Bump actions/cache from 3 to 4

Bumps [actions/cache](https://github.com/actions/cache) from 3 to 4.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/v3...v4)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/workflows/mad_modelDiff.yml

@@ -12,6 +12,7 @@ on:
       - main
     paths:
       - "java/ql/src/utils/modelgenerator/**/*.*"
+      - "misc/scripts/models-as-data/*.*"
       - ".github/workflows/mad_modelDiff.yml"
 
 permissions:
@@ -61,8 +62,9 @@ jobs:
             DATABASE=$2
             cd codeql-$QL_VARIANT
             SHORTNAME=`basename $DATABASE`
-            python java/ql/src/utils/modelgenerator/GenerateFlowModel.py --with-summaries --with-sinks $DATABASE ${SHORTNAME}.temp.model.yml
-            mv java/ql/lib/ext/generated/${SHORTNAME}.temp.model.yml $MODELS/${SHORTNAME}Generated_${QL_VARIANT}.model.yml
+            python java/ql/src/utils/modelgenerator/GenerateFlowModel.py --with-summaries --with-sinks $DATABASE $SHORTNAME/$QL_VARIANT
+            mkdir -p $MODELS/$SHORTNAME
+            mv java/ql/lib/ext/generated/$SHORTNAME/$QL_VARIANT $MODELS/$SHORTNAME
             cd ..
           }
 
@@ -85,16 +87,16 @@ jobs:
           set -x
           MODELS=`pwd`/tmp-models
           ls -1 tmp-models/
-          for m in $MODELS/*_main.model.yml ; do
+          for m in $MODELS/*/main/*.model.yml ; do
             t="${m/main/"pr"}"
             basename=`basename $m`
-            name="diff_${basename/_main.model.yml/""}"
+            name="diff_${basename/.model.yml/""}"
             (diff -w -u $m $t | diff2html -i stdin -F $MODELS/$name.html) || true
           done
       - uses: actions/upload-artifact@v3
         with:
           name: models
-          path: tmp-models/*.model.yml
+          path: tmp-models/**/**/*.model.yml
           retention-days: 20
       - uses: actions/upload-artifact@v3
         with:

.github/workflows/ql-for-ql-build.yml

@@ -27,7 +27,7 @@ jobs:
       ### Build the extractor ###
       - name: Cache entire extractor
         id: cache-extractor
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: |
             ql/extractor-pack/
@@ -35,7 +35,7 @@ jobs:
           key: ${{ runner.os }}-${{ steps.os_version.outputs.version }}-extractor-${{ hashFiles('ql/**/Cargo.lock') }}-${{ hashFiles('shared/tree-sitter-extractor') }}-${{ hashFiles('ql/**/*.rs') }}
       - name: Cache cargo
         if: steps.cache-extractor.outputs.cache-hit != 'true'
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: |
             ~/.cargo/registry

.github/workflows/ql-for-ql-dataset_measure.yml

@@ -30,7 +30,7 @@ jobs:
           languages: javascript # does not matter
       - uses: ./.github/actions/os-version
         id: os_version
-      - uses: actions/cache@v3
+      - uses: actions/cache@v4
         with:
           path: |
             ~/.cargo/registry

.github/workflows/ql-for-ql-tests.yml

@@ -29,7 +29,7 @@ jobs:
           languages: javascript # does not matter
       - uses: ./.github/actions/os-version
         id: os_version
-      - uses: actions/cache@v3
+      - uses: actions/cache@v4
         with:
           path: |
             ~/.cargo/registry
@@ -74,7 +74,7 @@ jobs:
           languages: javascript # does not matter
       - uses: ./.github/actions/os-version
         id: os_version
-      - uses: actions/cache@v3
+      - uses: actions/cache@v4
         with:
           path: |
             ~/.cargo/registry

.github/workflows/ruby-build.yml

@@ -54,7 +54,7 @@ jobs:
       - uses: ./.github/actions/os-version
         id: os_version
       - name: Cache entire extractor
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         id: cache-extractor
         with:
           path: |
@@ -62,7 +62,7 @@ jobs:
             ruby/extractor/target/release/codeql-extractor-ruby.exe
             ruby/extractor/ql/lib/codeql/ruby/ast/internal/TreeSitter.qll
           key: ${{ runner.os }}-${{ steps.os_version.outputs.version }}-ruby-extractor-${{ hashFiles('ruby/extractor/rust-toolchain.toml', 'ruby/extractor/Cargo.lock') }}-${{ hashFiles('shared/tree-sitter-extractor') }}-${{ hashFiles('ruby/extractor/**/*.rs') }}
-      - uses: actions/cache@v3
+      - uses: actions/cache@v4
         if: steps.cache-extractor.outputs.cache-hit != 'true'
         with:
           path: |

cpp/downgrades/cf72c8898d19eb1b3374432cf79d8276cb07ad43/upgrade.properties

@@ -1,5 +1,6 @@
 description: Support C++17 if and switch initializers
 compatibility: partial
+constexpr_if_initialization.rel: delete
 if_initialization.rel: delete
 switch_initialization.rel: delete
 exprparents.rel: run exprparents.qlo

cpp/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/cpp-all
-version: 0.12.3
+version: 0.12.4-dev
 groups: cpp
 dbscheme: semmlecode.cpp.dbscheme
 extractor: cpp

cpp/ql/lib/semmle/code/cpp/commons/StringConcatenation.qll

@@ -0,0 +1,101 @@
+/**
+ * A library for detecting general string concatenations.
+ */
+
+import cpp
+import semmle.code.cpp.models.implementations.Strcat
+import semmle.code.cpp.models.interfaces.FormattingFunction
+private import semmle.code.cpp.dataflow.new.DataFlow
+
+/**
+ * A call that performs a string concatenation. A string can be either a C
+ * string (i.e., a value of type `char*`), or a C++ string (i.e., a value of
+ * type `std::string`).
+ */
+class StringConcatenation extends Call {
+  StringConcatenation() {
+    // sprintf-like functions, i.e., concat through formatting
+    this instanceof FormattingFunctionCall
+    or
+    this.getTarget() instanceof StrcatFunction
+    or
+    this.getTarget() instanceof StrlcatFunction
+    or
+    // operator+ and ostream (<<) concat
+    exists(Call call, Operator op |
+      call.getTarget() = op and
+      op.hasQualifiedName(["std", "bsl"], ["operator+", "operator<<"]) and
+      op.getType()
+          .stripType()
+          .(UserType)
+          .hasQualifiedName(["std", "bsl"], ["basic_string", "basic_ostream"]) and
+      this = call
+    )
+  }
+
+  /**
+   * Gets an operand of this concatenation (one of the string operands being
+   * concatenated).
+   * Will not return out param for sprintf-like functions, but will consider the format string
+   * to be part of the operands.
+   */
+  Expr getAnOperand() {
+    // The result is an argument of 'this' (a call)
+    result = this.getAnArgument() and
+    // addresses odd behavior with overloaded operators
+    // i.e., "call to operator+" appearing as an operand
+    // occurs in cases like `string s = s1 + s2 + s3`, which is represented as
+    // `string s = (s1.operator+(s2)).operator+(s3);`
+    // By limiting to non-calls we get the leaf operands (the variables or raw strings)
+    // also, by not enumerating allowed types (variables and strings) we avoid issues
+    // with missed corner cases or extensions/changes to CodeQL in the future which might
+    // invalidate that approach.
+    not result instanceof Call and
+    // Limit the result type to string
+    (
+      result.getUnderlyingType().stripType().getName() = "char"
+      or
+      result
+          .getType()
+          .getUnspecifiedType()
+          .(UserType)
+          .hasQualifiedName(["std", "bsl"], "basic_string")
+    ) and
+    // when 'this' is a `FormattingFunctionCall` the result must be the format string argument
+    // or one of the formatting arguments
+    (
+      this instanceof FormattingFunctionCall
+      implies
+      (
+        result = this.(FormattingFunctionCall).getFormat()
+        or
+        exists(int n |
+          result = this.getArgument(n) and
+          n >= this.(FormattingFunctionCall).getTarget().getFirstFormatArgumentIndex()
+        )
+      )
+    )
+  }
+
+  /**
+   * Gets the data flow node representing the concatenation result.
+   */
+  DataFlow::Node getResultNode() {
+    if this.getTarget() instanceof StrcatFunction
+    then
+      result.asDefiningArgument() =
+        this.getArgument(this.getTarget().(StrcatFunction).getParamDest())
+      or
+      // Hardcoding it is also the return
+      result.asExpr() = this.(Call)
+    else
+      if this.getTarget() instanceof StrlcatFunction
+      then (
+        result.asDefiningArgument() =
+          this.getArgument(this.getTarget().(StrlcatFunction).getParamDest())
+      ) else
+        if this instanceof FormattingFunctionCall
+        then result.asDefiningArgument() = this.(FormattingFunctionCall).getOutputArgument(_)
+        else result.asExpr() = this.(Call)
+  }
+}

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowDispatch.qll

@@ -54,18 +54,6 @@ private predicate functionSignature(Function f, string qualifiedName, int nparam
   not f.isStatic()
 }
 
-/**
- * Holds if the set of viable implementations that can be called by `call`
- * might be improved by knowing the call context.
- */
-predicate mayBenefitFromCallContext(DataFlowCall call, Function f) { none() }
-
-/**
- * Gets a viable dispatch target of `call` in the context `ctx`. This is
- * restricted to those `call`s for which a context might make a difference.
- */
-Function viableImplInCallContext(DataFlowCall call, DataFlowCall ctx) { none() }
-
 /** A parameter position represented by an integer. */
 class ParameterPosition extends int {
   ParameterPosition() { any(ParameterNode p).isParameterOf(_, this) }

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowDispatch.qll

@@ -249,9 +249,7 @@ private predicate functionSignature(Function f, string qualifiedName, int nparam
  * Holds if the set of viable implementations that can be called by `call`
  * might be improved by knowing the call context.
  */
-predicate mayBenefitFromCallContext(DataFlowCall call, DataFlowCallable f) {
-  mayBenefitFromCallContext(call, f, _)
-}
+predicate mayBenefitFromCallContext(DataFlowCall call) { mayBenefitFromCallContext(call, _, _) }
 
 /**
  * Holds if `call` is a call through a function pointer, and the pointer

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplSpecific.qll

@@ -22,4 +22,8 @@ module CppDataFlow implements InputSig {
   predicate getAdditionalFlowIntoCallNodeTerm = Private::getAdditionalFlowIntoCallNodeTerm/2;
 
   predicate validParameterAliasStep = Private::validParameterAliasStep/2;
+
+  predicate mayBenefitFromCallContext = Private::mayBenefitFromCallContext/1;
+
+  predicate viableImplInCallContext = Private::viableImplInCallContext/2;
 }

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternals.qll

@@ -149,11 +149,16 @@ private newtype TDefOrUseImpl =
 private predicate isGlobalUse(
   GlobalLikeVariable v, IRFunction f, int indirection, int indirectionIndex
 ) {
-  exists(VariableAddressInstruction vai |
-    vai.getEnclosingIRFunction() = f and
-    vai.getAstVariable() = v and
-    isDef(_, _, _, vai, indirection, indirectionIndex)
-  )
+  // Generate a "global use" at the end of the function body if there's a
+  // direct definition somewhere in the body of the function
+  indirection =
+    min(int cand, VariableAddressInstruction vai |
+      vai.getEnclosingIRFunction() = f and
+      vai.getAstVariable() = v and
+      isDef(_, _, _, vai, cand, indirectionIndex)
+    |
+      cand
+    )
 }
 
 private predicate isGlobalDefImpl(
@@ -447,6 +452,57 @@ class FinalParameterUse extends UseImpl, TFinalParameterUse {
   }
 }
 
+/**
+ * A use that models a synthetic "last use" of a global variable just before a
+ * function returns.
+ *
+ * We model global variable flow by:
+ * - Inserting a last use of any global variable that's modified by a function
+ * - Flowing from the last use to the `VariableNode` that represents the global
+ *   variable.
+ * - Flowing from the `VariableNode` to an "initial def" of the global variable
+ * in any function that may read the global variable.
+ * - Flowing from the initial definition to any subsequent uses of the global
+ *   variable in the function body.
+ *
+ * For example, consider the following pair of functions:
+ * ```cpp
+ * int global;
+ * int source();
+ * void sink(int);
+ *
+ * void set_global() {
+ *   global = source();
+ * }
+ *
+ * void read_global() {
+ *  sink(global);
+ * }
+ * ```
+ * we insert global uses and defs so that (from the point-of-view of dataflow)
+ * the above scenario looks like:
+ * ```cpp
+ * int global; // (1)
+ * int source();
+ * void sink(int);
+ *
+ * void set_global() {
+ *   global = source();
+ *   __global_use(global); // (2)
+ * }
+ *
+ * void read_global() {
+ *  global = __global_def; // (3)
+ *  sink(global); // (4)
+ * }
+ * ```
+ * and flow from `source()` to the argument of `sink` is then modeled as
+ * follows:
+ * 1. Flow from `source()` to `(2)` (via SSA).
+ * 2. Flow from `(2)` to `(1)` (via a `jumpStep`).
+ * 3. Flow from `(1)` to `(3)` (via a `jumpStep`).
+ * 4. Flow from `(3)` to `(4)` (via SSA).
+ */
 class GlobalUse extends UseImpl, TGlobalUse {
   GlobalLikeVariable global;
   IRFunction f;
@@ -494,6 +550,12 @@ class GlobalUse extends UseImpl, TGlobalUse {
   override BaseSourceVariableInstruction getBase() { none() }
 }
 
+/**
+ * A definition that models a synthetic "initial definition" of a global
+ * variable just after the function entry point.
+ *
+ * See the QLDoc for `GlobalUse` for how this is used.
+ */
 class GlobalDefImpl extends DefOrUseImpl, TGlobalDefImpl {
   GlobalLikeVariable global;
   IRFunction f;

cpp/ql/lib/semmle/code/cpp/rangeanalysis/RangeAnalysisUtils.qll

@@ -355,13 +355,13 @@ private predicate linearAccessImpl(Expr expr, VariableAccess v, float p, float q
  * `cmpWithLinearBound(guard, v, Greater(), true)` and
  * `cmpWithLinearBound(guard, v, Lesser(),  false)` hold.
  * If `guard` is `4 - v > 5` then
- * `cmpWithLinearBound(guard, v, Lesser(),  false)` and
- * `cmpWithLinearBound(guard, v, Greater(), true)` hold.
+ * `cmpWithLinearBound(guard, v, Lesser(),  true)` and
+ * `cmpWithLinearBound(guard, v, Greater(), false)` hold.
  *
- * A more sophisticated predicate, such as `boundFromGuard`, is needed
- * to compute an actual bound for `v`. This predicate can be used if
- * you just want to check whether a variable is bounded, or to restrict
- * a more expensive analysis to just guards that bound a variable.
+ * If an actual bound for `v` is needed, use `upperBound` or `lowerBound`.
+ * This predicate can be used if you just want to check whether a variable
+ * is bounded, or to restrict a more expensive analysis to just guards that
+ * bound a variable.
  */
 predicate cmpWithLinearBound(
   ComparisonOperation guard, VariableAccess v,

cpp/ql/lib/upgrades/098850d25c4e9d417eb74c1bef9deb2f9d2dc417/upgrade.properties

@@ -1,3 +1,6 @@
 description: Remove the old CFG tables
 compatibility: full
 
+falsecond.rel: delete
+successors.rel: delete
+truecond.rel: delete

cpp/ql/src/change-notes/2024-01-09-add-exception-to-av-rule-32.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The `cpp/include-non-header` style query will now ignore the `.def` extension for textual header inclusions.

cpp/ql/src/experimental/Security/CWE/CWE-1240/CustomCryptographicPrimitive.ql

@@ -60,7 +60,7 @@ predicate computeHeuristicType(Type t) {
 
 /**
  * Holds if `e` is an operation that is common in encryption-like computations.
- * Looking for clusters of these tends to find things like encrpytion,
+ * Looking for clusters of these tends to find things like encryption,
  * compression, random number generation, graphics processing and other compute
  * heavy algorithms.
  */

cpp/ql/src/jsf/4.06 Pre-Processing Directives/AV Rule 32.ql

@@ -18,6 +18,7 @@ from Include i, File f, string extension
 where
   f = i.getIncludedFile() and
   extension = f.getExtension().toLowerCase() and
+  extension != "def" and
   extension != "inc" and
   extension != "inl" and
   extension != "tcc" and

cpp/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/cpp-queries
-version: 0.9.2
+version: 0.9.3-dev
 groups:
   - cpp
   - queries

cpp/ql/test/library-tests/builtins/functions_file/builtins.txt

@@ -1,2 +0,0 @@
-__builtin_foobar(i)i
-__builtin_malloc(i,i,i,f*)f

cpp/ql/test/library-tests/builtins/functions_file/isbuiltin.expected

@@ -1,4 +0,0 @@
-| file://:0:0:0:0 | __builtin_add_overflow | true | 0 | file://:0:0:0:0 | bool |
-| file://:0:0:0:0 | __builtin_foobar | true | 1 | file://:0:0:0:0 | int |
-| file://:0:0:0:0 | __builtin_malloc | true | 4 | file://:0:0:0:0 | float |
-| test.c:1:6:1:6 | f | false | 3 | file://:0:0:0:0 | long |

cpp/ql/test/library-tests/builtins/functions_file/isbuiltin.ql

@@ -1,5 +0,0 @@
-import cpp
-
-from Function f, boolean isBuiltin
-where if f instanceof BuiltInFunction then isBuiltin = true else isBuiltin = false
-select f, isBuiltin, f.getNumberOfParameters(), f.getType()

cpp/ql/test/library-tests/builtins/functions_file/test.c

@@ -1,20 +0,0 @@
-long f(int a, int b, int c) {
-  // A builtin from the builtin_functions_file.
-  int i1 = __builtin_foobar(a);
-
-  // A builtin that's not in the file, but the extractor should handle, given the
-  // --gnu_version flag we pass in.
-  int i2;
-  __builtin_add_overflow(a, b, &i2);
-
-  // A builtin that would normally be defined by the extractor with a type
-  // expecting it to be called like this:
-  //void* x = __builtin_malloc(a);
-  // But we override the type in the builtin_functions_file so it's called like
-  // this:
-  float f1, f2;
-  f1 = __builtin_malloc(a, b, c, &f2);
-
-  return 42;
-}
-// semmle-extractor-options: --gnu_version 50100 --edg --builtin_functions_file --edg ${testdir}/builtins.txt

cpp/ql/test/library-tests/c++_exceptions/graphable.expected

@@ -1,384 +1,388 @@
-| C::C | false | 493 | 493 | C |
-| C::C | false | 682 | 682 | C |
-| C::operator= | false | 675 | 675 | operator= |
-| C::~C | false | 614 | 614 | ~C |
-| Error::Error | false | 259 | 259 | Error |
-| Error::Error | false | 272 | 272 | Error |
-| Error::Error | false | 277 | 277 | return ... |
-| Error::Error | false | 279 | 279 | { ... } |
-| Error::Error | true | 277 | 272 |  |
-| Error::Error | true | 279 | 277 |  |
-| Error::operator= | false | 253 | 253 | operator= |
-| Error::~Error | false | 263 | 263 | ~Error |
-| Error::~Error | false | 268 | 268 | return ... |
-| Error::~Error | false | 270 | 270 | { ... } |
-| Error::~Error | true | 268 | 263 |  |
-| Error::~Error | true | 270 | 268 |  |
-| __va_list_tag::operator= | false | 140 | 140 | operator= |
-| __va_list_tag::operator= | false | 147 | 147 | operator= |
-| f | false | 477 | 477 | f |
-| f | false | 488 | 488 | declaration |
-| f | false | 491 | 491 | call to C |
-| f | false | 496 | 496 | 102 |
-| f | false | 497 | 497 | initializer for c102 |
-| f | false | 501 | 501 | call to C |
-| f | false | 505 | 505 | 103 |
-| f | false | 506 | 506 | initializer for c103 |
-| f | false | 509 | 509 | declaration |
-| f | false | 511 | 511 | b1 |
-| f | false | 513 | 513 | (bool)... |
-| f | false | 516 | 516 | 1 |
-| f | false | 517 | 517 | throw ... |
-| f | false | 519 | 519 | ExprStmt |
-| f | false | 521 | 521 | { ... } |
-| f | false | 523 | 523 | if (...) ...  |
-| f | false | 525 | 525 | declaration |
-| f | false | 527 | 527 | { ... } |
-| f | false | 534 | 534 | 1 |
-| f | false | 536 | 536 | call to C |
-| f | false | 540 | 540 | 104 |
-| f | false | 541 | 541 | initializer for c104 |
-| f | false | 544 | 544 | declaration |
-| f | false | 546 | 546 | { ... } |
-| f | false | 548 | 548 | __try { ... } __except( ... ) { ... } |
-| f | false | 550 | 550 | declaration |
+| C::C | false | 499 | 499 | C |
+| C::C | false | 690 | 690 | C |
+| C::operator= | false | 681 | 681 | operator= |
+| C::~C | false | 647 | 647 | ~C |
+| Error::Error | false | 205 | 205 | Error |
+| Error::Error | false | 219 | 219 | Error |
+| Error::Error | false | 224 | 224 | return ... |
+| Error::Error | false | 226 | 226 | { ... } |
+| Error::Error | true | 224 | 219 |  |
+| Error::Error | true | 226 | 224 |  |
+| Error::operator= | false | 197 | 197 | operator= |
+| Error::~Error | false | 209 | 209 | ~Error |
+| Error::~Error | false | 215 | 215 | return ... |
+| Error::~Error | false | 217 | 217 | { ... } |
+| Error::~Error | true | 215 | 209 |  |
+| Error::~Error | true | 217 | 215 |  |
+| __va_list_tag::operator= | false | 66 | 66 | operator= |
+| __va_list_tag::operator= | false | 72 | 72 | operator= |
+| f | false | 483 | 483 | f |
+| f | false | 494 | 494 | declaration |
+| f | false | 497 | 497 | call to C |
+| f | false | 502 | 502 | 101 |
+| f | false | 503 | 503 | initializer for c101 |
+| f | false | 506 | 506 | __try { ... } __except( ... ) { ... } |
+| f | false | 509 | 509 | call to C |
+| f | false | 513 | 513 | 102 |
+| f | false | 514 | 514 | initializer for c102 |
+| f | false | 518 | 518 | call to C |
+| f | false | 522 | 522 | 103 |
+| f | false | 523 | 523 | initializer for c103 |
+| f | false | 526 | 526 | declaration |
+| f | false | 528 | 528 | if (...) ...  |
+| f | false | 530 | 530 | b1 |
+| f | false | 532 | 532 | (bool)... |
+| f | false | 533 | 533 | ExprStmt |
+| f | false | 537 | 537 | 1 |
+| f | false | 538 | 538 | throw ... |
+| f | false | 540 | 540 | { ... } |
+| f | false | 542 | 542 | declaration |
+| f | false | 544 | 544 | { ... } |
+| f | false | 551 | 551 | 1 |
 | f | false | 553 | 553 | call to C |
-| f | false | 557 | 557 | 106 |
-| f | false | 558 | 558 | initializer for c106 |
-| f | false | 562 | 562 | call to C |
-| f | false | 566 | 566 | 107 |
-| f | false | 567 | 567 | initializer for c107 |
-| f | false | 570 | 570 | declaration |
-| f | false | 572 | 572 | b2 |
-| f | false | 574 | 574 | (bool)... |
-| f | false | 577 | 577 | 2 |
-| f | false | 578 | 578 | throw ... |
-| f | false | 580 | 580 | ExprStmt |
-| f | false | 582 | 582 | { ... } |
-| f | false | 584 | 584 | if (...) ...  |
-| f | false | 586 | 586 | declaration |
-| f | false | 588 | 588 | { ... } |
-| f | false | 591 | 591 | call to C |
-| f | false | 595 | 595 | 108 |
-| f | false | 596 | 596 | initializer for c108 |
-| f | false | 599 | 599 | declaration |
-| f | false | 601 | 601 | { ... } |
-| f | false | 603 | 603 | __try { ... } __finally { ... } |
-| f | false | 605 | 605 | declaration |
-| f | false | 607 | 607 | return ... |
-| f | false | 609 | 609 | { ... } |
-| f | false | 611 | 611 | c101 |
-| f | false | 613 | 613 | call to c101.~C |
-| f | false | 615 | 615 | c105 |
-| f | false | 616 | 616 | call to c105.~C |
-| f | false | 617 | 617 | c109 |
-| f | false | 618 | 618 | call to c109.~C |
-| f | false | 619 | 619 | c101 |
-| f | false | 620 | 620 | call to c101.~C |
-| f | false | 621 | 621 | c105 |
-| f | false | 622 | 622 | call to c105.~C |
-| f | false | 623 | 623 | c108 |
-| f | false | 625 | 625 | call to c108.~C |
-| f | false | 626 | 626 | c106 |
-| f | false | 628 | 628 | call to c106.~C |
-| f | false | 629 | 629 | c107 |
-| f | false | 630 | 630 | call to c107.~C |
-| f | false | 631 | 631 | c106 |
-| f | false | 632 | 632 | call to c106.~C |
-| f | false | 633 | 633 | c104 |
-| f | false | 635 | 635 | call to c104.~C |
-| f | false | 636 | 636 | c102 |
-| f | false | 638 | 638 | call to c102.~C |
-| f | false | 639 | 639 | c103 |
-| f | false | 640 | 640 | call to c103.~C |
-| f | false | 641 | 641 | c102 |
-| f | false | 642 | 642 | call to c102.~C |
-| f | false | 644 | 644 | call to C |
-| f | false | 648 | 648 | 101 |
-| f | false | 649 | 649 | initializer for c101 |
-| f | false | 653 | 653 | call to C |
-| f | false | 657 | 657 | 105 |
-| f | false | 658 | 658 | initializer for c105 |
-| f | false | 662 | 662 | call to C |
-| f | false | 666 | 666 | 109 |
-| f | false | 667 | 667 | initializer for c109 |
-| f | true | 488 | 649 |  |
-| f | true | 491 | 523 |  |
-| f | true | 496 | 491 |  |
-| f | true | 497 | 496 |  |
-| f | true | 501 | 639 |  |
-| f | true | 505 | 501 |  |
-| f | true | 506 | 505 |  |
-| f | true | 509 | 497 |  |
-| f | true | 511 | 521 | T |
-| f | true | 511 | 525 | F |
-| f | true | 516 | 517 |  |
-| f | true | 517 | 641 |  |
-| f | true | 519 | 516 |  |
-| f | true | 521 | 519 |  |
-| f | true | 523 | 511 |  |
-| f | true | 525 | 506 |  |
-| f | true | 527 | 509 |  |
-| f | true | 534 | 546 | T |
-| f | true | 536 | 633 |  |
-| f | true | 540 | 536 |  |
-| f | true | 541 | 540 |  |
-| f | true | 544 | 541 |  |
-| f | true | 546 | 544 |  |
-| f | true | 548 | 527 |  |
-| f | true | 550 | 658 |  |
-| f | true | 553 | 584 |  |
+| f | false | 557 | 557 | 104 |
+| f | false | 558 | 558 | initializer for c104 |
+| f | false | 561 | 561 | declaration |
+| f | false | 563 | 563 | { ... } |
+| f | false | 565 | 565 | declaration |
+| f | false | 568 | 568 | call to C |
+| f | false | 572 | 572 | 105 |
+| f | false | 573 | 573 | initializer for c105 |
+| f | false | 576 | 576 | __try { ... } __finally { ... } |
+| f | false | 579 | 579 | call to C |
+| f | false | 583 | 583 | 106 |
+| f | false | 584 | 584 | initializer for c106 |
+| f | false | 588 | 588 | call to C |
+| f | false | 592 | 592 | 107 |
+| f | false | 593 | 593 | initializer for c107 |
+| f | false | 596 | 596 | declaration |
+| f | false | 598 | 598 | if (...) ...  |
+| f | false | 600 | 600 | b2 |
+| f | false | 602 | 602 | (bool)... |
+| f | false | 603 | 603 | ExprStmt |
+| f | false | 607 | 607 | 2 |
+| f | false | 608 | 608 | throw ... |
+| f | false | 610 | 610 | { ... } |
+| f | false | 612 | 612 | declaration |
+| f | false | 614 | 614 | { ... } |
+| f | false | 617 | 617 | call to C |
+| f | false | 621 | 621 | 108 |
+| f | false | 622 | 622 | initializer for c108 |
+| f | false | 625 | 625 | declaration |
+| f | false | 627 | 627 | { ... } |
+| f | false | 629 | 629 | declaration |
+| f | false | 632 | 632 | call to C |
+| f | false | 636 | 636 | 109 |
+| f | false | 637 | 637 | initializer for c109 |
+| f | false | 640 | 640 | return ... |
+| f | false | 642 | 642 | { ... } |
+| f | false | 644 | 644 | c104 |
+| f | false | 646 | 646 | call to c104.~C |
+| f | false | 648 | 648 | c101 |
+| f | false | 650 | 650 | call to c101.~C |
+| f | false | 651 | 651 | c102 |
+| f | false | 653 | 653 | call to c102.~C |
+| f | false | 654 | 654 | c103 |
+| f | false | 655 | 655 | call to c103.~C |
+| f | false | 656 | 656 | c102 |
+| f | false | 657 | 657 | call to c102.~C |
+| f | false | 658 | 658 | c101 |
+| f | false | 659 | 659 | call to c101.~C |
+| f | false | 660 | 660 | c105 |
+| f | false | 661 | 661 | call to c105.~C |
+| f | false | 662 | 662 | c108 |
+| f | false | 664 | 664 | call to c108.~C |
+| f | false | 665 | 665 | c106 |
+| f | false | 667 | 667 | call to c106.~C |
+| f | false | 668 | 668 | c107 |
+| f | false | 669 | 669 | call to c107.~C |
+| f | false | 670 | 670 | c106 |
+| f | false | 671 | 671 | call to c106.~C |
+| f | false | 672 | 672 | c101 |
+| f | false | 673 | 673 | call to c101.~C |
+| f | false | 674 | 674 | c105 |
+| f | false | 675 | 675 | call to c105.~C |
+| f | false | 676 | 676 | c109 |
+| f | false | 677 | 677 | call to c109.~C |
+| f | true | 494 | 503 |  |
+| f | true | 497 | 506 |  |
+| f | true | 502 | 497 |  |
+| f | true | 503 | 502 |  |
+| f | true | 506 | 544 |  |
+| f | true | 509 | 528 |  |
+| f | true | 513 | 509 |  |
+| f | true | 514 | 513 |  |
+| f | true | 518 | 654 |  |
+| f | true | 522 | 518 |  |
+| f | true | 523 | 522 |  |
+| f | true | 526 | 514 |  |
+| f | true | 528 | 530 |  |
+| f | true | 530 | 540 | T |
+| f | true | 530 | 542 | F |
+| f | true | 533 | 537 |  |
+| f | true | 537 | 538 |  |
+| f | true | 538 | 656 |  |
+| f | true | 540 | 533 |  |
+| f | true | 542 | 523 |  |
+| f | true | 544 | 526 |  |
+| f | true | 551 | 563 | T |
+| f | true | 553 | 644 |  |
 | f | true | 557 | 553 |  |
 | f | true | 558 | 557 |  |
-| f | true | 562 | 629 |  |
-| f | true | 566 | 562 |  |
-| f | true | 567 | 566 |  |
-| f | true | 570 | 558 |  |
-| f | true | 572 | 582 | T |
-| f | true | 572 | 586 | F |
-| f | true | 577 | 578 |  |
-| f | true | 578 | 631 |  |
-| f | true | 580 | 577 |  |
-| f | true | 582 | 580 |  |
-| f | true | 584 | 572 |  |
-| f | true | 586 | 567 |  |
-| f | true | 588 | 570 |  |
-| f | true | 591 | 623 |  |
-| f | true | 595 | 591 |  |
-| f | true | 596 | 595 |  |
-| f | true | 599 | 596 |  |
-| f | true | 601 | 599 |  |
-| f | true | 603 | 588 |  |
-| f | true | 605 | 667 |  |
-| f | true | 607 | 617 |  |
-| f | true | 609 | 488 |  |
-| f | true | 611 | 613 |  |
-| f | true | 613 | 477 |  |
-| f | true | 615 | 616 |  |
-| f | true | 616 | 611 |  |
-| f | true | 617 | 618 |  |
-| f | true | 618 | 615 |  |
-| f | true | 619 | 620 |  |
-| f | true | 620 | 477 |  |
-| f | true | 621 | 622 |  |
-| f | true | 622 | 619 |  |
-| f | true | 623 | 625 |  |
-| f | true | 625 | 605 |  |
-| f | true | 625 | 621 |  |
-| f | true | 626 | 628 |  |
-| f | true | 628 | 601 |  |
-| f | true | 629 | 630 |  |
-| f | true | 630 | 626 |  |
-| f | true | 631 | 632 |  |
-| f | true | 632 | 601 |  |
-| f | true | 633 | 635 |  |
-| f | true | 635 | 550 |  |
-| f | true | 636 | 638 |  |
-| f | true | 638 | 550 |  |
-| f | true | 639 | 640 |  |
-| f | true | 640 | 636 |  |
-| f | true | 641 | 642 |  |
-| f | true | 642 | 534 |  |
-| f | true | 644 | 548 |  |
-| f | true | 648 | 644 |  |
-| f | true | 649 | 648 |  |
-| f | true | 653 | 603 |  |
-| f | true | 657 | 653 |  |
-| f | true | 658 | 657 |  |
-| f | true | 662 | 607 |  |
-| f | true | 666 | 662 |  |
-| f | true | 667 | 666 |  |
-| f1 | false | 292 | 292 | f1 |
-| f2 | false | 299 | 299 | f2 |
-| f3 | false | 304 | 304 | f3 |
-| f4 | false | 309 | 309 | f4 |
-| f4 | false | 433 | 433 | return ... |
-| f4 | false | 435 | 435 | { ... } |
-| f4 | true | 433 | 309 |  |
-| f4 | true | 435 | 433 |  |
-| f5 | false | 314 | 314 | f5 |
-| f5 | false | 422 | 422 | 3 |
-| f5 | false | 423 | 423 | throw ... |
-| f5 | false | 425 | 425 | ExprStmt |
-| f5 | false | 427 | 427 | { ... } |
-| f5 | true | 422 | 423 |  |
-| f5 | true | 423 | 314 |  |
-| f5 | true | 425 | 422 |  |
-| f5 | true | 427 | 425 |  |
-| fun | false | 287 | 287 | fun |
-| fun | false | 295 | 295 | call to f1 |
+| f | true | 561 | 558 |  |
+| f | true | 563 | 561 |  |
+| f | true | 565 | 573 |  |
+| f | true | 568 | 576 |  |
+| f | true | 572 | 568 |  |
+| f | true | 573 | 572 |  |
+| f | true | 576 | 614 |  |
+| f | true | 579 | 598 |  |
+| f | true | 583 | 579 |  |
+| f | true | 584 | 583 |  |
+| f | true | 588 | 668 |  |
+| f | true | 592 | 588 |  |
+| f | true | 593 | 592 |  |
+| f | true | 596 | 584 |  |
+| f | true | 598 | 600 |  |
+| f | true | 600 | 610 | T |
+| f | true | 600 | 612 | F |
+| f | true | 603 | 607 |  |
+| f | true | 607 | 608 |  |
+| f | true | 608 | 670 |  |
+| f | true | 610 | 603 |  |
+| f | true | 612 | 593 |  |
+| f | true | 614 | 596 |  |
+| f | true | 617 | 662 |  |
+| f | true | 621 | 617 |  |
+| f | true | 622 | 621 |  |
+| f | true | 625 | 622 |  |
+| f | true | 627 | 625 |  |
+| f | true | 629 | 637 |  |
+| f | true | 632 | 640 |  |
+| f | true | 636 | 632 |  |
+| f | true | 637 | 636 |  |
+| f | true | 640 | 676 |  |
+| f | true | 642 | 494 |  |
+| f | true | 644 | 646 |  |
+| f | true | 646 | 565 |  |
+| f | true | 648 | 650 |  |
+| f | true | 650 | 483 |  |
+| f | true | 651 | 653 |  |
+| f | true | 653 | 565 |  |
+| f | true | 654 | 655 |  |
+| f | true | 655 | 651 |  |
+| f | true | 656 | 657 |  |
+| f | true | 657 | 551 |  |
+| f | true | 658 | 659 |  |
+| f | true | 659 | 483 |  |
+| f | true | 660 | 661 |  |
+| f | true | 661 | 658 |  |
+| f | true | 662 | 664 |  |
+| f | true | 664 | 629 |  |
+| f | true | 664 | 660 |  |
+| f | true | 665 | 667 |  |
+| f | true | 667 | 627 |  |
+| f | true | 668 | 669 |  |
+| f | true | 669 | 665 |  |
+| f | true | 670 | 671 |  |
+| f | true | 671 | 627 |  |
+| f | true | 672 | 673 |  |
+| f | true | 673 | 483 |  |
+| f | true | 674 | 675 |  |
+| f | true | 675 | 672 |  |
+| f | true | 676 | 677 |  |
+| f | true | 677 | 674 |  |
+| f1 | false | 287 | 287 | f1 |
+| f2 | false | 294 | 294 | f2 |
+| f3 | false | 299 | 299 | f3 |
+| f4 | false | 304 | 304 | f4 |
+| f4 | false | 422 | 422 | return ... |
+| f4 | false | 424 | 424 | { ... } |
+| f4 | true | 422 | 304 |  |
+| f4 | true | 424 | 422 |  |
+| f5 | false | 309 | 309 | f5 |
+| f5 | false | 409 | 409 | ExprStmt |
+| f5 | false | 413 | 413 | 3 |
+| f5 | false | 414 | 414 | throw ... |
+| f5 | false | 416 | 416 | { ... } |
+| f5 | true | 409 | 413 |  |
+| f5 | true | 413 | 414 |  |
+| f5 | true | 414 | 309 |  |
+| f5 | true | 416 | 409 |  |
+| fun | false | 276 | 276 | fun |
+| fun | false | 281 | 281 | try { ... } |
+| fun | false | 283 | 283 | try { ... } |
+| fun | false | 285 | 285 | ExprStmt |
+| fun | false | 290 | 290 | call to f1 |
+| fun | false | 292 | 292 | ExprStmt |
+| fun | false | 295 | 295 | call to f2 |
 | fun | false | 297 | 297 | ExprStmt |
-| fun | false | 300 | 300 | call to f2 |
+| fun | false | 300 | 300 | call to f3 |
 | fun | false | 302 | 302 | ExprStmt |
-| fun | false | 305 | 305 | call to f3 |
+| fun | false | 305 | 305 | call to f4 |
 | fun | false | 307 | 307 | ExprStmt |
-| fun | false | 310 | 310 | call to f4 |
+| fun | false | 310 | 310 | call to f5 |
 | fun | false | 312 | 312 | ExprStmt |
-| fun | false | 315 | 315 | call to f5 |
-| fun | false | 317 | 317 | ExprStmt |
-| fun | false | 321 | 321 | 5 |
-| fun | false | 322 | 322 | throw ... |
-| fun | false | 324 | 324 | ExprStmt |
-| fun | false | 327 | 327 | call to g |
+| fun | false | 316 | 316 | 5 |
+| fun | false | 317 | 317 | throw ... |
+| fun | false | 319 | 319 | ExprStmt |
+| fun | false | 322 | 322 | call to g |
+| fun | false | 324 | 324 | { ... } |
 | fun | false | 329 | 329 | ExprStmt |
-| fun | false | 331 | 331 | { ... } |
-| fun | false | 337 | 337 | call to h |
-| fun | false | 339 | 339 | ExprStmt |
-| fun | false | 341 | 341 | { ... } |
-| fun | false | 343 | 343 | <handler> |
-| fun | false | 344 | 344 | try { ... } |
-| fun | false | 346 | 346 | { ... } |
-| fun | false | 352 | 352 | call to i |
-| fun | false | 354 | 354 | ExprStmt |
-| fun | false | 356 | 356 | { ... } |
-| fun | false | 362 | 362 | call to j |
-| fun | false | 364 | 364 | ExprStmt |
-| fun | false | 366 | 366 | { ... } |
-| fun | false | 368 | 368 | <handler> |
-| fun | false | 369 | 369 | <handler> |
-| fun | false | 370 | 370 | try { ... } |
-| fun | false | 373 | 373 | call to k |
-| fun | false | 375 | 375 | ExprStmt |
-| fun | false | 379 | 379 | 7 |
-| fun | false | 380 | 380 | throw ... |
-| fun | false | 382 | 382 | ExprStmt |
-| fun | false | 384 | 384 | { ... } |
-| fun | false | 390 | 390 | call to l |
-| fun | false | 392 | 392 | ExprStmt |
-| fun | false | 394 | 394 | { ... } |
-| fun | false | 397 | 397 | call to m |
-| fun | false | 399 | 399 | ExprStmt |
-| fun | false | 401 | 401 | { ... } |
-| fun | false | 403 | 403 | <handler> |
-| fun | false | 404 | 404 | <handler> |
-| fun | false | 405 | 405 | try { ... } |
-| fun | false | 408 | 408 | call to n |
-| fun | false | 410 | 410 | ExprStmt |
-| fun | false | 412 | 412 | return ... |
-| fun | false | 414 | 414 | { ... } |
-| fun | true | 295 | 302 |  |
-| fun | true | 297 | 295 |  |
-| fun | true | 300 | 307 |  |
-| fun | true | 302 | 300 |  |
-| fun | true | 305 | 312 |  |
-| fun | true | 307 | 305 |  |
-| fun | true | 310 | 317 |  |
-| fun | true | 312 | 310 |  |
-| fun | true | 317 | 315 |  |
-| fun | true | 321 | 322 |  |
-| fun | true | 322 | 343 |  |
-| fun | true | 324 | 321 |  |
-| fun | true | 327 | 375 |  |
-| fun | true | 329 | 327 |  |
-| fun | true | 331 | 297 |  |
-| fun | true | 337 | 375 |  |
-| fun | true | 339 | 337 |  |
-| fun | true | 341 | 339 |  |
-| fun | true | 343 | 341 |  |
-| fun | true | 343 | 368 |  |
-| fun | true | 344 | 331 |  |
-| fun | true | 346 | 344 |  |
-| fun | true | 352 | 375 |  |
-| fun | true | 354 | 352 |  |
-| fun | true | 356 | 354 |  |
-| fun | true | 362 | 375 |  |
-| fun | true | 364 | 362 |  |
-| fun | true | 366 | 364 |  |
-| fun | true | 368 | 356 |  |
-| fun | true | 368 | 369 |  |
-| fun | true | 369 | 287 |  |
-| fun | true | 369 | 366 |  |
-| fun | true | 370 | 346 |  |
-| fun | true | 373 | 405 |  |
-| fun | true | 375 | 373 |  |
-| fun | true | 379 | 380 |  |
-| fun | true | 380 | 403 |  |
-| fun | true | 382 | 379 |  |
-| fun | true | 384 | 382 |  |
-| fun | true | 390 | 410 |  |
-| fun | true | 392 | 390 |  |
-| fun | true | 394 | 392 |  |
-| fun | true | 397 | 410 |  |
-| fun | true | 399 | 397 |  |
-| fun | true | 401 | 399 |  |
-| fun | true | 403 | 394 |  |
-| fun | true | 403 | 404 |  |
-| fun | true | 404 | 401 |  |
-| fun | true | 405 | 384 |  |
-| fun | true | 408 | 412 |  |
-| fun | true | 410 | 408 |  |
-| fun | true | 412 | 287 |  |
-| fun | true | 414 | 370 |  |
-| fun2 | false | 204 | 204 | fun2 |
-| fun2 | false | 215 | 215 | fun2 |
-| fun2 | false | 218 | 218 | { ... } |
-| fun2 | false | 223 | 223 | re-throw exception  |
-| fun2 | false | 225 | 225 | ExprStmt |
-| fun2 | false | 227 | 227 | { ... } |
-| fun2 | false | 231 | 231 | 1 |
-| fun2 | false | 232 | 232 | return ... |
-| fun2 | false | 234 | 234 | { ... } |
-| fun2 | false | 236 | 236 | <handler> |
-| fun2 | false | 237 | 237 | <handler> |
-| fun2 | false | 238 | 238 | try { ... } |
-| fun2 | false | 242 | 242 | 0 |
-| fun2 | false | 243 | 243 | return ... |
-| fun2 | false | 245 | 245 | { ... } |
-| fun2 | false | 702 | 702 | { ... } |
-| fun2 | false | 707 | 707 | re-throw exception  |
-| fun2 | false | 708 | 708 | ExprStmt |
-| fun2 | false | 709 | 709 | { ... } |
-| fun2 | false | 711 | 711 | 1 |
-| fun2 | false | 712 | 712 | return ... |
-| fun2 | false | 713 | 713 | { ... } |
-| fun2 | false | 714 | 714 | <handler> |
-| fun2 | false | 715 | 715 | <handler> |
-| fun2 | false | 716 | 716 | try { ... } |
-| fun2 | false | 718 | 718 | 0 |
-| fun2 | false | 719 | 719 | return ... |
-| fun2 | false | 720 | 720 | { ... } |
-| fun2 | true | 218 | 243 |  |
-| fun2 | true | 223 | 215 |  |
-| fun2 | true | 225 | 223 |  |
-| fun2 | true | 227 | 225 |  |
-| fun2 | true | 231 | 215 |  |
-| fun2 | true | 232 | 231 |  |
-| fun2 | true | 234 | 232 |  |
-| fun2 | true | 236 | 227 |  |
-| fun2 | true | 236 | 237 |  |
-| fun2 | true | 237 | 234 |  |
-| fun2 | true | 238 | 218 |  |
-| fun2 | true | 242 | 215 |  |
-| fun2 | true | 243 | 242 |  |
-| fun2 | true | 245 | 238 |  |
-| fun2 | true | 702 | 719 |  |
-| fun2 | true | 707 | 204 |  |
-| fun2 | true | 708 | 707 |  |
-| fun2 | true | 709 | 708 |  |
-| fun2 | true | 711 | 204 |  |
-| fun2 | true | 712 | 711 |  |
-| fun2 | true | 713 | 712 |  |
-| fun2 | true | 714 | 709 |  |
-| fun2 | true | 714 | 715 |  |
-| fun2 | true | 715 | 713 |  |
-| fun2 | true | 716 | 702 |  |
-| fun2 | true | 718 | 204 |  |
-| fun2 | true | 719 | 718 |  |
-| fun2 | true | 720 | 716 |  |
-| g | false | 326 | 326 | g |
-| h | false | 336 | 336 | h |
-| i | false | 351 | 351 | i |
-| j | false | 361 | 361 | j |
-| k | false | 372 | 372 | k |
-| l | false | 389 | 389 | l |
-| m | false | 396 | 396 | m |
-| n | false | 407 | 407 | n |
-| run_fun2 | false | 199 | 199 | run_fun2 |
-| run_fun2 | false | 207 | 207 | call to fun2 |
-| run_fun2 | false | 209 | 209 | ExprStmt |
-| run_fun2 | false | 211 | 211 | return ... |
-| run_fun2 | false | 213 | 213 | { ... } |
-| run_fun2 | true | 207 | 211 |  |
-| run_fun2 | true | 209 | 207 |  |
-| run_fun2 | true | 211 | 199 |  |
-| run_fun2 | true | 213 | 209 |  |
+| fun | false | 332 | 332 | call to h |
+| fun | false | 334 | 334 | { ... } |
+| fun | false | 336 | 336 | <handler> |
+| fun | false | 337 | 337 | { ... } |
+| fun | false | 342 | 342 | ExprStmt |
+| fun | false | 345 | 345 | call to i |
+| fun | false | 347 | 347 | { ... } |
+| fun | false | 352 | 352 | ExprStmt |
+| fun | false | 355 | 355 | call to j |
+| fun | false | 357 | 357 | { ... } |
+| fun | false | 359 | 359 | <handler> |
+| fun | false | 360 | 360 | <handler> |
+| fun | false | 361 | 361 | ExprStmt |
+| fun | false | 364 | 364 | call to k |
+| fun | false | 366 | 366 | try { ... } |
+| fun | false | 368 | 368 | ExprStmt |
+| fun | false | 372 | 372 | 7 |
+| fun | false | 373 | 373 | throw ... |
+| fun | false | 375 | 375 | { ... } |
+| fun | false | 380 | 380 | ExprStmt |
+| fun | false | 383 | 383 | call to l |
+| fun | false | 385 | 385 | { ... } |
+| fun | false | 387 | 387 | ExprStmt |
+| fun | false | 390 | 390 | call to m |
+| fun | false | 392 | 392 | { ... } |
+| fun | false | 394 | 394 | <handler> |
+| fun | false | 395 | 395 | <handler> |
+| fun | false | 396 | 396 | ExprStmt |
+| fun | false | 399 | 399 | call to n |
+| fun | false | 401 | 401 | return ... |
+| fun | false | 403 | 403 | { ... } |
+| fun | true | 281 | 337 |  |
+| fun | true | 283 | 324 |  |
+| fun | true | 285 | 290 |  |
+| fun | true | 290 | 292 |  |
+| fun | true | 292 | 295 |  |
+| fun | true | 295 | 297 |  |
+| fun | true | 297 | 300 |  |
+| fun | true | 300 | 302 |  |
+| fun | true | 302 | 305 |  |
+| fun | true | 305 | 307 |  |
+| fun | true | 307 | 310 |  |
+| fun | true | 312 | 316 |  |
+| fun | true | 316 | 317 |  |
+| fun | true | 317 | 336 |  |
+| fun | true | 319 | 322 |  |
+| fun | true | 322 | 361 |  |
+| fun | true | 324 | 285 |  |
+| fun | true | 329 | 332 |  |
+| fun | true | 332 | 361 |  |
+| fun | true | 334 | 329 |  |
+| fun | true | 336 | 334 |  |
+| fun | true | 336 | 359 |  |
+| fun | true | 337 | 283 |  |
+| fun | true | 342 | 345 |  |
+| fun | true | 345 | 361 |  |
+| fun | true | 347 | 342 |  |
+| fun | true | 352 | 355 |  |
+| fun | true | 355 | 361 |  |
+| fun | true | 357 | 352 |  |
+| fun | true | 359 | 347 |  |
+| fun | true | 359 | 360 |  |
+| fun | true | 360 | 276 |  |
+| fun | true | 360 | 357 |  |
+| fun | true | 361 | 364 |  |
+| fun | true | 364 | 366 |  |
+| fun | true | 366 | 375 |  |
+| fun | true | 368 | 372 |  |
+| fun | true | 372 | 373 |  |
+| fun | true | 373 | 394 |  |
+| fun | true | 375 | 368 |  |
+| fun | true | 380 | 383 |  |
+| fun | true | 383 | 396 |  |
+| fun | true | 385 | 380 |  |
+| fun | true | 387 | 390 |  |
+| fun | true | 390 | 396 |  |
+| fun | true | 392 | 387 |  |
+| fun | true | 394 | 385 |  |
+| fun | true | 394 | 395 |  |
+| fun | true | 395 | 392 |  |
+| fun | true | 396 | 399 |  |
+| fun | true | 399 | 401 |  |
+| fun | true | 401 | 276 |  |
+| fun | true | 403 | 281 |  |
+| fun2 | false | 149 | 149 | fun2 |
+| fun2 | false | 159 | 159 | fun2 |
+| fun2 | false | 162 | 162 | try { ... } |
+| fun2 | false | 164 | 164 | { ... } |
+| fun2 | false | 172 | 172 | ExprStmt |
+| fun2 | false | 174 | 174 | re-throw exception  |
+| fun2 | false | 176 | 176 | { ... } |
+| fun2 | false | 178 | 178 | return ... |
+| fun2 | false | 182 | 182 | 1 |
+| fun2 | false | 183 | 183 | { ... } |
+| fun2 | false | 185 | 185 | <handler> |
+| fun2 | false | 186 | 186 | <handler> |
+| fun2 | false | 187 | 187 | return ... |
+| fun2 | false | 191 | 191 | 0 |
+| fun2 | false | 192 | 192 | { ... } |
+| fun2 | false | 257 | 257 | try { ... } |
+| fun2 | false | 258 | 258 | { ... } |
+| fun2 | false | 261 | 261 | ExprStmt |
+| fun2 | false | 262 | 262 | re-throw exception  |
+| fun2 | false | 263 | 263 | { ... } |
+| fun2 | false | 264 | 264 | return ... |
+| fun2 | false | 266 | 266 | 1 |
+| fun2 | false | 267 | 267 | { ... } |
+| fun2 | false | 268 | 268 | <handler> |
+| fun2 | false | 269 | 269 | <handler> |
+| fun2 | false | 270 | 270 | return ... |
+| fun2 | false | 272 | 272 | 0 |
+| fun2 | false | 273 | 273 | { ... } |
+| fun2 | true | 162 | 164 |  |
+| fun2 | true | 164 | 187 |  |
+| fun2 | true | 172 | 174 |  |
+| fun2 | true | 174 | 159 |  |
+| fun2 | true | 176 | 172 |  |
+| fun2 | true | 178 | 182 |  |
+| fun2 | true | 182 | 159 |  |
+| fun2 | true | 183 | 178 |  |
+| fun2 | true | 185 | 176 |  |
+| fun2 | true | 185 | 186 |  |
+| fun2 | true | 186 | 183 |  |
+| fun2 | true | 187 | 191 |  |
+| fun2 | true | 191 | 159 |  |
+| fun2 | true | 192 | 162 |  |
+| fun2 | true | 257 | 258 |  |
+| fun2 | true | 258 | 270 |  |
+| fun2 | true | 261 | 262 |  |
+| fun2 | true | 262 | 149 |  |
+| fun2 | true | 263 | 261 |  |
+| fun2 | true | 264 | 266 |  |
+| fun2 | true | 266 | 149 |  |
+| fun2 | true | 267 | 264 |  |
+| fun2 | true | 268 | 263 |  |
+| fun2 | true | 268 | 269 |  |
+| fun2 | true | 269 | 267 |  |
+| fun2 | true | 270 | 272 |  |
+| fun2 | true | 272 | 149 |  |
+| fun2 | true | 273 | 257 |  |
+| g | false | 321 | 321 | g |
+| h | false | 331 | 331 | h |
+| i | false | 344 | 344 | i |
+| j | false | 354 | 354 | j |
+| k | false | 363 | 363 | k |
+| l | false | 382 | 382 | l |
+| m | false | 389 | 389 | m |
+| n | false | 398 | 398 | n |
+| run_fun2 | false | 142 | 142 | run_fun2 |
+| run_fun2 | false | 147 | 147 | ExprStmt |
+| run_fun2 | false | 152 | 152 | call to fun2 |
+| run_fun2 | false | 154 | 154 | return ... |
+| run_fun2 | false | 156 | 156 | { ... } |
+| run_fun2 | true | 147 | 152 |  |
+| run_fun2 | true | 152 | 154 |  |
+| run_fun2 | true | 154 | 142 |  |
+| run_fun2 | true | 156 | 147 |  |

cpp/ql/test/library-tests/c++_exceptions/unreachable.expected

@@ -1,2 +1,3 @@
 | exceptions.cpp:25:13:25:19 | ExprStmt |
 | exceptions.cpp:26:13:26:13 | ExprStmt |
+| ms.cpp:38:1:38:1 | c101 |

cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-consistency.expected

@@ -159,6 +159,9 @@ postWithInFlow
 | test.cpp:808:5:808:21 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
 | test.cpp:808:6:808:21 | global_indirect1 [inner post update] | PostUpdateNode should not be the target of local flow. |
 | test.cpp:832:5:832:17 | global_direct [post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:931:5:931:18 | global_pointer [post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:932:5:932:19 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
+| test.cpp:932:6:932:19 | global_pointer [inner post update] | PostUpdateNode should not be the target of local flow. |
 viableImplInCallContextTooLarge
 uniqueParameterNodeAtPosition
 uniqueParameterNodePosition
@@ -166,3 +169,4 @@ uniqueContentApprox
 identityLocalStep
 missingArgumentCall
 multipleArgumentCall
+lambdaCallEnclosingCallableMismatch

cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-ir-consistency.expected

@@ -31,3 +31,4 @@ uniqueContentApprox
 identityLocalStep
 missingArgumentCall
 multipleArgumentCall
+lambdaCallEnclosingCallableMismatch

cpp/ql/test/library-tests/dataflow/dataflow-tests/test-source-sink.expected

@@ -300,6 +300,7 @@ irFlow
 | test.cpp:902:56:902:75 | *indirect_source(2) | test.cpp:911:19:911:48 | *global_array_static_indirect_2 |
 | test.cpp:914:46:914:53 | source | test.cpp:919:10:919:30 | global_pointer_static |
 | test.cpp:915:57:915:76 | *indirect_source(1) | test.cpp:921:19:921:50 | *global_pointer_static_indirect_1 |
+| test.cpp:932:23:932:28 | call to source | test.cpp:937:10:937:24 | * ... |
 | true_upon_entry.cpp:9:11:9:16 | call to source | true_upon_entry.cpp:13:8:13:8 | x |
 | true_upon_entry.cpp:17:11:17:16 | call to source | true_upon_entry.cpp:21:8:21:8 | x |
 | true_upon_entry.cpp:27:9:27:14 | call to source | true_upon_entry.cpp:29:8:29:8 | x |

cpp/ql/test/library-tests/dataflow/dataflow-tests/test.cpp

@@ -923,3 +923,17 @@ namespace GlobalArrays {
     indirect_sink(global_pointer_static_indirect_2); // clean: global_pointer_static_indirect_2 does not have 2 indirections
   }
 }
+
+namespace global_variable_conflation_test {
+  int* global_pointer;
+
+  void def() {
+    global_pointer = nullptr;
+    *global_pointer = source();
+  }
+
+  void use() {
+    sink(global_pointer); // clean
+    sink(*global_pointer); // $ ir MISSING: ast
+  }
+}

cpp/ql/test/library-tests/dataflow/fields/dataflow-consistency.expected

@@ -193,3 +193,4 @@ uniqueContentApprox
 identityLocalStep
 missingArgumentCall
 multipleArgumentCall
+lambdaCallEnclosingCallableMismatch

cpp/ql/test/library-tests/dataflow/fields/dataflow-ir-consistency.expected

@@ -27,3 +27,4 @@ uniqueContentApprox
 identityLocalStep
 missingArgumentCall
 multipleArgumentCall
+lambdaCallEnclosingCallableMismatch

cpp/ql/test/library-tests/destructors/cfg.expected

@@ -1,255 +1,263 @@
-| C::C | false | 197 | 197 | C |
-| C::C | false | 398 | 398 | C |
-| C::operator= | false | 391 | 391 | operator= |
-| C::~C | false | 331 | 331 | ~C |
-| Class2::Class2 | false | 538 | 538 | Class2 |
-| Class2::Class2 | false | 544 | 544 | return ... |
-| Class2::Class2 | false | 546 | 546 | { ... } |
+| C::C | false | 181 | 181 | C |
+| C::C | false | 384 | 384 | C |
+| C::operator= | false | 375 | 375 | operator= |
+| C::~C | false | 333 | 333 | ~C |
 | Class2::Class2 | false | 547 | 547 | Class2 |
-| Class2::Class2 | true | 544 | 538 |  |
-| Class2::Class2 | true | 546 | 544 |  |
-| Class2::operator= | false | 532 | 532 | operator= |
-| Class2::~Class2 | false | 467 | 467 | ~Class2 |
-| Outer::Inner::Inner | false | 488 | 488 | Inner |
-| Outer::Inner::Inner | false | 509 | 509 | Inner |
-| Outer::Inner::Inner | false | 528 | 528 | return ... |
-| Outer::Inner::Inner | false | 530 | 530 | { ... } |
-| Outer::Inner::Inner | true | 528 | 488 |  |
-| Outer::Inner::Inner | true | 530 | 528 |  |
-| Outer::Inner::operator= | false | 502 | 502 | operator= |
-| Outer::Inner::~Inner | false | 470 | 470 | ~Inner |
-| Outer::Inner::~Inner | false | 517 | 517 | return ... |
-| Outer::Inner::~Inner | false | 519 | 519 | { ... } |
-| Outer::Inner::~Inner | true | 517 | 470 |  |
-| Outer::Inner::~Inner | true | 519 | 517 |  |
-| Outer::f2 | false | 439 | 439 | f2 |
-| Outer::f2 | false | 447 | 447 | declaration |
-| Outer::f2 | false | 449 | 449 | i |
-| Outer::f2 | false | 451 | 451 | (bool)... |
-| Outer::f2 | false | 452 | 452 | return ... |
-| Outer::f2 | false | 454 | 454 | { ... } |
-| Outer::f2 | false | 456 | 456 | if (...) ...  |
-| Outer::f2 | false | 458 | 458 | declaration |
-| Outer::f2 | false | 460 | 460 | return ... |
-| Outer::f2 | false | 462 | 462 | { ... } |
-| Outer::f2 | false | 464 | 464 | c |
-| Outer::f2 | false | 466 | 466 | call to c.~Class2 |
-| Outer::f2 | false | 468 | 468 | inner |
-| Outer::f2 | false | 469 | 469 | call to inner.~Inner |
-| Outer::f2 | false | 474 | 474 | call to getClass2 |
-| Outer::f2 | false | 476 | 476 | initializer for c |
-| Outer::f2 | false | 481 | 481 | call to Inner |
-| Outer::f2 | false | 490 | 490 | c |
-| Outer::f2 | false | 492 | 492 | (const Class2)... |
-| Outer::f2 | false | 493 | 493 | (reference to) |
-| Outer::f2 | false | 494 | 494 | initializer for inner |
-| Outer::f2 | true | 447 | 476 |  |
-| Outer::f2 | true | 449 | 454 | T |
-| Outer::f2 | true | 449 | 458 | F |
-| Outer::f2 | true | 452 | 464 |  |
-| Outer::f2 | true | 454 | 452 |  |
-| Outer::f2 | true | 456 | 449 |  |
-| Outer::f2 | true | 458 | 494 |  |
-| Outer::f2 | true | 460 | 468 |  |
-| Outer::f2 | true | 462 | 447 |  |
+| Class2::Class2 | false | 554 | 554 | return ... |
+| Class2::Class2 | false | 556 | 556 | { ... } |
+| Class2::Class2 | false | 557 | 557 | Class2 |
+| Class2::Class2 | true | 554 | 547 |  |
+| Class2::Class2 | true | 556 | 554 |  |
+| Class2::operator= | false | 541 | 541 | operator= |
+| Class2::~Class2 | false | 499 | 499 | ~Class2 |
+| Outer::Inner::Inner | false | 481 | 481 | Inner |
+| Outer::Inner::Inner | false | 517 | 517 | Inner |
+| Outer::Inner::Inner | false | 537 | 537 | return ... |
+| Outer::Inner::Inner | false | 539 | 539 | { ... } |
+| Outer::Inner::Inner | true | 537 | 481 |  |
+| Outer::Inner::Inner | true | 539 | 537 |  |
+| Outer::Inner::operator= | false | 508 | 508 | operator= |
+| Outer::Inner::~Inner | false | 504 | 504 | ~Inner |
+| Outer::Inner::~Inner | false | 526 | 526 | return ... |
+| Outer::Inner::~Inner | false | 528 | 528 | { ... } |
+| Outer::Inner::~Inner | true | 526 | 504 |  |
+| Outer::Inner::~Inner | true | 528 | 526 |  |
+| Outer::f2 | false | 444 | 444 | f2 |
+| Outer::f2 | false | 453 | 453 | declaration |
+| Outer::f2 | false | 458 | 458 | call to getClass2 |
+| Outer::f2 | false | 460 | 460 | initializer for c |
+| Outer::f2 | false | 464 | 464 | if (...) ...  |
+| Outer::f2 | false | 466 | 466 | i |
+| Outer::f2 | false | 468 | 468 | (bool)... |
+| Outer::f2 | false | 469 | 469 | return ... |
+| Outer::f2 | false | 471 | 471 | { ... } |
+| Outer::f2 | false | 473 | 473 | declaration |
+| Outer::f2 | false | 476 | 476 | call to Inner |
+| Outer::f2 | false | 482 | 482 | c |
+| Outer::f2 | false | 485 | 485 | (const Class2)... |
+| Outer::f2 | false | 488 | 488 | (reference to) |
+| Outer::f2 | false | 489 | 489 | initializer for inner |
+| Outer::f2 | false | 492 | 492 | return ... |
+| Outer::f2 | false | 494 | 494 | { ... } |
+| Outer::f2 | false | 496 | 496 | c |
+| Outer::f2 | false | 498 | 498 | call to c.~Class2 |
+| Outer::f2 | false | 500 | 500 | c |
+| Outer::f2 | false | 501 | 501 | call to c.~Class2 |
+| Outer::f2 | false | 502 | 502 | inner |
+| Outer::f2 | false | 503 | 503 | call to inner.~Inner |
+| Outer::f2 | true | 453 | 460 |  |
+| Outer::f2 | true | 458 | 464 |  |
+| Outer::f2 | true | 460 | 458 |  |
 | Outer::f2 | true | 464 | 466 |  |
-| Outer::f2 | true | 466 | 439 |  |
-| Outer::f2 | true | 468 | 469 |  |
-| Outer::f2 | true | 469 | 464 |  |
-| Outer::f2 | true | 474 | 456 |  |
-| Outer::f2 | true | 476 | 474 |  |
-| Outer::f2 | true | 481 | 460 |  |
-| Outer::f2 | true | 490 | 481 |  |
-| Outer::f2 | true | 494 | 490 |  |
-| Outer::operator= | false | 424 | 424 | operator= |
-| Outer::operator= | false | 435 | 435 | operator= |
-| __va_list_tag::operator= | false | 93 | 93 | operator= |
-| __va_list_tag::operator= | false | 100 | 100 | operator= |
-| f | false | 181 | 181 | f |
-| f | false | 192 | 192 | declaration |
-| f | false | 195 | 195 | call to C |
-| f | false | 200 | 200 | 120 |
-| f | false | 201 | 201 | initializer for c20 |
-| f | false | 205 | 205 | call to C |
-| f | false | 209 | 209 | 121 |
-| f | false | 210 | 210 | initializer for c21 |
-| f | false | 213 | 213 | declaration |
-| f | false | 216 | 216 | call to C |
-| f | false | 220 | 220 | 130 |
-| f | false | 221 | 221 | initializer for c30 |
-| f | false | 224 | 224 | declaration |
-| f | false | 226 | 226 | { ... } |
-| f | false | 229 | 229 | call to C |
-| f | false | 233 | 233 | 131 |
-| f | false | 234 | 234 | initializer for c31 |
-| f | false | 238 | 238 | call to C |
-| f | false | 242 | 242 | 132 |
-| f | false | 243 | 243 | initializer for c32 |
-| f | false | 247 | 247 | call to C |
-| f | false | 251 | 251 | 133 |
-| f | false | 252 | 252 | initializer for c33 |
-| f | false | 255 | 255 | declaration |
-| f | false | 257 | 257 | b1 |
-| f | false | 259 | 259 | (bool)... |
-| f | false | 260 | 260 | goto ... |
-| f | false | 262 | 262 | if (...) ...  |
-| f | false | 264 | 264 | declaration |
-| f | false | 266 | 266 | b2 |
-| f | false | 268 | 268 | (bool)... |
-| f | false | 269 | 269 | return ... |
-| f | false | 271 | 271 | if (...) ...  |
-| f | false | 273 | 273 | declaration |
-| f | false | 275 | 275 | { ... } |
-| f | false | 278 | 278 | call to C |
-| f | false | 282 | 282 | 134 |
-| f | false | 283 | 283 | initializer for c34 |
-| f | false | 286 | 286 | declaration |
-| f | false | 288 | 288 | { ... } |
-| f | false | 290 | 290 | declaration |
-| f | false | 292 | 292 | { ... } |
-| f | false | 295 | 295 | call to C |
-| f | false | 299 | 299 | 122 |
-| f | false | 300 | 300 | initializer for c22 |
-| f | false | 303 | 303 | declaration |
-| f | false | 305 | 305 | { ... } |
-| f | false | 308 | 308 | call to C |
-| f | false | 312 | 312 | 123 |
-| f | false | 313 | 313 | initializer for c23 |
-| f | false | 316 | 316 | label ...: |
-| f | false | 318 | 318 | declaration |
-| f | false | 320 | 320 | { ... } |
-| f | false | 322 | 322 | declaration |
-| f | false | 324 | 324 | return ... |
-| f | false | 326 | 326 | { ... } |
-| f | false | 328 | 328 | c10 |
-| f | false | 330 | 330 | call to c10.~C |
-| f | false | 332 | 332 | c11 |
-| f | false | 333 | 333 | call to c11.~C |
-| f | false | 334 | 334 | c23 |
-| f | false | 336 | 336 | call to c23.~C |
-| f | false | 337 | 337 | c22 |
-| f | false | 339 | 339 | call to c22.~C |
-| f | false | 340 | 340 | c20 |
-| f | false | 342 | 342 | call to c20.~C |
-| f | false | 343 | 343 | c21 |
-| f | false | 344 | 344 | call to c21.~C |
-| f | false | 345 | 345 | c34 |
-| f | false | 347 | 347 | call to c34.~C |
+| Outer::f2 | true | 466 | 471 | T |
+| Outer::f2 | true | 466 | 473 | F |
+| Outer::f2 | true | 469 | 496 |  |
+| Outer::f2 | true | 471 | 469 |  |
+| Outer::f2 | true | 473 | 489 |  |
+| Outer::f2 | true | 476 | 492 |  |
+| Outer::f2 | true | 482 | 476 |  |
+| Outer::f2 | true | 489 | 482 |  |
+| Outer::f2 | true | 492 | 502 |  |
+| Outer::f2 | true | 494 | 453 |  |
+| Outer::f2 | true | 496 | 498 |  |
+| Outer::f2 | true | 498 | 444 |  |
+| Outer::f2 | true | 500 | 501 |  |
+| Outer::f2 | true | 501 | 444 |  |
+| Outer::f2 | true | 502 | 503 |  |
+| Outer::f2 | true | 503 | 500 |  |
+| Outer::operator= | false | 428 | 428 | operator= |
+| Outer::operator= | false | 438 | 438 | operator= |
+| __va_list_tag::operator= | false | 66 | 66 | operator= |
+| __va_list_tag::operator= | false | 72 | 72 | operator= |
+| f | false | 165 | 165 | f |
+| f | false | 176 | 176 | declaration |
+| f | false | 179 | 179 | call to C |
+| f | false | 184 | 184 | 110 |
+| f | false | 185 | 185 | initializer for c10 |
+| f | false | 189 | 189 | call to C |
+| f | false | 193 | 193 | 120 |
+| f | false | 194 | 194 | initializer for c20 |
+| f | false | 198 | 198 | call to C |
+| f | false | 202 | 202 | 121 |
+| f | false | 203 | 203 | initializer for c21 |
+| f | false | 206 | 206 | declaration |
+| f | false | 209 | 209 | call to C |
+| f | false | 213 | 213 | 130 |
+| f | false | 214 | 214 | initializer for c30 |
+| f | false | 217 | 217 | declaration |
+| f | false | 219 | 219 | { ... } |
+| f | false | 222 | 222 | call to C |
+| f | false | 226 | 226 | 131 |
+| f | false | 227 | 227 | initializer for c31 |
+| f | false | 231 | 231 | call to C |
+| f | false | 235 | 235 | 132 |
+| f | false | 236 | 236 | initializer for c32 |
+| f | false | 240 | 240 | call to C |
+| f | false | 244 | 244 | 133 |
+| f | false | 245 | 245 | initializer for c33 |
+| f | false | 248 | 248 | declaration |
+| f | false | 250 | 250 | if (...) ...  |
+| f | false | 252 | 252 | b1 |
+| f | false | 254 | 254 | (bool)... |
+| f | false | 255 | 255 | goto ... |
+| f | false | 257 | 257 | declaration |
+| f | false | 259 | 259 | if (...) ...  |
+| f | false | 261 | 261 | b2 |
+| f | false | 263 | 263 | (bool)... |
+| f | false | 264 | 264 | return ... |
+| f | false | 266 | 266 | declaration |
+| f | false | 268 | 268 | { ... } |
+| f | false | 271 | 271 | call to C |
+| f | false | 275 | 275 | 134 |
+| f | false | 276 | 276 | initializer for c34 |
+| f | false | 279 | 279 | declaration |
+| f | false | 281 | 281 | { ... } |
+| f | false | 283 | 283 | declaration |
+| f | false | 285 | 285 | { ... } |
+| f | false | 288 | 288 | call to C |
+| f | false | 292 | 292 | 122 |
+| f | false | 293 | 293 | initializer for c22 |
+| f | false | 296 | 296 | declaration |
+| f | false | 298 | 298 | { ... } |
+| f | false | 301 | 301 | call to C |
+| f | false | 305 | 305 | 123 |
+| f | false | 306 | 306 | initializer for c23 |
+| f | false | 309 | 309 | label ...: |
+| f | false | 311 | 311 | declaration |
+| f | false | 313 | 313 | { ... } |
+| f | false | 315 | 315 | declaration |
+| f | false | 318 | 318 | call to C |
+| f | false | 322 | 322 | 111 |
+| f | false | 323 | 323 | initializer for c11 |
+| f | false | 326 | 326 | return ... |
+| f | false | 328 | 328 | { ... } |
+| f | false | 330 | 330 | c20 |
+| f | false | 332 | 332 | call to c20.~C |
+| f | false | 334 | 334 | c21 |
+| f | false | 335 | 335 | call to c21.~C |
+| f | false | 336 | 336 | c30 |
+| f | false | 338 | 338 | call to c30.~C |
+| f | false | 339 | 339 | c31 |
+| f | false | 341 | 341 | call to c31.~C |
+| f | false | 342 | 342 | c32 |
+| f | false | 343 | 343 | call to c32.~C |
+| f | false | 344 | 344 | c33 |
+| f | false | 345 | 345 | call to c33.~C |
+| f | false | 346 | 346 | c20 |
+| f | false | 347 | 347 | call to c20.~C |
 | f | false | 348 | 348 | c31 |
-| f | false | 350 | 350 | call to c31.~C |
-| f | false | 351 | 351 | c32 |
-| f | false | 352 | 352 | call to c32.~C |
-| f | false | 353 | 353 | c33 |
-| f | false | 354 | 354 | call to c33.~C |
-| f | false | 355 | 355 | c20 |
-| f | false | 356 | 356 | call to c20.~C |
-| f | false | 357 | 357 | c31 |
-| f | false | 358 | 358 | call to c31.~C |
-| f | false | 359 | 359 | c32 |
-| f | false | 360 | 360 | call to c32.~C |
-| f | false | 361 | 361 | c20 |
-| f | false | 362 | 362 | call to c20.~C |
-| f | false | 363 | 363 | c31 |
-| f | false | 364 | 364 | call to c31.~C |
-| f | false | 365 | 365 | c30 |
-| f | false | 367 | 367 | call to c30.~C |
-| f | false | 369 | 369 | call to C |
-| f | false | 373 | 373 | 110 |
-| f | false | 374 | 374 | initializer for c10 |
-| f | false | 378 | 378 | call to C |
-| f | false | 382 | 382 | 111 |
-| f | false | 383 | 383 | initializer for c11 |
-| f | true | 192 | 374 |  |
-| f | true | 195 | 226 |  |
-| f | true | 200 | 195 |  |
-| f | true | 201 | 200 |  |
-| f | true | 205 | 343 |  |
-| f | true | 209 | 205 |  |
-| f | true | 210 | 209 |  |
-| f | true | 213 | 201 |  |
-| f | true | 216 | 365 |  |
-| f | true | 220 | 216 |  |
-| f | true | 221 | 220 |  |
-| f | true | 224 | 221 |  |
-| f | true | 226 | 224 |  |
-| f | true | 229 | 262 |  |
-| f | true | 233 | 229 |  |
-| f | true | 234 | 233 |  |
-| f | true | 238 | 271 |  |
-| f | true | 242 | 238 |  |
-| f | true | 243 | 242 |  |
-| f | true | 247 | 353 |  |
-| f | true | 251 | 247 |  |
-| f | true | 252 | 251 |  |
-| f | true | 255 | 234 |  |
-| f | true | 257 | 260 | T |
-| f | true | 257 | 264 | F |
-| f | true | 260 | 363 |  |
-| f | true | 262 | 257 |  |
-| f | true | 264 | 243 |  |
-| f | true | 266 | 269 | T |
-| f | true | 266 | 273 | F |
-| f | true | 269 | 359 |  |
-| f | true | 271 | 266 |  |
-| f | true | 273 | 252 |  |
-| f | true | 275 | 255 |  |
-| f | true | 278 | 345 |  |
-| f | true | 282 | 278 |  |
-| f | true | 283 | 282 |  |
-| f | true | 286 | 283 |  |
-| f | true | 288 | 286 |  |
-| f | true | 290 | 210 |  |
-| f | true | 292 | 213 |  |
-| f | true | 295 | 337 |  |
-| f | true | 299 | 295 |  |
-| f | true | 300 | 299 |  |
-| f | true | 303 | 300 |  |
-| f | true | 305 | 303 |  |
-| f | true | 308 | 334 |  |
-| f | true | 312 | 308 |  |
-| f | true | 313 | 312 |  |
-| f | true | 316 | 318 |  |
-| f | true | 318 | 313 |  |
-| f | true | 320 | 316 |  |
-| f | true | 322 | 383 |  |
-| f | true | 324 | 332 |  |
-| f | true | 326 | 192 |  |
-| f | true | 328 | 330 |  |
-| f | true | 330 | 181 |  |
-| f | true | 332 | 333 |  |
-| f | true | 333 | 328 |  |
-| f | true | 334 | 336 |  |
-| f | true | 336 | 322 |  |
-| f | true | 337 | 339 |  |
-| f | true | 339 | 320 |  |
-| f | true | 340 | 342 |  |
-| f | true | 342 | 305 |  |
-| f | true | 343 | 344 |  |
-| f | true | 344 | 340 |  |
-| f | true | 345 | 347 |  |
-| f | true | 347 | 290 |  |
-| f | true | 348 | 350 |  |
-| f | true | 350 | 288 |  |
-| f | true | 351 | 352 |  |
-| f | true | 352 | 348 |  |
+| f | false | 349 | 349 | call to c31.~C |
+| f | false | 350 | 350 | c10 |
+| f | false | 352 | 352 | call to c10.~C |
+| f | false | 353 | 353 | c20 |
+| f | false | 354 | 354 | call to c20.~C |
+| f | false | 355 | 355 | c31 |
+| f | false | 356 | 356 | call to c31.~C |
+| f | false | 357 | 357 | c32 |
+| f | false | 358 | 358 | call to c32.~C |
+| f | false | 359 | 359 | c34 |
+| f | false | 361 | 361 | call to c34.~C |
+| f | false | 362 | 362 | c22 |
+| f | false | 364 | 364 | call to c22.~C |
+| f | false | 365 | 365 | c23 |
+| f | false | 367 | 367 | call to c23.~C |
+| f | false | 368 | 368 | c10 |
+| f | false | 369 | 369 | call to c10.~C |
+| f | false | 370 | 370 | c11 |
+| f | false | 371 | 371 | call to c11.~C |
+| f | true | 176 | 185 |  |
+| f | true | 179 | 285 |  |
+| f | true | 184 | 179 |  |
+| f | true | 185 | 184 |  |
+| f | true | 189 | 219 |  |
+| f | true | 193 | 189 |  |
+| f | true | 194 | 193 |  |
+| f | true | 198 | 334 |  |
+| f | true | 202 | 198 |  |
+| f | true | 203 | 202 |  |
+| f | true | 206 | 194 |  |
+| f | true | 209 | 336 |  |
+| f | true | 213 | 209 |  |
+| f | true | 214 | 213 |  |
+| f | true | 217 | 214 |  |
+| f | true | 219 | 217 |  |
+| f | true | 222 | 250 |  |
+| f | true | 226 | 222 |  |
+| f | true | 227 | 226 |  |
+| f | true | 231 | 259 |  |
+| f | true | 235 | 231 |  |
+| f | true | 236 | 235 |  |
+| f | true | 240 | 344 |  |
+| f | true | 244 | 240 |  |
+| f | true | 245 | 244 |  |
+| f | true | 248 | 227 |  |
+| f | true | 250 | 252 |  |
+| f | true | 252 | 255 | T |
+| f | true | 252 | 257 | F |
+| f | true | 255 | 348 |  |
+| f | true | 257 | 236 |  |
+| f | true | 259 | 261 |  |
+| f | true | 261 | 264 | T |
+| f | true | 261 | 266 | F |
+| f | true | 264 | 357 |  |
+| f | true | 266 | 245 |  |
+| f | true | 268 | 248 |  |
+| f | true | 271 | 359 |  |
+| f | true | 275 | 271 |  |
+| f | true | 276 | 275 |  |
+| f | true | 279 | 276 |  |
+| f | true | 281 | 279 |  |
+| f | true | 283 | 203 |  |
+| f | true | 285 | 206 |  |
+| f | true | 288 | 362 |  |
+| f | true | 292 | 288 |  |
+| f | true | 293 | 292 |  |
+| f | true | 296 | 293 |  |
+| f | true | 298 | 296 |  |
+| f | true | 301 | 365 |  |
+| f | true | 305 | 301 |  |
+| f | true | 306 | 305 |  |
+| f | true | 309 | 311 |  |
+| f | true | 311 | 306 |  |
+| f | true | 313 | 309 |  |
+| f | true | 315 | 323 |  |
+| f | true | 318 | 326 |  |
+| f | true | 322 | 318 |  |
+| f | true | 323 | 322 |  |
+| f | true | 326 | 370 |  |
+| f | true | 328 | 176 |  |
+| f | true | 330 | 332 |  |
+| f | true | 332 | 298 |  |
+| f | true | 334 | 335 |  |
+| f | true | 335 | 330 |  |
+| f | true | 336 | 338 |  |
+| f | true | 338 | 268 |  |
+| f | true | 339 | 341 |  |
+| f | true | 341 | 281 |  |
+| f | true | 342 | 343 |  |
+| f | true | 343 | 339 |  |
+| f | true | 344 | 345 |  |
+| f | true | 345 | 342 |  |
+| f | true | 346 | 347 |  |
+| f | true | 347 | 309 |  |
+| f | true | 348 | 349 |  |
+| f | true | 349 | 346 |  |
+| f | true | 350 | 352 |  |
+| f | true | 352 | 165 |  |
 | f | true | 353 | 354 |  |
-| f | true | 354 | 351 |  |
+| f | true | 354 | 350 |  |
 | f | true | 355 | 356 |  |
-| f | true | 356 | 328 |  |
+| f | true | 356 | 353 |  |
 | f | true | 357 | 358 |  |
 | f | true | 358 | 355 |  |
-| f | true | 359 | 360 |  |
-| f | true | 360 | 357 |  |
-| f | true | 361 | 362 |  |
-| f | true | 362 | 316 |  |
-| f | true | 363 | 364 |  |
-| f | true | 364 | 361 |  |
+| f | true | 359 | 361 |  |
+| f | true | 361 | 283 |  |
+| f | true | 362 | 364 |  |
+| f | true | 364 | 313 |  |
 | f | true | 365 | 367 |  |
-| f | true | 367 | 275 |  |
-| f | true | 369 | 292 |  |
-| f | true | 373 | 369 |  |
-| f | true | 374 | 373 |  |
-| f | true | 378 | 324 |  |
-| f | true | 382 | 378 |  |
-| f | true | 383 | 382 |  |
-| getClass2 | false | 420 | 420 | getClass2 |
+| f | true | 367 | 315 |  |
+| f | true | 368 | 369 |  |
+| f | true | 369 | 165 |  |
+| f | true | 370 | 371 |  |
+| f | true | 371 | 368 |  |
+| getClass2 | false | 425 | 425 | getClass2 |

cpp/ql/test/library-tests/destructors/jump_destructs.expected

@@ -1,14 +1,14 @@
 | destructors2.cpp:5:7:5:7 | Class2 | 5 | return ... | 3 | 5 | Class2 |
 | destructors2.cpp:17:9:17:13 | Inner | 17 | return ... | 3 | 17 | Inner |
 | destructors2.cpp:18:9:18:14 | ~Inner | 18 | return ... | 3 | 18 | ~Inner |
-| destructors2.cpp:21:10:21:11 | f2 | 24 | return ... | 16 | 27 | c |
-| destructors2.cpp:21:10:21:11 | f2 | 24 | return ... | 17 | 27 | call to ~Class2 |
-| destructors2.cpp:21:10:21:11 | f2 | 24 | return ... | 18 | 21 | f2 |
+| destructors2.cpp:21:10:21:11 | f2 | 24 | return ... | 9 | 27 | c |
+| destructors2.cpp:21:10:21:11 | f2 | 24 | return ... | 10 | 27 | call to ~Class2 |
+| destructors2.cpp:21:10:21:11 | f2 | 24 | return ... | 20 | 21 | f2 |
 | destructors2.cpp:21:10:21:11 | f2 | 27 | return ... | 12 | 27 | inner |
 | destructors2.cpp:21:10:21:11 | f2 | 27 | return ... | 13 | 27 | call to ~Inner |
-| destructors2.cpp:21:10:21:11 | f2 | 27 | return ... | 16 | 27 | c |
-| destructors2.cpp:21:10:21:11 | f2 | 27 | return ... | 17 | 27 | call to ~Class2 |
-| destructors2.cpp:21:10:21:11 | f2 | 27 | return ... | 18 | 21 | f2 |
+| destructors2.cpp:21:10:21:11 | f2 | 27 | return ... | 14 | 27 | c |
+| destructors2.cpp:21:10:21:11 | f2 | 27 | return ... | 15 | 27 | call to ~Class2 |
+| destructors2.cpp:21:10:21:11 | f2 | 27 | return ... | 20 | 21 | f2 |
 | destructors.cpp:8:6:8:6 | f | 17 | goto ... | 26 | 21 | c31 |
 | destructors.cpp:8:6:8:6 | f | 17 | goto ... | 27 | 21 | call to ~C |
 | destructors.cpp:8:6:8:6 | f | 17 | goto ... | 28 | 26 | c20 |
@@ -19,11 +19,11 @@
 | destructors.cpp:8:6:8:6 | f | 19 | return ... | 35 | 21 | call to ~C |
 | destructors.cpp:8:6:8:6 | f | 19 | return ... | 36 | 26 | c20 |
 | destructors.cpp:8:6:8:6 | f | 19 | return ... | 37 | 26 | call to ~C |
-| destructors.cpp:8:6:8:6 | f | 19 | return ... | 90 | 35 | c10 |
-| destructors.cpp:8:6:8:6 | f | 19 | return ... | 91 | 35 | call to ~C |
-| destructors.cpp:8:6:8:6 | f | 19 | return ... | 92 | 8 | f |
+| destructors.cpp:8:6:8:6 | f | 19 | return ... | 38 | 35 | c10 |
+| destructors.cpp:8:6:8:6 | f | 19 | return ... | 39 | 35 | call to ~C |
+| destructors.cpp:8:6:8:6 | f | 19 | return ... | 94 | 8 | f |
 | destructors.cpp:8:6:8:6 | f | 35 | return ... | 81 | 35 | c11 |
 | destructors.cpp:8:6:8:6 | f | 35 | return ... | 82 | 35 | call to ~C |
-| destructors.cpp:8:6:8:6 | f | 35 | return ... | 90 | 35 | c10 |
-| destructors.cpp:8:6:8:6 | f | 35 | return ... | 91 | 35 | call to ~C |
-| destructors.cpp:8:6:8:6 | f | 35 | return ... | 92 | 8 | f |
+| destructors.cpp:8:6:8:6 | f | 35 | return ... | 83 | 35 | c10 |
+| destructors.cpp:8:6:8:6 | f | 35 | return ... | 84 | 35 | call to ~C |
+| destructors.cpp:8:6:8:6 | f | 35 | return ... | 94 | 8 | f |

cpp/ql/test/library-tests/literals/uuidof/uuidof.cpp

@@ -17,4 +17,9 @@ void GetUUID() {
     uuid = __uuidof(s);
     uuid = __uuidof(0);
 }
+
+template <typename Placeholder, typename ...>
+auto Wrapper = __uuidof(Placeholder);
+auto inst = Wrapper<S>;
+
 // semmle-extractor-options: --microsoft

cpp/ql/test/library-tests/literals/uuidof/uuidof.expected

@@ -12,3 +12,5 @@ uuidofOperators
 | uuidof.cpp:15:12:15:29 | __uuidof(S) | const _GUID | 01234567-89ab-cdef-0123-456789abcdef |
 | uuidof.cpp:17:12:17:22 | __uuidof(S) | const _GUID | 01234567-89ab-cdef-0123-456789abcdef |
 | uuidof.cpp:18:12:18:22 | __uuidof(0) | const _GUID | 00000000-0000-0000-0000-000000000000 |
+| uuidof.cpp:22:16:22:36 | __uuidof(Placeholder) | const _GUID |  |
+| uuidof.cpp:22:16:22:36 | __uuidof(S) | const _GUID | 01234567-89ab-cdef-0123-456789abcdef |

cpp/ql/test/library-tests/literals/uuidof/uuidof.ql

@@ -5,6 +5,6 @@ query predicate classUuids(Class cls, string uuid) {
 }
 
 query predicate uuidofOperators(UuidofOperator op, string type, string uuid) {
-  uuid = op.getValue() and
+  (if exists(op.getValue()) then uuid = op.getValue() else uuid = "") and
   type = op.getType().toString()
 }

cpp/ql/test/library-tests/string_concat/concat.cpp

@@ -0,0 +1,62 @@
+// #include <iostream>
+// #include <string>
+// #include <stdio.h>
+// #include <string.h>
+// #include <sstream>
+#include "stl.h"
+
+int sprintf(char *s, const char *format, ...);
+char *strcat(char * s1, const char * s2);
+
+using namespace std;
+
+
+void test1(){
+    string str1 = "Hello";
+    string str2 = "World";
+    string str3 = "!";
+    string str4 = "Concatenation";
+    string str5 = "is";
+    string str6 = "fun";
+
+    // Using the + operator
+    string result1 = str1 + " " + str2 + str3;
+
+    // Using the append() function
+    //----TODO: currently not modeled----
+    // string result2 = str4.append(" ") + str5.append(" ") + str6;
+
+    // Using the insert() function
+    //----TODO: currently not modeled----
+    // string result3 = str1.insert(5, " ") + str2.insert(5, "! ");
+
+    // Using the replace() function
+    //----TODO: currently not modeled----
+    // string result4 = str1.replace(0, 5, "Hi") + str2.replace(0, 5, "There");
+
+    // Using the push_back() function
+    //----TODO: currently not modeled----
+    // string result5;
+    // for (char c : str1) {
+    //     result5.push_back(c);
+    // }
+
+    // Using the stream operator
+    string result6;
+    std::stringstream ss;
+    ss << str1 << " " << str2 << str3;
+}
+
+
+void test2(char* ucstr) {
+    char str1[20] = "Hello";
+    char str2[20] = "World";
+    char result[40];
+    char *result2;
+
+    // Using sprintf
+    sprintf(result, "%s %s %s", str1, str2, ucstr);
+
+    // Using strcat
+    strcat(str1, ucstr);
+}

cpp/ql/test/library-tests/string_concat/stl.h

@@ -0,0 +1,644 @@
+
+typedef unsigned long size_t;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+#include "type_traits.h"
+
+namespace std
+{
+	template<class T> constexpr T&& forward(remove_reference_t<T>& t) noexcept;
+	template<class T> constexpr T&& forward(remove_reference_t<T>&& t) noexcept;
+}
+
+// --- iterator ---
+
+namespace std {
+	struct ptrdiff_t;
+
+	template<class I> struct iterator_traits;
+
+	template <class Category,
+			  class value_type,
+			  class difference_type = ptrdiff_t,
+			  class pointer_type = value_type*,
+			  class reference_type = value_type&>
+	struct iterator {
+		typedef Category iterator_category;
+
+		iterator();
+		iterator(iterator<Category, remove_const_t<value_type> > const &other); // non-const -> const conversion constructor
+
+		iterator &operator++();
+		iterator operator++(int);
+		iterator &operator--();
+		iterator operator--(int);
+		bool operator==(iterator other) const;
+		bool operator!=(iterator other) const;
+		reference_type operator*() const;
+		pointer_type operator->() const;
+		iterator operator+(int);
+		iterator operator-(int);
+		iterator &operator+=(int);
+		iterator &operator-=(int);
+		int operator-(iterator);
+		reference_type operator[](int);
+	};
+
+	struct input_iterator_tag {};
+	struct forward_iterator_tag : public input_iterator_tag {};
+	struct bidirectional_iterator_tag : public forward_iterator_tag {};
+	struct random_access_iterator_tag : public bidirectional_iterator_tag {};
+
+	struct output_iterator_tag {};
+
+	template<class Container>
+	class back_insert_iterator {
+	protected:
+		Container* container = nullptr;
+	public:
+		using iterator_category = output_iterator_tag;
+		using value_type = void;
+		using difference_type = ptrdiff_t;
+		using pointer = void;
+		using reference = void;
+		using container_type = Container;
+		constexpr back_insert_iterator() noexcept = default;
+		constexpr explicit back_insert_iterator(Container& x);
+		back_insert_iterator& operator=(const typename Container::value_type& value);
+		back_insert_iterator& operator=(typename Container::value_type&& value);
+		back_insert_iterator& operator*();
+		back_insert_iterator& operator++();
+		back_insert_iterator operator++(int);
+	};
+
+	template<class Container>
+	constexpr back_insert_iterator<Container> back_inserter(Container& x) {
+		return back_insert_iterator<Container>(x);
+	}
+
+	template<class Container>
+	class front_insert_iterator {
+	protected:
+		Container* container = nullptr;
+	public:
+		using iterator_category = output_iterator_tag;
+		using value_type = void;
+		using difference_type = ptrdiff_t;
+		using pointer = void;
+		using reference = void;
+		using container_type = Container;
+		constexpr front_insert_iterator() noexcept = default;
+		constexpr explicit front_insert_iterator(Container& x);
+		constexpr front_insert_iterator& operator=(const typename Container::value_type& value);
+		constexpr front_insert_iterator& operator=(typename Container::value_type&& value);
+		constexpr front_insert_iterator& operator*();
+		constexpr front_insert_iterator& operator++();
+		constexpr front_insert_iterator operator++(int);
+	};
+	template<class Container>
+	constexpr front_insert_iterator<Container> front_inserter(Container& x) {
+		return front_insert_iterator<Container>(x);
+	}
+}
+
+// --- string ---
+
+namespace std
+{
+	template<class charT> struct char_traits;
+
+	typedef size_t streamsize;
+
+	template <class T> class allocator {
+	public:
+		allocator() throw();
+		typedef size_t size_type;
+	};
+
+	template<class charT, class traits = char_traits<charT>, class Allocator = allocator<charT> >
+	class basic_string {
+	public:
+		using value_type = charT;
+		using reference = value_type&;
+		using const_reference = const value_type&;
+		typedef typename Allocator::size_type size_type;
+		static const size_type npos = -1;
+
+		explicit basic_string(const Allocator& a = Allocator());
+		basic_string(const charT* s, const Allocator& a = Allocator());
+		template<class InputIterator> basic_string(InputIterator begin, InputIterator end, const Allocator& a = Allocator());
+
+		const charT* c_str() const;
+		charT* data() noexcept;
+		size_t length() const;
+
+		typedef std::iterator<random_access_iterator_tag, charT> iterator;
+		typedef std::iterator<random_access_iterator_tag, const charT> const_iterator;
+
+		iterator begin();
+		iterator end();
+		const_iterator begin() const;
+		const_iterator end() const;
+		const_iterator cbegin() const;
+		const_iterator cend() const;
+
+		void push_back(charT c);
+
+		const charT& front() const;
+		charT& front();
+		const charT& back() const;
+		charT& back();
+
+		const_reference operator[](size_type pos) const;
+		reference operator[](size_type pos);
+		const_reference at(size_type n) const;
+		reference at(size_type n);
+		template<class T> basic_string& operator+=(const T& t);
+		basic_string& operator+=(const charT* s);
+		basic_string& append(const basic_string& str);
+		basic_string& append(const charT* s);
+		basic_string& append(size_type n, charT c);
+		template<class InputIterator> basic_string& append(InputIterator first, InputIterator last); 
+		basic_string& assign(const basic_string& str);
+		basic_string& assign(size_type n, charT c);
+		template<class InputIterator> basic_string& assign(InputIterator first, InputIterator last);
+		basic_string& insert(size_type pos, const basic_string& str);
+		basic_string& insert(size_type pos, size_type n, charT c);
+		basic_string& insert(size_type pos, const charT* s);
+		iterator insert(const_iterator p, size_type n, charT c);
+		template<class InputIterator> iterator insert(const_iterator p, InputIterator first, InputIterator last); 
+		basic_string& replace(size_type pos1, size_type n1, const basic_string& str);
+		basic_string& replace(size_type pos1, size_type n1, size_type n2, charT c);
+		size_type copy(charT* s, size_type n, size_type pos = 0) const;
+		void clear() noexcept;
+		basic_string substr(size_type pos = 0, size_type n = npos) const;
+		void swap(basic_string& s) noexcept/*(allocator_traits<Allocator>::propagate_on_container_swap::value || allocator_traits<Allocator>::is_always_equal::value)*/;
+	};
+
+	template<class charT, class traits, class Allocator> basic_string<charT, traits, Allocator> operator+(const basic_string<charT, traits, Allocator>& lhs, const basic_string<charT, traits, Allocator>& rhs);
+	template<class charT, class traits, class Allocator> basic_string<charT, traits, Allocator> operator+(const basic_string<charT, traits, Allocator>& lhs, const charT* rhs);
+
+	typedef basic_string<char> string;
+}
+
+// --- istring / ostream / stringstream ---
+
+namespace std
+{
+	template <class charT, class traits = char_traits<charT> >
+	class basic_istream /*: virtual public basic_ios<charT,traits> - not needed for this test */ {
+	public:
+		using char_type = charT;
+		using int_type = int; //typename traits::int_type;
+
+		basic_istream<charT, traits>& operator>>(int& n);
+
+		int_type get();
+		basic_istream<charT, traits>& get(char_type& c);
+		basic_istream<charT, traits>& get(char_type* s, streamsize n);
+		int_type peek();
+		basic_istream<charT, traits>& read (char_type* s, streamsize n);
+		streamsize readsome(char_type* s, streamsize n);
+		basic_istream<charT, traits>& putback(char_type c);
+		basic_istream<charT,traits>& unget();
+
+		basic_istream<charT,traits>& getline(char_type* s, streamsize n);
+		basic_istream<charT,traits>& getline(char_type* s, streamsize n, char_type delim);
+ 	};
+
+	template<class charT, class traits> basic_istream<charT, traits>& operator>>(basic_istream<charT, traits>&, charT*);
+	template<class charT, class traits, class Allocator> basic_istream<charT, traits>& operator>>(basic_istream<charT, traits>& is, basic_string<charT, traits, Allocator>& str); 
+
+	template<class charT, class traits, class Allocator> basic_istream<charT,traits>& getline(basic_istream<charT,traits>& is, basic_string<charT,traits,Allocator>& str, charT delim);
+	template<class charT, class traits, class Allocator> basic_istream<charT,traits>& getline(basic_istream<charT,traits>& is, basic_string<charT,traits,Allocator>& str);
+
+	template <class charT, class traits = char_traits<charT> >
+	class basic_ostream /*: virtual public basic_ios<charT,traits> - not needed for this test */ {
+	public:
+		typedef charT char_type;
+
+		basic_ostream<charT, traits>& operator<<(int n);
+
+		basic_ostream<charT, traits>& put(char_type c);
+		basic_ostream<charT, traits>& write(const char_type* s, streamsize n);
+		basic_ostream<charT,traits>& flush();
+	};
+
+	template<class charT, class traits> basic_ostream<charT,traits>& operator<<(basic_ostream<charT,traits>&, const charT*);
+	template<class charT, class traits, class Allocator> basic_ostream<charT, traits>& operator<<(basic_ostream<charT, traits>& os, const basic_string<charT, traits, Allocator>& str); 
+
+	template<class charT, class traits = char_traits<charT>>
+	class basic_iostream : public basic_istream<charT, traits>, public basic_ostream<charT, traits> {
+	public:
+	};
+
+	template<class charT, class traits = char_traits<charT>, class Allocator = allocator<charT>>
+	class basic_stringstream : public basic_iostream<charT, traits> {
+	public:
+		explicit basic_stringstream(/*ios_base::openmode which = ios_base::out|ios_base::in - not needed for this test*/);
+		explicit basic_stringstream( const basic_string<charT, traits, Allocator>& str/*, ios_base::openmode which = ios_base::out | ios_base::in*/);
+		basic_stringstream(const basic_stringstream& rhs) = delete;
+		basic_stringstream(basic_stringstream&& rhs);
+		basic_stringstream& operator=(const basic_stringstream& rhs) = delete;
+		basic_stringstream& operator=(basic_stringstream&& rhs);
+
+		void swap(basic_stringstream& rhs);
+
+		basic_string<charT, traits, Allocator> str() const;
+		void str(const basic_string<charT, traits, Allocator>& str);
+	};
+
+	typedef basic_istream<char> istream;
+	typedef basic_ostream<char> ostream;
+	extern istream cin;
+	extern ostream cout;
+
+	using stringstream = basic_stringstream<char>;
+}
+
+// --- vector ---
+
+namespace std {
+	template<class T, class Allocator = allocator<T>>
+	class vector { 
+	public:
+		using value_type = T;
+		using reference = value_type&;
+		using const_reference = const value_type&; 
+		using size_type = unsigned int;
+		using iterator = std::iterator<random_access_iterator_tag, T>;
+		using const_iterator = std::iterator<random_access_iterator_tag, const T>;
+
+		vector() noexcept(noexcept(Allocator())) : vector(Allocator()) { }
+		explicit vector(const Allocator&) noexcept;
+		explicit vector(size_type n, const Allocator& = Allocator());
+		vector(size_type n, const T& value, const Allocator& = Allocator());
+		template<class InputIterator, class IteratorCategory = typename InputIterator::iterator_category> vector(InputIterator first, InputIterator last, const Allocator& = Allocator());
+			// use of `iterator_category` makes sure InputIterator is (probably) an iterator, and not an `int` or
+			// similar that should match a different overload (SFINAE).
+		~vector();
+
+		vector& operator=(const vector& x);
+		vector& operator=(vector&& x) noexcept/*(allocator_traits<Allocator>::propagate_on_container_move_assignment::value || allocator_traits<Allocator>::is_always_equal::value)*/;
+		template<class InputIterator, class IteratorCategory = typename InputIterator::iterator_category> void assign(InputIterator first, InputIterator last);
+			// use of `iterator_category` makes sure InputIterator is (probably) an iterator, and not an `int` or
+			// similar that should match a different overload (SFINAE).
+		void assign(size_type n, const T& u);
+
+		iterator begin() noexcept;
+		const_iterator begin() const noexcept;
+		iterator end() noexcept;
+		const_iterator end() const noexcept;
+
+		size_type size() const noexcept;
+
+		reference operator[](size_type n);
+		const_reference operator[](size_type n) const;
+		const_reference at(size_type n) const;
+		reference at(size_type n);
+		reference front();
+		const_reference front() const;
+		reference back();
+		const_reference back() const;
+
+		T* data() noexcept;
+		const T* data() const noexcept;
+
+		void push_back(const T& x);
+		void push_back(T&& x);
+
+		iterator insert(const_iterator position, const T& x);
+		iterator insert(const_iterator position, T&& x);
+		iterator insert(const_iterator position, size_type n, const T& x);
+		template<class InputIterator> iterator insert(const_iterator position, InputIterator first, InputIterator last);
+
+		template <class... Args> iterator emplace (const_iterator position, Args&&... args);
+		template <class... Args> void emplace_back (Args&&... args);
+
+		void swap(vector&) noexcept/*(allocator_traits<Allocator>::propagate_on_container_swap::value || allocator_traits<Allocator>::is_always_equal::value)*/;
+
+		void clear() noexcept;
+	};
+}
+
+// --- make_shared / make_unique ---
+
+namespace std {
+	template<typename T>
+	class shared_ptr {
+	public:
+		shared_ptr() noexcept;
+		explicit shared_ptr(T*);
+		shared_ptr(const shared_ptr&) noexcept;
+		template<class U> shared_ptr(const shared_ptr<U>&) noexcept;
+		template<class U> shared_ptr(shared_ptr<U>&&) noexcept;
+
+		shared_ptr<T>& operator=(const shared_ptr<T>&) noexcept;
+		shared_ptr<T>& operator=(shared_ptr<T>&&) noexcept;
+
+		T& operator*() const noexcept;
+		T* operator->() const noexcept;
+
+		T* get() const noexcept;
+	};
+
+	template<typename T>
+	class unique_ptr {
+	public:
+		constexpr unique_ptr() noexcept;
+		explicit unique_ptr(T*) noexcept;
+		unique_ptr(unique_ptr<T>&&) noexcept;
+
+		unique_ptr<T>& operator=(unique_ptr<T>&&) noexcept;
+
+		T& operator*() const;
+		T* operator->() const noexcept;
+
+		T* get() const noexcept;
+	};
+
+	template<typename T, class... Args> unique_ptr<T> make_unique(Args&&...);
+
+	template<typename T, class... Args> shared_ptr<T> make_shared(Args&&...);
+}
+
+// --- pair ---
+
+namespace std {
+	template <class T1, class T2>
+	struct pair {
+		typedef T1 first_type;
+		typedef T2 second_type;
+
+		T1 first;
+		T2 second;
+		pair();
+		pair(const T1& x, const T2& y) : first(x), second(y) {};
+		template<class U, class V> pair(const pair<U, V> &p);
+
+		void swap(pair& p) /*noexcept(...)*/;
+	};
+
+	template<class T1, class T2> constexpr pair<decay_t<T1>, decay_t<T2>> make_pair(T1&& x, T2&& y) {
+		return pair<decay_t<T1>, decay_t<T2>>(std::forward<T1>(x), std::forward<T2>(y));
+	}
+}
+
+// --- map ---
+
+namespace std {
+	template<class T = void> struct less;
+
+	template<class Key, class T, class Compare = less<Key>, class Allocator = allocator<pair<const Key, T>>>
+	class map {
+	public:
+		using key_type = Key;
+		using mapped_type = T;
+		using value_type = pair<const Key, T>;
+		using iterator = std::iterator<random_access_iterator_tag, value_type >;
+		using const_iterator = std::iterator<random_access_iterator_tag, const value_type >;
+
+		map() /*: map(Compare()) { }*/;
+		map(const map& x);
+		map(map&& x);
+		~map();
+
+		map& operator=(const map& x);
+		map& operator=(map&& x) /*noexcept(allocator_traits<Allocator>::is_always_equal::value && is_nothrow_move_assignable_v<Compare>)*/;
+
+		iterator begin() noexcept;
+		const_iterator begin() const noexcept;
+		iterator end() noexcept;
+		const_iterator end() const noexcept;
+
+		T& operator[](const key_type& x);
+		T& operator[](key_type&& x);
+		T& at(const key_type& x);
+		const T& at(const key_type& x) const;
+
+		template<class... Args> pair<iterator, bool> emplace(Args&&... args);
+		template<class... Args> iterator emplace_hint(const_iterator position, Args&&... args);
+
+		pair<iterator, bool> insert(const value_type& x);
+		pair<iterator, bool> insert(value_type&& x);
+		iterator insert(const_iterator position, const value_type& x);
+		iterator insert(const_iterator position, value_type&& x);
+
+		template<class... Args> pair<iterator, bool> try_emplace(const key_type& k, Args&&... args);
+		template<class... Args> pair<iterator, bool> try_emplace(key_type&& k, Args&&... args);
+		template<class... Args> iterator try_emplace(const_iterator hint, const key_type& k, Args&&... args);
+		template<class... Args> iterator try_emplace(const_iterator hint, key_type&& k, Args&&... args);
+		template<class M> pair<iterator, bool> insert_or_assign(const key_type& k, M&& obj);
+		template<class M> pair<iterator, bool> insert_or_assign(key_type&& k, M&& obj);
+		template<class M> iterator insert_or_assign(const_iterator hint, const key_type& k, M&& obj);
+		template<class M> iterator insert_or_assign(const_iterator hint, key_type&& k, M&& obj);
+
+		iterator erase(iterator position);
+		iterator erase(const_iterator position);
+		iterator erase(const_iterator first, const_iterator last);
+		void swap(map&) /*noexcept(/*==allocator_traits<Allocator>::is_always_equal::value && is_nothrow_swappable_v<Compare>)*/;
+		void clear() noexcept;
+
+		template<class C2> void merge(map<Key, T, C2, Allocator>& source);
+		template<class C2> void merge(map<Key, T, C2, Allocator>&& source);
+
+		iterator find(const key_type& x);
+		const_iterator find(const key_type& x) const;
+
+		iterator lower_bound(const key_type& x);
+		const_iterator lower_bound(const key_type& x) const;
+		iterator upper_bound(const key_type& x);
+		const_iterator upper_bound(const key_type& x) const;
+
+		pair<iterator, iterator> equal_range(const key_type& x);
+		pair<const_iterator, const_iterator> equal_range(const key_type& x) const;
+	};
+
+	template<class T> struct hash;
+	template<class T = void> struct equal_to;
+
+	template<class Key, class T, class Hash = hash<Key>, class Pred = equal_to<Key>, class Allocator = allocator<pair<const Key, T>>>
+	class unordered_map {
+	public:
+		using key_type = Key;
+		using mapped_type = T;
+		using value_type = pair<const Key, T>;
+		using iterator = std::iterator<random_access_iterator_tag, value_type >;
+		using const_iterator = std::iterator<random_access_iterator_tag, const value_type >;
+
+		unordered_map();
+		unordered_map(const unordered_map&);
+		unordered_map(unordered_map&&);
+		~unordered_map();
+
+		unordered_map& operator=(const unordered_map&);
+		unordered_map& operator=(unordered_map&&) /*noexcept(allocator_traits<Allocator>::is_always_equal::value && is_nothrow_move_assignable_v<Hash> && is_nothrow_move_assignable_v<Pred>)*/;
+
+		iterator begin() noexcept;
+		const_iterator begin() const noexcept;
+		iterator end() noexcept;
+		const_iterator end() const noexcept;
+
+		mapped_type& operator[](const key_type& k);
+		mapped_type& operator[](key_type&& k);
+		mapped_type& at(const key_type& k);
+		const mapped_type& at(const key_type& k) const;
+		
+		template<class... Args> pair<iterator, bool> emplace(Args&&... args);
+		template<class... Args> iterator emplace_hint(const_iterator position, Args&&... args);
+
+		pair<iterator, bool> insert(const value_type& obj);
+		pair<iterator, bool> insert(value_type&& obj);
+		iterator insert(const_iterator hint, const value_type& obj);
+		iterator insert(const_iterator hint, value_type&& obj);
+
+		template<class... Args> pair<iterator, bool> try_emplace(const key_type& k, Args&&... args);
+		template<class... Args> pair<iterator, bool> try_emplace(key_type&& k, Args&&... args);
+		template<class... Args> iterator try_emplace(const_iterator hint, const key_type& k, Args&&... args);
+		template<class... Args> iterator try_emplace(const_iterator hint, key_type&& k, Args&&... args);
+		template<class M> pair<iterator, bool> insert_or_assign(const key_type& k, M&& obj);
+		template<class M> pair<iterator, bool> insert_or_assign(key_type&& k, M&& obj);
+		template<class M> iterator insert_or_assign(const_iterator hint, const key_type& k, M&& obj);
+		template<class M> iterator insert_or_assign(const_iterator hint, key_type&& k, M&& obj);
+
+		iterator erase(iterator position);
+		iterator erase(const_iterator position);
+		iterator erase(const_iterator first, const_iterator last);
+		void swap(unordered_map&) /*noexcept(allocator_traits<Allocator>::is_always_equal::value && is_nothrow_swappable_v<Hash> && is_nothrow_swappable_v<Pred>)*/;
+		void clear() noexcept;
+
+		template<class H2, class P2> void merge(unordered_map<Key, T, H2, P2, Allocator>& source);
+		template<class H2, class P2> void merge(unordered_map<Key, T, H2, P2, Allocator>&& source);
+
+		iterator find(const key_type& k);
+		const_iterator find(const key_type& k) const;
+
+		pair<iterator, iterator> equal_range(const key_type& k);
+		pair<const_iterator, const_iterator> equal_range(const key_type& k) const;
+	};
+};
+
+// --- set ---
+
+namespace std {
+	template<class Key, class Compare = less<Key>, class Allocator = allocator<Key>>
+	class set {
+	public:
+		using key_type = Key;
+		using value_type = Key;
+		using size_type = size_t;
+		using allocator_type = Allocator;
+		using iterator = std::iterator<random_access_iterator_tag, value_type >;
+		using const_iterator = std::iterator<random_access_iterator_tag, const value_type >;
+
+		set() /*: set(Compare())*/ { }
+		set(const set& x);
+		set(set&& x);
+		template<class InputIterator> set(InputIterator first, InputIterator last/*, const Compare& comp = Compare(), const Allocator& = Allocator()*/);
+		~set();
+		
+		set& operator=(const set& x);
+		set& operator=(set&& x) noexcept/*(allocator_traits<Allocator>::is_always_equal::value && is_nothrow_move_assignable_v<Compare>)*/;
+
+		iterator begin() noexcept;
+		const_iterator begin() const noexcept;
+		iterator end() noexcept;
+		const_iterator end() const noexcept;
+
+		template<class... Args> pair<iterator, bool> emplace(Args&&... args);
+		template<class... Args> iterator emplace_hint(const_iterator position, Args&&... args);
+		pair<iterator,bool> insert(const value_type& x);
+		pair<iterator,bool> insert(value_type&& x);
+		iterator insert(const_iterator position, const value_type& x);
+		iterator insert(const_iterator position, value_type&& x);
+		template<class InputIterator> void insert(InputIterator first, InputIterator last); 
+		
+		iterator erase(iterator position);
+		iterator erase(const_iterator position);
+		iterator erase(const_iterator first, const_iterator last); 
+		void swap(set&) noexcept/*(allocator_traits<Allocator>::is_always_equal::value && is_nothrow_swappable_v<Compare>)*/;
+		void clear() noexcept;
+
+		template<class C2> void merge(set<Key, C2, Allocator>& source);
+		template<class C2> void merge(set<Key, C2, Allocator>&& source);
+
+		iterator find(const key_type& x);
+		const_iterator find(const key_type& x) const;
+		
+		iterator lower_bound(const key_type& x);
+		const_iterator lower_bound(const key_type& x) const;
+		iterator upper_bound(const key_type& x);
+		const_iterator upper_bound(const key_type& x) const;
+		pair<iterator, iterator> equal_range(const key_type& x);
+		pair<const_iterator, const_iterator> equal_range(const key_type& x) const;
+	};
+
+	template<class Key, class Hash = hash<Key>, class Pred = equal_to<Key>, class Allocator = allocator<Key>>
+	class unordered_set { 
+	public:
+		using key_type = Key;
+		using value_type = Key;
+		using hasher = Hash;
+		using key_equal = Pred;
+		using allocator_type = Allocator;
+		using size_type = size_t;
+		using iterator = std::iterator<random_access_iterator_tag, value_type >;
+		using const_iterator = std::iterator<random_access_iterator_tag, const value_type >;
+
+		unordered_set();
+		unordered_set(const unordered_set&);
+		unordered_set(unordered_set&&);
+		template<class InputIterator> unordered_set(InputIterator f, InputIterator l, size_type n = 0/*, const hasher& hf = hasher(), const key_equal& eql = key_equal(), const allocator_type& a = allocator_type()*/);
+		~unordered_set();
+
+		unordered_set& operator=(const unordered_set&);
+		unordered_set& operator=(unordered_set&&) noexcept/*(allocator_traits<Allocator>::is_always_equal::value && is_nothrow_move_assignable_v<Hash> && is_nothrow_move_assignable_v<Pred>)*/;
+		
+		iterator begin() noexcept;
+		const_iterator begin() const noexcept;
+		iterator end() noexcept;
+		const_iterator end() const noexcept;
+
+		template<class... Args> pair<iterator, bool> emplace(Args&&... args);
+		template<class... Args> iterator emplace_hint(const_iterator position, Args&&... args);
+		pair<iterator, bool> insert(const value_type& obj);
+		pair<iterator, bool> insert(value_type&& obj);
+		iterator insert(const_iterator hint, const value_type& obj);
+		iterator insert(const_iterator hint, value_type&& obj);
+		template<class InputIterator> void insert(InputIterator first, InputIterator last); 
+
+		iterator erase(iterator position);
+		iterator erase(const_iterator position);
+		iterator erase(const_iterator first, const_iterator last);
+		void swap(unordered_set&) noexcept/*(allocator_traits<Allocator>::is_always_equal::value && is_nothrow_swappable_v<Hash> && is_nothrow_swappable_v<Pred>)*/;
+		void clear() noexcept;
+
+		template<class H2, class P2> void merge(unordered_set<Key, H2, P2, Allocator>& source);
+		template<class H2, class P2> void merge(unordered_set<Key, H2, P2, Allocator>&& source);
+
+		iterator find(const key_type& k);
+		const_iterator find(const key_type& k) const;
+		pair<iterator, iterator> equal_range(const key_type& k);
+		pair<const_iterator, const_iterator> equal_range(const key_type& k) const;
+	};
+}

cpp/ql/test/library-tests/string_concat/strconcat.expected

@@ -0,0 +1,22 @@
+| concat.cpp:23:27:23:27 | call to operator+ | concat.cpp:23:22:23:25 | str1 | concat.cpp:23:22:23:31 | call to operator+ |
+| concat.cpp:23:27:23:27 | call to operator+ | concat.cpp:23:22:23:25 | str1 | concat.cpp:23:22:23:31 | call to operator+ |
+| concat.cpp:23:27:23:27 | call to operator+ | concat.cpp:23:22:23:25 | str1 | concat.cpp:23:27:23:27 | call to operator+ |
+| concat.cpp:23:27:23:27 | call to operator+ | concat.cpp:23:29:23:31 |   | concat.cpp:23:22:23:31 | call to operator+ |
+| concat.cpp:23:27:23:27 | call to operator+ | concat.cpp:23:29:23:31 |   | concat.cpp:23:22:23:31 | call to operator+ |
+| concat.cpp:23:27:23:27 | call to operator+ | concat.cpp:23:29:23:31 |   | concat.cpp:23:27:23:27 | call to operator+ |
+| concat.cpp:23:33:23:33 | call to operator+ | concat.cpp:23:35:23:38 | str2 | concat.cpp:23:22:23:38 | call to operator+ |
+| concat.cpp:23:33:23:33 | call to operator+ | concat.cpp:23:35:23:38 | str2 | concat.cpp:23:22:23:38 | call to operator+ |
+| concat.cpp:23:33:23:33 | call to operator+ | concat.cpp:23:35:23:38 | str2 | concat.cpp:23:33:23:33 | call to operator+ |
+| concat.cpp:23:40:23:40 | call to operator+ | concat.cpp:23:42:23:45 | str3 | concat.cpp:23:40:23:40 | call to operator+ |
+| concat.cpp:47:8:47:8 | call to operator<< | concat.cpp:47:11:47:14 | str1 | concat.cpp:47:8:47:17 | call to operator<< |
+| concat.cpp:47:16:47:16 | call to operator<< | concat.cpp:47:19:47:21 |   | concat.cpp:47:16:47:24 | call to operator<< |
+| concat.cpp:47:23:47:23 | call to operator<< | concat.cpp:47:26:47:29 | str2 | concat.cpp:47:23:47:32 | call to operator<< |
+| concat.cpp:47:31:47:31 | call to operator<< | concat.cpp:47:34:47:37 | str3 | concat.cpp:47:31:47:38 | call to operator<< |
+| concat.cpp:58:5:58:11 | call to sprintf | concat.cpp:58:21:58:30 | %s %s %s | concat.cpp:58:13:58:18 | sprintf output argument |
+| concat.cpp:58:5:58:11 | call to sprintf | concat.cpp:58:33:58:36 | str1 | concat.cpp:58:13:58:18 | sprintf output argument |
+| concat.cpp:58:5:58:11 | call to sprintf | concat.cpp:58:39:58:42 | str2 | concat.cpp:58:13:58:18 | sprintf output argument |
+| concat.cpp:58:5:58:11 | call to sprintf | concat.cpp:58:45:58:49 | ucstr | concat.cpp:58:13:58:18 | sprintf output argument |
+| concat.cpp:61:5:61:10 | call to strcat | concat.cpp:61:12:61:15 | str1 | concat.cpp:61:5:61:10 | call to strcat |
+| concat.cpp:61:5:61:10 | call to strcat | concat.cpp:61:12:61:15 | str1 | concat.cpp:61:12:61:15 | strcat output argument |
+| concat.cpp:61:5:61:10 | call to strcat | concat.cpp:61:18:61:22 | ucstr | concat.cpp:61:5:61:10 | call to strcat |
+| concat.cpp:61:5:61:10 | call to strcat | concat.cpp:61:18:61:22 | ucstr | concat.cpp:61:12:61:15 | strcat output argument |

cpp/ql/test/library-tests/string_concat/strconcat.ql

@@ -0,0 +1,10 @@
+import cpp
+import semmle.code.cpp.commons.StringConcatenation
+import semmle.code.cpp.dataflow.new.DataFlow
+
+from StringConcatenation s, Expr op, DataFlow::Node res
+where
+  s.getLocation().getFile().getBaseName() = "concat.cpp" and
+  op = s.getAnOperand() and
+  res = s.getResultNode()
+select s, op, res

cpp/ql/test/library-tests/string_concat/type_traits.h

@@ -0,0 +1,35 @@
+template<class T>
+struct remove_const { typedef T type; };
+
+template<class T>
+struct remove_const<const T> { typedef T type; };
+
+// `remove_const_t<T>` removes any `const` specifier from `T`
+template<class T>
+using remove_const_t = typename remove_const<T>::type;
+
+template<class T>
+struct remove_reference { typedef T type; };
+
+template<class T>
+struct remove_reference<T &> { typedef T type; };
+
+template<class T>
+struct remove_reference<T &&> { typedef T type; };
+
+// `remove_reference_t<T>` removes any `&` from `T`
+template<class T>
+using remove_reference_t = typename remove_reference<T>::type;
+
+template<class T>
+struct decay_impl {
+    typedef T type;
+};
+
+template<class T, size_t t_size>
+struct decay_impl<T[t_size]> {
+    typedef T* type;
+};
+
+template<class T>
+using decay_t = typename decay_impl<remove_reference_t<T>>::type;

cpp/ql/test/library-tests/syntax-zoo/dataflow-consistency.expected

@@ -99,3 +99,4 @@ uniqueContentApprox
 identityLocalStep
 missingArgumentCall
 multipleArgumentCall
+lambdaCallEnclosingCallableMismatch

cpp/ql/test/library-tests/syntax-zoo/dataflow-ir-consistency.expected

@@ -42,3 +42,4 @@ uniqueContentApprox
 identityLocalStep
 missingArgumentCall
 multipleArgumentCall
+lambdaCallEnclosingCallableMismatch

cpp/ql/test/query-tests/jsf/4.06 Pre-Processing Directives/AV Rule 32/test.c

@@ -1,3 +1,4 @@
-#include "test.H"
-#include "test.xpm"
-#include "test2.c"
+#include "test.H"    // GOOD
+#include "test.xpm"  // GOOD
+#include "test2.c"   // BAD
+#include "test.def"  // GOOD

csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/FilePathFilter.cs

@@ -74,16 +74,18 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
                         includeByDefault)
                 });
 
-            // Move included pathfilters to the front of the list:
-            pathFilters.Sort((pf1, pf2) => -1 * pf1.Include.CompareTo(pf2.Include));
             return unfilteredResult.Where(f =>
             {
                 var include = f.FileInclusion.Include;
-                foreach (var pathFilter in pathFilters)
+                // LGTM_INDEX_FILTERS is a prioritized list, where later filters take
+                // priority over earlier ones.
+                for (int i = pathFilters.Count - 1; i >= 0; i--)
                 {
+                    var pathFilter = pathFilters[i];
                     if (pathFilter.Regex.IsMatch(f.FileInclusion.Path))
                     {
                         include = pathFilter.Include;
+                        break;
                     }
                 }
 

csharp/extractor/Semmle.Extraction.CSharp/Entities/OrdinaryMethod.cs

@@ -18,7 +18,12 @@ namespace Semmle.Extraction.CSharp.Entities
 
         public IMethodSymbol SourceDeclaration => Symbol.OriginalDefinition;
 
-        public override Microsoft.CodeAnalysis.Location ReportingLocation => Symbol.GetSymbolLocation();
+        public override Microsoft.CodeAnalysis.Location ReportingLocation =>
+            IsCompilerGeneratedDelegate()
+                ? Symbol.ContainingType.GetSymbolLocation()
+                : Symbol.GetSymbolLocation();
+
+        public override bool NeedsPopulation => base.NeedsPopulation || IsCompilerGeneratedDelegate();
 
         public override void Populate(TextWriter trapFile)
         {
@@ -47,6 +52,13 @@ namespace Semmle.Extraction.CSharp.Entities
             ExtractCompilerGenerated(trapFile);
         }
 
+        private bool IsCompilerGeneratedDelegate() =>
+            // Lambdas with parameter defaults or a `params` parameter are implemented
+            // using compiler generated delegate types.
+            Symbol.MethodKind == MethodKind.DelegateInvoke &&
+            Symbol.ContainingType is INamedTypeSymbol nt &&
+            nt.IsImplicitlyDeclared;
+
         public static new OrdinaryMethod Create(Context cx, IMethodSymbol method)
         {
             if (method.MethodKind == MethodKind.ReducedExtension)

csharp/extractor/Semmle.Extraction.Tests/FilePathFilter.cs

@@ -165,6 +165,7 @@ namespace Semmle.Extraction.Tests
         {
             (var testSubject, var progressMonitor, var files) = TestSetup();
 
+            // NOTE: the ordering DOES matter, later filters takes priority, so the exclude will end up not mattering at all.
             Environment.SetEnvironmentVariable("LGTM_INDEX_FILTERS", """
                 exclude:c/x/z
                 include:c/x
@@ -174,7 +175,8 @@ namespace Semmle.Extraction.Tests
 
             var expected = GetExpected(
                 [
-                    "/a/b/c/x/y/i.cs"
+                    "/a/b/c/x/y/i.cs",
+                    "/a/b/c/x/z/i.cs"
                 ]);
 
             AssertFileInfoEquivalence(expected, filtered);

csharp/ql/campaigns/Solorigate/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-all
-version: 1.7.6
+version: 1.7.7-dev
 groups:
   - csharp
   - solorigate

csharp/ql/campaigns/Solorigate/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-queries
-version: 1.7.6
+version: 1.7.7-dev
 groups:
   - csharp
   - solorigate

csharp/ql/lib/change-notes/2024-01-10-lambda-param-defaults.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* C# 12: Add extractor support for lambda expressions with parameter defaults like `(int x, int y = 1) => ...` and lambda expressions with a `param` parameter like `(params int[] x) => ...)`.

csharp/ql/lib/change-notes/2024-01-11-manual-neutral-model-blocks-generated-models.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* A manual neutral summary model for a callable now blocks all generated summary models for that callable from having any effect.

csharp/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-all
-version: 0.8.6
+version: 0.8.7-dev
 groups: csharp
 dbscheme: semmlecode.csharp.dbscheme
 extractor: csharp

csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowDispatch.qll

@@ -148,17 +148,17 @@ private module Cached {
 import Cached
 
 private module DispatchImpl {
-  /**
-   * Holds if the set of viable implementations that can be called by `call`
-   * might be improved by knowing the call context. This is the case if the
-   * call is a delegate call, or if the qualifier accesses a parameter of
-   * the enclosing callable `c` (including the implicit `this` parameter).
-   */
-  predicate mayBenefitFromCallContext(DataFlowCall call, DataFlowCallable c) {
+  private predicate mayBenefitFromCallContext(DataFlowCall call, DataFlowCallable c) {
     c = call.getEnclosingCallable() and
     call.(NonDelegateDataFlowCall).getDispatchCall().mayBenefitFromCallContext()
   }
 
+  /**
+   * Holds if the set of viable implementations that can be called by `call`
+   * might be improved by knowing the call context.
+   */
+  predicate mayBenefitFromCallContext(DataFlowCall call) { mayBenefitFromCallContext(call, _) }
+
   /**
    * Gets a viable dispatch target of `call` in the context `ctx`. This is
    * restricted to those `call`s for which a context might make a difference.

csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImplSpecific.qll

@@ -20,4 +20,8 @@ module CsharpDataFlow implements InputSig {
   Node exprNode(DataFlowExpr e) { result = Public::exprNode(e) }
 
   predicate accessPathLimit = Private::accessPathLimit/0;
+
+  predicate mayBenefitFromCallContext = Private::mayBenefitFromCallContext/1;
+
+  predicate viableImplInCallContext = Private::viableImplInCallContext/2;
 }

csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll

@@ -529,6 +529,13 @@ private predicate interpretSummary(
   )
 }
 
+private predicate interpretNeutral(UnboundCallable c, string kind, string provenance) {
+  exists(string namespace, string type, string name, string signature |
+    neutralModel(namespace, type, name, signature, kind, provenance) and
+    c = interpretElement(namespace, type, false, name, signature, "")
+  )
+}
+
 // adapter class for converting Mad summaries to `SummarizedCallable`s
 private class SummarizedCallableAdapter extends SummarizedCallable {
   SummarizedCallableAdapter() { interpretSummary(this, _, _, _, _) }
@@ -544,6 +551,10 @@ private class SummarizedCallableAdapter extends SummarizedCallable {
     exists(Provenance provenance |
       interpretSummary(this, input, output, kind, provenance) and
       provenance.isGenerated()
+    ) and
+    not exists(Provenance provenance |
+      interpretNeutral(this, "summary", provenance) and
+      provenance.isManual()
     )
   }
 
@@ -568,12 +579,7 @@ private class NeutralCallableAdapter extends NeutralCallable {
   string kind;
   string provenance_;
 
-  NeutralCallableAdapter() {
-    exists(string namespace, string type, string name, string signature |
-      neutralModel(namespace, type, name, signature, kind, provenance_) and
-      this = interpretElement(namespace, type, false, name, signature, "")
-    )
-  }
+  NeutralCallableAdapter() { interpretNeutral(this, kind, provenance_) }
 
   override string getKind() { result = kind }
 

csharp/ql/lib/semmle/code/csharp/exprs/Call.qll

@@ -60,18 +60,17 @@ class Call extends DotNet::Call, Expr, @call {
    */
   cached
   override Expr getArgumentForParameter(DotNet::Parameter p) {
+    // Appears in the positional part of the call
+    result = this.getImplicitArgument(p)
+    or
+    // Appears in the named part of the call
     this.getTarget().getAParameter() = p and
-    (
-      // Appears in the positional part of the call
-      result = this.getImplicitArgument(p)
-      or
-      // Appears in the named part of the call
-      result = this.getExplicitArgument(p.getName())
-    )
+    result = this.getExplicitArgument(p.getName())
   }
 
   pragma[noinline]
   private Expr getImplicitArgument(DotNet::Parameter p) {
+    this.getTarget().getAParameter() = p and
     not exists(result.getExplicitArgumentName()) and
     (
       p.(Parameter).isParams() and
@@ -182,15 +181,39 @@ class Call extends DotNet::Call, Expr, @call {
   /**
    * Gets the argument that corresponds to parameter `p` of a potential
    * run-time target of this call.
+   *
+   * This takes into account both positional and named arguments, but does not
+   * consider default arguments.
    */
+  cached
   Expr getRuntimeArgumentForParameter(Parameter p) {
-    exists(Callable c |
-      c = this.getARuntimeTarget() and
-      p = c.getAParameter() and
+    // Appears in the positional part of the call
+    result = this.getImplicitRuntimeArgument(p)
+    or
+    // Appears in the named part of the call
+    this.getARuntimeTarget().getAParameter() = p and
+    result = this.getExplicitRuntimeArgument(p.getName())
+  }
+
+  pragma[noinline]
+  private Expr getImplicitRuntimeArgument(Parameter p) {
+    this.getARuntimeTarget().getAParameter() = p and
+    not exists(result.getExplicitArgumentName()) and
+    (
+      p.isParams() and
+      result = this.getRuntimeArgument(any(int i | i >= p.getPosition()))
+      or
+      not p.isParams() and
       result = this.getRuntimeArgument(p.getPosition())
     )
   }
 
+  pragma[nomagic]
+  private Expr getExplicitRuntimeArgument(string name) {
+    result = this.getARuntimeArgument() and
+    result.getExplicitArgumentName() = name
+  }
+
   /**
    * Gets the argument that corresponds to a parameter named `name` of a potential
    * run-time target of this call.

csharp/ql/lib/upgrades/6b8962d52bd5ed58edb163f78467074fd7e1a127/upgrade.properties

@@ -1,2 +1,7 @@
 description: Remove unused VCS relations.
 compatibility: backwards
+
+svnaffectedfiles.rel: delete
+svnchurn.rel: delete
+svnentries.rel: delete
+svnentrymsg.rel: delete

csharp/ql/lib/upgrades/90fdbc8f87761f223ef7723e4b421c5b26ecc15e/upgrade.properties

@@ -2,3 +2,5 @@ description: Support type annotations
 compatibility: backwards
 
 type_annotation.rel: run type_annotation.qlo
+ref_readonly_returns.rel: delete
+ref_returns.rel: delete

csharp/ql/lib/upgrades/f93793ee5f6b7bec615eaa1af0a1a4dea19472bb/upgrade.properties

@@ -1,2 +1,5 @@
 description: Implement structured nullability 
 compatibility: backwards
+
+specific_type_parameter_annotation.rel: delete
+type_argument_annotation.rel: delete

csharp/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-queries
-version: 0.8.6
+version: 0.8.7-dev
 groups:
   - csharp
   - queries

csharp/ql/src/utils/modelgenerator/CaptureDiscardedSummaryModels.ql

@@ -1,15 +0,0 @@
-/**
- * @name Capture discarded summary models.
- * @description Finds summary models that are discarded as handwritten counterparts exist.
- * @id cs/utils/modelgenerator/discarded-summary-models
- */
-
-import semmle.code.csharp.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl
-import internal.CaptureModels
-import internal.CaptureSummaryFlowQuery
-
-from DataFlowTargetApi api, string flow
-where
-  flow = captureFlow(api) and
-  api.(FlowSummaryImpl::Public::SummarizedCallable).applyManualModel()
-select flow order by flow

csharp/ql/src/utils/modelgenerator/CaptureNeutralModels.ql

@@ -11,7 +11,5 @@ import internal.CaptureModels
 import internal.CaptureSummaryFlowQuery
 
 from DataFlowTargetApi api, string noflow
-where
-  noflow = captureNoFlow(api) and
-  not api.(FlowSummaryImpl::Public::SummarizedCallable).applyManualModel()
+where noflow = captureNoFlow(api)
 select noflow order by noflow

csharp/ql/src/utils/modelgenerator/CaptureSummaryModels.ql

@@ -11,7 +11,5 @@ import internal.CaptureModels
 import internal.CaptureSummaryFlowQuery
 
 from DataFlowTargetApi api, string flow
-where
-  flow = captureFlow(api) and
-  not api.(FlowSummaryImpl::Public::SummarizedCallable).applyManualModel()
+where flow = captureFlow(api)
 select flow order by flow

csharp/ql/src/utils/modelgenerator/internal/CaptureModelsSpecific.qll

@@ -7,6 +7,7 @@ private import dotnet
 private import semmle.code.csharp.commons.Util as Util
 private import semmle.code.csharp.commons.Collections as Collections
 private import semmle.code.csharp.dataflow.internal.DataFlowDispatch
+private import semmle.code.csharp.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl
 private import semmle.code.csharp.frameworks.system.linq.Expressions
 import semmle.code.csharp.dataflow.internal.ExternalFlow as ExternalFlow
 import semmle.code.csharp.dataflow.internal.DataFlowImplCommon as DataFlowImplCommon
@@ -37,7 +38,10 @@ private predicate isRelevantForModels(CS::Callable api) {
   not api instanceof Util::MainMethod and
   not api instanceof CS::Destructor and
   not api instanceof CS::AnonymousFunctionExpr and
-  not api.(CS::Constructor).isParameterless()
+  not api.(CS::Constructor).isParameterless() and
+  // Disregard all APIs that have a manual model.
+  not api = any(FlowSummaryImpl::Public::SummarizedCallable sc | sc.applyManualModel()) and
+  not api = any(FlowSummaryImpl::Public::NeutralSummaryCallable sc | sc.hasManualModel())
 }
 
 /**

csharp/ql/test/library-tests/arguments/PrintAst.expected

@@ -353,3 +353,98 @@ arguments.cs:
 #   93|       0: [Parameter] b
 #   93|         -1: [TypeMention] bool
 #   93|     4: [BlockStmt] {...}
+lambdas.cs:
+#    3| [Class] LambdaArgumentsTest
+#    5|   5: [Method] M1
+#    5|     -1: [TypeMention] Void
+#    6|     4: [BlockStmt] {...}
+#    7|       0: [LocalVariableDeclStmt] ... ...;
+#    7|         0: [LocalVariableDeclAndInitExpr] Func<Int32,Int32> l1 = ...
+#    7|           -1: [TypeMention] Func<int, int>
+#    7|           0: [LocalVariableAccess] access to local variable l1
+#    7|           1: [LambdaExpr] (...) => ...
+#-----|             2: (Parameters)
+#    7|               0: [Parameter] x
+#    7|                 -1: [TypeMention] int
+#    7|             4: [AddExpr] ... + ...
+#    7|               0: [ParameterAccess] access to parameter x
+#    7|               1: [IntLiteral] 1
+#    8|       1: [ExprStmt] ...;
+#    8|         0: [DelegateCall] delegate call
+#    8|           -1: [LocalVariableAccess] access to local variable l1
+#    8|           0: [IntLiteral] 1
+#   10|       2: [LocalVariableDeclStmt] ... ...;
+#   10|         0: [LocalVariableDeclAndInitExpr] <>__AnonType0<> l2 = ...
+#   10|           -1: [TypeMention] <>__AnonType0<>
+#   10|           0: [LocalVariableAccess] access to local variable l2
+#   10|           1: [LambdaExpr] (...) => ...
+#-----|             2: (Parameters)
+#   10|               0: [Parameter] x
+#   10|                 -1: [TypeMention] int
+#   10|               1: [Parameter] y
+#   10|                 -1: [TypeMention] int
+#   10|                 1: [IntLiteral] 1
+#   10|             4: [AddExpr] ... + ...
+#   10|               0: [ParameterAccess] access to parameter x
+#   10|               1: [ParameterAccess] access to parameter y
+#   11|       3: [ExprStmt] ...;
+#   11|         0: [DelegateCall] delegate call
+#   11|           -1: [LocalVariableAccess] access to local variable l2
+#   11|           0: [IntLiteral] 2
+#   11|           1: [IntLiteral] 3
+#   12|       4: [ExprStmt] ...;
+#   12|         0: [DelegateCall] delegate call
+#   12|           -1: [LocalVariableAccess] access to local variable l2
+#   12|           0: [IntLiteral] 4
+#   13|       5: [ExprStmt] ...;
+#   13|         0: [DelegateCall] delegate call
+#   13|           -1: [LocalVariableAccess] access to local variable l2
+#   13|           0: [IntLiteral] 5
+#   13|           1: [IntLiteral] 6
+#   15|       6: [LocalVariableDeclStmt] ... ...;
+#   15|         0: [LocalVariableDeclAndInitExpr] <>__AnonType0<> l3 = ...
+#   15|           -1: [TypeMention] <>__AnonType0<>
+#   15|           0: [LocalVariableAccess] access to local variable l3
+#   15|           1: [LambdaExpr] (...) => ...
+#-----|             2: (Parameters)
+#   15|               0: [Parameter] x
+#   15|                 -1: [TypeMention] Int32[]
+#   15|                   1: [TypeMention] int
+#   15|             4: [PropertyCall] access to property Length
+#   15|               -1: [ParameterAccess] access to parameter x
+#   16|       7: [ExprStmt] ...;
+#   16|         0: [DelegateCall] delegate call
+#   16|           -1: [LocalVariableAccess] access to local variable l3
+#   17|       8: [ExprStmt] ...;
+#   17|         0: [DelegateCall] delegate call
+#   17|           -1: [LocalVariableAccess] access to local variable l3
+#   17|           0: [IntLiteral] 7
+#   17|           1: [IntLiteral] 8
+#   17|           2: [IntLiteral] 9
+#   20|   6: [DelegateType] MyDelegate
+#-----|     2: (Parameters)
+#   20|       0: [Parameter] x
+#   20|         -1: [TypeMention] int
+#   20|       1: [Parameter] y
+#   20|         -1: [TypeMention] int
+#   22|   7: [Method] M2
+#   22|     -1: [TypeMention] Void
+#   23|     4: [BlockStmt] {...}
+#   24|       0: [LocalVariableDeclStmt] ... ...;
+#   24|         0: [LocalVariableDeclAndInitExpr] MyDelegate sum = ...
+#   24|           -1: [TypeMention] MyDelegate
+#   24|           0: [LocalVariableAccess] access to local variable sum
+#   24|           1: [LambdaExpr] (...) => ...
+#-----|             2: (Parameters)
+#   24|               0: [Parameter] x
+#   24|                 -1: [TypeMention] int
+#   24|               1: [Parameter] y
+#   24|                 -1: [TypeMention] int
+#   24|             4: [AddExpr] ... + ...
+#   24|               0: [ParameterAccess] access to parameter x
+#   24|               1: [ParameterAccess] access to parameter y
+#   25|       1: [ExprStmt] ...;
+#   25|         0: [DelegateCall] delegate call
+#   25|           -1: [LocalVariableAccess] access to local variable sum
+#   25|           0: [IntLiteral] 4
+#   25|           1: [IntLiteral] 5

csharp/ql/test/library-tests/arguments/argumentName.expected

@@ -11,3 +11,5 @@
 | arguments.cs:70:36:70:36 | 0 | x |
 | arguments.cs:78:18:78:21 | access to parameter args | args |
 | arguments.cs:78:27:78:27 | 0 | o |
+| lambdas.cs:25:16:25:16 | 4 | y |
+| lambdas.cs:25:22:25:22 | 5 | x |

csharp/ql/test/library-tests/arguments/argumentType.expected

@@ -70,3 +70,14 @@
 | arguments.cs:84:23:84:43 | array creation of type Double[] | 0 |
 | arguments.cs:85:20:85:20 | 0 | 0 |
 | arguments.cs:85:23:85:43 | array creation of type Double[] | 0 |
+| lambdas.cs:8:12:8:12 | 1 | 0 |
+| lambdas.cs:11:12:11:12 | 2 | 0 |
+| lambdas.cs:11:15:11:15 | 3 | 0 |
+| lambdas.cs:12:12:12:12 | 4 | 0 |
+| lambdas.cs:13:12:13:12 | 5 | 0 |
+| lambdas.cs:13:15:13:15 | 6 | 0 |
+| lambdas.cs:17:12:17:12 | 7 | 0 |
+| lambdas.cs:17:15:17:15 | 8 | 0 |
+| lambdas.cs:17:18:17:18 | 9 | 0 |
+| lambdas.cs:25:16:25:16 | 4 | 0 |
+| lambdas.cs:25:22:25:22 | 5 | 0 |

csharp/ql/test/library-tests/arguments/lambdaArgument.expected

@@ -0,0 +1,11 @@
+| lambdas.cs:8:9:8:13 | delegate call | lambdas.cs:7:23:7:23 | x | lambdas.cs:8:12:8:12 | 1 |
+| lambdas.cs:11:9:11:16 | delegate call | lambdas.cs:10:23:10:23 | x | lambdas.cs:11:12:11:12 | 2 |
+| lambdas.cs:11:9:11:16 | delegate call | lambdas.cs:10:30:10:30 | y | lambdas.cs:11:15:11:15 | 3 |
+| lambdas.cs:12:9:12:13 | delegate call | lambdas.cs:10:23:10:23 | x | lambdas.cs:12:12:12:12 | 4 |
+| lambdas.cs:13:9:13:16 | delegate call | lambdas.cs:10:23:10:23 | x | lambdas.cs:13:12:13:12 | 5 |
+| lambdas.cs:13:9:13:16 | delegate call | lambdas.cs:10:30:10:30 | y | lambdas.cs:13:15:13:15 | 6 |
+| lambdas.cs:17:9:17:19 | delegate call | lambdas.cs:15:32:15:32 | x | lambdas.cs:17:12:17:12 | 7 |
+| lambdas.cs:17:9:17:19 | delegate call | lambdas.cs:15:32:15:32 | x | lambdas.cs:17:15:17:15 | 8 |
+| lambdas.cs:17:9:17:19 | delegate call | lambdas.cs:15:32:15:32 | x | lambdas.cs:17:18:17:18 | 9 |
+| lambdas.cs:25:9:25:23 | delegate call | lambdas.cs:24:31:24:31 | x | lambdas.cs:25:22:25:22 | 5 |
+| lambdas.cs:25:9:25:23 | delegate call | lambdas.cs:24:38:24:38 | y | lambdas.cs:25:16:25:16 | 4 |

csharp/ql/test/library-tests/arguments/lambdaArgument.ql

@@ -0,0 +1,7 @@
+import csharp
+
+from Call call, Parameter p, Expr arg
+where
+  call.getARuntimeTarget() instanceof LambdaExpr and
+  arg = call.getRuntimeArgumentForParameter(p)
+select call, p, arg

csharp/ql/test/library-tests/arguments/lambdas.cs

@@ -0,0 +1,28 @@
+using System;
+
+class LambdaArgumentsTest
+{
+    void M1()
+    {
+        var l1 = (int x) => x + 1;
+        l1(1);
+
+        var l2 = (int x, int y = 1) => x + y;
+        l2(2, 3);
+        l2(4);
+        l2(5, 6);
+
+        var l3 = (params int[] x) => x.Length;
+        l3();
+        l3(7, 8, 9);
+    }
+
+    delegate int MyDelegate(int x, int y);
+
+    void M2()
+    {
+        MyDelegate sum = (int x, int y) => x + y;
+        sum(y: 4, x: 5);
+    }
+}
+

csharp/ql/test/library-tests/dataflow/external-models/ExternalFlow.cs

@@ -206,12 +206,25 @@ namespace My.Qltest
             Sink(MixedFlowArgs(null, o2));
         }
 
+        void M4()
+        {
+            var o1 = new object();
+            Sink(GeneratedFlowWithGeneratedNeutral(o1));
+
+            var o2 = new object();
+            Sink(GeneratedFlowWithManualNeutral(o2)); // no flow because the modelled method has a manual neutral summary model
+        }
+
         object GeneratedFlow(object o) => throw null;
 
         object GeneratedFlowArgs(object o1, object o2) => throw null;
 
         object MixedFlowArgs(object o1, object o2) => throw null;
 
+        object GeneratedFlowWithGeneratedNeutral(object o) => throw null;
+
+        object GeneratedFlowWithManualNeutral(object o) => throw null;
+
         static void Sink(object o) { }
     }
 

csharp/ql/test/library-tests/dataflow/external-models/ExternalFlow.expected

@@ -63,9 +63,11 @@ edges
 | ExternalFlow.cs:120:18:120:18 | access to local variable b : null [element] : Object | ExternalFlow.cs:120:18:120:21 | access to array element |
 | ExternalFlow.cs:205:22:205:33 | object creation of type Object : Object | ExternalFlow.cs:206:38:206:39 | access to local variable o2 : Object |
 | ExternalFlow.cs:206:38:206:39 | access to local variable o2 : Object | ExternalFlow.cs:206:18:206:40 | call to method MixedFlowArgs |
-| ExternalFlow.cs:231:21:231:28 | object creation of type HC : HC | ExternalFlow.cs:232:21:232:21 | access to local variable h : HC |
-| ExternalFlow.cs:232:21:232:21 | access to local variable h : HC | ExternalFlow.cs:232:21:232:39 | call to method ExtensionMethod : HC |
-| ExternalFlow.cs:232:21:232:39 | call to method ExtensionMethod : HC | ExternalFlow.cs:233:18:233:18 | access to local variable o |
+| ExternalFlow.cs:211:22:211:33 | object creation of type Object : Object | ExternalFlow.cs:212:52:212:53 | access to local variable o1 : Object |
+| ExternalFlow.cs:212:52:212:53 | access to local variable o1 : Object | ExternalFlow.cs:212:18:212:54 | call to method GeneratedFlowWithGeneratedNeutral |
+| ExternalFlow.cs:244:21:244:28 | object creation of type HC : HC | ExternalFlow.cs:245:21:245:21 | access to local variable h : HC |
+| ExternalFlow.cs:245:21:245:21 | access to local variable h : HC | ExternalFlow.cs:245:21:245:39 | call to method ExtensionMethod : HC |
+| ExternalFlow.cs:245:21:245:39 | call to method ExtensionMethod : HC | ExternalFlow.cs:246:18:246:18 | access to local variable o |
 nodes
 | ExternalFlow.cs:9:27:9:38 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
 | ExternalFlow.cs:10:18:10:33 | call to method StepArgRes | semmle.label | call to method StepArgRes |
@@ -148,10 +150,13 @@ nodes
 | ExternalFlow.cs:205:22:205:33 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
 | ExternalFlow.cs:206:18:206:40 | call to method MixedFlowArgs | semmle.label | call to method MixedFlowArgs |
 | ExternalFlow.cs:206:38:206:39 | access to local variable o2 : Object | semmle.label | access to local variable o2 : Object |
-| ExternalFlow.cs:231:21:231:28 | object creation of type HC : HC | semmle.label | object creation of type HC : HC |
-| ExternalFlow.cs:232:21:232:21 | access to local variable h : HC | semmle.label | access to local variable h : HC |
-| ExternalFlow.cs:232:21:232:39 | call to method ExtensionMethod : HC | semmle.label | call to method ExtensionMethod : HC |
-| ExternalFlow.cs:233:18:233:18 | access to local variable o | semmle.label | access to local variable o |
+| ExternalFlow.cs:211:22:211:33 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
+| ExternalFlow.cs:212:18:212:54 | call to method GeneratedFlowWithGeneratedNeutral | semmle.label | call to method GeneratedFlowWithGeneratedNeutral |
+| ExternalFlow.cs:212:52:212:53 | access to local variable o1 : Object | semmle.label | access to local variable o1 : Object |
+| ExternalFlow.cs:244:21:244:28 | object creation of type HC : HC | semmle.label | object creation of type HC : HC |
+| ExternalFlow.cs:245:21:245:21 | access to local variable h : HC | semmle.label | access to local variable h : HC |
+| ExternalFlow.cs:245:21:245:39 | call to method ExtensionMethod : HC | semmle.label | call to method ExtensionMethod : HC |
+| ExternalFlow.cs:246:18:246:18 | access to local variable o | semmle.label | access to local variable o |
 subpaths
 #select
 | ExternalFlow.cs:10:18:10:33 | call to method StepArgRes | ExternalFlow.cs:9:27:9:38 | object creation of type Object : Object | ExternalFlow.cs:10:18:10:33 | call to method StepArgRes | $@ | ExternalFlow.cs:9:27:9:38 | object creation of type Object : Object | object creation of type Object : Object |
@@ -175,4 +180,5 @@ subpaths
 | ExternalFlow.cs:112:18:112:25 | access to property MyProp | ExternalFlow.cs:111:24:111:35 | object creation of type Object : Object | ExternalFlow.cs:112:18:112:25 | access to property MyProp | $@ | ExternalFlow.cs:111:24:111:35 | object creation of type Object : Object | object creation of type Object : Object |
 | ExternalFlow.cs:120:18:120:21 | access to array element | ExternalFlow.cs:117:36:117:47 | object creation of type Object : Object | ExternalFlow.cs:120:18:120:21 | access to array element | $@ | ExternalFlow.cs:117:36:117:47 | object creation of type Object : Object | object creation of type Object : Object |
 | ExternalFlow.cs:206:18:206:40 | call to method MixedFlowArgs | ExternalFlow.cs:205:22:205:33 | object creation of type Object : Object | ExternalFlow.cs:206:18:206:40 | call to method MixedFlowArgs | $@ | ExternalFlow.cs:205:22:205:33 | object creation of type Object : Object | object creation of type Object : Object |
-| ExternalFlow.cs:233:18:233:18 | access to local variable o | ExternalFlow.cs:231:21:231:28 | object creation of type HC : HC | ExternalFlow.cs:233:18:233:18 | access to local variable o | $@ | ExternalFlow.cs:231:21:231:28 | object creation of type HC : HC | object creation of type HC : HC |
+| ExternalFlow.cs:212:18:212:54 | call to method GeneratedFlowWithGeneratedNeutral | ExternalFlow.cs:211:22:211:33 | object creation of type Object : Object | ExternalFlow.cs:212:18:212:54 | call to method GeneratedFlowWithGeneratedNeutral | $@ | ExternalFlow.cs:211:22:211:33 | object creation of type Object : Object | object creation of type Object : Object |
+| ExternalFlow.cs:246:18:246:18 | access to local variable o | ExternalFlow.cs:244:21:244:28 | object creation of type HC : HC | ExternalFlow.cs:246:18:246:18 | access to local variable o | $@ | ExternalFlow.cs:244:21:244:28 | object creation of type HC : HC | object creation of type HC : HC |

csharp/ql/test/library-tests/dataflow/external-models/ExternalFlow.ext.yml

@@ -29,4 +29,13 @@ extensions:
       - ["My.Qltest", "G", false, "GeneratedFlowArgs", "(System.Object,System.Object)", "", "Argument[1]", "ReturnValue", "value", "df-generated"]
       - ["My.Qltest", "G", false, "MixedFlowArgs", "(System.Object,System.Object)", "", "Argument[0]", "ReturnValue", "value", "df-generated"]
       - ["My.Qltest", "G", false, "MixedFlowArgs", "(System.Object,System.Object)", "", "Argument[1]", "ReturnValue", "value", "manual"]
+      - ["My.Qltest", "G", false, "GeneratedFlowWithGeneratedNeutral", "(System.Object)", "", "Argument[0]", "ReturnValue", "value", "df-generated"]
+      - ["My.Qltest", "G", false, "GeneratedFlowWithManualNeutral", "(System.Object)", "", "Argument[0]", "ReturnValue", "value", "df-generated"]
       - ["My.Qltest", "HE", false, "ExtensionMethod", "(My.Qltest.HI)", "", "Argument[0]", "ReturnValue", "value", "manual"]
+  - addsTo:
+      pack: codeql/csharp-all
+      extensible: neutralModel
+      # "namespace", "type", "name", "signature", "kind", "provenance"
+    data:
+      - ["My.Qltest", "G", "GeneratedFlowWithGeneratedNeutral", "(System.Object)", "summary", "df-generated"]
+      - ["My.Qltest", "G", "GeneratedFlowWithManualNeutral", "(System.Object)", "summary", "manual"]

csharp/ql/test/library-tests/dataflow/external-models/ExternalFlow.ql

@@ -21,11 +21,18 @@ module TaintConfig implements DataFlow::ConfigSig {
 module Taint = TaintTracking::Global<TaintConfig>;
 
 /**
- * Simulate that methods with summaries are not included in the source code.
- * This is relevant for dataflow analysis using summaries tagged as generated.
+ * Emulate that methods with summaries do not have a body.
+ * This is relevant for dataflow analysis using summaries with a generated like
+ * provenance as generated summaries are only applied, if a
+ * callable does not have a body.
  */
-private class MyMethod extends Method {
-  override predicate fromSource() { none() }
+private class MethodsWithGeneratedModels extends Method {
+  MethodsWithGeneratedModels() {
+    this.hasFullyQualifiedName("My.Qltest", "G",
+      ["MixedFlowArgs", "GeneratedFlowWithGeneratedNeutral", "GeneratedFlowWithManualNeutral"])
+  }
+
+  override predicate hasBody() { none() }
 }
 
 from Taint::PathNode source, Taint::PathNode sink

csharp/ql/test/library-tests/dataflow/external-models/Steps.cs

@@ -42,6 +42,12 @@ namespace My.Qltest
             gen.StepGeneric2(false);
 
             new Sub().StepOverride("string");
+
+            object arg4 = new object();
+            this.StepArgQualGenerated(arg4);
+            
+            object arg5 = new object();
+            this.StepArgQualGeneratedIgnored(arg5);
         }
 
         object StepArgRes(object x) { return null; }
@@ -50,6 +56,10 @@ namespace My.Qltest
 
         void StepArgQual(object x) { }
 
+        void StepArgQualGenerated(object x) { }
+
+        void StepArgQualGeneratedIgnored(object x) { }
+
         object StepQualRes() { return null; }
 
         void StepQualArg(object @out) { }

csharp/ql/test/library-tests/dataflow/external-models/steps.expected

@@ -11,11 +11,12 @@ summaryThroughStep
 | Steps.cs:41:29:41:29 | 0 | Steps.cs:41:13:41:30 | call to method StepGeneric | true |
 | Steps.cs:42:30:42:34 | false | Steps.cs:42:13:42:35 | call to method StepGeneric2<Boolean> | true |
 | Steps.cs:44:36:44:43 | "string" | Steps.cs:44:13:44:44 | call to method StepOverride | true |
+| Steps.cs:47:39:47:42 | access to local variable arg4 | Steps.cs:47:13:47:16 | [post] this access | false |
 summaryGetterStep
-| Steps.cs:28:13:28:16 | this access | Steps.cs:28:13:28:34 | call to method StepFieldGetter | Steps.cs:57:13:57:17 | field Field |
-| Steps.cs:32:13:32:16 | this access | Steps.cs:32:13:32:37 | call to method StepPropertyGetter | Steps.cs:63:13:63:20 | property Property |
+| Steps.cs:28:13:28:16 | this access | Steps.cs:28:13:28:34 | call to method StepFieldGetter | Steps.cs:67:13:67:17 | field Field |
+| Steps.cs:32:13:32:16 | this access | Steps.cs:32:13:32:37 | call to method StepPropertyGetter | Steps.cs:73:13:73:20 | property Property |
 | Steps.cs:36:13:36:16 | this access | Steps.cs:36:13:36:36 | call to method StepElementGetter | file://:0:0:0:0 | element |
 summarySetterStep
-| Steps.cs:30:34:30:34 | 0 | Steps.cs:30:13:30:16 | [post] this access | Steps.cs:57:13:57:17 | field Field |
-| Steps.cs:34:37:34:37 | 0 | Steps.cs:34:13:34:16 | [post] this access | Steps.cs:63:13:63:20 | property Property |
+| Steps.cs:30:34:30:34 | 0 | Steps.cs:30:13:30:16 | [post] this access | Steps.cs:67:13:67:17 | field Field |
+| Steps.cs:34:37:34:37 | 0 | Steps.cs:34:13:34:16 | [post] this access | Steps.cs:73:13:73:20 | property Property |
 | Steps.cs:38:36:38:36 | 0 | Steps.cs:38:13:38:16 | [post] this access | file://:0:0:0:0 | element |

csharp/ql/test/library-tests/dataflow/external-models/steps.ext.yml

@@ -18,3 +18,13 @@ extensions:
       - ["My.Qltest", "C+Generic<T,U>", false, "StepGeneric", "(T)", "", "Argument[0]", "ReturnValue", "value", "manual"]
       - ["My.Qltest", "C+Generic<T,U>", false, "StepGeneric2<S>", "(S)", "", "Argument[0]", "ReturnValue", "value", "manual"]
       - ["My.Qltest", "C+Base<T>", true, "StepOverride", "(T)", "", "Argument[0]", "ReturnValue", "value", "manual"]
+      - ["My.Qltest", "C", false, "StepArgQualGenerated", "(System.Object)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
+      - ["My.Qltest", "C", false, "StepArgQualGeneratedIgnored", "(System.Object)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
+  - addsTo:
+      pack: codeql/csharp-all
+      extensible: neutralModel
+      # "namespace", "type", "name", "signature", "kind", "provenance"
+    data:
+      - ["My.Qltest", "C", "StepArgQualGenerated", "(System.Object)", "summary", "df-generated"]
+      - ["My.Qltest", "C", "StepArgQualGeneratedIgnored", "(System.Object)", "summary", "manual"]
+

csharp/ql/test/library-tests/dataflow/external-models/steps.ql

@@ -6,6 +6,22 @@ import semmle.code.csharp.dataflow.FlowSummary
 import semmle.code.csharp.dataflow.internal.DataFlowDispatch as DataFlowDispatch
 import semmle.code.csharp.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl
 
+/**
+ * Emulate that methods with summaries do not have a body.
+ * This is relevant for dataflow analysis using summaries with a generated like
+ * provenance as generated summaries are only applied, if a
+ * callable does not have a body.
+ */
+private class StepArgQualGenerated extends Method {
+  StepArgQualGenerated() {
+    exists(string name |
+      this.hasFullyQualifiedName("My.Qltest", "C", name) and name.matches("StepArgQualGenerated%")
+    )
+  }
+
+  override predicate hasBody() { none() }
+}
+
 query predicate summaryThroughStep(
   DataFlow::Node node1, DataFlow::Node node2, boolean preservesValue
 ) {

csharp/ql/test/library-tests/parameters/LambdaParameters.cs

@@ -0,0 +1,15 @@
+using System;
+using System.Runtime.InteropServices;
+using System.Runtime.CompilerServices;
+
+public class LambdaParameters
+{
+    public void M1()
+    {
+        var l1 = (int x, int y = 1) => x + y;
+        var l2 = (object? o = default) => o;
+        var l3 = (int x, int y = 1, int z = 2) => x + y + z;
+        var l4 = ([Optional, DefaultParameterValue(7)] int x) => x;
+        var l5 = ([Optional, DateTimeConstant(14L)] DateTime x) => x;
+    }
+}

csharp/ql/test/library-tests/parameters/Parameters.expected

@@ -1,4 +1,6 @@
 noDefaultValue
+| LambdaParameters.cs:9:18:9:44 | (...) => ... | LambdaParameters.cs:9:23:9:23 | x | 0 |
+| LambdaParameters.cs:11:18:11:59 | (...) => ... | LambdaParameters.cs:11:23:11:23 | x | 0 |
 | Parameters.cs:7:17:7:18 | M1 | Parameters.cs:7:24:7:24 | a | 0 |
 | Parameters.cs:7:17:7:18 | M1 | Parameters.cs:7:34:7:34 | b | 1 |
 | Parameters.cs:7:17:7:18 | M1 | Parameters.cs:7:44:7:44 | c | 2 |
@@ -16,6 +18,12 @@ noDefaultValue
 | Parameters.dll:0:0:0:0 | implicit conversion | Parameters.dll:0:0:0:0 | i | 0 |
 | Parameters.dll:0:0:0:0 | implicit conversion | Parameters.dll:0:0:0:0 | s | 0 |
 withDefaultValue
+| LambdaParameters.cs:9:18:9:44 | (...) => ... | LambdaParameters.cs:9:30:9:30 | y | 1 | LambdaParameters.cs:9:34:9:34 | 1 | 1 |
+| LambdaParameters.cs:10:18:10:43 | (...) => ... | LambdaParameters.cs:10:27:10:27 | o | 0 | LambdaParameters.cs:10:31:10:37 | default | null |
+| LambdaParameters.cs:11:18:11:59 | (...) => ... | LambdaParameters.cs:11:30:11:30 | y | 1 | LambdaParameters.cs:11:34:11:34 | 1 | 1 |
+| LambdaParameters.cs:11:18:11:59 | (...) => ... | LambdaParameters.cs:11:41:11:41 | z | 2 | LambdaParameters.cs:11:45:11:45 | 2 | 2 |
+| LambdaParameters.cs:12:18:12:66 | (...) => ... | LambdaParameters.cs:12:60:12:60 | x | 0 | LambdaParameters.cs:12:19:12:60 | 7 | 7 |
+| LambdaParameters.cs:13:18:13:68 | (...) => ... | LambdaParameters.cs:13:62:13:62 | x | 0 | LambdaParameters.cs:13:19:13:62 | object creation of type DateTime | - |
 | Parameters.cs:8:17:8:18 | M2 | Parameters.cs:8:34:8:34 | b | 1 | Parameters.cs:8:38:8:41 | null | null |
 | Parameters.cs:8:17:8:18 | M2 | Parameters.cs:8:51:8:51 | c | 2 | Parameters.cs:8:55:8:70 | "default string" | default string |
 | Parameters.cs:9:17:9:18 | M3 | Parameters.cs:9:24:9:24 | a | 0 | Parameters.cs:9:28:9:28 | 1 | 1 |
@@ -81,6 +89,7 @@ withDefaultValue
 | Parameters.dll:0:0:0:0 | M23 | Parameters.dll:0:0:0:0 | arg12 | 0 | Parameters.dll:0:0:0:0 | (...) ... | 0 |
 | Parameters.dll:0:0:0:0 | M24 | Parameters.dll:0:0:0:0 | arg13 | 0 | Parameters.dll:0:0:0:0 | (...) ... | 7 |
 dateTimeDefaults
+| LambdaParameters.cs:13:18:13:68 | (...) => ... | LambdaParameters.cs:13:62:13:62 | x | LambdaParameters.cs:13:19:13:62 | object creation of type DateTime | DateTime(long) | 14 |
 | Parameters.cs:22:17:22:19 | M14 | Parameters.cs:22:64:22:67 | arg4 | Parameters.cs:22:21:22:67 | object creation of type DateTime | DateTime(long) | 14 |
 | Parameters.cs:23:17:23:19 | M15 | Parameters.cs:23:68:23:71 | arg5 | Parameters.cs:23:21:23:71 | object creation of type DateTime | DateTime(long) | 10001 |
 | Parameters.dll:0:0:0:0 | M14 | Parameters.dll:0:0:0:0 | arg4 | Parameters.dll:0:0:0:0 | object creation of type DateTime | DateTime(long) | 14 |

csharp/ql/test/library-tests/typealias/alias.cs

@@ -0,0 +1,30 @@
+using System;
+
+using TupleType1 = (int, object);
+using TupleType2 = (int, string);
+using TupleType3 = (int, object);
+using Point = (int x, int y);
+
+public class TupleMethods
+{
+    public void M1(TupleType1 t)
+    {
+        var x = t.Item1;
+        var y = t.Item2;
+    }
+
+    public void M2(TupleType2 t)
+    {
+        var x = t.Item1;
+        var y = t.Item2;
+        M1(t);
+    }
+
+    public void M3(Point p)
+    {
+        var x = p.x;
+        var y = p.y;
+    }
+
+    public void M4(TupleType3 t) { }
+}

csharp/ql/test/library-tests/typealias/alias.expected

@@ -0,0 +1,4 @@
+| alias.cs:10:17:10:18 | M1 | alias.cs:10:31:10:31 | t | (Int32,Object) |
+| alias.cs:16:17:16:18 | M2 | alias.cs:16:31:16:31 | t | (Int32,String) |
+| alias.cs:23:17:23:18 | M3 | alias.cs:23:26:23:26 | p | (Int32,Int32) |
+| alias.cs:29:17:29:18 | M4 | alias.cs:29:31:29:31 | t | (Int32,Object) |

csharp/ql/test/library-tests/typealias/alias.ql

@@ -0,0 +1,8 @@
+import csharp
+
+from Method m, Parameter p, Type t
+where
+  m.fromSource() and
+  p = m.getAParameter() and
+  p.getType() = t
+select m, p, t.toString()

csharp/ql/test/utils/modelgenerator/dataflow/CaptureNeutralModels.ext.yml

@@ -0,0 +1,6 @@
+extensions:
+  - addsTo:
+      pack: codeql/csharp-all
+      extensible: neutralModel
+    data:
+      - [ "NoSummaries", "ManuallyModelled", "HasNeutralSummaryNoFlow", "(System.Object)", "summary", "manual"]

csharp/ql/test/utils/modelgenerator/dataflow/CaptureSummaryModels.ext.yml

@@ -0,0 +1,12 @@
+extensions:
+  - addsTo:
+      pack: codeql/csharp-all
+      extensible: summaryModel
+    data:
+      - [ "NoSummaries", "ManuallyModelled", False, "HasSummary", "(System.Object)", "", "Argument[0]", "ReturnValue", "value", "manual"]
+
+  - addsTo:
+      pack: codeql/csharp-all
+      extensible: neutralModel
+    data:
+      - [ "NoSummaries", "ManuallyModelled", "HasNeutralSummary", "(System.Object)", "summary", "manual"]

csharp/ql/test/utils/modelgenerator/dataflow/NoSummaries.cs

@@ -143,3 +143,22 @@ public class ParameterlessConstructor
         IsInitialized = true;
     }
 }
+
+// No models should be created, if there exist either a manual summary or neutral summary.
+public class ManuallyModelled
+{
+    public object HasSummary(object o)
+    {
+        return o;
+    }
+
+    public object HasNeutralSummary(object o)
+    {
+        return o;
+    }
+
+    public object HasNeutralSummaryNoFlow(object o)
+    {
+        return null;
+    }
+}

csharp/ql/test/utils/modelgenerator/typebasedflow/CaptureTypeBasedSummaryModels.expected

@@ -124,7 +124,6 @@
 | Summaries;TypeBasedCollection<T>;false;Add;(T);;Argument[0];Argument[this].Element;value;tb-generated |
 | Summaries;TypeBasedCollection<T>;false;AddMany;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;Argument[this].Element;value;tb-generated |
 | Summaries;TypeBasedCollection<T>;false;First;();;Argument[this].Element;ReturnValue;value;tb-generated |
-| Summaries;TypeBasedCollection<T>;false;GetEnumerator;();;Argument[this].Element;ReturnValue.SyntheticField[ArgType0];value;tb-generated |
 | Summaries;TypeBasedCollection<T>;false;GetMany;();;Argument[this].Element;ReturnValue.Element;value;tb-generated |
 | Summaries;TypeBasedComplex<T>;false;AddMany;(System.Collections.Generic.IEnumerable<T>);;Argument[0].Element;Argument[this].SyntheticField[ArgType0];value;tb-generated |
 | Summaries;TypeBasedComplex<T>;false;Apply;(System.Func<T,System.Int32>);;Argument[this].SyntheticField[ArgType0];Argument[0].Parameter[0];value;tb-generated |

docs/codeql/codeql-for-visual-studio-code/about-telemetry-in-codeql-for-visual-studio-code.rst

@@ -30,6 +30,7 @@ If you opt in, GitHub collects the following information related to the usage of
 - Randomly generated GUID that uniquely identifies a CodeQL extension installation. (Discarded before aggregation.)
 - IP address of the client sending the telemetry data. (Discarded before aggregation.)
 - Whether or not the ``codeQL.canary`` setting is enabled and set to ``true``.
+- Whether any :doc:`CodeQL extension settings <customizing-settings>` are configured.
 
 How long data is retained
 --------------------------

docs/codeql/ql-language-reference/aliases.rst

@@ -124,3 +124,19 @@ You could give the predicate a more descriptive name as follows:
 .. code-block:: ql
 
     predicate lessThanTen = isSmall/1;
+
+.. _weak_strong_aliases:
+
+Strong and weak aliases
+=======================
+
+Every alias definition is either **strong** or **weak**.
+An alias definition is **strong** if and only if it is a :ref:`type alias <type-aliases>` definition with
+:ref:`annotation <annotations>` ``final``.
+During :ref:`name resolution <name-resolution>`, ambiguity between aliases from **weak** alias definitions
+for the same module/type/predicate is allowed, but ambiguity between between aliases from distinct **strong**
+alias definitions is invalid QL.
+Likewise, for the purpose of applicative instantiation of :ref:`parameterised modules <parameterized-modules>`
+and `:ref:`parameterised module signatures <parameterized-module-signatures>`, aliases from **weak** alias
+definitions for instantiation arguments do not result in separate instantiations, but aliases from **strong**
+alias definitions for instantiation arguments do.

docs/codeql/ql-language-reference/modules.rst

@@ -180,7 +180,8 @@ For example, in the previous two snippets, we relied on the predicate signature
     signature int transformer(int x);
 
 The instantiation of parameterized modules is applicative.
-That is, if you instantiate a parameterized module twice with identical arguments, the resulting object is the same.
+That is, if you instantiate a parameterized module twice with equivalent arguments, the resulting object is the same.
+Arguments are considered equivalent in this context if they differ only by :ref:`weak aliasing <weak_strong_aliases>`.
 This is particularly relevant for type definitions inside parameterized modules as :ref:`classes <classes>`
 or via :ref:`newtype <algebraic-datatypes>`, because the duplication of such type definitions would result in
 incompatible types.

docs/codeql/ql-language-reference/ql-language-specification.rst

@@ -115,7 +115,7 @@ Environments may be combined as follows:
 -  *Union*. This takes the union of the entry sets of the two environments.
 -  *Overriding union*. This takes the union of two environments, but if there are entries for a key in the first map, then no additional entries for that key are included from the second map.
 
-A *definite* environment has at most one entry for each key. Resolution is unique in a definite environment.
+A *definite* environment has only values that are *equal modulo weak aliasing* for each key.
 
 Global environments
 ~~~~~~~~~~~~~~~~~~~
@@ -334,7 +334,7 @@ For a *completely uninstantiated* parameter, the *bottom-up instantiation-resolu
 
 An entity is called *fully instantiated* if none of the *bottom-up instantiation-resolutions* of the parameters in the *relevant set of parameters* of the entity's *underlying completely uninstantiated* entity are parameters.
 
-Two *instantiated modules* or two *instantiation-nested* entities are considered *equivalent* if they have the same *underlying completely uninstantiated* entity and each parameter in its *relevant set of parameters* has the same *bottom-up instantiation-resolution* relative to either *instantiated module*.
+Two *instantiated modules* or two *instantiation-nested* entities are considered *equivalent* if they have the same *underlying completely uninstantiated* entity and each parameter in its *relevant set of parameters* has *bottom-up instantiation-resolution*s relative both *instantiated module*s that are *equivalent modulo weak aliases*.
 
 Module instantiation is applicative, meaning that *equivalent* *instantiated modules* and *equivalent* *instantiation-nested* entities are indistinguishable.
 
@@ -1763,7 +1763,7 @@ The grammar given in this section is disambiguated first by precedence, and seco
 Aliases
 -------
 
-Aliases define new names for existing QL entities.
+Aliases define new names for existing QL bindings.
 
 ::
 
@@ -1772,7 +1772,19 @@ Aliases define new names for existing QL entities.
          |   qldoc? annotations "module" modulename "=" moduleExpr ";"
 
 
-An alias introduces a binding from the new name to the entity referred to by the right-hand side in the current module's declared predicate, type, or module environment respectively.
+An alias introduces a binding from the new name to the binding referred to by the right-hand side in the current module's visible predicate, type, or module environment respectively.
+
+An alias is called a *strong alias* if and only if it has the ``final`` annotation. Otherwise, it is called a *weak alias*.
+
+Two bindings `A`, `B` are called *equal modulo weak aliasing* if and only if one of the following conditions are satisfied:
+
+- `A` and `B` are the same binding or
+
+- `A`` is introduced by a *weak alias* for `C`, where `B` and `C` are *equal modulo weak aliasing* (or vice versa) or
+
+- `A` and `B` are introduced by the same strong alias and they are aliases for bindings that are *equal modulo weak aliasing*.
+
+Note that the third condition is only relevant in :ref:`Parameterized modules`, where the binding introduced by the alias can depend on instantiation parameters.
 
 Built-ins
 ---------

docs/codeql/writing-codeql-queries/metadata-for-codeql-queries.rst

@@ -49,7 +49,7 @@ The following properties are supported by all query files:
 |                       | | ``warning``             |                                                                                                                                                                                                                                                                                                                                                                       |
 |                       | | ``recommendation``      |                                                                                                                                                                                                                                                                                                                                                                       |
 +-----------------------+---------------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
-| ``@security-severity``| ``<score>``               | Defines the level of severity, between 0.0 and 10.0, for queries with ``@tags security``. For more information about calculating ``@security-severity``, see the `GitHub changelog <https://gh.io/2021-07-19-codeql-security-severity>`__.                                                                                                                            |
+| ``@security-severity``| ``<score>``               | Defines the level of severity, between 0.0 and 10.0, for queries with ``@tags security``. For more information, see the `GitHub user documentation <https://docs.github.com/code-security/code-scanning/managing-code-scanning-alerts/about-code-scanning-alerts#about-alert-severity-and-security-severity-levels>`__.                                               |
 +-----------------------+---------------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
 
 Example

docs/ql-libraries/dataflow/dataflow.md

@@ -588,18 +588,17 @@ However, joining the virtual dispatch relation with itself in this way is
 usually way too big to be feasible. Instead, the relation above should only be
 defined for those values of `call` for which the set of resulting dispatch
 targets might be reduced. To do this, define the set of `call`s that might for
-some reason benefit from a call context as the following predicate (the `c`
-column should be `call.getEnclosingCallable()`):
+some reason benefit from a call context as the following predicate:
 ```ql
-predicate mayBenefitFromCallContext(DataFlowCall call, DataFlowCallable c)
+predicate mayBenefitFromCallContext(DataFlowCall call)
 ```
 And then define `DataFlowCallable viableImplInCallContext(DataFlowCall call,
 DataFlowCall ctx)` as sketched above, but restricted to
-`mayBenefitFromCallContext(call, _)`.
+`mayBenefitFromCallContext(call)`.
 
 The shared implementation will then compare counts of virtual dispatch targets
 using `viableCallable` and `viableImplInCallContext` for each `call` in
-`mayBenefitFromCallContext(call, _)` and track call contexts during flow
+`mayBenefitFromCallContext(call)` and track call contexts during flow
 calculation when differences in these counts show an improved precision in
 further calls.
 

docs/query-metadata-style-guide.md

@@ -113,11 +113,11 @@ Alert queries (`@kind problem` or `path-problem`) support two further properties
   * `medium`
   * `high`
   * `very-high`
-* `@problem.severity`–defines the level of severity of non-security alerts: 
+* `@problem.severity`–defines the likelihood that an alert, either security-related or not, causes an actual problem such as incorrect program behavior: 
   * `error`–an issue that is likely to cause incorrect program behavior, for example a crash or vulnerability.
   * `warning`–an issue that indicates a potential problem in the code, or makes the code fragile if another (unrelated) part of code is changed.
   * `recommendation`–an issue where the code behaves correctly, but it could be improved.
-* `@security-severity`-defines the level of severity, between 0.0 and 10.0, for queries with `@tags security`. For more information about calculating `@security-severity`, see the [GitHub changelog](https://github.blog/changelog/2021-07-19-codeql-code-scanning-new-severity-levels-for-security-alerts/).  
+* `@security-severity`-defines the level of severity, between 0.0 and 10.0, for queries with `@tags security`. For more information about how this value is calculated and then used in code scanning analysis, see [About alert severity and security severity levels](https://docs.github.com/code-security/code-scanning/managing-code-scanning-alerts/about-code-scanning-alerts#about-alert-severity-and-security-severity-levels) in the GitHub user documentation.
 
 ## Query tags `@tags`
 
@@ -155,7 +155,10 @@ If your query is a security query, use one or more `@tags` to associate it with
 ||`external/cwe/cwe-036` |
 ||`external/cwe/cwe-073` |
 
-When you tag a query like this, the associated CWE pages from [MITRE.org](https://cwe.mitre.org/index.html) will automatically appear in the reference section of its associated qhelp file.
+When you tag a query like this, the associated CWE pages from [MITRE.org](https://cwe.mitre.org/index.html) will automatically appear in the references section of its associated qhelp file.
+
+> [!NOTE]
+> The automatic addition of CWE reference links works only if the qhelp file already contains a `<references>` section.
 
 #### Metric/summary `@tags`
 
@@ -203,5 +206,3 @@ The `select` clause of a summary metric query must have one of the following res
   - This indicates a metric without a specific location in the codebase, for example the total lines of code in a codebase.
 - A code `entity` followed by a `number`
   - This indicates a metric with a specific location in the codebase, for example the lines of code within a file. The `entity` here must have a valid location in the source code.
-
-

go/documentation/library-coverage/coverage.csv

@@ -34,7 +34,7 @@ encoding/pem,,3,,3,
 encoding/xml,,23,,23,
 errors,,3,,3,
 expvar,,6,,6,
-fmt,,5,,5,
+fmt,,16,,16,
 github.com/astaxie/beego,,7,,7,
 github.com/astaxie/beego/context,,1,,1,
 github.com/astaxie/beego/utils,,13,,13,
@@ -53,6 +53,7 @@ github.com/labstack/echo,,2,,2,
 github.com/revel/revel,,10,,10,
 github.com/robfig/revel,,10,,10,
 github.com/sendgrid/sendgrid-go/$ANYVERSION/helpers/mail,,1,,1,
+github.com/valyala/fasthttp,,5,,5,
 go.uber.org/zap,,11,,11,
 golang.org/x/net/$ANYVERSION/html,,16,,16,
 golang.org/x/net/context,,5,,5,

go/documentation/library-coverage/coverage.rst

@@ -15,8 +15,9 @@ Go framework & library support
    `Macaron <https://gopkg.in/macaron.v1>`_,``gopkg.in/macaron*``,,1,
    `Revel <http://revel.github.io/>`_,"``github.com/revel/revel*``, ``github.com/robfig/revel*``",,20,
    `SendGrid <https://github.com/sendgrid/sendgrid-go>`_,``github.com/sendgrid/sendgrid-go*``,,1,
-   `Standard library <https://pkg.go.dev/std>`_,"````, ``archive/*``, ``bufio``, ``bytes``, ``cmp``, ``compress/*``, ``container/*``, ``context``, ``crypto``, ``crypto/*``, ``database/*``, ``debug/*``, ``embed``, ``encoding``, ``encoding/*``, ``errors``, ``expvar``, ``flag``, ``fmt``, ``go/*``, ``hash``, ``hash/*``, ``html``, ``html/*``, ``image``, ``image/*``, ``index/*``, ``io``, ``io/*``, ``log``, ``log/*``, ``maps``, ``math``, ``math/*``, ``mime``, ``mime/*``, ``net``, ``net/*``, ``os``, ``os/*``, ``path``, ``path/*``, ``plugin``, ``reflect``, ``reflect/*``, ``regexp``, ``regexp/*``, ``slices``, ``sort``, ``strconv``, ``strings``, ``sync``, ``sync/*``, ``syscall``, ``syscall/*``, ``testing``, ``testing/*``, ``text/*``, ``time``, ``time/*``, ``unicode``, ``unicode/*``, ``unsafe``",8,566,
+   `Standard library <https://pkg.go.dev/std>`_,"````, ``archive/*``, ``bufio``, ``bytes``, ``cmp``, ``compress/*``, ``container/*``, ``context``, ``crypto``, ``crypto/*``, ``database/*``, ``debug/*``, ``embed``, ``encoding``, ``encoding/*``, ``errors``, ``expvar``, ``flag``, ``fmt``, ``go/*``, ``hash``, ``hash/*``, ``html``, ``html/*``, ``image``, ``image/*``, ``index/*``, ``io``, ``io/*``, ``log``, ``log/*``, ``maps``, ``math``, ``math/*``, ``mime``, ``mime/*``, ``net``, ``net/*``, ``os``, ``os/*``, ``path``, ``path/*``, ``plugin``, ``reflect``, ``reflect/*``, ``regexp``, ``regexp/*``, ``slices``, ``sort``, ``strconv``, ``strings``, ``sync``, ``sync/*``, ``syscall``, ``syscall/*``, ``testing``, ``testing/*``, ``text/*``, ``time``, ``time/*``, ``unicode``, ``unicode/*``, ``unsafe``",8,577,
    `beego <https://beego.me/>`_,"``github.com/astaxie/beego*``, ``github.com/beego/beego*``",,42,
+   `fasthttp <https://github.com/valyala/fasthttp>`_,``github.com/valyala/fasthttp*``,,5,
    `go-pg <https://pg.uptrace.dev/>`_,``github.com/go-pg/pg*``,,6,
    `golang.org/x/net <https://pkg.go.dev/golang.org/x/net>`_,``golang.org/x/net*``,,21,
    `goproxy <https://github.com/elazarl/goproxy>`_,``github.com/elazarl/goproxy*``,,2,
@@ -25,5 +26,5 @@ Go framework & library support
    `protobuf <https://pkg.go.dev/google.golang.org/protobuf>`_,"``github.com/golang/protobuf*``, ``google.golang.org/protobuf*``",,16,
    `yaml <https://gopkg.in/yaml.v3>`_,``gopkg.in/yaml*``,,9,
    `zap <https://go.uber.org/zap>`_,``go.uber.org/zap*``,,11,
-   Totals,,8,826,
+   Totals,,8,842,
 

go/documentation/library-coverage/frameworks.csv

@@ -4,6 +4,7 @@ beego,https://beego.me/,github.com/astaxie/beego* github.com/beego/beego*
 Couchbase official client(gocb),https://github.com/couchbase/gocb,github.com/couchbase/gocb* gopkg.in/couchbase/gocb*
 Couchbase unofficial client,http://www.github.com/couchbase/go-couchbase,github.com/couchbaselabs/gocb*
 Echo,https://echo.labstack.com/,github.com/labstack/echo*
+fasthttp,https://github.com/valyala/fasthttp,github.com/valyala/fasthttp*
 Gin,https://github.com/gin-gonic/gin,github.com/gin-gonic/gin*
 go-pg,https://pg.uptrace.dev/,github.com/go-pg/pg*
 golang.org/x/net,https://pkg.go.dev/golang.org/x/net,golang.org/x/net*

go/extractor/cli/go-autobuilder/go-autobuilder.go

@@ -96,7 +96,15 @@ func getEnvGoSemVer() string {
 	if !strings.HasPrefix(goVersion, "go") {
 		log.Fatalf("Expected 'go version' output of the form 'go1.2.3'; got '%s'", goVersion)
 	}
-	return "v" + goVersion[2:]
+	// Go versions don't follow the SemVer format, but the only exception we normally care about
+	// is release candidates; so this is a horrible hack to convert e.g. `go1.22rc1` into `go1.22-rc1`
+	// which is compatible with the SemVer specification
+	rcIndex := strings.Index(goVersion, "rc")
+	if rcIndex != -1 {
+		return semver.Canonical("v"+goVersion[2:rcIndex]) + "-" + goVersion[rcIndex:]
+	} else {
+		return semver.Canonical("v" + goVersion[2:])
+	}
 }
 
 // Returns the import path of the package being built, or "" if it cannot be determined.

go/extractor/go.mod

@@ -4,5 +4,5 @@ go 1.21
 
 require (
 	golang.org/x/mod v0.14.0
-	golang.org/x/tools v0.16.1
+	golang.org/x/tools v0.17.0
 )