C++: Fix ql-for-ql alerts.

config/identical-files.json

@@ -8,11 +8,11 @@
     "java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl6.qll",
     "java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImplForSerializability.qll",
     "java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImplForOnActivityResult.qll",
-    "cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll",
-    "cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll",
-    "cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll",
-    "cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll",
-    "cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplLocal.qll",
+    "cpp/ql/lib/semmle/code/cpp/dataflow/old/internal/DataFlowImpl.qll",
+    "cpp/ql/lib/semmle/code/cpp/dataflow/old/internal/DataFlowImpl2.qll",
+    "cpp/ql/lib/semmle/code/cpp/dataflow/old/internal/DataFlowImpl3.qll",
+    "cpp/ql/lib/semmle/code/cpp/dataflow/old/internal/DataFlowImpl4.qll",
+    "cpp/ql/lib/semmle/code/cpp/dataflow/old/internal/DataFlowImplLocal.qll",
     "cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll",
     "cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll",
     "cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll",
@@ -40,7 +40,7 @@
   ],
   "DataFlow Java/C++/C#/Python Common": [
     "java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImplCommon.qll",
-    "cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplCommon.qll",
+    "cpp/ql/lib/semmle/code/cpp/dataflow/old/internal/DataFlowImplCommon.qll",
     "cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplCommon.qll",
     "cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImplCommon.qll",
     "csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImplCommon.qll",
@@ -49,8 +49,8 @@
     "swift/ql/lib/codeql/swift/dataflow/internal/DataFlowImplCommon.qll"
   ],
   "TaintTracking::Configuration Java/C++/C#/Python": [
-    "cpp/ql/lib/semmle/code/cpp/dataflow/internal/tainttracking1/TaintTrackingImpl.qll",
-    "cpp/ql/lib/semmle/code/cpp/dataflow/internal/tainttracking2/TaintTrackingImpl.qll",
+    "cpp/ql/lib/semmle/code/cpp/dataflow/old/internal/tainttracking1/TaintTrackingImpl.qll",
+    "cpp/ql/lib/semmle/code/cpp/dataflow/old/internal/tainttracking2/TaintTrackingImpl.qll",
     "cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/tainttracking1/TaintTrackingImpl.qll",
     "cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/tainttracking2/TaintTrackingImpl.qll",
     "cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/tainttracking3/TaintTrackingImpl.qll",
@@ -74,7 +74,7 @@
   ],
   "DataFlow Java/C++/C#/Python Consistency checks": [
     "java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImplConsistency.qll",
-    "cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplConsistency.qll",
+    "cpp/ql/lib/semmle/code/cpp/dataflow/old/internal/DataFlowImplConsistency.qll",
     "cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplConsistency.qll",
     "cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImplConsistency.qll",
     "csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImplConsistency.qll",
@@ -115,7 +115,7 @@
   ],
   "C++ SubBasicBlocks": [
     "cpp/ql/lib/semmle/code/cpp/controlflow/SubBasicBlocks.qll",
-    "cpp/ql/lib/semmle/code/cpp/dataflow/internal/SubBasicBlocks.qll"
+    "cpp/ql/lib/semmle/code/cpp/dataflow/old/internal/SubBasicBlocks.qll"
   ],
   "IR Instruction": [
     "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/Instruction.qll",

cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll

@@ -887,7 +887,7 @@ class ThisParameterNode extends ParameterNode, InstructionNode {
 }
 
 pragma[noinline]
-private predicate indirectPostionHasArgumentIndexAndIndex(
+private predicate indirectPositionHasArgumentIndexAndIndex(
   IndirectionPosition pos, int argumentIndex, int indirectionIndex
 ) {
   pos.getArgumentIndex() = argumentIndex and
@@ -907,7 +907,7 @@ class ParameterIndirectionNode extends ParameterNode instanceof IndirectParamete
   override predicate isParameterOf(Function f, ParameterPosition pos) {
     IndirectParameterNode.super.getEnclosingCallable() = f and
     exists(int argumentIndex, int indirectionIndex |
-      indirectPostionHasArgumentIndexAndIndex(pos, argumentIndex, indirectionIndex) and
+      indirectPositionHasArgumentIndexAndIndex(pos, argumentIndex, indirectionIndex) and
       indirectParameterNodeHasArgumentIndexAndIndex(this, argumentIndex, indirectionIndex)
     )
   }

cpp/ql/lib/semmle/code/cpp/dataflow/DataFlow.qll

@@ -4,10 +4,7 @@
  * _sink_.
  *
  * Unless configured otherwise, _flow_ means that the exact value of
- * the source may reach the sink. We do not track flow across pointer
- * dereferences or array indexing. To track these types of flow, where the
- * exact value may not be preserved, import
- * `semmle.code.cpp.dataflow.TaintTracking`.
+ * the source may reach the sink.
  *
  * To use global (interprocedural) data flow, extend the class
  * `DataFlow::Configuration` as documented on that class. To use local
@@ -17,8 +14,4 @@
  * `DataFlow::Node`.
  */
 
-import cpp
-
-module DataFlow {
-  import semmle.code.cpp.dataflow.internal.DataFlowImpl
-}
+import semmle.code.cpp.ir.dataflow.DataFlow

cpp/ql/lib/semmle/code/cpp/dataflow/DataFlow2.qll

@@ -9,8 +9,4 @@
  * See `semmle.code.cpp.dataflow.DataFlow` for the full documentation.
  */
 
-import cpp
-
-module DataFlow2 {
-  import semmle.code.cpp.dataflow.internal.DataFlowImpl2
-}
+import semmle.code.cpp.ir.dataflow.DataFlow2

cpp/ql/lib/semmle/code/cpp/dataflow/DataFlow3.qll

@@ -9,8 +9,4 @@
  * See `semmle.code.cpp.dataflow.DataFlow` for the full documentation.
  */
 
-import cpp
-
-module DataFlow3 {
-  import semmle.code.cpp.dataflow.internal.DataFlowImpl3
-}
+import semmle.code.cpp.ir.dataflow.DataFlow3

cpp/ql/lib/semmle/code/cpp/dataflow/DataFlow4.qll

@@ -9,8 +9,4 @@
  * See `semmle.code.cpp.dataflow.DataFlow` for the full documentation.
  */
 
-import cpp
-
-module DataFlow4 {
-  import semmle.code.cpp.dataflow.internal.DataFlowImpl4
-}
+import semmle.code.cpp.ir.dataflow.DataFlow4

cpp/ql/lib/semmle/code/cpp/dataflow/StackAddress.qll

@@ -95,6 +95,11 @@ predicate stackPointerFlowsToUse(Expr use, Type useType, Expr source, boolean is
 cached
 private PointerType getExprPtrType(Expr use) { result = use.getUnspecifiedType() }
 
+/**
+ * Holds if `use` has type `useType` and `source` is an access to a stack variable
+ * that flows to `use`. `isLocal` is `true` if `use` is accessed via a parameter, and
+ * `false` otherwise.
+ */
 predicate stackReferenceFlowsToUse(Expr use, Type useType, Expr source, boolean isLocal) {
   // Stack variables
   exists(StackVariable var |

cpp/ql/lib/semmle/code/cpp/dataflow/TaintTracking.qll

@@ -15,9 +15,4 @@
  * `TaintTracking::localTaintStep` with arguments of type `DataFlow::Node`.
  */
 
-import semmle.code.cpp.dataflow.DataFlow
-import semmle.code.cpp.dataflow.DataFlow2
-
-module TaintTracking {
-  import semmle.code.cpp.dataflow.internal.tainttracking1.TaintTrackingImpl
-}
+import semmle.code.cpp.ir.dataflow.TaintTracking

cpp/ql/lib/semmle/code/cpp/dataflow/TaintTracking2.qll

@@ -10,6 +10,5 @@
  *
  * See `semmle.code.cpp.dataflow.TaintTracking` for the full documentation.
  */
-module TaintTracking2 {
-  import semmle.code.cpp.dataflow.internal.tainttracking2.TaintTrackingImpl
-}
+
+import semmle.code.cpp.ir.dataflow.TaintTracking2

cpp/ql/lib/semmle/code/cpp/dataflow/TaintTracking3.qll

@@ -0,0 +1,14 @@
+/**
+ * Provides a `TaintTracking3` module, which is a copy of the `TaintTracking`
+ * module. Use this class when data-flow configurations or taint-tracking
+ * configurations must depend on each other. Two classes extending
+ * `DataFlow::Configuration` should never depend on each other, but one of them
+ * should instead depend on a `DataFlow2::Configuration`, a
+ * `DataFlow3::Configuration`, or a `DataFlow4::Configuration`. The
+ * `TaintTracking::Configuration` class extends `DataFlow::Configuration`, and
+ * `TaintTracking2::Configuration` extends `DataFlow2::Configuration`.
+ *
+ * See `semmle.code.cpp.dataflow.TaintTracking` for the full documentation.
+ */
+
+import semmle.code.cpp.ir.dataflow.TaintTracking3

cpp/ql/lib/semmle/code/cpp/dataflow/internal/tainttracking1/TaintTrackingParameter.qll

@@ -1,5 +0,0 @@
-import semmle.code.cpp.dataflow.internal.TaintTrackingUtil as Public
-
-module Private {
-  import semmle.code.cpp.dataflow.DataFlow::DataFlow as DataFlow
-}

cpp/ql/lib/semmle/code/cpp/dataflow/internal/tainttracking2/TaintTrackingParameter.qll

@@ -1,5 +0,0 @@
-import semmle.code.cpp.dataflow.internal.TaintTrackingUtil as Public
-
-module Private {
-  import semmle.code.cpp.dataflow.DataFlow2::DataFlow2 as DataFlow
-}

cpp/ql/lib/semmle/code/cpp/dataflow/old/DataFlow.qll

@@ -0,0 +1,25 @@
+/**
+ * Provides a library for local (intra-procedural) and global (inter-procedural)
+ * data flow analysis: deciding whether data can flow from a _source_ to a
+ * _sink_.
+ *
+ * Unless configured otherwise, _flow_ means that the exact value of
+ * the source may reach the sink.
+ *
+ * To use global (interprocedural) data flow, extend the class
+ * `DataFlow::Configuration` as documented on that class. To use local
+ * (intraprocedural) data flow between expressions, call
+ * `DataFlow::localExprFlow`. For more general cases of local data flow, call
+ * `DataFlow::localFlow` or `DataFlow::localFlowStep` with arguments of type
+ * `DataFlow::Node`.
+ */
+
+import cpp
+
+/**
+ * Provides classes for performing local (intra-procedural) and
+ * global (inter-procedural) data flow analyses.
+ */
+module DataFlow {
+  import semmle.code.cpp.dataflow.old.internal.DataFlowImpl
+}

cpp/ql/lib/semmle/code/cpp/dataflow/old/DataFlow2.qll

@@ -0,0 +1,20 @@
+/**
+ * Provides a `DataFlow2` module, which is a copy of the `DataFlow` module. Use
+ * this class when data-flow configurations must depend on each other. Two
+ * classes extending `DataFlow::Configuration` should never depend on each
+ * other, but one of them should instead depend on a
+ * `DataFlow2::Configuration`, a `DataFlow3::Configuration`, or a
+ * `DataFlow4::Configuration`.
+ *
+ * See `semmle.code.cpp.ir.dataflow.DataFlow` for the full documentation.
+ */
+
+import cpp
+
+/**
+ * Provides classes for performing local (intra-procedural) and
+ * global (inter-procedural) data flow analyses.
+ */
+module DataFlow {
+  import semmle.code.cpp.dataflow.old.internal.DataFlowImpl2
+}

cpp/ql/lib/semmle/code/cpp/dataflow/old/DataFlow3.qll

@@ -0,0 +1,20 @@
+/**
+ * Provides a `DataFlow3` module, which is a copy of the `DataFlow` module. Use
+ * this class when data-flow configurations must depend on each other. Two
+ * classes extending `DataFlow::Configuration` should never depend on each
+ * other, but one of them should instead depend on a
+ * `DataFlow2::Configuration`, a `DataFlow3::Configuration`, or a
+ * `DataFlow4::Configuration`.
+ *
+ * See `semmle.code.cpp.ir.dataflow.DataFlow` for the full documentation.
+ */
+
+import cpp
+
+/**
+ * Provides classes for performing local (intra-procedural) and
+ * global (inter-procedural) data flow analyses.
+ */
+module DataFlow {
+  import semmle.code.cpp.dataflow.old.internal.DataFlowImpl3
+}

cpp/ql/lib/semmle/code/cpp/dataflow/old/DataFlow4.qll

@@ -0,0 +1,20 @@
+/**
+ * Provides a `DataFlow4` module, which is a copy of the `DataFlow` module. Use
+ * this class when data-flow configurations must depend on each other. Two
+ * classes extending `DataFlow::Configuration` should never depend on each
+ * other, but one of them should instead depend on a
+ * `DataFlow2::Configuration`, a `DataFlow3::Configuration`, or a
+ * `DataFlow4::Configuration`.
+ *
+ * See `semmle.code.cpp.ir.dataflow.DataFlow` for the full documentation.
+ */
+
+import cpp
+
+/**
+ * Provides classes for performing local (intra-procedural) and
+ * global (inter-procedural) data flow analyses.
+ */
+module DataFlow {
+  import semmle.code.cpp.dataflow.old.internal.DataFlowImpl4
+}

cpp/ql/lib/semmle/code/cpp/dataflow/old/RecursionPrevention.qll

@@ -0,0 +1,39 @@
+/**
+ * DEPRECATED: Recursion through `DataFlow::Configuration` is impossible in
+ * any supported tooling. There is no need for this module because it's
+ * impossible to accidentally depend on recursion through
+ * `DataFlow::Configuration` in current releases.
+ *
+ * When this module is imported, recursive use of `DataFlow::Configuration` is
+ * disallowed. Importing this module will guarantee the absence of such
+ * recursion, which is unsupported and will be unconditionally disallowed in a
+ * future release.
+ *
+ * Recursive use of `DataFlow{2..4}::Configuration` is always disallowed, so no
+ * import is needed for those.
+ */
+
+import cpp
+private import semmle.code.cpp.dataflow.DataFlow
+
+/**
+ * This class exists to prevent mutual recursion between the user-overridden
+ * member predicates of `Configuration` and the rest of the data-flow library.
+ * Good performance cannot be guaranteed in the presence of such recursion, so
+ * it should be replaced by using more than one copy of the data flow library.
+ * Four copies are available: `DataFlow` through `DataFlow4`.
+ */
+abstract private class ConfigurationRecursionPrevention extends DataFlow::Configuration {
+  bindingset[this]
+  ConfigurationRecursionPrevention() { any() }
+
+  override predicate hasFlow(DataFlow::Node source, DataFlow::Node sink) {
+    strictcount(DataFlow::Node n | this.isSource(n)) < 0
+    or
+    strictcount(DataFlow::Node n | this.isSink(n)) < 0
+    or
+    strictcount(DataFlow::Node n1, DataFlow::Node n2 | this.isAdditionalFlowStep(n1, n2)) < 0
+    or
+    super.hasFlow(source, sink)
+  }
+}

cpp/ql/lib/semmle/code/cpp/dataflow/old/TaintTracking.qll

@@ -0,0 +1,18 @@
+/**
+ * Provides classes for performing local (intra-procedural) and
+ * global (inter-procedural) taint-tracking analyses.
+ *
+ * We define _taint propagation_ informally to mean that a substantial part of
+ * the information from the source is preserved at the sink. For example, taint
+ * propagates from `x` to `x + 100`, but it does not propagate from `x` to `x >
+ * 100` since we consider a single bit of information to be too little.
+ *
+ * To use global (interprocedural) taint tracking, extend the class
+ * `TaintTracking::Configuration` as documented on that class. To use local
+ * (intraprocedural) taint tracking between expressions, call
+ * `TaintTracking::localExprTaint`. For more general cases of local taint
+ * tracking, call `TaintTracking::localTaint` or
+ * `TaintTracking::localTaintStep` with arguments of type `DataFlow::Node`.
+ */
+
+import semmle.code.cpp.ir.dataflow.TaintTracking

cpp/ql/lib/semmle/code/cpp/dataflow/old/TaintTracking2.qll

@@ -0,0 +1,14 @@
+/**
+ * Provides a `TaintTracking2` module, which is a copy of the `TaintTracking`
+ * module. Use this class when data-flow configurations or taint-tracking
+ * configurations must depend on each other. Two classes extending
+ * `DataFlow::Configuration` should never depend on each other, but one of them
+ * should instead depend on a `DataFlow2::Configuration`, a
+ * `DataFlow3::Configuration`, or a `DataFlow4::Configuration`. The
+ * `TaintTracking::Configuration` class extends `DataFlow::Configuration`, and
+ * `TaintTracking2::Configuration` extends `DataFlow2::Configuration`.
+ *
+ * See `semmle.code.cpp.ir.dataflow.TaintTracking` for the full documentation.
+ */
+
+import semmle.code.cpp.ir.dataflow.TaintTracking2

cpp/ql/lib/semmle/code/cpp/dataflow/old/TaintTracking3.qll

@@ -0,0 +1,14 @@
+/**
+ * Provides a `TaintTracking3` module, which is a copy of the `TaintTracking`
+ * module. Use this class when data-flow configurations or taint-tracking
+ * configurations must depend on each other. Two classes extending
+ * `DataFlow::Configuration` should never depend on each other, but one of them
+ * should instead depend on a `DataFlow2::Configuration`, a
+ * `DataFlow3::Configuration`, or a `DataFlow4::Configuration`. The
+ * `TaintTracking::Configuration` class extends `DataFlow::Configuration`, and
+ * `TaintTracking2::Configuration` extends `DataFlow2::Configuration`.
+ *
+ * See `semmle.code.cpp.ir.dataflow.TaintTracking` for the full documentation.
+ */
+
+import semmle.code.cpp.ir.dataflow.TaintTracking3

cpp/ql/lib/semmle/code/cpp/dataflow/old/internal/DataFlowDispatch.qll

@@ -1,6 +1,6 @@
 private import cpp
-private import semmle.code.cpp.dataflow.internal.DataFlowPrivate
-private import semmle.code.cpp.dataflow.internal.DataFlowUtil
+private import DataFlowPrivate
+private import DataFlowUtil
 
 /**
  * Gets a function that might be called by `call`.

cpp/ql/lib/semmle/code/cpp/dataflow/old/internal/DataFlowUtil.qll

@@ -3,10 +3,10 @@
  */
 
 private import cpp
-private import semmle.code.cpp.dataflow.internal.FlowVar
+private import FlowVar
 private import semmle.code.cpp.models.interfaces.DataFlow
 private import semmle.code.cpp.controlflow.Guards
-private import semmle.code.cpp.dataflow.internal.AddressFlow
+private import AddressFlow
 
 cached
 private newtype TNode =

cpp/ql/lib/semmle/code/cpp/dataflow/old/internal/FlowVar.qll

@@ -4,8 +4,8 @@
 
 import cpp
 private import semmle.code.cpp.controlflow.SSA
-private import semmle.code.cpp.dataflow.internal.SubBasicBlocks
-private import semmle.code.cpp.dataflow.internal.AddressFlow
+private import SubBasicBlocks
+private import AddressFlow
 private import semmle.code.cpp.models.implementations.Iterator
 private import semmle.code.cpp.models.interfaces.PointerWrapper
 

cpp/ql/lib/semmle/code/cpp/dataflow/old/internal/TaintTrackingUtil.qll

@@ -14,7 +14,7 @@ private import semmle.code.cpp.models.interfaces.Iterator
 private import semmle.code.cpp.models.interfaces.PointerWrapper
 
 private module DataFlow {
-  import semmle.code.cpp.dataflow.internal.DataFlowUtil
+  import DataFlowUtil
 }
 
 /**

cpp/ql/lib/semmle/code/cpp/dataflow/old/internal/tainttracking1/TaintTrackingParameter.qll

@@ -0,0 +1,5 @@
+import semmle.code.cpp.dataflow.old.internal.TaintTrackingUtil as Public
+
+module Private {
+  import semmle.code.cpp.dataflow.old.DataFlow::DataFlow as DataFlow
+}

cpp/ql/lib/semmle/code/cpp/dataflow/old/internal/tainttracking2/TaintTrackingParameter.qll

@@ -0,0 +1,5 @@
+import semmle.code.cpp.dataflow.old.internal.TaintTrackingUtil as Public
+
+module Private {
+  import semmle.code.cpp.dataflow.old.DataFlow2::DataFlow as DataFlow
+}

cpp/ql/lib/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll

@@ -282,7 +282,7 @@ private module Cached {
   cached
   predicate additionalTaintStep(DataFlow::Node n1, DataFlow::Node n2) {
     exists(CallInstruction call, Function func, FunctionInput modelIn, FunctionOutput modelOut |
-      n1.asOperand() = callInput(call, modelIn) and
+      n1 = callInput(call, modelIn) and
       (
         func.(TaintFunction).hasTaintFlow(modelIn, modelOut)
         or

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowDispatch.qll

@@ -1,8 +1,8 @@
 private import cpp
 private import semmle.code.cpp.ir.IR
 private import semmle.code.cpp.ir.dataflow.DataFlow
-private import semmle.code.cpp.ir.dataflow.internal.DataFlowPrivate
-private import semmle.code.cpp.ir.dataflow.internal.DataFlowUtil
+private import DataFlowPrivate
+private import DataFlowUtil
 private import DataFlowImplCommon as DataFlowImplCommon
 
 /**

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll

@@ -1,8 +1,10 @@
-private import cpp
+private import cpp as Cpp
 private import DataFlowUtil
 private import semmle.code.cpp.ir.IR
 private import DataFlowDispatch
 private import DataFlowImplConsistency
+private import semmle.code.cpp.ir.internal.IRCppLanguage
+private import SsaInternals as Ssa
 
 /** Gets the callable in which this node occurs. */
 DataFlowCallable nodeGetEnclosingCallable(Node n) { result = n.getEnclosingCallable() }
@@ -22,7 +24,7 @@ predicate isArgumentNode(ArgumentNode arg, DataFlowCall c, ArgumentPosition pos)
  * to the callable. Instance arguments (`this` pointer) and read side effects
  * on parameters are also included.
  */
-abstract class ArgumentNode extends OperandNode {
+abstract class ArgumentNode extends Node {
   /**
    * Holds if this argument occurs at the given position in the given call.
    * The instance argument is considered to have index `-1`.
@@ -37,7 +39,7 @@ abstract class ArgumentNode extends OperandNode {
  * A data flow node that occurs as the argument to a call, or an
  * implicit `this` pointer argument.
  */
-private class PrimaryArgumentNode extends ArgumentNode {
+private class PrimaryArgumentNode extends ArgumentNode, OperandNode {
   override ArgumentOperand op;
 
   PrimaryArgumentNode() { exists(CallInstruction call | op = call.getAnArgumentOperand()) }
@@ -46,49 +48,34 @@ private class PrimaryArgumentNode extends ArgumentNode {
     op = call.getArgumentOperand(pos.(DirectPosition).getIndex())
   }
 
-  override string toString() {
-    exists(Expr unconverted |
-      unconverted = op.getDef().getUnconvertedResultExpression() and
-      result = unconverted.toString()
-    )
-    or
-    // Certain instructions don't map to an unconverted result expression. For these cases
-    // we fall back to a simpler naming scheme. This can happen in IR-generated constructors.
-    not exists(op.getDef().getUnconvertedResultExpression()) and
-    (
-      result = "Argument " + op.(PositionalArgumentOperand).getIndex()
-      or
-      op instanceof ThisArgumentOperand and result = "Argument this"
-    )
-  }
+  override string toStringImpl() { result = argumentOperandToString(op) }
 }
 
-/**
- * A data flow node representing the read side effect of a call on a
- * specific parameter.
- */
-private class SideEffectArgumentNode extends ArgumentNode {
-  override SideEffectOperand op;
-  ReadSideEffectInstruction read;
+private string argumentOperandToString(ArgumentOperand op) {
+  exists(Expr unconverted |
+    unconverted = op.getDef().getUnconvertedResultExpression() and
+    result = unconverted.toString()
+  )
+  or
+  // Certain instructions don't map to an unconverted result expression. For these cases
+  // we fall back to a simpler naming scheme. This can happen in IR-generated constructors.
+  not exists(op.getDef().getUnconvertedResultExpression()) and
+  (
+    result = "Argument " + op.(PositionalArgumentOperand).getIndex()
+    or
+    op instanceof ThisArgumentOperand and result = "Argument this"
+  )
+}
 
-  SideEffectArgumentNode() { op = read.getSideEffectOperand() }
-
-  override predicate argumentOf(DataFlowCall call, ArgumentPosition pos) {
-    read.getPrimaryInstruction() = call and
-    pos.(IndirectionPosition).getIndex() = read.getIndex()
+private class SideEffectArgumentNode extends ArgumentNode, SideEffectOperandNode {
+  override predicate argumentOf(DataFlowCall dfCall, ArgumentPosition pos) {
+    this.getCallInstruction() = dfCall and
+    pos.(IndirectionPosition).getArgumentIndex() = this.getArgumentIndex() and
+    pos.(IndirectionPosition).getIndirectionIndex() = super.getIndirectionIndex()
   }
 
-  override string toString() {
-    result = read.getArgumentDef().getUnconvertedResultExpression().toString() + " indirection"
-    or
-    // Some instructions don't map to an unconverted result expression. For these cases
-    // we fall back to a simpler naming scheme. This can happen in IR-generated constructors.
-    not exists(read.getArgumentDef().getUnconvertedResultExpression()) and
-    (
-      if read.getIndex() = -1
-      then result = "Argument this indirection"
-      else result = "Argument " + read.getIndex() + " indirection"
-    )
+  override string toStringImpl() {
+    result = argumentOperandToString(this.getAddressOperand()) + " indirection"
   }
 }
 
@@ -102,47 +89,57 @@ class Position extends TPosition {
   abstract string toString();
 }
 
-class DirectPosition extends TDirectPosition {
+class DirectPosition extends Position, TDirectPosition {
   int index;
 
   DirectPosition() { this = TDirectPosition(index) }
 
-  string toString() {
-    index = -1 and
-    result = "this"
-    or
-    index != -1 and
-    result = index.toString()
-  }
+  override string toString() { if index = -1 then result = "this" else result = index.toString() }
 
   int getIndex() { result = index }
 }
 
-class IndirectionPosition extends TIndirectionPosition {
-  int index;
+class IndirectionPosition extends Position, TIndirectionPosition {
+  int argumentIndex;
+  int indirectionIndex;
 
-  IndirectionPosition() { this = TIndirectionPosition(index) }
+  IndirectionPosition() { this = TIndirectionPosition(argumentIndex, indirectionIndex) }
 
-  string toString() {
-    index = -1 and
-    result = "this"
-    or
-    index != -1 and
-    result = index.toString()
+  override string toString() {
+    if argumentIndex = -1
+    then if indirectionIndex > 0 then result = "this indirection" else result = "this"
+    else
+      if indirectionIndex > 0
+      then result = argumentIndex.toString() + " indirection"
+      else result = argumentIndex.toString()
   }
 
-  int getIndex() { result = index }
+  int getArgumentIndex() { result = argumentIndex }
+
+  int getIndirectionIndex() { result = indirectionIndex }
 }
 
 newtype TPosition =
   TDirectPosition(int index) { exists(any(CallInstruction c).getArgument(index)) } or
-  TIndirectionPosition(int index) {
-    exists(ReadSideEffectInstruction instr | instr.getIndex() = index)
+  TIndirectionPosition(int argumentIndex, int indirectionIndex) {
+    hasOperandAndIndex(_, any(CallInstruction call).getArgumentOperand(argumentIndex),
+      indirectionIndex)
   }
 
 private newtype TReturnKind =
-  TNormalReturnKind() or
-  TIndirectReturnKind(ParameterIndex index)
+  TNormalReturnKind(int index) {
+    exists(IndirectReturnNode return |
+      return.getAddressOperand() = any(ReturnValueInstruction r).getReturnAddressOperand() and
+      index = return.getIndirectionIndex() - 1 // We subtract one because the return loads the value.
+    )
+  } or
+  TIndirectReturnKind(int argumentIndex, int indirectionIndex) {
+    exists(IndirectReturnNode return, ReturnIndirectionInstruction returnInd |
+      returnInd.hasIndex(argumentIndex) and
+      return.getAddressOperand() = returnInd.getSourceAddressOperand() and
+      indirectionIndex = return.getIndirectionIndex()
+    )
+  }
 
 /**
  * A return kind. A return kind describes how a value can be returned
@@ -154,53 +151,146 @@ class ReturnKind extends TReturnKind {
 }
 
 private class NormalReturnKind extends ReturnKind, TNormalReturnKind {
-  override string toString() { result = "return" }
+  int index;
+
+  NormalReturnKind() { this = TNormalReturnKind(index) }
+
+  override string toString() { result = "indirect return" }
 }
 
 private class IndirectReturnKind extends ReturnKind, TIndirectReturnKind {
-  ParameterIndex index;
+  int argumentIndex;
+  int indirectionIndex;
 
-  IndirectReturnKind() { this = TIndirectReturnKind(index) }
+  IndirectReturnKind() { this = TIndirectReturnKind(argumentIndex, indirectionIndex) }
 
-  override string toString() { result = "outparam[" + index.toString() + "]" }
+  override string toString() { result = "indirect outparam[" + argumentIndex.toString() + "]" }
 }
 
 /** A data flow node that occurs as the result of a `ReturnStmt`. */
-class ReturnNode extends InstructionNode {
-  Instruction primary;
-
-  ReturnNode() {
-    exists(ReturnValueInstruction ret | instr = ret and primary = ret)
-    or
-    exists(ReturnIndirectionInstruction rii | instr = rii and primary = rii)
-  }
-
+class ReturnNode extends Node instanceof IndirectReturnNode {
   /** Gets the kind of this returned value. */
   abstract ReturnKind getKind();
 }
 
-class ReturnValueNode extends ReturnNode {
-  override ReturnValueInstruction primary;
-
-  override ReturnKind getKind() { result = TNormalReturnKind() }
+/**
+ * This predicate represents an annoying hack that we have to do. We use the
+ * `ReturnIndirectionInstruction` to determine which variables need flow back
+ * out of a function. However, the IR will unconditionally create those for a
+ * variable passed to a function even though the variable was never updated by
+ * the function. And if a function has too many `ReturnNode`s the dataflow
+ * library lowers its precision for that function by disabling field flow.
+ *
+ * So we those eliminate `ReturnNode`s that would have otherwise been created
+ * by this unconditional `ReturnIndirectionInstruction` by requiring that there
+ * must exist an SSA definition of the IR variable in the function.
+ */
+private predicate hasNonInitializeParameterDef(IRVariable v) {
+  exists(Ssa::Def def |
+    not def.getDefiningInstruction() instanceof InitializeParameterInstruction and
+    v = def.getSourceVariable().getBaseVariable().(Ssa::BaseIRVariable).getIRVariable()
+  )
 }
 
-class ReturnIndirectionNode extends ReturnNode {
-  override ReturnIndirectionInstruction primary;
-
+class ReturnIndirectionNode extends IndirectReturnNode, ReturnNode {
   override ReturnKind getKind() {
-    exists(int index |
-      primary.hasIndex(index) and
-      result = TIndirectReturnKind(index)
+    exists(int argumentIndex, ReturnIndirectionInstruction returnInd |
+      returnInd.hasIndex(argumentIndex) and
+      this.getAddressOperand() = returnInd.getSourceAddressOperand() and
+      result = TIndirectReturnKind(argumentIndex, this.getIndirectionIndex()) and
+      hasNonInitializeParameterDef(returnInd.getIRVariable())
     )
+    or
+    this.getAddressOperand() = any(ReturnValueInstruction r).getReturnAddressOperand() and
+    result = TNormalReturnKind(this.getIndirectionIndex() - 1)
   }
 }
 
+private Operand fullyConvertedCallStep(Operand op) {
+  not exists(getANonConversionUse(op)) and
+  exists(Instruction instr |
+    conversionFlow(op, instr, _) and
+    result = getAUse(instr)
+  )
+}
+
+/**
+ * Gets the instruction that uses this operand, if the instruction is not
+ * ignored for dataflow purposes.
+ */
+private Instruction getUse(Operand op) {
+  result = op.getUse() and
+  not Ssa::ignoreOperand(op)
+}
+
+/** Gets a use of the instruction `instr` that is not ignored for dataflow purposes. */
+Operand getAUse(Instruction instr) {
+  result = instr.getAUse() and
+  not Ssa::ignoreOperand(result)
+}
+
+/**
+ * Gets a use of `operand` that is:
+ * - not ignored for dataflow purposes, and
+ * - not a conversion-like instruction.
+ */
+private Instruction getANonConversionUse(Operand operand) {
+  result = getUse(operand) and
+  not conversionFlow(_, result, _)
+}
+
+/**
+ * Gets the operand that represents the first use of the value of `call` following
+ * a sequnce of conversion-like instructions.
+ */
+predicate operandForfullyConvertedCall(Operand operand, CallInstruction call) {
+  exists(getANonConversionUse(operand)) and
+  (
+    operand = getAUse(call)
+    or
+    operand = fullyConvertedCallStep*(getAUse(call))
+  )
+}
+
+/**
+ * Gets the instruction that represents the first use of the value of `call` following
+ * a sequnce of conversion-like instructions.
+ *
+ * This predicate only holds if there is no suitable operand (i.e., no operand of a non-
+ * conversion instruction) to use to represent the value of `call` after conversions.
+ */
+predicate instructionForfullyConvertedCall(Instruction instr, CallInstruction call) {
+  not operandForfullyConvertedCall(_, call) and
+  (
+    // If there is no use of the call then we pick the call instruction
+    not exists(getAUse(call)) and
+    instr = call
+    or
+    // Otherwise, flow to the first non-conversion use.
+    exists(Operand operand | operand = fullyConvertedCallStep*(getAUse(call)) |
+      instr = getANonConversionUse(operand)
+    )
+  )
+}
+
+/** Holds if `node` represents the output node for `call`. */
+private predicate simpleOutNode(Node node, CallInstruction call) {
+  operandForfullyConvertedCall(node.asOperand(), call)
+  or
+  instructionForfullyConvertedCall(node.asInstruction(), call)
+}
+
 /** A data flow node that represents the output of a call. */
-class OutNode extends InstructionNode {
+class OutNode extends Node {
   OutNode() {
-    instr instanceof CallInstruction or
-    instr instanceof WriteSideEffectInstruction
+    // Return values not hidden behind indirections
+    simpleOutNode(this, _)
+    or
+    // Return values hidden behind indirections
+    this instanceof IndirectReturnOutNode
+    or
+    // Modified arguments hidden behind indirections
+    this instanceof IndirectArgumentOutNode
   }
 
   /** Gets the underlying call. */
@@ -209,20 +299,28 @@ class OutNode extends InstructionNode {
   abstract ReturnKind getReturnKind();
 }
 
-private class CallOutNode extends OutNode {
-  override CallInstruction instr;
+private class DirectCallOutNode extends OutNode {
+  CallInstruction call;
 
-  override DataFlowCall getCall() { result = instr }
+  DirectCallOutNode() { simpleOutNode(this, call) }
 
-  override ReturnKind getReturnKind() { result instanceof NormalReturnKind }
+  override DataFlowCall getCall() { result = call }
+
+  override ReturnKind getReturnKind() { result = TNormalReturnKind(0) }
 }
 
-private class SideEffectOutNode extends OutNode {
-  override WriteSideEffectInstruction instr;
+private class IndirectCallOutNode extends OutNode, IndirectReturnOutNode {
+  override DataFlowCall getCall() { result = this.getCallInstruction() }
 
-  override DataFlowCall getCall() { result = instr.getPrimaryInstruction() }
+  override ReturnKind getReturnKind() { result = TNormalReturnKind(this.getIndirectionIndex()) }
+}
 
-  override ReturnKind getReturnKind() { result = TIndirectReturnKind(instr.getIndex()) }
+private class SideEffectOutNode extends OutNode, IndirectArgumentOutNode {
+  override DataFlowCall getCall() { result = this.getCallInstruction() }
+
+  override ReturnKind getReturnKind() {
+    result = TIndirectReturnKind(this.getArgumentIndex(), this.getIndirectionIndex())
+  }
 }
 
 /**
@@ -230,13 +328,8 @@ private class SideEffectOutNode extends OutNode {
  * `kind`.
  */
 OutNode getAnOutNode(DataFlowCall call, ReturnKind kind) {
-  // There should be only one `OutNode` for a given `(call, kind)` pair. Showing the optimizer that
-  // this is true helps it make better decisions downstream, especially in virtual dispatch.
-  result =
-    unique(OutNode outNode |
-      outNode.getCall() = call and
-      outNode.getReturnKind() = kind
-    )
+  result.getCall() = call and
+  result.getReturnKind() = kind
 }
 
 /**
@@ -245,7 +338,7 @@ OutNode getAnOutNode(DataFlowCall call, ReturnKind kind) {
  * global or static variable.
  */
 predicate jumpStep(Node n1, Node n2) {
-  exists(GlobalOrNamespaceVariable v |
+  exists(Cpp::GlobalOrNamespaceVariable v |
     v =
       n1.asInstruction()
           .(StoreInstruction)
@@ -269,24 +362,92 @@ predicate jumpStep(Node n1, Node n2) {
  * Thus, `node2` references an object with a field `f` that contains the
  * value of `node1`.
  */
-predicate storeStep(StoreNodeInstr node1, FieldContent f, StoreNodeInstr node2) {
-  exists(FieldAddressInstruction fai |
-    node1.getInstruction() = fai and
-    node2.getInstruction() = fai.getObjectAddress() and
-    f.getField() = fai.getField()
+predicate storeStep(Node node1, Content c, PostFieldUpdateNode node2) {
+  exists(int indirectionIndex1, int numberOfLoads, StoreInstruction store |
+    nodeHasInstruction(node1, store, pragma[only_bind_into](indirectionIndex1)) and
+    node2.getIndirectionIndex() = 1 and
+    numberOfLoadsFromOperand(node2.getFieldAddress(), store.getDestinationAddressOperand(),
+      numberOfLoads)
+  |
+    exists(FieldContent fc | fc = c |
+      fc.getField() = node2.getUpdatedField() and
+      fc.getIndirectionIndex() = 1 + indirectionIndex1 + numberOfLoads
+    )
+    or
+    exists(UnionContent uc | uc = c |
+      uc.getAField() = node2.getUpdatedField() and
+      uc.getIndirectionIndex() = 1 + indirectionIndex1 + numberOfLoads
+    )
   )
 }
 
+/**
+ * Holds if `operandFrom` flows to `operandTo` using a sequence of conversion-like
+ * operations and exactly `n` `LoadInstruction` operations.
+ */
+private predicate numberOfLoadsFromOperandRec(Operand operandFrom, Operand operandTo, int ind) {
+  exists(LoadInstruction load | load.getSourceAddressOperand() = operandFrom |
+    operandTo = operandFrom and ind = 0
+    or
+    numberOfLoadsFromOperand(load.getAUse(), operandTo, ind - 1)
+  )
+  or
+  exists(Operand op, Instruction instr |
+    instr = op.getDef() and
+    conversionFlow(operandFrom, instr, _) and
+    numberOfLoadsFromOperand(op, operandTo, ind)
+  )
+}
+
+/**
+ * Holds if `operandFrom` flows to `operandTo` using a sequence of conversion-like
+ * operations and exactly `n` `LoadInstruction` operations.
+ */
+private predicate numberOfLoadsFromOperand(Operand operandFrom, Operand operandTo, int n) {
+  numberOfLoadsFromOperandRec(operandFrom, operandTo, n)
+  or
+  not any(LoadInstruction load).getSourceAddressOperand() = operandFrom and
+  not conversionFlow(operandFrom, _, _) and
+  operandFrom = operandTo and
+  n = 0
+}
+
+// Needed to join on both an operand and an index at the same time.
+pragma[noinline]
+predicate nodeHasOperand(Node node, Operand operand, int indirectionIndex) {
+  node.asOperand() = operand and indirectionIndex = 0
+  or
+  hasOperandAndIndex(node, operand, indirectionIndex)
+}
+
+// Needed to join on both an instruction and an index at the same time.
+pragma[noinline]
+predicate nodeHasInstruction(Node node, Instruction instr, int indirectionIndex) {
+  node.asInstruction() = instr and indirectionIndex = 0
+  or
+  hasInstructionAndIndex(node, instr, indirectionIndex)
+}
+
 /**
  * Holds if data can flow from `node1` to `node2` via a read of `f`.
  * Thus, `node1` references an object with a field `f` whose value ends up in
  * `node2`.
  */
-predicate readStep(ReadNode node1, FieldContent f, ReadNode node2) {
-  exists(FieldAddressInstruction fai |
-    node1.getInstruction() = fai.getObjectAddress() and
-    node2.getInstruction() = fai and
-    f.getField() = fai.getField()
+predicate readStep(Node node1, Content c, Node node2) {
+  exists(FieldAddress fa1, Operand operand, int numberOfLoads, int indirectionIndex2 |
+    nodeHasOperand(node2, operand, indirectionIndex2) and
+    nodeHasOperand(node1, fa1.getObjectAddressOperand(), _) and
+    numberOfLoadsFromOperand(fa1, operand, numberOfLoads)
+  |
+    exists(FieldContent fc | fc = c |
+      fc.getField() = fa1.getField() and
+      fc.getIndirectionIndex() = indirectionIndex2 + numberOfLoads
+    )
+    or
+    exists(UnionContent uc | uc = c |
+      uc.getAField() = fa1.getField() and
+      uc.getIndirectionIndex() = indirectionIndex2 + numberOfLoads
+    )
   )
 }
 
@@ -304,20 +465,20 @@ predicate clearsContent(Node n, Content c) {
 predicate expectsContent(Node n, ContentSet c) { none() }
 
 /** Gets the type of `n` used for type pruning. */
-IRType getNodeType(Node n) {
+DataFlowType getNodeType(Node n) {
   suppressUnusedNode(n) and
-  result instanceof IRVoidType // stub implementation
+  result instanceof VoidType // stub implementation
 }
 
 /** Gets a string representation of a type returned by `getNodeType`. */
-string ppReprType(IRType t) { none() } // stub implementation
+string ppReprType(DataFlowType t) { none() } // stub implementation
 
 /**
  * Holds if `t1` and `t2` are compatible, that is, whether data can flow from
  * a node of type `t1` to a node of type `t2`.
  */
 pragma[inline]
-predicate compatibleTypes(IRType t1, IRType t2) {
+predicate compatibleTypes(DataFlowType t1, DataFlowType t2) {
   any() // stub implementation
 }
 
@@ -337,11 +498,11 @@ class CastNode extends Node {
  * data-flow library discards call contexts and inserts a node in the big-step
  * relation used for human-readable path explanations.
  */
-class DataFlowCallable = Declaration;
+class DataFlowCallable = Cpp::Declaration;
 
 class DataFlowExpr = Expr;
 
-class DataFlowType = IRType;
+class DataFlowType = Type;
 
 /** A function call relevant for data flow. */
 class DataFlowCall extends CallInstruction {
@@ -368,17 +529,7 @@ class Unit extends TUnit {
 }
 
 /** Holds if `n` should be hidden from path explanations. */
-predicate nodeIsHidden(Node n) {
-  n instanceof OperandNode and not n instanceof ArgumentNode
-  or
-  StoreNodeFlow::flowThrough(n, _) and
-  not StoreNodeFlow::flowOutOf(n, _) and
-  not StoreNodeFlow::flowInto(_, n)
-  or
-  ReadNodeFlow::flowThrough(n, _) and
-  not ReadNodeFlow::flowOutOf(n, _) and
-  not ReadNodeFlow::flowInto(_, n)
-}
+predicate nodeIsHidden(Node n) { n instanceof OperandNode and not n instanceof ArgumentNode }
 
 class LambdaCallKind = Unit;
 

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/ModelUtil.qll

@@ -5,41 +5,89 @@
 
 private import semmle.code.cpp.ir.IR
 private import semmle.code.cpp.ir.dataflow.DataFlow
+private import DataFlowUtil
+private import SsaInternals as Ssa
 
 /**
  * Gets the instruction that goes into `input` for `call`.
  */
-Operand callInput(CallInstruction call, FunctionInput input) {
+DataFlow::Node callInput(CallInstruction call, FunctionInput input) {
   // An argument or qualifier
   exists(int index |
-    result = call.getArgumentOperand(index) and
+    result.asOperand() = call.getArgumentOperand(index) and
     input.isParameterOrQualifierAddress(index)
   )
   or
   // A value pointed to by an argument or qualifier
-  exists(ReadSideEffectInstruction read |
-    result = read.getSideEffectOperand() and
-    read.getPrimaryInstruction() = call and
-    input.isParameterDerefOrQualifierObject(read.getIndex())
+  exists(int index, int indirectionIndex |
+    hasOperandAndIndex(result, call.getArgumentOperand(index), indirectionIndex) and
+    input.isParameterDerefOrQualifierObject(index, indirectionIndex)
+  )
+  or
+  exists(int ind |
+    result = getIndirectReturnOutNode(call, ind) and
+    input.isReturnValueDeref(ind)
   )
 }
 
 /**
  * Gets the instruction that holds the `output` for `call`.
  */
-Instruction callOutput(CallInstruction call, FunctionOutput output) {
+Node callOutput(CallInstruction call, FunctionOutput output) {
   // The return value
-  result = call and
+  result.asInstruction() = call and
   output.isReturnValue()
   or
   // The side effect of a call on the value pointed to by an argument or qualifier
-  exists(WriteSideEffectInstruction effect |
-    result = effect and
-    effect.getPrimaryInstruction() = call and
-    output.isParameterDerefOrQualifierObject(effect.getIndex())
+  exists(int index, int indirectionIndex |
+    result.(IndirectArgumentOutNode).getArgumentIndex() = index and
+    result.(IndirectArgumentOutNode).getIndirectionIndex() = indirectionIndex and
+    result.(IndirectArgumentOutNode).getCallInstruction() = call and
+    output.isParameterDerefOrQualifierObject(index, indirectionIndex)
   )
   or
-  // TODO: modify this when we get return value dereferences
-  result = call and
-  output.isReturnValueDeref()
+  exists(int ind |
+    result = getIndirectReturnOutNode(call, ind) and
+    output.isReturnValueDeref(ind)
+  )
+}
+
+DataFlow::Node callInput(CallInstruction call, FunctionInput input, int d) {
+  exists(DataFlow::Node n | n = callInput(call, input) and d > 0 |
+    // An argument or qualifier
+    hasOperandAndIndex(result, n.asOperand(), d)
+    or
+    exists(Operand operand, int indirectionIndex |
+      // A value pointed to by an argument or qualifier
+      hasOperandAndIndex(n, operand, indirectionIndex) and
+      hasOperandAndIndex(result, operand, indirectionIndex + d)
+    )
+  )
+}
+
+private IndirectReturnOutNode getIndirectReturnOutNode(CallInstruction call, int d) {
+  result.getCallInstruction() = call and
+  result.getIndirectionIndex() = d
+}
+
+/**
+ * Gets the instruction that holds the `output` for `call`.
+ */
+bindingset[d]
+Node callOutput(CallInstruction call, FunctionOutput output, int d) {
+  exists(DataFlow::Node n | n = callOutput(call, output) and d > 0 |
+    // The return value
+    result = getIndirectReturnOutNode(n.asInstruction(), d)
+    or
+    // If there isn't an indirect out node for the call with indirection `d` then
+    // we conflate this with the underlying `CallInstruction`.
+    not exists(getIndirectReturnOutNode(call, d)) and
+    n.asInstruction() = result.asInstruction()
+    or
+    // The side effect of a call on the value pointed to by an argument or qualifier
+    exists(Operand operand, int indirectionIndex |
+      Ssa::outNodeHasAddressAndIndex(n, operand, indirectionIndex) and
+      Ssa::outNodeHasAddressAndIndex(result, operand, indirectionIndex + d)
+    )
+  )
 }

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternalsCommon.qll

@@ -0,0 +1,270 @@
+import cpp as Cpp
+import semmle.code.cpp.ir.IR
+import semmle.code.cpp.ir.internal.IRCppLanguage
+private import semmle.code.cpp.ir.implementation.raw.internal.SideEffects as SideEffects
+private import DataFlowImplCommon as DataFlowImplCommon
+private import DataFlowUtil
+
+/**
+ * Holds if `operand` is an operand that is not used by the dataflow library.
+ * Ignored operands are not recognizd as uses by SSA, and they don't have a
+ * corresponding `(Indirect)OperandNode`.
+ */
+predicate ignoreOperand(Operand operand) {
+  operand = any(Instruction instr | ignoreInstruction(instr)).getAnOperand() or
+  operand = any(Instruction instr | ignoreInstruction(instr)).getAUse() or
+  operand instanceof MemoryOperand
+}
+
+/**
+ * Holds if `instr` is an instruction that is not used by the dataflow library.
+ * Ignored instructions are not recognized as reads/writes by SSA, and they
+ * don't have a corresponding `(Indirect)InstructionNode`.
+ */
+predicate ignoreInstruction(Instruction instr) {
+  DataFlowImplCommon::forceCachingInSameStage() and
+  (
+    instr instanceof WriteSideEffectInstruction or
+    instr instanceof PhiInstruction or
+    instr instanceof ReadSideEffectInstruction or
+    instr instanceof ChiInstruction or
+    instr instanceof InitializeIndirectionInstruction
+  )
+}
+
+/**
+ * Gets the C++ type of `this` in the member function `f`.
+ * The result is a glvalue if `isGLValue` is true, and
+ * a prvalue if `isGLValue` is false.
+ */
+bindingset[isGLValue]
+private CppType getThisType(Cpp::MemberFunction f, boolean isGLValue) {
+  result.hasType(f.getTypeOfThis(), isGLValue)
+}
+
+/**
+ * Gets the C++ type of the instruction `i`.
+ *
+ * This is equivalent to `i.getResultLanguageType()` with the exception
+ * of instructions that directly references a `this` IRVariable. In this
+ * case, `i.getResultLanguageType()` gives an unknown type, whereas the
+ * predicate gives the expected type (i.e., a potentially cv-qualified
+ * type `A*` where `A` is the declaring type of the member function that
+ * contains `i`).
+ */
+cached
+CppType getResultLanguageType(Instruction i) {
+  if i.(VariableAddressInstruction).getIRVariable() instanceof IRThisVariable
+  then
+    if i.isGLValue()
+    then result = getThisType(i.getEnclosingFunction(), true)
+    else result = getThisType(i.getEnclosingFunction(), false)
+  else result = i.getResultLanguageType()
+}
+
+/**
+ * Gets the C++ type of the operand `operand`.
+ * This is equivalent to the type of the operand's defining instruction.
+ *
+ * See `getResultLanguageType` for a description of this behavior.
+ */
+CppType getLanguageType(Operand operand) { result = getResultLanguageType(operand.getDef()) }
+
+/**
+ * Gets the maximum number of indirections a glvalue of type `type` can have.
+ * For example:
+ * - If `type = int`, the result is 1
+ * - If `type = MyStruct`, the result is 1
+ * - If `type = char*`, the result is 2
+ */
+int getMaxIndirectionsForType(Type type) {
+  result = countIndirectionsForCppType(getTypeForGLValue(type))
+}
+
+/**
+ * Gets the maximum number of indirections a value of type `type` can have.
+ *
+ * Note that this predicate is intended to be called on unspecified types
+ * (i.e., `countIndirections(e.getUnspecifiedType())`).
+ */
+private int countIndirections(Type t) {
+  result =
+    1 +
+      countIndirections([t.(Cpp::PointerType).getBaseType(), t.(Cpp::ReferenceType).getBaseType()])
+  or
+  not t instanceof Cpp::PointerType and
+  not t instanceof Cpp::ReferenceType and
+  result = 0
+}
+
+/**
+ * Gets the maximum number of indirections a value of C++
+ * type `langType` can have.
+ */
+int countIndirectionsForCppType(LanguageType langType) {
+  exists(Type type | langType.hasType(type, true) |
+    result = 1 + countIndirections(type.getUnspecifiedType())
+  )
+  or
+  exists(Type type | langType.hasType(type, false) |
+    result = countIndirections(type.getUnspecifiedType())
+  )
+}
+
+/**
+ * A `CallInstruction` that calls an allocation function such
+ * as `malloc` or `operator new`.
+ */
+class AllocationInstruction extends CallInstruction {
+  AllocationInstruction() { this.getStaticCallTarget() instanceof Cpp::AllocationFunction }
+}
+
+/**
+ * Holds if `i` is a base instruction that starts a sequence of uses
+ * of some variable that SSA can handle.
+ *
+ * This is either when `i` is a `VariableAddressInstruction` or when
+ * `i` is a fresh allocation produced by an `AllocationInstruction`.
+ */
+private predicate isSourceVariableBase(Instruction i) {
+  i instanceof VariableAddressInstruction or i instanceof AllocationInstruction
+}
+
+/**
+ * Holds if the value pointed to by `operand` can potentially be
+ * modified be the caller.
+ */
+predicate isModifiableByCall(ArgumentOperand operand) {
+  exists(CallInstruction call, int index, CppType type |
+    type = getLanguageType(operand) and
+    call.getArgumentOperand(index) = operand and
+    if index = -1
+    then not call.getStaticCallTarget() instanceof Cpp::ConstMemberFunction
+    else not SideEffects::isConstPointerLike(any(Type t | type.hasType(t, _)))
+  )
+}
+
+cached
+private module Cached {
+  /**
+   * Holds if `op` is a use of an SSA variable rooted at `base` with `ind` number
+   * of indirections.
+   *
+   * `certain` is `true` if the operand is guaranteed to read the variable, and
+   * `indirectionIndex` specifies the number of loads required to read the variable.
+   */
+  cached
+  predicate isUse(boolean certain, Operand op, Instruction base, int ind, int indirectionIndex) {
+    not ignoreOperand(op) and
+    certain = true and
+    exists(LanguageType type, int m, int ind0 |
+      type = getLanguageType(op) and
+      m = countIndirectionsForCppType(type) and
+      isUseImpl(op, base, ind0) and
+      ind = ind0 + [0 .. m] and
+      indirectionIndex = ind - ind0
+    )
+  }
+
+  /**
+   * Holds if `operand` is a use of an SSA variable rooted at `base`, and the
+   * path from `base` to `operand` passes through `ind` load-like instructions.
+   */
+  private predicate isUseImpl(Operand operand, Instruction base, int ind) {
+    DataFlowImplCommon::forceCachingInSameStage() and
+    ind = 0 and
+    operand.getDef() = base and
+    isSourceVariableBase(base)
+    or
+    exists(Operand mid, Instruction instr |
+      isUseImpl(mid, base, ind) and
+      instr = operand.getDef() and
+      conversionFlow(mid, instr, false)
+    )
+    or
+    exists(int ind0 |
+      isUseImpl(operand.getDef().(LoadInstruction).getSourceAddressOperand(), base, ind0)
+      or
+      isUseImpl(operand.getDef().(InitializeParameterInstruction).getAnOperand(), base, ind0)
+    |
+      ind0 = ind - 1
+    )
+  }
+
+  /**
+   * Holds if `address` is an address of an SSA variable rooted at `base`,
+   * and `instr` is a definition of the SSA variable with `ind` number of indirections.
+   *
+   * `certain` is `true` if `instr` is guaranteed to write to the variable, and
+   * `indirectionIndex` specifies the number of loads required to read the variable
+   * after the write operation.
+   */
+  cached
+  predicate isDef(
+    boolean certain, Instruction instr, Operand address, Instruction base, int ind,
+    int indirectionIndex
+  ) {
+    certain = true and
+    exists(int ind0, CppType type, int m |
+      address =
+        [
+          instr.(StoreInstruction).getDestinationAddressOperand(),
+          instr.(InitializeParameterInstruction).getAnOperand(),
+          instr.(InitializeDynamicAllocationInstruction).getAllocationAddressOperand(),
+          instr.(UninitializedInstruction).getAnOperand()
+        ]
+    |
+      isDefImpl(address, base, ind0) and
+      type = getLanguageType(address) and
+      m = countIndirectionsForCppType(type) and
+      ind = ind0 + [1 .. m] and
+      indirectionIndex = ind - (ind0 + 1)
+    )
+  }
+
+  /**
+   * Holds if `address` is a use of an SSA variable rooted at `base`, and the
+   * path from `base` to `address` passes through `ind` load-like instructions.
+   *
+   * Note: Unlike `isUseImpl`, this predicate recurses through pointer-arithmetic
+   * instructions.
+   */
+  private predicate isDefImpl(Operand address, Instruction base, int ind) {
+    DataFlowImplCommon::forceCachingInSameStage() and
+    ind = 0 and
+    address.getDef() = base and
+    isSourceVariableBase(base)
+    or
+    exists(Operand mid, Instruction instr |
+      isDefImpl(mid, base, ind) and
+      instr = address.getDef() and
+      conversionFlow(mid, instr, _)
+    )
+    or
+    exists(int ind0 |
+      isDefImpl(address.getDef().(LoadInstruction).getSourceAddressOperand(), base, ind0)
+      or
+      isDefImpl(address.getDef().(InitializeParameterInstruction).getAnOperand(), base, ind0)
+    |
+      ind0 = ind - 1
+    )
+  }
+}
+
+import Cached
+
+/**
+ * Inputs to the shared SSA library's parameterized module that is shared
+ * between the SSA pruning stage, and the final SSA stage.
+ */
+module InputSigCommon {
+  class BasicBlock = IRBlock;
+
+  BasicBlock getImmediateBasicBlockDominator(BasicBlock bb) { result.immediatelyDominates(bb) }
+
+  BasicBlock getABasicBlockSuccessor(BasicBlock bb) { result = bb.getASuccessor() }
+
+  class ExitBasicBlock extends IRBlock {
+    ExitBasicBlock() { this.getLastInstruction() instanceof ExitFunctionInstruction }
+  }
+}

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/TaintTrackingUtil.qll

@@ -3,6 +3,8 @@ private import semmle.code.cpp.ir.dataflow.DataFlow
 private import ModelUtil
 private import semmle.code.cpp.models.interfaces.DataFlow
 private import semmle.code.cpp.models.interfaces.SideEffect
+private import DataFlowUtil
+private import DataFlowPrivate
 
 /**
  * Holds if taint propagates from `nodeFrom` to `nodeTo` in exactly one local
@@ -23,26 +25,26 @@ cached
 predicate localAdditionalTaintStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
   operandToInstructionTaintStep(nodeFrom.asOperand(), nodeTo.asInstruction())
   or
-  instructionToOperandTaintStep(nodeFrom.asInstruction(), nodeTo.asOperand())
-}
-
-private predicate instructionToOperandTaintStep(Instruction fromInstr, Operand toOperand) {
-  // Propagate flow from the definition of an operand to the operand, even when the overlap is inexact.
-  // We only do this in certain cases:
-  // 1. The instruction's result must not be conflated, and
-  // 2. The instruction's result type is one the types where we expect element-to-object flow. Currently
-  // this is array types and union types. This matches the other two cases of element-to-object flow in
-  // `DefaultTaintTracking`.
-  toOperand.getAnyDef() = fromInstr and
-  not fromInstr.isResultConflated() and
-  (
-    fromInstr.getResultType() instanceof ArrayType or
-    fromInstr.getResultType() instanceof Union
+  modeledTaintStep(nodeFrom, nodeTo)
+  or
+  // Flow from `op` to `*op`.
+  exists(Operand operand, int indirectionIndex |
+    nodeHasOperand(nodeFrom, operand, indirectionIndex) and
+    nodeHasOperand(nodeTo, operand, indirectionIndex - 1)
   )
   or
-  exists(ReadSideEffectInstruction readInstr |
-    fromInstr = readInstr.getArgumentDef() and
-    toOperand = readInstr.getSideEffectOperand()
+  // Flow from `instr` to `*instr`.
+  exists(Instruction instr, int indirectionIndex |
+    nodeHasInstruction(nodeFrom, instr, indirectionIndex) and
+    nodeHasInstruction(nodeTo, instr, indirectionIndex - 1)
+  )
+  or
+  // Flow from (the indirection of) an operand of a pointer arithmetic instruction to the
+  // indirection of the pointer arithmetic instruction. This provides flow from `source`
+  // in `x[source]` to the result of the associated load instruction.
+  exists(PointerArithmeticInstruction pai, int indirectionIndex |
+    nodeHasOperand(nodeFrom, pai.getAnOperand(), pragma[only_bind_into](indirectionIndex)) and
+    hasInstructionAndIndex(nodeTo, pai, indirectionIndex + 1)
   )
 }
 
@@ -61,13 +63,13 @@ private predicate operandToInstructionTaintStep(Operand opFrom, Instruction inst
     instrTo instanceof BitwiseInstruction
     or
     instrTo instanceof PointerArithmeticInstruction
-    or
-    // The `CopyInstruction` case is also present in non-taint data flow, but
-    // that uses `getDef` rather than `getAnyDef`. For taint, we want flow
-    // from a definition of `myStruct` to a `myStruct.myField` expression.
-    instrTo instanceof CopyInstruction
   )
   or
+  // The `CopyInstruction` case is also present in non-taint data flow, but
+  // that uses `getDef` rather than `getAnyDef`. For taint, we want flow
+  // from a definition of `myStruct` to a `myStruct.myField` expression.
+  instrTo.(LoadInstruction).getSourceAddressOperand() = opFrom
+  or
   // Unary instructions tend to preserve enough information in practice that we
   // want taint to flow through.
   // The exception is `FieldAddressInstruction`. Together with the rules below for
@@ -81,40 +83,6 @@ private predicate operandToInstructionTaintStep(Operand opFrom, Instruction inst
     or
     instrTo.(FieldAddressInstruction).getField().getDeclaringType() instanceof Union
   )
-  or
-  // Flow from an element to an array or union that contains it.
-  instrTo.(ChiInstruction).getPartialOperand() = opFrom and
-  not instrTo.isResultConflated() and
-  exists(Type t | instrTo.getResultLanguageType().hasType(t, false) |
-    t instanceof Union
-    or
-    t instanceof ArrayType
-  )
-  or
-  // Until we have flow through indirections across calls, we'll take flow out
-  // of the indirection and into the argument.
-  // When we get proper flow through indirections across calls, this code can be
-  // moved to `adjusedSink` or possibly into the `DataFlow::ExprNode` class.
-  exists(ReadSideEffectInstruction read |
-    read.getSideEffectOperand() = opFrom and
-    read.getArgumentDef() = instrTo
-  )
-  or
-  // Until we have from through indirections across calls, we'll take flow out
-  // of the parameter and into its indirection.
-  // `InitializeIndirectionInstruction` only has a single operand: the address of the
-  // value whose indirection we are initializing. When initializing an indirection of a parameter `p`,
-  // the IR looks like this:
-  // ```
-  // m1 = InitializeParameter[p] : &r1
-  // r2 = Load[p] : r2, m1
-  // m3 = InitializeIndirection[p] : &r2
-  // ```
-  // So by having flow from `r2` to `m3` we're enabling flow from `m1` to `m3`. This relies on the
-  // `LoadOperand`'s overlap being exact.
-  instrTo.(InitializeIndirectionInstruction).getAnOperand() = opFrom
-  or
-  modeledTaintStep(opFrom, instrTo)
 }
 
 /**
@@ -164,24 +132,42 @@ predicate defaultImplicitTaintRead(DataFlow::Node node, DataFlow::Content c) { n
 predicate defaultTaintSanitizer(DataFlow::Node node) { none() }
 
 /**
- * Holds if taint can flow from `instrIn` to `instrOut` through a call to a
+ * Holds if taint can flow from `nodeIn` to `nodeOut` through a call to a
  * modeled function.
  */
-predicate modeledTaintStep(Operand nodeIn, Instruction nodeOut) {
+predicate modeledTaintStep(DataFlow::Node nodeIn, DataFlow::Node nodeOut) {
+  // Normal taint steps
   exists(CallInstruction call, TaintFunction func, FunctionInput modelIn, FunctionOutput modelOut |
+    call.getStaticCallTarget() = func and
+    func.hasTaintFlow(modelIn, modelOut)
+  |
     (
       nodeIn = callInput(call, modelIn)
       or
       exists(int n |
         modelIn.isParameterDerefOrQualifierObject(n) and
         if n = -1
-        then nodeIn = callInput(call, any(InQualifierObject inQualifier))
+        then nodeIn = callInput(call, any(InQualifierAddress inQualifier))
         else nodeIn = callInput(call, any(InParameter inParam | inParam.getIndex() = n))
       )
     ) and
-    nodeOut = callOutput(call, modelOut) and
-    call.getStaticCallTarget() = func and
-    func.hasTaintFlow(modelIn, modelOut)
+    nodeOut = callOutput(call, modelOut)
+    or
+    exists(int d |
+      nodeIn = callInput(call, modelIn, d)
+      or
+      exists(int n |
+        d = 1 and
+        modelIn.isParameterDerefOrQualifierObject(n) and
+        if n = -1
+        then nodeIn = callInput(call, any(InQualifierAddress inQualifier))
+        else nodeIn = callInput(call, any(InParameter inParam | inParam.getIndex() = n))
+      )
+    |
+      call.getStaticCallTarget() = func and
+      func.hasTaintFlow(modelIn, modelOut) and
+      nodeOut = callOutput(call, modelOut, d)
+    )
   )
   or
   // Taint flow from one argument to another and data flow from an argument to a
@@ -205,12 +191,11 @@ predicate modeledTaintStep(Operand nodeIn, Instruction nodeOut) {
   // Taint flow from a pointer argument to an output, when the model specifies flow from the deref
   // to that output, but the deref is not modeled in the IR for the caller.
   exists(
-    CallInstruction call, ReadSideEffectInstruction read, Function func, FunctionInput modelIn,
-    FunctionOutput modelOut
+    CallInstruction call, DataFlow::SideEffectOperandNode indirectArgument, Function func,
+    FunctionInput modelIn, FunctionOutput modelOut
   |
-    read.getSideEffectOperand() = callInput(call, modelIn) and
-    read.getArgumentDef() = nodeIn.getDef() and
-    not read.getSideEffect().isResultModeled() and
+    indirectArgument = callInput(call, modelIn) and
+    indirectArgument.getAddressOperand() = nodeIn.asOperand() and
     call.getStaticCallTarget() = func and
     (
       func.(DataFlowFunction).hasDataFlow(modelIn, modelOut)

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/ssa0/SsaInternals.qll

@@ -0,0 +1,314 @@
+/**
+ * This module defines an initial SSA pruning stage that doesn't take
+ * indirections into account.
+ */
+
+private import codeql.ssa.Ssa as SsaImplCommon
+private import semmle.code.cpp.ir.IR
+private import semmle.code.cpp.ir.dataflow.internal.DataFlowImplCommon as DataFlowImplCommon
+private import semmle.code.cpp.models.interfaces.Allocation as Alloc
+private import semmle.code.cpp.models.interfaces.DataFlow as DataFlow
+private import semmle.code.cpp.ir.implementation.raw.internal.SideEffects as SideEffects
+private import semmle.code.cpp.ir.internal.IRCppLanguage
+private import semmle.code.cpp.ir.dataflow.internal.DataFlowPrivate
+private import semmle.code.cpp.ir.dataflow.internal.DataFlowUtil
+private import semmle.code.cpp.ir.dataflow.internal.SsaInternalsCommon
+
+private module SourceVariables {
+  newtype TBaseSourceVariable =
+    // Each IR variable gets its own source variable
+    TBaseIRVariable(IRVariable var) or
+    // Each allocation gets its own source variable
+    TBaseCallVariable(AllocationInstruction call)
+
+  abstract class BaseSourceVariable extends TBaseSourceVariable {
+    abstract string toString();
+
+    abstract DataFlowType getType();
+  }
+
+  class BaseIRVariable extends BaseSourceVariable, TBaseIRVariable {
+    IRVariable var;
+
+    IRVariable getIRVariable() { result = var }
+
+    BaseIRVariable() { this = TBaseIRVariable(var) }
+
+    override string toString() { result = var.toString() }
+
+    override DataFlowType getType() { result = var.getType() }
+  }
+
+  class BaseCallVariable extends BaseSourceVariable, TBaseCallVariable {
+    AllocationInstruction call;
+
+    BaseCallVariable() { this = TBaseCallVariable(call) }
+
+    AllocationInstruction getCallInstruction() { result = call }
+
+    override string toString() { result = call.toString() }
+
+    override DataFlowType getType() { result = call.getResultType() }
+  }
+
+  private newtype TSourceVariable =
+    TSourceIRVariable(BaseIRVariable baseVar) or
+    TCallVariable(AllocationInstruction call)
+
+  abstract class SourceVariable extends TSourceVariable {
+    abstract string toString();
+
+    abstract BaseSourceVariable getBaseVariable();
+  }
+
+  class SourceIRVariable extends SourceVariable, TSourceIRVariable {
+    BaseIRVariable var;
+
+    SourceIRVariable() { this = TSourceIRVariable(var) }
+
+    IRVariable getIRVariable() { result = var.getIRVariable() }
+
+    override BaseIRVariable getBaseVariable() { result.getIRVariable() = this.getIRVariable() }
+
+    override string toString() { result = this.getIRVariable().toString() }
+  }
+
+  class CallVariable extends SourceVariable, TCallVariable {
+    AllocationInstruction call;
+
+    CallVariable() { this = TCallVariable(call) }
+
+    AllocationInstruction getCall() { result = call }
+
+    override BaseCallVariable getBaseVariable() { result.getCallInstruction() = call }
+
+    override string toString() { result = "Call" }
+  }
+}
+
+import SourceVariables
+
+private newtype TDefOrUseImpl =
+  TDefImpl(Operand address) { isDef(_, _, address, _, _, _) } or
+  TUseImpl(Operand operand) {
+    isUse(_, operand, _, _, _) and
+    not isDef(_, _, operand, _, _, _)
+  }
+
+abstract private class DefOrUseImpl extends TDefOrUseImpl {
+  /** Gets a textual representation of this element. */
+  abstract string toString();
+
+  /** Gets the block of this definition or use. */
+  abstract IRBlock getBlock();
+
+  /** Holds if this definition or use has index `index` in block `block`. */
+  abstract predicate hasIndexInBlock(IRBlock block, int index);
+
+  final predicate hasIndexInBlock(IRBlock block, int index, SourceVariable sv) {
+    this.hasIndexInBlock(block, index) and
+    sv = this.getSourceVariable()
+  }
+
+  /** Gets the location of this element. */
+  abstract Cpp::Location getLocation();
+
+  abstract Instruction getBase();
+
+  final BaseSourceVariable getBaseSourceVariable() {
+    exists(IRVariable var |
+      result.(BaseIRVariable).getIRVariable() = var and
+      instructionHasIRVariable(this.getBase(), var)
+    )
+    or
+    result.(BaseCallVariable).getCallInstruction() = this.getBase()
+  }
+
+  /** Gets the variable that is defined or used. */
+  final SourceVariable getSourceVariable() {
+    exists(BaseSourceVariable v |
+      sourceVariableHasBaseAndIndex(result, v) and
+      defOrUseHasSourceVariable(this, v)
+    )
+  }
+}
+
+pragma[noinline]
+private predicate instructionHasIRVariable(VariableAddressInstruction vai, IRVariable var) {
+  vai.getIRVariable() = var
+}
+
+private predicate defOrUseHasSourceVariable(DefOrUseImpl defOrUse, BaseSourceVariable bv) {
+  defHasSourceVariable(defOrUse, bv)
+  or
+  useHasSourceVariable(defOrUse, bv)
+}
+
+pragma[noinline]
+private predicate defHasSourceVariable(DefImpl def, BaseSourceVariable bv) {
+  bv = def.getBaseSourceVariable()
+}
+
+pragma[noinline]
+private predicate useHasSourceVariable(UseImpl use, BaseSourceVariable bv) {
+  bv = use.getBaseSourceVariable()
+}
+
+pragma[noinline]
+private predicate sourceVariableHasBaseAndIndex(SourceVariable v, BaseSourceVariable bv) {
+  v.getBaseVariable() = bv
+}
+
+class DefImpl extends DefOrUseImpl, TDefImpl {
+  Operand address;
+
+  DefImpl() { this = TDefImpl(address) }
+
+  override Instruction getBase() { isDef(_, _, address, result, _, _) }
+
+  Operand getAddressOperand() { result = address }
+
+  Instruction getDefiningInstruction() { isDef(_, result, address, _, _, _) }
+
+  override string toString() { result = address.toString() }
+
+  override IRBlock getBlock() { result = this.getDefiningInstruction().getBlock() }
+
+  override Cpp::Location getLocation() { result = this.getDefiningInstruction().getLocation() }
+
+  final override predicate hasIndexInBlock(IRBlock block, int index) {
+    this.getDefiningInstruction() = block.getInstruction(index)
+  }
+
+  predicate isCertain() { isDef(true, _, address, _, _, _) }
+}
+
+class UseImpl extends DefOrUseImpl, TUseImpl {
+  Operand operand;
+
+  UseImpl() { this = TUseImpl(operand) }
+
+  Operand getOperand() { result = operand }
+
+  override string toString() { result = operand.toString() }
+
+  final override predicate hasIndexInBlock(IRBlock block, int index) {
+    operand.getUse() = block.getInstruction(index)
+  }
+
+  final override IRBlock getBlock() { result = operand.getUse().getBlock() }
+
+  final override Cpp::Location getLocation() { result = operand.getLocation() }
+
+  override Instruction getBase() { isUse(_, operand, result, _, _) }
+
+  predicate isCertain() { isUse(true, operand, _, _, _) }
+}
+
+private module SsaInput implements SsaImplCommon::InputSig {
+  import InputSigCommon
+  import SourceVariables
+
+  /**
+   * Holds if the `i`'th write in block `bb` writes to the variable `v`.
+   * `certain` is `true` if the write is guaranteed to overwrite the entire variable.
+   */
+  predicate variableWrite(IRBlock bb, int i, SourceVariable v, boolean certain) {
+    DataFlowImplCommon::forceCachingInSameStage() and
+    exists(DefImpl def | def.hasIndexInBlock(bb, i, v) |
+      if def.isCertain() then certain = true else certain = false
+    )
+  }
+
+  /**
+   * Holds if the `i`'th read in block `bb` reads to the variable `v`.
+   * `certain` is `true` if the read is guaranteed.
+   */
+  predicate variableRead(IRBlock bb, int i, SourceVariable v, boolean certain) {
+    exists(UseImpl use | use.hasIndexInBlock(bb, i, v) |
+      if use.isCertain() then certain = true else certain = false
+    )
+  }
+}
+
+private newtype TSsaDefOrUse =
+  TDefOrUse(DefOrUseImpl defOrUse) {
+    defOrUse instanceof UseImpl
+    or
+    // If `defOrUse` is a definition we only include it if the
+    // SSA library concludes that it's live after the write.
+    exists(Definition def, SourceVariable sv, IRBlock bb, int i |
+      def.definesAt(sv, bb, i) and
+      defOrUse.(DefImpl).hasIndexInBlock(bb, i, sv)
+    )
+  } or
+  TPhi(PhiNode phi)
+
+abstract private class SsaDefOrUse extends TSsaDefOrUse {
+  string toString() { result = "SsaDefOrUse" }
+
+  DefOrUseImpl asDefOrUse() { none() }
+
+  PhiNode asPhi() { none() }
+
+  abstract Location getLocation();
+}
+
+class DefOrUse extends TDefOrUse, SsaDefOrUse {
+  DefOrUseImpl defOrUse;
+
+  DefOrUse() { this = TDefOrUse(defOrUse) }
+
+  final override DefOrUseImpl asDefOrUse() { result = defOrUse }
+
+  final override Location getLocation() { result = defOrUse.getLocation() }
+
+  final SourceVariable getSourceVariable() { result = defOrUse.getSourceVariable() }
+}
+
+class Phi extends TPhi, SsaDefOrUse {
+  PhiNode phi;
+
+  Phi() { this = TPhi(phi) }
+
+  final override PhiNode asPhi() { result = phi }
+
+  final override Location getLocation() { result = phi.getBasicBlock().getLocation() }
+}
+
+class UseOrPhi extends SsaDefOrUse {
+  UseOrPhi() {
+    this.asDefOrUse() instanceof UseImpl
+    or
+    this instanceof Phi
+  }
+
+  final override Location getLocation() {
+    result = this.asDefOrUse().getLocation() or result = this.(Phi).getLocation()
+  }
+
+  override string toString() {
+    result = this.asDefOrUse().toString()
+    or
+    this instanceof Phi and
+    result = "Phi"
+  }
+}
+
+class Def extends DefOrUse {
+  override DefImpl defOrUse;
+
+  Operand getAddressOperand() { result = defOrUse.getAddressOperand() }
+
+  Instruction getAddress() { result = this.getAddressOperand().getDef() }
+
+  Instruction getDefiningInstruction() { result = defOrUse.getDefiningInstruction() }
+
+  override string toString() { result = this.asDefOrUse().toString() + " (def)" }
+}
+
+private module SsaImpl = SsaImplCommon::Make<SsaInput>;
+
+class PhiNode = SsaImpl::PhiNode;
+
+class Definition = SsaImpl::Definition;

cpp/ql/test/TestUtilities/dataflow/FlowTestCommon.qll

@@ -13,7 +13,6 @@
 
 import cpp
 private import semmle.code.cpp.ir.dataflow.DataFlow::DataFlow as IRDataFlow
-private import semmle.code.cpp.dataflow.DataFlow::DataFlow as AstDataFlow
 import TestUtilities.InlineExpectationsTest
 
 class IRFlowTest extends InlineExpectationsTest {
@@ -41,34 +40,3 @@ class IRFlowTest extends InlineExpectationsTest {
     )
   }
 }
-
-class AstFlowTest extends InlineExpectationsTest {
-  AstFlowTest() { this = "ASTFlowTest" }
-
-  override string getARelevantTag() { result = "ast" }
-
-  override predicate hasActualResult(Location location, string element, string tag, string value) {
-    exists(
-      AstDataFlow::Node source, AstDataFlow::Node sink, AstDataFlow::Configuration conf, int n
-    |
-      tag = "ast" and
-      conf.hasFlow(source, sink) and
-      n = strictcount(AstDataFlow::Node otherSource | conf.hasFlow(otherSource, sink)) and
-      (
-        n = 1 and value = ""
-        or
-        // If there is more than one source for this sink
-        // we specify the source location explicitly.
-        n > 1 and
-        value =
-          source.getLocation().getStartLine().toString() + ":" +
-            source.getLocation().getStartColumn()
-      ) and
-      location = sink.getLocation() and
-      element = sink.toString()
-    )
-  }
-}
-
-/** DEPRECATED: Alias for AstFlowTest */
-deprecated class ASTFlowTest = AstFlowTest;

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-020/NoCheckBeforeUnsafePutUser/NoCheckBeforeUnsafePutUser.expected

@@ -1,3 +0,0 @@
-| test.cpp:20:21:20:22 | ref arg & ... | This 'unsafe_put_user' writes a user-mode pointer without a security check. |
-| test.cpp:41:21:41:22 | ref arg & ... | This 'unsafe_put_user' writes a user-mode pointer without a security check. |
-| test.cpp:69:21:69:27 | ref arg & ... | This 'unsafe_put_user' writes a user-mode pointer without a security check. |

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/AllocMultiplicationOverflow/AllocMultiplicationOverflow.expected

@@ -1,9 +1,20 @@
 edges
+| test.cpp:13:33:13:37 | ... * ... | test.cpp:13:33:13:37 | ... * ... |
+| test.cpp:15:31:15:35 | ... * ... | test.cpp:15:31:15:35 | (unsigned long)... |
+| test.cpp:19:34:19:38 | ... * ... | test.cpp:19:34:19:38 | ... * ... |
+| test.cpp:22:17:22:21 | (size_t)... | test.cpp:23:33:23:37 | size1 |
 | test.cpp:22:17:22:21 | ... * ... | test.cpp:23:33:23:37 | size1 |
 nodes
 | test.cpp:13:33:13:37 | ... * ... | semmle.label | ... * ... |
+| test.cpp:13:33:13:37 | ... * ... | semmle.label | ... * ... |
+| test.cpp:13:33:13:37 | ... * ... | semmle.label | ... * ... |
+| test.cpp:15:31:15:35 | (unsigned long)... | semmle.label | (unsigned long)... |
+| test.cpp:15:31:15:35 | ... * ... | semmle.label | ... * ... |
 | test.cpp:15:31:15:35 | ... * ... | semmle.label | ... * ... |
 | test.cpp:19:34:19:38 | ... * ... | semmle.label | ... * ... |
+| test.cpp:19:34:19:38 | ... * ... | semmle.label | ... * ... |
+| test.cpp:19:34:19:38 | ... * ... | semmle.label | ... * ... |
+| test.cpp:22:17:22:21 | (size_t)... | semmle.label | (size_t)... |
 | test.cpp:22:17:22:21 | ... * ... | semmle.label | ... * ... |
 | test.cpp:23:33:23:37 | size1 | semmle.label | size1 |
 | test.cpp:30:27:30:31 | ... * ... | semmle.label | ... * ... |
@@ -11,8 +22,15 @@ nodes
 subpaths
 #select
 | test.cpp:13:33:13:37 | ... * ... | test.cpp:13:33:13:37 | ... * ... | test.cpp:13:33:13:37 | ... * ... | Potentially overflowing value from $@ is used in the size of this allocation. | test.cpp:13:33:13:37 | ... * ... | multiplication |
+| test.cpp:13:33:13:37 | ... * ... | test.cpp:13:33:13:37 | ... * ... | test.cpp:13:33:13:37 | ... * ... | Potentially overflowing value from $@ is used in the size of this allocation. | test.cpp:13:33:13:37 | ... * ... | multiplication |
+| test.cpp:13:33:13:37 | ... * ... | test.cpp:13:33:13:37 | ... * ... | test.cpp:13:33:13:37 | ... * ... | Potentially overflowing value from $@ is used in the size of this allocation. | test.cpp:13:33:13:37 | ... * ... | multiplication |
+| test.cpp:15:31:15:35 | (unsigned long)... | test.cpp:15:31:15:35 | (unsigned long)... | test.cpp:15:31:15:35 | (unsigned long)... | Potentially overflowing value from $@ is used in the size of this allocation. | test.cpp:15:31:15:35 | (unsigned long)... | multiplication |
+| test.cpp:15:31:15:35 | (unsigned long)... | test.cpp:15:31:15:35 | ... * ... | test.cpp:15:31:15:35 | (unsigned long)... | Potentially overflowing value from $@ is used in the size of this allocation. | test.cpp:15:31:15:35 | ... * ... | multiplication |
 | test.cpp:15:31:15:35 | ... * ... | test.cpp:15:31:15:35 | ... * ... | test.cpp:15:31:15:35 | ... * ... | Potentially overflowing value from $@ is used in the size of this allocation. | test.cpp:15:31:15:35 | ... * ... | multiplication |
 | test.cpp:19:34:19:38 | ... * ... | test.cpp:19:34:19:38 | ... * ... | test.cpp:19:34:19:38 | ... * ... | Potentially overflowing value from $@ is used in the size of this allocation. | test.cpp:19:34:19:38 | ... * ... | multiplication |
+| test.cpp:19:34:19:38 | ... * ... | test.cpp:19:34:19:38 | ... * ... | test.cpp:19:34:19:38 | ... * ... | Potentially overflowing value from $@ is used in the size of this allocation. | test.cpp:19:34:19:38 | ... * ... | multiplication |
+| test.cpp:19:34:19:38 | ... * ... | test.cpp:19:34:19:38 | ... * ... | test.cpp:19:34:19:38 | ... * ... | Potentially overflowing value from $@ is used in the size of this allocation. | test.cpp:19:34:19:38 | ... * ... | multiplication |
+| test.cpp:23:33:23:37 | size1 | test.cpp:22:17:22:21 | (size_t)... | test.cpp:23:33:23:37 | size1 | Potentially overflowing value from $@ is used in the size of this allocation. | test.cpp:22:17:22:21 | (size_t)... | multiplication |
 | test.cpp:23:33:23:37 | size1 | test.cpp:22:17:22:21 | ... * ... | test.cpp:23:33:23:37 | size1 | Potentially overflowing value from $@ is used in the size of this allocation. | test.cpp:22:17:22:21 | ... * ... | multiplication |
 | test.cpp:30:27:30:31 | ... * ... | test.cpp:30:27:30:31 | ... * ... | test.cpp:30:27:30:31 | ... * ... | Potentially overflowing value from $@ is used in the size of this allocation. | test.cpp:30:27:30:31 | ... * ... | multiplication |
 | test.cpp:31:27:31:31 | ... * ... | test.cpp:31:27:31:31 | ... * ... | test.cpp:31:27:31:31 | ... * ... | Potentially overflowing value from $@ is used in the size of this allocation. | test.cpp:31:27:31:31 | ... * ... | multiplication |

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-359/semmle/tests/PrivateCleartextWrite.expected

@@ -1,27 +1,60 @@
 edges
-| test.cpp:45:18:45:23 | buffer | test.cpp:47:10:47:15 | buffer |
+| test.cpp:57:9:57:18 | theZipcode | test.cpp:57:9:57:18 | theZipcode |
+| test.cpp:74:24:74:30 | medical | test.cpp:78:24:78:27 | temp |
+| test.cpp:74:24:74:30 | medical | test.cpp:81:22:81:28 | medical |
 | test.cpp:77:16:77:22 | medical | test.cpp:78:24:78:27 | temp |
-| test.cpp:81:17:81:20 | call to func | test.cpp:82:24:82:28 | buff5 |
-| test.cpp:81:22:81:28 | medical | test.cpp:45:18:45:23 | buffer |
-| test.cpp:81:22:81:28 | medical | test.cpp:81:17:81:20 | call to func |
+| test.cpp:77:16:77:22 | medical | test.cpp:81:22:81:28 | medical |
+| test.cpp:81:22:81:28 | medical | test.cpp:82:24:82:28 | buff5 |
+| test.cpp:96:37:96:46 | theZipcode | test.cpp:96:37:96:46 | theZipcode |
+| test.cpp:96:37:96:46 | theZipcode | test.cpp:96:37:96:46 | theZipcode |
+| test.cpp:96:37:96:46 | theZipcode | test.cpp:99:42:99:51 | theZipcode |
+| test.cpp:96:37:96:46 | theZipcode | test.cpp:99:42:99:51 | theZipcode |
+| test.cpp:96:37:96:46 | theZipcode | test.cpp:99:42:99:51 | theZipcode |
+| test.cpp:96:37:96:46 | theZipcode | test.cpp:99:42:99:51 | theZipcode |
+| test.cpp:96:37:96:46 | theZipcode | test.cpp:99:42:99:51 | theZipcode |
+| test.cpp:96:37:96:46 | theZipcode | test.cpp:99:42:99:51 | theZipcode |
+| test.cpp:99:42:99:51 | theZipcode | test.cpp:99:42:99:51 | theZipcode |
+| test.cpp:99:61:99:70 | theZipcode | test.cpp:99:42:99:51 | theZipcode |
+| test.cpp:99:61:99:70 | theZipcode | test.cpp:99:42:99:51 | theZipcode |
 nodes
-| test.cpp:45:18:45:23 | buffer | semmle.label | buffer |
-| test.cpp:47:10:47:15 | buffer | semmle.label | buffer |
 | test.cpp:57:9:57:18 | theZipcode | semmle.label | theZipcode |
+| test.cpp:57:9:57:18 | theZipcode | semmle.label | theZipcode |
+| test.cpp:57:9:57:18 | theZipcode | semmle.label | theZipcode |
+| test.cpp:74:24:74:30 | medical | semmle.label | medical |
 | test.cpp:74:24:74:30 | medical | semmle.label | medical |
 | test.cpp:77:16:77:22 | medical | semmle.label | medical |
 | test.cpp:78:24:78:27 | temp | semmle.label | temp |
-| test.cpp:81:17:81:20 | call to func | semmle.label | call to func |
 | test.cpp:81:22:81:28 | medical | semmle.label | medical |
 | test.cpp:82:24:82:28 | buff5 | semmle.label | buff5 |
 | test.cpp:96:37:96:46 | theZipcode | semmle.label | theZipcode |
+| test.cpp:96:37:96:46 | theZipcode | semmle.label | theZipcode |
+| test.cpp:96:37:96:46 | theZipcode | semmle.label | theZipcode |
+| test.cpp:96:37:96:46 | theZipcode | semmle.label | theZipcode |
 | test.cpp:99:42:99:51 | theZipcode | semmle.label | theZipcode |
+| test.cpp:99:42:99:51 | theZipcode | semmle.label | theZipcode |
+| test.cpp:99:42:99:51 | theZipcode | semmle.label | theZipcode |
+| test.cpp:99:61:99:70 | theZipcode | semmle.label | theZipcode |
+| test.cpp:99:61:99:70 | theZipcode | semmle.label | theZipcode |
 subpaths
-| test.cpp:81:22:81:28 | medical | test.cpp:45:18:45:23 | buffer | test.cpp:47:10:47:15 | buffer | test.cpp:81:17:81:20 | call to func |
 #select
 | test.cpp:57:9:57:18 | theZipcode | test.cpp:57:9:57:18 | theZipcode | test.cpp:57:9:57:18 | theZipcode | This write into the external location 'theZipcode' may contain unencrypted data from $@. | test.cpp:57:9:57:18 | theZipcode | this source of private data. |
+| test.cpp:57:9:57:18 | theZipcode | test.cpp:57:9:57:18 | theZipcode | test.cpp:57:9:57:18 | theZipcode | This write into the external location 'theZipcode' may contain unencrypted data from $@. | test.cpp:57:9:57:18 | theZipcode | this source of private data. |
+| test.cpp:57:9:57:18 | theZipcode | test.cpp:57:9:57:18 | theZipcode | test.cpp:57:9:57:18 | theZipcode | This write into the external location 'theZipcode' may contain unencrypted data from $@. | test.cpp:57:9:57:18 | theZipcode | this source of private data. |
 | test.cpp:74:24:74:30 | medical | test.cpp:74:24:74:30 | medical | test.cpp:74:24:74:30 | medical | This write into the external location 'medical' may contain unencrypted data from $@. | test.cpp:74:24:74:30 | medical | this source of private data. |
+| test.cpp:78:24:78:27 | temp | test.cpp:74:24:74:30 | medical | test.cpp:78:24:78:27 | temp | This write into the external location 'temp' may contain unencrypted data from $@. | test.cpp:74:24:74:30 | medical | this source of private data. |
 | test.cpp:78:24:78:27 | temp | test.cpp:77:16:77:22 | medical | test.cpp:78:24:78:27 | temp | This write into the external location 'temp' may contain unencrypted data from $@. | test.cpp:77:16:77:22 | medical | this source of private data. |
+| test.cpp:82:24:82:28 | buff5 | test.cpp:74:24:74:30 | medical | test.cpp:82:24:82:28 | buff5 | This write into the external location 'buff5' may contain unencrypted data from $@. | test.cpp:74:24:74:30 | medical | this source of private data. |
+| test.cpp:82:24:82:28 | buff5 | test.cpp:77:16:77:22 | medical | test.cpp:82:24:82:28 | buff5 | This write into the external location 'buff5' may contain unencrypted data from $@. | test.cpp:77:16:77:22 | medical | this source of private data. |
 | test.cpp:82:24:82:28 | buff5 | test.cpp:81:22:81:28 | medical | test.cpp:82:24:82:28 | buff5 | This write into the external location 'buff5' may contain unencrypted data from $@. | test.cpp:81:22:81:28 | medical | this source of private data. |
 | test.cpp:96:37:96:46 | theZipcode | test.cpp:96:37:96:46 | theZipcode | test.cpp:96:37:96:46 | theZipcode | This write into the external location 'theZipcode' may contain unencrypted data from $@. | test.cpp:96:37:96:46 | theZipcode | this source of private data. |
+| test.cpp:96:37:96:46 | theZipcode | test.cpp:96:37:96:46 | theZipcode | test.cpp:96:37:96:46 | theZipcode | This write into the external location 'theZipcode' may contain unencrypted data from $@. | test.cpp:96:37:96:46 | theZipcode | this source of private data. |
+| test.cpp:96:37:96:46 | theZipcode | test.cpp:96:37:96:46 | theZipcode | test.cpp:96:37:96:46 | theZipcode | This write into the external location 'theZipcode' may contain unencrypted data from $@. | test.cpp:96:37:96:46 | theZipcode | this source of private data. |
+| test.cpp:99:42:99:51 | theZipcode | test.cpp:96:37:96:46 | theZipcode | test.cpp:99:42:99:51 | theZipcode | This write into the external location 'theZipcode' may contain unencrypted data from $@. | test.cpp:96:37:96:46 | theZipcode | this source of private data. |
+| test.cpp:99:42:99:51 | theZipcode | test.cpp:96:37:96:46 | theZipcode | test.cpp:99:42:99:51 | theZipcode | This write into the external location 'theZipcode' may contain unencrypted data from $@. | test.cpp:96:37:96:46 | theZipcode | this source of private data. |
+| test.cpp:99:42:99:51 | theZipcode | test.cpp:96:37:96:46 | theZipcode | test.cpp:99:42:99:51 | theZipcode | This write into the external location 'theZipcode' may contain unencrypted data from $@. | test.cpp:96:37:96:46 | theZipcode | this source of private data. |
+| test.cpp:99:42:99:51 | theZipcode | test.cpp:96:37:96:46 | theZipcode | test.cpp:99:42:99:51 | theZipcode | This write into the external location 'theZipcode' may contain unencrypted data from $@. | test.cpp:96:37:96:46 | theZipcode | this source of private data. |
 | test.cpp:99:42:99:51 | theZipcode | test.cpp:99:42:99:51 | theZipcode | test.cpp:99:42:99:51 | theZipcode | This write into the external location 'theZipcode' may contain unencrypted data from $@. | test.cpp:99:42:99:51 | theZipcode | this source of private data. |
+| test.cpp:99:42:99:51 | theZipcode | test.cpp:99:42:99:51 | theZipcode | test.cpp:99:42:99:51 | theZipcode | This write into the external location 'theZipcode' may contain unencrypted data from $@. | test.cpp:99:42:99:51 | theZipcode | this source of private data. |
+| test.cpp:99:42:99:51 | theZipcode | test.cpp:99:42:99:51 | theZipcode | test.cpp:99:42:99:51 | theZipcode | This write into the external location 'theZipcode' may contain unencrypted data from $@. | test.cpp:99:42:99:51 | theZipcode | this source of private data. |
+| test.cpp:99:42:99:51 | theZipcode | test.cpp:99:61:99:70 | theZipcode | test.cpp:99:42:99:51 | theZipcode | This write into the external location 'theZipcode' may contain unencrypted data from $@. | test.cpp:99:61:99:70 | theZipcode | this source of private data. |
+| test.cpp:99:42:99:51 | theZipcode | test.cpp:99:61:99:70 | theZipcode | test.cpp:99:42:99:51 | theZipcode | This write into the external location 'theZipcode' may contain unencrypted data from $@. | test.cpp:99:61:99:70 | theZipcode | this source of private data. |

cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/annotate_path_to_sink/test_diff.cpp

@@ -101,7 +101,7 @@ int main(int argc, char *argv[]) {
 
     calls_sink_with_argv(*p[i]); // $ ir-path=96:26 ir-path=98:18 MISSING:ast
 
-    sink(*(argv + 1)); // $ ast ir-path ir-sink
+    sink(*(argv + 1)); // $ ast ir-path ir-sink=96:26 ir-sink=98:18 ir-sink=104:12
 
     BaseWithPureVirtual* b = new DerivedCallsSink;
 

cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/annotate_sinks_only/defaulttainttracking.cpp

@@ -233,7 +233,7 @@ void test_recv() {
 int send(int, const void*, int, int);
 
 void test_send(char* buffer, int length) {
-  send(0, buffer, length, 0); // $ remote
+  send(0, buffer, length, 0); // $ MISSING: remote
 }
 
 struct iovec {
@@ -257,5 +257,5 @@ int test_readv_and_writev(iovec* iovs) {
   sink(p); // $ MISSING: ast,ir
   sink(*p); // $ MISSING: ast,ir
 
-  writev(0, iovs, 16); // $ remote
+  writev(0, iovs, 16); // $ MISSING: remote
 }

cpp/ql/test/library-tests/dataflow/additional-flow-to-parameter/standardFlow.ql

@@ -1,5 +1,5 @@
 import cpp
-import semmle.code.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.old.DataFlow
 
 class TestConfig extends DataFlow::Configuration {
   TestConfig() { this = "TestConfig" }

cpp/ql/test/library-tests/dataflow/dataflow-edge-tests/additionalEdges.ql

@@ -1,5 +1,5 @@
 import cpp
-import semmle.code.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.old.DataFlow
 
 class EdgeToExcept extends AdditionalControlFlowEdge {
   EdgeToExcept() {

cpp/ql/test/library-tests/dataflow/dataflow-edge-tests/standardEdges.ql

@@ -1,5 +1,5 @@
 import cpp
-import semmle.code.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.old.DataFlow
 
 from DataFlow::Node nodeFrom, DataFlow::Node nodeTo
 where DataFlow::localFlowStep(nodeFrom, nodeTo)

cpp/ql/test/library-tests/dataflow/dataflow-tests/BarrierGuard.cpp

@@ -4,7 +4,7 @@ bool guarded(int);
 
 void bg_basic(int source) {
   if (guarded(source)) {
-    sink(source); // no flow
+    sink(source); // $ SPURIOUS: ir
   } else {
     sink(source); // $ ast,ir
   }
@@ -14,13 +14,13 @@ void bg_not(int source) {
   if (!guarded(source)) {
     sink(source); // $ ast,ir
   } else {
-    sink(source); // no flow
+    sink(source); // $ SPURIOUS: ir
   }
 }
 
 void bg_and(int source, bool arbitrary) {
   if (guarded(source) && arbitrary) {
-    sink(source); // no flow
+    sink(source); // $ SPURIOUS: ir
   } else {
     sink(source); // $ ast,ir
   }
@@ -38,7 +38,7 @@ void bg_return(int source) {
   if (!guarded(source)) {
     return;
   }
-  sink(source); // no flow
+  sink(source); // $ SPURIOUS: ir
 }
 
 struct XY {
@@ -48,7 +48,7 @@ struct XY {
 void bg_stackstruct(XY s1, XY s2) {
   s1.x = source();
   if (guarded(s1.x)) {
-    sink(s1.x); // $ SPURIOUS: ast
+    sink(s1.x); // $ SPURIOUS: ast,ir
   } else if (guarded(s1.y)) {
     sink(s1.x); // $ ast,ir
   } else if (guarded(s2.y)) {
@@ -59,7 +59,7 @@ void bg_stackstruct(XY s1, XY s2) {
 void bg_structptr(XY *p1, XY *p2) {
   p1->x = source();
   if (guarded(p1->x)) {
-    sink(p1->x); // $ SPURIOUS: ast
+    sink(p1->x); // $ SPURIOUS: ast,ir
   } else if (guarded(p1->y)) {
     sink(p1->x); // $ ast,ir
   } else if (guarded(p2->x)) {

cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-consistency.ql

@@ -1 +1 @@
-import semmle.code.cpp.dataflow.internal.DataFlowImplConsistency::Consistency
+import semmle.code.cpp.dataflow.old.internal.DataFlowImplConsistency::Consistency

cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-ir-consistency.expected

@@ -1,4 +1,8 @@
 uniqueEnclosingCallable
+| globals.cpp:9:5:9:19 | VariableAddress indirection | Node should have one enclosing callable but has 0. |
+| globals.cpp:9:5:9:19 | VariableAddress indirection | Node should have one enclosing callable but has 0. |
+| globals.cpp:16:12:16:26 | VariableAddress indirection | Node should have one enclosing callable but has 0. |
+| globals.cpp:16:12:16:26 | VariableAddress indirection | Node should have one enclosing callable but has 0. |
 uniqueType
 uniqueNodeLocation
 | BarrierGuard.cpp:2:11:2:13 | (unnamed parameter 0) | Node should have one location but has 6. |
@@ -29,602 +33,14 @@ postHasUniquePre
 uniquePostUpdate
 postIsInSameCallable
 reverseRead
+| dispatch.cpp:168:3:168:4 | Unary | Origin of readStep is missing a PostUpdateNode. |
+| dispatch.cpp:173:37:173:38 | Unary | Origin of readStep is missing a PostUpdateNode. |
+| dispatch.cpp:174:37:174:38 | Unary | Origin of readStep is missing a PostUpdateNode. |
+| test.cpp:481:21:481:21 | Unary | Origin of readStep is missing a PostUpdateNode. |
 argHasPostUpdate
 postWithInFlow
-| BarrierGuard.cpp:49:6:49:6 | x [post update] | PostUpdateNode should not be the target of local flow. |
-| BarrierGuard.cpp:60:3:60:4 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| BarrierGuard.cpp:60:7:60:7 | x [post update] | PostUpdateNode should not be the target of local flow. |
-| clang.cpp:8:20:8:29 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| clang.cpp:22:8:22:20 | & ... [post update] | PostUpdateNode should not be the target of local flow. |
-| clang.cpp:22:8:22:20 | & ... [post update] | PostUpdateNode should not be the target of local flow. |
-| clang.cpp:22:9:22:20 | sourceArray1 [post update] | PostUpdateNode should not be the target of local flow. |
-| clang.cpp:26:8:26:24 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| clang.cpp:26:8:26:24 | sourceStruct1_ptr [post update] | PostUpdateNode should not be the target of local flow. |
-| clang.cpp:26:8:26:24 | sourceStruct1_ptr [post update] | PostUpdateNode should not be the target of local flow. |
-| clang.cpp:28:3:28:19 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| clang.cpp:28:22:28:23 | m1 [post update] | PostUpdateNode should not be the target of local flow. |
-| clang.cpp:30:8:30:24 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| clang.cpp:30:8:30:24 | sourceStruct1_ptr [post update] | PostUpdateNode should not be the target of local flow. |
-| clang.cpp:30:8:30:24 | sourceStruct1_ptr [post update] | PostUpdateNode should not be the target of local flow. |
-| clang.cpp:34:19:34:41 | FieldAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| clang.cpp:34:19:34:41 | FieldAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| clang.cpp:39:16:39:21 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| clang.cpp:39:30:39:51 | FieldAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| clang.cpp:39:30:39:51 | FieldAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| clang.cpp:43:26:43:53 | FieldAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| clang.cpp:43:26:43:53 | FieldAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| clang.cpp:49:7:49:16 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| clang.cpp:49:22:49:44 | PointerAdd [post update] | PostUpdateNode should not be the target of local flow. |
-| clang.cpp:49:22:49:44 | PointerAdd [post update] | PostUpdateNode should not be the target of local flow. |
-| clang.cpp:50:3:50:12 | array to pointer conversion [post update] | PostUpdateNode should not be the target of local flow. |
-| clang.cpp:50:3:50:12 | stackArray [post update] | PostUpdateNode should not be the target of local flow. |
-| clang.cpp:50:3:50:15 | access to array [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:6:29:6:37 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:7:29:7:37 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:9:30:9:45 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:10:30:10:45 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:15:8:15:8 | Argument this [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:15:8:15:8 | ConvertToNonVirtualBase [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:15:8:15:8 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:16:30:16:45 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:17:31:17:39 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:21:8:21:8 | Argument this [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:21:8:21:8 | ConvertToNonVirtualBase [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:21:8:21:8 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:22:30:22:45 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:24:31:24:39 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:29:8:29:13 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:29:29:29:34 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:31:8:31:13 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:31:8:31:13 | topPtr [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:31:8:31:13 | topPtr [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:32:8:32:13 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:32:8:32:13 | topPtr [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:32:8:32:13 | topPtr [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:33:3:33:8 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:33:3:33:8 | topPtr [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:33:3:33:8 | topPtr [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:35:8:35:13 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:35:8:35:13 | topPtr [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:35:8:35:13 | topPtr [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:36:8:36:13 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:36:8:36:13 | topPtr [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:36:8:36:13 | topPtr [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:37:3:37:8 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:37:3:37:8 | topPtr [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:37:3:37:8 | topPtr [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:39:8:39:13 | (reference dereference) [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:39:8:39:13 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:39:8:39:13 | topRef [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:39:8:39:13 | topRef [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:40:8:40:13 | (reference dereference) [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:40:8:40:13 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:40:8:40:13 | topRef [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:40:8:40:13 | topRef [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:41:3:41:8 | (reference dereference) [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:41:3:41:8 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:41:3:41:8 | topRef [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:41:3:41:8 | topRef [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:43:8:43:13 | (reference dereference) [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:43:8:43:13 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:43:8:43:13 | topRef [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:43:8:43:13 | topRef [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:44:8:44:13 | (reference dereference) [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:44:8:44:13 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:44:8:44:13 | topRef [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:44:8:44:13 | topRef [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:45:3:45:8 | (reference dereference) [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:45:3:45:8 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:45:3:45:8 | topRef [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:45:3:45:8 | topRef [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:51:3:51:22 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:55:8:55:19 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:55:8:55:19 | globalBottom [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:55:8:55:19 | globalBottom [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:56:8:56:19 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:56:8:56:19 | globalMiddle [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:56:8:56:19 | globalMiddle [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:58:8:58:23 | call to readGlobalBottom [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:58:8:58:23 | call to readGlobalBottom [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:60:3:60:14 | globalBottom [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:60:18:60:29 | Call [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:60:18:60:29 | new [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:60:18:60:29 | new [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:61:3:61:14 | globalMiddle [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:61:18:61:29 | Call [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:61:18:61:29 | new [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:61:18:61:29 | new [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:65:3:65:22 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:65:10:65:21 | Call [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:65:10:65:21 | new [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:65:10:65:21 | new [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:69:3:69:5 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:69:3:69:5 | top [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:69:3:69:5 | top [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:73:3:73:5 | (reference dereference) [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:73:3:73:5 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:73:3:73:5 | top [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:73:3:73:5 | top [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:77:21:77:34 | call to allocateBottom [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:77:21:77:34 | call to allocateBottom [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:78:23:78:39 | (reference to) [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:78:23:78:39 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:78:23:78:39 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:78:24:78:37 | call to allocateBottom [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:80:8:80:8 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:81:3:81:3 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:81:3:81:3 | x [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:81:3:81:3 | x [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:85:3:85:13 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:89:3:89:10 | call to identity [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:89:3:89:10 | call to identity [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:89:12:89:17 | (Middle *)... [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:89:12:89:17 | (Top *)... [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:89:12:89:17 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:89:12:89:17 | bottom [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:89:12:89:17 | bottom [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:90:3:90:10 | call to identity [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:90:3:90:10 | call to identity [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:90:12:90:14 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:90:12:90:14 | top [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:90:12:90:14 | top [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:100:3:100:18 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:105:5:105:17 | maybeCallSink [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:113:30:113:38 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:117:31:117:46 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:127:10:127:15 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:127:31:127:36 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:129:10:129:15 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:129:10:129:15 | topPtr [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:129:10:129:15 | topPtr [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:130:10:130:15 | (reference dereference) [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:130:10:130:15 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:130:10:130:15 | topRef [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:130:10:130:15 | topRef [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:148:3:148:3 | u [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:148:5:148:5 | f [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:168:3:168:4 | u2 [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:168:6:168:6 | u [post update] | PostUpdateNode should not be the target of local flow. |
-| dispatch.cpp:168:8:168:8 | f [post update] | PostUpdateNode should not be the target of local flow. |
-| example.c:17:19:17:22 | FieldAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| example.c:17:19:17:22 | FieldAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| example.c:24:9:24:9 | x [post update] | PostUpdateNode should not be the target of local flow. |
-| example.c:24:20:24:20 | y [post update] | PostUpdateNode should not be the target of local flow. |
-| example.c:26:9:26:9 | x [post update] | PostUpdateNode should not be the target of local flow. |
-| example.c:26:18:26:24 | & ... [post update] | PostUpdateNode should not be the target of local flow. |
-| example.c:26:18:26:24 | & ... [post update] | PostUpdateNode should not be the target of local flow. |
-| example.c:26:19:26:24 | coords [post update] | PostUpdateNode should not be the target of local flow. |
-| example.c:28:14:28:25 | & ... [post update] | PostUpdateNode should not be the target of local flow. |
-| example.c:28:14:28:25 | (void *)... [post update] | PostUpdateNode should not be the target of local flow. |
-| example.c:28:22:28:25 | & ... [post update] | PostUpdateNode should not be the target of local flow. |
-| example.c:28:23:28:25 | pos [post update] | PostUpdateNode should not be the target of local flow. |
-| globals.cpp:5:9:5:13 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| globals.cpp:9:5:9:19 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| globals.cpp:13:5:13:19 | flowTestGlobal1 [post update] | PostUpdateNode should not be the target of local flow. |
-| globals.cpp:16:12:16:26 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| globals.cpp:23:5:23:19 | flowTestGlobal2 [post update] | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:8:6:8:6 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:9:6:9:6 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:10:6:10:6 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:11:6:11:6 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:13:7:13:7 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:13:10:17:2 | FieldAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:13:10:17:2 | FieldAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:13:11:13:11 | FieldAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:13:11:13:11 | FieldAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:16:3:16:11 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:20:7:20:7 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:20:10:24:2 | FieldAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:20:10:24:2 | FieldAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:20:10:24:2 | FieldAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:20:11:20:11 | FieldAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:20:11:20:11 | FieldAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:20:11:20:11 | FieldAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:23:3:23:3 | (reference dereference) [post update] | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:23:3:23:14 | FieldAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:23:3:23:14 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:23:3:23:14 | v [post update] | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:28:7:28:7 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:28:10:31:2 | FieldAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:28:10:31:2 | FieldAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:28:11:28:11 | FieldAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:28:11:28:11 | FieldAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:34:7:34:7 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:34:13:34:13 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:40:7:40:7 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:40:13:40:13 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:43:3:43:3 | (reference dereference) [post update] | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:43:3:43:3 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:43:3:43:3 | c [post update] | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:45:4:45:4 | (reference to) [post update] | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:45:4:45:4 | t [post update] | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:45:4:45:4 | t [post update] | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:45:7:45:7 | (reference to) [post update] | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:45:7:45:7 | u [post update] | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:45:7:45:7 | u [post update] | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:45:10:45:10 | (reference to) [post update] | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:45:10:45:10 | w [post update] | PostUpdateNode should not be the target of local flow. |
-| lambdas.cpp:45:10:45:10 | w [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:11:5:11:7 | (reference dereference) [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:11:5:11:7 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:11:5:11:7 | lhs [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:16:12:16:14 | (reference dereference) [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:16:12:16:14 | (reference to) [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:16:12:16:14 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:16:12:16:14 | lhs [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:16:12:16:14 | lhs [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:20:5:20:7 | (reference dereference) [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:20:5:20:7 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:20:5:20:7 | lhs [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:22:7:22:9 | (reference dereference) [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:22:7:22:9 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:22:7:22:9 | lhs [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:24:7:24:9 | (reference dereference) [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:24:7:24:9 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:24:7:24:9 | lhs [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:29:5:29:7 | (reference dereference) [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:29:5:29:7 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:29:5:29:7 | out [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:31:7:31:9 | (reference dereference) [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:31:7:31:9 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:31:7:31:9 | out [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:37:21:37:23 | (reference dereference) [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:37:21:37:23 | (reference to) [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:37:21:37:23 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:37:21:37:23 | out [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:37:21:37:23 | out [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:39:7:39:9 | (reference dereference) [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:39:7:39:9 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:39:7:39:9 | out [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:44:5:44:7 | (reference dereference) [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:44:5:44:7 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:44:5:44:7 | out [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:46:7:46:9 | (reference dereference) [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:46:7:46:9 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:46:7:46:9 | out [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:48:7:48:9 | (reference dereference) [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:48:7:48:9 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:48:7:48:9 | out [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:55:19:55:20 | (reference to) [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:55:19:55:20 | x1 [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:55:19:55:20 | x1 [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:58:15:58:16 | (reference to) [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:58:15:58:16 | x2 [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:58:15:58:16 | x2 [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:61:26:61:27 | (reference to) [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:61:26:61:27 | x3 [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:61:26:61:27 | x3 [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:64:15:64:16 | (reference to) [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:64:15:64:16 | x4 [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:64:15:64:16 | x4 [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:75:5:75:7 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:75:5:75:7 | lhs [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:75:9:75:11 | val [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:79:12:79:14 | (reference dereference) [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:79:12:79:14 | (reference to) [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:79:12:79:14 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:79:12:79:14 | lhs [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:79:12:79:14 | lhs [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:83:5:83:7 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:83:5:83:7 | lhs [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:83:9:83:11 | val [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:87:7:87:9 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:87:7:87:9 | lhs [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:87:11:87:13 | val [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:89:7:89:9 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:89:7:89:9 | lhs [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:89:11:89:13 | val [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:94:5:94:7 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:94:5:94:7 | out [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:94:9:94:11 | val [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:96:7:96:9 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:96:7:96:9 | out [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:96:11:96:13 | val [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:102:21:102:23 | (reference dereference) [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:102:21:102:23 | (reference to) [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:102:21:102:23 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:102:21:102:23 | out [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:102:21:102:23 | out [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:104:7:104:9 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:104:7:104:9 | out [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:104:11:104:13 | val [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:109:5:109:7 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:109:5:109:7 | out [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:109:9:109:11 | val [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:113:7:113:9 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:113:7:113:9 | out [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:113:11:113:13 | val [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:115:7:115:9 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:115:7:115:9 | out [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:115:11:115:13 | val [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:122:19:122:20 | (reference to) [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:122:19:122:20 | x1 [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:122:19:122:20 | x1 [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:125:15:125:16 | (reference to) [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:125:15:125:16 | x2 [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:125:15:125:16 | x2 [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:128:26:128:27 | (reference to) [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:128:26:128:27 | x3 [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:128:26:128:27 | x3 [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:131:15:131:16 | (reference to) [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:131:15:131:16 | x4 [post update] | PostUpdateNode should not be the target of local flow. |
-| ref.cpp:131:15:131:16 | x4 [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:6:7:6:8 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:8:3:8:4 | t2 [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:12:5:12:6 | t2 [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:17:3:17:4 | t1 [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:23:12:23:12 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:23:27:23:27 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:24:5:24:6 | t1 [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:41:9:41:10 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:41:17:41:18 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:42:9:42:9 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:43:10:43:20 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:43:10:43:20 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:45:5:45:5 | t [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:45:9:45:19 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:45:9:45:19 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:50:9:50:10 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:50:24:50:24 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:52:7:52:7 | t [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:54:7:54:7 | t [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:67:14:67:15 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:68:8:68:9 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:69:8:69:9 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:70:14:70:15 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:77:3:77:4 | u1 [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:80:7:80:8 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:84:8:84:18 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:85:3:85:4 | i1 [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:91:3:91:9 | (reference dereference) [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:91:3:91:9 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:91:3:91:9 | source1 [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:100:9:100:9 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:101:10:101:12 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:102:5:102:5 | t [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:107:9:107:9 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:108:10:108:12 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:109:5:109:5 | t [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:115:3:115:6 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:115:4:115:6 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:115:4:115:6 | out [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:116:3:116:11 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:120:3:120:6 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:120:4:120:6 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:120:4:120:6 | out [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:121:3:121:11 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:125:3:125:6 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:125:4:125:6 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:125:4:125:6 | out [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:126:3:126:11 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:134:3:134:11 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:138:7:138:7 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:139:7:139:7 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:145:3:145:11 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:149:7:149:7 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:151:7:151:7 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:156:7:156:7 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:158:3:158:11 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:162:7:162:7 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:164:7:164:7 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:171:7:171:7 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:172:3:172:11 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:176:7:176:7 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:177:7:177:7 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:190:5:190:13 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:194:9:194:9 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:194:13:194:27 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:194:13:194:27 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:194:13:194:27 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:195:9:195:15 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:196:9:196:9 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:201:9:201:15 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:203:5:203:19 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:207:9:207:9 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:207:13:207:33 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:207:13:207:33 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:207:13:207:33 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:209:9:209:9 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:209:13:209:33 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:209:13:209:33 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:209:13:209:33 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:214:9:214:15 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:215:9:215:9 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:217:5:217:13 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:221:9:221:9 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:221:13:221:34 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:221:13:221:34 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:221:13:221:34 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:223:9:223:9 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:223:13:223:34 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:223:13:223:34 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:223:13:223:34 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:230:9:230:9 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:231:9:231:15 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:232:5:232:19 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:236:9:236:9 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:236:13:236:24 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:236:13:236:24 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:236:13:236:24 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:237:9:237:9 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:245:7:245:12 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:245:7:245:12 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:245:7:245:12 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:246:7:246:16 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:246:7:246:16 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:246:7:246:16 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:250:11:250:11 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:251:7:251:12 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:251:7:251:12 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:251:7:251:12 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:255:11:255:17 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:256:7:256:12 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:256:7:256:12 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:256:7:256:12 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:265:11:265:11 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:265:15:265:20 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:265:15:265:20 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:265:15:265:20 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:267:7:267:7 | x [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:267:11:267:20 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:267:11:267:20 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:267:11:267:20 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:272:11:272:11 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:273:7:273:23 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:273:14:273:19 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:273:14:273:19 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:273:14:273:19 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:277:11:277:17 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:278:7:278:29 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:278:14:278:19 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:278:14:278:19 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:278:14:278:19 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:282:11:282:11 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:283:7:283:15 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:288:13:288:13 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:288:17:288:22 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:288:17:288:22 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:288:17:288:22 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:290:9:290:9 | x [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:290:13:290:22 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:290:13:290:22 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:290:13:290:22 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:295:13:295:13 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:295:17:295:22 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:295:17:295:22 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:295:17:295:22 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:296:9:296:17 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:300:13:300:19 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:300:23:300:28 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:300:23:300:28 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:300:23:300:28 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:301:9:301:23 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:305:13:305:13 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:306:9:306:17 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:314:2:314:2 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:314:2:314:2 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:314:2:314:2 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:317:6:317:6 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:317:10:317:10 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:317:10:317:10 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:317:10:317:10 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:319:6:319:6 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:319:10:319:10 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:319:10:319:10 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:319:10:319:10 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:321:2:321:2 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:321:2:321:2 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:321:2:321:2 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:324:2:324:10 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:333:5:333:13 | globalVar [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:347:5:347:13 | globalVar [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:359:5:359:9 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:359:5:359:9 | field [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:364:5:364:14 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:364:5:364:14 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:364:5:364:14 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:373:5:373:9 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:373:5:373:9 | field [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:374:5:374:20 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:374:5:374:20 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:374:5:374:20 | this [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:383:7:383:9 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:384:10:384:13 | & ... [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:384:10:384:13 | & ... [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:384:10:384:13 | (void *)... [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:384:11:384:13 | tmp [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:389:7:389:9 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:390:8:390:14 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:391:10:391:13 | & ... [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:391:10:391:13 | & ... [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:391:10:391:13 | (void *)... [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:391:11:391:13 | tmp [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:400:10:400:13 | & ... [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:400:10:400:13 | & ... [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:400:10:400:13 | (void *)... [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:400:11:400:13 | tmp [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:406:8:406:14 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:407:10:407:13 | & ... [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:407:10:407:13 | & ... [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:407:10:407:13 | (void *)... [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:407:11:407:13 | tmp [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:417:16:417:20 | (reference to) [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:417:16:417:20 | local [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:417:16:417:20 | local [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:423:20:423:25 | & ... [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:423:20:423:25 | & ... [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:423:21:423:25 | local [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:429:20:429:24 | array to pointer conversion [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:429:20:429:24 | local [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:429:20:429:24 | local [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:436:18:436:23 | & ... [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:436:18:436:23 | & ... [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:436:19:436:23 | local [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:442:18:442:22 | array to pointer conversion [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:442:18:442:22 | local [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:442:18:442:22 | local [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:453:7:453:11 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:456:7:456:9 | tmp [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:458:7:458:9 | tmp [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:465:3:465:4 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:465:4:465:4 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:465:4:465:4 | p [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:469:7:469:7 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:470:21:470:22 | & ... [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:470:21:470:22 | & ... [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:470:22:470:22 | x [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:481:21:481:21 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:481:21:481:30 | (void *)... [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:481:21:481:30 | content [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:481:24:481:30 | FieldAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:481:24:481:30 | content [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:482:8:482:16 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:489:7:489:7 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:491:5:491:5 | x [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:494:5:494:5 | x [post update] | PostUpdateNode should not be the target of local flow. |
-| true_upon_entry.cpp:9:7:9:7 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| true_upon_entry.cpp:10:12:10:12 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| true_upon_entry.cpp:10:27:10:27 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| true_upon_entry.cpp:11:5:11:5 | x [post update] | PostUpdateNode should not be the target of local flow. |
-| true_upon_entry.cpp:17:7:17:7 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| true_upon_entry.cpp:18:12:18:12 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| true_upon_entry.cpp:18:35:18:35 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| true_upon_entry.cpp:19:5:19:5 | x [post update] | PostUpdateNode should not be the target of local flow. |
-| true_upon_entry.cpp:25:7:25:7 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| true_upon_entry.cpp:26:12:26:12 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| true_upon_entry.cpp:26:27:26:27 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| true_upon_entry.cpp:27:5:27:5 | x [post update] | PostUpdateNode should not be the target of local flow. |
-| true_upon_entry.cpp:33:7:33:7 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| true_upon_entry.cpp:34:12:34:12 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| true_upon_entry.cpp:34:27:34:27 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| true_upon_entry.cpp:37:5:37:5 | x [post update] | PostUpdateNode should not be the target of local flow. |
-| true_upon_entry.cpp:43:7:43:7 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| true_upon_entry.cpp:44:12:44:12 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| true_upon_entry.cpp:44:27:44:27 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| true_upon_entry.cpp:47:5:47:5 | x [post update] | PostUpdateNode should not be the target of local flow. |
-| true_upon_entry.cpp:54:7:54:7 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| true_upon_entry.cpp:55:12:55:12 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| true_upon_entry.cpp:55:30:55:30 | y [post update] | PostUpdateNode should not be the target of local flow. |
-| true_upon_entry.cpp:55:38:55:38 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| true_upon_entry.cpp:62:7:62:7 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| true_upon_entry.cpp:63:12:63:12 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| true_upon_entry.cpp:63:30:63:30 | y [post update] | PostUpdateNode should not be the target of local flow. |
-| true_upon_entry.cpp:63:38:63:38 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| true_upon_entry.cpp:64:5:64:5 | x [post update] | PostUpdateNode should not be the target of local flow. |
-| true_upon_entry.cpp:70:7:70:7 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| true_upon_entry.cpp:76:12:76:12 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| true_upon_entry.cpp:76:30:76:30 | x [post update] | PostUpdateNode should not be the target of local flow. |
-| true_upon_entry.cpp:76:38:76:38 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| true_upon_entry.cpp:83:7:83:7 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| true_upon_entry.cpp:84:12:84:12 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| true_upon_entry.cpp:84:20:84:20 | y [post update] | PostUpdateNode should not be the target of local flow. |
-| true_upon_entry.cpp:84:38:84:38 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| true_upon_entry.cpp:90:7:90:7 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| true_upon_entry.cpp:91:12:91:12 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| true_upon_entry.cpp:91:20:91:20 | x [post update] | PostUpdateNode should not be the target of local flow. |
-| true_upon_entry.cpp:91:38:91:38 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| true_upon_entry.cpp:97:7:97:7 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| true_upon_entry.cpp:98:7:98:7 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| true_upon_entry.cpp:101:18:101:18 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| true_upon_entry.cpp:102:5:102:5 | x [post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:384:10:384:13 | memcpy output argument | PostUpdateNode should not be the target of local flow. |
+| test.cpp:391:10:391:13 | memcpy output argument | PostUpdateNode should not be the target of local flow. |
+| test.cpp:400:10:400:13 | memcpy output argument | PostUpdateNode should not be the target of local flow. |
+| test.cpp:407:10:407:13 | memcpy output argument | PostUpdateNode should not be the target of local flow. |
 viableImplInCallContextTooLarge

cpp/ql/test/library-tests/dataflow/dataflow-tests/dispatch.cpp

@@ -55,7 +55,7 @@ void DispatchThroughGlobal() {
   sink(globalBottom->isSource1()); // $ ir MISSING: ast
   sink(globalMiddle->isSource1()); // no flow
 
-  sink(readGlobalBottom()->isSource1()); // $ ir MISSING: ast
+  sink(readGlobalBottom()->isSource1()); // $ MISSING: ast,ir
 
   globalBottom = new Bottom();
   globalMiddle = new Middle();

cpp/ql/test/library-tests/dataflow/dataflow-tests/localFlow.ql

@@ -1,5 +1,5 @@
 import cpp
-import semmle.code.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.old.DataFlow
 
 from DataFlow::Node nodeFrom, DataFlow::Node nodeTo
 where

cpp/ql/test/library-tests/dataflow/dataflow-tests/test.ql

@@ -1,49 +1,5 @@
 import TestUtilities.dataflow.FlowTestCommon
 
-module AstTest {
-  private import semmle.code.cpp.dataflow.DataFlow
-  private import semmle.code.cpp.controlflow.Guards
-
-  /**
-   * A `BarrierGuard` that stops flow to all occurrences of `x` within statement
-   * S in `if (guarded(x)) S`.
-   */
-  // This is tested in `BarrierGuard.cpp`.
-  predicate testBarrierGuard(GuardCondition g, Expr checked, boolean isTrue) {
-    g.(FunctionCall).getTarget().getName() = "guarded" and
-    checked = g.(FunctionCall).getArgument(0) and
-    isTrue = true
-  }
-
-  /** Common data flow configuration to be used by tests. */
-  class AstTestAllocationConfig extends DataFlow::Configuration {
-    AstTestAllocationConfig() { this = "ASTTestAllocationConfig" }
-
-    override predicate isSource(DataFlow::Node source) {
-      source.asExpr().(FunctionCall).getTarget().getName() = "source"
-      or
-      source.asParameter().getName().matches("source%")
-      or
-      source.(DataFlow::DefinitionByReferenceNode).getParameter().getName().matches("ref_source%")
-      or
-      // Track uninitialized variables
-      exists(source.asUninitialized())
-    }
-
-    override predicate isSink(DataFlow::Node sink) {
-      exists(FunctionCall call |
-        call.getTarget().getName() = "sink" and
-        sink.asExpr() = call.getAnArgument()
-      )
-    }
-
-    override predicate isBarrier(DataFlow::Node barrier) {
-      barrier.asExpr().(VariableAccess).getTarget().hasName("barrier") or
-      barrier = DataFlow::BarrierGuard<testBarrierGuard/3>::getABarrierNode()
-    }
-  }
-}
-
 module IRTest {
   private import semmle.code.cpp.ir.dataflow.DataFlow
   private import semmle.code.cpp.ir.IR

cpp/ql/test/library-tests/dataflow/dataflow-tests/uninitialized.ql

@@ -1,4 +1,4 @@
-import semmle.code.cpp.dataflow.internal.FlowVar
+import semmle.code.cpp.dataflow.old.internal.FlowVar
 
 from Variable var, VariableAccess va
 where FlowVar_internal::mayBeUsedUninitialized(var, va)

cpp/ql/test/library-tests/dataflow/fields/A.cpp

@@ -54,7 +54,7 @@ public:
     B *b = new B();
     b->set(new C1());
     sink(b->get());                // $ ast ir=55:12
-    sink((new B(new C()))->get()); // $ ast,ir
+    sink((new B(new C()))->get()); // $ ast ir=57:17
   }
 
   void f3()
@@ -129,7 +129,7 @@ public:
   {
     B *b = new B();
     f7(b);
-    sink(b->c); // $ ast,ir
+    sink(b->c); // $ ast ir=126:12
   }
 
   class D

cpp/ql/test/library-tests/dataflow/fields/ASTConfiguration.qll

@@ -1,4 +1,4 @@
-private import semmle.code.cpp.dataflow.DataFlow
+private import semmle.code.cpp.dataflow.old.DataFlow2
 private import DataFlow
 
 class AstConf extends Configuration {

cpp/ql/test/library-tests/dataflow/fields/C.cpp

@@ -28,7 +28,7 @@ public:
   {
     sink(s1); // $ast,ir
     sink(s2); // $ MISSING: ast,ir
-    sink(s3); // $ast MISSING: ir
+    sink(s3); // $ast,ir
     sink(s4); // $ MISSING: ast,ir
   }
 };

cpp/ql/test/library-tests/dataflow/fields/E.cpp

@@ -18,7 +18,7 @@ void sink(char *b);
 
 void handlePacket(packet *p)
 {
-    sink(p->data.buffer); // $ ast,ir
+    sink(p->data.buffer); // $ ast MISSING: ir
 }
 
 void f(buf* b)
@@ -28,7 +28,7 @@ void f(buf* b)
     argument_source(raw);
     argument_source(b->buffer);
     argument_source(p.data.buffer);
-    sink(raw); // $ ast,ir
-    sink(b->buffer); // $ ast,ir
+    sink(raw); // $ ast MISSING: ir
+    sink(b->buffer); // $ ast MISSING: ir
     handlePacket(&p);
 }

cpp/ql/test/library-tests/dataflow/fields/Nodes.qll

@@ -1,5 +1,5 @@
 private import semmle.code.cpp.ir.dataflow.DataFlow as IR
-private import semmle.code.cpp.dataflow.DataFlow as AST
+private import semmle.code.cpp.dataflow.old.DataFlow as AST
 private import cpp
 
 private newtype TNode =

cpp/ql/test/library-tests/dataflow/fields/aliasing.cpp

@@ -99,7 +99,7 @@ void addressOfField() {
 
   S s_copy = s;
   int* px = &s_copy.m1;
-  sink(*px); // $ MISSING: ast,ir
+  sink(*px); // $ ir MISSING: ast
 }
 
 void taint_a_ptr(int* pa) {
@@ -119,22 +119,22 @@ struct S_with_pointer {
 
 void pointer_deref(int* xs) {
   taint_a_ptr(xs);
-  sink(xs[0]); // $ MISSING: ast,ir
+  sink(xs[0]); // $ ir MISSING: ast
 }
 
 void pointer_deref_sub(int* xs) {
   taint_a_ptr(xs - 2);
-  sink(*(xs - 2)); // $ MISSING: ast,ir
+  sink(*(xs - 2)); // $ ir MISSING: ast
 }
 
 void pointer_many_addrof_and_deref(int* xs) {
   taint_a_ptr(xs);
-  sink(*&*&*xs); // $ MISSING: ast,ir
+  sink(*&*&*xs); // $ ir MISSING: ast
 }
 
 void pointer_unary_plus(int* xs) {
   taint_a_ptr(+xs);
-  sink(*+xs); // $ MISSING: ast,ir
+  sink(*+xs); // $ ir MISSING: ast
 }
 
 void pointer_member_index(S_with_pointer s) {

cpp/ql/test/library-tests/dataflow/fields/conflated.cpp

@@ -17,7 +17,7 @@ void sink(void*);
 void pointer_without_allocation_2() {
   char *raw;
   argument_source(raw);
-  sink(raw); // $ ast,ir
+  sink(raw); // $ ast MISSING: ir
 }
 
 A* makeA() {

cpp/ql/test/library-tests/dataflow/fields/dataflow-consistency.ql

@@ -1 +1 @@
-import semmle.code.cpp.dataflow.internal.DataFlowImplConsistency::Consistency
+import semmle.code.cpp.dataflow.old.internal.DataFlowImplConsistency::Consistency

cpp/ql/test/library-tests/dataflow/fields/partial-definition-diff.expected

@@ -1,147 +1,358 @@
 | A.cpp:25:13:25:13 | c | AST only |
 | A.cpp:27:28:27:28 | c | AST only |
-| A.cpp:31:14:31:21 | new | IR only |
-| A.cpp:40:15:40:21 | 0 | IR only |
-| A.cpp:41:15:41:21 | new | IR only |
-| A.cpp:41:15:41:21 | new | IR only |
-| A.cpp:47:12:47:18 | new | IR only |
-| A.cpp:54:12:54:18 | new | IR only |
-| A.cpp:55:12:55:19 | new | IR only |
-| A.cpp:55:12:55:19 | new | IR only |
-| A.cpp:57:11:57:24 | new | IR only |
-| A.cpp:57:11:57:24 | new | IR only |
-| A.cpp:57:17:57:23 | new | IR only |
-| A.cpp:57:17:57:23 | new | IR only |
-| A.cpp:62:13:62:19 | new | IR only |
-| A.cpp:64:21:64:28 | new | IR only |
-| A.cpp:64:21:64:28 | new | IR only |
-| A.cpp:71:13:71:19 | new | IR only |
-| A.cpp:73:25:73:32 | new | IR only |
-| A.cpp:73:25:73:32 | new | IR only |
-| A.cpp:89:15:89:21 | new | IR only |
-| A.cpp:99:14:99:21 | new | IR only |
+| A.cpp:28:29:28:29 | this | IR only |
+| A.cpp:31:20:31:20 | c | AST only |
+| A.cpp:40:5:40:6 | cc | AST only |
+| A.cpp:41:5:41:6 | ct | AST only |
+| A.cpp:42:10:42:12 | & ... | AST only |
+| A.cpp:43:10:43:12 | & ... | AST only |
+| A.cpp:48:20:48:20 | c | AST only |
+| A.cpp:49:13:49:13 | c | AST only |
+| A.cpp:55:5:55:5 | b | AST only |
+| A.cpp:56:10:56:10 | b | AST only |
+| A.cpp:56:13:56:15 | call to get | AST only |
+| A.cpp:57:28:57:30 | call to get | AST only |
+| A.cpp:64:10:64:15 | this | AST only |
+| A.cpp:64:17:64:18 | b1 | AST only |
+| A.cpp:65:14:65:14 | c | AST only |
+| A.cpp:66:14:66:14 | c | AST only |
+| A.cpp:73:10:73:19 | this | AST only |
+| A.cpp:73:21:73:22 | b1 | AST only |
+| A.cpp:74:14:74:14 | c | AST only |
+| A.cpp:75:14:75:14 | c | AST only |
+| A.cpp:81:10:81:15 | this | AST only |
+| A.cpp:81:17:81:18 | b1 | AST only |
+| A.cpp:81:21:81:21 | c | AST only |
+| A.cpp:82:12:82:12 | this | AST only |
+| A.cpp:87:9:87:9 | this | AST only |
+| A.cpp:90:7:90:8 | b2 | AST only |
+| A.cpp:90:15:90:15 | c | AST only |
 | A.cpp:100:9:100:9 | a | AST only |
-| A.cpp:116:12:116:19 | new | IR only |
-| A.cpp:126:12:126:18 | new | IR only |
-| A.cpp:126:12:126:18 | new | IR only |
-| A.cpp:130:12:130:18 | new | IR only |
+| A.cpp:101:5:101:6 | this | AST only |
+| A.cpp:101:8:101:9 | c1 | AST only |
+| A.cpp:107:16:107:16 | a | AST only |
+| A.cpp:120:16:120:16 | a | AST only |
+| A.cpp:126:5:126:5 | b | AST only |
+| A.cpp:131:5:131:6 | this | AST only |
+| A.cpp:131:8:131:8 | b | AST only |
+| A.cpp:132:13:132:13 | c | AST only |
 | A.cpp:142:10:142:10 | c | AST only |
-| A.cpp:142:14:142:20 | new | IR only |
 | A.cpp:143:13:143:13 | b | AST only |
-| A.cpp:143:25:143:31 | new | IR only |
-| A.cpp:150:12:150:18 | new | IR only |
-| A.cpp:151:12:151:24 | new | IR only |
-| A.cpp:159:12:159:18 | new | IR only |
-| A.cpp:160:18:160:60 | new | IR only |
-| A.cpp:160:32:160:59 | new | IR only |
-| A.cpp:160:32:160:59 | new | IR only |
-| A.cpp:160:43:160:49 | 0 | IR only |
-| A.cpp:160:52:160:58 | 0 | IR only |
-| A.cpp:161:18:161:40 | new | IR only |
-| A.cpp:161:29:161:35 | 0 | IR only |
-| A.cpp:162:18:162:40 | new | IR only |
-| A.cpp:162:29:162:35 | 0 | IR only |
+| A.cpp:151:18:151:18 | b | AST only |
+| A.cpp:151:21:151:21 | this | AST only |
+| A.cpp:152:13:152:13 | b | AST only |
+| A.cpp:153:16:153:16 | c | AST only |
+| A.cpp:154:13:154:13 | c | AST only |
+| A.cpp:160:29:160:29 | b | AST only |
+| A.cpp:161:38:161:39 | l1 | AST only |
+| A.cpp:162:38:162:39 | l2 | AST only |
+| A.cpp:163:14:163:17 | head | AST only |
+| A.cpp:164:20:164:23 | head | AST only |
+| A.cpp:165:26:165:29 | head | AST only |
+| A.cpp:166:32:166:35 | head | AST only |
+| A.cpp:167:47:167:50 | l | IR only |
+| A.cpp:169:15:169:18 | head | AST only |
 | A.cpp:183:7:183:10 | head | AST only |
 | A.cpp:184:13:184:16 | next | AST only |
-| B.cpp:7:16:7:35 | new | IR only |
-| B.cpp:7:28:7:34 | 0 | IR only |
-| B.cpp:8:16:8:27 | new | IR only |
-| B.cpp:16:16:16:38 | new | IR only |
-| B.cpp:16:28:16:34 | 0 | IR only |
-| B.cpp:17:16:17:27 | new | IR only |
+| B.cpp:7:25:7:25 | e | AST only |
+| B.cpp:8:25:8:26 | b1 | AST only |
+| B.cpp:9:20:9:24 | elem1 | AST only |
+| B.cpp:10:20:10:24 | elem2 | AST only |
+| B.cpp:16:37:16:37 | e | AST only |
+| B.cpp:17:25:17:26 | b1 | AST only |
+| B.cpp:18:20:18:24 | elem1 | AST only |
+| B.cpp:19:20:19:24 | elem2 | AST only |
 | B.cpp:35:13:35:17 | elem1 | AST only |
 | B.cpp:36:13:36:17 | elem2 | AST only |
 | B.cpp:46:13:46:16 | box1 | AST only |
-| C.cpp:18:12:18:18 | new | IR only |
+| C.cpp:19:5:19:5 | c | AST only |
 | C.cpp:24:11:24:12 | s3 | AST only |
-| C.cpp:30:10:30:11 | s2 | IR only |
+| C.cpp:29:10:29:11 | s1 | AST only |
 | C.cpp:30:10:30:11 | this | IR only |
-| C.cpp:32:10:32:11 | s4 | IR only |
+| C.cpp:31:10:31:11 | s3 | AST only |
 | D.cpp:9:21:9:24 | elem | AST only |
+| D.cpp:10:30:10:33 | this | IR only |
 | D.cpp:11:29:11:32 | elem | AST only |
 | D.cpp:16:21:16:23 | box | AST only |
+| D.cpp:17:30:17:32 | this | IR only |
 | D.cpp:18:29:18:31 | box | AST only |
-| D.cpp:29:15:29:41 | new | IR only |
-| D.cpp:29:24:29:40 | new | IR only |
-| D.cpp:29:24:29:40 | new | IR only |
-| D.cpp:29:33:29:39 | 0 | IR only |
+| D.cpp:22:10:22:11 | b2 | AST only |
+| D.cpp:22:14:22:20 | call to getBox1 | AST only |
+| D.cpp:22:25:22:31 | call to getElem | AST only |
 | D.cpp:30:13:30:16 | elem | AST only |
-| D.cpp:36:15:36:41 | new | IR only |
-| D.cpp:36:24:36:40 | new | IR only |
-| D.cpp:36:24:36:40 | new | IR only |
-| D.cpp:36:33:36:39 | 0 | IR only |
-| D.cpp:43:15:43:41 | new | IR only |
-| D.cpp:43:24:43:40 | new | IR only |
-| D.cpp:43:24:43:40 | new | IR only |
-| D.cpp:43:33:43:39 | 0 | IR only |
+| D.cpp:31:14:31:14 | b | AST only |
+| D.cpp:37:8:37:10 | box | AST only |
+| D.cpp:37:21:37:21 | e | AST only |
+| D.cpp:38:14:38:14 | b | AST only |
+| D.cpp:44:5:44:5 | b | AST only |
 | D.cpp:44:19:44:22 | elem | AST only |
-| D.cpp:50:15:50:41 | new | IR only |
-| D.cpp:50:24:50:40 | new | IR only |
-| D.cpp:50:24:50:40 | new | IR only |
-| D.cpp:50:33:50:39 | 0 | IR only |
+| D.cpp:45:14:45:14 | b | AST only |
+| D.cpp:51:5:51:5 | b | AST only |
+| D.cpp:51:8:51:14 | call to getBox1 | AST only |
+| D.cpp:51:27:51:27 | e | AST only |
+| D.cpp:52:14:52:14 | b | AST only |
 | D.cpp:57:5:57:12 | boxfield | AST only |
-| D.cpp:57:16:57:42 | new | IR only |
-| D.cpp:57:25:57:41 | new | IR only |
-| D.cpp:57:25:57:41 | new | IR only |
-| D.cpp:57:34:57:40 | 0 | IR only |
 | D.cpp:58:20:58:23 | elem | AST only |
+| D.cpp:59:5:59:7 | this | AST only |
+| D.cpp:64:25:64:28 | elem | AST only |
+| E.cpp:21:18:21:23 | buffer | AST only |
+| E.cpp:28:21:28:23 | raw | AST only |
+| E.cpp:29:24:29:29 | buffer | AST only |
+| E.cpp:30:28:30:33 | buffer | AST only |
+| E.cpp:31:10:31:12 | raw | AST only |
+| E.cpp:32:13:32:18 | buffer | AST only |
+| E.cpp:33:18:33:19 | & ... | AST only |
 | aliasing.cpp:9:6:9:7 | m1 | AST only |
 | aliasing.cpp:13:5:13:6 | m1 | AST only |
 | aliasing.cpp:17:5:17:6 | m1 | AST only |
+| aliasing.cpp:25:17:25:19 | & ... | AST only |
+| aliasing.cpp:26:19:26:20 | s2 | AST only |
+| aliasing.cpp:29:11:29:12 | s1 | IR only |
+| aliasing.cpp:30:11:30:12 | s2 | IR only |
+| aliasing.cpp:31:11:31:12 | s3 | IR only |
 | aliasing.cpp:37:8:37:9 | m1 | AST only |
+| aliasing.cpp:38:11:38:12 | s1 | IR only |
 | aliasing.cpp:42:6:42:7 | m1 | AST only |
+| aliasing.cpp:43:13:43:14 | ref2 | IR only |
 | aliasing.cpp:49:9:49:10 | m1 | AST only |
+| aliasing.cpp:50:11:50:12 | s1 | IR only |
 | aliasing.cpp:54:6:54:7 | m1 | AST only |
+| aliasing.cpp:55:14:55:15 | copy2 | IR only |
 | aliasing.cpp:60:6:60:7 | m1 | AST only |
+| aliasing.cpp:62:14:62:15 | copy2 | IR only |
+| aliasing.cpp:71:11:71:11 | w | IR only |
 | aliasing.cpp:72:5:72:6 | m1 | AST only |
+| aliasing.cpp:73:10:73:10 | w | IR only |
+| aliasing.cpp:73:12:73:13 | s | IR only |
+| aliasing.cpp:78:13:78:13 | w | IR only |
 | aliasing.cpp:79:6:79:7 | m1 | AST only |
+| aliasing.cpp:80:10:80:10 | w | IR only |
+| aliasing.cpp:80:12:80:13 | s | IR only |
+| aliasing.cpp:85:12:85:12 | w | IR only |
 | aliasing.cpp:86:5:86:6 | m1 | AST only |
+| aliasing.cpp:87:10:87:10 | w | IR only |
+| aliasing.cpp:87:12:87:13 | s | IR only |
 | aliasing.cpp:92:7:92:8 | m1 | AST only |
+| aliasing.cpp:93:10:93:10 | w | IR only |
+| aliasing.cpp:93:12:93:13 | s | IR only |
 | aliasing.cpp:98:5:98:6 | m1 | AST only |
+| aliasing.cpp:101:21:101:22 | s_copy | IR only |
 | aliasing.cpp:106:3:106:5 | * ... | AST only |
+| aliasing.cpp:111:15:111:19 | & ... | AST only |
+| aliasing.cpp:112:10:112:11 | s | IR only |
+| aliasing.cpp:121:15:121:16 | xs | AST only |
+| aliasing.cpp:126:15:126:20 | ... - ... | AST only |
+| aliasing.cpp:131:15:131:16 | xs | AST only |
+| aliasing.cpp:136:15:136:17 | + ... | AST only |
+| aliasing.cpp:141:17:141:20 | data | AST only |
+| aliasing.cpp:143:10:143:13 | s | IR only |
+| aliasing.cpp:147:15:147:22 | & ... | AST only |
+| aliasing.cpp:148:13:148:14 | access to array | IR only |
+| aliasing.cpp:158:17:158:20 | data | AST only |
+| aliasing.cpp:159:11:159:14 | s | IR only |
+| aliasing.cpp:164:17:164:20 | data | AST only |
+| aliasing.cpp:165:10:165:13 | s | IR only |
+| aliasing.cpp:175:15:175:22 | & ... | AST only |
+| aliasing.cpp:176:11:176:11 | s2 | IR only |
+| aliasing.cpp:176:13:176:14 | s | IR only |
+| aliasing.cpp:181:15:181:22 | & ... | AST only |
+| aliasing.cpp:182:11:182:11 | s2 | IR only |
+| aliasing.cpp:182:13:182:14 | s | IR only |
+| aliasing.cpp:187:15:187:22 | & ... | AST only |
+| aliasing.cpp:189:13:189:13 | s2_2 | IR only |
+| aliasing.cpp:189:15:189:16 | s | IR only |
+| aliasing.cpp:194:15:194:22 | & ... | AST only |
+| aliasing.cpp:196:13:196:13 | s2_2 | IR only |
+| aliasing.cpp:196:15:196:16 | s | IR only |
+| aliasing.cpp:200:15:200:24 | & ... | AST only |
+| aliasing.cpp:201:13:201:13 | ps2 | IR only |
+| aliasing.cpp:201:15:201:16 | s | IR only |
+| aliasing.cpp:205:15:205:24 | & ... | AST only |
+| aliasing.cpp:206:13:206:13 | ps2 | IR only |
+| aliasing.cpp:206:15:206:16 | s | IR only |
 | arrays.cpp:6:3:6:8 | access to array | AST only |
-| arrays.cpp:7:8:7:13 | access to array | IR only |
-| arrays.cpp:8:8:8:13 | access to array | IR only |
-| arrays.cpp:9:8:9:11 | * ... | IR only |
-| arrays.cpp:10:8:10:15 | * ... | IR only |
 | arrays.cpp:15:3:15:10 | * ... | AST only |
-| arrays.cpp:16:8:16:13 | access to array | IR only |
-| arrays.cpp:17:8:17:13 | access to array | IR only |
 | arrays.cpp:36:19:36:22 | data | AST only |
+| arrays.cpp:37:24:37:27 | data | AST only |
+| arrays.cpp:38:24:38:27 | data | AST only |
 | arrays.cpp:42:22:42:25 | data | AST only |
+| arrays.cpp:43:27:43:30 | data | AST only |
+| arrays.cpp:44:27:44:30 | data | AST only |
 | arrays.cpp:48:22:48:25 | data | AST only |
+| arrays.cpp:49:27:49:30 | data | AST only |
+| arrays.cpp:50:27:50:30 | data | AST only |
 | by_reference.cpp:12:8:12:8 | a | AST only |
 | by_reference.cpp:16:11:16:11 | a | AST only |
+| by_reference.cpp:20:5:20:8 | this | AST only |
+| by_reference.cpp:20:23:20:27 | value | AST only |
+| by_reference.cpp:24:19:24:22 | this | AST only |
+| by_reference.cpp:24:25:24:29 | value | AST only |
+| by_reference.cpp:32:15:32:15 | s | IR only |
+| by_reference.cpp:36:18:36:18 | this | IR only |
 | by_reference.cpp:40:12:40:15 | this | AST only |
+| by_reference.cpp:50:3:50:3 | s | AST only |
+| by_reference.cpp:50:17:50:26 | call to user_input | AST only |
 | by_reference.cpp:51:8:51:8 | s | AST only |
+| by_reference.cpp:51:10:51:20 | call to getDirectly | AST only |
+| by_reference.cpp:56:3:56:3 | s | AST only |
+| by_reference.cpp:56:19:56:28 | call to user_input | AST only |
 | by_reference.cpp:57:8:57:8 | s | AST only |
+| by_reference.cpp:57:10:57:22 | call to getIndirectly | AST only |
+| by_reference.cpp:62:3:62:3 | s | AST only |
+| by_reference.cpp:62:25:62:34 | call to user_input | AST only |
 | by_reference.cpp:63:8:63:8 | s | AST only |
+| by_reference.cpp:63:10:63:28 | call to getThroughNonMember | AST only |
+| by_reference.cpp:68:17:68:18 | & ... | AST only |
+| by_reference.cpp:68:21:68:30 | call to user_input | AST only |
+| by_reference.cpp:69:8:69:20 | call to nonMemberGetA | AST only |
 | by_reference.cpp:84:10:84:10 | a | AST only |
 | by_reference.cpp:88:9:88:9 | a | AST only |
 | by_reference.cpp:92:3:92:5 | * ... | AST only |
 | by_reference.cpp:96:3:96:4 | pa | AST only |
+| by_reference.cpp:102:21:102:39 | & ... | AST only |
+| by_reference.cpp:103:27:103:35 | inner_ptr | AST only |
+| by_reference.cpp:104:15:104:22 | & ... | AST only |
+| by_reference.cpp:106:21:106:41 | & ... | AST only |
+| by_reference.cpp:107:29:107:37 | inner_ptr | AST only |
+| by_reference.cpp:108:15:108:24 | & ... | AST only |
+| by_reference.cpp:110:27:110:27 | a | AST only |
+| by_reference.cpp:111:25:111:25 | a | AST only |
+| by_reference.cpp:112:14:112:14 | a | AST only |
+| by_reference.cpp:114:29:114:29 | a | AST only |
+| by_reference.cpp:115:27:115:27 | a | AST only |
+| by_reference.cpp:116:16:116:16 | a | AST only |
+| by_reference.cpp:122:27:122:38 | inner_nested | AST only |
+| by_reference.cpp:123:21:123:36 | * ... | AST only |
+| by_reference.cpp:124:21:124:21 | a | AST only |
+| by_reference.cpp:126:29:126:40 | inner_nested | AST only |
+| by_reference.cpp:127:21:127:38 | * ... | AST only |
+| by_reference.cpp:128:23:128:23 | a | AST only |
+| by_reference.cpp:130:27:130:27 | a | AST only |
+| by_reference.cpp:131:25:131:25 | a | AST only |
+| by_reference.cpp:132:14:132:14 | a | AST only |
+| by_reference.cpp:134:29:134:29 | a | AST only |
+| by_reference.cpp:135:27:135:27 | a | AST only |
+| by_reference.cpp:136:16:136:16 | a | AST only |
+| complex.cpp:9:20:9:21 | this | IR only |
+| complex.cpp:10:20:10:21 | this | IR only |
 | complex.cpp:11:22:11:23 | a_ | AST only |
 | complex.cpp:12:22:12:23 | b_ | AST only |
+| complex.cpp:42:16:42:16 | f | AST only |
+| complex.cpp:43:16:43:16 | f | AST only |
+| complex.cpp:53:12:53:12 | f | AST only |
+| complex.cpp:54:12:54:12 | f | AST only |
+| complex.cpp:55:12:55:12 | f | AST only |
+| complex.cpp:56:12:56:12 | f | AST only |
+| complex.cpp:59:7:59:8 | b1 | AST only |
+| complex.cpp:62:7:62:8 | b2 | AST only |
+| complex.cpp:65:7:65:8 | b3 | AST only |
+| complex.cpp:68:7:68:8 | b4 | AST only |
 | conflated.cpp:10:3:10:7 | * ... | AST only |
+| conflated.cpp:11:12:11:12 | ra | IR only |
+| conflated.cpp:19:19:19:21 | raw | AST only |
+| conflated.cpp:20:8:20:10 | raw | AST only |
 | conflated.cpp:29:7:29:7 | x | AST only |
+| conflated.cpp:30:12:30:12 | pa | IR only |
 | conflated.cpp:36:7:36:7 | x | AST only |
+| conflated.cpp:37:12:37:12 | pa | IR only |
 | conflated.cpp:53:7:53:10 | next | AST only |
 | conflated.cpp:54:13:54:13 | y | AST only |
-| conflated.cpp:59:20:59:39 | new | IR only |
+| conflated.cpp:55:12:55:15 | ll | IR only |
+| conflated.cpp:55:18:55:18 | next | IR only |
+| conflated.cpp:59:35:59:38 | next | AST only |
 | conflated.cpp:60:13:60:13 | y | AST only |
+| conflated.cpp:61:12:61:15 | ll | IR only |
+| conflated.cpp:61:18:61:18 | next | IR only |
+| constructors.cpp:18:22:18:23 | this | IR only |
+| constructors.cpp:19:22:19:23 | this | IR only |
 | constructors.cpp:20:24:20:25 | a_ | AST only |
 | constructors.cpp:21:24:21:25 | b_ | AST only |
+| constructors.cpp:28:10:28:10 | f | AST only |
+| constructors.cpp:29:10:29:10 | f | AST only |
+| constructors.cpp:40:9:40:9 | f | AST only |
+| constructors.cpp:43:9:43:9 | g | AST only |
+| constructors.cpp:46:9:46:9 | h | AST only |
+| constructors.cpp:49:9:49:9 | i | AST only |
 | qualifiers.cpp:9:36:9:36 | a | AST only |
 | qualifiers.cpp:12:56:12:56 | a | AST only |
 | qualifiers.cpp:13:57:13:57 | a | AST only |
+| qualifiers.cpp:18:32:18:36 | this | IR only |
+| qualifiers.cpp:22:5:22:9 | outer | AST only |
 | qualifiers.cpp:22:23:22:23 | a | AST only |
+| qualifiers.cpp:23:23:23:23 | a | AST only |
+| qualifiers.cpp:27:5:27:9 | outer | AST only |
+| qualifiers.cpp:27:11:27:18 | call to getInner | AST only |
+| qualifiers.cpp:27:28:27:37 | call to user_input | AST only |
+| qualifiers.cpp:28:23:28:23 | a | AST only |
+| qualifiers.cpp:32:17:32:21 | outer | AST only |
+| qualifiers.cpp:32:23:32:30 | call to getInner | AST only |
+| qualifiers.cpp:32:35:32:44 | call to user_input | AST only |
+| qualifiers.cpp:33:23:33:23 | a | AST only |
+| qualifiers.cpp:37:19:37:35 | * ... | AST only |
+| qualifiers.cpp:37:20:37:24 | outer | AST only |
+| qualifiers.cpp:37:38:37:47 | call to user_input | AST only |
+| qualifiers.cpp:38:23:38:23 | a | AST only |
+| qualifiers.cpp:42:7:42:11 | outer | AST only |
 | qualifiers.cpp:42:25:42:25 | a | AST only |
+| qualifiers.cpp:43:23:43:23 | a | AST only |
+| qualifiers.cpp:47:6:47:11 | & ... | AST only |
 | qualifiers.cpp:47:27:47:27 | a | AST only |
+| qualifiers.cpp:48:23:48:23 | a | AST only |
 | realistic.cpp:26:5:26:10 | offset | AST only |
+| realistic.cpp:42:20:42:20 | o | AST only |
 | realistic.cpp:49:20:49:22 | baz | AST only |
 | realistic.cpp:53:35:53:43 | bufferLen | AST only |
+| realistic.cpp:54:42:54:47 | buffer | AST only |
+| realistic.cpp:55:16:55:18 | foo | IR only |
+| realistic.cpp:55:23:55:25 | access to array | IR only |
+| realistic.cpp:55:28:55:36 | baz | IR only |
+| realistic.cpp:55:38:55:46 | userInput | IR only |
+| realistic.cpp:57:92:57:94 | foo | IR only |
+| realistic.cpp:57:99:57:101 | access to array | IR only |
+| realistic.cpp:57:104:57:112 | baz | IR only |
+| realistic.cpp:57:114:57:122 | userInput | IR only |
+| realistic.cpp:60:16:60:18 | dst | AST only |
+| realistic.cpp:60:25:60:27 | foo | IR only |
+| realistic.cpp:60:32:60:34 | access to array | IR only |
+| realistic.cpp:60:37:60:45 | baz | IR only |
+| realistic.cpp:60:47:60:52 | userInput | IR only |
+| realistic.cpp:60:59:60:61 | foo | IR only |
+| realistic.cpp:60:66:60:68 | access to array | IR only |
+| realistic.cpp:60:71:60:79 | baz | IR only |
+| realistic.cpp:60:81:60:89 | userInput | IR only |
+| realistic.cpp:61:47:61:55 | bufferLen | AST only |
+| realistic.cpp:65:47:65:52 | buffer | AST only |
+| realistic.cpp:66:21:66:23 | dst | AST only |
+| simple.cpp:18:22:18:23 | this | IR only |
+| simple.cpp:19:22:19:23 | this | IR only |
 | simple.cpp:20:24:20:25 | a_ | AST only |
 | simple.cpp:21:24:21:25 | b_ | AST only |
+| simple.cpp:28:10:28:10 | f | AST only |
+| simple.cpp:29:10:29:10 | f | AST only |
+| simple.cpp:39:5:39:5 | f | AST only |
+| simple.cpp:40:5:40:5 | g | AST only |
+| simple.cpp:41:5:41:5 | h | AST only |
+| simple.cpp:42:5:42:5 | h | AST only |
+| simple.cpp:45:9:45:9 | f | AST only |
+| simple.cpp:48:9:48:9 | g | AST only |
+| simple.cpp:51:9:51:9 | h | AST only |
+| simple.cpp:54:9:54:9 | i | AST only |
 | simple.cpp:65:7:65:7 | i | AST only |
+| simple.cpp:67:13:67:13 | a2 | IR only |
+| simple.cpp:79:16:79:17 | this | IR only |
+| simple.cpp:79:19:79:20 | f2 | IR only |
 | simple.cpp:83:12:83:13 | f1 | AST only |
+| simple.cpp:84:14:84:20 | this | AST only |
 | simple.cpp:92:7:92:7 | i | AST only |
+| simple.cpp:94:13:94:13 | a2 | IR only |
+| struct_init.c:15:12:15:12 | a | AST only |
+| struct_init.c:16:12:16:12 | b | AST only |
+| struct_init.c:22:11:22:11 | a | AST only |
+| struct_init.c:23:11:23:11 | b | AST only |
+| struct_init.c:24:10:24:12 | & ... | AST only |
+| struct_init.c:31:23:31:23 | a | AST only |
+| struct_init.c:32:23:32:23 | b | AST only |
+| struct_init.c:33:25:33:25 | a | AST only |
+| struct_init.c:34:25:34:25 | b | AST only |
+| struct_init.c:36:10:36:24 | & ... | AST only |
+| struct_init.c:46:16:46:24 | pointerAB | AST only |

cpp/ql/test/library-tests/dataflow/fields/partial-definition-diff.ql

@@ -4,7 +4,7 @@
 
 import cpp
 import semmle.code.cpp.ir.dataflow.DataFlow::DataFlow as IR
-import semmle.code.cpp.dataflow.DataFlow::DataFlow as AST
+import semmle.code.cpp.dataflow.old.DataFlow::DataFlow as AST
 import Nodes
 
 class AstPartialDefNode extends AstNode {

cpp/ql/test/library-tests/dataflow/fields/partial-definition-ir.expected

@@ -1,447 +1,260 @@
 | A.cpp:25:7:25:10 | this |
 | A.cpp:27:22:27:25 | this |
-| A.cpp:31:14:31:21 | new |
-| A.cpp:31:20:31:20 | c |
-| A.cpp:40:5:40:6 | cc |
-| A.cpp:40:15:40:21 | 0 |
-| A.cpp:41:5:41:6 | ct |
-| A.cpp:41:15:41:21 | new |
-| A.cpp:42:10:42:12 | & ... |
-| A.cpp:43:10:43:12 | & ... |
-| A.cpp:47:12:47:18 | new |
-| A.cpp:48:20:48:20 | c |
+| A.cpp:28:23:28:26 | this |
 | A.cpp:49:10:49:10 | b |
-| A.cpp:49:13:49:13 | c |
-| A.cpp:54:12:54:18 | new |
-| A.cpp:55:5:55:5 | b |
-| A.cpp:55:12:55:19 | new |
-| A.cpp:56:10:56:10 | b |
-| A.cpp:56:13:56:15 | call to get |
-| A.cpp:57:11:57:24 | new |
-| A.cpp:57:17:57:23 | new |
-| A.cpp:57:28:57:30 | call to get |
-| A.cpp:62:13:62:19 | new |
-| A.cpp:64:10:64:15 | this |
-| A.cpp:64:17:64:18 | b1 |
-| A.cpp:64:21:64:28 | new |
 | A.cpp:65:10:65:11 | b1 |
-| A.cpp:65:14:65:14 | c |
 | A.cpp:66:10:66:11 | b2 |
-| A.cpp:66:14:66:14 | c |
-| A.cpp:71:13:71:19 | new |
-| A.cpp:73:10:73:19 | this |
-| A.cpp:73:21:73:22 | b1 |
-| A.cpp:73:25:73:32 | new |
 | A.cpp:74:10:74:11 | b1 |
-| A.cpp:74:14:74:14 | c |
 | A.cpp:75:10:75:11 | b2 |
-| A.cpp:75:14:75:14 | c |
-| A.cpp:81:10:81:15 | this |
-| A.cpp:81:17:81:18 | b1 |
-| A.cpp:81:21:81:21 | c |
-| A.cpp:82:12:82:12 | this |
-| A.cpp:87:9:87:9 | this |
-| A.cpp:89:15:89:21 | new |
-| A.cpp:90:7:90:8 | b2 |
-| A.cpp:90:15:90:15 | c |
-| A.cpp:99:14:99:21 | new |
 | A.cpp:100:5:100:6 | c1 |
-| A.cpp:101:5:101:6 | this |
-| A.cpp:101:8:101:9 | c1 |
 | A.cpp:107:12:107:13 | c1 |
-| A.cpp:107:16:107:16 | a |
-| A.cpp:116:12:116:19 | new |
 | A.cpp:120:12:120:13 | c1 |
-| A.cpp:120:16:120:16 | a |
-| A.cpp:126:5:126:5 | b |
-| A.cpp:126:12:126:18 | new |
-| A.cpp:130:12:130:18 | new |
-| A.cpp:131:5:131:6 | this |
-| A.cpp:131:8:131:8 | b |
 | A.cpp:132:10:132:10 | b |
-| A.cpp:132:13:132:13 | c |
 | A.cpp:142:7:142:7 | b |
-| A.cpp:142:14:142:20 | new |
 | A.cpp:143:7:143:10 | this |
-| A.cpp:143:25:143:31 | new |
-| A.cpp:150:12:150:18 | new |
-| A.cpp:151:12:151:24 | new |
-| A.cpp:151:18:151:18 | b |
-| A.cpp:151:21:151:21 | this |
 | A.cpp:152:10:152:10 | d |
-| A.cpp:152:13:152:13 | b |
 | A.cpp:153:10:153:10 | d |
 | A.cpp:153:13:153:13 | b |
-| A.cpp:153:16:153:16 | c |
 | A.cpp:154:10:154:10 | b |
-| A.cpp:154:13:154:13 | c |
-| A.cpp:159:12:159:18 | new |
-| A.cpp:160:18:160:60 | new |
-| A.cpp:160:29:160:29 | b |
-| A.cpp:160:32:160:59 | new |
-| A.cpp:160:43:160:49 | 0 |
-| A.cpp:160:52:160:58 | 0 |
-| A.cpp:161:18:161:40 | new |
-| A.cpp:161:29:161:35 | 0 |
-| A.cpp:161:38:161:39 | l1 |
-| A.cpp:162:18:162:40 | new |
-| A.cpp:162:29:162:35 | 0 |
-| A.cpp:162:38:162:39 | l2 |
 | A.cpp:163:10:163:11 | l3 |
-| A.cpp:163:14:163:17 | head |
 | A.cpp:164:10:164:11 | l3 |
 | A.cpp:164:14:164:17 | next |
-| A.cpp:164:20:164:23 | head |
 | A.cpp:165:10:165:11 | l3 |
 | A.cpp:165:14:165:17 | next |
 | A.cpp:165:20:165:23 | next |
-| A.cpp:165:26:165:29 | head |
 | A.cpp:166:10:166:11 | l3 |
 | A.cpp:166:14:166:17 | next |
 | A.cpp:166:20:166:23 | next |
 | A.cpp:166:26:166:29 | next |
-| A.cpp:166:32:166:35 | head |
+| A.cpp:167:44:167:44 | l |
 | A.cpp:169:12:169:12 | l |
-| A.cpp:169:15:169:18 | head |
 | A.cpp:183:7:183:10 | this |
 | A.cpp:184:7:184:10 | this |
-| B.cpp:7:16:7:35 | new |
-| B.cpp:7:25:7:25 | e |
-| B.cpp:7:28:7:34 | 0 |
-| B.cpp:8:16:8:27 | new |
-| B.cpp:8:25:8:26 | b1 |
 | B.cpp:9:10:9:11 | b2 |
 | B.cpp:9:14:9:17 | box1 |
-| B.cpp:9:20:9:24 | elem1 |
 | B.cpp:10:10:10:11 | b2 |
 | B.cpp:10:14:10:17 | box1 |
-| B.cpp:10:20:10:24 | elem2 |
-| B.cpp:16:16:16:38 | new |
-| B.cpp:16:28:16:34 | 0 |
-| B.cpp:16:37:16:37 | e |
-| B.cpp:17:16:17:27 | new |
-| B.cpp:17:25:17:26 | b1 |
 | B.cpp:18:10:18:11 | b2 |
 | B.cpp:18:14:18:17 | box1 |
-| B.cpp:18:20:18:24 | elem1 |
 | B.cpp:19:10:19:11 | b2 |
 | B.cpp:19:14:19:17 | box1 |
-| B.cpp:19:20:19:24 | elem2 |
 | B.cpp:35:7:35:10 | this |
 | B.cpp:36:7:36:10 | this |
 | B.cpp:46:7:46:10 | this |
-| C.cpp:18:12:18:18 | new |
-| C.cpp:19:5:19:5 | c |
 | C.cpp:24:5:24:8 | this |
-| C.cpp:29:10:29:11 | s1 |
 | C.cpp:29:10:29:11 | this |
-| C.cpp:30:10:30:11 | s2 |
 | C.cpp:30:10:30:11 | this |
-| C.cpp:31:10:31:11 | s3 |
 | C.cpp:31:10:31:11 | this |
-| C.cpp:32:10:32:11 | s4 |
 | D.cpp:9:21:9:24 | this |
+| D.cpp:10:30:10:33 | this |
 | D.cpp:11:29:11:32 | this |
 | D.cpp:16:21:16:23 | this |
+| D.cpp:17:30:17:32 | this |
 | D.cpp:18:29:18:31 | this |
-| D.cpp:22:10:22:11 | b2 |
-| D.cpp:22:14:22:20 | call to getBox1 |
-| D.cpp:22:25:22:31 | call to getElem |
-| D.cpp:29:15:29:41 | new |
-| D.cpp:29:24:29:40 | new |
-| D.cpp:29:33:29:39 | 0 |
 | D.cpp:30:5:30:5 | b |
 | D.cpp:30:8:30:10 | box |
-| D.cpp:31:14:31:14 | b |
-| D.cpp:36:15:36:41 | new |
-| D.cpp:36:24:36:40 | new |
-| D.cpp:36:33:36:39 | 0 |
 | D.cpp:37:5:37:5 | b |
-| D.cpp:37:8:37:10 | box |
-| D.cpp:37:21:37:21 | e |
-| D.cpp:38:14:38:14 | b |
-| D.cpp:43:15:43:41 | new |
-| D.cpp:43:24:43:40 | new |
-| D.cpp:43:33:43:39 | 0 |
-| D.cpp:44:5:44:5 | b |
 | D.cpp:44:8:44:14 | call to getBox1 |
-| D.cpp:45:14:45:14 | b |
-| D.cpp:50:15:50:41 | new |
-| D.cpp:50:24:50:40 | new |
-| D.cpp:50:33:50:39 | 0 |
-| D.cpp:51:5:51:5 | b |
-| D.cpp:51:8:51:14 | call to getBox1 |
-| D.cpp:51:27:51:27 | e |
-| D.cpp:52:14:52:14 | b |
 | D.cpp:57:5:57:12 | this |
-| D.cpp:57:16:57:42 | new |
-| D.cpp:57:25:57:41 | new |
-| D.cpp:57:34:57:40 | 0 |
 | D.cpp:58:5:58:12 | boxfield |
 | D.cpp:58:5:58:12 | this |
 | D.cpp:58:15:58:17 | box |
-| D.cpp:59:5:59:7 | this |
 | D.cpp:64:10:64:17 | boxfield |
 | D.cpp:64:10:64:17 | this |
 | D.cpp:64:20:64:22 | box |
-| D.cpp:64:25:64:28 | elem |
 | E.cpp:21:10:21:10 | p |
 | E.cpp:21:13:21:16 | data |
-| E.cpp:21:18:21:23 | buffer |
-| E.cpp:28:21:28:23 | raw |
 | E.cpp:29:21:29:21 | b |
-| E.cpp:29:24:29:29 | buffer |
 | E.cpp:30:21:30:21 | p |
 | E.cpp:30:23:30:26 | data |
-| E.cpp:30:28:30:33 | buffer |
-| E.cpp:31:10:31:12 | raw |
 | E.cpp:32:10:32:10 | b |
-| E.cpp:32:13:32:18 | buffer |
-| E.cpp:33:18:33:19 | & ... |
 | aliasing.cpp:9:3:9:3 | s |
 | aliasing.cpp:13:3:13:3 | s |
 | aliasing.cpp:17:3:17:3 | s |
-| aliasing.cpp:25:17:25:19 | & ... |
-| aliasing.cpp:26:19:26:20 | s2 |
+| aliasing.cpp:29:8:29:9 | s1 |
+| aliasing.cpp:30:8:30:9 | s2 |
+| aliasing.cpp:31:8:31:9 | s3 |
 | aliasing.cpp:37:3:37:6 | ref1 |
+| aliasing.cpp:38:8:38:9 | s1 |
 | aliasing.cpp:42:3:42:4 | s2 |
+| aliasing.cpp:43:8:43:11 | ref2 |
 | aliasing.cpp:49:3:49:7 | copy1 |
+| aliasing.cpp:50:8:50:9 | s1 |
 | aliasing.cpp:54:3:54:4 | s2 |
+| aliasing.cpp:55:8:55:12 | copy2 |
 | aliasing.cpp:60:3:60:4 | s2 |
+| aliasing.cpp:62:8:62:12 | copy2 |
+| aliasing.cpp:71:9:71:9 | w |
 | aliasing.cpp:72:3:72:3 | s |
+| aliasing.cpp:73:8:73:8 | w |
+| aliasing.cpp:73:10:73:10 | s |
+| aliasing.cpp:78:11:78:11 | w |
 | aliasing.cpp:79:3:79:3 | s |
+| aliasing.cpp:80:8:80:8 | w |
+| aliasing.cpp:80:10:80:10 | s |
+| aliasing.cpp:85:10:85:10 | w |
 | aliasing.cpp:86:3:86:3 | s |
+| aliasing.cpp:87:8:87:8 | w |
+| aliasing.cpp:87:10:87:10 | s |
 | aliasing.cpp:92:3:92:3 | w |
 | aliasing.cpp:92:5:92:5 | s |
+| aliasing.cpp:93:8:93:8 | w |
+| aliasing.cpp:93:10:93:10 | s |
 | aliasing.cpp:98:3:98:3 | s |
-| aliasing.cpp:111:15:111:19 | & ... |
+| aliasing.cpp:101:14:101:19 | s_copy |
 | aliasing.cpp:111:16:111:16 | s |
-| aliasing.cpp:121:15:121:16 | xs |
-| aliasing.cpp:126:15:126:20 | ... - ... |
-| aliasing.cpp:131:15:131:16 | xs |
-| aliasing.cpp:136:15:136:17 | + ... |
+| aliasing.cpp:112:8:112:8 | s |
 | aliasing.cpp:141:15:141:15 | s |
-| aliasing.cpp:141:17:141:20 | data |
-| aliasing.cpp:147:15:147:22 | & ... |
+| aliasing.cpp:143:8:143:8 | s |
 | aliasing.cpp:147:16:147:19 | access to array |
+| aliasing.cpp:148:8:148:11 | access to array |
 | aliasing.cpp:158:15:158:15 | s |
-| aliasing.cpp:158:17:158:20 | data |
+| aliasing.cpp:159:9:159:9 | s |
 | aliasing.cpp:164:15:164:15 | s |
-| aliasing.cpp:164:17:164:20 | data |
-| aliasing.cpp:175:15:175:22 | & ... |
+| aliasing.cpp:165:8:165:8 | s |
 | aliasing.cpp:175:16:175:17 | s2 |
 | aliasing.cpp:175:19:175:19 | s |
-| aliasing.cpp:181:15:181:22 | & ... |
+| aliasing.cpp:176:8:176:9 | s2 |
+| aliasing.cpp:176:11:176:11 | s |
 | aliasing.cpp:181:16:181:17 | s2 |
 | aliasing.cpp:181:19:181:19 | s |
-| aliasing.cpp:187:15:187:22 | & ... |
+| aliasing.cpp:182:8:182:9 | s2 |
+| aliasing.cpp:182:11:182:11 | s |
 | aliasing.cpp:187:16:187:17 | s2 |
 | aliasing.cpp:187:19:187:19 | s |
-| aliasing.cpp:194:15:194:22 | & ... |
+| aliasing.cpp:189:8:189:11 | s2_2 |
+| aliasing.cpp:189:13:189:13 | s |
 | aliasing.cpp:194:16:194:17 | s2 |
 | aliasing.cpp:194:19:194:19 | s |
-| aliasing.cpp:200:15:200:24 | & ... |
+| aliasing.cpp:196:8:196:11 | s2_2 |
+| aliasing.cpp:196:13:196:13 | s |
 | aliasing.cpp:200:16:200:18 | ps2 |
 | aliasing.cpp:200:21:200:21 | s |
-| aliasing.cpp:205:15:205:24 | & ... |
+| aliasing.cpp:201:8:201:10 | ps2 |
+| aliasing.cpp:201:13:201:13 | s |
 | aliasing.cpp:205:16:205:18 | ps2 |
 | aliasing.cpp:205:21:205:21 | s |
-| arrays.cpp:7:8:7:13 | access to array |
-| arrays.cpp:8:8:8:13 | access to array |
-| arrays.cpp:9:8:9:11 | * ... |
-| arrays.cpp:10:8:10:15 | * ... |
-| arrays.cpp:16:8:16:13 | access to array |
-| arrays.cpp:17:8:17:13 | access to array |
+| aliasing.cpp:206:8:206:10 | ps2 |
+| aliasing.cpp:206:13:206:13 | s |
 | arrays.cpp:36:3:36:3 | o |
 | arrays.cpp:36:3:36:17 | access to array |
 | arrays.cpp:36:5:36:10 | nested |
 | arrays.cpp:37:8:37:8 | o |
 | arrays.cpp:37:8:37:22 | access to array |
 | arrays.cpp:37:10:37:15 | nested |
-| arrays.cpp:37:24:37:27 | data |
 | arrays.cpp:38:8:38:8 | o |
 | arrays.cpp:38:8:38:22 | access to array |
 | arrays.cpp:38:10:38:15 | nested |
-| arrays.cpp:38:24:38:27 | data |
 | arrays.cpp:42:3:42:3 | o |
 | arrays.cpp:42:3:42:20 | access to array |
 | arrays.cpp:42:5:42:12 | indirect |
 | arrays.cpp:43:8:43:8 | o |
 | arrays.cpp:43:8:43:25 | access to array |
 | arrays.cpp:43:10:43:17 | indirect |
-| arrays.cpp:43:27:43:30 | data |
 | arrays.cpp:44:8:44:8 | o |
 | arrays.cpp:44:8:44:25 | access to array |
 | arrays.cpp:44:10:44:17 | indirect |
-| arrays.cpp:44:27:44:30 | data |
 | arrays.cpp:48:3:48:3 | o |
 | arrays.cpp:48:3:48:20 | access to array |
 | arrays.cpp:48:5:48:12 | indirect |
 | arrays.cpp:49:8:49:8 | o |
 | arrays.cpp:49:8:49:25 | access to array |
 | arrays.cpp:49:10:49:17 | indirect |
-| arrays.cpp:49:27:49:30 | data |
 | arrays.cpp:50:8:50:8 | o |
 | arrays.cpp:50:8:50:25 | access to array |
 | arrays.cpp:50:10:50:17 | indirect |
-| arrays.cpp:50:27:50:30 | data |
 | by_reference.cpp:12:5:12:5 | s |
 | by_reference.cpp:16:5:16:8 | this |
-| by_reference.cpp:20:5:20:8 | this |
-| by_reference.cpp:20:23:20:27 | value |
-| by_reference.cpp:24:19:24:22 | this |
-| by_reference.cpp:24:25:24:29 | value |
-| by_reference.cpp:50:3:50:3 | s |
-| by_reference.cpp:50:17:50:26 | call to user_input |
-| by_reference.cpp:51:10:51:20 | call to getDirectly |
-| by_reference.cpp:56:3:56:3 | s |
-| by_reference.cpp:56:19:56:28 | call to user_input |
-| by_reference.cpp:57:10:57:22 | call to getIndirectly |
-| by_reference.cpp:62:3:62:3 | s |
-| by_reference.cpp:62:25:62:34 | call to user_input |
-| by_reference.cpp:63:10:63:28 | call to getThroughNonMember |
-| by_reference.cpp:68:17:68:18 | & ... |
-| by_reference.cpp:68:21:68:30 | call to user_input |
-| by_reference.cpp:69:8:69:20 | call to nonMemberGetA |
+| by_reference.cpp:32:12:32:12 | s |
+| by_reference.cpp:36:12:36:15 | this |
 | by_reference.cpp:84:3:84:7 | inner |
 | by_reference.cpp:88:3:88:7 | inner |
-| by_reference.cpp:102:21:102:39 | & ... |
 | by_reference.cpp:102:22:102:26 | outer |
 | by_reference.cpp:103:21:103:25 | outer |
-| by_reference.cpp:103:27:103:35 | inner_ptr |
-| by_reference.cpp:104:15:104:22 | & ... |
 | by_reference.cpp:104:16:104:20 | outer |
-| by_reference.cpp:106:21:106:41 | & ... |
 | by_reference.cpp:106:22:106:27 | pouter |
 | by_reference.cpp:107:21:107:26 | pouter |
-| by_reference.cpp:107:29:107:37 | inner_ptr |
-| by_reference.cpp:108:15:108:24 | & ... |
 | by_reference.cpp:108:16:108:21 | pouter |
 | by_reference.cpp:110:8:110:12 | outer |
 | by_reference.cpp:110:14:110:25 | inner_nested |
-| by_reference.cpp:110:27:110:27 | a |
 | by_reference.cpp:111:8:111:12 | outer |
 | by_reference.cpp:111:14:111:22 | inner_ptr |
-| by_reference.cpp:111:25:111:25 | a |
 | by_reference.cpp:112:8:112:12 | outer |
-| by_reference.cpp:112:14:112:14 | a |
 | by_reference.cpp:114:8:114:13 | pouter |
 | by_reference.cpp:114:16:114:27 | inner_nested |
-| by_reference.cpp:114:29:114:29 | a |
 | by_reference.cpp:115:8:115:13 | pouter |
 | by_reference.cpp:115:16:115:24 | inner_ptr |
-| by_reference.cpp:115:27:115:27 | a |
 | by_reference.cpp:116:8:116:13 | pouter |
-| by_reference.cpp:116:16:116:16 | a |
 | by_reference.cpp:122:21:122:25 | outer |
-| by_reference.cpp:122:27:122:38 | inner_nested |
-| by_reference.cpp:123:21:123:36 | * ... |
 | by_reference.cpp:123:22:123:26 | outer |
 | by_reference.cpp:124:15:124:19 | outer |
-| by_reference.cpp:124:21:124:21 | a |
 | by_reference.cpp:126:21:126:26 | pouter |
-| by_reference.cpp:126:29:126:40 | inner_nested |
-| by_reference.cpp:127:21:127:38 | * ... |
 | by_reference.cpp:127:22:127:27 | pouter |
 | by_reference.cpp:128:15:128:20 | pouter |
-| by_reference.cpp:128:23:128:23 | a |
 | by_reference.cpp:130:8:130:12 | outer |
 | by_reference.cpp:130:14:130:25 | inner_nested |
-| by_reference.cpp:130:27:130:27 | a |
 | by_reference.cpp:131:8:131:12 | outer |
 | by_reference.cpp:131:14:131:22 | inner_ptr |
-| by_reference.cpp:131:25:131:25 | a |
 | by_reference.cpp:132:8:132:12 | outer |
-| by_reference.cpp:132:14:132:14 | a |
 | by_reference.cpp:134:8:134:13 | pouter |
 | by_reference.cpp:134:16:134:27 | inner_nested |
-| by_reference.cpp:134:29:134:29 | a |
 | by_reference.cpp:135:8:135:13 | pouter |
 | by_reference.cpp:135:16:135:24 | inner_ptr |
-| by_reference.cpp:135:27:135:27 | a |
 | by_reference.cpp:136:8:136:13 | pouter |
-| by_reference.cpp:136:16:136:16 | a |
+| complex.cpp:9:20:9:21 | this |
+| complex.cpp:10:20:10:21 | this |
 | complex.cpp:11:22:11:23 | this |
 | complex.cpp:12:22:12:23 | this |
 | complex.cpp:42:8:42:8 | b |
 | complex.cpp:42:10:42:14 | inner |
-| complex.cpp:42:16:42:16 | f |
 | complex.cpp:43:8:43:8 | b |
 | complex.cpp:43:10:43:14 | inner |
-| complex.cpp:43:16:43:16 | f |
 | complex.cpp:53:3:53:4 | b1 |
 | complex.cpp:53:6:53:10 | inner |
-| complex.cpp:53:12:53:12 | f |
 | complex.cpp:54:3:54:4 | b2 |
 | complex.cpp:54:6:54:10 | inner |
-| complex.cpp:54:12:54:12 | f |
 | complex.cpp:55:3:55:4 | b3 |
 | complex.cpp:55:6:55:10 | inner |
-| complex.cpp:55:12:55:12 | f |
 | complex.cpp:56:3:56:4 | b3 |
 | complex.cpp:56:6:56:10 | inner |
-| complex.cpp:56:12:56:12 | f |
-| complex.cpp:59:7:59:8 | b1 |
-| complex.cpp:62:7:62:8 | b2 |
-| complex.cpp:65:7:65:8 | b3 |
-| complex.cpp:68:7:68:8 | b4 |
 | conflated.cpp:10:4:10:5 | ra |
-| conflated.cpp:19:19:19:21 | raw |
-| conflated.cpp:20:8:20:10 | raw |
+| conflated.cpp:11:9:11:10 | ra |
 | conflated.cpp:29:3:29:4 | pa |
+| conflated.cpp:30:8:30:9 | pa |
 | conflated.cpp:36:3:36:4 | pa |
+| conflated.cpp:37:8:37:9 | pa |
 | conflated.cpp:53:3:53:4 | ll |
 | conflated.cpp:54:3:54:4 | ll |
 | conflated.cpp:54:7:54:10 | next |
-| conflated.cpp:59:20:59:39 | new |
-| conflated.cpp:59:35:59:38 | next |
+| conflated.cpp:55:8:55:9 | ll |
+| conflated.cpp:55:12:55:15 | next |
 | conflated.cpp:60:3:60:4 | ll |
 | conflated.cpp:60:7:60:10 | next |
+| conflated.cpp:61:8:61:9 | ll |
+| conflated.cpp:61:12:61:15 | next |
+| constructors.cpp:18:22:18:23 | this |
+| constructors.cpp:19:22:19:23 | this |
 | constructors.cpp:20:24:20:25 | this |
 | constructors.cpp:21:24:21:25 | this |
-| constructors.cpp:28:10:28:10 | f |
-| constructors.cpp:29:10:29:10 | f |
-| constructors.cpp:40:9:40:9 | f |
-| constructors.cpp:43:9:43:9 | g |
-| constructors.cpp:46:9:46:9 | h |
-| constructors.cpp:49:9:49:9 | i |
 | qualifiers.cpp:9:30:9:33 | this |
 | qualifiers.cpp:12:49:12:53 | inner |
 | qualifiers.cpp:13:51:13:55 | inner |
-| qualifiers.cpp:22:5:22:9 | outer |
+| qualifiers.cpp:18:32:18:36 | this |
 | qualifiers.cpp:22:11:22:18 | call to getInner |
 | qualifiers.cpp:23:10:23:14 | outer |
 | qualifiers.cpp:23:16:23:20 | inner |
-| qualifiers.cpp:23:23:23:23 | a |
-| qualifiers.cpp:27:5:27:9 | outer |
-| qualifiers.cpp:27:11:27:18 | call to getInner |
-| qualifiers.cpp:27:28:27:37 | call to user_input |
 | qualifiers.cpp:28:10:28:14 | outer |
 | qualifiers.cpp:28:16:28:20 | inner |
-| qualifiers.cpp:28:23:28:23 | a |
-| qualifiers.cpp:32:17:32:21 | outer |
-| qualifiers.cpp:32:23:32:30 | call to getInner |
-| qualifiers.cpp:32:35:32:44 | call to user_input |
 | qualifiers.cpp:33:10:33:14 | outer |
 | qualifiers.cpp:33:16:33:20 | inner |
-| qualifiers.cpp:33:23:33:23 | a |
-| qualifiers.cpp:37:19:37:35 | * ... |
-| qualifiers.cpp:37:20:37:24 | outer |
-| qualifiers.cpp:37:38:37:47 | call to user_input |
 | qualifiers.cpp:38:10:38:14 | outer |
 | qualifiers.cpp:38:16:38:20 | inner |
-| qualifiers.cpp:38:23:38:23 | a |
 | qualifiers.cpp:42:6:42:22 | * ... |
-| qualifiers.cpp:42:7:42:11 | outer |
 | qualifiers.cpp:43:10:43:14 | outer |
 | qualifiers.cpp:43:16:43:20 | inner |
-| qualifiers.cpp:43:23:43:23 | a |
-| qualifiers.cpp:47:6:47:11 | & ... |
 | qualifiers.cpp:47:15:47:22 | call to getInner |
 | qualifiers.cpp:48:10:48:14 | outer |
 | qualifiers.cpp:48:16:48:20 | inner |
-| qualifiers.cpp:48:23:48:23 | a |
-| realistic.cpp:42:20:42:20 | o |
 | realistic.cpp:49:9:49:11 | foo |
 | realistic.cpp:49:9:49:18 | access to array |
 | realistic.cpp:53:9:53:11 | foo |
@@ -452,58 +265,53 @@
 | realistic.cpp:54:16:54:25 | access to array |
 | realistic.cpp:54:27:54:29 | baz |
 | realistic.cpp:54:32:54:40 | userInput |
-| realistic.cpp:54:42:54:47 | buffer |
-| realistic.cpp:60:16:60:18 | dst |
+| realistic.cpp:55:12:55:14 | foo |
+| realistic.cpp:55:12:55:21 | access to array |
+| realistic.cpp:55:23:55:25 | baz |
+| realistic.cpp:55:28:55:36 | userInput |
+| realistic.cpp:57:88:57:90 | foo |
+| realistic.cpp:57:88:57:97 | access to array |
+| realistic.cpp:57:99:57:101 | baz |
+| realistic.cpp:57:104:57:112 | userInput |
+| realistic.cpp:60:21:60:23 | foo |
+| realistic.cpp:60:21:60:30 | access to array |
+| realistic.cpp:60:32:60:34 | baz |
+| realistic.cpp:60:37:60:45 | userInput |
+| realistic.cpp:60:55:60:57 | foo |
+| realistic.cpp:60:55:60:64 | access to array |
+| realistic.cpp:60:66:60:68 | baz |
+| realistic.cpp:60:71:60:79 | userInput |
 | realistic.cpp:61:21:61:23 | foo |
 | realistic.cpp:61:21:61:30 | access to array |
 | realistic.cpp:61:32:61:34 | baz |
 | realistic.cpp:61:37:61:45 | userInput |
-| realistic.cpp:61:47:61:55 | bufferLen |
 | realistic.cpp:65:21:65:23 | foo |
 | realistic.cpp:65:21:65:30 | access to array |
 | realistic.cpp:65:32:65:34 | baz |
 | realistic.cpp:65:37:65:45 | userInput |
-| realistic.cpp:65:47:65:52 | buffer |
-| realistic.cpp:66:21:66:23 | dst |
+| simple.cpp:18:22:18:23 | this |
+| simple.cpp:19:22:19:23 | this |
 | simple.cpp:20:24:20:25 | this |
 | simple.cpp:21:24:21:25 | this |
-| simple.cpp:28:10:28:10 | f |
-| simple.cpp:29:10:29:10 | f |
-| simple.cpp:39:5:39:5 | f |
-| simple.cpp:40:5:40:5 | g |
-| simple.cpp:41:5:41:5 | h |
-| simple.cpp:42:5:42:5 | h |
-| simple.cpp:45:9:45:9 | f |
-| simple.cpp:48:9:48:9 | g |
-| simple.cpp:51:9:51:9 | h |
-| simple.cpp:54:9:54:9 | i |
 | simple.cpp:65:5:65:5 | a |
+| simple.cpp:67:10:67:11 | a2 |
+| simple.cpp:79:16:79:17 | f2 |
+| simple.cpp:79:16:79:17 | this |
 | simple.cpp:83:9:83:10 | f2 |
 | simple.cpp:83:9:83:10 | this |
-| simple.cpp:84:14:84:20 | this |
 | simple.cpp:92:5:92:5 | a |
+| simple.cpp:94:10:94:11 | a2 |
 | struct_init.c:15:8:15:9 | ab |
-| struct_init.c:15:12:15:12 | a |
 | struct_init.c:16:8:16:9 | ab |
-| struct_init.c:16:12:16:12 | b |
 | struct_init.c:22:8:22:9 | ab |
-| struct_init.c:22:11:22:11 | a |
 | struct_init.c:23:8:23:9 | ab |
-| struct_init.c:23:11:23:11 | b |
-| struct_init.c:24:10:24:12 | & ... |
 | struct_init.c:31:8:31:12 | outer |
 | struct_init.c:31:14:31:21 | nestedAB |
-| struct_init.c:31:23:31:23 | a |
 | struct_init.c:32:8:32:12 | outer |
 | struct_init.c:32:14:32:21 | nestedAB |
-| struct_init.c:32:23:32:23 | b |
 | struct_init.c:33:8:33:12 | outer |
 | struct_init.c:33:14:33:22 | pointerAB |
-| struct_init.c:33:25:33:25 | a |
 | struct_init.c:34:8:34:12 | outer |
 | struct_init.c:34:14:34:22 | pointerAB |
-| struct_init.c:34:25:34:25 | b |
-| struct_init.c:36:10:36:24 | & ... |
 | struct_init.c:36:11:36:15 | outer |
 | struct_init.c:46:10:46:14 | outer |
-| struct_init.c:46:16:46:24 | pointerAB |

cpp/ql/test/library-tests/dataflow/fields/partial-definition.ql

@@ -3,6 +3,6 @@
  */
 
 import cpp
-import semmle.code.cpp.dataflow.DataFlow::DataFlow
+import semmle.code.cpp.dataflow.old.DataFlow::DataFlow
 
 select any(Node n).asPartialDefinition()

cpp/ql/test/library-tests/dataflow/fields/path-flow.ql

@@ -2,7 +2,7 @@
  * @kind path-problem
  */
 
-import semmle.code.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.old.DataFlow2
 import ASTConfiguration
 import DataFlow::PathGraph
 

cpp/ql/test/library-tests/dataflow/partialdefinitions/partialdefinitions.ql

@@ -1,4 +1,4 @@
-import semmle.code.cpp.dataflow.internal.FlowVar
+import semmle.code.cpp.dataflow.old.internal.FlowVar
 
 from PartialDefinition def
 select def.getActualLocation().toString(), "partial def of " + def.toString(), def,

cpp/ql/test/library-tests/dataflow/security-taint/tainted_diff.expected

@@ -23,8 +23,12 @@
 | test.cpp:68:28:68:33 | call to getenv | test.cpp:69:10:69:13 | copy | AST only |
 | test.cpp:68:28:68:33 | call to getenv | test.cpp:70:5:70:10 | call to strcpy | AST only |
 | test.cpp:68:28:68:33 | call to getenv | test.cpp:70:12:70:15 | copy | AST only |
-| test.cpp:68:28:68:33 | call to getenv | test.cpp:71:12:71:15 | copy | AST only |
+| test.cpp:68:28:68:33 | call to getenv | test.cpp:71:12:71:15 | array to pointer conversion | IR only |
 | test.cpp:75:20:75:25 | call to getenv | test.cpp:15:22:15:25 | nptr | AST only |
+| test.cpp:75:20:75:25 | call to getenv | test.cpp:76:9:76:11 | len | IR only |
+| test.cpp:75:20:75:25 | call to getenv | test.cpp:77:36:77:38 | (unsigned long)... | IR only |
+| test.cpp:75:20:75:25 | call to getenv | test.cpp:77:36:77:38 | len | IR only |
+| test.cpp:75:20:75:25 | call to getenv | test.cpp:77:36:77:55 | ... * ... | IR only |
 | test.cpp:83:28:83:33 | call to getenv | test.cpp:8:24:8:25 | s1 | AST only |
 | test.cpp:83:28:83:33 | call to getenv | test.cpp:11:20:11:21 | s1 | AST only |
 | test.cpp:83:28:83:33 | call to getenv | test.cpp:11:36:11:37 | s2 | AST only |

cpp/ql/test/library-tests/dataflow/security-taint/tainted_ir.expected

@@ -20,9 +20,15 @@
 | test.cpp:68:28:68:33 | call to getenv | test.cpp:68:28:68:33 | call to getenv |
 | test.cpp:68:28:68:33 | call to getenv | test.cpp:68:28:68:46 | (const char *)... |
 | test.cpp:68:28:68:33 | call to getenv | test.cpp:70:18:70:25 | userName |
+| test.cpp:68:28:68:33 | call to getenv | test.cpp:71:12:71:15 | array to pointer conversion |
+| test.cpp:68:28:68:33 | call to getenv | test.cpp:71:12:71:15 | copy |
 | test.cpp:75:20:75:25 | call to getenv | test.cpp:75:15:75:18 | call to atoi |
 | test.cpp:75:20:75:25 | call to getenv | test.cpp:75:20:75:25 | call to getenv |
 | test.cpp:75:20:75:25 | call to getenv | test.cpp:75:20:75:45 | (const char *)... |
+| test.cpp:75:20:75:25 | call to getenv | test.cpp:76:9:76:11 | len |
+| test.cpp:75:20:75:25 | call to getenv | test.cpp:77:36:77:38 | (unsigned long)... |
+| test.cpp:75:20:75:25 | call to getenv | test.cpp:77:36:77:38 | len |
+| test.cpp:75:20:75:25 | call to getenv | test.cpp:77:36:77:55 | ... * ... |
 | test.cpp:83:28:83:33 | call to getenv | test.cpp:83:28:83:33 | call to getenv |
 | test.cpp:83:28:83:33 | call to getenv | test.cpp:83:28:83:46 | (const char *)... |
 | test.cpp:83:28:83:33 | call to getenv | test.cpp:86:15:86:22 | userName |

cpp/ql/test/library-tests/dataflow/smart-pointers-taint/taint.ql

@@ -1,24 +1,5 @@
 import TestUtilities.dataflow.FlowTestCommon
 
-module AstTest {
-  private import semmle.code.cpp.dataflow.TaintTracking
-
-  class AstSmartPointerTaintConfig extends TaintTracking::Configuration {
-    AstSmartPointerTaintConfig() { this = "ASTSmartPointerTaintConfig" }
-
-    override predicate isSource(DataFlow::Node source) {
-      source.asExpr().(FunctionCall).getTarget().getName() = "source"
-    }
-
-    override predicate isSink(DataFlow::Node sink) {
-      exists(FunctionCall call |
-        call.getTarget().getName() = "sink" and
-        sink.asExpr() = call.getAnArgument()
-      )
-    }
-  }
-}
-
 module IRTest {
   private import semmle.code.cpp.ir.dataflow.TaintTracking
 

cpp/ql/test/library-tests/dataflow/smart-pointers-taint/test.cpp

@@ -7,8 +7,8 @@ void test_unique_ptr_int() {
 	std::unique_ptr<int> p1(new int(source()));
 	std::unique_ptr<int> p2 = std::make_unique<int>(source());
 	
-	sink(*p1); // $ MISSING: ast,ir
-	sink(*p2); // $ ast ir=8:50
+	sink(*p1); // $ ir
+	sink(*p2); // $ ir=8:50
 }
 
 struct A {
@@ -21,9 +21,9 @@ void test_unique_ptr_struct() {
 	std::unique_ptr<A> p1(new A{source(), 0});
 	std::unique_ptr<A> p2 = std::make_unique<A>(source(), 0);
 	
-	sink(p1->x); // $ MISSING: ast,ir
+	sink(p1->x); // $ ir
 	sink(p1->y);
-	sink(p2->x); // $ MISSING: ast,ir=22:46
+	sink(p2->x); // $ ir=22:46
 	sink(p2->y);
 }
 
@@ -31,16 +31,16 @@ void test_shared_ptr_int() {
 	std::shared_ptr<int> p1(new int(source()));
 	std::shared_ptr<int> p2 = std::make_shared<int>(source());
 	
-	sink(*p1); // $ ast MISSING: ir
-	sink(*p2); // $ ast ir=32:50 
+	sink(*p1); // $ ir
+	sink(*p2); // $ ir=32:50 
 }
 
 void test_shared_ptr_struct() {
 	std::shared_ptr<A> p1(new A{source(), 0});
 	std::shared_ptr<A> p2 = std::make_shared<A>(source(), 0);
 	
-	sink(p1->x); // $ MISSING: ast,ir
+	sink(p1->x); // $ MISSING: ir
 	sink(p1->y);
-	sink(p2->x); // $ MISSING: ast,ir
+	sink(p2->x); // $ MISSING: ir
 	sink(p2->y);
 }

cpp/ql/test/library-tests/dataflow/stackaddress/StackPointerFlowsToUse.ql

@@ -1,5 +1,5 @@
 import cpp
-import semmle.code.cpp.dataflow.StackAddress
+import semmle.code.cpp.dataflow.old.StackAddress
 
 from FunctionCall call, Expr use, Type useType, Expr source, boolean isLocal
 where

cpp/ql/test/library-tests/dataflow/taint-tests/arrayassignment.cpp

@@ -13,10 +13,10 @@ void test_pointer_deref_assignment()
 
 	*p_x = source();
 
-	sink(x); // $ MISSING: ast,ir
-	sink(*p_x); // $ ast,ir
-	sink(*p2_x); // $ MISSING: ast,ir
-	sink(r_x); // $ MISSING: ast,ir
+	sink(x); // $ MISSING: ir
+	sink(*p_x); // $ ir
+	sink(*p2_x); // $ MISSING: ir
+	sink(r_x); // $ MISSING: ir
 }
 
 void test_reference_deref_assignment()
@@ -28,10 +28,10 @@ void test_reference_deref_assignment()
 
 	r_x = source();
 
-	sink(x); // $ MISSING: ast,ir
-	sink(*p_x); // $ MISSING: ast,ir
-	sink(r_x); // $ ast,ir
-	sink(r2_x); // $ MISSING: ast,ir
+	sink(x); // $ MISSING: ir
+	sink(*p_x); // $ MISSING: ir
+	sink(r_x); // $ ir
+	sink(r2_x); // $ MISSING: ir
 }
 
 class MyInt
@@ -53,8 +53,8 @@ void test_myint_member_assignment()
 
 	mi.i = source();
 
-	sink(mi); // $ MISSING: ast,ir
-	sink(mi.get()); // $ ast MISSING: ir
+	sink(mi); // $ MISSING: ir
+	sink(mi.get()); // $ ir
 }
 
 void test_myint_method_assignment()
@@ -63,8 +63,8 @@ void test_myint_method_assignment()
 
 	mi.get() = source();
 
-	sink(mi); // $ ir MISSING: ast
-	sink(mi.get()); // $ ast MISSING: ir
+	sink(mi); // $ MISSING: ir
+	sink(mi.get()); // $ MISSING: ir
 }
 
 void test_myint_overloaded_assignment()
@@ -74,10 +74,10 @@ void test_myint_overloaded_assignment()
 	mi = source();
 	mi2 = mi;
 
-	sink(mi); // $ MISSING: ast,ir
-	sink(mi.get()); // $ MISSING: ast,ir
-	sink(mi2); // $ MISSING: ast,ir
-	sink(mi2.get()); // $ MISSING: ast,ir
+	sink(mi); // $ MISSING: ir
+	sink(mi.get()); // $ MISSING: ir
+	sink(mi2); // $ MISSING: ir
+	sink(mi2.get()); // $ MISSING: ir
 }
 
 class MyArray
@@ -98,7 +98,7 @@ void test_myarray_member_assignment()
 
 	ma.values[0] = source();
 
-	sink(ma.values[0]); // $ ast,ir
+	sink(ma.values[0]); // $ ir
 }
 
 void test_myarray_method_assignment()
@@ -107,7 +107,7 @@ void test_myarray_method_assignment()
 
 	ma.get(0) = source();
 
-	sink(ma.get(0)); // $ MISSING: ast,ir
+	sink(ma.get(0)); // $ MISSING: ir
 }
 
 void test_myarray_overloaded_assignment()
@@ -117,8 +117,8 @@ void test_myarray_overloaded_assignment()
 	ma[0] = source();
 	ma2 = ma;
 
-	sink(ma[0]); // $ MISSING: ast,ir
-	sink(ma2[0]); // $ MISSING: ast,ir
+	sink(ma[0]); // $ MISSING: ir
+	sink(ma2[0]); // $ MISSING: ir
 }
 
 void sink(int *);
@@ -132,16 +132,16 @@ void test_array_reference_assignment()
 	int *ptr2, *ptr3;
 
 	ref1 = source();
-	sink(ref1); // $ ast,ir
-	sink(arr1[5]); // $ MISSING: ast,ir
+	sink(ref1); // $ ir
+	sink(arr1[5]); // $ MISSING: ir
 
 	ptr2 = &(arr2[5]);
 	*ptr2 = source();
-	sink(*ptr2); // $ ast,ir
-	sink(arr2[5]); // $ MISSING: ast,ir
+	sink(*ptr2); // $ ir
+	sink(arr2[5]); // $ MISSING: ir
 
 	ptr3 = arr3;
 	ptr3[5] = source();
-	sink(ptr3[5]); // $ ast,ir
-	sink(arr3[5]); // $ MISSING: ast,ir
+	sink(ptr3[5]); // $ ir
+	sink(arr3[5]); // $ MISSING: ir
 }

cpp/ql/test/library-tests/dataflow/taint-tests/bsd.cpp

@@ -19,6 +19,6 @@ void test_accept() {
   int size = sizeof(sockaddr);
   int a = accept(s, &addr, &size);
 
-  sink(a); // $ ast=17:11 ir SPURIOUS: ast=18:12
-  sink(addr); // $ ast,ir
+  sink(a); // $ ir
+  sink(addr); // $ MISSING: ir
 }

cpp/ql/test/library-tests/dataflow/taint-tests/constructor_delegation.cpp

@@ -34,14 +34,14 @@ void test_inits()
 	MyDerivedValue v11(true, source());
 
 	sink(v1.x);
-	sink(v2.x); // $ ast,ir
+	sink(v2.x); // $ ir
 	sink(v3.x);
-	sink(v4.x); // $ ir MISSING: ast
+	sink(v4.x); // $ ir
 	sink(v5.x);
-	sink(v6.x); // $ ir MISSING: ast
-	sink(v7.x); // $ ir MISSING: ast
+	sink(v6.x); // $ ir
+	sink(v7.x); // $ ir
 	sink(v8.x);
 	sink(v9.x);
 	sink(v10.x);
-	sink(v11.x); // $ ir MISSING: ast
+	sink(v11.x); // $ ir
 }

cpp/ql/test/library-tests/dataflow/taint-tests/copyableclass.cpp

@@ -37,10 +37,10 @@ void test_copyableclass()
 		MyCopyableClass s4;
 		s4 = source();
 
-		sink(s1); // $ ast,ir
-		sink(s2); // $ ast,ir
-		sink(s3); // $ ast,ir
-		sink(s4); // $ ast,ir
+		sink(s1); // $ ir
+		sink(s2); // $ ir
+		sink(s3); // $ ir
+		sink(s4); // $ ir
 	}
 
 	{
@@ -62,8 +62,8 @@ void test_copyableclass()
 		MyCopyableClass s3;
 		s2 = MyCopyableClass(source());
 
-		sink(s1); // $ ast,ir
-		sink(s2); // $ ast,ir
-		sink(s3 = source()); // $ ast,ir
+		sink(s1); // $ ir
+		sink(s2); // $ ir
+		sink(s3 = source()); // $ ir
 	}
 }

cpp/ql/test/library-tests/dataflow/taint-tests/copyableclass_declonly.cpp

@@ -37,10 +37,10 @@ void test_copyableclass_declonly()
 		MyCopyableClassDeclOnly s4;
 		s4 = source();
 
-		sink(s1); // $ ast,ir
-		sink(s2); // $ ast,ir
-		sink(s3); // $ ast,ir
-		sink(s4); // $ ast,ir
+		sink(s1); // $ ir
+		sink(s2); // $ ir
+		sink(s3); // $ ir
+		sink(s4); // $ ir
 	}
 
 	{
@@ -62,8 +62,8 @@ void test_copyableclass_declonly()
 		MyCopyableClassDeclOnly s3;
 		s2 = MyCopyableClassDeclOnly(source());
 
-		sink(s1); // $ ast,ir
-		sink(s2); // $ ast,ir
-		sink(s3 = source()); // $ ast,ir
+		sink(s1); // $ ir
+		sink(s2); // $ ir
+		sink(s3 = source()); // $ ir
 	}
 }

cpp/ql/test/library-tests/dataflow/taint-tests/format.cpp

@@ -54,22 +54,22 @@ void test1()
 	{
 		char buffer[256] = {0};
 		sink(snprintf(buffer, 256, "%s", string::source()));
-		sink(buffer); // $ ast,ir
+		sink(buffer); // $ MISSING: ir
 	}
 	{
 		char buffer[256] = {0};
 		sink(snprintf(buffer, 256, string::source(), "Hello."));
-		sink(buffer); // $ ast,ir
+		sink(buffer); // $ MISSING: ir
 	}
 	{
 		char buffer[256] = {0};
 		sink(snprintf(buffer, 256, "%s %s %s", "a", "b", string::source()));
-		sink(buffer); // $ ast,ir
+		sink(buffer); // $ MISSING: ir
 	}
 	{
 		char buffer[256] = {0};
 		sink(snprintf(buffer, 256, "%.*s", 10, string::source()));
-		sink(buffer); // $ ast,ir
+		sink(buffer); // $ MISSING: ir
 	}
 
 	{
@@ -80,39 +80,39 @@ void test1()
 	{
 		char buffer[256] = {0};
 		sink(snprintf(buffer, 256, "%i", source()));
-		sink(buffer); // $ ast,ir
+		sink(buffer); // $ MISSING: ir
 	}
 	{
 		char buffer[256] = {0};
 		sink(snprintf(buffer, 256, "%.*s", source(), "Hello."));
-		sink(buffer); // $ ast,ir
+		sink(buffer); // $ MISSING: ir
 	}
 
 	{
 		char buffer[256] = {0};
 		sink(snprintf(buffer, 256, "%p", string::source()));
-		sink(buffer); // $ ast,ir // tainted (debatable)
+		sink(buffer); // $ MISSING: ir // tainted (debatable)
 	}
 
 	{
 		char buffer[256] = {0};
 		sink(sprintf(buffer, "%s", string::source()));
-		sink(buffer); // $ ast,ir
+		sink(buffer); // $ MISSING: ir
 	}
 	{
 		char buffer[256] = {0};
 		sink(sprintf(buffer, "%ls", wstring::source()));
-		sink(buffer); // $ ast,ir
+		sink(buffer); // $ MISSING: ir
 	}
 	{
 		wchar_t wbuffer[256] = {0};
 		sink(swprintf(wbuffer, 256, L"%s", wstring::source()));
-		sink(wbuffer); // $ ast,ir
+		sink(wbuffer); // $ MISSING: ir
 	}
 	{
 		char buffer[256] = {0};
 		sink(mysprintf(buffer, 256, "%s", string::source()));
-		sink(buffer); // $ ast,ir
+		sink(buffer); // $ MISSING: ir
 	}
 
 	{
@@ -123,7 +123,7 @@ void test1()
 	{
 		int i = 0;
 		sink(sscanf(string::source(), "%i", &i));
-		sink(i); // $ ast,ir
+		sink(i); // $ ir
 	}
 	{
 		char buffer[256] = {0};
@@ -133,7 +133,7 @@ void test1()
 	{
 		char buffer[256] = {0};
 		sink(sscanf(string::source(), "%s", &buffer));
-		sink(buffer); // $ ast,ir
+		sink(buffer); // $ MISSING: ir
 	}
 }
 
@@ -154,6 +154,6 @@ void test2()
 	i = strlen(s) + 1;
 	sink(i);
 
-	sink(s[strlen(s) - 1]); // $ ast,ir
-	sink(ws + (wcslen(ws) / 2)); // $ ast,ir
+	sink(s[strlen(s) - 1]); // $ ir
+	sink(ws + (wcslen(ws) / 2)); // $ ir
 }

cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.ql

@@ -1,5 +1,5 @@
 import cpp
-import semmle.code.cpp.dataflow.TaintTracking
+import semmle.code.cpp.dataflow.old.TaintTracking
 
 from DataFlow::Node nodeFrom, DataFlow::Node nodeTo, string msg
 where

cpp/ql/test/library-tests/dataflow/taint-tests/map.cpp

@@ -26,14 +26,14 @@ void test_pair()
 	sink(a);
 
 	b.first = source();
-	sink(b.first); // $ ast,ir
+	sink(b.first); // $ ir
 	sink(b.second);
-	sink(b); // $ ir MISSING: ast
+	sink(b); // $ MISSING: ir
 
 	c.second = source();
 	sink(c.first);
-	sink(c.second); // $ ast,ir
-	sink(c); // $ ir MISSING: ast
+	sink(c.second); // $ ir
+	sink(c); // $ MISSING: ir
 
 	std::pair<char *, char *> d("123", "456");
 	sink(d.first);
@@ -41,25 +41,25 @@ void test_pair()
 	sink(d);
 
 	std::pair<char *, char *> e(source(), "456");
-	sink(e.first); // $ ast,ir
+	sink(e.first); // $ ir
 	sink(e.second);
-	sink(e); // $ ir MISSING: ast
+	sink(e); // $ MISSING: ir
 
 	std::pair<char *, char *> f("123", source());
 	sink(f.first);
-	sink(f.second); // $ ast,ir
-	sink(f); // $ ast,ir
+	sink(f.second); // $ ir
+	sink(f); // $ ir
 
 	std::pair<char *, char *> g(f);
 	sink(g.first);
-	sink(g.second); // $ ast,ir
-	sink(g); // $ ast,ir
+	sink(g.second); // $ ir
+	sink(g); // $ ir
 
 	std::pair<char *, char *> h;
 	h = f;
 	sink(h.first);
-	sink(h.second); // $ ast,ir
-	sink(h); // $ ast,ir
+	sink(h.second); // $ ir
+	sink(h); // $ ir
 
 	std::pair<char *, char *> i("123", "456");
 	std::pair<char *, char *> j("123", source());
@@ -68,34 +68,34 @@ void test_pair()
  	i.swap(j);
 	k.swap(l);
 	sink(i.first);
-	sink(i.second); // $ MISSING: ast,ir
-	sink(i); // $ ast,ir
+	sink(i.second); // $ MISSING: ir
+	sink(i); // $ ir
 	sink(j.first);
-	sink(j.second); // $ SPURIOUS: ast,ir
-	sink(j); // $ SPURIOUS: ast,ir
+	sink(j.second); // $ SPURIOUS: ir
+	sink(j); // $ SPURIOUS: ir
 	sink(k.first);
-	sink(k.second); // $ SPURIOUS: ast,ir
-	sink(k); // $ SPURIOUS: ast,ir
+	sink(k.second); // $ SPURIOUS: ir
+	sink(k); // $ SPURIOUS: ir
 	sink(l.first);
-	sink(l.second); // $ MISSING: ast,ir
-	sink(l); // $ ast,ir
+	sink(l.second); // $ MISSING: ir
+	sink(l); // $ ir
 
 	sink(make_pair("123", "456"));
 	sink(make_pair("123", "456").first);
 	sink(make_pair("123", "456").second);
-	sink(make_pair(source(), "456")); // $ MISSING: ast,ir
-	sink(make_pair(source(), "456").first); // $ ast,ir
+	sink(make_pair(source(), "456")); // $ MISSING: ir
+	sink(make_pair(source(), "456").first); // $ ir
 	sink(make_pair(source(), "456").second);
-	sink(make_pair("123", source())); // $ ast,ir
+	sink(make_pair("123", source())); // $ ir
 	sink(make_pair("123", source()).first);
-	sink(make_pair("123", source()).second); // $ ast,ir
+	sink(make_pair("123", source()).second); // $ ir
 
 	std::pair<std::pair<char *, char *>, char *> m;
 	m = make_pair(make_pair("123", source()), "789");
-	sink(m); // $ MISSING: ast,ir
-	sink(m.first); // $ MISSING: ast,ir
+	sink(m); // $ MISSING: ir
+	sink(m.first); // $ MISSING: ir
 	sink(m.first.first);
-	sink(m.first.second); // $ MISSING: ast,ir
+	sink(m.first.second); // $ MISSING: ir
 	sink(m.second);
 }
 
@@ -106,40 +106,40 @@ void test_map()
 
 	sink(m1.insert(std::make_pair("abc", "def")).first);
 	sink(m2.insert(std::make_pair("abc", source())).first);
-	sink(m3.insert(std::make_pair(source(), "def")).first); // $ MISSING: ast,ir
-	sink(m4.insert(m4.begin(), std::pair<char *, char *>("abc", source()))); // $ ast,ir
+	sink(m3.insert(std::make_pair(source(), "def")).first); // $ MISSING: ir
+	sink(m4.insert(m4.begin(), std::pair<char *, char *>("abc", source()))); // $ ir
 	sink(m5.insert_or_assign("abc", source()).first);
-	sink(m6.insert_or_assign(m6.begin(), "abc", source())); // $ ast,ir
+	sink(m6.insert_or_assign(m6.begin(), "abc", source())); // $ ir
 	sink(m1);
-	sink(m2); // $ ast,ir
-	sink(m3); // $ MISSING: ast,ir
-	sink(m4); // $ ast,ir
-	sink(m5); // $ ast,ir
-	sink(m6); // $ ast,ir
+	sink(m2); // $ ir
+	sink(m3); // $ MISSING: ir
+	sink(m4); // $ ir
+	sink(m5); // $ ir
+	sink(m6); // $ ir
 	sink(m1.find("abc"));
-	sink(m2.find("abc")); // $ ast,ir
+	sink(m2.find("abc")); // $ ir
 	sink(m3.find("abc"));
-	sink(m4.find("abc")); // $ ast,ir
-	sink(m5.find("abc")); // $ ast,ir
-	sink(m6.find("abc")); // $ ast,ir
+	sink(m4.find("abc")); // $ ir
+	sink(m5.find("abc")); // $ ir
+	sink(m6.find("abc")); // $ ir
 	sink(m1.find("def"));
-	sink(m2.find("def")); // $ SPURIOUS: ast,ir
+	sink(m2.find("def")); // $ SPURIOUS: ir
 	sink(m3.find("def"));
-	sink(m4.find("def")); // $ SPURIOUS: ast,ir
-	sink(m5.find("def")); // $ SPURIOUS: ast,ir
-	sink(m6.find("def")); // $ SPURIOUS: ast,ir
+	sink(m4.find("def")); // $ SPURIOUS: ir
+	sink(m5.find("def")); // $ SPURIOUS: ir
+	sink(m6.find("def")); // $ SPURIOUS: ir
 
 	// copy constructors and assignment
 	std::map<char *, char *> m7(m2);
 	std::map<char *, char *> m8 = m2;
 	std::map<char *, char *> m9;
 	m9 = m2;
-	sink(m7); // $ ast,ir
-	sink(m8); // $ ast,ir
-	sink(m9); // $ ast,ir
-	sink(m7.find("abc")); // $ ast,ir
-	sink(m8.find("abc")); // $ ast,ir
-	sink(m9.find("abc")); // $ ast,ir
+	sink(m7); // $ ir
+	sink(m8); // $ ir
+	sink(m9); // $ ir
+	sink(m7.find("abc")); // $ ir
+	sink(m8.find("abc")); // $ ir
+	sink(m9.find("abc")); // $ ir
 
 	// iterators
 	std::map<char *, char *>::iterator i1, i2, i3;
@@ -151,27 +151,27 @@ void test_map()
 	}
 	for (i2 = m2.begin(); i2 != m2.end(); i2++)
 	{
-		sink(*i2); // $ ast,ir
+		sink(*i2); // $ ir
 		sink(i2->first); // clean
-		sink(i2->second); // $ MISSING: ast,ir
+		sink(i2->second); // $ MISSING: ir
 	}
 	for (i3 = m3.begin(); i3 != m3.end(); i3++)
 	{
-		sink(*i3); // $ MISSING: ast,ir
-		sink(i3->first);  // $ MISSING: ast,ir
+		sink(*i3); // $ MISSING: ir
+		sink(i3->first);  // $ MISSING: ir
 		sink(i3->second); // clean
 	}
 
 	// array-like access
 	std::map<char *, char *> m10, m11, m12, m13;
 	sink(m10["abc"] = "def");
-	sink(m11["abc"] = source()); // $ ast,ir
+	sink(m11["abc"] = source()); // $ ir
 	sink(m12.at("abc") = "def");
-	sink(m13.at("abc") = source()); // $ ast,ir
+	sink(m13.at("abc") = source()); // $ ir
 	sink(m10["abc"]);
-	sink(m11["abc"]); // $ ast,ir
+	sink(m11["abc"]); // $ ir
 	sink(m12["abc"]);
-	sink(m13["abc"]); // $ ast,ir
+	sink(m13["abc"]); // $ ir
 
 	// ranges
 	std::map<char *, char *> m14;
@@ -179,27 +179,27 @@ void test_map()
 	m14.insert(std::make_pair("b", source()));
 	m14.insert(std::make_pair("c", source()));
 	m14.insert(std::make_pair("d", "d"));
-	sink(m14.lower_bound("b")); // $ ast,ir=179:33 ast,ir=180:33
-	sink(m14.upper_bound("b")); // $ ast,ir=179:33 ast,ir=180:33
-	sink(m14.equal_range("b").first); // $ MISSING: ast,ir
-	sink(m14.equal_range("b").second); // $ MISSING: ast,ir
-	sink(m14.upper_bound("c")); // $ SPURIOUS: ast,ir=179:33 ast,ir=180:33
+	sink(m14.lower_bound("b")); // $ ir=179:33 ir=180:33
+	sink(m14.upper_bound("b")); // $ ir=179:33 ir=180:33
+	sink(m14.equal_range("b").first); // $ MISSING: ir
+	sink(m14.equal_range("b").second); // $ MISSING: ir
+	sink(m14.upper_bound("c")); // $ SPURIOUS: ir=179:33 ir=180:33
 	sink(m14.equal_range("c").second);
 
 	// swap
 	std::map<char *, char *> m15, m16, m17, m18;
 	m15.insert(std::pair<char *, char *>(source(), source()));
 	m18.insert(std::pair<char *, char *>(source(), source()));
-	sink(m15); // $ ast,ir
+	sink(m15); // $ ir
 	sink(m16);
 	sink(m17);
-	sink(m18); // $ ast,ir
+	sink(m18); // $ ir
 	m15.swap(m16);
 	m17.swap(m18);
-	sink(m15); // $ SPURIOUS: ast,ir
-	sink(m16); // $ ast,ir
-	sink(m17); // $ ast,ir
-	sink(m18); // $ SPURIOUS: ast,ir
+	sink(m15); // $ SPURIOUS: ir
+	sink(m16); // $ ir
+	sink(m17); // $ ir
+	sink(m18); // $ SPURIOUS: ir
 
 	// merge
 	std::map<char *, char *> m19, m20, m21, m22;
@@ -207,48 +207,48 @@ void test_map()
 	m20.insert(std::pair<char *, char *>("abc", "def"));
 	m21.insert(std::pair<char *, char *>("abc", "def"));
 	m22.insert(std::pair<char *, char *>(source(), source()));
-	sink(m19); // $ ast,ir
+	sink(m19); // $ ir
 	sink(m20);
 	sink(m21);
-	sink(m22); // $ ast,ir
+	sink(m22); // $ ir
 	m19.merge(m20);
 	m21.merge(m22);
-	sink(m19); // $ ast,ir
+	sink(m19); // $ ir
 	sink(m20);
-	sink(m21); // $ ast,ir
-	sink(m22); // $ ast,ir
+	sink(m21); // $ ir
+	sink(m22); // $ ir
 
 	// erase, clear
 	std::map<char *, char *> m23;
 	m23.insert(std::pair<char *, char *>(source(), source()));
 	m23.insert(std::pair<char *, char *>(source(), source()));
-	sink(m23); // $ ast,ir=223:49 ast,ir=224:49
-	sink(m23.erase(m23.begin())); // $ ast,ir=223:49 ast,ir=224:49
-	sink(m23); // $ ast,ir=223:49 ast,ir=224:49
+	sink(m23); // $ ir=223:49 ir=224:49
+	sink(m23.erase(m23.begin())); // $ ir=223:49 ir=224:49
+	sink(m23); // $ ir=223:49 ir=224:49
 	m23.clear();
-	sink(m23); // $ SPURIOUS: ast,ir=223:49 ast,ir=224:49
+	sink(m23); // $ SPURIOUS: ir=223:49 ir=224:49
 
 	// emplace, emplace_hint
 	std::map<char *, char *> m24, m25;
 	sink(m24.emplace("abc", "def").first);
 	sink(m24);
 	sink(m24.emplace("abc", source()).first);
-	sink(m24); // $ ast,ir
+	sink(m24); // $ ir
 	sink(m25.emplace_hint(m25.begin(), "abc", "def"));
 	sink(m25);
-	sink(m25.emplace_hint(m25.begin(), "abc", source())); // $ ast,ir
-	sink(m25); // $ ast,ir
+	sink(m25.emplace_hint(m25.begin(), "abc", source())); // $ ir
+	sink(m25); // $ ir
 	
 	// try_emplace
 	std::map<char *, char *> m26, m27;
 	sink(m26.try_emplace("abc", "def").first);
 	sink(m26);
 	sink(m26.try_emplace("abc", source()).first);
-	sink(m26); // $ ast,ir
+	sink(m26); // $ ir
 	sink(m27.try_emplace(m27.begin(), "abc", "def"));
 	sink(m27);
-	sink(m27.try_emplace(m27.begin(), "abc", source())); // $ ast,ir
-	sink(m27); // $ ast,ir
+	sink(m27.try_emplace(m27.begin(), "abc", source())); // $ ir
+	sink(m27); // $ ir
 }
 
 void test_unordered_map()
@@ -258,40 +258,40 @@ void test_unordered_map()
 
 	sink(m1.insert(std::make_pair("abc", "def")).first);
 	sink(m2.insert(std::make_pair("abc", source())).first);
-	sink(m3.insert(std::make_pair(source(), "def")).first); // $ MISSING: ast,ir
-	sink(m4.insert(m4.begin(), std::pair<char *, char *>("abc", source()))); // $ ast,ir
+	sink(m3.insert(std::make_pair(source(), "def")).first); // $ MISSING: ir
+	sink(m4.insert(m4.begin(), std::pair<char *, char *>("abc", source()))); // $ ir
 	sink(m5.insert_or_assign("abc", source()).first);
-	sink(m6.insert_or_assign(m6.begin(), "abc", source())); // $ ast,ir
+	sink(m6.insert_or_assign(m6.begin(), "abc", source())); // $ ir
 	sink(m1);
-	sink(m2); // $ ast,ir
-	sink(m3); // $ MISSING: ast,ir
-	sink(m4); // $ ast,ir
-	sink(m5); // $ ast,ir
-	sink(m6); // $ ast,ir
+	sink(m2); // $ ir
+	sink(m3); // $ MISSING: ir
+	sink(m4); // $ ir
+	sink(m5); // $ ir
+	sink(m6); // $ ir
 	sink(m1.find("abc"));
-	sink(m2.find("abc")); // $ ast,ir
+	sink(m2.find("abc")); // $ ir
 	sink(m3.find("abc"));
-	sink(m4.find("abc")); // $ ast,ir
-	sink(m5.find("abc")); // $ ast,ir
-	sink(m6.find("abc")); // $ ast,ir
+	sink(m4.find("abc")); // $ ir
+	sink(m5.find("abc")); // $ ir
+	sink(m6.find("abc")); // $ ir
 	sink(m1.find("def"));
-	sink(m2.find("def")); // $ SPURIOUS: ast,ir
+	sink(m2.find("def")); // $ SPURIOUS: ir
 	sink(m3.find("def"));
-	sink(m4.find("def")); // $ SPURIOUS: ast,ir
-	sink(m5.find("def")); // $ SPURIOUS: ast,ir
-	sink(m6.find("def")); // $ SPURIOUS: ast,ir
+	sink(m4.find("def")); // $ SPURIOUS: ir
+	sink(m5.find("def")); // $ SPURIOUS: ir
+	sink(m6.find("def")); // $ SPURIOUS: ir
 
 	// copy constructors and assignment
 	std::unordered_map<char *, char *> m7(m2);
 	std::unordered_map<char *, char *> m8 = m2;
 	std::unordered_map<char *, char *> m9;
 	m9 = m2;
-	sink(m7); // $ ast,ir
-	sink(m8); // $ ast,ir
-	sink(m9); // $ ast,ir
-	sink(m7.find("abc")); // $ ast,ir
-	sink(m8.find("abc")); // $ ast,ir
-	sink(m9.find("abc")); // $ ast,ir
+	sink(m7); // $ ir
+	sink(m8); // $ ir
+	sink(m9); // $ ir
+	sink(m7.find("abc")); // $ ir
+	sink(m8.find("abc")); // $ ir
+	sink(m9.find("abc")); // $ ir
 
 	// iterators
 	std::unordered_map<char *, char *>::iterator i1, i2, i3;
@@ -303,27 +303,27 @@ void test_unordered_map()
 	}
 	for (i2 = m2.begin(); i2 != m2.end(); i2++)
 	{
-		sink(*i2); // $ ast,ir
+		sink(*i2); // $ ir
 		sink(i2->first); // clean
-		sink(i2->second); // $ MISSING: ast,ir
+		sink(i2->second); // $ MISSING: ir
 	}
 	for (i3 = m3.begin(); i3 != m3.end(); i3++)
 	{
-		sink(*i3); // $ MISSING: ast,ir
-		sink(i3->first); // $ MISSING: ast,ir
+		sink(*i3); // $ MISSING: ir
+		sink(i3->first); // $ MISSING: ir
 		sink(i3->second); // clean
 	}
 
 	// array-like access
 	std::unordered_map<char *, char *> m10, m11, m12, m13;
 	sink(m10["abc"] = "def");
-	sink(m11["abc"] = source()); // $ ast,ir
+	sink(m11["abc"] = source()); // $ ir
 	sink(m12.at("abc") = "def");
-	sink(m13.at("abc") = source()); // $ ast,ir
+	sink(m13.at("abc") = source()); // $ ir
 	sink(m10["abc"]);
-	sink(m11["abc"]); // $ ast,ir
+	sink(m11["abc"]); // $ ir
 	sink(m12["abc"]);
-	sink(m13["abc"]); // $ ast,ir
+	sink(m13["abc"]); // $ ir
 
 	// ranges
 	std::unordered_map<char *, char *> m14;
@@ -332,23 +332,23 @@ void test_unordered_map()
 	m14.insert(std::make_pair("c", source()));
 	m14.insert(std::make_pair("d", "d"));
 	sink(m14.equal_range("b").first);
-	sink(m14.equal_range("b").second); // $ MISSING: ast,ir
+	sink(m14.equal_range("b").second); // $ MISSING: ir
 	sink(m14.equal_range("c").second);
 
 	// swap
 	std::unordered_map<char *, char *> m15, m16, m17, m18;
 	m15.insert(std::pair<char *, char *>(source(), source()));
 	m18.insert(std::pair<char *, char *>(source(), source()));
-	sink(m15); // $ ast,ir
+	sink(m15); // $ ir
 	sink(m16);
 	sink(m17);
-	sink(m18); // $ ast,ir
+	sink(m18); // $ ir
 	m15.swap(m16);
 	m17.swap(m18);
-	sink(m15); // $ SPURIOUS: ast,ir
-	sink(m16); // $ ast,ir
-	sink(m17); // $ ast,ir
-	sink(m18); // $ SPURIOUS: ast,ir
+	sink(m15); // $ SPURIOUS: ir
+	sink(m16); // $ ir
+	sink(m17); // $ ir
+	sink(m18); // $ SPURIOUS: ir
 
 	// merge
 	std::unordered_map<char *, char *> m19, m20, m21, m22;
@@ -356,37 +356,37 @@ void test_unordered_map()
 	m20.insert(std::pair<char *, char *>("abc", "def"));
 	m21.insert(std::pair<char *, char *>("abc", "def"));
 	m22.insert(std::pair<char *, char *>(source(), source()));
-	sink(m19); // $ ast,ir
+	sink(m19); // $ ir
 	sink(m20);
 	sink(m21);
-	sink(m22); // $ ast,ir
+	sink(m22); // $ ir
 	m19.merge(m20);
 	m21.merge(m22);
-	sink(m19); // $ ast,ir
+	sink(m19); // $ ir
 	sink(m20);
-	sink(m21); // $ ast,ir
-	sink(m22); // $ ast,ir
+	sink(m21); // $ ir
+	sink(m22); // $ ir
 
 	// erase, clear
 	std::unordered_map<char *, char *> m23;
 	m23.insert(std::pair<char *, char *>(source(), source()));
 	m23.insert(std::pair<char *, char *>(source(), source()));
-	sink(m23); // $ ast,ir=372:49 ast,ir=373:49
-	sink(m23.erase(m23.begin())); // $ ast,ir=372:49 ast,ir=373:49
-	sink(m23); // $ ast,ir=372:49 ast,ir=373:49
+	sink(m23); // $ ir=372:49 ir=373:49
+	sink(m23.erase(m23.begin())); // $ ir=372:49 ir=373:49
+	sink(m23); // $ ir=372:49 ir=373:49
 	m23.clear();
-	sink(m23); // $ SPURIOUS: ast,ir=372:49 ast,ir=373:49
+	sink(m23); // $ SPURIOUS: ir=372:49 ir=373:49
 
 	// emplace, emplace_hint
 	std::unordered_map<char *, char *> m24, m25;
 	sink(m24.emplace("abc", "def").first);
 	sink(m24);
 	sink(m24.emplace("abc", source()).first);
-	sink(m24); // $ ast,ir
+	sink(m24); // $ ir
 	sink(m25.emplace_hint(m25.begin(), "abc", "def"));
 	sink(m25);
-	sink(m25.emplace_hint(m25.begin(), "abc", source())); // $ ast,ir
-	sink(m25); // $ ast,ir
+	sink(m25.emplace_hint(m25.begin(), "abc", source())); // $ ir
+	sink(m25); // $ ir
 
 	// try_emplace
 	std::unordered_map<char *, char *> m26, m27, m28;
@@ -394,45 +394,45 @@ void test_unordered_map()
 	sink(m26.try_emplace("abc", "def").second);
 	sink(m26);
 	sink(m26.try_emplace("abc", source()).first);
-	sink(m26.try_emplace("abc", source()).second); // $ MISSING: ast,ir=396:30
-	sink(m26); // $ ast,ir=396:30 SPURIOUS: ast,ir=397:30
+	sink(m26.try_emplace("abc", source()).second); // $ MISSING: ir=396:30
+	sink(m26); // $ ir=396:30 SPURIOUS: ir=397:30
 	sink(m27.try_emplace(m27.begin(), "abc", "def"));
 	sink(m27);
-	sink(m27.try_emplace(m27.begin(), "abc", source())); // $ ast,ir
-	sink(m27); // $ ast,ir
+	sink(m27.try_emplace(m27.begin(), "abc", source())); // $ ir
+	sink(m27); // $ ir
 	sink(m28.try_emplace(m28.begin(), "abc", "def"));
 	sink(m28);
-	sink(m28.try_emplace(m28.begin(), source(), "def")); // $ MISSING: ast,ir
-	sink(m28); // $ MISSING: ast,ir
+	sink(m28.try_emplace(m28.begin(), source(), "def")); // $ MISSING: ir
+	sink(m28); // $ MISSING: ir
 
 	// additional try_emplace test cases
 	std::unordered_map<char *, std::pair<int, int>> m29, m30, m31, m32;
 	sink(m29.try_emplace("abc", 1, 2));
 	sink(m29);
 	sink(m29["abc"]);
-	sink(m30.try_emplace(source(), 1, 2)); // $ MISSING: ast,ir
-	sink(m30); // $ MISSING: ast,ir
+	sink(m30.try_emplace(source(), 1, 2)); // $ MISSING: ir
+	sink(m30); // $ MISSING: ir
 	sink(m30["abc"]);
-	sink(m31.try_emplace("abc", source(), 2)); // $ ast,ir
-	sink(m31); // $ ast,ir
-	sink(m31["abc"]); // $ ast,ir
-	sink(m32.try_emplace("abc", 1, source())); // $ ast,ir
-	sink(m32); // $ ast,ir
-	sink(m32["abc"]); // $ ast,ir
+	sink(m31.try_emplace("abc", source(), 2)); // $ ir
+	sink(m31); // $ ir
+	sink(m31["abc"]); // $ ir
+	sink(m32.try_emplace("abc", 1, source())); // $ ir
+	sink(m32); // $ ir
+	sink(m32["abc"]); // $ ir
 
 	// additional emplace test cases
 	std::unordered_map<char *, char *> m33;
-	sink(m33.emplace(source(), "def").first); // $ MISSING: ast,ir
-	sink(m33); // $ MISSING: ast,ir
+	sink(m33.emplace(source(), "def").first); // $ MISSING: ir
+	sink(m33); // $ MISSING: ir
 
 	std::unordered_map<char *, char *> m34, m35;
 	sink(m34.emplace(std::pair<char *, char *>("abc", "def")).first);
 	sink(m34);
 	sink(m34.emplace(std::pair<char *, char *>("abc", source())).first);
-	sink(m34); // $ ast,ir
-	sink(m34.emplace_hint(m34.begin(), "abc", "def")); // $ ast,ir
+	sink(m34); // $ ir
+	sink(m34.emplace_hint(m34.begin(), "abc", "def")); // $ ir
 	sink(m35.emplace().first);
 	sink(m35);
-	sink(m35.emplace(std::pair<char *, char *>(source(), "def")).first); // $ MISSING: ast,ir
-	sink(m35); // $ MISSING: ast,ir
+	sink(m35.emplace(std::pair<char *, char *>(source(), "def")).first); // $ MISSING: ir
+	sink(m35); // $ MISSING: ir
 }

cpp/ql/test/library-tests/dataflow/taint-tests/movableclass.cpp

@@ -41,9 +41,9 @@ void test_movableclass()
 		MyMovableClass s3;
 		s3 = source();
 
-		sink(s1); // $ ast,ir
-		sink(s2); // $ ast,ir
-		sink(s3); // $ ast,ir
+		sink(s1); // $ ir
+		sink(s2); // $ ir
+		sink(s3); // $ ir
 	}
 
 	{
@@ -51,8 +51,8 @@ void test_movableclass()
 		MyMovableClass s2;
 		s2 = MyMovableClass(source());
 
-		sink(s1); // $ ast,ir
-		sink(s2); // $ ast,ir
+		sink(s1); // $ ir
+		sink(s2); // $ ir
 	}
 
 	{
@@ -61,7 +61,7 @@ void test_movableclass()
 		MyMovableClass s3;
 
 		sink(s1);
-		sink(s2); // $ ast,ir
-		sink(s3 = source()); // $ ast,ir
+		sink(s2); // $ ir
+		sink(s3 = source()); // $ ir
 	}
 }

cpp/ql/test/library-tests/dataflow/taint-tests/set.cpp

@@ -17,23 +17,23 @@ void test_set()
 	std::set<char *> s1, s2, s3, s4, s5, s6;
 
 	sink(s1.insert("abc").first);
-	sink(s2.insert(source()).first); // $ MISSING: ast,ir
+	sink(s2.insert(source()).first); // $ MISSING: ir
 	sink(s3.insert(s3.begin(), "abc"));
-	sink(s4.insert(s4.begin(), source())); // $ ast,ir
+	sink(s4.insert(s4.begin(), source())); // $ ir
 	s5.insert(s1.begin(), s1.end());
 	s6.insert(s2.begin(), s2.end());
 	sink(s1);
-	sink(s2); // $ ast,ir
+	sink(s2); // $ ir
 	sink(s3);
-	sink(s4); // $ ast,ir
+	sink(s4); // $ ir
 	sink(s5);
-	sink(s6); // $ ast,ir
+	sink(s6); // $ ir
 	sink(s1.find("abc"));
-	sink(s2.find("abc")); // $ ast,ir
+	sink(s2.find("abc")); // $ ir
 	sink(s3.find("abc"));
-	sink(s4.find("abc")); // $ ast,ir
+	sink(s4.find("abc")); // $ ir
 	sink(s5.find("abc"));
-	sink(s6.find("abc")); // $ ast,ir
+	sink(s6.find("abc")); // $ ir
 
 	// copy constructors and assignment
 	std::set<char *> s7(s2);
@@ -41,14 +41,14 @@ void test_set()
 	std::set<char *> s9(s2.begin(), s2.end());
 	std::set<char *> s10;
 	s10 = s2;
-	sink(s7); // $ ast,ir
-	sink(s8); // $ ast,ir
-	sink(s9); // $ ast,ir
-	sink(s10); // $ ast,ir
-	sink(s7.find("abc")); // $ ast,ir
-	sink(s8.find("abc")); // $ ast,ir
-	sink(s9.find("abc")); // $ ast,ir
-	sink(s10.find("abc")); // $ ast,ir
+	sink(s7); // $ ir
+	sink(s8); // $ ir
+	sink(s9); // $ ir
+	sink(s10); // $ ir
+	sink(s7.find("abc")); // $ ir
+	sink(s8.find("abc")); // $ ir
+	sink(s9.find("abc")); // $ ir
+	sink(s10.find("abc")); // $ ir
 
 	// iterators
 	std::set<char *>::iterator i1, i2;
@@ -58,7 +58,7 @@ void test_set()
 	}
 	for (i2 = s2.begin(); i2 != s2.end(); i2++)
 	{
-		sink(*i2); // $ ast,ir
+		sink(*i2); // $ ir
 	}
 
 	// ranges
@@ -66,25 +66,25 @@ void test_set()
 	s11.insert("a");
 	s11.insert(source());
 	s11.insert("c");
-	sink(s11.lower_bound("b")); // $ ast,ir
-	sink(s11.upper_bound("b")); // $ ast,ir
-	sink(s11.equal_range("b").first); // $ MISSING: ast,ir
-	sink(s11.equal_range("b").second); // $ MISSING: ast,ir
+	sink(s11.lower_bound("b")); // $ ir
+	sink(s11.upper_bound("b")); // $ ir
+	sink(s11.equal_range("b").first); // $ MISSING: ir
+	sink(s11.equal_range("b").second); // $ MISSING: ir
 
 	// swap
 	std::set<char *> s12, s13, s14, s15;
 	s12.insert(source());
 	s15.insert(source());
-	sink(s12); // $ ast,ir
+	sink(s12); // $ ir
 	sink(s13);
 	sink(s14);
-	sink(s15); // $ ast,ir
+	sink(s15); // $ ir
 	s12.swap(s13);
 	s14.swap(s15);
-	sink(s12); // $ SPURIOUS: ast,ir
-	sink(s13); // $ ast,ir
-	sink(s14); // $ ast,ir
-	sink(s15); // $ SPURIOUS: ast,ir
+	sink(s12); // $ SPURIOUS: ir
+	sink(s13); // $ ir
+	sink(s14); // $ ir
+	sink(s15); // $ SPURIOUS: ir
 
 	// merge
 	std::set<char *> s16, s17, s18, s19;
@@ -92,37 +92,37 @@ void test_set()
 	s17.insert("abc");
 	s18.insert("def");
 	s19.insert(source());
-	sink(s16); // $ ast,ir
+	sink(s16); // $ ir
 	sink(s17);
 	sink(s18);
-	sink(s19); // $ ast,ir
+	sink(s19); // $ ir
 	s16.merge(s17);
 	s18.merge(s19);
-	sink(s16); // $ ast,ir
+	sink(s16); // $ ir
 	sink(s17);
-	sink(s18); // $ ast,ir
-	sink(s19); // $ ast,ir
+	sink(s18); // $ ir
+	sink(s19); // $ ir
 
 	// erase, clear
 	std::set<char *> s20;
 	s20.insert(source());
 	s20.insert(source());
-	sink(s20); // $ ast,ir=108:13 ast,ir=109:13
-	sink(s20.erase(s20.begin())); // $ ast,ir=108:13 ast,ir=109:13
-	sink(s20); // $ ast,ir=108:13 ast,ir=109:13
+	sink(s20); // $ ir=108:13 ir=109:13
+	sink(s20.erase(s20.begin())); // $ ir=108:13 ir=109:13
+	sink(s20); // $ ir=108:13 ir=109:13
 	s20.clear();
-	sink(s20); // $ SPURIOUS: ast,ir=108:13 ast,ir=109:13
+	sink(s20); // $ SPURIOUS: ir=108:13 ir=109:13
 
 	// emplace, emplace_hint
 	std::set<char *> s21, s22;
 	sink(s21.emplace("abc").first);
 	sink(s21);
-	sink(s21.emplace(source()).first); // $ MISSING: ast,ir
-	sink(s21); // $ ast,ir
+	sink(s21.emplace(source()).first); // $ MISSING: ir
+	sink(s21); // $ ir
 	sink(s22.emplace_hint(s22.begin(), "abc"));
 	sink(s22);
-	sink(s22.emplace_hint(s22.begin(), source())); // $ ast,ir
-	sink(s22); // $ ast,ir
+	sink(s22.emplace_hint(s22.begin(), source())); // $ ir
+	sink(s22); // $ ir
 }
 
 void test_unordered_set()
@@ -131,23 +131,23 @@ void test_unordered_set()
 	std::unordered_set<char *> s1, s2, s3, s4, s5, s6;
 
 	sink(s1.insert("abc").first);
-	sink(s2.insert(source()).first); // $ MISSING: ast,ir
+	sink(s2.insert(source()).first); // $ MISSING: ir
 	sink(s3.insert(s3.begin(), "abc"));
-	sink(s4.insert(s4.begin(), source())); // $ ast,ir
+	sink(s4.insert(s4.begin(), source())); // $ ir
 	s5.insert(s1.begin(), s1.end());
 	s6.insert(s2.begin(), s2.end());
 	sink(s1);
-	sink(s2); // $ ast,ir
+	sink(s2); // $ ir
 	sink(s3);
-	sink(s4); // $ ast,ir
+	sink(s4); // $ ir
 	sink(s5);
-	sink(s6); // $ ast,ir
+	sink(s6); // $ ir
 	sink(s1.find("abc"));
-	sink(s2.find("abc")); // $ ast,ir
+	sink(s2.find("abc")); // $ ir
 	sink(s3.find("abc"));
-	sink(s4.find("abc")); // $ ast,ir
+	sink(s4.find("abc")); // $ ir
 	sink(s5.find("abc"));
-	sink(s6.find("abc")); // $ ast,ir
+	sink(s6.find("abc")); // $ ir
 
 	// copy constructors and assignment
 	std::unordered_set<char *> s7(s2);
@@ -155,14 +155,14 @@ void test_unordered_set()
 	std::unordered_set<char *> s9(s2.begin(), s2.end());
 	std::unordered_set<char *> s10;
 	s10 = s2;
-	sink(s7); // $ ast,ir
-	sink(s8); // $ ast,ir
-	sink(s9); // $ ast,ir
-	sink(s10); // $ ast,ir
-	sink(s7.find("abc")); // $ ast,ir
-	sink(s8.find("abc")); // $ ast,ir
-	sink(s9.find("abc")); // $ ast,ir
-	sink(s10.find("abc")); // $ ast,ir
+	sink(s7); // $ ir
+	sink(s8); // $ ir
+	sink(s9); // $ ir
+	sink(s10); // $ ir
+	sink(s7.find("abc")); // $ ir
+	sink(s8.find("abc")); // $ ir
+	sink(s9.find("abc")); // $ ir
+	sink(s10.find("abc")); // $ ir
 
 	// iterators
 	std::unordered_set<char *>::iterator i1, i2;
@@ -172,7 +172,7 @@ void test_unordered_set()
 	}
 	for (i2 = s2.begin(); i2 != s2.end(); i2++)
 	{
-		sink(*i2); // $ ast,ir
+		sink(*i2); // $ ir
 	}
 
 	// ranges
@@ -180,23 +180,23 @@ void test_unordered_set()
 	s11.insert("a");
 	s11.insert(source());
 	s11.insert("c");
-	sink(s11.equal_range("b").first); // $ MISSING: ast,ir
-	sink(s11.equal_range("b").second); // $ MISSING: ast,ir
+	sink(s11.equal_range("b").first); // $ MISSING: ir
+	sink(s11.equal_range("b").second); // $ MISSING: ir
 
 	// swap
 	std::unordered_set<char *> s12, s13, s14, s15;
 	s12.insert(source());
 	s15.insert(source());
-	sink(s12); // $ ast,ir
+	sink(s12); // $ ir
 	sink(s13);
 	sink(s14);
-	sink(s15); // $ ast,ir
+	sink(s15); // $ ir
 	s12.swap(s13);
 	s14.swap(s15);
-	sink(s12); // $ SPURIOUS: ast,ir
-	sink(s13); // $ ast,ir
-	sink(s14); // $ ast,ir
-	sink(s15); // $ SPURIOUS: ast,ir
+	sink(s12); // $ SPURIOUS: ir
+	sink(s13); // $ ir
+	sink(s14); // $ ir
+	sink(s15); // $ SPURIOUS: ir
 
 	// merge
 	std::unordered_set<char *> s16, s17, s18, s19;
@@ -204,35 +204,35 @@ void test_unordered_set()
 	s17.insert("abc");
 	s18.insert("def");
 	s19.insert(source());
-	sink(s16); // $ ast,ir
+	sink(s16); // $ ir
 	sink(s17);
 	sink(s18);
-	sink(s19); // $ ast,ir
+	sink(s19); // $ ir
 	s16.merge(s17);
 	s18.merge(s19);
-	sink(s16); // $ ast,ir
+	sink(s16); // $ ir
 	sink(s17);
-	sink(s18); // $ ast,ir
-	sink(s19); // $ ast,ir
+	sink(s18); // $ ir
+	sink(s19); // $ ir
 
 	// erase, clear
 	std::unordered_set<char *> s20;
 	s20.insert(source());
 	s20.insert(source());
-	sink(s20); // $ ast,ir=220:13 ast,ir=221:13
-	sink(s20.erase(s20.begin())); // $ ast,ir=220:13 ast,ir=221:13
-	sink(s20); // $ ast,ir=220:13 ast,ir=221:13
+	sink(s20); // $ ir=220:13 ir=221:13
+	sink(s20.erase(s20.begin())); // $ ir=220:13 ir=221:13
+	sink(s20); // $ ir=220:13 ir=221:13
 	s20.clear();
-	sink(s20); // $ SPURIOUS: ast,ir=220:13 ast,ir=221:13
+	sink(s20); // $ SPURIOUS: ir=220:13 ir=221:13
 
 	// emplace, emplace_hint
 	std::unordered_set<char *> s21, s22;
 	sink(s21.emplace("abc").first);
 	sink(s21);
-	sink(s21.emplace(source()).first); // $ MISSING: ast,ir
-	sink(s21); // $ ast,ir
+	sink(s21.emplace(source()).first); // $ MISSING: ir
+	sink(s21); // $ ir
 	sink(s22.emplace_hint(s22.begin(), "abc"));
 	sink(s22);
-	sink(s22.emplace_hint(s22.begin(), source())); // $ ast,ir
-	sink(s22); // $ ast,ir
+	sink(s22.emplace_hint(s22.begin(), source())); // $ ir
+	sink(s22); // $ ir
 }

cpp/ql/test/library-tests/dataflow/taint-tests/smart_pointer.cpp

@@ -9,8 +9,8 @@ template<typename T> void sink(std::unique_ptr<T>&);
 
 void test_make_shared() {
     std::shared_ptr<int> p = std::make_shared<int>(source());
-    sink(*p); // $ ast,ir
-    sink(p); // $ ast,ir
+    sink(*p); // $ ir
+    sink(p); // $ MISSING: ir
 }
 
 void test_make_shared_array() {
@@ -21,8 +21,8 @@ void test_make_shared_array() {
 
 void test_make_unique() {
     std::unique_ptr<int> p = std::make_unique<int>(source());
-    sink(*p); // $ ast,ir
-    sink(p); // $ ast,ir
+    sink(*p); // $ ir
+    sink(p); // $ MISSING: ir
 }
 
 void test_make_unique_array() {
@@ -35,26 +35,26 @@ void test_reverse_taint_shared() {
     std::shared_ptr<int> p = std::make_shared<int>();
 
     *p = source();
-    sink(p); // $ ast MISSING: ir
-    sink(*p); // $ ast MISSING: ir
+    sink(p); // $ MISSING: ir
+    sink(*p); // $ MISSING: ir
 }
 
 void test_reverse_taint_unique() {
     std::unique_ptr<int> p = std::unique_ptr<int>();
 
     *p = source();
-    sink(p); // $ ast MISSING: ir
-    sink(*p); // $ ast MISSING: ir
+    sink(p); // $ MISSING: ir
+    sink(*p); // $ MISSING: ir
 }
 
 void test_shared_get() {
     std::shared_ptr<int> p = std::make_shared<int>(source());
-    sink(p.get()); // $ ast,ir
+    sink(p.get()); // $ ir
 }
 
 void test_unique_get() {
     std::unique_ptr<int> p = std::make_unique<int>(source());
-    sink(p.get()); // $ ast,ir
+    sink(p.get()); // $ ir
 }
 
 struct A {
@@ -63,7 +63,7 @@ struct A {
 
 void test_shared_field_member() {
     std::unique_ptr<A> p = std::make_unique<A>(source(), 0);
-    sink(p->x); // $ MISSING: ast,ir
+    sink(p->x); // $ MISSING: ir
     sink(p->y); // not tainted
 }
 
@@ -74,7 +74,7 @@ void getNumber(std::shared_ptr<int> ptr) {
 int test_from_issue_5190() {
   std::shared_ptr<int> p(new int);
   getNumber(p);
-  sink(*p); // $ ast MISSING: ir
+  sink(*p); // $ MISSING: ir
 }
 
 struct B {
@@ -85,11 +85,11 @@ struct B {
 
 void test_operator_arrow(std::unique_ptr<A> p, std::unique_ptr<B> q) {
   p->x = source();
-  sink(p->x); // $ ast MISSING: ir
+  sink(p->x); // $ MISSING: ir
   sink(p->y);
 
   q->a1.x = source();
-  sink(q->a1.x); // $ ast MISSING: ir
+  sink(q->a1.x); // $ MISSING: ir
   sink(q->a1.y);
   sink(q->a2.x);
 }
@@ -101,7 +101,7 @@ void taint_x(A* pa) {
 void reverse_taint_smart_pointer() {
   std::unique_ptr<A> p = std::unique_ptr<A>(new A);
   taint_x(p.get());
-  sink(p->x); // $ ast MISSING: ir
+  sink(p->x); // $ MISSING: ir
 }
 
 struct C {
@@ -123,16 +123,16 @@ void getNumberCRef(const std::shared_ptr<int>& ptr) {
 
 int nested_shared_ptr_taint(std::shared_ptr<C> p1, std::unique_ptr<std::shared_ptr<int>> p2) {
   taint_x_shared(p1->q);
-  sink(p1->q->x); // $ ast MISSING: ir
+  sink(p1->q->x); // $ MISSING: ir
 
   getNumber(*p2);
-  sink(**p2); // $ ast MISSING: ir
+  sink(**p2); // $ MISSING: ir
 }
 
 int nested_shared_ptr_taint_cref(std::shared_ptr<C> p1, std::unique_ptr<std::shared_ptr<int>> p2) {
   taint_x_shared_cref(p1->q);
-  sink(p1->q->x); // $ ast MISSING: ir
+  sink(p1->q->x); // $ MISSING: ir
 
   getNumberCRef(*p2);
-  sink(**p2); // $ ast MISSING: ir
+  sink(**p2); // $ MISSING: ir
 }

cpp/ql/test/library-tests/dataflow/taint-tests/standalone_iterators.cpp

@@ -37,15 +37,15 @@ public:
 };
 
 void test_typedefs(int_iterator_by_typedefs source1) {
-    sink(*source1); // $ ast,ir
-    sink(*(source1++)); // $ ast,ir
-    sink(*(++source1)); // $ ast,ir
+    sink(*source1); // $ ir
+    sink(*(source1++)); // $ ir
+    sink(*(++source1)); // $ ir
 }
 
 void test_trait(int_iterator_by_trait source1) {
-    sink(*source1); // $ ast,ir
-    sink(*(source1++)); // $ ast,ir
-    sink(*(++source1)); // $ ast,ir
+    sink(*source1); // $ ir
+    sink(*(source1++)); // $ ir
+    sink(*(++source1)); // $ ir
 }
 
 void test_non_iterator(non_iterator source1) {
@@ -84,7 +84,7 @@ void test_insert_iterator() {
 
     insert_iterator_by_trait i1 = c1.begin();
     *i1-- = source();
-    sink(c1); // $ ast MISSING: ir
+    sink(c1); // $ MISSING: ir
 
     insert_iterator_by_trait i2 = c2.begin();
     *i2-- = 0;
@@ -101,12 +101,12 @@ void test_assign_through_iterator() {
 	a = c1.begin();
 	b = c1.begin();
 	*a = source();
-	sink(a); // $ ast MISSING: ir
+	sink(a); // $ MISSING: ir
 
 	c = c1.begin();
-	sink(b); // MISSING: ast,ir
-	sink(c); // $ ast MISSING: ir
-	sink(c1); // $ ast MISSING: ir
+	sink(b); // MISSING: ir
+	sink(c); // $ MISSING: ir
+	sink(c1); // $ MISSING: ir
 }
 
 void test_nonmember_iterator() {
@@ -118,6 +118,6 @@ void test_nonmember_iterator() {
 	it += 1;
 	sink(it);
 	it += source();
-	sink(it); // $ ast,ir
+	sink(it); // $ ir
 	sink(c1);
 }

cpp/ql/test/library-tests/dataflow/taint-tests/string.cpp

@@ -26,24 +26,24 @@ void test_string()
 	std::string b("123");
 	std::string c(source());
 
-	sink(a); // $ ast,ir
+	sink(a); // $ ir
 	sink(b);
-	sink(c); // $ ast,ir
+	sink(c); // $ MISSING: ir
 	sink(b.c_str());
-	sink(c.c_str()); // $ ast,ir
+	sink(c.c_str()); // $ ir
 }
 
 void test_strings2()
 {
 	string path1 = user_input();
-	sink(path1.c_str(), "r"); // $ ast,ir
+	sink(path1.c_str(), "r"); // $ ir
 
 	string path2;
 	path2 = user_input();
-	sink(path2.c_str(), "r"); // $ ast,ir
+	sink(path2.c_str(), "r"); // $ ir
 
 	string path3(user_input());
-	sink(path3.c_str(), "r"); // $ ast,ir
+	sink(path3.c_str(), "r"); // $ ir
 }
 
 void test_string3()
@@ -53,8 +53,8 @@ void test_string3()
 	// convert char * -> std::string
 	std::string ss(cs);
 
-	sink(cs); // $ ast,ir
-	sink(ss); // $ ast,ir
+	sink(cs); // $ ir
+	sink(ss); // $ MISSING: ir
 }
 
 void test_string4()
@@ -67,8 +67,8 @@ void test_string4()
 	// convert back std::string -> char *
 	cs = ss.c_str();
 
-	sink(cs); // $ ast,ir
-	sink(ss); // $ ast,ir
+	sink(cs); // $ ir
+	sink(ss); // $ MISSING: ir
 }
 
 void test_string_constructors_assignments()
@@ -90,9 +90,9 @@ void test_string_constructors_assignments()
 		std::string s3;
 		s3 = source();
 
-		sink(s1); // $ ast,ir
-		sink(s2); // $ ast,ir
-		sink(s3); // $ ast,ir
+		sink(s1); // $ MISSING: ir
+		sink(s2); // $ MISSING: ir
+		sink(s3); // $ MISSING: ir
 	}
 
 	{
@@ -111,28 +111,28 @@ void test_string_constructors_assignments()
 		std::string s2;
 		s2 = std::string(source());
 
-		sink(s1); // $ ast,ir
-		sink(s2); // $ ast,ir
+		sink(s1); // $ MISSING: ir
+		sink(s2); // $ MISSING: ir
 	}
 }
 
 void test_range_based_for_loop_string() {
 	std::string s(source());
 	for(char c : s) {
-		sink(c); // $ ast,ir
+		sink(c); // $ ir
 	}
 
 	for(std::string::iterator it = s.begin(); it != s.end(); ++it) {
-		sink(*it); // $ ast,ir
+		sink(*it); // $ ir
 	}
 
 	for(char& c : s) {
-		sink(c); // $ ast,ir
+		sink(c); // $ ir
 	}
 
 	const std::string const_s(source());
 	for(const char& c : const_s) {
-		sink(c); // $ ast,ir
+		sink(c); // $ ir
 	}
 }
 
@@ -142,12 +142,12 @@ void test_string_append() {
 		std::string s2(source());
 
 		sink(s1 + s1);
-		sink(s1 + s2); // $ ast,ir
-		sink(s2 + s1); // $ ast,ir
-		sink(s2 + s2); // $ ast,ir
+		sink(s1 + s2); // $ ir
+		sink(s2 + s1); // $ ir
+		sink(s2 + s2); // $ ir
 	
 		sink(s1 + " world");
-		sink(s1 + source()); // $ ast,ir
+		sink(s1 + source()); // $ ir
 	}
 
 	{
@@ -156,25 +156,25 @@ void test_string_append() {
 		std::string s5, s6, s7, s8, s9;
 
 		s5 = s3 + s4;
-		sink(s5); // $ ast,ir
+		sink(s5); // $ MISSING: ir
 
 		s6 = s3;
-		sink(s6 += s4); // $ ast,ir
-		sink(s6); // $ ast,ir
+		sink(s6 += s4); // $ MISSING: ir
+		sink(s6); // $ MISSING: ir
 
 		s7 = s3;
-		sink(s7 += source()); // $ ast,ir
-		sink(s7 += " "); // $ ast,ir
-		sink(s7); // $ ast,ir
+		sink(s7 += source()); // $ ir
+		sink(s7 += " "); // $ MISSING: ir
+		sink(s7); // $ MISSING: ir
 
 		s8 = s3;
 		s8.append(s4);
-		sink(s8); // $ ast,ir
+		sink(s8); // $ MISSING: ir
 
 		s9 = s3;
 		s9.append(source());
 		s9.append(" ");
-		sink(s9); // $ ast,ir
+		sink(s9); // $ MISSING: ir
 	}
 
 	{
@@ -182,7 +182,7 @@ void test_string_append() {
 		char c = ns_char::source();
 
 		s10.append(1, c);
-		sink(s10); // $ ast,ir
+		sink(s10); // $ MISSING: ir
 	}
 }
 
@@ -196,14 +196,14 @@ void test_string_assign() {
 	sink(s3.assign(s1));
 	sink(s3);
 
-	sink(s4.assign(s2)); // $ ast,ir
-	sink(s4); // $ ast,ir
+	sink(s4.assign(s2)); // $ MISSING: ir
+	sink(s4); // $ MISSING: ir
 
-	sink(s5.assign(10, c)); // $ ast,ir
-	sink(s5); // $ ast,ir
+	sink(s5.assign(10, c)); // $ MISSING: ir
+	sink(s5); // $ MISSING: ir
 
 	sink(s6.assign(s1));
-	sink(s6); // $ SPURIOUS: ast,ir
+	sink(s6); //
 }
 
 void test_string_insert() {
@@ -217,16 +217,16 @@ void test_string_insert() {
 	sink(s3);
 
 	s4 = s2;
-	sink(s4.insert(0, s1)); // $ ast,ir
-	sink(s4); // $ ast,ir
+	sink(s4.insert(0, s1)); // $ MISSING: ir
+	sink(s4); // $ MISSING: ir
 
 	s5 = s1;
-	sink(s5.insert(0, s2)); // $ ast,ir
-	sink(s5); // $ ast,ir
+	sink(s5.insert(0, s2)); // $ MISSING: ir
+	sink(s5); // $ MISSING: ir
 
 	s6 = s1;
-	sink(s6.insert(0, 10, c)); // $ ast,ir
-	sink(s6); // $ ast,ir
+	sink(s6.insert(0, 10, c)); // $ MISSING: ir
+	sink(s6); // $ MISSING: ir
 }
 
 void test_string_replace() {
@@ -240,16 +240,16 @@ void test_string_replace() {
 	sink(s3);
 
 	s4 = s2;
-	sink(s4.replace(1, 2, s1)); // $ ast,ir
-	sink(s4); // $ ast,ir
+	sink(s4.replace(1, 2, s1)); // $ MISSING: ir
+	sink(s4); // $ MISSING: ir
 
 	s5 = s1;
-	sink(s5.replace(1, 2, s2)); // $ ast,ir
-	sink(s5); // $ ast,ir
+	sink(s5.replace(1, 2, s2)); // $ MISSING: ir
+	sink(s5); // $ MISSING: ir
 
 	s6 = s1;
-	sink(s6.replace(1, 2, 10, c)); // $ ast,ir
-	sink(s6); // $ ast,ir
+	sink(s6.replace(1, 2, 10, c)); // $ MISSING: ir
+	sink(s6); // $ MISSING: ir
 }
 
 void test_string_copy() {
@@ -262,7 +262,7 @@ void test_string_copy() {
 	sink(b1);
 
 	s2.copy(b2, s1.length(), 0);
-	sink(b2); // $ ast,ir
+	sink(b2); // $ MISSING: ir
 }
 
 void test_string_swap() {
@@ -272,17 +272,17 @@ void test_string_swap() {
 	std::string s4(source());
 
 	sink(s1);
-	sink(s2); // $ ast,ir
+	sink(s2); // $ MISSING: ir
 	sink(s3);
-	sink(s4); // $ ast,ir
+	sink(s4); // $ MISSING: ir
 
 	s1.swap(s2);
 	s4.swap(s3);
 
-	sink(s1); // $ ast,ir
-	sink(s2); // $ SPURIOUS: ast,ir
-	sink(s3); // $ ast,ir
-	sink(s4); // $ SPURIOUS: ast,ir
+	sink(s1); // $ MISSING: ir
+	sink(s2);
+	sink(s3); // $ MISSING: ir
+	sink(s4);
 }
 
 void test_string_clear() {
@@ -290,17 +290,17 @@ void test_string_clear() {
 	std::string s2(source());
 	std::string s3(source());
 
-	sink(s1); // $ ast,ir
-	sink(s2); // $ ast,ir
-	sink(s3); // $ ast,ir
+	sink(s1); // $ MISSING: ir
+	sink(s2); // $ MISSING: ir
+	sink(s3); // $ MISSING: ir
 
 	s1.clear();
 	s2 = "";
 	s3 = s3;
 
-	sink(s1); // $ SPURIOUS: ast,ir
+	sink(s1);
 	sink(s2);
-	sink(s3); // $ ast,ir
+	sink(s3); // $ MISSING: ir
 }
 
 void test_string_data()
@@ -309,7 +309,7 @@ void test_string_data()
 	std::string b(source());
 
 	sink(a.data());
-	sink(b.data()); // $ ast,ir
+	sink(b.data()); // $ MISSING: ir
 	sink(a.length());
 	sink(b.length());
 }
@@ -320,7 +320,7 @@ void test_string_substr()
 	std::string b(source());
 
 	sink(a.substr(0, a.length()));
-	sink(b.substr(0, b.length())); // $ ast,ir
+	sink(b.substr(0, b.length())); // $ ir
 }
 
 void test_string_at()
@@ -337,9 +337,9 @@ void test_string_at()
 	b.at(0) = ns_char::source();
 	c[0] = a[0];
 
-	sink(a); // $ ast,ir
-	sink(b); // $ ast,ir
-	sink(c); // $ ast,ir
+	sink(a); // $ MISSING: ir
+	sink(b); // $ MISSING: ir
+	sink(c); // $ MISSING: ir
 }
 
 void test_string_data_more()
@@ -347,8 +347,8 @@ void test_string_data_more()
 	std::string str("123");
 
 	str.data()[1] = ns_char::source();
-	sink(str); // $ ast,ir
-	sink(str.data()); // $ ast,ir
+	sink(str); // $ MISSING: ir
+	sink(str.data()); // $ MISSING: ir
 }
 
 void test_string_iterators() {
@@ -360,8 +360,8 @@ void test_string_iterators() {
 		std::string s4("world");
 
 		sink(s1);
-		sink(s1.append(s2.begin(), s2.end())); // $ ast,ir
-		sink(s1); // $ ast,ir
+		sink(s1.append(s2.begin(), s2.end())); // $ MISSING: ir
+		sink(s1); // $ MISSING: ir
 
 		sink(s3);
 		sink(s3.append(s4.begin(), s4.end()));
@@ -379,8 +379,8 @@ void test_string_iterators() {
 		sink(iter1[1]);
 		string::iterator iter2 = s2.begin();
 
-		sink(*iter2); // $ ast,ir
-		sink(iter2[1]); // $ ast,ir
+		sink(*iter2); // $ ir
+		sink(iter2[1]); // $ ir
 	}
 
 	// arithmetic operators
@@ -393,33 +393,33 @@ void test_string_iterators() {
 		string::iterator i2 = s2.begin();
 		string::iterator i3, i4, i5, i6, i7, i8, i9, i10, i11;
 
-		sink(*(i2+1)); // $ ast,ir
-		sink(*(i2-1)); // $ ast,ir
+		sink(*(i2+1)); // $ ir
+		sink(*(i2-1)); // $ ir
 		i3 = i2;
-		sink(*(++i3)); // $ ast,ir
+		sink(*(++i3)); // $ ir
 		i4 = i2;
-		sink(*(--i4)); // $ ast,ir
+		sink(*(--i4)); // $ ir
 		i5 = i2;
 		i5++;
-		sink(*i5); // $ ast,ir
+		sink(*i5); // $ ir
 		i6 = i2;
 		i6--;
-		sink(*i6); // $ ast,ir
+		sink(*i6); // $ ir
 		i7 = i2;
-		sink(*(i7+=1)); // $ ast,ir
+		sink(*(i7+=1)); // $ ir
 		i8 = i2;
-		sink(*(i8-=1)); // $ ast,ir
+		sink(*(i8-=1)); // $ ir
 
 		i9 = s2.end();
 		--i9;
-		sink(*i9); // $ ast,ir
+		sink(*i9); // $ ir
 
 		i10 = i2;
-		sink(*(i10++)); // $ ast,ir
-		sink(i10); // $ ast,ir
+		sink(*(i10++)); // $ ir
+		sink(i10); // $ ir
 		i11 = i2;
-		sink(*(i11--)); // $ ast,ir
-		sink(i11); // $ ast,ir
+		sink(*(i11--)); // $ ir
+		sink(i11); // $ ir
 	}
 }
 
@@ -433,8 +433,8 @@ void test_string_insert_more()
 	sink(s1.insert(0, cs1));
 	sink(s1);
 
-	sink(s2.insert(0, cs2)); // $ ast,ir
-	sink(s2); // $ ast,ir
+	sink(s2.insert(0, cs2)); // $ MISSING: ir
+	sink(s2); // $ MISSING: ir
 }
 
 void test_string_iterator_methods()
@@ -446,8 +446,8 @@ void test_string_iterator_methods()
 		sink(a.insert(a.begin(), 10, 'x'));
 		sink(a);
 
-		sink(b.insert(b.begin(), 10, ns_char::source())); // $ ast,ir
-		sink(b); // $ ast,ir
+		sink(b.insert(b.begin(), 10, ns_char::source())); // $ MISSING: ir
+		sink(b); // $ MISSING: ir
 	}
 
 	{
@@ -459,11 +459,11 @@ void test_string_iterator_methods()
 		sink(c.insert(c.end(), s1.begin(), s1.end()));
 		sink(c);
 
-		sink(d.insert(d.end(), s2.begin(), s2.end())); // $ ast,ir
-		sink(d); // $ ast,ir
+		sink(d.insert(d.end(), s2.begin(), s2.end())); // $ MISSING: ir
+		sink(d); // $ MISSING: ir
 
-		sink(s2.insert(s2.end(), s1.begin(), s1.end())); // $ ast,ir
-		sink(s2); // $ ast,ir
+		sink(s2.insert(s2.end(), s1.begin(), s1.end())); // $ MISSING: ir
+		sink(s2); // $ MISSING: ir
 	}
 
 	{
@@ -475,11 +475,11 @@ void test_string_iterator_methods()
 		sink(e.append(s3.begin(), s3.end()));
 		sink(e);
 
-		sink(f.append(s4.begin(), s4.end())); // $ ast,ir
-		sink(f); // $ ast,ir
+		sink(f.append(s4.begin(), s4.end())); // $ MISSING: ir
+		sink(f); // $ MISSING: ir
 
-		sink(s4.append(s3.begin(), s3.end())); // $ ast,ir
-		sink(s4); // $ ast,ir
+		sink(s4.append(s3.begin(), s3.end())); // $ MISSING: ir
+		sink(s4); // $ MISSING: ir
 	}
 
 	{
@@ -491,11 +491,11 @@ void test_string_iterator_methods()
 		sink(g.assign(s5.cbegin(), s5.cend()));
 		sink(g);
 
-		sink(h.assign(s6.cbegin(), s6.cend())); // $ ast,ir
-		sink(h); // $ ast,ir
+		sink(h.assign(s6.cbegin(), s6.cend())); // $ MISSING: ir
+		sink(h); // $ MISSING: ir
 
 		sink(s6.assign(s5.cbegin(), s5.cend()));
-		sink(s6); // $ SPURIOUS: ast,ir
+		sink(s6);
 	}
 }
 
@@ -508,9 +508,9 @@ void test_string_constructors_more() {
 	std::string s4(s2.begin(), s2.end());
 
 	sink(s1);
-	sink(s2); // $ ast,ir
+	sink(s2); // $ MISSING: ir
 	sink(s3);
-	sink(s4); // $ ast,ir
+	sink(s4); // $ MISSING: ir
 }
 
 void test_string_front_back() {
@@ -519,8 +519,8 @@ void test_string_front_back() {
 	sink(a.front());
 	sink(a.back());
 	a.push_back(ns_char::source());
-	sink(a.front()); // $ SPURIOUS: ast,ir
-	sink(a.back()); // $ ast,ir
+	sink(a.front()); // $ SPURIOUS: ir
+	sink(a.back()); // $ ir
 }
 
 void test_string_return_assign() {
@@ -533,15 +533,15 @@ void test_string_return_assign() {
 		std::string f("ff");
 
 		sink( a += (b += "bb") );
-		sink( c += (d += source()) ); // $ ast,ir
-		sink( (e += "ee") += source() ); // $ ast,ir
-		sink( (f += source()) += "ff" ); // $ ast,ir
+		sink( c += (d += source()) ); // $ MISSING: ir
+		sink( (e += "ee") += source() ); // $ ir
+		sink( (f += source()) += "ff" ); // $ MISSING: ir
 		sink(a);
 		sink(b);
-		sink(c); // $ ast,ir
-		sink(d); // $ ast,ir
-		sink(e); // $ ast,ir
-		sink(f); // $ ast,ir
+		sink(c); // $ MISSING: ir
+		sink(d); // $ MISSING: ir
+		sink(e); // $ MISSING: ir
+		sink(f); // $ MISSING: ir
 	}
 
 	{
@@ -553,14 +553,14 @@ void test_string_return_assign() {
 		std::string f("ff");
 
 		sink( a.assign(b.assign("bb")) );
-		sink( c.assign(d.assign(source())) ); // $ ast,ir
-		sink( e.assign("ee").assign(source()) ); // $ ast,ir
+		sink( c.assign(d.assign(source())) ); // $ MISSING: ir
+		sink( e.assign("ee").assign(source()) ); // $ MISSING: ir
 		sink( f.assign(source()).assign("ff") );
 		sink(a);
 		sink(b);
-		sink(c); // $ ast,ir
-		sink(d); // $ ast,ir
-		sink(e); // $ ast,ir
-		sink(f); // $ SPURIOUS: ast,ir
+		sink(c); // $ MISSING: ir
+		sink(d); // $ MISSING: ir
+		sink(e); // $ MISSING: ir
+		sink(f);
 	}
 }

cpp/ql/test/library-tests/dataflow/taint-tests/stringstream.cpp

@@ -29,42 +29,42 @@ void test_stringstream_string(int amount)
 	std::string t(source());
 
 	sink(ss1 << "1234");
-	sink(ss2 << source()); // $ ast,ir
-	sink(ss3 << "123" << source()); // $ ast,ir
-	sink(ss4 << source() << "456"); // $ ast,ir
-	sink(ss5 << t); // $ ast,ir
+	sink(ss2 << source()); // $ ir
+	sink(ss3 << "123" << source()); // $ ir
+	sink(ss4 << source() << "456"); // $ ir
+	sink(ss5 << t); // $ ir
 
 	sink(ss1);
-	sink(ss2); // $ ast,ir
-	sink(ss3); // $ ast,ir
-	sink(ss4); // $ ast,ir
-	sink(ss5); // $ ast,ir
+	sink(ss2); // $ MISSING: ir
+	sink(ss3); // $ MISSING: ir
+	sink(ss4); // $ MISSING: ir
+	sink(ss5); // $ MISSING: ir
 	sink(ss1.str());
-	sink(ss2.str()); // $ ast,ir
-	sink(ss3.str()); // $ ast,ir
-	sink(ss4.str()); // $ ast,ir
-	sink(ss5.str()); // $ ast,ir
+	sink(ss2.str()); // $ ir
+	sink(ss3.str()); // $ ir
+	sink(ss4.str()); // $ ir
+	sink(ss5.str()); // $ ir
 
 	ss6.str("abc");
 	ss6.str(source()); // (overwrites)
 	ss7.str(source());
 	ss7.str("abc"); // (overwrites)
-	sink(ss6); // $ ast,ir
-	sink(ss7); // $ SPURIOUS: ast,ir
+	sink(ss6); // $ MISSING: ir
+	sink(ss7);
 
 	sink(ss8.put('a'));
-	sink(ss9.put(ns_char::source())); // $ ast,ir
-	sink(ss10.put('a').put(ns_char::source()).put('z')); // $ ast,ir
+	sink(ss9.put(ns_char::source())); // $ MISSING: ir
+	sink(ss10.put('a').put(ns_char::source()).put('z')); // $ ir
 	sink(ss8);
-	sink(ss9); // $ ast,ir
-	sink(ss10); // $ ast,ir
+	sink(ss9); // $ MISSING: ir
+	sink(ss10); // $ MISSING: ir
 
 	sink(ss11.write("begin", 5));
-	sink(ss12.write(source(), 5)); // $ ast,ir
-	sink(ss13.write("begin", 5).write(source(), amount).write("end", 3)); // $ ast,ir
+	sink(ss12.write(source(), 5)); // $ MISSING: ir
+	sink(ss13.write("begin", 5).write(source(), amount).write("end", 3)); // $ ir
 	sink(ss11);
-	sink(ss12); // $ ast,ir
-	sink(ss13); // $ ast,ir
+	sink(ss12); // $ MISSING: ir
+	sink(ss13); // $ MISSING: ir
 }
 
 void test_stringstream_int(int source)
@@ -73,16 +73,16 @@ void test_stringstream_int(int source)
 	int v1 = 0, v2 = 0;
 
 	sink(ss1 << 1234);
-	sink(ss2 << source); // $ ast,ir
+	sink(ss2 << source); // $ MISSING: ir
 	sink(ss1 >> v1);
-	sink(ss2 >> v2); // $ ast,ir
+	sink(ss2 >> v2); // $ ir
 
 	sink(ss1);
-	sink(ss2); // $ ast,ir
+	sink(ss2); // $ MISSING: ir
 	sink(ss1.str());
-	sink(ss2.str()); // $ ast,ir
+	sink(ss2.str()); // $ ir
 	sink(v1);
-	sink(v2); // $ ast,ir
+	sink(v2); // $ ir
 }
 
 void test_stringstream_constructors()
@@ -97,14 +97,14 @@ void test_stringstream_constructors()
 	std::stringstream ss6;
 
 	sink(ss5 = std::stringstream("abc"));
-	sink(ss6 = std::stringstream(source())); // $ ast,ir
+	sink(ss6 = std::stringstream(source())); // $ MISSING: ir
 
 	sink(ss1);
-	sink(ss2); // $ ast,ir
+	sink(ss2); // $ MISSING: ir
 	sink(ss3);
-	sink(ss4); // $ ast,ir
+	sink(ss4); // $ MISSING: ir
 	sink(ss5);
-	sink(ss6); // $ ast,ir
+	sink(ss6); // $ MISSING: ir
 }
 
 void test_stringstream_swap()
@@ -117,10 +117,10 @@ void test_stringstream_swap()
 	ss1.swap(ss2);
 	ss4.swap(ss3);
 
-	sink(ss1); // $ ast,ir
-	sink(ss2); // $ SPURIOUS: ast,ir
-	sink(ss3); // $ ast,ir
-	sink(ss4); // $ SPURIOUS: ast,ir
+	sink(ss1); // $ MISSING: ir
+	sink(ss2);
+	sink(ss3); // $ MISSING: ir
+	sink(ss4);
 }
 
 void test_stringstream_in()
@@ -140,49 +140,49 @@ void test_stringstream_in()
 	char c1 = 0, c2 = 0, c3 = 0, c4 = 0, c5 = 0, c6 = 0;
 
 	sink(ss1 << "abc");
-	sink(ss2 << source()); // $ ast,ir
+	sink(ss2 << source()); // $ ir
 
 	sink(ss1 >> s1);
-	sink(ss2 >> s2); // $ ast,ir
-	sink(ss2 >> s3 >> s4); // $ ast,ir
+	sink(ss2 >> s2); // $ ir
+	sink(ss2 >> s3 >> s4); // $ ir
 	sink(s1);
-	sink(s2); // $ ast,ir
-	sink(s3); // $ ast,ir
-	sink(s4); // $ ast,ir
+	sink(s2); // $ MISSING: ir
+	sink(s3); // $ MISSING: ir
+	sink(s4); // $ MISSING: ir
 
 	sink(ss1 >> b1);
-	sink(ss2 >> b2); // $ ast,ir
-	sink(ss2 >> b3 >> b4); // $ ast,ir
+	sink(ss2 >> b2); // $ ir
+	sink(ss2 >> b3 >> b4); // $ ir
 	sink(b1);
-	sink(b2); // $ ast,ir
-	sink(b3); // $ ast,ir
-	sink(b4); // $ ast,ir
+	sink(b2); // $ ir
+	sink(b3); // $ ir
+	sink(b4); // $ ir
 
 	sink(ss1.read(b5, 100));
-	sink(ss2.read(b6, 100)); // $ ast,ir
+	sink(ss2.read(b6, 100)); // $ ir
 	sink(ss1.readsome(b7, 100));
 	sink(ss2.readsome(b8, 100)); // (returns a length, not significantly tainted)
 	sink(ss1.get(b9, 100));
-	sink(ss2.get(b10, 100)); // $ ast,ir
+	sink(ss2.get(b10, 100)); // $ ir
 	sink(b5);
-	sink(b6); // $ ast,ir
+	sink(b6); // $ ir
 	sink(b7);
-	sink(b8); // $ ast,ir
+	sink(b8); // $ ir
 	sink(b9);
-	sink(b10); // $ ast,ir
+	sink(b10); // $ ir
 
 	sink(c1 = ss1.get());
-	sink(c2 = ss2.get()); // $ ast,ir
+	sink(c2 = ss2.get()); // $ ir
 	sink(c3 = ss1.peek());
-	sink(c4 = ss2.peek()); // $ ast,ir
+	sink(c4 = ss2.peek()); // $ ir
 	sink(ss1.get(c5));
-	sink(ss2.get(c6)); // $ ast,ir
+	sink(ss2.get(c6)); // $ ir
 	sink(c1);
-	sink(c2); // $ ast,ir
+	sink(c2); // $ ir
 	sink(c3);
-	sink(c4); // $ ast,ir
+	sink(c4); // $ ir
 	sink(c5);
-	sink(c6); // $ ast,ir
+	sink(c6); // $ ir
 }
 
 void test_stringstream_putback()
@@ -193,8 +193,8 @@ void test_stringstream_putback()
 	sink(ss.get());
 	sink(ss.putback('b'));
 	sink(ss.get());
-	sink(ss.putback(ns_char::source())); // $ ast,ir
-	sink(ss.get()); // $ ast,ir
+	sink(ss.putback(ns_char::source())); // $ MISSING: ir
+	sink(ss.get()); // $ ir
 }
 
 void test_getline()
@@ -212,44 +212,44 @@ void test_getline()
 	std::string s1, s2, s3, s4, s5, s6, s7, s8;
 
 	sink(ss1.getline(b1, 1000));
-	sink(ss2.getline(b2, 1000)); // $ ast,ir
-	sink(ss2.getline(b3, 1000)); // $ ast,ir
+	sink(ss2.getline(b2, 1000)); // $ ir
+	sink(ss2.getline(b3, 1000)); // $ ir
 	sink(ss1.getline(b3, 1000));
 	sink(b1);
-	sink(b2); // $ ast,ir
-	sink(b3); // $ SPURIOUS: ast,ir
+	sink(b2); // $ ir
+	sink(b3); // $ SPURIOUS: ir
 
 	sink(ss1.getline(b4, 1000, ' '));
-	sink(ss2.getline(b5, 1000, ' ')); // $ ast,ir
-	sink(ss2.getline(b6, 1000, ' ')); // $ ast,ir
+	sink(ss2.getline(b5, 1000, ' ')); // $ ir
+	sink(ss2.getline(b6, 1000, ' ')); // $ ir
 	sink(ss1.getline(b6, 1000, ' '));
 	sink(b4);
-	sink(b5); // $ ast,ir
-	sink(b6); // $ SPURIOUS: ast,ir
+	sink(b5); // $ ir
+	sink(b6); // $ SPURIOUS: ir
 
-	sink(ss2.getline(b7, 1000).getline(b8, 1000)); // $ ast,ir
-	sink(b7); // $ ast,ir
-	sink(b8); // $ ast,ir
+	sink(ss2.getline(b7, 1000).getline(b8, 1000)); // $ ir
+	sink(b7); // $ ir
+	sink(b8); // $ ir
 
 	sink(getline(ss1, s1));
-	sink(getline(ss2, s2)); // $ ast,ir
-	sink(getline(ss2, s3)); // $ ast,ir
+	sink(getline(ss2, s2)); // $ ir
+	sink(getline(ss2, s3)); // $ ir
 	sink(getline(ss1, s3));
 	sink(s1);
-	sink(s2); // $ ast,ir
-	sink(s3); // $ SPURIOUS: ast,ir
+	sink(s2); // $ MISSING: ir
+	sink(s3);
 
 	sink(getline(ss1, s4, ' '));
-	sink(getline(ss2, s5, ' ')); // $ ast,ir
-	sink(getline(ss2, s6, ' ')); // $ ast,ir
+	sink(getline(ss2, s5, ' ')); // $ ir
+	sink(getline(ss2, s6, ' ')); // $ ir
 	sink(getline(ss1, s6, ' '));
 	sink(s4);
-	sink(s5); // $ ast,ir
-	sink(s6); // $ SPURIOUS: ast,ir
+	sink(s5); // $ MISSING: ir
+	sink(s6);
 
-	sink(getline(getline(ss2, s7), s8)); // $ ast,ir
-	sink(s7); // $ ast,ir
-	sink(s8); // $ ast,ir
+	sink(getline(getline(ss2, s7), s8)); // $ ir
+	sink(s7); // $ MISSING: ir
+	sink(s8); // $ MISSING: ir
 }
 
 void test_chaining()
@@ -259,10 +259,10 @@ void test_chaining()
 	char b1[1000] = {0};
 	char b2[1000] = {0};
 
-	sink(ss1.get(b1, 100).unget().get(b2, 100)); // $ ast,ir
-	sink(b1); // $ ast,ir
-	sink(b2); // $ ast,ir
+	sink(ss1.get(b1, 100).unget().get(b2, 100)); // $ ir
+	sink(b1); // $ ir
+	sink(b2); // $ ir
 
-	sink(ss2.write("abc", 3).flush().write(source(), 3).flush().write("xyz", 3)); // $ ast,ir
-	sink(ss2); // $ ast,ir
+	sink(ss2.write("abc", 3).flush().write(source(), 3).flush().write("xyz", 3)); // $ ir
+	sink(ss2); // $ MISSING: ir
 }