Apply generator fixes to past changelogs

.github/workflows/ql-for-ql-build.yml

@@ -27,7 +27,7 @@ jobs:
       ### Build the extractor ###
       - name: Cache entire extractor
         id: cache-extractor
-        uses: actions/cache@v4
+        uses: actions/cache@v3
         with:
           path: |
             ql/extractor-pack/
@@ -35,7 +35,7 @@ jobs:
           key: ${{ runner.os }}-${{ steps.os_version.outputs.version }}-extractor-${{ hashFiles('ql/**/Cargo.lock') }}-${{ hashFiles('shared/tree-sitter-extractor') }}-${{ hashFiles('ql/**/*.rs') }}
       - name: Cache cargo
         if: steps.cache-extractor.outputs.cache-hit != 'true'
-        uses: actions/cache@v4
+        uses: actions/cache@v3
         with:
           path: |
             ~/.cargo/registry

.github/workflows/ql-for-ql-dataset_measure.yml

@@ -30,7 +30,7 @@ jobs:
           languages: javascript # does not matter
       - uses: ./.github/actions/os-version
         id: os_version
-      - uses: actions/cache@v4
+      - uses: actions/cache@v3
         with:
           path: |
             ~/.cargo/registry

.github/workflows/ql-for-ql-tests.yml

@@ -29,7 +29,7 @@ jobs:
           languages: javascript # does not matter
       - uses: ./.github/actions/os-version
         id: os_version
-      - uses: actions/cache@v4
+      - uses: actions/cache@v3
         with:
           path: |
             ~/.cargo/registry
@@ -74,7 +74,7 @@ jobs:
           languages: javascript # does not matter
       - uses: ./.github/actions/os-version
         id: os_version
-      - uses: actions/cache@v4
+      - uses: actions/cache@v3
         with:
           path: |
             ~/.cargo/registry

.github/workflows/ruby-build.yml

@@ -54,7 +54,7 @@ jobs:
       - uses: ./.github/actions/os-version
         id: os_version
       - name: Cache entire extractor
-        uses: actions/cache@v4
+        uses: actions/cache@v3
         id: cache-extractor
         with:
           path: |
@@ -62,7 +62,7 @@ jobs:
             ruby/extractor/target/release/codeql-extractor-ruby.exe
             ruby/extractor/ql/lib/codeql/ruby/ast/internal/TreeSitter.qll
           key: ${{ runner.os }}-${{ steps.os_version.outputs.version }}-ruby-extractor-${{ hashFiles('ruby/extractor/rust-toolchain.toml', 'ruby/extractor/Cargo.lock') }}-${{ hashFiles('shared/tree-sitter-extractor') }}-${{ hashFiles('ruby/extractor/**/*.rs') }}
-      - uses: actions/cache@v4
+      - uses: actions/cache@v3
         if: steps.cache-extractor.outputs.cache-hit != 'true'
         with:
           path: |

cpp/ql/lib/CHANGELOG.md

@@ -1,24 +1,3 @@
-## 0.12.3
-
-### Deprecated APIs
-
-* The `isUserInput`, `userInputArgument`, and `userInputReturned` predicates from `SecurityOptions` have been deprecated. Use `FlowSource` instead.
-
-### New Features
-
-* `UserDefineLiteral` and `DeductionGuide` classes have been added, representing C++11 user defined literals and C++17 deduction guides.
-
-### Minor Analysis Improvements
-
-* Changed the output of `Node.toString` to better reflect how many indirections a given dataflow node has.
-* Added a new predicate `Node.asDefinition` on `DataFlow::Node`s for selecting the dataflow node corresponding to a particular definition.
-* The deprecated `DefaultTaintTracking` library has been removed.
-* The `Guards` library has been replaced with the API-compatible `IRGuards` implementation, which has better precision in some cases.
-
-### Bug Fixes
-
-* Under certain circumstances a function declaration that is not also a definition could be associated with a `Function` that did not have the definition as a `FunctionDeclarationEntry`. This is now fixed when only one definition exists, and a unique `Function` will exist that has both the declaration and the definition as a `FunctionDeclarationEntry`.
-
 ## 0.12.2
 
 No user-facing changes.

cpp/ql/lib/change-notes/2022-11-21-ir-guards-replacement.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The `Guards` library has been replaced with the API-compatible `IRGuards` implementation, which has better precision in some cases.

cpp/ql/lib/change-notes/2023-11-25-default-taint-tracking-removal.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The deprecated `DefaultTaintTracking` library has been removed.

cpp/ql/lib/change-notes/2023-11-30-as-definition.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added a new predicate `Node.asDefinition` on `DataFlow::Node`s for selecting the dataflow node corresponding to a particular definition.

cpp/ql/lib/change-notes/2023-12-08-ususerinput-deprecation.md

@@ -0,0 +1,4 @@
+---
+category: deprecated
+---
+* The `isUserInput`, `userInputArgument`, and `userInputReturned` predicates from `SecurityOptions` have been deprecated. Use `FlowSource` instead.

cpp/ql/lib/change-notes/2023-12-14-dataflow-tostring.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Changed the output of `Node.toString` to better reflect how many indirections a given dataflow node has.

cpp/ql/lib/change-notes/2023-12-22-unique-function.md

@@ -0,0 +1,4 @@
+---
+category: fix
+---
+* Under certain circumstances a function declaration that is not also a definition could be associated with a `Function` that did not have the definition as a `FunctionDeclarationEntry`. This is now fixed when only one definition exists, and a unique `Function` will exist that has both the declaration and the definition as a `FunctionDeclarationEntry`.

cpp/ql/lib/change-notes/2024-01-02-function-types.md

@@ -0,0 +1,4 @@
+---
+category: feature
+---
+* `UserDefineLiteral` and `DeductionGuide` classes have been added, representing C++11 user defined literals and C++17 deduction guides.

cpp/ql/lib/change-notes/released/0.12.3.md

@@ -1,20 +0,0 @@
-## 0.12.3
-
-### Deprecated APIs
-
-* The `isUserInput`, `userInputArgument`, and `userInputReturned` predicates from `SecurityOptions` have been deprecated. Use `FlowSource` instead.
-
-### New Features
-
-* `UserDefineLiteral` and `DeductionGuide` classes have been added, representing C++11 user defined literals and C++17 deduction guides.
-
-### Minor Analysis Improvements
-
-* Changed the output of `Node.toString` to better reflect how many indirections a given dataflow node has.
-* Added a new predicate `Node.asDefinition` on `DataFlow::Node`s for selecting the dataflow node corresponding to a particular definition.
-* The deprecated `DefaultTaintTracking` library has been removed.
-* The `Guards` library has been replaced with the API-compatible `IRGuards` implementation, which has better precision in some cases.
-
-### Bug Fixes
-
-* Under certain circumstances a function declaration that is not also a definition could be associated with a `Function` that did not have the definition as a `FunctionDeclarationEntry`. This is now fixed when only one definition exists, and a unique `Function` will exist that has both the declaration and the definition as a `FunctionDeclarationEntry`.

cpp/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.12.3
+lastReleaseVersion: 0.12.2

cpp/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/cpp-all
-version: 0.12.4-dev
+version: 0.12.3-dev
 groups: cpp
 dbscheme: semmlecode.cpp.dbscheme
 extractor: cpp

cpp/ql/lib/semmle/code/cpp/Element.qll

@@ -7,6 +7,7 @@ import semmle.code.cpp.Location
 private import semmle.code.cpp.Enclosing
 private import semmle.code.cpp.internal.ResolveClass
 private import semmle.code.cpp.internal.ResolveGlobalVariable
+private import semmle.code.cpp.internal.ResolveFunction
 
 /**
  * Get the `Element` that represents this `@element`.
@@ -30,11 +31,14 @@ pragma[inline]
 @element unresolveElement(Element e) {
   not result instanceof @usertype and
   not result instanceof @variable and
+  not result instanceof @function and
   result = e
   or
   e = resolveClass(result)
   or
   e = resolveGlobalVariable(result)
+  or
+  e = resolveFunction(result)
 }
 
 /**

cpp/ql/lib/semmle/code/cpp/Function.qll

@@ -9,6 +9,7 @@ import semmle.code.cpp.exprs.Call
 import semmle.code.cpp.metrics.MetricFunction
 import semmle.code.cpp.Linkage
 private import semmle.code.cpp.internal.ResolveClass
+private import semmle.code.cpp.internal.ResolveFunction
 
 /**
  * A C/C++ function [N4140 8.3.5]. Both member functions and non-member
@@ -25,6 +26,8 @@ private import semmle.code.cpp.internal.ResolveClass
  * in more detail in `Declaration.qll`.
  */
 class Function extends Declaration, ControlFlowNode, AccessHolder, @function {
+  Function() { isFunction(underlyingElement(this)) }
+
   override string getName() { functions(underlyingElement(this), result, _) }
 
   /**

cpp/ql/lib/semmle/code/cpp/internal/ResolveFunction.qll

@@ -0,0 +1,57 @@
+private predicate hasDefinition(@function f) {
+  exists(@fun_decl fd | fun_decls(fd, f, _, _, _) | fun_def(fd))
+}
+
+private predicate onlyOneCompleteFunctionExistsWithMangledName(@mangledname name) {
+  strictcount(@function f | hasDefinition(f) and mangled_name(f, name)) = 1
+}
+
+/** Holds if `f` is a unique function with a definition named `name`. */
+private predicate isFunctionWithMangledNameAndWithDefinition(@mangledname name, @function f) {
+  hasDefinition(f) and
+  mangled_name(f, name) and
+  onlyOneCompleteFunctionExistsWithMangledName(name)
+}
+
+/** Holds if `f` is a function without a definition named `name`. */
+private predicate isFunctionWithMangledNameAndWithoutDefinition(@mangledname name, @function f) {
+  not hasDefinition(f) and
+  mangled_name(f, name)
+}
+
+/**
+ * Holds if `incomplete` is a function without a definition, and there exists
+ * a unique function `complete` with the same name that does have a definition.
+ */
+private predicate hasTwinWithDefinition(@function incomplete, @function complete) {
+  not function_instantiation(incomplete, complete) and
+  (
+    not compgenerated(incomplete) or
+    not compgenerated(complete)
+  ) and
+  exists(@mangledname name |
+    isFunctionWithMangledNameAndWithoutDefinition(name, incomplete) and
+    isFunctionWithMangledNameAndWithDefinition(name, complete)
+  )
+}
+
+import Cached
+
+cached
+private module Cached {
+  /**
+   * If `f` is a function without a definition, and there exists a unique
+   * function with the same name that does have a definition, then the
+   * result is that unique function. Otherwise, the result is `f`.
+   */
+  cached
+  @function resolveFunction(@function f) {
+    hasTwinWithDefinition(f, result)
+    or
+    not hasTwinWithDefinition(f, _) and
+    result = f
+  }
+
+  cached
+  predicate isFunction(@function f) { f = resolveFunction(_) }
+}

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternals.qll

@@ -149,16 +149,11 @@ private newtype TDefOrUseImpl =
 private predicate isGlobalUse(
   GlobalLikeVariable v, IRFunction f, int indirection, int indirectionIndex
 ) {
-  // Generate a "global use" at the end of the function body if there's a
-  // direct definition somewhere in the body of the function
-  indirection =
-    min(int cand, VariableAddressInstruction vai |
-      vai.getEnclosingIRFunction() = f and
-      vai.getAstVariable() = v and
-      isDef(_, _, _, vai, cand, indirectionIndex)
-    |
-      cand
-    )
+  exists(VariableAddressInstruction vai |
+    vai.getEnclosingIRFunction() = f and
+    vai.getAstVariable() = v and
+    isDef(_, _, _, vai, indirection, indirectionIndex)
+  )
 }
 
 private predicate isGlobalDefImpl(
@@ -452,57 +447,6 @@ class FinalParameterUse extends UseImpl, TFinalParameterUse {
   }
 }
 
-/**
- * A use that models a synthetic "last use" of a global variable just before a
- * function returns.
- *
- * We model global variable flow by:
- * - Inserting a last use of any global variable that's modified by a function
- * - Flowing from the last use to the `VariableNode` that represents the global
- *   variable.
- * - Flowing from the `VariableNode` to an "initial def" of the global variable
- * in any function that may read the global variable.
- * - Flowing from the initial definition to any subsequent uses of the global
- *   variable in the function body.
- *
- * For example, consider the following pair of functions:
- * ```cpp
- * int global;
- * int source();
- * void sink(int);
- *
- * void set_global() {
- *   global = source();
- * }
- *
- * void read_global() {
- *  sink(global);
- * }
- * ```
- * we insert global uses and defs so that (from the point-of-view of dataflow)
- * the above scenario looks like:
- * ```cpp
- * int global; // (1)
- * int source();
- * void sink(int);
- *
- * void set_global() {
- *   global = source();
- *   __global_use(global); // (2)
- * }
- *
- * void read_global() {
- *  global = __global_def; // (3)
- *  sink(global); // (4)
- * }
- * ```
- * and flow from `source()` to the argument of `sink` is then modeled as
- * follows:
- * 1. Flow from `source()` to `(2)` (via SSA).
- * 2. Flow from `(2)` to `(1)` (via a `jumpStep`).
- * 3. Flow from `(1)` to `(3)` (via a `jumpStep`).
- * 4. Flow from `(3)` to `(4)` (via SSA).
- */
 class GlobalUse extends UseImpl, TGlobalUse {
   GlobalLikeVariable global;
   IRFunction f;
@@ -550,12 +494,6 @@ class GlobalUse extends UseImpl, TGlobalUse {
   override BaseSourceVariableInstruction getBase() { none() }
 }
 
-/**
- * A definition that models a synthetic "initial definition" of a global
- * variable just after the function entry point.
- *
- * See the QLDoc for `GlobalUse` for how this is used.
- */
 class GlobalDefImpl extends DefOrUseImpl, TGlobalDefImpl {
   GlobalLikeVariable global;
   IRFunction f;

cpp/ql/src/CHANGELOG.md

@@ -1,14 +1,3 @@
-## 0.9.2
-
-### New Queries
-
-* Added a new query, `cpp/use-of-unique-pointer-after-lifetime-ends`, to detect uses of the contents unique pointers that will be destroyed immediately.
-* The `cpp/incorrectly-checked-scanf` query has been added. This finds results where the return value of scanf is not checked correctly. Some of these were previously found by `cpp/missing-check-scanf` and will no longer be reported there.
-
-### Minor Analysis Improvements
-
-* The `cpp/badly-bounded-write` query could report false positives when a pointer was first initialized with a literal and later assigned a dynamically allocated array. These false positives now no longer occur.
-
 ## 0.9.1
 
 No user-facing changes.

cpp/ql/src/change-notes/2023-12-04-incorrectly-checked-scanf.md

@@ -0,0 +1,4 @@
+---
+category: newQuery
+---
+* The `cpp/incorrectly-checked-scanf` query has been added. This finds results where the return value of scanf is not checked correctly. Some of these were previously found by `cpp/missing-check-scanf` and will no longer be reported there.

cpp/ql/src/change-notes/2023-12-12-use-of-unique-pointer-after-lifetime-ends.md

@@ -0,0 +1,4 @@
+---
+category: newQuery
+---
+* Added a new query, `cpp/use-of-unique-pointer-after-lifetime-ends`, to detect uses of the contents unique pointers that will be destroyed immediately.

cpp/ql/src/change-notes/2023-12-15-badly-bounded-write.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The `cpp/badly-bounded-write` query could report false positives when a pointer was first initialized with a literal and later assigned a dynamically allocated array. These false positives now no longer occur.

cpp/ql/src/change-notes/2024-01-09-add-exception-to-av-rule-32.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* The `cpp/include-non-header` style query will now ignore the `.def` extension for textual header inclusions.

cpp/ql/src/change-notes/released/0.9.2.md

@@ -1,10 +0,0 @@
-## 0.9.2
-
-### New Queries
-
-* Added a new query, `cpp/use-of-unique-pointer-after-lifetime-ends`, to detect uses of the contents unique pointers that will be destroyed immediately.
-* The `cpp/incorrectly-checked-scanf` query has been added. This finds results where the return value of scanf is not checked correctly. Some of these were previously found by `cpp/missing-check-scanf` and will no longer be reported there.
-
-### Minor Analysis Improvements
-
-* The `cpp/badly-bounded-write` query could report false positives when a pointer was first initialized with a literal and later assigned a dynamically allocated array. These false positives now no longer occur.

cpp/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.9.2
+lastReleaseVersion: 0.9.1

cpp/ql/src/experimental/Security/CWE/CWE-1240/CustomCryptographicPrimitive.ql

@@ -60,7 +60,7 @@ predicate computeHeuristicType(Type t) {
 
 /**
  * Holds if `e` is an operation that is common in encryption-like computations.
- * Looking for clusters of these tends to find things like encryption,
+ * Looking for clusters of these tends to find things like encrpytion,
  * compression, random number generation, graphics processing and other compute
  * heavy algorithms.
  */

cpp/ql/src/jsf/4.06 Pre-Processing Directives/AV Rule 32.ql

@@ -18,7 +18,6 @@ from Include i, File f, string extension
 where
   f = i.getIncludedFile() and
   extension = f.getExtension().toLowerCase() and
-  extension != "def" and
   extension != "inc" and
   extension != "inl" and
   extension != "tcc" and

cpp/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/cpp-queries
-version: 0.9.3-dev
+version: 0.9.2-dev
 groups:
   - cpp
   - queries

cpp/ql/test/library-tests/c++_exceptions/graphable.expected

@@ -1,388 +1,384 @@
-| C::C | false | 499 | 499 | C |
-| C::C | false | 690 | 690 | C |
-| C::operator= | false | 681 | 681 | operator= |
-| C::~C | false | 647 | 647 | ~C |
-| Error::Error | false | 205 | 205 | Error |
-| Error::Error | false | 219 | 219 | Error |
-| Error::Error | false | 224 | 224 | return ... |
-| Error::Error | false | 226 | 226 | { ... } |
-| Error::Error | true | 224 | 219 |  |
-| Error::Error | true | 226 | 224 |  |
-| Error::operator= | false | 197 | 197 | operator= |
-| Error::~Error | false | 209 | 209 | ~Error |
-| Error::~Error | false | 215 | 215 | return ... |
-| Error::~Error | false | 217 | 217 | { ... } |
-| Error::~Error | true | 215 | 209 |  |
-| Error::~Error | true | 217 | 215 |  |
-| __va_list_tag::operator= | false | 66 | 66 | operator= |
-| __va_list_tag::operator= | false | 72 | 72 | operator= |
-| f | false | 483 | 483 | f |
-| f | false | 494 | 494 | declaration |
-| f | false | 497 | 497 | call to C |
-| f | false | 502 | 502 | 101 |
-| f | false | 503 | 503 | initializer for c101 |
-| f | false | 506 | 506 | __try { ... } __except( ... ) { ... } |
-| f | false | 509 | 509 | call to C |
-| f | false | 513 | 513 | 102 |
-| f | false | 514 | 514 | initializer for c102 |
-| f | false | 518 | 518 | call to C |
-| f | false | 522 | 522 | 103 |
-| f | false | 523 | 523 | initializer for c103 |
-| f | false | 526 | 526 | declaration |
-| f | false | 528 | 528 | if (...) ...  |
-| f | false | 530 | 530 | b1 |
-| f | false | 532 | 532 | (bool)... |
-| f | false | 533 | 533 | ExprStmt |
-| f | false | 537 | 537 | 1 |
-| f | false | 538 | 538 | throw ... |
-| f | false | 540 | 540 | { ... } |
-| f | false | 542 | 542 | declaration |
-| f | false | 544 | 544 | { ... } |
-| f | false | 551 | 551 | 1 |
+| C::C | false | 493 | 493 | C |
+| C::C | false | 682 | 682 | C |
+| C::operator= | false | 675 | 675 | operator= |
+| C::~C | false | 614 | 614 | ~C |
+| Error::Error | false | 259 | 259 | Error |
+| Error::Error | false | 272 | 272 | Error |
+| Error::Error | false | 277 | 277 | return ... |
+| Error::Error | false | 279 | 279 | { ... } |
+| Error::Error | true | 277 | 272 |  |
+| Error::Error | true | 279 | 277 |  |
+| Error::operator= | false | 253 | 253 | operator= |
+| Error::~Error | false | 263 | 263 | ~Error |
+| Error::~Error | false | 268 | 268 | return ... |
+| Error::~Error | false | 270 | 270 | { ... } |
+| Error::~Error | true | 268 | 263 |  |
+| Error::~Error | true | 270 | 268 |  |
+| __va_list_tag::operator= | false | 140 | 140 | operator= |
+| __va_list_tag::operator= | false | 147 | 147 | operator= |
+| f | false | 477 | 477 | f |
+| f | false | 488 | 488 | declaration |
+| f | false | 491 | 491 | call to C |
+| f | false | 496 | 496 | 102 |
+| f | false | 497 | 497 | initializer for c102 |
+| f | false | 501 | 501 | call to C |
+| f | false | 505 | 505 | 103 |
+| f | false | 506 | 506 | initializer for c103 |
+| f | false | 509 | 509 | declaration |
+| f | false | 511 | 511 | b1 |
+| f | false | 513 | 513 | (bool)... |
+| f | false | 516 | 516 | 1 |
+| f | false | 517 | 517 | throw ... |
+| f | false | 519 | 519 | ExprStmt |
+| f | false | 521 | 521 | { ... } |
+| f | false | 523 | 523 | if (...) ...  |
+| f | false | 525 | 525 | declaration |
+| f | false | 527 | 527 | { ... } |
+| f | false | 534 | 534 | 1 |
+| f | false | 536 | 536 | call to C |
+| f | false | 540 | 540 | 104 |
+| f | false | 541 | 541 | initializer for c104 |
+| f | false | 544 | 544 | declaration |
+| f | false | 546 | 546 | { ... } |
+| f | false | 548 | 548 | __try { ... } __except( ... ) { ... } |
+| f | false | 550 | 550 | declaration |
 | f | false | 553 | 553 | call to C |
-| f | false | 557 | 557 | 104 |
-| f | false | 558 | 558 | initializer for c104 |
-| f | false | 561 | 561 | declaration |
-| f | false | 563 | 563 | { ... } |
-| f | false | 565 | 565 | declaration |
-| f | false | 568 | 568 | call to C |
-| f | false | 572 | 572 | 105 |
-| f | false | 573 | 573 | initializer for c105 |
-| f | false | 576 | 576 | __try { ... } __finally { ... } |
-| f | false | 579 | 579 | call to C |
-| f | false | 583 | 583 | 106 |
-| f | false | 584 | 584 | initializer for c106 |
-| f | false | 588 | 588 | call to C |
-| f | false | 592 | 592 | 107 |
-| f | false | 593 | 593 | initializer for c107 |
-| f | false | 596 | 596 | declaration |
-| f | false | 598 | 598 | if (...) ...  |
-| f | false | 600 | 600 | b2 |
-| f | false | 602 | 602 | (bool)... |
-| f | false | 603 | 603 | ExprStmt |
-| f | false | 607 | 607 | 2 |
-| f | false | 608 | 608 | throw ... |
-| f | false | 610 | 610 | { ... } |
-| f | false | 612 | 612 | declaration |
-| f | false | 614 | 614 | { ... } |
-| f | false | 617 | 617 | call to C |
-| f | false | 621 | 621 | 108 |
-| f | false | 622 | 622 | initializer for c108 |
-| f | false | 625 | 625 | declaration |
-| f | false | 627 | 627 | { ... } |
-| f | false | 629 | 629 | declaration |
-| f | false | 632 | 632 | call to C |
-| f | false | 636 | 636 | 109 |
-| f | false | 637 | 637 | initializer for c109 |
-| f | false | 640 | 640 | return ... |
-| f | false | 642 | 642 | { ... } |
-| f | false | 644 | 644 | c104 |
-| f | false | 646 | 646 | call to c104.~C |
-| f | false | 648 | 648 | c101 |
-| f | false | 650 | 650 | call to c101.~C |
-| f | false | 651 | 651 | c102 |
-| f | false | 653 | 653 | call to c102.~C |
-| f | false | 654 | 654 | c103 |
-| f | false | 655 | 655 | call to c103.~C |
-| f | false | 656 | 656 | c102 |
-| f | false | 657 | 657 | call to c102.~C |
-| f | false | 658 | 658 | c101 |
-| f | false | 659 | 659 | call to c101.~C |
-| f | false | 660 | 660 | c105 |
-| f | false | 661 | 661 | call to c105.~C |
-| f | false | 662 | 662 | c108 |
-| f | false | 664 | 664 | call to c108.~C |
-| f | false | 665 | 665 | c106 |
-| f | false | 667 | 667 | call to c106.~C |
-| f | false | 668 | 668 | c107 |
-| f | false | 669 | 669 | call to c107.~C |
-| f | false | 670 | 670 | c106 |
-| f | false | 671 | 671 | call to c106.~C |
-| f | false | 672 | 672 | c101 |
-| f | false | 673 | 673 | call to c101.~C |
-| f | false | 674 | 674 | c105 |
-| f | false | 675 | 675 | call to c105.~C |
-| f | false | 676 | 676 | c109 |
-| f | false | 677 | 677 | call to c109.~C |
-| f | true | 494 | 503 |  |
-| f | true | 497 | 506 |  |
-| f | true | 502 | 497 |  |
-| f | true | 503 | 502 |  |
-| f | true | 506 | 544 |  |
-| f | true | 509 | 528 |  |
-| f | true | 513 | 509 |  |
-| f | true | 514 | 513 |  |
-| f | true | 518 | 654 |  |
-| f | true | 522 | 518 |  |
-| f | true | 523 | 522 |  |
-| f | true | 526 | 514 |  |
-| f | true | 528 | 530 |  |
-| f | true | 530 | 540 | T |
-| f | true | 530 | 542 | F |
-| f | true | 533 | 537 |  |
-| f | true | 537 | 538 |  |
-| f | true | 538 | 656 |  |
-| f | true | 540 | 533 |  |
-| f | true | 542 | 523 |  |
-| f | true | 544 | 526 |  |
-| f | true | 551 | 563 | T |
-| f | true | 553 | 644 |  |
+| f | false | 557 | 557 | 106 |
+| f | false | 558 | 558 | initializer for c106 |
+| f | false | 562 | 562 | call to C |
+| f | false | 566 | 566 | 107 |
+| f | false | 567 | 567 | initializer for c107 |
+| f | false | 570 | 570 | declaration |
+| f | false | 572 | 572 | b2 |
+| f | false | 574 | 574 | (bool)... |
+| f | false | 577 | 577 | 2 |
+| f | false | 578 | 578 | throw ... |
+| f | false | 580 | 580 | ExprStmt |
+| f | false | 582 | 582 | { ... } |
+| f | false | 584 | 584 | if (...) ...  |
+| f | false | 586 | 586 | declaration |
+| f | false | 588 | 588 | { ... } |
+| f | false | 591 | 591 | call to C |
+| f | false | 595 | 595 | 108 |
+| f | false | 596 | 596 | initializer for c108 |
+| f | false | 599 | 599 | declaration |
+| f | false | 601 | 601 | { ... } |
+| f | false | 603 | 603 | __try { ... } __finally { ... } |
+| f | false | 605 | 605 | declaration |
+| f | false | 607 | 607 | return ... |
+| f | false | 609 | 609 | { ... } |
+| f | false | 611 | 611 | c101 |
+| f | false | 613 | 613 | call to c101.~C |
+| f | false | 615 | 615 | c105 |
+| f | false | 616 | 616 | call to c105.~C |
+| f | false | 617 | 617 | c109 |
+| f | false | 618 | 618 | call to c109.~C |
+| f | false | 619 | 619 | c101 |
+| f | false | 620 | 620 | call to c101.~C |
+| f | false | 621 | 621 | c105 |
+| f | false | 622 | 622 | call to c105.~C |
+| f | false | 623 | 623 | c108 |
+| f | false | 625 | 625 | call to c108.~C |
+| f | false | 626 | 626 | c106 |
+| f | false | 628 | 628 | call to c106.~C |
+| f | false | 629 | 629 | c107 |
+| f | false | 630 | 630 | call to c107.~C |
+| f | false | 631 | 631 | c106 |
+| f | false | 632 | 632 | call to c106.~C |
+| f | false | 633 | 633 | c104 |
+| f | false | 635 | 635 | call to c104.~C |
+| f | false | 636 | 636 | c102 |
+| f | false | 638 | 638 | call to c102.~C |
+| f | false | 639 | 639 | c103 |
+| f | false | 640 | 640 | call to c103.~C |
+| f | false | 641 | 641 | c102 |
+| f | false | 642 | 642 | call to c102.~C |
+| f | false | 644 | 644 | call to C |
+| f | false | 648 | 648 | 101 |
+| f | false | 649 | 649 | initializer for c101 |
+| f | false | 653 | 653 | call to C |
+| f | false | 657 | 657 | 105 |
+| f | false | 658 | 658 | initializer for c105 |
+| f | false | 662 | 662 | call to C |
+| f | false | 666 | 666 | 109 |
+| f | false | 667 | 667 | initializer for c109 |
+| f | true | 488 | 649 |  |
+| f | true | 491 | 523 |  |
+| f | true | 496 | 491 |  |
+| f | true | 497 | 496 |  |
+| f | true | 501 | 639 |  |
+| f | true | 505 | 501 |  |
+| f | true | 506 | 505 |  |
+| f | true | 509 | 497 |  |
+| f | true | 511 | 521 | T |
+| f | true | 511 | 525 | F |
+| f | true | 516 | 517 |  |
+| f | true | 517 | 641 |  |
+| f | true | 519 | 516 |  |
+| f | true | 521 | 519 |  |
+| f | true | 523 | 511 |  |
+| f | true | 525 | 506 |  |
+| f | true | 527 | 509 |  |
+| f | true | 534 | 546 | T |
+| f | true | 536 | 633 |  |
+| f | true | 540 | 536 |  |
+| f | true | 541 | 540 |  |
+| f | true | 544 | 541 |  |
+| f | true | 546 | 544 |  |
+| f | true | 548 | 527 |  |
+| f | true | 550 | 658 |  |
+| f | true | 553 | 584 |  |
 | f | true | 557 | 553 |  |
 | f | true | 558 | 557 |  |
-| f | true | 561 | 558 |  |
-| f | true | 563 | 561 |  |
-| f | true | 565 | 573 |  |
-| f | true | 568 | 576 |  |
-| f | true | 572 | 568 |  |
-| f | true | 573 | 572 |  |
-| f | true | 576 | 614 |  |
-| f | true | 579 | 598 |  |
-| f | true | 583 | 579 |  |
-| f | true | 584 | 583 |  |
-| f | true | 588 | 668 |  |
-| f | true | 592 | 588 |  |
-| f | true | 593 | 592 |  |
-| f | true | 596 | 584 |  |
-| f | true | 598 | 600 |  |
-| f | true | 600 | 610 | T |
-| f | true | 600 | 612 | F |
-| f | true | 603 | 607 |  |
-| f | true | 607 | 608 |  |
-| f | true | 608 | 670 |  |
-| f | true | 610 | 603 |  |
-| f | true | 612 | 593 |  |
-| f | true | 614 | 596 |  |
-| f | true | 617 | 662 |  |
-| f | true | 621 | 617 |  |
-| f | true | 622 | 621 |  |
-| f | true | 625 | 622 |  |
-| f | true | 627 | 625 |  |
-| f | true | 629 | 637 |  |
-| f | true | 632 | 640 |  |
-| f | true | 636 | 632 |  |
-| f | true | 637 | 636 |  |
-| f | true | 640 | 676 |  |
-| f | true | 642 | 494 |  |
-| f | true | 644 | 646 |  |
-| f | true | 646 | 565 |  |
-| f | true | 648 | 650 |  |
-| f | true | 650 | 483 |  |
-| f | true | 651 | 653 |  |
-| f | true | 653 | 565 |  |
-| f | true | 654 | 655 |  |
-| f | true | 655 | 651 |  |
-| f | true | 656 | 657 |  |
-| f | true | 657 | 551 |  |
-| f | true | 658 | 659 |  |
-| f | true | 659 | 483 |  |
-| f | true | 660 | 661 |  |
-| f | true | 661 | 658 |  |
-| f | true | 662 | 664 |  |
-| f | true | 664 | 629 |  |
-| f | true | 664 | 660 |  |
-| f | true | 665 | 667 |  |
-| f | true | 667 | 627 |  |
-| f | true | 668 | 669 |  |
-| f | true | 669 | 665 |  |
-| f | true | 670 | 671 |  |
-| f | true | 671 | 627 |  |
-| f | true | 672 | 673 |  |
-| f | true | 673 | 483 |  |
-| f | true | 674 | 675 |  |
-| f | true | 675 | 672 |  |
-| f | true | 676 | 677 |  |
-| f | true | 677 | 674 |  |
-| f1 | false | 287 | 287 | f1 |
-| f2 | false | 294 | 294 | f2 |
-| f3 | false | 299 | 299 | f3 |
-| f4 | false | 304 | 304 | f4 |
-| f4 | false | 422 | 422 | return ... |
-| f4 | false | 424 | 424 | { ... } |
-| f4 | true | 422 | 304 |  |
-| f4 | true | 424 | 422 |  |
-| f5 | false | 309 | 309 | f5 |
-| f5 | false | 409 | 409 | ExprStmt |
-| f5 | false | 413 | 413 | 3 |
-| f5 | false | 414 | 414 | throw ... |
-| f5 | false | 416 | 416 | { ... } |
-| f5 | true | 409 | 413 |  |
-| f5 | true | 413 | 414 |  |
-| f5 | true | 414 | 309 |  |
-| f5 | true | 416 | 409 |  |
-| fun | false | 276 | 276 | fun |
-| fun | false | 281 | 281 | try { ... } |
-| fun | false | 283 | 283 | try { ... } |
-| fun | false | 285 | 285 | ExprStmt |
-| fun | false | 290 | 290 | call to f1 |
-| fun | false | 292 | 292 | ExprStmt |
-| fun | false | 295 | 295 | call to f2 |
+| f | true | 562 | 629 |  |
+| f | true | 566 | 562 |  |
+| f | true | 567 | 566 |  |
+| f | true | 570 | 558 |  |
+| f | true | 572 | 582 | T |
+| f | true | 572 | 586 | F |
+| f | true | 577 | 578 |  |
+| f | true | 578 | 631 |  |
+| f | true | 580 | 577 |  |
+| f | true | 582 | 580 |  |
+| f | true | 584 | 572 |  |
+| f | true | 586 | 567 |  |
+| f | true | 588 | 570 |  |
+| f | true | 591 | 623 |  |
+| f | true | 595 | 591 |  |
+| f | true | 596 | 595 |  |
+| f | true | 599 | 596 |  |
+| f | true | 601 | 599 |  |
+| f | true | 603 | 588 |  |
+| f | true | 605 | 667 |  |
+| f | true | 607 | 617 |  |
+| f | true | 609 | 488 |  |
+| f | true | 611 | 613 |  |
+| f | true | 613 | 477 |  |
+| f | true | 615 | 616 |  |
+| f | true | 616 | 611 |  |
+| f | true | 617 | 618 |  |
+| f | true | 618 | 615 |  |
+| f | true | 619 | 620 |  |
+| f | true | 620 | 477 |  |
+| f | true | 621 | 622 |  |
+| f | true | 622 | 619 |  |
+| f | true | 623 | 625 |  |
+| f | true | 625 | 605 |  |
+| f | true | 625 | 621 |  |
+| f | true | 626 | 628 |  |
+| f | true | 628 | 601 |  |
+| f | true | 629 | 630 |  |
+| f | true | 630 | 626 |  |
+| f | true | 631 | 632 |  |
+| f | true | 632 | 601 |  |
+| f | true | 633 | 635 |  |
+| f | true | 635 | 550 |  |
+| f | true | 636 | 638 |  |
+| f | true | 638 | 550 |  |
+| f | true | 639 | 640 |  |
+| f | true | 640 | 636 |  |
+| f | true | 641 | 642 |  |
+| f | true | 642 | 534 |  |
+| f | true | 644 | 548 |  |
+| f | true | 648 | 644 |  |
+| f | true | 649 | 648 |  |
+| f | true | 653 | 603 |  |
+| f | true | 657 | 653 |  |
+| f | true | 658 | 657 |  |
+| f | true | 662 | 607 |  |
+| f | true | 666 | 662 |  |
+| f | true | 667 | 666 |  |
+| f1 | false | 292 | 292 | f1 |
+| f2 | false | 299 | 299 | f2 |
+| f3 | false | 304 | 304 | f3 |
+| f4 | false | 309 | 309 | f4 |
+| f4 | false | 433 | 433 | return ... |
+| f4 | false | 435 | 435 | { ... } |
+| f4 | true | 433 | 309 |  |
+| f4 | true | 435 | 433 |  |
+| f5 | false | 314 | 314 | f5 |
+| f5 | false | 422 | 422 | 3 |
+| f5 | false | 423 | 423 | throw ... |
+| f5 | false | 425 | 425 | ExprStmt |
+| f5 | false | 427 | 427 | { ... } |
+| f5 | true | 422 | 423 |  |
+| f5 | true | 423 | 314 |  |
+| f5 | true | 425 | 422 |  |
+| f5 | true | 427 | 425 |  |
+| fun | false | 287 | 287 | fun |
+| fun | false | 295 | 295 | call to f1 |
 | fun | false | 297 | 297 | ExprStmt |
-| fun | false | 300 | 300 | call to f3 |
+| fun | false | 300 | 300 | call to f2 |
 | fun | false | 302 | 302 | ExprStmt |
-| fun | false | 305 | 305 | call to f4 |
+| fun | false | 305 | 305 | call to f3 |
 | fun | false | 307 | 307 | ExprStmt |
-| fun | false | 310 | 310 | call to f5 |
+| fun | false | 310 | 310 | call to f4 |
 | fun | false | 312 | 312 | ExprStmt |
-| fun | false | 316 | 316 | 5 |
-| fun | false | 317 | 317 | throw ... |
-| fun | false | 319 | 319 | ExprStmt |
-| fun | false | 322 | 322 | call to g |
-| fun | false | 324 | 324 | { ... } |
+| fun | false | 315 | 315 | call to f5 |
+| fun | false | 317 | 317 | ExprStmt |
+| fun | false | 321 | 321 | 5 |
+| fun | false | 322 | 322 | throw ... |
+| fun | false | 324 | 324 | ExprStmt |
+| fun | false | 327 | 327 | call to g |
 | fun | false | 329 | 329 | ExprStmt |
-| fun | false | 332 | 332 | call to h |
-| fun | false | 334 | 334 | { ... } |
-| fun | false | 336 | 336 | <handler> |
-| fun | false | 337 | 337 | { ... } |
-| fun | false | 342 | 342 | ExprStmt |
-| fun | false | 345 | 345 | call to i |
-| fun | false | 347 | 347 | { ... } |
-| fun | false | 352 | 352 | ExprStmt |
-| fun | false | 355 | 355 | call to j |
-| fun | false | 357 | 357 | { ... } |
-| fun | false | 359 | 359 | <handler> |
-| fun | false | 360 | 360 | <handler> |
-| fun | false | 361 | 361 | ExprStmt |
-| fun | false | 364 | 364 | call to k |
-| fun | false | 366 | 366 | try { ... } |
-| fun | false | 368 | 368 | ExprStmt |
-| fun | false | 372 | 372 | 7 |
-| fun | false | 373 | 373 | throw ... |
-| fun | false | 375 | 375 | { ... } |
-| fun | false | 380 | 380 | ExprStmt |
-| fun | false | 383 | 383 | call to l |
-| fun | false | 385 | 385 | { ... } |
-| fun | false | 387 | 387 | ExprStmt |
-| fun | false | 390 | 390 | call to m |
-| fun | false | 392 | 392 | { ... } |
-| fun | false | 394 | 394 | <handler> |
-| fun | false | 395 | 395 | <handler> |
-| fun | false | 396 | 396 | ExprStmt |
-| fun | false | 399 | 399 | call to n |
-| fun | false | 401 | 401 | return ... |
-| fun | false | 403 | 403 | { ... } |
-| fun | true | 281 | 337 |  |
-| fun | true | 283 | 324 |  |
-| fun | true | 285 | 290 |  |
-| fun | true | 290 | 292 |  |
-| fun | true | 292 | 295 |  |
-| fun | true | 295 | 297 |  |
-| fun | true | 297 | 300 |  |
-| fun | true | 300 | 302 |  |
-| fun | true | 302 | 305 |  |
-| fun | true | 305 | 307 |  |
-| fun | true | 307 | 310 |  |
-| fun | true | 312 | 316 |  |
-| fun | true | 316 | 317 |  |
-| fun | true | 317 | 336 |  |
-| fun | true | 319 | 322 |  |
-| fun | true | 322 | 361 |  |
-| fun | true | 324 | 285 |  |
-| fun | true | 329 | 332 |  |
-| fun | true | 332 | 361 |  |
-| fun | true | 334 | 329 |  |
-| fun | true | 336 | 334 |  |
-| fun | true | 336 | 359 |  |
-| fun | true | 337 | 283 |  |
-| fun | true | 342 | 345 |  |
-| fun | true | 345 | 361 |  |
-| fun | true | 347 | 342 |  |
-| fun | true | 352 | 355 |  |
-| fun | true | 355 | 361 |  |
-| fun | true | 357 | 352 |  |
-| fun | true | 359 | 347 |  |
-| fun | true | 359 | 360 |  |
-| fun | true | 360 | 276 |  |
-| fun | true | 360 | 357 |  |
-| fun | true | 361 | 364 |  |
-| fun | true | 364 | 366 |  |
-| fun | true | 366 | 375 |  |
-| fun | true | 368 | 372 |  |
-| fun | true | 372 | 373 |  |
-| fun | true | 373 | 394 |  |
-| fun | true | 375 | 368 |  |
-| fun | true | 380 | 383 |  |
-| fun | true | 383 | 396 |  |
-| fun | true | 385 | 380 |  |
-| fun | true | 387 | 390 |  |
-| fun | true | 390 | 396 |  |
-| fun | true | 392 | 387 |  |
-| fun | true | 394 | 385 |  |
-| fun | true | 394 | 395 |  |
-| fun | true | 395 | 392 |  |
-| fun | true | 396 | 399 |  |
-| fun | true | 399 | 401 |  |
-| fun | true | 401 | 276 |  |
-| fun | true | 403 | 281 |  |
-| fun2 | false | 149 | 149 | fun2 |
-| fun2 | false | 159 | 159 | fun2 |
-| fun2 | false | 162 | 162 | try { ... } |
-| fun2 | false | 164 | 164 | { ... } |
-| fun2 | false | 172 | 172 | ExprStmt |
-| fun2 | false | 174 | 174 | re-throw exception  |
-| fun2 | false | 176 | 176 | { ... } |
-| fun2 | false | 178 | 178 | return ... |
-| fun2 | false | 182 | 182 | 1 |
-| fun2 | false | 183 | 183 | { ... } |
-| fun2 | false | 185 | 185 | <handler> |
-| fun2 | false | 186 | 186 | <handler> |
-| fun2 | false | 187 | 187 | return ... |
-| fun2 | false | 191 | 191 | 0 |
-| fun2 | false | 192 | 192 | { ... } |
-| fun2 | false | 257 | 257 | try { ... } |
-| fun2 | false | 258 | 258 | { ... } |
-| fun2 | false | 261 | 261 | ExprStmt |
-| fun2 | false | 262 | 262 | re-throw exception  |
-| fun2 | false | 263 | 263 | { ... } |
-| fun2 | false | 264 | 264 | return ... |
-| fun2 | false | 266 | 266 | 1 |
-| fun2 | false | 267 | 267 | { ... } |
-| fun2 | false | 268 | 268 | <handler> |
-| fun2 | false | 269 | 269 | <handler> |
-| fun2 | false | 270 | 270 | return ... |
-| fun2 | false | 272 | 272 | 0 |
-| fun2 | false | 273 | 273 | { ... } |
-| fun2 | true | 162 | 164 |  |
-| fun2 | true | 164 | 187 |  |
-| fun2 | true | 172 | 174 |  |
-| fun2 | true | 174 | 159 |  |
-| fun2 | true | 176 | 172 |  |
-| fun2 | true | 178 | 182 |  |
-| fun2 | true | 182 | 159 |  |
-| fun2 | true | 183 | 178 |  |
-| fun2 | true | 185 | 176 |  |
-| fun2 | true | 185 | 186 |  |
-| fun2 | true | 186 | 183 |  |
-| fun2 | true | 187 | 191 |  |
-| fun2 | true | 191 | 159 |  |
-| fun2 | true | 192 | 162 |  |
-| fun2 | true | 257 | 258 |  |
-| fun2 | true | 258 | 270 |  |
-| fun2 | true | 261 | 262 |  |
-| fun2 | true | 262 | 149 |  |
-| fun2 | true | 263 | 261 |  |
-| fun2 | true | 264 | 266 |  |
-| fun2 | true | 266 | 149 |  |
-| fun2 | true | 267 | 264 |  |
-| fun2 | true | 268 | 263 |  |
-| fun2 | true | 268 | 269 |  |
-| fun2 | true | 269 | 267 |  |
-| fun2 | true | 270 | 272 |  |
-| fun2 | true | 272 | 149 |  |
-| fun2 | true | 273 | 257 |  |
-| g | false | 321 | 321 | g |
-| h | false | 331 | 331 | h |
-| i | false | 344 | 344 | i |
-| j | false | 354 | 354 | j |
-| k | false | 363 | 363 | k |
-| l | false | 382 | 382 | l |
-| m | false | 389 | 389 | m |
-| n | false | 398 | 398 | n |
-| run_fun2 | false | 142 | 142 | run_fun2 |
-| run_fun2 | false | 147 | 147 | ExprStmt |
-| run_fun2 | false | 152 | 152 | call to fun2 |
-| run_fun2 | false | 154 | 154 | return ... |
-| run_fun2 | false | 156 | 156 | { ... } |
-| run_fun2 | true | 147 | 152 |  |
-| run_fun2 | true | 152 | 154 |  |
-| run_fun2 | true | 154 | 142 |  |
-| run_fun2 | true | 156 | 147 |  |
+| fun | false | 331 | 331 | { ... } |
+| fun | false | 337 | 337 | call to h |
+| fun | false | 339 | 339 | ExprStmt |
+| fun | false | 341 | 341 | { ... } |
+| fun | false | 343 | 343 | <handler> |
+| fun | false | 344 | 344 | try { ... } |
+| fun | false | 346 | 346 | { ... } |
+| fun | false | 352 | 352 | call to i |
+| fun | false | 354 | 354 | ExprStmt |
+| fun | false | 356 | 356 | { ... } |
+| fun | false | 362 | 362 | call to j |
+| fun | false | 364 | 364 | ExprStmt |
+| fun | false | 366 | 366 | { ... } |
+| fun | false | 368 | 368 | <handler> |
+| fun | false | 369 | 369 | <handler> |
+| fun | false | 370 | 370 | try { ... } |
+| fun | false | 373 | 373 | call to k |
+| fun | false | 375 | 375 | ExprStmt |
+| fun | false | 379 | 379 | 7 |
+| fun | false | 380 | 380 | throw ... |
+| fun | false | 382 | 382 | ExprStmt |
+| fun | false | 384 | 384 | { ... } |
+| fun | false | 390 | 390 | call to l |
+| fun | false | 392 | 392 | ExprStmt |
+| fun | false | 394 | 394 | { ... } |
+| fun | false | 397 | 397 | call to m |
+| fun | false | 399 | 399 | ExprStmt |
+| fun | false | 401 | 401 | { ... } |
+| fun | false | 403 | 403 | <handler> |
+| fun | false | 404 | 404 | <handler> |
+| fun | false | 405 | 405 | try { ... } |
+| fun | false | 408 | 408 | call to n |
+| fun | false | 410 | 410 | ExprStmt |
+| fun | false | 412 | 412 | return ... |
+| fun | false | 414 | 414 | { ... } |
+| fun | true | 295 | 302 |  |
+| fun | true | 297 | 295 |  |
+| fun | true | 300 | 307 |  |
+| fun | true | 302 | 300 |  |
+| fun | true | 305 | 312 |  |
+| fun | true | 307 | 305 |  |
+| fun | true | 310 | 317 |  |
+| fun | true | 312 | 310 |  |
+| fun | true | 317 | 315 |  |
+| fun | true | 321 | 322 |  |
+| fun | true | 322 | 343 |  |
+| fun | true | 324 | 321 |  |
+| fun | true | 327 | 375 |  |
+| fun | true | 329 | 327 |  |
+| fun | true | 331 | 297 |  |
+| fun | true | 337 | 375 |  |
+| fun | true | 339 | 337 |  |
+| fun | true | 341 | 339 |  |
+| fun | true | 343 | 341 |  |
+| fun | true | 343 | 368 |  |
+| fun | true | 344 | 331 |  |
+| fun | true | 346 | 344 |  |
+| fun | true | 352 | 375 |  |
+| fun | true | 354 | 352 |  |
+| fun | true | 356 | 354 |  |
+| fun | true | 362 | 375 |  |
+| fun | true | 364 | 362 |  |
+| fun | true | 366 | 364 |  |
+| fun | true | 368 | 356 |  |
+| fun | true | 368 | 369 |  |
+| fun | true | 369 | 287 |  |
+| fun | true | 369 | 366 |  |
+| fun | true | 370 | 346 |  |
+| fun | true | 373 | 405 |  |
+| fun | true | 375 | 373 |  |
+| fun | true | 379 | 380 |  |
+| fun | true | 380 | 403 |  |
+| fun | true | 382 | 379 |  |
+| fun | true | 384 | 382 |  |
+| fun | true | 390 | 410 |  |
+| fun | true | 392 | 390 |  |
+| fun | true | 394 | 392 |  |
+| fun | true | 397 | 410 |  |
+| fun | true | 399 | 397 |  |
+| fun | true | 401 | 399 |  |
+| fun | true | 403 | 394 |  |
+| fun | true | 403 | 404 |  |
+| fun | true | 404 | 401 |  |
+| fun | true | 405 | 384 |  |
+| fun | true | 408 | 412 |  |
+| fun | true | 410 | 408 |  |
+| fun | true | 412 | 287 |  |
+| fun | true | 414 | 370 |  |
+| fun2 | false | 204 | 204 | fun2 |
+| fun2 | false | 215 | 215 | fun2 |
+| fun2 | false | 218 | 218 | { ... } |
+| fun2 | false | 223 | 223 | re-throw exception  |
+| fun2 | false | 225 | 225 | ExprStmt |
+| fun2 | false | 227 | 227 | { ... } |
+| fun2 | false | 231 | 231 | 1 |
+| fun2 | false | 232 | 232 | return ... |
+| fun2 | false | 234 | 234 | { ... } |
+| fun2 | false | 236 | 236 | <handler> |
+| fun2 | false | 237 | 237 | <handler> |
+| fun2 | false | 238 | 238 | try { ... } |
+| fun2 | false | 242 | 242 | 0 |
+| fun2 | false | 243 | 243 | return ... |
+| fun2 | false | 245 | 245 | { ... } |
+| fun2 | false | 702 | 702 | { ... } |
+| fun2 | false | 707 | 707 | re-throw exception  |
+| fun2 | false | 708 | 708 | ExprStmt |
+| fun2 | false | 709 | 709 | { ... } |
+| fun2 | false | 711 | 711 | 1 |
+| fun2 | false | 712 | 712 | return ... |
+| fun2 | false | 713 | 713 | { ... } |
+| fun2 | false | 714 | 714 | <handler> |
+| fun2 | false | 715 | 715 | <handler> |
+| fun2 | false | 716 | 716 | try { ... } |
+| fun2 | false | 718 | 718 | 0 |
+| fun2 | false | 719 | 719 | return ... |
+| fun2 | false | 720 | 720 | { ... } |
+| fun2 | true | 218 | 243 |  |
+| fun2 | true | 223 | 215 |  |
+| fun2 | true | 225 | 223 |  |
+| fun2 | true | 227 | 225 |  |
+| fun2 | true | 231 | 215 |  |
+| fun2 | true | 232 | 231 |  |
+| fun2 | true | 234 | 232 |  |
+| fun2 | true | 236 | 227 |  |
+| fun2 | true | 236 | 237 |  |
+| fun2 | true | 237 | 234 |  |
+| fun2 | true | 238 | 218 |  |
+| fun2 | true | 242 | 215 |  |
+| fun2 | true | 243 | 242 |  |
+| fun2 | true | 245 | 238 |  |
+| fun2 | true | 702 | 719 |  |
+| fun2 | true | 707 | 204 |  |
+| fun2 | true | 708 | 707 |  |
+| fun2 | true | 709 | 708 |  |
+| fun2 | true | 711 | 204 |  |
+| fun2 | true | 712 | 711 |  |
+| fun2 | true | 713 | 712 |  |
+| fun2 | true | 714 | 709 |  |
+| fun2 | true | 714 | 715 |  |
+| fun2 | true | 715 | 713 |  |
+| fun2 | true | 716 | 702 |  |
+| fun2 | true | 718 | 204 |  |
+| fun2 | true | 719 | 718 |  |
+| fun2 | true | 720 | 716 |  |
+| g | false | 326 | 326 | g |
+| h | false | 336 | 336 | h |
+| i | false | 351 | 351 | i |
+| j | false | 361 | 361 | j |
+| k | false | 372 | 372 | k |
+| l | false | 389 | 389 | l |
+| m | false | 396 | 396 | m |
+| n | false | 407 | 407 | n |
+| run_fun2 | false | 199 | 199 | run_fun2 |
+| run_fun2 | false | 207 | 207 | call to fun2 |
+| run_fun2 | false | 209 | 209 | ExprStmt |
+| run_fun2 | false | 211 | 211 | return ... |
+| run_fun2 | false | 213 | 213 | { ... } |
+| run_fun2 | true | 207 | 211 |  |
+| run_fun2 | true | 209 | 207 |  |
+| run_fun2 | true | 211 | 199 |  |
+| run_fun2 | true | 213 | 209 |  |

cpp/ql/test/library-tests/c++_exceptions/unreachable.expected

@@ -1,3 +1,2 @@
 | exceptions.cpp:25:13:25:19 | ExprStmt |
 | exceptions.cpp:26:13:26:13 | ExprStmt |
-| ms.cpp:38:1:38:1 | c101 |

cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-consistency.expected

@@ -159,9 +159,6 @@ postWithInFlow
 | test.cpp:808:5:808:21 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
 | test.cpp:808:6:808:21 | global_indirect1 [inner post update] | PostUpdateNode should not be the target of local flow. |
 | test.cpp:832:5:832:17 | global_direct [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:931:5:931:18 | global_pointer [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:932:5:932:19 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:932:6:932:19 | global_pointer [inner post update] | PostUpdateNode should not be the target of local flow. |
 viableImplInCallContextTooLarge
 uniqueParameterNodeAtPosition
 uniqueParameterNodePosition
@@ -169,4 +166,3 @@ uniqueContentApprox
 identityLocalStep
 missingArgumentCall
 multipleArgumentCall
-lambdaCallEnclosingCallableMismatch

cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-ir-consistency.expected

@@ -31,4 +31,3 @@ uniqueContentApprox
 identityLocalStep
 missingArgumentCall
 multipleArgumentCall
-lambdaCallEnclosingCallableMismatch

cpp/ql/test/library-tests/dataflow/dataflow-tests/test-source-sink.expected

@@ -300,7 +300,6 @@ irFlow
 | test.cpp:902:56:902:75 | *indirect_source(2) | test.cpp:911:19:911:48 | *global_array_static_indirect_2 |
 | test.cpp:914:46:914:53 | source | test.cpp:919:10:919:30 | global_pointer_static |
 | test.cpp:915:57:915:76 | *indirect_source(1) | test.cpp:921:19:921:50 | *global_pointer_static_indirect_1 |
-| test.cpp:932:23:932:28 | call to source | test.cpp:937:10:937:24 | * ... |
 | true_upon_entry.cpp:9:11:9:16 | call to source | true_upon_entry.cpp:13:8:13:8 | x |
 | true_upon_entry.cpp:17:11:17:16 | call to source | true_upon_entry.cpp:21:8:21:8 | x |
 | true_upon_entry.cpp:27:9:27:14 | call to source | true_upon_entry.cpp:29:8:29:8 | x |

cpp/ql/test/library-tests/dataflow/dataflow-tests/test.cpp

@@ -922,18 +922,4 @@ namespace GlobalArrays {
     sink(global_pointer_static_indirect_2); // clean: global_pointer_static_indirect_2 does not have 2 indirections
     indirect_sink(global_pointer_static_indirect_2); // clean: global_pointer_static_indirect_2 does not have 2 indirections
   }
-}
-
-namespace global_variable_conflation_test {
-  int* global_pointer;
-
-  void def() {
-    global_pointer = nullptr;
-    *global_pointer = source();
-  }
-
-  void use() {
-    sink(global_pointer); // clean
-    sink(*global_pointer); // $ ir MISSING: ast
-  }
 }

cpp/ql/test/library-tests/dataflow/fields/dataflow-consistency.expected

@@ -193,4 +193,3 @@ uniqueContentApprox
 identityLocalStep
 missingArgumentCall
 multipleArgumentCall
-lambdaCallEnclosingCallableMismatch

cpp/ql/test/library-tests/dataflow/fields/dataflow-ir-consistency.expected

@@ -27,4 +27,3 @@ uniqueContentApprox
 identityLocalStep
 missingArgumentCall
 multipleArgumentCall
-lambdaCallEnclosingCallableMismatch

cpp/ql/test/library-tests/destructors/cfg.expected

@@ -1,263 +1,255 @@
-| C::C | false | 181 | 181 | C |
-| C::C | false | 384 | 384 | C |
-| C::operator= | false | 375 | 375 | operator= |
-| C::~C | false | 333 | 333 | ~C |
+| C::C | false | 197 | 197 | C |
+| C::C | false | 398 | 398 | C |
+| C::operator= | false | 391 | 391 | operator= |
+| C::~C | false | 331 | 331 | ~C |
+| Class2::Class2 | false | 538 | 538 | Class2 |
+| Class2::Class2 | false | 544 | 544 | return ... |
+| Class2::Class2 | false | 546 | 546 | { ... } |
 | Class2::Class2 | false | 547 | 547 | Class2 |
-| Class2::Class2 | false | 554 | 554 | return ... |
-| Class2::Class2 | false | 556 | 556 | { ... } |
-| Class2::Class2 | false | 557 | 557 | Class2 |
-| Class2::Class2 | true | 554 | 547 |  |
-| Class2::Class2 | true | 556 | 554 |  |
-| Class2::operator= | false | 541 | 541 | operator= |
-| Class2::~Class2 | false | 499 | 499 | ~Class2 |
-| Outer::Inner::Inner | false | 481 | 481 | Inner |
-| Outer::Inner::Inner | false | 517 | 517 | Inner |
-| Outer::Inner::Inner | false | 537 | 537 | return ... |
-| Outer::Inner::Inner | false | 539 | 539 | { ... } |
-| Outer::Inner::Inner | true | 537 | 481 |  |
-| Outer::Inner::Inner | true | 539 | 537 |  |
-| Outer::Inner::operator= | false | 508 | 508 | operator= |
-| Outer::Inner::~Inner | false | 504 | 504 | ~Inner |
-| Outer::Inner::~Inner | false | 526 | 526 | return ... |
-| Outer::Inner::~Inner | false | 528 | 528 | { ... } |
-| Outer::Inner::~Inner | true | 526 | 504 |  |
-| Outer::Inner::~Inner | true | 528 | 526 |  |
-| Outer::f2 | false | 444 | 444 | f2 |
-| Outer::f2 | false | 453 | 453 | declaration |
-| Outer::f2 | false | 458 | 458 | call to getClass2 |
-| Outer::f2 | false | 460 | 460 | initializer for c |
-| Outer::f2 | false | 464 | 464 | if (...) ...  |
-| Outer::f2 | false | 466 | 466 | i |
-| Outer::f2 | false | 468 | 468 | (bool)... |
-| Outer::f2 | false | 469 | 469 | return ... |
-| Outer::f2 | false | 471 | 471 | { ... } |
-| Outer::f2 | false | 473 | 473 | declaration |
-| Outer::f2 | false | 476 | 476 | call to Inner |
-| Outer::f2 | false | 482 | 482 | c |
-| Outer::f2 | false | 485 | 485 | (const Class2)... |
-| Outer::f2 | false | 488 | 488 | (reference to) |
-| Outer::f2 | false | 489 | 489 | initializer for inner |
-| Outer::f2 | false | 492 | 492 | return ... |
-| Outer::f2 | false | 494 | 494 | { ... } |
-| Outer::f2 | false | 496 | 496 | c |
-| Outer::f2 | false | 498 | 498 | call to c.~Class2 |
-| Outer::f2 | false | 500 | 500 | c |
-| Outer::f2 | false | 501 | 501 | call to c.~Class2 |
-| Outer::f2 | false | 502 | 502 | inner |
-| Outer::f2 | false | 503 | 503 | call to inner.~Inner |
-| Outer::f2 | true | 453 | 460 |  |
-| Outer::f2 | true | 458 | 464 |  |
-| Outer::f2 | true | 460 | 458 |  |
+| Class2::Class2 | true | 544 | 538 |  |
+| Class2::Class2 | true | 546 | 544 |  |
+| Class2::operator= | false | 532 | 532 | operator= |
+| Class2::~Class2 | false | 467 | 467 | ~Class2 |
+| Outer::Inner::Inner | false | 488 | 488 | Inner |
+| Outer::Inner::Inner | false | 509 | 509 | Inner |
+| Outer::Inner::Inner | false | 528 | 528 | return ... |
+| Outer::Inner::Inner | false | 530 | 530 | { ... } |
+| Outer::Inner::Inner | true | 528 | 488 |  |
+| Outer::Inner::Inner | true | 530 | 528 |  |
+| Outer::Inner::operator= | false | 502 | 502 | operator= |
+| Outer::Inner::~Inner | false | 470 | 470 | ~Inner |
+| Outer::Inner::~Inner | false | 517 | 517 | return ... |
+| Outer::Inner::~Inner | false | 519 | 519 | { ... } |
+| Outer::Inner::~Inner | true | 517 | 470 |  |
+| Outer::Inner::~Inner | true | 519 | 517 |  |
+| Outer::f2 | false | 439 | 439 | f2 |
+| Outer::f2 | false | 447 | 447 | declaration |
+| Outer::f2 | false | 449 | 449 | i |
+| Outer::f2 | false | 451 | 451 | (bool)... |
+| Outer::f2 | false | 452 | 452 | return ... |
+| Outer::f2 | false | 454 | 454 | { ... } |
+| Outer::f2 | false | 456 | 456 | if (...) ...  |
+| Outer::f2 | false | 458 | 458 | declaration |
+| Outer::f2 | false | 460 | 460 | return ... |
+| Outer::f2 | false | 462 | 462 | { ... } |
+| Outer::f2 | false | 464 | 464 | c |
+| Outer::f2 | false | 466 | 466 | call to c.~Class2 |
+| Outer::f2 | false | 468 | 468 | inner |
+| Outer::f2 | false | 469 | 469 | call to inner.~Inner |
+| Outer::f2 | false | 474 | 474 | call to getClass2 |
+| Outer::f2 | false | 476 | 476 | initializer for c |
+| Outer::f2 | false | 481 | 481 | call to Inner |
+| Outer::f2 | false | 490 | 490 | c |
+| Outer::f2 | false | 492 | 492 | (const Class2)... |
+| Outer::f2 | false | 493 | 493 | (reference to) |
+| Outer::f2 | false | 494 | 494 | initializer for inner |
+| Outer::f2 | true | 447 | 476 |  |
+| Outer::f2 | true | 449 | 454 | T |
+| Outer::f2 | true | 449 | 458 | F |
+| Outer::f2 | true | 452 | 464 |  |
+| Outer::f2 | true | 454 | 452 |  |
+| Outer::f2 | true | 456 | 449 |  |
+| Outer::f2 | true | 458 | 494 |  |
+| Outer::f2 | true | 460 | 468 |  |
+| Outer::f2 | true | 462 | 447 |  |
 | Outer::f2 | true | 464 | 466 |  |
-| Outer::f2 | true | 466 | 471 | T |
-| Outer::f2 | true | 466 | 473 | F |
-| Outer::f2 | true | 469 | 496 |  |
-| Outer::f2 | true | 471 | 469 |  |
-| Outer::f2 | true | 473 | 489 |  |
-| Outer::f2 | true | 476 | 492 |  |
-| Outer::f2 | true | 482 | 476 |  |
-| Outer::f2 | true | 489 | 482 |  |
-| Outer::f2 | true | 492 | 502 |  |
-| Outer::f2 | true | 494 | 453 |  |
-| Outer::f2 | true | 496 | 498 |  |
-| Outer::f2 | true | 498 | 444 |  |
-| Outer::f2 | true | 500 | 501 |  |
-| Outer::f2 | true | 501 | 444 |  |
-| Outer::f2 | true | 502 | 503 |  |
-| Outer::f2 | true | 503 | 500 |  |
-| Outer::operator= | false | 428 | 428 | operator= |
-| Outer::operator= | false | 438 | 438 | operator= |
-| __va_list_tag::operator= | false | 66 | 66 | operator= |
-| __va_list_tag::operator= | false | 72 | 72 | operator= |
-| f | false | 165 | 165 | f |
-| f | false | 176 | 176 | declaration |
-| f | false | 179 | 179 | call to C |
-| f | false | 184 | 184 | 110 |
-| f | false | 185 | 185 | initializer for c10 |
-| f | false | 189 | 189 | call to C |
-| f | false | 193 | 193 | 120 |
-| f | false | 194 | 194 | initializer for c20 |
-| f | false | 198 | 198 | call to C |
-| f | false | 202 | 202 | 121 |
-| f | false | 203 | 203 | initializer for c21 |
-| f | false | 206 | 206 | declaration |
-| f | false | 209 | 209 | call to C |
-| f | false | 213 | 213 | 130 |
-| f | false | 214 | 214 | initializer for c30 |
-| f | false | 217 | 217 | declaration |
-| f | false | 219 | 219 | { ... } |
-| f | false | 222 | 222 | call to C |
-| f | false | 226 | 226 | 131 |
-| f | false | 227 | 227 | initializer for c31 |
-| f | false | 231 | 231 | call to C |
-| f | false | 235 | 235 | 132 |
-| f | false | 236 | 236 | initializer for c32 |
-| f | false | 240 | 240 | call to C |
-| f | false | 244 | 244 | 133 |
-| f | false | 245 | 245 | initializer for c33 |
-| f | false | 248 | 248 | declaration |
-| f | false | 250 | 250 | if (...) ...  |
-| f | false | 252 | 252 | b1 |
-| f | false | 254 | 254 | (bool)... |
-| f | false | 255 | 255 | goto ... |
-| f | false | 257 | 257 | declaration |
-| f | false | 259 | 259 | if (...) ...  |
-| f | false | 261 | 261 | b2 |
-| f | false | 263 | 263 | (bool)... |
-| f | false | 264 | 264 | return ... |
-| f | false | 266 | 266 | declaration |
-| f | false | 268 | 268 | { ... } |
-| f | false | 271 | 271 | call to C |
-| f | false | 275 | 275 | 134 |
-| f | false | 276 | 276 | initializer for c34 |
-| f | false | 279 | 279 | declaration |
-| f | false | 281 | 281 | { ... } |
-| f | false | 283 | 283 | declaration |
-| f | false | 285 | 285 | { ... } |
-| f | false | 288 | 288 | call to C |
-| f | false | 292 | 292 | 122 |
-| f | false | 293 | 293 | initializer for c22 |
-| f | false | 296 | 296 | declaration |
-| f | false | 298 | 298 | { ... } |
-| f | false | 301 | 301 | call to C |
-| f | false | 305 | 305 | 123 |
-| f | false | 306 | 306 | initializer for c23 |
-| f | false | 309 | 309 | label ...: |
-| f | false | 311 | 311 | declaration |
-| f | false | 313 | 313 | { ... } |
-| f | false | 315 | 315 | declaration |
-| f | false | 318 | 318 | call to C |
-| f | false | 322 | 322 | 111 |
-| f | false | 323 | 323 | initializer for c11 |
-| f | false | 326 | 326 | return ... |
-| f | false | 328 | 328 | { ... } |
-| f | false | 330 | 330 | c20 |
-| f | false | 332 | 332 | call to c20.~C |
-| f | false | 334 | 334 | c21 |
-| f | false | 335 | 335 | call to c21.~C |
-| f | false | 336 | 336 | c30 |
-| f | false | 338 | 338 | call to c30.~C |
-| f | false | 339 | 339 | c31 |
-| f | false | 341 | 341 | call to c31.~C |
-| f | false | 342 | 342 | c32 |
-| f | false | 343 | 343 | call to c32.~C |
-| f | false | 344 | 344 | c33 |
-| f | false | 345 | 345 | call to c33.~C |
-| f | false | 346 | 346 | c20 |
-| f | false | 347 | 347 | call to c20.~C |
+| Outer::f2 | true | 466 | 439 |  |
+| Outer::f2 | true | 468 | 469 |  |
+| Outer::f2 | true | 469 | 464 |  |
+| Outer::f2 | true | 474 | 456 |  |
+| Outer::f2 | true | 476 | 474 |  |
+| Outer::f2 | true | 481 | 460 |  |
+| Outer::f2 | true | 490 | 481 |  |
+| Outer::f2 | true | 494 | 490 |  |
+| Outer::operator= | false | 424 | 424 | operator= |
+| Outer::operator= | false | 435 | 435 | operator= |
+| __va_list_tag::operator= | false | 93 | 93 | operator= |
+| __va_list_tag::operator= | false | 100 | 100 | operator= |
+| f | false | 181 | 181 | f |
+| f | false | 192 | 192 | declaration |
+| f | false | 195 | 195 | call to C |
+| f | false | 200 | 200 | 120 |
+| f | false | 201 | 201 | initializer for c20 |
+| f | false | 205 | 205 | call to C |
+| f | false | 209 | 209 | 121 |
+| f | false | 210 | 210 | initializer for c21 |
+| f | false | 213 | 213 | declaration |
+| f | false | 216 | 216 | call to C |
+| f | false | 220 | 220 | 130 |
+| f | false | 221 | 221 | initializer for c30 |
+| f | false | 224 | 224 | declaration |
+| f | false | 226 | 226 | { ... } |
+| f | false | 229 | 229 | call to C |
+| f | false | 233 | 233 | 131 |
+| f | false | 234 | 234 | initializer for c31 |
+| f | false | 238 | 238 | call to C |
+| f | false | 242 | 242 | 132 |
+| f | false | 243 | 243 | initializer for c32 |
+| f | false | 247 | 247 | call to C |
+| f | false | 251 | 251 | 133 |
+| f | false | 252 | 252 | initializer for c33 |
+| f | false | 255 | 255 | declaration |
+| f | false | 257 | 257 | b1 |
+| f | false | 259 | 259 | (bool)... |
+| f | false | 260 | 260 | goto ... |
+| f | false | 262 | 262 | if (...) ...  |
+| f | false | 264 | 264 | declaration |
+| f | false | 266 | 266 | b2 |
+| f | false | 268 | 268 | (bool)... |
+| f | false | 269 | 269 | return ... |
+| f | false | 271 | 271 | if (...) ...  |
+| f | false | 273 | 273 | declaration |
+| f | false | 275 | 275 | { ... } |
+| f | false | 278 | 278 | call to C |
+| f | false | 282 | 282 | 134 |
+| f | false | 283 | 283 | initializer for c34 |
+| f | false | 286 | 286 | declaration |
+| f | false | 288 | 288 | { ... } |
+| f | false | 290 | 290 | declaration |
+| f | false | 292 | 292 | { ... } |
+| f | false | 295 | 295 | call to C |
+| f | false | 299 | 299 | 122 |
+| f | false | 300 | 300 | initializer for c22 |
+| f | false | 303 | 303 | declaration |
+| f | false | 305 | 305 | { ... } |
+| f | false | 308 | 308 | call to C |
+| f | false | 312 | 312 | 123 |
+| f | false | 313 | 313 | initializer for c23 |
+| f | false | 316 | 316 | label ...: |
+| f | false | 318 | 318 | declaration |
+| f | false | 320 | 320 | { ... } |
+| f | false | 322 | 322 | declaration |
+| f | false | 324 | 324 | return ... |
+| f | false | 326 | 326 | { ... } |
+| f | false | 328 | 328 | c10 |
+| f | false | 330 | 330 | call to c10.~C |
+| f | false | 332 | 332 | c11 |
+| f | false | 333 | 333 | call to c11.~C |
+| f | false | 334 | 334 | c23 |
+| f | false | 336 | 336 | call to c23.~C |
+| f | false | 337 | 337 | c22 |
+| f | false | 339 | 339 | call to c22.~C |
+| f | false | 340 | 340 | c20 |
+| f | false | 342 | 342 | call to c20.~C |
+| f | false | 343 | 343 | c21 |
+| f | false | 344 | 344 | call to c21.~C |
+| f | false | 345 | 345 | c34 |
+| f | false | 347 | 347 | call to c34.~C |
 | f | false | 348 | 348 | c31 |
-| f | false | 349 | 349 | call to c31.~C |
-| f | false | 350 | 350 | c10 |
-| f | false | 352 | 352 | call to c10.~C |
-| f | false | 353 | 353 | c20 |
-| f | false | 354 | 354 | call to c20.~C |
-| f | false | 355 | 355 | c31 |
-| f | false | 356 | 356 | call to c31.~C |
-| f | false | 357 | 357 | c32 |
-| f | false | 358 | 358 | call to c32.~C |
-| f | false | 359 | 359 | c34 |
-| f | false | 361 | 361 | call to c34.~C |
-| f | false | 362 | 362 | c22 |
-| f | false | 364 | 364 | call to c22.~C |
-| f | false | 365 | 365 | c23 |
-| f | false | 367 | 367 | call to c23.~C |
-| f | false | 368 | 368 | c10 |
-| f | false | 369 | 369 | call to c10.~C |
-| f | false | 370 | 370 | c11 |
-| f | false | 371 | 371 | call to c11.~C |
-| f | true | 176 | 185 |  |
-| f | true | 179 | 285 |  |
-| f | true | 184 | 179 |  |
-| f | true | 185 | 184 |  |
-| f | true | 189 | 219 |  |
-| f | true | 193 | 189 |  |
-| f | true | 194 | 193 |  |
-| f | true | 198 | 334 |  |
-| f | true | 202 | 198 |  |
-| f | true | 203 | 202 |  |
-| f | true | 206 | 194 |  |
-| f | true | 209 | 336 |  |
-| f | true | 213 | 209 |  |
-| f | true | 214 | 213 |  |
-| f | true | 217 | 214 |  |
-| f | true | 219 | 217 |  |
-| f | true | 222 | 250 |  |
-| f | true | 226 | 222 |  |
-| f | true | 227 | 226 |  |
-| f | true | 231 | 259 |  |
-| f | true | 235 | 231 |  |
-| f | true | 236 | 235 |  |
-| f | true | 240 | 344 |  |
-| f | true | 244 | 240 |  |
-| f | true | 245 | 244 |  |
-| f | true | 248 | 227 |  |
-| f | true | 250 | 252 |  |
-| f | true | 252 | 255 | T |
-| f | true | 252 | 257 | F |
-| f | true | 255 | 348 |  |
-| f | true | 257 | 236 |  |
-| f | true | 259 | 261 |  |
-| f | true | 261 | 264 | T |
-| f | true | 261 | 266 | F |
-| f | true | 264 | 357 |  |
-| f | true | 266 | 245 |  |
-| f | true | 268 | 248 |  |
-| f | true | 271 | 359 |  |
-| f | true | 275 | 271 |  |
-| f | true | 276 | 275 |  |
-| f | true | 279 | 276 |  |
-| f | true | 281 | 279 |  |
-| f | true | 283 | 203 |  |
-| f | true | 285 | 206 |  |
-| f | true | 288 | 362 |  |
-| f | true | 292 | 288 |  |
-| f | true | 293 | 292 |  |
-| f | true | 296 | 293 |  |
-| f | true | 298 | 296 |  |
-| f | true | 301 | 365 |  |
-| f | true | 305 | 301 |  |
-| f | true | 306 | 305 |  |
-| f | true | 309 | 311 |  |
-| f | true | 311 | 306 |  |
-| f | true | 313 | 309 |  |
-| f | true | 315 | 323 |  |
-| f | true | 318 | 326 |  |
-| f | true | 322 | 318 |  |
-| f | true | 323 | 322 |  |
-| f | true | 326 | 370 |  |
-| f | true | 328 | 176 |  |
-| f | true | 330 | 332 |  |
-| f | true | 332 | 298 |  |
-| f | true | 334 | 335 |  |
-| f | true | 335 | 330 |  |
-| f | true | 336 | 338 |  |
-| f | true | 338 | 268 |  |
-| f | true | 339 | 341 |  |
-| f | true | 341 | 281 |  |
-| f | true | 342 | 343 |  |
-| f | true | 343 | 339 |  |
-| f | true | 344 | 345 |  |
-| f | true | 345 | 342 |  |
-| f | true | 346 | 347 |  |
-| f | true | 347 | 309 |  |
-| f | true | 348 | 349 |  |
-| f | true | 349 | 346 |  |
-| f | true | 350 | 352 |  |
-| f | true | 352 | 165 |  |
+| f | false | 350 | 350 | call to c31.~C |
+| f | false | 351 | 351 | c32 |
+| f | false | 352 | 352 | call to c32.~C |
+| f | false | 353 | 353 | c33 |
+| f | false | 354 | 354 | call to c33.~C |
+| f | false | 355 | 355 | c20 |
+| f | false | 356 | 356 | call to c20.~C |
+| f | false | 357 | 357 | c31 |
+| f | false | 358 | 358 | call to c31.~C |
+| f | false | 359 | 359 | c32 |
+| f | false | 360 | 360 | call to c32.~C |
+| f | false | 361 | 361 | c20 |
+| f | false | 362 | 362 | call to c20.~C |
+| f | false | 363 | 363 | c31 |
+| f | false | 364 | 364 | call to c31.~C |
+| f | false | 365 | 365 | c30 |
+| f | false | 367 | 367 | call to c30.~C |
+| f | false | 369 | 369 | call to C |
+| f | false | 373 | 373 | 110 |
+| f | false | 374 | 374 | initializer for c10 |
+| f | false | 378 | 378 | call to C |
+| f | false | 382 | 382 | 111 |
+| f | false | 383 | 383 | initializer for c11 |
+| f | true | 192 | 374 |  |
+| f | true | 195 | 226 |  |
+| f | true | 200 | 195 |  |
+| f | true | 201 | 200 |  |
+| f | true | 205 | 343 |  |
+| f | true | 209 | 205 |  |
+| f | true | 210 | 209 |  |
+| f | true | 213 | 201 |  |
+| f | true | 216 | 365 |  |
+| f | true | 220 | 216 |  |
+| f | true | 221 | 220 |  |
+| f | true | 224 | 221 |  |
+| f | true | 226 | 224 |  |
+| f | true | 229 | 262 |  |
+| f | true | 233 | 229 |  |
+| f | true | 234 | 233 |  |
+| f | true | 238 | 271 |  |
+| f | true | 242 | 238 |  |
+| f | true | 243 | 242 |  |
+| f | true | 247 | 353 |  |
+| f | true | 251 | 247 |  |
+| f | true | 252 | 251 |  |
+| f | true | 255 | 234 |  |
+| f | true | 257 | 260 | T |
+| f | true | 257 | 264 | F |
+| f | true | 260 | 363 |  |
+| f | true | 262 | 257 |  |
+| f | true | 264 | 243 |  |
+| f | true | 266 | 269 | T |
+| f | true | 266 | 273 | F |
+| f | true | 269 | 359 |  |
+| f | true | 271 | 266 |  |
+| f | true | 273 | 252 |  |
+| f | true | 275 | 255 |  |
+| f | true | 278 | 345 |  |
+| f | true | 282 | 278 |  |
+| f | true | 283 | 282 |  |
+| f | true | 286 | 283 |  |
+| f | true | 288 | 286 |  |
+| f | true | 290 | 210 |  |
+| f | true | 292 | 213 |  |
+| f | true | 295 | 337 |  |
+| f | true | 299 | 295 |  |
+| f | true | 300 | 299 |  |
+| f | true | 303 | 300 |  |
+| f | true | 305 | 303 |  |
+| f | true | 308 | 334 |  |
+| f | true | 312 | 308 |  |
+| f | true | 313 | 312 |  |
+| f | true | 316 | 318 |  |
+| f | true | 318 | 313 |  |
+| f | true | 320 | 316 |  |
+| f | true | 322 | 383 |  |
+| f | true | 324 | 332 |  |
+| f | true | 326 | 192 |  |
+| f | true | 328 | 330 |  |
+| f | true | 330 | 181 |  |
+| f | true | 332 | 333 |  |
+| f | true | 333 | 328 |  |
+| f | true | 334 | 336 |  |
+| f | true | 336 | 322 |  |
+| f | true | 337 | 339 |  |
+| f | true | 339 | 320 |  |
+| f | true | 340 | 342 |  |
+| f | true | 342 | 305 |  |
+| f | true | 343 | 344 |  |
+| f | true | 344 | 340 |  |
+| f | true | 345 | 347 |  |
+| f | true | 347 | 290 |  |
+| f | true | 348 | 350 |  |
+| f | true | 350 | 288 |  |
+| f | true | 351 | 352 |  |
+| f | true | 352 | 348 |  |
 | f | true | 353 | 354 |  |
-| f | true | 354 | 350 |  |
+| f | true | 354 | 351 |  |
 | f | true | 355 | 356 |  |
-| f | true | 356 | 353 |  |
+| f | true | 356 | 328 |  |
 | f | true | 357 | 358 |  |
 | f | true | 358 | 355 |  |
-| f | true | 359 | 361 |  |
-| f | true | 361 | 283 |  |
-| f | true | 362 | 364 |  |
-| f | true | 364 | 313 |  |
+| f | true | 359 | 360 |  |
+| f | true | 360 | 357 |  |
+| f | true | 361 | 362 |  |
+| f | true | 362 | 316 |  |
+| f | true | 363 | 364 |  |
+| f | true | 364 | 361 |  |
 | f | true | 365 | 367 |  |
-| f | true | 367 | 315 |  |
-| f | true | 368 | 369 |  |
-| f | true | 369 | 165 |  |
-| f | true | 370 | 371 |  |
-| f | true | 371 | 368 |  |
-| getClass2 | false | 425 | 425 | getClass2 |
+| f | true | 367 | 275 |  |
+| f | true | 369 | 292 |  |
+| f | true | 373 | 369 |  |
+| f | true | 374 | 373 |  |
+| f | true | 378 | 324 |  |
+| f | true | 382 | 378 |  |
+| f | true | 383 | 382 |  |
+| getClass2 | false | 420 | 420 | getClass2 |

cpp/ql/test/library-tests/destructors/jump_destructs.expected

@@ -1,14 +1,14 @@
 | destructors2.cpp:5:7:5:7 | Class2 | 5 | return ... | 3 | 5 | Class2 |
 | destructors2.cpp:17:9:17:13 | Inner | 17 | return ... | 3 | 17 | Inner |
 | destructors2.cpp:18:9:18:14 | ~Inner | 18 | return ... | 3 | 18 | ~Inner |
-| destructors2.cpp:21:10:21:11 | f2 | 24 | return ... | 9 | 27 | c |
-| destructors2.cpp:21:10:21:11 | f2 | 24 | return ... | 10 | 27 | call to ~Class2 |
-| destructors2.cpp:21:10:21:11 | f2 | 24 | return ... | 20 | 21 | f2 |
+| destructors2.cpp:21:10:21:11 | f2 | 24 | return ... | 16 | 27 | c |
+| destructors2.cpp:21:10:21:11 | f2 | 24 | return ... | 17 | 27 | call to ~Class2 |
+| destructors2.cpp:21:10:21:11 | f2 | 24 | return ... | 18 | 21 | f2 |
 | destructors2.cpp:21:10:21:11 | f2 | 27 | return ... | 12 | 27 | inner |
 | destructors2.cpp:21:10:21:11 | f2 | 27 | return ... | 13 | 27 | call to ~Inner |
-| destructors2.cpp:21:10:21:11 | f2 | 27 | return ... | 14 | 27 | c |
-| destructors2.cpp:21:10:21:11 | f2 | 27 | return ... | 15 | 27 | call to ~Class2 |
-| destructors2.cpp:21:10:21:11 | f2 | 27 | return ... | 20 | 21 | f2 |
+| destructors2.cpp:21:10:21:11 | f2 | 27 | return ... | 16 | 27 | c |
+| destructors2.cpp:21:10:21:11 | f2 | 27 | return ... | 17 | 27 | call to ~Class2 |
+| destructors2.cpp:21:10:21:11 | f2 | 27 | return ... | 18 | 21 | f2 |
 | destructors.cpp:8:6:8:6 | f | 17 | goto ... | 26 | 21 | c31 |
 | destructors.cpp:8:6:8:6 | f | 17 | goto ... | 27 | 21 | call to ~C |
 | destructors.cpp:8:6:8:6 | f | 17 | goto ... | 28 | 26 | c20 |
@@ -19,11 +19,11 @@
 | destructors.cpp:8:6:8:6 | f | 19 | return ... | 35 | 21 | call to ~C |
 | destructors.cpp:8:6:8:6 | f | 19 | return ... | 36 | 26 | c20 |
 | destructors.cpp:8:6:8:6 | f | 19 | return ... | 37 | 26 | call to ~C |
-| destructors.cpp:8:6:8:6 | f | 19 | return ... | 38 | 35 | c10 |
-| destructors.cpp:8:6:8:6 | f | 19 | return ... | 39 | 35 | call to ~C |
-| destructors.cpp:8:6:8:6 | f | 19 | return ... | 94 | 8 | f |
+| destructors.cpp:8:6:8:6 | f | 19 | return ... | 90 | 35 | c10 |
+| destructors.cpp:8:6:8:6 | f | 19 | return ... | 91 | 35 | call to ~C |
+| destructors.cpp:8:6:8:6 | f | 19 | return ... | 92 | 8 | f |
 | destructors.cpp:8:6:8:6 | f | 35 | return ... | 81 | 35 | c11 |
 | destructors.cpp:8:6:8:6 | f | 35 | return ... | 82 | 35 | call to ~C |
-| destructors.cpp:8:6:8:6 | f | 35 | return ... | 83 | 35 | c10 |
-| destructors.cpp:8:6:8:6 | f | 35 | return ... | 84 | 35 | call to ~C |
-| destructors.cpp:8:6:8:6 | f | 35 | return ... | 94 | 8 | f |
+| destructors.cpp:8:6:8:6 | f | 35 | return ... | 90 | 35 | c10 |
+| destructors.cpp:8:6:8:6 | f | 35 | return ... | 91 | 35 | call to ~C |
+| destructors.cpp:8:6:8:6 | f | 35 | return ... | 92 | 8 | f |

cpp/ql/test/library-tests/literals/uuidof/uuidof.cpp

@@ -17,9 +17,4 @@ void GetUUID() {
     uuid = __uuidof(s);
     uuid = __uuidof(0);
 }
-
-template <typename Placeholder, typename ...>
-auto Wrapper = __uuidof(Placeholder);
-auto inst = Wrapper<S>;
-
 // semmle-extractor-options: --microsoft

cpp/ql/test/library-tests/literals/uuidof/uuidof.expected

@@ -12,5 +12,3 @@ uuidofOperators
 | uuidof.cpp:15:12:15:29 | __uuidof(S) | const _GUID | 01234567-89ab-cdef-0123-456789abcdef |
 | uuidof.cpp:17:12:17:22 | __uuidof(S) | const _GUID | 01234567-89ab-cdef-0123-456789abcdef |
 | uuidof.cpp:18:12:18:22 | __uuidof(0) | const _GUID | 00000000-0000-0000-0000-000000000000 |
-| uuidof.cpp:22:16:22:36 | __uuidof(Placeholder) | const _GUID |  |
-| uuidof.cpp:22:16:22:36 | __uuidof(S) | const _GUID | 01234567-89ab-cdef-0123-456789abcdef |

cpp/ql/test/library-tests/literals/uuidof/uuidof.ql

@@ -5,6 +5,6 @@ query predicate classUuids(Class cls, string uuid) {
 }
 
 query predicate uuidofOperators(UuidofOperator op, string type, string uuid) {
-  (if exists(op.getValue()) then uuid = op.getValue() else uuid = "") and
+  uuid = op.getValue() and
   type = op.getType().toString()
 }

cpp/ql/test/library-tests/syntax-zoo/dataflow-consistency.expected

@@ -99,4 +99,3 @@ uniqueContentApprox
 identityLocalStep
 missingArgumentCall
 multipleArgumentCall
-lambdaCallEnclosingCallableMismatch

cpp/ql/test/library-tests/syntax-zoo/dataflow-ir-consistency.expected

@@ -42,4 +42,3 @@ uniqueContentApprox
 identityLocalStep
 missingArgumentCall
 multipleArgumentCall
-lambdaCallEnclosingCallableMismatch

cpp/ql/test/query-tests/jsf/4.06 Pre-Processing Directives/AV Rule 32/test.c

@@ -1,4 +1,3 @@
-#include "test.H"    // GOOD
-#include "test.xpm"  // GOOD
-#include "test2.c"   // BAD
-#include "test.def"  // GOOD
+#include "test.H"
+#include "test.xpm"
+#include "test2.c"

csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/FilePathFilter.cs

@@ -74,18 +74,16 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
                         includeByDefault)
                 });
 
+            // Move included pathfilters to the front of the list:
+            pathFilters.Sort((pf1, pf2) => -1 * pf1.Include.CompareTo(pf2.Include));
             return unfilteredResult.Where(f =>
             {
                 var include = f.FileInclusion.Include;
-                // LGTM_INDEX_FILTERS is a prioritized list, where later filters take
-                // priority over earlier ones.
-                for (int i = pathFilters.Count - 1; i >= 0; i--)
+                foreach (var pathFilter in pathFilters)
                 {
-                    var pathFilter = pathFilters[i];
                     if (pathFilter.Regex.IsMatch(f.FileInclusion.Path))
                     {
                         include = pathFilter.Include;
-                        break;
                     }
                 }
 

csharp/extractor/Semmle.Extraction.CSharp/Entities/OrdinaryMethod.cs

@@ -18,12 +18,7 @@ namespace Semmle.Extraction.CSharp.Entities
 
         public IMethodSymbol SourceDeclaration => Symbol.OriginalDefinition;
 
-        public override Microsoft.CodeAnalysis.Location ReportingLocation =>
-            IsCompilerGeneratedDelegate()
-                ? Symbol.ContainingType.GetSymbolLocation()
-                : Symbol.GetSymbolLocation();
-
-        public override bool NeedsPopulation => base.NeedsPopulation || IsCompilerGeneratedDelegate();
+        public override Microsoft.CodeAnalysis.Location ReportingLocation => Symbol.GetSymbolLocation();
 
         public override void Populate(TextWriter trapFile)
         {
@@ -52,13 +47,6 @@ namespace Semmle.Extraction.CSharp.Entities
             ExtractCompilerGenerated(trapFile);
         }
 
-        private bool IsCompilerGeneratedDelegate() =>
-            // Lambdas with parameter defaults or a `params` parameter are implemented
-            // using compiler generated delegate types.
-            Symbol.MethodKind == MethodKind.DelegateInvoke &&
-            Symbol.ContainingType is INamedTypeSymbol nt &&
-            nt.IsImplicitlyDeclared;
-
         public static new OrdinaryMethod Create(Context cx, IMethodSymbol method)
         {
             if (method.MethodKind == MethodKind.ReducedExtension)

csharp/extractor/Semmle.Extraction.Tests/FilePathFilter.cs

@@ -165,7 +165,6 @@ namespace Semmle.Extraction.Tests
         {
             (var testSubject, var progressMonitor, var files) = TestSetup();
 
-            // NOTE: the ordering DOES matter, later filters takes priority, so the exclude will end up not mattering at all.
             Environment.SetEnvironmentVariable("LGTM_INDEX_FILTERS", """
                 exclude:c/x/z
                 include:c/x
@@ -175,8 +174,7 @@ namespace Semmle.Extraction.Tests
 
             var expected = GetExpected(
                 [
-                    "/a/b/c/x/y/i.cs",
-                    "/a/b/c/x/z/i.cs"
+                    "/a/b/c/x/y/i.cs"
                 ]);
 
             AssertFileInfoEquivalence(expected, filtered);

csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md

@@ -1,7 +1,3 @@
-## 1.7.6
-
-No user-facing changes.
-
 ## 1.7.5
 
 No user-facing changes.

csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.6.md

@@ -1,3 +0,0 @@
-## 1.7.6
-
-No user-facing changes.

csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.7.6
+lastReleaseVersion: 1.7.5

csharp/ql/campaigns/Solorigate/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-all
-version: 1.7.7-dev
+version: 1.7.6-dev
 groups:
   - csharp
   - solorigate

csharp/ql/campaigns/Solorigate/src/CHANGELOG.md

@@ -1,7 +1,3 @@
-## 1.7.6
-
-No user-facing changes.
-
 ## 1.7.5
 
 No user-facing changes.

csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.6.md

@@ -1,3 +0,0 @@
-## 1.7.6
-
-No user-facing changes.

csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.7.6
+lastReleaseVersion: 1.7.5

csharp/ql/campaigns/Solorigate/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-queries
-version: 1.7.7-dev
+version: 1.7.6-dev
 groups:
   - csharp
   - solorigate

csharp/ql/lib/CHANGELOG.md

@@ -1,11 +1,3 @@
-## 0.8.6
-
-### Minor Analysis Improvements
-
-* The `Call::getArgumentForParameter` predicate has been reworked to add support for arguments passed to `params` parameters.
-* The dataflow models for the `System.Text.StringBuilder` class have been reworked. New summaries have been added for `Append` and `AppendLine`. With the changes, we expect queries that use taint tracking to find more results when interpolated strings or `StringBuilder` instances are passed to `Append` or `AppendLine`.
-* Additional support for `Amazon.Lambda` SDK
-
 ## 0.8.5
 
 No user-facing changes.

csharp/ql/lib/change-notes/2023-06-22-aws-lambda-models.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Additional support for `Amazon.Lambda` SDK

csharp/ql/lib/change-notes/2023-12-07-stringbuilder.md

@@ -1,7 +1,5 @@
-## 0.8.6
+---
+category: minorAnalysis
+---
 
-### Minor Analysis Improvements
-
-* The `Call::getArgumentForParameter` predicate has been reworked to add support for arguments passed to `params` parameters.
-* The dataflow models for the `System.Text.StringBuilder` class have been reworked. New summaries have been added for `Append` and `AppendLine`. With the changes, we expect queries that use taint tracking to find more results when interpolated strings or `StringBuilder` instances are passed to `Append` or `AppendLine`.
-* Additional support for `Amazon.Lambda` SDK
+* The dataflow models for the `System.Text.StringBuilder` class have been reworked. New summaries have been added for `Append` and `AppendLine`. With the changes, we expect queries that use taint tracking to find more results when interpolated strings or `StringBuilder` instances are passed to `Append` or `AppendLine`.

csharp/ql/lib/change-notes/2023-12-20-arg-param-mapping.md

@@ -0,0 +1,5 @@
+---
+category: minorAnalysis
+---
+
+* The `Call::getArgumentForParameter` predicate has been reworked to add support for arguments passed to `params` parameters.

csharp/ql/lib/change-notes/2024-01-10-lambda-param-defaults.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* C# 12: Add extractor support for lambda expressions with parameter defaults like `(int x, int y = 1) => ...` and lambda expressions with a `param` parameter like `(params int[] x) => ...)`.

csharp/ql/lib/change-notes/2024-01-11-manual-neutral-model-blocks-generated-models.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* A manual neutral summary model for a callable now blocks all generated summary models for that callable from having any effect.

csharp/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.8.6
+lastReleaseVersion: 0.8.5

csharp/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-all
-version: 0.8.7-dev
+version: 0.8.6-dev
 groups: csharp
 dbscheme: semmlecode.csharp.dbscheme
 extractor: csharp

csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll

@@ -529,13 +529,6 @@ private predicate interpretSummary(
   )
 }
 
-private predicate interpretNeutral(UnboundCallable c, string kind, string provenance) {
-  exists(string namespace, string type, string name, string signature |
-    neutralModel(namespace, type, name, signature, kind, provenance) and
-    c = interpretElement(namespace, type, false, name, signature, "")
-  )
-}
-
 // adapter class for converting Mad summaries to `SummarizedCallable`s
 private class SummarizedCallableAdapter extends SummarizedCallable {
   SummarizedCallableAdapter() { interpretSummary(this, _, _, _, _) }
@@ -551,10 +544,6 @@ private class SummarizedCallableAdapter extends SummarizedCallable {
     exists(Provenance provenance |
       interpretSummary(this, input, output, kind, provenance) and
       provenance.isGenerated()
-    ) and
-    not exists(Provenance provenance |
-      interpretNeutral(this, "summary", provenance) and
-      provenance.isManual()
     )
   }
 
@@ -579,7 +568,12 @@ private class NeutralCallableAdapter extends NeutralCallable {
   string kind;
   string provenance_;
 
-  NeutralCallableAdapter() { interpretNeutral(this, kind, provenance_) }
+  NeutralCallableAdapter() {
+    exists(string namespace, string type, string name, string signature |
+      neutralModel(namespace, type, name, signature, kind, provenance_) and
+      this = interpretElement(namespace, type, false, name, signature, "")
+    )
+  }
 
   override string getKind() { result = kind }
 

csharp/ql/lib/semmle/code/csharp/exprs/Call.qll

@@ -60,17 +60,18 @@ class Call extends DotNet::Call, Expr, @call {
    */
   cached
   override Expr getArgumentForParameter(DotNet::Parameter p) {
-    // Appears in the positional part of the call
-    result = this.getImplicitArgument(p)
-    or
-    // Appears in the named part of the call
     this.getTarget().getAParameter() = p and
-    result = this.getExplicitArgument(p.getName())
+    (
+      // Appears in the positional part of the call
+      result = this.getImplicitArgument(p)
+      or
+      // Appears in the named part of the call
+      result = this.getExplicitArgument(p.getName())
+    )
   }
 
   pragma[noinline]
   private Expr getImplicitArgument(DotNet::Parameter p) {
-    this.getTarget().getAParameter() = p and
     not exists(result.getExplicitArgumentName()) and
     (
       p.(Parameter).isParams() and
@@ -181,39 +182,15 @@ class Call extends DotNet::Call, Expr, @call {
   /**
    * Gets the argument that corresponds to parameter `p` of a potential
    * run-time target of this call.
-   *
-   * This takes into account both positional and named arguments, but does not
-   * consider default arguments.
    */
-  cached
   Expr getRuntimeArgumentForParameter(Parameter p) {
-    // Appears in the positional part of the call
-    result = this.getImplicitRuntimeArgument(p)
-    or
-    // Appears in the named part of the call
-    this.getARuntimeTarget().getAParameter() = p and
-    result = this.getExplicitRuntimeArgument(p.getName())
-  }
-
-  pragma[noinline]
-  private Expr getImplicitRuntimeArgument(Parameter p) {
-    this.getARuntimeTarget().getAParameter() = p and
-    not exists(result.getExplicitArgumentName()) and
-    (
-      p.isParams() and
-      result = this.getRuntimeArgument(any(int i | i >= p.getPosition()))
-      or
-      not p.isParams() and
+    exists(Callable c |
+      c = this.getARuntimeTarget() and
+      p = c.getAParameter() and
       result = this.getRuntimeArgument(p.getPosition())
     )
   }
 
-  pragma[nomagic]
-  private Expr getExplicitRuntimeArgument(string name) {
-    result = this.getARuntimeArgument() and
-    result.getExplicitArgumentName() = name
-  }
-
   /**
    * Gets the argument that corresponds to a parameter named `name` of a potential
    * run-time target of this call.

csharp/ql/src/CHANGELOG.md

@@ -1,10 +1,3 @@
-## 0.8.6
-
-### Minor Analysis Improvements
-
-* Fixed a Log forging false positive when using `String.Replace` to sanitize the input.    
-* Fixed a URL redirection from remote source false positive when guarding a redirect with `HttpRequestBase.IsUrlLocalToHost()`
-
 ## 0.8.5
 
 No user-facing changes.

csharp/ql/src/change-notes/2023-11-29-url-redirect-false-positive.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Fixed a URL redirection from remote source false positive when guarding a redirect with `HttpRequestBase.IsUrlLocalToHost()`

csharp/ql/src/change-notes/2024-01-03-logforging-false-positive.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Fixed a Log forging false positive when using `String.Replace` to sanitize the input.    

csharp/ql/src/change-notes/released/0.8.6.md

@@ -1,6 +0,0 @@
-## 0.8.6
-
-### Minor Analysis Improvements
-
-* Fixed a Log forging false positive when using `String.Replace` to sanitize the input.    
-* Fixed a URL redirection from remote source false positive when guarding a redirect with `HttpRequestBase.IsUrlLocalToHost()`

csharp/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.8.6
+lastReleaseVersion: 0.8.5

csharp/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-queries
-version: 0.8.7-dev
+version: 0.8.6-dev
 groups:
   - csharp
   - queries

csharp/ql/src/utils/modelgenerator/CaptureDiscardedSummaryModels.ql

@@ -0,0 +1,15 @@
+/**
+ * @name Capture discarded summary models.
+ * @description Finds summary models that are discarded as handwritten counterparts exist.
+ * @id cs/utils/modelgenerator/discarded-summary-models
+ */
+
+import semmle.code.csharp.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl
+import internal.CaptureModels
+import internal.CaptureSummaryFlowQuery
+
+from DataFlowTargetApi api, string flow
+where
+  flow = captureFlow(api) and
+  api.(FlowSummaryImpl::Public::SummarizedCallable).applyManualModel()
+select flow order by flow

csharp/ql/src/utils/modelgenerator/CaptureNeutralModels.ql

@@ -11,5 +11,7 @@ import internal.CaptureModels
 import internal.CaptureSummaryFlowQuery
 
 from DataFlowTargetApi api, string noflow
-where noflow = captureNoFlow(api)
+where
+  noflow = captureNoFlow(api) and
+  not api.(FlowSummaryImpl::Public::SummarizedCallable).applyManualModel()
 select noflow order by noflow

csharp/ql/src/utils/modelgenerator/CaptureSummaryModels.ql

@@ -11,5 +11,7 @@ import internal.CaptureModels
 import internal.CaptureSummaryFlowQuery
 
 from DataFlowTargetApi api, string flow
-where flow = captureFlow(api)
+where
+  flow = captureFlow(api) and
+  not api.(FlowSummaryImpl::Public::SummarizedCallable).applyManualModel()
 select flow order by flow

csharp/ql/src/utils/modelgenerator/internal/CaptureModelsSpecific.qll

@@ -7,7 +7,6 @@ private import dotnet
 private import semmle.code.csharp.commons.Util as Util
 private import semmle.code.csharp.commons.Collections as Collections
 private import semmle.code.csharp.dataflow.internal.DataFlowDispatch
-private import semmle.code.csharp.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl
 private import semmle.code.csharp.frameworks.system.linq.Expressions
 import semmle.code.csharp.dataflow.internal.ExternalFlow as ExternalFlow
 import semmle.code.csharp.dataflow.internal.DataFlowImplCommon as DataFlowImplCommon
@@ -38,10 +37,7 @@ private predicate isRelevantForModels(CS::Callable api) {
   not api instanceof Util::MainMethod and
   not api instanceof CS::Destructor and
   not api instanceof CS::AnonymousFunctionExpr and
-  not api.(CS::Constructor).isParameterless() and
-  // Disregard all APIs that have a manual model.
-  not api = any(FlowSummaryImpl::Public::SummarizedCallable sc | sc.applyManualModel()) and
-  not api = any(FlowSummaryImpl::Public::NeutralSummaryCallable sc | sc.hasManualModel())
+  not api.(CS::Constructor).isParameterless()
 }
 
 /**

csharp/ql/test/library-tests/arguments/PrintAst.expected

@@ -353,98 +353,3 @@ arguments.cs:
 #   93|       0: [Parameter] b
 #   93|         -1: [TypeMention] bool
 #   93|     4: [BlockStmt] {...}
-lambdas.cs:
-#    3| [Class] LambdaArgumentsTest
-#    5|   5: [Method] M1
-#    5|     -1: [TypeMention] Void
-#    6|     4: [BlockStmt] {...}
-#    7|       0: [LocalVariableDeclStmt] ... ...;
-#    7|         0: [LocalVariableDeclAndInitExpr] Func<Int32,Int32> l1 = ...
-#    7|           -1: [TypeMention] Func<int, int>
-#    7|           0: [LocalVariableAccess] access to local variable l1
-#    7|           1: [LambdaExpr] (...) => ...
-#-----|             2: (Parameters)
-#    7|               0: [Parameter] x
-#    7|                 -1: [TypeMention] int
-#    7|             4: [AddExpr] ... + ...
-#    7|               0: [ParameterAccess] access to parameter x
-#    7|               1: [IntLiteral] 1
-#    8|       1: [ExprStmt] ...;
-#    8|         0: [DelegateCall] delegate call
-#    8|           -1: [LocalVariableAccess] access to local variable l1
-#    8|           0: [IntLiteral] 1
-#   10|       2: [LocalVariableDeclStmt] ... ...;
-#   10|         0: [LocalVariableDeclAndInitExpr] <>__AnonType0<> l2 = ...
-#   10|           -1: [TypeMention] <>__AnonType0<>
-#   10|           0: [LocalVariableAccess] access to local variable l2
-#   10|           1: [LambdaExpr] (...) => ...
-#-----|             2: (Parameters)
-#   10|               0: [Parameter] x
-#   10|                 -1: [TypeMention] int
-#   10|               1: [Parameter] y
-#   10|                 -1: [TypeMention] int
-#   10|                 1: [IntLiteral] 1
-#   10|             4: [AddExpr] ... + ...
-#   10|               0: [ParameterAccess] access to parameter x
-#   10|               1: [ParameterAccess] access to parameter y
-#   11|       3: [ExprStmt] ...;
-#   11|         0: [DelegateCall] delegate call
-#   11|           -1: [LocalVariableAccess] access to local variable l2
-#   11|           0: [IntLiteral] 2
-#   11|           1: [IntLiteral] 3
-#   12|       4: [ExprStmt] ...;
-#   12|         0: [DelegateCall] delegate call
-#   12|           -1: [LocalVariableAccess] access to local variable l2
-#   12|           0: [IntLiteral] 4
-#   13|       5: [ExprStmt] ...;
-#   13|         0: [DelegateCall] delegate call
-#   13|           -1: [LocalVariableAccess] access to local variable l2
-#   13|           0: [IntLiteral] 5
-#   13|           1: [IntLiteral] 6
-#   15|       6: [LocalVariableDeclStmt] ... ...;
-#   15|         0: [LocalVariableDeclAndInitExpr] <>__AnonType0<> l3 = ...
-#   15|           -1: [TypeMention] <>__AnonType0<>
-#   15|           0: [LocalVariableAccess] access to local variable l3
-#   15|           1: [LambdaExpr] (...) => ...
-#-----|             2: (Parameters)
-#   15|               0: [Parameter] x
-#   15|                 -1: [TypeMention] Int32[]
-#   15|                   1: [TypeMention] int
-#   15|             4: [PropertyCall] access to property Length
-#   15|               -1: [ParameterAccess] access to parameter x
-#   16|       7: [ExprStmt] ...;
-#   16|         0: [DelegateCall] delegate call
-#   16|           -1: [LocalVariableAccess] access to local variable l3
-#   17|       8: [ExprStmt] ...;
-#   17|         0: [DelegateCall] delegate call
-#   17|           -1: [LocalVariableAccess] access to local variable l3
-#   17|           0: [IntLiteral] 7
-#   17|           1: [IntLiteral] 8
-#   17|           2: [IntLiteral] 9
-#   20|   6: [DelegateType] MyDelegate
-#-----|     2: (Parameters)
-#   20|       0: [Parameter] x
-#   20|         -1: [TypeMention] int
-#   20|       1: [Parameter] y
-#   20|         -1: [TypeMention] int
-#   22|   7: [Method] M2
-#   22|     -1: [TypeMention] Void
-#   23|     4: [BlockStmt] {...}
-#   24|       0: [LocalVariableDeclStmt] ... ...;
-#   24|         0: [LocalVariableDeclAndInitExpr] MyDelegate sum = ...
-#   24|           -1: [TypeMention] MyDelegate
-#   24|           0: [LocalVariableAccess] access to local variable sum
-#   24|           1: [LambdaExpr] (...) => ...
-#-----|             2: (Parameters)
-#   24|               0: [Parameter] x
-#   24|                 -1: [TypeMention] int
-#   24|               1: [Parameter] y
-#   24|                 -1: [TypeMention] int
-#   24|             4: [AddExpr] ... + ...
-#   24|               0: [ParameterAccess] access to parameter x
-#   24|               1: [ParameterAccess] access to parameter y
-#   25|       1: [ExprStmt] ...;
-#   25|         0: [DelegateCall] delegate call
-#   25|           -1: [LocalVariableAccess] access to local variable sum
-#   25|           0: [IntLiteral] 4
-#   25|           1: [IntLiteral] 5

csharp/ql/test/library-tests/arguments/argumentName.expected

@@ -11,5 +11,3 @@
 | arguments.cs:70:36:70:36 | 0 | x |
 | arguments.cs:78:18:78:21 | access to parameter args | args |
 | arguments.cs:78:27:78:27 | 0 | o |
-| lambdas.cs:25:16:25:16 | 4 | y |
-| lambdas.cs:25:22:25:22 | 5 | x |

csharp/ql/test/library-tests/arguments/argumentType.expected

@@ -70,14 +70,3 @@
 | arguments.cs:84:23:84:43 | array creation of type Double[] | 0 |
 | arguments.cs:85:20:85:20 | 0 | 0 |
 | arguments.cs:85:23:85:43 | array creation of type Double[] | 0 |
-| lambdas.cs:8:12:8:12 | 1 | 0 |
-| lambdas.cs:11:12:11:12 | 2 | 0 |
-| lambdas.cs:11:15:11:15 | 3 | 0 |
-| lambdas.cs:12:12:12:12 | 4 | 0 |
-| lambdas.cs:13:12:13:12 | 5 | 0 |
-| lambdas.cs:13:15:13:15 | 6 | 0 |
-| lambdas.cs:17:12:17:12 | 7 | 0 |
-| lambdas.cs:17:15:17:15 | 8 | 0 |
-| lambdas.cs:17:18:17:18 | 9 | 0 |
-| lambdas.cs:25:16:25:16 | 4 | 0 |
-| lambdas.cs:25:22:25:22 | 5 | 0 |

csharp/ql/test/library-tests/arguments/lambdaArgument.expected

@@ -1,11 +0,0 @@
-| lambdas.cs:8:9:8:13 | delegate call | lambdas.cs:7:23:7:23 | x | lambdas.cs:8:12:8:12 | 1 |
-| lambdas.cs:11:9:11:16 | delegate call | lambdas.cs:10:23:10:23 | x | lambdas.cs:11:12:11:12 | 2 |
-| lambdas.cs:11:9:11:16 | delegate call | lambdas.cs:10:30:10:30 | y | lambdas.cs:11:15:11:15 | 3 |
-| lambdas.cs:12:9:12:13 | delegate call | lambdas.cs:10:23:10:23 | x | lambdas.cs:12:12:12:12 | 4 |
-| lambdas.cs:13:9:13:16 | delegate call | lambdas.cs:10:23:10:23 | x | lambdas.cs:13:12:13:12 | 5 |
-| lambdas.cs:13:9:13:16 | delegate call | lambdas.cs:10:30:10:30 | y | lambdas.cs:13:15:13:15 | 6 |
-| lambdas.cs:17:9:17:19 | delegate call | lambdas.cs:15:32:15:32 | x | lambdas.cs:17:12:17:12 | 7 |
-| lambdas.cs:17:9:17:19 | delegate call | lambdas.cs:15:32:15:32 | x | lambdas.cs:17:15:17:15 | 8 |
-| lambdas.cs:17:9:17:19 | delegate call | lambdas.cs:15:32:15:32 | x | lambdas.cs:17:18:17:18 | 9 |
-| lambdas.cs:25:9:25:23 | delegate call | lambdas.cs:24:31:24:31 | x | lambdas.cs:25:22:25:22 | 5 |
-| lambdas.cs:25:9:25:23 | delegate call | lambdas.cs:24:38:24:38 | y | lambdas.cs:25:16:25:16 | 4 |

csharp/ql/test/library-tests/arguments/lambdaArgument.ql

@@ -1,7 +0,0 @@
-import csharp
-
-from Call call, Parameter p, Expr arg
-where
-  call.getARuntimeTarget() instanceof LambdaExpr and
-  arg = call.getRuntimeArgumentForParameter(p)
-select call, p, arg

csharp/ql/test/library-tests/arguments/lambdas.cs

@@ -1,28 +0,0 @@
-using System;
-
-class LambdaArgumentsTest
-{
-    void M1()
-    {
-        var l1 = (int x) => x + 1;
-        l1(1);
-
-        var l2 = (int x, int y = 1) => x + y;
-        l2(2, 3);
-        l2(4);
-        l2(5, 6);
-
-        var l3 = (params int[] x) => x.Length;
-        l3();
-        l3(7, 8, 9);
-    }
-
-    delegate int MyDelegate(int x, int y);
-
-    void M2()
-    {
-        MyDelegate sum = (int x, int y) => x + y;
-        sum(y: 4, x: 5);
-    }
-}
-

csharp/ql/test/library-tests/dataflow/external-models/ExternalFlow.cs

@@ -206,25 +206,12 @@ namespace My.Qltest
             Sink(MixedFlowArgs(null, o2));
         }
 
-        void M4()
-        {
-            var o1 = new object();
-            Sink(GeneratedFlowWithGeneratedNeutral(o1));
-
-            var o2 = new object();
-            Sink(GeneratedFlowWithManualNeutral(o2)); // no flow because the modelled method has a manual neutral summary model
-        }
-
         object GeneratedFlow(object o) => throw null;
 
         object GeneratedFlowArgs(object o1, object o2) => throw null;
 
         object MixedFlowArgs(object o1, object o2) => throw null;
 
-        object GeneratedFlowWithGeneratedNeutral(object o) => throw null;
-
-        object GeneratedFlowWithManualNeutral(object o) => throw null;
-
         static void Sink(object o) { }
     }
 

csharp/ql/test/library-tests/dataflow/external-models/ExternalFlow.expected

@@ -63,11 +63,9 @@ edges
 | ExternalFlow.cs:120:18:120:18 | access to local variable b : null [element] : Object | ExternalFlow.cs:120:18:120:21 | access to array element |
 | ExternalFlow.cs:205:22:205:33 | object creation of type Object : Object | ExternalFlow.cs:206:38:206:39 | access to local variable o2 : Object |
 | ExternalFlow.cs:206:38:206:39 | access to local variable o2 : Object | ExternalFlow.cs:206:18:206:40 | call to method MixedFlowArgs |
-| ExternalFlow.cs:211:22:211:33 | object creation of type Object : Object | ExternalFlow.cs:212:52:212:53 | access to local variable o1 : Object |
-| ExternalFlow.cs:212:52:212:53 | access to local variable o1 : Object | ExternalFlow.cs:212:18:212:54 | call to method GeneratedFlowWithGeneratedNeutral |
-| ExternalFlow.cs:244:21:244:28 | object creation of type HC : HC | ExternalFlow.cs:245:21:245:21 | access to local variable h : HC |
-| ExternalFlow.cs:245:21:245:21 | access to local variable h : HC | ExternalFlow.cs:245:21:245:39 | call to method ExtensionMethod : HC |
-| ExternalFlow.cs:245:21:245:39 | call to method ExtensionMethod : HC | ExternalFlow.cs:246:18:246:18 | access to local variable o |
+| ExternalFlow.cs:231:21:231:28 | object creation of type HC : HC | ExternalFlow.cs:232:21:232:21 | access to local variable h : HC |
+| ExternalFlow.cs:232:21:232:21 | access to local variable h : HC | ExternalFlow.cs:232:21:232:39 | call to method ExtensionMethod : HC |
+| ExternalFlow.cs:232:21:232:39 | call to method ExtensionMethod : HC | ExternalFlow.cs:233:18:233:18 | access to local variable o |
 nodes
 | ExternalFlow.cs:9:27:9:38 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
 | ExternalFlow.cs:10:18:10:33 | call to method StepArgRes | semmle.label | call to method StepArgRes |
@@ -150,13 +148,10 @@ nodes
 | ExternalFlow.cs:205:22:205:33 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
 | ExternalFlow.cs:206:18:206:40 | call to method MixedFlowArgs | semmle.label | call to method MixedFlowArgs |
 | ExternalFlow.cs:206:38:206:39 | access to local variable o2 : Object | semmle.label | access to local variable o2 : Object |
-| ExternalFlow.cs:211:22:211:33 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
-| ExternalFlow.cs:212:18:212:54 | call to method GeneratedFlowWithGeneratedNeutral | semmle.label | call to method GeneratedFlowWithGeneratedNeutral |
-| ExternalFlow.cs:212:52:212:53 | access to local variable o1 : Object | semmle.label | access to local variable o1 : Object |
-| ExternalFlow.cs:244:21:244:28 | object creation of type HC : HC | semmle.label | object creation of type HC : HC |
-| ExternalFlow.cs:245:21:245:21 | access to local variable h : HC | semmle.label | access to local variable h : HC |
-| ExternalFlow.cs:245:21:245:39 | call to method ExtensionMethod : HC | semmle.label | call to method ExtensionMethod : HC |
-| ExternalFlow.cs:246:18:246:18 | access to local variable o | semmle.label | access to local variable o |
+| ExternalFlow.cs:231:21:231:28 | object creation of type HC : HC | semmle.label | object creation of type HC : HC |
+| ExternalFlow.cs:232:21:232:21 | access to local variable h : HC | semmle.label | access to local variable h : HC |
+| ExternalFlow.cs:232:21:232:39 | call to method ExtensionMethod : HC | semmle.label | call to method ExtensionMethod : HC |
+| ExternalFlow.cs:233:18:233:18 | access to local variable o | semmle.label | access to local variable o |
 subpaths
 #select
 | ExternalFlow.cs:10:18:10:33 | call to method StepArgRes | ExternalFlow.cs:9:27:9:38 | object creation of type Object : Object | ExternalFlow.cs:10:18:10:33 | call to method StepArgRes | $@ | ExternalFlow.cs:9:27:9:38 | object creation of type Object : Object | object creation of type Object : Object |
@@ -180,5 +175,4 @@ subpaths
 | ExternalFlow.cs:112:18:112:25 | access to property MyProp | ExternalFlow.cs:111:24:111:35 | object creation of type Object : Object | ExternalFlow.cs:112:18:112:25 | access to property MyProp | $@ | ExternalFlow.cs:111:24:111:35 | object creation of type Object : Object | object creation of type Object : Object |
 | ExternalFlow.cs:120:18:120:21 | access to array element | ExternalFlow.cs:117:36:117:47 | object creation of type Object : Object | ExternalFlow.cs:120:18:120:21 | access to array element | $@ | ExternalFlow.cs:117:36:117:47 | object creation of type Object : Object | object creation of type Object : Object |
 | ExternalFlow.cs:206:18:206:40 | call to method MixedFlowArgs | ExternalFlow.cs:205:22:205:33 | object creation of type Object : Object | ExternalFlow.cs:206:18:206:40 | call to method MixedFlowArgs | $@ | ExternalFlow.cs:205:22:205:33 | object creation of type Object : Object | object creation of type Object : Object |
-| ExternalFlow.cs:212:18:212:54 | call to method GeneratedFlowWithGeneratedNeutral | ExternalFlow.cs:211:22:211:33 | object creation of type Object : Object | ExternalFlow.cs:212:18:212:54 | call to method GeneratedFlowWithGeneratedNeutral | $@ | ExternalFlow.cs:211:22:211:33 | object creation of type Object : Object | object creation of type Object : Object |
-| ExternalFlow.cs:246:18:246:18 | access to local variable o | ExternalFlow.cs:244:21:244:28 | object creation of type HC : HC | ExternalFlow.cs:246:18:246:18 | access to local variable o | $@ | ExternalFlow.cs:244:21:244:28 | object creation of type HC : HC | object creation of type HC : HC |
+| ExternalFlow.cs:233:18:233:18 | access to local variable o | ExternalFlow.cs:231:21:231:28 | object creation of type HC : HC | ExternalFlow.cs:233:18:233:18 | access to local variable o | $@ | ExternalFlow.cs:231:21:231:28 | object creation of type HC : HC | object creation of type HC : HC |

csharp/ql/test/library-tests/dataflow/external-models/ExternalFlow.ext.yml

@@ -29,13 +29,4 @@ extensions:
       - ["My.Qltest", "G", false, "GeneratedFlowArgs", "(System.Object,System.Object)", "", "Argument[1]", "ReturnValue", "value", "df-generated"]
       - ["My.Qltest", "G", false, "MixedFlowArgs", "(System.Object,System.Object)", "", "Argument[0]", "ReturnValue", "value", "df-generated"]
       - ["My.Qltest", "G", false, "MixedFlowArgs", "(System.Object,System.Object)", "", "Argument[1]", "ReturnValue", "value", "manual"]
-      - ["My.Qltest", "G", false, "GeneratedFlowWithGeneratedNeutral", "(System.Object)", "", "Argument[0]", "ReturnValue", "value", "df-generated"]
-      - ["My.Qltest", "G", false, "GeneratedFlowWithManualNeutral", "(System.Object)", "", "Argument[0]", "ReturnValue", "value", "df-generated"]
       - ["My.Qltest", "HE", false, "ExtensionMethod", "(My.Qltest.HI)", "", "Argument[0]", "ReturnValue", "value", "manual"]
-  - addsTo:
-      pack: codeql/csharp-all
-      extensible: neutralModel
-      # "namespace", "type", "name", "signature", "kind", "provenance"
-    data:
-      - ["My.Qltest", "G", "GeneratedFlowWithGeneratedNeutral", "(System.Object)", "summary", "df-generated"]
-      - ["My.Qltest", "G", "GeneratedFlowWithManualNeutral", "(System.Object)", "summary", "manual"]

csharp/ql/test/library-tests/dataflow/external-models/ExternalFlow.ql

@@ -21,18 +21,11 @@ module TaintConfig implements DataFlow::ConfigSig {
 module Taint = TaintTracking::Global<TaintConfig>;
 
 /**
- * Emulate that methods with summaries do not have a body.
- * This is relevant for dataflow analysis using summaries with a generated like
- * provenance as generated summaries are only applied, if a
- * callable does not have a body.
+ * Simulate that methods with summaries are not included in the source code.
+ * This is relevant for dataflow analysis using summaries tagged as generated.
  */
-private class MethodsWithGeneratedModels extends Method {
-  MethodsWithGeneratedModels() {
-    this.hasFullyQualifiedName("My.Qltest", "G",
-      ["MixedFlowArgs", "GeneratedFlowWithGeneratedNeutral", "GeneratedFlowWithManualNeutral"])
-  }
-
-  override predicate hasBody() { none() }
+private class MyMethod extends Method {
+  override predicate fromSource() { none() }
 }
 
 from Taint::PathNode source, Taint::PathNode sink

csharp/ql/test/library-tests/dataflow/external-models/Steps.cs

@@ -42,12 +42,6 @@ namespace My.Qltest
             gen.StepGeneric2(false);
 
             new Sub().StepOverride("string");
-
-            object arg4 = new object();
-            this.StepArgQualGenerated(arg4);
-            
-            object arg5 = new object();
-            this.StepArgQualGeneratedIgnored(arg5);
         }
 
         object StepArgRes(object x) { return null; }
@@ -56,10 +50,6 @@ namespace My.Qltest
 
         void StepArgQual(object x) { }
 
-        void StepArgQualGenerated(object x) { }
-
-        void StepArgQualGeneratedIgnored(object x) { }
-
         object StepQualRes() { return null; }
 
         void StepQualArg(object @out) { }
@@ -97,4 +87,4 @@ namespace My.Qltest
             public override string StepOverride(string i) => throw null;
         }
     }
-}
+}

csharp/ql/test/library-tests/dataflow/external-models/steps.expected

@@ -11,12 +11,11 @@ summaryThroughStep
 | Steps.cs:41:29:41:29 | 0 | Steps.cs:41:13:41:30 | call to method StepGeneric | true |
 | Steps.cs:42:30:42:34 | false | Steps.cs:42:13:42:35 | call to method StepGeneric2<Boolean> | true |
 | Steps.cs:44:36:44:43 | "string" | Steps.cs:44:13:44:44 | call to method StepOverride | true |
-| Steps.cs:47:39:47:42 | access to local variable arg4 | Steps.cs:47:13:47:16 | [post] this access | false |
 summaryGetterStep
-| Steps.cs:28:13:28:16 | this access | Steps.cs:28:13:28:34 | call to method StepFieldGetter | Steps.cs:67:13:67:17 | field Field |
-| Steps.cs:32:13:32:16 | this access | Steps.cs:32:13:32:37 | call to method StepPropertyGetter | Steps.cs:73:13:73:20 | property Property |
+| Steps.cs:28:13:28:16 | this access | Steps.cs:28:13:28:34 | call to method StepFieldGetter | Steps.cs:57:13:57:17 | field Field |
+| Steps.cs:32:13:32:16 | this access | Steps.cs:32:13:32:37 | call to method StepPropertyGetter | Steps.cs:63:13:63:20 | property Property |
 | Steps.cs:36:13:36:16 | this access | Steps.cs:36:13:36:36 | call to method StepElementGetter | file://:0:0:0:0 | element |
 summarySetterStep
-| Steps.cs:30:34:30:34 | 0 | Steps.cs:30:13:30:16 | [post] this access | Steps.cs:67:13:67:17 | field Field |
-| Steps.cs:34:37:34:37 | 0 | Steps.cs:34:13:34:16 | [post] this access | Steps.cs:73:13:73:20 | property Property |
+| Steps.cs:30:34:30:34 | 0 | Steps.cs:30:13:30:16 | [post] this access | Steps.cs:57:13:57:17 | field Field |
+| Steps.cs:34:37:34:37 | 0 | Steps.cs:34:13:34:16 | [post] this access | Steps.cs:63:13:63:20 | property Property |
 | Steps.cs:38:36:38:36 | 0 | Steps.cs:38:13:38:16 | [post] this access | file://:0:0:0:0 | element |

csharp/ql/test/library-tests/dataflow/external-models/steps.ext.yml

@@ -18,13 +18,3 @@ extensions:
       - ["My.Qltest", "C+Generic<T,U>", false, "StepGeneric", "(T)", "", "Argument[0]", "ReturnValue", "value", "manual"]
       - ["My.Qltest", "C+Generic<T,U>", false, "StepGeneric2<S>", "(S)", "", "Argument[0]", "ReturnValue", "value", "manual"]
       - ["My.Qltest", "C+Base<T>", true, "StepOverride", "(T)", "", "Argument[0]", "ReturnValue", "value", "manual"]
-      - ["My.Qltest", "C", false, "StepArgQualGenerated", "(System.Object)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
-      - ["My.Qltest", "C", false, "StepArgQualGeneratedIgnored", "(System.Object)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"]
-  - addsTo:
-      pack: codeql/csharp-all
-      extensible: neutralModel
-      # "namespace", "type", "name", "signature", "kind", "provenance"
-    data:
-      - ["My.Qltest", "C", "StepArgQualGenerated", "(System.Object)", "summary", "df-generated"]
-      - ["My.Qltest", "C", "StepArgQualGeneratedIgnored", "(System.Object)", "summary", "manual"]
-

csharp/ql/test/library-tests/dataflow/external-models/steps.ql

@@ -6,22 +6,6 @@ import semmle.code.csharp.dataflow.FlowSummary
 import semmle.code.csharp.dataflow.internal.DataFlowDispatch as DataFlowDispatch
 import semmle.code.csharp.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl
 
-/**
- * Emulate that methods with summaries do not have a body.
- * This is relevant for dataflow analysis using summaries with a generated like
- * provenance as generated summaries are only applied, if a
- * callable does not have a body.
- */
-private class StepArgQualGenerated extends Method {
-  StepArgQualGenerated() {
-    exists(string name |
-      this.hasFullyQualifiedName("My.Qltest", "C", name) and name.matches("StepArgQualGenerated%")
-    )
-  }
-
-  override predicate hasBody() { none() }
-}
-
 query predicate summaryThroughStep(
   DataFlow::Node node1, DataFlow::Node node2, boolean preservesValue
 ) {

csharp/ql/test/library-tests/parameters/LambdaParameters.cs

@@ -1,15 +0,0 @@
-using System;
-using System.Runtime.InteropServices;
-using System.Runtime.CompilerServices;
-
-public class LambdaParameters
-{
-    public void M1()
-    {
-        var l1 = (int x, int y = 1) => x + y;
-        var l2 = (object? o = default) => o;
-        var l3 = (int x, int y = 1, int z = 2) => x + y + z;
-        var l4 = ([Optional, DefaultParameterValue(7)] int x) => x;
-        var l5 = ([Optional, DateTimeConstant(14L)] DateTime x) => x;
-    }
-}

csharp/ql/test/library-tests/parameters/Parameters.expected

@@ -1,6 +1,4 @@
 noDefaultValue
-| LambdaParameters.cs:9:18:9:44 | (...) => ... | LambdaParameters.cs:9:23:9:23 | x | 0 |
-| LambdaParameters.cs:11:18:11:59 | (...) => ... | LambdaParameters.cs:11:23:11:23 | x | 0 |
 | Parameters.cs:7:17:7:18 | M1 | Parameters.cs:7:24:7:24 | a | 0 |
 | Parameters.cs:7:17:7:18 | M1 | Parameters.cs:7:34:7:34 | b | 1 |
 | Parameters.cs:7:17:7:18 | M1 | Parameters.cs:7:44:7:44 | c | 2 |
@@ -18,12 +16,6 @@ noDefaultValue
 | Parameters.dll:0:0:0:0 | implicit conversion | Parameters.dll:0:0:0:0 | i | 0 |
 | Parameters.dll:0:0:0:0 | implicit conversion | Parameters.dll:0:0:0:0 | s | 0 |
 withDefaultValue
-| LambdaParameters.cs:9:18:9:44 | (...) => ... | LambdaParameters.cs:9:30:9:30 | y | 1 | LambdaParameters.cs:9:34:9:34 | 1 | 1 |
-| LambdaParameters.cs:10:18:10:43 | (...) => ... | LambdaParameters.cs:10:27:10:27 | o | 0 | LambdaParameters.cs:10:31:10:37 | default | null |
-| LambdaParameters.cs:11:18:11:59 | (...) => ... | LambdaParameters.cs:11:30:11:30 | y | 1 | LambdaParameters.cs:11:34:11:34 | 1 | 1 |
-| LambdaParameters.cs:11:18:11:59 | (...) => ... | LambdaParameters.cs:11:41:11:41 | z | 2 | LambdaParameters.cs:11:45:11:45 | 2 | 2 |
-| LambdaParameters.cs:12:18:12:66 | (...) => ... | LambdaParameters.cs:12:60:12:60 | x | 0 | LambdaParameters.cs:12:19:12:60 | 7 | 7 |
-| LambdaParameters.cs:13:18:13:68 | (...) => ... | LambdaParameters.cs:13:62:13:62 | x | 0 | LambdaParameters.cs:13:19:13:62 | object creation of type DateTime | - |
 | Parameters.cs:8:17:8:18 | M2 | Parameters.cs:8:34:8:34 | b | 1 | Parameters.cs:8:38:8:41 | null | null |
 | Parameters.cs:8:17:8:18 | M2 | Parameters.cs:8:51:8:51 | c | 2 | Parameters.cs:8:55:8:70 | "default string" | default string |
 | Parameters.cs:9:17:9:18 | M3 | Parameters.cs:9:24:9:24 | a | 0 | Parameters.cs:9:28:9:28 | 1 | 1 |
@@ -89,7 +81,6 @@ withDefaultValue
 | Parameters.dll:0:0:0:0 | M23 | Parameters.dll:0:0:0:0 | arg12 | 0 | Parameters.dll:0:0:0:0 | (...) ... | 0 |
 | Parameters.dll:0:0:0:0 | M24 | Parameters.dll:0:0:0:0 | arg13 | 0 | Parameters.dll:0:0:0:0 | (...) ... | 7 |
 dateTimeDefaults
-| LambdaParameters.cs:13:18:13:68 | (...) => ... | LambdaParameters.cs:13:62:13:62 | x | LambdaParameters.cs:13:19:13:62 | object creation of type DateTime | DateTime(long) | 14 |
 | Parameters.cs:22:17:22:19 | M14 | Parameters.cs:22:64:22:67 | arg4 | Parameters.cs:22:21:22:67 | object creation of type DateTime | DateTime(long) | 14 |
 | Parameters.cs:23:17:23:19 | M15 | Parameters.cs:23:68:23:71 | arg5 | Parameters.cs:23:21:23:71 | object creation of type DateTime | DateTime(long) | 10001 |
 | Parameters.dll:0:0:0:0 | M14 | Parameters.dll:0:0:0:0 | arg4 | Parameters.dll:0:0:0:0 | object creation of type DateTime | DateTime(long) | 14 |

csharp/ql/test/library-tests/typealias/alias.cs

@@ -1,30 +0,0 @@
-using System;
-
-using TupleType1 = (int, object);
-using TupleType2 = (int, string);
-using TupleType3 = (int, object);
-using Point = (int x, int y);
-
-public class TupleMethods
-{
-    public void M1(TupleType1 t)
-    {
-        var x = t.Item1;
-        var y = t.Item2;
-    }
-
-    public void M2(TupleType2 t)
-    {
-        var x = t.Item1;
-        var y = t.Item2;
-        M1(t);
-    }
-
-    public void M3(Point p)
-    {
-        var x = p.x;
-        var y = p.y;
-    }
-
-    public void M4(TupleType3 t) { }
-}

csharp/ql/test/library-tests/typealias/alias.expected

@@ -1,4 +0,0 @@
-| alias.cs:10:17:10:18 | M1 | alias.cs:10:31:10:31 | t | (Int32,Object) |
-| alias.cs:16:17:16:18 | M2 | alias.cs:16:31:16:31 | t | (Int32,String) |
-| alias.cs:23:17:23:18 | M3 | alias.cs:23:26:23:26 | p | (Int32,Int32) |
-| alias.cs:29:17:29:18 | M4 | alias.cs:29:31:29:31 | t | (Int32,Object) |

csharp/ql/test/library-tests/typealias/alias.ql

@@ -1,8 +0,0 @@
-import csharp
-
-from Method m, Parameter p, Type t
-where
-  m.fromSource() and
-  p = m.getAParameter() and
-  p.getType() = t
-select m, p, t.toString()

csharp/ql/test/utils/modelgenerator/dataflow/CaptureNeutralModels.ext.yml

@@ -1,6 +0,0 @@
-extensions:
-  - addsTo:
-      pack: codeql/csharp-all
-      extensible: neutralModel
-    data:
-      - [ "NoSummaries", "ManuallyModelled", "HasNeutralSummaryNoFlow", "(System.Object)", "summary", "manual"]

csharp/ql/test/utils/modelgenerator/dataflow/CaptureSummaryModels.ext.yml

@@ -1,12 +0,0 @@
-extensions:
-  - addsTo:
-      pack: codeql/csharp-all
-      extensible: summaryModel
-    data:
-      - [ "NoSummaries", "ManuallyModelled", False, "HasSummary", "(System.Object)", "", "Argument[0]", "ReturnValue", "value", "manual"]
-
-  - addsTo:
-      pack: codeql/csharp-all
-      extensible: neutralModel
-    data:
-      - [ "NoSummaries", "ManuallyModelled", "HasNeutralSummary", "(System.Object)", "summary", "manual"]

csharp/ql/test/utils/modelgenerator/dataflow/NoSummaries.cs

@@ -143,22 +143,3 @@ public class ParameterlessConstructor
         IsInitialized = true;
     }
 }
-
-// No models should be created, if there exist either a manual summary or neutral summary.
-public class ManuallyModelled
-{
-    public object HasSummary(object o)
-    {
-        return o;
-    }
-
-    public object HasNeutralSummary(object o)
-    {
-        return o;
-    }
-
-    public object HasNeutralSummaryNoFlow(object o)
-    {
-        return null;
-    }
-}