Merge pull request #8233 from github/release-prep/2.8.2

Release preparation for version 2.8.2

.codeqlmanifest.json

@@ -4,8 +4,10 @@
         "*/ql/lib/qlpack.yml",
         "*/ql/test/qlpack.yml",
         "*/ql/examples/qlpack.yml",
+        "*/ql/consistency-queries/qlpack.yml",
         "cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/qlpack.yml",
         "javascript/ql/experimental/adaptivethreatmodeling/lib/qlpack.yml",
+        "javascript/ql/experimental/adaptivethreatmodeling/modelbuilding/qlpack.yml",
         "javascript/ql/experimental/adaptivethreatmodeling/src/qlpack.yml",
         "csharp/ql/campaigns/Solorigate/lib/qlpack.yml",
         "csharp/ql/campaigns/Solorigate/src/qlpack.yml",
@@ -13,8 +15,6 @@
         "misc/legacy-support/*/qlpack.yml",
         "misc/suite-helpers/qlpack.yml",
         "ruby/extractor-pack/codeql-extractor.yml",
-        "ruby/ql/consistency-queries/qlpack.yml",
-        "ql/ql/consistency-queries/qlpack.yml",
         "ql/extractor-pack/codeql-extractor.yml"
     ],
     "versionPolicies": {

.gitattributes

@@ -50,4 +50,15 @@
 *.pdb -text
 
 java/ql/test/stubs/**/*.java linguist-generated=true
-java/ql/test/experimental/stubs/**/*.java linguist-generated=true
+java/ql/test/experimental/stubs/**/*.java linguist-generated=true
+
+# For some languages, upgrade script testing references really old dbscheme
+# files from legacy upgrades that have CRLF line endings. Since upgrade
+# resolution relies on object hashes, we must suppress line ending conversion
+# for those testing dbscheme files.
+*/ql/lib/upgrades/initial/*.dbscheme -text
+
+# Generated test files - these are synced from the standard JavaScript libraries using
+# `javascript/ql/experimental/adaptivethreatmodeling/test/update_endpoint_test_files.py`.
+javascript/ql/experimental/adaptivethreatmodeling/test/endpoint_large_scale/autogenerated/**/*.js linguist-generated=true -merge
+javascript/ql/experimental/adaptivethreatmodeling/test/endpoint_large_scale/autogenerated/**/*.ts linguist-generated=true -merge

.github/workflows/check-change-note.yml

@@ -6,8 +6,11 @@ on:
     paths:
       - "*/ql/src/**/*.ql"
       - "*/ql/src/**/*.qll"
+      - "*/ql/lib/**/*.ql"
+      - "*/ql/lib/**/*.qll"
       - "!**/experimental/**"
       - "!ql/**"
+      - ".github/workflows/check-change-note.yml"
 
 jobs:
   check-change-note:

.github/workflows/codeql-analysis.yml

@@ -27,6 +27,11 @@ jobs:
       pull-requests: read
 
     steps:
+    - name: Setup dotnet
+      uses: actions/setup-dotnet@v1
+      with:
+        dotnet-version: 6.0.101
+
     - name: Checkout repository
       uses: actions/checkout@v2
 
@@ -51,7 +56,7 @@ jobs:
     #    uses a compiled language
 
     - run: |
-       dotnet build csharp
+       dotnet build csharp /p:UseSharedCompilation=false
 
     - name: Perform CodeQL Analysis
       uses: github/codeql-action/analyze@main

.github/workflows/csv-coverage-metrics.yml

@@ -0,0 +1,43 @@
+name: "Publish framework coverage as metrics"
+
+on:
+  schedule:
+    - cron: '5 0 * * *'
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - ".github/workflows/csv-coverage-metrics.yml"
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v2
+      - name: Setup CodeQL
+        uses: ./.github/actions/fetch-codeql
+      - name: Create empty database
+        run: |
+          DATABASE="${{ runner.temp }}/java-database"
+          PROJECT="${{ runner.temp }}/java-project"
+          mkdir -p "$PROJECT/src/tmp/empty"
+          echo "class Empty {}" >> "$PROJECT/src/tmp/empty/Empty.java"
+          codeql database create "$DATABASE" --language=java --source-root="$PROJECT" --command 'javac src/tmp/empty/Empty.java'
+      - name: Capture coverage information
+        run: |
+          DATABASE="${{ runner.temp }}/java-database"
+          codeql database analyze --format=sarif-latest --output=metrics.sarif -- "$DATABASE" ./java/ql/src/Metrics/Summaries/FrameworkCoverage.ql
+      - uses: actions/upload-artifact@v2
+        with:
+          name: metrics.sarif
+          path: metrics.sarif
+          retention-days: 20
+      - name: Upload SARIF file
+        uses: github/codeql-action/upload-sarif@v1
+        with:
+          sarif_file: metrics.sarif

.github/workflows/js-ml-tests.yml

@@ -0,0 +1,76 @@
+name: JS ML-powered queries tests
+
+on:
+  push:
+    paths:
+      - "javascript/ql/experimental/adaptivethreatmodeling/**"
+      - .github/workflows/js-ml-tests.yml
+    branches:
+      - main
+      - "rc/*"
+  pull_request:
+    paths:
+      - "javascript/ql/experimental/adaptivethreatmodeling/**"
+      - .github/workflows/js-ml-tests.yml
+
+defaults:
+  run:
+    working-directory: javascript/ql/experimental/adaptivethreatmodeling
+
+jobs:
+  qlformat:
+    name: Check QL formatting
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+
+      - uses: ./.github/actions/fetch-codeql
+
+      - name: Check QL formatting
+        run: |
+          find . "(" -name "*.ql" -or -name "*.qll" ")" -print0 | \
+            xargs -0 codeql query format --check-only
+
+  qlcompile:
+    name: Check QL compilation
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+
+      - uses: ./.github/actions/fetch-codeql
+
+      - name: Install pack dependencies
+        run: |
+          for pack in modelbuilding src; do
+            codeql pack install --mode verify -- "${pack}"
+          done
+
+      - name: Check QL compilation
+        run: |
+          codeql query compile \
+            --check-only \
+            --ram 5120 \
+            --additional-packs "${{ github.workspace }}" \
+            --threads=0 \
+            -- \
+            lib modelbuilding src
+
+  qltest:
+    name: Run QL tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+
+      - uses: ./.github/actions/fetch-codeql
+
+      - name: Install pack dependencies
+        run: codeql pack install -- test
+
+      - name: Run QL tests
+        run: |
+          codeql test run \
+            --threads=0 \
+            --ram 5120 \
+            --additional-packs "${{ github.workspace }}" \
+            -- \
+            test

.github/workflows/mad_modelDiff.yml

@@ -0,0 +1,103 @@
+name: Models as Data - Diff
+
+on:
+  workflow_dispatch:
+    inputs:
+      projects:
+        description: "The projects to generate models for"
+        required: true
+        default: '["netty/netty"]'
+  pull_request:
+    branches:
+      - main
+    paths:
+      - "java/ql/src/utils/model-generator/**/*.*"
+      - ".github/workflows/mad_modelDiff.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  model-diff:
+    name: Model Difference
+    runs-on: ubuntu-latest
+    if: github.repository == 'github/codeql'
+    strategy:
+      matrix:
+        slug: ${{fromJson(github.event.inputs.projects || '["apache/commons-codec", "apache/commons-io", "apache/commons-beanutils", "apache/commons-logging", "apache/commons-fileupload", "apache/commons-lang", "apache/commons-validator", "apache/commons-csv", "apache/dubbo"]' )}}
+    steps:
+      - name: Clone github/codeql from PR
+        uses: actions/checkout@v2
+        if: github.event.pull_request
+        with:
+          path: codeql-pr
+      - name: Clone github/codeql from main
+        uses: actions/checkout@v2
+        with:
+          path: codeql-main
+          ref: main
+      - uses: ./codeql-main/.github/actions/fetch-codeql
+      - name: Download database
+        env:
+          SLUG: ${{ matrix.slug }}
+        run: |
+          set -x
+          mkdir lib-dbs
+          SHORTNAME=${SLUG//[^a-zA-Z0-9_]/}
+          projectId=`curl -s https://lgtm.com/api/v1.0/projects/g/${SLUG} | jq .id`
+          curl -L "https://lgtm.com/api/v1.0/snapshots/$projectId/java" -o "$SHORTNAME.zip"
+          unzip -q -d "${SHORTNAME}-db" "${SHORTNAME}.zip"
+          mkdir "lib-dbs/$SHORTNAME/"
+          mv "${SHORTNAME}-db/"$(ls -1 "${SHORTNAME}"-db)/* "lib-dbs/${SHORTNAME}/"
+      - name: Generate Models (PR and main)
+        run: |
+          set -x
+          mkdir tmp-models
+          MODELS=`pwd`/tmp-models
+          DATABASES=`pwd`/lib-dbs
+
+          analyzeDatabaseWithCheckout() {
+            QL_VARIANT=$1
+            DATABASE=$2
+            cd codeql-$QL_VARIANT
+            SHORTNAME=`basename $DATABASE`
+            python java/ql/src/utils/model-generator/GenerateFlowModel.py $DATABASE $MODELS/${SHORTNAME}.qll
+            mv $MODELS/${SHORTNAME}.qll $MODELS/${SHORTNAME}Generated_${QL_VARIANT}.qll
+            cd ..
+          }
+
+          for d in $DATABASES/*/ ; do
+            ls -1 "$d"
+
+            analyzeDatabaseWithCheckout "main" $d
+            if [[ "$GITHUB_EVENT_NAME" == "pull_request" ]]
+            then
+              analyzeDatabaseWithCheckout "pr" $d
+            fi
+          done
+      - name: Install diff2html
+        if: github.event.pull_request
+        run: |
+          npm install -g diff2html-cli
+      - name: Generate Model Diff
+        if: github.event.pull_request
+        run: |
+          set -x
+          MODELS=`pwd`/tmp-models
+          ls -1 tmp-models/
+          for m in $MODELS/*_main.qll ; do
+            t="${m/main/"pr"}"
+            basename=`basename $m`
+            name="diff_${basename/_main.qll/""}"
+            (diff -w -u $m $t | diff2html -i stdin -F $MODELS/$name.html) || true
+          done
+      - uses: actions/upload-artifact@v2
+        with:
+          name: models
+          path: tmp-models/*.qll
+          retention-days: 20
+      - uses: actions/upload-artifact@v2
+        with:
+          name: diffs
+          path: tmp-models/*.html
+          retention-days: 20

.github/workflows/mad_regenerate-models.yml

@@ -0,0 +1,62 @@
+name: Regenerate framework models
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "30 2 * * *"
+  pull_request:
+    branches:
+      - main
+    paths:
+      - ".github/workflows/mad_regenerate-models.yml"
+
+jobs:
+  regenerate-models:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        # placeholder required for each axis, excluded below, replaced by the actual combinations (see include)
+        slug: ["placeholder"]
+        ref: ["placeholder"]
+        include:
+          - slug: "apache/commons-io"
+            ref: "8985de8fe74f6622a419b37a6eed0dbc484dc128"
+        exclude:
+          - slug: "placeholder"
+            ref: "placeholder"
+    steps:
+      - name: Clone self (github/codeql)
+        uses: actions/checkout@v2
+      - name: Setup CodeQL binaries
+        uses: ./.github/actions/fetch-codeql
+      - name: Clone repositories
+        uses: actions/checkout@v2
+        with:
+          path: repos/${{ matrix.ref }}
+          ref: ${{ matrix.ref }}
+          repository: ${{ matrix.slug }}
+      - name: Build database
+        env:
+          SLUG: ${{ matrix.slug }}
+          REF: ${{ matrix.ref }}
+        run: |
+          mkdir dbs
+          cd repos/${REF}
+          SHORTNAME=${SLUG//[^a-zA-Z0-9_]/}
+          codeql database create --language=java ../../dbs/${SHORTNAME}
+      - name: Regenerate models in-place
+        env:
+          SLUG: ${{ matrix.slug }}
+        run: |
+          SHORTNAME=${SLUG//[^a-zA-Z0-9_]/}
+          java/ql/src/utils/model-generator/RegenerateModels.py "${SLUG}" dbs/${SHORTNAME}
+      - name: Stage changes
+        run: |
+          find java -name "*.qll" -print0 | xargs -0 git add
+          git status
+          git diff --cached > models.patch
+      - uses: actions/upload-artifact@v2
+        with:
+          name: patch
+          path: models.patch
+          retention-days: 7

.github/workflows/ql-for-ql-build.yml

@@ -31,13 +31,13 @@ jobs:
         uses: actions/cache@v2
         with:
           path: ${{ runner.temp }}/query-pack.zip
-          key: queries-${{ hashFiles('ql/**/*.ql*') }}-${{ hashFiles('ql/ql/src/ql.dbscheme*') }}-${{ steps.get-codeql-version.outputs.version }}
+          key: queries-${{ hashFiles('ql/**/*.ql*') }}-${{ hashFiles('ql/**/qlpack.yml') }}-${{ hashFiles('ql/ql/src/ql.dbscheme*') }}-${{ steps.get-codeql-version.outputs.version }}
       - name: Build query pack
         if: steps.cache-queries.outputs.cache-hit != 'true'
         run: |
           cd ql/ql/src
           "${CODEQL}" pack create
-          cd .codeql/pack/codeql/ql-all/0.0.0
+          cd .codeql/pack/codeql/ql/0.0.0
           zip "${PACKZIP}" -r .
         env:
           CODEQL: ${{ steps.find-codeql.outputs.codeql-path }}
@@ -189,4 +189,11 @@ jobs:
         uses: github/codeql-action/analyze@erik-krogh/ql
         with: 
           category: "ql-for-ql-${{ matrix.folder }}"
+      - name: Copy sarif file to CWD
+        run: cp ../results/ql.sarif ./${{ matrix.folder }}.sarif
+      - name: Sarif as artifact
+        uses: actions/upload-artifact@v2
+        with:
+          name: ${{ matrix.folder }}.sarif
+          path: ${{ matrix.folder }}.sarif
 

.github/workflows/ql-for-ql-dataset_measure.yml

@@ -17,7 +17,7 @@ jobs:
       CODEQL_THREADS: 4 # TODO: remove this once it's set by the CLI
     strategy:
       matrix:
-        repo: 
+        repo:
           - github/codeql
           - github/codeql-go
     runs-on: ubuntu-latest
@@ -35,7 +35,7 @@ jobs:
             ~/.cargo/registry
             ~/.cargo/git
             ql/target
-          key: ${{ runner.os }}-qltest-cargo-${{ hashFiles('**/Cargo.lock') }}
+          key: ${{ runner.os }}-qltest-cargo-${{ hashFiles('ql/**/Cargo.lock') }}
       - name: Build Extractor
         run: cd ql; env "PATH=$PATH:`dirname ${CODEQL}`" ./create-extractor-pack.sh
         env:

.github/workflows/ql-for-ql-tests.yml

@@ -29,24 +29,24 @@ jobs:
             ~/.cargo/registry
             ~/.cargo/git
             ql/target
-          key: ${{ runner.os }}-qltest-cargo-${{ hashFiles('**/Cargo.lock') }}
+          key: ${{ runner.os }}-qltest-cargo-${{ hashFiles('ql/**/Cargo.lock') }}
       - name: Build extractor
         run: |
           cd ql;
           codeqlpath=$(dirname ${{ steps.find-codeql.outputs.codeql-path }});
           env "PATH=$PATH:$codeqlpath" ./create-extractor-pack.sh
       - name: Run QL tests
-        run: | 
+        run: |
           "${CODEQL}" test run --check-databases --check-unused-labels --check-repeated-labels --check-redefined-labels --check-use-before-definition --search-path "${{ github.workspace }}/ql/extractor-pack" --consistency-queries ql/ql/consistency-queries ql/ql/test
         env:
           CODEQL: ${{ steps.find-codeql.outputs.codeql-path }}
       - name: Check QL formatting
-        run: | 
+        run: |
           find ql/ql "(" -name "*.ql" -or -name "*.qll" ")" -print0 | xargs -0 "${CODEQL}" query format --check-only
         env:
           CODEQL: ${{ steps.find-codeql.outputs.codeql-path }}
       - name: Check QL compilation
-        run: | 
+        run: |
           "${CODEQL}" query compile --check-only --threads=4 --warnings=error --search-path "${{ github.workspace }}/ql/extractor-pack" "ql/ql/src" "ql/ql/examples"
         env:
           CODEQL: ${{ steps.find-codeql.outputs.codeql-path }}

.github/workflows/ruby-build.yml

@@ -50,7 +50,7 @@ jobs:
             ~/.cargo/registry
             ~/.cargo/git
             ruby/target
-          key: ${{ runner.os }}-rust-cargo-${{ hashFiles('**/Cargo.lock') }}
+          key: ${{ runner.os }}-ruby-rust-cargo-${{ hashFiles('ruby/rust-toolchain.toml', 'ruby/**/Cargo.lock') }}
       - name: Check formatting
         run: cargo fmt --all -- --check
       - name: Build

.github/workflows/ruby-qltest.yml

@@ -24,27 +24,53 @@ defaults:
     working-directory: ruby
 
 jobs:
-  qltest:
+  qlformat:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
       - uses: ./.github/actions/fetch-codeql
-      - uses: ./ruby/actions/create-extractor-pack
-      - name: Run QL tests
-        run: |
-          codeql test run --search-path "${{ github.workspace }}/ruby/extractor-pack" --check-databases --check-unused-labels --check-repeated-labels --check-redefined-labels --check-use-before-definition --consistency-queries ql/consistency-queries ql/test
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
       - name: Check QL formatting
         run: find ql "(" -name "*.ql" -or -name "*.qll" ")" -print0 | xargs -0 codeql query format --check-only
+  qlcompile:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - uses: ./.github/actions/fetch-codeql
       - name: Check QL compilation
         run: |
-          codeql query compile --check-only --threads=4 --warnings=error "ql/src" "ql/examples"
+          codeql query compile --check-only --threads=0 --ram 5000 --warnings=error "ql/src" "ql/examples"
         env:
           GITHUB_TOKEN: ${{ github.token }}
+  qlupgrade:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - uses: ./.github/actions/fetch-codeql
       - name: Check DB upgrade scripts
         run: |
           echo >empty.trap
           codeql dataset import -S ql/lib/upgrades/initial/ruby.dbscheme testdb empty.trap
           codeql dataset upgrade testdb --additional-packs ql/lib
           diff -q testdb/ruby.dbscheme ql/lib/ruby.dbscheme
+      - name: Check DB downgrade scripts
+        run: |
+          echo >empty.trap
+          rm -rf testdb; codeql dataset import -S ql/lib/ruby.dbscheme testdb empty.trap
+          codeql resolve upgrades --format=lines --allow-downgrades --additional-packs downgrades \
+           --dbscheme=ql/lib/ruby.dbscheme --target-dbscheme=downgrades/initial/ruby.dbscheme |
+           xargs codeql execute upgrades testdb
+          diff -q testdb/ruby.dbscheme downgrades/initial/ruby.dbscheme
+  qltest:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        slice: ["1/2", "2/2"]
+    steps:
+      - uses: actions/checkout@v2
+      - uses: ./.github/actions/fetch-codeql
+      - uses: ./ruby/actions/create-extractor-pack
+      - name: Run QL tests
+        run: |
+          codeql test run --threads=0 --ram 5000 --slice ${{ matrix.slice }} --search-path "${{ github.workspace }}/ruby/extractor-pack" --check-databases --check-unused-labels --check-repeated-labels --check-redefined-labels --check-use-before-definition --consistency-queries ql/consistency-queries ql/test
+        env:
+          GITHUB_TOKEN: ${{ github.token }}

.github/workflows/validate-change-notes.yml

@@ -0,0 +1,29 @@
+name: Validate change notes
+
+on:
+  push:
+    paths:
+      - "*/ql/*/change-notes/**/*"
+      - ".github/workflows/validate-change-notes.yml"
+    branches:
+      - main
+      - "rc/*"
+  pull_request:
+    paths:
+      - "*/ql/*/change-notes/**/*"
+      - ".github/workflows/validate-change-notes.yml"
+
+jobs:
+  check-change-note:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v2
+
+      - name: Setup CodeQL
+        uses: ./.github/actions/fetch-codeql
+
+      - name: Fail if there are any errors with existing change notes
+
+        run: |
+          codeql pack release --groups cpp,csharp,java,javascript,python,ruby,-examples,-test,-experimental

CODEOWNERS

@@ -13,6 +13,9 @@
 /python/**/experimental/**/* @github/codeql-python @xcorail
 /ruby/**/experimental/**/* @github/codeql-ruby @xcorail
 
+# ML-powered queries
+/javascript/ql/experimental/adaptivethreatmodeling/ @github/codeql-ml-powered-queries-reviewers
+
 # Notify members of codeql-go about PRs to the shared data-flow library files
 /java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl.qll @github/codeql-java @github/codeql-go
 /java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl2.qll @github/codeql-java @github/codeql-go
@@ -27,4 +30,4 @@
 /docs/query-*-style-guide.md @github/codeql-analysis-reviewers
 
 # QL for QL reviewers
-/ql/ @github/codeql-ql-for-ql-reviewers
+/ql/ @github/codeql-ql-for-ql-reviewers

config/identical-files.json

@@ -465,7 +465,8 @@
   ],
   "SensitiveDataHeuristics Python/JS": [
     "javascript/ql/lib/semmle/javascript/security/internal/SensitiveDataHeuristics.qll",
-    "python/ql/lib/semmle/python/security/internal/SensitiveDataHeuristics.qll"
+    "python/ql/lib/semmle/python/security/internal/SensitiveDataHeuristics.qll",
+    "ruby/ql/lib/codeql/ruby/security/internal/SensitiveDataHeuristics.qll"
   ],
   "ReDoS Util Python/JS/Ruby": [
     "javascript/ql/lib/semmle/javascript/security/performance/ReDoSUtil.qll",
@@ -501,5 +502,11 @@
     "javascript/ql/lib/tutorial.qll",
     "python/ql/lib/tutorial.qll",
     "ruby/ql/lib/tutorial.qll"
+  ],
+  "AccessPathSyntax": [
+    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/AccessPathSyntax.qll",
+    "java/ql/lib/semmle/code/java/dataflow/internal/AccessPathSyntax.qll",
+    "javascript/ql/lib/semmle/javascript/frameworks/data/internal/AccessPathSyntax.qll",
+    "ruby/ql/lib/codeql/ruby/dataflow/internal/AccessPathSyntax.qll"
   ]
 }

cpp/autobuilder/Semmle.Autobuild.Cpp.Tests/Semmle.Autobuild.Cpp.Tests.csproj

@@ -2,7 +2,7 @@
 
   <PropertyGroup>
     <OutputType>Exe</OutputType>
-    <TargetFramework>net5.0</TargetFramework>
+    <TargetFramework>net6.0</TargetFramework>
     <GenerateAssemblyInfo>false</GenerateAssemblyInfo>
     <RuntimeIdentifiers>win-x64;linux-x64;osx-x64</RuntimeIdentifiers>
     <Nullable>enable</Nullable>

cpp/autobuilder/Semmle.Autobuild.Cpp/Semmle.Autobuild.Cpp.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
-    <TargetFramework>net5.0</TargetFramework>
+    <TargetFramework>net6.0</TargetFramework>
     <AssemblyName>Semmle.Autobuild.Cpp</AssemblyName>
     <RootNamespace>Semmle.Autobuild.Cpp</RootNamespace>
     <ApplicationIcon />

cpp/downgrades/2cd420191e5f782589b4e4efb70127de265390dd/upgrade.properties

@@ -0,0 +1,2 @@
+description: Remove unused legacy relations
+compatibility: backwards

cpp/downgrades/bb0f279f2acd793105a347d589b5afc8715d94c4/upgrade.properties

@@ -0,0 +1,3 @@
+description: Add relation for tracking variables from structured binding declarations
+compatibility: full
+is_structured_binding.rel: delete

cpp/downgrades/qlpack.yml

@@ -0,0 +1,4 @@
+name: codeql/cpp-downgrades
+groups: cpp
+downgrades: .
+library: true

cpp/ql/examples/qlpack.yml

@@ -1,4 +1,6 @@
 name: codeql/cpp-examples
-version: 0.0.2
+groups: 
+  - cpp
+  - examples
 dependencies:
   codeql/cpp-all: "*"

cpp/ql/lib/CHANGELOG.md

@@ -1,3 +1,11 @@
+## 0.0.10
+
+### New Features
+
+* Added a `isStructuredBinding` predicate to the `Variable` class which holds when the variable is declared as part of a structured binding declaration.
+
+## 0.0.9
+
 ## 0.0.8
 
 ### Deprecated APIs

cpp/ql/lib/change-notes/released/0.0.10.md

@@ -0,0 +1,5 @@
+## 0.0.10
+
+### New Features
+
+* Added a `isStructuredBinding` predicate to the `Variable` class which holds when the variable is declared as part of a structured binding declaration.

cpp/ql/lib/change-notes/released/0.0.9.md

@@ -0,0 +1,2 @@
+## 0.0.9
+

cpp/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.0.8
+lastReleaseVersion: 0.0.10

cpp/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/cpp-all
-version: 0.0.8
+version: 0.0.10
 groups: cpp
 dbscheme: semmlecode.cpp.dbscheme
 extractor: cpp

cpp/ql/lib/semmle/code/cpp/Variable.qll

@@ -169,6 +169,12 @@ class Variable extends Declaration, @variable {
     variable_instantiation(underlyingElement(this), unresolveElement(v))
   }
 
+  /**
+   * Holds if this variable is declated as part of a structured binding
+   * declaration. For example, `x` in `auto [x, y] = ...`.
+   */
+  predicate isStructuredBinding() { is_structured_binding(underlyingElement(this)) }
+
   /**
    * Holds if this is a compiler-generated variable. For example, a
    * [range-based for loop](http://en.cppreference.com/w/cpp/language/range-for)

cpp/ql/lib/semmle/code/cpp/commons/unix/Constants.qll

@@ -11,10 +11,10 @@ import cpp
  */
 bindingset[input]
 int parseOctal(string input) {
-  input.charAt(0) = "0" and
+  input.regexpMatch("0[0-7]+") and
   result =
     strictsum(int ix |
-      ix in [0 .. input.length()]
+      ix in [1 .. input.length()]
     |
       8.pow(input.length() - (ix + 1)) * input.charAt(ix).toInt()
     )

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplCommon.qll

@@ -1290,7 +1290,7 @@ class DataFlowCallOption extends TDataFlowCallOption {
   }
 }
 
-/** Content tagged with the type of a containing object. */
+/** A `Content` tagged with the type of a containing object. */
 class TypedContent extends MkTypedContent {
   private Content c;
   private DataFlowType t;

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll

@@ -592,12 +592,14 @@ predicate simpleLocalFlowStep(Node nodeFrom, Node nodeTo) {
  * Holds if data flows from `source` to `sink` in zero or more local
  * (intra-procedural) steps.
  */
+pragma[inline]
 predicate localFlow(Node source, Node sink) { localFlowStep*(source, sink) }
 
 /**
  * Holds if data can flow from `e1` to `e2` in zero or more
  * local (intra-procedural) steps.
  */
+pragma[inline]
 predicate localExprFlow(Expr e1, Expr e2) { localFlow(exprNode(e1), exprNode(e2)) }
 
 /**

cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowVar.qll

@@ -353,9 +353,9 @@ module FlowVar_internal {
         // indirection.
         result = def.getAUse(v)
         or
-        exists(SsaDefinition descendentDef |
-          this.getASuccessorSsaVar+() = TSsaVar(descendentDef, _) and
-          result = descendentDef.getAUse(v)
+        exists(SsaDefinition descendantDef |
+          this.getASuccessorSsaVar+() = TSsaVar(descendantDef, _) and
+          result = descendantDef.getAUse(v)
         )
       )
       or

cpp/ql/lib/semmle/code/cpp/dataflow/internal/TaintTrackingUtil.qll

@@ -124,12 +124,14 @@ predicate localAdditionalTaintStep(DataFlow::Node nodeFrom, DataFlow::Node nodeT
  * Holds if taint may propagate from `source` to `sink` in zero or more local
  * (intra-procedural) steps.
  */
+pragma[inline]
 predicate localTaint(DataFlow::Node source, DataFlow::Node sink) { localTaintStep*(source, sink) }
 
 /**
  * Holds if taint can flow from `e1` to `e2` in zero or more
  * local (intra-procedural) steps.
  */
+pragma[inline]
 predicate localExprTaint(Expr e1, Expr e2) {
   localTaint(DataFlow::exprNode(e1), DataFlow::exprNode(e2))
 }

cpp/ql/lib/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll

@@ -1,3 +1,8 @@
+/**
+ * An IR taint tracking library that uses an IR DataFlow configuration to track
+ * taint from user inputs as defined by `semmle.code.cpp.security.Security`.
+ */
+
 import cpp
 import semmle.code.cpp.security.Security
 private import semmle.code.cpp.ir.dataflow.DataFlow

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplCommon.qll

@@ -1290,7 +1290,7 @@ class DataFlowCallOption extends TDataFlowCallOption {
   }
 }
 
-/** Content tagged with the type of a containing object. */
+/** A `Content` tagged with the type of a containing object. */
 class TypedContent extends MkTypedContent {
   private Content c;
   private DataFlowType t;

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll

@@ -1032,12 +1032,14 @@ SideEffectInstruction getSideEffectFor(CallInstruction call, int argument) {
  * Holds if data flows from `source` to `sink` in zero or more local
  * (intra-procedural) steps.
  */
+pragma[inline]
 predicate localFlow(Node source, Node sink) { localFlowStep*(source, sink) }
 
 /**
  * Holds if data can flow from `i1` to `i2` in zero or more
  * local (intra-procedural) steps.
  */
+pragma[inline]
 predicate localInstructionFlow(Instruction e1, Instruction e2) {
   localFlow(instructionNode(e1), instructionNode(e2))
 }
@@ -1046,6 +1048,7 @@ predicate localInstructionFlow(Instruction e1, Instruction e2) {
  * Holds if data can flow from `e1` to `e2` in zero or more
  * local (intra-procedural) steps.
  */
+pragma[inline]
 predicate localExprFlow(Expr e1, Expr e2) { localFlow(exprNode(e1), exprNode(e2)) }
 
 private newtype TContent =

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/TaintTrackingUtil.qll

@@ -121,12 +121,14 @@ private predicate operandToInstructionTaintStep(Operand opFrom, Instruction inst
  * Holds if taint may propagate from `source` to `sink` in zero or more local
  * (intra-procedural) steps.
  */
+pragma[inline]
 predicate localTaint(DataFlow::Node source, DataFlow::Node sink) { localTaintStep*(source, sink) }
 
 /**
  * Holds if taint can flow from `i1` to `i2` in zero or more
  * local (intra-procedural) steps.
  */
+pragma[inline]
 predicate localInstructionTaint(Instruction i1, Instruction i2) {
   localTaint(DataFlow::instructionNode(i1), DataFlow::instructionNode(i2))
 }
@@ -135,6 +137,7 @@ predicate localInstructionTaint(Instruction i1, Instruction i2) {
  * Holds if taint can flow from `e1` to `e2` in zero or more
  * local (intra-procedural) steps.
  */
+pragma[inline]
 predicate localExprTaint(Expr e1, Expr e2) {
   localTaint(DataFlow::exprNode(e1), DataFlow::exprNode(e2))
 }

cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/IRBlock.qll

@@ -200,7 +200,7 @@ class IRBlock extends IRBlockBase {
    * post-dominate block `B`, but block `A` does post-dominate an immediate successor of block `B`.
    */
   pragma[noinline]
-  final IRBlock postPominanceFrontier() {
+  final IRBlock postDominanceFrontier() {
     this.postDominates(result.getASuccessor()) and
     not this.strictlyPostDominates(result)
   }

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/IRBlock.qll

@@ -200,7 +200,7 @@ class IRBlock extends IRBlockBase {
    * post-dominate block `B`, but block `A` does post-dominate an immediate successor of block `B`.
    */
   pragma[noinline]
-  final IRBlock postPominanceFrontier() {
+  final IRBlock postDominanceFrontier() {
     this.postDominates(result.getASuccessor()) and
     not this.strictlyPostDominates(result)
   }

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedElement.qll

@@ -567,6 +567,13 @@ newtype TTranslatedElement =
   } or
   // The initialization of a base class from within a constructor.
   TTranslatedConstructorBaseInit(ConstructorBaseInit init) { not ignoreExpr(init) } or
+  // Workaround for a case where no base constructor is generated but a targetless base
+  // constructor call is present.
+  TTranslatedConstructorBareInit(ConstructorInit init) {
+    not ignoreExpr(init) and
+    not init instanceof ConstructorBaseInit and
+    not init instanceof ConstructorFieldInit
+  } or
   // The destruction of a base class from within a destructor.
   TTranslatedDestructorBaseDestruction(DestructorBaseDestruction destruction) {
     not ignoreExpr(destruction)

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedFunction.qll

@@ -573,6 +573,11 @@ class TranslatedConstructorInitList extends TranslatedElement, InitializationCon
       baseInit = func.(Constructor).getInitializer(id) and
       result = getTranslatedConstructorBaseInit(baseInit)
     )
+    or
+    exists(ConstructorInit bareInit |
+      bareInit = func.(Constructor).getInitializer(id) and
+      result = getTranslatedConstructorBareInit(bareInit)
+    )
   }
 
   override Instruction getFirstInstruction() {

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedInitialization.qll

@@ -917,3 +917,36 @@ class TranslatedDestructorBaseDestruction extends TranslatedBaseStructorCall,
 
   final override string toString() { result = "destroy base: " + call.toString() }
 }
+
+/**
+ * A constructor base init call where no base constructor has been generated.
+ *
+ * Workaround for an extractor issue.
+ */
+class TranslatedConstructorBareInit extends TranslatedElement, TTranslatedConstructorBareInit {
+  ConstructorInit init;
+
+  TranslatedConstructorBareInit() { this = TTranslatedConstructorBareInit(init) }
+
+  override Locatable getAST() { result = init }
+
+  final override string toString() { result = "construct base (no constructor)" }
+
+  override Instruction getFirstInstruction() { result = getParent().getChildSuccessor(this) }
+
+  override predicate hasInstruction(Opcode opcode, InstructionTag tag, CppType resultType) {
+    none()
+  }
+
+  override TranslatedElement getChild(int id) { none() }
+
+  override Function getFunction() { result = getParent().getFunction() }
+
+  override Instruction getInstructionSuccessor(InstructionTag tag, EdgeKind kind) { none() }
+
+  override Instruction getChildSuccessor(TranslatedElement child) { none() }
+}
+
+TranslatedConstructorBareInit getTranslatedConstructorBareInit(ConstructorInit init) {
+  result.getAST() = init
+}

cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/IRBlock.qll

@@ -200,7 +200,7 @@ class IRBlock extends IRBlockBase {
    * post-dominate block `B`, but block `A` does post-dominate an immediate successor of block `B`.
    */
   pragma[noinline]
-  final IRBlock postPominanceFrontier() {
+  final IRBlock postDominanceFrontier() {
     this.postDominates(result.getASuccessor()) and
     not this.strictlyPostDominates(result)
   }

cpp/ql/lib/semmle/code/cpp/models/implementations/Gets.qll

@@ -11,15 +11,14 @@ import semmle.code.cpp.models.interfaces.SideEffect
 import semmle.code.cpp.models.interfaces.FlowSource
 
 /**
- * The standard functions `gets` and `fgets`.
+ * The standard functions `fgets` and `fgetws`.
  */
-private class GetsFunction extends DataFlowFunction, TaintFunction, ArrayFunction, AliasFunction,
+private class FgetsFunction extends DataFlowFunction, TaintFunction, ArrayFunction, AliasFunction,
   SideEffectFunction, RemoteFlowSourceFunction {
-  GetsFunction() {
-    // gets(str)
+  FgetsFunction() {
     // fgets(str, num, stream)
     // fgetws(wstr, num, stream)
-    this.hasGlobalOrStdOrBslName(["gets", "fgets", "fgetws"])
+    this.hasGlobalOrStdOrBslName(["fgets", "fgetws"])
   }
 
   override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
@@ -51,20 +50,61 @@ private class GetsFunction extends DataFlowFunction, TaintFunction, ArrayFunctio
   override predicate hasRemoteFlowSource(FunctionOutput output, string description) {
     output.isParameterDeref(0) and
     description = "String read by " + this.getName()
+    or
+    output.isReturnValue() and
+    description = "String read by " + this.getName()
   }
 
   override predicate hasArrayWithVariableSize(int bufParam, int countParam) {
-    not this.hasName("gets") and
     bufParam = 0 and
     countParam = 1
   }
 
-  override predicate hasArrayWithUnknownSize(int bufParam) {
-    this.hasName("gets") and
-    bufParam = 0
-  }
-
   override predicate hasArrayOutput(int bufParam) { bufParam = 0 }
 
-  override predicate hasSocketInput(FunctionInput input) { input.isParameter(2) }
+  override predicate hasSocketInput(FunctionInput input) { input.isParameterDeref(2) }
+}
+
+/**
+ * The standard functions `gets`.
+ */
+private class GetsFunction extends DataFlowFunction, ArrayFunction, AliasFunction,
+  SideEffectFunction, LocalFlowSourceFunction {
+  GetsFunction() {
+    // gets(str)
+    this.hasGlobalOrStdOrBslName("gets")
+  }
+
+  override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
+    input.isParameter(0) and
+    output.isReturnValue()
+  }
+
+  override predicate parameterNeverEscapes(int index) { none() }
+
+  override predicate parameterEscapesOnlyViaReturn(int index) { index = 0 }
+
+  override predicate parameterIsAlwaysReturned(int index) { index = 0 }
+
+  override predicate hasOnlySpecificReadSideEffects() { any() }
+
+  override predicate hasOnlySpecificWriteSideEffects() { any() }
+
+  override predicate hasSpecificWriteSideEffect(ParameterIndex i, boolean buffer, boolean mustWrite) {
+    i = 0 and
+    buffer = true and
+    mustWrite = true
+  }
+
+  override predicate hasLocalFlowSource(FunctionOutput output, string description) {
+    output.isParameterDeref(0) and
+    description = "String read by " + this.getName()
+    or
+    output.isReturnValue() and
+    description = "String read by " + this.getName()
+  }
+
+  override predicate hasArrayWithUnknownSize(int bufParam) { bufParam = 0 }
+
+  override predicate hasArrayOutput(int bufParam) { bufParam = 0 }
 }

cpp/ql/lib/semmle/code/cpp/security/TaintTracking.qll

@@ -1,7 +1,10 @@
 /*
- * Support for tracking tainted data through the program.
+ * Support for tracking tainted data through the program. This is an alias for
+ * `semmle.code.cpp.ir.dataflow.DefaultTaintTracking` provided for backwards
+ * compatibility.
  *
- * Prefer to use `semmle.code.cpp.dataflow.TaintTracking` when designing new queries.
+ * Prefer to use `semmle.code.cpp.dataflow.TaintTracking` or
+ * `semmle.code.cpp.ir.dataflow.TaintTracking` when designing new queries.
  */
 
 import semmle.code.cpp.ir.dataflow.DefaultTaintTracking

cpp/ql/lib/semmlecode.cpp.dbscheme

@@ -135,52 +135,11 @@ externalData(
     string value : string ref
 );
 
-/**
- * The date of the snapshot.
- */
-snapshotDate(unique date snapshotDate : date ref);
-
 /**
  * The source location of the snapshot.
  */
 sourceLocationPrefix(string prefix : string ref);
 
-/**
- * Data used by the 'duplicate code' detection.
- */
-duplicateCode(
-    unique int id : @duplication,
-    string relativePath : string ref,
-    int equivClass : int ref
-);
-
-/**
- * Data used by the 'similar code' detection.
- */
-similarCode(
-    unique int id : @similarity,
-    string relativePath : string ref,
-    int equivClass : int ref
-);
-
-/**
- * Data used by the 'duplicate code' and 'similar code' detection.
- */
-@duplication_or_similarity = @duplication | @similarity
-
-/**
- * Data used by the 'duplicate code' and 'similar code' detection.
- */
-#keyset[id, offset]
-tokens(
-    int id : @duplication_or_similarity ref,
-    int offset : int ref,
-    int beginLine : int ref,
-    int beginColumn : int ref,
-    int endLine : int ref,
-    int endColumn : int ref
-);
-
 /**
  * Information about packages that provide code used during compilation.
  * The `id` is just a unique identifier.
@@ -487,6 +446,7 @@ var_decl_specifiers(
     int id: @var_decl ref,
     string name: string ref
 )
+is_structured_binding(unique int id: @variable ref);
 
 type_decls(
     unique int id: @type_decl,

cpp/ql/lib/tutorial.qll

@@ -6,122 +6,22 @@
  */
 class Person extends string {
   Person() {
-    this = "Ronil" or
-    this = "Dina" or
-    this = "Ravi" or
-    this = "Bruce" or
-    this = "Jo" or
-    this = "Aida" or
-    this = "Esme" or
-    this = "Charlie" or
-    this = "Fred" or
-    this = "Meera" or
-    this = "Maya" or
-    this = "Chad" or
-    this = "Tiana" or
-    this = "Laura" or
-    this = "George" or
-    this = "Will" or
-    this = "Mary" or
-    this = "Almira" or
-    this = "Susannah" or
-    this = "Rhoda" or
-    this = "Cynthia" or
-    this = "Eunice" or
-    this = "Olive" or
-    this = "Virginia" or
-    this = "Angeline" or
-    this = "Helen" or
-    this = "Cornelia" or
-    this = "Harriet" or
-    this = "Mahala" or
-    this = "Abby" or
-    this = "Margaret" or
-    this = "Deb" or
-    this = "Minerva" or
-    this = "Severus" or
-    this = "Lavina" or
-    this = "Adeline" or
-    this = "Cath" or
-    this = "Elisa" or
-    this = "Lucretia" or
-    this = "Anne" or
-    this = "Eleanor" or
-    this = "Joanna" or
-    this = "Adam" or
-    this = "Agnes" or
-    this = "Rosanna" or
-    this = "Clara" or
-    this = "Melissa" or
-    this = "Amy" or
-    this = "Isabel" or
-    this = "Jemima" or
-    this = "Cordelia" or
-    this = "Melinda" or
-    this = "Delila" or
-    this = "Jeremiah" or
-    this = "Elijah" or
-    this = "Hester" or
-    this = "Walter" or
-    this = "Oliver" or
-    this = "Hugh" or
-    this = "Aaron" or
-    this = "Reuben" or
-    this = "Eli" or
-    this = "Amos" or
-    this = "Augustus" or
-    this = "Theodore" or
-    this = "Ira" or
-    this = "Timothy" or
-    this = "Cyrus" or
-    this = "Horace" or
-    this = "Simon" or
-    this = "Asa" or
-    this = "Frank" or
-    this = "Nelson" or
-    this = "Leonard" or
-    this = "Harrison" or
-    this = "Anthony" or
-    this = "Louis" or
-    this = "Milton" or
-    this = "Noah" or
-    this = "Cornelius" or
-    this = "Abdul" or
-    this = "Warren" or
-    this = "Harvey" or
-    this = "Dennis" or
-    this = "Wesley" or
-    this = "Sylvester" or
-    this = "Gilbert" or
-    this = "Sullivan" or
-    this = "Edmund" or
-    this = "Wilson" or
-    this = "Perry" or
-    this = "Matthew" or
-    this = "Simba" or
-    this = "Nala" or
-    this = "Rafiki" or
-    this = "Shenzi" or
-    this = "Ernest" or
-    this = "Gertrude" or
-    this = "Oscar" or
-    this = "Lilian" or
-    this = "Raymond" or
-    this = "Elgar" or
-    this = "Elmer" or
-    this = "Herbert" or
-    this = "Maude" or
-    this = "Mae" or
-    this = "Otto" or
-    this = "Edwin" or
-    this = "Ophelia" or
-    this = "Parsley" or
-    this = "Sage" or
-    this = "Rosemary" or
-    this = "Thyme" or
-    this = "Garfunkel" or
-    this = "King Basil" or
-    this = "Stephen"
+    this =
+      [
+        "Ronil", "Dina", "Ravi", "Bruce", "Jo", "Aida", "Esme", "Charlie", "Fred", "Meera", "Maya",
+        "Chad", "Tiana", "Laura", "George", "Will", "Mary", "Almira", "Susannah", "Rhoda",
+        "Cynthia", "Eunice", "Olive", "Virginia", "Angeline", "Helen", "Cornelia", "Harriet",
+        "Mahala", "Abby", "Margaret", "Deb", "Minerva", "Severus", "Lavina", "Adeline", "Cath",
+        "Elisa", "Lucretia", "Anne", "Eleanor", "Joanna", "Adam", "Agnes", "Rosanna", "Clara",
+        "Melissa", "Amy", "Isabel", "Jemima", "Cordelia", "Melinda", "Delila", "Jeremiah", "Elijah",
+        "Hester", "Walter", "Oliver", "Hugh", "Aaron", "Reuben", "Eli", "Amos", "Augustus",
+        "Theodore", "Ira", "Timothy", "Cyrus", "Horace", "Simon", "Asa", "Frank", "Nelson",
+        "Leonard", "Harrison", "Anthony", "Louis", "Milton", "Noah", "Cornelius", "Abdul", "Warren",
+        "Harvey", "Dennis", "Wesley", "Sylvester", "Gilbert", "Sullivan", "Edmund", "Wilson",
+        "Perry", "Matthew", "Simba", "Nala", "Rafiki", "Shenzi", "Ernest", "Gertrude", "Oscar",
+        "Lilian", "Raymond", "Elgar", "Elmer", "Herbert", "Maude", "Mae", "Otto", "Edwin",
+        "Ophelia", "Parsley", "Sage", "Rosemary", "Thyme", "Garfunkel", "King Basil", "Stephen"
+      ]
   }
 
   /** Gets the hair color of the person. If the person is bald, there is no result. */
@@ -936,25 +836,12 @@ class Person extends string {
 
   /** Holds if the person is deceased. */
   predicate isDeceased() {
-    this = "Ernest" or
-    this = "Gertrude" or
-    this = "Oscar" or
-    this = "Lilian" or
-    this = "Edwin" or
-    this = "Raymond" or
-    this = "Elgar" or
-    this = "Elmer" or
-    this = "Herbert" or
-    this = "Maude" or
-    this = "Mae" or
-    this = "Otto" or
-    this = "Ophelia" or
-    this = "Parsley" or
-    this = "Sage" or
-    this = "Rosemary" or
-    this = "Thyme" or
-    this = "Garfunkel" or
-    this = "King Basil"
+    this =
+      [
+        "Ernest", "Gertrude", "Oscar", "Lilian", "Edwin", "Raymond", "Elgar", "Elmer", "Herbert",
+        "Maude", "Mae", "Otto", "Ophelia", "Parsley", "Sage", "Rosemary", "Thyme", "Garfunkel",
+        "King Basil"
+      ]
   }
 
   /** Gets a parent of the person (alive or deceased). */
@@ -1195,12 +1082,7 @@ class Person extends string {
   }
 
   /** Holds if the person is allowed in the region. Initially, all villagers are allowed in every region. */
-  predicate isAllowedIn(string region) {
-    region = "north" or
-    region = "south" or
-    region = "east" or
-    region = "west"
-  }
+  predicate isAllowedIn(string region) { region = ["north", "south", "east", "west"] }
 }
 
 /** Returns a parent of the person. */

cpp/ql/lib/upgrades/018f430097e80bcf4b2786c989dae94b7d82b819/upgrade.properties

@@ -0,0 +1,6 @@
+description: Remove unused legacy relations
+compatibility: full
+snapshotDate.rel: delete
+duplicateCode.rel: delete
+similarCode.rel: delete
+tokens.rel: delete

cpp/ql/lib/upgrades/2cd420191e5f782589b4e4efb70127de265390dd/upgrade.properties

@@ -0,0 +1,2 @@
+description: Add relation for tracking variables from structured binding declarations
+compatibility: backwards

cpp/ql/src/Best Practices/Hiding/DeclarationHidesVariable.ql

@@ -18,7 +18,6 @@ where
   not lv1.isCompilerGenerated() and
   not lv2.isCompilerGenerated() and
   not lv1.getParentScope().(BlockStmt).isInMacroExpansion() and
-  not lv2.getParentScope().(BlockStmt).isInMacroExpansion() and
-  not lv1.getName() = "(unnamed local variable)"
+  not lv2.getParentScope().(BlockStmt).isInMacroExpansion()
 select lv1, "Variable " + lv1.getName() + " hides another variable of the same name (on $@).", lv2,
   "line " + lv2.getLocation().getStartLine().toString()

cpp/ql/src/CHANGELOG.md

@@ -1,3 +1,23 @@
+## 0.0.10
+
+### Deprecated Classes
+
+* The `CodeDuplication.Copy`, `CodeDuplication.DuplicateBlock`, and `CodeDuplication.SimilarBlock` classes have been deprecated.
+
+## 0.0.9
+
+### New Queries
+
+* Added a new query, `cpp/open-call-with-mode-argument`, to detect when `open` or `openat` is called with the `O_CREAT` or `O_TMPFILE` flag but when the `mode` argument is omitted.
+
+### Minor Analysis Improvements
+
+* The "Cleartext transmission of sensitive information" (`cpp/cleartext-transmission`) query has been further improved to reduce false positive results, and upgraded from `medium` to `high` precision.
+* The "Cleartext transmission of sensitive information" (`cpp/cleartext-transmission`) query now finds more results, where a password is stored in a struct field or class member variable.
+* The `cpp/cleartext-storage-file` query has been improved, removing false positives where data is written to a standard output stream.
+* The `cpp/cleartext-storage-buffer` query has been updated to use the `semmle.code.cpp.dataflow.TaintTracking` library.
+* The `cpp/world-writable-file-creation` query now only detects `open` and `openat` calls with the `O_CREAT` or `O_TMPFILE` flag.
+
 ## 0.0.8
 
 ### New Queries

cpp/ql/src/Likely Bugs/Memory Management/ReturnStackAllocatedMemory.ql

@@ -14,6 +14,9 @@
  */
 
 import cpp
+// We don't actually use the global value numbering library in this query, but without it we end up
+// recomputing the IR.
+private import semmle.code.cpp.valuenumbering.GlobalValueNumbering
 import semmle.code.cpp.ir.IR
 import semmle.code.cpp.ir.dataflow.DataFlow::DataFlow
 

cpp/ql/src/Security/CWE/CWE-311/CleartextBufferWrite.ql

@@ -12,23 +12,33 @@
  */
 
 import cpp
-import semmle.code.cpp.security.BufferWrite
-import semmle.code.cpp.security.TaintTracking
+import semmle.code.cpp.security.BufferWrite as BufferWrite
 import semmle.code.cpp.security.SensitiveExprs
-import TaintedWithPath
+import semmle.code.cpp.security.FlowSources
+import semmle.code.cpp.ir.dataflow.TaintTracking
+import DataFlow::PathGraph
 
-class Configuration extends TaintTrackingConfiguration {
-  override predicate isSink(Element tainted) { exists(BufferWrite w | w.getASource() = tainted) }
+/**
+ * Taint flow from user input to a buffer write.
+ */
+class ToBufferConfiguration extends TaintTracking::Configuration {
+  ToBufferConfiguration() { this = "ToBufferConfiguration" }
+
+  override predicate isSource(DataFlow::Node source) { source instanceof FlowSource }
+
+  override predicate isSink(DataFlow::Node sink) {
+    exists(BufferWrite::BufferWrite w | w.getASource() = sink.asExpr())
+  }
 }
 
 from
-  BufferWrite w, Expr taintedArg, Expr taintSource, PathNode sourceNode, PathNode sinkNode,
-  string taintCause, SensitiveExpr dest
+  ToBufferConfiguration config, BufferWrite::BufferWrite w, DataFlow::PathNode sourceNode,
+  DataFlow::PathNode sinkNode, FlowSource source, SensitiveExpr dest
 where
-  taintedWithPath(taintSource, taintedArg, sourceNode, sinkNode) and
-  isUserInput(taintSource, taintCause) and
-  w.getASource() = taintedArg and
+  config.hasFlowPath(sourceNode, sinkNode) and
+  sourceNode.getNode() = source and
+  w.getASource() = sinkNode.getNode().asExpr() and
   dest = w.getDest()
 select w, sourceNode, sinkNode,
-  "This write into buffer '" + dest.toString() + "' may contain unencrypted data from $@",
-  taintSource, "user input (" + taintCause + ")"
+  "This write into buffer '" + dest.toString() + "' may contain unencrypted data from $@", source,
+  "user input (" + source.getSourceType() + ")"

cpp/ql/src/Security/CWE/CWE-311/CleartextFileWrite.ql

@@ -65,6 +65,7 @@ where
   midNode.getNode().asExpr() = mid and
   mid = w.getASource() and
   dest = w.getDest() and
+  not dest.(VariableAccess).getTarget().getName() = ["stdin", "stdout", "stderr"] and // exclude calls with standard streams
   not isFileName(globalValueNumber(source)) and // file names are not passwords
   not exists(string convChar | convChar = w.getSourceConvChar(mid) | not convChar = ["s", "S"]) // ignore things written with other conversion characters
 select w, sourceNode, midNode,

cpp/ql/src/Security/CWE/CWE-311/CleartextTransmission.ql

@@ -5,7 +5,7 @@
  * @kind path-problem
  * @problem.severity warning
  * @security-severity 7.5
- * @precision medium
+ * @precision high
  * @id cpp/cleartext-transmission
  * @tags security
  *       external/cwe/cwe-319
@@ -14,8 +14,8 @@
 import cpp
 import semmle.code.cpp.security.SensitiveExprs
 import semmle.code.cpp.dataflow.TaintTracking
-import semmle.code.cpp.valuenumbering.GlobalValueNumbering
 import semmle.code.cpp.models.interfaces.FlowSource
+import semmle.code.cpp.commons.File
 import DataFlow::PathGraph
 
 /**
@@ -27,6 +27,7 @@ class SensitiveNode extends DataFlow::Node {
     this.asExpr() = any(SensitiveVariable sv).getInitializer().getExpr() or
     this.asExpr().(VariableAccess).getTarget() =
       any(SensitiveVariable sv).(GlobalOrNamespaceVariable) or
+    this.asExpr().(VariableAccess).getTarget() = any(SensitiveVariable v | v instanceof Field) or
     this.asUninitialized() instanceof SensitiveVariable or
     this.asParameter() instanceof SensitiveVariable or
     this.asExpr().(FunctionCall).getTarget() instanceof SensitiveFunction
@@ -58,7 +59,10 @@ class Send extends SendRecv instanceof RemoteFlowSinkFunction {
     call.getTarget() = this and
     exists(FunctionInput input, int arg |
       super.hasSocketInput(input) and
-      input.isParameter(arg) and
+      (
+        input.isParameter(arg) or
+        input.isParameterDeref(arg)
+      ) and
       result = call.getArgument(arg)
     )
   }
@@ -81,7 +85,10 @@ class Recv extends SendRecv instanceof RemoteFlowSourceFunction {
     call.getTarget() = this and
     exists(FunctionInput input, int arg |
       super.hasSocketInput(input) and
-      input.isParameter(arg) and
+      (
+        input.isParameter(arg) or
+        input.isParameterDeref(arg)
+      ) and
       result = call.getArgument(arg)
     )
   }
@@ -114,24 +121,32 @@ abstract class NetworkSendRecv extends FunctionCall {
   NetworkSendRecv() {
     this.getTarget() = target and
     // exclude calls based on the socket...
-    not exists(GVN g |
-      g = globalValueNumber(target.getSocketExpr(this)) and
+    not exists(DataFlow::Node src, DataFlow::Node dest |
+      DataFlow::localFlow(src, dest) and
+      dest.asExpr() = target.getSocketExpr(this) and
       (
         // literal constant
-        globalValueNumber(any(Literal l)) = g
+        src.asExpr() instanceof Literal
         or
         // variable (such as a global) initialized to a literal constant
         exists(Variable v |
           v.getInitializer().getExpr() instanceof Literal and
-          g = globalValueNumber(v.getAnAccess())
+          src.asExpr() = v.getAnAccess()
         )
         or
         // result of a function call with literal inputs (likely constant)
+        forex(Expr arg | arg = src.asExpr().(FunctionCall).getAnArgument() | arg instanceof Literal)
+        or
+        // variable called `stdin`, `stdout` or `stderr`
+        src.asExpr().(VariableAccess).getTarget().getName() = ["stdin", "stdout", "stderr"]
+        or
+        // open of `"/dev/tty"`
         exists(FunctionCall fc |
-          forex(Expr arg | arg = fc.getAnArgument() | arg instanceof Literal) and
-          g = globalValueNumber(fc)
+          fopenCall(fc) and
+          fc.getAnArgument().getValue() = "/dev/tty" and
+          src.asExpr() = fc
         )
-        // (this is far from exhaustive)
+        // (this is not exhaustive)
       )
     )
   }
@@ -153,6 +168,16 @@ class NetworkRecv extends NetworkSendRecv {
   override Recv target;
 }
 
+pragma[noinline]
+predicate encryptionFunction(Function f) {
+  f.getName().toLowerCase().regexpMatch(".*(crypt|encode|decode|hash|securezero).*")
+}
+
+pragma[noinline]
+predicate encryptionType(UserType t) {
+  t.getName().toLowerCase().regexpMatch(".*(crypt|encode|decode|hash|securezero).*")
+}
+
 /**
  * An expression that is an argument or return value from an encryption /
  * decryption call. This is quite inclusive to minimize false positives, for
@@ -162,10 +187,7 @@ class NetworkRecv extends NetworkSendRecv {
 class Encrypted extends Expr {
   Encrypted() {
     exists(FunctionCall fc |
-      fc.getTarget()
-          .getName()
-          .toLowerCase()
-          .regexpMatch(".*(crypt|encode|decode|hash|securezero).*") and
+      encryptionFunction(fc.getTarget()) and
       (
         this = fc or
         this = fc.getAnArgument()
@@ -174,7 +196,7 @@ class Encrypted extends Expr {
     or
     exists(Type t |
       this.getType().refersTo(t) and
-      t.getName().toLowerCase().regexpMatch(".*(crypt|encode|decode|hash|securezero).*")
+      encryptionType(t)
     )
   }
 }

cpp/ql/src/Security/CWE/CWE-732/DoNotCreateWorldWritable.ql

@@ -12,17 +12,16 @@
 
 import cpp
 import FilePermissions
-import semmle.code.cpp.commons.unix.Constants
 
 predicate worldWritableCreation(FileCreationExpr fc, int mode) {
   mode = localUmask(fc).mask(fc.getMode()) and
-  sets(mode, s_iwoth())
+  setsAnyBits(mode, UnixConstants::s_iwoth())
 }
 
 predicate setWorldWritable(FunctionCall fc, int mode) {
   fc.getTarget().getName() = ["chmod", "fchmod", "_chmod", "_wchmod"] and
   mode = fc.getArgument(1).getValue().toInt() and
-  sets(mode, s_iwoth())
+  setsAnyBits(mode, UnixConstants::s_iwoth())
 }
 
 from Expr fc, int mode, string message

cpp/ql/src/Security/CWE/CWE-732/FilePermissions.qll

@@ -1,5 +1,49 @@
 import cpp
-import semmle.code.cpp.commons.unix.Constants
+import semmle.code.cpp.commons.unix.Constants as UnixConstants
+
+/**
+ * Gets the number corresponding to the contents of `input` in base-16.
+ * Note: the first two characters of `input` must be `0x`. For example:
+ * `parseHex("0x123abc") = 1194684`.
+ */
+bindingset[input]
+int parseHex(string input) {
+  exists(string lowerCaseInput | lowerCaseInput = input.toLowerCase() |
+    lowerCaseInput.regexpMatch("0x[0-9a-f]+") and
+    result =
+      strictsum(int ix |
+        ix in [2 .. input.length()]
+      |
+        16.pow(input.length() - (ix + 1)) * "0123456789abcdef".indexOf(lowerCaseInput.charAt(ix))
+      )
+  )
+}
+
+/**
+ * Gets the value defined by the `O_CREAT` macro if the macro
+ * exists and if every definition defines the same value.
+ */
+int o_creat() {
+  result =
+    unique(int v |
+      exists(Macro m | m.getName() = "O_CREAT" |
+        v = parseHex(m.getBody()) or v = UnixConstants::parseOctal(m.getBody())
+      )
+    )
+}
+
+/**
+ * Gets the value defined by the `O_TMPFILE` macro if the macro
+ * exists and if every definition defines the same value.
+ */
+int o_tmpfile() {
+  result =
+    unique(int v |
+      exists(Macro m | m.getName() = "O_TMPFILE" |
+        v = parseHex(m.getBody()) or v = UnixConstants::parseOctal(m.getBody())
+      )
+    )
+}
 
 bindingset[n, digit]
 private string octalDigit(int n, int digit) {
@@ -20,11 +64,17 @@ string octalFileMode(int mode) {
   else result = "[non-standard mode: decimal " + mode + "]"
 }
 
+/**
+ * Holds if the bitmask `value` sets the bits in `flag`.
+ */
+bindingset[value, flag]
+predicate setsFlag(int value, int flag) { value.bitAnd(flag) = flag }
+
 /**
  * Holds if the bitmask `mask` sets any of the bit fields in `fields`.
  */
 bindingset[mask, fields]
-predicate sets(int mask, int fields) { mask.bitAnd(fields) != 0 }
+predicate setsAnyBits(int mask, int fields) { mask.bitAnd(fields) != 0 }
 
 /**
  * Gets the value that `fc` sets the umask to, if `fc` is a call to
@@ -83,16 +133,24 @@ abstract class FileCreationExpr extends FunctionCall {
   abstract int getMode();
 }
 
-class OpenCreationExpr extends FileCreationExpr {
+abstract class FileCreationWithOptionalModeExpr extends FileCreationExpr {
+  abstract predicate hasModeArgument();
+}
+
+class OpenCreationExpr extends FileCreationWithOptionalModeExpr {
   OpenCreationExpr() {
-    this.getTarget().getName() = ["open", "_open", "_wopen"] and
-    sets(this.getArgument(1).getValue().toInt(), o_creat())
+    this.getTarget().hasGlobalOrStdName(["open", "_open", "_wopen"]) and
+    exists(int flag | flag = this.getArgument(1).getValue().toInt() |
+      setsFlag(flag, o_creat()) or setsFlag(flag, o_tmpfile())
+    )
   }
 
   override Expr getPath() { result = this.getArgument(0) }
 
+  override predicate hasModeArgument() { exists(this.getArgument(2)) }
+
   override int getMode() {
-    if exists(this.getArgument(2))
+    if this.hasModeArgument()
     then result = this.getArgument(2).getValue().toInt()
     else
       // assume anything is permitted
@@ -108,20 +166,35 @@ class CreatCreationExpr extends FileCreationExpr {
   override int getMode() { result = this.getArgument(1).getValue().toInt() }
 }
 
-class OpenatCreationExpr extends FileCreationExpr {
+class OpenatCreationExpr extends FileCreationWithOptionalModeExpr {
   OpenatCreationExpr() {
-    this.getTarget().getName() = "openat" and
-    this.getNumberOfArguments() = 4
+    this.getTarget().hasGlobalOrStdName("openat") and
+    exists(int flag | flag = this.getArgument(2).getValue().toInt() |
+      setsFlag(flag, o_creat()) or setsFlag(flag, o_tmpfile())
+    )
   }
 
   override Expr getPath() { result = this.getArgument(1) }
 
-  override int getMode() { result = this.getArgument(3).getValue().toInt() }
+  override predicate hasModeArgument() { exists(this.getArgument(3)) }
+
+  override int getMode() {
+    if this.hasModeArgument()
+    then result = this.getArgument(3).getValue().toInt()
+    else
+      // assume anything is permitted
+      result = 0.bitNot()
+  }
 }
 
 private int fopenMode() {
   result =
-    s_irusr().bitOr(s_irgrp()).bitOr(s_iroth()).bitOr(s_iwusr()).bitOr(s_iwgrp()).bitOr(s_iwoth())
+    UnixConstants::s_irusr()
+        .bitOr(UnixConstants::s_irgrp())
+        .bitOr(UnixConstants::s_iroth())
+        .bitOr(UnixConstants::s_iwusr())
+        .bitOr(UnixConstants::s_iwgrp())
+        .bitOr(UnixConstants::s_iwoth())
 }
 
 class FopenCreationExpr extends FileCreationExpr {
@@ -153,6 +226,6 @@ class FopensCreationExpr extends FileCreationExpr {
     // fopen_s has restrictive permissions unless you have "u" in the mode
     if this.getArgument(2).getValue().charAt(_) = "u"
     then result = fopenMode()
-    else result = s_irusr().bitOr(s_iwusr())
+    else result = UnixConstants::s_irusr().bitOr(UnixConstants::s_iwusr())
   }
 }

cpp/ql/src/Security/CWE/CWE-732/OpenCallMissingModeArgument.c

@@ -0,0 +1,9 @@
+int open_file_bad() {
+	// BAD - this uses arbitrary bytes from the stack as mode argument
+        return open(FILE, O_CREAT)
+}
+
+int open_file_good() {
+	// GOOD - the mode argument is supplied
+        return open(FILE, O_CREAT, S_IRUSR | S_IWUSR)
+}

cpp/ql/src/Security/CWE/CWE-732/OpenCallMissingModeArgument.qhelp

@@ -0,0 +1,31 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+
+<overview>
+<p>
+When opening a file with the <code>O_CREAT</code> or <code>O_TMPFILE</code> flag, the <code>mode</code> must
+be supplied. If the <code>mode</code> argument is omitted, some arbitrary bytes from the stack will be used
+as the file mode. This leaks some bits from the stack into the permissions of the file.
+</p>
+</overview>
+
+<recommendation>
+<p>
+The <code>mode</code> must be supplied when <code>O_CREAT</code> or <code>O_TMPFILE</code> is specified.
+</p>
+</recommendation>
+
+<example>
+<p>
+The first example opens a file with the <code>O_CREAT</code> flag without supplying the <code>mode</code>
+argument. In this case arbitrary bytes from the stack will be used as <code>mode</code> argument. The
+second example correctly supplies the <code>mode</code> argument and creates a file that is user readable
+and writable.
+</p>
+
+<sample src="OpenCallMissingModeArgument.c" />
+
+</example>
+</qhelp>

cpp/ql/src/Security/CWE/CWE-732/OpenCallMissingModeArgument.ql

@@ -0,0 +1,19 @@
+/**
+ * @name File opened with O_CREAT flag but without mode argument
+ * @description Opening a file with the O_CREAT flag but without mode argument reads arbitrary bytes from the stack.
+ * @kind problem
+ * @problem.severity error
+ * @security-severity 7.8
+ * @precision high
+ * @id cpp/open-call-with-mode-argument
+ * @tags security
+ *       external/cwe/cwe-732
+ */
+
+import cpp
+import FilePermissions
+
+from FileCreationWithOptionalModeExpr fc
+where not fc.hasModeArgument()
+select fc,
+  "A file is created here without providing a mode argument, which may leak bits from the stack."

cpp/ql/src/change-notes/released/0.0.10.md

@@ -0,0 +1,5 @@
+## 0.0.10
+
+### Deprecated Classes
+
+* The `CodeDuplication.Copy`, `CodeDuplication.DuplicateBlock`, and `CodeDuplication.SimilarBlock` classes have been deprecated.

cpp/ql/src/change-notes/released/0.0.9.md

@@ -0,0 +1,13 @@
+## 0.0.9
+
+### New Queries
+
+* Added a new query, `cpp/open-call-with-mode-argument`, to detect when `open` or `openat` is called with the `O_CREAT` or `O_TMPFILE` flag but when the `mode` argument is omitted.
+
+### Minor Analysis Improvements
+
+* The "Cleartext transmission of sensitive information" (`cpp/cleartext-transmission`) query has been further improved to reduce false positive results, and upgraded from `medium` to `high` precision.
+* The "Cleartext transmission of sensitive information" (`cpp/cleartext-transmission`) query now finds more results, where a password is stored in a struct field or class member variable.
+* The `cpp/cleartext-storage-file` query has been improved, removing false positives where data is written to a standard output stream.
+* The `cpp/cleartext-storage-buffer` query has been updated to use the `semmle.code.cpp.dataflow.TaintTracking` library.
+* The `cpp/world-writable-file-creation` query now only detects `open` and `openat` calls with the `O_CREAT` or `O_TMPFILE` flag.

cpp/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.0.8
+lastReleaseVersion: 0.0.10

cpp/ql/src/experimental/Best Practices/UselessTest.cpp

@@ -0,0 +1,9 @@
+void test(){
+    int a = 8;
+    int b = 9;
+
+    //Useless NonEquals
+    if(a==8 && a != 7) {}
+
+    while(a==8 && a!=7){}
+}

cpp/ql/src/experimental/Best Practices/UselessTest.qhelp

@@ -0,0 +1,18 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+
+<overview>
+<p>Comparison operations like <code>a==8 &amp;&amp; a!=7</code> contain a useless part : the non-equal part. This rule finds tests of this kind within an <code>if</code> or a <code>while</code> statement</p>
+</overview>
+
+<recommendation>
+<p>Remove the useless comparisons</p>
+</recommendation>
+
+<example>
+<sample src="UselessTest.cpp" />
+</example>
+
+</qhelp>

cpp/ql/src/experimental/Best Practices/UselessTest.ql

@@ -0,0 +1,45 @@
+/**
+ * @name Useless Test
+ * @description A boolean condition that is guaranteed to never be evaluated should be deleted.
+ * @kind problem
+ * @problem.severity warning
+ * @id cpp/uselesstest
+ * @tags reliability
+ *       readability
+ */
+
+import cpp
+import semmle.code.cpp.valuenumbering.GlobalValueNumbering
+
+predicate sameExpr(Expr e1, Expr e2) { globalValueNumber(e1).getAnExpr() = e2 }
+
+Element nearestParent(Expr e) {
+  if
+    e.getParent().(Expr).getConversion*() instanceof ParenthesisExpr or
+    e.getParent() instanceof IfStmt or
+    e.getParent() instanceof WhileStmt
+  then result = e.getParent()
+  else result = nearestParent(e.getParent())
+}
+
+from LogicalAndExpr b, EQExpr eq, NEExpr ne
+where
+  (
+    b.getAChild*() = eq and
+    b.getAChild*() = ne and
+    eq.getParent() instanceof LogicalAndExpr and
+    ne.getParent() instanceof LogicalAndExpr
+  ) and
+  (
+    eq.getLeftOperand() instanceof VariableAccess and ne.getLeftOperand() instanceof VariableAccess
+    or
+    eq.getLeftOperand() instanceof PointerDereferenceExpr and
+    ne.getLeftOperand() instanceof PointerDereferenceExpr
+  ) and
+  eq.getRightOperand() instanceof Literal and
+  ne.getRightOperand() instanceof Literal and
+  eq.getLeftOperand().getFullyConverted().getUnspecifiedType() =
+    ne.getLeftOperand().getFullyConverted().getUnspecifiedType() and
+  nearestParent(eq) = nearestParent(ne) and
+  sameExpr(eq.getLeftOperand(), ne.getLeftOperand())
+select ne, "Useless Test"

cpp/ql/src/external/CodeDuplication.qll

@@ -2,59 +2,40 @@
 
 import cpp
 
-private string relativePath(File file) { result = file.getRelativePath().replaceAll("\\", "/") }
-
-cached
-private predicate tokenLocation(string path, int sl, int sc, int ec, int el, Copy copy, int index) {
-  path = copy.sourceFile().getAbsolutePath() and
-  tokens(copy, index, sl, sc, ec, el)
-}
-
-/** A token block used for detection of duplicate and similar code. */
-class Copy extends @duplication_or_similarity {
-  /** Gets the index of the last token in this block. */
-  private int lastToken() { result = max(int i | tokens(this, i, _, _, _, _) | i) }
+private newtype TDuplicationOrSimilarity = MKDuplicationOrSimilarity()
 
+/**
+ * DEPRECATED: This class is no longer used.
+ *
+ * A token block used for detection of duplicate and similar code.
+ */
+class Copy extends TDuplicationOrSimilarity {
   /** Gets the index of the token in this block starting at the location `loc`, if any. */
-  int tokenStartingAt(Location loc) {
-    exists(string filepath, int startline, int startcol |
-      loc.hasLocationInfo(filepath, startline, startcol, _, _) and
-      tokenLocation(filepath, startline, startcol, _, _, this, result)
-    )
-  }
+  int tokenStartingAt(Location loc) { none() }
 
   /** Gets the index of the token in this block ending at the location `loc`, if any. */
-  int tokenEndingAt(Location loc) {
-    exists(string filepath, int endline, int endcol |
-      loc.hasLocationInfo(filepath, _, _, endline, endcol) and
-      tokenLocation(filepath, _, _, endline, endcol, this, result)
-    )
-  }
+  int tokenEndingAt(Location loc) { none() }
 
   /** Gets the line on which the first token in this block starts. */
-  int sourceStartLine() { tokens(this, 0, result, _, _, _) }
+  int sourceStartLine() { none() }
 
   /** Gets the column on which the first token in this block starts. */
-  int sourceStartColumn() { tokens(this, 0, _, result, _, _) }
+  int sourceStartColumn() { none() }
 
   /** Gets the line on which the last token in this block ends. */
-  int sourceEndLine() { tokens(this, this.lastToken(), _, _, result, _) }
+  int sourceEndLine() { none() }
 
   /** Gets the column on which the last token in this block ends. */
-  int sourceEndColumn() { tokens(this, this.lastToken(), _, _, _, result) }
+  int sourceEndColumn() { none() }
 
   /** Gets the number of lines containing at least (part of) one token in this block. */
   int sourceLines() { result = this.sourceEndLine() + 1 - this.sourceStartLine() }
 
   /** Gets an opaque identifier for the equivalence class of this block. */
-  int getEquivalenceClass() { duplicateCode(this, _, result) or similarCode(this, _, result) }
+  int getEquivalenceClass() { none() }
 
   /** Gets the source file in which this block appears. */
-  File sourceFile() {
-    exists(string name | duplicateCode(this, name, _) or similarCode(this, name, _) |
-      name.replaceAll("\\", "/") = relativePath(result)
-    )
-  }
+  File sourceFile() { none() }
 
   /**
    * Holds if this element is at the specified location.
@@ -77,15 +58,23 @@ class Copy extends @duplication_or_similarity {
   string toString() { none() }
 }
 
-/** A block of duplicated code. */
-class DuplicateBlock extends Copy, @duplication {
+/**
+ * DEPRECATED: This class is no longer used.
+ *
+ * A block of duplicated code.
+ */
+class DuplicateBlock extends Copy {
   override string toString() {
     result = "Duplicate code: " + this.sourceLines() + " duplicated lines."
   }
 }
 
-/** A block of similar code. */
-class SimilarBlock extends Copy, @similarity {
+/**
+ * DEPRECATED: This class is no longer used.
+ *
+ * A block of similar code.
+ */
+class SimilarBlock extends Copy {
   override string toString() {
     result = "Similar code: " + this.sourceLines() + " almost duplicated lines."
   }

cpp/ql/src/qlpack.yml

@@ -1,6 +1,8 @@
 name: codeql/cpp-queries
-version: 0.0.8
-groups: cpp
+version: 0.0.10
+groups: 
+  - cpp
+  - queries
 dependencies:
     codeql/cpp-all: "*"
     codeql/suite-helpers: "*"

cpp/ql/test/TestUtilities/InlineExpectationsTest.qll

@@ -93,7 +93,7 @@
 private import InlineExpectationsTestPrivate
 
 /**
- * Base class for tests with inline expectations. The test extends this class to provide the actual
+ * The base class for tests with inline expectations. The test extends this class to provide the actual
  * results of the query, which are then compared with the expected results in comments to produce a
  * list of failure messages that point out where the actual results differ from the expected
  * results.
@@ -123,6 +123,15 @@ abstract class InlineExpectationsTest extends string {
    */
   abstract predicate hasActualResult(Location location, string element, string tag, string value);
 
+  /**
+   * Like `hasActualResult`, but returns results that do not require a matching annotation.
+   * A failure will still arise if there is an annotation that does not match any results, but not vice versa.
+   * Override this predicate to specify optional results.
+   */
+  predicate hasOptionalResult(Location location, string element, string tag, string value) {
+    none()
+  }
+
   final predicate hasFailureMessage(FailureLocatable element, string message) {
     exists(ActualResult actualResult |
       actualResult.getTest() = this and
@@ -134,7 +143,8 @@ abstract class InlineExpectationsTest extends string {
         )
         or
         not exists(ValidExpectation expectation | expectation.matchesActualResult(actualResult)) and
-        message = "Unexpected result: " + actualResult.getExpectationText()
+        message = "Unexpected result: " + actualResult.getExpectationText() and
+        not actualResult.isOptional()
       )
     )
     or
@@ -243,9 +253,13 @@ private string expectationPattern() {
 
 private newtype TFailureLocatable =
   TActualResult(
-    InlineExpectationsTest test, Location location, string element, string tag, string value
+    InlineExpectationsTest test, Location location, string element, string tag, string value,
+    boolean optional
   ) {
-    test.hasActualResult(location, element, tag, value)
+    test.hasActualResult(location, element, tag, value) and
+    optional = false
+    or
+    test.hasOptionalResult(location, element, tag, value) and optional = true
   } or
   TValidExpectation(ExpectationComment comment, string tag, string value, string knownFailure) {
     exists(TColumn column, string tags |
@@ -277,8 +291,9 @@ class ActualResult extends FailureLocatable, TActualResult {
   string element;
   string tag;
   string value;
+  boolean optional;
 
-  ActualResult() { this = TActualResult(test, location, element, tag, value) }
+  ActualResult() { this = TActualResult(test, location, element, tag, value, optional) }
 
   override string toString() { result = element }
 
@@ -289,6 +304,8 @@ class ActualResult extends FailureLocatable, TActualResult {
   override string getTag() { result = tag }
 
   override string getValue() { result = value }
+
+  predicate isOptional() { optional = true }
 }
 
 abstract private class Expectation extends FailureLocatable {

cpp/ql/test/library-tests/ir/ir/PrintAST.expected

@@ -11332,6 +11332,930 @@ ir.cpp:
 # 1447|                         Type = [Struct] POD_Derived
 # 1447|                         ValueCategory = prvalue
 # 1448|     getStmt(4): [ReturnStmt] return ...
+# 1450| [CopyAssignmentOperator] Inheritance_Test_B& Inheritance_Test_B::operator=(Inheritance_Test_B const&)
+# 1450|   <params>: 
+#-----|     getParameter(0): [Parameter] (unnamed parameter 0)
+#-----|         Type = [LValueReferenceType] const Inheritance_Test_B &
+# 1450| [Constructor] void Inheritance_Test_B::Inheritance_Test_B()
+# 1450|   <params>: 
+# 1451| [Destructor] void Inheritance_Test_B::~Inheritance_Test_B()
+# 1451|   <params>: 
+# 1451|   getEntryPoint(): [BlockStmt] { ... }
+# 1451|     getStmt(0): [ReturnStmt] return ...
+# 1451|   <destructions>: 
+# 1454| [CopyAssignmentOperator] Inheritance_Test_A& Inheritance_Test_A::operator=(Inheritance_Test_A const&)
+# 1454|   <params>: 
+#-----|     getParameter(0): [Parameter] (unnamed parameter 0)
+#-----|         Type = [LValueReferenceType] const Inheritance_Test_A &
+# 1454| [MoveAssignmentOperator] Inheritance_Test_A& Inheritance_Test_A::operator=(Inheritance_Test_A&&)
+# 1454|   <params>: 
+#-----|     getParameter(0): [Parameter] (unnamed parameter 0)
+#-----|         Type = [RValueReferenceType] Inheritance_Test_A &&
+# 1454| [CopyConstructor] void Inheritance_Test_A::Inheritance_Test_A(Inheritance_Test_A const&)
+# 1454|   <params>: 
+#-----|     getParameter(0): [Parameter] (unnamed parameter 0)
+#-----|         Type = [LValueReferenceType] const Inheritance_Test_A &
+# 1454| [MoveConstructor] void Inheritance_Test_A::Inheritance_Test_A(Inheritance_Test_A&&)
+# 1454|   <params>: 
+#-----|     getParameter(0): [Parameter] (unnamed parameter 0)
+#-----|         Type = [RValueReferenceType] Inheritance_Test_A &&
+# 1454| [Destructor] void Inheritance_Test_A::~Inheritance_Test_A()
+# 1454|   <params>: 
+# 1457| [Constructor] void Inheritance_Test_A::Inheritance_Test_A()
+# 1457|   <params>: 
+# 1457|   <initializations>: 
+# 1457|     getInitializer(0): (no string representation)
+# 1457|         Type = [Struct] Inheritance_Test_B
+# 1457|         ValueCategory = prvalue
+# 1457|     getInitializer(1): [ConstructorFieldInit] constructor init of field x
+# 1457|         Type = [IntType] int
+# 1457|         ValueCategory = prvalue
+# 1457|       getExpr(): [Literal] 42
+# 1457|           Type = [IntType] int
+# 1457|           Value = [Literal] 42
+# 1457|           ValueCategory = prvalue
+# 1457|   getEntryPoint(): [BlockStmt] { ... }
+# 1458|     getStmt(0): [ExprStmt] ExprStmt
+# 1458|       getExpr(): [AssignExpr] ... = ...
+# 1458|           Type = [IntType] int
+# 1458|           ValueCategory = lvalue
+# 1458|         getLValue(): [PointerFieldAccess] y
+# 1458|             Type = [IntType] int
+# 1458|             ValueCategory = lvalue
+# 1458|           getQualifier(): [ThisExpr] this
+# 1458|               Type = [PointerType] Inheritance_Test_A *
+# 1458|               ValueCategory = prvalue(load)
+# 1458|         getRValue(): [Literal] 3
+# 1458|             Type = [IntType] int
+# 1458|             Value = [Literal] 3
+# 1458|             ValueCategory = prvalue
+# 1459|     getStmt(1): [ReturnStmt] return ...
+# 1462| [TopLevelFunction] void array_structured_binding()
+# 1462|   <params>: 
+# 1462|   getEntryPoint(): [BlockStmt] { ... }
+# 1463|     getStmt(0): [DeclStmt] declaration
+# 1463|       getDeclarationEntry(0): [VariableDeclarationEntry] definition of xs
+# 1463|           Type = [ArrayType] int[2]
+# 1463|         getVariable().getInitializer(): [Initializer] initializer for xs
+# 1463|           getExpr(): [ArrayAggregateLiteral] {...}
+# 1463|               Type = [ArrayType] int[2]
+# 1463|               ValueCategory = prvalue
+# 1463|             getElementExpr(0): [Literal] 1
+# 1463|                 Type = [IntType] int
+# 1463|                 Value = [Literal] 1
+# 1463|                 ValueCategory = prvalue
+# 1463|             getElementExpr(1): [Literal] 2
+# 1463|                 Type = [IntType] int
+# 1463|                 Value = [Literal] 2
+# 1463|                 ValueCategory = prvalue
+# 1465|     getStmt(1): [BlockStmt] { ... }
+# 1466|       getStmt(0): [DeclStmt] declaration
+# 1466|         getDeclarationEntry(0): (no string representation)
+# 1466|             Type = [LValueReferenceType] int(&)[2]
+# 1466|           getVariable().getInitializer(): [Initializer] initializer for (unnamed local variable)
+# 1466|             getExpr(): [VariableAccess] xs
+# 1466|                 Type = [ArrayType] int[2]
+# 1466|                 ValueCategory = lvalue
+# 1466|             getExpr().getFullyConverted(): [ReferenceToExpr] (reference to)
+# 1466|                 Type = [LValueReferenceType] int(&)[2]
+# 1466|                 ValueCategory = prvalue
+# 1466|         getDeclarationEntry(1): [VariableDeclarationEntry] definition of x0
+# 1466|             Type = [IntType] int
+#-----|           getVariable().getInitializer(): [Initializer] initializer for x0
+#-----|             getExpr(): [ArrayExpr] access to array
+#-----|                 Type = [IntType] int
+#-----|                 ValueCategory = lvalue
+#-----|               getArrayBase(): [VariableAccess] (unnamed local variable)
+#-----|                   Type = [LValueReferenceType] int(&)[2]
+#-----|                   ValueCategory = prvalue(load)
+#-----|               getArrayOffset(): [Literal] 0
+#-----|                   Type = [LongType] unsigned long
+#-----|                   Value = [Literal] 0
+#-----|                   ValueCategory = prvalue
+#-----|               getArrayBase().getFullyConverted(): [ArrayToPointerConversion] array to pointer conversion
+#-----|                   Type = [IntPointerType] int *
+#-----|                   ValueCategory = prvalue
+#-----|                 getExpr(): [ReferenceDereferenceExpr] (reference dereference)
+#-----|                     Type = [ArrayType] int[2]
+#-----|                     ValueCategory = lvalue
+# 1466|         getDeclarationEntry(2): [VariableDeclarationEntry] definition of x1
+# 1466|             Type = [IntType] int
+#-----|           getVariable().getInitializer(): [Initializer] initializer for x1
+#-----|             getExpr(): [ArrayExpr] access to array
+#-----|                 Type = [IntType] int
+#-----|                 ValueCategory = lvalue
+#-----|               getArrayBase(): [VariableAccess] (unnamed local variable)
+#-----|                   Type = [LValueReferenceType] int(&)[2]
+#-----|                   ValueCategory = prvalue(load)
+#-----|               getArrayOffset(): [Literal] 1
+#-----|                   Type = [LongType] unsigned long
+#-----|                   Value = [Literal] 1
+#-----|                   ValueCategory = prvalue
+#-----|               getArrayBase().getFullyConverted(): [ArrayToPointerConversion] array to pointer conversion
+#-----|                   Type = [IntPointerType] int *
+#-----|                   ValueCategory = prvalue
+#-----|                 getExpr(): [ReferenceDereferenceExpr] (reference dereference)
+#-----|                     Type = [ArrayType] int[2]
+#-----|                     ValueCategory = lvalue
+# 1467|       getStmt(1): [ExprStmt] ExprStmt
+# 1467|         getExpr(): [AssignExpr] ... = ...
+# 1467|             Type = [IntType] int
+# 1467|             ValueCategory = lvalue
+# 1467|           getLValue(): [VariableAccess] x1
+# 1467|               Type = [IntType] int
+# 1467|               ValueCategory = lvalue
+# 1467|           getRValue(): [Literal] 3
+# 1467|               Type = [IntType] int
+# 1467|               Value = [Literal] 3
+# 1467|               ValueCategory = prvalue
+# 1468|       getStmt(2): [DeclStmt] declaration
+# 1468|         getDeclarationEntry(0): [VariableDeclarationEntry] definition of rx1
+# 1468|             Type = [LValueReferenceType] int &
+# 1468|           getVariable().getInitializer(): [Initializer] initializer for rx1
+# 1468|             getExpr(): [VariableAccess] x1
+# 1468|                 Type = [IntType] int
+# 1468|                 ValueCategory = lvalue
+# 1468|             getExpr().getFullyConverted(): [ReferenceToExpr] (reference to)
+# 1468|                 Type = [LValueReferenceType] int &
+# 1468|                 ValueCategory = prvalue
+# 1469|       getStmt(3): [DeclStmt] declaration
+# 1469|         getDeclarationEntry(0): [VariableDeclarationEntry] definition of x
+# 1469|             Type = [IntType] int
+# 1469|           getVariable().getInitializer(): [Initializer] initializer for x
+# 1469|             getExpr(): [VariableAccess] x1
+# 1469|                 Type = [IntType] int
+# 1469|                 ValueCategory = prvalue(load)
+# 1472|     getStmt(2): [BlockStmt] { ... }
+# 1473|       getStmt(0): [DeclStmt] declaration
+# 1473|         getDeclarationEntry(0): [VariableDeclarationEntry] definition of unnamed_local_variable
+# 1473|             Type = [LValueReferenceType] int(&)[2]
+# 1473|           getVariable().getInitializer(): [Initializer] initializer for unnamed_local_variable
+# 1473|             getExpr(): [VariableAccess] xs
+# 1473|                 Type = [ArrayType] int[2]
+# 1473|                 ValueCategory = lvalue
+# 1473|             getExpr().getFullyConverted(): [ReferenceToExpr] (reference to)
+# 1473|                 Type = [LValueReferenceType] int(&)[2]
+# 1473|                 ValueCategory = prvalue
+# 1474|       getStmt(1): [DeclStmt] declaration
+# 1474|         getDeclarationEntry(0): [VariableDeclarationEntry] definition of x0
+# 1474|             Type = [LValueReferenceType] int &
+# 1474|           getVariable().getInitializer(): [Initializer] initializer for x0
+# 1474|             getExpr(): [ArrayExpr] access to array
+# 1474|                 Type = [IntType] int
+# 1474|                 ValueCategory = lvalue
+# 1474|               getArrayBase(): [VariableAccess] xs
+# 1474|                   Type = [ArrayType] int[2]
+# 1474|                   ValueCategory = lvalue
+# 1474|               getArrayOffset(): [Literal] 0
+# 1474|                   Type = [IntType] int
+# 1474|                   Value = [Literal] 0
+# 1474|                   ValueCategory = prvalue
+# 1474|               getArrayBase().getFullyConverted(): [ArrayToPointerConversion] array to pointer conversion
+# 1474|                   Type = [IntPointerType] int *
+# 1474|                   ValueCategory = prvalue
+# 1474|             getExpr().getFullyConverted(): [ReferenceToExpr] (reference to)
+# 1474|                 Type = [LValueReferenceType] int &
+# 1474|                 ValueCategory = prvalue
+# 1475|       getStmt(2): [DeclStmt] declaration
+# 1475|         getDeclarationEntry(0): [VariableDeclarationEntry] definition of x1
+# 1475|             Type = [LValueReferenceType] int &
+# 1475|           getVariable().getInitializer(): [Initializer] initializer for x1
+# 1475|             getExpr(): [ArrayExpr] access to array
+# 1475|                 Type = [IntType] int
+# 1475|                 ValueCategory = lvalue
+# 1475|               getArrayBase(): [VariableAccess] xs
+# 1475|                   Type = [ArrayType] int[2]
+# 1475|                   ValueCategory = lvalue
+# 1475|               getArrayOffset(): [Literal] 1
+# 1475|                   Type = [IntType] int
+# 1475|                   Value = [Literal] 1
+# 1475|                   ValueCategory = prvalue
+# 1475|               getArrayBase().getFullyConverted(): [ArrayToPointerConversion] array to pointer conversion
+# 1475|                   Type = [IntPointerType] int *
+# 1475|                   ValueCategory = prvalue
+# 1475|             getExpr().getFullyConverted(): [ReferenceToExpr] (reference to)
+# 1475|                 Type = [LValueReferenceType] int &
+# 1475|                 ValueCategory = prvalue
+# 1476|       getStmt(3): [ExprStmt] ExprStmt
+# 1476|         getExpr(): [AssignExpr] ... = ...
+# 1476|             Type = [IntType] int
+# 1476|             ValueCategory = lvalue
+# 1476|           getLValue(): [VariableAccess] x1
+# 1476|               Type = [LValueReferenceType] int &
+# 1476|               ValueCategory = prvalue(load)
+# 1476|           getRValue(): [Literal] 3
+# 1476|               Type = [IntType] int
+# 1476|               Value = [Literal] 3
+# 1476|               ValueCategory = prvalue
+# 1476|           getLValue().getFullyConverted(): [ReferenceDereferenceExpr] (reference dereference)
+# 1476|               Type = [IntType] int
+# 1476|               ValueCategory = lvalue
+# 1477|       getStmt(4): [DeclStmt] declaration
+# 1477|         getDeclarationEntry(0): [VariableDeclarationEntry] definition of rx1
+# 1477|             Type = [LValueReferenceType] int &
+# 1477|           getVariable().getInitializer(): [Initializer] initializer for rx1
+# 1477|             getExpr(): [VariableAccess] x1
+# 1477|                 Type = [LValueReferenceType] int &
+# 1477|                 ValueCategory = prvalue(load)
+# 1477|             getExpr().getFullyConverted(): [ReferenceToExpr] (reference to)
+# 1477|                 Type = [LValueReferenceType] int &
+# 1477|                 ValueCategory = prvalue
+# 1477|               getExpr(): [ReferenceDereferenceExpr] (reference dereference)
+# 1477|                   Type = [IntType] int
+# 1477|                   ValueCategory = lvalue
+# 1478|       getStmt(5): [DeclStmt] declaration
+# 1478|         getDeclarationEntry(0): [VariableDeclarationEntry] definition of x
+# 1478|             Type = [IntType] int
+# 1478|           getVariable().getInitializer(): [Initializer] initializer for x
+# 1478|             getExpr(): [VariableAccess] x1
+# 1478|                 Type = [LValueReferenceType] int &
+# 1478|                 ValueCategory = prvalue(load)
+# 1478|             getExpr().getFullyConverted(): [ReferenceDereferenceExpr] (reference dereference)
+# 1478|                 Type = [IntType] int
+# 1478|                 ValueCategory = prvalue(load)
+# 1480|     getStmt(3): [ReturnStmt] return ...
+# 1482| [CopyAssignmentOperator] StructuredBindingDataMemberStruct& StructuredBindingDataMemberStruct::operator=(StructuredBindingDataMemberStruct const&)
+# 1482|   <params>: 
+#-----|     getParameter(0): [Parameter] (unnamed parameter 0)
+#-----|         Type = [LValueReferenceType] const StructuredBindingDataMemberStruct &
+# 1482| [Constructor] void StructuredBindingDataMemberStruct::StructuredBindingDataMemberStruct()
+# 1482|   <params>: 
+# 1482|   <initializations>: 
+# 1482|     getInitializer(0): [ConstructorFieldInit] constructor init of field i
+# 1482|         Type = [IntType] int
+# 1482|         ValueCategory = prvalue
+# 1482|     getInitializer(1): [ConstructorFieldInit] constructor init of field d
+# 1482|         Type = [DoubleType] double
+# 1482|         ValueCategory = prvalue
+# 1482|     getInitializer(2): [ConstructorFieldInit] constructor init of field r
+# 1482|         Type = [LValueReferenceType] int &
+# 1482|         ValueCategory = prvalue
+# 1482|   getEntryPoint(): [BlockStmt] { ... }
+# 1482|     getStmt(0): [ReturnStmt] return ...
+# 1482| [CopyConstructor] void StructuredBindingDataMemberStruct::StructuredBindingDataMemberStruct(StructuredBindingDataMemberStruct const&)
+# 1482|   <params>: 
+#-----|     getParameter(0): [Parameter] (unnamed parameter 0)
+#-----|         Type = [LValueReferenceType] const StructuredBindingDataMemberStruct &
+# 1482|   <initializations>: 
+# 1482|     getInitializer(0): [ConstructorFieldInit] constructor init of field i
+# 1482|         Type = [IntType] int
+# 1482|         ValueCategory = prvalue
+# 1482|       getExpr(): [Literal] Unknown literal
+# 1482|           Type = [IntType] int
+# 1482|           ValueCategory = prvalue
+# 1482|     getInitializer(1): [ConstructorFieldInit] constructor init of field d
+# 1482|         Type = [DoubleType] double
+# 1482|         ValueCategory = prvalue
+# 1482|       getExpr(): [Literal] Unknown literal
+# 1482|           Type = [DoubleType] double
+# 1482|           ValueCategory = prvalue
+# 1482|     getInitializer(2): [ConstructorFieldInit] constructor init of field b
+# 1482|         Type = [IntType] unsigned int
+# 1482|         ValueCategory = prvalue
+# 1482|       getExpr(): [Literal] Unknown literal
+# 1482|           Type = [IntType] unsigned int
+# 1482|           ValueCategory = prvalue
+# 1482|     getInitializer(3): [ConstructorFieldInit] constructor init of field r
+# 1482|         Type = [LValueReferenceType] int &
+# 1482|         ValueCategory = prvalue
+# 1482|       getExpr(): [Literal] Unknown literal
+# 1482|           Type = [LValueReferenceType] int &
+# 1482|           ValueCategory = prvalue
+# 1482|   getEntryPoint(): [BlockStmt] { ... }
+# 1482|     getStmt(0): [ReturnStmt] return ...
+# 1482| [MoveConstructor] void StructuredBindingDataMemberStruct::StructuredBindingDataMemberStruct(StructuredBindingDataMemberStruct&&)
+# 1482|   <params>: 
+#-----|     getParameter(0): [Parameter] (unnamed parameter 0)
+#-----|         Type = [RValueReferenceType] StructuredBindingDataMemberStruct &&
+# 1489| [TopLevelFunction] void data_member_structured_binding()
+# 1489|   <params>: 
+# 1489|   getEntryPoint(): [BlockStmt] { ... }
+# 1490|     getStmt(0): [DeclStmt] declaration
+# 1490|       getDeclarationEntry(0): [VariableDeclarationEntry] definition of s
+# 1490|           Type = [Struct] StructuredBindingDataMemberStruct
+# 1490|         getVariable().getInitializer(): [Initializer] initializer for s
+# 1490|           getExpr(): [ConstructorCall] call to StructuredBindingDataMemberStruct
+# 1490|               Type = [VoidType] void
+# 1490|               ValueCategory = prvalue
+# 1492|     getStmt(1): [BlockStmt] { ... }
+# 1493|       getStmt(0): [DeclStmt] declaration
+# 1493|         getDeclarationEntry(0): (no string representation)
+# 1493|             Type = [Struct] StructuredBindingDataMemberStruct
+# 1493|           getVariable().getInitializer(): [Initializer] initializer for (unnamed local variable)
+# 1493|             getExpr(): [VariableAccess] s
+# 1493|                 Type = [Struct] StructuredBindingDataMemberStruct
+# 1493|                 ValueCategory = prvalue(load)
+# 1493|         getDeclarationEntry(1): [VariableDeclarationEntry] definition of i
+# 1493|             Type = [IntType] int
+#-----|           getVariable().getInitializer(): [Initializer] initializer for i
+# 1493|             getExpr(): [ValueFieldAccess] i
+# 1493|                 Type = [IntType] int
+# 1493|                 ValueCategory = lvalue
+# 1493|               getQualifier(): [VariableAccess] (unnamed local variable)
+# 1493|                   Type = [Struct] StructuredBindingDataMemberStruct
+# 1493|                   ValueCategory = lvalue
+# 1493|         getDeclarationEntry(2): [VariableDeclarationEntry] definition of d
+# 1493|             Type = [DoubleType] double
+#-----|           getVariable().getInitializer(): [Initializer] initializer for d
+# 1493|             getExpr(): [ValueFieldAccess] d
+# 1493|                 Type = [DoubleType] double
+# 1493|                 ValueCategory = lvalue
+# 1493|               getQualifier(): [VariableAccess] (unnamed local variable)
+# 1493|                   Type = [Struct] StructuredBindingDataMemberStruct
+# 1493|                   ValueCategory = lvalue
+# 1493|         getDeclarationEntry(3): [VariableDeclarationEntry] definition of b
+# 1493|             Type = [IntType] unsigned int
+#-----|           getVariable().getInitializer(): [Initializer] initializer for b
+# 1493|             getExpr(): [ValueFieldAccess] b
+# 1493|                 Type = [IntType] unsigned int
+# 1493|                 ValueCategory = lvalue
+# 1493|               getQualifier(): [VariableAccess] (unnamed local variable)
+# 1493|                   Type = [Struct] StructuredBindingDataMemberStruct
+# 1493|                   ValueCategory = lvalue
+# 1493|         getDeclarationEntry(4): [VariableDeclarationEntry] definition of r
+# 1493|             Type = [IntType] int
+#-----|           getVariable().getInitializer(): [Initializer] initializer for r
+# 1493|             getExpr(): [ValueFieldAccess] r
+# 1493|                 Type = [LValueReferenceType] int &
+# 1493|                 ValueCategory = prvalue(load)
+# 1493|               getQualifier(): [VariableAccess] (unnamed local variable)
+# 1493|                   Type = [Struct] StructuredBindingDataMemberStruct
+# 1493|                   ValueCategory = lvalue
+# 1493|             getExpr().getFullyConverted(): [ReferenceDereferenceExpr] (reference dereference)
+# 1493|                 Type = [IntType] int
+# 1493|                 ValueCategory = lvalue
+# 1494|       getStmt(1): [ExprStmt] ExprStmt
+# 1494|         getExpr(): [AssignExpr] ... = ...
+# 1494|             Type = [DoubleType] double
+# 1494|             ValueCategory = lvalue
+# 1494|           getLValue(): [VariableAccess] d
+# 1494|               Type = [DoubleType] double
+# 1494|               ValueCategory = lvalue
+# 1494|           getRValue(): [Literal] 4.0
+# 1494|               Type = [DoubleType] double
+# 1494|               Value = [Literal] 4.0
+# 1494|               ValueCategory = prvalue
+# 1495|       getStmt(2): [DeclStmt] declaration
+# 1495|         getDeclarationEntry(0): [VariableDeclarationEntry] definition of rd
+# 1495|             Type = [LValueReferenceType] double &
+# 1495|           getVariable().getInitializer(): [Initializer] initializer for rd
+# 1495|             getExpr(): [VariableAccess] d
+# 1495|                 Type = [DoubleType] double
+# 1495|                 ValueCategory = lvalue
+# 1495|             getExpr().getFullyConverted(): [ReferenceToExpr] (reference to)
+# 1495|                 Type = [LValueReferenceType] double &
+# 1495|                 ValueCategory = prvalue
+# 1496|       getStmt(3): [DeclStmt] declaration
+# 1496|         getDeclarationEntry(0): [VariableDeclarationEntry] definition of v
+# 1496|             Type = [IntType] int
+# 1496|           getVariable().getInitializer(): [Initializer] initializer for v
+# 1496|             getExpr(): [VariableAccess] i
+# 1496|                 Type = [IntType] int
+# 1496|                 ValueCategory = prvalue(load)
+# 1497|       getStmt(4): [ExprStmt] ExprStmt
+# 1497|         getExpr(): [AssignExpr] ... = ...
+# 1497|             Type = [IntType] int
+# 1497|             ValueCategory = lvalue
+# 1497|           getLValue(): [VariableAccess] r
+# 1497|               Type = [IntType] int
+# 1497|               ValueCategory = lvalue
+# 1497|           getRValue(): [Literal] 5
+# 1497|               Type = [IntType] int
+# 1497|               Value = [Literal] 5
+# 1497|               ValueCategory = prvalue
+# 1498|       getStmt(5): [DeclStmt] declaration
+# 1498|         getDeclarationEntry(0): [VariableDeclarationEntry] definition of rr
+# 1498|             Type = [LValueReferenceType] int &
+# 1498|           getVariable().getInitializer(): [Initializer] initializer for rr
+# 1498|             getExpr(): [VariableAccess] r
+# 1498|                 Type = [IntType] int
+# 1498|                 ValueCategory = lvalue
+# 1498|             getExpr().getFullyConverted(): [ReferenceToExpr] (reference to)
+# 1498|                 Type = [LValueReferenceType] int &
+# 1498|                 ValueCategory = prvalue
+# 1499|       getStmt(6): [DeclStmt] declaration
+# 1499|         getDeclarationEntry(0): [VariableDeclarationEntry] definition of w
+# 1499|             Type = [IntType] int
+# 1499|           getVariable().getInitializer(): [Initializer] initializer for w
+# 1499|             getExpr(): [VariableAccess] r
+# 1499|                 Type = [IntType] int
+# 1499|                 ValueCategory = prvalue(load)
+# 1502|     getStmt(2): [BlockStmt] { ... }
+# 1503|       getStmt(0): [DeclStmt] declaration
+# 1503|         getDeclarationEntry(0): [VariableDeclarationEntry] definition of unnamed_local_variable
+# 1503|             Type = [Struct] StructuredBindingDataMemberStruct
+# 1503|           getVariable().getInitializer(): [Initializer] initializer for unnamed_local_variable
+# 1503|             getExpr(): [VariableAccess] s
+# 1503|                 Type = [Struct] StructuredBindingDataMemberStruct
+# 1503|                 ValueCategory = prvalue(load)
+# 1504|       getStmt(1): [DeclStmt] declaration
+# 1504|         getDeclarationEntry(0): [VariableDeclarationEntry] definition of i
+# 1504|             Type = [LValueReferenceType] int &
+# 1504|           getVariable().getInitializer(): [Initializer] initializer for i
+# 1504|             getExpr(): [ValueFieldAccess] i
+# 1504|                 Type = [IntType] int
+# 1504|                 ValueCategory = lvalue
+# 1504|               getQualifier(): [VariableAccess] unnamed_local_variable
+# 1504|                   Type = [Struct] StructuredBindingDataMemberStruct
+# 1504|                   ValueCategory = lvalue
+# 1504|             getExpr().getFullyConverted(): [ReferenceToExpr] (reference to)
+# 1504|                 Type = [LValueReferenceType] int &
+# 1504|                 ValueCategory = prvalue
+# 1505|       getStmt(2): [DeclStmt] declaration
+# 1505|         getDeclarationEntry(0): [VariableDeclarationEntry] definition of d
+# 1505|             Type = [LValueReferenceType] double &
+# 1505|           getVariable().getInitializer(): [Initializer] initializer for d
+# 1505|             getExpr(): [ValueFieldAccess] d
+# 1505|                 Type = [DoubleType] double
+# 1505|                 ValueCategory = lvalue
+# 1505|               getQualifier(): [VariableAccess] unnamed_local_variable
+# 1505|                   Type = [Struct] StructuredBindingDataMemberStruct
+# 1505|                   ValueCategory = lvalue
+# 1505|             getExpr().getFullyConverted(): [ReferenceToExpr] (reference to)
+# 1505|                 Type = [LValueReferenceType] double &
+# 1505|                 ValueCategory = prvalue
+# 1507|       getStmt(3): [DeclStmt] declaration
+# 1507|         getDeclarationEntry(0): [VariableDeclarationEntry] definition of r
+# 1507|             Type = [LValueReferenceType] int &
+# 1507|           getVariable().getInitializer(): [Initializer] initializer for r
+# 1507|             getExpr(): [ValueFieldAccess] r
+# 1507|                 Type = [LValueReferenceType] int &
+# 1507|                 ValueCategory = prvalue(load)
+# 1507|               getQualifier(): [VariableAccess] unnamed_local_variable
+# 1507|                   Type = [Struct] StructuredBindingDataMemberStruct
+# 1507|                   ValueCategory = lvalue
+# 1507|             getExpr().getFullyConverted(): [ReferenceToExpr] (reference to)
+# 1507|                 Type = [LValueReferenceType] int &
+# 1507|                 ValueCategory = prvalue
+# 1507|               getExpr(): [ReferenceDereferenceExpr] (reference dereference)
+# 1507|                   Type = [IntType] int
+# 1507|                   ValueCategory = lvalue
+# 1508|       getStmt(4): [ExprStmt] ExprStmt
+# 1508|         getExpr(): [AssignExpr] ... = ...
+# 1508|             Type = [DoubleType] double
+# 1508|             ValueCategory = lvalue
+# 1508|           getLValue(): [VariableAccess] d
+# 1508|               Type = [LValueReferenceType] double &
+# 1508|               ValueCategory = prvalue(load)
+# 1508|           getRValue(): [Literal] 4.0
+# 1508|               Type = [DoubleType] double
+# 1508|               Value = [Literal] 4.0
+# 1508|               ValueCategory = prvalue
+# 1508|           getLValue().getFullyConverted(): [ReferenceDereferenceExpr] (reference dereference)
+# 1508|               Type = [DoubleType] double
+# 1508|               ValueCategory = lvalue
+# 1509|       getStmt(5): [DeclStmt] declaration
+# 1509|         getDeclarationEntry(0): [VariableDeclarationEntry] definition of rd
+# 1509|             Type = [LValueReferenceType] double &
+# 1509|           getVariable().getInitializer(): [Initializer] initializer for rd
+# 1509|             getExpr(): [VariableAccess] d
+# 1509|                 Type = [LValueReferenceType] double &
+# 1509|                 ValueCategory = prvalue(load)
+# 1509|             getExpr().getFullyConverted(): [ReferenceToExpr] (reference to)
+# 1509|                 Type = [LValueReferenceType] double &
+# 1509|                 ValueCategory = prvalue
+# 1509|               getExpr(): [ReferenceDereferenceExpr] (reference dereference)
+# 1509|                   Type = [DoubleType] double
+# 1509|                   ValueCategory = lvalue
+# 1510|       getStmt(6): [DeclStmt] declaration
+# 1510|         getDeclarationEntry(0): [VariableDeclarationEntry] definition of v
+# 1510|             Type = [IntType] int
+# 1510|           getVariable().getInitializer(): [Initializer] initializer for v
+# 1510|             getExpr(): [VariableAccess] i
+# 1510|                 Type = [LValueReferenceType] int &
+# 1510|                 ValueCategory = prvalue(load)
+# 1510|             getExpr().getFullyConverted(): [ReferenceDereferenceExpr] (reference dereference)
+# 1510|                 Type = [IntType] int
+# 1510|                 ValueCategory = prvalue(load)
+# 1511|       getStmt(7): [ExprStmt] ExprStmt
+# 1511|         getExpr(): [AssignExpr] ... = ...
+# 1511|             Type = [IntType] int
+# 1511|             ValueCategory = lvalue
+# 1511|           getLValue(): [VariableAccess] r
+# 1511|               Type = [LValueReferenceType] int &
+# 1511|               ValueCategory = prvalue(load)
+# 1511|           getRValue(): [Literal] 5
+# 1511|               Type = [IntType] int
+# 1511|               Value = [Literal] 5
+# 1511|               ValueCategory = prvalue
+# 1511|           getLValue().getFullyConverted(): [ReferenceDereferenceExpr] (reference dereference)
+# 1511|               Type = [IntType] int
+# 1511|               ValueCategory = lvalue
+# 1512|       getStmt(8): [DeclStmt] declaration
+# 1512|         getDeclarationEntry(0): [VariableDeclarationEntry] definition of rr
+# 1512|             Type = [LValueReferenceType] int &
+# 1512|           getVariable().getInitializer(): [Initializer] initializer for rr
+# 1512|             getExpr(): [VariableAccess] r
+# 1512|                 Type = [LValueReferenceType] int &
+# 1512|                 ValueCategory = prvalue(load)
+# 1512|             getExpr().getFullyConverted(): [ReferenceToExpr] (reference to)
+# 1512|                 Type = [LValueReferenceType] int &
+# 1512|                 ValueCategory = prvalue
+# 1512|               getExpr(): [ReferenceDereferenceExpr] (reference dereference)
+# 1512|                   Type = [IntType] int
+# 1512|                   ValueCategory = lvalue
+# 1513|       getStmt(9): [DeclStmt] declaration
+# 1513|         getDeclarationEntry(0): [VariableDeclarationEntry] definition of w
+# 1513|             Type = [IntType] int
+# 1513|           getVariable().getInitializer(): [Initializer] initializer for w
+# 1513|             getExpr(): [VariableAccess] r
+# 1513|                 Type = [LValueReferenceType] int &
+# 1513|                 ValueCategory = prvalue(load)
+# 1513|             getExpr().getFullyConverted(): [ReferenceDereferenceExpr] (reference dereference)
+# 1513|                 Type = [IntType] int
+# 1513|                 ValueCategory = prvalue(load)
+# 1515|     getStmt(3): [ReturnStmt] return ...
+# 1522| [CopyAssignmentOperator] std::tuple_size<StructuredBindingTuple>& std::tuple_size<StructuredBindingTuple>::operator=(std::tuple_size<StructuredBindingTuple> const&)
+# 1522|   <params>: 
+#-----|     getParameter(0): [Parameter] (unnamed parameter 0)
+#-----|         Type = [LValueReferenceType] const tuple_size<StructuredBindingTuple> &
+# 1522| [MoveAssignmentOperator] std::tuple_size<StructuredBindingTuple>& std::tuple_size<StructuredBindingTuple>::operator=(std::tuple_size<StructuredBindingTuple>&&)
+# 1522|   <params>: 
+#-----|     getParameter(0): [Parameter] (unnamed parameter 0)
+#-----|         Type = [RValueReferenceType] tuple_size<StructuredBindingTuple> &&
+# 1529| [CopyAssignmentOperator] std::tuple_element<int 0, StructuredBindingTuple>& std::tuple_element<int 0, StructuredBindingTuple>::operator=(std::tuple_element<int 0, StructuredBindingTuple> const&)
+# 1529|   <params>: 
+#-----|     getParameter(0): [Parameter] (unnamed parameter 0)
+#-----|         Type = [LValueReferenceType] const tuple_element<0, StructuredBindingTuple> &
+# 1529| [MoveAssignmentOperator] std::tuple_element<int 0, StructuredBindingTuple>& std::tuple_element<int 0, StructuredBindingTuple>::operator=(std::tuple_element<int 0, StructuredBindingTuple>&&)
+# 1529|   <params>: 
+#-----|     getParameter(0): [Parameter] (unnamed parameter 0)
+#-----|         Type = [RValueReferenceType] tuple_element<0, StructuredBindingTuple> &&
+# 1533| [CopyAssignmentOperator] std::tuple_element<int 1, StructuredBindingTuple>& std::tuple_element<int 1, StructuredBindingTuple>::operator=(std::tuple_element<int 1, StructuredBindingTuple> const&)
+# 1533|   <params>: 
+#-----|     getParameter(0): [Parameter] (unnamed parameter 0)
+#-----|         Type = [LValueReferenceType] const tuple_element<1, StructuredBindingTuple> &
+# 1533| [MoveAssignmentOperator] std::tuple_element<int 1, StructuredBindingTuple>& std::tuple_element<int 1, StructuredBindingTuple>::operator=(std::tuple_element<int 1, StructuredBindingTuple>&&)
+# 1533|   <params>: 
+#-----|     getParameter(0): [Parameter] (unnamed parameter 0)
+#-----|         Type = [RValueReferenceType] tuple_element<1, StructuredBindingTuple> &&
+# 1537| [CopyAssignmentOperator] std::tuple_element<int 2, StructuredBindingTuple>& std::tuple_element<int 2, StructuredBindingTuple>::operator=(std::tuple_element<int 2, StructuredBindingTuple> const&)
+# 1537|   <params>: 
+#-----|     getParameter(0): [Parameter] (unnamed parameter 0)
+#-----|         Type = [LValueReferenceType] const tuple_element<2, StructuredBindingTuple> &
+# 1537| [MoveAssignmentOperator] std::tuple_element<int 2, StructuredBindingTuple>& std::tuple_element<int 2, StructuredBindingTuple>::operator=(std::tuple_element<int 2, StructuredBindingTuple>&&)
+# 1537|   <params>: 
+#-----|     getParameter(0): [Parameter] (unnamed parameter 0)
+#-----|         Type = [RValueReferenceType] tuple_element<2, StructuredBindingTuple> &&
+# 1542| [CopyAssignmentOperator] StructuredBindingTuple& StructuredBindingTuple::operator=(StructuredBindingTuple const&)
+# 1542|   <params>: 
+#-----|     getParameter(0): [Parameter] (unnamed parameter 0)
+#-----|         Type = [LValueReferenceType] const StructuredBindingTuple &
+# 1542| [Constructor] void StructuredBindingTuple::StructuredBindingTuple()
+# 1542|   <params>: 
+# 1542|   <initializations>: 
+# 1542|     getInitializer(0): [ConstructorFieldInit] constructor init of field i
+# 1542|         Type = [IntType] int
+# 1542|         ValueCategory = prvalue
+# 1542|     getInitializer(1): [ConstructorFieldInit] constructor init of field d
+# 1542|         Type = [DoubleType] double
+# 1542|         ValueCategory = prvalue
+# 1542|     getInitializer(2): [ConstructorFieldInit] constructor init of field r
+# 1542|         Type = [LValueReferenceType] int &
+# 1542|         ValueCategory = prvalue
+# 1542|   getEntryPoint(): [BlockStmt] { ... }
+# 1542|     getStmt(0): [ReturnStmt] return ...
+# 1542| [CopyConstructor] void StructuredBindingTuple::StructuredBindingTuple(StructuredBindingTuple const&)
+# 1542|   <params>: 
+#-----|     getParameter(0): [Parameter] (unnamed parameter 0)
+#-----|         Type = [LValueReferenceType] const StructuredBindingTuple &
+# 1542|   <initializations>: 
+# 1542|     getInitializer(0): [ConstructorFieldInit] constructor init of field i
+# 1542|         Type = [IntType] int
+# 1542|         ValueCategory = prvalue
+# 1542|       getExpr(): [Literal] Unknown literal
+# 1542|           Type = [IntType] int
+# 1542|           ValueCategory = prvalue
+# 1542|     getInitializer(1): [ConstructorFieldInit] constructor init of field d
+# 1542|         Type = [DoubleType] double
+# 1542|         ValueCategory = prvalue
+# 1542|       getExpr(): [Literal] Unknown literal
+# 1542|           Type = [DoubleType] double
+# 1542|           ValueCategory = prvalue
+# 1542|     getInitializer(2): [ConstructorFieldInit] constructor init of field r
+# 1542|         Type = [LValueReferenceType] int &
+# 1542|         ValueCategory = prvalue
+# 1542|       getExpr(): [Literal] Unknown literal
+# 1542|           Type = [LValueReferenceType] int &
+# 1542|           ValueCategory = prvalue
+# 1542|   getEntryPoint(): [BlockStmt] { ... }
+# 1542|     getStmt(0): [ReturnStmt] return ...
+# 1542| [MoveConstructor] void StructuredBindingTuple::StructuredBindingTuple(StructuredBindingTuple&&)
+# 1542|   <params>: 
+#-----|     getParameter(0): [Parameter] (unnamed parameter 0)
+#-----|         Type = [RValueReferenceType] StructuredBindingTuple &&
+# 1548| [MemberFunction,TemplateFunction] type& StructuredBindingTuple::get<int i>()
+# 1548|   <params>: 
+# 1552| [FunctionTemplateSpecialization,MemberFunction] std::tuple_element<int 0, StructuredBindingTuple>::type& StructuredBindingTuple::get<int 0>()
+# 1552|   <params>: 
+# 1552|   getEntryPoint(): [BlockStmt] { ... }
+# 1552|     getStmt(0): [ReturnStmt] return ...
+# 1552|       getExpr(): [PointerFieldAccess] i
+# 1552|           Type = [IntType] int
+# 1552|           ValueCategory = lvalue
+# 1552|         getQualifier(): [ThisExpr] this
+# 1552|             Type = [PointerType] StructuredBindingTuple *
+# 1552|             ValueCategory = prvalue(load)
+#-----|       getExpr().getFullyConverted(): [ReferenceToExpr] (reference to)
+#-----|           Type = [LValueReferenceType] int &
+#-----|           ValueCategory = prvalue
+# 1554| [FunctionTemplateSpecialization,MemberFunction] std::tuple_element<int 1, StructuredBindingTuple>::type& StructuredBindingTuple::get<int 1>()
+# 1554|   <params>: 
+# 1554|   getEntryPoint(): [BlockStmt] { ... }
+# 1554|     getStmt(0): [ReturnStmt] return ...
+# 1554|       getExpr(): [PointerFieldAccess] d
+# 1554|           Type = [DoubleType] double
+# 1554|           ValueCategory = lvalue
+# 1554|         getQualifier(): [ThisExpr] this
+# 1554|             Type = [PointerType] StructuredBindingTuple *
+# 1554|             ValueCategory = prvalue(load)
+#-----|       getExpr().getFullyConverted(): [ReferenceToExpr] (reference to)
+#-----|           Type = [LValueReferenceType] double &
+#-----|           ValueCategory = prvalue
+# 1556| [FunctionTemplateSpecialization,MemberFunction] std::tuple_element<int 2, StructuredBindingTuple>::type StructuredBindingTuple::get<int 2>()
+# 1556|   <params>: 
+# 1556|   getEntryPoint(): [BlockStmt] { ... }
+# 1556|     getStmt(0): [ReturnStmt] return ...
+# 1556|       getExpr(): [PointerFieldAccess] r
+# 1556|           Type = [LValueReferenceType] int &
+# 1556|           ValueCategory = prvalue(load)
+# 1556|         getQualifier(): [ThisExpr] this
+# 1556|             Type = [PointerType] StructuredBindingTuple *
+# 1556|             ValueCategory = prvalue(load)
+# 1556|       getExpr().getFullyConverted(): [ReferenceToExpr] (reference to)
+# 1556|           Type = [LValueReferenceType] int &
+# 1556|           ValueCategory = prvalue
+# 1556|         getExpr(): [ReferenceDereferenceExpr] (reference dereference)
+# 1556|             Type = [IntType] int
+# 1556|             ValueCategory = lvalue
+# 1558| [TopLevelFunction] void tuple_structured_binding()
+# 1558|   <params>: 
+# 1558|   getEntryPoint(): [BlockStmt] { ... }
+# 1559|     getStmt(0): [DeclStmt] declaration
+# 1559|       getDeclarationEntry(0): [VariableDeclarationEntry] definition of t
+# 1559|           Type = [Struct] StructuredBindingTuple
+# 1559|         getVariable().getInitializer(): [Initializer] initializer for t
+# 1559|           getExpr(): [ConstructorCall] call to StructuredBindingTuple
+# 1559|               Type = [VoidType] void
+# 1559|               ValueCategory = prvalue
+# 1561|     getStmt(1): [BlockStmt] { ... }
+# 1562|       getStmt(0): [DeclStmt] declaration
+# 1562|         getDeclarationEntry(0): (no string representation)
+# 1562|             Type = [Struct] StructuredBindingTuple
+# 1562|           getVariable().getInitializer(): [Initializer] initializer for (unnamed local variable)
+# 1562|             getExpr(): [VariableAccess] t
+# 1562|                 Type = [Struct] StructuredBindingTuple
+# 1562|                 ValueCategory = prvalue(load)
+# 1562|         getDeclarationEntry(1): [VariableDeclarationEntry] definition of i
+# 1562|             Type = [LValueReferenceType] type &
+#-----|           getVariable().getInitializer(): [Initializer] initializer for i
+# 1562|             getExpr(): [FunctionCall] call to get
+# 1562|                 Type = [LValueReferenceType] type &
+# 1562|                 ValueCategory = prvalue
+# 1562|               getQualifier(): [VariableAccess] (unnamed local variable)
+# 1562|                   Type = [Struct] StructuredBindingTuple
+# 1562|                   ValueCategory = xvalue
+# 1562|             getExpr().getFullyConverted(): [ReferenceToExpr] (reference to)
+# 1562|                 Type = [LValueReferenceType] type &
+# 1562|                 ValueCategory = prvalue
+# 1562|               getExpr(): [ReferenceDereferenceExpr] (reference dereference)
+# 1562|                   Type = [NestedTypedefType,UsingAliasTypedefType] type
+# 1562|                   ValueCategory = lvalue
+# 1562|         getDeclarationEntry(2): [VariableDeclarationEntry] definition of d
+# 1562|             Type = [LValueReferenceType] type &
+#-----|           getVariable().getInitializer(): [Initializer] initializer for d
+# 1562|             getExpr(): [FunctionCall] call to get
+# 1562|                 Type = [LValueReferenceType] type &
+# 1562|                 ValueCategory = prvalue
+# 1562|               getQualifier(): [VariableAccess] (unnamed local variable)
+# 1562|                   Type = [Struct] StructuredBindingTuple
+# 1562|                   ValueCategory = xvalue
+# 1562|             getExpr().getFullyConverted(): [ReferenceToExpr] (reference to)
+# 1562|                 Type = [LValueReferenceType] type &
+# 1562|                 ValueCategory = prvalue
+# 1562|               getExpr(): [ReferenceDereferenceExpr] (reference dereference)
+# 1562|                   Type = [NestedTypedefType,UsingAliasTypedefType] type
+# 1562|                   ValueCategory = lvalue
+# 1562|         getDeclarationEntry(3): [VariableDeclarationEntry] definition of r
+# 1562|             Type = [NestedTypedefType,UsingAliasTypedefType] type
+#-----|           getVariable().getInitializer(): [Initializer] initializer for r
+# 1562|             getExpr(): [FunctionCall] call to get
+# 1562|                 Type = [NestedTypedefType,UsingAliasTypedefType] type
+# 1562|                 ValueCategory = prvalue
+# 1562|               getQualifier(): [VariableAccess] (unnamed local variable)
+# 1562|                   Type = [Struct] StructuredBindingTuple
+# 1562|                   ValueCategory = xvalue
+# 1562|             getExpr().getFullyConverted(): [ReferenceToExpr] (reference to)
+# 1562|                 Type = [LValueReferenceType] int &
+# 1562|                 ValueCategory = prvalue
+# 1562|               getExpr(): [ReferenceDereferenceExpr] (reference dereference)
+# 1562|                   Type = [IntType] int
+# 1562|                   ValueCategory = lvalue
+# 1563|       getStmt(1): [ExprStmt] ExprStmt
+# 1563|         getExpr(): [AssignExpr] ... = ...
+# 1563|             Type = [NestedTypedefType,UsingAliasTypedefType] type
+# 1563|             ValueCategory = lvalue
+# 1563|           getLValue(): [VariableAccess] d
+# 1563|               Type = [LValueReferenceType] type &
+# 1563|               ValueCategory = prvalue(load)
+# 1563|           getRValue(): [Literal] 4.0
+# 1563|               Type = [NestedTypedefType,UsingAliasTypedefType] type
+# 1563|               Value = [Literal] 4.0
+# 1563|               ValueCategory = prvalue
+# 1563|           getLValue().getFullyConverted(): [ReferenceDereferenceExpr] (reference dereference)
+# 1563|               Type = [NestedTypedefType,UsingAliasTypedefType] type
+# 1563|               ValueCategory = lvalue
+# 1564|       getStmt(2): [DeclStmt] declaration
+# 1564|         getDeclarationEntry(0): [VariableDeclarationEntry] definition of rd
+# 1564|             Type = [LValueReferenceType] double &
+# 1564|           getVariable().getInitializer(): [Initializer] initializer for rd
+# 1564|             getExpr(): [VariableAccess] d
+# 1564|                 Type = [LValueReferenceType] type &
+# 1564|                 ValueCategory = prvalue(load)
+# 1564|             getExpr().getFullyConverted(): [ReferenceToExpr] (reference to)
+# 1564|                 Type = [LValueReferenceType] type &
+# 1564|                 ValueCategory = prvalue
+# 1564|               getExpr(): [ReferenceDereferenceExpr] (reference dereference)
+# 1564|                   Type = [NestedTypedefType,UsingAliasTypedefType] type
+# 1564|                   ValueCategory = lvalue
+# 1565|       getStmt(3): [DeclStmt] declaration
+# 1565|         getDeclarationEntry(0): [VariableDeclarationEntry] definition of v
+# 1565|             Type = [IntType] int
+# 1565|           getVariable().getInitializer(): [Initializer] initializer for v
+# 1565|             getExpr(): [VariableAccess] i
+# 1565|                 Type = [LValueReferenceType] type &
+# 1565|                 ValueCategory = prvalue(load)
+# 1565|             getExpr().getFullyConverted(): [ReferenceDereferenceExpr] (reference dereference)
+# 1565|                 Type = [NestedTypedefType,UsingAliasTypedefType] type
+# 1565|                 ValueCategory = prvalue(load)
+# 1566|       getStmt(4): [ExprStmt] ExprStmt
+# 1566|         getExpr(): [AssignExpr] ... = ...
+# 1566|             Type = [IntType] int
+# 1566|             ValueCategory = lvalue
+# 1566|           getLValue(): [VariableAccess] r
+# 1566|               Type = [NestedTypedefType,UsingAliasTypedefType] type
+# 1566|               ValueCategory = prvalue(load)
+# 1566|           getRValue(): [Literal] 5
+# 1566|               Type = [IntType] int
+# 1566|               Value = [Literal] 5
+# 1566|               ValueCategory = prvalue
+# 1566|           getLValue().getFullyConverted(): [ReferenceDereferenceExpr] (reference dereference)
+# 1566|               Type = [IntType] int
+# 1566|               ValueCategory = lvalue
+# 1567|       getStmt(5): [DeclStmt] declaration
+# 1567|         getDeclarationEntry(0): [VariableDeclarationEntry] definition of rr
+# 1567|             Type = [LValueReferenceType] int &
+# 1567|           getVariable().getInitializer(): [Initializer] initializer for rr
+# 1567|             getExpr(): [VariableAccess] r
+# 1567|                 Type = [NestedTypedefType,UsingAliasTypedefType] type
+# 1567|                 ValueCategory = prvalue(load)
+# 1567|             getExpr().getFullyConverted(): [ReferenceToExpr] (reference to)
+# 1567|                 Type = [LValueReferenceType] int &
+# 1567|                 ValueCategory = prvalue
+# 1567|               getExpr(): [ReferenceDereferenceExpr] (reference dereference)
+# 1567|                   Type = [IntType] int
+# 1567|                   ValueCategory = lvalue
+# 1568|       getStmt(6): [DeclStmt] declaration
+# 1568|         getDeclarationEntry(0): [VariableDeclarationEntry] definition of w
+# 1568|             Type = [IntType] int
+# 1568|           getVariable().getInitializer(): [Initializer] initializer for w
+# 1568|             getExpr(): [VariableAccess] r
+# 1568|                 Type = [NestedTypedefType,UsingAliasTypedefType] type
+# 1568|                 ValueCategory = prvalue(load)
+# 1568|             getExpr().getFullyConverted(): [ReferenceDereferenceExpr] (reference dereference)
+# 1568|                 Type = [IntType] int
+# 1568|                 ValueCategory = prvalue(load)
+# 1571|     getStmt(2): [BlockStmt] { ... }
+# 1572|       getStmt(0): [DeclStmt] declaration
+# 1572|         getDeclarationEntry(0): [VariableDeclarationEntry] definition of unnamed_local_variable
+# 1572|             Type = [Struct] StructuredBindingTuple
+# 1572|           getVariable().getInitializer(): [Initializer] initializer for unnamed_local_variable
+# 1572|             getExpr(): [VariableAccess] t
+# 1572|                 Type = [Struct] StructuredBindingTuple
+# 1572|                 ValueCategory = prvalue(load)
+# 1573|       getStmt(1): [DeclStmt] declaration
+# 1573|         getDeclarationEntry(0): [VariableDeclarationEntry] definition of i
+# 1573|             Type = [LValueReferenceType] type &
+# 1573|           getVariable().getInitializer(): [Initializer] initializer for i
+# 1573|             getExpr(): [FunctionCall] call to get
+# 1573|                 Type = [LValueReferenceType] type &
+# 1573|                 ValueCategory = prvalue
+# 1573|               getQualifier(): [VariableAccess] unnamed_local_variable
+# 1573|                   Type = [Struct] StructuredBindingTuple
+# 1573|                   ValueCategory = lvalue
+# 1573|             getExpr().getFullyConverted(): [ReferenceToExpr] (reference to)
+# 1573|                 Type = [LValueReferenceType] type &
+# 1573|                 ValueCategory = prvalue
+# 1573|               getExpr(): [ReferenceDereferenceExpr] (reference dereference)
+# 1573|                   Type = [NestedTypedefType,UsingAliasTypedefType] type
+# 1573|                   ValueCategory = lvalue
+# 1574|       getStmt(2): [DeclStmt] declaration
+# 1574|         getDeclarationEntry(0): [VariableDeclarationEntry] definition of d
+# 1574|             Type = [LValueReferenceType] type &
+# 1574|           getVariable().getInitializer(): [Initializer] initializer for d
+# 1574|             getExpr(): [FunctionCall] call to get
+# 1574|                 Type = [LValueReferenceType] type &
+# 1574|                 ValueCategory = prvalue
+# 1574|               getQualifier(): [VariableAccess] unnamed_local_variable
+# 1574|                   Type = [Struct] StructuredBindingTuple
+# 1574|                   ValueCategory = lvalue
+# 1574|             getExpr().getFullyConverted(): [ReferenceToExpr] (reference to)
+# 1574|                 Type = [LValueReferenceType] type &
+# 1574|                 ValueCategory = prvalue
+# 1574|               getExpr(): [ReferenceDereferenceExpr] (reference dereference)
+# 1574|                   Type = [NestedTypedefType,UsingAliasTypedefType] type
+# 1574|                   ValueCategory = lvalue
+# 1575|       getStmt(3): [DeclStmt] declaration
+# 1575|         getDeclarationEntry(0): [VariableDeclarationEntry] definition of r
+# 1575|             Type = [LValueReferenceType] int &
+# 1575|           getVariable().getInitializer(): [Initializer] initializer for r
+# 1575|             getExpr(): [FunctionCall] call to get
+# 1575|                 Type = [NestedTypedefType,UsingAliasTypedefType] type
+# 1575|                 ValueCategory = prvalue
+# 1575|               getQualifier(): [VariableAccess] unnamed_local_variable
+# 1575|                   Type = [Struct] StructuredBindingTuple
+# 1575|                   ValueCategory = lvalue
+# 1575|             getExpr().getFullyConverted(): [ReferenceToExpr] (reference to)
+# 1575|                 Type = [LValueReferenceType] int &
+# 1575|                 ValueCategory = prvalue
+# 1575|               getExpr(): [ReferenceDereferenceExpr] (reference dereference)
+# 1575|                   Type = [IntType] int
+# 1575|                   ValueCategory = lvalue
+# 1576|       getStmt(4): [ExprStmt] ExprStmt
+# 1576|         getExpr(): [AssignExpr] ... = ...
+# 1576|             Type = [NestedTypedefType,UsingAliasTypedefType] type
+# 1576|             ValueCategory = lvalue
+# 1576|           getLValue(): [VariableAccess] d
+# 1576|               Type = [LValueReferenceType] type &
+# 1576|               ValueCategory = prvalue(load)
+# 1576|           getRValue(): [Literal] 4.0
+# 1576|               Type = [NestedTypedefType,UsingAliasTypedefType] type
+# 1576|               Value = [Literal] 4.0
+# 1576|               ValueCategory = prvalue
+# 1576|           getLValue().getFullyConverted(): [ReferenceDereferenceExpr] (reference dereference)
+# 1576|               Type = [NestedTypedefType,UsingAliasTypedefType] type
+# 1576|               ValueCategory = lvalue
+# 1577|       getStmt(5): [DeclStmt] declaration
+# 1577|         getDeclarationEntry(0): [VariableDeclarationEntry] definition of rd
+# 1577|             Type = [LValueReferenceType] double &
+# 1577|           getVariable().getInitializer(): [Initializer] initializer for rd
+# 1577|             getExpr(): [VariableAccess] d
+# 1577|                 Type = [LValueReferenceType] type &
+# 1577|                 ValueCategory = prvalue(load)
+# 1577|             getExpr().getFullyConverted(): [ReferenceToExpr] (reference to)
+# 1577|                 Type = [LValueReferenceType] type &
+# 1577|                 ValueCategory = prvalue
+# 1577|               getExpr(): [ReferenceDereferenceExpr] (reference dereference)
+# 1577|                   Type = [NestedTypedefType,UsingAliasTypedefType] type
+# 1577|                   ValueCategory = lvalue
+# 1578|       getStmt(6): [DeclStmt] declaration
+# 1578|         getDeclarationEntry(0): [VariableDeclarationEntry] definition of v
+# 1578|             Type = [IntType] int
+# 1578|           getVariable().getInitializer(): [Initializer] initializer for v
+# 1578|             getExpr(): [VariableAccess] i
+# 1578|                 Type = [LValueReferenceType] type &
+# 1578|                 ValueCategory = prvalue(load)
+# 1578|             getExpr().getFullyConverted(): [ReferenceDereferenceExpr] (reference dereference)
+# 1578|                 Type = [NestedTypedefType,UsingAliasTypedefType] type
+# 1578|                 ValueCategory = prvalue(load)
+# 1579|       getStmt(7): [ExprStmt] ExprStmt
+# 1579|         getExpr(): [AssignExpr] ... = ...
+# 1579|             Type = [IntType] int
+# 1579|             ValueCategory = lvalue
+# 1579|           getLValue(): [VariableAccess] r
+# 1579|               Type = [LValueReferenceType] int &
+# 1579|               ValueCategory = prvalue(load)
+# 1579|           getRValue(): [Literal] 5
+# 1579|               Type = [IntType] int
+# 1579|               Value = [Literal] 5
+# 1579|               ValueCategory = prvalue
+# 1579|           getLValue().getFullyConverted(): [ReferenceDereferenceExpr] (reference dereference)
+# 1579|               Type = [IntType] int
+# 1579|               ValueCategory = lvalue
+# 1580|       getStmt(8): [DeclStmt] declaration
+# 1580|         getDeclarationEntry(0): [VariableDeclarationEntry] definition of rr
+# 1580|             Type = [LValueReferenceType] int &
+# 1580|           getVariable().getInitializer(): [Initializer] initializer for rr
+# 1580|             getExpr(): [VariableAccess] r
+# 1580|                 Type = [LValueReferenceType] int &
+# 1580|                 ValueCategory = prvalue(load)
+# 1580|             getExpr().getFullyConverted(): [ReferenceToExpr] (reference to)
+# 1580|                 Type = [LValueReferenceType] int &
+# 1580|                 ValueCategory = prvalue
+# 1580|               getExpr(): [ReferenceDereferenceExpr] (reference dereference)
+# 1580|                   Type = [IntType] int
+# 1580|                   ValueCategory = lvalue
+# 1581|       getStmt(9): [DeclStmt] declaration
+# 1581|         getDeclarationEntry(0): [VariableDeclarationEntry] definition of w
+# 1581|             Type = [IntType] int
+# 1581|           getVariable().getInitializer(): [Initializer] initializer for w
+# 1581|             getExpr(): [VariableAccess] r
+# 1581|                 Type = [LValueReferenceType] int &
+# 1581|                 ValueCategory = prvalue(load)
+# 1581|             getExpr().getFullyConverted(): [ReferenceDereferenceExpr] (reference dereference)
+# 1581|                 Type = [IntType] int
+# 1581|                 ValueCategory = prvalue(load)
+# 1583|     getStmt(3): [ReturnStmt] return ...
 perf-regression.cpp:
 #    4| [CopyAssignmentOperator] Big& Big::operator=(Big const&)
 #    4|   <params>: 

cpp/ql/test/library-tests/ir/ir/ir.cpp

@@ -1447,4 +1447,139 @@ void temporary_hierarchy() {
     float f = (returnValue<POD_Derived>()).f();
 }
 
+struct Inheritance_Test_B {
+  ~Inheritance_Test_B() {}
+};
+
+struct Inheritance_Test_A : public Inheritance_Test_B {
+  int x;
+  int y;
+  Inheritance_Test_A() : x(42) {
+    y = 3;
+  }
+};
+
+void array_structured_binding() {
+    int xs[2] = {1, 2};
+    // structured binding use
+    {
+        auto& [x0, x1] = xs;
+        x1 = 3;
+        int &rx1 = x1;
+        int x = x1;
+    }
+    // explicit reference version
+    {
+        auto& unnamed_local_variable = xs;
+        auto& x0 = xs[0];
+        auto& x1 = xs[1];
+        x1 = 3;
+        int &rx1 = x1;
+        int x = x1;
+    }
+}
+
+struct StructuredBindingDataMemberStruct {
+    int i = 1;
+    double d = 2.0;
+    unsigned int b : 3;
+    int& r = i;
+};
+
+void data_member_structured_binding() {
+    StructuredBindingDataMemberStruct s;
+    // structured binding use
+    {
+        auto [i, d, b, r] = s;
+        d = 4.0;
+        double& rd = d;
+        int v = i;
+        r = 5;
+        int& rr = r;
+        int w = r;
+    }
+    // explicit reference version
+    {
+        auto unnamed_local_variable = s;
+        auto& i = unnamed_local_variable.i;
+        auto& d = unnamed_local_variable.d;
+        // no equivalent for b
+        auto& r = unnamed_local_variable.r;
+        d = 4.0;
+        double& rd = d;
+        int v = i;
+        r = 5;
+        int& rr = r;
+        int w = r;
+    }
+}
+struct StructuredBindingTuple;
+
+namespace std {
+    template<typename T>
+    struct tuple_size;
+    template<>
+    struct tuple_size<StructuredBindingTuple> {
+        static const unsigned int value = 3;
+    };
+
+    template<int, typename T>
+    struct tuple_element;
+    template<>
+    struct tuple_element<0, StructuredBindingTuple> {
+        using type = int;
+    };
+    template<>
+    struct tuple_element<1, StructuredBindingTuple> {
+        using type = double;
+    };
+    template<>
+    struct tuple_element<2, StructuredBindingTuple> {
+        using type = int&;
+    };
+}
+
+struct StructuredBindingTuple {
+    int i = 1;
+    double d = 2.2;
+    int& r = i;
+
+    template<int i>
+    typename std::tuple_element<i, StructuredBindingTuple>::type& get();
+};
+
+template<>
+std::tuple_element<0, StructuredBindingTuple>::type& StructuredBindingTuple::get<0>() { return i; }
+template<>
+std::tuple_element<1, StructuredBindingTuple>::type& StructuredBindingTuple::get<1>() { return d; }
+template<>
+std::tuple_element<2, StructuredBindingTuple>::type& StructuredBindingTuple::get<2>() { return r; }
+
+void tuple_structured_binding() {
+    StructuredBindingTuple t;
+    // structured binding use
+    {
+        auto [i, d, r] = t;
+        d = 4.0;
+        double& rd = d;
+        int v = i;
+        r = 5;
+        int& rr = r;
+        int w = r;
+    }
+    // explicit reference version
+    {
+        auto unnamed_local_variable = t;
+        auto& i = unnamed_local_variable.get<0>();
+        auto& d = unnamed_local_variable.get<1>();
+        auto& r = unnamed_local_variable.get<2>();
+        d = 4.0;
+        double& rd = d;
+        int v = i;
+        r = 5;
+        int& rr = r;
+        int w = r;
+    }
+}
+
 // semmle-extractor-options: -std=c++17 --clang

cpp/ql/test/library-tests/ir/ir/operand_locations.expected

@@ -632,6 +632,7 @@
 | file://:0:0:0:0 | Address | &:r0_1 |
 | file://:0:0:0:0 | Address | &:r0_1 |
 | file://:0:0:0:0 | Address | &:r0_1 |
+| file://:0:0:0:0 | Address | &:r0_1 |
 | file://:0:0:0:0 | Address | &:r0_2 |
 | file://:0:0:0:0 | Address | &:r0_3 |
 | file://:0:0:0:0 | Address | &:r0_3 |
@@ -653,6 +654,7 @@
 | file://:0:0:0:0 | Address | &:r0_8 |
 | file://:0:0:0:0 | Address | &:r0_8 |
 | file://:0:0:0:0 | Address | &:r0_8 |
+| file://:0:0:0:0 | Address | &:r0_8 |
 | file://:0:0:0:0 | Address | &:r0_9 |
 | file://:0:0:0:0 | Address | &:r0_9 |
 | file://:0:0:0:0 | Address | &:r0_10 |
@@ -682,6 +684,8 @@
 | file://:0:0:0:0 | ChiTotal | total:m763_8 |
 | file://:0:0:0:0 | ChiTotal | total:m1043_10 |
 | file://:0:0:0:0 | ChiTotal | total:m1240_4 |
+| file://:0:0:0:0 | Left | r0_4 |
+| file://:0:0:0:0 | Left | r0_11 |
 | file://:0:0:0:0 | Load | m0_2 |
 | file://:0:0:0:0 | Load | m0_2 |
 | file://:0:0:0:0 | Load | m0_2 |
@@ -689,7 +693,11 @@
 | file://:0:0:0:0 | Load | m745_6 |
 | file://:0:0:0:0 | Load | m754_6 |
 | file://:0:0:0:0 | Load | m763_6 |
+| file://:0:0:0:0 | Load | m1466_4 |
+| file://:0:0:0:0 | Load | m1466_4 |
 | file://:0:0:0:0 | Load | ~m1444_6 |
+| file://:0:0:0:0 | Right | r0_5 |
+| file://:0:0:0:0 | Right | r0_12 |
 | file://:0:0:0:0 | SideEffect | m0_4 |
 | file://:0:0:0:0 | SideEffect | m0_4 |
 | file://:0:0:0:0 | SideEffect | m0_4 |
@@ -715,11 +723,17 @@
 | file://:0:0:0:0 | StoreValue | r0_1 |
 | file://:0:0:0:0 | StoreValue | r0_1 |
 | file://:0:0:0:0 | StoreValue | r0_1 |
+| file://:0:0:0:0 | StoreValue | r0_1 |
+| file://:0:0:0:0 | StoreValue | r0_1 |
 | file://:0:0:0:0 | StoreValue | r0_3 |
+| file://:0:0:0:0 | StoreValue | r0_6 |
+| file://:0:0:0:0 | StoreValue | r0_13 |
 | file://:0:0:0:0 | StoreValue | r0_13 |
 | file://:0:0:0:0 | StoreValue | r0_22 |
 | file://:0:0:0:0 | StoreValue | r0_22 |
 | file://:0:0:0:0 | Unary | r0_1 |
+| file://:0:0:0:0 | Unary | r0_2 |
+| file://:0:0:0:0 | Unary | r0_3 |
 | file://:0:0:0:0 | Unary | r0_5 |
 | file://:0:0:0:0 | Unary | r0_5 |
 | file://:0:0:0:0 | Unary | r0_6 |
@@ -730,6 +744,8 @@
 | file://:0:0:0:0 | Unary | r0_7 |
 | file://:0:0:0:0 | Unary | r0_8 |
 | file://:0:0:0:0 | Unary | r0_9 |
+| file://:0:0:0:0 | Unary | r0_9 |
+| file://:0:0:0:0 | Unary | r0_10 |
 | file://:0:0:0:0 | Unary | r0_10 |
 | file://:0:0:0:0 | Unary | r0_11 |
 | file://:0:0:0:0 | Unary | r0_12 |
@@ -6626,6 +6642,456 @@
 | ir.cpp:1447:44:1447:44 | ChiTotal | total:m1447_5 |
 | ir.cpp:1447:44:1447:44 | SideEffect | ~m1447_5 |
 | ir.cpp:1447:44:1447:44 | StoreValue | r1447_8 |
+| ir.cpp:1451:3:1451:21 | Address | &:r1451_5 |
+| ir.cpp:1451:3:1451:21 | Address | &:r1451_5 |
+| ir.cpp:1451:3:1451:21 | Address | &:r1451_7 |
+| ir.cpp:1451:3:1451:21 | Address | &:r1451_7 |
+| ir.cpp:1451:3:1451:21 | ChiPartial | partial:m1451_3 |
+| ir.cpp:1451:3:1451:21 | ChiTotal | total:m1451_2 |
+| ir.cpp:1451:3:1451:21 | Load | m1451_6 |
+| ir.cpp:1451:3:1451:21 | SideEffect | m1451_3 |
+| ir.cpp:1451:3:1451:21 | SideEffect | m1451_8 |
+| ir.cpp:1457:3:1457:20 | Address | &:r1457_5 |
+| ir.cpp:1457:3:1457:20 | Address | &:r1457_5 |
+| ir.cpp:1457:3:1457:20 | Address | &:r1457_7 |
+| ir.cpp:1457:3:1457:20 | Address | &:r1457_7 |
+| ir.cpp:1457:3:1457:20 | ChiPartial | partial:m1457_3 |
+| ir.cpp:1457:3:1457:20 | ChiTotal | total:m1457_2 |
+| ir.cpp:1457:3:1457:20 | Load | m1457_6 |
+| ir.cpp:1457:3:1457:20 | SideEffect | m1457_3 |
+| ir.cpp:1457:3:1457:20 | SideEffect | m1458_6 |
+| ir.cpp:1457:3:1457:20 | Unary | m1457_6 |
+| ir.cpp:1457:26:1457:30 | Address | &:r1457_9 |
+| ir.cpp:1457:26:1457:30 | ChiPartial | partial:m1457_11 |
+| ir.cpp:1457:26:1457:30 | ChiTotal | total:m1457_8 |
+| ir.cpp:1457:26:1457:30 | StoreValue | r1457_10 |
+| ir.cpp:1458:5:1458:5 | Address | &:r1458_2 |
+| ir.cpp:1458:5:1458:5 | Address | &:r1458_4 |
+| ir.cpp:1458:5:1458:5 | Load | m1457_6 |
+| ir.cpp:1458:5:1458:5 | Unary | r1458_3 |
+| ir.cpp:1458:5:1458:9 | ChiPartial | partial:m1458_5 |
+| ir.cpp:1458:5:1458:9 | ChiTotal | total:m1457_12 |
+| ir.cpp:1458:9:1458:9 | StoreValue | r1458_1 |
+| ir.cpp:1462:6:1462:29 | ChiPartial | partial:m1462_3 |
+| ir.cpp:1462:6:1462:29 | ChiTotal | total:m1462_2 |
+| ir.cpp:1462:6:1462:29 | SideEffect | m1462_3 |
+| ir.cpp:1463:9:1463:10 | Address | &:r1463_1 |
+| ir.cpp:1463:9:1463:10 | Left | r1463_1 |
+| ir.cpp:1463:9:1463:10 | Left | r1463_1 |
+| ir.cpp:1463:16:1463:22 | Address | &:r1463_4 |
+| ir.cpp:1463:16:1463:22 | Address | &:r1463_9 |
+| ir.cpp:1463:16:1463:22 | Right | r1463_3 |
+| ir.cpp:1463:16:1463:22 | Right | r1463_8 |
+| ir.cpp:1463:18:1463:18 | ChiPartial | partial:m1463_6 |
+| ir.cpp:1463:18:1463:18 | ChiTotal | total:m1463_2 |
+| ir.cpp:1463:18:1463:18 | StoreValue | r1463_5 |
+| ir.cpp:1463:21:1463:21 | ChiPartial | partial:m1463_11 |
+| ir.cpp:1463:21:1463:21 | ChiTotal | total:m1463_7 |
+| ir.cpp:1463:21:1463:21 | StoreValue | r1463_10 |
+| ir.cpp:1466:15:1466:15 | Address | &:r1466_1 |
+| ir.cpp:1466:16:1466:16 | Address | &:r1466_5 |
+| ir.cpp:1466:20:1466:20 | Address | &:r1466_6 |
+| ir.cpp:1466:26:1466:27 | StoreValue | r1466_3 |
+| ir.cpp:1466:26:1466:27 | Unary | r1466_2 |
+| ir.cpp:1467:9:1467:10 | Address | &:r1467_2 |
+| ir.cpp:1467:14:1467:14 | StoreValue | r1467_1 |
+| ir.cpp:1468:14:1468:16 | Address | &:r1468_1 |
+| ir.cpp:1468:20:1468:21 | StoreValue | r1468_3 |
+| ir.cpp:1468:20:1468:21 | Unary | r1468_2 |
+| ir.cpp:1469:13:1469:13 | Address | &:r1469_1 |
+| ir.cpp:1469:17:1469:18 | Address | &:r1469_2 |
+| ir.cpp:1469:17:1469:18 | Load | m1467_3 |
+| ir.cpp:1469:17:1469:18 | StoreValue | r1469_3 |
+| ir.cpp:1473:15:1473:36 | Address | &:r1473_1 |
+| ir.cpp:1473:40:1473:41 | StoreValue | r1473_3 |
+| ir.cpp:1473:40:1473:41 | Unary | r1473_2 |
+| ir.cpp:1474:15:1474:16 | Address | &:r1474_1 |
+| ir.cpp:1474:20:1474:21 | Left | r1474_3 |
+| ir.cpp:1474:20:1474:21 | Unary | r1474_2 |
+| ir.cpp:1474:20:1474:24 | StoreValue | r1474_6 |
+| ir.cpp:1474:20:1474:24 | Unary | r1474_5 |
+| ir.cpp:1474:23:1474:23 | Right | r1474_4 |
+| ir.cpp:1475:15:1475:16 | Address | &:r1475_1 |
+| ir.cpp:1475:20:1475:21 | Left | r1475_3 |
+| ir.cpp:1475:20:1475:21 | Unary | r1475_2 |
+| ir.cpp:1475:20:1475:24 | StoreValue | r1475_6 |
+| ir.cpp:1475:20:1475:24 | Unary | r1475_5 |
+| ir.cpp:1475:23:1475:23 | Right | r1475_4 |
+| ir.cpp:1476:9:1476:10 | Address | &:r1476_2 |
+| ir.cpp:1476:9:1476:10 | Address | &:r1476_4 |
+| ir.cpp:1476:9:1476:10 | Load | m1475_7 |
+| ir.cpp:1476:9:1476:10 | Unary | r1476_3 |
+| ir.cpp:1476:9:1476:14 | ChiPartial | partial:m1476_5 |
+| ir.cpp:1476:9:1476:14 | ChiTotal | total:m1463_12 |
+| ir.cpp:1476:14:1476:14 | StoreValue | r1476_1 |
+| ir.cpp:1477:14:1477:16 | Address | &:r1477_1 |
+| ir.cpp:1477:20:1477:21 | Address | &:r1477_2 |
+| ir.cpp:1477:20:1477:21 | Load | m1475_7 |
+| ir.cpp:1477:20:1477:21 | StoreValue | r1477_5 |
+| ir.cpp:1477:20:1477:21 | Unary | r1477_3 |
+| ir.cpp:1477:20:1477:21 | Unary | r1477_4 |
+| ir.cpp:1478:13:1478:13 | Address | &:r1478_1 |
+| ir.cpp:1478:17:1478:18 | Address | &:r1478_2 |
+| ir.cpp:1478:17:1478:18 | Address | &:r1478_3 |
+| ir.cpp:1478:17:1478:18 | Load | m1475_7 |
+| ir.cpp:1478:17:1478:18 | Load | m1476_5 |
+| ir.cpp:1478:17:1478:18 | StoreValue | r1478_4 |
+| ir.cpp:1482:8:1482:8 | Address | &:r1482_5 |
+| ir.cpp:1482:8:1482:8 | Address | &:r1482_5 |
+| ir.cpp:1482:8:1482:8 | Address | &:r1482_7 |
+| ir.cpp:1482:8:1482:8 | Address | &:r1482_7 |
+| ir.cpp:1482:8:1482:8 | ChiPartial | partial:m1482_3 |
+| ir.cpp:1482:8:1482:8 | ChiTotal | total:m1482_2 |
+| ir.cpp:1482:8:1482:8 | Load | m1482_6 |
+| ir.cpp:1482:8:1482:8 | SideEffect | m1482_3 |
+| ir.cpp:1482:8:1482:8 | SideEffect | m1482_8 |
+| ir.cpp:1489:6:1489:35 | ChiPartial | partial:m1489_3 |
+| ir.cpp:1489:6:1489:35 | ChiTotal | total:m1489_2 |
+| ir.cpp:1489:6:1489:35 | SideEffect | ~m1511_6 |
+| ir.cpp:1490:39:1490:39 | Address | &:r1490_1 |
+| ir.cpp:1490:39:1490:39 | Address | &:r1490_1 |
+| ir.cpp:1490:39:1490:39 | Arg(this) | this:r1490_1 |
+| ir.cpp:1490:39:1490:39 | CallTarget | func:r1490_3 |
+| ir.cpp:1490:39:1490:39 | ChiPartial | partial:m1490_5 |
+| ir.cpp:1490:39:1490:39 | ChiPartial | partial:m1490_7 |
+| ir.cpp:1490:39:1490:39 | ChiTotal | total:m1489_4 |
+| ir.cpp:1490:39:1490:39 | ChiTotal | total:m1490_2 |
+| ir.cpp:1490:39:1490:39 | SideEffect | ~m1489_4 |
+| ir.cpp:1493:14:1493:14 | Address | &:r1493_1 |
+| ir.cpp:1493:15:1493:15 | Address | &:r1493_5 |
+| ir.cpp:1493:18:1493:18 | Address | &:r1493_9 |
+| ir.cpp:1493:21:1493:21 | Address | &:r1493_13 |
+| ir.cpp:1493:24:1493:24 | Address | &:r1493_17 |
+| ir.cpp:1493:29:1493:29 | Address | &:r1493_2 |
+| ir.cpp:1493:29:1493:29 | Load | m1490_8 |
+| ir.cpp:1493:29:1493:29 | StoreValue | r1493_3 |
+| ir.cpp:1493:30:1493:30 | Address | &:r1493_19 |
+| ir.cpp:1493:30:1493:30 | Load | ~m1493_4 |
+| ir.cpp:1493:30:1493:30 | StoreValue | r1493_7 |
+| ir.cpp:1493:30:1493:30 | StoreValue | r1493_11 |
+| ir.cpp:1493:30:1493:30 | StoreValue | r1493_15 |
+| ir.cpp:1493:30:1493:30 | StoreValue | r1493_21 |
+| ir.cpp:1493:30:1493:30 | Unary | r1493_6 |
+| ir.cpp:1493:30:1493:30 | Unary | r1493_10 |
+| ir.cpp:1493:30:1493:30 | Unary | r1493_14 |
+| ir.cpp:1493:30:1493:30 | Unary | r1493_18 |
+| ir.cpp:1493:30:1493:30 | Unary | r1493_20 |
+| ir.cpp:1494:9:1494:9 | Address | &:r1494_2 |
+| ir.cpp:1494:13:1494:15 | StoreValue | r1494_1 |
+| ir.cpp:1495:17:1495:18 | Address | &:r1495_1 |
+| ir.cpp:1495:22:1495:22 | StoreValue | r1495_3 |
+| ir.cpp:1495:22:1495:22 | Unary | r1495_2 |
+| ir.cpp:1496:13:1496:13 | Address | &:r1496_1 |
+| ir.cpp:1496:17:1496:17 | Address | &:r1496_2 |
+| ir.cpp:1496:17:1496:17 | Load | m1493_8 |
+| ir.cpp:1496:17:1496:17 | StoreValue | r1496_3 |
+| ir.cpp:1497:9:1497:9 | Address | &:r1497_2 |
+| ir.cpp:1497:13:1497:13 | StoreValue | r1497_1 |
+| ir.cpp:1498:14:1498:15 | Address | &:r1498_1 |
+| ir.cpp:1498:19:1498:19 | StoreValue | r1498_3 |
+| ir.cpp:1498:19:1498:19 | Unary | r1498_2 |
+| ir.cpp:1499:13:1499:13 | Address | &:r1499_1 |
+| ir.cpp:1499:17:1499:17 | Address | &:r1499_2 |
+| ir.cpp:1499:17:1499:17 | Load | m1497_3 |
+| ir.cpp:1499:17:1499:17 | StoreValue | r1499_3 |
+| ir.cpp:1503:14:1503:35 | Address | &:r1503_1 |
+| ir.cpp:1503:39:1503:39 | Address | &:r1503_2 |
+| ir.cpp:1503:39:1503:39 | Load | m1490_8 |
+| ir.cpp:1503:39:1503:39 | StoreValue | r1503_3 |
+| ir.cpp:1504:15:1504:15 | Address | &:r1504_1 |
+| ir.cpp:1504:19:1504:40 | Unary | r1504_2 |
+| ir.cpp:1504:19:1504:42 | StoreValue | r1504_4 |
+| ir.cpp:1504:42:1504:42 | Unary | r1504_3 |
+| ir.cpp:1505:15:1505:15 | Address | &:r1505_1 |
+| ir.cpp:1505:19:1505:40 | Unary | r1505_2 |
+| ir.cpp:1505:19:1505:42 | StoreValue | r1505_4 |
+| ir.cpp:1505:42:1505:42 | Unary | r1505_3 |
+| ir.cpp:1507:15:1507:15 | Address | &:r1507_1 |
+| ir.cpp:1507:19:1507:40 | Unary | r1507_2 |
+| ir.cpp:1507:19:1507:42 | StoreValue | r1507_6 |
+| ir.cpp:1507:19:1507:42 | Unary | r1507_5 |
+| ir.cpp:1507:42:1507:42 | Address | &:r1507_3 |
+| ir.cpp:1507:42:1507:42 | Load | ~m1503_4 |
+| ir.cpp:1507:42:1507:42 | Unary | r1507_4 |
+| ir.cpp:1508:9:1508:9 | Address | &:r1508_2 |
+| ir.cpp:1508:9:1508:9 | Address | &:r1508_4 |
+| ir.cpp:1508:9:1508:9 | Load | m1505_5 |
+| ir.cpp:1508:9:1508:9 | Unary | r1508_3 |
+| ir.cpp:1508:9:1508:15 | ChiPartial | partial:m1508_5 |
+| ir.cpp:1508:9:1508:15 | ChiTotal | total:m1503_4 |
+| ir.cpp:1508:13:1508:15 | StoreValue | r1508_1 |
+| ir.cpp:1509:17:1509:18 | Address | &:r1509_1 |
+| ir.cpp:1509:22:1509:22 | Address | &:r1509_2 |
+| ir.cpp:1509:22:1509:22 | Load | m1505_5 |
+| ir.cpp:1509:22:1509:22 | StoreValue | r1509_5 |
+| ir.cpp:1509:22:1509:22 | Unary | r1509_3 |
+| ir.cpp:1509:22:1509:22 | Unary | r1509_4 |
+| ir.cpp:1510:13:1510:13 | Address | &:r1510_1 |
+| ir.cpp:1510:17:1510:17 | Address | &:r1510_2 |
+| ir.cpp:1510:17:1510:17 | Address | &:r1510_3 |
+| ir.cpp:1510:17:1510:17 | Load | m1504_5 |
+| ir.cpp:1510:17:1510:17 | Load | ~m1503_4 |
+| ir.cpp:1510:17:1510:17 | StoreValue | r1510_4 |
+| ir.cpp:1511:9:1511:9 | Address | &:r1511_2 |
+| ir.cpp:1511:9:1511:9 | Address | &:r1511_4 |
+| ir.cpp:1511:9:1511:9 | Load | m1507_7 |
+| ir.cpp:1511:9:1511:9 | Unary | r1511_3 |
+| ir.cpp:1511:9:1511:13 | ChiPartial | partial:m1511_5 |
+| ir.cpp:1511:9:1511:13 | ChiTotal | total:m1490_6 |
+| ir.cpp:1511:13:1511:13 | StoreValue | r1511_1 |
+| ir.cpp:1512:14:1512:15 | Address | &:r1512_1 |
+| ir.cpp:1512:19:1512:19 | Address | &:r1512_2 |
+| ir.cpp:1512:19:1512:19 | Load | m1507_7 |
+| ir.cpp:1512:19:1512:19 | StoreValue | r1512_5 |
+| ir.cpp:1512:19:1512:19 | Unary | r1512_3 |
+| ir.cpp:1512:19:1512:19 | Unary | r1512_4 |
+| ir.cpp:1513:13:1513:13 | Address | &:r1513_1 |
+| ir.cpp:1513:17:1513:17 | Address | &:r1513_2 |
+| ir.cpp:1513:17:1513:17 | Address | &:r1513_3 |
+| ir.cpp:1513:17:1513:17 | Load | m1507_7 |
+| ir.cpp:1513:17:1513:17 | Load | ~m1511_6 |
+| ir.cpp:1513:17:1513:17 | StoreValue | r1513_4 |
+| ir.cpp:1542:8:1542:8 | Address | &:r1542_5 |
+| ir.cpp:1542:8:1542:8 | Address | &:r1542_5 |
+| ir.cpp:1542:8:1542:8 | Address | &:r1542_7 |
+| ir.cpp:1542:8:1542:8 | Address | &:r1542_7 |
+| ir.cpp:1542:8:1542:8 | ChiPartial | partial:m1542_3 |
+| ir.cpp:1542:8:1542:8 | ChiTotal | total:m1542_2 |
+| ir.cpp:1542:8:1542:8 | Load | m1542_6 |
+| ir.cpp:1542:8:1542:8 | SideEffect | m1542_3 |
+| ir.cpp:1542:8:1542:8 | SideEffect | m1542_8 |
+| ir.cpp:1552:54:1552:83 | Address | &:r1552_5 |
+| ir.cpp:1552:54:1552:83 | Address | &:r1552_5 |
+| ir.cpp:1552:54:1552:83 | Address | &:r1552_7 |
+| ir.cpp:1552:54:1552:83 | Address | &:r1552_7 |
+| ir.cpp:1552:54:1552:83 | Address | &:r1552_14 |
+| ir.cpp:1552:54:1552:83 | ChiPartial | partial:m1552_3 |
+| ir.cpp:1552:54:1552:83 | ChiTotal | total:m1552_2 |
+| ir.cpp:1552:54:1552:83 | Load | m0_2 |
+| ir.cpp:1552:54:1552:83 | Load | m1552_6 |
+| ir.cpp:1552:54:1552:83 | SideEffect | m1552_3 |
+| ir.cpp:1552:54:1552:83 | SideEffect | m1552_8 |
+| ir.cpp:1552:89:1552:97 | Address | &:r1552_9 |
+| ir.cpp:1552:96:1552:96 | Address | &:r1552_10 |
+| ir.cpp:1552:96:1552:96 | Load | m1552_6 |
+| ir.cpp:1552:96:1552:96 | Unary | r1552_11 |
+| ir.cpp:1552:96:1552:96 | Unary | r1552_12 |
+| ir.cpp:1554:54:1554:83 | Address | &:r1554_5 |
+| ir.cpp:1554:54:1554:83 | Address | &:r1554_5 |
+| ir.cpp:1554:54:1554:83 | Address | &:r1554_7 |
+| ir.cpp:1554:54:1554:83 | Address | &:r1554_7 |
+| ir.cpp:1554:54:1554:83 | Address | &:r1554_14 |
+| ir.cpp:1554:54:1554:83 | ChiPartial | partial:m1554_3 |
+| ir.cpp:1554:54:1554:83 | ChiTotal | total:m1554_2 |
+| ir.cpp:1554:54:1554:83 | Load | m0_2 |
+| ir.cpp:1554:54:1554:83 | Load | m1554_6 |
+| ir.cpp:1554:54:1554:83 | SideEffect | m1554_3 |
+| ir.cpp:1554:54:1554:83 | SideEffect | m1554_8 |
+| ir.cpp:1554:89:1554:97 | Address | &:r1554_9 |
+| ir.cpp:1554:96:1554:96 | Address | &:r1554_10 |
+| ir.cpp:1554:96:1554:96 | Load | m1554_6 |
+| ir.cpp:1554:96:1554:96 | Unary | r1554_11 |
+| ir.cpp:1554:96:1554:96 | Unary | r1554_12 |
+| ir.cpp:1556:54:1556:83 | Address | &:r1556_5 |
+| ir.cpp:1556:54:1556:83 | Address | &:r1556_5 |
+| ir.cpp:1556:54:1556:83 | Address | &:r1556_7 |
+| ir.cpp:1556:54:1556:83 | Address | &:r1556_7 |
+| ir.cpp:1556:54:1556:83 | Address | &:r1556_18 |
+| ir.cpp:1556:54:1556:83 | ChiPartial | partial:m1556_3 |
+| ir.cpp:1556:54:1556:83 | ChiTotal | total:m1556_2 |
+| ir.cpp:1556:54:1556:83 | Load | m1556_6 |
+| ir.cpp:1556:54:1556:83 | Load | m1556_16 |
+| ir.cpp:1556:54:1556:83 | SideEffect | m1556_3 |
+| ir.cpp:1556:54:1556:83 | SideEffect | m1556_8 |
+| ir.cpp:1556:89:1556:97 | Address | &:r1556_9 |
+| ir.cpp:1556:96:1556:96 | Address | &:r1556_10 |
+| ir.cpp:1556:96:1556:96 | Address | &:r1556_12 |
+| ir.cpp:1556:96:1556:96 | Load | m1556_6 |
+| ir.cpp:1556:96:1556:96 | Load | ~m1556_8 |
+| ir.cpp:1556:96:1556:96 | StoreValue | r1556_15 |
+| ir.cpp:1556:96:1556:96 | Unary | r1556_11 |
+| ir.cpp:1556:96:1556:96 | Unary | r1556_13 |
+| ir.cpp:1556:96:1556:96 | Unary | r1556_14 |
+| ir.cpp:1558:6:1558:29 | ChiPartial | partial:m1558_3 |
+| ir.cpp:1558:6:1558:29 | ChiTotal | total:m1558_2 |
+| ir.cpp:1558:6:1558:29 | SideEffect | ~m1579_6 |
+| ir.cpp:1559:28:1559:28 | Address | &:r1559_1 |
+| ir.cpp:1559:28:1559:28 | Address | &:r1559_1 |
+| ir.cpp:1559:28:1559:28 | Arg(this) | this:r1559_1 |
+| ir.cpp:1559:28:1559:28 | CallTarget | func:r1559_3 |
+| ir.cpp:1559:28:1559:28 | ChiPartial | partial:m1559_5 |
+| ir.cpp:1559:28:1559:28 | ChiPartial | partial:m1559_7 |
+| ir.cpp:1559:28:1559:28 | ChiTotal | total:m1558_4 |
+| ir.cpp:1559:28:1559:28 | ChiTotal | total:m1559_2 |
+| ir.cpp:1559:28:1559:28 | SideEffect | ~m1558_4 |
+| ir.cpp:1562:14:1562:14 | Address | &:r1562_1 |
+| ir.cpp:1562:14:1562:14 | Address | &:r1562_6 |
+| ir.cpp:1562:14:1562:14 | Address | &:r1562_6 |
+| ir.cpp:1562:14:1562:14 | Address | &:r1562_18 |
+| ir.cpp:1562:14:1562:14 | Address | &:r1562_18 |
+| ir.cpp:1562:14:1562:14 | Address | &:r1562_30 |
+| ir.cpp:1562:14:1562:14 | Address | &:r1562_30 |
+| ir.cpp:1562:14:1562:14 | Arg(this) | this:r1562_6 |
+| ir.cpp:1562:14:1562:14 | Arg(this) | this:r1562_18 |
+| ir.cpp:1562:14:1562:14 | Arg(this) | this:r1562_30 |
+| ir.cpp:1562:14:1562:14 | CallTarget | func:r1562_7 |
+| ir.cpp:1562:14:1562:14 | CallTarget | func:r1562_19 |
+| ir.cpp:1562:14:1562:14 | CallTarget | func:r1562_31 |
+| ir.cpp:1562:14:1562:14 | ChiPartial | partial:m1562_9 |
+| ir.cpp:1562:14:1562:14 | ChiPartial | partial:m1562_12 |
+| ir.cpp:1562:14:1562:14 | ChiPartial | partial:m1562_21 |
+| ir.cpp:1562:14:1562:14 | ChiPartial | partial:m1562_24 |
+| ir.cpp:1562:14:1562:14 | ChiPartial | partial:m1562_33 |
+| ir.cpp:1562:14:1562:14 | ChiPartial | partial:m1562_36 |
+| ir.cpp:1562:14:1562:14 | ChiTotal | total:m1559_6 |
+| ir.cpp:1562:14:1562:14 | ChiTotal | total:m1562_4 |
+| ir.cpp:1562:14:1562:14 | ChiTotal | total:m1562_10 |
+| ir.cpp:1562:14:1562:14 | ChiTotal | total:m1562_13 |
+| ir.cpp:1562:14:1562:14 | ChiTotal | total:m1562_22 |
+| ir.cpp:1562:14:1562:14 | ChiTotal | total:m1562_25 |
+| ir.cpp:1562:14:1562:14 | SideEffect | m1562_4 |
+| ir.cpp:1562:14:1562:14 | SideEffect | m1562_13 |
+| ir.cpp:1562:14:1562:14 | SideEffect | m1562_25 |
+| ir.cpp:1562:14:1562:14 | SideEffect | ~m1559_6 |
+| ir.cpp:1562:14:1562:14 | SideEffect | ~m1562_10 |
+| ir.cpp:1562:14:1562:14 | SideEffect | ~m1562_22 |
+| ir.cpp:1562:14:1562:14 | Unary | r1562_8 |
+| ir.cpp:1562:14:1562:14 | Unary | r1562_20 |
+| ir.cpp:1562:14:1562:14 | Unary | r1562_32 |
+| ir.cpp:1562:14:1562:27 | StoreValue | r1562_15 |
+| ir.cpp:1562:14:1562:27 | StoreValue | r1562_27 |
+| ir.cpp:1562:14:1562:27 | StoreValue | r1562_39 |
+| ir.cpp:1562:14:1562:27 | Unary | r1562_14 |
+| ir.cpp:1562:14:1562:27 | Unary | r1562_26 |
+| ir.cpp:1562:14:1562:27 | Unary | r1562_38 |
+| ir.cpp:1562:15:1562:15 | Address | &:r1562_5 |
+| ir.cpp:1562:18:1562:18 | Address | &:r1562_17 |
+| ir.cpp:1562:21:1562:21 | Address | &:r1562_29 |
+| ir.cpp:1562:26:1562:26 | Address | &:r1562_2 |
+| ir.cpp:1562:26:1562:26 | Load | m1559_8 |
+| ir.cpp:1562:26:1562:26 | StoreValue | r1562_3 |
+| ir.cpp:1563:9:1563:9 | Address | &:r1563_2 |
+| ir.cpp:1563:9:1563:9 | Address | &:r1563_4 |
+| ir.cpp:1563:9:1563:9 | Load | m1562_28 |
+| ir.cpp:1563:9:1563:9 | Unary | r1563_3 |
+| ir.cpp:1563:9:1563:15 | ChiPartial | partial:m1563_5 |
+| ir.cpp:1563:9:1563:15 | ChiTotal | total:m1562_37 |
+| ir.cpp:1563:13:1563:15 | StoreValue | r1563_1 |
+| ir.cpp:1564:17:1564:18 | Address | &:r1564_1 |
+| ir.cpp:1564:22:1564:22 | Address | &:r1564_2 |
+| ir.cpp:1564:22:1564:22 | Load | m1562_28 |
+| ir.cpp:1564:22:1564:22 | StoreValue | r1564_5 |
+| ir.cpp:1564:22:1564:22 | Unary | r1564_3 |
+| ir.cpp:1564:22:1564:22 | Unary | r1564_4 |
+| ir.cpp:1565:13:1565:13 | Address | &:r1565_1 |
+| ir.cpp:1565:17:1565:17 | Address | &:r1565_2 |
+| ir.cpp:1565:17:1565:17 | Address | &:r1565_3 |
+| ir.cpp:1565:17:1565:17 | Load | m1562_16 |
+| ir.cpp:1565:17:1565:17 | Load | ~m1562_37 |
+| ir.cpp:1565:17:1565:17 | StoreValue | r1565_4 |
+| ir.cpp:1566:9:1566:9 | Address | &:r1566_2 |
+| ir.cpp:1566:9:1566:9 | Address | &:r1566_4 |
+| ir.cpp:1566:9:1566:9 | Load | m1562_40 |
+| ir.cpp:1566:9:1566:9 | Unary | r1566_3 |
+| ir.cpp:1566:9:1566:13 | ChiPartial | partial:m1566_5 |
+| ir.cpp:1566:9:1566:13 | ChiTotal | total:m1562_34 |
+| ir.cpp:1566:13:1566:13 | StoreValue | r1566_1 |
+| ir.cpp:1567:14:1567:15 | Address | &:r1567_1 |
+| ir.cpp:1567:19:1567:19 | Address | &:r1567_2 |
+| ir.cpp:1567:19:1567:19 | Load | m1562_40 |
+| ir.cpp:1567:19:1567:19 | StoreValue | r1567_5 |
+| ir.cpp:1567:19:1567:19 | Unary | r1567_3 |
+| ir.cpp:1567:19:1567:19 | Unary | r1567_4 |
+| ir.cpp:1568:13:1568:13 | Address | &:r1568_1 |
+| ir.cpp:1568:17:1568:17 | Address | &:r1568_2 |
+| ir.cpp:1568:17:1568:17 | Address | &:r1568_3 |
+| ir.cpp:1568:17:1568:17 | Load | m1562_40 |
+| ir.cpp:1568:17:1568:17 | Load | ~m1566_6 |
+| ir.cpp:1568:17:1568:17 | StoreValue | r1568_4 |
+| ir.cpp:1572:14:1572:35 | Address | &:r1572_1 |
+| ir.cpp:1572:39:1572:39 | Address | &:r1572_2 |
+| ir.cpp:1572:39:1572:39 | Load | m1559_8 |
+| ir.cpp:1572:39:1572:39 | StoreValue | r1572_3 |
+| ir.cpp:1573:15:1573:15 | Address | &:r1573_1 |
+| ir.cpp:1573:19:1573:40 | Address | &:r1573_2 |
+| ir.cpp:1573:19:1573:40 | Address | &:r1573_2 |
+| ir.cpp:1573:19:1573:40 | Arg(this) | this:r1573_2 |
+| ir.cpp:1573:19:1573:40 | ChiPartial | partial:m1573_8 |
+| ir.cpp:1573:19:1573:40 | ChiTotal | total:m1572_4 |
+| ir.cpp:1573:19:1573:40 | SideEffect | m1572_4 |
+| ir.cpp:1573:42:1573:47 | CallTarget | func:r1573_3 |
+| ir.cpp:1573:42:1573:47 | ChiPartial | partial:m1573_5 |
+| ir.cpp:1573:42:1573:47 | ChiTotal | total:m1566_6 |
+| ir.cpp:1573:42:1573:47 | SideEffect | ~m1566_6 |
+| ir.cpp:1573:42:1573:47 | Unary | r1573_4 |
+| ir.cpp:1573:42:1573:50 | StoreValue | r1573_11 |
+| ir.cpp:1573:42:1573:50 | Unary | r1573_10 |
+| ir.cpp:1574:15:1574:15 | Address | &:r1574_1 |
+| ir.cpp:1574:19:1574:40 | Address | &:r1574_2 |
+| ir.cpp:1574:19:1574:40 | Address | &:r1574_2 |
+| ir.cpp:1574:19:1574:40 | Arg(this) | this:r1574_2 |
+| ir.cpp:1574:19:1574:40 | ChiPartial | partial:m1574_8 |
+| ir.cpp:1574:19:1574:40 | ChiTotal | total:m1573_9 |
+| ir.cpp:1574:19:1574:40 | SideEffect | m1573_9 |
+| ir.cpp:1574:42:1574:47 | CallTarget | func:r1574_3 |
+| ir.cpp:1574:42:1574:47 | ChiPartial | partial:m1574_5 |
+| ir.cpp:1574:42:1574:47 | ChiTotal | total:m1573_6 |
+| ir.cpp:1574:42:1574:47 | SideEffect | ~m1573_6 |
+| ir.cpp:1574:42:1574:47 | Unary | r1574_4 |
+| ir.cpp:1574:42:1574:50 | StoreValue | r1574_11 |
+| ir.cpp:1574:42:1574:50 | Unary | r1574_10 |
+| ir.cpp:1575:15:1575:15 | Address | &:r1575_1 |
+| ir.cpp:1575:19:1575:40 | Address | &:r1575_2 |
+| ir.cpp:1575:19:1575:40 | Address | &:r1575_2 |
+| ir.cpp:1575:19:1575:40 | Arg(this) | this:r1575_2 |
+| ir.cpp:1575:19:1575:40 | ChiPartial | partial:m1575_8 |
+| ir.cpp:1575:19:1575:40 | ChiTotal | total:m1574_9 |
+| ir.cpp:1575:19:1575:40 | SideEffect | m1574_9 |
+| ir.cpp:1575:42:1575:47 | CallTarget | func:r1575_3 |
+| ir.cpp:1575:42:1575:47 | ChiPartial | partial:m1575_5 |
+| ir.cpp:1575:42:1575:47 | ChiTotal | total:m1574_6 |
+| ir.cpp:1575:42:1575:47 | SideEffect | ~m1574_6 |
+| ir.cpp:1575:42:1575:47 | Unary | r1575_4 |
+| ir.cpp:1575:42:1575:50 | StoreValue | r1575_11 |
+| ir.cpp:1575:42:1575:50 | Unary | r1575_10 |
+| ir.cpp:1576:9:1576:9 | Address | &:r1576_2 |
+| ir.cpp:1576:9:1576:9 | Address | &:r1576_4 |
+| ir.cpp:1576:9:1576:9 | Load | m1574_12 |
+| ir.cpp:1576:9:1576:9 | Unary | r1576_3 |
+| ir.cpp:1576:9:1576:15 | ChiPartial | partial:m1576_5 |
+| ir.cpp:1576:9:1576:15 | ChiTotal | total:m1575_9 |
+| ir.cpp:1576:13:1576:15 | StoreValue | r1576_1 |
+| ir.cpp:1577:17:1577:18 | Address | &:r1577_1 |
+| ir.cpp:1577:22:1577:22 | Address | &:r1577_2 |
+| ir.cpp:1577:22:1577:22 | Load | m1574_12 |
+| ir.cpp:1577:22:1577:22 | StoreValue | r1577_5 |
+| ir.cpp:1577:22:1577:22 | Unary | r1577_3 |
+| ir.cpp:1577:22:1577:22 | Unary | r1577_4 |
+| ir.cpp:1578:13:1578:13 | Address | &:r1578_1 |
+| ir.cpp:1578:17:1578:17 | Address | &:r1578_2 |
+| ir.cpp:1578:17:1578:17 | Address | &:r1578_3 |
+| ir.cpp:1578:17:1578:17 | Load | m1573_12 |
+| ir.cpp:1578:17:1578:17 | Load | ~m1575_9 |
+| ir.cpp:1578:17:1578:17 | StoreValue | r1578_4 |
+| ir.cpp:1579:9:1579:9 | Address | &:r1579_2 |
+| ir.cpp:1579:9:1579:9 | Address | &:r1579_4 |
+| ir.cpp:1579:9:1579:9 | Load | m1575_12 |
+| ir.cpp:1579:9:1579:9 | Unary | r1579_3 |
+| ir.cpp:1579:9:1579:13 | ChiPartial | partial:m1579_5 |
+| ir.cpp:1579:9:1579:13 | ChiTotal | total:m1575_6 |
+| ir.cpp:1579:13:1579:13 | StoreValue | r1579_1 |
+| ir.cpp:1580:14:1580:15 | Address | &:r1580_1 |
+| ir.cpp:1580:19:1580:19 | Address | &:r1580_2 |
+| ir.cpp:1580:19:1580:19 | Load | m1575_12 |
+| ir.cpp:1580:19:1580:19 | StoreValue | r1580_5 |
+| ir.cpp:1580:19:1580:19 | Unary | r1580_3 |
+| ir.cpp:1580:19:1580:19 | Unary | r1580_4 |
+| ir.cpp:1581:13:1581:13 | Address | &:r1581_1 |
+| ir.cpp:1581:17:1581:17 | Address | &:r1581_2 |
+| ir.cpp:1581:17:1581:17 | Address | &:r1581_3 |
+| ir.cpp:1581:17:1581:17 | Load | m1575_12 |
+| ir.cpp:1581:17:1581:17 | Load | ~m1579_6 |
+| ir.cpp:1581:17:1581:17 | StoreValue | r1581_4 |
 | perf-regression.cpp:6:3:6:5 | Address | &:r6_5 |
 | perf-regression.cpp:6:3:6:5 | Address | &:r6_5 |
 | perf-regression.cpp:6:3:6:5 | Address | &:r6_7 |

cpp/ql/test/library-tests/ir/ir/raw_ir.expected

@@ -7858,6 +7858,485 @@ ir.cpp:
 # 1443|     v1443_5(void)               = AliasedUse                                        : ~m?
 # 1443|     v1443_6(void)               = ExitFunction                                      : 
 
+# 1451| void Inheritance_Test_B::~Inheritance_Test_B()
+# 1451|   Block 0
+# 1451|     v1451_1(void)                       = EnterFunction                : 
+# 1451|     mu1451_2(unknown)                   = AliasedDefinition            : 
+# 1451|     mu1451_3(unknown)                   = InitializeNonLocal           : 
+# 1451|     r1451_4(glval<unknown>)             = VariableAddress[#this]       : 
+# 1451|     mu1451_5(glval<Inheritance_Test_B>) = InitializeParameter[#this]   : &:r1451_4
+# 1451|     r1451_6(glval<Inheritance_Test_B>)  = Load[#this]                  : &:r1451_4, ~m?
+# 1451|     mu1451_7(Inheritance_Test_B)        = InitializeIndirection[#this] : &:r1451_6
+# 1451|     v1451_8(void)                       = NoOp                         : 
+# 1451|     v1451_9(void)                       = ReturnIndirection[#this]     : &:r1451_6, ~m?
+# 1451|     v1451_10(void)                      = ReturnVoid                   : 
+# 1451|     v1451_11(void)                      = AliasedUse                   : ~m?
+# 1451|     v1451_12(void)                      = ExitFunction                 : 
+
+# 1457| void Inheritance_Test_A::Inheritance_Test_A()
+# 1457|   Block 0
+# 1457|     v1457_1(void)                       = EnterFunction                : 
+# 1457|     mu1457_2(unknown)                   = AliasedDefinition            : 
+# 1457|     mu1457_3(unknown)                   = InitializeNonLocal           : 
+# 1457|     r1457_4(glval<unknown>)             = VariableAddress[#this]       : 
+# 1457|     mu1457_5(glval<Inheritance_Test_A>) = InitializeParameter[#this]   : &:r1457_4
+# 1457|     r1457_6(glval<Inheritance_Test_A>)  = Load[#this]                  : &:r1457_4, ~m?
+# 1457|     mu1457_7(Inheritance_Test_A)        = InitializeIndirection[#this] : &:r1457_6
+# 1457|     r1457_8(glval<int>)                 = FieldAddress[x]              : mu1457_5
+# 1457|     r1457_9(int)                        = Constant[42]                 : 
+# 1457|     mu1457_10(int)                      = Store[?]                     : &:r1457_8, r1457_9
+# 1458|     r1458_1(int)                        = Constant[3]                  : 
+# 1458|     r1458_2(glval<unknown>)             = VariableAddress[#this]       : 
+# 1458|     r1458_3(Inheritance_Test_A *)       = Load[#this]                  : &:r1458_2, ~m?
+# 1458|     r1458_4(glval<int>)                 = FieldAddress[y]              : r1458_3
+# 1458|     mu1458_5(int)                       = Store[?]                     : &:r1458_4, r1458_1
+# 1459|     v1459_1(void)                       = NoOp                         : 
+# 1457|     v1457_11(void)                      = ReturnIndirection[#this]     : &:r1457_6, ~m?
+# 1457|     v1457_12(void)                      = ReturnVoid                   : 
+# 1457|     v1457_13(void)                      = AliasedUse                   : ~m?
+# 1457|     v1457_14(void)                      = ExitFunction                 : 
+
+# 1462| void array_structured_binding()
+# 1462|   Block 0
+# 1462|     v1462_1(void)             = EnterFunction                             : 
+# 1462|     mu1462_2(unknown)         = AliasedDefinition                         : 
+# 1462|     mu1462_3(unknown)         = InitializeNonLocal                        : 
+# 1463|     r1463_1(glval<int[2]>)    = VariableAddress[xs]                       : 
+# 1463|     mu1463_2(int[2])          = Uninitialized[xs]                         : &:r1463_1
+# 1463|     r1463_3(int)              = Constant[0]                               : 
+# 1463|     r1463_4(glval<int>)       = PointerAdd[4]                             : r1463_1, r1463_3
+# 1463|     r1463_5(int)              = Constant[1]                               : 
+# 1463|     mu1463_6(int)             = Store[?]                                  : &:r1463_4, r1463_5
+# 1463|     r1463_7(int)              = Constant[1]                               : 
+# 1463|     r1463_8(glval<int>)       = PointerAdd[4]                             : r1463_1, r1463_7
+# 1463|     r1463_9(int)              = Constant[2]                               : 
+# 1463|     mu1463_10(int)            = Store[?]                                  : &:r1463_8, r1463_9
+# 1466|     r1466_1(glval<int(&)[2]>) = VariableAddress[(unnamed local variable)] : 
+# 1466|     r1466_2(glval<int[2]>)    = VariableAddress[xs]                       : 
+# 1466|     r1466_3(int(&)[2])        = CopyValue                                 : r1466_2
+# 1466|     mu1466_4(int(&)[2])       = Store[(unnamed local variable)]           : &:r1466_1, r1466_3
+# 1466|     r1466_5(glval<int>)       = VariableAddress[x0]                       : 
+#-----|     r0_1(glval<int(&)[2]>)    = VariableAddress[(unnamed local variable)] : 
+#-----|     r0_2(int(&)[2])           = Load[(unnamed local variable)]            : &:r0_1, ~m?
+#-----|     r0_3(glval<int[2]>)       = CopyValue                                 : r0_2
+#-----|     r0_4(int *)               = Convert                                   : r0_3
+#-----|     r0_5(unsigned long)       = Constant[0]                               : 
+#-----|     r0_6(glval<int>)          = PointerAdd[4]                             : r0_4, r0_5
+#-----|     mu0_7(int)                = Store[x0]                                 : &:r1466_5, r0_6
+# 1466|     r1466_6(glval<int>)       = VariableAddress[x1]                       : 
+#-----|     r0_8(glval<int(&)[2]>)    = VariableAddress[(unnamed local variable)] : 
+#-----|     r0_9(int(&)[2])           = Load[(unnamed local variable)]            : &:r0_8, ~m?
+#-----|     r0_10(glval<int[2]>)      = CopyValue                                 : r0_9
+#-----|     r0_11(int *)              = Convert                                   : r0_10
+#-----|     r0_12(unsigned long)      = Constant[1]                               : 
+#-----|     r0_13(glval<int>)         = PointerAdd[4]                             : r0_11, r0_12
+#-----|     mu0_14(int)               = Store[x1]                                 : &:r1466_6, r0_13
+# 1467|     r1467_1(int)              = Constant[3]                               : 
+# 1467|     r1467_2(glval<int>)       = VariableAddress[x1]                       : 
+# 1467|     mu1467_3(int)             = Store[x1]                                 : &:r1467_2, r1467_1
+# 1468|     r1468_1(glval<int &>)     = VariableAddress[rx1]                      : 
+# 1468|     r1468_2(glval<int>)       = VariableAddress[x1]                       : 
+# 1468|     r1468_3(int &)            = CopyValue                                 : r1468_2
+# 1468|     mu1468_4(int &)           = Store[rx1]                                : &:r1468_1, r1468_3
+# 1469|     r1469_1(glval<int>)       = VariableAddress[x]                        : 
+# 1469|     r1469_2(glval<int>)       = VariableAddress[x1]                       : 
+# 1469|     r1469_3(int)              = Load[x1]                                  : &:r1469_2, ~m?
+# 1469|     mu1469_4(int)             = Store[x]                                  : &:r1469_1, r1469_3
+# 1473|     r1473_1(glval<int(&)[2]>) = VariableAddress[unnamed_local_variable]   : 
+# 1473|     r1473_2(glval<int[2]>)    = VariableAddress[xs]                       : 
+# 1473|     r1473_3(int(&)[2])        = CopyValue                                 : r1473_2
+# 1473|     mu1473_4(int(&)[2])       = Store[unnamed_local_variable]             : &:r1473_1, r1473_3
+# 1474|     r1474_1(glval<int &>)     = VariableAddress[x0]                       : 
+# 1474|     r1474_2(glval<int[2]>)    = VariableAddress[xs]                       : 
+# 1474|     r1474_3(int *)            = Convert                                   : r1474_2
+# 1474|     r1474_4(int)              = Constant[0]                               : 
+# 1474|     r1474_5(glval<int>)       = PointerAdd[4]                             : r1474_3, r1474_4
+# 1474|     r1474_6(int &)            = CopyValue                                 : r1474_5
+# 1474|     mu1474_7(int &)           = Store[x0]                                 : &:r1474_1, r1474_6
+# 1475|     r1475_1(glval<int &>)     = VariableAddress[x1]                       : 
+# 1475|     r1475_2(glval<int[2]>)    = VariableAddress[xs]                       : 
+# 1475|     r1475_3(int *)            = Convert                                   : r1475_2
+# 1475|     r1475_4(int)              = Constant[1]                               : 
+# 1475|     r1475_5(glval<int>)       = PointerAdd[4]                             : r1475_3, r1475_4
+# 1475|     r1475_6(int &)            = CopyValue                                 : r1475_5
+# 1475|     mu1475_7(int &)           = Store[x1]                                 : &:r1475_1, r1475_6
+# 1476|     r1476_1(int)              = Constant[3]                               : 
+# 1476|     r1476_2(glval<int &>)     = VariableAddress[x1]                       : 
+# 1476|     r1476_3(int &)            = Load[x1]                                  : &:r1476_2, ~m?
+# 1476|     r1476_4(glval<int>)       = CopyValue                                 : r1476_3
+# 1476|     mu1476_5(int)             = Store[?]                                  : &:r1476_4, r1476_1
+# 1477|     r1477_1(glval<int &>)     = VariableAddress[rx1]                      : 
+# 1477|     r1477_2(glval<int &>)     = VariableAddress[x1]                       : 
+# 1477|     r1477_3(int &)            = Load[x1]                                  : &:r1477_2, ~m?
+# 1477|     r1477_4(glval<int>)       = CopyValue                                 : r1477_3
+# 1477|     r1477_5(int &)            = CopyValue                                 : r1477_4
+# 1477|     mu1477_6(int &)           = Store[rx1]                                : &:r1477_1, r1477_5
+# 1478|     r1478_1(glval<int>)       = VariableAddress[x]                        : 
+# 1478|     r1478_2(glval<int &>)     = VariableAddress[x1]                       : 
+# 1478|     r1478_3(int &)            = Load[x1]                                  : &:r1478_2, ~m?
+# 1478|     r1478_4(int)              = Load[?]                                   : &:r1478_3, ~m?
+# 1478|     mu1478_5(int)             = Store[x]                                  : &:r1478_1, r1478_4
+# 1480|     v1480_1(void)             = NoOp                                      : 
+# 1462|     v1462_4(void)             = ReturnVoid                                : 
+# 1462|     v1462_5(void)             = AliasedUse                                : ~m?
+# 1462|     v1462_6(void)             = ExitFunction                              : 
+
+# 1482| void StructuredBindingDataMemberStruct::StructuredBindingDataMemberStruct()
+# 1482|   Block 0
+# 1482|     v1482_1(void)                                      = EnterFunction                : 
+# 1482|     mu1482_2(unknown)                                  = AliasedDefinition            : 
+# 1482|     mu1482_3(unknown)                                  = InitializeNonLocal           : 
+# 1482|     r1482_4(glval<unknown>)                            = VariableAddress[#this]       : 
+# 1482|     mu1482_5(glval<StructuredBindingDataMemberStruct>) = InitializeParameter[#this]   : &:r1482_4
+# 1482|     r1482_6(glval<StructuredBindingDataMemberStruct>)  = Load[#this]                  : &:r1482_4, ~m?
+# 1482|     mu1482_7(StructuredBindingDataMemberStruct)        = InitializeIndirection[#this] : &:r1482_6
+# 1482|     v1482_8(void)                                      = NoOp                         : 
+# 1482|     v1482_9(void)                                      = ReturnIndirection[#this]     : &:r1482_6, ~m?
+# 1482|     v1482_10(void)                                     = ReturnVoid                   : 
+# 1482|     v1482_11(void)                                     = AliasedUse                   : ~m?
+# 1482|     v1482_12(void)                                     = ExitFunction                 : 
+
+# 1489| void data_member_structured_binding()
+# 1489|   Block 0
+# 1489|     v1489_1(void)                                      = EnterFunction                                      : 
+# 1489|     mu1489_2(unknown)                                  = AliasedDefinition                                  : 
+# 1489|     mu1489_3(unknown)                                  = InitializeNonLocal                                 : 
+# 1490|     r1490_1(glval<StructuredBindingDataMemberStruct>)  = VariableAddress[s]                                 : 
+# 1490|     mu1490_2(StructuredBindingDataMemberStruct)        = Uninitialized[s]                                   : &:r1490_1
+# 1490|     r1490_3(glval<unknown>)                            = FunctionAddress[StructuredBindingDataMemberStruct] : 
+# 1490|     v1490_4(void)                                      = Call[StructuredBindingDataMemberStruct]            : func:r1490_3, this:r1490_1
+# 1490|     mu1490_5(unknown)                                  = ^CallSideEffect                                    : ~m?
+# 1490|     mu1490_6(StructuredBindingDataMemberStruct)        = ^IndirectMayWriteSideEffect[-1]                    : &:r1490_1
+# 1493|     r1493_1(glval<StructuredBindingDataMemberStruct>)  = VariableAddress[(unnamed local variable)]          : 
+# 1493|     r1493_2(glval<StructuredBindingDataMemberStruct>)  = VariableAddress[s]                                 : 
+# 1493|     r1493_3(StructuredBindingDataMemberStruct)         = Load[s]                                            : &:r1493_2, ~m?
+# 1493|     mu1493_4(StructuredBindingDataMemberStruct)        = Store[(unnamed local variable)]                    : &:r1493_1, r1493_3
+# 1493|     r1493_5(glval<int>)                                = VariableAddress[i]                                 : 
+# 1493|     r1493_6(glval<StructuredBindingDataMemberStruct>)  = VariableAddress[(unnamed local variable)]          : 
+# 1493|     r1493_7(glval<int>)                                = FieldAddress[i]                                    : r1493_6
+# 1493|     mu1493_8(int)                                      = Store[i]                                           : &:r1493_5, r1493_7
+# 1493|     r1493_9(glval<double>)                             = VariableAddress[d]                                 : 
+# 1493|     r1493_10(glval<StructuredBindingDataMemberStruct>) = VariableAddress[(unnamed local variable)]          : 
+# 1493|     r1493_11(glval<double>)                            = FieldAddress[d]                                    : r1493_10
+# 1493|     mu1493_12(double)                                  = Store[d]                                           : &:r1493_9, r1493_11
+# 1493|     r1493_13(glval<unsigned int>)                      = VariableAddress[b]                                 : 
+# 1493|     r1493_14(glval<StructuredBindingDataMemberStruct>) = VariableAddress[(unnamed local variable)]          : 
+# 1493|     r1493_15(glval<unsigned int>)                      = FieldAddress[b]                                    : r1493_14
+# 1493|     mu1493_16(unsigned int)                            = Store[b]                                           : &:r1493_13, r1493_15
+# 1493|     r1493_17(glval<int>)                               = VariableAddress[r]                                 : 
+# 1493|     r1493_18(glval<StructuredBindingDataMemberStruct>) = VariableAddress[(unnamed local variable)]          : 
+# 1493|     r1493_19(glval<int &>)                             = FieldAddress[r]                                    : r1493_18
+# 1493|     r1493_20(int &)                                    = Load[?]                                            : &:r1493_19, ~m?
+# 1493|     r1493_21(glval<int>)                               = CopyValue                                          : r1493_20
+# 1493|     mu1493_22(int)                                     = Store[r]                                           : &:r1493_17, r1493_21
+# 1494|     r1494_1(double)                                    = Constant[4.0]                                      : 
+# 1494|     r1494_2(glval<double>)                             = VariableAddress[d]                                 : 
+# 1494|     mu1494_3(double)                                   = Store[d]                                           : &:r1494_2, r1494_1
+# 1495|     r1495_1(glval<double &>)                           = VariableAddress[rd]                                : 
+# 1495|     r1495_2(glval<double>)                             = VariableAddress[d]                                 : 
+# 1495|     r1495_3(double &)                                  = CopyValue                                          : r1495_2
+# 1495|     mu1495_4(double &)                                 = Store[rd]                                          : &:r1495_1, r1495_3
+# 1496|     r1496_1(glval<int>)                                = VariableAddress[v]                                 : 
+# 1496|     r1496_2(glval<int>)                                = VariableAddress[i]                                 : 
+# 1496|     r1496_3(int)                                       = Load[i]                                            : &:r1496_2, ~m?
+# 1496|     mu1496_4(int)                                      = Store[v]                                           : &:r1496_1, r1496_3
+# 1497|     r1497_1(int)                                       = Constant[5]                                        : 
+# 1497|     r1497_2(glval<int>)                                = VariableAddress[r]                                 : 
+# 1497|     mu1497_3(int)                                      = Store[r]                                           : &:r1497_2, r1497_1
+# 1498|     r1498_1(glval<int &>)                              = VariableAddress[rr]                                : 
+# 1498|     r1498_2(glval<int>)                                = VariableAddress[r]                                 : 
+# 1498|     r1498_3(int &)                                     = CopyValue                                          : r1498_2
+# 1498|     mu1498_4(int &)                                    = Store[rr]                                          : &:r1498_1, r1498_3
+# 1499|     r1499_1(glval<int>)                                = VariableAddress[w]                                 : 
+# 1499|     r1499_2(glval<int>)                                = VariableAddress[r]                                 : 
+# 1499|     r1499_3(int)                                       = Load[r]                                            : &:r1499_2, ~m?
+# 1499|     mu1499_4(int)                                      = Store[w]                                           : &:r1499_1, r1499_3
+# 1503|     r1503_1(glval<StructuredBindingDataMemberStruct>)  = VariableAddress[unnamed_local_variable]            : 
+# 1503|     r1503_2(glval<StructuredBindingDataMemberStruct>)  = VariableAddress[s]                                 : 
+# 1503|     r1503_3(StructuredBindingDataMemberStruct)         = Load[s]                                            : &:r1503_2, ~m?
+# 1503|     mu1503_4(StructuredBindingDataMemberStruct)        = Store[unnamed_local_variable]                      : &:r1503_1, r1503_3
+# 1504|     r1504_1(glval<int &>)                              = VariableAddress[i]                                 : 
+# 1504|     r1504_2(glval<StructuredBindingDataMemberStruct>)  = VariableAddress[unnamed_local_variable]            : 
+# 1504|     r1504_3(glval<int>)                                = FieldAddress[i]                                    : r1504_2
+# 1504|     r1504_4(int &)                                     = CopyValue                                          : r1504_3
+# 1504|     mu1504_5(int &)                                    = Store[i]                                           : &:r1504_1, r1504_4
+# 1505|     r1505_1(glval<double &>)                           = VariableAddress[d]                                 : 
+# 1505|     r1505_2(glval<StructuredBindingDataMemberStruct>)  = VariableAddress[unnamed_local_variable]            : 
+# 1505|     r1505_3(glval<double>)                             = FieldAddress[d]                                    : r1505_2
+# 1505|     r1505_4(double &)                                  = CopyValue                                          : r1505_3
+# 1505|     mu1505_5(double &)                                 = Store[d]                                           : &:r1505_1, r1505_4
+# 1507|     r1507_1(glval<int &>)                              = VariableAddress[r]                                 : 
+# 1507|     r1507_2(glval<StructuredBindingDataMemberStruct>)  = VariableAddress[unnamed_local_variable]            : 
+# 1507|     r1507_3(glval<int &>)                              = FieldAddress[r]                                    : r1507_2
+# 1507|     r1507_4(int &)                                     = Load[?]                                            : &:r1507_3, ~m?
+# 1507|     r1507_5(glval<int>)                                = CopyValue                                          : r1507_4
+# 1507|     r1507_6(int &)                                     = CopyValue                                          : r1507_5
+# 1507|     mu1507_7(int &)                                    = Store[r]                                           : &:r1507_1, r1507_6
+# 1508|     r1508_1(double)                                    = Constant[4.0]                                      : 
+# 1508|     r1508_2(glval<double &>)                           = VariableAddress[d]                                 : 
+# 1508|     r1508_3(double &)                                  = Load[d]                                            : &:r1508_2, ~m?
+# 1508|     r1508_4(glval<double>)                             = CopyValue                                          : r1508_3
+# 1508|     mu1508_5(double)                                   = Store[?]                                           : &:r1508_4, r1508_1
+# 1509|     r1509_1(glval<double &>)                           = VariableAddress[rd]                                : 
+# 1509|     r1509_2(glval<double &>)                           = VariableAddress[d]                                 : 
+# 1509|     r1509_3(double &)                                  = Load[d]                                            : &:r1509_2, ~m?
+# 1509|     r1509_4(glval<double>)                             = CopyValue                                          : r1509_3
+# 1509|     r1509_5(double &)                                  = CopyValue                                          : r1509_4
+# 1509|     mu1509_6(double &)                                 = Store[rd]                                          : &:r1509_1, r1509_5
+# 1510|     r1510_1(glval<int>)                                = VariableAddress[v]                                 : 
+# 1510|     r1510_2(glval<int &>)                              = VariableAddress[i]                                 : 
+# 1510|     r1510_3(int &)                                     = Load[i]                                            : &:r1510_2, ~m?
+# 1510|     r1510_4(int)                                       = Load[?]                                            : &:r1510_3, ~m?
+# 1510|     mu1510_5(int)                                      = Store[v]                                           : &:r1510_1, r1510_4
+# 1511|     r1511_1(int)                                       = Constant[5]                                        : 
+# 1511|     r1511_2(glval<int &>)                              = VariableAddress[r]                                 : 
+# 1511|     r1511_3(int &)                                     = Load[r]                                            : &:r1511_2, ~m?
+# 1511|     r1511_4(glval<int>)                                = CopyValue                                          : r1511_3
+# 1511|     mu1511_5(int)                                      = Store[?]                                           : &:r1511_4, r1511_1
+# 1512|     r1512_1(glval<int &>)                              = VariableAddress[rr]                                : 
+# 1512|     r1512_2(glval<int &>)                              = VariableAddress[r]                                 : 
+# 1512|     r1512_3(int &)                                     = Load[r]                                            : &:r1512_2, ~m?
+# 1512|     r1512_4(glval<int>)                                = CopyValue                                          : r1512_3
+# 1512|     r1512_5(int &)                                     = CopyValue                                          : r1512_4
+# 1512|     mu1512_6(int &)                                    = Store[rr]                                          : &:r1512_1, r1512_5
+# 1513|     r1513_1(glval<int>)                                = VariableAddress[w]                                 : 
+# 1513|     r1513_2(glval<int &>)                              = VariableAddress[r]                                 : 
+# 1513|     r1513_3(int &)                                     = Load[r]                                            : &:r1513_2, ~m?
+# 1513|     r1513_4(int)                                       = Load[?]                                            : &:r1513_3, ~m?
+# 1513|     mu1513_5(int)                                      = Store[w]                                           : &:r1513_1, r1513_4
+# 1515|     v1515_1(void)                                      = NoOp                                               : 
+# 1489|     v1489_4(void)                                      = ReturnVoid                                         : 
+# 1489|     v1489_5(void)                                      = AliasedUse                                         : ~m?
+# 1489|     v1489_6(void)                                      = ExitFunction                                       : 
+
+# 1542| void StructuredBindingTuple::StructuredBindingTuple()
+# 1542|   Block 0
+# 1542|     v1542_1(void)                           = EnterFunction                : 
+# 1542|     mu1542_2(unknown)                       = AliasedDefinition            : 
+# 1542|     mu1542_3(unknown)                       = InitializeNonLocal           : 
+# 1542|     r1542_4(glval<unknown>)                 = VariableAddress[#this]       : 
+# 1542|     mu1542_5(glval<StructuredBindingTuple>) = InitializeParameter[#this]   : &:r1542_4
+# 1542|     r1542_6(glval<StructuredBindingTuple>)  = Load[#this]                  : &:r1542_4, ~m?
+# 1542|     mu1542_7(StructuredBindingTuple)        = InitializeIndirection[#this] : &:r1542_6
+# 1542|     v1542_8(void)                           = NoOp                         : 
+# 1542|     v1542_9(void)                           = ReturnIndirection[#this]     : &:r1542_6, ~m?
+# 1542|     v1542_10(void)                          = ReturnVoid                   : 
+# 1542|     v1542_11(void)                          = AliasedUse                   : ~m?
+# 1542|     v1542_12(void)                          = ExitFunction                 : 
+
+# 1552| std::tuple_element<int 0, StructuredBindingTuple>::type& StructuredBindingTuple::get<int 0>()
+# 1552|   Block 0
+# 1552|     v1552_1(void)                           = EnterFunction                : 
+# 1552|     mu1552_2(unknown)                       = AliasedDefinition            : 
+# 1552|     mu1552_3(unknown)                       = InitializeNonLocal           : 
+# 1552|     r1552_4(glval<unknown>)                 = VariableAddress[#this]       : 
+# 1552|     mu1552_5(glval<StructuredBindingTuple>) = InitializeParameter[#this]   : &:r1552_4
+# 1552|     r1552_6(glval<StructuredBindingTuple>)  = Load[#this]                  : &:r1552_4, ~m?
+# 1552|     mu1552_7(StructuredBindingTuple)        = InitializeIndirection[#this] : &:r1552_6
+# 1552|     r1552_8(glval<int &>)                   = VariableAddress[#return]     : 
+# 1552|     r1552_9(glval<unknown>)                 = VariableAddress[#this]       : 
+# 1552|     r1552_10(StructuredBindingTuple *)      = Load[#this]                  : &:r1552_9, ~m?
+# 1552|     r1552_11(glval<int>)                    = FieldAddress[i]              : r1552_10
+#-----|     r0_1(int &)                             = CopyValue                    : r1552_11
+#-----|     mu0_2(int &)                            = Store[#return]               : &:r1552_8, r0_1
+# 1552|     v1552_12(void)                          = ReturnIndirection[#this]     : &:r1552_6, ~m?
+# 1552|     r1552_13(glval<int &>)                  = VariableAddress[#return]     : 
+# 1552|     v1552_14(void)                          = ReturnValue                  : &:r1552_13, ~m?
+# 1552|     v1552_15(void)                          = AliasedUse                   : ~m?
+# 1552|     v1552_16(void)                          = ExitFunction                 : 
+
+# 1554| std::tuple_element<int 1, StructuredBindingTuple>::type& StructuredBindingTuple::get<int 1>()
+# 1554|   Block 0
+# 1554|     v1554_1(void)                           = EnterFunction                : 
+# 1554|     mu1554_2(unknown)                       = AliasedDefinition            : 
+# 1554|     mu1554_3(unknown)                       = InitializeNonLocal           : 
+# 1554|     r1554_4(glval<unknown>)                 = VariableAddress[#this]       : 
+# 1554|     mu1554_5(glval<StructuredBindingTuple>) = InitializeParameter[#this]   : &:r1554_4
+# 1554|     r1554_6(glval<StructuredBindingTuple>)  = Load[#this]                  : &:r1554_4, ~m?
+# 1554|     mu1554_7(StructuredBindingTuple)        = InitializeIndirection[#this] : &:r1554_6
+# 1554|     r1554_8(glval<double &>)                = VariableAddress[#return]     : 
+# 1554|     r1554_9(glval<unknown>)                 = VariableAddress[#this]       : 
+# 1554|     r1554_10(StructuredBindingTuple *)      = Load[#this]                  : &:r1554_9, ~m?
+# 1554|     r1554_11(glval<double>)                 = FieldAddress[d]              : r1554_10
+#-----|     r0_1(double &)                          = CopyValue                    : r1554_11
+#-----|     mu0_2(double &)                         = Store[#return]               : &:r1554_8, r0_1
+# 1554|     v1554_12(void)                          = ReturnIndirection[#this]     : &:r1554_6, ~m?
+# 1554|     r1554_13(glval<double &>)               = VariableAddress[#return]     : 
+# 1554|     v1554_14(void)                          = ReturnValue                  : &:r1554_13, ~m?
+# 1554|     v1554_15(void)                          = AliasedUse                   : ~m?
+# 1554|     v1554_16(void)                          = ExitFunction                 : 
+
+# 1556| std::tuple_element<int 2, StructuredBindingTuple>::type StructuredBindingTuple::get<int 2>()
+# 1556|   Block 0
+# 1556|     v1556_1(void)                           = EnterFunction                : 
+# 1556|     mu1556_2(unknown)                       = AliasedDefinition            : 
+# 1556|     mu1556_3(unknown)                       = InitializeNonLocal           : 
+# 1556|     r1556_4(glval<unknown>)                 = VariableAddress[#this]       : 
+# 1556|     mu1556_5(glval<StructuredBindingTuple>) = InitializeParameter[#this]   : &:r1556_4
+# 1556|     r1556_6(glval<StructuredBindingTuple>)  = Load[#this]                  : &:r1556_4, ~m?
+# 1556|     mu1556_7(StructuredBindingTuple)        = InitializeIndirection[#this] : &:r1556_6
+# 1556|     r1556_8(glval<int &>)                   = VariableAddress[#return]     : 
+# 1556|     r1556_9(glval<unknown>)                 = VariableAddress[#this]       : 
+# 1556|     r1556_10(StructuredBindingTuple *)      = Load[#this]                  : &:r1556_9, ~m?
+# 1556|     r1556_11(glval<int &>)                  = FieldAddress[r]              : r1556_10
+# 1556|     r1556_12(int &)                         = Load[?]                      : &:r1556_11, ~m?
+# 1556|     r1556_13(glval<int>)                    = CopyValue                    : r1556_12
+# 1556|     r1556_14(int &)                         = CopyValue                    : r1556_13
+# 1556|     mu1556_15(int &)                        = Store[#return]               : &:r1556_8, r1556_14
+# 1556|     v1556_16(void)                          = ReturnIndirection[#this]     : &:r1556_6, ~m?
+# 1556|     r1556_17(glval<int &>)                  = VariableAddress[#return]     : 
+# 1556|     v1556_18(void)                          = ReturnValue                  : &:r1556_17, ~m?
+# 1556|     v1556_19(void)                          = AliasedUse                   : ~m?
+# 1556|     v1556_20(void)                          = ExitFunction                 : 
+
+# 1558| void tuple_structured_binding()
+# 1558|   Block 0
+# 1558|     v1558_1(void)                           = EnterFunction                             : 
+# 1558|     mu1558_2(unknown)                       = AliasedDefinition                         : 
+# 1558|     mu1558_3(unknown)                       = InitializeNonLocal                        : 
+# 1559|     r1559_1(glval<StructuredBindingTuple>)  = VariableAddress[t]                        : 
+# 1559|     mu1559_2(StructuredBindingTuple)        = Uninitialized[t]                          : &:r1559_1
+# 1559|     r1559_3(glval<unknown>)                 = FunctionAddress[StructuredBindingTuple]   : 
+# 1559|     v1559_4(void)                           = Call[StructuredBindingTuple]              : func:r1559_3, this:r1559_1
+# 1559|     mu1559_5(unknown)                       = ^CallSideEffect                           : ~m?
+# 1559|     mu1559_6(StructuredBindingTuple)        = ^IndirectMayWriteSideEffect[-1]           : &:r1559_1
+# 1562|     r1562_1(glval<StructuredBindingTuple>)  = VariableAddress[(unnamed local variable)] : 
+# 1562|     r1562_2(glval<StructuredBindingTuple>)  = VariableAddress[t]                        : 
+# 1562|     r1562_3(StructuredBindingTuple)         = Load[t]                                   : &:r1562_2, ~m?
+# 1562|     mu1562_4(StructuredBindingTuple)        = Store[(unnamed local variable)]           : &:r1562_1, r1562_3
+# 1562|     r1562_5(glval<int &>)                   = VariableAddress[i]                        : 
+# 1562|     r1562_6(glval<StructuredBindingTuple>)  = VariableAddress[(unnamed local variable)] : 
+# 1562|     r1562_7(glval<unknown>)                 = FunctionAddress[get]                      : 
+# 1562|     r1562_8(int &)                          = Call[get]                                 : func:r1562_7, this:r1562_6
+# 1562|     mu1562_9(unknown)                       = ^CallSideEffect                           : ~m?
+# 1562|     v1562_10(void)                          = ^IndirectReadSideEffect[-1]               : &:r1562_6, ~m?
+# 1562|     mu1562_11(StructuredBindingTuple)       = ^IndirectMayWriteSideEffect[-1]           : &:r1562_6
+# 1562|     r1562_12(glval<int>)                    = CopyValue                                 : r1562_8
+# 1562|     r1562_13(int &)                         = CopyValue                                 : r1562_12
+# 1562|     mu1562_14(int &)                        = Store[i]                                  : &:r1562_5, r1562_13
+# 1562|     r1562_15(glval<double &>)               = VariableAddress[d]                        : 
+# 1562|     r1562_16(glval<StructuredBindingTuple>) = VariableAddress[(unnamed local variable)] : 
+# 1562|     r1562_17(glval<unknown>)                = FunctionAddress[get]                      : 
+# 1562|     r1562_18(double &)                      = Call[get]                                 : func:r1562_17, this:r1562_16
+# 1562|     mu1562_19(unknown)                      = ^CallSideEffect                           : ~m?
+# 1562|     v1562_20(void)                          = ^IndirectReadSideEffect[-1]               : &:r1562_16, ~m?
+# 1562|     mu1562_21(StructuredBindingTuple)       = ^IndirectMayWriteSideEffect[-1]           : &:r1562_16
+# 1562|     r1562_22(glval<double>)                 = CopyValue                                 : r1562_18
+# 1562|     r1562_23(double &)                      = CopyValue                                 : r1562_22
+# 1562|     mu1562_24(double &)                     = Store[d]                                  : &:r1562_15, r1562_23
+# 1562|     r1562_25(glval<int &>)                  = VariableAddress[r]                        : 
+# 1562|     r1562_26(glval<StructuredBindingTuple>) = VariableAddress[(unnamed local variable)] : 
+# 1562|     r1562_27(glval<unknown>)                = FunctionAddress[get]                      : 
+# 1562|     r1562_28(int &)                         = Call[get]                                 : func:r1562_27, this:r1562_26
+# 1562|     mu1562_29(unknown)                      = ^CallSideEffect                           : ~m?
+# 1562|     v1562_30(void)                          = ^IndirectReadSideEffect[-1]               : &:r1562_26, ~m?
+# 1562|     mu1562_31(StructuredBindingTuple)       = ^IndirectMayWriteSideEffect[-1]           : &:r1562_26
+# 1562|     r1562_32(glval<int>)                    = CopyValue                                 : r1562_28
+# 1562|     r1562_33(int &)                         = CopyValue                                 : r1562_32
+# 1562|     mu1562_34(int &)                        = Store[r]                                  : &:r1562_25, r1562_33
+# 1563|     r1563_1(double)                         = Constant[4.0]                             : 
+# 1563|     r1563_2(glval<double &>)                = VariableAddress[d]                        : 
+# 1563|     r1563_3(double &)                       = Load[d]                                   : &:r1563_2, ~m?
+# 1563|     r1563_4(glval<double>)                  = CopyValue                                 : r1563_3
+# 1563|     mu1563_5(double)                        = Store[?]                                  : &:r1563_4, r1563_1
+# 1564|     r1564_1(glval<double &>)                = VariableAddress[rd]                       : 
+# 1564|     r1564_2(glval<double &>)                = VariableAddress[d]                        : 
+# 1564|     r1564_3(double &)                       = Load[d]                                   : &:r1564_2, ~m?
+# 1564|     r1564_4(glval<double>)                  = CopyValue                                 : r1564_3
+# 1564|     r1564_5(double &)                       = CopyValue                                 : r1564_4
+# 1564|     mu1564_6(double &)                      = Store[rd]                                 : &:r1564_1, r1564_5
+# 1565|     r1565_1(glval<int>)                     = VariableAddress[v]                        : 
+# 1565|     r1565_2(glval<int &>)                   = VariableAddress[i]                        : 
+# 1565|     r1565_3(int &)                          = Load[i]                                   : &:r1565_2, ~m?
+# 1565|     r1565_4(int)                            = Load[?]                                   : &:r1565_3, ~m?
+# 1565|     mu1565_5(int)                           = Store[v]                                  : &:r1565_1, r1565_4
+# 1566|     r1566_1(int)                            = Constant[5]                               : 
+# 1566|     r1566_2(glval<int &>)                   = VariableAddress[r]                        : 
+# 1566|     r1566_3(int &)                          = Load[r]                                   : &:r1566_2, ~m?
+# 1566|     r1566_4(glval<int>)                     = CopyValue                                 : r1566_3
+# 1566|     mu1566_5(int)                           = Store[?]                                  : &:r1566_4, r1566_1
+# 1567|     r1567_1(glval<int &>)                   = VariableAddress[rr]                       : 
+# 1567|     r1567_2(glval<int &>)                   = VariableAddress[r]                        : 
+# 1567|     r1567_3(int &)                          = Load[r]                                   : &:r1567_2, ~m?
+# 1567|     r1567_4(glval<int>)                     = CopyValue                                 : r1567_3
+# 1567|     r1567_5(int &)                          = CopyValue                                 : r1567_4
+# 1567|     mu1567_6(int &)                         = Store[rr]                                 : &:r1567_1, r1567_5
+# 1568|     r1568_1(glval<int>)                     = VariableAddress[w]                        : 
+# 1568|     r1568_2(glval<int &>)                   = VariableAddress[r]                        : 
+# 1568|     r1568_3(int &)                          = Load[r]                                   : &:r1568_2, ~m?
+# 1568|     r1568_4(int)                            = Load[?]                                   : &:r1568_3, ~m?
+# 1568|     mu1568_5(int)                           = Store[w]                                  : &:r1568_1, r1568_4
+# 1572|     r1572_1(glval<StructuredBindingTuple>)  = VariableAddress[unnamed_local_variable]   : 
+# 1572|     r1572_2(glval<StructuredBindingTuple>)  = VariableAddress[t]                        : 
+# 1572|     r1572_3(StructuredBindingTuple)         = Load[t]                                   : &:r1572_2, ~m?
+# 1572|     mu1572_4(StructuredBindingTuple)        = Store[unnamed_local_variable]             : &:r1572_1, r1572_3
+# 1573|     r1573_1(glval<int &>)                   = VariableAddress[i]                        : 
+# 1573|     r1573_2(glval<StructuredBindingTuple>)  = VariableAddress[unnamed_local_variable]   : 
+# 1573|     r1573_3(glval<unknown>)                 = FunctionAddress[get]                      : 
+# 1573|     r1573_4(int &)                          = Call[get]                                 : func:r1573_3, this:r1573_2
+# 1573|     mu1573_5(unknown)                       = ^CallSideEffect                           : ~m?
+# 1573|     v1573_6(void)                           = ^IndirectReadSideEffect[-1]               : &:r1573_2, ~m?
+# 1573|     mu1573_7(StructuredBindingTuple)        = ^IndirectMayWriteSideEffect[-1]           : &:r1573_2
+# 1573|     r1573_8(glval<int>)                     = CopyValue                                 : r1573_4
+# 1573|     r1573_9(int &)                          = CopyValue                                 : r1573_8
+# 1573|     mu1573_10(int &)                        = Store[i]                                  : &:r1573_1, r1573_9
+# 1574|     r1574_1(glval<double &>)                = VariableAddress[d]                        : 
+# 1574|     r1574_2(glval<StructuredBindingTuple>)  = VariableAddress[unnamed_local_variable]   : 
+# 1574|     r1574_3(glval<unknown>)                 = FunctionAddress[get]                      : 
+# 1574|     r1574_4(double &)                       = Call[get]                                 : func:r1574_3, this:r1574_2
+# 1574|     mu1574_5(unknown)                       = ^CallSideEffect                           : ~m?
+# 1574|     v1574_6(void)                           = ^IndirectReadSideEffect[-1]               : &:r1574_2, ~m?
+# 1574|     mu1574_7(StructuredBindingTuple)        = ^IndirectMayWriteSideEffect[-1]           : &:r1574_2
+# 1574|     r1574_8(glval<double>)                  = CopyValue                                 : r1574_4
+# 1574|     r1574_9(double &)                       = CopyValue                                 : r1574_8
+# 1574|     mu1574_10(double &)                     = Store[d]                                  : &:r1574_1, r1574_9
+# 1575|     r1575_1(glval<int &>)                   = VariableAddress[r]                        : 
+# 1575|     r1575_2(glval<StructuredBindingTuple>)  = VariableAddress[unnamed_local_variable]   : 
+# 1575|     r1575_3(glval<unknown>)                 = FunctionAddress[get]                      : 
+# 1575|     r1575_4(int &)                          = Call[get]                                 : func:r1575_3, this:r1575_2
+# 1575|     mu1575_5(unknown)                       = ^CallSideEffect                           : ~m?
+# 1575|     v1575_6(void)                           = ^IndirectReadSideEffect[-1]               : &:r1575_2, ~m?
+# 1575|     mu1575_7(StructuredBindingTuple)        = ^IndirectMayWriteSideEffect[-1]           : &:r1575_2
+# 1575|     r1575_8(glval<int>)                     = CopyValue                                 : r1575_4
+# 1575|     r1575_9(int &)                          = CopyValue                                 : r1575_8
+# 1575|     mu1575_10(int &)                        = Store[r]                                  : &:r1575_1, r1575_9
+# 1576|     r1576_1(double)                         = Constant[4.0]                             : 
+# 1576|     r1576_2(glval<double &>)                = VariableAddress[d]                        : 
+# 1576|     r1576_3(double &)                       = Load[d]                                   : &:r1576_2, ~m?
+# 1576|     r1576_4(glval<double>)                  = CopyValue                                 : r1576_3
+# 1576|     mu1576_5(double)                        = Store[?]                                  : &:r1576_4, r1576_1
+# 1577|     r1577_1(glval<double &>)                = VariableAddress[rd]                       : 
+# 1577|     r1577_2(glval<double &>)                = VariableAddress[d]                        : 
+# 1577|     r1577_3(double &)                       = Load[d]                                   : &:r1577_2, ~m?
+# 1577|     r1577_4(glval<double>)                  = CopyValue                                 : r1577_3
+# 1577|     r1577_5(double &)                       = CopyValue                                 : r1577_4
+# 1577|     mu1577_6(double &)                      = Store[rd]                                 : &:r1577_1, r1577_5
+# 1578|     r1578_1(glval<int>)                     = VariableAddress[v]                        : 
+# 1578|     r1578_2(glval<int &>)                   = VariableAddress[i]                        : 
+# 1578|     r1578_3(int &)                          = Load[i]                                   : &:r1578_2, ~m?
+# 1578|     r1578_4(int)                            = Load[?]                                   : &:r1578_3, ~m?
+# 1578|     mu1578_5(int)                           = Store[v]                                  : &:r1578_1, r1578_4
+# 1579|     r1579_1(int)                            = Constant[5]                               : 
+# 1579|     r1579_2(glval<int &>)                   = VariableAddress[r]                        : 
+# 1579|     r1579_3(int &)                          = Load[r]                                   : &:r1579_2, ~m?
+# 1579|     r1579_4(glval<int>)                     = CopyValue                                 : r1579_3
+# 1579|     mu1579_5(int)                           = Store[?]                                  : &:r1579_4, r1579_1
+# 1580|     r1580_1(glval<int &>)                   = VariableAddress[rr]                       : 
+# 1580|     r1580_2(glval<int &>)                   = VariableAddress[r]                        : 
+# 1580|     r1580_3(int &)                          = Load[r]                                   : &:r1580_2, ~m?
+# 1580|     r1580_4(glval<int>)                     = CopyValue                                 : r1580_3
+# 1580|     r1580_5(int &)                          = CopyValue                                 : r1580_4
+# 1580|     mu1580_6(int &)                         = Store[rr]                                 : &:r1580_1, r1580_5
+# 1581|     r1581_1(glval<int>)                     = VariableAddress[w]                        : 
+# 1581|     r1581_2(glval<int &>)                   = VariableAddress[r]                        : 
+# 1581|     r1581_3(int &)                          = Load[r]                                   : &:r1581_2, ~m?
+# 1581|     r1581_4(int)                            = Load[?]                                   : &:r1581_3, ~m?
+# 1581|     mu1581_5(int)                           = Store[w]                                  : &:r1581_1, r1581_4
+# 1583|     v1583_1(void)                           = NoOp                                      : 
+# 1558|     v1558_4(void)                           = ReturnVoid                                : 
+# 1558|     v1558_5(void)                           = AliasedUse                                : ~m?
+# 1558|     v1558_6(void)                           = ExitFunction                              : 
+
 perf-regression.cpp:
 #    6| void Big::Big()
 #    6|   Block 0

cpp/ql/test/query-tests/Best Practices/Hiding/DeclarationHidesVariable/DeclarationHidesVariable.expected

@@ -1,2 +1,3 @@
 | hiding.cpp:6:17:6:17 | i | Variable i hides another variable of the same name (on $@). | hiding.cpp:4:13:4:13 | i | line 4 |
 | hiding.cpp:18:15:18:15 | k | Variable k hides another variable of the same name (on $@). | hiding.cpp:15:11:15:11 | k | line 15 |
+| hiding.cpp:38:11:38:11 | x | Variable x hides another variable of the same name (on $@). | hiding.cpp:36:9:36:9 | x | line 36 |

cpp/ql/test/query-tests/Best Practices/Hiding/DeclarationHidesVariable/hiding.cpp

@@ -35,7 +35,7 @@ void structuredBinding() {
   int xs[1] = {1};
   auto [x] = xs;
   {
-    auto [x] = xs; // BAD [NOT DETECTED]
+    auto [x] = xs; // BAD
     auto [y] = xs; // GOOD
   }
 }

cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/CleartextBufferWrite.expected

@@ -1,18 +1,10 @@
 edges
 | test.cpp:54:17:54:20 | argv | test.cpp:58:25:58:29 | input |
-| test.cpp:54:17:54:20 | argv | test.cpp:58:25:58:29 | input |
-| test.cpp:54:17:54:20 | argv | test.cpp:58:25:58:29 | input |
-| test.cpp:54:17:54:20 | argv | test.cpp:58:25:58:29 | input |
-| test.cpp:54:17:54:20 | argv | test.cpp:58:25:58:29 | input indirection |
-| test.cpp:54:17:54:20 | argv | test.cpp:58:25:58:29 | input indirection |
-subpaths
 nodes
-| test.cpp:54:17:54:20 | argv | semmle.label | argv |
+| test2.cpp:110:3:110:6 | call to gets | semmle.label | call to gets |
 | test.cpp:54:17:54:20 | argv | semmle.label | argv |
 | test.cpp:58:25:58:29 | input | semmle.label | input |
-| test.cpp:58:25:58:29 | input | semmle.label | input |
-| test.cpp:58:25:58:29 | input | semmle.label | input |
-| test.cpp:58:25:58:29 | input indirection | semmle.label | input indirection |
-| test.cpp:58:25:58:29 | input indirection | semmle.label | input indirection |
+subpaths
 #select
-| test.cpp:58:3:58:9 | call to sprintf | test.cpp:54:17:54:20 | argv | test.cpp:58:25:58:29 | input | This write into buffer 'passwd' may contain unencrypted data from $@ | test.cpp:54:17:54:20 | argv | user input (argv) |
+| test2.cpp:110:3:110:6 | call to gets | test2.cpp:110:3:110:6 | call to gets | test2.cpp:110:3:110:6 | call to gets | This write into buffer 'password' may contain unencrypted data from $@ | test2.cpp:110:3:110:6 | call to gets | user input (String read by gets) |
+| test.cpp:58:3:58:9 | call to sprintf | test.cpp:54:17:54:20 | argv | test.cpp:58:25:58:29 | input | This write into buffer 'passwd' may contain unencrypted data from $@ | test.cpp:54:17:54:20 | argv | user input (a command-line argument) |

cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/CleartextTransmission.expected

@@ -1,4 +1,5 @@
 edges
+| test2.cpp:63:24:63:31 | password | test2.cpp:63:16:63:20 | call to crypt |
 | test3.cpp:17:28:17:36 | password1 | test3.cpp:22:15:22:23 | password1 |
 | test3.cpp:17:51:17:59 | password2 | test3.cpp:26:15:26:23 | password2 |
 | test3.cpp:45:8:45:15 | password | test3.cpp:47:15:47:22 | password |
@@ -89,11 +90,16 @@ edges
 | test3.cpp:398:18:398:25 | password | test3.cpp:400:15:400:23 | & ... |
 | test3.cpp:398:18:398:25 | password | test3.cpp:400:16:400:23 | password |
 | test3.cpp:398:18:398:25 | password | test3.cpp:400:33:400:40 | password |
+| test3.cpp:421:21:421:28 | password | test3.cpp:421:3:421:17 | call to decrypt_inplace |
+| test3.cpp:429:7:429:14 | password | test3.cpp:431:8:431:15 | password |
 | test.cpp:41:23:41:43 | cleartext password! | test.cpp:48:21:48:27 | call to encrypt |
 | test.cpp:41:23:41:43 | cleartext password! | test.cpp:48:29:48:39 | thePassword |
 | test.cpp:66:23:66:43 | cleartext password! | test.cpp:76:21:76:27 | call to encrypt |
 | test.cpp:66:23:66:43 | cleartext password! | test.cpp:76:29:76:39 | thePassword |
 nodes
+| test2.cpp:63:16:63:20 | call to crypt | semmle.label | call to crypt |
+| test2.cpp:63:24:63:31 | password | semmle.label | password |
+| test2.cpp:63:24:63:31 | password | semmle.label | password |
 | test3.cpp:17:28:17:36 | password1 | semmle.label | password1 |
 | test3.cpp:17:51:17:59 | password2 | semmle.label | password2 |
 | test3.cpp:22:15:22:23 | password1 | semmle.label | password1 |
@@ -208,6 +214,13 @@ nodes
 | test3.cpp:400:15:400:23 | & ... | semmle.label | & ... |
 | test3.cpp:400:16:400:23 | password | semmle.label | password |
 | test3.cpp:400:33:400:40 | password | semmle.label | password |
+| test3.cpp:414:17:414:24 | password | semmle.label | password |
+| test3.cpp:420:17:420:24 | password | semmle.label | password |
+| test3.cpp:421:3:421:17 | call to decrypt_inplace | semmle.label | call to decrypt_inplace |
+| test3.cpp:421:21:421:28 | password | semmle.label | password |
+| test3.cpp:421:21:421:28 | password | semmle.label | password |
+| test3.cpp:429:7:429:14 | password | semmle.label | password |
+| test3.cpp:431:8:431:15 | password | semmle.label | password |
 | test.cpp:41:23:41:43 | cleartext password! | semmle.label | cleartext password! |
 | test.cpp:48:21:48:27 | call to encrypt | semmle.label | call to encrypt |
 | test.cpp:48:29:48:39 | thePassword | semmle.label | thePassword |
@@ -238,3 +251,6 @@ subpaths
 | test3.cpp:300:2:300:5 | call to send | test3.cpp:308:58:308:66 | password2 | test3.cpp:300:14:300:17 | data | This operation transmits 'data', which may contain unencrypted sensitive data from $@ | test3.cpp:308:58:308:66 | password2 | password2 |
 | test3.cpp:341:4:341:7 | call to recv | test3.cpp:339:9:339:16 | password | test3.cpp:341:16:341:23 | password | This operation receives into 'password', which may put unencrypted sensitive data into $@ | test3.cpp:339:9:339:16 | password | password |
 | test3.cpp:388:3:388:6 | call to recv | test3.cpp:386:8:386:15 | password | test3.cpp:388:15:388:22 | password | This operation receives into 'password', which may put unencrypted sensitive data into $@ | test3.cpp:386:8:386:15 | password | password |
+| test3.cpp:414:3:414:6 | call to recv | test3.cpp:414:17:414:24 | password | test3.cpp:414:17:414:24 | password | This operation receives into 'password', which may put unencrypted sensitive data into $@ | test3.cpp:414:17:414:24 | password | password |
+| test3.cpp:420:3:420:6 | call to recv | test3.cpp:420:17:420:24 | password | test3.cpp:420:17:420:24 | password | This operation receives into 'password', which may put unencrypted sensitive data into $@ | test3.cpp:420:17:420:24 | password | password |
+| test3.cpp:431:2:431:6 | call to fgets | test3.cpp:429:7:429:14 | password | test3.cpp:431:8:431:15 | password | This operation receives into 'password', which may put unencrypted sensitive data into $@ | test3.cpp:429:7:429:14 | password | password |

cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test2.cpp

@@ -99,3 +99,14 @@ void tests(FILE *log, myStruct &s)
 		fprintf(log, "log: %s", buffer); // BAD
 	}
 }
+
+char *gets(char *s);
+
+void test_gets()
+{
+	{
+		char password[1024];
+
+		gets(password); // BAD
+	}
+}

cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test3.cpp

@@ -411,13 +411,66 @@ void test_member_password()
 	{
 		packet p;
 
-		recv(val(), p.password, 256, val()); // BAD: not encrypted [NOT DETECTED]
+		recv(val(), p.password, 256, val()); // BAD: not encrypted
 	}
 
 	{
 		packet p;
 
-		recv(val(), p.password, 256, val()); // GOOD: password is encrypted
+		recv(val(), p.password, 256, val()); // GOOD: password is encrypted [FALSE POSITIVE]
 		decrypt_inplace(p.password); // proof that `password` was in fact encrypted
 	}
 }
+
+extern FILE *stdin;
+
+void test_stdin_param(FILE *stream)
+{
+	char password[128];
+
+	fgets(password, 128, stream); // GOOD: from standard input (see call below) [FALSE POSITIVE]
+}
+
+void test_stdin()
+{
+	char password[128];
+	FILE *f = stdin;
+
+	fgets(password, 128, stdin); // GOOD: from standard input
+	fgets(password, 128, f); // GOOD: from standard input
+	test_stdin_param(stdin);
+}
+
+int open(const char *filename, int b);
+
+void test_tty()
+{
+	{
+		char password[256];
+		int f;
+
+		f = open("/dev/tty", val());
+		recv(f, password, 256, val()); // GOOD: from terminal
+	}
+
+	{
+		char password[256];
+		int f;
+
+		f = STDIN_FILENO;
+		recv(f, password, 256, val()); // GOOD: from stdin
+	}
+
+	{
+		char password[256];
+		int f;
+
+		f = open("/dev/tty", val());
+		if (f == -1)
+		{
+			f = STDIN_FILENO;
+		}
+
+		recv(f, password, 256, val()); // GOOD: from terminal or stdin
+	}
+}

cpp/ql/test/query-tests/Security/CWE/CWE-428/UnsafeCreateProcessCall.cpp

@@ -99,19 +99,19 @@ void positiveTestCases()
     void* h = 0;
     wchar_t* lpApplicationName = NULL;
 
-    // CreatePorcessA
+    // CreateProcessA
     CreateProcessA(                             //BUG
         NULL,
         (char*)"C:\\Program Files\\MyApp",
         NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL);
 
-    // CreatePorcessW
+    // CreateProcessW
     CreateProcessW(                             //BUG
         NULL,
         (wchar_t*)L"C:\\Program Files\\MyApp",
         NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL);
     
-    // CreatePorcess
+    // CreateProcess
     CreateProcess(                              //BUG
         NULL,
         (wchar_t*)L"C:\\Program Files\\MyApp",
@@ -162,7 +162,7 @@ void positiveTestCases()
         (wchar_t*)L"C:\\Program Files\\MyApp",
         NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL);
 
-    // CreatePorcess with a hardcoded variable for application Name (NULL)
+    // CreateProcess with a hardcoded variable for application Name (NULL)
     // Variation: tab instead of space
     CreateProcess(                              //BUG
         lpApplicationName,
@@ -276,19 +276,19 @@ void negativeTestCases_quotedCommandLine()
     void* h = 0;
     wchar_t* lpApplicationName = NULL;
 
-    // CreatePorcessA
+    // CreateProcessA
     CreateProcessA(
         NULL,
         (char*)"\"C:\\Program Files\\MyApp\"",
         NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL);
 
-    // CreatePorcessW
+    // CreateProcessW
     CreateProcessW(
         NULL,
         (wchar_t*)L"\"C:\\Program Files\\MyApp\"",
         NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL);
 
-    // CreatePorcess
+    // CreateProcess
     CreateProcess( 
         NULL,
         (wchar_t*)L"\"C:\\Program Files\\MyApp\"",
@@ -339,7 +339,7 @@ void negativeTestCases_quotedCommandLine()
         (wchar_t*)L"\"C:\\Program Files\\MyApp\"",
         NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL);
 
-    // CreatePorcess with a hardcoded variable for application Name (NULL)
+    // CreateProcess with a hardcoded variable for application Name (NULL)
     CreateProcess( 
         lpApplicationName,
         (wchar_t*)L"\"C:\\Program Files\\MyApp\"",
@@ -359,19 +359,19 @@ void negativeTestCases_AppNameSet()
     void* h = 0;
     const wchar_t* lpApplicationName = (const wchar_t*)L"MyApp.exe";
 
-    // CreatePorcessA
+    // CreateProcessA
     CreateProcessA(
         (char*)"MyApp.exe",
         (char*)"C:\\Program Files\\MyApp",
         NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL);
 
-    // CreatePorcessW
+    // CreateProcessW
     CreateProcessW(
         (wchar_t*)L"MyApp.exe",
         (wchar_t*)L"C:\\Program Files\\MyApp",
         NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL);
 
-    // CreatePorcess
+    // CreateProcess
     CreateProcess(
         (wchar_t*)L"MyApp.exe",
         (wchar_t*)L"C:\\Program Files\\MyApp",
@@ -422,7 +422,7 @@ void negativeTestCases_AppNameSet()
         (wchar_t*)L"C:\\Program Files\\MyApp",
         NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL);
 
-    // CreatePorcess with a hardcoded variable for application Name (NULL)
+    // CreateProcess with a hardcoded variable for application Name (NULL)
     CreateProcess(
         (wchar_t*)lpApplicationName,
         (wchar_t*)L"C:\\Program Files\\MyApp",

cpp/ql/test/query-tests/Security/CWE/CWE-732/OpenCallMissingModeArgument.c

@@ -0,0 +1,29 @@
+typedef unsigned int mode_t;
+
+#define O_RDWR     0x0002
+#define O_CLOEXEC  0x0040
+#define O_NONBLOCK 0x0080
+#define O_CREAT    0x0200
+#define O_APPEND   0x0800
+#define O_TMPFILE  0x2000
+
+int open(const char *pathname, int flags, ...);
+
+int openat(int dirfd, const char *pathname, int flags, ...);
+
+const char *a_file = "/a_file";
+
+void test_open() {
+  open(a_file, O_NONBLOCK); // GOOD
+  open(a_file, O_RDWR | O_CLOEXEC); // GOOD
+  open(a_file, O_APPEND); // GOOD
+  open(a_file, O_CREAT); // BAD
+  open(a_file, O_CREAT, 0); // GOOD
+  open(a_file, O_TMPFILE); // BAD
+  open(a_file, O_TMPFILE, 0); // GOOD
+  openat(0, a_file, O_APPEND); // GOOD
+  openat(0, a_file, O_CREAT); // BAD
+  openat(0, a_file, O_CREAT, 0); // GOOD
+  openat(0, a_file, O_TMPFILE); // BAD
+  openat(0, a_file, O_TMPFILE, 0); // GOOD
+}

cpp/ql/test/query-tests/Security/CWE/CWE-732/OpenCallMissingModeArgument.expected

@@ -0,0 +1,4 @@
+| OpenCallMissingModeArgument.c:20:3:20:6 | call to open | A file is created here without providing a mode argument, which may leak bits from the stack. |
+| OpenCallMissingModeArgument.c:22:3:22:6 | call to open | A file is created here without providing a mode argument, which may leak bits from the stack. |
+| OpenCallMissingModeArgument.c:25:3:25:8 | call to openat | A file is created here without providing a mode argument, which may leak bits from the stack. |
+| OpenCallMissingModeArgument.c:27:3:27:8 | call to openat | A file is created here without providing a mode argument, which may leak bits from the stack. |

cpp/ql/test/query-tests/Security/CWE/CWE-732/OpenCallMissingModeArgument.qlref

@@ -0,0 +1 @@
+Security/CWE/CWE-732/OpenCallMissingModeArgument.ql

csharp/autobuilder/Semmle.Autobuild.CSharp.Tests/Semmle.Autobuild.CSharp.Tests.csproj

@@ -1,6 +1,6 @@
 <Project Sdk="Microsoft.NET.Sdk">
 	<PropertyGroup>
-		<TargetFramework>net5.0</TargetFramework>
+		<TargetFramework>net6.0</TargetFramework>
 		<GenerateAssemblyInfo>false</GenerateAssemblyInfo>
 		<RuntimeIdentifiers>win-x64;linux-x64;osx-x64</RuntimeIdentifiers>
 		<Nullable>enable</Nullable>

csharp/autobuilder/Semmle.Autobuild.CSharp/Semmle.Autobuild.CSharp.csproj

@@ -1,6 +1,6 @@
 <Project Sdk="Microsoft.NET.Sdk">
 	<PropertyGroup>
-		<TargetFramework>net5.0</TargetFramework>
+		<TargetFramework>net6.0</TargetFramework>
 		<AssemblyName>Semmle.Autobuild.CSharp</AssemblyName>
 		<RootNamespace>Semmle.Autobuild.CSharp</RootNamespace>
 		<ApplicationIcon/>

csharp/autobuilder/Semmle.Autobuild.Shared/Semmle.Autobuild.Shared.csproj

@@ -1,6 +1,6 @@
 <Project Sdk="Microsoft.NET.Sdk">
 	<PropertyGroup>
-		<TargetFramework>net5.0</TargetFramework>
+		<TargetFramework>net6.0</TargetFramework>
 		<AssemblyName>Semmle.Autobuild.Shared</AssemblyName>
 		<RootNamespace>Semmle.Autobuild.Shared</RootNamespace>
 		<GenerateAssemblyInfo>false</GenerateAssemblyInfo>

csharp/downgrades/4b9c288ece4218779b6113b17af42795f4bbbee1/upgrade.properties

@@ -0,0 +1,3 @@
+description: Remove 'lambda_expr_return_type' relation.
+compatibility: backwards
+lambda_expr_return_type.rel: delete