Merge pull request #20858 from github/redsun82/2.23.6

Changedocs 2.23.5

.github/workflows/build-ripunzip.yml

@@ -1,29 +1,58 @@
-name: Build runzip
+name: Build ripunzip
 
 on:
   workflow_dispatch:
     inputs:
       ripunzip-version:
-        description: "what reference to checktout from google/runzip"
+        description: What reference to checkout from google/ripunzip. Latest by default
         required: false
-        default: v2.0.2
       openssl-version:
-        description: "what reference to checkout from openssl/openssl for Linux"
+        description: What reference to checkout from openssl/openssl for Linux. Latest by default
         required: false
-        default: openssl-3.5.0
+      open-pr:
+        description: Open a pull request updating the ripunzip versions committed to lfs
+        required: false
+        default: true  # will be false on PRs
+  pull_request:
+    paths:
+      - .github/workflows/build-ripunzip.yml
 
+permissions: {}
+  
 jobs:
+  versions:
+    runs-on: ubuntu-slim
+    outputs:
+      ripunzip-version: ${{ inputs.ripunzip-version || steps.fetch-ripunzip-version.outputs.version }}
+      openssl-version: ${{ inputs.openssl-version || steps.fetch-openssl-version.outputs.version }}
+    steps:
+      - name: Fetch latest ripunzip version
+        id: fetch-ripunzip-version
+        if: "!inputs.ripunzip-version"
+        run: &fetch-version
+          echo "version=$(gh release view --repo $REPO --json tagName --jq .tagName)" | tee -a $GITHUB_OUTPUT
+        env:
+          REPO: "google/ripunzip"
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Fetch latest openssl version
+        id: fetch-openssl-version
+        if: "!inputs.openssl-version"
+        run: *fetch-version
+        env:
+          REPO: "openssl/openssl"
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   build:
+    needs: versions
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-22.04, macos-13, windows-2022]
+        os: [ubuntu-24.04, macos-15, windows-2025]
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v5
         with:
           repository: google/ripunzip
-          ref: ${{ inputs.ripunzip-version }}
+          ref: ${{ needs.versions.outputs.ripunzip-version }}
       # we need to avoid ripunzip dynamically linking into libssl
       # see https://github.com/sfackler/rust-openssl/issues/183
       - if: runner.os == 'Linux'
@@ -32,7 +61,7 @@ jobs:
         with:
           repository: openssl/openssl
           path: openssl
-          ref: ${{ inputs.openssl-version }}
+          ref: ${{ needs.versions.outputs.openssl-version }}
       - if: runner.os == 'Linux'
         name: build and install openssl with fPIC
         shell: bash
@@ -64,11 +93,74 @@ jobs:
           lipo -create -output ripunzip-macos \
             -arch x86_64 target/x86_64-apple-darwin/release/ripunzip \
             -arch arm64 target/aarch64-apple-darwin/release/ripunzip
-      - uses: actions/upload-artifact@v4
+      - name: Archive
+        shell: bash
+        run: |
+          tar acf ripunzip-$RUNNER_OS.tar.zst ripunzip-$(echo $RUNNER_OS | tr '[:upper:]' '[:lower:]')
+      - name: Upload built binary
+        uses: actions/upload-artifact@v4
         with:
           name: ripunzip-${{ runner.os }}
-          path: ripunzip-*
+          path: ripunzip-${{ runner.os }}.tar.zst
+          retention-days: 5
+          compression: 0
       - name: Check built binary
         shell: bash
         run: |
+          rm -f ripunzip-*.tar.zst
           ./ripunzip-* --version
+  publish:
+    needs: [versions, build]
+    if: inputs.open-pr == 'true'
+    permissions:
+      contents: write
+      pull-requests: write
+    runs-on: ubuntu-slim
+    steps:
+      # workaround for git-lfs not being installed yet on ubuntu-slim runners
+      - name: Ensure git-lfs is installed
+        shell: bash
+        run: |
+          if which git-lfs &>/dev/null; then
+            echo "git-lfs is already installed"
+            exit 0
+          fi
+          cd $TMP
+          gh release download --repo git-lfs/git-lfs --pattern "git-lfs-linux-amd64-*.tar.gz" --clobber
+          tar xzf git-lfs-linux-amd64-*.tar.gz
+          rm git-lfs-linux-amd64-*.tar.gz
+          cd git-lfs-*
+          pwd | tee -a $GITHUB_PATH
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - uses: actions/checkout@v5
+        with:
+          sparse-checkout: |
+            .github
+            misc/ripunzip
+          lfs: true
+      - name: Download built binaries
+        uses: actions/download-artifact@v4
+        with:
+          merge-multiple: true
+          path: misc/ripunzip
+      - name: Open PR
+        shell: bash
+        run: |
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "github-actions[bot]@users.noreply.github.com"
+          git switch -c update-ripunzip
+          git add misc/ripunzip
+          git commit -m "Update ripunzip binaries to version $VERSION"
+          git push --set-upstream origin update-ripunzip --force
+          TITLE="Update ripunzip binaries to version $VERSION"
+          gh pr create \
+            --draft \
+            --title "$TITLE" \
+            --body "Automated update of ripunzip binaries." \
+            --assignee "$ACTOR" ||
+              (gh pr edit --title "$TITLE" --add-assignee "$ACTOR" && gh pr ready --undo)
+        env:
+          ACTOR: ${{ github.actor }}
+          VERSION: ${{ needs.versions.outputs.ripunzip-version }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

CODEOWNERS

@@ -5,19 +5,29 @@
 /actions/ @github/codeql-dynamic
 /cpp/ @github/codeql-c-analysis
 /csharp/ @github/codeql-csharp
-/csharp/autobuilder/Semmle.Autobuild.Cpp @github/codeql-c-extractor
-/csharp/autobuilder/Semmle.Autobuild.Cpp.Tests @github/codeql-c-extractor
+/csharp/autobuilder/Semmle.Autobuild.Cpp @github/codeql-c-extractor @github/code-scanning-language-coverage
+/csharp/autobuilder/Semmle.Autobuild.Cpp.Tests @github/codeql-c-extractor @github/code-scanning-language-coverage
 /go/ @github/codeql-go
+/go/codeql-tools/ @github/codeql-go @github/code-scanning-language-coverage
+/go/downgrades/ @github/codeql-go @github/code-scanning-language-coverage
+/go/extractor/ @github/codeql-go @github/code-scanning-language-coverage
+/go/extractor-smoke-test/ @github/codeql-go @github/code-scanning-language-coverage
+/go/ql/test/extractor-tests/ @github/codeql-go @github/code-scanning-language-coverage
 /java/ @github/codeql-java
 /javascript/ @github/codeql-javascript
+/javascript/extractor/ @github/codeql-javascript @github/code-scanning-language-coverage
 /python/ @github/codeql-python
+/python/extractor/ @github/codeql-python @github/code-scanning-language-coverage
 /ql/ @github/codeql-ql-for-ql-reviewers
 /ruby/ @github/codeql-ruby
+/ruby/extractor/ @github/codeql-ruby @github/code-scanning-language-coverage
 /rust/ @github/codeql-rust
+/rust/extractor/ @github/codeql-rust @github/code-scanning-language-coverage
 /shared/ @github/codeql-shared-libraries-reviewers
 /swift/ @github/codeql-swift
+/swift/extractor/ @github/codeql-swift @github/code-scanning-language-coverage
 /misc/codegen/ @github/codeql-swift
-/java/kotlin-extractor/ @github/codeql-kotlin
+/java/kotlin-extractor/ @github/codeql-kotlin @github/code-scanning-language-coverage
 /java/ql/test-kotlin1/ @github/codeql-kotlin
 /java/ql/test-kotlin2/ @github/codeql-kotlin
 

MODULE.bazel

@@ -273,19 +273,19 @@ lfs_archive = use_repo_rule("//misc/bazel:lfs.bzl", "lfs_archive")
 
 lfs_archive(
     name = "ripunzip-linux",
-    src = "//misc/ripunzip:ripunzip-Linux.zip",
+    src = "//misc/ripunzip:ripunzip-Linux.tar.zst",
     build_file = "//misc/ripunzip:BUILD.ripunzip.bazel",
 )
 
 lfs_archive(
     name = "ripunzip-windows",
-    src = "//misc/ripunzip:ripunzip-Windows.zip",
+    src = "//misc/ripunzip:ripunzip-Windows.tar.zst",
     build_file = "//misc/ripunzip:BUILD.ripunzip.bazel",
 )
 
 lfs_archive(
     name = "ripunzip-macos",
-    src = "//misc/ripunzip:ripunzip-macOS.zip",
+    src = "//misc/ripunzip:ripunzip-macOS.tar.zst",
     build_file = "//misc/ripunzip:BUILD.ripunzip.bazel",
 )
 

actions/ql/lib/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 0.4.21
+
+No user-facing changes.
+
 ## 0.4.20
 
 No user-facing changes.

actions/ql/lib/change-notes/released/0.4.21.md

@@ -0,0 +1,3 @@
+## 0.4.21
+
+No user-facing changes.

actions/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.4.20
+lastReleaseVersion: 0.4.21

actions/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/actions-all
-version: 0.4.20
+version: 0.4.21
 library: true
 warnOnImplicitThis: true
 dependencies:

actions/ql/src/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 0.6.13
+
+No user-facing changes.
+
 ## 0.6.12
 
 No user-facing changes.

actions/ql/src/change-notes/released/0.6.13.md

@@ -0,0 +1,3 @@
+## 0.6.13
+
+No user-facing changes.

actions/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.6.12
+lastReleaseVersion: 0.6.13

actions/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/actions-queries
-version: 0.6.12
+version: 0.6.13
 library: false
 warnOnImplicitThis: true
 groups: [actions, queries]

cpp/downgrades/1a6854060d5d3ada16c580a29f8c5ce21f3367f8/upgrade.properties

@@ -0,0 +1,3 @@
+description: Support expanded compilation argument lists
+compatibility: full
+compilation_expanded_args.rel: delete

cpp/downgrades/2121ffec11fac265524955fee1775217364d4ca4/upgrade.properties

@@ -0,0 +1,2 @@
+description: Fix decltype qualifier issue
+compatibility: full

cpp/ql/lib/CHANGELOG.md

@@ -1,3 +1,13 @@
+## 6.1.0
+
+### New Features
+
+* New predicates `getAnExpandedArgument` and `getExpandedArgument` were added to the `Compilation` class, yielding compilation arguments after expansion of response files.
+
+### Bug Fixes
+
+* Improve performance of the range analysis in cases where it would otherwise take an exorbitant amount of time.
+
 ## 6.0.1
 
 No user-facing changes.
@@ -259,8 +269,8 @@ No user-facing changes.
 
 ### Breaking Changes
 
-* Deleted many deprecated taint-tracking configurations based on `TaintTracking::Configuration`.
-* Deleted many deprecated dataflow configurations based on `DataFlow::Configuration`.
+* Deleted many deprecated taint-tracking configurations based on `TaintTracking::Configuration`. 
+* Deleted many deprecated dataflow configurations based on `DataFlow::Configuration`. 
 * Deleted the deprecated `hasQualifiedName` and `isDefined` predicates from the `Declaration` class, use `hasGlobalName` and `hasDefinition` respectively instead.
 * Deleted the `getFullSignature` predicate from the `Function` class, use `getIdentityString(Declaration)` from `semmle.code.cpp.Print` instead.
 * Deleted the deprecated `freeCall` predicate from `Alloc.qll`. Use `DeallocationExpr` instead.
@@ -294,7 +304,7 @@ No user-facing changes.
 * A `getTemplateClass` predicate was added to the `DeductionGuide` class to get the class template for which the deduction guide is a guide.
 * An `isExplicit` predicate was added to the `Function` class that determines whether the function was declared as explicit.
 * A `getExplicitExpr` predicate was added to the `Function` class that yields the constant boolean expression (if any) that conditionally determines whether the function is explicit.
-* A `isDestroyingDeleteDeallocation` predicate was added to the `NewOrNewArrayExpr` and `DeleteOrDeleteArrayExpr` classes to indicate whether the deallocation function is a destroying delete.
+* A `isDestroyingDeleteDeallocation` predicate was added to the `NewOrNewArrayExpr` and `DeleteOrDeleteArrayExpr` classes to indicate whether the deallocation function is a destroying delete. 
 
 ### Minor Analysis Improvements
 
@@ -372,9 +382,9 @@ No user-facing changes.
 ### New Features
 
 * Added a `TaintInheritingContent` class that can be extended to model taint flowing from a qualifier to a field.
-* Added a predicate `GuardCondition.comparesEq/4` to query whether an expression is compared to a constant.
+* Added a predicate `GuardCondition.comparesEq/4` to query whether an expression is compared to a constant. 
 * Added a predicate `GuardCondition.ensuresEq/4` to query whether a basic block is guarded by an expression being equal to a constant.
-* Added a predicate `GuardCondition.comparesLt/4` to query whether an expression is compared to a constant.
+* Added a predicate `GuardCondition.comparesLt/4` to query whether an expression is compared to a constant. 
 * Added a predicate `GuardCondition.ensuresLt/4` to query whether a basic block is guarded by an expression being less than a constant.
 * Added a predicate `GuardCondition.valueControls` to query whether a basic block is guarded by a particular `case` of a `switch` statement.
 
@@ -490,7 +500,7 @@ No user-facing changes.
 * Functions that do not return due to calling functions that don't return (e.g. `exit`) are now detected as
  non-returning in the IR and dataflow.
 * Treat functions that reach the end of the function as returning in the IR.
-  They used to be treated as unreachable but it is allowed in C.
+  They used to be treated as unreachable but it is allowed in C. 
 * The `DataFlow::asDefiningArgument` predicate now takes its argument from the range starting at `1` instead of `2`. Queries that depend on the single-parameter version of `DataFlow::asDefiningArgument` should have their arguments updated accordingly.
 
 ## 0.9.3
@@ -539,7 +549,7 @@ No user-facing changes.
 
 ### New Features
 
-* The `DataFlow::StateConfigSig` signature module has gained default implementations for `isBarrier/2` and `isAdditionalFlowStep/4`.
+* The `DataFlow::StateConfigSig` signature module has gained default implementations for `isBarrier/2` and `isAdditionalFlowStep/4`. 
   Hence it is no longer needed to provide `none()` implementations of these predicates if they are not needed.
 
 ### Minor Analysis Improvements
@@ -733,7 +743,7 @@ No user-facing changes.
 
 ### Deprecated APIs
 
-* Some classes/modules with upper-case acronyms in their name have been renamed to follow our style-guide.
+* Some classes/modules with upper-case acronyms in their name have been renamed to follow our style-guide. 
   The old name still exists as a deprecated alias.
 
 ### New Features
@@ -750,7 +760,7 @@ No user-facing changes.
 
 ### Deprecated APIs
 
-* Many classes/predicates/modules with upper-case acronyms in their name have been renamed to follow our style-guide.
+* Many classes/predicates/modules with upper-case acronyms in their name have been renamed to follow our style-guide. 
   The old name still exists as a deprecated alias.
 
 ### New Features
@@ -849,7 +859,7 @@ No user-facing changes.
 
 ### Deprecated APIs
 
-* Many classes/predicates/modules that had upper-case acronyms have been renamed to follow our style-guide.
+* Many classes/predicates/modules that had upper-case acronyms have been renamed to follow our style-guide. 
   The old name still exists as a deprecated alias.
 
 ### New Features

cpp/ql/lib/change-notes/released/6.1.0.md

@@ -0,0 +1,9 @@
+## 6.1.0
+
+### New Features
+
+* New predicates `getAnExpandedArgument` and `getExpandedArgument` were added to the `Compilation` class, yielding compilation arguments after expansion of response files.
+
+### Bug Fixes
+
+* Improve performance of the range analysis in cases where it would otherwise take an exorbitant amount of time.

cpp/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 6.0.1
+lastReleaseVersion: 6.1.0

cpp/ql/lib/ext/cctype.model.yml

@@ -0,0 +1,9 @@
+extensions:
+  - addsTo:
+      pack: codeql/cpp-all
+      extensible: summaryModel
+    data: # namespace, type, subtypes, name, signature, ext, input, output, kind, provenance
+      - ["", "", False, "tolower", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
+      - ["std", "", False, "tolower", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
+      - ["", "", False, "toupper", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
+      - ["std", "", False, "toupper", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]

cpp/ql/lib/ext/iconv.model.yml

@@ -0,0 +1,7 @@
+extensions:
+  - addsTo:
+      pack: codeql/cpp-all
+      extensible: summaryModel
+    data: # namespace, type, subtypes, name, signature, ext, input, output, kind, provenance
+      - ["", "", False, "iconv", "", "", "Argument[**1]", "Argument[**3]", "value", "manual"]
+      

cpp/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/cpp-all
-version: 6.0.1
+version: 6.1.0
 groups: cpp
 dbscheme: semmlecode.cpp.dbscheme
 extractor: cpp

cpp/ql/lib/semmle/code/cpp/Compilation.qll

@@ -94,6 +94,21 @@ class Compilation extends @compilation {
    */
   string getArgument(int i) { compilation_args(this, i, result) }
 
+  /**
+   * Gets an expanded argument passed to the extractor on this invocation.
+   */
+  string getAnExpandedArgument() { result = this.getArgument(_) }
+
+  /**
+   * Gets the `i`th expanded argument passed to the extractor on this
+   * invocation.
+   *
+   * This is similar to `getArgument`, but for a `@someFile` argument, it
+   * includes the arguments from that file, rather than just taking the
+   * argument literally.
+   */
+  string getExpandedArgument(int i) { compilation_expanded_args(this, i, result) }
+
   /**
    * Gets the total amount of CPU time spent processing all the files in the
    * front-end and extractor.

cpp/ql/lib/semmle/code/cpp/NameQualifiers.qll

@@ -144,14 +144,14 @@ class NameQualifiableElement extends Element, @namequalifiableelement {
 class NameQualifyingElement extends Element, @namequalifyingelement {
   /**
    * Gets a name qualifier for which this is the qualifying namespace or
-   * user-defined type. For example: class `X` is the
+   * user-defined type, or decltype. For example: class `X` is the
    * `NameQualifyingElement` and `X::` is the `NameQualifier`.
    */
   NameQualifier getANameQualifier() {
     namequalifiers(unresolveElement(result), _, underlyingElement(this), _)
   }
 
-  /** Gets the name of this namespace or user-defined type. */
+  /** Gets the name of this namespace, user-defined type, or decltype. */
   string getName() { none() }
 }
 

cpp/ql/lib/semmle/code/cpp/Type.qll

@@ -1146,7 +1146,7 @@ class DerivedType extends Type, @derivedtype {
  * decltype(a) b;
  * ```
  */
-class Decltype extends Type {
+class Decltype extends Type, NameQualifyingElement {
   Decltype() { decltypes(underlyingElement(this), _, 0, _, _) }
 
   override string getAPrimaryQlClass() { result = "Decltype" }
@@ -1187,7 +1187,7 @@ class Decltype extends Type {
 
   override string toString() { result = "decltype(...)" }
 
-  override string getName() { none() }
+  override string getName() { result = "decltype(...)" }
 
   override int getSize() { result = this.getBaseType().getSize() }
 
@@ -1247,7 +1247,7 @@ class TypeofType extends Type {
 
   override string toString() { result = "typeof(...)" }
 
-  override string getName() { none() }
+  override string getName() { result = "typeof(...)" }
 
   override int getSize() { result = this.getBaseType().getSize() }
 
@@ -1311,8 +1311,6 @@ class TypeofTypeType extends TypeofType {
   Type getType() { type_operators(underlyingElement(this), unresolveElement(result), _, _) }
 
   override string getAPrimaryQlClass() { result = "TypeofTypeType" }
-
-  override string toString() { result = "typeof(...)" }
 }
 
 /**
@@ -1394,7 +1392,7 @@ class IntrinsicTransformedType extends Type {
 
   override Type resolveTypedefs() { result = this.getBaseType().resolveTypedefs() }
 
-  override string getName() { none() }
+  override string getName() { result = this.getIntrinsicName() + "(...)" }
 
   override int getSize() { result = this.getBaseType().getSize() }
 

cpp/ql/lib/semmle/code/cpp/controlflow/IRGuards.qll

@@ -703,6 +703,7 @@ private class GuardConditionFromBinaryLogicalOperator extends GuardConditionImpl
     )
   }
 
+  pragma[nomagic]
   override predicate comparesLt(
     Cpp::Expr left, Cpp::Expr right, int k, boolean isLessThan, boolean testIsTrue
   ) {
@@ -713,6 +714,7 @@ private class GuardConditionFromBinaryLogicalOperator extends GuardConditionImpl
     )
   }
 
+  pragma[nomagic]
   override predicate comparesLt(Cpp::Expr e, int k, boolean isLessThan, GuardValue value) {
     exists(GuardValue partValue, GuardCondition part |
       this.(Cpp::BinaryLogicalOperation)
@@ -738,6 +740,7 @@ private class GuardConditionFromBinaryLogicalOperator extends GuardConditionImpl
     )
   }
 
+  pragma[nomagic]
   override predicate comparesEq(
     Cpp::Expr left, Cpp::Expr right, int k, boolean areEqual, boolean testIsTrue
   ) {
@@ -757,6 +760,7 @@ private class GuardConditionFromBinaryLogicalOperator extends GuardConditionImpl
     )
   }
 
+  pragma[nomagic]
   override predicate comparesEq(Cpp::Expr e, int k, boolean areEqual, GuardValue value) {
     exists(GuardValue partValue, GuardCondition part |
       this.(Cpp::BinaryLogicalOperation)

cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll

@@ -656,6 +656,7 @@ private string getTypeNameWithoutFunctionTemplates(Function f, int n, int remain
  * Normalize the `n`'th parameter of `f` by replacing template names
  * with `class:N` (where `N` is the index of the template).
  */
+pragma[nomagic]
 private string getTypeNameWithoutClassTemplates(Function f, int n, int remaining) {
   // If there is a declaring type then we start by expanding the function templates
   exists(Class template |
@@ -727,6 +728,7 @@ private string getSignatureWithoutClassTemplateNames(
  * - The `remaining` number of template arguments in `partiallyNormalizedSignature`
  * with their index in `nameArgs`.
  */
+pragma[nomagic]
 private string getSignatureWithoutFunctionTemplateNames(
   string partiallyNormalizedSignature, string typeArgs, string nameArgs, int remaining
 ) {
@@ -770,6 +772,7 @@ private string getSignatureWithoutFunctionTemplateNames(
  * ```
  * In this case, `normalizedSignature` will be `"(const func:0 &,int,class:1,class:0 *)"`.
  */
+pragma[nomagic]
 private predicate elementSpecWithArguments(
   string signature, string type, string name, string normalizedSignature, string typeArgs,
   string nameArgs
@@ -789,6 +792,35 @@ private string getSignatureParameterName(string signature, string type, string n
   )
 }
 
+/**
+ * Gets a `Function` identified by the `(namespace, type, name)` components.
+ *
+ * If `subtypes` is `true` then the result may be an override of the function
+ * identified by the components.
+ */
+pragma[nomagic]
+private Function getFunction(string namespace, string type, boolean subtypes, string name) {
+  elementSpec(namespace, type, subtypes, name, _, _) and
+  (
+    funcHasQualifiedName(result, namespace, name) and
+    subtypes = false and
+    type = ""
+    or
+    exists(Class namedClass, Class classWithMethod |
+      hasClassAndName(classWithMethod, result, name) and
+      classHasQualifiedName(namedClass, namespace, type)
+    |
+      // member declared in the named type or a subtype of it
+      subtypes = true and
+      classWithMethod = namedClass.getADerivedClass*()
+      or
+      // member declared directly in the named type
+      subtypes = false and
+      classWithMethod = namedClass
+    )
+  )
+}
+
 /**
  * Holds if the suffix containing the entries in `signature` starting at entry
  * `i` matches the suffix containing the parameters of `func` starting at entry `i`.
@@ -812,13 +844,17 @@ private string getSignatureParameterName(string signature, string type, string n
  * is `func:n` then the signature name is compared with the `n`'th name
  * in `name`.
  */
-private predicate signatureMatches(Function func, string signature, string type, string name, int i) {
+pragma[nomagic]
+private predicate signatureMatches(
+  Function func, string namespace, string signature, string type, string name, int i
+) {
+  func = getFunction(namespace, type, _, name) and
   exists(string s |
     s = getSignatureParameterName(signature, type, name, i) and
     s = getParameterTypeName(func, i)
   ) and
   if exists(getParameterTypeName(func, i + 1))
-  then signatureMatches(func, signature, type, name, i + 1)
+  then signatureMatches(func, namespace, signature, type, name, i + 1)
   else i = count(signature.indexOf(","))
 }
 
@@ -833,7 +869,7 @@ module ExternalFlowDebug {
    *
    * Exposed for testing purposes.
    */
-  predicate signatureMatches_debug = signatureMatches/5;
+  predicate signatureMatches_debug = signatureMatches/6;
 
   /**
    * INTERNAL: Do not use.
@@ -883,6 +919,7 @@ private predicate parseParens(string s, string betweenParens) { s = "(" + betwee
  * - `signatureWithoutParens` equals `signature`, but with the surrounding
  *    parentheses removed.
  */
+pragma[nomagic]
 private predicate elementSpecWithArguments0(
   string signature, string type, string name, string signatureWithoutParens, string typeArgs,
   string nameArgs
@@ -909,7 +946,7 @@ private predicate elementSpecMatchesSignature(
 ) {
   elementSpec(namespace, pragma[only_bind_into](type), subtypes, pragma[only_bind_into](name),
     pragma[only_bind_into](signature), _) and
-  signatureMatches(func, signature, type, name, 0)
+  signatureMatches(func, namespace, signature, type, name, 0)
 }
 
 /**
@@ -953,7 +990,7 @@ private predicate funcHasQualifiedName(Function func, string namespace, string n
  * Holds if `namedClass` is in namespace `namespace` and has
  * name `type` (excluding any template parameters).
  */
-bindingset[type, namespace]
+bindingset[type]
 pragma[inline_late]
 private predicate classHasQualifiedName(Class namedClass, string namespace, string type) {
   exists(string typeWithoutArgs |
@@ -969,17 +1006,14 @@ private predicate classHasQualifiedName(Class namedClass, string namespace, stri
  *    are also returned.
  * 3. The element has name `name`
  * 4. If `signature` is non-empty, then the element has a list of parameter types described by `signature`.
- *
- * NOTE: `namespace` is currently not used (since we don't properly extract modules yet).
  */
 pragma[nomagic]
 private Element interpretElement0(
   string namespace, string type, boolean subtypes, string name, string signature
 ) {
+  result = getFunction(namespace, type, subtypes, name) and
   (
     // Non-member functions
-    funcHasQualifiedName(result, namespace, name) and
-    subtypes = false and
     type = "" and
     (
       elementSpecMatchesSignature(result, namespace, type, subtypes, name, signature)
@@ -989,52 +1023,36 @@ private Element interpretElement0(
     )
     or
     // Member functions
-    exists(Class namedClass, Class classWithMethod |
-      hasClassAndName(classWithMethod, result, name) and
-      classHasQualifiedName(namedClass, namespace, type)
-    |
-      (
-        elementSpecMatchesSignature(result, namespace, type, subtypes, name, signature)
-        or
-        signature = "" and
-        elementSpec(namespace, type, subtypes, name, "", _)
-      ) and
-      (
-        // member declared in the named type or a subtype of it
-        subtypes = true and
-        classWithMethod = namedClass.getADerivedClass*()
-        or
-        // member declared directly in the named type
-        subtypes = false and
-        classWithMethod = namedClass
-      )
-    )
+    elementSpecMatchesSignature(result, namespace, type, subtypes, name, signature)
     or
-    elementSpec(namespace, type, subtypes, name, signature, _) and
-    // Member variables
     signature = "" and
-    exists(Class namedClass, Class classWithMember, MemberVariable member |
-      member.getName() = name and
-      member = classWithMember.getAMember() and
-      namedClass.hasQualifiedName(namespace, type) and
-      result = member
-    |
-      // field declared in the named type or a subtype of it (or an extension of any)
-      subtypes = true and
-      classWithMember = namedClass.getADerivedClass*()
-      or
-      // field declared directly in the named type (or an extension of it)
-      subtypes = false and
-      classWithMember = namedClass
-    )
-    or
-    // Global or namespace variables
-    elementSpec(namespace, type, subtypes, name, signature, _) and
-    signature = "" and
-    type = "" and
-    subtypes = false and
-    result = any(GlobalOrNamespaceVariable v | v.hasQualifiedName(namespace, name))
+    elementSpec(namespace, type, subtypes, name, signature, _)
   )
+  or
+  // Member variables
+  elementSpec(namespace, type, subtypes, name, signature, _) and
+  signature = "" and
+  exists(Class namedClass, Class classWithMember, MemberVariable member |
+    member.getName() = name and
+    member = classWithMember.getAMember() and
+    namedClass.hasQualifiedName(namespace, type) and
+    result = member
+  |
+    // field declared in the named type or a subtype of it (or an extension of any)
+    subtypes = true and
+    classWithMember = namedClass.getADerivedClass*()
+    or
+    // field declared directly in the named type (or an extension of it)
+    subtypes = false and
+    classWithMember = namedClass
+  )
+  or
+  // Global or namespace variables
+  elementSpec(namespace, type, subtypes, name, signature, _) and
+  signature = "" and
+  type = "" and
+  subtypes = false and
+  result = any(GlobalOrNamespaceVariable v | v.hasQualifiedName(namespace, name))
 }
 
 cached

cpp/ql/lib/semmle/code/cpp/models/implementations/Memcpy.qll

@@ -12,8 +12,8 @@ import semmle.code.cpp.models.interfaces.Taint
 import semmle.code.cpp.models.interfaces.NonThrowing
 
 /**
- * The standard functions `memcpy`, `memmove` and `bcopy`; and the gcc variant
- * `__builtin___memcpy_chk`.
+ * The standard functions `memcpy`, `memmove` and `bcopy`; and variants such as
+ * `__builtin___memcpy_chk` and `__builtin___memmove_chk`.
  */
 private class MemcpyFunction extends ArrayFunction, DataFlowFunction, SideEffectFunction,
   AliasFunction, NonCppThrowingFunction
@@ -27,7 +27,9 @@ private class MemcpyFunction extends ArrayFunction, DataFlowFunction, SideEffect
     // bcopy(src, dest, num)
     // mempcpy(dest, src, num)
     // memccpy(dest, src, c, n)
-    this.hasGlobalName(["bcopy", mempcpy(), "memccpy", "__builtin___memcpy_chk"])
+    this.hasGlobalName([
+        "bcopy", mempcpy(), "memccpy", "__builtin___memcpy_chk", "__builtin___memmove_chk"
+      ])
   }
 
   /**

cpp/ql/lib/semmle/code/cpp/models/implementations/Memset.qll

@@ -19,7 +19,8 @@ private class MemsetFunctionModel extends ArrayFunction, DataFlowFunction, Alias
     this.hasGlobalOrStdName("wmemset")
     or
     this.hasGlobalName([
-        bzero(), "__builtin_memset", "__builtin_memset_chk", "RtlZeroMemory", "RtlSecureZeroMemory"
+        bzero(), "__builtin_memset", "__builtin_memset_chk", "__builtin___memset_chk",
+        "RtlZeroMemory", "RtlSecureZeroMemory"
       ])
   }
 
@@ -32,7 +33,7 @@ private class MemsetFunctionModel extends ArrayFunction, DataFlowFunction, Alias
       or
       this.hasGlobalOrStdName("wmemset")
       or
-      this.hasGlobalName(["__builtin_memset", "__builtin_memset_chk"])
+      this.hasGlobalName(["__builtin_memset", "__builtin_memset_chk", "__builtin___memset_chk"])
     ) and
     result = 1
   }

cpp/ql/lib/semmle/code/cpp/models/implementations/Strcat.qll

@@ -30,7 +30,9 @@ class StrcatFunction extends TaintFunction, DataFlowFunction, ArrayFunction, Sid
         "_mbsncat", // _mbsncat(dst, src, max_amount)
         "_mbsncat_l", // _mbsncat_l(dst, src, max_amount, locale)
         "_mbsnbcat", // _mbsnbcat(dest, src, count)
-        "_mbsnbcat_l" // _mbsnbcat_l(dest, src, count, locale)
+        "_mbsnbcat_l", // _mbsnbcat_l(dest, src, count, locale)
+        "__builtin___strcat_chk", // __builtin___strcat_chk (dest, src, magic)
+        "__builtin___strncat_chk" // __builtin___strncat_chk (dest, src, max_amount, magic)
       ])
   }
 
@@ -56,7 +58,7 @@ class StrcatFunction extends TaintFunction, DataFlowFunction, ArrayFunction, Sid
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     (
-      this.getName() = ["strncat", "wcsncat", "_mbsncat", "_mbsncat_l"] and
+      this.getName() = ["strncat", "wcsncat", "_mbsncat", "_mbsncat_l", "__builtin___strncat_chk"] and
       input.isParameter(2)
       or
       this.getName() = ["_mbsncat_l", "_mbsnbcat_l"] and

cpp/ql/lib/semmle/code/cpp/models/implementations/Strcpy.qll

@@ -36,7 +36,11 @@ class StrcpyFunction extends ArrayFunction, DataFlowFunction, TaintFunction, Sid
         "_mbsnbcpy", // _mbsnbcpy(dest, src, max_amount)
         "stpcpy", // stpcpy(dest, src)
         "stpncpy", // stpncpy(dest, src, max_amount)
-        "strlcpy" // strlcpy(dst, src, dst_size)
+        "strlcpy", // strlcpy(dst, src, dst_size)
+        "__builtin___strcpy_chk", // __builtin___strcpy_chk (dest, src, magic)
+        "__builtin___stpcpy_chk", // __builtin___stpcpy_chk (dest, src, magic)
+        "__builtin___stpncpy_chk", // __builtin___stpncpy_chk(dest, src, max_amount, magic)
+        "__builtin___strncpy_chk" // __builtin___strncpy_chk (dest, src, max_amount, magic)
       ])
     or
     (

cpp/ql/lib/semmle/code/cpp/rangeanalysis/SimpleRangeAnalysis.qll

@@ -93,6 +93,18 @@ private float wideningUpperBounds(ArithmeticType t) {
   result = 1.0 / 0.0 // +Inf
 }
 
+/** Gets the widened lower bound for a given type and lower bound. */
+bindingset[type, lb]
+float widenLowerBound(Type type, float lb) {
+  result = max(float widenLB | widenLB = wideningLowerBounds(type) and widenLB <= lb | widenLB)
+}
+
+/** Gets the widened upper bound for a given type and upper bound. */
+bindingset[type, ub]
+float widenUpperBound(Type type, float ub) {
+  result = min(float widenUB | widenUB = wideningUpperBounds(type) and widenUB >= ub | widenUB)
+}
+
 /**
  * Gets the value of the expression `e`, if it is a constant.
  * This predicate also handles the case of constant variables initialized in different
@@ -504,6 +516,336 @@ private predicate isRecursiveExpr(Expr e) {
   )
 }
 
+/**
+ * Provides predicates that estimate the number of bounds that the range
+ * analysis might produce.
+ */
+private module BoundsEstimate {
+  /**
+   * Gets the limit beyond which we enable widening. That is, if the estimated
+   * number of bounds exceeds this limit, we enable widening such that the limit
+   * will not be reached.
+   */
+  float getBoundsLimit() {
+    // This limit is arbitrary, but low enough that it prevents timeouts on
+    // specific observed customer databases (and the in the tests).
+    result = 2.0.pow(40)
+  }
+
+  /** Gets the maximum number of bounds possible for `t` when widening is used. */
+  private int getNrOfWideningBounds(ArithmeticType t) {
+    result = strictcount(wideningLowerBounds(t)).maximum(strictcount(wideningUpperBounds(t)))
+  }
+
+  /**
+   * Holds if `boundFromGuard(guard, v, _, branch)` holds, but without
+   * relying on range analysis (which would cause non-monotonic recursion
+   * elsewhere).
+   */
+  private predicate hasBoundFromGuard(Expr guard, VariableAccess v, boolean branch) {
+    exists(Expr lhs | linearAccess(lhs, v, _, _) |
+      relOpWithSwapAndNegate(guard, lhs, _, _, _, branch)
+      or
+      eqOpWithSwapAndNegate(guard, lhs, _, true, branch)
+      or
+      eqZeroWithNegate(guard, lhs, true, branch)
+    )
+  }
+
+  /** Holds if `def` is a guard phi node for `v` with a bound from a guard. */
+  predicate isGuardPhiWithBound(RangeSsaDefinition def, StackVariable v, VariableAccess access) {
+    exists(Expr guard, boolean branch |
+      def.isGuardPhi(v, access, guard, branch) and
+      hasBoundFromGuard(guard, access, branch)
+    )
+  }
+
+  /**
+   * Gets the number of bounds for `def` when `def` is a guard phi node for the
+   * variable `v`.
+   */
+  language[monotonicAggregates]
+  private float nrOfBoundsPhiGuard(RangeSsaDefinition def, StackVariable v) {
+    // If we have
+    //
+    //   if (x < c) { e1 }
+    //   e2
+    //
+    // then `e2` is both a guard phi node (guarded by `x < c`) and a normal
+    // phi node (control is merged after the `if` statement).
+    //
+    // Assume `x` has `n` bounds. Then `n` bounds are propagated to the guard
+    // phi node `{ e1 }` and, since `{ e1 }` is input to `e2` as a normal phi
+    // node, `n` bounds are propagated to `e2`. If we also propagate the `n`
+    // bounds to `e2` as a guard phi node, then we square the number of
+    // bounds.
+    //
+    // However in practice `x < c` is going to cut down the number of bounds:
+    // The tracked bounds can't flow to both branches as that would require
+    // them to simultaneously be greater and smaller than `c`. To approximate
+    // this better, the contribution from a guard phi node that is also a
+    // normal phi node is 1.
+    exists(def.getAPhiInput(v)) and
+    isGuardPhiWithBound(def, v, _) and
+    result = 1
+    or
+    not exists(def.getAPhiInput(v)) and
+    // If there's different `access`es, then they refer to the same variable
+    // with the same lower bounds. Hence adding these guards make no sense (the
+    // implementation will take the union, but they'll be removed by
+    // deduplication). Hence we use `max` as an approximation.
+    result =
+      max(VariableAccess access | isGuardPhiWithBound(def, v, access) | nrOfBoundsExpr(access))
+    or
+    def.isPhiNode(v) and
+    not isGuardPhiWithBound(def, v, _) and
+    result = 0
+  }
+
+  /**
+   * Gets the number of bounds for `def` when `def` is a normal phi node for the
+   * variable `v`.
+   */
+  language[monotonicAggregates]
+  private float nrOfBoundsPhiNormal(RangeSsaDefinition def, StackVariable v) {
+    result =
+      strictsum(RangeSsaDefinition inputDef |
+        inputDef = def.getAPhiInput(v)
+      |
+        nrOfBoundsDef(inputDef, v)
+      )
+    or
+    def.isPhiNode(v) and
+    not exists(def.getAPhiInput(v)) and
+    result = 0
+  }
+
+  /**
+   * Gets the number of bounds for `def` when `def` is an NE phi node for the
+   * variable `v`.
+   */
+  language[monotonicAggregates]
+  float nrOfBoundsNEPhi(RangeSsaDefinition def, StackVariable v) {
+    // If there's different `access`es, then they refer to the same variable
+    // with the same lower bounds. Hence adding these guards make no sense (the
+    // implementation will take the union, but they'll be removed by
+    // deduplication). Hence we use `max` as an approximation.
+    result = max(VariableAccess access | isNEPhi(v, def, access, _) | nrOfBoundsExpr(access))
+    or
+    def.isPhiNode(v) and
+    not isNEPhi(v, def, _, _) and
+    result = 0
+  }
+
+  /**
+   * Gets the number of bounds for `def` when `def` is an unsupported guard phi
+   * node for the variable `v`.
+   */
+  language[monotonicAggregates]
+  private float nrOfBoundsUnsupportedGuardPhi(RangeSsaDefinition def, StackVariable v) {
+    // If there's different `access`es, then they refer to the same variable
+    // with the same lower bounds. Hence adding these guards make no sense (the
+    // implementation will take the union, but they'll be removed by
+    // deduplication). Hence we use `max` as an approximation.
+    result =
+      max(VariableAccess access | isUnsupportedGuardPhi(v, def, access) | nrOfBoundsExpr(access))
+    or
+    def.isPhiNode(v) and
+    not isUnsupportedGuardPhi(v, def, _) and
+    result = 0
+  }
+
+  private float nrOfBoundsPhi(RangeSsaDefinition def, StackVariable v) {
+    // The cases for phi nodes are not mutually exclusive. For instance a phi
+    // node can be both a guard phi node and a normal phi node. To handle this
+    // we sum the contributions from the different cases.
+    result =
+      nrOfBoundsPhiGuard(def, v) + nrOfBoundsPhiNormal(def, v) + nrOfBoundsNEPhi(def, v) +
+        nrOfBoundsUnsupportedGuardPhi(def, v)
+  }
+
+  /** Gets the estimated number of bounds for `def` and `v`. */
+  float nrOfBoundsDef(RangeSsaDefinition def, StackVariable v) {
+    // Recursive definitions are already widened, so we simply estimate them as
+    // having the number of widening bounds available. This is crucial as it
+    // ensures that we don't follow recursive cycles when calculating the
+    // estimate. Had that not been the case the estimate itself would be at risk
+    // of causing performance issues and being non-functional.
+    if isRecursiveDef(def, v)
+    then result = getNrOfWideningBounds(getVariableRangeType(v))
+    else (
+      // Definitions with a defining value
+      exists(Expr defExpr | assignmentDef(def, v, defExpr) and result = nrOfBoundsExpr(defExpr))
+      or
+      // Assignment operations with a defining value
+      exists(AssignOperation assignOp |
+        def = assignOp and
+        assignOp.getLValue() = v.getAnAccess() and
+        result = nrOfBoundsExpr(assignOp)
+      )
+      or
+      // Phi nodes
+      result = nrOfBoundsPhi(def, v)
+      or
+      unanalyzableDefBounds(def, v, _, _) and result = 1
+    )
+  }
+
+  /**
+   * Gets a naive estimate of the number of bounds for `e`.
+   *
+   * The estimate is like an abstract interpretation of the range analysis,
+   * where the abstract value is the number of bounds. For instance,
+   * `nrOfBoundsExpr(12) = 1` and `nrOfBoundsExpr(x + y) = nrOfBoundsExpr(x) *
+   * nrOfBoundsExpr(y)`.
+   *
+   * The estimated number of bounds will usually be greater than the actual
+   * number of bounds, as the estimate can not detect cases where bounds are cut
+   * down when tracked precisely. For instance, in
+   * ```c
+   * int x = 1;
+   * if (cond) { x = 1; }
+   * int y = x + x;
+   * ```
+   * the actual number of bounds for `y` is 1. However, the estimate will be 4
+   * as the conditional assignment to `x` gives two bounds for `x` on the last
+   * line and the addition gives 2 * 2 bounds. There are two sources of inaccuracies:
+   *
+   * 1. Without tracking the lower bounds we can't see that `x` is assigned a
+   * value that is equal to its lower bound.
+   * 2. Had the conditional assignment been `x = 2` then the estimate of two
+   * bounds for `x` would have been correct. However, the estimate of 4 for `y`
+   * would still be incorrect. Summing the actual bounds `{1,2}` with itself
+   * gives `{2,3,4}` which is only three bounds. Again, we can't realise this
+   * without tracking the bounds.
+   *
+   * Since these inaccuracies compound the estimated number of bounds can often
+   * be _much_ greater than the actual number of bounds. Do note though that the
+   * estimate is not _guaranteed_ to be an upper bound. In some cases the
+   * approximations might underestimate the number of bounds.
+   *
+   * This predicate is functional. This is crucial as:
+   *
+   * - It ensures that the computing the estimate itself is fast.
+   * - Our use of monotonic aggregates assumes functionality.
+   *
+   * Any non-functional case should be considered a bug.
+   */
+  float nrOfBoundsExpr(Expr e) {
+    // Similarly to what we do for definitions, we do not attempt to measure the
+    // number of bounds for recursive expressions.
+    if isRecursiveExpr(e)
+    then result = getNrOfWideningBounds(e.getUnspecifiedType())
+    else
+      if analyzableExpr(e)
+      then
+        // The cases here are an abstraction of and mirrors the cases inside
+        // `getLowerBoundsImpl`/`getUpperBoundsImpl`.
+        result = 1 and exists(getValue(e).toFloat())
+        or
+        exists(Expr operand | result = nrOfBoundsExpr(operand) |
+          effectivelyMultipliesByPositive(e, operand, _)
+          or
+          effectivelyMultipliesByNegative(e, operand, _)
+        )
+        or
+        exists(ConditionalExpr condExpr |
+          e = condExpr and
+          result = nrOfBoundsExpr(condExpr.getThen()) * nrOfBoundsExpr(condExpr.getElse())
+        )
+        or
+        exists(BinaryOperation binop |
+          e = binop and
+          result = nrOfBoundsExpr(binop.getLeftOperand()) * nrOfBoundsExpr(binop.getRightOperand())
+        |
+          e instanceof MaxExpr or
+          e instanceof MinExpr or
+          e instanceof AddExpr or
+          e instanceof SubExpr or
+          e instanceof UnsignedMulExpr or
+          e instanceof UnsignedBitwiseAndExpr
+        )
+        or
+        exists(AssignExpr assign | e = assign and result = nrOfBoundsExpr(assign.getRValue()))
+        or
+        exists(AssignArithmeticOperation assignOp |
+          e = assignOp and
+          result = nrOfBoundsExpr(assignOp.getLValue()) * nrOfBoundsExpr(assignOp.getRValue())
+        |
+          e instanceof AssignAddExpr or
+          e instanceof AssignSubExpr or
+          e instanceof UnsignedAssignMulExpr
+        )
+        or
+        // Handles `AssignMulByPositiveConstantExpr` and `AssignMulByNegativeConstantExpr`
+        exists(AssignMulByConstantExpr mulExpr |
+          e = mulExpr and
+          result = nrOfBoundsExpr(mulExpr.getLValue())
+        )
+        or
+        // Handles the prefix and postfix increment and decrement operators.
+        exists(CrementOperation crementOp |
+          e = crementOp and result = nrOfBoundsExpr(crementOp.getOperand())
+        )
+        or
+        exists(RemExpr remExpr | e = remExpr | result = nrOfBoundsExpr(remExpr.getRightOperand()))
+        or
+        exists(Conversion convExpr |
+          e = convExpr and
+          if convExpr.getUnspecifiedType() instanceof BoolType
+          then result = 1
+          else result = nrOfBoundsExpr(convExpr.getExpr())
+        )
+        or
+        exists(RangeSsaDefinition def, StackVariable v |
+          e = def.getAUse(v) and
+          result = nrOfBoundsDef(def, v) and
+          // Avoid returning two numbers when `e` is a use with a constant value.
+          not exists(getValue(e).toFloat())
+        )
+        or
+        exists(RShiftExpr rsExpr |
+          e = rsExpr and
+          exists(getValue(rsExpr.getRightOperand().getFullyConverted()).toInt()) and
+          result = nrOfBoundsExpr(rsExpr.getLeftOperand())
+        )
+      else (
+        exists(exprMinVal(e)) and result = 1
+      )
+  }
+}
+
+/**
+ * Holds if `v` is a variable for which widening should be used, as otherwise a
+ * very large number of bounds might be generated during the range analysis for
+ * `v`.
+ */
+private predicate varHasTooManyBounds(StackVariable v) {
+  exists(RangeSsaDefinition def |
+    def.getAVariable() = v and
+    BoundsEstimate::nrOfBoundsDef(def, v) > BoundsEstimate::getBoundsLimit()
+  )
+}
+
+/**
+ * Holds if `e` is an expression for which widening should be used, as otherwise
+ * a very large number of bounds might be generated during the range analysis
+ * for `e`.
+ */
+private predicate exprHasTooManyBounds(Expr e) {
+  BoundsEstimate::nrOfBoundsExpr(e) > BoundsEstimate::getBoundsLimit()
+  or
+  // A subexpressions of an expression with too many bounds may itself not have
+  // to many bounds. For instance, `x + y` can have too many bounds without `x`
+  // having as well. But in these cases, still want to consider `e` as having
+  // too many bounds since:
+  // - The overall result is widened anyway, so widening `e` as well is unlikely
+  //   to cause further precision loss.
+  // - The number of bounds could be very large but still below the arbitrary
+  //   limit. Hence widening `e` can improve performance.
+  exists(Expr pe | exprHasTooManyBounds(pe) and e.getParent() = pe)
+}
+
 /**
  * Holds if `binop` is a binary operation that's likely to be assigned a
  * quadratic (or more) number of candidate bounds during the analysis. This can
@@ -654,13 +996,8 @@ private float getTruncatedLowerBounds(Expr expr) {
     if exprMinVal(expr) <= newLB and newLB <= exprMaxVal(expr)
     then
       // Apply widening where we might get a combinatorial explosion.
-      if isRecursiveBinary(expr)
-      then
-        result =
-          max(float widenLB |
-            widenLB = wideningLowerBounds(expr.getUnspecifiedType()) and
-            not widenLB > newLB
-          )
+      if isRecursiveBinary(expr) or exprHasTooManyBounds(expr)
+      then result = widenLowerBound(expr.getUnspecifiedType(), newLB)
       else result = newLB
     else result = exprMinVal(expr)
   ) and
@@ -713,13 +1050,8 @@ private float getTruncatedUpperBounds(Expr expr) {
         if exprMinVal(expr) <= newUB and newUB <= exprMaxVal(expr)
         then
           // Apply widening where we might get a combinatorial explosion.
-          if isRecursiveBinary(expr)
-          then
-            result =
-              min(float widenUB |
-                widenUB = wideningUpperBounds(expr.getUnspecifiedType()) and
-                not widenUB < newUB
-              )
+          if isRecursiveBinary(expr) or exprHasTooManyBounds(expr)
+          then result = widenUpperBound(expr.getUnspecifiedType(), newUB)
           else result = newUB
         else result = exprMaxVal(expr)
       )
@@ -1796,18 +2128,12 @@ module SimpleRangeAnalysisInternal {
     |
       // Widening: check whether the new lower bound is from a source which
       // depends recursively on the current definition.
-      if isRecursiveDef(def, v)
+      if isRecursiveDef(def, v) or varHasTooManyBounds(v)
       then
         // The new lower bound is from a recursive source, so we round
         // down to one of a limited set of values to prevent the
         // recursion from exploding.
-        result =
-          max(float widenLB |
-            widenLB = wideningLowerBounds(getVariableRangeType(v)) and
-            not widenLB > truncatedLB
-          |
-            widenLB
-          )
+        result = widenLowerBound(getVariableRangeType(v), truncatedLB)
       else result = truncatedLB
     )
     or
@@ -1826,18 +2152,12 @@ module SimpleRangeAnalysisInternal {
     |
       // Widening: check whether the new upper bound is from a source which
       // depends recursively on the current definition.
-      if isRecursiveDef(def, v)
+      if isRecursiveDef(def, v) or varHasTooManyBounds(v)
       then
         // The new upper bound is from a recursive source, so we round
         // up to one of a fixed set of values to prevent the recursion
         // from exploding.
-        result =
-          min(float widenUB |
-            widenUB = wideningUpperBounds(getVariableRangeType(v)) and
-            not widenUB < truncatedUB
-          |
-            widenUB
-          )
+        result = widenUpperBound(getVariableRangeType(v), truncatedUB)
       else result = truncatedUB
     )
     or
@@ -1845,4 +2165,60 @@ module SimpleRangeAnalysisInternal {
     // bound is `typeUpperBound`.
     defMightOverflowNegatively(def, v) and result = varMaxVal(v)
   }
+
+  /** Gets the estimate of the number of bounds for `e`. */
+  float estimateNrOfBounds(Expr e) { result = BoundsEstimate::nrOfBoundsExpr(e) }
+}
+
+/** Provides predicates for debugging the simple range analysis library. */
+private module Debug {
+  Locatable getRelevantLocatable() {
+    exists(string filepath, int startline |
+      result.getLocation().hasLocationInfo(filepath, startline, _, _, _) and
+      filepath.matches("%/test.c") and
+      startline = [621 .. 639]
+    )
+  }
+
+  float debugGetLowerBoundsImpl(Expr e) {
+    e = getRelevantLocatable() and
+    result = getLowerBoundsImpl(e)
+  }
+
+  float debugGetUpperBoundsImpl(Expr e) {
+    e = getRelevantLocatable() and
+    result = getUpperBoundsImpl(e)
+  }
+
+  /**
+   * Counts the number of lower bounds for a given expression. This predicate is
+   * useful for identifying performance issues in the range analysis.
+   */
+  predicate countGetLowerBoundsImpl(Expr e, int n) {
+    e = getRelevantLocatable() and
+    n = strictcount(float lb | lb = getLowerBoundsImpl(e) | lb)
+  }
+
+  float debugNrOfBounds(Expr e) {
+    e = getRelevantLocatable() and
+    result = BoundsEstimate::nrOfBoundsExpr(e)
+  }
+
+  /**
+   * Finds any expressions for which `nrOfBounds` is not functional. The result
+   * should be empty, so this predicate is useful to debug non-functional cases.
+   */
+  int nonFunctionalNrOfBounds(Expr e) {
+    strictcount(BoundsEstimate::nrOfBoundsExpr(e)) > 1 and
+    result = BoundsEstimate::nrOfBoundsExpr(e)
+  }
+
+  /**
+   * Holds if `e` is an expression that has a lower bound, but where
+   * `nrOfBounds` does not compute an estimate.
+   */
+  predicate missingNrOfBounds(Expr e, float n) {
+    n = lowerBound(e) and
+    not exists(BoundsEstimate::nrOfBoundsExpr(e))
+  }
 }

cpp/ql/lib/semmlecode.cpp.dbscheme

@@ -47,6 +47,19 @@ compilation_args(
     string arg : string ref
 );
 
+/**
+ * The expanded arguments that were passed to the extractor for a
+ * compiler invocation. This is similar to `compilation_args`, but
+ * for a `@someFile` argument, it includes the arguments from that
+ * file, rather than just taking the argument literally.
+ */
+#keyset[id, num]
+compilation_expanded_args(
+    int id : @compilation ref,
+    int num : int ref,
+    string arg : string ref
+);
+
 /**
  * Optionally, record the build mode for each compilation.
  */
@@ -1327,7 +1340,8 @@ specialnamequalifyingelements(
 @namequalifiableelement = @expr | @namequalifier;
 @namequalifyingelement = @namespace
                        | @specialnamequalifyingelement
-                       | @usertype;
+                       | @usertype
+                       | @decltype;
 
 namequalifiers(
     unique int id: @namequalifier,

cpp/ql/lib/upgrades/2121ffec11fac265524955fee1775217364d4ca4/upgrade.properties

@@ -0,0 +1,2 @@
+description: Support expanded compilation argument lists
+compatibility: backwards

cpp/ql/lib/upgrades/c16b29b27f71247023321cc0d0360998b318837c/upgrade.properties

@@ -0,0 +1,2 @@
+description: Fix decltype qualifier issue
+compatibility: full

cpp/ql/src/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 1.5.4
+
+No user-facing changes.
+
 ## 1.5.3
 
 No user-facing changes.

cpp/ql/src/change-notes/released/1.5.4.md

@@ -0,0 +1,3 @@
+## 1.5.4
+
+No user-facing changes.

cpp/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.5.3
+lastReleaseVersion: 1.5.4

cpp/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/cpp-queries
-version: 1.5.3
+version: 1.5.4
 groups:
   - cpp
   - queries

cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected

@@ -7988,6 +7988,26 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
 | taint.cpp:841:21:841:35 | call to indirect_source | taint.cpp:843:16:843:17 | fp |  |
 | taint.cpp:842:11:842:12 | ref arg fp | taint.cpp:843:16:843:17 | fp |  |
 | taint.cpp:842:15:842:16 |  | taint.cpp:842:11:842:12 | ref arg fp | TAINT |
+| taint.cpp:851:10:851:15 | call to source | taint.cpp:852:18:852:18 | s |  |
+| taint.cpp:851:10:851:15 | call to source | taint.cpp:854:18:854:18 | s |  |
+| taint.cpp:852:10:852:16 | call to toupper | taint.cpp:853:7:853:7 | u |  |
+| taint.cpp:854:10:854:16 | call to tolower | taint.cpp:855:7:855:7 | l |  |
+| taint.cpp:861:24:861:27 | size | taint.cpp:866:16:866:19 | size |  |
+| taint.cpp:862:12:862:26 | call to indirect_source | taint.cpp:866:12:866:12 | s |  |
+| taint.cpp:863:7:863:9 | out | taint.cpp:864:12:864:14 | out |  |
+| taint.cpp:864:12:864:14 | out | taint.cpp:866:23:866:23 | p |  |
+| taint.cpp:864:12:864:14 | out | taint.cpp:867:8:867:8 | p |  |
+| taint.cpp:865:9:865:16 | size_out | taint.cpp:866:27:866:34 | size_out |  |
+| taint.cpp:866:11:866:12 | ref arg & ... | taint.cpp:866:12:866:12 | s [inner post update] |  |
+| taint.cpp:866:12:866:12 | s | taint.cpp:866:11:866:12 | & ... |  |
+| taint.cpp:866:15:866:19 | ref arg & ... | taint.cpp:866:16:866:19 | size [inner post update] |  |
+| taint.cpp:866:16:866:19 | size | taint.cpp:866:15:866:19 | & ... |  |
+| taint.cpp:866:22:866:23 | ref arg & ... | taint.cpp:866:23:866:23 | p [inner post update] |  |
+| taint.cpp:866:22:866:23 | ref arg & ... | taint.cpp:867:8:867:8 | p |  |
+| taint.cpp:866:23:866:23 | p | taint.cpp:866:22:866:23 | & ... |  |
+| taint.cpp:866:26:866:34 | ref arg & ... | taint.cpp:866:27:866:34 | size_out [inner post update] |  |
+| taint.cpp:866:27:866:34 | size_out | taint.cpp:866:26:866:34 | & ... |  |
+| taint.cpp:867:8:867:8 | p | taint.cpp:867:7:867:8 | * ... | TAINT |
 | thread.cpp:10:27:10:27 | s | thread.cpp:10:27:10:27 | s |  |
 | thread.cpp:10:27:10:27 | s | thread.cpp:11:8:11:8 | s |  |
 | thread.cpp:14:26:14:26 | s | thread.cpp:15:8:15:8 | s |  |

cpp/ql/test/library-tests/dataflow/taint-tests/taint.cpp

@@ -842,4 +842,27 @@ int f7(void)
   fprintf(fp, "");
 	indirect_sink(fp); // $ ir MISSING: ast
   return 0;
+}
+
+int toupper(int);
+int tolower(int);
+
+void test_toupper_and_tolower() {
+	int s = source();
+	int u = toupper(s);
+	sink(u); // $ ir MISSING: ast
+	int l = tolower(s);
+	sink(l); // $ ir MISSING: ast
+}
+
+typedef int iconv_t;
+size_t iconv(iconv_t cd, char **, size_t *, char **, size_t *);
+
+void test_iconv(size_t size) {
+	char* s = indirect_source();
+	char out[10];
+	char* p = out;
+	size_t size_out;
+	iconv(0, &s, &size, &p, &size_out);
+	sink(*p); // $ ast,ir
 }

cpp/ql/test/library-tests/dataflow/taint-tests/test_mad-signatures.ql

@@ -2,7 +2,7 @@ import cpp
 import semmle.code.cpp.dataflow.ExternalFlow
 import ExternalFlowDebug
 
-query predicate signatureMatches = signatureMatches_debug/5;
+query predicate signatureMatches = signatureMatches_debug/6;
 
 query predicate getSignatureParameterName = getSignatureParameterName_debug/4;
 

cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/lowerBound.expected

@@ -485,197 +485,529 @@
 | test.c:411:59:411:59 | k | 0.205191 |
 | test.c:411:63:411:63 | l | 0.132041 |
 | test.c:413:10:413:15 | output | 1.842468 |
-| test.c:418:20:418:20 | x | 0 |
-| test.c:418:30:418:30 | x | 0 |
-| test.c:421:3:421:4 | y1 | 0 |
-| test.c:421:11:421:11 | y | 0 |
-| test.c:421:14:421:14 | y | 1 |
-| test.c:422:3:422:4 | y2 | 0 |
-| test.c:422:9:422:9 | y | 1 |
-| test.c:422:14:422:14 | y | 2 |
-| test.c:422:22:422:22 | y | 5 |
-| test.c:423:10:423:11 | y1 | 1 |
-| test.c:423:15:423:16 | y2 | 5 |
-| test.c:431:3:431:3 | i | -2147483648 |
-| test.c:432:7:432:7 | i | 10 |
-| test.c:434:3:434:3 | i | -2147483648 |
-| test.c:435:3:435:3 | i | 10 |
-| test.c:436:7:436:7 | i | 20 |
-| test.c:438:3:438:3 | i | -2147483648 |
-| test.c:439:3:439:3 | i | 40 |
-| test.c:440:7:440:7 | i | 30 |
-| test.c:442:3:442:3 | i | -2147483648 |
-| test.c:442:7:442:7 | j | -2147483648 |
-| test.c:443:7:443:7 | i | 40 |
-| test.c:445:3:445:3 | i | -2147483648 |
-| test.c:445:8:445:8 | j | 40 |
-| test.c:446:7:446:7 | i | 50 |
-| test.c:448:3:448:3 | i | -2147483648 |
-| test.c:448:13:448:13 | j | 50 |
-| test.c:449:7:449:7 | i | 60 |
-| test.c:456:12:456:12 | a | 0 |
-| test.c:456:17:456:17 | a | 3 |
-| test.c:456:33:456:33 | b | 0 |
-| test.c:456:38:456:38 | b | 5 |
-| test.c:457:13:457:13 | a | 3 |
-| test.c:457:15:457:15 | b | 5 |
-| test.c:458:5:458:9 | total | 0 |
-| test.c:458:14:458:14 | r | 15 |
-| test.c:460:12:460:12 | a | 0 |
-| test.c:460:17:460:17 | a | 3 |
-| test.c:460:33:460:33 | b | 0 |
-| test.c:460:38:460:38 | b | 0 |
-| test.c:461:13:461:13 | a | 3 |
-| test.c:461:15:461:15 | b | 0 |
-| test.c:462:5:462:9 | total | 0 |
-| test.c:462:14:462:14 | r | 0 |
-| test.c:464:12:464:12 | a | 0 |
-| test.c:464:17:464:17 | a | 3 |
-| test.c:464:34:464:34 | b | 0 |
-| test.c:464:39:464:39 | b | 13 |
-| test.c:465:13:465:13 | a | 3 |
-| test.c:465:15:465:15 | b | 13 |
-| test.c:466:5:466:9 | total | 0 |
-| test.c:466:14:466:14 | r | 39 |
-| test.c:469:10:469:14 | total | 0 |
-| test.c:475:12:475:12 | b | 0 |
-| test.c:475:17:475:17 | b | 5 |
-| test.c:476:16:476:16 | b | 5 |
-| test.c:477:5:477:9 | total | 0 |
-| test.c:477:14:477:14 | r | 55 |
-| test.c:479:12:479:12 | b | 0 |
-| test.c:479:17:479:17 | b | 0 |
-| test.c:480:16:480:16 | b | 0 |
-| test.c:481:5:481:9 | total | 0 |
-| test.c:481:14:481:14 | r | 0 |
-| test.c:483:13:483:13 | b | 0 |
-| test.c:483:18:483:18 | b | 13 |
-| test.c:484:16:484:16 | b | 13 |
-| test.c:485:5:485:9 | total | 0 |
-| test.c:485:14:485:14 | r | 143 |
-| test.c:488:10:488:14 | total | 0 |
-| test.c:493:3:493:3 | x | 0 |
-| test.c:493:7:493:7 | y | 0 |
-| test.c:494:3:494:4 | xy | 0 |
-| test.c:494:8:494:8 | x | 1000000003 |
-| test.c:494:12:494:12 | y | 1000000003 |
-| test.c:495:10:495:11 | xy | 1000000006000000000 |
-| test.c:500:3:500:3 | x | 0 |
-| test.c:501:3:501:3 | y | 0 |
-| test.c:502:3:502:4 | xy | 0 |
-| test.c:502:8:502:8 | x | 274177 |
-| test.c:502:12:502:12 | y | 67280421310721 |
-| test.c:503:10:503:11 | xy | 18446744073709551616 |
-| test.c:507:7:507:8 | ui | 0 |
-| test.c:508:43:508:44 | ui | 10 |
-| test.c:508:48:508:49 | ui | 10 |
-| test.c:509:12:509:17 | result | 100 |
-| test.c:511:7:511:8 | ul | 0 |
-| test.c:512:28:512:29 | ul | 10 |
-| test.c:512:33:512:34 | ul | 10 |
-| test.c:513:12:513:17 | result | 0 |
-| test.c:519:7:519:8 | ui | 0 |
-| test.c:519:19:519:20 | ui | 0 |
-| test.c:520:5:520:6 | ui | 2 |
-| test.c:520:11:520:12 | ui | 2 |
-| test.c:521:12:521:13 | ui | 4 |
-| test.c:525:3:525:9 | uiconst | 10 |
-| test.c:528:3:528:9 | ulconst | 10 |
-| test.c:529:10:529:16 | uiconst | 40 |
-| test.c:529:20:529:26 | ulconst | 40 |
-| test.c:533:7:533:7 | i | -2147483648 |
-| test.c:533:18:533:18 | i | -1 |
-| test.c:534:5:534:5 | i | -2147483648 |
-| test.c:534:13:534:13 | i | -1 |
-| test.c:535:9:535:9 | i | -5 |
-| test.c:537:5:537:5 | i | -2147483648 |
-| test.c:537:9:537:9 | i | -5 |
-| test.c:538:9:538:9 | i | -30 |
-| test.c:540:5:540:5 | i | -30 |
-| test.c:541:9:541:9 | i | -210 |
-| test.c:543:5:543:5 | i | -210 |
-| test.c:544:9:544:9 | i | -1155 |
-| test.c:546:7:546:7 | i | -2147483648 |
-| test.c:547:5:547:5 | i | -2147483648 |
-| test.c:547:9:547:9 | i | -1 |
-| test.c:548:9:548:9 | i | 1 |
-| test.c:550:3:550:3 | i | -2147483648 |
-| test.c:550:7:550:7 | i | -2147483648 |
-| test.c:551:10:551:10 | i | -2147483648 |
-| test.c:554:3:554:3 | i | -2147483648 |
-| test.c:554:10:554:11 | sc | 1 |
-| test.c:556:7:556:7 | i | -128 |
-| test.c:563:7:563:7 | n | 0 |
-| test.c:565:7:565:7 | n | 0 |
-| test.c:566:9:566:9 | n | 1 |
-| test.c:569:7:569:7 | n | 0 |
-| test.c:570:9:570:9 | n | 1 |
-| test.c:572:9:572:9 | n | 0 |
-| test.c:575:8:575:8 | n | 0 |
-| test.c:576:9:576:9 | n | 0 |
-| test.c:578:9:578:9 | n | 1 |
-| test.c:581:10:581:10 | n | 0 |
-| test.c:582:5:582:5 | n | 1 |
-| test.c:585:7:585:7 | n | 0 |
-| test.c:589:7:589:7 | n | -32768 |
-| test.c:592:7:592:7 | n | 0 |
-| test.c:593:9:593:9 | n | 0 |
-| test.c:595:9:595:9 | n | 1 |
-| test.c:598:7:598:7 | n | 0 |
-| test.c:599:9:599:9 | n | 1 |
-| test.c:601:9:601:9 | n | 0 |
-| test.c:604:10:604:10 | n | 0 |
-| test.c:605:5:605:5 | n | 1 |
-| test.c:608:7:608:7 | n | 0 |
-| test.c:612:7:612:7 | n | -32768 |
-| test.c:613:9:613:9 | n | -32768 |
-| test.c:614:11:614:11 | n | 0 |
-| test.c:618:7:618:7 | n | -32768 |
-| test.c:619:13:619:13 | n | 5 |
-| test.c:622:9:622:9 | n | 6 |
-| test.c:625:7:625:7 | n | -32768 |
-| test.c:625:22:625:22 | n | -32767 |
-| test.c:626:9:626:9 | n | -32766 |
-| test.c:629:7:629:7 | n | -32768 |
-| test.c:630:5:630:5 | n | 0 |
-| test.c:630:10:630:10 | n | 1 |
-| test.c:630:14:630:14 | n | 0 |
-| test.c:631:6:631:6 | n | 0 |
-| test.c:631:10:631:10 | n | 0 |
-| test.c:631:14:631:14 | n | 1 |
-| test.c:642:7:642:8 | ss | -32768 |
-| test.c:643:9:643:10 | ss | 0 |
-| test.c:646:7:646:8 | ss | -32768 |
-| test.c:647:9:647:10 | ss | -32768 |
-| test.c:650:14:650:15 | us | 0 |
-| test.c:651:9:651:10 | us | 0 |
-| test.c:654:14:654:15 | us | 0 |
-| test.c:655:9:655:10 | us | 0 |
-| test.c:658:7:658:8 | ss | -32768 |
-| test.c:659:9:659:10 | ss | -32768 |
-| test.c:662:7:662:8 | ss | -32768 |
-| test.c:663:9:663:10 | ss | -1 |
-| test.c:669:8:669:8 | s | -2147483648 |
-| test.c:669:15:669:15 | s | 0 |
-| test.c:669:23:669:23 | s | 0 |
-| test.c:670:18:670:18 | s | 0 |
-| test.c:670:22:670:22 | s | 0 |
-| test.c:671:9:671:14 | result | 0 |
-| test.c:677:7:677:7 | i | 0 |
-| test.c:678:9:678:9 | i | -2147483648 |
-| test.c:682:7:682:7 | u | 0 |
-| test.c:683:9:683:9 | u | 0 |
-| test.c:688:12:688:12 | s | -2147483648 |
-| test.c:689:7:689:8 | s2 | -4 |
-| test.c:694:7:694:7 | x | -2147483648 |
-| test.c:695:9:695:9 | y | -2147483648 |
-| test.c:699:7:699:7 | y | -2147483648 |
-| test.c:708:7:708:7 | x | -2147483648 |
-| test.c:713:7:713:7 | x | -2147483648 |
-| test.c:720:8:720:8 | x | 2147483647 |
-| test.c:720:12:720:12 | y | 256 |
-| test.c:721:9:721:9 | x | 2147483647 |
-| test.c:722:9:722:9 | y | 256 |
+| test.c:420:7:420:9 | rhs | 0 |
+| test.c:420:19:420:21 | rhs | 0 |
+| test.c:421:7:421:9 | rhs | 0 |
+| test.c:421:19:421:21 | rhs | 0 |
+| test.c:422:7:422:9 | rhs | 0 |
+| test.c:422:19:422:21 | rhs | 0 |
+| test.c:423:7:423:9 | rhs | 0 |
+| test.c:423:19:423:21 | rhs | 0 |
+| test.c:424:7:424:9 | rhs | 0 |
+| test.c:424:19:424:21 | rhs | 0 |
+| test.c:425:10:425:12 | rhs | 0 |
+| test.c:429:7:429:7 | a | -2147483648 |
+| test.c:430:9:430:9 | b | -2147483648 |
+| test.c:431:7:431:7 | a | 17 |
+| test.c:431:12:431:12 | b | 23 |
+| test.c:433:9:433:9 | a | 17 |
+| test.c:434:7:434:7 | b | -2147483648 |
+| test.c:439:11:439:11 | a | -2147483648 |
+| test.c:439:15:439:15 | b | -2147483648 |
+| test.c:440:10:440:10 | a | -2147483648 |
+| test.c:440:14:440:14 | b | -2147483648 |
+| test.c:447:10:447:11 | ip | 0 |
+| test.c:447:20:447:21 | ip | 0 |
+| test.c:447:40:447:41 | ip | 0 |
+| test.c:448:14:448:15 | ip | 1 |
+| test.c:449:14:449:15 | ip | 0 |
+| test.c:449:34:449:35 | ip | 0 |
+| test.c:450:11:450:12 | ip | 0 |
+| test.c:451:13:451:14 | ip | 0 |
+| test.c:452:14:452:15 | ip | 0 |
+| test.c:453:14:453:15 | ip | 0 |
+| test.c:454:15:454:16 | ip | 0 |
+| test.c:454:41:454:42 | ip | 0 |
+| test.c:454:52:454:53 | ip | 0 |
+| test.c:454:67:454:68 | ip | 0 |
+| test.c:454:78:454:79 | ip | 0 |
+| test.c:455:18:455:19 | ip | 0 |
+| test.c:456:23:456:24 | ip | 0 |
+| test.c:456:34:456:35 | ip | 0 |
+| test.c:457:25:457:26 | ip | 0 |
+| test.c:458:20:458:21 | ip | 0 |
+| test.c:459:11:459:12 | ip | 0 |
+| test.c:459:26:459:27 | ip | 0 |
+| test.c:460:16:460:17 | ip | 0 |
+| test.c:461:16:461:17 | ip | 0 |
+| test.c:462:16:462:17 | ip | 0 |
+| test.c:463:17:463:18 | ip | 0 |
+| test.c:464:22:464:23 | ip | 0 |
+| test.c:464:33:464:34 | ip | 0 |
+| test.c:464:48:464:49 | ip | 0 |
+| test.c:464:59:464:60 | ip | 0 |
+| test.c:465:20:465:21 | ip | 0 |
+| test.c:466:25:466:26 | ip | 0 |
+| test.c:466:36:466:37 | ip | 0 |
+| test.c:467:27:467:28 | ip | 0 |
+| test.c:468:22:468:23 | ip | 0 |
+| test.c:469:15:469:16 | ip | 0 |
+| test.c:469:30:469:31 | ip | 0 |
+| test.c:470:11:470:12 | ip | 0 |
+| test.c:471:12:471:13 | ip | 0 |
+| test.c:472:12:472:13 | ip | 0 |
+| test.c:473:13:473:14 | ip | 0 |
+| test.c:473:39:473:40 | ip | 0 |
+| test.c:473:50:473:51 | ip | 0 |
+| test.c:473:65:473:66 | ip | 0 |
+| test.c:473:76:473:77 | ip | 0 |
+| test.c:474:16:474:17 | ip | 0 |
+| test.c:475:21:475:22 | ip | 0 |
+| test.c:475:32:475:33 | ip | 0 |
+| test.c:476:23:476:24 | ip | 0 |
+| test.c:477:18:477:19 | ip | 0 |
+| test.c:478:11:478:12 | ip | 0 |
+| test.c:478:17:478:18 | ip | 0 |
+| test.c:478:37:478:38 | ip | 0 |
+| test.c:478:43:478:44 | ip | 0 |
+| test.c:479:14:479:15 | ip | 0 |
+| test.c:480:14:480:15 | ip | 0 |
+| test.c:481:14:481:15 | ip | 0 |
+| test.c:482:15:482:16 | ip | 0 |
+| test.c:482:41:482:42 | ip | 0 |
+| test.c:482:52:482:53 | ip | 0 |
+| test.c:482:67:482:68 | ip | 0 |
+| test.c:482:78:482:79 | ip | 0 |
+| test.c:483:18:483:19 | ip | 0 |
+| test.c:484:23:484:24 | ip | 0 |
+| test.c:484:34:484:35 | ip | 0 |
+| test.c:485:25:485:26 | ip | 0 |
+| test.c:486:20:486:21 | ip | 0 |
+| test.c:487:14:487:15 | ip | 0 |
+| test.c:487:20:487:21 | ip | 0 |
+| test.c:488:16:488:17 | ip | 0 |
+| test.c:489:12:489:13 | ip | 0 |
+| test.c:490:14:490:15 | ip | 0 |
+| test.c:491:15:491:16 | ip | 0 |
+| test.c:492:16:492:17 | ip | 0 |
+| test.c:493:16:493:17 | ip | 0 |
+| test.c:494:17:494:18 | ip | 0 |
+| test.c:495:22:495:23 | ip | 0 |
+| test.c:495:33:495:34 | ip | 0 |
+| test.c:495:48:495:49 | ip | 0 |
+| test.c:495:59:495:60 | ip | 0 |
+| test.c:496:20:496:21 | ip | 0 |
+| test.c:497:25:497:26 | ip | 0 |
+| test.c:497:36:497:37 | ip | 0 |
+| test.c:498:27:498:28 | ip | 0 |
+| test.c:499:22:499:23 | ip | 0 |
+| test.c:500:13:500:14 | ip | 0 |
+| test.c:500:28:500:29 | ip | 0 |
+| test.c:501:18:501:19 | ip | 0 |
+| test.c:502:18:502:19 | ip | 0 |
+| test.c:503:18:503:19 | ip | 0 |
+| test.c:504:19:504:20 | ip | 0 |
+| test.c:505:24:505:25 | ip | 0 |
+| test.c:505:35:505:36 | ip | 0 |
+| test.c:505:50:505:51 | ip | 0 |
+| test.c:505:61:505:62 | ip | 0 |
+| test.c:506:22:506:23 | ip | 0 |
+| test.c:507:27:507:28 | ip | 0 |
+| test.c:507:38:507:39 | ip | 0 |
+| test.c:508:29:508:30 | ip | 0 |
+| test.c:509:24:509:25 | ip | 0 |
+| test.c:510:17:510:18 | ip | 0 |
+| test.c:510:32:510:33 | ip | 0 |
+| test.c:511:14:511:15 | ip | 0 |
+| test.c:512:18:512:19 | ip | 0 |
+| test.c:513:18:513:19 | ip | 0 |
+| test.c:514:19:514:20 | ip | 0 |
+| test.c:515:24:515:25 | ip | 0 |
+| test.c:515:35:515:36 | ip | 0 |
+| test.c:515:50:515:51 | ip | 0 |
+| test.c:515:61:515:62 | ip | 0 |
+| test.c:516:22:516:23 | ip | 0 |
+| test.c:517:27:517:28 | ip | 0 |
+| test.c:517:38:517:39 | ip | 0 |
+| test.c:518:29:518:30 | ip | 0 |
+| test.c:519:24:519:25 | ip | 0 |
+| test.c:520:17:520:18 | ip | 0 |
+| test.c:520:23:520:24 | ip | 0 |
+| test.c:520:43:520:44 | ip | 0 |
+| test.c:520:49:520:50 | ip | 0 |
+| test.c:521:16:521:17 | ip | 0 |
+| test.c:522:16:522:17 | ip | 0 |
+| test.c:523:16:523:17 | ip | 0 |
+| test.c:524:17:524:18 | ip | 0 |
+| test.c:525:22:525:23 | ip | 0 |
+| test.c:525:33:525:34 | ip | 0 |
+| test.c:525:48:525:49 | ip | 0 |
+| test.c:525:59:525:60 | ip | 0 |
+| test.c:526:20:526:21 | ip | 0 |
+| test.c:527:25:527:26 | ip | 0 |
+| test.c:527:36:527:37 | ip | 0 |
+| test.c:528:27:528:28 | ip | 0 |
+| test.c:529:22:529:23 | ip | 0 |
+| test.c:530:16:530:17 | ip | 0 |
+| test.c:530:22:530:23 | ip | 0 |
+| test.c:531:18:531:19 | ip | 0 |
+| test.c:532:14:532:15 | ip | 0 |
+| test.c:533:14:533:15 | ip | 0 |
+| test.c:533:24:533:25 | ip | 0 |
+| test.c:533:44:533:45 | ip | 0 |
+| test.c:534:16:534:17 | ip | 1 |
+| test.c:535:16:535:17 | ip | 0 |
+| test.c:535:36:535:37 | ip | 0 |
+| test.c:536:14:536:15 | ip | 0 |
+| test.c:537:19:537:20 | ip | 0 |
+| test.c:538:20:538:21 | ip | 0 |
+| test.c:539:20:539:21 | ip | 0 |
+| test.c:540:21:540:22 | ip | 0 |
+| test.c:541:26:541:27 | ip | 0 |
+| test.c:541:37:541:38 | ip | 0 |
+| test.c:541:52:541:53 | ip | 0 |
+| test.c:541:63:541:64 | ip | 0 |
+| test.c:542:24:542:25 | ip | 0 |
+| test.c:543:29:543:30 | ip | 0 |
+| test.c:543:40:543:41 | ip | 0 |
+| test.c:544:31:544:32 | ip | 0 |
+| test.c:545:26:545:27 | ip | 0 |
+| test.c:546:17:546:18 | ip | 0 |
+| test.c:546:32:546:33 | ip | 0 |
+| test.c:547:22:547:23 | ip | 0 |
+| test.c:548:22:548:23 | ip | 0 |
+| test.c:549:22:549:23 | ip | 0 |
+| test.c:550:23:550:24 | ip | 0 |
+| test.c:551:28:551:29 | ip | 0 |
+| test.c:551:39:551:40 | ip | 0 |
+| test.c:551:54:551:55 | ip | 0 |
+| test.c:551:65:551:66 | ip | 0 |
+| test.c:552:26:552:27 | ip | 0 |
+| test.c:553:31:553:32 | ip | 0 |
+| test.c:553:42:553:43 | ip | 0 |
+| test.c:554:33:554:34 | ip | 0 |
+| test.c:555:28:555:29 | ip | 0 |
+| test.c:556:21:556:22 | ip | 0 |
+| test.c:556:36:556:37 | ip | 0 |
+| test.c:557:17:557:18 | ip | 0 |
+| test.c:558:18:558:19 | ip | 0 |
+| test.c:559:18:559:19 | ip | 0 |
+| test.c:560:19:560:20 | ip | 0 |
+| test.c:561:24:561:25 | ip | 0 |
+| test.c:561:35:561:36 | ip | 0 |
+| test.c:561:50:561:51 | ip | 0 |
+| test.c:561:61:561:62 | ip | 0 |
+| test.c:562:22:562:23 | ip | 0 |
+| test.c:563:27:563:28 | ip | 0 |
+| test.c:563:38:563:39 | ip | 0 |
+| test.c:564:29:564:30 | ip | 0 |
+| test.c:565:24:565:25 | ip | 0 |
+| test.c:566:17:566:18 | ip | 0 |
+| test.c:566:23:566:24 | ip | 0 |
+| test.c:566:43:566:44 | ip | 0 |
+| test.c:566:49:566:50 | ip | 0 |
+| test.c:567:20:567:21 | ip | 0 |
+| test.c:568:20:568:21 | ip | 0 |
+| test.c:569:20:569:21 | ip | 0 |
+| test.c:570:21:570:22 | ip | 0 |
+| test.c:571:26:571:27 | ip | 0 |
+| test.c:571:37:571:38 | ip | 0 |
+| test.c:571:52:571:53 | ip | 0 |
+| test.c:571:63:571:64 | ip | 0 |
+| test.c:572:24:572:25 | ip | 0 |
+| test.c:573:29:573:30 | ip | 0 |
+| test.c:573:40:573:41 | ip | 0 |
+| test.c:574:31:574:32 | ip | 0 |
+| test.c:575:26:575:27 | ip | 0 |
+| test.c:576:20:576:21 | ip | 0 |
+| test.c:576:26:576:27 | ip | 0 |
+| test.c:577:22:577:23 | ip | 0 |
+| test.c:578:18:578:19 | ip | 0 |
+| test.c:579:16:579:17 | ip | 0 |
+| test.c:580:17:580:18 | ip | 0 |
+| test.c:581:18:581:19 | ip | 0 |
+| test.c:582:18:582:19 | ip | 0 |
+| test.c:583:19:583:20 | ip | 0 |
+| test.c:584:24:584:25 | ip | 0 |
+| test.c:584:35:584:36 | ip | 0 |
+| test.c:584:50:584:51 | ip | 0 |
+| test.c:584:61:584:62 | ip | 0 |
+| test.c:585:22:585:23 | ip | 0 |
+| test.c:586:27:586:28 | ip | 0 |
+| test.c:586:38:586:39 | ip | 0 |
+| test.c:587:29:587:30 | ip | 0 |
+| test.c:588:24:588:25 | ip | 0 |
+| test.c:589:15:589:16 | ip | 0 |
+| test.c:589:30:589:31 | ip | 0 |
+| test.c:590:20:590:21 | ip | 0 |
+| test.c:591:20:591:21 | ip | 0 |
+| test.c:592:20:592:21 | ip | 0 |
+| test.c:593:21:593:22 | ip | 0 |
+| test.c:594:26:594:27 | ip | 0 |
+| test.c:594:37:594:38 | ip | 0 |
+| test.c:594:52:594:53 | ip | 0 |
+| test.c:594:63:594:64 | ip | 0 |
+| test.c:595:24:595:25 | ip | 0 |
+| test.c:596:29:596:30 | ip | 0 |
+| test.c:596:40:596:41 | ip | 0 |
+| test.c:597:31:597:32 | ip | 0 |
+| test.c:598:26:598:27 | ip | 0 |
+| test.c:599:19:599:20 | ip | 0 |
+| test.c:599:34:599:35 | ip | 0 |
+| test.c:600:16:600:17 | ip | 0 |
+| test.c:601:20:601:21 | ip | 0 |
+| test.c:602:20:602:21 | ip | 0 |
+| test.c:603:21:603:22 | ip | 0 |
+| test.c:604:26:604:27 | ip | 0 |
+| test.c:604:37:604:38 | ip | 0 |
+| test.c:604:52:604:53 | ip | 0 |
+| test.c:604:63:604:64 | ip | 0 |
+| test.c:605:24:605:25 | ip | 0 |
+| test.c:606:29:606:30 | ip | 0 |
+| test.c:606:40:606:41 | ip | 0 |
+| test.c:607:31:607:32 | ip | 0 |
+| test.c:608:26:608:27 | ip | 0 |
+| test.c:609:19:609:20 | ip | 0 |
+| test.c:609:25:609:26 | ip | 0 |
+| test.c:609:45:609:46 | ip | 0 |
+| test.c:609:51:609:52 | ip | 0 |
+| test.c:610:18:610:19 | ip | 0 |
+| test.c:611:18:611:19 | ip | 0 |
+| test.c:612:18:612:19 | ip | 0 |
+| test.c:613:19:613:20 | ip | 0 |
+| test.c:614:24:614:25 | ip | 0 |
+| test.c:614:35:614:36 | ip | 0 |
+| test.c:614:50:614:51 | ip | 0 |
+| test.c:614:61:614:62 | ip | 0 |
+| test.c:615:22:615:23 | ip | 0 |
+| test.c:616:27:616:28 | ip | 0 |
+| test.c:616:38:616:39 | ip | 0 |
+| test.c:617:29:617:30 | ip | 0 |
+| test.c:618:24:618:25 | ip | 0 |
+| test.c:619:18:619:19 | ip | 0 |
+| test.c:619:24:619:25 | ip | 0 |
+| test.c:620:20:620:21 | ip | 0 |
+| test.c:621:16:621:17 | ip | 0 |
+| test.c:622:10:622:23 | special_number | 0 |
+| test.c:630:7:630:8 | c1 | -2147483648 |
+| test.c:630:13:630:13 | x | 0 |
+| test.c:631:7:631:8 | c2 | -2147483648 |
+| test.c:631:13:631:13 | x | 0 |
+| test.c:632:7:632:8 | c3 | -2147483648 |
+| test.c:632:13:632:13 | x | 0 |
+| test.c:633:7:633:8 | c4 | -2147483648 |
+| test.c:633:13:633:13 | x | 0 |
+| test.c:634:7:634:8 | c5 | -2147483648 |
+| test.c:634:13:634:13 | x | 0 |
+| test.c:635:7:635:8 | c1 | -2147483648 |
+| test.c:635:13:635:14 | c2 | -2147483648 |
+| test.c:635:19:635:19 | x | 0 |
+| test.c:636:7:636:8 | c1 | -2147483648 |
+| test.c:636:13:636:14 | c3 | -2147483648 |
+| test.c:636:19:636:19 | x | 0 |
+| test.c:637:7:637:8 | c1 | -2147483648 |
+| test.c:637:13:637:14 | c4 | -2147483648 |
+| test.c:637:19:637:19 | x | 0 |
+| test.c:638:7:638:8 | c1 | -2147483648 |
+| test.c:638:13:638:14 | c5 | -2147483648 |
+| test.c:638:19:638:19 | x | 0 |
+| test.c:639:7:639:8 | c2 | -2147483648 |
+| test.c:639:13:639:14 | c3 | -2147483648 |
+| test.c:639:19:639:19 | x | 0 |
+| test.c:641:11:641:11 | x | 0 |
+| test.c:641:15:641:15 | x | 0 |
+| test.c:641:19:641:19 | x | 0 |
+| test.c:641:23:641:23 | x | 0 |
+| test.c:641:27:641:27 | x | 0 |
+| test.c:641:31:641:31 | x | 0 |
+| test.c:641:35:641:35 | x | 0 |
+| test.c:641:39:641:39 | x | 0 |
+| test.c:641:43:641:43 | x | 0 |
+| test.c:641:47:641:47 | x | 0 |
+| test.c:641:51:641:51 | x | 0 |
+| test.c:641:55:641:55 | x | 0 |
+| test.c:642:10:642:10 | y | -2147483648 |
+| test.c:647:20:647:20 | x | 0 |
+| test.c:647:30:647:30 | x | 0 |
+| test.c:650:3:650:4 | y1 | 0 |
+| test.c:650:11:650:11 | y | 0 |
+| test.c:650:14:650:14 | y | 1 |
+| test.c:651:3:651:4 | y2 | 0 |
+| test.c:651:9:651:9 | y | 1 |
+| test.c:651:14:651:14 | y | 2 |
+| test.c:651:22:651:22 | y | 5 |
+| test.c:652:10:652:11 | y1 | 1 |
+| test.c:652:15:652:16 | y2 | 5 |
+| test.c:660:3:660:3 | i | -2147483648 |
+| test.c:661:7:661:7 | i | 10 |
+| test.c:663:3:663:3 | i | -2147483648 |
+| test.c:664:3:664:3 | i | 10 |
+| test.c:665:7:665:7 | i | 20 |
+| test.c:667:3:667:3 | i | -2147483648 |
+| test.c:668:3:668:3 | i | 40 |
+| test.c:669:7:669:7 | i | 30 |
+| test.c:671:3:671:3 | i | -2147483648 |
+| test.c:671:7:671:7 | j | -2147483648 |
+| test.c:672:7:672:7 | i | 40 |
+| test.c:674:3:674:3 | i | -2147483648 |
+| test.c:674:8:674:8 | j | 40 |
+| test.c:675:7:675:7 | i | 50 |
+| test.c:677:3:677:3 | i | -2147483648 |
+| test.c:677:13:677:13 | j | 50 |
+| test.c:678:7:678:7 | i | 60 |
+| test.c:685:12:685:12 | a | 0 |
+| test.c:685:17:685:17 | a | 3 |
+| test.c:685:33:685:33 | b | 0 |
+| test.c:685:38:685:38 | b | 5 |
+| test.c:686:13:686:13 | a | 3 |
+| test.c:686:15:686:15 | b | 5 |
+| test.c:687:5:687:9 | total | 0 |
+| test.c:687:14:687:14 | r | 15 |
+| test.c:689:12:689:12 | a | 0 |
+| test.c:689:17:689:17 | a | 3 |
+| test.c:689:33:689:33 | b | 0 |
+| test.c:689:38:689:38 | b | 0 |
+| test.c:690:13:690:13 | a | 3 |
+| test.c:690:15:690:15 | b | 0 |
+| test.c:691:5:691:9 | total | 0 |
+| test.c:691:14:691:14 | r | 0 |
+| test.c:693:12:693:12 | a | 0 |
+| test.c:693:17:693:17 | a | 3 |
+| test.c:693:34:693:34 | b | 0 |
+| test.c:693:39:693:39 | b | 13 |
+| test.c:694:13:694:13 | a | 3 |
+| test.c:694:15:694:15 | b | 13 |
+| test.c:695:5:695:9 | total | 0 |
+| test.c:695:14:695:14 | r | 39 |
+| test.c:698:10:698:14 | total | 0 |
+| test.c:704:12:704:12 | b | 0 |
+| test.c:704:17:704:17 | b | 5 |
+| test.c:705:16:705:16 | b | 5 |
+| test.c:706:5:706:9 | total | 0 |
+| test.c:706:14:706:14 | r | 55 |
+| test.c:708:12:708:12 | b | 0 |
+| test.c:708:17:708:17 | b | 0 |
+| test.c:709:16:709:16 | b | 0 |
+| test.c:710:5:710:9 | total | 0 |
+| test.c:710:14:710:14 | r | 0 |
+| test.c:712:13:712:13 | b | 0 |
+| test.c:712:18:712:18 | b | 13 |
+| test.c:713:16:713:16 | b | 13 |
+| test.c:714:5:714:9 | total | 0 |
+| test.c:714:14:714:14 | r | 143 |
+| test.c:717:10:717:14 | total | 0 |
+| test.c:722:3:722:3 | x | 0 |
+| test.c:722:7:722:7 | y | 0 |
+| test.c:723:3:723:4 | xy | 0 |
+| test.c:723:8:723:8 | x | 1000000003 |
+| test.c:723:12:723:12 | y | 1000000003 |
+| test.c:724:10:724:11 | xy | 1000000006000000000 |
+| test.c:729:3:729:3 | x | 0 |
+| test.c:730:3:730:3 | y | 0 |
+| test.c:731:3:731:4 | xy | 0 |
+| test.c:731:8:731:8 | x | 274177 |
+| test.c:731:12:731:12 | y | 67280421310721 |
+| test.c:732:10:732:11 | xy | 18446744073709551616 |
+| test.c:736:7:736:8 | ui | 0 |
+| test.c:737:43:737:44 | ui | 10 |
+| test.c:737:48:737:49 | ui | 10 |
+| test.c:738:12:738:17 | result | 100 |
+| test.c:740:7:740:8 | ul | 0 |
+| test.c:741:28:741:29 | ul | 10 |
+| test.c:741:33:741:34 | ul | 10 |
+| test.c:742:12:742:17 | result | 0 |
+| test.c:748:7:748:8 | ui | 0 |
+| test.c:748:19:748:20 | ui | 0 |
+| test.c:749:5:749:6 | ui | 2 |
+| test.c:749:11:749:12 | ui | 2 |
+| test.c:750:12:750:13 | ui | 4 |
+| test.c:754:3:754:9 | uiconst | 10 |
+| test.c:757:3:757:9 | ulconst | 10 |
+| test.c:758:10:758:16 | uiconst | 40 |
+| test.c:758:20:758:26 | ulconst | 40 |
+| test.c:762:7:762:7 | i | -2147483648 |
+| test.c:762:18:762:18 | i | -1 |
+| test.c:763:5:763:5 | i | -2147483648 |
+| test.c:763:13:763:13 | i | -1 |
+| test.c:764:9:764:9 | i | -5 |
+| test.c:766:5:766:5 | i | -2147483648 |
+| test.c:766:9:766:9 | i | -5 |
+| test.c:767:9:767:9 | i | -30 |
+| test.c:769:5:769:5 | i | -30 |
+| test.c:770:9:770:9 | i | -210 |
+| test.c:772:5:772:5 | i | -210 |
+| test.c:773:9:773:9 | i | -1155 |
+| test.c:775:7:775:7 | i | -2147483648 |
+| test.c:776:5:776:5 | i | -2147483648 |
+| test.c:776:9:776:9 | i | -1 |
+| test.c:777:9:777:9 | i | 1 |
+| test.c:779:3:779:3 | i | -2147483648 |
+| test.c:779:7:779:7 | i | -2147483648 |
+| test.c:780:10:780:10 | i | -2147483648 |
+| test.c:783:3:783:3 | i | -2147483648 |
+| test.c:783:10:783:11 | sc | 1 |
+| test.c:785:7:785:7 | i | -128 |
+| test.c:792:7:792:7 | n | 0 |
+| test.c:794:7:794:7 | n | 0 |
+| test.c:795:9:795:9 | n | 1 |
+| test.c:798:7:798:7 | n | 0 |
+| test.c:799:9:799:9 | n | 1 |
+| test.c:801:9:801:9 | n | 0 |
+| test.c:804:8:804:8 | n | 0 |
+| test.c:805:9:805:9 | n | 0 |
+| test.c:807:9:807:9 | n | 1 |
+| test.c:810:10:810:10 | n | 0 |
+| test.c:811:5:811:5 | n | 1 |
+| test.c:814:7:814:7 | n | 0 |
+| test.c:818:7:818:7 | n | -32768 |
+| test.c:821:7:821:7 | n | 0 |
+| test.c:822:9:822:9 | n | 0 |
+| test.c:824:9:824:9 | n | 1 |
+| test.c:827:7:827:7 | n | 0 |
+| test.c:828:9:828:9 | n | 1 |
+| test.c:830:9:830:9 | n | 0 |
+| test.c:833:10:833:10 | n | 0 |
+| test.c:834:5:834:5 | n | 1 |
+| test.c:837:7:837:7 | n | 0 |
+| test.c:841:7:841:7 | n | -32768 |
+| test.c:842:9:842:9 | n | -32768 |
+| test.c:843:11:843:11 | n | 0 |
+| test.c:847:7:847:7 | n | -32768 |
+| test.c:848:13:848:13 | n | 5 |
+| test.c:851:9:851:9 | n | 6 |
+| test.c:854:7:854:7 | n | -32768 |
+| test.c:854:22:854:22 | n | -32767 |
+| test.c:855:9:855:9 | n | -32766 |
+| test.c:858:7:858:7 | n | -32768 |
+| test.c:859:5:859:5 | n | 0 |
+| test.c:859:10:859:10 | n | 1 |
+| test.c:859:14:859:14 | n | 0 |
+| test.c:860:6:860:6 | n | 0 |
+| test.c:860:10:860:10 | n | 0 |
+| test.c:860:14:860:14 | n | 1 |
+| test.c:871:7:871:8 | ss | -32768 |
+| test.c:872:9:872:10 | ss | 0 |
+| test.c:875:7:875:8 | ss | -32768 |
+| test.c:876:9:876:10 | ss | -32768 |
+| test.c:879:14:879:15 | us | 0 |
+| test.c:880:9:880:10 | us | 0 |
+| test.c:883:14:883:15 | us | 0 |
+| test.c:884:9:884:10 | us | 0 |
+| test.c:887:7:887:8 | ss | -32768 |
+| test.c:888:9:888:10 | ss | -32768 |
+| test.c:891:7:891:8 | ss | -32768 |
+| test.c:892:9:892:10 | ss | -1 |
+| test.c:898:8:898:8 | s | -2147483648 |
+| test.c:898:15:898:15 | s | 0 |
+| test.c:898:23:898:23 | s | 0 |
+| test.c:899:18:899:18 | s | 0 |
+| test.c:899:22:899:22 | s | 0 |
+| test.c:900:9:900:14 | result | 0 |
+| test.c:906:7:906:7 | i | 0 |
+| test.c:907:9:907:9 | i | -2147483648 |
+| test.c:911:7:911:7 | u | 0 |
+| test.c:912:9:912:9 | u | 0 |
+| test.c:917:12:917:12 | s | -2147483648 |
+| test.c:918:7:918:8 | s2 | -4 |
+| test.c:923:7:923:7 | x | -2147483648 |
+| test.c:924:9:924:9 | y | -2147483648 |
+| test.c:928:7:928:7 | y | -2147483648 |
+| test.c:937:7:937:7 | x | -2147483648 |
+| test.c:942:7:942:7 | x | -2147483648 |
+| test.c:949:8:949:8 | x | 2147483647 |
+| test.c:949:12:949:12 | y | 256 |
+| test.c:950:9:950:9 | x | 2147483647 |
+| test.c:951:9:951:9 | y | 256 |
 | test.cpp:10:7:10:7 | b | -2147483648 |
 | test.cpp:11:5:11:5 | x | -2147483648 |
 | test.cpp:13:10:13:10 | x | -2147483648 |

cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/nrOfBounds.ql

@@ -0,0 +1,31 @@
+import cpp
+import utils.test.InlineExpectationsTest
+import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis
+
+query predicate estimateNrOfBounds(Expr e, float nrOfBounds) {
+  nrOfBounds = SimpleRangeAnalysisInternal::estimateNrOfBounds(e)
+}
+
+/**
+ * Finds any expressions for which `nrOfBounds` is not functional. The result
+ * should be empty, so this predicate is useful to debug non-functional cases.
+ */
+private predicate nonFunctionalNrOfBounds(Expr e) {
+  strictcount(SimpleRangeAnalysisInternal::estimateNrOfBounds(e)) > 1
+}
+
+module FunctionalityTest implements TestSig {
+  string getARelevantTag() { result = "nonFunctionalNrOfBounds" }
+
+  predicate hasActualResult(Location location, string element, string tag, string value) {
+    exists(Expr e |
+      nonFunctionalNrOfBounds(e) and
+      location = e.getLocation() and
+      element = e.toString() and
+      tag = "nonFunctionalNrOfBounds" and
+      value = ""
+    )
+  }
+}
+
+import MakeTest<FunctionalityTest>

cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/ternaryLower.expected

@@ -72,8 +72,77 @@
 | test.c:405:22:405:82 | ... ? ... : ... | 0.13204114 | 0.42186276 | 0.13204114 |
 | test.c:405:26:405:69 | ... ? ... : ... | 0.42186276 | 0.42186276 | 0.44996679 |
 | test.c:405:30:405:56 | ... ? ... : ... | 0.42186276 | 0.42186276 | 0.53843358 |
-| test.c:418:20:418:36 | ... ? ... : ... | 0.0 | 0.0 | 100.0 |
-| test.c:630:5:630:14 | ... ? ... : ... | 0.0 | 1.0 | 0.0 |
-| test.c:631:5:631:14 | ... ? ... : ... | 0.0 | 0.0 | 1.0 |
+| test.c:447:4:621:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:447:5:449:49 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:450:6:532:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:451:8:469:41 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:454:10:458:21 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:454:31:454:79 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:456:13:458:21 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:463:12:468:23 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:464:12:464:60 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:466:15:468:23 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:470:6:489:23 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:473:8:477:19 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:473:29:473:77 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:475:11:477:19 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:478:6:478:54 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:482:10:486:21 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:482:31:482:79 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:484:13:486:21 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:487:9:489:23 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:491:10:510:43 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:494:12:499:23 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:495:12:495:60 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:497:15:499:23 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:504:14:509:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:505:14:505:62 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:507:17:509:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:511:9:532:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:514:14:519:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:515:14:515:62 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:517:17:519:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:520:12:520:60 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:524:12:529:23 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:525:12:525:60 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:527:15:529:23 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:530:11:532:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:533:9:535:51 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:536:9:621:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:537:14:556:47 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:540:16:545:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:541:16:541:64 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:543:19:545:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:550:18:555:29 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:551:18:551:66 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:553:21:555:29 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:557:12:578:29 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:560:14:565:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:561:14:561:62 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:563:17:565:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:566:12:566:60 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:570:16:575:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:571:16:571:64 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:573:19:575:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:576:15:578:29 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:580:12:599:45 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:583:14:588:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:584:14:584:62 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:586:17:588:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:593:16:598:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:594:16:594:64 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:596:19:598:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:600:11:621:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:603:16:608:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:604:16:604:64 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:606:19:608:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:609:14:609:62 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:613:14:618:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:614:14:614:62 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:616:17:618:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:619:13:621:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:647:20:647:36 | ... ? ... : ... | 0.0 | 0.0 | 100.0 |
+| test.c:859:5:859:14 | ... ? ... : ... | 0.0 | 1.0 | 0.0 |
+| test.c:860:5:860:14 | ... ? ... : ... | 0.0 | 0.0 | 1.0 |
 | test.cpp:121:3:121:12 | ... ? ... : ... | 0.0 | 1.0 | 0.0 |
 | test.cpp:122:3:122:12 | ... ? ... : ... | 0.0 | 0.0 | 1.0 |

cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/ternaryUpper.expected

@@ -72,8 +72,77 @@
 | test.c:405:22:405:82 | ... ? ... : ... | 0.53843358 | 0.53843358 | 0.13204114 |
 | test.c:405:26:405:69 | ... ? ... : ... | 0.53843358 | 0.53843358 | 0.44996679 |
 | test.c:405:30:405:56 | ... ? ... : ... | 0.53843358 | 0.42186276 | 0.53843358 |
-| test.c:418:20:418:36 | ... ? ... : ... | 100.0 | 99.0 | 100.0 |
-| test.c:630:5:630:14 | ... ? ... : ... | 32767.0 | 32767.0 | 0.0 |
-| test.c:631:5:631:14 | ... ? ... : ... | 32767.0 | 0.0 | 32767.0 |
+| test.c:447:4:621:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:447:5:449:49 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:450:6:532:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:451:8:469:41 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:454:10:458:21 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:454:31:454:79 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:456:13:458:21 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:463:12:468:23 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:464:12:464:60 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:466:15:468:23 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:470:6:489:23 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:473:8:477:19 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:473:29:473:77 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:475:11:477:19 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:478:6:478:54 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:482:10:486:21 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:482:31:482:79 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:484:13:486:21 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:487:9:489:23 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:491:10:510:43 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:494:12:499:23 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:495:12:495:60 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:497:15:499:23 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:504:14:509:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:505:14:505:62 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:507:17:509:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:511:9:532:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:514:14:519:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:515:14:515:62 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:517:17:519:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:520:12:520:60 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:524:12:529:23 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:525:12:525:60 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:527:15:529:23 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:530:11:532:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:533:9:535:51 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:536:9:621:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:537:14:556:47 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:540:16:545:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:541:16:541:64 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:543:19:545:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:550:18:555:29 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:551:18:551:66 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:553:21:555:29 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:557:12:578:29 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:560:14:565:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:561:14:561:62 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:563:17:565:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:566:12:566:60 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:570:16:575:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:571:16:571:64 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:573:19:575:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:576:15:578:29 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:580:12:599:45 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:583:14:588:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:584:14:584:62 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:586:17:588:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:593:16:598:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:594:16:594:64 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:596:19:598:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:600:11:621:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:603:16:608:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:604:16:604:64 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:606:19:608:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:609:14:609:62 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:613:14:618:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:614:14:614:62 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:616:17:618:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:619:13:621:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:647:20:647:36 | ... ? ... : ... | 100.0 | 99.0 | 100.0 |
+| test.c:859:5:859:14 | ... ? ... : ... | 32767.0 | 32767.0 | 0.0 |
+| test.c:860:5:860:14 | ... ? ... : ... | 32767.0 | 0.0 | 32767.0 |
 | test.cpp:121:3:121:12 | ... ? ... : ... | 32767.0 | 32767.0 | 0.0 |
 | test.cpp:122:3:122:12 | ... ? ... : ... | 32767.0 | 0.0 | 32767.0 |

cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/test.c

@@ -413,6 +413,235 @@ double test_ternary_nested_of_literals(double m, double n, double o, double p, d
   return output;
 }
 
+int repeated_if_statements(unsigned int rhs) {
+  // Test how many bounds we estimate for `if` statements without `else`
+  // branches where the following node is both a normal phi node and a guard phi
+  // node.
+  if (rhs < 12) { rhs << 1; }
+  if (rhs < 13) { rhs << 1; }
+  if (rhs < 14) { rhs << 1; }
+  if (rhs < 15) { rhs << 1; }
+  if (rhs < 16) { rhs << 1; }
+  return rhs; // rhs has 6 bounds
+}
+
+int ne_phi_nodes(int a, int b) {
+  if (a == 17) {
+    if (b == 23) {
+      a += b;
+    }
+    if (a == 18) {
+      b = 10;
+    }
+  }
+  // The statement below is an NE phi node for the access `a` in both `a == 17`
+  // and `a == 18`.
+  int c = a + b;
+  return a + b;
+}
+
+unsigned int conditional_nested_guards(unsigned int ip) {
+  // This tests a combinatorial explosion that can happen from a large number of
+  // nested linear guards.
+  unsigned int special_number =
+   (14 * ip > (2 * ip + 1) * 17 + (2 * ip + 1 + 1) * 17
+      ? 14 * ip
+      : (2 * ip + 1) * 14 + (2 * ip + 1 + 1) * 17) >
+    (2 * (ip * 14 + 32) +
+      (4 * (ip * 14 + 32) +
+        (2 * ip * 14 + 32) +
+        2 * (ip * 14 + 64) +
+        ((2 * ip + 1) * 14 > (17 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+          ? (2 * ip + 1) * 14
+          : 14 * (2 * ip) > 17 * ip
+            ? 14 * (2 * ip)
+            : 14 * ip) >
+      2 * ip * 14 + (2 * ip + 1) * 17
+        ? 4 * (ip * 14 + 32) +
+          (2 * ip * 14 + 32) +
+          2 * (ip * 14 + 64) +
+          ((2 * ip + 1) * 14 >
+          (14 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+            ? (2 * ip + 1) * 14
+            : 14 * (2 * ip) > 17 * ip
+              ? 14 * (2 * ip)
+              : 14 * ip)
+        : 2 * ip * 14 + (2 * ip + 1) * 17) >
+    (4 * (ip * 14 + 32) +
+      (2 * ip * 14 + 32) +
+      2 * (ip * 14 + 64) +
+      ((2 * ip + 1) * 14 > (17 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+        ? (2 * ip + 1) * 14
+        : 14 * (2 * ip) > 17 * ip
+          ? 14 * (2 * ip)
+          : 14 * ip) >
+    (14 * ip > (ip + 1) * 17 ? 17 * ip : (ip + 1) * 17)
+      ? 4 * (ip * 14 + 32) +
+        (2 * ip * 14 + 32) +
+        2 * (ip * 14 + 64) +
+        ((2 * ip + 1) * 14 > (17 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+          ? (2 * ip + 1) * 14
+          : 14 * (2 * ip) > 17 * ip
+            ? 14 * (2 * ip)
+            : 14 * ip)
+      : 14 * ip > (ip + 1) * 17
+        ? 14 * ip
+        : (ip + 1) * 14)
+      ? 2 * (ip * 14 + 32) +
+        (4 * (ip * 14 + 32) +
+          (2 * ip * 14 + 32) +
+          2 * (ip * 14 + 64) +
+          ((2 * ip + 1) * 14 >
+          (14 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+            ? (2 * ip + 1) * 14
+            : 14 * (2 * ip) > 17 * ip
+              ? 14 * (2 * ip)
+              : 14 * ip) >
+        2 * ip * 14 + (2 * ip + 1) * 17
+          ? 4 * (ip * 14 + 32) +
+            (2 * ip * 14 + 32) +
+            2 * (ip * 14 + 64) +
+            ((2 * ip + 1) * 14 >
+            (14 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+              ? (2 * ip + 1) * 14
+              : 14 * (2 * ip) > 17 * ip
+                ? 14 * (2 * ip)
+                : 14 * ip)
+          : 2 * ip * 14 + (2 * ip + 1) * 17)
+      : 4 * (ip * 14 + 32) +
+            (2 * ip * 14 + 32) +
+            2 * (ip * 14 + 64) +
+            ((2 * ip + 1) * 14 >
+            (14 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+              ? (2 * ip + 1) * 14
+              : 14 * (2 * ip) > 17 * ip
+                ? 14 * (2 * ip)
+                : 14 * ip) >
+          (14 * ip > (ip + 1) * 17 ? 17 * ip : (ip + 1) * 17)
+        ? 4 * (ip * 14 + 32) +
+          (2 * ip * 14 + 32) +
+          2 * (ip * 14 + 64) +
+          ((2 * ip + 1) * 14 >
+          (14 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+            ? (2 * ip + 1) * 14
+            : 14 * (2 * ip) > 17 * ip
+              ? 14 * (2 * ip)
+              : 14 * ip)
+        : 14 * ip > (ip + 1) * 17
+          ? 14 * ip
+          : (ip + 1) * 14)
+      ? 14 * ip > (2 * ip + 1) * 17 + (2 * ip + 1 + 1) * 17
+        ? 14 * ip
+        : (2 * ip + 1) * 14 + (2 * ip + 1 + 1) * 17
+      : 2 * (ip * 14 + 32) +
+            (4 * (ip * 14 + 32) +
+              (2 * ip * 14 + 32) +
+              2 * (ip * 14 + 64) +
+              ((2 * ip + 1) * 14 >
+              (14 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+                ? (2 * ip + 1) * 14
+                : 14 * (2 * ip) > 17 * ip
+                  ? 14 * (2 * ip)
+                  : 14 * ip) >
+            2 * ip * 14 + (2 * ip + 1) * 17
+              ? 4 * (ip * 14 + 32) +
+                (2 * ip * 14 + 32) +
+                2 * (ip * 14 + 64) +
+                ((2 * ip + 1) * 14 >
+                (14 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+                  ? (2 * ip + 1) * 14
+                  : 14 * (2 * ip) > 17 * ip
+                    ? 14 * (2 * ip)
+                    : 14 * ip)
+              : 2 * ip * 14 + (2 * ip + 1) * 17) >
+          (4 * (ip * 14 + 32) +
+            (2 * ip * 14 + 32) +
+            2 * (ip * 14 + 64) +
+            ((2 * ip + 1) * 14 >
+            (14 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+              ? (2 * ip + 1) * 14
+              : 14 * (2 * ip) > 17 * ip
+                ? 14 * (2 * ip)
+                : 14 * ip) >
+          (14 * ip > (ip + 1) * 17 ? 17 * ip : (ip + 1) * 17)
+            ? 4 * (ip * 14 + 32) +
+              (2 * ip * 14 + 32) +
+              2 * (ip * 14 + 64) +
+              ((2 * ip + 1) * 14 >
+              (14 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+                ? (2 * ip + 1) * 14
+                : 14 * (2 * ip) > 17 * ip
+                  ? 14 * (2 * ip)
+                  : 14 * ip)
+            : 14 * ip > (ip + 1) * 17
+              ? 14 * ip
+              : (ip + 1) * 14)
+        ? 2 * (ip * 14 + 32) +
+          (4 * (ip * 14 + 32) +
+            (2 * ip * 14 + 32) +
+            2 * (ip * 14 + 64) +
+            ((2 * ip + 1) * 14 >
+            (14 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+              ? (2 * ip + 1) * 14
+              : 14 * (2 * ip) > 17 * ip
+                ? 14 * (2 * ip)
+                : 14 * ip) >
+          2 * ip * 14 + (2 * ip + 1) * 17
+            ? 4 * (ip * 14 + 32) +
+              (2 * ip * 14 + 32) +
+              2 * (ip * 14 + 64) +
+              ((2 * ip + 1) * 14 >
+              (14 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+                ? (2 * ip + 1) * 14
+                : 14 * (2 * ip) > 17 * ip
+                  ? 14 * (2 * ip)
+                  : 14 * ip)
+            : 2 * ip * 14 + (2 * ip + 1) * 17)
+        : 4 * (ip * 14 + 32) +
+              (2 * ip * 14 + 32) +
+              2 * (ip * 14 + 64) +
+              ((2 * ip + 1) * 14 >
+              (14 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+                ? (2 * ip + 1) * 14
+                : 14 * (2 * ip) > 17 * ip
+                  ? 14 * (2 * ip)
+                  : 14 * ip) >
+            (14 * ip > (ip + 1) * 17 ? 17 * ip : (ip + 1) * 17)
+          ? 4 * (ip * 14 + 32) +
+            (2 * ip * 14 + 32) +
+            2 * (ip * 14 + 64) +
+            ((2 * ip + 1) * 14 >
+            (14 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+              ? (2 * ip + 1) * 14
+              : 14 * (2 * ip) > 17 * ip
+                ? 14 * (2 * ip)
+                : 14 * ip)
+          : 14 * ip > (ip + 1) * 17
+            ? 14 * ip
+            : (ip + 1) * 14; 
+  return special_number;
+}
+
+int many_conditional_assignments(int c1, int c2, int c3, int c4, int c5) {
+  // This tests a combinatorial explosion that can happen from many conditional
+  // assignments, since each conditional assignment doubles the number of
+  // bounds.
+  int x = 0;
+  if (c1) { x += 748596; }
+  if (c2) { x += 84652395; }
+  if (c3) { x += 3675895; }
+  if (c4) { x += 98634; }
+  if (c5) { x += 7834985; }
+  if (c1 && c2) { x += 938457398; }
+  if (c1 && c3) { x += 73895648; }
+  if (c1 && c4) { x += 12345432; }
+  if (c1 && c5) { x += 38847; }
+  if (c2 && c3) { x += 234; }
+  // x now has 2^10 bounds, the 10 additions below give (2^10)^10 bounds
+  int y = x + x + x + x + x + x + x + x + x + x + x + x;
+  return y;
+}
+
 // Test the comma expression.
 unsigned int test_comma01(unsigned int x) {
   unsigned int y = x < 100 ? x : 100;

cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/upperBound.expected

@@ -485,197 +485,529 @@
 | test.c:411:59:411:59 | k | 0.889553 |
 | test.c:411:63:411:63 | l | 0.538434 |
 | test.c:413:10:413:15 | output | 9.284378 |
-| test.c:418:20:418:20 | x | 4294967295 |
-| test.c:418:30:418:30 | x | 99 |
-| test.c:421:3:421:4 | y1 | 4294967295 |
-| test.c:421:11:421:11 | y | 100 |
-| test.c:421:14:421:14 | y | 101 |
-| test.c:422:3:422:4 | y2 | 4294967295 |
-| test.c:422:9:422:9 | y | 101 |
-| test.c:422:14:422:14 | y | 102 |
-| test.c:422:22:422:22 | y | 105 |
-| test.c:423:10:423:11 | y1 | 101 |
-| test.c:423:15:423:16 | y2 | 105 |
-| test.c:431:3:431:3 | i | 2147483647 |
-| test.c:432:7:432:7 | i | 10 |
-| test.c:434:3:434:3 | i | 2147483647 |
-| test.c:435:3:435:3 | i | 10 |
-| test.c:436:7:436:7 | i | 20 |
-| test.c:438:3:438:3 | i | 2147483647 |
-| test.c:439:3:439:3 | i | 40 |
-| test.c:440:7:440:7 | i | 30 |
-| test.c:442:3:442:3 | i | 2147483647 |
-| test.c:442:7:442:7 | j | 2147483647 |
-| test.c:443:7:443:7 | i | 40 |
-| test.c:445:3:445:3 | i | 2147483647 |
-| test.c:445:8:445:8 | j | 40 |
-| test.c:446:7:446:7 | i | 50 |
-| test.c:448:3:448:3 | i | 2147483647 |
-| test.c:448:13:448:13 | j | 50 |
-| test.c:449:7:449:7 | i | 60 |
-| test.c:456:12:456:12 | a | 4294967295 |
-| test.c:456:17:456:17 | a | 4294967295 |
-| test.c:456:33:456:33 | b | 4294967295 |
-| test.c:456:38:456:38 | b | 4294967295 |
-| test.c:457:13:457:13 | a | 11 |
-| test.c:457:15:457:15 | b | 23 |
-| test.c:458:5:458:9 | total | 0 |
-| test.c:458:14:458:14 | r | 253 |
-| test.c:460:12:460:12 | a | 4294967295 |
-| test.c:460:17:460:17 | a | 4294967295 |
-| test.c:460:33:460:33 | b | 4294967295 |
-| test.c:460:38:460:38 | b | 4294967295 |
-| test.c:461:13:461:13 | a | 11 |
-| test.c:461:15:461:15 | b | 23 |
-| test.c:462:5:462:9 | total | 253 |
-| test.c:462:14:462:14 | r | 253 |
-| test.c:464:12:464:12 | a | 4294967295 |
-| test.c:464:17:464:17 | a | 4294967295 |
-| test.c:464:34:464:34 | b | 4294967295 |
-| test.c:464:39:464:39 | b | 4294967295 |
-| test.c:465:13:465:13 | a | 11 |
-| test.c:465:15:465:15 | b | 23 |
-| test.c:466:5:466:9 | total | 506 |
-| test.c:466:14:466:14 | r | 253 |
-| test.c:469:10:469:14 | total | 759 |
-| test.c:475:12:475:12 | b | 4294967295 |
-| test.c:475:17:475:17 | b | 4294967295 |
-| test.c:476:16:476:16 | b | 23 |
-| test.c:477:5:477:9 | total | 0 |
-| test.c:477:14:477:14 | r | 253 |
-| test.c:479:12:479:12 | b | 4294967295 |
-| test.c:479:17:479:17 | b | 4294967295 |
-| test.c:480:16:480:16 | b | 23 |
-| test.c:481:5:481:9 | total | 253 |
-| test.c:481:14:481:14 | r | 253 |
-| test.c:483:13:483:13 | b | 4294967295 |
-| test.c:483:18:483:18 | b | 4294967295 |
-| test.c:484:16:484:16 | b | 23 |
-| test.c:485:5:485:9 | total | 506 |
-| test.c:485:14:485:14 | r | 253 |
-| test.c:488:10:488:14 | total | 759 |
-| test.c:493:3:493:3 | x | 18446744073709551616 |
-| test.c:493:7:493:7 | y | 18446744073709551616 |
-| test.c:494:3:494:4 | xy | 18446744073709551616 |
-| test.c:494:8:494:8 | x | 1000000003 |
-| test.c:494:12:494:12 | y | 1000000003 |
-| test.c:495:10:495:11 | xy | 1000000006000000000 |
-| test.c:500:3:500:3 | x | 18446744073709551616 |
-| test.c:501:3:501:3 | y | 18446744073709551616 |
-| test.c:502:3:502:4 | xy | 18446744073709551616 |
-| test.c:502:8:502:8 | x | 274177 |
-| test.c:502:12:502:12 | y | 67280421310721 |
-| test.c:503:10:503:11 | xy | 18446744073709551616 |
-| test.c:507:7:507:8 | ui | 4294967295 |
-| test.c:508:43:508:44 | ui | 4294967295 |
-| test.c:508:48:508:49 | ui | 4294967295 |
-| test.c:509:12:509:17 | result | 18446744065119617024 |
-| test.c:511:7:511:8 | ul | 18446744073709551616 |
-| test.c:512:28:512:29 | ul | 18446744073709551616 |
-| test.c:512:33:512:34 | ul | 18446744073709551616 |
-| test.c:513:12:513:17 | result | 18446744073709551616 |
-| test.c:519:7:519:8 | ui | 4294967295 |
-| test.c:519:19:519:20 | ui | 10 |
-| test.c:520:5:520:6 | ui | 10 |
-| test.c:520:11:520:12 | ui | 10 |
-| test.c:521:12:521:13 | ui | 100 |
-| test.c:525:3:525:9 | uiconst | 10 |
-| test.c:528:3:528:9 | ulconst | 10 |
-| test.c:529:10:529:16 | uiconst | 40 |
-| test.c:529:20:529:26 | ulconst | 40 |
-| test.c:533:7:533:7 | i | 2147483647 |
-| test.c:533:18:533:18 | i | 2147483647 |
-| test.c:534:5:534:5 | i | 2147483647 |
-| test.c:534:13:534:13 | i | 2 |
-| test.c:535:9:535:9 | i | 10 |
-| test.c:537:5:537:5 | i | 2147483647 |
-| test.c:537:9:537:9 | i | 10 |
-| test.c:538:9:538:9 | i | 15 |
-| test.c:540:5:540:5 | i | 15 |
-| test.c:541:9:541:9 | i | 105 |
-| test.c:543:5:543:5 | i | 105 |
-| test.c:544:9:544:9 | i | 2310 |
-| test.c:546:7:546:7 | i | 2147483647 |
-| test.c:547:5:547:5 | i | 2147483647 |
-| test.c:547:9:547:9 | i | -1 |
-| test.c:548:9:548:9 | i | 1 |
-| test.c:550:3:550:3 | i | 2147483647 |
-| test.c:550:7:550:7 | i | 2147483647 |
-| test.c:551:10:551:10 | i | 2147483647 |
-| test.c:554:3:554:3 | i | 2147483647 |
-| test.c:554:10:554:11 | sc | 1 |
-| test.c:556:7:556:7 | i | 127 |
-| test.c:563:7:563:7 | n | 4294967295 |
-| test.c:565:7:565:7 | n | 4294967295 |
-| test.c:566:9:566:9 | n | 4294967295 |
-| test.c:569:7:569:7 | n | 4294967295 |
-| test.c:570:9:570:9 | n | 4294967295 |
-| test.c:572:9:572:9 | n | 0 |
-| test.c:575:8:575:8 | n | 4294967295 |
-| test.c:576:9:576:9 | n | 0 |
-| test.c:578:9:578:9 | n | 4294967295 |
-| test.c:581:10:581:10 | n | 4294967295 |
-| test.c:582:5:582:5 | n | 4294967295 |
-| test.c:585:7:585:7 | n | 0 |
-| test.c:589:7:589:7 | n | 32767 |
-| test.c:592:7:592:7 | n | 32767 |
-| test.c:593:9:593:9 | n | 0 |
-| test.c:595:9:595:9 | n | 32767 |
-| test.c:598:7:598:7 | n | 32767 |
-| test.c:599:9:599:9 | n | 32767 |
-| test.c:601:9:601:9 | n | 0 |
-| test.c:604:10:604:10 | n | 32767 |
-| test.c:605:5:605:5 | n | 32767 |
-| test.c:608:7:608:7 | n | 0 |
-| test.c:612:7:612:7 | n | 32767 |
-| test.c:613:9:613:9 | n | 32767 |
-| test.c:614:11:614:11 | n | 32767 |
-| test.c:618:7:618:7 | n | 32767 |
-| test.c:619:13:619:13 | n | 32767 |
-| test.c:622:9:622:9 | n | 32767 |
-| test.c:625:7:625:7 | n | 32767 |
-| test.c:625:22:625:22 | n | 32767 |
-| test.c:626:9:626:9 | n | 32767 |
-| test.c:629:7:629:7 | n | 32767 |
-| test.c:630:5:630:5 | n | 32767 |
-| test.c:630:10:630:10 | n | 32767 |
-| test.c:630:14:630:14 | n | 0 |
-| test.c:631:6:631:6 | n | 32767 |
-| test.c:631:10:631:10 | n | 0 |
-| test.c:631:14:631:14 | n | 32767 |
-| test.c:642:7:642:8 | ss | 32767 |
-| test.c:643:9:643:10 | ss | 3 |
-| test.c:646:7:646:8 | ss | 32767 |
-| test.c:647:9:647:10 | ss | 32767 |
-| test.c:650:14:650:15 | us | 65535 |
-| test.c:651:9:651:10 | us | 32767 |
-| test.c:654:14:654:15 | us | 65535 |
-| test.c:655:9:655:10 | us | 65535 |
-| test.c:658:7:658:8 | ss | 32767 |
-| test.c:659:9:659:10 | ss | 32767 |
-| test.c:662:7:662:8 | ss | 32767 |
-| test.c:663:9:663:10 | ss | 2 |
-| test.c:669:8:669:8 | s | 2147483647 |
-| test.c:669:15:669:15 | s | 127 |
-| test.c:669:23:669:23 | s | 9 |
-| test.c:670:18:670:18 | s | 9 |
-| test.c:670:22:670:22 | s | 9 |
-| test.c:671:9:671:14 | result | 127 |
-| test.c:677:7:677:7 | i | 0 |
-| test.c:678:9:678:9 | i | 2147483647 |
-| test.c:682:7:682:7 | u | 0 |
-| test.c:683:9:683:9 | u | 4294967295 |
-| test.c:688:12:688:12 | s | 2147483647 |
-| test.c:689:7:689:8 | s2 | 4 |
-| test.c:694:7:694:7 | x | 2147483647 |
-| test.c:695:9:695:9 | y | 2147483647 |
-| test.c:699:7:699:7 | y | 2147483647 |
-| test.c:708:7:708:7 | x | 2147483647 |
-| test.c:713:7:713:7 | x | 15 |
-| test.c:720:8:720:8 | x | 2147483647 |
-| test.c:720:12:720:12 | y | 256 |
-| test.c:721:9:721:9 | x | 2147483647 |
-| test.c:722:9:722:9 | y | 256 |
+| test.c:420:7:420:9 | rhs | 4294967295 |
+| test.c:420:19:420:21 | rhs | 11 |
+| test.c:421:7:421:9 | rhs | 4294967295 |
+| test.c:421:19:421:21 | rhs | 12 |
+| test.c:422:7:422:9 | rhs | 4294967295 |
+| test.c:422:19:422:21 | rhs | 13 |
+| test.c:423:7:423:9 | rhs | 4294967295 |
+| test.c:423:19:423:21 | rhs | 14 |
+| test.c:424:7:424:9 | rhs | 4294967295 |
+| test.c:424:19:424:21 | rhs | 15 |
+| test.c:425:10:425:12 | rhs | 4294967295 |
+| test.c:429:7:429:7 | a | 2147483647 |
+| test.c:430:9:430:9 | b | 2147483647 |
+| test.c:431:7:431:7 | a | 17 |
+| test.c:431:12:431:12 | b | 23 |
+| test.c:433:9:433:9 | a | 40 |
+| test.c:434:7:434:7 | b | 2147483647 |
+| test.c:439:11:439:11 | a | 2147483647 |
+| test.c:439:15:439:15 | b | 2147483647 |
+| test.c:440:10:440:10 | a | 2147483647 |
+| test.c:440:14:440:14 | b | 2147483647 |
+| test.c:447:10:447:11 | ip | 4294967295 |
+| test.c:447:20:447:21 | ip | 4294967295 |
+| test.c:447:40:447:41 | ip | 4294967295 |
+| test.c:448:14:448:15 | ip | 4294967295 |
+| test.c:449:14:449:15 | ip | 4294967295 |
+| test.c:449:34:449:35 | ip | 4294967295 |
+| test.c:450:11:450:12 | ip | 4294967295 |
+| test.c:451:13:451:14 | ip | 4294967295 |
+| test.c:452:14:452:15 | ip | 4294967295 |
+| test.c:453:14:453:15 | ip | 4294967295 |
+| test.c:454:15:454:16 | ip | 4294967295 |
+| test.c:454:41:454:42 | ip | 4294967295 |
+| test.c:454:52:454:53 | ip | 4294967295 |
+| test.c:454:67:454:68 | ip | 4294967295 |
+| test.c:454:78:454:79 | ip | 4294967295 |
+| test.c:455:18:455:19 | ip | 4294967295 |
+| test.c:456:23:456:24 | ip | 4294967295 |
+| test.c:456:34:456:35 | ip | 4294967295 |
+| test.c:457:25:457:26 | ip | 4294967295 |
+| test.c:458:20:458:21 | ip | 4294967295 |
+| test.c:459:11:459:12 | ip | 4294967295 |
+| test.c:459:26:459:27 | ip | 4294967295 |
+| test.c:460:16:460:17 | ip | 4294967295 |
+| test.c:461:16:461:17 | ip | 4294967295 |
+| test.c:462:16:462:17 | ip | 4294967295 |
+| test.c:463:17:463:18 | ip | 4294967295 |
+| test.c:464:22:464:23 | ip | 4294967295 |
+| test.c:464:33:464:34 | ip | 4294967295 |
+| test.c:464:48:464:49 | ip | 4294967295 |
+| test.c:464:59:464:60 | ip | 4294967295 |
+| test.c:465:20:465:21 | ip | 4294967295 |
+| test.c:466:25:466:26 | ip | 4294967295 |
+| test.c:466:36:466:37 | ip | 4294967295 |
+| test.c:467:27:467:28 | ip | 4294967295 |
+| test.c:468:22:468:23 | ip | 4294967295 |
+| test.c:469:15:469:16 | ip | 4294967295 |
+| test.c:469:30:469:31 | ip | 4294967295 |
+| test.c:470:11:470:12 | ip | 4294967295 |
+| test.c:471:12:471:13 | ip | 4294967295 |
+| test.c:472:12:472:13 | ip | 4294967295 |
+| test.c:473:13:473:14 | ip | 4294967295 |
+| test.c:473:39:473:40 | ip | 4294967295 |
+| test.c:473:50:473:51 | ip | 4294967295 |
+| test.c:473:65:473:66 | ip | 4294967295 |
+| test.c:473:76:473:77 | ip | 4294967295 |
+| test.c:474:16:474:17 | ip | 4294967295 |
+| test.c:475:21:475:22 | ip | 4294967295 |
+| test.c:475:32:475:33 | ip | 4294967295 |
+| test.c:476:23:476:24 | ip | 4294967295 |
+| test.c:477:18:477:19 | ip | 4294967295 |
+| test.c:478:11:478:12 | ip | 4294967295 |
+| test.c:478:17:478:18 | ip | 4294967295 |
+| test.c:478:37:478:38 | ip | 4294967295 |
+| test.c:478:43:478:44 | ip | 4294967295 |
+| test.c:479:14:479:15 | ip | 4294967295 |
+| test.c:480:14:480:15 | ip | 4294967295 |
+| test.c:481:14:481:15 | ip | 4294967295 |
+| test.c:482:15:482:16 | ip | 4294967295 |
+| test.c:482:41:482:42 | ip | 4294967295 |
+| test.c:482:52:482:53 | ip | 4294967295 |
+| test.c:482:67:482:68 | ip | 4294967295 |
+| test.c:482:78:482:79 | ip | 4294967295 |
+| test.c:483:18:483:19 | ip | 4294967295 |
+| test.c:484:23:484:24 | ip | 4294967295 |
+| test.c:484:34:484:35 | ip | 4294967295 |
+| test.c:485:25:485:26 | ip | 4294967295 |
+| test.c:486:20:486:21 | ip | 4294967295 |
+| test.c:487:14:487:15 | ip | 4294967295 |
+| test.c:487:20:487:21 | ip | 4294967295 |
+| test.c:488:16:488:17 | ip | 4294967295 |
+| test.c:489:12:489:13 | ip | 4294967295 |
+| test.c:490:14:490:15 | ip | 4294967295 |
+| test.c:491:15:491:16 | ip | 4294967295 |
+| test.c:492:16:492:17 | ip | 4294967295 |
+| test.c:493:16:493:17 | ip | 4294967295 |
+| test.c:494:17:494:18 | ip | 4294967295 |
+| test.c:495:22:495:23 | ip | 4294967295 |
+| test.c:495:33:495:34 | ip | 4294967295 |
+| test.c:495:48:495:49 | ip | 4294967295 |
+| test.c:495:59:495:60 | ip | 4294967295 |
+| test.c:496:20:496:21 | ip | 4294967295 |
+| test.c:497:25:497:26 | ip | 4294967295 |
+| test.c:497:36:497:37 | ip | 4294967295 |
+| test.c:498:27:498:28 | ip | 4294967295 |
+| test.c:499:22:499:23 | ip | 4294967295 |
+| test.c:500:13:500:14 | ip | 4294967295 |
+| test.c:500:28:500:29 | ip | 4294967295 |
+| test.c:501:18:501:19 | ip | 4294967295 |
+| test.c:502:18:502:19 | ip | 4294967295 |
+| test.c:503:18:503:19 | ip | 4294967295 |
+| test.c:504:19:504:20 | ip | 4294967295 |
+| test.c:505:24:505:25 | ip | 4294967295 |
+| test.c:505:35:505:36 | ip | 4294967295 |
+| test.c:505:50:505:51 | ip | 4294967295 |
+| test.c:505:61:505:62 | ip | 4294967295 |
+| test.c:506:22:506:23 | ip | 4294967295 |
+| test.c:507:27:507:28 | ip | 4294967295 |
+| test.c:507:38:507:39 | ip | 4294967295 |
+| test.c:508:29:508:30 | ip | 4294967295 |
+| test.c:509:24:509:25 | ip | 4294967295 |
+| test.c:510:17:510:18 | ip | 4294967295 |
+| test.c:510:32:510:33 | ip | 4294967295 |
+| test.c:511:14:511:15 | ip | 4294967295 |
+| test.c:512:18:512:19 | ip | 4294967295 |
+| test.c:513:18:513:19 | ip | 4294967295 |
+| test.c:514:19:514:20 | ip | 4294967295 |
+| test.c:515:24:515:25 | ip | 4294967295 |
+| test.c:515:35:515:36 | ip | 4294967295 |
+| test.c:515:50:515:51 | ip | 4294967295 |
+| test.c:515:61:515:62 | ip | 4294967295 |
+| test.c:516:22:516:23 | ip | 4294967295 |
+| test.c:517:27:517:28 | ip | 4294967295 |
+| test.c:517:38:517:39 | ip | 4294967295 |
+| test.c:518:29:518:30 | ip | 4294967295 |
+| test.c:519:24:519:25 | ip | 4294967295 |
+| test.c:520:17:520:18 | ip | 4294967295 |
+| test.c:520:23:520:24 | ip | 4294967295 |
+| test.c:520:43:520:44 | ip | 4294967295 |
+| test.c:520:49:520:50 | ip | 4294967295 |
+| test.c:521:16:521:17 | ip | 4294967295 |
+| test.c:522:16:522:17 | ip | 4294967295 |
+| test.c:523:16:523:17 | ip | 4294967295 |
+| test.c:524:17:524:18 | ip | 4294967295 |
+| test.c:525:22:525:23 | ip | 4294967295 |
+| test.c:525:33:525:34 | ip | 4294967295 |
+| test.c:525:48:525:49 | ip | 4294967295 |
+| test.c:525:59:525:60 | ip | 4294967295 |
+| test.c:526:20:526:21 | ip | 4294967295 |
+| test.c:527:25:527:26 | ip | 4294967295 |
+| test.c:527:36:527:37 | ip | 4294967295 |
+| test.c:528:27:528:28 | ip | 4294967295 |
+| test.c:529:22:529:23 | ip | 4294967295 |
+| test.c:530:16:530:17 | ip | 4294967295 |
+| test.c:530:22:530:23 | ip | 4294967295 |
+| test.c:531:18:531:19 | ip | 4294967295 |
+| test.c:532:14:532:15 | ip | 4294967295 |
+| test.c:533:14:533:15 | ip | 4294967295 |
+| test.c:533:24:533:25 | ip | 4294967295 |
+| test.c:533:44:533:45 | ip | 4294967295 |
+| test.c:534:16:534:17 | ip | 4294967295 |
+| test.c:535:16:535:17 | ip | 4294967295 |
+| test.c:535:36:535:37 | ip | 4294967295 |
+| test.c:536:14:536:15 | ip | 4294967295 |
+| test.c:537:19:537:20 | ip | 4294967295 |
+| test.c:538:20:538:21 | ip | 4294967295 |
+| test.c:539:20:539:21 | ip | 4294967295 |
+| test.c:540:21:540:22 | ip | 4294967295 |
+| test.c:541:26:541:27 | ip | 4294967295 |
+| test.c:541:37:541:38 | ip | 4294967295 |
+| test.c:541:52:541:53 | ip | 4294967295 |
+| test.c:541:63:541:64 | ip | 4294967295 |
+| test.c:542:24:542:25 | ip | 4294967295 |
+| test.c:543:29:543:30 | ip | 4294967295 |
+| test.c:543:40:543:41 | ip | 4294967295 |
+| test.c:544:31:544:32 | ip | 4294967295 |
+| test.c:545:26:545:27 | ip | 4294967295 |
+| test.c:546:17:546:18 | ip | 4294967295 |
+| test.c:546:32:546:33 | ip | 4294967295 |
+| test.c:547:22:547:23 | ip | 4294967295 |
+| test.c:548:22:548:23 | ip | 4294967295 |
+| test.c:549:22:549:23 | ip | 4294967295 |
+| test.c:550:23:550:24 | ip | 4294967295 |
+| test.c:551:28:551:29 | ip | 4294967295 |
+| test.c:551:39:551:40 | ip | 4294967295 |
+| test.c:551:54:551:55 | ip | 4294967295 |
+| test.c:551:65:551:66 | ip | 4294967295 |
+| test.c:552:26:552:27 | ip | 4294967295 |
+| test.c:553:31:553:32 | ip | 4294967295 |
+| test.c:553:42:553:43 | ip | 4294967295 |
+| test.c:554:33:554:34 | ip | 4294967295 |
+| test.c:555:28:555:29 | ip | 4294967295 |
+| test.c:556:21:556:22 | ip | 4294967295 |
+| test.c:556:36:556:37 | ip | 4294967295 |
+| test.c:557:17:557:18 | ip | 4294967295 |
+| test.c:558:18:558:19 | ip | 4294967295 |
+| test.c:559:18:559:19 | ip | 4294967295 |
+| test.c:560:19:560:20 | ip | 4294967295 |
+| test.c:561:24:561:25 | ip | 4294967295 |
+| test.c:561:35:561:36 | ip | 4294967295 |
+| test.c:561:50:561:51 | ip | 4294967295 |
+| test.c:561:61:561:62 | ip | 4294967295 |
+| test.c:562:22:562:23 | ip | 4294967295 |
+| test.c:563:27:563:28 | ip | 4294967295 |
+| test.c:563:38:563:39 | ip | 4294967295 |
+| test.c:564:29:564:30 | ip | 4294967295 |
+| test.c:565:24:565:25 | ip | 4294967295 |
+| test.c:566:17:566:18 | ip | 4294967295 |
+| test.c:566:23:566:24 | ip | 4294967295 |
+| test.c:566:43:566:44 | ip | 4294967295 |
+| test.c:566:49:566:50 | ip | 4294967295 |
+| test.c:567:20:567:21 | ip | 4294967295 |
+| test.c:568:20:568:21 | ip | 4294967295 |
+| test.c:569:20:569:21 | ip | 4294967295 |
+| test.c:570:21:570:22 | ip | 4294967295 |
+| test.c:571:26:571:27 | ip | 4294967295 |
+| test.c:571:37:571:38 | ip | 4294967295 |
+| test.c:571:52:571:53 | ip | 4294967295 |
+| test.c:571:63:571:64 | ip | 4294967295 |
+| test.c:572:24:572:25 | ip | 4294967295 |
+| test.c:573:29:573:30 | ip | 4294967295 |
+| test.c:573:40:573:41 | ip | 4294967295 |
+| test.c:574:31:574:32 | ip | 4294967295 |
+| test.c:575:26:575:27 | ip | 4294967295 |
+| test.c:576:20:576:21 | ip | 4294967295 |
+| test.c:576:26:576:27 | ip | 4294967295 |
+| test.c:577:22:577:23 | ip | 4294967295 |
+| test.c:578:18:578:19 | ip | 4294967295 |
+| test.c:579:16:579:17 | ip | 4294967295 |
+| test.c:580:17:580:18 | ip | 4294967295 |
+| test.c:581:18:581:19 | ip | 4294967295 |
+| test.c:582:18:582:19 | ip | 4294967295 |
+| test.c:583:19:583:20 | ip | 4294967295 |
+| test.c:584:24:584:25 | ip | 4294967295 |
+| test.c:584:35:584:36 | ip | 4294967295 |
+| test.c:584:50:584:51 | ip | 4294967295 |
+| test.c:584:61:584:62 | ip | 4294967295 |
+| test.c:585:22:585:23 | ip | 4294967295 |
+| test.c:586:27:586:28 | ip | 4294967295 |
+| test.c:586:38:586:39 | ip | 4294967295 |
+| test.c:587:29:587:30 | ip | 4294967295 |
+| test.c:588:24:588:25 | ip | 4294967295 |
+| test.c:589:15:589:16 | ip | 4294967295 |
+| test.c:589:30:589:31 | ip | 4294967295 |
+| test.c:590:20:590:21 | ip | 4294967295 |
+| test.c:591:20:591:21 | ip | 4294967295 |
+| test.c:592:20:592:21 | ip | 4294967295 |
+| test.c:593:21:593:22 | ip | 4294967295 |
+| test.c:594:26:594:27 | ip | 4294967295 |
+| test.c:594:37:594:38 | ip | 4294967295 |
+| test.c:594:52:594:53 | ip | 4294967295 |
+| test.c:594:63:594:64 | ip | 4294967295 |
+| test.c:595:24:595:25 | ip | 4294967295 |
+| test.c:596:29:596:30 | ip | 4294967295 |
+| test.c:596:40:596:41 | ip | 4294967295 |
+| test.c:597:31:597:32 | ip | 4294967295 |
+| test.c:598:26:598:27 | ip | 4294967295 |
+| test.c:599:19:599:20 | ip | 4294967295 |
+| test.c:599:34:599:35 | ip | 4294967295 |
+| test.c:600:16:600:17 | ip | 4294967295 |
+| test.c:601:20:601:21 | ip | 4294967295 |
+| test.c:602:20:602:21 | ip | 4294967295 |
+| test.c:603:21:603:22 | ip | 4294967295 |
+| test.c:604:26:604:27 | ip | 4294967295 |
+| test.c:604:37:604:38 | ip | 4294967295 |
+| test.c:604:52:604:53 | ip | 4294967295 |
+| test.c:604:63:604:64 | ip | 4294967295 |
+| test.c:605:24:605:25 | ip | 4294967295 |
+| test.c:606:29:606:30 | ip | 4294967295 |
+| test.c:606:40:606:41 | ip | 4294967295 |
+| test.c:607:31:607:32 | ip | 4294967295 |
+| test.c:608:26:608:27 | ip | 4294967295 |
+| test.c:609:19:609:20 | ip | 4294967295 |
+| test.c:609:25:609:26 | ip | 4294967295 |
+| test.c:609:45:609:46 | ip | 4294967295 |
+| test.c:609:51:609:52 | ip | 4294967295 |
+| test.c:610:18:610:19 | ip | 4294967295 |
+| test.c:611:18:611:19 | ip | 4294967295 |
+| test.c:612:18:612:19 | ip | 4294967295 |
+| test.c:613:19:613:20 | ip | 4294967295 |
+| test.c:614:24:614:25 | ip | 4294967295 |
+| test.c:614:35:614:36 | ip | 4294967295 |
+| test.c:614:50:614:51 | ip | 4294967295 |
+| test.c:614:61:614:62 | ip | 4294967295 |
+| test.c:615:22:615:23 | ip | 4294967295 |
+| test.c:616:27:616:28 | ip | 4294967295 |
+| test.c:616:38:616:39 | ip | 4294967295 |
+| test.c:617:29:617:30 | ip | 4294967295 |
+| test.c:618:24:618:25 | ip | 4294967295 |
+| test.c:619:18:619:19 | ip | 4294967295 |
+| test.c:619:24:619:25 | ip | 4294967295 |
+| test.c:620:20:620:21 | ip | 4294967295 |
+| test.c:621:16:621:17 | ip | 4294967295 |
+| test.c:622:10:622:23 | special_number | 4294967295 |
+| test.c:630:7:630:8 | c1 | 2147483647 |
+| test.c:630:13:630:13 | x | 0 |
+| test.c:631:7:631:8 | c2 | 2147483647 |
+| test.c:631:13:631:13 | x | 748596 |
+| test.c:632:7:632:8 | c3 | 2147483647 |
+| test.c:632:13:632:13 | x | 85400991 |
+| test.c:633:7:633:8 | c4 | 2147483647 |
+| test.c:633:13:633:13 | x | 89076886 |
+| test.c:634:7:634:8 | c5 | 2147483647 |
+| test.c:634:13:634:13 | x | 89175520 |
+| test.c:635:7:635:8 | c1 | 2147483647 |
+| test.c:635:13:635:14 | c2 | 2147483647 |
+| test.c:635:19:635:19 | x | 97010505 |
+| test.c:636:7:636:8 | c1 | 2147483647 |
+| test.c:636:13:636:14 | c3 | 2147483647 |
+| test.c:636:19:636:19 | x | 1035467903 |
+| test.c:637:7:637:8 | c1 | 2147483647 |
+| test.c:637:13:637:14 | c4 | 2147483647 |
+| test.c:637:19:637:19 | x | 1109363551 |
+| test.c:638:7:638:8 | c1 | 2147483647 |
+| test.c:638:13:638:14 | c5 | 2147483647 |
+| test.c:638:19:638:19 | x | 1121708983 |
+| test.c:639:7:639:8 | c2 | 2147483647 |
+| test.c:639:13:639:14 | c3 | 2147483647 |
+| test.c:639:19:639:19 | x | 1121747830 |
+| test.c:641:11:641:11 | x | 2147483647 |
+| test.c:641:15:641:15 | x | 2147483647 |
+| test.c:641:19:641:19 | x | 2147483647 |
+| test.c:641:23:641:23 | x | 2147483647 |
+| test.c:641:27:641:27 | x | 2147483647 |
+| test.c:641:31:641:31 | x | 2147483647 |
+| test.c:641:35:641:35 | x | 2147483647 |
+| test.c:641:39:641:39 | x | 2147483647 |
+| test.c:641:43:641:43 | x | 2147483647 |
+| test.c:641:47:641:47 | x | 2147483647 |
+| test.c:641:51:641:51 | x | 2147483647 |
+| test.c:641:55:641:55 | x | 2147483647 |
+| test.c:642:10:642:10 | y | 2147483647 |
+| test.c:647:20:647:20 | x | 4294967295 |
+| test.c:647:30:647:30 | x | 99 |
+| test.c:650:3:650:4 | y1 | 4294967295 |
+| test.c:650:11:650:11 | y | 100 |
+| test.c:650:14:650:14 | y | 101 |
+| test.c:651:3:651:4 | y2 | 4294967295 |
+| test.c:651:9:651:9 | y | 101 |
+| test.c:651:14:651:14 | y | 102 |
+| test.c:651:22:651:22 | y | 105 |
+| test.c:652:10:652:11 | y1 | 101 |
+| test.c:652:15:652:16 | y2 | 105 |
+| test.c:660:3:660:3 | i | 2147483647 |
+| test.c:661:7:661:7 | i | 10 |
+| test.c:663:3:663:3 | i | 2147483647 |
+| test.c:664:3:664:3 | i | 10 |
+| test.c:665:7:665:7 | i | 20 |
+| test.c:667:3:667:3 | i | 2147483647 |
+| test.c:668:3:668:3 | i | 40 |
+| test.c:669:7:669:7 | i | 30 |
+| test.c:671:3:671:3 | i | 2147483647 |
+| test.c:671:7:671:7 | j | 2147483647 |
+| test.c:672:7:672:7 | i | 40 |
+| test.c:674:3:674:3 | i | 2147483647 |
+| test.c:674:8:674:8 | j | 40 |
+| test.c:675:7:675:7 | i | 50 |
+| test.c:677:3:677:3 | i | 2147483647 |
+| test.c:677:13:677:13 | j | 50 |
+| test.c:678:7:678:7 | i | 60 |
+| test.c:685:12:685:12 | a | 4294967295 |
+| test.c:685:17:685:17 | a | 4294967295 |
+| test.c:685:33:685:33 | b | 4294967295 |
+| test.c:685:38:685:38 | b | 4294967295 |
+| test.c:686:13:686:13 | a | 11 |
+| test.c:686:15:686:15 | b | 23 |
+| test.c:687:5:687:9 | total | 0 |
+| test.c:687:14:687:14 | r | 253 |
+| test.c:689:12:689:12 | a | 4294967295 |
+| test.c:689:17:689:17 | a | 4294967295 |
+| test.c:689:33:689:33 | b | 4294967295 |
+| test.c:689:38:689:38 | b | 4294967295 |
+| test.c:690:13:690:13 | a | 11 |
+| test.c:690:15:690:15 | b | 23 |
+| test.c:691:5:691:9 | total | 253 |
+| test.c:691:14:691:14 | r | 253 |
+| test.c:693:12:693:12 | a | 4294967295 |
+| test.c:693:17:693:17 | a | 4294967295 |
+| test.c:693:34:693:34 | b | 4294967295 |
+| test.c:693:39:693:39 | b | 4294967295 |
+| test.c:694:13:694:13 | a | 11 |
+| test.c:694:15:694:15 | b | 23 |
+| test.c:695:5:695:9 | total | 506 |
+| test.c:695:14:695:14 | r | 253 |
+| test.c:698:10:698:14 | total | 759 |
+| test.c:704:12:704:12 | b | 4294967295 |
+| test.c:704:17:704:17 | b | 4294967295 |
+| test.c:705:16:705:16 | b | 23 |
+| test.c:706:5:706:9 | total | 0 |
+| test.c:706:14:706:14 | r | 253 |
+| test.c:708:12:708:12 | b | 4294967295 |
+| test.c:708:17:708:17 | b | 4294967295 |
+| test.c:709:16:709:16 | b | 23 |
+| test.c:710:5:710:9 | total | 253 |
+| test.c:710:14:710:14 | r | 253 |
+| test.c:712:13:712:13 | b | 4294967295 |
+| test.c:712:18:712:18 | b | 4294967295 |
+| test.c:713:16:713:16 | b | 23 |
+| test.c:714:5:714:9 | total | 506 |
+| test.c:714:14:714:14 | r | 253 |
+| test.c:717:10:717:14 | total | 759 |
+| test.c:722:3:722:3 | x | 18446744073709551616 |
+| test.c:722:7:722:7 | y | 18446744073709551616 |
+| test.c:723:3:723:4 | xy | 18446744073709551616 |
+| test.c:723:8:723:8 | x | 1000000003 |
+| test.c:723:12:723:12 | y | 1000000003 |
+| test.c:724:10:724:11 | xy | 1000000006000000000 |
+| test.c:729:3:729:3 | x | 18446744073709551616 |
+| test.c:730:3:730:3 | y | 18446744073709551616 |
+| test.c:731:3:731:4 | xy | 18446744073709551616 |
+| test.c:731:8:731:8 | x | 274177 |
+| test.c:731:12:731:12 | y | 67280421310721 |
+| test.c:732:10:732:11 | xy | 18446744073709551616 |
+| test.c:736:7:736:8 | ui | 4294967295 |
+| test.c:737:43:737:44 | ui | 4294967295 |
+| test.c:737:48:737:49 | ui | 4294967295 |
+| test.c:738:12:738:17 | result | 18446744065119617024 |
+| test.c:740:7:740:8 | ul | 18446744073709551616 |
+| test.c:741:28:741:29 | ul | 18446744073709551616 |
+| test.c:741:33:741:34 | ul | 18446744073709551616 |
+| test.c:742:12:742:17 | result | 18446744073709551616 |
+| test.c:748:7:748:8 | ui | 4294967295 |
+| test.c:748:19:748:20 | ui | 10 |
+| test.c:749:5:749:6 | ui | 10 |
+| test.c:749:11:749:12 | ui | 10 |
+| test.c:750:12:750:13 | ui | 100 |
+| test.c:754:3:754:9 | uiconst | 10 |
+| test.c:757:3:757:9 | ulconst | 10 |
+| test.c:758:10:758:16 | uiconst | 40 |
+| test.c:758:20:758:26 | ulconst | 40 |
+| test.c:762:7:762:7 | i | 2147483647 |
+| test.c:762:18:762:18 | i | 2147483647 |
+| test.c:763:5:763:5 | i | 2147483647 |
+| test.c:763:13:763:13 | i | 2 |
+| test.c:764:9:764:9 | i | 10 |
+| test.c:766:5:766:5 | i | 2147483647 |
+| test.c:766:9:766:9 | i | 10 |
+| test.c:767:9:767:9 | i | 15 |
+| test.c:769:5:769:5 | i | 15 |
+| test.c:770:9:770:9 | i | 105 |
+| test.c:772:5:772:5 | i | 105 |
+| test.c:773:9:773:9 | i | 2310 |
+| test.c:775:7:775:7 | i | 2147483647 |
+| test.c:776:5:776:5 | i | 2147483647 |
+| test.c:776:9:776:9 | i | -1 |
+| test.c:777:9:777:9 | i | 1 |
+| test.c:779:3:779:3 | i | 2147483647 |
+| test.c:779:7:779:7 | i | 2147483647 |
+| test.c:780:10:780:10 | i | 2147483647 |
+| test.c:783:3:783:3 | i | 2147483647 |
+| test.c:783:10:783:11 | sc | 1 |
+| test.c:785:7:785:7 | i | 127 |
+| test.c:792:7:792:7 | n | 4294967295 |
+| test.c:794:7:794:7 | n | 4294967295 |
+| test.c:795:9:795:9 | n | 4294967295 |
+| test.c:798:7:798:7 | n | 4294967295 |
+| test.c:799:9:799:9 | n | 4294967295 |
+| test.c:801:9:801:9 | n | 0 |
+| test.c:804:8:804:8 | n | 4294967295 |
+| test.c:805:9:805:9 | n | 0 |
+| test.c:807:9:807:9 | n | 4294967295 |
+| test.c:810:10:810:10 | n | 4294967295 |
+| test.c:811:5:811:5 | n | 4294967295 |
+| test.c:814:7:814:7 | n | 0 |
+| test.c:818:7:818:7 | n | 32767 |
+| test.c:821:7:821:7 | n | 32767 |
+| test.c:822:9:822:9 | n | 0 |
+| test.c:824:9:824:9 | n | 32767 |
+| test.c:827:7:827:7 | n | 32767 |
+| test.c:828:9:828:9 | n | 32767 |
+| test.c:830:9:830:9 | n | 0 |
+| test.c:833:10:833:10 | n | 32767 |
+| test.c:834:5:834:5 | n | 32767 |
+| test.c:837:7:837:7 | n | 0 |
+| test.c:841:7:841:7 | n | 32767 |
+| test.c:842:9:842:9 | n | 32767 |
+| test.c:843:11:843:11 | n | 32767 |
+| test.c:847:7:847:7 | n | 32767 |
+| test.c:848:13:848:13 | n | 32767 |
+| test.c:851:9:851:9 | n | 32767 |
+| test.c:854:7:854:7 | n | 32767 |
+| test.c:854:22:854:22 | n | 32767 |
+| test.c:855:9:855:9 | n | 32767 |
+| test.c:858:7:858:7 | n | 32767 |
+| test.c:859:5:859:5 | n | 32767 |
+| test.c:859:10:859:10 | n | 32767 |
+| test.c:859:14:859:14 | n | 0 |
+| test.c:860:6:860:6 | n | 32767 |
+| test.c:860:10:860:10 | n | 0 |
+| test.c:860:14:860:14 | n | 32767 |
+| test.c:871:7:871:8 | ss | 32767 |
+| test.c:872:9:872:10 | ss | 3 |
+| test.c:875:7:875:8 | ss | 32767 |
+| test.c:876:9:876:10 | ss | 32767 |
+| test.c:879:14:879:15 | us | 65535 |
+| test.c:880:9:880:10 | us | 32767 |
+| test.c:883:14:883:15 | us | 65535 |
+| test.c:884:9:884:10 | us | 65535 |
+| test.c:887:7:887:8 | ss | 32767 |
+| test.c:888:9:888:10 | ss | 32767 |
+| test.c:891:7:891:8 | ss | 32767 |
+| test.c:892:9:892:10 | ss | 2 |
+| test.c:898:8:898:8 | s | 2147483647 |
+| test.c:898:15:898:15 | s | 127 |
+| test.c:898:23:898:23 | s | 9 |
+| test.c:899:18:899:18 | s | 9 |
+| test.c:899:22:899:22 | s | 9 |
+| test.c:900:9:900:14 | result | 127 |
+| test.c:906:7:906:7 | i | 0 |
+| test.c:907:9:907:9 | i | 2147483647 |
+| test.c:911:7:911:7 | u | 0 |
+| test.c:912:9:912:9 | u | 4294967295 |
+| test.c:917:12:917:12 | s | 2147483647 |
+| test.c:918:7:918:8 | s2 | 4 |
+| test.c:923:7:923:7 | x | 2147483647 |
+| test.c:924:9:924:9 | y | 2147483647 |
+| test.c:928:7:928:7 | y | 2147483647 |
+| test.c:937:7:937:7 | x | 2147483647 |
+| test.c:942:7:942:7 | x | 15 |
+| test.c:949:8:949:8 | x | 2147483647 |
+| test.c:949:12:949:12 | y | 256 |
+| test.c:950:9:950:9 | x | 2147483647 |
+| test.c:951:9:951:9 | y | 256 |
 | test.cpp:10:7:10:7 | b | 2147483647 |
 | test.cpp:11:5:11:5 | x | 2147483647 |
 | test.cpp:13:10:13:10 | x | 2147483647 |

csharp/codeql-extractor.yml

@@ -4,6 +4,7 @@ aliases:
 display_name: "C#"
 version: 1.22.1
 column_kind: "utf16"
+overlay_support_version: 20250626
 extra_env_vars:
   DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
 build_modes:

csharp/downgrades/605f85053409cd72b4904df3f198ddc8324f3a83/upgrade.properties

@@ -0,0 +1,4 @@
+description: Delete databaseMetadata and overlayChangedFiles relations
+compatibility: full
+databaseMetadata.rel: delete
+overlayChangedFiles.rel: delete

csharp/downgrades/68b5aec54e50fe7e375df3777b756a746ca3a37c/upgrade.properties

@@ -0,0 +1,2 @@
+description: Remove @locatable type
+compatibility: full

csharp/extractor/Semmle.Extraction.CSharp.Standalone/Extractor.cs

@@ -2,6 +2,7 @@ using System;
 using System.Collections.Concurrent;
 using System.Collections.Generic;
 using System.Diagnostics;
+using System.IO;
 using System.Linq;
 using Microsoft.CodeAnalysis;
 using Microsoft.CodeAnalysis.CSharp;
@@ -53,6 +54,20 @@ namespace Semmle.Extraction.CSharp.Standalone
                         }
 
                         progressMonitor.MissingSummary(analyser.ExtractionContext!.MissingTypes.Count(), analyser.ExtractionContext!.MissingNamespaces.Count());
+
+                        // If extracting a base database, we need to create an empty metadata file.
+                        if (EnvironmentVariables.GetBaseMetaDataOutPath() is string baseMetaDataOutPath)
+                        {
+                            try
+                            {
+                                analyser.Logger.LogInfo($"Creating base metadata file at {baseMetaDataOutPath}");
+                                File.WriteAllText(baseMetaDataOutPath, string.Empty);
+                            }
+                            catch (Exception ex)
+                            {
+                                analyser.Logger.LogError($"Failed to create base metadata file: {ex.Message}");
+                            }
+                        }
                     });
             }
             finally
@@ -143,7 +158,8 @@ namespace Semmle.Extraction.CSharp.Standalone
             var pathTransformer = new PathTransformer(canonicalPathCache);
 
             var progressMonitor = new ExtractionProgress(logger);
-            using var analyser = new StandaloneAnalyser(progressMonitor, fileLogger, pathTransformer, canonicalPathCache, false);
+            var overlayInfo = OverlayInfoFactory.Make(logger, options.SrcDir);
+            using var analyser = new StandaloneAnalyser(progressMonitor, fileLogger, pathTransformer, canonicalPathCache, overlayInfo, false);
             try
             {
                 var extractionInput = new ExtractionInput(dependencyManager.AllSourceFiles, dependencyManager.ReferenceFiles, dependencyManager.CompilationInfos);
@@ -154,7 +170,8 @@ namespace Semmle.Extraction.CSharp.Standalone
                 fileLogger.LogError($"  Unhandled exception: {ex}");
             }
 
-            logger.Log(Severity.Info, $"Extraction completed in {overallStopwatch.Elapsed}");
+            logger.Log(Severity.Info, $"Extraction completed in {analyzerStopwatch.Elapsed}");
+            logger.Log(Severity.Info, $"Total time: {overallStopwatch.Elapsed}");
 
             return ExitCode.Ok;
         }

csharp/extractor/Semmle.Extraction.CSharp/Entities/Attribute.cs

@@ -57,8 +57,21 @@ namespace Semmle.Extraction.CSharp.Entities
 
         public override void Populate(TextWriter trapFile)
         {
+            // In this case, we don't extract the attribute again, as it was extracted using * ID
+            // originally and we re-use that.
+            if (Context.OnlyScaffold && (ReportingLocation is null || !ReportingLocation.IsInSource))
+            {
+                return;
+            }
+
             var type = Type.Create(Context, Symbol.AttributeClass);
             trapFile.attributes(this, kind, type.TypeRef, entity);
+
+            if (Context.OnlyScaffold)
+            {
+                return;
+            }
+
             WriteLocationToTrap(trapFile.attribute_location, this, Location);
 
             if (attributeSyntax is not null)

csharp/extractor/Semmle.Extraction.CSharp/Entities/CommentBlock.cs

@@ -10,9 +10,13 @@ namespace Semmle.Extraction.CSharp.Entities
 
         public override void Populate(TextWriter trapFile)
         {
+            if (Context.OnlyScaffold)
+            {
+                return;
+            }
             trapFile.commentblock(this);
-            WriteLocationToTrap(trapFile.commentblock_location, this, Context.CreateLocation(Symbol.Location));
             Symbol.CommentLines.ForEach((l, child) => trapFile.commentblock_child(this, l, child));
+            WriteLocationToTrap(trapFile.commentblock_location, this, Context.CreateLocation(Symbol.Location));
         }
 
         public override bool NeedsPopulation => true;
@@ -27,6 +31,10 @@ namespace Semmle.Extraction.CSharp.Entities
 
         public void BindTo(Label entity, CommentBinding binding)
         {
+            if (Context.OnlyScaffold)
+            {
+                return;
+            }
             Context.TrapWriter.Writer.commentblock_binding(this, entity, binding);
         }
 

csharp/extractor/Semmle.Extraction.CSharp/Entities/CommentLine.cs

@@ -21,9 +21,14 @@ namespace Semmle.Extraction.CSharp.Entities
 
         public override void Populate(TextWriter trapFile)
         {
-            location = Context.CreateLocation(Location);
+            if (Context.OnlyScaffold)
+            {
+                return;
+            }
             trapFile.commentline(this, Type == CommentLineType.MultilineContinuation ? CommentLineType.Multiline : Type, Text, RawText);
+            location = Context.CreateLocation(Location);
             WriteLocationToTrap(trapFile.commentline_location, this, location);
+
         }
 
         public override Microsoft.CodeAnalysis.Location? ReportingLocation => location?.Symbol;

csharp/extractor/Semmle.Extraction.CSharp/Entities/Compilations/CompilerDiagnostic.cs

@@ -21,6 +21,11 @@ namespace Semmle.Extraction.CSharp.Entities
 
         protected override void Populate(TextWriter trapFile)
         {
+            if (Context.OnlyScaffold)
+            {
+                return;
+            }
+
             var key = diagnostic.Id;
             var messageCount = compilation.messageCounts.AddOrUpdate(key, 1, (_, c) => c + 1);
             if (messageCount > limit)

csharp/extractor/Semmle.Extraction.CSharp/Entities/Constructor.cs

@@ -29,9 +29,17 @@ namespace Semmle.Extraction.CSharp.Entities
             ContainingType!.PopulateGenerics();
 
             trapFile.constructors(this, Symbol.ContainingType.Name, ContainingType, (Constructor)OriginalDefinition);
-            if (Context.ExtractLocation(Symbol) && (!IsDefault || IsBestSourceLocation))
+
+            if (Symbol.IsImplicitlyDeclared)
             {
-                WriteLocationToTrap(trapFile.constructor_location, this, Location);
+                var lineCounts = new LineCounts() { Total = 2, Code = 1, Comment = 0 };
+                trapFile.numlines(this, lineCounts);
+            }
+            ExtractCompilerGenerated(trapFile);
+
+            if (Context.OnlyScaffold)
+            {
+                return;
             }
 
             if (MakeSynthetic)
@@ -40,12 +48,11 @@ namespace Semmle.Extraction.CSharp.Entities
                 Statements.SyntheticEmptyBlock.Create(Context, this, 0, Location);
             }
 
-            if (Symbol.IsImplicitlyDeclared)
+            if (Context.ExtractLocation(Symbol) && (!IsDefault || IsBestSourceLocation))
             {
-                var lineCounts = new LineCounts() { Total = 2, Code = 1, Comment = 0 };
-                trapFile.numlines(this, lineCounts);
+                WriteLocationToTrap(trapFile.constructor_location, this, Location);
             }
-            ExtractCompilerGenerated(trapFile);
+
         }
 
         protected override void ExtractInitializers(TextWriter trapFile)
@@ -53,7 +60,7 @@ namespace Semmle.Extraction.CSharp.Entities
             // Do not extract initializers for constructed types.
             // Extract initializers for constructors with a body, primary constructors
             // and default constructors for classes and structs declared in source code.
-            if (Block is null && ExpressionBody is null && !MakeSynthetic)
+            if (Block is null && ExpressionBody is null && !MakeSynthetic || Context.OnlyScaffold)
             {
                 return;
             }
@@ -106,6 +113,7 @@ namespace Semmle.Extraction.CSharp.Entities
                 }
 
                 var baseConstructorTarget = Create(Context, baseConstructor);
+
                 var info = new ExpressionInfo(Context,
                     AnnotatedTypeSymbol.CreateNotAnnotated(baseType),
                     Location,
@@ -179,7 +187,7 @@ namespace Semmle.Extraction.CSharp.Entities
         /// </summary>
         private bool IsBestSourceLocation => ReportingLocation is not null && Context.IsLocationInContext(ReportingLocation);
 
-        private bool MakeSynthetic => IsPrimary || (IsDefault && IsBestSourceLocation);
+        private bool MakeSynthetic => (IsPrimary || (IsDefault && IsBestSourceLocation)) && !Context.OnlyScaffold;
 
         [return: NotNullIfNotNull(nameof(constructor))]
         public static new Constructor? Create(Context cx, IMethodSymbol? constructor)

csharp/extractor/Semmle.Extraction.CSharp/Entities/Destructor.cs

@@ -15,6 +15,7 @@ namespace Semmle.Extraction.CSharp.Entities
             ContainingType!.PopulateGenerics();
 
             trapFile.destructors(this, $"~{Symbol.ContainingType.Name}", ContainingType, OriginalDefinition(Context, this, Symbol));
+
             if (Context.ExtractLocation(Symbol))
             {
                 WriteLocationToTrap(trapFile.destructor_location, this, Location);

csharp/extractor/Semmle.Extraction.CSharp/Entities/Event.cs

@@ -37,7 +37,6 @@ namespace Semmle.Extraction.CSharp.Entities
                 Method.Create(Context, remover);
 
             PopulateModifiers(trapFile);
-            BindComments();
 
             var declSyntaxReferences = IsSourceDeclaration
                 ? Symbol.DeclaringSyntaxReferences.Select(d => d.GetSyntax()).ToArray()
@@ -51,6 +50,13 @@ namespace Semmle.Extraction.CSharp.Entities
                     TypeMention.Create(Context, syntax.ExplicitInterfaceSpecifier!.Name, this, explicitInterface);
             }
 
+            if (Context.OnlyScaffold)
+            {
+                return;
+            }
+
+            BindComments();
+
             if (Context.ExtractLocation(Symbol))
             {
                 WriteLocationsToTrap(trapFile.event_location, this, Locations);

csharp/extractor/Semmle.Extraction.CSharp/Entities/ExtractionMessage.cs

@@ -28,6 +28,11 @@ namespace Semmle.Extraction.CSharp.Entities
 
         protected override void Populate(TextWriter trapFile)
         {
+            if (Context.OnlyScaffold)
+            {
+                return;
+            }
+
             // For the time being we're counting the number of messages per severity, we could introduce other groupings in the future
             var key = msg.Severity.ToString();
             groupedMessageCounts.AddOrUpdate(key, 1, (_, c) => c + 1);

csharp/extractor/Semmle.Extraction.CSharp/Entities/Field.cs

@@ -49,6 +49,11 @@ namespace Semmle.Extraction.CSharp.Entities
                 }
             }
 
+            if (Context.OnlyScaffold)
+            {
+                return;
+            }
+
             if (Context.ExtractLocation(Symbol))
             {
                 WriteLocationsToTrap(trapFile.field_location, this, Locations);

csharp/extractor/Semmle.Extraction.CSharp/Entities/Indexer.cs

@@ -19,10 +19,6 @@ namespace Semmle.Extraction.CSharp.Entities
 
             var type = Type.Create(Context, Symbol.Type);
             trapFile.indexers(this, Symbol.GetName(useMetadataName: true), ContainingType!, type.TypeRef, OriginalDefinition);
-            if (Context.ExtractLocation(Symbol))
-            {
-                WriteLocationsToTrap(trapFile.indexer_location, this, Locations);
-            }
 
             var getter = BodyDeclaringSymbol.GetMethod;
             var setter = BodyDeclaringSymbol.SetMethod;
@@ -42,20 +38,8 @@ namespace Semmle.Extraction.CSharp.Entities
                 Parameter.Create(Context, Symbol.Parameters[i], this, original);
             }
 
-            if (IsSourceDeclaration)
-            {
-                var expressionBody = ExpressionBody;
-                if (expressionBody is not null)
-                {
-                    // The expression may need to reference parameters in the getter.
-                    // So we need to arrange that the expression is populated after the getter.
-                    Context.PopulateLater(() => Expression.CreateFromNode(new ExpressionNodeInfo(Context, expressionBody, this, 0).SetType(Symbol.GetAnnotatedType())));
-                }
-            }
-
             PopulateAttributes();
             PopulateModifiers(trapFile);
-            BindComments();
 
             var declSyntaxReferences = IsSourceDeclaration
                 ? Symbol.DeclaringSyntaxReferences.
@@ -70,6 +54,28 @@ namespace Semmle.Extraction.CSharp.Entities
                     TypeMention.Create(Context, syntax.ExplicitInterfaceSpecifier!.Name, this, explicitInterface);
             }
 
+            if (Context.OnlyScaffold)
+            {
+                return;
+            }
+
+            if (Context.ExtractLocation(Symbol))
+            {
+                WriteLocationsToTrap(trapFile.indexer_location, this, Locations);
+            }
+
+            if (IsSourceDeclaration)
+            {
+                var expressionBody = ExpressionBody;
+                if (expressionBody is not null)
+                {
+                    // The expression may need to reference parameters in the getter.
+                    // So we need to arrange that the expression is populated after the getter.
+                    Context.PopulateLater(() => Expression.CreateFromNode(new ExpressionNodeInfo(Context, expressionBody, this, 0).SetType(Symbol.GetAnnotatedType())));
+                }
+            }
+
+            BindComments();
 
             foreach (var syntax in declSyntaxReferences)
                 TypeMention.Create(Context, syntax.Type, this, type);

csharp/extractor/Semmle.Extraction.CSharp/Entities/LocalVariable.cs

@@ -41,6 +41,11 @@ namespace Semmle.Extraction.CSharp.Entities
                 trapFile.localvars(this, Kinds.VariableKind.None, Symbol.Name, @var, Type.Create(Context, parent.Type).TypeRef, parent);
             }
 
+            if (Context.OnlyScaffold)
+            {
+                return;
+            }
+
             WriteLocationToTrap(trapFile.localvar_location, this, Location);
 
             DefineConstantValue(trapFile);

csharp/extractor/Semmle.Extraction.CSharp/Entities/Method.cs

@@ -48,7 +48,7 @@ namespace Semmle.Extraction.CSharp.Entities
 
         protected virtual void PopulateMethodBody(TextWriter trapFile)
         {
-            if (!IsSourceDeclaration)
+            if (!IsSourceDeclaration || Context.OnlyScaffold)
                 return;
 
             var block = Block;

csharp/extractor/Semmle.Extraction.CSharp/Entities/NamespaceDeclaration.cs

@@ -35,7 +35,6 @@ namespace Semmle.Extraction.CSharp.Entities
 
             var ns = Namespace.Create(Context, @namespace);
             trapFile.namespace_declarations(this, ns);
-            WriteLocationToTrap(trapFile.namespace_declaration_location, this, Context.CreateLocation(node.Name.GetLocation()));
 
             var visitor = new Populators.TypeOrNamespaceVisitor(Context, trapFile, this);
 
@@ -48,6 +47,12 @@ namespace Semmle.Extraction.CSharp.Entities
             {
                 trapFile.parent_namespace_declaration(this, parent);
             }
+
+            if (Context.OnlyScaffold)
+            {
+                return;
+            }
+            WriteLocationToTrap(trapFile.namespace_declaration_location, this, Context.CreateLocation(node.Name.GetLocation()));
         }
 
         public static NamespaceDeclaration Create(Context cx, BaseNamespaceDeclarationSyntax decl, NamespaceDeclaration parent)

csharp/extractor/Semmle.Extraction.CSharp/Entities/OrdinaryMethod.cs

@@ -34,6 +34,16 @@ namespace Semmle.Extraction.CSharp.Entities
             var returnType = Type.Create(Context, Symbol.ReturnType);
             trapFile.methods(this, Name, ContainingType, returnType.TypeRef, OriginalDefinition);
 
+            PopulateGenerics(trapFile);
+            Overrides(trapFile);
+            ExtractRefReturn(trapFile, Symbol, this);
+            ExtractCompilerGenerated(trapFile);
+
+            if (Context.OnlyScaffold)
+            {
+                return;
+            }
+
             if (IsSourceDeclaration)
             {
                 foreach (var declaration in Symbol.DeclaringSyntaxReferences.Select(s => s.GetSyntax()).OfType<MethodDeclarationSyntax>())
@@ -47,11 +57,6 @@ namespace Semmle.Extraction.CSharp.Entities
             {
                 WriteLocationsToTrap(trapFile.method_location, this, Locations);
             }
-
-            PopulateGenerics(trapFile);
-            Overrides(trapFile);
-            ExtractRefReturn(trapFile, Symbol, this);
-            ExtractCompilerGenerated(trapFile);
         }
 
         private bool IsCompilerGeneratedDelegate() =>

csharp/extractor/Semmle.Extraction.CSharp/Entities/Parameter.cs

@@ -115,6 +115,11 @@ namespace Semmle.Extraction.CSharp.Entities
             var type = Type.Create(Context, Symbol.Type);
             trapFile.@params(this, Name, type.TypeRef, Ordinal, ParamKind, Parent!, Original);
 
+            if (Context.OnlyScaffold)
+            {
+                return;
+            }
+
             if (Context.ExtractLocation(Symbol))
             {
                 var locations = Context.GetLocations(Symbol);

csharp/extractor/Semmle.Extraction.CSharp/Entities/PreprocessorDirectives/PreprocessorDirective.cs

@@ -13,10 +13,15 @@ namespace Semmle.Extraction.CSharp.Entities
             PopulatePreprocessor(trapFile);
 
             trapFile.preprocessor_directive_active(this, Symbol.IsActive);
-            WriteLocationToTrap(trapFile.preprocessor_directive_location, this, Context.CreateLocation(ReportingLocation));
 
             var compilation = Compilation.Create(Context);
             trapFile.preprocessor_directive_compilation(this, compilation);
+
+            if (Context.OnlyScaffold)
+            {
+                return;
+            }
+            WriteLocationToTrap(trapFile.preprocessor_directive_location, this, Context.CreateLocation(ReportingLocation));
         }
 
         protected abstract void PopulatePreprocessor(TextWriter trapFile);

csharp/extractor/Semmle.Extraction.CSharp/Entities/Property.cs

@@ -40,7 +40,6 @@ namespace Semmle.Extraction.CSharp.Entities
         {
             PopulateAttributes();
             PopulateModifiers(trapFile);
-            BindComments();
             PopulateNullability(trapFile, Symbol.GetAnnotatedType());
             PopulateRefKind(trapFile, Symbol.RefKind);
 
@@ -69,6 +68,13 @@ namespace Semmle.Extraction.CSharp.Entities
                     TypeMention.Create(Context, syntax.ExplicitInterfaceSpecifier!.Name, this, explicitInterface);
             }
 
+            if (Context.OnlyScaffold)
+            {
+                return;
+            }
+
+            BindComments();
+
             if (Context.ExtractLocation(Symbol))
             {
                 WriteLocationsToTrap(trapFile.property_location, this, Locations);

csharp/extractor/Semmle.Extraction.CSharp/Entities/TypeMention.cs

@@ -59,6 +59,11 @@ namespace Semmle.Extraction.CSharp.Entities
 
         protected override void Populate(TextWriter trapFile)
         {
+            if (Context.OnlyScaffold)
+            {
+                return;
+            }
+
             switch (syntax.Kind())
             {
                 case SyntaxKind.ArrayType:

csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/DynamicType.cs

@@ -16,10 +16,14 @@ namespace Semmle.Extraction.CSharp.Entities
         public override void Populate(TextWriter trapFile)
         {
             trapFile.types(this, Kinds.TypeKind.DYNAMIC, "dynamic");
-            WriteLocationToTrap(trapFile.type_location, this, Location);
 
             trapFile.has_modifiers(this, Modifier.Create(Context, "public"));
             trapFile.parent_namespace(this, Namespace.Create(Context, Context.Compilation.GlobalNamespace));
+            if (Context.OnlyScaffold)
+            {
+                return;
+            }
+            WriteLocationToTrap(trapFile.type_location, this, Location);
         }
 
         public override void WriteId(EscapingTextWriter trapFile)

csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/NamedType.cs

@@ -81,7 +81,7 @@ namespace Semmle.Extraction.CSharp.Entities
             }
 
             // Class location
-            if (!Symbol.IsGenericType || Symbol.IsReallyUnbound())
+            if ((!Symbol.IsGenericType || Symbol.IsReallyUnbound()) && !Context.OnlyScaffold)
             {
                 WriteLocationsToTrap(trapFile.type_location, this, Locations);
             }

csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/TupleType.cs

@@ -51,6 +51,10 @@ namespace Semmle.Extraction.CSharp.Entities
                     trapFile.tuple_element(this, index++, element);
             }
 
+            if (Context.OnlyScaffold)
+            {
+                return;
+            }
             // Note: symbol.Locations seems to be very inconsistent
             // about what locations are available for a tuple type.
             // Sometimes it's the source code, and sometimes it's empty.

csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/Type.cs

@@ -222,7 +222,7 @@ namespace Semmle.Extraction.CSharp.Entities
 
         private IEnumerable<BaseTypeSyntax> GetBaseTypeDeclarations()
         {
-            if (!IsSourceDeclaration || !Symbol.FromSource())
+            if (!IsSourceDeclaration || !Symbol.FromSource() || Context.OnlyScaffold)
             {
                 return Enumerable.Empty<BaseTypeSyntax>();
             }

csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/TypeParameter.cs

@@ -26,6 +26,11 @@ namespace Semmle.Extraction.CSharp.Entities
             var parentNs = Namespace.Create(Context, Symbol.TypeParameterKind == TypeParameterKind.Method ? Context.Compilation.GlobalNamespace : Symbol.ContainingNamespace);
             trapFile.parent_namespace(this, parentNs);
 
+            if (Context.OnlyScaffold)
+            {
+                return;
+            }
+
             if (Context.ExtractLocation(Symbol))
             {
                 var locations = Context.GetLocations(Symbol);

csharp/extractor/Semmle.Extraction.CSharp/Entities/UserOperator.cs

@@ -26,6 +26,14 @@ namespace Semmle.Extraction.CSharp.Entities
                 returnType.TypeRef,
                 (UserOperator)OriginalDefinition);
 
+            ContainingType.PopulateGenerics();
+            Overrides(trapFile);
+
+            if (Context.OnlyScaffold)
+            {
+                return;
+            }
+
             if (Context.ExtractLocation(Symbol))
             {
                 WriteLocationsToTrap(trapFile.operator_location, this, Locations);
@@ -39,9 +47,6 @@ namespace Semmle.Extraction.CSharp.Entities
                 foreach (var declaration in declSyntaxReferences.OfType<ConversionOperatorDeclarationSyntax>())
                     TypeMention.Create(Context, declaration.Type, this, returnType);
             }
-
-            ContainingType.PopulateGenerics();
-            Overrides(trapFile);
         }
 
         public override bool NeedsPopulation => Context.Defines(Symbol) || IsImplicitOperator(out _);

csharp/extractor/Semmle.Extraction.CSharp/Entities/UsingDirective.cs

@@ -20,6 +20,11 @@ namespace Semmle.Extraction.CSharp.Entities
 
         protected override void Populate(TextWriter trapFile)
         {
+            if (Context.OnlyScaffold)
+            {
+                return;
+            }
+
             // This is guaranteed to be non-null as we only deal with "using namespace" not "using X = Y"
             var name = node.Name!;
 

csharp/extractor/Semmle.Extraction.CSharp/Extractor/Analyser.cs

@@ -41,16 +41,20 @@ namespace Semmle.Extraction.CSharp
 
         public IPathCache PathCache { get; }
 
+        public IOverlayInfo OverlayInfo { get; }
+
         protected Analyser(
             IProgressMonitor pm,
             ILogger logger,
             PathTransformer pathTransformer,
             IPathCache pathCache,
+            IOverlayInfo overlayInfo,
             bool addAssemblyTrapPrefix)
         {
             Logger = logger;
             PathTransformer = pathTransformer;
             PathCache = pathCache;
+            OverlayInfo = overlayInfo;
             this.addAssemblyTrapPrefix = addAssemblyTrapPrefix;
             this.progressMonitor = pm;
 
@@ -158,7 +162,7 @@ namespace Semmle.Extraction.CSharp
 
                     if (compilation.GetAssemblyOrModuleSymbol(r) is IAssemblySymbol assembly)
                     {
-                        var cx = new Context(ExtractionContext, compilation, trapWriter, new AssemblyScope(assembly, assemblyPath), addAssemblyTrapPrefix);
+                        var cx = new Context(ExtractionContext, compilation, trapWriter, new AssemblyScope(assembly, assemblyPath), OverlayInfo, addAssemblyTrapPrefix);
 
                         foreach (var module in assembly.Modules)
                         {
@@ -195,7 +199,7 @@ namespace Semmle.Extraction.CSharp
                 var currentTaskId = IncrementTaskCount();
                 ReportProgressTaskStarted(currentTaskId, sourcePath);
 
-                var cx = new Context(ExtractionContext, compilation, trapWriter, new SourceScope(tree), addAssemblyTrapPrefix);
+                var cx = new Context(ExtractionContext, compilation, trapWriter, new SourceScope(tree), OverlayInfo, addAssemblyTrapPrefix);
                 // Ensure that the file itself is populated in case the source file is totally empty
                 var root = tree.GetRoot();
                 Entities.File.Create(cx, root.SyntaxTree.FilePath);
@@ -234,7 +238,7 @@ namespace Semmle.Extraction.CSharp
                 var assembly = compilation.Assembly;
                 var trapWriter = transformedAssemblyPath.CreateTrapWriter(Logger, options.TrapCompression, discardDuplicates: false);
                 compilationTrapFile = trapWriter;  // Dispose later
-                var cx = new Context(ExtractionContext, compilation, trapWriter, new AssemblyScope(assembly, assemblyPath), addAssemblyTrapPrefix);
+                var cx = new Context(ExtractionContext, compilation, trapWriter, new AssemblyScope(assembly, assemblyPath), OverlayInfo, addAssemblyTrapPrefix);
 
                 compilationEntity = Entities.Compilation.Create(cx);
 

csharp/extractor/Semmle.Extraction.CSharp/Extractor/BinaryLogAnalyser.cs

@@ -8,7 +8,7 @@ namespace Semmle.Extraction.CSharp
     public class BinaryLogAnalyser : Analyser
     {
         public BinaryLogAnalyser(IProgressMonitor pm, ILogger logger, PathTransformer pathTransformer, IPathCache pathCache, bool addAssemblyTrapPrefix)
-            : base(pm, logger, pathTransformer, pathCache, addAssemblyTrapPrefix)
+            : base(pm, logger, pathTransformer, pathCache, new TrivialOverlayInfo(), addAssemblyTrapPrefix)
         {
         }
 

csharp/extractor/Semmle.Extraction.CSharp/Extractor/Context.cs

@@ -29,6 +29,12 @@ namespace Semmle.Extraction.CSharp
         /// </summary>
         public bool ShouldAddAssemblyTrapPrefix { get; }
 
+        /// <summary>
+        /// Holds if trap only should be created for types and member signatures (and not for expressions and statements).
+        /// This is the case for all unchanged files, when running in overlay mode.
+        /// </summary>
+        public bool OnlyScaffold { get; }
+
         public IList<object> TrapStackSuffix { get; } = new List<object>();
 
         private int GetNewId() => TrapWriter.IdCounter++;
@@ -523,13 +529,16 @@ namespace Semmle.Extraction.CSharp
 
         internal CommentProcessor CommentGenerator { get; } = new CommentProcessor();
 
-        public Context(ExtractionContext extractionContext, Compilation c, TrapWriter trapWriter, IExtractionScope scope, bool shouldAddAssemblyTrapPrefix = false)
+        public Context(ExtractionContext extractionContext, Compilation c, TrapWriter trapWriter, IExtractionScope scope, IOverlayInfo overlayInfo, bool shouldAddAssemblyTrapPrefix = false)
         {
             ExtractionContext = extractionContext;
             TrapWriter = trapWriter;
             ShouldAddAssemblyTrapPrefix = shouldAddAssemblyTrapPrefix;
             Compilation = c;
             this.scope = scope;
+            OnlyScaffold = overlayInfo.IsOverlayMode && (
+                IsAssemblyScope
+                || (scope is SourceScope ss && overlayInfo.OnlyMakeScaffold(ss.SourceTree.FilePath)));
         }
 
         public bool FromSource => scope is SourceScope;
@@ -552,7 +561,8 @@ namespace Semmle.Extraction.CSharp
 
         public bool ExtractLocation(ISymbol symbol) =>
             SymbolEqualityComparer.Default.Equals(symbol, symbol.OriginalDefinition) &&
-            scope.InScope(symbol);
+            scope.InScope(symbol) &&
+            !OnlyScaffold;
 
         /// <summary>
         /// Gets the locations of the symbol that are either
@@ -621,6 +631,10 @@ namespace Semmle.Extraction.CSharp
         /// <param name="l">Location of the entity.</param>
         public void BindComments(Entity entity, Microsoft.CodeAnalysis.Location? l)
         {
+            if (OnlyScaffold)
+            {
+                return;
+            }
             var duplicationGuardKey = GetCurrentTagStackKey();
             CommentGenerator.AddElement(entity.Label, duplicationGuardKey, l);
         }

csharp/extractor/Semmle.Extraction.CSharp/Extractor/Extractor.cs

@@ -182,7 +182,7 @@ namespace Semmle.Extraction.CSharp
                     var compilerCall = compilationData.CompilerCall;
                     var diagnosticName = compilerCall.GetDiagnosticName();
                     logger.LogInfo($"  Processing compilation {diagnosticName} at {compilerCall.ProjectDirectory}");
-                    var compilerArgs = compilerCall.GetArguments();
+                    var compilerArgs = reader.ReadArguments(compilerCall);
 
                     var compilationIdentifierPath = string.Empty;
                     try

csharp/extractor/Semmle.Extraction.CSharp/Extractor/OverlayInfo.cs

@@ -0,0 +1,124 @@
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text.Json;
+using Semmle.Util;
+using Semmle.Util.Logging;
+
+namespace Semmle.Extraction.CSharp
+{
+    public interface IOverlayInfo
+    {
+        /// <summary>
+        /// True, if the extractor is running in overlay mode.
+        /// </summary>
+        bool IsOverlayMode { get; }
+
+        /// <summary>
+        /// Returns true, if the given file is not in the set of changed files.
+        /// </summary>
+        /// <param name="filePath">A source file path</param>
+        bool OnlyMakeScaffold(string filePath);
+    }
+
+
+    /// <summary>
+    /// An instance of this class is used when overlay is not enabled.
+    /// </summary>
+    public class TrivialOverlayInfo : IOverlayInfo
+    {
+        public TrivialOverlayInfo() { }
+
+        public bool IsOverlayMode { get; } = false;
+
+        public bool OnlyMakeScaffold(string filePath) => false;
+    }
+
+    /// <summary>
+    /// An instance of this class is used for detecting
+    /// (1) Whether overlay is enabled.
+    /// (2) Fetch the changed files that should be fully extracted as a part
+    /// of the overlay extraction.
+    /// </summary>
+    public class OverlayInfo : IOverlayInfo
+    {
+        private readonly ILogger logger;
+        private readonly HashSet<string> changedFiles;
+        private readonly string srcDir;
+
+        public OverlayInfo(ILogger logger, string srcDir, string json)
+        {
+            this.logger = logger;
+            this.srcDir = srcDir;
+            changedFiles = ParseJson(json);
+        }
+
+        public bool IsOverlayMode { get; } = true;
+
+        public bool OnlyMakeScaffold(string filePath) => !changedFiles.Contains(filePath);
+
+        /// <summary>
+        /// Private type only used to parse overlay changes JSON files.
+        /// 
+        /// The content of such a file has the format
+        /// {
+        ///  "changes": [
+        ///    "app/controllers/about_controller.xyz",
+        ///    "app/models/about.xyz"
+        ///  ]
+        /// }
+        /// </summary>
+        private record ChangedFiles
+        {
+            public string[]? Changes { get; set; }
+        }
+
+        private HashSet<string> ParseJson(string json)
+        {
+            try
+            {
+                var options = new JsonSerializerOptions { PropertyNameCaseInsensitive = true };
+                var obj = JsonSerializer.Deserialize<ChangedFiles>(json, options);
+                return obj?.Changes is string[] changes
+                    ? changes.Select(change => Path.Join(srcDir, change)).ToHashSet()
+                    : [];
+            }
+            catch (JsonException)
+            {
+                logger.LogError("Overlay: Unable to parse the JSON content from the overlay changes file.");
+                return [];
+            }
+        }
+    }
+
+    public static class OverlayInfoFactory
+    {
+        /// <summary>
+        /// The returned object is used to decide, whether
+        /// (1) The extractor is running in overlay mode.
+        /// (2) Which files to only extract scaffolds for (unchanged files)
+        /// </summary>
+        /// <param name="logger">A logger</param>
+        /// <param name="srcDir">The (overlay) source directory</param>
+        /// <returns>An overlay information object.</returns>
+        public static IOverlayInfo Make(ILogger logger, string srcDir)
+        {
+            if (EnvironmentVariables.GetOverlayChangesFilePath() is string path)
+            {
+                logger.LogInfo($"Overlay: Reading overlay changes from file '{path}'.");
+                try
+                {
+                    var json = File.ReadAllText(path);
+                    return new OverlayInfo(logger, srcDir, json);
+                }
+                catch
+                {
+                    logger.LogError("Overlay: Unexpected error while reading the overlay changes file.");
+                }
+            }
+
+            logger.LogInfo("Overlay: Overlay mode not enabled.");
+            return new TrivialOverlayInfo();
+        }
+    }
+}

csharp/extractor/Semmle.Extraction.CSharp/Extractor/StandaloneAnalyser.cs

@@ -8,8 +8,8 @@ namespace Semmle.Extraction.CSharp
 {
     public class StandaloneAnalyser : Analyser
     {
-        public StandaloneAnalyser(IProgressMonitor pm, ILogger logger, PathTransformer pathTransformer, IPathCache pathCache, bool addAssemblyTrapPrefix)
-            : base(pm, logger, pathTransformer, pathCache, addAssemblyTrapPrefix)
+        public StandaloneAnalyser(IProgressMonitor pm, ILogger logger, PathTransformer pathTransformer, IPathCache pathCache, IOverlayInfo overlayInfo, bool addAssemblyTrapPrefix)
+            : base(pm, logger, pathTransformer, pathCache, overlayInfo, addAssemblyTrapPrefix)
         {
         }
 

csharp/extractor/Semmle.Extraction.CSharp/Extractor/TracingAnalyser.cs

@@ -14,7 +14,7 @@ namespace Semmle.Extraction.CSharp
         private bool init;
 
         public TracingAnalyser(IProgressMonitor pm, ILogger logger, PathTransformer pathTransformer, IPathCache pathCache, bool addAssemblyTrapPrefix)
-            : base(pm, logger, pathTransformer, pathCache, addAssemblyTrapPrefix)
+            : base(pm, logger, pathTransformer, pathCache, new TrivialOverlayInfo(), addAssemblyTrapPrefix)
         {
         }
 

csharp/extractor/Semmle.Extraction.CSharp/Populators/CommentPopulator.cs

@@ -12,6 +12,10 @@ namespace Semmle.Extraction.CSharp.Populators
     {
         public static void ExtractCommentBlocks(Context cx, CommentProcessor gen)
         {
+            if (cx.OnlyScaffold)
+            {
+                return;
+            }
             cx.Try(null, null, () =>
             {
                 gen.GenerateBindings((entity, duplicationGuardKey, block, binding) =>
@@ -34,6 +38,10 @@ namespace Semmle.Extraction.CSharp.Populators
 
         public static void ExtractComment(Context cx, SyntaxTrivia trivia)
         {
+            if (cx.OnlyScaffold)
+            {
+                return;
+            }
             switch (trivia.Kind())
             {
                 case SyntaxKind.SingleLineDocumentationCommentTrivia:

csharp/extractor/Semmle.Extraction.Tests/OverlayInfo.cs

@@ -0,0 +1,31 @@
+using Xunit;
+using Semmle.Extraction.CSharp;
+using System.IO;
+
+namespace Semmle.Extraction.Tests
+{
+    public class OverlayTests
+    {
+        [Fact]
+        public void TestOverlay()
+        {
+            var logger = new LoggerStub();
+            var json =
+                """
+                {
+                    "changes": [
+                        "app/controllers/about_controller.xyz",
+                        "app/models/about.xyz"
+                    ]
+                }
+                """;
+
+            var overlay = new OverlayInfo(logger, "overlay/source/path", json);
+
+            Assert.True(overlay.IsOverlayMode);
+            Assert.False(overlay.OnlyMakeScaffold("overlay/source/path" + Path.DirectorySeparatorChar + "app/controllers/about_controller.xyz"));
+            Assert.False(overlay.OnlyMakeScaffold("overlay/source/path" + Path.DirectorySeparatorChar + "app/models/about.xyz"));
+            Assert.True(overlay.OnlyMakeScaffold("overlay/source/path" + Path.DirectorySeparatorChar + "app/models/unchanged.xyz"));
+        }
+    }
+}

csharp/extractor/Semmle.Util/EnvironmentVariables.cs

@@ -53,5 +53,28 @@ namespace Semmle.Util
         {
             return Environment.GetEnvironmentVariable(name)?.Split(" ", StringSplitOptions.RemoveEmptyEntries) ?? [];
         }
+
+        /// <summary>
+        /// Used to
+        /// (1) Detect whether the extractor should run in overlay mode.
+        /// (2) Returns the path to the file containing a list of changed files
+        /// in JSON format.
+        ///
+        /// The environment variable is only set in case the extraction is supposed to be
+        /// performed in overlay mode. Furthermore, this only applies to buildless extraction.
+        /// </summary>
+        public static string? GetOverlayChangesFilePath()
+        {
+            return Environment.GetEnvironmentVariable("CODEQL_EXTRACTOR_CSHARP_OVERLAY_CHANGES");
+        }
+
+        /// <summary>
+        /// If the environment variable is set, the extractor is being called to extract a base database.
+        /// Its value will be a path, and the extractor must create either a file or directory at that location.
+        /// </summary>
+        public static string? GetBaseMetaDataOutPath()
+        {
+            return Environment.GetEnvironmentVariable("CODEQL_EXTRACTOR_CSHARP_OVERLAY_BASE_METADATA_OUT");
+        }
     }
 }

csharp/paket.dependencies

@@ -4,16 +4,16 @@ source https://api.nuget.org/v3/index.json
 # behave like nuget in choosing transitive dependency versions
 strategy: max
 
-nuget Basic.CompilerLog.Util 0.9.8
+nuget Basic.CompilerLog.Util 0.9.21
 nuget Mono.Posix.NETStandard
 nuget Newtonsoft.Json
 nuget xunit
 nuget xunit.runner.visualstudio
 nuget xunit.runner.utility
 nuget Microsoft.NET.Test.Sdk
-nuget Microsoft.CodeAnalysis.CSharp 4.12.0
-nuget Microsoft.CodeAnalysis 4.12.0
-nuget Microsoft.Build 17.12.6
+nuget Microsoft.CodeAnalysis.CSharp 4.14.0
+nuget Microsoft.CodeAnalysis 4.14.0
+nuget Microsoft.Build 17.14.28
 nuget Microsoft.Win32.Primitives
 nuget System.Net.Primitives
 nuget System.Security.Principal