Revert "JS: More robust hasUnderlyingType"

This reverts commit 3e5dc1efb7.

.codeqlmanifest.json

@@ -1,23 +1,7 @@
-{
-    "provide": [
-        "*/ql/src/qlpack.yml",
-        "*/ql/lib/qlpack.yml",
-        "*/ql/test/qlpack.yml",
-        "*/ql/examples/qlpack.yml",
-        "*/upgrades/qlpack.yml",
-        "cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/qlpack.yml",
-        "javascript/ql/experimental/adaptivethreatmodeling/lib/qlpack.yml",
-        "javascript/ql/experimental/adaptivethreatmodeling/src/qlpack.yml",
-        "misc/legacy-support/*/qlpack.yml",
-        "misc/suite-helpers/qlpack.yml",
-        "ruby/extractor-pack/codeql-extractor.yml",
-        "ruby/ql/consistency-queries/qlpack.yml"
-    ],
-    "versionPolicies": {
-      "default": {
-        "requireChangeNotes": true,
-        "committedPrereleaseSuffix": "dev",
-        "committedVersion": "nextPatchRelease"
-      }
-    }
-}
+{ "provide": [ "*/ql/src/qlpack.yml",
+               "*/ql/test/qlpack.yml",
+               "cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/qlpack.yml",
+               "*/ql/examples/qlpack.yml",
+               "*/upgrades/qlpack.yml",
+               "misc/legacy-support/*/qlpack.yml",
+               "misc/suite-helpers/qlpack.yml" ] }

.devcontainer/devcontainer.json

@@ -1,14 +1,9 @@
 {
   "extensions": [
-    "rust-lang.rust",
-    "bungcip.better-toml",
     "github.vscode-codeql",
     "slevesque.vscode-zipexplorer"
   ],
   "settings": {
-    "files.watcherExclude": {
-      "**/target/**": true
-    },
     "codeQL.runningQueries.memory": 2048
   }
 }

.gitattributes

@@ -48,6 +48,3 @@
 *.gif -text
 *.dll -text
 *.pdb -text
-
-java/ql/test/stubs/**/*.java linguist-generated=true
-java/ql/test/experimental/stubs/**/*.java linguist-generated=true

.github/actions/fetch-codeql/action.yml

@@ -1,14 +0,0 @@
-name: Fetch CodeQL
-description: Fetches the latest version of CodeQL
-runs:
-  using: composite
-  steps:
-    - name: Fetch CodeQL
-      shell: bash
-      run: |
-        LATEST=$(gh release list --repo https://github.com/github/codeql-cli-binaries | cut -f 1 | grep -v beta | sort --version-sort | tail -1)
-        gh release download --repo https://github.com/github/codeql-cli-binaries --pattern codeql-linux64.zip "$LATEST"
-        unzip -q -d "${RUNNER_TEMP}" codeql-linux64.zip
-        echo "${RUNNER_TEMP}/codeql" >> "${GITHUB_PATH}"
-      env:
-        GITHUB_TOKEN: ${{ github.token }}

.github/dependabot.yml

@@ -1,18 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: "cargo"
-    directory: "ruby/node-types"
-    schedule:
-      interval: "daily"
-  - package-ecosystem: "cargo"
-    directory: "ruby/generator"
-    schedule:
-      interval: "daily"
-  - package-ecosystem: "cargo"
-    directory: "ruby/extractor"
-    schedule:
-      interval: "daily"
-  - package-ecosystem: "cargo"
-    directory: "ruby/autobuilder"
-    schedule:
-      interval: "daily"

.github/labeler.yml

@@ -18,10 +18,6 @@ Python:
   - python/**/*
   - change-notes/**/*python*
 
-Ruby:
-  - ruby/**/*
-  - change-notes/**/*ruby*
-
 documentation:
   - "**/*.qhelp"
   - "**/*.md"

.github/workflows/codeql-analysis.yml

@@ -11,8 +11,6 @@ on:
       - 'rc/*'
     paths:
       - 'csharp/**'
-      - '.github/codeql/**'
-      - '.github/workflows/codeql-analysis.yml'
   schedule:
     - cron: '0 9 * * 1'
 
@@ -40,8 +38,8 @@ jobs:
 
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
-    #- name: Autobuild
-    #  uses: github/codeql-action/autobuild@main
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@main
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -50,8 +48,9 @@ jobs:
     #    and modify them (or add more) to build your code if your project
     #    uses a compiled language
 
-    - run: |
-       dotnet build csharp
+    #- run: |
+    #   make bootstrap
+    #   make release
 
     - name: Perform CodeQL Analysis
       uses: github/codeql-action/analyze@main

.github/workflows/csv-coverage-pr-artifacts.yml

@@ -6,8 +6,6 @@ on:
       - '.github/workflows/csv-coverage-pr-comment.yml'
       - '*/ql/src/**/*.ql'
       - '*/ql/src/**/*.qll'
-      - '*/ql/lib/**/*.ql'
-      - '*/ql/lib/**/*.qll'
       - 'misc/scripts/library-coverage/*.py'
       # input data files
       - '*/documentation/library-coverage/cwe-sink.csv'

.github/workflows/csv-coverage-update.yml

@@ -8,7 +8,7 @@ on:
 jobs:
   update:
     name: Update framework coverage report
-    if: github.repository == 'github/codeql'
+    if: github.event.repository.fork == false
     runs-on: ubuntu-latest
 
     steps:

.github/workflows/post-pr-comment.yml

@@ -1,31 +0,0 @@
-name: Post pull-request comment
-on:
-  workflow_run:
-    workflows: ["Query help preview"]
-    types:
-      - completed
-
-permissions:
-  pull-requests: write
-
-jobs:
-  post_comment:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Download artifact
-        run: gh run download "${WORKFLOW_RUN_ID}" --repo "${GITHUB_REPOSITORY}" --name "comment"
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-          WORKFLOW_RUN_ID: ${{ github.event.workflow_run.id }}
-      - run: |
-          PR="$(grep -o '^[0-9]\+$' pr.txt)"
-          PR_HEAD_SHA="$(gh api "/repos/${GITHUB_REPOSITORY}/pulls/${PR}" --jq .head.sha)"
-          # Check that the pull-request head SHA matches the head SHA of the workflow run
-          if [ "${WORKFLOW_RUN_HEAD_SHA}" != "${PR_HEAD_SHA}" ]; then
-            echo "PR head SHA ${PR_HEAD_SHA} does not match workflow_run event SHA ${WORKFLOW_RUN_HEAD_SHA}. Stopping." 1>&2
-            exit 1
-          fi
-          gh pr comment "${PR}" --repo "${GITHUB_REPOSITORY}" -F comment.txt
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-          WORKFLOW_RUN_HEAD_SHA: ${{ github.event.workflow_run.head_commit.id }}

.github/workflows/qhelp-pr-preview.yml

@@ -1,63 +0,0 @@
-name: Query help preview
-
-permissions:
-  contents: read
-
-on:
-  pull_request:
-    branches:
-      - main
-      - "rc/*"
-    paths:
-      - "ruby/**/*.qhelp"
-
-jobs:
-  qhelp:
-    runs-on: ubuntu-latest
-    steps:
-      - run: echo "${{  github.event.number }}" > pr.txt
-      - uses: actions/upload-artifact@v2
-        with:
-          name: comment
-          path: pr.txt
-          retention-days: 1
-      - uses: actions/checkout@v2
-        with:
-          fetch-depth: 2
-          persist-credentials: false
-      - uses: ./.github/actions/fetch-codeql
-      - name: Determine changed files
-        id: changes
-        run: |
-          (git diff -z --name-only --diff-filter=ACMRT HEAD~1 HEAD | grep -z '.qhelp$' | grep -z -v '.inc.qhelp';
-           git diff -z --name-only --diff-filter=ACMRT HEAD~1 HEAD | grep -z '.inc.qhelp$' | xargs --null -rn1 basename | xargs --null -rn1 git grep -z -l) |
-           grep -z '.qhelp$' | grep -z -v '^-' | sort -z -u > "${RUNNER_TEMP}/paths.txt"
-
-      - name: QHelp preview
-        run: |
-          EXIT_CODE=0
-          echo "QHelp previews:" > comment.txt
-          while read -r -d $'\0' path; do
-            if [ ! -f "${path}" ]; then
-               exit 1
-            fi
-            echo "<details> <summary>${path}</summary>"
-            echo
-            codeql generate query-help --format=markdown -- "./${path}" 2> errors.txt || EXIT_CODE="$?"
-            if [ -s errors.txt ]; then
-               echo "# errors/warnings:"
-               echo '```'
-               cat errors.txt
-               cat errors.txt 1>&2
-               echo '```'
-            fi
-            echo "</details>"
-          done < "${RUNNER_TEMP}/paths.txt" >> comment.txt
-          exit "${EXIT_CODE}"
-
-      - if: always()
-        uses: actions/upload-artifact@v2
-        with:
-          name: comment
-          path: comment.txt
-          retention-days: 1

.github/workflows/ruby-build.yml

@@ -1,224 +0,0 @@
-name: "Ruby: Build"
-
-on:
-  push:
-    paths:
-      - "ruby/**"
-      - .github/workflows/ruby-build.yml
-    branches:
-      - main
-      - "rc/*"
-  pull_request:
-    paths:
-      - "ruby/**"
-      - .github/workflows/ruby-build.yml
-    branches:
-      - main
-      - "rc/*"
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: "Version tag to create"
-        required: false
-
-env:
-  CARGO_TERM_COLOR: always
-
-defaults:
-  run:
-    working-directory: ruby
-
-jobs:
-  build:
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
-
-    runs-on: ${{ matrix.os }}
-
-    steps:
-      - uses: actions/checkout@v2
-      - name: Install GNU tar
-        if: runner.os == 'macOS'
-        run: |
-          brew install gnu-tar
-          echo "/usr/local/opt/gnu-tar/libexec/gnubin" >> $GITHUB_PATH
-      - uses: actions/cache@v2
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            ruby/target
-          key: ${{ runner.os }}-rust-cargo-${{ hashFiles('**/Cargo.lock') }}
-      - name: Check formatting
-        run: cargo fmt --all -- --check
-      - name: Build
-        run: cargo build --verbose
-      - name: Run tests
-        run: cargo test --verbose
-      - name: Release build
-        run: cargo build --release
-      - name: Generate dbscheme
-        if: ${{ matrix.os == 'ubuntu-latest' }}
-        run: target/release/ruby-generator --dbscheme ql/lib/ruby.dbscheme --library ql/lib/codeql/ruby/ast/internal/TreeSitter.qll
-      - uses: actions/upload-artifact@v2
-        if: ${{ matrix.os == 'ubuntu-latest' }}
-        with:
-          name: ruby.dbscheme
-          path: ruby/ql/lib/ruby.dbscheme
-      - uses: actions/upload-artifact@v2
-        if: ${{ matrix.os == 'ubuntu-latest' }}
-        with:
-          name: TreeSitter.qll
-          path: ruby/ql/lib/codeql/ruby/ast/internal/TreeSitter.qll
-      - uses: actions/upload-artifact@v2
-        with:
-          name: extractor-${{ matrix.os }}
-          path: |
-            ruby/target/release/ruby-autobuilder
-            ruby/target/release/ruby-autobuilder.exe
-            ruby/target/release/ruby-extractor
-            ruby/target/release/ruby-extractor.exe
-          retention-days: 1
-  compile-queries:
-    runs-on: ubuntu-latest
-    env:
-      CODEQL_THREADS: 4 # TODO: remove this once it's set by the CLI
-    steps:
-      - uses: actions/checkout@v2
-      - name: Fetch CodeQL
-        run: |
-          LATEST=$(gh release list --repo https://github.com/github/codeql-cli-binaries | cut -f 1 | grep -v beta | sort --version-sort | tail -1)
-          gh release download --repo https://github.com/github/codeql-cli-binaries --pattern codeql-linux64.zip "$LATEST"
-          unzip -q codeql-linux64.zip
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-      - name: Build Query Pack
-        run: |
-          codeql/codeql pack create ql/lib --output target/packs
-          codeql/codeql pack install ql/src
-          codeql/codeql pack create ql/src --output target/packs
-          PACK_FOLDER=$(readlink -f target/packs/codeql/ruby-queries/*)
-          codeql/codeql generate query-help --format=sarifv2.1.0 --output="${PACK_FOLDER}/rules.sarif" ql/src
-          (cd ql/src; find queries \( -name '*.qhelp' -o -name '*.rb' -o -name '*.erb' \) -exec bash -c 'mkdir -p "'"${PACK_FOLDER}"'/$(dirname "{}")"' \; -exec cp "{}" "${PACK_FOLDER}/{}" \;)
-      - uses: actions/upload-artifact@v2
-        with:
-          name: codeql-ruby-queries
-          path: |
-            ruby/target/packs/*
-          retention-days: 1
-
-  package:
-    runs-on: ubuntu-latest
-    needs: [build, compile-queries]
-    steps:
-      - uses: actions/checkout@v2
-      - uses: actions/download-artifact@v2
-        with:
-          name: ruby.dbscheme
-          path: ruby/ruby
-      - uses: actions/download-artifact@v2
-        with:
-          name: extractor-ubuntu-latest
-          path: ruby/linux64
-      - uses: actions/download-artifact@v2
-        with:
-          name: extractor-windows-latest
-          path: ruby/win64
-      - uses: actions/download-artifact@v2
-        with:
-          name: extractor-macos-latest
-          path: ruby/osx64
-      - run: |
-          mkdir -p ruby
-          cp -r codeql-extractor.yml tools ql/lib/ruby.dbscheme.stats ruby/
-          mkdir -p ruby/tools/{linux64,osx64,win64}
-          cp linux64/ruby-autobuilder ruby/tools/linux64/autobuilder
-          cp osx64/ruby-autobuilder ruby/tools/osx64/autobuilder
-          cp win64/ruby-autobuilder.exe ruby/tools/win64/autobuilder.exe
-          cp linux64/ruby-extractor ruby/tools/linux64/extractor
-          cp osx64/ruby-extractor ruby/tools/osx64/extractor
-          cp win64/ruby-extractor.exe ruby/tools/win64/extractor.exe
-          chmod +x ruby/tools/{linux64,osx64}/{autobuilder,extractor}
-          zip -rq codeql-ruby.zip ruby
-      - uses: actions/upload-artifact@v2
-        with:
-          name: codeql-ruby-pack
-          path: ruby/codeql-ruby.zip
-          retention-days: 1
-      - uses: actions/download-artifact@v2
-        with:
-          name: codeql-ruby-queries
-          path: ruby/qlpacks
-      - run: |
-          echo '{
-            "provide": [
-            "ruby/codeql-extractor.yml",
-            "qlpacks/*/*/*/qlpack.yml"
-            ]
-          }' > .codeqlmanifest.json
-          zip -rq codeql-ruby-bundle.zip .codeqlmanifest.json ruby qlpacks
-      - uses: actions/upload-artifact@v2
-        with:
-          name: codeql-ruby-bundle
-          path: ruby/codeql-ruby-bundle.zip
-          retention-days: 1
-
-  test:
-    defaults:
-      run:
-        working-directory: ${{ github.workspace }}
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
-
-    runs-on: ${{ matrix.os }}
-    needs: [package]
-    steps:
-      - uses: actions/checkout@v2
-        with:
-          repository: Shopify/example-ruby-app
-          ref: 67a0decc5eb550f3a9228eda53925c3afd40dfe9
-      - name: Fetch CodeQL
-        shell: bash
-        run: |
-          LATEST=$(gh release list --repo https://github.com/github/codeql-cli-binaries | cut -f 1 | grep -v beta | sort --version-sort | tail -1)
-          gh release download --repo https://github.com/github/codeql-cli-binaries --pattern codeql.zip "$LATEST"
-          unzip -q codeql.zip
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-        working-directory: ${{ runner.temp }}
-      - name: Download Ruby bundle
-        uses: actions/download-artifact@v2
-        with:
-          name: codeql-ruby-bundle
-          path: ${{ runner.temp }}
-      - name: Unzip Ruby bundle
-        shell: bash
-        run: unzip -q -d "${{ runner.temp }}/ruby-bundle" "${{ runner.temp }}/codeql-ruby-bundle.zip"
-      - name: Prepare test files
-        shell: bash
-        run: |
-          echo "import ruby select count(File f)" > "test.ql"
-          echo "| 4 |" > "test.expected"
-          echo 'name: sample-tests
-          version: 0.0.0
-          dependencies:
-            codeql/ruby-all: 0.0.1
-          extractor: ruby
-          tests: .
-          ' > qlpack.yml
-      - name: Run QL test
-        shell: bash
-        run: |
-          "${{ runner.temp }}/codeql/codeql" test run --search-path "${{ runner.temp }}/ruby-bundle" --additional-packs "${{ runner.temp }}/ruby-bundle" .
-      - name: Create database
-        shell: bash
-        run: |
-          "${{ runner.temp }}/codeql/codeql" database create --search-path "${{ runner.temp }}/ruby-bundle" --language ruby --source-root . ../database
-      - name: Analyze database
-        shell: bash
-        run: |
-          "${{ runner.temp }}/codeql/codeql" database analyze --search-path "${{ runner.temp }}/ruby-bundle" --format=sarifv2.1.0 --output=out.sarif ../database ruby-code-scanning.qls

.github/workflows/ruby-dataset-measure.yml

@@ -1,73 +0,0 @@
-name: "Ruby: Collect database stats"
-
-on:
-  push:
-    branches:
-      - main
-      - "rc/*"
-    paths:
-      - ruby/ql/lib/ruby.dbscheme
-      - .github/workflows/ruby-dataset-measure.yml
-  pull_request:
-    branches:
-      - main
-      - "rc/*"
-    paths:
-      - ruby/ql/lib/ruby.dbscheme
-      - .github/workflows/ruby-dataset-measure.yml
-  workflow_dispatch:
-
-jobs:
-  measure:
-    env:
-      CODEQL_THREADS: 4 # TODO: remove this once it's set by the CLI
-    strategy:
-      fail-fast: false
-      matrix:
-        repo: [rails/rails, discourse/discourse, spree/spree]
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-
-      - uses: ./.github/actions/fetch-codeql
-
-      - uses: ./ruby/actions/create-extractor-pack
-
-      - name: Checkout ${{ matrix.repo }}
-        uses: actions/checkout@v2
-        with:
-          repository: ${{ matrix.repo }}
-          path: ${{ github.workspace }}/repo
-      - name: Create database
-        run: |
-          codeql database create \
-            --search-path "${{ github.workspace }}/ruby/extractor-pack" \
-            --threads 4 \
-            --language ruby --source-root "${{ github.workspace }}/repo" \
-            "${{ runner.temp }}/database"
-      - name: Measure database
-        run: |
-          mkdir -p "stats/${{ matrix.repo }}"
-          codeql dataset measure --threads 4 --output "stats/${{ matrix.repo }}/stats.xml" "${{ runner.temp }}/database/db-ruby"
-      - uses: actions/upload-artifact@v2
-        with:
-          name: measurements
-          path: stats
-          retention-days: 1
-
-  merge:
-    runs-on: ubuntu-latest
-    needs: measure
-    steps:
-      - uses: actions/checkout@v2
-      - uses: actions/download-artifact@v2
-        with:
-          name: measurements
-          path: stats
-      - run: |
-          python -m pip install --user lxml
-          find stats -name 'stats.xml' | sort | xargs python ruby/scripts/merge_stats.py --output ruby/ql/lib/ruby.dbscheme.stats --normalise ruby_tokeninfo
-      - uses: actions/upload-artifact@v2
-        with:
-          name: ruby.dbscheme.stats
-          path: ruby/ql/lib/ruby.dbscheme.stats

.github/workflows/ruby-qltest.yml

@@ -1,50 +0,0 @@
-name: "Ruby: Run QL Tests"
-
-on:
-  push:
-    paths:
-      - "ruby/**"
-      - .github/workflows/ruby-qltest.yml
-    branches:
-      - main
-      - "rc/*"
-  pull_request:
-    paths:
-      - "ruby/**"
-      - .github/workflows/ruby-qltest.yml
-    branches:
-      - main
-      - "rc/*"
-
-env:
-  CARGO_TERM_COLOR: always
-
-defaults:
-  run:
-    working-directory: ruby
-
-jobs:
-  qltest:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-      - uses: ./.github/actions/fetch-codeql
-      - uses: ./ruby/actions/create-extractor-pack
-      - name: Run QL tests
-        run: |
-          codeql test run --search-path "${{ github.workspace }}/ruby/extractor-pack" --check-databases --check-unused-labels --check-repeated-labels --check-redefined-labels --check-use-before-definition --consistency-queries ql/consistency-queries ql/test
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-      - name: Check QL formatting
-        run: find ql "(" -name "*.ql" -or -name "*.qll" ")" -print0 | xargs -0 codeql query format --check-only
-      - name: Check QL compilation
-        run: |
-          codeql query compile --check-only --threads=4 --warnings=error "ql/src" "ql/examples"
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-      - name: Check DB upgrade scripts
-        run: |
-          echo >empty.trap
-          codeql dataset import -S ql/lib/upgrades/initial/ruby.dbscheme testdb empty.trap
-          codeql dataset upgrade testdb --additional-packs ql/lib
-          diff -q testdb/ruby.dbscheme ql/lib/ruby.dbscheme

.github/workflows/sync-files.yml

@@ -1,20 +0,0 @@
-name: Check synchronized files
-
-on:
-  push:
-    branches:
-      - main
-      - 'rc/*'
-  pull_request:
-    branches:
-      - main
-      - 'rc/*'
-
-jobs:
-  sync:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-      - name: Check synchronized files
-        run: python config/sync-files.py
-

.gitignore

@@ -24,9 +24,3 @@
 /codeql/
 
 csharp/extractor/Semmle.Extraction.CSharp.Driver/Properties/launchSettings.json
-
-# Avoid committing cached package components
-.codeql
-
-# Compiled class file
-*.class

CODEOWNERS

@@ -3,7 +3,6 @@
 /java/ @github/codeql-java
 /javascript/ @github/codeql-javascript
 /python/ @github/codeql-python
-/ruby/ @github/codeql-ruby
 
 # Make @xcorail (GitHub Security Lab) a code owner for experimental queries so he gets pinged when we promote a query out of experimental
 /cpp/**/experimental/**/* @github/codeql-c-analysis @xcorail
@@ -11,7 +10,6 @@
 /java/**/experimental/**/* @github/codeql-java @xcorail
 /javascript/**/experimental/**/* @github/codeql-javascript @xcorail
 /python/**/experimental/**/* @github/codeql-python @xcorail
-/ruby/**/experimental/**/* @github/codeql-ruby @xcorail
 
 # Notify members of codeql-go about PRs to the shared data-flow library files
 /java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl.qll @github/codeql-java @github/codeql-go
@@ -19,9 +17,3 @@
 /java/ql/src/semmle/code/java/dataflow/internal/DataFlowImplCommon.qll @github/codeql-java @github/codeql-go
 /java/ql/src/semmle/code/java/dataflow/internal/tainttracking1/TaintTrackingImpl.qll @github/codeql-java @github/codeql-go
 /java/ql/src/semmle/code/java/dataflow/internal/tainttracking2/TaintTrackingImpl.qll @github/codeql-java @github/codeql-go
-
-# CodeQL tools and associated docs
-/docs/codeql-cli/ @github/codeql-cli-reviewers
-/docs/codeql-for-visual-studio-code/ @github/codeql-vscode-reviewers
-/docs/ql-language-reference/ @github/codeql-frontend-reviewers
-/docs/query-*-style-guide.md @github/codeql-analysis-reviewers

CONTRIBUTING.md

@@ -11,14 +11,13 @@ If you have an idea for a query that you would like to share with other CodeQL u
 
 1. **Directory structure**
 
-    There are six language-specific query directories in this repository:
+    There are five language-specific query directories in this repository:
 
       * C/C++: `cpp/ql/src`
       * C#: `csharp/ql/src`
       * Java: `java/ql/src`
       * JavaScript: `javascript/ql/src`
       * Python: `python/ql/src`
-      * Ruby: `ruby/ql/src`
 
     Each language-specific directory contains further subdirectories that group queries based on their `@tags` or purpose.
     - Experimental queries and libraries are stored in the `experimental` subdirectory within each language-specific directory in the [CodeQL repository](https://github.com/github/codeql). For example, experimental Java queries and libraries are stored in `java/ql/src/experimental` and any corresponding tests in `java/ql/test/experimental`.

README.md

@@ -4,8 +4,8 @@ This open source repository contains the standard CodeQL libraries and queries t
 
 ## How do I learn CodeQL and run queries?
 
-There is [extensive documentation](https://codeql.github.com/docs/) on getting started with writing CodeQL.
-You can use the [interactive query console](https://lgtm.com/help/lgtm/using-query-console) on LGTM.com or the [CodeQL for Visual Studio Code](https://codeql.github.com/docs/codeql-for-visual-studio-code/) extension to try out your queries on any open source project that's currently being analyzed.
+There is [extensive documentation](https://help.semmle.com/QL/learn-ql/) on getting started with writing CodeQL.
+You can use the [interactive query console](https://lgtm.com/help/lgtm/using-query-console) on LGTM.com or the [CodeQL for Visual Studio Code](https://help.semmle.com/codeql/codeql-for-vscode.html) extension to try out your queries on any open source project that's currently being analyzed.
 
 ## Contributing
 

config/identical-files.json

@@ -1,339 +1,332 @@
 {
   "DataFlow Java/C++/C#/Python": [
-    "java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl.qll",
-    "java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl2.qll",
-    "java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl3.qll",
-    "java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl4.qll",
-    "java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl5.qll",
-    "java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl6.qll",
-    "java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImplForSerializability.qll",
-    "cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll",
-    "cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll",
-    "cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll",
-    "cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll",
-    "cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplLocal.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl2.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl3.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl4.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl5.qll",
-    "python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl.qll",
-    "python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl2.qll",
-    "python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl3.qll",
-    "python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl4.qll",
-    "ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImpl.qll",
-    "ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImpl2.qll"
+    "java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl.qll",
+    "java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl2.qll",
+    "java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl3.qll",
+    "java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl4.qll",
+    "java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl5.qll",
+    "java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl6.qll",
+    "cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll",
+    "cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll",
+    "cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll",
+    "cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll",
+    "cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImplLocal.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl2.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl3.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl4.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl5.qll",
+    "python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl.qll",
+    "python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl2.qll",
+    "python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl3.qll",
+    "python/ql/src/semmle/python/dataflow/new/internal/DataFlowImpl4.qll"
   ],
   "DataFlow Java/C++/C#/Python Common": [
-    "java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImplCommon.qll",
-    "cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplCommon.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplCommon.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImplCommon.qll",
-    "python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImplCommon.qll",
-    "ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImplCommon.qll"
+    "java/ql/src/semmle/code/java/dataflow/internal/DataFlowImplCommon.qll",
+    "cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImplCommon.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImplCommon.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImplCommon.qll",
+    "python/ql/src/semmle/python/dataflow/new/internal/DataFlowImplCommon.qll"
   ],
   "TaintTracking::Configuration Java/C++/C#/Python": [
-    "cpp/ql/lib/semmle/code/cpp/dataflow/internal/tainttracking1/TaintTrackingImpl.qll",
-    "cpp/ql/lib/semmle/code/cpp/dataflow/internal/tainttracking2/TaintTrackingImpl.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/tainttracking1/TaintTrackingImpl.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/tainttracking2/TaintTrackingImpl.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/tainttracking3/TaintTrackingImpl.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/tainttracking1/TaintTrackingImpl.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/tainttracking2/TaintTrackingImpl.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/tainttracking3/TaintTrackingImpl.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/tainttracking4/TaintTrackingImpl.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/tainttracking5/TaintTrackingImpl.qll",
-    "java/ql/lib/semmle/code/java/dataflow/internal/tainttracking1/TaintTrackingImpl.qll",
-    "java/ql/lib/semmle/code/java/dataflow/internal/tainttracking2/TaintTrackingImpl.qll",
-    "python/ql/lib/semmle/python/dataflow/new/internal/tainttracking1/TaintTrackingImpl.qll",
-    "python/ql/lib/semmle/python/dataflow/new/internal/tainttracking2/TaintTrackingImpl.qll",
-    "python/ql/lib/semmle/python/dataflow/new/internal/tainttracking3/TaintTrackingImpl.qll",
-    "python/ql/lib/semmle/python/dataflow/new/internal/tainttracking4/TaintTrackingImpl.qll",
-    "ruby/ql/lib/codeql/ruby/dataflow/internal/tainttracking1/TaintTrackingImpl.qll"
+    "cpp/ql/src/semmle/code/cpp/dataflow/internal/tainttracking1/TaintTrackingImpl.qll",
+    "cpp/ql/src/semmle/code/cpp/dataflow/internal/tainttracking2/TaintTrackingImpl.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/tainttracking1/TaintTrackingImpl.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/tainttracking2/TaintTrackingImpl.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/tainttracking3/TaintTrackingImpl.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/tainttracking1/TaintTrackingImpl.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/tainttracking2/TaintTrackingImpl.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/tainttracking3/TaintTrackingImpl.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/tainttracking4/TaintTrackingImpl.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/tainttracking5/TaintTrackingImpl.qll",
+    "java/ql/src/semmle/code/java/dataflow/internal/tainttracking1/TaintTrackingImpl.qll",
+    "java/ql/src/semmle/code/java/dataflow/internal/tainttracking2/TaintTrackingImpl.qll",
+    "python/ql/src/semmle/python/dataflow/new/internal/tainttracking1/TaintTrackingImpl.qll",
+    "python/ql/src/semmle/python/dataflow/new/internal/tainttracking2/TaintTrackingImpl.qll",
+    "python/ql/src/semmle/python/dataflow/new/internal/tainttracking3/TaintTrackingImpl.qll",
+    "python/ql/src/semmle/python/dataflow/new/internal/tainttracking4/TaintTrackingImpl.qll"
   ],
   "DataFlow Java/C++/C#/Python Consistency checks": [
-    "java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImplConsistency.qll",
-    "cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplConsistency.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplConsistency.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImplConsistency.qll",
-    "python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImplConsistency.qll",
-    "ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImplConsistency.qll"
+    "java/ql/src/semmle/code/java/dataflow/internal/DataFlowImplConsistency.qll",
+    "cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImplConsistency.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImplConsistency.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImplConsistency.qll",
+    "python/ql/src/semmle/python/dataflow/new/internal/DataFlowImplConsistency.qll"
   ],
   "DataFlow Java/C# Flow Summaries": [
-    "java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll",
-    "ruby/ql/lib/codeql/ruby/dataflow/internal/FlowSummaryImpl.qll"
+    "java/ql/src/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll"
   ],
   "SsaReadPosition Java/C#": [
-    "java/ql/lib/semmle/code/java/dataflow/internal/rangeanalysis/SsaReadPositionCommon.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/SsaReadPositionCommon.qll"
+    "java/ql/src/semmle/code/java/dataflow/internal/rangeanalysis/SsaReadPositionCommon.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/rangeanalysis/SsaReadPositionCommon.qll"
   ],
   "Sign Java/C#": [
-    "java/ql/lib/semmle/code/java/dataflow/internal/rangeanalysis/Sign.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/Sign.qll"
+    "java/ql/src/semmle/code/java/dataflow/internal/rangeanalysis/Sign.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/rangeanalysis/Sign.qll"
   ],
   "SignAnalysis Java/C#": [
-    "java/ql/lib/semmle/code/java/dataflow/internal/rangeanalysis/SignAnalysisCommon.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/SignAnalysisCommon.qll"
+    "java/ql/src/semmle/code/java/dataflow/internal/rangeanalysis/SignAnalysisCommon.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/rangeanalysis/SignAnalysisCommon.qll"
   ],
   "Bound Java/C#": [
-    "java/ql/lib/semmle/code/java/dataflow/Bound.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/Bound.qll"
+    "java/ql/src/semmle/code/java/dataflow/Bound.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/Bound.qll"
   ],
   "ModulusAnalysis Java/C#": [
-    "java/ql/lib/semmle/code/java/dataflow/ModulusAnalysis.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/ModulusAnalysis.qll"
+    "java/ql/src/semmle/code/java/dataflow/ModulusAnalysis.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/ModulusAnalysis.qll"
   ],
   "C++ SubBasicBlocks": [
-    "cpp/ql/lib/semmle/code/cpp/controlflow/SubBasicBlocks.qll",
-    "cpp/ql/lib/semmle/code/cpp/dataflow/internal/SubBasicBlocks.qll"
+    "cpp/ql/src/semmle/code/cpp/controlflow/SubBasicBlocks.qll",
+    "cpp/ql/src/semmle/code/cpp/dataflow/internal/SubBasicBlocks.qll"
   ],
   "IR Instruction": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/Instruction.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/Instruction.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll",
     "csharp/ql/src/experimental/ir/implementation/raw/Instruction.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/Instruction.qll"
   ],
   "IR IRBlock": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/IRBlock.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/IRBlock.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/IRBlock.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/IRBlock.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/IRBlock.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/IRBlock.qll",
     "csharp/ql/src/experimental/ir/implementation/raw/IRBlock.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/IRBlock.qll"
   ],
   "IR IRVariable": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/IRVariable.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/IRVariable.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/IRVariable.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/IRVariable.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/IRVariable.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/IRVariable.qll",
     "csharp/ql/src/experimental/ir/implementation/raw/IRVariable.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/IRVariable.qll"
   ],
   "IR IRFunction": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/IRFunction.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/IRFunction.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/IRFunction.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/IRFunction.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/IRFunction.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/IRFunction.qll",
     "csharp/ql/src/experimental/ir/implementation/raw/IRFunction.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/IRFunction.qll"
   ],
   "IR Operand": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/Operand.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/Operand.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/Operand.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/Operand.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/Operand.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/Operand.qll",
     "csharp/ql/src/experimental/ir/implementation/raw/Operand.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/Operand.qll"
   ],
   "IR IRType": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/IRType.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/IRType.qll",
     "csharp/ql/src/experimental/ir/implementation/IRType.qll"
   ],
   "IR IRConfiguration": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/IRConfiguration.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/IRConfiguration.qll",
     "csharp/ql/src/experimental/ir/implementation/IRConfiguration.qll"
   ],
   "IR UseSoundEscapeAnalysis": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/UseSoundEscapeAnalysis.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/UseSoundEscapeAnalysis.qll",
     "csharp/ql/src/experimental/ir/implementation/UseSoundEscapeAnalysis.qll"
   ],
   "IR IRFunctionBase": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/internal/IRFunctionBase.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/internal/IRFunctionBase.qll",
     "csharp/ql/src/experimental/ir/implementation/internal/IRFunctionBase.qll"
   ],
   "IR Operand Tag": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/internal/OperandTag.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/internal/OperandTag.qll",
     "csharp/ql/src/experimental/ir/implementation/internal/OperandTag.qll"
   ],
   "IR TInstruction": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/internal/TInstruction.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/internal/TInstruction.qll",
     "csharp/ql/src/experimental/ir/implementation/internal/TInstruction.qll"
   ],
   "IR TIRVariable": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/internal/TIRVariable.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/internal/TIRVariable.qll",
     "csharp/ql/src/experimental/ir/implementation/internal/TIRVariable.qll"
   ],
   "IR IR": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/IR.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/IR.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/IR.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/IR.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/IR.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/IR.qll",
     "csharp/ql/src/experimental/ir/implementation/raw/IR.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/IR.qll"
   ],
   "IR IRConsistency": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/IRConsistency.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/IRConsistency.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/IRConsistency.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/IRConsistency.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/IRConsistency.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/IRConsistency.qll",
     "csharp/ql/src/experimental/ir/implementation/raw/IRConsistency.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/IRConsistency.qll"
   ],
   "IR PrintIR": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/PrintIR.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/PrintIR.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/PrintIR.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/PrintIR.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/PrintIR.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/PrintIR.qll",
     "csharp/ql/src/experimental/ir/implementation/raw/PrintIR.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/PrintIR.qll"
   ],
   "IR IntegerConstant": [
-    "cpp/ql/lib/semmle/code/cpp/ir/internal/IntegerConstant.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/internal/IntegerConstant.qll",
     "csharp/ql/src/experimental/ir/internal/IntegerConstant.qll"
   ],
   "IR IntegerInteval": [
-    "cpp/ql/lib/semmle/code/cpp/ir/internal/IntegerInterval.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/internal/IntegerInterval.qll",
     "csharp/ql/src/experimental/ir/internal/IntegerInterval.qll"
   ],
   "IR IntegerPartial": [
-    "cpp/ql/lib/semmle/code/cpp/ir/internal/IntegerPartial.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/internal/IntegerPartial.qll",
     "csharp/ql/src/experimental/ir/internal/IntegerPartial.qll"
   ],
   "IR Overlap": [
-    "cpp/ql/lib/semmle/code/cpp/ir/internal/Overlap.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/internal/Overlap.qll",
     "csharp/ql/src/experimental/ir/internal/Overlap.qll"
   ],
   "IR EdgeKind": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/EdgeKind.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/EdgeKind.qll",
     "csharp/ql/src/experimental/ir/implementation/EdgeKind.qll"
   ],
   "IR MemoryAccessKind": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/MemoryAccessKind.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/MemoryAccessKind.qll",
     "csharp/ql/src/experimental/ir/implementation/MemoryAccessKind.qll"
   ],
   "IR TempVariableTag": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/TempVariableTag.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/TempVariableTag.qll",
     "csharp/ql/src/experimental/ir/implementation/TempVariableTag.qll"
   ],
   "IR Opcode": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/Opcode.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/Opcode.qll",
     "csharp/ql/src/experimental/ir/implementation/Opcode.qll"
   ],
   "IR SSAConsistency": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConsistency.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConsistency.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConsistency.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConsistency.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/SSAConsistency.qll"
   ],
   "C++ IR InstructionImports": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/InstructionImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/InstructionImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/InstructionImports.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/InstructionImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/InstructionImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/InstructionImports.qll"
   ],
   "C++ IR IRImports": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/IRImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/IRImports.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/IRImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/IRImports.qll"
   ],
   "C++ IR IRBlockImports": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/IRBlockImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRBlockImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/IRBlockImports.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/IRBlockImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRBlockImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/IRBlockImports.qll"
   ],
   "C++ IR IRFunctionImports": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/IRFunctionImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRFunctionImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/IRFunctionImports.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/IRFunctionImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRFunctionImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/IRFunctionImports.qll"
   ],
   "C++ IR IRVariableImports": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/IRVariableImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRVariableImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/IRVariableImports.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/IRVariableImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRVariableImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/IRVariableImports.qll"
   ],
   "C++ IR OperandImports": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/OperandImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/OperandImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/OperandImports.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/OperandImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/OperandImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/OperandImports.qll"
   ],
   "C++ IR PrintIRImports": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/PrintIRImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/PrintIRImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/PrintIRImports.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/PrintIRImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/PrintIRImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/PrintIRImports.qll"
   ],
   "C++ SSA SSAConstructionImports": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConstructionImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstructionImports.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConstructionImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstructionImports.qll"
   ],
   "SSA AliasAnalysis": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysis.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysis.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll"
   ],
   "SSA PrintAliasAnalysis": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/PrintAliasAnalysis.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/PrintAliasAnalysis.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/PrintAliasAnalysis.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/PrintAliasAnalysis.qll"
   ],
   "C++ SSA AliasAnalysisImports": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysisImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysisImports.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysisImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysisImports.qll"
   ],
   "C++ IR ValueNumberingImports": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/gvn/internal/ValueNumberingImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/internal/ValueNumberingImports.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/internal/ValueNumberingImports.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/gvn/internal/ValueNumberingImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/internal/ValueNumberingImports.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/internal/ValueNumberingImports.qll"
   ],
   "IR SSA SimpleSSA": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SimpleSSA.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SimpleSSA.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/SimpleSSA.qll"
   ],
   "IR AliasConfiguration (unaliased_ssa)": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasConfiguration.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasConfiguration.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/AliasConfiguration.qll"
   ],
   "IR SSA SSAConstruction": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstruction.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstruction.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll"
   ],
   "IR SSA PrintSSA": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/PrintSSA.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/PrintSSA.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/PrintSSA.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/PrintSSA.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/PrintSSA.qll"
   ],
   "IR ValueNumberInternal": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/gvn/internal/ValueNumberingInternal.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/internal/ValueNumberingInternal.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/internal/ValueNumberingInternal.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/gvn/internal/ValueNumberingInternal.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/internal/ValueNumberingInternal.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/internal/ValueNumberingInternal.qll",
     "csharp/ql/src/experimental/ir/implementation/raw/gvn/internal/ValueNumberingInternal.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/gvn/internal/ValueNumberingInternal.qll"
   ],
   "C++ IR ValueNumber": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/gvn/ValueNumbering.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/ValueNumbering.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/ValueNumbering.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/gvn/ValueNumbering.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/ValueNumbering.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/ValueNumbering.qll",
     "csharp/ql/src/experimental/ir/implementation/raw/gvn/ValueNumbering.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/gvn/ValueNumbering.qll"
   ],
   "C++ IR PrintValueNumbering": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/gvn/PrintValueNumbering.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/PrintValueNumbering.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/PrintValueNumbering.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/gvn/PrintValueNumbering.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/PrintValueNumbering.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/PrintValueNumbering.qll",
     "csharp/ql/src/experimental/ir/implementation/raw/gvn/PrintValueNumbering.qll",
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/gvn/PrintValueNumbering.qll"
   ],
   "C++ IR ConstantAnalysis": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/constant/ConstantAnalysis.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/constant/ConstantAnalysis.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/constant/ConstantAnalysis.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/constant/ConstantAnalysis.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/constant/ConstantAnalysis.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/constant/ConstantAnalysis.qll"
   ],
   "C++ IR PrintConstantAnalysis": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/constant/PrintConstantAnalysis.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/constant/PrintConstantAnalysis.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/constant/PrintConstantAnalysis.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/constant/PrintConstantAnalysis.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/constant/PrintConstantAnalysis.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/constant/PrintConstantAnalysis.qll"
   ],
   "C++ IR ReachableBlock": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/reachability/ReachableBlock.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/reachability/ReachableBlock.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/reachability/ReachableBlock.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/reachability/ReachableBlock.qll"
   ],
   "C++ IR PrintReachableBlock": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/reachability/PrintReachableBlock.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/reachability/PrintReachableBlock.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/reachability/PrintReachableBlock.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/reachability/PrintReachableBlock.qll"
   ],
   "C++ IR Dominance": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/reachability/Dominance.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/reachability/Dominance.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/reachability/Dominance.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/reachability/Dominance.qll"
   ],
   "C++ IR PrintDominance": [
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/reachability/PrintDominance.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/reachability/PrintDominance.qll"
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/reachability/PrintDominance.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/reachability/PrintDominance.qll"
   ],
   "C# IR InstructionImports": [
     "csharp/ql/src/experimental/ir/implementation/raw/internal/InstructionImports.qll",
@@ -368,15 +361,13 @@
     "csharp/ql/src/experimental/ir/implementation/unaliased_ssa/gvn/internal/ValueNumberingImports.qll"
   ],
   "C# ControlFlowReachability": [
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/ControlFlowReachability.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/ControlFlowReachability.qll"
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/ControlFlowReachability.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/rangeanalysis/ControlFlowReachability.qll"
   ],
   "Inline Test Expectations": [
     "cpp/ql/test/TestUtilities/InlineExpectationsTest.qll",
-    "csharp/ql/test/TestUtilities/InlineExpectationsTest.qll",
     "java/ql/test/TestUtilities/InlineExpectationsTest.qll",
-    "python/ql/test/TestUtilities/InlineExpectationsTest.qll",
-    "ruby/ql/test/TestUtilities/InlineExpectationsTest.qll"
+    "python/ql/test/TestUtilities/InlineExpectationsTest.qll"
   ],
   "C++ ExternalAPIs": [
     "cpp/ql/src/Security/CWE/CWE-020/ExternalAPIs.qll",
@@ -387,11 +378,11 @@
     "cpp/ql/src/Security/CWE/CWE-020/ir/SafeExternalAPIFunction.qll"
   ],
   "XML": [
-    "cpp/ql/lib/semmle/code/cpp/XML.qll",
-    "csharp/ql/lib/semmle/code/csharp/XML.qll",
-    "java/ql/lib/semmle/code/xml/XML.qll",
-    "javascript/ql/lib/semmle/javascript/XML.qll",
-    "python/ql/lib/semmle/python/xml/XML.qll"
+    "cpp/ql/src/semmle/code/cpp/XML.qll",
+    "csharp/ql/src/semmle/code/csharp/XML.qll",
+    "java/ql/src/semmle/code/xml/XML.qll",
+    "javascript/ql/src/semmle/javascript/XML.qll",
+    "python/ql/src/semmle/python/xml/XML.qll"
   ],
   "DuplicationProblems.inc.qhelp": [
     "cpp/ql/src/Metrics/Files/DuplicationProblems.inc.qhelp",
@@ -445,54 +436,17 @@
     "python/ql/src/analysis/IDEContextual.qll"
   ],
   "SSA C#": [
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/SsaImplCommon.qll",
-    "csharp/ql/lib/semmle/code/csharp/controlflow/internal/pressa/SsaImplCommon.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/basessa/SsaImplCommon.qll",
-    "csharp/ql/lib/semmle/code/cil/internal/SsaImplCommon.qll",
-    "ruby/ql/lib/codeql/ruby/dataflow/internal/SsaImplCommon.qll",
-    "cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaImplCommon.qll"
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/SsaImplCommon.qll",
+    "csharp/ql/src/semmle/code/csharp/controlflow/internal/pressa/SsaImplCommon.qll",
+    "csharp/ql/src/semmle/code/csharp/dataflow/internal/basessa/SsaImplCommon.qll",
+    "csharp/ql/src/semmle/code/cil/internal/SsaImplCommon.qll"
   ],
   "CryptoAlgorithms Python/JS": [
-    "javascript/ql/lib/semmle/javascript/security/CryptoAlgorithms.qll",
-    "python/ql/lib/semmle/python/concepts/CryptoAlgorithms.qll"
+    "javascript/ql/src/semmle/javascript/security/CryptoAlgorithms.qll",
+    "python/ql/src/semmle/python/concepts/CryptoAlgorithms.qll"
   ],
   "SensitiveDataHeuristics Python/JS": [
-    "javascript/ql/lib/semmle/javascript/security/internal/SensitiveDataHeuristics.qll",
-    "python/ql/lib/semmle/python/security/internal/SensitiveDataHeuristics.qll"
-  ],
-  "ReDoS Util Python/JS/Ruby": [
-    "javascript/ql/lib/semmle/javascript/security/performance/ReDoSUtil.qll",
-    "python/ql/lib/semmle/python/security/performance/ReDoSUtil.qll",
-    "ruby/ql/lib/codeql/ruby/security/performance/ReDoSUtil.qll"
-  ],
-  "ReDoS Exponential Python/JS": [
-    "javascript/ql/lib/semmle/javascript/security/performance/ExponentialBackTracking.qll",
-    "python/ql/lib/semmle/python/security/performance/ExponentialBackTracking.qll"
-  ],
-  "ReDoS Polynomial Python/JS": [
-    "javascript/ql/lib/semmle/javascript/security/performance/SuperlinearBackTracking.qll",
-    "python/ql/lib/semmle/python/security/performance/SuperlinearBackTracking.qll",
-    "ruby/ql/lib/codeql/ruby/security/performance/SuperlinearBackTracking.qll"
-  ],
-  "BadTagFilterQuery Python/JS/Ruby": [
-    "javascript/ql/lib/semmle/javascript/security/BadTagFilterQuery.qll",
-    "python/ql/lib/semmle/python/security/BadTagFilterQuery.qll",
-    "ruby/ql/lib/codeql/ruby/security/BadTagFilterQuery.qll"
-  ],
-  "CFG": [
-    "csharp/ql/lib/semmle/code/csharp/controlflow/internal/ControlFlowGraphImplShared.qll",
-    "ruby/ql/lib/codeql/ruby/controlflow/internal/ControlFlowGraphImplShared.qll"
-  ],
-  "TypeTracker": [
-    "python/ql/lib/semmle/python/dataflow/new/internal/TypeTracker.qll",
-    "ruby/ql/lib/codeql/ruby/typetracking/TypeTracker.qll"
-  ],
-  "CodeQL Tutorial": [
-    "cpp/ql/lib/tutorial.qll",
-    "csharp/ql/lib/tutorial.qll",
-    "java/ql/lib/tutorial.qll",
-    "javascript/ql/lib/tutorial.qll",
-    "python/ql/lib/tutorial.qll",
-    "ruby/ql/lib/tutorial.qll"
+    "javascript/ql/src/semmle/javascript/security/internal/SensitiveDataHeuristics.qll",
+    "python/ql/src/semmle/python/security/internal/SensitiveDataHeuristics.qll"
   ]
 }

cpp/change-notes/2021-06-10-cleartext-transmission.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* A new query (`cpp/cleartext-transmission`) has been added. This is similar to the `cpp/cleartext-storage-file`, `cpp/cleartext-storage-buffer` and `cpp/cleartext-storage-database` queries but looks for cases where sensitive information is most likely transmitted over a network.

cpp/change-notes/2021-06-22-sql-tainted.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* The 'Uncontrolled data in SQL query' (cpp/sql-injection) query now supports the `libpqxx` library.

cpp/change-notes/2021-06-24-uncontrolled-arithmetic.md

@@ -1,2 +0,0 @@
-lgtm
-* The 'Uncontrolled data in arithmetic expression' (cpp/uncontrolled-arithmetic) query now recognizes more sources of randomness.

cpp/change-notes/2021-06-30-wrong-type-format-argument.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* The 'Wrong type of arguments to formatting function' (cpp/wrong-type-format-argument) query is now more accepting of the string and character formatting differences between Microsoft and non-Microsoft platforms.  There are now fewer false positive results.

cpp/change-notes/2021-07-13-cleartext-storage-file.md

@@ -1,3 +0,0 @@
-lgtm,codescanning
-* The "Cleartext storage of sensitive information in file" (cpp/cleartext-storage-file) query now uses dataflow to produce additional results.
-* Heuristics in the SensitiveExprs.qll library have been improved, making the "Cleartext storage of sensitive information in file" (cpp/cleartext-storage-file), "Cleartext storage of sensitive information in buffer" (cpp/cleartext-storage-buffer) and "Cleartext storage of sensitive information in an SQLite" (cpp/cleartext-storage-database) queries more accurate.

cpp/change-notes/2021-07-20-toctou-race-condition.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* Improvements have been made to the `cpp/toctou-race-condition` query, both to find more correct results and fewer false positive results.

cpp/change-notes/2021-07-27-uncontrolled-arithmetic.md

@@ -1,2 +0,0 @@
-lgtm
-* Improvements made to the (`cpp/uncontrolled-arithmetic`) query, reducing the frequency of false positive results.

cpp/change-notes/2021-07-29-virtual-function-declaration-specifiers.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* Virtual function specifiers are now accessible via the new predicates on `Function` (`.isDeclaredVirtual`, `.isOverride`, and `.isFinal`).

cpp/change-notes/2021-08-10-has-trailing-return-type.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* Added `Function.hasTrailingReturnType` predicate to check whether a function was declared with a trailing return type.

cpp/change-notes/2021-08-17-has-c-linkage.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* Added `RoutineType.hasCLinkage` predicate to check whether a function type has "C" language linkage.

cpp/change-notes/2021-08-23-ctime-weaken-claims.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* Lowered the precision of `cpp/potentially-dangerous-function` so it is run but not displayed on LGTM by default and so it's only run and displayed on Code Scanning if a broader suite like `cpp-security-extended` is opted into.

cpp/change-notes/2021-08-23-getPrimaryQlClasses.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* Added `Element.getPrimaryQlClasses()` predicate, which gets a comma-separated list of the names of the primary CodeQL classes to which this element belongs.

cpp/change-notes/2021-08-24-implicit-downcast-from-bitfield.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* The query `cpp/implicit-bitfield-downcast` now accounts for C++ reference types, which leads to more true positive results.

cpp/change-notes/2021-08-31-range-analysis-upper-bound.md

@@ -1,4 +0,0 @@
-lgtm,codescanning
-* The `SimpleRangeAnalysis` library includes information from the
-  immediate guard for determining the upper bound of a stack
-  variable for improved accuracy.

cpp/change-notes/2021-09-13-overflow-static.md

@@ -1,4 +0,0 @@
-lgtm,codescanning
-* The `memberMayBeVarSize` predicate considers more fields to be variable size.
-  As a result, the "Static buffer overflow" query (cpp/static-buffer-overflow)
-  produces fewer false positives.

cpp/change-notes/2021-09-27-command-line-injection.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* The "Uncontrolled data used in OS command" (`cpp/command-line-injection`) query has been enhanced to reduce false positive results and its `@precision` increased to `high`

cpp/change-notes/2021-09-27-overflow-static.md

@@ -1,3 +0,0 @@
-lgtm,codescanning
-* Increase precision to high for the "Static buffer overflow" query
-  (`cpp/static-buffer-overflow`). This means the query is run and displayed by default on Code Scanning and LGTM.

cpp/change-notes/2021-10-01-improper-null-termination.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* Several improvements made to the `NullTermination.qll` library and the 'Potential improper null termination' (cpp/improper-null-termination). These changes reduce the number of false positive results for this query and related query 'User-controlled data may not be null terminated' (cpp/user-controlled-null-termination-tainted).

cpp/change-notes/2021-10-07-extraction-errors.md

@@ -1,3 +0,0 @@
-codescanning
-* Problems with extraction that in most cases won't break the analysis in a significant way are now reported as warnings rather than errors.
-* The failed extractor invocations query now has severity `error`.

cpp/change-notes/2021-11-01-isFromSystemMacroDefinition.md

@@ -1,4 +0,0 @@
-lgtm,codescanning
-* The QL library `semmle.code.cpp.commons.Exclusions` now contains a predicate
-  `isFromSystemMacroDefinition` for identifying code that originates from a
-  macro outside the project being analyzed.

cpp/change-notes/2021-11-09-use-of-http.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* A new query `cpp/non-https-url` has been added for C/C++. The query flags uses of `http` URLs that might be better replaced with `https`.

cpp/ql/examples/qlpack.lock.yml

@@ -1,4 +0,0 @@
----
-dependencies: {}
-compiled: false
-lockVersion: 1.0.0

cpp/ql/examples/qlpack.yml

@@ -1,4 +1,3 @@
-name: codeql/cpp-examples
-version: 0.0.2
-dependencies:
-  codeql/cpp-all: "*"
+name: codeql-cpp-examples
+version: 0.0.0
+libraryPathDependencies: codeql-cpp

cpp/ql/lib/CHANGELOG.md

@@ -1,7 +0,0 @@
-## 0.0.4
-
-### New Features
-
-* The QL library `semmle.code.cpp.commons.Exclusions` now contains a predicate
-  `isFromSystemMacroDefinition` for identifying code that originates from a
-  macro outside the project being analyzed.

cpp/ql/lib/change-notes/released/0.0.4.md

@@ -1,7 +0,0 @@
-## 0.0.4
-
-### New Features
-
-* The QL library `semmle.code.cpp.commons.Exclusions` now contains a predicate
-  `isFromSystemMacroDefinition` for identifying code that originates from a
-  macro outside the project being analyzed.

cpp/ql/lib/codeql-pack.release.yml

@@ -1,2 +0,0 @@
----
-lastReleaseVersion: 0.0.4

cpp/ql/lib/experimental/semmle/code/cpp/security/PrivateData.qll

@@ -1,52 +0,0 @@
-/**
- * Provides classes and predicates for identifying private data and functions for security.
- *
- * 'Private' data in general is anything that would compromise user privacy if exposed. This
- * library tries to guess where private data may either be stored in a variable or produced by a
- * function.
- *
- * This library is not concerned with credentials. See `SensitiveActions` for expressions related
- * to credentials.
- */
-
-import cpp
-
-/** A string for `match` that identifies strings that look like they represent private data. */
-private string privateNames() {
-  result =
-    [
-      // Inspired by the list on https://cwe.mitre.org/data/definitions/359.html
-      // Government identifiers, such as Social Security Numbers
-      "%social%security%number%",
-      // Contact information, such as home addresses and telephone numbers
-      "%postcode%", "%zipcode%",
-      // result = "%telephone%" or
-      // Geographic location - where the user is (or was)
-      "%latitude%", "%longitude%",
-      // Financial data - such as credit card numbers, salary, bank accounts, and debts
-      "%creditcard%", "%salary%", "%bankaccount%",
-      // Communications - e-mail addresses, private e-mail messages, SMS text messages, chat logs, etc.
-      // result = "%email%" or
-      // result = "%mobile%" or
-      "%employer%",
-      // Health - medical conditions, insurance status, prescription records
-      "%medical%"
-    ]
-}
-
-/** An expression that might contain private data. */
-abstract class PrivateDataExpr extends Expr { }
-
-/** A functiond call that might produce private data. */
-class PrivateFunctionCall extends PrivateDataExpr, FunctionCall {
-  PrivateFunctionCall() {
-    exists(string s | this.getTarget().getName().toLowerCase() = s | s.matches(privateNames()))
-  }
-}
-
-/** An access to a variable that might contain private data. */
-class PrivateVariableAccess extends PrivateDataExpr, VariableAccess {
-  PrivateVariableAccess() {
-    exists(string s | this.getTarget().getName().toLowerCase() = s | s.matches(privateNames()))
-  }
-}

cpp/ql/lib/external/ExternalArtifact.qll

@@ -1,60 +0,0 @@
-/**
- * Provides classes for working with external data.
- */
-
-import cpp
-
-/**
- * An external data item.
- */
-class ExternalData extends @externalDataElement {
-  /** Gets the path of the file this data was loaded from. */
-  string getDataPath() { externalData(this, result, _, _) }
-
-  /**
-   * Gets the path of the file this data was loaded from, with its
-   * extension replaced by `.ql`.
-   */
-  string getQueryPath() { result = this.getDataPath().regexpReplaceAll("\\.[^.]*$", ".ql") }
-
-  /** Gets the number of fields in this data item. */
-  int getNumFields() { result = 1 + max(int i | externalData(this, _, i, _) | i) }
-
-  /** Gets the value of the `i`th field of this data item. */
-  string getField(int i) { externalData(this, _, i, result) }
-
-  /** Gets the integer value of the `i`th field of this data item. */
-  int getFieldAsInt(int i) { result = this.getField(i).toInt() }
-
-  /** Gets the floating-point value of the `i`th field of this data item. */
-  float getFieldAsFloat(int i) { result = this.getField(i).toFloat() }
-
-  /** Gets the value of the `i`th field of this data item, interpreted as a date. */
-  date getFieldAsDate(int i) { result = this.getField(i).toDate() }
-
-  /** Gets a textual representation of this data item. */
-  string toString() { result = this.getQueryPath() + ": " + this.buildTupleString(0) }
-
-  /** Gets a textual representation of this data item, starting with the `n`th field. */
-  private string buildTupleString(int n) {
-    n = this.getNumFields() - 1 and result = this.getField(n)
-    or
-    n < this.getNumFields() - 1 and result = this.getField(n) + "," + this.buildTupleString(n + 1)
-  }
-}
-
-/**
- * External data with a location, and a message, as produced by tools that used to produce QLDs.
- */
-class DefectExternalData extends ExternalData {
-  DefectExternalData() {
-    this.getField(0).regexpMatch("\\w+://.*:[0-9]+:[0-9]+:[0-9]+:[0-9]+$") and
-    this.getNumFields() = 2
-  }
-
-  /** Gets the URL associated with this data item. */
-  string getURL() { result = this.getField(0) }
-
-  /** Gets the message associated with this data item. */
-  string getMessage() { result = this.getField(1) }
-}

cpp/ql/lib/qlpack.lock.yml

@@ -1,4 +0,0 @@
----
-dependencies: {}
-compiled: false
-lockVersion: 1.0.0

cpp/ql/lib/qlpack.yml

@@ -1,8 +0,0 @@
-name: codeql/cpp-all
-version: 0.0.4
-groups: cpp
-dbscheme: semmlecode.cpp.dbscheme
-extractor: cpp
-library: true
-dependencies:
-  codeql/cpp-upgrades: 0.0.3

cpp/ql/lib/semmle/code/cpp/Declaration.qll

@@ -1,719 +0,0 @@
-/**
- * Provides classes for working with C and C++ declarations.
- */
-
-import semmle.code.cpp.Element
-import semmle.code.cpp.Specifier
-import semmle.code.cpp.Namespace
-private import semmle.code.cpp.internal.QualifiedName as Q
-
-/**
- * A C/C++ declaration: for example, a variable declaration, a type
- * declaration, or a function declaration.
- *
- * This file defines two closely related classes: `Declaration` and
- * `DeclarationEntry`. Some declarations do not correspond to a unique
- * location in the source code. For example, a global variable might
- * be declared in multiple source files:
- * ```
- *   extern int myglobal;
- * ```
- * and defined in one:
- * ```
- *   int myglobal;
- * ```
- * Each of these declarations (including the definition) is given its own
- * distinct `DeclarationEntry`, but they all share the same `Declaration`.
- *
- * Some derived class of `Declaration` do not have a corresponding
- * `DeclarationEntry`, because they always have a unique source location.
- * `EnumConstant` and `FriendDecl` are both examples of this.
- */
-class Declaration extends Locatable, @declaration {
-  /**
-   * Gets the innermost namespace which contains this declaration.
-   *
-   * The result will either be `GlobalNamespace`, or the tightest lexically
-   * enclosing namespace block. In particular, note that for declarations
-   * within structures, the namespace of the declaration is the same as the
-   * namespace of the structure.
-   */
-  Namespace getNamespace() {
-    result = underlyingElement(this).(Q::Declaration).getNamespace()
-    or
-    exists(Parameter p | p = this and result = p.getFunction().getNamespace())
-    or
-    exists(LocalVariable v | v = this and result = v.getFunction().getNamespace())
-  }
-
-  /**
-   * Gets the name of the declaration, fully qualified with its
-   * namespace and declaring type.
-   *
-   * For performance, prefer the multi-argument `hasQualifiedName` or
-   * `hasGlobalName` predicates since they don't construct so many intermediate
-   * strings. For debugging, the `semmle.code.cpp.Print` module produces more
-   * detailed output but are also more expensive to compute.
-   *
-   * Example: `getQualifiedName() =
-   * "namespace1::namespace2::TemplateClass1<int>::Class2::memberName"`.
-   */
-  string getQualifiedName() { result = underlyingElement(this).(Q::Declaration).getQualifiedName() }
-
-  /**
-   * DEPRECATED: Prefer `hasGlobalName` or the 2-argument or 3-argument
-   * `hasQualifiedName` predicates. To get the exact same results as this
-   * predicate in all edge cases, use `getQualifiedName()`.
-   *
-   * Holds if this declaration has the fully-qualified name `qualifiedName`.
-   * See `getQualifiedName`.
-   */
-  predicate hasQualifiedName(string qualifiedName) { this.getQualifiedName() = qualifiedName }
-
-  /**
-   * Holds if this declaration has a fully-qualified name with a name-space
-   * component of `namespaceQualifier`, a declaring type of `typeQualifier`,
-   * and a base name of `baseName`. Template parameters and arguments are
-   * stripped from all components. Missing components are `""`.
-   *
-   * Example: `hasQualifiedName("namespace1::namespace2",
-   * "TemplateClass1::Class2", "memberName")`.
-   *
-   * Example (the class `std::vector`): `hasQualifiedName("std", "", "vector")`
-   * or `hasQualifiedName("std", "vector")`.
-   *
-   * Example (the `size` member function of class `std::vector`):
-   * `hasQualifiedName("std", "vector", "size")`.
-   */
-  predicate hasQualifiedName(string namespaceQualifier, string typeQualifier, string baseName) {
-    underlyingElement(this)
-        .(Q::Declaration)
-        .hasQualifiedName(namespaceQualifier, typeQualifier, baseName)
-  }
-
-  /**
-   * Holds if this declaration has a fully-qualified name with a name-space
-   * component of `namespaceQualifier`, no declaring type, and a base name of
-   * `baseName`.
-   *
-   * See the 3-argument `hasQualifiedName` for examples.
-   */
-  predicate hasQualifiedName(string namespaceQualifier, string baseName) {
-    this.hasQualifiedName(namespaceQualifier, "", baseName)
-  }
-
-  /**
-   * Gets a description of this `Declaration` for display purposes.
-   */
-  string getDescription() { result = this.getName() }
-
-  final override string toString() { result = this.getDescription() }
-
-  /**
-   * Gets the name of this declaration.
-   *
-   * This name doesn't include a namespace or any argument types, so
-   * for example both functions `::open()` and `::std::ifstream::open(...)`
-   * have the same name. The name of a template _class_ includes a string
-   * representation of its parameters, and the names of its instantiations
-   * include string representations of their arguments. Template _functions_
-   * and their instantiations do not include template parameters or arguments.
-   *
-   * To get the name including the namespace, use `hasQualifiedName`.
-   *
-   * To test whether this declaration has a particular name in the global
-   * namespace, use `hasGlobalName`.
-   */
-  string getName() { none() } // overridden in subclasses
-
-  /** Holds if this declaration has the given name. */
-  predicate hasName(string name) { name = this.getName() }
-
-  /** Holds if this declaration has the given name in the global namespace. */
-  predicate hasGlobalName(string name) { this.hasQualifiedName("", "", name) }
-
-  /** Holds if this declaration has the given name in the global namespace or the `std` namespace. */
-  predicate hasGlobalOrStdName(string name) {
-    this.hasGlobalName(name)
-    or
-    this.hasQualifiedName("std", "", name)
-  }
-
-  /**
-   * Holds if this declaration has the given name in the global namespace,
-   * the `std` namespace or the `bsl` namespace.
-   * We treat `std` and `bsl` as the same in some of our models.
-   */
-  predicate hasGlobalOrStdOrBslName(string name) {
-    this.hasGlobalName(name)
-    or
-    this.hasQualifiedName("std", "", name)
-    or
-    this.hasQualifiedName("bsl", "", name)
-  }
-
-  /** Gets a specifier of this declaration. */
-  Specifier getASpecifier() { none() } // overridden in subclasses
-
-  /** Holds if this declaration has a specifier with the given name. */
-  predicate hasSpecifier(string name) { this.getASpecifier().hasName(name) }
-
-  /**
-   * Gets a declaration entry corresponding to this declaration. See the
-   * comment above this class for an explanation of the relationship
-   * between `Declaration` and `DeclarationEntry`.
-   */
-  DeclarationEntry getADeclarationEntry() { none() }
-
-  /**
-   * Gets the location of a declaration entry corresponding to this
-   * declaration.
-   */
-  Location getADeclarationLocation() { none() } // overridden in subclasses
-
-  /**
-   * Gets the declaration entry corresponding to this declaration that is a
-   * definition, if any.
-   */
-  DeclarationEntry getDefinition() { none() }
-
-  /** Gets the location of the definition, if any. */
-  Location getDefinitionLocation() { none() } // overridden in subclasses
-
-  /** Holds if the declaration has a definition. */
-  predicate hasDefinition() { exists(this.getDefinition()) }
-
-  /** DEPRECATED: Use `hasDefinition` instead. */
-  predicate isDefined() { this.hasDefinition() }
-
-  /** Gets the preferred location of this declaration, if any. */
-  override Location getLocation() { none() }
-
-  /** Gets a file where this element occurs. */
-  File getAFile() { result = this.getADeclarationLocation().getFile() }
-
-  /** Holds if this declaration is a top-level declaration. */
-  predicate isTopLevel() {
-    not (
-      this.isMember() or
-      this instanceof EnumConstant or
-      this instanceof Parameter or
-      this instanceof ProxyClass or
-      this instanceof LocalVariable or
-      this instanceof TemplateParameter or
-      this.(UserType).isLocal()
-    )
-  }
-
-  /** Holds if this declaration is static. */
-  predicate isStatic() { this.hasSpecifier("static") }
-
-  /** Holds if this declaration is a member of a class/struct/union. */
-  predicate isMember() { this.hasDeclaringType() }
-
-  /** Holds if this declaration is a member of a class/struct/union. */
-  predicate hasDeclaringType() { exists(this.getDeclaringType()) }
-
-  /**
-   * Gets the class where this member is declared, if it is a member.
-   * For templates, both the template itself and all instantiations of
-   * the template are considered to have the same declaring class.
-   */
-  Class getDeclaringType() { this = result.getAMember() }
-
-  /**
-   * Gets a template argument used to instantiate this declaration from a template.
-   * When called on a template, this will return a template parameter type for
-   * both typed and non-typed parameters.
-   */
-  final Locatable getATemplateArgument() { result = this.getTemplateArgument(_) }
-
-  /**
-   * Gets a template argument used to instantiate this declaration from a template.
-   * When called on a template, this will return a non-typed template
-   * parameter value.
-   */
-  final Locatable getATemplateArgumentKind() { result = this.getTemplateArgumentKind(_) }
-
-  /**
-   * Gets the `i`th template argument used to instantiate this declaration from a
-   * template.
-   *
-   * For example:
-   *
-   * `template<typename T, T X> class Foo;`
-   *
-   * Will have `getTemplateArgument(0)` return `T`, and
-   * `getTemplateArgument(1)` return `X`.
-   *
-   * `Foo<int, 1> bar;`
-   *
-   * Will have `getTemplateArgument())` return `int`, and
-   * `getTemplateArgument(1)` return `1`.
-   */
-  final Locatable getTemplateArgument(int index) {
-    if exists(this.getTemplateArgumentValue(index))
-    then result = this.getTemplateArgumentValue(index)
-    else result = this.getTemplateArgumentType(index)
-  }
-
-  /**
-   * Gets the `i`th template argument value used to instantiate this declaration
-   * from a template. When called on a template, this will return the `i`th template
-   * parameter value if it exists.
-   *
-   * For example:
-   *
-   * `template<typename T, T X> class Foo;`
-   *
-   * Will have `getTemplateArgumentKind(1)` return `T`, and no result for
-   * `getTemplateArgumentKind(0)`.
-   *
-   * `Foo<int, 10> bar;
-   *
-   * Will have `getTemplateArgumentKind(1)` return `int`, and no result for
-   * `getTemplateArgumentKind(0)`.
-   */
-  final Locatable getTemplateArgumentKind(int index) {
-    exists(this.getTemplateArgumentValue(index)) and
-    result = this.getTemplateArgumentType(index)
-  }
-
-  /** Gets the number of template arguments for this declaration. */
-  final int getNumberOfTemplateArguments() {
-    result = count(int i | exists(this.getTemplateArgument(i)))
-  }
-
-  private Type getTemplateArgumentType(int index) {
-    class_template_argument(underlyingElement(this), index, unresolveElement(result))
-    or
-    function_template_argument(underlyingElement(this), index, unresolveElement(result))
-    or
-    variable_template_argument(underlyingElement(this), index, unresolveElement(result))
-  }
-
-  private Expr getTemplateArgumentValue(int index) {
-    class_template_argument_value(underlyingElement(this), index, unresolveElement(result))
-    or
-    function_template_argument_value(underlyingElement(this), index, unresolveElement(result))
-    or
-    variable_template_argument_value(underlyingElement(this), index, unresolveElement(result))
-  }
-}
-
-private class TDeclarationEntry = @var_decl or @type_decl or @fun_decl;
-
-/**
- * A C/C++ declaration entry. For example the following code contains five
- * declaration entries:
- * ```
- * extern int myGlobal;
- * int myVariable;
- * typedef char MyChar;
- * void myFunction();
- * void myFunction() {
- *   // ...
- * }
- * ```
- * See the comment above `Declaration` for an explanation of the relationship
- * between `Declaration` and `DeclarationEntry`.
- */
-class DeclarationEntry extends Locatable, TDeclarationEntry {
-  /** Gets a specifier associated with this declaration entry. */
-  string getASpecifier() { none() } // overridden in subclasses
-
-  /**
-   * Gets the name associated with the corresponding definition (where
-   * available), or the name declared by this entry otherwise.
-   */
-  string getCanonicalName() {
-    if this.getDeclaration().hasDefinition()
-    then result = this.getDeclaration().getDefinition().getName()
-    else result = this.getName()
-  }
-
-  /**
-   * Gets the declaration for which this is a declaration entry.
-   *
-   * Note that this is *not* always the inverse of
-   * `Declaration.getADeclarationEntry()`, for example if `C` is a
-   * `TemplateClass`, `I` is an instantiation of `C`, and `D` is a
-   * `Declaration` of `C`, then:
-   *  `C.getADeclarationEntry()` returns `D`
-   *  `I.getADeclarationEntry()` returns `D`
-   *  but `D.getDeclaration()` only returns `C`
-   */
-  Declaration getDeclaration() { none() } // overridden in subclasses
-
-  /** Gets the name associated with this declaration entry, if any. */
-  string getName() { none() } // overridden in subclasses
-
-  /**
-   * Gets the type associated with this declaration entry.
-   *
-   * For variable declarations, get the type of the variable.
-   * For function declarations, get the return type of the function.
-   * For type declarations, get the type being declared.
-   */
-  Type getType() { none() } // overridden in subclasses
-
-  /**
-   * Gets the type associated with this declaration entry after specifiers
-   * have been deeply stripped and typedefs have been resolved.
-   *
-   * For variable declarations, get the type of the variable.
-   * For function declarations, get the return type of the function.
-   * For type declarations, get the type being declared.
-   */
-  Type getUnspecifiedType() { result = this.getType().getUnspecifiedType() }
-
-  /**
-   * Holds if this declaration entry has a specifier with the given name.
-   */
-  predicate hasSpecifier(string specifier) { this.getASpecifier() = specifier }
-
-  /** Holds if this declaration entry is a definition. */
-  predicate isDefinition() { none() } // overridden in subclasses
-
-  override string toString() {
-    if this.isDefinition()
-    then result = "definition of " + this.getName()
-    else
-      if this.getName() = this.getCanonicalName()
-      then result = "declaration of " + this.getName()
-      else result = "declaration of " + this.getCanonicalName() + " as " + this.getName()
-  }
-}
-
-private class TAccessHolder = @function or @usertype;
-
-/**
- * A declaration that can potentially have more C++ access rights than its
- * enclosing element. This comprises `Class` (they have access to their own
- * private members) along with other `UserType`s and `Function` (they can be
- * the target of `friend` declarations).  For example `MyClass` and
- * `myFunction` in the following code:
- * ```
- * class MyClass
- * {
- * public:
- *   ...
- * };
- *
- * void myFunction() {
- *   // ...
- * }
- * ```
- * In the C++ standard (N4140 11.2), rules for access control revolve around
- * the informal phrase "_R_ occurs in a member or friend of class C", where
- * `AccessHolder` corresponds to this _R_.
- */
-class AccessHolder extends Declaration, TAccessHolder {
-  /**
-   * Holds if `this` can access private members of class `c`.
-   *
-   * This predicate encodes the phrase "occurs in a member or friend" that is
-   * repeated many times in the C++14 standard, section 11.2.
-   */
-  predicate inMemberOrFriendOf(Class c) {
-    this.getEnclosingAccessHolder*() = c
-    or
-    exists(FriendDecl fd | fd.getDeclaringClass() = c |
-      this.getEnclosingAccessHolder*() = fd.getFriend()
-    )
-  }
-
-  /**
-   * Gets the nearest enclosing `AccessHolder`.
-   */
-  AccessHolder getEnclosingAccessHolder() { none() } // overridden in subclasses
-
-  /**
-   * Holds if a base class `base` of `derived` _is accessible at_ `this` (N4140
-   * 11.2/4). When this holds, and `derived` has only one base subobject of
-   * type `base`, code in `this` can implicitly convert a pointer to `derived`
-   * into a pointer to `base`. Conversely, if such a conversion is possible
-   * then this predicate holds.
-   *
-   * For the sake of generality, this predicate also holds whenever `base` =
-   * `derived`.
-   *
-   * This predicate is `pragma[inline]` because it is infeasible to fully
-   * compute it on large code bases: all classes `derived` can be converted to
-   * their public bases `base` from everywhere (`this`), so this predicate
-   * could yield a number of tuples that is quadratic in the size of the
-   * program. To avoid this combinatorial explosion, only use this predicate in
-   * a context where `this` together with `base` or `derived` are sufficiently
-   * restricted.
-   */
-  pragma[inline]
-  predicate canAccessClass(Class base, Class derived) {
-    // This predicate is marked `inline` and implemented in a very particular
-    // way. If we allowed this predicate to be fully computed, it would relate
-    // all `AccessHolder`s to all classes, which would be too much.
-    // There are four rules in N4140 11.2/4. Only the one named (4.4) is
-    // recursive, and it describes a transitive closure: intuitively, if A can
-    // be converted to B, and B can be converted to C, then A can be converted
-    // to C. To limit the number of tuples in the non-inline helper predicates,
-    // we first separate the derivation of 11.2/4 into two cases:
-    // Derivations using only (4.1) and (4.4). Note that these derivations are
-    // independent of `this`, which is why users of this predicate must take
-    // care to avoid a combinatorial explosion.
-    isDirectPublicBaseOf*(base, derived)
-    or
-    exists(DirectAccessHolder n |
-      this.getEnclosingAccessHolder*() = n and
-      // Derivations using (4.2) or (4.3) at least once.
-      n.thisCanAccessClassTrans(base, derived)
-    )
-  }
-
-  /**
-   * Holds if a non-static member `member` _is accessible at_ `this` when named
-   * in a class `derived` that is derived from or equal to the declaring class
-   * of `member` (N4140 11.2/5 and 11.4).
-   *
-   * This predicate determines whether an expression `x.member` would be
-   * allowed in `this` when `x` has type `derived`. The more general syntax
-   * `x.N::member`, where `N` may be a base class of `derived`, is not
-   * supported. This should only affect very rare edge cases of 11.4. This
-   * predicate concerns only _access_ and thus does not determine whether
-   * `member` can be unambiguously named at `this`: multiple overloads may
-   * apply, or `member` may be declared in an ambiguous base class.
-   *
-   * This predicate is `pragma[inline]` because it is infeasible to fully
-   * compute it on large code bases: all public members `member` are accessible
-   * from everywhere (`this`), so this predicate could yield a number of tuples
-   * that is quadratic in the size of the program. To avoid this combinatorial
-   * explosion, only use this predicate in a context where `this` and `member`
-   * are sufficiently restricted when `member` is public.
-   */
-  pragma[inline]
-  predicate canAccessMember(Declaration member, Class derived) {
-    this.couldAccessMember(member.getDeclaringType(), member.getASpecifier(), derived)
-  }
-
-  /**
-   * Holds if a hypothetical non-static member of `memberClass` with access
-   * specifier `memberAccess` _is accessible at_ `this` when named in a class
-   * `derived` that is derived from or equal to `memberClass` (N4140 11.2/5 and
-   * 11.4).
-   *
-   * This predicate determines whether an expression `x.m` would be
-   * allowed in `this` when `x` has type `derived` and `m` has `memberAccess`
-   * in `memberClass`. The more general syntax `x.N::n`, where `N` may be a
-   * base class of `derived`, is not supported. This should only affect very
-   * rare edge cases of 11.4.
-   *
-   * This predicate is `pragma[inline]` because it is infeasible to fully
-   * compute it on large code bases: all classes `memberClass` have their
-   * public members accessible from everywhere (`this`), so this predicate
-   * could yield a number of tuples that is quadratic in the size of the
-   * program. To avoid this combinatorial explosion, only use this predicate in
-   * a context where `this` and `memberClass` are sufficiently restricted when
-   * `memberAccess` is public.
-   */
-  pragma[inline]
-  predicate couldAccessMember(Class memberClass, AccessSpecifier memberAccess, Class derived) {
-    // There are four rules in N4140 11.2/5. To limit the number of tuples in
-    // the non-inline helper predicates, we first separate the derivation of
-    // 11.2/5 into two cases:
-    // Rule (5.1) directly: the member is public, and `derived` uses public
-    // inheritance all the way up to `memberClass`. Note that these derivations
-    // are independent of `this`, which is why users of this predicate must
-    // take care to avoid a combinatorial explosion.
-    everyoneCouldAccessMember(memberClass, memberAccess, derived)
-    or
-    exists(DirectAccessHolder n |
-      this.getEnclosingAccessHolder*() = n and
-      // Any other derivation.
-      n.thisCouldAccessMember(memberClass, memberAccess, derived)
-    )
-  }
-}
-
-/**
- * A declaration that very likely has more C++ access rights than its
- * enclosing element. This comprises `Class` (they have access to their own
- * private members) along with any target of a `friend` declaration.  For
- * example `MyClass` and `friendFunction` in the following code:
- * ```
- * class MyClass
- * {
- * public:
- *   friend void friendFunction();
- * };
- *
- * void friendFunction() {
- *   // ...
- * }
- * ```
- * Most access rights are computed for `DirectAccessHolder` instead of
- * `AccessHolder` -- that's more efficient because there are fewer
- * `DirectAccessHolder`s. If a `DirectAccessHolder` contains an `AccessHolder`,
- * then the contained `AccessHolder` inherits its access rights.
- */
-private class DirectAccessHolder extends Element {
-  DirectAccessHolder() {
-    this instanceof Class
-    or
-    exists(FriendDecl fd | fd.getFriend() = this)
-  }
-
-  /**
-   * Holds if a base class `base` of `derived` _is accessible at_ `this` when
-   * the derivation of that fact uses rule (4.2) and (4.3) of N4140 11.2/4 at
-   * least once. In other words, the `this` parameter is not ignored. This
-   * restriction makes it feasible to fully enumerate this predicate even on
-   * large code bases.
-   */
-  predicate thisCanAccessClassTrans(Class base, Class derived) {
-    // This implementation relies on the following property of our predicates:
-    // if `this.thisCanAccessClassStep(b, d)` and
-    // `isDirectPublicBaseOf(b2, b)`, then
-    // `this.thisCanAccessClassStep(b2, d)`. In other words, if a derivation
-    // uses (4.2) or (4.3) somewhere and uses (4.1) directly above that in the
-    // transitive chain, then the use of (4.1) is redundant. This means we only
-    // need to consider derivations that use (4.2) or (4.3) as the "first"
-    // step, that is, towards `base`, so this implementation is essentially a
-    // transitive closure with a restricted base case.
-    this.thisCanAccessClassStep(base, derived)
-    or
-    exists(Class between | this.thisCanAccessClassTrans(base, between) |
-      isDirectPublicBaseOf(between, derived) or
-      this.thisCanAccessClassStep(between, derived)
-    )
-    // It is possible that this predicate could be computed faster for deep
-    // hierarchies if we can prove and utilize that all derivations of 11.2/4
-    // can be broken down into steps where `base` is a _direct_ base of
-    // `derived` in each step.
-  }
-
-  /**
-   * Holds if a base class `base` of `derived` _is accessible at_ `this` using
-   * only a single application of rule (4.2) and (4.3) of N4140 11.2/4.
-   */
-  private predicate thisCanAccessClassStep(Class base, Class derived) {
-    exists(AccessSpecifier public | public.hasName("public") |
-      // Rules (4.2) and (4.3) are implemented together as one here with
-      // reflexive-transitive inheritance, where (4.3) is the transitive case,
-      // and (4.2) is the reflexive case.
-      exists(Class p | p = derived.getADerivedClass*() |
-        this.isFriendOfOrEqualTo(p) and
-        // Note: it's crucial that this is `!=` rather than `not =` since
-        // `accessOfBaseMember` does not have a result when the member would be
-        // inaccessible.
-        p.accessOfBaseMember(base, public) != public
-      )
-    ) and
-    // This is the only case that doesn't in itself guarantee that
-    // `derived` < `base`, so we add the check here. The standard suggests
-    // computing `canAccessClass` only for derived classes, but that seems
-    // incompatible with the execution model of QL, so we instead construct
-    // every case to guarantee `derived` < `base`.
-    derived = base.getADerivedClass+()
-  }
-
-  /**
-   * Like `couldAccessMember` but only contains derivations in which either
-   * (5.2), (5.3) or (5.4) must be invoked. In other words, the `this`
-   * parameter is not ignored. This restriction makes it feasible to fully
-   * enumerate this predicate even on large code bases. We check for 11.4 as
-   * part of (5.3), since this further limits the number of tuples produced by
-   * this predicate.
-   */
-  predicate thisCouldAccessMember(Class memberClass, AccessSpecifier memberAccess, Class derived) {
-    // Only (5.4) is recursive, and chains of invocations of (5.4) can always
-    // be collapsed to one invocation by the transitivity of 11.2/4.
-    // Derivations not using (5.4) can always be rewritten to have a (5.4) rule
-    // in front because our encoding of 11.2/4 in `canAccessClass` is
-    // reflexive. Thus, we only need to consider three cases: rule (5.4)
-    // followed by either (5.1), (5.2) or (5.3).
-    // Rule (5.4), using a non-trivial derivation of 11.2/4, followed by (5.1).
-    // If the derivation of 11.2/4 is trivial (only uses (4.1) and (4.4)), this
-    // case can be replaced with purely (5.1) and thus does not need to be in
-    // this predicate.
-    exists(Class between | this.thisCanAccessClassTrans(between, derived) |
-      everyoneCouldAccessMember(memberClass, memberAccess, between)
-    )
-    or
-    // Rule (5.4) followed by Rule (5.2)
-    exists(Class between | this.(AccessHolder).canAccessClass(between, derived) |
-      between.accessOfBaseMember(memberClass, memberAccess).hasName("private") and
-      this.isFriendOfOrEqualTo(between)
-    )
-    or
-    // Rule (5.4) followed by Rule (5.3), integrating 11.4. We integrate 11.4
-    // here because we would otherwise generate too many tuples. This code is
-    // very performance-sensitive, and any changes should be benchmarked on
-    // LibreOffice.
-    // Rule (5.4) requires that `this.canAccessClass(between, derived)`
-    // (implying that `derived <= between` in the class hierarchy) and that
-    // `p <= between`. Rule 11.4 additionally requires `derived <= p`, but
-    // all these rules together result in too much freedom and overlap between
-    // cases. Therefore, for performance, we split into three cases for how
-    // `between` as a base of `derived` is accessible at `this`, where `this`
-    // is the implementation of `p`:
-    // 1. `between` is an accessible base of `derived` by going through `p` as
-    //    an intermediate step.
-    // 2. `this` is part of the implementation of `derived` because it's a
-    //    member or a friend. In this case, we do not need `p` to perform this
-    //    derivation, so we can set `p = derived` and proceed as in case 1.
-    // 3. `derived` has an alternative inheritance path up to `between` that
-    //    bypasses `p`. Then that path must be public, or we are in case 2.
-    exists(AccessSpecifier public | public.hasName("public") |
-      exists(Class between, Class p |
-        between.accessOfBaseMember(memberClass, memberAccess).hasName("protected") and
-        this.isFriendOfOrEqualTo(p) and
-        (
-          // This is case 1 from above. If `p` derives privately from `between`
-          // then the member we're trying to access is private or inaccessible
-          // in `derived`, so either rule (5.2) applies instead, or the member
-          // is inaccessible. Therefore, in this case, `p` must derive at least
-          // protected from `between`. Further, since the access of `derived`
-          // to its base `between` must pass through `p` in this case, we know
-          // that `derived` must derived publicly from `p` unless we are in
-          // case 2; there are no other cases of 11.2/4 where the
-          // implementation of a base class can access itself as a base.
-          p.accessOfBaseMember(between, public).getName() >= "protected" and
-          derived.accessOfBaseMember(p, public) = public
-          or
-          // This is case 3 above.
-          derived.accessOfBaseMember(between, public) = public and
-          derived = p.getADerivedClass*() and
-          exists(p.accessOfBaseMember(between, memberAccess))
-        )
-      )
-    )
-  }
-
-  private predicate isFriendOfOrEqualTo(Class c) {
-    exists(FriendDecl fd | fd.getDeclaringClass() = c | this = fd.getFriend())
-    or
-    this = c
-  }
-}
-
-/**
- * Holds if `base` is a direct public base of `derived`, possibly virtual and
- * possibly through typedefs. The transitive closure of this predicate encodes
- * derivations of N4140 11.2/4 that use only (4.1) and (4.4).
- */
-private predicate isDirectPublicBaseOf(Class base, Class derived) {
-  exists(ClassDerivation cd |
-    cd.getBaseClass() = base and
-    cd.getDerivedClass() = derived and
-    cd.getASpecifier().hasName("public")
-  )
-}
-
-/**
- * Holds if a hypothetical member of `memberClass` with access specifier
- * `memberAccess` would be public when named as a member of `derived`.
- * This encodes N4140 11.2/5 case (5.1).
- */
-private predicate everyoneCouldAccessMember(
-  Class memberClass, AccessSpecifier memberAccess, Class derived
-) {
-  derived.accessOfBaseMember(memberClass, memberAccess).hasName("public")
-}

cpp/ql/lib/semmle/code/cpp/Element.qll

@@ -1,297 +0,0 @@
-/**
- * Provides the `Element` class, which is the base class for all classes representing C or C++
- * program elements.
- */
-
-import semmle.code.cpp.Location
-private import semmle.code.cpp.Enclosing
-private import semmle.code.cpp.internal.ResolveClass
-
-/**
- * Get the `Element` that represents this `@element`.
- * Normally this will simply be a cast of `e`, but sometimes it is not.
- * For example, for an incomplete struct `e` the result may be a
- * complete struct with the same name.
- */
-pragma[inline]
-Element mkElement(@element e) { unresolveElement(result) = e }
-
-/**
- * INTERNAL: Do not use.
- *
- * Gets an `@element` that resolves to the `Element`. This should
- * normally only be called from member predicates, where `e` is not
- * `this` and you need the result for an argument to a database
- * extensional.
- * See `underlyingElement` for when `e` is `this`.
- */
-pragma[inline]
-@element unresolveElement(Element e) {
-  not result instanceof @usertype and
-  result = e
-  or
-  e = resolveClass(result)
-}
-
-/**
- * INTERNAL: Do not use.
- *
- * Gets the `@element` that this `Element` extends. This should normally
- * only be called from member predicates, where `e` is `this` and you
- * need the result for an argument to a database extensional.
- * See `unresolveElement` for when `e` is not `this`.
- */
-@element underlyingElement(Element e) { result = e }
-
-/**
- * A C/C++ element with no member predicates other than `toString`. Not for
- * general use. This class does not define a location, so classes wanting to
- * change their location without affecting other classes can extend
- * `ElementBase` instead of `Element` to create a new rootdef for `getURL`,
- * `getLocation`, or `hasLocationInfo`.
- */
-class ElementBase extends @element {
-  /** Gets a textual representation of this element. */
-  cached
-  string toString() { none() }
-
-  /** DEPRECATED: use `getAPrimaryQlClass` instead. */
-  deprecated string getCanonicalQLClass() { result = this.getAPrimaryQlClass() }
-
-  /**
-   * Gets a comma-separated list of the names of the primary CodeQL classes to which this element belongs.
-   */
-  final string getPrimaryQlClasses() { result = concat(this.getAPrimaryQlClass(), ",") }
-
-  /**
-   * Gets the name of a primary CodeQL class to which this element belongs.
-   *
-   * For most elements, this is simply the most precise syntactic category to
-   * which they belong; for example, `AddExpr` is a primary class, but
-   * `BinaryOperation` is not.
-   *
-   * This predicate can have multiple results if multiple primary classes match.
-   * For some elements, this predicate may not have a result.
-   */
-  string getAPrimaryQlClass() { none() }
-}
-
-/**
- * A C/C++ element. This class is the base class for all C/C++
- * elements, such as functions, classes, expressions, and so on.
- */
-class Element extends ElementBase {
-  /** Gets the primary file where this element occurs. */
-  File getFile() { result = this.getLocation().getFile() }
-
-  /**
-   * Holds if this element may be from source. This predicate holds for all
-   * elements, except for those in the dummy file, whose name is the empty string.
-   * The dummy file contains declarations that are built directly into the compiler.
-   */
-  predicate fromSource() { this.getFile().fromSource() }
-
-  /**
-   * Holds if this element may be from a library.
-   *
-   * DEPRECATED: always true.
-   */
-  deprecated predicate fromLibrary() { this.getFile().fromLibrary() }
-
-  /** Gets the primary location of this element. */
-  Location getLocation() { none() }
-
-  /**
-   * Gets the source of this element: either itself or a macro that expanded
-   * to this element.
-   *
-   * If the element is not in a macro expansion, then the "root" is just
-   * the element itself. Otherwise, it is the definition of the innermost
-   * macro whose expansion the element is in.
-   *
-   * This method is useful for filtering macro results in checks: simply
-   * blame `e.findRootCause` rather than `e`. This will report only bugs
-   * that are not in macros, and in addition report macros that (somewhere)
-   * expand to a bug.
-   */
-  Element findRootCause() {
-    if exists(MacroInvocation mi | this = mi.getAGeneratedElement())
-    then
-      exists(MacroInvocation mi |
-        this = mi.getAGeneratedElement() and
-        not exists(MacroInvocation closer |
-          this = closer.getAGeneratedElement() and
-          mi = closer.getParentInvocation+()
-        ) and
-        result = mi.getMacro()
-      )
-    else result = this
-  }
-
-  /**
-   * Gets the parent scope of this `Element`, if any.
-   * A scope is a `Type` (`Class` / `Enum`), a `Namespace`, a `BlockStmt`, a `Function`,
-   * or certain kinds of `Statement`.
-   */
-  Element getParentScope() {
-    // result instanceof class
-    exists(Declaration m |
-      m = this and
-      result = m.getDeclaringType() and
-      not this instanceof EnumConstant
-    )
-    or
-    exists(TemplateClass tc | this = tc.getATemplateArgument() and result = tc)
-    or
-    // result instanceof namespace
-    exists(Namespace n | result = n and n.getADeclaration() = this)
-    or
-    exists(FriendDecl d, Namespace n | this = d and n.getADeclaration() = d and result = n)
-    or
-    exists(Namespace n | this = n and result = n.getParentNamespace())
-    or
-    // result instanceof stmt
-    exists(LocalVariable v |
-      this = v and
-      exists(DeclStmt ds | ds.getADeclaration() = v and result = ds.getParent())
-    )
-    or
-    exists(Parameter p | this = p and result = p.getFunction())
-    or
-    exists(GlobalVariable g, Namespace n | this = g and n.getADeclaration() = g and result = n)
-    or
-    exists(EnumConstant e | this = e and result = e.getDeclaringEnum())
-    or
-    // result instanceof block|function
-    exists(BlockStmt b | this = b and blockscope(unresolveElement(b), unresolveElement(result)))
-    or
-    exists(TemplateFunction tf | this = tf.getATemplateArgument() and result = tf)
-    or
-    // result instanceof stmt
-    exists(ControlStructure s | this = s and result = s.getParent())
-    or
-    using_container(unresolveElement(result), underlyingElement(this))
-  }
-
-  /**
-   * Holds if this element comes from a macro expansion. Only elements that
-   * are entirely generated by a macro are included - for elements that
-   * partially come from a macro, see `isAffectedByMacro`.
-   */
-  predicate isInMacroExpansion() { inMacroExpansion(this) }
-
-  /**
-   * Holds if this element is affected in any way by a macro. All elements
-   * that are totally or partially generated by a macro are included, so
-   * this is a super-set of `isInMacroExpansion`.
-   */
-  predicate isAffectedByMacro() { affectedByMacro(this) }
-
-  private Element getEnclosingElementPref() {
-    enclosingfunction(underlyingElement(this), unresolveElement(result)) or
-    result.(Function) = stmtEnclosingElement(this) or
-    this.(LocalScopeVariable).getFunction() = result or
-    enumconstants(underlyingElement(this), unresolveElement(result), _, _, _, _) or
-    derivations(underlyingElement(this), unresolveElement(result), _, _, _) or
-    stmtparents(underlyingElement(this), _, unresolveElement(result)) or
-    exprparents(underlyingElement(this), _, unresolveElement(result)) or
-    namequalifiers(underlyingElement(this), unresolveElement(result), _, _) or
-    initialisers(underlyingElement(this), unresolveElement(result), _, _) or
-    exprconv(unresolveElement(result), underlyingElement(this)) or
-    param_decl_bind(underlyingElement(this), _, unresolveElement(result)) or
-    using_container(unresolveElement(result), underlyingElement(this)) or
-    static_asserts(unresolveElement(this), _, _, _, underlyingElement(result))
-  }
-
-  /** Gets the closest `Element` enclosing this one. */
-  cached
-  Element getEnclosingElement() {
-    result = this.getEnclosingElementPref()
-    or
-    not exists(this.getEnclosingElementPref()) and
-    (
-      this = result.(Class).getAMember()
-      or
-      result = exprEnclosingElement(this)
-      or
-      var_decls(underlyingElement(this), unresolveElement(result), _, _, _)
-    )
-  }
-
-  /**
-   * Holds if this `Element` is a part of a template instantiation (but not
-   * the template itself).
-   */
-  predicate isFromTemplateInstantiation(Element instantiation) {
-    exists(Element e | isFromTemplateInstantiationRec(e, instantiation) |
-      this = e or
-      this.(DeclarationEntry).getDeclaration() = e
-    )
-  }
-
-  /**
-   * Holds if this `Element` is part of a template `template` (not if it is
-   * part of an instantiation of `template`). This means it is represented in
-   * the database purely as syntax and without guarantees on the presence or
-   * correctness of type-based operations such as implicit conversions.
-   *
-   * If an element is nested within several templates, this predicate holds with
-   * a value of `template` for each containing template.
-   */
-  predicate isFromUninstantiatedTemplate(Element template) {
-    exists(Element e | isFromUninstantiatedTemplateRec(e, template) |
-      this = e or
-      this.(DeclarationEntry).getDeclaration() = e
-    )
-  }
-}
-
-private predicate isFromTemplateInstantiationRec(Element e, Element instantiation) {
-  instantiation.(Function).isConstructedFrom(_) and
-  e = instantiation
-  or
-  instantiation.(Class).isConstructedFrom(_) and
-  e = instantiation
-  or
-  instantiation.(Variable).isConstructedFrom(_) and
-  e = instantiation
-  or
-  isFromTemplateInstantiationRec(e.getEnclosingElement(), instantiation)
-}
-
-private predicate isFromUninstantiatedTemplateRec(Element e, Element template) {
-  is_class_template(unresolveElement(template)) and
-  e = template
-  or
-  is_function_template(unresolveElement(template)) and
-  e = template
-  or
-  is_variable_template(unresolveElement(template)) and
-  e = template
-  or
-  isFromUninstantiatedTemplateRec(e.getEnclosingElement(), template)
-}
-
-/**
- * A C++11 `static_assert` or C11 `_Static_assert` construct. For example each
- * line in the following example contains a static assert:
- * ```
- * static_assert(sizeof(MyStruct) <= 4096);
- * static_assert(sizeof(MyStruct) <= 4096, "MyStruct is too big!");
- * ```
- */
-class StaticAssert extends Locatable, @static_assert {
-  override string toString() { result = "static_assert(..., \"" + this.getMessage() + "\")" }
-
-  /**
-   * Gets the expression which this static assertion ensures is true.
-   */
-  Expr getCondition() { static_asserts(underlyingElement(this), unresolveElement(result), _, _, _) }
-
-  /**
-   * Gets the message which will be reported by the compiler if this static assertion fails.
-   */
-  string getMessage() { static_asserts(underlyingElement(this), _, result, _, _) }
-
-  override Location getLocation() { static_asserts(underlyingElement(this), _, _, result, _) }
-}

cpp/ql/lib/semmle/code/cpp/File.qll

@@ -1,452 +0,0 @@
-/**
- * Provides classes representing files and folders.
- */
-
-import semmle.code.cpp.Element
-import semmle.code.cpp.Declaration
-import semmle.code.cpp.metrics.MetricFile
-
-/** A file or folder. */
-class Container extends Locatable, @container {
-  /**
-   * Gets the absolute, canonical path of this container, using forward slashes
-   * as path separator.
-   *
-   * The path starts with a _root prefix_ followed by zero or more _path
-   * segments_ separated by forward slashes.
-   *
-   * The root prefix is of one of the following forms:
-   *
-   *   1. A single forward slash `/` (Unix-style)
-   *   2. An upper-case drive letter followed by a colon and a forward slash,
-   *      such as `C:/` (Windows-style)
-   *   3. Two forward slashes, a computer name, and then another forward slash,
-   *      such as `//FileServer/` (UNC-style)
-   *
-   * Path segments are never empty (that is, absolute paths never contain two
-   * contiguous slashes, except as part of a UNC-style root prefix). Also, path
-   * segments never contain forward slashes, and no path segment is of the
-   * form `.` (one dot) or `..` (two dots).
-   *
-   * Note that an absolute path never ends with a forward slash, except if it is
-   * a bare root prefix, that is, the path has no path segments. A container
-   * whose absolute path has no segments is always a `Folder`, not a `File`.
-   */
-  string getAbsolutePath() { none() } // overridden by subclasses
-
-  /**
-   * DEPRECATED: Use `getLocation` instead.
-   * Gets a URL representing the location of this container.
-   *
-   * For more information see [Providing URLs](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/#providing-urls).
-   */
-  deprecated string getURL() { none() } // overridden by subclasses
-
-  /**
-   * Gets the relative path of this file or folder from the root folder of the
-   * analyzed source location. The relative path of the root folder itself is
-   * the empty string.
-   *
-   * This has no result if the container is outside the source root, that is,
-   * if the root folder is not a reflexive, transitive parent of this container.
-   */
-  string getRelativePath() {
-    exists(string absPath, string pref |
-      absPath = this.getAbsolutePath() and sourceLocationPrefix(pref)
-    |
-      absPath = pref and result = ""
-      or
-      absPath = pref.regexpReplaceAll("/$", "") + "/" + result and
-      not result.matches("/%")
-    )
-  }
-
-  /**
-   * Gets the base name of this container including extension, that is, the last
-   * segment of its absolute path, or the empty string if it has no segments.
-   *
-   * Here are some examples of absolute paths and the corresponding base names
-   * (surrounded with quotes to avoid ambiguity):
-   *
-   * <table border="1">
-   * <tr><th>Absolute path</th><th>Base name</th></tr>
-   * <tr><td>"/tmp/tst.js"</td><td>"tst.js"</td></tr>
-   * <tr><td>"C:/Program Files (x86)"</td><td>"Program Files (x86)"</td></tr>
-   * <tr><td>"/"</td><td>""</td></tr>
-   * <tr><td>"C:/"</td><td>""</td></tr>
-   * <tr><td>"D:/"</td><td>""</td></tr>
-   * <tr><td>"//FileServer/"</td><td>""</td></tr>
-   * </table>
-   */
-  string getBaseName() {
-    result = this.getAbsolutePath().regexpCapture(".*/(([^/]*?)(?:\\.([^.]*))?)", 1)
-  }
-
-  /**
-   * Gets the extension of this container, that is, the suffix of its base name
-   * after the last dot character, if any.
-   *
-   * In particular,
-   *
-   *  - if the name does not include a dot, there is no extension, so this
-   *    predicate has no result;
-   *  - if the name ends in a dot, the extension is the empty string;
-   *  - if the name contains multiple dots, the extension follows the last dot.
-   *
-   * Here are some examples of absolute paths and the corresponding extensions
-   * (surrounded with quotes to avoid ambiguity):
-   *
-   * <table border="1">
-   * <tr><th>Absolute path</th><th>Extension</th></tr>
-   * <tr><td>"/tmp/tst.js"</td><td>"js"</td></tr>
-   * <tr><td>"/tmp/.classpath"</td><td>"classpath"</td></tr>
-   * <tr><td>"/bin/bash"</td><td>not defined</td></tr>
-   * <tr><td>"/tmp/tst2."</td><td>""</td></tr>
-   * <tr><td>"/tmp/x.tar.gz"</td><td>"gz"</td></tr>
-   * </table>
-   */
-  string getExtension() {
-    result = this.getAbsolutePath().regexpCapture(".*/([^/]*?)(\\.([^.]*))?", 3)
-  }
-
-  /**
-   * Gets the stem of this container, that is, the prefix of its base name up to
-   * (but not including) the last dot character if there is one, or the entire
-   * base name if there is not.
-   *
-   * Here are some examples of absolute paths and the corresponding stems
-   * (surrounded with quotes to avoid ambiguity):
-   *
-   * <table border="1">
-   * <tr><th>Absolute path</th><th>Stem</th></tr>
-   * <tr><td>"/tmp/tst.js"</td><td>"tst"</td></tr>
-   * <tr><td>"/tmp/.classpath"</td><td>""</td></tr>
-   * <tr><td>"/bin/bash"</td><td>"bash"</td></tr>
-   * <tr><td>"/tmp/tst2."</td><td>"tst2"</td></tr>
-   * <tr><td>"/tmp/x.tar.gz"</td><td>"x.tar"</td></tr>
-   * </table>
-   */
-  string getStem() {
-    result = this.getAbsolutePath().regexpCapture(".*/([^/]*?)(?:\\.([^.]*))?", 1)
-  }
-
-  /** Gets the parent container of this file or folder, if any. */
-  Container getParentContainer() {
-    containerparent(unresolveElement(result), underlyingElement(this))
-  }
-
-  /** Gets a file or sub-folder in this container. */
-  Container getAChildContainer() { this = result.getParentContainer() }
-
-  /** Gets a file in this container. */
-  File getAFile() { result = this.getAChildContainer() }
-
-  /** Gets the file in this container that has the given `baseName`, if any. */
-  File getFile(string baseName) {
-    result = this.getAFile() and
-    result.getBaseName() = baseName
-  }
-
-  /** Gets a sub-folder in this container. */
-  Folder getAFolder() { result = this.getAChildContainer() }
-
-  /** Gets the sub-folder in this container that has the given `baseName`, if any. */
-  Folder getFolder(string baseName) {
-    result = this.getAFolder() and
-    result.getBaseName() = baseName
-  }
-
-  /**
-   * Gets a textual representation of the path of this container.
-   *
-   * This is the absolute path of the container.
-   */
-  override string toString() { result = this.getAbsolutePath() }
-}
-
-/**
- * A folder that was observed on disk during the build process.
- *
- * For the example folder name of "/usr/home/me", the path decomposes to:
- *
- *  1. "/usr/home" - see `getParentContainer`.
- *  2. "me" - see `getBaseName`.
- *
- * To get the full path, use `getAbsolutePath`.
- */
-class Folder extends Container, @folder {
-  override string getAbsolutePath() { folders(underlyingElement(this), result) }
-
-  override Location getLocation() {
-    result.getContainer() = this and
-    result.hasLocationInfo(_, 0, 0, 0, 0)
-  }
-
-  override string getAPrimaryQlClass() { result = "Folder" }
-
-  /**
-   * DEPRECATED: Use `getLocation` instead.
-   * Gets the URL of this folder.
-   */
-  deprecated override string getURL() { result = "file://" + this.getAbsolutePath() + ":0:0:0:0" }
-
-  /**
-   * DEPRECATED: use `getAbsolutePath` instead.
-   * Gets the name of this folder.
-   */
-  deprecated string getName() { folders(underlyingElement(this), result) }
-
-  /**
-   * DEPRECATED: use `getAbsolutePath` instead.
-   * Holds if this element is named `name`.
-   */
-  deprecated predicate hasName(string name) { name = this.getName() }
-
-  /**
-   * DEPRECATED: use `getAbsolutePath` instead.
-   * Gets the full name of this folder.
-   */
-  deprecated string getFullName() { result = this.getName() }
-
-  /**
-   * DEPRECATED: use `getBaseName` instead.
-   * Gets the last part of the folder name.
-   */
-  deprecated string getShortName() { result = this.getBaseName() }
-
-  /**
-   * DEPRECATED: use `getParentContainer` instead.
-   * Gets the parent folder.
-   */
-  deprecated Folder getParent() {
-    containerparent(unresolveElement(result), underlyingElement(this))
-  }
-}
-
-/**
- * A file that was observed on disk during the build process.
- *
- * For the example filename of "/usr/home/me/myprogram.c", the filename
- * decomposes to:
- *
- *  1. "/usr/home/me" - see `getParentContainer`.
- *  2. "myprogram.c" - see `getBaseName`.
- *
- * The base name further decomposes into the _stem_ and _extension_ -- see
- * `getStem` and `getExtension`. To get the full path, use `getAbsolutePath`.
- */
-class File extends Container, @file {
-  override string getAbsolutePath() { files(underlyingElement(this), result) }
-
-  override string toString() { result = Container.super.toString() }
-
-  override string getAPrimaryQlClass() { result = "File" }
-
-  override Location getLocation() {
-    result.getContainer() = this and
-    result.hasLocationInfo(_, 0, 0, 0, 0)
-  }
-
-  /**
-   * DEPRECATED: Use `getLocation` instead.
-   * Gets the URL of this file.
-   */
-  deprecated override string getURL() { result = "file://" + this.getAbsolutePath() + ":0:0:0:0" }
-
-  /** Holds if this file was compiled as C (at any point). */
-  predicate compiledAsC() { fileannotations(underlyingElement(this), 1, "compiled as c", "1") }
-
-  /** Holds if this file was compiled as C++ (at any point). */
-  predicate compiledAsCpp() { fileannotations(underlyingElement(this), 1, "compiled as c++", "1") }
-
-  /**
-   * Holds if this file was compiled by a Microsoft compiler (at any point).
-   *
-   * Note: currently unreliable - on some projects only some of the files that
-   * are compiled by a Microsoft compiler are detected by this predicate.
-   */
-  predicate compiledAsMicrosoft() {
-    exists(File f, Compilation c |
-      c.getAFileCompiled() = f and
-      (
-        c.getAnArgument() = "--microsoft" or
-        c.getAnArgument()
-            .toLowerCase()
-            .replaceAll("\\", "/")
-            .matches(["%/cl.exe", "%/clang-cl.exe"])
-      ) and
-      f.getAnIncludedFile*() = this
-    )
-  }
-
-  /** Gets a top-level element declared in this file. */
-  Declaration getATopLevelDeclaration() { result.getAFile() = this and result.isTopLevel() }
-
-  /** Gets a declaration in this file. */
-  Declaration getADeclaration() { result.getAFile() = this }
-
-  /** Holds if this file uses the given macro. */
-  predicate usesMacro(Macro m) {
-    exists(MacroInvocation mi |
-      mi.getFile() = this and
-      mi.getMacro() = m
-    )
-  }
-
-  /**
-   * Gets a file that is directly included from this file (using a
-   * pre-processor directive like `#include`).
-   */
-  File getAnIncludedFile() {
-    exists(Include i | i.getFile() = this and i.getIncludedFile() = result)
-  }
-
-  /**
-   * Holds if this file may be from source. This predicate holds for all files
-   * except the dummy file, whose name is the empty string, which contains
-   * declarations that are built into the compiler.
-   */
-  override predicate fromSource() { numlines(underlyingElement(this), _, _, _) }
-
-  /**
-   * Holds if this file may be from a library.
-   *
-   * DEPRECATED: For historical reasons this is true for any file.
-   */
-  deprecated override predicate fromLibrary() { any() }
-
-  /** Gets the metric file. */
-  MetricFile getMetrics() { result = this }
-
-  /**
-   * Gets the remainder of the base name after the first dot character. Note
-   * that the name of this predicate is in plural form, unlike `getExtension`,
-   * which gets the remainder of the base name after the _last_ dot character.
-   *
-   * Predicates `getStem` and `getExtension` should be preferred over
-   * `getShortName` and `getExtensions` since the former pair is compatible
-   * with the file libraries of other languages.
-   * Note the slight difference between this predicate and `getStem`:
-   * for example, for "file.tar.gz", this predicate will have the result
-   * "tar.gz", while `getExtension` will have the result "gz".
-   */
-  string getExtensions() {
-    exists(string name, int firstDotPos |
-      name = this.getBaseName() and
-      firstDotPos = min([name.indexOf("."), name.length() - 1]) and
-      result = name.suffix(firstDotPos + 1)
-    )
-  }
-
-  /**
-   * Gets the short name of this file, that is, the prefix of its base name up
-   * to (but not including) the first dot character if there is one, or the
-   * entire base name if there is not. For example, if the full name is
-   * "/path/to/filename.a.bcd" then the short name is "filename".
-   *
-   * Predicates `getStem` and `getExtension` should be preferred over
-   * `getShortName` and `getExtensions` since the former pair is compatible
-   * with the file libraries of other languages.
-   * Note the slight difference between this predicate and `getStem`:
-   * for example, for "file.tar.gz", this predicate will have the result
-   * "file", while `getStem` will have the result "file.tar".
-   */
-  string getShortName() {
-    exists(string name, int firstDotPos |
-      name = this.getBaseName() and
-      firstDotPos = min([name.indexOf("."), name.length()]) and
-      result = name.prefix(firstDotPos)
-    )
-    or
-    this.getAbsolutePath() = "" and
-    result = ""
-  }
-}
-
-/**
- * Holds if any file was compiled by a Microsoft compiler.
- */
-predicate anyFileCompiledAsMicrosoft() { any(File f).compiledAsMicrosoft() }
-
-/**
- * A C/C++ header file, as determined (mainly) by file extension.
- *
- * For the related notion of whether a file is included anywhere (using a
- * pre-processor directive like `#include`), use `Include.getIncludedFile`.
- */
-class HeaderFile extends File {
-  HeaderFile() {
-    this.getExtension().toLowerCase() =
-      ["h", "r", "hpp", "hxx", "h++", "hh", "hp", "tcc", "tpp", "txx", "t++"]
-    or
-    not exists(this.getExtension()) and
-    exists(Include i | i.getIncludedFile() = this)
-  }
-
-  override string getAPrimaryQlClass() { result = "HeaderFile" }
-
-  /**
-   * Holds if this header file does not contain any declaration entries or top level
-   * declarations.  For example it might be:
-   *  - a file containing only preprocessor directives and/or comments
-   *  - an empty file
-   *  - a file that contains non-top level code or data that's included in an
-   *    unusual way
-   */
-  predicate noTopLevelCode() {
-    not exists(DeclarationEntry de | de.getFile() = this) and
-    not exists(Declaration d | d.getFile() = this and d.isTopLevel()) and
-    not exists(UsingEntry ue | ue.getFile() = this)
-  }
-}
-
-/**
- * A C source file, as determined by file extension.
- *
- * For the related notion of whether a file is compiled as C code, use
- * `File.compiledAsC`.
- */
-class CFile extends File {
-  CFile() { this.getExtension().toLowerCase() = ["c", "i"] }
-
-  override string getAPrimaryQlClass() { result = "CFile" }
-}
-
-/**
- * A C++ source file, as determined by file extension.
- *
- * For the related notion of whether a file is compiled as C++ code, use
- * `File.compiledAsCpp`.
- */
-class CppFile extends File {
-  CppFile() {
-    this.getExtension().toLowerCase() =
-      ["cpp", "cxx", "c++", "cc", "cp", "icc", "ipp", "ixx", "i++", "ii"]
-    // Note: .C files are indistinguishable from .c files on some
-    // file systems, so we just treat them as CFile's.
-  }
-
-  override string getAPrimaryQlClass() { result = "CppFile" }
-}
-
-/**
- * DEPRECATED: Objective-C is no longer supported.
- * An Objective C source file, as determined by file extension.
- *
- * For the related notion of whether a file is compiled as Objective C
- * code, use `File.compiledAsObjC`.
- */
-deprecated class ObjCFile extends File {
-  ObjCFile() { none() }
-}
-
-/**
- * DEPRECATED: Objective-C is no longer supported.
- * An Objective C++ source file, as determined by file extension.
- *
- * For the related notion of whether a file is compiled as Objective C++
- * code, use `File.compiledAsObjCpp`.
- */
-deprecated class ObjCppFile extends File {
-  ObjCppFile() { none() }
-}

cpp/ql/lib/semmle/code/cpp/Function.qll

@@ -1,877 +0,0 @@
-/**
- * Provides classes for working with functions, including template functions.
- */
-
-import semmle.code.cpp.Location
-import semmle.code.cpp.Class
-import semmle.code.cpp.Parameter
-import semmle.code.cpp.exprs.Call
-import semmle.code.cpp.metrics.MetricFunction
-import semmle.code.cpp.Linkage
-private import semmle.code.cpp.internal.ResolveClass
-
-/**
- * A C/C++ function [N4140 8.3.5]. Both member functions and non-member
- * functions are included. For example the function `MyFunction` in:
- * ```
- * void MyFunction() {
- *   DoSomething();
- * }
- * ```
- *
- * Function has a one-to-many relationship with FunctionDeclarationEntry,
- * because the same function can be declared in multiple locations. This
- * relationship between `Declaration` and `DeclarationEntry` is explained
- * in more detail in `Declaration.qll`.
- */
-class Function extends Declaration, ControlFlowNode, AccessHolder, @function {
-  override string getName() { functions(underlyingElement(this), result, _) }
-
-  /**
-   * DEPRECATED: Use `getIdentityString(Declaration)` from `semmle.code.cpp.Print` instead.
-   * Gets the full signature of this function, including return type, parameter
-   * types, and template arguments.
-   *
-   * For example, in the following code:
-   * ```
-   * template<typename T> T min(T x, T y);
-   * int z = min(5, 7);
-   * ```
-   * The full signature of the function called on the last line would be
-   * "min<int>(int, int) -> int", and the full signature of the uninstantiated
-   * template on the first line would be "min<T>(T, T) -> T".
-   */
-  string getFullSignature() {
-    exists(string name, string templateArgs, string args |
-      result = name + templateArgs + args + " -> " + this.getType().toString() and
-      name = this.getQualifiedName() and
-      (
-        if exists(this.getATemplateArgument())
-        then
-          templateArgs =
-            "<" +
-              concat(int i |
-                exists(this.getTemplateArgument(i))
-              |
-                this.getTemplateArgument(i).toString(), ", " order by i
-              ) + ">"
-        else templateArgs = ""
-      ) and
-      args =
-        "(" +
-          concat(int i |
-            exists(this.getParameter(i))
-          |
-            this.getParameter(i).getType().toString(), ", " order by i
-          ) + ")"
-    )
-  }
-
-  /** Gets a specifier of this function. */
-  override Specifier getASpecifier() {
-    funspecifiers(underlyingElement(this), unresolveElement(result)) or
-    result.hasName(this.getADeclarationEntry().getASpecifier())
-  }
-
-  /** Gets an attribute of this function. */
-  Attribute getAnAttribute() { funcattributes(underlyingElement(this), unresolveElement(result)) }
-
-  /** Holds if this function is generated by the compiler. */
-  predicate isCompilerGenerated() { compgenerated(underlyingElement(this)) }
-
-  /** Holds if this function is inline. */
-  predicate isInline() { this.hasSpecifier("inline") }
-
-  /**
-   * Holds if this function is virtual.
-   *
-   * Unlike `isDeclaredVirtual()`, `isVirtual()` holds even if the function
-   * is not explicitly declared with the `virtual` specifier.
-   */
-  predicate isVirtual() { this.hasSpecifier("virtual") }
-
-  /** Holds if this function is declared with the `virtual` specifier. */
-  predicate isDeclaredVirtual() { this.hasSpecifier("declared_virtual") }
-
-  /** Holds if this function is declared with the `override` specifier. */
-  predicate isOverride() { this.hasSpecifier("override") }
-
-  /** Holds if this function is declared with the `final` specifier. */
-  predicate isFinal() { this.hasSpecifier("final") }
-
-  /**
-   * Holds if this function is deleted.
-   * This may be because it was explicitly deleted with an `= delete`
-   * definition, or because the compiler was unable to auto-generate a
-   * definition for it.
-   *
-   * Most implicitly deleted functions are omitted from the database.
-   * `Class.implicitCopyConstructorDeleted` and
-   * `Class.implicitCopyAssignmentOperatorDeleted` can be used to find
-   * whether a class would have had those members implicitly deleted.
-   */
-  predicate isDeleted() { function_deleted(underlyingElement(this)) }
-
-  /**
-   * Holds if this function is explicitly defaulted with the `= default`
-   * specifier.
-   */
-  predicate isDefaulted() { function_defaulted(underlyingElement(this)) }
-
-  /**
-   * Holds if this function is declared to be `constexpr`.
-   *
-   * Note that this does not hold if the function has been declared
-   * `consteval`.
-   */
-  predicate isDeclaredConstexpr() { this.hasSpecifier("declared_constexpr") }
-
-  /**
-   * Holds if this function is `constexpr`. Normally, this holds if and
-   * only if `isDeclaredConstexpr()` holds, but in some circumstances
-   * they differ. For example, with
-   * ```
-   * int f(int i) { return 6; }
-   * template <typename T> constexpr int g(T x) { return f(x); }
-   * ```
-   * `g<int>` is declared constexpr, but is not constexpr.
-   *
-   * Will also hold if this function is `consteval`.
-   */
-  predicate isConstexpr() { this.hasSpecifier("is_constexpr") }
-
-  /**
-   * Holds if this function is declared to be `consteval`.
-   */
-  predicate isConsteval() { this.hasSpecifier("is_consteval") }
-
-  /**
-   * Holds if this function is declared with `__attribute__((naked))` or
-   * `__declspec(naked)`.
-   */
-  predicate isNaked() { this.getAnAttribute().hasName("naked") }
-
-  /**
-   * Holds if this function has a trailing return type.
-   *
-   * Note that this is true whether or not deduction took place. For example,
-   * this holds for both `e` and `f`, but not `g` or `h`:
-   * ```
-   * auto e() -> int { return 0; }
-   * auto f() -> auto { return 0; }
-   * auto g() { return 0; }
-   * int h() { return 0; }
-   * ```
-   */
-  predicate hasTrailingReturnType() { this.hasSpecifier("has_trailing_return_type") }
-
-  /** Gets the return type of this function. */
-  Type getType() { function_return_type(underlyingElement(this), unresolveElement(result)) }
-
-  /**
-   * Gets the return type of this function after specifiers have been deeply
-   * stripped and typedefs have been resolved.
-   */
-  Type getUnspecifiedType() { result = this.getType().getUnspecifiedType() }
-
-  /**
-   * Gets the nth parameter of this function. There is no result for the
-   * implicit `this` parameter, and there is no `...` varargs pseudo-parameter.
-   */
-  Parameter getParameter(int n) { params(unresolveElement(result), underlyingElement(this), n, _) }
-
-  /**
-   * Gets a parameter of this function. There is no result for the implicit
-   * `this` parameter, and there is no `...` varargs pseudo-parameter.
-   */
-  Parameter getAParameter() { params(unresolveElement(result), underlyingElement(this), _, _) }
-
-  /**
-   * Gets an access of this function.
-   *
-   * To get calls to this function, use `getACallToThisFunction` instead.
-   */
-  FunctionAccess getAnAccess() { result.getTarget() = this }
-
-  /**
-   * Gets the number of parameters of this function, _not_ including any
-   * implicit `this` parameter or any `...` varargs pseudo-parameter.
-   */
-  int getNumberOfParameters() { result = count(this.getAParameter()) }
-
-  /**
-   * Gets the number of parameters of this function, _including_ any implicit
-   * `this` parameter but _not_ including any `...` varargs pseudo-parameter.
-   */
-  int getEffectiveNumberOfParameters() {
-    // This method is overridden in `MemberFunction`, where the result is
-    // adjusted to account for the implicit `this` parameter.
-    result = this.getNumberOfParameters()
-  }
-
-  /**
-   * Gets a string representing the parameters of this function.
-   *
-   * For example: for a function `int Foo(int p1, int p2)` this would
-   * return `int p1, int p2`.
-   */
-  string getParameterString() {
-    result = concat(int i | | min(this.getParameter(i).getTypedName()), ", " order by i)
-  }
-
-  /** Gets a call to this function. */
-  FunctionCall getACallToThisFunction() { result.getTarget() = this }
-
-  /**
-   * Gets a declaration entry corresponding to this declaration. The
-   * relationship between `Declaration` and `DeclarationEntry` is explained
-   * in `Declaration.qll`.
-   */
-  override FunctionDeclarationEntry getADeclarationEntry() {
-    if fun_decls(_, underlyingElement(this), _, _, _)
-    then this.declEntry(result)
-    else
-      exists(Function f |
-        this.isConstructedFrom(f) and
-        fun_decls(unresolveElement(result), unresolveElement(f), _, _, _)
-      )
-  }
-
-  private predicate declEntry(FunctionDeclarationEntry fde) {
-    fun_decls(unresolveElement(fde), underlyingElement(this), _, _, _) and
-    // If one .cpp file specializes a function, and another calls the
-    // specialized function, then when extracting the second we only see an
-    // instantiation, not the specialization. We Therefore need to ignore
-    // any non-specialized declarations if there are any specialized ones.
-    (this.isSpecialization() implies fde.isSpecialization())
-  }
-
-  /**
-   * Gets the location of a `FunctionDeclarationEntry` corresponding to this
-   * declaration.
-   */
-  override Location getADeclarationLocation() { result = this.getADeclarationEntry().getLocation() }
-
-  /** Holds if this Function is a Template specialization. */
-  predicate isSpecialization() {
-    exists(FunctionDeclarationEntry fde |
-      fun_decls(unresolveElement(fde), underlyingElement(this), _, _, _) and
-      fde.isSpecialization()
-    )
-  }
-
-  /**
-   * Gets the declaration entry corresponding to this declaration that is a
-   * definition, if any.
-   */
-  override FunctionDeclarationEntry getDefinition() {
-    result = this.getADeclarationEntry() and
-    result.isDefinition()
-  }
-
-  /** Gets the location of the definition, if any. */
-  override Location getDefinitionLocation() {
-    if exists(this.getDefinition())
-    then result = this.getDefinition().getLocation()
-    else exists(Function f | this.isConstructedFrom(f) and result = f.getDefinition().getLocation())
-  }
-
-  /**
-   * Gets the preferred location of this declaration. (The location of the
-   * definition, if possible.)
-   */
-  override Location getLocation() {
-    if exists(this.getDefinition())
-    then result = this.getDefinitionLocation()
-    else result = this.getADeclarationLocation()
-  }
-
-  /** Gets a child declaration of this function. */
-  Declaration getADeclaration() { result = this.getAParameter() }
-
-  /**
-   * Gets the block that is the function body.
-   *
-   * For C++ functions whose body is a function try statement rather than a
-   * block, this gives the block guarded by the try statement. See
-   * `FunctionTryStmt` for further information.
-   */
-  BlockStmt getBlock() { result.getParentScope() = this }
-
-  /** Holds if this function has an entry point. */
-  predicate hasEntryPoint() { exists(this.getEntryPoint()) }
-
-  /**
-   * Gets the first node in this function's control flow graph.
-   *
-   * For most functions, this first node will be the `BlockStmt` returned by
-   * `getBlock`. However in C++, the first node can also be a
-   * `FunctionTryStmt`.
-   */
-  Stmt getEntryPoint() { function_entry_point(underlyingElement(this), unresolveElement(result)) }
-
-  /**
-   * Gets the metric class. `MetricFunction` has methods for computing
-   * various metrics, such as "number of lines of code" and "number of
-   * function calls".
-   */
-  MetricFunction getMetrics() { result = this }
-
-  /** Holds if this function calls the function `f`. */
-  predicate calls(Function f) { exists(Locatable l | this.calls(f, l)) }
-
-  /**
-   * Holds if this function calls the function `f` in the `FunctionCall`
-   * expression `l`.
-   */
-  predicate calls(Function f, Locatable l) {
-    exists(FunctionCall call |
-      call.getEnclosingFunction() = this and call.getTarget() = f and call = l
-    )
-    or
-    exists(DestructorCall call |
-      call.getEnclosingFunction() = this and call.getTarget() = f and call = l
-    )
-  }
-
-  /** Holds if this function accesses a function or variable or enumerator `a`. */
-  predicate accesses(Declaration a) { exists(Locatable l | this.accesses(a, l)) }
-
-  /**
-   * Holds if this function accesses a function or variable or enumerator `a`
-   * in the `Access` expression `l`.
-   */
-  predicate accesses(Declaration a, Locatable l) {
-    exists(Access access |
-      access.getEnclosingFunction() = this and
-      a = access.getTarget() and
-      access = l
-    )
-  }
-
-  /** Gets a variable that is written-to in this function. */
-  Variable getAWrittenVariable() {
-    exists(ConstructorFieldInit cfi |
-      cfi.getEnclosingFunction() = this and result = cfi.getTarget()
-    )
-    or
-    exists(VariableAccess va |
-      va = result.getAnAccess() and
-      va.isUsedAsLValue() and
-      va.getEnclosingFunction() = this
-    )
-  }
-
-  /**
-   * Gets the class of which this function, called `memberName`, is a member.
-   *
-   * Prefer to use `getDeclaringType()` or `getName()` directly if you do not
-   * need to reason about both.
-   */
-  pragma[nomagic]
-  Class getClassAndName(string memberName) {
-    this.hasName(memberName) and
-    this.getDeclaringType() = result
-  }
-
-  /**
-   * Implements `ControlFlowNode.getControlFlowScope`. The `Function` is
-   * used to represent the exit node of the control flow graph, so it is
-   * its own scope.
-   */
-  override Function getControlFlowScope() { result = this }
-
-  /**
-   * Implements `ControlFlowNode.getEnclosingStmt`. The `Function` is
-   * used to represent the exit node of the control flow graph, so it
-   * has no enclosing statement.
-   */
-  override Stmt getEnclosingStmt() { none() }
-
-  /**
-   * Holds if this function has C linkage, as specified by one of its
-   * declaration entries. For example: `extern "C" void foo();`.
-   */
-  predicate hasCLinkage() { this.getADeclarationEntry().hasCLinkage() }
-
-  /**
-   * Holds if this function is constructed from `f` as a result
-   * of template instantiation. If so, it originates either from a template
-   * function or from a function nested in a template class.
-   */
-  predicate isConstructedFrom(Function f) {
-    function_instantiation(underlyingElement(this), unresolveElement(f))
-  }
-
-  /**
-   * Holds if this function is defined in several files. This is illegal in
-   * C (though possible in some C++ compilers), and likely indicates that
-   * several functions that are not linked together have been compiled. An
-   * example would be a project with many 'main' functions.
-   */
-  predicate isMultiplyDefined() { strictcount(this.getFile()) > 1 }
-
-  /** Holds if this function is a varargs function. */
-  predicate isVarargs() { this.hasSpecifier("varargs") }
-
-  /** Gets a type that is specified to be thrown by the function. */
-  Type getAThrownType() { result = this.getADeclarationEntry().getAThrownType() }
-
-  /**
-   * Gets the `i`th type specified to be thrown by the function.
-   */
-  Type getThrownType(int i) { result = this.getADeclarationEntry().getThrownType(i) }
-
-  /** Holds if the function has an exception specification. */
-  predicate hasExceptionSpecification() { this.getADeclarationEntry().hasExceptionSpecification() }
-
-  /** Holds if this function has a `throw()` exception specification. */
-  predicate isNoThrow() { this.getADeclarationEntry().isNoThrow() }
-
-  /** Holds if this function has a `noexcept` exception specification. */
-  predicate isNoExcept() { this.getADeclarationEntry().isNoExcept() }
-
-  /**
-   * Gets a function that overloads this one.
-   *
-   * Note: if _overrides_ are wanted rather than _overloads_ then
-   * `MemberFunction::getAnOverridingFunction` should be used instead.
-   */
-  Function getAnOverload() {
-    (
-      // If this function is declared in a class, only consider other
-      // functions from the same class.
-      exists(string name, Class declaringType |
-        candGetAnOverloadMember(name, declaringType, this) and
-        candGetAnOverloadMember(name, declaringType, result)
-      )
-      or
-      // Conversely, if this function is not
-      // declared in a class, only consider other functions not declared in a
-      // class.
-      exists(string name, Namespace namespace |
-        candGetAnOverloadNonMember(name, namespace, this) and
-        candGetAnOverloadNonMember(name, namespace, result)
-      )
-    ) and
-    result != this and
-    // Instantiations and specializations don't participate in overload
-    // resolution.
-    not (
-      this instanceof FunctionTemplateInstantiation or
-      result instanceof FunctionTemplateInstantiation
-    ) and
-    not (
-      this instanceof FunctionTemplateSpecialization or
-      result instanceof FunctionTemplateSpecialization
-    )
-  }
-
-  /** Gets a link target which compiled or referenced this function. */
-  LinkTarget getALinkTarget() { this = result.getAFunction() }
-
-  /**
-   * Holds if this function is side-effect free (conservative
-   * approximation).
-   */
-  predicate isSideEffectFree() { not this.mayHaveSideEffects() }
-
-  /**
-   * Holds if this function may have side-effects; if in doubt, we assume it
-   * may.
-   */
-  predicate mayHaveSideEffects() {
-    // If we cannot see the definition then we assume that it may have
-    // side-effects.
-    if exists(this.getEntryPoint())
-    then
-      // If it might be globally impure (we don't care about it modifying
-      // temporaries) then it may have side-effects.
-      this.getEntryPoint().mayBeGloballyImpure()
-      or
-      // Constructor initializers are separate from the entry point ...
-      this.(Constructor).getAnInitializer().mayBeGloballyImpure()
-      or
-      // ... and likewise for destructors.
-      this.(Destructor).getADestruction().mayBeGloballyImpure()
-    else
-      // Unless it's a function that we know is side-effect free, it may
-      // have side-effects.
-      not this.hasGlobalOrStdName([
-          "strcmp", "wcscmp", "_mbscmp", "strlen", "wcslen", "_mbslen", "_mbslen_l", "_mbstrlen",
-          "_mbstrlen_l", "strnlen", "strnlen_s", "wcsnlen", "wcsnlen_s", "_mbsnlen", "_mbsnlen_l",
-          "_mbstrnlen", "_mbstrnlen_l", "strncmp", "wcsncmp", "_mbsncmp", "_mbsncmp_l", "strchr",
-          "memchr", "wmemchr", "memcmp", "wmemcmp", "_memicmp", "_memicmp_l", "feof", "isdigit",
-          "isxdigit", "abs", "fabs", "labs", "floor", "ceil", "atoi", "atol", "atoll", "atof"
-        ])
-  }
-
-  /**
-   * Gets the nearest enclosing AccessHolder.
-   */
-  override AccessHolder getEnclosingAccessHolder() { result = this.getDeclaringType() }
-}
-
-pragma[noinline]
-private predicate candGetAnOverloadMember(string name, Class declaringType, Function f) {
-  f.getName() = name and
-  f.getDeclaringType() = declaringType
-}
-
-pragma[noinline]
-private predicate candGetAnOverloadNonMember(string name, Namespace namespace, Function f) {
-  f.getName() = name and
-  f.getNamespace() = namespace and
-  not exists(f.getDeclaringType())
-}
-
-/**
- * A particular declaration or definition of a C/C++ function. For example the
- * declaration and definition of `MyFunction` in the following code are each a
- * `FunctionDeclarationEntry`:
- * ```
- * void MyFunction();
- *
- * void MyFunction() {
- *   DoSomething();
- * }
- * ```
- */
-class FunctionDeclarationEntry extends DeclarationEntry, @fun_decl {
-  /** Gets the function which is being declared or defined. */
-  override Function getDeclaration() { result = this.getFunction() }
-
-  override string getAPrimaryQlClass() { result = "FunctionDeclarationEntry" }
-
-  /** Gets the function which is being declared or defined. */
-  Function getFunction() { fun_decls(underlyingElement(this), unresolveElement(result), _, _, _) }
-
-  /** Gets the name of the function. */
-  override string getName() { fun_decls(underlyingElement(this), _, _, result, _) }
-
-  /**
-   * Gets the return type of the function which is being declared or
-   * defined.
-   */
-  override Type getType() { fun_decls(underlyingElement(this), _, unresolveElement(result), _, _) }
-
-  /** Gets the location of this declaration entry. */
-  override Location getLocation() { fun_decls(underlyingElement(this), _, _, _, result) }
-
-  /** Gets a specifier associated with this declaration entry. */
-  override string getASpecifier() { fun_decl_specifiers(underlyingElement(this), result) }
-
-  /**
-   * Implements `Element.getEnclosingElement`. A function declaration does
-   * not have an enclosing element.
-   */
-  override Element getEnclosingElement() { none() }
-
-  /**
-   * Gets the typedef type (if any) used for this function declaration. As
-   * an example, the typedef type in the declaration of function foo in the
-   * following is Foo:
-   *
-   * typedef int Foo();
-   * static Foo foo;
-   */
-  TypedefType getTypedefType() {
-    fun_decl_typedef_type(underlyingElement(this), unresolveElement(result))
-  }
-
-  /**
-   * Gets the cyclomatic complexity of this function:
-   *
-   *   The number of branching statements (if, while, do, for, switch,
-   *   case, catch) plus the number of branching expressions (`?`, `&&`,
-   *   `||`) plus one.
-   */
-  int getCyclomaticComplexity() { result = 1 + cyclomaticComplexityBranches(this.getBlock()) }
-
-  /**
-   * If this is a function definition, get the block containing the
-   * function body.
-   */
-  BlockStmt getBlock() {
-    this.isDefinition() and
-    result = this.getFunction().getBlock() and
-    result.getFile() = this.getFile()
-  }
-
-  /**
-   * If this is a function definition, get the number of lines of code
-   * associated with it.
-   */
-  pragma[noopt]
-  int getNumberOfLines() {
-    exists(BlockStmt b, Location l, int start, int end, int diff | b = this.getBlock() |
-      l = b.getLocation() and
-      start = l.getStartLine() and
-      end = l.getEndLine() and
-      diff = end - start and
-      result = diff + 1
-    )
-  }
-
-  /**
-   * Gets the declaration entry for a parameter of this function
-   * declaration.
-   */
-  ParameterDeclarationEntry getAParameterDeclarationEntry() {
-    result = this.getParameterDeclarationEntry(_)
-  }
-
-  /**
-   * Gets the declaration entry for the nth parameter of this function
-   * declaration.
-   */
-  ParameterDeclarationEntry getParameterDeclarationEntry(int n) {
-    param_decl_bind(unresolveElement(result), n, underlyingElement(this))
-  }
-
-  /** Gets the number of parameters of this function declaration. */
-  int getNumberOfParameters() { result = count(this.getAParameterDeclarationEntry()) }
-
-  /**
-   * Gets a string representing the parameters of this function declaration.
-   *
-   * For example: for a function 'int Foo(int p1, int p2)' this would
-   * return 'int p1, int p2'.
-   */
-  string getParameterString() {
-    result =
-      concat(int i | | min(this.getParameterDeclarationEntry(i).getTypedName()), ", " order by i)
-  }
-
-  /**
-   * Holds if this declaration entry specifies C linkage:
-   *
-   *    `extern "C" void foo();`
-   */
-  predicate hasCLinkage() { this.getASpecifier() = "c_linkage" }
-
-  /** Holds if this declaration entry has a void parameter list. */
-  predicate hasVoidParamList() { this.getASpecifier() = "void_param_list" }
-
-  /** Holds if this declaration is also a definition of its function. */
-  override predicate isDefinition() { fun_def(underlyingElement(this)) }
-
-  /** Holds if this declaration is a Template specialization. */
-  predicate isSpecialization() { fun_specialized(underlyingElement(this)) }
-
-  /**
-   * Holds if this declaration is an implicit function declaration, that is,
-   * where a function is used before it is declared (under older C standards).
-   */
-  predicate isImplicit() { fun_implicit(underlyingElement(this)) }
-
-  /** Gets a type that is specified to be thrown by the declared function. */
-  Type getAThrownType() { result = this.getThrownType(_) }
-
-  /**
-   * Gets the `i`th type specified to be thrown by the declared function
-   * (where `i` is indexed from 0). For example, if a function is declared
-   * to `throw(int,float)`, then the thrown type with index 0 would be
-   * `int`, and that with index 1 would be `float`.
-   */
-  Type getThrownType(int i) {
-    fun_decl_throws(underlyingElement(this), i, unresolveElement(result))
-  }
-
-  /**
-   * If this declaration has a noexcept-specification [N4140 15.4], then
-   * this predicate returns the argument to `noexcept` if one was given.
-   */
-  Expr getNoExceptExpr() { fun_decl_noexcept(underlyingElement(this), unresolveElement(result)) }
-
-  /**
-   * Holds if the declared function has an exception specification [N4140
-   * 15.4].
-   */
-  predicate hasExceptionSpecification() {
-    fun_decl_throws(underlyingElement(this), _, _) or
-    fun_decl_noexcept(underlyingElement(this), _) or
-    this.isNoThrow() or
-    this.isNoExcept()
-  }
-
-  /**
-   * Holds if the declared function has a `throw()` exception specification.
-   */
-  predicate isNoThrow() { fun_decl_empty_throws(underlyingElement(this)) }
-
-  /**
-   * Holds if the declared function has an empty `noexcept` exception
-   * specification.
-   */
-  predicate isNoExcept() { fun_decl_empty_noexcept(underlyingElement(this)) }
-}
-
-/**
- * A C/C++ non-member function (a function that is not a member of any
- * class). For example, in the following code, `MyFunction` is a
- * `TopLevelFunction` but `MyMemberFunction` is not:
- * ```
- * void MyFunction() {
- *   DoSomething();
- * }
- *
- * class MyClass {
- * public:
- *   void MyMemberFunction() {
- *     DoSomething();
- *   }
- * };
- * ```
- */
-class TopLevelFunction extends Function {
-  TopLevelFunction() { not this.isMember() }
-
-  override string getAPrimaryQlClass() { result = "TopLevelFunction" }
-}
-
-/**
- * A C++ user-defined operator [N4140 13.5].
- */
-class Operator extends Function {
-  Operator() { functions(underlyingElement(this), _, 5) }
-
-  override string getAPrimaryQlClass() {
-    not this instanceof MemberFunction and result = "Operator"
-  }
-}
-
-/**
- * A C++ function which has a non-empty template argument list. For example
- * the function `myTemplateFunction` in the following code:
- * ```
- * template<class T>
- * void myTemplateFunction(T t) {
- *   ...
- * }
- * ```
- *
- * This comprises function declarations which are immediately preceded by
- * `template <...>`, where the "..." part is not empty, and therefore it does
- * not include:
- *
- *   1. Full specializations of template functions, as they have an empty
- *      template argument list.
- *   2. Instantiations of template functions, as they don't have an
- *      explicit template argument list.
- *   3. Member functions of template classes - unless they have their own
- *      (non-empty) template argument list.
- */
-class TemplateFunction extends Function {
-  TemplateFunction() {
-    is_function_template(underlyingElement(this)) and exists(this.getATemplateArgument())
-  }
-
-  override string getAPrimaryQlClass() { result = "TemplateFunction" }
-
-  /**
-   * Gets a compiler-generated instantiation of this function template.
-   */
-  Function getAnInstantiation() {
-    result.isConstructedFrom(this) and
-    not result.isSpecialization()
-  }
-
-  /**
-   * Gets a full specialization of this function template.
-   *
-   * Note that unlike classes, functions overload rather than specialize
-   * partially. Therefore this does not include things which "look like"
-   * partial specializations, nor does it include full specializations of
-   * such things -- see FunctionTemplateSpecialization for further details.
-   */
-  FunctionTemplateSpecialization getASpecialization() { result.getPrimaryTemplate() = this }
-}
-
-/**
- * A function that is an instantiation of a template. For example
- * the instantiation `myTemplateFunction<int>` in the following code:
- * ```
- * template<class T>
- * void myTemplateFunction(T t) {
- *   ...
- * }
- *
- * void caller(int i) {
- *   myTemplateFunction<int>(i);
- * }
- * ```
- */
-class FunctionTemplateInstantiation extends Function {
-  TemplateFunction tf;
-
-  FunctionTemplateInstantiation() { tf.getAnInstantiation() = this }
-
-  override string getAPrimaryQlClass() { result = "FunctionTemplateInstantiation" }
-
-  /**
-   * Gets the function template from which this instantiation was instantiated.
-   *
-   * Example: For `int const& std::min<int>(int const&, int const&)`, returns `T const& min<T>(T const&, T const&)`.
-   */
-  TemplateFunction getTemplate() { result = tf }
-}
-
-/**
- * An explicit specialization of a C++ function template. For example the
- * function `myTemplateFunction<int>` in the following code:
- * ```
- * template<class T>
- * void myTemplateFunction(T t) {
- *   ...
- * }
- *
- * template<>
- * void myTemplateFunction<int>(int i) {
- *   ...
- * }
- * ```
- *
- * Note that unlike classes, functions overload rather than specialize
- * partially. Therefore this only includes the last two of the following
- * four definitions, and in particular does not include the second one:
- *
- * ```
- * template <typename T> void f(T) {...}
- * template <typename T> void f(T*) {...}
- * template <> void f<int>(int *) {...}
- * template <> void f<int*>(int *) {...}
- * ```
- *
- * Furthermore, this does not include compiler-generated instantiations of
- * function templates.
- *
- * For further reference on function template specializations, see:
- *   http://www.gotw.ca/publications/mill17.htm
- */
-class FunctionTemplateSpecialization extends Function {
-  FunctionTemplateSpecialization() { this.isSpecialization() }
-
-  override string getAPrimaryQlClass() { result = "FunctionTemplateSpecialization" }
-
-  /**
-   * Gets the primary template for the specialization (the function template
-   * this specializes).
-   */
-  TemplateFunction getPrimaryTemplate() { this.isConstructedFrom(result) }
-}
-
-/**
- * A GCC built-in function. For example: `__builtin___memcpy_chk`.
- */
-class BuiltInFunction extends Function {
-  BuiltInFunction() { functions(underlyingElement(this), _, 6) }
-
-  /** Gets a dummy location for the built-in function. */
-  override Location getLocation() {
-    suppressUnusedThis(this) and
-    result instanceof UnknownDefaultLocation
-  }
-}
-
-private predicate suppressUnusedThis(Function f) { any() }

cpp/ql/lib/semmle/code/cpp/Location.qll

@@ -1,173 +0,0 @@
-/**
- * Provides classes and predicates for locations in the source code.
- */
-
-import semmle.code.cpp.Element
-import semmle.code.cpp.File
-
-/**
- * A location of a C/C++ artifact.
- */
-class Location extends @location {
-  /** Gets the container corresponding to this location. */
-  Container getContainer() { this.fullLocationInfo(result, _, _, _, _) }
-
-  /** Gets the file corresponding to this location, if any. */
-  File getFile() { result = this.getContainer() }
-
-  /** Gets the 1-based line number (inclusive) where this location starts. */
-  int getStartLine() { this.fullLocationInfo(_, result, _, _, _) }
-
-  /** Gets the 1-based column number (inclusive) where this location starts. */
-  int getStartColumn() { this.fullLocationInfo(_, _, result, _, _) }
-
-  /** Gets the 1-based line number (inclusive) where this location ends. */
-  int getEndLine() { this.fullLocationInfo(_, _, _, result, _) }
-
-  /** Gets the 1-based column number (inclusive) where this location ends. */
-  int getEndColumn() { this.fullLocationInfo(_, _, _, _, result) }
-
-  /**
-   * Gets a textual representation of this element.
-   *
-   * The format is "file://filePath:startLine:startColumn:endLine:endColumn".
-   */
-  string toString() {
-    exists(string filepath, int startline, int startcolumn, int endline, int endcolumn |
-      this.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
-    |
-      toUrl(filepath, startline, startcolumn, endline, endcolumn, result)
-    )
-  }
-
-  /**
-   * Holds if this element is in the specified container.
-   * The location spans column `startcolumn` of line `startline` to
-   * column `endcolumn` of line `endline`.
-   *
-   * This predicate is similar to `hasLocationInfo`, but exposes the `Container`
-   * entity, rather than merely its path.
-   */
-  predicate fullLocationInfo(
-    Container container, int startline, int startcolumn, int endline, int endcolumn
-  ) {
-    locations_default(this, unresolveElement(container), startline, startcolumn, endline, endcolumn) or
-    locations_expr(this, unresolveElement(container), startline, startcolumn, endline, endcolumn) or
-    locations_stmt(this, unresolveElement(container), startline, startcolumn, endline, endcolumn)
-  }
-
-  /**
-   * Holds if this element is at the specified location.
-   * The location spans column `startcolumn` of line `startline` to
-   * column `endcolumn` of line `endline` in file `filepath`.
-   * For more information, see
-   * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
-   */
-  predicate hasLocationInfo(
-    string filepath, int startline, int startcolumn, int endline, int endcolumn
-  ) {
-    exists(Container f | this.fullLocationInfo(f, startline, startcolumn, endline, endcolumn) |
-      filepath = f.getAbsolutePath()
-    )
-  }
-
-  /** Holds if `this` comes on a line strictly before `l`. */
-  pragma[inline]
-  predicate isBefore(Location l) {
-    this.getFile() = l.getFile() and this.getEndLine() < l.getStartLine()
-  }
-
-  /** Holds if location `l` is completely contained within this one. */
-  predicate subsumes(Location l) {
-    exists(File f | f = this.getFile() |
-      exists(int thisStart, int thisEnd | this.charLoc(f, thisStart, thisEnd) |
-        exists(int lStart, int lEnd | l.charLoc(f, lStart, lEnd) |
-          thisStart <= lStart and lEnd <= thisEnd
-        )
-      )
-    )
-  }
-
-  /**
-   * Holds if this location corresponds to file `f` and character "offsets"
-   * `start..end`. Note that these are not real character offsets, because
-   * we use `maxCols` to find the length of the longest line and then pretend
-   * that all the lines are the same length. However, these offsets are
-   * convenient for comparing or sorting locations in a file. For an example,
-   * see `subsumes`.
-   */
-  predicate charLoc(File f, int start, int end) {
-    f = this.getFile() and
-    exists(int maxCols | maxCols = maxCols(f) |
-      start = this.getStartLine() * maxCols + this.getStartColumn() and
-      end = this.getEndLine() * maxCols + this.getEndColumn()
-    )
-  }
-}
-
-/**
- * DEPRECATED: Use `Location` instead.
- * A location of an element. Not used for expressions or statements, which
- * instead use LocationExpr and LocationStmt respectively.
- */
-deprecated library class LocationDefault extends Location, @location_default { }
-
-/**
- * DEPRECATED: Use `Location` instead.
- * A location of a statement.
- */
-deprecated library class LocationStmt extends Location, @location_stmt { }
-
-/**
- * DEPRECATED: Use `Location` instead.
- * A location of an expression.
- */
-deprecated library class LocationExpr extends Location, @location_expr { }
-
-/**
- * Gets the length of the longest line in file `f`.
- */
-pragma[nomagic]
-private int maxCols(File f) {
-  result = max(Location l | l.getFile() = f | l.getStartColumn().maximum(l.getEndColumn()))
-}
-
-/**
- * A C/C++ element that has a location in a file
- */
-class Locatable extends Element { }
-
-/**
- * A dummy location which is used when something doesn't have a location in
- * the source code but needs to have a `Location` associated with it. There
- * may be several distinct kinds of unknown locations. For example: one for
- * expressions, one for statements and one for other program elements.
- */
-class UnknownLocation extends Location {
-  UnknownLocation() { this.getFile().getAbsolutePath() = "" }
-}
-
-/**
- * A dummy location which is used when something doesn't have a location in
- * the source code but needs to have a `Location` associated with it.
- */
-class UnknownDefaultLocation extends UnknownLocation {
-  UnknownDefaultLocation() { locations_default(this, _, 0, 0, 0, 0) }
-}
-
-/**
- * A dummy location which is used when an expression doesn't have a
- * location in the source code but needs to have a `Location` associated
- * with it.
- */
-class UnknownExprLocation extends UnknownLocation {
-  UnknownExprLocation() { locations_expr(this, _, 0, 0, 0, 0) }
-}
-
-/**
- * A dummy location which is used when a statement doesn't have a location
- * in the source code but needs to have a `Location` associated with it.
- */
-class UnknownStmtLocation extends UnknownLocation {
-  UnknownStmtLocation() { locations_stmt(this, _, 0, 0, 0, 0) }
-}

cpp/ql/lib/semmle/code/cpp/Namespace.qll

@@ -1,249 +0,0 @@
-/**
- * Provides classes for modeling namespaces, `using` directives and `using` declarations.
- */
-
-import semmle.code.cpp.Element
-import semmle.code.cpp.Type
-import semmle.code.cpp.metrics.MetricNamespace
-
-/**
- * A C++ namespace. For example the (single) namespace `A` in the following
- * code:
- * ```
- * namespace A
- * {
- *   // ...
- * }
- *
- * // ...
- *
- * namespace A
- * {
- *   // ...
- * }
- * ```
- * Note that namespaces are somewhat nebulous entities, as they do not in
- * general have a single well-defined location in the source code. The
- * related notion of a `NamespaceDeclarationEntry` is rather more concrete,
- * and should be used when a location is required. For example, the `std::`
- * namespace is particularly nebulous, as parts of it are defined across a
- * wide range of headers. As a more extreme example, the global namespace
- * is never explicitly declared, but might correspond to a large proportion
- * of the source code.
- */
-class Namespace extends NameQualifyingElement, @namespace {
-  /**
-   * Gets the location of the namespace. Most namespaces do not have a
-   * single well-defined source location, so a dummy location is returned,
-   * unless the namespace has exactly one declaration entry.
-   */
-  override Location getLocation() {
-    if strictcount(this.getADeclarationEntry()) = 1
-    then result = this.getADeclarationEntry().getLocation()
-    else result instanceof UnknownDefaultLocation
-  }
-
-  /** Gets the simple name of this namespace. */
-  override string getName() { namespaces(underlyingElement(this), result) }
-
-  /** Holds if this element is named `name`. */
-  predicate hasName(string name) { name = this.getName() }
-
-  /** Holds if this namespace is anonymous. */
-  predicate isAnonymous() { this.hasName("(unnamed namespace)") }
-
-  /** Gets the name of the parent namespace, if it exists. */
-  private string getParentName() {
-    result = this.getParentNamespace().getName() and
-    result != ""
-  }
-
-  /** Gets the qualified name of this namespace. For example: `a::b`. */
-  string getQualifiedName() {
-    if exists(this.getParentName())
-    then result = this.getParentNamespace().getQualifiedName() + "::" + this.getName()
-    else result = this.getName()
-  }
-
-  /** Gets the parent namespace, if any. */
-  Namespace getParentNamespace() {
-    namespacembrs(unresolveElement(result), underlyingElement(this))
-    or
-    not namespacembrs(_, underlyingElement(this)) and result instanceof GlobalNamespace
-  }
-
-  /** Gets a child declaration of this namespace. */
-  Declaration getADeclaration() { namespacembrs(underlyingElement(this), unresolveElement(result)) }
-
-  /** Gets a child namespace of this namespace. */
-  Namespace getAChildNamespace() {
-    namespacembrs(underlyingElement(this), unresolveElement(result))
-  }
-
-  /** Holds if the namespace is inline. */
-  predicate isInline() { namespace_inline(underlyingElement(this)) }
-
-  /** Holds if this namespace may be from source. */
-  override predicate fromSource() { this.getADeclaration().fromSource() }
-
-  /**
-   * Holds if this namespace is in a library.
-   *
-   * DEPRECATED: never holds.
-   */
-  deprecated override predicate fromLibrary() { not this.fromSource() }
-
-  /** Gets the metric namespace. */
-  MetricNamespace getMetrics() { result = this }
-
-  /** Gets a version of the `QualifiedName` that is more suitable for display purposes. */
-  string getFriendlyName() { result = this.getQualifiedName() }
-
-  final override string toString() { result = this.getFriendlyName() }
-
-  /** Gets a declaration of (part of) this namespace. */
-  NamespaceDeclarationEntry getADeclarationEntry() { result.getNamespace() = this }
-
-  /** Gets a file which declares (part of) this namespace. */
-  File getAFile() { result = this.getADeclarationEntry().getLocation().getFile() }
-}
-
-/**
- * A declaration of (part of) a C++ namespace. This corresponds to a single
- * `namespace N { ... }` occurrence in the source code. For example the two
- * mentions of `A` in the following code:
- * ```
- * namespace A
- * {
- *   // ...
- * }
- *
- * // ...
- *
- * namespace A
- * {
- *   // ...
- * }
- * ```
- */
-class NamespaceDeclarationEntry extends Locatable, @namespace_decl {
-  /**
-   * Get the namespace that this declaration entry corresponds to.  There
-   * is a one-to-many relationship between `Namespace` and
-   * `NamespaceDeclarationEntry`.
-   */
-  Namespace getNamespace() {
-    namespace_decls(underlyingElement(this), unresolveElement(result), _, _)
-  }
-
-  override string toString() { result = this.getNamespace().getFriendlyName() }
-
-  /**
-   * Gets the location of the token preceding the namespace declaration
-   * entry's body.
-   *
-   * For named declarations, such as "namespace MyStuff { ... }", this will
-   * give the "MyStuff" token.
-   *
-   * For anonymous declarations, such as "namespace { ... }", this will
-   * give the "namespace" token.
-   */
-  override Location getLocation() { namespace_decls(underlyingElement(this), _, result, _) }
-
-  /**
-   * Gets the location of the namespace declaration entry's body. For
-   * example: the "{ ... }" in "namespace N { ... }".
-   */
-  Location getBodyLocation() { namespace_decls(underlyingElement(this), _, _, result) }
-
-  override string getAPrimaryQlClass() { result = "NamespaceDeclarationEntry" }
-}
-
-/**
- * A C++ `using` directive or `using` declaration.
- */
-class UsingEntry extends Locatable, @using {
-  override Location getLocation() { usings(underlyingElement(this), _, result) }
-}
-
-/**
- * A C++ `using` declaration. For example:
- * ```
- * using std::string;
- * ```
- */
-class UsingDeclarationEntry extends UsingEntry {
-  UsingDeclarationEntry() {
-    not exists(Namespace n | usings(underlyingElement(this), unresolveElement(n), _))
-  }
-
-  /**
-   * Gets the declaration that is referenced by this using declaration. For
-   * example, `std::string` in `using std::string`.
-   */
-  Declaration getDeclaration() { usings(underlyingElement(this), unresolveElement(result), _) }
-
-  override string toString() { result = "using " + this.getDeclaration().getDescription() }
-}
-
-/**
- * A C++ `using` directive. For example:
- * ```
- * using namespace std;
- * ```
- */
-class UsingDirectiveEntry extends UsingEntry {
-  UsingDirectiveEntry() {
-    exists(Namespace n | usings(underlyingElement(this), unresolveElement(n), _))
-  }
-
-  /**
-   * Gets the namespace that is referenced by this using directive. For
-   * example, `std` in `using namespace std`.
-   */
-  Namespace getNamespace() { usings(underlyingElement(this), unresolveElement(result), _) }
-
-  override string toString() { result = "using namespace " + this.getNamespace().getFriendlyName() }
-}
-
-/**
- * Holds if `g` is an instance of `GlobalNamespace`. This predicate
- * is used suppress a warning in `GlobalNamespace.getADeclaration()`
- * by providing a fake use of `this`.
- */
-private predicate suppressWarningForUnused(GlobalNamespace g) { any() }
-
-/**
- * The C/C++ global namespace.
- */
-class GlobalNamespace extends Namespace {
-  GlobalNamespace() { this.hasName("") }
-
-  override Declaration getADeclaration() {
-    suppressWarningForUnused(this) and
-    result.isTopLevel() and
-    not namespacembrs(_, unresolveElement(result))
-  }
-
-  /** Gets a child namespace of the global namespace. */
-  override Namespace getAChildNamespace() {
-    suppressWarningForUnused(this) and
-    not namespacembrs(unresolveElement(result), _)
-  }
-
-  override Namespace getParentNamespace() { none() }
-
-  /**
-   * DEPRECATED: use `getName()`.
-   */
-  deprecated string getFullName() { result = this.getName() }
-
-  override string getFriendlyName() { result = "(global namespace)" }
-}
-
-/**
- * The C++ `std::` namespace.
- */
-class StdNamespace extends Namespace {
-  StdNamespace() { this.hasName("std") and this.getParentNamespace() instanceof GlobalNamespace }
-}

cpp/ql/lib/semmle/code/cpp/Parameter.qll

@@ -1,180 +0,0 @@
-/**
- * Provides a class that models parameters to functions.
- */
-
-import semmle.code.cpp.Location
-import semmle.code.cpp.Declaration
-private import semmle.code.cpp.internal.ResolveClass
-
-/**
- * A C/C++ function parameter or catch block parameter. For example the
- * function parameter `p` and the catch block parameter `e` in the following
- * code:
- * ```
- * void myFunction(int p) {
- *   try {
- *     ...
- *   } catch (const std::exception &e) {
- *     ...
- *   }
- * }
- * ```
- *
- * For catch block parameters, there is a one-to-one correspondence between
- * the `Parameter` and its `ParameterDeclarationEntry`.
- *
- * For function parameters, there is a one-to-many relationship between
- * `Parameter` and `ParameterDeclarationEntry`, because one function can
- * have multiple declarations.
- */
-class Parameter extends LocalScopeVariable, @parameter {
-  /**
-   * Gets the canonical name, or names, of this parameter.
-   *
-   * The canonical names are the first non-empty category from the
-   * following list:
-   *  1. The name given to the parameter at the function's definition or
-   *     (for catch block parameters) at the catch block.
-   *  2. A name given to the parameter at a function declaration.
-   *  3. The name "(unnamed parameter i)" where i is the index of the parameter.
-   */
-  override string getName() {
-    exists(VariableDeclarationEntry vde |
-      vde = this.getANamedDeclarationEntry() and result = vde.getName()
-    |
-      vde.isDefinition() or not this.getANamedDeclarationEntry().isDefinition()
-    )
-    or
-    not exists(this.getANamedDeclarationEntry()) and
-    result = "(unnamed parameter " + this.getIndex().toString() + ")"
-  }
-
-  override string getAPrimaryQlClass() { result = "Parameter" }
-
-  /**
-   * Gets the name of this parameter, including it's type.
-   *
-   * For example: `int p`.
-   */
-  string getTypedName() {
-    exists(string typeString, string nameString |
-      (
-        if exists(this.getType().getName())
-        then typeString = this.getType().getName()
-        else typeString = ""
-      ) and
-      (if exists(this.getName()) then nameString = this.getName() else nameString = "") and
-      (
-        if typeString != "" and nameString != ""
-        then result = typeString + " " + nameString
-        else result = typeString + nameString
-      )
-    )
-  }
-
-  private VariableDeclarationEntry getANamedDeclarationEntry() {
-    result = this.getAnEffectiveDeclarationEntry() and result.getName() != ""
-  }
-
-  /**
-   * Gets a declaration entry corresponding to this declaration.
-   *
-   * This predicate is the same as getADeclarationEntry(), except that for
-   * parameters of instantiated function templates, gives the declaration
-   * entry of the prototype instantiation of the parameter (as
-   * non-prototype instantiations don't have declaration entries of their
-   * own).
-   */
-  private VariableDeclarationEntry getAnEffectiveDeclarationEntry() {
-    if this.getFunction().isConstructedFrom(_)
-    then
-      exists(Function prototypeInstantiation |
-        prototypeInstantiation.getParameter(this.getIndex()) = result.getVariable() and
-        this.getFunction().isConstructedFrom(prototypeInstantiation)
-      )
-    else result = this.getADeclarationEntry()
-  }
-
-  /**
-   * Gets the name of this parameter in the given block (which should be
-   * the body of a function with which the parameter is associated).
-   *
-   * DEPRECATED: this method was used in a previous implementation of
-   * getName, but is no longer in use.
-   */
-  deprecated string getNameInBlock(BlockStmt b) {
-    exists(ParameterDeclarationEntry pde |
-      pde.getFunctionDeclarationEntry().getBlock() = b and
-      this.getFunction().getBlock() = b and
-      pde.getVariable() = this and
-      result = pde.getName()
-    )
-  }
-
-  /**
-   * Holds if this parameter has a name.
-   *
-   * In other words, this predicate holds precisely when the result of
-   * `getName()` is not "(unnamed parameter i)" (where `i` is the index
-   * of the parameter).
-   */
-  predicate isNamed() { exists(this.getANamedDeclarationEntry()) }
-
-  /**
-   * Gets the function to which this parameter belongs, if it is a function
-   * parameter.
-   */
-  override Function getFunction() {
-    params(underlyingElement(this), unresolveElement(result), _, _)
-  }
-
-  /**
-   * Gets the catch block to which this parameter belongs, if it is a catch
-   * block parameter.
-   */
-  BlockStmt getCatchBlock() { params(underlyingElement(this), unresolveElement(result), _, _) }
-
-  /**
-   * Gets the zero-based index of this parameter.
-   *
-   * For catch block parameters, this is always zero.
-   */
-  int getIndex() { params(underlyingElement(this), _, result, _) }
-
-  /**
-   * Gets the type of this parameter.
-   *
-   * Function parameters of array type are a special case in C/C++,
-   * as they are syntactic sugar for parameters of pointer type. The
-   * result is an array type for such parameters.
-   */
-  override Type getType() { params(underlyingElement(this), _, _, unresolveElement(result)) }
-
-  /**
-   * Gets the canonical location, or locations, of this parameter.
-   *
-   * 1. For catch block parameters, gets the obvious location.
-   * 2. For parameters of functions which have a definition, gets the
-   *    location within the function definition.
-   * 3. For parameters of functions which don't have a definition, gets all
-   *    of the declaration locations.
-   */
-  override Location getLocation() {
-    exists(VariableDeclarationEntry vde |
-      vde = this.getAnEffectiveDeclarationEntry() and result = vde.getLocation()
-    |
-      vde.isDefinition() or not this.getAnEffectiveDeclarationEntry().isDefinition()
-    )
-  }
-}
-
-/**
- * An `int` that is a parameter index for some function.  This is needed for binding in certain cases.
- */
-class ParameterIndex extends int {
-  ParameterIndex() {
-    exists(Parameter p | this = p.getIndex()) or
-    exists(Call c | exists(c.getArgument(this))) or // permit indexing varargs
-    this = -1 // used for `this`
-  }
-}

cpp/ql/lib/semmle/code/cpp/Preprocessor.qll

@@ -1,296 +0,0 @@
-import semmle.code.cpp.Location
-import semmle.code.cpp.Element
-
-/**
- * A C/C++ preprocessor directive. For example each of the following lines of
- * code contains a `PreprocessorDirective`:
- * ```
- * #pragma once
- * #ifdef MYDEFINE
- * #include "myfile.h"
- * #line 1 "source.c"
- * ```
- */
-class PreprocessorDirective extends Locatable, @preprocdirect {
-  override string toString() { result = "Preprocessor directive" }
-
-  override Location getLocation() { preprocdirects(underlyingElement(this), _, result) }
-
-  string getHead() { preproctext(underlyingElement(this), result, _) }
-
-  /**
-   * Gets a preprocessor branching directive whose condition affects
-   * whether this directive is performed.
-   *
-   * From a lexical point of view, this returns all `#if`, `#ifdef`,
-   * `#ifndef`, or `#elif` directives which occur before this directive and
-   * have a matching `#endif` which occurs after this directive.
-   */
-  PreprocessorBranch getAGuard() {
-    exists(PreprocessorEndif e, int line |
-      result.getEndIf() = e and
-      e.getFile() = this.getFile() and
-      result.getFile() = this.getFile() and
-      line = this.getLocation().getStartLine() and
-      result.getLocation().getStartLine() < line and
-      line < e.getLocation().getEndLine()
-    )
-  }
-}
-
-private class TPreprocessorBranchDirective = @ppd_branch or @ppd_else or @ppd_endif;
-
-/**
- * A C/C++ preprocessor branch related directive: `#if`, `#ifdef`,
- * `#ifndef`, `#elif`, `#else` or `#endif`.
- */
-class PreprocessorBranchDirective extends PreprocessorDirective, TPreprocessorBranchDirective {
-  /**
-   * Gets the `#if`, `#ifdef` or `#ifndef` directive which matches this
-   * branching directive.
-   *
-   * If this branch directive was unbalanced, then there will be no
-   * result. Conversely, if the branch matches different `#if` directives
-   * in different translation units, then there can be more than one
-   * result.
-   */
-  PreprocessorBranch getIf() {
-    result = this.(PreprocessorIf) or
-    result = this.(PreprocessorIfdef) or
-    result = this.(PreprocessorIfndef) or
-    preprocpair(unresolveElement(result), underlyingElement(this))
-  }
-
-  /**
-   * Gets the `#endif` directive which matches this branching directive.
-   *
-   * If this branch directive was unbalanced, then there will be no
-   * result. Conversely, if the branch matched different `#endif`
-   * directives in different translation units, then there can be more than
-   * one result.
-   */
-  PreprocessorEndif getEndIf() {
-    preprocpair(unresolveElement(this.getIf()), unresolveElement(result))
-  }
-
-  /**
-   * Gets the next `#elif`, `#else` or `#endif` matching this branching
-   * directive.
-   *
-   * For example `somePreprocessorBranchDirective.getIf().getNext()` gets
-   * the second directive in the same construct as
-   * `somePreprocessorBranchDirective`.
-   */
-  PreprocessorBranchDirective getNext() {
-    exists(PreprocessorBranch branch |
-      this.getIndexInBranch(branch) + 1 = result.getIndexInBranch(branch)
-    )
-  }
-
-  /**
-   * Gets the index of this branching directive within the matching #if,
-   * #ifdef or #ifndef.
-   */
-  private int getIndexInBranch(PreprocessorBranch branch) {
-    this =
-      rank[result](PreprocessorBranchDirective other |
-        other.getIf() = branch
-      |
-        other order by other.getLocation().getStartLine()
-      )
-  }
-}
-
-/**
- * A C/C++ preprocessor branching directive: `#if`, `#ifdef`, `#ifndef`, or
- * `#elif`.
- *
- * A branching directive has a condition and that condition may be evaluated
- * at compile-time.  As a result, the preprocessor will either take the
- * branch, or not take the branch.
- *
- * However, there are also situations in which a branch's condition isn't
- * evaluated.  The obvious case of this is when the directive is contained
- * within a branch which wasn't taken. There is also a much more subtle
- * case involving header guard branches: suitably clever compilers can
- * notice that a branch is a header guard, and can then subsequently ignore
- * a `#include` for the file being guarded. It is for this reason that
- * `wasTaken()` always holds on header guard branches, but `wasNotToken()`
- * rarely holds on header guard branches.
- */
-class PreprocessorBranch extends PreprocessorBranchDirective, @ppd_branch {
-  /**
-   * Holds if at least one translation unit evaluated this directive's
-   * condition and subsequently took the branch.
-   */
-  predicate wasTaken() { preproctrue(underlyingElement(this)) }
-
-  /**
-   * Holds if at least one translation unit evaluated this directive's
-   * condition but then didn't take the branch.
-   *
-   * If `#else` is the next matching directive, then this means that the
-   * `#else` was taken instead.
-   */
-  predicate wasNotTaken() { preprocfalse(underlyingElement(this)) }
-
-  /**
-   * Holds if this directive was either taken by all translation units
-   * which evaluated it, or was not taken by any translation unit which
-   * evaluated it.
-   */
-  predicate wasPredictable() { not (this.wasTaken() and this.wasNotTaken()) }
-}
-
-/**
- * A C/C++ preprocessor `#if` directive. For example there is a
- * `PreprocessorIf` on the first line of the following code:
- * ```
- * #if defined(MYDEFINE)
- * // ...
- * #endif
- * ```
- * For the related notion of a directive which causes branching (which
- * includes `#if`, plus also `#ifdef`, `#ifndef`, and `#elif`), see
- * `PreprocessorBranch`.
- */
-class PreprocessorIf extends PreprocessorBranch, @ppd_if {
-  override string toString() { result = "#if " + this.getHead() }
-}
-
-/**
- * A C/C++ preprocessor `#ifdef` directive. For example there is a
- * `PreprocessorIfdef` on the first line of the following code:
- * ```
- * #ifdef MYDEFINE
- * // ...
- * #endif
- * ```
- * The syntax `#ifdef X` is shorthand for `#if defined(X)`.
- */
-class PreprocessorIfdef extends PreprocessorBranch, @ppd_ifdef {
-  override string toString() { result = "#ifdef " + this.getHead() }
-
-  override string getAPrimaryQlClass() { result = "PreprocessorIfdef" }
-}
-
-/**
- * A C/C++ preprocessor `#ifndef` directive. For example there is a
- * `PreprocessorIfndef` on the first line of the following code:
- * ```
- * #ifndef MYDEFINE
- * // ...
- * #endif
- * ```
- * The syntax `#ifndef X` is shorthand for `#if !defined(X)`.
- */
-class PreprocessorIfndef extends PreprocessorBranch, @ppd_ifndef {
-  override string toString() { result = "#ifndef " + this.getHead() }
-}
-
-/**
- * A C/C++ preprocessor `#else` directive. For example there is a
- * `PreprocessorElse` on the fifth line of the following code:
- * ```
- * #ifdef MYDEFINE1
- * // ...
- * #elif MYDEFINE2
- * // ...
- * #else
- * // ...
- * #endif
- * ```
- */
-class PreprocessorElse extends PreprocessorBranchDirective, @ppd_else {
-  override string toString() { result = "#else" }
-}
-
-/**
- * A C/C++ preprocessor `#elif` directive. For example there is a
- * `PreprocessorElif` on the third line of the following code:
- * ```
- * #ifdef MYDEFINE1
- * // ...
- * #elif MYDEFINE2
- * // ...
- * #else
- * // ...
- * #endif
- * ```
- */
-class PreprocessorElif extends PreprocessorBranch, @ppd_elif {
-  override string toString() { result = "#elif " + this.getHead() }
-}
-
-/**
- * A C/C++ preprocessor `#endif` directive. For example there is a
- * `PreprocessorEndif` on the third line of the following code:
- * ```
- * #ifdef MYDEFINE
- * // ...
- * #endif
- * ```
- */
-class PreprocessorEndif extends PreprocessorBranchDirective, @ppd_endif {
-  override string toString() { result = "#endif" }
-}
-
-/**
- * A C/C++ preprocessor `#warning` directive. For example:
- * ```
- * #warning "This configuration is not supported."
- * ```
- */
-class PreprocessorWarning extends PreprocessorDirective, @ppd_warning {
-  override string toString() { result = "#warning " + this.getHead() }
-}
-
-/**
- * A C/C++ preprocessor `#error` directive. For example:
- * ```
- * #error "This configuration is not implemented."
- * ```
- */
-class PreprocessorError extends PreprocessorDirective, @ppd_error {
-  override string toString() { result = "#error " + this.getHead() }
-}
-
-/**
- * A C/C++ preprocessor `#undef` directive. For example there is a
- * `PreprocessorUndef` on the second line of the following code:
- * ```
- * #ifdef MYMACRO
- * #undef MYMACRO
- * #endif
- * ```
- */
-class PreprocessorUndef extends PreprocessorDirective, @ppd_undef {
-  override string toString() { result = "#undef " + this.getHead() }
-
-  /**
-   * Gets the name of the macro that is undefined.
-   */
-  string getName() { result = this.getHead() }
-}
-
-/**
- * A C/C++ preprocessor `#pragma` directive. For example:
- * ```
- * #pragma once
- * ```
- */
-class PreprocessorPragma extends PreprocessorDirective, @ppd_pragma {
-  override string toString() {
-    if exists(this.getHead()) then result = "#pragma " + this.getHead() else result = "#pragma"
-  }
-}
-
-/**
- * A C/C++ preprocessor `#line` directive. For example:
- * ```
- * #line 1 "source.c"
- * ```
- */
-class PreprocessorLine extends PreprocessorDirective, @ppd_line {
-  override string toString() { result = "#line " + this.getHead() }
-}

cpp/ql/lib/semmle/code/cpp/Print.qll

@@ -1,428 +0,0 @@
-import cpp
-private import PrintAST
-
-/**
- * Print function declarations only if there is a `PrintASTConfiguration`
- * that requests that function, or no `PrintASTConfiguration` exists.
- */
-private predicate shouldPrintDeclaration(Declaration decl) {
-  not decl instanceof Function
-  or
-  not exists(PrintASTConfiguration c)
-  or
-  exists(PrintASTConfiguration config | config.shouldPrintFunction(decl))
-}
-
-/**
- * Gets a string containing the scope in which this declaration is declared.
- */
-private string getScopePrefix(Declaration decl) {
-  decl.isMember() and result = decl.getDeclaringType().(UserDumpType).getIdentityString() + "::"
-  or
-  decl.isTopLevel() and
-  exists(string parentName |
-    parentName = decl.getNamespace().getQualifiedName() and
-    (
-      parentName != "" and result = parentName + "::"
-      or
-      parentName = "" and result = ""
-    )
-  )
-  or
-  exists(UserType type |
-    type = decl and
-    type.isLocal() and
-    result = "(" + type.getEnclosingFunction().(DumpFunction).getIdentityString() + ")::"
-  )
-  or
-  decl instanceof TemplateParameter and result = ""
-}
-
-/**
- * Gets the identity string of a type used as a parameter. Identical to `Type.getTypeIdentityString()`, except that
- * it returns `...` for `UnknownType`, which is used to represent variable arguments.
- */
-private string getParameterTypeString(Type parameterType) {
-  if parameterType instanceof UnknownType
-  then result = "..."
-  else result = parameterType.(DumpType).getTypeIdentityString()
-}
-
-private string getTemplateArgumentString(Declaration d, int i) {
-  if exists(d.getTemplateArgumentKind(i))
-  then
-    result =
-      d.getTemplateArgumentKind(i).(DumpType).getTypeIdentityString() + " " +
-        d.getTemplateArgument(i)
-  else result = d.getTemplateArgument(i).(DumpType).getTypeIdentityString()
-}
-
-/**
- * A `Declaration` extended to add methods for generating strings useful only for dumps and debugging.
- */
-private class DumpDeclaration extends Declaration {
-  DumpDeclaration() { shouldPrintDeclaration(this) }
-
-  /**
-   * Gets a string that uniquely identifies this declaration, suitable for use when debugging queries. Only holds for
-   * functions, user-defined types, global and namespace-scope variables, and member variables.
-   *
-   * This operation is very expensive, and should not be used in production queries. Consider using
-   * `hasQualifiedName()` for identifying known declarations in production queries.
-   */
-  string getIdentityString() { none() }
-
-  language[monotonicAggregates]
-  final string getTemplateArgumentsString() {
-    if exists(this.getATemplateArgument())
-    then
-      result =
-        "<" +
-          strictconcat(int i |
-            exists(this.getTemplateArgument(i))
-          |
-            getTemplateArgumentString(this, i), ", " order by i
-          ) + ">"
-    else result = ""
-  }
-}
-
-/**
- * A `Type` extended to add methods for generating strings useful only for dumps and debugging.
- */
-private class DumpType extends Type {
-  /**
-   * Gets a string that uniquely identifies this type, suitable for use when debugging queries. All typedefs and
-   * decltypes are expanded, and all symbol names are fully qualified.
-   *
-   * This operation is very expensive, and should not be used in production queries.
-   */
-  final string getTypeIdentityString() {
-    // The identity string of a type is just the concatenation of the four
-    // components below. To create the type identity for a derived type, insert
-    // the declarator of the derived type between the `getDeclaratorPrefix()`
-    // and `getDeclaratorSuffixBeforeQualifiers()`. To create the type identity
-    // for a `SpecifiedType`, insert the qualifiers after
-    // `getDeclaratorSuffixBeforeQualifiers()`.
-    result =
-      this.getTypeSpecifier() + this.getDeclaratorPrefix() +
-        this.getDeclaratorSuffixBeforeQualifiers() + this.getDeclaratorSuffix()
-  }
-
-  /**
-   * Gets the "type specifier" part of this type's name. This is generally the "leaf" type from which the type was
-   * constructed.
-   *
-   * Examples:
-   * - `int` -> `int`
-   * - `int*` -> `int`
-   * - `int (*&)(float, double) const` -> `int`
-   *
-   * This predicate is intended to be used only by the implementation of `getTypeIdentityString`.
-   */
-  string getTypeSpecifier() { result = "" }
-
-  /**
-   * Gets the portion of this type's declarator that comes before the declarator for any derived type.
-   *
-   * This predicate is intended to be used only by the implementation of `getTypeIdentityString`.
-   */
-  string getDeclaratorPrefix() { result = "" }
-
-  /**
-   * Gets the portion of this type's declarator that comes after the declarator for any derived type, but before any
-   * qualifiers on the current type.
-   *
-   * This predicate is intended to be used only by the implementation of `getTypeIdentityString`.
-   */
-  string getDeclaratorSuffixBeforeQualifiers() { result = "" }
-
-  /**
-   * Gets the portion of this type's declarator that comes after the declarator for any derived type and after any
-   * qualifiers on the current type.
-   *
-   * This predicate is intended to be used only by the implementation of `getTypeIdentityString`.
-   */
-  string getDeclaratorSuffix() { result = "" }
-}
-
-private class BuiltInDumpType extends DumpType, BuiltInType {
-  override string getTypeSpecifier() { result = this.toString() }
-}
-
-private class IntegralDumpType extends BuiltInDumpType, IntegralType {
-  override string getTypeSpecifier() { result = this.getCanonicalArithmeticType().toString() }
-}
-
-private class DerivedDumpType extends DumpType, DerivedType {
-  override string getTypeSpecifier() { result = this.getBaseType().(DumpType).getTypeSpecifier() }
-
-  override string getDeclaratorSuffixBeforeQualifiers() {
-    result = this.getBaseType().(DumpType).getDeclaratorSuffixBeforeQualifiers()
-  }
-
-  override string getDeclaratorSuffix() {
-    result = this.getBaseType().(DumpType).getDeclaratorSuffix()
-  }
-}
-
-private class DecltypeDumpType extends DumpType, Decltype {
-  override string getTypeSpecifier() { result = this.getBaseType().(DumpType).getTypeSpecifier() }
-
-  override string getDeclaratorPrefix() {
-    result = this.getBaseType().(DumpType).getDeclaratorPrefix()
-  }
-
-  override string getDeclaratorSuffix() {
-    result = this.getBaseType().(DumpType).getDeclaratorSuffix()
-  }
-}
-
-private class PointerIshDumpType extends DerivedDumpType {
-  PointerIshDumpType() {
-    this instanceof PointerType or
-    this instanceof ReferenceType
-  }
-
-  override string getDeclaratorPrefix() {
-    exists(string declarator |
-      result = this.getBaseType().(DumpType).getDeclaratorPrefix() + declarator and
-      if this.getBaseType().getUnspecifiedType() instanceof ArrayType
-      then declarator = "(" + this.getDeclaratorToken() + ")"
-      else declarator = this.getDeclaratorToken()
-    )
-  }
-
-  /**
-   * Gets the token used when declaring this kind of type (e.g. `*`, `&`, `&&`)/
-   */
-  string getDeclaratorToken() { result = "" }
-}
-
-private class PointerDumpType extends PointerIshDumpType, PointerType {
-  override string getDeclaratorToken() { result = "*" }
-}
-
-private class LValueReferenceDumpType extends PointerIshDumpType, LValueReferenceType {
-  override string getDeclaratorToken() { result = "&" }
-}
-
-private class RValueReferenceDumpType extends PointerIshDumpType, RValueReferenceType {
-  override string getDeclaratorToken() { result = "&&" }
-}
-
-private class PointerToMemberDumpType extends DumpType, PointerToMemberType {
-  override string getTypeSpecifier() { result = this.getBaseType().(DumpType).getTypeSpecifier() }
-
-  override string getDeclaratorPrefix() {
-    exists(string declarator, string parenDeclarator, Type baseType |
-      declarator = this.getClass().(DumpType).getTypeIdentityString() + "::*" and
-      result = this.getBaseType().(DumpType).getDeclaratorPrefix() + " " + parenDeclarator and
-      baseType = this.getBaseType().getUnspecifiedType() and
-      if baseType instanceof ArrayType or baseType instanceof RoutineType
-      then parenDeclarator = "(" + declarator
-      else parenDeclarator = declarator
-    )
-  }
-
-  override string getDeclaratorSuffixBeforeQualifiers() {
-    exists(Type baseType |
-      baseType = this.getBaseType().getUnspecifiedType() and
-      if baseType instanceof ArrayType or baseType instanceof RoutineType
-      then result = ")" + this.getBaseType().(DumpType).getDeclaratorSuffixBeforeQualifiers()
-      else result = this.getBaseType().(DumpType).getDeclaratorSuffixBeforeQualifiers()
-    )
-  }
-
-  override string getDeclaratorSuffix() {
-    result = this.getBaseType().(DumpType).getDeclaratorSuffix()
-  }
-}
-
-private class ArrayDumpType extends DerivedDumpType, ArrayType {
-  override string getDeclaratorPrefix() {
-    result = this.getBaseType().(DumpType).getDeclaratorPrefix()
-  }
-
-  override string getDeclaratorSuffixBeforeQualifiers() {
-    if exists(this.getArraySize())
-    then
-      result =
-        "[" + this.getArraySize().toString() + "]" +
-          this.getBaseType().(DumpType).getDeclaratorSuffixBeforeQualifiers()
-    else result = "[]" + this.getBaseType().(DumpType).getDeclaratorSuffixBeforeQualifiers()
-  }
-}
-
-private class FunctionPointerIshDumpType extends DerivedDumpType, FunctionPointerIshType {
-  override string getDeclaratorSuffixBeforeQualifiers() {
-    result = ")" + this.getBaseType().(DumpType).getDeclaratorSuffixBeforeQualifiers()
-  }
-
-  override string getDeclaratorSuffix() {
-    result = this.getBaseType().(DumpType).getDeclaratorSuffix()
-  }
-
-  override string getDeclaratorPrefix() {
-    result = this.getBaseType().(DumpType).getDeclaratorPrefix() + "(" + this.getDeclaratorToken()
-  }
-
-  /**
-   * Gets the token used when declaring this kind of type (e.g. `*`, `&`, `^`)/
-   */
-  string getDeclaratorToken() { result = "" }
-}
-
-private class FunctionPointerDumpType extends FunctionPointerIshDumpType, FunctionPointerType {
-  override string getDeclaratorToken() { result = "*" }
-}
-
-private class FunctionReferenceDumpType extends FunctionPointerIshDumpType, FunctionReferenceType {
-  override string getDeclaratorToken() { result = "&" }
-}
-
-private class BlockDumpType extends FunctionPointerIshDumpType, BlockType {
-  override string getDeclaratorToken() { result = "^" }
-}
-
-private class RoutineDumpType extends DumpType, RoutineType {
-  override string getTypeSpecifier() { result = this.getReturnType().(DumpType).getTypeSpecifier() }
-
-  override string getDeclaratorPrefix() {
-    result = this.getReturnType().(DumpType).getDeclaratorPrefix()
-  }
-
-  language[monotonicAggregates]
-  override string getDeclaratorSuffixBeforeQualifiers() {
-    result =
-      "(" +
-        concat(int i |
-          exists(this.getParameterType(i))
-        |
-          getParameterTypeString(this.getParameterType(i)), ", " order by i
-        ) + ")"
-  }
-
-  override string getDeclaratorSuffix() {
-    result =
-      this.getReturnType().(DumpType).getDeclaratorSuffixBeforeQualifiers() +
-        this.getReturnType().(DumpType).getDeclaratorSuffix()
-  }
-}
-
-private class SpecifiedDumpType extends DerivedDumpType, SpecifiedType {
-  override string getDeclaratorPrefix() {
-    exists(string basePrefix |
-      basePrefix = this.getBaseType().(DumpType).getDeclaratorPrefix() and
-      if this.getBaseType().getUnspecifiedType() instanceof RoutineType
-      then result = basePrefix
-      else result = basePrefix + " " + this.getSpecifierString()
-    )
-  }
-
-  override string getDeclaratorSuffixBeforeQualifiers() {
-    exists(string baseSuffix |
-      baseSuffix = this.getBaseType().(DumpType).getDeclaratorSuffixBeforeQualifiers() and
-      if this.getBaseType().getUnspecifiedType() instanceof RoutineType
-      then result = baseSuffix + " " + this.getSpecifierString()
-      else result = baseSuffix
-    )
-  }
-
-  override string getDeclaratorSuffix() {
-    result = this.getBaseType().(DumpType).getDeclaratorSuffix()
-  }
-}
-
-private class UserDumpType extends DumpType, DumpDeclaration, UserType {
-  override string getIdentityString() {
-    exists(string simpleName |
-      (
-        if this instanceof Closure
-        then
-          // Parenthesize the name of the lambda because it's freeform text similar to
-          // "lambda [] type at line 12, col. 40"
-          // Use `min(getSimpleName())` to work around an extractor bug where a lambda can have different names
-          // from different compilation units.
-          simpleName = "(" + min(this.getSimpleName()) + ")"
-        else simpleName = this.getSimpleName()
-      ) and
-      result = getScopePrefix(this) + simpleName + this.getTemplateArgumentsString()
-    )
-  }
-
-  override string getTypeSpecifier() { result = this.getIdentityString() }
-}
-
-private class DumpProxyClass extends UserDumpType, ProxyClass {
-  override string getIdentityString() { result = this.getName() }
-}
-
-private class DumpVariable extends DumpDeclaration, Variable {
-  override string getIdentityString() {
-    exists(DumpType type |
-      (this instanceof MemberVariable or this instanceof GlobalOrNamespaceVariable) and
-      type = this.getType() and
-      result =
-        type.getTypeSpecifier() + type.getDeclaratorPrefix() + " " + getScopePrefix(this) +
-          this.getName() + this.getTemplateArgumentsString() +
-          type.getDeclaratorSuffixBeforeQualifiers() + type.getDeclaratorSuffix()
-    )
-  }
-}
-
-private class DumpFunction extends DumpDeclaration, Function {
-  override string getIdentityString() {
-    result =
-      this.getType().(DumpType).getTypeSpecifier() + this.getType().(DumpType).getDeclaratorPrefix()
-        + " " + getScopePrefix(this) + this.getName() + this.getTemplateArgumentsString() +
-        this.getDeclaratorSuffixBeforeQualifiers() + this.getDeclaratorSuffix()
-  }
-
-  language[monotonicAggregates]
-  private string getDeclaratorSuffixBeforeQualifiers() {
-    result =
-      "(" +
-        concat(int i |
-          exists(this.getParameter(i).getType())
-        |
-          getParameterTypeString(this.getParameter(i).getType()), ", " order by i
-        ) + ")" + this.getQualifierString()
-  }
-
-  private string getQualifierString() {
-    if exists(this.getACVQualifier())
-    then
-      result =
-        " " + strictconcat(string qualifier | qualifier = this.getACVQualifier() | qualifier, " ")
-    else result = ""
-  }
-
-  private string getACVQualifier() {
-    result = this.getASpecifier().getName() and
-    result = ["const", "volatile"]
-  }
-
-  private string getDeclaratorSuffix() {
-    result =
-      this.getType().(DumpType).getDeclaratorSuffixBeforeQualifiers() +
-        this.getType().(DumpType).getDeclaratorSuffix()
-  }
-}
-
-/**
- * Gets a string that uniquely identifies this declaration, suitable for use when debugging queries. Only holds for
- * functions, user-defined types, global and namespace-scope variables, and member variables.
- *
- * This operation is very expensive, and should not be used in production queries. Consider using `hasName()` or
- * `hasQualifiedName()` for identifying known declarations in production queries.
- */
-string getIdentityString(Declaration decl) { result = decl.(DumpDeclaration).getIdentityString() }
-
-/**
- * Gets a string that uniquely identifies this type, suitable for use when debugging queries. All typedefs and
- * decltypes are expanded, and all symbol names are fully qualified.
- *
- * This operation is very expensive, and should not be used in production queries.
- */
-string getTypeIdentityString(Type type) { result = type.(DumpType).getTypeIdentityString() }

cpp/ql/lib/semmle/code/cpp/Variable.qll

@@ -1,613 +0,0 @@
-/**
- * Provides classes for modeling variables and their declarations.
- */
-
-import semmle.code.cpp.Element
-import semmle.code.cpp.exprs.Access
-import semmle.code.cpp.Initializer
-private import semmle.code.cpp.internal.ResolveClass
-
-/**
- * A C/C++ variable. For example, in the following code there are four
- * variables, `a`, `b`, `c` and `d`:
- * ```
- * extern int a;
- * int a;
- *
- * void myFunction(int b) {
- *   int c;
- * }
- *
- * namespace N {
- *   extern int d;
- *   int d = 1;
- * }
- * ```
- *
- * For local variables, there is a one-to-one correspondence between
- * `Variable` and `VariableDeclarationEntry`.
- *
- * For other types of variable, there is a one-to-many relationship between
- * `Variable` and `VariableDeclarationEntry`. For example, a `Parameter`
- * can have multiple declarations.
- */
-class Variable extends Declaration, @variable {
-  override string getAPrimaryQlClass() { result = "Variable" }
-
-  /** Gets the initializer of this variable, if any. */
-  Initializer getInitializer() { result.getDeclaration() = this }
-
-  /** Holds if this variable has an initializer. */
-  predicate hasInitializer() { exists(this.getInitializer()) }
-
-  /** Gets an access to this variable. */
-  VariableAccess getAnAccess() { result.getTarget() = this }
-
-  /**
-   * Gets a specifier of this variable. This includes `extern`, `static`,
-   * `auto`, `private`, `protected`, `public`. Specifiers of the *type* of
-   * this variable, such as `const` and `volatile`, are instead accessed
-   * through `this.getType().getASpecifier()`.
-   */
-  override Specifier getASpecifier() {
-    varspecifiers(underlyingElement(this), unresolveElement(result))
-  }
-
-  /** Gets an attribute of this variable. */
-  Attribute getAnAttribute() { varattributes(underlyingElement(this), unresolveElement(result)) }
-
-  /** Holds if this variable is `const`. */
-  predicate isConst() { this.getType().isConst() }
-
-  /** Holds if this variable is `volatile`. */
-  predicate isVolatile() { this.getType().isVolatile() }
-
-  /** Gets the name of this variable. */
-  override string getName() { none() }
-
-  /** Gets the type of this variable. */
-  Type getType() { none() }
-
-  /** Gets the type of this variable, after typedefs have been resolved. */
-  Type getUnderlyingType() { result = this.getType().getUnderlyingType() }
-
-  /**
-   * Gets the type of this variable, after specifiers have been deeply
-   * stripped and typedefs have been resolved.
-   */
-  Type getUnspecifiedType() { result = this.getType().getUnspecifiedType() }
-
-  /**
-   * Gets the type of this variable prior to deduction caused by the C++11
-   * `auto` keyword.
-   *
-   * If the type of this variable was not declared with the C++11 `auto`
-   * keyword, then this predicate does not hold.
-   *
-   * If the type of this variable is completely `auto`, then `result` is an
-   * instance of `AutoType`. For example:
-   *
-   *   `auto four = 4;`
-   *
-   * If the type of this variable is partially `auto`, then a descendant of
-   * `result` is an instance of `AutoType`. For example:
-   *
-   *   `const auto& c = container;`
-   */
-  Type getTypeWithAuto() { autoderivation(underlyingElement(this), unresolveElement(result)) }
-
-  /**
-   * Holds if the type of this variable is declared using the C++ `auto`
-   * keyword.
-   */
-  predicate declaredUsingAutoType() { autoderivation(underlyingElement(this), _) }
-
-  override VariableDeclarationEntry getADeclarationEntry() { result.getDeclaration() = this }
-
-  override Location getADeclarationLocation() { result = this.getADeclarationEntry().getLocation() }
-
-  override VariableDeclarationEntry getDefinition() {
-    result = this.getADeclarationEntry() and
-    result.isDefinition()
-  }
-
-  override Location getDefinitionLocation() { result = this.getDefinition().getLocation() }
-
-  override Location getLocation() {
-    if exists(this.getDefinition())
-    then result = this.getDefinitionLocation()
-    else result = this.getADeclarationLocation()
-  }
-
-  /**
-   * Gets an expression that is assigned to this variable somewhere in the
-   * program.
-   */
-  Expr getAnAssignedValue() {
-    result = this.getInitializer().getExpr()
-    or
-    exists(ConstructorFieldInit cfi | cfi.getTarget() = this and result = cfi.getExpr())
-    or
-    exists(AssignExpr ae | ae.getLValue().(Access).getTarget() = this and result = ae.getRValue())
-    or
-    exists(ClassAggregateLiteral l | result = l.getFieldExpr(this))
-  }
-
-  /**
-   * Gets an assignment expression that assigns to this variable.
-   * For example: `x=...` or `x+=...`.
-   *
-   * This does _not_ include the initialization of the variable. Use
-   * `Variable.getInitializer()` to get the variable's initializer,
-   * or use `Variable.getAnAssignedValue()` to get an expression that
-   * is the right-hand side of an assignment or an initialization of
-   * the varible.
-   */
-  Assignment getAnAssignment() { result.getLValue() = this.getAnAccess() }
-
-  /**
-   * Holds if this variable is `constexpr`.
-   */
-  predicate isConstexpr() { this.hasSpecifier("is_constexpr") }
-
-  /**
-   * Holds if this variable is declared `constinit`.
-   */
-  predicate isConstinit() { this.hasSpecifier("declared_constinit") }
-
-  /**
-   * Holds if this variable is `thread_local`.
-   */
-  predicate isThreadLocal() { this.hasSpecifier("is_thread_local") }
-
-  /**
-   * Holds if this variable is constructed from `v` as a result
-   * of template instantiation. If so, it originates either from a template
-   * variable or from a variable nested in a template class.
-   */
-  predicate isConstructedFrom(Variable v) {
-    variable_instantiation(underlyingElement(this), unresolveElement(v))
-  }
-
-  /**
-   * Holds if this is a compiler-generated variable. For example, a
-   * [range-based for loop](http://en.cppreference.com/w/cpp/language/range-for)
-   * typically has three compiler-generated variables, named `__range`,
-   * `__begin`, and `__end`:
-   *
-   *    `for (char c : str) { ... }`
-   */
-  predicate isCompilerGenerated() { compgenerated(underlyingElement(this)) }
-}
-
-/**
- * A particular declaration or definition of a C/C++ variable. For example, in
- * the following code there are six variable declaration entries - two each for
- * `a` and `d`, and one each for `b` and `c`:
- * ```
- * extern int a;
- * int a;
- *
- * void myFunction(int b) {
- *   int c;
- * }
- *
- * namespace N {
- *   extern int d;
- *   int d = 1;
- * }
- * ```
- */
-class VariableDeclarationEntry extends DeclarationEntry, @var_decl {
-  override Variable getDeclaration() { result = this.getVariable() }
-
-  override string getAPrimaryQlClass() { result = "VariableDeclarationEntry" }
-
-  /**
-   * Gets the variable which is being declared or defined.
-   */
-  Variable getVariable() { var_decls(underlyingElement(this), unresolveElement(result), _, _, _) }
-
-  /**
-   * Gets the name, if any, used for the variable at this declaration or
-   * definition.
-   *
-   * In most cases, this will be the name of the variable itself. The only
-   * case in which it can differ is in a parameter declaration entry,
-   * because the parameter may have a different name in the declaration
-   * than in the definition. For example:
-   *
-   * ```
-   * // Declaration. Parameter is named "x".
-   * int f(int x);
-   *
-   * // Definition. Parameter is named "y".
-   * int f(int y) { return y; }
-   * ```
-   */
-  override string getName() { var_decls(underlyingElement(this), _, _, result, _) and result != "" }
-
-  /**
-   * Gets the type of the variable which is being declared or defined.
-   */
-  override Type getType() { var_decls(underlyingElement(this), _, unresolveElement(result), _, _) }
-
-  override Location getLocation() { var_decls(underlyingElement(this), _, _, _, result) }
-
-  /**
-   * Holds if this is a definition of a variable.
-   *
-   * This always holds for local variables and member variables, but need
-   * not hold for global variables. In the case of function parameters,
-   * this holds precisely when the enclosing `FunctionDeclarationEntry` is
-   * a definition.
-   */
-  override predicate isDefinition() { var_def(underlyingElement(this)) }
-
-  override string getASpecifier() { var_decl_specifiers(underlyingElement(this), result) }
-}
-
-/**
- * A parameter as described within a particular declaration or definition
- * of a C/C++ function. For example the declaration of `a` in the following
- * code:
- * ```
- * void myFunction(int a) {
- *   int b;
- * }
- * ```
- */
-class ParameterDeclarationEntry extends VariableDeclarationEntry {
-  ParameterDeclarationEntry() { param_decl_bind(underlyingElement(this), _, _) }
-
-  override string getAPrimaryQlClass() { result = "ParameterDeclarationEntry" }
-
-  /**
-   * Gets the function declaration or definition which this parameter
-   * description is part of.
-   */
-  FunctionDeclarationEntry getFunctionDeclarationEntry() {
-    param_decl_bind(underlyingElement(this), _, unresolveElement(result))
-  }
-
-  /**
-   * Gets the zero-based index of this parameter.
-   */
-  int getIndex() { param_decl_bind(underlyingElement(this), result, _) }
-
-  private string getAnonymousParameterDescription() {
-    not exists(this.getName()) and
-    exists(string idx |
-      idx =
-        ((this.getIndex() + 1).toString() + "th")
-            .replaceAll("1th", "1st")
-            .replaceAll("2th", "2nd")
-            .replaceAll("3th", "3rd")
-            .replaceAll("11st", "11th")
-            .replaceAll("12nd", "12th")
-            .replaceAll("13rd", "13th") and
-      if exists(this.getCanonicalName())
-      then
-        result = "declaration of " + this.getCanonicalName() + " as anonymous " + idx + " parameter"
-      else result = "declaration of " + idx + " parameter"
-    )
-  }
-
-  override string toString() {
-    this.isDefinition() and
-    result = "definition of " + this.getName()
-    or
-    not this.isDefinition() and
-    if this.getName() = this.getCanonicalName()
-    then result = "declaration of " + this.getName()
-    else result = "declaration of " + this.getCanonicalName() + " as " + this.getName()
-    or
-    result = this.getAnonymousParameterDescription()
-  }
-
-  /**
-   * Gets the name of this `ParameterDeclarationEntry` including it's type.
-   *
-   * For example: "int p".
-   */
-  string getTypedName() {
-    exists(string typeString, string nameString |
-      (
-        if exists(this.getType().getName())
-        then typeString = this.getType().getName()
-        else typeString = ""
-      ) and
-      (if exists(this.getName()) then nameString = this.getName() else nameString = "") and
-      if typeString != "" and nameString != ""
-      then result = typeString + " " + nameString
-      else result = typeString + nameString
-    )
-  }
-}
-
-/**
- * A C/C++ variable with block scope [N4140 3.3.3]. In other words, a local
- * variable or a function parameter. For example, the variables `a`, `b` and
- * `c` in the following code:
- * ```
- * void myFunction(int a) {
- *   int b;
- *   static int c;
- * }
- * ```
- *
- * See also `StackVariable`, which is the class of local-scope variables
- * without statics and thread-locals.
- */
-class LocalScopeVariable extends Variable, @localscopevariable {
-  /** Gets the function to which this variable belongs. */
-  Function getFunction() { none() } // overridden in subclasses
-}
-
-/**
- * A C/C++ variable with _automatic storage duration_. In other words, a
- * function parameter or a local variable that is not static or thread-local.
- * For example, the variables `a` and `b` in the following code.
- * ```
- * void myFunction(int a) {
- *   int b;
- *   static int c;
- * }
- * ```
- */
-class StackVariable extends LocalScopeVariable {
-  StackVariable() {
-    not this.isStatic() and
-    not this.isThreadLocal()
-  }
-}
-
-/**
- * A C/C++ local variable. In other words, any variable that has block
- * scope [N4140 3.3.3], but is not a parameter of a `Function` or `CatchBlock`.
- * For example the variables `b` and `c` in the following code:
- * ```
- * void myFunction(int a) {
- *   int b;
- *   static int c;
- * }
- * ```
- *
- * Local variables can be static; use the `isStatic` member predicate to detect
- * those.
- *
- * A local variable can be declared by a `DeclStmt` or a `ConditionDeclExpr`.
- */
-class LocalVariable extends LocalScopeVariable, @localvariable {
-  override string getAPrimaryQlClass() { result = "LocalVariable" }
-
-  override string getName() { localvariables(underlyingElement(this), _, result) }
-
-  override Type getType() { localvariables(underlyingElement(this), unresolveElement(result), _) }
-
-  override Function getFunction() {
-    exists(DeclStmt s | s.getADeclaration() = this and s.getEnclosingFunction() = result)
-    or
-    exists(ConditionDeclExpr e | e.getVariable() = this and e.getEnclosingFunction() = result)
-  }
-}
-
-/**
- * A variable whose contents always have static storage duration. This can be a
- * global variable, a namespace variable, a static local variable, or a static
- * member variable.
- */
-class StaticStorageDurationVariable extends Variable {
-  StaticStorageDurationVariable() {
-    this instanceof GlobalOrNamespaceVariable
-    or
-    this.(LocalVariable).isStatic()
-    or
-    this.(MemberVariable).isStatic()
-  }
-
-  /**
-   * Holds if the initializer for this variable is evaluated at runtime.
-   */
-  predicate hasDynamicInitialization() {
-    runtimeExprInStaticInitializer(this.getInitializer().getExpr())
-  }
-}
-
-/**
- * Holds if `e` is an expression in a static initializer that must be evaluated
- * at run time. This predicate computes "is non-const" instead of "is const"
- * since computing "is const" for an aggregate literal with many children would
- * either involve recursion through `forall` on those children or an iteration
- * through the rank numbers of the children, both of which can be slow.
- */
-private predicate runtimeExprInStaticInitializer(Expr e) {
-  inStaticInitializer(e) and
-  if e instanceof AggregateLiteral // in sync with the cast in `inStaticInitializer`
-  then runtimeExprInStaticInitializer(e.getAChild())
-  else not e.getFullyConverted().isConstant()
-}
-
-/**
- * Holds if `e` is the initializer of a `StaticStorageDurationVariable`, either
- * directly or below some top-level `AggregateLiteral`s.
- */
-private predicate inStaticInitializer(Expr e) {
-  exists(StaticStorageDurationVariable var | e = var.getInitializer().getExpr())
-  or
-  // The cast to `AggregateLiteral` ensures we only compute what'll later be
-  // needed by `runtimeExprInStaticInitializer`.
-  inStaticInitializer(e.getParent().(AggregateLiteral))
-}
-
-/**
- * A C++ local variable declared as `static`.
- */
-class StaticLocalVariable extends LocalVariable, StaticStorageDurationVariable { }
-
-/**
- * A C/C++ variable which has global scope or namespace scope. For example the
- * variables `a` and `b` in the following code:
- * ```
- * int a;
- *
- * namespace N {
- *   int b;
- * }
- * ```
- */
-class GlobalOrNamespaceVariable extends Variable, @globalvariable {
-  override string getName() { globalvariables(underlyingElement(this), _, result) }
-
-  override Type getType() { globalvariables(underlyingElement(this), unresolveElement(result), _) }
-
-  override Element getEnclosingElement() { none() }
-}
-
-/**
- * A C/C++ variable which has namespace scope. For example the variable `b`
- * in the following code:
- * ```
- * int a;
- *
- * namespace N {
- *   int b;
- * }
- * ```
- */
-class NamespaceVariable extends GlobalOrNamespaceVariable {
-  NamespaceVariable() {
-    exists(Namespace n | namespacembrs(unresolveElement(n), underlyingElement(this)))
-  }
-
-  override string getAPrimaryQlClass() { result = "NamespaceVariable" }
-}
-
-/**
- * A C/C++ variable which has global scope. For example the variable `a`
- * in the following code:
- * ```
- * int a;
- *
- * namespace N {
- *   int b;
- * }
- * ```
- *
- * Note that variables declared in anonymous namespaces have namespace scope,
- * even though they are accessed in the same manner as variables declared in
- * the enclosing scope of said namespace (which may be the global scope).
- */
-class GlobalVariable extends GlobalOrNamespaceVariable {
-  GlobalVariable() { not this instanceof NamespaceVariable }
-
-  override string getAPrimaryQlClass() { result = "GlobalVariable" }
-}
-
-/**
- * A C structure member or C++ member variable. For example the member
- * variables `m` and `s` in the following code:
- * ```
- * class MyClass {
- * public:
- *   int m;
- *   static int s;
- * };
- * ```
- *
- * This includes static member variables in C++. To exclude static member
- * variables, use `Field` instead of `MemberVariable`.
- */
-class MemberVariable extends Variable, @membervariable {
-  MemberVariable() { this.isMember() }
-
-  override string getAPrimaryQlClass() { result = "MemberVariable" }
-
-  /** Holds if this member is private. */
-  predicate isPrivate() { this.hasSpecifier("private") }
-
-  /** Holds if this member is protected. */
-  predicate isProtected() { this.hasSpecifier("protected") }
-
-  /** Holds if this member is public. */
-  predicate isPublic() { this.hasSpecifier("public") }
-
-  override string getName() { membervariables(underlyingElement(this), _, result) }
-
-  override Type getType() {
-    if strictcount(this.getAType()) = 1
-    then result = this.getAType()
-    else
-      // In rare situations a member variable may have multiple types in
-      // different translation units. In that case, we return the unspecified
-      // type.
-      result = this.getAType().getUnspecifiedType()
-  }
-
-  /** Holds if this member is mutable. */
-  predicate isMutable() { this.getADeclarationEntry().hasSpecifier("mutable") }
-
-  private Type getAType() { membervariables(underlyingElement(this), unresolveElement(result), _) }
-}
-
-/**
- * A C/C++ function pointer variable.
- *
- * DEPRECATED: use `Variable.getType() instanceof FunctionPointerType` instead.
- */
-deprecated class FunctionPointerVariable extends Variable {
-  FunctionPointerVariable() { this.getType() instanceof FunctionPointerType }
-}
-
-/**
- * A C/C++ function pointer member variable.
- *
- * DEPRECATED: use `MemberVariable.getType() instanceof FunctionPointerType` instead.
- */
-deprecated class FunctionPointerMemberVariable extends MemberVariable {
-  FunctionPointerMemberVariable() { this instanceof FunctionPointerVariable }
-}
-
-/**
- * A C++14 variable template. For example, in the following code the variable
- * template `v` defines a family of variables:
- * ```
- * template<class T>
- * T v;
- * ```
- */
-class TemplateVariable extends Variable {
-  TemplateVariable() { is_variable_template(underlyingElement(this)) }
-
-  /**
-   * Gets an instantiation of this variable template.
-   */
-  Variable getAnInstantiation() { result.isConstructedFrom(this) }
-}
-
-/**
- * A non-static local variable or parameter that is not part of an
- * uninstantiated template. Uninstantiated templates are purely syntax, and
- * only on instantiation will they be complete with information about types,
- * conversions, call targets, etc. For example in the following code, the
- * variables `a` in `myFunction` and `b` in the instantiation
- * `myTemplateFunction<int>`, but not `b` in the template
- * `myTemplateFunction<T>`:
- * ```
- * void myFunction() {
- *   float a;
- * }
- *
- * template<typename T>
- * void myTemplateFunction() {
- *   T b;
- * }
- *
- * ...
- *
- * myTemplateFunction<int>();
- * ```
- */
-class SemanticStackVariable extends StackVariable {
-  SemanticStackVariable() { not this.isFromUninstantiatedTemplate(_) }
-}

cpp/ql/lib/semmle/code/cpp/XML.qll

@@ -1,343 +0,0 @@
-/**
- * Provides classes and predicates for working with XML files and their content.
- */
-
-import semmle.files.FileSystem
-
-private class TXMLLocatable =
-  @xmldtd or @xmlelement or @xmlattribute or @xmlnamespace or @xmlcomment or @xmlcharacters;
-
-/** An XML element that has a location. */
-class XMLLocatable extends @xmllocatable, TXMLLocatable {
-  /** Gets the source location for this element. */
-  Location getLocation() { xmllocations(this, result) }
-
-  /**
-   * DEPRECATED: Use `getLocation()` instead.
-   *
-   * Gets the source location for this element.
-   */
-  deprecated Location getALocation() { result = this.getLocation() }
-
-  /**
-   * Holds if this element is at the specified location.
-   * The location spans column `startcolumn` of line `startline` to
-   * column `endcolumn` of line `endline` in file `filepath`.
-   * For more information, see
-   * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
-   */
-  predicate hasLocationInfo(
-    string filepath, int startline, int startcolumn, int endline, int endcolumn
-  ) {
-    exists(File f, Location l | l = this.getLocation() |
-      locations_default(l, f, startline, startcolumn, endline, endcolumn) and
-      filepath = f.getAbsolutePath()
-    )
-  }
-
-  /** Gets a textual representation of this element. */
-  string toString() { none() } // overridden in subclasses
-}
-
-/**
- * An `XMLParent` is either an `XMLElement` or an `XMLFile`,
- * both of which can contain other elements.
- */
-class XMLParent extends @xmlparent {
-  XMLParent() {
-    // explicitly restrict `this` to be either an `XMLElement` or an `XMLFile`;
-    // the type `@xmlparent` currently also includes non-XML files
-    this instanceof @xmlelement or xmlEncoding(this, _)
-  }
-
-  /**
-   * Gets a printable representation of this XML parent.
-   * (Intended to be overridden in subclasses.)
-   */
-  string getName() { none() } // overridden in subclasses
-
-  /** Gets the file to which this XML parent belongs. */
-  XMLFile getFile() { result = this or xmlElements(this, _, _, _, result) }
-
-  /** Gets the child element at a specified index of this XML parent. */
-  XMLElement getChild(int index) { xmlElements(result, _, this, index, _) }
-
-  /** Gets a child element of this XML parent. */
-  XMLElement getAChild() { xmlElements(result, _, this, _, _) }
-
-  /** Gets a child element of this XML parent with the given `name`. */
-  XMLElement getAChild(string name) { xmlElements(result, _, this, _, _) and result.hasName(name) }
-
-  /** Gets a comment that is a child of this XML parent. */
-  XMLComment getAComment() { xmlComments(result, _, this, _) }
-
-  /** Gets a character sequence that is a child of this XML parent. */
-  XMLCharacters getACharactersSet() { xmlChars(result, _, this, _, _, _) }
-
-  /** Gets the depth in the tree. (Overridden in XMLElement.) */
-  int getDepth() { result = 0 }
-
-  /** Gets the number of child XML elements of this XML parent. */
-  int getNumberOfChildren() { result = count(XMLElement e | xmlElements(e, _, this, _, _)) }
-
-  /** Gets the number of places in the body of this XML parent where text occurs. */
-  int getNumberOfCharacterSets() { result = count(int pos | xmlChars(_, _, this, pos, _, _)) }
-
-  /**
-   * DEPRECATED: Internal.
-   *
-   * Append the character sequences of this XML parent from left to right, separated by a space,
-   * up to a specified (zero-based) index.
-   */
-  deprecated string charsSetUpTo(int n) {
-    n = 0 and xmlChars(_, result, this, 0, _, _)
-    or
-    n > 0 and
-    exists(string chars | xmlChars(_, chars, this, n, _, _) |
-      result = this.charsSetUpTo(n - 1) + " " + chars
-    )
-  }
-
-  /**
-   * Gets the result of appending all the character sequences of this XML parent from
-   * left to right, separated by a space.
-   */
-  string allCharactersString() {
-    result =
-      concat(string chars, int pos | xmlChars(_, chars, this, pos, _, _) | chars, " " order by pos)
-  }
-
-  /** Gets the text value contained in this XML parent. */
-  string getTextValue() { result = this.allCharactersString() }
-
-  /** Gets a printable representation of this XML parent. */
-  string toString() { result = this.getName() }
-}
-
-/** An XML file. */
-class XMLFile extends XMLParent, File {
-  XMLFile() { xmlEncoding(this, _) }
-
-  /** Gets a printable representation of this XML file. */
-  override string toString() { result = this.getName() }
-
-  /** Gets the name of this XML file. */
-  override string getName() { result = File.super.getAbsolutePath() }
-
-  /**
-   * DEPRECATED: Use `getAbsolutePath()` instead.
-   *
-   * Gets the path of this XML file.
-   */
-  deprecated string getPath() { result = this.getAbsolutePath() }
-
-  /**
-   * DEPRECATED: Use `getParentContainer().getAbsolutePath()` instead.
-   *
-   * Gets the path of the folder that contains this XML file.
-   */
-  deprecated string getFolder() { result = this.getParentContainer().getAbsolutePath() }
-
-  /** Gets the encoding of this XML file. */
-  string getEncoding() { xmlEncoding(this, result) }
-
-  /** Gets the XML file itself. */
-  override XMLFile getFile() { result = this }
-
-  /** Gets a top-most element in an XML file. */
-  XMLElement getARootElement() { result = this.getAChild() }
-
-  /** Gets a DTD associated with this XML file. */
-  XMLDTD getADTD() { xmlDTDs(result, _, _, _, this) }
-}
-
-/**
- * An XML document type definition (DTD).
- *
- * Example:
- *
- * ```
- * <!ELEMENT person (firstName, lastName?)>
- * <!ELEMENT firstName (#PCDATA)>
- * <!ELEMENT lastName (#PCDATA)>
- * ```
- */
-class XMLDTD extends XMLLocatable, @xmldtd {
-  /** Gets the name of the root element of this DTD. */
-  string getRoot() { xmlDTDs(this, result, _, _, _) }
-
-  /** Gets the public ID of this DTD. */
-  string getPublicId() { xmlDTDs(this, _, result, _, _) }
-
-  /** Gets the system ID of this DTD. */
-  string getSystemId() { xmlDTDs(this, _, _, result, _) }
-
-  /** Holds if this DTD is public. */
-  predicate isPublic() { not xmlDTDs(this, _, "", _, _) }
-
-  /** Gets the parent of this DTD. */
-  XMLParent getParent() { xmlDTDs(this, _, _, _, result) }
-
-  override string toString() {
-    this.isPublic() and
-    result = this.getRoot() + " PUBLIC '" + this.getPublicId() + "' '" + this.getSystemId() + "'"
-    or
-    not this.isPublic() and
-    result = this.getRoot() + " SYSTEM '" + this.getSystemId() + "'"
-  }
-}
-
-/**
- * An XML element in an XML file.
- *
- * Example:
- *
- * ```
- * <manifest xmlns:android="http://schemas.android.com/apk/res/android"
- *           package="com.example.exampleapp" android:versionCode="1">
- * </manifest>
- * ```
- */
-class XMLElement extends @xmlelement, XMLParent, XMLLocatable {
-  /** Holds if this XML element has the given `name`. */
-  predicate hasName(string name) { name = this.getName() }
-
-  /** Gets the name of this XML element. */
-  override string getName() { xmlElements(this, result, _, _, _) }
-
-  /** Gets the XML file in which this XML element occurs. */
-  override XMLFile getFile() { xmlElements(this, _, _, _, result) }
-
-  /** Gets the parent of this XML element. */
-  XMLParent getParent() { xmlElements(this, _, result, _, _) }
-
-  /** Gets the index of this XML element among its parent's children. */
-  int getIndex() { xmlElements(this, _, _, result, _) }
-
-  /** Holds if this XML element has a namespace. */
-  predicate hasNamespace() { xmlHasNs(this, _, _) }
-
-  /** Gets the namespace of this XML element, if any. */
-  XMLNamespace getNamespace() { xmlHasNs(this, result, _) }
-
-  /** Gets the index of this XML element among its parent's children. */
-  int getElementPositionIndex() { xmlElements(this, _, _, result, _) }
-
-  /** Gets the depth of this element within the XML file tree structure. */
-  override int getDepth() { result = this.getParent().getDepth() + 1 }
-
-  /** Gets an XML attribute of this XML element. */
-  XMLAttribute getAnAttribute() { result.getElement() = this }
-
-  /** Gets the attribute with the specified `name`, if any. */
-  XMLAttribute getAttribute(string name) { result.getElement() = this and result.getName() = name }
-
-  /** Holds if this XML element has an attribute with the specified `name`. */
-  predicate hasAttribute(string name) { exists(XMLAttribute a | a = this.getAttribute(name)) }
-
-  /** Gets the value of the attribute with the specified `name`, if any. */
-  string getAttributeValue(string name) { result = this.getAttribute(name).getValue() }
-
-  /** Gets a printable representation of this XML element. */
-  override string toString() { result = this.getName() }
-}
-
-/**
- * An attribute that occurs inside an XML element.
- *
- * Examples:
- *
- * ```
- * package="com.example.exampleapp"
- * android:versionCode="1"
- * ```
- */
-class XMLAttribute extends @xmlattribute, XMLLocatable {
-  /** Gets the name of this attribute. */
-  string getName() { xmlAttrs(this, _, result, _, _, _) }
-
-  /** Gets the XML element to which this attribute belongs. */
-  XMLElement getElement() { xmlAttrs(this, result, _, _, _, _) }
-
-  /** Holds if this attribute has a namespace. */
-  predicate hasNamespace() { xmlHasNs(this, _, _) }
-
-  /** Gets the namespace of this attribute, if any. */
-  XMLNamespace getNamespace() { xmlHasNs(this, result, _) }
-
-  /** Gets the value of this attribute. */
-  string getValue() { xmlAttrs(this, _, _, result, _, _) }
-
-  /** Gets a printable representation of this XML attribute. */
-  override string toString() { result = this.getName() + "=" + this.getValue() }
-}
-
-/**
- * A namespace used in an XML file.
- *
- * Example:
- *
- * ```
- * xmlns:android="http://schemas.android.com/apk/res/android"
- * ```
- */
-class XMLNamespace extends XMLLocatable, @xmlnamespace {
-  /** Gets the prefix of this namespace. */
-  string getPrefix() { xmlNs(this, result, _, _) }
-
-  /** Gets the URI of this namespace. */
-  string getURI() { xmlNs(this, _, result, _) }
-
-  /** Holds if this namespace has no prefix. */
-  predicate isDefault() { this.getPrefix() = "" }
-
-  override string toString() {
-    this.isDefault() and result = this.getURI()
-    or
-    not this.isDefault() and result = this.getPrefix() + ":" + this.getURI()
-  }
-}
-
-/**
- * A comment in an XML file.
- *
- * Example:
- *
- * ```
- * <!-- This is a comment. -->
- * ```
- */
-class XMLComment extends @xmlcomment, XMLLocatable {
-  /** Gets the text content of this XML comment. */
-  string getText() { xmlComments(this, result, _, _) }
-
-  /** Gets the parent of this XML comment. */
-  XMLParent getParent() { xmlComments(this, _, result, _) }
-
-  /** Gets a printable representation of this XML comment. */
-  override string toString() { result = this.getText() }
-}
-
-/**
- * A sequence of characters that occurs between opening and
- * closing tags of an XML element, excluding other elements.
- *
- * Example:
- *
- * ```
- * <content>This is a sequence of characters.</content>
- * ```
- */
-class XMLCharacters extends @xmlcharacters, XMLLocatable {
-  /** Gets the content of this character sequence. */
-  string getCharacters() { xmlChars(this, result, _, _, _, _) }
-
-  /** Gets the parent of this character sequence. */
-  XMLParent getParent() { xmlChars(this, _, result, _, _, _) }
-
-  /** Holds if this character sequence is CDATA. */
-  predicate isCDATA() { xmlChars(this, _, _, _, 1, _) }
-
-  /** Gets a printable representation of this XML character sequence. */
-  override string toString() { result = this.getCharacters() }
-}

cpp/ql/lib/semmle/code/cpp/commons/Buffer.qll

@@ -1,90 +0,0 @@
-import cpp
-import semmle.code.cpp.dataflow.DataFlow
-
-/**
- * Holds if `v` is a member variable of `c` that looks like it might be variable sized
- * in practice. For example:
- * ```
- * struct myStruct { // c
- *   int amount;
- *   char data[1]; // v
- * };
- * ```
- * This requires that `v` is an array of size 0 or 1.
- */
-predicate memberMayBeVarSize(Class c, MemberVariable v) {
-  c = v.getDeclaringType() and
-  v.getUnspecifiedType().(ArrayType).getArraySize() <= 1
-}
-
-/**
- * Get the size in bytes of the buffer pointed to by an expression (if this can be determined).
- */
-language[monotonicAggregates]
-int getBufferSize(Expr bufferExpr, Element why) {
-  exists(Variable bufferVar | bufferVar = bufferExpr.(VariableAccess).getTarget() |
-    // buffer is a fixed size array
-    result = bufferVar.getUnspecifiedType().(ArrayType).getSize() and
-    why = bufferVar and
-    not memberMayBeVarSize(_, bufferVar) and
-    not result = 0 // zero sized arrays are likely to have special usage, for example
-    or
-    // behaving a bit like a 'union' overlapping other fields.
-    // buffer is an initialized array
-    //  e.g. int buffer[] = {1, 2, 3};
-    why = bufferVar.getInitializer().getExpr() and
-    (
-      why instanceof AggregateLiteral or
-      why instanceof StringLiteral
-    ) and
-    result = why.(Expr).getType().(ArrayType).getSize() and
-    not exists(bufferVar.getUnspecifiedType().(ArrayType).getSize())
-    or
-    exists(Class parentClass, VariableAccess parentPtr |
-      // buffer is the parentPtr->bufferVar of a 'variable size struct'
-      memberMayBeVarSize(parentClass, bufferVar) and
-      why = bufferVar and
-      parentPtr = bufferExpr.(VariableAccess).getQualifier() and
-      parentPtr.getTarget().getUnspecifiedType().(PointerType).getBaseType() = parentClass and
-      result = getBufferSize(parentPtr, _) + bufferVar.getType().getSize() - parentClass.getSize()
-    )
-  )
-  or
-  // buffer is a fixed size dynamic allocation
-  result = bufferExpr.(AllocationExpr).getSizeBytes() and
-  why = bufferExpr
-  or
-  exists(DataFlow::ExprNode bufferExprNode |
-    // dataflow (all sources must be the same size)
-    bufferExprNode = DataFlow::exprNode(bufferExpr) and
-    result =
-      unique(Expr def |
-        DataFlow::localFlowStep(DataFlow::exprNode(def), bufferExprNode)
-      |
-        getBufferSize(def, _)
-      ) and
-    // find reason
-    exists(Expr def | DataFlow::localFlowStep(DataFlow::exprNode(def), bufferExprNode) |
-      why = def or
-      exists(getBufferSize(def, why))
-    )
-  )
-  or
-  exists(Type bufferType |
-    // buffer is the address of a variable
-    why = bufferExpr.(AddressOfExpr).getAddressable() and
-    bufferType = why.(Variable).getType() and
-    result = bufferType.getSize() and
-    not bufferType instanceof ReferenceType and
-    not any(Union u).getAMemberVariable() = why
-  )
-  or
-  exists(Union bufferType |
-    // buffer is the address of a union member; in this case, we
-    // take the size of the union itself rather the union member, since
-    // it's usually OK to access that amount (e.g. clearing with memset).
-    why = bufferExpr.(AddressOfExpr).getAddressable() and
-    bufferType.getAMemberVariable() = why and
-    result = bufferType.getSize()
-  )
-}

cpp/ql/lib/semmle/code/cpp/commons/Dependency.qll

@@ -1,502 +0,0 @@
-import semmle.code.cpp.Element
-import semmle.code.cpp.Declaration
-import semmle.code.cpp.Function
-import semmle.code.cpp.Variable
-
-/**
- * Options that control the dependencies generated by
- * this library.
- */
-class DependencyOptions extends string {
-  DependencyOptions() { this = "DependencyOptions" }
-
-  /**
-   * Holds if dependencies should only be generated in templates rather than
-   * in both templates and instantiations, where possible.  This is expensive
-   * to compute, but tends to produce dependencies that are easier to read.
-   */
-  cached
-  predicate preferTemplateDeps() { any() }
-}
-
-/**
- * Gets the `DependencyOptions`.
- */
-DependencyOptions getDependencyOptions() { any() }
-
-/**
- * An Element that can be the source of a transitive dependency.  This is any
- * Element that is not in a template instantiation, plus declarations of template
- * specializations (even though they are technically in an instantiation) because
- * we need to generate (at least) a dependency from them to the general declaration.
- */
-class DependsSource extends Element {
-  DependsSource() {
-    // not inside a template instantiation
-    not exists(Element other | this.isFromTemplateInstantiation(other)) or
-    // allow DeclarationEntrys of template specializations
-    this.(DeclarationEntry).getDeclaration().(Function).isConstructedFrom(_) or
-    this.(DeclarationEntry).getDeclaration().(Class).isConstructedFrom(_)
-  }
-}
-
-/**
- * A program element which can be the target of inter-function or inter-file dependencies.
- *
- * This is the union of Declaration, DeclarationEntry and Macro, minus various kinds of declaration:
- *  * FriendDecl is not included, as a friend declaration cannot be the target of a dependency (nor, as it happens, can they be a source).
- *  * TemplateParameter and related UserTypes are not included, as they are intrinsic sub-components of their associated template.
- *  * Template instantiations are excluded, as the template itself is more useful as a dependency target.
- *  * Stack variables and local types are excluded, as they are lexically tied to their enclosing function, and intra-function dependencies
- *    can only be inter-file dependencies in pathological cases.
- *  * Builtin functions and macros are excluded, as dependencies on them do not translate to inter-file dependencies (note that static functions
- *    and declarations within anonymous namespaces cannot be excluded for this reason, as the declaration can be in a header).
- *  * DeclarationEntrys are only needed if they're not definitions, for the definition to declaration dependency.
- */
-class Symbol extends DependsSource {
-  Symbol() {
-    (
-      exists(EnumConstant ec | this = ec and not ec.getDeclaringEnum() instanceof LocalEnum)
-      or
-      this instanceof Macro and this.getFile().getAbsolutePath() != ""
-      or
-      this instanceof DeclarationEntry and
-      not this.(VariableDeclarationEntry).getVariable() instanceof LocalScopeVariable and
-      not this.(FunctionDeclarationEntry).getFunction() instanceof BuiltInFunction and
-      not this.(TypeDeclarationEntry).getType() instanceof LocalEnum and
-      not this.(TypeDeclarationEntry).getType() instanceof LocalClass and
-      not this.(TypeDeclarationEntry).getType() instanceof LocalTypedefType and
-      not this.(TypeDeclarationEntry).getType() instanceof TemplateParameter
-      or
-      this instanceof NamespaceDeclarationEntry
-    )
-  }
-
-  /**
-   * Gets an element which depends upon this symbol.
-   *
-   * To a first approximation, dependent elements can be thought of as occurrences of the symbol's name: instances of `VariableAccess`
-   * for `Variable` symbols, instances of `MacroInvocation` for `Macro` symbols, and so on.
-   *
-   *  category:
-   *   1 - C/C++ compile-time dependency
-   *   2 - C/C++ link-time dependency (or transitive dependency with a link-time component)
-   */
-  cached
-  Element getADependentElement(int category) { dependsOnFull(result, this, category) }
-}
-
-/**
- * Associates a Declaration with it's DeclarationEntries, or (for a template
- * instantiation) with the DeclarationEntries of its template.
- */
-cached
-predicate getDeclarationEntries(Declaration decl, DeclarationEntry de) {
-  (
-    decl = de.getDeclaration() or
-    decl.(Function).isConstructedFrom(de.getDeclaration()) or
-    decl.(Class).isConstructedFrom(de.getDeclaration())
-  ) and
-  // ParameterDeclarationEntries are special, as (a) they can only be accessed
-  // from within the definition, and (b) non-definition PDEs may be commonly
-  // included. Thus, for PDEs, we point only to the definition.
-  (de instanceof ParameterDeclarationEntry implies de.isDefinition())
-}
-
-/**
- * A 'simple' dependency from src to dest.  This type of dependency
- * does not make any special account of templates.
- *
- * Consider using Symbol.getADependentElement() rather than directly
- * accessing this predicate.
- */
-predicate dependsOnSimple(Element src, Element dest) {
-  dependsOnSimpleInline(src, dest) or
-  dependency_macroUse(src, dest)
-}
-
-/**
- * A 'simple' dependency that might be inlined.
- */
-private predicate dependsOnSimpleInline(Element src, Element dest) {
-  dependency_functionUse(src, dest) or
-  dependency_typeUse(src, dest) or
-  dependency_variableUse(src, dest) or
-  dependency_usingDeclaration(src, dest) or
-  dependency_usingNamespace(src, dest) or
-  dependency_enumConstantUse(src, dest) or
-  dependency_outOfLineDeclaration(src, dest) or
-  dependency_outOfLineInitializer(src, dest) or
-  dependency_functionSpecialization(src, dest) or
-  dependency_classSpecialization(src, dest)
-}
-
-/**
- * Holds if a simple, non-template dependency exists between two Locations
- * specified by the parameters.
- */
-private predicate dependsLocation(
-  File f1, int sl1, int sc1, int el1, int ec1, File f2, int sl2, int sc2, int el2, int ec2
-) {
-  exists(Element src, Element dest, Location loc1, Location loc2 |
-    dependsOnSimpleInline(src, dest) and
-    src instanceof DependsSource and
-    loc1 = src.getLocation() and
-    f1 = loc1.getFile() and
-    sl1 = loc1.getStartLine() and
-    sc1 = loc1.getStartColumn() and
-    el1 = loc1.getEndLine() and
-    ec1 = loc1.getEndColumn() and
-    loc2 = dest.getLocation() and
-    f2 = loc2.getFile() and
-    sl2 = loc2.getStartLine() and
-    sc2 = loc2.getStartColumn() and
-    el2 = loc2.getEndLine() and
-    ec2 = loc2.getEndColumn()
-  )
-}
-
-/**
- * Holds if a simple dependency from `loc` to `loc2` in a template has a
- * non-template alternative?
- * (if `DependencyOptions.preferTemplateDeps()` is enabled)
- */
-private predicate dependsNonTemplateAlternative(Location loc1, Location loc2) {
-  getDependencyOptions().preferTemplateDeps() and
-  exists(Element src, Element dest |
-    dependsOnSimpleInline(src, dest) and
-    src.isFromTemplateInstantiation(_) and
-    src.getLocation() = loc1 and
-    dest.getLocation() = loc2
-  ) and
-  dependsLocation(loc1.getFile(), loc1.getStartLine(), loc1.getStartColumn(), loc1.getEndLine(),
-    loc1.getEndColumn(), loc2.getFile(), loc2.getStartLine(), loc2.getStartColumn(),
-    loc2.getEndLine(), loc2.getEndColumn())
-}
-
-/**
- * A simple dependency from src to a declaration dest, where the definition is not
- * needed at compile time.
- */
-predicate dependsOnDeclOnly(Element src, Element dest) {
-  dependency_functionUse(src, dest) or
-  dependency_variableUse(src, dest) or
-  dependency_pointerTypeUse(src, dest)
-}
-
-/**
- * A dependency from src to dest.  This predicate inlines
- * template dependencies.
- */
-private predicate dependsOnViaTemplate(Declaration src, Element dest) {
-  // A template instantiation depends on everything that anything
-  // inside it depends upon.  This effectively inlines the things
-  // inside at the point where the template is called or
-  // referenced.
-  exists(Element internal, Location internalLocation, Location destLocation |
-    // internal is an element in the template {function or class} instantiation that cannot
-    // itself be a transitive dependency source
-    internal.isFromTemplateInstantiation(src) and
-    // don't generate template dependencies through a member function of a template class;
-    // these dependencies are also generated through the class, which has to be referenced
-    // somewhere anyway.
-    not exists(Class c |
-      internal.isFromTemplateInstantiation(c) and
-      src.getDeclaringType() = c
-    ) and
-    // dest is anything that the internal element depends upon
-    dependsOnSimpleInline(internal, dest) and
-    // is there something in the template (not the instantiation) that's generating
-    // (better) dependencies from internal anyway?
-    internalLocation = internal.getLocation() and
-    destLocation = dest.getLocation() and
-    not dependsNonTemplateAlternative(internalLocation, destLocation)
-  )
-}
-
-/**
- * Holds if `src` is related to `dest` by one `dependsOnSimple` and any
- * number of `dependsOnViaTemplate` steps.
- *
- * Consider using `Symbol.getADependentElement()` rather than directly
- * accessing this predicate.
- */
-predicate dependsOnTransitive(DependsSource src, Element dest) {
-  exists(Element mid1 |
-    // begin with a simple step
-    dependsOnSimpleInline(src, mid1) and
-    // any number of recursive steps
-    (
-      mid1 = dest or // mid1 is not necessarily a Declaration
-      dependsOnViaTemplate+(mid1, dest)
-    )
-  )
-  or
-  dependency_macroUse(src, dest)
-}
-
-/**
- * A dependency that targets a TypeDeclarationEntry.
- */
-private predicate dependsOnTDE(Element src, Type t, TypeDeclarationEntry dest) {
-  dependsOnTransitive(src, t) and
-  getDeclarationEntries(t, dest)
-}
-
-/**
- * A dependency that targets a visible TypeDeclarationEntry.
- */
-pragma[noopt]
-private predicate dependsOnVisibleTDE(Element src, Type t, TypeDeclarationEntry dest) {
-  dependsOnTDE(src, t, dest) and
-  exists(File g | g = dest.getFile() |
-    exists(File f | f = src.getFile() | f.getAnIncludedFile*() = g)
-  )
-}
-
-/**
- * A dependency that targets a DeclarationEntry
- */
-private predicate dependsOnDeclarationEntry(Element src, DeclarationEntry dest) {
-  exists(Type t |
-    // dependency from a Type use -> unique visible TDE
-    dependsOnVisibleTDE(src, t, dest) and
-    strictcount(TypeDeclarationEntry alt | dependsOnVisibleTDE(src, t, alt)) = 1
-  )
-  or
-  exists(TypedefType mid |
-    // dependency from a TypedefType use -> any (visible) TDE
-    dependsOnTransitive(src, mid) and
-    getDeclarationEntries(mid, dest.(TypeDeclarationEntry))
-  )
-  or
-  exists(Declaration mid |
-    // dependency from a Variable / Function use -> any (visible) declaration entry
-    dependsOnTransitive(src, mid) and
-    not mid instanceof Type and
-    not mid instanceof EnumConstant and
-    getDeclarationEntries(mid, dest) and
-    not dest instanceof TypeDeclarationEntry
-  )
-  or
-  exists(Declaration mid |
-    // dependency from a Type / Variable / Function use -> any (visible) definition
-    dependsOnTransitive(src, mid) and
-    not mid instanceof EnumConstant and
-    getDeclarationEntries(mid, dest) and
-    // must be definition
-    dest.isDefinition()
-  )
-}
-
-/**
- * The full dependsOn relation, made up of dependsOnTransitive plus some logic
- * to fix up the results for Declarations to most reasonable DeclarationEntrys.
- */
-private predicate dependsOnFull(DependsSource src, Symbol dest, int category) {
-  // direct result
-  dependsOnTransitive(src, dest) and
-  category = 1
-  or
-  // result to a visible DeclarationEntry
-  dependsOnDeclarationEntry(src, dest) and
-  src.getFile().getAnIncludedFile*() = dest.getFile() and
-  category = 1
-  or
-  exists(Declaration mid |
-    // dependency from a Variable / Function use -> non-visible definition (link time)
-    dependsOnTransitive(src, mid) and
-    not mid instanceof EnumConstant and
-    getDeclarationEntries(mid, dest) and
-    not dest instanceof TypeDeclarationEntry and
-    // must be definition
-    dest.(DeclarationEntry).isDefinition() and
-    // must not be visible (else covered above)
-    not src.getFile().getAnIncludedFile*() = dest.getFile() and
-    // filter out FDEs that are only defined in the dummy link target
-    (
-      (
-        dest instanceof FunctionDeclarationEntry and
-        isLinkerAwareExtracted()
-      )
-      implies
-      exists(LinkTarget lt | not lt.isDummy() |
-        lt.getAFunction() = dest.(FunctionDeclarationEntry).getFunction()
-      )
-    ) and
-    category = 2
-  )
-}
-
-/**
- * A dependency caused by a function call / use.
- */
-private predicate dependency_functionUse(Element src, Function dest) {
-  funbind(unresolveElement(src), unresolveElement(dest))
-}
-
-/**
- * A Type which refers to a UserType.
- */
-cached
-private predicate refersToUserType(Type a, UserType b) { a.refersTo(b) }
-
-/**
- * A Type which refers to a type directly, without using a pointer or reference.
- */
-private predicate refersToDirectlyNonPointer(Type a, Type b) {
-  a.refersToDirectly(b) and
-  not a instanceof PointerType and
-  not a instanceof ReferenceType
-}
-
-/**
- * A Type which refers to a UserType, but only through a pointer or reference.
- */
-cached
-private predicate refersToUserTypePointer(Type a, UserType b) {
-  refersToUserType(a, b) and
-  not refersToDirectlyNonPointer*(a, b)
-}
-
-/**
- * A dependency caused by a type use.
- */
-private predicate dependency_typeUse(Element src, UserType dest) {
-  refersToUserType(typeUsedBy(src), dest)
-}
-
-/**
- * A dependency caused by a pointer/reference type use only.
- */
-predicate dependency_pointerTypeUse(Element src, UserType dest) {
-  refersToUserTypePointer(typeUsedBy(src), dest)
-}
-
-/**
- * The Types that must be defined for a particular Element.
- */
-private Type typeUsedBy(Element src) {
-  result = src.(VariableDeclarationEntry).getType() and
-  not src.(VariableDeclarationEntry).getVariable().declaredUsingAutoType()
-  or
-  result = src.(FunctionDeclarationEntry).getType()
-  or
-  result = src.(Cast).getType() and not src.(Cast).isImplicit()
-  or
-  result = src.(ClassDerivation).getBaseClass()
-  or
-  result = src.(TypeDeclarationEntry).getType().(TypedefType).getBaseType()
-  or
-  result = src.(TypeDeclarationEntry).getDeclaration().(Enum).getExplicitUnderlyingType()
-  or
-  result = src.(SizeofTypeOperator).getTypeOperand()
-  or
-  exists(Function f |
-    funbind(unresolveElement(src), unresolveElement(f)) and result = f.getATemplateArgument()
-  )
-  or
-  result = src.(NewExpr).getType() and not result.(Class).hasConstructor()
-  or
-  result = src.(NewArrayExpr).getType() and
-  not result.(ArrayType).getBaseType().(Class).hasConstructor()
-  or
-  result = src.(DeleteExpr).getExpr().getType() and
-  not result.(PointerType).getBaseType().(Class).hasDestructor()
-  or
-  result = src.(DeleteArrayExpr).getExpr().getType() and
-  not result.(PointerType).getBaseType().(Class).hasDestructor()
-}
-
-/**
- * A dependency caused by a variable use.
- */
-private predicate dependency_variableUse(VariableAccess src, Variable dest) {
-  src.getTarget() = dest and
-  not dest instanceof LocalScopeVariable
-}
-
-/**
- * A dependency caused by an enum constant use.
- */
-private predicate dependency_enumConstantUse(EnumConstantAccess src, EnumConstant dest) {
-  src.getTarget() = dest
-}
-
-/**
- * A dependency caused by a macro access.
- */
-private predicate dependency_macroUse(MacroAccess src, Macro dest) { src.getMacro() = dest }
-
-/**
- * A dependency caused by a 'using' declaration 'using X::Y'.
- */
-private predicate dependency_usingDeclaration(UsingDeclarationEntry src, Declaration dest) {
-  src.getDeclaration() = dest
-}
-
-/**
- * A dependency caused by a 'using' directive 'using namespace X'.
- */
-private predicate dependency_usingNamespace(UsingDirectiveEntry src, NamespaceDeclarationEntry dest) {
-  exists(Namespace nsdecl |
-    nsdecl = src.getNamespace() and
-    dest.getNamespace() = nsdecl and
-    dest.getFile().getAnIncludedFile*() = src.getFile() and
-    (
-      dest.getFile() = src.getFile()
-      implies
-      dest.getLocation().getStartLine() < src.getLocation().getStartLine()
-    ) and
-    none() // temporarily disabled until we have suitable UI in Architect
-  )
-}
-
-/**
- * A dependency from the definition of a class member to a corresponding declaration.  This
- * ensures that an externally defined class member has a dependency on (something in) the
- * class definition.
- */
-private predicate dependency_outOfLineDeclaration(DeclarationEntry src, DeclarationEntry dest) {
-  src.getDeclaration().hasDeclaringType() and
-  src.isDefinition() and
-  (
-    dest.getDeclaration() = src.getDeclaration()
-    or
-    // also permit out of line declarations to jump from the declaration of a specialized
-    // function to it's definition in the primary template.  Note that the specialization
-    // in this case may be on a template class parameter.
-    src.getDeclaration().(Function).isConstructedFrom(dest.getDeclaration())
-  ) and
-  not dest.isDefinition()
-}
-
-/**
- * A dependency from an initialization of a (static) class member to a corresponding
- * declaration.
- */
-private predicate dependency_outOfLineInitializer(Initializer src, DeclarationEntry dest) {
-  src.getDeclaration().hasDeclaringType() and
-  dest.getDeclaration() = src.getDeclaration() and
-  not dest.isDefinition()
-}
-
-/**
- * A dependency from a template function specialization to the general one.
- */
-private predicate dependency_functionSpecialization(DeclarationEntry src, DeclarationEntry dest) {
-  exists(FunctionTemplateSpecialization fts |
-    src.getDeclaration() = fts and
-    dest.getDeclaration() = fts.getPrimaryTemplate()
-  )
-}
-
-/**
- * A dependency from a template class specialization to the most general one.
- */
-private predicate dependency_classSpecialization(DeclarationEntry src, DeclarationEntry dest) {
-  exists(ClassTemplateSpecialization cts |
-    src.getDeclaration() = cts and
-    dest.getDeclaration() = cts.getPrimaryTemplate()
-  )
-}

cpp/ql/lib/semmle/code/cpp/commons/NullTermination.qll

@@ -1,140 +0,0 @@
-import cpp
-private import semmle.code.cpp.models.interfaces.ArrayFunction
-private import semmle.code.cpp.models.implementations.Strcat
-import semmle.code.cpp.dataflow.DataFlow
-
-/**
- * Holds if the expression `e` assigns something including `va` to a
- * stack variable `v0`.
- */
-private predicate mayAddNullTerminatorHelper(Expr e, VariableAccess va, StackVariable v0) {
-  exists(Expr val |
-    exprDefinition(v0, e, val) and // `e` is `v0 := val`
-    val.getAChild*() = va
-  )
-}
-
-bindingset[n1, n2]
-private predicate controlFlowNodeSuccessorTransitive(ControlFlowNode n1, ControlFlowNode n2) {
-  exists(BasicBlock bb1, int pos1, BasicBlock bb2, int pos2 |
-    pragma[only_bind_into](bb1).getNode(pos1) = n1 and
-    pragma[only_bind_into](bb2).getNode(pos2) = n2 and
-    (
-      bb1 = bb2 and pos1 < pos2
-      or
-      bb1.getASuccessor+() = bb2
-    )
-  )
-}
-
-/**
- * Holds if the expression `e` may add a null terminator to the string
- * accessed by `va`.
- */
-predicate mayAddNullTerminator(Expr e, VariableAccess va) {
-  // Assignment: dereferencing or array access
-  exists(AssignExpr ae | e = ae |
-    (
-      // *v = x, *v++ = x, etc.
-      ae.getLValue().(PointerDereferenceExpr).getOperand().getAChild*() = va
-      or
-      // v[x] = y
-      ae.getLValue().(ArrayExpr).getArrayBase() = va
-    ) and
-    // Rule out assignments where the assigned value is a non-zero constant
-    not ae.getRValue().getFullyConverted().getValue().toInt() != 0
-  )
-  or
-  // Assignment to another stack variable
-  exists(StackVariable v0, Expr e0 |
-    mayAddNullTerminatorHelper(e, va, v0) and
-    mayAddNullTerminator(pragma[only_bind_into](e0), pragma[only_bind_into](v0.getAnAccess())) and
-    controlFlowNodeSuccessorTransitive(e, e0)
-  )
-  or
-  // Assignment to non-stack variable
-  exists(AssignExpr ae | e = ae |
-    not ae.getLValue().(VariableAccess).getTarget() instanceof StackVariable and
-    ae.getRValue().getAChild*() = va
-  )
-  or
-  // Function calls...
-  exists(Call c, Function f, int i |
-    e = c and
-    f = c.getTarget() and
-    not functionArgumentMustBeNullTerminated(f, i) and
-    c.getAnArgumentSubExpr(i) = va
-  |
-    // library function
-    not f.hasEntryPoint()
-    or
-    // function where the relevant parameter is potentially added a null terminator
-    mayAddNullTerminator(_, f.getParameter(i).getAnAccess())
-    or
-    // varargs function
-    f.isVarargs() and i >= f.getNumberOfParameters()
-    or
-    // function containing assembler code
-    exists(AsmStmt s | s.getEnclosingFunction() = f)
-    or
-    // function where the relevant parameter is returned (leaking it to be potentially null terminated elsewhere)
-    DataFlow::localFlow(DataFlow::parameterNode(f.getParameter(i)),
-      DataFlow::exprNode(any(ReturnStmt rs).getExpr()))
-  )
-  or
-  // Call without target (e.g., function pointer call)
-  exists(Call c |
-    e = c and
-    not exists(c.getTarget()) and
-    c.getAnArgumentSubExpr(_) = va
-  )
-}
-
-/**
- * Holds if `f` is a (library) function whose `i`th argument must be null
- * terminated.
- */
-predicate functionArgumentMustBeNullTerminated(Function f, int i) {
-  f.(ArrayFunction).hasArrayWithNullTerminator(i) and
-  f.(ArrayFunction).hasArrayInput(i)
-  or
-  f instanceof StrcatFunction and i = 0
-}
-
-/**
- * Holds if `va` is a variable access where the contents must be null terminated.
- */
-predicate variableMustBeNullTerminated(VariableAccess va) {
-  exists(FunctionCall fc |
-    // Call to a function that requires null termination
-    exists(int i |
-      functionArgumentMustBeNullTerminated(fc.getTarget(), i) and
-      fc.getArgument(i) = va
-    )
-    or
-    // String argument to a formatting function (such as `printf`)
-    exists(int n, FormatLiteral fl |
-      fc.(FormattingFunctionCall).getConversionArgument(n) = va and
-      fl = fc.(FormattingFunctionCall).getFormat() and
-      fl.getConversionType(n) instanceof PointerType and // `%s`, `%ws` etc
-      not fl.getConversionType(n) instanceof VoidPointerType and // exclude: `%p`
-      not fl.hasPrecision(n) // exclude: `%.*s`
-    )
-    or
-    // Call to a wrapper function that requires null termination
-    // (not itself adding a null terminator)
-    exists(Function wrapper, int i, Parameter p, VariableAccess use |
-      fc.getTarget() = wrapper and
-      fc.getArgument(i) = va and
-      p = wrapper.getParameter(i) and
-      parameterUsePair(p, use) and
-      variableMustBeNullTerminated(use) and
-      // Simplified: check that `p` may not be null terminated on *any*
-      // path to `use` (including the one found via `parameterUsePair`)
-      not exists(Expr e |
-        mayAddNullTerminator(pragma[only_bind_into](e), p.getAnAccess()) and
-        controlFlowNodeSuccessorTransitive(e, use)
-      )
-    )
-  )
-}

cpp/ql/lib/semmle/code/cpp/controlflow/BasicBlocks.qll

@@ -1,282 +0,0 @@
-/**
- * Provides a library for reasoning about control flow at the granularity of basic blocks.
- * This is usually much more efficient than reasoning directly at the level of `ControlFlowNode`s.
- */
-
-import cpp
-private import internal.PrimitiveBasicBlocks
-private import internal.ConstantExprs
-/*
- * `BasicBlock`s are refinements of `PrimitiveBasicBlock`s, taking
- * impossible CFG edges into account (using the `successors_adapted`
- * relation). The refinement manifests itself in two changes:
- *
- * - The successor relation on `BasicBlock`s uses `successors_adapted`
- * (instead of `successors_extended` used by `PrimtiveBasicBlock`s). Consequently,
- * some edges between `BasicBlock`s may be removed. Example:
- * ```
- * x = 1;      // s1
- * if (true) { // s2
- *   x = 2;    // s3
- * } else {
- *   x = 3;    // s4
- * }
- * ```
- * The `BasicBlock` successor edge from the basic block containing `s1`
- * and `s2` to the basic block containing `s4` is removed.
- *
- * - `PrimitiveBasicBlock`s may be split up into two or more
- * `BasicBlock`s: Internal nodes of `PrimitiveBasicBlock`s whose
- * predecessor edges have been removed (unreachable code) will be entry
- * points of new `BasicBlock`s. Consequently, each entry point of a
- * `PrimitiveBasicBlock` will also be an entry point of a `BasicBlock`,
- * but the converse does not necessarily hold. Example:
- * ```
- * x = 1;   // s5
- * abort(); // s6
- * x = 2;   // s7
- * ```
- * `s5`-`s7` belong to the same `PrimitiveBasicBlock`, but the CFG edge
- * from `s6` to `s7` is impossible, so `s7` will be the entry point of
- * its own (unreachable) `BasicBlock`.
- *
- * Note that, although possible, two or more `PrimitiveBasicBlock`s are
- * never merged to one `BasicBlock`: Consider the first example above;
- * it would be possible to define a single `BasicBlock` consisting of
- * `s1`-`s3`, however, the result would be counter-intuitive.
- */
-
-private import Cached
-
-cached
-private module Cached {
-  /**
-   * Any node that is the entry point of a primitive basic block is
-   * also the entry point of a basic block. In addition, all nodes
-   * with a primitive successor, where the predecessor has been pruned
-   * (that is, `getAPredecessor()` does not exist while a predecessor
-   * using the primitive `successors_extended` relation does exist), is also
-   * considered a basic block entry node.
-   */
-  cached
-  predicate basic_block_entry_node(ControlFlowNode node) {
-    primitive_basic_block_entry_node(node) or
-    non_primitive_basic_block_entry_node(node)
-  }
-
-  private predicate non_primitive_basic_block_entry_node(ControlFlowNode node) {
-    not primitive_basic_block_entry_node(node) and
-    not exists(node.getAPredecessor()) and
-    successors_extended(node, _)
-  }
-
-  /**
-   * Holds if basic block `bb` equals a primitive basic block.
-   *
-   * There are two situations in which this is *not* the case:
-   *
-   * - Either the entry node of `bb` does not correspond to an
-   *   entry node of a primitive basic block, or
-   * - The primitive basic block with the same entry node contains
-   *   a (non-entry) node which is the entry node of a non-primitive
-   *   basic block (that is, the primitive basic block has been split
-   *   up).
-   *
-   * This predicate is used for performance optimization only:
-   * Whenever a `BasicBlock` equals a `PrimitiveBasicBlock`, we can
-   * reuse predicates already computed for `PrimitiveBasicBlocks`.
-   */
-  private predicate equalsPrimitiveBasicBlock(BasicBlock bb) {
-    primitive_basic_block_entry_node(bb) and
-    not exists(int i |
-      i > 0 and
-      non_primitive_basic_block_entry_node(bb.(PrimitiveBasicBlock).getNode(i))
-    )
-  }
-
-  /** Holds if `node` is the `pos`th control-flow node in basic block `bb`. */
-  cached
-  predicate basic_block_member(ControlFlowNode node, BasicBlock bb, int pos) {
-    equalsPrimitiveBasicBlock(bb) and primitive_basic_block_member(node, bb, pos) // reuse already computed relation
-    or
-    non_primitive_basic_block_member(node, bb, pos)
-  }
-
-  private predicate non_primitive_basic_block_member(ControlFlowNode node, BasicBlock bb, int pos) {
-    not equalsPrimitiveBasicBlock(bb) and node = bb and pos = 0
-    or
-    not node instanceof BasicBlock and
-    exists(ControlFlowNode pred | successors_extended(pred, node) |
-      non_primitive_basic_block_member(pred, bb, pos - 1)
-    )
-  }
-
-  /** Gets the number of control-flow nodes in the basic block `bb`. */
-  cached
-  int bb_length(BasicBlock bb) {
-    if equalsPrimitiveBasicBlock(bb)
-    then result = bb.(PrimitiveBasicBlock).length() // reuse already computed relation
-    else result = strictcount(ControlFlowNode node | basic_block_member(node, bb, _))
-  }
-
-  /** Successor relation for basic blocks. */
-  cached
-  predicate bb_successor_cached(BasicBlock pred, BasicBlock succ) {
-    exists(ControlFlowNode last |
-      basic_block_member(last, pred, bb_length(pred) - 1) and
-      last.getASuccessor() = succ
-    )
-  }
-}
-
-predicate bb_successor = bb_successor_cached/2;
-
-/**
- * A basic block in the C/C++ control-flow graph.
- *
- * A basic block is a simple sequence of control-flow nodes,
- * connected to each other and nothing else:
- *
- * ```
- *    A - B - C - D  ABCD is a basic block
- * ```
- *
- * Any incoming or outgoing edges break the block into two:
- *
- * ```
- *    A - B > C - D  AB is a basic block and CD is a basic block (C has two incoming edges)
- *
- *
- *    A - B < C - D  AB is a basic block and CD is a basic block (B has two outgoing edges)
- * ```
- */
-class BasicBlock extends ControlFlowNodeBase {
-  BasicBlock() { basic_block_entry_node(this) }
-
-  /** Holds if this basic block contains `node`. */
-  predicate contains(ControlFlowNode node) { basic_block_member(node, this, _) }
-
-  /** Gets the `ControlFlowNode` at position `pos` in this basic block. */
-  ControlFlowNode getNode(int pos) { basic_block_member(result, this, pos) }
-
-  /** Gets a `ControlFlowNode` in this basic block. */
-  ControlFlowNode getANode() { basic_block_member(result, this, _) }
-
-  /** Gets a `BasicBlock` that is a direct successor of this basic block. */
-  BasicBlock getASuccessor() { bb_successor(this, result) }
-
-  /** Gets a `BasicBlock` that is a direct predecessor of this basic block. */
-  BasicBlock getAPredecessor() { bb_successor(result, this) }
-
-  /**
-   * Gets a `BasicBlock` such that the control-flow edge `(this, result)` may be taken
-   * when the outgoing edge of this basic block is an expression that is true.
-   */
-  BasicBlock getATrueSuccessor() { result.getStart() = this.getEnd().getATrueSuccessor() }
-
-  /**
-   * Gets a `BasicBlock` such that the control-flow edge `(this, result)` may be taken
-   * when the outgoing edge of this basic block is an expression that is false.
-   */
-  BasicBlock getAFalseSuccessor() { result.getStart() = this.getEnd().getAFalseSuccessor() }
-
-  /** Gets the final `ControlFlowNode` of this basic block. */
-  ControlFlowNode getEnd() { basic_block_member(result, this, bb_length(this) - 1) }
-
-  /** Gets the first `ControlFlowNode` of this basic block. */
-  ControlFlowNode getStart() { result = this }
-
-  /** Gets the number of `ControlFlowNode`s in this basic block. */
-  int length() { result = bb_length(this) }
-
-  /**
-   * Holds if this element is at the specified location.
-   * The location spans column `startcolumn` of line `startline` to
-   * column `endcolumn` of line `endline` in file `filepath`.
-   * For more information, see
-   * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
-   *
-   * Yields no result if this basic block spans multiple source files.
-   */
-  predicate hasLocationInfo(
-    string filepath, int startline, int startcolumn, int endline, int endcolumn
-  ) {
-    this.hasLocationInfoInternal(filepath, startline, startcolumn, filepath, endline, endcolumn)
-  }
-
-  pragma[noinline]
-  private predicate hasLocationInfoInternal(
-    string file, int line, int col, string endf, int endl, int endc
-  ) {
-    this.getStart().getLocation().hasLocationInfo(file, line, col, _, _) and
-    this.getEnd().getLocation().hasLocationInfo(endf, _, _, endl, endc)
-  }
-
-  /** Gets the function containing this basic block. */
-  Function getEnclosingFunction() { result = this.getStart().getControlFlowScope() }
-
-  /**
-   * Holds if this basic block is in a loop of the control-flow graph. This
-   * includes loops created by `goto` statements. This predicate may not hold
-   * even if this basic block is syntactically inside a `while` loop if the
-   * necessary back edges are unreachable.
-   */
-  predicate inLoop() { this.getASuccessor+() = this }
-
-  /**
-   * DEPRECATED since version 1.11: this predicate does not match the standard
-   * definition of _loop header_.
-   *
-   * Holds if this basic block is in a loop of the control-flow graph and
-   * additionally has an incoming edge that is not part of any loop containing
-   * this basic block. A typical example would be the basic block that computes
-   * `x > 0` in an outermost loop `while (x > 0) { ... }`.
-   */
-  deprecated predicate isLoopHeader() {
-    this.inLoop() and
-    exists(BasicBlock pred | pred = this.getAPredecessor() and not pred = this.getASuccessor+())
-  }
-
-  /**
-   * Holds if control flow may reach this basic block from a function entry
-   * point or any handler of a reachable `try` statement.
-   */
-  predicate isReachable() {
-    exists(Function f | f.getBlock() = this)
-    or
-    exists(TryStmt t, BasicBlock tryblock |
-      // a `Handler` preceeds the `CatchBlock`, and is always the beginning
-      // of a new `BasicBlock` (see `primitive_basic_block_entry_node`).
-      this.(Handler).getTryStmt() = t and
-      tryblock.isReachable() and
-      tryblock.contains(t)
-    )
-    or
-    exists(BasicBlock pred | pred.getASuccessor() = this and pred.isReachable())
-  }
-
-  /** Means `not isReachable()`. */
-  predicate isUnreachable() { not this.isReachable() }
-}
-
-/** Correct relation for reachability of ControlFlowNodes. */
-predicate unreachable(ControlFlowNode n) {
-  exists(BasicBlock bb | bb.contains(n) and bb.isUnreachable())
-}
-
-/**
- * An entry point of a function.
- */
-class EntryBasicBlock extends BasicBlock {
-  EntryBasicBlock() { exists(Function f | this = f.getEntryPoint()) }
-}
-
-/**
- * A basic block whose last node is the exit point of a function.
- */
-class ExitBasicBlock extends BasicBlock {
-  ExitBasicBlock() {
-    this.getEnd() instanceof Function or
-    aborting(this.getEnd())
-  }
-}

cpp/ql/lib/semmle/code/cpp/controlflow/ControlFlowGraph.qll

@@ -1,145 +0,0 @@
-/**
- * Provides a library for reasoning about control flow at the granularity of
- * individual nodes in the control-flow graph.
- */
-
-import cpp
-import BasicBlocks
-private import semmle.code.cpp.controlflow.internal.ConstantExprs
-private import semmle.code.cpp.controlflow.internal.CFG
-
-/**
- * A control-flow node is either a statement or an expression; in addition,
- * functions are control-flow nodes representing the exit point of the
- * function. The graph represents one possible evaluation order out of all the
- * ones the compiler might have picked.
- *
- * Control-flow nodes have successors and predecessors at the expression level,
- * so control flow is accurately represented in expressions as well as between
- * statements. Statements and initializers precede their contained expressions,
- * and expressions deeper in the tree precede those higher up; for example, the
- * statement `x = y + 1` gets a control-flow graph that looks like
- *
- * ```
- * ExprStmt -> y -> 1 -> (+) -> x -> (=)
- * ```
- *
- * The first control-flow node in a function is the body of the function (a
- * block), and the last is the function itself, which is used to represent the
- * exit point.
- *
- * Each `throw` expression or `Handler` has a path (along any necessary
- * destructor calls) to its nearest enclosing `Handler` within the same
- * function, or to the exit point of the function if there is no such
- * `Handler`. There are no edges from function calls to `Handler`s.
- */
-class ControlFlowNode extends Locatable, ControlFlowNodeBase {
-  /** Gets a direct successor of this control-flow node, if any. */
-  ControlFlowNode getASuccessor() { successors_adapted(this, result) }
-
-  /** Gets a direct predecessor of this control-flow node, if any. */
-  ControlFlowNode getAPredecessor() { this = result.getASuccessor() }
-
-  /** Gets the function containing this control-flow node. */
-  Function getControlFlowScope() {
-    none() // overridden in subclasses
-  }
-
-  /** Gets the smallest statement containing this control-flow node. */
-  Stmt getEnclosingStmt() {
-    none() // overridden in subclasses
-  }
-
-  /**
-   * Holds if this node is the top-level expression of a conditional statement,
-   * meaning that `this.getATrueSuccessor()` or `this.getAFalseSuccessor()`
-   * will have a result.
-   */
-  predicate isCondition() {
-    exists(this.getATrueSuccessor()) or
-    exists(this.getAFalseSuccessor())
-  }
-
-  /**
-   * Gets a node such that the control-flow edge `(this, result)` may be
-   * taken when this expression is true.
-   */
-  ControlFlowNode getATrueSuccessor() {
-    qlCFGTrueSuccessor(this, result) and
-    result = this.getASuccessor()
-  }
-
-  /**
-   * Gets a node such that the control-flow edge `(this, result)` may be
-   * taken when this expression is false.
-   */
-  ControlFlowNode getAFalseSuccessor() {
-    qlCFGFalseSuccessor(this, result) and
-    result = this.getASuccessor()
-  }
-
-  /** Gets the `BasicBlock` containing this control-flow node. */
-  BasicBlock getBasicBlock() { result.getANode() = this }
-}
-
-import ControlFlowGraphPublic
-
-/**
- * An element that is convertible to `ControlFlowNode`. This class is similar
- * to `ControlFlowNode` except that is has no member predicates apart from
- * `toString`.
- *
- * This class can be used as base class for classes that want to inherit the
- * extent of `ControlFlowNode` without inheriting its public member predicates.
- */
-class ControlFlowNodeBase extends ElementBase, @cfgnode { }
-
-/**
- * DEPRECATED: Use `ControlFlowNode.getATrueSuccessor()` instead.
- * Holds when `n2` is a control-flow node such that the control-flow
- * edge `(n1, n2)` may be taken when `n1` is an expression that is true.
- */
-deprecated predicate truecond_base(ControlFlowNodeBase n1, ControlFlowNodeBase n2) {
-  qlCFGTrueSuccessor(n1, n2)
-}
-
-/**
- * DEPRECATED: Use `ControlFlowNode.getAFalseSuccessor()` instead.
- * Holds when `n2` is a control-flow node such that the control-flow
- * edge `(n1, n2)` may be taken when `n1` is an expression that is false.
- */
-deprecated predicate falsecond_base(ControlFlowNodeBase n1, ControlFlowNodeBase n2) {
-  qlCFGFalseSuccessor(n1, n2)
-}
-
-/**
- * An abstract class that can be extended to add additional edges to the
- * control-flow graph. Instances of this class correspond to the source nodes
- * of such edges, and the predicate `getAnEdgeTarget` should be overridden to
- * produce the target nodes of each source.
- *
- * Changing the control-flow graph in some queries and not others can be
- * expensive in execution time and disk space. Most cached predicates in the
- * library depend on the control-flow graph, so these predicates will be
- * computed and cached for each variation of the control-flow graph
- * that is used.
- *
- * Edges added by this class will still be removed by the library if they
- * appear to be unreachable. See the documentation on `ControlFlowNode` for
- * more information about the control-flow graph.
- */
-abstract class AdditionalControlFlowEdge extends ControlFlowNodeBase {
-  /** Gets a target node of this edge, where the source node is `this`. */
-  abstract ControlFlowNodeBase getAnEdgeTarget();
-}
-
-/**
- * Holds if there is a control-flow edge from `source` to `target` in either
- * the extractor-generated control-flow graph or in a subclass of
- * `AdditionalControlFlowEdge`. Use this relation instead of `qlCFGSuccessor`.
- */
-predicate successors_extended(ControlFlowNodeBase source, ControlFlowNodeBase target) {
-  qlCFGSuccessor(source, target)
-  or
-  source.(AdditionalControlFlowEdge).getAnEdgeTarget() = target
-}

cpp/ql/lib/semmle/code/cpp/controlflow/SSA.qll

@@ -1,161 +0,0 @@
-/**
- * Provides classes and predicates for SSA representation (Static Single Assignment form).
- */
-
-import cpp
-import semmle.code.cpp.controlflow.Dominance
-import SSAUtils
-
-/**
- * The SSA logic comes in two versions: the standard SSA and range-analysis RangeSSA.
- * This class provides the standard SSA logic.
- */
-library class StandardSSA extends SSAHelper {
-  StandardSSA() { this = 0 }
-}
-
-/**
- * A definition of one or more SSA variables, including phi node definitions.
- * An _SSA variable_, as defined in the literature, is effectively the pair of
- * an `SsaDefinition d` and a `StackVariable v`, written `(d, v)` in this
- * documentation. Note that definitions and uses can be coincident due to the
- * presence of parameter definitions and phi nodes.
- *
- * Not all `StackVariable`s of a function have SSA definitions. If the variable
- * has its address taken, either explicitly or implicitly, then it is excluded
- * from analysis. `SsaDefinition`s are not generated in locations that are
- * statically seen to be unreachable.
- */
-class SsaDefinition extends ControlFlowNodeBase {
-  SsaDefinition() { exists(StandardSSA x | x.ssa_defn(_, this, _, _)) }
-
-  /**
-   * Gets a variable corresponding to an SSA StackVariable defined by
-   * this definition.
-   */
-  StackVariable getAVariable() { exists(StandardSSA x | x.ssa_defn(result, this, _, _)) }
-
-  /**
-   * Gets a string representation of the SSA variable represented by the pair
-   * `(this, v)`.
-   */
-  string toString(StackVariable v) { exists(StandardSSA x | result = x.toString(this, v)) }
-
-  /** Gets a use of the SSA variable represented by the pair `(this, v)`. */
-  VariableAccess getAUse(StackVariable v) { exists(StandardSSA x | result = x.getAUse(this, v)) }
-
-  /**
-   * Gets the control-flow node for this definition. This will usually be the
-   * control-flow node that assigns to this variable as a side effect, but
-   * there are some exceptions. If `this` is defined by initialization, the
-   * result is the value of `Initializer.getExpr()` for that initialization.
-   * If `this` is a function parameter (see `definedByParameter`), the result
-   * will be the function entry point. If `this` variable is defined by being
-   * passed as a reference in a function call, including overloaded
-   * operators, the result will be the `VariableAccess` expression for this
-   * parameter. If `this` is a phi node (see `isPhiNode`), the result will be
-   * the node where control flow is joined from multiple paths.
-   */
-  ControlFlowNode getDefinition() { result = this }
-
-  /** Gets the `BasicBlock` containing this definition. */
-  BasicBlock getBasicBlock() { result.contains(this.getDefinition()) }
-
-  /** Holds if this definition is a phi node for variable `v`. */
-  predicate isPhiNode(StackVariable v) { exists(StandardSSA x | x.phi_node(v, this)) }
-
-  /** Gets the location of this definition. */
-  Location getLocation() { result = this.(ControlFlowNode).getLocation() }
-
-  /** Holds if the SSA variable `(this, p)` is defined by parameter `p`. */
-  predicate definedByParameter(Parameter p) { this = p.getFunction().getEntryPoint() }
-
-  /**
-   * Holds if the SSA variable `(result, v)` is an input to the phi definition
-   * `(this, v)`.
-   */
-  SsaDefinition getAPhiInput(StackVariable v) {
-    this.isPhiNode(v) and
-    result.reachesEndOfBB(v, this.(BasicBlock).getAPredecessor())
-  }
-
-  /**
-   * Gets the expression assigned to the SSA variable `(this, v)`, if any,
-   * when it is not a phi definition. The following is an exhaustive list of
-   * expressions that may be the result of this predicate.
-   *
-   * - The contained expression of an `Initializer`.
-   * - The right-hand side of an `AssignExpr`.
-   * - An `AssignOperation`.
-   * - A `CrementOperation`.
-   *
-   * In all cases except `PostfixCrementOperation`, the variable `v` will be
-   * equal to the result of this predicate after evaluation of
-   * `this.getDefinition()`.
-   *
-   * If the SSA variable is defined in other ways than those four (such as
-   * function parameters or `f(&x)`) there is no result. These cases are
-   * instead covered via `definedByParameter` and `getDefinition`,
-   * respectively.
-   */
-  Expr getDefiningValue(StackVariable v) {
-    exists(ControlFlowNode def | def = this.getDefinition() |
-      def = v.getInitializer().getExpr() and def = result
-      or
-      exists(AssignExpr assign |
-        def = assign and
-        assign.getLValue() = v.getAnAccess() and
-        result = assign.getRValue()
-      )
-      or
-      exists(AssignOperation assign |
-        def = assign and
-        assign.getLValue() = v.getAnAccess() and
-        result = assign
-      )
-      or
-      exists(CrementOperation crement |
-        def = crement and
-        crement.getOperand() = v.getAnAccess() and
-        result = crement
-      )
-    )
-  }
-
-  /** Holds if `(this, v)` reaches the end of basic block `b`. */
-  predicate reachesEndOfBB(StackVariable v, BasicBlock b) {
-    exists(StandardSSA x | x.ssaDefinitionReachesEndOfBB(v, this, b))
-  }
-
-  /**
-   * Gets a definition that ultimately defines this variable and is not
-   * itself a phi node.
-   */
-  SsaDefinition getAnUltimateSsaDefinition(StackVariable v) {
-    result = this.getAPhiInput(v).getAnUltimateSsaDefinition(v)
-    or
-    v = this.getAVariable() and
-    not this.isPhiNode(v) and
-    result = this
-  }
-
-  /**
-   * Gets a possible defining expression for `v` at this SSA definition,
-   * recursing backwards through phi definitions. Not all definitions have a
-   * defining expression---see the documentation for `getDefiningValue`.
-   */
-  Expr getAnUltimateDefiningValue(StackVariable v) {
-    result = this.getAnUltimateSsaDefinition(v).getDefiningValue(v)
-  }
-
-  /**
-   * DEPRECATED: this is the old name for `getAnUltimateDefiningValue`. The
-   * name was confusing as it seemed analogous to `getDefinition` rather than
-   * `getDefiningValue`. The SSA libraries for other languages use the name
-   * `getAnUltimateSsaDefinition` to refer to a predicate named
-   * `getAnUltimateSsaDefinition` in this class.
-   */
-  deprecated Expr getAnUltimateDefinition(StackVariable v) {
-    result = this.getAnUltimateDefiningValue(v)
-  }
-}

cpp/ql/lib/semmle/code/cpp/controlflow/SubBasicBlocks.qll

@@ -1,179 +0,0 @@
-// NOTE: There are two copies of this file, and they must be kept identical:
-// - semmle/code/cpp/controlflow/SubBasicBlocks.qll
-// - semmle/code/cpp/dataflow/internal/SubBasicBlocks.qll
-//
-// The second one is a private copy of the `SubBasicBlocks` library for
-// internal use by the data flow library. Having an extra copy prevents
-// non-monotonic recursion errors in queries that use both the data flow
-// library and the `SubBasicBlocks` library.
-/**
- * Provides the `SubBasicBlock` class, used for partitioning basic blocks in
- * smaller pieces.
- */
-
-import cpp
-
-/**
- * An abstract class that directs where in the control-flow graph a new
- * `SubBasicBlock` must start. If a `ControlFlowNode` is an instance of this
- * class, that node is guaranteed to be the first node in a `SubBasicBlock`.
- * If multiple libraries use the `SubBasicBlock` library, basic blocks may be
- * split in more places than either library expects, but nothing should break
- * as a direct result of that.
- */
-abstract class SubBasicBlockCutNode extends ControlFlowNode {
-  SubBasicBlockCutNode() {
-    // Some control-flow nodes are not in any basic block. This includes
-    // `Conversion`s, expressions that are evaluated at compile time, default
-    // arguments, and `Function`s without implementation.
-    exists(this.getBasicBlock())
-  }
-}
-
-/**
- * A block that can be smaller than or equal to a `BasicBlock`. Use this class
- * when `ControlFlowNode` is too fine-grained and `BasicBlock` too
- * coarse-grained. Their successor graph is like that of basic blocks, except
- * that the blocks are split up with an extra edge right before any instance of
- * the abstract class `SubBasicBlockCutNode`. Users of this library must
- * therefore extend `SubBasicBlockCutNode` to direct where basic blocks will be
- * split up.
- */
-class SubBasicBlock extends ControlFlowNodeBase {
-  SubBasicBlock() {
-    this instanceof BasicBlock
-    or
-    this instanceof SubBasicBlockCutNode
-  }
-
-  /** Gets the basic block in which this `SubBasicBlock` is contained. */
-  BasicBlock getBasicBlock() { result = this.(ControlFlowNode).getBasicBlock() }
-
-  /**
-   * Holds if this `SubBasicBlock` comes first in its basic block. This is the
-   * only condition under which a `SubBasicBlock` may have multiple
-   * predecessors.
-   */
-  predicate firstInBB() { exists(BasicBlock bb | this.getRankInBasicBlock(bb) = 1) }
-
-  /**
-   * Holds if this `SubBasicBlock` comes last in its basic block. This is the
-   * only condition under which a `SubBasicBlock` may have multiple successors.
-   */
-  predicate lastInBB() {
-    exists(BasicBlock bb | this.getRankInBasicBlock(bb) = countSubBasicBlocksInBasicBlock(bb))
-  }
-
-  /**
-   * Gets the (1-based) rank of this `SubBasicBlock` among the other `SubBasicBlock`s in
-   * its containing basic block `bb`, where `bb` is equal to `getBasicBlock()`.
-   */
-  int getRankInBasicBlock(BasicBlock bb) {
-    exists(int thisIndexInBB |
-      thisIndexInBB = this.getIndexInBasicBlock(bb) and
-      thisIndexInBB = rank[result](int i | i = any(SubBasicBlock n).getIndexInBasicBlock(bb))
-    )
-  }
-
-  /**
-   * DEPRECATED: use `getRankInBasicBlock` instead. Note that this predicate
-   * returns a 0-based position, while `getRankInBasicBlock` returns a 1-based
-   * position.
-   */
-  deprecated int getPosInBasicBlock(BasicBlock bb) { result = this.getRankInBasicBlock(bb) - 1 }
-
-  pragma[noinline]
-  private int getIndexInBasicBlock(BasicBlock bb) { this = bb.getNode(result) }
-
-  /** Gets a successor in the control-flow graph of `SubBasicBlock`s. */
-  SubBasicBlock getASuccessor() {
-    this.lastInBB() and
-    result = this.getBasicBlock().getASuccessor()
-    or
-    exists(BasicBlock bb | result.getRankInBasicBlock(bb) = this.getRankInBasicBlock(bb) + 1)
-  }
-
-  /**
-   * Gets the `index`th control-flow node in this `SubBasicBlock`. Indexes
-   * start from 0, and the node at index 0 always exists and compares equal
-   * to `this`.
-   */
-  ControlFlowNode getNode(int index) {
-    exists(BasicBlock bb |
-      exists(int outerIndex |
-        result = bb.getNode(outerIndex) and
-        index = this.outerToInnerIndex(bb, outerIndex)
-      )
-    )
-  }
-
-  /**
-   * Gets the index of the node in this `SubBasicBlock` that has `indexInBB` in
-   * `bb`, where `bb` is equal to `getBasicBlock()`.
-   */
-  // This predicate is factored out of `getNode` to ensure a good join order.
-  // It's sensitive to bad magic, so it has `pragma[nomagic]` on it. For
-  // example, it can get very slow if `getNode` is pragma[nomagic], which could
-  // mean it might get very slow if `getNode` is used in the wrong context.
-  pragma[nomagic]
-  private int outerToInnerIndex(BasicBlock bb, int indexInBB) {
-    indexInBB = result + this.getIndexInBasicBlock(bb) and
-    result = [0 .. this.getNumberOfNodes() - 1]
-  }
-
-  /** Gets a control-flow node in this `SubBasicBlock`. */
-  ControlFlowNode getANode() { result = this.getNode(_) }
-
-  /** Holds if `this` contains `node`. */
-  predicate contains(ControlFlowNode node) { node = this.getANode() }
-
-  /** Gets a predecessor in the control-flow graph of `SubBasicBlock`s. */
-  SubBasicBlock getAPredecessor() { result.getASuccessor() = this }
-
-  /**
-   * Gets a node such that the control-flow edge `(this, result)` may be taken
-   * when the final node of this `SubBasicBlock` is a conditional expression
-   * and evaluates to true.
-   */
-  SubBasicBlock getATrueSuccessor() {
-    this.lastInBB() and
-    result = this.getBasicBlock().getATrueSuccessor()
-  }
-
-  /**
-   * Gets a node such that the control-flow edge `(this, result)` may be taken
-   * when the final node of this `SubBasicBlock` is a conditional expression
-   * and evaluates to false.
-   */
-  SubBasicBlock getAFalseSuccessor() {
-    this.lastInBB() and
-    result = this.getBasicBlock().getAFalseSuccessor()
-  }
-
-  /**
-   * Gets the number of control-flow nodes in this `SubBasicBlock`. There is
-   * always at least one.
-   */
-  int getNumberOfNodes() {
-    exists(BasicBlock bb |
-      if this.lastInBB()
-      then result = bb.length() - this.getIndexInBasicBlock(bb)
-      else result = this.getASuccessor().getIndexInBasicBlock(bb) - this.getIndexInBasicBlock(bb)
-    )
-  }
-
-  /** Gets the last control-flow node in this `SubBasicBlock`. */
-  ControlFlowNode getEnd() { result = this.getNode(this.getNumberOfNodes() - 1) }
-
-  /** Gets the first control-flow node in this `SubBasicBlock`. */
-  ControlFlowNode getStart() { result = this }
-
-  /** Gets the function that contains this `SubBasicBlock`. */
-  pragma[noinline]
-  Function getEnclosingFunction() { result = this.getStart().getControlFlowScope() }
-}
-
-/** Gets the number of `SubBasicBlock`s in the given basic block. */
-private int countSubBasicBlocksInBasicBlock(BasicBlock bb) {
-  result = strictcount(SubBasicBlock sbb | sbb.getBasicBlock() = bb)
-}

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplConsistency.qll

@@ -1,196 +0,0 @@
-/**
- * Provides consistency queries for checking invariants in the language-specific
- * data-flow classes and predicates.
- */
-
-private import DataFlowImplSpecific::Private
-private import DataFlowImplSpecific::Public
-private import tainttracking1.TaintTrackingParameter::Private
-private import tainttracking1.TaintTrackingParameter::Public
-
-module Consistency {
-  private newtype TConsistencyConfiguration = MkConsistencyConfiguration()
-
-  /** A class for configuring the consistency queries. */
-  class ConsistencyConfiguration extends TConsistencyConfiguration {
-    string toString() { none() }
-
-    /** Holds if `n` should be excluded from the consistency test `postWithInFlow`. */
-    predicate postWithInFlowExclude(Node n) { none() }
-
-    /** Holds if `n` should be excluded from the consistency test `argHasPostUpdate`. */
-    predicate argHasPostUpdateExclude(ArgumentNode n) { none() }
-  }
-
-  private class RelevantNode extends Node {
-    RelevantNode() {
-      this instanceof ArgumentNode or
-      this instanceof ParameterNode or
-      this instanceof ReturnNode or
-      this = getAnOutNode(_, _) or
-      simpleLocalFlowStep(this, _) or
-      simpleLocalFlowStep(_, this) or
-      jumpStep(this, _) or
-      jumpStep(_, this) or
-      storeStep(this, _, _) or
-      storeStep(_, _, this) or
-      readStep(this, _, _) or
-      readStep(_, _, this) or
-      defaultAdditionalTaintStep(this, _) or
-      defaultAdditionalTaintStep(_, this)
-    }
-  }
-
-  query predicate uniqueEnclosingCallable(Node n, string msg) {
-    exists(int c |
-      n instanceof RelevantNode and
-      c = count(nodeGetEnclosingCallable(n)) and
-      c != 1 and
-      msg = "Node should have one enclosing callable but has " + c + "."
-    )
-  }
-
-  query predicate uniqueType(Node n, string msg) {
-    exists(int c |
-      n instanceof RelevantNode and
-      c = count(getNodeType(n)) and
-      c != 1 and
-      msg = "Node should have one type but has " + c + "."
-    )
-  }
-
-  query predicate uniqueNodeLocation(Node n, string msg) {
-    exists(int c |
-      c =
-        count(string filepath, int startline, int startcolumn, int endline, int endcolumn |
-          n.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
-        ) and
-      c != 1 and
-      msg = "Node should have one location but has " + c + "."
-    )
-  }
-
-  query predicate missingLocation(string msg) {
-    exists(int c |
-      c =
-        strictcount(Node n |
-          not exists(string filepath, int startline, int startcolumn, int endline, int endcolumn |
-            n.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
-          )
-        ) and
-      msg = "Nodes without location: " + c
-    )
-  }
-
-  query predicate uniqueNodeToString(Node n, string msg) {
-    exists(int c |
-      c = count(n.toString()) and
-      c != 1 and
-      msg = "Node should have one toString but has " + c + "."
-    )
-  }
-
-  query predicate missingToString(string msg) {
-    exists(int c |
-      c = strictcount(Node n | not exists(n.toString())) and
-      msg = "Nodes without toString: " + c
-    )
-  }
-
-  query predicate parameterCallable(ParameterNode p, string msg) {
-    exists(DataFlowCallable c | isParameterNode(p, c, _) and c != nodeGetEnclosingCallable(p)) and
-    msg = "Callable mismatch for parameter."
-  }
-
-  query predicate localFlowIsLocal(Node n1, Node n2, string msg) {
-    simpleLocalFlowStep(n1, n2) and
-    nodeGetEnclosingCallable(n1) != nodeGetEnclosingCallable(n2) and
-    msg = "Local flow step does not preserve enclosing callable."
-  }
-
-  private DataFlowType typeRepr() { result = getNodeType(_) }
-
-  query predicate compatibleTypesReflexive(DataFlowType t, string msg) {
-    t = typeRepr() and
-    not compatibleTypes(t, t) and
-    msg = "Type compatibility predicate is not reflexive."
-  }
-
-  query predicate unreachableNodeCCtx(Node n, DataFlowCall call, string msg) {
-    isUnreachableInCall(n, call) and
-    exists(DataFlowCallable c |
-      c = nodeGetEnclosingCallable(n) and
-      not viableCallable(call) = c
-    ) and
-    msg = "Call context for isUnreachableInCall is inconsistent with call graph."
-  }
-
-  query predicate localCallNodes(DataFlowCall call, Node n, string msg) {
-    (
-      n = getAnOutNode(call, _) and
-      msg = "OutNode and call does not share enclosing callable."
-      or
-      n.(ArgumentNode).argumentOf(call, _) and
-      msg = "ArgumentNode and call does not share enclosing callable."
-    ) and
-    nodeGetEnclosingCallable(n) != call.getEnclosingCallable()
-  }
-
-  // This predicate helps the compiler forget that in some languages
-  // it is impossible for a result of `getPreUpdateNode` to be an
-  // instance of `PostUpdateNode`.
-  private Node getPre(PostUpdateNode n) {
-    result = n.getPreUpdateNode()
-    or
-    none()
-  }
-
-  query predicate postIsNotPre(PostUpdateNode n, string msg) {
-    getPre(n) = n and
-    msg = "PostUpdateNode should not equal its pre-update node."
-  }
-
-  query predicate postHasUniquePre(PostUpdateNode n, string msg) {
-    exists(int c |
-      c = count(n.getPreUpdateNode()) and
-      c != 1 and
-      msg = "PostUpdateNode should have one pre-update node but has " + c + "."
-    )
-  }
-
-  query predicate uniquePostUpdate(Node n, string msg) {
-    1 < strictcount(PostUpdateNode post | post.getPreUpdateNode() = n) and
-    msg = "Node has multiple PostUpdateNodes."
-  }
-
-  query predicate postIsInSameCallable(PostUpdateNode n, string msg) {
-    nodeGetEnclosingCallable(n) != nodeGetEnclosingCallable(n.getPreUpdateNode()) and
-    msg = "PostUpdateNode does not share callable with its pre-update node."
-  }
-
-  private predicate hasPost(Node n) { exists(PostUpdateNode post | post.getPreUpdateNode() = n) }
-
-  query predicate reverseRead(Node n, string msg) {
-    exists(Node n2 | readStep(n, _, n2) and hasPost(n2) and not hasPost(n)) and
-    msg = "Origin of readStep is missing a PostUpdateNode."
-  }
-
-  query predicate argHasPostUpdate(ArgumentNode n, string msg) {
-    not hasPost(n) and
-    not any(ConsistencyConfiguration c).argHasPostUpdateExclude(n) and
-    msg = "ArgumentNode is missing PostUpdateNode."
-  }
-
-  // This predicate helps the compiler forget that in some languages
-  // it is impossible for a `PostUpdateNode` to be the target of
-  // `simpleLocalFlowStep`.
-  private predicate isPostUpdateNode(Node n) { n instanceof PostUpdateNode or none() }
-
-  query predicate postWithInFlow(Node n, string msg) {
-    isPostUpdateNode(n) and
-    not clearsContent(n, _) and
-    simpleLocalFlowStep(_, n) and
-    not any(ConsistencyConfiguration c).postWithInFlowExclude(n) and
-    msg = "PostUpdateNode should not be the target of local flow."
-  }
-}

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowPrivate.qll

@@ -1,300 +0,0 @@
-private import cpp
-private import DataFlowUtil
-private import DataFlowDispatch
-private import FlowVar
-private import DataFlowImplConsistency
-
-/** Gets the callable in which this node occurs. */
-DataFlowCallable nodeGetEnclosingCallable(Node n) { result = n.getEnclosingCallable() }
-
-/** Holds if `p` is a `ParameterNode` of `c` with position `pos`. */
-predicate isParameterNode(ParameterNode p, DataFlowCallable c, int pos) { p.isParameterOf(c, pos) }
-
-/** Gets the instance argument of a non-static call. */
-private Node getInstanceArgument(Call call) {
-  result.asExpr() = call.getQualifier()
-  or
-  result.(PreObjectInitializerNode).getExpr().(ConstructorCall) = call
-  // This does not include the implicit `this` argument on auto-generated
-  // base class destructor calls as those do not have an AST element.
-}
-
-/** An argument to a call. */
-private class Argument extends Expr {
-  Call call;
-  int pos;
-
-  Argument() { call.getArgument(pos) = this }
-
-  /** Gets the call that has this argument. */
-  Call getCall() { result = call }
-
-  /** Gets the position of this argument. */
-  int getPosition() { result = pos }
-}
-
-/**
- * A data flow node that occurs as the argument of a call and is passed as-is
- * to the callable. Arguments that are wrapped in an implicit varargs array
- * creation are not included, but the implicitly created array is.
- * Instance arguments are also included.
- */
-class ArgumentNode extends Node {
-  ArgumentNode() {
-    exists(Argument arg | this.asExpr() = arg) or
-    this = getInstanceArgument(_)
-  }
-
-  /**
-   * Holds if this argument occurs at the given position in the given call.
-   * The instance argument is considered to have index `-1`.
-   */
-  predicate argumentOf(DataFlowCall call, int pos) {
-    exists(Argument arg | this.asExpr() = arg | call = arg.getCall() and pos = arg.getPosition())
-    or
-    pos = -1 and this = getInstanceArgument(call)
-  }
-
-  /** Gets the call in which this node is an argument. */
-  DataFlowCall getCall() { this.argumentOf(result, _) }
-}
-
-private newtype TReturnKind =
-  TNormalReturnKind() or
-  TRefReturnKind(int i) { exists(Parameter parameter | i = parameter.getIndex()) }
-
-/**
- * A return kind. A return kind describes how a value can be returned
- * from a callable. For C++, this is simply a function return.
- */
-class ReturnKind extends TReturnKind {
-  /** Gets a textual representation of this return kind. */
-  string toString() {
-    this instanceof TNormalReturnKind and
-    result = "return"
-    or
-    this instanceof TRefReturnKind and
-    result = "ref"
-  }
-}
-
-/** A data flow node that represents a returned value in the called function. */
-abstract class ReturnNode extends Node {
-  /** Gets the kind of this returned value. */
-  abstract ReturnKind getKind();
-}
-
-/** A `ReturnNode` that occurs as the result of a `ReturnStmt`. */
-private class NormalReturnNode extends ReturnNode, ExprNode {
-  NormalReturnNode() { exists(ReturnStmt ret | this.getExpr() = ret.getExpr()) }
-
-  /** Gets the kind of this returned value. */
-  override ReturnKind getKind() { result = TNormalReturnKind() }
-}
-
-/**
- * A `ReturnNode` that occurs as a result of a definition of a reference
- * parameter reaching the end of a function body.
- */
-private class RefReturnNode extends ReturnNode, RefParameterFinalValueNode {
-  /** Gets the kind of this returned value. */
-  override ReturnKind getKind() { result = TRefReturnKind(this.getParameter().getIndex()) }
-}
-
-/** A data flow node that represents the output of a call at the call site. */
-abstract class OutNode extends Node {
-  /** Gets the underlying call. */
-  abstract DataFlowCall getCall();
-}
-
-private class ExprOutNode extends OutNode, ExprNode {
-  ExprOutNode() { this.getExpr() instanceof Call }
-
-  /** Gets the underlying call. */
-  override DataFlowCall getCall() { result = this.getExpr() }
-}
-
-private class RefOutNode extends OutNode, DefinitionByReferenceOrIteratorNode {
-  /** Gets the underlying call. */
-  override DataFlowCall getCall() { result = this.getArgument().getParent() }
-}
-
-/**
- * Gets a node that can read the value returned from `call` with return kind
- * `kind`.
- */
-OutNode getAnOutNode(DataFlowCall call, ReturnKind kind) {
-  result = call.getNode() and
-  kind = TNormalReturnKind()
-  or
-  exists(int i |
-    result.(DefinitionByReferenceOrIteratorNode).getArgument() = call.getArgument(i) and
-    kind = TRefReturnKind(i)
-  )
-}
-
-/**
- * Holds if data can flow from `node1` to `node2` in a way that loses the
- * calling context. For example, this would happen with flow through a
- * global or static variable.
- */
-predicate jumpStep(Node n1, Node n2) { none() }
-
-/**
- * Holds if data can flow from `node1` to `node2` via an assignment to `f`.
- * Thus, `node2` references an object with a field `f` that contains the
- * value of `node1`.
- */
-predicate storeStep(Node node1, Content f, PostUpdateNode node2) {
-  exists(ClassAggregateLiteral aggr, Field field |
-    // The following line requires `node2` to be both an `ExprNode` and a
-    // `PostUpdateNode`, which means it must be an `ObjectInitializerNode`.
-    node2.asExpr() = aggr and
-    f.(FieldContent).getField() = field and
-    aggr.getFieldExpr(field) = node1.asExpr()
-  )
-  or
-  exists(FieldAccess fa |
-    exists(Assignment a |
-      node1.asExpr() = a and
-      a.getLValue() = fa
-    ) and
-    node2.getPreUpdateNode().asExpr() = fa.getQualifier() and
-    f.(FieldContent).getField() = fa.getTarget()
-  )
-  or
-  exists(ConstructorFieldInit cfi |
-    node2.getPreUpdateNode().(PreConstructorInitThis).getConstructorFieldInit() = cfi and
-    f.(FieldContent).getField() = cfi.getTarget() and
-    node1.asExpr() = cfi.getExpr()
-  )
-}
-
-/**
- * Holds if data can flow from `node1` to `node2` via a read of `f`.
- * Thus, `node1` references an object with a field `f` whose value ends up in
- * `node2`.
- */
-predicate readStep(Node node1, Content f, Node node2) {
-  exists(FieldAccess fr |
-    node1.asExpr() = fr.getQualifier() and
-    fr.getTarget() = f.(FieldContent).getField() and
-    fr = node2.asExpr() and
-    not fr = any(AssignExpr a).getLValue()
-  )
-}
-
-/**
- * Holds if values stored inside content `c` are cleared at node `n`.
- */
-predicate clearsContent(Node n, Content c) {
-  none() // stub implementation
-}
-
-/** Gets the type of `n` used for type pruning. */
-Type getNodeType(Node n) {
-  suppressUnusedNode(n) and
-  result instanceof VoidType // stub implementation
-}
-
-/** Gets a string representation of a type returned by `getNodeType`. */
-string ppReprType(Type t) { none() } // stub implementation
-
-/**
- * Holds if `t1` and `t2` are compatible, that is, whether data can flow from
- * a node of type `t1` to a node of type `t2`.
- */
-pragma[inline]
-predicate compatibleTypes(Type t1, Type t2) {
-  any() // stub implementation
-}
-
-private predicate suppressUnusedNode(Node n) { any() }
-
-//////////////////////////////////////////////////////////////////////////////
-// Java QL library compatibility wrappers
-//////////////////////////////////////////////////////////////////////////////
-/** A node that performs a type cast. */
-class CastNode extends Node {
-  CastNode() { none() } // stub implementation
-}
-
-class DataFlowCallable = Function;
-
-class DataFlowExpr = Expr;
-
-class DataFlowType = Type;
-
-/** A function call relevant for data flow. */
-class DataFlowCall extends Expr instanceof Call {
-  /**
-   * Gets the nth argument for this call.
-   *
-   * The range of `n` is from `0` to `getNumberOfArguments() - 1`.
-   */
-  Expr getArgument(int n) { result = super.getArgument(n) }
-
-  /** Gets the data flow node corresponding to this call. */
-  ExprNode getNode() { result.getExpr() = this }
-
-  /** Gets the enclosing callable of this call. */
-  Function getEnclosingCallable() { result = this.getEnclosingFunction() }
-}
-
-predicate isUnreachableInCall(Node n, DataFlowCall call) { none() } // stub implementation
-
-int accessPathLimit() { result = 5 }
-
-/**
- * Holds if access paths with `c` at their head always should be tracked at high
- * precision. This disables adaptive access path precision for such access paths.
- */
-predicate forceHighPrecision(Content c) { none() }
-
-/** The unit type. */
-private newtype TUnit = TMkUnit()
-
-/** The trivial type with a single element. */
-class Unit extends TUnit {
-  /** Gets a textual representation of this element. */
-  string toString() { result = "unit" }
-}
-
-/** Holds if `n` should be hidden from path explanations. */
-predicate nodeIsHidden(Node n) { none() }
-
-class LambdaCallKind = Unit;
-
-/** Holds if `creation` is an expression that creates a lambda of kind `kind` for `c`. */
-predicate lambdaCreation(Node creation, LambdaCallKind kind, DataFlowCallable c) { none() }
-
-/** Holds if `call` is a lambda call of kind `kind` where `receiver` is the lambda expression. */
-predicate lambdaCall(DataFlowCall call, LambdaCallKind kind, Node receiver) { none() }
-
-/** Extra data-flow steps needed for lambda flow analysis. */
-predicate additionalLambdaFlowStep(Node nodeFrom, Node nodeTo, boolean preservesValue) { none() }
-
-/**
- * Holds if flow is allowed to pass from parameter `p` and back to itself as a
- * side-effect, resulting in a summary from `p` to itself.
- *
- * One example would be to allow flow like `p.foo = p.bar;`, which is disallowed
- * by default as a heuristic.
- */
-predicate allowParameterReturnInSelf(ParameterNode p) { none() }
-
-private class MyConsistencyConfiguration extends Consistency::ConsistencyConfiguration {
-  override predicate argHasPostUpdateExclude(ArgumentNode n) {
-    // Is the null pointer (or something that's not really a pointer)
-    exists(n.asExpr().getValue())
-    or
-    // Isn't a pointer or is a pointer to const
-    forall(DerivedType dt | dt = n.asExpr().getActualType() |
-      dt.getBaseType().isConst()
-      or
-      dt.getBaseType() instanceof RoutineType
-    )
-    // The above list of cases isn't exhaustive, but it narrows down the
-    // consistency alerts enough that most of them are interesting.
-  }
-}

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll

@@ -1,843 +0,0 @@
-/**
- * Provides C++-specific definitions for use in the data flow library.
- */
-
-private import cpp
-private import semmle.code.cpp.dataflow.internal.FlowVar
-private import semmle.code.cpp.models.interfaces.DataFlow
-private import semmle.code.cpp.controlflow.Guards
-private import semmle.code.cpp.dataflow.internal.AddressFlow
-
-cached
-private newtype TNode =
-  TExprNode(Expr e) or
-  TPartialDefinitionNode(PartialDefinition pd) or
-  TPreObjectInitializerNode(Expr e) {
-    e instanceof ConstructorCall
-    or
-    e instanceof ClassAggregateLiteral
-  } or
-  TExplicitParameterNode(Parameter p) { exists(p.getFunction().getBlock()) } or
-  TInstanceParameterNode(MemberFunction f) { exists(f.getBlock()) and not f.isStatic() } or
-  TPreConstructorInitThis(ConstructorFieldInit cfi) or
-  TPostConstructorInitThis(ConstructorFieldInit cfi) or
-  TInnerPartialDefinitionNode(Expr e) {
-    exists(PartialDefinition def, Expr outer |
-      def.definesExpressions(e, outer) and
-      // This condition ensures that we don't get two post-update nodes sharing
-      // the same pre-update node.
-      e != outer
-    )
-  } or
-  TUninitializedNode(LocalVariable v) { not v.hasInitializer() } or
-  TRefParameterFinalValueNode(Parameter p) { exists(FlowVar var | var.reachesRefParameter(p)) }
-
-/**
- * A node in a data flow graph.
- *
- * A node can be either an expression, a parameter, or an uninitialized local
- * variable. Such nodes are created with `DataFlow::exprNode`,
- * `DataFlow::parameterNode`, and `DataFlow::uninitializedNode` respectively.
- */
-class Node extends TNode {
-  /** Gets the function to which this node belongs. */
-  Function getFunction() { none() } // overridden in subclasses
-
-  /**
-   * INTERNAL: Do not use. Alternative name for `getFunction`.
-   */
-  final Function getEnclosingCallable() { result = this.getFunction() }
-
-  /** Gets the type of this node. */
-  Type getType() { none() } // overridden in subclasses
-
-  /**
-   * Gets the expression corresponding to this node, if any. This predicate
-   * only has a result on nodes that represent the value of evaluating the
-   * expression. For data flowing _out of_ an expression, like when an
-   * argument is passed by reference, use `asDefiningArgument` instead of
-   * `asExpr`.
-   */
-  Expr asExpr() { result = this.(ExprNode).getExpr() }
-
-  /** Gets the parameter corresponding to this node, if any. */
-  Parameter asParameter() { result = this.(ExplicitParameterNode).getParameter() }
-
-  /**
-   * Gets the argument that defines this `DefinitionByReferenceNode`, if any.
-   * This predicate should be used instead of `asExpr` when referring to the
-   * value of a reference argument _after_ the call has returned. For example,
-   * in `f(&x)`, this predicate will have `&x` as its result for the `Node`
-   * that represents the new value of `x`.
-   */
-  Expr asDefiningArgument() { result = this.(DefinitionByReferenceNode).getArgument() }
-
-  /**
-   * Gets the expression that is partially defined by this node, if any.
-   *
-   * Partial definitions are created for field stores (`x.y = taint();` is a partial
-   * definition of `x`), and for calls that may change the value of an object (so
-   * `x.set(taint())` is a partial definition of `x`, and `transfer(&x, taint())` is
-   * a partial definition of `&x`).
-   */
-  Expr asPartialDefinition() {
-    this.(PartialDefinitionNode).getPartialDefinition().definesExpressions(_, result)
-  }
-
-  /**
-   * Gets the uninitialized local variable corresponding to this node, if
-   * any.
-   */
-  LocalVariable asUninitialized() { result = this.(UninitializedNode).getLocalVariable() }
-
-  /** Gets a textual representation of this element. */
-  string toString() { none() } // overridden by subclasses
-
-  /** Gets the location of this element. */
-  Location getLocation() { none() } // overridden by subclasses
-
-  /**
-   * Holds if this element is at the specified location.
-   * The location spans column `startcolumn` of line `startline` to
-   * column `endcolumn` of line `endline` in file `filepath`.
-   * For more information, see
-   * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
-   */
-  predicate hasLocationInfo(
-    string filepath, int startline, int startcolumn, int endline, int endcolumn
-  ) {
-    this.getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
-  }
-
-  /**
-   * Gets an upper bound on the type of this node.
-   */
-  Type getTypeBound() { result = this.getType() }
-}
-
-/**
- * An expression, viewed as a node in a data flow graph.
- */
-class ExprNode extends Node, TExprNode {
-  Expr expr;
-
-  ExprNode() { this = TExprNode(expr) }
-
-  override Function getFunction() { result = expr.getEnclosingFunction() }
-
-  override Type getType() { result = expr.getType() }
-
-  override string toString() { result = expr.toString() }
-
-  override Location getLocation() { result = expr.getLocation() }
-
-  /** Gets the expression corresponding to this node. */
-  Expr getExpr() { result = expr }
-}
-
-abstract class ParameterNode extends Node, TNode {
-  /**
-   * Holds if this node is the parameter of `c` at the specified (zero-based)
-   * position. The implicit `this` parameter is considered to have index `-1`.
-   */
-  abstract predicate isParameterOf(Function f, int i);
-}
-
-/**
- * The value of a parameter at function entry, viewed as a node in a data
- * flow graph.
- */
-class ExplicitParameterNode extends ParameterNode, TExplicitParameterNode {
-  Parameter param;
-
-  ExplicitParameterNode() { this = TExplicitParameterNode(param) }
-
-  override Function getFunction() { result = param.getFunction() }
-
-  override Type getType() { result = param.getType() }
-
-  override string toString() { result = param.toString() }
-
-  override Location getLocation() { result = param.getLocation() }
-
-  /** Gets the parameter corresponding to this node. */
-  Parameter getParameter() { result = param }
-
-  override predicate isParameterOf(Function f, int i) { f.getParameter(i) = param }
-}
-
-class ImplicitParameterNode extends ParameterNode, TInstanceParameterNode {
-  MemberFunction f;
-
-  ImplicitParameterNode() { this = TInstanceParameterNode(f) }
-
-  override Function getFunction() { result = f }
-
-  override Type getType() { result = f.getDeclaringType() }
-
-  override string toString() { result = "this" }
-
-  override Location getLocation() { result = f.getLocation() }
-
-  override predicate isParameterOf(Function fun, int i) { f = fun and i = -1 }
-}
-
-/**
- * INTERNAL: do not use.
- *
- * A node that represents the value of a variable after a function call that
- * may have changed the variable because it's passed by reference or because an
- * iterator for it was passed by value or by reference.
- */
-class DefinitionByReferenceOrIteratorNode extends PartialDefinitionNode {
-  Expr inner;
-  Expr argument;
-
-  DefinitionByReferenceOrIteratorNode() {
-    this.getPartialDefinition().definesExpressions(inner, argument) and
-    (
-      this.getPartialDefinition() instanceof DefinitionByReference
-      or
-      this.getPartialDefinition() instanceof DefinitionByIterator
-    )
-  }
-
-  override Function getFunction() { result = inner.getEnclosingFunction() }
-
-  override Type getType() { result = inner.getType() }
-
-  override Location getLocation() { result = argument.getLocation() }
-
-  override ExprNode getPreUpdateNode() { result.getExpr() = argument }
-
-  /** Gets the argument corresponding to this node. */
-  Expr getArgument() { result = argument }
-
-  /** Gets the parameter through which this value is assigned. */
-  Parameter getParameter() {
-    exists(FunctionCall call, int i |
-      argument = call.getArgument(i) and
-      result = call.getTarget().getParameter(i)
-    )
-  }
-}
-
-/**
- * A node that represents the value of a variable after a function call that
- * may have changed the variable because it's passed by reference.
- *
- * A typical example would be a call `f(&x)`. Firstly, there will be flow into
- * `x` from previous definitions of `x`. Secondly, there will be a
- * `DefinitionByReferenceNode` to represent the value of `x` after the call has
- * returned. This node will have its `getArgument()` equal to `&x`.
- */
-class DefinitionByReferenceNode extends DefinitionByReferenceOrIteratorNode {
-  override VariablePartialDefinition pd;
-
-  override string toString() { result = "ref arg " + argument.toString() }
-}
-
-/**
- * The value of an uninitialized local variable, viewed as a node in a data
- * flow graph.
- */
-class UninitializedNode extends Node, TUninitializedNode {
-  LocalVariable v;
-
-  UninitializedNode() { this = TUninitializedNode(v) }
-
-  override Function getFunction() { result = v.getFunction() }
-
-  override Type getType() { result = v.getType() }
-
-  override string toString() { result = v.toString() }
-
-  override Location getLocation() { result = v.getLocation() }
-
-  /** Gets the uninitialized local variable corresponding to this node. */
-  LocalVariable getLocalVariable() { result = v }
-}
-
-/** INTERNAL: do not use. The final value of a non-const ref parameter. */
-class RefParameterFinalValueNode extends Node, TRefParameterFinalValueNode {
-  Parameter p;
-
-  RefParameterFinalValueNode() { this = TRefParameterFinalValueNode(p) }
-
-  override Function getFunction() { result = p.getFunction() }
-
-  override Type getType() { result = p.getType() }
-
-  override string toString() { result = p.toString() }
-
-  override Location getLocation() { result = p.getLocation() }
-
-  Parameter getParameter() { result = p }
-}
-
-/**
- * A node associated with an object after an operation that might have
- * changed its state.
- *
- * This can be either the argument to a callable after the callable returns
- * (which might have mutated the argument), or the qualifier of a field after
- * an update to the field.
- *
- * Nodes corresponding to AST elements, for example `ExprNode`, usually refer
- * to the value before the update with the exception of `ClassInstanceExpr`,
- * which represents the value after the constructor has run.
- */
-abstract class PostUpdateNode extends Node {
-  /**
-   * Gets the node before the state update.
-   */
-  abstract Node getPreUpdateNode();
-
-  override Function getFunction() { result = this.getPreUpdateNode().getFunction() }
-
-  override Type getType() { result = this.getPreUpdateNode().getType() }
-
-  override Location getLocation() { result = this.getPreUpdateNode().getLocation() }
-}
-
-abstract private class PartialDefinitionNode extends PostUpdateNode, TPartialDefinitionNode {
-  PartialDefinition pd;
-
-  PartialDefinitionNode() { this = TPartialDefinitionNode(pd) }
-
-  override Location getLocation() { result = pd.getActualLocation() }
-
-  PartialDefinition getPartialDefinition() { result = pd }
-
-  override string toString() { result = this.getPreUpdateNode().toString() + " [post update]" }
-}
-
-private class VariablePartialDefinitionNode extends PartialDefinitionNode {
-  override VariablePartialDefinition pd;
-
-  override Node getPreUpdateNode() { pd.definesExpressions(_, result.asExpr()) }
-}
-
-/**
- * INTERNAL: do not use.
- *
- * A synthetic data flow node used for flow into a collection when an iterator
- * write occurs in a callee.
- */
-private class IteratorPartialDefinitionNode extends PartialDefinitionNode {
-  override IteratorPartialDefinition pd;
-
-  override Node getPreUpdateNode() { pd.definesExpressions(_, result.asExpr()) }
-}
-
-/**
- * A post-update node on the `e->f` in `f(&e->f)` (and other forms).
- */
-private class InnerPartialDefinitionNode extends TInnerPartialDefinitionNode, PostUpdateNode {
-  Expr e;
-
-  InnerPartialDefinitionNode() { this = TInnerPartialDefinitionNode(e) }
-
-  override ExprNode getPreUpdateNode() { result.getExpr() = e }
-
-  override Function getFunction() { result = e.getEnclosingFunction() }
-
-  override Type getType() { result = e.getType() }
-
-  override string toString() { result = e.toString() + " [inner post update]" }
-
-  override Location getLocation() { result = e.getLocation() }
-}
-
-/**
- * A node representing the temporary value of an object that was just
- * constructed by a constructor call or an aggregate initializer. This is only
- * for objects, not for pointers to objects.
- *
- * These expressions are their own post-update nodes but instead have synthetic
- * pre-update nodes.
- */
-private class ObjectInitializerNode extends PostUpdateNode, TExprNode {
-  PreObjectInitializerNode pre;
-
-  ObjectInitializerNode() {
-    // If a `Node` is associated with a `PreObjectInitializerNode`, then it's
-    // an `ObjectInitializerNode`.
-    pre.getExpr() = this.asExpr()
-  }
-
-  override PreObjectInitializerNode getPreUpdateNode() { result = pre }
-  // No override of `toString` since these nodes already have a `toString` from
-  // their overlap with `ExprNode`.
-}
-
-/**
- * INTERNAL: do not use.
- *
- * A synthetic data-flow node that plays the role of a temporary object that
- * has not yet been initialized.
- */
-class PreObjectInitializerNode extends Node, TPreObjectInitializerNode {
-  Expr getExpr() { this = TPreObjectInitializerNode(result) }
-
-  override Function getFunction() { result = this.getExpr().getEnclosingFunction() }
-
-  override Type getType() { result = this.getExpr().getType() }
-
-  override Location getLocation() { result = this.getExpr().getLocation() }
-
-  override string toString() { result = this.getExpr().toString() + " [pre init]" }
-}
-
-/**
- * A synthetic data-flow node that plays the role of the post-update `this`
- * pointer in a `ConstructorFieldInit`. For example, the `x(1)` in
- * `C() : x(1) { }` is roughly equivalent to `this.x = 1`, and this node is
- * equivalent to the `this` _after_ the field has been assigned.
- */
-private class PostConstructorInitThis extends PostUpdateNode, TPostConstructorInitThis {
-  override PreConstructorInitThis getPreUpdateNode() {
-    this = TPostConstructorInitThis(result.getConstructorFieldInit())
-  }
-
-  override string toString() {
-    result = this.getPreUpdateNode().getConstructorFieldInit().toString() + " [post-this]"
-  }
-}
-
-/**
- * INTERNAL: do not use.
- *
- * A synthetic data-flow node that plays the role of the pre-update `this`
- * pointer in a `ConstructorFieldInit`. For example, the `x(1)` in
- * `C() : x(1) { }` is roughly equivalent to `this.x = 1`, and this node is
- * equivalent to the `this` _before_ the field has been assigned.
- */
-class PreConstructorInitThis extends Node, TPreConstructorInitThis {
-  ConstructorFieldInit getConstructorFieldInit() { this = TPreConstructorInitThis(result) }
-
-  override Constructor getFunction() {
-    result = this.getConstructorFieldInit().getEnclosingFunction()
-  }
-
-  override PointerType getType() {
-    result.getBaseType() = this.getConstructorFieldInit().getEnclosingFunction().getDeclaringType()
-  }
-
-  override Location getLocation() { result = this.getConstructorFieldInit().getLocation() }
-
-  override string toString() { result = this.getConstructorFieldInit().toString() + " [pre-this]" }
-}
-
-/**
- * Gets the `Node` corresponding to the value of evaluating `e`. For data
- * flowing _out of_ an expression, like when an argument is passed by
- * reference, use `definitionByReferenceNodeFromArgument` instead.
- */
-ExprNode exprNode(Expr e) { result.getExpr() = e }
-
-/**
- * Gets the `Node` corresponding to the value of `p` at function entry.
- */
-ParameterNode parameterNode(Parameter p) { result.(ExplicitParameterNode).getParameter() = p }
-
-/**
- * Gets the `Node` corresponding to a definition by reference of the variable
- * that is passed as `argument` of a call.
- */
-DefinitionByReferenceNode definitionByReferenceNodeFromArgument(Expr argument) {
-  result.getArgument() = argument
-}
-
-/**
- * Gets the `Node` corresponding to the value of an uninitialized local
- * variable `v`.
- */
-UninitializedNode uninitializedNode(LocalVariable v) { result.getLocalVariable() = v }
-
-private module ThisFlow {
-  /**
-   * Gets the 0-based index of `thisNode` in `b`, where `thisNode` is an access
-   * to `this` that may or may not have an associated `PostUpdateNode`. To make
-   * room for synthetic nodes that access `this`, the index may not correspond
-   * to an actual `ControlFlowNode`.
-   */
-  private int basicBlockThisIndex(BasicBlock b, Node thisNode) {
-    // The implicit `this` parameter node is given a very negative offset to
-    // make space for any `ConstructorFieldInit`s there may be between it and
-    // the block contents.
-    thisNode.(ImplicitParameterNode).getFunction().getBlock() = b and
-    result = -2147483648
-    or
-    // Place the synthetic `this` node for a `ConstructorFieldInit` at a
-    // negative offset in the first basic block, between the
-    // `ImplicitParameterNode` and the first statement.
-    exists(Constructor constructor, int i |
-      thisNode.(PreConstructorInitThis).getConstructorFieldInit() = constructor.getInitializer(i) and
-      result = -2147483648 + 1 + i and
-      b = thisNode.getFunction().getBlock()
-    )
-    or
-    b.getNode(result) = thisNode.asExpr().(ThisExpr)
-  }
-
-  private int thisRank(BasicBlock b, Node thisNode) {
-    thisNode = rank[result](Node n, int i | i = basicBlockThisIndex(b, n) | n order by i)
-  }
-
-  private int lastThisRank(BasicBlock b) { result = max(thisRank(b, _)) }
-
-  private predicate thisAccessBlockReaches(BasicBlock b1, BasicBlock b2) {
-    exists(basicBlockThisIndex(b1, _)) and b2 = b1.getASuccessor()
-    or
-    exists(BasicBlock mid |
-      thisAccessBlockReaches(b1, mid) and
-      b2 = mid.getASuccessor() and
-      not exists(basicBlockThisIndex(mid, _))
-    )
-  }
-
-  predicate adjacentThisRefs(Node n1, Node n2) {
-    exists(BasicBlock b | thisRank(b, n1) + 1 = thisRank(b, n2))
-    or
-    exists(BasicBlock b1, BasicBlock b2 |
-      lastThisRank(b1) = thisRank(b1, n1) and
-      thisAccessBlockReaches(b1, b2) and
-      thisRank(b2, n2) = 1
-    )
-  }
-}
-
-/**
- * Holds if data flows from `nodeFrom` to `nodeTo` in exactly one local
- * (intra-procedural) step.
- */
-cached
-predicate localFlowStep(Node nodeFrom, Node nodeTo) {
-  simpleLocalFlowStep(nodeFrom, nodeTo)
-  or
-  // Field flow is not strictly a "step" but covers the whole function
-  // transitively. There's no way to get a step-like relation out of the global
-  // data flow library, so we just have to accept some big steps here.
-  FieldFlow::fieldFlow(nodeFrom, nodeTo)
-}
-
-/**
- * INTERNAL: do not use.
- *
- * This is the local flow predicate that's used as a building block in global
- * data flow. It may have less flow than the `localFlowStep` predicate.
- */
-predicate simpleLocalFlowStep(Node nodeFrom, Node nodeTo) {
-  // Expr -> Expr
-  exprToExprStep_nocfg(nodeFrom.asExpr(), nodeTo.asExpr())
-  or
-  // Assignment -> LValue post-update node
-  //
-  // This is used for assignments whose left-hand side is not a variable
-  // assignment or a storeStep but is still modeled by other means. It could be
-  // a call to `operator*` or `operator[]` where taint should flow to the
-  // post-update node of the qualifier.
-  exists(AssignExpr assign |
-    nodeFrom.asExpr() = assign and
-    nodeTo.(PostUpdateNode).getPreUpdateNode().asExpr() = assign.getLValue()
-  )
-  or
-  // Node -> FlowVar -> VariableAccess
-  exists(FlowVar var |
-    (
-      exprToVarStep(nodeFrom.asExpr(), var)
-      or
-      varSourceBaseCase(var, nodeFrom.asParameter())
-      or
-      varSourceBaseCase(var, nodeFrom.asUninitialized())
-      or
-      var.definedPartiallyAt(nodeFrom.asPartialDefinition())
-    ) and
-    varToNodeStep(var, nodeTo)
-  )
-  or
-  // Expr -> DefinitionByReferenceNode
-  exprToDefinitionByReferenceStep(nodeFrom.asExpr(), nodeTo.asDefiningArgument())
-  or
-  // `this` -> adjacent-`this`
-  ThisFlow::adjacentThisRefs(nodeFrom, nodeTo)
-  or
-  // post-update-`this` -> following-`this`-ref
-  ThisFlow::adjacentThisRefs(nodeFrom.(PostUpdateNode).getPreUpdateNode(), nodeTo)
-  or
-  // In `f(&x->a)`, this step provides the flow from post-`&` to post-`x->a`,
-  // from which there is field flow to `x` via reverse read.
-  exists(PartialDefinition def, Expr inner, Expr outer |
-    def.definesExpressions(inner, outer) and
-    inner = nodeTo.(InnerPartialDefinitionNode).getPreUpdateNode().asExpr() and
-    outer = nodeFrom.(PartialDefinitionNode).getPreUpdateNode().asExpr()
-  )
-  or
-  // Reverse flow: data that flows from the post-update node of a reference
-  // returned by a function call, back into the qualifier of that function.
-  // This allows data to flow 'in' through references returned by a modeled
-  // function such as `operator[]`.
-  exists(DataFlowFunction f, Call call, FunctionInput inModel, FunctionOutput outModel |
-    call.getTarget() = f and
-    inModel.isReturnValueDeref() and
-    outModel.isQualifierObject() and
-    f.hasDataFlow(inModel, outModel) and
-    nodeFrom.(PostUpdateNode).getPreUpdateNode().asExpr() = call and
-    nodeTo.asDefiningArgument() = call.getQualifier()
-  )
-}
-
-/**
- * Holds if data flows from `source` to `sink` in zero or more local
- * (intra-procedural) steps.
- */
-predicate localFlow(Node source, Node sink) { localFlowStep*(source, sink) }
-
-/**
- * Holds if data can flow from `e1` to `e2` in zero or more
- * local (intra-procedural) steps.
- */
-predicate localExprFlow(Expr e1, Expr e2) { localFlow(exprNode(e1), exprNode(e2)) }
-
-/**
- * Holds if the initial value of `v`, if it is a source, flows to `var`.
- */
-private predicate varSourceBaseCase(FlowVar var, Variable v) { var.definedByInitialValue(v) }
-
-/**
- * Holds if `var` is defined by an assignment-like operation that causes flow
- * directly from `assignedExpr` to `var`, _and_ `assignedExpr` evaluates to
- * the same value as what is assigned to `var`.
- */
-private predicate exprToVarStep(Expr assignedExpr, FlowVar var) {
-  exists(ControlFlowNode operation |
-    var.definedByExpr(assignedExpr, operation) and
-    not operation instanceof PostfixCrementOperation
-  )
-}
-
-/**
- * Holds if the node `n` is an access of the variable `var`.
- */
-private predicate varToNodeStep(FlowVar var, Node n) {
-  n.asExpr() = var.getAnAccess()
-  or
-  var.reachesRefParameter(n.(RefParameterFinalValueNode).getParameter())
-}
-
-/**
- * Holds if data flows from `fromExpr` to `toExpr` directly, in the case
- * where `toExpr` is the immediate AST parent of `fromExpr`. For example,
- * data flows from `x` and `y` to `b ? x : y`.
- */
-private predicate exprToExprStep_nocfg(Expr fromExpr, Expr toExpr) {
-  toExpr = any(ConditionalExpr cond | fromExpr = cond.getThen() or fromExpr = cond.getElse())
-  or
-  toExpr = any(AssignExpr assign | fromExpr = assign.getRValue())
-  or
-  toExpr = any(CommaExpr comma | fromExpr = comma.getRightOperand())
-  or
-  toExpr = any(PostfixCrementOperation op | fromExpr = op.getOperand())
-  or
-  toExpr = any(StmtExpr stmtExpr | fromExpr = stmtExpr.getResultExpr())
-  or
-  toExpr.(AddressOfExpr).getOperand() = fromExpr
-  or
-  // This rule enables flow from an array to its elements. Example: `a` to
-  // `a[i]` or `*a`, where `a` is an array type. It does not enable flow from a
-  // pointer to its indirection as in `p[i]` where `p` is a pointer type.
-  exists(Expr toConverted |
-    variablePartiallyAccessed(fromExpr, toConverted) and
-    toExpr = toConverted.getUnconverted() and
-    not toExpr = fromExpr
-  )
-  or
-  toExpr.(BuiltInOperationBuiltInAddressOf).getOperand() = fromExpr
-  or
-  // The following case is needed to track the qualifier object for flow
-  // through fields. It gives flow from `T(x)` to `new T(x)`. That's not
-  // strictly _data_ flow but _taint_ flow because the type of `fromExpr` is
-  // `T` while the type of `toExpr` is `T*`.
-  //
-  // This discrepancy is an artifact of how `new`-expressions are represented
-  // in the database in a way that slightly varies from what the standard
-  // specifies. In the C++ standard, there is no constructor call expression
-  // `T(x)` after `new`. Instead there is a type `T` and an optional
-  // initializer `(x)`.
-  toExpr.(NewExpr).getInitializer() = fromExpr
-  or
-  // A lambda expression (`[captures](params){body}`) is just a thin wrapper
-  // around the desugared closure creation in the form of a
-  // `ClassAggregateLiteral` (`{ capture1, ..., captureN }`).
-  toExpr.(LambdaExpression).getInitializer() = fromExpr
-  or
-  // Data flow through a function model.
-  toExpr =
-    any(Call call |
-      exists(DataFlowFunction f, FunctionInput inModel, FunctionOutput outModel |
-        f.hasDataFlow(inModel, outModel) and
-        (
-          exists(int iIn |
-            inModel.isParameterDeref(iIn) and
-            call.passesByReference(iIn, fromExpr)
-          )
-          or
-          exists(int iIn |
-            inModel.isParameter(iIn) and
-            fromExpr = call.getArgument(iIn)
-          )
-          or
-          inModel.isQualifierObject() and
-          fromExpr = call.getQualifier()
-          or
-          inModel.isQualifierAddress() and
-          fromExpr = call.getQualifier()
-        ) and
-        call.getTarget() = f and
-        // AST dataflow treats a reference as if it were the referred-to object, while the dataflow
-        // models treat references as pointers. If the return type of the call is a reference, then
-        // look for data flow the the referred-to object, rather than the reference itself.
-        if call.getType().getUnspecifiedType() instanceof ReferenceType
-        then outModel.isReturnValueDeref()
-        else outModel.isReturnValue()
-      )
-    )
-}
-
-private predicate exprToDefinitionByReferenceStep(Expr exprIn, Expr argOut) {
-  exists(DataFlowFunction f, Call call, FunctionOutput outModel, int argOutIndex |
-    call.getTarget() = f and
-    argOut = call.getArgument(argOutIndex) and
-    outModel.isParameterDeref(argOutIndex) and
-    exists(int argInIndex, FunctionInput inModel | f.hasDataFlow(inModel, outModel) |
-      inModel.isParameterDeref(argInIndex) and
-      call.passesByReference(argInIndex, exprIn)
-      or
-      inModel.isParameter(argInIndex) and
-      exprIn = call.getArgument(argInIndex)
-    )
-  )
-}
-
-private module FieldFlow {
-  private import DataFlowImplCommon
-  private import DataFlowImplLocal
-  private import DataFlowPrivate
-
-  /**
-   * A configuration for finding local-only flow through fields. This uses the
-   * `Configuration` class in the dedicated `DataFlowImplLocal` copy of the
-   * shared library that's not user-exposed directly.
-   *
-   * To keep the flow local to a single function, we put barriers on parameters
-   * and return statements. Sources and sinks are the values that go into and
-   * out of fields, respectively.
-   */
-  private class FieldConfiguration extends Configuration {
-    FieldConfiguration() { this = "FieldConfiguration" }
-
-    override predicate isSource(Node source) {
-      storeStep(source, _, _)
-      or
-      // Also mark `foo(a.b);` as a source when `a.b` may be overwritten by `foo`.
-      readStep(_, _, any(Node node | node.asExpr() = source.asDefiningArgument()))
-    }
-
-    override predicate isSink(Node sink) { readStep(_, _, sink) }
-
-    override predicate isBarrier(Node node) { node instanceof ParameterNode }
-
-    override predicate isBarrierOut(Node node) {
-      node.asExpr().getParent() instanceof ReturnStmt
-      or
-      node.asExpr().getParent() instanceof ThrowExpr
-    }
-  }
-
-  predicate fieldFlow(Node node1, Node node2) {
-    exists(FieldConfiguration cfg | cfg.hasFlow(node1, node2)) and
-    // This configuration should not be able to cross function boundaries, but
-    // we double-check here just to be sure.
-    getNodeEnclosingCallable(node1) = getNodeEnclosingCallable(node2)
-  }
-}
-
-VariableAccess getAnAccessToAssignedVariable(Expr assign) {
-  (
-    assign instanceof Assignment
-    or
-    assign instanceof CrementOperation
-  ) and
-  exists(FlowVar var |
-    var.definedByExpr(_, assign) and
-    result = var.getAnAccess()
-  )
-}
-
-private newtype TContent =
-  TFieldContent(Field f) or
-  TCollectionContent() or
-  TArrayContent()
-
-/**
- * A description of the way data may be stored inside an object. Examples
- * include instance fields, the contents of a collection object, or the contents
- * of an array.
- */
-class Content extends TContent {
-  /** Gets a textual representation of this element. */
-  abstract string toString();
-
-  predicate hasLocationInfo(string path, int sl, int sc, int el, int ec) {
-    path = "" and sl = 0 and sc = 0 and el = 0 and ec = 0
-  }
-}
-
-/** A reference through an instance field. */
-class FieldContent extends Content, TFieldContent {
-  Field f;
-
-  FieldContent() { this = TFieldContent(f) }
-
-  Field getField() { result = f }
-
-  override string toString() { result = f.toString() }
-
-  override predicate hasLocationInfo(string path, int sl, int sc, int el, int ec) {
-    f.getLocation().hasLocationInfo(path, sl, sc, el, ec)
-  }
-}
-
-/** A reference through an array. */
-private class ArrayContent extends Content, TArrayContent {
-  override string toString() { result = "[]" }
-}
-
-/** A reference through the contents of some collection-like container. */
-private class CollectionContent extends Content, TCollectionContent {
-  override string toString() { result = "<element>" }
-}
-
-/**
- * A guard that validates some expression.
- *
- * To use this in a configuration, extend the class and provide a
- * characteristic predicate precisely specifying the guard, and override
- * `checks` to specify what is being validated and in which branch.
- *
- * It is important that all extending classes in scope are disjoint.
- */
-class BarrierGuard extends GuardCondition {
-  /** Override this predicate to hold if this guard validates `e` upon evaluating to `b`. */
-  abstract predicate checks(Expr e, boolean b);
-
-  /** Gets a node guarded by this guard. */
-  final ExprNode getAGuardedNode() {
-    exists(SsaDefinition def, Variable v, boolean branch |
-      result.getExpr() = def.getAUse(v) and
-      this.checks(def.getAUse(v), branch) and
-      this.controls(result.getExpr().getBasicBlock(), branch)
-    )
-  }
-}

cpp/ql/lib/semmle/code/cpp/dataflow/internal/SubBasicBlocks.qll

@@ -1,179 +0,0 @@
-// NOTE: There are two copies of this file, and they must be kept identical:
-// - semmle/code/cpp/controlflow/SubBasicBlocks.qll
-// - semmle/code/cpp/dataflow/internal/SubBasicBlocks.qll
-//
-// The second one is a private copy of the `SubBasicBlocks` library for
-// internal use by the data flow library. Having an extra copy prevents
-// non-monotonic recursion errors in queries that use both the data flow
-// library and the `SubBasicBlocks` library.
-/**
- * Provides the `SubBasicBlock` class, used for partitioning basic blocks in
- * smaller pieces.
- */
-
-import cpp
-
-/**
- * An abstract class that directs where in the control-flow graph a new
- * `SubBasicBlock` must start. If a `ControlFlowNode` is an instance of this
- * class, that node is guaranteed to be the first node in a `SubBasicBlock`.
- * If multiple libraries use the `SubBasicBlock` library, basic blocks may be
- * split in more places than either library expects, but nothing should break
- * as a direct result of that.
- */
-abstract class SubBasicBlockCutNode extends ControlFlowNode {
-  SubBasicBlockCutNode() {
-    // Some control-flow nodes are not in any basic block. This includes
-    // `Conversion`s, expressions that are evaluated at compile time, default
-    // arguments, and `Function`s without implementation.
-    exists(this.getBasicBlock())
-  }
-}
-
-/**
- * A block that can be smaller than or equal to a `BasicBlock`. Use this class
- * when `ControlFlowNode` is too fine-grained and `BasicBlock` too
- * coarse-grained. Their successor graph is like that of basic blocks, except
- * that the blocks are split up with an extra edge right before any instance of
- * the abstract class `SubBasicBlockCutNode`. Users of this library must
- * therefore extend `SubBasicBlockCutNode` to direct where basic blocks will be
- * split up.
- */
-class SubBasicBlock extends ControlFlowNodeBase {
-  SubBasicBlock() {
-    this instanceof BasicBlock
-    or
-    this instanceof SubBasicBlockCutNode
-  }
-
-  /** Gets the basic block in which this `SubBasicBlock` is contained. */
-  BasicBlock getBasicBlock() { result = this.(ControlFlowNode).getBasicBlock() }
-
-  /**
-   * Holds if this `SubBasicBlock` comes first in its basic block. This is the
-   * only condition under which a `SubBasicBlock` may have multiple
-   * predecessors.
-   */
-  predicate firstInBB() { exists(BasicBlock bb | this.getRankInBasicBlock(bb) = 1) }
-
-  /**
-   * Holds if this `SubBasicBlock` comes last in its basic block. This is the
-   * only condition under which a `SubBasicBlock` may have multiple successors.
-   */
-  predicate lastInBB() {
-    exists(BasicBlock bb | this.getRankInBasicBlock(bb) = countSubBasicBlocksInBasicBlock(bb))
-  }
-
-  /**
-   * Gets the (1-based) rank of this `SubBasicBlock` among the other `SubBasicBlock`s in
-   * its containing basic block `bb`, where `bb` is equal to `getBasicBlock()`.
-   */
-  int getRankInBasicBlock(BasicBlock bb) {
-    exists(int thisIndexInBB |
-      thisIndexInBB = this.getIndexInBasicBlock(bb) and
-      thisIndexInBB = rank[result](int i | i = any(SubBasicBlock n).getIndexInBasicBlock(bb))
-    )
-  }
-
-  /**
-   * DEPRECATED: use `getRankInBasicBlock` instead. Note that this predicate
-   * returns a 0-based position, while `getRankInBasicBlock` returns a 1-based
-   * position.
-   */
-  deprecated int getPosInBasicBlock(BasicBlock bb) { result = this.getRankInBasicBlock(bb) - 1 }
-
-  pragma[noinline]
-  private int getIndexInBasicBlock(BasicBlock bb) { this = bb.getNode(result) }
-
-  /** Gets a successor in the control-flow graph of `SubBasicBlock`s. */
-  SubBasicBlock getASuccessor() {
-    this.lastInBB() and
-    result = this.getBasicBlock().getASuccessor()
-    or
-    exists(BasicBlock bb | result.getRankInBasicBlock(bb) = this.getRankInBasicBlock(bb) + 1)
-  }
-
-  /**
-   * Gets the `index`th control-flow node in this `SubBasicBlock`. Indexes
-   * start from 0, and the node at index 0 always exists and compares equal
-   * to `this`.
-   */
-  ControlFlowNode getNode(int index) {
-    exists(BasicBlock bb |
-      exists(int outerIndex |
-        result = bb.getNode(outerIndex) and
-        index = this.outerToInnerIndex(bb, outerIndex)
-      )
-    )
-  }
-
-  /**
-   * Gets the index of the node in this `SubBasicBlock` that has `indexInBB` in
-   * `bb`, where `bb` is equal to `getBasicBlock()`.
-   */
-  // This predicate is factored out of `getNode` to ensure a good join order.
-  // It's sensitive to bad magic, so it has `pragma[nomagic]` on it. For
-  // example, it can get very slow if `getNode` is pragma[nomagic], which could
-  // mean it might get very slow if `getNode` is used in the wrong context.
-  pragma[nomagic]
-  private int outerToInnerIndex(BasicBlock bb, int indexInBB) {
-    indexInBB = result + this.getIndexInBasicBlock(bb) and
-    result = [0 .. this.getNumberOfNodes() - 1]
-  }
-
-  /** Gets a control-flow node in this `SubBasicBlock`. */
-  ControlFlowNode getANode() { result = this.getNode(_) }
-
-  /** Holds if `this` contains `node`. */
-  predicate contains(ControlFlowNode node) { node = this.getANode() }
-
-  /** Gets a predecessor in the control-flow graph of `SubBasicBlock`s. */
-  SubBasicBlock getAPredecessor() { result.getASuccessor() = this }
-
-  /**
-   * Gets a node such that the control-flow edge `(this, result)` may be taken
-   * when the final node of this `SubBasicBlock` is a conditional expression
-   * and evaluates to true.
-   */
-  SubBasicBlock getATrueSuccessor() {
-    this.lastInBB() and
-    result = this.getBasicBlock().getATrueSuccessor()
-  }
-
-  /**
-   * Gets a node such that the control-flow edge `(this, result)` may be taken
-   * when the final node of this `SubBasicBlock` is a conditional expression
-   * and evaluates to false.
-   */
-  SubBasicBlock getAFalseSuccessor() {
-    this.lastInBB() and
-    result = this.getBasicBlock().getAFalseSuccessor()
-  }
-
-  /**
-   * Gets the number of control-flow nodes in this `SubBasicBlock`. There is
-   * always at least one.
-   */
-  int getNumberOfNodes() {
-    exists(BasicBlock bb |
-      if this.lastInBB()
-      then result = bb.length() - this.getIndexInBasicBlock(bb)
-      else result = this.getASuccessor().getIndexInBasicBlock(bb) - this.getIndexInBasicBlock(bb)
-    )
-  }
-
-  /** Gets the last control-flow node in this `SubBasicBlock`. */
-  ControlFlowNode getEnd() { result = this.getNode(this.getNumberOfNodes() - 1) }
-
-  /** Gets the first control-flow node in this `SubBasicBlock`. */
-  ControlFlowNode getStart() { result = this }
-
-  /** Gets the function that contains this `SubBasicBlock`. */
-  pragma[noinline]
-  Function getEnclosingFunction() { result = this.getStart().getControlFlowScope() }
-}
-
-/** Gets the number of `SubBasicBlock`s in the given basic block. */
-private int countSubBasicBlocksInBasicBlock(BasicBlock bb) {
-  result = strictcount(SubBasicBlock sbb | sbb.getBasicBlock() = bb)
-}

cpp/ql/lib/semmle/code/cpp/dataflow/internal/tainttracking1/TaintTrackingImpl.qll

@@ -1,122 +0,0 @@
-/**
- * Provides an implementation of global (interprocedural) taint tracking.
- * This file re-exports the local (intraprocedural) taint-tracking analysis
- * from `TaintTrackingParameter::Public` and adds a global analysis, mainly
- * exposed through the `Configuration` class. For some languages, this file
- * exists in several identical copies, allowing queries to use multiple
- * `Configuration` classes that depend on each other without introducing
- * mutual recursion among those configurations.
- */
-
-import TaintTrackingParameter::Public
-private import TaintTrackingParameter::Private
-
-/**
- * A configuration of interprocedural taint tracking analysis. This defines
- * sources, sinks, and any other configurable aspect of the analysis. Each
- * use of the taint tracking library must define its own unique extension of
- * this abstract class.
- *
- * A taint-tracking configuration is a special data flow configuration
- * (`DataFlow::Configuration`) that allows for flow through nodes that do not
- * necessarily preserve values but are still relevant from a taint tracking
- * perspective. (For example, string concatenation, where one of the operands
- * is tainted.)
- *
- * To create a configuration, extend this class with a subclass whose
- * characteristic predicate is a unique singleton string. For example, write
- *
- * ```ql
- * class MyAnalysisConfiguration extends TaintTracking::Configuration {
- *   MyAnalysisConfiguration() { this = "MyAnalysisConfiguration" }
- *   // Override `isSource` and `isSink`.
- *   // Optionally override `isSanitizer`.
- *   // Optionally override `isSanitizerIn`.
- *   // Optionally override `isSanitizerOut`.
- *   // Optionally override `isSanitizerGuard`.
- *   // Optionally override `isAdditionalTaintStep`.
- * }
- * ```
- *
- * Then, to query whether there is flow between some `source` and `sink`,
- * write
- *
- * ```ql
- * exists(MyAnalysisConfiguration cfg | cfg.hasFlow(source, sink))
- * ```
- *
- * Multiple configurations can coexist, but it is unsupported to depend on
- * another `TaintTracking::Configuration` or a `DataFlow::Configuration` in the
- * overridden predicates that define sources, sinks, or additional steps.
- * Instead, the dependency should go to a `TaintTracking2::Configuration` or a
- * `DataFlow2::Configuration`, `DataFlow3::Configuration`, etc.
- */
-abstract class Configuration extends DataFlow::Configuration {
-  bindingset[this]
-  Configuration() { any() }
-
-  /**
-   * Holds if `source` is a relevant taint source.
-   *
-   * The smaller this predicate is, the faster `hasFlow()` will converge.
-   */
-  // overridden to provide taint-tracking specific qldoc
-  abstract override predicate isSource(DataFlow::Node source);
-
-  /**
-   * Holds if `sink` is a relevant taint sink.
-   *
-   * The smaller this predicate is, the faster `hasFlow()` will converge.
-   */
-  // overridden to provide taint-tracking specific qldoc
-  abstract override predicate isSink(DataFlow::Node sink);
-
-  /** Holds if the node `node` is a taint sanitizer. */
-  predicate isSanitizer(DataFlow::Node node) { none() }
-
-  final override predicate isBarrier(DataFlow::Node node) {
-    this.isSanitizer(node) or
-    defaultTaintSanitizer(node)
-  }
-
-  /** Holds if taint propagation into `node` is prohibited. */
-  predicate isSanitizerIn(DataFlow::Node node) { none() }
-
-  final override predicate isBarrierIn(DataFlow::Node node) { this.isSanitizerIn(node) }
-
-  /** Holds if taint propagation out of `node` is prohibited. */
-  predicate isSanitizerOut(DataFlow::Node node) { none() }
-
-  final override predicate isBarrierOut(DataFlow::Node node) { this.isSanitizerOut(node) }
-
-  /** Holds if taint propagation through nodes guarded by `guard` is prohibited. */
-  predicate isSanitizerGuard(DataFlow::BarrierGuard guard) { none() }
-
-  final override predicate isBarrierGuard(DataFlow::BarrierGuard guard) {
-    this.isSanitizerGuard(guard)
-  }
-
-  /**
-   * Holds if the additional taint propagation step from `node1` to `node2`
-   * must be taken into account in the analysis.
-   */
-  predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) { none() }
-
-  final override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
-    this.isAdditionalTaintStep(node1, node2) or
-    defaultAdditionalTaintStep(node1, node2)
-  }
-
-  override predicate allowImplicitRead(DataFlow::Node node, DataFlow::Content c) {
-    (this.isSink(node) or this.isAdditionalTaintStep(node, _)) and
-    defaultImplicitTaintRead(node, c)
-  }
-
-  /**
-   * Holds if taint may flow from `source` to `sink` for this configuration.
-   */
-  // overridden to provide taint-tracking specific qldoc
-  override predicate hasFlow(DataFlow::Node source, DataFlow::Node sink) {
-    super.hasFlow(source, sink)
-  }
-}

cpp/ql/lib/semmle/code/cpp/dataflow/internal/tainttracking2/TaintTrackingImpl.qll

@@ -1,122 +0,0 @@
-/**
- * Provides an implementation of global (interprocedural) taint tracking.
- * This file re-exports the local (intraprocedural) taint-tracking analysis
- * from `TaintTrackingParameter::Public` and adds a global analysis, mainly
- * exposed through the `Configuration` class. For some languages, this file
- * exists in several identical copies, allowing queries to use multiple
- * `Configuration` classes that depend on each other without introducing
- * mutual recursion among those configurations.
- */
-
-import TaintTrackingParameter::Public
-private import TaintTrackingParameter::Private
-
-/**
- * A configuration of interprocedural taint tracking analysis. This defines
- * sources, sinks, and any other configurable aspect of the analysis. Each
- * use of the taint tracking library must define its own unique extension of
- * this abstract class.
- *
- * A taint-tracking configuration is a special data flow configuration
- * (`DataFlow::Configuration`) that allows for flow through nodes that do not
- * necessarily preserve values but are still relevant from a taint tracking
- * perspective. (For example, string concatenation, where one of the operands
- * is tainted.)
- *
- * To create a configuration, extend this class with a subclass whose
- * characteristic predicate is a unique singleton string. For example, write
- *
- * ```ql
- * class MyAnalysisConfiguration extends TaintTracking::Configuration {
- *   MyAnalysisConfiguration() { this = "MyAnalysisConfiguration" }
- *   // Override `isSource` and `isSink`.
- *   // Optionally override `isSanitizer`.
- *   // Optionally override `isSanitizerIn`.
- *   // Optionally override `isSanitizerOut`.
- *   // Optionally override `isSanitizerGuard`.
- *   // Optionally override `isAdditionalTaintStep`.
- * }
- * ```
- *
- * Then, to query whether there is flow between some `source` and `sink`,
- * write
- *
- * ```ql
- * exists(MyAnalysisConfiguration cfg | cfg.hasFlow(source, sink))
- * ```
- *
- * Multiple configurations can coexist, but it is unsupported to depend on
- * another `TaintTracking::Configuration` or a `DataFlow::Configuration` in the
- * overridden predicates that define sources, sinks, or additional steps.
- * Instead, the dependency should go to a `TaintTracking2::Configuration` or a
- * `DataFlow2::Configuration`, `DataFlow3::Configuration`, etc.
- */
-abstract class Configuration extends DataFlow::Configuration {
-  bindingset[this]
-  Configuration() { any() }
-
-  /**
-   * Holds if `source` is a relevant taint source.
-   *
-   * The smaller this predicate is, the faster `hasFlow()` will converge.
-   */
-  // overridden to provide taint-tracking specific qldoc
-  abstract override predicate isSource(DataFlow::Node source);
-
-  /**
-   * Holds if `sink` is a relevant taint sink.
-   *
-   * The smaller this predicate is, the faster `hasFlow()` will converge.
-   */
-  // overridden to provide taint-tracking specific qldoc
-  abstract override predicate isSink(DataFlow::Node sink);
-
-  /** Holds if the node `node` is a taint sanitizer. */
-  predicate isSanitizer(DataFlow::Node node) { none() }
-
-  final override predicate isBarrier(DataFlow::Node node) {
-    this.isSanitizer(node) or
-    defaultTaintSanitizer(node)
-  }
-
-  /** Holds if taint propagation into `node` is prohibited. */
-  predicate isSanitizerIn(DataFlow::Node node) { none() }
-
-  final override predicate isBarrierIn(DataFlow::Node node) { this.isSanitizerIn(node) }
-
-  /** Holds if taint propagation out of `node` is prohibited. */
-  predicate isSanitizerOut(DataFlow::Node node) { none() }
-
-  final override predicate isBarrierOut(DataFlow::Node node) { this.isSanitizerOut(node) }
-
-  /** Holds if taint propagation through nodes guarded by `guard` is prohibited. */
-  predicate isSanitizerGuard(DataFlow::BarrierGuard guard) { none() }
-
-  final override predicate isBarrierGuard(DataFlow::BarrierGuard guard) {
-    this.isSanitizerGuard(guard)
-  }
-
-  /**
-   * Holds if the additional taint propagation step from `node1` to `node2`
-   * must be taken into account in the analysis.
-   */
-  predicate isAdditionalTaintStep(DataFlow::Node node1, DataFlow::Node node2) { none() }
-
-  final override predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
-    this.isAdditionalTaintStep(node1, node2) or
-    defaultAdditionalTaintStep(node1, node2)
-  }
-
-  override predicate allowImplicitRead(DataFlow::Node node, DataFlow::Content c) {
-    (this.isSink(node) or this.isAdditionalTaintStep(node, _)) and
-    defaultImplicitTaintRead(node, c)
-  }
-
-  /**
-   * Holds if taint may flow from `source` to `sink` for this configuration.
-   */
-  // overridden to provide taint-tracking specific qldoc
-  override predicate hasFlow(DataFlow::Node source, DataFlow::Node sink) {
-    super.hasFlow(source, sink)
-  }
-}

cpp/ql/lib/semmle/code/cpp/exprs/Access.qll

@@ -1,480 +0,0 @@
-/**
- * Provides classes for modeling accesses including variable accesses, enum
- * constant accesses and function accesses.
- */
-
-import semmle.code.cpp.exprs.Expr
-import semmle.code.cpp.Variable
-import semmle.code.cpp.Enum
-private import semmle.code.cpp.dataflow.EscapesTree
-
-/**
- * A C/C++ access expression. This refers to a function (excluding function references in function call expressions), variable, or enum constant.
- */
-class Access extends Expr, NameQualifiableElement, @access {
-  // As `@access` is a union type containing `@routineexpr` (which describes function accesses
-  // that are called), we need to exclude function calls.
-  Access() { this instanceof @routineexpr implies not iscall(underlyingElement(this), _) }
-
-  /** Gets the accessed function, variable, or enum constant. */
-  Declaration getTarget() { none() } // overridden in subclasses
-
-  override predicate mayBeImpure() { none() }
-
-  override predicate mayBeGloballyImpure() { none() }
-
-  override string toString() { none() }
-}
-
-/**
- * A C/C++ `enum` constant access expression. For example the access to
- * `MYENUMCONST1` in `myFunction` in the following code:
- * ```
- * enum MyEnum {
- *   MYENUMCONST1,
- *   MYENUMCONST2
- * };
- *
- * void myFunction() {
- *   MyEnum v = MYENUMCONST1;
- * };
- * ```
- */
-class EnumConstantAccess extends Access, @varaccess {
-  override string getAPrimaryQlClass() { result = "EnumConstantAccess" }
-
-  EnumConstantAccess() {
-    exists(EnumConstant c | varbind(underlyingElement(this), unresolveElement(c)))
-  }
-
-  /** Gets the accessed `enum` constant. */
-  override EnumConstant getTarget() { varbind(underlyingElement(this), unresolveElement(result)) }
-
-  /** Gets a textual representation of this `enum` constant access. */
-  override string toString() { result = this.getTarget().getName() }
-}
-
-/**
- * A C/C++ variable access expression. For example the accesses to
- * `x` and `y` in `myFunction` in the following code:
- * ```
- * int x;
- *
- * void myFunction(int y) {
- *   x = y;
- * };
- * ```
- */
-class VariableAccess extends Access, @varaccess {
-  override string getAPrimaryQlClass() { result = "VariableAccess" }
-
-  VariableAccess() {
-    not exists(EnumConstant c | varbind(underlyingElement(this), unresolveElement(c)))
-  }
-
-  /** Gets the accessed variable. */
-  override Variable getTarget() { varbind(underlyingElement(this), unresolveElement(result)) }
-
-  /**
-   * Holds if this variable access is providing an LValue in a meaningful way.
-   * For example, this includes accesses on the left-hand side of an assignment.
-   * It does not include accesses on the right-hand side of an assignment, even if they could appear on the left-hand side of some assignment.
-   */
-  predicate isUsedAsLValue() {
-    exists(Assignment a | a.getLValue() = this) or
-    exists(CrementOperation c | c.getOperand() = this) or
-    exists(AddressOfExpr addof | addof.getOperand() = this) or
-    exists(ReferenceToExpr rte | this.getConversion() = rte) or
-    exists(ArrayToPointerConversion atpc | this.getConversion() = atpc)
-  }
-
-  /**
-   * Holds if this variable access is in a position where it is (directly) modified,
-   * for instance by an assignment or increment/decrement operator.
-   */
-  predicate isModified() {
-    exists(Assignment a | a.getLValue() = this)
-    or
-    exists(CrementOperation c | c.getOperand() = this)
-    or
-    exists(FunctionCall c | c.getQualifier() = this and c.getTarget().hasName("operator="))
-  }
-
-  /** Holds if this variable access is an rvalue. */
-  predicate isRValue() {
-    not exists(AssignExpr ae | ae.getLValue() = this) and
-    not exists(AddressOfExpr addof | addof.getOperand() = this) and
-    not exists(ReferenceToExpr rte | this.getConversion() = rte) and
-    not exists(ArrayToPointerConversion atpc | this.getConversion() = atpc)
-  }
-
-  /**
-   * Gets the expression generating the variable being accessed.
-   *
-   * As a few examples:
-   * For `ptr->x`, this gives `ptr`.
-   * For `(*ptr).x`, this gives `(*ptr)`.
-   * For `smart_ptr->x`, this gives the call to `operator->`.
-   *
-   * This applies mostly to FieldAccesses, but also to static member variables accessed
-   * "through" a pointer. Note that it does NOT apply to static member variables accessed
-   * through a type name, as in that case the type name is a qualifier on the variable
-   * rather than a qualifier on the access.
-   */
-  Expr getQualifier() { this.getChild(-1) = result }
-
-  /** Gets a textual representation of this variable access. */
-  override string toString() {
-    if exists(this.getTarget())
-    then result = this.getTarget().getName()
-    else result = "variable access"
-  }
-
-  override predicate mayBeImpure() {
-    this.getQualifier().mayBeImpure() or
-    this.getTarget().getType().isVolatile()
-  }
-
-  override predicate mayBeGloballyImpure() {
-    this.getQualifier().mayBeGloballyImpure() or
-    this.getTarget().getType().isVolatile()
-  }
-
-  /**
-   * Holds if this access is used to get the address of the underlying variable
-   * in such a way that the address might escape. This can be either explicit,
-   * for example `&x`, or implicit, for example `T& y = x`.
-   */
-  predicate isAddressOfAccess() { variableAddressEscapesTree(this, _) }
-
-  /**
-   * Holds if this access is used to get the address of the underlying variable
-   * in such a way that the address might escape as a pointer or reference to
-   * non-const data. This can be either explicit, for example `&x`, or
-   * implicit, for example `T& y = x`.
-   */
-  predicate isAddressOfAccessNonConst() { variableAddressEscapesTreeNonConst(this, _) }
-}
-
-/**
- * A C/C++ field access expression. For example the accesses to
- * `x` and `y` in `myMethod` in the following code:
- * ```
- * class MyClass {
- * public:
- *   void myMethod(MyClass &other) {
- *     x = other.y;
- *   }
- *
- *   int x, y;
- * };
- * ```
- */
-class FieldAccess extends VariableAccess {
-  override string getAPrimaryQlClass() { result = "FieldAccess" }
-
-  FieldAccess() { exists(Field f | varbind(underlyingElement(this), unresolveElement(f))) }
-
-  /** Gets the accessed field. */
-  override Field getTarget() { result = super.getTarget() }
-}
-
-/**
- * A field access whose qualifier is a pointer to a class, struct or union.
- * These typically take the form `obj->field`. Another case is a field access
- * with an implicit `this->` qualifier, which is often a `PointerFieldAccess`
- * (but see also `ImplicitThisFieldAccess`).
- *
- * For example the accesses to `x` and `y` in `myMethod` in the following code
- * are each a `PointerFieldAccess`:
- * ```
- * class MyClass {
- * public:
- *   void myMethod(MyClass *other) {
- *       other->x = y;
- *   }
- *
- *   int x, y;
- * };
- * ```
- */
-class PointerFieldAccess extends FieldAccess {
-  override string getAPrimaryQlClass() { result = "PointerFieldAccess" }
-
-  PointerFieldAccess() {
-    exists(PointerType t |
-      t = this.getQualifier().getFullyConverted().getUnspecifiedType() and
-      t.getBaseType() instanceof Class
-    )
-  }
-}
-
-/**
- * A field access of the form `obj.field`. The type of `obj` is either a
- * class/struct/union or a reference to one. `DotFieldAccess` has two
- * sub-classes, `ValueFieldAccess` and `ReferenceFieldAccess`, to
- * distinguish whether or not the type of `obj` is a reference type.
- */
-class DotFieldAccess extends FieldAccess {
-  override string getAPrimaryQlClass() { result = "DotFieldAccess" }
-
-  DotFieldAccess() {
-    exists(Class c | c = this.getQualifier().getFullyConverted().getUnspecifiedType())
-  }
-}
-
-/**
- * A field access of the form `obj.field`, where the type of `obj` is a
- * reference to a class/struct/union. For example the accesses to `y` in
- * `myMethod` in the following code:
- * ```
- * class MyClass {
- * public:
- *   void myMethod(MyClass a, MyClass &b) {
- *     a.x = b.y;
- *   }
- *
- *   int x, y;
- * };
- * ```
- */
-class ReferenceFieldAccess extends DotFieldAccess {
-  override string getAPrimaryQlClass() { result = "ReferenceFieldAccess" }
-
-  ReferenceFieldAccess() { exprHasReferenceConversion(this.getQualifier()) }
-}
-
-/**
- * A field access of the form `obj.field`, where the type of `obj` is a
- * class/struct/union (and not a reference). For example the accesses to `x`
- * in `myMethod` in the following code:
- * ```
- * class MyClass {
- * public:
- *   void myMethod(MyClass a, MyClass &b) {
- *     a.x = b.y;
- *   }
- *
- *   int x, y;
- * };
- * ```
- */
-class ValueFieldAccess extends DotFieldAccess {
-  override string getAPrimaryQlClass() { result = "ValueFieldAccess" }
-
-  ValueFieldAccess() { not exprHasReferenceConversion(this.getQualifier()) }
-}
-
-/**
- * Holds if `c` is a conversion from type `T&` to `T` (or from `T&&` to
- * `T`).
- */
-private predicate referenceConversion(Conversion c) {
-  c.getType() = c.getExpr().getType().(ReferenceType).getBaseType()
-}
-
-/**
- * Holds if `e` is a reference expression (that is, it has a type of the
- * form `T&`), which is converted to a value. For example:
- * ```
- * int myfcn(MyStruct &x) {
- *   return x.field;
- * }
- * ```
- * In this example, the type of `x` is `MyStruct&`, but it gets implicitly
- * converted to `MyStruct` in the expression `x.field`.
- */
-private predicate exprHasReferenceConversion(Expr e) { referenceConversion(e.getConversion+()) }
-
-/**
- * A field access of a field of `this` which has no qualifier because
- * the use of `this` is implicit. For example, in the following code the
- * implicit call to the destructor of `A` has no qualifier because the
- * use of `this` is implicit:
- * ```
- * class A {
- * public:
- *   ~A() {
- *     // ...
- *   }
- * };
- *
- * class B {
- * public:
- *   A a;
- *
- *   ~B() {
- *     // Implicit call to the destructor of `A`.
- *   }
- * };
- * ```
- * Note: the C++ front-end often automatically desugars `field` to
- * `this->field`, so most accesses of `this->field` are instances
- * of `PointerFieldAccess` (with `ThisExpr` as the qualifier), not
- * `ImplicitThisFieldAccess`.
- */
-class ImplicitThisFieldAccess extends FieldAccess {
-  override string getAPrimaryQlClass() { result = "ImplicitThisFieldAccess" }
-
-  ImplicitThisFieldAccess() { not exists(this.getQualifier()) }
-}
-
-/**
- * A C++ _pointer to non-static data member_ literal. For example, `&C::x` is
- * an expression that refers to field `x` of class `C`. If the type of that
- * field is `int`, then `&C::x` ought to have type `int C::*`. It is currently
- * modeled in QL as having type `int`.
- *
- * See [dcl.mptr] in the C++17 standard or see
- * https://en.cppreference.com/w/cpp/language/pointer#Pointers_to_data_members.
- */
-class PointerToFieldLiteral extends ImplicitThisFieldAccess {
-  PointerToFieldLiteral() {
-    // The extractor currently emits a pointer-to-field literal as a field
-    // access without a qualifier. The only other unqualified field accesses it
-    // emits are for compiler-generated constructors and destructors. When we
-    // filter those out, there are only pointer-to-field literals left.
-    not this.isCompilerGenerated()
-  }
-
-  override predicate isConstant() { any() }
-
-  override string getAPrimaryQlClass() { result = "PointerToFieldLiteral" }
-}
-
-/**
- * A C/C++ function access expression. For example the access to
- * `myFunctionTarget` in `myFunction` in the following code:
- * ```
- * int myFunctionTarget(int);
- *
- * void myFunction() {
- *   int (*myFunctionPointer)(int) = &myFunctionTarget;
- * }
- * ```
- * This excludes function accesses in function call expressions.
- * For example the access `myFunctionTarget` in `myFunction` in the following code:
- * ```
- * int myFunctionTarget(int);
- *
- * void myFunction() {
- *   myFunctionTarget(1);
- * }
- * ```
- */
-class FunctionAccess extends Access, @routineexpr {
-  FunctionAccess() { not iscall(underlyingElement(this), _) }
-
-  override string getAPrimaryQlClass() { result = "FunctionAccess" }
-
-  /** Gets the accessed function. */
-  override Function getTarget() { funbind(underlyingElement(this), unresolveElement(result)) }
-
-  /** Gets a textual representation of this function access. */
-  override string toString() {
-    if exists(this.getTarget())
-    then result = this.getTarget().getName()
-    else result = "function access"
-  }
-}
-
-/**
- * An access to a parameter of a function signature for the purposes of a `decltype`.
- *
- * For example, given the following code:
- * ```
- *   template <typename L, typename R>
- *   auto add(L lhs, R rhs) -> decltype(lhs + rhs) {
- *     return lhs + rhs;
- *   }
- * ```
- * The return type of the function is a decltype, the expression of which contains
- * an add expression, which in turn has two `ParamAccessForType` children.
- */
-class ParamAccessForType extends Expr, @param_ref {
-  override string toString() { result = "param access" }
-}
-
-/**
- * An access to a type.  This occurs in certain contexts where a built-in
- * works on types directly rather than variables, expressions etc.  For
- * example the reference to `MyClass` in `__is_pod` in the following code:
- * ```
- * class MyClass {
- *   ...
- * };
- *
- * void myFunction() {
- *   if (__is_pod(MyClass))
- *   {
- *     ...
- *   } else {
- *     ...
- *   }
- * }
- * ```
- */
-class TypeName extends Expr, @type_operand {
-  override string getAPrimaryQlClass() { result = "TypeName" }
-
-  override string toString() { result = this.getType().getName() }
-}
-
-/**
- * A C/C++ array access expression. For example, the access to `as` in
- * `myFunction` in the following code:
- * ```
- * int as[10];
- *
- * void myFunction() {
- *   as[0]++;
- * }
- * ```
- * For calls to `operator[]`, which look syntactically identical, see
- * `OverloadedArrayExpr`.
- */
-class ArrayExpr extends Expr, @subscriptexpr {
-  override string getAPrimaryQlClass() { result = "ArrayExpr" }
-
-  /**
-   * Gets the array or pointer expression being subscripted.
-   *
-   * This is `arr` in both `arr[0]` and `0[arr]`.
-   */
-  Expr getArrayBase() { result = this.getChild(0) }
-
-  /**
-   * Gets the expression giving the index into the array.
-   *
-   * This is `0` in both `arr[0]` and `0[arr]`.
-   */
-  Expr getArrayOffset() { result = this.getChild(1) }
-
-  /**
-   * Holds if this array access is in a position where it is (directly) modified,
-   * for instance by an assignment or an increment/decrement operation.
-   */
-  predicate isModified() {
-    exists(Assignment a | a.getLValue() = this)
-    or
-    exists(CrementOperation c | c.getOperand() = this)
-    or
-    exists(FunctionCall c | c.getQualifier() = this and c.getTarget().hasName("operator="))
-  }
-
-  override string toString() { result = "access to array" }
-
-  override predicate mayBeImpure() {
-    this.getArrayBase().mayBeImpure() or
-    this.getArrayOffset().mayBeImpure() or
-    this.getArrayBase().getFullyConverted().getType().(DerivedType).getBaseType().isVolatile() or
-    this.getArrayOffset().getFullyConverted().getType().(DerivedType).getBaseType().isVolatile()
-  }
-
-  override predicate mayBeGloballyImpure() {
-    this.getArrayBase().mayBeGloballyImpure() or
-    this.getArrayOffset().mayBeGloballyImpure() or
-    this.getArrayBase().getFullyConverted().getType().(DerivedType).getBaseType().isVolatile() or
-    this.getArrayOffset().getFullyConverted().getType().(DerivedType).getBaseType().isVolatile()
-  }
-}

cpp/ql/lib/semmle/code/cpp/exprs/ArithmeticOperation.qll

@@ -1,455 +0,0 @@
-/**
- * Provides classes for modeling arithmetic operations such as `+`, `-`, `*`
- * and `++`.
- */
-
-import semmle.code.cpp.exprs.Expr
-
-/**
- * A C/C++ unary arithmetic operation.
- */
-class UnaryArithmeticOperation extends UnaryOperation, @un_arith_op_expr { }
-
-/**
- * A C/C++ unary minus expression.
- * ```
- * b = - a;
- * ```
- */
-class UnaryMinusExpr extends UnaryArithmeticOperation, @arithnegexpr {
-  override string getOperator() { result = "-" }
-
-  override string getAPrimaryQlClass() { result = "UnaryMinusExpr" }
-
-  override int getPrecedence() { result = 16 }
-}
-
-/**
- * A C/C++ unary plus expression.
- * ```
- * b = + a;
- * ```
- */
-class UnaryPlusExpr extends UnaryArithmeticOperation, @unaryplusexpr {
-  override string getOperator() { result = "+" }
-
-  override string getAPrimaryQlClass() { result = "UnaryPlusExpr" }
-
-  override int getPrecedence() { result = 16 }
-}
-
-/**
- * A C/C++ GNU conjugation expression.  It operates on `_Complex` or
- * `__complex__ `numbers, and is similar to the C99 `conj`, `conjf` and `conjl`
- * functions.
- * ```
- * _Complex double a =  ( 1.0, 2.0 );
- * _Complex double b = ~ a;  // ( 1.0, - 2.0 )
- * ```
- */
-class ConjugationExpr extends UnaryArithmeticOperation, @conjugation {
-  override string getOperator() { result = "~" }
-
-  override string getAPrimaryQlClass() { result = "ConjugationExpr" }
-}
-
-/**
- * A C/C++ `++` or `--` expression (either prefix or postfix).
- *
- * This is the base QL class for increment and decrement operations.
- *
- * Note that this does not include calls to user-defined `operator++`
- * or `operator--`.
- */
-class CrementOperation extends UnaryArithmeticOperation, @crement_expr {
-  override predicate mayBeImpure() { any() }
-
-  override predicate mayBeGloballyImpure() {
-    not exists(VariableAccess va, StackVariable v |
-      va = this.getOperand() and
-      v = va.getTarget() and
-      not va.getConversion+() instanceof ReferenceDereferenceExpr
-    )
-  }
-}
-
-/**
- * A C/C++ `++` expression (either prefix or postfix).
- *
- * Note that this does not include calls to user-defined `operator++`.
- */
-class IncrementOperation extends CrementOperation, @increment_expr { }
-
-/**
- * A C/C++ `--` expression (either prefix or postfix).
- *
- * Note that this does not include calls to user-defined `operator--`.
- */
-class DecrementOperation extends CrementOperation, @decrement_expr { }
-
-/**
- * A C/C++ `++` or `--` prefix expression.
- *
- * Note that this does not include calls to user-defined operators.
- */
-class PrefixCrementOperation extends CrementOperation, @prefix_crement_expr { }
-
-/**
- * A C/C++ `++` or `--` postfix expression.
- *
- * Note that this does not include calls to user-defined operators.
- */
-class PostfixCrementOperation extends CrementOperation, @postfix_crement_expr { }
-
-/**
- * A C/C++ prefix increment expression, as in `++x`.
- *
- * Note that this does not include calls to user-defined `operator++`.
- * ```
- * b = ++a;
- * ```
- */
-class PrefixIncrExpr extends IncrementOperation, PrefixCrementOperation, @preincrexpr {
-  override string getOperator() { result = "++" }
-
-  override string getAPrimaryQlClass() { result = "PrefixIncrExpr" }
-
-  override int getPrecedence() { result = 16 }
-}
-
-/**
- * A C/C++ prefix decrement expression, as in `--x`.
- *
- * Note that this does not include calls to user-defined `operator--`.
- * ```
- * b = --a;
- * ```
- */
-class PrefixDecrExpr extends DecrementOperation, PrefixCrementOperation, @predecrexpr {
-  override string getOperator() { result = "--" }
-
-  override string getAPrimaryQlClass() { result = "PrefixDecrExpr" }
-
-  override int getPrecedence() { result = 16 }
-}
-
-/**
- * A C/C++ postfix increment expression, as in `x++`.
- *
- * Note that this does not include calls to user-defined `operator++`.
- * ```
- * b = a++;
- * ```
- */
-class PostfixIncrExpr extends IncrementOperation, PostfixCrementOperation, @postincrexpr {
-  override string getOperator() { result = "++" }
-
-  override string getAPrimaryQlClass() { result = "PostfixIncrExpr" }
-
-  override int getPrecedence() { result = 17 }
-
-  override string toString() { result = "... " + this.getOperator() }
-}
-
-/**
- * A C/C++ postfix decrement expression, as in `x--`.
- *
- * Note that this does not include calls to user-defined `operator--`.
- * ```
- * b = a--;
- * ```
- */
-class PostfixDecrExpr extends DecrementOperation, PostfixCrementOperation, @postdecrexpr {
-  override string getOperator() { result = "--" }
-
-  override string getAPrimaryQlClass() { result = "PostfixDecrExpr" }
-
-  override int getPrecedence() { result = 17 }
-
-  override string toString() { result = "... " + this.getOperator() }
-}
-
-/**
- * A C/C++ GNU real part expression.  It operates on `_Complex` or
- * `__complex__` numbers.
- * ```
- * _Complex double f = { 2.0, 3.0 };
- * double d = __real(f);  // 2.0
- * ```
- */
-class RealPartExpr extends UnaryArithmeticOperation, @realpartexpr {
-  override string getOperator() { result = "__real" }
-
-  override string getAPrimaryQlClass() { result = "RealPartExpr" }
-}
-
-/**
- * A C/C++ GNU imaginary part expression.  It operates on `_Complex` or
- * `__complex__` numbers.
- * ```
- * _Complex double f = { 2.0, 3.0 };
- * double d = __imag(f);  // 3.0
- * ```
- */
-class ImaginaryPartExpr extends UnaryArithmeticOperation, @imagpartexpr {
-  override string getOperator() { result = "__imag" }
-
-  override string getAPrimaryQlClass() { result = "ImaginaryPartExpr" }
-}
-
-/**
- * A C/C++ binary arithmetic operation.
- *
- * This is an abstract base QL class for all binary arithmetic operations.
- */
-class BinaryArithmeticOperation extends BinaryOperation, @bin_arith_op_expr { }
-
-/**
- * A C/C++ add expression.
- * ```
- * c = a + b;
- * ```
- */
-class AddExpr extends BinaryArithmeticOperation, @addexpr {
-  override string getOperator() { result = "+" }
-
-  override string getAPrimaryQlClass() { result = "AddExpr" }
-
-  override int getPrecedence() { result = 13 }
-}
-
-/**
- * A C/C++ subtract expression.
- * ```
- * c = a - b;
- * ```
- */
-class SubExpr extends BinaryArithmeticOperation, @subexpr {
-  override string getOperator() { result = "-" }
-
-  override string getAPrimaryQlClass() { result = "SubExpr" }
-
-  override int getPrecedence() { result = 13 }
-}
-
-/**
- * A C/C++ multiply expression.
- * ```
- * c = a * b;
- * ```
- */
-class MulExpr extends BinaryArithmeticOperation, @mulexpr {
-  override string getOperator() { result = "*" }
-
-  override string getAPrimaryQlClass() { result = "MulExpr" }
-
-  override int getPrecedence() { result = 14 }
-}
-
-/**
- * A C/C++ divide expression.
- * ```
- * c = a / b;
- * ```
- */
-class DivExpr extends BinaryArithmeticOperation, @divexpr {
-  override string getOperator() { result = "/" }
-
-  override string getAPrimaryQlClass() { result = "DivExpr" }
-
-  override int getPrecedence() { result = 14 }
-}
-
-/**
- * A C/C++ remainder expression.
- * ```
- * c = a % b;
- * ```
- */
-class RemExpr extends BinaryArithmeticOperation, @remexpr {
-  override string getOperator() { result = "%" }
-
-  override string getAPrimaryQlClass() { result = "RemExpr" }
-
-  override int getPrecedence() { result = 14 }
-}
-
-/**
- * A C/C++ multiply expression with an imaginary number.  This is specific to
- * C99 and later.
- * ```
- * double z;
- * _Imaginary double x, y;
- * z = x * y;
- * ```
- */
-class ImaginaryMulExpr extends BinaryArithmeticOperation, @jmulexpr {
-  override string getOperator() { result = "*" }
-
-  override string getAPrimaryQlClass() { result = "ImaginaryMulExpr" }
-
-  override int getPrecedence() { result = 14 }
-}
-
-/**
- * A C/C++ divide expression with an imaginary number.  This is specific to
- * C99 and later.
- * ```
- * double z;
- * _Imaginary double y;
- * z = z / y;
- * ```
- */
-class ImaginaryDivExpr extends BinaryArithmeticOperation, @jdivexpr {
-  override string getOperator() { result = "/" }
-
-  override string getAPrimaryQlClass() { result = "ImaginaryDivExpr" }
-
-  override int getPrecedence() { result = 14 }
-}
-
-/**
- * A C/C++ add expression with a real term and an imaginary term.  This is
- * specific to C99 and later.
- * ```
- * double z;
- * _Imaginary double x;
- * _Complex double w;
- * w = z + x;
- * ```
- */
-class RealImaginaryAddExpr extends BinaryArithmeticOperation, @fjaddexpr {
-  override string getOperator() { result = "+" }
-
-  override string getAPrimaryQlClass() { result = "RealImaginaryAddExpr" }
-
-  override int getPrecedence() { result = 13 }
-}
-
-/**
- * A C/C++ add expression with an imaginary term and a real term.  This is
- * specific to C99 and later.
- * ```
- * double z;
- * _Imaginary double x;
- * _Complex double w;
- * w = x + z;
- * ```
- */
-class ImaginaryRealAddExpr extends BinaryArithmeticOperation, @jfaddexpr {
-  override string getOperator() { result = "+" }
-
-  override string getAPrimaryQlClass() { result = "ImaginaryRealAddExpr" }
-
-  override int getPrecedence() { result = 13 }
-}
-
-/**
- * A C/C++ subtract expression with a real term and an imaginary term.  This is
- * specific to C99 and later.
- * ```
- * double z;
- * _Imaginary double x;
- * _Complex double w;
- * w = z - x;
- * ```
- */
-class RealImaginarySubExpr extends BinaryArithmeticOperation, @fjsubexpr {
-  override string getOperator() { result = "-" }
-
-  override string getAPrimaryQlClass() { result = "RealImaginarySubExpr" }
-
-  override int getPrecedence() { result = 13 }
-}
-
-/**
- * A C/C++ subtract expression with an imaginary term and a real term.  This is
- * specific to C99 and later.
- * ```
- * double z;
- * _Imaginary double x;
- * _Complex double w;
- * w = x - z;
- * ```
- */
-class ImaginaryRealSubExpr extends BinaryArithmeticOperation, @jfsubexpr {
-  override string getOperator() { result = "-" }
-
-  override string getAPrimaryQlClass() { result = "ImaginaryRealSubExpr" }
-
-  override int getPrecedence() { result = 13 }
-}
-
-/**
- * A C/C++ GNU min expression.
- * ```
- * c = a <? b;
- * ```
- */
-class MinExpr extends BinaryArithmeticOperation, @minexpr {
-  override string getOperator() { result = "<?" }
-
-  override string getAPrimaryQlClass() { result = "MinExpr" }
-}
-
-/**
- * A C/C++ GNU max expression.
- * ```
- * c = a >? b;
- * ```
- */
-class MaxExpr extends BinaryArithmeticOperation, @maxexpr {
-  override string getOperator() { result = ">?" }
-
-  override string getAPrimaryQlClass() { result = "MaxExpr" }
-}
-
-/**
- * A C/C++ pointer arithmetic operation.
- */
-class PointerArithmeticOperation extends BinaryArithmeticOperation, @p_arith_op_expr { }
-
-/**
- * A C/C++ pointer add expression.
- * ```
- * foo *ptr = &f[0];
- * ptr = ptr + 2;
- * ```
- */
-class PointerAddExpr extends PointerArithmeticOperation, @paddexpr {
-  override string getOperator() { result = "+" }
-
-  override string getAPrimaryQlClass() { result = "PointerAddExpr" }
-
-  override int getPrecedence() { result = 13 }
-}
-
-/**
- * A C/C++ pointer subtract expression.
- * ```
- * foo *ptr = &f[3];
- * ptr = ptr - 2;
- * ```
- */
-class PointerSubExpr extends PointerArithmeticOperation, @psubexpr {
-  override string getOperator() { result = "-" }
-
-  override string getAPrimaryQlClass() { result = "PointerSubExpr" }
-
-  override int getPrecedence() { result = 13 }
-}
-
-/**
- * A C/C++ pointer difference expression.
- * ```
- * foo *start = &f[0], *end = &f[4];
- * int size = end - size;
- * ```
- */
-class PointerDiffExpr extends PointerArithmeticOperation, @pdiffexpr {
-  override string getOperator() { result = "-" }
-
-  override string getAPrimaryQlClass() { result = "PointerDiffExpr" }
-
-  override int getPrecedence() { result = 13 }
-}

cpp/ql/lib/semmle/code/cpp/exprs/Assignment.qll

@@ -1,254 +0,0 @@
-import semmle.code.cpp.exprs.Expr
-import semmle.code.cpp.exprs.ArithmeticOperation
-import semmle.code.cpp.exprs.BitwiseOperation
-
-/**
- * A non-overloaded binary assignment operation, including `=`, `+=`, `&=`,
- * etc. A C++ overloaded assignment operation looks syntactically identical but is instead
- * a `FunctionCall`. This class does _not_ include variable initializers. To get a variable
- * initializer, use `Initializer` instead.
- *
- * This is a QL base class for all (non-overloaded) assignments.
- */
-class Assignment extends Operation, @assign_expr {
-  /** Gets the _lvalue_ of this assignment. */
-  Expr getLValue() { this.hasChild(result, 0) }
-
-  /** Gets the rvalue of this assignment. */
-  Expr getRValue() { this.hasChild(result, 1) }
-
-  override int getPrecedence() { result = 2 }
-
-  override predicate mayBeGloballyImpure() {
-    this.getRValue().mayBeGloballyImpure()
-    or
-    not exists(VariableAccess va, StackVariable v |
-      va = this.getLValue() and
-      v = va.getTarget() and
-      not va.getConversion+() instanceof ReferenceDereferenceExpr
-    )
-  }
-}
-
-/**
- * A non-overloaded assignment operation with the operator `=`.
- * ```
- * a = b;
- * ```
- * Note that `int a = b;` is _not_ an `AssignExpr`. It is a `Variable`,
- * and `b` can be obtained using `Variable.getInitializer()`.
- */
-class AssignExpr extends Assignment, @assignexpr {
-  override string getOperator() { result = "=" }
-
-  override string getAPrimaryQlClass() { result = "AssignExpr" }
-
-  /** Gets a textual representation of this assignment. */
-  override string toString() { result = "... = ..." }
-}
-
-/**
- * A non-overloaded binary assignment operation other than `=`.
- *
- * This class does _not_ include variable initializers. To get a variable
- * initializer, use `Initializer` instead.
- */
-class AssignOperation extends Assignment, @assign_op_expr {
-  override string toString() { result = "... " + this.getOperator() + " ..." }
-}
-
-/**
- * A non-overloaded arithmetic assignment operation on a non-pointer _lvalue_:
- * `+=`, `-=`, `*=`, `/=` and `%=`.
- */
-class AssignArithmeticOperation extends AssignOperation, @assign_arith_expr { }
-
-/**
- * A non-overloaded `+=` assignment expression on a non-pointer _lvalue_.
- * ```
- * a += b;
- * ```
- */
-class AssignAddExpr extends AssignArithmeticOperation, @assignaddexpr {
-  override string getAPrimaryQlClass() { result = "AssignAddExpr" }
-
-  override string getOperator() { result = "+=" }
-}
-
-/**
- * A non-overloaded `-=` assignment expression on a non-pointer _lvalue_.
- * ```
- * a -= b;
- * ```
- */
-class AssignSubExpr extends AssignArithmeticOperation, @assignsubexpr {
-  override string getAPrimaryQlClass() { result = "AssignSubExpr" }
-
-  override string getOperator() { result = "-=" }
-}
-
-/**
- * A non-overloaded `*=` assignment expression.
- * ```
- * a *= b;
- * ```
- */
-class AssignMulExpr extends AssignArithmeticOperation, @assignmulexpr {
-  override string getAPrimaryQlClass() { result = "AssignMulExpr" }
-
-  override string getOperator() { result = "*=" }
-}
-
-/**
- * A non-overloaded `/=` assignment expression.
- * ```
- * a /= b;
- * ```
- */
-class AssignDivExpr extends AssignArithmeticOperation, @assigndivexpr {
-  override string getAPrimaryQlClass() { result = "AssignDivExpr" }
-
-  override string getOperator() { result = "/=" }
-}
-
-/**
- * A non-overloaded `%=` assignment expression.
- * ```
- * a %= b;
- * ```
- */
-class AssignRemExpr extends AssignArithmeticOperation, @assignremexpr {
-  override string getAPrimaryQlClass() { result = "AssignRemExpr" }
-
-  override string getOperator() { result = "%=" }
-}
-
-/**
- * A non-overloaded bitwise assignment operation:
- * `&=`, `|=`, `^=`, `<<=`, and `>>=`.
- */
-class AssignBitwiseOperation extends AssignOperation, @assign_bitwise_expr { }
-
-/**
- * A non-overloaded AND (`&=`) assignment expression.
- * ```
- * a &= b;
- * ```
- */
-class AssignAndExpr extends AssignBitwiseOperation, @assignandexpr {
-  override string getAPrimaryQlClass() { result = "AssignAndExpr" }
-
-  override string getOperator() { result = "&=" }
-}
-
-/**
- * A non-overloaded OR (`|=`) assignment expression.
- * ```
- * a |= b;
- * ```
- */
-class AssignOrExpr extends AssignBitwiseOperation, @assignorexpr {
-  override string getAPrimaryQlClass() { result = "AssignOrExpr" }
-
-  override string getOperator() { result = "|=" }
-}
-
-/**
- * A non-overloaded XOR (`^=`) assignment expression.
- * ```
- * a ^= b;
- * ```
- */
-class AssignXorExpr extends AssignBitwiseOperation, @assignxorexpr {
-  override string getAPrimaryQlClass() { result = "AssignXorExpr" }
-
-  override string getOperator() { result = "^=" }
-}
-
-/**
- * A non-overloaded `<<=` assignment expression.
- * ```
- * a <<= b;
- * ```
- */
-class AssignLShiftExpr extends AssignBitwiseOperation, @assignlshiftexpr {
-  override string getAPrimaryQlClass() { result = "AssignLShiftExpr" }
-
-  override string getOperator() { result = "<<=" }
-}
-
-/**
- * A non-overloaded `>>=` assignment expression.
- * ```
- * a >>= b;
- * ```
- */
-class AssignRShiftExpr extends AssignBitwiseOperation, @assignrshiftexpr {
-  override string getAPrimaryQlClass() { result = "AssignRShiftExpr" }
-
-  override string getOperator() { result = ">>=" }
-}
-
-/**
- * A non-overloaded `+=` pointer assignment expression.
- * ```
- * ptr += index;
- * ```
- */
-class AssignPointerAddExpr extends AssignOperation, @assignpaddexpr {
-  override string getAPrimaryQlClass() { result = "AssignPointerAddExpr" }
-
-  override string getOperator() { result = "+=" }
-}
-
-/**
- * A non-overloaded `-=` pointer assignment expression.
- * ```
- * ptr -= index;
- * ```
- */
-class AssignPointerSubExpr extends AssignOperation, @assignpsubexpr {
-  override string getAPrimaryQlClass() { result = "AssignPointerSubExpr" }
-
-  override string getOperator() { result = "-=" }
-}
-
-/**
- * A C++ variable declaration inside the conditional expression of a `while`, `if` or
- * `for` compound statement.  Declaring a variable this way narrows its lifetime and
- * scope to be strictly the compound statement itself.  For example:
- * ```
- * extern int x, y;
- * if (bool c = x < y) { do_something_with(c); }
- * // c is no longer in scope
- * while (int d = x - y) { do_something_else_with(d); }
- * // d is no longer is scope
- * ```
- */
-class ConditionDeclExpr extends Expr, @condition_decl {
-  /**
-   * DEPRECATED: Use `getVariableAccess()` or `getInitializingExpr()` instead.
-   *
-   * Gets the access using the condition for this declaration.
-   */
-  deprecated Expr getExpr() { result = this.getChild(0) }
-
-  override string getAPrimaryQlClass() { result = "ConditionDeclExpr" }
-
-  /**
-   * Gets the compiler-generated variable access that conceptually occurs after
-   * the initialization of the declared variable.
-   */
-  VariableAccess getVariableAccess() { result = this.getChild(0) }
-
-  /**
-   * Gets the expression that initializes the declared variable. This predicate
-   * always has a result.
-   */
-  Expr getInitializingExpr() { result = this.getVariable().getInitializer().getExpr() }
-
-  /** Gets the variable that is declared. */
-  Variable getVariable() { condition_decl_bind(underlyingElement(this), unresolveElement(result)) }
-
-  override string toString() { result = "(condition decl)" }
-}

cpp/ql/lib/semmle/code/cpp/exprs/Call.qll

@@ -1,665 +0,0 @@
-/**
- * Provides classes for modeling call expressions including direct calls to
- * functions, constructor and destructor calls, and calls made through function
- * pointers.
- */
-
-import semmle.code.cpp.exprs.Expr
-import semmle.code.cpp.Function
-private import semmle.code.cpp.dataflow.EscapesTree
-
-private class TCall = @funbindexpr or @callexpr;
-
-/**
- * A C/C++ call.
- */
-class Call extends Expr, NameQualifiableElement, TCall {
-  // `@funbindexpr` (which is the dbscheme type for FunctionCall) is a union type that includes
-  // `@routineexpr. This dbscheme type includes accesses to functions that are not necessarily calls to
-  // that function. That's why the charpred for `FunctionCall` requires:
-  // ```
-  // iscall(underlyingElement(this), _)
-  // ```
-  // So for the charpred for `Call` we include the requirement that if this is an instance of
-  // `@funbindexpr` it must be a _call_ to the function.
-  Call() { this instanceof @callexpr or iscall(underlyingElement(this), _) }
-
-  /**
-   * Gets the number of arguments (actual parameters) of this call. The count
-   * does _not_ include the qualifier of the call, if any.
-   */
-  int getNumberOfArguments() { result = count(this.getAnArgument()) }
-
-  /**
-   * Holds if this call has a qualifier.
-   *
-   * For example, `ptr->f()` has a qualifier, whereas plain `f()` does not.
-   */
-  predicate hasQualifier() { exists(Expr e | this.getChild(-1) = e) }
-
-  /**
-   * Gets the expression to the left of the function name or function pointer variable name.
-   *
-   * As a few examples:
-   *  For the call to `f` in `ptr->f()`, this gives `ptr`.
-   *  For the call to `f` in `(*ptr).f()`, this gives `(*ptr)`.
-   */
-  Expr getQualifier() { result = this.getChild(-1) }
-
-  /**
-   * Gets an argument for this call. To get the qualifier of this call, if
-   * any, use `getQualifier()`.
-   */
-  Expr getAnArgument() { exists(int i | result = this.getChild(i) and i >= 0) }
-
-  /**
-   * Gets the nth argument for this call.
-   *
-   * The range of `n` is from `0` to `getNumberOfArguments() - 1`. To get the
-   * qualifier of this call, if any, use `getQualifier()`.
-   */
-  Expr getArgument(int n) { result = this.getChild(n) and n >= 0 }
-
-  /**
-   * Gets a subexpression of the argument at position `index`. If the
-   * argument itself contains calls, such calls will be considered
-   * leaves in the expression tree. The qualifier of the call, if any, is not
-   * considered to be an argument.
-   *
-   * Example: the call `f(2, 3 + 4, g(4 + 5))` has sub expression(s)
-   * `2` at index 0; `3`, `4`, and `3 + 4` at index 1; and `g(4 + 5)`
-   * at index 2, respectively.
-   */
-  Expr getAnArgumentSubExpr(int index) {
-    result = this.getArgument(index)
-    or
-    exists(Expr mid |
-      mid = this.getAnArgumentSubExpr(index) and
-      not mid instanceof Call and
-      not mid instanceof SizeofOperator and
-      result = mid.getAChild()
-    )
-  }
-
-  /**
-   * Gets the target of the call, as best as makes sense for this kind of call.
-   * The precise meaning depends on the kind of call it is:
-   * - For a call to a function, it's the function being called.
-   * - For a C++ method call, it's the statically resolved method.
-   * - For an Objective C message expression, it's the statically resolved
-   *   method, and it might not exist.
-   * - For a variable call, it never exists.
-   */
-  Function getTarget() { none() } // overridden in subclasses
-
-  override int getPrecedence() { result = 17 }
-
-  override string toString() { none() }
-
-  /**
-   * Holds if this call passes the variable accessed by `va` by
-   * reference as the `i`th argument. The qualifier of a call to a member
-   * function is `i = -1`.
-   *
-   * A variable is passed by reference if the `i`th parameter of the function
-   * receives an address that points within the object denoted by `va`. For a
-   * variable named `x`, passing by reference includes both explicit pointers
-   * (`&x`) and implicit conversion to a C++ reference (`x`), but it also
-   * includes deeper expressions such as `&x[0] + length` or `&*&*&x`.
-   *
-   * When `Field`s are involved, an argument `i` may pass more than one
-   * variable by reference simultaneously. For example, the call `f(&x.m1.m2)`
-   * counts as passing both `x`, `m1` and `m2` to argument 0 of `f`.
-   *
-   * This predicate holds for variables passed by reference even if they are
-   * passed as references to `const` and thus cannot be changed through that
-   * reference. See `passesByNonConstReference` for a predicate that only holds
-   * for variables passed by reference to non-const.
-   */
-  predicate passesByReference(int i, VariableAccess va) {
-    variableAddressEscapesTree(va, this.getArgument(i).getFullyConverted())
-    or
-    variableAddressEscapesTree(va, this.getQualifier().getFullyConverted()) and
-    i = -1
-  }
-
-  /**
-   * Holds if this call passes the variable accessed by `va` by
-   * reference to non-const data as the `i`th argument. The qualifier of a
-   * call to a member function is `i = -1`.
-   *
-   * A variable is passed by reference if the `i`th parameter of the function
-   * receives an address that points within the object denoted by `va`. For a
-   * variable named `x`, passing by reference includes both explicit pointers
-   * (`&x`) and implicit conversion to a C++ reference (`x`), but it also
-   * includes deeper expressions such as `&x[0] + length` or `&*&*&x`.
-   *
-   * When `Field`s are involved, an argument `i` may pass more than one
-   * variable by reference simultaneously. For example, the call `f(&x.m1.m2)`
-   * counts as passing both `x`, `m1` and `m2` to argument 0 of `f`.
-   *
-   * This predicate only holds for variables passed by reference to non-const
-   * data and thus can be changed through that reference. See
-   * `passesByReference` for a predicate that also holds for variables passed
-   * by reference to const.
-   */
-  predicate passesByReferenceNonConst(int i, VariableAccess va) {
-    variableAddressEscapesTreeNonConst(va, this.getArgument(i).getFullyConverted())
-    or
-    variableAddressEscapesTreeNonConst(va, this.getQualifier().getFullyConverted()) and
-    i = -1
-  }
-}
-
-/**
- * A C/C++ function call where the name of the target function is known at compile-time.
- *
- * This includes various kinds of call:
- *  1. Calls such as `f(x)` where `f` is the name of a function.
- *  2. Calls such as `ptr->f()` where `f` is the name of a (possibly virtual) member function.
- *  3. Constructor calls for stack-allocated objects.
- *  4. Implicit and explicit calls to user-defined operators.
- *  5. Base class initializers in constructors.
- */
-class FunctionCall extends Call, @funbindexpr {
-  FunctionCall() { iscall(underlyingElement(this), _) }
-
-  override string getAPrimaryQlClass() { result = "FunctionCall" }
-
-  /** Gets an explicit template argument for this call. */
-  Locatable getAnExplicitTemplateArgument() { result = this.getExplicitTemplateArgument(_) }
-
-  /** Gets an explicit template argument value for this call. */
-  Locatable getAnExplicitTemplateArgumentKind() { result = this.getExplicitTemplateArgumentKind(_) }
-
-  /** Gets a template argument for this call. */
-  Locatable getATemplateArgument() { result = this.getTarget().getATemplateArgument() }
-
-  /** Gets a template argument value for this call. */
-  Locatable getATemplateArgumentKind() { result = this.getTarget().getATemplateArgumentKind() }
-
-  /** Gets the nth explicit template argument for this call. */
-  Locatable getExplicitTemplateArgument(int n) {
-    n < this.getNumberOfExplicitTemplateArguments() and
-    result = this.getTemplateArgument(n)
-  }
-
-  /** Gets the nth explicit template argument value for this call. */
-  Locatable getExplicitTemplateArgumentKind(int n) {
-    n < this.getNumberOfExplicitTemplateArguments() and
-    result = this.getTemplateArgumentKind(n)
-  }
-
-  /** Gets the number of explicit template arguments for this call. */
-  int getNumberOfExplicitTemplateArguments() {
-    if numtemplatearguments(underlyingElement(this), _)
-    then numtemplatearguments(underlyingElement(this), result)
-    else result = 0
-  }
-
-  /** Gets the number of template arguments for this call. */
-  int getNumberOfTemplateArguments() { result = count(int i | exists(this.getTemplateArgument(i))) }
-
-  /** Gets the nth template argument for this call (indexed from 0). */
-  Locatable getTemplateArgument(int n) { result = this.getTarget().getTemplateArgument(n) }
-
-  /** Gets the nth template argument value for this call (indexed from 0). */
-  Locatable getTemplateArgumentKind(int n) { result = this.getTarget().getTemplateArgumentKind(n) }
-
-  /** Holds if any template arguments for this call are implicit / deduced. */
-  predicate hasImplicitTemplateArguments() {
-    exists(int i |
-      exists(this.getTemplateArgument(i)) and
-      not exists(this.getExplicitTemplateArgument(i))
-    )
-  }
-
-  /** Holds if a template argument list was provided for this call. */
-  predicate hasTemplateArgumentList() { numtemplatearguments(underlyingElement(this), _) }
-
-  /**
-   * Gets the `RoutineType` of the call target as visible at the call site.  For
-   * constructor calls, this predicate instead gets the `Class` of the constructor
-   * being called.
-   */
-  Type getTargetType() { result = Call.super.getType().stripType() }
-
-  /**
-   * Gets the expected return type of the function called by this call.
-   *
-   * In most cases, the expected return type will be the return type of the function being called.
-   * It is only different when the function being called is ambiguously declared, at which point
-   * the expected return type is the return type of the (unambiguous) function declaration that was
-   * visible at the call site.
-   */
-  Type getExpectedReturnType() {
-    if this.getTargetType() instanceof RoutineType
-    then result = this.getTargetType().(RoutineType).getReturnType()
-    else result = this.getTarget().getType()
-  }
-
-  /**
-   * Gets the expected type of the nth parameter of the function called by this call.
-   *
-   * In most cases, the expected parameter types match the parameter types of the function being called.
-   * They are only different when the function being called is ambiguously declared, at which point
-   * the expected parameter types are the parameter types of the (unambiguous) function declaration that
-   * was visible at the call site.
-   */
-  Type getExpectedParameterType(int n) {
-    if this.getTargetType() instanceof RoutineType
-    then result = this.getTargetType().(RoutineType).getParameterType(n)
-    else result = this.getTarget().getParameter(n).getType()
-  }
-
-  /**
-   * Gets the function called by this call.
-   *
-   * In the case of virtual function calls, the result is the most-specific function in the override tree (as
-   * determined by the compiler) such that the target at runtime will be one of `result.getAnOverridingFunction*()`.
-   */
-  override Function getTarget() { funbind(underlyingElement(this), unresolveElement(result)) }
-
-  /**
-   * Gets the type of this expression, that is, the return type of the function being called.
-   */
-  override Type getType() { result = this.getExpectedReturnType() }
-
-  /**
-   * Holds if this is a call to a virtual function.
-   *
-   * Note that this holds even in cases where a sufficiently clever compiler could perform static dispatch.
-   */
-  predicate isVirtual() { iscall(underlyingElement(this), 1) }
-
-  /**
-   * Holds if the target of this function call was found by argument-dependent lookup and wouldn't have been
-   * found by any other means.
-   */
-  predicate isOnlyFoundByADL() { iscall(underlyingElement(this), 2) }
-
-  /** Gets a textual representation of this function call. */
-  override string toString() {
-    if exists(this.getTarget())
-    then result = "call to " + this.getTarget().getName()
-    else result = "call to unknown function"
-  }
-
-  override predicate mayBeImpure() {
-    this.getChild(_).mayBeImpure() or
-    this.getTarget().mayHaveSideEffects() or
-    this.isVirtual() or
-    this.getTarget().getAnAttribute().getName() = "weak"
-  }
-
-  override predicate mayBeGloballyImpure() {
-    this.getChild(_).mayBeGloballyImpure() or
-    this.getTarget().mayHaveSideEffects() or
-    this.isVirtual() or
-    this.getTarget().getAnAttribute().getName() = "weak"
-  }
-}
-
-/** A _user-defined_ unary `operator*` function. */
-class OverloadedPointerDereferenceFunction extends Function {
-  OverloadedPointerDereferenceFunction() {
-    this.hasName("operator*") and
-    this.getEffectiveNumberOfParameters() = 1
-  }
-}
-
-/**
- * An instance of a _user-defined_ unary `operator*` applied to its argument.
- * ```
- * T1 operator*(const T2 &);
- * T1 a; T2 b;
- * a = *b;
- * ```
- */
-class OverloadedPointerDereferenceExpr extends FunctionCall {
-  OverloadedPointerDereferenceExpr() {
-    this.getTarget() instanceof OverloadedPointerDereferenceFunction
-  }
-
-  override string getAPrimaryQlClass() { result = "OverloadedPointerDereferenceExpr" }
-
-  /**
-   * Gets the expression this operator * applies to.
-   */
-  Expr getExpr() {
-    result = this.getChild(0) or
-    result = this.getQualifier()
-  }
-
-  override predicate mayBeImpure() {
-    FunctionCall.super.mayBeImpure() and
-    (
-      this.getExpr().mayBeImpure()
-      or
-      not exists(Class declaring |
-        this.getTarget().getDeclaringType().isConstructedFrom*(declaring)
-      |
-        declaring.getNamespace() instanceof StdNamespace
-      )
-    )
-  }
-
-  override predicate mayBeGloballyImpure() {
-    FunctionCall.super.mayBeGloballyImpure() and
-    (
-      this.getExpr().mayBeGloballyImpure()
-      or
-      not exists(Class declaring |
-        this.getTarget().getDeclaringType().isConstructedFrom*(declaring)
-      |
-        declaring.getNamespace() instanceof StdNamespace
-      )
-    )
-  }
-}
-
-/**
- * An instance of a _user-defined_ binary `operator[]` applied to its arguments.
- * ```
- * struct T2 { T1 operator[](const T3 &); };
- * T1 a; T2 b; T3 c;
- * a = b[c];
- * ```
- */
-class OverloadedArrayExpr extends FunctionCall {
-  OverloadedArrayExpr() { this.getTarget().hasName("operator[]") }
-
-  override string getAPrimaryQlClass() { result = "OverloadedArrayExpr" }
-
-  /**
-   * Gets the expression being subscripted.
-   */
-  Expr getArrayBase() {
-    if exists(this.getQualifier()) then result = this.getQualifier() else result = this.getChild(0)
-  }
-
-  /**
-   * Gets the expression giving the index.
-   */
-  Expr getArrayOffset() {
-    if exists(this.getQualifier()) then result = this.getChild(0) else result = this.getChild(1)
-  }
-}
-
-/**
- * A C/C++ call which is performed through a function pointer.
- *
- * In the call below, `(*funcptr)` may be simplified to just `funcptr`.
- * ```
- * extern int (*funcptr)(int a, int b);
- * int c = (*funcptr)(1, 2);
- * ```
- */
-class ExprCall extends Call, @callexpr {
-  /**
-   * Gets the expression which yields the function pointer to call.
-   */
-  Expr getExpr() { result = this.getChild(0) }
-
-  override string getAPrimaryQlClass() { result = "ExprCall" }
-
-  override Expr getAnArgument() { exists(int i | result = this.getChild(i) and i >= 1) }
-
-  override Expr getArgument(int index) {
-    result = this.getChild(index + 1) and index in [0 .. this.getNumChild() - 2]
-  }
-
-  override string toString() { result = "call to expression" }
-
-  override Function getTarget() { none() }
-}
-
-/**
- * A C/C++ call which is performed through a variable of function pointer type.
- * ```
- * int call_via_ptr(int (*pfn)(int)) {
- *   return pfn(5);
- * }
- * ```
- */
-class VariableCall extends ExprCall {
-  VariableCall() { this.getExpr() instanceof VariableAccess }
-
-  override string getAPrimaryQlClass() { result = "VariableCall" }
-
-  /**
-   * Gets the variable which yields the function pointer to call.
-   */
-  Variable getVariable() { this.getExpr().(VariableAccess).getTarget() = result }
-}
-
-/**
- * A call to a constructor.
- * ```
- * struct S { S(void) {} };
- * S s;
- * ```
- */
-class ConstructorCall extends FunctionCall {
-  ConstructorCall() { super.getTarget() instanceof Constructor }
-
-  override string getAPrimaryQlClass() { result = "ConstructorCall" }
-
-  /** Gets the constructor being called. */
-  override Constructor getTarget() { result = super.getTarget() }
-}
-
-/**
- * A call to a destructor.
- * ```
- * struct S { ~S(void) {} } *s;
- * s->~S();
- * ```
- */
-class DestructorCall extends FunctionCall {
-  DestructorCall() { super.getTarget() instanceof Destructor }
-
-  override string getAPrimaryQlClass() { result = "DestructorCall" }
-
-  /** Gets the destructor being called. */
-  override Destructor getTarget() { result = super.getTarget() }
-}
-
-/**
- * An expression that looks like a destructor call, but has no effect.
- *
- * For example, given a plain old data type `pod_t`, the syntax `ptr->~pod_t()` is
- * a vacuous destructor call, as `~pod_t` isn't actually a function. This can also
- * occur in instantiated templates, as `ptr->~T()` becomes vacuous when `T` is `int`.
- * ```
- * typedef int pod_t;
- * pod_t *s;
- * s->~pod_t();
- * ```
- */
-class VacuousDestructorCall extends Expr, @vacuous_destructor_call {
-  /**
-   * Gets the expression for the object whose destructor would be called.
-   */
-  Expr getQualifier() { result = this.getChild(0) }
-
-  override string getAPrimaryQlClass() { result = "VacuousDestructorCall" }
-
-  override string toString() { result = "(vacuous destructor call)" }
-}
-
-/**
- * An initialization of a base class or member variable performed as part
- * of a constructor's explicit initializer list or implicit actions.
- *
- * This is a QL root class for reprenting various types of constructor
- * initializations.
- */
-class ConstructorInit extends Expr, @ctorinit {
-  override string getAPrimaryQlClass() { result = "ConstructorInit" }
-}
-
-/**
- * A call to a constructor of a base class as part of a constructor's
- * initializer list or compiler-generated actions.
- */
-class ConstructorBaseInit extends ConstructorInit, ConstructorCall {
-  override string getAPrimaryQlClass() { result = "ConstructorBaseInit" }
-}
-
-/**
- * A call to a constructor of a direct non-virtual base class as part of a
- * constructor's initializer list or compiler-generated actions.
- * ```
- * struct S {
- *   int a;
- *   S(int b): a(b) {}
- * };
- * struct T: S {
- *   T(): S(33) {}  // S(33) is a constructor call
- * };
- * ```
- */
-class ConstructorDirectInit extends ConstructorBaseInit, @ctordirectinit {
-  override string getAPrimaryQlClass() { result = "ConstructorDirectInit" }
-}
-
-/**
- * A call to a constructor of a virtual base class as part of a
- * constructor's initializer list or compiler-generated actions.
- *
- * If the virtual base class has already been initialized, then this
- * call won't be performed.
- * ```
- * struct S {
- *   int a;
- *   S(int b): a(b) {}
- * };
- * struct T: virtual S {
- *   T(): S(33) {}  // S(33) is a call to a virtual base constructor
- * };
- * ```
- */
-class ConstructorVirtualInit extends ConstructorBaseInit, @ctorvirtualinit {
-  override string getAPrimaryQlClass() { result = "ConstructorVirtualInit" }
-}
-
-/**
- * A call to a constructor of the same class as part of a constructor's
- * initializer list, which delegates object construction (C++11 only).
- * ```
- * struct S {
- *  int a;
- *  S(int b): a(b) { }
- *  S(): S(0) { } // delegation to another constructor
- * };
- * ```
- */
-class ConstructorDelegationInit extends ConstructorBaseInit, @ctordelegatinginit {
-  override string getAPrimaryQlClass() { result = "ConstructorDelegationInit" }
-}
-
-/**
- * An initialization of a member variable performed as part of a
- * constructor's explicit initializer list or implicit actions.
- * In the example below, member variable `b` is being initialized by
- * constructor parameter `a`:
- * ```
- * struct S {
- *   int b;
- *   S(int a): b(a) {}
- * } s(2);
- * ```
- */
-class ConstructorFieldInit extends ConstructorInit, @ctorfieldinit {
-  /** Gets the field being initialized. */
-  Field getTarget() { varbind(underlyingElement(this), unresolveElement(result)) }
-
-  override string getAPrimaryQlClass() { result = "ConstructorFieldInit" }
-
-  /**
-   * Gets the expression to which the field is initialized.
-   *
-   * This is typically either a Literal or a FunctionCall to a
-   * constructor, but more complex expressions can also occur.
-   */
-  Expr getExpr() { result = this.getChild(0) }
-
-  override string toString() { result = "constructor init of field " + this.getTarget().getName() }
-
-  override predicate mayBeImpure() { this.getExpr().mayBeImpure() }
-
-  override predicate mayBeGloballyImpure() { this.getExpr().mayBeGloballyImpure() }
-}
-
-/**
- * A call to a destructor of a base class or field as part of a destructor's
- * compiler-generated actions.
- */
-class DestructorDestruction extends Expr, @dtordestruct {
-  override string getAPrimaryQlClass() { result = "DestructorDestruction" }
-}
-
-/**
- * A call to a destructor of a base class as part of a destructor's
- * compiler-generated actions.
- */
-class DestructorBaseDestruction extends DestructorCall, DestructorDestruction {
-  override string getAPrimaryQlClass() { result = "DestructorBaseDestruction" }
-}
-
-/**
- * A call to a destructor of a direct non-virtual base class as part of a
- * destructor's compiler-generated actions.
- * ```
- * struct S {  ~S(void) {} };
- * struct T: S {
- *   ~T(void) {} // will call ~S()
- * };
- * ```
- */
-class DestructorDirectDestruction extends DestructorBaseDestruction, @dtordirectdestruct {
-  override string getAPrimaryQlClass() { result = "DestructorDirectDestruction" }
-}
-
-/**
- * A call to a destructor of a direct virtual base class as part of a
- * destructor's compiler-generated actions.
- *
- * If the virtual base class wasn't initialized by the ConstructorVirtualInit
- * in the corresponding constructor, then this call won't be performed.
- * ```
- * struct S {  ~S(void) {} };
- * struct T: virtual S {
- *   ~T(void) {} // will call ~S()
- * };
- * ```
- */
-class DestructorVirtualDestruction extends DestructorBaseDestruction, @dtorvirtualdestruct {
-  override string getAPrimaryQlClass() { result = "DestructorVirtualDestruction" }
-}
-
-/**
- * A destruction of a member variable performed as part of a
- * destructor's compiler-generated actions.
- * ```
- * struct S {  ~S(void) {} };
- * struct T {
- *   S s;
- *   ~T(void) {}  // will call s.~S()
- * };
- * ```
- */
-class DestructorFieldDestruction extends DestructorDestruction, @dtorfielddestruct {
-  /** Gets the field being destructed. */
-  Field getTarget() { varbind(underlyingElement(this), unresolveElement(result)) }
-
-  override string getAPrimaryQlClass() { result = "DestructorFieldDestruction" }
-
-  /** Gets the compiler-generated call to the variable's destructor. */
-  DestructorCall getExpr() { result = this.getChild(0) }
-
-  override string toString() {
-    result = "destructor field destruction of " + this.getTarget().getName()
-  }
-}

cpp/ql/lib/semmle/code/cpp/exprs/Literal.qll

@@ -1,346 +0,0 @@
-/**
- * Provides classes for modeling literals in the source code such as `0`, `'c'`
- * or `"string"`.
- */
-
-import semmle.code.cpp.exprs.Expr
-
-/**
- * A C/C++ literal.
- *
- * The is the QL root class for all literals.
- */
-class Literal extends Expr, @literal {
-  /** Gets a textual representation of this literal. */
-  override string toString() {
-    result = this.getValue()
-    or
-    not exists(this.getValue()) and
-    result = "Unknown literal"
-  }
-
-  override string getAPrimaryQlClass() { result = "Literal" }
-
-  override predicate mayBeImpure() { none() }
-
-  override predicate mayBeGloballyImpure() { none() }
-}
-
-/**
- * A label literal, that is, a use of the '&&' operator to take the address of a
- * label for use in a computed goto statement.  This is a non-standard C/C++ extension.
- *
- * For example:
- * ```
- * void *label_ptr = &&myLabel; // &&myLabel is a LabelLiteral
- * goto *label_ptr; // this is a ComputedGotoStmt
- * myLabel: // this is a LabelStmt
- * ```
- */
-class LabelLiteral extends Literal {
-  LabelLiteral() { jumpinfo(underlyingElement(this), _, _) }
-
-  override string getAPrimaryQlClass() { result = "LabelLiteral" }
-
-  /** Gets the corresponding label statement. */
-  LabelStmt getLabel() { jumpinfo(underlyingElement(this), _, unresolveElement(result)) }
-}
-
-/** A character literal or a string literal. */
-class TextLiteral extends Literal {
-  TextLiteral() {
-    // String Literal
-    // Note that `AggregateLiteral`s can also have an array type, but they derive from
-    // @aggregateliteral rather than @literal.
-    this.getType() instanceof ArrayType
-    or
-    // Char literal
-    this.getValueText().regexpMatch("(?s)\\s*L?'.*")
-  }
-
-  /** Gets a hex escape sequence that appears in the character or string literal (see [lex.ccon] in the C++ Standard). */
-  string getAHexEscapeSequence(int occurrence, int offset) {
-    result = this.getValueText().regexpFind("(?<!\\\\)\\\\x[0-9a-fA-F]+", occurrence, offset)
-  }
-
-  /** Gets an octal escape sequence that appears in the character or string literal (see [lex.ccon] in the C++ Standard). */
-  string getAnOctalEscapeSequence(int occurrence, int offset) {
-    result = this.getValueText().regexpFind("(?<!\\\\)\\\\[0-7]{1,3}", occurrence, offset)
-  }
-
-  /**
-   * Gets a non-standard escape sequence that appears in the character or string literal. This is one that has the
-   * form of an escape sequence but is not one of the valid types of escape sequence in the C++ Standard.
-   */
-  string getANonStandardEscapeSequence(int occurrence, int offset) {
-    // Find all single character escape sequences (ignoring the start of octal escape sequences),
-    // together with anything starting like a hex escape sequence but not followed by a hex digit.
-    result = this.getValueText().regexpFind("\\\\[^x0-7\\s]|\\\\x[^0-9a-fA-F]", occurrence, offset) and
-    // From these, exclude all standard escape sequences.
-    not result = this.getAStandardEscapeSequence(_, _)
-  }
-
-  /** Gets a simple escape sequence that appears in the char or string literal (see [lex.ccon] in the C++ Standard). */
-  string getASimpleEscapeSequence(int occurrence, int offset) {
-    result = this.getValueText().regexpFind("\\\\['\"?\\\\abfnrtv]", occurrence, offset)
-  }
-
-  /** Gets a standard escape sequence that appears in the char or string literal (see [lex.ccon] in the C++ Standard). */
-  string getAStandardEscapeSequence(int occurrence, int offset) {
-    result = this.getASimpleEscapeSequence(occurrence, offset) or
-    result = this.getAnOctalEscapeSequence(occurrence, offset) or
-    result = this.getAHexEscapeSequence(occurrence, offset)
-  }
-
-  /**
-   * Gets the length of the string literal (including null) before escape sequences added by the extractor.
-   */
-  int getOriginalLength() { result = this.getValue().length() + 1 }
-}
-
-/**
- * A character literal.  For example:
- * ```
- * char c1 = 'a';
- * wchar_t c2 = L'b';
- * ```
- */
-class CharLiteral extends TextLiteral {
-  CharLiteral() { this.getValueText().regexpMatch("(?s)\\s*L?'.*") }
-
-  override string getAPrimaryQlClass() { result = "CharLiteral" }
-
-  /**
-   * Gets the character of this literal. For example `L'a'` has character `"a"`.
-   */
-  string getCharacter() { result = this.getValueText().regexpCapture("(?s)\\s*L?'(.*)'", 1) }
-}
-
-/**
- * A string literal. For example:
- * ```
- * const char *s1 = "abcdef";
- * const wchar_t *s2 = L"123456";
- * ```
- */
-class StringLiteral extends TextLiteral {
-  StringLiteral() {
-    this.getType() instanceof ArrayType
-    // Note that `AggregateLiteral`s can also have an array type, but they derive from
-    // @aggregateliteral rather than @literal.
-  }
-
-  override string getAPrimaryQlClass() { result = "StringLiteral" }
-}
-
-/**
- * An octal literal. For example:
- * ```
- * char esc = 033;
- * ```
- * Octal literals must always start with the digit `0`.
- */
-class OctalLiteral extends Literal {
-  OctalLiteral() { super.getValueText().regexpMatch("\\s*0[0-7]+[uUlL]*\\s*") }
-
-  override string getAPrimaryQlClass() { result = "OctalLiteral" }
-}
-
-/**
- * A hexadecimal literal.
- * ```
- * unsigned int32_t minus2 = 0xfffffffe;
- * ```
- */
-class HexLiteral extends Literal {
-  HexLiteral() { super.getValueText().regexpMatch("\\s*0[xX][0-9a-fA-F]+[uUlL]*\\s*") }
-
-  override string getAPrimaryQlClass() { result = "HexLiteral" }
-}
-
-/**
- * A C/C++ aggregate literal.
- */
-class AggregateLiteral extends Expr, @aggregateliteral {
-  override string getAPrimaryQlClass() { result = "AggregateLiteral" }
-
-  /**
-   * DEPRECATED: Use ClassAggregateLiteral.getFieldExpr() instead.
-   *
-   * Gets the expression within the aggregate literal that is used to initialise field `f`,
-   * if this literal is being used to initialise a class/struct instance.
-   */
-  deprecated Expr getCorrespondingExpr(Field f) {
-    result = this.(ClassAggregateLiteral).getFieldExpr(f)
-  }
-
-  override predicate mayBeImpure() { this.getAChild().mayBeImpure() }
-
-  override predicate mayBeGloballyImpure() { this.getAChild().mayBeGloballyImpure() }
-
-  /** Gets a textual representation of this aggregate literal. */
-  override string toString() { result = "{...}" }
-}
-
-/**
- * A C/C++ aggregate literal that initializes a `class`, `struct`, or `union`.
- * For example:
- * ```
- * S s = { arg1, arg2, { arg3, arg4 }, arg5 };
- * ```
- */
-class ClassAggregateLiteral extends AggregateLiteral {
-  Class classType;
-
-  ClassAggregateLiteral() { classType = this.getUnspecifiedType() }
-
-  override string getAPrimaryQlClass() { result = "ClassAggregateLiteral" }
-
-  /**
-   * Gets the expression within the aggregate literal that is used to initialize
-   * field `field`, if present.
-   */
-  Expr getFieldExpr(Field field) {
-    field = classType.getAField() and
-    aggregate_field_init(underlyingElement(this), unresolveElement(result), unresolveElement(field))
-  }
-
-  /**
-   * Holds if the field `field` is initialized by this initializer list, either
-   * explicitly with an expression, or implicitly value initialized.
-   */
-  pragma[inline]
-  predicate isInitialized(Field field) {
-    field = classType.getAField() and
-    field.isInitializable() and
-    (
-      // If the field has an explicit initializer expression, then the field is
-      // initialized.
-      exists(this.getFieldExpr(field))
-      or
-      // If the type is not a union, all fields without initializers are value
-      // initialized.
-      not classType instanceof Union
-      or
-      // If the type is a union, and there are no explicit initializers, then
-      // the first declared field is value initialized.
-      not exists(this.getAChild()) and
-      field.getInitializationOrder() = 0
-    )
-  }
-
-  /**
-   * Holds if the field `field` is value initialized because it is not
-   * explicitly initialized by this initializer list.
-   *
-   * Value initialization (see [dcl.init]/8) recursively initializes all fields
-   * of an object to `false`, `0`, `nullptr`, or by calling the default
-   * constructor, as appropriate to the type.
-   */
-  pragma[inline]
-  predicate isValueInitialized(Field field) {
-    this.isInitialized(field) and
-    not exists(this.getFieldExpr(field))
-  }
-}
-
-/**
- * A C/C++ aggregate literal that initializes an array or a GNU vector type.
- */
-class ArrayOrVectorAggregateLiteral extends AggregateLiteral {
-  ArrayOrVectorAggregateLiteral() {
-    exists(DerivedType type |
-      type = this.getUnspecifiedType() and
-      (
-        type instanceof ArrayType or
-        type instanceof GNUVectorType
-      )
-    )
-  }
-
-  /**
-   * Gets the number of elements initialized by this initializer list, either explicitly with an
-   * expression, or by implicit value initialization.
-   */
-  int getArraySize() { none() }
-
-  /**
-   * Gets the type of the elements in the initializer list.
-   */
-  Type getElementType() { none() }
-
-  /**
-   * Gets the expression within the aggregate literal that is used to initialize
-   * element `elementIndex`, if present.
-   */
-  Expr getElementExpr(int elementIndex) {
-    aggregate_array_init(underlyingElement(this), unresolveElement(result), elementIndex)
-  }
-
-  /**
-   * Holds if the element `elementIndex` is initialized by this initializer
-   * list, either explicitly with an expression, or implicitly value
-   * initialized.
-   */
-  bindingset[elementIndex]
-  predicate isInitialized(int elementIndex) {
-    elementIndex >= 0 and
-    elementIndex < this.getArraySize()
-  }
-
-  /**
-   * Holds if the element `elementIndex` is value initialized because it is not
-   * explicitly initialized by this initializer list.
-   *
-   * Value initialization (see [dcl.init]/8) recursively initializes all fields
-   * of an object to `false`, `0`, `nullptr`, or by calling the default
-   * constructor, as appropriate to the type.
-   */
-  bindingset[elementIndex]
-  predicate isValueInitialized(int elementIndex) {
-    this.isInitialized(elementIndex) and
-    not exists(this.getElementExpr(elementIndex))
-  }
-}
-
-/**
- * A C/C++ aggregate literal that initializes an array
- * ```
- * S s[4] = { s_1, s_2, s_3, s_n };
- * ```
- */
-class ArrayAggregateLiteral extends ArrayOrVectorAggregateLiteral {
-  ArrayType arrayType;
-
-  ArrayAggregateLiteral() { arrayType = this.getUnspecifiedType() }
-
-  override string getAPrimaryQlClass() { result = "ArrayAggregateLiteral" }
-
-  override int getArraySize() { result = arrayType.getArraySize() }
-
-  override Type getElementType() { result = arrayType.getBaseType() }
-}
-
-/**
- * A C/C++ aggregate literal that initializes a GNU vector type.
- *
- * Braced initializer lists are used, similarly to what is done
- * for arrays.
- * ```
- * typedef int v4si __attribute__ (( vector_size(4*sizeof(int)) ));
- * v4si v = (v4si){ 1, 2, 3, 4 };
- * typedef float float4 __attribute__((ext_vector_type(4)));
- * float4 vf = {1.0f, 2.0f, 3.0f, 4.0f};
- * ```
- */
-class VectorAggregateLiteral extends ArrayOrVectorAggregateLiteral {
-  GNUVectorType vectorType;
-
-  VectorAggregateLiteral() { vectorType = this.getUnspecifiedType() }
-
-  override string getAPrimaryQlClass() { result = "VectorAggregateLiteral" }
-
-  override int getArraySize() { result = vectorType.getNumElements() }
-
-  override Type getElementType() { result = vectorType.getBaseType() }
-}

cpp/ql/lib/semmle/code/cpp/ir/dataflow/ResolveCall.qll

@@ -1,23 +0,0 @@
-/**
- * Provides a predicate for non-contextual virtual dispatch and function
- * pointer resolution.
- */
-
-import cpp
-private import semmle.code.cpp.ir.ValueNumbering
-private import internal.DataFlowDispatch
-private import semmle.code.cpp.ir.IR
-
-/**
- * Resolve potential target function(s) for `call`.
- *
- * If `call` is a call through a function pointer (`ExprCall`) or its target is
- * a virtual member function, simple data flow analysis is performed in order
- * to identify the possible target(s).
- */
-Function resolveCall(Call call) {
-  exists(CallInstruction callInstruction |
-    callInstruction.getAST() = call and
-    result = viableCallable(callInstruction)
-  )
-}

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowDispatch.qll

@@ -1,268 +0,0 @@
-private import cpp
-private import semmle.code.cpp.ir.IR
-private import semmle.code.cpp.ir.dataflow.DataFlow
-private import semmle.code.cpp.ir.dataflow.internal.DataFlowPrivate
-private import DataFlowImplCommon as DataFlowImplCommon
-
-/**
- * Gets a function that might be called by `call`.
- */
-cached
-Function viableCallable(CallInstruction call) {
-  DataFlowImplCommon::forceCachingInSameStage() and
-  result = call.getStaticCallTarget()
-  or
-  // If the target of the call does not have a body in the snapshot, it might
-  // be because the target is just a header declaration, and the real target
-  // will be determined at run time when the caller and callee are linked
-  // together by the operating system's dynamic linker. In case a _unique_
-  // function with the right signature is present in the database, we return
-  // that as a potential callee.
-  exists(string qualifiedName, int nparams |
-    callSignatureWithoutBody(qualifiedName, nparams, call) and
-    functionSignatureWithBody(qualifiedName, nparams, result) and
-    strictcount(Function other | functionSignatureWithBody(qualifiedName, nparams, other)) = 1
-  )
-  or
-  // Virtual dispatch
-  result = call.(VirtualDispatch::DataSensitiveCall).resolve()
-}
-
-/**
- * Provides virtual dispatch support compatible with the original
- * implementation of `semmle.code.cpp.security.TaintTracking`.
- */
-private module VirtualDispatch {
-  /** A call that may dispatch differently depending on the qualifier value. */
-  abstract class DataSensitiveCall extends DataFlowCall {
-    /**
-     * Gets the node whose value determines the target of this call. This node
-     * could be the qualifier of a virtual dispatch or the function-pointer
-     * expression in a call to a function pointer. What they have in common is
-     * that we need to find out which data flows there, and then it's up to the
-     * `resolve` predicate to stitch that information together and resolve the
-     * call.
-     */
-    abstract DataFlow::Node getDispatchValue();
-
-    /** Gets a candidate target for this call. */
-    abstract Function resolve();
-
-    /**
-     * Whether `src` can flow to this call.
-     *
-     * Searches backwards from `getDispatchValue()` to `src`. The `allowFromArg`
-     * parameter is true when the search is allowed to continue backwards into
-     * a parameter; non-recursive callers should pass `_` for `allowFromArg`.
-     */
-    predicate flowsFrom(DataFlow::Node src, boolean allowFromArg) {
-      src = this.getDispatchValue() and allowFromArg = true
-      or
-      exists(DataFlow::Node other, boolean allowOtherFromArg |
-        this.flowsFrom(other, allowOtherFromArg)
-      |
-        // Call argument
-        exists(DataFlowCall call, int i |
-          other
-              .(DataFlow::ParameterNode)
-              .isParameterOf(pragma[only_bind_into](call).getStaticCallTarget(), i) and
-          src.(ArgumentNode).argumentOf(call, pragma[only_bind_into](pragma[only_bind_out](i)))
-        ) and
-        allowOtherFromArg = true and
-        allowFromArg = true
-        or
-        // Call return
-        exists(DataFlowCall call, ReturnKind returnKind |
-          other = getAnOutNode(call, returnKind) and
-          returnNodeWithKindAndEnclosingCallable(src, returnKind, call.getStaticCallTarget())
-        ) and
-        allowFromArg = false
-        or
-        // Local flow
-        DataFlow::localFlowStep(src, other) and
-        allowFromArg = allowOtherFromArg
-        or
-        // Flow from global variable to load.
-        exists(LoadInstruction load, GlobalOrNamespaceVariable var |
-          var = src.asVariable() and
-          other.asInstruction() = load and
-          addressOfGlobal(load.getSourceAddress(), var) and
-          // The `allowFromArg` concept doesn't play a role when `src` is a
-          // global variable, so we just set it to a single arbitrary value for
-          // performance.
-          allowFromArg = true
-        )
-        or
-        // Flow from store to global variable.
-        exists(StoreInstruction store, GlobalOrNamespaceVariable var |
-          var = other.asVariable() and
-          store = src.asInstruction() and
-          storeIntoGlobal(store, var) and
-          // Setting `allowFromArg` to `true` like in the base case means we
-          // treat a store to a global variable like the dispatch itself: flow
-          // may come from anywhere.
-          allowFromArg = true
-        )
-      )
-    }
-  }
-
-  pragma[noinline]
-  private predicate storeIntoGlobal(StoreInstruction store, GlobalOrNamespaceVariable var) {
-    addressOfGlobal(store.getDestinationAddress(), var)
-  }
-
-  /** Holds if `addressInstr` is an instruction that produces the address of `var`. */
-  private predicate addressOfGlobal(Instruction addressInstr, GlobalOrNamespaceVariable var) {
-    // Access directly to the global variable
-    addressInstr.(VariableAddressInstruction).getASTVariable() = var
-    or
-    // Access to a field on a global union
-    exists(FieldAddressInstruction fa |
-      fa = addressInstr and
-      fa.getObjectAddress().(VariableAddressInstruction).getASTVariable() = var and
-      fa.getField().getDeclaringType() instanceof Union
-    )
-  }
-
-  /**
-   * A ReturnNode with its ReturnKind and its enclosing callable.
-   *
-   * Used to fix a join ordering issue in flowsFrom.
-   */
-  pragma[noinline]
-  private predicate returnNodeWithKindAndEnclosingCallable(
-    ReturnNode node, ReturnKind kind, DataFlowCallable callable
-  ) {
-    node.getKind() = kind and
-    node.getEnclosingCallable() = callable
-  }
-
-  /** Call through a function pointer. */
-  private class DataSensitiveExprCall extends DataSensitiveCall {
-    DataSensitiveExprCall() { not exists(this.getStaticCallTarget()) }
-
-    override DataFlow::Node getDispatchValue() { result.asInstruction() = this.getCallTarget() }
-
-    override Function resolve() {
-      exists(FunctionInstruction fi |
-        this.flowsFrom(DataFlow::instructionNode(fi), _) and
-        result = fi.getFunctionSymbol()
-      ) and
-      (
-        this.getNumberOfArguments() <= result.getEffectiveNumberOfParameters() and
-        this.getNumberOfArguments() >= result.getEffectiveNumberOfParameters()
-        or
-        result.isVarargs()
-      )
-    }
-  }
-
-  /** Call to a virtual function. */
-  private class DataSensitiveOverriddenFunctionCall extends DataSensitiveCall {
-    DataSensitiveOverriddenFunctionCall() {
-      exists(this.getStaticCallTarget().(VirtualFunction).getAnOverridingFunction())
-    }
-
-    override DataFlow::Node getDispatchValue() { result.asInstruction() = this.getThisArgument() }
-
-    override MemberFunction resolve() {
-      exists(Class overridingClass |
-        this.overrideMayAffectCall(overridingClass, result) and
-        this.hasFlowFromCastFrom(overridingClass)
-      )
-    }
-
-    /**
-     * Holds if `this` is a virtual function call whose static target is
-     * overridden by `overridingFunction` in `overridingClass`.
-     */
-    pragma[noinline]
-    private predicate overrideMayAffectCall(Class overridingClass, MemberFunction overridingFunction) {
-      overridingFunction.getAnOverriddenFunction+() = this.getStaticCallTarget().(VirtualFunction) and
-      overridingFunction.getDeclaringType() = overridingClass
-    }
-
-    /**
-     * Holds if the qualifier of `this` has flow from an upcast from
-     * `derivedClass`.
-     */
-    pragma[noinline]
-    private predicate hasFlowFromCastFrom(Class derivedClass) {
-      exists(ConvertToBaseInstruction toBase |
-        this.flowsFrom(DataFlow::instructionNode(toBase), _) and
-        derivedClass = toBase.getDerivedClass()
-      )
-    }
-  }
-}
-
-/**
- * Holds if `f` is a function with a body that has name `qualifiedName` and
- * `nparams` parameter count. See `functionSignature`.
- */
-private predicate functionSignatureWithBody(string qualifiedName, int nparams, Function f) {
-  functionSignature(f, qualifiedName, nparams) and
-  exists(f.getBlock())
-}
-
-/**
- * Holds if the target of `call` is a function _with no definition_ that has
- * name `qualifiedName` and `nparams` parameter count. See `functionSignature`.
- */
-pragma[noinline]
-private predicate callSignatureWithoutBody(string qualifiedName, int nparams, CallInstruction call) {
-  exists(Function target |
-    target = call.getStaticCallTarget() and
-    not exists(target.getBlock()) and
-    functionSignature(target, qualifiedName, nparams)
-  )
-}
-
-/**
- * Holds if `f` has name `qualifiedName` and `nparams` parameter count. This is
- * an approximation of its signature for the purpose of matching functions that
- * might be the same across link targets.
- */
-private predicate functionSignature(Function f, string qualifiedName, int nparams) {
-  qualifiedName = f.getQualifiedName() and
-  nparams = f.getNumberOfParameters() and
-  not f.isStatic()
-}
-
-/**
- * Holds if the set of viable implementations that can be called by `call`
- * might be improved by knowing the call context.
- */
-predicate mayBenefitFromCallContext(CallInstruction call, Function f) {
-  mayBenefitFromCallContext(call, f, _)
-}
-
-/**
- * Holds if `call` is a call through a function pointer, and the pointer
- * value is given as the `arg`'th argument to `f`.
- */
-private predicate mayBenefitFromCallContext(
-  VirtualDispatch::DataSensitiveCall call, Function f, int arg
-) {
-  f = pragma[only_bind_out](call).getEnclosingCallable() and
-  exists(InitializeParameterInstruction init |
-    not exists(call.getStaticCallTarget()) and
-    init.getEnclosingFunction() = f and
-    call.flowsFrom(DataFlow::instructionNode(init), _) and
-    init.getParameter().getIndex() = arg
-  )
-}
-
-/**
- * Gets a viable dispatch target of `call` in the context `ctx`. This is
- * restricted to those `call`s for which a context might make a difference.
- */
-Function viableImplInCallContext(CallInstruction call, CallInstruction ctx) {
-  result = viableCallable(call) and
-  exists(int i, Function f |
-    mayBenefitFromCallContext(pragma[only_bind_into](call), f, i) and
-    f = ctx.getStaticCallTarget() and
-    result = ctx.getArgument(i).getUnconvertedResultExpression().(FunctionAccess).getTarget()
-  )
-}

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplConsistency.qll

@@ -1,196 +0,0 @@
-/**
- * Provides consistency queries for checking invariants in the language-specific
- * data-flow classes and predicates.
- */
-
-private import DataFlowImplSpecific::Private
-private import DataFlowImplSpecific::Public
-private import tainttracking1.TaintTrackingParameter::Private
-private import tainttracking1.TaintTrackingParameter::Public
-
-module Consistency {
-  private newtype TConsistencyConfiguration = MkConsistencyConfiguration()
-
-  /** A class for configuring the consistency queries. */
-  class ConsistencyConfiguration extends TConsistencyConfiguration {
-    string toString() { none() }
-
-    /** Holds if `n` should be excluded from the consistency test `postWithInFlow`. */
-    predicate postWithInFlowExclude(Node n) { none() }
-
-    /** Holds if `n` should be excluded from the consistency test `argHasPostUpdate`. */
-    predicate argHasPostUpdateExclude(ArgumentNode n) { none() }
-  }
-
-  private class RelevantNode extends Node {
-    RelevantNode() {
-      this instanceof ArgumentNode or
-      this instanceof ParameterNode or
-      this instanceof ReturnNode or
-      this = getAnOutNode(_, _) or
-      simpleLocalFlowStep(this, _) or
-      simpleLocalFlowStep(_, this) or
-      jumpStep(this, _) or
-      jumpStep(_, this) or
-      storeStep(this, _, _) or
-      storeStep(_, _, this) or
-      readStep(this, _, _) or
-      readStep(_, _, this) or
-      defaultAdditionalTaintStep(this, _) or
-      defaultAdditionalTaintStep(_, this)
-    }
-  }
-
-  query predicate uniqueEnclosingCallable(Node n, string msg) {
-    exists(int c |
-      n instanceof RelevantNode and
-      c = count(nodeGetEnclosingCallable(n)) and
-      c != 1 and
-      msg = "Node should have one enclosing callable but has " + c + "."
-    )
-  }
-
-  query predicate uniqueType(Node n, string msg) {
-    exists(int c |
-      n instanceof RelevantNode and
-      c = count(getNodeType(n)) and
-      c != 1 and
-      msg = "Node should have one type but has " + c + "."
-    )
-  }
-
-  query predicate uniqueNodeLocation(Node n, string msg) {
-    exists(int c |
-      c =
-        count(string filepath, int startline, int startcolumn, int endline, int endcolumn |
-          n.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
-        ) and
-      c != 1 and
-      msg = "Node should have one location but has " + c + "."
-    )
-  }
-
-  query predicate missingLocation(string msg) {
-    exists(int c |
-      c =
-        strictcount(Node n |
-          not exists(string filepath, int startline, int startcolumn, int endline, int endcolumn |
-            n.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
-          )
-        ) and
-      msg = "Nodes without location: " + c
-    )
-  }
-
-  query predicate uniqueNodeToString(Node n, string msg) {
-    exists(int c |
-      c = count(n.toString()) and
-      c != 1 and
-      msg = "Node should have one toString but has " + c + "."
-    )
-  }
-
-  query predicate missingToString(string msg) {
-    exists(int c |
-      c = strictcount(Node n | not exists(n.toString())) and
-      msg = "Nodes without toString: " + c
-    )
-  }
-
-  query predicate parameterCallable(ParameterNode p, string msg) {
-    exists(DataFlowCallable c | isParameterNode(p, c, _) and c != nodeGetEnclosingCallable(p)) and
-    msg = "Callable mismatch for parameter."
-  }
-
-  query predicate localFlowIsLocal(Node n1, Node n2, string msg) {
-    simpleLocalFlowStep(n1, n2) and
-    nodeGetEnclosingCallable(n1) != nodeGetEnclosingCallable(n2) and
-    msg = "Local flow step does not preserve enclosing callable."
-  }
-
-  private DataFlowType typeRepr() { result = getNodeType(_) }
-
-  query predicate compatibleTypesReflexive(DataFlowType t, string msg) {
-    t = typeRepr() and
-    not compatibleTypes(t, t) and
-    msg = "Type compatibility predicate is not reflexive."
-  }
-
-  query predicate unreachableNodeCCtx(Node n, DataFlowCall call, string msg) {
-    isUnreachableInCall(n, call) and
-    exists(DataFlowCallable c |
-      c = nodeGetEnclosingCallable(n) and
-      not viableCallable(call) = c
-    ) and
-    msg = "Call context for isUnreachableInCall is inconsistent with call graph."
-  }
-
-  query predicate localCallNodes(DataFlowCall call, Node n, string msg) {
-    (
-      n = getAnOutNode(call, _) and
-      msg = "OutNode and call does not share enclosing callable."
-      or
-      n.(ArgumentNode).argumentOf(call, _) and
-      msg = "ArgumentNode and call does not share enclosing callable."
-    ) and
-    nodeGetEnclosingCallable(n) != call.getEnclosingCallable()
-  }
-
-  // This predicate helps the compiler forget that in some languages
-  // it is impossible for a result of `getPreUpdateNode` to be an
-  // instance of `PostUpdateNode`.
-  private Node getPre(PostUpdateNode n) {
-    result = n.getPreUpdateNode()
-    or
-    none()
-  }
-
-  query predicate postIsNotPre(PostUpdateNode n, string msg) {
-    getPre(n) = n and
-    msg = "PostUpdateNode should not equal its pre-update node."
-  }
-
-  query predicate postHasUniquePre(PostUpdateNode n, string msg) {
-    exists(int c |
-      c = count(n.getPreUpdateNode()) and
-      c != 1 and
-      msg = "PostUpdateNode should have one pre-update node but has " + c + "."
-    )
-  }
-
-  query predicate uniquePostUpdate(Node n, string msg) {
-    1 < strictcount(PostUpdateNode post | post.getPreUpdateNode() = n) and
-    msg = "Node has multiple PostUpdateNodes."
-  }
-
-  query predicate postIsInSameCallable(PostUpdateNode n, string msg) {
-    nodeGetEnclosingCallable(n) != nodeGetEnclosingCallable(n.getPreUpdateNode()) and
-    msg = "PostUpdateNode does not share callable with its pre-update node."
-  }
-
-  private predicate hasPost(Node n) { exists(PostUpdateNode post | post.getPreUpdateNode() = n) }
-
-  query predicate reverseRead(Node n, string msg) {
-    exists(Node n2 | readStep(n, _, n2) and hasPost(n2) and not hasPost(n)) and
-    msg = "Origin of readStep is missing a PostUpdateNode."
-  }
-
-  query predicate argHasPostUpdate(ArgumentNode n, string msg) {
-    not hasPost(n) and
-    not any(ConsistencyConfiguration c).argHasPostUpdateExclude(n) and
-    msg = "ArgumentNode is missing PostUpdateNode."
-  }
-
-  // This predicate helps the compiler forget that in some languages
-  // it is impossible for a `PostUpdateNode` to be the target of
-  // `simpleLocalFlowStep`.
-  private predicate isPostUpdateNode(Node n) { n instanceof PostUpdateNode or none() }
-
-  query predicate postWithInFlow(Node n, string msg) {
-    isPostUpdateNode(n) and
-    not clearsContent(n, _) and
-    simpleLocalFlowStep(_, n) and
-    not any(ConsistencyConfiguration c).postWithInFlowExclude(n) and
-    msg = "PostUpdateNode should not be the target of local flow."
-  }
-}

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll

@@ -1,328 +0,0 @@
-private import cpp
-private import DataFlowUtil
-private import semmle.code.cpp.ir.IR
-private import DataFlowDispatch
-private import DataFlowImplConsistency
-
-/** Gets the callable in which this node occurs. */
-DataFlowCallable nodeGetEnclosingCallable(Node n) { result = n.getEnclosingCallable() }
-
-/** Holds if `p` is a `ParameterNode` of `c` with position `pos`. */
-predicate isParameterNode(ParameterNode p, DataFlowCallable c, int pos) { p.isParameterOf(c, pos) }
-
-/**
- * A data flow node that occurs as the argument of a call and is passed as-is
- * to the callable. Instance arguments (`this` pointer) and read side effects
- * on parameters are also included.
- */
-abstract class ArgumentNode extends OperandNode {
-  /**
-   * Holds if this argument occurs at the given position in the given call.
-   * The instance argument is considered to have index `-1`.
-   */
-  abstract predicate argumentOf(DataFlowCall call, int pos);
-
-  /** Gets the call in which this node is an argument. */
-  DataFlowCall getCall() { this.argumentOf(result, _) }
-}
-
-/**
- * A data flow node that occurs as the argument to a call, or an
- * implicit `this` pointer argument.
- */
-private class PrimaryArgumentNode extends ArgumentNode {
-  override ArgumentOperand op;
-
-  PrimaryArgumentNode() { exists(CallInstruction call | op = call.getAnArgumentOperand()) }
-
-  override predicate argumentOf(DataFlowCall call, int pos) { op = call.getArgumentOperand(pos) }
-
-  override string toString() {
-    exists(Expr unconverted |
-      unconverted = op.getDef().getUnconvertedResultExpression() and
-      result = unconverted.toString()
-    )
-    or
-    // Certain instructions don't map to an unconverted result expression. For these cases
-    // we fall back to a simpler naming scheme. This can happen in IR-generated constructors.
-    not exists(op.getDef().getUnconvertedResultExpression()) and
-    (
-      result = "Argument " + op.(PositionalArgumentOperand).getIndex()
-      or
-      op instanceof ThisArgumentOperand and result = "Argument this"
-    )
-  }
-}
-
-/**
- * A data flow node representing the read side effect of a call on a
- * specific parameter.
- */
-private class SideEffectArgumentNode extends ArgumentNode {
-  override SideEffectOperand op;
-  ReadSideEffectInstruction read;
-
-  SideEffectArgumentNode() { op = read.getSideEffectOperand() }
-
-  override predicate argumentOf(DataFlowCall call, int pos) {
-    read.getPrimaryInstruction() = call and
-    pos = getArgumentPosOfSideEffect(read.getIndex())
-  }
-
-  override string toString() {
-    result = read.getArgumentDef().getUnconvertedResultExpression().toString() + " indirection"
-    or
-    // Some instructions don't map to an unconverted result expression. For these cases
-    // we fall back to a simpler naming scheme. This can happen in IR-generated constructors.
-    not exists(read.getArgumentDef().getUnconvertedResultExpression()) and
-    (
-      if read.getIndex() = -1
-      then result = "Argument this indirection"
-      else result = "Argument " + read.getIndex() + " indirection"
-    )
-  }
-}
-
-private newtype TReturnKind =
-  TNormalReturnKind() or
-  TIndirectReturnKind(ParameterIndex index)
-
-/**
- * A return kind. A return kind describes how a value can be returned
- * from a callable. For C++, this is simply a function return.
- */
-class ReturnKind extends TReturnKind {
-  /** Gets a textual representation of this return kind. */
-  abstract string toString();
-}
-
-private class NormalReturnKind extends ReturnKind, TNormalReturnKind {
-  override string toString() { result = "return" }
-}
-
-private class IndirectReturnKind extends ReturnKind, TIndirectReturnKind {
-  ParameterIndex index;
-
-  IndirectReturnKind() { this = TIndirectReturnKind(index) }
-
-  override string toString() { result = "outparam[" + index.toString() + "]" }
-}
-
-/** A data flow node that occurs as the result of a `ReturnStmt`. */
-class ReturnNode extends InstructionNode {
-  Instruction primary;
-
-  ReturnNode() {
-    exists(ReturnValueInstruction ret | instr = ret and primary = ret)
-    or
-    exists(ReturnIndirectionInstruction rii | instr = rii and primary = rii)
-  }
-
-  /** Gets the kind of this returned value. */
-  abstract ReturnKind getKind();
-}
-
-class ReturnValueNode extends ReturnNode {
-  override ReturnValueInstruction primary;
-
-  override ReturnKind getKind() { result = TNormalReturnKind() }
-}
-
-class ReturnIndirectionNode extends ReturnNode {
-  override ReturnIndirectionInstruction primary;
-
-  override ReturnKind getKind() {
-    exists(int index |
-      primary.hasIndex(index) and
-      result = TIndirectReturnKind(index)
-    )
-  }
-}
-
-/** A data flow node that represents the output of a call. */
-class OutNode extends InstructionNode {
-  OutNode() {
-    instr instanceof CallInstruction or
-    instr instanceof WriteSideEffectInstruction
-  }
-
-  /** Gets the underlying call. */
-  abstract DataFlowCall getCall();
-
-  abstract ReturnKind getReturnKind();
-}
-
-private class CallOutNode extends OutNode {
-  override CallInstruction instr;
-
-  override DataFlowCall getCall() { result = instr }
-
-  override ReturnKind getReturnKind() { result instanceof NormalReturnKind }
-}
-
-private class SideEffectOutNode extends OutNode {
-  override WriteSideEffectInstruction instr;
-
-  override DataFlowCall getCall() { result = instr.getPrimaryInstruction() }
-
-  override ReturnKind getReturnKind() { result = TIndirectReturnKind(instr.getIndex()) }
-}
-
-/**
- * Gets a node that can read the value returned from `call` with return kind
- * `kind`.
- */
-OutNode getAnOutNode(DataFlowCall call, ReturnKind kind) {
-  // There should be only one `OutNode` for a given `(call, kind)` pair. Showing the optimizer that
-  // this is true helps it make better decisions downstream, especially in virtual dispatch.
-  result =
-    unique(OutNode outNode |
-      outNode.getCall() = call and
-      outNode.getReturnKind() = kind
-    )
-}
-
-/**
- * Holds if data can flow from `node1` to `node2` in a way that loses the
- * calling context. For example, this would happen with flow through a
- * global or static variable.
- */
-predicate jumpStep(Node n1, Node n2) { none() }
-
-/**
- * Holds if data can flow from `node1` to `node2` via an assignment to `f`.
- * Thus, `node2` references an object with a field `f` that contains the
- * value of `node1`.
- */
-predicate storeStep(StoreNodeInstr node1, FieldContent f, StoreNodeInstr node2) {
-  exists(FieldAddressInstruction fai |
-    node1.getInstruction() = fai and
-    node2.getInstruction() = fai.getObjectAddress() and
-    f.getField() = fai.getField()
-  )
-}
-
-/**
- * Holds if data can flow from `node1` to `node2` via a read of `f`.
- * Thus, `node1` references an object with a field `f` whose value ends up in
- * `node2`.
- */
-predicate readStep(ReadNode node1, FieldContent f, ReadNode node2) {
-  exists(FieldAddressInstruction fai |
-    node1.getInstruction() = fai.getObjectAddress() and
-    node2.getInstruction() = fai and
-    f.getField() = fai.getField()
-  )
-}
-
-/**
- * Holds if values stored inside content `c` are cleared at node `n`.
- */
-predicate clearsContent(Node n, Content c) {
-  none() // stub implementation
-}
-
-/** Gets the type of `n` used for type pruning. */
-IRType getNodeType(Node n) {
-  suppressUnusedNode(n) and
-  result instanceof IRVoidType // stub implementation
-}
-
-/** Gets a string representation of a type returned by `getNodeType`. */
-string ppReprType(IRType t) { none() } // stub implementation
-
-/**
- * Holds if `t1` and `t2` are compatible, that is, whether data can flow from
- * a node of type `t1` to a node of type `t2`.
- */
-pragma[inline]
-predicate compatibleTypes(IRType t1, IRType t2) {
-  any() // stub implementation
-}
-
-private predicate suppressUnusedNode(Node n) { any() }
-
-//////////////////////////////////////////////////////////////////////////////
-// Java QL library compatibility wrappers
-//////////////////////////////////////////////////////////////////////////////
-/** A node that performs a type cast. */
-class CastNode extends Node {
-  CastNode() { none() } // stub implementation
-}
-
-/**
- * A function that may contain code or a variable that may contain itself. When
- * flow crosses from one _enclosing callable_ to another, the interprocedural
- * data-flow library discards call contexts and inserts a node in the big-step
- * relation used for human-readable path explanations.
- */
-class DataFlowCallable = Declaration;
-
-class DataFlowExpr = Expr;
-
-class DataFlowType = IRType;
-
-/** A function call relevant for data flow. */
-class DataFlowCall extends CallInstruction {
-  Function getEnclosingCallable() { result = this.getEnclosingFunction() }
-}
-
-predicate isUnreachableInCall(Node n, DataFlowCall call) { none() } // stub implementation
-
-int accessPathLimit() { result = 5 }
-
-/**
- * Holds if access paths with `c` at their head always should be tracked at high
- * precision. This disables adaptive access path precision for such access paths.
- */
-predicate forceHighPrecision(Content c) { none() }
-
-/** The unit type. */
-private newtype TUnit = TMkUnit()
-
-/** The trivial type with a single element. */
-class Unit extends TUnit {
-  /** Gets a textual representation of this element. */
-  string toString() { result = "unit" }
-}
-
-/** Holds if `n` should be hidden from path explanations. */
-predicate nodeIsHidden(Node n) {
-  n instanceof OperandNode and not n instanceof ArgumentNode
-  or
-  StoreNodeFlow::flowThrough(n, _) and
-  not StoreNodeFlow::flowOutOf(n, _) and
-  not StoreNodeFlow::flowInto(_, n)
-  or
-  ReadNodeFlow::flowThrough(n, _) and
-  not ReadNodeFlow::flowOutOf(n, _) and
-  not ReadNodeFlow::flowInto(_, n)
-}
-
-class LambdaCallKind = Unit;
-
-/** Holds if `creation` is an expression that creates a lambda of kind `kind` for `c`. */
-predicate lambdaCreation(Node creation, LambdaCallKind kind, DataFlowCallable c) { none() }
-
-/** Holds if `call` is a lambda call of kind `kind` where `receiver` is the lambda expression. */
-predicate lambdaCall(DataFlowCall call, LambdaCallKind kind, Node receiver) { none() }
-
-/** Extra data-flow steps needed for lambda flow analysis. */
-predicate additionalLambdaFlowStep(Node nodeFrom, Node nodeTo, boolean preservesValue) { none() }
-
-/**
- * Holds if flow is allowed to pass from parameter `p` and back to itself as a
- * side-effect, resulting in a summary from `p` to itself.
- *
- * One example would be to allow flow like `p.foo = p.bar;`, which is disallowed
- * by default as a heuristic.
- */
-predicate allowParameterReturnInSelf(ParameterNode p) { none() }
-
-private class MyConsistencyConfiguration extends Consistency::ConsistencyConfiguration {
-  override predicate argHasPostUpdateExclude(ArgumentNode n) {
-    // The rules for whether an IR argument gets a post-update node are too
-    // complex to model here.
-    any()
-  }
-}

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaImplCommon.qll

@@ -1,662 +0,0 @@
-/**
- * Provides a language-independent implementation of static single assignment
- * (SSA) form.
- */
-
-private import SsaImplSpecific
-
-private BasicBlock getABasicBlockPredecessor(BasicBlock bb) { getABasicBlockSuccessor(result) = bb }
-
-/**
- * Liveness analysis (based on source variables) to restrict the size of the
- * SSA representation.
- */
-private module Liveness {
-  /**
-   * A classification of variable references into reads (of a given kind) and
-   * (certain or uncertain) writes.
-   */
-  private newtype TRefKind =
-    Read(boolean certain) { certain in [false, true] } or
-    Write(boolean certain) { certain in [false, true] }
-
-  private class RefKind extends TRefKind {
-    string toString() {
-      exists(boolean certain | this = Read(certain) and result = "read (" + certain + ")")
-      or
-      exists(boolean certain | this = Write(certain) and result = "write (" + certain + ")")
-    }
-
-    int getOrder() {
-      this = Read(_) and
-      result = 0
-      or
-      this = Write(_) and
-      result = 1
-    }
-  }
-
-  /**
-   * Holds if the `i`th node of basic block `bb` is a reference to `v` of kind `k`.
-   */
-  private predicate ref(BasicBlock bb, int i, SourceVariable v, RefKind k) {
-    exists(boolean certain | variableRead(bb, i, v, certain) | k = Read(certain))
-    or
-    exists(boolean certain | variableWrite(bb, i, v, certain) | k = Write(certain))
-  }
-
-  private newtype OrderedRefIndex =
-    MkOrderedRefIndex(int i, int tag) {
-      exists(RefKind rk | ref(_, i, _, rk) | tag = rk.getOrder())
-    }
-
-  private OrderedRefIndex refOrd(BasicBlock bb, int i, SourceVariable v, RefKind k, int ord) {
-    ref(bb, i, v, k) and
-    result = MkOrderedRefIndex(i, ord) and
-    ord = k.getOrder()
-  }
-
-  /**
-   * Gets the (1-based) rank of the reference to `v` at the `i`th node of
-   * basic block `bb`, which has the given reference kind `k`.
-   *
-   * Reads are considered before writes when they happen at the same index.
-   */
-  private int refRank(BasicBlock bb, int i, SourceVariable v, RefKind k) {
-    refOrd(bb, i, v, k, _) =
-      rank[result](int j, int ord, OrderedRefIndex res |
-        res = refOrd(bb, j, v, _, ord)
-      |
-        res order by j, ord
-      )
-  }
-
-  private int maxRefRank(BasicBlock bb, SourceVariable v) {
-    result = refRank(bb, _, v, _) and
-    not result + 1 = refRank(bb, _, v, _)
-  }
-
-  /**
-   * Gets the (1-based) rank of the first reference to `v` inside basic block `bb`
-   * that is either a read or a certain write.
-   */
-  private int firstReadOrCertainWrite(BasicBlock bb, SourceVariable v) {
-    result =
-      min(int r, RefKind k |
-        r = refRank(bb, _, v, k) and
-        k != Write(false)
-      |
-        r
-      )
-  }
-
-  /**
-   * Holds if source variable `v` is live at the beginning of basic block `bb`.
-   */
-  predicate liveAtEntry(BasicBlock bb, SourceVariable v) {
-    // The first read or certain write to `v` inside `bb` is a read
-    refRank(bb, _, v, Read(_)) = firstReadOrCertainWrite(bb, v)
-    or
-    // There is no certain write to `v` inside `bb`, but `v` is live at entry
-    // to a successor basic block of `bb`
-    not exists(firstReadOrCertainWrite(bb, v)) and
-    liveAtExit(bb, v)
-  }
-
-  /**
-   * Holds if source variable `v` is live at the end of basic block `bb`.
-   */
-  predicate liveAtExit(BasicBlock bb, SourceVariable v) {
-    liveAtEntry(getABasicBlockSuccessor(bb), v)
-  }
-
-  /**
-   * Holds if variable `v` is live in basic block `bb` at index `i`.
-   * The rank of `i` is `rnk` as defined by `refRank()`.
-   */
-  private predicate liveAtRank(BasicBlock bb, int i, SourceVariable v, int rnk) {
-    exists(RefKind kind | rnk = refRank(bb, i, v, kind) |
-      rnk = maxRefRank(bb, v) and
-      liveAtExit(bb, v)
-      or
-      ref(bb, i, v, kind) and
-      kind = Read(_)
-      or
-      exists(RefKind nextKind |
-        liveAtRank(bb, _, v, rnk + 1) and
-        rnk + 1 = refRank(bb, _, v, nextKind) and
-        nextKind != Write(true)
-      )
-    )
-  }
-
-  /**
-   * Holds if variable `v` is live after the (certain or uncertain) write at
-   * index `i` inside basic block `bb`.
-   */
-  predicate liveAfterWrite(BasicBlock bb, int i, SourceVariable v) {
-    exists(int rnk | rnk = refRank(bb, i, v, Write(_)) | liveAtRank(bb, i, v, rnk))
-  }
-}
-
-private import Liveness
-
-/**
- * Holds if `df` is in the dominance frontier of `bb`.
- *
- * This is equivalent to:
- *
- * ```ql
- * bb = getImmediateBasicBlockDominator*(getABasicBlockPredecessor(df)) and
- * not bb = getImmediateBasicBlockDominator+(df)
- * ```
- */
-private predicate inDominanceFrontier(BasicBlock bb, BasicBlock df) {
-  bb = getABasicBlockPredecessor(df) and not bb = getImmediateBasicBlockDominator(df)
-  or
-  exists(BasicBlock prev | inDominanceFrontier(prev, df) |
-    bb = getImmediateBasicBlockDominator(prev) and
-    not bb = getImmediateBasicBlockDominator(df)
-  )
-}
-
-/**
- * Holds if `bb` is in the dominance frontier of a block containing a
- * definition of `v`.
- */
-pragma[noinline]
-private predicate inDefDominanceFrontier(BasicBlock bb, SourceVariable v) {
-  exists(BasicBlock defbb, Definition def |
-    def.definesAt(v, defbb, _) and
-    inDominanceFrontier(defbb, bb)
-  )
-}
-
-cached
-newtype TDefinition =
-  TWriteDef(SourceVariable v, BasicBlock bb, int i) {
-    variableWrite(bb, i, v, _) and
-    liveAfterWrite(bb, i, v)
-  } or
-  TPhiNode(SourceVariable v, BasicBlock bb) {
-    inDefDominanceFrontier(bb, v) and
-    liveAtEntry(bb, v)
-  }
-
-private module SsaDefReaches {
-  newtype TSsaRefKind =
-    SsaRead() or
-    SsaDef()
-
-  /**
-   * A classification of SSA variable references into reads and definitions.
-   */
-  class SsaRefKind extends TSsaRefKind {
-    string toString() {
-      this = SsaRead() and
-      result = "SsaRead"
-      or
-      this = SsaDef() and
-      result = "SsaDef"
-    }
-
-    int getOrder() {
-      this = SsaRead() and
-      result = 0
-      or
-      this = SsaDef() and
-      result = 1
-    }
-  }
-
-  /**
-   * Holds if the `i`th node of basic block `bb` is a reference to `v`,
-   * either a read (when `k` is `SsaRead()`) or an SSA definition (when `k`
-   * is `SsaDef()`).
-   *
-   * Unlike `Liveness::ref`, this includes `phi` nodes.
-   */
-  predicate ssaRef(BasicBlock bb, int i, SourceVariable v, SsaRefKind k) {
-    variableRead(bb, i, v, _) and
-    k = SsaRead()
-    or
-    exists(Definition def | def.definesAt(v, bb, i)) and
-    k = SsaDef()
-  }
-
-  private newtype OrderedSsaRefIndex =
-    MkOrderedSsaRefIndex(int i, SsaRefKind k) { ssaRef(_, i, _, k) }
-
-  private OrderedSsaRefIndex ssaRefOrd(BasicBlock bb, int i, SourceVariable v, SsaRefKind k, int ord) {
-    ssaRef(bb, i, v, k) and
-    result = MkOrderedSsaRefIndex(i, k) and
-    ord = k.getOrder()
-  }
-
-  /**
-   * Gets the (1-based) rank of the reference to `v` at the `i`th node of basic
-   * block `bb`, which has the given reference kind `k`.
-   *
-   * For example, if `bb` is a basic block with a phi node for `v` (considered
-   * to be at index -1), reads `v` at node 2, and defines it at node 5, we have:
-   *
-   * ```ql
-   * ssaRefRank(bb, -1, v, SsaDef()) = 1    // phi node
-   * ssaRefRank(bb,  2, v, Read())   = 2    // read at node 2
-   * ssaRefRank(bb,  5, v, SsaDef()) = 3    // definition at node 5
-   * ```
-   *
-   * Reads are considered before writes when they happen at the same index.
-   */
-  int ssaRefRank(BasicBlock bb, int i, SourceVariable v, SsaRefKind k) {
-    ssaRefOrd(bb, i, v, k, _) =
-      rank[result](int j, int ord, OrderedSsaRefIndex res |
-        res = ssaRefOrd(bb, j, v, _, ord)
-      |
-        res order by j, ord
-      )
-  }
-
-  int maxSsaRefRank(BasicBlock bb, SourceVariable v) {
-    result = ssaRefRank(bb, _, v, _) and
-    not result + 1 = ssaRefRank(bb, _, v, _)
-  }
-
-  /**
-   * Holds if the SSA definition `def` reaches rank index `rnk` in its own
-   * basic block `bb`.
-   */
-  predicate ssaDefReachesRank(BasicBlock bb, Definition def, int rnk, SourceVariable v) {
-    exists(int i |
-      rnk = ssaRefRank(bb, i, v, SsaDef()) and
-      def.definesAt(v, bb, i)
-    )
-    or
-    ssaDefReachesRank(bb, def, rnk - 1, v) and
-    rnk = ssaRefRank(bb, _, v, SsaRead())
-  }
-
-  /**
-   * Holds if the SSA definition of `v` at `def` reaches index `i` in the same
-   * basic block `bb`, without crossing another SSA definition of `v`.
-   */
-  predicate ssaDefReachesReadWithinBlock(SourceVariable v, Definition def, BasicBlock bb, int i) {
-    exists(int rnk |
-      ssaDefReachesRank(bb, def, rnk, v) and
-      rnk = ssaRefRank(bb, i, v, SsaRead())
-    )
-  }
-
-  /**
-   * Holds if the SSA definition of `v` at `def` reaches uncertain SSA definition
-   * `redef` in the same basic block, without crossing another SSA definition of `v`.
-   */
-  predicate ssaDefReachesUncertainDefWithinBlock(
-    SourceVariable v, Definition def, UncertainWriteDefinition redef
-  ) {
-    exists(BasicBlock bb, int rnk, int i |
-      ssaDefReachesRank(bb, def, rnk, v) and
-      rnk = ssaRefRank(bb, i, v, SsaDef()) - 1 and
-      redef.definesAt(v, bb, i)
-    )
-  }
-
-  /**
-   * Same as `ssaRefRank()`, but restricted to a particular SSA definition `def`.
-   */
-  int ssaDefRank(Definition def, SourceVariable v, BasicBlock bb, int i, SsaRefKind k) {
-    v = def.getSourceVariable() and
-    result = ssaRefRank(bb, i, v, k) and
-    (
-      ssaDefReachesRead(_, def, bb, i)
-      or
-      def.definesAt(_, bb, i)
-    )
-  }
-
-  /**
-   * Holds if the reference to `def` at index `i` in basic block `bb` is the
-   * last reference to `v` inside `bb`.
-   */
-  pragma[noinline]
-  predicate lastSsaRef(Definition def, SourceVariable v, BasicBlock bb, int i) {
-    ssaDefRank(def, v, bb, i, _) = maxSsaRefRank(bb, v)
-  }
-
-  predicate defOccursInBlock(Definition def, BasicBlock bb, SourceVariable v) {
-    exists(ssaDefRank(def, v, bb, _, _))
-  }
-
-  pragma[noinline]
-  private predicate ssaDefReachesThroughBlock(Definition def, BasicBlock bb) {
-    ssaDefReachesEndOfBlock(bb, def, _) and
-    not defOccursInBlock(_, bb, def.getSourceVariable())
-  }
-
-  /**
-   * Holds if `def` is accessed in basic block `bb1` (either a read or a write),
-   * `bb2` is a transitive successor of `bb1`, `def` is live at the end of `bb1`,
-   * and the underlying variable for `def` is neither read nor written in any block
-   * on the path between `bb1` and `bb2`.
-   */
-  predicate varBlockReaches(Definition def, BasicBlock bb1, BasicBlock bb2) {
-    defOccursInBlock(def, bb1, _) and
-    bb2 = getABasicBlockSuccessor(bb1)
-    or
-    exists(BasicBlock mid |
-      varBlockReaches(def, bb1, mid) and
-      ssaDefReachesThroughBlock(def, mid) and
-      bb2 = getABasicBlockSuccessor(mid)
-    )
-  }
-
-  /**
-   * Holds if `def` is accessed in basic block `bb1` (either a read or a write),
-   * `def` is read at index `i2` in basic block `bb2`, `bb2` is in a transitive
-   * successor block of `bb1`, and `def` is neither read nor written in any block
-   * on a path between `bb1` and `bb2`.
-   */
-  predicate defAdjacentRead(Definition def, BasicBlock bb1, BasicBlock bb2, int i2) {
-    varBlockReaches(def, bb1, bb2) and
-    ssaRefRank(bb2, i2, def.getSourceVariable(), SsaRead()) = 1
-  }
-}
-
-private import SsaDefReaches
-
-pragma[nomagic]
-predicate liveThrough(BasicBlock bb, SourceVariable v) {
-  liveAtExit(bb, v) and
-  not ssaRef(bb, _, v, SsaDef())
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if the SSA definition of `v` at `def` reaches the end of basic
- * block `bb`, at which point it is still live, without crossing another
- * SSA definition of `v`.
- */
-pragma[nomagic]
-predicate ssaDefReachesEndOfBlock(BasicBlock bb, Definition def, SourceVariable v) {
-  exists(int last | last = maxSsaRefRank(bb, v) |
-    ssaDefReachesRank(bb, def, last, v) and
-    liveAtExit(bb, v)
-  )
-  or
-  // The construction of SSA form ensures that each read of a variable is
-  // dominated by its definition. An SSA definition therefore reaches a
-  // control flow node if it is the _closest_ SSA definition that dominates
-  // the node. If two definitions dominate a node then one must dominate the
-  // other, so therefore the definition of _closest_ is given by the dominator
-  // tree. Thus, reaching definitions can be calculated in terms of dominance.
-  ssaDefReachesEndOfBlock(getImmediateBasicBlockDominator(bb), def, pragma[only_bind_into](v)) and
-  liveThrough(bb, pragma[only_bind_into](v))
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if `inp` is an input to the phi node `phi` along the edge originating in `bb`.
- */
-pragma[nomagic]
-predicate phiHasInputFromBlock(PhiNode phi, Definition inp, BasicBlock bb) {
-  exists(SourceVariable v, BasicBlock bbDef |
-    phi.definesAt(v, bbDef, _) and
-    getABasicBlockPredecessor(bbDef) = bb and
-    ssaDefReachesEndOfBlock(bb, inp, v)
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if the SSA definition of `v` at `def` reaches a read at index `i` in
- * basic block `bb`, without crossing another SSA definition of `v`. The read
- * is of kind `rk`.
- */
-pragma[nomagic]
-predicate ssaDefReachesRead(SourceVariable v, Definition def, BasicBlock bb, int i) {
-  ssaDefReachesReadWithinBlock(v, def, bb, i)
-  or
-  variableRead(bb, i, v, _) and
-  ssaDefReachesEndOfBlock(getABasicBlockPredecessor(bb), def, v) and
-  not ssaDefReachesReadWithinBlock(v, _, bb, i)
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if `def` is accessed at index `i1` in basic block `bb1` (either a read
- * or a write), `def` is read at index `i2` in basic block `bb2`, and there is a
- * path between them without any read of `def`.
- */
-pragma[nomagic]
-predicate adjacentDefRead(Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2) {
-  exists(int rnk |
-    rnk = ssaDefRank(def, _, bb1, i1, _) and
-    rnk + 1 = ssaDefRank(def, _, bb1, i2, SsaRead()) and
-    variableRead(bb1, i2, _, _) and
-    bb2 = bb1
-  )
-  or
-  lastSsaRef(def, _, bb1, i1) and
-  defAdjacentRead(def, bb1, bb2, i2)
-}
-
-pragma[noinline]
-private predicate adjacentDefRead(
-  Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2, SourceVariable v
-) {
-  adjacentDefRead(def, bb1, i1, bb2, i2) and
-  v = def.getSourceVariable()
-}
-
-private predicate adjacentDefReachesRead(
-  Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2
-) {
-  exists(SourceVariable v | adjacentDefRead(def, bb1, i1, bb2, i2, v) |
-    ssaRef(bb1, i1, v, SsaDef())
-    or
-    variableRead(bb1, i1, v, true)
-  )
-  or
-  exists(BasicBlock bb3, int i3 |
-    adjacentDefReachesRead(def, bb1, i1, bb3, i3) and
-    variableRead(bb3, i3, _, false) and
-    adjacentDefRead(def, bb3, i3, bb2, i2)
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Same as `adjacentDefRead`, but ignores uncertain reads.
- */
-pragma[nomagic]
-predicate adjacentDefNoUncertainReads(Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2) {
-  adjacentDefReachesRead(def, bb1, i1, bb2, i2) and
-  variableRead(bb2, i2, _, true)
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if the node at index `i` in `bb` is a last reference to SSA definition
- * `def`. The reference is last because it can reach another write `next`,
- * without passing through another read or write.
- */
-pragma[nomagic]
-predicate lastRefRedef(Definition def, BasicBlock bb, int i, Definition next) {
-  exists(SourceVariable v |
-    // Next reference to `v` inside `bb` is a write
-    exists(int rnk, int j |
-      rnk = ssaDefRank(def, v, bb, i, _) and
-      next.definesAt(v, bb, j) and
-      rnk + 1 = ssaRefRank(bb, j, v, SsaDef())
-    )
-    or
-    // Can reach a write using one or more steps
-    lastSsaRef(def, v, bb, i) and
-    exists(BasicBlock bb2 |
-      varBlockReaches(def, bb, bb2) and
-      1 = ssaDefRank(next, v, bb2, _, SsaDef())
-    )
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if `inp` is an immediately preceding definition of uncertain definition
- * `def`. Since `def` is uncertain, the value from the preceding definition might
- * still be valid.
- */
-pragma[nomagic]
-predicate uncertainWriteDefinitionInput(UncertainWriteDefinition def, Definition inp) {
-  lastRefRedef(inp, _, _, def)
-}
-
-private predicate adjacentDefReachesUncertainRead(
-  Definition def, BasicBlock bb1, int i1, BasicBlock bb2, int i2
-) {
-  adjacentDefReachesRead(def, bb1, i1, bb2, i2) and
-  variableRead(bb2, i2, _, false)
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Same as `lastRefRedef`, but ignores uncertain reads.
- */
-pragma[nomagic]
-predicate lastRefRedefNoUncertainReads(Definition def, BasicBlock bb, int i, Definition next) {
-  lastRefRedef(def, bb, i, next) and
-  not variableRead(bb, i, def.getSourceVariable(), false)
-  or
-  exists(BasicBlock bb0, int i0 |
-    lastRefRedef(def, bb0, i0, next) and
-    adjacentDefReachesUncertainRead(def, bb, i, bb0, i0)
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Holds if the node at index `i` in `bb` is a last reference to SSA
- * definition `def`.
- *
- * That is, the node can reach the end of the enclosing callable, or another
- * SSA definition for the underlying source variable, without passing through
- * another read.
- */
-pragma[nomagic]
-predicate lastRef(Definition def, BasicBlock bb, int i) {
-  lastRefRedef(def, bb, i, _)
-  or
-  lastSsaRef(def, _, bb, i) and
-  (
-    // Can reach exit directly
-    bb instanceof ExitBasicBlock
-    or
-    // Can reach a block using one or more steps, where `def` is no longer live
-    exists(BasicBlock bb2 | varBlockReaches(def, bb, bb2) |
-      not defOccursInBlock(def, bb2, _) and
-      not ssaDefReachesEndOfBlock(bb2, def, _)
-    )
-  )
-}
-
-/**
- * NB: If this predicate is exposed, it should be cached.
- *
- * Same as `lastRefRedef`, but ignores uncertain reads.
- */
-pragma[nomagic]
-predicate lastRefNoUncertainReads(Definition def, BasicBlock bb, int i) {
-  lastRef(def, bb, i) and
-  not variableRead(bb, i, def.getSourceVariable(), false)
-  or
-  exists(BasicBlock bb0, int i0 |
-    lastRef(def, bb0, i0) and
-    adjacentDefReachesUncertainRead(def, bb, i, bb0, i0)
-  )
-}
-
-/** A static single assignment (SSA) definition. */
-class Definition extends TDefinition {
-  /** Gets the source variable underlying this SSA definition. */
-  SourceVariable getSourceVariable() { this.definesAt(result, _, _) }
-
-  /**
-   * Holds if this SSA definition defines `v` at index `i` in basic block `bb`.
-   * Phi nodes are considered to be at index `-1`, while normal variable writes
-   * are at the index of the control flow node they wrap.
-   */
-  final predicate definesAt(SourceVariable v, BasicBlock bb, int i) {
-    this = TWriteDef(v, bb, i)
-    or
-    this = TPhiNode(v, bb) and i = -1
-  }
-
-  /** Gets the basic block to which this SSA definition belongs. */
-  final BasicBlock getBasicBlock() { this.definesAt(_, result, _) }
-
-  /** Gets a textual representation of this SSA definition. */
-  string toString() { none() }
-}
-
-/** An SSA definition that corresponds to a write. */
-class WriteDefinition extends Definition, TWriteDef {
-  private SourceVariable v;
-  private BasicBlock bb;
-  private int i;
-
-  WriteDefinition() { this = TWriteDef(v, bb, i) }
-
-  override string toString() { result = "WriteDef" }
-}
-
-/** A phi node. */
-class PhiNode extends Definition, TPhiNode {
-  override string toString() { result = "Phi" }
-}
-
-/**
- * An SSA definition that represents an uncertain update of the underlying
- * source variable.
- */
-class UncertainWriteDefinition extends WriteDefinition {
-  UncertainWriteDefinition() {
-    exists(SourceVariable v, BasicBlock bb, int i |
-      this.definesAt(v, bb, i) and
-      variableWrite(bb, i, v, false)
-    )
-  }
-}
-
-/** Provides a set of consistency queries. */
-module Consistency {
-  abstract class RelevantDefinition extends Definition {
-    abstract predicate hasLocationInfo(
-      string filepath, int startline, int startcolumn, int endline, int endcolumn
-    );
-  }
-
-  query predicate nonUniqueDef(RelevantDefinition def, SourceVariable v, BasicBlock bb, int i) {
-    ssaDefReachesRead(v, def, bb, i) and
-    not exists(unique(Definition def0 | ssaDefReachesRead(v, def0, bb, i)))
-  }
-
-  query predicate readWithoutDef(SourceVariable v, BasicBlock bb, int i) {
-    variableRead(bb, i, v, _) and
-    not ssaDefReachesRead(v, _, bb, i)
-  }
-
-  query predicate deadDef(RelevantDefinition def, SourceVariable v) {
-    v = def.getSourceVariable() and
-    not ssaDefReachesRead(_, def, _, _) and
-    not phiHasInputFromBlock(_, def, _) and
-    not uncertainWriteDefinitionInput(_, def)
-  }
-}

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaImplSpecific.qll

@@ -1,18 +0,0 @@
-private import semmle.code.cpp.ir.IR
-private import SsaInternals as Ssa
-
-class BasicBlock = IRBlock;
-
-class SourceVariable = Ssa::SourceVariable;
-
-BasicBlock getImmediateBasicBlockDominator(BasicBlock bb) { result.immediatelyDominates(bb) }
-
-BasicBlock getABasicBlockSuccessor(BasicBlock bb) { result = bb.getASuccessor() }
-
-class ExitBasicBlock extends IRBlock {
-  ExitBasicBlock() { this.getLastInstruction() instanceof ExitFunctionInstruction }
-}
-
-predicate variableWrite = Ssa::variableWrite/4;
-
-predicate variableRead = Ssa::variableRead/4;

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternals.qll

@@ -1,639 +0,0 @@
-import SsaImplCommon
-private import cpp as Cpp
-private import semmle.code.cpp.ir.IR
-private import DataFlowUtil
-private import DataFlowImplCommon as DataFlowImplCommon
-private import semmle.code.cpp.models.interfaces.Allocation as Alloc
-private import semmle.code.cpp.models.interfaces.DataFlow as DataFlow
-
-private module SourceVariables {
-  private newtype TSourceVariable =
-    TSourceIRVariable(IRVariable var) or
-    TSourceIRVariableIndirection(InitializeIndirectionInstruction init)
-
-  abstract class SourceVariable extends TSourceVariable {
-    IRVariable var;
-
-    abstract string toString();
-  }
-
-  class SourceIRVariable extends SourceVariable, TSourceIRVariable {
-    SourceIRVariable() { this = TSourceIRVariable(var) }
-
-    IRVariable getIRVariable() { result = var }
-
-    override string toString() { result = this.getIRVariable().toString() }
-  }
-
-  class SourceIRVariableIndirection extends SourceVariable, TSourceIRVariableIndirection {
-    InitializeIndirectionInstruction init;
-
-    SourceIRVariableIndirection() {
-      this = TSourceIRVariableIndirection(init) and var = init.getIRVariable()
-    }
-
-    IRVariable getUnderlyingIRVariable() { result = var }
-
-    override string toString() { result = "*" + this.getUnderlyingIRVariable().toString() }
-  }
-}
-
-import SourceVariables
-
-cached
-private newtype TDefOrUse =
-  TExplicitDef(Instruction store) { explicitWrite(_, store, _) } or
-  TInitializeParam(Instruction instr) {
-    instr instanceof InitializeParameterInstruction
-    or
-    instr instanceof InitializeIndirectionInstruction
-  } or
-  TExplicitUse(Operand op) { isExplicitUse(op) } or
-  TReturnParamIndirection(Operand op) { returnParameterIndirection(op, _) }
-
-pragma[nomagic]
-private int getRank(DefOrUse defOrUse, IRBlock block) {
-  defOrUse =
-    rank[result](int i, DefOrUse cand |
-      block.getInstruction(i) = toInstruction(cand)
-    |
-      cand order by i
-    )
-}
-
-private class DefOrUse extends TDefOrUse {
-  /** Gets the instruction associated with this definition, if any. */
-  Instruction asDef() { none() }
-
-  /** Gets the operand associated with this use, if any. */
-  Operand asUse() { none() }
-
-  /** Gets a textual representation of this element. */
-  abstract string toString();
-
-  /** Gets the block of this definition or use. */
-  abstract IRBlock getBlock();
-
-  /** Holds if this definition or use has rank `rank` in block `block`. */
-  cached
-  final predicate hasRankInBlock(IRBlock block, int rnk) { rnk = getRank(this, block) }
-
-  /** Gets the location of this element. */
-  abstract Cpp::Location getLocation();
-}
-
-private Instruction toInstruction(DefOrUse defOrUse) {
-  result = defOrUse.asDef()
-  or
-  result = defOrUse.asUse().getUse()
-}
-
-abstract class Def extends DefOrUse {
-  Instruction store;
-
-  /** Gets the instruction of this definition. */
-  Instruction getInstruction() { result = store }
-
-  /** Gets the variable that is defined by this definition. */
-  abstract SourceVariable getSourceVariable();
-
-  /** Holds if this definition is guaranteed to happen. */
-  abstract predicate isCertain();
-
-  override Instruction asDef() { result = this.getInstruction() }
-
-  override string toString() { result = "Def" }
-
-  override IRBlock getBlock() { result = this.getInstruction().getBlock() }
-
-  override Cpp::Location getLocation() { result = store.getLocation() }
-}
-
-private class ExplicitDef extends Def, TExplicitDef {
-  ExplicitDef() { this = TExplicitDef(store) }
-
-  override SourceVariable getSourceVariable() {
-    exists(VariableInstruction var |
-      explicitWrite(_, this.getInstruction(), var) and
-      result.(SourceIRVariable).getIRVariable() = var.getIRVariable()
-    )
-  }
-
-  override predicate isCertain() { explicitWrite(true, this.getInstruction(), _) }
-}
-
-private class ParameterDef extends Def, TInitializeParam {
-  ParameterDef() { this = TInitializeParam(store) }
-
-  override SourceVariable getSourceVariable() {
-    result.(SourceIRVariable).getIRVariable() =
-      store.(InitializeParameterInstruction).getIRVariable()
-    or
-    result.(SourceIRVariableIndirection).getUnderlyingIRVariable() =
-      store.(InitializeIndirectionInstruction).getIRVariable()
-  }
-
-  override predicate isCertain() { any() }
-}
-
-abstract class Use extends DefOrUse {
-  Operand use;
-
-  override Operand asUse() { result = use }
-
-  /** Gets the underlying operand of this use. */
-  Operand getOperand() { result = use }
-
-  override string toString() { result = "Use" }
-
-  /** Gets the variable that is used by this use. */
-  abstract SourceVariable getSourceVariable();
-
-  override IRBlock getBlock() { result = use.getUse().getBlock() }
-
-  override Cpp::Location getLocation() { result = use.getLocation() }
-}
-
-private class ExplicitUse extends Use, TExplicitUse {
-  ExplicitUse() { this = TExplicitUse(use) }
-
-  override SourceVariable getSourceVariable() {
-    exists(VariableInstruction var |
-      use.getDef() = var and
-      if use.getUse() instanceof ReadSideEffectInstruction
-      then result.(SourceIRVariableIndirection).getUnderlyingIRVariable() = var.getIRVariable()
-      else result.(SourceIRVariable).getIRVariable() = var.getIRVariable()
-    )
-  }
-}
-
-private class ReturnParameterIndirection extends Use, TReturnParamIndirection {
-  ReturnParameterIndirection() { this = TReturnParamIndirection(use) }
-
-  override SourceVariable getSourceVariable() {
-    exists(ReturnIndirectionInstruction ret |
-      returnParameterIndirection(use, ret) and
-      result.(SourceIRVariableIndirection).getUnderlyingIRVariable() = ret.getIRVariable()
-    )
-  }
-}
-
-private predicate isExplicitUse(Operand op) {
-  op.getDef() instanceof VariableAddressInstruction and
-  not exists(LoadInstruction load |
-    load.getSourceAddressOperand() = op and
-    load.getAUse().getUse() instanceof InitializeIndirectionInstruction
-  )
-}
-
-private predicate returnParameterIndirection(Operand op, ReturnIndirectionInstruction ret) {
-  ret.getSourceAddressOperand() = op
-}
-
-/**
- * Holds if `iFrom` computes an address that is used by `iTo`.
- */
-predicate addressFlow(Instruction iFrom, Instruction iTo) {
-  iTo.(CopyValueInstruction).getSourceValue() = iFrom
-  or
-  iTo.(ConvertInstruction).getUnary() = iFrom
-  or
-  iTo.(CheckedConvertOrNullInstruction).getUnary() = iFrom
-  or
-  iTo.(InheritanceConversionInstruction).getUnary() = iFrom
-  or
-  iTo.(PointerArithmeticInstruction).getLeft() = iFrom
-  or
-  iTo.(FieldAddressInstruction).getObjectAddress() = iFrom
-  or
-  // We traverse `LoadInstruction`s since we want to conclude that the
-  // destination of the store operation `*x = source()` is derived from `x`.
-  iTo.(LoadInstruction).getSourceAddress() = iFrom
-  or
-  // We want to include `ReadSideEffectInstruction`s for the same reason that we include
-  // `LoadInstruction`s, but only when a `WriteSideEffectInstruction` for the same index exists as well
-  // (as otherwise we know that the callee won't override the data). However, given an index `i`, the
-  // destination of the `WriteSideEffectInstruction` for `i` is identical to the source address of the
-  // `ReadSideEffectInstruction` for `i`. So we don't have to talk about the `ReadSideEffectInstruction`
-  // at all.
-  exists(WriteSideEffectInstruction write |
-    write.getPrimaryInstruction() = iTo and
-    write.getDestinationAddress() = iFrom
-  )
-}
-
-/**
- * The reflexive, transitive closure of `addressFlow` that ends as the address of a
- * store or read operation.
- */
-cached
-predicate addressFlowTC(Instruction iFrom, Instruction iTo) {
-  iTo = [getDestinationAddress(_), getSourceAddress(_)] and
-  addressFlow*(iFrom, iTo)
-}
-
-/**
- * Gets the destination address of `instr` if it is a `StoreInstruction` or
- * a `WriteSideEffectInstruction`.
- */
-Instruction getDestinationAddress(Instruction instr) {
-  result =
-    [
-      instr.(StoreInstruction).getDestinationAddress(),
-      instr.(WriteSideEffectInstruction).getDestinationAddress()
-    ]
-}
-
-/** Gets the source address of `instr` if it is an instruction that behaves like a `LoadInstruction`. */
-Instruction getSourceAddress(Instruction instr) { result = getSourceAddressOperand(instr).getDef() }
-
-/**
- * Gets the operand that represents the source address of `instr` if it is an
- * instruction that behaves like a `LoadInstruction`.
- */
-Operand getSourceAddressOperand(Instruction instr) {
-  result =
-    [
-      instr.(LoadInstruction).getSourceAddressOperand(),
-      instr.(ReadSideEffectInstruction).getArgumentOperand()
-    ]
-}
-
-/**
- * Gets the source address of `node` if it's an instruction or operand that
- * behaves like a `LoadInstruction`.
- */
-Instruction getSourceAddressFromNode(Node node) {
-  result = getSourceAddress(node.asInstruction())
-  or
-  result = getSourceAddress(node.asOperand().(SideEffectOperand).getUse())
-}
-
-/** Gets the source value of `instr` if it's an instruction that behaves like a `LoadInstruction`. */
-Instruction getSourceValue(Instruction instr) { result = getSourceValueOperand(instr).getDef() }
-
-/**
- * Gets the operand that represents the source value of `instr` if it's an instruction
- * that behaves like a `LoadInstruction`.
- */
-Operand getSourceValueOperand(Instruction instr) {
-  result = instr.(LoadInstruction).getSourceValueOperand()
-  or
-  result = instr.(ReadSideEffectInstruction).getSideEffectOperand()
-}
-
-/**
- * Holds if `instr` is a `StoreInstruction` or a `WriteSideEffectInstruction` that writes to an address.
- * The addresses is computed using `address`, and `certain` is `true` if the write is guaranteed to overwrite
- * the entire variable.
- */
-cached
-predicate explicitWrite(boolean certain, Instruction instr, Instruction address) {
-  exists(StoreInstruction store |
-    store = instr and addressFlowTC(address, store.getDestinationAddress())
-  |
-    // Set `certain = false` if the address is derived from any instructions that prevents us from
-    // concluding that the entire variable is overridden.
-    if
-      addressFlowTC(any(Instruction i |
-          i instanceof FieldAddressInstruction or
-          i instanceof PointerArithmeticInstruction or
-          i instanceof LoadInstruction or
-          i instanceof InheritanceConversionInstruction
-        ), store.getDestinationAddress())
-    then certain = false
-    else certain = true
-  )
-  or
-  addressFlowTC(address, instr.(WriteSideEffectInstruction).getDestinationAddress()) and
-  certain = false
-}
-
-cached
-private module Cached {
-  private predicate defUseFlow(Node nodeFrom, Node nodeTo) {
-    exists(IRBlock bb1, int i1, IRBlock bb2, int i2, DefOrUse defOrUse, Use use |
-      defOrUse.hasRankInBlock(bb1, i1) and
-      use.hasRankInBlock(bb2, i2) and
-      adjacentDefRead(_, bb1, i1, bb2, i2) and
-      nodeFrom.asInstruction() = toInstruction(defOrUse) and
-      flowOutOfAddressStep(use.getOperand(), nodeTo)
-    )
-  }
-
-  private predicate fromStoreNode(StoreNodeInstr nodeFrom, Node nodeTo) {
-    // Def-use flow from a `StoreNode`.
-    exists(IRBlock bb1, int i1, IRBlock bb2, int i2, Def def, Use use |
-      nodeFrom.isTerminal() and
-      def.getInstruction() = nodeFrom.getStoreInstruction() and
-      def.hasRankInBlock(bb1, i1) and
-      adjacentDefRead(_, bb1, i1, bb2, i2) and
-      use.hasRankInBlock(bb2, i2) and
-      flowOutOfAddressStep(use.getOperand(), nodeTo)
-    )
-    or
-    // This final case is a bit annoying. The write side effect on an expression like `a = new A;` writes
-    // to a fresh address returned by `operator new`, and there's no easy way to use the shared SSA
-    // library to hook that up to the assignment to `a`. So instead we flow to the _first_ use of the
-    // value computed by `operator new` that occurs after `nodeFrom` (to avoid a loop in the
-    // dataflow graph).
-    exists(WriteSideEffectInstruction write, IRBlock bb, int i1, int i2, Operand op |
-      nodeFrom.getInstruction().(CallInstruction).getStaticCallTarget() instanceof
-        Alloc::OperatorNewAllocationFunction and
-      write = nodeFrom.getStoreInstruction() and
-      bb.getInstruction(i1) = write and
-      bb.getInstruction(i2) = op.getUse() and
-      // Flow to an instruction that occurs later in the block.
-      conversionFlow*(nodeFrom.getInstruction(), op.getDef()) and
-      nodeTo.asOperand() = op and
-      i2 > i1 and
-      // There is no previous instruction that also occurs after `nodeFrom`.
-      not exists(Instruction instr, int i |
-        bb.getInstruction(i) = instr and
-        conversionFlow(instr, op.getDef()) and
-        i1 < i and
-        i < i2
-      )
-    )
-  }
-
-  private predicate fromReadNode(ReadNode nodeFrom, Node nodeTo) {
-    exists(IRBlock bb1, int i1, IRBlock bb2, int i2, Use use1, Use use2 |
-      use1.hasRankInBlock(bb1, i1) and
-      use2.hasRankInBlock(bb2, i2) and
-      use1.getOperand().getDef() = nodeFrom.getInstruction() and
-      adjacentDefRead(_, bb1, i1, bb2, i2) and
-      flowOutOfAddressStep(use2.getOperand(), nodeTo)
-    )
-  }
-
-  private predicate fromPhiNode(SsaPhiNode nodeFrom, Node nodeTo) {
-    exists(PhiNode phi, Use use, IRBlock block, int rnk |
-      phi = nodeFrom.getPhiNode() and
-      adjacentDefRead(phi, _, _, block, rnk) and
-      use.hasRankInBlock(block, rnk) and
-      flowOutOfAddressStep(use.getOperand(), nodeTo)
-    )
-  }
-
-  private predicate toPhiNode(Node nodeFrom, SsaPhiNode nodeTo) {
-    // Flow to phi nodes
-    exists(Def def, IRBlock block, int rnk |
-      def.hasRankInBlock(block, rnk) and
-      nodeTo.hasInputAtRankInBlock(block, rnk)
-    |
-      exists(StoreNodeInstr storeNode |
-        storeNode = nodeFrom and
-        storeNode.isTerminal() and
-        def.getInstruction() = storeNode.getStoreInstruction()
-      )
-      or
-      def.getInstruction() = nodeFrom.asInstruction()
-    )
-    or
-    // Phi -> phi flow
-    nodeTo.hasInputAtRankInBlock(_, _, nodeFrom.(SsaPhiNode).getPhiNode())
-  }
-
-  /**
-   * Holds if `nodeFrom` is a read or write, and `nTo` is the next subsequent read of the variable
-   * written (or read) by `storeOrRead`.
-   */
-  cached
-  predicate ssaFlow(Node nodeFrom, Node nodeTo) {
-    // Def-use/use-use flow from an `InstructionNode`.
-    defUseFlow(nodeFrom, nodeTo)
-    or
-    // Def-use flow from a `StoreNode`.
-    fromStoreNode(nodeFrom, nodeTo)
-    or
-    // Use-use flow from a `ReadNode`.
-    fromReadNode(nodeFrom, nodeTo)
-    or
-    fromPhiNode(nodeFrom, nodeTo)
-    or
-    toPhiNode(nodeFrom, nodeTo)
-    or
-    // When we want to transfer flow out of a `StoreNode` we perform two steps:
-    // 1. Find the next use of the address being stored to
-    // 2. Find the `LoadInstruction` that loads the address
-    // When the address being stored into doesn't have a `LoadInstruction` associated with it because it's
-    // passed into a `CallInstruction` we transfer flow to the `ReadSideEffect`, which will then flow into
-    // the callee. We then pickup the flow from the `InitializeIndirectionInstruction` and use the shared
-    // SSA library to determine where the next use of the address that received the flow is.
-    exists(Node init, Node mid |
-      nodeFrom.asInstruction().(InitializeIndirectionInstruction).getIRVariable() =
-        init.asInstruction().(InitializeParameterInstruction).getIRVariable() and
-      // No need for the flow if the next use is the instruction that returns the flow out of the callee.
-      not mid.asInstruction() instanceof ReturnIndirectionInstruction and
-      // Find the next use of the address
-      ssaFlow(init, mid) and
-      // And flow to the next load of that address
-      flowOutOfAddressStep([mid.asInstruction().getAUse(), mid.asOperand()], nodeTo)
-    )
-  }
-
-  /**
-   * Holds if `iTo` is a conversion-like instruction that copies
-   * the value computed by `iFrom`.
-   *
-   * This predicate is used by `fromStoreNode` to find the next use of a pointer that
-   * points to freshly allocated memory.
-   */
-  private predicate conversionFlow(Instruction iFrom, Instruction iTo) {
-    iTo.(CopyValueInstruction).getSourceValue() = iFrom
-    or
-    iTo.(ConvertInstruction).getUnary() = iFrom
-    or
-    iTo.(CheckedConvertOrNullInstruction).getUnary() = iFrom
-    or
-    iTo.(InheritanceConversionInstruction).getUnary() = iFrom
-  }
-
-  pragma[noinline]
-  private predicate callTargetHasInputOutput(
-    CallInstruction call, DataFlow::FunctionInput input, DataFlow::FunctionOutput output
-  ) {
-    exists(DataFlow::DataFlowFunction func |
-      call.getStaticCallTarget() = func and
-      func.hasDataFlow(input, output)
-    )
-  }
-
-  /**
-   * The role of `flowOutOfAddressStep` is to select the node for which we want dataflow to end up in
-   * after the shared SSA library's `adjacentDefRead` predicate has determined that `operand` is the
-   * next use of some variable.
-   *
-   * More precisely, this predicate holds if `operand` is an operand that represents an address, and:
-   * - `nodeTo` is the next load of that address, or
-   * - `nodeTo` is a `ReadNode` that uses the definition of `operand` to start a sequence of reads, or
-   * - `nodeTo` is the outer-most `StoreNode` that uses the address represented by `operand`. We obtain
-   *    use-use flow in this case since `StoreNodeFlow::flowOutOf` will then provide flow to the next of
-   *    of `operand`.
-   *
-   * There is one final (slightly annoying) case: When `operand` is a an argument to a modeled function
-   * without any `ReadSideEffect` (such as `std::move`). Here, the address flows from the argument to
-   * the return value, which might then be read later.
-   */
-  private predicate flowOutOfAddressStep(Operand operand, Node nodeTo) {
-    // Flow into a read node
-    exists(ReadNode readNode | readNode = nodeTo |
-      readNode.isInitial() and
-      operand.getDef() = readNode.getInstruction()
-    )
-    or
-    exists(StoreNodeInstr storeNode, Instruction def |
-      storeNode = nodeTo and
-      def = operand.getDef()
-    |
-      storeNode.isTerminal() and
-      not addressFlow(def, _) and
-      // Only transfer flow to a store node if it doesn't immediately overwrite the address
-      // we've just written to.
-      explicitWrite(false, storeNode.getStoreInstruction(), def)
-    )
-    or
-    // The destination of a store operation has undergone lvalue-to-rvalue conversion and is now a
-    // right-hand-side of a store operation.
-    // Find the next use of the variable in that store operation, and recursively find the load of that
-    // pointer. For example, consider this case:
-    //
-    // ```cpp
-    // int x = source();
-    // int* p = &x;
-    // sink(*p);
-    // ```
-    //
-    // if we want to find the load of the address of `x`, we see that the pointer is stored into `p`,
-    // and we then need to recursively look for the load of `p`.
-    exists(
-      Def def, StoreInstruction store, IRBlock block1, int rnk1, Use use, IRBlock block2, int rnk2
-    |
-      store = def.getInstruction() and
-      store.getSourceValueOperand() = operand and
-      def.hasRankInBlock(block1, rnk1) and
-      use.hasRankInBlock(block2, rnk2) and
-      adjacentDefRead(_, block1, rnk1, block2, rnk2)
-    |
-      // The shared SSA library has determined that `use` is the next use of the operand
-      // so we find the next load of that use (but only if there is no `PostUpdateNode`) we
-      // need to flow into first.
-      not StoreNodeFlow::flowInto(store, _) and
-      flowOutOfAddressStep(use.getOperand(), nodeTo)
-      or
-      // It may also be the case that `store` gives rise to another store step. So let's make sure that
-      // we also take those into account.
-      StoreNodeFlow::flowInto(store, nodeTo)
-    )
-    or
-    // As we find the next load of an address, we might come across another use of the same variable.
-    // In that case, we recursively find the next use of _that_ operand, and continue searching for
-    // the next load of that operand. For example, consider this case:
-    //
-    // ```cpp
-    // int x = source();
-    // use(&x);
-    // int* p = &x;
-    // sink(*p);
-    // ```
-    //
-    // The next use of `x` after its definition is `use(&x)`, but there is a later load of the address
-    // of `x` that we want to flow to. So we use the shared SSA library to find the next load.
-    not operand = getSourceAddressOperand(_) and
-    exists(Use use1, Use use2, IRBlock block1, int rnk1, IRBlock block2, int rnk2 |
-      use1.getOperand() = operand and
-      use1.hasRankInBlock(block1, rnk1) and
-      // Don't flow to the next use if this use is part of a store operation that totally
-      // overrides a variable.
-      not explicitWrite(true, _, use1.getOperand().getDef()) and
-      adjacentDefRead(_, block1, rnk1, block2, rnk2) and
-      use2.hasRankInBlock(block2, rnk2) and
-      flowOutOfAddressStep(use2.getOperand(), nodeTo)
-    )
-    or
-    operand = getSourceAddressOperand(nodeTo.asInstruction())
-    or
-    exists(ReturnIndirectionInstruction ret |
-      ret.getSourceAddressOperand() = operand and
-      ret = nodeTo.asInstruction()
-    )
-    or
-    exists(ReturnValueInstruction ret |
-      ret.getReturnAddressOperand() = operand and
-      nodeTo.asInstruction() = ret
-    )
-    or
-    exists(CallInstruction call, int index, ReadSideEffectInstruction read |
-      call.getArgumentOperand(index) = operand and
-      read = getSideEffectFor(call, index) and
-      nodeTo.asOperand() = read.getSideEffectOperand()
-    )
-    or
-    exists(CopyInstruction copy |
-      not exists(getSourceAddressOperand(copy)) and
-      copy.getSourceValueOperand() = operand and
-      flowOutOfAddressStep(copy.getAUse(), nodeTo)
-    )
-    or
-    exists(ConvertInstruction convert |
-      convert.getUnaryOperand() = operand and
-      flowOutOfAddressStep(convert.getAUse(), nodeTo)
-    )
-    or
-    exists(CheckedConvertOrNullInstruction convert |
-      convert.getUnaryOperand() = operand and
-      flowOutOfAddressStep(convert.getAUse(), nodeTo)
-    )
-    or
-    exists(InheritanceConversionInstruction convert |
-      convert.getUnaryOperand() = operand and
-      flowOutOfAddressStep(convert.getAUse(), nodeTo)
-    )
-    or
-    exists(PointerArithmeticInstruction arith |
-      arith.getLeftOperand() = operand and
-      flowOutOfAddressStep(arith.getAUse(), nodeTo)
-    )
-    or
-    // Flow through a modeled function that has parameter -> return value flow.
-    exists(
-      CallInstruction call, int index, DataFlow::FunctionInput input,
-      DataFlow::FunctionOutput output
-    |
-      callTargetHasInputOutput(call, input, output) and
-      call.getArgumentOperand(index) = operand and
-      not getSideEffectFor(call, index) instanceof ReadSideEffectInstruction and
-      input.isParameter(index) and
-      output.isReturnValue() and
-      flowOutOfAddressStep(call.getAUse(), nodeTo)
-    )
-  }
-}
-
-import Cached
-
-/**
- * Holds if the `i`'th write in block `bb` writes to the variable `v`.
- * `certain` is `true` if the write is guaranteed to overwrite the entire variable.
- */
-predicate variableWrite(IRBlock bb, int i, SourceVariable v, boolean certain) {
-  DataFlowImplCommon::forceCachingInSameStage() and
-  exists(Def def |
-    def.hasRankInBlock(bb, i) and
-    v = def.getSourceVariable() and
-    (if def.isCertain() then certain = true else certain = false)
-  )
-}
-
-/**
- * Holds if the `i`'th read in block `bb` reads to the variable `v`.
- * `certain` is `true` if the read is guaranteed. For C++, this is always the case.
- */
-predicate variableRead(IRBlock bb, int i, SourceVariable v, boolean certain) {
-  exists(Use use |
-    use.hasRankInBlock(bb, i) and
-    v = use.getSourceVariable() and
-    certain = true
-  )
-}