Bump actions/cache from 3 to 4

Bumps [actions/cache](https://github.com/actions/cache) from 3 to 4.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/v3...v4)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/workflows/mad_modelDiff.yml

@@ -12,6 +12,7 @@ on:
       - main
     paths:
       - "java/ql/src/utils/modelgenerator/**/*.*"
+      - "misc/scripts/models-as-data/*.*"
       - ".github/workflows/mad_modelDiff.yml"
 
 permissions:
@@ -61,8 +62,9 @@ jobs:
             DATABASE=$2
             cd codeql-$QL_VARIANT
             SHORTNAME=`basename $DATABASE`
-            python java/ql/src/utils/modelgenerator/GenerateFlowModel.py --with-summaries --with-sinks $DATABASE ${SHORTNAME}.temp.model.yml
-            mv java/ql/lib/ext/generated/${SHORTNAME}.temp.model.yml $MODELS/${SHORTNAME}Generated_${QL_VARIANT}.model.yml
+            python java/ql/src/utils/modelgenerator/GenerateFlowModel.py --with-summaries --with-sinks $DATABASE $SHORTNAME/$QL_VARIANT
+            mkdir -p $MODELS/$SHORTNAME
+            mv java/ql/lib/ext/generated/$SHORTNAME/$QL_VARIANT $MODELS/$SHORTNAME
             cd ..
           }
 
@@ -85,16 +87,16 @@ jobs:
           set -x
           MODELS=`pwd`/tmp-models
           ls -1 tmp-models/
-          for m in $MODELS/*_main.model.yml ; do
+          for m in $MODELS/*/main/*.model.yml ; do
             t="${m/main/"pr"}"
             basename=`basename $m`
-            name="diff_${basename/_main.model.yml/""}"
+            name="diff_${basename/.model.yml/""}"
             (diff -w -u $m $t | diff2html -i stdin -F $MODELS/$name.html) || true
           done
       - uses: actions/upload-artifact@v3
         with:
           name: models
-          path: tmp-models/*.model.yml
+          path: tmp-models/**/**/*.model.yml
           retention-days: 20
       - uses: actions/upload-artifact@v3
         with:

.github/workflows/ql-for-ql-build.yml

@@ -27,7 +27,7 @@ jobs:
       ### Build the extractor ###
       - name: Cache entire extractor
         id: cache-extractor
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: |
             ql/extractor-pack/
@@ -35,7 +35,7 @@ jobs:
           key: ${{ runner.os }}-${{ steps.os_version.outputs.version }}-extractor-${{ hashFiles('ql/**/Cargo.lock') }}-${{ hashFiles('shared/tree-sitter-extractor') }}-${{ hashFiles('ql/**/*.rs') }}
       - name: Cache cargo
         if: steps.cache-extractor.outputs.cache-hit != 'true'
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: |
             ~/.cargo/registry

.github/workflows/ql-for-ql-dataset_measure.yml

@@ -30,7 +30,7 @@ jobs:
           languages: javascript # does not matter
       - uses: ./.github/actions/os-version
         id: os_version
-      - uses: actions/cache@v3
+      - uses: actions/cache@v4
         with:
           path: |
             ~/.cargo/registry

.github/workflows/ql-for-ql-tests.yml

@@ -29,7 +29,7 @@ jobs:
           languages: javascript # does not matter
       - uses: ./.github/actions/os-version
         id: os_version
-      - uses: actions/cache@v3
+      - uses: actions/cache@v4
         with:
           path: |
             ~/.cargo/registry
@@ -74,7 +74,7 @@ jobs:
           languages: javascript # does not matter
       - uses: ./.github/actions/os-version
         id: os_version
-      - uses: actions/cache@v3
+      - uses: actions/cache@v4
         with:
           path: |
             ~/.cargo/registry

.github/workflows/ruby-build.yml

@@ -54,7 +54,7 @@ jobs:
       - uses: ./.github/actions/os-version
         id: os_version
       - name: Cache entire extractor
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         id: cache-extractor
         with:
           path: |
@@ -62,7 +62,7 @@ jobs:
             ruby/extractor/target/release/codeql-extractor-ruby.exe
             ruby/extractor/ql/lib/codeql/ruby/ast/internal/TreeSitter.qll
           key: ${{ runner.os }}-${{ steps.os_version.outputs.version }}-ruby-extractor-${{ hashFiles('ruby/extractor/rust-toolchain.toml', 'ruby/extractor/Cargo.lock') }}-${{ hashFiles('shared/tree-sitter-extractor') }}-${{ hashFiles('ruby/extractor/**/*.rs') }}
-      - uses: actions/cache@v3
+      - uses: actions/cache@v4
         if: steps.cache-extractor.outputs.cache-hit != 'true'
         with:
           path: |

cpp/downgrades/cf72c8898d19eb1b3374432cf79d8276cb07ad43/upgrade.properties

@@ -1,5 +1,6 @@
 description: Support C++17 if and switch initializers
 compatibility: partial
+constexpr_if_initialization.rel: delete
 if_initialization.rel: delete
 switch_initialization.rel: delete
 exprparents.rel: run exprparents.qlo

cpp/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/cpp-all
-version: 0.12.3
+version: 0.12.4-dev
 groups: cpp
 dbscheme: semmlecode.cpp.dbscheme
 extractor: cpp

cpp/ql/lib/semmle/code/cpp/commons/StringConcatenation.qll

@@ -0,0 +1,101 @@
+/**
+ * A library for detecting general string concatenations.
+ */
+
+import cpp
+import semmle.code.cpp.models.implementations.Strcat
+import semmle.code.cpp.models.interfaces.FormattingFunction
+private import semmle.code.cpp.dataflow.new.DataFlow
+
+/**
+ * A call that performs a string concatenation. A string can be either a C
+ * string (i.e., a value of type `char*`), or a C++ string (i.e., a value of
+ * type `std::string`).
+ */
+class StringConcatenation extends Call {
+  StringConcatenation() {
+    // sprintf-like functions, i.e., concat through formatting
+    this instanceof FormattingFunctionCall
+    or
+    this.getTarget() instanceof StrcatFunction
+    or
+    this.getTarget() instanceof StrlcatFunction
+    or
+    // operator+ and ostream (<<) concat
+    exists(Call call, Operator op |
+      call.getTarget() = op and
+      op.hasQualifiedName(["std", "bsl"], ["operator+", "operator<<"]) and
+      op.getType()
+          .stripType()
+          .(UserType)
+          .hasQualifiedName(["std", "bsl"], ["basic_string", "basic_ostream"]) and
+      this = call
+    )
+  }
+
+  /**
+   * Gets an operand of this concatenation (one of the string operands being
+   * concatenated).
+   * Will not return out param for sprintf-like functions, but will consider the format string
+   * to be part of the operands.
+   */
+  Expr getAnOperand() {
+    // The result is an argument of 'this' (a call)
+    result = this.getAnArgument() and
+    // addresses odd behavior with overloaded operators
+    // i.e., "call to operator+" appearing as an operand
+    // occurs in cases like `string s = s1 + s2 + s3`, which is represented as
+    // `string s = (s1.operator+(s2)).operator+(s3);`
+    // By limiting to non-calls we get the leaf operands (the variables or raw strings)
+    // also, by not enumerating allowed types (variables and strings) we avoid issues
+    // with missed corner cases or extensions/changes to CodeQL in the future which might
+    // invalidate that approach.
+    not result instanceof Call and
+    // Limit the result type to string
+    (
+      result.getUnderlyingType().stripType().getName() = "char"
+      or
+      result
+          .getType()
+          .getUnspecifiedType()
+          .(UserType)
+          .hasQualifiedName(["std", "bsl"], "basic_string")
+    ) and
+    // when 'this' is a `FormattingFunctionCall` the result must be the format string argument
+    // or one of the formatting arguments
+    (
+      this instanceof FormattingFunctionCall
+      implies
+      (
+        result = this.(FormattingFunctionCall).getFormat()
+        or
+        exists(int n |
+          result = this.getArgument(n) and
+          n >= this.(FormattingFunctionCall).getTarget().getFirstFormatArgumentIndex()
+        )
+      )
+    )
+  }
+
+  /**
+   * Gets the data flow node representing the concatenation result.
+   */
+  DataFlow::Node getResultNode() {
+    if this.getTarget() instanceof StrcatFunction
+    then
+      result.asDefiningArgument() =
+        this.getArgument(this.getTarget().(StrcatFunction).getParamDest())
+      or
+      // Hardcoding it is also the return
+      result.asExpr() = this.(Call)
+    else
+      if this.getTarget() instanceof StrlcatFunction
+      then (
+        result.asDefiningArgument() =
+          this.getArgument(this.getTarget().(StrlcatFunction).getParamDest())
+      ) else
+        if this instanceof FormattingFunctionCall
+        then result.asDefiningArgument() = this.(FormattingFunctionCall).getOutputArgument(_)
+        else result.asExpr() = this.(Call)
+  }
+}

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowDispatch.qll

@@ -54,18 +54,6 @@ private predicate functionSignature(Function f, string qualifiedName, int nparam
   not f.isStatic()
 }
 
-/**
- * Holds if the set of viable implementations that can be called by `call`
- * might be improved by knowing the call context.
- */
-predicate mayBenefitFromCallContext(DataFlowCall call, Function f) { none() }
-
-/**
- * Gets a viable dispatch target of `call` in the context `ctx`. This is
- * restricted to those `call`s for which a context might make a difference.
- */
-Function viableImplInCallContext(DataFlowCall call, DataFlowCall ctx) { none() }
-
 /** A parameter position represented by an integer. */
 class ParameterPosition extends int {
   ParameterPosition() { any(ParameterNode p).isParameterOf(_, this) }

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowDispatch.qll

@@ -249,9 +249,7 @@ private predicate functionSignature(Function f, string qualifiedName, int nparam
  * Holds if the set of viable implementations that can be called by `call`
  * might be improved by knowing the call context.
  */
-predicate mayBenefitFromCallContext(DataFlowCall call, DataFlowCallable f) {
-  mayBenefitFromCallContext(call, f, _)
-}
+predicate mayBenefitFromCallContext(DataFlowCall call) { mayBenefitFromCallContext(call, _, _) }
 
 /**
  * Holds if `call` is a call through a function pointer, and the pointer

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplSpecific.qll

@@ -22,4 +22,8 @@ module CppDataFlow implements InputSig {
   predicate getAdditionalFlowIntoCallNodeTerm = Private::getAdditionalFlowIntoCallNodeTerm/2;
 
   predicate validParameterAliasStep = Private::validParameterAliasStep/2;
+
+  predicate mayBenefitFromCallContext = Private::mayBenefitFromCallContext/1;
+
+  predicate viableImplInCallContext = Private::viableImplInCallContext/2;
 }

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternals.qll

@@ -149,11 +149,16 @@ private newtype TDefOrUseImpl =
 private predicate isGlobalUse(
   GlobalLikeVariable v, IRFunction f, int indirection, int indirectionIndex
 ) {
-  exists(VariableAddressInstruction vai |
-    vai.getEnclosingIRFunction() = f and
-    vai.getAstVariable() = v and
-    isDef(_, _, _, vai, indirection, indirectionIndex)
-  )
+  // Generate a "global use" at the end of the function body if there's a
+  // direct definition somewhere in the body of the function
+  indirection =
+    min(int cand, VariableAddressInstruction vai |
+      vai.getEnclosingIRFunction() = f and
+      vai.getAstVariable() = v and
+      isDef(_, _, _, vai, cand, indirectionIndex)
+    |
+      cand
+    )
 }
 
 private predicate isGlobalDefImpl(
@@ -447,6 +452,57 @@ class FinalParameterUse extends UseImpl, TFinalParameterUse {
   }
 }
 
+/**
+ * A use that models a synthetic "last use" of a global variable just before a
+ * function returns.
+ *
+ * We model global variable flow by:
+ * - Inserting a last use of any global variable that's modified by a function
+ * - Flowing from the last use to the `VariableNode` that represents the global
+ *   variable.
+ * - Flowing from the `VariableNode` to an "initial def" of the global variable
+ * in any function that may read the global variable.
+ * - Flowing from the initial definition to any subsequent uses of the global
+ *   variable in the function body.
+ *
+ * For example, consider the following pair of functions:
+ * ```cpp
+ * int global;
+ * int source();
+ * void sink(int);
+ *
+ * void set_global() {
+ *   global = source();
+ * }
+ *
+ * void read_global() {
+ *  sink(global);
+ * }
+ * ```
+ * we insert global uses and defs so that (from the point-of-view of dataflow)
+ * the above scenario looks like:
+ * ```cpp
+ * int global; // (1)
+ * int source();
+ * void sink(int);
+ *
+ * void set_global() {
+ *   global = source();
+ *   __global_use(global); // (2)
+ * }
+ *
+ * void read_global() {
+ *  global = __global_def; // (3)
+ *  sink(global); // (4)
+ * }
+ * ```
+ * and flow from `source()` to the argument of `sink` is then modeled as
+ * follows:
+ * 1. Flow from `source()` to `(2)` (via SSA).
+ * 2. Flow from `(2)` to `(1)` (via a `jumpStep`).
+ * 3. Flow from `(1)` to `(3)` (via a `jumpStep`).
+ * 4. Flow from `(3)` to `(4)` (via SSA).
+ */
 class GlobalUse extends UseImpl, TGlobalUse {
   GlobalLikeVariable global;
   IRFunction f;
@@ -494,6 +550,12 @@ class GlobalUse extends UseImpl, TGlobalUse {
   override BaseSourceVariableInstruction getBase() { none() }
 }
 
+/**
+ * A definition that models a synthetic "initial definition" of a global
+ * variable just after the function entry point.
+ *
+ * See the QLDoc for `GlobalUse` for how this is used.
+ */
 class GlobalDefImpl extends DefOrUseImpl, TGlobalDefImpl {
   GlobalLikeVariable global;
   IRFunction f;

cpp/ql/lib/semmle/code/cpp/rangeanalysis/RangeAnalysisUtils.qll

@@ -355,13 +355,13 @@ private predicate linearAccessImpl(Expr expr, VariableAccess v, float p, float q
  * `cmpWithLinearBound(guard, v, Greater(), true)` and
  * `cmpWithLinearBound(guard, v, Lesser(),  false)` hold.
  * If `guard` is `4 - v > 5` then
- * `cmpWithLinearBound(guard, v, Lesser(),  false)` and
- * `cmpWithLinearBound(guard, v, Greater(), true)` hold.
+ * `cmpWithLinearBound(guard, v, Lesser(),  true)` and
+ * `cmpWithLinearBound(guard, v, Greater(), false)` hold.
  *
- * A more sophisticated predicate, such as `boundFromGuard`, is needed
- * to compute an actual bound for `v`. This predicate can be used if
- * you just want to check whether a variable is bounded, or to restrict
- * a more expensive analysis to just guards that bound a variable.
+ * If an actual bound for `v` is needed, use `upperBound` or `lowerBound`.
+ * This predicate can be used if you just want to check whether a variable
+ * is bounded, or to restrict a more expensive analysis to just guards that
+ * bound a variable.
  */
 predicate cmpWithLinearBound(
   ComparisonOperation guard, VariableAccess v,

cpp/ql/lib/upgrades/098850d25c4e9d417eb74c1bef9deb2f9d2dc417/upgrade.properties

@@ -1,3 +1,6 @@
 description: Remove the old CFG tables
 compatibility: full
 
+falsecond.rel: delete
+successors.rel: delete
+truecond.rel: delete

cpp/ql/src/change-notes/2024-01-09-add-exception-to-av-rule-32.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The `cpp/include-non-header` style query will now ignore the `.def` extension for textual header inclusions.

cpp/ql/src/experimental/Security/CWE/CWE-1240/CustomCryptographicPrimitive.ql

@@ -60,7 +60,7 @@ predicate computeHeuristicType(Type t) {
 
 /**
  * Holds if `e` is an operation that is common in encryption-like computations.
- * Looking for clusters of these tends to find things like encrpytion,
+ * Looking for clusters of these tends to find things like encryption,
  * compression, random number generation, graphics processing and other compute
  * heavy algorithms.
  */

cpp/ql/src/jsf/4.06 Pre-Processing Directives/AV Rule 32.ql

@@ -18,6 +18,7 @@ from Include i, File f, string extension
 where
   f = i.getIncludedFile() and
   extension = f.getExtension().toLowerCase() and
+  extension != "def" and
   extension != "inc" and
   extension != "inl" and
   extension != "tcc" and

cpp/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/cpp-queries
-version: 0.9.2
+version: 0.9.3-dev
 groups:
   - cpp
   - queries

cpp/ql/test/library-tests/builtins/functions_file/builtins.txt

@@ -1,2 +0,0 @@
-__builtin_foobar(i)i
-__builtin_malloc(i,i,i,f*)f

cpp/ql/test/library-tests/builtins/functions_file/isbuiltin.expected

@@ -1,4 +0,0 @@
-| file://:0:0:0:0 | __builtin_add_overflow | true | 0 | file://:0:0:0:0 | bool |
-| file://:0:0:0:0 | __builtin_foobar | true | 1 | file://:0:0:0:0 | int |
-| file://:0:0:0:0 | __builtin_malloc | true | 4 | file://:0:0:0:0 | float |
-| test.c:1:6:1:6 | f | false | 3 | file://:0:0:0:0 | long |

cpp/ql/test/library-tests/builtins/functions_file/isbuiltin.ql

@@ -1,5 +0,0 @@
-import cpp
-
-from Function f, boolean isBuiltin
-where if f instanceof BuiltInFunction then isBuiltin = true else isBuiltin = false
-select f, isBuiltin, f.getNumberOfParameters(), f.getType()

cpp/ql/test/library-tests/builtins/functions_file/test.c

@@ -1,20 +0,0 @@
-long f(int a, int b, int c) {
-  // A builtin from the builtin_functions_file.
-  int i1 = __builtin_foobar(a);
-
-  // A builtin that's not in the file, but the extractor should handle, given the
-  // --gnu_version flag we pass in.
-  int i2;
-  __builtin_add_overflow(a, b, &i2);
-
-  // A builtin that would normally be defined by the extractor with a type
-  // expecting it to be called like this:
-  //void* x = __builtin_malloc(a);
-  // But we override the type in the builtin_functions_file so it's called like
-  // this:
-  float f1, f2;
-  f1 = __builtin_malloc(a, b, c, &f2);
-
-  return 42;
-}
-// semmle-extractor-options: --gnu_version 50100 --edg --builtin_functions_file --edg ${testdir}/builtins.txt

cpp/ql/test/library-tests/c++_exceptions/graphable.expected

@@ -1,384 +1,388 @@
-| C::C | false | 493 | 493 | C |
-| C::C | false | 682 | 682 | C |
-| C::operator= | false | 675 | 675 | operator= |
-| C::~C | false | 614 | 614 | ~C |
-| Error::Error | false | 259 | 259 | Error |
-| Error::Error | false | 272 | 272 | Error |
-| Error::Error | false | 277 | 277 | return ... |
-| Error::Error | false | 279 | 279 | { ... } |
-| Error::Error | true | 277 | 272 |  |
-| Error::Error | true | 279 | 277 |  |
-| Error::operator= | false | 253 | 253 | operator= |
-| Error::~Error | false | 263 | 263 | ~Error |
-| Error::~Error | false | 268 | 268 | return ... |
-| Error::~Error | false | 270 | 270 | { ... } |
-| Error::~Error | true | 268 | 263 |  |
-| Error::~Error | true | 270 | 268 |  |
-| __va_list_tag::operator= | false | 140 | 140 | operator= |
-| __va_list_tag::operator= | false | 147 | 147 | operator= |
-| f | false | 477 | 477 | f |
-| f | false | 488 | 488 | declaration |
-| f | false | 491 | 491 | call to C |
-| f | false | 496 | 496 | 102 |
-| f | false | 497 | 497 | initializer for c102 |
-| f | false | 501 | 501 | call to C |
-| f | false | 505 | 505 | 103 |
-| f | false | 506 | 506 | initializer for c103 |
-| f | false | 509 | 509 | declaration |
-| f | false | 511 | 511 | b1 |
-| f | false | 513 | 513 | (bool)... |
-| f | false | 516 | 516 | 1 |
-| f | false | 517 | 517 | throw ... |
-| f | false | 519 | 519 | ExprStmt |
-| f | false | 521 | 521 | { ... } |
-| f | false | 523 | 523 | if (...) ...  |
-| f | false | 525 | 525 | declaration |
-| f | false | 527 | 527 | { ... } |
-| f | false | 534 | 534 | 1 |
-| f | false | 536 | 536 | call to C |
-| f | false | 540 | 540 | 104 |
-| f | false | 541 | 541 | initializer for c104 |
-| f | false | 544 | 544 | declaration |
-| f | false | 546 | 546 | { ... } |
-| f | false | 548 | 548 | __try { ... } __except( ... ) { ... } |
-| f | false | 550 | 550 | declaration |
+| C::C | false | 499 | 499 | C |
+| C::C | false | 690 | 690 | C |
+| C::operator= | false | 681 | 681 | operator= |
+| C::~C | false | 647 | 647 | ~C |
+| Error::Error | false | 205 | 205 | Error |
+| Error::Error | false | 219 | 219 | Error |
+| Error::Error | false | 224 | 224 | return ... |
+| Error::Error | false | 226 | 226 | { ... } |
+| Error::Error | true | 224 | 219 |  |
+| Error::Error | true | 226 | 224 |  |
+| Error::operator= | false | 197 | 197 | operator= |
+| Error::~Error | false | 209 | 209 | ~Error |
+| Error::~Error | false | 215 | 215 | return ... |
+| Error::~Error | false | 217 | 217 | { ... } |
+| Error::~Error | true | 215 | 209 |  |
+| Error::~Error | true | 217 | 215 |  |
+| __va_list_tag::operator= | false | 66 | 66 | operator= |
+| __va_list_tag::operator= | false | 72 | 72 | operator= |
+| f | false | 483 | 483 | f |
+| f | false | 494 | 494 | declaration |
+| f | false | 497 | 497 | call to C |
+| f | false | 502 | 502 | 101 |
+| f | false | 503 | 503 | initializer for c101 |
+| f | false | 506 | 506 | __try { ... } __except( ... ) { ... } |
+| f | false | 509 | 509 | call to C |
+| f | false | 513 | 513 | 102 |
+| f | false | 514 | 514 | initializer for c102 |
+| f | false | 518 | 518 | call to C |
+| f | false | 522 | 522 | 103 |
+| f | false | 523 | 523 | initializer for c103 |
+| f | false | 526 | 526 | declaration |
+| f | false | 528 | 528 | if (...) ...  |
+| f | false | 530 | 530 | b1 |
+| f | false | 532 | 532 | (bool)... |
+| f | false | 533 | 533 | ExprStmt |
+| f | false | 537 | 537 | 1 |
+| f | false | 538 | 538 | throw ... |
+| f | false | 540 | 540 | { ... } |
+| f | false | 542 | 542 | declaration |
+| f | false | 544 | 544 | { ... } |
+| f | false | 551 | 551 | 1 |
 | f | false | 553 | 553 | call to C |
-| f | false | 557 | 557 | 106 |
-| f | false | 558 | 558 | initializer for c106 |
-| f | false | 562 | 562 | call to C |
-| f | false | 566 | 566 | 107 |
-| f | false | 567 | 567 | initializer for c107 |
-| f | false | 570 | 570 | declaration |
-| f | false | 572 | 572 | b2 |
-| f | false | 574 | 574 | (bool)... |
-| f | false | 577 | 577 | 2 |
-| f | false | 578 | 578 | throw ... |
-| f | false | 580 | 580 | ExprStmt |
-| f | false | 582 | 582 | { ... } |
-| f | false | 584 | 584 | if (...) ...  |
-| f | false | 586 | 586 | declaration |
-| f | false | 588 | 588 | { ... } |
-| f | false | 591 | 591 | call to C |
-| f | false | 595 | 595 | 108 |
-| f | false | 596 | 596 | initializer for c108 |
-| f | false | 599 | 599 | declaration |
-| f | false | 601 | 601 | { ... } |
-| f | false | 603 | 603 | __try { ... } __finally { ... } |
-| f | false | 605 | 605 | declaration |
-| f | false | 607 | 607 | return ... |
-| f | false | 609 | 609 | { ... } |
-| f | false | 611 | 611 | c101 |
-| f | false | 613 | 613 | call to c101.~C |
-| f | false | 615 | 615 | c105 |
-| f | false | 616 | 616 | call to c105.~C |
-| f | false | 617 | 617 | c109 |
-| f | false | 618 | 618 | call to c109.~C |
-| f | false | 619 | 619 | c101 |
-| f | false | 620 | 620 | call to c101.~C |
-| f | false | 621 | 621 | c105 |
-| f | false | 622 | 622 | call to c105.~C |
-| f | false | 623 | 623 | c108 |
-| f | false | 625 | 625 | call to c108.~C |
-| f | false | 626 | 626 | c106 |
-| f | false | 628 | 628 | call to c106.~C |
-| f | false | 629 | 629 | c107 |
-| f | false | 630 | 630 | call to c107.~C |
-| f | false | 631 | 631 | c106 |
-| f | false | 632 | 632 | call to c106.~C |
-| f | false | 633 | 633 | c104 |
-| f | false | 635 | 635 | call to c104.~C |
-| f | false | 636 | 636 | c102 |
-| f | false | 638 | 638 | call to c102.~C |
-| f | false | 639 | 639 | c103 |
-| f | false | 640 | 640 | call to c103.~C |
-| f | false | 641 | 641 | c102 |
-| f | false | 642 | 642 | call to c102.~C |
-| f | false | 644 | 644 | call to C |
-| f | false | 648 | 648 | 101 |
-| f | false | 649 | 649 | initializer for c101 |
-| f | false | 653 | 653 | call to C |
-| f | false | 657 | 657 | 105 |
-| f | false | 658 | 658 | initializer for c105 |
-| f | false | 662 | 662 | call to C |
-| f | false | 666 | 666 | 109 |
-| f | false | 667 | 667 | initializer for c109 |
-| f | true | 488 | 649 |  |
-| f | true | 491 | 523 |  |
-| f | true | 496 | 491 |  |
-| f | true | 497 | 496 |  |
-| f | true | 501 | 639 |  |
-| f | true | 505 | 501 |  |
-| f | true | 506 | 505 |  |
-| f | true | 509 | 497 |  |
-| f | true | 511 | 521 | T |
-| f | true | 511 | 525 | F |
-| f | true | 516 | 517 |  |
-| f | true | 517 | 641 |  |
-| f | true | 519 | 516 |  |
-| f | true | 521 | 519 |  |
-| f | true | 523 | 511 |  |
-| f | true | 525 | 506 |  |
-| f | true | 527 | 509 |  |
-| f | true | 534 | 546 | T |
-| f | true | 536 | 633 |  |
-| f | true | 540 | 536 |  |
-| f | true | 541 | 540 |  |
-| f | true | 544 | 541 |  |
-| f | true | 546 | 544 |  |
-| f | true | 548 | 527 |  |
-| f | true | 550 | 658 |  |
-| f | true | 553 | 584 |  |
+| f | false | 557 | 557 | 104 |
+| f | false | 558 | 558 | initializer for c104 |
+| f | false | 561 | 561 | declaration |
+| f | false | 563 | 563 | { ... } |
+| f | false | 565 | 565 | declaration |
+| f | false | 568 | 568 | call to C |
+| f | false | 572 | 572 | 105 |
+| f | false | 573 | 573 | initializer for c105 |
+| f | false | 576 | 576 | __try { ... } __finally { ... } |
+| f | false | 579 | 579 | call to C |
+| f | false | 583 | 583 | 106 |
+| f | false | 584 | 584 | initializer for c106 |
+| f | false | 588 | 588 | call to C |
+| f | false | 592 | 592 | 107 |
+| f | false | 593 | 593 | initializer for c107 |
+| f | false | 596 | 596 | declaration |
+| f | false | 598 | 598 | if (...) ...  |
+| f | false | 600 | 600 | b2 |
+| f | false | 602 | 602 | (bool)... |
+| f | false | 603 | 603 | ExprStmt |
+| f | false | 607 | 607 | 2 |
+| f | false | 608 | 608 | throw ... |
+| f | false | 610 | 610 | { ... } |
+| f | false | 612 | 612 | declaration |
+| f | false | 614 | 614 | { ... } |
+| f | false | 617 | 617 | call to C |
+| f | false | 621 | 621 | 108 |
+| f | false | 622 | 622 | initializer for c108 |
+| f | false | 625 | 625 | declaration |
+| f | false | 627 | 627 | { ... } |
+| f | false | 629 | 629 | declaration |
+| f | false | 632 | 632 | call to C |
+| f | false | 636 | 636 | 109 |
+| f | false | 637 | 637 | initializer for c109 |
+| f | false | 640 | 640 | return ... |
+| f | false | 642 | 642 | { ... } |
+| f | false | 644 | 644 | c104 |
+| f | false | 646 | 646 | call to c104.~C |
+| f | false | 648 | 648 | c101 |
+| f | false | 650 | 650 | call to c101.~C |
+| f | false | 651 | 651 | c102 |
+| f | false | 653 | 653 | call to c102.~C |
+| f | false | 654 | 654 | c103 |
+| f | false | 655 | 655 | call to c103.~C |
+| f | false | 656 | 656 | c102 |
+| f | false | 657 | 657 | call to c102.~C |
+| f | false | 658 | 658 | c101 |
+| f | false | 659 | 659 | call to c101.~C |
+| f | false | 660 | 660 | c105 |
+| f | false | 661 | 661 | call to c105.~C |
+| f | false | 662 | 662 | c108 |
+| f | false | 664 | 664 | call to c108.~C |
+| f | false | 665 | 665 | c106 |
+| f | false | 667 | 667 | call to c106.~C |
+| f | false | 668 | 668 | c107 |
+| f | false | 669 | 669 | call to c107.~C |
+| f | false | 670 | 670 | c106 |
+| f | false | 671 | 671 | call to c106.~C |
+| f | false | 672 | 672 | c101 |
+| f | false | 673 | 673 | call to c101.~C |
+| f | false | 674 | 674 | c105 |
+| f | false | 675 | 675 | call to c105.~C |
+| f | false | 676 | 676 | c109 |
+| f | false | 677 | 677 | call to c109.~C |
+| f | true | 494 | 503 |  |
+| f | true | 497 | 506 |  |
+| f | true | 502 | 497 |  |
+| f | true | 503 | 502 |  |
+| f | true | 506 | 544 |  |
+| f | true | 509 | 528 |  |
+| f | true | 513 | 509 |  |
+| f | true | 514 | 513 |  |
+| f | true | 518 | 654 |  |
+| f | true | 522 | 518 |  |
+| f | true | 523 | 522 |  |
+| f | true | 526 | 514 |  |
+| f | true | 528 | 530 |  |
+| f | true | 530 | 540 | T |
+| f | true | 530 | 542 | F |
+| f | true | 533 | 537 |  |
+| f | true | 537 | 538 |  |
+| f | true | 538 | 656 |  |
+| f | true | 540 | 533 |  |
+| f | true | 542 | 523 |  |
+| f | true | 544 | 526 |  |
+| f | true | 551 | 563 | T |
+| f | true | 553 | 644 |  |
 | f | true | 557 | 553 |  |
 | f | true | 558 | 557 |  |
-| f | true | 562 | 629 |  |
-| f | true | 566 | 562 |  |
-| f | true | 567 | 566 |  |
-| f | true | 570 | 558 |  |
-| f | true | 572 | 582 | T |
-| f | true | 572 | 586 | F |
-| f | true | 577 | 578 |  |
-| f | true | 578 | 631 |  |
-| f | true | 580 | 577 |  |
-| f | true | 582 | 580 |  |
-| f | true | 584 | 572 |  |
-| f | true | 586 | 567 |  |
-| f | true | 588 | 570 |  |
-| f | true | 591 | 623 |  |
-| f | true | 595 | 591 |  |
-| f | true | 596 | 595 |  |
-| f | true | 599 | 596 |  |
-| f | true | 601 | 599 |  |
-| f | true | 603 | 588 |  |
-| f | true | 605 | 667 |  |
-| f | true | 607 | 617 |  |
-| f | true | 609 | 488 |  |
-| f | true | 611 | 613 |  |
-| f | true | 613 | 477 |  |
-| f | true | 615 | 616 |  |
-| f | true | 616 | 611 |  |
-| f | true | 617 | 618 |  |
-| f | true | 618 | 615 |  |
-| f | true | 619 | 620 |  |
-| f | true | 620 | 477 |  |
-| f | true | 621 | 622 |  |
-| f | true | 622 | 619 |  |
-| f | true | 623 | 625 |  |
-| f | true | 625 | 605 |  |
-| f | true | 625 | 621 |  |
-| f | true | 626 | 628 |  |
-| f | true | 628 | 601 |  |
-| f | true | 629 | 630 |  |
-| f | true | 630 | 626 |  |
-| f | true | 631 | 632 |  |
-| f | true | 632 | 601 |  |
-| f | true | 633 | 635 |  |
-| f | true | 635 | 550 |  |
-| f | true | 636 | 638 |  |
-| f | true | 638 | 550 |  |
-| f | true | 639 | 640 |  |
-| f | true | 640 | 636 |  |
-| f | true | 641 | 642 |  |
-| f | true | 642 | 534 |  |
-| f | true | 644 | 548 |  |
-| f | true | 648 | 644 |  |
-| f | true | 649 | 648 |  |
-| f | true | 653 | 603 |  |
-| f | true | 657 | 653 |  |
-| f | true | 658 | 657 |  |
-| f | true | 662 | 607 |  |
-| f | true | 666 | 662 |  |
-| f | true | 667 | 666 |  |
-| f1 | false | 292 | 292 | f1 |
-| f2 | false | 299 | 299 | f2 |
-| f3 | false | 304 | 304 | f3 |
-| f4 | false | 309 | 309 | f4 |
-| f4 | false | 433 | 433 | return ... |
-| f4 | false | 435 | 435 | { ... } |
-| f4 | true | 433 | 309 |  |
-| f4 | true | 435 | 433 |  |
-| f5 | false | 314 | 314 | f5 |
-| f5 | false | 422 | 422 | 3 |
-| f5 | false | 423 | 423 | throw ... |
-| f5 | false | 425 | 425 | ExprStmt |
-| f5 | false | 427 | 427 | { ... } |
-| f5 | true | 422 | 423 |  |
-| f5 | true | 423 | 314 |  |
-| f5 | true | 425 | 422 |  |
-| f5 | true | 427 | 425 |  |
-| fun | false | 287 | 287 | fun |
-| fun | false | 295 | 295 | call to f1 |
+| f | true | 561 | 558 |  |
+| f | true | 563 | 561 |  |
+| f | true | 565 | 573 |  |
+| f | true | 568 | 576 |  |
+| f | true | 572 | 568 |  |
+| f | true | 573 | 572 |  |
+| f | true | 576 | 614 |  |
+| f | true | 579 | 598 |  |
+| f | true | 583 | 579 |  |
+| f | true | 584 | 583 |  |
+| f | true | 588 | 668 |  |
+| f | true | 592 | 588 |  |
+| f | true | 593 | 592 |  |
+| f | true | 596 | 584 |  |
+| f | true | 598 | 600 |  |
+| f | true | 600 | 610 | T |
+| f | true | 600 | 612 | F |
+| f | true | 603 | 607 |  |
+| f | true | 607 | 608 |  |
+| f | true | 608 | 670 |  |
+| f | true | 610 | 603 |  |
+| f | true | 612 | 593 |  |
+| f | true | 614 | 596 |  |
+| f | true | 617 | 662 |  |
+| f | true | 621 | 617 |  |
+| f | true | 622 | 621 |  |
+| f | true | 625 | 622 |  |
+| f | true | 627 | 625 |  |
+| f | true | 629 | 637 |  |
+| f | true | 632 | 640 |  |
+| f | true | 636 | 632 |  |
+| f | true | 637 | 636 |  |
+| f | true | 640 | 676 |  |
+| f | true | 642 | 494 |  |
+| f | true | 644 | 646 |  |
+| f | true | 646 | 565 |  |
+| f | true | 648 | 650 |  |
+| f | true | 650 | 483 |  |
+| f | true | 651 | 653 |  |
+| f | true | 653 | 565 |  |
+| f | true | 654 | 655 |  |
+| f | true | 655 | 651 |  |
+| f | true | 656 | 657 |  |
+| f | true | 657 | 551 |  |
+| f | true | 658 | 659 |  |
+| f | true | 659 | 483 |  |
+| f | true | 660 | 661 |  |
+| f | true | 661 | 658 |  |
+| f | true | 662 | 664 |  |
+| f | true | 664 | 629 |  |
+| f | true | 664 | 660 |  |
+| f | true | 665 | 667 |  |
+| f | true | 667 | 627 |  |
+| f | true | 668 | 669 |  |
+| f | true | 669 | 665 |  |
+| f | true | 670 | 671 |  |
+| f | true | 671 | 627 |  |
+| f | true | 672 | 673 |  |
+| f | true | 673 | 483 |  |
+| f | true | 674 | 675 |  |
+| f | true | 675 | 672 |  |
+| f | true | 676 | 677 |  |
+| f | true | 677 | 674 |  |
+| f1 | false | 287 | 287 | f1 |
+| f2 | false | 294 | 294 | f2 |
+| f3 | false | 299 | 299 | f3 |
+| f4 | false | 304 | 304 | f4 |
+| f4 | false | 422 | 422 | return ... |
+| f4 | false | 424 | 424 | { ... } |
+| f4 | true | 422 | 304 |  |
+| f4 | true | 424 | 422 |  |
+| f5 | false | 309 | 309 | f5 |
+| f5 | false | 409 | 409 | ExprStmt |
+| f5 | false | 413 | 413 | 3 |
+| f5 | false | 414 | 414 | throw ... |
+| f5 | false | 416 | 416 | { ... } |
+| f5 | true | 409 | 413 |  |
+| f5 | true | 413 | 414 |  |
+| f5 | true | 414 | 309 |  |
+| f5 | true | 416 | 409 |  |
+| fun | false | 276 | 276 | fun |
+| fun | false | 281 | 281 | try { ... } |
+| fun | false | 283 | 283 | try { ... } |
+| fun | false | 285 | 285 | ExprStmt |
+| fun | false | 290 | 290 | call to f1 |
+| fun | false | 292 | 292 | ExprStmt |
+| fun | false | 295 | 295 | call to f2 |
 | fun | false | 297 | 297 | ExprStmt |
-| fun | false | 300 | 300 | call to f2 |
+| fun | false | 300 | 300 | call to f3 |
 | fun | false | 302 | 302 | ExprStmt |
-| fun | false | 305 | 305 | call to f3 |
+| fun | false | 305 | 305 | call to f4 |
 | fun | false | 307 | 307 | ExprStmt |
-| fun | false | 310 | 310 | call to f4 |
+| fun | false | 310 | 310 | call to f5 |
 | fun | false | 312 | 312 | ExprStmt |
-| fun | false | 315 | 315 | call to f5 |
-| fun | false | 317 | 317 | ExprStmt |
-| fun | false | 321 | 321 | 5 |
-| fun | false | 322 | 322 | throw ... |
-| fun | false | 324 | 324 | ExprStmt |
-| fun | false | 327 | 327 | call to g |
+| fun | false | 316 | 316 | 5 |
+| fun | false | 317 | 317 | throw ... |
+| fun | false | 319 | 319 | ExprStmt |
+| fun | false | 322 | 322 | call to g |
+| fun | false | 324 | 324 | { ... } |
 | fun | false | 329 | 329 | ExprStmt |
-| fun | false | 331 | 331 | { ... } |
-| fun | false | 337 | 337 | call to h |
-| fun | false | 339 | 339 | ExprStmt |
-| fun | false | 341 | 341 | { ... } |
-| fun | false | 343 | 343 | <handler> |
-| fun | false | 344 | 344 | try { ... } |
-| fun | false | 346 | 346 | { ... } |
-| fun | false | 352 | 352 | call to i |
-| fun | false | 354 | 354 | ExprStmt |
-| fun | false | 356 | 356 | { ... } |
-| fun | false | 362 | 362 | call to j |
-| fun | false | 364 | 364 | ExprStmt |
-| fun | false | 366 | 366 | { ... } |
-| fun | false | 368 | 368 | <handler> |
-| fun | false | 369 | 369 | <handler> |
-| fun | false | 370 | 370 | try { ... } |
-| fun | false | 373 | 373 | call to k |
-| fun | false | 375 | 375 | ExprStmt |
-| fun | false | 379 | 379 | 7 |
-| fun | false | 380 | 380 | throw ... |
-| fun | false | 382 | 382 | ExprStmt |
-| fun | false | 384 | 384 | { ... } |
-| fun | false | 390 | 390 | call to l |
-| fun | false | 392 | 392 | ExprStmt |
-| fun | false | 394 | 394 | { ... } |
-| fun | false | 397 | 397 | call to m |
-| fun | false | 399 | 399 | ExprStmt |
-| fun | false | 401 | 401 | { ... } |
-| fun | false | 403 | 403 | <handler> |
-| fun | false | 404 | 404 | <handler> |
-| fun | false | 405 | 405 | try { ... } |
-| fun | false | 408 | 408 | call to n |
-| fun | false | 410 | 410 | ExprStmt |
-| fun | false | 412 | 412 | return ... |
-| fun | false | 414 | 414 | { ... } |
-| fun | true | 295 | 302 |  |
-| fun | true | 297 | 295 |  |
-| fun | true | 300 | 307 |  |
-| fun | true | 302 | 300 |  |
-| fun | true | 305 | 312 |  |
-| fun | true | 307 | 305 |  |
-| fun | true | 310 | 317 |  |
-| fun | true | 312 | 310 |  |
-| fun | true | 317 | 315 |  |
-| fun | true | 321 | 322 |  |
-| fun | true | 322 | 343 |  |
-| fun | true | 324 | 321 |  |
-| fun | true | 327 | 375 |  |
-| fun | true | 329 | 327 |  |
-| fun | true | 331 | 297 |  |
-| fun | true | 337 | 375 |  |
-| fun | true | 339 | 337 |  |
-| fun | true | 341 | 339 |  |
-| fun | true | 343 | 341 |  |
-| fun | true | 343 | 368 |  |
-| fun | true | 344 | 331 |  |
-| fun | true | 346 | 344 |  |
-| fun | true | 352 | 375 |  |
-| fun | true | 354 | 352 |  |
-| fun | true | 356 | 354 |  |
-| fun | true | 362 | 375 |  |
-| fun | true | 364 | 362 |  |
-| fun | true | 366 | 364 |  |
-| fun | true | 368 | 356 |  |
-| fun | true | 368 | 369 |  |
-| fun | true | 369 | 287 |  |
-| fun | true | 369 | 366 |  |
-| fun | true | 370 | 346 |  |
-| fun | true | 373 | 405 |  |
-| fun | true | 375 | 373 |  |
-| fun | true | 379 | 380 |  |
-| fun | true | 380 | 403 |  |
-| fun | true | 382 | 379 |  |
-| fun | true | 384 | 382 |  |
-| fun | true | 390 | 410 |  |
-| fun | true | 392 | 390 |  |
-| fun | true | 394 | 392 |  |
-| fun | true | 397 | 410 |  |
-| fun | true | 399 | 397 |  |
-| fun | true | 401 | 399 |  |
-| fun | true | 403 | 394 |  |
-| fun | true | 403 | 404 |  |
-| fun | true | 404 | 401 |  |
-| fun | true | 405 | 384 |  |
-| fun | true | 408 | 412 |  |
-| fun | true | 410 | 408 |  |
-| fun | true | 412 | 287 |  |
-| fun | true | 414 | 370 |  |
-| fun2 | false | 204 | 204 | fun2 |
-| fun2 | false | 215 | 215 | fun2 |
-| fun2 | false | 218 | 218 | { ... } |
-| fun2 | false | 223 | 223 | re-throw exception  |
-| fun2 | false | 225 | 225 | ExprStmt |
-| fun2 | false | 227 | 227 | { ... } |
-| fun2 | false | 231 | 231 | 1 |
-| fun2 | false | 232 | 232 | return ... |
-| fun2 | false | 234 | 234 | { ... } |
-| fun2 | false | 236 | 236 | <handler> |
-| fun2 | false | 237 | 237 | <handler> |
-| fun2 | false | 238 | 238 | try { ... } |
-| fun2 | false | 242 | 242 | 0 |
-| fun2 | false | 243 | 243 | return ... |
-| fun2 | false | 245 | 245 | { ... } |
-| fun2 | false | 702 | 702 | { ... } |
-| fun2 | false | 707 | 707 | re-throw exception  |
-| fun2 | false | 708 | 708 | ExprStmt |
-| fun2 | false | 709 | 709 | { ... } |
-| fun2 | false | 711 | 711 | 1 |
-| fun2 | false | 712 | 712 | return ... |
-| fun2 | false | 713 | 713 | { ... } |
-| fun2 | false | 714 | 714 | <handler> |
-| fun2 | false | 715 | 715 | <handler> |
-| fun2 | false | 716 | 716 | try { ... } |
-| fun2 | false | 718 | 718 | 0 |
-| fun2 | false | 719 | 719 | return ... |
-| fun2 | false | 720 | 720 | { ... } |
-| fun2 | true | 218 | 243 |  |
-| fun2 | true | 223 | 215 |  |
-| fun2 | true | 225 | 223 |  |
-| fun2 | true | 227 | 225 |  |
-| fun2 | true | 231 | 215 |  |
-| fun2 | true | 232 | 231 |  |
-| fun2 | true | 234 | 232 |  |
-| fun2 | true | 236 | 227 |  |
-| fun2 | true | 236 | 237 |  |
-| fun2 | true | 237 | 234 |  |
-| fun2 | true | 238 | 218 |  |
-| fun2 | true | 242 | 215 |  |
-| fun2 | true | 243 | 242 |  |
-| fun2 | true | 245 | 238 |  |
-| fun2 | true | 702 | 719 |  |
-| fun2 | true | 707 | 204 |  |
-| fun2 | true | 708 | 707 |  |
-| fun2 | true | 709 | 708 |  |
-| fun2 | true | 711 | 204 |  |
-| fun2 | true | 712 | 711 |  |
-| fun2 | true | 713 | 712 |  |
-| fun2 | true | 714 | 709 |  |
-| fun2 | true | 714 | 715 |  |
-| fun2 | true | 715 | 713 |  |
-| fun2 | true | 716 | 702 |  |
-| fun2 | true | 718 | 204 |  |
-| fun2 | true | 719 | 718 |  |
-| fun2 | true | 720 | 716 |  |
-| g | false | 326 | 326 | g |
-| h | false | 336 | 336 | h |
-| i | false | 351 | 351 | i |
-| j | false | 361 | 361 | j |
-| k | false | 372 | 372 | k |
-| l | false | 389 | 389 | l |
-| m | false | 396 | 396 | m |
-| n | false | 407 | 407 | n |
-| run_fun2 | false | 199 | 199 | run_fun2 |
-| run_fun2 | false | 207 | 207 | call to fun2 |
-| run_fun2 | false | 209 | 209 | ExprStmt |
-| run_fun2 | false | 211 | 211 | return ... |
-| run_fun2 | false | 213 | 213 | { ... } |
-| run_fun2 | true | 207 | 211 |  |
-| run_fun2 | true | 209 | 207 |  |
-| run_fun2 | true | 211 | 199 |  |
-| run_fun2 | true | 213 | 209 |  |
+| fun | false | 332 | 332 | call to h |
+| fun | false | 334 | 334 | { ... } |
+| fun | false | 336 | 336 | <handler> |
+| fun | false | 337 | 337 | { ... } |
+| fun | false | 342 | 342 | ExprStmt |
+| fun | false | 345 | 345 | call to i |
+| fun | false | 347 | 347 | { ... } |
+| fun | false | 352 | 352 | ExprStmt |
+| fun | false | 355 | 355 | call to j |
+| fun | false | 357 | 357 | { ... } |
+| fun | false | 359 | 359 | <handler> |
+| fun | false | 360 | 360 | <handler> |
+| fun | false | 361 | 361 | ExprStmt |
+| fun | false | 364 | 364 | call to k |
+| fun | false | 366 | 366 | try { ... } |
+| fun | false | 368 | 368 | ExprStmt |
+| fun | false | 372 | 372 | 7 |
+| fun | false | 373 | 373 | throw ... |
+| fun | false | 375 | 375 | { ... } |
+| fun | false | 380 | 380 | ExprStmt |
+| fun | false | 383 | 383 | call to l |
+| fun | false | 385 | 385 | { ... } |
+| fun | false | 387 | 387 | ExprStmt |
+| fun | false | 390 | 390 | call to m |
+| fun | false | 392 | 392 | { ... } |
+| fun | false | 394 | 394 | <handler> |
+| fun | false | 395 | 395 | <handler> |
+| fun | false | 396 | 396 | ExprStmt |
+| fun | false | 399 | 399 | call to n |
+| fun | false | 401 | 401 | return ... |
+| fun | false | 403 | 403 | { ... } |
+| fun | true | 281 | 337 |  |
+| fun | true | 283 | 324 |  |
+| fun | true | 285 | 290 |  |
+| fun | true | 290 | 292 |  |
+| fun | true | 292 | 295 |  |
+| fun | true | 295 | 297 |  |
+| fun | true | 297 | 300 |  |
+| fun | true | 300 | 302 |  |
+| fun | true | 302 | 305 |  |
+| fun | true | 305 | 307 |  |
+| fun | true | 307 | 310 |  |
+| fun | true | 312 | 316 |  |
+| fun | true | 316 | 317 |  |
+| fun | true | 317 | 336 |  |
+| fun | true | 319 | 322 |  |
+| fun | true | 322 | 361 |  |
+| fun | true | 324 | 285 |  |
+| fun | true | 329 | 332 |  |
+| fun | true | 332 | 361 |  |
+| fun | true | 334 | 329 |  |
+| fun | true | 336 | 334 |  |
+| fun | true | 336 | 359 |  |
+| fun | true | 337 | 283 |  |
+| fun | true | 342 | 345 |  |
+| fun | true | 345 | 361 |  |
+| fun | true | 347 | 342 |  |
+| fun | true | 352 | 355 |  |
+| fun | true | 355 | 361 |  |
+| fun | true | 357 | 352 |  |
+| fun | true | 359 | 347 |  |
+| fun | true | 359 | 360 |  |
+| fun | true | 360 | 276 |  |
+| fun | true | 360 | 357 |  |
+| fun | true | 361 | 364 |  |
+| fun | true | 364 | 366 |  |
+| fun | true | 366 | 375 |  |
+| fun | true | 368 | 372 |  |
+| fun | true | 372 | 373 |  |
+| fun | true | 373 | 394 |  |
+| fun | true | 375 | 368 |  |
+| fun | true | 380 | 383 |  |
+| fun | true | 383 | 396 |  |
+| fun | true | 385 | 380 |  |
+| fun | true | 387 | 390 |  |
+| fun | true | 390 | 396 |  |
+| fun | true | 392 | 387 |  |
+| fun | true | 394 | 385 |  |
+| fun | true | 394 | 395 |  |
+| fun | true | 395 | 392 |  |
+| fun | true | 396 | 399 |  |
+| fun | true | 399 | 401 |  |
+| fun | true | 401 | 276 |  |
+| fun | true | 403 | 281 |  |
+| fun2 | false | 149 | 149 | fun2 |
+| fun2 | false | 159 | 159 | fun2 |
+| fun2 | false | 162 | 162 | try { ... } |
+| fun2 | false | 164 | 164 | { ... } |
+| fun2 | false | 172 | 172 | ExprStmt |
+| fun2 | false | 174 | 174 | re-throw exception  |
+| fun2 | false | 176 | 176 | { ... } |
+| fun2 | false | 178 | 178 | return ... |
+| fun2 | false | 182 | 182 | 1 |
+| fun2 | false | 183 | 183 | { ... } |
+| fun2 | false | 185 | 185 | <handler> |
+| fun2 | false | 186 | 186 | <handler> |
+| fun2 | false | 187 | 187 | return ... |
+| fun2 | false | 191 | 191 | 0 |
+| fun2 | false | 192 | 192 | { ... } |
+| fun2 | false | 257 | 257 | try { ... } |
+| fun2 | false | 258 | 258 | { ... } |
+| fun2 | false | 261 | 261 | ExprStmt |
+| fun2 | false | 262 | 262 | re-throw exception  |
+| fun2 | false | 263 | 263 | { ... } |
+| fun2 | false | 264 | 264 | return ... |
+| fun2 | false | 266 | 266 | 1 |
+| fun2 | false | 267 | 267 | { ... } |
+| fun2 | false | 268 | 268 | <handler> |
+| fun2 | false | 269 | 269 | <handler> |
+| fun2 | false | 270 | 270 | return ... |
+| fun2 | false | 272 | 272 | 0 |
+| fun2 | false | 273 | 273 | { ... } |
+| fun2 | true | 162 | 164 |  |
+| fun2 | true | 164 | 187 |  |
+| fun2 | true | 172 | 174 |  |
+| fun2 | true | 174 | 159 |  |
+| fun2 | true | 176 | 172 |  |
+| fun2 | true | 178 | 182 |  |
+| fun2 | true | 182 | 159 |  |
+| fun2 | true | 183 | 178 |  |
+| fun2 | true | 185 | 176 |  |
+| fun2 | true | 185 | 186 |  |
+| fun2 | true | 186 | 183 |  |
+| fun2 | true | 187 | 191 |  |
+| fun2 | true | 191 | 159 |  |
+| fun2 | true | 192 | 162 |  |
+| fun2 | true | 257 | 258 |  |
+| fun2 | true | 258 | 270 |  |
+| fun2 | true | 261 | 262 |  |
+| fun2 | true | 262 | 149 |  |
+| fun2 | true | 263 | 261 |  |
+| fun2 | true | 264 | 266 |  |
+| fun2 | true | 266 | 149 |  |
+| fun2 | true | 267 | 264 |  |
+| fun2 | true | 268 | 263 |  |
+| fun2 | true | 268 | 269 |  |
+| fun2 | true | 269 | 267 |  |
+| fun2 | true | 270 | 272 |  |
+| fun2 | true | 272 | 149 |  |
+| fun2 | true | 273 | 257 |  |
+| g | false | 321 | 321 | g |
+| h | false | 331 | 331 | h |
+| i | false | 344 | 344 | i |
+| j | false | 354 | 354 | j |
+| k | false | 363 | 363 | k |
+| l | false | 382 | 382 | l |
+| m | false | 389 | 389 | m |
+| n | false | 398 | 398 | n |
+| run_fun2 | false | 142 | 142 | run_fun2 |
+| run_fun2 | false | 147 | 147 | ExprStmt |
+| run_fun2 | false | 152 | 152 | call to fun2 |
+| run_fun2 | false | 154 | 154 | return ... |
+| run_fun2 | false | 156 | 156 | { ... } |
+| run_fun2 | true | 147 | 152 |  |
+| run_fun2 | true | 152 | 154 |  |
+| run_fun2 | true | 154 | 142 |  |
+| run_fun2 | true | 156 | 147 |  |

cpp/ql/test/library-tests/c++_exceptions/unreachable.expected

@@ -1,2 +1,3 @@
 | exceptions.cpp:25:13:25:19 | ExprStmt |
 | exceptions.cpp:26:13:26:13 | ExprStmt |
+| ms.cpp:38:1:38:1 | c101 |

cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-consistency.expected

@@ -159,6 +159,9 @@ postWithInFlow
 | test.cpp:808:5:808:21 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
 | test.cpp:808:6:808:21 | global_indirect1 [inner post update] | PostUpdateNode should not be the target of local flow. |
 | test.cpp:832:5:832:17 | global_direct [post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:931:5:931:18 | global_pointer [post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:932:5:932:19 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:932:6:932:19 | global_pointer [inner post update] | PostUpdateNode should not be the target of local flow. |
 viableImplInCallContextTooLarge
 uniqueParameterNodeAtPosition
 uniqueParameterNodePosition
@@ -166,3 +169,4 @@ uniqueContentApprox
 identityLocalStep
 missingArgumentCall
 multipleArgumentCall
+lambdaCallEnclosingCallableMismatch

cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-ir-consistency.expected

@@ -31,3 +31,4 @@ uniqueContentApprox
 identityLocalStep
 missingArgumentCall
 multipleArgumentCall
+lambdaCallEnclosingCallableMismatch

cpp/ql/test/library-tests/dataflow/dataflow-tests/test-source-sink.expected

@@ -300,6 +300,7 @@ irFlow
 | test.cpp:902:56:902:75 | *indirect_source(2) | test.cpp:911:19:911:48 | *global_array_static_indirect_2 |
 | test.cpp:914:46:914:53 | source | test.cpp:919:10:919:30 | global_pointer_static |
 | test.cpp:915:57:915:76 | *indirect_source(1) | test.cpp:921:19:921:50 | *global_pointer_static_indirect_1 |
+| test.cpp:932:23:932:28 | call to source | test.cpp:937:10:937:24 | * ... |
 | true_upon_entry.cpp:9:11:9:16 | call to source | true_upon_entry.cpp:13:8:13:8 | x |
 | true_upon_entry.cpp:17:11:17:16 | call to source | true_upon_entry.cpp:21:8:21:8 | x |
 | true_upon_entry.cpp:27:9:27:14 | call to source | true_upon_entry.cpp:29:8:29:8 | x |

cpp/ql/test/library-tests/dataflow/dataflow-tests/test.cpp

@@ -922,4 +922,18 @@ namespace GlobalArrays {
     sink(global_pointer_static_indirect_2); // clean: global_pointer_static_indirect_2 does not have 2 indirections
     indirect_sink(global_pointer_static_indirect_2); // clean: global_pointer_static_indirect_2 does not have 2 indirections
   }
+}
+
+namespace global_variable_conflation_test {
+  int* global_pointer;
+
+  void def() {
+    global_pointer = nullptr;
+    *global_pointer = source();
+  }
+
+  void use() {
+    sink(global_pointer); // clean
+    sink(*global_pointer); // $ ir MISSING: ast
+  }
 }

cpp/ql/test/library-tests/dataflow/fields/dataflow-consistency.expected

@@ -193,3 +193,4 @@ uniqueContentApprox
 identityLocalStep
 missingArgumentCall
 multipleArgumentCall
+lambdaCallEnclosingCallableMismatch

cpp/ql/test/library-tests/dataflow/fields/dataflow-ir-consistency.expected

@@ -27,3 +27,4 @@ uniqueContentApprox
 identityLocalStep
 missingArgumentCall
 multipleArgumentCall
+lambdaCallEnclosingCallableMismatch

cpp/ql/test/library-tests/destructors/cfg.expected

@@ -1,255 +1,263 @@
-| C::C | false | 197 | 197 | C |
-| C::C | false | 398 | 398 | C |
-| C::operator= | false | 391 | 391 | operator= |
-| C::~C | false | 331 | 331 | ~C |
-| Class2::Class2 | false | 538 | 538 | Class2 |
-| Class2::Class2 | false | 544 | 544 | return ... |
-| Class2::Class2 | false | 546 | 546 | { ... } |
+| C::C | false | 181 | 181 | C |
+| C::C | false | 384 | 384 | C |
+| C::operator= | false | 375 | 375 | operator= |
+| C::~C | false | 333 | 333 | ~C |
 | Class2::Class2 | false | 547 | 547 | Class2 |
-| Class2::Class2 | true | 544 | 538 |  |
-| Class2::Class2 | true | 546 | 544 |  |
-| Class2::operator= | false | 532 | 532 | operator= |
-| Class2::~Class2 | false | 467 | 467 | ~Class2 |
-| Outer::Inner::Inner | false | 488 | 488 | Inner |
-| Outer::Inner::Inner | false | 509 | 509 | Inner |
-| Outer::Inner::Inner | false | 528 | 528 | return ... |
-| Outer::Inner::Inner | false | 530 | 530 | { ... } |
-| Outer::Inner::Inner | true | 528 | 488 |  |
-| Outer::Inner::Inner | true | 530 | 528 |  |
-| Outer::Inner::operator= | false | 502 | 502 | operator= |
-| Outer::Inner::~Inner | false | 470 | 470 | ~Inner |
-| Outer::Inner::~Inner | false | 517 | 517 | return ... |
-| Outer::Inner::~Inner | false | 519 | 519 | { ... } |
-| Outer::Inner::~Inner | true | 517 | 470 |  |
-| Outer::Inner::~Inner | true | 519 | 517 |  |
-| Outer::f2 | false | 439 | 439 | f2 |
-| Outer::f2 | false | 447 | 447 | declaration |
-| Outer::f2 | false | 449 | 449 | i |
-| Outer::f2 | false | 451 | 451 | (bool)... |
-| Outer::f2 | false | 452 | 452 | return ... |
-| Outer::f2 | false | 454 | 454 | { ... } |
-| Outer::f2 | false | 456 | 456 | if (...) ...  |
-| Outer::f2 | false | 458 | 458 | declaration |
-| Outer::f2 | false | 460 | 460 | return ... |
-| Outer::f2 | false | 462 | 462 | { ... } |
-| Outer::f2 | false | 464 | 464 | c |
-| Outer::f2 | false | 466 | 466 | call to c.~Class2 |
-| Outer::f2 | false | 468 | 468 | inner |
-| Outer::f2 | false | 469 | 469 | call to inner.~Inner |
-| Outer::f2 | false | 474 | 474 | call to getClass2 |
-| Outer::f2 | false | 476 | 476 | initializer for c |
-| Outer::f2 | false | 481 | 481 | call to Inner |
-| Outer::f2 | false | 490 | 490 | c |
-| Outer::f2 | false | 492 | 492 | (const Class2)... |
-| Outer::f2 | false | 493 | 493 | (reference to) |
-| Outer::f2 | false | 494 | 494 | initializer for inner |
-| Outer::f2 | true | 447 | 476 |  |
-| Outer::f2 | true | 449 | 454 | T |
-| Outer::f2 | true | 449 | 458 | F |
-| Outer::f2 | true | 452 | 464 |  |
-| Outer::f2 | true | 454 | 452 |  |
-| Outer::f2 | true | 456 | 449 |  |
-| Outer::f2 | true | 458 | 494 |  |
-| Outer::f2 | true | 460 | 468 |  |
-| Outer::f2 | true | 462 | 447 |  |
+| Class2::Class2 | false | 554 | 554 | return ... |
+| Class2::Class2 | false | 556 | 556 | { ... } |
+| Class2::Class2 | false | 557 | 557 | Class2 |
+| Class2::Class2 | true | 554 | 547 |  |
+| Class2::Class2 | true | 556 | 554 |  |
+| Class2::operator= | false | 541 | 541 | operator= |
+| Class2::~Class2 | false | 499 | 499 | ~Class2 |
+| Outer::Inner::Inner | false | 481 | 481 | Inner |
+| Outer::Inner::Inner | false | 517 | 517 | Inner |
+| Outer::Inner::Inner | false | 537 | 537 | return ... |
+| Outer::Inner::Inner | false | 539 | 539 | { ... } |
+| Outer::Inner::Inner | true | 537 | 481 |  |
+| Outer::Inner::Inner | true | 539 | 537 |  |
+| Outer::Inner::operator= | false | 508 | 508 | operator= |
+| Outer::Inner::~Inner | false | 504 | 504 | ~Inner |
+| Outer::Inner::~Inner | false | 526 | 526 | return ... |
+| Outer::Inner::~Inner | false | 528 | 528 | { ... } |
+| Outer::Inner::~Inner | true | 526 | 504 |  |
+| Outer::Inner::~Inner | true | 528 | 526 |  |
+| Outer::f2 | false | 444 | 444 | f2 |
+| Outer::f2 | false | 453 | 453 | declaration |
+| Outer::f2 | false | 458 | 458 | call to getClass2 |
+| Outer::f2 | false | 460 | 460 | initializer for c |
+| Outer::f2 | false | 464 | 464 | if (...) ...  |
+| Outer::f2 | false | 466 | 466 | i |
+| Outer::f2 | false | 468 | 468 | (bool)... |
+| Outer::f2 | false | 469 | 469 | return ... |
+| Outer::f2 | false | 471 | 471 | { ... } |
+| Outer::f2 | false | 473 | 473 | declaration |
+| Outer::f2 | false | 476 | 476 | call to Inner |
+| Outer::f2 | false | 482 | 482 | c |
+| Outer::f2 | false | 485 | 485 | (const Class2)... |
+| Outer::f2 | false | 488 | 488 | (reference to) |
+| Outer::f2 | false | 489 | 489 | initializer for inner |
+| Outer::f2 | false | 492 | 492 | return ... |
+| Outer::f2 | false | 494 | 494 | { ... } |
+| Outer::f2 | false | 496 | 496 | c |
+| Outer::f2 | false | 498 | 498 | call to c.~Class2 |
+| Outer::f2 | false | 500 | 500 | c |
+| Outer::f2 | false | 501 | 501 | call to c.~Class2 |
+| Outer::f2 | false | 502 | 502 | inner |
+| Outer::f2 | false | 503 | 503 | call to inner.~Inner |
+| Outer::f2 | true | 453 | 460 |  |
+| Outer::f2 | true | 458 | 464 |  |
+| Outer::f2 | true | 460 | 458 |  |
 | Outer::f2 | true | 464 | 466 |  |
-| Outer::f2 | true | 466 | 439 |  |
-| Outer::f2 | true | 468 | 469 |  |
-| Outer::f2 | true | 469 | 464 |  |
-| Outer::f2 | true | 474 | 456 |  |
-| Outer::f2 | true | 476 | 474 |  |
-| Outer::f2 | true | 481 | 460 |  |
-| Outer::f2 | true | 490 | 481 |  |
-| Outer::f2 | true | 494 | 490 |  |
-| Outer::operator= | false | 424 | 424 | operator= |
-| Outer::operator= | false | 435 | 435 | operator= |
-| __va_list_tag::operator= | false | 93 | 93 | operator= |
-| __va_list_tag::operator= | false | 100 | 100 | operator= |
-| f | false | 181 | 181 | f |
-| f | false | 192 | 192 | declaration |
-| f | false | 195 | 195 | call to C |
-| f | false | 200 | 200 | 120 |
-| f | false | 201 | 201 | initializer for c20 |
-| f | false | 205 | 205 | call to C |
-| f | false | 209 | 209 | 121 |
-| f | false | 210 | 210 | initializer for c21 |
-| f | false | 213 | 213 | declaration |
-| f | false | 216 | 216 | call to C |
-| f | false | 220 | 220 | 130 |
-| f | false | 221 | 221 | initializer for c30 |
-| f | false | 224 | 224 | declaration |
-| f | false | 226 | 226 | { ... } |
-| f | false | 229 | 229 | call to C |
-| f | false | 233 | 233 | 131 |
-| f | false | 234 | 234 | initializer for c31 |
-| f | false | 238 | 238 | call to C |
-| f | false | 242 | 242 | 132 |
-| f | false | 243 | 243 | initializer for c32 |
-| f | false | 247 | 247 | call to C |
-| f | false | 251 | 251 | 133 |
-| f | false | 252 | 252 | initializer for c33 |
-| f | false | 255 | 255 | declaration |
-| f | false | 257 | 257 | b1 |
-| f | false | 259 | 259 | (bool)... |
-| f | false | 260 | 260 | goto ... |
-| f | false | 262 | 262 | if (...) ...  |
-| f | false | 264 | 264 | declaration |
-| f | false | 266 | 266 | b2 |
-| f | false | 268 | 268 | (bool)... |
-| f | false | 269 | 269 | return ... |
-| f | false | 271 | 271 | if (...) ...  |
-| f | false | 273 | 273 | declaration |
-| f | false | 275 | 275 | { ... } |
-| f | false | 278 | 278 | call to C |
-| f | false | 282 | 282 | 134 |
-| f | false | 283 | 283 | initializer for c34 |
-| f | false | 286 | 286 | declaration |
-| f | false | 288 | 288 | { ... } |
-| f | false | 290 | 290 | declaration |
-| f | false | 292 | 292 | { ... } |
-| f | false | 295 | 295 | call to C |
-| f | false | 299 | 299 | 122 |
-| f | false | 300 | 300 | initializer for c22 |
-| f | false | 303 | 303 | declaration |
-| f | false | 305 | 305 | { ... } |
-| f | false | 308 | 308 | call to C |
-| f | false | 312 | 312 | 123 |
-| f | false | 313 | 313 | initializer for c23 |
-| f | false | 316 | 316 | label ...: |
-| f | false | 318 | 318 | declaration |
-| f | false | 320 | 320 | { ... } |
-| f | false | 322 | 322 | declaration |
-| f | false | 324 | 324 | return ... |
-| f | false | 326 | 326 | { ... } |
-| f | false | 328 | 328 | c10 |
-| f | false | 330 | 330 | call to c10.~C |
-| f | false | 332 | 332 | c11 |
-| f | false | 333 | 333 | call to c11.~C |
-| f | false | 334 | 334 | c23 |
-| f | false | 336 | 336 | call to c23.~C |
-| f | false | 337 | 337 | c22 |
-| f | false | 339 | 339 | call to c22.~C |
-| f | false | 340 | 340 | c20 |
-| f | false | 342 | 342 | call to c20.~C |
-| f | false | 343 | 343 | c21 |
-| f | false | 344 | 344 | call to c21.~C |
-| f | false | 345 | 345 | c34 |
-| f | false | 347 | 347 | call to c34.~C |
+| Outer::f2 | true | 466 | 471 | T |
+| Outer::f2 | true | 466 | 473 | F |
+| Outer::f2 | true | 469 | 496 |  |
+| Outer::f2 | true | 471 | 469 |  |
+| Outer::f2 | true | 473 | 489 |  |
+| Outer::f2 | true | 476 | 492 |  |
+| Outer::f2 | true | 482 | 476 |  |
+| Outer::f2 | true | 489 | 482 |  |
+| Outer::f2 | true | 492 | 502 |  |
+| Outer::f2 | true | 494 | 453 |  |
+| Outer::f2 | true | 496 | 498 |  |
+| Outer::f2 | true | 498 | 444 |  |
+| Outer::f2 | true | 500 | 501 |  |
+| Outer::f2 | true | 501 | 444 |  |
+| Outer::f2 | true | 502 | 503 |  |
+| Outer::f2 | true | 503 | 500 |  |
+| Outer::operator= | false | 428 | 428 | operator= |
+| Outer::operator= | false | 438 | 438 | operator= |
+| __va_list_tag::operator= | false | 66 | 66 | operator= |
+| __va_list_tag::operator= | false | 72 | 72 | operator= |
+| f | false | 165 | 165 | f |
+| f | false | 176 | 176 | declaration |
+| f | false | 179 | 179 | call to C |
+| f | false | 184 | 184 | 110 |
+| f | false | 185 | 185 | initializer for c10 |
+| f | false | 189 | 189 | call to C |
+| f | false | 193 | 193 | 120 |
+| f | false | 194 | 194 | initializer for c20 |
+| f | false | 198 | 198 | call to C |
+| f | false | 202 | 202 | 121 |
+| f | false | 203 | 203 | initializer for c21 |
+| f | false | 206 | 206 | declaration |
+| f | false | 209 | 209 | call to C |
+| f | false | 213 | 213 | 130 |
+| f | false | 214 | 214 | initializer for c30 |
+| f | false | 217 | 217 | declaration |
+| f | false | 219 | 219 | { ... } |
+| f | false | 222 | 222 | call to C |
+| f | false | 226 | 226 | 131 |
+| f | false | 227 | 227 | initializer for c31 |
+| f | false | 231 | 231 | call to C |
+| f | false | 235 | 235 | 132 |
+| f | false | 236 | 236 | initializer for c32 |
+| f | false | 240 | 240 | call to C |
+| f | false | 244 | 244 | 133 |
+| f | false | 245 | 245 | initializer for c33 |
+| f | false | 248 | 248 | declaration |
+| f | false | 250 | 250 | if (...) ...  |
+| f | false | 252 | 252 | b1 |
+| f | false | 254 | 254 | (bool)... |
+| f | false | 255 | 255 | goto ... |
+| f | false | 257 | 257 | declaration |
+| f | false | 259 | 259 | if (...) ...  |
+| f | false | 261 | 261 | b2 |
+| f | false | 263 | 263 | (bool)... |
+| f | false | 264 | 264 | return ... |
+| f | false | 266 | 266 | declaration |
+| f | false | 268 | 268 | { ... } |
+| f | false | 271 | 271 | call to C |
+| f | false | 275 | 275 | 134 |
+| f | false | 276 | 276 | initializer for c34 |
+| f | false | 279 | 279 | declaration |
+| f | false | 281 | 281 | { ... } |
+| f | false | 283 | 283 | declaration |
+| f | false | 285 | 285 | { ... } |
+| f | false | 288 | 288 | call to C |
+| f | false | 292 | 292 | 122 |
+| f | false | 293 | 293 | initializer for c22 |
+| f | false | 296 | 296 | declaration |
+| f | false | 298 | 298 | { ... } |
+| f | false | 301 | 301 | call to C |
+| f | false | 305 | 305 | 123 |
+| f | false | 306 | 306 | initializer for c23 |
+| f | false | 309 | 309 | label ...: |
+| f | false | 311 | 311 | declaration |
+| f | false | 313 | 313 | { ... } |
+| f | false | 315 | 315 | declaration |
+| f | false | 318 | 318 | call to C |
+| f | false | 322 | 322 | 111 |
+| f | false | 323 | 323 | initializer for c11 |
+| f | false | 326 | 326 | return ... |
+| f | false | 328 | 328 | { ... } |
+| f | false | 330 | 330 | c20 |
+| f | false | 332 | 332 | call to c20.~C |
+| f | false | 334 | 334 | c21 |
+| f | false | 335 | 335 | call to c21.~C |
+| f | false | 336 | 336 | c30 |
+| f | false | 338 | 338 | call to c30.~C |
+| f | false | 339 | 339 | c31 |
+| f | false | 341 | 341 | call to c31.~C |
+| f | false | 342 | 342 | c32 |
+| f | false | 343 | 343 | call to c32.~C |
+| f | false | 344 | 344 | c33 |
+| f | false | 345 | 345 | call to c33.~C |
+| f | false | 346 | 346 | c20 |
+| f | false | 347 | 347 | call to c20.~C |
 | f | false | 348 | 348 | c31 |
-| f | false | 350 | 350 | call to c31.~C |
-| f | false | 351 | 351 | c32 |
-| f | false | 352 | 352 | call to c32.~C |
-| f | false | 353 | 353 | c33 |
-| f | false | 354 | 354 | call to c33.~C |
-| f | false | 355 | 355 | c20 |
-| f | false | 356 | 356 | call to c20.~C |
-| f | false | 357 | 357 | c31 |
-| f | false | 358 | 358 | call to c31.~C |
-| f | false | 359 | 359 | c32 |
-| f | false | 360 | 360 | call to c32.~C |
-| f | false | 361 | 361 | c20 |
-| f | false | 362 | 362 | call to c20.~C |
-| f | false | 363 | 363 | c31 |
-| f | false | 364 | 364 | call to c31.~C |
-| f | false | 365 | 365 | c30 |
-| f | false | 367 | 367 | call to c30.~C |
-| f | false | 369 | 369 | call to C |
-| f | false | 373 | 373 | 110 |
-| f | false | 374 | 374 | initializer for c10 |
-| f | false | 378 | 378 | call to C |
-| f | false | 382 | 382 | 111 |
-| f | false | 383 | 383 | initializer for c11 |
-| f | true | 192 | 374 |  |
-| f | true | 195 | 226 |  |
-| f | true | 200 | 195 |  |
-| f | true | 201 | 200 |  |
-| f | true | 205 | 343 |  |
-| f | true | 209 | 205 |  |
-| f | true | 210 | 209 |  |
-| f | true | 213 | 201 |  |
-| f | true | 216 | 365 |  |
-| f | true | 220 | 216 |  |
-| f | true | 221 | 220 |  |
-| f | true | 224 | 221 |  |
-| f | true | 226 | 224 |  |
-| f | true | 229 | 262 |  |
-| f | true | 233 | 229 |  |
-| f | true | 234 | 233 |  |
-| f | true | 238 | 271 |  |
-| f | true | 242 | 238 |  |
-| f | true | 243 | 242 |  |
-| f | true | 247 | 353 |  |
-| f | true | 251 | 247 |  |
-| f | true | 252 | 251 |  |
-| f | true | 255 | 234 |  |
-| f | true | 257 | 260 | T |
-| f | true | 257 | 264 | F |
-| f | true | 260 | 363 |  |
-| f | true | 262 | 257 |  |
-| f | true | 264 | 243 |  |
-| f | true | 266 | 269 | T |
-| f | true | 266 | 273 | F |
-| f | true | 269 | 359 |  |
-| f | true | 271 | 266 |  |
-| f | true | 273 | 252 |  |
-| f | true | 275 | 255 |  |
-| f | true | 278 | 345 |  |
-| f | true | 282 | 278 |  |
-| f | true | 283 | 282 |  |
-| f | true | 286 | 283 |  |
-| f | true | 288 | 286 |  |
-| f | true | 290 | 210 |  |
-| f | true | 292 | 213 |  |
-| f | true | 295 | 337 |  |
-| f | true | 299 | 295 |  |
-| f | true | 300 | 299 |  |
-| f | true | 303 | 300 |  |
-| f | true | 305 | 303 |  |
-| f | true | 308 | 334 |  |
-| f | true | 312 | 308 |  |
-| f | true | 313 | 312 |  |
-| f | true | 316 | 318 |  |
-| f | true | 318 | 313 |  |
-| f | true | 320 | 316 |  |
-| f | true | 322 | 383 |  |
-| f | true | 324 | 332 |  |
-| f | true | 326 | 192 |  |
-| f | true | 328 | 330 |  |
-| f | true | 330 | 181 |  |
-| f | true | 332 | 333 |  |
-| f | true | 333 | 328 |  |
-| f | true | 334 | 336 |  |
-| f | true | 336 | 322 |  |
-| f | true | 337 | 339 |  |
-| f | true | 339 | 320 |  |
-| f | true | 340 | 342 |  |
-| f | true | 342 | 305 |  |
-| f | true | 343 | 344 |  |
-| f | true | 344 | 340 |  |
-| f | true | 345 | 347 |  |
-| f | true | 347 | 290 |  |
-| f | true | 348 | 350 |  |
-| f | true | 350 | 288 |  |
-| f | true | 351 | 352 |  |
-| f | true | 352 | 348 |  |
+| f | false | 349 | 349 | call to c31.~C |
+| f | false | 350 | 350 | c10 |
+| f | false | 352 | 352 | call to c10.~C |
+| f | false | 353 | 353 | c20 |
+| f | false | 354 | 354 | call to c20.~C |
+| f | false | 355 | 355 | c31 |
+| f | false | 356 | 356 | call to c31.~C |
+| f | false | 357 | 357 | c32 |
+| f | false | 358 | 358 | call to c32.~C |
+| f | false | 359 | 359 | c34 |
+| f | false | 361 | 361 | call to c34.~C |
+| f | false | 362 | 362 | c22 |
+| f | false | 364 | 364 | call to c22.~C |
+| f | false | 365 | 365 | c23 |
+| f | false | 367 | 367 | call to c23.~C |
+| f | false | 368 | 368 | c10 |
+| f | false | 369 | 369 | call to c10.~C |
+| f | false | 370 | 370 | c11 |
+| f | false | 371 | 371 | call to c11.~C |
+| f | true | 176 | 185 |  |
+| f | true | 179 | 285 |  |
+| f | true | 184 | 179 |  |
+| f | true | 185 | 184 |  |
+| f | true | 189 | 219 |  |
+| f | true | 193 | 189 |  |
+| f | true | 194 | 193 |  |
+| f | true | 198 | 334 |  |
+| f | true | 202 | 198 |  |
+| f | true | 203 | 202 |  |
+| f | true | 206 | 194 |  |
+| f | true | 209 | 336 |  |
+| f | true | 213 | 209 |  |
+| f | true | 214 | 213 |  |
+| f | true | 217 | 214 |  |
+| f | true | 219 | 217 |  |
+| f | true | 222 | 250 |  |
+| f | true | 226 | 222 |  |
+| f | true | 227 | 226 |  |
+| f | true | 231 | 259 |  |
+| f | true | 235 | 231 |  |
+| f | true | 236 | 235 |  |
+| f | true | 240 | 344 |  |
+| f | true | 244 | 240 |  |
+| f | true | 245 | 244 |  |
+| f | true | 248 | 227 |  |
+| f | true | 250 | 252 |  |
+| f | true | 252 | 255 | T |
+| f | true | 252 | 257 | F |
+| f | true | 255 | 348 |  |
+| f | true | 257 | 236 |  |
+| f | true | 259 | 261 |  |
+| f | true | 261 | 264 | T |
+| f | true | 261 | 266 | F |
+| f | true | 264 | 357 |  |
+| f | true | 266 | 245 |  |
+| f | true | 268 | 248 |  |
+| f | true | 271 | 359 |  |
+| f | true | 275 | 271 |  |
+| f | true | 276 | 275 |  |
+| f | true | 279 | 276 |  |
+| f | true | 281 | 279 |  |
+| f | true | 283 | 203 |  |
+| f | true | 285 | 206 |  |
+| f | true | 288 | 362 |  |
+| f | true | 292 | 288 |  |
+| f | true | 293 | 292 |  |
+| f | true | 296 | 293 |  |
+| f | true | 298 | 296 |  |
+| f | true | 301 | 365 |  |
+| f | true | 305 | 301 |  |
+| f | true | 306 | 305 |  |
+| f | true | 309 | 311 |  |
+| f | true | 311 | 306 |  |
+| f | true | 313 | 309 |  |
+| f | true | 315 | 323 |  |
+| f | true | 318 | 326 |  |
+| f | true | 322 | 318 |  |
+| f | true | 323 | 322 |  |
+| f | true | 326 | 370 |  |
+| f | true | 328 | 176 |  |
+| f | true | 330 | 332 |  |
+| f | true | 332 | 298 |  |
+| f | true | 334 | 335 |  |
+| f | true | 335 | 330 |  |
+| f | true | 336 | 338 |  |
+| f | true | 338 | 268 |  |
+| f | true | 339 | 341 |  |
+| f | true | 341 | 281 |  |
+| f | true | 342 | 343 |  |
+| f | true | 343 | 339 |  |
+| f | true | 344 | 345 |  |
+| f | true | 345 | 342 |  |
+| f | true | 346 | 347 |  |
+| f | true | 347 | 309 |  |
+| f | true | 348 | 349 |  |
+| f | true | 349 | 346 |  |
+| f | true | 350 | 352 |  |
+| f | true | 352 | 165 |  |
 | f | true | 353 | 354 |  |
-| f | true | 354 | 351 |  |
+| f | true | 354 | 350 |  |
 | f | true | 355 | 356 |  |
-| f | true | 356 | 328 |  |
+| f | true | 356 | 353 |  |
 | f | true | 357 | 358 |  |
 | f | true | 358 | 355 |  |
-| f | true | 359 | 360 |  |
-| f | true | 360 | 357 |  |
-| f | true | 361 | 362 |  |
-| f | true | 362 | 316 |  |
-| f | true | 363 | 364 |  |
-| f | true | 364 | 361 |  |
+| f | true | 359 | 361 |  |
+| f | true | 361 | 283 |  |
+| f | true | 362 | 364 |  |
+| f | true | 364 | 313 |  |
 | f | true | 365 | 367 |  |
-| f | true | 367 | 275 |  |
-| f | true | 369 | 292 |  |
-| f | true | 373 | 369 |  |
-| f | true | 374 | 373 |  |
-| f | true | 378 | 324 |  |
-| f | true | 382 | 378 |  |
-| f | true | 383 | 382 |  |
-| getClass2 | false | 420 | 420 | getClass2 |
+| f | true | 367 | 315 |  |
+| f | true | 368 | 369 |  |
+| f | true | 369 | 165 |  |
+| f | true | 370 | 371 |  |
+| f | true | 371 | 368 |  |
+| getClass2 | false | 425 | 425 | getClass2 |

cpp/ql/test/library-tests/destructors/jump_destructs.expected

@@ -1,14 +1,14 @@
 | destructors2.cpp:5:7:5:7 | Class2 | 5 | return ... | 3 | 5 | Class2 |
 | destructors2.cpp:17:9:17:13 | Inner | 17 | return ... | 3 | 17 | Inner |
 | destructors2.cpp:18:9:18:14 | ~Inner | 18 | return ... | 3 | 18 | ~Inner |
-| destructors2.cpp:21:10:21:11 | f2 | 24 | return ... | 16 | 27 | c |
-| destructors2.cpp:21:10:21:11 | f2 | 24 | return ... | 17 | 27 | call to ~Class2 |
-| destructors2.cpp:21:10:21:11 | f2 | 24 | return ... | 18 | 21 | f2 |
+| destructors2.cpp:21:10:21:11 | f2 | 24 | return ... | 9 | 27 | c |
+| destructors2.cpp:21:10:21:11 | f2 | 24 | return ... | 10 | 27 | call to ~Class2 |
+| destructors2.cpp:21:10:21:11 | f2 | 24 | return ... | 20 | 21 | f2 |
 | destructors2.cpp:21:10:21:11 | f2 | 27 | return ... | 12 | 27 | inner |
 | destructors2.cpp:21:10:21:11 | f2 | 27 | return ... | 13 | 27 | call to ~Inner |
-| destructors2.cpp:21:10:21:11 | f2 | 27 | return ... | 16 | 27 | c |
-| destructors2.cpp:21:10:21:11 | f2 | 27 | return ... | 17 | 27 | call to ~Class2 |
-| destructors2.cpp:21:10:21:11 | f2 | 27 | return ... | 18 | 21 | f2 |
+| destructors2.cpp:21:10:21:11 | f2 | 27 | return ... | 14 | 27 | c |
+| destructors2.cpp:21:10:21:11 | f2 | 27 | return ... | 15 | 27 | call to ~Class2 |
+| destructors2.cpp:21:10:21:11 | f2 | 27 | return ... | 20 | 21 | f2 |
 | destructors.cpp:8:6:8:6 | f | 17 | goto ... | 26 | 21 | c31 |
 | destructors.cpp:8:6:8:6 | f | 17 | goto ... | 27 | 21 | call to ~C |
 | destructors.cpp:8:6:8:6 | f | 17 | goto ... | 28 | 26 | c20 |
@@ -19,11 +19,11 @@
 | destructors.cpp:8:6:8:6 | f | 19 | return ... | 35 | 21 | call to ~C |
 | destructors.cpp:8:6:8:6 | f | 19 | return ... | 36 | 26 | c20 |
 | destructors.cpp:8:6:8:6 | f | 19 | return ... | 37 | 26 | call to ~C |
-| destructors.cpp:8:6:8:6 | f | 19 | return ... | 90 | 35 | c10 |
-| destructors.cpp:8:6:8:6 | f | 19 | return ... | 91 | 35 | call to ~C |
-| destructors.cpp:8:6:8:6 | f | 19 | return ... | 92 | 8 | f |
+| destructors.cpp:8:6:8:6 | f | 19 | return ... | 38 | 35 | c10 |
+| destructors.cpp:8:6:8:6 | f | 19 | return ... | 39 | 35 | call to ~C |
+| destructors.cpp:8:6:8:6 | f | 19 | return ... | 94 | 8 | f |
 | destructors.cpp:8:6:8:6 | f | 35 | return ... | 81 | 35 | c11 |
 | destructors.cpp:8:6:8:6 | f | 35 | return ... | 82 | 35 | call to ~C |
-| destructors.cpp:8:6:8:6 | f | 35 | return ... | 90 | 35 | c10 |
-| destructors.cpp:8:6:8:6 | f | 35 | return ... | 91 | 35 | call to ~C |
-| destructors.cpp:8:6:8:6 | f | 35 | return ... | 92 | 8 | f |
+| destructors.cpp:8:6:8:6 | f | 35 | return ... | 83 | 35 | c10 |
+| destructors.cpp:8:6:8:6 | f | 35 | return ... | 84 | 35 | call to ~C |
+| destructors.cpp:8:6:8:6 | f | 35 | return ... | 94 | 8 | f |

cpp/ql/test/library-tests/literals/uuidof/uuidof.cpp

@@ -17,4 +17,9 @@ void GetUUID() {
     uuid = __uuidof(s);
     uuid = __uuidof(0);
 }
+
+template <typename Placeholder, typename ...>
+auto Wrapper = __uuidof(Placeholder);
+auto inst = Wrapper<S>;
+
 // semmle-extractor-options: --microsoft

cpp/ql/test/library-tests/literals/uuidof/uuidof.expected

@@ -12,3 +12,5 @@ uuidofOperators
 | uuidof.cpp:15:12:15:29 | __uuidof(S) | const _GUID | 01234567-89ab-cdef-0123-456789abcdef |
 | uuidof.cpp:17:12:17:22 | __uuidof(S) | const _GUID | 01234567-89ab-cdef-0123-456789abcdef |
 | uuidof.cpp:18:12:18:22 | __uuidof(0) | const _GUID | 00000000-0000-0000-0000-000000000000 |
+| uuidof.cpp:22:16:22:36 | __uuidof(Placeholder) | const _GUID |  |
+| uuidof.cpp:22:16:22:36 | __uuidof(S) | const _GUID | 01234567-89ab-cdef-0123-456789abcdef |

cpp/ql/test/library-tests/literals/uuidof/uuidof.ql

@@ -5,6 +5,6 @@ query predicate classUuids(Class cls, string uuid) {
 }
 
 query predicate uuidofOperators(UuidofOperator op, string type, string uuid) {
-  uuid = op.getValue() and
+  (if exists(op.getValue()) then uuid = op.getValue() else uuid = "") and
   type = op.getType().toString()
 }

cpp/ql/test/library-tests/string_concat/concat.cpp

@@ -0,0 +1,62 @@
+// #include <iostream>
+// #include <string>
+// #include <stdio.h>
+// #include <string.h>
+// #include <sstream>
+#include "stl.h"
+
+int sprintf(char *s, const char *format, ...);
+char *strcat(char * s1, const char * s2);
+
+using namespace std;
+
+
+void test1(){
+    string str1 = "Hello";
+    string str2 = "World";
+    string str3 = "!";
+    string str4 = "Concatenation";
+    string str5 = "is";
+    string str6 = "fun";
+
+    // Using the + operator
+    string result1 = str1 + " " + str2 + str3;
+
+    // Using the append() function
+    //----TODO: currently not modeled----
+    // string result2 = str4.append(" ") + str5.append(" ") + str6;
+
+    // Using the insert() function
+    //----TODO: currently not modeled----
+    // string result3 = str1.insert(5, " ") + str2.insert(5, "! ");
+
+    // Using the replace() function
+    //----TODO: currently not modeled----
+    // string result4 = str1.replace(0, 5, "Hi") + str2.replace(0, 5, "There");
+
+    // Using the push_back() function
+    //----TODO: currently not modeled----
+    // string result5;
+    // for (char c : str1) {
+    //     result5.push_back(c);
+    // }
+
+    // Using the stream operator
+    string result6;
+    std::stringstream ss;
+    ss << str1 << " " << str2 << str3;
+}
+
+
+void test2(char* ucstr) {
+    char str1[20] = "Hello";
+    char str2[20] = "World";
+    char result[40];
+    char *result2;
+
+    // Using sprintf
+    sprintf(result, "%s %s %s", str1, str2, ucstr);
+
+    // Using strcat
+    strcat(str1, ucstr);
+}

cpp/ql/test/library-tests/string_concat/stl.h

@@ -0,0 +1,644 @@
+
+typedef unsigned long size_t;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+#include "type_traits.h"
+
+namespace std
+{
+	template<class T> constexpr T&& forward(remove_reference_t<T>& t) noexcept;
+	template<class T> constexpr T&& forward(remove_reference_t<T>&& t) noexcept;
+}
+
+// --- iterator ---
+
+namespace std {
+	struct ptrdiff_t;
+
+	template<class I> struct iterator_traits;
+
+	template <class Category,
+			  class value_type,
+			  class difference_type = ptrdiff_t,
+			  class pointer_type = value_type*,
+			  class reference_type = value_type&>
+	struct iterator {
+		typedef Category iterator_category;
+
+		iterator();
+		iterator(iterator<Category, remove_const_t<value_type> > const &other); // non-const -> const conversion constructor
+
+		iterator &operator++();
+		iterator operator++(int);
+		iterator &operator--();
+		iterator operator--(int);
+		bool operator==(iterator other) const;
+		bool operator!=(iterator other) const;
+		reference_type operator*() const;
+		pointer_type operator->() const;
+		iterator operator+(int);
+		iterator operator-(int);
+		iterator &operator+=(int);
+		iterator &operator-=(int);
+		int operator-(iterator);
+		reference_type operator[](int);
+	};
+
+	struct input_iterator_tag {};
+	struct forward_iterator_tag : public input_iterator_tag {};
+	struct bidirectional_iterator_tag : public forward_iterator_tag {};
+	struct random_access_iterator_tag : public bidirectional_iterator_tag {};
+
+	struct output_iterator_tag {};
+
+	template<class Container>
+	class back_insert_iterator {
+	protected:
+		Container* container = nullptr;
+	public:
+		using iterator_category = output_iterator_tag;
+		using value_type = void;
+		using difference_type = ptrdiff_t;
+		using pointer = void;
+		using reference = void;
+		using container_type = Container;
+		constexpr back_insert_iterator() noexcept = default;
+		constexpr explicit back_insert_iterator(Container& x);
+		back_insert_iterator& operator=(const typename Container::value_type& value);
+		back_insert_iterator& operator=(typename Container::value_type&& value);
+		back_insert_iterator& operator*();
+		back_insert_iterator& operator++();
+		back_insert_iterator operator++(int);
+	};
+
+	template<class Container>
+	constexpr back_insert_iterator<Container> back_inserter(Container& x) {
+		return back_insert_iterator<Container>(x);
+	}
+
+	template<class Container>
+	class front_insert_iterator {
+	protected:
+		Container* container = nullptr;
+	public:
+		using iterator_category = output_iterator_tag;
+		using value_type = void;
+		using difference_type = ptrdiff_t;
+		using pointer = void;
+		using reference = void;
+		using container_type = Container;
+		constexpr front_insert_iterator() noexcept = default;
+		constexpr explicit front_insert_iterator(Container& x);
+		constexpr front_insert_iterator& operator=(const typename Container::value_type& value);
+		constexpr front_insert_iterator& operator=(typename Container::value_type&& value);
+		constexpr front_insert_iterator& operator*();
+		constexpr front_insert_iterator& operator++();
+		constexpr front_insert_iterator operator++(int);
+	};
+	template<class Container>
+	constexpr front_insert_iterator<Container> front_inserter(Container& x) {
+		return front_insert_iterator<Container>(x);
+	}
+}
+
+// --- string ---
+
+namespace std
+{
+	template<class charT> struct char_traits;
+
+	typedef size_t streamsize;
+
+	template <class T> class allocator {
+	public:
+		allocator() throw();
+		typedef size_t size_type;
+	};
+
+	template<class charT, class traits = char_traits<charT>, class Allocator = allocator<charT> >
+	class basic_string {
+	public:
+		using value_type = charT;
+		using reference = value_type&;
+		using const_reference = const value_type&;
+		typedef typename Allocator::size_type size_type;
+		static const size_type npos = -1;
+
+		explicit basic_string(const Allocator& a = Allocator());
+		basic_string(const charT* s, const Allocator& a = Allocator());
+		template<class InputIterator> basic_string(InputIterator begin, InputIterator end, const Allocator& a = Allocator());
+
+		const charT* c_str() const;
+		charT* data() noexcept;
+		size_t length() const;
+
+		typedef std::iterator<random_access_iterator_tag, charT> iterator;
+		typedef std::iterator<random_access_iterator_tag, const charT> const_iterator;
+
+		iterator begin();
+		iterator end();
+		const_iterator begin() const;
+		const_iterator end() const;
+		const_iterator cbegin() const;
+		const_iterator cend() const;
+
+		void push_back(charT c);
+
+		const charT& front() const;
+		charT& front();
+		const charT& back() const;
+		charT& back();
+
+		const_reference operator[](size_type pos) const;
+		reference operator[](size_type pos);
+		const_reference at(size_type n) const;
+		reference at(size_type n);
+		template<class T> basic_string& operator+=(const T& t);
+		basic_string& operator+=(const charT* s);
+		basic_string& append(const basic_string& str);
+		basic_string& append(const charT* s);
+		basic_string& append(size_type n, charT c);
+		template<class InputIterator> basic_string& append(InputIterator first, InputIterator last); 
+		basic_string& assign(const basic_string& str);
+		basic_string& assign(size_type n, charT c);
+		template<class InputIterator> basic_string& assign(InputIterator first, InputIterator last);
+		basic_string& insert(size_type pos, const basic_string& str);
+		basic_string& insert(size_type pos, size_type n, charT c);
+		basic_string& insert(size_type pos, const charT* s);
+		iterator insert(const_iterator p, size_type n, charT c);
+		template<class InputIterator> iterator insert(const_iterator p, InputIterator first, InputIterator last); 
+		basic_string& replace(size_type pos1, size_type n1, const basic_string& str);
+		basic_string& replace(size_type pos1, size_type n1, size_type n2, charT c);
+		size_type copy(charT* s, size_type n, size_type pos = 0) const;
+		void clear() noexcept;
+		basic_string substr(size_type pos = 0, size_type n = npos) const;
+		void swap(basic_string& s) noexcept/*(allocator_traits<Allocator>::propagate_on_container_swap::value || allocator_traits<Allocator>::is_always_equal::value)*/;
+	};
+
+	template<class charT, class traits, class Allocator> basic_string<charT, traits, Allocator> operator+(const basic_string<charT, traits, Allocator>& lhs, const basic_string<charT, traits, Allocator>& rhs);
+	template<class charT, class traits, class Allocator> basic_string<charT, traits, Allocator> operator+(const basic_string<charT, traits, Allocator>& lhs, const charT* rhs);
+
+	typedef basic_string<char> string;
+}
+
+// --- istring / ostream / stringstream ---
+
+namespace std
+{
+	template <class charT, class traits = char_traits<charT> >
+	class basic_istream /*: virtual public basic_ios<charT,traits> - not needed for this test */ {
+	public:
+		using char_type = charT;
+		using int_type = int; //typename traits::int_type;
+
+		basic_istream<charT, traits>& operator>>(int& n);
+
+		int_type get();
+		basic_istream<charT, traits>& get(char_type& c);
+		basic_istream<charT, traits>& get(char_type* s, streamsize n);
+		int_type peek();
+		basic_istream<charT, traits>& read (char_type* s, streamsize n);
+		streamsize readsome(char_type* s, streamsize n);
+		basic_istream<charT, traits>& putback(char_type c);
+		basic_istream<charT,traits>& unget();
+
+		basic_istream<charT,traits>& getline(char_type* s, streamsize n);
+		basic_istream<charT,traits>& getline(char_type* s, streamsize n, char_type delim);
+ 	};
+
+	template<class charT, class traits> basic_istream<charT, traits>& operator>>(basic_istream<charT, traits>&, charT*);
+	template<class charT, class traits, class Allocator> basic_istream<charT, traits>& operator>>(basic_istream<charT, traits>& is, basic_string<charT, traits, Allocator>& str); 
+
+	template<class charT, class traits, class Allocator> basic_istream<charT,traits>& getline(basic_istream<charT,traits>& is, basic_string<charT,traits,Allocator>& str, charT delim);
+	template<class charT, class traits, class Allocator> basic_istream<charT,traits>& getline(basic_istream<charT,traits>& is, basic_string<charT,traits,Allocator>& str);
+
+	template <class charT, class traits = char_traits<charT> >
+	class basic_ostream /*: virtual public basic_ios<charT,traits> - not needed for this test */ {
+	public:
+		typedef charT char_type;
+
+		basic_ostream<charT, traits>& operator<<(int n);
+
+		basic_ostream<charT, traits>& put(char_type c);
+		basic_ostream<charT, traits>& write(const char_type* s, streamsize n);
+		basic_ostream<charT,traits>& flush();
+	};
+
+	template<class charT, class traits> basic_ostream<charT,traits>& operator<<(basic_ostream<charT,traits>&, const charT*);
+	template<class charT, class traits, class Allocator> basic_ostream<charT, traits>& operator<<(basic_ostream<charT, traits>& os, const basic_string<charT, traits, Allocator>& str); 
+
+	template<class charT, class traits = char_traits<charT>>
+	class basic_iostream : public basic_istream<charT, traits>, public basic_ostream<charT, traits> {
+	public:
+	};
+
+	template<class charT, class traits = char_traits<charT>, class Allocator = allocator<charT>>
+	class basic_stringstream : public basic_iostream<charT, traits> {
+	public:
+		explicit basic_stringstream(/*ios_base::openmode which = ios_base::out|ios_base::in - not needed for this test*/);
+		explicit basic_stringstream( const basic_string<charT, traits, Allocator>& str/*, ios_base::openmode which = ios_base::out | ios_base::in*/);
+		basic_stringstream(const basic_stringstream& rhs) = delete;
+		basic_stringstream(basic_stringstream&& rhs);
+		basic_stringstream& operator=(const basic_stringstream& rhs) = delete;
+		basic_stringstream& operator=(basic_stringstream&& rhs);
+
+		void swap(basic_stringstream& rhs);
+
+		basic_string<charT, traits, Allocator> str() const;
+		void str(const basic_string<charT, traits, Allocator>& str);
+	};
+
+	typedef basic_istream<char> istream;
+	typedef basic_ostream<char> ostream;
+	extern istream cin;
+	extern ostream cout;
+
+	using stringstream = basic_stringstream<char>;
+}
+
+// --- vector ---
+
+namespace std {
+	template<class T, class Allocator = allocator<T>>
+	class vector { 
+	public:
+		using value_type = T;
+		using reference = value_type&;
+		using const_reference = const value_type&; 
+		using size_type = unsigned int;
+		using iterator = std::iterator<random_access_iterator_tag, T>;
+		using const_iterator = std::iterator<random_access_iterator_tag, const T>;
+
+		vector() noexcept(noexcept(Allocator())) : vector(Allocator()) { }
+		explicit vector(const Allocator&) noexcept;
+		explicit vector(size_type n, const Allocator& = Allocator());
+		vector(size_type n, const T& value, const Allocator& = Allocator());
+		template<class InputIterator, class IteratorCategory = typename InputIterator::iterator_category> vector(InputIterator first, InputIterator last, const Allocator& = Allocator());
+			// use of `iterator_category` makes sure InputIterator is (probably) an iterator, and not an `int` or
+			// similar that should match a different overload (SFINAE).
+		~vector();
+
+		vector& operator=(const vector& x);
+		vector& operator=(vector&& x) noexcept/*(allocator_traits<Allocator>::propagate_on_container_move_assignment::value || allocator_traits<Allocator>::is_always_equal::value)*/;
+		template<class InputIterator, class IteratorCategory = typename InputIterator::iterator_category> void assign(InputIterator first, InputIterator last);
+			// use of `iterator_category` makes sure InputIterator is (probably) an iterator, and not an `int` or
+			// similar that should match a different overload (SFINAE).
+		void assign(size_type n, const T& u);
+
+		iterator begin() noexcept;
+		const_iterator begin() const noexcept;
+		iterator end() noexcept;
+		const_iterator end() const noexcept;
+
+		size_type size() const noexcept;
+
+		reference operator[](size_type n);
+		const_reference operator[](size_type n) const;
+		const_reference at(size_type n) const;
+		reference at(size_type n);
+		reference front();
+		const_reference front() const;
+		reference back();
+		const_reference back() const;
+
+		T* data() noexcept;
+		const T* data() const noexcept;
+
+		void push_back(const T& x);
+		void push_back(T&& x);
+
+		iterator insert(const_iterator position, const T& x);
+		iterator insert(const_iterator position, T&& x);
+		iterator insert(const_iterator position, size_type n, const T& x);
+		template<class InputIterator> iterator insert(const_iterator position, InputIterator first, InputIterator last);
+
+		template <class... Args> iterator emplace (const_iterator position, Args&&... args);
+		template <class... Args> void emplace_back (Args&&... args);
+
+		void swap(vector&) noexcept/*(allocator_traits<Allocator>::propagate_on_container_swap::value || allocator_traits<Allocator>::is_always_equal::value)*/;
+
+		void clear() noexcept;
+	};
+}
+
+// --- make_shared / make_unique ---
+
+namespace std {
+	template<typename T>
+	class shared_ptr {
+	public:
+		shared_ptr() noexcept;
+		explicit shared_ptr(T*);
+		shared_ptr(const shared_ptr&) noexcept;
+		template<class U> shared_ptr(const shared_ptr<U>&) noexcept;
+		template<class U> shared_ptr(shared_ptr<U>&&) noexcept;
+
+		shared_ptr<T>& operator=(const shared_ptr<T>&) noexcept;
+		shared_ptr<T>& operator=(shared_ptr<T>&&) noexcept;
+
+		T& operator*() const noexcept;
+		T* operator->() const noexcept;
+
+		T* get() const noexcept;
+	};
+
+	template<typename T>
+	class unique_ptr {
+	public:
+		constexpr unique_ptr() noexcept;
+		explicit unique_ptr(T*) noexcept;
+		unique_ptr(unique_ptr<T>&&) noexcept;
+
+		unique_ptr<T>& operator=(unique_ptr<T>&&) noexcept;
+
+		T& operator*() const;
+		T* operator->() const noexcept;
+
+		T* get() const noexcept;
+	};
+
+	template<typename T, class... Args> unique_ptr<T> make_unique(Args&&...);
+
+	template<typename T, class... Args> shared_ptr<T> make_shared(Args&&...);
+}
+
+// --- pair ---
+
+namespace std {
+	template <class T1, class T2>
+	struct pair {
+		typedef T1 first_type;
+		typedef T2 second_type;
+
+		T1 first;
+		T2 second;
+		pair();
+		pair(const T1& x, const T2& y) : first(x), second(y) {};
+		template<class U, class V> pair(const pair<U, V> &p);
+
+		void swap(pair& p) /*noexcept(...)*/;
+	};
+
+	template<class T1, class T2> constexpr pair<decay_t<T1>, decay_t<T2>> make_pair(T1&& x, T2&& y) {
+		return pair<decay_t<T1>, decay_t<T2>>(std::forward<T1>(x), std::forward<T2>(y));
+	}
+}
+
+// --- map ---
+
+namespace std {
+	template<class T = void> struct less;
+
+	template<class Key, class T, class Compare = less<Key>, class Allocator = allocator<pair<const Key, T>>>
+	class map {
+	public:
+		using key_type = Key;
+		using mapped_type = T;
+		using value_type = pair<const Key, T>;
+		using iterator = std::iterator<random_access_iterator_tag, value_type >;
+		using const_iterator = std::iterator<random_access_iterator_tag, const value_type >;
+
+		map() /*: map(Compare()) { }*/;
+		map(const map& x);
+		map(map&& x);
+		~map();
+
+		map& operator=(const map& x);
+		map& operator=(map&& x) /*noexcept(allocator_traits<Allocator>::is_always_equal::value && is_nothrow_move_assignable_v<Compare>)*/;
+
+		iterator begin() noexcept;
+		const_iterator begin() const noexcept;
+		iterator end() noexcept;
+		const_iterator end() const noexcept;
+
+		T& operator[](const key_type& x);
+		T& operator[](key_type&& x);
+		T& at(const key_type& x);
+		const T& at(const key_type& x) const;
+
+		template<class... Args> pair<iterator, bool> emplace(Args&&... args);
+		template<class... Args> iterator emplace_hint(const_iterator position, Args&&... args);
+
+		pair<iterator, bool> insert(const value_type& x);
+		pair<iterator, bool> insert(value_type&& x);
+		iterator insert(const_iterator position, const value_type& x);
+		iterator insert(const_iterator position, value_type&& x);
+
+		template<class... Args> pair<iterator, bool> try_emplace(const key_type& k, Args&&... args);
+		template<class... Args> pair<iterator, bool> try_emplace(key_type&& k, Args&&... args);
+		template<class... Args> iterator try_emplace(const_iterator hint, const key_type& k, Args&&... args);
+		template<class... Args> iterator try_emplace(const_iterator hint, key_type&& k, Args&&... args);
+		template<class M> pair<iterator, bool> insert_or_assign(const key_type& k, M&& obj);
+		template<class M> pair<iterator, bool> insert_or_assign(key_type&& k, M&& obj);
+		template<class M> iterator insert_or_assign(const_iterator hint, const key_type& k, M&& obj);
+		template<class M> iterator insert_or_assign(const_iterator hint, key_type&& k, M&& obj);
+
+		iterator erase(iterator position);
+		iterator erase(const_iterator position);
+		iterator erase(const_iterator first, const_iterator last);
+		void swap(map&) /*noexcept(/*==allocator_traits<Allocator>::is_always_equal::value && is_nothrow_swappable_v<Compare>)*/;
+		void clear() noexcept;
+
+		template<class C2> void merge(map<Key, T, C2, Allocator>& source);
+		template<class C2> void merge(map<Key, T, C2, Allocator>&& source);
+
+		iterator find(const key_type& x);
+		const_iterator find(const key_type& x) const;
+
+		iterator lower_bound(const key_type& x);
+		const_iterator lower_bound(const key_type& x) const;
+		iterator upper_bound(const key_type& x);
+		const_iterator upper_bound(const key_type& x) const;
+
+		pair<iterator, iterator> equal_range(const key_type& x);
+		pair<const_iterator, const_iterator> equal_range(const key_type& x) const;
+	};
+
+	template<class T> struct hash;
+	template<class T = void> struct equal_to;
+
+	template<class Key, class T, class Hash = hash<Key>, class Pred = equal_to<Key>, class Allocator = allocator<pair<const Key, T>>>
+	class unordered_map {
+	public:
+		using key_type = Key;
+		using mapped_type = T;
+		using value_type = pair<const Key, T>;
+		using iterator = std::iterator<random_access_iterator_tag, value_type >;
+		using const_iterator = std::iterator<random_access_iterator_tag, const value_type >;
+
+		unordered_map();
+		unordered_map(const unordered_map&);
+		unordered_map(unordered_map&&);
+		~unordered_map();
+
+		unordered_map& operator=(const unordered_map&);
+		unordered_map& operator=(unordered_map&&) /*noexcept(allocator_traits<Allocator>::is_always_equal::value && is_nothrow_move_assignable_v<Hash> && is_nothrow_move_assignable_v<Pred>)*/;
+
+		iterator begin() noexcept;
+		const_iterator begin() const noexcept;
+		iterator end() noexcept;
+		const_iterator end() const noexcept;
+
+		mapped_type& operator[](const key_type& k);
+		mapped_type& operator[](key_type&& k);
+		mapped_type& at(const key_type& k);
+		const mapped_type& at(const key_type& k) const;
+		
+		template<class... Args> pair<iterator, bool> emplace(Args&&... args);
+		template<class... Args> iterator emplace_hint(const_iterator position, Args&&... args);
+
+		pair<iterator, bool> insert(const value_type& obj);
+		pair<iterator, bool> insert(value_type&& obj);
+		iterator insert(const_iterator hint, const value_type& obj);
+		iterator insert(const_iterator hint, value_type&& obj);
+
+		template<class... Args> pair<iterator, bool> try_emplace(const key_type& k, Args&&... args);
+		template<class... Args> pair<iterator, bool> try_emplace(key_type&& k, Args&&... args);
+		template<class... Args> iterator try_emplace(const_iterator hint, const key_type& k, Args&&... args);
+		template<class... Args> iterator try_emplace(const_iterator hint, key_type&& k, Args&&... args);
+		template<class M> pair<iterator, bool> insert_or_assign(const key_type& k, M&& obj);
+		template<class M> pair<iterator, bool> insert_or_assign(key_type&& k, M&& obj);
+		template<class M> iterator insert_or_assign(const_iterator hint, const key_type& k, M&& obj);
+		template<class M> iterator insert_or_assign(const_iterator hint, key_type&& k, M&& obj);
+
+		iterator erase(iterator position);
+		iterator erase(const_iterator position);
+		iterator erase(const_iterator first, const_iterator last);
+		void swap(unordered_map&) /*noexcept(allocator_traits<Allocator>::is_always_equal::value && is_nothrow_swappable_v<Hash> && is_nothrow_swappable_v<Pred>)*/;
+		void clear() noexcept;
+
+		template<class H2, class P2> void merge(unordered_map<Key, T, H2, P2, Allocator>& source);
+		template<class H2, class P2> void merge(unordered_map<Key, T, H2, P2, Allocator>&& source);
+
+		iterator find(const key_type& k);
+		const_iterator find(const key_type& k) const;
+
+		pair<iterator, iterator> equal_range(const key_type& k);
+		pair<const_iterator, const_iterator> equal_range(const key_type& k) const;
+	};
+};
+
+// --- set ---
+
+namespace std {
+	template<class Key, class Compare = less<Key>, class Allocator = allocator<Key>>
+	class set {
+	public:
+		using key_type = Key;
+		using value_type = Key;
+		using size_type = size_t;
+		using allocator_type = Allocator;
+		using iterator = std::iterator<random_access_iterator_tag, value_type >;
+		using const_iterator = std::iterator<random_access_iterator_tag, const value_type >;
+
+		set() /*: set(Compare())*/ { }
+		set(const set& x);
+		set(set&& x);
+		template<class InputIterator> set(InputIterator first, InputIterator last/*, const Compare& comp = Compare(), const Allocator& = Allocator()*/);
+		~set();
+		
+		set& operator=(const set& x);
+		set& operator=(set&& x) noexcept/*(allocator_traits<Allocator>::is_always_equal::value && is_nothrow_move_assignable_v<Compare>)*/;
+
+		iterator begin() noexcept;
+		const_iterator begin() const noexcept;
+		iterator end() noexcept;
+		const_iterator end() const noexcept;
+
+		template<class... Args> pair<iterator, bool> emplace(Args&&... args);
+		template<class... Args> iterator emplace_hint(const_iterator position, Args&&... args);
+		pair<iterator,bool> insert(const value_type& x);
+		pair<iterator,bool> insert(value_type&& x);
+		iterator insert(const_iterator position, const value_type& x);
+		iterator insert(const_iterator position, value_type&& x);
+		template<class InputIterator> void insert(InputIterator first, InputIterator last); 
+		
+		iterator erase(iterator position);
+		iterator erase(const_iterator position);
+		iterator erase(const_iterator first, const_iterator last); 
+		void swap(set&) noexcept/*(allocator_traits<Allocator>::is_always_equal::value && is_nothrow_swappable_v<Compare>)*/;
+		void clear() noexcept;
+
+		template<class C2> void merge(set<Key, C2, Allocator>& source);
+		template<class C2> void merge(set<Key, C2, Allocator>&& source);
+
+		iterator find(const key_type& x);
+		const_iterator find(const key_type& x) const;
+		
+		iterator lower_bound(const key_type& x);
+		const_iterator lower_bound(const key_type& x) const;
+		iterator upper_bound(const key_type& x);
+		const_iterator upper_bound(const key_type& x) const;
+		pair<iterator, iterator> equal_range(const key_type& x);
+		pair<const_iterator, const_iterator> equal_range(const key_type& x) const;
+	};
+
+	template<class Key, class Hash = hash<Key>, class Pred = equal_to<Key>, class Allocator = allocator<Key>>
+	class unordered_set { 
+	public:
+		using key_type = Key;
+		using value_type = Key;
+		using hasher = Hash;
+		using key_equal = Pred;
+		using allocator_type = Allocator;
+		using size_type = size_t;
+		using iterator = std::iterator<random_access_iterator_tag, value_type >;
+		using const_iterator = std::iterator<random_access_iterator_tag, const value_type >;
+
+		unordered_set();
+		unordered_set(const unordered_set&);
+		unordered_set(unordered_set&&);
+		template<class InputIterator> unordered_set(InputIterator f, InputIterator l, size_type n = 0/*, const hasher& hf = hasher(), const key_equal& eql = key_equal(), const allocator_type& a = allocator_type()*/);
+		~unordered_set();
+
+		unordered_set& operator=(const unordered_set&);
+		unordered_set& operator=(unordered_set&&) noexcept/*(allocator_traits<Allocator>::is_always_equal::value && is_nothrow_move_assignable_v<Hash> && is_nothrow_move_assignable_v<Pred>)*/;
+		
+		iterator begin() noexcept;
+		const_iterator begin() const noexcept;
+		iterator end() noexcept;
+		const_iterator end() const noexcept;
+
+		template<class... Args> pair<iterator, bool> emplace(Args&&... args);
+		template<class... Args> iterator emplace_hint(const_iterator position, Args&&... args);
+		pair<iterator, bool> insert(const value_type& obj);
+		pair<iterator, bool> insert(value_type&& obj);
+		iterator insert(const_iterator hint, const value_type& obj);
+		iterator insert(const_iterator hint, value_type&& obj);
+		template<class InputIterator> void insert(InputIterator first, InputIterator last); 
+
+		iterator erase(iterator position);
+		iterator erase(const_iterator position);
+		iterator erase(const_iterator first, const_iterator last);
+		void swap(unordered_set&) noexcept/*(allocator_traits<Allocator>::is_always_equal::value && is_nothrow_swappable_v<Hash> && is_nothrow_swappable_v<Pred>)*/;
+		void clear() noexcept;
+
+		template<class H2, class P2> void merge(unordered_set<Key, H2, P2, Allocator>& source);
+		template<class H2, class P2> void merge(unordered_set<Key, H2, P2, Allocator>&& source);
+
+		iterator find(const key_type& k);
+		const_iterator find(const key_type& k) const;
+		pair<iterator, iterator> equal_range(const key_type& k);
+		pair<const_iterator, const_iterator> equal_range(const key_type& k) const;
+	};
+}

cpp/ql/test/library-tests/string_concat/strconcat.expected

@@ -0,0 +1,22 @@
+| concat.cpp:23:27:23:27 | call to operator+ | concat.cpp:23:22:23:25 | str1 | concat.cpp:23:22:23:31 | call to operator+ |
+| concat.cpp:23:27:23:27 | call to operator+ | concat.cpp:23:22:23:25 | str1 | concat.cpp:23:22:23:31 | call to operator+ |
+| concat.cpp:23:27:23:27 | call to operator+ | concat.cpp:23:22:23:25 | str1 | concat.cpp:23:27:23:27 | call to operator+ |
+| concat.cpp:23:27:23:27 | call to operator+ | concat.cpp:23:29:23:31 |   | concat.cpp:23:22:23:31 | call to operator+ |
+| concat.cpp:23:27:23:27 | call to operator+ | concat.cpp:23:29:23:31 |   | concat.cpp:23:22:23:31 | call to operator+ |
+| concat.cpp:23:27:23:27 | call to operator+ | concat.cpp:23:29:23:31 |   | concat.cpp:23:27:23:27 | call to operator+ |
+| concat.cpp:23:33:23:33 | call to operator+ | concat.cpp:23:35:23:38 | str2 | concat.cpp:23:22:23:38 | call to operator+ |
+| concat.cpp:23:33:23:33 | call to operator+ | concat.cpp:23:35:23:38 | str2 | concat.cpp:23:22:23:38 | call to operator+ |
+| concat.cpp:23:33:23:33 | call to operator+ | concat.cpp:23:35:23:38 | str2 | concat.cpp:23:33:23:33 | call to operator+ |
+| concat.cpp:23:40:23:40 | call to operator+ | concat.cpp:23:42:23:45 | str3 | concat.cpp:23:40:23:40 | call to operator+ |
+| concat.cpp:47:8:47:8 | call to operator<< | concat.cpp:47:11:47:14 | str1 | concat.cpp:47:8:47:17 | call to operator<< |
+| concat.cpp:47:16:47:16 | call to operator<< | concat.cpp:47:19:47:21 |   | concat.cpp:47:16:47:24 | call to operator<< |
+| concat.cpp:47:23:47:23 | call to operator<< | concat.cpp:47:26:47:29 | str2 | concat.cpp:47:23:47:32 | call to operator<< |
+| concat.cpp:47:31:47:31 | call to operator<< | concat.cpp:47:34:47:37 | str3 | concat.cpp:47:31:47:38 | call to operator<< |
+| concat.cpp:58:5:58:11 | call to sprintf | concat.cpp:58:21:58:30 | %s %s %s | concat.cpp:58:13:58:18 | sprintf output argument |
+| concat.cpp:58:5:58:11 | call to sprintf | concat.cpp:58:33:58:36 | str1 | concat.cpp:58:13:58:18 | sprintf output argument |
+| concat.cpp:58:5:58:11 | call to sprintf | concat.cpp:58:39:58:42 | str2 | concat.cpp:58:13:58:18 | sprintf output argument |
+| concat.cpp:58:5:58:11 | call to sprintf | concat.cpp:58:45:58:49 | ucstr | concat.cpp:58:13:58:18 | sprintf output argument |
+| concat.cpp:61:5:61:10 | call to strcat | concat.cpp:61:12:61:15 | str1 | concat.cpp:61:5:61:10 | call to strcat |
+| concat.cpp:61:5:61:10 | call to strcat | concat.cpp:61:12:61:15 | str1 | concat.cpp:61:12:61:15 | strcat output argument |
+| concat.cpp:61:5:61:10 | call to strcat | concat.cpp:61:18:61:22 | ucstr | concat.cpp:61:5:61:10 | call to strcat |
+| concat.cpp:61:5:61:10 | call to strcat | concat.cpp:61:18:61:22 | ucstr | concat.cpp:61:12:61:15 | strcat output argument |

cpp/ql/test/library-tests/string_concat/strconcat.ql

@@ -0,0 +1,10 @@
+import cpp
+import semmle.code.cpp.commons.StringConcatenation
+import semmle.code.cpp.dataflow.new.DataFlow
+
+from StringConcatenation s, Expr op, DataFlow::Node res
+where
+  s.getLocation().getFile().getBaseName() = "concat.cpp" and
+  op = s.getAnOperand() and
+  res = s.getResultNode()
+select s, op, res

cpp/ql/test/library-tests/string_concat/type_traits.h

@@ -0,0 +1,35 @@
+template<class T>
+struct remove_const { typedef T type; };
+
+template<class T>
+struct remove_const<const T> { typedef T type; };
+
+// `remove_const_t<T>` removes any `const` specifier from `T`
+template<class T>
+using remove_const_t = typename remove_const<T>::type;
+
+template<class T>
+struct remove_reference { typedef T type; };
+
+template<class T>
+struct remove_reference<T &> { typedef T type; };
+
+template<class T>
+struct remove_reference<T &&> { typedef T type; };
+
+// `remove_reference_t<T>` removes any `&` from `T`
+template<class T>
+using remove_reference_t = typename remove_reference<T>::type;
+
+template<class T>
+struct decay_impl {
+    typedef T type;
+};
+
+template<class T, size_t t_size>
+struct decay_impl<T[t_size]> {
+    typedef T* type;
+};
+
+template<class T>
+using decay_t = typename decay_impl<remove_reference_t<T>>::type;

cpp/ql/test/library-tests/syntax-zoo/dataflow-consistency.expected

@@ -99,3 +99,4 @@ uniqueContentApprox
 identityLocalStep
 missingArgumentCall
 multipleArgumentCall
+lambdaCallEnclosingCallableMismatch

cpp/ql/test/library-tests/syntax-zoo/dataflow-ir-consistency.expected

@@ -42,3 +42,4 @@ uniqueContentApprox
 identityLocalStep
 missingArgumentCall
 multipleArgumentCall
+lambdaCallEnclosingCallableMismatch

cpp/ql/test/query-tests/jsf/4.06 Pre-Processing Directives/AV Rule 32/test.c

@@ -1,3 +1,4 @@
-#include "test.H"
-#include "test.xpm"
-#include "test2.c"
+#include "test.H"    // GOOD
+#include "test.xpm"  // GOOD
+#include "test2.c"   // BAD
+#include "test.def"  // GOOD

csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/FilePathFilter.cs

@@ -74,16 +74,18 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
                         includeByDefault)
                 });
 
-            // Move included pathfilters to the front of the list:
-            pathFilters.Sort((pf1, pf2) => -1 * pf1.Include.CompareTo(pf2.Include));
             return unfilteredResult.Where(f =>
             {
                 var include = f.FileInclusion.Include;
-                foreach (var pathFilter in pathFilters)
+                // LGTM_INDEX_FILTERS is a prioritized list, where later filters take
+                // priority over earlier ones.
+                for (int i = pathFilters.Count - 1; i >= 0; i--)
                 {
+                    var pathFilter = pathFilters[i];
                     if (pathFilter.Regex.IsMatch(f.FileInclusion.Path))
                     {
                         include = pathFilter.Include;
+                        break;
                     }
                 }
 

csharp/extractor/Semmle.Extraction.CSharp/Entities/OrdinaryMethod.cs

@@ -18,7 +18,12 @@ namespace Semmle.Extraction.CSharp.Entities
 
         public IMethodSymbol SourceDeclaration => Symbol.OriginalDefinition;
 
-        public override Microsoft.CodeAnalysis.Location ReportingLocation => Symbol.GetSymbolLocation();
+        public override Microsoft.CodeAnalysis.Location ReportingLocation =>
+            IsCompilerGeneratedDelegate()
+                ? Symbol.ContainingType.GetSymbolLocation()
+                : Symbol.GetSymbolLocation();
+
+        public override bool NeedsPopulation => base.NeedsPopulation || IsCompilerGeneratedDelegate();
 
         public override void Populate(TextWriter trapFile)
         {
@@ -47,6 +52,13 @@ namespace Semmle.Extraction.CSharp.Entities
             ExtractCompilerGenerated(trapFile);
         }
 
+        private bool IsCompilerGeneratedDelegate() =>
+            // Lambdas with parameter defaults or a `params` parameter are implemented
+            // using compiler generated delegate types.
+            Symbol.MethodKind == MethodKind.DelegateInvoke &&
+            Symbol.ContainingType is INamedTypeSymbol nt &&
+            nt.IsImplicitlyDeclared;
+
         public static new OrdinaryMethod Create(Context cx, IMethodSymbol method)
         {
             if (method.MethodKind == MethodKind.ReducedExtension)

csharp/extractor/Semmle.Extraction.Tests/FilePathFilter.cs

@@ -165,6 +165,7 @@ namespace Semmle.Extraction.Tests
         {
             (var testSubject, var progressMonitor, var files) = TestSetup();
 
+            // NOTE: the ordering DOES matter, later filters takes priority, so the exclude will end up not mattering at all.
             Environment.SetEnvironmentVariable("LGTM_INDEX_FILTERS", """
                 exclude:c/x/z
                 include:c/x
@@ -174,7 +175,8 @@ namespace Semmle.Extraction.Tests
 
             var expected = GetExpected(
                 [
-                    "/a/b/c/x/y/i.cs"
+                    "/a/b/c/x/y/i.cs",
+                    "/a/b/c/x/z/i.cs"
                 ]);
 
             AssertFileInfoEquivalence(expected, filtered);

csharp/ql/campaigns/Solorigate/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-all
-version: 1.7.6
+version: 1.7.7-dev
 groups:
   - csharp
   - solorigate

csharp/ql/campaigns/Solorigate/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-queries
-version: 1.7.6
+version: 1.7.7-dev
 groups:
   - csharp
   - solorigate

csharp/ql/lib/change-notes/2024-01-10-lambda-param-defaults.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* C# 12: Add extractor support for lambda expressions with parameter defaults like `(int x, int y = 1) => ...` and lambda expressions with a `param` parameter like `(params int[] x) => ...)`.

csharp/ql/lib/change-notes/2024-01-11-manual-neutral-model-blocks-generated-models.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* A manual neutral summary model for a callable now blocks all generated summary models for that callable from having any effect.

csharp/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-all
-version: 0.8.6
+version: 0.8.7-dev
 groups: csharp
 dbscheme: semmlecode.csharp.dbscheme
 extractor: csharp

csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowDispatch.qll

@@ -148,17 +148,17 @@ private module Cached {
 import Cached
 
 private module DispatchImpl {
-  /**
-   * Holds if the set of viable implementations that can be called by `call`
-   * might be improved by knowing the call context. This is the case if the
-   * call is a delegate call, or if the qualifier accesses a parameter of
-   * the enclosing callable `c` (including the implicit `this` parameter).
-   */
-  predicate mayBenefitFromCallContext(DataFlowCall call, DataFlowCallable c) {
+  private predicate mayBenefitFromCallContext(DataFlowCall call, DataFlowCallable c) {
     c = call.getEnclosingCallable() and
     call.(NonDelegateDataFlowCall).getDispatchCall().mayBenefitFromCallContext()
   }
 
+  /**
+   * Holds if the set of viable implementations that can be called by `call`
+   * might be improved by knowing the call context.
+   */
+  predicate mayBenefitFromCallContext(DataFlowCall call) { mayBenefitFromCallContext(call, _) }
+
   /**
    * Gets a viable dispatch target of `call` in the context `ctx`. This is
    * restricted to those `call`s for which a context might make a difference.

csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImplSpecific.qll

@@ -20,4 +20,8 @@ module CsharpDataFlow implements InputSig {
   Node exprNode(DataFlowExpr e) { result = Public::exprNode(e) }
 
   predicate accessPathLimit = Private::accessPathLimit/0;
+
+  predicate mayBenefitFromCallContext = Private::mayBenefitFromCallContext/1;
+
+  predicate viableImplInCallContext = Private::viableImplInCallContext/2;
 }

csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll

@@ -529,6 +529,13 @@ private predicate interpretSummary(
   )
 }
 
+private predicate interpretNeutral(UnboundCallable c, string kind, string provenance) {
+  exists(string namespace, string type, string name, string signature |
+    neutralModel(namespace, type, name, signature, kind, provenance) and
+    c = interpretElement(namespace, type, false, name, signature, "")
+  )
+}
+
 // adapter class for converting Mad summaries to `SummarizedCallable`s
 private class SummarizedCallableAdapter extends SummarizedCallable {
   SummarizedCallableAdapter() { interpretSummary(this, _, _, _, _) }
@@ -544,6 +551,10 @@ private class SummarizedCallableAdapter extends SummarizedCallable {
     exists(Provenance provenance |
       interpretSummary(this, input, output, kind, provenance) and
       provenance.isGenerated()
+    ) and
+    not exists(Provenance provenance |
+      interpretNeutral(this, "summary", provenance) and
+      provenance.isManual()
     )
   }
 
@@ -568,12 +579,7 @@ private class NeutralCallableAdapter extends NeutralCallable {
   string kind;
   string provenance_;
 
-  NeutralCallableAdapter() {
-    exists(string namespace, string type, string name, string signature |
-      neutralModel(namespace, type, name, signature, kind, provenance_) and
-      this = interpretElement(namespace, type, false, name, signature, "")
-    )
-  }
+  NeutralCallableAdapter() { interpretNeutral(this, kind, provenance_) }
 
   override string getKind() { result = kind }
 

csharp/ql/lib/semmle/code/csharp/exprs/Call.qll

@@ -60,18 +60,17 @@ class Call extends DotNet::Call, Expr, @call {
    */
   cached
   override Expr getArgumentForParameter(DotNet::Parameter p) {
+    // Appears in the positional part of the call
+    result = this.getImplicitArgument(p)
+    or
+    // Appears in the named part of the call
     this.getTarget().getAParameter() = p and
-    (
-      // Appears in the positional part of the call
-      result = this.getImplicitArgument(p)
-      or
-      // Appears in the named part of the call
-      result = this.getExplicitArgument(p.getName())
-    )
+    result = this.getExplicitArgument(p.getName())
   }
 
   pragma[noinline]
   private Expr getImplicitArgument(DotNet::Parameter p) {
+    this.getTarget().getAParameter() = p and
     not exists(result.getExplicitArgumentName()) and
     (
       p.(Parameter).isParams() and
@@ -182,15 +181,39 @@ class Call extends DotNet::Call, Expr, @call {
   /**
    * Gets the argument that corresponds to parameter `p` of a potential
    * run-time target of this call.
+   *
+   * This takes into account both positional and named arguments, but does not
+   * consider default arguments.
    */
+  cached
   Expr getRuntimeArgumentForParameter(Parameter p) {
-    exists(Callable c |
-      c = this.getARuntimeTarget() and
-      p = c.getAParameter() and
+    // Appears in the positional part of the call
+    result = this.getImplicitRuntimeArgument(p)
+    or
+    // Appears in the named part of the call
+    this.getARuntimeTarget().getAParameter() = p and
+    result = this.getExplicitRuntimeArgument(p.getName())
+  }
+
+  pragma[noinline]
+  private Expr getImplicitRuntimeArgument(Parameter p) {
+    this.getARuntimeTarget().getAParameter() = p and
+    not exists(result.getExplicitArgumentName()) and
+    (
+      p.isParams() and
+      result = this.getRuntimeArgument(any(int i | i >= p.getPosition()))
+      or
+      not p.isParams() and
       result = this.getRuntimeArgument(p.getPosition())
     )
   }
 
+  pragma[nomagic]
+  private Expr getExplicitRuntimeArgument(string name) {
+    result = this.getARuntimeArgument() and
+    result.getExplicitArgumentName() = name
+  }
+
   /**
    * Gets the argument that corresponds to a parameter named `name` of a potential
    * run-time target of this call.

csharp/ql/lib/upgrades/6b8962d52bd5ed58edb163f78467074fd7e1a127/upgrade.properties

@@ -1,2 +1,7 @@
 description: Remove unused VCS relations.
 compatibility: backwards
+
+svnaffectedfiles.rel: delete
+svnchurn.rel: delete
+svnentries.rel: delete
+svnentrymsg.rel: delete

csharp/ql/lib/upgrades/90fdbc8f87761f223ef7723e4b421c5b26ecc15e/upgrade.properties

@@ -2,3 +2,5 @@ description: Support type annotations
 compatibility: backwards
 
 type_annotation.rel: run type_annotation.qlo
+ref_readonly_returns.rel: delete
+ref_returns.rel: delete

csharp/ql/lib/upgrades/f93793ee5f6b7bec615eaa1af0a1a4dea19472bb/upgrade.properties

@@ -1,2 +1,5 @@
 description: Implement structured nullability 
 compatibility: backwards
+
+specific_type_parameter_annotation.rel: delete
+type_argument_annotation.rel: delete

csharp/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-queries
-version: 0.8.6
+version: 0.8.7-dev
 groups:
   - csharp
   - queries

csharp/ql/src/utils/modelgenerator/CaptureDiscardedSummaryModels.ql

@@ -1,15 +0,0 @@
-/**
- * @name Capture discarded summary models.
- * @description Finds summary models that are discarded as handwritten counterparts exist.
- * @id cs/utils/modelgenerator/discarded-summary-models
- */
-
-import semmle.code.csharp.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl
-import internal.CaptureModels
-import internal.CaptureSummaryFlowQuery
-
-from DataFlowTargetApi api, string flow
-where
-  flow = captureFlow(api) and
-  api.(FlowSummaryImpl::Public::SummarizedCallable).applyManualModel()
-select flow order by flow

csharp/ql/src/utils/modelgenerator/CaptureNeutralModels.ql

@@ -11,7 +11,5 @@ import internal.CaptureModels
 import internal.CaptureSummaryFlowQuery
 
 from DataFlowTargetApi api, string noflow
-where
-  noflow = captureNoFlow(api) and
-  not api.(FlowSummaryImpl::Public::SummarizedCallable).applyManualModel()
+where noflow = captureNoFlow(api)
 select noflow order by noflow

csharp/ql/src/utils/modelgenerator/CaptureSummaryModels.ql

@@ -11,7 +11,5 @@ import internal.CaptureModels
 import internal.CaptureSummaryFlowQuery
 
 from DataFlowTargetApi api, string flow
-where
-  flow = captureFlow(api) and
-  not api.(FlowSummaryImpl::Public::SummarizedCallable).applyManualModel()
+where flow = captureFlow(api)
 select flow order by flow

csharp/ql/src/utils/modelgenerator/internal/CaptureModelsSpecific.qll

@@ -7,6 +7,7 @@ private import dotnet
 private import semmle.code.csharp.commons.Util as Util
 private import semmle.code.csharp.commons.Collections as Collections
 private import semmle.code.csharp.dataflow.internal.DataFlowDispatch
+private import semmle.code.csharp.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl
 private import semmle.code.csharp.frameworks.system.linq.Expressions
 import semmle.code.csharp.dataflow.internal.ExternalFlow as ExternalFlow
 import semmle.code.csharp.dataflow.internal.DataFlowImplCommon as DataFlowImplCommon
@@ -37,7 +38,10 @@ private predicate isRelevantForModels(CS::Callable api) {
   not api instanceof Util::MainMethod and
   not api instanceof CS::Destructor and
   not api instanceof CS::AnonymousFunctionExpr and
-  not api.(CS::Constructor).isParameterless()
+  not api.(CS::Constructor).isParameterless() and
+  // Disregard all APIs that have a manual model.
+  not api = any(FlowSummaryImpl::Public::SummarizedCallable sc | sc.applyManualModel()) and
+  not api = any(FlowSummaryImpl::Public::NeutralSummaryCallable sc | sc.hasManualModel())
 }
 
 /**

csharp/ql/test/library-tests/arguments/PrintAst.expected

@@ -353,3 +353,98 @@ arguments.cs:
 #   93|       0: [Parameter] b
 #   93|         -1: [TypeMention] bool
 #   93|     4: [BlockStmt] {...}
+lambdas.cs:
+#    3| [Class] LambdaArgumentsTest
+#    5|   5: [Method] M1
+#    5|     -1: [TypeMention] Void
+#    6|     4: [BlockStmt] {...}
+#    7|       0: [LocalVariableDeclStmt] ... ...;
+#    7|         0: [LocalVariableDeclAndInitExpr] Func<Int32,Int32> l1 = ...
+#    7|           -1: [TypeMention] Func<int, int>
+#    7|           0: [LocalVariableAccess] access to local variable l1
+#    7|           1: [LambdaExpr] (...) => ...
+#-----|             2: (Parameters)
+#    7|               0: [Parameter] x
+#    7|                 -1: [TypeMention] int
+#    7|             4: [AddExpr] ... + ...
+#    7|               0: [ParameterAccess] access to parameter x
+#    7|               1: [IntLiteral] 1
+#    8|       1: [ExprStmt] ...;
+#    8|         0: [DelegateCall] delegate call
+#    8|           -1: [LocalVariableAccess] access to local variable l1
+#    8|           0: [IntLiteral] 1
+#   10|       2: [LocalVariableDeclStmt] ... ...;
+#   10|         0: [LocalVariableDeclAndInitExpr] <>__AnonType0<> l2 = ...
+#   10|           -1: [TypeMention] <>__AnonType0<>
+#   10|           0: [LocalVariableAccess] access to local variable l2
+#   10|           1: [LambdaExpr] (...) => ...
+#-----|             2: (Parameters)
+#   10|               0: [Parameter] x
+#   10|                 -1: [TypeMention] int
+#   10|               1: [Parameter] y
+#   10|                 -1: [TypeMention] int
+#   10|                 1: [IntLiteral] 1
+#   10|             4: [AddExpr] ... + ...
+#   10|               0: [ParameterAccess] access to parameter x
+#   10|               1: [ParameterAccess] access to parameter y
+#   11|       3: [ExprStmt] ...;
+#   11|         0: [DelegateCall] delegate call
+#   11|           -1: [LocalVariableAccess] access to local variable l2
+#   11|           0: [IntLiteral] 2
+#   11|           1: [IntLiteral] 3
+#   12|       4: [ExprStmt] ...;
+#   12|         0: [DelegateCall] delegate call
+#   12|           -1: [LocalVariableAccess] access to local variable l2
+#   12|           0: [IntLiteral] 4
+#   13|       5: [ExprStmt] ...;
+#   13|         0: [DelegateCall] delegate call
+#   13|           -1: [LocalVariableAccess] access to local variable l2
+#   13|           0: [IntLiteral] 5
+#   13|           1: [IntLiteral] 6
+#   15|       6: [LocalVariableDeclStmt] ... ...;
+#   15|         0: [LocalVariableDeclAndInitExpr] <>__AnonType0<> l3 = ...
+#   15|           -1: [TypeMention] <>__AnonType0<>
+#   15|           0: [LocalVariableAccess] access to local variable l3
+#   15|           1: [LambdaExpr] (...) => ...
+#-----|             2: (Parameters)
+#   15|               0: [Parameter] x
+#   15|                 -1: [TypeMention] Int32[]
+#   15|                   1: [TypeMention] int
+#   15|             4: [PropertyCall] access to property Length
+#   15|               -1: [ParameterAccess] access to parameter x
+#   16|       7: [ExprStmt] ...;
+#   16|         0: [DelegateCall] delegate call
+#   16|           -1: [LocalVariableAccess] access to local variable l3
+#   17|       8: [ExprStmt] ...;
+#   17|         0: [DelegateCall] delegate call
+#   17|           -1: [LocalVariableAccess] access to local variable l3
+#   17|           0: [IntLiteral] 7
+#   17|           1: [IntLiteral] 8
+#   17|           2: [IntLiteral] 9
+#   20|   6: [DelegateType] MyDelegate
+#-----|     2: (Parameters)
+#   20|       0: [Parameter] x
+#   20|         -1: [TypeMention] int
+#   20|       1: [Parameter] y
+#   20|         -1: [TypeMention] int
+#   22|   7: [Method] M2
+#   22|     -1: [TypeMention] Void
+#   23|     4: [BlockStmt] {...}
+#   24|       0: [LocalVariableDeclStmt] ... ...;
+#   24|         0: [LocalVariableDeclAndInitExpr] MyDelegate sum = ...
+#   24|           -1: [TypeMention] MyDelegate
+#   24|           0: [LocalVariableAccess] access to local variable sum
+#   24|           1: [LambdaExpr] (...) => ...
+#-----|             2: (Parameters)
+#   24|               0: [Parameter] x
+#   24|                 -1: [TypeMention] int
+#   24|               1: [Parameter] y
+#   24|                 -1: [TypeMention] int
+#   24|             4: [AddExpr] ... + ...
+#   24|               0: [ParameterAccess] access to parameter x
+#   24|               1: [ParameterAccess] access to parameter y
+#   25|       1: [ExprStmt] ...;
+#   25|         0: [DelegateCall] delegate call
+#   25|           -1: [LocalVariableAccess] access to local variable sum
+#   25|           0: [IntLiteral] 4
+#   25|           1: [IntLiteral] 5

csharp/ql/test/library-tests/arguments/argumentName.expected

@@ -11,3 +11,5 @@
 | arguments.cs:70:36:70:36 | 0 | x |
 | arguments.cs:78:18:78:21 | access to parameter args | args |
 | arguments.cs:78:27:78:27 | 0 | o |
+| lambdas.cs:25:16:25:16 | 4 | y |
+| lambdas.cs:25:22:25:22 | 5 | x |

csharp/ql/test/library-tests/arguments/argumentType.expected

@@ -70,3 +70,14 @@
 | arguments.cs:84:23:84:43 | array creation of type Double[] | 0 |
 | arguments.cs:85:20:85:20 | 0 | 0 |
 | arguments.cs:85:23:85:43 | array creation of type Double[] | 0 |
+| lambdas.cs:8:12:8:12 | 1 | 0 |
+| lambdas.cs:11:12:11:12 | 2 | 0 |
+| lambdas.cs:11:15:11:15 | 3 | 0 |
+| lambdas.cs:12:12:12:12 | 4 | 0 |
+| lambdas.cs:13:12:13:12 | 5 | 0 |
+| lambdas.cs:13:15:13:15 | 6 | 0 |
+| lambdas.cs:17:12:17:12 | 7 | 0 |
+| lambdas.cs:17:15:17:15 | 8 | 0 |
+| lambdas.cs:17:18:17:18 | 9 | 0 |
+| lambdas.cs:25:16:25:16 | 4 | 0 |
+| lambdas.cs:25:22:25:22 | 5 | 0 |

csharp/ql/test/library-tests/arguments/lambdaArgument.expected

@@ -0,0 +1,11 @@
+| lambdas.cs:8:9:8:13 | delegate call | lambdas.cs:7:23:7:23 | x | lambdas.cs:8:12:8:12 | 1 |
+| lambdas.cs:11:9:11:16 | delegate call | lambdas.cs:10:23:10:23 | x | lambdas.cs:11:12:11:12 | 2 |
+| lambdas.cs:11:9:11:16 | delegate call | lambdas.cs:10:30:10:30 | y | lambdas.cs:11:15:11:15 | 3 |
+| lambdas.cs:12:9:12:13 | delegate call | lambdas.cs:10:23:10:23 | x | lambdas.cs:12:12:12:12 | 4 |
+| lambdas.cs:13:9:13:16 | delegate call | lambdas.cs:10:23:10:23 | x | lambdas.cs:13:12:13:12 | 5 |
+| lambdas.cs:13:9:13:16 | delegate call | lambdas.cs:10:30:10:30 | y | lambdas.cs:13:15:13:15 | 6 |
+| lambdas.cs:17:9:17:19 | delegate call | lambdas.cs:15:32:15:32 | x | lambdas.cs:17:12:17:12 | 7 |
+| lambdas.cs:17:9:17:19 | delegate call | lambdas.cs:15:32:15:32 | x | lambdas.cs:17:15:17:15 | 8 |
+| lambdas.cs:17:9:17:19 | delegate call | lambdas.cs:15:32:15:32 | x | lambdas.cs:17:18:17:18 | 9 |
+| lambdas.cs:25:9:25:23 | delegate call | lambdas.cs:24:31:24:31 | x | lambdas.cs:25:22:25:22 | 5 |
+| lambdas.cs:25:9:25:23 | delegate call | lambdas.cs:24:38:24:38 | y | lambdas.cs:25:16:25:16 | 4 |

csharp/ql/test/library-tests/arguments/lambdaArgument.ql

@@ -0,0 +1,7 @@
+import csharp
+
+from Call call, Parameter p, Expr arg
+where
+  call.getARuntimeTarget() instanceof LambdaExpr and
+  arg = call.getRuntimeArgumentForParameter(p)
+select call, p, arg

csharp/ql/test/library-tests/arguments/lambdas.cs

@@ -0,0 +1,28 @@
+using System;
+
+class LambdaArgumentsTest
+{
+    void M1()
+    {
+        var l1 = (int x) => x + 1;
+        l1(1);
+
+        var l2 = (int x, int y = 1) => x + y;
+        l2(2, 3);
+        l2(4);
+        l2(5, 6);
+
+        var l3 = (params int[] x) => x.Length;
+        l3();
+        l3(7, 8, 9);
+    }
+
+    delegate int MyDelegate(int x, int y);
+
+    void M2()
+    {
+        MyDelegate sum = (int x, int y) => x + y;
+        sum(y: 4, x: 5);
+    }
+}
+

csharp/ql/test/library-tests/dataflow/external-models/ExternalFlow.cs

@@ -206,12 +206,25 @@ namespace My.Qltest
             Sink(MixedFlowArgs(null, o2));
         }
 
+        void M4()
+        {
+            var o1 = new object();
+            Sink(GeneratedFlowWithGeneratedNeutral(o1));
+
+            var o2 = new object();
+            Sink(GeneratedFlowWithManualNeutral(o2)); // no flow because the modelled method has a manual neutral summary model
+        }
+
         object GeneratedFlow(object o) => throw null;
 
         object GeneratedFlowArgs(object o1, object o2) => throw null;
 
         object MixedFlowArgs(object o1, object o2) => throw null;
 
+        object GeneratedFlowWithGeneratedNeutral(object o) => throw null;
+
+        object GeneratedFlowWithManualNeutral(object o) => throw null;
+
         static void Sink(object o) { }
     }
 

csharp/ql/test/library-tests/dataflow/external-models/ExternalFlow.expected

@@ -63,9 +63,11 @@ edges
 | ExternalFlow.cs:120:18:120:18 | access to local variable b : null [element] : Object | ExternalFlow.cs:120:18:120:21 | access to array element |
 | ExternalFlow.cs:205:22:205:33 | object creation of type Object : Object | ExternalFlow.cs:206:38:206:39 | access to local variable o2 : Object |
 | ExternalFlow.cs:206:38:206:39 | access to local variable o2 : Object | ExternalFlow.cs:206:18:206:40 | call to method MixedFlowArgs |
-| ExternalFlow.cs:231:21:231:28 | object creation of type HC : HC | ExternalFlow.cs:232:21:232:21 | access to local variable h : HC |
-| ExternalFlow.cs:232:21:232:21 | access to local variable h : HC | ExternalFlow.cs:232:21:232:39 | call to method ExtensionMethod : HC |
-| ExternalFlow.cs:232:21:232:39 | call to method ExtensionMethod : HC | ExternalFlow.cs:233:18:233:18 | access to local variable o |
+| ExternalFlow.cs:211:22:211:33 | object creation of type Object : Object | ExternalFlow.cs:212:52:212:53 | access to local variable o1 : Object |
+| ExternalFlow.cs:212:52:212:53 | access to local variable o1 : Object | ExternalFlow.cs:212:18:212:54 | call to method GeneratedFlowWithGeneratedNeutral |
+| ExternalFlow.cs:244:21:244:28 | object creation of type HC : HC | ExternalFlow.cs:245:21:245:21 | access to local variable h : HC |
+| ExternalFlow.cs:245:21:245:21 | access to local variable h : HC | ExternalFlow.cs:245:21:245:39 | call to method ExtensionMethod : HC |
+| ExternalFlow.cs:245:21:245:39 | call to method ExtensionMethod : HC | ExternalFlow.cs:246:18:246:18 | access to local variable o |
 nodes
 | ExternalFlow.cs:9:27:9:38 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
 | ExternalFlow.cs:10:18:10:33 | call to method StepArgRes | semmle.label | call to method StepArgRes |
@@ -148,10 +150,13 @@ nodes
 | ExternalFlow.cs:205:22:205:33 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
 | ExternalFlow.cs:206:18:206:40 | call to method MixedFlowArgs | semmle.label | call to method MixedFlowArgs |
 | ExternalFlow.cs:206:38:206:39 | access to local variable o2 : Object | semmle.label | access to local variable o2 : Object |
-| ExternalFlow.cs:231:21:231:28 | object creation of type HC : HC | semmle.label | object creation of type HC : HC |
-| ExternalFlow.cs:232:21:232:21 | access to local variable h : HC | semmle.label | access to local variable h : HC |
-| ExternalFlow.cs:232:21:232:39 | call to method ExtensionMethod : HC | semmle.label | call to method ExtensionMethod : HC |
-| ExternalFlow.cs:233:18:233:18 | access to local variable o | semmle.label | access to local variable o |
+| ExternalFlow.cs:211:22:211:33 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
+| ExternalFlow.cs:212:18:212:54 | call to method GeneratedFlowWithGeneratedNeutral | semmle.label | call to method GeneratedFlowWithGeneratedNeutral |
+| ExternalFlow.cs:212:52:212:53 | access to local variable o1 : Object | semmle.label | access to local variable o1 : Object |
+| ExternalFlow.cs:244:21:244:28 | object creation of type HC : HC | semmle.label | object creation of type HC : HC |
+| ExternalFlow.cs:245:21:245:21 | access to local variable h : HC | semmle.label | access to local variable h : HC |
+| ExternalFlow.cs:245:21:245:39 | call to method ExtensionMethod : HC | semmle.label | call to method ExtensionMethod : HC |
+| ExternalFlow.cs:246:18:246:18 | access to local variable o | semmle.label | access to local variable o |
 subpaths
 #select
 | ExternalFlow.cs:10:18:10:33 | call to method StepArgRes | ExternalFlow.cs:9:27:9:38 | object creation of type Object : Object | ExternalFlow.cs:10:18:10:33 | call to method StepArgRes | $@ | ExternalFlow.cs:9:27:9:38 | object creation of type Object : Object | object creation of type Object : Object |
@@ -175,4 +180,5 @@ subpaths
 | ExternalFlow.cs:112:18:112:25 | access to property MyProp | ExternalFlow.cs:111:24:111:35 | object creation of type Object : Object | ExternalFlow.cs:112:18:112:25 | access to property MyProp | $@ | ExternalFlow.cs:111:24:111:35 | object creation of type Object : Object | object creation of type Object : Object |
 | ExternalFlow.cs:120:18:120:21 | access to array element | ExternalFlow.cs:117:36:117:47 | object creation of type Object : Object | ExternalFlow.cs:120:18:120:21 | access to array element | $@ | ExternalFlow.cs:117:36:117:47 | object creation of type Object : Object | object creation of type Object : Object |
 | ExternalFlow.cs:206:18:206:40 | call to method MixedFlowArgs | ExternalFlow.cs:205:22:205:33 | object creation of type Object : Object | ExternalFlow.cs:206:18:206:40 | call to method MixedFlowArgs | $@ | ExternalFlow.cs:205:22:205:33 | object creation of type Object : Object | object creation of type Object : Object |
-| ExternalFlow.cs:233:18:233:18 | access to local variable o | ExternalFlow.cs:231:21:231:28 | object creation of type HC : HC | ExternalFlow.cs:233:18:233:18 | access to local variable o | $@ | ExternalFlow.cs:231:21:231:28 | object creation of type HC : HC | object creation of type HC : HC |
+| ExternalFlow.cs:212:18:212:54 | call to method GeneratedFlowWithGeneratedNeutral | ExternalFlow.cs:211:22:211:33 | object creation of type Object : Object | ExternalFlow.cs:212:18:212:54 | call to method GeneratedFlowWithGeneratedNeutral | $@ | ExternalFlow.cs:211:22:211:33 | object creation of type Object : Object | object creation of type Object : Object |
+| ExternalFlow.cs:246:18:246:18 | access to local variable o | ExternalFlow.cs:244:21:244:28 | object creation of type HC : HC | ExternalFlow.cs:246:18:246:18 | access to local variable o | $@ | ExternalFlow.cs:244:21:244:28 | object creation of type HC : HC | object creation of type HC : HC |

csharp/ql/test/library-tests/dataflow/external-models/ExternalFlow.ext.yml

@@ -29,4 +29,13 @@ extensions:
       - ["My.Qltest", "G", false, "GeneratedFlowArgs", "(System.Object,System.Object)", "", "Argument[1]", "ReturnValue", "value", "df-generated"]
       - ["My.Qltest", "G", false, "MixedFlowArgs", "(System.Object,System.Object)", "", "Argument[0]", "ReturnValue", "value", "df-generated"]
       - ["My.Qltest", "G", false, "MixedFlowArgs", "(System.Object,System.Object)", "", "Argument[1]", "ReturnValue", "value", "manual"]
+      - ["My.Qltest", "G", false, "GeneratedFlowWithGeneratedNeutral", "(System.Object)", "", "Argument[0]", "ReturnValue", "value", "df-generated"]
+      - ["My.Qltest", "G", false, "GeneratedFlowWithManualNeutral", "(System.Object)", "", "Argument[0]", "ReturnValue", "value", "df-generated"]
       - ["My.Qltest", "HE", false, "ExtensionMethod", "(My.Qltest.HI)", "", "Argument[0]", "ReturnValue", "value", "manual"]
+  - addsTo:
+      pack: codeql/csharp-all
+      extensible: neutralModel
+      # "namespace", "type", "name", "signature", "kind", "provenance"
+    data:
+      - ["My.Qltest", "G", "GeneratedFlowWithGeneratedNeutral", "(System.Object)", "summary", "df-generated"]
+      - ["My.Qltest", "G", "GeneratedFlowWithManualNeutral", "(System.Object)", "summary", "manual"]

csharp/ql/test/library-tests/dataflow/external-models/ExternalFlow.ql

@@ -21,11 +21,18 @@ module TaintConfig implements DataFlow::ConfigSig {
 module Taint = TaintTracking::Global<TaintConfig>;
 
 /**
- * Simulate that methods with summaries are not included in the source code.
- * This is relevant for dataflow analysis using summaries tagged as generated.
+ * Emulate that methods with summaries do not have a body.
+ * This is relevant for dataflow analysis using summaries with a generated like
+ * provenance as generated summaries are only applied, if a
+ * callable does not have a body.
  */
-private class MyMethod extends Method {
-  override predicate fromSource() { none() }
+private class MethodsWithGeneratedModels extends Method {
+  MethodsWithGeneratedModels() {
+    this.hasFullyQualifiedName("My.Qltest", "G",
+      ["MixedFlowArgs", "GeneratedFlowWithGeneratedNeutral", "GeneratedFlowWithManualNeutral"])
+  }
+
+  override predicate hasBody() { none() }
 }
 
 from Taint::PathNode source, Taint::PathNode sink

csharp/ql/test/library-tests/dataflow/external-models/Steps.cs

@@ -42,6 +42,12 @@ namespace My.Qltest
             gen.StepGeneric2(false);
 
             new Sub().StepOverride("string");
+
+            object arg4 = new object();
+            this.StepArgQualGenerated(arg4);
+            
+            object arg5 = new object();
+            this.StepArgQualGeneratedIgnored(arg5);
         }
 
         object StepArgRes(object x) { return null; }
@@ -50,6 +56,10 @@ namespace My.Qltest
 
         void StepArgQual(object x) { }
 
+        void StepArgQualGenerated(object x) { }
+
+        void StepArgQualGeneratedIgnored(object x) { }
+
         object StepQualRes() { return null; }
 
         void StepQualArg(object @out) { }
@@ -87,4 +97,4 @@ namespace My.Qltest
             public override string StepOverride(string i) => throw null;
         }
     }
-}
+}

csharp/ql/test/library-tests/dataflow/external-models/steps.expected

@@ -11,11 +11,12 @@ summaryThroughStep
 | Steps.cs:41:29:41:29 | 0 | Steps.cs:41:13:41:30 | call to method StepGeneric | true |
 | Steps.cs:42:30:42:34 | false | Steps.cs:42:13:42:35 | call to method StepGeneric2<Boolean> | true |
 | Steps.cs:44:36:44:43 | "string" | Steps.cs:44:13:44:44 | call to method StepOverride | true |
+| Steps.cs:47:39:47:42 | access to local variable arg4 | Steps.cs:47:13:47:16 | [post] this access | false |
 summaryGetterStep
-| Steps.cs:28:13:28:16 | this access | Steps.cs:28:13:28:34 | call to method StepFieldGetter | Steps.cs:57:13:57:17 | field Field |
-| Steps.cs:32:13:32:16 | this access | Steps.cs:32:13:32:37 | call to method StepPropertyGetter | Steps.cs:63:13:63:20 | property Property |
+| Steps.cs:28:13:28:16 | this access | Steps.cs:28:13:28:34 | call to method StepFieldGetter | Steps.cs:67:13:67:17 | field Field |
+| Steps.cs:32:13:32:16 | this access | Steps.cs:32:13:32:37 | call to method StepPropertyGetter | Steps.cs:73:13:73:20 | property Property |
 | Steps.cs:36:13:36:16 | this access | Steps.cs:36:13:36:36 | call to method StepElementGetter | file://:0:0:0:0 | element |
 summarySetterStep
-| Steps.cs:30:34:30:34 | 0 | Steps.cs:30:13:30:16 | [post] this access | Steps.cs:57:13:57:17 | field Field |
-| Steps.cs:34:37:34:37 | 0 | Steps.cs:34:13:34:16 | [post] this access | Steps.cs:63:13:63:20 | property Property |
+| Steps.cs:30:34:30:34 | 0 | Steps.cs:30:13:30:16 | [post] this access | Steps.cs:67:13:67:17 | field Field |
+| Steps.cs:34:37:34:37 | 0 | Steps.cs:34:13:34:16 | [post] this access | Steps.cs:73:13:73:20 | property Property |
 | Steps.cs:38:36:38:36 | 0 | Steps.cs:38:13:38:16 | [post] this access | file://:0:0:0:0 | element |

csharp/ql/test/library-tests/dataflow/external-models/steps.ext.yml

@@ -18,3 +18,13 @@ extensions:
       - ["My.Qltest", "C+Generic<T,U>", false, "StepGeneric", "(T)", "", "Argument[0]", "ReturnValue", "value", "manual"]
       - ["My.Qltest", "C+Generic<T,U>", false, "StepGeneric2<S>", "(S)", "", "Argument[0]", "ReturnValue", "value", "manual"]
       - ["My.Qltest", "C+Base<T>", true, "StepOverride", "(T)", "", "Argument[0]", "ReturnValue", "value", "manual"]
+      - ["My.Qltest", "C", false, "StepArgQualGenerated", "(System.Object)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
+      - ["My.Qltest", "C", false, "StepArgQualGeneratedIgnored", "(System.Object)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
+  - addsTo:
+      pack: codeql/csharp-all
+      extensible: neutralModel
+      # "namespace", "type", "name", "signature", "kind", "provenance"
+    data:
+      - ["My.Qltest", "C", "StepArgQualGenerated", "(System.Object)", "summary", "df-generated"]
+      - ["My.Qltest", "C", "StepArgQualGeneratedIgnored", "(System.Object)", "summary", "manual"]
+

csharp/ql/test/library-tests/dataflow/external-models/steps.ql

@@ -6,6 +6,22 @@ import semmle.code.csharp.dataflow.FlowSummary
 import semmle.code.csharp.dataflow.internal.DataFlowDispatch as DataFlowDispatch
 import semmle.code.csharp.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl
 
+/**
+ * Emulate that methods with summaries do not have a body.
+ * This is relevant for dataflow analysis using summaries with a generated like
+ * provenance as generated summaries are only applied, if a
+ * callable does not have a body.
+ */
+private class StepArgQualGenerated extends Method {
+  StepArgQualGenerated() {
+    exists(string name |
+      this.hasFullyQualifiedName("My.Qltest", "C", name) and name.matches("StepArgQualGenerated%")
+    )
+  }
+
+  override predicate hasBody() { none() }
+}
+
 query predicate summaryThroughStep(
   DataFlow::Node node1, DataFlow::Node node2, boolean preservesValue
 ) {

csharp/ql/test/library-tests/parameters/LambdaParameters.cs

@@ -0,0 +1,15 @@
+using System;
+using System.Runtime.InteropServices;
+using System.Runtime.CompilerServices;
+
+public class LambdaParameters
+{
+    public void M1()
+    {
+        var l1 = (int x, int y = 1) => x + y;
+        var l2 = (object? o = default) => o;
+        var l3 = (int x, int y = 1, int z = 2) => x + y + z;
+        var l4 = ([Optional, DefaultParameterValue(7)] int x) => x;
+        var l5 = ([Optional, DateTimeConstant(14L)] DateTime x) => x;
+    }
+}

csharp/ql/test/library-tests/parameters/Parameters.expected

@@ -1,4 +1,6 @@
 noDefaultValue
+| LambdaParameters.cs:9:18:9:44 | (...) => ... | LambdaParameters.cs:9:23:9:23 | x | 0 |
+| LambdaParameters.cs:11:18:11:59 | (...) => ... | LambdaParameters.cs:11:23:11:23 | x | 0 |
 | Parameters.cs:7:17:7:18 | M1 | Parameters.cs:7:24:7:24 | a | 0 |
 | Parameters.cs:7:17:7:18 | M1 | Parameters.cs:7:34:7:34 | b | 1 |
 | Parameters.cs:7:17:7:18 | M1 | Parameters.cs:7:44:7:44 | c | 2 |
@@ -16,6 +18,12 @@ noDefaultValue
 | Parameters.dll:0:0:0:0 | implicit conversion | Parameters.dll:0:0:0:0 | i | 0 |
 | Parameters.dll:0:0:0:0 | implicit conversion | Parameters.dll:0:0:0:0 | s | 0 |
 withDefaultValue
+| LambdaParameters.cs:9:18:9:44 | (...) => ... | LambdaParameters.cs:9:30:9:30 | y | 1 | LambdaParameters.cs:9:34:9:34 | 1 | 1 |
+| LambdaParameters.cs:10:18:10:43 | (...) => ... | LambdaParameters.cs:10:27:10:27 | o | 0 | LambdaParameters.cs:10:31:10:37 | default | null |
+| LambdaParameters.cs:11:18:11:59 | (...) => ... | LambdaParameters.cs:11:30:11:30 | y | 1 | LambdaParameters.cs:11:34:11:34 | 1 | 1 |
+| LambdaParameters.cs:11:18:11:59 | (...) => ... | LambdaParameters.cs:11:41:11:41 | z | 2 | LambdaParameters.cs:11:45:11:45 | 2 | 2 |
+| LambdaParameters.cs:12:18:12:66 | (...) => ... | LambdaParameters.cs:12:60:12:60 | x | 0 | LambdaParameters.cs:12:19:12:60 | 7 | 7 |
+| LambdaParameters.cs:13:18:13:68 | (...) => ... | LambdaParameters.cs:13:62:13:62 | x | 0 | LambdaParameters.cs:13:19:13:62 | object creation of type DateTime | - |
 | Parameters.cs:8:17:8:18 | M2 | Parameters.cs:8:34:8:34 | b | 1 | Parameters.cs:8:38:8:41 | null | null |
 | Parameters.cs:8:17:8:18 | M2 | Parameters.cs:8:51:8:51 | c | 2 | Parameters.cs:8:55:8:70 | "default string" | default string |
 | Parameters.cs:9:17:9:18 | M3 | Parameters.cs:9:24:9:24 | a | 0 | Parameters.cs:9:28:9:28 | 1 | 1 |
@@ -81,6 +89,7 @@ withDefaultValue
 | Parameters.dll:0:0:0:0 | M23 | Parameters.dll:0:0:0:0 | arg12 | 0 | Parameters.dll:0:0:0:0 | (...) ... | 0 |
 | Parameters.dll:0:0:0:0 | M24 | Parameters.dll:0:0:0:0 | arg13 | 0 | Parameters.dll:0:0:0:0 | (...) ... | 7 |
 dateTimeDefaults
+| LambdaParameters.cs:13:18:13:68 | (...) => ... | LambdaParameters.cs:13:62:13:62 | x | LambdaParameters.cs:13:19:13:62 | object creation of type DateTime | DateTime(long) | 14 |
 | Parameters.cs:22:17:22:19 | M14 | Parameters.cs:22:64:22:67 | arg4 | Parameters.cs:22:21:22:67 | object creation of type DateTime | DateTime(long) | 14 |
 | Parameters.cs:23:17:23:19 | M15 | Parameters.cs:23:68:23:71 | arg5 | Parameters.cs:23:21:23:71 | object creation of type DateTime | DateTime(long) | 10001 |
 | Parameters.dll:0:0:0:0 | M14 | Parameters.dll:0:0:0:0 | arg4 | Parameters.dll:0:0:0:0 | object creation of type DateTime | DateTime(long) | 14 |

csharp/ql/test/library-tests/typealias/alias.cs

@@ -0,0 +1,30 @@
+using System;
+
+using TupleType1 = (int, object);
+using TupleType2 = (int, string);
+using TupleType3 = (int, object);
+using Point = (int x, int y);
+
+public class TupleMethods
+{
+    public void M1(TupleType1 t)
+    {
+        var x = t.Item1;
+        var y = t.Item2;
+    }
+
+    public void M2(TupleType2 t)
+    {
+        var x = t.Item1;
+        var y = t.Item2;
+        M1(t);
+    }
+
+    public void M3(Point p)
+    {
+        var x = p.x;
+        var y = p.y;
+    }
+
+    public void M4(TupleType3 t) { }
+}

csharp/ql/test/library-tests/typealias/alias.expected

@@ -0,0 +1,4 @@
+| alias.cs:10:17:10:18 | M1 | alias.cs:10:31:10:31 | t | (Int32,Object) |
+| alias.cs:16:17:16:18 | M2 | alias.cs:16:31:16:31 | t | (Int32,String) |
+| alias.cs:23:17:23:18 | M3 | alias.cs:23:26:23:26 | p | (Int32,Int32) |
+| alias.cs:29:17:29:18 | M4 | alias.cs:29:31:29:31 | t | (Int32,Object) |

csharp/ql/test/library-tests/typealias/alias.ql

@@ -0,0 +1,8 @@
+import csharp
+
+from Method m, Parameter p, Type t
+where
+  m.fromSource() and
+  p = m.getAParameter() and
+  p.getType() = t
+select m, p, t.toString()

csharp/ql/test/utils/modelgenerator/dataflow/CaptureNeutralModels.ext.yml

@@ -0,0 +1,6 @@
+extensions:
+  - addsTo:
+      pack: codeql/csharp-all
+      extensible: neutralModel
+    data:
+      - [ "NoSummaries", "ManuallyModelled", "HasNeutralSummaryNoFlow", "(System.Object)", "summary", "manual"]

csharp/ql/test/utils/modelgenerator/dataflow/CaptureSummaryModels.ext.yml

@@ -0,0 +1,12 @@
+extensions:
+  - addsTo:
+      pack: codeql/csharp-all
+      extensible: summaryModel
+    data:
+      - [ "NoSummaries", "ManuallyModelled", False, "HasSummary", "(System.Object)", "", "Argument[0]", "ReturnValue", "value", "manual"]
+
+  - addsTo:
+      pack: codeql/csharp-all
+      extensible: neutralModel
+    data:
+      - [ "NoSummaries", "ManuallyModelled", "HasNeutralSummary", "(System.Object)", "summary", "manual"]

csharp/ql/test/utils/modelgenerator/dataflow/NoSummaries.cs

@@ -143,3 +143,22 @@ public class ParameterlessConstructor
         IsInitialized = true;
     }
 }
+
+// No models should be created, if there exist either a manual summary or neutral summary.
+public class ManuallyModelled
+{
+    public object HasSummary(object o)
+    {
+        return o;
+    }
+
+    public object HasNeutralSummary(object o)
+    {
+        return o;
+    }
+
+    public object HasNeutralSummaryNoFlow(object o)
+    {
+        return null;
+    }
+}

csharp/ql/test/utils/modelgenerator/typebasedflow/CaptureTypeBasedSummaryModels.expected

@@ -124,7 +124,6 @@
 | Summaries;TypeBasedCollection<T>;false;Add;(T);;Argument[0];Argument[this].Element;value;tb-generated |
 | Summaries;TypeBasedCollection<T>;false;AddMany;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;Argument[this].Element;value;tb-generated |
 | Summaries;TypeBasedCollection<T>;false;First;();;Argument[this].Element;ReturnValue;value;tb-generated |
-| Summaries;TypeBasedCollection<T>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.SyntheticField[ArgType0];value;tb-generated |
 | Summaries;TypeBasedCollection<T>;false;GetMany;();;Argument[this].Element;ReturnValue.Element;value;tb-generated |
 | Summaries;TypeBasedComplex<T>;false;AddMany;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;Argument[this].SyntheticField[ArgType0];value;tb-generated |
 | Summaries;TypeBasedComplex<T>;false;Apply;(System.Func<T,System.Int32>);;Argument[this].SyntheticField[ArgType0];Argument[0].Parameter[0];value;tb-generated |

docs/codeql/codeql-for-visual-studio-code/about-telemetry-in-codeql-for-visual-studio-code.rst

@@ -30,6 +30,7 @@ If you opt in, GitHub collects the following information related to the usage of
 - Randomly generated GUID that uniquely identifies a CodeQL extension installation. (Discarded before aggregation.)
 - IP address of the client sending the telemetry data. (Discarded before aggregation.)
 - Whether or not the ``codeQL.canary`` setting is enabled and set to ``true``.
+- Whether any :doc:`CodeQL extension settings <customizing-settings>` are configured.
 
 How long data is retained
 --------------------------

docs/codeql/ql-language-reference/aliases.rst

@@ -123,4 +123,20 @@ You could give the predicate a more descriptive name as follows:
 
 .. code-block:: ql
 
-    predicate lessThanTen = isSmall/1;
+    predicate lessThanTen = isSmall/1;
+
+.. _weak_strong_aliases:
+
+Strong and weak aliases
+=======================
+
+Every alias definition is either **strong** or **weak**.
+An alias definition is **strong** if and only if it is a :ref:`type alias <type-aliases>` definition with
+:ref:`annotation <annotations>` ``final``.
+During :ref:`name resolution <name-resolution>`, ambiguity between aliases from **weak** alias definitions
+for the same module/type/predicate is allowed, but ambiguity between between aliases from distinct **strong**
+alias definitions is invalid QL.
+Likewise, for the purpose of applicative instantiation of :ref:`parameterised modules <parameterized-modules>`
+and `:ref:`parameterised module signatures <parameterized-module-signatures>`, aliases from **weak** alias
+definitions for instantiation arguments do not result in separate instantiations, but aliases from **strong**
+alias definitions for instantiation arguments do.

docs/codeql/ql-language-reference/modules.rst

@@ -180,7 +180,8 @@ For example, in the previous two snippets, we relied on the predicate signature
     signature int transformer(int x);
 
 The instantiation of parameterized modules is applicative.
-That is, if you instantiate a parameterized module twice with identical arguments, the resulting object is the same.
+That is, if you instantiate a parameterized module twice with equivalent arguments, the resulting object is the same.
+Arguments are considered equivalent in this context if they differ only by :ref:`weak aliasing <weak_strong_aliases>`.
 This is particularly relevant for type definitions inside parameterized modules as :ref:`classes <classes>`
 or via :ref:`newtype <algebraic-datatypes>`, because the duplication of such type definitions would result in
 incompatible types.

docs/codeql/ql-language-reference/ql-language-specification.rst

@@ -115,7 +115,7 @@ Environments may be combined as follows:
 -  *Union*. This takes the union of the entry sets of the two environments.
 -  *Overriding union*. This takes the union of two environments, but if there are entries for a key in the first map, then no additional entries for that key are included from the second map.
 
-A *definite* environment has at most one entry for each key. Resolution is unique in a definite environment.
+A *definite* environment has only values that are *equal modulo weak aliasing* for each key.
 
 Global environments
 ~~~~~~~~~~~~~~~~~~~
@@ -334,7 +334,7 @@ For a *completely uninstantiated* parameter, the *bottom-up instantiation-resolu
 
 An entity is called *fully instantiated* if none of the *bottom-up instantiation-resolutions* of the parameters in the *relevant set of parameters* of the entity's *underlying completely uninstantiated* entity are parameters.
 
-Two *instantiated modules* or two *instantiation-nested* entities are considered *equivalent* if they have the same *underlying completely uninstantiated* entity and each parameter in its *relevant set of parameters* has the same *bottom-up instantiation-resolution* relative to either *instantiated module*.
+Two *instantiated modules* or two *instantiation-nested* entities are considered *equivalent* if they have the same *underlying completely uninstantiated* entity and each parameter in its *relevant set of parameters* has *bottom-up instantiation-resolution*s relative both *instantiated module*s that are *equivalent modulo weak aliases*.
 
 Module instantiation is applicative, meaning that *equivalent* *instantiated modules* and *equivalent* *instantiation-nested* entities are indistinguishable.
 
@@ -1763,7 +1763,7 @@ The grammar given in this section is disambiguated first by precedence, and seco
 Aliases
 -------
 
-Aliases define new names for existing QL entities.
+Aliases define new names for existing QL bindings.
 
 ::
 
@@ -1772,7 +1772,19 @@ Aliases define new names for existing QL entities.
          |   qldoc? annotations "module" modulename "=" moduleExpr ";"
 
 
-An alias introduces a binding from the new name to the entity referred to by the right-hand side in the current module's declared predicate, type, or module environment respectively.
+An alias introduces a binding from the new name to the binding referred to by the right-hand side in the current module's visible predicate, type, or module environment respectively.
+
+An alias is called a *strong alias* if and only if it has the ``final`` annotation. Otherwise, it is called a *weak alias*.
+
+Two bindings `A`, `B` are called *equal modulo weak aliasing* if and only if one of the following conditions are satisfied:
+
+- `A` and `B` are the same binding or
+
+- `A`` is introduced by a *weak alias* for `C`, where `B` and `C` are *equal modulo weak aliasing* (or vice versa) or
+
+- `A` and `B` are introduced by the same strong alias and they are aliases for bindings that are *equal modulo weak aliasing*.
+
+Note that the third condition is only relevant in :ref:`Parameterized modules`, where the binding introduced by the alias can depend on instantiation parameters.
 
 Built-ins
 ---------

docs/codeql/writing-codeql-queries/metadata-for-codeql-queries.rst

@@ -8,8 +8,8 @@ Metadata tells users important information about CodeQL queries. You must includ
 About query metadata
 --------------------
 
-Any query that is run as part of an analysis includes a number of properties, known as query metadata. Metadata is included at the top of each query file as the content of a QLDoc comment. 
-This metadata tells the CodeQL :ref:`extension for VS Code <codeql-for-visual-studio-code>` and the `Code scanning feature in GitHub <https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-with-codeql>`__ how to handle the query and display its results correctly. 
+Any query that is run as part of an analysis includes a number of properties, known as query metadata. Metadata is included at the top of each query file as the content of a QLDoc comment.
+This metadata tells the CodeQL :ref:`extension for VS Code <codeql-for-visual-studio-code>` and the `Code scanning feature in GitHub <https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-with-codeql>`__ how to handle the query and display its results correctly.
 It also gives other users information about what the query results mean. For more information on query metadata, see the `query metadata style guide <https://github.com/github/codeql/blob/main/docs/query-metadata-style-guide.md>`__ in our `open source repository <https://github.com/github/codeql>`__ on GitHub.
 
 .. pull-quote::
@@ -17,7 +17,7 @@ It also gives other users information about what the query results mean. For mor
     Note
 
     The exact metadata requirement depends on how you are going to run your query. For more information, see the section on query metadata in ":doc:`About CodeQL queries <about-codeql-queries>`."
-    
+
 Metadata properties
 -------------------
 
@@ -49,7 +49,7 @@ The following properties are supported by all query files:
 |                       | | ``warning``             |                                                                                                                                                                                                                                                                                                                                                                       |
 |                       | | ``recommendation``      |                                                                                                                                                                                                                                                                                                                                                                       |
 +-----------------------+---------------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
-| ``@security-severity``| ``<score>``               | Defines the level of severity, between 0.0 and 10.0, for queries with ``@tags security``. For more information about calculating ``@security-severity``, see the `GitHub changelog <https://gh.io/2021-07-19-codeql-security-severity>`__.                                                                                                                            |
+| ``@security-severity``| ``<score>``               | Defines the level of severity, between 0.0 and 10.0, for queries with ``@tags security``. For more information, see the `GitHub user documentation <https://docs.github.com/code-security/code-scanning/managing-code-scanning-alerts/about-code-scanning-alerts#about-alert-severity-and-security-severity-levels>`__.                                               |
 +-----------------------+---------------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
 
 Example

docs/ql-libraries/dataflow/dataflow.md

@@ -588,18 +588,17 @@ However, joining the virtual dispatch relation with itself in this way is
 usually way too big to be feasible. Instead, the relation above should only be
 defined for those values of `call` for which the set of resulting dispatch
 targets might be reduced. To do this, define the set of `call`s that might for
-some reason benefit from a call context as the following predicate (the `c`
-column should be `call.getEnclosingCallable()`):
+some reason benefit from a call context as the following predicate:
 ```ql
-predicate mayBenefitFromCallContext(DataFlowCall call, DataFlowCallable c)
+predicate mayBenefitFromCallContext(DataFlowCall call)
 ```
 And then define `DataFlowCallable viableImplInCallContext(DataFlowCall call,
 DataFlowCall ctx)` as sketched above, but restricted to
-`mayBenefitFromCallContext(call, _)`.
+`mayBenefitFromCallContext(call)`.
 
 The shared implementation will then compare counts of virtual dispatch targets
 using `viableCallable` and `viableImplInCallContext` for each `call` in
-`mayBenefitFromCallContext(call, _)` and track call contexts during flow
+`mayBenefitFromCallContext(call)` and track call contexts during flow
 calculation when differences in these counts show an improved precision in
 further calls.
 

docs/query-metadata-style-guide.md

@@ -113,11 +113,11 @@ Alert queries (`@kind problem` or `path-problem`) support two further properties
   * `medium`
   * `high`
   * `very-high`
-* `@problem.severity`–defines the level of severity of non-security alerts: 
+* `@problem.severity`–defines the likelihood that an alert, either security-related or not, causes an actual problem such as incorrect program behavior: 
   * `error`–an issue that is likely to cause incorrect program behavior, for example a crash or vulnerability.
   * `warning`–an issue that indicates a potential problem in the code, or makes the code fragile if another (unrelated) part of code is changed.
   * `recommendation`–an issue where the code behaves correctly, but it could be improved.
-* `@security-severity`-defines the level of severity, between 0.0 and 10.0, for queries with `@tags security`. For more information about calculating `@security-severity`, see the [GitHub changelog](https://github.blog/changelog/2021-07-19-codeql-code-scanning-new-severity-levels-for-security-alerts/).  
+* `@security-severity`-defines the level of severity, between 0.0 and 10.0, for queries with `@tags security`. For more information about how this value is calculated and then used in code scanning analysis, see [About alert severity and security severity levels](https://docs.github.com/code-security/code-scanning/managing-code-scanning-alerts/about-code-scanning-alerts#about-alert-severity-and-security-severity-levels) in the GitHub user documentation.
 
 ## Query tags `@tags`
 
@@ -155,7 +155,10 @@ If your query is a security query, use one or more `@tags` to associate it with
 ||`external/cwe/cwe-036` |
 ||`external/cwe/cwe-073` |
 
-When you tag a query like this, the associated CWE pages from [MITRE.org](https://cwe.mitre.org/index.html) will automatically appear in the reference section of its associated qhelp file.
+When you tag a query like this, the associated CWE pages from [MITRE.org](https://cwe.mitre.org/index.html) will automatically appear in the references section of its associated qhelp file.
+
+> [!NOTE]
+> The automatic addition of CWE reference links works only if the qhelp file already contains a `<references>` section.
 
 #### Metric/summary `@tags`
 
@@ -175,14 +178,14 @@ The select clause of each alert query defines the alert message that is displaye
 * Program element references should be in 'single quotes' to distinguish them from ordinary words. Quotes are not needed around substitutions (`$@`).
 * Avoid constant alert message strings and include some context, if possible. For example, `The class 'Foo' is duplicated as 'Bar'.` is preferable to `This class is duplicated here.`
 * If a reference to the current location can't be avoided use "this location" instead of "here". For example, `Bad thing at this location.` is preferable to `Bad thing here.`. This avoids the "click here" anti-pattern.
-* For path queries, if possible, try to follow the template: `This path depends on a [user-provided value].`, or alternatively (if the first option doesn't work) `[User-provided value] flows to this location and is used in a path.`. 
+* For path queries, if possible, try to follow the template: `This path depends on a [user-provided value].`, or alternatively (if the first option doesn't work) `[User-provided value] flows to this location and is used in a path.`.
 * Taint tracking queries generally have a sink that "depends on" the source, and dataflow queries generally have a source that "flows to" the sink.
 
 ### Links in alert messages
 
 * Where you reference another program element, link to it if possible using a substitution (`$@`). Links should be used inline in the sentence, rather than as parenthesised lists or appositions.
-* Avoid using link texts that don't describe what they link to. For example, rewrite `This sensitive data is written to a logfile unescaped [here]` to `This sensitive data is [written to a logfile unescaped]`. 
-* Make link text as concise and precise as possible. For example, avoid starting a link text with an indefinite article (a, an). `Path construction depends on a [user-provided value]` is preferable to `Path construction depends on [a user-provided value]`. (Where the square brackets indicate a link.) See [the W3C guide on link texts](https://www.w3.org/WAI/WCAG22/Understanding/link-purpose-in-context.html) for further information. 
+* Avoid using link texts that don't describe what they link to. For example, rewrite `This sensitive data is written to a logfile unescaped [here]` to `This sensitive data is [written to a logfile unescaped]`.
+* Make link text as concise and precise as possible. For example, avoid starting a link text with an indefinite article (a, an). `Path construction depends on a [user-provided value]` is preferable to `Path construction depends on [a user-provided value]`. (Where the square brackets indicate a link.) See [the W3C guide on link texts](https://www.w3.org/WAI/WCAG22/Understanding/link-purpose-in-context.html) for further information.
 * When a message contains multiple links, construct a sentence that has the most variable link (that is, the link with most targets) last. For further information, see [Defining the results of a query](https://codeql.github.com/docs/writing-codeql-queries/defining-the-results-of-a-query/).
 
 For examples of select clauses and alert messages, see the query source files at the following pages:
@@ -203,5 +206,3 @@ The `select` clause of a summary metric query must have one of the following res
   - This indicates a metric without a specific location in the codebase, for example the total lines of code in a codebase.
 - A code `entity` followed by a `number`
   - This indicates a metric with a specific location in the codebase, for example the lines of code within a file. The `entity` here must have a valid location in the source code.
-
-

go/documentation/library-coverage/coverage.csv

@@ -34,7 +34,7 @@ encoding/pem,,3,,3,
 encoding/xml,,23,,23,
 errors,,3,,3,
 expvar,,6,,6,
-fmt,,5,,5,
+fmt,,16,,16,
 github.com/astaxie/beego,,7,,7,
 github.com/astaxie/beego/context,,1,,1,
 github.com/astaxie/beego/utils,,13,,13,
@@ -53,6 +53,7 @@ github.com/labstack/echo,,2,,2,
 github.com/revel/revel,,10,,10,
 github.com/robfig/revel,,10,,10,
 github.com/sendgrid/sendgrid-go/$ANYVERSION/helpers/mail,,1,,1,
+github.com/valyala/fasthttp,,5,,5,
 go.uber.org/zap,,11,,11,
 golang.org/x/net/$ANYVERSION/html,,16,,16,
 golang.org/x/net/context,,5,,5,

go/documentation/library-coverage/coverage.rst

@@ -15,8 +15,9 @@ Go framework & library support
    `Macaron <https://gopkg.in/macaron.v1>`_,``gopkg.in/macaron*``,,1,
    `Revel <http://revel.github.io/>`_,"``github.com/revel/revel*``, ``github.com/robfig/revel*``",,20,
    `SendGrid <https://github.com/sendgrid/sendgrid-go>`_,``github.com/sendgrid/sendgrid-go*``,,1,
-   `Standard library <https://pkg.go.dev/std>`_,"````, ``archive/*``, ``bufio``, ``bytes``, ``cmp``, ``compress/*``, ``container/*``, ``context``, ``crypto``, ``crypto/*``, ``database/*``, ``debug/*``, ``embed``, ``encoding``, ``encoding/*``, ``errors``, ``expvar``, ``flag``, ``fmt``, ``go/*``, ``hash``, ``hash/*``, ``html``, ``html/*``, ``image``, ``image/*``, ``index/*``, ``io``, ``io/*``, ``log``, ``log/*``, ``maps``, ``math``, ``math/*``, ``mime``, ``mime/*``, ``net``, ``net/*``, ``os``, ``os/*``, ``path``, ``path/*``, ``plugin``, ``reflect``, ``reflect/*``, ``regexp``, ``regexp/*``, ``slices``, ``sort``, ``strconv``, ``strings``, ``sync``, ``sync/*``, ``syscall``, ``syscall/*``, ``testing``, ``testing/*``, ``text/*``, ``time``, ``time/*``, ``unicode``, ``unicode/*``, ``unsafe``",8,566,
+   `Standard library <https://pkg.go.dev/std>`_,"````, ``archive/*``, ``bufio``, ``bytes``, ``cmp``, ``compress/*``, ``container/*``, ``context``, ``crypto``, ``crypto/*``, ``database/*``, ``debug/*``, ``embed``, ``encoding``, ``encoding/*``, ``errors``, ``expvar``, ``flag``, ``fmt``, ``go/*``, ``hash``, ``hash/*``, ``html``, ``html/*``, ``image``, ``image/*``, ``index/*``, ``io``, ``io/*``, ``log``, ``log/*``, ``maps``, ``math``, ``math/*``, ``mime``, ``mime/*``, ``net``, ``net/*``, ``os``, ``os/*``, ``path``, ``path/*``, ``plugin``, ``reflect``, ``reflect/*``, ``regexp``, ``regexp/*``, ``slices``, ``sort``, ``strconv``, ``strings``, ``sync``, ``sync/*``, ``syscall``, ``syscall/*``, ``testing``, ``testing/*``, ``text/*``, ``time``, ``time/*``, ``unicode``, ``unicode/*``, ``unsafe``",8,577,
    `beego <https://beego.me/>`_,"``github.com/astaxie/beego*``, ``github.com/beego/beego*``",,42,
+   `fasthttp <https://github.com/valyala/fasthttp>`_,``github.com/valyala/fasthttp*``,,5,
    `go-pg <https://pg.uptrace.dev/>`_,``github.com/go-pg/pg*``,,6,
    `golang.org/x/net <https://pkg.go.dev/golang.org/x/net>`_,``golang.org/x/net*``,,21,
    `goproxy <https://github.com/elazarl/goproxy>`_,``github.com/elazarl/goproxy*``,,2,
@@ -25,5 +26,5 @@ Go framework & library support
    `protobuf <https://pkg.go.dev/google.golang.org/protobuf>`_,"``github.com/golang/protobuf*``, ``google.golang.org/protobuf*``",,16,
    `yaml <https://gopkg.in/yaml.v3>`_,``gopkg.in/yaml*``,,9,
    `zap <https://go.uber.org/zap>`_,``go.uber.org/zap*``,,11,
-   Totals,,8,826,
+   Totals,,8,842,
 

go/documentation/library-coverage/frameworks.csv

@@ -4,6 +4,7 @@ beego,https://beego.me/,github.com/astaxie/beego* github.com/beego/beego*
 Couchbase official client(gocb),https://github.com/couchbase/gocb,github.com/couchbase/gocb* gopkg.in/couchbase/gocb*
 Couchbase unofficial client,http://www.github.com/couchbase/go-couchbase,github.com/couchbaselabs/gocb*
 Echo,https://echo.labstack.com/,github.com/labstack/echo*
+fasthttp,https://github.com/valyala/fasthttp,github.com/valyala/fasthttp*
 Gin,https://github.com/gin-gonic/gin,github.com/gin-gonic/gin*
 go-pg,https://pg.uptrace.dev/,github.com/go-pg/pg*
 golang.org/x/net,https://pkg.go.dev/golang.org/x/net,golang.org/x/net*

go/extractor/cli/go-autobuilder/go-autobuilder.go

@@ -96,7 +96,15 @@ func getEnvGoSemVer() string {
 	if !strings.HasPrefix(goVersion, "go") {
 		log.Fatalf("Expected 'go version' output of the form 'go1.2.3'; got '%s'", goVersion)
 	}
-	return "v" + goVersion[2:]
+	// Go versions don't follow the SemVer format, but the only exception we normally care about
+	// is release candidates; so this is a horrible hack to convert e.g. `go1.22rc1` into `go1.22-rc1`
+	// which is compatible with the SemVer specification
+	rcIndex := strings.Index(goVersion, "rc")
+	if rcIndex != -1 {
+		return semver.Canonical("v"+goVersion[2:rcIndex]) + "-" + goVersion[rcIndex:]
+	} else {
+		return semver.Canonical("v" + goVersion[2:])
+	}
 }
 
 // Returns the import path of the package being built, or "" if it cannot be determined.

go/extractor/go.mod

@@ -4,5 +4,5 @@ go 1.21
 
 require (
 	golang.org/x/mod v0.14.0
-	golang.org/x/tools v0.16.1
+	golang.org/x/tools v0.17.0
 )