Merge branch 'github:main' into jorgectf/python/deserialization

.codeqlmanifest.json

@@ -6,6 +6,7 @@
         "*/ql/examples/qlpack.yml",
         "cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/qlpack.yml",
         "javascript/ql/experimental/adaptivethreatmodeling/lib/qlpack.yml",
+        "javascript/ql/experimental/adaptivethreatmodeling/modelbuilding/qlpack.yml",
         "javascript/ql/experimental/adaptivethreatmodeling/src/qlpack.yml",
         "csharp/ql/campaigns/Solorigate/lib/qlpack.yml",
         "csharp/ql/campaigns/Solorigate/src/qlpack.yml",

.gitattributes

@@ -50,4 +50,9 @@
 *.pdb -text
 
 java/ql/test/stubs/**/*.java linguist-generated=true
-java/ql/test/experimental/stubs/**/*.java linguist-generated=true
+java/ql/test/experimental/stubs/**/*.java linguist-generated=true
+
+# Generated test files - these are synced from the standard JavaScript libraries using
+# `javascript/ql/experimental/adaptivethreatmodeling/test/update_endpoint_test_files.py`.
+javascript/ql/experimental/adaptivethreatmodeling/test/endpoint_large_scale/autogenerated/**/*.js linguist-generated=true -merge
+javascript/ql/experimental/adaptivethreatmodeling/test/endpoint_large_scale/autogenerated/**/*.ts linguist-generated=true -merge

.github/workflows/codeql-analysis.yml

@@ -27,6 +27,11 @@ jobs:
       pull-requests: read
 
     steps:
+    - name: Setup dotnet
+      uses: actions/setup-dotnet@v1
+      with:
+        dotnet-version: 6.0.101
+
     - name: Checkout repository
       uses: actions/checkout@v2
 
@@ -51,7 +56,7 @@ jobs:
     #    uses a compiled language
 
     - run: |
-       dotnet build csharp
+       dotnet build csharp /p:UseSharedCompilation=false
 
     - name: Perform CodeQL Analysis
       uses: github/codeql-action/analyze@main

.github/workflows/js-ml-tests.yml

@@ -0,0 +1,67 @@
+name: JS ML-powered queries tests
+
+on:
+  push:
+    paths:
+      - "javascript/ql/experimental/adaptivethreatmodeling/**"
+      - .github/workflows/js-ml-tests.yml
+    branches:
+      - main
+      - "rc/*"
+  pull_request:
+    paths:
+      - "javascript/ql/experimental/adaptivethreatmodeling/**"
+      - .github/workflows/js-ml-tests.yml
+
+defaults:
+  run:
+    working-directory: javascript/ql/experimental/adaptivethreatmodeling
+
+jobs:
+  qlformat:
+    name: Check QL formatting
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+
+      - uses: ./.github/actions/fetch-codeql
+
+      - name: Check QL formatting
+        run: |
+          find . "(" -name "*.ql" -or -name "*.qll" ")" -print0 | \
+            xargs -0 codeql query format --check-only
+
+  qlcompile:
+    name: Check QL compilation
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+
+      - uses: ./.github/actions/fetch-codeql
+
+      - name: Check QL compilation
+        run: |
+          codeql query compile \
+            --check-only \
+            --ram 5120 \
+            --additional-packs "${{ github.workspace }}" \
+            --threads=0 \
+            -- \
+            lib modelbuilding src
+
+  qltest:
+    name: Run QL tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+
+      - uses: ./.github/actions/fetch-codeql
+
+      - name: Run QL tests
+        run: |
+          codeql test run \
+            --threads=0 \
+            --ram 5120 \
+            --additional-packs "${{ github.workspace }}" \
+            -- \
+            test

.github/workflows/mad_modelDiff.yml

@@ -0,0 +1,103 @@
+name: Models as Data - Diff
+
+on:
+  workflow_dispatch:
+    inputs:
+      projects:
+        description: "The projects to generate models for"
+        required: true
+        default: '["netty/netty"]'
+  pull_request:
+    branches:
+      - main
+    paths:
+      - "java/ql/src/utils/model-generator/**/*.*"
+      - ".github/workflows/mad_modelDiff.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  model-diff:
+    name: Model Difference
+    runs-on: ubuntu-latest
+    if: github.repository == 'github/codeql'
+    strategy:
+      matrix:
+        slug: ${{fromJson(github.event.inputs.projects || '["apache/commons-codec", "apache/commons-io", "apache/commons-beanutils", "apache/commons-logging", "apache/commons-fileupload", "apache/commons-lang", "apache/commons-validator", "apache/commons-csv", "apache/dubbo"]' )}}
+    steps:
+      - name: Clone github/codeql from PR
+        uses: actions/checkout@v2
+        if: github.event.pull_request
+        with:
+          path: codeql-pr
+      - name: Clone github/codeql from main
+        uses: actions/checkout@v2
+        with:
+          path: codeql-main
+          ref: main
+      - uses: ./codeql-main/.github/actions/fetch-codeql
+      - name: Download database
+        env:
+          SLUG: ${{ matrix.slug }}
+        run: |
+          set -x
+          mkdir lib-dbs
+          SHORTNAME=${SLUG//[^a-zA-Z0-9_]/}
+          projectId=`curl -s https://lgtm.com/api/v1.0/projects/g/${SLUG} | jq .id`
+          curl -L "https://lgtm.com/api/v1.0/snapshots/$projectId/java" -o "$SHORTNAME.zip"
+          unzip -q -d "${SHORTNAME}-db" "${SHORTNAME}.zip"
+          mkdir "lib-dbs/$SHORTNAME/"
+          mv "${SHORTNAME}-db/"$(ls -1 "${SHORTNAME}"-db)/* "lib-dbs/${SHORTNAME}/"
+      - name: Generate Models (PR and main)
+        run: |
+          set -x
+          mkdir tmp-models
+          MODELS=`pwd`/tmp-models
+          DATABASES=`pwd`/lib-dbs
+
+          analyzeDatabaseWithCheckout() {
+            QL_VARIANT=$1
+            DATABASE=$2
+            cd codeql-$QL_VARIANT
+            SHORTNAME=`basename $DATABASE`
+            python java/ql/src/utils/model-generator/GenerateFlowModel.py $DATABASE $MODELS/${SHORTNAME}.qll
+            mv $MODELS/${SHORTNAME}.qll $MODELS/${SHORTNAME}Generated_${QL_VARIANT}.qll
+            cd ..
+          }
+
+          for d in $DATABASES/*/ ; do
+            ls -1 "$d"
+
+            analyzeDatabaseWithCheckout "main" $d
+            if [[ "$GITHUB_EVENT_NAME" == "pull_request" ]]
+            then
+              analyzeDatabaseWithCheckout "pr" $d
+            fi
+          done
+      - name: Install diff2html
+        if: github.event.pull_request
+        run: |
+          npm install -g diff2html-cli
+      - name: Generate Model Diff
+        if: github.event.pull_request
+        run: |
+          set -x
+          MODELS=`pwd`/tmp-models
+          ls -1 tmp-models/
+          for m in $MODELS/*_main.qll ; do
+            t="${m/main/"pr"}"
+            basename=`basename $m`
+            name="diff_${basename/_main.qll/""}"
+            (diff -w -u $m $t | diff2html -i stdin -F $MODELS/$name.html) || true
+          done
+      - uses: actions/upload-artifact@v2
+        with:
+          name: models
+          path: tmp-models/*.qll
+          retention-days: 20
+      - uses: actions/upload-artifact@v2
+        with:
+          name: diffs
+          path: tmp-models/*.html
+          retention-days: 20

.github/workflows/mad_regenerate-models.yml

@@ -0,0 +1,62 @@
+name: Regenerate framework models
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "30 2 * * *"
+  pull_request:
+    branches:
+      - main
+    paths:
+      - ".github/workflows/mad_regenerate-models.yml"
+
+jobs:
+  regenerate-models:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        # placeholder required for each axis, excluded below, replaced by the actual combinations (see include)
+        slug: ["placeholder"]
+        ref: ["placeholder"]
+        include:
+          - slug: "apache/commons-io"
+            ref: "8985de8fe74f6622a419b37a6eed0dbc484dc128"
+        exclude:
+          - slug: "placeholder"
+            ref: "placeholder"
+    steps:
+      - name: Clone self (github/codeql)
+        uses: actions/checkout@v2
+      - name: Setup CodeQL binaries
+        uses: ./.github/actions/fetch-codeql
+      - name: Clone repositories
+        uses: actions/checkout@v2
+        with:
+          path: repos/${{ matrix.ref }}
+          ref: ${{ matrix.ref }}
+          repository: ${{ matrix.slug }}
+      - name: Build database
+        env:
+          SLUG: ${{ matrix.slug }}
+          REF: ${{ matrix.ref }}
+        run: |
+          mkdir dbs
+          cd repos/${REF}
+          SHORTNAME=${SLUG//[^a-zA-Z0-9_]/}
+          codeql database create --language=java ../../dbs/${SHORTNAME}
+      - name: Regenerate models in-place
+        env:
+          SLUG: ${{ matrix.slug }}
+        run: |
+          SHORTNAME=${SLUG//[^a-zA-Z0-9_]/}
+          java/ql/src/utils/model-generator/RegenerateModels.py "${SLUG}" dbs/${SHORTNAME}
+      - name: Stage changes
+        run: |
+          find java -name "*.qll" -print0 | xargs -0 git add
+          git status
+          git diff --cached > models.patch
+      - uses: actions/upload-artifact@v2
+        with:
+          name: patch
+          path: models.patch
+          retention-days: 7

.github/workflows/ql-for-ql-build.yml

@@ -189,4 +189,11 @@ jobs:
         uses: github/codeql-action/analyze@erik-krogh/ql
         with: 
           category: "ql-for-ql-${{ matrix.folder }}"
+      - name: Copy sarif file to CWD
+        run: cp ../results/ql.sarif ./${{ matrix.folder }}.sarif
+      - name: Sarif as artifact
+        uses: actions/upload-artifact@v2
+        with:
+          name: ${{ matrix.folder }}.sarif
+          path: ${{ matrix.folder }}.sarif
 

.github/workflows/ql-for-ql-dataset_measure.yml

@@ -17,7 +17,7 @@ jobs:
       CODEQL_THREADS: 4 # TODO: remove this once it's set by the CLI
     strategy:
       matrix:
-        repo: 
+        repo:
           - github/codeql
           - github/codeql-go
     runs-on: ubuntu-latest
@@ -35,7 +35,7 @@ jobs:
             ~/.cargo/registry
             ~/.cargo/git
             ql/target
-          key: ${{ runner.os }}-qltest-cargo-${{ hashFiles('**/Cargo.lock') }}
+          key: ${{ runner.os }}-qltest-cargo-${{ hashFiles('ql/**/Cargo.lock') }}
       - name: Build Extractor
         run: cd ql; env "PATH=$PATH:`dirname ${CODEQL}`" ./create-extractor-pack.sh
         env:

.github/workflows/ql-for-ql-tests.yml

@@ -29,24 +29,24 @@ jobs:
             ~/.cargo/registry
             ~/.cargo/git
             ql/target
-          key: ${{ runner.os }}-qltest-cargo-${{ hashFiles('**/Cargo.lock') }}
+          key: ${{ runner.os }}-qltest-cargo-${{ hashFiles('ql/**/Cargo.lock') }}
       - name: Build extractor
         run: |
           cd ql;
           codeqlpath=$(dirname ${{ steps.find-codeql.outputs.codeql-path }});
           env "PATH=$PATH:$codeqlpath" ./create-extractor-pack.sh
       - name: Run QL tests
-        run: | 
+        run: |
           "${CODEQL}" test run --check-databases --check-unused-labels --check-repeated-labels --check-redefined-labels --check-use-before-definition --search-path "${{ github.workspace }}/ql/extractor-pack" --consistency-queries ql/ql/consistency-queries ql/ql/test
         env:
           CODEQL: ${{ steps.find-codeql.outputs.codeql-path }}
       - name: Check QL formatting
-        run: | 
+        run: |
           find ql/ql "(" -name "*.ql" -or -name "*.qll" ")" -print0 | xargs -0 "${CODEQL}" query format --check-only
         env:
           CODEQL: ${{ steps.find-codeql.outputs.codeql-path }}
       - name: Check QL compilation
-        run: | 
+        run: |
           "${CODEQL}" query compile --check-only --threads=4 --warnings=error --search-path "${{ github.workspace }}/ql/extractor-pack" "ql/ql/src" "ql/ql/examples"
         env:
           CODEQL: ${{ steps.find-codeql.outputs.codeql-path }}

.github/workflows/ruby-build.yml

@@ -50,7 +50,7 @@ jobs:
             ~/.cargo/registry
             ~/.cargo/git
             ruby/target
-          key: ${{ runner.os }}-rust-cargo-${{ hashFiles('**/Cargo.lock') }}
+          key: ${{ runner.os }}-ruby-rust-cargo-${{ hashFiles('ruby/rust-toolchain.toml', 'ruby/**/Cargo.lock') }}
       - name: Check formatting
         run: cargo fmt --all -- --check
       - name: Build

.github/workflows/ruby-qltest.yml

@@ -24,27 +24,45 @@ defaults:
     working-directory: ruby
 
 jobs:
-  qltest:
+  qlformat:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
       - uses: ./.github/actions/fetch-codeql
-      - uses: ./ruby/actions/create-extractor-pack
-      - name: Run QL tests
-        run: |
-          codeql test run --threads=0 --ram 5000 --search-path "${{ github.workspace }}/ruby/extractor-pack" --check-databases --check-unused-labels --check-repeated-labels --check-redefined-labels --check-use-before-definition --consistency-queries ql/consistency-queries ql/test
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
       - name: Check QL formatting
         run: find ql "(" -name "*.ql" -or -name "*.qll" ")" -print0 | xargs -0 codeql query format --check-only
+  qlcompile:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - uses: ./.github/actions/fetch-codeql
       - name: Check QL compilation
         run: |
           codeql query compile --check-only --threads=0 --ram 5000 --warnings=error "ql/src" "ql/examples"
         env:
           GITHUB_TOKEN: ${{ github.token }}
+  qlupgrade:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - uses: ./.github/actions/fetch-codeql
       - name: Check DB upgrade scripts
         run: |
           echo >empty.trap
           codeql dataset import -S ql/lib/upgrades/initial/ruby.dbscheme testdb empty.trap
           codeql dataset upgrade testdb --additional-packs ql/lib
           diff -q testdb/ruby.dbscheme ql/lib/ruby.dbscheme
+  qltest:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        slice: ["1/2", "2/2"]
+    steps:
+      - uses: actions/checkout@v2
+      - uses: ./.github/actions/fetch-codeql
+      - uses: ./ruby/actions/create-extractor-pack
+      - name: Run QL tests
+        run: |
+          codeql test run --threads=0 --ram 5000 --slice ${{ matrix.slice }} --search-path "${{ github.workspace }}/ruby/extractor-pack" --check-databases --check-unused-labels --check-repeated-labels --check-redefined-labels --check-use-before-definition --consistency-queries ql/consistency-queries ql/test
+        env:
+          GITHUB_TOKEN: ${{ github.token }}

cpp/autobuilder/Semmle.Autobuild.Cpp.Tests/Semmle.Autobuild.Cpp.Tests.csproj

@@ -2,7 +2,7 @@
 
   <PropertyGroup>
     <OutputType>Exe</OutputType>
-    <TargetFramework>net5.0</TargetFramework>
+    <TargetFramework>net6.0</TargetFramework>
     <GenerateAssemblyInfo>false</GenerateAssemblyInfo>
     <RuntimeIdentifiers>win-x64;linux-x64;osx-x64</RuntimeIdentifiers>
     <Nullable>enable</Nullable>

cpp/autobuilder/Semmle.Autobuild.Cpp/Semmle.Autobuild.Cpp.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
-    <TargetFramework>net5.0</TargetFramework>
+    <TargetFramework>net6.0</TargetFramework>
     <AssemblyName>Semmle.Autobuild.Cpp</AssemblyName>
     <RootNamespace>Semmle.Autobuild.Cpp</RootNamespace>
     <ApplicationIcon />

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplCommon.qll

@@ -1290,7 +1290,7 @@ class DataFlowCallOption extends TDataFlowCallOption {
   }
 }
 
-/** Content tagged with the type of a containing object. */
+/** A `Content` tagged with the type of a containing object. */
 class TypedContent extends MkTypedContent {
   private Content c;
   private DataFlowType t;

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll

@@ -592,12 +592,14 @@ predicate simpleLocalFlowStep(Node nodeFrom, Node nodeTo) {
  * Holds if data flows from `source` to `sink` in zero or more local
  * (intra-procedural) steps.
  */
+pragma[inline]
 predicate localFlow(Node source, Node sink) { localFlowStep*(source, sink) }
 
 /**
  * Holds if data can flow from `e1` to `e2` in zero or more
  * local (intra-procedural) steps.
  */
+pragma[inline]
 predicate localExprFlow(Expr e1, Expr e2) { localFlow(exprNode(e1), exprNode(e2)) }
 
 /**

cpp/ql/lib/semmle/code/cpp/dataflow/internal/TaintTrackingUtil.qll

@@ -124,12 +124,14 @@ predicate localAdditionalTaintStep(DataFlow::Node nodeFrom, DataFlow::Node nodeT
  * Holds if taint may propagate from `source` to `sink` in zero or more local
  * (intra-procedural) steps.
  */
+pragma[inline]
 predicate localTaint(DataFlow::Node source, DataFlow::Node sink) { localTaintStep*(source, sink) }
 
 /**
  * Holds if taint can flow from `e1` to `e2` in zero or more
  * local (intra-procedural) steps.
  */
+pragma[inline]
 predicate localExprTaint(Expr e1, Expr e2) {
   localTaint(DataFlow::exprNode(e1), DataFlow::exprNode(e2))
 }

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplCommon.qll

@@ -1290,7 +1290,7 @@ class DataFlowCallOption extends TDataFlowCallOption {
   }
 }
 
-/** Content tagged with the type of a containing object. */
+/** A `Content` tagged with the type of a containing object. */
 class TypedContent extends MkTypedContent {
   private Content c;
   private DataFlowType t;

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll

@@ -1032,12 +1032,14 @@ SideEffectInstruction getSideEffectFor(CallInstruction call, int argument) {
  * Holds if data flows from `source` to `sink` in zero or more local
  * (intra-procedural) steps.
  */
+pragma[inline]
 predicate localFlow(Node source, Node sink) { localFlowStep*(source, sink) }
 
 /**
  * Holds if data can flow from `i1` to `i2` in zero or more
  * local (intra-procedural) steps.
  */
+pragma[inline]
 predicate localInstructionFlow(Instruction e1, Instruction e2) {
   localFlow(instructionNode(e1), instructionNode(e2))
 }
@@ -1046,6 +1048,7 @@ predicate localInstructionFlow(Instruction e1, Instruction e2) {
  * Holds if data can flow from `e1` to `e2` in zero or more
  * local (intra-procedural) steps.
  */
+pragma[inline]
 predicate localExprFlow(Expr e1, Expr e2) { localFlow(exprNode(e1), exprNode(e2)) }
 
 private newtype TContent =

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/TaintTrackingUtil.qll

@@ -121,12 +121,14 @@ private predicate operandToInstructionTaintStep(Operand opFrom, Instruction inst
  * Holds if taint may propagate from `source` to `sink` in zero or more local
  * (intra-procedural) steps.
  */
+pragma[inline]
 predicate localTaint(DataFlow::Node source, DataFlow::Node sink) { localTaintStep*(source, sink) }
 
 /**
  * Holds if taint can flow from `i1` to `i2` in zero or more
  * local (intra-procedural) steps.
  */
+pragma[inline]
 predicate localInstructionTaint(Instruction i1, Instruction i2) {
   localTaint(DataFlow::instructionNode(i1), DataFlow::instructionNode(i2))
 }
@@ -135,6 +137,7 @@ predicate localInstructionTaint(Instruction i1, Instruction i2) {
  * Holds if taint can flow from `e1` to `e2` in zero or more
  * local (intra-procedural) steps.
  */
+pragma[inline]
 predicate localExprTaint(Expr e1, Expr e2) {
   localTaint(DataFlow::exprNode(e1), DataFlow::exprNode(e2))
 }

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedElement.qll

@@ -567,6 +567,13 @@ newtype TTranslatedElement =
   } or
   // The initialization of a base class from within a constructor.
   TTranslatedConstructorBaseInit(ConstructorBaseInit init) { not ignoreExpr(init) } or
+  // Workaround for a case where no base constructor is generated but a targetless base
+  // constructor call is present.
+  TTranslatedConstructorBareInit(ConstructorInit init) {
+    not ignoreExpr(init) and
+    not init instanceof ConstructorBaseInit and
+    not init instanceof ConstructorFieldInit
+  } or
   // The destruction of a base class from within a destructor.
   TTranslatedDestructorBaseDestruction(DestructorBaseDestruction destruction) {
     not ignoreExpr(destruction)

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedFunction.qll

@@ -573,6 +573,11 @@ class TranslatedConstructorInitList extends TranslatedElement, InitializationCon
       baseInit = func.(Constructor).getInitializer(id) and
       result = getTranslatedConstructorBaseInit(baseInit)
     )
+    or
+    exists(ConstructorInit bareInit |
+      bareInit = func.(Constructor).getInitializer(id) and
+      result = getTranslatedConstructorBareInit(bareInit)
+    )
   }
 
   override Instruction getFirstInstruction() {

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedInitialization.qll

@@ -917,3 +917,36 @@ class TranslatedDestructorBaseDestruction extends TranslatedBaseStructorCall,
 
   final override string toString() { result = "destroy base: " + call.toString() }
 }
+
+/**
+ * A constructor base init call where no base constructor has been generated.
+ *
+ * Workaround for an extractor issue.
+ */
+class TranslatedConstructorBareInit extends TranslatedElement, TTranslatedConstructorBareInit {
+  ConstructorInit init;
+
+  TranslatedConstructorBareInit() { this = TTranslatedConstructorBareInit(init) }
+
+  override Locatable getAST() { result = init }
+
+  final override string toString() { result = "construct base (no constructor)" }
+
+  override Instruction getFirstInstruction() { result = getParent().getChildSuccessor(this) }
+
+  override predicate hasInstruction(Opcode opcode, InstructionTag tag, CppType resultType) {
+    none()
+  }
+
+  override TranslatedElement getChild(int id) { none() }
+
+  override Function getFunction() { result = getParent().getFunction() }
+
+  override Instruction getInstructionSuccessor(InstructionTag tag, EdgeKind kind) { none() }
+
+  override Instruction getChildSuccessor(TranslatedElement child) { none() }
+}
+
+TranslatedConstructorBareInit getTranslatedConstructorBareInit(ConstructorInit init) {
+  result.getAST() = init
+}

cpp/ql/lib/tutorial.qll

@@ -6,122 +6,22 @@
  */
 class Person extends string {
   Person() {
-    this = "Ronil" or
+    this =
-    this = "Dina" or
+      [
-    this = "Ravi" or
+        "Ronil", "Dina", "Ravi", "Bruce", "Jo", "Aida", "Esme", "Charlie", "Fred", "Meera", "Maya",
-    this = "Bruce" or
+        "Chad", "Tiana", "Laura", "George", "Will", "Mary", "Almira", "Susannah", "Rhoda",
-    this = "Jo" or
+        "Cynthia", "Eunice", "Olive", "Virginia", "Angeline", "Helen", "Cornelia", "Harriet",
-    this = "Aida" or
+        "Mahala", "Abby", "Margaret", "Deb", "Minerva", "Severus", "Lavina", "Adeline", "Cath",
-    this = "Esme" or
+        "Elisa", "Lucretia", "Anne", "Eleanor", "Joanna", "Adam", "Agnes", "Rosanna", "Clara",
-    this = "Charlie" or
+        "Melissa", "Amy", "Isabel", "Jemima", "Cordelia", "Melinda", "Delila", "Jeremiah", "Elijah",
-    this = "Fred" or
+        "Hester", "Walter", "Oliver", "Hugh", "Aaron", "Reuben", "Eli", "Amos", "Augustus",
-    this = "Meera" or
+        "Theodore", "Ira", "Timothy", "Cyrus", "Horace", "Simon", "Asa", "Frank", "Nelson",
-    this = "Maya" or
+        "Leonard", "Harrison", "Anthony", "Louis", "Milton", "Noah", "Cornelius", "Abdul", "Warren",
-    this = "Chad" or
+        "Harvey", "Dennis", "Wesley", "Sylvester", "Gilbert", "Sullivan", "Edmund", "Wilson",
-    this = "Tiana" or
+        "Perry", "Matthew", "Simba", "Nala", "Rafiki", "Shenzi", "Ernest", "Gertrude", "Oscar",
-    this = "Laura" or
+        "Lilian", "Raymond", "Elgar", "Elmer", "Herbert", "Maude", "Mae", "Otto", "Edwin",
-    this = "George" or
+        "Ophelia", "Parsley", "Sage", "Rosemary", "Thyme", "Garfunkel", "King Basil", "Stephen"
-    this = "Will" or
+      ]
-    this = "Mary" or
-    this = "Almira" or
-    this = "Susannah" or
-    this = "Rhoda" or
-    this = "Cynthia" or
-    this = "Eunice" or
-    this = "Olive" or
-    this = "Virginia" or
-    this = "Angeline" or
-    this = "Helen" or
-    this = "Cornelia" or
-    this = "Harriet" or
-    this = "Mahala" or
-    this = "Abby" or
-    this = "Margaret" or
-    this = "Deb" or
-    this = "Minerva" or
-    this = "Severus" or
-    this = "Lavina" or
-    this = "Adeline" or
-    this = "Cath" or
-    this = "Elisa" or
-    this = "Lucretia" or
-    this = "Anne" or
-    this = "Eleanor" or
-    this = "Joanna" or
-    this = "Adam" or
-    this = "Agnes" or
-    this = "Rosanna" or
-    this = "Clara" or
-    this = "Melissa" or
-    this = "Amy" or
-    this = "Isabel" or
-    this = "Jemima" or
-    this = "Cordelia" or
-    this = "Melinda" or
-    this = "Delila" or
-    this = "Jeremiah" or
-    this = "Elijah" or
-    this = "Hester" or
-    this = "Walter" or
-    this = "Oliver" or
-    this = "Hugh" or
-    this = "Aaron" or
-    this = "Reuben" or
-    this = "Eli" or
-    this = "Amos" or
-    this = "Augustus" or
-    this = "Theodore" or
-    this = "Ira" or
-    this = "Timothy" or
-    this = "Cyrus" or
-    this = "Horace" or
-    this = "Simon" or
-    this = "Asa" or
-    this = "Frank" or
-    this = "Nelson" or
-    this = "Leonard" or
-    this = "Harrison" or
-    this = "Anthony" or
-    this = "Louis" or
-    this = "Milton" or
-    this = "Noah" or
-    this = "Cornelius" or
-    this = "Abdul" or
-    this = "Warren" or
-    this = "Harvey" or
-    this = "Dennis" or
-    this = "Wesley" or
-    this = "Sylvester" or
-    this = "Gilbert" or
-    this = "Sullivan" or
-    this = "Edmund" or
-    this = "Wilson" or
-    this = "Perry" or
-    this = "Matthew" or
-    this = "Simba" or
-    this = "Nala" or
-    this = "Rafiki" or
-    this = "Shenzi" or
-    this = "Ernest" or
-    this = "Gertrude" or
-    this = "Oscar" or
-    this = "Lilian" or
-    this = "Raymond" or
-    this = "Elgar" or
-    this = "Elmer" or
-    this = "Herbert" or
-    this = "Maude" or
-    this = "Mae" or
-    this = "Otto" or
-    this = "Edwin" or
-    this = "Ophelia" or
-    this = "Parsley" or
-    this = "Sage" or
-    this = "Rosemary" or
-    this = "Thyme" or
-    this = "Garfunkel" or
-    this = "King Basil" or
-    this = "Stephen"
   }
 
   /** Gets the hair color of the person. If the person is bald, there is no result. */
@@ -936,25 +836,12 @@ class Person extends string {
 
   /** Holds if the person is deceased. */
   predicate isDeceased() {
-    this = "Ernest" or
+    this =
-    this = "Gertrude" or
+      [
-    this = "Oscar" or
+        "Ernest", "Gertrude", "Oscar", "Lilian", "Edwin", "Raymond", "Elgar", "Elmer", "Herbert",
-    this = "Lilian" or
+        "Maude", "Mae", "Otto", "Ophelia", "Parsley", "Sage", "Rosemary", "Thyme", "Garfunkel",
-    this = "Edwin" or
+        "King Basil"
-    this = "Raymond" or
+      ]
-    this = "Elgar" or
-    this = "Elmer" or
-    this = "Herbert" or
-    this = "Maude" or
-    this = "Mae" or
-    this = "Otto" or
-    this = "Ophelia" or
-    this = "Parsley" or
-    this = "Sage" or
-    this = "Rosemary" or
-    this = "Thyme" or
-    this = "Garfunkel" or
-    this = "King Basil"
   }
 
   /** Gets a parent of the person (alive or deceased). */
@@ -1195,12 +1082,7 @@ class Person extends string {
   }
 
   /** Holds if the person is allowed in the region. Initially, all villagers are allowed in every region. */
-  predicate isAllowedIn(string region) {
+  predicate isAllowedIn(string region) { region = ["north", "south", "east", "west"] }
-    region = "north" or
-    region = "south" or
-    region = "east" or
-    region = "west"
-  }
 }
 
 /** Returns a parent of the person. */

cpp/ql/src/Likely Bugs/Memory Management/ReturnStackAllocatedMemory.ql

@@ -14,6 +14,9 @@
  */
 
 import cpp
+// We don't actually use the global value numbering library in this query, but without it we end up
+// recomputing the IR.
+private import semmle.code.cpp.valuenumbering.GlobalValueNumbering
 import semmle.code.cpp.ir.IR
 import semmle.code.cpp.ir.dataflow.DataFlow::DataFlow
 

cpp/ql/src/Security/CWE/CWE-311/CleartextTransmission.ql

@@ -5,7 +5,7 @@
  * @kind path-problem
  * @problem.severity warning
  * @security-severity 7.5
- * @precision medium
+ * @precision high
  * @id cpp/cleartext-transmission
  * @tags security
  *       external/cwe/cwe-319
@@ -14,8 +14,8 @@
 import cpp
 import semmle.code.cpp.security.SensitiveExprs
 import semmle.code.cpp.dataflow.TaintTracking
-import semmle.code.cpp.valuenumbering.GlobalValueNumbering
 import semmle.code.cpp.models.interfaces.FlowSource
+import semmle.code.cpp.commons.File
 import DataFlow::PathGraph
 
 /**
@@ -27,6 +27,7 @@ class SensitiveNode extends DataFlow::Node {
     this.asExpr() = any(SensitiveVariable sv).getInitializer().getExpr() or
     this.asExpr().(VariableAccess).getTarget() =
       any(SensitiveVariable sv).(GlobalOrNamespaceVariable) or
+    this.asExpr().(VariableAccess).getTarget() = any(SensitiveVariable v | v instanceof Field) or
     this.asUninitialized() instanceof SensitiveVariable or
     this.asParameter() instanceof SensitiveVariable or
     this.asExpr().(FunctionCall).getTarget() instanceof SensitiveFunction
@@ -120,24 +121,32 @@ abstract class NetworkSendRecv extends FunctionCall {
   NetworkSendRecv() {
     this.getTarget() = target and
     // exclude calls based on the socket...
-    not exists(GVN g |
+    not exists(DataFlow::Node src, DataFlow::Node dest |
-      g = globalValueNumber(target.getSocketExpr(this)) and
+      DataFlow::localFlow(src, dest) and
+      dest.asExpr() = target.getSocketExpr(this) and
       (
         // literal constant
-        globalValueNumber(any(Literal l)) = g
+        src.asExpr() instanceof Literal
         or
         // variable (such as a global) initialized to a literal constant
         exists(Variable v |
           v.getInitializer().getExpr() instanceof Literal and
-          g = globalValueNumber(v.getAnAccess())
+          src.asExpr() = v.getAnAccess()
         )
         or
         // result of a function call with literal inputs (likely constant)
+        forex(Expr arg | arg = src.asExpr().(FunctionCall).getAnArgument() | arg instanceof Literal)
+        or
+        // variable called `stdin`, `stdout` or `stderr`
+        src.asExpr().(VariableAccess).getTarget().getName() = ["stdin", "stdout", "stderr"]
+        or
+        // open of `"/dev/tty"`
         exists(FunctionCall fc |
-          forex(Expr arg | arg = fc.getAnArgument() | arg instanceof Literal) and
+          fopenCall(fc) and
-          g = globalValueNumber(fc)
+          fc.getAnArgument().getValue() = "/dev/tty" and
+          src.asExpr() = fc
         )
-        // (this is far from exhaustive)
+        // (this is not exhaustive)
       )
     )
   }

cpp/ql/src/change-notes/2022-01-22-cleartext-transmission.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The "Cleartext transmission of sensitive information" (`cpp/cleartext-transmission`) query now finds more results, where a password is stored in a struct field or class member variable.

cpp/ql/src/change-notes/2022-02-22-cleartext-transmission.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The "Cleartext transmission of sensitive information" (`cpp/cleartext-transmission`) query has been further improved to reduce false positive results, and upgraded from `medium` to `high` precision.

cpp/ql/src/experimental/Best Practices/UselessTest.cpp

@@ -0,0 +1,9 @@
+void test(){
+    int a = 8;
+    int b = 9;
+
+    //Useless NonEquals
+    if(a==8 && a != 7) {}
+
+    while(a==8 && a!=7){}
+}

cpp/ql/src/experimental/Best Practices/UselessTest.qhelp

@@ -0,0 +1,18 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+
+<overview>
+<p>Comparison operations like <code>a==8 &amp;&amp; a!=7</code> contain a useless part : the non-equal part. This rule finds tests of this kind within an <code>if</code> or a <code>while</code> statement</p>
+</overview>
+
+<recommendation>
+<p>Remove the useless comparisons</p>
+</recommendation>
+
+<example>
+<sample src="UselessTest.cpp" />
+</example>
+
+</qhelp>

cpp/ql/src/experimental/Best Practices/UselessTest.ql

@@ -0,0 +1,43 @@
+/**
+ * @name Useless Test
+ * @description A boolean condition that is guaranteed to never be evaluated should be deleted.
+ * @kind problem
+ * @problem.severity warning
+ * @id cpp/uselesstest
+ * @tags reliability
+ *       readability
+ */
+
+import cpp
+import semmle.code.cpp.valuenumbering.GlobalValueNumbering
+
+predicate sameExpr(Expr e1, Expr e2) { globalValueNumber(e1).getAnExpr() = e2 }
+
+Element nearestParent(Expr e) {
+  if
+    e.getParent().(Expr).getConversion*() instanceof ParenthesisExpr or
+    e.getParent() instanceof IfStmt or
+    e.getParent() instanceof WhileStmt
+  then result = e.getParent()
+  else result = nearestParent(e.getParent())
+}
+
+from LogicalAndExpr b, EQExpr eq, NEExpr ne
+where
+  (
+    b.getAChild*() = eq and
+    b.getAChild*() = ne and
+    eq.getParent() instanceof LogicalAndExpr and
+    ne.getParent() instanceof LogicalAndExpr
+  ) and
+  (
+    eq.getLeftOperand() instanceof VariableAccess and ne.getLeftOperand() instanceof VariableAccess
+    or
+    eq.getLeftOperand() instanceof PointerDereferenceExpr and
+    ne.getLeftOperand() instanceof PointerDereferenceExpr
+  ) and
+  eq.getRightOperand() instanceof Literal and
+  ne.getRightOperand() instanceof Literal and
+  nearestParent(eq) = nearestParent(ne) and
+  sameExpr(eq.getLeftOperand(), ne.getLeftOperand())
+select ne, "Useless Test"

cpp/ql/test/TestUtilities/InlineExpectationsTest.qll

@@ -93,7 +93,7 @@
 private import InlineExpectationsTestPrivate
 
 /**
- * Base class for tests with inline expectations. The test extends this class to provide the actual
+ * The base class for tests with inline expectations. The test extends this class to provide the actual
  * results of the query, which are then compared with the expected results in comments to produce a
  * list of failure messages that point out where the actual results differ from the expected
  * results.
@@ -123,6 +123,15 @@ abstract class InlineExpectationsTest extends string {
    */
   abstract predicate hasActualResult(Location location, string element, string tag, string value);
 
+  /**
+   * Like `hasActualResult`, but returns results that do not require a matching annotation.
+   * A failure will still arise if there is an annotation that does not match any results, but not vice versa.
+   * Override this predicate to specify optional results.
+   */
+  predicate hasOptionalResult(Location location, string element, string tag, string value) {
+    none()
+  }
+
   final predicate hasFailureMessage(FailureLocatable element, string message) {
     exists(ActualResult actualResult |
       actualResult.getTest() = this and
@@ -134,7 +143,8 @@ abstract class InlineExpectationsTest extends string {
         )
         or
         not exists(ValidExpectation expectation | expectation.matchesActualResult(actualResult)) and
-        message = "Unexpected result: " + actualResult.getExpectationText()
+        message = "Unexpected result: " + actualResult.getExpectationText() and
+        not actualResult.isOptional()
       )
     )
     or
@@ -243,9 +253,13 @@ private string expectationPattern() {
 
 private newtype TFailureLocatable =
   TActualResult(
-    InlineExpectationsTest test, Location location, string element, string tag, string value
+    InlineExpectationsTest test, Location location, string element, string tag, string value,
+    boolean optional
   ) {
-    test.hasActualResult(location, element, tag, value)
+    test.hasActualResult(location, element, tag, value) and
+    optional = false
+    or
+    test.hasOptionalResult(location, element, tag, value) and optional = true
   } or
   TValidExpectation(ExpectationComment comment, string tag, string value, string knownFailure) {
     exists(TColumn column, string tags |
@@ -277,8 +291,9 @@ class ActualResult extends FailureLocatable, TActualResult {
   string element;
   string tag;
   string value;
+  boolean optional;
 
-  ActualResult() { this = TActualResult(test, location, element, tag, value) }
+  ActualResult() { this = TActualResult(test, location, element, tag, value, optional) }
 
   override string toString() { result = element }
 
@@ -289,6 +304,8 @@ class ActualResult extends FailureLocatable, TActualResult {
   override string getTag() { result = tag }
 
   override string getValue() { result = value }
+
+  predicate isOptional() { optional = true }
 }
 
 abstract private class Expectation extends FailureLocatable {

cpp/ql/test/library-tests/ir/ir/PrintAST.expected

@@ -11332,6 +11332,64 @@ ir.cpp:
 # 1447|                         Type = [Struct] POD_Derived
 # 1447|                         ValueCategory = prvalue
 # 1448|     getStmt(4): [ReturnStmt] return ...
+# 1450| [CopyAssignmentOperator] Inheritance_Test_B& Inheritance_Test_B::operator=(Inheritance_Test_B const&)
+# 1450|   <params>: 
+#-----|     getParameter(0): [Parameter] (unnamed parameter 0)
+#-----|         Type = [LValueReferenceType] const Inheritance_Test_B &
+# 1450| [Constructor] void Inheritance_Test_B::Inheritance_Test_B()
+# 1450|   <params>: 
+# 1451| [Destructor] void Inheritance_Test_B::~Inheritance_Test_B()
+# 1451|   <params>: 
+# 1451|   getEntryPoint(): [BlockStmt] { ... }
+# 1451|     getStmt(0): [ReturnStmt] return ...
+# 1451|   <destructions>: 
+# 1454| [CopyAssignmentOperator] Inheritance_Test_A& Inheritance_Test_A::operator=(Inheritance_Test_A const&)
+# 1454|   <params>: 
+#-----|     getParameter(0): [Parameter] (unnamed parameter 0)
+#-----|         Type = [LValueReferenceType] const Inheritance_Test_A &
+# 1454| [MoveAssignmentOperator] Inheritance_Test_A& Inheritance_Test_A::operator=(Inheritance_Test_A&&)
+# 1454|   <params>: 
+#-----|     getParameter(0): [Parameter] (unnamed parameter 0)
+#-----|         Type = [RValueReferenceType] Inheritance_Test_A &&
+# 1454| [CopyConstructor] void Inheritance_Test_A::Inheritance_Test_A(Inheritance_Test_A const&)
+# 1454|   <params>: 
+#-----|     getParameter(0): [Parameter] (unnamed parameter 0)
+#-----|         Type = [LValueReferenceType] const Inheritance_Test_A &
+# 1454| [MoveConstructor] void Inheritance_Test_A::Inheritance_Test_A(Inheritance_Test_A&&)
+# 1454|   <params>: 
+#-----|     getParameter(0): [Parameter] (unnamed parameter 0)
+#-----|         Type = [RValueReferenceType] Inheritance_Test_A &&
+# 1454| [Destructor] void Inheritance_Test_A::~Inheritance_Test_A()
+# 1454|   <params>: 
+# 1457| [Constructor] void Inheritance_Test_A::Inheritance_Test_A()
+# 1457|   <params>: 
+# 1457|   <initializations>: 
+# 1457|     getInitializer(0): (no string representation)
+# 1457|         Type = [Struct] Inheritance_Test_B
+# 1457|         ValueCategory = prvalue
+# 1457|     getInitializer(1): [ConstructorFieldInit] constructor init of field x
+# 1457|         Type = [IntType] int
+# 1457|         ValueCategory = prvalue
+# 1457|       getExpr(): [Literal] 42
+# 1457|           Type = [IntType] int
+# 1457|           Value = [Literal] 42
+# 1457|           ValueCategory = prvalue
+# 1457|   getEntryPoint(): [BlockStmt] { ... }
+# 1458|     getStmt(0): [ExprStmt] ExprStmt
+# 1458|       getExpr(): [AssignExpr] ... = ...
+# 1458|           Type = [IntType] int
+# 1458|           ValueCategory = lvalue
+# 1458|         getLValue(): [PointerFieldAccess] y
+# 1458|             Type = [IntType] int
+# 1458|             ValueCategory = lvalue
+# 1458|           getQualifier(): [ThisExpr] this
+# 1458|               Type = [PointerType] Inheritance_Test_A *
+# 1458|               ValueCategory = prvalue(load)
+# 1458|         getRValue(): [Literal] 3
+# 1458|             Type = [IntType] int
+# 1458|             Value = [Literal] 3
+# 1458|             ValueCategory = prvalue
+# 1459|     getStmt(1): [ReturnStmt] return ...
 perf-regression.cpp:
 #    4| [CopyAssignmentOperator] Big& Big::operator=(Big const&)
 #    4|   <params>: 

cpp/ql/test/library-tests/ir/ir/ir.cpp

@@ -1447,4 +1447,15 @@ void temporary_hierarchy() {
     float f = (returnValue<POD_Derived>()).f();
 }
 
+struct Inheritance_Test_B {
+  ~Inheritance_Test_B() {}
+};
+
+struct Inheritance_Test_A : public Inheritance_Test_B {
+  int x;
+  int y;
+  Inheritance_Test_A() : x(42) {
+    y = 3;
+  }
+};
 // semmle-extractor-options: -std=c++17 --clang

cpp/ql/test/library-tests/ir/ir/operand_locations.expected

@@ -6626,6 +6626,36 @@
 | ir.cpp:1447:44:1447:44 | ChiTotal | total:m1447_5 |
 | ir.cpp:1447:44:1447:44 | SideEffect | ~m1447_5 |
 | ir.cpp:1447:44:1447:44 | StoreValue | r1447_8 |
+| ir.cpp:1451:3:1451:21 | Address | &:r1451_5 |
+| ir.cpp:1451:3:1451:21 | Address | &:r1451_5 |
+| ir.cpp:1451:3:1451:21 | Address | &:r1451_7 |
+| ir.cpp:1451:3:1451:21 | Address | &:r1451_7 |
+| ir.cpp:1451:3:1451:21 | ChiPartial | partial:m1451_3 |
+| ir.cpp:1451:3:1451:21 | ChiTotal | total:m1451_2 |
+| ir.cpp:1451:3:1451:21 | Load | m1451_6 |
+| ir.cpp:1451:3:1451:21 | SideEffect | m1451_3 |
+| ir.cpp:1451:3:1451:21 | SideEffect | m1451_8 |
+| ir.cpp:1457:3:1457:20 | Address | &:r1457_5 |
+| ir.cpp:1457:3:1457:20 | Address | &:r1457_5 |
+| ir.cpp:1457:3:1457:20 | Address | &:r1457_7 |
+| ir.cpp:1457:3:1457:20 | Address | &:r1457_7 |
+| ir.cpp:1457:3:1457:20 | ChiPartial | partial:m1457_3 |
+| ir.cpp:1457:3:1457:20 | ChiTotal | total:m1457_2 |
+| ir.cpp:1457:3:1457:20 | Load | m1457_6 |
+| ir.cpp:1457:3:1457:20 | SideEffect | m1457_3 |
+| ir.cpp:1457:3:1457:20 | SideEffect | m1458_6 |
+| ir.cpp:1457:3:1457:20 | Unary | m1457_6 |
+| ir.cpp:1457:26:1457:30 | Address | &:r1457_9 |
+| ir.cpp:1457:26:1457:30 | ChiPartial | partial:m1457_11 |
+| ir.cpp:1457:26:1457:30 | ChiTotal | total:m1457_8 |
+| ir.cpp:1457:26:1457:30 | StoreValue | r1457_10 |
+| ir.cpp:1458:5:1458:5 | Address | &:r1458_2 |
+| ir.cpp:1458:5:1458:5 | Address | &:r1458_4 |
+| ir.cpp:1458:5:1458:5 | Load | m1457_6 |
+| ir.cpp:1458:5:1458:5 | Unary | r1458_3 |
+| ir.cpp:1458:5:1458:9 | ChiPartial | partial:m1458_5 |
+| ir.cpp:1458:5:1458:9 | ChiTotal | total:m1457_12 |
+| ir.cpp:1458:9:1458:9 | StoreValue | r1458_1 |
 | perf-regression.cpp:6:3:6:5 | Address | &:r6_5 |
 | perf-regression.cpp:6:3:6:5 | Address | &:r6_5 |
 | perf-regression.cpp:6:3:6:5 | Address | &:r6_7 |

cpp/ql/test/library-tests/ir/ir/raw_ir.expected

@@ -7858,6 +7858,44 @@ ir.cpp:
 # 1443|     v1443_5(void)               = AliasedUse                                        : ~m?
 # 1443|     v1443_6(void)               = ExitFunction                                      : 
 
+# 1451| void Inheritance_Test_B::~Inheritance_Test_B()
+# 1451|   Block 0
+# 1451|     v1451_1(void)                       = EnterFunction                : 
+# 1451|     mu1451_2(unknown)                   = AliasedDefinition            : 
+# 1451|     mu1451_3(unknown)                   = InitializeNonLocal           : 
+# 1451|     r1451_4(glval<unknown>)             = VariableAddress[#this]       : 
+# 1451|     mu1451_5(glval<Inheritance_Test_B>) = InitializeParameter[#this]   : &:r1451_4
+# 1451|     r1451_6(glval<Inheritance_Test_B>)  = Load[#this]                  : &:r1451_4, ~m?
+# 1451|     mu1451_7(Inheritance_Test_B)        = InitializeIndirection[#this] : &:r1451_6
+# 1451|     v1451_8(void)                       = NoOp                         : 
+# 1451|     v1451_9(void)                       = ReturnIndirection[#this]     : &:r1451_6, ~m?
+# 1451|     v1451_10(void)                      = ReturnVoid                   : 
+# 1451|     v1451_11(void)                      = AliasedUse                   : ~m?
+# 1451|     v1451_12(void)                      = ExitFunction                 : 
+
+# 1457| void Inheritance_Test_A::Inheritance_Test_A()
+# 1457|   Block 0
+# 1457|     v1457_1(void)                       = EnterFunction                : 
+# 1457|     mu1457_2(unknown)                   = AliasedDefinition            : 
+# 1457|     mu1457_3(unknown)                   = InitializeNonLocal           : 
+# 1457|     r1457_4(glval<unknown>)             = VariableAddress[#this]       : 
+# 1457|     mu1457_5(glval<Inheritance_Test_A>) = InitializeParameter[#this]   : &:r1457_4
+# 1457|     r1457_6(glval<Inheritance_Test_A>)  = Load[#this]                  : &:r1457_4, ~m?
+# 1457|     mu1457_7(Inheritance_Test_A)        = InitializeIndirection[#this] : &:r1457_6
+# 1457|     r1457_8(glval<int>)                 = FieldAddress[x]              : mu1457_5
+# 1457|     r1457_9(int)                        = Constant[42]                 : 
+# 1457|     mu1457_10(int)                      = Store[?]                     : &:r1457_8, r1457_9
+# 1458|     r1458_1(int)                        = Constant[3]                  : 
+# 1458|     r1458_2(glval<unknown>)             = VariableAddress[#this]       : 
+# 1458|     r1458_3(Inheritance_Test_A *)       = Load[#this]                  : &:r1458_2, ~m?
+# 1458|     r1458_4(glval<int>)                 = FieldAddress[y]              : r1458_3
+# 1458|     mu1458_5(int)                       = Store[?]                     : &:r1458_4, r1458_1
+# 1459|     v1459_1(void)                       = NoOp                         : 
+# 1457|     v1457_11(void)                      = ReturnIndirection[#this]     : &:r1457_6, ~m?
+# 1457|     v1457_12(void)                      = ReturnVoid                   : 
+# 1457|     v1457_13(void)                      = AliasedUse                   : ~m?
+# 1457|     v1457_14(void)                      = ExitFunction                 : 
+
 perf-regression.cpp:
 #    6| void Big::Big()
 #    6|   Block 0

cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/CleartextTransmission.expected

@@ -1,4 +1,5 @@
 edges
+| test2.cpp:63:24:63:31 | password | test2.cpp:63:16:63:20 | call to crypt |
 | test3.cpp:17:28:17:36 | password1 | test3.cpp:22:15:22:23 | password1 |
 | test3.cpp:17:51:17:59 | password2 | test3.cpp:26:15:26:23 | password2 |
 | test3.cpp:45:8:45:15 | password | test3.cpp:47:15:47:22 | password |
@@ -89,11 +90,16 @@ edges
 | test3.cpp:398:18:398:25 | password | test3.cpp:400:15:400:23 | & ... |
 | test3.cpp:398:18:398:25 | password | test3.cpp:400:16:400:23 | password |
 | test3.cpp:398:18:398:25 | password | test3.cpp:400:33:400:40 | password |
+| test3.cpp:421:21:421:28 | password | test3.cpp:421:3:421:17 | call to decrypt_inplace |
+| test3.cpp:429:7:429:14 | password | test3.cpp:431:8:431:15 | password |
 | test.cpp:41:23:41:43 | cleartext password! | test.cpp:48:21:48:27 | call to encrypt |
 | test.cpp:41:23:41:43 | cleartext password! | test.cpp:48:29:48:39 | thePassword |
 | test.cpp:66:23:66:43 | cleartext password! | test.cpp:76:21:76:27 | call to encrypt |
 | test.cpp:66:23:66:43 | cleartext password! | test.cpp:76:29:76:39 | thePassword |
 nodes
+| test2.cpp:63:16:63:20 | call to crypt | semmle.label | call to crypt |
+| test2.cpp:63:24:63:31 | password | semmle.label | password |
+| test2.cpp:63:24:63:31 | password | semmle.label | password |
 | test3.cpp:17:28:17:36 | password1 | semmle.label | password1 |
 | test3.cpp:17:51:17:59 | password2 | semmle.label | password2 |
 | test3.cpp:22:15:22:23 | password1 | semmle.label | password1 |
@@ -208,6 +214,13 @@ nodes
 | test3.cpp:400:15:400:23 | & ... | semmle.label | & ... |
 | test3.cpp:400:16:400:23 | password | semmle.label | password |
 | test3.cpp:400:33:400:40 | password | semmle.label | password |
+| test3.cpp:414:17:414:24 | password | semmle.label | password |
+| test3.cpp:420:17:420:24 | password | semmle.label | password |
+| test3.cpp:421:3:421:17 | call to decrypt_inplace | semmle.label | call to decrypt_inplace |
+| test3.cpp:421:21:421:28 | password | semmle.label | password |
+| test3.cpp:421:21:421:28 | password | semmle.label | password |
+| test3.cpp:429:7:429:14 | password | semmle.label | password |
+| test3.cpp:431:8:431:15 | password | semmle.label | password |
 | test.cpp:41:23:41:43 | cleartext password! | semmle.label | cleartext password! |
 | test.cpp:48:21:48:27 | call to encrypt | semmle.label | call to encrypt |
 | test.cpp:48:29:48:39 | thePassword | semmle.label | thePassword |
@@ -238,3 +251,6 @@ subpaths
 | test3.cpp:300:2:300:5 | call to send | test3.cpp:308:58:308:66 | password2 | test3.cpp:300:14:300:17 | data | This operation transmits 'data', which may contain unencrypted sensitive data from $@ | test3.cpp:308:58:308:66 | password2 | password2 |
 | test3.cpp:341:4:341:7 | call to recv | test3.cpp:339:9:339:16 | password | test3.cpp:341:16:341:23 | password | This operation receives into 'password', which may put unencrypted sensitive data into $@ | test3.cpp:339:9:339:16 | password | password |
 | test3.cpp:388:3:388:6 | call to recv | test3.cpp:386:8:386:15 | password | test3.cpp:388:15:388:22 | password | This operation receives into 'password', which may put unencrypted sensitive data into $@ | test3.cpp:386:8:386:15 | password | password |
+| test3.cpp:414:3:414:6 | call to recv | test3.cpp:414:17:414:24 | password | test3.cpp:414:17:414:24 | password | This operation receives into 'password', which may put unencrypted sensitive data into $@ | test3.cpp:414:17:414:24 | password | password |
+| test3.cpp:420:3:420:6 | call to recv | test3.cpp:420:17:420:24 | password | test3.cpp:420:17:420:24 | password | This operation receives into 'password', which may put unencrypted sensitive data into $@ | test3.cpp:420:17:420:24 | password | password |
+| test3.cpp:431:2:431:6 | call to fgets | test3.cpp:429:7:429:14 | password | test3.cpp:431:8:431:15 | password | This operation receives into 'password', which may put unencrypted sensitive data into $@ | test3.cpp:429:7:429:14 | password | password |

cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test3.cpp

@@ -411,13 +411,66 @@ void test_member_password()
 	{
 		packet p;
 
-		recv(val(), p.password, 256, val()); // BAD: not encrypted [NOT DETECTED]
+		recv(val(), p.password, 256, val()); // BAD: not encrypted
 	}
 
 	{
 		packet p;
 
-		recv(val(), p.password, 256, val()); // GOOD: password is encrypted
+		recv(val(), p.password, 256, val()); // GOOD: password is encrypted [FALSE POSITIVE]
 		decrypt_inplace(p.password); // proof that `password` was in fact encrypted
 	}
 }
+
+extern FILE *stdin;
+
+void test_stdin_param(FILE *stream)
+{
+	char password[128];
+
+	fgets(password, 128, stream); // GOOD: from standard input (see call below) [FALSE POSITIVE]
+}
+
+void test_stdin()
+{
+	char password[128];
+	FILE *f = stdin;
+
+	fgets(password, 128, stdin); // GOOD: from standard input
+	fgets(password, 128, f); // GOOD: from standard input
+	test_stdin_param(stdin);
+}
+
+int open(const char *filename, int b);
+
+void test_tty()
+{
+	{
+		char password[256];
+		int f;
+
+		f = open("/dev/tty", val());
+		recv(f, password, 256, val()); // GOOD: from terminal
+	}
+
+	{
+		char password[256];
+		int f;
+
+		f = STDIN_FILENO;
+		recv(f, password, 256, val()); // GOOD: from stdin
+	}
+
+	{
+		char password[256];
+		int f;
+
+		f = open("/dev/tty", val());
+		if (f == -1)
+		{
+			f = STDIN_FILENO;
+		}
+
+		recv(f, password, 256, val()); // GOOD: from terminal or stdin
+	}
+}

csharp/autobuilder/Semmle.Autobuild.CSharp.Tests/Semmle.Autobuild.CSharp.Tests.csproj

@@ -1,6 +1,6 @@
 <Project Sdk="Microsoft.NET.Sdk">
 	<PropertyGroup>
-		<TargetFramework>net5.0</TargetFramework>
+		<TargetFramework>net6.0</TargetFramework>
 		<GenerateAssemblyInfo>false</GenerateAssemblyInfo>
 		<RuntimeIdentifiers>win-x64;linux-x64;osx-x64</RuntimeIdentifiers>
 		<Nullable>enable</Nullable>

csharp/autobuilder/Semmle.Autobuild.CSharp/Semmle.Autobuild.CSharp.csproj

@@ -1,6 +1,6 @@
 <Project Sdk="Microsoft.NET.Sdk">
 	<PropertyGroup>
-		<TargetFramework>net5.0</TargetFramework>
+		<TargetFramework>net6.0</TargetFramework>
 		<AssemblyName>Semmle.Autobuild.CSharp</AssemblyName>
 		<RootNamespace>Semmle.Autobuild.CSharp</RootNamespace>
 		<ApplicationIcon/>

csharp/autobuilder/Semmle.Autobuild.Shared/Semmle.Autobuild.Shared.csproj

@@ -1,6 +1,6 @@
 <Project Sdk="Microsoft.NET.Sdk">
 	<PropertyGroup>
-		<TargetFramework>net5.0</TargetFramework>
+		<TargetFramework>net6.0</TargetFramework>
 		<AssemblyName>Semmle.Autobuild.Shared</AssemblyName>
 		<RootNamespace>Semmle.Autobuild.Shared</RootNamespace>
 		<GenerateAssemblyInfo>false</GenerateAssemblyInfo>

csharp/downgrades/ab09ac8287516082b7a7367f8fda1862b1be47c5/upgrade.properties

@@ -0,0 +1,3 @@
+description: Remove 'kind' from 'attributes'.
+compatability: full
+attributes.rel: reorder attributes.rel (int id, int kind, int type_id, int target) id type_id target

csharp/extractor/Semmle.Extraction.CIL.Driver/Semmle.Extraction.CIL.Driver.csproj

@@ -2,7 +2,7 @@
 
   <PropertyGroup>
     <OutputType>Exe</OutputType>
-    <TargetFramework>net5.0</TargetFramework>
+    <TargetFramework>net6.0</TargetFramework>
     <AssemblyName>Semmle.Extraction.CIL.Driver</AssemblyName>
     <RootNamespace>Semmle.Extraction.CIL.Driver</RootNamespace>
     <GenerateAssemblyInfo>false</GenerateAssemblyInfo>

csharp/extractor/Semmle.Extraction.CIL/Semmle.Extraction.CIL.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
-    <TargetFramework>net5.0</TargetFramework>
+    <TargetFramework>net6.0</TargetFramework>
     <AssemblyName>Semmle.Extraction.CIL</AssemblyName>
     <RootNamespace>Semmle.Extraction.CIL</RootNamespace>
     <GenerateAssemblyInfo>false</GenerateAssemblyInfo>

csharp/extractor/Semmle.Extraction.CSharp.Driver/Semmle.Extraction.CSharp.Driver.csproj

@@ -2,7 +2,7 @@
 
   <PropertyGroup>
     <OutputType>Exe</OutputType>
-    <TargetFramework>net5.0</TargetFramework>
+    <TargetFramework>net6.0</TargetFramework>
     <AssemblyName>Semmle.Extraction.CSharp.Driver</AssemblyName>
     <RootNamespace>Semmle.Extraction.CSharp.Driver</RootNamespace>
     <GenerateAssemblyInfo>false</GenerateAssemblyInfo>

csharp/extractor/Semmle.Extraction.CSharp.Standalone/AssemblyInfo.cs

@@ -146,7 +146,7 @@ namespace Semmle.BuildAnalyser
                  *  loading the same assembly from different locations.
                  */
                 using var pereader = new System.Reflection.PortableExecutable.PEReader(new FileStream(filename, FileMode.Open, FileAccess.Read, FileShare.Read));
-                using var sha1 = new SHA1CryptoServiceProvider();
+                using var sha1 = SHA1.Create();
                 var metadata = pereader.GetMetadata();
                 unsafe
                 {

csharp/extractor/Semmle.Extraction.CSharp.Standalone/BuildAnalysis.cs

@@ -160,7 +160,7 @@ namespace Semmle.BuildAnalyser
         {
             var bytes = Encoding.Unicode.GetBytes(srcDir);
 
-            using var sha1 = new SHA1CryptoServiceProvider();
+            using var sha1 = SHA1.Create();
             var sha = sha1.ComputeHash(bytes);
             var sb = new StringBuilder();
             foreach (var b in sha.Take(8))

csharp/extractor/Semmle.Extraction.CSharp.Standalone/Semmle.Extraction.CSharp.Standalone.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk">
 	<PropertyGroup>
 		<OutputType>Exe</OutputType>
-		<TargetFramework>net5.0</TargetFramework>
+		<TargetFramework>net6.0</TargetFramework>
 		<AssemblyName>Semmle.Extraction.CSharp.Standalone</AssemblyName>
 		<RootNamespace>Semmle.Extraction.CSharp.Standalone</RootNamespace>
 		<GenerateAssemblyInfo>false</GenerateAssemblyInfo>

csharp/extractor/Semmle.Extraction.CSharp/Entities/Attribute.cs

@@ -1,3 +1,5 @@
+using System;
+using System.Collections.Generic;
 using System.IO;
 using System.Linq;
 using Microsoft.CodeAnalysis;
@@ -6,18 +8,28 @@ using Semmle.Extraction.Entities;
 
 namespace Semmle.Extraction.CSharp.Entities
 {
+    internal enum AttributeKind
+    {
+        Default = 0,
+        Return = 1,
+        Assembly = 2,
+        Module = 3,
+    }
+
     internal class Attribute : CachedEntity<AttributeData>, IExpressionParentEntity
     {
         bool IExpressionParentEntity.IsTopLevelParent => true;
 
         private readonly AttributeSyntax? attributeSyntax;
         private readonly IEntity entity;
+        private readonly AttributeKind kind;
 
-        private Attribute(Context cx, AttributeData attributeData, IEntity entity)
+        private Attribute(Context cx, AttributeData attributeData, IEntity entity, AttributeKind kind)
             : base(cx, attributeData)
         {
             this.attributeSyntax = attributeData.ApplicationSyntaxReference?.GetSyntax() as AttributeSyntax;
             this.entity = entity;
+            this.kind = kind;
         }
 
         public override void WriteId(EscapingTextWriter trapFile)
@@ -48,7 +60,7 @@ namespace Semmle.Extraction.CSharp.Entities
         public override void Populate(TextWriter trapFile)
         {
             var type = Type.Create(Context, Symbol.AttributeClass);
-            trapFile.attributes(this, type.TypeRef, entity);
+            trapFile.attributes(this, kind, type.TypeRef, entity);
             trapFile.attribute_location(this, Location);
 
             if (attributeSyntax is not null)
@@ -125,26 +137,36 @@ namespace Semmle.Extraction.CSharp.Entities
 
         public override bool NeedsPopulation => true;
 
-        public static void ExtractAttributes(Context cx, ISymbol symbol, IEntity entity)
+        private static void ExtractAttributes(Context cx, IEnumerable<AttributeData> attributes, IEntity entity, AttributeKind kind)
         {
-            foreach (var attribute in symbol.GetAttributes())
+            foreach (var attribute in attributes)
             {
-                Create(cx, attribute, entity);
+                Create(cx, attribute, entity, kind);
             }
         }
 
-        public static Attribute Create(Context cx, AttributeData attributeData, IEntity entity)
+        public static void ExtractAttributes(Context cx, ISymbol symbol, IEntity entity)
         {
-            var init = (attributeData, entity);
+            ExtractAttributes(cx, symbol.GetAttributes(), entity, AttributeKind.Default);
+            if (symbol is IMethodSymbol method)
+            {
+                ExtractAttributes(cx, method.GetReturnTypeAttributes(), entity, AttributeKind.Return);
+            }
+        }
+
+
+        public static Attribute Create(Context cx, AttributeData attributeData, IEntity entity, AttributeKind kind)
+        {
+            var init = (attributeData, entity, kind);
             return AttributeFactory.Instance.CreateEntity(cx, attributeData, init);
         }
 
-        private class AttributeFactory : CachedEntityFactory<(AttributeData attributeData, IEntity receiver), Attribute>
+        private class AttributeFactory : CachedEntityFactory<(AttributeData attributeData, IEntity receiver, AttributeKind kind), Attribute>
         {
             public static readonly AttributeFactory Instance = new AttributeFactory();
 
-            public override Attribute Create(Context cx, (AttributeData attributeData, IEntity receiver) init) =>
+            public override Attribute Create(Context cx, (AttributeData attributeData, IEntity receiver, AttributeKind kind) init) =>
-                new Attribute(cx, init.attributeData, init.receiver);
+                new Attribute(cx, init.attributeData, init.receiver, init.kind);
         }
     }
 }

csharp/extractor/Semmle.Extraction.CSharp/Entities/UserOperator.cs

@@ -178,6 +178,9 @@ namespace Semmle.Extraction.CSharp.Entities
         /// <returns>The converted name.</returns>
         private static string OperatorSymbol(Context cx, IMethodSymbol method)
         {
+            if (method.ExplicitInterfaceImplementations.Any())
+                return OperatorSymbol(cx, method.ExplicitInterfaceImplementations.First());
+
             var methodName = method.Name;
             if (!OperatorSymbol(methodName, out var result))
                 cx.ModelError(method, $"Unhandled operator name in OperatorSymbol(): '{methodName}'");

csharp/extractor/Semmle.Extraction.CSharp/Populators/TypeContainerVisitor.cs

@@ -86,11 +86,17 @@ namespace Semmle.Extraction.CSharp.Populators
                 return;
 
             var outputAssembly = Assembly.CreateOutputAssembly(Cx);
+            var kind = node.Target?.Identifier.Kind() switch
+            {
+                SyntaxKind.AssemblyKeyword => Entities.AttributeKind.Assembly,
+                SyntaxKind.ModuleKeyword => Entities.AttributeKind.Module,
+                _ => throw new InternalError(node, "Unhandled global target")
+            };
             foreach (var attribute in node.Attributes)
             {
                 if (attributeLookup.Value(attribute) is AttributeData attributeData)
                 {
-                    var ae = Entities.Attribute.Create(Cx, attributeData, outputAssembly);
+                    var ae = Entities.Attribute.Create(Cx, attributeData, outputAssembly, kind);
                     Cx.BindComments(ae, attribute.GetLocation());
                 }
             }

csharp/extractor/Semmle.Extraction.CSharp/Semmle.Extraction.CSharp.csproj

@@ -1,6 +1,6 @@
 <Project Sdk="Microsoft.NET.Sdk">
 	<PropertyGroup>
-		<TargetFramework>net5.0</TargetFramework>
+		<TargetFramework>net6.0</TargetFramework>
 		<AssemblyName>Semmle.Extraction.CSharp</AssemblyName>
 		<RootNamespace>Semmle.Extraction.CSharp</RootNamespace>
 		<GenerateAssemblyInfo>false</GenerateAssemblyInfo>

csharp/extractor/Semmle.Extraction.CSharp/Tuples.cs

@@ -32,8 +32,8 @@ namespace Semmle.Extraction.CSharp
         internal static void array_element_type(this TextWriter trapFile, ArrayType array, int dimension, int rank, Type elementType) =>
             trapFile.WriteTuple("array_element_type", array, dimension, rank, elementType);
 
-        internal static void attributes(this TextWriter trapFile, Attribute attribute, Type attributeType, IEntity entity) =>
+        internal static void attributes(this TextWriter trapFile, Attribute attribute, AttributeKind kind, Type attributeType, IEntity entity) =>
-            trapFile.WriteTuple("attributes", attribute, attributeType, entity);
+            trapFile.WriteTuple("attributes", attribute, kind, attributeType, entity);
 
         internal static void attribute_location(this TextWriter trapFile, Attribute attribute, Location location) =>
             trapFile.WriteTuple("attribute_location", attribute, location);

csharp/extractor/Semmle.Extraction.Tests/Semmle.Extraction.Tests.csproj

@@ -1,6 +1,6 @@
 <Project Sdk="Microsoft.NET.Sdk">
 	<PropertyGroup>
-		<TargetFramework>net5.0</TargetFramework>
+		<TargetFramework>net6.0</TargetFramework>
 		<GenerateAssemblyInfo>false</GenerateAssemblyInfo>
 		<RuntimeIdentifiers>win-x64;linux-x64;osx-x64</RuntimeIdentifiers>
 		<Nullable>enable</Nullable>

csharp/extractor/Semmle.Extraction/Semmle.Extraction.csproj

@@ -1,6 +1,6 @@
 <Project Sdk="Microsoft.NET.Sdk">
 	<PropertyGroup>
-		<TargetFramework>net5.0</TargetFramework>
+		<TargetFramework>net6.0</TargetFramework>
 		<AssemblyName>Semmle.Extraction</AssemblyName>
 		<RootNamespace>Semmle.Extraction</RootNamespace>
 		<GenerateAssemblyInfo>false</GenerateAssemblyInfo>

csharp/extractor/Semmle.Util.Tests/Semmle.Util.Tests.csproj

@@ -1,6 +1,6 @@
 <Project Sdk="Microsoft.NET.Sdk">
 	<PropertyGroup>
-		<TargetFramework>net5.0</TargetFramework>
+		<TargetFramework>net6.0</TargetFramework>
 		<GenerateAssemblyInfo>false</GenerateAssemblyInfo>
 		<RuntimeIdentifiers>win-x64;linux-x64;osx-x64</RuntimeIdentifiers>
 		<Nullable>enable</Nullable>

csharp/extractor/Semmle.Util/FileUtils.cs

@@ -84,7 +84,7 @@ namespace Semmle.Util
         public static string ComputeFileHash(string filePath)
         {
             using var fileStream = new FileStream(filePath, FileMode.Open, FileAccess.Read, FileShare.Read);
-            using var shaAlg = new SHA256Managed();
+            using var shaAlg = SHA256.Create();
             var sha = shaAlg.ComputeHash(fileStream);
             var hex = new StringBuilder(sha.Length * 2);
             foreach (var b in sha)

csharp/extractor/Semmle.Util/Semmle.Util.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
-    <TargetFramework>net5.0</TargetFramework>
+    <TargetFramework>net6.0</TargetFramework>
     <AssemblyName>Semmle.Util</AssemblyName>
     <RootNamespace>Semmle.Util</RootNamespace>
     <GenerateAssemblyInfo>false</GenerateAssemblyInfo>

csharp/ql/lib/change-notes/2021-02-02-return-value-attributes.md

@@ -0,0 +1,5 @@
+---
+category: majorAnalysis
+---
+* Return value attributes are extracted.
+* The QL `Attribute` class now has subclasses for each kind of attribute.

csharp/ql/lib/semmle/code/csharp/Attribute.qll

@@ -36,6 +36,12 @@ class Attributable extends @attributable {
   }
 }
 
+private string getAttributeName(Attribute a) {
+  exists(string type | type = a.getType().getName() |
+    if type.matches("%Attribute") then result = type.prefix(type.length() - 9) else result = type
+  )
+}
+
 /**
  * An attribute, for example `[...]` on line 1 in
  *
@@ -50,10 +56,10 @@ class Attributable extends @attributable {
  */
 class Attribute extends TopLevelExprParent, @attribute {
   /** Gets the type of this attribute. */
-  Class getType() { attributes(this, getTypeRef(result), _) }
+  Class getType() { attributes(this, _, getTypeRef(result), _) }
 
   /** Gets the element that this attribute is attached to. */
-  Attributable getTarget() { attributes(this, _, result) }
+  Attributable getTarget() { attributes(this, _, _, result) }
 
   /**
    * Gets the `i`th argument of this attribute. This includes both constructor
@@ -88,12 +94,55 @@ class Attribute extends TopLevelExprParent, @attribute {
 
   override Location getALocation() { attribute_location(this, result) }
 
-  override string toString() {
+  override string toString() { result = "[" + getAttributeName(this) + "(...)]" }
-    exists(string type, string name | type = this.getType().getName() |
-      (if type.matches("%Attribute") then name = type.prefix(type.length() - 9) else name = type) and
-      result = "[" + name + "(...)]"
-    )
-  }
 
   override string getAPrimaryQlClass() { result = "Attribute" }
 }
+
+/**
+ * An attribute with default kind, for example `[...]` on line 1 in
+ * ```csharp
+ * [MyAttribute(0)]
+ * int SomeMethod() { return 1; }
+ * ```
+ */
+class DefaultAttribute extends Attribute, @attribute_default {
+  override string getAPrimaryQlClass() { result = "DefaultAttribute" }
+}
+
+/**
+ * An attribute with return kind, for example `[...]` on line 1 in
+ * ```csharp
+ * [return: MyAttribute(0)]
+ * int SomeMethod() { return 1; }
+ * ```
+ */
+class ReturnAttribute extends Attribute, @attribute_return {
+  override string toString() { result = "[return: " + getAttributeName(this) + "(...)]" }
+
+  override string getAPrimaryQlClass() { result = "ReturnAttribute" }
+}
+
+/**
+ * An attribute with assembly kind, for example `[...]` on line 1 in
+ * ```csharp
+ * [assembly: MyAttribute(0)]
+ * ```
+ */
+class AssemblyAttribute extends Attribute, @attribute_assembly {
+  override string toString() { result = "[assembly: " + getAttributeName(this) + "(...)]" }
+
+  override string getAPrimaryQlClass() { result = "AssemblyAttribute" }
+}
+
+/**
+ * An attribute with module kind, for example `[...]` on line 1 in
+ * ```csharp
+ * [module: MyAttribute(0)]
+ * ```
+ */
+class ModuleAttribute extends Attribute, @attribute_module {
+  override string toString() { result = "[module: " + getAttributeName(this) + "(...)]" }
+
+  override string getAPrimaryQlClass() { result = "ModuleAttribute" }
+}

csharp/ql/lib/semmle/code/csharp/controlflow/internal/ControlFlowGraphImplShared.qll

@@ -214,7 +214,7 @@ abstract class SplitKind extends SplitKindBase {
   abstract string toString();
 }
 
-/** Provides the interface for implementing an entity to split on. */
+/** An interface for implementing an entity to split on. */
 abstract class SplitImpl extends Split {
   /** Gets the kind of this split. */
   abstract SplitKind getKind();
@@ -900,10 +900,25 @@ module TestOutput {
   }
 
   query predicate edges(RelevantNode pred, RelevantNode succ, string attr, string val) {
+    attr = "semmle.label" and
     exists(SuccessorType t | succ = getASuccessor(pred, t) |
-      attr = "semmle.label" and
       if successorTypeIsSimple(t) then val = "" else val = t.toString()
     )
+    or
+    attr = "semmle.order" and
+    val =
+      any(int i |
+        succ =
+          rank[i](RelevantNode s, SuccessorType t, Location l |
+            s = getASuccessor(pred, t) and
+            l = s.getLocation()
+          |
+            s
+            order by
+              l.getFile().getBaseName(), l.getFile().getAbsolutePath(), l.getStartLine(),
+              l.getStartColumn(), l.getEndLine(), l.getEndColumn(), t.toString()
+          )
+      ).toString()
   }
 }
 

csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImplCommon.qll

@@ -1290,7 +1290,7 @@ class DataFlowCallOption extends TDataFlowCallOption {
   }
 }
 
-/** Content tagged with the type of a containing object. */
+/** A `Content` tagged with the type of a containing object. */
 class TypedContent extends MkTypedContent {
   private Content c;
   private DataFlowType t;

csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPublic.qll

@@ -160,6 +160,7 @@ predicate localFlow(Node source, Node sink) { localFlowStep*(source, sink) }
  * Holds if data can flow from `e1` to `e2` in zero or more
  * local (intra-procedural) steps.
  */
+pragma[inline]
 predicate localExprFlow(Expr e1, Expr e2) { localFlow(exprNode(e1), exprNode(e2)) }
 
 /**

csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll

@@ -90,7 +90,9 @@ module Public {
     predicate contains(SummaryComponent c) { c = this.drop(_).head() }
 
     /** Gets the bottom element of this stack. */
-    SummaryComponent bottom() { result = this.drop(this.length() - 1).head() }
+    SummaryComponent bottom() {
+      this = TSingletonSummaryComponentStack(result) or result = this.tail().bottom()
+    }
 
     /** Gets a textual representation of this stack. */
     string toString() {

csharp/ql/lib/semmle/code/csharp/dataflow/internal/TaintTrackingPublic.qll

@@ -5,12 +5,14 @@ private import TaintTrackingPrivate
  * Holds if taint propagates from `source` to `sink` in zero or more local
  * (intra-procedural) steps.
  */
+pragma[inline]
 predicate localTaint(DataFlow::Node source, DataFlow::Node sink) { localTaintStep*(source, sink) }
 
 /**
  * Holds if taint can flow from `e1` to `e2` in zero or more
  * local (intra-procedural) steps.
  */
+pragma[inline]
 predicate localExprTaint(Expr e1, Expr e2) {
   localTaint(DataFlow::exprNode(e1), DataFlow::exprNode(e2))
 }

csharp/ql/lib/semmlecode.csharp.dbscheme

@@ -520,9 +520,17 @@ tuple_element(
 
 attributes(
   unique int id: @attribute,
+  int kind: int ref,
   int type_id: @type_or_ref ref,
   int target:  @attributable ref);
 
+case @attribute.kind of
+  0 = @attribute_default
+| 1 = @attribute_return
+| 2 = @attribute_assembly
+| 3 = @attribute_module
+;
+
 attribute_location(
   int id: @attribute ref,
   int loc: @location ref);

csharp/ql/lib/tutorial.qll

@@ -6,122 +6,22 @@
  */
 class Person extends string {
   Person() {
-    this = "Ronil" or
+    this =
-    this = "Dina" or
+      [
-    this = "Ravi" or
+        "Ronil", "Dina", "Ravi", "Bruce", "Jo", "Aida", "Esme", "Charlie", "Fred", "Meera", "Maya",
-    this = "Bruce" or
+        "Chad", "Tiana", "Laura", "George", "Will", "Mary", "Almira", "Susannah", "Rhoda",
-    this = "Jo" or
+        "Cynthia", "Eunice", "Olive", "Virginia", "Angeline", "Helen", "Cornelia", "Harriet",
-    this = "Aida" or
+        "Mahala", "Abby", "Margaret", "Deb", "Minerva", "Severus", "Lavina", "Adeline", "Cath",
-    this = "Esme" or
+        "Elisa", "Lucretia", "Anne", "Eleanor", "Joanna", "Adam", "Agnes", "Rosanna", "Clara",
-    this = "Charlie" or
+        "Melissa", "Amy", "Isabel", "Jemima", "Cordelia", "Melinda", "Delila", "Jeremiah", "Elijah",
-    this = "Fred" or
+        "Hester", "Walter", "Oliver", "Hugh", "Aaron", "Reuben", "Eli", "Amos", "Augustus",
-    this = "Meera" or
+        "Theodore", "Ira", "Timothy", "Cyrus", "Horace", "Simon", "Asa", "Frank", "Nelson",
-    this = "Maya" or
+        "Leonard", "Harrison", "Anthony", "Louis", "Milton", "Noah", "Cornelius", "Abdul", "Warren",
-    this = "Chad" or
+        "Harvey", "Dennis", "Wesley", "Sylvester", "Gilbert", "Sullivan", "Edmund", "Wilson",
-    this = "Tiana" or
+        "Perry", "Matthew", "Simba", "Nala", "Rafiki", "Shenzi", "Ernest", "Gertrude", "Oscar",
-    this = "Laura" or
+        "Lilian", "Raymond", "Elgar", "Elmer", "Herbert", "Maude", "Mae", "Otto", "Edwin",
-    this = "George" or
+        "Ophelia", "Parsley", "Sage", "Rosemary", "Thyme", "Garfunkel", "King Basil", "Stephen"
-    this = "Will" or
+      ]
-    this = "Mary" or
-    this = "Almira" or
-    this = "Susannah" or
-    this = "Rhoda" or
-    this = "Cynthia" or
-    this = "Eunice" or
-    this = "Olive" or
-    this = "Virginia" or
-    this = "Angeline" or
-    this = "Helen" or
-    this = "Cornelia" or
-    this = "Harriet" or
-    this = "Mahala" or
-    this = "Abby" or
-    this = "Margaret" or
-    this = "Deb" or
-    this = "Minerva" or
-    this = "Severus" or
-    this = "Lavina" or
-    this = "Adeline" or
-    this = "Cath" or
-    this = "Elisa" or
-    this = "Lucretia" or
-    this = "Anne" or
-    this = "Eleanor" or
-    this = "Joanna" or
-    this = "Adam" or
-    this = "Agnes" or
-    this = "Rosanna" or
-    this = "Clara" or
-    this = "Melissa" or
-    this = "Amy" or
-    this = "Isabel" or
-    this = "Jemima" or
-    this = "Cordelia" or
-    this = "Melinda" or
-    this = "Delila" or
-    this = "Jeremiah" or
-    this = "Elijah" or
-    this = "Hester" or
-    this = "Walter" or
-    this = "Oliver" or
-    this = "Hugh" or
-    this = "Aaron" or
-    this = "Reuben" or
-    this = "Eli" or
-    this = "Amos" or
-    this = "Augustus" or
-    this = "Theodore" or
-    this = "Ira" or
-    this = "Timothy" or
-    this = "Cyrus" or
-    this = "Horace" or
-    this = "Simon" or
-    this = "Asa" or
-    this = "Frank" or
-    this = "Nelson" or
-    this = "Leonard" or
-    this = "Harrison" or
-    this = "Anthony" or
-    this = "Louis" or
-    this = "Milton" or
-    this = "Noah" or
-    this = "Cornelius" or
-    this = "Abdul" or
-    this = "Warren" or
-    this = "Harvey" or
-    this = "Dennis" or
-    this = "Wesley" or
-    this = "Sylvester" or
-    this = "Gilbert" or
-    this = "Sullivan" or
-    this = "Edmund" or
-    this = "Wilson" or
-    this = "Perry" or
-    this = "Matthew" or
-    this = "Simba" or
-    this = "Nala" or
-    this = "Rafiki" or
-    this = "Shenzi" or
-    this = "Ernest" or
-    this = "Gertrude" or
-    this = "Oscar" or
-    this = "Lilian" or
-    this = "Raymond" or
-    this = "Elgar" or
-    this = "Elmer" or
-    this = "Herbert" or
-    this = "Maude" or
-    this = "Mae" or
-    this = "Otto" or
-    this = "Edwin" or
-    this = "Ophelia" or
-    this = "Parsley" or
-    this = "Sage" or
-    this = "Rosemary" or
-    this = "Thyme" or
-    this = "Garfunkel" or
-    this = "King Basil" or
-    this = "Stephen"
   }
 
   /** Gets the hair color of the person. If the person is bald, there is no result. */
@@ -936,25 +836,12 @@ class Person extends string {
 
   /** Holds if the person is deceased. */
   predicate isDeceased() {
-    this = "Ernest" or
+    this =
-    this = "Gertrude" or
+      [
-    this = "Oscar" or
+        "Ernest", "Gertrude", "Oscar", "Lilian", "Edwin", "Raymond", "Elgar", "Elmer", "Herbert",
-    this = "Lilian" or
+        "Maude", "Mae", "Otto", "Ophelia", "Parsley", "Sage", "Rosemary", "Thyme", "Garfunkel",
-    this = "Edwin" or
+        "King Basil"
-    this = "Raymond" or
+      ]
-    this = "Elgar" or
-    this = "Elmer" or
-    this = "Herbert" or
-    this = "Maude" or
-    this = "Mae" or
-    this = "Otto" or
-    this = "Ophelia" or
-    this = "Parsley" or
-    this = "Sage" or
-    this = "Rosemary" or
-    this = "Thyme" or
-    this = "Garfunkel" or
-    this = "King Basil"
   }
 
   /** Gets a parent of the person (alive or deceased). */
@@ -1195,12 +1082,7 @@ class Person extends string {
   }
 
   /** Holds if the person is allowed in the region. Initially, all villagers are allowed in every region. */
-  predicate isAllowedIn(string region) {
+  predicate isAllowedIn(string region) { region = ["north", "south", "east", "west"] }
-    region = "north" or
-    region = "south" or
-    region = "east" or
-    region = "west"
-  }
 }
 
 /** Returns a parent of the person. */

csharp/ql/lib/upgrades/ba2201248071b2bf0bb52909b35014091d2e18a6/attribute_kind.ql

@@ -0,0 +1,15 @@
+class Attribute extends @attribute {
+  string toString() { none() }
+}
+
+class Attributable extends @attributable {
+  string toString() { none() }
+}
+
+class TypeOrRef extends @type_or_ref {
+  string toString() { none() }
+}
+
+from Attribute id, TypeOrRef type_id, Attributable target
+where attributes(id, type_id, target)
+select id, 0, type_id, target

csharp/ql/lib/upgrades/ba2201248071b2bf0bb52909b35014091d2e18a6/upgrade.properties

@@ -0,0 +1,3 @@
+description: Add 'kind' to 'attributes'.
+compatability: backwards
+attributes.rel: run attribute_kind.ql

csharp/ql/src/Stubs/make_stubs_nuget.py

@@ -8,7 +8,7 @@ import shutil
 def write_csproj_prefix(ioWrapper):
     ioWrapper.write('<Project Sdk="Microsoft.NET.Sdk">\n')
     ioWrapper.write('  <PropertyGroup>\n')
-    ioWrapper.write('    <TargetFramework>net5.0</TargetFramework>\n')
+    ioWrapper.write('    <TargetFramework>net6.0</TargetFramework>\n')
     ioWrapper.write('    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>\n')
     ioWrapper.write('    <OutputPath>bin\</OutputPath>\n')
     ioWrapper.write(
@@ -60,7 +60,7 @@ jsonFile = os.path.join(rawOutputDir, outputName + '.json')
 version = helpers.get_argv(2, "latest")
 
 print("\n* Creating new input project")
-run_cmd(['dotnet', 'new', 'classlib', "-f", "net5.0", "--language", "C#", '--name',
+run_cmd(['dotnet', 'new', 'classlib', "-f", "net6.0", "--language", "C#", '--name',
                  projectNameIn, '--output', projectDirIn])
 helpers.remove_files(projectDirIn, '.cs')
 
@@ -71,7 +71,7 @@ if (version != "latest"):
     cmd.append(version)
 run_cmd(cmd)
 
-sdk_version = '5.0.402'
+sdk_version = '6.0.101'
 print("\n* Creating new global.json file and setting SDK to " + sdk_version)
 run_cmd(['dotnet', 'new', 'globaljson', '--force', '--sdk-version', sdk_version, '--output', workDir])
 

csharp/ql/test/TestUtilities/InlineExpectationsTest.qll

@@ -93,7 +93,7 @@
 private import InlineExpectationsTestPrivate
 
 /**
- * Base class for tests with inline expectations. The test extends this class to provide the actual
+ * The base class for tests with inline expectations. The test extends this class to provide the actual
  * results of the query, which are then compared with the expected results in comments to produce a
  * list of failure messages that point out where the actual results differ from the expected
  * results.
@@ -123,6 +123,15 @@ abstract class InlineExpectationsTest extends string {
    */
   abstract predicate hasActualResult(Location location, string element, string tag, string value);
 
+  /**
+   * Like `hasActualResult`, but returns results that do not require a matching annotation.
+   * A failure will still arise if there is an annotation that does not match any results, but not vice versa.
+   * Override this predicate to specify optional results.
+   */
+  predicate hasOptionalResult(Location location, string element, string tag, string value) {
+    none()
+  }
+
   final predicate hasFailureMessage(FailureLocatable element, string message) {
     exists(ActualResult actualResult |
       actualResult.getTest() = this and
@@ -134,7 +143,8 @@ abstract class InlineExpectationsTest extends string {
         )
         or
         not exists(ValidExpectation expectation | expectation.matchesActualResult(actualResult)) and
-        message = "Unexpected result: " + actualResult.getExpectationText()
+        message = "Unexpected result: " + actualResult.getExpectationText() and
+        not actualResult.isOptional()
       )
     )
     or
@@ -243,9 +253,13 @@ private string expectationPattern() {
 
 private newtype TFailureLocatable =
   TActualResult(
-    InlineExpectationsTest test, Location location, string element, string tag, string value
+    InlineExpectationsTest test, Location location, string element, string tag, string value,
+    boolean optional
   ) {
-    test.hasActualResult(location, element, tag, value)
+    test.hasActualResult(location, element, tag, value) and
+    optional = false
+    or
+    test.hasOptionalResult(location, element, tag, value) and optional = true
   } or
   TValidExpectation(ExpectationComment comment, string tag, string value, string knownFailure) {
     exists(TColumn column, string tags |
@@ -277,8 +291,9 @@ class ActualResult extends FailureLocatable, TActualResult {
   string element;
   string tag;
   string value;
+  boolean optional;
 
-  ActualResult() { this = TActualResult(test, location, element, tag, value) }
+  ActualResult() { this = TActualResult(test, location, element, tag, value, optional) }
 
   override string toString() { result = element }
 
@@ -289,6 +304,8 @@ class ActualResult extends FailureLocatable, TActualResult {
   override string getTag() { result = tag }
 
   override string getValue() { result = value }
+
+  predicate isOptional() { optional = true }
 }
 
 abstract private class Expectation extends FailureLocatable {

csharp/ql/test/library-tests/arguments/PrintAst.expected

@@ -222,14 +222,14 @@ arguments.cs:
 #   66|   14: [Method] f6
 #   66|     -1: [TypeMention] Void
 #-----|     0: (Attributes)
-#   65|       1: [Attribute] [My(...)]
+#   65|       1: [DefaultAttribute] [My(...)]
 #   65|         -1: [TypeMention] MyAttribute
 #   65|         0: [BoolLiteral] false
 #   66|     4: [BlockStmt] {...}
 #   69|   15: [Method] f7
 #   69|     -1: [TypeMention] Void
 #-----|     0: (Attributes)
-#   68|       1: [Attribute] [My(...)]
+#   68|       1: [DefaultAttribute] [My(...)]
 #   68|         -1: [TypeMention] MyAttribute
 #   68|         0: [BoolLiteral] true
 #   68|         1: [StringLiteral] ""

csharp/ql/test/library-tests/assemblies/compilation.expected

@@ -1,9 +1,9 @@
 | Assembly1, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null | no compilation |
 | Locations, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null | has compilation |
 | System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 | no compilation |
-| System.Console, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a | no compilation |
+| System.Console, Version=6.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a | no compilation |
 | System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 | no compilation |
-| System.Private.CoreLib, Version=5.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e | no compilation |
+| System.Private.CoreLib, Version=6.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e | no compilation |
-| System.Runtime, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a | no compilation |
+| System.Runtime, Version=6.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a | no compilation |
-| System.Runtime.Extensions, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a | no compilation |
+| System.Runtime.Extensions, Version=6.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a | no compilation |
 | mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 | no compilation |

csharp/ql/test/library-tests/attributes/AttributeArguments.expected

@@ -17,30 +17,36 @@ arguments
 | Assembly1.dll:0:0:0:0 | [Custom(...)] | 5 | Assembly1.dll:0:0:0:0 | array creation of type Object[] |
 | Assembly1.dll:0:0:0:0 | [Custom(...)] | 5 | Assembly1.dll:0:0:0:0 | array creation of type Object[] |
 | Assembly1.dll:0:0:0:0 | [Custom(...)] | 5 | Assembly1.dll:0:0:0:0 | array creation of type Object[] |
-| attributes.cs:10:12:10:24 | [AssemblyTitle(...)] | 0 | attributes.cs:10:26:10:45 | "C# attributes test" |
+| Assembly1.dll:0:0:0:0 | [return: Custom(...)] | 0 | Assembly1.dll:0:0:0:0 | 42 |
-| attributes.cs:11:12:11:30 | [AssemblyDescription(...)] | 0 | attributes.cs:11:32:11:56 | "A test of C# attributes" |
+| Assembly1.dll:0:0:0:0 | [return: Custom(...)] | 1 | Assembly1.dll:0:0:0:0 | array creation of type Int32[] |
-| attributes.cs:12:12:12:32 | [AssemblyConfiguration(...)] | 0 | attributes.cs:12:34:12:35 | "" |
+| Assembly1.dll:0:0:0:0 | [return: Custom(...)] | 2 | Assembly1.dll:0:0:0:0 | null |
-| attributes.cs:13:12:13:26 | [AssemblyCompany(...)] | 0 | attributes.cs:13:28:13:39 | "Semmle Plc" |
+| Assembly1.dll:0:0:0:0 | [return: Custom(...)] | 3 | Assembly1.dll:0:0:0:0 | (...) ... |
-| attributes.cs:14:12:14:26 | [AssemblyProduct(...)] | 0 | attributes.cs:14:28:14:34 | "Odasa" |
+| Assembly1.dll:0:0:0:0 | [return: Custom(...)] | 4 | Assembly1.dll:0:0:0:0 | array creation of type Int32[] |
-| attributes.cs:15:12:15:28 | [AssemblyCopyright(...)] | 0 | attributes.cs:15:30:15:54 | "Copyright \u00a9 Semmle 2018" |
+| Assembly1.dll:0:0:0:0 | [return: Custom(...)] | 5 | Assembly1.dll:0:0:0:0 | array creation of type Object[] |
-| attributes.cs:16:12:16:28 | [AssemblyTrademark(...)] | 0 | attributes.cs:16:30:16:31 | "" |
+| attributes.cs:10:12:10:24 | [assembly: AssemblyTitle(...)] | 0 | attributes.cs:10:26:10:45 | "C# attributes test" |
-| attributes.cs:17:12:17:26 | [AssemblyCulture(...)] | 0 | attributes.cs:17:28:17:29 | "" |
+| attributes.cs:11:12:11:30 | [assembly: AssemblyDescription(...)] | 0 | attributes.cs:11:32:11:56 | "A test of C# attributes" |
-| attributes.cs:22:12:22:21 | [ComVisible(...)] | 0 | attributes.cs:22:23:22:27 | false |
+| attributes.cs:12:12:12:32 | [assembly: AssemblyConfiguration(...)] | 0 | attributes.cs:12:34:12:35 | "" |
-| attributes.cs:25:12:25:15 | [Guid(...)] | 0 | attributes.cs:25:17:25:54 | "2f70fdd6-14aa-4850-b053-d547adb1f476" |
+| attributes.cs:13:12:13:26 | [assembly: AssemblyCompany(...)] | 0 | attributes.cs:13:28:13:39 | "Semmle Plc" |
-| attributes.cs:37:12:37:26 | [AssemblyVersion(...)] | 0 | attributes.cs:37:28:37:36 | "1.0.0.0" |
+| attributes.cs:14:12:14:26 | [assembly: AssemblyProduct(...)] | 0 | attributes.cs:14:28:14:34 | "Odasa" |
-| attributes.cs:38:12:38:30 | [AssemblyFileVersion(...)] | 0 | attributes.cs:38:32:38:40 | "1.0.0.0" |
+| attributes.cs:15:12:15:28 | [assembly: AssemblyCopyright(...)] | 0 | attributes.cs:15:30:15:54 | "Copyright \u00a9 Semmle 2018" |
-| attributes.cs:40:12:40:15 | [Args(...)] | 0 | attributes.cs:40:17:40:17 | 0 |
+| attributes.cs:16:12:16:28 | [assembly: AssemblyTrademark(...)] | 0 | attributes.cs:16:30:16:31 | "" |
-| attributes.cs:40:12:40:15 | [Args(...)] | 1 | attributes.cs:40:20:40:46 | array creation of type Object[] |
+| attributes.cs:17:12:17:26 | [assembly: AssemblyCulture(...)] | 0 | attributes.cs:17:28:17:29 | "" |
-| attributes.cs:40:12:40:15 | [Args(...)] | 2 | attributes.cs:40:49:40:69 | typeof(...) |
+| attributes.cs:22:12:22:21 | [assembly: ComVisible(...)] | 0 | attributes.cs:22:23:22:27 | false |
-| attributes.cs:40:12:40:15 | [Args(...)] | 3 | attributes.cs:40:72:40:76 | (...) ... |
+| attributes.cs:25:12:25:15 | [assembly: Guid(...)] | 0 | attributes.cs:25:17:25:54 | "2f70fdd6-14aa-4850-b053-d547adb1f476" |
-| attributes.cs:40:12:40:15 | [Args(...)] | 4 | attributes.cs:40:79:40:82 | null |
+| attributes.cs:37:12:37:26 | [assembly: AssemblyVersion(...)] | 0 | attributes.cs:37:28:37:36 | "1.0.0.0" |
-| attributes.cs:40:12:40:15 | [Args(...)] | 5 | attributes.cs:40:92:40:122 | array creation of type Object[] |
+| attributes.cs:38:12:38:30 | [assembly: AssemblyFileVersion(...)] | 0 | attributes.cs:38:32:38:40 | "1.0.0.0" |
-| attributes.cs:41:10:41:13 | [Args(...)] | 0 | attributes.cs:41:15:41:15 | 0 |
+| attributes.cs:40:12:40:15 | [assembly: Args(...)] | 0 | attributes.cs:40:17:40:17 | 0 |
-| attributes.cs:41:10:41:13 | [Args(...)] | 1 | attributes.cs:41:18:41:44 | array creation of type Object[] |
+| attributes.cs:40:12:40:15 | [assembly: Args(...)] | 1 | attributes.cs:40:20:40:46 | array creation of type Object[] |
-| attributes.cs:41:10:41:13 | [Args(...)] | 2 | attributes.cs:41:47:41:67 | typeof(...) |
+| attributes.cs:40:12:40:15 | [assembly: Args(...)] | 2 | attributes.cs:40:49:40:69 | typeof(...) |
-| attributes.cs:41:10:41:13 | [Args(...)] | 3 | attributes.cs:41:70:41:74 | (...) ... |
+| attributes.cs:40:12:40:15 | [assembly: Args(...)] | 3 | attributes.cs:40:72:40:76 | (...) ... |
-| attributes.cs:41:10:41:13 | [Args(...)] | 4 | attributes.cs:41:77:41:80 | null |
+| attributes.cs:40:12:40:15 | [assembly: Args(...)] | 4 | attributes.cs:40:79:40:82 | null |
-| attributes.cs:41:10:41:13 | [Args(...)] | 5 | attributes.cs:41:90:41:120 | array creation of type Object[] |
+| attributes.cs:40:12:40:15 | [assembly: Args(...)] | 5 | attributes.cs:40:92:40:122 | array creation of type Object[] |
+| attributes.cs:41:10:41:13 | [module: Args(...)] | 0 | attributes.cs:41:15:41:15 | 0 |
+| attributes.cs:41:10:41:13 | [module: Args(...)] | 1 | attributes.cs:41:18:41:44 | array creation of type Object[] |
+| attributes.cs:41:10:41:13 | [module: Args(...)] | 2 | attributes.cs:41:47:41:67 | typeof(...) |
+| attributes.cs:41:10:41:13 | [module: Args(...)] | 3 | attributes.cs:41:70:41:74 | (...) ... |
+| attributes.cs:41:10:41:13 | [module: Args(...)] | 4 | attributes.cs:41:77:41:80 | null |
+| attributes.cs:41:10:41:13 | [module: Args(...)] | 5 | attributes.cs:41:90:41:120 | array creation of type Object[] |
 | attributes.cs:43:2:43:22 | [AttributeUsage(...)] | 0 | attributes.cs:43:24:43:50 | access to constant All |
 | attributes.cs:46:6:46:16 | [Conditional(...)] | 0 | attributes.cs:46:18:46:25 | "DEBUG2" |
 | attributes.cs:54:6:54:16 | [My(...)] | 0 | attributes.cs:54:18:54:22 | false |
@@ -64,6 +70,26 @@ arguments
 | attributes.cs:80:6:80:9 | [Args(...)] | 3 | attributes.cs:80:48:80:52 | (...) ... |
 | attributes.cs:80:6:80:9 | [Args(...)] | 4 | attributes.cs:80:55:80:58 | null |
 | attributes.cs:80:6:80:9 | [Args(...)] | 5 | attributes.cs:80:68:80:98 | array creation of type Object[] |
+| attributes.cs:81:14:81:17 | [return: Args(...)] | 0 | attributes.cs:81:19:81:24 | ... + ... |
+| attributes.cs:81:14:81:17 | [return: Args(...)] | 1 | attributes.cs:81:27:81:47 | array creation of type Int32[] |
+| attributes.cs:81:14:81:17 | [return: Args(...)] | 2 | attributes.cs:81:50:81:53 | null |
+| attributes.cs:81:14:81:17 | [return: Args(...)] | 3 | attributes.cs:81:56:81:60 | (...) ... |
+| attributes.cs:81:14:81:17 | [return: Args(...)] | 4 | attributes.cs:81:63:81:66 | null |
+| attributes.cs:81:14:81:17 | [return: Args(...)] | 5 | attributes.cs:81:76:81:106 | array creation of type Object[] |
+| attributes.cs:96:2:96:13 | [My3(...)] | 0 | attributes.cs:96:15:96:15 | 1 |
+| attributes.cs:97:10:97:21 | [return: My3(...)] | 0 | attributes.cs:97:23:97:23 | 2 |
+| attributes.cs:100:10:100:21 | [return: My3(...)] | 0 | attributes.cs:100:23:100:23 | 3 |
+| attributes.cs:101:8:101:19 | [My3(...)] | 0 | attributes.cs:101:21:101:21 | 4 |
+| attributes.cs:106:6:106:17 | [My3(...)] | 0 | attributes.cs:106:19:106:19 | 5 |
+| attributes.cs:107:14:107:25 | [return: My3(...)] | 0 | attributes.cs:107:27:107:27 | 6 |
+| attributes.cs:112:10:112:21 | [My3(...)] | 0 | attributes.cs:112:23:112:23 | 7 |
+| attributes.cs:113:18:113:29 | [return: My3(...)] | 0 | attributes.cs:113:31:113:31 | 8 |
+| attributes.cs:116:18:116:29 | [My3(...)] | 0 | attributes.cs:116:31:116:31 | 9 |
+| attributes.cs:117:17:117:28 | [My3(...)] | 0 | attributes.cs:117:30:117:31 | 10 |
+| attributes.cs:124:18:124:29 | [My3(...)] | 0 | attributes.cs:124:31:124:32 | 11 |
+| attributes.cs:125:18:125:29 | [return: My3(...)] | 0 | attributes.cs:125:31:125:32 | 12 |
+| attributes.cs:128:10:128:21 | [My3(...)] | 0 | attributes.cs:128:23:128:24 | 13 |
+| attributes.cs:129:17:129:28 | [My3(...)] | 0 | attributes.cs:129:30:129:31 | 14 |
 constructorArguments
 | Assembly1.dll:0:0:0:0 | [Custom(...)] | 0 | Assembly1.dll:0:0:0:0 | 1 |
 | Assembly1.dll:0:0:0:0 | [Custom(...)] | 0 | Assembly1.dll:0:0:0:0 | 3 |
@@ -80,28 +106,33 @@ constructorArguments
 | Assembly1.dll:0:0:0:0 | [Custom(...)] | 4 | Assembly1.dll:0:0:0:0 | array creation of type Int32[] |
 | Assembly1.dll:0:0:0:0 | [Custom(...)] | 4 | Assembly1.dll:0:0:0:0 | null |
 | Assembly1.dll:0:0:0:0 | [Custom(...)] | 4 | Assembly1.dll:0:0:0:0 | null |
-| attributes.cs:10:12:10:24 | [AssemblyTitle(...)] | 0 | attributes.cs:10:26:10:45 | "C# attributes test" |
+| Assembly1.dll:0:0:0:0 | [return: Custom(...)] | 0 | Assembly1.dll:0:0:0:0 | 42 |
-| attributes.cs:11:12:11:30 | [AssemblyDescription(...)] | 0 | attributes.cs:11:32:11:56 | "A test of C# attributes" |
+| Assembly1.dll:0:0:0:0 | [return: Custom(...)] | 1 | Assembly1.dll:0:0:0:0 | array creation of type Int32[] |
-| attributes.cs:12:12:12:32 | [AssemblyConfiguration(...)] | 0 | attributes.cs:12:34:12:35 | "" |
+| Assembly1.dll:0:0:0:0 | [return: Custom(...)] | 2 | Assembly1.dll:0:0:0:0 | null |
-| attributes.cs:13:12:13:26 | [AssemblyCompany(...)] | 0 | attributes.cs:13:28:13:39 | "Semmle Plc" |
+| Assembly1.dll:0:0:0:0 | [return: Custom(...)] | 3 | Assembly1.dll:0:0:0:0 | (...) ... |
-| attributes.cs:14:12:14:26 | [AssemblyProduct(...)] | 0 | attributes.cs:14:28:14:34 | "Odasa" |
+| Assembly1.dll:0:0:0:0 | [return: Custom(...)] | 4 | Assembly1.dll:0:0:0:0 | array creation of type Int32[] |
-| attributes.cs:15:12:15:28 | [AssemblyCopyright(...)] | 0 | attributes.cs:15:30:15:54 | "Copyright \u00a9 Semmle 2018" |
+| attributes.cs:10:12:10:24 | [assembly: AssemblyTitle(...)] | 0 | attributes.cs:10:26:10:45 | "C# attributes test" |
-| attributes.cs:16:12:16:28 | [AssemblyTrademark(...)] | 0 | attributes.cs:16:30:16:31 | "" |
+| attributes.cs:11:12:11:30 | [assembly: AssemblyDescription(...)] | 0 | attributes.cs:11:32:11:56 | "A test of C# attributes" |
-| attributes.cs:17:12:17:26 | [AssemblyCulture(...)] | 0 | attributes.cs:17:28:17:29 | "" |
+| attributes.cs:12:12:12:32 | [assembly: AssemblyConfiguration(...)] | 0 | attributes.cs:12:34:12:35 | "" |
-| attributes.cs:22:12:22:21 | [ComVisible(...)] | 0 | attributes.cs:22:23:22:27 | false |
+| attributes.cs:13:12:13:26 | [assembly: AssemblyCompany(...)] | 0 | attributes.cs:13:28:13:39 | "Semmle Plc" |
-| attributes.cs:25:12:25:15 | [Guid(...)] | 0 | attributes.cs:25:17:25:54 | "2f70fdd6-14aa-4850-b053-d547adb1f476" |
+| attributes.cs:14:12:14:26 | [assembly: AssemblyProduct(...)] | 0 | attributes.cs:14:28:14:34 | "Odasa" |
-| attributes.cs:37:12:37:26 | [AssemblyVersion(...)] | 0 | attributes.cs:37:28:37:36 | "1.0.0.0" |
+| attributes.cs:15:12:15:28 | [assembly: AssemblyCopyright(...)] | 0 | attributes.cs:15:30:15:54 | "Copyright \u00a9 Semmle 2018" |
-| attributes.cs:38:12:38:30 | [AssemblyFileVersion(...)] | 0 | attributes.cs:38:32:38:40 | "1.0.0.0" |
+| attributes.cs:16:12:16:28 | [assembly: AssemblyTrademark(...)] | 0 | attributes.cs:16:30:16:31 | "" |
-| attributes.cs:40:12:40:15 | [Args(...)] | 0 | attributes.cs:40:17:40:17 | 0 |
+| attributes.cs:17:12:17:26 | [assembly: AssemblyCulture(...)] | 0 | attributes.cs:17:28:17:29 | "" |
-| attributes.cs:40:12:40:15 | [Args(...)] | 1 | attributes.cs:40:20:40:46 | array creation of type Object[] |
+| attributes.cs:22:12:22:21 | [assembly: ComVisible(...)] | 0 | attributes.cs:22:23:22:27 | false |
-| attributes.cs:40:12:40:15 | [Args(...)] | 2 | attributes.cs:40:49:40:69 | typeof(...) |
+| attributes.cs:25:12:25:15 | [assembly: Guid(...)] | 0 | attributes.cs:25:17:25:54 | "2f70fdd6-14aa-4850-b053-d547adb1f476" |
-| attributes.cs:40:12:40:15 | [Args(...)] | 3 | attributes.cs:40:72:40:76 | (...) ... |
+| attributes.cs:37:12:37:26 | [assembly: AssemblyVersion(...)] | 0 | attributes.cs:37:28:37:36 | "1.0.0.0" |
-| attributes.cs:40:12:40:15 | [Args(...)] | 4 | attributes.cs:40:79:40:82 | null |
+| attributes.cs:38:12:38:30 | [assembly: AssemblyFileVersion(...)] | 0 | attributes.cs:38:32:38:40 | "1.0.0.0" |
-| attributes.cs:41:10:41:13 | [Args(...)] | 0 | attributes.cs:41:15:41:15 | 0 |
+| attributes.cs:40:12:40:15 | [assembly: Args(...)] | 0 | attributes.cs:40:17:40:17 | 0 |
-| attributes.cs:41:10:41:13 | [Args(...)] | 1 | attributes.cs:41:18:41:44 | array creation of type Object[] |
+| attributes.cs:40:12:40:15 | [assembly: Args(...)] | 1 | attributes.cs:40:20:40:46 | array creation of type Object[] |
-| attributes.cs:41:10:41:13 | [Args(...)] | 2 | attributes.cs:41:47:41:67 | typeof(...) |
+| attributes.cs:40:12:40:15 | [assembly: Args(...)] | 2 | attributes.cs:40:49:40:69 | typeof(...) |
-| attributes.cs:41:10:41:13 | [Args(...)] | 3 | attributes.cs:41:70:41:74 | (...) ... |
+| attributes.cs:40:12:40:15 | [assembly: Args(...)] | 3 | attributes.cs:40:72:40:76 | (...) ... |
-| attributes.cs:41:10:41:13 | [Args(...)] | 4 | attributes.cs:41:77:41:80 | null |
+| attributes.cs:40:12:40:15 | [assembly: Args(...)] | 4 | attributes.cs:40:79:40:82 | null |
+| attributes.cs:41:10:41:13 | [module: Args(...)] | 0 | attributes.cs:41:15:41:15 | 0 |
+| attributes.cs:41:10:41:13 | [module: Args(...)] | 1 | attributes.cs:41:18:41:44 | array creation of type Object[] |
+| attributes.cs:41:10:41:13 | [module: Args(...)] | 2 | attributes.cs:41:47:41:67 | typeof(...) |
+| attributes.cs:41:10:41:13 | [module: Args(...)] | 3 | attributes.cs:41:70:41:74 | (...) ... |
+| attributes.cs:41:10:41:13 | [module: Args(...)] | 4 | attributes.cs:41:77:41:80 | null |
 | attributes.cs:43:2:43:22 | [AttributeUsage(...)] | 0 | attributes.cs:43:24:43:50 | access to constant All |
 | attributes.cs:46:6:46:16 | [Conditional(...)] | 0 | attributes.cs:46:18:46:25 | "DEBUG2" |
 | attributes.cs:54:6:54:16 | [My(...)] | 0 | attributes.cs:54:18:54:22 | false |
@@ -120,14 +151,35 @@ constructorArguments
 | attributes.cs:80:6:80:9 | [Args(...)] | 2 | attributes.cs:80:42:80:45 | null |
 | attributes.cs:80:6:80:9 | [Args(...)] | 3 | attributes.cs:80:48:80:52 | (...) ... |
 | attributes.cs:80:6:80:9 | [Args(...)] | 4 | attributes.cs:80:55:80:58 | null |
+| attributes.cs:81:14:81:17 | [return: Args(...)] | 0 | attributes.cs:81:19:81:24 | ... + ... |
+| attributes.cs:81:14:81:17 | [return: Args(...)] | 1 | attributes.cs:81:27:81:47 | array creation of type Int32[] |
+| attributes.cs:81:14:81:17 | [return: Args(...)] | 2 | attributes.cs:81:50:81:53 | null |
+| attributes.cs:81:14:81:17 | [return: Args(...)] | 3 | attributes.cs:81:56:81:60 | (...) ... |
+| attributes.cs:81:14:81:17 | [return: Args(...)] | 4 | attributes.cs:81:63:81:66 | null |
+| attributes.cs:96:2:96:13 | [My3(...)] | 0 | attributes.cs:96:15:96:15 | 1 |
+| attributes.cs:97:10:97:21 | [return: My3(...)] | 0 | attributes.cs:97:23:97:23 | 2 |
+| attributes.cs:100:10:100:21 | [return: My3(...)] | 0 | attributes.cs:100:23:100:23 | 3 |
+| attributes.cs:101:8:101:19 | [My3(...)] | 0 | attributes.cs:101:21:101:21 | 4 |
+| attributes.cs:106:6:106:17 | [My3(...)] | 0 | attributes.cs:106:19:106:19 | 5 |
+| attributes.cs:107:14:107:25 | [return: My3(...)] | 0 | attributes.cs:107:27:107:27 | 6 |
+| attributes.cs:112:10:112:21 | [My3(...)] | 0 | attributes.cs:112:23:112:23 | 7 |
+| attributes.cs:113:18:113:29 | [return: My3(...)] | 0 | attributes.cs:113:31:113:31 | 8 |
+| attributes.cs:116:18:116:29 | [My3(...)] | 0 | attributes.cs:116:31:116:31 | 9 |
+| attributes.cs:117:17:117:28 | [My3(...)] | 0 | attributes.cs:117:30:117:31 | 10 |
+| attributes.cs:124:18:124:29 | [My3(...)] | 0 | attributes.cs:124:31:124:32 | 11 |
+| attributes.cs:125:18:125:29 | [return: My3(...)] | 0 | attributes.cs:125:31:125:32 | 12 |
+| attributes.cs:128:10:128:21 | [My3(...)] | 0 | attributes.cs:128:23:128:24 | 13 |
+| attributes.cs:129:17:129:28 | [My3(...)] | 0 | attributes.cs:129:30:129:31 | 14 |
 namedArguments
 | Assembly1.dll:0:0:0:0 | [Custom(...)] | Prop2 | Assembly1.dll:0:0:0:0 | array creation of type Object[] |
 | Assembly1.dll:0:0:0:0 | [Custom(...)] | Prop2 | Assembly1.dll:0:0:0:0 | array creation of type Object[] |
 | Assembly1.dll:0:0:0:0 | [Custom(...)] | Prop2 | Assembly1.dll:0:0:0:0 | array creation of type Object[] |
-| attributes.cs:40:12:40:15 | [Args(...)] | Prop | attributes.cs:40:92:40:122 | array creation of type Object[] |
+| Assembly1.dll:0:0:0:0 | [return: Custom(...)] | Prop2 | Assembly1.dll:0:0:0:0 | array creation of type Object[] |
-| attributes.cs:41:10:41:13 | [Args(...)] | Prop | attributes.cs:41:90:41:120 | array creation of type Object[] |
+| attributes.cs:40:12:40:15 | [assembly: Args(...)] | Prop | attributes.cs:40:92:40:122 | array creation of type Object[] |
+| attributes.cs:41:10:41:13 | [module: Args(...)] | Prop | attributes.cs:41:90:41:120 | array creation of type Object[] |
 | attributes.cs:57:6:57:16 | [My(...)] | x | attributes.cs:57:36:57:36 | 0 |
 | attributes.cs:57:6:57:16 | [My(...)] | y | attributes.cs:57:28:57:29 | "" |
 | attributes.cs:58:6:58:8 | [My2(...)] | X | attributes.cs:58:39:58:40 | 42 |
 | attributes.cs:77:2:77:5 | [Args(...)] | Prop | attributes.cs:77:63:77:93 | array creation of type Object[] |
 | attributes.cs:80:6:80:9 | [Args(...)] | Prop | attributes.cs:80:68:80:98 | array creation of type Object[] |
+| attributes.cs:81:14:81:17 | [return: Args(...)] | Prop | attributes.cs:81:76:81:106 | array creation of type Object[] |

csharp/ql/test/library-tests/attributes/AttributeComments.expected

@@ -1,4 +1,4 @@
-| attributes.cs:10:12:10:24 | [AssemblyTitle(...)] | attributes.cs:7:1:9:31 | // ... |
+| attributes.cs:10:12:10:24 | [assembly: AssemblyTitle(...)] | attributes.cs:7:1:9:31 | // ... |
-| attributes.cs:22:12:22:21 | [ComVisible(...)] | attributes.cs:19:1:21:58 | // ... |
+| attributes.cs:22:12:22:21 | [assembly: ComVisible(...)] | attributes.cs:19:1:21:58 | // ... |
-| attributes.cs:25:12:25:15 | [Guid(...)] | attributes.cs:24:1:24:84 | // ... |
+| attributes.cs:25:12:25:15 | [assembly: Guid(...)] | attributes.cs:24:1:24:84 | // ... |
-| attributes.cs:37:12:37:26 | [AssemblyVersion(...)] | attributes.cs:27:1:36:39 | // ... |
+| attributes.cs:37:12:37:26 | [assembly: AssemblyVersion(...)] | attributes.cs:27:1:36:39 | // ... |

csharp/ql/test/library-tests/attributes/AttributeElements.expected

@@ -17,17 +17,32 @@
 | attributes.cs:59:10:59:11 | M2 | attributes.cs:58:6:58:8 | [My2(...)] | My2Attribute |
 | attributes.cs:78:14:78:14 | X | attributes.cs:77:2:77:5 | [Args(...)] | ArgsAttribute |
 | attributes.cs:82:9:82:18 | SomeMethod | attributes.cs:80:6:80:9 | [Args(...)] | ArgsAttribute |
-| attributes.dll:0:0:0:0 | attributes, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null | attributes.cs:10:12:10:24 | [AssemblyTitle(...)] | System.Reflection.AssemblyTitleAttribute |
+| attributes.cs:82:9:82:18 | SomeMethod | attributes.cs:81:14:81:17 | [return: Args(...)] | ArgsAttribute |
-| attributes.dll:0:0:0:0 | attributes, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null | attributes.cs:11:12:11:30 | [AssemblyDescription(...)] | System.Reflection.AssemblyDescriptionAttribute |
+| attributes.cs:98:14:98:24 | Invoke | attributes.cs:97:10:97:21 | [return: My3(...)] | My3Attribute |
-| attributes.dll:0:0:0:0 | attributes, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null | attributes.cs:12:12:12:32 | [AssemblyConfiguration(...)] | System.Reflection.AssemblyConfigurationAttribute |
+| attributes.cs:98:14:98:24 | My1Delegate | attributes.cs:96:2:96:13 | [My3(...)] | My3Attribute |
-| attributes.dll:0:0:0:0 | attributes, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null | attributes.cs:13:12:13:26 | [AssemblyCompany(...)] | System.Reflection.AssemblyCompanyAttribute |
+| attributes.cs:102:17:102:27 | Invoke | attributes.cs:100:10:100:21 | [return: My3(...)] | My3Attribute |
-| attributes.dll:0:0:0:0 | attributes, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null | attributes.cs:14:12:14:26 | [AssemblyProduct(...)] | System.Reflection.AssemblyProductAttribute |
+| attributes.cs:102:17:102:27 | My2Delegate | attributes.cs:101:8:101:19 | [My3(...)] | My3Attribute |
-| attributes.dll:0:0:0:0 | attributes, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null | attributes.cs:15:12:15:28 | [AssemblyCopyright(...)] | System.Reflection.AssemblyCopyrightAttribute |
+| attributes.cs:108:32:108:32 | + | attributes.cs:106:6:106:17 | [My3(...)] | My3Attribute |
-| attributes.dll:0:0:0:0 | attributes, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null | attributes.cs:16:12:16:28 | [AssemblyTrademark(...)] | System.Reflection.AssemblyTrademarkAttribute |
+| attributes.cs:108:32:108:32 | + | attributes.cs:107:14:107:25 | [return: My3(...)] | My3Attribute |
-| attributes.dll:0:0:0:0 | attributes, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null | attributes.cs:17:12:17:26 | [AssemblyCulture(...)] | System.Reflection.AssemblyCultureAttribute |
+| attributes.cs:114:9:114:11 | get_Item | attributes.cs:112:10:112:21 | [My3(...)] | My3Attribute |
-| attributes.dll:0:0:0:0 | attributes, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null | attributes.cs:22:12:22:21 | [ComVisible(...)] | System.Runtime.InteropServices.ComVisibleAttribute |
+| attributes.cs:114:9:114:11 | get_Item | attributes.cs:113:18:113:29 | [return: My3(...)] | My3Attribute |
-| attributes.dll:0:0:0:0 | attributes, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null | attributes.cs:25:12:25:15 | [Guid(...)] | System.Runtime.InteropServices.GuidAttribute |
+| attributes.cs:118:9:118:11 | set_Item | attributes.cs:116:18:116:29 | [My3(...)] | My3Attribute |
-| attributes.dll:0:0:0:0 | attributes, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null | attributes.cs:37:12:37:26 | [AssemblyVersion(...)] | System.Reflection.AssemblyVersionAttribute |
+| attributes.cs:118:9:118:11 | value | attributes.cs:117:17:117:28 | [My3(...)] | My3Attribute |
-| attributes.dll:0:0:0:0 | attributes, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null | attributes.cs:38:12:38:30 | [AssemblyFileVersion(...)] | System.Reflection.AssemblyFileVersionAttribute |
+| attributes.cs:126:9:126:11 | get_Prop1 | attributes.cs:124:18:124:29 | [My3(...)] | My3Attribute |
-| attributes.dll:0:0:0:0 | attributes, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null | attributes.cs:40:12:40:15 | [Args(...)] | ArgsAttribute |
+| attributes.cs:126:9:126:11 | get_Prop1 | attributes.cs:125:18:125:29 | [return: My3(...)] | My3Attribute |
-| attributes.dll:0:0:0:0 | attributes, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null | attributes.cs:41:10:41:13 | [Args(...)] | ArgsAttribute |
+| attributes.cs:130:9:130:11 | set_Prop1 | attributes.cs:128:10:128:21 | [My3(...)] | My3Attribute |
+| attributes.cs:130:9:130:11 | value | attributes.cs:129:17:129:28 | [My3(...)] | My3Attribute |
+| attributes.dll:0:0:0:0 | attributes, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null | attributes.cs:10:12:10:24 | [assembly: AssemblyTitle(...)] | System.Reflection.AssemblyTitleAttribute |
+| attributes.dll:0:0:0:0 | attributes, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null | attributes.cs:11:12:11:30 | [assembly: AssemblyDescription(...)] | System.Reflection.AssemblyDescriptionAttribute |
+| attributes.dll:0:0:0:0 | attributes, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null | attributes.cs:12:12:12:32 | [assembly: AssemblyConfiguration(...)] | System.Reflection.AssemblyConfigurationAttribute |
+| attributes.dll:0:0:0:0 | attributes, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null | attributes.cs:13:12:13:26 | [assembly: AssemblyCompany(...)] | System.Reflection.AssemblyCompanyAttribute |
+| attributes.dll:0:0:0:0 | attributes, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null | attributes.cs:14:12:14:26 | [assembly: AssemblyProduct(...)] | System.Reflection.AssemblyProductAttribute |
+| attributes.dll:0:0:0:0 | attributes, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null | attributes.cs:15:12:15:28 | [assembly: AssemblyCopyright(...)] | System.Reflection.AssemblyCopyrightAttribute |
+| attributes.dll:0:0:0:0 | attributes, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null | attributes.cs:16:12:16:28 | [assembly: AssemblyTrademark(...)] | System.Reflection.AssemblyTrademarkAttribute |
+| attributes.dll:0:0:0:0 | attributes, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null | attributes.cs:17:12:17:26 | [assembly: AssemblyCulture(...)] | System.Reflection.AssemblyCultureAttribute |
+| attributes.dll:0:0:0:0 | attributes, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null | attributes.cs:22:12:22:21 | [assembly: ComVisible(...)] | System.Runtime.InteropServices.ComVisibleAttribute |
+| attributes.dll:0:0:0:0 | attributes, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null | attributes.cs:25:12:25:15 | [assembly: Guid(...)] | System.Runtime.InteropServices.GuidAttribute |
+| attributes.dll:0:0:0:0 | attributes, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null | attributes.cs:37:12:37:26 | [assembly: AssemblyVersion(...)] | System.Reflection.AssemblyVersionAttribute |
+| attributes.dll:0:0:0:0 | attributes, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null | attributes.cs:38:12:38:30 | [assembly: AssemblyFileVersion(...)] | System.Reflection.AssemblyFileVersionAttribute |
+| attributes.dll:0:0:0:0 | attributes, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null | attributes.cs:40:12:40:15 | [assembly: Args(...)] | ArgsAttribute |
+| attributes.dll:0:0:0:0 | attributes, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null | attributes.cs:41:10:41:13 | [module: Args(...)] | ArgsAttribute |

csharp/ql/test/library-tests/attributes/AttributeElements.ql

@@ -3,5 +3,5 @@ import csharp
 from Attributable element, Attribute attribute
 where
   attribute = element.getAnAttribute() and
-  (element.(Element).fromSource() or element.(Assembly).getName() in ["attributes", "Assembly1"])
+  (attribute.fromSource() or element.(Assembly).getName() in ["attributes", "Assembly1"])
 select element, attribute, attribute.getType().getQualifiedName()

csharp/ql/test/library-tests/attributes/PrintAst.expected

@@ -1,41 +1,41 @@
 attributes.cs:
-#   10| [Attribute] [AssemblyTitle(...)]
+#   10| [AssemblyAttribute] [assembly: AssemblyTitle(...)]
 #   10|   -1: [TypeMention] AssemblyTitleAttribute
 #   10|   0: [StringLiteral] "C# attributes test"
-#   11| [Attribute] [AssemblyDescription(...)]
+#   11| [AssemblyAttribute] [assembly: AssemblyDescription(...)]
 #   11|   -1: [TypeMention] AssemblyDescriptionAttribute
 #   11|   0: [StringLiteral] "A test of C# attributes"
-#   12| [Attribute] [AssemblyConfiguration(...)]
+#   12| [AssemblyAttribute] [assembly: AssemblyConfiguration(...)]
 #   12|   -1: [TypeMention] AssemblyConfigurationAttribute
 #   12|   0: [StringLiteral] ""
-#   13| [Attribute] [AssemblyCompany(...)]
+#   13| [AssemblyAttribute] [assembly: AssemblyCompany(...)]
 #   13|   -1: [TypeMention] AssemblyCompanyAttribute
 #   13|   0: [StringLiteral] "Semmle Plc"
-#   14| [Attribute] [AssemblyProduct(...)]
+#   14| [AssemblyAttribute] [assembly: AssemblyProduct(...)]
 #   14|   -1: [TypeMention] AssemblyProductAttribute
 #   14|   0: [StringLiteral] "Odasa"
-#   15| [Attribute] [AssemblyCopyright(...)]
+#   15| [AssemblyAttribute] [assembly: AssemblyCopyright(...)]
 #   15|   -1: [TypeMention] AssemblyCopyrightAttribute
 #   15|   0: [StringLiteral] "Copyright © Semmle 2018"
-#   16| [Attribute] [AssemblyTrademark(...)]
+#   16| [AssemblyAttribute] [assembly: AssemblyTrademark(...)]
 #   16|   -1: [TypeMention] AssemblyTrademarkAttribute
 #   16|   0: [StringLiteral] ""
-#   17| [Attribute] [AssemblyCulture(...)]
+#   17| [AssemblyAttribute] [assembly: AssemblyCulture(...)]
 #   17|   -1: [TypeMention] AssemblyCultureAttribute
 #   17|   0: [StringLiteral] ""
-#   22| [Attribute] [ComVisible(...)]
+#   22| [AssemblyAttribute] [assembly: ComVisible(...)]
 #   22|   -1: [TypeMention] ComVisibleAttribute
 #   22|   0: [BoolLiteral] false
-#   25| [Attribute] [Guid(...)]
+#   25| [AssemblyAttribute] [assembly: Guid(...)]
 #   25|   -1: [TypeMention] GuidAttribute
 #   25|   0: [StringLiteral] "2f70fdd6-14aa-4850-b053-d547adb1f476"
-#   37| [Attribute] [AssemblyVersion(...)]
+#   37| [AssemblyAttribute] [assembly: AssemblyVersion(...)]
 #   37|   -1: [TypeMention] AssemblyVersionAttribute
 #   37|   0: [StringLiteral] "1.0.0.0"
-#   38| [Attribute] [AssemblyFileVersion(...)]
+#   38| [AssemblyAttribute] [assembly: AssemblyFileVersion(...)]
 #   38|   -1: [TypeMention] AssemblyFileVersionAttribute
 #   38|   0: [StringLiteral] "1.0.0.0"
-#   40| [Attribute] [Args(...)]
+#   40| [AssemblyAttribute] [assembly: Args(...)]
 #   40|   -1: [TypeMention] ArgsAttribute
 #   40|   0: [IntLiteral] 0
 #   40|   1: [ArrayCreation] array creation of type Object[]
@@ -64,7 +64,7 @@ attributes.cs:
 #   40|       1: [TypeofExpr] typeof(...)
 #   40|         0: [TypeAccess] access to type Int32
 #   40|           0: [TypeMention] int
-#   41| [Attribute] [Args(...)]
+#   41| [ModuleAttribute] [module: Args(...)]
 #   41|   -1: [TypeMention] ArgsAttribute
 #   41|   0: [IntLiteral] 0
 #   41|   1: [ArrayCreation] array creation of type Object[]
@@ -95,7 +95,7 @@ attributes.cs:
 #   41|           0: [TypeMention] int
 #   44| [Class] Foo
 #-----|   0: (Attributes)
-#   43|     1: [Attribute] [AttributeUsage(...)]
+#   43|     1: [DefaultAttribute] [AttributeUsage(...)]
 #   43|       -1: [TypeMention] AttributeUsageAttribute
 #   43|       0: [MemberConstantAccess] access to constant All
 #   43|         -1: [TypeAccess] access to type AttributeTargets
@@ -105,7 +105,7 @@ attributes.cs:
 #   47|   5: [Method] foo
 #   47|     -1: [TypeMention] Void
 #-----|     0: (Attributes)
-#   46|       1: [Attribute] [Conditional(...)]
+#   46|       1: [DefaultAttribute] [Conditional(...)]
 #   46|         -1: [TypeMention] ConditionalAttribute
 #   46|         0: [StringLiteral] "DEBUG2"
 #   47|     4: [BlockStmt] {...}
@@ -116,7 +116,7 @@ attributes.cs:
 #   52|       0: [Parameter] x
 #   52|         -1: [TypeMention] int
 #-----|         0: (Attributes)
-#   52|           1: [Attribute] [Foo(...)]
+#   52|           1: [DefaultAttribute] [Foo(...)]
 #   52|             0: [TypeMention] Foo
 #   52|     4: [BlockStmt] {...}
 #   52|       0: [ReturnStmt] return ...;
@@ -126,19 +126,19 @@ attributes.cs:
 #   55|   6: [Method] M1
 #   55|     -1: [TypeMention] Void
 #-----|     0: (Attributes)
-#   54|       1: [Attribute] [My(...)]
+#   54|       1: [DefaultAttribute] [My(...)]
 #   54|         -1: [TypeMention] MyAttribute
 #   54|         0: [BoolLiteral] false
 #   55|     4: [BlockStmt] {...}
 #   59|   7: [Method] M2
 #   59|     -1: [TypeMention] Void
 #-----|     0: (Attributes)
-#   57|       1: [Attribute] [My(...)]
+#   57|       1: [DefaultAttribute] [My(...)]
 #   57|         -1: [TypeMention] MyAttribute
 #   57|         0: [BoolLiteral] true
 #   57|         1: [StringLiteral] ""
 #   57|         2: [IntLiteral] 0
-#   58|       2: [Attribute] [My2(...)]
+#   58|       2: [DefaultAttribute] [My2(...)]
 #   58|         -1: [TypeMention] My2Attribute
 #   58|         0: [BoolLiteral] false
 #   58|         1: [BoolLiteral] true
@@ -192,7 +192,7 @@ attributes.cs:
 #   74|     4: [BlockStmt] {...}
 #   78| [Class] X
 #-----|   0: (Attributes)
-#   77|     1: [Attribute] [Args(...)]
+#   77|     1: [DefaultAttribute] [Args(...)]
 #   77|       -1: [TypeMention] ArgsAttribute
 #   77|       0: [IntLiteral] 42
 #   77|       1: [NullLiteral] null
@@ -221,7 +221,7 @@ attributes.cs:
 #   82|   5: [Method] SomeMethod
 #   82|     -1: [TypeMention] int
 #-----|     0: (Attributes)
-#   80|       1: [Attribute] [Args(...)]
+#   80|       1: [DefaultAttribute] [Args(...)]
 #   80|         -1: [TypeMention] ArgsAttribute
 #   80|         0: [AddExpr] ... + ...
 #   80|           0: [IntLiteral] 42
@@ -248,6 +248,33 @@ attributes.cs:
 #   80|             1: [TypeofExpr] typeof(...)
 #   80|               0: [TypeAccess] access to type Int32
 #   80|                 0: [TypeMention] int
+#   81|       2: [ReturnAttribute] [return: Args(...)]
+#   81|         -1: [TypeMention] ArgsAttribute
+#   81|         0: [AddExpr] ... + ...
+#   81|           0: [IntLiteral] 42
+#   81|           1: [IntLiteral] 0
+#   81|         1: [ArrayCreation] array creation of type Int32[]
+#   81|           -2: [TypeMention] Int32[]
+#   81|             1: [TypeMention] int
+#   81|           -1: [ArrayInitializer] { ..., ... }
+#   81|             0: [IntLiteral] 1
+#   81|             1: [IntLiteral] 2
+#   81|             2: [IntLiteral] 3
+#   81|         2: [NullLiteral] null
+#   81|         3: [CastExpr] (...) ...
+#   81|           0: [TypeAccess] access to type E
+#   81|             0: [TypeMention] E
+#   81|           1: [IntLiteral] 12
+#   81|         4: [NullLiteral] null
+#   81|         5: [ArrayCreation] array creation of type Object[]
+#   81|           -2: [TypeMention] Object[]
+#   81|             1: [TypeMention] object
+#   81|           -1: [ArrayInitializer] { ..., ... }
+#   81|             0: [CastExpr] (...) ...
+#   81|               1: [IntLiteral] 1
+#   81|             1: [TypeofExpr] typeof(...)
+#   81|               0: [TypeAccess] access to type Int32
+#   81|                 0: [TypeMention] int
 #   82|     4: [BlockStmt] {...}
 #   82|       0: [ReturnStmt] return ...;
 #   82|         0: [IntLiteral] 1
@@ -273,3 +300,108 @@ attributes.cs:
 #   88|         -1: [TypeMention] int
 #   88|         1: [IntLiteral] 13
 #   88|     4: [BlockStmt] {...}
+#   91| [Class] My3Attribute
+#-----|   3: (Base types)
+#   91|     0: [TypeMention] Attribute
+#   93|   4: [InstanceConstructor] My3Attribute
+#-----|     2: (Parameters)
+#   93|       0: [Parameter] x
+#   93|         -1: [TypeMention] int
+#   93|     4: [BlockStmt] {...}
+#   98| [DelegateType] My1Delegate
+#-----|   0: (Attributes)
+#   96|     1: [DefaultAttribute] [My3(...)]
+#   96|       -1: [TypeMention] My3Attribute
+#   96|       0: [IntLiteral] 1
+#-----|   2: (Parameters)
+#   98|     0: [Parameter] message
+#   98|       -1: [TypeMention] string
+#  102| [DelegateType] My2Delegate
+#-----|   0: (Attributes)
+#  101|     1: [DefaultAttribute] [My3(...)]
+#  101|       -1: [TypeMention] My3Attribute
+#  101|       0: [IntLiteral] 4
+#-----|   2: (Parameters)
+#  102|     0: [Parameter] message
+#  102|       -1: [TypeMention] string
+#  104| [Class] MyAttributeUsage
+#  108|   5: [AddOperator] +
+#  108|     -1: [TypeMention] int
+#-----|     0: (Attributes)
+#  106|       1: [DefaultAttribute] [My3(...)]
+#  106|         -1: [TypeMention] My3Attribute
+#  106|         0: [IntLiteral] 5
+#  107|       2: [ReturnAttribute] [return: My3(...)]
+#  107|         -1: [TypeMention] My3Attribute
+#  107|         0: [IntLiteral] 6
+#-----|     2: (Parameters)
+#  108|       0: [Parameter] a
+#  108|         -1: [TypeMention] MyAttributeUsage
+#  108|       1: [Parameter] b
+#  108|         -1: [TypeMention] MyAttributeUsage
+#  108|     4: [IntLiteral] 0
+#  110|   6: [Indexer] Item
+#  110|     -1: [TypeMention] int
+#-----|     1: (Parameters)
+#  110|       0: [Parameter] x
+#  110|         -1: [TypeMention] int
+#  114|     3: [Getter] get_Item
+#-----|       0: (Attributes)
+#  112|         1: [DefaultAttribute] [My3(...)]
+#  112|           -1: [TypeMention] My3Attribute
+#  112|           0: [IntLiteral] 7
+#  113|         2: [ReturnAttribute] [return: My3(...)]
+#  113|           -1: [TypeMention] My3Attribute
+#  113|           0: [IntLiteral] 8
+#-----|       2: (Parameters)
+#  110|         0: [Parameter] x
+#  114|       4: [BlockStmt] {...}
+#  114|         0: [ReturnStmt] return ...;
+#  114|           0: [AddExpr] ... + ...
+#  114|             0: [ParameterAccess] access to parameter x
+#  114|             1: [IntLiteral] 1
+#  118|     4: [Setter] set_Item
+#-----|       0: (Attributes)
+#  116|         1: [DefaultAttribute] [My3(...)]
+#  116|           -1: [TypeMention] My3Attribute
+#  116|           0: [IntLiteral] 9
+#-----|       2: (Parameters)
+#  110|         0: [Parameter] x
+#  118|         1: [Parameter] value
+#-----|           0: (Attributes)
+#  117|             1: [DefaultAttribute] [My3(...)]
+#  117|               -1: [TypeMention] My3Attribute
+#  117|               0: [IntLiteral] 10
+#  118|       4: [BlockStmt] {...}
+#  118|         0: [ReturnStmt] return ...;
+#  121|   7: [Field] p
+#  121|     -1: [TypeMention] int
+#  122|   8: [Property] Prop1
+#  122|     -1: [TypeMention] int
+#  126|     3: [Getter] get_Prop1
+#-----|       0: (Attributes)
+#  124|         1: [DefaultAttribute] [My3(...)]
+#  124|           -1: [TypeMention] My3Attribute
+#  124|           0: [IntLiteral] 11
+#  125|         2: [ReturnAttribute] [return: My3(...)]
+#  125|           -1: [TypeMention] My3Attribute
+#  125|           0: [IntLiteral] 12
+#  126|       4: [BlockStmt] {...}
+#  126|         0: [ReturnStmt] return ...;
+#  126|           0: [FieldAccess] access to field p
+#  130|     4: [Setter] set_Prop1
+#-----|       0: (Attributes)
+#  128|         1: [DefaultAttribute] [My3(...)]
+#  128|           -1: [TypeMention] My3Attribute
+#  128|           0: [IntLiteral] 13
+#-----|       2: (Parameters)
+#  130|         0: [Parameter] value
+#-----|           0: (Attributes)
+#  129|             1: [DefaultAttribute] [My3(...)]
+#  129|               -1: [TypeMention] My3Attribute
+#  129|               0: [IntLiteral] 14
+#  130|       4: [BlockStmt] {...}
+#  130|         0: [ExprStmt] ...;
+#  130|           0: [AssignExpr] ... = ...
+#  130|             0: [FieldAccess] access to field p
+#  130|             1: [ParameterAccess] access to parameter value

csharp/ql/test/library-tests/attributes/attributes.cs

@@ -86,4 +86,47 @@ class My2Attribute : Attribute
 {
     public int X { get; set; }
     public My2Attribute(bool a, bool b, int i = 12, int j = 13) { }
+}
+
+class My3Attribute : Attribute
+{
+    public My3Attribute(int x) { }
+}
+
+[My3Attribute(1)]
+[return: My3Attribute(2)]
+delegate int My1Delegate(string message);
+
+[return: My3Attribute(3)]
+[type: My3Attribute(4)]
+delegate string My2Delegate(string message);
+
+public class MyAttributeUsage
+{
+    [My3Attribute(5)]
+    [return: My3Attribute(6)]
+    public static int operator +(MyAttributeUsage a, MyAttributeUsage b) => 0;
+
+    public int this[int x]
+    {
+        [My3Attribute(7)]
+        [return: My3Attribute(8)]
+        get { return x + 1; }
+
+        [method: My3Attribute(9)]
+        [param: My3Attribute(10)]
+        set { return; }
+    }
+
+    private int p;
+    public int Prop1
+    {
+        [method: My3Attribute(11)]
+        [return: My3Attribute(12)]
+        get { return p; }
+
+        [My3Attribute(13)]
+        [param: My3Attribute(14)]
+        set { p = value; }
+    }
 }

csharp/ql/test/library-tests/cil/attributes/attribute.ql

@@ -1,7 +1,14 @@
 import semmle.code.cil.Attribute
 import semmle.code.cil.Declaration
 
-private predicate isOsSpecific(Declaration d) { d.getQualifiedName().matches("%libobjc%") }
+private predicate isOsSpecific(Declaration d) {
+  d.getQualifiedName()
+      .matches("%" +
+          [
+            "libobjc", "libproc", "System.Diagnostics.Tracing.XplatEventLogger",
+            "System.Threading.AutoreleasePool"
+          ] + "%")
+}
 
 query predicate attrNoArg(string dec, string attr) {
   exists(Declaration d, Attribute a |

csharp/ql/test/library-tests/cil/dataflow/CallableReturns.expected

@@ -11,8 +11,8 @@ alwaysNonNull
 | System.ArgumentException System.ThrowHelper.GetAddingDuplicateWithKeyArgumentException(System.Object) |
 | System.ArgumentException System.ThrowHelper.GetWrongKeyTypeArgumentException(System.Object,System.Type) |
 | System.ArgumentException System.ThrowHelper.GetWrongValueTypeArgumentException(System.Object,System.Type) |
-| System.ArgumentNullException System.ThrowHelper.GetArgumentNullException(System.ExceptionArgument) |
 | System.Collections.Generic.KeyNotFoundException System.ThrowHelper.GetKeyNotFoundException(System.Object) |
+| System.Exception System.ThrowHelper.CreateEndOfFileException() |
 | System.Exception System.ThrowHelper.GetArraySegmentCtorValidationFailedException(System.Array,System.Int32,System.Int32) |
 | System.InvalidOperationException System.ThrowHelper.GetInvalidOperationException_EnumCurrent(System.Int32) |
 | System.Object Dataflow.NonNullMethods.ReturnsNonNull2() |
@@ -35,26 +35,35 @@ alwaysThrows
 | System.Object Dataflow.ThrowingMethods.get_ThrowProperty() | System.Exception | 0: newobj System.Exception..ctor, 1: throw |
 | System.Object Dataflow.ThrowingMethods.get_VirtualThrowProperty() | System.Exception | 0: newobj System.Exception..ctor, 1: throw |
 | System.Object System.ValueTuple.get_Item(System.Int32) | System.IndexOutOfRangeException | 0: newobj System.IndexOutOfRangeException..ctor, 1: throw |
+| System.Void System.ThrowHelper.ArgumentOutOfRangeException_Enum_Value() | System.ArgumentOutOfRangeException | 0: ldstr "value", 1: call System.SR.get_ArgumentOutOfRange_Enum, 2: newobj System.ArgumentOutOfRangeException..ctor, 3: throw |
 | System.Void System.ThrowHelper.ThrowAddingDuplicateWithKeyArgumentException`1(!0) | System.ArgumentException | 0: ldarg.0, 1: box, 2: call System.ThrowHelper.GetAddingDuplicateWithKeyArgumentException, 3: throw |
 | System.Void System.ThrowHelper.ThrowAggregateException(System.Collections.Generic.List<System.Exception>) | System.AggregateException | 0: ldarg.0, 1: newobj System.AggregateException..ctor, 2: throw |
 | System.Void System.ThrowHelper.ThrowArgumentException_Argument_InvalidArrayType() | System.ArgumentException | 0: call System.SR.get_Argument_InvalidArrayType, 1: newobj System.ArgumentException..ctor, 2: throw |
 | System.Void System.ThrowHelper.ThrowArgumentException_BadComparer(System.Object) | System.ArgumentException | 0: call System.SR.get_Arg_BogusIComparer, 1: ldarg.0, 2: call System.SR.Format, 3: newobj System.ArgumentException..ctor, 4: throw |
 | System.Void System.ThrowHelper.ThrowArgumentException_CannotExtractScalar(System.ExceptionArgument) | System.ArgumentException | 0: ldc.i4.s 31, 1: ldarg.0, 2: call System.ThrowHelper.GetArgumentException, 3: throw |
 | System.Void System.ThrowHelper.ThrowArgumentException_DestinationTooShort() | System.ArgumentException | 0: call System.SR.get_Argument_DestinationTooShort, 1: ldstr "destination", 2: newobj System.ArgumentException..ctor, 3: throw |
+| System.Void System.ThrowHelper.ThrowArgumentException_HandleNotAsync(System.String) | System.ArgumentException | 0: call System.SR.get_Arg_HandleNotAsync, 1: ldarg.0, 2: newobj System.ArgumentException..ctor, 3: throw |
+| System.Void System.ThrowHelper.ThrowArgumentException_HandleNotSync(System.String) | System.ArgumentException | 0: call System.SR.get_Arg_HandleNotSync, 1: ldarg.0, 2: newobj System.ArgumentException..ctor, 3: throw |
+| System.Void System.ThrowHelper.ThrowArgumentException_InvalidHandle(System.String) | System.ArgumentException | 0: call System.SR.get_Arg_InvalidHandle, 1: ldarg.0, 2: newobj System.ArgumentException..ctor, 3: throw |
 | System.Void System.ThrowHelper.ThrowArgumentException_OverlapAlignmentMismatch() | System.ArgumentException | 0: call System.SR.get_Argument_OverlapAlignmentMismatch, 1: newobj System.ArgumentException..ctor, 2: throw |
-| System.Void System.ThrowHelper.ThrowArgumentNullException(System.ExceptionArgument) | System.ArgumentNullException | 0: ldarg.0, 1: call System.ThrowHelper.GetArgumentNullException, 2: throw |
+| System.Void System.ThrowHelper.ThrowArgumentException_TupleIncorrectType(System.Object) | System.ArgumentException | 0: call System.SR.get_ArgumentException_ValueTupleIncorrectType, 1: ldarg.0, 2: callvirt System.Object.GetType, 3: call System.SR.Format, 4: ldstr "other", 5: newobj System.ArgumentException..ctor, 6: throw |
+| System.Void System.ThrowHelper.ThrowArgumentNullException(System.ExceptionArgument) | System.ArgumentNullException | 0: ldarg.0, 1: call System.ThrowHelper.GetArgumentName, 2: newobj System.ArgumentNullException..ctor, 3: throw |
 | System.Void System.ThrowHelper.ThrowArgumentOutOfRangeException() | System.ArgumentOutOfRangeException | 0: newobj System.ArgumentOutOfRangeException..ctor, 1: throw |
 | System.Void System.ThrowHelper.ThrowArgumentOutOfRangeException(System.ExceptionArgument) | System.ArgumentOutOfRangeException | 0: ldarg.0, 1: call System.ThrowHelper.GetArgumentName, 2: newobj System.ArgumentOutOfRangeException..ctor, 3: throw |
+| System.Void System.ThrowHelper.ThrowArgumentOutOfRangeException_NeedNonNegNum(System.String) | System.ArgumentOutOfRangeException | 0: ldarg.0, 1: call System.SR.get_ArgumentOutOfRange_NeedNonNegNum, 2: newobj System.ArgumentOutOfRangeException..ctor, 3: throw |
 | System.Void System.ThrowHelper.ThrowArgumentOutOfRangeException_PrecisionTooLarge() | System.ArgumentOutOfRangeException | 0: ldstr "precision", 1: call System.SR.get_Argument_PrecisionTooLarge, 2: ldc.i4.s 31, 3: box, 4: call System.SR.Format, 5: newobj System.ArgumentOutOfRangeException..ctor, 6: throw |
 | System.Void System.ThrowHelper.ThrowArgumentOutOfRangeException_SymbolDoesNotFit() | System.ArgumentOutOfRangeException | 0: ldstr "symbol", 1: call System.SR.get_Argument_BadFormatSpecifier, 2: newobj System.ArgumentOutOfRangeException..ctor, 3: throw |
 | System.Void System.ThrowHelper.ThrowArgumentOutOfRange_BadHourMinuteSecond() | System.ArgumentOutOfRangeException | 0: ldnull, 1: call System.SR.get_ArgumentOutOfRange_BadHourMinuteSecond, 2: newobj System.ArgumentOutOfRangeException..ctor, 3: throw |
 | System.Void System.ThrowHelper.ThrowArgumentOutOfRange_BadYearMonthDay() | System.ArgumentOutOfRangeException | 0: ldnull, 1: call System.SR.get_ArgumentOutOfRange_BadYearMonthDay, 2: newobj System.ArgumentOutOfRangeException..ctor, 3: throw |
+| System.Void System.ThrowHelper.ThrowArgumentOutOfRange_DayNumber(System.Int32) | System.ArgumentOutOfRangeException | 0: ldstr "dayNumber", 1: ldarg.0, 2: box, 3: call System.SR.get_ArgumentOutOfRange_DayNumber, 4: newobj System.ArgumentOutOfRangeException..ctor, 5: throw |
 | System.Void System.ThrowHelper.ThrowArgumentOutOfRange_IndexException() | System.ArgumentOutOfRangeException | 0: ldc.i4.s 31, 1: ldc.i4.0, 2: call System.ThrowHelper.GetArgumentOutOfRangeException, 3: throw |
+| System.Void System.ThrowHelper.ThrowArgumentOutOfRange_Month(System.Int32) | System.ArgumentOutOfRangeException | 0: ldstr "month", 1: ldarg.0, 2: box, 3: call System.SR.get_ArgumentOutOfRange_Month, 4: newobj System.ArgumentOutOfRangeException..ctor, 5: throw |
 | System.Void System.ThrowHelper.ThrowArgumentOutOfRange_TimeSpanTooLong() | System.ArgumentOutOfRangeException | 0: ldnull, 1: call System.SR.get_Overflow_TimeSpanTooLong, 2: newobj System.ArgumentOutOfRangeException..ctor, 3: throw |
 | System.Void System.ThrowHelper.ThrowArgumentOutOfRange_Year() | System.ArgumentOutOfRangeException | 0: ldc.i4.s 31, 1: ldc.i4.4, 2: call System.ThrowHelper.GetArgumentOutOfRangeException, 3: throw |
 | System.Void System.ThrowHelper.ThrowArraySegmentCtorValidationFailedExceptions(System.Array,System.Int32,System.Int32) | System.Exception | 0: ldarg.0, 1: ldarg.1, 2: ldarg.2, 3: call System.ThrowHelper.GetArraySegmentCtorValidationFailedException, 4: throw |
 | System.Void System.ThrowHelper.ThrowArrayTypeMismatchException() | System.ArrayTypeMismatchException | 0: newobj System.ArrayTypeMismatchException..ctor, 1: throw |
 | System.Void System.ThrowHelper.ThrowCountArgumentOutOfRange_ArgumentOutOfRange_Count() | System.ArgumentOutOfRangeException | 0: ldc.i4.s 31, 1: ldc.i4.3, 2: call System.ThrowHelper.GetArgumentOutOfRangeException, 3: throw |
+| System.Void System.ThrowHelper.ThrowEndOfFileException() | System.Exception | 0: call System.ThrowHelper.CreateEndOfFileException, 1: throw |
 | System.Void System.ThrowHelper.ThrowFormatException_BadFormatSpecifier() | System.FormatException | 0: call System.SR.get_Argument_BadFormatSpecifier, 1: newobj System.FormatException..ctor, 2: throw |
 | System.Void System.ThrowHelper.ThrowIndexArgumentOutOfRange_NeedNonNegNumException() | System.ArgumentOutOfRangeException | 0: ldc.i4.s 31, 1: ldc.i4.s 31, 2: call System.ThrowHelper.GetArgumentOutOfRangeException, 3: throw |
 | System.Void System.ThrowHelper.ThrowIndexOutOfRangeException() | System.IndexOutOfRangeException | 0: newobj System.IndexOutOfRangeException..ctor, 1: throw |
@@ -72,6 +81,12 @@ alwaysThrows
 | System.Void System.ThrowHelper.ThrowKeyNotFoundException`1(!0) | System.Collections.Generic.KeyNotFoundException | 0: ldarg.0, 1: box, 2: call System.ThrowHelper.GetKeyNotFoundException, 3: throw |
 | System.Void System.ThrowHelper.ThrowLengthArgumentOutOfRange_ArgumentOutOfRange_NeedNonNegNum() | System.ArgumentOutOfRangeException | 0: ldc.i4.s 31, 1: ldc.i4.s 31, 2: call System.ThrowHelper.GetArgumentOutOfRangeException, 3: throw |
 | System.Void System.ThrowHelper.ThrowNotSupportedException() | System.NotSupportedException | 0: newobj System.NotSupportedException..ctor, 1: throw |
+| System.Void System.ThrowHelper.ThrowNotSupportedException_UnreadableStream() | System.NotSupportedException | 0: call System.SR.get_NotSupported_UnreadableStream, 1: newobj System.NotSupportedException..ctor, 2: throw |
+| System.Void System.ThrowHelper.ThrowNotSupportedException_UnseekableStream() | System.NotSupportedException | 0: call System.SR.get_NotSupported_UnseekableStream, 1: newobj System.NotSupportedException..ctor, 2: throw |
+| System.Void System.ThrowHelper.ThrowNotSupportedException_UnwritableStream() | System.NotSupportedException | 0: call System.SR.get_NotSupported_UnwritableStream, 1: newobj System.NotSupportedException..ctor, 2: throw |
+| System.Void System.ThrowHelper.ThrowObjectDisposedException_FileClosed() | System.ObjectDisposedException | 0: ldnull, 1: call System.SR.get_ObjectDisposed_FileClosed, 2: newobj System.ObjectDisposedException..ctor, 3: throw |
+| System.Void System.ThrowHelper.ThrowObjectDisposedException_StreamClosed(System.String) | System.ObjectDisposedException | 0: ldarg.0, 1: call System.SR.get_ObjectDisposed_StreamClosed, 2: newobj System.ObjectDisposedException..ctor, 3: throw |
+| System.Void System.ThrowHelper.ThrowOutOfMemoryException() | System.OutOfMemoryException | 0: newobj System.OutOfMemoryException..ctor, 1: throw |
 | System.Void System.ThrowHelper.ThrowStartIndexArgumentOutOfRange_ArgumentOutOfRange_Index() | System.ArgumentOutOfRangeException | 0: ldc.i4.8, 1: ldc.i4.0, 2: call System.ThrowHelper.GetArgumentOutOfRangeException, 3: throw |
 | System.Void System.ThrowHelper.ThrowValueArgumentOutOfRange_NeedNonNegNumException() | System.ArgumentOutOfRangeException | 0: ldc.i4.7, 1: ldc.i4.s 31, 2: call System.ThrowHelper.GetArgumentOutOfRangeException, 3: throw |
 | System.Void System.ThrowHelper.ThrowWrongKeyTypeArgumentException`1(!0,System.Type) | System.ArgumentException | 0: ldarg.0, 1: box, 2: ldarg.1, 3: call System.ThrowHelper.GetWrongKeyTypeArgumentException, 4: throw |

csharp/ql/test/library-tests/cil/dataflow/TrivialProperties.expected

@@ -5,7 +5,6 @@
 | System.Reflection.AssemblyName.CodeBase |
 | System.Reflection.AssemblyName.CultureInfo |
 | System.Reflection.AssemblyName.HashAlgorithm |
-| System.Reflection.AssemblyName.KeyPair |
 | System.Reflection.AssemblyName.Name |
 | System.Reflection.AssemblyName.Version |
 | System.Reflection.AssemblyName.VersionCompatibility |

csharp/ql/test/library-tests/cil/enums/enums.expected

@@ -6,22 +6,26 @@
 | Interop.PollEvents | short |
 | Interop.Sys.AccessMode | int |
 | Interop.Sys.ControlCharacterNames | int |
-| Interop.Sys.CtrlCode | int |
 | Interop.Sys.FileAdvice | int |
 | Interop.Sys.FileStatusFlags | int |
 | Interop.Sys.LockOperations | int |
 | Interop.Sys.NodeType | int |
 | Interop.Sys.OpenFlags | int |
+| Interop.Sys.Permissions | int |
 | Interop.Sys.SeekWhence | int |
 | Interop.Sys.SysConfName | int |
 | Interop.Sys.SysLogPriority | int |
+| Interop.Sys.UnixFileSystemTypes | long |
+| Microsoft.Win32.SafeHandles.SafeFileHandle.NullableBool | int |
+| Microsoft.Win32.SafeHandles.SafeFileHandle.ThreadPoolValueTaskSource.Operation | byte |
 | System.AttributeTargets | int |
 | System.Base64FormattingOptions | int |
 | System.Buffers.ArrayPoolEventSource.BufferAllocatedReason | int |
+| System.Buffers.ArrayPoolEventSource.BufferDroppedReason | int |
 | System.Buffers.OperationStatus | int |
 | System.Buffers.Text.Utf8Parser.ComponentParseResult | byte |
 | System.Buffers.Text.Utf8Parser.ParseNumberOptions | int |
-| System.Buffers.TlsOverPerCoreLockedStacksArrayPool.MemoryPressure | int |
+| System.Buffers.Utilities.MemoryPressure | int |
 | System.Collections.Generic.InsertionBehavior | byte |
 | System.ComponentModel.EditorBrowsableState | int |
 | System.Configuration.Assemblies.AssemblyHashAlgorithm | int |
@@ -43,7 +47,6 @@
 | System.Diagnostics.DebuggableAttribute.DebuggingModes | int |
 | System.Diagnostics.DebuggerBrowsableState | int |
 | System.Diagnostics.StackTrace.TraceFormat | int |
-| System.Diagnostics.SymbolStore.SymAddressKind | int |
 | System.Diagnostics.Tracing.ControllerCommand | int |
 | System.Diagnostics.Tracing.EventActivityOptions | int |
 | System.Diagnostics.Tracing.EventChannel | byte |
@@ -55,7 +58,6 @@
 | System.Diagnostics.Tracing.EventLevel | int |
 | System.Diagnostics.Tracing.EventManifestOptions | int |
 | System.Diagnostics.Tracing.EventOpcode | int |
-| System.Diagnostics.Tracing.EventPipeMetadataGenerator.MetadataTag | int |
 | System.Diagnostics.Tracing.EventPipeSerializationFormat | int |
 | System.Diagnostics.Tracing.EventProvider.WriteEventErrorCode | int |
 | System.Diagnostics.Tracing.EventProviderType | int |
@@ -63,6 +65,8 @@
 | System.Diagnostics.Tracing.EventTags | int |
 | System.Diagnostics.Tracing.EventTask | int |
 | System.Diagnostics.Tracing.ManifestEnvelope.ManifestFormats | byte |
+| System.Diagnostics.Tracing.NativeRuntimeEventSource.ThreadAdjustmentReasonMap | uint |
+| System.Diagnostics.Tracing.RuntimeEventSource.EventId | int |
 | System.Diagnostics.Tracing.TraceLoggingDataType | int |
 | System.Environment.SpecialFolder | int |
 | System.Environment.SpecialFolderOption | int |
@@ -113,6 +117,10 @@
 | System.IO.FileOptions | int |
 | System.IO.FileShare | int |
 | System.IO.HandleInheritability | int |
+| System.IO.MatchCasing | int |
+| System.IO.MatchType | int |
+| System.IO.SearchOption | int |
+| System.IO.SearchTarget | int |
 | System.IO.SeekOrigin | int |
 | System.LazyState | int |
 | System.LoaderOptimization | int |
@@ -153,6 +161,8 @@
 | System.Reflection.MethodAttributes | int |
 | System.Reflection.MethodImplAttributes | int |
 | System.Reflection.MethodSemanticsAttributes | int |
+| System.Reflection.NullabilityInfoContext.NotAnnotatedStatus | int |
+| System.Reflection.NullabilityState | int |
 | System.Reflection.PInvokeAttributes | int |
 | System.Reflection.ParameterAttributes | int |
 | System.Reflection.PortableExecutableKinds | int |
@@ -192,6 +202,7 @@
 | System.Runtime.InteropServices.ComTypes.TYPEKIND | int |
 | System.Runtime.InteropServices.ComTypes.VARFLAGS | short |
 | System.Runtime.InteropServices.ComTypes.VARKIND | int |
+| System.Runtime.InteropServices.ComWrappersScenario | int |
 | System.Runtime.InteropServices.CreateComInterfaceFlags | int |
 | System.Runtime.InteropServices.CreateObjectFlags | int |
 | System.Runtime.InteropServices.CustomQueryInterfaceMode | int |
@@ -199,6 +210,8 @@
 | System.Runtime.InteropServices.DllImportSearchPath | int |
 | System.Runtime.InteropServices.GCHandleType | int |
 | System.Runtime.InteropServices.LayoutKind | int |
+| System.Runtime.InteropServices.ObjectiveC.ObjectiveCMarshal.MessageSendFunction | int |
+| System.Runtime.InteropServices.PosixSignal | int |
 | System.Runtime.InteropServices.UnmanagedType | int |
 | System.Runtime.InteropServices.VarEnum | int |
 | System.Runtime.Intrinsics.X86.FloatComparisonMode | byte |
@@ -229,6 +242,9 @@
 | System.Threading.EventResetMode | int |
 | System.Threading.LazyThreadSafetyMode | int |
 | System.Threading.LockRecursionPolicy | int |
+| System.Threading.OpenExistingResult | int |
+| System.Threading.PortableThreadPool.HillClimbing.StateOrTransition | int |
+| System.Threading.PortableThreadPool.PendingBlockingAdjustment | byte |
 | System.Threading.ReaderWriterLockSlim.EnterLockType | int |
 | System.Threading.ReaderWriterLockSlim.EnterSpinLockReason | int |
 | System.Threading.ReaderWriterLockSlim.WaiterStates | byte |
@@ -240,13 +256,13 @@
 | System.Threading.Tasks.InternalTaskOptions | int |
 | System.Threading.Tasks.Sources.ValueTaskSourceOnCompletedFlags | int |
 | System.Threading.Tasks.Sources.ValueTaskSourceStatus | int |
+| System.Threading.Tasks.Task.TaskStateFlags | int |
 | System.Threading.Tasks.TaskContinuationOptions | int |
 | System.Threading.Tasks.TaskCreationOptions | int |
 | System.Threading.Tasks.TaskStatus | int |
 | System.Threading.Tasks.TplEventSource.TaskWaitBehavior | int |
 | System.Threading.ThreadPriority | int |
 | System.Threading.ThreadState | int |
-| System.Threading.WaitHandle.OpenExistingResult | int |
 | System.TimeZoneInfo.StringSerializer.State | int |
 | System.TimeZoneInfo.TZVersion | byte |
 | System.TimeZoneInfo.TimeZoneInfoResult | int |

csharp/ql/test/library-tests/cil/functionPointers/functionPointers.expected

@@ -6,9 +6,16 @@ fnptr
 | delegate* managed<Int32&,Object& modreq(OutAttribute),Int32> | 2 | Int32 | 0 |
 | delegate* managed<Int32*,Void*> | 1 | Void* | 0 |
 | delegate* managed<Int32> | 0 | Int32 | 0 |
-| delegate* managed<IntPtr,IntPtr,IntPtr*,Void> | 3 | void | 0 |
+| delegate* managed<IntPtr,IntPtr,PortableTailCallFrame*,Void> | 3 | void | 0 |
+| delegate* managed<Object,Void> | 1 | void | 0 |
 | delegate* managed<Void*,Int32*> | 1 | Int32* | 0 |
+| delegate* managed<Void*,Object> | 1 | Object | 0 |
 | delegate* unmanaged<Char*,IntPtr,Void> | 2 | void | 9 |
+| delegate* unmanaged<Int32,PosixSignal,Int32> | 2 | Int32 | 9 |
+| delegate* unmanaged<IntPtr,Guid*,IntPtr*,Int32> | 3 | Int32 | 9 |
+| delegate* unmanaged<IntPtr,Int32> | 1 | Int32 | 9 |
+| delegate* unmanaged<IntPtr,Void> | 1 | void | 9 |
+| delegate* unmanaged<Void> | 0 | void | 9 |
 | delegate* unmanaged[StdCall]<Int32&,Object& modreq(OutAttribute),!0,Void> | 3 | void | 2 |
 params
 | delegate* managed<!0,Int32> | 0 | Parameter 0 of delegate* managed<!0,Int32> | !0 |
@@ -20,12 +27,21 @@ params
 | delegate* managed<Int32&,Object& modreq(OutAttribute),Int32> | 0 | Parameter 0 of delegate* managed<Int32&,Object& modreq(OutAttribute),Int32> | Int32& |
 | delegate* managed<Int32&,Object& modreq(OutAttribute),Int32> | 1 | Parameter 1 of delegate* managed<Int32&,Object& modreq(OutAttribute),Int32> | Object& |
 | delegate* managed<Int32*,Void*> | 0 | Parameter 0 of delegate* managed<Int32*,Void*> | Int32* |
-| delegate* managed<IntPtr,IntPtr,IntPtr*,Void> | 0 | Parameter 0 of delegate* managed<IntPtr,IntPtr,IntPtr*,Void> | IntPtr |
+| delegate* managed<IntPtr,IntPtr,PortableTailCallFrame*,Void> | 0 | Parameter 0 of delegate* managed<IntPtr,IntPtr,PortableTailCallFrame*,Void> | IntPtr |
-| delegate* managed<IntPtr,IntPtr,IntPtr*,Void> | 1 | Parameter 1 of delegate* managed<IntPtr,IntPtr,IntPtr*,Void> | IntPtr |
+| delegate* managed<IntPtr,IntPtr,PortableTailCallFrame*,Void> | 1 | Parameter 1 of delegate* managed<IntPtr,IntPtr,PortableTailCallFrame*,Void> | IntPtr |
-| delegate* managed<IntPtr,IntPtr,IntPtr*,Void> | 2 | Parameter 2 of delegate* managed<IntPtr,IntPtr,IntPtr*,Void> | IntPtr* |
+| delegate* managed<IntPtr,IntPtr,PortableTailCallFrame*,Void> | 2 | Parameter 2 of delegate* managed<IntPtr,IntPtr,PortableTailCallFrame*,Void> | PortableTailCallFrame* |
+| delegate* managed<Object,Void> | 0 | Parameter 0 of delegate* managed<Object,Void> | Object |
 | delegate* managed<Void*,Int32*> | 0 | Parameter 0 of delegate* managed<Void*,Int32*> | Void* |
+| delegate* managed<Void*,Object> | 0 | Parameter 0 of delegate* managed<Void*,Object> | Void* |
 | delegate* unmanaged<Char*,IntPtr,Void> | 0 | Parameter 0 of delegate* unmanaged<Char*,IntPtr,Void> | Char* |
 | delegate* unmanaged<Char*,IntPtr,Void> | 1 | Parameter 1 of delegate* unmanaged<Char*,IntPtr,Void> | IntPtr |
+| delegate* unmanaged<Int32,PosixSignal,Int32> | 0 | Parameter 0 of delegate* unmanaged<Int32,PosixSignal,Int32> | Int32 |
+| delegate* unmanaged<Int32,PosixSignal,Int32> | 1 | Parameter 1 of delegate* unmanaged<Int32,PosixSignal,Int32> | PosixSignal |
+| delegate* unmanaged<IntPtr,Guid*,IntPtr*,Int32> | 0 | Parameter 0 of delegate* unmanaged<IntPtr,Guid*,IntPtr*,Int32> | IntPtr |
+| delegate* unmanaged<IntPtr,Guid*,IntPtr*,Int32> | 1 | Parameter 1 of delegate* unmanaged<IntPtr,Guid*,IntPtr*,Int32> | Guid* |
+| delegate* unmanaged<IntPtr,Guid*,IntPtr*,Int32> | 2 | Parameter 2 of delegate* unmanaged<IntPtr,Guid*,IntPtr*,Int32> | IntPtr* |
+| delegate* unmanaged<IntPtr,Int32> | 0 | Parameter 0 of delegate* unmanaged<IntPtr,Int32> | IntPtr |
+| delegate* unmanaged<IntPtr,Void> | 0 | Parameter 0 of delegate* unmanaged<IntPtr,Void> | IntPtr |
 | delegate* unmanaged[StdCall]<Int32&,Object& modreq(OutAttribute),!0,Void> | 0 | Parameter 0 of delegate* unmanaged[StdCall]<Int32&,Object& modreq(OutAttribute),!0,Void> | Int32& |
 | delegate* unmanaged[StdCall]<Int32&,Object& modreq(OutAttribute),!0,Void> | 1 | Parameter 1 of delegate* unmanaged[StdCall]<Int32&,Object& modreq(OutAttribute),!0,Void> | Object& |
 | delegate* unmanaged[StdCall]<Int32&,Object& modreq(OutAttribute),!0,Void> | 2 | Parameter 2 of delegate* unmanaged[StdCall]<Int32&,Object& modreq(OutAttribute),!0,Void> | !0 |

csharp/ql/test/library-tests/cil/init-only-prop/customModifiers.expected

@@ -4,20 +4,19 @@
 | Invoke | System.Runtime.InteropServices.InAttribute | modreq |
 | Max | System.Runtime.InteropServices.InAttribute | modreq |
 | Min | System.Runtime.InteropServices.InAttribute | modreq |
+| ThreadIDExecutingCallbacks | System.Runtime.CompilerServices.IsVolatile | modreq |
 | Value | System.Runtime.CompilerServices.IsVolatile | modreq |
 | _bufferedValuesIndex | System.Runtime.CompilerServices.IsVolatile | modreq |
-| _callbackPartitions | System.Runtime.CompilerServices.IsVolatile | modreq |
+| _canSeek | System.Runtime.CompilerServices.IsVolatile | modreq |
-| _canceled | System.Runtime.CompilerServices.IsVolatile | modreq |
 | _container | System.Runtime.CompilerServices.IsVolatile | modreq |
 | _fullyInitialized | System.Runtime.CompilerServices.IsVolatile | modreq |
 | _head | System.Runtime.CompilerServices.IsVolatile | modreq |
+| _idsThatDoNotTrackAllValues | System.Runtime.CompilerServices.IsVolatile | modreq |
 | _initialized | System.Runtime.CompilerServices.IsVolatile | modreq |
-| _isFullyInitialized | System.Runtime.CompilerServices.IsVolatile | modreq |
 | _isWriterInProgress | System.Runtime.CompilerServices.IsVolatile | modreq |
 | _kernelEvent | System.Runtime.CompilerServices.IsVolatile | modreq |
 | _localTimeZone | System.Runtime.CompilerServices.IsVolatile | modreq |
 | _next | System.Runtime.CompilerServices.IsVolatile | modreq |
-| _notifyWhenNoCallbacksRunning | System.Runtime.CompilerServices.IsVolatile | modreq |
 | _oldKeepAlive | System.Runtime.CompilerServices.IsVolatile | modreq |
 | _owner | System.Runtime.CompilerServices.IsVolatile | modreq |
 | _previous | System.Runtime.CompilerServices.IsVolatile | modreq |
@@ -27,8 +26,8 @@
 | _saShortTimes | System.Runtime.CompilerServices.IsVolatile | modreq |
 | _slotArray | System.Runtime.CompilerServices.IsVolatile | modreq |
 | _state | System.Runtime.CompilerServices.IsVolatile | modreq |
+| _supportsRandomAccess | System.Runtime.CompilerServices.IsVolatile | modreq |
 | _tail | System.Runtime.CompilerServices.IsVolatile | modreq |
-| _threadIDExecutingCallbacks | System.Runtime.CompilerServices.IsVolatile | modreq |
 | _timer | System.Runtime.CompilerServices.IsVolatile | modreq |
 | _version | System.Runtime.CompilerServices.IsVolatile | modreq |
 | _waCalendars | System.Runtime.CompilerServices.IsVolatile | modreq |
@@ -63,34 +62,39 @@
 | m_mask | System.Runtime.CompilerServices.IsVolatile | modreq |
 | m_nameIsCached | System.Runtime.CompilerServices.IsVolatile | modreq |
 | m_rawManifest | System.Runtime.CompilerServices.IsVolatile | modreq |
-| m_signature | System.Runtime.CompilerServices.IsVolatile | modreq |
 | m_stateFlags | System.Runtime.CompilerServices.IsVolatile | modreq |
 | m_tail | System.Runtime.CompilerServices.IsVolatile | modreq |
 | m_tailIndex | System.Runtime.CompilerServices.IsVolatile | modreq |
-| m_taskId | System.Runtime.CompilerServices.IsVolatile | modreq |
 | m_taskSchedulerId | System.Runtime.CompilerServices.IsVolatile | modreq |
 | m_waitHandle | System.Runtime.CompilerServices.IsVolatile | modreq |
 | numOutstandingThreadRequests | System.Runtime.CompilerServices.IsVolatile | modreq |
+| numRequestedWorkers | System.Runtime.CompilerServices.IsVolatile | modreq |
 | property Current | System.Runtime.InteropServices.InAttribute | modreq |
 | property Item | System.Runtime.InteropServices.InAttribute | modreq |
 | s_DefaultThreadCurrentCulture | System.Runtime.CompilerServices.IsVolatile | modreq |
 | s_DefaultThreadCurrentUICulture | System.Runtime.CompilerServices.IsVolatile | modreq |
 | s_Invariant | System.Runtime.CompilerServices.IsVolatile | modreq |
+| s_allContexts | System.Runtime.CompilerServices.IsVolatile | modreq |
 | s_anonymouslyHostedDynamicMethodsModule | System.Runtime.CompilerServices.IsVolatile | modreq |
 | s_cachedCultures | System.Runtime.CompilerServices.IsVolatile | modreq |
 | s_cachedCulturesByLcid | System.Runtime.CompilerServices.IsVolatile | modreq |
 | s_cachedCulturesByName | System.Runtime.CompilerServices.IsVolatile | modreq |
 | s_cachedRegions | System.Runtime.CompilerServices.IsVolatile | modreq |
+| s_canceledTask | System.Runtime.CompilerServices.IsVolatile | modreq |
 | s_currentRegionInfo | System.Runtime.CompilerServices.IsVolatile | modreq |
 | s_defaultBinder | System.Runtime.CompilerServices.IsVolatile | modreq |
+| s_defaultFlowSuppressed | System.Runtime.CompilerServices.IsVolatile | modreq |
 | s_defaultInstance | System.Runtime.CompilerServices.IsVolatile | modreq |
+| s_emitAnsiColorCodes | System.Runtime.CompilerServices.IsVolatile | modreq |
 | s_encoding | System.Runtime.CompilerServices.IsVolatile | modreq |
-| s_haveProcessId | System.Runtime.CompilerServices.IsVolatile | modreq |
 | s_indentSize | System.Runtime.CompilerServices.IsVolatile | modreq |
 | s_initialized | System.Runtime.CompilerServices.IsVolatile | modreq |
 | s_invariantInfo | System.Runtime.CompilerServices.IsVolatile | modreq |
 | s_jajpDTFI | System.Runtime.CompilerServices.IsVolatile | modreq |
 | s_japaneseEraInfo | System.Runtime.CompilerServices.IsVolatile | modreq |
+| s_osVersion | System.Runtime.CompilerServices.IsVolatile | modreq |
+| s_processId | System.Runtime.CompilerServices.IsVolatile | modreq |
+| s_processPath | System.Runtime.CompilerServices.IsVolatile | modreq |
 | s_provider | System.Runtime.CompilerServices.IsVolatile | modreq |
 | s_providers | System.Runtime.CompilerServices.IsVolatile | modreq |
 | s_regionNames | System.Runtime.CompilerServices.IsVolatile | modreq |

csharp/ql/test/library-tests/cil/typeAnnotations/typeAnnotations.ql

@@ -1,31 +1,59 @@
 import cil
 import semmle.code.cil.Type
 
-private string elementType(Element e) {
+private string elementType(Element e, string toString) {
-  e instanceof Method and result = "method"
+  toString = e.(Method).getQualifiedName() and result = "method"
   or
-  e instanceof Property and result = "property"
+  toString = e.(Property).getQualifiedName() and result = "property"
   or
-  e instanceof Parameter and result = "parameter"
+  e =
+    any(Parameter p |
+      toString = "Parameter " + p.getIndex() + " of " + p.getDeclaringElement().getQualifiedName()
+    ) and
+  result = "parameter"
   or
-  e instanceof LocalVariable and result = "local"
+  e =
+    any(LocalVariable v |
+      toString =
+        "Local variable " + v.getIndex() + " of method " +
+          v.getImplementation().getMethod().getQualifiedName()
+    ) and
+  result = "local"
   or
-  e instanceof FunctionPointerType and result = "fnptr"
+  toString = e.(FunctionPointerType).getQualifiedName() and result = "fnptr"
   or
   not e instanceof Method and
   not e instanceof Property and
   not e instanceof Parameter and
   not e instanceof LocalVariable and
   not e instanceof FunctionPointerType and
-  result = "other"
+  result = "other" and
+  toString = e.toString()
 }
 
-from Element e, int i
+private predicate exclude(string s) {
+  s in [
+      "Parameter 0 of Interop.libobjc.NSOperatingSystemVersion_objc_msgSend_stret",
+      "Parameter 1 of Interop.procfs.TryParseStatusFile",
+      "Parameter 1 of Interop.procfs.TryReadFile",
+      "Parameter 1 of Interop.procfs.TryReadStatusFile",
+      "Parameter 1 of System.CLRConfig.GetBoolValue",
+      "Parameter 1 of System.CLRConfig.GetConfigBoolValue",
+      "Parameter 1 of System.Runtime.InteropServices.ObjectiveC.ObjectiveCMarshal.CreateReferenceTrackingHandleInternal",
+      "Parameter 2 of System.Runtime.InteropServices.ObjectiveC.ObjectiveCMarshal.CreateReferenceTrackingHandleInternal",
+      "Parameter 2 of System.Runtime.InteropServices.ObjectiveC.ObjectiveCMarshal.InvokeUnhandledExceptionPropagation",
+    ]
+}
+
+from Element e, int i, string toString, string type
 where
   cil_type_annotation(e, i) and
+  type = elementType(e, toString) and
+  not exclude(toString) and
   (
-    not e instanceof Parameter or
+    not e instanceof Parameter
+    or
     e.(Parameter).getDeclaringElement().(Method).getDeclaringType().getQualifiedName() !=
       "System.Environment" // There are OS specific methods in this class
   )
-select e.toString(), elementType(e), i
+select toString, type, i

csharp/ql/test/library-tests/commons/TargetFramework/HasElement.expected

@@ -1,2 +1,2 @@
-| NetFramework4.6.1.cs:7:7:7:8 | C1 | NetFramework4.6.1.cs:5:12:5:69 | [TargetFramework(...)] |
+| NetFramework4.6.1.cs:7:7:7:8 | C1 | NetFramework4.6.1.cs:5:12:5:69 | [assembly: TargetFramework(...)] |
-| NetFramework4.6.1.cs:11:7:11:8 | C2 | NetFramework4.6.1.cs:5:12:5:69 | [TargetFramework(...)] |
+| NetFramework4.6.1.cs:11:7:11:8 | C2 | NetFramework4.6.1.cs:5:12:5:69 | [assembly: TargetFramework(...)] |

csharp/ql/test/library-tests/commons/TargetFramework/NetCore.expected

@@ -1 +1 @@
-| NetCore2.0.cs:5:12:5:26 | [TargetFramework(...)] |
+| NetCore2.0.cs:5:12:5:26 | [assembly: TargetFramework(...)] |

csharp/ql/test/library-tests/commons/TargetFramework/NetFramework.expected

@@ -1,2 +1,2 @@
-| NetFramework4.6.1.cs:5:12:5:69 | [TargetFramework(...)] |
+| NetFramework4.6.1.cs:5:12:5:69 | [assembly: TargetFramework(...)] |
-| NetFramework4.6.cs:5:12:5:35 | [TargetFramework(...)] |
+| NetFramework4.6.cs:5:12:5:35 | [assembly: TargetFramework(...)] |

csharp/ql/test/library-tests/commons/TargetFramework/NetStandard.expected

@@ -1 +1 @@
-| NetStandard1.3.cs:5:12:5:26 | [TargetFramework(...)] |
+| NetStandard1.3.cs:5:12:5:26 | [assembly: TargetFramework(...)] |

csharp/ql/test/library-tests/commons/TargetFramework/TargetFrameworks.expected

@@ -1,4 +1,4 @@
-| NetCore2.0.cs:5:12:5:26 | [TargetFramework(...)] | .NETCoreApp | 2.0 |
+| NetCore2.0.cs:5:12:5:26 | [assembly: TargetFramework(...)] | .NETCoreApp | 2.0 |
-| NetFramework4.6.1.cs:5:12:5:69 | [TargetFramework(...)] | .NETFramework | 4.6.1 |
+| NetFramework4.6.1.cs:5:12:5:69 | [assembly: TargetFramework(...)] | .NETFramework | 4.6.1 |
-| NetFramework4.6.cs:5:12:5:35 | [TargetFramework(...)] | .NETFramework | 4.6 |
+| NetFramework4.6.cs:5:12:5:35 | [assembly: TargetFramework(...)] | .NETFramework | 4.6 |
-| NetStandard1.3.cs:5:12:5:26 | [TargetFramework(...)] | .NETStandard | 1.3 |
+| NetStandard1.3.cs:5:12:5:26 | [assembly: TargetFramework(...)] | .NETStandard | 1.3 |

csharp/ql/test/library-tests/controlflow/graph/NodeGraph.expected

@@ -1187,8 +1187,8 @@ Assert.cs:
 #-----|  -> access to local variable s
 
 #   24| access to local variable s
-#-----| null -> [assertion failure] call to method IsNotNull
 #-----| non-null -> [assertion success] call to method IsNotNull
+#-----| null -> [assertion failure] call to method IsNotNull
 
 #   25| call to method WriteLine
 #-----|  -> exit M3 (normal)
@@ -1376,8 +1376,8 @@ Assert.cs:
 #-----|  -> null
 
 #   45| ... != ...
-#-----| true -> [assertion failure] call to method IsFalse
 #-----| false -> [assertion success] call to method IsFalse
+#-----| true -> [assertion failure] call to method IsFalse
 
 #   45| null
 #-----|  -> ... != ...
@@ -1440,8 +1440,8 @@ Assert.cs:
 #-----|  -> null
 
 #   52| ... == ...
-#-----| true -> [assertion failure] call to method IsFalse
 #-----| false -> [assertion success] call to method IsFalse
+#-----| true -> [assertion failure] call to method IsFalse
 
 #   52| null
 #-----|  -> ... == ...
@@ -2068,12 +2068,12 @@ Assert.cs:
 #-----|  -> [b (line 84): true] access to local variable s
 
 #   95| [b (line 84): false] access to local variable s
-#-----| null -> [assertion failure, b (line 84): false] call to method IsNotNull
 #-----| non-null -> [assertion success, b (line 84): false] call to method IsNotNull
+#-----| null -> [assertion failure, b (line 84): false] call to method IsNotNull
 
 #   95| [b (line 84): true] access to local variable s
-#-----| null -> [assertion failure, b (line 84): true] call to method IsNotNull
 #-----| non-null -> [assertion success, b (line 84): true] call to method IsNotNull
+#-----| null -> [assertion failure, b (line 84): true] call to method IsNotNull
 
 #   96| [b (line 84): false] call to method WriteLine
 #-----|  -> [b (line 84): false] ...;
@@ -2338,12 +2338,12 @@ Assert.cs:
 #-----|  -> [b (line 84): true] null
 
 #  107| [b (line 84): false] ... != ...
-#-----| true -> [assertion failure, b (line 84): false] call to method IsFalse
 #-----| false -> [assertion success, b (line 84): false] call to method IsFalse
+#-----| true -> [assertion failure, b (line 84): false] call to method IsFalse
 
 #  107| [b (line 84): true] ... != ...
-#-----| true -> [assertion failure, b (line 84): true] call to method IsFalse
 #-----| false -> [assertion success, b (line 84): true] call to method IsFalse
+#-----| true -> [assertion failure, b (line 84): true] call to method IsFalse
 
 #  107| [b (line 84): false] null
 #-----|  -> [b (line 84): false] ... != ...
@@ -2430,12 +2430,12 @@ Assert.cs:
 #-----|  -> [b (line 84): true] null
 
 #  111| [b (line 84): false] ... == ...
-#-----| true -> [assertion failure, b (line 84): false] call to method IsFalse
 #-----| false -> [assertion success, b (line 84): false] call to method IsFalse
+#-----| true -> [assertion failure, b (line 84): false] call to method IsFalse
 
 #  111| [b (line 84): true] ... == ...
-#-----| true -> [assertion failure, b (line 84): true] call to method IsFalse
 #-----| false -> [assertion success, b (line 84): true] call to method IsFalse
+#-----| true -> [assertion failure, b (line 84): true] call to method IsFalse
 
 #  111| [b (line 84): false] null
 #-----|  -> [b (line 84): false] ... == ...
@@ -2771,15 +2771,15 @@ Assert.cs:
 #-----|  -> this access
 
 #  140| access to parameter b1
-#-----| true -> access to parameter b2
 #-----| false -> [assertion failure] access to parameter b2
+#-----| true -> access to parameter b2
 
 #  140| [assertion failure] access to parameter b2
-#-----| true -> [assertion failure] access to parameter b3
+#-----| false -> [assertion failure] access to parameter b3
 
 #  140| access to parameter b2
-#-----| true -> [assertion failure] access to parameter b3
 #-----| false -> [assertion success] access to parameter b3
+#-----| true -> [assertion failure] access to parameter b3
 
 #  140| [assertion failure] access to parameter b3
 #-----|  -> [assertion failure] call to method AssertTrueFalse
@@ -2980,8 +2980,8 @@ BreakInTry.cs:
 #-----|  -> null
 
 #   15| ... == ...
-#-----| true -> ;
 #-----| false -> exit M1 (normal)
+#-----| true -> ;
 
 #   15| null
 #-----|  -> ... == ...
@@ -3116,8 +3116,8 @@ BreakInTry.cs:
 #-----|  -> access to parameter args
 
 #   47| [finally: return] foreach (... ... in ...) ...
-#-----| non-empty -> [finally: return] String arg
 #-----| return -> exit M3 (normal)
+#-----| non-empty -> [finally: return] String arg
 
 #   47| foreach (... ... in ...) ...
 #-----| non-empty -> String arg
@@ -3216,12 +3216,12 @@ BreakInTry.cs:
 #-----|  -> access to parameter args
 
 #   65| [finally: return] foreach (... ... in ...) ...
-#-----| non-empty -> [finally: return] String arg
 #-----| return -> exit M4 (normal)
+#-----| non-empty -> [finally: return] String arg
 
 #   65| foreach (... ... in ...) ...
-#-----| non-empty -> String arg
 #-----| empty -> exit M4 (normal)
+#-----| non-empty -> String arg
 
 #   65| String arg
 #-----|  -> {...}
@@ -3396,12 +3396,12 @@ ConditionalAccess.cs:
 #-----|  -> exit M1
 
 #    3| access to parameter i
-#-----| non-null -> call to method ToString
 #-----| null -> exit M1 (normal)
+#-----| non-null -> call to method ToString
 
 #    3| call to method ToString
-#-----| non-null -> call to method ToLower
 #-----| null -> exit M1 (normal)
+#-----| non-null -> call to method ToLower
 
 #    3| call to method ToLower
 #-----|  -> exit M1 (normal)
@@ -3415,8 +3415,8 @@ ConditionalAccess.cs:
 #-----|  -> exit M2
 
 #    5| access to parameter s
-#-----| non-null -> access to property Length
 #-----| null -> exit M2 (normal)
+#-----| non-null -> access to property Length
 
 #    5| access to property Length
 #-----|  -> exit M2 (normal)
@@ -3434,8 +3434,8 @@ ConditionalAccess.cs:
 #-----| null -> access to parameter s2
 
 #    7| ... ?? ...
-#-----| non-null -> access to property Length
 #-----| null -> exit M3 (normal)
+#-----| non-null -> access to property Length
 
 #    7| [non-null] ... ?? ...
 #-----| non-null -> access to property Length
@@ -3524,8 +3524,8 @@ ConditionalAccess.cs:
 #-----|  -> exit M6
 
 #   19| access to parameter s1
-#-----| non-null -> access to parameter s2
 #-----| null -> exit M6 (normal)
+#-----| non-null -> access to parameter s2
 
 #   19| call to method CommaJoinWith
 #-----|  -> exit M6 (normal)
@@ -3621,8 +3621,8 @@ ConditionalAccess.cs:
 #-----|  -> ... = ...
 
 #   35| access to property Prop
-#-----| non-null -> call to method Out
 #-----| null -> exit M8 (normal)
+#-----| non-null -> call to method Out
 
 #   35| this access
 #-----|  -> access to property Prop
@@ -4058,8 +4058,8 @@ Conditions.cs:
 #-----| true -> [b (line 46): true] ...;
 
 #   51| access to parameter b
-#-----| true -> [b (line 46): true] ...;
 #-----| false -> [b (line 46): false] access to parameter x
+#-----| true -> [b (line 46): true] ...;
 
 #   52| [b (line 46): true] access to local variable y
 #-----|  -> [b (line 46): true] ...++
@@ -4163,8 +4163,8 @@ Conditions.cs:
 #-----| true -> [b (line 57): true] ...;
 
 #   62| access to parameter b
-#-----| true -> [b (line 57): true] ...;
 #-----| false -> [b (line 57): false] access to parameter x
+#-----| true -> [b (line 57): true] ...;
 
 #   63| [b (line 57): true] access to local variable y
 #-----|  -> [b (line 57): true] ...++
@@ -4580,8 +4580,8 @@ Conditions.cs:
 #-----|  -> access to parameter args
 
 #  116| ... < ...
-#-----| true -> {...}
 #-----| false -> exit M9 (normal)
+#-----| true -> {...}
 
 #  116| access to parameter args
 #-----|  -> access to property Length
@@ -4632,8 +4632,8 @@ Conditions.cs:
 #-----| true -> [last (line 118): false] ...;
 
 #  119| access to local variable last
-#-----| true -> [false, last (line 118): true] !...
 #-----| false -> [true, last (line 118): false] !...
+#-----| true -> [false, last (line 118): true] !...
 
 #  120| [last (line 118): false] ... = ...
 #-----|  -> [last (line 118): false] if (...) ...
@@ -5073,8 +5073,8 @@ ExitMethods.cs:
 #-----|  -> access to parameter b
 
 #   68| access to parameter b
-#-----| true -> object creation of type Exception
 #-----| false -> exit ErrorMaybe (normal)
+#-----| true -> object creation of type Exception
 
 #   69| throw ...;
 #-----| exception(Exception) -> exit ErrorMaybe (abnormal)
@@ -5230,8 +5230,8 @@ ExitMethods.cs:
 #-----|  -> 0
 
 #  112| ... != ...
-#-----| false -> "input"
 #-----| true -> 1
+#-----| false -> "input"
 
 #  112| ... ? ... : ...
 #-----|  -> return ...;
@@ -5354,8 +5354,8 @@ ExitMethods.cs:
 #-----|  -> exit AssertFalse (normal)
 
 #  132| access to parameter b
-#-----| true -> [assertion failure] call to method IsFalse
 #-----| false -> [assertion success] call to method IsFalse
+#-----| true -> [assertion failure] call to method IsFalse
 
 #  134| enter FailingAssertion3
 #-----|  -> {...}
@@ -5558,8 +5558,8 @@ Finally.cs:
 #-----|  -> ...;
 
 #   11| call to method WriteLine
-#-----|  -> {...}
 #-----| exception(Exception) -> [finally: exception(Exception)] {...}
+#-----|  -> {...}
 
 #   11| ...;
 #-----|  -> "Try1"
@@ -5612,8 +5612,8 @@ Finally.cs:
 #-----|  -> ...;
 
 #   23| call to method WriteLine
-#-----| exception(Exception) -> [exception: Exception] catch (...) {...}
 #-----|  -> return ...;
+#-----| exception(Exception) -> [exception: Exception] catch (...) {...}
 
 #   23| ...;
 #-----|  -> "Try2"
@@ -5752,8 +5752,8 @@ Finally.cs:
 #-----|  -> ...;
 
 #   58| call to method WriteLine
-#-----| exception(Exception) -> [exception: Exception] catch (...) {...}
 #-----|  -> return ...;
+#-----| exception(Exception) -> [exception: Exception] catch (...) {...}
 
 #   58| ...;
 #-----|  -> "Try3"
@@ -5880,8 +5880,8 @@ Finally.cs:
 #-----|  -> 0
 
 #   77| ... > ...
-#-----| true -> {...}
 #-----| false -> exit M4 (normal)
+#-----| true -> {...}
 
 #   77| 0
 #-----|  -> ... > ...
@@ -6179,16 +6179,16 @@ Finally.cs:
 #-----|  -> this access
 
 #  107| access to field Field
-#-----| exception(NullReferenceException) -> [finally: exception(NullReferenceException)] {...}
 #-----|  -> access to property Length
+#-----| exception(NullReferenceException) -> [finally: exception(NullReferenceException)] {...}
 
 #  107| this access
 #-----|  -> access to field Field
 
 #  107| access to property Length
+#-----|  -> 0
 #-----| exception(Exception) -> [finally: exception(Exception)] {...}
 #-----| exception(NullReferenceException) -> [finally: exception(NullReferenceException)] {...}
-#-----|  -> 0
 
 #  107| ... == ...
 #-----| true -> return ...;
@@ -6204,16 +6204,16 @@ Finally.cs:
 #-----|  -> this access
 
 #  109| access to field Field
-#-----| exception(NullReferenceException) -> [finally: exception(NullReferenceException)] {...}
 #-----|  -> access to property Length
+#-----| exception(NullReferenceException) -> [finally: exception(NullReferenceException)] {...}
 
 #  109| this access
 #-----|  -> access to field Field
 
 #  109| access to property Length
+#-----|  -> 1
 #-----| exception(Exception) -> [finally: exception(Exception)] {...}
 #-----| exception(NullReferenceException) -> [finally: exception(NullReferenceException)] {...}
-#-----|  -> 1
 
 #  109| ... == ...
 #-----| true -> object creation of type OutOfMemoryException
@@ -6335,24 +6335,24 @@ Finally.cs:
 #-----|  -> 0
 
 #  114| ... == ...
-#-----| true -> [false] !...
 #-----| false -> [true] !...
+#-----| true -> [false] !...
 
 #  114| [finally: exception(Exception)] ... == ...
-#-----| true -> [false, finally: exception(Exception)] !...
 #-----| false -> [true, finally: exception(Exception)] !...
+#-----| true -> [false, finally: exception(Exception)] !...
 
 #  114| [finally: exception(NullReferenceException)] ... == ...
-#-----| true -> [false, finally: exception(NullReferenceException)] !...
 #-----| false -> [true, finally: exception(NullReferenceException)] !...
+#-----| true -> [false, finally: exception(NullReferenceException)] !...
 
 #  114| [finally: exception(OutOfMemoryException)] ... == ...
-#-----| true -> [false, finally: exception(OutOfMemoryException)] !...
 #-----| false -> [true, finally: exception(OutOfMemoryException)] !...
+#-----| true -> [false, finally: exception(OutOfMemoryException)] !...
 
 #  114| [finally: return] ... == ...
-#-----| true -> [false, finally: return] !...
 #-----| false -> [true, finally: return] !...
+#-----| true -> [false, finally: return] !...
 
 #  114| 0
 #-----|  -> ... == ...
@@ -6490,24 +6490,24 @@ Finally.cs:
 #-----|  -> 0
 
 #  116| ... > ...
-#-----| true -> ...;
 #-----| false -> exit M5 (normal)
+#-----| true -> ...;
 
 #  116| [finally: exception(Exception)] ... > ...
-#-----| true -> [finally: exception(Exception)] ...;
 #-----| exception(Exception) -> exit M5 (abnormal)
+#-----| true -> [finally: exception(Exception)] ...;
 
 #  116| [finally: exception(NullReferenceException)] ... > ...
-#-----| true -> [finally: exception(NullReferenceException)] ...;
 #-----| exception(NullReferenceException) -> exit M5 (abnormal)
+#-----| true -> [finally: exception(NullReferenceException)] ...;
 
 #  116| [finally: exception(OutOfMemoryException)] ... > ...
-#-----| true -> [finally: exception(OutOfMemoryException)] ...;
 #-----| exception(OutOfMemoryException) -> exit M5 (abnormal)
+#-----| true -> [finally: exception(OutOfMemoryException)] ...;
 
 #  116| [finally: return] ... > ...
-#-----| true -> [finally: return] ...;
 #-----| return -> exit M5 (normal)
+#-----| true -> [finally: return] ...;
 
 #  116| 0
 #-----|  -> ... > ...
@@ -6622,8 +6622,8 @@ Finally.cs:
 #-----|  -> ...;
 
 #  137| call to method WriteLine
-#-----|  -> {...}
 #-----| exception(Exception) -> [finally: exception(Exception)] {...}
+#-----|  -> {...}
 
 #  137| ...;
 #-----|  -> "Try"
@@ -6741,31 +6741,31 @@ Finally.cs:
 #-----|  -> access to property Length
 
 #  158| [finally: exception(ArgumentNullException)] access to property Length
+#-----|  -> [finally: exception(ArgumentNullException)] 1
 #-----| exception(Exception) -> [finally: exception(ArgumentNullException), exception: Exception] catch (...) {...}
 #-----| exception(NullReferenceException) -> [finally: exception(ArgumentNullException), exception: NullReferenceException] catch (...) {...}
-#-----|  -> [finally: exception(ArgumentNullException)] 1
 
 #  158| [finally: exception(Exception)] access to property Length
+#-----|  -> [finally: exception(Exception)] 1
 #-----| exception(Exception) -> [finally: exception(Exception), exception: Exception] catch (...) {...}
 #-----| exception(NullReferenceException) -> [finally: exception(Exception), exception: NullReferenceException] catch (...) {...}
-#-----|  -> [finally: exception(Exception)] 1
 
 #  158| access to property Length
+#-----|  -> 1
 #-----| exception(Exception) -> [exception: Exception] catch (...) {...}
 #-----| exception(NullReferenceException) -> [exception: NullReferenceException] catch (...) {...}
-#-----|  -> 1
 
 #  158| ... == ...
-#-----| true -> "1"
 #-----| false -> exit M8 (normal)
+#-----| true -> "1"
 
 #  158| [finally: exception(ArgumentNullException)] ... == ...
-#-----| true -> [finally: exception(ArgumentNullException)] "1"
 #-----| exception(ArgumentNullException) -> exit M8 (abnormal)
+#-----| true -> [finally: exception(ArgumentNullException)] "1"
 
 #  158| [finally: exception(Exception)] ... == ...
-#-----| true -> [finally: exception(Exception)] "1"
 #-----| exception(Exception) -> exit M8 (abnormal)
+#-----| true -> [finally: exception(Exception)] "1"
 
 #  158| 1
 #-----|  -> ... == ...
@@ -6786,16 +6786,16 @@ Finally.cs:
 #-----| exception(Exception) -> [exception: Exception] catch (...) {...}
 
 #  159| [finally: exception(ArgumentNullException)] object creation of type Exception
-#-----| exception(Exception) -> [finally: exception(ArgumentNullException), exception: Exception] catch (...) {...}
 #-----|  -> [finally: exception(ArgumentNullException)] throw ...;
+#-----| exception(Exception) -> [finally: exception(ArgumentNullException), exception: Exception] catch (...) {...}
 
 #  159| [finally: exception(Exception)] object creation of type Exception
-#-----| exception(Exception) -> [finally: exception(Exception), exception: Exception] catch (...) {...}
 #-----|  -> [finally: exception(Exception)] throw ...;
+#-----| exception(Exception) -> [finally: exception(Exception), exception: Exception] catch (...) {...}
 
 #  159| object creation of type Exception
-#-----| exception(Exception) -> [exception: Exception] catch (...) {...}
 #-----|  -> throw ...;
+#-----| exception(Exception) -> [exception: Exception] catch (...) {...}
 
 #  159| "1"
 #-----|  -> object creation of type Exception
@@ -7090,16 +7090,16 @@ Finally.cs:
 #-----|  -> [finally: exception(ExceptionA), b1 (line 176): true] access to parameter b2
 
 #  186| [b1 (line 176): false] access to parameter b2
-#-----| true -> [b1 (line 176): false, b2 (line 176): true] object creation of type ExceptionB
 #-----| false -> exit M9 (normal)
+#-----| true -> [b1 (line 176): false, b2 (line 176): true] object creation of type ExceptionB
 
 #  186| [finally: exception(Exception), b1 (line 176): true] access to parameter b2
-#-----| true -> [finally: exception(Exception), b1 (line 176): true, b2 (line 176): true] object creation of type ExceptionB
 #-----| exception(Exception) -> exit M9 (abnormal)
+#-----| true -> [finally: exception(Exception), b1 (line 176): true, b2 (line 176): true] object creation of type ExceptionB
 
 #  186| [finally: exception(ExceptionA), b1 (line 176): true] access to parameter b2
-#-----| true -> [finally: exception(ExceptionA), b1 (line 176): true, b2 (line 176): true] object creation of type ExceptionB
 #-----| exception(ExceptionA) -> exit M9 (abnormal)
+#-----| true -> [finally: exception(ExceptionA), b1 (line 176): true, b2 (line 176): true] object creation of type ExceptionB
 
 #  186| [b1 (line 176): false, b2 (line 176): true] throw ...;
 #-----| exception(ExceptionB) -> [exception: ExceptionB, b1 (line 176): false, b2 (line 176): true] catch (...) {...}
@@ -7111,34 +7111,34 @@ Finally.cs:
 #-----| exception(ExceptionB) -> [finally: exception(ExceptionA), exception: ExceptionB, b1 (line 176): true, b2 (line 176): true] catch (...) {...}
 
 #  186| [b1 (line 176): false, b2 (line 176): true] object creation of type ExceptionB
-#-----| exception(Exception) -> [exception: Exception, b1 (line 176): false, b2 (line 176): true] catch (...) {...}
 #-----|  -> [b1 (line 176): false, b2 (line 176): true] throw ...;
+#-----| exception(Exception) -> [exception: Exception, b1 (line 176): false, b2 (line 176): true] catch (...) {...}
 
 #  186| [finally: exception(Exception), b1 (line 176): true, b2 (line 176): true] object creation of type ExceptionB
-#-----| exception(Exception) -> [finally: exception(Exception), exception: Exception, b1 (line 176): true, b2 (line 176): true] catch (...) {...}
 #-----|  -> [finally: exception(Exception), b1 (line 176): true, b2 (line 176): true] throw ...;
+#-----| exception(Exception) -> [finally: exception(Exception), exception: Exception, b1 (line 176): true, b2 (line 176): true] catch (...) {...}
 
 #  186| [finally: exception(ExceptionA), b1 (line 176): true, b2 (line 176): true] object creation of type ExceptionB
-#-----| exception(Exception) -> [finally: exception(ExceptionA), exception: Exception, b1 (line 176): true, b2 (line 176): true] catch (...) {...}
 #-----|  -> [finally: exception(ExceptionA), b1 (line 176): true, b2 (line 176): true] throw ...;
+#-----| exception(Exception) -> [finally: exception(ExceptionA), exception: Exception, b1 (line 176): true, b2 (line 176): true] catch (...) {...}
 
 #  188| [exception: Exception, b1 (line 176): false, b2 (line 176): true] catch (...) {...}
-#-----| match -> [exception: Exception, b1 (line 176): false, b2 (line 176): true] access to parameter b2
 #-----| exception(Exception) -> exit M9 (abnormal)
+#-----| match -> [exception: Exception, b1 (line 176): false, b2 (line 176): true] access to parameter b2
 
 #  188| [exception: ExceptionB, b1 (line 176): false, b2 (line 176): true] catch (...) {...}
 #-----| match -> [exception: ExceptionB, b1 (line 176): false, b2 (line 176): true] access to parameter b2
 
 #  188| [finally: exception(Exception), exception: Exception, b1 (line 176): true, b2 (line 176): true] catch (...) {...}
-#-----| match -> [finally: exception(Exception), exception: Exception, b1 (line 176): true, b2 (line 176): true] access to parameter b2
 #-----| exception(Exception) -> exit M9 (abnormal)
+#-----| match -> [finally: exception(Exception), exception: Exception, b1 (line 176): true, b2 (line 176): true] access to parameter b2
 
 #  188| [finally: exception(Exception), exception: ExceptionB, b1 (line 176): true, b2 (line 176): true] catch (...) {...}
 #-----| match -> [finally: exception(Exception), exception: ExceptionB, b1 (line 176): true, b2 (line 176): true] access to parameter b2
 
 #  188| [finally: exception(ExceptionA), exception: Exception, b1 (line 176): true, b2 (line 176): true] catch (...) {...}
-#-----| match -> [finally: exception(ExceptionA), exception: Exception, b1 (line 176): true, b2 (line 176): true] access to parameter b2
 #-----| exception(Exception) -> exit M9 (abnormal)
+#-----| match -> [finally: exception(ExceptionA), exception: Exception, b1 (line 176): true, b2 (line 176): true] access to parameter b2
 
 #  188| [finally: exception(ExceptionA), exception: ExceptionB, b1 (line 176): true, b2 (line 176): true] catch (...) {...}
 #-----| match -> [finally: exception(ExceptionA), exception: ExceptionB, b1 (line 176): true, b2 (line 176): true] access to parameter b2
@@ -7358,32 +7358,32 @@ Finally.cs:
 #-----|  -> access to parameter b3
 
 #  209| [finally(1): exception(Exception)] access to parameter b3
-#-----| true -> [finally(1): exception(Exception)] object creation of type ExceptionC
 #-----| exception(Exception) -> exit M10 (abnormal)
+#-----| true -> [finally(1): exception(Exception)] object creation of type ExceptionC
 
 #  209| [finally(1): exception(ExceptionB)] access to parameter b3
-#-----| true -> [finally(1): exception(ExceptionB)] object creation of type ExceptionC
 #-----| exception(ExceptionB) -> exit M10 (abnormal)
+#-----| true -> [finally(1): exception(ExceptionB)] object creation of type ExceptionC
 
 #  209| [finally: exception(Exception), finally(1): exception(Exception)] access to parameter b3
-#-----| true -> [finally: exception(Exception), finally(1): exception(Exception)] object creation of type ExceptionC
 #-----| exception(Exception) -> exit M10 (abnormal)
+#-----| true -> [finally: exception(Exception), finally(1): exception(Exception)] object creation of type ExceptionC
 
 #  209| [finally: exception(Exception), finally(1): exception(ExceptionB)] access to parameter b3
-#-----| true -> [finally: exception(Exception), finally(1): exception(ExceptionB)] object creation of type ExceptionC
 #-----| exception(ExceptionB) -> exit M10 (abnormal)
+#-----| true -> [finally: exception(Exception), finally(1): exception(ExceptionB)] object creation of type ExceptionC
 
 #  209| [finally: exception(Exception)] access to parameter b3
 #-----| true -> [finally: exception(Exception)] object creation of type ExceptionC
 #-----| false -> [finally: exception(Exception)] ...;
 
 #  209| [finally: exception(ExceptionA), finally(1): exception(Exception)] access to parameter b3
-#-----| true -> [finally: exception(ExceptionA), finally(1): exception(Exception)] object creation of type ExceptionC
 #-----| exception(Exception) -> exit M10 (abnormal)
+#-----| true -> [finally: exception(ExceptionA), finally(1): exception(Exception)] object creation of type ExceptionC
 
 #  209| [finally: exception(ExceptionA), finally(1): exception(ExceptionB)] access to parameter b3
-#-----| true -> [finally: exception(ExceptionA), finally(1): exception(ExceptionB)] object creation of type ExceptionC
 #-----| exception(ExceptionB) -> exit M10 (abnormal)
+#-----| true -> [finally: exception(ExceptionA), finally(1): exception(ExceptionB)] object creation of type ExceptionC
 
 #  209| [finally: exception(ExceptionA)] access to parameter b3
 #-----| true -> [finally: exception(ExceptionA)] object creation of type ExceptionC
@@ -7776,8 +7776,8 @@ Finally.cs:
 #-----|  -> [finally: exception(ExceptionA)] call to method WriteLine
 
 #  254| call to method WriteLine
-#-----|  -> {...}
 #-----| exception(Exception) -> [finally: exception(Exception)] {...}
+#-----|  -> {...}
 
 #  254| ...;
 #-----|  -> "Mid finally"
@@ -7851,8 +7851,8 @@ Finally.cs:
 #-----|  -> ...;
 
 #  267| call to method WriteLine
-#-----|  -> {...}
 #-----| exception(Exception) -> [finally: exception(Exception)] {...}
+#-----|  -> {...}
 
 #  267| ...;
 #-----|  -> "1"
@@ -7927,8 +7927,8 @@ Foreach.cs:
 #-----|  -> access to parameter args
 
 #    8| foreach (... ... in ...) ...
-#-----| non-empty -> String arg
 #-----| empty -> exit M1 (normal)
+#-----| non-empty -> String arg
 
 #    8| String arg
 #-----|  -> ;
@@ -7951,8 +7951,8 @@ Foreach.cs:
 #-----|  -> access to parameter args
 
 #   14| foreach (... ... in ...) ...
-#-----| non-empty -> String _
 #-----| empty -> exit M2 (normal)
+#-----| non-empty -> String _
 
 #   14| String _
 #-----|  -> ;
@@ -7975,8 +7975,8 @@ Foreach.cs:
 #-----|  -> access to parameter e
 
 #   20| foreach (... ... in ...) ...
-#-----| non-empty -> String x
 #-----| empty -> exit M3 (normal)
+#-----| non-empty -> String x
 
 #   20| String x
 #-----|  -> ;
@@ -8010,8 +8010,8 @@ Foreach.cs:
 #-----|  -> access to parameter args
 
 #   26| foreach (... ... in ...) ...
-#-----| non-empty -> String x
 #-----| empty -> exit M4 (normal)
+#-----| non-empty -> String x
 
 #   26| (..., ...)
 #-----|  -> ;
@@ -8040,8 +8040,8 @@ Foreach.cs:
 #-----|  -> access to parameter args
 
 #   32| foreach (... ... in ...) ...
-#-----| non-empty -> String x
 #-----| empty -> exit M5 (normal)
+#-----| non-empty -> String x
 
 #   32| (..., ...)
 #-----|  -> ;
@@ -8070,8 +8070,8 @@ Foreach.cs:
 #-----|  -> access to parameter args
 
 #   38| foreach (... ... in ...) ...
-#-----| non-empty -> String x
 #-----| empty -> exit M6 (normal)
+#-----| non-empty -> String x
 
 #   38| (..., ...)
 #-----|  -> ;
@@ -8739,8 +8739,8 @@ LoopUnrolling.cs:
 #-----| non-empty -> String arg
 
 #   11| foreach (... ... in ...) ...
-#-----| non-empty -> String arg
 #-----| empty -> exit M1 (normal)
+#-----| non-empty -> String arg
 
 #   11| String arg
 #-----|  -> ...;
@@ -8796,8 +8796,8 @@ LoopUnrolling.cs:
 #-----| non-empty -> String x
 
 #   18| foreach (... ... in ...) ...
-#-----| non-empty -> String x
 #-----| empty -> exit M2 (normal)
+#-----| non-empty -> String x
 
 #   18| String x
 #-----|  -> ...;
@@ -8826,8 +8826,8 @@ LoopUnrolling.cs:
 #-----|  -> access to parameter args
 
 #   24| foreach (... ... in ...) ...
-#-----| non-empty -> Char arg
 #-----| empty -> exit M3 (normal)
+#-----| non-empty -> Char arg
 
 #   24| Char arg
 #-----|  -> access to parameter args
@@ -8949,8 +8949,8 @@ LoopUnrolling.cs:
 #-----| non-empty -> String x
 
 #   40| foreach (... ... in ...) ...
-#-----| non-empty -> String x
 #-----| empty -> exit M5 (normal)
+#-----| non-empty -> String x
 
 #   40| String x
 #-----|  -> access to local variable ys
@@ -9079,12 +9079,12 @@ LoopUnrolling.cs:
 #-----|  -> { ..., ... }
 
 #   58| [b (line 55): false] foreach (... ... in ...) ...
-#-----| non-empty -> [b (line 55): false] String x
 #-----| empty -> exit M7 (normal)
+#-----| non-empty -> [b (line 55): false] String x
 
 #   58| [b (line 55): true] foreach (... ... in ...) ...
-#-----| non-empty -> [b (line 55): true] String x
 #-----| empty -> exit M7 (normal)
+#-----| non-empty -> [b (line 55): true] String x
 
 #   58| [unroll (line 58)] foreach (... ... in ...) ...
 #-----| non-empty -> String x
@@ -9183,8 +9183,8 @@ LoopUnrolling.cs:
 #-----|  -> call to method Any<String>
 
 #   69| call to method Any<String>
-#-----| true -> [false] !...
 #-----| false -> [true] !...
+#-----| true -> [false] !...
 
 #   70| return ...;
 #-----| return -> exit M8 (normal)
@@ -9298,8 +9298,8 @@ LoopUnrolling.cs:
 #-----| non-empty -> String x
 
 #   97| foreach (... ... in ...) ...
-#-----| non-empty -> String x
 #-----| empty -> exit M11 (normal)
+#-----| non-empty -> String x
 
 #   97| String x
 #-----|  -> {...}
@@ -10388,8 +10388,8 @@ Patterns.cs:
 #-----| true -> {...}
 
 #    8| Int32 i1
-#-----| no-match -> [false] ... is ...
 #-----| match -> [true] ... is ...
+#-----| no-match -> [false] ... is ...
 
 #    9| {...}
 #-----|  -> ...;
@@ -10422,8 +10422,8 @@ Patterns.cs:
 #-----| true -> {...}
 
 #   12| String s1
-#-----| no-match -> [false] ... is ...
 #-----| match -> [true] ... is ...
+#-----| no-match -> [false] ... is ...
 
 #   13| {...}
 #-----|  -> ...;
@@ -10456,8 +10456,8 @@ Patterns.cs:
 #-----| true -> {...}
 
 #   16| Object v1
-#-----| no-match -> [false] ... is ...
 #-----| match -> [true] ... is ...
+#-----| no-match -> [false] ... is ...
 
 #   17| {...}
 #-----|  -> switch (...) {...}
@@ -10482,8 +10482,8 @@ Patterns.cs:
 #-----|  -> Int32 i2
 
 #   24| Int32 i2
-#-----| no-match -> case ...:
 #-----| match -> access to local variable i2
+#-----| no-match -> case ...:
 
 #   24| access to local variable i2
 #-----|  -> 0
@@ -10693,8 +10693,8 @@ Patterns.cs:
 #-----| no-match -> { ... }
 
 #   54| 1
-#-----| no-match -> [no-match] { ... }
 #-----| match -> [match] { ... }
+#-----| no-match -> [no-match] { ... }
 
 #   56| enter M5
 #-----|  -> {...}
@@ -10979,8 +10979,8 @@ Patterns.cs:
 #-----| no-match -> [no-match] { ... }
 
 #   95| access to constant B
-#-----| no-match -> [no-match] ... or ...
 #-----| match -> [match] ... or ...
+#-----| no-match -> [no-match] ... or ...
 
 #   96| {...}
 #-----|  -> ...;
@@ -11039,8 +11039,8 @@ PostDominance.cs:
 #-----| true -> return ...;
 
 #   12| null
-#-----| no-match -> [false] ... is ...
 #-----| match -> [true] ... is ...
+#-----| no-match -> [false] ... is ...
 
 #   13| return ...;
 #-----| return -> exit M2 (normal)
@@ -11081,8 +11081,8 @@ PostDominance.cs:
 #-----| true -> nameof(...)
 
 #   19| null
-#-----| no-match -> [false] ... is ...
 #-----| match -> [true] ... is ...
+#-----| no-match -> [false] ... is ...
 
 #   20| throw ...;
 #-----| exception(ArgumentNullException) -> exit M3 (abnormal)
@@ -11402,8 +11402,8 @@ Switch.cs:
 #-----|  -> String s
 
 #   24| String s
-#-----| no-match -> case ...:
 #-----| match -> access to local variable s
+#-----| no-match -> case ...:
 
 #   24| access to local variable s
 #-----|  -> access to property Length
@@ -11516,15 +11516,15 @@ Switch.cs:
 #-----|  -> access to type Boolean
 
 #   50| access to type Boolean
-#-----| match -> access to parameter o
 #-----| no-match -> exit M4 (normal)
+#-----| match -> access to parameter o
 
 #   50| access to parameter o
 #-----|  -> null
 
 #   50| ... != ...
-#-----| true -> break;
 #-----| false -> exit M4 (normal)
+#-----| true -> break;
 
 #   50| null
 #-----|  -> ... != ...
@@ -11600,8 +11600,8 @@ Switch.cs:
 #-----|  -> ""
 
 #   72| ""
-#-----| match -> break;
 #-----| no-match -> exit M6 (normal)
+#-----| match -> break;
 
 #   73| break;
 #-----| break -> exit M6 (normal)
@@ -11801,8 +11801,8 @@ Switch.cs:
 #-----|  -> 3
 
 #  117| 3
-#-----| no-match -> case ...:
 #-----| match -> access to parameter s
+#-----| no-match -> case ...:
 
 #  117| access to parameter s
 #-----|  -> "foo"
@@ -11824,8 +11824,8 @@ Switch.cs:
 #-----|  -> 2
 
 #  118| 2
-#-----| no-match -> 1
 #-----| match -> access to parameter s
+#-----| no-match -> 1
 
 #  118| access to parameter s
 #-----|  -> "fu"
@@ -12097,8 +12097,8 @@ Switch.cs:
 #-----|  -> ... => ...
 
 #  156| false
-#-----| match -> "b"
 #-----| exception(InvalidOperationException) -> exit M15 (abnormal)
+#-----| match -> "b"
 
 #  156| ... => ...
 #-----|  -> ... switch { ... }
@@ -12192,8 +12192,8 @@ TypeAccesses.cs:
 #-----| true -> ;
 
 #    7| Int32 j
-#-----| no-match -> [false] ... is ...
 #-----| match -> [true] ... is ...
+#-----| no-match -> [false] ... is ...
 
 #    7| ;
 #-----|  -> ... ...;
@@ -12503,8 +12503,8 @@ cflow.cs:
 #-----|  -> 20
 
 #   24| ... <= ...
-#-----| true -> {...}
 #-----| false -> exit Main (normal)
+#-----| true -> {...}
 
 #   24| 20
 #-----|  -> ... <= ...
@@ -12791,8 +12791,8 @@ cflow.cs:
 #-----|  -> access to field Field
 
 #   63| ... == ...
-#-----| true -> [false] !...
 #-----| false -> [true] !...
+#-----| true -> [false] !...
 
 #   63| ""
 #-----|  -> ... == ...
@@ -13042,8 +13042,8 @@ cflow.cs:
 #-----|  -> null
 
 #  102| ... != ...
-#-----| true -> ...;
 #-----| false -> exit M3 (normal)
+#-----| true -> ...;
 
 #  102| null
 #-----|  -> ... != ...
@@ -13536,8 +13536,8 @@ cflow.cs:
 #-----|  -> 10
 
 #  173| ... < ...
-#-----| true -> {...}
 #-----| false -> exit For (normal)
+#-----| true -> {...}
 
 #  173| access to local variable j
 #-----|  -> ... + ...
@@ -13853,8 +13853,8 @@ cflow.cs:
 #-----|  -> 0
 
 #  200| ... == ...
-#-----| true -> [false] !...
 #-----| false -> [true] !...
+#-----| true -> [false] !...
 
 #  200| 0
 #-----|  -> ... == ...
@@ -14007,8 +14007,8 @@ cflow.cs:
 #-----|  -> 10
 
 #  221| ... < ...
-#-----| true -> {...}
 #-----| false -> exit Do (normal)
+#-----| true -> {...}
 
 #  221| 10
 #-----|  -> ... < ...
@@ -14025,8 +14025,8 @@ cflow.cs:
 #-----|  -> "a"
 
 #  226| foreach (... ... in ...) ...
-#-----| non-empty -> String x
 #-----| empty -> exit Foreach (normal)
+#-----| non-empty -> String x
 
 #  226| String x
 #-----|  -> {...}
@@ -14153,8 +14153,8 @@ cflow.cs:
 #-----|  -> 0
 
 #  242| ... == ...
-#-----| true -> [false] !...
 #-----| false -> [true] !...
+#-----| true -> [false] !...
 
 #  242| 0
 #-----|  -> ... == ...
@@ -14440,8 +14440,8 @@ cflow.cs:
 #-----|  -> 0
 
 #  300| ... > ...
-#-----| true -> [false] !...
 #-----| false -> [true] !...
+#-----| true -> [false] !...
 
 #  300| 0
 #-----|  -> ... > ...

csharp/ql/test/library-tests/conversion/boxing/Boxing.expected

@@ -5,10 +5,34 @@
 | Boolean | Object |
 | Boolean | ValueType |
 | Boolean | dynamic |
+| Char | IAdditionOperators<Char,Char,Char> |
+| Char | IAdditiveIdentity<Char,Char> |
+| Char | IBinaryInteger<Char> |
+| Char | IBinaryNumber<Char> |
+| Char | IBitwiseOperators<Char,Char,Char> |
 | Char | IComparable |
 | Char | IComparable<Char> |
+| Char | IComparisonOperators<Char,Char> |
 | Char | IConvertible |
+| Char | IDecrementOperators<Char> |
+| Char | IDivisionOperators<Char,Char,Char> |
+| Char | IEqualityOperators<Char,Char> |
 | Char | IEquatable<Char> |
+| Char | IFormattable |
+| Char | IIncrementOperators<Char> |
+| Char | IMinMaxValue<Char> |
+| Char | IModulusOperators<Char,Char,Char> |
+| Char | IMultiplicativeIdentity<Char,Char> |
+| Char | IMultiplyOperators<Char,Char,Char> |
+| Char | INumber<Char> |
+| Char | IParseable<Char> |
+| Char | IShiftOperators<Char,Char> |
+| Char | ISpanFormattable |
+| Char | ISpanParseable<Char> |
+| Char | ISubtractionOperators<Char,Char,Char> |
+| Char | IUnaryNegationOperators<Char,Char> |
+| Char | IUnaryPlusOperators<Char,Char> |
+| Char | IUnsignedNumber<Char> |
 | Char | Object |
 | Char | ValueType |
 | Char | dynamic |
@@ -16,21 +40,65 @@
 | E | Object |
 | E | ValueType |
 | E | dynamic |
+| Int32 | IAdditionOperators<Int32,Int32,Int32> |
+| Int32 | IAdditiveIdentity<Int32,Int32> |
+| Int32 | IBinaryInteger<Int32> |
+| Int32 | IBinaryNumber<Int32> |
+| Int32 | IBitwiseOperators<Int32,Int32,Int32> |
 | Int32 | IComparable |
 | Int32 | IComparable<Int32> |
+| Int32 | IComparisonOperators<Int32,Int32> |
 | Int32 | IConvertible |
+| Int32 | IDecrementOperators<Int32> |
+| Int32 | IDivisionOperators<Int32,Int32,Int32> |
+| Int32 | IEqualityOperators<Int32,Int32> |
 | Int32 | IEquatable<Int32> |
 | Int32 | IFormattable |
+| Int32 | IIncrementOperators<Int32> |
+| Int32 | IMinMaxValue<Int32> |
+| Int32 | IModulusOperators<Int32,Int32,Int32> |
+| Int32 | IMultiplicativeIdentity<Int32,Int32> |
+| Int32 | IMultiplyOperators<Int32,Int32,Int32> |
+| Int32 | INumber<Int32> |
+| Int32 | IParseable<Int32> |
+| Int32 | IShiftOperators<Int32,Int32> |
+| Int32 | ISignedNumber<Int32> |
 | Int32 | ISpanFormattable |
+| Int32 | ISpanParseable<Int32> |
+| Int32 | ISubtractionOperators<Int32,Int32,Int32> |
+| Int32 | IUnaryNegationOperators<Int32,Int32> |
+| Int32 | IUnaryPlusOperators<Int32,Int32> |
 | Int32 | Object |
 | Int32 | ValueType |
 | Int32 | dynamic |
+| Nullable<Int32> | IAdditionOperators<Int32,Int32,Int32> |
+| Nullable<Int32> | IAdditiveIdentity<Int32,Int32> |
+| Nullable<Int32> | IBinaryInteger<Int32> |
+| Nullable<Int32> | IBinaryNumber<Int32> |
+| Nullable<Int32> | IBitwiseOperators<Int32,Int32,Int32> |
 | Nullable<Int32> | IComparable |
 | Nullable<Int32> | IComparable<Int32> |
+| Nullable<Int32> | IComparisonOperators<Int32,Int32> |
 | Nullable<Int32> | IConvertible |
+| Nullable<Int32> | IDecrementOperators<Int32> |
+| Nullable<Int32> | IDivisionOperators<Int32,Int32,Int32> |
+| Nullable<Int32> | IEqualityOperators<Int32,Int32> |
 | Nullable<Int32> | IEquatable<Int32> |
 | Nullable<Int32> | IFormattable |
+| Nullable<Int32> | IIncrementOperators<Int32> |
+| Nullable<Int32> | IMinMaxValue<Int32> |
+| Nullable<Int32> | IModulusOperators<Int32,Int32,Int32> |
+| Nullable<Int32> | IMultiplicativeIdentity<Int32,Int32> |
+| Nullable<Int32> | IMultiplyOperators<Int32,Int32,Int32> |
+| Nullable<Int32> | INumber<Int32> |
+| Nullable<Int32> | IParseable<Int32> |
+| Nullable<Int32> | IShiftOperators<Int32,Int32> |
+| Nullable<Int32> | ISignedNumber<Int32> |
 | Nullable<Int32> | ISpanFormattable |
+| Nullable<Int32> | ISpanParseable<Int32> |
+| Nullable<Int32> | ISubtractionOperators<Int32,Int32,Int32> |
+| Nullable<Int32> | IUnaryNegationOperators<Int32,Int32> |
+| Nullable<Int32> | IUnaryPlusOperators<Int32,Int32> |
 | Nullable<Int32> | Object |
 | Nullable<Int32> | ValueType |
 | Nullable<Int32> | dynamic |