Fix integration test expectations for new Maven message

.bazelversion

@@ -1 +1 @@
-6.1.2
+5.0.0

.github/workflows/atm-check-query-suite.yml

@@ -0,0 +1,102 @@
+name: "ATM - Check query suite"
+
+env:
+  QUERY_PACK: javascript/ql/experimental/adaptivethreatmodeling/src
+  QUERY_SUITE: codeql-suites/javascript-atm-code-scanning.qls
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/atm-check-query-suite.yml"
+      - "javascript/ql/experimental/adaptivethreatmodeling/**"
+  workflow_dispatch:
+
+jobs:
+  atm-check-query-suite:
+    runs-on: ubuntu-latest-xl
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Setup CodeQL
+        uses: ./.github/actions/fetch-codeql
+        with:
+          channel: release
+
+      - name: Cache compilation cache
+        id: query-cache
+        uses: ./.github/actions/cache-query-compilation
+        with: 
+          key: atm-suite
+
+      - name: Install ATM model
+        run: |
+          set -exu
+
+          # Install dependencies of ATM query pack, i.e. the ATM model
+          codeql pack install "${QUERY_PACK}"
+
+          # Retrieve model checksum
+          model_checksum=$(codeql resolve extensions "${QUERY_PACK}/${QUERY_SUITE}" | jq -r '.models[0].checksum')
+
+          # Trust the model so that we can use it in the ATM boosted queries
+          mkdir -p "$HOME/.config/codeql"
+          echo "--insecurely-execute-ml-model-checksums ${model_checksum}" >> "$HOME/.config/codeql/config"
+
+      - name: Create test DB
+        run: |
+          DB_PATH="${RUNNER_TEMP}/db"
+          echo "DB_PATH=${DB_PATH}" >> "${GITHUB_ENV}"
+
+          codeql database create "${DB_PATH}" --source-root config/atm --language javascript 
+
+      - name: Run ATM query suite
+        run: |
+          SARIF_PATH="${RUNNER_TEMP}/sarif.json"
+          echo "SARIF_PATH=${SARIF_PATH}" >> "${GITHUB_ENV}"
+
+          codeql database analyze \
+            --threads=0 \
+            --ram 50000 \
+            --format sarif-latest \
+            --output "${SARIF_PATH}" \
+            --sarif-group-rules-by-pack \
+            -vv \
+            --compilation-cache "${{ steps.query-cache.outputs.cache-dir }}" \
+            -- \
+            "${DB_PATH}" \
+            "${QUERY_PACK}/${QUERY_SUITE}"
+
+      - name: Upload SARIF
+        uses: actions/upload-artifact@v3
+        with:
+          name: javascript-ml-powered-queries.sarif
+          path: "${{ env.SARIF_PATH }}"
+          retention-days: 5
+
+      - name: Check results
+        run: |
+          # We should run at least the ML-powered queries in `expected_rules`.
+          expected_rules="js/ml-powered/nosql-injection js/ml-powered/path-injection js/ml-powered/sql-injection js/ml-powered/xss"
+
+          for rule in ${expected_rules}; do
+            found_rule=$(jq --arg rule "${rule}" '[.runs[0].tool.extensions[].rules | select(. != null) |
+              flatten | .[].id] | any(. == $rule)' "${SARIF_PATH}")
+            if [[ "${found_rule}" != "true" ]]; then
+              echo "Expected SARIF output to contain rule '${rule}', but found no such rule."
+              exit 1
+            else
+              echo "Found rule '${rule}'."
+            fi
+          done
+
+          # We should have at least one alert from an ML-powered query.
+          num_alerts=$(jq '[.runs[0].results[] |
+            select(.properties.score != null and (.rule.id | startswith("js/ml-powered/")))] | length' \
+            "${SARIF_PATH}")
+          if [[ "${num_alerts}" -eq 0 ]]; then
+            echo "Expected to find at least one alert from an ML-powered query but found ${num_alerts}."
+            exit 1
+          else
+            echo "Found ${num_alerts} alerts from ML-powered queries.";
+          fi

.github/workflows/atm-model-integration-tests.yml

@@ -0,0 +1,12 @@
+name: ATM Model Integration Tests
+
+on:
+  workflow_dispatch:
+
+jobs:
+  hello-world:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: foo
+        run: echo "Hello world"

.github/workflows/check-change-note.yml

@@ -8,7 +8,6 @@ on:
       - "*/ql/src/**/*.qll"
       - "*/ql/lib/**/*.ql"
       - "*/ql/lib/**/*.qll"
-      - "*/ql/lib/**/*.yml"
       - "!**/experimental/**"
       - "!ql/**"
       - "!swift/**"

.github/workflows/close-stale.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/stale@v8
+    - uses: actions/stale@v7
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
         stale-issue-message: 'This issue is stale because it has been open 14 days with no activity. Comment or remove the `Stale` label in order to avoid having this issue closed in 7 days.'

.github/workflows/fast-forward.yml

@@ -1,50 +0,0 @@
-# Fast-forwards the branch specified in BRANCH_NAME
-# to the github.ref/sha that this workflow is run on.
-# Used as part of the release process, to ensure
-# external query writers can always access a branch of github/codeql
-# that is compatible with the latest stable release.
-name: Fast-forward tracking branch for selected CodeQL version
-on:
-  workflow_dispatch:
-
-jobs:
-  fast-forward:
-    name: Fast-forward tracking branch for selected CodeQL version
-    runs-on: ubuntu-latest
-    if: github.repository == 'github/codeql'
-    permissions:
-      contents: write
-    env:
-      BRANCH_NAME: 'lgtm.com'
-    steps:
-      - name: Validate chosen branch
-        if: ${{ !startsWith(github.ref_name, 'codeql-cli-') }}
-        shell: bash
-        run: |
-          echo "::error ::The $BRANCH_NAME tracking branch should only be fast-forwarded to the tip of a codeql-cli-* branch, got $GITHUB_REF_NAME instead."
-          exit 1
-
-      - name: Checkout
-        uses: actions/checkout@v3
-
-      - name: Git config
-        shell: bash
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-
-      - name: Fetch
-        shell: bash
-        run: |
-          set -x
-          echo "Fetching $BRANCH_NAME"
-          # Explicitly unshallow and fetch to ensure the remote ref is available.
-          git fetch --unshallow origin "$BRANCH_NAME"
-          git checkout -b "$BRANCH_NAME" "origin/$BRANCH_NAME"
-
-      - name: Fast-forward
-        shell: bash
-        run: |
-          echo "Fast-forwarding $BRANCH_NAME to ${GITHUB_REF}@${GITHUB_SHA}"
-          git merge --ff-only "$GITHUB_SHA"
-          git push origin "$BRANCH_NAME"

.github/workflows/go-tests-other-os.yml

@@ -15,7 +15,7 @@ jobs:
       - name: Set up Go 1.20
         uses: actions/setup-go@v4
         with:
-          go-version: '1.20'
+          go-version: 1.20.0
         id: go
 
       - name: Check out code
@@ -50,7 +50,7 @@ jobs:
       - name: Set up Go 1.20
         uses: actions/setup-go@v4
         with:
-          go-version: '1.20'
+          go-version: 1.20.0
         id: go
 
       - name: Check out code

.github/workflows/go-tests.yml

@@ -23,7 +23,7 @@ jobs:
       - name: Set up Go 1.20
         uses: actions/setup-go@v4
         with:
-          go-version: '1.20'
+          go-version: 1.20.0
         id: go
 
       - name: Check out code

.github/workflows/ruby-build.yml

@@ -48,9 +48,6 @@ jobs:
         run: |
           brew install gnu-tar
           echo "/usr/local/opt/gnu-tar/libexec/gnubin" >> $GITHUB_PATH
-      - name: Install cargo-cross
-        if: runner.os == 'Linux'
-        run: cargo install cross --version 0.2.5
       - uses: ./.github/actions/os-version
         id: os_version
       - name: Cache entire extractor
@@ -58,8 +55,10 @@ jobs:
         id: cache-extractor
         with:
           path: |
-            ruby/extractor/target/release/codeql-extractor-ruby
-            ruby/extractor/target/release/codeql-extractor-ruby.exe
+            ruby/extractor/target/release/autobuilder
+            ruby/extractor/target/release/autobuilder.exe
+            ruby/extractor/target/release/extractor
+            ruby/extractor/target/release/extractor.exe
             ruby/extractor/ql/lib/codeql/ruby/ast/internal/TreeSitter.qll
           key: ${{ runner.os }}-${{ steps.os_version.outputs.version }}-ruby-extractor-${{ hashFiles('ruby/extractor/rust-toolchain.toml', 'ruby/extractor/Cargo.lock') }}--${{ hashFiles('ruby/extractor/**/*.rs') }}
       - uses: actions/cache@v3
@@ -79,20 +78,12 @@ jobs:
       - name: Run tests
         if: steps.cache-extractor.outputs.cache-hit != 'true'
         run: cd extractor && cargo test --verbose
-      # On linux, build the extractor via cross in a centos7 container.
-      # This ensures we don't depend on glibc > 2.17.
-      - name: Release build (linux)
-        if: steps.cache-extractor.outputs.cache-hit != 'true' && runner.os == 'Linux'
-        run: |
-          cd extractor
-          cross build --release
-          mv target/x86_64-unknown-linux-gnu/release/codeql-extractor-ruby target/release/
-      - name: Release build (windows and macos)
-        if: steps.cache-extractor.outputs.cache-hit != 'true' && runner.os != 'Linux'
+      - name: Release build
+        if: steps.cache-extractor.outputs.cache-hit != 'true'
         run: cd extractor && cargo build --release
       - name: Generate dbscheme
         if: ${{ matrix.os == 'ubuntu-latest' && steps.cache-extractor.outputs.cache-hit != 'true'}}
-        run: extractor/target/release/codeql-extractor-ruby generate --dbscheme ql/lib/ruby.dbscheme --library ql/lib/codeql/ruby/ast/internal/TreeSitter.qll
+        run: extractor/target/release/generator --dbscheme ql/lib/ruby.dbscheme --library ql/lib/codeql/ruby/ast/internal/TreeSitter.qll
       - uses: actions/upload-artifact@v3
         if: ${{ matrix.os == 'ubuntu-latest' }}
         with:
@@ -107,8 +98,10 @@ jobs:
         with:
           name: extractor-${{ matrix.os }}
           path: |
-            ruby/extractor/target/release/codeql-extractor-ruby
-            ruby/extractor/target/release/codeql-extractor-ruby.exe
+            ruby/extractor/target/release/autobuilder
+            ruby/extractor/target/release/autobuilder.exe
+            ruby/extractor/target/release/extractor
+            ruby/extractor/target/release/extractor.exe
           retention-days: 1
   compile-queries:
     runs-on: ubuntu-latest-xl
@@ -166,10 +159,13 @@ jobs:
           mkdir -p ruby
           cp -r codeql-extractor.yml tools ql/lib/ruby.dbscheme.stats ruby/
           mkdir -p ruby/tools/{linux64,osx64,win64}
-          cp linux64/codeql-extractor-ruby ruby/tools/linux64/extractor
-          cp osx64/codeql-extractor-ruby ruby/tools/osx64/extractor
-          cp win64/codeql-extractor-ruby.exe ruby/tools/win64/extractor.exe
-          chmod +x ruby/tools/{linux64,osx64}/extractor
+          cp linux64/autobuilder ruby/tools/linux64/autobuilder
+          cp osx64/autobuilder ruby/tools/osx64/autobuilder
+          cp win64/autobuilder.exe ruby/tools/win64/autobuilder.exe
+          cp linux64/extractor ruby/tools/linux64/extractor
+          cp osx64/extractor ruby/tools/osx64/extractor
+          cp win64/extractor.exe ruby/tools/win64/extractor.exe
+          chmod +x ruby/tools/{linux64,osx64}/{autobuilder,extractor}
           zip -rq codeql-ruby.zip ruby
       - uses: actions/upload-artifact@v3
         with:
@@ -231,54 +227,3 @@ jobs:
         shell: bash
         run: |
           codeql database analyze --search-path "${{ runner.temp }}/ruby-bundle" --format=sarifv2.1.0 --output=out.sarif ../database ruby-code-scanning.qls
-
-  # This is a copy of the 'test' job that runs in a centos7 container.
-  # This tests that the extractor works correctly on systems with an old glibc.
-  test-centos7:
-    defaults:
-      run:
-        working-directory: ${{ github.workspace }}
-    strategy:
-      fail-fast: false
-    runs-on: ubuntu-latest
-    container:
-      image: centos:centos7
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    needs: [package]
-    steps:
-      - name: Install gh cli
-        run: |
-          yum-config-manager --add-repo https://cli.github.com/packages/rpm/gh-cli.repo
-          # fetch-codeql requires unzip and jq
-          # jq is available in epel-release (https://docs.fedoraproject.org/en-US/epel/)
-          yum install -y gh unzip epel-release
-          yum install -y jq
-      - uses: actions/checkout@v3
-      - name: Fetch CodeQL
-        uses: ./.github/actions/fetch-codeql
-
-      # Due to a bug in Actions, we can't use runner.temp in the run blocks here.
-      # https://github.com/actions/runner/issues/2185
-
-      - name: Download Ruby bundle
-        uses: actions/download-artifact@v3
-        with:
-          name: codeql-ruby-bundle
-          path: ${{ runner.temp }}
-      - name: Unzip Ruby bundle
-        shell: bash
-        run: unzip -q -d "$RUNNER_TEMP"/ruby-bundle "$RUNNER_TEMP"/codeql-ruby-bundle.zip
-
-      - name: Run QL test
-        shell: bash
-        run: |
-          codeql test run --search-path "$RUNNER_TEMP"/ruby-bundle --additional-packs "$RUNNER_TEMP"/ruby-bundle ruby/ql/test/library-tests/ast/constants/
-      - name: Create database
-        shell: bash
-        run: |
-          codeql database create --search-path "$RUNNER_TEMP"/ruby-bundle --language ruby --source-root ruby/ql/test/library-tests/ast/constants/ ../database
-      - name: Analyze database
-        shell: bash
-        run: |
-          codeql database analyze --search-path "$RUNNER_TEMP"/ruby-bundle --format=sarifv2.1.0 --output=out.sarif ../database ruby-code-scanning.qls

.github/workflows/ruby-qltest.yml

@@ -4,7 +4,6 @@ on:
   push:
     paths:
       - "ruby/**"
-      - "shared/**"
       - .github/workflows/ruby-build.yml
       - .github/actions/fetch-codeql/action.yml
       - codeql-workspace.yml

.pre-commit-config.yaml

@@ -19,7 +19,7 @@ repos:
     rev: v1.6.0
     hooks:
       - id: autopep8
-        files: ^misc/codegen/.*\.py
+        files: ^swift/.*\.py
 
   - repo: local
     hooks:

README.md

@@ -1,5 +1,3 @@
-# Do not integrate this change
-
 # CodeQL
 
 This open source repository contains the standard CodeQL libraries and queries that power [GitHub Advanced Security](https://github.com/features/security/code) and the other application security products that [GitHub](https://github.com/features/security/) makes available to its customers worldwide.

config/identical-files.json

@@ -40,6 +40,7 @@
     "csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl3.qll",
     "csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl4.qll",
     "csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl5.qll",
+    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImplForContentDataFlow.qll",
     "go/ql/lib/semmle/go/dataflow/internal/DataFlowImpl1.qll",
     "go/ql/lib/semmle/go/dataflow/internal/DataFlowImpl2.qll",
     "go/ql/lib/semmle/go/dataflow/internal/DataFlowImplForStringsNewReplacer.qll",
@@ -122,10 +123,6 @@
     "java/ql/src/utils/modelgenerator/internal/CaptureModels.qll",
     "csharp/ql/src/utils/modelgenerator/internal/CaptureModels.qll"
   ],
-  "Model as Data Generation Java/C# - CaptureModelsPrinting": [
-    "java/ql/src/utils/modelgenerator/internal/CaptureModelsPrinting.qll",
-    "csharp/ql/src/utils/modelgenerator/internal/CaptureModelsPrinting.qll"
-  ],
   "Sign Java/C#": [
     "java/ql/lib/semmle/code/java/dataflow/internal/rangeanalysis/Sign.qll",
     "csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/Sign.qll"
@@ -282,11 +279,6 @@
     "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRBlockImports.qll",
     "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/IRBlockImports.qll"
   ],
-  "C++ IR IRConsistencyImports": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/IRConsistencyImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRConsistencyImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/IRConsistencyImports.qll"
-  ],
   "C++ IR IRFunctionImports": [
     "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/IRFunctionImports.qll",
     "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRFunctionImports.qll",
@@ -599,4 +591,4 @@
     "python/ql/lib/semmle/python/security/internal/EncryptionKeySizes.qll",
     "java/ql/lib/semmle/code/java/security/internal/EncryptionKeySizes.qll"
   ]
-}
+}

cpp/downgrades/19887dbd33327fb07d54251786e0cb2578539775/upgrade.properties

@@ -1,4 +0,0 @@
-description: Revert support for repeated initializers, which are allowed in C with designated initializers.
-compatibility: full
-aggregate_field_init.rel: reorder aggregate_field_init.rel (int aggregate, int initializer, int field, int position) aggregate initializer field
-aggregate_array_init.rel: reorder aggregate_array_init.rel (int aggregate, int initializer, int element_index, int position) aggregate initializer element_index

cpp/ql/examples/queries.xml

@@ -0,0 +1 @@
+<queries language="cpp"/>

cpp/ql/lib/CHANGELOG.md

@@ -1,80 +1,3 @@
-## 0.7.1
-
-No user-facing changes.
-
-## 0.7.0
-
-### Breaking Changes
-
-* The internal `SsaConsistency` module has been moved from `SSAConstruction` to `SSAConsitency`, and the deprecated `SSAConsistency` module has been removed.
-
-### Deprecated APIs
-
-* The single-parameter predicates `ArrayOrVectorAggregateLiteral.getElementExpr` and `ClassAggregateLiteral.getFieldExpr` have been deprecated in favor of `ArrayOrVectorAggregateLiteral.getAnElementExpr` and `ClassAggregateLiteral.getAFieldExpr`.
-* The recently introduced new data flow and taint tracking APIs have had a
-  number of module and predicate renamings. The old APIs remain in place for
-  now.
-* The `SslContextCallAbstractConfig`, `SslContextCallConfig`, `SslContextCallBannedProtocolConfig`, `SslContextCallTls12ProtocolConfig`, `SslContextCallTls13ProtocolConfig`, `SslContextCallTlsProtocolConfig`, `SslContextFlowsToSetOptionConfig`, `SslOptionConfig` dataflow configurations from `BoostorgAsio` have been deprecated. Please use `SslContextCallConfigSig`, `SslContextCallGlobal`, `SslContextCallFlow`, `SslContextCallBannedProtocolFlow`, `SslContextCallTls12ProtocolFlow`, `SslContextCallTls13ProtocolFlow`, `SslContextCallTlsProtocolFlow`, `SslContextFlowsToSetOptionFlow`.
-
-### New Features
-
-* Added overridable predicates `getSizeExpr` and `getSizeMult` to the `BufferAccess` class (`semmle.code.cpp.security.BufferAccess.qll`). This makes it possible to model a larger class of buffer reads and writes using the library.
-
-### Minor Analysis Improvements
-
-* The `BufferAccess` library (`semmle.code.cpp.security.BufferAccess`) no longer matches buffer accesses inside unevaluated contexts (such as inside `sizeof` or `decltype` expressions). As a result, queries using this library may see fewer false positives.
-
-### Bug Fixes
-
-* Fixed some accidental predicate visibility in the backwards-compatible wrapper for data flow configurations. In particular `DataFlow::hasFlowPath`, `DataFlow::hasFlow`, `DataFlow::hasFlowTo`, and `DataFlow::hasFlowToExpr` were accidentally exposed in a single version.
-
-## 0.6.1
-
-No user-facing changes.
-
-## 0.6.0
-
-### Breaking Changes
-
-* The `semmle.code.cpp.commons.Buffer` and `semmle.code.cpp.commons.NullTermination` libraries no longer expose `semmle.code.cpp.dataflow.DataFlow`. Please import `semmle.code.cpp.dataflow.DataFlow` directly.
-
-### Deprecated APIs
-
-* The `WriteConfig` taint tracking configuration has been deprecated. Please use `WriteFlow`.
-
-### New Features
-
-* Added support for merging two `PathGraph`s via disjoint union to allow results from multiple data flow computations in a single `path-problem` query.
-
-### Major Analysis Improvements
-
-* A new C/C++ dataflow library (`semmle.code.cpp.dataflow.new.DataFlow`) has been added.
-  The new library behaves much more like the dataflow library of other CodeQL supported
-  languages by following use-use dataflow paths instead of def-use dataflow paths.
-  The new library also better supports dataflow through indirections, and new predicates
-  such as `Node::asIndirectExpr` have been added to facilitate working with indirections.
-
-  The `semmle.code.cpp.ir.dataflow.DataFlow` library is now identical to the new
-  `semmle.code.cpp.dataflow.new.DataFlow` library.
-* The main data flow and taint tracking APIs have been changed. The old APIs
-  remain in place for now and translate to the new through a
-  backwards-compatible wrapper. If multiple configurations are in scope
-  simultaneously, then this may affect results slightly. The new API is quite
-  similar to the old, but makes use of a configuration module instead of a
-  configuration class.
-
-### Minor Analysis Improvements
-
-* Deleted the deprecated `hasGeneratedCopyConstructor` and `hasGeneratedCopyAssignmentOperator` predicates from the `Folder` class.
-* Deleted the deprecated `getPath` and `getFolder` predicates from the `XmlFile` class.
-* Deleted the deprecated `getMustlockFunction`, `getTrylockFunction`, `getLockFunction`, and `getUnlockFunction` predicates from the `MutexType` class.
-* Deleted the deprecated `getPosInBasicBlock` predicate from the `SubBasicBlock` class.
-* Deleted the deprecated `getExpr` predicate from the `PointerDereferenceExpr` class.
-* Deleted the deprecated `getUseInstruction` and `getDefinitionInstruction` predicates from the `Operand` class.
-* Deleted the deprecated `isInParameter`, `isInParameterPointer`, and `isInQualifier` predicates from the `FunctionInput` class.
-* Deleted the deprecated `isOutParameterPointer`, `isOutQualifier`, `isOutReturnValue`, and `isOutReturnPointer` predicate from the `FunctionOutput` class.
-* Deleted the deprecated 3-argument `isGuardPhi` predicate from the `RangeSsaDefinition` class.
-
 ## 0.5.4
 
 No user-facing changes.

cpp/ql/lib/change-notes/2023-02-10-buffer-and-nill-termination-dataflow.md

@@ -0,0 +1,4 @@
+---
+category: breaking
+---
+* The `semmle.code.cpp.commons.Buffer` and `semmle.code.cpp.commons.NullTermination` libraries no longer expose `semmle.code.cpp.dataflow.DataFlow`. Please import `semmle.code.cpp.dataflow.DataFlow` directly.

cpp/ql/lib/change-notes/2023-03-02-dataflow-conf-module.md

@@ -1,11 +1,6 @@
-## 0.4.5
-
-### New Features
-
-* Added support for merging two `PathGraph`s via disjoint union to allow results from multiple data flow computations in a single `path-problem` query.
-
-### Major Analysis Improvements
-
+---
+category: majorAnalysis
+---
 * The main data flow and taint tracking APIs have been changed. The old APIs
   remain in place for now and translate to the new through a
   backwards-compatible wrapper. If multiple configurations are in scope

cpp/ql/lib/change-notes/2023-03-03-delete-deps.md

@@ -0,0 +1,12 @@
+---
+category: minorAnalysis
+---
+* Deleted the deprecated `hasGeneratedCopyConstructor` and `hasGeneratedCopyAssignmentOperator` predicates from the `Folder` class.
+* Deleted the deprecated `getPath` and `getFolder` predicates from the `XmlFile` class.
+* Deleted the deprecated `getMustlockFunction`, `getTrylockFunction`, `getLockFunction`, and `getUnlockFunction` predicates from the `MutexType` class.
+* Deleted the deprecated `getPosInBasicBlock` predicate from the `SubBasicBlock` class.
+* Deleted the deprecated `getExpr` predicate from the `PointerDereferenceExpr` class.
+* Deleted the deprecated `getUseInstruction` and `getDefinitionInstruction` predicates from the `Operand` class.
+* Deleted the deprecated `isInParameter`, `isInParameterPointer`, and `isInQualifier` predicates from the `FunctionInput` class.
+* Deleted the deprecated `isOutParameterPointer`, `isOutQualifier`, `isOutReturnValue`, and `isOutReturnPointer` predicate from the `FunctionOutput` class.
+* Deleted the deprecated 3-argument `isGuardPhi` predicate from the `RangeSsaDefinition` class.

cpp/ql/lib/change-notes/2023-03-08-deprecated-dataflow-configurations.md

@@ -0,0 +1,4 @@
+---
+category: deprecated
+---
+* The `WriteConfig` taint tracking configuration has been deprecated. Please use `WriteFlow`.

cpp/ql/lib/change-notes/2023-03-13-mergepathgraph.md

@@ -0,0 +1,4 @@
+---
+category: feature
+---
+* Added support for merging two `PathGraph`s via disjoint union to allow results from multiple data flow computations in a single `path-problem` query.

cpp/ql/lib/change-notes/2023-03-16-use-use-flow.md

@@ -0,0 +1,11 @@
+---
+category: majorAnalysis
+---
+* A new C/C++ dataflow library (`semmle.code.cpp.dataflow.new.DataFlow`) has been added.
+  The new library behaves much more like the dataflow library of other CodeQL supported
+  languages by following use-use dataflow paths instead of def-use dataflow paths.
+  The new library also better supports dataflow through indirections, and new predicates
+  such as `Node::asIndirectExpr` have been added to facilitate working with indirections.
+
+  The `semmle.code.cpp.ir.dataflow.DataFlow` library is now identical to the new
+  `semmle.code.cpp.dataflow.new.DataFlow` library.

cpp/ql/lib/change-notes/2023-04-28-static-local-dataflow.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* The new dataflow (`semmle.code.cpp.dataflow.new.DataFlow`) and taint-tracking libraries (`semmle.code.cpp.dataflow.new.TaintTracking`) now support tracking flow through static local variables.

cpp/ql/lib/change-notes/released/0.6.0.md

@@ -1,42 +0,0 @@
-## 0.6.0
-
-### Breaking Changes
-
-* The `semmle.code.cpp.commons.Buffer` and `semmle.code.cpp.commons.NullTermination` libraries no longer expose `semmle.code.cpp.dataflow.DataFlow`. Please import `semmle.code.cpp.dataflow.DataFlow` directly.
-
-### Deprecated APIs
-
-* The `WriteConfig` taint tracking configuration has been deprecated. Please use `WriteFlow`.
-
-### New Features
-
-* Added support for merging two `PathGraph`s via disjoint union to allow results from multiple data flow computations in a single `path-problem` query.
-
-### Major Analysis Improvements
-
-* A new C/C++ dataflow library (`semmle.code.cpp.dataflow.new.DataFlow`) has been added.
-  The new library behaves much more like the dataflow library of other CodeQL supported
-  languages by following use-use dataflow paths instead of def-use dataflow paths.
-  The new library also better supports dataflow through indirections, and new predicates
-  such as `Node::asIndirectExpr` have been added to facilitate working with indirections.
-
-  The `semmle.code.cpp.ir.dataflow.DataFlow` library is now identical to the new
-  `semmle.code.cpp.dataflow.new.DataFlow` library.
-* The main data flow and taint tracking APIs have been changed. The old APIs
-  remain in place for now and translate to the new through a
-  backwards-compatible wrapper. If multiple configurations are in scope
-  simultaneously, then this may affect results slightly. The new API is quite
-  similar to the old, but makes use of a configuration module instead of a
-  configuration class.
-
-### Minor Analysis Improvements
-
-* Deleted the deprecated `hasGeneratedCopyConstructor` and `hasGeneratedCopyAssignmentOperator` predicates from the `Folder` class.
-* Deleted the deprecated `getPath` and `getFolder` predicates from the `XmlFile` class.
-* Deleted the deprecated `getMustlockFunction`, `getTrylockFunction`, `getLockFunction`, and `getUnlockFunction` predicates from the `MutexType` class.
-* Deleted the deprecated `getPosInBasicBlock` predicate from the `SubBasicBlock` class.
-* Deleted the deprecated `getExpr` predicate from the `PointerDereferenceExpr` class.
-* Deleted the deprecated `getUseInstruction` and `getDefinitionInstruction` predicates from the `Operand` class.
-* Deleted the deprecated `isInParameter`, `isInParameterPointer`, and `isInQualifier` predicates from the `FunctionInput` class.
-* Deleted the deprecated `isOutParameterPointer`, `isOutQualifier`, `isOutReturnValue`, and `isOutReturnPointer` predicate from the `FunctionOutput` class.
-* Deleted the deprecated 3-argument `isGuardPhi` predicate from the `RangeSsaDefinition` class.

cpp/ql/lib/change-notes/released/0.6.1.md

@@ -1,3 +0,0 @@
-## 0.6.1
-
-No user-facing changes.

cpp/ql/lib/change-notes/released/0.7.0.md

@@ -1,25 +0,0 @@
-## 0.7.0
-
-### Breaking Changes
-
-* The internal `SsaConsistency` module has been moved from `SSAConstruction` to `SSAConsitency`, and the deprecated `SSAConsistency` module has been removed.
-
-### Deprecated APIs
-
-* The single-parameter predicates `ArrayOrVectorAggregateLiteral.getElementExpr` and `ClassAggregateLiteral.getFieldExpr` have been deprecated in favor of `ArrayOrVectorAggregateLiteral.getAnElementExpr` and `ClassAggregateLiteral.getAFieldExpr`.
-* The recently introduced new data flow and taint tracking APIs have had a
-  number of module and predicate renamings. The old APIs remain in place for
-  now.
-* The `SslContextCallAbstractConfig`, `SslContextCallConfig`, `SslContextCallBannedProtocolConfig`, `SslContextCallTls12ProtocolConfig`, `SslContextCallTls13ProtocolConfig`, `SslContextCallTlsProtocolConfig`, `SslContextFlowsToSetOptionConfig`, `SslOptionConfig` dataflow configurations from `BoostorgAsio` have been deprecated. Please use `SslContextCallConfigSig`, `SslContextCallGlobal`, `SslContextCallFlow`, `SslContextCallBannedProtocolFlow`, `SslContextCallTls12ProtocolFlow`, `SslContextCallTls13ProtocolFlow`, `SslContextCallTlsProtocolFlow`, `SslContextFlowsToSetOptionFlow`.
-
-### New Features
-
-* Added overridable predicates `getSizeExpr` and `getSizeMult` to the `BufferAccess` class (`semmle.code.cpp.security.BufferAccess.qll`). This makes it possible to model a larger class of buffer reads and writes using the library.
-
-### Minor Analysis Improvements
-
-* The `BufferAccess` library (`semmle.code.cpp.security.BufferAccess`) no longer matches buffer accesses inside unevaluated contexts (such as inside `sizeof` or `decltype` expressions). As a result, queries using this library may see fewer false positives.
-
-### Bug Fixes
-
-* Fixed some accidental predicate visibility in the backwards-compatible wrapper for data flow configurations. In particular `DataFlow::hasFlowPath`, `DataFlow::hasFlow`, `DataFlow::hasFlowTo`, and `DataFlow::hasFlowToExpr` were accidentally exposed in a single version.

cpp/ql/lib/change-notes/released/0.7.1.md

@@ -1,3 +0,0 @@
-## 0.7.1
-
-No user-facing changes.

cpp/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.7.1
+lastReleaseVersion: 0.5.4

cpp/ql/lib/experimental/semmle/code/cpp/dataflow/ProductFlow.qll

@@ -1,146 +1,17 @@
 import semmle.code.cpp.ir.dataflow.DataFlow
-private import codeql.util.Unit
+import semmle.code.cpp.ir.dataflow.DataFlow2
 
 module ProductFlow {
-  signature module ConfigSig {
+  abstract class Configuration extends string {
+    bindingset[this]
+    Configuration() { any() }
+
     /**
      * Holds if `(source1, source2)` is a relevant data flow source.
      *
      * `source1` and `source2` must belong to the same callable.
      */
-    predicate isSourcePair(DataFlow::Node source1, DataFlow::Node source2);
-
-    /**
-     * Holds if `(sink1, sink2)` is a relevant data flow sink.
-     *
-     * `sink1` and `sink2` must belong to the same callable.
-     */
-    predicate isSinkPair(DataFlow::Node sink1, DataFlow::Node sink2);
-
-    /**
-     * Holds if data flow through `node` is prohibited through the first projection of the product
-     * dataflow graph.
-     */
-    default predicate isBarrier1(DataFlow::Node node) { none() }
-
-    /**
-     * Holds if data flow through `node` is prohibited through the second projection of the product
-     * dataflow graph.
-     */
-    default predicate isBarrier2(DataFlow::Node node) { none() }
-
-    /**
-     * Holds if data flow out of `node` is prohibited in the first projection of the product
-     * dataflow graph.
-     */
-    default predicate isBarrierOut1(DataFlow::Node node) { none() }
-
-    /**
-     * Holds if data flow out of `node` is prohibited in the second projection of the product
-     * dataflow graph.
-     */
-    default predicate isBarrierOut2(DataFlow::Node node) { none() }
-
-    /*
-     * Holds if data may flow from `node1` to `node2` in addition to the normal data-flow steps in
-     * the first projection of the product dataflow graph.
-     */
-
-    default predicate isAdditionalFlowStep1(DataFlow::Node node1, DataFlow::Node node2) { none() }
-
-    /**
-     * Holds if data may flow from `node1` to `node2` in addition to the normal data-flow steps in
-     * the second projection of the product dataflow graph.
-     */
-    default predicate isAdditionalFlowStep2(DataFlow::Node node1, DataFlow::Node node2) { none() }
-
-    /**
-     * Holds if data flow into `node` is prohibited in the first projection of the product
-     * dataflow graph.
-     */
-    default predicate isBarrierIn1(DataFlow::Node node) { none() }
-
-    /**
-     * Holds if data flow into `node` is prohibited in the second projection of the product
-     * dataflow graph.
-     */
-    default predicate isBarrierIn2(DataFlow::Node node) { none() }
-  }
-
-  module Global<ConfigSig Config> {
-    private module StateConfig implements StateConfigSig {
-      class FlowState1 = Unit;
-
-      class FlowState2 = Unit;
-
-      predicate isSourcePair(
-        DataFlow::Node source1, FlowState1 state1, DataFlow::Node source2, FlowState2 state2
-      ) {
-        exists(state1) and
-        exists(state2) and
-        Config::isSourcePair(source1, source2)
-      }
-
-      predicate isSinkPair(
-        DataFlow::Node sink1, FlowState1 state1, DataFlow::Node sink2, FlowState2 state2
-      ) {
-        exists(state1) and
-        exists(state2) and
-        Config::isSinkPair(sink1, sink2)
-      }
-
-      predicate isBarrier1(DataFlow::Node node, FlowState1 state) {
-        exists(state) and
-        Config::isBarrier1(node)
-      }
-
-      predicate isBarrier2(DataFlow::Node node, FlowState2 state) {
-        exists(state) and
-        Config::isBarrier2(node)
-      }
-
-      predicate isBarrier1 = Config::isBarrier1/1;
-
-      predicate isBarrier2 = Config::isBarrier2/1;
-
-      predicate isBarrierOut1 = Config::isBarrierOut1/1;
-
-      predicate isBarrierOut2 = Config::isBarrierOut2/1;
-
-      predicate isAdditionalFlowStep1 = Config::isAdditionalFlowStep1/2;
-
-      predicate isAdditionalFlowStep1(
-        DataFlow::Node node1, FlowState1 state1, DataFlow::Node node2, FlowState1 state2
-      ) {
-        exists(state1) and
-        exists(state2) and
-        Config::isAdditionalFlowStep1(node1, node2)
-      }
-
-      predicate isAdditionalFlowStep2 = Config::isAdditionalFlowStep2/2;
-
-      predicate isAdditionalFlowStep2(
-        DataFlow::Node node1, FlowState2 state1, DataFlow::Node node2, FlowState2 state2
-      ) {
-        exists(state1) and
-        exists(state2) and
-        Config::isAdditionalFlowStep2(node1, node2)
-      }
-
-      predicate isBarrierIn1 = Config::isBarrierIn1/1;
-
-      predicate isBarrierIn2 = Config::isBarrierIn2/1;
-    }
-
-    import GlobalWithState<StateConfig>
-  }
-
-  signature module StateConfigSig {
-    bindingset[this]
-    class FlowState1;
-
-    bindingset[this]
-    class FlowState2;
+    predicate isSourcePair(DataFlow::Node source1, DataFlow::Node source2) { none() }
 
     /**
      * Holds if `(source1, source2)` is a relevant data flow source with initial states `state1`
@@ -149,8 +20,20 @@ module ProductFlow {
      * `source1` and `source2` must belong to the same callable.
      */
     predicate isSourcePair(
-      DataFlow::Node source1, FlowState1 state1, DataFlow::Node source2, FlowState2 state2
-    );
+      DataFlow::Node source1, DataFlow::FlowState state1, DataFlow::Node source2,
+      DataFlow::FlowState state2
+    ) {
+      state1 = "" and
+      state2 = "" and
+      this.isSourcePair(source1, source2)
+    }
+
+    /**
+     * Holds if `(sink1, sink2)` is a relevant data flow sink.
+     *
+     * `sink1` and `sink2` must belong to the same callable.
+     */
+    predicate isSinkPair(DataFlow::Node sink1, DataFlow::Node sink2) { none() }
 
     /**
      * Holds if `(sink1, sink2)` is a relevant data flow sink with final states `state1`
@@ -159,51 +42,60 @@ module ProductFlow {
      * `sink1` and `sink2` must belong to the same callable.
      */
     predicate isSinkPair(
-      DataFlow::Node sink1, FlowState1 state1, DataFlow::Node sink2, FlowState2 state2
-    );
+      DataFlow::Node sink1, DataFlow::FlowState state1, DataFlow::Node sink2,
+      DataFlow::FlowState state2
+    ) {
+      state1 = "" and
+      state2 = "" and
+      this.isSinkPair(sink1, sink2)
+    }
 
     /**
      * Holds if data flow through `node` is prohibited through the first projection of the product
      * dataflow graph when the flow state is `state`.
      */
-    predicate isBarrier1(DataFlow::Node node, FlowState1 state);
+    predicate isBarrier1(DataFlow::Node node, DataFlow::FlowState state) {
+      this.isBarrier1(node) and state = ""
+    }
 
     /**
      * Holds if data flow through `node` is prohibited through the second projection of the product
      * dataflow graph when the flow state is `state`.
      */
-    predicate isBarrier2(DataFlow::Node node, FlowState2 state);
+    predicate isBarrier2(DataFlow::Node node, DataFlow::FlowState state) {
+      this.isBarrier2(node) and state = ""
+    }
 
     /**
      * Holds if data flow through `node` is prohibited through the first projection of the product
      * dataflow graph.
      */
-    default predicate isBarrier1(DataFlow::Node node) { none() }
+    predicate isBarrier1(DataFlow::Node node) { none() }
 
     /**
      * Holds if data flow through `node` is prohibited through the second projection of the product
      * dataflow graph.
      */
-    default predicate isBarrier2(DataFlow::Node node) { none() }
+    predicate isBarrier2(DataFlow::Node node) { none() }
 
     /**
      * Holds if data flow out of `node` is prohibited in the first projection of the product
      * dataflow graph.
      */
-    default predicate isBarrierOut1(DataFlow::Node node) { none() }
+    predicate isBarrierOut1(DataFlow::Node node) { none() }
 
     /**
      * Holds if data flow out of `node` is prohibited in the second projection of the product
      * dataflow graph.
      */
-    default predicate isBarrierOut2(DataFlow::Node node) { none() }
+    predicate isBarrierOut2(DataFlow::Node node) { none() }
 
     /*
      * Holds if data may flow from `node1` to `node2` in addition to the normal data-flow steps in
      * the first projection of the product dataflow graph.
      */
 
-    default predicate isAdditionalFlowStep1(DataFlow::Node node1, DataFlow::Node node2) { none() }
+    predicate isAdditionalFlowStep1(DataFlow::Node node1, DataFlow::Node node2) { none() }
 
     /**
      * Holds if data may flow from `node1` to `node2` in addition to the normal data-flow steps in
@@ -212,14 +104,19 @@ module ProductFlow {
      * This step is only applicable in `state1` and updates the flow state to `state2`.
      */
     predicate isAdditionalFlowStep1(
-      DataFlow::Node node1, FlowState1 state1, DataFlow::Node node2, FlowState1 state2
-    );
+      DataFlow::Node node1, DataFlow::FlowState state1, DataFlow::Node node2,
+      DataFlow::FlowState state2
+    ) {
+      state1 instanceof DataFlow::FlowStateEmpty and
+      state2 instanceof DataFlow::FlowStateEmpty and
+      this.isAdditionalFlowStep1(node1, node2)
+    }
 
     /**
      * Holds if data may flow from `node1` to `node2` in addition to the normal data-flow steps in
      * the second projection of the product dataflow graph.
      */
-    default predicate isAdditionalFlowStep2(DataFlow::Node node1, DataFlow::Node node2) { none() }
+    predicate isAdditionalFlowStep2(DataFlow::Node node1, DataFlow::Node node2) { none() }
 
     /**
      * Holds if data may flow from `node1` to `node2` in addition to the normal data-flow steps in
@@ -228,168 +125,177 @@ module ProductFlow {
      * This step is only applicable in `state1` and updates the flow state to `state2`.
      */
     predicate isAdditionalFlowStep2(
-      DataFlow::Node node1, FlowState2 state1, DataFlow::Node node2, FlowState2 state2
-    );
+      DataFlow::Node node1, DataFlow::FlowState state1, DataFlow::Node node2,
+      DataFlow::FlowState state2
+    ) {
+      state1 instanceof DataFlow::FlowStateEmpty and
+      state2 instanceof DataFlow::FlowStateEmpty and
+      this.isAdditionalFlowStep2(node1, node2)
+    }
 
     /**
      * Holds if data flow into `node` is prohibited in the first projection of the product
      * dataflow graph.
      */
-    default predicate isBarrierIn1(DataFlow::Node node) { none() }
+    predicate isBarrierIn1(DataFlow::Node node) { none() }
 
     /**
      * Holds if data flow into `node` is prohibited in the second projection of the product
      * dataflow graph.
      */
-    default predicate isBarrierIn2(DataFlow::Node node) { none() }
+    predicate isBarrierIn2(DataFlow::Node node) { none() }
+
+    predicate hasFlowPath(
+      DataFlow::PathNode source1, DataFlow2::PathNode source2, DataFlow::PathNode sink1,
+      DataFlow2::PathNode sink2
+    ) {
+      reachable(this, source1, source2, sink1, sink2)
+    }
   }
 
-  module GlobalWithState<StateConfigSig Config> {
-    class PathNode1 = Flow1::PathNode;
+  private import Internal
 
-    class PathNode2 = Flow2::PathNode;
+  module Internal {
+    class Conf1 extends DataFlow::Configuration {
+      Conf1() { this = "Conf1" }
 
-    module PathGraph1 = Flow1::PathGraph;
-
-    module PathGraph2 = Flow2::PathGraph;
-
-    class FlowState1 = Config::FlowState1;
-
-    class FlowState2 = Config::FlowState2;
-
-    predicate flowPath(
-      Flow1::PathNode source1, Flow2::PathNode source2, Flow1::PathNode sink1, Flow2::PathNode sink2
-    ) {
-      reachable(source1, source2, sink1, sink2)
-    }
-
-    private module Config1 implements DataFlow::StateConfigSig {
-      class FlowState = FlowState1;
-
-      predicate isSource(DataFlow::Node source, FlowState state) {
-        Config::isSourcePair(source, state, _, _)
+      override predicate isSource(DataFlow::Node source, DataFlow::FlowState state) {
+        exists(Configuration conf | conf.isSourcePair(source, state, _, _))
       }
 
-      predicate isSink(DataFlow::Node sink, FlowState state) {
-        Config::isSinkPair(sink, state, _, _)
+      override predicate isSink(DataFlow::Node sink, DataFlow::FlowState state) {
+        exists(Configuration conf | conf.isSinkPair(sink, state, _, _))
       }
 
-      predicate isBarrier(DataFlow::Node node, FlowState state) { Config::isBarrier1(node, state) }
+      override predicate isBarrier(DataFlow::Node node, DataFlow::FlowState state) {
+        exists(Configuration conf | conf.isBarrier1(node, state))
+      }
 
-      predicate isBarrierOut(DataFlow::Node node) { Config::isBarrierOut1(node) }
+      override predicate isBarrierOut(DataFlow::Node node) {
+        exists(Configuration conf | conf.isBarrierOut1(node))
+      }
 
-      predicate isAdditionalFlowStep(
-        DataFlow::Node node1, FlowState1 state1, DataFlow::Node node2, FlowState state2
+      override predicate isAdditionalFlowStep(
+        DataFlow::Node node1, DataFlow::FlowState state1, DataFlow::Node node2,
+        DataFlow::FlowState state2
       ) {
-        Config::isAdditionalFlowStep1(node1, state1, node2, state2)
+        exists(Configuration conf | conf.isAdditionalFlowStep1(node1, state1, node2, state2))
       }
 
-      predicate isBarrierIn(DataFlow::Node node) { Config::isBarrierIn1(node) }
+      override predicate isBarrierIn(DataFlow::Node node) {
+        exists(Configuration conf | conf.isBarrierIn1(node))
+      }
     }
 
-    module Flow1 = DataFlow::GlobalWithState<Config1>;
+    class Conf2 extends DataFlow2::Configuration {
+      Conf2() { this = "Conf2" }
 
-    module Config2 implements DataFlow::StateConfigSig {
-      class FlowState = FlowState2;
-
-      predicate isSource(DataFlow::Node source, FlowState state) {
-        exists(Flow1::PathNode source1 |
-          Config::isSourcePair(source1.getNode(), source1.getState(), source, state) and
-          Flow1::flowPath(source1, _)
+      override predicate isSource(DataFlow::Node source, DataFlow::FlowState state) {
+        exists(Configuration conf, DataFlow::PathNode source1 |
+          conf.isSourcePair(source1.getNode(), source1.getState(), source, state) and
+          any(Conf1 c).hasFlowPath(source1, _)
         )
       }
 
-      predicate isSink(DataFlow::Node sink, FlowState state) {
-        exists(Flow1::PathNode sink1 |
-          Config::isSinkPair(sink1.getNode(), sink1.getState(), sink, state) and
-          Flow1::flowPath(_, sink1)
+      override predicate isSink(DataFlow::Node sink, DataFlow::FlowState state) {
+        exists(Configuration conf, DataFlow::PathNode sink1 |
+          conf.isSinkPair(sink1.getNode(), sink1.getState(), sink, state) and
+          any(Conf1 c).hasFlowPath(_, sink1)
         )
       }
 
-      predicate isBarrier(DataFlow::Node node, FlowState state) { Config::isBarrier2(node, state) }
-
-      predicate isBarrierOut(DataFlow::Node node) { Config::isBarrierOut2(node) }
-
-      predicate isAdditionalFlowStep(
-        DataFlow::Node node1, FlowState state1, DataFlow::Node node2, FlowState state2
-      ) {
-        Config::isAdditionalFlowStep2(node1, state1, node2, state2)
+      override predicate isBarrier(DataFlow::Node node, DataFlow::FlowState state) {
+        exists(Configuration conf | conf.isBarrier2(node, state))
       }
 
-      predicate isBarrierIn(DataFlow::Node node) { Config::isBarrierIn2(node) }
-    }
+      override predicate isBarrierOut(DataFlow::Node node) {
+        exists(Configuration conf | conf.isBarrierOut2(node))
+      }
 
-    module Flow2 = DataFlow::GlobalWithState<Config2>;
+      override predicate isAdditionalFlowStep(
+        DataFlow::Node node1, DataFlow::FlowState state1, DataFlow::Node node2,
+        DataFlow::FlowState state2
+      ) {
+        exists(Configuration conf | conf.isAdditionalFlowStep2(node1, state1, node2, state2))
+      }
 
-    pragma[nomagic]
-    private predicate reachableInterprocEntry(
-      Flow1::PathNode source1, Flow2::PathNode source2, Flow1::PathNode node1, Flow2::PathNode node2
-    ) {
-      Config::isSourcePair(node1.getNode(), node1.getState(), node2.getNode(), node2.getState()) and
-      node1 = source1 and
-      node2 = source2
-      or
-      exists(
-        Flow1::PathNode midEntry1, Flow2::PathNode midEntry2, Flow1::PathNode midExit1,
-        Flow2::PathNode midExit2
-      |
-        reachableInterprocEntry(source1, source2, midEntry1, midEntry2) and
-        interprocEdgePair(midExit1, midExit2, node1, node2) and
-        localPathStep1*(midEntry1, midExit1) and
-        localPathStep2*(midEntry2, midExit2)
-      )
+      override predicate isBarrierIn(DataFlow::Node node) {
+        exists(Configuration conf | conf.isBarrierIn2(node))
+      }
     }
+  }
 
-    private predicate localPathStep1(Flow1::PathNode pred, Flow1::PathNode succ) {
-      Flow1::PathGraph::edges(pred, succ) and
-      pragma[only_bind_out](pred.getNode().getEnclosingCallable()) =
-        pragma[only_bind_out](succ.getNode().getEnclosingCallable())
-    }
+  pragma[nomagic]
+  private predicate reachableInterprocEntry(
+    Configuration conf, DataFlow::PathNode source1, DataFlow2::PathNode source2,
+    DataFlow::PathNode node1, DataFlow2::PathNode node2
+  ) {
+    conf.isSourcePair(node1.getNode(), node1.getState(), node2.getNode(), node2.getState()) and
+    node1 = source1 and
+    node2 = source2
+    or
+    exists(
+      DataFlow::PathNode midEntry1, DataFlow2::PathNode midEntry2, DataFlow::PathNode midExit1,
+      DataFlow2::PathNode midExit2
+    |
+      reachableInterprocEntry(conf, source1, source2, midEntry1, midEntry2) and
+      interprocEdgePair(midExit1, midExit2, node1, node2) and
+      localPathStep1*(midEntry1, midExit1) and
+      localPathStep2*(midEntry2, midExit2)
+    )
+  }
 
-    private predicate localPathStep2(Flow2::PathNode pred, Flow2::PathNode succ) {
-      Flow2::PathGraph::edges(pred, succ) and
-      pragma[only_bind_out](pred.getNode().getEnclosingCallable()) =
-        pragma[only_bind_out](succ.getNode().getEnclosingCallable())
-    }
+  private predicate localPathStep1(DataFlow::PathNode pred, DataFlow::PathNode succ) {
+    DataFlow::PathGraph::edges(pred, succ) and
+    pragma[only_bind_out](pred.getNode().getEnclosingCallable()) =
+      pragma[only_bind_out](succ.getNode().getEnclosingCallable())
+  }
 
-    pragma[nomagic]
-    private predicate interprocEdge1(
-      Declaration predDecl, Declaration succDecl, Flow1::PathNode pred1, Flow1::PathNode succ1
-    ) {
-      Flow1::PathGraph::edges(pred1, succ1) and
-      predDecl != succDecl and
-      pred1.getNode().getEnclosingCallable() = predDecl and
-      succ1.getNode().getEnclosingCallable() = succDecl
-    }
+  private predicate localPathStep2(DataFlow2::PathNode pred, DataFlow2::PathNode succ) {
+    DataFlow2::PathGraph::edges(pred, succ) and
+    pragma[only_bind_out](pred.getNode().getEnclosingCallable()) =
+      pragma[only_bind_out](succ.getNode().getEnclosingCallable())
+  }
 
-    pragma[nomagic]
-    private predicate interprocEdge2(
-      Declaration predDecl, Declaration succDecl, Flow2::PathNode pred2, Flow2::PathNode succ2
-    ) {
-      Flow2::PathGraph::edges(pred2, succ2) and
-      predDecl != succDecl and
-      pred2.getNode().getEnclosingCallable() = predDecl and
-      succ2.getNode().getEnclosingCallable() = succDecl
-    }
+  pragma[nomagic]
+  private predicate interprocEdge1(
+    Declaration predDecl, Declaration succDecl, DataFlow::PathNode pred1, DataFlow::PathNode succ1
+  ) {
+    DataFlow::PathGraph::edges(pred1, succ1) and
+    predDecl != succDecl and
+    pred1.getNode().getEnclosingCallable() = predDecl and
+    succ1.getNode().getEnclosingCallable() = succDecl
+  }
 
-    private predicate interprocEdgePair(
-      Flow1::PathNode pred1, Flow2::PathNode pred2, Flow1::PathNode succ1, Flow2::PathNode succ2
-    ) {
-      exists(Declaration predDecl, Declaration succDecl |
-        interprocEdge1(predDecl, succDecl, pred1, succ1) and
-        interprocEdge2(predDecl, succDecl, pred2, succ2)
-      )
-    }
+  pragma[nomagic]
+  private predicate interprocEdge2(
+    Declaration predDecl, Declaration succDecl, DataFlow2::PathNode pred2, DataFlow2::PathNode succ2
+  ) {
+    DataFlow2::PathGraph::edges(pred2, succ2) and
+    predDecl != succDecl and
+    pred2.getNode().getEnclosingCallable() = predDecl and
+    succ2.getNode().getEnclosingCallable() = succDecl
+  }
 
-    private predicate reachable(
-      Flow1::PathNode source1, Flow2::PathNode source2, Flow1::PathNode sink1, Flow2::PathNode sink2
-    ) {
-      exists(Flow1::PathNode mid1, Flow2::PathNode mid2 |
-        reachableInterprocEntry(source1, source2, mid1, mid2) and
-        Config::isSinkPair(sink1.getNode(), sink1.getState(), sink2.getNode(), sink2.getState()) and
-        localPathStep1*(mid1, sink1) and
-        localPathStep2*(mid2, sink2)
-      )
-    }
+  private predicate interprocEdgePair(
+    DataFlow::PathNode pred1, DataFlow2::PathNode pred2, DataFlow::PathNode succ1,
+    DataFlow2::PathNode succ2
+  ) {
+    exists(Declaration predDecl, Declaration succDecl |
+      interprocEdge1(predDecl, succDecl, pred1, succ1) and
+      interprocEdge2(predDecl, succDecl, pred2, succ2)
+    )
+  }
+
+  private predicate reachable(
+    Configuration conf, DataFlow::PathNode source1, DataFlow2::PathNode source2,
+    DataFlow::PathNode sink1, DataFlow2::PathNode sink2
+  ) {
+    exists(DataFlow::PathNode mid1, DataFlow2::PathNode mid2 |
+      reachableInterprocEntry(conf, source1, source2, mid1, mid2) and
+      conf.isSinkPair(sink1.getNode(), sink1.getState(), sink2.getNode(), sink2.getState()) and
+      localPathStep1*(mid1, sink1) and
+      localPathStep2*(mid2, sink2)
+    )
   }
 }

cpp/ql/lib/experimental/semmle/code/cpp/rangeanalysis/Bound.qll

@@ -1 +1,86 @@
-import semmle.code.cpp.rangeanalysis.new.internal.semantic.analysis.Bound
+import cpp
+private import semmle.code.cpp.ir.IR
+private import semmle.code.cpp.ir.ValueNumbering
+
+private newtype TBound =
+  TBoundZero() or
+  TBoundValueNumber(ValueNumber vn) {
+    exists(Instruction i |
+      vn.getAnInstruction() = i and
+      (
+        i.getResultIRType() instanceof IRIntegerType or
+        i.getResultIRType() instanceof IRAddressType
+      ) and
+      not vn.getAnInstruction() instanceof ConstantInstruction
+    |
+      i instanceof PhiInstruction
+      or
+      i instanceof InitializeParameterInstruction
+      or
+      i instanceof CallInstruction
+      or
+      i instanceof VariableAddressInstruction
+      or
+      i instanceof FieldAddressInstruction
+      or
+      i.(LoadInstruction).getSourceAddress() instanceof VariableAddressInstruction
+      or
+      i.(LoadInstruction).getSourceAddress() instanceof FieldAddressInstruction
+      or
+      i.getAUse() instanceof ArgumentOperand
+      or
+      i instanceof PointerArithmeticInstruction
+      or
+      i.getAUse() instanceof AddressOperand
+    )
+  }
+
+/**
+ * A bound that may be inferred for an expression plus/minus an integer delta.
+ */
+abstract class Bound extends TBound {
+  abstract string toString();
+
+  /** Gets an expression that equals this bound plus `delta`. */
+  abstract Instruction getInstruction(int delta);
+
+  /** Gets an expression that equals this bound. */
+  Instruction getInstruction() { result = getInstruction(0) }
+
+  abstract Location getLocation();
+}
+
+/**
+ * The bound that corresponds to the integer 0. This is used to represent all
+ * integer bounds as bounds are always accompanied by an added integer delta.
+ */
+class ZeroBound extends Bound, TBoundZero {
+  override string toString() { result = "0" }
+
+  override Instruction getInstruction(int delta) {
+    result.(ConstantValueInstruction).getValue().toInt() = delta
+  }
+
+  override Location getLocation() { result instanceof UnknownDefaultLocation }
+}
+
+/**
+ * A bound corresponding to the value of an `Instruction`.
+ */
+class ValueNumberBound extends Bound, TBoundValueNumber {
+  ValueNumber vn;
+
+  ValueNumberBound() { this = TBoundValueNumber(vn) }
+
+  /** Gets an `Instruction` that equals this bound. */
+  override Instruction getInstruction(int delta) {
+    this = TBoundValueNumber(valueNumber(result)) and delta = 0
+  }
+
+  override string toString() { result = "ValueNumberBound" }
+
+  override Location getLocation() { result = vn.getLocation() }
+
+  /** Gets the value number that equals this bound. */
+  ValueNumber getValueNumber() { result = vn }
+}

cpp/ql/lib/experimental/semmle/code/cpp/rangeanalysis/ExtendedRangeAnalysis.qll

@@ -3,4 +3,3 @@ import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis
 // Import each extension we want to enable
 import extensions.SubtractSelf
 import extensions.ConstantBitwiseAndExprRange
-import extensions.StrlenLiteralRangeExpr

cpp/ql/lib/experimental/semmle/code/cpp/rangeanalysis/extensions/RangeNode.qll

@@ -1,115 +0,0 @@
-/**
- * This module implements subclasses for various DataFlow nodes that extends
- * their `toString()` predicates with range information, if applicable. By
- * including this module in a `path-problem` query, this range information
- * will be displayed at each step in the query results.
- *
- * This is currently implemented for `DataFlow::ExprNode` and `DataFlow::DefinitionByReferenceNode`,
- * but it is not yet implemented for `DataFlow::ParameterNode`.
- */
-
-private import cpp
-private import semmle.code.cpp.dataflow.DataFlow
-private import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis
-
-string getExprBoundAsString(Expr e) {
-  if exists(lowerBound(e)) and exists(upperBound(e))
-  then result = "[" + lowerBound(e) + ", " + upperBound(e) + "]"
-  else result = "[unknown range]"
-}
-
-/**
- * Holds for any integer type after resolving typedefs and stripping `const`
- * specifiers, such as for `const size_t`
- */
-predicate isIntegralType(Type t) {
-  // We use `getUnspecifiedType` here because without it things like
-  // `const size_t` aren't considered to be integral
-  t.getUnspecifiedType() instanceof IntegralType
-}
-
-/**
- * Holds for any reference to an integer type after resolving typedefs and
- * stripping `const` specifiers, such as for `const size_t&`
- */
-predicate isIntegralReferenceType(Type t) { isIntegralType(t.(ReferenceType).stripType()) }
-
-/**
- * Holds for any pointer to an integer type after resolving typedefs and
- * stripping `const` specifiers, such as for `const size_t*`. This predicate
- * holds for any pointer depth, such as for `const size_t**`.
- */
-predicate isIntegralPointerType(Type t) { isIntegralType(t.(PointerType).stripType()) }
-
-predicate hasIntegralOrReferenceIntegralType(Locatable e) {
-  exists(Type t |
-    (
-      t = e.(Expr).getUnspecifiedType()
-      or
-      // This will cover variables, parameters, type declarations, etc.
-      t = e.(DeclarationEntry).getUnspecifiedType()
-    ) and
-    (isIntegralType(t) or isIntegralReferenceType(t))
-  )
-}
-
-Expr getLOp(Operation o) {
-  result = o.(BinaryOperation).getLeftOperand() or
-  result = o.(Assignment).getLValue()
-}
-
-Expr getROp(Operation o) {
-  result = o.(BinaryOperation).getRightOperand() or
-  result = o.(Assignment).getRValue()
-}
-
-/**
- * Display the ranges of expressions in the path view
- */
-private class ExprRangeNode extends DataFlow::ExprNode {
-  pragma[inline]
-  private string getIntegralBounds(Expr arg) {
-    if hasIntegralOrReferenceIntegralType(arg)
-    then result = getExprBoundAsString(arg)
-    else result = ""
-  }
-
-  private string getOperationBounds(Operation e) {
-    result =
-      getExprBoundAsString(e) + " = " + getExprBoundAsString(getLOp(e)) + e.getOperator() +
-        getExprBoundAsString(getROp(e))
-  }
-
-  private string getCallBounds(Call e) {
-    result =
-      getExprBoundAsString(e) + "(" +
-        concat(Expr arg, int i | arg = e.getArgument(i) | getIntegralBounds(arg) order by i, ",") +
-        ")"
-  }
-
-  override string toString() {
-    exists(Expr e | e = getExpr() |
-      if hasIntegralOrReferenceIntegralType(e)
-      then
-        result = super.toString() + ": " + getOperationBounds(e)
-        or
-        result = super.toString() + ": " + getCallBounds(e)
-        or
-        not exists(getOperationBounds(e)) and
-        not exists(getCallBounds(e)) and
-        result = super.toString() + ": " + getExprBoundAsString(e)
-      else result = super.toString()
-    )
-  }
-}
-
-/**
- * Display the ranges of expressions in the path view
- */
-private class ReferenceArgumentRangeNode extends DataFlow::DefinitionByReferenceNode {
-  override string toString() {
-    if hasIntegralOrReferenceIntegralType(asDefiningArgument())
-    then result = super.toString() + ": " + getExprBoundAsString(getArgument())
-    else result = super.toString()
-  }
-}

cpp/ql/lib/experimental/semmle/code/cpp/rangeanalysis/extensions/StrlenLiteralRangeExpr.qll

@@ -1,18 +0,0 @@
-private import cpp
-private import experimental.semmle.code.cpp.models.interfaces.SimpleRangeAnalysisExpr
-
-/**
- * Provides range analysis information for calls to `strlen` on literal strings.
- * For example, the range of `strlen("literal")` will be 7.
- */
-class StrlenLiteralRangeExpr extends SimpleRangeAnalysisExpr, FunctionCall {
-  StrlenLiteralRangeExpr() {
-    getTarget().hasGlobalOrStdName("strlen") and getArgument(0).isConstant()
-  }
-
-  override int getLowerBounds() { result = getArgument(0).getValue().length() }
-
-  override int getUpperBounds() { result = getArgument(0).getValue().length() }
-
-  override predicate dependsOnChild(Expr e) { none() }
-}

cpp/ql/lib/experimental/semmle/code/cpp/security/PrivateCleartextWrite.qll

@@ -54,7 +54,7 @@ module PrivateCleartextWrite {
     predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
   }
 
-  module WriteFlow = TaintTracking::Global<WriteConfig>;
+  module WriteFlow = TaintTracking::Make<WriteConfig>;
 
   class PrivateDataSource extends Source {
     PrivateDataSource() { this.getExpr() instanceof PrivateDataExpr }

cpp/ql/lib/experimental/semmle/code/cpp/semantic/SemanticBound.qll

@@ -5,7 +5,6 @@
 private import SemanticExpr
 private import SemanticExprSpecific::SemanticExprConfig as Specific
 private import SemanticSSA
-private import SemanticLocation
 
 /**
  * A valid base for an expression bound.
@@ -15,8 +14,6 @@ private import SemanticLocation
 class SemBound instanceof Specific::Bound {
   final string toString() { result = super.toString() }
 
-  final SemLocation getLocation() { result = super.getLocation() }
-
   final SemExpr getExpr(int delta) { result = Specific::getBoundExpr(this, delta) }
 }
 

cpp/ql/lib/experimental/semmle/code/cpp/semantic/SemanticExprSpecific.qll

@@ -5,99 +5,19 @@
 private import cpp as Cpp
 private import semmle.code.cpp.ir.IR as IR
 private import Semantic
-private import analysis.Bound as IRBound
+private import experimental.semmle.code.cpp.rangeanalysis.Bound as IRBound
 private import semmle.code.cpp.controlflow.IRGuards as IRGuards
 private import semmle.code.cpp.ir.ValueNumbering
 
 module SemanticExprConfig {
   class Location = Cpp::Location;
 
-  /** A `ConvertInstruction` or a `CopyValueInstruction`. */
-  private class Conversion extends IR::UnaryInstruction {
-    Conversion() {
-      this instanceof IR::CopyValueInstruction
-      or
-      this instanceof IR::ConvertInstruction
-    }
-
-    /** Holds if this instruction converts a value of type `tFrom` to a value of type `tTo`. */
-    predicate converts(SemType tFrom, SemType tTo) {
-      tFrom = getSemanticType(this.getUnary().getResultIRType()) and
-      tTo = getSemanticType(this.getResultIRType())
-    }
-  }
-
-  /**
-   * Gets a conversion-like instruction that consumes `op`, and
-   * which is guaranteed to not overflow.
-   */
-  private IR::Instruction safeConversion(IR::Operand op) {
-    exists(Conversion conv, SemType tFrom, SemType tTo |
-      conv.converts(tFrom, tTo) and
-      conversionCannotOverflow(tFrom, tTo) and
-      conv.getUnaryOperand() = op and
-      result = conv
-    )
-  }
-
-  /** Holds if `i1 = i2` or if `i2` is a safe conversion that consumes `i1`. */
-  private predicate idOrSafeConversion(IR::Instruction i1, IR::Instruction i2) {
-    not i1.getResultIRType() instanceof IR::IRVoidType and
-    (
-      i1 = i2
-      or
-      i2 = safeConversion(i1.getAUse()) and
-      i1.getBlock() = i2.getBlock()
-    )
-  }
-
-  module Equiv = QlBuiltins::EquivalenceRelation<IR::Instruction, idOrSafeConversion/2>;
-
-  /**
-   * The expressions on which we perform range analysis.
-   */
-  class Expr extends Equiv::EquivalenceClass {
-    /** Gets the n'th instruction in this equivalence class. */
-    private IR::Instruction getInstruction(int n) {
-      result =
-        rank[n + 1](IR::Instruction instr, int i, IR::IRBlock block |
-          this = Equiv::getEquivalenceClass(instr) and block.getInstruction(i) = instr
-        |
-          instr order by i
-        )
-    }
-
-    /** Gets a textual representation of this element. */
-    string toString() { result = this.getUnconverted().toString() }
-
-    /** Gets the basic block of this expression. */
-    IR::IRBlock getBlock() { result = this.getUnconverted().getBlock() }
-
-    /** Gets the unconverted instruction associated with this expression. */
-    IR::Instruction getUnconverted() { result = this.getInstruction(0) }
-
-    /**
-     * Gets the final instruction associated with this expression. This
-     * represents the result after applying all the safe conversions.
-     */
-    IR::Instruction getConverted() {
-      exists(int n |
-        result = this.getInstruction(n) and
-        not exists(this.getInstruction(n + 1))
-      )
-    }
-
-    /** Gets the type of the result produced by this instruction. */
-    IR::IRType getResultIRType() { result = this.getConverted().getResultIRType() }
-
-    /** Gets the location of the source code for this expression. */
-    Location getLocation() { result = this.getUnconverted().getLocation() }
-  }
+  class Expr = IR::Instruction;
 
   SemBasicBlock getExprBasicBlock(Expr e) { result = getSemanticBasicBlock(e.getBlock()) }
 
   private predicate anyConstantExpr(Expr expr, SemType type, string value) {
-    exists(IR::ConstantInstruction instr | getSemanticExpr(instr) = expr |
+    exists(IR::ConstantInstruction instr | instr = expr |
       type = getSemanticType(instr.getResultIRType()) and
       value = instr.getValue()
     )
@@ -138,46 +58,41 @@ module SemanticExprConfig {
   predicate nullLiteral(Expr expr, SemAddressType type) { anyConstantExpr(expr, type, _) }
 
   predicate stringLiteral(Expr expr, SemType type, string value) {
-    anyConstantExpr(expr, type, value) and
-    expr.getUnconverted() instanceof IR::StringConstantInstruction
+    anyConstantExpr(expr, type, value) and expr instanceof IR::StringConstantInstruction
   }
 
   predicate binaryExpr(Expr expr, Opcode opcode, SemType type, Expr leftOperand, Expr rightOperand) {
-    exists(IR::BinaryInstruction instr |
-      instr = expr.getUnconverted() and
+    exists(IR::BinaryInstruction instr | instr = expr |
       type = getSemanticType(instr.getResultIRType()) and
-      leftOperand = getSemanticExpr(instr.getLeft()) and
-      rightOperand = getSemanticExpr(instr.getRight()) and
+      leftOperand = instr.getLeft() and
+      rightOperand = instr.getRight() and
       // REVIEW: Merge the two `Opcode` types.
       opcode.toString() = instr.getOpcode().toString()
     )
   }
 
   predicate unaryExpr(Expr expr, Opcode opcode, SemType type, Expr operand) {
-    exists(IR::UnaryInstruction instr | instr = expr.getUnconverted() |
-      type = getSemanticType(instr.getResultIRType()) and
-      operand = getSemanticExpr(instr.getUnary()) and
-      // REVIEW: Merge the two operand types.
-      opcode.toString() = instr.getOpcode().toString()
-    )
-    or
-    exists(IR::StoreInstruction instr | instr = expr.getUnconverted() |
-      type = getSemanticType(instr.getResultIRType()) and
-      operand = getSemanticExpr(instr.getSourceValue()) and
-      opcode instanceof Opcode::Store
+    type = getSemanticType(expr.getResultIRType()) and
+    (
+      exists(IR::UnaryInstruction instr | instr = expr |
+        operand = instr.getUnary() and
+        // REVIEW: Merge the two operand types.
+        opcode.toString() = instr.getOpcode().toString()
+      )
+      or
+      exists(IR::StoreInstruction instr | instr = expr |
+        operand = instr.getSourceValue() and
+        opcode instanceof Opcode::Store
+      )
     )
   }
 
   predicate nullaryExpr(Expr expr, Opcode opcode, SemType type) {
-    exists(IR::LoadInstruction load |
-      load = expr.getUnconverted() and
-      type = getSemanticType(load.getResultIRType()) and
-      opcode instanceof Opcode::Load
-    )
-    or
-    exists(IR::InitializeParameterInstruction init |
-      init = expr.getUnconverted() and
-      type = getSemanticType(init.getResultIRType()) and
+    type = getSemanticType(expr.getResultIRType()) and
+    (
+      expr instanceof IR::LoadInstruction and opcode instanceof Opcode::Load
+      or
+      expr instanceof IR::InitializeParameterInstruction and
       opcode instanceof Opcode::InitializeParameter
     )
   }
@@ -207,10 +122,8 @@ module SemanticExprConfig {
   newtype TSsaVariable =
     TSsaInstruction(IR::Instruction instr) { instr.hasMemoryResult() } or
     TSsaOperand(IR::Operand op) { op.isDefinitionInexact() } or
-    TSsaPointerArithmeticGuard(ValueNumber instr) {
-      exists(Guard g, IR::Operand use |
-        use = instr.getAUse() and use.getIRType() instanceof IR::IRAddressType
-      |
+    TSsaPointerArithmeticGuard(IR::PointerArithmeticInstruction instr) {
+      exists(Guard g, IR::Operand use | use = instr.getAUse() |
         g.comparesLt(use, _, _, _, _) or
         g.comparesLt(_, use, _, _, _) or
         g.comparesEq(use, _, _, _, _) or
@@ -225,7 +138,7 @@ module SemanticExprConfig {
 
     IR::Instruction asInstruction() { none() }
 
-    ValueNumber asPointerArithGuard() { none() }
+    IR::PointerArithmeticInstruction asPointerArithGuard() { none() }
 
     IR::Operand asOperand() { none() }
   }
@@ -243,15 +156,15 @@ module SemanticExprConfig {
   }
 
   class SsaPointerArithmeticGuard extends SsaVariable, TSsaPointerArithmeticGuard {
-    ValueNumber vn;
+    IR::PointerArithmeticInstruction instr;
 
-    SsaPointerArithmeticGuard() { this = TSsaPointerArithmeticGuard(vn) }
+    SsaPointerArithmeticGuard() { this = TSsaPointerArithmeticGuard(instr) }
 
-    final override string toString() { result = vn.toString() }
+    final override string toString() { result = instr.toString() }
 
-    final override Location getLocation() { result = vn.getLocation() }
+    final override Location getLocation() { result = instr.getLocation() }
 
-    final override ValueNumber asPointerArithGuard() { result = vn }
+    final override IR::PointerArithmeticInstruction asPointerArithGuard() { result = instr }
   }
 
   class SsaOperand extends SsaVariable, TSsaOperand {
@@ -266,9 +179,7 @@ module SemanticExprConfig {
     final override IR::Operand asOperand() { result = op }
   }
 
-  predicate explicitUpdate(SsaVariable v, Expr sourceExpr) {
-    getSemanticExpr(v.asInstruction()) = sourceExpr
-  }
+  predicate explicitUpdate(SsaVariable v, Expr sourceExpr) { v.asInstruction() = sourceExpr }
 
   predicate phi(SsaVariable v) { v.asInstruction() instanceof IR::PhiInstruction }
 
@@ -281,9 +192,9 @@ module SemanticExprConfig {
   }
 
   Expr getAUse(SsaVariable v) {
-    result.getUnconverted().(IR::LoadInstruction).getSourceValue() = v.asInstruction()
+    result.(IR::LoadInstruction).getSourceValue() = v.asInstruction()
     or
-    result.getUnconverted() = v.asPointerArithGuard().getAnInstruction()
+    result = valueNumber(v.asPointerArithGuard()).getAnInstruction()
   }
 
   SemType getSsaVariableType(SsaVariable v) {
@@ -325,7 +236,7 @@ module SemanticExprConfig {
     final override predicate hasRead(SsaVariable v) {
       exists(IR::Operand operand |
         operand.getDef() = v.asInstruction() or
-        operand.getDef() = v.asPointerArithGuard().getAnInstruction()
+        operand.getDef() = valueNumber(v.asPointerArithGuard()).getAnInstruction()
       |
         not operand instanceof IR::PhiInputOperand and
         operand.getUse().getBlock() = block
@@ -346,7 +257,7 @@ module SemanticExprConfig {
     final override predicate hasRead(SsaVariable v) {
       exists(IR::PhiInputOperand operand |
         operand.getDef() = v.asInstruction() or
-        operand.getDef() = v.asPointerArithGuard().getAnInstruction()
+        operand.getDef() = valueNumber(v.asPointerArithGuard()).getAnInstruction()
       |
         operand.getPredecessorBlock() = pred and
         operand.getUse().getBlock() = succ
@@ -392,21 +303,17 @@ module SemanticExprConfig {
   }
 
   Expr getBoundExpr(Bound bound, int delta) {
-    result = getSemanticExpr(bound.(IRBound::Bound).getInstruction(delta))
+    result = bound.(IRBound::Bound).getInstruction(delta)
   }
 
   class Guard = IRGuards::IRGuardCondition;
 
   predicate guard(Guard guard, BasicBlock block) { block = guard.getBlock() }
 
-  Expr getGuardAsExpr(Guard guard) { result = getSemanticExpr(guard) }
+  Expr getGuardAsExpr(Guard guard) { result = guard }
 
   predicate equalityGuard(Guard guard, Expr e1, Expr e2, boolean polarity) {
-    exists(IR::Instruction left, IR::Instruction right |
-      getSemanticExpr(left) = e1 and
-      getSemanticExpr(right) = e2 and
-      guard.comparesEq(left.getAUse(), right.getAUse(), 0, true, polarity)
-    )
+    guard.comparesEq(e1.getAUse(), e2.getAUse(), 0, true, polarity)
   }
 
   predicate guardDirectlyControlsBlock(Guard guard, BasicBlock controlled, boolean branch) {
@@ -417,17 +324,16 @@ module SemanticExprConfig {
     guard.controlsEdge(bb1, bb2, branch)
   }
 
-  Guard comparisonGuard(Expr e) { getSemanticExpr(result) = e }
+  Guard comparisonGuard(Expr e) { result = e }
 
   predicate implies_v2(Guard g1, boolean b1, Guard g2, boolean b2) {
     none() // TODO
   }
-
-  /** Gets the expression associated with `instr`. */
-  SemExpr getSemanticExpr(IR::Instruction instr) { result = Equiv::getEquivalenceClass(instr) }
 }
 
-predicate getSemanticExpr = SemanticExprConfig::getSemanticExpr/1;
+SemExpr getSemanticExpr(IR::Instruction instr) { result = instr }
+
+IR::Instruction getCppInstruction(SemExpr e) { e = result }
 
 SemBasicBlock getSemanticBasicBlock(IR::IRBlock block) { result = block }
 

cpp/ql/lib/experimental/semmle/code/cpp/semantic/SemanticType.qll

@@ -250,26 +250,16 @@ SemType getSemanticType(Specific::Type type) {
   Specific::unknownType(type) and result = TSemUnknownType()
 }
 
-private class SemNumericOrBooleanType extends SemSizedType {
-  SemNumericOrBooleanType() {
-    this instanceof SemNumericType
-    or
-    this instanceof SemBooleanType
-  }
-}
-
 /**
  * Holds if the conversion from `fromType` to `toType` can never overflow or underflow.
  */
-predicate conversionCannotOverflow(SemNumericOrBooleanType fromType, SemNumericOrBooleanType toType) {
+predicate conversionCannotOverflow(SemNumericType fromType, SemNumericType toType) {
   // Identity cast
   fromType = toType
   or
   // Treat any cast to an FP type as safe. It can lose precision, but not overflow.
   toType instanceof SemFloatingPointType and fromType = any(SemNumericType n)
   or
-  fromType instanceof SemBooleanType and toType instanceof SemIntegerType
-  or
   exists(SemIntegerType fromInteger, SemIntegerType toInteger, int fromSize, int toSize |
     fromInteger = fromType and
     toInteger = toType and

cpp/ql/lib/experimental/semmle/code/cpp/semantic/analysis/ConstantAnalysis.qll

@@ -2,7 +2,7 @@
  * Simple constant analysis using the Semantic interface.
  */
 
-private import semmle.code.cpp.rangeanalysis.new.internal.semantic.Semantic
+private import experimental.semmle.code.cpp.semantic.Semantic
 private import ConstantAnalysisSpecific as Specific
 
 /** An expression that always has the same integer value. */

cpp/ql/lib/experimental/semmle/code/cpp/semantic/analysis/ConstantAnalysisSpecific.qll

@@ -2,7 +2,7 @@
  * C++-specific implementation of constant analysis.
  */
 
-private import semmle.code.cpp.rangeanalysis.new.internal.semantic.Semantic
+private import experimental.semmle.code.cpp.semantic.Semantic
 
 /**
  * Gets the constant integer value of the specified expression, if any.

cpp/ql/lib/experimental/semmle/code/cpp/semantic/analysis/FloatDelta.qll

@@ -1,7 +1,7 @@
 private import RangeAnalysisStage
 
-module IntDelta implements DeltaSig {
-  class Delta = int;
+module FloatDelta implements DeltaSig {
+  class Delta = float;
 
   bindingset[d]
   bindingset[result]

cpp/ql/lib/experimental/semmle/code/cpp/semantic/analysis/ModulusAnalysis.qll

@@ -11,7 +11,7 @@
  */
 
 private import ModulusAnalysisSpecific::Private
-private import semmle.code.cpp.rangeanalysis.new.internal.semantic.Semantic
+private import experimental.semmle.code.cpp.semantic.Semantic
 private import ConstantAnalysis
 private import RangeUtils
 private import RangeAnalysisStage

cpp/ql/lib/experimental/semmle/code/cpp/semantic/analysis/ModulusAnalysisSpecific.qll

@@ -2,7 +2,7 @@
  * C++-specific implementation of modulus analysis.
  */
 module Private {
-  private import semmle.code.cpp.rangeanalysis.new.internal.semantic.Semantic
+  private import experimental.semmle.code.cpp.semantic.Semantic
 
   predicate ignoreExprModulus(SemExpr e) { none() }
 }

cpp/ql/lib/experimental/semmle/code/cpp/semantic/analysis/RangeAnalysis.qll

@@ -0,0 +1,24 @@
+private import RangeAnalysisStage
+private import RangeAnalysisSpecific
+private import experimental.semmle.code.cpp.semantic.analysis.FloatDelta
+private import RangeUtils
+private import experimental.semmle.code.cpp.semantic.SemanticBound as SemanticBound
+
+module Bounds implements BoundSig<FloatDelta> {
+  class SemBound instanceof SemanticBound::SemBound {
+    string toString() { result = super.toString() }
+
+    SemExpr getExpr(float delta) { result = super.getExpr(delta) }
+  }
+
+  class SemZeroBound extends SemBound instanceof SemanticBound::SemZeroBound { }
+
+  class SemSsaBound extends SemBound instanceof SemanticBound::SemSsaBound {
+    SemSsaVariable getAVariable() { result = this.(SemanticBound::SemSsaBound).getAVariable() }
+  }
+}
+
+private module CppRangeAnalysis =
+  RangeStage<FloatDelta, Bounds, CppLangImpl, RangeUtil<FloatDelta, CppLangImpl>>;
+
+import CppRangeAnalysis

cpp/ql/lib/experimental/semmle/code/cpp/semantic/analysis/RangeAnalysisSpecific.qll

@@ -2,11 +2,11 @@
  * C++-specific implementation of range analysis.
  */
 
-private import semmle.code.cpp.rangeanalysis.new.internal.semantic.Semantic
+private import experimental.semmle.code.cpp.semantic.Semantic
 private import RangeAnalysisStage
-private import semmle.code.cpp.rangeanalysis.new.internal.semantic.analysis.FloatDelta
+private import experimental.semmle.code.cpp.semantic.analysis.FloatDelta
 
-module CppLangImplConstant implements LangSig<FloatDelta> {
+module CppLangImpl implements LangSig<FloatDelta> {
   /**
    * Holds if the specified expression should be excluded from the result of `ssaRead()`.
    *

cpp/ql/lib/experimental/semmle/code/cpp/semantic/analysis/RangeAnalysisStage.qll

@@ -65,29 +65,30 @@
 
 private import RangeUtils as Utils
 private import SignAnalysisCommon
-private import semmle.code.cpp.rangeanalysis.new.internal.semantic.analysis.ModulusAnalysis
-import semmle.code.cpp.rangeanalysis.new.internal.semantic.SemanticExpr
-import semmle.code.cpp.rangeanalysis.new.internal.semantic.SemanticSSA
-import semmle.code.cpp.rangeanalysis.new.internal.semantic.SemanticGuard
-import semmle.code.cpp.rangeanalysis.new.internal.semantic.SemanticCFG
-import semmle.code.cpp.rangeanalysis.new.internal.semantic.SemanticType
-import semmle.code.cpp.rangeanalysis.new.internal.semantic.SemanticOpcode
+private import experimental.semmle.code.cpp.semantic.analysis.ModulusAnalysis
+import experimental.semmle.code.cpp.semantic.SemanticExpr
+import experimental.semmle.code.cpp.semantic.SemanticSSA
+import experimental.semmle.code.cpp.semantic.SemanticGuard
+import experimental.semmle.code.cpp.semantic.SemanticCFG
+import experimental.semmle.code.cpp.semantic.SemanticType
+import experimental.semmle.code.cpp.semantic.SemanticOpcode
 private import ConstantAnalysis
-private import Sign
-import semmle.code.cpp.rangeanalysis.new.internal.semantic.SemanticLocation
 
 /**
  * Holds if `typ` is a small integral type with the given lower and upper bounds.
  */
-private predicate typeBound(SemIntegerType typ, float lowerbound, float upperbound) {
+private predicate typeBound(SemIntegerType typ, int lowerbound, int upperbound) {
   exists(int bitSize | bitSize = typ.getByteSize() * 8 |
-    if typ.isSigned()
-    then (
-      upperbound = 2.pow(bitSize - 1) - 1 and
-      lowerbound = -upperbound - 1
-    ) else (
-      lowerbound = 0 and
-      upperbound = 2.pow(bitSize) - 1
+    bitSize < 32 and
+    (
+      if typ.isSigned()
+      then (
+        upperbound = 1.bitShiftLeft(bitSize - 1) - 1 and
+        lowerbound = -upperbound - 1
+      ) else (
+        lowerbound = 0 and
+        upperbound = 1.bitShiftLeft(bitSize) - 1
+      )
     )
   )
 }
@@ -227,10 +228,6 @@ signature module UtilSig<DeltaSig DeltaParam> {
 
 signature module BoundSig<DeltaSig D> {
   class SemBound {
-    string toString();
-
-    SemLocation getLocation();
-
     SemExpr getExpr(D::Delta delta);
   }
 
@@ -241,19 +238,11 @@ signature module BoundSig<DeltaSig D> {
   }
 }
 
-signature module OverflowSig<DeltaSig D> {
-  predicate semExprDoesNotOverflow(boolean positively, SemExpr expr);
-}
-
-module RangeStage<
-  DeltaSig D, BoundSig<D> Bounds, OverflowSig<D> OverflowParam, LangSig<D> LangParam,
-  UtilSig<D> UtilParam>
-{
+module RangeStage<DeltaSig D, BoundSig<D> Bounds, LangSig<D> LangParam, UtilSig<D> UtilParam> {
   private import Bounds
   private import LangParam
   private import UtilParam
   private import D
-  private import OverflowParam
 
   /**
    * An expression that does conversion, boxing, or unboxing
@@ -292,10 +281,10 @@ module RangeStage<
     }
 
     /** Gets the lower bound of the resulting type. */
-    float getLowerBound() { typeBound(getTrackedType(this), result, _) }
+    int getLowerBound() { typeBound(getTrackedType(this), result, _) }
 
     /** Gets the upper bound of the resulting type. */
-    float getUpperBound() { typeBound(getTrackedType(this), _, result) }
+    int getUpperBound() { typeBound(getTrackedType(this), _, result) }
   }
 
   private module SignAnalysisInstantiated = SignAnalysis<D, UtilParam>; // TODO: will this cause reevaluation if it's instantiated with the same DeltaSig and UtilParam multiple times?
@@ -501,7 +490,7 @@ module RangeStage<
       SemSsaVariable v2, SemGuard guardEq, boolean eqIsTrue, D::Delta d1, D::Delta d2,
       D::Delta oldDelta
     |
-      guardEq = semEqFlowCond(v, semSsaRead(pragma[only_bind_into](v2), d1), d2, true, eqIsTrue) and
+      guardEq = semEqFlowCond(v, semSsaRead(v2, d1), d2, true, eqIsTrue) and
       result = boundFlowCond(v2, e, oldDelta, upper, testIsTrue) and
       // guardEq needs to control guard
       guardEq.directlyControls(result.getBasicBlock(), eqIsTrue) and
@@ -597,6 +586,24 @@ module RangeStage<
     delta = D::fromInt(0) and
     (upper = true or upper = false)
     or
+    exists(SemExpr x | e2.(SemAddExpr).hasOperands(e1, x) |
+      // `x instanceof ConstantIntegerExpr` is covered by valueFlowStep
+      not x instanceof SemConstantIntegerExpr and
+      not e1 instanceof SemConstantIntegerExpr and
+      if strictlyPositiveIntegralExpr(x)
+      then upper = false and delta = D::fromInt(1)
+      else
+        if semPositive(x)
+        then upper = false and delta = D::fromInt(0)
+        else
+          if strictlyNegativeIntegralExpr(x)
+          then upper = true and delta = D::fromInt(-1)
+          else
+            if semNegative(x)
+            then upper = true and delta = D::fromInt(0)
+            else none()
+    )
+    or
     exists(SemExpr x, SemSubExpr sub |
       e2 = sub and
       sub.getLeftOperand() = e1 and
@@ -929,81 +936,6 @@ module RangeStage<
     bounded(cast.getOperand(), b, delta, upper, fromBackEdge, origdelta, reason)
   }
 
-  predicate bounded(
-    SemExpr e, SemBound b, D::Delta delta, boolean upper, boolean fromBackEdge, D::Delta origdelta,
-    SemReason reason
-  ) {
-    initialBounded(e, b, delta, upper, fromBackEdge, origdelta, reason) and
-    (
-      semExprDoesNotOverflow(upper.booleanNot(), e)
-      or
-      not potentiallyOverflowingExpr(upper.booleanNot(), e)
-      or
-      exists(D::Delta otherDelta |
-        initialBounded(e, _, otherDelta, upper.booleanNot(), _, _, _) and
-        (
-          upper = true and D::toFloat(otherDelta) >= 0
-          or
-          upper = false and D::toFloat(otherDelta) <= 0
-        )
-      )
-    )
-  }
-
-  predicate potentiallyOverflowingExpr(boolean positively, SemExpr expr) {
-    (
-      expr.getOpcode() instanceof Opcode::Add or
-      expr.getOpcode() instanceof Opcode::PointerAdd
-    ) and
-    (
-      positively = true and
-      (
-        pragma[only_bind_out](semExprSign(expr.(SemBinaryExpr).getLeftOperand())) = TPos() and
-        pragma[only_bind_out](semExprSign(expr.(SemBinaryExpr).getRightOperand())) = TPos()
-      )
-      or
-      positively = false and
-      (
-        pragma[only_bind_out](semExprSign(expr.(SemBinaryExpr).getLeftOperand())) = TNeg() and
-        pragma[only_bind_out](semExprSign(expr.(SemBinaryExpr).getRightOperand())) = TNeg()
-      )
-    )
-    or
-    (
-      expr.getOpcode() instanceof Opcode::Sub or
-      expr.getOpcode() instanceof Opcode::PointerSub
-    ) and
-    (
-      positively = true and
-      (
-        pragma[only_bind_out](semExprSign(expr.(SemBinaryExpr).getLeftOperand())) = TPos() and
-        pragma[only_bind_out](semExprSign(expr.(SemBinaryExpr).getRightOperand())) = TNeg()
-      )
-      or
-      positively = false and
-      (
-        pragma[only_bind_out](semExprSign(expr.(SemBinaryExpr).getLeftOperand())) = TNeg() and
-        pragma[only_bind_out](semExprSign(expr.(SemBinaryExpr).getRightOperand())) = TPos()
-      )
-    )
-    or
-    positively in [true, false] and
-    (
-      expr.getOpcode() instanceof Opcode::Mul or
-      expr.getOpcode() instanceof Opcode::ShiftLeft
-    )
-    or
-    positively = false and
-    (
-      expr.getOpcode() instanceof Opcode::Negate or
-      expr.getOpcode() instanceof Opcode::SubOne or
-      expr.(SemDivExpr).getSemType() instanceof SemFloatingPointType
-    )
-    or
-    positively = true and
-    expr.getOpcode() instanceof Opcode::AddOne
-  }
-
   /**
    * Computes a normal form of `x` where -0.0 has changed to +0.0. This can be
    * needed on the lesser side of a floating-point comparison or on both sides of
@@ -1018,7 +950,7 @@ module RangeStage<
    * - `upper = true`  : `e <= b + delta`
    * - `upper = false` : `e >= b + delta`
    */
-  predicate initialBounded(
+  private predicate bounded(
     SemExpr e, SemBound b, D::Delta delta, boolean upper, boolean fromBackEdge, D::Delta origdelta,
     SemReason reason
   ) {
@@ -1106,196 +1038,13 @@ module RangeStage<
         delta = D::fromFloat(f) and
         if semPositive(e) then f >= 0 else any()
       )
-      or
-      exists(
-        SemBound bLeft, SemBound bRight, D::Delta dLeft, D::Delta dRight, boolean fbeLeft,
-        boolean fbeRight, D::Delta odLeft, D::Delta odRight, SemReason rLeft, SemReason rRight
-      |
-        boundedAddOperand(e, upper, bLeft, false, dLeft, fbeLeft, odLeft, rLeft) and
-        boundedAddOperand(e, upper, bRight, true, dRight, fbeRight, odRight, rRight) and
-        delta = D::fromFloat(D::toFloat(dLeft) + D::toFloat(dRight)) and
-        fromBackEdge = fbeLeft.booleanOr(fbeRight)
-      |
-        b = bLeft and origdelta = odLeft and reason = rLeft and bRight instanceof SemZeroBound
-        or
-        b = bRight and origdelta = odRight and reason = rRight and bLeft instanceof SemZeroBound
-      )
-      or
-      exists(
-        SemRemExpr rem, D::Delta d_max, D::Delta d1, D::Delta d2, boolean fbe1, boolean fbe2,
-        D::Delta od1, D::Delta od2, SemReason r1, SemReason r2
-      |
-        rem = e and
-        b instanceof SemZeroBound and
-        not (upper = true and semPositive(rem.getRightOperand())) and
-        not (upper = true and semPositive(rem.getLeftOperand())) and
-        boundedRemExpr(rem, true, d1, fbe1, od1, r1) and
-        boundedRemExpr(rem, false, d2, fbe2, od2, r2) and
-        (
-          if D::toFloat(d1).abs() > D::toFloat(d2).abs()
-          then (
-            d_max = d1 and fromBackEdge = fbe1 and origdelta = od1 and reason = r1
-          ) else (
-            d_max = d2 and fromBackEdge = fbe2 and origdelta = od2 and reason = r2
-          )
-        )
-      |
-        upper = true and delta = D::fromFloat(D::toFloat(d_max).abs() - 1)
-        or
-        upper = false and delta = D::fromFloat(-D::toFloat(d_max).abs() + 1)
-      )
-      or
-      exists(
-        D::Delta dLeft, D::Delta dRight, boolean fbeLeft, boolean fbeRight, D::Delta odLeft,
-        D::Delta odRight, SemReason rLeft, SemReason rRight
-      |
-        boundedMulOperand(e, upper, true, dLeft, fbeLeft, odLeft, rLeft) and
-        boundedMulOperand(e, upper, false, dRight, fbeRight, odRight, rRight) and
-        delta = D::fromFloat(D::toFloat(dLeft) * D::toFloat(dRight)) and
-        fromBackEdge = fbeLeft.booleanOr(fbeRight)
-      |
-        b instanceof SemZeroBound and origdelta = odLeft and reason = rLeft
-        or
-        b instanceof SemZeroBound and origdelta = odRight and reason = rRight
-      )
     )
   }
 
-  pragma[nomagic]
   private predicate boundedConditionalExpr(
     SemConditionalExpr cond, SemBound b, boolean upper, boolean branch, D::Delta delta,
     boolean fromBackEdge, D::Delta origdelta, SemReason reason
   ) {
     bounded(cond.getBranchExpr(branch), b, delta, upper, fromBackEdge, origdelta, reason)
   }
-
-  pragma[nomagic]
-  private predicate boundedAddOperand(
-    SemAddExpr add, boolean upper, SemBound b, boolean isLeft, D::Delta delta, boolean fromBackEdge,
-    D::Delta origdelta, SemReason reason
-  ) {
-    // `semValueFlowStep` already handles the case where one of the operands is a constant.
-    not semValueFlowStep(add, _, _) and
-    (
-      isLeft = true and
-      bounded(add.getLeftOperand(), b, delta, upper, fromBackEdge, origdelta, reason)
-      or
-      isLeft = false and
-      bounded(add.getRightOperand(), b, delta, upper, fromBackEdge, origdelta, reason)
-    )
-  }
-
-  pragma[nomagic]
-  private predicate boundedRemExpr(
-    SemRemExpr rem, boolean upper, D::Delta delta, boolean fromBackEdge, D::Delta origdelta,
-    SemReason reason
-  ) {
-    bounded(rem.getRightOperand(), any(SemZeroBound zb), delta, upper, fromBackEdge, origdelta,
-      reason)
-  }
-
-  /**
-   * Define `cmp(true) = <=` and `cmp(false) = >=`.
-   *
-   * Holds if `mul = left * right`, and in order to know if `mul cmp(upper) 0 + k` (for
-   * some `k`) we need to know that `left cmp(upperLeft) 0 + k1` and
-   * `right cmp(upperRight) 0 + k2` (for some `k1` and `k2`).
-   */
-  pragma[nomagic]
-  private predicate boundedMulOperandCand(
-    SemMulExpr mul, SemExpr left, SemExpr right, boolean upper, boolean upperLeft,
-    boolean upperRight
-  ) {
-    not boundFlowStepMul(mul, _, _) and
-    mul.getLeftOperand() = left and
-    mul.getRightOperand() = right and
-    (
-      semPositive(left) and
-      (
-        // left, right >= 0
-        semPositive(right) and
-        (
-          // max(left * right) = max(left) * max(right)
-          upper = true and
-          upperLeft = true and
-          upperRight = true
-          or
-          // min(left * right) = min(left) * min(right)
-          upper = false and
-          upperLeft = false and
-          upperRight = false
-        )
-        or
-        // left >= 0, right <= 0
-        semNegative(right) and
-        (
-          // max(left * right) = min(left) * max(right)
-          upper = true and
-          upperLeft = false and
-          upperRight = true
-          or
-          // min(left * right) = max(left) * min(right)
-          upper = false and
-          upperLeft = true and
-          upperRight = false
-        )
-      )
-      or
-      semNegative(left) and
-      (
-        // left <= 0, right >= 0
-        semPositive(right) and
-        (
-          // max(left * right) = max(left) * min(right)
-          upper = true and
-          upperLeft = true and
-          upperRight = false
-          or
-          // min(left * right) = min(left) * max(right)
-          upper = false and
-          upperLeft = false and
-          upperRight = true
-        )
-        or
-        // left, right <= 0
-        semNegative(right) and
-        (
-          // max(left * right) = min(left) * min(right)
-          upper = true and
-          upperLeft = false and
-          upperRight = false
-          or
-          // min(left * right) = max(left) * max(right)
-          upper = false and
-          upperLeft = true and
-          upperRight = true
-        )
-      )
-    )
-  }
-
-  /**
-   * Holds if `isLeft = true` and `mul`'s left operand is bounded by `delta`,
-   * or if `isLeft = false` and `mul`'s right operand is bounded by `delta`.
-   *
-   * If `upper = true` the computed bound contributes to an upper bound of `mul`,
-   * and if `upper = false` it contributes to a lower bound.
-   * The `fromBackEdge`, `origdelta`, `reason` triple are defined by the recursive
-   * call to `bounded`.
-   */
-  pragma[nomagic]
-  private predicate boundedMulOperand(
-    SemMulExpr mul, boolean upper, boolean isLeft, D::Delta delta, boolean fromBackEdge,
-    D::Delta origdelta, SemReason reason
-  ) {
-    exists(boolean upperLeft, boolean upperRight, SemExpr left, SemExpr right |
-      boundedMulOperandCand(mul, left, right, upper, upperLeft, upperRight)
-    |
-      isLeft = true and
-      bounded(left, any(SemZeroBound zb), delta, upperLeft, fromBackEdge, origdelta, reason)
-      or
-      isLeft = false and
-      bounded(right, any(SemZeroBound zb), delta, upperRight, fromBackEdge, origdelta, reason)
-    )
-  }
 }

cpp/ql/lib/experimental/semmle/code/cpp/semantic/analysis/RangeUtils.qll

@@ -2,8 +2,8 @@
  * Provides utility predicates for range analysis.
  */
 
-private import semmle.code.cpp.rangeanalysis.new.internal.semantic.Semantic
-private import RangeAnalysisRelativeSpecific
+private import experimental.semmle.code.cpp.semantic.Semantic
+private import RangeAnalysisSpecific
 private import RangeAnalysisStage as Range
 private import ConstantAnalysis
 

cpp/ql/lib/experimental/semmle/code/cpp/semantic/analysis/Sign.qll

@@ -1,4 +1,4 @@
-private import semmle.code.cpp.rangeanalysis.new.internal.semantic.Semantic
+private import experimental.semmle.code.cpp.semantic.Semantic
 
 newtype TSign =
   TNeg() or

cpp/ql/lib/experimental/semmle/code/cpp/semantic/analysis/SignAnalysisCommon.qll

@@ -8,7 +8,7 @@
 
 private import RangeAnalysisStage
 private import SignAnalysisSpecific as Specific
-private import semmle.code.cpp.rangeanalysis.new.internal.semantic.Semantic
+private import experimental.semmle.code.cpp.semantic.Semantic
 private import ConstantAnalysis
 private import RangeUtils
 private import Sign
@@ -198,16 +198,6 @@ module SignAnalysis<DeltaSig D, UtilSig<D> Utils> {
     }
   }
 
-  /** An expression of an unsigned type. */
-  private class UnsignedExpr extends FlowSignExpr {
-    UnsignedExpr() { Utils::getTrackedType(this) instanceof SemUnsignedIntegerType }
-
-    override Sign getSignRestriction() {
-      result = TPos() or
-      result = TZero()
-    }
-  }
-
   pragma[nomagic]
   private predicate binaryExprOperands(SemBinaryExpr binary, SemExpr left, SemExpr right) {
     binary.getLeftOperand() = left and binary.getRightOperand() = right
@@ -338,11 +328,10 @@ module SignAnalysis<DeltaSig D, UtilSig<D> Utils> {
    *  - `isEq = false` : `v != eqbound`
    */
   private predicate eqBound(SemExpr eqbound, SemSsaVariable v, SemSsaReadPosition pos, boolean isEq) {
-    exists(SemGuard guard, boolean testIsTrue, boolean polarity, SemExpr e |
-      pos.hasReadOfVar(pragma[only_bind_into](v)) and
-      semGuardControlsSsaRead(guard, pragma[only_bind_into](pos), testIsTrue) and
-      e = Utils::semSsaRead(pragma[only_bind_into](v), D::fromInt(0)) and
-      guard.isEquality(eqbound, e, polarity) and
+    exists(SemGuard guard, boolean testIsTrue, boolean polarity |
+      pos.hasReadOfVar(v) and
+      semGuardControlsSsaRead(guard, pos, testIsTrue) and
+      guard.isEquality(eqbound, Utils::semSsaRead(v, D::fromInt(0)), polarity) and
       isEq = polarity.booleanXor(testIsTrue).booleanNot() and
       not unknownSign(eqbound)
     )

cpp/ql/lib/experimental/semmle/code/cpp/semantic/analysis/SignAnalysisSpecific.qll

@@ -2,7 +2,7 @@
  * Provides C++-specific definitions for use in sign analysis.
  */
 
-private import semmle.code.cpp.rangeanalysis.new.internal.semantic.Semantic
+private import experimental.semmle.code.cpp.semantic.Semantic
 
 /**
  * Workaround to allow certain expressions to have a negative sign, even if the type of the

cpp/ql/lib/experimental/semmle/code/cpp/semantic/analysis/SimpleRangeAnalysis.qll

@@ -5,11 +5,9 @@
 
 private import cpp
 private import semmle.code.cpp.ir.IR
-private import semmle.code.cpp.rangeanalysis.new.internal.semantic.SemanticBound
-private import semmle.code.cpp.rangeanalysis.new.internal.semantic.SemanticExprSpecific
-private import semmle.code.cpp.rangeanalysis.new.internal.semantic.analysis.RangeAnalysis
-private import semmle.code.cpp.rangeanalysis.new.internal.semantic.analysis.RangeAnalysisImpl
-private import semmle.code.cpp.rangeanalysis.RangeAnalysisUtils
+private import experimental.semmle.code.cpp.semantic.SemanticBound
+private import experimental.semmle.code.cpp.semantic.SemanticExprSpecific
+private import RangeAnalysis
 
 /**
  * Gets the lower bound of the expression.
@@ -24,10 +22,8 @@ private import semmle.code.cpp.rangeanalysis.RangeAnalysisUtils
  *    `lowerBound(expr.getFullyConverted())`
  */
 float lowerBound(Expr expr) {
-  exists(Instruction i, ConstantBounds::SemBound b |
-    i.getAst() = expr and b instanceof ConstantBounds::SemZeroBound
-  |
-    ConstantStage::semBounded(getSemanticExpr(i), b, result, false, _)
+  exists(Instruction i, SemBound b | i.getAst() = expr and b instanceof SemZeroBound |
+    semBounded(getSemanticExpr(i), b, result, false, _)
   )
 }
 
@@ -44,10 +40,8 @@ float lowerBound(Expr expr) {
  *    `upperBound(expr.getFullyConverted())`
  */
 float upperBound(Expr expr) {
-  exists(Instruction i, ConstantBounds::SemBound b |
-    i.getAst() = expr and b instanceof ConstantBounds::SemZeroBound
-  |
-    ConstantStage::semBounded(getSemanticExpr(i), b, result, true, _)
+  exists(Instruction i, SemBound b | i.getAst() = expr and b instanceof SemZeroBound |
+    semBounded(getSemanticExpr(i), b, result, true, _)
   )
 }
 
@@ -96,15 +90,7 @@ predicate defMightOverflow(RangeSsaDefinition def, StackVariable v) {
  * does not consider the possibility that the expression might overflow
  * due to a conversion.
  */
-predicate exprMightOverflowNegatively(Expr expr) {
-  lowerBound(expr) < exprMinVal(expr)
-  or
-  exists(SemanticExprConfig::Expr semExpr |
-    semExpr.getUnconverted().getAst() = expr and
-    ConstantStage::potentiallyOverflowingExpr(false, semExpr) and
-    not ConstantStage::initialBounded(semExpr, _, _, false, _, _, _)
-  )
-}
+predicate exprMightOverflowNegatively(Expr expr) { none() }
 
 /**
  * Holds if the expression might overflow negatively. Conversions
@@ -122,15 +108,7 @@ predicate convertedExprMightOverflowNegatively(Expr expr) {
  * does not consider the possibility that the expression might overflow
  * due to a conversion.
  */
-predicate exprMightOverflowPositively(Expr expr) {
-  upperBound(expr) > exprMaxVal(expr)
-  or
-  exists(SemanticExprConfig::Expr semExpr |
-    semExpr.getUnconverted().getAst() = expr and
-    ConstantStage::potentiallyOverflowingExpr(true, semExpr) and
-    not ConstantStage::initialBounded(semExpr, _, _, true, _, _, _)
-  )
-}
+predicate exprMightOverflowPositively(Expr expr) { none() }
 
 /**
  * Holds if the expression might overflow positively. Conversions

cpp/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/cpp-all
-version: 0.7.2-dev
+version: 0.5.5-dev
 groups: cpp
 dbscheme: semmlecode.cpp.dbscheme
 extractor: cpp
@@ -8,4 +8,3 @@ upgrades: upgrades
 dependencies:
   codeql/ssa: ${workspace}
   codeql/tutorial: ${workspace}
-  codeql/util: ${workspace}

cpp/ql/lib/semmle/code/cpp/PrintAST.qll

@@ -752,13 +752,13 @@ private predicate namedExprChildPredicates(Expr expr, Element ele, string pred)
     expr.(VariableAccess).getQualifier() = ele and pred = "getQualifier()"
     or
     exists(Field f |
-      expr.(ClassAggregateLiteral).getAFieldExpr(f) = ele and
-      pred = "getAFieldExpr(" + f.toString() + ")"
+      expr.(ClassAggregateLiteral).getFieldExpr(f) = ele and
+      pred = "getFieldExpr(" + f.toString() + ")"
     )
     or
     exists(int n |
-      expr.(ArrayOrVectorAggregateLiteral).getAnElementExpr(n) = ele and
-      pred = "getAnElementExpr(" + n.toString() + ")"
+      expr.(ArrayOrVectorAggregateLiteral).getElementExpr(n) = ele and
+      pred = "getElementExpr(" + n.toString() + ")"
     )
     or
     expr.(AlignofExprOperator).getExprOperand() = ele and pred = "getExprOperand()"

cpp/ql/lib/semmle/code/cpp/Variable.qll

@@ -133,7 +133,7 @@ class Variable extends Declaration, @variable {
     or
     exists(AssignExpr ae | ae.getLValue().(Access).getTarget() = this and result = ae.getRValue())
     or
-    exists(ClassAggregateLiteral l | result = l.getAFieldExpr(this))
+    exists(ClassAggregateLiteral l | result = l.getFieldExpr(this))
   }
 
   /**

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlow.qll

@@ -2,7 +2,7 @@
  * Provides an implementation of global (interprocedural) data flow. This file
  * re-exports the local (intraprocedural) data flow analysis from
  * `DataFlowImplSpecific::Public` and adds a global analysis, mainly exposed
- * through the `Global` and `GlobalWithState` modules.
+ * through the `Make` and `MakeWithState` modules.
  */
 
 private import DataFlowImplCommon
@@ -73,10 +73,10 @@ signature module ConfigSig {
    */
   default FlowFeature getAFeature() { none() }
 
-  /** Holds if sources should be grouped in the result of `flowPath`. */
+  /** Holds if sources should be grouped in the result of `hasFlowPath`. */
   default predicate sourceGrouping(Node source, string sourceGroup) { none() }
 
-  /** Holds if sinks should be grouped in the result of `flowPath`. */
+  /** Holds if sinks should be grouped in the result of `hasFlowPath`. */
   default predicate sinkGrouping(Node sink, string sinkGroup) { none() }
 
   /**
@@ -166,10 +166,10 @@ signature module StateConfigSig {
    */
   default FlowFeature getAFeature() { none() }
 
-  /** Holds if sources should be grouped in the result of `flowPath`. */
+  /** Holds if sources should be grouped in the result of `hasFlowPath`. */
   default predicate sourceGrouping(Node source, string sourceGroup) { none() }
 
-  /** Holds if sinks should be grouped in the result of `flowPath`. */
+  /** Holds if sinks should be grouped in the result of `hasFlowPath`. */
   default predicate sinkGrouping(Node sink, string sinkGroup) { none() }
 
   /**
@@ -182,15 +182,15 @@ signature module StateConfigSig {
 }
 
 /**
- * Gets the exploration limit for `partialFlow` and `partialFlowRev`
+ * Gets the exploration limit for `hasPartialFlow` and `hasPartialFlowRev`
  * measured in approximate number of interprocedural steps.
  */
 signature int explorationLimitSig();
 
 /**
- * The output of a global data flow computation.
+ * The output of a data flow computation.
  */
-signature module GlobalFlowSig {
+signature module DataFlowSig {
   /**
    * A `Node` augmented with a call context (except for sinks) and an access path.
    * Only those `PathNode`s that are reachable from a source, and which can reach a sink, are generated.
@@ -203,28 +203,28 @@ signature module GlobalFlowSig {
    * The corresponding paths are generated from the end-points and the graph
    * included in the module `PathGraph`.
    */
-  predicate flowPath(PathNode source, PathNode sink);
+  predicate hasFlowPath(PathNode source, PathNode sink);
 
   /**
    * Holds if data can flow from `source` to `sink`.
    */
-  predicate flow(Node source, Node sink);
+  predicate hasFlow(Node source, Node sink);
 
   /**
    * Holds if data can flow from some source to `sink`.
    */
-  predicate flowTo(Node sink);
+  predicate hasFlowTo(Node sink);
 
   /**
    * Holds if data can flow from some source to `sink`.
    */
-  predicate flowToExpr(DataFlowExpr sink);
+  predicate hasFlowToExpr(DataFlowExpr sink);
 }
 
 /**
- * Constructs a global data flow computation.
+ * Constructs a standard data flow computation.
  */
-module Global<ConfigSig Config> implements GlobalFlowSig {
+module Make<ConfigSig Config> implements DataFlowSig {
   private module C implements FullStateConfigSig {
     import DefaultState<Config>
     import Config
@@ -233,15 +233,10 @@ module Global<ConfigSig Config> implements GlobalFlowSig {
   import Impl<C>
 }
 
-/** DEPRECATED: Use `Global` instead. */
-deprecated module Make<ConfigSig Config> implements GlobalFlowSig {
-  import Global<Config>
-}
-
 /**
- * Constructs a global data flow computation using flow state.
+ * Constructs a data flow computation using flow state.
  */
-module GlobalWithState<StateConfigSig Config> implements GlobalFlowSig {
+module MakeWithState<StateConfigSig Config> implements DataFlowSig {
   private module C implements FullStateConfigSig {
     import Config
   }
@@ -249,11 +244,6 @@ module GlobalWithState<StateConfigSig Config> implements GlobalFlowSig {
   import Impl<C>
 }
 
-/** DEPRECATED: Use `GlobalWithState` instead. */
-deprecated module MakeWithState<StateConfigSig Config> implements GlobalFlowSig {
-  import GlobalWithState<Config>
-}
-
 signature class PathNodeSig {
   /** Gets a textual representation of this element. */
   string toString();
@@ -361,52 +351,3 @@ module MergePathGraph<
     }
   }
 }
-
-/**
- * Constructs a `PathGraph` from three `PathGraph`s by disjoint union.
- */
-module MergePathGraph3<
-  PathNodeSig PathNode1, PathNodeSig PathNode2, PathNodeSig PathNode3,
-  PathGraphSig<PathNode1> Graph1, PathGraphSig<PathNode2> Graph2, PathGraphSig<PathNode3> Graph3>
-{
-  private module MergedInner = MergePathGraph<PathNode1, PathNode2, Graph1, Graph2>;
-
-  private module Merged =
-    MergePathGraph<MergedInner::PathNode, PathNode3, MergedInner::PathGraph, Graph3>;
-
-  /** A node in a graph of path explanations that is formed by disjoint union of the three given graphs. */
-  class PathNode instanceof Merged::PathNode {
-    /** Gets this as a projection on the first given `PathGraph`. */
-    PathNode1 asPathNode1() { result = super.asPathNode1().asPathNode1() }
-
-    /** Gets this as a projection on the second given `PathGraph`. */
-    PathNode2 asPathNode2() { result = super.asPathNode1().asPathNode2() }
-
-    /** Gets this as a projection on the third given `PathGraph`. */
-    PathNode3 asPathNode3() { result = super.asPathNode2() }
-
-    /** Gets a textual representation of this element. */
-    string toString() { result = super.toString() }
-
-    /**
-     * Holds if this element is at the specified location.
-     * The location spans column `startcolumn` of line `startline` to
-     * column `endcolumn` of line `endline` in file `filepath`.
-     * For more information, see
-     * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
-     */
-    predicate hasLocationInfo(
-      string filepath, int startline, int startcolumn, int endline, int endcolumn
-    ) {
-      super.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
-    }
-
-    /** Gets the underlying `Node`. */
-    Node getNode() { result = super.getNode() }
-  }
-
-  /**
-   * Provides the query predicates needed to include a graph in a path-problem query.
-   */
-  module PathGraph = Merged::PathGraph;
-}

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowDispatch.qll

@@ -79,13 +79,3 @@ class ArgumentPosition extends int {
 /** Holds if arguments at position `apos` match parameters at position `ppos`. */
 pragma[inline]
 predicate parameterMatch(ParameterPosition ppos, ArgumentPosition apos) { ppos = apos }
-
-/**
- * Holds if flow from `call`'s argument `arg` to parameter `p` is permissible.
- *
- * This is a temporary hook to support technical debt in the Go language; do not use.
- */
-pragma[inline]
-predicate golangSpecificParamArgFilter(DataFlowCall call, ParameterNode p, ArgumentNode arg) {
-  any()
-}

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl1.qll

@@ -1,5 +1,5 @@
 /**
- * DEPRECATED: Use `Global` and `GlobalWithState` instead.
+ * DEPRECATED: Use `Make` and `MakeWithState` instead.
  *
  * Provides a `Configuration` class backwards-compatible interface to the data
  * flow library.
@@ -11,7 +11,6 @@ import DataFlowImplSpecific::Public
 private import DataFlowImpl
 import DataFlowImplCommonPublic
 import FlowStateString
-private import codeql.util.Unit
 
 /**
  * A configuration of interprocedural data flow analysis. This defines
@@ -329,6 +328,7 @@ private module Config implements FullStateConfigSig {
 }
 
 private import Impl<Config> as I
+import I
 
 /**
  * A `Node` augmented with a call context (except for sinks), an access path, and a configuration.
@@ -379,8 +379,6 @@ class PathNode instanceof I::PathNode {
   final predicate isSinkGroup(string group) { super.isSinkGroup(group) }
 }
 
-module PathGraph = I::PathGraph;
-
 private predicate hasFlow(Node source, Node sink, Configuration config) {
   exists(PathNode source0, PathNode sink0 |
     hasFlowPath(source0, sink0, config) and
@@ -390,7 +388,7 @@ private predicate hasFlow(Node source, Node sink, Configuration config) {
 }
 
 private predicate hasFlowPath(PathNode source, PathNode sink, Configuration config) {
-  I::flowPath(source, sink) and source.getConfiguration() = config
+  hasFlowPath(source, sink) and source.getConfiguration() = config
 }
 
 private predicate hasFlowTo(Node sink, Configuration config) { hasFlow(_, sink, config) }

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll

@@ -1,5 +1,5 @@
 /**
- * DEPRECATED: Use `Global` and `GlobalWithState` instead.
+ * DEPRECATED: Use `Make` and `MakeWithState` instead.
  *
  * Provides a `Configuration` class backwards-compatible interface to the data
  * flow library.
@@ -11,7 +11,6 @@ import DataFlowImplSpecific::Public
 private import DataFlowImpl
 import DataFlowImplCommonPublic
 import FlowStateString
-private import codeql.util.Unit
 
 /**
  * A configuration of interprocedural data flow analysis. This defines
@@ -329,6 +328,7 @@ private module Config implements FullStateConfigSig {
 }
 
 private import Impl<Config> as I
+import I
 
 /**
  * A `Node` augmented with a call context (except for sinks), an access path, and a configuration.
@@ -379,8 +379,6 @@ class PathNode instanceof I::PathNode {
   final predicate isSinkGroup(string group) { super.isSinkGroup(group) }
 }
 
-module PathGraph = I::PathGraph;
-
 private predicate hasFlow(Node source, Node sink, Configuration config) {
   exists(PathNode source0, PathNode sink0 |
     hasFlowPath(source0, sink0, config) and
@@ -390,7 +388,7 @@ private predicate hasFlow(Node source, Node sink, Configuration config) {
 }
 
 private predicate hasFlowPath(PathNode source, PathNode sink, Configuration config) {
-  I::flowPath(source, sink) and source.getConfiguration() = config
+  hasFlowPath(source, sink) and source.getConfiguration() = config
 }
 
 private predicate hasFlowTo(Node sink, Configuration config) { hasFlow(_, sink, config) }

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll

@@ -1,5 +1,5 @@
 /**
- * DEPRECATED: Use `Global` and `GlobalWithState` instead.
+ * DEPRECATED: Use `Make` and `MakeWithState` instead.
  *
  * Provides a `Configuration` class backwards-compatible interface to the data
  * flow library.
@@ -11,7 +11,6 @@ import DataFlowImplSpecific::Public
 private import DataFlowImpl
 import DataFlowImplCommonPublic
 import FlowStateString
-private import codeql.util.Unit
 
 /**
  * A configuration of interprocedural data flow analysis. This defines
@@ -329,6 +328,7 @@ private module Config implements FullStateConfigSig {
 }
 
 private import Impl<Config> as I
+import I
 
 /**
  * A `Node` augmented with a call context (except for sinks), an access path, and a configuration.
@@ -379,8 +379,6 @@ class PathNode instanceof I::PathNode {
   final predicate isSinkGroup(string group) { super.isSinkGroup(group) }
 }
 
-module PathGraph = I::PathGraph;
-
 private predicate hasFlow(Node source, Node sink, Configuration config) {
   exists(PathNode source0, PathNode sink0 |
     hasFlowPath(source0, sink0, config) and
@@ -390,7 +388,7 @@ private predicate hasFlow(Node source, Node sink, Configuration config) {
 }
 
 private predicate hasFlowPath(PathNode source, PathNode sink, Configuration config) {
-  I::flowPath(source, sink) and source.getConfiguration() = config
+  hasFlowPath(source, sink) and source.getConfiguration() = config
 }
 
 private predicate hasFlowTo(Node sink, Configuration config) { hasFlow(_, sink, config) }

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll

@@ -1,5 +1,5 @@
 /**
- * DEPRECATED: Use `Global` and `GlobalWithState` instead.
+ * DEPRECATED: Use `Make` and `MakeWithState` instead.
  *
  * Provides a `Configuration` class backwards-compatible interface to the data
  * flow library.
@@ -11,7 +11,6 @@ import DataFlowImplSpecific::Public
 private import DataFlowImpl
 import DataFlowImplCommonPublic
 import FlowStateString
-private import codeql.util.Unit
 
 /**
  * A configuration of interprocedural data flow analysis. This defines
@@ -329,6 +328,7 @@ private module Config implements FullStateConfigSig {
 }
 
 private import Impl<Config> as I
+import I
 
 /**
  * A `Node` augmented with a call context (except for sinks), an access path, and a configuration.
@@ -379,8 +379,6 @@ class PathNode instanceof I::PathNode {
   final predicate isSinkGroup(string group) { super.isSinkGroup(group) }
 }
 
-module PathGraph = I::PathGraph;
-
 private predicate hasFlow(Node source, Node sink, Configuration config) {
   exists(PathNode source0, PathNode sink0 |
     hasFlowPath(source0, sink0, config) and
@@ -390,7 +388,7 @@ private predicate hasFlow(Node source, Node sink, Configuration config) {
 }
 
 private predicate hasFlowPath(PathNode source, PathNode sink, Configuration config) {
-  I::flowPath(source, sink) and source.getConfiguration() = config
+  hasFlowPath(source, sink) and source.getConfiguration() = config
 }
 
 private predicate hasFlowTo(Node sink, Configuration config) { hasFlow(_, sink, config) }

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplCommon.qll

@@ -140,8 +140,10 @@ private module LambdaFlow {
   }
 
   pragma[nomagic]
-  private TReturnPositionSimple viableReturnPosLambda(DataFlowCall call, ReturnKind kind) {
-    result = TReturnPositionSimple0(viableCallableLambda(call, _), kind)
+  private TReturnPositionSimple viableReturnPosLambda(
+    DataFlowCall call, DataFlowCallOption lastCall, ReturnKind kind
+  ) {
+    result = TReturnPositionSimple0(viableCallableLambda(call, lastCall), kind)
   }
 
   private predicate viableReturnPosOutNonLambda(
@@ -153,12 +155,11 @@ private module LambdaFlow {
     )
   }
 
-  pragma[nomagic]
   private predicate viableReturnPosOutLambda(
-    DataFlowCall call, TReturnPositionSimple pos, OutNode out
+    DataFlowCall call, DataFlowCallOption lastCall, TReturnPositionSimple pos, OutNode out
   ) {
     exists(ReturnKind kind |
-      pos = viableReturnPosLambda(call, kind) and
+      pos = viableReturnPosLambda(call, lastCall, kind) and
       out = getAnOutNode(call, kind)
     )
   }
@@ -187,7 +188,6 @@ private module LambdaFlow {
     else any()
   }
 
-  pragma[assume_small_delta]
   pragma[nomagic]
   predicate revLambdaFlow0(
     DataFlowCall lambdaCall, LambdaCallKind kind, Node node, DataFlowType t, boolean toReturn,
@@ -274,7 +274,6 @@ private module LambdaFlow {
     )
   }
 
-  pragma[assume_small_delta]
   pragma[nomagic]
   predicate revLambdaFlowOut(
     DataFlowCall lambdaCall, LambdaCallKind kind, TReturnPositionSimple pos, DataFlowType t,
@@ -286,7 +285,7 @@ private module LambdaFlow {
       or
       // non-linear recursion
       revLambdaFlowOutLambdaCall(lambdaCall, kind, out, t, toJump, call, lastCall) and
-      viableReturnPosOutLambda(call, pos, out)
+      viableReturnPosOutLambda(call, _, pos, out)
     )
   }
 
@@ -425,8 +424,7 @@ private module Cached {
     exists(ParameterPosition ppos |
       viableParam(call, ppos, p) and
       argumentPositionMatch(call, arg, ppos) and
-      compatibleTypes(getNodeDataFlowType(arg), getNodeDataFlowType(p)) and
-      golangSpecificParamArgFilter(call, p, arg)
+      compatibleTypes(getNodeDataFlowType(arg), getNodeDataFlowType(p))
     )
   }
 
@@ -815,15 +813,7 @@ private module Cached {
     )
   }
 
-  /**
-   * Holds if data can flow from `node1` to `node2` via a direct assignment to
-   * `c`.
-   *
-   * This includes reverse steps through reads when the result of the read has
-   * been stored into, in order to handle cases like `x.f1.f2 = y`.
-   */
-  cached
-  predicate store(
+  private predicate store(
     Node node1, Content c, Node node2, DataFlowType contentType, DataFlowType containerType
   ) {
     exists(ContentSet cs |
@@ -831,6 +821,18 @@ private module Cached {
     )
   }
 
+  /**
+   * Holds if data can flow from `node1` to `node2` via a direct assignment to
+   * `f`.
+   *
+   * This includes reverse steps through reads when the result of the read has
+   * been stored into, in order to handle cases like `x.f1.f2 = y`.
+   */
+  cached
+  predicate store(Node node1, TypedContent tc, Node node2, DataFlowType contentType) {
+    store(node1, tc.getContent(), node2, contentType, tc.getContainerType())
+  }
+
   /**
    * Holds if data can flow from `fromNode` to `toNode` because they are the post-update
    * nodes of some function output and input respectively, where the output and input
@@ -928,15 +930,36 @@ private module Cached {
     TReturnCtxNoFlowThrough() or
     TReturnCtxMaybeFlowThrough(ReturnPosition pos)
 
+  cached
+  newtype TTypedContentApprox =
+    MkTypedContentApprox(ContentApprox c, DataFlowType t) {
+      exists(Content cont |
+        c = getContentApprox(cont) and
+        store(_, cont, _, _, t)
+      )
+    }
+
+  cached
+  newtype TTypedContent = MkTypedContent(Content c, DataFlowType t) { store(_, c, _, _, t) }
+
+  cached
+  TypedContent getATypedContent(TypedContentApprox c) {
+    exists(ContentApprox cls, DataFlowType t, Content cont |
+      c = MkTypedContentApprox(cls, pragma[only_bind_into](t)) and
+      result = MkTypedContent(cont, pragma[only_bind_into](t)) and
+      cls = getContentApprox(cont)
+    )
+  }
+
   cached
   newtype TAccessPathFront =
-    TFrontNil() or
-    TFrontHead(Content c)
+    TFrontNil(DataFlowType t) or
+    TFrontHead(TypedContent tc)
 
   cached
   newtype TApproxAccessPathFront =
-    TApproxFrontNil() or
-    TApproxFrontHead(ContentApprox c)
+    TApproxFrontNil(DataFlowType t) or
+    TApproxFrontHead(TypedContentApprox tc)
 
   cached
   newtype TAccessPathFrontOption =
@@ -961,16 +984,8 @@ predicate recordDataFlowCallSite(DataFlowCall call, DataFlowCallable callable) {
 /**
  * A `Node` at which a cast can occur such that the type should be checked.
  */
-class CastingNode instanceof Node {
+class CastingNode extends Node {
   CastingNode() { castingNode(this) }
-
-  string toString() { result = super.toString() }
-
-  predicate hasLocationInfo(
-    string filepath, int startline, int startcolumn, int endline, int endcolumn
-  ) {
-    super.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
-  }
 }
 
 private predicate readStepWithTypes(
@@ -1118,17 +1133,9 @@ LocalCallContext getLocalCallContext(CallContext ctx, DataFlowCallable callable)
  * The value of a parameter at function entry, viewed as a node in a data
  * flow graph.
  */
-class ParamNode instanceof Node {
+class ParamNode extends Node {
   ParamNode() { parameterNode(this, _, _) }
 
-  string toString() { result = super.toString() }
-
-  predicate hasLocationInfo(
-    string filepath, int startline, int startcolumn, int endline, int endcolumn
-  ) {
-    super.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
-  }
-
   /**
    * Holds if this node is the parameter of callable `c` at the specified
    * position.
@@ -1137,17 +1144,9 @@ class ParamNode instanceof Node {
 }
 
 /** A data-flow node that represents a call argument. */
-class ArgNode instanceof Node {
+class ArgNode extends Node {
   ArgNode() { argumentNode(this, _, _) }
 
-  string toString() { result = super.toString() }
-
-  predicate hasLocationInfo(
-    string filepath, int startline, int startcolumn, int endline, int endcolumn
-  ) {
-    super.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
-  }
-
   /** Holds if this argument occurs at the given position in the given call. */
   final predicate argumentOf(DataFlowCall call, ArgumentPosition pos) {
     argumentNode(this, call, pos)
@@ -1158,17 +1157,9 @@ class ArgNode instanceof Node {
  * A node from which flow can return to the caller. This is either a regular
  * `ReturnNode` or a `PostUpdateNode` corresponding to the value of a parameter.
  */
-class ReturnNodeExt instanceof Node {
+class ReturnNodeExt extends Node {
   ReturnNodeExt() { returnNodeExt(this, _) }
 
-  string toString() { result = super.toString() }
-
-  predicate hasLocationInfo(
-    string filepath, int startline, int startcolumn, int endline, int endcolumn
-  ) {
-    super.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
-  }
-
   /** Gets the kind of this returned value. */
   ReturnKindExt getKind() { returnNodeExt(this, result) }
 }
@@ -1177,16 +1168,8 @@ class ReturnNodeExt instanceof Node {
  * A node to which data can flow from a call. Either an ordinary out node
  * or a post-update node associated with a call argument.
  */
-class OutNodeExt instanceof Node {
+class OutNodeExt extends Node {
   OutNodeExt() { outNodeExt(this) }
-
-  string toString() { result = super.toString() }
-
-  predicate hasLocationInfo(
-    string filepath, int startline, int startcolumn, int endline, int endcolumn
-  ) {
-    super.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
-  }
 }
 
 /**
@@ -1402,37 +1385,67 @@ class ReturnCtx extends TReturnCtx {
   }
 }
 
+/** An approximated `Content` tagged with the type of a containing object. */
+class TypedContentApprox extends MkTypedContentApprox {
+  private ContentApprox c;
+  private DataFlowType t;
+
+  TypedContentApprox() { this = MkTypedContentApprox(c, t) }
+
+  /** Gets a typed content approximated by this value. */
+  TypedContent getATypedContent() { result = getATypedContent(this) }
+
+  /** Gets the content. */
+  ContentApprox getContent() { result = c }
+
+  /** Gets the container type. */
+  DataFlowType getContainerType() { result = t }
+
+  /** Gets a textual representation of this approximated content. */
+  string toString() { result = c.toString() }
+}
+
 /**
  * The front of an approximated access path. This is either a head or a nil.
  */
 abstract class ApproxAccessPathFront extends TApproxAccessPathFront {
   abstract string toString();
 
+  abstract DataFlowType getType();
+
   abstract boolean toBoolNonEmpty();
 
-  ContentApprox getHead() { this = TApproxFrontHead(result) }
+  TypedContentApprox getHead() { this = TApproxFrontHead(result) }
 
   pragma[nomagic]
-  Content getAHead() {
-    exists(ContentApprox cont |
+  TypedContent getAHead() {
+    exists(TypedContentApprox cont |
       this = TApproxFrontHead(cont) and
-      cont = getContentApprox(result)
+      result = cont.getATypedContent()
     )
   }
 }
 
 class ApproxAccessPathFrontNil extends ApproxAccessPathFront, TApproxFrontNil {
-  override string toString() { result = "nil" }
+  private DataFlowType t;
+
+  ApproxAccessPathFrontNil() { this = TApproxFrontNil(t) }
+
+  override string toString() { result = ppReprType(t) }
+
+  override DataFlowType getType() { result = t }
 
   override boolean toBoolNonEmpty() { result = false }
 }
 
 class ApproxAccessPathFrontHead extends ApproxAccessPathFront, TApproxFrontHead {
-  private ContentApprox c;
+  private TypedContentApprox tc;
 
-  ApproxAccessPathFrontHead() { this = TApproxFrontHead(c) }
+  ApproxAccessPathFrontHead() { this = TApproxFrontHead(tc) }
 
-  override string toString() { result = c.toString() }
+  override string toString() { result = tc.toString() }
+
+  override DataFlowType getType() { result = tc.getContainerType() }
 
   override boolean toBoolNonEmpty() { result = true }
 }
@@ -1446,31 +1459,65 @@ class ApproxAccessPathFrontOption extends TApproxAccessPathFrontOption {
   }
 }
 
+/** A `Content` tagged with the type of a containing object. */
+class TypedContent extends MkTypedContent {
+  private Content c;
+  private DataFlowType t;
+
+  TypedContent() { this = MkTypedContent(c, t) }
+
+  /** Gets the content. */
+  Content getContent() { result = c }
+
+  /** Gets the container type. */
+  DataFlowType getContainerType() { result = t }
+
+  /** Gets a textual representation of this content. */
+  string toString() { result = c.toString() }
+
+  /**
+   * Holds if access paths with this `TypedContent` at their head always should
+   * be tracked at high precision. This disables adaptive access path precision
+   * for such access paths.
+   */
+  predicate forceHighPrecision() { forceHighPrecision(c) }
+}
+
 /**
  * The front of an access path. This is either a head or a nil.
  */
 abstract class AccessPathFront extends TAccessPathFront {
   abstract string toString();
 
+  abstract DataFlowType getType();
+
   abstract ApproxAccessPathFront toApprox();
 
-  Content getHead() { this = TFrontHead(result) }
+  TypedContent getHead() { this = TFrontHead(result) }
 }
 
 class AccessPathFrontNil extends AccessPathFront, TFrontNil {
-  override string toString() { result = "nil" }
+  private DataFlowType t;
 
-  override ApproxAccessPathFront toApprox() { result = TApproxFrontNil() }
+  AccessPathFrontNil() { this = TFrontNil(t) }
+
+  override string toString() { result = ppReprType(t) }
+
+  override DataFlowType getType() { result = t }
+
+  override ApproxAccessPathFront toApprox() { result = TApproxFrontNil(t) }
 }
 
 class AccessPathFrontHead extends AccessPathFront, TFrontHead {
-  private Content c;
+  private TypedContent tc;
 
-  AccessPathFrontHead() { this = TFrontHead(c) }
+  AccessPathFrontHead() { this = TFrontHead(tc) }
 
-  override string toString() { result = c.toString() }
+  override string toString() { result = tc.toString() }
 
-  override ApproxAccessPathFront toApprox() { result.getAHead() = c }
+  override DataFlowType getType() { result = tc.getContainerType() }
+
+  override ApproxAccessPathFront toApprox() { result.getAHead() = tc }
 }
 
 /** An optional access path front. */

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplLocal.qll

@@ -1,5 +1,5 @@
 /**
- * DEPRECATED: Use `Global` and `GlobalWithState` instead.
+ * DEPRECATED: Use `Make` and `MakeWithState` instead.
  *
  * Provides a `Configuration` class backwards-compatible interface to the data
  * flow library.
@@ -11,7 +11,6 @@ import DataFlowImplSpecific::Public
 private import DataFlowImpl
 import DataFlowImplCommonPublic
 import FlowStateString
-private import codeql.util.Unit
 
 /**
  * A configuration of interprocedural data flow analysis. This defines
@@ -329,6 +328,7 @@ private module Config implements FullStateConfigSig {
 }
 
 private import Impl<Config> as I
+import I
 
 /**
  * A `Node` augmented with a call context (except for sinks), an access path, and a configuration.
@@ -379,8 +379,6 @@ class PathNode instanceof I::PathNode {
   final predicate isSinkGroup(string group) { super.isSinkGroup(group) }
 }
 
-module PathGraph = I::PathGraph;
-
 private predicate hasFlow(Node source, Node sink, Configuration config) {
   exists(PathNode source0, PathNode sink0 |
     hasFlowPath(source0, sink0, config) and
@@ -390,7 +388,7 @@ private predicate hasFlow(Node source, Node sink, Configuration config) {
 }
 
 private predicate hasFlowPath(PathNode source, PathNode sink, Configuration config) {
-  I::flowPath(source, sink) and source.getConfiguration() = config
+  hasFlowPath(source, sink) and source.getConfiguration() = config
 }
 
 private predicate hasFlowTo(Node sink, Configuration config) { hasFlow(_, sink, config) }

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowPrivate.qll

@@ -3,7 +3,6 @@ private import DataFlowUtil
 private import DataFlowDispatch
 private import FlowVar
 private import DataFlowImplConsistency
-private import codeql.util.Unit
 
 /** Gets the callable in which this node occurs. */
 DataFlowCallable nodeGetEnclosingCallable(Node n) { result = n.getEnclosingCallable() }
@@ -159,7 +158,7 @@ predicate storeStep(Node node1, Content f, PostUpdateNode node2) {
     // `PostUpdateNode`, which means it must be an `ObjectInitializerNode`.
     node2.asExpr() = aggr and
     f.(FieldContent).getField() = field and
-    aggr.getAFieldExpr(field) = node1.asExpr()
+    aggr.getFieldExpr(field) = node1.asExpr()
   )
   or
   exists(FieldAccess fa |
@@ -265,6 +264,15 @@ int accessPathLimit() { result = 5 }
  */
 predicate forceHighPrecision(Content c) { none() }
 
+/** The unit type. */
+private newtype TUnit = TMkUnit()
+
+/** The trivial type with a single element. */
+class Unit extends TUnit {
+  /** Gets a textual representation of this element. */
+  string toString() { result = "unit" }
+}
+
 /** Holds if `n` should be hidden from path explanations. */
 predicate nodeIsHidden(Node n) { none() }
 

cpp/ql/lib/semmle/code/cpp/dataflow/internal/tainttracking1/TaintTracking.qll

@@ -33,9 +33,9 @@ private module AddTaintDefaults<DataFlowInternal::FullStateConfigSig Config> imp
 }
 
 /**
- * Constructs a global taint tracking computation.
+ * Constructs a standard taint tracking computation.
  */
-module Global<DataFlow::ConfigSig Config> implements DataFlow::GlobalFlowSig {
+module Make<DataFlow::ConfigSig Config> implements DataFlow::DataFlowSig {
   private module Config0 implements DataFlowInternal::FullStateConfigSig {
     import DataFlowInternal::DefaultState<Config>
     import Config
@@ -48,15 +48,10 @@ module Global<DataFlow::ConfigSig Config> implements DataFlow::GlobalFlowSig {
   import DataFlowInternal::Impl<C>
 }
 
-/** DEPRECATED: Use `Global` instead. */
-deprecated module Make<DataFlow::ConfigSig Config> implements DataFlow::GlobalFlowSig {
-  import Global<Config>
-}
-
 /**
- * Constructs a global taint tracking computation using flow state.
+ * Constructs a taint tracking computation using flow state.
  */
-module GlobalWithState<DataFlow::StateConfigSig Config> implements DataFlow::GlobalFlowSig {
+module MakeWithState<DataFlow::StateConfigSig Config> implements DataFlow::DataFlowSig {
   private module Config0 implements DataFlowInternal::FullStateConfigSig {
     import Config
   }
@@ -67,8 +62,3 @@ module GlobalWithState<DataFlow::StateConfigSig Config> implements DataFlow::Glo
 
   import DataFlowInternal::Impl<C>
 }
-
-/** DEPRECATED: Use `GlobalWithState` instead. */
-deprecated module MakeWithState<DataFlow::StateConfigSig Config> implements DataFlow::GlobalFlowSig {
-  import GlobalWithState<Config>
-}

cpp/ql/lib/semmle/code/cpp/exprs/Lambda.qll

@@ -147,7 +147,7 @@ class LambdaCapture extends Locatable, @lambdacapture {
    */
   Expr getInitializer() {
     exists(LambdaExpression lambda | this = lambda.getCapture(_) |
-      result = lambda.getInitializer().getAFieldExpr(this.getField())
+      result = lambda.getInitializer().getFieldExpr(this.getField())
     )
   }
 }

cpp/ql/lib/semmle/code/cpp/exprs/Literal.qll

@@ -187,44 +187,12 @@ class ClassAggregateLiteral extends AggregateLiteral {
   override string getAPrimaryQlClass() { result = "ClassAggregateLiteral" }
 
   /**
-   * Gets an expression within the aggregate literal that is used to initialize
-   * field `field`, if present.
-   *
-   * This predicate may have multiple results since a field can be initialized
-   * multiple times in the same initializer.
-   */
-  Expr getAFieldExpr(Field field) { result = this.getFieldExpr(field, _) }
-
-  /**
-   * DEPRECATED: Use `getAFieldExpr` instead.
-   *
    * Gets the expression within the aggregate literal that is used to initialize
    * field `field`, if present.
-   *
-   * This predicate may have multiple results since a field can be initialized
-   * multiple times in the same initializer.
    */
-  deprecated Expr getFieldExpr(Field field) { result = this.getFieldExpr(field, _) }
-
-  /**
-   * Gets the expression within the aggregate literal that is used to initialize
-   * field `field`, if present. The expression is the `position`'th entry in the
-   * aggregate literal.
-   *
-   * For example, if `aggr` represents the initialization literal `{.x = 123, .y = 456 .x = 789}` in
-   * ```cpp
-   * struct Foo { int x; int y; };
-   * struct Foo foo = {.x = 123, .y = 456 .x = 789};
-   * ```
-   * then:
-   * - `aggr.getFieldExpr(x, 0)` gives `123`.
-   * - `aggr.getFieldExpr(y, 1)` gives `456`.
-   * - `aggr.getFieldExpr(x, 2)` gives `789`.
-   */
-  Expr getFieldExpr(Field field, int position) {
+  Expr getFieldExpr(Field field) {
     field = classType.getAField() and
-    aggregate_field_init(underlyingElement(this), unresolveElement(result), unresolveElement(field),
-      position)
+    aggregate_field_init(underlyingElement(this), unresolveElement(result), unresolveElement(field))
   }
 
   /**
@@ -238,7 +206,7 @@ class ClassAggregateLiteral extends AggregateLiteral {
     (
       // If the field has an explicit initializer expression, then the field is
       // initialized.
-      exists(this.getAFieldExpr(field))
+      exists(this.getFieldExpr(field))
       or
       // If the type is not a union, all fields without initializers are value
       // initialized.
@@ -262,7 +230,7 @@ class ClassAggregateLiteral extends AggregateLiteral {
   pragma[inline]
   predicate isValueInitialized(Field field) {
     this.isInitialized(field) and
-    not exists(this.getAFieldExpr(field))
+    not exists(this.getFieldExpr(field))
   }
 }
 
@@ -292,41 +260,11 @@ class ArrayOrVectorAggregateLiteral extends AggregateLiteral {
   Type getElementType() { none() }
 
   /**
-   * Gets an expression within the aggregate literal that is used to initialize
-   * element `elementIndex`, if present.
-   *
-   * This predicate may have multiple results since an element can be initialized
-   * multiple times in the same initializer.
-   */
-  Expr getAnElementExpr(int elementIndex) { result = this.getElementExpr(elementIndex, _) }
-
-  /**
-   * DEPRECATED: Use `getAnElementExpr` instead.
-   *
    * Gets the expression within the aggregate literal that is used to initialize
    * element `elementIndex`, if present.
-   *
-   * This predicate may have multiple results since an element can be initialized
-   * multiple times in the same initializer.
    */
-  deprecated Expr getElementExpr(int elementIndex) { result = this.getElementExpr(elementIndex, _) }
-
-  /**
-   * Gets the expression within the aggregate literal that is used to initialize
-   * element `elementIndex`, if present. The expression is the `position`'th entry
-   * in the aggregate literal.
-   *
-   * For example, if `a` represents the initialization literal `{[0] = 123, [1] = 456, [0] = 789 }` in
-   * ```cpp
-   * int x[2] = {[0] = 123, [1] = 456, [0] = 789 };
-   * ```
-   * then:
-   * - `a.getElementExpr(0, 0)` gives `123`.
-   * - `a.getElementExpr(1, 1)` gives `456`.
-   * - `a.getElementExpr(0, 2)` gives `789`.
-   */
-  Expr getElementExpr(int elementIndex, int position) {
-    aggregate_array_init(underlyingElement(this), unresolveElement(result), elementIndex, position)
+  Expr getElementExpr(int elementIndex) {
+    aggregate_array_init(underlyingElement(this), unresolveElement(result), elementIndex)
   }
 
   /**
@@ -351,7 +289,7 @@ class ArrayOrVectorAggregateLiteral extends AggregateLiteral {
   bindingset[elementIndex]
   predicate isValueInitialized(int elementIndex) {
     this.isInitialized(elementIndex) and
-    not exists(this.getAnElementExpr(elementIndex))
+    not exists(this.getElementExpr(elementIndex))
   }
 }
 

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlow.qll

@@ -2,7 +2,7 @@
  * Provides an implementation of global (interprocedural) data flow. This file
  * re-exports the local (intraprocedural) data flow analysis from
  * `DataFlowImplSpecific::Public` and adds a global analysis, mainly exposed
- * through the `Global` and `GlobalWithState` modules.
+ * through the `Make` and `MakeWithState` modules.
  */
 
 private import DataFlowImplCommon
@@ -73,10 +73,10 @@ signature module ConfigSig {
    */
   default FlowFeature getAFeature() { none() }
 
-  /** Holds if sources should be grouped in the result of `flowPath`. */
+  /** Holds if sources should be grouped in the result of `hasFlowPath`. */
   default predicate sourceGrouping(Node source, string sourceGroup) { none() }
 
-  /** Holds if sinks should be grouped in the result of `flowPath`. */
+  /** Holds if sinks should be grouped in the result of `hasFlowPath`. */
   default predicate sinkGrouping(Node sink, string sinkGroup) { none() }
 
   /**
@@ -166,10 +166,10 @@ signature module StateConfigSig {
    */
   default FlowFeature getAFeature() { none() }
 
-  /** Holds if sources should be grouped in the result of `flowPath`. */
+  /** Holds if sources should be grouped in the result of `hasFlowPath`. */
   default predicate sourceGrouping(Node source, string sourceGroup) { none() }
 
-  /** Holds if sinks should be grouped in the result of `flowPath`. */
+  /** Holds if sinks should be grouped in the result of `hasFlowPath`. */
   default predicate sinkGrouping(Node sink, string sinkGroup) { none() }
 
   /**
@@ -182,15 +182,15 @@ signature module StateConfigSig {
 }
 
 /**
- * Gets the exploration limit for `partialFlow` and `partialFlowRev`
+ * Gets the exploration limit for `hasPartialFlow` and `hasPartialFlowRev`
  * measured in approximate number of interprocedural steps.
  */
 signature int explorationLimitSig();
 
 /**
- * The output of a global data flow computation.
+ * The output of a data flow computation.
  */
-signature module GlobalFlowSig {
+signature module DataFlowSig {
   /**
    * A `Node` augmented with a call context (except for sinks) and an access path.
    * Only those `PathNode`s that are reachable from a source, and which can reach a sink, are generated.
@@ -203,28 +203,28 @@ signature module GlobalFlowSig {
    * The corresponding paths are generated from the end-points and the graph
    * included in the module `PathGraph`.
    */
-  predicate flowPath(PathNode source, PathNode sink);
+  predicate hasFlowPath(PathNode source, PathNode sink);
 
   /**
    * Holds if data can flow from `source` to `sink`.
    */
-  predicate flow(Node source, Node sink);
+  predicate hasFlow(Node source, Node sink);
 
   /**
    * Holds if data can flow from some source to `sink`.
    */
-  predicate flowTo(Node sink);
+  predicate hasFlowTo(Node sink);
 
   /**
    * Holds if data can flow from some source to `sink`.
    */
-  predicate flowToExpr(DataFlowExpr sink);
+  predicate hasFlowToExpr(DataFlowExpr sink);
 }
 
 /**
- * Constructs a global data flow computation.
+ * Constructs a standard data flow computation.
  */
-module Global<ConfigSig Config> implements GlobalFlowSig {
+module Make<ConfigSig Config> implements DataFlowSig {
   private module C implements FullStateConfigSig {
     import DefaultState<Config>
     import Config
@@ -233,15 +233,10 @@ module Global<ConfigSig Config> implements GlobalFlowSig {
   import Impl<C>
 }
 
-/** DEPRECATED: Use `Global` instead. */
-deprecated module Make<ConfigSig Config> implements GlobalFlowSig {
-  import Global<Config>
-}
-
 /**
- * Constructs a global data flow computation using flow state.
+ * Constructs a data flow computation using flow state.
  */
-module GlobalWithState<StateConfigSig Config> implements GlobalFlowSig {
+module MakeWithState<StateConfigSig Config> implements DataFlowSig {
   private module C implements FullStateConfigSig {
     import Config
   }
@@ -249,11 +244,6 @@ module GlobalWithState<StateConfigSig Config> implements GlobalFlowSig {
   import Impl<C>
 }
 
-/** DEPRECATED: Use `GlobalWithState` instead. */
-deprecated module MakeWithState<StateConfigSig Config> implements GlobalFlowSig {
-  import GlobalWithState<Config>
-}
-
 signature class PathNodeSig {
   /** Gets a textual representation of this element. */
   string toString();
@@ -361,52 +351,3 @@ module MergePathGraph<
     }
   }
 }
-
-/**
- * Constructs a `PathGraph` from three `PathGraph`s by disjoint union.
- */
-module MergePathGraph3<
-  PathNodeSig PathNode1, PathNodeSig PathNode2, PathNodeSig PathNode3,
-  PathGraphSig<PathNode1> Graph1, PathGraphSig<PathNode2> Graph2, PathGraphSig<PathNode3> Graph3>
-{
-  private module MergedInner = MergePathGraph<PathNode1, PathNode2, Graph1, Graph2>;
-
-  private module Merged =
-    MergePathGraph<MergedInner::PathNode, PathNode3, MergedInner::PathGraph, Graph3>;
-
-  /** A node in a graph of path explanations that is formed by disjoint union of the three given graphs. */
-  class PathNode instanceof Merged::PathNode {
-    /** Gets this as a projection on the first given `PathGraph`. */
-    PathNode1 asPathNode1() { result = super.asPathNode1().asPathNode1() }
-
-    /** Gets this as a projection on the second given `PathGraph`. */
-    PathNode2 asPathNode2() { result = super.asPathNode1().asPathNode2() }
-
-    /** Gets this as a projection on the third given `PathGraph`. */
-    PathNode3 asPathNode3() { result = super.asPathNode2() }
-
-    /** Gets a textual representation of this element. */
-    string toString() { result = super.toString() }
-
-    /**
-     * Holds if this element is at the specified location.
-     * The location spans column `startcolumn` of line `startline` to
-     * column `endcolumn` of line `endline` in file `filepath`.
-     * For more information, see
-     * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
-     */
-    predicate hasLocationInfo(
-      string filepath, int startline, int startcolumn, int endline, int endcolumn
-    ) {
-      super.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
-    }
-
-    /** Gets the underlying `Node`. */
-    Node getNode() { result = super.getNode() }
-  }
-
-  /**
-   * Provides the query predicates needed to include a graph in a path-problem query.
-   */
-  module PathGraph = Merged::PathGraph;
-}

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowDispatch.qll

@@ -271,13 +271,3 @@ Function viableImplInCallContext(CallInstruction call, CallInstruction ctx) {
 /** Holds if arguments at position `apos` match parameters at position `ppos`. */
 pragma[inline]
 predicate parameterMatch(ParameterPosition ppos, ArgumentPosition apos) { ppos = apos }
-
-/**
- * Holds if flow from `call`'s argument `arg` to parameter `p` is permissible.
- *
- * This is a temporary hook to support technical debt in the Go language; do not use.
- */
-pragma[inline]
-predicate golangSpecificParamArgFilter(DataFlowCall call, ParameterNode p, ArgumentNode arg) {
-  any()
-}

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl1.qll

@@ -1,5 +1,5 @@
 /**
- * DEPRECATED: Use `Global` and `GlobalWithState` instead.
+ * DEPRECATED: Use `Make` and `MakeWithState` instead.
  *
  * Provides a `Configuration` class backwards-compatible interface to the data
  * flow library.
@@ -11,7 +11,6 @@ import DataFlowImplSpecific::Public
 private import DataFlowImpl
 import DataFlowImplCommonPublic
 import FlowStateString
-private import codeql.util.Unit
 
 /**
  * A configuration of interprocedural data flow analysis. This defines
@@ -329,6 +328,7 @@ private module Config implements FullStateConfigSig {
 }
 
 private import Impl<Config> as I
+import I
 
 /**
  * A `Node` augmented with a call context (except for sinks), an access path, and a configuration.
@@ -379,8 +379,6 @@ class PathNode instanceof I::PathNode {
   final predicate isSinkGroup(string group) { super.isSinkGroup(group) }
 }
 
-module PathGraph = I::PathGraph;
-
 private predicate hasFlow(Node source, Node sink, Configuration config) {
   exists(PathNode source0, PathNode sink0 |
     hasFlowPath(source0, sink0, config) and
@@ -390,7 +388,7 @@ private predicate hasFlow(Node source, Node sink, Configuration config) {
 }
 
 private predicate hasFlowPath(PathNode source, PathNode sink, Configuration config) {
-  I::flowPath(source, sink) and source.getConfiguration() = config
+  hasFlowPath(source, sink) and source.getConfiguration() = config
 }
 
 private predicate hasFlowTo(Node sink, Configuration config) { hasFlow(_, sink, config) }

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll

@@ -1,5 +1,5 @@
 /**
- * DEPRECATED: Use `Global` and `GlobalWithState` instead.
+ * DEPRECATED: Use `Make` and `MakeWithState` instead.
  *
  * Provides a `Configuration` class backwards-compatible interface to the data
  * flow library.
@@ -11,7 +11,6 @@ import DataFlowImplSpecific::Public
 private import DataFlowImpl
 import DataFlowImplCommonPublic
 import FlowStateString
-private import codeql.util.Unit
 
 /**
  * A configuration of interprocedural data flow analysis. This defines
@@ -329,6 +328,7 @@ private module Config implements FullStateConfigSig {
 }
 
 private import Impl<Config> as I
+import I
 
 /**
  * A `Node` augmented with a call context (except for sinks), an access path, and a configuration.
@@ -379,8 +379,6 @@ class PathNode instanceof I::PathNode {
   final predicate isSinkGroup(string group) { super.isSinkGroup(group) }
 }
 
-module PathGraph = I::PathGraph;
-
 private predicate hasFlow(Node source, Node sink, Configuration config) {
   exists(PathNode source0, PathNode sink0 |
     hasFlowPath(source0, sink0, config) and
@@ -390,7 +388,7 @@ private predicate hasFlow(Node source, Node sink, Configuration config) {
 }
 
 private predicate hasFlowPath(PathNode source, PathNode sink, Configuration config) {
-  I::flowPath(source, sink) and source.getConfiguration() = config
+  hasFlowPath(source, sink) and source.getConfiguration() = config
 }
 
 private predicate hasFlowTo(Node sink, Configuration config) { hasFlow(_, sink, config) }

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll

@@ -1,5 +1,5 @@
 /**
- * DEPRECATED: Use `Global` and `GlobalWithState` instead.
+ * DEPRECATED: Use `Make` and `MakeWithState` instead.
  *
  * Provides a `Configuration` class backwards-compatible interface to the data
  * flow library.
@@ -11,7 +11,6 @@ import DataFlowImplSpecific::Public
 private import DataFlowImpl
 import DataFlowImplCommonPublic
 import FlowStateString
-private import codeql.util.Unit
 
 /**
  * A configuration of interprocedural data flow analysis. This defines
@@ -329,6 +328,7 @@ private module Config implements FullStateConfigSig {
 }
 
 private import Impl<Config> as I
+import I
 
 /**
  * A `Node` augmented with a call context (except for sinks), an access path, and a configuration.
@@ -379,8 +379,6 @@ class PathNode instanceof I::PathNode {
   final predicate isSinkGroup(string group) { super.isSinkGroup(group) }
 }
 
-module PathGraph = I::PathGraph;
-
 private predicate hasFlow(Node source, Node sink, Configuration config) {
   exists(PathNode source0, PathNode sink0 |
     hasFlowPath(source0, sink0, config) and
@@ -390,7 +388,7 @@ private predicate hasFlow(Node source, Node sink, Configuration config) {
 }
 
 private predicate hasFlowPath(PathNode source, PathNode sink, Configuration config) {
-  I::flowPath(source, sink) and source.getConfiguration() = config
+  hasFlowPath(source, sink) and source.getConfiguration() = config
 }
 
 private predicate hasFlowTo(Node sink, Configuration config) { hasFlow(_, sink, config) }

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll

@@ -1,5 +1,5 @@
 /**
- * DEPRECATED: Use `Global` and `GlobalWithState` instead.
+ * DEPRECATED: Use `Make` and `MakeWithState` instead.
  *
  * Provides a `Configuration` class backwards-compatible interface to the data
  * flow library.
@@ -11,7 +11,6 @@ import DataFlowImplSpecific::Public
 private import DataFlowImpl
 import DataFlowImplCommonPublic
 import FlowStateString
-private import codeql.util.Unit
 
 /**
  * A configuration of interprocedural data flow analysis. This defines
@@ -329,6 +328,7 @@ private module Config implements FullStateConfigSig {
 }
 
 private import Impl<Config> as I
+import I
 
 /**
  * A `Node` augmented with a call context (except for sinks), an access path, and a configuration.
@@ -379,8 +379,6 @@ class PathNode instanceof I::PathNode {
   final predicate isSinkGroup(string group) { super.isSinkGroup(group) }
 }
 
-module PathGraph = I::PathGraph;
-
 private predicate hasFlow(Node source, Node sink, Configuration config) {
   exists(PathNode source0, PathNode sink0 |
     hasFlowPath(source0, sink0, config) and
@@ -390,7 +388,7 @@ private predicate hasFlow(Node source, Node sink, Configuration config) {
 }
 
 private predicate hasFlowPath(PathNode source, PathNode sink, Configuration config) {
-  I::flowPath(source, sink) and source.getConfiguration() = config
+  hasFlowPath(source, sink) and source.getConfiguration() = config
 }
 
 private predicate hasFlowTo(Node sink, Configuration config) { hasFlow(_, sink, config) }

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplCommon.qll

@@ -140,8 +140,10 @@ private module LambdaFlow {
   }
 
   pragma[nomagic]
-  private TReturnPositionSimple viableReturnPosLambda(DataFlowCall call, ReturnKind kind) {
-    result = TReturnPositionSimple0(viableCallableLambda(call, _), kind)
+  private TReturnPositionSimple viableReturnPosLambda(
+    DataFlowCall call, DataFlowCallOption lastCall, ReturnKind kind
+  ) {
+    result = TReturnPositionSimple0(viableCallableLambda(call, lastCall), kind)
   }
 
   private predicate viableReturnPosOutNonLambda(
@@ -153,12 +155,11 @@ private module LambdaFlow {
     )
   }
 
-  pragma[nomagic]
   private predicate viableReturnPosOutLambda(
-    DataFlowCall call, TReturnPositionSimple pos, OutNode out
+    DataFlowCall call, DataFlowCallOption lastCall, TReturnPositionSimple pos, OutNode out
   ) {
     exists(ReturnKind kind |
-      pos = viableReturnPosLambda(call, kind) and
+      pos = viableReturnPosLambda(call, lastCall, kind) and
       out = getAnOutNode(call, kind)
     )
   }
@@ -187,7 +188,6 @@ private module LambdaFlow {
     else any()
   }
 
-  pragma[assume_small_delta]
   pragma[nomagic]
   predicate revLambdaFlow0(
     DataFlowCall lambdaCall, LambdaCallKind kind, Node node, DataFlowType t, boolean toReturn,
@@ -274,7 +274,6 @@ private module LambdaFlow {
     )
   }
 
-  pragma[assume_small_delta]
   pragma[nomagic]
   predicate revLambdaFlowOut(
     DataFlowCall lambdaCall, LambdaCallKind kind, TReturnPositionSimple pos, DataFlowType t,
@@ -286,7 +285,7 @@ private module LambdaFlow {
       or
       // non-linear recursion
       revLambdaFlowOutLambdaCall(lambdaCall, kind, out, t, toJump, call, lastCall) and
-      viableReturnPosOutLambda(call, pos, out)
+      viableReturnPosOutLambda(call, _, pos, out)
     )
   }
 
@@ -425,8 +424,7 @@ private module Cached {
     exists(ParameterPosition ppos |
       viableParam(call, ppos, p) and
       argumentPositionMatch(call, arg, ppos) and
-      compatibleTypes(getNodeDataFlowType(arg), getNodeDataFlowType(p)) and
-      golangSpecificParamArgFilter(call, p, arg)
+      compatibleTypes(getNodeDataFlowType(arg), getNodeDataFlowType(p))
     )
   }
 
@@ -815,15 +813,7 @@ private module Cached {
     )
   }
 
-  /**
-   * Holds if data can flow from `node1` to `node2` via a direct assignment to
-   * `c`.
-   *
-   * This includes reverse steps through reads when the result of the read has
-   * been stored into, in order to handle cases like `x.f1.f2 = y`.
-   */
-  cached
-  predicate store(
+  private predicate store(
     Node node1, Content c, Node node2, DataFlowType contentType, DataFlowType containerType
   ) {
     exists(ContentSet cs |
@@ -831,6 +821,18 @@ private module Cached {
     )
   }
 
+  /**
+   * Holds if data can flow from `node1` to `node2` via a direct assignment to
+   * `f`.
+   *
+   * This includes reverse steps through reads when the result of the read has
+   * been stored into, in order to handle cases like `x.f1.f2 = y`.
+   */
+  cached
+  predicate store(Node node1, TypedContent tc, Node node2, DataFlowType contentType) {
+    store(node1, tc.getContent(), node2, contentType, tc.getContainerType())
+  }
+
   /**
    * Holds if data can flow from `fromNode` to `toNode` because they are the post-update
    * nodes of some function output and input respectively, where the output and input
@@ -928,15 +930,36 @@ private module Cached {
     TReturnCtxNoFlowThrough() or
     TReturnCtxMaybeFlowThrough(ReturnPosition pos)
 
+  cached
+  newtype TTypedContentApprox =
+    MkTypedContentApprox(ContentApprox c, DataFlowType t) {
+      exists(Content cont |
+        c = getContentApprox(cont) and
+        store(_, cont, _, _, t)
+      )
+    }
+
+  cached
+  newtype TTypedContent = MkTypedContent(Content c, DataFlowType t) { store(_, c, _, _, t) }
+
+  cached
+  TypedContent getATypedContent(TypedContentApprox c) {
+    exists(ContentApprox cls, DataFlowType t, Content cont |
+      c = MkTypedContentApprox(cls, pragma[only_bind_into](t)) and
+      result = MkTypedContent(cont, pragma[only_bind_into](t)) and
+      cls = getContentApprox(cont)
+    )
+  }
+
   cached
   newtype TAccessPathFront =
-    TFrontNil() or
-    TFrontHead(Content c)
+    TFrontNil(DataFlowType t) or
+    TFrontHead(TypedContent tc)
 
   cached
   newtype TApproxAccessPathFront =
-    TApproxFrontNil() or
-    TApproxFrontHead(ContentApprox c)
+    TApproxFrontNil(DataFlowType t) or
+    TApproxFrontHead(TypedContentApprox tc)
 
   cached
   newtype TAccessPathFrontOption =
@@ -961,16 +984,8 @@ predicate recordDataFlowCallSite(DataFlowCall call, DataFlowCallable callable) {
 /**
  * A `Node` at which a cast can occur such that the type should be checked.
  */
-class CastingNode instanceof Node {
+class CastingNode extends Node {
   CastingNode() { castingNode(this) }
-
-  string toString() { result = super.toString() }
-
-  predicate hasLocationInfo(
-    string filepath, int startline, int startcolumn, int endline, int endcolumn
-  ) {
-    super.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
-  }
 }
 
 private predicate readStepWithTypes(
@@ -1118,17 +1133,9 @@ LocalCallContext getLocalCallContext(CallContext ctx, DataFlowCallable callable)
  * The value of a parameter at function entry, viewed as a node in a data
  * flow graph.
  */
-class ParamNode instanceof Node {
+class ParamNode extends Node {
   ParamNode() { parameterNode(this, _, _) }
 
-  string toString() { result = super.toString() }
-
-  predicate hasLocationInfo(
-    string filepath, int startline, int startcolumn, int endline, int endcolumn
-  ) {
-    super.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
-  }
-
   /**
    * Holds if this node is the parameter of callable `c` at the specified
    * position.
@@ -1137,17 +1144,9 @@ class ParamNode instanceof Node {
 }
 
 /** A data-flow node that represents a call argument. */
-class ArgNode instanceof Node {
+class ArgNode extends Node {
   ArgNode() { argumentNode(this, _, _) }
 
-  string toString() { result = super.toString() }
-
-  predicate hasLocationInfo(
-    string filepath, int startline, int startcolumn, int endline, int endcolumn
-  ) {
-    super.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
-  }
-
   /** Holds if this argument occurs at the given position in the given call. */
   final predicate argumentOf(DataFlowCall call, ArgumentPosition pos) {
     argumentNode(this, call, pos)
@@ -1158,17 +1157,9 @@ class ArgNode instanceof Node {
  * A node from which flow can return to the caller. This is either a regular
  * `ReturnNode` or a `PostUpdateNode` corresponding to the value of a parameter.
  */
-class ReturnNodeExt instanceof Node {
+class ReturnNodeExt extends Node {
   ReturnNodeExt() { returnNodeExt(this, _) }
 
-  string toString() { result = super.toString() }
-
-  predicate hasLocationInfo(
-    string filepath, int startline, int startcolumn, int endline, int endcolumn
-  ) {
-    super.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
-  }
-
   /** Gets the kind of this returned value. */
   ReturnKindExt getKind() { returnNodeExt(this, result) }
 }
@@ -1177,16 +1168,8 @@ class ReturnNodeExt instanceof Node {
  * A node to which data can flow from a call. Either an ordinary out node
  * or a post-update node associated with a call argument.
  */
-class OutNodeExt instanceof Node {
+class OutNodeExt extends Node {
   OutNodeExt() { outNodeExt(this) }
-
-  string toString() { result = super.toString() }
-
-  predicate hasLocationInfo(
-    string filepath, int startline, int startcolumn, int endline, int endcolumn
-  ) {
-    super.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
-  }
 }
 
 /**
@@ -1402,37 +1385,67 @@ class ReturnCtx extends TReturnCtx {
   }
 }
 
+/** An approximated `Content` tagged with the type of a containing object. */
+class TypedContentApprox extends MkTypedContentApprox {
+  private ContentApprox c;
+  private DataFlowType t;
+
+  TypedContentApprox() { this = MkTypedContentApprox(c, t) }
+
+  /** Gets a typed content approximated by this value. */
+  TypedContent getATypedContent() { result = getATypedContent(this) }
+
+  /** Gets the content. */
+  ContentApprox getContent() { result = c }
+
+  /** Gets the container type. */
+  DataFlowType getContainerType() { result = t }
+
+  /** Gets a textual representation of this approximated content. */
+  string toString() { result = c.toString() }
+}
+
 /**
  * The front of an approximated access path. This is either a head or a nil.
  */
 abstract class ApproxAccessPathFront extends TApproxAccessPathFront {
   abstract string toString();
 
+  abstract DataFlowType getType();
+
   abstract boolean toBoolNonEmpty();
 
-  ContentApprox getHead() { this = TApproxFrontHead(result) }
+  TypedContentApprox getHead() { this = TApproxFrontHead(result) }
 
   pragma[nomagic]
-  Content getAHead() {
-    exists(ContentApprox cont |
+  TypedContent getAHead() {
+    exists(TypedContentApprox cont |
       this = TApproxFrontHead(cont) and
-      cont = getContentApprox(result)
+      result = cont.getATypedContent()
     )
   }
 }
 
 class ApproxAccessPathFrontNil extends ApproxAccessPathFront, TApproxFrontNil {
-  override string toString() { result = "nil" }
+  private DataFlowType t;
+
+  ApproxAccessPathFrontNil() { this = TApproxFrontNil(t) }
+
+  override string toString() { result = ppReprType(t) }
+
+  override DataFlowType getType() { result = t }
 
   override boolean toBoolNonEmpty() { result = false }
 }
 
 class ApproxAccessPathFrontHead extends ApproxAccessPathFront, TApproxFrontHead {
-  private ContentApprox c;
+  private TypedContentApprox tc;
 
-  ApproxAccessPathFrontHead() { this = TApproxFrontHead(c) }
+  ApproxAccessPathFrontHead() { this = TApproxFrontHead(tc) }
 
-  override string toString() { result = c.toString() }
+  override string toString() { result = tc.toString() }
+
+  override DataFlowType getType() { result = tc.getContainerType() }
 
   override boolean toBoolNonEmpty() { result = true }
 }
@@ -1446,31 +1459,65 @@ class ApproxAccessPathFrontOption extends TApproxAccessPathFrontOption {
   }
 }
 
+/** A `Content` tagged with the type of a containing object. */
+class TypedContent extends MkTypedContent {
+  private Content c;
+  private DataFlowType t;
+
+  TypedContent() { this = MkTypedContent(c, t) }
+
+  /** Gets the content. */
+  Content getContent() { result = c }
+
+  /** Gets the container type. */
+  DataFlowType getContainerType() { result = t }
+
+  /** Gets a textual representation of this content. */
+  string toString() { result = c.toString() }
+
+  /**
+   * Holds if access paths with this `TypedContent` at their head always should
+   * be tracked at high precision. This disables adaptive access path precision
+   * for such access paths.
+   */
+  predicate forceHighPrecision() { forceHighPrecision(c) }
+}
+
 /**
  * The front of an access path. This is either a head or a nil.
  */
 abstract class AccessPathFront extends TAccessPathFront {
   abstract string toString();
 
+  abstract DataFlowType getType();
+
   abstract ApproxAccessPathFront toApprox();
 
-  Content getHead() { this = TFrontHead(result) }
+  TypedContent getHead() { this = TFrontHead(result) }
 }
 
 class AccessPathFrontNil extends AccessPathFront, TFrontNil {
-  override string toString() { result = "nil" }
+  private DataFlowType t;
 
-  override ApproxAccessPathFront toApprox() { result = TApproxFrontNil() }
+  AccessPathFrontNil() { this = TFrontNil(t) }
+
+  override string toString() { result = ppReprType(t) }
+
+  override DataFlowType getType() { result = t }
+
+  override ApproxAccessPathFront toApprox() { result = TApproxFrontNil(t) }
 }
 
 class AccessPathFrontHead extends AccessPathFront, TFrontHead {
-  private Content c;
+  private TypedContent tc;
 
-  AccessPathFrontHead() { this = TFrontHead(c) }
+  AccessPathFrontHead() { this = TFrontHead(tc) }
 
-  override string toString() { result = c.toString() }
+  override string toString() { result = tc.toString() }
 
-  override ApproxAccessPathFront toApprox() { result.getAHead() = c }
+  override DataFlowType getType() { result = tc.getContainerType() }
+
+  override ApproxAccessPathFront toApprox() { result.getAHead() = tc }
 }
 
 /** An optional access path front. */

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll

@@ -6,7 +6,6 @@ private import DataFlowImplConsistency
 private import semmle.code.cpp.ir.internal.IRCppLanguage
 private import SsaInternals as Ssa
 private import DataFlowImplCommon as DataFlowImplCommon
-private import codeql.util.Unit
 
 cached
 private module Cached {
@@ -607,21 +606,13 @@ OutNode getAnOutNode(DataFlowCall call, ReturnKind kind) {
   result.getReturnKind() = kind
 }
 
-/** A variable that behaves like a global variable. */
-class GlobalLikeVariable extends Variable {
-  GlobalLikeVariable() {
-    this instanceof Cpp::GlobalOrNamespaceVariable or
-    this instanceof Cpp::StaticLocalVariable
-  }
-}
-
 /**
  * Holds if data can flow from `node1` to `node2` in a way that loses the
  * calling context. For example, this would happen with flow through a
  * global or static variable.
  */
 predicate jumpStep(Node n1, Node n2) {
-  exists(GlobalLikeVariable v |
+  exists(Cpp::GlobalOrNamespaceVariable v |
     exists(Ssa::GlobalUse globalUse |
       v = globalUse.getVariable() and
       n1.(FinalGlobalValue).getGlobalUse() = globalUse
@@ -808,6 +799,15 @@ int accessPathLimit() { result = 5 }
  */
 predicate forceHighPrecision(Content c) { none() }
 
+/** The unit type. */
+private newtype TUnit = TMkUnit()
+
+/** The trivial type with a single element. */
+class Unit extends TUnit {
+  /** Gets a textual representation of this element. */
+  string toString() { result = "unit" }
+}
+
 /** Holds if `n` should be hidden from path explanations. */
 predicate nodeIsHidden(Node n) {
   n instanceof OperandNode and
@@ -905,6 +905,23 @@ private class MyConsistencyConfiguration extends Consistency::ConsistencyConfigu
   }
 }
 
+/**
+ * Gets the basic block of `node`.
+ */
+IRBlock getBasicBlock(Node node) {
+  node.asInstruction().getBlock() = result
+  or
+  node.asOperand().getUse().getBlock() = result
+  or
+  node.(SsaPhiNode).getPhiNode().getBasicBlock() = result
+  or
+  node.(RawIndirectOperand).getOperand().getUse().getBlock() = result
+  or
+  node.(RawIndirectInstruction).getInstruction().getBlock() = result
+  or
+  result = getBasicBlock(node.(PostUpdateNode).getPreUpdateNode())
+}
+
 /**
  * A local flow relation that includes both local steps, read steps and
  * argument-to-return flow through summarized functions.
@@ -990,8 +1007,7 @@ private int countNumberOfBranchesUsingParameter(SwitchInstruction switch, Parame
     // we pick the one with the highest edge count.
     result =
       max(SsaPhiNode phi |
-        switch.getSuccessor(caseOrDefaultEdge()).getBlock().dominanceFrontier() =
-          phi.getBasicBlock() and
+        switch.getSuccessor(caseOrDefaultEdge()).getBlock().dominanceFrontier() = getBasicBlock(phi) and
         phi.getSourceVariable() = sv
       |
         strictcount(phi.getAnInput())

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll

@@ -160,28 +160,6 @@ class Node extends TIRDataFlowNode {
   /** Gets the operands corresponding to this node, if any. */
   Operand asOperand() { result = this.(OperandNode).getOperand() }
 
-  /**
-   * Holds if this node is at index `i` in basic block `block`.
-   *
-   * Note: Phi nodes are considered to be at index `-1`.
-   */
-  final predicate hasIndexInBlock(IRBlock block, int i) {
-    this.asInstruction() = block.getInstruction(i)
-    or
-    this.asOperand().getUse() = block.getInstruction(i)
-    or
-    this.(SsaPhiNode).getPhiNode().getBasicBlock() = block and i = -1
-    or
-    this.(RawIndirectOperand).getOperand().getUse() = block.getInstruction(i)
-    or
-    this.(RawIndirectInstruction).getInstruction() = block.getInstruction(i)
-    or
-    this.(PostUpdateNode).getPreUpdateNode().hasIndexInBlock(block, i)
-  }
-
-  /** Gets the basic block of this node, if any. */
-  final IRBlock getBasicBlock() { this.hasIndexInBlock(result, _) }
-
   /**
    * Gets the non-conversion expression corresponding to this node, if any.
    * This predicate only has a result on nodes that represent the value of
@@ -552,7 +530,7 @@ class SsaPhiNode extends Node, TSsaPhiNode {
    */
   final Node getAnInput(boolean fromBackEdge) {
     localFlowStep(result, this) and
-    if phi.getBasicBlock().dominates(result.getBasicBlock())
+    if phi.getBasicBlock().dominates(getBasicBlock(result))
     then fromBackEdge = true
     else fromBackEdge = false
   }
@@ -1909,7 +1887,7 @@ module BarrierGuard<guardChecksSig/3 guardChecks> {
       e = value.getAnInstruction().getConvertedResultExpression() and
       result.getConvertedExpr() = e and
       guardChecks(g, value.getAnInstruction().getConvertedResultExpression(), edge) and
-      g.controls(result.getBasicBlock(), edge)
+      g.controls(getBasicBlock(result), edge)
     )
   }
 }

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DefaultTaintTrackingImpl.qll

@@ -9,6 +9,7 @@ import cpp
 import semmle.code.cpp.security.Security
 private import semmle.code.cpp.ir.dataflow.DataFlow
 private import semmle.code.cpp.ir.dataflow.internal.DataFlowUtil
+private import semmle.code.cpp.ir.dataflow.DataFlow3
 private import semmle.code.cpp.ir.IR
 private import semmle.code.cpp.ir.dataflow.ResolveCall
 private import semmle.code.cpp.controlflow.IRGuards
@@ -89,64 +90,65 @@ private predicate conflatePointerAndPointee(DataFlow::Node nodeFrom, DataFlow::N
   )
 }
 
-private module DefaultTaintTrackingConfig implements DataFlow::ConfigSig {
-  predicate isSource(DataFlow::Node source) { source = getNodeForSource(_) }
+private class DefaultTaintTrackingCfg extends TaintTracking::Configuration {
+  DefaultTaintTrackingCfg() { this = "DefaultTaintTrackingCfg" }
 
-  predicate isSink(DataFlow::Node sink) { exists(adjustedSink(sink)) }
+  override predicate isSource(DataFlow::Node source) { source = getNodeForSource(_) }
 
-  predicate isBarrier(DataFlow::Node node) { nodeIsBarrier(node) }
+  override predicate isSink(DataFlow::Node sink) { exists(adjustedSink(sink)) }
 
-  predicate isBarrierIn(DataFlow::Node node) { nodeIsBarrierIn(node) }
+  override predicate isSanitizer(DataFlow::Node node) { nodeIsBarrier(node) }
 
-  predicate isAdditionalFlowStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
+  override predicate isSanitizerIn(DataFlow::Node node) { nodeIsBarrierIn(node) }
+
+  override predicate isAdditionalTaintStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
     conflatePointerAndPointee(nodeFrom, nodeTo)
   }
 }
 
-private module DefaultTaintTrackingFlow = TaintTracking::Global<DefaultTaintTrackingConfig>;
+private class ToGlobalVarTaintTrackingCfg extends TaintTracking::Configuration {
+  ToGlobalVarTaintTrackingCfg() { this = "GlobalVarTaintTrackingCfg" }
 
-private module ToGlobalVarTaintTrackingConfig implements DataFlow::ConfigSig {
-  predicate isSource(DataFlow::Node source) { source = getNodeForSource(_) }
+  override predicate isSource(DataFlow::Node source) { source = getNodeForSource(_) }
 
-  predicate isSink(DataFlow::Node sink) { sink.asVariable() instanceof GlobalOrNamespaceVariable }
+  override predicate isSink(DataFlow::Node sink) {
+    sink.asVariable() instanceof GlobalOrNamespaceVariable
+  }
 
-  predicate isAdditionalFlowStep(DataFlow::Node n1, DataFlow::Node n2) {
+  override predicate isAdditionalTaintStep(DataFlow::Node n1, DataFlow::Node n2) {
     writesVariable(n1.asInstruction(), n2.asVariable().(GlobalOrNamespaceVariable))
     or
     readsVariable(n2.asInstruction(), n1.asVariable().(GlobalOrNamespaceVariable))
   }
 
-  predicate isBarrier(DataFlow::Node node) { nodeIsBarrier(node) }
+  override predicate isSanitizer(DataFlow::Node node) { nodeIsBarrier(node) }
 
-  predicate isBarrierIn(DataFlow::Node node) { nodeIsBarrierIn(node) }
+  override predicate isSanitizerIn(DataFlow::Node node) { nodeIsBarrierIn(node) }
 }
 
-private module ToGlobalVarTaintTrackingFlow = TaintTracking::Global<ToGlobalVarTaintTrackingConfig>;
+private class FromGlobalVarTaintTrackingCfg extends TaintTracking2::Configuration {
+  FromGlobalVarTaintTrackingCfg() { this = "FromGlobalVarTaintTrackingCfg" }
 
-private module FromGlobalVarTaintTrackingConfig implements DataFlow::ConfigSig {
-  predicate isSource(DataFlow::Node source) {
+  override predicate isSource(DataFlow::Node source) {
     // This set of sources should be reasonably small, which is good for
     // performance since the set of sinks is very large.
-    ToGlobalVarTaintTrackingFlow::flowTo(source)
+    exists(ToGlobalVarTaintTrackingCfg otherCfg | otherCfg.hasFlowTo(source))
   }
 
-  predicate isSink(DataFlow::Node sink) { exists(adjustedSink(sink)) }
+  override predicate isSink(DataFlow::Node sink) { exists(adjustedSink(sink)) }
 
-  predicate isAdditionalFlowStep(DataFlow::Node n1, DataFlow::Node n2) {
+  override predicate isAdditionalTaintStep(DataFlow::Node n1, DataFlow::Node n2) {
     // Additional step for flow out of variables. There is no flow _into_
     // variables in this configuration, so this step only serves to take flow
     // out of a variable that's a source.
     readsVariable(n2.asInstruction(), n1.asVariable())
   }
 
-  predicate isBarrier(DataFlow::Node node) { nodeIsBarrier(node) }
+  override predicate isSanitizer(DataFlow::Node node) { nodeIsBarrier(node) }
 
-  predicate isBarrierIn(DataFlow::Node node) { nodeIsBarrierIn(node) }
+  override predicate isSanitizerIn(DataFlow::Node node) { nodeIsBarrierIn(node) }
 }
 
-private module FromGlobalVarTaintTrackingFlow =
-  TaintTracking::Global<FromGlobalVarTaintTrackingConfig>;
-
 private predicate readsVariable(LoadInstruction load, Variable var) {
   load.getSourceAddress().(VariableAddressInstruction).getAstVariable() = var
 }
@@ -330,8 +332,8 @@ private import Cached
  */
 cached
 predicate tainted(Expr source, Element tainted) {
-  exists(DataFlow::Node sink |
-    DefaultTaintTrackingFlow::flow(getNodeForSource(source), sink) and
+  exists(DefaultTaintTrackingCfg cfg, DataFlow::Node sink |
+    cfg.hasFlow(getNodeForSource(source), sink) and
     tainted = adjustedSink(sink)
   )
 }
@@ -357,11 +359,12 @@ predicate taintedIncludingGlobalVars(Expr source, Element tainted, string global
   globalVar = ""
   or
   exists(
+    ToGlobalVarTaintTrackingCfg toCfg, FromGlobalVarTaintTrackingCfg fromCfg,
     DataFlow::VariableNode variableNode, GlobalOrNamespaceVariable global, DataFlow::Node sink
   |
     global = variableNode.getVariable() and
-    ToGlobalVarTaintTrackingFlow::flow(getNodeForSource(source), variableNode) and
-    FromGlobalVarTaintTrackingFlow::flow(variableNode, sink) and
+    toCfg.hasFlow(getNodeForSource(source), variableNode) and
+    fromCfg.hasFlow(variableNode, sink) and
     tainted = adjustedSink(sink) and
     global = globalVarFromId(globalVar)
   )
@@ -419,18 +422,20 @@ module TaintedWithPath {
     string toString() { result = "TaintTrackingConfiguration" }
   }
 
-  private module AdjustedConfig implements DataFlow::ConfigSig {
-    predicate isSource(DataFlow::Node source) {
+  private class AdjustedConfiguration extends TaintTracking3::Configuration {
+    AdjustedConfiguration() { this = "AdjustedConfiguration" }
+
+    override predicate isSource(DataFlow::Node source) {
       exists(TaintTrackingConfiguration cfg, Expr e |
         cfg.isSource(e) and source = getNodeForExpr(e)
       )
     }
 
-    predicate isSink(DataFlow::Node sink) {
+    override predicate isSink(DataFlow::Node sink) {
       exists(TaintTrackingConfiguration cfg | cfg.isSink(adjustedSink(sink)))
     }
 
-    predicate isAdditionalFlowStep(DataFlow::Node n1, DataFlow::Node n2) {
+    override predicate isAdditionalTaintStep(DataFlow::Node n1, DataFlow::Node n2) {
       conflatePointerAndPointee(n1, n2)
       or
       // Steps into and out of global variables
@@ -443,15 +448,13 @@ module TaintedWithPath {
       additionalTaintStep(n1, n2)
     }
 
-    predicate isBarrier(DataFlow::Node node) {
+    override predicate isSanitizer(DataFlow::Node node) {
       exists(TaintTrackingConfiguration cfg, Expr e | cfg.isBarrier(e) and node = getNodeForExpr(e))
     }
 
-    predicate isBarrierIn(DataFlow::Node node) { nodeIsBarrierIn(node) }
+    override predicate isSanitizerIn(DataFlow::Node node) { nodeIsBarrierIn(node) }
   }
 
-  private module AdjustedFlow = TaintTracking::Global<AdjustedConfig>;
-
   /*
    * A sink `Element` may map to multiple `DataFlowX::PathNode`s via (the
    * inverse of) `adjustedSink`. For example, an `Expr` maps to all its
@@ -467,12 +470,12 @@ module TaintedWithPath {
    */
 
   private newtype TPathNode =
-    TWrapPathNode(AdjustedFlow::PathNode n) or
+    TWrapPathNode(DataFlow3::PathNode n) or
     // There's a single newtype constructor for both sources and sinks since
     // that makes it easiest to deal with the case where source = sink.
     TEndpointPathNode(Element e) {
-      exists(DataFlow::Node sourceNode, DataFlow::Node sinkNode |
-        AdjustedFlow::flow(sourceNode, sinkNode)
+      exists(AdjustedConfiguration cfg, DataFlow3::Node sourceNode, DataFlow3::Node sinkNode |
+        cfg.hasFlow(sourceNode, sinkNode)
       |
         sourceNode = getNodeForExpr(e) and
         exists(TaintTrackingConfiguration ttCfg | ttCfg.isSource(e))
@@ -521,7 +524,7 @@ module TaintedWithPath {
   }
 
   private class WrapPathNode extends PathNode, TWrapPathNode {
-    AdjustedFlow::PathNode inner() { this = TWrapPathNode(result) }
+    DataFlow3::PathNode inner() { this = TWrapPathNode(result) }
 
     override string toString() { result = this.inner().toString() }
 
@@ -558,25 +561,25 @@ module TaintedWithPath {
 
   /** Holds if `(a,b)` is an edge in the graph of data flow path explanations. */
   query predicate edges(PathNode a, PathNode b) {
-    AdjustedFlow::PathGraph::edges(a.(WrapPathNode).inner(), b.(WrapPathNode).inner())
+    DataFlow3::PathGraph::edges(a.(WrapPathNode).inner(), b.(WrapPathNode).inner())
     or
     // To avoid showing trivial-looking steps, we _replace_ the last node instead
     // of adding an edge out of it.
     exists(WrapPathNode sinkNode |
-      AdjustedFlow::PathGraph::edges(a.(WrapPathNode).inner(), sinkNode.inner()) and
+      DataFlow3::PathGraph::edges(a.(WrapPathNode).inner(), sinkNode.inner()) and
       b.(FinalPathNode).inner() = adjustedSink(sinkNode.inner().getNode())
     )
     or
     // Same for the first node
     exists(WrapPathNode sourceNode |
-      AdjustedFlow::PathGraph::edges(sourceNode.inner(), b.(WrapPathNode).inner()) and
+      DataFlow3::PathGraph::edges(sourceNode.inner(), b.(WrapPathNode).inner()) and
       sourceNode.inner().getNode() = getNodeForExpr(a.(InitialPathNode).inner())
     )
     or
     // Finally, handle the case where the path goes directly from a source to a
     // sink, meaning that they both need to be translated.
     exists(WrapPathNode sinkNode, WrapPathNode sourceNode |
-      AdjustedFlow::PathGraph::edges(sourceNode.inner(), sinkNode.inner()) and
+      DataFlow3::PathGraph::edges(sourceNode.inner(), sinkNode.inner()) and
       sourceNode.inner().getNode() = getNodeForExpr(a.(InitialPathNode).inner()) and
       b.(FinalPathNode).inner() = adjustedSink(sinkNode.inner().getNode())
     )
@@ -587,20 +590,20 @@ module TaintedWithPath {
    * from `par` to `ret` within it, in the graph of data flow path explanations.
    */
   query predicate subpaths(PathNode arg, PathNode par, PathNode ret, PathNode out) {
-    AdjustedFlow::PathGraph::subpaths(arg.(WrapPathNode).inner(), par.(WrapPathNode).inner(),
+    DataFlow3::PathGraph::subpaths(arg.(WrapPathNode).inner(), par.(WrapPathNode).inner(),
       ret.(WrapPathNode).inner(), out.(WrapPathNode).inner())
     or
     // To avoid showing trivial-looking steps, we _replace_ the last node instead
     // of adding an edge out of it.
     exists(WrapPathNode sinkNode |
-      AdjustedFlow::PathGraph::subpaths(arg.(WrapPathNode).inner(), par.(WrapPathNode).inner(),
+      DataFlow3::PathGraph::subpaths(arg.(WrapPathNode).inner(), par.(WrapPathNode).inner(),
         ret.(WrapPathNode).inner(), sinkNode.inner()) and
       out.(FinalPathNode).inner() = adjustedSink(sinkNode.inner().getNode())
     )
     or
     // Same for the first node
     exists(WrapPathNode sourceNode |
-      AdjustedFlow::PathGraph::subpaths(sourceNode.inner(), par.(WrapPathNode).inner(),
+      DataFlow3::PathGraph::subpaths(sourceNode.inner(), par.(WrapPathNode).inner(),
         ret.(WrapPathNode).inner(), out.(WrapPathNode).inner()) and
       sourceNode.inner().getNode() = getNodeForExpr(arg.(InitialPathNode).inner())
     )
@@ -608,7 +611,7 @@ module TaintedWithPath {
     // Finally, handle the case where the path goes directly from a source to a
     // sink, meaning that they both need to be translated.
     exists(WrapPathNode sinkNode, WrapPathNode sourceNode |
-      AdjustedFlow::PathGraph::subpaths(sourceNode.inner(), par.(WrapPathNode).inner(),
+      DataFlow3::PathGraph::subpaths(sourceNode.inner(), par.(WrapPathNode).inner(),
         ret.(WrapPathNode).inner(), sinkNode.inner()) and
       sourceNode.inner().getNode() = getNodeForExpr(arg.(InitialPathNode).inner()) and
       out.(FinalPathNode).inner() = adjustedSink(sinkNode.inner().getNode())
@@ -631,10 +634,10 @@ module TaintedWithPath {
    * the computation.
    */
   predicate taintedWithPath(Expr source, Element tainted, PathNode sourceNode, PathNode sinkNode) {
-    exists(DataFlow::Node flowSource, DataFlow::Node flowSink |
+    exists(AdjustedConfiguration cfg, DataFlow3::Node flowSource, DataFlow3::Node flowSink |
       source = sourceNode.(InitialPathNode).inner() and
       flowSource = getNodeForExpr(source) and
-      AdjustedFlow::flow(flowSource, flowSink) and
+      cfg.hasFlow(flowSource, flowSink) and
       tainted = adjustedSink(flowSink) and
       tainted = sinkNode.(FinalPathNode).inner()
     )
@@ -657,8 +660,8 @@ module TaintedWithPath {
    * through a global variable.
    */
   predicate taintedWithoutGlobals(Element tainted) {
-    exists(PathNode sourceNode, FinalPathNode sinkNode |
-      AdjustedConfig::isSource(sourceNode.(WrapPathNode).inner().getNode()) and
+    exists(AdjustedConfiguration cfg, PathNode sourceNode, FinalPathNode sinkNode |
+      cfg.isSource(sourceNode.(WrapPathNode).inner().getNode()) and
       edgesWithoutGlobals+(sourceNode, sinkNode) and
       tainted = sinkNode.inner()
     )

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternals.qll

@@ -145,14 +145,14 @@ private newtype TDefOrUseImpl =
       or
       // Since the pruning stage doesn't know about global variables we can't use the above check to
       // rule out dead assignments to globals.
-      base.(VariableAddressInstruction).getAstVariable() instanceof GlobalLikeVariable
+      base.(VariableAddressInstruction).getAstVariable() instanceof Cpp::GlobalOrNamespaceVariable
     )
   } or
   TUseImpl(Operand operand, int indirectionIndex) {
     isUse(_, operand, _, _, indirectionIndex) and
     not isDef(_, _, operand, _, _, _)
   } or
-  TGlobalUse(GlobalLikeVariable v, IRFunction f, int indirectionIndex) {
+  TGlobalUse(Cpp::GlobalOrNamespaceVariable v, IRFunction f, int indirectionIndex) {
     // Represents a final "use" of a global variable to ensure that
     // the assignment to a global variable isn't ruled out as dead.
     exists(VariableAddressInstruction vai, int defIndex |
@@ -162,7 +162,7 @@ private newtype TDefOrUseImpl =
       indirectionIndex = [0 .. defIndex] + 1
     )
   } or
-  TGlobalDefImpl(GlobalLikeVariable v, IRFunction f, int indirectionIndex) {
+  TGlobalDefImpl(Cpp::GlobalOrNamespaceVariable v, IRFunction f, int indirectionIndex) {
     // Represents the initial "definition" of a global variable when entering
     // a function body.
     exists(VariableAddressInstruction vai |
@@ -458,7 +458,7 @@ class FinalParameterUse extends UseImpl, TFinalParameterUse {
 }
 
 class GlobalUse extends UseImpl, TGlobalUse {
-  GlobalLikeVariable global;
+  Cpp::GlobalOrNamespaceVariable global;
   IRFunction f;
 
   GlobalUse() { this = TGlobalUse(global, f, ind) }
@@ -468,7 +468,7 @@ class GlobalUse extends UseImpl, TGlobalUse {
   override int getIndirection() { result = ind + 1 }
 
   /** Gets the global variable associated with this use. */
-  GlobalLikeVariable getVariable() { result = global }
+  Cpp::GlobalOrNamespaceVariable getVariable() { result = global }
 
   /** Gets the `IRFunction` whose body is exited from after this use. */
   IRFunction getIRFunction() { result = f }
@@ -496,14 +496,14 @@ class GlobalUse extends UseImpl, TGlobalUse {
 }
 
 class GlobalDefImpl extends DefOrUseImpl, TGlobalDefImpl {
-  GlobalLikeVariable global;
+  Cpp::GlobalOrNamespaceVariable global;
   IRFunction f;
   int indirectionIndex;
 
   GlobalDefImpl() { this = TGlobalDefImpl(global, f, indirectionIndex) }
 
   /** Gets the global variable associated with this definition. */
-  GlobalLikeVariable getVariable() { result = global }
+  Cpp::GlobalOrNamespaceVariable getVariable() { result = global }
 
   /** Gets the `IRFunction` whose body is evaluated after this definition. */
   IRFunction getIRFunction() { result = f }
@@ -760,14 +760,13 @@ private predicate variableWriteCand(IRBlock bb, int i, SourceVariable v) {
 }
 
 private predicate sourceVariableIsGlobal(
-  SourceVariable sv, GlobalLikeVariable global, IRFunction func, int indirectionIndex
+  SourceVariable sv, Cpp::GlobalOrNamespaceVariable global, IRFunction func, int indirectionIndex
 ) {
   exists(IRVariable irVar, BaseIRVariable base |
     sourceVariableHasBaseAndIndex(sv, base, indirectionIndex) and
     irVar = base.getIRVariable() and
     irVar.getEnclosingIRFunction() = func and
-    global = irVar.getAst() and
-    not irVar instanceof IRDynamicInitializationFlag
+    global = irVar.getAst()
   )
 }
 
@@ -920,7 +919,7 @@ class GlobalDef extends TGlobalDef, SsaDefOrUse {
   IRFunction getIRFunction() { result = global.getIRFunction() }
 
   /** Gets the global variable associated with this definition. */
-  GlobalLikeVariable getVariable() { result = global.getVariable() }
+  Cpp::GlobalOrNamespaceVariable getVariable() { result = global.getVariable() }
 }
 
 class Phi extends TPhi, SsaDefOrUse {

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternalsCommon.qll

@@ -26,17 +26,12 @@ predicate ignoreOperand(Operand operand) {
 predicate ignoreInstruction(Instruction instr) {
   DataFlowImplCommon::forceCachingInSameStage() and
   (
-    instr instanceof CallSideEffectInstruction or
-    instr instanceof CallReadSideEffectInstruction or
-    instr instanceof ExitFunctionInstruction or
-    instr instanceof EnterFunctionInstruction or
     instr instanceof WriteSideEffectInstruction or
     instr instanceof PhiInstruction or
     instr instanceof ReadSideEffectInstruction or
     instr instanceof ChiInstruction or
     instr instanceof InitializeIndirectionInstruction or
     instr instanceof AliasedDefinitionInstruction or
-    instr instanceof AliasedUseInstruction or
     instr instanceof InitializeNonLocalInstruction or
     instr instanceof ReturnIndirectionInstruction
   )

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/tainttracking1/TaintTracking.qll

@@ -33,9 +33,9 @@ private module AddTaintDefaults<DataFlowInternal::FullStateConfigSig Config> imp
 }
 
 /**
- * Constructs a global taint tracking computation.
+ * Constructs a standard taint tracking computation.
  */
-module Global<DataFlow::ConfigSig Config> implements DataFlow::GlobalFlowSig {
+module Make<DataFlow::ConfigSig Config> implements DataFlow::DataFlowSig {
   private module Config0 implements DataFlowInternal::FullStateConfigSig {
     import DataFlowInternal::DefaultState<Config>
     import Config
@@ -48,15 +48,10 @@ module Global<DataFlow::ConfigSig Config> implements DataFlow::GlobalFlowSig {
   import DataFlowInternal::Impl<C>
 }
 
-/** DEPRECATED: Use `Global` instead. */
-deprecated module Make<DataFlow::ConfigSig Config> implements DataFlow::GlobalFlowSig {
-  import Global<Config>
-}
-
 /**
- * Constructs a global taint tracking computation using flow state.
+ * Constructs a taint tracking computation using flow state.
  */
-module GlobalWithState<DataFlow::StateConfigSig Config> implements DataFlow::GlobalFlowSig {
+module MakeWithState<DataFlow::StateConfigSig Config> implements DataFlow::DataFlowSig {
   private module Config0 implements DataFlowInternal::FullStateConfigSig {
     import Config
   }
@@ -67,8 +62,3 @@ module GlobalWithState<DataFlow::StateConfigSig Config> implements DataFlow::Glo
 
   import DataFlowInternal::Impl<C>
 }
-
-/** DEPRECATED: Use `GlobalWithState` instead. */
-deprecated module MakeWithState<DataFlow::StateConfigSig Config> implements DataFlow::GlobalFlowSig {
-  import GlobalWithState<Config>
-}

cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/IRConsistency.qll

@@ -1,7 +1,6 @@
 private import IR
 import InstructionConsistency // module is below
 import IRTypeConsistency // module is in IRType.qll
-import internal.IRConsistencyImports
 
 module InstructionConsistency {
   private import internal.InstructionImports as Imports
@@ -29,7 +28,7 @@ module InstructionConsistency {
     PresentIRFunction() { this = TPresentIRFunction(irFunc) }
 
     override string toString() {
-      result = concat(LanguageDebug::getIdentityString(irFunc.getFunction()), "; ")
+      result = concat(Language::getIdentityString(irFunc.getFunction()), "; ")
     }
 
     override Language::Location getLocation() {

cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/PrintIR.qll

@@ -149,9 +149,7 @@ private class PrintableIRFunction extends PrintableIRNode, TPrintableIRFunction
 
   override Language::Location getLocation() { result = irFunc.getLocation() }
 
-  override string getLabel() {
-    result = Imports::LanguageDebug::getIdentityString(irFunc.getFunction())
-  }
+  override string getLabel() { result = Language::getIdentityString(irFunc.getFunction()) }
 
   override int getOrder() {
     this =

cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/internal/ValueNumberingInternal.qll

@@ -159,56 +159,26 @@ private predicate fieldAddressValueNumber(
   tvalueNumber(instr.getObjectAddress()) = objectAddress
 }
 
-pragma[nomagic]
-private predicate binaryValueNumber0(
-  BinaryInstruction instr, IRFunction irFunc, Opcode opcode, boolean isLeft,
-  TValueNumber valueNumber
-) {
-  not instr instanceof PointerArithmeticInstruction and
-  instr.getEnclosingIRFunction() = irFunc and
-  instr.getOpcode() = opcode and
-  (
-    isLeft = true and
-    tvalueNumber(instr.getLeft()) = valueNumber
-    or
-    isLeft = false and
-    tvalueNumber(instr.getRight()) = valueNumber
-  )
-}
-
-pragma[assume_small_delta]
 private predicate binaryValueNumber(
   BinaryInstruction instr, IRFunction irFunc, Opcode opcode, TValueNumber leftOperand,
   TValueNumber rightOperand
-) {
-  binaryValueNumber0(instr, irFunc, opcode, true, leftOperand) and
-  binaryValueNumber0(instr, irFunc, opcode, false, rightOperand)
-}
-
-pragma[nomagic]
-private predicate pointerArithmeticValueNumber0(
-  PointerArithmeticInstruction instr, IRFunction irFunc, Opcode opcode, int elementSize,
-  boolean isLeft, TValueNumber valueNumber
 ) {
   instr.getEnclosingIRFunction() = irFunc and
+  not instr instanceof PointerArithmeticInstruction and
   instr.getOpcode() = opcode and
-  instr.getElementSize() = elementSize and
-  (
-    isLeft = true and
-    tvalueNumber(instr.getLeft()) = valueNumber
-    or
-    isLeft = false and
-    tvalueNumber(instr.getRight()) = valueNumber
-  )
+  tvalueNumber(instr.getLeft()) = leftOperand and
+  tvalueNumber(instr.getRight()) = rightOperand
 }
 
-pragma[assume_small_delta]
 private predicate pointerArithmeticValueNumber(
   PointerArithmeticInstruction instr, IRFunction irFunc, Opcode opcode, int elementSize,
   TValueNumber leftOperand, TValueNumber rightOperand
 ) {
-  pointerArithmeticValueNumber0(instr, irFunc, opcode, elementSize, true, leftOperand) and
-  pointerArithmeticValueNumber0(instr, irFunc, opcode, elementSize, false, rightOperand)
+  instr.getEnclosingIRFunction() = irFunc and
+  instr.getOpcode() = opcode and
+  instr.getElementSize() = elementSize and
+  tvalueNumber(instr.getLeft()) = leftOperand and
+  tvalueNumber(instr.getRight()) = rightOperand
 }
 
 private predicate unaryValueNumber(
@@ -233,29 +203,14 @@ private predicate inheritanceConversionValueNumber(
   unique( | | instr.getDerivedClass()) = derivedClass
 }
 
-pragma[nomagic]
-private predicate loadTotalOverlapValueNumber0(
-  LoadTotalOverlapInstruction instr, IRFunction irFunc, IRType type, TValueNumber valueNumber,
-  boolean isAddress
-) {
-  instr.getEnclosingIRFunction() = irFunc and
-  instr.getResultIRType() = type and
-  (
-    isAddress = true and
-    tvalueNumberOfOperand(instr.getSourceAddressOperand()) = valueNumber
-    or
-    isAddress = false and
-    tvalueNumber(instr.getSourceValueOperand().getAnyDef()) = valueNumber
-  )
-}
-
-pragma[assume_small_delta]
 private predicate loadTotalOverlapValueNumber(
   LoadTotalOverlapInstruction instr, IRFunction irFunc, IRType type, TValueNumber memOperand,
   TValueNumber operand
 ) {
-  loadTotalOverlapValueNumber0(instr, irFunc, type, operand, true) and
-  loadTotalOverlapValueNumber0(instr, irFunc, type, memOperand, false)
+  instr.getEnclosingIRFunction() = irFunc and
+  tvalueNumber(instr.getAnOperand().(MemoryOperand).getAnyDef()) = memOperand and
+  tvalueNumberOfOperand(instr.getAnOperand().(AddressOperand)) = operand and
+  instr.getResultIRType() = type
 }
 
 /**

cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasedSSA.qll

@@ -1,7 +1,7 @@
 import AliasAnalysis
-import semmle.code.cpp.Location
 import semmle.code.cpp.ir.internal.Overlap
 private import semmle.code.cpp.ir.internal.IRCppLanguage as Language
+private import semmle.code.cpp.Print
 private import semmle.code.cpp.ir.implementation.unaliased_ssa.IR
 private import semmle.code.cpp.ir.implementation.unaliased_ssa.internal.SSAConstruction as OldSsa
 private import semmle.code.cpp.ir.internal.IntegerConstant as Ints

cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/IRConsistencyImports.qll

@@ -1 +0,0 @@
-import semmle.code.cpp.ir.internal.IRCppLanguageDebug as LanguageDebug

cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/PrintIRImports.qll

@@ -1,2 +1 @@
 import semmle.code.cpp.ir.IRConfiguration as IRConfiguration
-import semmle.code.cpp.ir.internal.IRCppLanguageDebug as LanguageDebug

cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConsistency.qll

@@ -1,55 +1,2 @@
-import SsaConsistency
-import SSAConsistencyImports
-
-module SsaConsistency {
-  /**
-   * Holds if a `MemoryOperand` has more than one `MemoryLocation` assigned by alias analysis.
-   */
-  query predicate multipleOperandMemoryLocations(
-    OldIR::MemoryOperand operand, string message, OldIR::IRFunction func, string funcText
-  ) {
-    exists(int locationCount |
-      locationCount = strictcount(Alias::getOperandMemoryLocation(operand)) and
-      locationCount > 1 and
-      func = operand.getEnclosingIRFunction() and
-      funcText = LanguageDebug::getIdentityString(func.getFunction()) and
-      message =
-        operand.getUse().toString() + " " + "Operand has " + locationCount.toString() +
-          " memory accesses in function '$@': " +
-          strictconcat(Alias::getOperandMemoryLocation(operand).toString(), ", ")
-    )
-  }
-
-  /**
-   * Holds if a `MemoryLocation` does not have an associated `VirtualVariable`.
-   */
-  query predicate missingVirtualVariableForMemoryLocation(
-    Alias::MemoryLocation location, string message, OldIR::IRFunction func, string funcText
-  ) {
-    not exists(location.getVirtualVariable()) and
-    func = location.getIRFunction() and
-    funcText = LanguageDebug::getIdentityString(func.getFunction()) and
-    message = "Memory location has no virtual variable in function '$@'."
-  }
-
-  /**
-   * Holds if a `MemoryLocation` is a member of more than one `VirtualVariable`.
-   */
-  query predicate multipleVirtualVariablesForMemoryLocation(
-    Alias::MemoryLocation location, string message, OldIR::IRFunction func, string funcText
-  ) {
-    exists(int vvarCount |
-      vvarCount = strictcount(location.getVirtualVariable()) and
-      vvarCount > 1 and
-      func = location.getIRFunction() and
-      funcText = LanguageDebug::getIdentityString(func.getFunction()) and
-      message =
-        "Memory location has " + vvarCount.toString() + " virtual variables in function '$@': (" +
-          concat(Alias::VirtualVariable vvar |
-            vvar = location.getVirtualVariable()
-          |
-            vvar.toString(), ", "
-          ) + ")."
-    )
-  }
-}
+private import SSAConstruction as Ssa
+import Ssa::SsaConsistency

cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConsistencyImports.qll

@@ -1,3 +0,0 @@
-import semmle.code.cpp.ir.implementation.raw.IR as OldIR
-import AliasedSSA as Alias
-import semmle.code.cpp.ir.internal.IRCppLanguageDebug as LanguageDebug

cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstruction.qll

@@ -996,7 +996,7 @@ deprecated predicate canReuseSSAForMemoryResult = canReuseSsaForMemoryResult/1;
 
 /**
  * Expose some of the internal predicates to PrintSSA.qll. We do this by publicly importing those modules in the
- * `DebugSsa` module, which is then imported by PrintSSA.
+ * `DebugSSA` module, which is then imported by PrintSSA.
  */
 module DebugSsa {
   import PhiInsertion
@@ -1063,6 +1063,62 @@ private module CachedForDebugging {
   int maxValue() { result = 2147483647 }
 }
 
+module SsaConsistency {
+  /**
+   * Holds if a `MemoryOperand` has more than one `MemoryLocation` assigned by alias analysis.
+   */
+  query predicate multipleOperandMemoryLocations(
+    OldIR::MemoryOperand operand, string message, OldIR::IRFunction func, string funcText
+  ) {
+    exists(int locationCount |
+      locationCount = strictcount(Alias::getOperandMemoryLocation(operand)) and
+      locationCount > 1 and
+      func = operand.getEnclosingIRFunction() and
+      funcText = Language::getIdentityString(func.getFunction()) and
+      message =
+        operand.getUse().toString() + " " + "Operand has " + locationCount.toString() +
+          " memory accesses in function '$@': " +
+          strictconcat(Alias::getOperandMemoryLocation(operand).toString(), ", ")
+    )
+  }
+
+  /**
+   * Holds if a `MemoryLocation` does not have an associated `VirtualVariable`.
+   */
+  query predicate missingVirtualVariableForMemoryLocation(
+    Alias::MemoryLocation location, string message, OldIR::IRFunction func, string funcText
+  ) {
+    not exists(location.getVirtualVariable()) and
+    func = location.getIRFunction() and
+    funcText = Language::getIdentityString(func.getFunction()) and
+    message = "Memory location has no virtual variable in function '$@'."
+  }
+
+  /**
+   * Holds if a `MemoryLocation` is a member of more than one `VirtualVariable`.
+   */
+  query predicate multipleVirtualVariablesForMemoryLocation(
+    Alias::MemoryLocation location, string message, OldIR::IRFunction func, string funcText
+  ) {
+    exists(int vvarCount |
+      vvarCount = strictcount(location.getVirtualVariable()) and
+      vvarCount > 1 and
+      func = location.getIRFunction() and
+      funcText = Language::getIdentityString(func.getFunction()) and
+      message =
+        "Memory location has " + vvarCount.toString() + " virtual variables in function '$@': (" +
+          concat(Alias::VirtualVariable vvar |
+            vvar = location.getVirtualVariable()
+          |
+            vvar.toString(), ", "
+          ) + ")."
+    )
+  }
+}
+
+/** DEPRECATED: Alias for SsaConsistency */
+deprecated module SSAConsistency = SsaConsistency;
+
 /**
  * Provides the portion of the parameterized IR interface that is used to construct the SSA stages
  * of the IR. The raw stage of the IR does not expose these predicates.

cpp/ql/lib/semmle/code/cpp/ir/implementation/internal/IRFunctionBase.qll

@@ -6,7 +6,7 @@ private import IRFunctionBaseInternal
 
 private newtype TIRFunction =
   TFunctionIRFunction(Language::Function func) { IRConstruction::Raw::functionHasIR(func) } or
-  TVarInitIRFunction(Language::Variable var) { IRConstruction::Raw::varHasIRFunc(var) }
+  TVarInitIRFunction(Language::GlobalVariable var) { IRConstruction::Raw::varHasIRFunc(var) }
 
 /**
  * The IR for a function. This base class contains only the predicates that are the same between all

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/IRConsistency.qll

@@ -1,7 +1,6 @@
 private import IR
 import InstructionConsistency // module is below
 import IRTypeConsistency // module is in IRType.qll
-import internal.IRConsistencyImports
 
 module InstructionConsistency {
   private import internal.InstructionImports as Imports
@@ -29,7 +28,7 @@ module InstructionConsistency {
     PresentIRFunction() { this = TPresentIRFunction(irFunc) }
 
     override string toString() {
-      result = concat(LanguageDebug::getIdentityString(irFunc.getFunction()), "; ")
+      result = concat(Language::getIdentityString(irFunc.getFunction()), "; ")
     }
 
     override Language::Location getLocation() {