Merge branch 'main' into redsun82/rust-doc

actions/ql/lib/change-notes/2025-06-09-bash-parsing-performance.md

@@ -0,0 +1,6 @@
+---
+category: minorAnalysis
+---
+* Fixed performance issues in the parsing of Bash scripts in workflow files,
+  which led to out-of-disk errors when analysing certain workflow files with
+  complex interpolations of shell commands or quoted strings.

actions/ql/lib/codeql/actions/Bash.qll

@@ -8,35 +8,64 @@ class BashShellScript extends ShellScript {
     )
   }
 
-  private string lineProducer(int i) {
+  /**
-    result = this.getRawScript().regexpReplaceAll("\\\\\\s*\n", "").splitAt("\n", i)
+   * Gets the line at 0-based index `lineIndex` within this shell script,
+   * assuming newlines as separators.
+   */
+  private string lineProducer(int lineIndex) {
+    result = this.getRawScript().regexpReplaceAll("\\\\\\s*\n", "").splitAt("\n", lineIndex)
   }
 
-  private predicate cmdSubstitutionReplacement(string cmdSubs, string id, int k) {
+  private predicate cmdSubstitutionReplacement(string command, string id, int lineIndex) {
-    exists(string line | line = this.lineProducer(k) |
+    this.commandInSubstitution(lineIndex, command, id)
-      exists(int i, int j |
+    or
-        cmdSubs =
+    this.commandInBackticks(lineIndex, command, id)
-          // $() cmd substitution
+  }
-          line.regexpFind("\\$\\((?:[^()]+|\\((?:[^()]+|\\([^()]*\\))*\\))*\\)", i, j)
+
-              .regexpReplaceAll("^\\$\\(", "")
+  /**
-              .regexpReplaceAll("\\)$", "") and
+   * Holds if there is a command substitution `$(command)` in
-        id = "cmdsubs:" + k + ":" + i + ":" + j
+   * the line at `lineIndex` in the shell script,
-      )
+   * and `id` is a unique identifier for this command.
-      or
+   */
-      exists(int i, int j |
+  private predicate commandInSubstitution(int lineIndex, string command, string id) {
-        // `...` cmd substitution
+    exists(int occurrenceIndex, int occurrenceOffset |
-        cmdSubs =
+      command =
-          line.regexpFind("\\`[^\\`]+\\`", i, j)
+        // Look for the command inside a $(...) command substitution
-              .regexpReplaceAll("^\\`", "")
+        this.lineProducer(lineIndex)
-              .regexpReplaceAll("\\`$", "") and
+            .regexpFind("\\$\\((?:[^()]+|\\((?:[^()]+|\\([^()]*\\))*\\))*\\)", occurrenceIndex,
-        id = "cmd:" + k + ":" + i + ":" + j
+              occurrenceOffset)
-      )
+            // trim starting $( - TODO do this in first regex
+            .regexpReplaceAll("^\\$\\(", "")
+            // trim ending ) - TODO do this in first regex
+            .regexpReplaceAll("\\)$", "") and
+      id = "cmdsubs:" + lineIndex + ":" + occurrenceIndex + ":" + occurrenceOffset
     )
   }
 
-  private predicate rankedCmdSubstitutionReplacements(int i, string old, string new) {
+  /**
-    old = rank[i](string old2 | this.cmdSubstitutionReplacement(old2, _, _) | old2) and
+   * Holds if `command` is a command in backticks `` `...` `` in
-    this.cmdSubstitutionReplacement(old, new, _)
+   * the line at `lineIndex` in the shell script,
+   * and `id` is a unique identifier for this command.
+   */
+  private predicate commandInBackticks(int lineIndex, string command, string id) {
+    exists(int occurrenceIndex, int occurrenceOffset |
+      command =
+        this.lineProducer(lineIndex)
+            .regexpFind("\\`[^\\`]+\\`", occurrenceIndex, occurrenceOffset)
+            // trim leading backtick - TODO do this in first regex
+            .regexpReplaceAll("^\\`", "")
+            // trim trailing backtick - TODO do this in first regex
+            .regexpReplaceAll("\\`$", "") and
+      id = "cmd:" + lineIndex + ":" + occurrenceIndex + ":" + occurrenceOffset
+    )
+  }
+
+  private predicate rankedCmdSubstitutionReplacements(int i, string command, string commandId) {
+    // rank commands by their unique IDs
+    commandId = rank[i](string c, string id | this.cmdSubstitutionReplacement(c, id, _) | id) and
+    // since we cannot output (command, ID) tuples from the rank operation,
+    // we need to work out the specific command associated with the resulting ID
+    this.cmdSubstitutionReplacement(command, commandId, _)
   }
 
   private predicate doReplaceCmdSubstitutions(int line, int round, string old, string new) {
@@ -64,31 +93,56 @@ class BashShellScript extends ShellScript {
     this.cmdSubstitutionReplacement(result, _, i)
   }
 
+  /**
+   * Holds if `quotedStr` is a string in double quotes in
+   * the line at `lineIndex` in the shell script,
+   * and `id` is a unique identifier for this quoted string.
+   */
+  private predicate doubleQuotedString(int lineIndex, string quotedStr, string id) {
+    exists(int occurrenceIndex, int occurrenceOffset |
+      // double quoted string
+      quotedStr =
+        this.cmdSubstitutedLineProducer(lineIndex)
+            .regexpFind("\"((?:[^\"\\\\]|\\\\.)*)\"", occurrenceIndex, occurrenceOffset) and
+      id =
+        "qstr:" + lineIndex + ":" + occurrenceIndex + ":" + occurrenceOffset + ":" +
+          quotedStr.length() + ":" + quotedStr.regexpReplaceAll("[^a-zA-Z0-9]", "")
+    )
+  }
+
+  /**
+   * Holds if `quotedStr` is a string in single quotes in
+   * the line at `lineIndex` in the shell script,
+   * and `id` is a unique identifier for this quoted string.
+   */
+  private predicate singleQuotedString(int lineIndex, string quotedStr, string id) {
+    exists(int occurrenceIndex, int occurrenceOffset |
+      // single quoted string
+      quotedStr =
+        this.cmdSubstitutedLineProducer(lineIndex)
+            .regexpFind("'((?:\\\\.|[^'\\\\])*)'", occurrenceIndex, occurrenceOffset) and
+      id =
+        "qstr:" + lineIndex + ":" + occurrenceIndex + ":" + occurrenceOffset + ":" +
+          quotedStr.length() + ":" + quotedStr.regexpReplaceAll("[^a-zA-Z0-9]", "")
+    )
+  }
+
   private predicate quotedStringReplacement(string quotedStr, string id) {
-    exists(string line, int k | line = this.cmdSubstitutedLineProducer(k) |
+    exists(int lineIndex |
-      exists(int i, int j |
+      this.doubleQuotedString(lineIndex, quotedStr, id)
-        // double quoted string
-        quotedStr = line.regexpFind("\"((?:[^\"\\\\]|\\\\.)*)\"", i, j) and
-        id =
-          "qstr:" + k + ":" + i + ":" + j + ":" + quotedStr.length() + ":" +
-            quotedStr.regexpReplaceAll("[^a-zA-Z0-9]", "")
-      )
       or
-      exists(int i, int j |
+      this.singleQuotedString(lineIndex, quotedStr, id)
-        // single quoted string
-        quotedStr = line.regexpFind("'((?:\\\\.|[^'\\\\])*)'", i, j) and
-        id =
-          "qstr:" + k + ":" + i + ":" + j + ":" + quotedStr.length() + ":" +
-            quotedStr.regexpReplaceAll("[^a-zA-Z0-9]", "")
-      )
     ) and
     // Only do this for strings that might otherwise disrupt subsequent parsing
     quotedStr.regexpMatch("[\"'].*[$\n\r'\"" + Bash::separator() + "].*[\"']")
   }
 
-  private predicate rankedQuotedStringReplacements(int i, string old, string new) {
+  private predicate rankedQuotedStringReplacements(int i, string quotedString, string quotedStringId) {
-    old = rank[i](string old2 | this.quotedStringReplacement(old2, _) | old2) and
+    // rank quoted strings by their nearly-unique IDs
-    this.quotedStringReplacement(old, new)
+    quotedStringId = rank[i](string s, string id | this.quotedStringReplacement(s, id) | id) and
+    // since we cannot output (string, ID) tuples from the rank operation,
+    // we need to work out the specific string associated with the resulting ID
+    this.quotedStringReplacement(quotedString, quotedStringId)
   }
 
   private predicate doReplaceQuotedStrings(int line, int round, string old, string new) {

actions/ql/test/query-tests/Security/CWE-094/.github/workflows/interpolation.yml

@@ -0,0 +1,81 @@
+name: Workflow with complex interpolation
+on: 
+  workflow_dispatch:
+    inputs:
+      choice-a:
+        required: true
+        type: choice
+        description: choice-a
+        default: a1
+        options: 
+        - a1
+        - a2
+        - a3
+      string-b:
+        required: false
+        type: string
+        description: string-b
+      string-c:
+        required: false
+        type: string
+        description: string-c
+      list-d:
+        required: true
+        type: string
+        default: d1 d2
+        description: list-d whitespace separated
+      list-e:
+        required: false
+        type: string
+        description: list-e whitespace separated
+      choice-f:
+        required: true
+        type: choice
+        description: choice-f
+        options: 
+        - false
+        - true
+          
+env:
+  DRY_TEST: false
+  B: ${{ github.event.inputs.string-b }}
+
+jobs:
+  job:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Produce values
+      id: produce-values
+      run: |
+        echo "region=region" >> $GITHUB_OUTPUT
+        echo "zone=zone" >> $GITHUB_OUTPUT
+
+    - name: Step with complex interpolation
+      id: complex
+      env:
+        CHOICE_A: ${{ github.event.inputs.choice-a }}
+        STRING_B: ${{ github.event.inputs.string-b }}
+        STRING_C: ${{ github.event.inputs.string-c }}
+        LIST_D: ${{ github.event.inputs.list-d }}
+        LIST_E: ${{ github.event.inputs.list-e }}
+        CHOICE_F: ${{ github.event.inputs.choice-f }}
+        REGION: ${{ steps.produce-values.outputs.region }}
+        ZONE: ${{ steps.produce-values.outputs.zone }}
+        DRY_TEST_JSON: ${{ fromJSON(env.DRY_TEST) }}
+        FUNCTION_NAME: my-function
+        USER_EMAIL: 'example@example.com'
+        TYPE: type
+        RANGE: '0-100'
+
+      run: |
+        comma_separated_list_d=$(echo "${LIST_D}" | sed "s/ /\",\"/g")
+        comma_separated_list_e=$(echo "${LIST_E}" | sed "s/ /\",\"/g")
+        c1=$(echo "${STRING_C}" | cut -d "-" -f 1)
+        c2=$(echo "${STRING_C}" | cut -d "-" -f 2)
+        # Similar commands that use JSON payloads with string interpolation.
+        response=$(aws lambda invoke --invocation-type RequestResponse --function-name "${FUNCTION_NAME}" --region "${REGION}" --cli-read-timeout 0 --cli-binary-format raw-in-base64-out --payload '{"appName":"my-app","chA":"'"${CHOICE_A}"'","c1":"'"${c1}"'","c2":"'"${c2}"'","a":"${CHOICE_A}","bValue":"${B}","zone":"${ZONE}","userEmail":"'"${USER_EMAIL}"'","region":"${REGION}","range":"${RANGE}","type":"${TYPE}","b":"${STRING_B}","listD":"","listE":"","dryTest":'"${DRY_TEST_JSON}"',"f":"${CHOICE_F}"}' ./config.json --log-type Tail)
+        response=$(aws lambda invoke --invocation-type RequestResponse --function-name "${FUNCTION_NAME}" --region "${REGION}" --cli-read-timeout 0 --cli-binary-format raw-in-base64-out --payload '{"appName":"my-app","chA":"'"${CHOICE_A}"'","c1":"'"${c1}"'","c2":"'"${c2}"'","a":"${CHOICE_A}","bValue":"${B}","zone":"${ZONE}","userEmail":"'"${USER_EMAIL}"'","region":"${REGION}","range":"${RANGE}","type":"${TYPE}","b":"${STRING_B}","listD":["'"${comma_separated_list_d}"'"],"listE":"","dryTest":'"${DRY_TEST_JSON}"',"f":"${CHOICE_F}"}' ./config.json --log-type Tail)
+        response=$(aws lambda invoke --invocation-type RequestResponse --function-name "${FUNCTION_NAME}" --region "${REGION}" --cli-read-timeout 0 --cli-binary-format raw-in-base64-out --payload '{"appName":"my-app","chA":"'"${CHOICE_A}"'","c1":"'"${c1}"'","c2":"'"${c2}"'","a":"${CHOICE_A}","bValue":"${B}","zone":"${ZONE}","userEmail":"'"${USER_EMAIL}"'","region":"${REGION}","range":"${RANGE}","type":"${TYPE}","b":"${STRING_B}","listD":["'"${comma_separated_list_d}"'"],"listE":"","dryTest":'"${DRY_TEST_JSON}"',"f":"${CHOICE_F}"}' ./config.json --log-type Tail)
+        response=$(aws lambda invoke --invocation-type RequestResponse --function-name "${FUNCTION_NAME}" --region "${REGION}" --cli-read-timeout 0 --cli-binary-format raw-in-base64-out --payload '{"appName":"my-app","chA":"'"${CHOICE_A}"'","c1":"'"${c1}"'","c2":"'"${c2}"'","a":"${CHOICE_A}","bValue":"${B}","zone":"${ZONE}","userEmail":"'"${USER_EMAIL}"'","region":"${REGION}","range":"${RANGE}","type":"${TYPE}","b":"${STRING_B}","listD":["'"${comma_separated_list_d}"'"],"listE":"","dryTest":'"${DRY_TEST_JSON}"',"f":"${CHOICE_F}"}' ./config.json --log-type Tail)
+        response=$(aws lambda invoke --invocation-type RequestResponse --function-name "${FUNCTION_NAME}" --region "${REGION}" --cli-read-timeout 0 --cli-binary-format raw-in-base64-out --payload '{"appName":"my-app","chA":"'"${CHOICE_A}"'","c1":"'"${c1}"'","c2":"'"${c2}"'","a":"${CHOICE_A}","bValue":"${B}","zone":"${ZONE}","userEmail":"'"${USER_EMAIL}"'","region":"${REGION}","range":"${RANGE}","type":"${TYPE}","b":"${STRING_B}","listD":"","listE":["'"${comma_separated_list_e}"'"],"dryTest":'"${DRY_TEST_JSON}"',"f":"${CHOICE_F}"}' ./config.json --log-type Tail)
+      shell: bash

cpp/bulk_generation_targets.yml

@@ -0,0 +1,10 @@
+language: cpp
+strategy: dca
+destination: cpp/ql/lib/ext/generated
+targets:
+- name: openssl
+  with-sinks: false
+  with-sources: false
+- name: sqlite
+  with-sinks: false
+  with-sources: false

cpp/downgrades/3c45f8b9e71ec723bf50c40581e1f18f4f25e290/lambdas.ql

@@ -0,0 +1,7 @@
+class LambdaExpr extends @lambdaexpr {
+  string toString() { none() }
+}
+
+from LambdaExpr lambda, string default_capture, boolean has_explicit_return_type
+where lambdas(lambda, default_capture, has_explicit_return_type, _)
+select lambda, default_capture, has_explicit_return_type

cpp/downgrades/3c45f8b9e71ec723bf50c40581e1f18f4f25e290/upgrade.properties

@@ -0,0 +1,3 @@
+description: capture whether a lambda has an explicitly specified parameter list.
+compatibility: full
+lambdas.rel: run lambdas.qlo

cpp/downgrades/af887e83a815a9cefe774ffa80e2493a1365b9e2/builtintypes.ql

@@ -0,0 +1,9 @@
+class BuiltinType extends @builtintype {
+  string toString() { none() }
+}
+
+from BuiltinType id, string name, int kind, int new_kind, int size, int sign, int alignment
+where
+  builtintypes(id, name, kind, size, sign, alignment) and
+  if kind = 62 then new_kind = 1 else new_kind = kind
+select id, name, new_kind, size, sign, alignment

cpp/downgrades/af887e83a815a9cefe774ffa80e2493a1365b9e2/upgrade.properties

@@ -0,0 +1,3 @@
+description: Support __mfp8 type
+compatibility: backwards
+builtintypes.rel: run builtintypes.qlo

cpp/misc/bulk_generation_targets.json

@@ -1,9 +0,0 @@
-{
-  "strategy": "dca",
-  "language": "cpp",
-  "targets": [
-      { "name": "openssl", "with-sources": false, "with-sinks": false },
-      { "name": "sqlite", "with-sources": false, "with-sinks": false }
-  ],
-  "destination": "cpp/ql/lib/ext/generated"
-}

cpp/ql/lib/change-notes/2025-06-06-lambda-parameters.md

@@ -0,0 +1,4 @@
+---
+category: feature
+---
+* Added a predicate `hasParameterList` to `LambdaExpression` to capture whether a lambda has an explicitly specified parameter list.

cpp/ql/lib/semmle/code/cpp/Type.qll

@@ -839,6 +839,9 @@ private predicate floatingPointTypeMapping(
   or
   // _Complex _Float128
   kind = 61 and base = 2 and domain = TComplexDomain() and realKind = 49 and extended = false
+  or
+  // __mfp8
+  kind = 62 and base = 2 and domain = TRealDomain() and realKind = 62 and extended = false
 }
 
 /**

cpp/ql/lib/semmle/code/cpp/exprs/Lambda.qll

@@ -41,12 +41,17 @@ class LambdaExpression extends Expr, @lambdaexpr {
    *   - "&" if capture-by-reference is the default for implicit captures.
    *   - "=" if capture-by-value is the default for implicit captures.
    */
-  string getDefaultCaptureMode() { lambdas(underlyingElement(this), result, _) }
+  string getDefaultCaptureMode() { lambdas(underlyingElement(this), result, _, _) }
 
   /**
    * Holds if the return type (of the call operator of the resulting object) was explicitly specified.
    */
-  predicate returnTypeIsExplicit() { lambdas(underlyingElement(this), _, true) }
+  predicate returnTypeIsExplicit() { lambdas(underlyingElement(this), _, true, _) }
+
+  /**
+   * Holds if the lambda has an explicitly specified parameter list, even when empty.
+   */
+  predicate hasParameterList() { lambdas(underlyingElement(this), _, _, true) }
 
   /**
    * Gets the function which will be invoked when the resulting object is called.

cpp/ql/lib/semmlecode.cpp.dbscheme

@@ -691,6 +691,7 @@ case @builtintype.kind of
 | 59 = @complex_std_float64   // _Complex _Float64
 | 60 = @complex_float64x      // _Complex _Float64x
 | 61 = @complex_std_float128  // _Complex _Float128
+| 62 = @mfp8                  // __mfp8
 ;
 
 builtintypes(
@@ -2138,7 +2139,8 @@ code_block(
 lambdas(
     unique int expr: @lambdaexpr ref,
     string default_capture: string ref,
-    boolean has_explicit_return_type: boolean ref
+    boolean has_explicit_return_type: boolean ref,
+    boolean has_explicit_parameter_list: boolean ref
 );
 
 lambda_capture(

cpp/ql/lib/upgrades/9a7c3c14c1076f64b871719117a558733d987b48/upgrade.properties

@@ -0,0 +1,2 @@
+description: Support __mfp8 type
+compatibility: full

cpp/ql/lib/upgrades/af887e83a815a9cefe774ffa80e2493a1365b9e2/lambdas.ql

@@ -0,0 +1,7 @@
+class LambdaExpr extends @lambdaexpr {
+  string toString() { none() }
+}
+
+from LambdaExpr lambda, string default_capture, boolean has_explicit_return_type
+where lambdas(lambda, default_capture, has_explicit_return_type)
+select lambda, default_capture, has_explicit_return_type, true

cpp/ql/lib/upgrades/af887e83a815a9cefe774ffa80e2493a1365b9e2/upgrade.properties

@@ -0,0 +1,3 @@
+description: capture whether a lambda has an explicitly specified parameter list.
+compatibility: backwards
+lambdas.rel: run lambdas.qlo

cpp/ql/test/library-tests/ir/ir/PrintAST.expected

@@ -58,6 +58,77 @@
 #-----|         Type = [LongType] unsigned long
 #-----|     getParameter(1): [Parameter] (unnamed parameter 1)
 #-----|         Type = [ScopedEnum] align_val_t
+arm.cpp:
+#    6| [TopLevelFunction] uint8x8_t vadd_u8(uint8x8_t, uint8x8_t)
+#    6|   <params>: 
+#    6|     getParameter(0): [Parameter] a
+#    6|         Type = [CTypedefType] uint8x8_t
+#    6|     getParameter(1): [Parameter] b
+#    6|         Type = [CTypedefType] uint8x8_t
+#    6|   getEntryPoint(): [BlockStmt] { ... }
+#    7|     getStmt(0): [ReturnStmt] return ...
+#    7|       getExpr(): [AddExpr] ... + ...
+#    7|           Type = [GNUVectorType] __attribute((neon_vector_type(8))) unsigned char
+#    7|           ValueCategory = prvalue
+#    7|         getLeftOperand(): [VariableAccess] a
+#    7|             Type = [CTypedefType] uint8x8_t
+#    7|             ValueCategory = prvalue(load)
+#    7|         getRightOperand(): [VariableAccess] b
+#    7|             Type = [CTypedefType] uint8x8_t
+#    7|             ValueCategory = prvalue(load)
+#   12| [TopLevelFunction] uint16x8_t __builtin_aarch64_uaddlv8qi_uuu(uint8x8_t, uint8x8_t)
+#   12|   <params>: 
+#   12|     getParameter(0): [Parameter] (unnamed parameter 0)
+#   12|         Type = [CTypedefType] uint8x8_t
+#   12|     getParameter(1): [Parameter] (unnamed parameter 1)
+#   12|         Type = [CTypedefType] uint8x8_t
+#   14| [TopLevelFunction] uint16x8_t vaddl_u8(uint8x8_t, uint8x8_t)
+#   14|   <params>: 
+#   14|     getParameter(0): [Parameter] a
+#   14|         Type = [CTypedefType] uint8x8_t
+#   14|     getParameter(1): [Parameter] b
+#   14|         Type = [CTypedefType] uint8x8_t
+#   14|   getEntryPoint(): [BlockStmt] { ... }
+#   15|     getStmt(0): [ReturnStmt] return ...
+#   15|       getExpr(): [FunctionCall] call to __builtin_aarch64_uaddlv8qi_uuu
+#   15|           Type = [CTypedefType] uint16x8_t
+#   15|           ValueCategory = prvalue
+#   15|         getArgument(0): [VariableAccess] a
+#   15|             Type = [CTypedefType] uint8x8_t
+#   15|             ValueCategory = prvalue(load)
+#   15|         getArgument(1): [VariableAccess] b
+#   15|             Type = [CTypedefType] uint8x8_t
+#   15|             ValueCategory = prvalue(load)
+#   18| [TopLevelFunction] uint16x8_t arm_add(uint8x8_t, uint8x8_t)
+#   18|   <params>: 
+#   18|     getParameter(0): [Parameter] a
+#   18|         Type = [CTypedefType] uint8x8_t
+#   18|     getParameter(1): [Parameter] b
+#   18|         Type = [CTypedefType] uint8x8_t
+#   18|   getEntryPoint(): [BlockStmt] { ... }
+#   19|     getStmt(0): [DeclStmt] declaration
+#   19|       getDeclarationEntry(0): [VariableDeclarationEntry] definition of c
+#   19|           Type = [CTypedefType] uint8x8_t
+#   19|         getVariable().getInitializer(): [Initializer] initializer for c
+#   19|           getExpr(): [FunctionCall] call to vadd_u8
+#   19|               Type = [CTypedefType] uint8x8_t
+#   19|               ValueCategory = prvalue
+#   19|             getArgument(0): [VariableAccess] a
+#   19|                 Type = [CTypedefType] uint8x8_t
+#   19|                 ValueCategory = prvalue(load)
+#   19|             getArgument(1): [VariableAccess] b
+#   19|                 Type = [CTypedefType] uint8x8_t
+#   19|                 ValueCategory = prvalue(load)
+#   20|     getStmt(1): [ReturnStmt] return ...
+#   20|       getExpr(): [FunctionCall] call to vaddl_u8
+#   20|           Type = [CTypedefType] uint16x8_t
+#   20|           ValueCategory = prvalue
+#   20|         getArgument(0): [VariableAccess] a
+#   20|             Type = [CTypedefType] uint8x8_t
+#   20|             ValueCategory = prvalue(load)
+#   20|         getArgument(1): [VariableAccess] c
+#   20|             Type = [CTypedefType] uint8x8_t
+#   20|             ValueCategory = prvalue(load)
 bad_asts.cpp:
 #    5| [CopyAssignmentOperator] Bad::S& Bad::S::operator=(Bad::S const&)
 #    5|   <params>: 

cpp/ql/test/library-tests/ir/ir/aliased_ir.expected

@@ -1,3 +1,86 @@
+arm.cpp:
+#    6| uint8x8_t vadd_u8(uint8x8_t, uint8x8_t)
+#    6|   Block 0
+#    6|     v6_1(void)                                                    = EnterFunction            : 
+#    6|     m6_2(unknown)                                                 = AliasedDefinition        : 
+#    6|     m6_3(unknown)                                                 = InitializeNonLocal       : 
+#    6|     m6_4(unknown)                                                 = Chi                      : total:m6_2, partial:m6_3
+#    6|     r6_5(glval<__attribute((neon_vector_type(8))) unsigned char>) = VariableAddress[a]       : 
+#    6|     m6_6(__attribute((neon_vector_type(8))) unsigned char)        = InitializeParameter[a]   : &:r6_5
+#    6|     r6_7(glval<__attribute((neon_vector_type(8))) unsigned char>) = VariableAddress[b]       : 
+#    6|     m6_8(__attribute((neon_vector_type(8))) unsigned char)        = InitializeParameter[b]   : &:r6_7
+#    7|     r7_1(glval<__attribute((neon_vector_type(8))) unsigned char>) = VariableAddress[#return] : 
+#    7|     r7_2(glval<__attribute((neon_vector_type(8))) unsigned char>) = VariableAddress[a]       : 
+#    7|     r7_3(__attribute((neon_vector_type(8))) unsigned char)        = Load[a]                  : &:r7_2, m6_6
+#    7|     r7_4(glval<__attribute((neon_vector_type(8))) unsigned char>) = VariableAddress[b]       : 
+#    7|     r7_5(__attribute((neon_vector_type(8))) unsigned char)        = Load[b]                  : &:r7_4, m6_8
+#    7|     r7_6(__attribute((neon_vector_type(8))) unsigned char)        = Add                      : r7_3, r7_5
+#    7|     m7_7(__attribute((neon_vector_type(8))) unsigned char)        = Store[#return]           : &:r7_1, r7_6
+#    6|     r6_9(glval<__attribute((neon_vector_type(8))) unsigned char>) = VariableAddress[#return] : 
+#    6|     v6_10(void)                                                   = ReturnValue              : &:r6_9, m7_7
+#    6|     v6_11(void)                                                   = AliasedUse               : m6_3
+#    6|     v6_12(void)                                                   = ExitFunction             : 
+
+#   14| uint16x8_t vaddl_u8(uint8x8_t, uint8x8_t)
+#   14|   Block 0
+#   14|     v14_1(void)                                                     = EnterFunction                                    : 
+#   14|     m14_2(unknown)                                                  = AliasedDefinition                                : 
+#   14|     m14_3(unknown)                                                  = InitializeNonLocal                               : 
+#   14|     m14_4(unknown)                                                  = Chi                                              : total:m14_2, partial:m14_3
+#   14|     r14_5(glval<__attribute((neon_vector_type(8))) unsigned char>)  = VariableAddress[a]                               : 
+#   14|     m14_6(__attribute((neon_vector_type(8))) unsigned char)         = InitializeParameter[a]                           : &:r14_5
+#   14|     r14_7(glval<__attribute((neon_vector_type(8))) unsigned char>)  = VariableAddress[b]                               : 
+#   14|     m14_8(__attribute((neon_vector_type(8))) unsigned char)         = InitializeParameter[b]                           : &:r14_7
+#   15|     r15_1(glval<__attribute((neon_vector_type(8))) unsigned short>) = VariableAddress[#return]                         : 
+#   15|     r15_2(glval<unknown>)                                           = FunctionAddress[__builtin_aarch64_uaddlv8qi_uuu] : 
+#   15|     r15_3(glval<__attribute((neon_vector_type(8))) unsigned char>)  = VariableAddress[a]                               : 
+#   15|     r15_4(__attribute((neon_vector_type(8))) unsigned char)         = Load[a]                                          : &:r15_3, m14_6
+#   15|     r15_5(glval<__attribute((neon_vector_type(8))) unsigned char>)  = VariableAddress[b]                               : 
+#   15|     r15_6(__attribute((neon_vector_type(8))) unsigned char)         = Load[b]                                          : &:r15_5, m14_8
+#   15|     r15_7(__attribute((neon_vector_type(8))) unsigned short)        = Call[__builtin_aarch64_uaddlv8qi_uuu]            : func:r15_2, 0:r15_4, 1:r15_6
+#   15|     m15_8(unknown)                                                  = ^CallSideEffect                                  : ~m14_4
+#   15|     m15_9(unknown)                                                  = Chi                                              : total:m14_4, partial:m15_8
+#   15|     m15_10(__attribute((neon_vector_type(8))) unsigned short)       = Store[#return]                                   : &:r15_1, r15_7
+#   14|     r14_9(glval<__attribute((neon_vector_type(8))) unsigned short>) = VariableAddress[#return]                         : 
+#   14|     v14_10(void)                                                    = ReturnValue                                      : &:r14_9, m15_10
+#   14|     v14_11(void)                                                    = AliasedUse                                       : ~m15_9
+#   14|     v14_12(void)                                                    = ExitFunction                                     : 
+
+#   18| uint16x8_t arm_add(uint8x8_t, uint8x8_t)
+#   18|   Block 0
+#   18|     v18_1(void)                                                     = EnterFunction             : 
+#   18|     m18_2(unknown)                                                  = AliasedDefinition         : 
+#   18|     m18_3(unknown)                                                  = InitializeNonLocal        : 
+#   18|     m18_4(unknown)                                                  = Chi                       : total:m18_2, partial:m18_3
+#   18|     r18_5(glval<__attribute((neon_vector_type(8))) unsigned char>)  = VariableAddress[a]        : 
+#   18|     m18_6(__attribute((neon_vector_type(8))) unsigned char)         = InitializeParameter[a]    : &:r18_5
+#   18|     r18_7(glval<__attribute((neon_vector_type(8))) unsigned char>)  = VariableAddress[b]        : 
+#   18|     m18_8(__attribute((neon_vector_type(8))) unsigned char)         = InitializeParameter[b]    : &:r18_7
+#   19|     r19_1(glval<__attribute((neon_vector_type(8))) unsigned char>)  = VariableAddress[c]        : 
+#   19|     r19_2(glval<unknown>)                                           = FunctionAddress[vadd_u8]  : 
+#   19|     r19_3(glval<__attribute((neon_vector_type(8))) unsigned char>)  = VariableAddress[a]        : 
+#   19|     r19_4(__attribute((neon_vector_type(8))) unsigned char)         = Load[a]                   : &:r19_3, m18_6
+#   19|     r19_5(glval<__attribute((neon_vector_type(8))) unsigned char>)  = VariableAddress[b]        : 
+#   19|     r19_6(__attribute((neon_vector_type(8))) unsigned char)         = Load[b]                   : &:r19_5, m18_8
+#   19|     r19_7(__attribute((neon_vector_type(8))) unsigned char)         = Call[vadd_u8]             : func:r19_2, 0:r19_4, 1:r19_6
+#   19|     m19_8(unknown)                                                  = ^CallSideEffect           : ~m18_4
+#   19|     m19_9(unknown)                                                  = Chi                       : total:m18_4, partial:m19_8
+#   19|     m19_10(__attribute((neon_vector_type(8))) unsigned char)        = Store[c]                  : &:r19_1, r19_7
+#   20|     r20_1(glval<__attribute((neon_vector_type(8))) unsigned short>) = VariableAddress[#return]  : 
+#   20|     r20_2(glval<unknown>)                                           = FunctionAddress[vaddl_u8] : 
+#   20|     r20_3(glval<__attribute((neon_vector_type(8))) unsigned char>)  = VariableAddress[a]        : 
+#   20|     r20_4(__attribute((neon_vector_type(8))) unsigned char)         = Load[a]                   : &:r20_3, m18_6
+#   20|     r20_5(glval<__attribute((neon_vector_type(8))) unsigned char>)  = VariableAddress[c]        : 
+#   20|     r20_6(__attribute((neon_vector_type(8))) unsigned char)         = Load[c]                   : &:r20_5, m19_10
+#   20|     r20_7(__attribute((neon_vector_type(8))) unsigned short)        = Call[vaddl_u8]            : func:r20_2, 0:r20_4, 1:r20_6
+#   20|     m20_8(unknown)                                                  = ^CallSideEffect           : ~m19_9
+#   20|     m20_9(unknown)                                                  = Chi                       : total:m19_9, partial:m20_8
+#   20|     m20_10(__attribute((neon_vector_type(8))) unsigned short)       = Store[#return]            : &:r20_1, r20_7
+#   18|     r18_9(glval<__attribute((neon_vector_type(8))) unsigned short>) = VariableAddress[#return]  : 
+#   18|     v18_10(void)                                                    = ReturnValue               : &:r18_9, m20_10
+#   18|     v18_11(void)                                                    = AliasedUse                : ~m20_9
+#   18|     v18_12(void)                                                    = ExitFunction              : 
+
 bad_asts.cpp:
 #    9| int Bad::S::MemberFunction<int 6>(int)
 #    9|   Block 0

cpp/ql/test/library-tests/ir/ir/arm.cpp

@@ -0,0 +1,21 @@
+// semmle-extractor-options: --edg --target --edg linux_arm64
+
+typedef __Uint8x8_t uint8x8_t;
+typedef __Uint16x8_t uint16x8_t;
+
+uint8x8_t vadd_u8(uint8x8_t a, uint8x8_t b) {
+  return a + b;
+}
+
+// Workaround: the frontend only exposes this when the arm_neon.h
+// header is encountered.
+uint16x8_t __builtin_aarch64_uaddlv8qi_uuu(uint8x8_t, uint8x8_t);
+
+uint16x8_t vaddl_u8(uint8x8_t a, uint8x8_t b) {
+  return __builtin_aarch64_uaddlv8qi_uuu (a, b);
+}
+
+uint16x8_t arm_add(uint8x8_t a, uint8x8_t b) {
+  uint8x8_t c = vadd_u8(a, b);
+  return vaddl_u8(a, c);
+}

cpp/ql/test/library-tests/ir/ir/raw_ir.expected

@@ -1,3 +1,80 @@
+arm.cpp:
+#    6| uint8x8_t vadd_u8(uint8x8_t, uint8x8_t)
+#    6|   Block 0
+#    6|     v6_1(void)                                                    = EnterFunction            : 
+#    6|     mu6_2(unknown)                                                = AliasedDefinition        : 
+#    6|     mu6_3(unknown)                                                = InitializeNonLocal       : 
+#    6|     r6_4(glval<__attribute((neon_vector_type(8))) unsigned char>) = VariableAddress[a]       : 
+#    6|     mu6_5(__attribute((neon_vector_type(8))) unsigned char)       = InitializeParameter[a]   : &:r6_4
+#    6|     r6_6(glval<__attribute((neon_vector_type(8))) unsigned char>) = VariableAddress[b]       : 
+#    6|     mu6_7(__attribute((neon_vector_type(8))) unsigned char)       = InitializeParameter[b]   : &:r6_6
+#    7|     r7_1(glval<__attribute((neon_vector_type(8))) unsigned char>) = VariableAddress[#return] : 
+#    7|     r7_2(glval<__attribute((neon_vector_type(8))) unsigned char>) = VariableAddress[a]       : 
+#    7|     r7_3(__attribute((neon_vector_type(8))) unsigned char)        = Load[a]                  : &:r7_2, ~m?
+#    7|     r7_4(glval<__attribute((neon_vector_type(8))) unsigned char>) = VariableAddress[b]       : 
+#    7|     r7_5(__attribute((neon_vector_type(8))) unsigned char)        = Load[b]                  : &:r7_4, ~m?
+#    7|     r7_6(__attribute((neon_vector_type(8))) unsigned char)        = Add                      : r7_3, r7_5
+#    7|     mu7_7(__attribute((neon_vector_type(8))) unsigned char)       = Store[#return]           : &:r7_1, r7_6
+#    6|     r6_8(glval<__attribute((neon_vector_type(8))) unsigned char>) = VariableAddress[#return] : 
+#    6|     v6_9(void)                                                    = ReturnValue              : &:r6_8, ~m?
+#    6|     v6_10(void)                                                   = AliasedUse               : ~m?
+#    6|     v6_11(void)                                                   = ExitFunction             : 
+
+#   14| uint16x8_t vaddl_u8(uint8x8_t, uint8x8_t)
+#   14|   Block 0
+#   14|     v14_1(void)                                                     = EnterFunction                                    : 
+#   14|     mu14_2(unknown)                                                 = AliasedDefinition                                : 
+#   14|     mu14_3(unknown)                                                 = InitializeNonLocal                               : 
+#   14|     r14_4(glval<__attribute((neon_vector_type(8))) unsigned char>)  = VariableAddress[a]                               : 
+#   14|     mu14_5(__attribute((neon_vector_type(8))) unsigned char)        = InitializeParameter[a]                           : &:r14_4
+#   14|     r14_6(glval<__attribute((neon_vector_type(8))) unsigned char>)  = VariableAddress[b]                               : 
+#   14|     mu14_7(__attribute((neon_vector_type(8))) unsigned char)        = InitializeParameter[b]                           : &:r14_6
+#   15|     r15_1(glval<__attribute((neon_vector_type(8))) unsigned short>) = VariableAddress[#return]                         : 
+#   15|     r15_2(glval<unknown>)                                           = FunctionAddress[__builtin_aarch64_uaddlv8qi_uuu] : 
+#   15|     r15_3(glval<__attribute((neon_vector_type(8))) unsigned char>)  = VariableAddress[a]                               : 
+#   15|     r15_4(__attribute((neon_vector_type(8))) unsigned char)         = Load[a]                                          : &:r15_3, ~m?
+#   15|     r15_5(glval<__attribute((neon_vector_type(8))) unsigned char>)  = VariableAddress[b]                               : 
+#   15|     r15_6(__attribute((neon_vector_type(8))) unsigned char)         = Load[b]                                          : &:r15_5, ~m?
+#   15|     r15_7(__attribute((neon_vector_type(8))) unsigned short)        = Call[__builtin_aarch64_uaddlv8qi_uuu]            : func:r15_2, 0:r15_4, 1:r15_6
+#   15|     mu15_8(unknown)                                                 = ^CallSideEffect                                  : ~m?
+#   15|     mu15_9(__attribute((neon_vector_type(8))) unsigned short)       = Store[#return]                                   : &:r15_1, r15_7
+#   14|     r14_8(glval<__attribute((neon_vector_type(8))) unsigned short>) = VariableAddress[#return]                         : 
+#   14|     v14_9(void)                                                     = ReturnValue                                      : &:r14_8, ~m?
+#   14|     v14_10(void)                                                    = AliasedUse                                       : ~m?
+#   14|     v14_11(void)                                                    = ExitFunction                                     : 
+
+#   18| uint16x8_t arm_add(uint8x8_t, uint8x8_t)
+#   18|   Block 0
+#   18|     v18_1(void)                                                     = EnterFunction             : 
+#   18|     mu18_2(unknown)                                                 = AliasedDefinition         : 
+#   18|     mu18_3(unknown)                                                 = InitializeNonLocal        : 
+#   18|     r18_4(glval<__attribute((neon_vector_type(8))) unsigned char>)  = VariableAddress[a]        : 
+#   18|     mu18_5(__attribute((neon_vector_type(8))) unsigned char)        = InitializeParameter[a]    : &:r18_4
+#   18|     r18_6(glval<__attribute((neon_vector_type(8))) unsigned char>)  = VariableAddress[b]        : 
+#   18|     mu18_7(__attribute((neon_vector_type(8))) unsigned char)        = InitializeParameter[b]    : &:r18_6
+#   19|     r19_1(glval<__attribute((neon_vector_type(8))) unsigned char>)  = VariableAddress[c]        : 
+#   19|     r19_2(glval<unknown>)                                           = FunctionAddress[vadd_u8]  : 
+#   19|     r19_3(glval<__attribute((neon_vector_type(8))) unsigned char>)  = VariableAddress[a]        : 
+#   19|     r19_4(__attribute((neon_vector_type(8))) unsigned char)         = Load[a]                   : &:r19_3, ~m?
+#   19|     r19_5(glval<__attribute((neon_vector_type(8))) unsigned char>)  = VariableAddress[b]        : 
+#   19|     r19_6(__attribute((neon_vector_type(8))) unsigned char)         = Load[b]                   : &:r19_5, ~m?
+#   19|     r19_7(__attribute((neon_vector_type(8))) unsigned char)         = Call[vadd_u8]             : func:r19_2, 0:r19_4, 1:r19_6
+#   19|     mu19_8(unknown)                                                 = ^CallSideEffect           : ~m?
+#   19|     mu19_9(__attribute((neon_vector_type(8))) unsigned char)        = Store[c]                  : &:r19_1, r19_7
+#   20|     r20_1(glval<__attribute((neon_vector_type(8))) unsigned short>) = VariableAddress[#return]  : 
+#   20|     r20_2(glval<unknown>)                                           = FunctionAddress[vaddl_u8] : 
+#   20|     r20_3(glval<__attribute((neon_vector_type(8))) unsigned char>)  = VariableAddress[a]        : 
+#   20|     r20_4(__attribute((neon_vector_type(8))) unsigned char)         = Load[a]                   : &:r20_3, ~m?
+#   20|     r20_5(glval<__attribute((neon_vector_type(8))) unsigned char>)  = VariableAddress[c]        : 
+#   20|     r20_6(__attribute((neon_vector_type(8))) unsigned char)         = Load[c]                   : &:r20_5, ~m?
+#   20|     r20_7(__attribute((neon_vector_type(8))) unsigned short)        = Call[vaddl_u8]            : func:r20_2, 0:r20_4, 1:r20_6
+#   20|     mu20_8(unknown)                                                 = ^CallSideEffect           : ~m?
+#   20|     mu20_9(__attribute((neon_vector_type(8))) unsigned short)       = Store[#return]            : &:r20_1, r20_7
+#   18|     r18_8(glval<__attribute((neon_vector_type(8))) unsigned short>) = VariableAddress[#return]  : 
+#   18|     v18_9(void)                                                     = ReturnValue               : &:r18_8, ~m?
+#   18|     v18_10(void)                                                    = AliasedUse                : ~m?
+#   18|     v18_11(void)                                                    = ExitFunction              : 
+
 bad_asts.cpp:
 #    9| int Bad::S::MemberFunction<int 6>(int)
 #    9|   Block 0

cpp/ql/test/library-tests/lambdas/syntax/empty_declarator.expected

@@ -0,0 +1,11 @@
+| parameters.cpp:2:5:2:23 | [...](...){...} | with list | 2 |
+| parameters.cpp:4:5:4:22 | [...](...){...} | with list | 1 |
+| parameters.cpp:6:5:6:17 | [...](...){...} | with list | 1 |
+| parameters.cpp:8:5:8:20 | [...](...){...} | with list | 0 |
+| parameters.cpp:10:5:10:26 | [...](...){...} | with list | 0 |
+| parameters.cpp:11:5:11:24 | [...](...){...} | without list | 0 |
+| parameters.cpp:13:5:13:20 | [...](...){...} | with list | 0 |
+| parameters.cpp:16:5:18:5 | [...](...){...} | with list | 0 |
+| parameters.cpp:20:5:22:5 | [...](...){...} | without list | 0 |
+| parameters.cpp:24:5:24:10 | [...](...){...} | without list | 0 |
+| parameters.cpp:25:5:25:14 | [...](...){...} | with list | 0 |

cpp/ql/test/library-tests/lambdas/syntax/empty_declarator.ql

@@ -0,0 +1,5 @@
+import cpp
+
+from LambdaExpression e, string parameterList
+where if e.hasParameterList() then parameterList = "with list" else parameterList = "without list"
+select e, parameterList, e.getLambdaFunction().getNumberOfParameters()

cpp/ql/test/library-tests/lambdas/syntax/parameters.cpp

@@ -0,0 +1,26 @@
+void test_lambda_declarator() {
+    [=](int, float) { };
+
+    [](int x = 42) { };
+
+    [](int x) { };
+
+    []() mutable { };
+
+    []() [[nodiscard]] { };
+    [] [[nodiscard]] { };
+
+    []() -> void { };
+
+    int i;
+    [&i]() {
+        i += 1;
+    };
+
+    [&i] {
+        i += 1;
+    };
+
+    [] { };
+    [=] () { };
+}

cpp/ql/test/library-tests/templates/type_instantiations/types.expected

@@ -25,6 +25,7 @@
 | file://:0:0:0:0 | __float128 |
 | file://:0:0:0:0 | __fp16 |
 | file://:0:0:0:0 | __int128 |
+| file://:0:0:0:0 | __mfp8 |
 | file://:0:0:0:0 | __va_list_tag |
 | file://:0:0:0:0 | __va_list_tag & |
 | file://:0:0:0:0 | __va_list_tag && |

cpp/ql/test/library-tests/type_sizes/type_sizes.expected

@@ -46,6 +46,7 @@
 | file://:0:0:0:0 | __float128 | 16 |
 | file://:0:0:0:0 | __fp16 | 2 |
 | file://:0:0:0:0 | __int128 | 16 |
+| file://:0:0:0:0 | __mfp8 | 1 |
 | file://:0:0:0:0 | __va_list_tag | 24 |
 | file://:0:0:0:0 | __va_list_tag & | 8 |
 | file://:0:0:0:0 | __va_list_tag && | 8 |

cpp/ql/test/library-tests/unspecified_type/types/unspecified_type.expected

@@ -27,6 +27,7 @@
 | file://:0:0:0:0 | __float128 | __float128 |
 | file://:0:0:0:0 | __fp16 | __fp16 |
 | file://:0:0:0:0 | __int128 | __int128 |
+| file://:0:0:0:0 | __mfp8 | __mfp8 |
 | file://:0:0:0:0 | __va_list_tag & | __va_list_tag & |
 | file://:0:0:0:0 | __va_list_tag && | __va_list_tag && |
 | file://:0:0:0:0 | auto | auto |

cpp/ql/test/library-tests/variables/variables/types.expected

@@ -26,6 +26,7 @@
 | __float128 | Float128Type |  |  |  |  |
 | __fp16 | BinaryFloatingPointType, RealNumberType |  |  |  |  |
 | __int128 | Int128Type |  |  |  |  |
+| __mfp8 | BinaryFloatingPointType, RealNumberType |  |  |  |  |
 | __va_list_tag | DirectAccessHolder, MetricClass, Struct, StructLikeClass |  |  |  |  |
 | __va_list_tag & | LValueReferenceType, PointerOrArrayOrReferenceType, PointerOrArrayOrReferenceTypeIndirection |  | __va_list_tag |  |  |
 | __va_list_tag && | PointerOrArrayOrReferenceType, PointerOrArrayOrReferenceTypeIndirection, RValueReferenceType |  | __va_list_tag |  |  |

csharp/ql/integration-tests/posix/query-suite/csharp-code-quality.qls.expected

@@ -2,6 +2,8 @@ ql/csharp/ql/src/API Abuse/CallToGCCollect.ql
 ql/csharp/ql/src/API Abuse/FormatInvalid.ql
 ql/csharp/ql/src/API Abuse/NoDisposeCallOnLocalIDisposable.ql
 ql/csharp/ql/src/Bad Practices/Control-Flow/ConstantCondition.ql
+ql/csharp/ql/src/CSI/NullAlways.ql
+ql/csharp/ql/src/CSI/NullMaybe.ql
 ql/csharp/ql/src/Dead Code/DeadStoreOfLocal.ql
 ql/csharp/ql/src/Language Abuse/MissedReadonlyOpportunity.ql
 ql/csharp/ql/src/Likely Bugs/Collections/ContainerLengthCmpOffByOne.ql
@@ -11,6 +13,7 @@ ql/csharp/ql/src/Likely Bugs/EqualityCheckOnFloats.ql
 ql/csharp/ql/src/Likely Bugs/ReferenceEqualsOnValueTypes.ql
 ql/csharp/ql/src/Likely Bugs/SelfAssignment.ql
 ql/csharp/ql/src/Likely Bugs/UncheckedCastInEquals.ql
+ql/csharp/ql/src/Performance/StringConcatenationInLoop.ql
 ql/csharp/ql/src/Performance/UseTryGetValue.ql
 ql/csharp/ql/src/Useless code/DefaultToString.ql
 ql/csharp/ql/src/Useless code/IntGetHashCode.ql

csharp/ql/lib/semmle/code/csharp/dataflow/Nullness.qll

@@ -544,8 +544,13 @@ class Dereference extends G::DereferenceableExpr {
         p.hasExtensionMethodModifier() and
         not emc.isConditional()
       |
-        p.fromSource() // assume all non-source extension methods perform a dereference
+        // Assume all non-source extension methods on
-        implies
+        // (1) nullable types are null-safe
+        // (2) non-nullable types are doing a dereference.
+        p.fromLibrary() and
+        not p.getAnnotatedType().isNullableRefType()
+        or
+        p.fromSource() and
         exists(
           Ssa::ImplicitParameterDefinition def,
           AssignableDefinitions::ImplicitParameterDefinition pdef

csharp/ql/lib/semmle/code/csharp/frameworks/system/Diagnostics.qll

@@ -41,9 +41,7 @@ class SystemDiagnosticsDebugClass extends SystemDiagnosticsClass {
   /** Gets an `Assert(bool, ...)` method. */
   Method getAssertMethod() {
     result.getDeclaringType() = this and
-    result.hasName("Assert") and
+    result.hasName("Assert")
-    result.getParameter(0).getType() instanceof BoolType and
-    result.getReturnType() instanceof VoidType
   }
 }
 

csharp/ql/src/CSI/NullAlways.ql

@@ -9,6 +9,7 @@
  *       correctness
  *       exceptions
  *       external/cwe/cwe-476
+ *       quality
  */
 
 import csharp

csharp/ql/src/CSI/NullMaybe.ql

@@ -10,6 +10,7 @@
  *       correctness
  *       exceptions
  *       external/cwe/cwe-476
+ *       quality
  */
 
 import csharp

csharp/ql/src/Performance/StringConcatenationInLoop.ql

@@ -7,6 +7,7 @@
  * @id cs/string-concatenation-in-loop
  * @tags efficiency
  *       maintainability
+ *       quality
  */
 
 import csharp

csharp/ql/src/Security Features/CWE-134/UncontrolledFormatString.ql

@@ -4,7 +4,7 @@
  *              and cause a denial of service.
  * @kind path-problem
  * @problem.severity error
- * @security-severity 9.3
+ * @security-severity 7.3
  * @precision high
  * @id cs/uncontrolled-format-string
  * @tags security

csharp/ql/src/change-notes/2025-06-03-dereferece-extension-method.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The queries `cs/dereferenced-value-is-always-null` and `cs/dereferenced-value-may-be-null` have been improved to reduce false positives. The queries no longer assume that expressions are dereferenced when passed as the receiver (`this` parameter) to extension methods where that parameter is a nullable type.

csharp/ql/src/change-notes/2025-06-06-reduce-CWE-134-for-memory-safe-languages.md

@@ -0,0 +1,4 @@
+---
+category: queryMetadata
+---
+* Adjusts the `@security-severity` from 9.3 to 7.3 for `cs/uncontrolled-format-string` to align `CWE-134` severity for memory safe languages to better reflect their impact.

csharp/ql/src/codeql-suites/csharp-security-and-quality.qls

@@ -1,4 +1,143 @@
 - description: Security-and-quality queries for C#
 - queries: .
-- apply: security-and-quality-selectors.yml
+- include:
-  from: codeql/suite-helpers
+    kind:
+    - problem
+    - path-problem
+    precision:
+    - high
+    - very-high
+    tags contain:
+    - security
+- include:
+    kind:
+    - problem
+    - path-problem
+    precision: medium
+    problem.severity:
+    - error
+    - warning
+    tags contain:
+    - security
+- include:
+    id:
+      - cs/asp/response-write
+      - cs/call-to-gc
+      - cs/call-to-object-tostring
+      - cs/call-to-obsolete-method
+      - cs/call-to-unmanaged-code
+      - cs/cast-from-abstract-to-concrete-collection
+      - cs/cast-of-this-to-type-parameter
+      - cs/catch-nullreferenceexception
+      - cs/catch-of-all-exceptions
+      - cs/chained-type-tests
+      - cs/class-implements-icloneable
+      - cs/class-missing-equals
+      - cs/class-name-comparison
+      - cs/class-name-matches-base-class
+      - cs/coalesce-of-identical-expressions
+      - cs/comparison-of-identical-expressions
+      - cs/complex-block
+      - cs/complex-condition
+      - cs/constant-comparison
+      - cs/constant-condition
+      - cs/coupled-types
+      - cs/dereferenced-value-is-always-null
+      - cs/dereferenced-value-may-be-null
+      - cs/dispose-not-called-on-throw
+      - cs/downcast-of-this
+      - cs/empty-block
+      - cs/empty-catch-block
+      - cs/empty-collection
+      - cs/empty-lock-statement
+      - cs/equality-on-floats
+      - cs/equals-on-arrays
+      - cs/equals-on-unrelated-types
+      - cs/equals-uses-as
+      - cs/equals-uses-is
+      - cs/expose-implementation
+      - cs/field-masks-base-field
+      - cs/gethashcode-is-not-defined
+      - cs/impossible-array-cast
+      - cs/inconsistent-compareto-and-equals
+      - cs/inconsistent-equals-and-gethashcode
+      - cs/inconsistent-lock-sequence
+      - cs/index-out-of-bounds
+      - cs/inefficient-containskey
+      - cs/invalid-dynamic-call
+      - cs/invalid-string-formatting
+      - cs/linq/inconsistent-enumeration
+      - cs/linq/missed-all
+      - cs/linq/missed-cast
+      - cs/linq/missed-oftype
+      - cs/linq/missed-select
+      - cs/linq/missed-where
+      - cs/linq/useless-select
+      - cs/local-not-disposed
+      - cs/local-shadows-member
+      - cs/lock-this
+      - cs/locked-wait
+      - cs/loss-of-precision
+      - cs/mishandling-japanese-era
+      - cs/misleading-indentation
+      - cs/missed-readonly-modifier
+      - cs/missed-ternary-operator
+      - cs/missed-using-statement
+      - cs/nested-if-statements
+      - cs/nested-loops-with-same-variable
+      - cs/non-short-circuit
+      - cs/null-argument-to-equals
+      - cs/path-combine
+      - cs/recursive-equals-call
+      - cs/recursive-operator-equals-call
+      - cs/reference-equality-on-valuetypes
+      - cs/reference-equality-with-object
+      - cs/rethrown-exception-variable
+      - cs/self-assignment
+      - cs/simplifiable-boolean-expression
+      - cs/static-field-written-by-instance
+      - cs/string-concatenation-in-loop
+      - cs/stringbuilder-creation-in-loop
+      - cs/stringbuilder-initialized-with-character
+      - cs/test-for-negative-container-size
+      - cs/too-many-ref-parameters
+      - cs/type-test-of-this
+      - cs/unchecked-cast-in-equals
+      - cs/unmanaged-code
+      - cs/unsafe-double-checked-lock
+      - cs/unsafe-sync-on-field
+      - cs/unsafe-year-construction
+      - cs/unsynchronized-getter
+      - cs/unsynchronized-static-access
+      - cs/unused-collection
+      - cs/unused-label
+      - cs/unused-property-value
+      - cs/useless-assignment-to-local
+      - cs/useless-cast-to-self
+      - cs/useless-gethashcode-call
+      - cs/useless-if-statement
+      - cs/useless-tostring-call
+      - cs/useless-type-test
+      - cs/useless-upcast
+      - cs/virtual-call-in-constructor
+      - cs/wrong-compareto-signature
+      - cs/wrong-equals-signature
+      - cs/xmldoc/missing-summary
+- include:
+    kind:
+    - diagnostic
+- include:
+    kind:
+    - metric
+    tags contain:
+    - summary
+- exclude:
+    deprecated: //
+- exclude:
+    query path:
+      - /^experimental\/.*/
+      - Metrics/Summaries/FrameworkCoverage.ql
+- exclude:
+    tags contain:
+      - modeleditor
+      - modelgenerator

csharp/ql/test/query-tests/Nullness/A.cs

@@ -5,7 +5,7 @@ class A
     public void Lock()
     {
         object synchronizedAlways = null;
-        lock (synchronizedAlways) // BAD (always)
+        lock (synchronizedAlways) // $ Alert[cs/dereferenced-value-is-always-null]
         {
             synchronizedAlways.GetHashCode(); // GOOD
         }
@@ -14,7 +14,7 @@ class A
     public void ArrayAssignTest()
     {
         int[] arrayNull = null;
-        arrayNull[0] = 10; // BAD (always)
+        arrayNull[0] = 10; // $ Alert[cs/dereferenced-value-is-always-null]
 
         int[] arrayOk;
         arrayOk = new int[10];
@@ -28,10 +28,10 @@ class A
         object methodAccess = null;
         object methodCall = null;
 
-        Console.WriteLine(arrayAccess[1]); // BAD (always)
+        Console.WriteLine(arrayAccess[1]); // $ Alert[cs/dereferenced-value-is-always-null]
-        Console.WriteLine(fieldAccess.Length); // BAD (always)
+        Console.WriteLine(fieldAccess.Length); // $ Alert[cs/dereferenced-value-is-always-null]
-        Func<String> tmp = methodAccess.ToString; // BAD (always)
+        Func<String> tmp = methodAccess.ToString; // $ Alert[cs/dereferenced-value-is-always-null]
-        Console.WriteLine(methodCall.ToString()); // BAD (always)
+        Console.WriteLine(methodCall.ToString()); // $ Alert[cs/dereferenced-value-is-always-null]
 
         Console.WriteLine(arrayAccess[1]); // GOOD
         Console.WriteLine(fieldAccess.Length); // GOOD
@@ -47,7 +47,7 @@ class A
 
         object varRef = null;
         TestMethod2(ref varRef);
-        varRef.ToString(); // BAD (always)
+        varRef.ToString(); // $ Alert[cs/dereferenced-value-is-always-null]
 
         varRef = null;
         TestMethod3(ref varRef);

csharp/ql/test/query-tests/Nullness/Assert.cs

@@ -12,7 +12,7 @@ class AssertTests
 
         s = b ? null : "";
         Assert.IsNull(s);
-        Console.WriteLine(s.Length); // BAD (always)
+        Console.WriteLine(s.Length); // $ Alert[cs/dereferenced-value-is-always-null]
 
         s = b ? null : "";
         Assert.IsNotNull(s);
@@ -20,7 +20,7 @@ class AssertTests
 
         s = b ? null : "";
         Assert.IsTrue(s == null);
-        Console.WriteLine(s.Length); // BAD (always)
+        Console.WriteLine(s.Length); // $ Alert[cs/dereferenced-value-is-always-null]
 
         s = b ? null : "";
         Assert.IsTrue(s != null);
@@ -28,7 +28,7 @@ class AssertTests
 
         s = b ? null : "";
         Assert.IsFalse(s != null);
-        Console.WriteLine(s.Length); // BAD (always)
+        Console.WriteLine(s.Length); // $ Alert[cs/dereferenced-value-is-always-null]
 
         s = b ? null : "";
         Assert.IsFalse(s == null);
@@ -44,10 +44,10 @@ class AssertTests
 
         s = b ? null : "";
         Assert.IsTrue(s == null && b);
-        Console.WriteLine(s.Length); // BAD (always)
+        Console.WriteLine(s.Length); // $ Alert[cs/dereferenced-value-is-always-null]
 
         s = b ? null : "";
         Assert.IsFalse(s != null || !b);
-        Console.WriteLine(s.Length); // BAD (always)
+        Console.WriteLine(s.Length); // $ Alert[cs/dereferenced-value-is-always-null]
     }
 }

csharp/ql/test/query-tests/Nullness/B.cs

@@ -10,7 +10,7 @@ class B
         B neqCallAlways = null;
 
         if (eqCallAlways == null)
-            eqCallAlways.ToString(); // BAD (always)
+            eqCallAlways.ToString(); // $ Alert[cs/dereferenced-value-is-always-null]
 
         if (b2 != null)
             b2.ToString(); // GOOD
@@ -21,7 +21,7 @@ class B
 
         if (neqCallAlways != null) { }
         else
-            neqCallAlways.ToString(); // BAD (always)
+            neqCallAlways.ToString(); // $ Alert[cs/dereferenced-value-is-always-null]
     }
 
     public static bool operator ==(B b1, B b2)

csharp/ql/test/query-tests/Nullness/C.cs

@@ -15,7 +15,7 @@ public class C
 
         if (!(o != null))
         {
-            o.GetHashCode(); // BAD (always)
+            o.GetHashCode(); // $ Alert[cs/dereferenced-value-is-always-null]
         }
     }
 
@@ -39,7 +39,7 @@ public class C
     {
         var s = Maybe() ? null : "";
         Debug.Assert(s == null);
-        s.ToString(); // BAD (always)
+        s.ToString(); // $ Alert[cs/dereferenced-value-is-always-null]
 
         s = Maybe() ? null : "";
         Debug.Assert(s != null);
@@ -50,22 +50,22 @@ public class C
     {
         var o1 = new object();
         AssertNull(o1);
-        o1.ToString(); // BAD (always) (false negative)
+        o1.ToString(); // $ MISSING: Alert[cs/dereferenced-value-is-always-null]
 
         var o2 = Maybe() ? null : "";
         Assert.IsNull(o2);
-        o2.ToString(); // BAD (always)
+        o2.ToString(); // $ Alert[cs/dereferenced-value-is-always-null]
     }
 
     public void AssertNotNullTest()
     {
-        var o1 = Maybe() ? null : new object();
+        var o1 = Maybe() ? null : new object(); // $ Source[cs/dereferenced-value-may-be-null]
         AssertNonNull(o1);
-        o1.ToString(); // GOOD (false positive)
+        o1.ToString(); // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
 
-        var o2 = Maybe() ? null : new object();
+        var o2 = Maybe() ? null : new object(); // $ Source[cs/dereferenced-value-may-be-null]
         AssertNonNull(o1);
-        o2.ToString(); // BAD (maybe)
+        o2.ToString(); // $ Alert[cs/dereferenced-value-may-be-null]
 
         var o3 = Maybe() ? null : new object();
         Assert.IsNotNull(o3);
@@ -91,16 +91,16 @@ public class C
 
     public void Lock()
     {
-        var o = Maybe() ? null : new object();
+        var o = Maybe() ? null : new object(); // $ Source[cs/dereferenced-value-may-be-null]
-        lock (o) // BAD (maybe)
+        lock (o) // $ Alert[cs/dereferenced-value-may-be-null]
             o.ToString(); // GOOD
     }
 
     public void Foreach(IEnumerable<int> list)
     {
         if (Maybe())
-            list = null;
+            list = null; // $ Source[cs/dereferenced-value-may-be-null]
-        foreach (var x in list) // BAD (maybe)
+        foreach (var x in list) // $ Alert[cs/dereferenced-value-may-be-null]
         {
             x.ToString(); // GOOD
             list.ToString(); // GOOD
@@ -159,7 +159,7 @@ public class C
         s = null;
         do
         {
-            s.ToString(); // BAD (always)
+            s.ToString(); // $ Alert[cs/dereferenced-value-is-always-null]
             s = null;
         }
         while (s != null);
@@ -167,15 +167,15 @@ public class C
         s = null;
         do
         {
-            s.ToString(); // BAD (always)
+            s.ToString(); // $ Alert[cs/dereferenced-value-is-always-null]
         }
         while (s != null);
 
         s = "";
         do
         {
-            s.ToString(); // BAD (maybe)
+            s.ToString(); // $ Alert[cs/dereferenced-value-may-be-null]
-            s = null;
+            s = null; // $ Source[cs/dereferenced-value-may-be-null]
         }
         while (true);
     }
@@ -193,15 +193,15 @@ public class C
         s = null;
         while (b)
         {
-            s.ToString(); // BAD (always)
+            s.ToString(); // $ Alert[cs/dereferenced-value-is-always-null]
             s = null;
         }
 
         s = "";
         while (true)
         {
-            s.ToString(); // BAD (maybe)
+            s.ToString(); // $ Alert[cs/dereferenced-value-may-be-null]
-            s = null;
+            s = null; // $ Source[cs/dereferenced-value-may-be-null]
         }
     }
 
@@ -215,12 +215,12 @@ public class C
         }
 
         if (s == null)
-            s.ToString(); // BAD (always)
+            s.ToString(); // $ Alert[cs/dereferenced-value-is-always-null]
 
         s = "";
         if (s != null && s.Length % 2 == 0)
-            s = null;
+            s = null; // $ Source[cs/dereferenced-value-may-be-null]
-        s.ToString(); // BAD (maybe)
+        s.ToString(); // $ Alert[cs/dereferenced-value-may-be-null]
     }
 
     public void For()
@@ -230,23 +230,23 @@ public class C
         {
             s.ToString(); // GOOD
         }
-        s.ToString(); // BAD (always)
+        s.ToString(); // $ Alert[cs/dereferenced-value-is-always-null]
 
         for (s = null; s == null; s = null)
         {
-            s.ToString(); // BAD (always)
+            s.ToString(); // $ Alert[cs/dereferenced-value-is-always-null]
         }
 
-        for (s = ""; ; s = null)
+        for (s = ""; ; s = null) // $ Source[cs/dereferenced-value-may-be-null]
         {
-            s.ToString(); // BAD (maybe)
+            s.ToString(); // $ Alert[cs/dereferenced-value-may-be-null]
         }
     }
 
     public void ArrayAssignTest()
     {
         int[] a = null;
-        a[0] = 10; // BAD (always)
+        a[0] = 10; // $ Alert[cs/dereferenced-value-is-always-null]
 
         a = new int[10];
         a[0] = 42; // GOOD
@@ -257,8 +257,8 @@ public class C
         int[] ia = null;
         string[] sa = null;
 
-        ia[1] = 0; // BAD (always)
+        ia[1] = 0; // $ Alert[cs/dereferenced-value-is-always-null]
-        var temp = sa.Length; // BAD (always)
+        var temp = sa.Length; // $ Alert[cs/dereferenced-value-is-always-null]
 
         ia[1] = 0; // BAD (always), but not first
         temp = sa.Length; // BAD (always), but not first

csharp/ql/test/query-tests/Nullness/D.cs

@@ -14,22 +14,22 @@ public class D
     public void Caller()
     {
         Callee1(new object());
-        Callee1(null);
+        Callee1(null); // $ Source[cs/dereferenced-value-may-be-null]
         Callee2(new object());
     }
 
     public void Callee1(object param)
     {
-        param.ToString(); // BAD (maybe)
+        param.ToString(); // $ Alert[cs/dereferenced-value-may-be-null]
     }
 
-    public void Callee2(object param)
+    public void Callee2(object param) // $ Source[cs/dereferenced-value-may-be-null]
     {
         if (param != null)
         {
             param.ToString(); // GOOD
         }
-        param.ToString(); // BAD (maybe)
+        param.ToString(); // $ Alert[cs/dereferenced-value-may-be-null]
     }
 
     private static bool CustomIsNull(object x)
@@ -55,54 +55,54 @@ public class D
         if ((2 > 1 && o4 != null) != false)
             o4.ToString(); // GOOD
 
-        var o5 = (o4 != null) ? "" : null;
+        var o5 = (o4 != null) ? "" : null; // $ Source[cs/dereferenced-value-may-be-null]
         if (o5 != null)
             o4.ToString(); // GOOD
         if (o4 != null)
-            o5.ToString(); // GOOD (false positive)
+            o5.ToString(); // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
 
         var o6 = maybe ? null : "";
         if (!CustomIsNull(o6))
             o6.ToString(); // GOOD
 
-        var o7 = maybe ? null : "";
+        var o7 = maybe ? null : ""; // $ Source[cs/dereferenced-value-may-be-null]
         var ok = o7 != null && 2 > 1;
         if (ok)
             o7.ToString(); // GOOD
         else
-            o7.ToString(); // BAD (maybe)
+            o7.ToString(); // $ Alert[cs/dereferenced-value-may-be-null]
 
-        var o8 = maybe ? null : "";
+        var o8 = maybe ? null : ""; // $ Source[cs/dereferenced-value-may-be-null]
         int track = o8 == null ? 42 : 1 + 1;
         if (track == 2)
             o8.ToString(); // GOOD
         if (track != 42)
             o8.ToString(); // GOOD
         if (track < 42)
-            o8.ToString(); // GOOD (false positive)
+            o8.ToString(); // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
         if (track <= 41)
-            o8.ToString(); // GOOD (false positive)
+            o8.ToString(); // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
     }
 
     public void Deref(int i)
     {
-        int[] xs = maybe ? null : new int[2];
+        int[] xs = maybe ? null : new int[2]; // $ Source[cs/dereferenced-value-may-be-null]
         if (i > 1)
-            xs[0] = 5; // BAD (maybe)
+            xs[0] = 5; // $ Alert[cs/dereferenced-value-may-be-null]
 
         if (i > 2)
-            maybe = xs[1] > 5; // BAD (maybe)
+            maybe = xs[1] > 5; // $ Alert[cs/dereferenced-value-may-be-null]
 
         if (i > 3)
         {
-            var l = xs.Length; // BAD (maybe)
+            var l = xs.Length; // $ Alert[cs/dereferenced-value-may-be-null]
         }
 
         if (i > 4)
-            foreach (var _ in xs) ; // BAD (maybe)
+            foreach (var _ in xs) ; // $ Alert[cs/dereferenced-value-may-be-null]
 
         if (i > 5)
-            lock (xs) // BAD (maybe)
+            lock (xs) // $ Alert[cs/dereferenced-value-may-be-null]
                 xs.ToString(); // Not reported - same basic block
 
         if (i > 6)
@@ -117,12 +117,12 @@ public class D
         var x = b ? null : "abc";
         x = x == null ? "" : x;
         if (x == null)
-            x.ToString(); // BAD (always)
+            x.ToString(); // $ Alert[cs/dereferenced-value-is-always-null]
         else
             x.ToString(); // GOOD
     }
 
-    public void LengthGuard(int[] a, int[] b)
+    public void LengthGuard(int[] a, int[] b) // $ Source[cs/dereferenced-value-may-be-null]
     {
         int alen = a == null ? 0 : a.Length; // GOOD
         int blen = b == null ? 0 : b.Length; // GOOD
@@ -131,8 +131,8 @@ public class D
         {
             for (int i = 0; i < alen; i++)
             {
-                sum += a[i]; // GOOD (false positive)
+                sum += a[i]; // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
-                sum += b[i]; // GOOD (false positive)
+                sum += b[i]; // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
             }
         }
         int alen2;
@@ -142,13 +142,13 @@ public class D
             alen2 = 0;
         for (int i = 1; i <= alen2; ++i)
         {
-            sum += a[i - 1]; // GOOD (false positive)
+            sum += a[i - 1]; // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
         }
     }
 
-    public void MissedGuard(object obj)
+    public void MissedGuard(object obj) // $ Source[cs/dereferenced-value-may-be-null]
     {
-        obj.ToString(); // BAD (maybe)
+        obj.ToString(); // $ Alert[cs/dereferenced-value-may-be-null]
         var x = obj != null ? 1 : 0;
     }
 
@@ -160,7 +160,7 @@ public class D
 
     public void Exceptions()
     {
-        object obj = null;
+        object obj = null; // $ Source[cs/dereferenced-value-may-be-null]
         try
         {
             obj = MkMaybe();
@@ -168,7 +168,7 @@ public class D
         catch (Exception e)
         {
         }
-        obj.ToString(); // BAD (maybe)
+        obj.ToString(); // $ Alert[cs/dereferenced-value-may-be-null]
 
         object obj2 = null;
         try
@@ -194,7 +194,7 @@ public class D
     {
         var o = new Object();
         if (o == null)
-            o.ToString(); // BAD (always)
+            o.ToString(); // $ Alert[cs/dereferenced-value-is-always-null]
         o.ToString(); // GOOD
 
         try
@@ -204,7 +204,7 @@ public class D
         catch (Exception e)
         {
             if (e == null)
-                e.ToString(); // BAD (always)
+                e.ToString(); // $ Alert[cs/dereferenced-value-is-always-null]
             e.ToString(); // GOOD
         }
 
@@ -214,12 +214,12 @@ public class D
 
         var o3 = "abc";
         if (o3 == null)
-            o3.ToString(); // BAD (always)
+            o3.ToString(); // $ Alert[cs/dereferenced-value-is-always-null]
         o3.ToString(); // GOOD
 
         var o4 = "" + null;
         if (o4 == null)
-            o4.ToString(); // BAD (always)
+            o4.ToString(); // $ Alert[cs/dereferenced-value-is-always-null]
         o4.ToString(); // GOOD
     }
 
@@ -237,25 +237,25 @@ public class D
         if (flag)
             o.ToString(); // GOOD
 
-        o = null;
+        o = null; // $ Source[cs/dereferenced-value-may-be-null]
         var other = maybe ? null : "";
         if (other == null)
             o = "";
         if (other != null)
-            o.ToString(); // BAD (always) (reported as maybe)
+            o.ToString(); // $ Alert[cs/dereferenced-value-may-be-null] (always - but reported as maybe)
         else
-            o.ToString(); // GOOD (false positive)
+            o.ToString(); // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
 
-        var o2 = (num < 0) ? null : "";
+        var o2 = (num < 0) ? null : ""; // $ Source[cs/dereferenced-value-may-be-null]
         if (num < 0)
             o2 = "";
         else
-            o2.ToString(); // GOOD (false positive)
+            o2.ToString(); // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
     }
 
     public void TrackingVariable(int[] a)
     {
-        object o = null;
+        object o = null; // $ Source[cs/dereferenced-value-may-be-null]
         object other = null;
         if (maybe)
         {
@@ -264,9 +264,9 @@ public class D
         }
 
         if (other is string)
-            o.ToString(); // GOOD (false positive)
+            o.ToString(); // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
 
-        o = null;
+        o = null; // $ Source[cs/dereferenced-value-may-be-null]
         int count = 0;
         var found = false;
         for (var i = 0; i < a.Length; i++)
@@ -280,7 +280,7 @@ public class D
             }
             if (a[i] > 10000)
             {
-                o = null;
+                o = null; // $ Source[cs/dereferenced-value-may-be-null]
                 count = 0;
                 if (2 > i) { }
                 found = false;
@@ -288,20 +288,20 @@ public class D
         }
 
         if (count > 3)
-            o.ToString(); // GOOD (false positive)
+            o.ToString(); // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
 
         if (found)
-            o.ToString(); // GOOD (false positive)
+            o.ToString(); // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
 
-        object prev = null;
+        object prev = null; // $ Source[cs/dereferenced-value-may-be-null]
         for (var i = 0; i < a.Length; ++i)
         {
             if (i != 0)
-                prev.ToString(); // GOOD (false positive)
+                prev.ToString(); // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
             prev = a[i];
         }
 
-        string s = null;
+        string s = null; // $ Source[cs/dereferenced-value-may-be-null]
         {
             var s_null = true;
             foreach (var i in a)
@@ -310,10 +310,10 @@ public class D
                 s = "" + a;
             }
             if (!s_null)
-                s.ToString(); // GOOD (false positive)
+                s.ToString(); // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
         }
 
-        object r = null;
+        object r = null; // $ Source[cs/dereferenced-value-may-be-null]
         var stat = MyStatus.INIT;
         while (stat == MyStatus.INIT && stat != MyStatus.READY)
         {
@@ -321,7 +321,7 @@ public class D
             if (stat == MyStatus.INIT)
                 stat = MyStatus.READY;
         }
-        r.ToString(); // GOOD (false positive)
+        r.ToString(); // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
     }
 
     public enum MyStatus
@@ -348,28 +348,28 @@ public class D
 
     public void LoopCorr(int iters)
     {
-        int[] a = null;
+        int[] a = null; // $ Source[cs/dereferenced-value-may-be-null]
         if (iters > 0)
             a = new int[iters];
 
         for (var i = 0; i < iters; ++i)
-            a[i] = 0; // GOOD (false positive)
+            a[i] = 0; // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
 
         if (iters > 0)
         {
-            string last = null;
+            string last = null; // $ Source[cs/dereferenced-value-may-be-null]
             for (var i = 0; i < iters; i++)
                 last = "abc";
-            last.ToString(); // GOOD (false positive)
+            last.ToString(); // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
         }
 
-        int[] b = maybe ? null : new int[iters];
+        int[] b = maybe ? null : new int[iters]; // $ Source[cs/dereferenced-value-may-be-null]
         if (iters > 0 && (b == null || b.Length < iters))
             throw new Exception();
 
         for (var i = 0; i < iters; ++i)
         {
-            b[i] = 0; // GOOD (false positive)
+            b[i] = 0; // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
         }
     }
 
@@ -382,33 +382,33 @@ public class D
         if (ioe != null)
             ioe = e;
         else
-            ioe.ToString(); // BAD (always)
+            ioe.ToString(); // $ Alert[cs/dereferenced-value-is-always-null]
     }
 
-    public void LengthGuard2(int[] a, int[] b)
+    public void LengthGuard2(int[] a, int[] b) // $ Source[cs/dereferenced-value-may-be-null]
     {
         int alen = a == null ? 0 : a.Length; // GOOD
         int sum = 0;
         int i;
         for (i = 0; i < alen; i++)
         {
-            sum += a[i]; // GOOD (false positive)
+            sum += a[i]; // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
         }
         int blen = b == null ? 0 : b.Length; // GOOD
         for (i = 0; i < blen; i++)
         {
-            sum += b[i]; // GOOD (false positive)
+            sum += b[i]; // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
         }
         i = -3;
     }
 
-    public void CorrConds2(object x, object y)
+    public void CorrConds2(object x, object y) // $ Source[cs/dereferenced-value-may-be-null]
     {
         if ((x != null && y == null) || (x == null && y != null))
             return;
         if (x != null)
-            y.ToString(); // GOOD (false positive)
+            y.ToString(); // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
         if (y != null)
-            x.ToString(); // GOOD (false positive)
+            x.ToString(); // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
     }
 }

csharp/ql/test/query-tests/Nullness/E.cs

@@ -6,12 +6,12 @@ public class E
 {
     public void Ex1(long[][][] a1, int ix, int len)
     {
-        long[][] a2 = null;
+        long[][] a2 = null; // $ Source[cs/dereferenced-value-may-be-null]
         var haveA2 = ix < len && (a2 = a1[ix]) != null;
-        long[] a3 = null;
+        long[] a3 = null; // $ Source[cs/dereferenced-value-may-be-null]
-        var haveA3 = haveA2 && (a3 = a2[ix]) != null; // GOOD (FALSE POSITIVE)
+        var haveA3 = haveA2 && (a3 = a2[ix]) != null; // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
         if (haveA3)
-            a3[0] = 0; // GOOD (FALSE POSITIVE)
+            a3[0] = 0; // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
     }
 
     public void Ex2(bool x, bool y)
@@ -20,11 +20,11 @@ public class E
         var s2 = (s1 == null) ? null : "";
         if (s2 == null)
         {
-            s1 = y ? null : "";
+            s1 = y ? null : ""; // $ Source[cs/dereferenced-value-may-be-null]
             s2 = (s1 == null) ? null : "";
         }
         if (s2 != null)
-            s1.ToString(); // GOOD (FALSE POSITIVE)
+            s1.ToString(); // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
     }
 
     public void Ex3(IEnumerable<string> ss)
@@ -48,7 +48,7 @@ public class E
     {
         int index = 0;
         var result = new List<List<string>>();
-        List<string> slice = null;
+        List<string> slice = null; // $ Source[cs/dereferenced-value-may-be-null]
         var iter = list.GetEnumerator();
         while (iter.MoveNext())
         {
@@ -58,19 +58,19 @@ public class E
                 slice = new List<string>();
                 result.Add(slice);
             }
-            slice.Add(str); // GOOD (FALSE POSITIVE)
+            slice.Add(str); // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
             ++index;
         }
     }
 
-    public void Ex5(bool hasArr, int[] arr)
+    public void Ex5(bool hasArr, int[] arr) // $ Source[cs/dereferenced-value-may-be-null]
     {
         int arrLen = 0;
         if (hasArr)
             arrLen = arr == null ? 0 : arr.Length;
 
         if (arrLen > 0)
-            arr[0] = 0; // GOOD (FALSE POSITIVE)
+            arr[0] = 0; // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
     }
 
     public const int MY_CONST_A = 1;
@@ -104,12 +104,12 @@ public class E
 
     public void Ex7(int[] arr1)
     {
-        int[] arr2 = null;
+        int[] arr2 = null; // $ Source[cs/dereferenced-value-may-be-null]
         if (arr1.Length > 0)
             arr2 = new int[arr1.Length];
 
         for (var i = 0; i < arr1.Length; i++)
-            arr2[i] = arr1[i]; // GOOD (FALSE POSITIVE)
+            arr2[i] = arr1[i]; // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
     }
 
     public void Ex8(int x, int lim)
@@ -122,7 +122,7 @@ public class E
             int j = 0;
             while (!stop && j < lim)
             {
-                int step = (j * obj.GetHashCode()) % 10; // GOOD (FALSE POSITIVE)
+                int step = (j * obj.GetHashCode()) % 10; // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
                 if (step == 0)
                 {
                     obj.ToString(); // GOOD
@@ -134,7 +134,7 @@ public class E
                     }
                     else
                     {
-                        obj = null;
+                        obj = null; // $ Source[cs/dereferenced-value-may-be-null]
                     }
                     continue;
                 }
@@ -149,33 +149,33 @@ public class E
         {
             return;
         }
-        object obj2 = obj1;
+        object obj2 = obj1; // $ Source[cs/dereferenced-value-may-be-null]
         if (obj2 != null && obj2.GetHashCode() % 5 > 2)
         {
             obj2.ToString(); // GOOD
             cond = true;
         }
         if (cond)
-            obj2.ToString(); // GOOD (FALSE POSITIVE)
+            obj2.ToString(); // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
     }
 
-    public void Ex10(int[] a)
+    public void Ex10(int[] a) // $ Source[cs/dereferenced-value-may-be-null]
     {
         int n = a == null ? 0 : a.Length;
         for (var i = 0; i < n; i++)
         {
-            int x = a[i]; // GOOD (FALSE POSITIVE)
+            int x = a[i]; // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
             if (x > 7)
                 a = new int[n];
         }
     }
 
-    public void Ex11(object obj, bool b1)
+    public void Ex11(object obj, bool b1) // $ Source[cs/dereferenced-value-may-be-null]
     {
         bool b2 = obj == null ? false : b1;
         if (b2 == null)
         {
-            obj.ToString(); // GOOD (FALSE POSITIVE)
+            obj.ToString(); // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
         }
         if (obj == null)
         {
@@ -183,61 +183,61 @@ public class E
         }
         if (b1 == null)
         {
-            obj.ToString(); // GOOD (FALSE POSITIVE)
+            obj.ToString(); // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
         }
     }
 
-    public void Ex12(object o)
+    public void Ex12(object o) // $ Source[cs/dereferenced-value-may-be-null]
     {
-        var i = o.GetHashCode(); // BAD (maybe)
+        var i = o.GetHashCode(); // $ Alert[cs/dereferenced-value-may-be-null]
         var s = o?.ToString();
     }
 
     public void Ex13(bool b)
     {
-        var o = b ? null : "";
+        var o = b ? null : ""; // $ Source[cs/dereferenced-value-may-be-null]
         o.M1(); // GOOD
         if (b)
-            o.M2(); // BAD (maybe)
+            o.M2(); // $ Alert[cs/dereferenced-value-may-be-null]
         else
-            o.Select(x => x); // BAD (maybe)
+            o.Select(x => x); // $ Alert[cs/dereferenced-value-may-be-null]
     }
 
     public int Ex14(string s)
     {
         if (s is string)
             return s.Length;
-        return s.GetHashCode(); // BAD (always)
+        return s.GetHashCode(); // $ Alert[cs/dereferenced-value-is-always-null]
     }
 
     public void Ex15(bool b)
     {
         var x = "";
         if (b)
-            x = null;
+            x = null; // $ Source[cs/dereferenced-value-may-be-null]
-        x.ToString(); // BAD (maybe)
+        x.ToString(); // $ Alert[cs/dereferenced-value-may-be-null]
         if (b)
-            x.ToString(); // BAD (always)
+            x.ToString(); // $ Alert[cs/dereferenced-value-is-always-null]
     }
 
     public void Ex16(bool b)
     {
         var x = "";
         if (b)
-            x = null;
+            x = null; // $ Source[cs/dereferenced-value-may-be-null]
         if (b)
-            x.ToString(); // BAD (always)
+            x.ToString(); // $ Alert[cs/dereferenced-value-is-always-null]
-        x.ToString(); // BAD (maybe)
+        x.ToString(); // $ Alert[cs/dereferenced-value-may-be-null]
     }
 
-    public int Ex17(int? i)
+    public int Ex17(int? i) // $ Source[cs/dereferenced-value-may-be-null]
     {
-        return i.Value; // BAD (maybe)
+        return i.Value; // $ Alert[cs/dereferenced-value-may-be-null]
     }
 
-    public int Ex18(int? i)
+    public int Ex18(int? i) // $ Source[cs/dereferenced-value-may-be-null]
     {
-        return (int)i; // BAD (maybe)
+        return (int)i; // $ Alert[cs/dereferenced-value-may-be-null]
     }
 
     public int Ex19(int? i)
@@ -280,9 +280,9 @@ public class E
     {
         if (b)
             b.ToString();
-        var o = Make();
+        var o = Make(); // $ Source[cs/dereferenced-value-may-be-null]
         o?.ToString();
-        o.ToString(); // BAD (maybe)
+        o.ToString(); // $ Alert[cs/dereferenced-value-may-be-null]
         if (b)
             b.ToString();
     }
@@ -298,8 +298,8 @@ public class E
 
     public void Ex25(object o)
     {
-        var s = o as string;
+        var s = o as string; // $ Source[cs/dereferenced-value-may-be-null]
-        s.ToString(); // BAD (maybe)
+        s.ToString(); // $ Alert[cs/dereferenced-value-may-be-null]
     }
 
     private long? l;
@@ -320,15 +320,15 @@ public class E
     {
         if ((s1 ?? s2) is null)
         {
-            s1.ToString(); // BAD (always)
+            s1.ToString(); // $ Alert[cs/dereferenced-value-is-always-null]
-            s2.ToString(); // BAD (always)
+            s2.ToString(); // $ Alert[cs/dereferenced-value-is-always-null]
         }
     }
 
     static void Ex28()
     {
         var x = (string)null ?? null;
-        x.ToString(); // BAD (always)
+        x.ToString(); // $ Alert[cs/dereferenced-value-is-always-null]
     }
 
     static void Ex29(string s)
@@ -339,14 +339,14 @@ public class E
 
     static void Ex30(string s, object o)
     {
-        var x = s ?? o as string;
+        var x = s ?? o as string; // $ Source[cs/dereferenced-value-may-be-null]
-        x.ToString(); // BAD (maybe)
+        x.ToString(); // $ Alert[cs/dereferenced-value-may-be-null]
     }
 
     static void Ex31(string s, object o)
     {
-        dynamic x = s ?? o as string;
+        dynamic x = s ?? o as string; // $ Source[cs/dereferenced-value-may-be-null]
-        x.ToString(); // BAD (maybe)
+        x.ToString(); // $ Alert[cs/dereferenced-value-may-be-null]
     }
 
     static void Ex32(string s, object o)
@@ -363,7 +363,7 @@ public class E
             x.ToString(); // GOOD
     }
 
-    static int Ex34(string s = null) => s.Length; // BAD (maybe)
+    static int Ex34(string s = null) => s.Length; // $ Alert[cs/dereferenced-value-may-be-null]
 
     static int Ex35(string s = "null") => s.Length; // GOOD
 
@@ -371,19 +371,19 @@ public class E
     {
         if (o is string)
         {
-            var s = o as string;
+            var s = o as string; // $ Source[cs/dereferenced-value-may-be-null]
-            return s.Length; // GOOD (FALSE POSITIVE)
+            return s.Length; // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
         }
         return -1;
     }
 
-    static bool Ex37(E e1, E e2)
+    static bool Ex37(E e1, E e2) // $ Source[cs/dereferenced-value-may-be-null]
     {
         if ((e1 == null && e2 != null) || (e1 != null && e2 == null))
             return false;
         if (e1 == null && e2 == null)
             return true;
-        return e1.Long == e2.Long; // GOOD (FALSE POSITIVE)
+        return e1.Long == e2.Long; // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
     }
 
     int Ex38(int? i)
@@ -402,7 +402,7 @@ public class E
     {
         int? i = null;
         i ??= null;
-        return i.Value; // BAD (always)
+        return i.Value; // $ Alert[cs/dereferenced-value-is-always-null]
     }
 
     int Ex41()
@@ -414,20 +414,20 @@ public class E
 
     static bool Ex42(int? i, IEnumerable<int> @is)
     {
-        return @is.Any(j => j == i.Value); // BAD (maybe)
+        return @is.Any(j => j == i.Value); // $ Alert[cs/dereferenced-value-may-be-null]
     }
 
     static bool Ex43(int? i, IEnumerable<int> @is)
     {
         if (i.HasValue)
-            return @is.Any(j => j == i.Value); // GOOD (FALSE POSITIVE)
+            return @is.Any(j => j == i.Value); // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
         return false;
     }
 
     static bool Ex44(int? i, IEnumerable<int> @is)
     {
         if (i.HasValue)
-            @is = @is.Where(j => j == i.Value); // BAD (always)
+            @is = @is.Where(j => j == i.Value); // $ Alert[cs/dereferenced-value-may-be-null]
         i = null;
         return @is.Any();
     }
@@ -436,12 +436,12 @@ public class E
     {
         if (s is null)
         {
-            s.ToString(); // BAD (always)
+            s.ToString(); // $ Alert[cs/dereferenced-value-is-always-null]
         }
 
         if (s is not not null)
         {
-            s.ToString(); // BAD (always) (FALSE NEGATIVE)
+            s.ToString(); // $ MISSING: Alert[cs/dereferenced-value-is-always-null]
         }
 
         if (s is not null)

csharp/ql/test/query-tests/Nullness/F.cs

@@ -0,0 +1,16 @@
+using Library;
+
+public class F
+{
+    public void M1()
+    {
+        object o = null;
+        o.Accept(); // $ Alert[cs/dereferenced-value-is-always-null]
+    }
+
+    public void M2()
+    {
+        object? o = null;
+        o.AcceptNullable();
+    }
+}

csharp/ql/test/query-tests/Nullness/Forwarding.cs

@@ -33,11 +33,11 @@ class ForwardingTests
 
         if (IsNotNullWrong(s))
         {
-            Console.WriteLine(s.Length); // BAD (always)
+            Console.WriteLine(s.Length); // $ Alert[cs/dereferenced-value-is-always-null]
         }
 
         AssertIsNotNull(s);
-        Console.WriteLine(s.Length); // GOOD (false positive)
+        Console.WriteLine(s.Length); // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-is-always-null]
     }
 
     bool IsNotNull(object o)

csharp/ql/test/query-tests/Nullness/GuardedString.cs

@@ -4,7 +4,7 @@ class GuardedStringTest
 {
     void Fn(bool b)
     {
-        string s = b ? null : "";
+        string s = b ? null : ""; // $ Source[cs/dereferenced-value-may-be-null]
 
         if (!string.IsNullOrEmpty(s))
         {
@@ -32,7 +32,7 @@ class GuardedStringTest
             Console.WriteLine(s.Length); // GOOD
 
         if (s?.Length != 0)
-            Console.WriteLine(s.Length); // BAD (maybe)
+            Console.WriteLine(s.Length); // $ Alert[cs/dereferenced-value-may-be-null]
         else
             Console.WriteLine(s.Length); // GOOD
     }

csharp/ql/test/query-tests/Nullness/Implications.expected

@@ -1305,6 +1305,10 @@
 | E.cs:442:13:442:29 | ... is ... | true | E.cs:442:13:442:13 | access to parameter s | non-null |
 | E.cs:447:13:447:25 | ... is ... | true | E.cs:447:13:447:13 | access to parameter s | non-null |
 | E.cs:452:13:452:23 | ... is ... | true | E.cs:452:13:452:13 | access to parameter s | non-null |
+| F.cs:8:9:8:9 | access to local variable o | non-null | F.cs:7:20:7:23 | null | non-null |
+| F.cs:8:9:8:9 | access to local variable o | null | F.cs:7:20:7:23 | null | null |
+| F.cs:14:9:14:9 | access to local variable o | non-null | F.cs:13:21:13:24 | null | non-null |
+| F.cs:14:9:14:9 | access to local variable o | null | F.cs:13:21:13:24 | null | null |
 | Forwarding.cs:9:13:9:30 | !... | false | Forwarding.cs:9:14:9:30 | call to method IsNullOrEmpty | true |
 | Forwarding.cs:9:13:9:30 | !... | true | Forwarding.cs:9:14:9:30 | call to method IsNullOrEmpty | false |
 | Forwarding.cs:9:14:9:14 | access to local variable s | empty | Forwarding.cs:7:20:7:23 | null | empty |

csharp/ql/test/query-tests/Nullness/NullAlways.expected

@@ -38,6 +38,7 @@
 | E.cs:331:9:331:9 | access to local variable x | Variable $@ is always null at this dereference. | E.cs:330:13:330:13 | x | x |
 | E.cs:405:16:405:16 | access to local variable i | Variable $@ is always null at this dereference. | E.cs:403:14:403:14 | i | i |
 | E.cs:439:13:439:13 | access to parameter s | Variable $@ is always null at this dereference. | E.cs:435:29:435:29 | s | s |
+| F.cs:8:9:8:9 | access to local variable o | Variable $@ is always null at this dereference. | F.cs:7:16:7:16 | o | o |
 | Forwarding.cs:36:31:36:31 | access to local variable s | Variable $@ is always null at this dereference. | Forwarding.cs:7:16:7:16 | s | s |
 | Forwarding.cs:40:27:40:27 | access to local variable s | Variable $@ is always null at this dereference. | Forwarding.cs:7:16:7:16 | s | s |
 | NullAlwaysBad.cs:9:30:9:30 | access to parameter s | Variable $@ is always null at this dereference. | NullAlwaysBad.cs:7:29:7:29 | s | s |

csharp/ql/test/query-tests/Nullness/NullAlways.qlref

@@ -1 +1,2 @@
-CSI/NullAlways.ql
+query: CSI/NullAlways.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

csharp/ql/test/query-tests/Nullness/NullAlwaysBad.cs

@@ -6,7 +6,7 @@ namespace NullAlways
     {
         void DoPrint(string s)
         {
-            if (s != null || s.Length > 0)
+            if (s != null || s.Length > 0) // $ Alert[cs/dereferenced-value-is-always-null]
                 Console.WriteLine(s);
         }
     }

csharp/ql/test/query-tests/Nullness/NullMaybe.expected

@@ -1,3 +1,483 @@
+#select
+| C.cs:64:9:64:10 | access to local variable o1 | C.cs:62:13:62:46 | SSA def(o1) | C.cs:64:9:64:10 | access to local variable o1 | Variable $@ may be null at this access because of $@ assignment. | C.cs:62:13:62:14 | o1 | o1 | C.cs:62:13:62:46 | Object o1 = ... | this |
+| C.cs:68:9:68:10 | access to local variable o2 | C.cs:66:13:66:46 | SSA def(o2) | C.cs:68:9:68:10 | access to local variable o2 | Variable $@ may be null at this access because of $@ assignment. | C.cs:66:13:66:14 | o2 | o2 | C.cs:66:13:66:46 | Object o2 = ... | this |
+| C.cs:95:15:95:15 | access to local variable o | C.cs:94:13:94:45 | SSA def(o) | C.cs:95:15:95:15 | access to local variable o | Variable $@ may be null at this access because of $@ assignment. | C.cs:94:13:94:13 | o | o | C.cs:94:13:94:45 | Object o = ... | this |
+| C.cs:103:27:103:30 | access to parameter list | C.cs:102:13:102:23 | SSA def(list) | C.cs:103:27:103:30 | access to parameter list | Variable $@ may be null at this access because of $@ assignment. | C.cs:99:42:99:45 | list | list | C.cs:102:13:102:23 | ... = ... | this |
+| C.cs:177:13:177:13 | access to local variable s | C.cs:178:13:178:20 | SSA def(s) | C.cs:177:13:177:13 | access to local variable s | Variable $@ may be null at this access because of $@ assignment. | C.cs:151:13:151:13 | s | s | C.cs:178:13:178:20 | ... = ... | this |
+| C.cs:203:13:203:13 | access to local variable s | C.cs:204:13:204:20 | SSA def(s) | C.cs:203:13:203:13 | access to local variable s | Variable $@ may be null at this access because of $@ assignment. | C.cs:185:13:185:13 | s | s | C.cs:204:13:204:20 | ... = ... | this |
+| C.cs:223:9:223:9 | access to local variable s | C.cs:222:13:222:20 | SSA def(s) | C.cs:223:9:223:9 | access to local variable s | Variable $@ may be null at this access because of $@ assignment. | C.cs:210:13:210:13 | s | s | C.cs:222:13:222:20 | ... = ... | this |
+| C.cs:242:13:242:13 | access to local variable s | C.cs:240:24:240:31 | SSA def(s) | C.cs:242:13:242:13 | access to local variable s | Variable $@ may be null at this access because of $@ assignment. | C.cs:228:16:228:16 | s | s | C.cs:240:24:240:31 | ... = ... | this |
+| D.cs:23:9:23:13 | access to parameter param | D.cs:17:17:17:20 | null | D.cs:23:9:23:13 | access to parameter param | Variable $@ may be null at this access because of $@ null argument. | D.cs:21:32:21:36 | param | param | D.cs:17:17:17:20 | null | this |
+| D.cs:32:9:32:13 | access to parameter param | D.cs:26:32:26:36 | SSA param(param) | D.cs:32:9:32:13 | access to parameter param | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:26:32:26:36 | param | param | D.cs:28:13:28:25 | ... != ... | this |
+| D.cs:62:13:62:14 | access to local variable o5 | D.cs:58:13:58:41 | SSA def(o5) | D.cs:62:13:62:14 | access to local variable o5 | Variable $@ may be null at this access because of $@ assignment. | D.cs:58:13:58:14 | o5 | o5 | D.cs:58:13:58:41 | String o5 = ... | this |
+| D.cs:73:13:73:14 | access to local variable o7 | D.cs:68:13:68:34 | SSA def(o7) | D.cs:73:13:73:14 | access to local variable o7 | Variable $@ may be null at this access because of $@ assignment. | D.cs:68:13:68:14 | o7 | o7 | D.cs:68:13:68:34 | String o7 = ... | this |
+| D.cs:82:13:82:14 | access to local variable o8 | D.cs:75:13:75:34 | SSA def(o8) | D.cs:82:13:82:14 | access to local variable o8 | Variable $@ may be null at this access because of $@ assignment. | D.cs:75:13:75:14 | o8 | o8 | D.cs:75:13:75:34 | String o8 = ... | this |
+| D.cs:84:13:84:14 | access to local variable o8 | D.cs:75:13:75:34 | SSA def(o8) | D.cs:84:13:84:14 | access to local variable o8 | Variable $@ may be null at this access because of $@ assignment. | D.cs:75:13:75:14 | o8 | o8 | D.cs:75:13:75:34 | String o8 = ... | this |
+| D.cs:91:13:91:14 | access to local variable xs | D.cs:89:15:89:44 | SSA def(xs) | D.cs:91:13:91:14 | access to local variable xs | Variable $@ may be null at this access because of $@ assignment. | D.cs:89:15:89:16 | xs | xs | D.cs:89:15:89:44 | Int32[] xs = ... | this |
+| D.cs:94:21:94:22 | access to local variable xs | D.cs:89:15:89:44 | SSA def(xs) | D.cs:94:21:94:22 | access to local variable xs | Variable $@ may be null at this access because of $@ assignment. | D.cs:89:15:89:16 | xs | xs | D.cs:89:15:89:44 | Int32[] xs = ... | this |
+| D.cs:98:21:98:22 | access to local variable xs | D.cs:89:15:89:44 | SSA def(xs) | D.cs:98:21:98:22 | access to local variable xs | Variable $@ may be null at this access because of $@ assignment. | D.cs:89:15:89:16 | xs | xs | D.cs:89:15:89:44 | Int32[] xs = ... | this |
+| D.cs:102:31:102:32 | access to local variable xs | D.cs:89:15:89:44 | SSA def(xs) | D.cs:102:31:102:32 | access to local variable xs | Variable $@ may be null at this access because of $@ assignment. | D.cs:89:15:89:16 | xs | xs | D.cs:89:15:89:44 | Int32[] xs = ... | this |
+| D.cs:105:19:105:20 | access to local variable xs | D.cs:89:15:89:44 | SSA def(xs) | D.cs:105:19:105:20 | access to local variable xs | Variable $@ may be null at this access because of $@ assignment. | D.cs:89:15:89:16 | xs | xs | D.cs:89:15:89:44 | Int32[] xs = ... | this |
+| D.cs:134:24:134:24 | access to parameter a | D.cs:125:35:125:35 | SSA param(a) | D.cs:134:24:134:24 | access to parameter a | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:125:35:125:35 | a | a | D.cs:127:20:127:28 | ... == ... | this |
+| D.cs:134:24:134:24 | access to parameter a | D.cs:125:35:125:35 | SSA param(a) | D.cs:134:24:134:24 | access to parameter a | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:125:35:125:35 | a | a | D.cs:139:13:139:21 | ... != ... | this |
+| D.cs:135:24:135:24 | access to parameter b | D.cs:125:44:125:44 | SSA param(b) | D.cs:135:24:135:24 | access to parameter b | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:125:44:125:44 | b | b | D.cs:128:20:128:28 | ... == ... | this |
+| D.cs:145:20:145:20 | access to parameter a | D.cs:125:35:125:35 | SSA param(a) | D.cs:145:20:145:20 | access to parameter a | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:125:35:125:35 | a | a | D.cs:127:20:127:28 | ... == ... | this |
+| D.cs:145:20:145:20 | access to parameter a | D.cs:125:35:125:35 | SSA param(a) | D.cs:145:20:145:20 | access to parameter a | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:125:35:125:35 | a | a | D.cs:139:13:139:21 | ... != ... | this |
+| D.cs:151:9:151:11 | access to parameter obj | D.cs:149:36:149:38 | SSA param(obj) | D.cs:151:9:151:11 | access to parameter obj | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:149:36:149:38 | obj | obj | D.cs:152:17:152:27 | ... != ... | this |
+| D.cs:171:9:171:11 | access to local variable obj | D.cs:163:16:163:25 | SSA def(obj) | D.cs:171:9:171:11 | access to local variable obj | Variable $@ may be null at this access because of $@ assignment. | D.cs:163:16:163:18 | obj | obj | D.cs:163:16:163:25 | Object obj = ... | this |
+| D.cs:245:13:245:13 | access to local variable o | D.cs:240:9:240:16 | SSA def(o) | D.cs:245:13:245:13 | access to local variable o | Variable $@ may be null at this access because of $@ assignment. | D.cs:228:16:228:16 | o | o | D.cs:240:9:240:16 | ... = ... | this |
+| D.cs:247:13:247:13 | access to local variable o | D.cs:240:9:240:16 | SSA def(o) | D.cs:247:13:247:13 | access to local variable o | Variable $@ may be null at this access because of $@ assignment. | D.cs:228:16:228:16 | o | o | D.cs:240:9:240:16 | ... = ... | this |
+| D.cs:253:13:253:14 | access to local variable o2 | D.cs:249:13:249:38 | SSA def(o2) | D.cs:253:13:253:14 | access to local variable o2 | Variable $@ may be null at this access because of $@ assignment. | D.cs:249:13:249:14 | o2 | o2 | D.cs:249:13:249:38 | String o2 = ... | this |
+| D.cs:267:13:267:13 | access to local variable o | D.cs:258:16:258:23 | SSA def(o) | D.cs:267:13:267:13 | access to local variable o | Variable $@ may be null at this access because of $@ assignment. | D.cs:258:16:258:16 | o | o | D.cs:258:16:258:23 | Object o = ... | this |
+| D.cs:291:13:291:13 | access to local variable o | D.cs:269:9:269:16 | SSA def(o) | D.cs:291:13:291:13 | access to local variable o | Variable $@ may be null at this access because of $@ assignment. | D.cs:258:16:258:16 | o | o | D.cs:269:9:269:16 | ... = ... | this |
+| D.cs:291:13:291:13 | access to local variable o | D.cs:283:17:283:24 | SSA def(o) | D.cs:291:13:291:13 | access to local variable o | Variable $@ may be null at this access because of $@ assignment. | D.cs:258:16:258:16 | o | o | D.cs:283:17:283:24 | ... = ... | this |
+| D.cs:294:13:294:13 | access to local variable o | D.cs:269:9:269:16 | SSA def(o) | D.cs:294:13:294:13 | access to local variable o | Variable $@ may be null at this access because of $@ assignment. | D.cs:258:16:258:16 | o | o | D.cs:269:9:269:16 | ... = ... | this |
+| D.cs:294:13:294:13 | access to local variable o | D.cs:283:17:283:24 | SSA def(o) | D.cs:294:13:294:13 | access to local variable o | Variable $@ may be null at this access because of $@ assignment. | D.cs:258:16:258:16 | o | o | D.cs:283:17:283:24 | ... = ... | this |
+| D.cs:300:17:300:20 | access to local variable prev | D.cs:296:16:296:26 | SSA def(prev) | D.cs:300:17:300:20 | access to local variable prev | Variable $@ may be null at this access because of $@ assignment. | D.cs:296:16:296:19 | prev | prev | D.cs:296:16:296:26 | Object prev = ... | this |
+| D.cs:313:17:313:17 | access to local variable s | D.cs:304:16:304:23 | SSA def(s) | D.cs:313:17:313:17 | access to local variable s | Variable $@ may be null at this access because of $@ assignment. | D.cs:304:16:304:16 | s | s | D.cs:304:16:304:23 | String s = ... | this |
+| D.cs:324:9:324:9 | access to local variable r | D.cs:316:16:316:23 | SSA def(r) | D.cs:324:9:324:9 | access to local variable r | Variable $@ may be null at this access because of $@ assignment. | D.cs:316:16:316:16 | r | r | D.cs:316:16:316:23 | Object r = ... | this |
+| D.cs:356:13:356:13 | access to local variable a | D.cs:351:15:351:22 | SSA def(a) | D.cs:356:13:356:13 | access to local variable a | Variable $@ may be null at this access because of $@ assignment. | D.cs:351:15:351:15 | a | a | D.cs:351:15:351:22 | Int32[] a = ... | this |
+| D.cs:363:13:363:16 | access to local variable last | D.cs:360:20:360:30 | SSA def(last) | D.cs:363:13:363:16 | access to local variable last | Variable $@ may be null at this access because of $@ assignment. | D.cs:360:20:360:23 | last | last | D.cs:360:20:360:30 | String last = ... | this |
+| D.cs:372:13:372:13 | access to local variable b | D.cs:366:15:366:47 | SSA def(b) | D.cs:372:13:372:13 | access to local variable b | Variable $@ may be null at this access because of $@ assignment. | D.cs:366:15:366:15 | b | b | D.cs:366:15:366:47 | Int32[] b = ... | this |
+| D.cs:395:20:395:20 | access to parameter a | D.cs:388:36:388:36 | SSA param(a) | D.cs:395:20:395:20 | access to parameter a | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:388:36:388:36 | a | a | D.cs:390:20:390:28 | ... == ... | this |
+| D.cs:400:20:400:20 | access to parameter b | D.cs:388:45:388:45 | SSA param(b) | D.cs:400:20:400:20 | access to parameter b | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:388:45:388:45 | b | b | D.cs:397:20:397:28 | ... == ... | this |
+| D.cs:410:13:410:13 | access to parameter y | D.cs:405:45:405:45 | SSA param(y) | D.cs:410:13:410:13 | access to parameter y | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:405:45:405:45 | y | y | D.cs:407:27:407:35 | ... == ... | this |
+| D.cs:410:13:410:13 | access to parameter y | D.cs:405:45:405:45 | SSA param(y) | D.cs:410:13:410:13 | access to parameter y | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:405:45:405:45 | y | y | D.cs:407:55:407:63 | ... != ... | this |
+| D.cs:410:13:410:13 | access to parameter y | D.cs:405:45:405:45 | SSA param(y) | D.cs:410:13:410:13 | access to parameter y | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:405:45:405:45 | y | y | D.cs:411:13:411:21 | ... != ... | this |
+| D.cs:412:13:412:13 | access to parameter x | D.cs:405:35:405:35 | SSA param(x) | D.cs:412:13:412:13 | access to parameter x | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:405:35:405:35 | x | x | D.cs:407:14:407:22 | ... != ... | this |
+| D.cs:412:13:412:13 | access to parameter x | D.cs:405:35:405:35 | SSA param(x) | D.cs:412:13:412:13 | access to parameter x | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:405:35:405:35 | x | x | D.cs:407:42:407:50 | ... == ... | this |
+| D.cs:412:13:412:13 | access to parameter x | D.cs:405:35:405:35 | SSA param(x) | D.cs:412:13:412:13 | access to parameter x | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:405:35:405:35 | x | x | D.cs:409:13:409:21 | ... != ... | this |
+| E.cs:12:38:12:39 | access to local variable a2 | E.cs:9:18:9:26 | SSA def(a2) | E.cs:12:38:12:39 | access to local variable a2 | Variable $@ may be null at this access because of $@ assignment. | E.cs:9:18:9:19 | a2 | a2 | E.cs:9:18:9:26 | Int64[][] a2 = ... | this |
+| E.cs:14:13:14:14 | access to local variable a3 | E.cs:11:16:11:24 | SSA def(a3) | E.cs:14:13:14:14 | access to local variable a3 | Variable $@ may be null at this access because of $@ assignment. | E.cs:11:16:11:17 | a3 | a3 | E.cs:11:16:11:24 | Int64[] a3 = ... | this |
+| E.cs:27:13:27:14 | access to local variable s1 | E.cs:23:13:23:30 | SSA def(s1) | E.cs:27:13:27:14 | access to local variable s1 | Variable $@ may be null at this access because of $@ assignment. | E.cs:19:13:19:14 | s1 | s1 | E.cs:23:13:23:30 | ... = ... | this |
+| E.cs:61:13:61:17 | access to local variable slice | E.cs:51:22:51:33 | SSA def(slice) | E.cs:61:13:61:17 | access to local variable slice | Variable $@ may be null at this access because of $@ assignment. | E.cs:51:22:51:26 | slice | slice | E.cs:51:22:51:33 | List<String> slice = ... | this |
+| E.cs:73:13:73:15 | access to parameter arr | E.cs:66:40:66:42 | SSA param(arr) | E.cs:73:13:73:15 | access to parameter arr | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:66:40:66:42 | arr | arr | E.cs:70:22:70:32 | ... == ... | this |
+| E.cs:112:13:112:16 | access to local variable arr2 | E.cs:107:15:107:25 | SSA def(arr2) | E.cs:112:13:112:16 | access to local variable arr2 | Variable $@ may be null at this access because of $@ assignment. | E.cs:107:15:107:18 | arr2 | arr2 | E.cs:107:15:107:25 | Int32[] arr2 = ... | this |
+| E.cs:125:33:125:35 | access to local variable obj | E.cs:137:25:137:34 | SSA def(obj) | E.cs:125:33:125:35 | access to local variable obj | Variable $@ may be null at this access because of $@ assignment. | E.cs:119:13:119:15 | obj | obj | E.cs:137:25:137:34 | ... = ... | this |
+| E.cs:159:13:159:16 | access to local variable obj2 | E.cs:152:16:152:26 | SSA def(obj2) | E.cs:159:13:159:16 | access to local variable obj2 | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:152:16:152:19 | obj2 | obj2 | E.cs:153:13:153:24 | ... != ... | this |
+| E.cs:167:21:167:21 | access to parameter a | E.cs:162:28:162:28 | SSA param(a) | E.cs:167:21:167:21 | access to parameter a | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:162:28:162:28 | a | a | E.cs:164:17:164:25 | ... == ... | this |
+| E.cs:178:13:178:15 | access to parameter obj | E.cs:173:29:173:31 | SSA param(obj) | E.cs:178:13:178:15 | access to parameter obj | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:173:29:173:31 | obj | obj | E.cs:175:19:175:29 | ... == ... | this |
+| E.cs:178:13:178:15 | access to parameter obj | E.cs:173:29:173:31 | SSA param(obj) | E.cs:178:13:178:15 | access to parameter obj | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:173:29:173:31 | obj | obj | E.cs:180:13:180:23 | ... == ... | this |
+| E.cs:186:13:186:15 | access to parameter obj | E.cs:173:29:173:31 | SSA param(obj) | E.cs:186:13:186:15 | access to parameter obj | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:173:29:173:31 | obj | obj | E.cs:175:19:175:29 | ... == ... | this |
+| E.cs:186:13:186:15 | access to parameter obj | E.cs:173:29:173:31 | SSA param(obj) | E.cs:186:13:186:15 | access to parameter obj | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:173:29:173:31 | obj | obj | E.cs:180:13:180:23 | ... == ... | this |
+| E.cs:192:17:192:17 | access to parameter o | E.cs:190:29:190:29 | SSA param(o) | E.cs:192:17:192:17 | access to parameter o | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:190:29:190:29 | o | o | E.cs:193:17:193:17 | access to parameter o | this |
+| E.cs:201:13:201:13 | access to local variable o | E.cs:198:13:198:29 | [b (line 196): true] SSA def(o) | E.cs:201:13:201:13 | access to local variable o | Variable $@ may be null at this access because of $@ assignment. | E.cs:198:13:198:13 | o | o | E.cs:198:13:198:29 | String o = ... | this |
+| E.cs:203:13:203:13 | access to local variable o | E.cs:198:13:198:29 | [b (line 196): false] SSA def(o) | E.cs:203:13:203:13 | access to local variable o | Variable $@ may be null at this access because of $@ assignment. | E.cs:198:13:198:13 | o | o | E.cs:198:13:198:29 | String o = ... | this |
+| E.cs:218:9:218:9 | access to local variable x | E.cs:217:13:217:20 | [b (line 213): true] SSA def(x) | E.cs:218:9:218:9 | access to local variable x | Variable $@ may be null at this access because of $@ assignment. | E.cs:215:13:215:13 | x | x | E.cs:217:13:217:20 | ... = ... | this |
+| E.cs:230:9:230:9 | access to local variable x | E.cs:227:13:227:20 | [b (line 223): true] SSA def(x) | E.cs:230:9:230:9 | access to local variable x | Variable $@ may be null at this access because of $@ assignment. | E.cs:225:13:225:13 | x | x | E.cs:227:13:227:20 | ... = ... | this |
+| E.cs:235:16:235:16 | access to parameter i | E.cs:233:26:233:26 | SSA param(i) | E.cs:235:16:235:16 | access to parameter i | Variable $@ may be null at this access because it has a nullable type. | E.cs:233:26:233:26 | i | i | E.cs:233:26:233:26 | i | this |
+| E.cs:240:21:240:21 | access to parameter i | E.cs:238:26:238:26 | SSA param(i) | E.cs:240:21:240:21 | access to parameter i | Variable $@ may be null at this access because it has a nullable type. | E.cs:238:26:238:26 | i | i | E.cs:238:26:238:26 | i | this |
+| E.cs:285:9:285:9 | access to local variable o | E.cs:283:13:283:22 | [b (line 279): false] SSA def(o) | E.cs:285:9:285:9 | access to local variable o | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:283:13:283:13 | o | o | E.cs:284:9:284:9 | access to local variable o | this |
+| E.cs:285:9:285:9 | access to local variable o | E.cs:283:13:283:22 | [b (line 279): true] SSA def(o) | E.cs:285:9:285:9 | access to local variable o | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:283:13:283:13 | o | o | E.cs:284:9:284:9 | access to local variable o | this |
+| E.cs:302:9:302:9 | access to local variable s | E.cs:301:13:301:27 | SSA def(s) | E.cs:302:9:302:9 | access to local variable s | Variable $@ may be null at this access because of $@ assignment. | E.cs:301:13:301:13 | s | s | E.cs:301:13:301:27 | String s = ... | this |
+| E.cs:343:9:343:9 | access to local variable x | E.cs:342:13:342:32 | SSA def(x) | E.cs:343:9:343:9 | access to local variable x | Variable $@ may be null at this access because of $@ assignment. | E.cs:342:13:342:13 | x | x | E.cs:342:13:342:32 | String x = ... | this |
+| E.cs:349:9:349:9 | access to local variable x | E.cs:348:17:348:36 | SSA def(x) | E.cs:349:9:349:9 | access to local variable x | Variable $@ may be null at this access because of $@ assignment. | E.cs:348:17:348:17 | x | x | E.cs:348:17:348:36 | dynamic x = ... | this |
+| E.cs:366:41:366:41 | access to parameter s | E.cs:366:28:366:28 | SSA param(s) | E.cs:366:41:366:41 | access to parameter s | Variable $@ may be null at this access because the parameter has a null default value. | E.cs:366:28:366:28 | s | s | E.cs:366:32:366:35 | null | this |
+| E.cs:375:20:375:20 | access to local variable s | E.cs:374:17:374:31 | SSA def(s) | E.cs:375:20:375:20 | access to local variable s | Variable $@ may be null at this access because of $@ assignment. | E.cs:374:17:374:17 | s | s | E.cs:374:17:374:31 | String s = ... | this |
+| E.cs:386:16:386:17 | access to parameter e1 | E.cs:380:24:380:25 | SSA param(e1) | E.cs:386:16:386:17 | access to parameter e1 | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:380:24:380:25 | e1 | e1 | E.cs:382:14:382:23 | ... == ... | this |
+| E.cs:386:16:386:17 | access to parameter e1 | E.cs:380:24:380:25 | SSA param(e1) | E.cs:386:16:386:17 | access to parameter e1 | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:380:24:380:25 | e1 | e1 | E.cs:382:44:382:53 | ... != ... | this |
+| E.cs:386:16:386:17 | access to parameter e1 | E.cs:380:24:380:25 | SSA param(e1) | E.cs:386:16:386:17 | access to parameter e1 | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:380:24:380:25 | e1 | e1 | E.cs:384:13:384:22 | ... == ... | this |
+| E.cs:386:27:386:28 | access to parameter e2 | E.cs:380:30:380:31 | SSA param(e2) | E.cs:386:27:386:28 | access to parameter e2 | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:380:30:380:31 | e2 | e2 | E.cs:382:28:382:37 | ... != ... | this |
+| E.cs:386:27:386:28 | access to parameter e2 | E.cs:380:30:380:31 | SSA param(e2) | E.cs:386:27:386:28 | access to parameter e2 | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:380:30:380:31 | e2 | e2 | E.cs:382:58:382:67 | ... == ... | this |
+| E.cs:386:27:386:28 | access to parameter e2 | E.cs:380:30:380:31 | SSA param(e2) | E.cs:386:27:386:28 | access to parameter e2 | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:380:30:380:31 | e2 | e2 | E.cs:384:27:384:36 | ... == ... | this |
+| E.cs:417:34:417:34 | access to parameter i | E.cs:417:24:417:40 | SSA capture def(i) | E.cs:417:34:417:34 | access to parameter i | Variable $@ may be null at this access because it has a nullable type. | E.cs:415:27:415:27 | i | i | E.cs:415:27:415:27 | i | this |
+| E.cs:423:38:423:38 | access to parameter i | E.cs:423:28:423:44 | SSA capture def(i) | E.cs:423:38:423:38 | access to parameter i | Variable $@ may be null at this access because it has a nullable type. | E.cs:420:27:420:27 | i | i | E.cs:420:27:420:27 | i | this |
+| E.cs:430:39:430:39 | access to parameter i | E.cs:430:29:430:45 | SSA capture def(i) | E.cs:430:39:430:39 | access to parameter i | Variable $@ may be null at this access because it has a nullable type. | E.cs:427:27:427:27 | i | i | E.cs:427:27:427:27 | i | this |
+| GuardedString.cs:35:31:35:31 | access to local variable s | GuardedString.cs:7:16:7:32 | SSA def(s) | GuardedString.cs:35:31:35:31 | access to local variable s | Variable $@ may be null at this access because of $@ assignment. | GuardedString.cs:7:16:7:16 | s | s | GuardedString.cs:7:16:7:32 | String s = ... | this |
+| NullMaybeBad.cs:7:27:7:27 | access to parameter o | NullMaybeBad.cs:13:17:13:20 | null | NullMaybeBad.cs:7:27:7:27 | access to parameter o | Variable $@ may be null at this access because of $@ null argument. | NullMaybeBad.cs:5:25:5:25 | o | o | NullMaybeBad.cs:13:17:13:20 | null | this |
+| Params.cs:14:17:14:20 | access to parameter args | Params.cs:20:12:20:15 | null | Params.cs:14:17:14:20 | access to parameter args | Variable $@ may be null at this access because of $@ null argument. | Params.cs:12:36:12:39 | args | args | Params.cs:20:12:20:15 | null | this |
+| StringConcatenation.cs:16:17:16:17 | access to local variable s | StringConcatenation.cs:14:16:14:23 | SSA def(s) | StringConcatenation.cs:16:17:16:17 | access to local variable s | Variable $@ may be null at this access because of $@ assignment. | StringConcatenation.cs:14:16:14:16 | s | s | StringConcatenation.cs:14:16:14:23 | String s = ... | this |
+edges
+| A.cs:7:16:7:40 | SSA def(synchronizedAlways) | A.cs:8:15:8:32 | access to local variable synchronizedAlways |
+| A.cs:7:16:7:40 | SSA def(synchronizedAlways) | A.cs:10:13:10:30 | access to local variable synchronizedAlways |
+| A.cs:16:15:16:30 | SSA def(arrayNull) | A.cs:17:9:17:17 | access to local variable arrayNull |
+| A.cs:26:15:26:32 | SSA def(arrayAccess) | A.cs:31:27:31:37 | access to local variable arrayAccess |
+| A.cs:26:15:26:32 | SSA def(arrayAccess) | A.cs:36:27:36:37 | access to local variable arrayAccess |
+| A.cs:27:18:27:35 | SSA def(fieldAccess) | A.cs:32:27:32:37 | access to local variable fieldAccess |
+| A.cs:27:18:27:35 | SSA def(fieldAccess) | A.cs:37:27:37:37 | access to local variable fieldAccess |
+| A.cs:28:16:28:34 | SSA def(methodAccess) | A.cs:33:28:33:39 | access to local variable methodAccess |
+| A.cs:28:16:28:34 | SSA def(methodAccess) | A.cs:38:15:38:26 | access to local variable methodAccess |
+| A.cs:29:16:29:32 | SSA def(methodCall) | A.cs:34:27:34:36 | access to local variable methodCall |
+| A.cs:29:16:29:32 | SSA def(methodCall) | A.cs:39:27:39:36 | access to local variable methodCall |
+| A.cs:48:16:48:28 | SSA def(varRef) | A.cs:50:9:50:14 | access to local variable varRef |
+| Assert.cs:13:9:13:25 | [b (line 7): false] SSA def(s) | Assert.cs:15:27:15:27 | access to local variable s |
+| Assert.cs:13:9:13:25 | [b (line 7): true] SSA def(s) | Assert.cs:15:27:15:27 | access to local variable s |
+| Assert.cs:21:9:21:25 | [b (line 7): false] SSA def(s) | Assert.cs:23:27:23:27 | access to local variable s |
+| Assert.cs:21:9:21:25 | [b (line 7): true] SSA def(s) | Assert.cs:23:27:23:27 | access to local variable s |
+| Assert.cs:29:9:29:25 | [b (line 7): false] SSA def(s) | Assert.cs:31:27:31:27 | access to local variable s |
+| Assert.cs:29:9:29:25 | [b (line 7): true] SSA def(s) | Assert.cs:31:27:31:27 | access to local variable s |
+| Assert.cs:45:9:45:25 | [b (line 7): true] SSA def(s) | Assert.cs:46:36:46:36 | [b (line 7): true] access to parameter b |
+| Assert.cs:46:23:46:36 | [true, b (line 7): true] ... && ... | Assert.cs:47:27:47:27 | access to local variable s |
+| Assert.cs:46:36:46:36 | [b (line 7): true] access to parameter b | Assert.cs:46:23:46:36 | [true, b (line 7): true] ... && ... |
+| Assert.cs:49:9:49:25 | [b (line 7): true] SSA def(s) | Assert.cs:50:38:50:38 | [b (line 7): true] access to parameter b |
+| Assert.cs:50:24:50:38 | [false] ... \|\| ... | Assert.cs:51:27:51:27 | access to local variable s |
+| Assert.cs:50:37:50:38 | [false] !... | Assert.cs:50:24:50:38 | [false] ... \|\| ... |
+| Assert.cs:50:38:50:38 | [b (line 7): true] access to parameter b | Assert.cs:50:37:50:38 | [false] !... |
+| B.cs:7:11:7:29 | SSA def(eqCallAlways) | B.cs:13:13:13:24 | access to local variable eqCallAlways |
+| B.cs:10:11:10:30 | SSA def(neqCallAlways) | B.cs:13:13:13:36 | ...; |
+| B.cs:10:11:10:30 | SSA def(neqCallAlways) | B.cs:15:9:16:26 | if (...) ... |
+| B.cs:13:13:13:36 | ...; | B.cs:15:9:16:26 | if (...) ... |
+| B.cs:15:9:16:26 | if (...) ... | B.cs:16:13:16:26 | ...; |
+| B.cs:15:9:16:26 | if (...) ... | B.cs:18:9:20:26 | if (...) ... |
+| B.cs:16:13:16:26 | ...; | B.cs:18:9:20:26 | if (...) ... |
+| B.cs:18:9:20:26 | if (...) ... | B.cs:18:25:18:27 | {...} |
+| B.cs:18:9:20:26 | if (...) ... | B.cs:20:13:20:26 | ...; |
+| B.cs:18:25:18:27 | {...} | B.cs:22:9:24:37 | if (...) ... |
+| B.cs:20:13:20:26 | ...; | B.cs:22:9:24:37 | if (...) ... |
+| B.cs:22:9:24:37 | if (...) ... | B.cs:24:13:24:25 | access to local variable neqCallAlways |
+| C.cs:10:16:10:23 | SSA def(o) | C.cs:11:17:11:28 | [false] !... |
+| C.cs:11:13:11:30 | [false] !... | C.cs:16:9:19:9 | if (...) ... |
+| C.cs:11:15:11:29 | [true] !... | C.cs:11:13:11:30 | [false] !... |
+| C.cs:11:17:11:28 | [false] !... | C.cs:11:15:11:29 | [true] !... |
+| C.cs:16:9:19:9 | if (...) ... | C.cs:16:13:16:24 | [true] !... |
+| C.cs:16:13:16:24 | [true] !... | C.cs:18:13:18:13 | access to local variable o |
+| C.cs:40:13:40:35 | SSA def(s) | C.cs:42:9:42:9 | access to local variable s |
+| C.cs:55:13:55:36 | SSA def(o2) | C.cs:57:9:57:10 | access to local variable o2 |
+| C.cs:62:13:62:46 | SSA def(o1) | C.cs:64:9:64:10 | access to local variable o1 |
+| C.cs:66:13:66:46 | SSA def(o2) | C.cs:68:9:68:10 | access to local variable o2 |
+| C.cs:94:13:94:45 | SSA def(o) | C.cs:95:15:95:15 | access to local variable o |
+| C.cs:94:13:94:45 | SSA def(o) | C.cs:96:13:96:13 | access to local variable o |
+| C.cs:102:13:102:23 | SSA def(list) | C.cs:103:27:103:30 | access to parameter list |
+| C.cs:102:13:102:23 | SSA def(list) | C.cs:103:27:103:30 | access to parameter list |
+| C.cs:103:9:107:9 | foreach (... ... in ...) ... | C.cs:103:22:103:22 | Int32 x |
+| C.cs:103:9:107:9 | foreach (... ... in ...) ... | C.cs:106:13:106:16 | access to parameter list |
+| C.cs:103:22:103:22 | Int32 x | C.cs:103:9:107:9 | foreach (... ... in ...) ... |
+| C.cs:103:27:103:30 | access to parameter list | C.cs:103:9:107:9 | foreach (... ... in ...) ... |
+| C.cs:159:9:159:16 | SSA def(s) | C.cs:162:13:162:13 | access to local variable s |
+| C.cs:167:9:167:16 | SSA def(s) | C.cs:170:13:170:13 | access to local variable s |
+| C.cs:178:13:178:20 | SSA def(s) | C.cs:177:13:177:13 | access to local variable s |
+| C.cs:193:9:193:16 | SSA def(s) | C.cs:196:13:196:13 | access to local variable s |
+| C.cs:197:13:197:20 | [b (line 192): true] SSA def(s) | C.cs:196:13:196:13 | access to local variable s |
+| C.cs:201:16:201:19 | true | C.cs:203:13:203:13 | access to local variable s |
+| C.cs:204:13:204:20 | SSA def(s) | C.cs:201:16:201:19 | true |
+| C.cs:210:13:210:35 | SSA def(s) | C.cs:217:9:218:25 | if (...) ... |
+| C.cs:214:13:214:20 | SSA def(s) | C.cs:217:9:218:25 | if (...) ... |
+| C.cs:217:9:218:25 | if (...) ... | C.cs:218:13:218:13 | access to local variable s |
+| C.cs:222:13:222:20 | SSA def(s) | C.cs:223:9:223:9 | access to local variable s |
+| C.cs:229:22:229:22 | access to local variable s | C.cs:233:9:233:9 | access to local variable s |
+| C.cs:229:33:229:40 | SSA def(s) | C.cs:229:22:229:22 | access to local variable s |
+| C.cs:235:14:235:21 | SSA def(s) | C.cs:235:24:235:24 | access to local variable s |
+| C.cs:235:24:235:24 | access to local variable s | C.cs:237:13:237:13 | access to local variable s |
+| C.cs:235:35:235:42 | SSA def(s) | C.cs:235:24:235:24 | access to local variable s |
+| C.cs:240:24:240:31 | SSA def(s) | C.cs:242:13:242:13 | access to local variable s |
+| C.cs:248:15:248:22 | SSA def(a) | C.cs:249:9:249:9 | access to local variable a |
+| C.cs:257:15:257:23 | SSA def(ia) | C.cs:260:9:260:10 | access to local variable ia |
+| C.cs:257:15:257:23 | SSA def(ia) | C.cs:263:9:263:10 | access to local variable ia |
+| C.cs:258:18:258:26 | SSA def(sa) | C.cs:261:20:261:21 | access to local variable sa |
+| C.cs:258:18:258:26 | SSA def(sa) | C.cs:264:16:264:17 | access to local variable sa |
+| D.cs:17:17:17:20 | null | D.cs:23:9:23:13 | access to parameter param |
+| D.cs:26:32:26:36 | SSA param(param) | D.cs:32:9:32:13 | access to parameter param |
+| D.cs:58:13:58:41 | SSA def(o5) | D.cs:61:9:62:26 | if (...) ... |
+| D.cs:61:9:62:26 | if (...) ... | D.cs:62:13:62:14 | access to local variable o5 |
+| D.cs:68:13:68:34 | SSA def(o7) | D.cs:69:18:69:36 | ... && ... |
+| D.cs:69:18:69:36 | ... && ... | D.cs:73:13:73:14 | access to local variable o7 |
+| D.cs:75:13:75:34 | SSA def(o8) | D.cs:76:34:76:35 | 42 |
+| D.cs:76:21:76:43 | ... ? ... : ... | D.cs:79:9:80:26 | if (...) ... |
+| D.cs:76:34:76:35 | 42 | D.cs:76:21:76:43 | ... ? ... : ... |
+| D.cs:79:9:80:26 | if (...) ... | D.cs:81:9:82:26 | if (...) ... |
+| D.cs:81:9:82:26 | if (...) ... | D.cs:82:13:82:14 | access to local variable o8 |
+| D.cs:81:9:82:26 | if (...) ... | D.cs:82:13:82:26 | ...; |
+| D.cs:81:9:82:26 | if (...) ... | D.cs:83:9:84:26 | if (...) ... |
+| D.cs:82:13:82:26 | ...; | D.cs:83:9:84:26 | if (...) ... |
+| D.cs:83:9:84:26 | if (...) ... | D.cs:84:13:84:14 | access to local variable o8 |
+| D.cs:89:15:89:44 | SSA def(xs) | D.cs:91:13:91:14 | access to local variable xs |
+| D.cs:89:15:89:44 | SSA def(xs) | D.cs:91:13:91:22 | ...; |
+| D.cs:89:15:89:44 | SSA def(xs) | D.cs:93:9:94:30 | if (...) ... |
+| D.cs:91:13:91:22 | ...; | D.cs:93:9:94:30 | if (...) ... |
+| D.cs:93:9:94:30 | if (...) ... | D.cs:94:13:94:30 | ...; |
+| D.cs:93:9:94:30 | if (...) ... | D.cs:94:21:94:22 | access to local variable xs |
+| D.cs:93:9:94:30 | if (...) ... | D.cs:96:9:99:9 | if (...) ... |
+| D.cs:94:13:94:30 | ...; | D.cs:96:9:99:9 | if (...) ... |
+| D.cs:96:9:99:9 | if (...) ... | D.cs:97:9:99:9 | {...} |
+| D.cs:96:9:99:9 | if (...) ... | D.cs:98:21:98:22 | access to local variable xs |
+| D.cs:96:9:99:9 | if (...) ... | D.cs:101:9:102:35 | if (...) ... |
+| D.cs:97:9:99:9 | {...} | D.cs:101:9:102:35 | if (...) ... |
+| D.cs:101:9:102:35 | if (...) ... | D.cs:102:31:102:32 | access to local variable xs |
+| D.cs:101:9:102:35 | if (...) ... | D.cs:102:31:102:32 | access to local variable xs |
+| D.cs:101:9:102:35 | if (...) ... | D.cs:104:9:106:30 | if (...) ... |
+| D.cs:102:13:102:35 | foreach (... ... in ...) ... | D.cs:102:26:102:26 | Int32 _ |
+| D.cs:102:13:102:35 | foreach (... ... in ...) ... | D.cs:104:9:106:30 | if (...) ... |
+| D.cs:102:26:102:26 | Int32 _ | D.cs:102:13:102:35 | foreach (... ... in ...) ... |
+| D.cs:102:31:102:32 | access to local variable xs | D.cs:102:13:102:35 | foreach (... ... in ...) ... |
+| D.cs:104:9:106:30 | if (...) ... | D.cs:105:19:105:20 | access to local variable xs |
+| D.cs:104:9:106:30 | if (...) ... | D.cs:106:17:106:18 | access to local variable xs |
+| D.cs:118:9:118:30 | SSA def(x) | D.cs:120:13:120:13 | access to local variable x |
+| D.cs:125:35:125:35 | SSA param(a) | D.cs:127:32:127:32 | 0 |
+| D.cs:125:35:125:35 | SSA param(a) | D.cs:127:32:127:32 | 0 |
+| D.cs:125:44:125:44 | SSA param(b) | D.cs:127:32:127:32 | 0 |
+| D.cs:125:44:125:44 | SSA param(b) | D.cs:127:36:127:36 | access to parameter a |
+| D.cs:127:20:127:43 | ... ? ... : ... | D.cs:128:32:128:32 | 0 |
+| D.cs:127:20:127:43 | ... ? ... : ... | D.cs:128:32:128:32 | 0 |
+| D.cs:127:20:127:43 | ... ? ... : ... | D.cs:128:36:128:36 | access to parameter b |
+| D.cs:127:32:127:32 | 0 | D.cs:127:20:127:43 | ... ? ... : ... |
+| D.cs:127:32:127:32 | 0 | D.cs:127:20:127:43 | ... ? ... : ... |
+| D.cs:127:36:127:36 | access to parameter a | D.cs:127:20:127:43 | ... ? ... : ... |
+| D.cs:128:20:128:43 | ... ? ... : ... | D.cs:131:9:137:9 | {...} |
+| D.cs:128:20:128:43 | ... ? ... : ... | D.cs:131:9:137:9 | {...} |
+| D.cs:128:20:128:43 | ... ? ... : ... | D.cs:138:9:138:18 | ... ...; |
+| D.cs:128:32:128:32 | 0 | D.cs:128:20:128:43 | ... ? ... : ... |
+| D.cs:128:32:128:32 | 0 | D.cs:128:20:128:43 | ... ? ... : ... |
+| D.cs:128:36:128:36 | access to parameter b | D.cs:128:20:128:43 | ... ? ... : ... |
+| D.cs:131:9:137:9 | {...} | D.cs:132:29:132:29 | access to local variable i |
+| D.cs:131:9:137:9 | {...} | D.cs:132:29:132:29 | access to local variable i |
+| D.cs:132:29:132:29 | access to local variable i | D.cs:133:13:136:13 | {...} |
+| D.cs:132:29:132:29 | access to local variable i | D.cs:133:13:136:13 | {...} |
+| D.cs:132:29:132:29 | access to local variable i | D.cs:134:24:134:24 | access to parameter a |
+| D.cs:132:29:132:29 | access to local variable i | D.cs:135:24:135:24 | access to parameter b |
+| D.cs:132:29:132:29 | access to local variable i | D.cs:138:9:138:18 | ... ...; |
+| D.cs:133:13:136:13 | {...} | D.cs:132:29:132:29 | access to local variable i |
+| D.cs:133:13:136:13 | {...} | D.cs:132:29:132:29 | access to local variable i |
+| D.cs:138:9:138:18 | ... ...; | D.cs:142:13:142:22 | ...; |
+| D.cs:142:13:142:22 | ...; | D.cs:143:9:146:9 | for (...;...;...) ... |
+| D.cs:143:9:146:9 | for (...;...;...) ... | D.cs:143:25:143:25 | access to local variable i |
+| D.cs:143:25:143:25 | access to local variable i | D.cs:144:9:146:9 | {...} |
+| D.cs:143:25:143:25 | access to local variable i | D.cs:145:20:145:20 | access to parameter a |
+| D.cs:144:9:146:9 | {...} | D.cs:143:25:143:25 | access to local variable i |
+| D.cs:149:36:149:38 | SSA param(obj) | D.cs:151:9:151:11 | access to parameter obj |
+| D.cs:163:16:163:25 | SSA def(obj) | D.cs:168:9:170:9 | [exception: Exception] catch (...) {...} |
+| D.cs:168:9:170:9 | [exception: Exception] catch (...) {...} | D.cs:168:26:168:26 | [exception: Exception] Exception e |
+| D.cs:168:26:168:26 | [exception: Exception] Exception e | D.cs:171:9:171:11 | access to local variable obj |
+| D.cs:240:9:240:16 | SSA def(o) | D.cs:241:29:241:32 | null |
+| D.cs:240:9:240:16 | SSA def(o) | D.cs:241:36:241:37 | "" |
+| D.cs:241:21:241:37 | ... ? ... : ... | D.cs:244:9:247:25 | if (...) ... |
+| D.cs:241:29:241:32 | null | D.cs:241:21:241:37 | ... ? ... : ... |
+| D.cs:241:36:241:37 | "" | D.cs:241:21:241:37 | ... ? ... : ... |
+| D.cs:244:9:247:25 | if (...) ... | D.cs:245:13:245:13 | access to local variable o |
+| D.cs:244:9:247:25 | if (...) ... | D.cs:247:13:247:13 | access to local variable o |
+| D.cs:249:13:249:38 | SSA def(o2) | D.cs:253:13:253:14 | access to local variable o2 |
+| D.cs:258:16:258:23 | SSA def(o) | D.cs:266:9:267:25 | if (...) ... |
+| D.cs:266:9:267:25 | if (...) ... | D.cs:266:13:266:27 | [true] ... is ... |
+| D.cs:266:13:266:27 | [true] ... is ... | D.cs:267:13:267:13 | access to local variable o |
+| D.cs:269:9:269:16 | SSA def(o) | D.cs:272:25:272:25 | access to local variable i |
+| D.cs:272:25:272:25 | access to local variable i | D.cs:273:9:288:9 | {...} |
+| D.cs:272:25:272:25 | access to local variable i | D.cs:290:9:291:25 | if (...) ... |
+| D.cs:272:39:272:39 | access to local variable i | D.cs:272:25:272:25 | access to local variable i |
+| D.cs:273:9:288:9 | {...} | D.cs:281:13:287:13 | if (...) ... |
+| D.cs:281:13:287:13 | if (...) ... | D.cs:272:39:272:39 | access to local variable i |
+| D.cs:283:17:283:24 | SSA def(o) | D.cs:285:28:285:30 | {...} |
+| D.cs:283:17:283:24 | SSA def(o) | D.cs:286:17:286:30 | ...; |
+| D.cs:285:28:285:30 | {...} | D.cs:286:17:286:30 | ...; |
+| D.cs:286:17:286:30 | ...; | D.cs:272:39:272:39 | access to local variable i |
+| D.cs:290:9:291:25 | if (...) ... | D.cs:291:13:291:13 | access to local variable o |
+| D.cs:290:9:291:25 | if (...) ... | D.cs:291:13:291:25 | ...; |
+| D.cs:290:9:291:25 | if (...) ... | D.cs:293:9:294:25 | if (...) ... |
+| D.cs:291:13:291:25 | ...; | D.cs:293:9:294:25 | if (...) ... |
+| D.cs:293:9:294:25 | if (...) ... | D.cs:294:13:294:13 | access to local variable o |
+| D.cs:296:16:296:26 | SSA def(prev) | D.cs:297:25:297:25 | access to local variable i |
+| D.cs:297:25:297:25 | access to local variable i | D.cs:298:9:302:9 | {...} |
+| D.cs:298:9:302:9 | {...} | D.cs:300:17:300:20 | access to local variable prev |
+| D.cs:304:16:304:23 | SSA def(s) | D.cs:307:13:311:13 | foreach (... ... in ...) ... |
+| D.cs:307:13:311:13 | foreach (... ... in ...) ... | D.cs:312:13:313:29 | if (...) ... |
+| D.cs:312:13:313:29 | if (...) ... | D.cs:312:17:312:23 | [true] !... |
+| D.cs:312:17:312:23 | [true] !... | D.cs:313:17:313:17 | access to local variable s |
+| D.cs:316:16:316:23 | SSA def(r) | D.cs:318:16:318:19 | access to local variable stat |
+| D.cs:318:16:318:19 | access to local variable stat | D.cs:318:16:318:62 | [false] ... && ... |
+| D.cs:318:16:318:19 | access to local variable stat | D.cs:318:41:318:44 | access to local variable stat |
+| D.cs:318:16:318:62 | [false] ... && ... | D.cs:324:9:324:9 | access to local variable r |
+| D.cs:318:41:318:44 | access to local variable stat | D.cs:318:16:318:62 | [false] ... && ... |
+| D.cs:351:15:351:22 | SSA def(a) | D.cs:355:9:356:21 | for (...;...;...) ... |
+| D.cs:355:9:356:21 | for (...;...;...) ... | D.cs:355:25:355:25 | access to local variable i |
+| D.cs:355:25:355:25 | access to local variable i | D.cs:356:13:356:13 | access to local variable a |
+| D.cs:355:25:355:25 | access to local variable i | D.cs:356:13:356:21 | ...; |
+| D.cs:356:13:356:21 | ...; | D.cs:355:25:355:25 | access to local variable i |
+| D.cs:360:20:360:30 | SSA def(last) | D.cs:361:29:361:29 | access to local variable i |
+| D.cs:361:29:361:29 | access to local variable i | D.cs:363:13:363:16 | access to local variable last |
+| D.cs:366:15:366:47 | SSA def(b) | D.cs:367:13:367:56 | [false] ... && ... |
+| D.cs:367:13:367:56 | [false] ... && ... | D.cs:370:9:373:9 | for (...;...;...) ... |
+| D.cs:370:9:373:9 | for (...;...;...) ... | D.cs:370:25:370:25 | access to local variable i |
+| D.cs:370:25:370:25 | access to local variable i | D.cs:371:9:373:9 | {...} |
+| D.cs:370:25:370:25 | access to local variable i | D.cs:372:13:372:13 | access to local variable b |
+| D.cs:371:9:373:9 | {...} | D.cs:370:25:370:25 | access to local variable i |
+| D.cs:378:19:378:28 | SSA def(ioe) | D.cs:382:9:385:27 | if (...) ... |
+| D.cs:382:9:385:27 | if (...) ... | D.cs:385:13:385:15 | access to local variable ioe |
+| D.cs:388:36:388:36 | SSA param(a) | D.cs:390:32:390:32 | 0 |
+| D.cs:388:45:388:45 | SSA param(b) | D.cs:390:32:390:32 | 0 |
+| D.cs:388:45:388:45 | SSA param(b) | D.cs:390:36:390:36 | access to parameter a |
+| D.cs:390:20:390:43 | ... ? ... : ... | D.cs:393:21:393:21 | access to local variable i |
+| D.cs:390:20:390:43 | ... ? ... : ... | D.cs:393:21:393:21 | access to local variable i |
+| D.cs:390:32:390:32 | 0 | D.cs:390:20:390:43 | ... ? ... : ... |
+| D.cs:390:32:390:32 | 0 | D.cs:390:20:390:43 | ... ? ... : ... |
+| D.cs:390:36:390:36 | access to parameter a | D.cs:390:20:390:43 | ... ? ... : ... |
+| D.cs:393:21:393:21 | access to local variable i | D.cs:394:9:396:9 | {...} |
+| D.cs:393:21:393:21 | access to local variable i | D.cs:394:9:396:9 | {...} |
+| D.cs:393:21:393:21 | access to local variable i | D.cs:395:20:395:20 | access to parameter a |
+| D.cs:393:21:393:21 | access to local variable i | D.cs:397:9:397:44 | ... ...; |
+| D.cs:394:9:396:9 | {...} | D.cs:393:21:393:21 | access to local variable i |
+| D.cs:394:9:396:9 | {...} | D.cs:393:21:393:21 | access to local variable i |
+| D.cs:397:9:397:44 | ... ...; | D.cs:397:32:397:32 | 0 |
+| D.cs:397:20:397:43 | ... ? ... : ... | D.cs:398:21:398:21 | access to local variable i |
+| D.cs:397:32:397:32 | 0 | D.cs:397:20:397:43 | ... ? ... : ... |
+| D.cs:398:21:398:21 | access to local variable i | D.cs:399:9:401:9 | {...} |
+| D.cs:398:21:398:21 | access to local variable i | D.cs:400:20:400:20 | access to parameter b |
+| D.cs:399:9:401:9 | {...} | D.cs:398:21:398:21 | access to local variable i |
+| D.cs:405:35:405:35 | SSA param(x) | D.cs:407:14:407:35 | [false] ... && ... |
+| D.cs:405:35:405:35 | SSA param(x) | D.cs:407:14:407:35 | [false] ... && ... |
+| D.cs:405:35:405:35 | SSA param(x) | D.cs:407:14:407:35 | [false] ... && ... |
+| D.cs:405:45:405:45 | SSA param(y) | D.cs:407:14:407:35 | [false] ... && ... |
+| D.cs:405:45:405:45 | SSA param(y) | D.cs:407:14:407:35 | [false] ... && ... |
+| D.cs:405:45:405:45 | SSA param(y) | D.cs:407:14:407:35 | [false] ... && ... |
+| D.cs:407:13:407:64 | [false] ... \|\| ... | D.cs:409:9:410:25 | if (...) ... |
+| D.cs:407:13:407:64 | [false] ... \|\| ... | D.cs:409:9:410:25 | if (...) ... |
+| D.cs:407:14:407:35 | [false] ... && ... | D.cs:407:42:407:42 | access to parameter x |
+| D.cs:407:14:407:35 | [false] ... && ... | D.cs:407:42:407:42 | access to parameter x |
+| D.cs:407:42:407:42 | access to parameter x | D.cs:407:42:407:63 | [false] ... && ... |
+| D.cs:407:42:407:42 | access to parameter x | D.cs:407:55:407:55 | access to parameter y |
+| D.cs:407:42:407:42 | access to parameter x | D.cs:407:55:407:55 | access to parameter y |
+| D.cs:407:42:407:63 | [false] ... && ... | D.cs:407:13:407:64 | [false] ... \|\| ... |
+| D.cs:407:42:407:63 | [false] ... && ... | D.cs:407:13:407:64 | [false] ... \|\| ... |
+| D.cs:407:55:407:55 | access to parameter y | D.cs:407:42:407:63 | [false] ... && ... |
+| D.cs:407:55:407:55 | access to parameter y | D.cs:407:42:407:63 | [false] ... && ... |
+| D.cs:409:9:410:25 | if (...) ... | D.cs:410:13:410:13 | access to parameter y |
+| D.cs:409:9:410:25 | if (...) ... | D.cs:411:9:412:25 | if (...) ... |
+| D.cs:411:9:412:25 | if (...) ... | D.cs:412:13:412:13 | access to parameter x |
+| E.cs:9:18:9:26 | SSA def(a2) | E.cs:10:22:10:54 | ... && ... |
+| E.cs:10:22:10:54 | ... && ... | E.cs:12:38:12:39 | access to local variable a2 |
+| E.cs:11:16:11:24 | SSA def(a3) | E.cs:12:22:12:52 | ... && ... |
+| E.cs:12:22:12:52 | ... && ... | E.cs:14:13:14:14 | access to local variable a3 |
+| E.cs:23:13:23:30 | SSA def(s1) | E.cs:24:33:24:36 | null |
+| E.cs:24:18:24:41 | ... ? ... : ... | E.cs:26:9:27:26 | if (...) ... |
+| E.cs:24:33:24:36 | null | E.cs:24:18:24:41 | ... ? ... : ... |
+| E.cs:26:9:27:26 | if (...) ... | E.cs:27:13:27:14 | access to local variable s1 |
+| E.cs:51:22:51:33 | SSA def(slice) | E.cs:53:16:53:19 | access to local variable iter |
+| E.cs:53:16:53:19 | access to local variable iter | E.cs:54:9:63:9 | {...} |
+| E.cs:54:9:63:9 | {...} | E.cs:61:13:61:17 | access to local variable slice |
+| E.cs:54:9:63:9 | {...} | E.cs:61:13:61:27 | ...; |
+| E.cs:61:13:61:27 | ...; | E.cs:53:16:53:19 | access to local variable iter |
+| E.cs:66:40:66:42 | SSA param(arr) | E.cs:70:13:70:50 | ...; |
+| E.cs:66:40:66:42 | SSA param(arr) | E.cs:72:9:73:23 | if (...) ... |
+| E.cs:70:13:70:50 | ...; | E.cs:70:36:70:36 | 0 |
+| E.cs:70:22:70:49 | ... ? ... : ... | E.cs:72:9:73:23 | if (...) ... |
+| E.cs:70:36:70:36 | 0 | E.cs:70:22:70:49 | ... ? ... : ... |
+| E.cs:72:9:73:23 | if (...) ... | E.cs:73:13:73:15 | access to parameter arr |
+| E.cs:107:15:107:25 | SSA def(arr2) | E.cs:111:9:112:30 | for (...;...;...) ... |
+| E.cs:111:9:112:30 | for (...;...;...) ... | E.cs:111:25:111:25 | access to local variable i |
+| E.cs:111:25:111:25 | access to local variable i | E.cs:112:13:112:16 | access to local variable arr2 |
+| E.cs:111:25:111:25 | access to local variable i | E.cs:112:13:112:30 | ...; |
+| E.cs:112:13:112:30 | ...; | E.cs:111:25:111:25 | access to local variable i |
+| E.cs:120:16:120:20 | [true] !... | E.cs:121:9:143:9 | {...} |
+| E.cs:120:17:120:20 | access to local variable stop | E.cs:120:16:120:20 | [true] !... |
+| E.cs:121:9:143:9 | {...} | E.cs:123:21:123:24 | access to local variable stop |
+| E.cs:123:20:123:24 | [false] !... | E.cs:123:20:123:35 | [false] ... && ... |
+| E.cs:123:20:123:24 | [true] !... | E.cs:123:29:123:29 | access to local variable j |
+| E.cs:123:20:123:35 | [false] ... && ... | E.cs:120:17:120:20 | access to local variable stop |
+| E.cs:123:20:123:35 | [true] ... && ... | E.cs:124:13:142:13 | {...} |
+| E.cs:123:20:123:35 | [true] ... && ... | E.cs:125:33:125:35 | access to local variable obj |
+| E.cs:123:21:123:24 | access to local variable stop | E.cs:123:20:123:24 | [false] !... |
+| E.cs:123:21:123:24 | access to local variable stop | E.cs:123:20:123:24 | [true] !... |
+| E.cs:123:29:123:29 | access to local variable j | E.cs:123:20:123:35 | [false] ... && ... |
+| E.cs:123:29:123:29 | access to local variable j | E.cs:123:20:123:35 | [true] ... && ... |
+| E.cs:124:13:142:13 | {...} | E.cs:128:21:128:23 | access to local variable obj |
+| E.cs:124:13:142:13 | {...} | E.cs:141:17:141:26 | ...; |
+| E.cs:137:25:137:34 | SSA def(obj) | E.cs:139:21:139:29 | continue; |
+| E.cs:139:21:139:29 | continue; | E.cs:123:21:123:24 | access to local variable stop |
+| E.cs:141:17:141:26 | ...; | E.cs:123:21:123:24 | access to local variable stop |
+| E.cs:152:16:152:26 | SSA def(obj2) | E.cs:153:13:153:54 | [false] ... && ... |
+| E.cs:153:13:153:54 | [false] ... && ... | E.cs:158:9:159:28 | if (...) ... |
+| E.cs:158:9:159:28 | if (...) ... | E.cs:159:13:159:16 | access to local variable obj2 |
+| E.cs:162:28:162:28 | SSA param(a) | E.cs:164:29:164:29 | 0 |
+| E.cs:164:17:164:40 | ... ? ... : ... | E.cs:165:25:165:25 | access to local variable i |
+| E.cs:164:29:164:29 | 0 | E.cs:164:17:164:40 | ... ? ... : ... |
+| E.cs:165:25:165:25 | access to local variable i | E.cs:166:9:170:9 | {...} |
+| E.cs:165:25:165:25 | access to local variable i | E.cs:167:21:167:21 | access to parameter a |
+| E.cs:165:32:165:32 | access to local variable i | E.cs:165:25:165:25 | access to local variable i |
+| E.cs:166:9:170:9 | {...} | E.cs:165:32:165:32 | access to local variable i |
+| E.cs:173:29:173:31 | SSA param(obj) | E.cs:175:33:175:37 | false |
+| E.cs:173:29:173:31 | SSA param(obj) | E.cs:175:33:175:37 | false |
+| E.cs:175:19:175:42 | ... ? ... : ... | E.cs:177:9:179:9 | {...} |
+| E.cs:175:19:175:42 | ... ? ... : ... | E.cs:178:13:178:15 | access to parameter obj |
+| E.cs:175:19:175:42 | ... ? ... : ... | E.cs:180:9:183:9 | if (...) ... |
+| E.cs:175:33:175:37 | false | E.cs:175:19:175:42 | ... ? ... : ... |
+| E.cs:177:9:179:9 | {...} | E.cs:180:9:183:9 | if (...) ... |
+| E.cs:180:9:183:9 | if (...) ... | E.cs:181:9:183:9 | {...} |
+| E.cs:181:9:183:9 | {...} | E.cs:184:9:187:9 | if (...) ... |
+| E.cs:184:9:187:9 | if (...) ... | E.cs:186:13:186:15 | access to parameter obj |
+| E.cs:190:29:190:29 | SSA param(o) | E.cs:192:17:192:17 | access to parameter o |
+| E.cs:198:13:198:29 | [b (line 196): false] SSA def(o) | E.cs:203:13:203:13 | access to local variable o |
+| E.cs:198:13:198:29 | [b (line 196): true] SSA def(o) | E.cs:201:13:201:13 | access to local variable o |
+| E.cs:206:28:206:28 | SSA param(s) | E.cs:208:13:208:23 | [false] ... is ... |
+| E.cs:208:13:208:23 | [false] ... is ... | E.cs:210:16:210:16 | access to parameter s |
+| E.cs:217:13:217:20 | [b (line 213): true] SSA def(x) | E.cs:218:9:218:9 | access to local variable x |
+| E.cs:217:13:217:20 | [b (line 213): true] SSA def(x) | E.cs:220:13:220:13 | access to local variable x |
+| E.cs:227:13:227:20 | [b (line 223): true] SSA def(x) | E.cs:229:13:229:13 | access to local variable x |
+| E.cs:227:13:227:20 | [b (line 223): true] SSA def(x) | E.cs:229:13:229:25 | ...; |
+| E.cs:229:13:229:25 | ...; | E.cs:230:9:230:9 | access to local variable x |
+| E.cs:233:26:233:26 | SSA param(i) | E.cs:235:16:235:16 | access to parameter i |
+| E.cs:238:26:238:26 | SSA param(i) | E.cs:240:21:240:21 | access to parameter i |
+| E.cs:283:13:283:22 | [b (line 279): false] SSA def(o) | E.cs:285:9:285:9 | access to local variable o |
+| E.cs:283:13:283:22 | [b (line 279): true] SSA def(o) | E.cs:285:9:285:9 | access to local variable o |
+| E.cs:301:13:301:27 | SSA def(s) | E.cs:302:9:302:9 | access to local variable s |
+| E.cs:319:29:319:30 | SSA param(s1) | E.cs:321:20:321:21 | access to parameter s2 |
+| E.cs:321:13:321:30 | [true] ... is ... | E.cs:323:13:323:14 | access to parameter s1 |
+| E.cs:321:14:321:21 | ... ?? ... | E.cs:321:13:321:30 | [true] ... is ... |
+| E.cs:321:20:321:21 | access to parameter s2 | E.cs:321:14:321:21 | ... ?? ... |
+| E.cs:330:13:330:36 | SSA def(x) | E.cs:331:9:331:9 | access to local variable x |
+| E.cs:342:13:342:32 | SSA def(x) | E.cs:343:9:343:9 | access to local variable x |
+| E.cs:348:17:348:36 | SSA def(x) | E.cs:349:9:349:9 | access to local variable x |
+| E.cs:366:28:366:28 | SSA param(s) | E.cs:366:41:366:41 | access to parameter s |
+| E.cs:374:17:374:31 | SSA def(s) | E.cs:375:20:375:20 | access to local variable s |
+| E.cs:380:24:380:25 | SSA param(e1) | E.cs:382:28:382:29 | access to parameter e2 |
+| E.cs:380:24:380:25 | SSA param(e1) | E.cs:382:28:382:29 | access to parameter e2 |
+| E.cs:380:24:380:25 | SSA param(e1) | E.cs:382:28:382:29 | access to parameter e2 |
+| E.cs:380:30:380:31 | SSA param(e2) | E.cs:382:14:382:37 | [false] ... && ... |
+| E.cs:380:30:380:31 | SSA param(e2) | E.cs:382:14:382:37 | [false] ... && ... |
+| E.cs:380:30:380:31 | SSA param(e2) | E.cs:382:14:382:37 | [false] ... && ... |
+| E.cs:380:30:380:31 | SSA param(e2) | E.cs:382:28:382:29 | access to parameter e2 |
+| E.cs:380:30:380:31 | SSA param(e2) | E.cs:382:28:382:29 | access to parameter e2 |
+| E.cs:380:30:380:31 | SSA param(e2) | E.cs:382:28:382:29 | access to parameter e2 |
+| E.cs:382:13:382:68 | [false] ... \|\| ... | E.cs:384:9:385:24 | if (...) ... |
+| E.cs:382:13:382:68 | [false] ... \|\| ... | E.cs:384:9:385:24 | if (...) ... |
+| E.cs:382:14:382:37 | [false] ... && ... | E.cs:382:44:382:45 | access to parameter e1 |
+| E.cs:382:14:382:37 | [false] ... && ... | E.cs:382:44:382:45 | access to parameter e1 |
+| E.cs:382:28:382:29 | access to parameter e2 | E.cs:382:14:382:37 | [false] ... && ... |
+| E.cs:382:28:382:29 | access to parameter e2 | E.cs:382:14:382:37 | [false] ... && ... |
+| E.cs:382:44:382:45 | access to parameter e1 | E.cs:382:44:382:67 | [false] ... && ... |
+| E.cs:382:44:382:45 | access to parameter e1 | E.cs:382:44:382:67 | [false] ... && ... |
+| E.cs:382:44:382:67 | [false] ... && ... | E.cs:382:13:382:68 | [false] ... \|\| ... |
+| E.cs:382:44:382:67 | [false] ... && ... | E.cs:382:13:382:68 | [false] ... \|\| ... |
+| E.cs:384:9:385:24 | if (...) ... | E.cs:384:13:384:36 | [false] ... && ... |
+| E.cs:384:9:385:24 | if (...) ... | E.cs:384:27:384:28 | access to parameter e2 |
+| E.cs:384:13:384:36 | [false] ... && ... | E.cs:386:16:386:17 | access to parameter e1 |
+| E.cs:384:13:384:36 | [false] ... && ... | E.cs:386:27:386:28 | access to parameter e2 |
+| E.cs:384:27:384:28 | access to parameter e2 | E.cs:384:13:384:36 | [false] ... && ... |
+| E.cs:404:9:404:18 | SSA def(i) | E.cs:405:16:405:16 | access to local variable i |
+| E.cs:404:9:404:18 | SSA def(i) | E.cs:405:16:405:16 | access to local variable i |
+| E.cs:417:24:417:40 | SSA capture def(i) | E.cs:417:34:417:34 | access to parameter i |
+| E.cs:423:28:423:44 | SSA capture def(i) | E.cs:423:38:423:38 | access to parameter i |
+| E.cs:430:29:430:45 | SSA capture def(i) | E.cs:430:39:430:39 | access to parameter i |
+| E.cs:435:29:435:29 | SSA param(s) | E.cs:437:13:437:21 | [true] ... is ... |
+| E.cs:437:13:437:21 | [true] ... is ... | E.cs:439:13:439:13 | access to parameter s |
+| F.cs:7:16:7:23 | SSA def(o) | F.cs:8:9:8:9 | access to local variable o |
+| Forwarding.cs:7:16:7:23 | SSA def(s) | Forwarding.cs:9:13:9:30 | [false] !... |
+| Forwarding.cs:9:13:9:30 | [false] !... | Forwarding.cs:14:9:17:9 | if (...) ... |
+| Forwarding.cs:14:9:17:9 | if (...) ... | Forwarding.cs:19:9:22:9 | if (...) ... |
+| Forwarding.cs:19:9:22:9 | if (...) ... | Forwarding.cs:19:13:19:23 | [false] !... |
+| Forwarding.cs:19:13:19:23 | [false] !... | Forwarding.cs:24:9:27:9 | if (...) ... |
+| Forwarding.cs:24:9:27:9 | if (...) ... | Forwarding.cs:29:9:32:9 | if (...) ... |
+| Forwarding.cs:29:9:32:9 | if (...) ... | Forwarding.cs:34:9:37:9 | if (...) ... |
+| Forwarding.cs:34:9:37:9 | if (...) ... | Forwarding.cs:35:9:37:9 | {...} |
+| Forwarding.cs:34:9:37:9 | if (...) ... | Forwarding.cs:36:31:36:31 | access to local variable s |
+| Forwarding.cs:35:9:37:9 | {...} | Forwarding.cs:40:27:40:27 | access to local variable s |
+| GuardedString.cs:7:16:7:32 | SSA def(s) | GuardedString.cs:9:13:9:36 | [false] !... |
+| GuardedString.cs:9:13:9:36 | [false] !... | GuardedString.cs:14:9:17:9 | if (...) ... |
+| GuardedString.cs:14:9:17:9 | if (...) ... | GuardedString.cs:14:13:14:41 | [false] !... |
+| GuardedString.cs:14:13:14:41 | [false] !... | GuardedString.cs:19:9:20:40 | if (...) ... |
+| GuardedString.cs:19:9:20:40 | if (...) ... | GuardedString.cs:19:26:19:26 | 0 |
+| GuardedString.cs:19:26:19:26 | 0 | GuardedString.cs:22:9:23:40 | if (...) ... |
+| GuardedString.cs:22:9:23:40 | if (...) ... | GuardedString.cs:22:25:22:25 | 0 |
+| GuardedString.cs:22:25:22:25 | 0 | GuardedString.cs:25:9:26:40 | if (...) ... |
+| GuardedString.cs:25:9:26:40 | if (...) ... | GuardedString.cs:25:26:25:26 | 0 |
+| GuardedString.cs:25:26:25:26 | 0 | GuardedString.cs:28:9:29:40 | if (...) ... |
+| GuardedString.cs:28:9:29:40 | if (...) ... | GuardedString.cs:28:25:28:26 | 10 |
+| GuardedString.cs:28:25:28:26 | 10 | GuardedString.cs:31:9:32:40 | if (...) ... |
+| GuardedString.cs:31:9:32:40 | if (...) ... | GuardedString.cs:31:26:31:27 | 10 |
+| GuardedString.cs:31:26:31:27 | 10 | GuardedString.cs:34:9:37:40 | if (...) ... |
+| GuardedString.cs:34:9:37:40 | if (...) ... | GuardedString.cs:34:26:34:26 | 0 |
+| GuardedString.cs:34:26:34:26 | 0 | GuardedString.cs:35:31:35:31 | access to local variable s |
+| NullAlwaysBad.cs:7:29:7:29 | SSA param(s) | NullAlwaysBad.cs:9:30:9:30 | access to parameter s |
+| NullMaybeBad.cs:13:17:13:20 | null | NullMaybeBad.cs:7:27:7:27 | access to parameter o |
+| Params.cs:20:12:20:15 | null | Params.cs:14:17:14:20 | access to parameter args |
+| StringConcatenation.cs:14:16:14:23 | SSA def(s) | StringConcatenation.cs:15:16:15:16 | access to local variable s |
+| StringConcatenation.cs:15:16:15:16 | access to local variable s | StringConcatenation.cs:16:17:16:17 | access to local variable s |
 nodes
 | A.cs:7:16:7:40 | SSA def(synchronizedAlways) |
 | A.cs:8:15:8:32 | access to local variable synchronizedAlways |
@@ -415,6 +895,8 @@ nodes
 | E.cs:435:29:435:29 | SSA param(s) |
 | E.cs:437:13:437:21 | [true] ... is ... |
 | E.cs:439:13:439:13 | access to parameter s |
+| F.cs:7:16:7:23 | SSA def(o) |
+| F.cs:8:9:8:9 | access to local variable o |
 | Forwarding.cs:7:16:7:23 | SSA def(s) |
 | Forwarding.cs:9:13:9:30 | [false] !... |
 | Forwarding.cs:14:9:17:9 | if (...) ... |
@@ -452,482 +934,3 @@ nodes
 | StringConcatenation.cs:14:16:14:23 | SSA def(s) |
 | StringConcatenation.cs:15:16:15:16 | access to local variable s |
 | StringConcatenation.cs:16:17:16:17 | access to local variable s |
-edges
-| A.cs:7:16:7:40 | SSA def(synchronizedAlways) | A.cs:8:15:8:32 | access to local variable synchronizedAlways |
-| A.cs:7:16:7:40 | SSA def(synchronizedAlways) | A.cs:10:13:10:30 | access to local variable synchronizedAlways |
-| A.cs:16:15:16:30 | SSA def(arrayNull) | A.cs:17:9:17:17 | access to local variable arrayNull |
-| A.cs:26:15:26:32 | SSA def(arrayAccess) | A.cs:31:27:31:37 | access to local variable arrayAccess |
-| A.cs:26:15:26:32 | SSA def(arrayAccess) | A.cs:36:27:36:37 | access to local variable arrayAccess |
-| A.cs:27:18:27:35 | SSA def(fieldAccess) | A.cs:32:27:32:37 | access to local variable fieldAccess |
-| A.cs:27:18:27:35 | SSA def(fieldAccess) | A.cs:37:27:37:37 | access to local variable fieldAccess |
-| A.cs:28:16:28:34 | SSA def(methodAccess) | A.cs:33:28:33:39 | access to local variable methodAccess |
-| A.cs:28:16:28:34 | SSA def(methodAccess) | A.cs:38:15:38:26 | access to local variable methodAccess |
-| A.cs:29:16:29:32 | SSA def(methodCall) | A.cs:34:27:34:36 | access to local variable methodCall |
-| A.cs:29:16:29:32 | SSA def(methodCall) | A.cs:39:27:39:36 | access to local variable methodCall |
-| A.cs:48:16:48:28 | SSA def(varRef) | A.cs:50:9:50:14 | access to local variable varRef |
-| Assert.cs:13:9:13:25 | [b (line 7): false] SSA def(s) | Assert.cs:15:27:15:27 | access to local variable s |
-| Assert.cs:13:9:13:25 | [b (line 7): true] SSA def(s) | Assert.cs:15:27:15:27 | access to local variable s |
-| Assert.cs:21:9:21:25 | [b (line 7): false] SSA def(s) | Assert.cs:23:27:23:27 | access to local variable s |
-| Assert.cs:21:9:21:25 | [b (line 7): true] SSA def(s) | Assert.cs:23:27:23:27 | access to local variable s |
-| Assert.cs:29:9:29:25 | [b (line 7): false] SSA def(s) | Assert.cs:31:27:31:27 | access to local variable s |
-| Assert.cs:29:9:29:25 | [b (line 7): true] SSA def(s) | Assert.cs:31:27:31:27 | access to local variable s |
-| Assert.cs:45:9:45:25 | [b (line 7): true] SSA def(s) | Assert.cs:46:36:46:36 | [b (line 7): true] access to parameter b |
-| Assert.cs:46:23:46:36 | [true, b (line 7): true] ... && ... | Assert.cs:47:27:47:27 | access to local variable s |
-| Assert.cs:46:36:46:36 | [b (line 7): true] access to parameter b | Assert.cs:46:23:46:36 | [true, b (line 7): true] ... && ... |
-| Assert.cs:49:9:49:25 | [b (line 7): true] SSA def(s) | Assert.cs:50:38:50:38 | [b (line 7): true] access to parameter b |
-| Assert.cs:50:24:50:38 | [false] ... \|\| ... | Assert.cs:51:27:51:27 | access to local variable s |
-| Assert.cs:50:37:50:38 | [false] !... | Assert.cs:50:24:50:38 | [false] ... \|\| ... |
-| Assert.cs:50:38:50:38 | [b (line 7): true] access to parameter b | Assert.cs:50:37:50:38 | [false] !... |
-| B.cs:7:11:7:29 | SSA def(eqCallAlways) | B.cs:13:13:13:24 | access to local variable eqCallAlways |
-| B.cs:10:11:10:30 | SSA def(neqCallAlways) | B.cs:13:13:13:36 | ...; |
-| B.cs:10:11:10:30 | SSA def(neqCallAlways) | B.cs:15:9:16:26 | if (...) ... |
-| B.cs:13:13:13:36 | ...; | B.cs:15:9:16:26 | if (...) ... |
-| B.cs:15:9:16:26 | if (...) ... | B.cs:16:13:16:26 | ...; |
-| B.cs:15:9:16:26 | if (...) ... | B.cs:18:9:20:26 | if (...) ... |
-| B.cs:16:13:16:26 | ...; | B.cs:18:9:20:26 | if (...) ... |
-| B.cs:18:9:20:26 | if (...) ... | B.cs:18:25:18:27 | {...} |
-| B.cs:18:9:20:26 | if (...) ... | B.cs:20:13:20:26 | ...; |
-| B.cs:18:25:18:27 | {...} | B.cs:22:9:24:37 | if (...) ... |
-| B.cs:20:13:20:26 | ...; | B.cs:22:9:24:37 | if (...) ... |
-| B.cs:22:9:24:37 | if (...) ... | B.cs:24:13:24:25 | access to local variable neqCallAlways |
-| C.cs:10:16:10:23 | SSA def(o) | C.cs:11:17:11:28 | [false] !... |
-| C.cs:11:13:11:30 | [false] !... | C.cs:16:9:19:9 | if (...) ... |
-| C.cs:11:15:11:29 | [true] !... | C.cs:11:13:11:30 | [false] !... |
-| C.cs:11:17:11:28 | [false] !... | C.cs:11:15:11:29 | [true] !... |
-| C.cs:16:9:19:9 | if (...) ... | C.cs:16:13:16:24 | [true] !... |
-| C.cs:16:13:16:24 | [true] !... | C.cs:18:13:18:13 | access to local variable o |
-| C.cs:40:13:40:35 | SSA def(s) | C.cs:42:9:42:9 | access to local variable s |
-| C.cs:55:13:55:36 | SSA def(o2) | C.cs:57:9:57:10 | access to local variable o2 |
-| C.cs:62:13:62:46 | SSA def(o1) | C.cs:64:9:64:10 | access to local variable o1 |
-| C.cs:66:13:66:46 | SSA def(o2) | C.cs:68:9:68:10 | access to local variable o2 |
-| C.cs:94:13:94:45 | SSA def(o) | C.cs:95:15:95:15 | access to local variable o |
-| C.cs:94:13:94:45 | SSA def(o) | C.cs:96:13:96:13 | access to local variable o |
-| C.cs:102:13:102:23 | SSA def(list) | C.cs:103:27:103:30 | access to parameter list |
-| C.cs:102:13:102:23 | SSA def(list) | C.cs:103:27:103:30 | access to parameter list |
-| C.cs:103:9:107:9 | foreach (... ... in ...) ... | C.cs:103:22:103:22 | Int32 x |
-| C.cs:103:9:107:9 | foreach (... ... in ...) ... | C.cs:106:13:106:16 | access to parameter list |
-| C.cs:103:22:103:22 | Int32 x | C.cs:103:9:107:9 | foreach (... ... in ...) ... |
-| C.cs:103:27:103:30 | access to parameter list | C.cs:103:9:107:9 | foreach (... ... in ...) ... |
-| C.cs:159:9:159:16 | SSA def(s) | C.cs:162:13:162:13 | access to local variable s |
-| C.cs:167:9:167:16 | SSA def(s) | C.cs:170:13:170:13 | access to local variable s |
-| C.cs:178:13:178:20 | SSA def(s) | C.cs:177:13:177:13 | access to local variable s |
-| C.cs:193:9:193:16 | SSA def(s) | C.cs:196:13:196:13 | access to local variable s |
-| C.cs:197:13:197:20 | [b (line 192): true] SSA def(s) | C.cs:196:13:196:13 | access to local variable s |
-| C.cs:201:16:201:19 | true | C.cs:203:13:203:13 | access to local variable s |
-| C.cs:204:13:204:20 | SSA def(s) | C.cs:201:16:201:19 | true |
-| C.cs:210:13:210:35 | SSA def(s) | C.cs:217:9:218:25 | if (...) ... |
-| C.cs:214:13:214:20 | SSA def(s) | C.cs:217:9:218:25 | if (...) ... |
-| C.cs:217:9:218:25 | if (...) ... | C.cs:218:13:218:13 | access to local variable s |
-| C.cs:222:13:222:20 | SSA def(s) | C.cs:223:9:223:9 | access to local variable s |
-| C.cs:229:22:229:22 | access to local variable s | C.cs:233:9:233:9 | access to local variable s |
-| C.cs:229:33:229:40 | SSA def(s) | C.cs:229:22:229:22 | access to local variable s |
-| C.cs:235:14:235:21 | SSA def(s) | C.cs:235:24:235:24 | access to local variable s |
-| C.cs:235:24:235:24 | access to local variable s | C.cs:237:13:237:13 | access to local variable s |
-| C.cs:235:35:235:42 | SSA def(s) | C.cs:235:24:235:24 | access to local variable s |
-| C.cs:240:24:240:31 | SSA def(s) | C.cs:242:13:242:13 | access to local variable s |
-| C.cs:248:15:248:22 | SSA def(a) | C.cs:249:9:249:9 | access to local variable a |
-| C.cs:257:15:257:23 | SSA def(ia) | C.cs:260:9:260:10 | access to local variable ia |
-| C.cs:257:15:257:23 | SSA def(ia) | C.cs:263:9:263:10 | access to local variable ia |
-| C.cs:258:18:258:26 | SSA def(sa) | C.cs:261:20:261:21 | access to local variable sa |
-| C.cs:258:18:258:26 | SSA def(sa) | C.cs:264:16:264:17 | access to local variable sa |
-| D.cs:17:17:17:20 | null | D.cs:23:9:23:13 | access to parameter param |
-| D.cs:26:32:26:36 | SSA param(param) | D.cs:32:9:32:13 | access to parameter param |
-| D.cs:58:13:58:41 | SSA def(o5) | D.cs:61:9:62:26 | if (...) ... |
-| D.cs:61:9:62:26 | if (...) ... | D.cs:62:13:62:14 | access to local variable o5 |
-| D.cs:68:13:68:34 | SSA def(o7) | D.cs:69:18:69:36 | ... && ... |
-| D.cs:69:18:69:36 | ... && ... | D.cs:73:13:73:14 | access to local variable o7 |
-| D.cs:75:13:75:34 | SSA def(o8) | D.cs:76:34:76:35 | 42 |
-| D.cs:76:21:76:43 | ... ? ... : ... | D.cs:79:9:80:26 | if (...) ... |
-| D.cs:76:34:76:35 | 42 | D.cs:76:21:76:43 | ... ? ... : ... |
-| D.cs:79:9:80:26 | if (...) ... | D.cs:81:9:82:26 | if (...) ... |
-| D.cs:81:9:82:26 | if (...) ... | D.cs:82:13:82:14 | access to local variable o8 |
-| D.cs:81:9:82:26 | if (...) ... | D.cs:82:13:82:26 | ...; |
-| D.cs:81:9:82:26 | if (...) ... | D.cs:83:9:84:26 | if (...) ... |
-| D.cs:82:13:82:26 | ...; | D.cs:83:9:84:26 | if (...) ... |
-| D.cs:83:9:84:26 | if (...) ... | D.cs:84:13:84:14 | access to local variable o8 |
-| D.cs:89:15:89:44 | SSA def(xs) | D.cs:91:13:91:14 | access to local variable xs |
-| D.cs:89:15:89:44 | SSA def(xs) | D.cs:91:13:91:22 | ...; |
-| D.cs:89:15:89:44 | SSA def(xs) | D.cs:93:9:94:30 | if (...) ... |
-| D.cs:91:13:91:22 | ...; | D.cs:93:9:94:30 | if (...) ... |
-| D.cs:93:9:94:30 | if (...) ... | D.cs:94:13:94:30 | ...; |
-| D.cs:93:9:94:30 | if (...) ... | D.cs:94:21:94:22 | access to local variable xs |
-| D.cs:93:9:94:30 | if (...) ... | D.cs:96:9:99:9 | if (...) ... |
-| D.cs:94:13:94:30 | ...; | D.cs:96:9:99:9 | if (...) ... |
-| D.cs:96:9:99:9 | if (...) ... | D.cs:97:9:99:9 | {...} |
-| D.cs:96:9:99:9 | if (...) ... | D.cs:98:21:98:22 | access to local variable xs |
-| D.cs:96:9:99:9 | if (...) ... | D.cs:101:9:102:35 | if (...) ... |
-| D.cs:97:9:99:9 | {...} | D.cs:101:9:102:35 | if (...) ... |
-| D.cs:101:9:102:35 | if (...) ... | D.cs:102:31:102:32 | access to local variable xs |
-| D.cs:101:9:102:35 | if (...) ... | D.cs:102:31:102:32 | access to local variable xs |
-| D.cs:101:9:102:35 | if (...) ... | D.cs:104:9:106:30 | if (...) ... |
-| D.cs:102:13:102:35 | foreach (... ... in ...) ... | D.cs:102:26:102:26 | Int32 _ |
-| D.cs:102:13:102:35 | foreach (... ... in ...) ... | D.cs:104:9:106:30 | if (...) ... |
-| D.cs:102:26:102:26 | Int32 _ | D.cs:102:13:102:35 | foreach (... ... in ...) ... |
-| D.cs:102:31:102:32 | access to local variable xs | D.cs:102:13:102:35 | foreach (... ... in ...) ... |
-| D.cs:104:9:106:30 | if (...) ... | D.cs:105:19:105:20 | access to local variable xs |
-| D.cs:104:9:106:30 | if (...) ... | D.cs:106:17:106:18 | access to local variable xs |
-| D.cs:118:9:118:30 | SSA def(x) | D.cs:120:13:120:13 | access to local variable x |
-| D.cs:125:35:125:35 | SSA param(a) | D.cs:127:32:127:32 | 0 |
-| D.cs:125:35:125:35 | SSA param(a) | D.cs:127:32:127:32 | 0 |
-| D.cs:125:44:125:44 | SSA param(b) | D.cs:127:32:127:32 | 0 |
-| D.cs:125:44:125:44 | SSA param(b) | D.cs:127:36:127:36 | access to parameter a |
-| D.cs:127:20:127:43 | ... ? ... : ... | D.cs:128:32:128:32 | 0 |
-| D.cs:127:20:127:43 | ... ? ... : ... | D.cs:128:32:128:32 | 0 |
-| D.cs:127:20:127:43 | ... ? ... : ... | D.cs:128:36:128:36 | access to parameter b |
-| D.cs:127:32:127:32 | 0 | D.cs:127:20:127:43 | ... ? ... : ... |
-| D.cs:127:32:127:32 | 0 | D.cs:127:20:127:43 | ... ? ... : ... |
-| D.cs:127:36:127:36 | access to parameter a | D.cs:127:20:127:43 | ... ? ... : ... |
-| D.cs:128:20:128:43 | ... ? ... : ... | D.cs:131:9:137:9 | {...} |
-| D.cs:128:20:128:43 | ... ? ... : ... | D.cs:131:9:137:9 | {...} |
-| D.cs:128:20:128:43 | ... ? ... : ... | D.cs:138:9:138:18 | ... ...; |
-| D.cs:128:32:128:32 | 0 | D.cs:128:20:128:43 | ... ? ... : ... |
-| D.cs:128:32:128:32 | 0 | D.cs:128:20:128:43 | ... ? ... : ... |
-| D.cs:128:36:128:36 | access to parameter b | D.cs:128:20:128:43 | ... ? ... : ... |
-| D.cs:131:9:137:9 | {...} | D.cs:132:29:132:29 | access to local variable i |
-| D.cs:131:9:137:9 | {...} | D.cs:132:29:132:29 | access to local variable i |
-| D.cs:132:29:132:29 | access to local variable i | D.cs:133:13:136:13 | {...} |
-| D.cs:132:29:132:29 | access to local variable i | D.cs:133:13:136:13 | {...} |
-| D.cs:132:29:132:29 | access to local variable i | D.cs:134:24:134:24 | access to parameter a |
-| D.cs:132:29:132:29 | access to local variable i | D.cs:135:24:135:24 | access to parameter b |
-| D.cs:132:29:132:29 | access to local variable i | D.cs:138:9:138:18 | ... ...; |
-| D.cs:133:13:136:13 | {...} | D.cs:132:29:132:29 | access to local variable i |
-| D.cs:133:13:136:13 | {...} | D.cs:132:29:132:29 | access to local variable i |
-| D.cs:138:9:138:18 | ... ...; | D.cs:142:13:142:22 | ...; |
-| D.cs:142:13:142:22 | ...; | D.cs:143:9:146:9 | for (...;...;...) ... |
-| D.cs:143:9:146:9 | for (...;...;...) ... | D.cs:143:25:143:25 | access to local variable i |
-| D.cs:143:25:143:25 | access to local variable i | D.cs:144:9:146:9 | {...} |
-| D.cs:143:25:143:25 | access to local variable i | D.cs:145:20:145:20 | access to parameter a |
-| D.cs:144:9:146:9 | {...} | D.cs:143:25:143:25 | access to local variable i |
-| D.cs:149:36:149:38 | SSA param(obj) | D.cs:151:9:151:11 | access to parameter obj |
-| D.cs:163:16:163:25 | SSA def(obj) | D.cs:168:9:170:9 | [exception: Exception] catch (...) {...} |
-| D.cs:168:9:170:9 | [exception: Exception] catch (...) {...} | D.cs:168:26:168:26 | [exception: Exception] Exception e |
-| D.cs:168:26:168:26 | [exception: Exception] Exception e | D.cs:171:9:171:11 | access to local variable obj |
-| D.cs:240:9:240:16 | SSA def(o) | D.cs:241:29:241:32 | null |
-| D.cs:240:9:240:16 | SSA def(o) | D.cs:241:36:241:37 | "" |
-| D.cs:241:21:241:37 | ... ? ... : ... | D.cs:244:9:247:25 | if (...) ... |
-| D.cs:241:29:241:32 | null | D.cs:241:21:241:37 | ... ? ... : ... |
-| D.cs:241:36:241:37 | "" | D.cs:241:21:241:37 | ... ? ... : ... |
-| D.cs:244:9:247:25 | if (...) ... | D.cs:245:13:245:13 | access to local variable o |
-| D.cs:244:9:247:25 | if (...) ... | D.cs:247:13:247:13 | access to local variable o |
-| D.cs:249:13:249:38 | SSA def(o2) | D.cs:253:13:253:14 | access to local variable o2 |
-| D.cs:258:16:258:23 | SSA def(o) | D.cs:266:9:267:25 | if (...) ... |
-| D.cs:266:9:267:25 | if (...) ... | D.cs:266:13:266:27 | [true] ... is ... |
-| D.cs:266:13:266:27 | [true] ... is ... | D.cs:267:13:267:13 | access to local variable o |
-| D.cs:269:9:269:16 | SSA def(o) | D.cs:272:25:272:25 | access to local variable i |
-| D.cs:272:25:272:25 | access to local variable i | D.cs:273:9:288:9 | {...} |
-| D.cs:272:25:272:25 | access to local variable i | D.cs:290:9:291:25 | if (...) ... |
-| D.cs:272:39:272:39 | access to local variable i | D.cs:272:25:272:25 | access to local variable i |
-| D.cs:273:9:288:9 | {...} | D.cs:281:13:287:13 | if (...) ... |
-| D.cs:281:13:287:13 | if (...) ... | D.cs:272:39:272:39 | access to local variable i |
-| D.cs:283:17:283:24 | SSA def(o) | D.cs:285:28:285:30 | {...} |
-| D.cs:283:17:283:24 | SSA def(o) | D.cs:286:17:286:30 | ...; |
-| D.cs:285:28:285:30 | {...} | D.cs:286:17:286:30 | ...; |
-| D.cs:286:17:286:30 | ...; | D.cs:272:39:272:39 | access to local variable i |
-| D.cs:290:9:291:25 | if (...) ... | D.cs:291:13:291:13 | access to local variable o |
-| D.cs:290:9:291:25 | if (...) ... | D.cs:291:13:291:25 | ...; |
-| D.cs:290:9:291:25 | if (...) ... | D.cs:293:9:294:25 | if (...) ... |
-| D.cs:291:13:291:25 | ...; | D.cs:293:9:294:25 | if (...) ... |
-| D.cs:293:9:294:25 | if (...) ... | D.cs:294:13:294:13 | access to local variable o |
-| D.cs:296:16:296:26 | SSA def(prev) | D.cs:297:25:297:25 | access to local variable i |
-| D.cs:297:25:297:25 | access to local variable i | D.cs:298:9:302:9 | {...} |
-| D.cs:298:9:302:9 | {...} | D.cs:300:17:300:20 | access to local variable prev |
-| D.cs:304:16:304:23 | SSA def(s) | D.cs:307:13:311:13 | foreach (... ... in ...) ... |
-| D.cs:307:13:311:13 | foreach (... ... in ...) ... | D.cs:312:13:313:29 | if (...) ... |
-| D.cs:312:13:313:29 | if (...) ... | D.cs:312:17:312:23 | [true] !... |
-| D.cs:312:17:312:23 | [true] !... | D.cs:313:17:313:17 | access to local variable s |
-| D.cs:316:16:316:23 | SSA def(r) | D.cs:318:16:318:19 | access to local variable stat |
-| D.cs:318:16:318:19 | access to local variable stat | D.cs:318:16:318:62 | [false] ... && ... |
-| D.cs:318:16:318:19 | access to local variable stat | D.cs:318:41:318:44 | access to local variable stat |
-| D.cs:318:16:318:62 | [false] ... && ... | D.cs:324:9:324:9 | access to local variable r |
-| D.cs:318:41:318:44 | access to local variable stat | D.cs:318:16:318:62 | [false] ... && ... |
-| D.cs:351:15:351:22 | SSA def(a) | D.cs:355:9:356:21 | for (...;...;...) ... |
-| D.cs:355:9:356:21 | for (...;...;...) ... | D.cs:355:25:355:25 | access to local variable i |
-| D.cs:355:25:355:25 | access to local variable i | D.cs:356:13:356:13 | access to local variable a |
-| D.cs:355:25:355:25 | access to local variable i | D.cs:356:13:356:21 | ...; |
-| D.cs:356:13:356:21 | ...; | D.cs:355:25:355:25 | access to local variable i |
-| D.cs:360:20:360:30 | SSA def(last) | D.cs:361:29:361:29 | access to local variable i |
-| D.cs:361:29:361:29 | access to local variable i | D.cs:363:13:363:16 | access to local variable last |
-| D.cs:366:15:366:47 | SSA def(b) | D.cs:367:13:367:56 | [false] ... && ... |
-| D.cs:367:13:367:56 | [false] ... && ... | D.cs:370:9:373:9 | for (...;...;...) ... |
-| D.cs:370:9:373:9 | for (...;...;...) ... | D.cs:370:25:370:25 | access to local variable i |
-| D.cs:370:25:370:25 | access to local variable i | D.cs:371:9:373:9 | {...} |
-| D.cs:370:25:370:25 | access to local variable i | D.cs:372:13:372:13 | access to local variable b |
-| D.cs:371:9:373:9 | {...} | D.cs:370:25:370:25 | access to local variable i |
-| D.cs:378:19:378:28 | SSA def(ioe) | D.cs:382:9:385:27 | if (...) ... |
-| D.cs:382:9:385:27 | if (...) ... | D.cs:385:13:385:15 | access to local variable ioe |
-| D.cs:388:36:388:36 | SSA param(a) | D.cs:390:32:390:32 | 0 |
-| D.cs:388:45:388:45 | SSA param(b) | D.cs:390:32:390:32 | 0 |
-| D.cs:388:45:388:45 | SSA param(b) | D.cs:390:36:390:36 | access to parameter a |
-| D.cs:390:20:390:43 | ... ? ... : ... | D.cs:393:21:393:21 | access to local variable i |
-| D.cs:390:20:390:43 | ... ? ... : ... | D.cs:393:21:393:21 | access to local variable i |
-| D.cs:390:32:390:32 | 0 | D.cs:390:20:390:43 | ... ? ... : ... |
-| D.cs:390:32:390:32 | 0 | D.cs:390:20:390:43 | ... ? ... : ... |
-| D.cs:390:36:390:36 | access to parameter a | D.cs:390:20:390:43 | ... ? ... : ... |
-| D.cs:393:21:393:21 | access to local variable i | D.cs:394:9:396:9 | {...} |
-| D.cs:393:21:393:21 | access to local variable i | D.cs:394:9:396:9 | {...} |
-| D.cs:393:21:393:21 | access to local variable i | D.cs:395:20:395:20 | access to parameter a |
-| D.cs:393:21:393:21 | access to local variable i | D.cs:397:9:397:44 | ... ...; |
-| D.cs:394:9:396:9 | {...} | D.cs:393:21:393:21 | access to local variable i |
-| D.cs:394:9:396:9 | {...} | D.cs:393:21:393:21 | access to local variable i |
-| D.cs:397:9:397:44 | ... ...; | D.cs:397:32:397:32 | 0 |
-| D.cs:397:20:397:43 | ... ? ... : ... | D.cs:398:21:398:21 | access to local variable i |
-| D.cs:397:32:397:32 | 0 | D.cs:397:20:397:43 | ... ? ... : ... |
-| D.cs:398:21:398:21 | access to local variable i | D.cs:399:9:401:9 | {...} |
-| D.cs:398:21:398:21 | access to local variable i | D.cs:400:20:400:20 | access to parameter b |
-| D.cs:399:9:401:9 | {...} | D.cs:398:21:398:21 | access to local variable i |
-| D.cs:405:35:405:35 | SSA param(x) | D.cs:407:14:407:35 | [false] ... && ... |
-| D.cs:405:35:405:35 | SSA param(x) | D.cs:407:14:407:35 | [false] ... && ... |
-| D.cs:405:35:405:35 | SSA param(x) | D.cs:407:14:407:35 | [false] ... && ... |
-| D.cs:405:45:405:45 | SSA param(y) | D.cs:407:14:407:35 | [false] ... && ... |
-| D.cs:405:45:405:45 | SSA param(y) | D.cs:407:14:407:35 | [false] ... && ... |
-| D.cs:405:45:405:45 | SSA param(y) | D.cs:407:14:407:35 | [false] ... && ... |
-| D.cs:407:13:407:64 | [false] ... \|\| ... | D.cs:409:9:410:25 | if (...) ... |
-| D.cs:407:13:407:64 | [false] ... \|\| ... | D.cs:409:9:410:25 | if (...) ... |
-| D.cs:407:14:407:35 | [false] ... && ... | D.cs:407:42:407:42 | access to parameter x |
-| D.cs:407:14:407:35 | [false] ... && ... | D.cs:407:42:407:42 | access to parameter x |
-| D.cs:407:42:407:42 | access to parameter x | D.cs:407:42:407:63 | [false] ... && ... |
-| D.cs:407:42:407:42 | access to parameter x | D.cs:407:55:407:55 | access to parameter y |
-| D.cs:407:42:407:42 | access to parameter x | D.cs:407:55:407:55 | access to parameter y |
-| D.cs:407:42:407:63 | [false] ... && ... | D.cs:407:13:407:64 | [false] ... \|\| ... |
-| D.cs:407:42:407:63 | [false] ... && ... | D.cs:407:13:407:64 | [false] ... \|\| ... |
-| D.cs:407:55:407:55 | access to parameter y | D.cs:407:42:407:63 | [false] ... && ... |
-| D.cs:407:55:407:55 | access to parameter y | D.cs:407:42:407:63 | [false] ... && ... |
-| D.cs:409:9:410:25 | if (...) ... | D.cs:410:13:410:13 | access to parameter y |
-| D.cs:409:9:410:25 | if (...) ... | D.cs:411:9:412:25 | if (...) ... |
-| D.cs:411:9:412:25 | if (...) ... | D.cs:412:13:412:13 | access to parameter x |
-| E.cs:9:18:9:26 | SSA def(a2) | E.cs:10:22:10:54 | ... && ... |
-| E.cs:10:22:10:54 | ... && ... | E.cs:12:38:12:39 | access to local variable a2 |
-| E.cs:11:16:11:24 | SSA def(a3) | E.cs:12:22:12:52 | ... && ... |
-| E.cs:12:22:12:52 | ... && ... | E.cs:14:13:14:14 | access to local variable a3 |
-| E.cs:23:13:23:30 | SSA def(s1) | E.cs:24:33:24:36 | null |
-| E.cs:24:18:24:41 | ... ? ... : ... | E.cs:26:9:27:26 | if (...) ... |
-| E.cs:24:33:24:36 | null | E.cs:24:18:24:41 | ... ? ... : ... |
-| E.cs:26:9:27:26 | if (...) ... | E.cs:27:13:27:14 | access to local variable s1 |
-| E.cs:51:22:51:33 | SSA def(slice) | E.cs:53:16:53:19 | access to local variable iter |
-| E.cs:53:16:53:19 | access to local variable iter | E.cs:54:9:63:9 | {...} |
-| E.cs:54:9:63:9 | {...} | E.cs:61:13:61:17 | access to local variable slice |
-| E.cs:54:9:63:9 | {...} | E.cs:61:13:61:27 | ...; |
-| E.cs:61:13:61:27 | ...; | E.cs:53:16:53:19 | access to local variable iter |
-| E.cs:66:40:66:42 | SSA param(arr) | E.cs:70:13:70:50 | ...; |
-| E.cs:66:40:66:42 | SSA param(arr) | E.cs:72:9:73:23 | if (...) ... |
-| E.cs:70:13:70:50 | ...; | E.cs:70:36:70:36 | 0 |
-| E.cs:70:22:70:49 | ... ? ... : ... | E.cs:72:9:73:23 | if (...) ... |
-| E.cs:70:36:70:36 | 0 | E.cs:70:22:70:49 | ... ? ... : ... |
-| E.cs:72:9:73:23 | if (...) ... | E.cs:73:13:73:15 | access to parameter arr |
-| E.cs:107:15:107:25 | SSA def(arr2) | E.cs:111:9:112:30 | for (...;...;...) ... |
-| E.cs:111:9:112:30 | for (...;...;...) ... | E.cs:111:25:111:25 | access to local variable i |
-| E.cs:111:25:111:25 | access to local variable i | E.cs:112:13:112:16 | access to local variable arr2 |
-| E.cs:111:25:111:25 | access to local variable i | E.cs:112:13:112:30 | ...; |
-| E.cs:112:13:112:30 | ...; | E.cs:111:25:111:25 | access to local variable i |
-| E.cs:120:16:120:20 | [true] !... | E.cs:121:9:143:9 | {...} |
-| E.cs:120:17:120:20 | access to local variable stop | E.cs:120:16:120:20 | [true] !... |
-| E.cs:121:9:143:9 | {...} | E.cs:123:21:123:24 | access to local variable stop |
-| E.cs:123:20:123:24 | [false] !... | E.cs:123:20:123:35 | [false] ... && ... |
-| E.cs:123:20:123:24 | [true] !... | E.cs:123:29:123:29 | access to local variable j |
-| E.cs:123:20:123:35 | [false] ... && ... | E.cs:120:17:120:20 | access to local variable stop |
-| E.cs:123:20:123:35 | [true] ... && ... | E.cs:124:13:142:13 | {...} |
-| E.cs:123:20:123:35 | [true] ... && ... | E.cs:125:33:125:35 | access to local variable obj |
-| E.cs:123:21:123:24 | access to local variable stop | E.cs:123:20:123:24 | [false] !... |
-| E.cs:123:21:123:24 | access to local variable stop | E.cs:123:20:123:24 | [true] !... |
-| E.cs:123:29:123:29 | access to local variable j | E.cs:123:20:123:35 | [false] ... && ... |
-| E.cs:123:29:123:29 | access to local variable j | E.cs:123:20:123:35 | [true] ... && ... |
-| E.cs:124:13:142:13 | {...} | E.cs:128:21:128:23 | access to local variable obj |
-| E.cs:124:13:142:13 | {...} | E.cs:141:17:141:26 | ...; |
-| E.cs:137:25:137:34 | SSA def(obj) | E.cs:139:21:139:29 | continue; |
-| E.cs:139:21:139:29 | continue; | E.cs:123:21:123:24 | access to local variable stop |
-| E.cs:141:17:141:26 | ...; | E.cs:123:21:123:24 | access to local variable stop |
-| E.cs:152:16:152:26 | SSA def(obj2) | E.cs:153:13:153:54 | [false] ... && ... |
-| E.cs:153:13:153:54 | [false] ... && ... | E.cs:158:9:159:28 | if (...) ... |
-| E.cs:158:9:159:28 | if (...) ... | E.cs:159:13:159:16 | access to local variable obj2 |
-| E.cs:162:28:162:28 | SSA param(a) | E.cs:164:29:164:29 | 0 |
-| E.cs:164:17:164:40 | ... ? ... : ... | E.cs:165:25:165:25 | access to local variable i |
-| E.cs:164:29:164:29 | 0 | E.cs:164:17:164:40 | ... ? ... : ... |
-| E.cs:165:25:165:25 | access to local variable i | E.cs:166:9:170:9 | {...} |
-| E.cs:165:25:165:25 | access to local variable i | E.cs:167:21:167:21 | access to parameter a |
-| E.cs:165:32:165:32 | access to local variable i | E.cs:165:25:165:25 | access to local variable i |
-| E.cs:166:9:170:9 | {...} | E.cs:165:32:165:32 | access to local variable i |
-| E.cs:173:29:173:31 | SSA param(obj) | E.cs:175:33:175:37 | false |
-| E.cs:173:29:173:31 | SSA param(obj) | E.cs:175:33:175:37 | false |
-| E.cs:175:19:175:42 | ... ? ... : ... | E.cs:177:9:179:9 | {...} |
-| E.cs:175:19:175:42 | ... ? ... : ... | E.cs:178:13:178:15 | access to parameter obj |
-| E.cs:175:19:175:42 | ... ? ... : ... | E.cs:180:9:183:9 | if (...) ... |
-| E.cs:175:33:175:37 | false | E.cs:175:19:175:42 | ... ? ... : ... |
-| E.cs:177:9:179:9 | {...} | E.cs:180:9:183:9 | if (...) ... |
-| E.cs:180:9:183:9 | if (...) ... | E.cs:181:9:183:9 | {...} |
-| E.cs:181:9:183:9 | {...} | E.cs:184:9:187:9 | if (...) ... |
-| E.cs:184:9:187:9 | if (...) ... | E.cs:186:13:186:15 | access to parameter obj |
-| E.cs:190:29:190:29 | SSA param(o) | E.cs:192:17:192:17 | access to parameter o |
-| E.cs:198:13:198:29 | [b (line 196): false] SSA def(o) | E.cs:203:13:203:13 | access to local variable o |
-| E.cs:198:13:198:29 | [b (line 196): true] SSA def(o) | E.cs:201:13:201:13 | access to local variable o |
-| E.cs:206:28:206:28 | SSA param(s) | E.cs:208:13:208:23 | [false] ... is ... |
-| E.cs:208:13:208:23 | [false] ... is ... | E.cs:210:16:210:16 | access to parameter s |
-| E.cs:217:13:217:20 | [b (line 213): true] SSA def(x) | E.cs:218:9:218:9 | access to local variable x |
-| E.cs:217:13:217:20 | [b (line 213): true] SSA def(x) | E.cs:220:13:220:13 | access to local variable x |
-| E.cs:227:13:227:20 | [b (line 223): true] SSA def(x) | E.cs:229:13:229:13 | access to local variable x |
-| E.cs:227:13:227:20 | [b (line 223): true] SSA def(x) | E.cs:229:13:229:25 | ...; |
-| E.cs:229:13:229:25 | ...; | E.cs:230:9:230:9 | access to local variable x |
-| E.cs:233:26:233:26 | SSA param(i) | E.cs:235:16:235:16 | access to parameter i |
-| E.cs:238:26:238:26 | SSA param(i) | E.cs:240:21:240:21 | access to parameter i |
-| E.cs:283:13:283:22 | [b (line 279): false] SSA def(o) | E.cs:285:9:285:9 | access to local variable o |
-| E.cs:283:13:283:22 | [b (line 279): true] SSA def(o) | E.cs:285:9:285:9 | access to local variable o |
-| E.cs:301:13:301:27 | SSA def(s) | E.cs:302:9:302:9 | access to local variable s |
-| E.cs:319:29:319:30 | SSA param(s1) | E.cs:321:20:321:21 | access to parameter s2 |
-| E.cs:321:13:321:30 | [true] ... is ... | E.cs:323:13:323:14 | access to parameter s1 |
-| E.cs:321:14:321:21 | ... ?? ... | E.cs:321:13:321:30 | [true] ... is ... |
-| E.cs:321:20:321:21 | access to parameter s2 | E.cs:321:14:321:21 | ... ?? ... |
-| E.cs:330:13:330:36 | SSA def(x) | E.cs:331:9:331:9 | access to local variable x |
-| E.cs:342:13:342:32 | SSA def(x) | E.cs:343:9:343:9 | access to local variable x |
-| E.cs:348:17:348:36 | SSA def(x) | E.cs:349:9:349:9 | access to local variable x |
-| E.cs:366:28:366:28 | SSA param(s) | E.cs:366:41:366:41 | access to parameter s |
-| E.cs:374:17:374:31 | SSA def(s) | E.cs:375:20:375:20 | access to local variable s |
-| E.cs:380:24:380:25 | SSA param(e1) | E.cs:382:28:382:29 | access to parameter e2 |
-| E.cs:380:24:380:25 | SSA param(e1) | E.cs:382:28:382:29 | access to parameter e2 |
-| E.cs:380:24:380:25 | SSA param(e1) | E.cs:382:28:382:29 | access to parameter e2 |
-| E.cs:380:30:380:31 | SSA param(e2) | E.cs:382:14:382:37 | [false] ... && ... |
-| E.cs:380:30:380:31 | SSA param(e2) | E.cs:382:14:382:37 | [false] ... && ... |
-| E.cs:380:30:380:31 | SSA param(e2) | E.cs:382:14:382:37 | [false] ... && ... |
-| E.cs:380:30:380:31 | SSA param(e2) | E.cs:382:28:382:29 | access to parameter e2 |
-| E.cs:380:30:380:31 | SSA param(e2) | E.cs:382:28:382:29 | access to parameter e2 |
-| E.cs:380:30:380:31 | SSA param(e2) | E.cs:382:28:382:29 | access to parameter e2 |
-| E.cs:382:13:382:68 | [false] ... \|\| ... | E.cs:384:9:385:24 | if (...) ... |
-| E.cs:382:13:382:68 | [false] ... \|\| ... | E.cs:384:9:385:24 | if (...) ... |
-| E.cs:382:14:382:37 | [false] ... && ... | E.cs:382:44:382:45 | access to parameter e1 |
-| E.cs:382:14:382:37 | [false] ... && ... | E.cs:382:44:382:45 | access to parameter e1 |
-| E.cs:382:28:382:29 | access to parameter e2 | E.cs:382:14:382:37 | [false] ... && ... |
-| E.cs:382:28:382:29 | access to parameter e2 | E.cs:382:14:382:37 | [false] ... && ... |
-| E.cs:382:44:382:45 | access to parameter e1 | E.cs:382:44:382:67 | [false] ... && ... |
-| E.cs:382:44:382:45 | access to parameter e1 | E.cs:382:44:382:67 | [false] ... && ... |
-| E.cs:382:44:382:67 | [false] ... && ... | E.cs:382:13:382:68 | [false] ... \|\| ... |
-| E.cs:382:44:382:67 | [false] ... && ... | E.cs:382:13:382:68 | [false] ... \|\| ... |
-| E.cs:384:9:385:24 | if (...) ... | E.cs:384:13:384:36 | [false] ... && ... |
-| E.cs:384:9:385:24 | if (...) ... | E.cs:384:27:384:28 | access to parameter e2 |
-| E.cs:384:13:384:36 | [false] ... && ... | E.cs:386:16:386:17 | access to parameter e1 |
-| E.cs:384:13:384:36 | [false] ... && ... | E.cs:386:27:386:28 | access to parameter e2 |
-| E.cs:384:27:384:28 | access to parameter e2 | E.cs:384:13:384:36 | [false] ... && ... |
-| E.cs:404:9:404:18 | SSA def(i) | E.cs:405:16:405:16 | access to local variable i |
-| E.cs:404:9:404:18 | SSA def(i) | E.cs:405:16:405:16 | access to local variable i |
-| E.cs:417:24:417:40 | SSA capture def(i) | E.cs:417:34:417:34 | access to parameter i |
-| E.cs:423:28:423:44 | SSA capture def(i) | E.cs:423:38:423:38 | access to parameter i |
-| E.cs:430:29:430:45 | SSA capture def(i) | E.cs:430:39:430:39 | access to parameter i |
-| E.cs:435:29:435:29 | SSA param(s) | E.cs:437:13:437:21 | [true] ... is ... |
-| E.cs:437:13:437:21 | [true] ... is ... | E.cs:439:13:439:13 | access to parameter s |
-| Forwarding.cs:7:16:7:23 | SSA def(s) | Forwarding.cs:9:13:9:30 | [false] !... |
-| Forwarding.cs:9:13:9:30 | [false] !... | Forwarding.cs:14:9:17:9 | if (...) ... |
-| Forwarding.cs:14:9:17:9 | if (...) ... | Forwarding.cs:19:9:22:9 | if (...) ... |
-| Forwarding.cs:19:9:22:9 | if (...) ... | Forwarding.cs:19:13:19:23 | [false] !... |
-| Forwarding.cs:19:13:19:23 | [false] !... | Forwarding.cs:24:9:27:9 | if (...) ... |
-| Forwarding.cs:24:9:27:9 | if (...) ... | Forwarding.cs:29:9:32:9 | if (...) ... |
-| Forwarding.cs:29:9:32:9 | if (...) ... | Forwarding.cs:34:9:37:9 | if (...) ... |
-| Forwarding.cs:34:9:37:9 | if (...) ... | Forwarding.cs:35:9:37:9 | {...} |
-| Forwarding.cs:34:9:37:9 | if (...) ... | Forwarding.cs:36:31:36:31 | access to local variable s |
-| Forwarding.cs:35:9:37:9 | {...} | Forwarding.cs:40:27:40:27 | access to local variable s |
-| GuardedString.cs:7:16:7:32 | SSA def(s) | GuardedString.cs:9:13:9:36 | [false] !... |
-| GuardedString.cs:9:13:9:36 | [false] !... | GuardedString.cs:14:9:17:9 | if (...) ... |
-| GuardedString.cs:14:9:17:9 | if (...) ... | GuardedString.cs:14:13:14:41 | [false] !... |
-| GuardedString.cs:14:13:14:41 | [false] !... | GuardedString.cs:19:9:20:40 | if (...) ... |
-| GuardedString.cs:19:9:20:40 | if (...) ... | GuardedString.cs:19:26:19:26 | 0 |
-| GuardedString.cs:19:26:19:26 | 0 | GuardedString.cs:22:9:23:40 | if (...) ... |
-| GuardedString.cs:22:9:23:40 | if (...) ... | GuardedString.cs:22:25:22:25 | 0 |
-| GuardedString.cs:22:25:22:25 | 0 | GuardedString.cs:25:9:26:40 | if (...) ... |
-| GuardedString.cs:25:9:26:40 | if (...) ... | GuardedString.cs:25:26:25:26 | 0 |
-| GuardedString.cs:25:26:25:26 | 0 | GuardedString.cs:28:9:29:40 | if (...) ... |
-| GuardedString.cs:28:9:29:40 | if (...) ... | GuardedString.cs:28:25:28:26 | 10 |
-| GuardedString.cs:28:25:28:26 | 10 | GuardedString.cs:31:9:32:40 | if (...) ... |
-| GuardedString.cs:31:9:32:40 | if (...) ... | GuardedString.cs:31:26:31:27 | 10 |
-| GuardedString.cs:31:26:31:27 | 10 | GuardedString.cs:34:9:37:40 | if (...) ... |
-| GuardedString.cs:34:9:37:40 | if (...) ... | GuardedString.cs:34:26:34:26 | 0 |
-| GuardedString.cs:34:26:34:26 | 0 | GuardedString.cs:35:31:35:31 | access to local variable s |
-| NullAlwaysBad.cs:7:29:7:29 | SSA param(s) | NullAlwaysBad.cs:9:30:9:30 | access to parameter s |
-| NullMaybeBad.cs:13:17:13:20 | null | NullMaybeBad.cs:7:27:7:27 | access to parameter o |
-| Params.cs:20:12:20:15 | null | Params.cs:14:17:14:20 | access to parameter args |
-| StringConcatenation.cs:14:16:14:23 | SSA def(s) | StringConcatenation.cs:15:16:15:16 | access to local variable s |
-| StringConcatenation.cs:15:16:15:16 | access to local variable s | StringConcatenation.cs:16:17:16:17 | access to local variable s |
-#select
-| C.cs:64:9:64:10 | access to local variable o1 | C.cs:62:13:62:46 | SSA def(o1) | C.cs:64:9:64:10 | access to local variable o1 | Variable $@ may be null at this access because of $@ assignment. | C.cs:62:13:62:14 | o1 | o1 | C.cs:62:13:62:46 | Object o1 = ... | this |
-| C.cs:68:9:68:10 | access to local variable o2 | C.cs:66:13:66:46 | SSA def(o2) | C.cs:68:9:68:10 | access to local variable o2 | Variable $@ may be null at this access because of $@ assignment. | C.cs:66:13:66:14 | o2 | o2 | C.cs:66:13:66:46 | Object o2 = ... | this |
-| C.cs:95:15:95:15 | access to local variable o | C.cs:94:13:94:45 | SSA def(o) | C.cs:95:15:95:15 | access to local variable o | Variable $@ may be null at this access because of $@ assignment. | C.cs:94:13:94:13 | o | o | C.cs:94:13:94:45 | Object o = ... | this |
-| C.cs:103:27:103:30 | access to parameter list | C.cs:102:13:102:23 | SSA def(list) | C.cs:103:27:103:30 | access to parameter list | Variable $@ may be null at this access because of $@ assignment. | C.cs:99:42:99:45 | list | list | C.cs:102:13:102:23 | ... = ... | this |
-| C.cs:177:13:177:13 | access to local variable s | C.cs:178:13:178:20 | SSA def(s) | C.cs:177:13:177:13 | access to local variable s | Variable $@ may be null at this access because of $@ assignment. | C.cs:151:13:151:13 | s | s | C.cs:178:13:178:20 | ... = ... | this |
-| C.cs:203:13:203:13 | access to local variable s | C.cs:204:13:204:20 | SSA def(s) | C.cs:203:13:203:13 | access to local variable s | Variable $@ may be null at this access because of $@ assignment. | C.cs:185:13:185:13 | s | s | C.cs:204:13:204:20 | ... = ... | this |
-| C.cs:223:9:223:9 | access to local variable s | C.cs:222:13:222:20 | SSA def(s) | C.cs:223:9:223:9 | access to local variable s | Variable $@ may be null at this access because of $@ assignment. | C.cs:210:13:210:13 | s | s | C.cs:222:13:222:20 | ... = ... | this |
-| C.cs:242:13:242:13 | access to local variable s | C.cs:240:24:240:31 | SSA def(s) | C.cs:242:13:242:13 | access to local variable s | Variable $@ may be null at this access because of $@ assignment. | C.cs:228:16:228:16 | s | s | C.cs:240:24:240:31 | ... = ... | this |
-| D.cs:23:9:23:13 | access to parameter param | D.cs:17:17:17:20 | null | D.cs:23:9:23:13 | access to parameter param | Variable $@ may be null at this access because of $@ null argument. | D.cs:21:32:21:36 | param | param | D.cs:17:17:17:20 | null | this |
-| D.cs:32:9:32:13 | access to parameter param | D.cs:26:32:26:36 | SSA param(param) | D.cs:32:9:32:13 | access to parameter param | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:26:32:26:36 | param | param | D.cs:28:13:28:25 | ... != ... | this |
-| D.cs:62:13:62:14 | access to local variable o5 | D.cs:58:13:58:41 | SSA def(o5) | D.cs:62:13:62:14 | access to local variable o5 | Variable $@ may be null at this access because of $@ assignment. | D.cs:58:13:58:14 | o5 | o5 | D.cs:58:13:58:41 | String o5 = ... | this |
-| D.cs:73:13:73:14 | access to local variable o7 | D.cs:68:13:68:34 | SSA def(o7) | D.cs:73:13:73:14 | access to local variable o7 | Variable $@ may be null at this access because of $@ assignment. | D.cs:68:13:68:14 | o7 | o7 | D.cs:68:13:68:34 | String o7 = ... | this |
-| D.cs:82:13:82:14 | access to local variable o8 | D.cs:75:13:75:34 | SSA def(o8) | D.cs:82:13:82:14 | access to local variable o8 | Variable $@ may be null at this access because of $@ assignment. | D.cs:75:13:75:14 | o8 | o8 | D.cs:75:13:75:34 | String o8 = ... | this |
-| D.cs:84:13:84:14 | access to local variable o8 | D.cs:75:13:75:34 | SSA def(o8) | D.cs:84:13:84:14 | access to local variable o8 | Variable $@ may be null at this access because of $@ assignment. | D.cs:75:13:75:14 | o8 | o8 | D.cs:75:13:75:34 | String o8 = ... | this |
-| D.cs:91:13:91:14 | access to local variable xs | D.cs:89:15:89:44 | SSA def(xs) | D.cs:91:13:91:14 | access to local variable xs | Variable $@ may be null at this access because of $@ assignment. | D.cs:89:15:89:16 | xs | xs | D.cs:89:15:89:44 | Int32[] xs = ... | this |
-| D.cs:94:21:94:22 | access to local variable xs | D.cs:89:15:89:44 | SSA def(xs) | D.cs:94:21:94:22 | access to local variable xs | Variable $@ may be null at this access because of $@ assignment. | D.cs:89:15:89:16 | xs | xs | D.cs:89:15:89:44 | Int32[] xs = ... | this |
-| D.cs:98:21:98:22 | access to local variable xs | D.cs:89:15:89:44 | SSA def(xs) | D.cs:98:21:98:22 | access to local variable xs | Variable $@ may be null at this access because of $@ assignment. | D.cs:89:15:89:16 | xs | xs | D.cs:89:15:89:44 | Int32[] xs = ... | this |
-| D.cs:102:31:102:32 | access to local variable xs | D.cs:89:15:89:44 | SSA def(xs) | D.cs:102:31:102:32 | access to local variable xs | Variable $@ may be null at this access because of $@ assignment. | D.cs:89:15:89:16 | xs | xs | D.cs:89:15:89:44 | Int32[] xs = ... | this |
-| D.cs:105:19:105:20 | access to local variable xs | D.cs:89:15:89:44 | SSA def(xs) | D.cs:105:19:105:20 | access to local variable xs | Variable $@ may be null at this access because of $@ assignment. | D.cs:89:15:89:16 | xs | xs | D.cs:89:15:89:44 | Int32[] xs = ... | this |
-| D.cs:134:24:134:24 | access to parameter a | D.cs:125:35:125:35 | SSA param(a) | D.cs:134:24:134:24 | access to parameter a | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:125:35:125:35 | a | a | D.cs:127:20:127:28 | ... == ... | this |
-| D.cs:134:24:134:24 | access to parameter a | D.cs:125:35:125:35 | SSA param(a) | D.cs:134:24:134:24 | access to parameter a | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:125:35:125:35 | a | a | D.cs:139:13:139:21 | ... != ... | this |
-| D.cs:135:24:135:24 | access to parameter b | D.cs:125:44:125:44 | SSA param(b) | D.cs:135:24:135:24 | access to parameter b | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:125:44:125:44 | b | b | D.cs:128:20:128:28 | ... == ... | this |
-| D.cs:145:20:145:20 | access to parameter a | D.cs:125:35:125:35 | SSA param(a) | D.cs:145:20:145:20 | access to parameter a | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:125:35:125:35 | a | a | D.cs:127:20:127:28 | ... == ... | this |
-| D.cs:145:20:145:20 | access to parameter a | D.cs:125:35:125:35 | SSA param(a) | D.cs:145:20:145:20 | access to parameter a | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:125:35:125:35 | a | a | D.cs:139:13:139:21 | ... != ... | this |
-| D.cs:151:9:151:11 | access to parameter obj | D.cs:149:36:149:38 | SSA param(obj) | D.cs:151:9:151:11 | access to parameter obj | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:149:36:149:38 | obj | obj | D.cs:152:17:152:27 | ... != ... | this |
-| D.cs:171:9:171:11 | access to local variable obj | D.cs:163:16:163:25 | SSA def(obj) | D.cs:171:9:171:11 | access to local variable obj | Variable $@ may be null at this access because of $@ assignment. | D.cs:163:16:163:18 | obj | obj | D.cs:163:16:163:25 | Object obj = ... | this |
-| D.cs:245:13:245:13 | access to local variable o | D.cs:240:9:240:16 | SSA def(o) | D.cs:245:13:245:13 | access to local variable o | Variable $@ may be null at this access because of $@ assignment. | D.cs:228:16:228:16 | o | o | D.cs:240:9:240:16 | ... = ... | this |
-| D.cs:247:13:247:13 | access to local variable o | D.cs:240:9:240:16 | SSA def(o) | D.cs:247:13:247:13 | access to local variable o | Variable $@ may be null at this access because of $@ assignment. | D.cs:228:16:228:16 | o | o | D.cs:240:9:240:16 | ... = ... | this |
-| D.cs:253:13:253:14 | access to local variable o2 | D.cs:249:13:249:38 | SSA def(o2) | D.cs:253:13:253:14 | access to local variable o2 | Variable $@ may be null at this access because of $@ assignment. | D.cs:249:13:249:14 | o2 | o2 | D.cs:249:13:249:38 | String o2 = ... | this |
-| D.cs:267:13:267:13 | access to local variable o | D.cs:258:16:258:23 | SSA def(o) | D.cs:267:13:267:13 | access to local variable o | Variable $@ may be null at this access because of $@ assignment. | D.cs:258:16:258:16 | o | o | D.cs:258:16:258:23 | Object o = ... | this |
-| D.cs:291:13:291:13 | access to local variable o | D.cs:269:9:269:16 | SSA def(o) | D.cs:291:13:291:13 | access to local variable o | Variable $@ may be null at this access because of $@ assignment. | D.cs:258:16:258:16 | o | o | D.cs:269:9:269:16 | ... = ... | this |
-| D.cs:291:13:291:13 | access to local variable o | D.cs:283:17:283:24 | SSA def(o) | D.cs:291:13:291:13 | access to local variable o | Variable $@ may be null at this access because of $@ assignment. | D.cs:258:16:258:16 | o | o | D.cs:283:17:283:24 | ... = ... | this |
-| D.cs:294:13:294:13 | access to local variable o | D.cs:269:9:269:16 | SSA def(o) | D.cs:294:13:294:13 | access to local variable o | Variable $@ may be null at this access because of $@ assignment. | D.cs:258:16:258:16 | o | o | D.cs:269:9:269:16 | ... = ... | this |
-| D.cs:294:13:294:13 | access to local variable o | D.cs:283:17:283:24 | SSA def(o) | D.cs:294:13:294:13 | access to local variable o | Variable $@ may be null at this access because of $@ assignment. | D.cs:258:16:258:16 | o | o | D.cs:283:17:283:24 | ... = ... | this |
-| D.cs:300:17:300:20 | access to local variable prev | D.cs:296:16:296:26 | SSA def(prev) | D.cs:300:17:300:20 | access to local variable prev | Variable $@ may be null at this access because of $@ assignment. | D.cs:296:16:296:19 | prev | prev | D.cs:296:16:296:26 | Object prev = ... | this |
-| D.cs:313:17:313:17 | access to local variable s | D.cs:304:16:304:23 | SSA def(s) | D.cs:313:17:313:17 | access to local variable s | Variable $@ may be null at this access because of $@ assignment. | D.cs:304:16:304:16 | s | s | D.cs:304:16:304:23 | String s = ... | this |
-| D.cs:324:9:324:9 | access to local variable r | D.cs:316:16:316:23 | SSA def(r) | D.cs:324:9:324:9 | access to local variable r | Variable $@ may be null at this access because of $@ assignment. | D.cs:316:16:316:16 | r | r | D.cs:316:16:316:23 | Object r = ... | this |
-| D.cs:356:13:356:13 | access to local variable a | D.cs:351:15:351:22 | SSA def(a) | D.cs:356:13:356:13 | access to local variable a | Variable $@ may be null at this access because of $@ assignment. | D.cs:351:15:351:15 | a | a | D.cs:351:15:351:22 | Int32[] a = ... | this |
-| D.cs:363:13:363:16 | access to local variable last | D.cs:360:20:360:30 | SSA def(last) | D.cs:363:13:363:16 | access to local variable last | Variable $@ may be null at this access because of $@ assignment. | D.cs:360:20:360:23 | last | last | D.cs:360:20:360:30 | String last = ... | this |
-| D.cs:372:13:372:13 | access to local variable b | D.cs:366:15:366:47 | SSA def(b) | D.cs:372:13:372:13 | access to local variable b | Variable $@ may be null at this access because of $@ assignment. | D.cs:366:15:366:15 | b | b | D.cs:366:15:366:47 | Int32[] b = ... | this |
-| D.cs:395:20:395:20 | access to parameter a | D.cs:388:36:388:36 | SSA param(a) | D.cs:395:20:395:20 | access to parameter a | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:388:36:388:36 | a | a | D.cs:390:20:390:28 | ... == ... | this |
-| D.cs:400:20:400:20 | access to parameter b | D.cs:388:45:388:45 | SSA param(b) | D.cs:400:20:400:20 | access to parameter b | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:388:45:388:45 | b | b | D.cs:397:20:397:28 | ... == ... | this |
-| D.cs:410:13:410:13 | access to parameter y | D.cs:405:45:405:45 | SSA param(y) | D.cs:410:13:410:13 | access to parameter y | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:405:45:405:45 | y | y | D.cs:407:27:407:35 | ... == ... | this |
-| D.cs:410:13:410:13 | access to parameter y | D.cs:405:45:405:45 | SSA param(y) | D.cs:410:13:410:13 | access to parameter y | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:405:45:405:45 | y | y | D.cs:407:55:407:63 | ... != ... | this |
-| D.cs:410:13:410:13 | access to parameter y | D.cs:405:45:405:45 | SSA param(y) | D.cs:410:13:410:13 | access to parameter y | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:405:45:405:45 | y | y | D.cs:411:13:411:21 | ... != ... | this |
-| D.cs:412:13:412:13 | access to parameter x | D.cs:405:35:405:35 | SSA param(x) | D.cs:412:13:412:13 | access to parameter x | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:405:35:405:35 | x | x | D.cs:407:14:407:22 | ... != ... | this |
-| D.cs:412:13:412:13 | access to parameter x | D.cs:405:35:405:35 | SSA param(x) | D.cs:412:13:412:13 | access to parameter x | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:405:35:405:35 | x | x | D.cs:407:42:407:50 | ... == ... | this |
-| D.cs:412:13:412:13 | access to parameter x | D.cs:405:35:405:35 | SSA param(x) | D.cs:412:13:412:13 | access to parameter x | Variable $@ may be null at this access as suggested by $@ null check. | D.cs:405:35:405:35 | x | x | D.cs:409:13:409:21 | ... != ... | this |
-| E.cs:12:38:12:39 | access to local variable a2 | E.cs:9:18:9:26 | SSA def(a2) | E.cs:12:38:12:39 | access to local variable a2 | Variable $@ may be null at this access because of $@ assignment. | E.cs:9:18:9:19 | a2 | a2 | E.cs:9:18:9:26 | Int64[][] a2 = ... | this |
-| E.cs:14:13:14:14 | access to local variable a3 | E.cs:11:16:11:24 | SSA def(a3) | E.cs:14:13:14:14 | access to local variable a3 | Variable $@ may be null at this access because of $@ assignment. | E.cs:11:16:11:17 | a3 | a3 | E.cs:11:16:11:24 | Int64[] a3 = ... | this |
-| E.cs:27:13:27:14 | access to local variable s1 | E.cs:23:13:23:30 | SSA def(s1) | E.cs:27:13:27:14 | access to local variable s1 | Variable $@ may be null at this access because of $@ assignment. | E.cs:19:13:19:14 | s1 | s1 | E.cs:23:13:23:30 | ... = ... | this |
-| E.cs:61:13:61:17 | access to local variable slice | E.cs:51:22:51:33 | SSA def(slice) | E.cs:61:13:61:17 | access to local variable slice | Variable $@ may be null at this access because of $@ assignment. | E.cs:51:22:51:26 | slice | slice | E.cs:51:22:51:33 | List<String> slice = ... | this |
-| E.cs:73:13:73:15 | access to parameter arr | E.cs:66:40:66:42 | SSA param(arr) | E.cs:73:13:73:15 | access to parameter arr | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:66:40:66:42 | arr | arr | E.cs:70:22:70:32 | ... == ... | this |
-| E.cs:112:13:112:16 | access to local variable arr2 | E.cs:107:15:107:25 | SSA def(arr2) | E.cs:112:13:112:16 | access to local variable arr2 | Variable $@ may be null at this access because of $@ assignment. | E.cs:107:15:107:18 | arr2 | arr2 | E.cs:107:15:107:25 | Int32[] arr2 = ... | this |
-| E.cs:125:33:125:35 | access to local variable obj | E.cs:137:25:137:34 | SSA def(obj) | E.cs:125:33:125:35 | access to local variable obj | Variable $@ may be null at this access because of $@ assignment. | E.cs:119:13:119:15 | obj | obj | E.cs:137:25:137:34 | ... = ... | this |
-| E.cs:159:13:159:16 | access to local variable obj2 | E.cs:152:16:152:26 | SSA def(obj2) | E.cs:159:13:159:16 | access to local variable obj2 | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:152:16:152:19 | obj2 | obj2 | E.cs:153:13:153:24 | ... != ... | this |
-| E.cs:167:21:167:21 | access to parameter a | E.cs:162:28:162:28 | SSA param(a) | E.cs:167:21:167:21 | access to parameter a | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:162:28:162:28 | a | a | E.cs:164:17:164:25 | ... == ... | this |
-| E.cs:178:13:178:15 | access to parameter obj | E.cs:173:29:173:31 | SSA param(obj) | E.cs:178:13:178:15 | access to parameter obj | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:173:29:173:31 | obj | obj | E.cs:175:19:175:29 | ... == ... | this |
-| E.cs:178:13:178:15 | access to parameter obj | E.cs:173:29:173:31 | SSA param(obj) | E.cs:178:13:178:15 | access to parameter obj | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:173:29:173:31 | obj | obj | E.cs:180:13:180:23 | ... == ... | this |
-| E.cs:186:13:186:15 | access to parameter obj | E.cs:173:29:173:31 | SSA param(obj) | E.cs:186:13:186:15 | access to parameter obj | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:173:29:173:31 | obj | obj | E.cs:175:19:175:29 | ... == ... | this |
-| E.cs:186:13:186:15 | access to parameter obj | E.cs:173:29:173:31 | SSA param(obj) | E.cs:186:13:186:15 | access to parameter obj | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:173:29:173:31 | obj | obj | E.cs:180:13:180:23 | ... == ... | this |
-| E.cs:192:17:192:17 | access to parameter o | E.cs:190:29:190:29 | SSA param(o) | E.cs:192:17:192:17 | access to parameter o | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:190:29:190:29 | o | o | E.cs:193:17:193:17 | access to parameter o | this |
-| E.cs:201:13:201:13 | access to local variable o | E.cs:198:13:198:29 | [b (line 196): true] SSA def(o) | E.cs:201:13:201:13 | access to local variable o | Variable $@ may be null at this access because of $@ assignment. | E.cs:198:13:198:13 | o | o | E.cs:198:13:198:29 | String o = ... | this |
-| E.cs:203:13:203:13 | access to local variable o | E.cs:198:13:198:29 | [b (line 196): false] SSA def(o) | E.cs:203:13:203:13 | access to local variable o | Variable $@ may be null at this access because of $@ assignment. | E.cs:198:13:198:13 | o | o | E.cs:198:13:198:29 | String o = ... | this |
-| E.cs:218:9:218:9 | access to local variable x | E.cs:217:13:217:20 | [b (line 213): true] SSA def(x) | E.cs:218:9:218:9 | access to local variable x | Variable $@ may be null at this access because of $@ assignment. | E.cs:215:13:215:13 | x | x | E.cs:217:13:217:20 | ... = ... | this |
-| E.cs:230:9:230:9 | access to local variable x | E.cs:227:13:227:20 | [b (line 223): true] SSA def(x) | E.cs:230:9:230:9 | access to local variable x | Variable $@ may be null at this access because of $@ assignment. | E.cs:225:13:225:13 | x | x | E.cs:227:13:227:20 | ... = ... | this |
-| E.cs:235:16:235:16 | access to parameter i | E.cs:233:26:233:26 | SSA param(i) | E.cs:235:16:235:16 | access to parameter i | Variable $@ may be null at this access because it has a nullable type. | E.cs:233:26:233:26 | i | i | E.cs:233:26:233:26 | i | this |
-| E.cs:240:21:240:21 | access to parameter i | E.cs:238:26:238:26 | SSA param(i) | E.cs:240:21:240:21 | access to parameter i | Variable $@ may be null at this access because it has a nullable type. | E.cs:238:26:238:26 | i | i | E.cs:238:26:238:26 | i | this |
-| E.cs:285:9:285:9 | access to local variable o | E.cs:283:13:283:22 | [b (line 279): false] SSA def(o) | E.cs:285:9:285:9 | access to local variable o | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:283:13:283:13 | o | o | E.cs:284:9:284:9 | access to local variable o | this |
-| E.cs:285:9:285:9 | access to local variable o | E.cs:283:13:283:22 | [b (line 279): true] SSA def(o) | E.cs:285:9:285:9 | access to local variable o | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:283:13:283:13 | o | o | E.cs:284:9:284:9 | access to local variable o | this |
-| E.cs:302:9:302:9 | access to local variable s | E.cs:301:13:301:27 | SSA def(s) | E.cs:302:9:302:9 | access to local variable s | Variable $@ may be null at this access because of $@ assignment. | E.cs:301:13:301:13 | s | s | E.cs:301:13:301:27 | String s = ... | this |
-| E.cs:343:9:343:9 | access to local variable x | E.cs:342:13:342:32 | SSA def(x) | E.cs:343:9:343:9 | access to local variable x | Variable $@ may be null at this access because of $@ assignment. | E.cs:342:13:342:13 | x | x | E.cs:342:13:342:32 | String x = ... | this |
-| E.cs:349:9:349:9 | access to local variable x | E.cs:348:17:348:36 | SSA def(x) | E.cs:349:9:349:9 | access to local variable x | Variable $@ may be null at this access because of $@ assignment. | E.cs:348:17:348:17 | x | x | E.cs:348:17:348:36 | dynamic x = ... | this |
-| E.cs:366:41:366:41 | access to parameter s | E.cs:366:28:366:28 | SSA param(s) | E.cs:366:41:366:41 | access to parameter s | Variable $@ may be null at this access because the parameter has a null default value. | E.cs:366:28:366:28 | s | s | E.cs:366:32:366:35 | null | this |
-| E.cs:375:20:375:20 | access to local variable s | E.cs:374:17:374:31 | SSA def(s) | E.cs:375:20:375:20 | access to local variable s | Variable $@ may be null at this access because of $@ assignment. | E.cs:374:17:374:17 | s | s | E.cs:374:17:374:31 | String s = ... | this |
-| E.cs:386:16:386:17 | access to parameter e1 | E.cs:380:24:380:25 | SSA param(e1) | E.cs:386:16:386:17 | access to parameter e1 | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:380:24:380:25 | e1 | e1 | E.cs:382:14:382:23 | ... == ... | this |
-| E.cs:386:16:386:17 | access to parameter e1 | E.cs:380:24:380:25 | SSA param(e1) | E.cs:386:16:386:17 | access to parameter e1 | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:380:24:380:25 | e1 | e1 | E.cs:382:44:382:53 | ... != ... | this |
-| E.cs:386:16:386:17 | access to parameter e1 | E.cs:380:24:380:25 | SSA param(e1) | E.cs:386:16:386:17 | access to parameter e1 | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:380:24:380:25 | e1 | e1 | E.cs:384:13:384:22 | ... == ... | this |
-| E.cs:386:27:386:28 | access to parameter e2 | E.cs:380:30:380:31 | SSA param(e2) | E.cs:386:27:386:28 | access to parameter e2 | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:380:30:380:31 | e2 | e2 | E.cs:382:28:382:37 | ... != ... | this |
-| E.cs:386:27:386:28 | access to parameter e2 | E.cs:380:30:380:31 | SSA param(e2) | E.cs:386:27:386:28 | access to parameter e2 | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:380:30:380:31 | e2 | e2 | E.cs:382:58:382:67 | ... == ... | this |
-| E.cs:386:27:386:28 | access to parameter e2 | E.cs:380:30:380:31 | SSA param(e2) | E.cs:386:27:386:28 | access to parameter e2 | Variable $@ may be null at this access as suggested by $@ null check. | E.cs:380:30:380:31 | e2 | e2 | E.cs:384:27:384:36 | ... == ... | this |
-| E.cs:417:34:417:34 | access to parameter i | E.cs:417:24:417:40 | SSA capture def(i) | E.cs:417:34:417:34 | access to parameter i | Variable $@ may be null at this access because it has a nullable type. | E.cs:415:27:415:27 | i | i | E.cs:415:27:415:27 | i | this |
-| E.cs:423:38:423:38 | access to parameter i | E.cs:423:28:423:44 | SSA capture def(i) | E.cs:423:38:423:38 | access to parameter i | Variable $@ may be null at this access because it has a nullable type. | E.cs:420:27:420:27 | i | i | E.cs:420:27:420:27 | i | this |
-| E.cs:430:39:430:39 | access to parameter i | E.cs:430:29:430:45 | SSA capture def(i) | E.cs:430:39:430:39 | access to parameter i | Variable $@ may be null at this access because it has a nullable type. | E.cs:427:27:427:27 | i | i | E.cs:427:27:427:27 | i | this |
-| GuardedString.cs:35:31:35:31 | access to local variable s | GuardedString.cs:7:16:7:32 | SSA def(s) | GuardedString.cs:35:31:35:31 | access to local variable s | Variable $@ may be null at this access because of $@ assignment. | GuardedString.cs:7:16:7:16 | s | s | GuardedString.cs:7:16:7:32 | String s = ... | this |
-| NullMaybeBad.cs:7:27:7:27 | access to parameter o | NullMaybeBad.cs:13:17:13:20 | null | NullMaybeBad.cs:7:27:7:27 | access to parameter o | Variable $@ may be null at this access because of $@ null argument. | NullMaybeBad.cs:5:25:5:25 | o | o | NullMaybeBad.cs:13:17:13:20 | null | this |
-| Params.cs:14:17:14:20 | access to parameter args | Params.cs:20:12:20:15 | null | Params.cs:14:17:14:20 | access to parameter args | Variable $@ may be null at this access because of $@ null argument. | Params.cs:12:36:12:39 | args | args | Params.cs:20:12:20:15 | null | this |
-| StringConcatenation.cs:16:17:16:17 | access to local variable s | StringConcatenation.cs:14:16:14:23 | SSA def(s) | StringConcatenation.cs:16:17:16:17 | access to local variable s | Variable $@ may be null at this access because of $@ assignment. | StringConcatenation.cs:14:16:14:16 | s | s | StringConcatenation.cs:14:16:14:23 | String s = ... | this |

csharp/ql/test/query-tests/Nullness/NullMaybe.qlref

@@ -1 +1,2 @@
-CSI/NullMaybe.ql
+query: CSI/NullMaybe.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

csharp/ql/test/query-tests/Nullness/NullMaybeBad.cs

@@ -4,12 +4,12 @@ class Bad
 {
     void DoPrint(object o)
     {
-        Console.WriteLine(o.ToString());
+        Console.WriteLine(o.ToString()); // $ Alert[cs/dereferenced-value-may-be-null]
     }
 
     void M()
     {
         DoPrint("Hello");
-        DoPrint(null);
+        DoPrint(null); // $ Source[cs/dereferenced-value-may-be-null]
     }
 }

csharp/ql/test/query-tests/Nullness/Params.cs

@@ -11,12 +11,12 @@ public class Params
 
     public void M2(params string[] args)
     {
-        var l = args.Length; // Good
+        var l = args.Length; // $ SPURIOUS (false positive): Alert[cs/dereferenced-value-may-be-null]
     }
 
     public void M()
     {
         M1("a", "b", "c", null);
-        M2(null);
+        M2(null); // $ Source[cs/dereferenced-value-may-be-null]
     }
-}
+}

csharp/ql/test/query-tests/Nullness/StringConcatenation.cs

@@ -11,9 +11,9 @@ class StringsTest
 
     void StringMaybeNull()
     {
-        string s = null;
+        string s = null; // $ Source[cs/dereferenced-value-may-be-null]
         while (s != "")
-            s = s.Trim(); // BAD (maybe)
+            s = s.Trim(); // $ Alert[cs/dereferenced-value-may-be-null]
     }
 
     void StringNotNull()

csharp/ql/test/query-tests/Nullness/options

@@ -1,3 +1,4 @@
 semmle-extractor-options: /nostdlib /noconfig
 semmle-extractor-options: --load-sources-from-project:${testdir}/../../resources/stubs/_frameworks/Microsoft.NETCore.App/Microsoft.NETCore.App.csproj
-semmle-extractor-options: ${testdir}/../../resources/stubs/Microsoft.VisualStudio.TestTools.UnitTesting.cs
+semmle-extractor-options: ${testdir}/../../resources/stubs/Microsoft.VisualStudio.TestTools.UnitTesting.cs
+semmle-extractor-options: ${testdir}/../../resources/stubs/Library.cs

csharp/ql/test/resources/stubs/Library.cs

@@ -0,0 +1,13 @@
+namespace Library;
+
+/*
+ * This file is for making stubs for library methods used for testing purposes.
+ * The file is located in the stubs folder, because then the code is not
+ * recognized as being from source.
+ */
+public static class MyExtensions
+{
+    public static void Accept(this object o) { }
+
+    public static void AcceptNullable(this object? o) { }
+}

docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.19.4.rst

@@ -79,4 +79,4 @@ JavaScript/TypeScript
 *   Added taint-steps for :code:`Array.prototype.toReversed`.
 *   Added taint-steps for :code:`Array.prototype.toSorted`.
 *   Added support for :code:`String.prototype.matchAll`.
-*   Added taint-steps for :code:`Array.prototype.reverse`.
+*   Added taint-steps for :code:`Array.prototype.reverse`. 

docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.22.0.rst

@@ -0,0 +1,82 @@
+.. _codeql-cli-2.22.0:
+
+==========================
+CodeQL 2.22.0 (2025-06-11)
+==========================
+
+.. contents:: Contents
+   :depth: 2
+   :local:
+   :backlinks: none
+
+This is an overview of changes in the CodeQL CLI and relevant CodeQL query and library packs. For additional updates on changes to the CodeQL code scanning experience, check out the `code scanning section on the GitHub blog <https://github.blog/tag/code-scanning/>`__, `relevant GitHub Changelog updates <https://github.blog/changelog/label/code-scanning/>`__, `changes in the CodeQL extension for Visual Studio Code <https://marketplace.visualstudio.com/items/GitHub.vscode-codeql/changelog>`__, and the `CodeQL Action changelog <https://github.com/github/codeql-action/blob/main/CHANGELOG.md>`__.
+
+Security Coverage
+-----------------
+
+CodeQL 2.22.0 runs a total of 450 security queries when configured with the Default suite (covering 165 CWE). The Extended suite enables an additional 128 queries (covering 33 more CWE). 1 security query has been added with this release.
+
+CodeQL CLI
+----------
+
+Breaking Changes
+~~~~~~~~~~~~~~~~
+
+*   A number of breaking changes have been made to the C and C++ CodeQL test environment as used by :code:`codeql test run`\ :
+
+    *   Options starting with a :code:`/` are no longer supported by
+        :code:`semmle-extractor-options`. Any option starting with a :code:`/` should be replaced by the equivalent option starting with a :code:`-`, e.g., :code:`/D` should be replaced by :code:`-D`.
+    *   Preprocessor command line options of the form :code:`-D<macro>#<def>` are no longer supported by :code:`semmle-extractor-options`. :code:`-D<macro>=<def>` should be used instead.
+    *   The :code:`/Fp` and :code:`-o` options are no longer supported by
+        :code:`semmle-extractor-options`. The options should be omitted.
+    *   The :code:`-emit-pch`, :code:`-include-pch`, :code:`/Yc`, and :code:`/Yu` options, and the
+        :code:`--preinclude` option taking a pre-compiled header as its argument, are no longer supported by :code:`semmle-extractor-options`. Any test that makes use of this should be replaced by a test that invokes the CodeQL CLI with the
+        :code:`create database` option and that runs the relevant queries on the created database.
+
+Query Packs
+-----------
+
+Minor Analysis Improvements
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Python
+""""""
+
+*   Added SQL injection models from the :code:`pandas` PyPI package.
+
+New Queries
+~~~~~~~~~~~
+
+Golang
+""""""
+
+*   Query (:code:`go/html-template-escaping-bypass-xss`) has been promoted to the main query suite. This query finds potential cross-site scripting (XSS) vulnerabilities when using the :code:`html/template` package, caused by user input being cast to a type which bypasses the HTML autoescaping. It was originally contributed to the experimental query pack by @gagliardetto in `https://github.com/github/codeql-go/pull/493 <https://github.com/github/codeql-go/pull/493>`_.
+
+Language Libraries
+------------------
+
+Minor Analysis Improvements
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Golang
+""""""
+
+*   The first argument of :code:`Client.Query` in :code:`cloud.google.com/go/bigquery` is now recognized as a SQL injection sink.
+
+JavaScript/TypeScript
+"""""""""""""""""""""
+
+*   Added taint flow through the :code:`URL` constructor from the :code:`url` package, improving the identification of SSRF vulnerabilities.
+
+Swift
+"""""
+
+*   Updated to allow analysis of Swift 6.1.2.
+
+New Features
+~~~~~~~~~~~~
+
+C/C++
+"""""
+
+*   Added a predicate :code:`getReferencedMember` to :code:`UsingDeclarationEntry`, which yields a member depending on a type template parameter.

docs/codeql/codeql-overview/codeql-changelog/index.rst

@@ -11,6 +11,7 @@ A list of queries for each suite and language `is available here <https://docs.g
 .. toctree::
    :maxdepth: 1
 
+   codeql-cli-2.22.0
    codeql-cli-2.21.4
    codeql-cli-2.21.3
    codeql-cli-2.21.2

go/ql/src/CHANGELOG.md

@@ -2,7 +2,7 @@
 
 ### New Queries
 
-* Query (`go/html-template-escaping-bypass-xss`) has been promoted to the main query suite. This query finds potential cross-site scripting (XSS) vulnerabilities when using the `html/template` package, caused by user input being cast to a type which bypasses the HTML autoescaping. It was originally contributed to the experimental query pack by @gagliardetto in <https://github.com/github/codeql-go/pull/493>.
+* Query (`go/html-template-escaping-bypass-xss`) has been promoted to the main query suite. This query finds potential cross-site scripting (XSS) vulnerabilities when using the `html/template` package, caused by user input being cast to a type which bypasses the HTML autoescaping. It was originally contributed to the experimental query pack by @gagliardetto in https://github.com/github/codeql-go/pull/493.
 
 ## 1.2.1
 

go/ql/src/change-notes/released/1.3.0.md

@@ -2,4 +2,4 @@
 
 ### New Queries
 
-* Query (`go/html-template-escaping-bypass-xss`) has been promoted to the main query suite. This query finds potential cross-site scripting (XSS) vulnerabilities when using the `html/template` package, caused by user input being cast to a type which bypasses the HTML autoescaping. It was originally contributed to the experimental query pack by @gagliardetto in <https://github.com/github/codeql-go/pull/493>.
+* Query (`go/html-template-escaping-bypass-xss`) has been promoted to the main query suite. This query finds potential cross-site scripting (XSS) vulnerabilities when using the `html/template` package, caused by user input being cast to a type which bypasses the HTML autoescaping. It was originally contributed to the experimental query pack by @gagliardetto in https://github.com/github/codeql-go/pull/493.

java/ql/integration-tests/java/query-suite/java-code-scanning.qls.expected

@@ -12,7 +12,6 @@ ql/java/ql/src/Security/CWE/CWE-023/PartialPathTraversalFromRemote.ql
 ql/java/ql/src/Security/CWE/CWE-074/JndiInjection.ql
 ql/java/ql/src/Security/CWE/CWE-074/XsltInjection.ql
 ql/java/ql/src/Security/CWE/CWE-078/ExecTainted.ql
-ql/java/ql/src/Security/CWE/CWE-078/ExecUnescaped.ql
 ql/java/ql/src/Security/CWE/CWE-079/XSS.ql
 ql/java/ql/src/Security/CWE/CWE-089/SqlTainted.ql
 ql/java/ql/src/Security/CWE/CWE-090/LdapInjection.ql

java/ql/src/Security/CWE/CWE-078/ExecUnescaped.ql

@@ -5,7 +5,7 @@
  * @kind problem
  * @problem.severity error
  * @security-severity 9.8
- * @precision high
+ * @precision medium
  * @id java/concatenated-command-line
  * @tags security
  *       external/cwe/cwe-078

java/ql/src/Security/CWE/CWE-134/ExternallyControlledFormatString.ql

@@ -3,7 +3,7 @@
  * @description Using external input in format strings can lead to exceptions or information leaks.
  * @kind path-problem
  * @problem.severity error
- * @security-severity 9.3
+ * @security-severity 7.3
  * @precision high
  * @id java/tainted-format-string
  * @tags security

java/ql/src/change-notes/2025-06-06-reduce-CWE-134-for-memory-safe-languages.md

@@ -0,0 +1,4 @@
+---
+category: queryMetadata
+---
+* Adjusts the `@security-severity` from 9.3 to 7.3 for `java/tainted-format-string` to align `CWE-134` severity for memory safe languages to better reflect their impact.

java/ql/src/change-notes/2025-06-10-reduce-precision-for-building-cmdline-with-string-concatenation.md

@@ -0,0 +1,4 @@
+---
+category: queryMetadata
+---
+* Adjusts the `@precision` from high to medium for `java/concatenated-command-line` because it is producing false positive alerts when the concatenated strings are hard-coded.

javascript/extractor/src/com/semmle/js/extractor/ScopeManager.java

@@ -426,7 +426,6 @@ public class ScopeManager {
       // cases where we turn on the 'declKind' flags
       @Override
       public Void visit(FunctionDeclaration nd, Void v) {
-        if (nd.hasDeclareKeyword() && !isInTypeScriptDeclarationFile()) return null;
         // strict mode functions are block-scoped, non-strict mode ones aren't
         if (blockscope == isStrict) visit(nd.getId(), DeclKind.var);
         return null;
@@ -434,7 +433,6 @@ public class ScopeManager {
 
       @Override
       public Void visit(ClassDeclaration nd, Void c) {
-        if (nd.hasDeclareKeyword() && !isInTypeScriptDeclarationFile()) return null;
         if (blockscope) visit(nd.getClassDef().getId(), DeclKind.varAndType);
         return null;
       }
@@ -483,7 +481,6 @@ public class ScopeManager {
 
       @Override
       public Void visit(VariableDeclaration nd, Void v) {
-        if (nd.hasDeclareKeyword() && !isInTypeScriptDeclarationFile()) return null;
         // in block scoping mode, only process 'let'; in non-block scoping
         // mode, only process non-'let'
         if (blockscope == nd.isBlockScoped(ecmaVersion)) visit(nd.getDeclarations());
@@ -518,8 +515,7 @@ public class ScopeManager {
       @Override
       public Void visit(NamespaceDeclaration nd, Void c) {
         if (blockscope) return null;
-        boolean isAmbientOutsideDtsFile = nd.hasDeclareKeyword() && !isInTypeScriptDeclarationFile();
+        boolean hasVariable = nd.isInstantiated();
-        boolean hasVariable = nd.isInstantiated() && !isAmbientOutsideDtsFile;
         visit(nd.getName(), hasVariable ? DeclKind.varAndNamespace : DeclKind.namespace);
         return null;
       }

javascript/extractor/tests/ts/output/trap/declareClass.ts.trap

@@ -50,61 +50,64 @@ toplevels(#20001,0)
 #20016=@"loc,{#10000},1,1,2,0"
 locations_default(#20016,#10000,1,1,2,0)
 hasLocation(#20001,#20016)
-#20017=*
+#20017=@"var;{C};{#20000}"
-stmts(#20017,26,#20001,0,"declare class C {}")
+variables(#20017,"C",#20000)
-hasLocation(#20017,#20003)
+#20018=@"local_type_name;{C};{#20000}"
-stmt_containers(#20017,#20001)
+local_type_names(#20018,"C",#20000)
-has_declare_keyword(#20017)
+#20019=*
-#20018=*
+stmts(#20019,26,#20001,0,"declare class C {}")
-exprs(#20018,78,#20017,0,"C")
+hasLocation(#20019,#20003)
-hasLocation(#20018,#20009)
+stmt_containers(#20019,#20001)
-enclosing_stmt(#20018,#20017)
+has_declare_keyword(#20019)
-expr_containers(#20018,#20001)
-literals("C","C",#20018)
-#20019=@"var;{C};{#20000}"
-variables(#20019,"C",#20000)
-decl(#20018,#20019)
 #20020=*
-scopes(#20020,10)
+exprs(#20020,78,#20019,0,"C")
-scopenodes(#20017,#20020)
+hasLocation(#20020,#20009)
-scopenesting(#20020,#20000)
+enclosing_stmt(#20020,#20019)
+expr_containers(#20020,#20001)
+literals("C","C",#20020)
+decl(#20020,#20017)
+typedecl(#20020,#20018)
 #20021=*
-properties(#20021,#20017,2,0,"constructor() {}")
+scopes(#20021,10)
-#20022=@"loc,{#10000},1,17,1,16"
+scopenodes(#20019,#20021)
-locations_default(#20022,#10000,1,17,1,16)
+scopenesting(#20021,#20000)
-hasLocation(#20021,#20022)
+#20022=*
-#20023=*
+properties(#20022,#20019,2,0,"constructor() {}")
-exprs(#20023,0,#20021,0,"constructor")
+#20023=@"loc,{#10000},1,17,1,16"
-hasLocation(#20023,#20022)
+locations_default(#20023,#10000,1,17,1,16)
-enclosing_stmt(#20023,#20017)
+hasLocation(#20022,#20023)
-expr_containers(#20023,#20001)
-literals("constructor","constructor",#20023)
 #20024=*
-exprs(#20024,9,#20021,1,"() {}")
+exprs(#20024,0,#20022,0,"constructor")
-hasLocation(#20024,#20022)
+hasLocation(#20024,#20023)
-enclosing_stmt(#20024,#20017)
+enclosing_stmt(#20024,#20019)
 expr_containers(#20024,#20001)
+literals("constructor","constructor",#20024)
 #20025=*
-scopes(#20025,1)
+exprs(#20025,9,#20022,1,"() {}")
-scopenodes(#20024,#20025)
+hasLocation(#20025,#20023)
-scopenesting(#20025,#20020)
+enclosing_stmt(#20025,#20019)
-#20026=@"var;{arguments};{#20025}"
+expr_containers(#20025,#20001)
-variables(#20026,"arguments",#20025)
+#20026=*
-is_arguments_object(#20026)
+scopes(#20026,1)
-#20027=*
+scopenodes(#20025,#20026)
-stmts(#20027,1,#20024,-2,"{}")
+scopenesting(#20026,#20021)
-hasLocation(#20027,#20022)
+#20027=@"var;{arguments};{#20026}"
-stmt_containers(#20027,#20024)
+variables(#20027,"arguments",#20026)
-is_method(#20021)
+is_arguments_object(#20027)
 #20028=*
-entry_cfg_node(#20028,#20001)
+stmts(#20028,1,#20025,-2,"{}")
-#20029=@"loc,{#10000},1,1,1,0"
+hasLocation(#20028,#20023)
-locations_default(#20029,#10000,1,1,1,0)
+stmt_containers(#20028,#20025)
-hasLocation(#20028,#20029)
+is_method(#20022)
-#20030=*
+#20029=*
-exit_cfg_node(#20030,#20001)
+entry_cfg_node(#20029,#20001)
-hasLocation(#20030,#20015)
+#20030=@"loc,{#10000},1,1,1,0"
-successor(#20017,#20030)
+locations_default(#20030,#10000,1,1,1,0)
-successor(#20028,#20017)
+hasLocation(#20029,#20030)
+#20031=*
+exit_cfg_node(#20031,#20001)
+hasLocation(#20031,#20015)
+successor(#20019,#20031)
+successor(#20029,#20019)
 numlines(#10000,1,1,0)
 filetype(#10000,"typescript")

javascript/extractor/tests/ts/output/trap/functiondecorators.ts.trap

@@ -584,62 +584,63 @@ toplevels(#20001,0)
 #20221=@"loc,{#10000},1,1,16,0"
 locations_default(#20221,#10000,1,1,16,0)
 hasLocation(#20001,#20221)
-#20222=@"var;{C};{#20000}"
+#20222=@"var;{A};{#20000}"
-variables(#20222,"C",#20000)
+variables(#20222,"A",#20000)
-#20223=@"local_type_name;{C};{#20000}"
+#20223=@"var;{B};{#20000}"
-local_type_names(#20223,"C",#20000)
+variables(#20223,"B",#20000)
-#20224=*
+#20224=@"var;{C};{#20000}"
-stmts(#20224,18,#20001,0,"declare var A : any;")
+variables(#20224,"C",#20000)
-hasLocation(#20224,#20003)
+variables(#20224,"C",#20000)
-stmt_containers(#20224,#20001)
+#20225=@"local_type_name;{C};{#20000}"
-has_declare_keyword(#20224)
+local_type_names(#20225,"C",#20000)
-#20225=*
+#20226=*
-exprs(#20225,64,#20224,0,"A : any")
+stmts(#20226,18,#20001,0,"declare var A : any;")
-#20226=@"loc,{#10000},1,13,1,19"
+hasLocation(#20226,#20003)
-locations_default(#20226,#10000,1,13,1,19)
+stmt_containers(#20226,#20001)
-hasLocation(#20225,#20226)
+has_declare_keyword(#20226)
-enclosing_stmt(#20225,#20224)
-expr_containers(#20225,#20001)
 #20227=*
-exprs(#20227,78,#20225,0,"A")
+exprs(#20227,64,#20226,0,"A : any")
-hasLocation(#20227,#20037)
+#20228=@"loc,{#10000},1,13,1,19"
-enclosing_stmt(#20227,#20224)
+locations_default(#20228,#10000,1,13,1,19)
+hasLocation(#20227,#20228)
+enclosing_stmt(#20227,#20226)
 expr_containers(#20227,#20001)
-literals("A","A",#20227)
-#20228=@"var;{A};{#20000}"
-variables(#20228,"A",#20000)
-decl(#20227,#20228)
 #20229=*
-typeexprs(#20229,2,#20225,2,"any")
+exprs(#20229,78,#20227,0,"A")
-hasLocation(#20229,#20041)
+hasLocation(#20229,#20037)
-enclosing_stmt(#20229,#20224)
+enclosing_stmt(#20229,#20226)
 expr_containers(#20229,#20001)
-literals("any","any",#20229)
+literals("A","A",#20229)
+decl(#20229,#20222)
 #20230=*
-stmts(#20230,18,#20001,1,"declare var B : any;")
+typeexprs(#20230,2,#20227,2,"any")
-hasLocation(#20230,#20005)
+hasLocation(#20230,#20041)
-stmt_containers(#20230,#20001)
+enclosing_stmt(#20230,#20226)
-has_declare_keyword(#20230)
+expr_containers(#20230,#20001)
+literals("any","any",#20230)
 #20231=*
-exprs(#20231,64,#20230,0,"B : any")
+stmts(#20231,18,#20001,1,"declare var B : any;")
-#20232=@"loc,{#10000},2,13,2,19"
+hasLocation(#20231,#20005)
-locations_default(#20232,#10000,2,13,2,19)
+stmt_containers(#20231,#20001)
-hasLocation(#20231,#20232)
+has_declare_keyword(#20231)
-enclosing_stmt(#20231,#20230)
+#20232=*
-expr_containers(#20231,#20001)
+exprs(#20232,64,#20231,0,"B : any")
-#20233=*
+#20233=@"loc,{#10000},2,13,2,19"
-exprs(#20233,78,#20231,0,"B")
+locations_default(#20233,#10000,2,13,2,19)
-hasLocation(#20233,#20049)
+hasLocation(#20232,#20233)
-enclosing_stmt(#20233,#20230)
+enclosing_stmt(#20232,#20231)
-expr_containers(#20233,#20001)
+expr_containers(#20232,#20001)
-literals("B","B",#20233)
+#20234=*
-#20234=@"var;{B};{#20000}"
+exprs(#20234,78,#20232,0,"B")
-variables(#20234,"B",#20000)
+hasLocation(#20234,#20049)
-decl(#20233,#20234)
+enclosing_stmt(#20234,#20231)
+expr_containers(#20234,#20001)
+literals("B","B",#20234)
+decl(#20234,#20223)
 #20235=*
-typeexprs(#20235,2,#20231,2,"any")
+typeexprs(#20235,2,#20232,2,"any")
 hasLocation(#20235,#20053)
-enclosing_stmt(#20235,#20230)
+enclosing_stmt(#20235,#20231)
 expr_containers(#20235,#20001)
 literals("any","any",#20235)
 #20236=*
@@ -660,7 +661,7 @@ hasLocation(#20239,#20061)
 enclosing_stmt(#20239,#20236)
 expr_containers(#20239,#20001)
 literals("C","C",#20239)
-decl(#20239,#20222)
+decl(#20239,#20224)
 #20240=*
 typeexprs(#20240,2,#20237,2,"any")
 hasLocation(#20240,#20065)
@@ -679,8 +680,8 @@ hasLocation(#20243,#20071)
 enclosing_stmt(#20243,#20241)
 expr_containers(#20243,#20001)
 literals("C","C",#20243)
-decl(#20243,#20222)
+decl(#20243,#20224)
-typedecl(#20243,#20223)
+typedecl(#20243,#20225)
 #20244=*
 scopes(#20244,10)
 scopenodes(#20241,#20244)
@@ -769,7 +770,7 @@ exprs(#20266,79,#20265,0,"A")
 hasLocation(#20266,#20093)
 expr_containers(#20266,#20258)
 literals("A","A",#20266)
-bind(#20266,#20228)
+bind(#20266,#20222)
 #20267=*
 stmts(#20267,1,#20258,-2,"{}")
 #20268=@"loc,{#10000},7,12,7,13"
@@ -825,7 +826,7 @@ exprs(#20281,79,#20279,0,"A")
 hasLocation(#20281,#20109)
 expr_containers(#20281,#20272)
 literals("A","A",#20281)
-bind(#20281,#20228)
+bind(#20281,#20222)
 #20282=*
 exprs(#20282,94,#20277,1,"@B")
 #20283=@"loc,{#10000},8,9,8,10"
@@ -837,7 +838,7 @@ exprs(#20284,79,#20282,0,"B")
 hasLocation(#20284,#20113)
 expr_containers(#20284,#20272)
 literals("B","B",#20284)
-bind(#20284,#20234)
+bind(#20284,#20223)
 #20285=*
 stmts(#20285,1,#20272,-2,"{}")
 #20286=@"loc,{#10000},8,16,8,17"
@@ -899,7 +900,7 @@ exprs(#20300,79,#20299,0,"A")
 hasLocation(#20300,#20133)
 expr_containers(#20300,#20290)
 literals("A","A",#20300)
-bind(#20300,#20228)
+bind(#20300,#20222)
 #20301=*
 stmts(#20301,1,#20290,-2,"{}")
 #20302=@"loc,{#10000},10,18,10,19"
@@ -963,7 +964,7 @@ exprs(#20317,79,#20315,0,"A")
 hasLocation(#20317,#20153)
 expr_containers(#20317,#20306)
 literals("A","A",#20317)
-bind(#20317,#20228)
+bind(#20317,#20222)
 #20318=*
 exprs(#20318,94,#20313,1,"@B")
 #20319=@"loc,{#10000},11,15,11,16"
@@ -975,7 +976,7 @@ exprs(#20320,79,#20318,0,"B")
 hasLocation(#20320,#20157)
 expr_containers(#20320,#20306)
 literals("B","B",#20320)
-bind(#20320,#20234)
+bind(#20320,#20223)
 #20321=*
 stmts(#20321,1,#20306,-2,"{}")
 #20322=@"loc,{#10000},11,22,11,23"
@@ -1037,7 +1038,7 @@ exprs(#20336,79,#20335,0,"A")
 hasLocation(#20336,#20173)
 expr_containers(#20336,#20326)
 literals("A","A",#20336)
-bind(#20336,#20228)
+bind(#20336,#20222)
 #20337=*
 exprs(#20337,104,#20326,-12,"@B")
 #20338=@"loc,{#10000},13,12,13,13"
@@ -1053,7 +1054,7 @@ exprs(#20340,79,#20339,0,"B")
 hasLocation(#20340,#20181)
 expr_containers(#20340,#20326)
 literals("B","B",#20340)
-bind(#20340,#20234)
+bind(#20340,#20223)
 #20341=*
 stmts(#20341,1,#20326,-2,"{}")
 #20342=@"loc,{#10000},13,18,13,19"
@@ -1115,7 +1116,7 @@ exprs(#20356,79,#20355,0,"A")
 hasLocation(#20356,#20197)
 expr_containers(#20356,#20346)
 literals("A","A",#20356)
-bind(#20356,#20228)
+bind(#20356,#20222)
 #20357=*
 exprs(#20357,104,#20346,-12,"@B @C")
 #20358=@"loc,{#10000},14,12,14,16"
@@ -1133,7 +1134,7 @@ exprs(#20361,79,#20359,0,"B")
 hasLocation(#20361,#20205)
 expr_containers(#20361,#20346)
 literals("B","B",#20361)
-bind(#20361,#20234)
+bind(#20361,#20223)
 #20362=*
 exprs(#20362,94,#20357,1,"@C")
 #20363=@"loc,{#10000},14,15,14,16"
@@ -1145,7 +1146,7 @@ exprs(#20364,79,#20362,0,"C")
 hasLocation(#20364,#20209)
 expr_containers(#20364,#20346)
 literals("C","C",#20364)
-bind(#20364,#20222)
+bind(#20364,#20224)
 #20365=*
 stmts(#20365,1,#20346,-2,"{}")
 #20366=@"loc,{#10000},14,22,14,23"
@@ -1349,8 +1350,8 @@ successor(#20265,#20263)
 successor(#20263,#20281)
 successor(#20241,#20266)
 successor(#20236,#20243)
-successor(#20230,#20236)
+successor(#20231,#20236)
-successor(#20224,#20230)
+successor(#20226,#20231)
-successor(#20374,#20224)
+successor(#20374,#20226)
 numlines(#10000,15,12,0)
 filetype(#10000,"typescript")

javascript/extractor/tests/ts/output/trap/nobody.ts.trap

@@ -694,506 +694,509 @@ toplevels(#20001,0)
 #20252=@"loc,{#10000},2,1,30,0"
 locations_default(#20252,#10000,2,1,30,0)
 hasLocation(#20001,#20252)
-#20253=@"var;{C};{#20000}"
+#20253=@"var;{f};{#20000}"
-variables(#20253,"C",#20000)
+variables(#20253,"f",#20000)
-#20254=@"local_type_name;{C};{#20000}"
+#20254=@"var;{C};{#20000}"
-local_type_names(#20254,"C",#20000)
+variables(#20254,"C",#20000)
-#20255=*
+#20255=@"var;{D};{#20000}"
-stmts(#20255,17,#20001,0,"declare ... on f();")
+variables(#20255,"D",#20000)
-hasLocation(#20255,#20020)
+#20256=@"local_type_name;{C};{#20000}"
-stmt_containers(#20255,#20001)
+local_type_names(#20256,"C",#20000)
-has_declare_keyword(#20255)
+#20257=@"local_type_name;{D};{#20000}"
-#20256=*
+local_type_names(#20257,"D",#20000)
-exprs(#20256,78,#20255,-1,"f")
-hasLocation(#20256,#20079)
-expr_containers(#20256,#20255)
-literals("f","f",#20256)
-#20257=@"var;{f};{#20000}"
-variables(#20257,"f",#20000)
-decl(#20256,#20257)
 #20258=*
-scopes(#20258,1)
+stmts(#20258,17,#20001,0,"declare ... on f();")
-scopenodes(#20255,#20258)
+hasLocation(#20258,#20020)
-scopenesting(#20258,#20000)
+stmt_containers(#20258,#20001)
-#20259=@"var;{arguments};{#20258}"
+has_declare_keyword(#20258)
-variables(#20259,"arguments",#20258)
+#20259=*
-is_arguments_object(#20259)
+exprs(#20259,78,#20258,-1,"f")
+hasLocation(#20259,#20079)
+expr_containers(#20259,#20258)
+literals("f","f",#20259)
+decl(#20259,#20253)
 #20260=*
-stmts(#20260,26,#20001,1,"abstrac ... mber;\n}")
+scopes(#20260,1)
-#20261=@"loc,{#10000},4,1,15,1"
+scopenodes(#20258,#20260)
-locations_default(#20261,#10000,4,1,15,1)
+scopenesting(#20260,#20000)
-hasLocation(#20260,#20261)
+#20261=@"var;{arguments};{#20260}"
-stmt_containers(#20260,#20001)
+variables(#20261,"arguments",#20260)
-is_abstract_class(#20260)
+is_arguments_object(#20261)
 #20262=*
-exprs(#20262,78,#20260,0,"C")
+stmts(#20262,26,#20001,1,"abstrac ... mber;\n}")
-hasLocation(#20262,#20091)
+#20263=@"loc,{#10000},4,1,15,1"
-enclosing_stmt(#20262,#20260)
+locations_default(#20263,#10000,4,1,15,1)
-expr_containers(#20262,#20001)
+hasLocation(#20262,#20263)
-literals("C","C",#20262)
+stmt_containers(#20262,#20001)
-decl(#20262,#20253)
+is_abstract_class(#20262)
-typedecl(#20262,#20254)
-#20263=*
-scopes(#20263,10)
-scopenodes(#20260,#20263)
-scopenesting(#20263,#20000)
 #20264=*
-properties(#20264,#20260,2,0,"abstract h();")
+exprs(#20264,78,#20262,0,"C")
-#20265=@"loc,{#10000},6,3,6,15"
+hasLocation(#20264,#20091)
-locations_default(#20265,#10000,6,3,6,15)
+enclosing_stmt(#20264,#20262)
-hasLocation(#20264,#20265)
+expr_containers(#20264,#20001)
+literals("C","C",#20264)
+decl(#20264,#20254)
+typedecl(#20264,#20256)
+#20265=*
+scopes(#20265,10)
+scopenodes(#20262,#20265)
+scopenesting(#20265,#20000)
 #20266=*
-exprs(#20266,0,#20264,0,"h")
+properties(#20266,#20262,2,0,"abstract h();")
-hasLocation(#20266,#20097)
+#20267=@"loc,{#10000},6,3,6,15"
-enclosing_stmt(#20266,#20260)
+locations_default(#20267,#10000,6,3,6,15)
-expr_containers(#20266,#20001)
+hasLocation(#20266,#20267)
-literals("h","h",#20266)
-#20267=*
-exprs(#20267,9,#20264,1,"abstract h();")
-hasLocation(#20267,#20265)
-enclosing_stmt(#20267,#20260)
-expr_containers(#20267,#20001)
 #20268=*
-scopes(#20268,1)
+exprs(#20268,0,#20266,0,"h")
-scopenodes(#20267,#20268)
+hasLocation(#20268,#20097)
-scopenesting(#20268,#20263)
+enclosing_stmt(#20268,#20262)
-#20269=@"var;{arguments};{#20268}"
+expr_containers(#20268,#20001)
-variables(#20269,"arguments",#20268)
+literals("h","h",#20268)
-is_arguments_object(#20269)
+#20269=*
-is_method(#20264)
+exprs(#20269,9,#20266,1,"abstract h();")
-is_abstract_member(#20264)
+hasLocation(#20269,#20267)
+enclosing_stmt(#20269,#20262)
+expr_containers(#20269,#20001)
 #20270=*
-properties(#20270,#20260,3,0,"g(x: nu ... number;")
+scopes(#20270,1)
-#20271=@"loc,{#10000},9,3,9,23"
+scopenodes(#20269,#20270)
-locations_default(#20271,#10000,9,3,9,23)
+scopenesting(#20270,#20265)
-hasLocation(#20270,#20271)
+#20271=@"var;{arguments};{#20270}"
+variables(#20271,"arguments",#20270)
+is_arguments_object(#20271)
+is_method(#20266)
+is_abstract_member(#20266)
 #20272=*
-exprs(#20272,0,#20270,0,"g")
+properties(#20272,#20262,3,0,"g(x: nu ... number;")
-hasLocation(#20272,#20105)
+#20273=@"loc,{#10000},9,3,9,23"
-enclosing_stmt(#20272,#20260)
+locations_default(#20273,#10000,9,3,9,23)
-expr_containers(#20272,#20001)
+hasLocation(#20272,#20273)
-literals("g","g",#20272)
-#20273=*
-exprs(#20273,9,#20270,1,"g(x: nu ... number;")
-hasLocation(#20273,#20271)
-enclosing_stmt(#20273,#20260)
-expr_containers(#20273,#20001)
 #20274=*
-scopes(#20274,1)
+exprs(#20274,0,#20272,0,"g")
-scopenodes(#20273,#20274)
+hasLocation(#20274,#20105)
-scopenesting(#20274,#20263)
+enclosing_stmt(#20274,#20262)
-#20275=@"var;{x};{#20274}"
+expr_containers(#20274,#20001)
-variables(#20275,"x",#20274)
+literals("g","g",#20274)
+#20275=*
+exprs(#20275,9,#20272,1,"g(x: nu ... number;")
+hasLocation(#20275,#20273)
+enclosing_stmt(#20275,#20262)
+expr_containers(#20275,#20001)
 #20276=*
-exprs(#20276,78,#20273,0,"x")
+scopes(#20276,1)
-hasLocation(#20276,#20109)
+scopenodes(#20275,#20276)
-expr_containers(#20276,#20273)
+scopenesting(#20276,#20265)
-literals("x","x",#20276)
+#20277=@"var;{x};{#20276}"
-decl(#20276,#20275)
+variables(#20277,"x",#20276)
-#20277=@"var;{arguments};{#20274}"
-variables(#20277,"arguments",#20274)
-is_arguments_object(#20277)
 #20278=*
-typeexprs(#20278,2,#20273,-3,"number")
+exprs(#20278,78,#20275,0,"x")
-hasLocation(#20278,#20119)
+hasLocation(#20278,#20109)
-expr_containers(#20278,#20273)
+expr_containers(#20278,#20275)
-literals("number","number",#20278)
+literals("x","x",#20278)
-#20279=*
+decl(#20278,#20277)
-typeexprs(#20279,2,#20273,-6,"number")
+#20279=@"var;{arguments};{#20276}"
-hasLocation(#20279,#20113)
+variables(#20279,"arguments",#20276)
-expr_containers(#20279,#20273)
+is_arguments_object(#20279)
-literals("number","number",#20279)
-is_method(#20270)
 #20280=*
-properties(#20280,#20260,4,0,"g(x: st ... string;")
+typeexprs(#20280,2,#20275,-3,"number")
-#20281=@"loc,{#10000},10,3,10,23"
+hasLocation(#20280,#20119)
-locations_default(#20281,#10000,10,3,10,23)
+expr_containers(#20280,#20275)
-hasLocation(#20280,#20281)
+literals("number","number",#20280)
+#20281=*
+typeexprs(#20281,2,#20275,-6,"number")
+hasLocation(#20281,#20113)
+expr_containers(#20281,#20275)
+literals("number","number",#20281)
+is_method(#20272)
 #20282=*
-exprs(#20282,0,#20280,0,"g")
+properties(#20282,#20262,4,0,"g(x: st ... string;")
-hasLocation(#20282,#20123)
+#20283=@"loc,{#10000},10,3,10,23"
-enclosing_stmt(#20282,#20260)
+locations_default(#20283,#10000,10,3,10,23)
-expr_containers(#20282,#20001)
+hasLocation(#20282,#20283)
-literals("g","g",#20282)
-#20283=*
-exprs(#20283,9,#20280,1,"g(x: st ... string;")
-hasLocation(#20283,#20281)
-enclosing_stmt(#20283,#20260)
-expr_containers(#20283,#20001)
 #20284=*
-scopes(#20284,1)
+exprs(#20284,0,#20282,0,"g")
-scopenodes(#20283,#20284)
+hasLocation(#20284,#20123)
-scopenesting(#20284,#20263)
+enclosing_stmt(#20284,#20262)
-#20285=@"var;{x};{#20284}"
+expr_containers(#20284,#20001)
-variables(#20285,"x",#20284)
+literals("g","g",#20284)
+#20285=*
+exprs(#20285,9,#20282,1,"g(x: st ... string;")
+hasLocation(#20285,#20283)
+enclosing_stmt(#20285,#20262)
+expr_containers(#20285,#20001)
 #20286=*
-exprs(#20286,78,#20283,0,"x")
+scopes(#20286,1)
-hasLocation(#20286,#20127)
+scopenodes(#20285,#20286)
-expr_containers(#20286,#20283)
+scopenesting(#20286,#20265)
-literals("x","x",#20286)
+#20287=@"var;{x};{#20286}"
-decl(#20286,#20285)
+variables(#20287,"x",#20286)
-#20287=@"var;{arguments};{#20284}"
-variables(#20287,"arguments",#20284)
-is_arguments_object(#20287)
 #20288=*
-typeexprs(#20288,2,#20283,-3,"string")
+exprs(#20288,78,#20285,0,"x")
-hasLocation(#20288,#20137)
+hasLocation(#20288,#20127)
-expr_containers(#20288,#20283)
+expr_containers(#20288,#20285)
-literals("string","string",#20288)
+literals("x","x",#20288)
-#20289=*
+decl(#20288,#20287)
-typeexprs(#20289,2,#20283,-6,"string")
+#20289=@"var;{arguments};{#20286}"
-hasLocation(#20289,#20131)
+variables(#20289,"arguments",#20286)
-expr_containers(#20289,#20283)
+is_arguments_object(#20289)
-literals("string","string",#20289)
-is_method(#20280)
 #20290=*
-properties(#20290,#20260,5,0,"g(x: any) {}")
+typeexprs(#20290,2,#20285,-3,"string")
-#20291=@"loc,{#10000},11,3,11,14"
+hasLocation(#20290,#20137)
-locations_default(#20291,#10000,11,3,11,14)
+expr_containers(#20290,#20285)
-hasLocation(#20290,#20291)
+literals("string","string",#20290)
+#20291=*
+typeexprs(#20291,2,#20285,-6,"string")
+hasLocation(#20291,#20131)
+expr_containers(#20291,#20285)
+literals("string","string",#20291)
+is_method(#20282)
 #20292=*
-exprs(#20292,0,#20290,0,"g")
+properties(#20292,#20262,5,0,"g(x: any) {}")
-hasLocation(#20292,#20141)
+#20293=@"loc,{#10000},11,3,11,14"
-enclosing_stmt(#20292,#20260)
+locations_default(#20293,#10000,11,3,11,14)
-expr_containers(#20292,#20001)
+hasLocation(#20292,#20293)
-literals("g","g",#20292)
-#20293=*
-exprs(#20293,9,#20290,1,"g(x: any) {}")
-hasLocation(#20293,#20291)
-enclosing_stmt(#20293,#20260)
-expr_containers(#20293,#20001)
 #20294=*
-scopes(#20294,1)
+exprs(#20294,0,#20292,0,"g")
-scopenodes(#20293,#20294)
+hasLocation(#20294,#20141)
-scopenesting(#20294,#20263)
+enclosing_stmt(#20294,#20262)
-#20295=@"var;{x};{#20294}"
+expr_containers(#20294,#20001)
-variables(#20295,"x",#20294)
+literals("g","g",#20294)
+#20295=*
+exprs(#20295,9,#20292,1,"g(x: any) {}")
+hasLocation(#20295,#20293)
+enclosing_stmt(#20295,#20262)
+expr_containers(#20295,#20001)
 #20296=*
-exprs(#20296,78,#20293,0,"x")
+scopes(#20296,1)
-hasLocation(#20296,#20145)
+scopenodes(#20295,#20296)
-expr_containers(#20296,#20293)
+scopenesting(#20296,#20265)
-literals("x","x",#20296)
+#20297=@"var;{x};{#20296}"
-decl(#20296,#20295)
+variables(#20297,"x",#20296)
-#20297=@"var;{arguments};{#20294}"
-variables(#20297,"arguments",#20294)
-is_arguments_object(#20297)
 #20298=*
-typeexprs(#20298,2,#20293,-6,"any")
+exprs(#20298,78,#20295,0,"x")
-hasLocation(#20298,#20149)
+hasLocation(#20298,#20145)
-expr_containers(#20298,#20293)
+expr_containers(#20298,#20295)
-literals("any","any",#20298)
+literals("x","x",#20298)
-#20299=*
+decl(#20298,#20297)
-stmts(#20299,1,#20293,-2,"{}")
+#20299=@"var;{arguments};{#20296}"
-#20300=@"loc,{#10000},11,13,11,14"
+variables(#20299,"arguments",#20296)
-locations_default(#20300,#10000,11,13,11,14)
+is_arguments_object(#20299)
-hasLocation(#20299,#20300)
+#20300=*
-stmt_containers(#20299,#20293)
+typeexprs(#20300,2,#20295,-6,"any")
-is_method(#20290)
+hasLocation(#20300,#20149)
+expr_containers(#20300,#20295)
+literals("any","any",#20300)
 #20301=*
-properties(#20301,#20260,6,8,"abstract x: number;")
+stmts(#20301,1,#20295,-2,"{}")
-#20302=@"loc,{#10000},14,3,14,21"
+#20302=@"loc,{#10000},11,13,11,14"
-locations_default(#20302,#10000,14,3,14,21)
+locations_default(#20302,#10000,11,13,11,14)
 hasLocation(#20301,#20302)
+stmt_containers(#20301,#20295)
+is_method(#20292)
 #20303=*
-#20304=*
+properties(#20303,#20262,6,8,"abstract x: number;")
-exprs(#20304,0,#20301,0,"x")
+#20304=@"loc,{#10000},14,3,14,21"
-hasLocation(#20304,#20159)
+locations_default(#20304,#10000,14,3,14,21)
-expr_containers(#20304,#20303)
+hasLocation(#20303,#20304)
-literals("x","x",#20304)
-is_abstract_member(#20301)
 #20305=*
-typeexprs(#20305,2,#20301,2,"number")
-hasLocation(#20305,#20163)
-enclosing_stmt(#20305,#20260)
-expr_containers(#20305,#20001)
-literals("number","number",#20305)
 #20306=*
-properties(#20306,#20260,7,0,"constructor() {}")
+exprs(#20306,0,#20303,0,"x")
-#20307=@"loc,{#10000},4,18,4,17"
+hasLocation(#20306,#20159)
-locations_default(#20307,#10000,4,18,4,17)
+expr_containers(#20306,#20305)
-hasLocation(#20306,#20307)
+literals("x","x",#20306)
+is_abstract_member(#20303)
+#20307=*
+typeexprs(#20307,2,#20303,2,"number")
+hasLocation(#20307,#20163)
+enclosing_stmt(#20307,#20262)
+expr_containers(#20307,#20001)
+literals("number","number",#20307)
 #20308=*
-exprs(#20308,0,#20306,0,"constructor")
+properties(#20308,#20262,7,0,"constructor() {}")
-hasLocation(#20308,#20307)
+#20309=@"loc,{#10000},4,18,4,17"
-enclosing_stmt(#20308,#20260)
+locations_default(#20309,#10000,4,18,4,17)
-expr_containers(#20308,#20001)
+hasLocation(#20308,#20309)
-literals("constructor","constructor",#20308)
+#20310=*
-exprs(#20303,9,#20306,1,"() {}")
+exprs(#20310,0,#20308,0,"constructor")
-hasLocation(#20303,#20307)
+hasLocation(#20310,#20309)
-enclosing_stmt(#20303,#20260)
+enclosing_stmt(#20310,#20262)
-expr_containers(#20303,#20001)
+expr_containers(#20310,#20001)
-#20309=*
+literals("constructor","constructor",#20310)
-scopes(#20309,1)
+exprs(#20305,9,#20308,1,"() {}")
-scopenodes(#20303,#20309)
+hasLocation(#20305,#20309)
-scopenesting(#20309,#20263)
+enclosing_stmt(#20305,#20262)
-#20310=@"var;{arguments};{#20309}"
+expr_containers(#20305,#20001)
-variables(#20310,"arguments",#20309)
-is_arguments_object(#20310)
 #20311=*
-stmts(#20311,1,#20303,-2,"{}")
+scopes(#20311,1)
-hasLocation(#20311,#20307)
+scopenodes(#20305,#20311)
-stmt_containers(#20311,#20303)
+scopenesting(#20311,#20265)
-is_method(#20306)
+#20312=@"var;{arguments};{#20311}"
-#20312=*
+variables(#20312,"arguments",#20311)
-stmts(#20312,26,#20001,2,"declare ... mber;\n}")
+is_arguments_object(#20312)
-#20313=@"loc,{#10000},18,1,29,1"
+#20313=*
-locations_default(#20313,#10000,18,1,29,1)
+stmts(#20313,1,#20305,-2,"{}")
-hasLocation(#20312,#20313)
+hasLocation(#20313,#20309)
-stmt_containers(#20312,#20001)
+stmt_containers(#20313,#20305)
-has_declare_keyword(#20312)
+is_method(#20308)
-is_abstract_class(#20312)
 #20314=*
-exprs(#20314,78,#20312,0,"D")
+stmts(#20314,26,#20001,2,"declare ... mber;\n}")
-hasLocation(#20314,#20174)
+#20315=@"loc,{#10000},18,1,29,1"
-enclosing_stmt(#20314,#20312)
+locations_default(#20315,#10000,18,1,29,1)
-expr_containers(#20314,#20001)
+hasLocation(#20314,#20315)
-literals("D","D",#20314)
+stmt_containers(#20314,#20001)
-#20315=@"var;{D};{#20000}"
+has_declare_keyword(#20314)
-variables(#20315,"D",#20000)
+is_abstract_class(#20314)
-decl(#20314,#20315)
 #20316=*
-scopes(#20316,10)
+exprs(#20316,78,#20314,0,"D")
-scopenodes(#20312,#20316)
+hasLocation(#20316,#20174)
-scopenesting(#20316,#20000)
+enclosing_stmt(#20316,#20314)
+expr_containers(#20316,#20001)
+literals("D","D",#20316)
+decl(#20316,#20255)
+typedecl(#20316,#20257)
 #20317=*
-properties(#20317,#20312,2,0,"abstract h();")
+scopes(#20317,10)
-#20318=@"loc,{#10000},20,3,20,15"
+scopenodes(#20314,#20317)
-locations_default(#20318,#10000,20,3,20,15)
+scopenesting(#20317,#20000)
-hasLocation(#20317,#20318)
+#20318=*
-#20319=*
+properties(#20318,#20314,2,0,"abstract h();")
-exprs(#20319,0,#20317,0,"h")
+#20319=@"loc,{#10000},20,3,20,15"
-hasLocation(#20319,#20180)
+locations_default(#20319,#10000,20,3,20,15)
-enclosing_stmt(#20319,#20312)
+hasLocation(#20318,#20319)
-expr_containers(#20319,#20001)
-literals("h","h",#20319)
 #20320=*
-exprs(#20320,9,#20317,1,"abstract h();")
+exprs(#20320,0,#20318,0,"h")
-hasLocation(#20320,#20318)
+hasLocation(#20320,#20180)
-enclosing_stmt(#20320,#20312)
+enclosing_stmt(#20320,#20314)
 expr_containers(#20320,#20001)
+literals("h","h",#20320)
 #20321=*
-scopes(#20321,1)
+exprs(#20321,9,#20318,1,"abstract h();")
-scopenodes(#20320,#20321)
+hasLocation(#20321,#20319)
-scopenesting(#20321,#20316)
+enclosing_stmt(#20321,#20314)
-#20322=@"var;{arguments};{#20321}"
+expr_containers(#20321,#20001)
-variables(#20322,"arguments",#20321)
+#20322=*
-is_arguments_object(#20322)
+scopes(#20322,1)
-is_method(#20317)
+scopenodes(#20321,#20322)
-is_abstract_member(#20317)
+scopenesting(#20322,#20317)
-#20323=*
+#20323=@"var;{arguments};{#20322}"
-properties(#20323,#20312,3,0,"g(x: nu ... number;")
+variables(#20323,"arguments",#20322)
-#20324=@"loc,{#10000},23,3,23,23"
+is_arguments_object(#20323)
-locations_default(#20324,#10000,23,3,23,23)
+is_method(#20318)
-hasLocation(#20323,#20324)
+is_abstract_member(#20318)
-#20325=*
+#20324=*
-exprs(#20325,0,#20323,0,"g")
+properties(#20324,#20314,3,0,"g(x: nu ... number;")
-hasLocation(#20325,#20188)
+#20325=@"loc,{#10000},23,3,23,23"
-enclosing_stmt(#20325,#20312)
+locations_default(#20325,#10000,23,3,23,23)
-expr_containers(#20325,#20001)
+hasLocation(#20324,#20325)
-literals("g","g",#20325)
 #20326=*
-exprs(#20326,9,#20323,1,"g(x: nu ... number;")
+exprs(#20326,0,#20324,0,"g")
-hasLocation(#20326,#20324)
+hasLocation(#20326,#20188)
-enclosing_stmt(#20326,#20312)
+enclosing_stmt(#20326,#20314)
 expr_containers(#20326,#20001)
+literals("g","g",#20326)
 #20327=*
-scopes(#20327,1)
+exprs(#20327,9,#20324,1,"g(x: nu ... number;")
-scopenodes(#20326,#20327)
+hasLocation(#20327,#20325)
-scopenesting(#20327,#20316)
+enclosing_stmt(#20327,#20314)
-#20328=@"var;{x};{#20327}"
+expr_containers(#20327,#20001)
-variables(#20328,"x",#20327)
+#20328=*
-#20329=*
+scopes(#20328,1)
-exprs(#20329,78,#20326,0,"x")
+scopenodes(#20327,#20328)
-hasLocation(#20329,#20192)
+scopenesting(#20328,#20317)
-expr_containers(#20329,#20326)
+#20329=@"var;{x};{#20328}"
-literals("x","x",#20329)
+variables(#20329,"x",#20328)
-decl(#20329,#20328)
+#20330=*
-#20330=@"var;{arguments};{#20327}"
+exprs(#20330,78,#20327,0,"x")
-variables(#20330,"arguments",#20327)
+hasLocation(#20330,#20192)
-is_arguments_object(#20330)
+expr_containers(#20330,#20327)
-#20331=*
+literals("x","x",#20330)
-typeexprs(#20331,2,#20326,-3,"number")
+decl(#20330,#20329)
-hasLocation(#20331,#20202)
+#20331=@"var;{arguments};{#20328}"
-expr_containers(#20331,#20326)
+variables(#20331,"arguments",#20328)
-literals("number","number",#20331)
+is_arguments_object(#20331)
 #20332=*
-typeexprs(#20332,2,#20326,-6,"number")
+typeexprs(#20332,2,#20327,-3,"number")
-hasLocation(#20332,#20196)
+hasLocation(#20332,#20202)
-expr_containers(#20332,#20326)
+expr_containers(#20332,#20327)
 literals("number","number",#20332)
-is_method(#20323)
 #20333=*
-properties(#20333,#20312,4,0,"g(x: st ... string;")
+typeexprs(#20333,2,#20327,-6,"number")
-#20334=@"loc,{#10000},24,3,24,23"
+hasLocation(#20333,#20196)
-locations_default(#20334,#10000,24,3,24,23)
+expr_containers(#20333,#20327)
-hasLocation(#20333,#20334)
+literals("number","number",#20333)
-#20335=*
+is_method(#20324)
-exprs(#20335,0,#20333,0,"g")
+#20334=*
-hasLocation(#20335,#20206)
+properties(#20334,#20314,4,0,"g(x: st ... string;")
-enclosing_stmt(#20335,#20312)
+#20335=@"loc,{#10000},24,3,24,23"
-expr_containers(#20335,#20001)
+locations_default(#20335,#10000,24,3,24,23)
-literals("g","g",#20335)
+hasLocation(#20334,#20335)
 #20336=*
-exprs(#20336,9,#20333,1,"g(x: st ... string;")
+exprs(#20336,0,#20334,0,"g")
-hasLocation(#20336,#20334)
+hasLocation(#20336,#20206)
-enclosing_stmt(#20336,#20312)
+enclosing_stmt(#20336,#20314)
 expr_containers(#20336,#20001)
+literals("g","g",#20336)
 #20337=*
-scopes(#20337,1)
+exprs(#20337,9,#20334,1,"g(x: st ... string;")
-scopenodes(#20336,#20337)
+hasLocation(#20337,#20335)
-scopenesting(#20337,#20316)
+enclosing_stmt(#20337,#20314)
-#20338=@"var;{x};{#20337}"
+expr_containers(#20337,#20001)
-variables(#20338,"x",#20337)
+#20338=*
-#20339=*
+scopes(#20338,1)
-exprs(#20339,78,#20336,0,"x")
+scopenodes(#20337,#20338)
-hasLocation(#20339,#20210)
+scopenesting(#20338,#20317)
-expr_containers(#20339,#20336)
+#20339=@"var;{x};{#20338}"
-literals("x","x",#20339)
+variables(#20339,"x",#20338)
-decl(#20339,#20338)
+#20340=*
-#20340=@"var;{arguments};{#20337}"
+exprs(#20340,78,#20337,0,"x")
-variables(#20340,"arguments",#20337)
+hasLocation(#20340,#20210)
-is_arguments_object(#20340)
+expr_containers(#20340,#20337)
-#20341=*
+literals("x","x",#20340)
-typeexprs(#20341,2,#20336,-3,"string")
+decl(#20340,#20339)
-hasLocation(#20341,#20220)
+#20341=@"var;{arguments};{#20338}"
-expr_containers(#20341,#20336)
+variables(#20341,"arguments",#20338)
-literals("string","string",#20341)
+is_arguments_object(#20341)
 #20342=*
-typeexprs(#20342,2,#20336,-6,"string")
+typeexprs(#20342,2,#20337,-3,"string")
-hasLocation(#20342,#20214)
+hasLocation(#20342,#20220)
-expr_containers(#20342,#20336)
+expr_containers(#20342,#20337)
 literals("string","string",#20342)
-is_method(#20333)
 #20343=*
-properties(#20343,#20312,5,0,"g(x: any) {}")
+typeexprs(#20343,2,#20337,-6,"string")
-#20344=@"loc,{#10000},25,3,25,14"
+hasLocation(#20343,#20214)
-locations_default(#20344,#10000,25,3,25,14)
+expr_containers(#20343,#20337)
-hasLocation(#20343,#20344)
+literals("string","string",#20343)
-#20345=*
+is_method(#20334)
-exprs(#20345,0,#20343,0,"g")
+#20344=*
-hasLocation(#20345,#20224)
+properties(#20344,#20314,5,0,"g(x: any) {}")
-enclosing_stmt(#20345,#20312)
+#20345=@"loc,{#10000},25,3,25,14"
-expr_containers(#20345,#20001)
+locations_default(#20345,#10000,25,3,25,14)
-literals("g","g",#20345)
+hasLocation(#20344,#20345)
 #20346=*
-exprs(#20346,9,#20343,1,"g(x: any) {}")
+exprs(#20346,0,#20344,0,"g")
-hasLocation(#20346,#20344)
+hasLocation(#20346,#20224)
-enclosing_stmt(#20346,#20312)
+enclosing_stmt(#20346,#20314)
 expr_containers(#20346,#20001)
+literals("g","g",#20346)
 #20347=*
-scopes(#20347,1)
+exprs(#20347,9,#20344,1,"g(x: any) {}")
-scopenodes(#20346,#20347)
+hasLocation(#20347,#20345)
-scopenesting(#20347,#20316)
+enclosing_stmt(#20347,#20314)
-#20348=@"var;{x};{#20347}"
+expr_containers(#20347,#20001)
-variables(#20348,"x",#20347)
+#20348=*
-#20349=*
+scopes(#20348,1)
-exprs(#20349,78,#20346,0,"x")
+scopenodes(#20347,#20348)
-hasLocation(#20349,#20228)
+scopenesting(#20348,#20317)
-expr_containers(#20349,#20346)
+#20349=@"var;{x};{#20348}"
-literals("x","x",#20349)
+variables(#20349,"x",#20348)
-decl(#20349,#20348)
+#20350=*
-#20350=@"var;{arguments};{#20347}"
+exprs(#20350,78,#20347,0,"x")
-variables(#20350,"arguments",#20347)
+hasLocation(#20350,#20228)
-is_arguments_object(#20350)
+expr_containers(#20350,#20347)
-#20351=*
+literals("x","x",#20350)
-typeexprs(#20351,2,#20346,-6,"any")
+decl(#20350,#20349)
-hasLocation(#20351,#20232)
+#20351=@"var;{arguments};{#20348}"
-expr_containers(#20351,#20346)
+variables(#20351,"arguments",#20348)
-literals("any","any",#20351)
+is_arguments_object(#20351)
 #20352=*
-stmts(#20352,1,#20346,-2,"{}")
+typeexprs(#20352,2,#20347,-6,"any")
-#20353=@"loc,{#10000},25,13,25,14"
+hasLocation(#20352,#20232)
-locations_default(#20353,#10000,25,13,25,14)
+expr_containers(#20352,#20347)
-hasLocation(#20352,#20353)
+literals("any","any",#20352)
-stmt_containers(#20352,#20346)
+#20353=*
-is_method(#20343)
+stmts(#20353,1,#20347,-2,"{}")
-#20354=*
+#20354=@"loc,{#10000},25,13,25,14"
-properties(#20354,#20312,6,8,"abstract x: number;")
+locations_default(#20354,#10000,25,13,25,14)
-#20355=@"loc,{#10000},28,3,28,21"
+hasLocation(#20353,#20354)
-locations_default(#20355,#10000,28,3,28,21)
+stmt_containers(#20353,#20347)
-hasLocation(#20354,#20355)
+is_method(#20344)
-#20356=*
+#20355=*
+properties(#20355,#20314,6,8,"abstract x: number;")
+#20356=@"loc,{#10000},28,3,28,21"
+locations_default(#20356,#10000,28,3,28,21)
+hasLocation(#20355,#20356)
 #20357=*
-exprs(#20357,0,#20354,0,"x")
-hasLocation(#20357,#20242)
-expr_containers(#20357,#20356)
-literals("x","x",#20357)
-is_abstract_member(#20354)
 #20358=*
-typeexprs(#20358,2,#20354,2,"number")
+exprs(#20358,0,#20355,0,"x")
-hasLocation(#20358,#20246)
+hasLocation(#20358,#20242)
-enclosing_stmt(#20358,#20312)
+expr_containers(#20358,#20357)
-expr_containers(#20358,#20001)
+literals("x","x",#20358)
-literals("number","number",#20358)
+is_abstract_member(#20355)
 #20359=*
-properties(#20359,#20312,7,0,"constructor() {}")
+typeexprs(#20359,2,#20355,2,"number")
-#20360=@"loc,{#10000},18,26,18,25"
+hasLocation(#20359,#20246)
-locations_default(#20360,#10000,18,26,18,25)
+enclosing_stmt(#20359,#20314)
-hasLocation(#20359,#20360)
+expr_containers(#20359,#20001)
-#20361=*
+literals("number","number",#20359)
-exprs(#20361,0,#20359,0,"constructor")
+#20360=*
-hasLocation(#20361,#20360)
+properties(#20360,#20314,7,0,"constructor() {}")
-enclosing_stmt(#20361,#20312)
+#20361=@"loc,{#10000},18,26,18,25"
-expr_containers(#20361,#20001)
+locations_default(#20361,#10000,18,26,18,25)
-literals("constructor","constructor",#20361)
+hasLocation(#20360,#20361)
-exprs(#20356,9,#20359,1,"() {}")
-hasLocation(#20356,#20360)
-enclosing_stmt(#20356,#20312)
-expr_containers(#20356,#20001)
 #20362=*
-scopes(#20362,1)
+exprs(#20362,0,#20360,0,"constructor")
-scopenodes(#20356,#20362)
+hasLocation(#20362,#20361)
-scopenesting(#20362,#20316)
+enclosing_stmt(#20362,#20314)
-#20363=@"var;{arguments};{#20362}"
+expr_containers(#20362,#20001)
-variables(#20363,"arguments",#20362)
+literals("constructor","constructor",#20362)
-is_arguments_object(#20363)
+exprs(#20357,9,#20360,1,"() {}")
-#20364=*
+hasLocation(#20357,#20361)
-stmts(#20364,1,#20356,-2,"{}")
+enclosing_stmt(#20357,#20314)
-hasLocation(#20364,#20360)
+expr_containers(#20357,#20001)
-stmt_containers(#20364,#20356)
+#20363=*
-is_method(#20359)
+scopes(#20363,1)
+scopenodes(#20357,#20363)
+scopenesting(#20363,#20317)
+#20364=@"var;{arguments};{#20363}"
+variables(#20364,"arguments",#20363)
+is_arguments_object(#20364)
 #20365=*
-entry_cfg_node(#20365,#20001)
+stmts(#20365,1,#20357,-2,"{}")
-#20366=@"loc,{#10000},2,1,2,0"
+hasLocation(#20365,#20361)
-locations_default(#20366,#10000,2,1,2,0)
+stmt_containers(#20365,#20357)
-hasLocation(#20365,#20366)
+is_method(#20360)
-#20367=*
+#20366=*
-exit_cfg_node(#20367,#20001)
+entry_cfg_node(#20366,#20001)
-hasLocation(#20367,#20251)
+#20367=@"loc,{#10000},2,1,2,0"
-successor(#20312,#20367)
+locations_default(#20367,#10000,2,1,2,0)
-successor(#20303,#20306)
+hasLocation(#20366,#20367)
 #20368=*
-entry_cfg_node(#20368,#20303)
+exit_cfg_node(#20368,#20001)
-hasLocation(#20368,#20307)
+hasLocation(#20368,#20251)
+successor(#20314,#20368)
+successor(#20305,#20308)
 #20369=*
-exit_cfg_node(#20369,#20303)
+entry_cfg_node(#20369,#20305)
-hasLocation(#20369,#20307)
+hasLocation(#20369,#20309)
-successor(#20311,#20369)
-successor(#20368,#20311)
-successor(#20308,#20303)
-successor(#20306,#20260)
-successor(#20293,#20290)
 #20370=*
-entry_cfg_node(#20370,#20293)
+exit_cfg_node(#20370,#20305)
-#20371=@"loc,{#10000},11,3,11,2"
+hasLocation(#20370,#20309)
-locations_default(#20371,#10000,11,3,11,2)
+successor(#20313,#20370)
-hasLocation(#20370,#20371)
+successor(#20369,#20313)
-#20372=*
+successor(#20310,#20305)
-exit_cfg_node(#20372,#20293)
+successor(#20308,#20262)
-#20373=@"loc,{#10000},11,15,11,14"
+successor(#20295,#20292)
-locations_default(#20373,#10000,11,15,11,14)
+#20371=*
-hasLocation(#20372,#20373)
+entry_cfg_node(#20371,#20295)
-successor(#20299,#20372)
+#20372=@"loc,{#10000},11,3,11,2"
-successor(#20296,#20299)
+locations_default(#20372,#10000,11,3,11,2)
-successor(#20370,#20296)
+hasLocation(#20371,#20372)
-successor(#20292,#20293)
+#20373=*
-successor(#20290,#20308)
+exit_cfg_node(#20373,#20295)
-successor(#20280,#20292)
+#20374=@"loc,{#10000},11,15,11,14"
-successor(#20270,#20280)
+locations_default(#20374,#10000,11,15,11,14)
-successor(#20264,#20270)
+hasLocation(#20373,#20374)
-successor(#20262,#20264)
+successor(#20301,#20373)
-successor(#20260,#20312)
+successor(#20298,#20301)
-successor(#20255,#20262)
+successor(#20371,#20298)
-successor(#20365,#20255)
+successor(#20294,#20295)
+successor(#20292,#20310)
+successor(#20282,#20294)
+successor(#20272,#20282)
+successor(#20266,#20272)
+successor(#20264,#20266)
+successor(#20262,#20314)
+successor(#20258,#20264)
+successor(#20366,#20258)
 numlines(#10000,29,15,8)
 filetype(#10000,"typescript")

javascript/extractor/tests/ts/output/trap/thisparameter.ts.trap

@@ -425,146 +425,146 @@ hasLocation(#20001,#20158)
 variables(#20159,"declaration",#20000)
 #20160=@"var;{f};{#20000}"
 variables(#20160,"f",#20000)
-#20161=@"var;{C};{#20000}"
+#20161=@"var;{ambient};{#20000}"
-variables(#20161,"C",#20000)
+variables(#20161,"ambient",#20000)
-#20162=@"local_type_name;{C};{#20000}"
+#20162=@"var;{C};{#20000}"
-local_type_names(#20162,"C",#20000)
+variables(#20162,"C",#20000)
-#20163=@"local_type_name;{I};{#20000}"
+#20163=@"local_type_name;{C};{#20000}"
-local_type_names(#20163,"I",#20000)
+local_type_names(#20163,"C",#20000)
-#20164=*
+#20164=@"local_type_name;{I};{#20000}"
-stmts(#20164,17,#20001,0,"functio ... ber) {}")
+local_type_names(#20164,"I",#20000)
-hasLocation(#20164,#20003)
-stmt_containers(#20164,#20001)
 #20165=*
-exprs(#20165,78,#20164,-1,"declaration")
+stmts(#20165,17,#20001,0,"functio ... ber) {}")
-hasLocation(#20165,#20033)
+hasLocation(#20165,#20003)
-expr_containers(#20165,#20164)
+stmt_containers(#20165,#20001)
-literals("declaration","declaration",#20165)
-decl(#20165,#20159)
 #20166=*
-scopes(#20166,1)
+exprs(#20166,78,#20165,-1,"declaration")
-scopenodes(#20164,#20166)
+hasLocation(#20166,#20033)
-scopenesting(#20166,#20000)
+expr_containers(#20166,#20165)
-#20167=@"var;{x};{#20166}"
+literals("declaration","declaration",#20166)
-variables(#20167,"x",#20166)
+decl(#20166,#20159)
-#20168=*
+#20167=*
-exprs(#20168,78,#20164,0,"x")
+scopes(#20167,1)
-hasLocation(#20168,#20045)
+scopenodes(#20165,#20167)
-expr_containers(#20168,#20164)
+scopenesting(#20167,#20000)
-literals("x","x",#20168)
+#20168=@"var;{x};{#20167}"
-decl(#20168,#20167)
+variables(#20168,"x",#20167)
-#20169=@"var;{arguments};{#20166}"
+#20169=*
-variables(#20169,"arguments",#20166)
+exprs(#20169,78,#20165,0,"x")
-is_arguments_object(#20169)
+hasLocation(#20169,#20045)
-#20170=*
+expr_containers(#20169,#20165)
-typeexprs(#20170,2,#20164,-4,"void")
+literals("x","x",#20169)
-hasLocation(#20170,#20041)
+decl(#20169,#20168)
-expr_containers(#20170,#20164)
+#20170=@"var;{arguments};{#20167}"
-literals("void","void",#20170)
+variables(#20170,"arguments",#20167)
+is_arguments_object(#20170)
 #20171=*
-typeexprs(#20171,2,#20164,-6,"number")
+typeexprs(#20171,2,#20165,-4,"void")
-hasLocation(#20171,#20049)
+hasLocation(#20171,#20041)
-expr_containers(#20171,#20164)
+expr_containers(#20171,#20165)
-literals("number","number",#20171)
+literals("void","void",#20171)
 #20172=*
-stmts(#20172,1,#20164,-2,"{}")
+typeexprs(#20172,2,#20165,-6,"number")
-#20173=@"loc,{#10000},1,45,1,46"
+hasLocation(#20172,#20049)
-locations_default(#20173,#10000,1,45,1,46)
+expr_containers(#20172,#20165)
-hasLocation(#20172,#20173)
+literals("number","number",#20172)
-stmt_containers(#20172,#20164)
+#20173=*
-#20174=*
+stmts(#20173,1,#20165,-2,"{}")
-stmts(#20174,18,#20001,1,"var f = ... ber) {}")
+#20174=@"loc,{#10000},1,45,1,46"
-hasLocation(#20174,#20007)
+locations_default(#20174,#10000,1,45,1,46)
-stmt_containers(#20174,#20001)
+hasLocation(#20173,#20174)
+stmt_containers(#20173,#20165)
 #20175=*
-exprs(#20175,64,#20174,0,"f = fun ... ber) {}")
+stmts(#20175,18,#20001,1,"var f = ... ber) {}")
-#20176=@"loc,{#10000},3,5,3,44"
+hasLocation(#20175,#20007)
-locations_default(#20176,#10000,3,5,3,44)
+stmt_containers(#20175,#20001)
-hasLocation(#20175,#20176)
+#20176=*
-enclosing_stmt(#20175,#20174)
+exprs(#20176,64,#20175,0,"f = fun ... ber) {}")
-expr_containers(#20175,#20001)
+#20177=@"loc,{#10000},3,5,3,44"
-#20177=*
+locations_default(#20177,#10000,3,5,3,44)
-exprs(#20177,78,#20175,0,"f")
+hasLocation(#20176,#20177)
-hasLocation(#20177,#20059)
+enclosing_stmt(#20176,#20175)
-enclosing_stmt(#20177,#20174)
+expr_containers(#20176,#20001)
-expr_containers(#20177,#20001)
-literals("f","f",#20177)
-decl(#20177,#20160)
 #20178=*
-exprs(#20178,9,#20175,1,"functio ... ber) {}")
+exprs(#20178,78,#20176,0,"f")
-#20179=@"loc,{#10000},3,9,3,44"
+hasLocation(#20178,#20059)
-locations_default(#20179,#10000,3,9,3,44)
+enclosing_stmt(#20178,#20175)
-hasLocation(#20178,#20179)
-enclosing_stmt(#20178,#20174)
 expr_containers(#20178,#20001)
-#20180=*
+literals("f","f",#20178)
-scopes(#20180,1)
+decl(#20178,#20160)
-scopenodes(#20178,#20180)
+#20179=*
-scopenesting(#20180,#20000)
+exprs(#20179,9,#20176,1,"functio ... ber) {}")
-#20181=@"var;{x};{#20180}"
+#20180=@"loc,{#10000},3,9,3,44"
-variables(#20181,"x",#20180)
+locations_default(#20180,#10000,3,9,3,44)
-#20182=*
+hasLocation(#20179,#20180)
-exprs(#20182,78,#20178,0,"x")
+enclosing_stmt(#20179,#20175)
-hasLocation(#20182,#20075)
+expr_containers(#20179,#20001)
-expr_containers(#20182,#20178)
+#20181=*
-literals("x","x",#20182)
+scopes(#20181,1)
-decl(#20182,#20181)
+scopenodes(#20179,#20181)
-#20183=@"var;{arguments};{#20180}"
+scopenesting(#20181,#20000)
-variables(#20183,"arguments",#20180)
+#20182=@"var;{x};{#20181}"
-is_arguments_object(#20183)
+variables(#20182,"x",#20181)
-#20184=*
+#20183=*
-typeexprs(#20184,2,#20178,-4,"string")
+exprs(#20183,78,#20179,0,"x")
-hasLocation(#20184,#20071)
+hasLocation(#20183,#20075)
-expr_containers(#20184,#20178)
+expr_containers(#20183,#20179)
-literals("string","string",#20184)
+literals("x","x",#20183)
+decl(#20183,#20182)
+#20184=@"var;{arguments};{#20181}"
+variables(#20184,"arguments",#20181)
+is_arguments_object(#20184)
 #20185=*
-typeexprs(#20185,2,#20178,-6,"number")
+typeexprs(#20185,2,#20179,-4,"string")
-hasLocation(#20185,#20079)
+hasLocation(#20185,#20071)
-expr_containers(#20185,#20178)
+expr_containers(#20185,#20179)
-literals("number","number",#20185)
+literals("string","string",#20185)
 #20186=*
-stmts(#20186,1,#20178,-2,"{}")
+typeexprs(#20186,2,#20179,-6,"number")
-#20187=@"loc,{#10000},3,43,3,44"
+hasLocation(#20186,#20079)
-locations_default(#20187,#10000,3,43,3,44)
+expr_containers(#20186,#20179)
-hasLocation(#20186,#20187)
+literals("number","number",#20186)
-stmt_containers(#20186,#20178)
+#20187=*
-#20188=*
+stmts(#20187,1,#20179,-2,"{}")
-stmts(#20188,17,#20001,2,"declare ... umber);")
+#20188=@"loc,{#10000},3,43,3,44"
-hasLocation(#20188,#20011)
+locations_default(#20188,#10000,3,43,3,44)
-stmt_containers(#20188,#20001)
+hasLocation(#20187,#20188)
-has_declare_keyword(#20188)
+stmt_containers(#20187,#20179)
 #20189=*
-exprs(#20189,78,#20188,-1,"ambient")
+stmts(#20189,17,#20001,2,"declare ... umber);")
-hasLocation(#20189,#20091)
+hasLocation(#20189,#20011)
-expr_containers(#20189,#20188)
+stmt_containers(#20189,#20001)
-literals("ambient","ambient",#20189)
+has_declare_keyword(#20189)
-#20190=@"var;{ambient};{#20000}"
+#20190=*
-variables(#20190,"ambient",#20000)
+exprs(#20190,78,#20189,-1,"ambient")
-decl(#20189,#20190)
+hasLocation(#20190,#20091)
+expr_containers(#20190,#20189)
+literals("ambient","ambient",#20190)
+decl(#20190,#20161)
 #20191=*
 scopes(#20191,1)
-scopenodes(#20188,#20191)
+scopenodes(#20189,#20191)
 scopenesting(#20191,#20000)
 #20192=@"var;{x};{#20191}"
 variables(#20192,"x",#20191)
 #20193=*
-exprs(#20193,78,#20188,0,"x")
+exprs(#20193,78,#20189,0,"x")
 hasLocation(#20193,#20103)
-expr_containers(#20193,#20188)
+expr_containers(#20193,#20189)
 literals("x","x",#20193)
 decl(#20193,#20192)
 #20194=@"var;{arguments};{#20191}"
 variables(#20194,"arguments",#20191)
 is_arguments_object(#20194)
 #20195=*
-typeexprs(#20195,2,#20188,-4,"string")
+typeexprs(#20195,2,#20189,-4,"string")
 hasLocation(#20195,#20099)
-expr_containers(#20195,#20188)
+expr_containers(#20195,#20189)
 literals("string","string",#20195)
 #20196=*
-typeexprs(#20196,2,#20188,-6,"number")
+typeexprs(#20196,2,#20189,-6,"number")
 hasLocation(#20196,#20107)
-expr_containers(#20196,#20188)
+expr_containers(#20196,#20189)
 literals("number","number",#20196)
 #20197=*
 stmts(#20197,26,#20001,3,"class C ... C) {}\n}")
@@ -578,8 +578,8 @@ hasLocation(#20199,#20115)
 enclosing_stmt(#20199,#20197)
 expr_containers(#20199,#20001)
 literals("C","C",#20199)
-decl(#20199,#20161)
+decl(#20199,#20162)
-typedecl(#20199,#20162)
+typedecl(#20199,#20163)
 #20200=*
 scopes(#20200,10)
 scopenodes(#20197,#20200)
@@ -612,7 +612,7 @@ typeexprs(#20207,0,#20204,-4,"C")
 hasLocation(#20207,#20127)
 expr_containers(#20207,#20204)
 literals("C","C",#20207)
-typebind(#20207,#20162)
+typebind(#20207,#20163)
 #20208=*
 stmts(#20208,1,#20204,-2,"{}")
 #20209=@"loc,{#10000},8,19,8,20"
@@ -660,7 +660,7 @@ hasLocation(#20219,#20138)
 enclosing_stmt(#20219,#20217)
 expr_containers(#20219,#20001)
 literals("I","I",#20219)
-typedecl(#20219,#20163)
+typedecl(#20219,#20164)
 #20220=*
 properties(#20220,#20217,2,0,"method(this: I);")
 #20221=@"loc,{#10000},12,3,12,18"
@@ -689,7 +689,7 @@ typeexprs(#20226,0,#20223,-4,"I")
 hasLocation(#20226,#20150)
 expr_containers(#20226,#20223)
 literals("I","I",#20226)
-typebind(#20226,#20163)
+typebind(#20226,#20164)
 is_method(#20220)
 is_abstract_member(#20220)
 #20227=*
@@ -729,37 +729,37 @@ successor(#20203,#20204)
 successor(#20201,#20212)
 successor(#20199,#20203)
 successor(#20197,#20217)
-successor(#20188,#20199)
+successor(#20189,#20199)
-successor(#20174,#20177)
+successor(#20175,#20178)
-successor(#20178,#20175)
+successor(#20179,#20176)
 #20236=*
-entry_cfg_node(#20236,#20178)
+entry_cfg_node(#20236,#20179)
 #20237=@"loc,{#10000},3,9,3,8"
 locations_default(#20237,#10000,3,9,3,8)
 hasLocation(#20236,#20237)
 #20238=*
-exit_cfg_node(#20238,#20178)
+exit_cfg_node(#20238,#20179)
 #20239=@"loc,{#10000},3,45,3,44"
 locations_default(#20239,#10000,3,45,3,44)
 hasLocation(#20238,#20239)
-successor(#20186,#20238)
+successor(#20187,#20238)
-successor(#20182,#20186)
+successor(#20183,#20187)
-successor(#20236,#20182)
+successor(#20236,#20183)
-successor(#20177,#20178)
+successor(#20178,#20179)
-successor(#20175,#20188)
+successor(#20176,#20189)
-successor(#20164,#20174)
+successor(#20165,#20175)
 #20240=*
-entry_cfg_node(#20240,#20164)
+entry_cfg_node(#20240,#20165)
 hasLocation(#20240,#20228)
 #20241=*
-exit_cfg_node(#20241,#20164)
+exit_cfg_node(#20241,#20165)
 #20242=@"loc,{#10000},1,47,1,46"
 locations_default(#20242,#10000,1,47,1,46)
 hasLocation(#20241,#20242)
-successor(#20172,#20241)
+successor(#20173,#20241)
-successor(#20168,#20172)
+successor(#20169,#20173)
-successor(#20240,#20168)
+successor(#20240,#20169)
-successor(#20165,#20164)
+successor(#20166,#20165)
-successor(#20227,#20165)
+successor(#20227,#20166)
 numlines(#10000,14,9,0)
 filetype(#10000,"typescript")

javascript/ql/integration-tests/query-suite/javascript-code-quality.qls.expected

@@ -1,6 +1,8 @@
 ql/javascript/ql/src/Declarations/IneffectiveParameterType.ql
+ql/javascript/ql/src/Declarations/SuspiciousMethodNameDeclaration.ql
 ql/javascript/ql/src/Expressions/ExprHasNoEffect.ql
 ql/javascript/ql/src/Expressions/MissingAwait.ql
 ql/javascript/ql/src/LanguageFeatures/SpuriousArguments.ql
 ql/javascript/ql/src/Quality/UnhandledErrorInStreamPipeline.ql
+ql/javascript/ql/src/RegExp/DuplicateCharacterInCharacterClass.ql
 ql/javascript/ql/src/RegExp/RegExpAlwaysMatches.ql

javascript/ql/integration-tests/query-suite/not_included_in_qls.expected

@@ -147,4 +147,3 @@ ql/javascript/ql/src/meta/extraction-metrics/FileData.ql
 ql/javascript/ql/src/meta/extraction-metrics/MissingMetrics.ql
 ql/javascript/ql/src/meta/extraction-metrics/PhaseTimings.ql
 ql/javascript/ql/src/meta/types/TypedExprs.ql
-ql/javascript/ql/src/meta/types/TypesWithQualifiedName.ql

javascript/ql/lib/Expressions/ExprHasNoEffect.qll

@@ -22,6 +22,9 @@ predicate inVoidContext(Expr e) {
     )
   )
   or
+  // propagate void context through parenthesized expressions
+  inVoidContext(e.getParent().(ParExpr))
+  or
   exists(SeqExpr seq, int i, int n |
     e = seq.getOperand(i) and
     n = seq.getNumOperands()
@@ -129,6 +132,19 @@ predicate noSideEffects(Expr e) {
   )
 }
 
+/**
+ * Holds if `e` is a compound expression that may contain sub-expressions with side effects.
+ * We should not flag these directly as useless since we want to flag only the innermost
+ * expressions that actually have no effect.
+ */
+predicate isCompoundExpression(Expr e) {
+  e instanceof LogicalBinaryExpr
+  or
+  e instanceof SeqExpr
+  or
+  e instanceof ParExpr
+}
+
 /**
  * Holds if the expression `e` should be reported as having no effect.
  */
@@ -145,6 +161,7 @@ predicate hasNoEffect(Expr e) {
   not isDeclaration(e) and
   // exclude DOM properties, which sometimes have magical auto-update properties
   not isDomProperty(e.(PropAccess).getPropertyName()) and
+  not isCompoundExpression(e) and
   // exclude xUnit.js annotations
   not e instanceof XUnitAnnotation and
   // exclude common patterns that are most likely intentional
@@ -157,7 +174,17 @@ predicate hasNoEffect(Expr e) {
     not exists(fe.getName())
   ) and
   // exclude block-level flow type annotations. For example: `(name: empty)`.
-  not e.(ParExpr).getExpression().getLastToken().getNextToken().getValue() = ":" and
+  not exists(ParExpr parent |
+    e.getParent() = parent and
+    e.getLastToken().getNextToken().getValue() = ":"
+  ) and
+  // exclude expressions that are part of a conditional expression
+  not exists(ConditionalExpr cond | e = cond.getABranch() |
+    e instanceof NullLiteral or
+    e.(GlobalVarAccess).getName() = "undefined" or
+    e.(NumberLiteral).getIntValue() = 0 or
+    e instanceof VoidExpr
+  ) and
   // exclude the first statement of a try block
   not e = any(TryStmt stmt).getBody().getStmt(0).(ExprStmt).getExpr() and
   // exclude expressions that are alone in a file, and file doesn't contain a function.

javascript/ql/lib/definitions.qll

@@ -153,17 +153,7 @@ private predicate jsdocTypeLookup(JSDocNamedTypeExpr ref, AstNode decl, string k
   kind = "T"
 }
 
-/**
+private AstNode definitionOfRaw(Locatable e, string kind) {
- * Gets an element, of kind `kind`, that element `e` uses, if any.
- *
- * The `kind` is a string representing what kind of use it is:
- *  - `"M"` for function and method calls
- *  - `"T"` for uses of types
- *  - `"V"` for variable accesses
- *  - `"I"` for imports
- */
-cached
-AstNode definitionOf(Locatable e, string kind) {
   variableDefLookup(e, result, kind)
   or
   // prefer definitions over declarations
@@ -179,3 +169,46 @@ AstNode definitionOf(Locatable e, string kind) {
   or
   jsdocTypeLookup(e, result, kind)
 }
+
+/** Gets a more useful node to show for something that resolves to `node`. */
+private AstNode redirectOnce(AstNode node) {
+  exists(ConstructorDeclaration ctor |
+    ctor.isSynthetic() and
+    node = ctor.getBody() and
+    result = ctor.getDeclaringClass()
+  )
+  or
+  exists(ClassDefinition cls |
+    node = cls and
+    result = cls.getIdentifier()
+  )
+  or
+  exists(FunctionDeclStmt decl |
+    node = decl and
+    result = decl.getIdentifier()
+  )
+  or
+  exists(MethodDeclaration member |
+    not member instanceof ConstructorDeclaration and
+    node = member.getBody() and
+    result = member.getNameExpr()
+  )
+}
+
+private AstNode redirect(AstNode node) {
+  node = definitionOfRaw(_, _) and
+  result = redirectOnce*(node) and
+  not exists(redirectOnce(result))
+}
+
+/**
+ * Gets an element, of kind `kind`, that element `e` uses, if any.
+ *
+ * The `kind` is a string representing what kind of use it is:
+ *  - `"M"` for function and method calls
+ *  - `"T"` for uses of types
+ *  - `"V"` for variable accesses
+ *  - `"I"` for imports
+ */
+cached
+AstNode definitionOf(Locatable e, string kind) { result = redirect(definitionOfRaw(e, kind)) }

javascript/ql/lib/semmle/javascript/ApiGraphs.qll

@@ -649,11 +649,13 @@ module API {
     /** Gets a node corresponding to an import of module `m` without taking into account types from models. */
     Node getAModuleImportRaw(string m) {
       result = Impl::MkModuleImport(m) or
-      result = Impl::MkModuleImport(m).(Node).getMember("default")
+      result = Impl::MkModuleImport(m).(Node).getMember("default") or
+      result = Impl::MkTypeUse(m, "")
     }
 
     /** Gets a node whose type has the given qualified name, not including types from models. */
     Node getANodeOfTypeRaw(string moduleName, string exportedName) {
+      exportedName != "" and
       result = Impl::MkTypeUse(moduleName, exportedName).(Node).getInstance()
       or
       exportedName = "" and
@@ -749,18 +751,14 @@ module API {
       MkModuleImport(string m) {
         imports(_, m)
         or
-        any(TypeAnnotation n).hasQualifiedName(m, _)
+        any(TypeAnnotation n).hasUnderlyingType(m, _)
-        or
-        any(Type t).hasUnderlyingType(m, _)
       } or
       MkClassInstance(DataFlow::ClassNode cls) { needsDefNode(cls) } or
       MkDef(DataFlow::Node nd) { rhs(_, _, nd) } or
       MkUse(DataFlow::Node nd) { use(_, _, nd) } or
       /** A use of a TypeScript type. */
       MkTypeUse(string moduleName, string exportName) {
-        any(TypeAnnotation n).hasQualifiedName(moduleName, exportName)
+        any(TypeAnnotation n).hasUnderlyingType(moduleName, exportName)
-        or
-        any(Type t).hasUnderlyingType(moduleName, exportName)
       } or
       MkSyntheticCallbackArg(DataFlow::Node src, int bound, DataFlow::InvokeNode nd) {
         trackUseNode(src, true, bound, "").flowsTo(nd.getCalleeNode())

javascript/ql/lib/semmle/javascript/Closure.qll

@@ -5,17 +5,49 @@
 import javascript
 
 module Closure {
+  /** A call to `goog.require` */
+  class RequireCallExpr extends CallExpr {
+    RequireCallExpr() { this.getCallee().(PropAccess).getQualifiedName() = "goog.require" }
+
+    /** Gets the imported namespace name. */
+    string getClosureNamespace() { result = this.getArgument(0).getStringValue() }
+  }
+
+  /** A call to `goog.provide` */
+  class ProvideCallExpr extends CallExpr {
+    ProvideCallExpr() { this.getCallee().(PropAccess).getQualifiedName() = "goog.provide" }
+
+    /** Gets the imported namespace name. */
+    string getClosureNamespace() { result = this.getArgument(0).getStringValue() }
+  }
+
+  /** A call to `goog.module` or `goog.declareModuleId`. */
+  private class ModuleDeclarationCall extends CallExpr {
+    private string kind;
+
+    ModuleDeclarationCall() {
+      this.getCallee().(PropAccess).getQualifiedName() = kind and
+      kind = ["goog.module", "goog.declareModuleId"]
+    }
+
+    /** Gets the declared namespace. */
+    string getClosureNamespace() { result = this.getArgument(0).getStringValue() }
+
+    /** Gets the string `goog.module` or `goog.declareModuleId` depending on which method is being called. */
+    string getModuleKind() { result = kind }
+  }
+
   /**
    * A reference to a Closure namespace.
    */
-  class ClosureNamespaceRef extends DataFlow::Node instanceof ClosureNamespaceRef::Range {
+  deprecated class ClosureNamespaceRef extends DataFlow::Node instanceof ClosureNamespaceRef::Range {
     /**
      * Gets the namespace being referenced.
      */
     string getClosureNamespace() { result = super.getClosureNamespace() }
   }
 
-  module ClosureNamespaceRef {
+  deprecated module ClosureNamespaceRef {
     /**
      * A reference to a Closure namespace.
      *
@@ -32,10 +64,10 @@ module Closure {
   /**
    * A data flow node that returns the value of a closure namespace.
    */
-  class ClosureNamespaceAccess extends ClosureNamespaceRef instanceof ClosureNamespaceAccess::Range {
+  deprecated class ClosureNamespaceAccess extends ClosureNamespaceRef instanceof ClosureNamespaceAccess::Range
-  }
+  { }
 
-  module ClosureNamespaceAccess {
+  deprecated module ClosureNamespaceAccess {
     /**
      * A data flow node that returns the value of a closure namespace.
      *
@@ -47,7 +79,7 @@ module Closure {
   /**
    * A call to a method on the `goog.` namespace, as a closure reference.
    */
-  abstract private class DefaultNamespaceRef extends DataFlow::MethodCallNode,
+  abstract deprecated private class DefaultNamespaceRef extends DataFlow::MethodCallNode,
     ClosureNamespaceRef::Range
   {
     DefaultNamespaceRef() { this = DataFlow::globalVarRef("goog").getAMethodCall() }
@@ -59,14 +91,14 @@ module Closure {
    * Holds if `node` is the data flow node corresponding to the expression in
    * a top-level expression statement.
    */
-  private predicate isTopLevelExpr(DataFlow::Node node) {
+  deprecated private predicate isTopLevelExpr(DataFlow::Node node) {
     any(TopLevel tl).getAChildStmt().(ExprStmt).getExpr().flow() = node
   }
 
   /**
    * A top-level call to `goog.provide`.
    */
-  private class DefaultClosureProvideCall extends DefaultNamespaceRef {
+  deprecated private class DefaultClosureProvideCall extends DefaultNamespaceRef {
     DefaultClosureProvideCall() {
       this.getMethodName() = "provide" and
       isTopLevelExpr(this)
@@ -76,13 +108,14 @@ module Closure {
   /**
    * A top-level call to `goog.provide`.
    */
-  class ClosureProvideCall extends ClosureNamespaceRef, DataFlow::MethodCallNode instanceof DefaultClosureProvideCall
+  deprecated class ClosureProvideCall extends ClosureNamespaceRef, DataFlow::MethodCallNode instanceof DefaultClosureProvideCall
   { }
 
   /**
    * A call to `goog.require`.
    */
-  private class DefaultClosureRequireCall extends DefaultNamespaceRef, ClosureNamespaceAccess::Range
+  deprecated private class DefaultClosureRequireCall extends DefaultNamespaceRef,
+    ClosureNamespaceAccess::Range
   {
     DefaultClosureRequireCall() { this.getMethodName() = "require" }
   }
@@ -90,13 +123,13 @@ module Closure {
   /**
    * A call to `goog.require`.
    */
-  class ClosureRequireCall extends ClosureNamespaceAccess, DataFlow::MethodCallNode instanceof DefaultClosureRequireCall
+  deprecated class ClosureRequireCall extends ClosureNamespaceAccess, DataFlow::MethodCallNode instanceof DefaultClosureRequireCall
   { }
 
   /**
    * A top-level call to `goog.module` or `goog.declareModuleId`.
    */
-  private class DefaultClosureModuleDeclaration extends DefaultNamespaceRef {
+  deprecated private class DefaultClosureModuleDeclaration extends DefaultNamespaceRef {
     DefaultClosureModuleDeclaration() {
       (this.getMethodName() = "module" or this.getMethodName() = "declareModuleId") and
       isTopLevelExpr(this)
@@ -106,41 +139,29 @@ module Closure {
   /**
    * A top-level call to `goog.module` or `goog.declareModuleId`.
    */
-  class ClosureModuleDeclaration extends ClosureNamespaceRef, DataFlow::MethodCallNode instanceof DefaultClosureModuleDeclaration
+  deprecated class ClosureModuleDeclaration extends ClosureNamespaceRef, DataFlow::MethodCallNode instanceof DefaultClosureModuleDeclaration
   { }
 
-  private GlobalVariable googVariable() { variables(result, "goog", any(GlobalScope sc)) }
-
-  pragma[nomagic]
-  private MethodCallExpr googModuleDeclExpr() {
-    result.getReceiver() = googVariable().getAnAccess() and
-    result.getMethodName() = ["module", "declareModuleId"]
-  }
-
-  pragma[nomagic]
-  private MethodCallExpr googModuleDeclExprInContainer(StmtContainer container) {
-    result = googModuleDeclExpr() and
-    container = result.getContainer()
-  }
-
   pragma[noinline]
-  private ClosureRequireCall getARequireInTopLevel(ClosureModule m) { result.getTopLevel() = m }
+  private RequireCallExpr getARequireInTopLevel(ClosureModule m) { result.getTopLevel() = m }
 
   /**
    * A module using the Closure module system, declared using `goog.module()` or `goog.declareModuleId()`.
    */
   class ClosureModule extends Module {
-    ClosureModule() { exists(googModuleDeclExprInContainer(this)) }
+    private ModuleDeclarationCall decl;
+
+    ClosureModule() { decl.getTopLevel() = this }
 
     /**
      * Gets the call to `goog.module` or `goog.declareModuleId` in this module.
      */
-    ClosureModuleDeclaration getModuleDeclaration() { result.getTopLevel() = this }
+    deprecated ClosureModuleDeclaration getModuleDeclaration() { result.getTopLevel() = this }
 
     /**
      * Gets the namespace of this module.
      */
-    string getClosureNamespace() { result = this.getModuleDeclaration().getClosureNamespace() }
+    string getClosureNamespace() { result = decl.getClosureNamespace() }
 
     override Module getAnImportedModule() {
       result.(ClosureModule).getClosureNamespace() =
@@ -156,7 +177,7 @@ module Closure {
      * Has no result for ES6 modules using `goog.declareModuleId`.
      */
     Variable getExportsVariable() {
-      this.getModuleDeclaration().getMethodName() = "module" and
+      decl.getModuleKind() = "goog.module" and
       result = this.getScope().getVariable("exports")
     }
 
@@ -185,15 +206,15 @@ module Closure {
     ClosureScript() {
       not this instanceof ClosureModule and
       (
-        any(ClosureProvideCall provide).getTopLevel() = this
+        any(ProvideCallExpr provide).getTopLevel() = this
         or
-        any(ClosureRequireCall require).getTopLevel() = this
+        any(RequireCallExpr require).getTopLevel() = this
       )
     }
 
     /** Gets the identifier of a namespace required by this module. */
     string getARequiredNamespace() {
-      exists(ClosureRequireCall require |
+      exists(RequireCallExpr require |
         require.getTopLevel() = this and
         result = require.getClosureNamespace()
       )
@@ -201,7 +222,7 @@ module Closure {
 
     /** Gets the identifer of a namespace provided by this module. */
     string getAProvidedNamespace() {
-      exists(ClosureProvideCall require |
+      exists(ProvideCallExpr require |
         require.getTopLevel() = this and
         result = require.getClosureNamespace()
       )
@@ -213,7 +234,13 @@ module Closure {
    */
   pragma[noinline]
   predicate isClosureNamespace(string name) {
-    exists(string namespace | namespace = any(ClosureNamespaceRef ref).getClosureNamespace() |
+    exists(string namespace |
+      namespace =
+        [
+          any(RequireCallExpr ref).getClosureNamespace(),
+          any(ModuleDeclarationCall c).getClosureNamespace()
+        ]
+    |
       name = namespace.substring(0, namespace.indexOf("."))
       or
       name = namespace

javascript/ql/lib/semmle/javascript/ES2015Modules.qll

@@ -180,6 +180,9 @@ deprecated private class LiteralImportPath extends PathExpr, ConstantString {
  * ```
  */
 class ImportSpecifier extends Expr, @import_specifier {
+  /** Gets the import declaration in which this specifier appears. */
+  ImportDeclaration getImportDeclaration() { result.getASpecifier() = this }
+
   /** Gets the imported symbol; undefined for default and namespace import specifiers. */
   Identifier getImported() { result = this.getChildExpr(0) }
 

javascript/ql/lib/semmle/javascript/Expr.qll

@@ -4,6 +4,7 @@
 
 import javascript
 private import semmle.javascript.internal.CachedStages
+private import semmle.javascript.internal.TypeResolution
 
 /**
  * A program element that is either an expression or a type annotation.
@@ -1017,7 +1018,11 @@ class InvokeExpr extends @invokeexpr, Expr {
    * Note that the resolved function may be overridden in a subclass and thus is not
    * necessarily the actual target of this invocation at runtime.
    */
-  Function getResolvedCallee() { result = this.getResolvedCalleeName().getImplementation() }
+  Function getResolvedCallee() {
+    TypeResolution::callTarget(this, result)
+    or
+    result = this.getResolvedCalleeName().getImplementation()
+  }
 }
 
 /**

javascript/ql/lib/semmle/javascript/GlobalAccessPaths.qll

@@ -34,7 +34,7 @@ module AccessPath {
       not this.accessesGlobal(_) and
       not this instanceof DataFlow::PropRead and
       not this instanceof PropertyProjection and
-      not this instanceof Closure::ClosureNamespaceAccess and
+      not this.asExpr() instanceof Closure::RequireCallExpr and
       not this = DataFlow::parameterNode(any(ImmediatelyInvokedFunctionExpr iife).getAParameter()) and
       not FlowSteps::identityFunctionStep(_, this)
     }
@@ -139,8 +139,8 @@ module AccessPath {
       result = join(fromReference(prop.getBase(), root), "[number]")
     )
     or
-    exists(Closure::ClosureNamespaceAccess acc | node = acc |
+    exists(Closure::RequireCallExpr req | node = req.flow() |
-      result = acc.getClosureNamespace() and
+      result = req.getClosureNamespace() and
       root.isGlobal()
     )
     or

javascript/ql/lib/semmle/javascript/JSDoc.qll

@@ -33,6 +33,9 @@ class JSDoc extends @jsdoc, Locatable {
     result.getTitle() = title
   }
 
+  /** Gets the element to which this JSDoc comment is attached */
+  Documentable getDocumentedElement() { result.getDocumentation() = this }
+
   override string toString() { result = this.getComment().toString() }
 }
 
@@ -299,6 +302,41 @@ class JSDocIdentifierTypeExpr extends @jsdoc_identifier_type_expr, JSDocTypeExpr
   override predicate isRawFunction() { this.getName() = "Function" }
 }
 
+private AstNode getAncestorInScope(Documentable doc) {
+  any(JSDocLocalTypeAccess t).getJSDocComment() = doc.getDocumentation() and // restrict to cases where we need this
+  result = doc.getParent()
+  or
+  exists(AstNode mid |
+    mid = getAncestorInScope(doc) and
+    not mid = any(Scope s).getScopeElement() and
+    result = mid.getParent()
+  )
+}
+
+private Scope getScope(Documentable doc) { result.getScopeElement() = getAncestorInScope(doc) }
+
+pragma[nomagic]
+private predicate shouldResolveName(TopLevel top, string name) {
+  exists(JSDocLocalTypeAccess access |
+    access.getName() = name and
+    access.getTopLevel() = top
+  )
+}
+
+private LexicalName getOwnLocal(Scope scope, string name, DeclarationSpace space) {
+  scope = result.getScope() and
+  name = result.getName() and
+  space = result.getDeclarationSpace() and
+  shouldResolveName(scope.getScopeElement().getTopLevel(), name) // restrict size of predicate
+}
+
+private LexicalName resolveLocal(Scope scope, string name, DeclarationSpace space) {
+  result = getOwnLocal(scope, name, space)
+  or
+  result = resolveLocal(scope.getOuterScope(), name, space) and
+  not exists(getOwnLocal(scope, name, space))
+}
+
 /**
  * An unqualified identifier in a JSDoc type expression.
  *
@@ -311,6 +349,12 @@ class JSDocIdentifierTypeExpr extends @jsdoc_identifier_type_expr, JSDocTypeExpr
  */
 class JSDocLocalTypeAccess extends JSDocIdentifierTypeExpr {
   JSDocLocalTypeAccess() { not this = any(JSDocQualifiedTypeAccess a).getNameNode() }
+
+  /** Gets a variable, type-name, or namespace that this expression may resolve to. */
+  LexicalName getALexicalName() {
+    result =
+      resolveLocal(getScope(this.getJSDocComment().getDocumentedElement()), this.getName(), _)
+  }
 }
 
 /**
@@ -371,7 +415,7 @@ class JSDocNamedTypeExpr extends JSDocTypeExpr {
    * - `foo.bar.Baz` has prefix `foo` and suffix `.bar.Baz`.
    * - `Baz` has prefix `Baz` and an empty suffix.
    */
-  predicate hasNameParts(string prefix, string suffix) {
+  deprecated predicate hasNameParts(string prefix, string suffix) {
     not this = any(JSDocQualifiedTypeAccess a).getBase() and // restrict size of predicate
     exists(string regex, string name | regex = "([^.]+)(.*)" |
       name = this.getRawName() and
@@ -379,46 +423,6 @@ class JSDocNamedTypeExpr extends JSDocTypeExpr {
       suffix = name.regexpCapture(regex, 2)
     )
   }
-
-  pragma[noinline]
-  pragma[nomagic]
-  private predicate hasNamePartsAndEnv(string prefix, string suffix, JSDoc::Environment env) {
-    // Force join ordering
-    this.hasNameParts(prefix, suffix) and
-    env.isContainerInScope(this.getContainer())
-  }
-
-  /**
-   * Gets the qualified name of this name by resolving its prefix, if any.
-   */
-  cached
-  private string resolvedName() {
-    exists(string prefix, string suffix, JSDoc::Environment env |
-      this.hasNamePartsAndEnv(prefix, suffix, env) and
-      result = env.resolveAlias(prefix) + suffix
-    )
-  }
-
-  override predicate hasQualifiedName(string globalName) {
-    globalName = this.resolvedName()
-    or
-    not exists(this.resolvedName()) and
-    globalName = this.getRawName()
-  }
-
-  override DataFlow::ClassNode getClass() {
-    exists(string name |
-      this.hasQualifiedName(name) and
-      result.hasQualifiedName(name)
-    )
-    or
-    // Handle case where a local variable has a reference to the class,
-    // but the class doesn't have a globally qualified name.
-    exists(string alias, JSDoc::Environment env |
-      this.hasNamePartsAndEnv(alias, "", env) and
-      result.getAClassReference().flowsTo(env.getNodeFromAlias(alias))
-    )
-  }
 }
 
 /**
@@ -447,12 +451,6 @@ class JSDocAppliedTypeExpr extends @jsdoc_applied_type_expr, JSDocTypeExpr {
    * For example, in `Array<string>`, `string` is the only argument type.
    */
   JSDocTypeExpr getAnArgument() { result = this.getArgument(_) }
-
-  override predicate hasQualifiedName(string globalName) {
-    this.getHead().hasQualifiedName(globalName)
-  }
-
-  override DataFlow::ClassNode getClass() { result = this.getHead().getClass() }
 }
 
 /**
@@ -472,8 +470,6 @@ class JSDocNullableTypeExpr extends @jsdoc_nullable_type_expr, JSDocTypeExpr {
   predicate isPrefix() { jsdoc_prefix_qualifier(this) }
 
   override JSDocTypeExpr getAnUnderlyingType() { result = this.getTypeExpr().getAnUnderlyingType() }
-
-  override DataFlow::ClassNode getClass() { result = this.getTypeExpr().getClass() }
 }
 
 /**
@@ -493,8 +489,6 @@ class JSDocNonNullableTypeExpr extends @jsdoc_non_nullable_type_expr, JSDocTypeE
   predicate isPrefix() { jsdoc_prefix_qualifier(this) }
 
   override JSDocTypeExpr getAnUnderlyingType() { result = this.getTypeExpr().getAnUnderlyingType() }
-
-  override DataFlow::ClassNode getClass() { result = this.getTypeExpr().getClass() }
 }
 
 /**
@@ -599,8 +593,6 @@ class JSDocOptionalParameterTypeExpr extends @jsdoc_optional_type_expr, JSDocTyp
   override JSDocTypeExpr getAnUnderlyingType() {
     result = this.getUnderlyingType().getAnUnderlyingType()
   }
-
-  override DataFlow::ClassNode getClass() { result = this.getUnderlyingType().getClass() }
 }
 
 /**
@@ -635,7 +627,7 @@ module JSDoc {
   /**
    * A statement container which may declare JSDoc name aliases.
    */
-  class Environment extends StmtContainer {
+  deprecated class Environment extends StmtContainer {
     /**
      * Gets the fully qualified name aliased by the given unqualified name
      * within this container.
@@ -685,7 +677,7 @@ module JSDoc {
   }
 
   pragma[noinline]
-  private predicate isTypenamePrefix(string name) {
+  deprecated private predicate isTypenamePrefix(string name) {
     any(JSDocNamedTypeExpr expr).hasNameParts(name, _)
   }
 }

javascript/ql/lib/semmle/javascript/TypeAnnotations.qll

@@ -4,6 +4,8 @@
 
 import javascript
 private import internal.StmtContainers
+private import internal.NameResolution
+private import internal.UnderlyingTypes
 
 /**
  * A type annotation, either in the form of a TypeScript type or a JSDoc comment.
@@ -75,14 +77,38 @@ class TypeAnnotation extends @type_annotation, NodeInStmtContainer {
   TypeAnnotation getAnUnderlyingType() { result = this }
 
   /**
+   * DEPRECATED. Use `hasUnderlyingType` instead.
+   *
    * Holds if this is a reference to the type with qualified name `globalName` relative to the global scope.
    */
-  predicate hasQualifiedName(string globalName) { none() }
+  deprecated predicate hasQualifiedName(string globalName) {
+    UnderlyingTypes::nodeHasUnderlyingType(this, globalName)
+  }
 
   /**
+   * DEPRECATED. Use `hasUnderlyingType` instead.
+   *
    * Holds if this is a reference to the type exported from `moduleName` under the name `exportedName`.
    */
-  predicate hasQualifiedName(string moduleName, string exportedName) { none() }
+  deprecated predicate hasQualifiedName(string moduleName, string exportedName) {
+    UnderlyingTypes::nodeHasUnderlyingType(this, moduleName, exportedName)
+  }
+
+  /**
+   * Holds if this is a reference to the type with qualified name `globalName` relative to the global scope,
+   * or is declared as a subtype thereof, or is a union or intersection containing such a type.
+   */
+  final predicate hasUnderlyingType(string globalName) {
+    UnderlyingTypes::nodeHasUnderlyingType(this, globalName)
+  }
+
+  /**
+   * Holds if this is a reference to the type exported from `moduleName` under the name `exportedName`,
+   * or is declared as a subtype thereof, or is a union or intersection containing such a type.
+   */
+  final predicate hasUnderlyingType(string moduleName, string exportedName) {
+    UnderlyingTypes::nodeHasUnderlyingType(this, moduleName, exportedName)
+  }
 
   /** Gets the statement in which this type appears. */
   Stmt getEnclosingStmt() { none() }
@@ -107,5 +133,5 @@ class TypeAnnotation extends @type_annotation, NodeInStmtContainer {
    *
    * This unfolds nullability modifiers and generic type applications.
    */
-  DataFlow::ClassNode getClass() { none() }
+  final DataFlow::ClassNode getClass() { UnderlyingTypes::nodeHasUnderlyingClassType(this, result) }
 }

javascript/ql/lib/semmle/javascript/TypeScript.qll

@@ -1,4 +1,5 @@
 import javascript
+private import semmle.javascript.internal.UnderlyingTypes
 
 /**
  * A statement that defines a namespace, that is, a namespace declaration or enum declaration.
@@ -575,10 +576,6 @@ class TypeExpr extends ExprOrType, @typeexpr, TypeAnnotation {
   override Function getEnclosingFunction() { result = ExprOrType.super.getEnclosingFunction() }
 
   override TopLevel getTopLevel() { result = ExprOrType.super.getTopLevel() }
-
-  override DataFlow::ClassNode getClass() {
-    result.getAstNode() = this.getType().(ClassType).getClass()
-  }
 }
 
 /**
@@ -698,58 +695,9 @@ class TypeAccess extends @typeaccess, TypeExpr, TypeRef {
    */
   TypeName getTypeName() { ast_node_symbol(this, result) }
 
-  override predicate hasQualifiedName(string globalName) {
-    this.getTypeName().hasQualifiedName(globalName)
-    or
-    exists(LocalTypeAccess local | local = this |
-      not exists(local.getLocalTypeName()) and // Without a local type name, the type is looked up in the global scope.
-      globalName = local.getName()
-    )
-  }
-
-  override predicate hasQualifiedName(string moduleName, string exportedName) {
-    this.getTypeName().hasQualifiedName(moduleName, exportedName)
-    or
-    exists(ImportDeclaration imprt, ImportSpecifier spec |
-      moduleName = getImportName(imprt) and
-      spec = imprt.getASpecifier()
-    |
-      spec.getImportedName() = exportedName and
-      this = spec.getLocal().(TypeDecl).getLocalTypeName().getAnAccess()
-      or
-      (spec instanceof ImportNamespaceSpecifier or spec instanceof ImportDefaultSpecifier) and
-      this =
-        spec.getLocal().(LocalNamespaceDecl).getLocalNamespaceName().getAMemberAccess(exportedName)
-    )
-    or
-    exists(ImportEqualsDeclaration imprt |
-      moduleName = getImportName(imprt.getImportedEntity()) and
-      this =
-        imprt
-            .getIdentifier()
-            .(LocalNamespaceDecl)
-            .getLocalNamespaceName()
-            .getAMemberAccess(exportedName)
-    )
-  }
-
   override string getAPrimaryQlClass() { result = "TypeAccess" }
 }
 
-/**
- * Gets a suitable name for the library imported by `imprt`.
- *
- * For relative imports, this is the snapshot-relative path to the imported module.
- * For non-relative imports, it is the import path itself.
- */
-private string getImportName(Import imprt) {
-  exists(string path | path = imprt.getImportedPathString() |
-    if path.regexpMatch("[./].*")
-    then result = imprt.getImportedModule().getFile().getRelativePath()
-    else result = path
-  )
-}
-
 /** An identifier that is used as part of a type, such as `Date`. */
 class LocalTypeAccess extends @local_type_access, TypeAccess, Identifier, LexicalAccess {
   override predicate isStringy() { this.getName() = "String" }
@@ -822,14 +770,6 @@ class GenericTypeExpr extends @generic_typeexpr, TypeExpr {
   /** Gets the number of type arguments. This is always at least one. */
   int getNumTypeArgument() { result = count(this.getATypeArgument()) }
 
-  override predicate hasQualifiedName(string globalName) {
-    this.getTypeAccess().hasQualifiedName(globalName)
-  }
-
-  override predicate hasQualifiedName(string moduleName, string exportedName) {
-    this.getTypeAccess().hasQualifiedName(moduleName, exportedName)
-  }
-
   override string getAPrimaryQlClass() { result = "GenericTypeExpr" }
 }
 

javascript/ql/lib/semmle/javascript/Variables.qll

@@ -27,6 +27,12 @@ class Scope extends @scope {
     result = this.getAVariable() and
     result.getName() = name
   }
+
+  /** Gets the local type name with the given name declared in this scope. */
+  LocalTypeName getLocalTypeName(string name) {
+    result.getScope() = this and
+    result.getName() = name
+  }
 }
 
 /**
@@ -128,8 +134,26 @@ class Variable extends @variable, LexicalName {
   /** Gets the scope this variable is declared in. */
   override Scope getScope() { variables(this, _, result) }
 
+  /**
+   * Holds if this variable is declared in the top-level of a module using a `declare` statement.
+   *
+   * For example:
+   * ```js
+   * declare var $: any;
+   * ```
+   *
+   * Such variables are generally treated as a global variables, except for type-checking related purposes.
+   */
+  pragma[nomagic]
+  predicate isTopLevelWithAmbientDeclaration() {
+    this.getScope() instanceof ModuleScope and
+    forex(VarDecl decl | decl = this.getADeclaration() | decl.isAmbient())
+  }
+
   /** Holds if this is a global variable. */
-  predicate isGlobal() { this.getScope() instanceof GlobalScope }
+  predicate isGlobal() {
+    this.getScope() instanceof GlobalScope or this.isTopLevelWithAmbientDeclaration()
+  }
 
   /**
    * Holds if this is a variable exported from a TypeScript namespace.

javascript/ql/lib/semmle/javascript/ViewComponentInput.qll

@@ -3,6 +3,7 @@
  */
 
 private import javascript
+private import semmle.javascript.internal.TypeResolution
 
 /**
  * An input to a view component, such as React props.
@@ -14,34 +15,11 @@ abstract class ViewComponentInput extends DataFlow::Node {
 
 private class ViewComponentInputAsThreatModelSource extends ThreatModelSource::Range instanceof ViewComponentInput
 {
-  ViewComponentInputAsThreatModelSource() { not isSafeType(this.asExpr().getType()) }
+  ViewComponentInputAsThreatModelSource() {
+    not TypeResolution::valueHasSanitizingPrimitiveType(this.asExpr())
+  }
 
   final override string getThreatModel() { result = "view-component-input" }
 
   final override string getSourceType() { result = ViewComponentInput.super.getSourceType() }
 }
-
-private predicate isSafeType(Type t) {
-  t instanceof NumberLikeType
-  or
-  t instanceof BooleanLikeType
-  or
-  t instanceof UndefinedType
-  or
-  t instanceof NullType
-  or
-  t instanceof VoidType
-  or
-  hasSafeTypes(t, t.(UnionType).getNumElementType())
-  or
-  isSafeType(t.(IntersectionType).getAnElementType())
-}
-
-/** Hold if the first `n` components of `t` are safe types. */
-private predicate hasSafeTypes(UnionType t, int n) {
-  isSafeType(t.getElementType(0)) and
-  n = 1
-  or
-  isSafeType(t.getElementType(n - 1)) and
-  hasSafeTypes(t, n - 1)
-}

javascript/ql/lib/semmle/javascript/dataflow/DataFlow.qll

@@ -27,6 +27,9 @@ private import internal.PreCallGraphStep
 private import semmle.javascript.internal.CachedStages
 private import semmle.javascript.dataflow.internal.DataFlowPrivate as Private
 private import semmle.javascript.dataflow.internal.VariableOrThis
+private import semmle.javascript.internal.NameResolution
+private import semmle.javascript.internal.UnderlyingTypes
+private import semmle.javascript.internal.TypeResolution
 
 module DataFlow {
   /**
@@ -189,26 +192,6 @@ module DataFlow {
       FlowSteps::identityFunctionStep(result, this)
     }
 
-    /**
-     * Gets the static type of this node as determined by the TypeScript type system.
-     */
-    private Type getType() {
-      exists(AST::ValueNode node |
-        this = TValueNode(node) and
-        ast_node_type(node, result)
-      )
-      or
-      exists(BindingPattern pattern |
-        this = lvalueNode(pattern) and
-        ast_node_type(pattern, result)
-      )
-      or
-      exists(MethodDefinition def |
-        this = TThisNode(def.getInit()) and
-        ast_node_type(def.getDeclaringClass(), result)
-      )
-    }
-
     /**
      * Gets the type annotation describing the type of this node,
      * provided that a static type could not be found.
@@ -229,6 +212,15 @@ module DataFlow {
       )
     }
 
+    private NameResolution::Node getNameResolutionNode() {
+      this = valueNode(result)
+      or
+      exists(PropertyPattern pattern |
+        result = pattern.getValuePattern() and
+        this = TPropNode(pattern)
+      )
+    }
+
     /**
      * Holds if this node is annotated with the given named type,
      * or is declared as a subtype thereof, or is a union or intersection containing such a type.
@@ -236,9 +228,10 @@ module DataFlow {
     cached
     predicate hasUnderlyingType(string globalName) {
       Stages::TypeTracking::ref() and
-      this.getType().hasUnderlyingType(globalName)
+      exists(NameResolution::Node type |
-      or
+        TypeResolution::valueHasType(this.getNameResolutionNode(), type) and
-      this.getFallbackTypeAnnotation().getAnUnderlyingType().hasQualifiedName(globalName)
+        UnderlyingTypes::nodeHasUnderlyingType(type, globalName)
+      )
     }
 
     /**
@@ -248,9 +241,11 @@ module DataFlow {
     cached
     predicate hasUnderlyingType(string moduleName, string typeName) {
       Stages::TypeTracking::ref() and
-      this.getType().hasUnderlyingType(moduleName, typeName)
+      moduleName != "global" and
-      or
+      exists(NameResolution::Node type |
-      this.getFallbackTypeAnnotation().getAnUnderlyingType().hasQualifiedName(moduleName, typeName)
+        TypeResolution::valueHasType(this.getNameResolutionNode(), type) and
+        UnderlyingTypes::nodeHasUnderlyingType(type, moduleName, typeName)
+      )
     }
 
     /**

javascript/ql/lib/semmle/javascript/dataflow/Sources.qll

@@ -333,7 +333,14 @@ module SourceNode {
         astNode instanceof TaggedTemplateExpr or
         astNode instanceof Templating::PipeRefExpr or
         astNode instanceof Templating::TemplateVarRefExpr or
-        astNode instanceof StringLiteral
+        astNode instanceof StringLiteral or
+        astNode instanceof TypeAssertion or
+        astNode instanceof SatisfiesExpr
+      )
+      or
+      exists(VariableDeclarator decl |
+        exists(decl.getTypeAnnotation()) and
+        this = DataFlow::valueNode(decl.getBindingPattern())
       )
       or
       DataFlow::parameterNode(this, _)

javascript/ql/lib/semmle/javascript/dataflow/internal/Contents.qll

@@ -179,6 +179,9 @@ module Public {
     /** Holds if this represents values stored at an unknown array index. */
     predicate isUnknownArrayElement() { this = MkArrayElementUnknown() }
 
+    /** Holds if this represents the value of a resolved promise. */
+    predicate isPromiseValue() { this = MkPromiseValue() }
+
     /** Holds if this represents values stored in a `Map` at an unknown key. */
     predicate isMapValueWithUnknownKey() { this = MkMapValueWithUnknownKey() }
 
@@ -266,6 +269,11 @@ module Public {
       or
       this = ContentSet::anyCapturedContent() and
       result instanceof Private::MkCapturedContent
+      or
+      // Although data flow will never use the special `Awaited` ContentSet in a read or store step,
+      // it may appear in type-tracking and type resolution, and here it helps to treat is as `Awaited[value]`.
+      this = MkAwaited() and
+      result = MkPromiseValue()
     }
 
     /** Gets the singleton content to be accessed. */

javascript/ql/lib/semmle/javascript/frameworks/Nest.qll

@@ -5,6 +5,8 @@
 import javascript
 private import semmle.javascript.security.dataflow.ServerSideUrlRedirectCustomizations
 private import semmle.javascript.dataflow.internal.PreCallGraphStep
+private import semmle.javascript.internal.NameResolution
+private import semmle.javascript.internal.TypeResolution
 
 /**
  * Provides classes and predicates for reasoning about [Nest](https://nestjs.com/).
@@ -133,7 +135,9 @@ module NestJS {
       hasSanitizingPipe(this, false)
       or
       hasSanitizingPipe(this, true) and
-      isSanitizingType(this.getParameter().getType().unfold())
+      // Note: we could consider types with class-validator decorators to be sanitized here, but instead we consider the root
+      // object to be tainted, but omit taint steps for the individual properties names that have sanitizing decorators. See ClassValidator.qll.
+      TypeResolution::isSanitizingPrimitiveType(this.getParameter().getTypeAnnotation())
     }
   }
 
@@ -209,19 +213,6 @@ module NestJS {
     dependsOnType = true
   }
 
-  /**
-   * Holds if a parameter of type `t` is considered sanitized, provided it has been checked by `ValidationPipe`
-   * (which relies on metadata emitted by the TypeScript compiler).
-   */
-  private predicate isSanitizingType(Type t) {
-    t instanceof NumberType
-    or
-    t instanceof BooleanType
-    //
-    // Note: we could consider types with class-validator decorators to be sanitized here, but instead we consider the root
-    // object to be tainted, but omit taint steps for the individual properties names that have sanitizing decorators. See ClassValidator.qll.
-  }
-
   /**
    * A user-defined pipe class, for example:
    * ```js
@@ -237,7 +228,7 @@ module NestJS {
     CustomPipeClass() {
       exists(ClassDefinition cls |
         this = cls.flow() and
-        cls.getASuperInterface().hasQualifiedName("@nestjs/common", "PipeTransform")
+        cls.getASuperInterface().hasUnderlyingType("@nestjs/common", "PipeTransform")
       )
     }
 
@@ -327,14 +318,6 @@ module NestJS {
     }
   }
 
-  private predicate isStringType(Type type) {
-    type instanceof StringType
-    or
-    type instanceof AnyType
-    or
-    isStringType(type.(PromiseType).getElementType().unfold())
-  }
-
   /**
    * A return value from a route handler, seen as an argument to `res.send()`.
    *
@@ -353,10 +336,10 @@ module NestJS {
     ReturnValueAsResponseSend() {
       handler.isReturnValueReflected() and
       this = handler.getAReturn() and
-      // Only returned strings are sinks
+      // Only returned strings are sinks. If we can find a type for the return value, it must be string-like.
-      not exists(Type type |
+      not exists(NameResolution::Node type |
-        type = this.asExpr().getType() and
+        TypeResolution::valueHasType(this.asExpr(), type) and
-        not isStringType(type.unfold())
+        not TypeResolution::hasUnderlyingStringOrAnyType(type)
       )
     }