Python: Fix broken queries

.github/workflows/ql-for-ql-build.yml

@@ -27,7 +27,6 @@ jobs:
         uses: github/codeql-action/init@main
         with:
           languages: javascript # does not matter
-          tools: nightly
       - uses: ./.github/actions/os-version
         id: os_version
       ### Build the extractor ###

.github/workflows/ql-for-ql-tests.yml

@@ -30,7 +30,6 @@ jobs:
         uses: github/codeql-action/init@main
         with:
           languages: javascript # does not matter
-          tools: nightly
       - uses: ./.github/actions/os-version
         id: os_version
       - uses: actions/cache@v3
@@ -76,7 +75,6 @@ jobs:
         uses: github/codeql-action/init@main
         with:
           languages: javascript # does not matter
-          tools: nightly
       - uses: ./.github/actions/os-version
         id: os_version
       - uses: actions/cache@v3

MODULE.bazel

@@ -24,7 +24,7 @@ bazel_dep(name = "bazel_skylib", version = "1.8.1")
 bazel_dep(name = "abseil-cpp", version = "20240116.1", repo_name = "absl")
 bazel_dep(name = "nlohmann_json", version = "3.11.3", repo_name = "json")
 bazel_dep(name = "fmt", version = "12.1.0-codeql.1")
-bazel_dep(name = "rules_kotlin", version = "2.2.0-codeql.1")
+bazel_dep(name = "rules_kotlin", version = "2.1.3-codeql.1")
 bazel_dep(name = "gazelle", version = "0.40.0")
 bazel_dep(name = "rules_dotnet", version = "0.21.5-codeql.1")
 bazel_dep(name = "googletest", version = "1.14.0.bcr.1")
@@ -221,6 +221,10 @@ use_repo(
     kotlin_extractor_deps,
     "codeql_kotlin_defaults",
     "codeql_kotlin_embeddable",
+    "kotlin-compiler-1.6.0",
+    "kotlin-compiler-1.6.20",
+    "kotlin-compiler-1.7.0",
+    "kotlin-compiler-1.7.20",
     "kotlin-compiler-1.8.0",
     "kotlin-compiler-1.9.0-Beta",
     "kotlin-compiler-1.9.20-Beta",
@@ -230,7 +234,10 @@ use_repo(
     "kotlin-compiler-2.1.20-Beta1",
     "kotlin-compiler-2.2.0-Beta1",
     "kotlin-compiler-2.2.20-Beta2",
-    "kotlin-compiler-2.3.0",
+    "kotlin-compiler-embeddable-1.6.0",
+    "kotlin-compiler-embeddable-1.6.20",
+    "kotlin-compiler-embeddable-1.7.0",
+    "kotlin-compiler-embeddable-1.7.20",
     "kotlin-compiler-embeddable-1.8.0",
     "kotlin-compiler-embeddable-1.9.0-Beta",
     "kotlin-compiler-embeddable-1.9.20-Beta",
@@ -240,7 +247,10 @@ use_repo(
     "kotlin-compiler-embeddable-2.1.20-Beta1",
     "kotlin-compiler-embeddable-2.2.0-Beta1",
     "kotlin-compiler-embeddable-2.2.20-Beta2",
-    "kotlin-compiler-embeddable-2.3.0",
+    "kotlin-stdlib-1.6.0",
+    "kotlin-stdlib-1.6.20",
+    "kotlin-stdlib-1.7.0",
+    "kotlin-stdlib-1.7.20",
     "kotlin-stdlib-1.8.0",
     "kotlin-stdlib-1.9.0-Beta",
     "kotlin-stdlib-1.9.20-Beta",
@@ -250,7 +260,6 @@ use_repo(
     "kotlin-stdlib-2.1.20-Beta1",
     "kotlin-stdlib-2.2.0-Beta1",
     "kotlin-stdlib-2.2.20-Beta2",
-    "kotlin-stdlib-2.3.0",
 )
 
 go_sdk = use_extension("@rules_go//go:extensions.bzl", "go_sdk")

actions/ql/lib/CHANGELOG.md

@@ -1,9 +1,3 @@
-## 0.4.27
-
-### Bug Fixes
-
-* Fixed a crash when analysing a `${{ ... }}` expression over around 300 characters in length.
-
 ## 0.4.26
 
 ### Major Analysis Improvements

actions/ql/lib/change-notes/released/0.4.27.md

@@ -1,5 +0,0 @@
-## 0.4.27
-
-### Bug Fixes
-
-* Fixed a crash when analysing a `${{ ... }}` expression over around 300 characters in length.

actions/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.4.27
+lastReleaseVersion: 0.4.26

actions/ql/lib/codeql/actions/ast/internal/Ast.qll

@@ -27,8 +27,8 @@ string getADelimitedExpression(YamlString s, int offset) {
   // not just the last (greedy match) or first (reluctant match).
   result =
     s.getValue()
-        .regexpFind("\\$\\{\\{(?:[^}]|}(?!}))*+\\}\\}", _, offset)
-        .regexpCapture("(\\$\\{\\{(?:[^}]|}(?!}))*+\\}\\})", 1)
+        .regexpFind("\\$\\{\\{(?:[^}]|}(?!}))*\\}\\}", _, offset)
+        .regexpCapture("(\\$\\{\\{(?:[^}]|}(?!}))*\\}\\})", 1)
         .trim()
 }
 

actions/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/actions-all
-version: 0.4.27
+version: 0.4.27-dev
 library: true
 warnOnImplicitThis: true
 dependencies:

actions/ql/src/CHANGELOG.md

@@ -1,7 +1,3 @@
-## 0.6.19
-
-No user-facing changes.
-
 ## 0.6.18
 
 No user-facing changes.

actions/ql/src/change-notes/released/0.6.19.md

@@ -1,3 +0,0 @@
-## 0.6.19
-
-No user-facing changes.

actions/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.6.19
+lastReleaseVersion: 0.6.18

actions/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/actions-queries
-version: 0.6.19
+version: 0.6.19-dev
 library: false
 warnOnImplicitThis: true
 groups: [actions, queries]

actions/ql/test/library-tests/very-long-expression/very_long_expression_node.expected

@@ -1 +0,0 @@
-| 97418 |

actions/ql/test/library-tests/very-long-expression/very_long_expression_node.ql

@@ -1,5 +0,0 @@
-import codeql.actions.ast.internal.Ast
-
-int getAnExpressionLength() { result = any(ExpressionImpl e).toString().length() }
-
-select max(getAnExpressionLength())

cpp/downgrades/9439176c1d1312787926458dd54d65a849069118/preprocdirects.ql

@@ -1,13 +0,0 @@
-class PreprocessorDirective extends @preprocdirect {
-  string toString() { none() }
-}
-
-class Location extends @location_default {
-  string toString() { none() }
-}
-
-from PreprocessorDirective ppd, int kind, int kind_new, Location l
-where
-  preprocdirects(ppd, kind, l) and
-  if kind = 17 then kind_new = /* ppd_warning */ 18 else kind_new = kind
-select ppd, kind_new, l

cpp/downgrades/9439176c1d1312787926458dd54d65a849069118/upgrade.properties

@@ -1,4 +0,0 @@
-description: Support embed preprocessor directive
-compatibility: partial
-embeds.rel: delete
-preprocdirects.rel: run preprocdirects.qlo

cpp/ql/lib/CHANGELOG.md

@@ -1,21 +1,3 @@
-## 7.1.0
-
-### New Features
-
-* Added a subclass `Embed` of `PreprocessorDirective` for C23 and C++26 `#embed` preprocessor directives.
-* Added modules `DataFlow::ParameterizedBarrierGuard` and `DataFlow::ParameterizedInstructionBarrierGuard`. These modules provide the same features as `DataFlow::BarrierGuard` and `DataFlow::InstructionBarrierGuard`, but allow for an additional parameter to support properly using them in dataflow configurations that uses flow states.
-
-### Minor Analysis Improvements
-
-* The `Buffer.qll` library will no longer report incorrect buffer sizes on certain malformed databases. As a result, the queries `cpp/static-buffer-overflow`, `cpp/overflow-buffer`, `cpp/badly-bounded-write`, `cpp/overrunning-write`, `cpp/overrunning-write-with-float`, and `cpp/very-likely-overrunning-write` will report fewer false positives on such databases.
-* Added `taint` summary models and `sql-injection` barrier models for the MySQL `mysql_real_escape_string` and `mysql_real_escape_string_quote` escaping functions.
-* The predicate `SummarizedCallable.propagatesFlow` has been extended with the columns `Provenance p` and `boolean isExact`, and as a consequence the predicates `SummarizedCallable.hasProvenance` and `SummarizedCallable.hasExactModel` have been removed.
-
-### Bug Fixes
-
-* Fixed a bug in the `GuardCondition` library which sometimes prevented binary logical operators from being recognized as guard conditions. As a result, queries using `GuardCondition` may see improved results.
-* Fixed a bug which caused `Node.asDefinition()` to not have a result for certain assignments.
-
 ## 7.0.0
 
 ### Breaking Changes

cpp/ql/lib/change-notes/released/7.1.0.md

@@ -1,17 +0,0 @@
-## 7.1.0
-
-### New Features
-
-* Added a subclass `Embed` of `PreprocessorDirective` for C23 and C++26 `#embed` preprocessor directives.
-* Added modules `DataFlow::ParameterizedBarrierGuard` and `DataFlow::ParameterizedInstructionBarrierGuard`. These modules provide the same features as `DataFlow::BarrierGuard` and `DataFlow::InstructionBarrierGuard`, but allow for an additional parameter to support properly using them in dataflow configurations that uses flow states.
-
-### Minor Analysis Improvements
-
-* The `Buffer.qll` library will no longer report incorrect buffer sizes on certain malformed databases. As a result, the queries `cpp/static-buffer-overflow`, `cpp/overflow-buffer`, `cpp/badly-bounded-write`, `cpp/overrunning-write`, `cpp/overrunning-write-with-float`, and `cpp/very-likely-overrunning-write` will report fewer false positives on such databases.
-* Added `taint` summary models and `sql-injection` barrier models for the MySQL `mysql_real_escape_string` and `mysql_real_escape_string_quote` escaping functions.
-* The predicate `SummarizedCallable.propagatesFlow` has been extended with the columns `Provenance p` and `boolean isExact`, and as a consequence the predicates `SummarizedCallable.hasProvenance` and `SummarizedCallable.hasExactModel` have been removed.
-
-### Bug Fixes
-
-* Fixed a bug in the `GuardCondition` library which sometimes prevented binary logical operators from being recognized as guard conditions. As a result, queries using `GuardCondition` may see improved results.
-* Fixed a bug which caused `Node.asDefinition()` to not have a result for certain assignments.

cpp/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 7.1.0
+lastReleaseVersion: 7.0.0

cpp/ql/lib/ext/MySql.model.yml

@@ -1,14 +0,0 @@
-# partial model of the MySQL api
-extensions:
-  - addsTo:
-      pack: codeql/cpp-all
-      extensible: summaryModel
-    data: # namespace, type, subtypes, name, signature, ext, input, output, kind, provenance
-      - ["", "", False, "mysql_real_escape_string", "", "", "Argument[*2]", "Argument[*1]", "taint", "manual"]
-      - ["", "", False, "mysql_real_escape_string_quote", "", "", "Argument[*2]", "Argument[*1]", "taint", "manual"]
-  - addsTo:
-      pack: codeql/cpp-all
-      extensible: barrierModel
-    data: # namespace, type, subtypes, name, signature, ext, output, kind, provenance
-      - ["", "", False, "mysql_real_escape_string", "", "", "Argument[*1]", "sql-injection", "manual"]
-      - ["", "", False, "mysql_real_escape_string_quote", "", "", "Argument[*1]", "sql-injection", "manual"]

cpp/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/cpp-all
-version: 7.1.0
+version: 7.0.1-dev
 groups: cpp
 dbscheme: semmlecode.cpp.dbscheme
 extractor: cpp

cpp/ql/lib/semmle/code/cpp/Element.qll

@@ -192,15 +192,6 @@ class Element extends ElementBase {
    */
   predicate isAffectedByMacro() { affectedByMacro(this) }
 
-  /**
-   * INTERNAL: Do not use.
-   *
-   * Holds if this element is affected by the expansion of `mi`.
-   */
-  predicate isAffectedByMacro(MacroInvocation mi) {
-    affectedbymacroexpansion(underlyingElement(this), unresolveElement(mi))
-  }
-
   private Element getEnclosingElementPref() {
     enclosingfunction(underlyingElement(this), unresolveElement(result)) or
     result.(Function) = stmtEnclosingElement(this) or

cpp/ql/lib/semmle/code/cpp/Macro.qll

@@ -239,9 +239,6 @@ class MacroInvocation extends MacroAccess {
     macro_argument_unexpanded(underlyingElement(this), i, result)
   }
 
-  /** Gets the number of arguments for this macro invocation. */
-  int getNumberOfArguments() { result = count(int i | exists(this.getUnexpandedArgument(i)) | i) }
-
   /**
    * Gets the `i`th _expanded_ argument of this macro invocation, where the
    * first argument has `i = 0`. The result has been expanded for macros _and_

cpp/ql/lib/semmle/code/cpp/Preprocessor.qll

@@ -328,27 +328,3 @@ class PreprocessorPragma extends PreprocessorDirective, @ppd_pragma {
 class PreprocessorLine extends PreprocessorDirective, @ppd_line {
   override string toString() { result = "#line " + this.getHead() }
 }
-
-/**
- * A C23 or C++26 `#embed` preprocessor directive. For example, the following code
- * contains one `Embed` directive:
- * ```cpp
- * char arr[] = {
- * #embed "bin"
- * };
- * ```
- */
-class Embed extends PreprocessorDirective, @ppd_embed {
-  override string toString() { result = "#embed " + this.getIncludeText() }
-
-  /**
-   * Gets the token which occurs after `#embed`, for example `"filename"`
-   * or `<filename>`.
-   */
-  string getIncludeText() { result = this.getHead() }
-
-  /**
-   * Gets the file directly embedded by this `#embed`.
-   */
-  File getEmbeddedFile() { embeds(underlyingElement(this), unresolveElement(result)) }
-}

cpp/ql/lib/semmle/code/cpp/commons/Buffer.qll

@@ -62,13 +62,11 @@ private Class getRootType(FieldAccess fa) {
  * unspecified type of `v` is a `ReferenceType`.
  */
 private int getVariableSize(Variable v) {
-  result =
-    unique(Type t |
-      t = v.getUnspecifiedType() and
-      not t instanceof ReferenceType
-    |
-      t.getSize()
-    )
+  exists(Type t |
+    t = v.getUnspecifiedType() and
+    not t instanceof ReferenceType and
+    result = t.getSize()
+  )
 }
 
 /**
@@ -81,32 +79,30 @@ private int getSize(VariableAccess va) {
     not v instanceof Field and
     result = getVariableSize(v)
     or
-    result =
-      unique(Class c, int trueSize |
-        // Otherwise, we find the "outermost" object and compute the size
-        // as the difference between the size of the type of the "outermost
-        // object" and the offset of the field relative to that type.
-        // For example, consider the following structs:
-        // ```
-        // struct S {
-        //   uint32_t x;
-        //   uint32_t y;
-        // };
-        // struct S2 {
-        //   S s;
-        //   uint32_t z;
-        // };
-        // ```
-        // Given an object `S2 s2` the size of the buffer `&s2.s.y`
-        // is the size of the base object type (i.e., `S2`) minus the offset
-        // of `y` relative to the type `S2` (i.e., `4`). So the size of the
-        // buffer is `12 - 4 = 8`.
-        c = getRootType(va) and
-        // we calculate the size based on the last field, to avoid including any padding after it
-        trueSize = max(Field f | | f.getOffsetInClass(c) + getVariableSize(f))
-      |
-        trueSize - v.(Field).getOffsetInClass(c)
-      )
+    exists(Class c, int trueSize |
+      // Otherwise, we find the "outermost" object and compute the size
+      // as the difference between the size of the type of the "outermost
+      // object" and the offset of the field relative to that type.
+      // For example, consider the following structs:
+      // ```
+      // struct S {
+      //   uint32_t x;
+      //   uint32_t y;
+      // };
+      // struct S2 {
+      //   S s;
+      //   uint32_t z;
+      // };
+      // ```
+      // Given an object `S2 s2` the size of the buffer `&s2.s.y`
+      // is the size of the base object type (i.e., `S2`) minutes the offset
+      // of `y` relative to the type `S2` (i.e., `4`). So the size of the
+      // buffer is `12 - 4 = 8`.
+      c = getRootType(va) and
+      // we calculate the size based on the last field, to avoid including any padding after it
+      trueSize = max(Field f | | f.getOffsetInClass(c) + getVariableSize(f)) and
+      result = trueSize - v.(Field).getOffsetInClass(c)
+    )
   )
 }
 
@@ -120,8 +116,12 @@ private int isSource(Expr bufferExpr, Element why) {
   exists(Variable bufferVar | bufferVar = bufferExpr.(VariableAccess).getTarget() |
     // buffer is a fixed size array
     exists(bufferVar.getUnspecifiedType().(ArrayType).getSize()) and
-    // more generous than .getSize() itself, when the array is a class field or similar.
-    result = getSize(bufferExpr) and
+    result =
+      unique(int size | // more generous than .getSize() itself, when the array is a class field or similar.
+        size = getSize(bufferExpr)
+      |
+        size
+      ) and
     why = bufferVar and
     not memberMayBeVarSize(_, bufferVar) and
     not exists(BuiltInOperationBuiltInOffsetOf offsetof | offsetof.getAChild*() = bufferExpr) and

cpp/ql/lib/semmle/code/cpp/controlflow/IRGuards.qll

@@ -8,8 +8,7 @@ import semmle.code.cpp.ir.IR
 private import codeql.util.Void
 private import codeql.controlflow.Guards as SharedGuards
 private import semmle.code.cpp.ir.ValueNumbering
-private import semmle.code.cpp.ir.implementation.raw.internal.TranslatedExpr as TE
-private import semmle.code.cpp.ir.implementation.raw.internal.TranslatedFunction as TF
+private import semmle.code.cpp.ir.implementation.raw.internal.TranslatedExpr
 private import semmle.code.cpp.ir.implementation.raw.internal.InstructionTag
 
 private class BasicBlock = IRCfg::BasicBlock;
@@ -684,26 +683,24 @@ final class GuardCondition = GuardConditionImpl;
  */
 private class GuardConditionFromBinaryLogicalOperator extends GuardConditionImpl instanceof Cpp::BinaryLogicalOperation
 {
-  GuardConditionImpl l;
-  GuardConditionImpl r;
-
-  GuardConditionFromBinaryLogicalOperator() {
-    super.getLeftOperand() = l and
-    super.getRightOperand() = r
-  }
-
   override predicate valueControls(Cpp::BasicBlock controlled, GuardValue v) {
-    // `l || r` does not control `r` even though `l` does.
-    not r.(Cpp::Expr).getBasicBlock() = controlled and
-    l.valueControls(controlled, v)
-    or
-    r.valueControls(controlled, v)
+    exists(Cpp::BinaryLogicalOperation binop, GuardCondition lhs, GuardCondition rhs |
+      this = binop and
+      lhs = binop.getLeftOperand() and
+      rhs = binop.getRightOperand() and
+      lhs.valueControls(controlled, v) and
+      rhs.valueControls(controlled, v)
+    )
   }
 
   override predicate valueControlsEdge(Cpp::BasicBlock pred, Cpp::BasicBlock succ, GuardValue v) {
-    l.valueControlsEdge(pred, succ, v)
-    or
-    r.valueControlsEdge(pred, succ, v)
+    exists(Cpp::BinaryLogicalOperation binop, GuardCondition lhs, GuardCondition rhs |
+      this = binop and
+      lhs = binop.getLeftOperand() and
+      rhs = binop.getRightOperand() and
+      lhs.valueControlsEdge(pred, succ, v) and
+      rhs.valueControlsEdge(pred, succ, v)
+    )
   }
 
   pragma[nomagic]
@@ -1029,7 +1026,7 @@ private class GuardConditionFromIR extends GuardConditionImpl {
 
 private predicate excludeAsControlledInstruction(Instruction instr) {
   // Exclude the temporaries generated by a ternary expression.
-  exists(TE::TranslatedConditionalExpr tce |
+  exists(TranslatedConditionalExpr tce |
     instr = tce.getInstruction(ConditionValueFalseStoreTag())
     or
     instr = tce.getInstruction(ConditionValueTrueStoreTag())
@@ -1041,14 +1038,6 @@ private predicate excludeAsControlledInstruction(Instruction instr) {
   or
   // Exclude unreached instructions, as their AST is the whole function and not a block.
   instr instanceof UnreachedInstruction
-  or
-  // Exclude instructions generated by a translated function as they map to the function itself
-  // and the function is considered the last basic block of a function body.
-  any(TF::TranslatedFunction tf).getInstruction(_) = instr
-  or
-  // `ChiInstruction`s generated by instructions in the above case don't come from `getInstruction` (since they are generated by AliasedSSA)
-  // so we need to special case them.
-  excludeAsControlledInstruction(instr.(ChiInstruction).getPartial())
 }
 
 /**

cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll

@@ -95,7 +95,6 @@
 
 import cpp
 private import new.DataFlow
-private import semmle.code.cpp.controlflow.IRGuards
 private import semmle.code.cpp.ir.dataflow.internal.DataFlowPrivate as Private
 private import semmle.code.cpp.ir.dataflow.internal.DataFlowUtil
 private import internal.FlowSummaryImpl
@@ -368,8 +367,6 @@ private predicate elementSpec(
 ) {
   sourceModel(namespace, type, subtypes, name, signature, ext, _, _, _, _) or
   sinkModel(namespace, type, subtypes, name, signature, ext, _, _, _, _) or
-  barrierModel(namespace, type, subtypes, name, signature, ext, _, _, _, _) or
-  barrierGuardModel(namespace, type, subtypes, name, signature, ext, _, _, _, _, _) or
   summaryModel(namespace, type, subtypes, name, signature, ext, _, _, _, _, _)
 }
 
@@ -1031,84 +1028,6 @@ private module Cached {
       isSinkNode(n, kind, model) and n.asNode() = node
     )
   }
-
-  private newtype TKindModelPair =
-    TMkPair(string kind, string model) { isBarrierGuardNode(_, _, kind, model) }
-
-  private GuardValue convertAcceptingValue(Public::AcceptingValue av) {
-    av.isTrue() and result.asBooleanValue() = true
-    or
-    av.isFalse() and result.asBooleanValue() = false
-    or
-    // NOTE: The below cases don't contribute anything currently since the
-    // callers immediately use `.asBooleanValue()` to convert the `GuardValue`
-    // to a boolean. Once we're willing to accept the breaking change of
-    // converting the barrier guard API to use `GuardValue`s instead `Boolean`s
-    // we can remove this restriction.
-    av.isNoException() and result.getDualValue().isThrowsException()
-    or
-    av.isZero() and result.asIntValue() = 0
-    or
-    av.isNotZero() and result.getDualValue().asIntValue() = 0
-    or
-    av.isNull() and result.isNullValue()
-    or
-    av.isNotNull() and result.isNonNullValue()
-  }
-
-  private predicate barrierGuardChecks(IRGuardCondition g, Expr e, boolean gv, TKindModelPair kmp) {
-    exists(
-      SourceSinkInterpretationInput::InterpretNode n, Public::AcceptingValue acceptingvalue,
-      string kind, string model
-    |
-      isBarrierGuardNode(n, acceptingvalue, kind, model) and
-      n.asNode().asExpr() = e and
-      kmp = TMkPair(kind, model) and
-      gv = convertAcceptingValue(acceptingvalue).asBooleanValue() and
-      n.asNode().(Private::ArgumentNode).getCall().asCallInstruction() = g
-    )
-  }
-
-  private newtype TKindModelPairIntPair =
-    MkKindModelPairIntPair(TKindModelPair pair, int indirectionIndex) {
-      indirectionIndex > 0 and
-      Private::nodeHasInstruction(_, _, indirectionIndex) and
-      exists(pair)
-    }
-
-  private predicate indirectBarrierGuardChecks(
-    IRGuardCondition g, Expr e, boolean gv, TKindModelPairIntPair kmp
-  ) {
-    exists(
-      SourceSinkInterpretationInput::InterpretNode interpretNode,
-      Public::AcceptingValue acceptingvalue, string kind, string model, int indirectionIndex,
-      Private::ArgumentNode arg
-    |
-      isBarrierGuardNode(interpretNode, acceptingvalue, kind, model) and
-      arg = interpretNode.asNode() and
-      arg.asIndirectExpr(indirectionIndex) = e and
-      kmp = MkKindModelPairIntPair(TMkPair(kind, model), indirectionIndex) and
-      gv = convertAcceptingValue(acceptingvalue).asBooleanValue() and
-      arg.getCall().asCallInstruction() = g
-    )
-  }
-
-  /**
-   * Holds if `node` is specified as a barrier with the given kind in a MaD flow
-   * model.
-   */
-  cached
-  predicate barrierNode(DataFlow::Node node, string kind, string model) {
-    exists(SourceSinkInterpretationInput::InterpretNode n |
-      isBarrierNode(n, kind, model) and n.asNode() = node
-    )
-    or
-    DataFlow::ParameterizedBarrierGuard<TKindModelPair, barrierGuardChecks/4>::getABarrierNode(TMkPair(kind,
-        model)) = node
-    or
-    DataFlow::ParameterizedBarrierGuard<TKindModelPairIntPair, indirectBarrierGuardChecks/4>::getAnIndirectBarrierNode(MkKindModelPairIntPair(TMkPair(kind,
-          model), _)) = node
-  }
 }
 
 import Cached
@@ -1125,12 +1044,6 @@ predicate sourceNode(DataFlow::Node node, string kind) { sourceNode(node, kind,
  */
 predicate sinkNode(DataFlow::Node node, string kind) { sinkNode(node, kind, _) }
 
-/**
- * Holds if `node` is specified as a barrier with the given kind in a MaD flow
- * model.
- */
-predicate barrierNode(DataFlow::Node node, string kind) { barrierNode(node, kind, _) }
-
 private predicate interpretSummary(
   Function f, string input, string output, string kind, string provenance, string model
 ) {
@@ -1145,22 +1058,40 @@ private predicate interpretSummary(
 
 // adapter class for converting Mad summaries to `SummarizedCallable`s
 private class SummarizedCallableAdapter extends SummarizedCallable {
-  string input_;
-  string output_;
-  string kind;
-  Provenance p_;
-  string model_;
+  SummarizedCallableAdapter() { interpretSummary(this, _, _, _, _, _) }
 
-  SummarizedCallableAdapter() { interpretSummary(this, input_, output_, kind, p_, model_) }
+  private predicate relevantSummaryElementManual(
+    string input, string output, string kind, string model
+  ) {
+    exists(Provenance provenance |
+      interpretSummary(this, input, output, kind, provenance, model) and
+      provenance.isManual()
+    )
+  }
+
+  private predicate relevantSummaryElementGenerated(
+    string input, string output, string kind, string model
+  ) {
+    exists(Provenance provenance |
+      interpretSummary(this, input, output, kind, provenance, model) and
+      provenance.isGenerated()
+    )
+  }
 
   override predicate propagatesFlow(
-    string input, string output, boolean preservesValue, Provenance p, boolean isExact, string model
+    string input, string output, boolean preservesValue, string model
   ) {
-    input = input_ and
-    output = output_ and
-    (if kind = "value" then preservesValue = true else preservesValue = false) and
-    p = p_ and
-    isExact = true and
-    model = model_
+    exists(string kind |
+      this.relevantSummaryElementManual(input, output, kind, model)
+      or
+      not this.relevantSummaryElementManual(_, _, _, _) and
+      this.relevantSummaryElementGenerated(input, output, kind, model)
+    |
+      if kind = "value" then preservesValue = true else preservesValue = false
+    )
+  }
+
+  override predicate hasProvenance(Provenance provenance) {
+    interpretSummary(this, _, _, _, provenance, _)
   }
 }

cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowSummaryImpl.qll

@@ -20,8 +20,6 @@ module Input implements InputSig<Location, DataFlowImplSpecific::CppDataFlow> {
 
   class SinkBase = Void;
 
-  predicate callableFromSource(SummarizedCallableBase c) { exists(c.getBlock()) }
-
   ArgumentPosition callbackSelfParameterPosition() { result = TDirectPosition(-1) }
 
   ReturnKind getStandardReturnValueKind() { result = getReturnValueKind("") }
@@ -151,27 +149,16 @@ module SourceSinkInterpretationInput implements
   }
 
   predicate barrierElement(
-    Element e, string output, string kind, Public::Provenance provenance, string model
+    Element n, string output, string kind, Public::Provenance provenance, string model
   ) {
-    exists(
-      string namespace, string type, boolean subtypes, string name, string signature, string ext
-    |
-      barrierModel(namespace, type, subtypes, name, signature, ext, output, kind, provenance, model) and
-      e = interpretElement(namespace, type, subtypes, name, signature, ext)
-    )
+    none()
   }
 
   predicate barrierGuardElement(
-    Element e, string input, Public::AcceptingValue acceptingvalue, string kind,
+    Element n, string input, Public::AcceptingValue acceptingvalue, string kind,
     Public::Provenance provenance, string model
   ) {
-    exists(
-      string package, string type, boolean subtypes, string name, string signature, string ext
-    |
-      barrierGuardModel(package, type, subtypes, name, signature, ext, input, acceptingvalue, kind,
-        provenance, model) and
-      e = interpretElement(package, type, subtypes, name, signature, ext)
-    )
+    none()
   }
 
   private newtype TInterpretNode =

cpp/ql/lib/semmle/code/cpp/exprs/Expr.qll

@@ -23,7 +23,7 @@ class Expr extends StmtParent, @expr {
   predicate hasChild(Expr e, int n) { e = this.getChild(n) }
 
   /** Gets the enclosing function of this expression, if any. */
-  override Function getEnclosingFunction() { result = exprEnclosingElement(this) }
+  Function getEnclosingFunction() { result = exprEnclosingElement(this) }
 
   /** Gets the nearest enclosing set of curly braces around this expression in the source, if any. */
   BlockStmt getEnclosingBlock() { result = this.getEnclosingStmt().getEnclosingBlock() }

cpp/ql/lib/semmle/code/cpp/internal/Overlay.qll

@@ -45,13 +45,13 @@ private string getSingleLocationFilePath(@element e) {
 overlay[local]
 private string getMultiLocationFilePath(@element e) {
   exists(@location_default loc |
-    var_decls(_, e, _, _, loc)
+    exists(@var_decl vd | var_decls(vd, e, _, _, loc))
     or
-    fun_decls(_, e, _, _, loc)
+    exists(@fun_decl fd | fun_decls(fd, e, _, _, loc))
     or
-    type_decls(_, e, loc)
+    exists(@type_decl td | type_decls(td, e, loc))
     or
-    namespace_decls(_, e, loc, _)
+    exists(@namespace_decl nd | namespace_decls(nd, e, loc, _))
   |
     result = getLocationFilePath(loc)
   )
@@ -62,7 +62,7 @@ private string getMultiLocationFilePath(@element e) {
  * overlay variant.
  */
 overlay[local]
-private predicate isBase() { not isOverlay() }
+private predicate holdsInBase() { not isOverlay() }
 
 /**
  * Discards an element from the base variant if:
@@ -71,7 +71,7 @@ private predicate isBase() { not isOverlay() }
  */
 overlay[discard_entity]
 private predicate discardElement(@element e) {
-  isBase() and
+  holdsInBase() and
   (
     overlayChangedFiles(getSingleLocationFilePath(e))
     or

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll

@@ -1144,7 +1144,7 @@ private newtype TDataFlowCall =
   }
 
 private predicate summarizedCallableIsManual(SummarizedCallable sc) {
-  sc.asSummarizedCallable().hasManualModel()
+  sc.asSummarizedCallable().applyManualModel()
 }
 
 /**

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll

@@ -312,13 +312,6 @@ class Node extends TIRDataFlowNode {
    */
   Expr asDefinition() { result = this.asDefinition(_) }
 
-  private predicate isCertainStore() {
-    exists(SsaImpl::Definition def |
-      SsaImpl::defToNode(this, def, _) and
-      def.isCertain()
-    )
-  }
-
   /**
    * Gets the definition associated with this node, if any.
    *
@@ -368,10 +361,11 @@ class Node extends TIRDataFlowNode {
    * pointed to by `p`.
    */
   Expr asDefinition(boolean uncertain) {
-    exists(StoreInstruction store |
+    exists(StoreInstruction store, SsaImpl::Definition def |
       store = this.asInstruction() and
       result = asDefinitionImpl(store) and
-      if this.isCertainStore() then uncertain = false else uncertain = true
+      SsaImpl::defToNode(this, def, _) and
+      if def.isCertain() then uncertain = false else uncertain = true
     )
   }
 
@@ -2423,19 +2417,6 @@ class ContentSet instanceof Content {
   }
 }
 
-private signature class ParamSig;
-
-private module WithParam<ParamSig P> {
-  /**
-   * Holds if the guard `g` validates the expression `e` upon evaluating to `branch`.
-   *
-   * The expression `e` is expected to be a syntactic part of the guard `g`.
-   * For example, the guard `g` might be a call `isSafe(x)` and the expression `e`
-   * the argument `x`.
-   */
-  signature predicate guardChecksSig(IRGuardCondition g, Expr e, boolean branch, P param);
-}
-
 /**
  * Holds if the guard `g` validates the expression `e` upon evaluating to `branch`.
  *
@@ -2457,7 +2438,7 @@ private predicate controls(IRGuardCondition g, Node n, boolean edge) {
  * This is expected to be used in `isBarrier`/`isSanitizer` definitions
  * in data flow and taint tracking.
  */
-module ParameterizedBarrierGuard<ParamSig P, WithParam<P>::guardChecksSig/4 guardChecks> {
+module BarrierGuard<guardChecksSig/3 guardChecks> {
   bindingset[value, n]
   pragma[inline_late]
   private predicate convertedExprHasValueNumber(ValueNumber value, Node n) {
@@ -2467,13 +2448,12 @@ module ParameterizedBarrierGuard<ParamSig P, WithParam<P>::guardChecksSig/4 guar
     )
   }
 
-  private predicate guardChecksNode(IRGuardCondition g, Node n, boolean branch, P p) {
-    guardChecks(g, n.asOperand().getDef().getConvertedResultExpression(), branch, p)
+  private predicate guardChecksNode(IRGuardCondition g, Node n, boolean branch) {
+    guardChecks(g, n.asOperand().getDef().getConvertedResultExpression(), branch)
   }
 
   /**
-   * Gets an expression node that is safely guarded by the given guard check
-   * when the parameter is `p`.
+   * Gets an expression node that is safely guarded by the given guard check.
    *
    * For example, given the following code:
    * ```cpp
@@ -2504,27 +2484,19 @@ module ParameterizedBarrierGuard<ParamSig P, WithParam<P>::guardChecksSig/4 guar
    *
    * NOTE: If an indirect expression is tracked, use `getAnIndirectBarrierNode` instead.
    */
-  Node getABarrierNode(P p) {
+  Node getABarrierNode() {
     exists(IRGuardCondition g, ValueNumber value, boolean edge |
       convertedExprHasValueNumber(value, result) and
       guardChecks(g,
-        pragma[only_bind_into](value.getAnInstruction().getConvertedResultExpression()), edge, p) and
+        pragma[only_bind_into](value.getAnInstruction().getConvertedResultExpression()), edge) and
       controls(g, result, edge)
     )
     or
-    result = SsaImpl::BarrierGuard<P, guardChecksNode/4>::getABarrierNode(p)
+    result = SsaImpl::BarrierGuard<guardChecksNode/3>::getABarrierNode()
   }
 
   /**
-   * Gets an expression node that is safely guarded by the given guard check.
-   *
-   * See `getABarrierNode/1` for examples.
-   */
-  Node getABarrierNode() { result = getABarrierNode(_) }
-
-  /**
-   * Gets an indirect expression node that is safely guarded by the given
-   * guard check with parameter `p`.
+   * Gets an indirect expression node that is safely guarded by the given guard check.
    *
    * For example, given the following code:
    * ```cpp
@@ -2556,13 +2528,6 @@ module ParameterizedBarrierGuard<ParamSig P, WithParam<P>::guardChecksSig/4 guar
    *
    * NOTE: If a non-indirect expression is tracked, use `getABarrierNode` instead.
    */
-  Node getAnIndirectBarrierNode(P p) { result = getAnIndirectBarrierNode(_, p) }
-
-  /**
-   * Gets an indirect expression node that is safely guarded by the given guard check.
-   *
-   * See `getAnIndirectBarrierNode/1` for examples.
-   */
   Node getAnIndirectBarrierNode() { result = getAnIndirectBarrierNode(_) }
 
   bindingset[value, n]
@@ -2577,10 +2542,10 @@ module ParameterizedBarrierGuard<ParamSig P, WithParam<P>::guardChecksSig/4 guar
   }
 
   private predicate guardChecksIndirectNode(
-    IRGuardCondition g, Node n, boolean branch, int indirectionIndex, P p
+    IRGuardCondition g, Node n, boolean branch, int indirectionIndex
   ) {
     guardChecks(g, n.asIndirectOperand(indirectionIndex).getDef().getConvertedResultExpression(),
-      branch, p)
+      branch)
   }
 
   /**
@@ -2617,44 +2582,19 @@ module ParameterizedBarrierGuard<ParamSig P, WithParam<P>::guardChecksSig/4 guar
    *
    * NOTE: If a non-indirect expression is tracked, use `getABarrierNode` instead.
    */
-  Node getAnIndirectBarrierNode(int indirectionIndex, P p) {
+  Node getAnIndirectBarrierNode(int indirectionIndex) {
     exists(IRGuardCondition g, ValueNumber value, boolean edge |
       indirectConvertedExprHasValueNumber(indirectionIndex, value, result) and
       guardChecks(g,
-        pragma[only_bind_into](value.getAnInstruction().getConvertedResultExpression()), edge, p) and
+        pragma[only_bind_into](value.getAnInstruction().getConvertedResultExpression()), edge) and
       controls(g, result, edge)
     )
     or
     result =
-      SsaImpl::BarrierGuardWithIntParam<P, guardChecksIndirectNode/5>::getABarrierNode(indirectionIndex,
-        p)
+      SsaImpl::BarrierGuardWithIntParam<guardChecksIndirectNode/4>::getABarrierNode(indirectionIndex)
   }
 }
 
-/**
- * Provides a set of barrier nodes for a guard that validates an expression.
- *
- * This is expected to be used in `isBarrier`/`isSanitizer` definitions
- * in data flow and taint tracking.
- */
-module BarrierGuard<guardChecksSig/3 guardChecks> {
-  private predicate guardChecks(IRGuardCondition g, Expr e, boolean branch, Unit unit) {
-    guardChecks(g, e, branch) and
-    exists(unit)
-  }
-
-  import ParameterizedBarrierGuard<Unit, guardChecks/4>
-}
-
-private module InstrWithParam<ParamSig P> {
-  /**
-   * Holds if the guard `g` validates the instruction `instr` upon evaluating to `branch`.
-   */
-  signature predicate instructionGuardChecksSig(
-    IRGuardCondition g, Instruction instr, boolean branch, P p
-  );
-}
-
 /**
  * Holds if the guard `g` validates the instruction `instr` upon evaluating to `branch`.
  */
@@ -2666,9 +2606,7 @@ signature predicate instructionGuardChecksSig(IRGuardCondition g, Instruction in
  * This is expected to be used in `isBarrier`/`isSanitizer` definitions
  * in data flow and taint tracking.
  */
-module ParameterizedInstructionBarrierGuard<
-  ParamSig P, InstrWithParam<P>::instructionGuardChecksSig/4 instructionGuardChecks>
-{
+module InstructionBarrierGuard<instructionGuardChecksSig/3 instructionGuardChecks> {
   bindingset[value, n]
   pragma[inline_late]
   private predicate operandHasValueNumber(ValueNumber value, Node n) {
@@ -2678,27 +2616,21 @@ module ParameterizedInstructionBarrierGuard<
     )
   }
 
-  private predicate guardChecksNode(IRGuardCondition g, Node n, boolean branch, P p) {
-    instructionGuardChecks(g, n.asOperand().getDef(), branch, p)
+  private predicate guardChecksNode(IRGuardCondition g, Node n, boolean branch) {
+    instructionGuardChecks(g, n.asOperand().getDef(), branch)
   }
 
-  /**
-   * Gets a node that is safely guarded by the given guard check with
-   * parameter `p`.
-   */
-  Node getABarrierNode(P p) {
+  /** Gets a node that is safely guarded by the given guard check. */
+  Node getABarrierNode() {
     exists(IRGuardCondition g, ValueNumber value, boolean edge |
-      instructionGuardChecks(g, pragma[only_bind_into](value.getAnInstruction()), edge, p) and
+      instructionGuardChecks(g, pragma[only_bind_into](value.getAnInstruction()), edge) and
       operandHasValueNumber(value, result) and
       controls(g, result, edge)
     )
     or
-    result = SsaImpl::BarrierGuard<P, guardChecksNode/4>::getABarrierNode(p)
+    result = SsaImpl::BarrierGuard<guardChecksNode/3>::getABarrierNode()
   }
 
-  /** Gets a node that is safely guarded by the given guard check. */
-  Node getABarrierNode() { result = getABarrierNode(_) }
-
   bindingset[value, n]
   pragma[inline_late]
   private predicate indirectOperandHasValueNumber(ValueNumber value, int indirectionIndex, Node n) {
@@ -2709,52 +2641,25 @@ module ParameterizedInstructionBarrierGuard<
   }
 
   private predicate guardChecksIndirectNode(
-    IRGuardCondition g, Node n, boolean branch, int indirectionIndex, P p
+    IRGuardCondition g, Node n, boolean branch, int indirectionIndex
   ) {
-    instructionGuardChecks(g, n.asIndirectOperand(indirectionIndex).getDef(), branch, p)
+    instructionGuardChecks(g, n.asIndirectOperand(indirectionIndex).getDef(), branch)
   }
 
   /**
    * Gets an indirect node with indirection index `indirectionIndex` that is
-   * safely guarded by the given guard check with parameter `p`.
+   * safely guarded by the given guard check.
    */
-  Node getAnIndirectBarrierNode(int indirectionIndex, P p) {
+  Node getAnIndirectBarrierNode(int indirectionIndex) {
     exists(IRGuardCondition g, ValueNumber value, boolean edge |
-      instructionGuardChecks(g, pragma[only_bind_into](value.getAnInstruction()), edge, p) and
+      instructionGuardChecks(g, pragma[only_bind_into](value.getAnInstruction()), edge) and
       indirectOperandHasValueNumber(value, indirectionIndex, result) and
       controls(g, result, edge)
     )
     or
     result =
-      SsaImpl::BarrierGuardWithIntParam<P, guardChecksIndirectNode/5>::getABarrierNode(indirectionIndex,
-        p)
+      SsaImpl::BarrierGuardWithIntParam<guardChecksIndirectNode/4>::getABarrierNode(indirectionIndex)
   }
-
-  /**
-   * Gets an indirect node that is safely guarded by the given guard check
-   * with parameter `p`.
-   */
-  Node getAnIndirectBarrierNode(P p) { result = getAnIndirectBarrierNode(_, p) }
-
-  /** Gets an indirect node that is safely guarded by the given guard check. */
-  Node getAnIndirectBarrierNode() { result = getAnIndirectBarrierNode(_) }
-}
-
-/**
- * Provides a set of barrier nodes for a guard that validates an instruction.
- *
- * This is expected to be used in `isBarrier`/`isSanitizer` definitions
- * in data flow and taint tracking.
- */
-module InstructionBarrierGuard<instructionGuardChecksSig/3 instructionGuardChecks> {
-  private predicate instructionGuardChecks(
-    IRGuardCondition g, Instruction i, boolean branch, Unit unit
-  ) {
-    instructionGuardChecks(g, i, branch) and
-    exists(unit)
-  }
-
-  import ParameterizedInstructionBarrierGuard<Unit, instructionGuardChecks/4>
 }
 
 /**

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaImpl.qll

@@ -15,79 +15,17 @@ private import DataFlowPrivate
 import SsaImplCommon
 
 private module SourceVariables {
-  /**
-   * Holds if `store` is the `StoreInstruction` generated by a postfix
-   * increment or decrement operation `e`, and `postCrement` is the operand
-   * that represents the use of the evaluated value of `e`.
-   */
-  private predicate isUseAfterPostfixCrement0(StoreInstruction store, Operand postCrement) {
-    exists(
-      BinaryInstruction binary, IRBlock b, int iPre, int iPost, int iStore, Operand preCrement,
-      Instruction left
-    |
-      binary instanceof AddInstruction
-      or
-      binary instanceof PointerAddInstruction
-      or
-      binary instanceof SubInstruction
-      or
-      binary instanceof PointerSubInstruction
-    |
-      store.getSourceValue() = binary and
-      left = binary.getLeft() and
-      strictcount(left.getAUse()) = 2 and
-      left.getAUse() = preCrement and
-      left.getAUse() = postCrement and
-      b.getInstruction(iPre) = preCrement.getUse() and
-      b.getInstruction(iPost) = postCrement.getUse() and
-      b.getInstruction(iStore) = store and
-      iPre < iStore and
-      iStore < iPost
-    )
-  }
-
-  /**
-   * Holds if `store` is the `StoreInstruction` generated by an postfix
-   * increment or decrement operation `e`, and `postCrement` is the fully
-   * converted operand that represents the use of the evaluated value of `e`.
-   */
-  private predicate isUseAfterPostfixCrement(StoreInstruction store, Operand postCrement) {
-    isUseAfterPostfixCrement0(store, postCrement) and
-    conversionFlow(postCrement, _, false, _)
-    or
-    exists(Instruction instr, Operand postCrement0 |
-      isUseAfterPostfixCrement(store, postCrement0) and
-      conversionFlow(postCrement0, instr, false, _) and
-      instr = postCrement.getDef()
-    )
-  }
-
-  private predicate hasSavedPostfixCrementSourceVariable(
-    BaseSourceVariable base, StoreInstruction store, int ind
-  ) {
-    exists(BaseSourceVariableInstruction inst, int ind0 |
-      isUseAfterPostfixCrement(store, _) and
-      inst.getBaseSourceVariable() = base and
-      isDef(_, _, store.getDestinationAddressOperand(), inst, ind0, 0) and
-      ind = [ind0 .. countIndirectionsForCppType(base.getLanguageType()) + 1]
-    )
-  }
-
   cached
   private newtype TSourceVariable =
-    TNormalSourceVariable(BaseSourceVariable base, int ind) {
+    TMkSourceVariable(BaseSourceVariable base, int ind) {
       ind = [0 .. countIndirectionsForCppType(base.getLanguageType()) + 1]
-    } or
-    TSavedPostfixCrementSourceVariable(StoreInstruction store, int ind) {
-      hasSavedPostfixCrementSourceVariable(_, store, ind)
     }
 
-  abstract private class AbstractSourceVariable extends TSourceVariable {
+  class SourceVariable extends TSourceVariable {
     BaseSourceVariable base;
     int ind;
 
-    bindingset[ind]
-    AbstractSourceVariable() { any() }
+    SourceVariable() { this = TMkSourceVariable(base, ind) }
 
     /** Gets the IR variable associated with this `SourceVariable`, if any. */
     IRVariable getIRVariable() { result = base.(BaseIRVariable).getIRVariable() }
@@ -99,7 +37,7 @@ private module SourceVariables {
     BaseSourceVariable getBaseVariable() { result = base }
 
     /** Gets a textual representation of this element. */
-    abstract string toString();
+    string toString() { result = repeatStars(this.getIndirection()) + base.toString() }
 
     /**
      * Gets the number of loads performed on the base source variable
@@ -124,53 +62,6 @@ private module SourceVariables {
     /** Gets the location of this variable. */
     Location getLocation() { result = this.getBaseVariable().getLocation() }
   }
-
-  final class SourceVariable = AbstractSourceVariable;
-
-  /**
-   * A regular source variable. Most source variables are instances of this
-   * class.
-   */
-  class NormalSourceVariable extends AbstractSourceVariable, TNormalSourceVariable {
-    NormalSourceVariable() { this = TNormalSourceVariable(base, ind) }
-
-    final override string toString() {
-      result = repeatStars(this.getIndirection()) + base.toString()
-    }
-  }
-
-  /**
-   * Before a value is postfix incremented (or decremented) we "save" its
-   * current value so that the pre-incremented value can be returned to the
-   * enclosing expression. We use the source variables represented by this
-   * class to represent the "saved value".
-   */
-  class SavedPostfixCrementSourceVariable extends AbstractSourceVariable,
-    TSavedPostfixCrementSourceVariable
-  {
-    StoreInstruction store;
-
-    SavedPostfixCrementSourceVariable() {
-      this = TSavedPostfixCrementSourceVariable(store, ind) and
-      hasSavedPostfixCrementSourceVariable(base, store, ind)
-    }
-
-    final override string toString() {
-      result = repeatStars(this.getIndirection()) + base.toString() + " [before crement]"
-    }
-
-    /**
-     * Gets the `StoreInstruction` that writes the incremented (or decremented)
-     * value.
-     */
-    StoreInstruction getStoreInstruction() { result = store }
-
-    /**
-     * Gets the fully converted `Operand` that represents the use of the
-     * value before the increment.
-     */
-    Operand getOperand() { isUseAfterPostfixCrement(store, result) }
-  }
 }
 
 import SourceVariables
@@ -218,43 +109,17 @@ private newtype TDefImpl =
   TDirectDefImpl(Operand address, int indirectionIndex) {
     isDef(_, _, address, _, _, indirectionIndex)
   } or
-  TSavedPostfixCrementDefImpl(SavedPostfixCrementSourceVariable sv, int indirectionIndex) {
-    isDef(_, _, sv.getStoreInstruction().getDestinationAddressOperand(), _, sv.getIndirection(),
-      indirectionIndex)
-  } or
   TGlobalDefImpl(GlobalLikeVariable v, IRFunction f, int indirectionIndex) {
     // Represents the initial "definition" of a global variable when entering
     // a function body.
     isGlobalDefImpl(v, f, _, indirectionIndex)
   }
 
-pragma[nomagic]
-private predicate hasOperandAndIndirection(
-  SavedPostfixCrementSourceVariable sv, Operand operand, int indirection
-) {
-  sv.getOperand() = operand and
-  sv.getIndirection() = indirection
-}
-
-private predicate hasBeforePostCrementUseImpl(
-  SavedPostfixCrementSourceVariable sv, Operand operand, int indirectionIndex
-) {
-  not isDef(true, _, operand, _, _, _) and
-  exists(int indirection |
-    hasOperandAndIndirection(sv, operand, indirection) and
-    isUse(_, operand, _, indirection, indirectionIndex)
-  )
-}
-
 cached
 private newtype TUseImpl =
   TDirectUseImpl(Operand operand, int indirectionIndex) {
     isUse(_, operand, _, _, indirectionIndex) and
-    not isDef(true, _, operand, _, _, _) and
-    not hasBeforePostCrementUseImpl(_, operand, indirectionIndex)
-  } or
-  TSavedPostfixCrementUseImpl(SavedPostfixCrementSourceVariable sv, int indirectionIndex) {
-    hasBeforePostCrementUseImpl(sv, _, indirectionIndex)
+    not isDef(true, _, operand, _, _, _)
   } or
   TGlobalUse(GlobalLikeVariable v, IRFunction f, int indirectionIndex) {
     // Represents a final "use" of a global variable to ensure that
@@ -358,8 +223,19 @@ abstract class DefImpl extends TDefImpl {
    */
   abstract int getIndirection();
 
+  /**
+   * Gets the base source variable (i.e., the variable without
+   * any indirection) of this definition or use.
+   */
+  abstract BaseSourceVariable getBaseSourceVariable();
+
   /** Gets the variable that is defined or used. */
-  abstract SourceVariable getSourceVariable();
+  SourceVariable getSourceVariable() {
+    exists(BaseSourceVariable v, int indirection |
+      sourceVariableHasBaseAndIndex(result, v, indirection) and
+      defHasSourceVariable(this, v, indirection)
+    )
+  }
 
   /**
    * Holds if this definition is guaranteed to totally overwrite the
@@ -367,8 +243,8 @@ abstract class DefImpl extends TDefImpl {
    */
   abstract predicate isCertain();
 
-  /** Gets the value written to the destination variable by this definition, if any. */
-  Node0Impl getValue() { none() }
+  /** Gets the value written to the destination variable by this definition. */
+  abstract Node0Impl getValue();
 
   /** Gets the operand that represents the address of this definition, if any. */
   Operand getAddressOperand() { none() }
@@ -417,8 +293,19 @@ abstract class UseImpl extends TUseImpl {
   /** Gets the indirection index of this use. */
   final int getIndirectionIndex() { result = indirectionIndex }
 
+  /**
+   * Gets the base source variable (i.e., the variable without
+   * any indirection) of this definition or use.
+   */
+  abstract BaseSourceVariable getBaseSourceVariable();
+
   /** Gets the variable that is defined or used. */
-  abstract SourceVariable getSourceVariable();
+  SourceVariable getSourceVariable() {
+    exists(BaseSourceVariable v, int indirection |
+      sourceVariableHasBaseAndIndex(result, v, indirection) and
+      useHasSourceVariable(this, v, indirection)
+    )
+  }
 
   /**
    * Holds if this use is guaranteed to read the
@@ -427,6 +314,18 @@ abstract class UseImpl extends TUseImpl {
   abstract predicate isCertain();
 }
 
+pragma[noinline]
+private predicate defHasSourceVariable(DefImpl def, BaseSourceVariable bv, int ind) {
+  bv = def.getBaseSourceVariable() and
+  ind = def.getIndirection()
+}
+
+pragma[noinline]
+private predicate useHasSourceVariable(UseImpl use, BaseSourceVariable bv, int ind) {
+  bv = use.getBaseSourceVariable() and
+  ind = use.getIndirection()
+}
+
 pragma[noinline]
 private predicate sourceVariableHasBaseAndIndex(SourceVariable v, BaseSourceVariable bv, int ind) {
   v.getBaseVariable() = bv and
@@ -459,12 +358,16 @@ abstract private class DefAddressImpl extends DefImpl, TDefAddressImpl {
 
   final override predicate isCertain() { any() }
 
+  final override Node0Impl getValue() { none() }
+
   override Cpp::Location getLocation() { result = v.getLocation() }
 
-  final override NormalSourceVariable getSourceVariable() {
+  final override SourceVariable getSourceVariable() {
     result.getBaseVariable() = v and
     result.getIndirection() = 0
   }
+
+  final override BaseSourceVariable getBaseSourceVariable() { result = v }
 }
 
 private class DefVariableAddressImpl extends DefAddressImpl {
@@ -510,17 +413,8 @@ private class DirectDef extends DefImpl, TDirectDefImpl {
     isDef(_, _, address, result, _, indirectionIndex)
   }
 
-  pragma[nomagic]
-  private predicate hasBaseSourceVariableAndIndirection(BaseSourceVariable v, int indirection) {
-    v = this.getBase().getBaseSourceVariable() and
-    indirection = this.getIndirection()
-  }
-
-  final override NormalSourceVariable getSourceVariable() {
-    exists(BaseSourceVariable v, int indirection |
-      sourceVariableHasBaseAndIndex(result, v, indirection) and
-      this.hasBaseSourceVariableAndIndirection(v, indirection)
-    )
+  override BaseSourceVariable getBaseSourceVariable() {
+    result = this.getBase().getBaseSourceVariable()
   }
 
   override int getIndirection() { isDef(_, _, address, _, result, indirectionIndex) }
@@ -530,32 +424,6 @@ private class DirectDef extends DefImpl, TDirectDefImpl {
   override predicate isCertain() { isDef(true, _, address, _, _, indirectionIndex) }
 }
 
-/**
- * A definition that "saves" the value of a variable before it is incremented
- * or decremented.
- */
-private class SavedPostfixCrementDefImpl extends DefImpl, TSavedPostfixCrementDefImpl {
-  SavedPostfixCrementSourceVariable sv;
-
-  SavedPostfixCrementDefImpl() { this = TSavedPostfixCrementDefImpl(sv, indirectionIndex) }
-
-  override Cpp::Location getLocation() { result = sv.getStoreInstruction().getLocation() }
-
-  final override predicate hasIndexInBlock(IRBlock block, int index) {
-    sv.getStoreInstruction() = block.getInstruction(index)
-  }
-
-  override string toString() { result = "Def of " + this.getSourceVariable() }
-
-  override SourceVariable getSourceVariable() { result = sv }
-
-  override int getIndirection() { result = sv.getIndirection() }
-
-  override predicate isCertain() {
-    isDef(true, _, sv.getStoreInstruction().getDestinationAddressOperand(), _, _, indirectionIndex)
-  }
-}
-
 private class DirectUseImpl extends UseImpl, TDirectUseImpl {
   Operand operand;
 
@@ -564,22 +432,29 @@ private class DirectUseImpl extends UseImpl, TDirectUseImpl {
   override string toString() { result = "Use of " + this.getSourceVariable() }
 
   final override predicate hasIndexInBlock(IRBlock block, int index) {
-    operand.getUse() = block.getInstruction(index)
+    // See the comment in `ssa0`'s `OperandBasedUse` for an explanation of this
+    // predicate's implementation.
+    if this.getBase().getAst() = any(Cpp::PostfixCrementOperation c).getOperand()
+    then
+      exists(Operand op, int indirection, Instruction base |
+        indirection = this.getIndirection() and
+        base = this.getBase() and
+        op =
+          min(Operand cand, int i |
+            isUse(_, cand, base, indirection, indirectionIndex) and
+            block.getInstruction(i) = cand.getUse()
+          |
+            cand order by i
+          ) and
+        block.getInstruction(index) = op.getUse()
+      )
+    else operand.getUse() = block.getInstruction(index)
   }
 
   private BaseSourceVariableInstruction getBase() { isUse(_, operand, result, _, indirectionIndex) }
 
-  pragma[nomagic]
-  private predicate hasBaseSourceVariableAndIndirection(BaseSourceVariable bv, int indirection) {
-    this.getBase().getBaseSourceVariable() = bv and
-    this.getIndirection() = indirection
-  }
-
-  override NormalSourceVariable getSourceVariable() {
-    exists(BaseSourceVariable v, int indirection |
-      sourceVariableHasBaseAndIndex(result, v, indirection) and
-      this.hasBaseSourceVariableAndIndirection(v, indirection)
-    )
+  override BaseSourceVariable getBaseSourceVariable() {
+    result = this.getBase().getBaseSourceVariable()
   }
 
   final Operand getOperand() { result = operand }
@@ -593,34 +468,6 @@ private class DirectUseImpl extends UseImpl, TDirectUseImpl {
   override Node getNode() { nodeHasOperand(result, operand, indirectionIndex) }
 }
 
-/**
- * The use of the original "saved" variable after the variable has been incremented
- * or decremented.
- */
-private class SavedPostfixCrementUseImpl extends UseImpl, TSavedPostfixCrementUseImpl {
-  SavedPostfixCrementSourceVariable sv;
-
-  SavedPostfixCrementUseImpl() { this = TSavedPostfixCrementUseImpl(sv, indirectionIndex) }
-
-  override string toString() { result = "Use of " + this.getSourceVariable() }
-
-  final override predicate hasIndexInBlock(IRBlock block, int index) {
-    this.getOperand().getUse() = block.getInstruction(index)
-  }
-
-  override SourceVariable getSourceVariable() { result = sv }
-
-  final Operand getOperand() { result = sv.getOperand() }
-
-  final override Cpp::Location getLocation() { result = this.getOperand().getLocation() }
-
-  override int getIndirection() { result = sv.getIndirection() }
-
-  override predicate isCertain() { isUse(true, this.getOperand(), _, _, indirectionIndex) }
-
-  override Node getNode() { nodeHasOperand(result, this.getOperand(), indirectionIndex) }
-}
-
 pragma[nomagic]
 private predicate finalParameterNodeHasParameterAndIndex(
   FinalParameterNode n, Parameter p, int indirectionIndex
@@ -685,18 +532,7 @@ class FinalParameterUse extends UseImpl, TFinalParameterUse {
     result instanceof UnknownLocation
   }
 
-  pragma[nomagic]
-  private predicate hasBaseSourceVariableAndIndirection(BaseIRVariable v, int indirection) {
-    v.getIRVariable().getAst() = p and
-    indirection = this.getIndirection()
-  }
-
-  override NormalSourceVariable getSourceVariable() {
-    exists(BaseIRVariable v, int indirection |
-      sourceVariableHasBaseAndIndex(result, v, indirection) and
-      this.hasBaseSourceVariableAndIndirection(v, indirection)
-    )
-  }
+  override BaseIRVariable getBaseSourceVariable() { result.getIRVariable().getAst() = p }
 }
 
 /**
@@ -776,17 +612,8 @@ class GlobalUse extends UseImpl, TGlobalUse {
     hasReturnPosition(f, block, index)
   }
 
-  pragma[nomagic]
-  private predicate hasBaseSourceVariableAndIndirection(BaseIRVariable v, int indirection) {
-    baseSourceVariableIsGlobal(v, global, f) and
-    indirection = this.getIndirection()
-  }
-
-  override NormalSourceVariable getSourceVariable() {
-    exists(BaseIRVariable v, int indirection |
-      sourceVariableHasBaseAndIndex(result, v, indirection) and
-      this.hasBaseSourceVariableAndIndirection(v, indirection)
-    )
+  override BaseSourceVariable getBaseSourceVariable() {
+    baseSourceVariableIsGlobal(result, global, f)
   }
 
   final override Cpp::Location getLocation() { result = f.getLocation() }
@@ -831,15 +658,15 @@ class GlobalDefImpl extends DefImpl, TGlobalDefImpl {
     )
   }
 
-  final override NormalSourceVariable getSourceVariable() {
-    exists(BaseSourceVariable v |
-      sourceVariableHasBaseAndIndex(result, v, indirectionIndex) and
-      baseSourceVariableIsGlobal(v, global, f)
-    )
+  /** Gets the global variable associated with this definition. */
+  override BaseSourceVariable getBaseSourceVariable() {
+    baseSourceVariableIsGlobal(result, global, f)
   }
 
   override int getIndirection() { result = indirectionIndex }
 
+  override Node0Impl getValue() { none() }
+
   override predicate isCertain() { any() }
 
   /**
@@ -877,15 +704,9 @@ predicate defToNode(Node node, Definition def, SourceVariable sv) {
 }
 
 private predicate defToNode(Node node, Definition def) {
-  // Only definitions of `NormalSourceVariable` need to be converted into
-  // dataflow nodes. The other case, `SavedPostfixCrementSourceVariable`,
-  // are internal definitions that don't have a dataflow node representation.
-  def.getSourceVariable() instanceof NormalSourceVariable and
-  (
-    nodeHasOperand(node, def.getValue().asOperand(), def.getIndirectionIndex())
-    or
-    nodeHasInstruction(node, def.getValue().asInstruction(), def.getIndirectionIndex())
-  )
+  nodeHasOperand(node, def.getValue().asOperand(), def.getIndirectionIndex())
+  or
+  nodeHasInstruction(node, def.getValue().asInstruction(), def.getIndirectionIndex())
   or
   node.(InitialGlobalValue).getGlobalDef() = def
 }
@@ -1119,16 +940,6 @@ module SsaCached {
     SsaImpl::phiHasInputFromBlock(phi, inp, bb)
   }
 
-  cached
-  predicate uncertainWriteDefinitionInput(Definition uncertain, Definition inp) {
-    SsaImpl::uncertainWriteDefinitionInput(uncertain, inp)
-  }
-
-  cached
-  predicate ssaDefReachesEndOfBlock(IRBlock bb, Definition def) {
-    SsaImpl::ssaDefReachesEndOfBlock(bb, def, _)
-  }
-
   predicate variableRead = SsaInput::variableRead/4;
 
   predicate variableWrite = SsaInput::variableWrite/4;
@@ -1224,23 +1035,13 @@ class SynthNode extends DataFlowIntegrationImpl::SsaNode {
   SynthNode() { not this.asDefinition() instanceof SsaImpl::WriteDefinition }
 }
 
-private signature class ParamSig;
+signature predicate guardChecksNodeSig(IRGuards::IRGuardCondition g, Node e, boolean branch);
 
-private module ParamIntPair<ParamSig P> {
-  newtype TPair = MkPair(P p, int indirectionIndex) { nodeHasInstruction(_, _, indirectionIndex) }
-}
+signature predicate guardChecksNodeSig(
+  IRGuards::IRGuardCondition g, Node e, boolean branch, int indirectionIndex
+);
 
-private module WithParam<ParamSig P> {
-  signature predicate guardChecksNodeSig(IRGuards::IRGuardCondition g, Node e, boolean gv, P param);
-}
-
-private module IntWithParam<ParamSig P> {
-  signature predicate guardChecksNodeSig(
-    IRGuards::IRGuardCondition g, Node e, boolean gv, int indirectionIndex, P param
-  );
-}
-
-module BarrierGuardWithIntParam<ParamSig P, IntWithParam<P>::guardChecksNodeSig/5 guardChecksNode> {
+module BarrierGuardWithIntParam<guardChecksNodeSig/4 guardChecksNode> {
   private predicate ssaDefReachesCertainUse(Definition def, UseImpl use) {
     exists(SourceVariable v, IRBlock bb, int i |
       use.hasIndexInBlock(bb, i, v) and
@@ -1251,23 +1052,21 @@ module BarrierGuardWithIntParam<ParamSig P, IntWithParam<P>::guardChecksNodeSig/
 
   private predicate guardChecksInstr(
     IRGuards::Guards_v1::Guard g, IRGuards::GuardsInput::Expr instr, IRGuards::GuardValue gv,
-    ParamIntPair<P>::TPair pair
+    int indirectionIndex
   ) {
-    exists(Node node, int indirectionIndex, P p |
-      pair = ParamIntPair<P>::MkPair(p, indirectionIndex) and
+    exists(Node node |
       nodeHasInstruction(node, instr, indirectionIndex) and
-      guardChecksNode(g, node, gv.asBooleanValue(), indirectionIndex, p)
+      guardChecksNode(g, node, gv.asBooleanValue(), indirectionIndex)
     )
   }
 
   private predicate guardChecksWithWrappers(
     DataFlowIntegrationInput::Guard g, SsaImpl::Definition def, IRGuards::GuardValue val,
-    ParamIntPair<P>::MkPair pair
+    int indirectionIndex
   ) {
-    exists(Instruction e, int indirectionIndex |
-      IRGuards::Guards_v1::ParameterizedValidationWrapper<ParamIntPair<P>::TPair, guardChecksInstr/4>::guardChecks(g,
-        e, val, pair) and
-      pair = ParamIntPair<P>::MkPair(_, indirectionIndex)
+    exists(Instruction e |
+      IRGuards::Guards_v1::ParameterizedValidationWrapper<int, guardChecksInstr/4>::guardChecks(g,
+        e, val, indirectionIndex)
     |
       indirectionIndex = 0 and
       def.(Definition).getAUse().getDef() = e
@@ -1276,19 +1075,18 @@ module BarrierGuardWithIntParam<ParamSig P, IntWithParam<P>::guardChecksNodeSig/
     )
   }
 
-  Node getABarrierNode(int indirectionIndex, P p) {
+  Node getABarrierNode(int indirectionIndex) {
     // Only get the SynthNodes from the shared implementation, as the ExprNodes cannot
     // be matched on SourceVariable.
     result.(SsaSynthNode).getSynthNode() =
-      DataFlowIntegrationImpl::BarrierGuardDefWithState<ParamIntPair<P>::MkPair, guardChecksWithWrappers/4>::getABarrierNode(ParamIntPair<P>::MkPair(p,
-          indirectionIndex))
+      DataFlowIntegrationImpl::BarrierGuardDefWithState<int, guardChecksWithWrappers/4>::getABarrierNode(indirectionIndex)
     or
     // Calculate the guarded UseImpls corresponding to ExprNodes directly.
     exists(
       DataFlowIntegrationInput::Guard g, IRGuards::GuardValue branch, Definition def, IRBlock bb
     |
+      guardChecksWithWrappers(g, def, branch, indirectionIndex) and
       exists(UseImpl use |
-        guardChecksWithWrappers(g, def, branch, ParamIntPair<P>::MkPair(p, indirectionIndex)) and
         ssaDefReachesCertainUse(def, use) and
         use.getBlock() = bb and
         DataFlowIntegrationInput::guardControlsBlock(g, bb, branch) and
@@ -1298,16 +1096,15 @@ module BarrierGuardWithIntParam<ParamSig P, IntWithParam<P>::guardChecksNodeSig/
   }
 }
 
-module BarrierGuard<ParamSig P, WithParam<P>::guardChecksNodeSig/4 guardChecksNode> {
+module BarrierGuard<guardChecksNodeSig/3 guardChecksNode> {
   private predicate guardChecksNode(
-    IRGuards::IRGuardCondition g, Node e, boolean gv, int indirectionIndex, P p
+    IRGuards::IRGuardCondition g, Node e, boolean branch, int indirectionIndex
   ) {
-    indirectionIndex = 0 and
-    guardChecksNode(g, e, gv, p)
+    guardChecksNode(g, e, branch) and indirectionIndex = 0
   }
 
-  Node getABarrierNode(P p) {
-    result = BarrierGuardWithIntParam<P, guardChecksNode/5>::getABarrierNode(0, p)
+  Node getABarrierNode() {
+    result = BarrierGuardWithIntParam<guardChecksNode/4>::getABarrierNode(0)
   }
 }
 
@@ -1362,17 +1159,9 @@ class Definition extends SsaImpl::Definition {
   private Definition getAPhiInputOrPriorDefinition() {
     result = this.(PhiNode).getAnInput()
     or
-    uncertainWriteDefinitionInput(this, result)
+    SsaImpl::uncertainWriteDefinitionInput(this, result)
   }
 
-  /**
-   * Holds if this SSA definition is live at the end of basic block `bb`.
-   * That is, this definition reaches the end of basic block `bb`, at which
-   * point it is still live, without crossing another SSA definition of the
-   * same source variable.
-   */
-  predicate isLiveAtEndOfBlock(IRBlock bb) { ssaDefReachesEndOfBlock(bb, this) }
-
   /**
    * Gets a definition that ultimately defines this SSA definition and is
    * not itself a phi node.

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/InstructionTag.qll

@@ -104,11 +104,7 @@ newtype TInstructionTag =
   } or
   SizeofVlaDimensionTag(int index) {
     exists(VlaDeclStmt v | exists(v.getTransitiveVlaDimensionStmt(index)))
-  } or
-  AssertionVarAddressTag() or
-  AssertionVarLoadTag() or
-  AssertionOpTag() or
-  AssertionBranchTag()
+  }
 
 class InstructionTag extends TInstructionTag {
   final string toString() { result = getInstructionTagId(this) }
@@ -300,12 +296,4 @@ string getInstructionTagId(TInstructionTag tag) {
   tag = CoAwaitBranchTag() and result = "CoAwaitBranch"
   or
   tag = BoolToIntConversionTag() and result = "BoolToIntConversion"
-  or
-  tag = AssertionVarAddressTag() and result = "AssertionVarAddress"
-  or
-  tag = AssertionVarLoadTag() and result = "AssertionVarLoad"
-  or
-  tag = AssertionOpTag() and result = "AssertionOp"
-  or
-  tag = AssertionBranchTag() and result = "AssertionBranch"
 }

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedAssertion.qll

@@ -1,387 +0,0 @@
-private import cpp
-private import semmle.code.cpp.ir.internal.IRUtilities
-private import semmle.code.cpp.ir.implementation.internal.OperandTag
-private import semmle.code.cpp.ir.internal.CppType
-private import semmle.code.cpp.ir.internal.TempVariableTag
-private import InstructionTag
-private import TranslatedElement
-private import TranslatedStmt
-private import TranslatedFunction
-
-/**
- * Holds if `s` is a statement that may be an expanded assertion in a
- * release build.
- */
-pragma[nomagic]
-private predicate stmtCandidate(Stmt s) {
-  not s.isFromUninstantiatedTemplate(_) and
-  (
-    // The expansion of `__analysis_assume(x != 0);` when `__analysis_assume` is
-    // empty is the empty statement.
-    s instanceof EmptyStmt
-    or
-    // The expansion of `assert(x != 0)` when `assert` is `((void)0)` is a zero literal
-    // with a void type.
-    exists(Expr e |
-      e = s.(ExprStmt).getExpr() and
-      e.getValue() = "0" and
-      e.getActualType() instanceof VoidType
-    )
-  )
-}
-
-pragma[nomagic]
-private predicate macroInvocationLocation(int startline, Function f, MacroInvocation mi) {
-  mi.getMacroName() = ["assert", "__analysis_assume"] and
-  mi.getNumberOfArguments() = 1 and
-  mi.getLocation().hasLocationInfo(_, startline, _, _, _) and
-  f.getEntryPoint().isAffectedByMacro(mi)
-}
-
-pragma[nomagic]
-private predicate stmtParentLocation(int startline, Function f, StmtParent p) {
-  p.getEnclosingFunction() = f and
-  p.getLocation().hasLocationInfo(_, startline, _, _, _)
-}
-
-/**
- * Holds if `mi` is a macro invocation with a name that is known
- * to correspond to an assertion macro, and the macro invocation
- * is the only thing on the line.
- */
-pragma[nomagic]
-private predicate assertion0(MacroInvocation mi, Stmt s, string arg) {
-  stmtCandidate(s) and
-  s =
-    unique(StmtParent p, int startline, Function f |
-      macroInvocationLocation(startline, f, mi) and
-      stmtParentLocation(startline, f, p) and
-      // Also do not count the elements from the expanded macro, i.e., when checking
-      // if `assert(x)` is the only thing on the line we do not count the
-      // generated `((void)0)` expression.
-      not p = mi.getAnExpandedElement()
-    |
-      p
-    ) and
-  arg = mi.getUnexpandedArgument(0)
-}
-
-private Function getEnclosingFunctionForMacroInvocation(MacroInvocation mi) {
-  exists(Stmt s |
-    assertion0(mi, s, _) and
-    result = s.getEnclosingFunction()
-  )
-}
-
-/**
- * Holds if `arg` has two components and the `i`'th component of the string
- * `arg` is `s`, and the components are separated by an operation with
- * opcode `opcode`.
- */
-bindingset[arg]
-pragma[inline_late]
-private predicate parseArgument(string arg, string s, int i, Opcode opcode) {
-  s =
-    arg.regexpCapture("([a-zA-Z_][a-zA-Z_0-9]*|[0-9]+)\\s?<=\\s?([a-zA-Z_][a-zA-Z_0-9]*|[0-9]+)",
-      i + 1) and
-  opcode instanceof Opcode::CompareLE
-  or
-  s =
-    arg.regexpCapture("([a-zA-Z_][a-zA-Z_0-9]*|[0-9]+)\\s?>=\\s?([a-zA-Z_][a-zA-Z_0-9]*|[0-9]+)",
-      i + 1) and
-  opcode instanceof Opcode::CompareGE
-  or
-  s =
-    arg.regexpCapture("([a-zA-Z_][a-zA-Z_0-9]*|[0-9]+)\\s?<\\s?([a-zA-Z_][a-zA-Z_0-9]*|[0-9]+)",
-      i + 1) and
-  opcode instanceof Opcode::CompareLT
-  or
-  s =
-    arg.regexpCapture("([a-zA-Z_][a-zA-Z_0-9]*|[0-9]+)\\s?>\\s?([a-zA-Z_][a-zA-Z_0-9]*|[0-9]+)",
-      i + 1) and
-  opcode instanceof Opcode::CompareGT
-  or
-  s =
-    arg.regexpCapture("([a-zA-Z_][a-zA-Z_0-9]*|[0-9]+)\\s?!=\\s?([a-zA-Z_][a-zA-Z_0-9]*|[0-9]+)",
-      i + 1) and
-  opcode instanceof Opcode::CompareNE
-  or
-  s =
-    arg.regexpCapture("([a-zA-Z_][a-zA-Z_0-9]*|[0-9]+)\\s?==\\s?([a-zA-Z_][a-zA-Z_0-9]*|[0-9]+)",
-      i + 1) and
-  opcode instanceof Opcode::CompareEQ
-}
-
-private Element getAChildScope(Element scope) { result.getParentScope() = scope }
-
-private predicate hasAVariable(MacroInvocation mi, Stmt s, Element scope) {
-  assertion0(mi, s, _) and
-  s.getParent() = scope
-  or
-  hasAVariable(mi, s, getAChildScope(scope))
-}
-
-private LocalScopeVariable getVariable(MacroInvocation mi, int i) {
-  exists(string operand, string arg, Stmt s |
-    assertion0(mi, s, arg) and
-    parseArgument(arg, operand, i, _) and
-    result =
-      unique(Variable v |
-        v.getLocation().getStartLine() < s.getLocation().getStartLine() and
-        hasAVariable(mi, s, v.getParentScope()) and
-        v.hasName(operand)
-      |
-        v
-      )
-  )
-}
-
-/**
- * Holds if the `i`'th component of the macro invocation `mi` with opcode
- * `opcode` is a reference to `var`.
- */
-private predicate hasVarAccessMacroArgument(MacroInvocation mi, Variable var, int i, Opcode opcode) {
-  exists(string arg, string s, Function f |
-    arg = mi.getUnexpandedArgument(0) and
-    f = getEnclosingFunctionForMacroInvocation(mi) and
-    parseArgument(arg, s, i, opcode) and
-    var = getVariable(mi, i)
-  )
-}
-
-/**
- * Holds if the `i`'th component of the macro invocation `mi` with opcode
- * `opcode` is a constant with the value `k`.
- */
-private predicate hasConstMacroArgument(MacroInvocation mi, int k, int i, Opcode opcode) {
-  exists(string arg, string s |
-    assertion0(mi, _, arg) and
-    s.toInt() = k and
-    parseArgument(arg, s, i, opcode)
-  )
-}
-
-predicate hasAssertionOperand(MacroInvocation mi, int i) {
-  hasVarAccessMacroArgument(mi, _, i, _)
-  or
-  hasConstMacroArgument(mi, _, i, _)
-}
-
-private predicate hasAssertionOpcode(MacroInvocation mi, Opcode opcode) {
-  hasVarAccessMacroArgument(mi, _, _, opcode)
-  or
-  hasConstMacroArgument(mi, _, _, opcode)
-}
-
-/**
- * Holds if `mi` is a macro invocation that is an assertion that should be generated
- * in the control-flow graph at `s`.
- */
-predicate assertion(MacroInvocation mi, Stmt s) {
-  assertion0(mi, s, _) and
-  hasAssertionOperand(mi, 0) and
-  hasAssertionOperand(mi, 1)
-}
-
-/** The translation of an operand of an assertion. */
-abstract private class TranslatedAssertionOperand extends TranslatedElement,
-  TTranslatedAssertionOperand
-{
-  MacroInvocation mi;
-  int index;
-
-  TranslatedAssertionOperand() { this = TTranslatedAssertionOperand(mi, index) }
-
-  MacroInvocation getMacroInvocation() { result = mi }
-
-  /**
-   * Gets the statement that is being replaced by the assertion that uses this
-   * operand.
-   */
-  Stmt getStmt() { assertion(mi, result) }
-
-  final override Locatable getAst() { result = this.getStmt() }
-
-  final override TranslatedElement getChild(int id) { none() }
-
-  final override Declaration getFunction() { result = this.getStmt().getEnclosingFunction() }
-
-  /** Gets the instruction which holds the result of this operand. */
-  abstract Instruction getResult();
-
-  final override string toString() { result = "Operand of assertion: " + mi }
-
-  /** Gets the index of this operand (i.e., `0` or `1`). */
-  final int getIndex() { result = index }
-}
-
-/** An operand of an assertion that is a variable access. */
-class TranslatedAssertionVarAccess extends TranslatedAssertionOperand {
-  TranslatedAssertionVarAccess() { hasVarAccessMacroArgument(mi, _, index, _) }
-
-  Variable getVariable() { hasVarAccessMacroArgument(mi, result, index, _) }
-
-  final override IRUserVariable getInstructionVariable(InstructionTag tag) {
-    tag = AssertionVarAddressTag() and
-    result.getVariable() = this.getVariable()
-  }
-
-  final override Instruction getFirstInstruction(EdgeKind kind) {
-    result = this.getInstruction(AssertionVarAddressTag()) and kind instanceof GotoEdge
-  }
-
-  final override Instruction getInstructionSuccessorInternal(InstructionTag tag, EdgeKind kind) {
-    tag = AssertionVarAddressTag() and
-    kind instanceof GotoEdge and
-    result = this.getInstruction(AssertionVarLoadTag())
-    or
-    tag = AssertionVarLoadTag() and
-    result = getTranslatedAssertionMacroInvocation(mi).getChildSuccessor(this, kind)
-  }
-
-  final override Instruction getALastInstructionInternal() {
-    result = this.getInstruction(AssertionVarLoadTag())
-  }
-
-  override predicate hasInstruction(Opcode opcode, InstructionTag tag, CppType resultType) {
-    exists(Variable v | v = this.getVariable() |
-      opcode instanceof Opcode::VariableAddress and
-      tag = AssertionVarAddressTag() and
-      resultType = getTypeForGLValue(v.getType())
-      or
-      opcode instanceof Opcode::Load and
-      tag = AssertionVarLoadTag() and
-      resultType = getTypeForPRValue(v.getType())
-    )
-  }
-
-  final override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
-    tag = AssertionVarLoadTag() and
-    operandTag instanceof AddressOperandTag and
-    result = this.getInstruction(AssertionVarAddressTag())
-  }
-
-  final override Instruction getResult() { result = this.getInstruction(AssertionVarLoadTag()) }
-}
-
-/** An operand of an assertion that is a constant access. */
-private class TranslatedAssertionConst extends TranslatedAssertionOperand {
-  TranslatedAssertionConst() { hasConstMacroArgument(mi, _, index, _) }
-
-  int getConst() { hasConstMacroArgument(mi, result, index, _) }
-
-  final override string getInstructionConstantValue(InstructionTag tag) {
-    tag = OnlyInstructionTag() and
-    result = this.getConst().toString()
-  }
-
-  final override Instruction getFirstInstruction(EdgeKind kind) {
-    result = this.getInstruction(OnlyInstructionTag()) and
-    kind instanceof GotoEdge
-  }
-
-  final override Instruction getInstructionSuccessorInternal(InstructionTag tag, EdgeKind kind) {
-    tag = OnlyInstructionTag() and
-    result = getTranslatedAssertionMacroInvocation(mi).getChildSuccessor(this, kind)
-  }
-
-  final override Instruction getALastInstructionInternal() {
-    result = this.getInstruction(OnlyInstructionTag())
-  }
-
-  override predicate hasInstruction(Opcode opcode, InstructionTag tag, CppType resultType) {
-    opcode instanceof Opcode::Constant and
-    tag = OnlyInstructionTag() and
-    resultType = getIntType()
-  }
-
-  final override Instruction getResult() { result = this.getInstruction(OnlyInstructionTag()) }
-}
-
-/**
- * Gets the `TranslatedAssertionMacroInvocation` corresponding to the macro
- * invocation `mi`.
- */
-TranslatedAssertionMacroInvocation getTranslatedAssertionMacroInvocation(MacroInvocation mi) {
-  result.getMacroInvocation() = mi
-}
-
-/**
- * A synthesized assertion which would have otherwise been invisible because the
- * database represents a release build where assertions are disabled.
- */
-private class TranslatedAssertionMacroInvocation extends TranslatedStmt {
-  MacroInvocation mi;
-
-  TranslatedAssertionMacroInvocation() { assertion(mi, stmt) }
-
-  final override Instruction getFirstInstruction(EdgeKind kind) {
-    result = this.getLeft().getFirstInstruction(kind)
-  }
-
-  TranslatedAssertionOperand getLeft() {
-    result.getMacroInvocation() = mi and
-    result.getIndex() = 0
-  }
-
-  TranslatedAssertionOperand getRight() {
-    result.getMacroInvocation() = mi and
-    result.getIndex() = 1
-  }
-
-  final override Instruction getInstructionSuccessorInternal(InstructionTag tag, EdgeKind kind) {
-    tag = AssertionOpTag() and
-    kind instanceof GotoEdge and
-    result = this.getInstruction(AssertionBranchTag())
-    or
-    tag = AssertionBranchTag() and
-    kind instanceof TrueEdge and
-    result = this.getParent().getChildSuccessor(this, _)
-  }
-
-  final override TranslatedElement getChildInternal(int id) {
-    id = 0 and result = this.getLeft()
-    or
-    id = 1 and result = this.getRight()
-  }
-
-  final override Instruction getALastInstructionInternal() {
-    result = this.getInstruction(AssertionBranchTag())
-  }
-
-  final override predicate hasInstruction(Opcode opcode, InstructionTag tag, CppType resultType) {
-    tag = AssertionOpTag() and
-    resultType = getBoolType() and
-    hasAssertionOpcode(mi, opcode)
-    or
-    tag = AssertionBranchTag() and
-    resultType = getVoidType() and
-    opcode instanceof Opcode::ConditionalBranch
-  }
-
-  final override Instruction getChildSuccessorInternal(TranslatedElement child, EdgeKind kind) {
-    child = this.getLeft() and
-    result = this.getRight().getFirstInstruction(kind)
-    or
-    child = this.getRight() and
-    kind instanceof GotoEdge and
-    result = this.getInstruction(AssertionOpTag())
-  }
-
-  final override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
-    tag = AssertionOpTag() and
-    (
-      operandTag instanceof LeftOperandTag and
-      result = this.getLeft().getResult()
-      or
-      operandTag instanceof RightOperandTag and
-      result = this.getRight().getResult()
-    )
-    or
-    tag = AssertionBranchTag() and
-    operandTag instanceof ConditionOperandTag and
-    result = this.getInstruction(AssertionOpTag())
-  }
-
-  MacroInvocation getMacroInvocation() { result = mi }
-}

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedElement.qll

@@ -12,7 +12,6 @@ private import TranslatedFunction
 private import TranslatedStmt
 private import TranslatedExpr
 private import IRConstruction
-private import TranslatedAssertion
 private import semmle.code.cpp.models.interfaces.SideEffect
 private import SideEffects
 
@@ -62,26 +61,12 @@ private predicate ignoreConstantValue(Operation op) {
   op instanceof BitwiseXorExpr
 }
 
-/**
- * Holds if `expr` contains an address-of expression that EDG may have constant-folded.
- * We don't recurse into `sizeof` or `alignof` since they don't evaluate their operands,
- * so any address-of inside them doesn't affect actual execution.
- */
-private predicate containsAddressOf(Expr expr) {
-  expr instanceof AddressOfExpr
-  or
-  not expr instanceof SizeofOperator and
-  not expr instanceof AlignofOperator and
-  containsAddressOf(expr.getAChild())
-}
-
 /**
  * Holds if `expr` is a constant of a type that can be replaced directly with
  * its value in the IR. This does not include address constants as we have no
  * means to express those as QL values.
  */
 predicate isIRConstant(Expr expr) {
-  not containsAddressOf(expr) and
   exists(expr.getValue()) and
   // We avoid constant folding certain operations since it's often useful to
   // mark one of those as a source in dataflow, and if the operation is
@@ -153,14 +138,6 @@ private predicate ignoreExprAndDescendants(Expr expr) {
   // conditionally constructed (until we have a mechanism for calling these only when the
   // temporary's constructor was run)
   isConditionalTemporaryDestructorCall(expr)
-  or
-  // An assertion in a release build is often defined as `#define assert(x) ((void)0)`.
-  // We generate a synthetic assertion in release builds, and when we do that the
-  // expression `((void)0)` should not be translated.
-  exists(MacroInvocation mi |
-    assertion(mi, _) and
-    expr = mi.getExpr().getFullyConverted()
-  )
 }
 
 /**
@@ -932,8 +909,7 @@ newtype TTranslatedElement =
   } or
   // The side effect that initializes newly-allocated memory.
   TTranslatedAllocationSideEffect(AllocationExpr expr) { not ignoreSideEffects(expr) } or
-  TTranslatedStaticStorageDurationVarInit(Variable var) { Raw::varHasIRFunc(var) } or
-  TTranslatedAssertionOperand(MacroInvocation mi, int index) { hasAssertionOperand(mi, index) }
+  TTranslatedStaticStorageDurationVarInit(Variable var) { Raw::varHasIRFunc(var) }
 
 /**
  * Gets the index of the first explicitly initialized element in `initList`

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedStmt.qll

@@ -10,7 +10,6 @@ private import TranslatedElement
 private import TranslatedExpr
 private import TranslatedFunction
 private import TranslatedInitialization
-private import TranslatedAssertion
 
 TranslatedStmt getTranslatedStmt(Stmt stmt) { result.getAst() = stmt }
 
@@ -325,16 +324,8 @@ abstract class TranslatedStmt extends TranslatedElement, TTranslatedStmt {
 
 class TranslatedEmptyStmt extends TranslatedStmt {
   TranslatedEmptyStmt() {
-    // An assertion macro invocation can expand to
-    // an empty statement in release builds. In that case
-    // we synthesize the check that would have occurred.
-    // This is handled by `TranslatedAssertion.qll` and so
-    // we exclude these statements here.
-    not assertion(_, stmt) and
-    stmt instanceof EmptyStmt
-    or
-    stmt instanceof LabelStmt
-    or
+    stmt instanceof EmptyStmt or
+    stmt instanceof LabelStmt or
     stmt instanceof SwitchCase
   }
 
@@ -429,15 +420,6 @@ class TranslatedDeclStmt extends TranslatedStmt {
 class TranslatedExprStmt extends TranslatedStmt {
   override ExprStmt stmt;
 
-  TranslatedExprStmt() {
-    // An assertion macro invocation typically expand to the
-    // expression `((void)0)` in release builds. In that case
-    // we synthesize the check that would have occurred.
-    // This is handled by `TranslatedAssertion.qll` and so
-    // we exclude these statements here.
-    not assertion(_, stmt)
-  }
-
   TranslatedExpr getExpr() { result = getTranslatedExpr(stmt.getExpr().getFullyConverted()) }
 
   override TranslatedElement getChildInternal(int id) { id = 0 and result = this.getExpr() }

cpp/ql/lib/semmle/code/cpp/models/implementations/MySql.qll

@@ -16,3 +16,17 @@ private class MySqlExecutionFunction extends SqlExecutionFunction {
 
   override predicate hasSqlArgument(FunctionInput input) { input.isParameterDeref(1) }
 }
+
+/**
+ * The `mysql_real_escape_string` family of functions from the MySQL C API.
+ */
+private class MySqlBarrierFunction extends SqlBarrierFunction {
+  MySqlBarrierFunction() {
+    this.hasName(["mysql_real_escape_string", "mysql_real_escape_string_quote"])
+  }
+
+  override predicate barrierSqlArgument(FunctionInput input, FunctionOutput output) {
+    input.isParameterDeref(2) and
+    output.isParameterDeref(1)
+  }
+}

cpp/ql/lib/semmle/code/cpp/stmts/Stmt.qll

@@ -20,7 +20,7 @@ class Stmt extends StmtParent, @stmt {
   predicate hasChild(Element e, int n) { this.getChild(n) = e }
 
   /** Gets the enclosing function of this statement, if any. */
-  override Function getEnclosingFunction() { result = stmtEnclosingElement(this) }
+  Function getEnclosingFunction() { result = stmtEnclosingElement(this) }
 
   /**
    * Gets the nearest enclosing block of this statement in the source, if any.
@@ -159,10 +159,7 @@ private class TStmtParent = @stmt or @expr;
  *
  * This is normally a statement, but may be a `StmtExpr`.
  */
-class StmtParent extends ControlFlowNode, TStmtParent {
-  /** Gets the enclosing function of this element, if any. */
-  Function getEnclosingFunction() { none() }
-}
+class StmtParent extends ControlFlowNode, TStmtParent { }
 
 /**
  * A C/C++ 'expression' statement.

cpp/ql/lib/semmlecode.cpp.dbscheme

@@ -2353,7 +2353,6 @@ case @preprocdirect.kind of
 | 14 = @ppd_ms_import
 | 15 = @ppd_elifdef
 | 16 = @ppd_elifndef
-| 17 = @ppd_embed
 | 18 = @ppd_warning
 ;
 
@@ -2380,11 +2379,6 @@ includes(
     int included: @file ref
 );
 
-embeds(
-    unique int id: @ppd_embed ref,
-    int included: @file ref
-);
-
 link_targets(
     int id: @link_target,
     int binary: @file ref

cpp/ql/lib/upgrades/83100310bf73eefc37c1d8d0ac98b2ca3019c7b6/upgrade.properties

@@ -1,2 +0,0 @@
-description: Support embed preprocessor directive
-compatibility: partial

cpp/ql/src/CHANGELOG.md

@@ -1,7 +1,3 @@
-## 1.5.10
-
-No user-facing changes.
-
 ## 1.5.9
 
 ### Minor Analysis Improvements

cpp/ql/src/Security/CWE/CWE-089/SqlTainted.ql

@@ -45,15 +45,14 @@ module SqlTaintedConfig implements DataFlow::ConfigSig {
 
   predicate isBarrier(DataFlow::Node node) {
     node.asExpr().getUnspecifiedType() instanceof IntegralType
-    or
+  }
+
+  predicate isBarrierIn(DataFlow::Node node) {
     exists(SqlBarrierFunction sql, int arg, FunctionInput input |
       node.asIndirectArgument() = sql.getACallToThisFunction().getArgument(arg) and
       input.isParameterDeref(arg) and
       sql.barrierSqlArgument(input, _)
     )
-    or
-    // barrier defined using models-as-data
-    barrierNode(node, "sql-injection")
   }
 
   predicate observeDiffInformedIncrementalMode() { any() }

cpp/ql/src/change-notes/released/1.5.10.md

@@ -1,3 +0,0 @@
-## 1.5.10
-
-No user-facing changes.

cpp/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.5.10
+lastReleaseVersion: 1.5.9

cpp/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/cpp-queries
-version: 1.5.10
+version: 1.5.10-dev
 groups:
   - cpp
   - queries

cpp/ql/src/utils/modelgenerator/internal/CaptureModels.qll

@@ -310,7 +310,7 @@ private module SummaryModelGeneratorInput implements SummaryModelGeneratorInputS
   }
 
   private predicate hasManualSummaryModel(Callable api) {
-    api = any(FlowSummaryImpl::Public::SummarizedCallable sc | sc.hasManualModel()) or
+    api = any(FlowSummaryImpl::Public::SummarizedCallable sc | sc.applyManualModel()) or
     api = any(FlowSummaryImpl::Public::NeutralSummaryCallable sc | sc.hasManualModel())
   }
 

cpp/ql/test/library-tests/controlflow/guards-ir/tests.expected

@@ -384,9 +384,7 @@ astGuardsControl
 | test.c:126:7:126:7 | 1 | true | 131 | 132 |
 | test.c:126:7:126:7 | 1 | true | 134 | 123 |
 | test.c:126:7:126:28 | ... && ... | true | 126 | 128 |
-| test.c:126:7:126:28 | ... && ... | true | 131 | 131 |
 | test.c:126:7:126:28 | ... && ... | true | 131 | 132 |
-| test.c:126:7:126:28 | ... && ... | true | 134 | 123 |
 | test.c:126:12:126:26 | call to test3_condition | true | 126 | 128 |
 | test.c:126:12:126:26 | call to test3_condition | true | 131 | 132 |
 | test.c:131:7:131:7 | b | true | 131 | 132 |
@@ -407,7 +405,9 @@ astGuardsControl
 | test.c:181:9:181:9 | x | true | 181 | 182 |
 | test.c:181:9:181:9 | x | true | 186 | 180 |
 | test.cpp:18:8:18:10 | call to get | true | 19 | 19 |
+| test.cpp:31:7:31:13 | ... == ... | false | 30 | 30 |
 | test.cpp:31:7:31:13 | ... == ... | false | 34 | 34 |
+| test.cpp:31:7:31:13 | ... == ... | true | 30 | 30 |
 | test.cpp:31:7:31:13 | ... == ... | true | 31 | 32 |
 | test.cpp:42:13:42:20 | call to getABool | true | 43 | 45 |
 astGuardsEnsure
@@ -589,9 +589,13 @@ astGuardsEnsure
 | test.c:175:13:175:32 | ... == ... | test.c:175:13:175:15 | call to foo | == | test.c:175:32:175:32 | 0 | 0 | 175 | 175 |
 | test.c:175:13:175:32 | ... == ... | test.c:175:32:175:32 | 0 | != | test.c:175:13:175:15 | call to foo | 0 | 175 | 175 |
 | test.c:175:13:175:32 | ... == ... | test.c:175:32:175:32 | 0 | == | test.c:175:13:175:15 | call to foo | 0 | 175 | 175 |
+| test.cpp:31:7:31:13 | ... == ... | test.cpp:31:7:31:7 | x | != | test.cpp:31:12:31:13 | - ... | 0 | 30 | 30 |
 | test.cpp:31:7:31:13 | ... == ... | test.cpp:31:7:31:7 | x | != | test.cpp:31:12:31:13 | - ... | 0 | 34 | 34 |
+| test.cpp:31:7:31:13 | ... == ... | test.cpp:31:7:31:7 | x | == | test.cpp:31:12:31:13 | - ... | 0 | 30 | 30 |
 | test.cpp:31:7:31:13 | ... == ... | test.cpp:31:7:31:7 | x | == | test.cpp:31:12:31:13 | - ... | 0 | 31 | 32 |
+| test.cpp:31:7:31:13 | ... == ... | test.cpp:31:12:31:13 | - ... | != | test.cpp:31:7:31:7 | x | 0 | 30 | 30 |
 | test.cpp:31:7:31:13 | ... == ... | test.cpp:31:12:31:13 | - ... | != | test.cpp:31:7:31:7 | x | 0 | 34 | 34 |
+| test.cpp:31:7:31:13 | ... == ... | test.cpp:31:12:31:13 | - ... | == | test.cpp:31:7:31:7 | x | 0 | 30 | 30 |
 | test.cpp:31:7:31:13 | ... == ... | test.cpp:31:12:31:13 | - ... | == | test.cpp:31:7:31:7 | x | 0 | 31 | 32 |
 astGuardsEnsure_const
 | test.c:7:9:7:13 | ... > ... | test.c:7:9:7:13 | ... > ... | != | 0 | 7 | 9 |
@@ -789,21 +793,13 @@ astGuardsEnsure_const
 | test.c:126:7:126:7 | 1 | test.c:126:7:126:7 | 1 | == | 1 | 131 | 132 |
 | test.c:126:7:126:7 | 1 | test.c:126:7:126:7 | 1 | == | 1 | 134 | 123 |
 | test.c:126:7:126:28 | ... && ... | test.c:126:7:126:7 | 1 | != | 0 | 126 | 128 |
-| test.c:126:7:126:28 | ... && ... | test.c:126:7:126:7 | 1 | != | 0 | 131 | 131 |
 | test.c:126:7:126:28 | ... && ... | test.c:126:7:126:7 | 1 | != | 0 | 131 | 132 |
-| test.c:126:7:126:28 | ... && ... | test.c:126:7:126:7 | 1 | != | 0 | 134 | 123 |
 | test.c:126:7:126:28 | ... && ... | test.c:126:7:126:7 | 1 | == | 1 | 126 | 128 |
-| test.c:126:7:126:28 | ... && ... | test.c:126:7:126:7 | 1 | == | 1 | 131 | 131 |
 | test.c:126:7:126:28 | ... && ... | test.c:126:7:126:7 | 1 | == | 1 | 131 | 132 |
-| test.c:126:7:126:28 | ... && ... | test.c:126:7:126:7 | 1 | == | 1 | 134 | 123 |
 | test.c:126:7:126:28 | ... && ... | test.c:126:12:126:26 | call to test3_condition | != | 0 | 126 | 128 |
-| test.c:126:7:126:28 | ... && ... | test.c:126:12:126:26 | call to test3_condition | != | 0 | 131 | 131 |
 | test.c:126:7:126:28 | ... && ... | test.c:126:12:126:26 | call to test3_condition | != | 0 | 131 | 132 |
-| test.c:126:7:126:28 | ... && ... | test.c:126:12:126:26 | call to test3_condition | != | 0 | 134 | 123 |
 | test.c:126:7:126:28 | ... && ... | test.c:126:12:126:26 | call to test3_condition | == | 1 | 126 | 128 |
-| test.c:126:7:126:28 | ... && ... | test.c:126:12:126:26 | call to test3_condition | == | 1 | 131 | 131 |
 | test.c:126:7:126:28 | ... && ... | test.c:126:12:126:26 | call to test3_condition | == | 1 | 131 | 132 |
-| test.c:126:7:126:28 | ... && ... | test.c:126:12:126:26 | call to test3_condition | == | 1 | 134 | 123 |
 | test.c:126:12:126:26 | call to test3_condition | test.c:126:12:126:26 | call to test3_condition | != | 0 | 126 | 128 |
 | test.c:126:12:126:26 | call to test3_condition | test.c:126:12:126:26 | call to test3_condition | != | 0 | 131 | 132 |
 | test.c:126:12:126:26 | call to test3_condition | test.c:126:12:126:26 | call to test3_condition | == | 1 | 126 | 128 |
@@ -850,11 +846,17 @@ astGuardsEnsure_const
 | test.c:181:9:181:9 | x | test.c:181:9:181:9 | x | == | 1 | 186 | 180 |
 | test.cpp:18:8:18:10 | call to get | test.cpp:18:8:18:10 | call to get | != | 0 | 19 | 19 |
 | test.cpp:18:8:18:10 | call to get | test.cpp:18:8:18:10 | call to get | == | 1 | 19 | 19 |
+| test.cpp:31:7:31:13 | ... == ... | test.cpp:31:7:31:7 | x | != | -1 | 30 | 30 |
 | test.cpp:31:7:31:13 | ... == ... | test.cpp:31:7:31:7 | x | != | -1 | 34 | 34 |
+| test.cpp:31:7:31:13 | ... == ... | test.cpp:31:7:31:7 | x | == | -1 | 30 | 30 |
 | test.cpp:31:7:31:13 | ... == ... | test.cpp:31:7:31:7 | x | == | -1 | 31 | 32 |
+| test.cpp:31:7:31:13 | ... == ... | test.cpp:31:7:31:13 | ... == ... | != | 0 | 30 | 30 |
 | test.cpp:31:7:31:13 | ... == ... | test.cpp:31:7:31:13 | ... == ... | != | 0 | 31 | 32 |
+| test.cpp:31:7:31:13 | ... == ... | test.cpp:31:7:31:13 | ... == ... | != | 1 | 30 | 30 |
 | test.cpp:31:7:31:13 | ... == ... | test.cpp:31:7:31:13 | ... == ... | != | 1 | 34 | 34 |
+| test.cpp:31:7:31:13 | ... == ... | test.cpp:31:7:31:13 | ... == ... | == | 0 | 30 | 30 |
 | test.cpp:31:7:31:13 | ... == ... | test.cpp:31:7:31:13 | ... == ... | == | 0 | 34 | 34 |
+| test.cpp:31:7:31:13 | ... == ... | test.cpp:31:7:31:13 | ... == ... | == | 1 | 30 | 30 |
 | test.cpp:31:7:31:13 | ... == ... | test.cpp:31:7:31:13 | ... == ... | == | 1 | 31 | 32 |
 | test.cpp:42:13:42:20 | call to getABool | test.cpp:42:13:42:20 | call to getABool | != | 0 | 43 | 45 |
 | test.cpp:42:13:42:20 | call to getABool | test.cpp:42:13:42:20 | call to getABool | == | 1 | 43 | 45 |

cpp/ql/test/library-tests/controlflow/guards/GuardsControl.expected

@@ -105,13 +105,9 @@
 | test.c:126:7:126:7 | 1 | true | test.c:131:10:132:16 | { ... } |
 | test.c:126:7:126:7 | 1 | true | test.c:134:1:123:10 | return ... |
 | test.c:126:7:126:28 | ... && ... | not 0 | test.c:126:31:128:16 | { ... } |
-| test.c:126:7:126:28 | ... && ... | not 0 | test.c:131:3:131:7 | if (...) ...  |
 | test.c:126:7:126:28 | ... && ... | not 0 | test.c:131:10:132:16 | { ... } |
-| test.c:126:7:126:28 | ... && ... | not 0 | test.c:134:1:123:10 | return ... |
 | test.c:126:7:126:28 | ... && ... | true | test.c:126:31:128:16 | { ... } |
-| test.c:126:7:126:28 | ... && ... | true | test.c:131:3:131:7 | if (...) ...  |
 | test.c:126:7:126:28 | ... && ... | true | test.c:131:10:132:16 | { ... } |
-| test.c:126:7:126:28 | ... && ... | true | test.c:134:1:123:10 | return ... |
 | test.c:126:12:126:26 | call to test3_condition | not 0 | test.c:126:31:128:16 | { ... } |
 | test.c:126:12:126:26 | call to test3_condition | not 0 | test.c:131:10:132:16 | { ... } |
 | test.c:126:12:126:26 | call to test3_condition | true | test.c:126:31:128:16 | { ... } |
@@ -166,11 +162,17 @@
 | test.c:219:9:219:22 | call to __builtin_expect | true | test.c:219:25:221:5 | { ... } |
 | test.cpp:18:8:18:10 | call to get | not null | test.cpp:19:5:19:14 | ExprStmt |
 | test.cpp:18:8:18:10 | call to get | true | test.cpp:19:5:19:14 | ExprStmt |
+| test.cpp:30:22:30:22 | x | -1 | test.cpp:30:6:30:16 | doSomething |
 | test.cpp:30:22:30:22 | x | -1 | test.cpp:31:16:32:21 | { ... } |
+| test.cpp:30:22:30:22 | x | not -1 | test.cpp:30:6:30:16 | doSomething |
 | test.cpp:30:22:30:22 | x | not -1 | test.cpp:34:1:34:1 | return ... |
+| test.cpp:31:7:31:7 | x | -1 | test.cpp:30:6:30:16 | doSomething |
 | test.cpp:31:7:31:7 | x | -1 | test.cpp:31:16:32:21 | { ... } |
+| test.cpp:31:7:31:7 | x | not -1 | test.cpp:30:6:30:16 | doSomething |
 | test.cpp:31:7:31:7 | x | not -1 | test.cpp:34:1:34:1 | return ... |
+| test.cpp:31:7:31:13 | ... == ... | false | test.cpp:30:6:30:16 | doSomething |
 | test.cpp:31:7:31:13 | ... == ... | false | test.cpp:34:1:34:1 | return ... |
+| test.cpp:31:7:31:13 | ... == ... | true | test.cpp:30:6:30:16 | doSomething |
 | test.cpp:31:7:31:13 | ... == ... | true | test.cpp:31:16:32:21 | { ... } |
 | test.cpp:42:13:42:20 | call to getABool | true | test.cpp:43:9:45:23 | { ... } |
 | test.cpp:60:31:60:31 | i | 0 | test.cpp:62:5:64:12 | case ...: |
@@ -406,11 +408,19 @@
 | test.cpp:400:11:400:25 | call to testEnumWrapper | 2 | test.cpp:404:5:406:12 | case ...: |
 | test.cpp:400:27:400:27 | b | false | test.cpp:404:5:406:12 | case ...: |
 | test.cpp:400:27:400:27 | b | true | test.cpp:401:5:403:12 | case ...: |
+| test.cpp:410:26:410:26 | o | not null | test.cpp:410:6:410:18 | ensureNotNull |
 | test.cpp:410:26:410:26 | o | not null | test.cpp:412:1:412:1 | return ... |
+| test.cpp:410:26:410:26 | o | null | test.cpp:410:6:410:18 | ensureNotNull |
 | test.cpp:410:26:410:26 | o | null | test.cpp:411:11:411:18 | ExprStmt |
+| test.cpp:411:7:411:8 | ! ... | false | test.cpp:410:6:410:18 | ensureNotNull |
 | test.cpp:411:7:411:8 | ! ... | false | test.cpp:412:1:412:1 | return ... |
+| test.cpp:411:7:411:8 | ! ... | true | test.cpp:410:6:410:18 | ensureNotNull |
 | test.cpp:411:7:411:8 | ! ... | true | test.cpp:411:11:411:18 | ExprStmt |
+| test.cpp:411:8:411:8 | o | false | test.cpp:410:6:410:18 | ensureNotNull |
 | test.cpp:411:8:411:8 | o | false | test.cpp:411:11:411:18 | ExprStmt |
+| test.cpp:411:8:411:8 | o | not null | test.cpp:410:6:410:18 | ensureNotNull |
 | test.cpp:411:8:411:8 | o | not null | test.cpp:412:1:412:1 | return ... |
+| test.cpp:411:8:411:8 | o | null | test.cpp:410:6:410:18 | ensureNotNull |
 | test.cpp:411:8:411:8 | o | null | test.cpp:411:11:411:18 | ExprStmt |
+| test.cpp:411:8:411:8 | o | true | test.cpp:410:6:410:18 | ensureNotNull |
 | test.cpp:411:8:411:8 | o | true | test.cpp:412:1:412:1 | return ... |

cpp/ql/test/library-tests/controlflow/guards/GuardsEnsure.expected

@@ -195,9 +195,13 @@ binary
 | test.c:215:6:215:18 | call to __builtin_expect | test.c:215:17:215:17 | b | < | test.c:215:13:215:13 | a | 0 | test.c:215:21:217:5 | { ... } |
 | test.c:219:9:219:22 | call to __builtin_expect | test.c:219:16:219:16 | a | >= | test.c:219:20:219:21 | 42 | 1 | test.c:219:25:221:5 | { ... } |
 | test.c:219:9:219:22 | call to __builtin_expect | test.c:219:20:219:21 | 42 | < | test.c:219:16:219:16 | a | 0 | test.c:219:25:221:5 | { ... } |
+| test.cpp:31:7:31:13 | ... == ... | test.cpp:31:7:31:7 | x | != | test.cpp:31:12:31:13 | - ... | 0 | test.cpp:30:6:30:16 | doSomething |
 | test.cpp:31:7:31:13 | ... == ... | test.cpp:31:7:31:7 | x | != | test.cpp:31:12:31:13 | - ... | 0 | test.cpp:34:1:34:1 | return ... |
+| test.cpp:31:7:31:13 | ... == ... | test.cpp:31:7:31:7 | x | == | test.cpp:31:12:31:13 | - ... | 0 | test.cpp:30:6:30:16 | doSomething |
 | test.cpp:31:7:31:13 | ... == ... | test.cpp:31:7:31:7 | x | == | test.cpp:31:12:31:13 | - ... | 0 | test.cpp:31:16:32:21 | { ... } |
+| test.cpp:31:7:31:13 | ... == ... | test.cpp:31:12:31:13 | - ... | != | test.cpp:31:7:31:7 | x | 0 | test.cpp:30:6:30:16 | doSomething |
 | test.cpp:31:7:31:13 | ... == ... | test.cpp:31:12:31:13 | - ... | != | test.cpp:31:7:31:7 | x | 0 | test.cpp:34:1:34:1 | return ... |
+| test.cpp:31:7:31:13 | ... == ... | test.cpp:31:12:31:13 | - ... | == | test.cpp:31:7:31:7 | x | 0 | test.cpp:30:6:30:16 | doSomething |
 | test.cpp:31:7:31:13 | ... == ... | test.cpp:31:12:31:13 | - ... | == | test.cpp:31:7:31:7 | x | 0 | test.cpp:31:16:32:21 | { ... } |
 | test.cpp:105:6:105:14 | ... != ... | test.cpp:105:6:105:6 | f | != | test.cpp:105:11:105:14 | 0.0 | 0 | test.cpp:105:17:106:7 | { ... } |
 | test.cpp:105:6:105:14 | ... != ... | test.cpp:105:11:105:14 | 0.0 | != | test.cpp:105:6:105:6 | f | 0 | test.cpp:105:17:106:7 | { ... } |
@@ -758,21 +762,13 @@ unary
 | test.c:126:7:126:7 | 1 | test.c:126:7:126:7 | 1 | == | 1 | test.c:131:10:132:16 | { ... } |
 | test.c:126:7:126:7 | 1 | test.c:126:7:126:7 | 1 | == | 1 | test.c:134:1:123:10 | return ... |
 | test.c:126:7:126:28 | ... && ... | test.c:126:7:126:7 | 1 | != | 0 | test.c:126:31:128:16 | { ... } |
-| test.c:126:7:126:28 | ... && ... | test.c:126:7:126:7 | 1 | != | 0 | test.c:131:3:131:7 | if (...) ...  |
 | test.c:126:7:126:28 | ... && ... | test.c:126:7:126:7 | 1 | != | 0 | test.c:131:10:132:16 | { ... } |
-| test.c:126:7:126:28 | ... && ... | test.c:126:7:126:7 | 1 | != | 0 | test.c:134:1:123:10 | return ... |
 | test.c:126:7:126:28 | ... && ... | test.c:126:7:126:7 | 1 | == | 1 | test.c:126:31:128:16 | { ... } |
-| test.c:126:7:126:28 | ... && ... | test.c:126:7:126:7 | 1 | == | 1 | test.c:131:3:131:7 | if (...) ...  |
 | test.c:126:7:126:28 | ... && ... | test.c:126:7:126:7 | 1 | == | 1 | test.c:131:10:132:16 | { ... } |
-| test.c:126:7:126:28 | ... && ... | test.c:126:7:126:7 | 1 | == | 1 | test.c:134:1:123:10 | return ... |
 | test.c:126:7:126:28 | ... && ... | test.c:126:12:126:26 | call to test3_condition | != | 0 | test.c:126:31:128:16 | { ... } |
-| test.c:126:7:126:28 | ... && ... | test.c:126:12:126:26 | call to test3_condition | != | 0 | test.c:131:3:131:7 | if (...) ...  |
 | test.c:126:7:126:28 | ... && ... | test.c:126:12:126:26 | call to test3_condition | != | 0 | test.c:131:10:132:16 | { ... } |
-| test.c:126:7:126:28 | ... && ... | test.c:126:12:126:26 | call to test3_condition | != | 0 | test.c:134:1:123:10 | return ... |
 | test.c:126:7:126:28 | ... && ... | test.c:126:12:126:26 | call to test3_condition | == | 1 | test.c:126:31:128:16 | { ... } |
-| test.c:126:7:126:28 | ... && ... | test.c:126:12:126:26 | call to test3_condition | == | 1 | test.c:131:3:131:7 | if (...) ...  |
 | test.c:126:7:126:28 | ... && ... | test.c:126:12:126:26 | call to test3_condition | == | 1 | test.c:131:10:132:16 | { ... } |
-| test.c:126:7:126:28 | ... && ... | test.c:126:12:126:26 | call to test3_condition | == | 1 | test.c:134:1:123:10 | return ... |
 | test.c:126:12:126:26 | call to test3_condition | test.c:126:12:126:26 | call to test3_condition | != | 0 | test.c:126:31:128:16 | { ... } |
 | test.c:126:12:126:26 | call to test3_condition | test.c:126:12:126:26 | call to test3_condition | != | 0 | test.c:131:10:132:16 | { ... } |
 | test.c:126:12:126:26 | call to test3_condition | test.c:126:12:126:26 | call to test3_condition | == | 1 | test.c:126:31:128:16 | { ... } |
@@ -857,11 +853,17 @@ unary
 | test.c:219:9:219:22 | call to __builtin_expect | test.c:219:16:219:21 | ... > ... | != | 0 | test.c:219:25:221:5 | { ... } |
 | test.cpp:18:8:18:10 | call to get | test.cpp:18:8:18:10 | call to get | != | 0 | test.cpp:19:5:19:14 | ExprStmt |
 | test.cpp:18:8:18:10 | call to get | test.cpp:18:8:18:10 | call to get | == | 1 | test.cpp:19:5:19:14 | ExprStmt |
+| test.cpp:31:7:31:13 | ... == ... | test.cpp:31:7:31:7 | x | != | -1 | test.cpp:30:6:30:16 | doSomething |
 | test.cpp:31:7:31:13 | ... == ... | test.cpp:31:7:31:7 | x | != | -1 | test.cpp:34:1:34:1 | return ... |
+| test.cpp:31:7:31:13 | ... == ... | test.cpp:31:7:31:7 | x | == | -1 | test.cpp:30:6:30:16 | doSomething |
 | test.cpp:31:7:31:13 | ... == ... | test.cpp:31:7:31:7 | x | == | -1 | test.cpp:31:16:32:21 | { ... } |
+| test.cpp:31:7:31:13 | ... == ... | test.cpp:31:7:31:13 | ... == ... | != | 0 | test.cpp:30:6:30:16 | doSomething |
 | test.cpp:31:7:31:13 | ... == ... | test.cpp:31:7:31:13 | ... == ... | != | 0 | test.cpp:31:16:32:21 | { ... } |
+| test.cpp:31:7:31:13 | ... == ... | test.cpp:31:7:31:13 | ... == ... | != | 1 | test.cpp:30:6:30:16 | doSomething |
 | test.cpp:31:7:31:13 | ... == ... | test.cpp:31:7:31:13 | ... == ... | != | 1 | test.cpp:34:1:34:1 | return ... |
+| test.cpp:31:7:31:13 | ... == ... | test.cpp:31:7:31:13 | ... == ... | == | 0 | test.cpp:30:6:30:16 | doSomething |
 | test.cpp:31:7:31:13 | ... == ... | test.cpp:31:7:31:13 | ... == ... | == | 0 | test.cpp:34:1:34:1 | return ... |
+| test.cpp:31:7:31:13 | ... == ... | test.cpp:31:7:31:13 | ... == ... | == | 1 | test.cpp:30:6:30:16 | doSomething |
 | test.cpp:31:7:31:13 | ... == ... | test.cpp:31:7:31:13 | ... == ... | == | 1 | test.cpp:31:16:32:21 | { ... } |
 | test.cpp:42:13:42:20 | call to getABool | test.cpp:42:13:42:20 | call to getABool | != | 0 | test.cpp:43:9:45:23 | { ... } |
 | test.cpp:42:13:42:20 | call to getABool | test.cpp:42:13:42:20 | call to getABool | == | 1 | test.cpp:43:9:45:23 | { ... } |
@@ -1399,19 +1401,35 @@ unary
 | test.cpp:394:7:394:47 | ... == ... | test.cpp:394:15:394:34 | call to returnAIfNoneAreNull | == | 0 | test.cpp:394:50:395:7 | { ... } |
 | test.cpp:400:11:400:25 | call to testEnumWrapper | test.cpp:400:11:400:25 | call to testEnumWrapper | == | 1 | test.cpp:401:5:403:12 | case ...: |
 | test.cpp:400:11:400:25 | call to testEnumWrapper | test.cpp:400:11:400:25 | call to testEnumWrapper | == | 2 | test.cpp:404:5:406:12 | case ...: |
+| test.cpp:411:7:411:8 | ! ... | test.cpp:411:7:411:8 | ! ... | != | 0 | test.cpp:410:6:410:18 | ensureNotNull |
 | test.cpp:411:7:411:8 | ! ... | test.cpp:411:7:411:8 | ! ... | != | 0 | test.cpp:411:11:411:18 | ExprStmt |
+| test.cpp:411:7:411:8 | ! ... | test.cpp:411:7:411:8 | ! ... | != | 1 | test.cpp:410:6:410:18 | ensureNotNull |
 | test.cpp:411:7:411:8 | ! ... | test.cpp:411:7:411:8 | ! ... | != | 1 | test.cpp:412:1:412:1 | return ... |
+| test.cpp:411:7:411:8 | ! ... | test.cpp:411:7:411:8 | ! ... | == | 0 | test.cpp:410:6:410:18 | ensureNotNull |
 | test.cpp:411:7:411:8 | ! ... | test.cpp:411:7:411:8 | ! ... | == | 0 | test.cpp:412:1:412:1 | return ... |
+| test.cpp:411:7:411:8 | ! ... | test.cpp:411:7:411:8 | ! ... | == | 1 | test.cpp:410:6:410:18 | ensureNotNull |
 | test.cpp:411:7:411:8 | ! ... | test.cpp:411:7:411:8 | ! ... | == | 1 | test.cpp:411:11:411:18 | ExprStmt |
+| test.cpp:411:7:411:8 | ! ... | test.cpp:411:8:411:8 | o | != | 0 | test.cpp:410:6:410:18 | ensureNotNull |
 | test.cpp:411:7:411:8 | ! ... | test.cpp:411:8:411:8 | o | != | 0 | test.cpp:412:1:412:1 | return ... |
+| test.cpp:411:7:411:8 | ! ... | test.cpp:411:8:411:8 | o | != | 1 | test.cpp:410:6:410:18 | ensureNotNull |
 | test.cpp:411:7:411:8 | ! ... | test.cpp:411:8:411:8 | o | != | 1 | test.cpp:411:11:411:18 | ExprStmt |
+| test.cpp:411:7:411:8 | ! ... | test.cpp:411:8:411:8 | o | == | 0 | test.cpp:410:6:410:18 | ensureNotNull |
 | test.cpp:411:7:411:8 | ! ... | test.cpp:411:8:411:8 | o | == | 0 | test.cpp:411:11:411:18 | ExprStmt |
+| test.cpp:411:7:411:8 | ! ... | test.cpp:411:8:411:8 | o | == | 1 | test.cpp:410:6:410:18 | ensureNotNull |
 | test.cpp:411:7:411:8 | ! ... | test.cpp:411:8:411:8 | o | == | 1 | test.cpp:412:1:412:1 | return ... |
+| test.cpp:411:8:411:8 | o | test.cpp:411:7:411:8 | ! ... | != | 0 | test.cpp:410:6:410:18 | ensureNotNull |
 | test.cpp:411:8:411:8 | o | test.cpp:411:7:411:8 | ! ... | != | 0 | test.cpp:411:11:411:18 | ExprStmt |
+| test.cpp:411:8:411:8 | o | test.cpp:411:7:411:8 | ! ... | != | 1 | test.cpp:410:6:410:18 | ensureNotNull |
 | test.cpp:411:8:411:8 | o | test.cpp:411:7:411:8 | ! ... | != | 1 | test.cpp:412:1:412:1 | return ... |
+| test.cpp:411:8:411:8 | o | test.cpp:411:7:411:8 | ! ... | == | 0 | test.cpp:410:6:410:18 | ensureNotNull |
 | test.cpp:411:8:411:8 | o | test.cpp:411:7:411:8 | ! ... | == | 0 | test.cpp:412:1:412:1 | return ... |
+| test.cpp:411:8:411:8 | o | test.cpp:411:7:411:8 | ! ... | == | 1 | test.cpp:410:6:410:18 | ensureNotNull |
 | test.cpp:411:8:411:8 | o | test.cpp:411:7:411:8 | ! ... | == | 1 | test.cpp:411:11:411:18 | ExprStmt |
+| test.cpp:411:8:411:8 | o | test.cpp:411:8:411:8 | o | != | 0 | test.cpp:410:6:410:18 | ensureNotNull |
 | test.cpp:411:8:411:8 | o | test.cpp:411:8:411:8 | o | != | 0 | test.cpp:412:1:412:1 | return ... |
+| test.cpp:411:8:411:8 | o | test.cpp:411:8:411:8 | o | != | 1 | test.cpp:410:6:410:18 | ensureNotNull |
 | test.cpp:411:8:411:8 | o | test.cpp:411:8:411:8 | o | != | 1 | test.cpp:411:11:411:18 | ExprStmt |
+| test.cpp:411:8:411:8 | o | test.cpp:411:8:411:8 | o | == | 0 | test.cpp:410:6:410:18 | ensureNotNull |
 | test.cpp:411:8:411:8 | o | test.cpp:411:8:411:8 | o | == | 0 | test.cpp:411:11:411:18 | ExprStmt |
+| test.cpp:411:8:411:8 | o | test.cpp:411:8:411:8 | o | == | 1 | test.cpp:410:6:410:18 | ensureNotNull |
 | test.cpp:411:8:411:8 | o | test.cpp:411:8:411:8 | o | == | 1 | test.cpp:412:1:412:1 | return ... |

cpp/ql/test/library-tests/dataflow/asDefinition/test.cpp

@@ -1,18 +0,0 @@
-struct S {
-  int x;
-};
-
-void use(int);
-
-void test() {
-  int y = 43; // $ asDefinition=43
-  use(y);
-  y = 44; // $ asDefinition="... = ..."
-  use(y);
-
-  int x = 43; // $ asDefinition=43
-  x = 44; // $ asDefinition="... = ..."
-
-  S s;
-  s.x = 42; // $ asDefinition="... = ..."
-}

cpp/ql/test/library-tests/dataflow/asDefinition/test.ql

@@ -1,22 +0,0 @@
-import cpp
-import utils.test.InlineExpectationsTest
-import semmle.code.cpp.dataflow.new.DataFlow::DataFlow
-
-bindingset[s]
-string quote(string s) { if s.matches("% %") then result = "\"" + s + "\"" else result = s }
-
-module AsDefinitionTest implements TestSig {
-  string getARelevantTag() { result = "asDefinition" }
-
-  predicate hasActualResult(Location location, string element, string tag, string value) {
-    exists(Node n, Expr e |
-      e = n.asDefinition() and
-      location = e.getLocation() and
-      element = n.toString() and
-      tag = "asDefinition" and
-      value = quote(e.toString())
-    )
-  }
-}
-
-import MakeTest<AsDefinitionTest>

cpp/ql/test/library-tests/dataflow/dataflow-tests/test-source-sink.expected

@@ -147,29 +147,6 @@ astFlow
 | test.cpp:1165:10:1165:15 | call to source | test.cpp:1239:10:1239:26 | * ... |
 | test.cpp:1195:10:1195:24 | call to indirect_source | test.cpp:1200:19:1200:36 | global_int_ptr_ptr |
 | test.cpp:1195:10:1195:24 | call to indirect_source | test.cpp:1201:10:1201:27 | global_int_ptr_ptr |
-| test.cpp:1258:11:1258:16 | call to source | test.cpp:1259:8:1259:10 | ... ++ |
-| test.cpp:1262:7:1262:12 | call to source | test.cpp:1263:8:1263:10 | ... -- |
-| test.cpp:1266:7:1266:12 | call to source | test.cpp:1267:8:1267:10 | ++ ... |
-| test.cpp:1266:7:1266:12 | call to source | test.cpp:1268:8:1268:8 | x |
-| test.cpp:1270:7:1270:12 | call to source | test.cpp:1271:8:1271:10 | -- ... |
-| test.cpp:1270:7:1270:12 | call to source | test.cpp:1272:8:1272:8 | x |
-| test.cpp:1274:7:1274:12 | call to source | test.cpp:1275:8:1275:14 | ... += ... |
-| test.cpp:1274:7:1274:12 | call to source | test.cpp:1276:8:1276:8 | x |
-| test.cpp:1278:7:1278:12 | call to source | test.cpp:1279:8:1279:14 | ... -= ... |
-| test.cpp:1278:7:1278:12 | call to source | test.cpp:1280:8:1280:8 | x |
-| test.cpp:1284:11:1284:16 | call to source | test.cpp:1285:8:1285:20 | ... ? ... : ... |
-| test.cpp:1288:7:1288:12 | call to source | test.cpp:1289:8:1289:20 | ... ++ |
-| test.cpp:1288:7:1288:12 | call to source | test.cpp:1290:8:1290:8 | x |
-| test.cpp:1292:7:1292:12 | call to source | test.cpp:1294:8:1294:8 | x |
-| test.cpp:1296:7:1296:12 | call to source | test.cpp:1297:8:1297:18 | ... ? ... : ... |
-| test.cpp:1296:7:1296:12 | call to source | test.cpp:1298:8:1298:8 | x |
-| test.cpp:1300:7:1300:12 | call to source | test.cpp:1301:8:1301:18 | ... ? ... : ... |
-| test.cpp:1300:7:1300:12 | call to source | test.cpp:1302:8:1302:8 | x |
-| test.cpp:1304:7:1304:12 | call to source | test.cpp:1305:8:1305:18 | ... ? ... : ... |
-| test.cpp:1304:7:1304:12 | call to source | test.cpp:1306:8:1306:8 | x |
-| test.cpp:1308:7:1308:12 | call to source | test.cpp:1309:14:1309:16 | ... ++ |
-| test.cpp:1312:7:1312:12 | call to source | test.cpp:1313:8:1313:24 | ... ? ... : ... |
-| test.cpp:1312:7:1312:12 | call to source | test.cpp:1314:8:1314:8 | x |
 | true_upon_entry.cpp:17:11:17:16 | call to source | true_upon_entry.cpp:21:8:21:8 | x |
 | true_upon_entry.cpp:27:9:27:14 | call to source | true_upon_entry.cpp:29:8:29:8 | x |
 | true_upon_entry.cpp:33:11:33:16 | call to source | true_upon_entry.cpp:39:8:39:8 | x |
@@ -377,19 +354,6 @@ irFlow
 | test.cpp:1195:10:1195:24 | *call to indirect_source | test.cpp:1218:19:1218:36 | **global_int_ptr_ptr |
 | test.cpp:1195:10:1195:24 | *call to indirect_source | test.cpp:1224:19:1224:37 | ** ... |
 | test.cpp:1195:10:1195:24 | *call to indirect_source | test.cpp:1227:10:1227:29 | * ... |
-| test.cpp:1258:11:1258:16 | call to source | test.cpp:1259:8:1259:10 | ... ++ |
-| test.cpp:1262:7:1262:12 | call to source | test.cpp:1263:8:1263:10 | ... -- |
-| test.cpp:1284:11:1284:16 | call to source | test.cpp:1285:8:1285:20 | ... ? ... : ... |
-| test.cpp:1288:7:1288:12 | call to source | test.cpp:1290:8:1290:8 | x |
-| test.cpp:1292:7:1292:12 | call to source | test.cpp:1294:8:1294:8 | x |
-| test.cpp:1296:7:1296:12 | call to source | test.cpp:1297:8:1297:18 | ... ? ... : ... |
-| test.cpp:1296:7:1296:12 | call to source | test.cpp:1298:8:1298:8 | x |
-| test.cpp:1300:7:1300:12 | call to source | test.cpp:1301:8:1301:18 | ... ? ... : ... |
-| test.cpp:1300:7:1300:12 | call to source | test.cpp:1302:8:1302:8 | x |
-| test.cpp:1304:7:1304:12 | call to source | test.cpp:1306:8:1306:8 | x |
-| test.cpp:1308:7:1308:12 | call to source | test.cpp:1309:8:1309:16 | ... ++ |
-| test.cpp:1312:7:1312:12 | call to source | test.cpp:1313:8:1313:24 | ... ? ... : ... |
-| test.cpp:1312:7:1312:12 | call to source | test.cpp:1314:8:1314:8 | x |
 | true_upon_entry.cpp:9:11:9:16 | call to source | true_upon_entry.cpp:13:8:13:8 | x |
 | true_upon_entry.cpp:17:11:17:16 | call to source | true_upon_entry.cpp:21:8:21:8 | x |
 | true_upon_entry.cpp:27:9:27:14 | call to source | true_upon_entry.cpp:29:8:29:8 | x |

cpp/ql/test/library-tests/dataflow/dataflow-tests/test.cpp

@@ -1252,64 +1252,4 @@ namespace globals_without_explicit_def {
     calls_set_array();
     sink(*global_int_array); // $ ir MISSING: ast
   }
-}
-
-void crement_test1() {
-  int x = source();
-  sink(x++); // $ ir ast
-  sink(x);
-
-  x = source();
-  sink(x--); // $ ir ast
-  sink(x);
-
-  x = source();
-  sink(++x); // $ SPURIOUS: ast
-  sink(x); // $ SPURIOUS: ast
-
-  x = source();
-  sink(--x); // $ SPURIOUS: ast
-  sink(x); // $ SPURIOUS: ast
-
-  x = source();
-  sink(x += 10); // $ SPURIOUS: ast
-  sink(x); // $ SPURIOUS: ast
-
-  x = source();
-  sink(x -= 10); // $ SPURIOUS: ast
-  sink(x); // $ SPURIOUS: ast
-}
-
-void crement_test2(bool b, int y) {
-  int x = source();
-  sink(b ? x++ : x--); // $ ir ast
-  sink(x);
-
-  x = source();
-  sink((b ? x : y)++); // $ ast MISSING: ir
-  sink(x); // $ ir ast
-
-  x = source();
-  sink(++(b ? x : y));
-  sink(x); // $ ir ast
-
-  x = source();
-  sink(b ? x++ : y); // $ ir ast
-  sink(x); // $ ir ast
-
-  x = source();
-  sink(b ? x : y++); // $ ir ast
-  sink(x); // $ ir ast
-
-  x = source();
-  sink(b ? ++x : y); // $ SPURIOUS: ast
-  sink(x); // $ ir ast
-
-  x = source();
-  sink((long)x++); // $ ir ast
-  sink(x);
-
-  x = source();
-  sink(b ? (long)x++ : 0); // $ ir ast
-  sink(x); // $ ir ast
 }

cpp/ql/test/library-tests/dataflow/external-models/steps.expected

@@ -3,4 +3,6 @@
 | test.cpp:21:27:21:27 | x | test.cpp:21:10:21:25 | call to ymlStepGenerated |
 | test.cpp:25:35:25:35 | x | test.cpp:25:11:25:33 | call to ymlStepManual_with_body |
 | test.cpp:28:35:28:35 | 0 | test.cpp:28:11:28:33 | call to ymlStepManual_with_body |
+| test.cpp:32:38:32:38 | 0 | test.cpp:32:11:32:36 | call to ymlStepGenerated_with_body |
+| test.cpp:35:38:35:38 | x | test.cpp:35:11:35:36 | call to ymlStepGenerated_with_body |
 | windows.cpp:27:36:27:38 | *cmd | windows.cpp:27:17:27:34 | **call to CommandLineToArgvA |

cpp/ql/test/library-tests/dataflow/ir-barrier-guards/test.cpp

@@ -12,38 +12,4 @@ void testCheckArgument(int p) {
   if (checkArgument(&p)) {
     sink(p); // $ barrier=glval<int> indirect_barrier=int
   }
-}
-
-int* get_clean_value(int* x) { return x; }
-bool is_clean_value(int*);
-
-int* get_clean_pointer(int* x) { return x; }
-bool is_clean_pointer(int*);
-
-void sink(int*);
-
-void test_mad(int x, int* p) {
-	{
-		if(is_clean_value(&x)) {
-			sink(x); // $ external=int
-		}
-	}
-
-	{
-		if(is_clean_value(p)) {
-			sink(*p); // $ external=int
-		}
-	}
-
-	{
-		if(is_clean_pointer(p)) {
-			sink(p); // $ external=int*
-		}
-	}
-
-	{
-		if(is_clean_pointer(&x)) {
-			sink(x); // $ external=glval<int>
-		}
-	}
 }

cpp/ql/test/library-tests/dataflow/ir-barrier-guards/test.ext.yml

@@ -1,13 +0,0 @@
-extensions:
-  - addsTo:
-      pack: codeql/cpp-all
-      extensible: barrierModel
-    data:
-      - ["", "", False, "get_clean_pointer", "", "", "ReturnValue", "test-barrier", "manual"]
-      - ["", "", False, "get_clean_data", "", "", "ReturnValue[*]", "test-barrier", "manual"]
-  - addsTo:
-      pack: codeql/cpp-all
-      extensible: barrierGuardModel
-    data:
-      - ["", "", False, "is_clean_value", "", "", "Argument[*0]", "true", "test-barrier", "manual"]
-      - ["", "", False, "is_clean_pointer", "", "", "Argument[0]", "true", "test-barrier", "manual"]

cpp/ql/test/library-tests/dataflow/ir-barrier-guards/test.ql

@@ -2,7 +2,6 @@ import cpp
 import semmle.code.cpp.dataflow.new.DataFlow
 import semmle.code.cpp.controlflow.IRGuards
 import utils.test.InlineExpectationsTest
-import semmle.code.cpp.dataflow.ExternalFlow
 
 predicate instructionGuardChecks(IRGuardCondition gc, Instruction checked, boolean branch) {
   exists(CallInstruction call |
@@ -28,26 +27,18 @@ predicate barrierGuard(DataFlow::Node node, string s) {
   else s = node.getType().toString().replaceAll(" ", "")
 }
 
-predicate externalBarrierGuard(DataFlow::Node node, string s) {
-  barrierNode(node, "test-barrier") and
-  if node.isGLValue()
-  then s = "glval<" + node.getType().toString().replaceAll(" ", "") + ">"
-  else s = node.getType().toString().replaceAll(" ", "")
-}
-
 module Test implements TestSig {
-  string getARelevantTag() { result = ["barrier", "indirect_barrier", "external"] }
+  string getARelevantTag() { result = ["barrier", "indirect_barrier"] }
 
   predicate hasActualResult(Location location, string element, string tag, string value) {
-    exists(DataFlow::Node node |
-      indirectBarrierGuard(node, value) and
+    exists(DataFlow::Node node, string s |
+      indirectBarrierGuard(node, s) and
+      value = s and
       tag = "indirect_barrier"
       or
-      barrierGuard(node, value) and
+      barrierGuard(node, s) and
+      value = s and
       tag = "barrier"
-      or
-      externalBarrierGuard(node, value) and
-      tag = "external"
     |
       element = node.toString() and
       location = node.getLocation()

cpp/ql/test/library-tests/ir/address_constant_folding/test.c

@@ -1,22 +0,0 @@
-#define NULL ((void*)0)
-
-int global_var;
-
-void test_address_null_comparison(int param_var) {
-    int local_var;
-
-    if (&global_var == NULL) {}  // $ VariableAddress=global_var
-    if (&global_var != NULL) {}  // $ VariableAddress=global_var
-    if (&global_var) {}          // $ VariableAddress=global_var
-    if (!&global_var) {}         // $ VariableAddress=global_var
-
-    if (&local_var == NULL) {}   // $ VariableAddress=local_var
-    if (&local_var != NULL) {}   // $ VariableAddress=local_var
-    if (&local_var) {}           // $ VariableAddress=local_var
-    if (!&local_var) {}          // $ VariableAddress=local_var
-
-    if (&param_var == NULL) {}   // $ VariableAddress=param_var
-    if (&param_var != NULL) {}   // $ VariableAddress=param_var
-    if (&param_var) {}           // $ VariableAddress=param_var
-    if (!&param_var) {}          // $ VariableAddress=param_var
-}

cpp/ql/test/library-tests/ir/address_constant_folding/variable_addresses.ql

@@ -1,20 +0,0 @@
-import cpp
-private import utils.test.InlineExpectationsTest
-private import semmle.code.cpp.ir.IR
-
-module VariableAddressTest implements TestSig {
-  string getARelevantTag() { result = "VariableAddress" }
-
-  predicate hasActualResult(Location location, string element, string tag, string value) {
-    exists(VariableAddressInstruction vai |
-      not vai.getAst() instanceof DeclarationEntry and
-      not vai.getAst() instanceof Parameter and
-      tag = "VariableAddress" and
-      value = vai.getAstVariable().getName() and
-      element = vai.toString() and
-      location = vai.getLocation()
-    )
-  }
-}
-
-import MakeTest<VariableAddressTest>

cpp/ql/test/library-tests/ir/ir/PrintAST.expected

@@ -25131,517 +25131,6 @@ ir.cpp:
 # 2823|                 Type = [ArrayType] int[]
 # 2823|                 ValueCategory = lvalue
 # 2824|     getStmt(5): [ReturnStmt] return ...
-# 2830| [TopLevelFunction] void test_assert_simple(int, int, unsigned int, int)
-# 2830|   <params>: 
-# 2830|     getParameter(0): [Parameter] x
-# 2830|         Type = [IntType] int
-# 2830|     getParameter(1): [Parameter] y
-# 2830|         Type = [IntType] int
-# 2830|     getParameter(2): [Parameter] u
-# 2830|         Type = [IntType] unsigned int
-# 2830|     getParameter(3): [Parameter] shadowed
-# 2830|         Type = [IntType] int
-# 2830|   getEntryPoint(): [BlockStmt] { ... }
-# 2831|     getStmt(0): [ExprStmt] ExprStmt
-# 2831|       getExpr(): [Literal] 0
-# 2831|           Type = [IntType] int
-# 2831|           Value = [Literal] 0
-# 2831|           ValueCategory = prvalue
-# 2831|       getExpr().getFullyConverted(): [ParenthesisExpr] (...)
-# 2831|           Type = [VoidType] void
-# 2831|           ValueCategory = prvalue
-# 2831|         getExpr(): [CStyleCast] (void)...
-# 2831|             Conversion = [VoidConversion] conversion to void
-# 2831|             Type = [VoidType] void
-# 2831|             ValueCategory = prvalue
-# 2832|     getStmt(1): [ExprStmt] ExprStmt
-# 2832|       getExpr(): [Literal] 0
-# 2832|           Type = [IntType] int
-# 2832|           Value = [Literal] 0
-# 2832|           ValueCategory = prvalue
-# 2832|       getExpr().getFullyConverted(): [ParenthesisExpr] (...)
-# 2832|           Type = [VoidType] void
-# 2832|           ValueCategory = prvalue
-# 2832|         getExpr(): [CStyleCast] (void)...
-# 2832|             Conversion = [VoidConversion] conversion to void
-# 2832|             Type = [VoidType] void
-# 2832|             ValueCategory = prvalue
-# 2833|     getStmt(2): [ExprStmt] ExprStmt
-# 2833|       getExpr(): [Literal] 0
-# 2833|           Type = [IntType] int
-# 2833|           Value = [Literal] 0
-# 2833|           ValueCategory = prvalue
-# 2833|       getExpr().getFullyConverted(): [ParenthesisExpr] (...)
-# 2833|           Type = [VoidType] void
-# 2833|           ValueCategory = prvalue
-# 2833|         getExpr(): [CStyleCast] (void)...
-# 2833|             Conversion = [VoidConversion] conversion to void
-# 2833|             Type = [VoidType] void
-# 2833|             ValueCategory = prvalue
-# 2835|     getStmt(3): [EmptyStmt] ;
-# 2837|     getStmt(4): [ExprStmt] ExprStmt
-# 2837|       getExpr(): [Literal] 0
-# 2837|           Type = [IntType] int
-# 2837|           Value = [Literal] 0
-# 2837|           ValueCategory = prvalue
-# 2837|       getExpr().getFullyConverted(): [ParenthesisExpr] (...)
-# 2837|           Type = [VoidType] void
-# 2837|           ValueCategory = prvalue
-# 2837|         getExpr(): [CStyleCast] (void)...
-# 2837|             Conversion = [VoidConversion] conversion to void
-# 2837|             Type = [VoidType] void
-# 2837|             ValueCategory = prvalue
-# 2839|     getStmt(5): [BlockStmt] { ... }
-# 2840|       getStmt(0): [DeclStmt] declaration
-# 2840|         getDeclarationEntry(0): [VariableDeclarationEntry] definition of shadowed
-# 2840|             Type = [IntType] int
-# 2840|           getVariable().getInitializer(): [Initializer] initializer for shadowed
-# 2840|             getExpr(): [VariableAccess] x
-# 2840|                 Type = [IntType] int
-# 2840|                 ValueCategory = prvalue(load)
-# 2841|       getStmt(1): [ExprStmt] ExprStmt
-# 2841|         getExpr(): [Literal] 0
-# 2841|             Type = [IntType] int
-# 2841|             Value = [Literal] 0
-# 2841|             ValueCategory = prvalue
-# 2841|         getExpr().getFullyConverted(): [ParenthesisExpr] (...)
-# 2841|             Type = [VoidType] void
-# 2841|             ValueCategory = prvalue
-# 2841|           getExpr(): [CStyleCast] (void)...
-# 2841|               Conversion = [VoidConversion] conversion to void
-# 2841|               Type = [VoidType] void
-# 2841|               ValueCategory = prvalue
-# 2843|     getStmt(6): [ReturnStmt] return ...
-# 2846| [TemplateFunction,TopLevelFunction] void test_assert_in_template<T>(T, int, unsigned int)
-# 2846|   <params>: 
-# 2846|     getParameter(0): [Parameter] x
-# 2846|         Type = [TypeTemplateParameter] T
-# 2846|     getParameter(1): [Parameter] y
-# 2846|         Type = [IntType] int
-# 2846|     getParameter(2): [Parameter] u
-# 2846|         Type = [IntType] unsigned int
-# 2846|   getEntryPoint(): [BlockStmt] { ... }
-# 2847|     getStmt(0): [ExprStmt] ExprStmt
-# 2847|       getExpr(): [Literal] 0
-# 2847|           Type = [IntType] int
-# 2847|           Value = [Literal] 0
-# 2847|           ValueCategory = prvalue
-# 2847|       getExpr().getFullyConverted(): [ParenthesisExpr] (...)
-# 2847|           Type = [VoidType] void
-# 2847|           ValueCategory = prvalue
-# 2847|         getExpr(): [CStyleCast] (void)...
-# 2847|             Conversion = [VoidConversion] conversion to void
-# 2847|             Type = [VoidType] void
-# 2847|             ValueCategory = prvalue
-# 2848|     getStmt(1): [ExprStmt] ExprStmt
-# 2848|       getExpr(): [Literal] 0
-# 2848|           Type = [IntType] int
-# 2848|           Value = [Literal] 0
-# 2848|           ValueCategory = prvalue
-# 2848|       getExpr().getFullyConverted(): [ParenthesisExpr] (...)
-# 2848|           Type = [VoidType] void
-# 2848|           ValueCategory = prvalue
-# 2848|         getExpr(): [CStyleCast] (void)...
-# 2848|             Conversion = [VoidConversion] conversion to void
-# 2848|             Type = [VoidType] void
-# 2848|             ValueCategory = prvalue
-# 2849|     getStmt(2): [ExprStmt] ExprStmt
-# 2849|       getExpr(): [Literal] 0
-# 2849|           Type = [IntType] int
-# 2849|           Value = [Literal] 0
-# 2849|           ValueCategory = prvalue
-# 2849|       getExpr().getFullyConverted(): [ParenthesisExpr] (...)
-# 2849|           Type = [VoidType] void
-# 2849|           ValueCategory = prvalue
-# 2849|         getExpr(): [CStyleCast] (void)...
-# 2849|             Conversion = [VoidConversion] conversion to void
-# 2849|             Type = [VoidType] void
-# 2849|             ValueCategory = prvalue
-# 2851|     getStmt(3): [EmptyStmt] ;
-# 2853|     getStmt(4): [ExprStmt] ExprStmt
-# 2853|       getExpr(): [Literal] 0
-# 2853|           Type = [IntType] int
-# 2853|           Value = [Literal] 0
-# 2853|           ValueCategory = prvalue
-# 2853|       getExpr().getFullyConverted(): [ParenthesisExpr] (...)
-# 2853|           Type = [VoidType] void
-# 2853|           ValueCategory = prvalue
-# 2853|         getExpr(): [CStyleCast] (void)...
-# 2853|             Conversion = [VoidConversion] conversion to void
-# 2853|             Type = [VoidType] void
-# 2853|             ValueCategory = prvalue
-# 2855|     getStmt(5): [BlockStmt] { ... }
-# 2856|       getStmt(0): [DeclStmt] declaration
-# 2856|         getDeclarationEntry(0): [VariableDeclarationEntry] definition of shadowed
-# 2856|             Type = [IntType] int
-# 2856|           getVariable().getInitializer(): [Initializer] initializer for shadowed
-# 2856|             getExpr(): [VariableAccess] x
-# 2856|                 Type = [TypeTemplateParameter] T
-# 2856|                 ValueCategory = lvalue
-# 2856|             getExpr().getFullyConverted(): [CStyleCast] (int)...
-# 2856|                 Type = [IntType] int
-# 2856|                 ValueCategory = prvalue
-# 2857|       getStmt(1): [ExprStmt] ExprStmt
-# 2857|         getExpr(): [Literal] 0
-# 2857|             Type = [IntType] int
-# 2857|             Value = [Literal] 0
-# 2857|             ValueCategory = prvalue
-# 2857|         getExpr().getFullyConverted(): [ParenthesisExpr] (...)
-# 2857|             Type = [VoidType] void
-# 2857|             ValueCategory = prvalue
-# 2857|           getExpr(): [CStyleCast] (void)...
-# 2857|               Conversion = [VoidConversion] conversion to void
-# 2857|               Type = [VoidType] void
-# 2857|               ValueCategory = prvalue
-# 2859|     getStmt(6): [ExprStmt] ExprStmt
-# 2859|       getExpr(): [Literal] 0
-# 2859|           Type = [IntType] int
-# 2859|           Value = [Literal] 0
-# 2859|           ValueCategory = prvalue
-# 2859|       getExpr().getFullyConverted(): [ParenthesisExpr] (...)
-# 2859|           Type = [VoidType] void
-# 2859|           ValueCategory = prvalue
-# 2859|         getExpr(): [CStyleCast] (void)...
-# 2859|             Conversion = [VoidConversion] conversion to void
-# 2859|             Type = [VoidType] void
-# 2859|             ValueCategory = prvalue
-# 2860|     getStmt(7): [ReturnStmt] return ...
-# 2846| [FunctionTemplateInstantiation,TopLevelFunction] void test_assert_in_template<int>(int, int, unsigned int)
-# 2846|   <params>: 
-# 2846|     getParameter(0): [Parameter] x
-# 2846|         Type = [IntType] int
-# 2846|     getParameter(1): [Parameter] y
-# 2846|         Type = [IntType] int
-# 2846|     getParameter(2): [Parameter] u
-# 2846|         Type = [IntType] unsigned int
-# 2846|   getEntryPoint(): [BlockStmt] { ... }
-# 2847|     getStmt(0): [ExprStmt] ExprStmt
-# 2847|       getExpr(): [Literal] 0
-# 2847|           Type = [IntType] int
-# 2847|           Value = [Literal] 0
-# 2847|           ValueCategory = prvalue
-# 2847|       getExpr().getFullyConverted(): [ParenthesisExpr] (...)
-# 2847|           Type = [VoidType] void
-# 2847|           ValueCategory = prvalue
-# 2847|         getExpr(): [CStyleCast] (void)...
-# 2847|             Conversion = [VoidConversion] conversion to void
-# 2847|             Type = [VoidType] void
-# 2847|             ValueCategory = prvalue
-# 2848|     getStmt(1): [ExprStmt] ExprStmt
-# 2848|       getExpr(): [Literal] 0
-# 2848|           Type = [IntType] int
-# 2848|           Value = [Literal] 0
-# 2848|           ValueCategory = prvalue
-# 2848|       getExpr().getFullyConverted(): [ParenthesisExpr] (...)
-# 2848|           Type = [VoidType] void
-# 2848|           ValueCategory = prvalue
-# 2848|         getExpr(): [CStyleCast] (void)...
-# 2848|             Conversion = [VoidConversion] conversion to void
-# 2848|             Type = [VoidType] void
-# 2848|             ValueCategory = prvalue
-# 2849|     getStmt(2): [ExprStmt] ExprStmt
-# 2849|       getExpr(): [Literal] 0
-# 2849|           Type = [IntType] int
-# 2849|           Value = [Literal] 0
-# 2849|           ValueCategory = prvalue
-# 2849|       getExpr().getFullyConverted(): [ParenthesisExpr] (...)
-# 2849|           Type = [VoidType] void
-# 2849|           ValueCategory = prvalue
-# 2849|         getExpr(): [CStyleCast] (void)...
-# 2849|             Conversion = [VoidConversion] conversion to void
-# 2849|             Type = [VoidType] void
-# 2849|             ValueCategory = prvalue
-# 2851|     getStmt(3): [EmptyStmt] ;
-# 2853|     getStmt(4): [ExprStmt] ExprStmt
-# 2853|       getExpr(): [Literal] 0
-# 2853|           Type = [IntType] int
-# 2853|           Value = [Literal] 0
-# 2853|           ValueCategory = prvalue
-# 2853|       getExpr().getFullyConverted(): [ParenthesisExpr] (...)
-# 2853|           Type = [VoidType] void
-# 2853|           ValueCategory = prvalue
-# 2853|         getExpr(): [CStyleCast] (void)...
-# 2853|             Conversion = [VoidConversion] conversion to void
-# 2853|             Type = [VoidType] void
-# 2853|             ValueCategory = prvalue
-# 2855|     getStmt(5): [BlockStmt] { ... }
-# 2856|       getStmt(0): [DeclStmt] declaration
-# 2856|         getDeclarationEntry(0): [VariableDeclarationEntry] definition of shadowed
-# 2856|             Type = [IntType] int
-# 2856|           getVariable().getInitializer(): [Initializer] initializer for shadowed
-# 2856|             getExpr(): [VariableAccess] x
-# 2856|                 Type = [IntType] int
-# 2856|                 ValueCategory = prvalue(load)
-# 2857|       getStmt(1): [ExprStmt] ExprStmt
-# 2857|         getExpr(): [Literal] 0
-# 2857|             Type = [IntType] int
-# 2857|             Value = [Literal] 0
-# 2857|             ValueCategory = prvalue
-# 2857|         getExpr().getFullyConverted(): [ParenthesisExpr] (...)
-# 2857|             Type = [VoidType] void
-# 2857|             ValueCategory = prvalue
-# 2857|           getExpr(): [CStyleCast] (void)...
-# 2857|               Conversion = [VoidConversion] conversion to void
-# 2857|               Type = [VoidType] void
-# 2857|               ValueCategory = prvalue
-# 2859|     getStmt(6): [ExprStmt] ExprStmt
-# 2859|       getExpr(): [Literal] 0
-# 2859|           Type = [IntType] int
-# 2859|           Value = [Literal] 0
-# 2859|           ValueCategory = prvalue
-# 2859|       getExpr().getFullyConverted(): [ParenthesisExpr] (...)
-# 2859|           Type = [VoidType] void
-# 2859|           ValueCategory = prvalue
-# 2859|         getExpr(): [CStyleCast] (void)...
-# 2859|             Conversion = [VoidConversion] conversion to void
-# 2859|             Type = [VoidType] void
-# 2859|             ValueCategory = prvalue
-# 2860|     getStmt(7): [ReturnStmt] return ...
-# 2846| [FunctionTemplateInstantiation,TopLevelFunction] void test_assert_in_template<short>(short, int, unsigned int)
-# 2846|   <params>: 
-# 2846|     getParameter(0): [Parameter] x
-# 2846|         Type = [ShortType] short
-# 2846|     getParameter(1): [Parameter] y
-# 2846|         Type = [IntType] int
-# 2846|     getParameter(2): [Parameter] u
-# 2846|         Type = [IntType] unsigned int
-# 2846|   getEntryPoint(): [BlockStmt] { ... }
-# 2847|     getStmt(0): [ExprStmt] ExprStmt
-# 2847|       getExpr(): [Literal] 0
-# 2847|           Type = [IntType] int
-# 2847|           Value = [Literal] 0
-# 2847|           ValueCategory = prvalue
-# 2847|       getExpr().getFullyConverted(): [ParenthesisExpr] (...)
-# 2847|           Type = [VoidType] void
-# 2847|           ValueCategory = prvalue
-# 2847|         getExpr(): [CStyleCast] (void)...
-# 2847|             Conversion = [VoidConversion] conversion to void
-# 2847|             Type = [VoidType] void
-# 2847|             ValueCategory = prvalue
-# 2848|     getStmt(1): [ExprStmt] ExprStmt
-# 2848|       getExpr(): [Literal] 0
-# 2848|           Type = [IntType] int
-# 2848|           Value = [Literal] 0
-# 2848|           ValueCategory = prvalue
-# 2848|       getExpr().getFullyConverted(): [ParenthesisExpr] (...)
-# 2848|           Type = [VoidType] void
-# 2848|           ValueCategory = prvalue
-# 2848|         getExpr(): [CStyleCast] (void)...
-# 2848|             Conversion = [VoidConversion] conversion to void
-# 2848|             Type = [VoidType] void
-# 2848|             ValueCategory = prvalue
-# 2849|     getStmt(2): [ExprStmt] ExprStmt
-# 2849|       getExpr(): [Literal] 0
-# 2849|           Type = [IntType] int
-# 2849|           Value = [Literal] 0
-# 2849|           ValueCategory = prvalue
-# 2849|       getExpr().getFullyConverted(): [ParenthesisExpr] (...)
-# 2849|           Type = [VoidType] void
-# 2849|           ValueCategory = prvalue
-# 2849|         getExpr(): [CStyleCast] (void)...
-# 2849|             Conversion = [VoidConversion] conversion to void
-# 2849|             Type = [VoidType] void
-# 2849|             ValueCategory = prvalue
-# 2851|     getStmt(3): [EmptyStmt] ;
-# 2853|     getStmt(4): [ExprStmt] ExprStmt
-# 2853|       getExpr(): [Literal] 0
-# 2853|           Type = [IntType] int
-# 2853|           Value = [Literal] 0
-# 2853|           ValueCategory = prvalue
-# 2853|       getExpr().getFullyConverted(): [ParenthesisExpr] (...)
-# 2853|           Type = [VoidType] void
-# 2853|           ValueCategory = prvalue
-# 2853|         getExpr(): [CStyleCast] (void)...
-# 2853|             Conversion = [VoidConversion] conversion to void
-# 2853|             Type = [VoidType] void
-# 2853|             ValueCategory = prvalue
-# 2855|     getStmt(5): [BlockStmt] { ... }
-# 2856|       getStmt(0): [DeclStmt] declaration
-# 2856|         getDeclarationEntry(0): [VariableDeclarationEntry] definition of shadowed
-# 2856|             Type = [IntType] int
-# 2856|           getVariable().getInitializer(): [Initializer] initializer for shadowed
-# 2856|             getExpr(): [VariableAccess] x
-# 2856|                 Type = [ShortType] short
-# 2856|                 ValueCategory = prvalue(load)
-# 2856|             getExpr().getFullyConverted(): [CStyleCast] (int)...
-# 2856|                 Conversion = [IntegralConversion] integral conversion
-# 2856|                 Type = [IntType] int
-# 2856|                 ValueCategory = prvalue
-# 2857|       getStmt(1): [ExprStmt] ExprStmt
-# 2857|         getExpr(): [Literal] 0
-# 2857|             Type = [IntType] int
-# 2857|             Value = [Literal] 0
-# 2857|             ValueCategory = prvalue
-# 2857|         getExpr().getFullyConverted(): [ParenthesisExpr] (...)
-# 2857|             Type = [VoidType] void
-# 2857|             ValueCategory = prvalue
-# 2857|           getExpr(): [CStyleCast] (void)...
-# 2857|               Conversion = [VoidConversion] conversion to void
-# 2857|               Type = [VoidType] void
-# 2857|               ValueCategory = prvalue
-# 2859|     getStmt(6): [ExprStmt] ExprStmt
-# 2859|       getExpr(): [Literal] 0
-# 2859|           Type = [IntType] int
-# 2859|           Value = [Literal] 0
-# 2859|           ValueCategory = prvalue
-# 2859|       getExpr().getFullyConverted(): [ParenthesisExpr] (...)
-# 2859|           Type = [VoidType] void
-# 2859|           ValueCategory = prvalue
-# 2859|         getExpr(): [CStyleCast] (void)...
-# 2859|             Conversion = [VoidConversion] conversion to void
-# 2859|             Type = [VoidType] void
-# 2859|             ValueCategory = prvalue
-# 2860|     getStmt(7): [ReturnStmt] return ...
-# 2867| [TopLevelFunction] void (unnamed namespace)::complex_assertions(int, bool, int)
-# 2867|   <params>: 
-# 2867|     getParameter(0): [Parameter] x
-# 2867|         Type = [IntType] int
-# 2867|     getParameter(1): [Parameter] b
-# 2867|         Type = [BoolType] bool
-# 2867|     getParameter(2): [Parameter] max
-# 2867|         Type = [IntType] int
-# 2867|   getEntryPoint(): [BlockStmt] { ... }
-# 2868|     getStmt(0): [DeclStmt] declaration
-# 2868|       getDeclarationEntry(0): [VariableDeclarationEntry] definition of y
-# 2868|           Type = [IntType] int
-# 2868|         getVariable().getInitializer(): [Initializer] initializer for y
-# 2868|           getExpr(): [CommaExpr] ... , ...
-# 2868|               Type = [IntType] int
-# 2868|               ValueCategory = prvalue(load)
-# 2868|             getLeftOperand(): [Literal] 0
-# 2868|                 Type = [IntType] int
-# 2868|                 Value = [Literal] 0
-# 2868|                 ValueCategory = prvalue
-# 2868|             getRightOperand(): [VariableAccess] x
-# 2868|                 Type = [IntType] int
-# 2868|                 ValueCategory = prvalue(load)
-# 2868|             getLeftOperand().getFullyConverted(): [ParenthesisExpr] (...)
-# 2868|                 Type = [VoidType] void
-# 2868|                 ValueCategory = prvalue
-# 2868|               getExpr(): [CStyleCast] (void)...
-# 2868|                   Conversion = [VoidConversion] conversion to void
-# 2868|                   Type = [VoidType] void
-# 2868|                   ValueCategory = prvalue
-# 2868|           getExpr().getFullyConverted(): [ParenthesisExpr] (...)
-# 2868|               Type = [IntType] int
-# 2868|               ValueCategory = prvalue(load)
-# 2869|     getStmt(1): [DeclStmt] declaration
-# 2869|       getDeclarationEntry(0): [VariableDeclarationEntry] definition of z
-# 2869|           Type = [IntType] int
-# 2869|         getVariable().getInitializer(): [Initializer] initializer for z
-# 2869|           getExpr(): [ConditionalExpr] ... ? ... : ...
-# 2869|               Type = [IntType] int
-# 2869|               ValueCategory = prvalue
-# 2869|             getCondition(): [VariableAccess] b
-# 2869|                 Type = [BoolType] bool
-# 2869|                 ValueCategory = prvalue(load)
-# 2869|             getThen(): [CommaExpr] ... , ...
-# 2869|                 Type = [IntType] int
-# 2869|                 Value = [CommaExpr] 0
-# 2869|                 ValueCategory = prvalue
-# 2869|               getLeftOperand(): [Literal] 0
-# 2869|                   Type = [IntType] int
-# 2869|                   Value = [Literal] 0
-# 2869|                   ValueCategory = prvalue
-# 2869|               getRightOperand(): [Literal] 0
-# 2869|                   Type = [IntType] int
-# 2869|                   Value = [Literal] 0
-# 2869|                   ValueCategory = prvalue
-# 2869|               getLeftOperand().getFullyConverted(): [ParenthesisExpr] (...)
-# 2869|                   Type = [VoidType] void
-# 2869|                   ValueCategory = prvalue
-# 2869|                 getExpr(): [CStyleCast] (void)...
-# 2869|                     Conversion = [VoidConversion] conversion to void
-# 2869|                     Type = [VoidType] void
-# 2869|                     ValueCategory = prvalue
-# 2869|             getElse(): [Literal] 1
-# 2869|                 Type = [IntType] int
-# 2869|                 Value = [Literal] 1
-# 2869|                 ValueCategory = prvalue
-# 2869|             getThen().getFullyConverted(): [ParenthesisExpr] (...)
-# 2869|                 Type = [IntType] int
-# 2869|                 Value = [ParenthesisExpr] 0
-# 2869|                 ValueCategory = prvalue
-# 2871|     getStmt(2): [TryStmt] try { ... }
-# 2871|       getStmt(): [BlockStmt] { ... }
-# 2872|         getStmt(0): [ExprStmt] ExprStmt
-# 2872|           getExpr(): [ThrowExpr] throw ...
-# 2872|               Type = [IntType] int
-# 2872|               ValueCategory = prvalue
-# 2872|             getExpr(): [Literal] 41
-# 2872|                 Type = [IntType] int
-# 2872|                 Value = [Literal] 41
-# 2872|                 ValueCategory = prvalue
-# 2873|       getChild(1): [Handler] <handler>
-# 2873|         getParameter(): [Parameter] c
-# 2873|             Type = [IntType] int
-# 2873|         getBlock(): [CatchBlock] { ... }
-# 2874|           getStmt(0): [ExprStmt] ExprStmt
-# 2874|             getExpr(): [Literal] 0
-# 2874|                 Type = [IntType] int
-# 2874|                 Value = [Literal] 0
-# 2874|                 ValueCategory = prvalue
-# 2874|             getExpr().getFullyConverted(): [ParenthesisExpr] (...)
-# 2874|                 Type = [VoidType] void
-# 2874|                 ValueCategory = prvalue
-# 2874|               getExpr(): [CStyleCast] (void)...
-# 2874|                   Conversion = [VoidConversion] conversion to void
-# 2874|                   Type = [VoidType] void
-# 2874|                   ValueCategory = prvalue
-# 2875|           getStmt(1): [ExprStmt] ExprStmt
-# 2875|             getExpr(): [Literal] 0
-# 2875|                 Type = [IntType] int
-# 2875|                 Value = [Literal] 0
-# 2875|                 ValueCategory = prvalue
-# 2875|             getExpr().getFullyConverted(): [ParenthesisExpr] (...)
-# 2875|                 Type = [VoidType] void
-# 2875|                 ValueCategory = prvalue
-# 2875|               getExpr(): [CStyleCast] (void)...
-# 2875|                   Conversion = [VoidConversion] conversion to void
-# 2875|                   Type = [VoidType] void
-# 2875|                   ValueCategory = prvalue
-# 2878|     getStmt(3): [ExprStmt] ExprStmt
-# 2878|       getExpr(): [Literal] 0
-# 2878|           Type = [IntType] int
-# 2878|           Value = [Literal] 0
-# 2878|           ValueCategory = prvalue
-# 2878|       getExpr().getFullyConverted(): [ParenthesisExpr] (...)
-# 2878|           Type = [VoidType] void
-# 2878|           ValueCategory = prvalue
-# 2878|         getExpr(): [CStyleCast] (void)...
-# 2878|             Conversion = [VoidConversion] conversion to void
-# 2878|             Type = [VoidType] void
-# 2878|             ValueCategory = prvalue
-# 2879|     getStmt(4): [DeclStmt] declaration
-# 2879|       getDeclarationEntry(0): [VariableDeclarationEntry] definition of shadowed
-# 2879|           Type = [IntType] int
-# 2881|     getStmt(5): [TryStmt] try { ... }
-# 2881|       getStmt(): [BlockStmt] { ... }
-# 2882|         getStmt(0): [ExprStmt] ExprStmt
-# 2882|           getExpr(): [ThrowExpr] throw ...
-# 2882|               Type = [IntType] int
-# 2882|               ValueCategory = prvalue
-# 2882|             getExpr(): [Literal] 41
-# 2882|                 Type = [IntType] int
-# 2882|                 Value = [Literal] 41
-# 2882|                 ValueCategory = prvalue
-# 2883|       getChild(1): [Handler] <handler>
-# 2883|         getParameter(): [Parameter] shadowed
-# 2883|             Type = [IntType] int
-# 2883|         getBlock(): [CatchBlock] { ... }
-# 2884|           getStmt(0): [ExprStmt] ExprStmt
-# 2884|             getExpr(): [Literal] 0
-# 2884|                 Type = [IntType] int
-# 2884|                 Value = [Literal] 0
-# 2884|                 ValueCategory = prvalue
-# 2884|             getExpr().getFullyConverted(): [ParenthesisExpr] (...)
-# 2884|                 Type = [VoidType] void
-# 2884|                 ValueCategory = prvalue
-# 2884|               getExpr(): [CStyleCast] (void)...
-# 2884|                   Conversion = [VoidConversion] conversion to void
-# 2884|                   Type = [VoidType] void
-# 2884|                   ValueCategory = prvalue
-# 2886|     getStmt(6): [ReturnStmt] return ...
 ir23.cpp:
 #    1| [TopLevelFunction] bool consteval_1()
 #    1|   <params>: 

cpp/ql/test/library-tests/ir/ir/aliased_ir.expected

@@ -20741,331 +20741,6 @@ ir.cpp:
 # 2821|     v2821_10(void)                = AliasedUse                : m2821_3
 # 2821|     v2821_11(void)                = ExitFunction              : 
 
-# 2830| void test_assert_simple(int, int, unsigned int, int)
-# 2830|   Block 0
-# 2830|     v2830_1(void)                = EnterFunction                 : 
-# 2830|     m2830_2(unknown)             = AliasedDefinition             : 
-# 2830|     m2830_3(unknown)             = InitializeNonLocal            : 
-# 2830|     m2830_4(unknown)             = Chi                           : total:m2830_2, partial:m2830_3
-# 2830|     r2830_5(glval<int>)          = VariableAddress[x]            : 
-# 2830|     m2830_6(int)                 = InitializeParameter[x]        : &:r2830_5
-# 2830|     r2830_7(glval<int>)          = VariableAddress[y]            : 
-# 2830|     m2830_8(int)                 = InitializeParameter[y]        : &:r2830_7
-# 2830|     r2830_9(glval<unsigned int>) = VariableAddress[u]            : 
-# 2830|     m2830_10(unsigned int)       = InitializeParameter[u]        : &:r2830_9
-# 2830|     r2830_11(glval<int>)         = VariableAddress[shadowed]     : 
-# 2830|     m2830_12(int)                = InitializeParameter[shadowed] : &:r2830_11
-# 2831|     r2831_1(glval<int>)          = VariableAddress[x]            : 
-# 2831|     r2831_2(int)                 = Load[x]                       : &:r2831_1, m2830_6
-# 2831|     r2831_3(int)                 = Constant[0]                   : 
-# 2831|     r2831_4(bool)                = CompareGT                     : r2831_2, r2831_3
-# 2831|     v2831_5(void)                = ConditionalBranch             : r2831_4
-#-----|   True -> Block 1
-
-# 2832|   Block 1
-# 2832|     r2832_1(int)        = Constant[0]        : 
-# 2832|     r2832_2(glval<int>) = VariableAddress[x] : 
-# 2832|     r2832_3(int)        = Load[x]            : &:r2832_2, m2830_6
-# 2832|     r2832_4(bool)       = CompareLT          : r2832_1, r2832_3
-# 2832|     v2832_5(void)       = ConditionalBranch  : r2832_4
-#-----|   True -> Block 2
-
-# 2833|   Block 2
-# 2833|     r2833_1(glval<int>) = VariableAddress[x] : 
-# 2833|     r2833_2(int)        = Load[x]            : &:r2833_1, m2830_6
-# 2833|     r2833_3(glval<int>) = VariableAddress[y] : 
-# 2833|     r2833_4(int)        = Load[y]            : &:r2833_3, m2830_8
-# 2833|     r2833_5(bool)       = CompareLT          : r2833_2, r2833_4
-# 2833|     v2833_6(void)       = ConditionalBranch  : r2833_5
-#-----|   True -> Block 3
-
-# 2835|   Block 3
-# 2835|     r2835_1(glval<int>) = VariableAddress[x] : 
-# 2835|     r2835_2(int)        = Load[x]            : &:r2835_1, m2830_6
-# 2835|     r2835_3(int)        = Constant[2]        : 
-# 2835|     r2835_4(bool)       = CompareNE          : r2835_2, r2835_3
-# 2835|     v2835_5(void)       = ConditionalBranch  : r2835_4
-#-----|   True -> Block 4
-
-# 2837|   Block 4
-# 2837|     r2837_1(glval<unsigned int>) = VariableAddress[u] : 
-# 2837|     r2837_2(unsigned int)        = Load[u]            : &:r2837_1, m2830_10
-# 2837|     r2837_3(glval<int>)          = VariableAddress[x] : 
-# 2837|     r2837_4(int)                 = Load[x]            : &:r2837_3, m2830_6
-# 2837|     r2837_5(bool)                = CompareLT          : r2837_2, r2837_4
-# 2837|     v2837_6(void)                = ConditionalBranch  : r2837_5
-#-----|   True -> Block 5
-
-# 2840|   Block 5
-# 2840|     r2840_1(glval<int>) = VariableAddress[shadowed] : 
-# 2840|     r2840_2(glval<int>) = VariableAddress[x]        : 
-# 2840|     r2840_3(int)        = Load[x]                   : &:r2840_2, m2830_6
-# 2840|     m2840_4(int)        = Store[shadowed]           : &:r2840_1, r2840_3
-# 2841|     r2841_1(int)        = Constant[0]               : 
-# 2841|     v2841_2(void)       = Convert                   : r2841_1
-# 2843|     v2843_1(void)       = NoOp                      : 
-# 2830|     v2830_13(void)      = ReturnVoid                : 
-# 2830|     v2830_14(void)      = AliasedUse                : m2830_3
-# 2830|     v2830_15(void)      = ExitFunction              : 
-
-# 2846| void test_assert_in_template<int>(int, int, unsigned int)
-# 2846|   Block 0
-# 2846|     v2846_1(void)                = EnterFunction          : 
-# 2846|     m2846_2(unknown)             = AliasedDefinition      : 
-# 2846|     m2846_3(unknown)             = InitializeNonLocal     : 
-# 2846|     m2846_4(unknown)             = Chi                    : total:m2846_2, partial:m2846_3
-# 2846|     r2846_5(glval<int>)          = VariableAddress[x]     : 
-# 2846|     m2846_6(int)                 = InitializeParameter[x] : &:r2846_5
-# 2846|     r2846_7(glval<int>)          = VariableAddress[y]     : 
-# 2846|     m2846_8(int)                 = InitializeParameter[y] : &:r2846_7
-# 2846|     r2846_9(glval<unsigned int>) = VariableAddress[u]     : 
-# 2846|     m2846_10(unsigned int)       = InitializeParameter[u] : &:r2846_9
-# 2847|     r2847_1(glval<int>)          = VariableAddress[x]     : 
-# 2847|     r2847_2(int)                 = Load[x]                : &:r2847_1, m2846_6
-# 2847|     r2847_3(int)                 = Constant[0]            : 
-# 2847|     r2847_4(bool)                = CompareGT              : r2847_2, r2847_3
-# 2847|     v2847_5(void)                = ConditionalBranch      : r2847_4
-#-----|   True -> Block 1
-
-# 2848|   Block 1
-# 2848|     r2848_1(int)        = Constant[0]        : 
-# 2848|     r2848_2(glval<int>) = VariableAddress[x] : 
-# 2848|     r2848_3(int)        = Load[x]            : &:r2848_2, m2846_6
-# 2848|     r2848_4(bool)       = CompareLT          : r2848_1, r2848_3
-# 2848|     v2848_5(void)       = ConditionalBranch  : r2848_4
-#-----|   True -> Block 2
-
-# 2849|   Block 2
-# 2849|     r2849_1(glval<int>) = VariableAddress[x] : 
-# 2849|     r2849_2(int)        = Load[x]            : &:r2849_1, m2846_6
-# 2849|     r2849_3(glval<int>) = VariableAddress[y] : 
-# 2849|     r2849_4(int)        = Load[y]            : &:r2849_3, m2846_8
-# 2849|     r2849_5(bool)       = CompareLT          : r2849_2, r2849_4
-# 2849|     v2849_6(void)       = ConditionalBranch  : r2849_5
-#-----|   True -> Block 3
-
-# 2851|   Block 3
-# 2851|     r2851_1(glval<int>) = VariableAddress[x] : 
-# 2851|     r2851_2(int)        = Load[x]            : &:r2851_1, m2846_6
-# 2851|     r2851_3(int)        = Constant[2]        : 
-# 2851|     r2851_4(bool)       = CompareNE          : r2851_2, r2851_3
-# 2851|     v2851_5(void)       = ConditionalBranch  : r2851_4
-#-----|   True -> Block 4
-
-# 2853|   Block 4
-# 2853|     r2853_1(glval<unsigned int>) = VariableAddress[u] : 
-# 2853|     r2853_2(unsigned int)        = Load[u]            : &:r2853_1, m2846_10
-# 2853|     r2853_3(glval<int>)          = VariableAddress[x] : 
-# 2853|     r2853_4(int)                 = Load[x]            : &:r2853_3, m2846_6
-# 2853|     r2853_5(bool)                = CompareLT          : r2853_2, r2853_4
-# 2853|     v2853_6(void)                = ConditionalBranch  : r2853_5
-#-----|   True -> Block 5
-
-# 2856|   Block 5
-# 2856|     r2856_1(glval<int>) = VariableAddress[shadowed] : 
-# 2856|     r2856_2(glval<int>) = VariableAddress[x]        : 
-# 2856|     r2856_3(int)        = Load[x]                   : &:r2856_2, m2846_6
-# 2856|     m2856_4(int)        = Store[shadowed]           : &:r2856_1, r2856_3
-# 2857|     r2857_1(glval<int>) = VariableAddress[shadowed] : 
-# 2857|     r2857_2(int)        = Load[shadowed]            : &:r2857_1, m2856_4
-# 2857|     r2857_3(int)        = Constant[0]               : 
-# 2857|     r2857_4(bool)       = CompareGT                 : r2857_2, r2857_3
-# 2857|     v2857_5(void)       = ConditionalBranch         : r2857_4
-#-----|   True -> Block 6
-
-# 2859|   Block 6
-# 2859|     r2859_1(glval<int>) = VariableAddress[x] : 
-# 2859|     r2859_2(int)        = Load[x]            : &:r2859_1, m2846_6
-# 2859|     r2859_3(int)        = Constant[0]        : 
-# 2859|     r2859_4(bool)       = CompareGT          : r2859_2, r2859_3
-# 2859|     v2859_5(void)       = ConditionalBranch  : r2859_4
-#-----|   True -> Block 7
-
-# 2860|   Block 7
-# 2860|     v2860_1(void)  = NoOp         : 
-# 2846|     v2846_11(void) = ReturnVoid   : 
-# 2846|     v2846_12(void) = AliasedUse   : m2846_3
-# 2846|     v2846_13(void) = ExitFunction : 
-
-# 2846| void test_assert_in_template<short>(short, int, unsigned int)
-# 2846|   Block 0
-# 2846|     v2846_1(void)                = EnterFunction          : 
-# 2846|     m2846_2(unknown)             = AliasedDefinition      : 
-# 2846|     m2846_3(unknown)             = InitializeNonLocal     : 
-# 2846|     m2846_4(unknown)             = Chi                    : total:m2846_2, partial:m2846_3
-# 2846|     r2846_5(glval<short>)        = VariableAddress[x]     : 
-# 2846|     m2846_6(short)               = InitializeParameter[x] : &:r2846_5
-# 2846|     r2846_7(glval<int>)          = VariableAddress[y]     : 
-# 2846|     m2846_8(int)                 = InitializeParameter[y] : &:r2846_7
-# 2846|     r2846_9(glval<unsigned int>) = VariableAddress[u]     : 
-# 2846|     m2846_10(unsigned int)       = InitializeParameter[u] : &:r2846_9
-# 2847|     r2847_1(glval<short>)        = VariableAddress[x]     : 
-# 2847|     r2847_2(short)               = Load[x]                : &:r2847_1, m2846_6
-# 2847|     r2847_3(int)                 = Constant[0]            : 
-# 2847|     r2847_4(bool)                = CompareGT              : r2847_2, r2847_3
-# 2847|     v2847_5(void)                = ConditionalBranch      : r2847_4
-#-----|   True -> Block 1
-
-# 2848|   Block 1
-# 2848|     r2848_1(int)          = Constant[0]        : 
-# 2848|     r2848_2(glval<short>) = VariableAddress[x] : 
-# 2848|     r2848_3(short)        = Load[x]            : &:r2848_2, m2846_6
-# 2848|     r2848_4(bool)         = CompareLT          : r2848_1, r2848_3
-# 2848|     v2848_5(void)         = ConditionalBranch  : r2848_4
-#-----|   True -> Block 2
-
-# 2849|   Block 2
-# 2849|     r2849_1(glval<short>) = VariableAddress[x] : 
-# 2849|     r2849_2(short)        = Load[x]            : &:r2849_1, m2846_6
-# 2849|     r2849_3(glval<int>)   = VariableAddress[y] : 
-# 2849|     r2849_4(int)          = Load[y]            : &:r2849_3, m2846_8
-# 2849|     r2849_5(bool)         = CompareLT          : r2849_2, r2849_4
-# 2849|     v2849_6(void)         = ConditionalBranch  : r2849_5
-#-----|   True -> Block 3
-
-# 2851|   Block 3
-# 2851|     r2851_1(glval<short>) = VariableAddress[x] : 
-# 2851|     r2851_2(short)        = Load[x]            : &:r2851_1, m2846_6
-# 2851|     r2851_3(int)          = Constant[2]        : 
-# 2851|     r2851_4(bool)         = CompareNE          : r2851_2, r2851_3
-# 2851|     v2851_5(void)         = ConditionalBranch  : r2851_4
-#-----|   True -> Block 4
-
-# 2853|   Block 4
-# 2853|     r2853_1(glval<unsigned int>) = VariableAddress[u] : 
-# 2853|     r2853_2(unsigned int)        = Load[u]            : &:r2853_1, m2846_10
-# 2853|     r2853_3(glval<short>)        = VariableAddress[x] : 
-# 2853|     r2853_4(short)               = Load[x]            : &:r2853_3, m2846_6
-# 2853|     r2853_5(bool)                = CompareLT          : r2853_2, r2853_4
-# 2853|     v2853_6(void)                = ConditionalBranch  : r2853_5
-#-----|   True -> Block 5
-
-# 2856|   Block 5
-# 2856|     r2856_1(glval<int>)   = VariableAddress[shadowed] : 
-# 2856|     r2856_2(glval<short>) = VariableAddress[x]        : 
-# 2856|     r2856_3(short)        = Load[x]                   : &:r2856_2, m2846_6
-# 2856|     r2856_4(int)          = Convert                   : r2856_3
-# 2856|     m2856_5(int)          = Store[shadowed]           : &:r2856_1, r2856_4
-# 2857|     r2857_1(glval<int>)   = VariableAddress[shadowed] : 
-# 2857|     r2857_2(int)          = Load[shadowed]            : &:r2857_1, m2856_5
-# 2857|     r2857_3(int)          = Constant[0]               : 
-# 2857|     r2857_4(bool)         = CompareGT                 : r2857_2, r2857_3
-# 2857|     v2857_5(void)         = ConditionalBranch         : r2857_4
-#-----|   True -> Block 6
-
-# 2859|   Block 6
-# 2859|     r2859_1(glval<short>) = VariableAddress[x] : 
-# 2859|     r2859_2(short)        = Load[x]            : &:r2859_1, m2846_6
-# 2859|     r2859_3(int)          = Constant[0]        : 
-# 2859|     r2859_4(bool)         = CompareGT          : r2859_2, r2859_3
-# 2859|     v2859_5(void)         = ConditionalBranch  : r2859_4
-#-----|   True -> Block 7
-
-# 2860|   Block 7
-# 2860|     v2860_1(void)  = NoOp         : 
-# 2846|     v2846_11(void) = ReturnVoid   : 
-# 2846|     v2846_12(void) = AliasedUse   : m2846_3
-# 2846|     v2846_13(void) = ExitFunction : 
-
-# 2867| void (unnamed namespace)::complex_assertions(int, bool, int)
-# 2867|   Block 0
-# 2867|     v2867_1(void)        = EnterFunction            : 
-# 2867|     m2867_2(unknown)     = AliasedDefinition        : 
-# 2867|     m2867_3(unknown)     = InitializeNonLocal       : 
-# 2867|     m2867_4(unknown)     = Chi                      : total:m2867_2, partial:m2867_3
-# 2867|     r2867_5(glval<int>)  = VariableAddress[x]       : 
-# 2867|     m2867_6(int)         = InitializeParameter[x]   : &:r2867_5
-# 2867|     r2867_7(glval<bool>) = VariableAddress[b]       : 
-# 2867|     m2867_8(bool)        = InitializeParameter[b]   : &:r2867_7
-# 2867|     r2867_9(glval<int>)  = VariableAddress[max]     : 
-# 2867|     m2867_10(int)        = InitializeParameter[max] : &:r2867_9
-# 2868|     r2868_1(glval<int>)  = VariableAddress[y]       : 
-# 2868|     r2868_2(int)         = Constant[0]              : 
-# 2868|     v2868_3(void)        = Convert                  : r2868_2
-# 2868|     r2868_4(glval<int>)  = VariableAddress[x]       : 
-# 2868|     r2868_5(int)         = Load[x]                  : &:r2868_4, m2867_6
-# 2868|     r2868_6(int)         = CopyValue                : r2868_5
-# 2868|     m2868_7(int)         = Store[y]                 : &:r2868_1, r2868_6
-# 2869|     r2869_1(glval<int>)  = VariableAddress[z]       : 
-# 2869|     r2869_2(glval<bool>) = VariableAddress[b]       : 
-# 2869|     r2869_3(bool)        = Load[b]                  : &:r2869_2, m2867_8
-# 2869|     v2869_4(void)        = ConditionalBranch        : r2869_3
-#-----|   False -> Block 5
-#-----|   True -> Block 4
-
-# 2867|   Block 1
-# 2867|     v2867_11(void) = AliasedUse   : m2867_3
-# 2867|     v2867_12(void) = ExitFunction : 
-
-# 2867|   Block 2
-# 2867|     v2867_13(void) = Unwind : 
-#-----|   Goto -> Block 1
-
-# 2869|   Block 3
-# 2869|     m2869_5(int)        = Phi                            : from 4:m2869_11, from 5:m2869_14
-# 2869|     r2869_6(glval<int>) = VariableAddress[#temp2869:17]  : 
-# 2869|     r2869_7(int)        = Load[#temp2869:17]             : &:r2869_6, m2869_5
-# 2869|     m2869_8(int)        = Store[z]                       : &:r2869_1, r2869_7
-# 2872|     r2872_1(glval<int>) = VariableAddress[#throw2872:13] : 
-# 2872|     r2872_2(int)        = Constant[41]                   : 
-# 2872|     m2872_3(int)        = Store[#throw2872:13]           : &:r2872_1, r2872_2
-# 2872|     v2872_4(void)       = ThrowValue                     : &:r2872_1, m2872_3
-#-----|   C++ Exception -> Block 6
-
-# 2869|   Block 4
-# 2869|     r2869_9(int)         = Constant[0]                   : 
-# 2869|     r2869_10(glval<int>) = VariableAddress[#temp2869:17] : 
-# 2869|     m2869_11(int)        = Store[#temp2869:17]           : &:r2869_10, r2869_9
-#-----|   Goto -> Block 3
-
-# 2869|   Block 5
-# 2869|     r2869_12(int)        = Constant[1]                   : 
-# 2869|     r2869_13(glval<int>) = VariableAddress[#temp2869:17] : 
-# 2869|     m2869_14(int)        = Store[#temp2869:17]           : &:r2869_13, r2869_12
-#-----|   Goto -> Block 3
-
-# 2873|   Block 6
-# 2873|     v2873_1(void) = CatchByType[int] : 
-#-----|   C++ Exception -> Block 2
-#-----|   Goto -> Block 7
-
-# 2873|   Block 7
-# 2873|     r2873_2(glval<int>) = VariableAddress[c]     : 
-# 2873|     m2873_3(int)        = InitializeParameter[c] : &:r2873_2
-# 2874|     r2874_1(glval<int>) = VariableAddress[c]     : 
-# 2874|     r2874_2(int)        = Load[c]                : &:r2874_1, m2873_3
-# 2874|     r2874_3(int)        = Constant[42]           : 
-# 2874|     r2874_4(bool)       = CompareLT              : r2874_2, r2874_3
-# 2874|     v2874_5(void)       = ConditionalBranch      : r2874_4
-#-----|   True -> Block 8
-
-# 2875|   Block 8
-# 2875|     r2875_1(int)        = Constant[0]                    : 
-# 2875|     v2875_2(void)       = Convert                        : r2875_1
-# 2878|     r2878_1(int)        = Constant[0]                    : 
-# 2878|     v2878_2(void)       = Convert                        : r2878_1
-# 2879|     r2879_1(glval<int>) = VariableAddress[shadowed]      : 
-# 2879|     m2879_2(int)        = Uninitialized[shadowed]        : &:r2879_1
-# 2882|     r2882_1(glval<int>) = VariableAddress[#throw2882:13] : 
-# 2882|     r2882_2(int)        = Constant[41]                   : 
-# 2882|     m2882_3(int)        = Store[#throw2882:13]           : &:r2882_1, r2882_2
-# 2882|     v2882_4(void)       = ThrowValue                     : &:r2882_1, m2882_3
-#-----|   C++ Exception -> Block 9
-
-# 2883|   Block 9
-# 2883|     v2883_1(void) = CatchByType[int] : 
-#-----|   C++ Exception -> Block 2
-#-----|   Goto -> Block 10
-
-# 2883|   Block 10
-# 2883|     r2883_2(glval<int>) = VariableAddress[shadowed]     : 
-# 2883|     m2883_3(int)        = InitializeParameter[shadowed] : &:r2883_2
-# 2884|     r2884_1(int)        = Constant[0]                   : 
-# 2884|     v2884_2(void)       = Convert                       : r2884_1
-# 2886|     v2886_1(void)       = NoOp                          : 
-# 2867|     v2867_14(void)      = ReturnVoid                    : 
-#-----|   Goto -> Block 1
-
 ir23.cpp:
 #    1| bool consteval_1()
 #    1|   Block 0

cpp/ql/test/library-tests/ir/ir/assertion_variable_resolution.ql

@@ -1,20 +0,0 @@
-import cpp
-import semmle.code.cpp.ir.IR
-import semmle.code.cpp.ir.implementation.raw.internal.TranslatedAssertion
-import utils.test.InlineExpectationsTest
-
-module Test implements TestSig {
-  string getARelevantTag() { result = "var" }
-
-  predicate hasActualResult(Location location, string element, string tag, string value) {
-    exists(TranslatedAssertionVarAccess tava, Variable v |
-      v = tava.getVariable() and
-      location = tava.getLocation() and
-      tava.toString() = element and
-      tag = "var" and
-      value = v.getLocation().getStartLine().toString() + ":" + v.getName()
-    )
-  }
-}
-
-import MakeTest<Test>

cpp/ql/test/library-tests/ir/ir/ir.cpp

@@ -2823,67 +2823,4 @@ void vla_sizeof_test5(int len1, size_t len2) {
   size_t z = sizeof((*&tmp1)[1]);
 }
 
-// Common definitions for assertions in release builds
-#define assert(x) ((void)0)
-#define __analysis_assume(x)
-
-void test_assert_simple(int x, int y, unsigned u, int shadowed) {
-    assert(x > 0); // $ var=2830:x
-    assert(0 < x); // $ var=2830:x
-    assert(x < y); // $ var=2830:x var=2830:y
-    
-    __analysis_assume(x != 2); // $ var=2830:x
-
-    assert(u < x); // $ var=2830:u var=2830:x
-
-    {
-        int shadowed = x;
-        assert(shadowed > 0); // no assertion generated since the variable is shadowed
-    }
-}
-
-template<typename T>
-void test_assert_in_template(T x, int y, unsigned u) {
-    assert(x > 0); // $ var=2846:x
-    assert(0 < x); // $ var=2846:x
-    assert(x < y); // $ var=2846:x var=2846:y
-    
-    __analysis_assume(x != 2); // $ var=2846:x
-
-    assert(u < x); // $ var=2846:u var=2846:x
-
-    {
-        int shadowed = x;
-        assert(shadowed > 0); // $ var=2856:shadowed
-    }
-    assert(x> 0); // $ var=2846:x
-}
-
-template void test_assert_in_template<int>(int, int, unsigned);
-template void test_assert_in_template<short>(short, int, unsigned);
-namespace {
-    int shadowed;
-
-    void complex_assertions(int x, bool b, int max) {
-        int y = (assert(x > 0), x); // no assertion generated
-        int z = b ? (assert(x != 0), 0) : 1; // no assertion generated
-
-        try {
-            throw 41;
-        } catch (int c) {
-            assert(c < 42); // $ var=2873:c
-            assert(shadowed < 42); // no assertion generated
-        }
-
-        assert(shadowed > 0); // no assertion generated
-        int shadowed;
-
-        try {
-            throw 41;
-        } catch (int shadowed) {
-            assert(shadowed < 42); // no assertion generated
-        }
-    }
-}
-
 // semmle-extractor-options: -std=c++20 --clang

cpp/ql/test/library-tests/ir/ir/raw_ir.expected

@@ -18880,326 +18880,6 @@ ir.cpp:
 # 2821|     v2821_9(void)                 = AliasedUse                : ~m?
 # 2821|     v2821_10(void)                = ExitFunction              : 
 
-# 2830| void test_assert_simple(int, int, unsigned int, int)
-# 2830|   Block 0
-# 2830|     v2830_1(void)                = EnterFunction                 : 
-# 2830|     mu2830_2(unknown)            = AliasedDefinition             : 
-# 2830|     mu2830_3(unknown)            = InitializeNonLocal            : 
-# 2830|     r2830_4(glval<int>)          = VariableAddress[x]            : 
-# 2830|     mu2830_5(int)                = InitializeParameter[x]        : &:r2830_4
-# 2830|     r2830_6(glval<int>)          = VariableAddress[y]            : 
-# 2830|     mu2830_7(int)                = InitializeParameter[y]        : &:r2830_6
-# 2830|     r2830_8(glval<unsigned int>) = VariableAddress[u]            : 
-# 2830|     mu2830_9(unsigned int)       = InitializeParameter[u]        : &:r2830_8
-# 2830|     r2830_10(glval<int>)         = VariableAddress[shadowed]     : 
-# 2830|     mu2830_11(int)               = InitializeParameter[shadowed] : &:r2830_10
-# 2831|     r2831_1(glval<int>)          = VariableAddress[x]            : 
-# 2831|     r2831_2(int)                 = Load[x]                       : &:r2831_1, ~m?
-# 2831|     r2831_3(int)                 = Constant[0]                   : 
-# 2831|     r2831_4(bool)                = CompareGT                     : r2831_2, r2831_3
-# 2831|     v2831_5(void)                = ConditionalBranch             : r2831_4
-#-----|   True -> Block 1
-
-# 2832|   Block 1
-# 2832|     r2832_1(int)        = Constant[0]        : 
-# 2832|     r2832_2(glval<int>) = VariableAddress[x] : 
-# 2832|     r2832_3(int)        = Load[x]            : &:r2832_2, ~m?
-# 2832|     r2832_4(bool)       = CompareLT          : r2832_1, r2832_3
-# 2832|     v2832_5(void)       = ConditionalBranch  : r2832_4
-#-----|   True -> Block 2
-
-# 2833|   Block 2
-# 2833|     r2833_1(glval<int>) = VariableAddress[x] : 
-# 2833|     r2833_2(int)        = Load[x]            : &:r2833_1, ~m?
-# 2833|     r2833_3(glval<int>) = VariableAddress[y] : 
-# 2833|     r2833_4(int)        = Load[y]            : &:r2833_3, ~m?
-# 2833|     r2833_5(bool)       = CompareLT          : r2833_2, r2833_4
-# 2833|     v2833_6(void)       = ConditionalBranch  : r2833_5
-#-----|   True -> Block 3
-
-# 2835|   Block 3
-# 2835|     r2835_1(glval<int>) = VariableAddress[x] : 
-# 2835|     r2835_2(int)        = Load[x]            : &:r2835_1, ~m?
-# 2835|     r2835_3(int)        = Constant[2]        : 
-# 2835|     r2835_4(bool)       = CompareNE          : r2835_2, r2835_3
-# 2835|     v2835_5(void)       = ConditionalBranch  : r2835_4
-#-----|   True -> Block 4
-
-# 2837|   Block 4
-# 2837|     r2837_1(glval<unsigned int>) = VariableAddress[u] : 
-# 2837|     r2837_2(unsigned int)        = Load[u]            : &:r2837_1, ~m?
-# 2837|     r2837_3(glval<int>)          = VariableAddress[x] : 
-# 2837|     r2837_4(int)                 = Load[x]            : &:r2837_3, ~m?
-# 2837|     r2837_5(bool)                = CompareLT          : r2837_2, r2837_4
-# 2837|     v2837_6(void)                = ConditionalBranch  : r2837_5
-#-----|   True -> Block 5
-
-# 2840|   Block 5
-# 2840|     r2840_1(glval<int>) = VariableAddress[shadowed] : 
-# 2840|     r2840_2(glval<int>) = VariableAddress[x]        : 
-# 2840|     r2840_3(int)        = Load[x]                   : &:r2840_2, ~m?
-# 2840|     mu2840_4(int)       = Store[shadowed]           : &:r2840_1, r2840_3
-# 2841|     r2841_1(int)        = Constant[0]               : 
-# 2841|     v2841_2(void)       = Convert                   : r2841_1
-# 2843|     v2843_1(void)       = NoOp                      : 
-# 2830|     v2830_12(void)      = ReturnVoid                : 
-# 2830|     v2830_13(void)      = AliasedUse                : ~m?
-# 2830|     v2830_14(void)      = ExitFunction              : 
-
-# 2846| void test_assert_in_template<int>(int, int, unsigned int)
-# 2846|   Block 0
-# 2846|     v2846_1(void)                = EnterFunction          : 
-# 2846|     mu2846_2(unknown)            = AliasedDefinition      : 
-# 2846|     mu2846_3(unknown)            = InitializeNonLocal     : 
-# 2846|     r2846_4(glval<int>)          = VariableAddress[x]     : 
-# 2846|     mu2846_5(int)                = InitializeParameter[x] : &:r2846_4
-# 2846|     r2846_6(glval<int>)          = VariableAddress[y]     : 
-# 2846|     mu2846_7(int)                = InitializeParameter[y] : &:r2846_6
-# 2846|     r2846_8(glval<unsigned int>) = VariableAddress[u]     : 
-# 2846|     mu2846_9(unsigned int)       = InitializeParameter[u] : &:r2846_8
-# 2847|     r2847_1(glval<int>)          = VariableAddress[x]     : 
-# 2847|     r2847_2(int)                 = Load[x]                : &:r2847_1, ~m?
-# 2847|     r2847_3(int)                 = Constant[0]            : 
-# 2847|     r2847_4(bool)                = CompareGT              : r2847_2, r2847_3
-# 2847|     v2847_5(void)                = ConditionalBranch      : r2847_4
-#-----|   True -> Block 1
-
-# 2848|   Block 1
-# 2848|     r2848_1(int)        = Constant[0]        : 
-# 2848|     r2848_2(glval<int>) = VariableAddress[x] : 
-# 2848|     r2848_3(int)        = Load[x]            : &:r2848_2, ~m?
-# 2848|     r2848_4(bool)       = CompareLT          : r2848_1, r2848_3
-# 2848|     v2848_5(void)       = ConditionalBranch  : r2848_4
-#-----|   True -> Block 2
-
-# 2849|   Block 2
-# 2849|     r2849_1(glval<int>) = VariableAddress[x] : 
-# 2849|     r2849_2(int)        = Load[x]            : &:r2849_1, ~m?
-# 2849|     r2849_3(glval<int>) = VariableAddress[y] : 
-# 2849|     r2849_4(int)        = Load[y]            : &:r2849_3, ~m?
-# 2849|     r2849_5(bool)       = CompareLT          : r2849_2, r2849_4
-# 2849|     v2849_6(void)       = ConditionalBranch  : r2849_5
-#-----|   True -> Block 3
-
-# 2851|   Block 3
-# 2851|     r2851_1(glval<int>) = VariableAddress[x] : 
-# 2851|     r2851_2(int)        = Load[x]            : &:r2851_1, ~m?
-# 2851|     r2851_3(int)        = Constant[2]        : 
-# 2851|     r2851_4(bool)       = CompareNE          : r2851_2, r2851_3
-# 2851|     v2851_5(void)       = ConditionalBranch  : r2851_4
-#-----|   True -> Block 4
-
-# 2853|   Block 4
-# 2853|     r2853_1(glval<unsigned int>) = VariableAddress[u] : 
-# 2853|     r2853_2(unsigned int)        = Load[u]            : &:r2853_1, ~m?
-# 2853|     r2853_3(glval<int>)          = VariableAddress[x] : 
-# 2853|     r2853_4(int)                 = Load[x]            : &:r2853_3, ~m?
-# 2853|     r2853_5(bool)                = CompareLT          : r2853_2, r2853_4
-# 2853|     v2853_6(void)                = ConditionalBranch  : r2853_5
-#-----|   True -> Block 5
-
-# 2856|   Block 5
-# 2856|     r2856_1(glval<int>) = VariableAddress[shadowed] : 
-# 2856|     r2856_2(glval<int>) = VariableAddress[x]        : 
-# 2856|     r2856_3(int)        = Load[x]                   : &:r2856_2, ~m?
-# 2856|     mu2856_4(int)       = Store[shadowed]           : &:r2856_1, r2856_3
-# 2857|     r2857_1(glval<int>) = VariableAddress[shadowed] : 
-# 2857|     r2857_2(int)        = Load[shadowed]            : &:r2857_1, ~m?
-# 2857|     r2857_3(int)        = Constant[0]               : 
-# 2857|     r2857_4(bool)       = CompareGT                 : r2857_2, r2857_3
-# 2857|     v2857_5(void)       = ConditionalBranch         : r2857_4
-#-----|   True -> Block 6
-
-# 2859|   Block 6
-# 2859|     r2859_1(glval<int>) = VariableAddress[x] : 
-# 2859|     r2859_2(int)        = Load[x]            : &:r2859_1, ~m?
-# 2859|     r2859_3(int)        = Constant[0]        : 
-# 2859|     r2859_4(bool)       = CompareGT          : r2859_2, r2859_3
-# 2859|     v2859_5(void)       = ConditionalBranch  : r2859_4
-#-----|   True -> Block 7
-
-# 2860|   Block 7
-# 2860|     v2860_1(void)  = NoOp         : 
-# 2846|     v2846_10(void) = ReturnVoid   : 
-# 2846|     v2846_11(void) = AliasedUse   : ~m?
-# 2846|     v2846_12(void) = ExitFunction : 
-
-# 2846| void test_assert_in_template<short>(short, int, unsigned int)
-# 2846|   Block 0
-# 2846|     v2846_1(void)                = EnterFunction          : 
-# 2846|     mu2846_2(unknown)            = AliasedDefinition      : 
-# 2846|     mu2846_3(unknown)            = InitializeNonLocal     : 
-# 2846|     r2846_4(glval<short>)        = VariableAddress[x]     : 
-# 2846|     mu2846_5(short)              = InitializeParameter[x] : &:r2846_4
-# 2846|     r2846_6(glval<int>)          = VariableAddress[y]     : 
-# 2846|     mu2846_7(int)                = InitializeParameter[y] : &:r2846_6
-# 2846|     r2846_8(glval<unsigned int>) = VariableAddress[u]     : 
-# 2846|     mu2846_9(unsigned int)       = InitializeParameter[u] : &:r2846_8
-# 2847|     r2847_1(glval<short>)        = VariableAddress[x]     : 
-# 2847|     r2847_2(short)               = Load[x]                : &:r2847_1, ~m?
-# 2847|     r2847_3(int)                 = Constant[0]            : 
-# 2847|     r2847_4(bool)                = CompareGT              : r2847_2, r2847_3
-# 2847|     v2847_5(void)                = ConditionalBranch      : r2847_4
-#-----|   True -> Block 1
-
-# 2848|   Block 1
-# 2848|     r2848_1(int)          = Constant[0]        : 
-# 2848|     r2848_2(glval<short>) = VariableAddress[x] : 
-# 2848|     r2848_3(short)        = Load[x]            : &:r2848_2, ~m?
-# 2848|     r2848_4(bool)         = CompareLT          : r2848_1, r2848_3
-# 2848|     v2848_5(void)         = ConditionalBranch  : r2848_4
-#-----|   True -> Block 2
-
-# 2849|   Block 2
-# 2849|     r2849_1(glval<short>) = VariableAddress[x] : 
-# 2849|     r2849_2(short)        = Load[x]            : &:r2849_1, ~m?
-# 2849|     r2849_3(glval<int>)   = VariableAddress[y] : 
-# 2849|     r2849_4(int)          = Load[y]            : &:r2849_3, ~m?
-# 2849|     r2849_5(bool)         = CompareLT          : r2849_2, r2849_4
-# 2849|     v2849_6(void)         = ConditionalBranch  : r2849_5
-#-----|   True -> Block 3
-
-# 2851|   Block 3
-# 2851|     r2851_1(glval<short>) = VariableAddress[x] : 
-# 2851|     r2851_2(short)        = Load[x]            : &:r2851_1, ~m?
-# 2851|     r2851_3(int)          = Constant[2]        : 
-# 2851|     r2851_4(bool)         = CompareNE          : r2851_2, r2851_3
-# 2851|     v2851_5(void)         = ConditionalBranch  : r2851_4
-#-----|   True -> Block 4
-
-# 2853|   Block 4
-# 2853|     r2853_1(glval<unsigned int>) = VariableAddress[u] : 
-# 2853|     r2853_2(unsigned int)        = Load[u]            : &:r2853_1, ~m?
-# 2853|     r2853_3(glval<short>)        = VariableAddress[x] : 
-# 2853|     r2853_4(short)               = Load[x]            : &:r2853_3, ~m?
-# 2853|     r2853_5(bool)                = CompareLT          : r2853_2, r2853_4
-# 2853|     v2853_6(void)                = ConditionalBranch  : r2853_5
-#-----|   True -> Block 5
-
-# 2856|   Block 5
-# 2856|     r2856_1(glval<int>)   = VariableAddress[shadowed] : 
-# 2856|     r2856_2(glval<short>) = VariableAddress[x]        : 
-# 2856|     r2856_3(short)        = Load[x]                   : &:r2856_2, ~m?
-# 2856|     r2856_4(int)          = Convert                   : r2856_3
-# 2856|     mu2856_5(int)         = Store[shadowed]           : &:r2856_1, r2856_4
-# 2857|     r2857_1(glval<int>)   = VariableAddress[shadowed] : 
-# 2857|     r2857_2(int)          = Load[shadowed]            : &:r2857_1, ~m?
-# 2857|     r2857_3(int)          = Constant[0]               : 
-# 2857|     r2857_4(bool)         = CompareGT                 : r2857_2, r2857_3
-# 2857|     v2857_5(void)         = ConditionalBranch         : r2857_4
-#-----|   True -> Block 6
-
-# 2859|   Block 6
-# 2859|     r2859_1(glval<short>) = VariableAddress[x] : 
-# 2859|     r2859_2(short)        = Load[x]            : &:r2859_1, ~m?
-# 2859|     r2859_3(int)          = Constant[0]        : 
-# 2859|     r2859_4(bool)         = CompareGT          : r2859_2, r2859_3
-# 2859|     v2859_5(void)         = ConditionalBranch  : r2859_4
-#-----|   True -> Block 7
-
-# 2860|   Block 7
-# 2860|     v2860_1(void)  = NoOp         : 
-# 2846|     v2846_10(void) = ReturnVoid   : 
-# 2846|     v2846_11(void) = AliasedUse   : ~m?
-# 2846|     v2846_12(void) = ExitFunction : 
-
-# 2867| void (unnamed namespace)::complex_assertions(int, bool, int)
-# 2867|   Block 0
-# 2867|     v2867_1(void)        = EnterFunction            : 
-# 2867|     mu2867_2(unknown)    = AliasedDefinition        : 
-# 2867|     mu2867_3(unknown)    = InitializeNonLocal       : 
-# 2867|     r2867_4(glval<int>)  = VariableAddress[x]       : 
-# 2867|     mu2867_5(int)        = InitializeParameter[x]   : &:r2867_4
-# 2867|     r2867_6(glval<bool>) = VariableAddress[b]       : 
-# 2867|     mu2867_7(bool)       = InitializeParameter[b]   : &:r2867_6
-# 2867|     r2867_8(glval<int>)  = VariableAddress[max]     : 
-# 2867|     mu2867_9(int)        = InitializeParameter[max] : &:r2867_8
-# 2868|     r2868_1(glval<int>)  = VariableAddress[y]       : 
-# 2868|     r2868_2(int)         = Constant[0]              : 
-# 2868|     v2868_3(void)        = Convert                  : r2868_2
-# 2868|     r2868_4(glval<int>)  = VariableAddress[x]       : 
-# 2868|     r2868_5(int)         = Load[x]                  : &:r2868_4, ~m?
-# 2868|     r2868_6(int)         = CopyValue                : r2868_5
-# 2868|     mu2868_7(int)        = Store[y]                 : &:r2868_1, r2868_6
-# 2869|     r2869_1(glval<int>)  = VariableAddress[z]       : 
-# 2869|     r2869_2(glval<bool>) = VariableAddress[b]       : 
-# 2869|     r2869_3(bool)        = Load[b]                  : &:r2869_2, ~m?
-# 2869|     v2869_4(void)        = ConditionalBranch        : r2869_3
-#-----|   False -> Block 5
-#-----|   True -> Block 4
-
-# 2867|   Block 1
-# 2867|     v2867_10(void) = AliasedUse   : ~m?
-# 2867|     v2867_11(void) = ExitFunction : 
-
-# 2867|   Block 2
-# 2867|     v2867_12(void) = Unwind : 
-#-----|   Goto -> Block 1
-
-# 2869|   Block 3
-# 2869|     r2869_5(glval<int>) = VariableAddress[#temp2869:17]  : 
-# 2869|     r2869_6(int)        = Load[#temp2869:17]             : &:r2869_5, ~m?
-# 2869|     mu2869_7(int)       = Store[z]                       : &:r2869_1, r2869_6
-# 2872|     r2872_1(glval<int>) = VariableAddress[#throw2872:13] : 
-# 2872|     r2872_2(int)        = Constant[41]                   : 
-# 2872|     mu2872_3(int)       = Store[#throw2872:13]           : &:r2872_1, r2872_2
-# 2872|     v2872_4(void)       = ThrowValue                     : &:r2872_1, ~m?
-#-----|   C++ Exception -> Block 6
-
-# 2869|   Block 4
-# 2869|     r2869_8(int)        = Constant[0]                   : 
-# 2869|     r2869_9(glval<int>) = VariableAddress[#temp2869:17] : 
-# 2869|     mu2869_10(int)      = Store[#temp2869:17]           : &:r2869_9, r2869_8
-#-----|   Goto -> Block 3
-
-# 2869|   Block 5
-# 2869|     r2869_11(int)        = Constant[1]                   : 
-# 2869|     r2869_12(glval<int>) = VariableAddress[#temp2869:17] : 
-# 2869|     mu2869_13(int)       = Store[#temp2869:17]           : &:r2869_12, r2869_11
-#-----|   Goto -> Block 3
-
-# 2873|   Block 6
-# 2873|     v2873_1(void) = CatchByType[int] : 
-#-----|   C++ Exception -> Block 2
-#-----|   Goto -> Block 7
-
-# 2873|   Block 7
-# 2873|     r2873_2(glval<int>) = VariableAddress[c]     : 
-# 2873|     mu2873_3(int)       = InitializeParameter[c] : &:r2873_2
-# 2874|     r2874_1(glval<int>) = VariableAddress[c]     : 
-# 2874|     r2874_2(int)        = Load[c]                : &:r2874_1, ~m?
-# 2874|     r2874_3(int)        = Constant[42]           : 
-# 2874|     r2874_4(bool)       = CompareLT              : r2874_2, r2874_3
-# 2874|     v2874_5(void)       = ConditionalBranch      : r2874_4
-#-----|   True -> Block 8
-
-# 2875|   Block 8
-# 2875|     r2875_1(int)        = Constant[0]                    : 
-# 2875|     v2875_2(void)       = Convert                        : r2875_1
-# 2878|     r2878_1(int)        = Constant[0]                    : 
-# 2878|     v2878_2(void)       = Convert                        : r2878_1
-# 2879|     r2879_1(glval<int>) = VariableAddress[shadowed]      : 
-# 2879|     mu2879_2(int)       = Uninitialized[shadowed]        : &:r2879_1
-# 2882|     r2882_1(glval<int>) = VariableAddress[#throw2882:13] : 
-# 2882|     r2882_2(int)        = Constant[41]                   : 
-# 2882|     mu2882_3(int)       = Store[#throw2882:13]           : &:r2882_1, r2882_2
-# 2882|     v2882_4(void)       = ThrowValue                     : &:r2882_1, ~m?
-#-----|   C++ Exception -> Block 9
-
-# 2883|   Block 9
-# 2883|     v2883_1(void) = CatchByType[int] : 
-#-----|   C++ Exception -> Block 2
-#-----|   Goto -> Block 10
-
-# 2883|   Block 10
-# 2883|     r2883_2(glval<int>) = VariableAddress[shadowed]     : 
-# 2883|     mu2883_3(int)       = InitializeParameter[shadowed] : &:r2883_2
-# 2884|     r2884_1(int)        = Constant[0]                   : 
-# 2884|     v2884_2(void)       = Convert                       : r2884_1
-# 2886|     v2886_1(void)       = NoOp                          : 
-# 2867|     v2867_13(void)      = ReturnVoid                    : 
-#-----|   Goto -> Block 1
-
 ir23.cpp:
 #    1| bool consteval_1()
 #    1|   Block 0

csharp/autobuilder/Semmle.Autobuild.CSharp.Tests/BuildScripts.cs

@@ -158,10 +158,6 @@ namespace Semmle.Autobuild.CSharp.Tests
 
         bool IBuildActions.IsMacOs() => IsMacOs;
 
-        public bool IsLinux { get; set; }
-
-        bool IBuildActions.IsLinux() => IsLinux;
-
         public bool IsRunningOnAppleSilicon { get; set; }
 
         bool IBuildActions.IsRunningOnAppleSilicon() => IsRunningOnAppleSilicon;

csharp/autobuilder/Semmle.Autobuild.Cpp.Tests/BuildScripts.cs

@@ -146,10 +146,6 @@ namespace Semmle.Autobuild.Cpp.Tests
 
         bool IBuildActions.IsMacOs() => IsMacOs;
 
-        public bool IsLinux { get; set; }
-
-        bool IBuildActions.IsLinux() => IsLinux;
-
         public bool IsRunningOnAppleSilicon { get; set; }
 
         bool IBuildActions.IsRunningOnAppleSilicon() => IsRunningOnAppleSilicon;

csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/NugetPackageRestorer.cs

@@ -814,43 +814,6 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
         private (HashSet<string> explicitFeeds, HashSet<string> allFeeds) GetAllFeeds()
         {
             var nugetConfigs = fileProvider.NugetConfigs;
-
-            // On systems with case-sensitive file systems (for simplicity, we assume that is Linux), the
-            // filenames of NuGet configuration files must be named correctly. For compatibility with projects
-            // that are typically built on Windows or macOS where this doesn't matter, we accept all variants
-            // of `nuget.config` ourselves. However, `dotnet` does not. If we detect that incorrectly-named
-            // files are present, we emit a diagnostic to warn the user.
-            if (SystemBuildActions.Instance.IsLinux())
-            {
-                string[] acceptedNugetConfigNames = ["nuget.config", "NuGet.config", "NuGet.Config"];
-                var invalidNugetConfigs = nugetConfigs
-                    .Where(path => !acceptedNugetConfigNames.Contains(Path.GetFileName(path)));
-
-                if (invalidNugetConfigs.Count() > 0)
-                {
-                    this.logger.LogWarning(string.Format(
-                        "Found incorrectly named NuGet configuration files: {0}",
-                        string.Join(", ", invalidNugetConfigs)
-                    ));
-                    this.diagnosticsWriter.AddEntry(new DiagnosticMessage(
-                        Language.CSharp,
-                        "buildless/case-sensitive-nuget-config",
-                        "Found NuGet configuration files which are not correctly named",
-                        visibility: new DiagnosticMessage.TspVisibility(statusPage: true, cliSummaryTable: true, telemetry: true),
-                        markdownMessage: string.Format(
-                            "On platforms with case-sensitive file systems, NuGet only accepts files with one of the following names: {0}.\n\n" +
-                            "CodeQL found the following files while performing an analysis on a platform with a case-sensitive file system:\n\n" +
-                            "{1}\n\n" +
-                            "To avoid unexpected results, rename these files to match the casing of one of the accepted filenames.",
-                            string.Join(", ", acceptedNugetConfigNames),
-                            string.Join("\n", invalidNugetConfigs.Select(path => string.Format("- `{0}`", path)))
-                        ),
-                        severity: DiagnosticMessage.TspSeverity.Warning
-                    ));
-                }
-            }
-
-            // Find feeds that are explicitly configured in the NuGet configuration files that we found.
             var explicitFeeds = nugetConfigs
                 .SelectMany(config => GetFeeds(() => dotnet.GetNugetFeeds(config)))
                 .ToHashSet();
@@ -886,14 +849,6 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
                     .Where(folder => folder != null)
                     .SelectMany(folder => GetFeeds(() => dotnet.GetNugetFeedsFromFolder(folder!)))
                     .ToHashSet();
-
-                // If we have discovered any explicit feeds, then we also expect these to be in the set of all feeds.
-                // Normally, it is a safe assumption to make that `GetNugetFeedsFromFolder` will include the feeds configured
-                // in a NuGet configuration file in the given directory. There is one exception: on a system with case-sensitive
-                // file systems, we may discover a configuration file such as `Nuget.Config` which is not recognised by `dotnet nuget`.
-                // In that case, our call to `GetNugetFeeds` will retrieve the feeds from that file (because it is accepted when
-                // provided explicitly as `--configfile` argument), but the call to `GetNugetFeedsFromFolder` will not.
-                allFeeds.UnionWith(explicitFeeds);
             }
             else
             {

csharp/extractor/Semmle.Util/BuildActions.cs

@@ -119,12 +119,6 @@ namespace Semmle.Util
         /// <returns>True if we are running on macOS.</returns>
         bool IsMacOs();
 
-        /// <summary>
-        /// Gets a value indicating whether we are running on Linux.
-        /// </summary>
-        /// <returns>True if we are running on Linux.</returns>
-        bool IsLinux();
-
         /// <summary>
         /// Gets a value indicating whether we are running on Apple Silicon.
         /// </summary>
@@ -252,8 +246,6 @@ namespace Semmle.Util
 
         bool IBuildActions.IsMacOs() => RuntimeInformation.IsOSPlatform(OSPlatform.OSX);
 
-        bool IBuildActions.IsLinux() => RuntimeInformation.IsOSPlatform(OSPlatform.Linux);
-
         bool IBuildActions.IsRunningOnAppleSilicon()
         {
             var thisBuildActions = (IBuildActions)this;

csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md

@@ -1,7 +1,3 @@
-## 1.7.58
-
-No user-facing changes.
-
 ## 1.7.57
 
 No user-facing changes.

csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.58.md

@@ -1,3 +0,0 @@
-## 1.7.58
-
-No user-facing changes.

csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.7.58
+lastReleaseVersion: 1.7.57

csharp/ql/campaigns/Solorigate/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-all
-version: 1.7.58
+version: 1.7.58-dev
 groups:
   - csharp
   - solorigate

csharp/ql/campaigns/Solorigate/src/CHANGELOG.md

@@ -1,7 +1,3 @@
-## 1.7.58
-
-No user-facing changes.
-
 ## 1.7.57
 
 No user-facing changes.

csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.58.md

@@ -1,3 +0,0 @@
-## 1.7.58
-
-No user-facing changes.