Revert "JS: Add compileForOverlayEval"

This reverts commit 39f74d808b.

.github/copilot-instructions.md

@@ -1,4 +0,0 @@
-When reviewing code:
-* do not review changes in files with `.expected` extension (they are automatically ensured to be correct).
-* in `.ql` and `.qll` files, do not try to review the code itself as you don't understand the programming language
-  well enough to make comments in these languages. You can still check for typos or comment improvements.

.github/dependabot.yml

@@ -25,11 +25,18 @@ updates:
     allow:
       - dependency-name: "golang.org/x/mod"
       - dependency-name: "golang.org/x/tools"
-    exclude-paths:
-      - "go/ql/**"
     groups:
       extractor-dependencies:
         patterns:
           - "golang.org/x/*"
     reviewers:
       - "github/codeql-go"
+
+  - package-ecosystem: "gomod"
+    directory: "go/ql/test"
+    schedule:
+      interval: "monthly"
+    ignore:
+      - dependency-name: "*"
+    reviewers:
+      - "github/codeql-go"

.github/instructions/expected-files.instructions.md

@@ -0,0 +1,4 @@
+---
+applyTo: "**/*.expected"
+---
+Ignore these files. These are generated to be correct by running the tests, and should not be edited manually.

.github/instructions/ql-files.instructions.md

@@ -0,0 +1,6 @@
+---
+applyTo: "**/*.ql,**/*.qll"
+---
+When reviewing these QL files, do not make any comment on the code itself. You don't understand the QL programming language well enough yet. You can only make comments about the following aspects:
+* comments (lines starting with `//` or block comments enclosed in `/* ... */`): you can suggest improvements to the clarity of comments, or point out spelling mistakes
+* typos in identifiers

Cargo.toml

@@ -10,4 +10,3 @@ members = [
     "rust/ast-generator",
     "rust/autobuild",
 ]
-exclude = ["mad-generation-build"]

MODULE.bazel

@@ -19,8 +19,8 @@ bazel_dep(name = "rules_go", version = "0.56.1")
 bazel_dep(name = "rules_pkg", version = "1.0.1")
 bazel_dep(name = "rules_nodejs", version = "6.2.0-codeql.1")
 bazel_dep(name = "rules_python", version = "0.40.0")
-bazel_dep(name = "rules_shell", version = "0.3.0")
-bazel_dep(name = "bazel_skylib", version = "1.7.1")
+bazel_dep(name = "rules_shell", version = "0.5.0")
+bazel_dep(name = "bazel_skylib", version = "1.8.1")
 bazel_dep(name = "abseil-cpp", version = "20240116.1", repo_name = "absl")
 bazel_dep(name = "nlohmann_json", version = "3.11.3", repo_name = "json")
 bazel_dep(name = "fmt", version = "10.0.0")
@@ -28,7 +28,7 @@ bazel_dep(name = "rules_kotlin", version = "2.1.3-codeql.1")
 bazel_dep(name = "gazelle", version = "0.40.0")
 bazel_dep(name = "rules_dotnet", version = "0.19.2-codeql.1")
 bazel_dep(name = "googletest", version = "1.14.0.bcr.1")
-bazel_dep(name = "rules_rust", version = "0.63.0")
+bazel_dep(name = "rules_rust", version = "0.66.0")
 bazel_dep(name = "zstd", version = "1.5.5.bcr.1")
 
 bazel_dep(name = "buildifier_prebuilt", version = "6.4.0", dev_dependency = True)

actions/ql/lib/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 0.4.19
+
+No user-facing changes.
+
 ## 0.4.18
 
 No user-facing changes.

actions/ql/lib/change-notes/released/0.4.19.md

@@ -0,0 +1,3 @@
+## 0.4.19
+
+No user-facing changes.

actions/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.4.18
+lastReleaseVersion: 0.4.19

actions/ql/lib/codeql/actions/security/ArgumentInjectionQuery.qll

@@ -100,8 +100,6 @@ private module ArgumentInjectionConfig implements DataFlow::ConfigSig {
 
   predicate observeDiffInformedIncrementalMode() { any() }
 
-  Location getASelectedSourceLocation(DataFlow::Node source) { none() }
-
   Location getASelectedSinkLocation(DataFlow::Node sink) {
     result = sink.getLocation()
     or

actions/ql/lib/codeql/actions/security/ArtifactPoisoningQuery.qll

@@ -333,8 +333,6 @@ private module ArtifactPoisoningConfig implements DataFlow::ConfigSig {
 
   predicate observeDiffInformedIncrementalMode() { any() }
 
-  Location getASelectedSourceLocation(DataFlow::Node source) { none() }
-
   Location getASelectedSinkLocation(DataFlow::Node sink) {
     result = sink.getLocation()
     or

actions/ql/lib/codeql/actions/security/CodeInjectionQuery.qll

@@ -80,8 +80,6 @@ private module CodeInjectionConfig implements DataFlow::ConfigSig {
 
   predicate observeDiffInformedIncrementalMode() { any() }
 
-  Location getASelectedSourceLocation(DataFlow::Node source) { none() }
-
   Location getASelectedSinkLocation(DataFlow::Node sink) {
     result = sink.getLocation()
     or

actions/ql/lib/codeql/actions/security/EnvPathInjectionQuery.qll

@@ -130,8 +130,6 @@ private module EnvPathInjectionConfig implements DataFlow::ConfigSig {
 
   predicate observeDiffInformedIncrementalMode() { any() }
 
-  Location getASelectedSourceLocation(DataFlow::Node source) { none() }
-
   Location getASelectedSinkLocation(DataFlow::Node sink) {
     result = sink.getLocation()
     or

actions/ql/lib/codeql/actions/security/EnvVarInjectionQuery.qll

@@ -184,8 +184,6 @@ private module EnvVarInjectionConfig implements DataFlow::ConfigSig {
 
   predicate observeDiffInformedIncrementalMode() { any() }
 
-  Location getASelectedSourceLocation(DataFlow::Node source) { none() }
-
   Location getASelectedSinkLocation(DataFlow::Node sink) {
     result = sink.getLocation()
     or

actions/ql/lib/codeql/actions/security/OutputClobberingQuery.qll

@@ -212,8 +212,6 @@ private module OutputClobberingConfig implements DataFlow::ConfigSig {
   }
 
   predicate observeDiffInformedIncrementalMode() { any() }
-
-  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }
 
 /** Tracks flow of unsafe user input that is used to construct and evaluate an environment variable. */

actions/ql/lib/codeql/actions/security/RequestForgeryQuery.qll

@@ -18,8 +18,6 @@ private module RequestForgeryConfig implements DataFlow::ConfigSig {
   predicate isSink(DataFlow::Node sink) { sink instanceof RequestForgerySink }
 
   predicate observeDiffInformedIncrementalMode() { any() }
-
-  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }
 
 /** Tracks flow of unsafe user input that is used to construct and evaluate a system command. */

actions/ql/lib/codeql/actions/security/SecretExfiltrationQuery.qll

@@ -17,8 +17,6 @@ private module SecretExfiltrationConfig implements DataFlow::ConfigSig {
   predicate isSink(DataFlow::Node sink) { sink instanceof SecretExfiltrationSink }
 
   predicate observeDiffInformedIncrementalMode() { any() }
-
-  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }
 
 /** Tracks flow of unsafe user input that is used in a context where it may lead to a secret exfiltration. */

actions/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/actions-all
-version: 0.4.19-dev
+version: 0.4.20-dev
 library: true
 warnOnImplicitThis: true
 dependencies:

actions/ql/src/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 0.6.11
+
+No user-facing changes.
+
 ## 0.6.10
 
 No user-facing changes.

actions/ql/src/Models/CompositeActionsSinks.ql

@@ -26,8 +26,6 @@ private module MyConfig implements DataFlow::ConfigSig {
   }
 
   predicate observeDiffInformedIncrementalMode() { any() }
-
-  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }
 
 module MyFlow = TaintTracking::Global<MyConfig>;

actions/ql/src/Models/CompositeActionsSources.ql

@@ -36,8 +36,6 @@ private module MyConfig implements DataFlow::ConfigSig {
   }
 
   predicate observeDiffInformedIncrementalMode() { any() }
-
-  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }
 
 module MyFlow = TaintTracking::Global<MyConfig>;

actions/ql/src/Models/CompositeActionsSummaries.ql

@@ -27,8 +27,6 @@ private module MyConfig implements DataFlow::ConfigSig {
   }
 
   predicate observeDiffInformedIncrementalMode() { any() }
-
-  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }
 
 module MyFlow = TaintTracking::Global<MyConfig>;

actions/ql/src/Models/ReusableWorkflowsSinks.ql

@@ -26,8 +26,6 @@ private module MyConfig implements DataFlow::ConfigSig {
   }
 
   predicate observeDiffInformedIncrementalMode() { any() }
-
-  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }
 
 module MyFlow = TaintTracking::Global<MyConfig>;

actions/ql/src/Models/ReusableWorkflowsSources.ql

@@ -36,8 +36,6 @@ private module MyConfig implements DataFlow::ConfigSig {
   }
 
   predicate observeDiffInformedIncrementalMode() { any() }
-
-  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }
 
 module MyFlow = TaintTracking::Global<MyConfig>;

actions/ql/src/Models/ReusableWorkflowsSummaries.ql

@@ -27,8 +27,6 @@ private module MyConfig implements DataFlow::ConfigSig {
   }
 
   predicate observeDiffInformedIncrementalMode() { any() }
-
-  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }
 
 module MyFlow = TaintTracking::Global<MyConfig>;

actions/ql/src/change-notes/released/0.6.11.md

@@ -0,0 +1,3 @@
+## 0.6.11
+
+No user-facing changes.

actions/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.6.10
+lastReleaseVersion: 0.6.11

actions/ql/src/experimental/Security/CWE-200/SecretExfiltration.ql

@@ -19,5 +19,5 @@ import SecretExfiltrationFlow::PathGraph
 from SecretExfiltrationFlow::PathNode source, SecretExfiltrationFlow::PathNode sink
 where SecretExfiltrationFlow::flowPath(source, sink)
 select sink.getNode(), source, sink,
-  "Potential secret exfiltration in $@, which may be be leaked to an attacker-controlled resource.",
+  "Potential secret exfiltration in $@, which may be leaked to an attacker-controlled resource.",
   sink, sink.getNode().asExpr().(Expression).getRawExpression()

actions/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/actions-queries
-version: 0.6.11-dev
+version: 0.6.12-dev
 library: false
 warnOnImplicitThis: true
 groups: [actions, queries]

actions/ql/test/query-tests/Security/CWE-200/SecretExfiltration.expected

@@ -3,4 +3,4 @@ nodes
 | .github/workflows/test1.yml:15:11:16:75 | github.event.pull_request.title | semmle.label | github.event.pull_request.title |
 subpaths
 #select
-| .github/workflows/test1.yml:15:11:16:75 | github.event.pull_request.title | .github/workflows/test1.yml:15:11:16:75 | github.event.pull_request.title | .github/workflows/test1.yml:15:11:16:75 | github.event.pull_request.title | Potential secret exfiltration in $@, which may be be leaked to an attacker-controlled resource. | .github/workflows/test1.yml:15:11:16:75 | github.event.pull_request.title | ${{ github.event.pull_request.title }} |
+| .github/workflows/test1.yml:15:11:16:75 | github.event.pull_request.title | .github/workflows/test1.yml:15:11:16:75 | github.event.pull_request.title | .github/workflows/test1.yml:15:11:16:75 | github.event.pull_request.title | Potential secret exfiltration in $@, which may be leaked to an attacker-controlled resource. | .github/workflows/test1.yml:15:11:16:75 | github.event.pull_request.title | ${{ github.event.pull_request.title }} |

config/dbscheme-fragments.json

@@ -9,6 +9,7 @@
   "fragments": [
     "/*- Compilations -*/",
     "/*- External data -*/",
+    "/*- Overlay support -*/",
     "/*- Files and folders -*/",
     "/*- Diagnostic messages -*/",
     "/*- Diagnostic messages: severity -*/",

cpp/ql/lib/CHANGELOG.md

@@ -1,3 +1,13 @@
+## 6.0.0
+
+### Breaking Changes
+
+* The "Guards" libraries (`semmle.code.cpp.controlflow.Guards` and `semmle.code.cpp.controlflow.IRGuards`) have been totally rewritten to recognize many more guards. The API remains unchanged, but the `GuardCondition` class now extends `Element` instead of `Expr`.
+
+### New Features
+
+* C/C++ `build-mode: none` support is now generally available.
+
 ## 5.6.1
 
 No user-facing changes.

cpp/ql/lib/change-notes/2025-10-07-bmn-ga.md

@@ -1,4 +0,0 @@
----
-category: feature
----
-* The C/C++ "build-mode: none" support is now General Availability (GA).

cpp/ql/lib/change-notes/2025-10-16-range-analysis-performance.md

@@ -0,0 +1,4 @@
+---
+category: fix
+---
+* Improve performance of the range analysis in cases where it would otherwise take an exorbitant amount of time.

cpp/ql/lib/change-notes/released/6.0.0.md

@@ -1,4 +1,9 @@
----
-category: breaking
----
-* The "Guards" libraries (`semmle.code.cpp.controlflow.Guards` and `semmle.code.cpp.controlflow.IRGuards`) have been totally rewritten to recognize many more guards. The API remains unchanged, but the `GuardCondition` class now extends `Element` instead of `Expr`.
+## 6.0.0
+
+### Breaking Changes
+
+* The "Guards" libraries (`semmle.code.cpp.controlflow.Guards` and `semmle.code.cpp.controlflow.IRGuards`) have been totally rewritten to recognize many more guards. The API remains unchanged, but the `GuardCondition` class now extends `Element` instead of `Expr`.
+
+### New Features
+
+* C/C++ `build-mode: none` support is now generally available.

cpp/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 5.6.1
+lastReleaseVersion: 6.0.0

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/EllipticCurveAlgorithmInstance.qll

@@ -40,7 +40,7 @@ class KnownOpenSslEllipticCurveConstantAlgorithmInstance extends OpenSslAlgorith
     result = this.(Call).getTarget().getName()
   }
 
-  override Crypto::EllipticCurveFamilyType getEllipticCurveFamilyType() {
+  override Crypto::EllipticCurveType getEllipticCurveType() {
     if
       Crypto::ellipticCurveNameToKnownKeySizeAndFamilyMapping(this.getParsedEllipticCurveName(), _,
         _)

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/HashAlgorithmInstance.qll

@@ -72,7 +72,7 @@ class KnownOpenSslHashConstantAlgorithmInstance extends OpenSslAlgorithmInstance
 
   override OpenSslAlgorithmValueConsumer getAvc() { result = getterCall }
 
-  override Crypto::THashType getHashFamily() {
+  override Crypto::THashType getHashType() {
     knownOpenSslConstantToHashFamilyType(this, result)
     or
     not knownOpenSslConstantToHashFamilyType(this, _) and result = Crypto::OtherHashType()

cpp/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/cpp-all
-version: 5.6.2-dev
+version: 6.0.1-dev
 groups: cpp
 dbscheme: semmlecode.cpp.dbscheme
 extractor: cpp

cpp/ql/lib/semmle/code/cpp/controlflow/IRGuards.qll

@@ -380,18 +380,20 @@ private module LogicInput_v1 implements GuardsImpl::LogicInputSig {
     GuardsInput::Expr getARead() { result = this.getAUse().getDef() }
   }
 
-  class SsaWriteDefinition extends SsaDefinition instanceof ExplicitDefinition {
-    GuardsInput::Expr getDefinition() { result = super.getAssignedInstruction() }
+  class SsaExplicitWrite extends SsaDefinition instanceof ExplicitDefinition {
+    GuardsInput::Expr getValue() { result = super.getAssignedInstruction() }
   }
 
-  class SsaPhiNode extends SsaDefinition instanceof PhiNode {
+  class SsaPhiDefinition extends SsaDefinition instanceof PhiNode {
     predicate hasInputFromBlock(SsaDefinition inp, BasicBlock bb) {
       super.hasInputFromBlock(inp, bb)
     }
   }
 
-  predicate parameterDefinition(GuardsInput::Parameter p, SsaDefinition def) {
-    def.isParameterDefinition(p)
+  class SsaParameterInit extends SsaDefinition {
+    SsaParameterInit() { this.isParameterDefinition(_) }
+
+    GuardsInput::Parameter getParameter() { this.isParameterDefinition(result) }
   }
 
   predicate additionalImpliesStep(

cpp/ql/lib/semmle/code/cpp/rangeanalysis/RangeAnalysisUtils.qll

@@ -1,10 +1,10 @@
 import cpp
 
 /**
- * Describes whether a relation is 'strict' (that is, a `<` or `>`
+ * The strictness of a relation. Either 'strict' (that is, a `<` or `>`
  * relation) or 'non-strict' (a `<=` or `>=` relation).
  */
-newtype RelationStrictness =
+newtype TRelationStrictness =
   /**
    * Represents that a relation is 'strict' (that is, a `<` or `>` relation).
    */
@@ -14,6 +14,19 @@ newtype RelationStrictness =
    */
   Nonstrict()
 
+/**
+ * The strictness of a relation. Either 'strict' (that is, a `<` or `>`
+ * relation) or 'non-strict' (a `<=` or `>=` relation).
+ */
+class RelationStrictness extends TRelationStrictness {
+  /** Gets the string representation of this relation strictness. */
+  string toString() {
+    this = Strict() and result = "strict"
+    or
+    this = Nonstrict() and result = "non-strict"
+  }
+}
+
 /**
  * Describes whether a relation is 'greater' (that is, a `>` or `>=`
  * relation) or 'lesser' (a `<` or `<=` relation).
@@ -105,10 +118,10 @@ predicate relOpWithSwap(
  *
  * This allows for the relation to be either as written, or with its
  * arguments reversed; for example, if `rel` is `x < 5` then
- * `relOpWithSwapAndNegate(rel, x, 5, Lesser(), Strict(), true)`,
- * `relOpWithSwapAndNegate(rel, 5, x, Greater(), Strict(), true)`,
- * `relOpWithSwapAndNegate(rel, x, 5, Greater(), Nonstrict(), false)` and
- * `relOpWithSwapAndNegate(rel, 5, x, Lesser(), Nonstrict(), false)` hold.
+ * - `relOpWithSwapAndNegate(rel, x, 5, Lesser(), Strict(), true)`,
+ * - `relOpWithSwapAndNegate(rel, 5, x, Greater(), Strict(), true)`,
+ * - `relOpWithSwapAndNegate(rel, x, 5, Greater(), Nonstrict(), false)` and
+ * - `relOpWithSwapAndNegate(rel, 5, x, Lesser(), Nonstrict(), false)` hold.
  */
 predicate relOpWithSwapAndNegate(
   RelationalOperation rel, Expr a, Expr b, RelationDirection dir, RelationStrictness strict,

cpp/ql/lib/semmle/code/cpp/rangeanalysis/SimpleRangeAnalysis.qll

@@ -93,31 +93,42 @@ private float wideningUpperBounds(ArithmeticType t) {
   result = 1.0 / 0.0 // +Inf
 }
 
+/** Gets the widened lower bound for a given type and lower bound. */
+bindingset[type, lb]
+float widenLowerBound(Type type, float lb) {
+  result = max(float widenLB | widenLB = wideningLowerBounds(type) and widenLB <= lb | widenLB)
+}
+
+/** Gets the widened upper bound for a given type and upper bound. */
+bindingset[type, ub]
+float widenUpperBound(Type type, float ub) {
+  result = min(float widenUB | widenUB = wideningUpperBounds(type) and widenUB >= ub | widenUB)
+}
+
 /**
  * Gets the value of the expression `e`, if it is a constant.
  * This predicate also handles the case of constant variables initialized in different
  * compilation units, which doesn't necessarily have a getValue() result from the extractor.
  */
 private string getValue(Expr e) {
-  if exists(e.getValue())
-  then result = e.getValue()
-  else
-    /*
-     * It should be safe to propagate the initialization value to a variable if:
-     * The type of v is const, and
-     * The type of v is not volatile, and
-     * Either:
-     *   v is a local/global variable, or
-     *   v is a static member variable
-     */
+  result = e.getValue()
+  or
+  not exists(e.getValue()) and
+  /*
+   * It should be safe to propagate the initialization value to a variable if:
+   * The type of v is const, and
+   * The type of v is not volatile, and
+   * Either:
+   *   v is a local/global variable, or
+   *   v is a static member variable
+   */
 
-    exists(VariableAccess access, StaticStorageDurationVariable v |
-      not v.getUnderlyingType().isVolatile() and
-      v.getUnderlyingType().isConst() and
-      e = access and
-      v = access.getTarget() and
-      result = getValue(v.getAnAssignedValue())
-    )
+  exists(StaticStorageDurationVariable v |
+    not v.getUnderlyingType().isVolatile() and
+    v.getUnderlyingType().isConst() and
+    v = e.(VariableAccess).getTarget() and
+    result = getValue(v.getAnAssignedValue())
+  )
 }
 
 /**
@@ -505,6 +516,328 @@ private predicate isRecursiveExpr(Expr e) {
   )
 }
 
+/**
+ * Provides predicates that estimate the number of bounds that the range
+ * analysis might produce.
+ */
+private module BoundsEstimate {
+  /**
+   * Gets the limit beyond which we enable widening. That is, if the estimated
+   * number of bounds exceeds this limit, we enable widening such that the limit
+   * will not be reached.
+   */
+  float getBoundsLimit() {
+    // This limit is arbitrary, but low enough that it prevents timeouts on
+    // specific observed customer databases (and the in the tests).
+    result = 2.0.pow(40)
+  }
+
+  /** Gets the maximum number of bounds possible for `t` when widening is used. */
+  private int getNrOfWideningBounds(ArithmeticType t) {
+    result = strictcount(wideningLowerBounds(t)).maximum(strictcount(wideningUpperBounds(t)))
+  }
+
+  /**
+   * Holds if `boundFromGuard(guard, v, _, branch)` holds, but without
+   * relying on range analysis (which would cause non-monotonic recursion
+   * elsewhere).
+   */
+  private predicate hasBoundFromGuard(Expr guard, VariableAccess v, boolean branch) {
+    exists(Expr lhs | linearAccess(lhs, v, _, _) |
+      relOpWithSwapAndNegate(guard, lhs, _, _, _, branch)
+      or
+      eqOpWithSwapAndNegate(guard, lhs, _, true, branch)
+      or
+      eqZeroWithNegate(guard, lhs, true, branch)
+    )
+  }
+
+  /** Holds if `def` is a guard phi node for `v` with a bound from a guard. */
+  predicate isGuardPhiWithBound(RangeSsaDefinition def, StackVariable v, VariableAccess access) {
+    exists(Expr guard, boolean branch |
+      def.isGuardPhi(v, access, guard, branch) and
+      hasBoundFromGuard(guard, access, branch)
+    )
+  }
+
+  /**
+   * Gets the number of bounds for `def` when `def` is a guard phi node for the
+   * variable `v`.
+   */
+  language[monotonicAggregates]
+  private float nrOfBoundsPhiGuard(RangeSsaDefinition def, StackVariable v) {
+    // If we have
+    //
+    //   if (x < c) { e1 }
+    //   e2
+    //
+    // then `e2` is both a guard phi node (guarded by `x < c`) and a normal
+    // phi node (control is merged after the `if` statement).
+    //
+    // Assume `x` has `n` bounds. Then `n` bounds are propagated to the guard
+    // phi node `{ e1 }` and, since `{ e1 }` is input to `e2` as a normal phi
+    // node, `n` bounds are propagated to `e2`. If we also propagate the `n`
+    // bounds to `e2` as a guard phi node, then we square the number of
+    // bounds.
+    //
+    // However in practice `x < c` is going to cut down the number of bounds:
+    // The tracked bounds can't flow to both branches as that would require
+    // them to simultaneously be greater and smaller than `c`. To approximate
+    // this better, the contribution from a guard phi node that is also a
+    // normal phi node is 1.
+    exists(def.getAPhiInput(v)) and
+    isGuardPhiWithBound(def, v, _) and
+    result = 1
+    or
+    not exists(def.getAPhiInput(v)) and
+    // If there's different `access`es, then they refer to the same variable
+    // with the same lower bounds. Hence adding these guards make no sense (the
+    // implementation will take the union but they'll be removed by
+    // deduplication). Hence we use `max` as an approximation.
+    result =
+      max(VariableAccess access | isGuardPhiWithBound(def, v, access) | nrOfBoundsExpr(access))
+    or
+    def.isPhiNode(v) and
+    not isGuardPhiWithBound(def, v, _) and
+    result = 0
+  }
+
+  /**
+   * Gets the number of bounds for `def` when `def` is a normal phi node for the
+   * variable `v`.
+   */
+  language[monotonicAggregates]
+  private float nrOfBoundsPhiNormal(RangeSsaDefinition def, StackVariable v) {
+    result =
+      strictsum(RangeSsaDefinition inputDef |
+        inputDef = def.getAPhiInput(v)
+      |
+        nrOfBoundsDef(inputDef, v)
+      )
+    or
+    def.isPhiNode(v) and
+    not exists(def.getAPhiInput(v)) and
+    result = 0
+  }
+
+  /**
+   * Gets the number of bounds for `def` when `def` is an NE phi node for the
+   * variable `v`.
+   */
+  private float nrOfBoundsNEPhi(RangeSsaDefinition def, StackVariable v) {
+    exists(VariableAccess access | isNEPhi(v, def, access, _) and result = nrOfBoundsExpr(access))
+    or
+    def.isPhiNode(v) and
+    not isNEPhi(v, def, _, _) and
+    result = 0
+  }
+
+  /**
+   * Gets the number of bounds for `def` when `def` is an unsupported guard phi
+   * node for the variable `v`.
+   */
+  private float nrOfBoundsUnsupportedGuardPhi(RangeSsaDefinition def, StackVariable v) {
+    exists(VariableAccess access |
+      isUnsupportedGuardPhi(v, def, access) and
+      result = nrOfBoundsExpr(access)
+    )
+    or
+    def.isPhiNode(v) and
+    not isUnsupportedGuardPhi(v, def, _) and
+    result = 0
+  }
+
+  private float nrOfBoundsPhi(RangeSsaDefinition def, StackVariable v) {
+    // The cases for phi nodes are not mutually exclusive. For instance a phi
+    // node can be both a guard phi node and a normal phi node. To handle this
+    // we sum the contributions from the different cases.
+    result =
+      nrOfBoundsPhiGuard(def, v) + nrOfBoundsPhiNormal(def, v) + nrOfBoundsNEPhi(def, v) +
+        nrOfBoundsUnsupportedGuardPhi(def, v)
+  }
+
+  /** Gets the estimated number of bounds for `def` and `v`. */
+  float nrOfBoundsDef(RangeSsaDefinition def, StackVariable v) {
+    // Recursive definitions are already widened, so we simply estimate them as
+    // having the number of widening bounds available. This is crucial as it
+    // ensures that we don't follow recursive cycles when calculating the
+    // estimate. Had that not been the case the estimate itself would be at risk
+    // of causing performance issues and being non-functional.
+    if isRecursiveDef(def, v)
+    then result = getNrOfWideningBounds(getVariableRangeType(v))
+    else (
+      // Definitions with a defining value
+      exists(Expr defExpr | assignmentDef(def, v, defExpr) and result = nrOfBoundsExpr(defExpr))
+      or
+      // Assignment operations with a defining value
+      exists(AssignOperation assignOp |
+        def = assignOp and
+        assignOp.getLValue() = v.getAnAccess() and
+        result = nrOfBoundsExpr(assignOp)
+      )
+      or
+      // Phi nodes
+      result = nrOfBoundsPhi(def, v)
+      or
+      unanalyzableDefBounds(def, v, _, _) and result = 1
+    )
+  }
+
+  /**
+   * Gets a naive estimate of the number of bounds for `e`.
+   *
+   * The estimate is like an abstract interpretation of the range analysis,
+   * where the abstract value is the number of bounds. For instance,
+   * `nrOfBoundsExpr(12) = 1` and `nrOfBoundsExpr(x + y) = nrOfBoundsExpr(x) *
+   * nrOfBoundsExpr(y)`.
+   *
+   * The estimated number of bounds will usually be greater than the actual
+   * number of bounds, as the estimate can not detect cases where bounds are cut
+   * down when tracked precisely. For instance, in
+   * ```c
+   * int x = 1;
+   * if (cond) { x = 1; }
+   * int y = x + x;
+   * ```
+   * the actual number of bounds for `y` is 1. However, the estimate will be 4
+   * as the conditional assignment to `x` gives two bounds for `x` on the last
+   * line and the addition gives 2 * 2 bounds. There are two sources of anncuracies:
+   *
+   * 1. Without tracking the lower bounds we can't see that `x` is assigned a
+   * value that is equal to its lower bound.
+   * 2. Had the conditional assignment been `x = 2` then the estimate of two
+   * bounds for `x` would have been correct. However, the estimate of 4 for `y`
+   * would still be incorrect. Summing the actual bounds `{1,2}` with itself
+   * gives `{2,3,4}` which is only three bounds. Again, we can't realise this
+   * without tracking the bounds.
+   *
+   * Since these inaccuracies compound the estimated number of bounds can often
+   * be _much_ greater than the actual number of bounds. Do note though that the
+   * estimate is not _guaranteed_ to be an upper bound. In some cases the
+   * approximations might underestimate the number of bounds.
+   *
+   * This predicate is functional. This is crucial as:
+   *
+   * - It ensures that the computing the estimate itself is fast.
+   * - Our use of monotonic aggregates assumes functionality.
+   *
+   * Any non-functional case should be considered a bug.
+   */
+  float nrOfBoundsExpr(Expr e) {
+    // Similarly to what we do for definitions, we do not attempt to measure the
+    // number of bounds for recursive expressions.
+    if isRecursiveExpr(e)
+    then result = getNrOfWideningBounds(e.getUnspecifiedType())
+    else
+      if analyzableExpr(e)
+      then
+        // The cases here are an abstraction of and mirrors the cases inside
+        // `getLowerBoundsImpl`/`getUpperBoundsImpl`.
+        result = 1 and exists(getValue(e).toFloat())
+        or
+        exists(Expr operand | result = nrOfBoundsExpr(operand) |
+          effectivelyMultipliesByPositive(e, operand, _)
+          or
+          effectivelyMultipliesByNegative(e, operand, _)
+        )
+        or
+        exists(ConditionalExpr condExpr |
+          e = condExpr and
+          result = nrOfBoundsExpr(condExpr.getThen()) * nrOfBoundsExpr(condExpr.getElse())
+        )
+        or
+        exists(BinaryOperation binop |
+          e = binop and
+          result = nrOfBoundsExpr(binop.getLeftOperand()) * nrOfBoundsExpr(binop.getRightOperand())
+        |
+          e instanceof MaxExpr or
+          e instanceof MinExpr or
+          e instanceof AddExpr or
+          e instanceof SubExpr or
+          e instanceof UnsignedMulExpr or
+          e instanceof UnsignedBitwiseAndExpr
+        )
+        or
+        exists(AssignExpr assign | e = assign and result = nrOfBoundsExpr(assign.getRValue()))
+        or
+        exists(AssignArithmeticOperation assignOp |
+          e = assignOp and
+          result = nrOfBoundsExpr(assignOp.getLValue()) * nrOfBoundsExpr(assignOp.getRValue())
+        |
+          e instanceof AssignAddExpr or
+          e instanceof AssignSubExpr or
+          e instanceof UnsignedAssignMulExpr
+        )
+        or
+        // Handles `AssignMulByPositiveConstantExpr` and `AssignMulByNegativeConstantExpr`
+        exists(AssignMulByConstantExpr mulExpr |
+          e = mulExpr and
+          result = nrOfBoundsExpr(mulExpr.getLValue())
+        )
+        or
+        // Handles the prefix and postfix increment and decrement operators.
+        exists(CrementOperation crementOp |
+          e = crementOp and result = nrOfBoundsExpr(crementOp.getOperand())
+        )
+        or
+        exists(RemExpr remExpr | e = remExpr | result = nrOfBoundsExpr(remExpr.getRightOperand()))
+        or
+        exists(Conversion convExpr |
+          e = convExpr and
+          if convExpr.getUnspecifiedType() instanceof BoolType
+          then result = 1
+          else result = nrOfBoundsExpr(convExpr.getExpr())
+        )
+        or
+        exists(RangeSsaDefinition def, StackVariable v |
+          e = def.getAUse(v) and
+          result = nrOfBoundsDef(def, v) and
+          // Avoid returning two numbers when `e` is a use with a constant value.
+          not exists(getValue(e).toFloat())
+        )
+        or
+        exists(RShiftExpr rsExpr |
+          e = rsExpr and
+          exists(getValue(rsExpr.getRightOperand().getFullyConverted()).toInt()) and
+          result = nrOfBoundsExpr(rsExpr.getLeftOperand())
+        )
+      else (
+        exists(exprMinVal(e)) and result = 1
+      )
+  }
+}
+
+/**
+ * Holds if `v` is a variable for which widening should be used, as otherwise a
+ * very large number of bounds might be generated during the range analysis for
+ * `v`.
+ */
+private predicate varHasTooManyBounds(StackVariable v) {
+  exists(RangeSsaDefinition def |
+    def.getAVariable() = v and
+    BoundsEstimate::nrOfBoundsDef(def, v) > BoundsEstimate::getBoundsLimit()
+  )
+}
+
+/**
+ * Holds if `e` is an expression for which widening should be used, as otherwise
+ * a very large number of bounds might be generated during the range analysis
+ * for `e`.
+ */
+private predicate exprHasTooManyBounds(Expr e) {
+  BoundsEstimate::nrOfBoundsExpr(e) > BoundsEstimate::getBoundsLimit()
+  or
+  // A subexpressions of an expression with too many bounds may itself not have
+  // to many bounds. For instance, `x + y` can have too many bounds without `x`
+  // having as well. But in these cases, still want to consider `e` as having
+  // too many bounds since:
+  // - The overall result is widened anyway, so widening `e` as well is unlikely
+  //   to cause further precision loss.
+  // - The number of bounds could be very large but still below the arbitrary
+  //   limit. Hence widening `e` can improve performance.
+  exists(Expr pe | exprHasTooManyBounds(pe) and e.getParent() = pe)
+}
+
 /**
  * Holds if `binop` is a binary operation that's likely to be assigned a
  * quadratic (or more) number of candidate bounds during the analysis. This can
@@ -655,13 +988,8 @@ private float getTruncatedLowerBounds(Expr expr) {
     if exprMinVal(expr) <= newLB and newLB <= exprMaxVal(expr)
     then
       // Apply widening where we might get a combinatorial explosion.
-      if isRecursiveBinary(expr)
-      then
-        result =
-          max(float widenLB |
-            widenLB = wideningLowerBounds(expr.getUnspecifiedType()) and
-            not widenLB > newLB
-          )
+      if isRecursiveBinary(expr) or exprHasTooManyBounds(expr)
+      then result = widenLowerBound(expr.getUnspecifiedType(), newLB)
       else result = newLB
     else result = exprMinVal(expr)
   ) and
@@ -714,13 +1042,8 @@ private float getTruncatedUpperBounds(Expr expr) {
         if exprMinVal(expr) <= newUB and newUB <= exprMaxVal(expr)
         then
           // Apply widening where we might get a combinatorial explosion.
-          if isRecursiveBinary(expr)
-          then
-            result =
-              min(float widenUB |
-                widenUB = wideningUpperBounds(expr.getUnspecifiedType()) and
-                not widenUB < newUB
-              )
+          if isRecursiveBinary(expr) or exprHasTooManyBounds(expr)
+          then result = widenUpperBound(expr.getUnspecifiedType(), newUB)
           else result = newUB
         else result = exprMaxVal(expr)
       )
@@ -890,7 +1213,7 @@ private float getLowerBoundsImpl(Expr expr) {
       // equal to `min(-y + 1,y - 1)`.
       exists(float childLB |
         childLB = getFullyConvertedLowerBounds(remExpr.getAnOperand()) and
-        not childLB >= 0
+        childLB < 0
       |
         result = getFullyConvertedLowerBounds(remExpr.getRightOperand()) - 1
         or
@@ -1102,8 +1425,7 @@ private float getUpperBoundsImpl(Expr expr) {
       // adding `-rhsLB` to the set of upper bounds.
       exists(float rhsLB |
         rhsLB = getFullyConvertedLowerBounds(remExpr.getRightOperand()) and
-        not rhsLB >= 0
-      |
+        rhsLB < 0 and
         result = -rhsLB + 1
       )
     )
@@ -1248,8 +1570,7 @@ private float getPhiLowerBounds(StackVariable v, RangeSsaDefinition phi) {
   exists(VariableAccess access, Expr guard, boolean branch, float defLB, float guardLB |
     phi.isGuardPhi(v, access, guard, branch) and
     lowerBoundFromGuard(guard, access, guardLB, branch) and
-    defLB = getFullyConvertedLowerBounds(access)
-  |
+    defLB = getFullyConvertedLowerBounds(access) and
     // Compute the maximum of `guardLB` and `defLB`.
     if guardLB > defLB then result = guardLB else result = defLB
   )
@@ -1273,8 +1594,7 @@ private float getPhiUpperBounds(StackVariable v, RangeSsaDefinition phi) {
   exists(VariableAccess access, Expr guard, boolean branch, float defUB, float guardUB |
     phi.isGuardPhi(v, access, guard, branch) and
     upperBoundFromGuard(guard, access, guardUB, branch) and
-    defUB = getFullyConvertedUpperBounds(access)
-  |
+    defUB = getFullyConvertedUpperBounds(access) and
     // Compute the minimum of `guardUB` and `defUB`.
     if guardUB < defUB then result = guardUB else result = defUB
   )
@@ -1438,8 +1758,7 @@ private predicate upperBoundFromGuard(Expr guard, VariableAccess v, float ub, bo
 }
 
 /**
- * This predicate simplifies the results returned by
- * `linearBoundFromGuard`.
+ * This predicate simplifies the results returned by `linearBoundFromGuard`.
  */
 private predicate boundFromGuard(
   Expr guard, VariableAccess v, float boundValue, boolean isLowerBound,
@@ -1447,22 +1766,10 @@ private predicate boundFromGuard(
 ) {
   exists(float p, float q, float r, boolean isLB |
     linearBoundFromGuard(guard, v, p, q, r, isLB, strictness, branch) and
-    boundValue = (r - q) / p
-  |
+    boundValue = (r - q) / p and
     // If the multiplier is negative then the direction of the comparison
     // needs to be flipped.
-    p > 0 and isLowerBound = isLB
-    or
-    p < 0 and isLowerBound = isLB.booleanNot()
-  )
-  or
-  // When `!e` is true, we know that `0 <= e <= 0`
-  exists(float p, float q, Expr e |
-    linearAccess(e, v, p, q) and
-    eqZeroWithNegate(guard, e, true, branch) and
-    boundValue = (0.0 - q) / p and
-    isLowerBound = [false, true] and
-    strictness = Nonstrict()
+    if p < 0 then isLowerBound = isLB.booleanNot() else isLowerBound = isLB
   )
 }
 
@@ -1472,54 +1779,57 @@ private predicate boundFromGuard(
  * lower or upper bound for `v`.
  */
 private predicate linearBoundFromGuard(
-  ComparisonOperation guard, VariableAccess v, float p, float q, float boundValue,
+  Expr guard, VariableAccess v, float p, float q, float r,
   boolean isLowerBound, // Is this a lower or an upper bound?
   RelationStrictness strictness, boolean branch // Which control-flow branch is this bound valid on?
 ) {
-  // For the comparison x < RHS, we create two bounds:
-  //
-  //   1. x < upperbound(RHS)
-  //   2. x >= typeLowerBound(RHS.getUnspecifiedType())
-  //
-  exists(Expr lhs, Expr rhs, RelationDirection dir, RelationStrictness st |
-    linearAccess(lhs, v, p, q) and
-    relOpWithSwapAndNegate(guard, lhs, rhs, dir, st, branch)
-  |
-    isLowerBound = directionIsGreater(dir) and
-    strictness = st and
-    getBounds(rhs, boundValue, isLowerBound)
+  exists(Expr lhs | linearAccess(lhs, v, p, q) |
+    // For the comparison x < RHS, we create the following bounds:
+    //   1. x < upperbound(RHS)
+    //   2. x >= typeLowerBound(RHS.getUnspecifiedType())
+    exists(Expr rhs, RelationDirection dir, RelationStrictness st |
+      relOpWithSwapAndNegate(guard, lhs, rhs, dir, st, branch)
+    |
+      isLowerBound = directionIsGreater(dir) and
+      strictness = st and
+      r = getBounds(rhs, isLowerBound)
+      or
+      isLowerBound = directionIsLesser(dir) and
+      strictness = Nonstrict() and
+      r = getExprTypeBounds(rhs, isLowerBound)
+    )
     or
-    isLowerBound = directionIsLesser(dir) and
-    strictness = Nonstrict() and
-    exprTypeBounds(rhs, boundValue, isLowerBound)
-  )
-  or
-  // For x == RHS, we create the following bounds:
-  //
-  //   1. x <= upperbound(RHS)
-  //   2. x >= lowerbound(RHS)
-  //
-  exists(Expr lhs, Expr rhs |
-    linearAccess(lhs, v, p, q) and
-    eqOpWithSwapAndNegate(guard, lhs, rhs, true, branch) and
-    getBounds(rhs, boundValue, isLowerBound) and
+    // For x == RHS, we create the following bounds:
+    //   1. x <= upperbound(RHS)
+    //   2. x >= lowerbound(RHS)
+    exists(Expr rhs |
+      eqOpWithSwapAndNegate(guard, lhs, rhs, true, branch) and
+      r = getBounds(rhs, isLowerBound) and
+      strictness = Nonstrict()
+    )
+    or
+    // When `x` is equal to 0 we create the following bounds:
+    //   1. x <= 0
+    //   2. x >= 0
+    eqZeroWithNegate(guard, lhs, true, branch) and
+    r = 0.0 and
+    isLowerBound = [false, true] and
     strictness = Nonstrict()
   )
-  // x != RHS and !x are handled elsewhere
+}
+
+/** Get the fully converted lower or upper bounds of `expr` based on `isLowerBound`. */
+private float getBounds(Expr expr, boolean isLowerBound) {
+  isLowerBound = true and result = getFullyConvertedLowerBounds(expr)
+  or
+  isLowerBound = false and result = getFullyConvertedUpperBounds(expr)
 }
 
 /** Utility for `linearBoundFromGuard`. */
-private predicate getBounds(Expr expr, float boundValue, boolean isLowerBound) {
-  isLowerBound = true and boundValue = getFullyConvertedLowerBounds(expr)
+private float getExprTypeBounds(Expr expr, boolean isLowerBound) {
+  isLowerBound = true and result = exprMinVal(expr.getFullyConverted())
   or
-  isLowerBound = false and boundValue = getFullyConvertedUpperBounds(expr)
-}
-
-/** Utility for `linearBoundFromGuard`. */
-private predicate exprTypeBounds(Expr expr, float boundValue, boolean isLowerBound) {
-  isLowerBound = true and boundValue = exprMinVal(expr.getFullyConverted())
-  or
-  isLowerBound = false and boundValue = exprMaxVal(expr.getFullyConverted())
+  isLowerBound = false and result = exprMaxVal(expr.getFullyConverted())
 }
 
 /**
@@ -1810,18 +2120,12 @@ module SimpleRangeAnalysisInternal {
     |
       // Widening: check whether the new lower bound is from a source which
       // depends recursively on the current definition.
-      if isRecursiveDef(def, v)
+      if isRecursiveDef(def, v) or varHasTooManyBounds(v)
       then
         // The new lower bound is from a recursive source, so we round
         // down to one of a limited set of values to prevent the
         // recursion from exploding.
-        result =
-          max(float widenLB |
-            widenLB = wideningLowerBounds(getVariableRangeType(v)) and
-            not widenLB > truncatedLB
-          |
-            widenLB
-          )
+        result = widenLowerBound(getVariableRangeType(v), truncatedLB)
       else result = truncatedLB
     )
     or
@@ -1840,18 +2144,12 @@ module SimpleRangeAnalysisInternal {
     |
       // Widening: check whether the new upper bound is from a source which
       // depends recursively on the current definition.
-      if isRecursiveDef(def, v)
+      if isRecursiveDef(def, v) or varHasTooManyBounds(v)
       then
         // The new upper bound is from a recursive source, so we round
         // up to one of a fixed set of values to prevent the recursion
         // from exploding.
-        result =
-          min(float widenUB |
-            widenUB = wideningUpperBounds(getVariableRangeType(v)) and
-            not widenUB < truncatedUB
-          |
-            widenUB
-          )
+        result = widenUpperBound(getVariableRangeType(v), truncatedUB)
       else result = truncatedUB
     )
     or
@@ -1859,4 +2157,60 @@ module SimpleRangeAnalysisInternal {
     // bound is `typeUpperBound`.
     defMightOverflowNegatively(def, v) and result = varMaxVal(v)
   }
+
+  /** Gets the estimate of the number of bounds for `e`. */
+  float estimateNrOfBounds(Expr e) { result = BoundsEstimate::nrOfBoundsExpr(e) }
+}
+
+/** Provides predicates for debugging the simple range analysis library. */
+private module Debug {
+  Locatable getRelevantLocatable() {
+    exists(string filepath, int startline |
+      result.getLocation().hasLocationInfo(filepath, startline, _, _, _) and
+      filepath.matches("%/test.c") and
+      startline = [621 .. 639]
+    )
+  }
+
+  float debugGetLowerBoundsImpl(Expr e) {
+    e = getRelevantLocatable() and
+    result = getLowerBoundsImpl(e)
+  }
+
+  float debugGetUpperBoundsImpl(Expr e) {
+    e = getRelevantLocatable() and
+    result = getUpperBoundsImpl(e)
+  }
+
+  /**
+   * Counts the number of lower bounds for a given expression. This predicate is
+   * useful for identifying performance issues in the range analysis.
+   */
+  predicate countGetLowerBoundsImpl(Expr e, int n) {
+    e = getRelevantLocatable() and
+    n = strictcount(float lb | lb = getLowerBoundsImpl(e) | lb)
+  }
+
+  float debugNrOfBounds(Expr e) {
+    e = getRelevantLocatable() and
+    result = BoundsEstimate::nrOfBoundsExpr(e)
+  }
+
+  /**
+   * Finds any expressions for which `nrOfBounds` is not functional. The result
+   * should be empty, so this predicate is useful to debug non-functional cases.
+   */
+  int nonFunctionalNrOfBounds(Expr e) {
+    strictcount(BoundsEstimate::nrOfBoundsExpr(e)) > 1 and
+    result = BoundsEstimate::nrOfBoundsExpr(e)
+  }
+
+  /**
+   * Holds if `e` is an expression that has a lower bound, but where
+   * `nrOfBounds` does not compute an estimate.
+   */
+  predicate missingNrOfBounds(Expr e, float n) {
+    n = lowerBound(e) and
+    not exists(BoundsEstimate::nrOfBoundsExpr(e))
+  }
 }

cpp/ql/src/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 1.5.2
+
+No user-facing changes.
+
 ## 1.5.1
 
 No user-facing changes.

cpp/ql/src/Critical/OverflowDestination.ql

@@ -85,10 +85,8 @@ module OverflowDestinationConfig implements DataFlow::ConfigSig {
 
   predicate observeDiffInformedIncrementalMode() { any() }
 
-  Location getASelectedSourceLocation(DataFlow::Node source) { none() }
-
   Location getASelectedSinkLocation(DataFlow::Node sink) {
-    exists(FunctionCall fc | result = fc.getLocation() |
+    exists(FunctionCall fc | result = [fc.getLocation(), sink.getLocation()] |
       sourceSized(fc, sink.asIndirectConvertedExpr())
     )
   }

cpp/ql/src/Likely Bugs/Format/NonConstantFormat.ql

@@ -171,12 +171,10 @@ module NonConstFlowConfig implements DataFlow::ConfigSig {
 
   predicate observeDiffInformedIncrementalMode() { any() }
 
-  Location getASelectedSourceLocation(DataFlow::Node source) { none() }
-
   Location getASelectedSinkLocation(DataFlow::Node sink) {
-    result = sink.getLocation()
-    or
-    exists(FormattingFunctionCall call, Expr formatString | result = call.getLocation() |
+    exists(FormattingFunctionCall call, Expr formatString |
+      result = [call.getLocation(), sink.getLocation()]
+    |
       isSinkImpl(sink, formatString) and
       call.getArgument(call.getFormatParameterIndex()) = formatString
     )

cpp/ql/src/Security/CWE/CWE-078/ExecTainted.ql

@@ -155,7 +155,7 @@ module ExecTaintConfig implements DataFlow::StateConfigSig {
 
   Location getASelectedSinkLocation(DataFlow::Node sink) {
     exists(DataFlow::Node concatResult, Expr command, ExecState state |
-      result = [concatResult.getLocation(), command.getLocation()] and
+      result = [concatResult.getLocation(), command.getLocation(), sink.getLocation()] and
       isSink(sink, state) and
       isSinkImpl(sink, command, _) and
       concatResult = state.getOutgoingNode()

cpp/ql/src/Security/CWE/CWE-089/SqlTainted.ql

@@ -58,7 +58,9 @@ module SqlTaintedConfig implements DataFlow::ConfigSig {
   predicate observeDiffInformedIncrementalMode() { any() }
 
   Location getASelectedSinkLocation(DataFlow::Node sink) {
-    exists(Expr taintedArg | result = taintedArg.getLocation() | taintedArg = asSinkExpr(sink))
+    exists(Expr taintedArg | result = [taintedArg.getLocation(), sink.getLocation()] |
+      taintedArg = asSinkExpr(sink)
+    )
   }
 }
 

cpp/ql/src/Security/CWE/CWE-120/UnboundedWrite.ql

@@ -128,7 +128,7 @@ module Config implements DataFlow::ConfigSig {
   predicate observeDiffInformedIncrementalMode() { any() }
 
   Location getASelectedSinkLocation(DataFlow::Node sink) {
-    exists(BufferWrite bw | result = bw.getLocation() | isSink(sink, bw, _))
+    exists(BufferWrite bw | result = [bw.getLocation(), sink.getLocation()] | isSink(sink, bw, _))
   }
 }
 

cpp/ql/src/Security/CWE/CWE-190/ArithmeticUncontrolled.ql

@@ -124,7 +124,8 @@ module UncontrolledArithConfig implements DataFlow::ConfigSig {
   predicate observeDiffInformedIncrementalMode() { any() }
 
   Location getASelectedSourceLocation(DataFlow::Node source) {
-    result = getExpr(source).getLocation()
+    isSource(source) and
+    result = [getExpr(source).getLocation(), source.getLocation()]
   }
 }
 

cpp/ql/src/Security/CWE/CWE-190/TaintedAllocationSize.ql

@@ -95,7 +95,7 @@ module TaintedAllocationSizeConfig implements DataFlow::ConfigSig {
   predicate observeDiffInformedIncrementalMode() { any() }
 
   Location getASelectedSinkLocation(DataFlow::Node sink) {
-    exists(Expr alloc | result = alloc.getLocation() | allocSink(alloc, sink))
+    exists(Expr alloc | result = [alloc.getLocation(), sink.getLocation()] | allocSink(alloc, sink))
   }
 }
 

cpp/ql/src/Security/CWE/CWE-290/AuthenticationBypass.ql

@@ -76,7 +76,9 @@ module Config implements DataFlow::ConfigSig {
   predicate observeDiffInformedIncrementalMode() { any() }
 
   Location getASelectedSinkLocation(DataFlow::Node sink) {
-    exists(Expr condition | result = condition.getLocation() | isSink(sink, condition))
+    exists(Expr condition | result = [condition.getLocation(), sink.getLocation()] |
+      isSink(sink, condition)
+    )
   }
 }
 

cpp/ql/src/Security/CWE/CWE-311/CleartextBufferWrite.ql

@@ -51,7 +51,9 @@ module ToBufferConfig implements DataFlow::ConfigSig {
   predicate observeDiffInformedIncrementalMode() { any() }
 
   Location getASelectedSinkLocation(DataFlow::Node sink) {
-    exists(SensitiveBufferWrite w | result = w.getLocation() | isSinkImpl(sink, w))
+    exists(SensitiveBufferWrite w | result = [w.getLocation(), sink.getLocation()] |
+      isSinkImpl(sink, w)
+    )
   }
 }
 

cpp/ql/src/Security/CWE/CWE-311/CleartextFileWrite.ql

@@ -35,11 +35,13 @@ module FromSensitiveConfig implements DataFlow::ConfigSig {
   predicate observeDiffInformedIncrementalMode() { any() }
 
   Location getASelectedSourceLocation(DataFlow::Node sourceNode) {
-    exists(SensitiveExpr source | result = source.getLocation() | isSourceImpl(sourceNode, source))
+    exists(SensitiveExpr source | result = [source.getLocation(), sourceNode.getLocation()] |
+      isSourceImpl(sourceNode, source)
+    )
   }
 
   Location getASelectedSinkLocation(DataFlow::Node sink) {
-    exists(FileWrite w | result = w.getLocation() | isSinkImpl(sink, w, _))
+    exists(FileWrite w | result = [w.getLocation(), sink.getLocation()] | isSinkImpl(sink, w, _))
   }
 }
 

cpp/ql/src/Security/CWE/CWE-311/CleartextTransmission.ql

@@ -249,7 +249,9 @@ module FromSensitiveConfig implements DataFlow::ConfigSig {
   predicate observeDiffInformedIncrementalMode() { any() }
 
   Location getASelectedSinkLocation(DataFlow::Node sink) {
-    exists(NetworkSendRecv networkSendRecv | result = networkSendRecv.getLocation() |
+    exists(NetworkSendRecv networkSendRecv |
+      result = [networkSendRecv.getLocation(), sink.getLocation()]
+    |
       isSinkSendRecv(sink, networkSendRecv)
     )
   }

cpp/ql/src/Security/CWE/CWE-313/CleartextSqliteDatabase.ql

@@ -127,13 +127,13 @@ module FromSensitiveConfig implements DataFlow::ConfigSig {
   predicate observeDiffInformedIncrementalMode() { any() }
 
   Location getASelectedSourceLocation(DataFlow::Node source) {
-    exists(SensitiveExpr sensitive | result = sensitive.getLocation() |
+    exists(SensitiveExpr sensitive | result = [sensitive.getLocation(), source.getLocation()] |
       isSourceImpl(source, sensitive)
     )
   }
 
   Location getASelectedSinkLocation(DataFlow::Node sink) {
-    exists(SqliteFunctionCall sqliteCall | result = sqliteCall.getLocation() |
+    exists(SqliteFunctionCall sqliteCall | result = [sqliteCall.getLocation(), sink.getLocation()] |
       isSinkImpl(sink, sqliteCall, _)
     )
   }

cpp/ql/src/Security/CWE/CWE-319/UseOfHttp.ql

@@ -91,10 +91,9 @@ module HttpStringToUrlOpenConfig implements DataFlow::ConfigSig {
   predicate observeDiffInformedIncrementalMode() { any() }
 
   Location getASelectedSourceLocation(DataFlow::Node source) {
-    result = source.asIndirectExpr().getLocation()
+    isSource(source) and
+    result = [source.asIndirectExpr().getLocation(), source.getLocation()]
   }
-
-  Location getASelectedSinkLocation(DataFlow::Node sink) { none() }
 }
 
 module HttpStringToUrlOpen = TaintTracking::Global<HttpStringToUrlOpenConfig>;

cpp/ql/src/Security/CWE/CWE-327/BrokenCryptoAlgorithm.qhelp

@@ -3,11 +3,15 @@
   "qhelp.dtd">
 <qhelp>
 <overview>
-<p>Using broken or weak cryptographic algorithms can leave data vulnerable to being decrypted.</p>
+<p>Using broken or weak cryptographic algorithms may compromise security guarantees such as confidentiality, integrity, and authenticity.</p>
 
-<p>Many cryptographic algorithms provided by cryptography libraries are known to be weak, or 
-flawed. Using such an algorithm means that an attacker may be able to easily decrypt the encrypted
-data.</p>
+<p>Many cryptographic algorithms are known to be weak or flawed. The security guarantees of a system often rely on the underlying cryptography, so using a weak algorithm can have severe consequences. For example:
+</p>
+<ul>
+  <li>If a weak encryption algorithm is used, an attacker may be able to decrypt sensitive data.</li>
+  <li>If a weak hashing algorithm is used to protect data integrity, an attacker may be able to craft a malicious input that has the same hash as a benign one.</li>
+  <li>If a weak algorithm is used for digital signatures, an attacker may be able to forge signatures and impersonate legitimate users.</li>
+</ul>
 
 </overview>
 <recommendation>

cpp/ql/src/change-notes/released/1.5.2.md

@@ -0,0 +1,3 @@
+## 1.5.2
+
+No user-facing changes.

cpp/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.5.1
+lastReleaseVersion: 1.5.2

cpp/ql/src/experimental/Security/CWE/CWE-078/WordexpTainted.ql

@@ -50,8 +50,6 @@ module WordexpTaintConfig implements DataFlow::ConfigSig {
   }
 
   predicate observeDiffInformedIncrementalMode() { any() }
-
-  Location getASelectedSourceLocation(DataFlow::Node source) { none() }
 }
 
 module WordexpTaint = TaintTracking::Global<WordexpTaintConfig>;

cpp/ql/src/experimental/Security/CWE/CWE-193/ConstantSizeArrayOffByOne.ql

@@ -187,12 +187,14 @@ module ArrayAddressToDerefConfig implements DataFlow::StateConfigSig {
   predicate observeDiffInformedIncrementalMode() { any() }
 
   Location getASelectedSourceLocation(DataFlow::Node source) {
-    exists(Variable v | result = v.getLocation() | isSourceImpl(source, v))
+    exists(Variable v | result = v.getLocation() or result = source.getLocation() |
+      isSourceImpl(source, v)
+    )
   }
 
   Location getASelectedSinkLocation(DataFlow::Node sink) {
     exists(PointerArithmeticInstruction pai, Instruction deref |
-      result = [pai, deref].getLocation() and
+      result = [[pai, deref].getLocation(), sink.getLocation()] and
       isInvalidPointerDerefSink2(sink, deref, _) and
       isSink(sink, ArrayAddressToDerefConfig::TOverflowArithmetic(pai))
     )

cpp/ql/src/experimental/Security/CWE/CWE-409/DecompressionBombs.ql

@@ -31,8 +31,6 @@ module DecompressionTaintConfig implements DataFlow::ConfigSig {
 
   predicate observeDiffInformedIncrementalMode() { any() }
 
-  Location getASelectedSourceLocation(DataFlow::Node source) { none() }
-
   Location getASelectedSinkLocation(DataFlow::Node sink) {
     exists(FunctionCall fc | result = [sink.getLocation(), fc.getLocation()] | isSink(fc, sink))
   }

cpp/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/cpp-queries
-version: 1.5.2-dev
+version: 1.5.3-dev
 groups:
   - cpp
   - queries

cpp/ql/test/library-tests/controlflow/guards/GuardsControl.expected

@@ -115,7 +115,6 @@
 | test.c:127:9:127:9 | 1 | not 0 | test.c:131:10:132:16 | { ... } |
 | test.c:131:7:131:7 | b | not 0 | test.c:131:10:132:16 | { ... } |
 | test.c:131:7:131:7 | b | true | test.c:131:10:132:16 | { ... } |
-| test.c:137:7:137:7 | 0 | 0 | test.c:142:3:136:10 | return ... |
 | test.c:137:7:137:7 | 0 | false | test.c:142:3:136:10 | return ... |
 | test.c:145:16:145:16 | x | 0 | test.c:146:11:147:9 | { ... } |
 | test.c:146:7:146:8 | ! ... | true | test.c:146:11:147:9 | { ... } |

cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/lowerBound.expected

@@ -485,197 +485,519 @@
 | test.c:411:59:411:59 | k | 0.205191 |
 | test.c:411:63:411:63 | l | 0.132041 |
 | test.c:413:10:413:15 | output | 1.842468 |
-| test.c:418:20:418:20 | x | 0 |
-| test.c:418:30:418:30 | x | 0 |
-| test.c:421:3:421:4 | y1 | 0 |
-| test.c:421:11:421:11 | y | 0 |
-| test.c:421:14:421:14 | y | 1 |
-| test.c:422:3:422:4 | y2 | 0 |
-| test.c:422:9:422:9 | y | 1 |
-| test.c:422:14:422:14 | y | 2 |
-| test.c:422:22:422:22 | y | 5 |
-| test.c:423:10:423:11 | y1 | 1 |
-| test.c:423:15:423:16 | y2 | 5 |
-| test.c:431:3:431:3 | i | -2147483648 |
-| test.c:432:7:432:7 | i | 10 |
-| test.c:434:3:434:3 | i | -2147483648 |
-| test.c:435:3:435:3 | i | 10 |
-| test.c:436:7:436:7 | i | 20 |
-| test.c:438:3:438:3 | i | -2147483648 |
-| test.c:439:3:439:3 | i | 40 |
-| test.c:440:7:440:7 | i | 30 |
-| test.c:442:3:442:3 | i | -2147483648 |
-| test.c:442:7:442:7 | j | -2147483648 |
-| test.c:443:7:443:7 | i | 40 |
-| test.c:445:3:445:3 | i | -2147483648 |
-| test.c:445:8:445:8 | j | 40 |
-| test.c:446:7:446:7 | i | 50 |
-| test.c:448:3:448:3 | i | -2147483648 |
-| test.c:448:13:448:13 | j | 50 |
-| test.c:449:7:449:7 | i | 60 |
-| test.c:456:12:456:12 | a | 0 |
-| test.c:456:17:456:17 | a | 3 |
-| test.c:456:33:456:33 | b | 0 |
-| test.c:456:38:456:38 | b | 5 |
-| test.c:457:13:457:13 | a | 3 |
-| test.c:457:15:457:15 | b | 5 |
-| test.c:458:5:458:9 | total | 0 |
-| test.c:458:14:458:14 | r | 15 |
-| test.c:460:12:460:12 | a | 0 |
-| test.c:460:17:460:17 | a | 3 |
-| test.c:460:33:460:33 | b | 0 |
-| test.c:460:38:460:38 | b | 0 |
-| test.c:461:13:461:13 | a | 3 |
-| test.c:461:15:461:15 | b | 0 |
-| test.c:462:5:462:9 | total | 0 |
-| test.c:462:14:462:14 | r | 0 |
-| test.c:464:12:464:12 | a | 0 |
-| test.c:464:17:464:17 | a | 3 |
-| test.c:464:34:464:34 | b | 0 |
-| test.c:464:39:464:39 | b | 13 |
-| test.c:465:13:465:13 | a | 3 |
-| test.c:465:15:465:15 | b | 13 |
-| test.c:466:5:466:9 | total | 0 |
-| test.c:466:14:466:14 | r | 39 |
-| test.c:469:10:469:14 | total | 0 |
-| test.c:475:12:475:12 | b | 0 |
-| test.c:475:17:475:17 | b | 5 |
-| test.c:476:16:476:16 | b | 5 |
-| test.c:477:5:477:9 | total | 0 |
-| test.c:477:14:477:14 | r | 55 |
-| test.c:479:12:479:12 | b | 0 |
-| test.c:479:17:479:17 | b | 0 |
-| test.c:480:16:480:16 | b | 0 |
-| test.c:481:5:481:9 | total | 0 |
-| test.c:481:14:481:14 | r | 0 |
-| test.c:483:13:483:13 | b | 0 |
-| test.c:483:18:483:18 | b | 13 |
-| test.c:484:16:484:16 | b | 13 |
-| test.c:485:5:485:9 | total | 0 |
-| test.c:485:14:485:14 | r | 143 |
-| test.c:488:10:488:14 | total | 0 |
-| test.c:493:3:493:3 | x | 0 |
-| test.c:493:7:493:7 | y | 0 |
-| test.c:494:3:494:4 | xy | 0 |
-| test.c:494:8:494:8 | x | 1000000003 |
-| test.c:494:12:494:12 | y | 1000000003 |
-| test.c:495:10:495:11 | xy | 1000000006000000000 |
-| test.c:500:3:500:3 | x | 0 |
-| test.c:501:3:501:3 | y | 0 |
-| test.c:502:3:502:4 | xy | 0 |
-| test.c:502:8:502:8 | x | 274177 |
-| test.c:502:12:502:12 | y | 67280421310721 |
-| test.c:503:10:503:11 | xy | 18446744073709551616 |
-| test.c:507:7:507:8 | ui | 0 |
-| test.c:508:43:508:44 | ui | 10 |
-| test.c:508:48:508:49 | ui | 10 |
-| test.c:509:12:509:17 | result | 100 |
-| test.c:511:7:511:8 | ul | 0 |
-| test.c:512:28:512:29 | ul | 10 |
-| test.c:512:33:512:34 | ul | 10 |
-| test.c:513:12:513:17 | result | 0 |
-| test.c:519:7:519:8 | ui | 0 |
-| test.c:519:19:519:20 | ui | 0 |
-| test.c:520:5:520:6 | ui | 2 |
-| test.c:520:11:520:12 | ui | 2 |
-| test.c:521:12:521:13 | ui | 4 |
-| test.c:525:3:525:9 | uiconst | 10 |
-| test.c:528:3:528:9 | ulconst | 10 |
-| test.c:529:10:529:16 | uiconst | 40 |
-| test.c:529:20:529:26 | ulconst | 40 |
-| test.c:533:7:533:7 | i | -2147483648 |
-| test.c:533:18:533:18 | i | -1 |
-| test.c:534:5:534:5 | i | -2147483648 |
-| test.c:534:13:534:13 | i | -1 |
-| test.c:535:9:535:9 | i | -5 |
-| test.c:537:5:537:5 | i | -2147483648 |
-| test.c:537:9:537:9 | i | -5 |
-| test.c:538:9:538:9 | i | -30 |
-| test.c:540:5:540:5 | i | -30 |
-| test.c:541:9:541:9 | i | -210 |
-| test.c:543:5:543:5 | i | -210 |
-| test.c:544:9:544:9 | i | -1155 |
-| test.c:546:7:546:7 | i | -2147483648 |
-| test.c:547:5:547:5 | i | -2147483648 |
-| test.c:547:9:547:9 | i | -1 |
-| test.c:548:9:548:9 | i | 1 |
-| test.c:550:3:550:3 | i | -2147483648 |
-| test.c:550:7:550:7 | i | -2147483648 |
-| test.c:551:10:551:10 | i | -2147483648 |
-| test.c:554:3:554:3 | i | -2147483648 |
-| test.c:554:10:554:11 | sc | 1 |
-| test.c:556:7:556:7 | i | -128 |
-| test.c:563:7:563:7 | n | 0 |
-| test.c:565:7:565:7 | n | 0 |
-| test.c:566:9:566:9 | n | 1 |
-| test.c:569:7:569:7 | n | 0 |
-| test.c:570:9:570:9 | n | 1 |
-| test.c:572:9:572:9 | n | 0 |
-| test.c:575:8:575:8 | n | 0 |
-| test.c:576:9:576:9 | n | 0 |
-| test.c:578:9:578:9 | n | 1 |
-| test.c:581:10:581:10 | n | 0 |
-| test.c:582:5:582:5 | n | 1 |
-| test.c:585:7:585:7 | n | 0 |
-| test.c:589:7:589:7 | n | -32768 |
-| test.c:592:7:592:7 | n | 0 |
-| test.c:593:9:593:9 | n | 0 |
-| test.c:595:9:595:9 | n | 1 |
-| test.c:598:7:598:7 | n | 0 |
-| test.c:599:9:599:9 | n | 1 |
-| test.c:601:9:601:9 | n | 0 |
-| test.c:604:10:604:10 | n | 0 |
-| test.c:605:5:605:5 | n | 1 |
-| test.c:608:7:608:7 | n | 0 |
-| test.c:612:7:612:7 | n | -32768 |
-| test.c:613:9:613:9 | n | -32768 |
-| test.c:614:11:614:11 | n | 0 |
-| test.c:618:7:618:7 | n | -32768 |
-| test.c:619:13:619:13 | n | 5 |
-| test.c:622:9:622:9 | n | 6 |
-| test.c:625:7:625:7 | n | -32768 |
-| test.c:625:22:625:22 | n | -32767 |
-| test.c:626:9:626:9 | n | -32766 |
-| test.c:629:7:629:7 | n | -32768 |
-| test.c:630:5:630:5 | n | 0 |
-| test.c:630:10:630:10 | n | 1 |
-| test.c:630:14:630:14 | n | 0 |
-| test.c:631:6:631:6 | n | 0 |
-| test.c:631:10:631:10 | n | 0 |
-| test.c:631:14:631:14 | n | 1 |
-| test.c:642:7:642:8 | ss | -32768 |
-| test.c:643:9:643:10 | ss | 0 |
-| test.c:646:7:646:8 | ss | -32768 |
-| test.c:647:9:647:10 | ss | -32768 |
-| test.c:650:14:650:15 | us | 0 |
-| test.c:651:9:651:10 | us | 0 |
-| test.c:654:14:654:15 | us | 0 |
-| test.c:655:9:655:10 | us | 0 |
-| test.c:658:7:658:8 | ss | -32768 |
-| test.c:659:9:659:10 | ss | -32768 |
-| test.c:662:7:662:8 | ss | -32768 |
-| test.c:663:9:663:10 | ss | -1 |
-| test.c:669:8:669:8 | s | -2147483648 |
-| test.c:669:15:669:15 | s | 0 |
-| test.c:669:23:669:23 | s | 0 |
-| test.c:670:18:670:18 | s | 0 |
-| test.c:670:22:670:22 | s | 0 |
-| test.c:671:9:671:14 | result | 0 |
-| test.c:677:7:677:7 | i | 0 |
-| test.c:678:9:678:9 | i | -2147483648 |
-| test.c:682:7:682:7 | u | 0 |
-| test.c:683:9:683:9 | u | 0 |
-| test.c:688:12:688:12 | s | -2147483648 |
-| test.c:689:7:689:8 | s2 | -4 |
-| test.c:694:7:694:7 | x | -2147483648 |
-| test.c:695:9:695:9 | y | -2147483648 |
-| test.c:699:7:699:7 | y | -2147483648 |
-| test.c:708:7:708:7 | x | -2147483648 |
-| test.c:713:7:713:7 | x | -2147483648 |
-| test.c:720:8:720:8 | x | 2147483647 |
-| test.c:720:12:720:12 | y | 256 |
-| test.c:721:9:721:9 | x | 2147483647 |
-| test.c:722:9:722:9 | y | 256 |
+| test.c:420:7:420:9 | rhs | 0 |
+| test.c:420:19:420:21 | rhs | 0 |
+| test.c:421:7:421:9 | rhs | 0 |
+| test.c:421:19:421:21 | rhs | 0 |
+| test.c:422:7:422:9 | rhs | 0 |
+| test.c:422:19:422:21 | rhs | 0 |
+| test.c:423:7:423:9 | rhs | 0 |
+| test.c:423:19:423:21 | rhs | 0 |
+| test.c:424:7:424:9 | rhs | 0 |
+| test.c:424:19:424:21 | rhs | 0 |
+| test.c:425:10:425:12 | rhs | 0 |
+| test.c:432:10:432:11 | ip | 0 |
+| test.c:432:20:432:21 | ip | 0 |
+| test.c:432:40:432:41 | ip | 0 |
+| test.c:433:14:433:15 | ip | 1 |
+| test.c:434:14:434:15 | ip | 0 |
+| test.c:434:34:434:35 | ip | 0 |
+| test.c:435:11:435:12 | ip | 0 |
+| test.c:436:13:436:14 | ip | 0 |
+| test.c:437:14:437:15 | ip | 0 |
+| test.c:438:14:438:15 | ip | 0 |
+| test.c:439:15:439:16 | ip | 0 |
+| test.c:439:41:439:42 | ip | 0 |
+| test.c:439:52:439:53 | ip | 0 |
+| test.c:439:67:439:68 | ip | 0 |
+| test.c:439:78:439:79 | ip | 0 |
+| test.c:440:18:440:19 | ip | 0 |
+| test.c:441:23:441:24 | ip | 0 |
+| test.c:441:34:441:35 | ip | 0 |
+| test.c:442:25:442:26 | ip | 0 |
+| test.c:443:20:443:21 | ip | 0 |
+| test.c:444:11:444:12 | ip | 0 |
+| test.c:444:26:444:27 | ip | 0 |
+| test.c:445:16:445:17 | ip | 0 |
+| test.c:446:16:446:17 | ip | 0 |
+| test.c:447:16:447:17 | ip | 0 |
+| test.c:448:17:448:18 | ip | 0 |
+| test.c:449:22:449:23 | ip | 0 |
+| test.c:449:33:449:34 | ip | 0 |
+| test.c:449:48:449:49 | ip | 0 |
+| test.c:449:59:449:60 | ip | 0 |
+| test.c:450:20:450:21 | ip | 0 |
+| test.c:451:25:451:26 | ip | 0 |
+| test.c:451:36:451:37 | ip | 0 |
+| test.c:452:27:452:28 | ip | 0 |
+| test.c:453:22:453:23 | ip | 0 |
+| test.c:454:15:454:16 | ip | 0 |
+| test.c:454:30:454:31 | ip | 0 |
+| test.c:455:11:455:12 | ip | 0 |
+| test.c:456:12:456:13 | ip | 0 |
+| test.c:457:12:457:13 | ip | 0 |
+| test.c:458:13:458:14 | ip | 0 |
+| test.c:458:39:458:40 | ip | 0 |
+| test.c:458:50:458:51 | ip | 0 |
+| test.c:458:65:458:66 | ip | 0 |
+| test.c:458:76:458:77 | ip | 0 |
+| test.c:459:16:459:17 | ip | 0 |
+| test.c:460:21:460:22 | ip | 0 |
+| test.c:460:32:460:33 | ip | 0 |
+| test.c:461:23:461:24 | ip | 0 |
+| test.c:462:18:462:19 | ip | 0 |
+| test.c:463:11:463:12 | ip | 0 |
+| test.c:463:17:463:18 | ip | 0 |
+| test.c:463:37:463:38 | ip | 0 |
+| test.c:463:43:463:44 | ip | 0 |
+| test.c:464:14:464:15 | ip | 0 |
+| test.c:465:14:465:15 | ip | 0 |
+| test.c:466:14:466:15 | ip | 0 |
+| test.c:467:15:467:16 | ip | 0 |
+| test.c:467:41:467:42 | ip | 0 |
+| test.c:467:52:467:53 | ip | 0 |
+| test.c:467:67:467:68 | ip | 0 |
+| test.c:467:78:467:79 | ip | 0 |
+| test.c:468:18:468:19 | ip | 0 |
+| test.c:469:23:469:24 | ip | 0 |
+| test.c:469:34:469:35 | ip | 0 |
+| test.c:470:25:470:26 | ip | 0 |
+| test.c:471:20:471:21 | ip | 0 |
+| test.c:472:14:472:15 | ip | 0 |
+| test.c:472:20:472:21 | ip | 0 |
+| test.c:473:16:473:17 | ip | 0 |
+| test.c:474:12:474:13 | ip | 0 |
+| test.c:475:14:475:15 | ip | 0 |
+| test.c:476:15:476:16 | ip | 0 |
+| test.c:477:16:477:17 | ip | 0 |
+| test.c:478:16:478:17 | ip | 0 |
+| test.c:479:17:479:18 | ip | 0 |
+| test.c:480:22:480:23 | ip | 0 |
+| test.c:480:33:480:34 | ip | 0 |
+| test.c:480:48:480:49 | ip | 0 |
+| test.c:480:59:480:60 | ip | 0 |
+| test.c:481:20:481:21 | ip | 0 |
+| test.c:482:25:482:26 | ip | 0 |
+| test.c:482:36:482:37 | ip | 0 |
+| test.c:483:27:483:28 | ip | 0 |
+| test.c:484:22:484:23 | ip | 0 |
+| test.c:485:13:485:14 | ip | 0 |
+| test.c:485:28:485:29 | ip | 0 |
+| test.c:486:18:486:19 | ip | 0 |
+| test.c:487:18:487:19 | ip | 0 |
+| test.c:488:18:488:19 | ip | 0 |
+| test.c:489:19:489:20 | ip | 0 |
+| test.c:490:24:490:25 | ip | 0 |
+| test.c:490:35:490:36 | ip | 0 |
+| test.c:490:50:490:51 | ip | 0 |
+| test.c:490:61:490:62 | ip | 0 |
+| test.c:491:22:491:23 | ip | 0 |
+| test.c:492:27:492:28 | ip | 0 |
+| test.c:492:38:492:39 | ip | 0 |
+| test.c:493:29:493:30 | ip | 0 |
+| test.c:494:24:494:25 | ip | 0 |
+| test.c:495:17:495:18 | ip | 0 |
+| test.c:495:32:495:33 | ip | 0 |
+| test.c:496:14:496:15 | ip | 0 |
+| test.c:497:18:497:19 | ip | 0 |
+| test.c:498:18:498:19 | ip | 0 |
+| test.c:499:19:499:20 | ip | 0 |
+| test.c:500:24:500:25 | ip | 0 |
+| test.c:500:35:500:36 | ip | 0 |
+| test.c:500:50:500:51 | ip | 0 |
+| test.c:500:61:500:62 | ip | 0 |
+| test.c:501:22:501:23 | ip | 0 |
+| test.c:502:27:502:28 | ip | 0 |
+| test.c:502:38:502:39 | ip | 0 |
+| test.c:503:29:503:30 | ip | 0 |
+| test.c:504:24:504:25 | ip | 0 |
+| test.c:505:17:505:18 | ip | 0 |
+| test.c:505:23:505:24 | ip | 0 |
+| test.c:505:43:505:44 | ip | 0 |
+| test.c:505:49:505:50 | ip | 0 |
+| test.c:506:16:506:17 | ip | 0 |
+| test.c:507:16:507:17 | ip | 0 |
+| test.c:508:16:508:17 | ip | 0 |
+| test.c:509:17:509:18 | ip | 0 |
+| test.c:510:22:510:23 | ip | 0 |
+| test.c:510:33:510:34 | ip | 0 |
+| test.c:510:48:510:49 | ip | 0 |
+| test.c:510:59:510:60 | ip | 0 |
+| test.c:511:20:511:21 | ip | 0 |
+| test.c:512:25:512:26 | ip | 0 |
+| test.c:512:36:512:37 | ip | 0 |
+| test.c:513:27:513:28 | ip | 0 |
+| test.c:514:22:514:23 | ip | 0 |
+| test.c:515:16:515:17 | ip | 0 |
+| test.c:515:22:515:23 | ip | 0 |
+| test.c:516:18:516:19 | ip | 0 |
+| test.c:517:14:517:15 | ip | 0 |
+| test.c:518:14:518:15 | ip | 0 |
+| test.c:518:24:518:25 | ip | 0 |
+| test.c:518:44:518:45 | ip | 0 |
+| test.c:519:16:519:17 | ip | 1 |
+| test.c:520:16:520:17 | ip | 0 |
+| test.c:520:36:520:37 | ip | 0 |
+| test.c:521:14:521:15 | ip | 0 |
+| test.c:522:19:522:20 | ip | 0 |
+| test.c:523:20:523:21 | ip | 0 |
+| test.c:524:20:524:21 | ip | 0 |
+| test.c:525:21:525:22 | ip | 0 |
+| test.c:526:26:526:27 | ip | 0 |
+| test.c:526:37:526:38 | ip | 0 |
+| test.c:526:52:526:53 | ip | 0 |
+| test.c:526:63:526:64 | ip | 0 |
+| test.c:527:24:527:25 | ip | 0 |
+| test.c:528:29:528:30 | ip | 0 |
+| test.c:528:40:528:41 | ip | 0 |
+| test.c:529:31:529:32 | ip | 0 |
+| test.c:530:26:530:27 | ip | 0 |
+| test.c:531:17:531:18 | ip | 0 |
+| test.c:531:32:531:33 | ip | 0 |
+| test.c:532:22:532:23 | ip | 0 |
+| test.c:533:22:533:23 | ip | 0 |
+| test.c:534:22:534:23 | ip | 0 |
+| test.c:535:23:535:24 | ip | 0 |
+| test.c:536:28:536:29 | ip | 0 |
+| test.c:536:39:536:40 | ip | 0 |
+| test.c:536:54:536:55 | ip | 0 |
+| test.c:536:65:536:66 | ip | 0 |
+| test.c:537:26:537:27 | ip | 0 |
+| test.c:538:31:538:32 | ip | 0 |
+| test.c:538:42:538:43 | ip | 0 |
+| test.c:539:33:539:34 | ip | 0 |
+| test.c:540:28:540:29 | ip | 0 |
+| test.c:541:21:541:22 | ip | 0 |
+| test.c:541:36:541:37 | ip | 0 |
+| test.c:542:17:542:18 | ip | 0 |
+| test.c:543:18:543:19 | ip | 0 |
+| test.c:544:18:544:19 | ip | 0 |
+| test.c:545:19:545:20 | ip | 0 |
+| test.c:546:24:546:25 | ip | 0 |
+| test.c:546:35:546:36 | ip | 0 |
+| test.c:546:50:546:51 | ip | 0 |
+| test.c:546:61:546:62 | ip | 0 |
+| test.c:547:22:547:23 | ip | 0 |
+| test.c:548:27:548:28 | ip | 0 |
+| test.c:548:38:548:39 | ip | 0 |
+| test.c:549:29:549:30 | ip | 0 |
+| test.c:550:24:550:25 | ip | 0 |
+| test.c:551:17:551:18 | ip | 0 |
+| test.c:551:23:551:24 | ip | 0 |
+| test.c:551:43:551:44 | ip | 0 |
+| test.c:551:49:551:50 | ip | 0 |
+| test.c:552:20:552:21 | ip | 0 |
+| test.c:553:20:553:21 | ip | 0 |
+| test.c:554:20:554:21 | ip | 0 |
+| test.c:555:21:555:22 | ip | 0 |
+| test.c:556:26:556:27 | ip | 0 |
+| test.c:556:37:556:38 | ip | 0 |
+| test.c:556:52:556:53 | ip | 0 |
+| test.c:556:63:556:64 | ip | 0 |
+| test.c:557:24:557:25 | ip | 0 |
+| test.c:558:29:558:30 | ip | 0 |
+| test.c:558:40:558:41 | ip | 0 |
+| test.c:559:31:559:32 | ip | 0 |
+| test.c:560:26:560:27 | ip | 0 |
+| test.c:561:20:561:21 | ip | 0 |
+| test.c:561:26:561:27 | ip | 0 |
+| test.c:562:22:562:23 | ip | 0 |
+| test.c:563:18:563:19 | ip | 0 |
+| test.c:564:16:564:17 | ip | 0 |
+| test.c:565:17:565:18 | ip | 0 |
+| test.c:566:18:566:19 | ip | 0 |
+| test.c:567:18:567:19 | ip | 0 |
+| test.c:568:19:568:20 | ip | 0 |
+| test.c:569:24:569:25 | ip | 0 |
+| test.c:569:35:569:36 | ip | 0 |
+| test.c:569:50:569:51 | ip | 0 |
+| test.c:569:61:569:62 | ip | 0 |
+| test.c:570:22:570:23 | ip | 0 |
+| test.c:571:27:571:28 | ip | 0 |
+| test.c:571:38:571:39 | ip | 0 |
+| test.c:572:29:572:30 | ip | 0 |
+| test.c:573:24:573:25 | ip | 0 |
+| test.c:574:15:574:16 | ip | 0 |
+| test.c:574:30:574:31 | ip | 0 |
+| test.c:575:20:575:21 | ip | 0 |
+| test.c:576:20:576:21 | ip | 0 |
+| test.c:577:20:577:21 | ip | 0 |
+| test.c:578:21:578:22 | ip | 0 |
+| test.c:579:26:579:27 | ip | 0 |
+| test.c:579:37:579:38 | ip | 0 |
+| test.c:579:52:579:53 | ip | 0 |
+| test.c:579:63:579:64 | ip | 0 |
+| test.c:580:24:580:25 | ip | 0 |
+| test.c:581:29:581:30 | ip | 0 |
+| test.c:581:40:581:41 | ip | 0 |
+| test.c:582:31:582:32 | ip | 0 |
+| test.c:583:26:583:27 | ip | 0 |
+| test.c:584:19:584:20 | ip | 0 |
+| test.c:584:34:584:35 | ip | 0 |
+| test.c:585:16:585:17 | ip | 0 |
+| test.c:586:20:586:21 | ip | 0 |
+| test.c:587:20:587:21 | ip | 0 |
+| test.c:588:21:588:22 | ip | 0 |
+| test.c:589:26:589:27 | ip | 0 |
+| test.c:589:37:589:38 | ip | 0 |
+| test.c:589:52:589:53 | ip | 0 |
+| test.c:589:63:589:64 | ip | 0 |
+| test.c:590:24:590:25 | ip | 0 |
+| test.c:591:29:591:30 | ip | 0 |
+| test.c:591:40:591:41 | ip | 0 |
+| test.c:592:31:592:32 | ip | 0 |
+| test.c:593:26:593:27 | ip | 0 |
+| test.c:594:19:594:20 | ip | 0 |
+| test.c:594:25:594:26 | ip | 0 |
+| test.c:594:45:594:46 | ip | 0 |
+| test.c:594:51:594:52 | ip | 0 |
+| test.c:595:18:595:19 | ip | 0 |
+| test.c:596:18:596:19 | ip | 0 |
+| test.c:597:18:597:19 | ip | 0 |
+| test.c:598:19:598:20 | ip | 0 |
+| test.c:599:24:599:25 | ip | 0 |
+| test.c:599:35:599:36 | ip | 0 |
+| test.c:599:50:599:51 | ip | 0 |
+| test.c:599:61:599:62 | ip | 0 |
+| test.c:600:22:600:23 | ip | 0 |
+| test.c:601:27:601:28 | ip | 0 |
+| test.c:601:38:601:39 | ip | 0 |
+| test.c:602:29:602:30 | ip | 0 |
+| test.c:603:24:603:25 | ip | 0 |
+| test.c:604:18:604:19 | ip | 0 |
+| test.c:604:24:604:25 | ip | 0 |
+| test.c:605:20:605:21 | ip | 0 |
+| test.c:606:16:606:17 | ip | 0 |
+| test.c:607:10:607:23 | special_number | 0 |
+| test.c:615:7:615:8 | c1 | -2147483648 |
+| test.c:615:13:615:13 | x | 0 |
+| test.c:616:7:616:8 | c2 | -2147483648 |
+| test.c:616:13:616:13 | x | 0 |
+| test.c:617:7:617:8 | c3 | -2147483648 |
+| test.c:617:13:617:13 | x | 0 |
+| test.c:618:7:618:8 | c4 | -2147483648 |
+| test.c:618:13:618:13 | x | 0 |
+| test.c:619:7:619:8 | c5 | -2147483648 |
+| test.c:619:13:619:13 | x | 0 |
+| test.c:620:7:620:8 | c1 | -2147483648 |
+| test.c:620:13:620:14 | c2 | -2147483648 |
+| test.c:620:19:620:19 | x | 0 |
+| test.c:621:7:621:8 | c1 | -2147483648 |
+| test.c:621:13:621:14 | c3 | -2147483648 |
+| test.c:621:19:621:19 | x | 0 |
+| test.c:622:7:622:8 | c1 | -2147483648 |
+| test.c:622:13:622:14 | c4 | -2147483648 |
+| test.c:622:19:622:19 | x | 0 |
+| test.c:623:7:623:8 | c1 | -2147483648 |
+| test.c:623:13:623:14 | c5 | -2147483648 |
+| test.c:623:19:623:19 | x | 0 |
+| test.c:624:7:624:8 | c2 | -2147483648 |
+| test.c:624:13:624:14 | c3 | -2147483648 |
+| test.c:624:19:624:19 | x | 0 |
+| test.c:626:11:626:11 | x | 0 |
+| test.c:626:15:626:15 | x | 0 |
+| test.c:626:19:626:19 | x | 0 |
+| test.c:626:23:626:23 | x | 0 |
+| test.c:626:27:626:27 | x | 0 |
+| test.c:626:31:626:31 | x | 0 |
+| test.c:626:35:626:35 | x | 0 |
+| test.c:626:39:626:39 | x | 0 |
+| test.c:626:43:626:43 | x | 0 |
+| test.c:626:47:626:47 | x | 0 |
+| test.c:626:51:626:51 | x | 0 |
+| test.c:626:55:626:55 | x | 0 |
+| test.c:627:10:627:10 | y | -2147483648 |
+| test.c:632:20:632:20 | x | 0 |
+| test.c:632:30:632:30 | x | 0 |
+| test.c:635:3:635:4 | y1 | 0 |
+| test.c:635:11:635:11 | y | 0 |
+| test.c:635:14:635:14 | y | 1 |
+| test.c:636:3:636:4 | y2 | 0 |
+| test.c:636:9:636:9 | y | 1 |
+| test.c:636:14:636:14 | y | 2 |
+| test.c:636:22:636:22 | y | 5 |
+| test.c:637:10:637:11 | y1 | 1 |
+| test.c:637:15:637:16 | y2 | 5 |
+| test.c:645:3:645:3 | i | -2147483648 |
+| test.c:646:7:646:7 | i | 10 |
+| test.c:648:3:648:3 | i | -2147483648 |
+| test.c:649:3:649:3 | i | 10 |
+| test.c:650:7:650:7 | i | 20 |
+| test.c:652:3:652:3 | i | -2147483648 |
+| test.c:653:3:653:3 | i | 40 |
+| test.c:654:7:654:7 | i | 30 |
+| test.c:656:3:656:3 | i | -2147483648 |
+| test.c:656:7:656:7 | j | -2147483648 |
+| test.c:657:7:657:7 | i | 40 |
+| test.c:659:3:659:3 | i | -2147483648 |
+| test.c:659:8:659:8 | j | 40 |
+| test.c:660:7:660:7 | i | 50 |
+| test.c:662:3:662:3 | i | -2147483648 |
+| test.c:662:13:662:13 | j | 50 |
+| test.c:663:7:663:7 | i | 60 |
+| test.c:670:12:670:12 | a | 0 |
+| test.c:670:17:670:17 | a | 3 |
+| test.c:670:33:670:33 | b | 0 |
+| test.c:670:38:670:38 | b | 5 |
+| test.c:671:13:671:13 | a | 3 |
+| test.c:671:15:671:15 | b | 5 |
+| test.c:672:5:672:9 | total | 0 |
+| test.c:672:14:672:14 | r | 15 |
+| test.c:674:12:674:12 | a | 0 |
+| test.c:674:17:674:17 | a | 3 |
+| test.c:674:33:674:33 | b | 0 |
+| test.c:674:38:674:38 | b | 0 |
+| test.c:675:13:675:13 | a | 3 |
+| test.c:675:15:675:15 | b | 0 |
+| test.c:676:5:676:9 | total | 0 |
+| test.c:676:14:676:14 | r | 0 |
+| test.c:678:12:678:12 | a | 0 |
+| test.c:678:17:678:17 | a | 3 |
+| test.c:678:34:678:34 | b | 0 |
+| test.c:678:39:678:39 | b | 13 |
+| test.c:679:13:679:13 | a | 3 |
+| test.c:679:15:679:15 | b | 13 |
+| test.c:680:5:680:9 | total | 0 |
+| test.c:680:14:680:14 | r | 39 |
+| test.c:683:10:683:14 | total | 0 |
+| test.c:689:12:689:12 | b | 0 |
+| test.c:689:17:689:17 | b | 5 |
+| test.c:690:16:690:16 | b | 5 |
+| test.c:691:5:691:9 | total | 0 |
+| test.c:691:14:691:14 | r | 55 |
+| test.c:693:12:693:12 | b | 0 |
+| test.c:693:17:693:17 | b | 0 |
+| test.c:694:16:694:16 | b | 0 |
+| test.c:695:5:695:9 | total | 0 |
+| test.c:695:14:695:14 | r | 0 |
+| test.c:697:13:697:13 | b | 0 |
+| test.c:697:18:697:18 | b | 13 |
+| test.c:698:16:698:16 | b | 13 |
+| test.c:699:5:699:9 | total | 0 |
+| test.c:699:14:699:14 | r | 143 |
+| test.c:702:10:702:14 | total | 0 |
+| test.c:707:3:707:3 | x | 0 |
+| test.c:707:7:707:7 | y | 0 |
+| test.c:708:3:708:4 | xy | 0 |
+| test.c:708:8:708:8 | x | 1000000003 |
+| test.c:708:12:708:12 | y | 1000000003 |
+| test.c:709:10:709:11 | xy | 1000000006000000000 |
+| test.c:714:3:714:3 | x | 0 |
+| test.c:715:3:715:3 | y | 0 |
+| test.c:716:3:716:4 | xy | 0 |
+| test.c:716:8:716:8 | x | 274177 |
+| test.c:716:12:716:12 | y | 67280421310721 |
+| test.c:717:10:717:11 | xy | 18446744073709551616 |
+| test.c:721:7:721:8 | ui | 0 |
+| test.c:722:43:722:44 | ui | 10 |
+| test.c:722:48:722:49 | ui | 10 |
+| test.c:723:12:723:17 | result | 100 |
+| test.c:725:7:725:8 | ul | 0 |
+| test.c:726:28:726:29 | ul | 10 |
+| test.c:726:33:726:34 | ul | 10 |
+| test.c:727:12:727:17 | result | 0 |
+| test.c:733:7:733:8 | ui | 0 |
+| test.c:733:19:733:20 | ui | 0 |
+| test.c:734:5:734:6 | ui | 2 |
+| test.c:734:11:734:12 | ui | 2 |
+| test.c:735:12:735:13 | ui | 4 |
+| test.c:739:3:739:9 | uiconst | 10 |
+| test.c:742:3:742:9 | ulconst | 10 |
+| test.c:743:10:743:16 | uiconst | 40 |
+| test.c:743:20:743:26 | ulconst | 40 |
+| test.c:747:7:747:7 | i | -2147483648 |
+| test.c:747:18:747:18 | i | -1 |
+| test.c:748:5:748:5 | i | -2147483648 |
+| test.c:748:13:748:13 | i | -1 |
+| test.c:749:9:749:9 | i | -5 |
+| test.c:751:5:751:5 | i | -2147483648 |
+| test.c:751:9:751:9 | i | -5 |
+| test.c:752:9:752:9 | i | -30 |
+| test.c:754:5:754:5 | i | -30 |
+| test.c:755:9:755:9 | i | -210 |
+| test.c:757:5:757:5 | i | -210 |
+| test.c:758:9:758:9 | i | -1155 |
+| test.c:760:7:760:7 | i | -2147483648 |
+| test.c:761:5:761:5 | i | -2147483648 |
+| test.c:761:9:761:9 | i | -1 |
+| test.c:762:9:762:9 | i | 1 |
+| test.c:764:3:764:3 | i | -2147483648 |
+| test.c:764:7:764:7 | i | -2147483648 |
+| test.c:765:10:765:10 | i | -2147483648 |
+| test.c:768:3:768:3 | i | -2147483648 |
+| test.c:768:10:768:11 | sc | 1 |
+| test.c:770:7:770:7 | i | -128 |
+| test.c:777:7:777:7 | n | 0 |
+| test.c:779:7:779:7 | n | 0 |
+| test.c:780:9:780:9 | n | 1 |
+| test.c:783:7:783:7 | n | 0 |
+| test.c:784:9:784:9 | n | 1 |
+| test.c:786:9:786:9 | n | 0 |
+| test.c:789:8:789:8 | n | 0 |
+| test.c:790:9:790:9 | n | 0 |
+| test.c:792:9:792:9 | n | 1 |
+| test.c:795:10:795:10 | n | 0 |
+| test.c:796:5:796:5 | n | 1 |
+| test.c:799:7:799:7 | n | 0 |
+| test.c:803:7:803:7 | n | -32768 |
+| test.c:806:7:806:7 | n | 0 |
+| test.c:807:9:807:9 | n | 0 |
+| test.c:809:9:809:9 | n | 1 |
+| test.c:812:7:812:7 | n | 0 |
+| test.c:813:9:813:9 | n | 1 |
+| test.c:815:9:815:9 | n | 0 |
+| test.c:818:10:818:10 | n | 0 |
+| test.c:819:5:819:5 | n | 1 |
+| test.c:822:7:822:7 | n | 0 |
+| test.c:826:7:826:7 | n | -32768 |
+| test.c:827:9:827:9 | n | -32768 |
+| test.c:828:11:828:11 | n | 0 |
+| test.c:832:7:832:7 | n | -32768 |
+| test.c:833:13:833:13 | n | 5 |
+| test.c:836:9:836:9 | n | 6 |
+| test.c:839:7:839:7 | n | -32768 |
+| test.c:839:22:839:22 | n | -32767 |
+| test.c:840:9:840:9 | n | -32766 |
+| test.c:843:7:843:7 | n | -32768 |
+| test.c:844:5:844:5 | n | 0 |
+| test.c:844:10:844:10 | n | 1 |
+| test.c:844:14:844:14 | n | 0 |
+| test.c:845:6:845:6 | n | 0 |
+| test.c:845:10:845:10 | n | 0 |
+| test.c:845:14:845:14 | n | 1 |
+| test.c:856:7:856:8 | ss | -32768 |
+| test.c:857:9:857:10 | ss | 0 |
+| test.c:860:7:860:8 | ss | -32768 |
+| test.c:861:9:861:10 | ss | -32768 |
+| test.c:864:14:864:15 | us | 0 |
+| test.c:865:9:865:10 | us | 0 |
+| test.c:868:14:868:15 | us | 0 |
+| test.c:869:9:869:10 | us | 0 |
+| test.c:872:7:872:8 | ss | -32768 |
+| test.c:873:9:873:10 | ss | -32768 |
+| test.c:876:7:876:8 | ss | -32768 |
+| test.c:877:9:877:10 | ss | -1 |
+| test.c:883:8:883:8 | s | -2147483648 |
+| test.c:883:15:883:15 | s | 0 |
+| test.c:883:23:883:23 | s | 0 |
+| test.c:884:18:884:18 | s | 0 |
+| test.c:884:22:884:22 | s | 0 |
+| test.c:885:9:885:14 | result | 0 |
+| test.c:891:7:891:7 | i | 0 |
+| test.c:892:9:892:9 | i | -2147483648 |
+| test.c:896:7:896:7 | u | 0 |
+| test.c:897:9:897:9 | u | 0 |
+| test.c:902:12:902:12 | s | -2147483648 |
+| test.c:903:7:903:8 | s2 | -4 |
+| test.c:908:7:908:7 | x | -2147483648 |
+| test.c:909:9:909:9 | y | -2147483648 |
+| test.c:913:7:913:7 | y | -2147483648 |
+| test.c:922:7:922:7 | x | -2147483648 |
+| test.c:927:7:927:7 | x | -2147483648 |
+| test.c:934:8:934:8 | x | 2147483647 |
+| test.c:934:12:934:12 | y | 256 |
+| test.c:935:9:935:9 | x | 2147483647 |
+| test.c:936:9:936:9 | y | 256 |
 | test.cpp:10:7:10:7 | b | -2147483648 |
 | test.cpp:11:5:11:5 | x | -2147483648 |
 | test.cpp:13:10:13:10 | x | -2147483648 |

cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/nrOfBounds.ql

@@ -0,0 +1,5 @@
+import cpp
+import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis
+
+from Expr e
+select e, SimpleRangeAnalysisInternal::estimateNrOfBounds(e)

cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/ternaryLower.expected

@@ -72,8 +72,77 @@
 | test.c:405:22:405:82 | ... ? ... : ... | 0.13204114 | 0.42186276 | 0.13204114 |
 | test.c:405:26:405:69 | ... ? ... : ... | 0.42186276 | 0.42186276 | 0.44996679 |
 | test.c:405:30:405:56 | ... ? ... : ... | 0.42186276 | 0.42186276 | 0.53843358 |
-| test.c:418:20:418:36 | ... ? ... : ... | 0.0 | 0.0 | 100.0 |
-| test.c:630:5:630:14 | ... ? ... : ... | 0.0 | 1.0 | 0.0 |
-| test.c:631:5:631:14 | ... ? ... : ... | 0.0 | 0.0 | 1.0 |
+| test.c:432:4:606:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:432:5:434:49 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:435:6:517:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:436:8:454:41 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:439:10:443:21 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:439:31:439:79 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:441:13:443:21 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:448:12:453:23 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:449:12:449:60 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:451:15:453:23 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:455:6:474:23 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:458:8:462:19 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:458:29:458:77 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:460:11:462:19 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:463:6:463:54 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:467:10:471:21 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:467:31:467:79 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:469:13:471:21 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:472:9:474:23 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:476:10:495:43 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:479:12:484:23 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:480:12:480:60 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:482:15:484:23 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:489:14:494:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:490:14:490:62 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:492:17:494:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:496:9:517:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:499:14:504:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:500:14:500:62 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:502:17:504:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:505:12:505:60 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:509:12:514:23 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:510:12:510:60 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:512:15:514:23 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:515:11:517:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:518:9:520:51 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:521:9:606:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:522:14:541:47 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:525:16:530:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:526:16:526:64 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:528:19:530:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:535:18:540:29 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:536:18:536:66 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:538:21:540:29 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:542:12:563:29 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:545:14:550:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:546:14:546:62 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:548:17:550:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:551:12:551:60 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:555:16:560:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:556:16:556:64 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:558:19:560:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:561:15:563:29 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:565:12:584:45 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:568:14:573:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:569:14:569:62 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:571:17:573:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:578:16:583:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:579:16:579:64 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:581:19:583:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:585:11:606:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:588:16:593:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:589:16:589:64 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:591:19:593:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:594:14:594:62 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:598:14:603:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:599:14:599:62 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:601:17:603:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:604:13:606:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
+| test.c:632:20:632:36 | ... ? ... : ... | 0.0 | 0.0 | 100.0 |
+| test.c:844:5:844:14 | ... ? ... : ... | 0.0 | 1.0 | 0.0 |
+| test.c:845:5:845:14 | ... ? ... : ... | 0.0 | 0.0 | 1.0 |
 | test.cpp:121:3:121:12 | ... ? ... : ... | 0.0 | 1.0 | 0.0 |
 | test.cpp:122:3:122:12 | ... ? ... : ... | 0.0 | 0.0 | 1.0 |

cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/ternaryUpper.expected

@@ -72,8 +72,77 @@
 | test.c:405:22:405:82 | ... ? ... : ... | 0.53843358 | 0.53843358 | 0.13204114 |
 | test.c:405:26:405:69 | ... ? ... : ... | 0.53843358 | 0.53843358 | 0.44996679 |
 | test.c:405:30:405:56 | ... ? ... : ... | 0.53843358 | 0.42186276 | 0.53843358 |
-| test.c:418:20:418:36 | ... ? ... : ... | 100.0 | 99.0 | 100.0 |
-| test.c:630:5:630:14 | ... ? ... : ... | 32767.0 | 32767.0 | 0.0 |
-| test.c:631:5:631:14 | ... ? ... : ... | 32767.0 | 0.0 | 32767.0 |
+| test.c:432:4:606:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:432:5:434:49 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:435:6:517:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:436:8:454:41 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:439:10:443:21 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:439:31:439:79 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:441:13:443:21 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:448:12:453:23 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:449:12:449:60 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:451:15:453:23 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:455:6:474:23 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:458:8:462:19 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:458:29:458:77 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:460:11:462:19 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:463:6:463:54 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:467:10:471:21 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:467:31:467:79 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:469:13:471:21 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:472:9:474:23 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:476:10:495:43 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:479:12:484:23 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:480:12:480:60 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:482:15:484:23 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:489:14:494:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:490:14:490:62 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:492:17:494:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:496:9:517:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:499:14:504:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:500:14:500:62 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:502:17:504:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:505:12:505:60 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:509:12:514:23 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:510:12:510:60 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:512:15:514:23 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:515:11:517:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:518:9:520:51 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:521:9:606:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:522:14:541:47 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:525:16:530:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:526:16:526:64 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:528:19:530:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:535:18:540:29 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:536:18:536:66 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:538:21:540:29 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:542:12:563:29 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:545:14:550:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:546:14:546:62 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:548:17:550:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:551:12:551:60 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:555:16:560:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:556:16:556:64 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:558:19:560:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:561:15:563:29 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:565:12:584:45 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:568:14:573:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:569:14:569:62 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:571:17:573:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:578:16:583:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:579:16:579:64 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:581:19:583:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:585:11:606:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:588:16:593:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:589:16:589:64 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:591:19:593:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:594:14:594:62 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:598:14:603:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:599:14:599:62 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:601:17:603:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:604:13:606:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
+| test.c:632:20:632:36 | ... ? ... : ... | 100.0 | 99.0 | 100.0 |
+| test.c:844:5:844:14 | ... ? ... : ... | 32767.0 | 32767.0 | 0.0 |
+| test.c:845:5:845:14 | ... ? ... : ... | 32767.0 | 0.0 | 32767.0 |
 | test.cpp:121:3:121:12 | ... ? ... : ... | 32767.0 | 32767.0 | 0.0 |
 | test.cpp:122:3:122:12 | ... ? ... : ... | 32767.0 | 0.0 | 32767.0 |

cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/test.c

@@ -413,6 +413,220 @@ double test_ternary_nested_of_literals(double m, double n, double o, double p, d
   return output;
 }
 
+int repeated_if_statements(unsigned int rhs) {
+  // Test how many bounds we estimate for `if` statements without `else`
+  // branches where the following node is both a normal phi node and a guard phi
+  // node.
+  if (rhs < 12) { rhs << 1; }
+  if (rhs < 13) { rhs << 1; }
+  if (rhs < 14) { rhs << 1; }
+  if (rhs < 15) { rhs << 1; }
+  if (rhs < 16) { rhs << 1; }
+  return rhs; // rhs has 6 bounds
+}
+
+unsigned int conditional_nested_guards(unsigned int ip) {
+  // This tests a combinatorial explosion that can happen from a large number of
+  // nested linear guards.
+  unsigned int special_number =
+   (14 * ip > (2 * ip + 1) * 17 + (2 * ip + 1 + 1) * 17
+      ? 14 * ip
+      : (2 * ip + 1) * 14 + (2 * ip + 1 + 1) * 17) >
+    (2 * (ip * 14 + 32) +
+      (4 * (ip * 14 + 32) +
+        (2 * ip * 14 + 32) +
+        2 * (ip * 14 + 64) +
+        ((2 * ip + 1) * 14 > (17 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+          ? (2 * ip + 1) * 14
+          : 14 * (2 * ip) > 17 * ip
+            ? 14 * (2 * ip)
+            : 14 * ip) >
+      2 * ip * 14 + (2 * ip + 1) * 17
+        ? 4 * (ip * 14 + 32) +
+          (2 * ip * 14 + 32) +
+          2 * (ip * 14 + 64) +
+          ((2 * ip + 1) * 14 >
+          (14 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+            ? (2 * ip + 1) * 14
+            : 14 * (2 * ip) > 17 * ip
+              ? 14 * (2 * ip)
+              : 14 * ip)
+        : 2 * ip * 14 + (2 * ip + 1) * 17) >
+    (4 * (ip * 14 + 32) +
+      (2 * ip * 14 + 32) +
+      2 * (ip * 14 + 64) +
+      ((2 * ip + 1) * 14 > (17 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+        ? (2 * ip + 1) * 14
+        : 14 * (2 * ip) > 17 * ip
+          ? 14 * (2 * ip)
+          : 14 * ip) >
+    (14 * ip > (ip + 1) * 17 ? 17 * ip : (ip + 1) * 17)
+      ? 4 * (ip * 14 + 32) +
+        (2 * ip * 14 + 32) +
+        2 * (ip * 14 + 64) +
+        ((2 * ip + 1) * 14 > (17 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+          ? (2 * ip + 1) * 14
+          : 14 * (2 * ip) > 17 * ip
+            ? 14 * (2 * ip)
+            : 14 * ip)
+      : 14 * ip > (ip + 1) * 17
+        ? 14 * ip
+        : (ip + 1) * 14)
+      ? 2 * (ip * 14 + 32) +
+        (4 * (ip * 14 + 32) +
+          (2 * ip * 14 + 32) +
+          2 * (ip * 14 + 64) +
+          ((2 * ip + 1) * 14 >
+          (14 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+            ? (2 * ip + 1) * 14
+            : 14 * (2 * ip) > 17 * ip
+              ? 14 * (2 * ip)
+              : 14 * ip) >
+        2 * ip * 14 + (2 * ip + 1) * 17
+          ? 4 * (ip * 14 + 32) +
+            (2 * ip * 14 + 32) +
+            2 * (ip * 14 + 64) +
+            ((2 * ip + 1) * 14 >
+            (14 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+              ? (2 * ip + 1) * 14
+              : 14 * (2 * ip) > 17 * ip
+                ? 14 * (2 * ip)
+                : 14 * ip)
+          : 2 * ip * 14 + (2 * ip + 1) * 17)
+      : 4 * (ip * 14 + 32) +
+            (2 * ip * 14 + 32) +
+            2 * (ip * 14 + 64) +
+            ((2 * ip + 1) * 14 >
+            (14 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+              ? (2 * ip + 1) * 14
+              : 14 * (2 * ip) > 17 * ip
+                ? 14 * (2 * ip)
+                : 14 * ip) >
+          (14 * ip > (ip + 1) * 17 ? 17 * ip : (ip + 1) * 17)
+        ? 4 * (ip * 14 + 32) +
+          (2 * ip * 14 + 32) +
+          2 * (ip * 14 + 64) +
+          ((2 * ip + 1) * 14 >
+          (14 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+            ? (2 * ip + 1) * 14
+            : 14 * (2 * ip) > 17 * ip
+              ? 14 * (2 * ip)
+              : 14 * ip)
+        : 14 * ip > (ip + 1) * 17
+          ? 14 * ip
+          : (ip + 1) * 14)
+      ? 14 * ip > (2 * ip + 1) * 17 + (2 * ip + 1 + 1) * 17
+        ? 14 * ip
+        : (2 * ip + 1) * 14 + (2 * ip + 1 + 1) * 17
+      : 2 * (ip * 14 + 32) +
+            (4 * (ip * 14 + 32) +
+              (2 * ip * 14 + 32) +
+              2 * (ip * 14 + 64) +
+              ((2 * ip + 1) * 14 >
+              (14 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+                ? (2 * ip + 1) * 14
+                : 14 * (2 * ip) > 17 * ip
+                  ? 14 * (2 * ip)
+                  : 14 * ip) >
+            2 * ip * 14 + (2 * ip + 1) * 17
+              ? 4 * (ip * 14 + 32) +
+                (2 * ip * 14 + 32) +
+                2 * (ip * 14 + 64) +
+                ((2 * ip + 1) * 14 >
+                (14 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+                  ? (2 * ip + 1) * 14
+                  : 14 * (2 * ip) > 17 * ip
+                    ? 14 * (2 * ip)
+                    : 14 * ip)
+              : 2 * ip * 14 + (2 * ip + 1) * 17) >
+          (4 * (ip * 14 + 32) +
+            (2 * ip * 14 + 32) +
+            2 * (ip * 14 + 64) +
+            ((2 * ip + 1) * 14 >
+            (14 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+              ? (2 * ip + 1) * 14
+              : 14 * (2 * ip) > 17 * ip
+                ? 14 * (2 * ip)
+                : 14 * ip) >
+          (14 * ip > (ip + 1) * 17 ? 17 * ip : (ip + 1) * 17)
+            ? 4 * (ip * 14 + 32) +
+              (2 * ip * 14 + 32) +
+              2 * (ip * 14 + 64) +
+              ((2 * ip + 1) * 14 >
+              (14 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+                ? (2 * ip + 1) * 14
+                : 14 * (2 * ip) > 17 * ip
+                  ? 14 * (2 * ip)
+                  : 14 * ip)
+            : 14 * ip > (ip + 1) * 17
+              ? 14 * ip
+              : (ip + 1) * 14)
+        ? 2 * (ip * 14 + 32) +
+          (4 * (ip * 14 + 32) +
+            (2 * ip * 14 + 32) +
+            2 * (ip * 14 + 64) +
+            ((2 * ip + 1) * 14 >
+            (14 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+              ? (2 * ip + 1) * 14
+              : 14 * (2 * ip) > 17 * ip
+                ? 14 * (2 * ip)
+                : 14 * ip) >
+          2 * ip * 14 + (2 * ip + 1) * 17
+            ? 4 * (ip * 14 + 32) +
+              (2 * ip * 14 + 32) +
+              2 * (ip * 14 + 64) +
+              ((2 * ip + 1) * 14 >
+              (14 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+                ? (2 * ip + 1) * 14
+                : 14 * (2 * ip) > 17 * ip
+                  ? 14 * (2 * ip)
+                  : 14 * ip)
+            : 2 * ip * 14 + (2 * ip + 1) * 17)
+        : 4 * (ip * 14 + 32) +
+              (2 * ip * 14 + 32) +
+              2 * (ip * 14 + 64) +
+              ((2 * ip + 1) * 14 >
+              (14 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+                ? (2 * ip + 1) * 14
+                : 14 * (2 * ip) > 17 * ip
+                  ? 14 * (2 * ip)
+                  : 14 * ip) >
+            (14 * ip > (ip + 1) * 17 ? 17 * ip : (ip + 1) * 17)
+          ? 4 * (ip * 14 + 32) +
+            (2 * ip * 14 + 32) +
+            2 * (ip * 14 + 64) +
+            ((2 * ip + 1) * 14 >
+            (14 * (2 * ip) > 17 * ip ? 17 * (2 * ip) : 17 * ip)
+              ? (2 * ip + 1) * 14
+              : 14 * (2 * ip) > 17 * ip
+                ? 14 * (2 * ip)
+                : 14 * ip)
+          : 14 * ip > (ip + 1) * 17
+            ? 14 * ip
+            : (ip + 1) * 14; 
+  return special_number;
+}
+
+int many_conditional_assignments(int c1, int c2, int c3, int c4, int c5) {
+  // This tests a combinatorial explosion that can happen from many conditional
+  // assignments, since each conditional assignment doubles the number of
+  // bounds.
+  int x = 0;
+  if (c1) { x += 748596; }
+  if (c2) { x += 84652395; }
+  if (c3) { x += 3675895; }
+  if (c4) { x += 98634; }
+  if (c5) { x += 7834985; }
+  if (c1 && c2) { x += 938457398; }
+  if (c1 && c3) { x += 73895648; }
+  if (c1 && c4) { x += 12345432; }
+  if (c1 && c5) { x += 38847; }
+  if (c2 && c3) { x += 234; }
+  // x now has 2^10 bounds, the 10 additions below give (2^10)^10 bounds
+  int y = x + x + x + x + x + x + x + x + x + x + x + x;
+  return y;
+}
+
 // Test the comma expression.
 unsigned int test_comma01(unsigned int x) {
   unsigned int y = x < 100 ? x : 100;
@@ -700,7 +914,7 @@ void guard_with_exit(int x, int y) {
 
   // This test ensures that we correctly identify
   // that the upper bound for y is max_int when calling `out(y)`.
-  // The RangeSsa will place guardPhy on `out(y)`, and consequently there is no
+  // The RangeSsa will place guardPhi on `out(y)`, and consequently there is no
   // frontier phi node at out(y).
 }
 
@@ -708,7 +922,7 @@ void test(int x) {
   if (x >= 10) {
     return;
   }
-  // The basic below has two predecessors.
+  // The basic block below has two predecessors.
 label:
   out(x);
   goto label;

cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/upperBound.expected

@@ -485,197 +485,519 @@
 | test.c:411:59:411:59 | k | 0.889553 |
 | test.c:411:63:411:63 | l | 0.538434 |
 | test.c:413:10:413:15 | output | 9.284378 |
-| test.c:418:20:418:20 | x | 4294967295 |
-| test.c:418:30:418:30 | x | 99 |
-| test.c:421:3:421:4 | y1 | 4294967295 |
-| test.c:421:11:421:11 | y | 100 |
-| test.c:421:14:421:14 | y | 101 |
-| test.c:422:3:422:4 | y2 | 4294967295 |
-| test.c:422:9:422:9 | y | 101 |
-| test.c:422:14:422:14 | y | 102 |
-| test.c:422:22:422:22 | y | 105 |
-| test.c:423:10:423:11 | y1 | 101 |
-| test.c:423:15:423:16 | y2 | 105 |
-| test.c:431:3:431:3 | i | 2147483647 |
-| test.c:432:7:432:7 | i | 10 |
-| test.c:434:3:434:3 | i | 2147483647 |
-| test.c:435:3:435:3 | i | 10 |
-| test.c:436:7:436:7 | i | 20 |
-| test.c:438:3:438:3 | i | 2147483647 |
-| test.c:439:3:439:3 | i | 40 |
-| test.c:440:7:440:7 | i | 30 |
-| test.c:442:3:442:3 | i | 2147483647 |
-| test.c:442:7:442:7 | j | 2147483647 |
-| test.c:443:7:443:7 | i | 40 |
-| test.c:445:3:445:3 | i | 2147483647 |
-| test.c:445:8:445:8 | j | 40 |
-| test.c:446:7:446:7 | i | 50 |
-| test.c:448:3:448:3 | i | 2147483647 |
-| test.c:448:13:448:13 | j | 50 |
-| test.c:449:7:449:7 | i | 60 |
-| test.c:456:12:456:12 | a | 4294967295 |
-| test.c:456:17:456:17 | a | 4294967295 |
-| test.c:456:33:456:33 | b | 4294967295 |
-| test.c:456:38:456:38 | b | 4294967295 |
-| test.c:457:13:457:13 | a | 11 |
-| test.c:457:15:457:15 | b | 23 |
-| test.c:458:5:458:9 | total | 0 |
-| test.c:458:14:458:14 | r | 253 |
-| test.c:460:12:460:12 | a | 4294967295 |
-| test.c:460:17:460:17 | a | 4294967295 |
-| test.c:460:33:460:33 | b | 4294967295 |
-| test.c:460:38:460:38 | b | 4294967295 |
-| test.c:461:13:461:13 | a | 11 |
-| test.c:461:15:461:15 | b | 23 |
-| test.c:462:5:462:9 | total | 253 |
-| test.c:462:14:462:14 | r | 253 |
-| test.c:464:12:464:12 | a | 4294967295 |
-| test.c:464:17:464:17 | a | 4294967295 |
-| test.c:464:34:464:34 | b | 4294967295 |
-| test.c:464:39:464:39 | b | 4294967295 |
-| test.c:465:13:465:13 | a | 11 |
-| test.c:465:15:465:15 | b | 23 |
-| test.c:466:5:466:9 | total | 506 |
-| test.c:466:14:466:14 | r | 253 |
-| test.c:469:10:469:14 | total | 759 |
-| test.c:475:12:475:12 | b | 4294967295 |
-| test.c:475:17:475:17 | b | 4294967295 |
-| test.c:476:16:476:16 | b | 23 |
-| test.c:477:5:477:9 | total | 0 |
-| test.c:477:14:477:14 | r | 253 |
-| test.c:479:12:479:12 | b | 4294967295 |
-| test.c:479:17:479:17 | b | 4294967295 |
-| test.c:480:16:480:16 | b | 23 |
-| test.c:481:5:481:9 | total | 253 |
-| test.c:481:14:481:14 | r | 253 |
-| test.c:483:13:483:13 | b | 4294967295 |
-| test.c:483:18:483:18 | b | 4294967295 |
-| test.c:484:16:484:16 | b | 23 |
-| test.c:485:5:485:9 | total | 506 |
-| test.c:485:14:485:14 | r | 253 |
-| test.c:488:10:488:14 | total | 759 |
-| test.c:493:3:493:3 | x | 18446744073709551616 |
-| test.c:493:7:493:7 | y | 18446744073709551616 |
-| test.c:494:3:494:4 | xy | 18446744073709551616 |
-| test.c:494:8:494:8 | x | 1000000003 |
-| test.c:494:12:494:12 | y | 1000000003 |
-| test.c:495:10:495:11 | xy | 1000000006000000000 |
-| test.c:500:3:500:3 | x | 18446744073709551616 |
-| test.c:501:3:501:3 | y | 18446744073709551616 |
-| test.c:502:3:502:4 | xy | 18446744073709551616 |
-| test.c:502:8:502:8 | x | 274177 |
-| test.c:502:12:502:12 | y | 67280421310721 |
-| test.c:503:10:503:11 | xy | 18446744073709551616 |
-| test.c:507:7:507:8 | ui | 4294967295 |
-| test.c:508:43:508:44 | ui | 4294967295 |
-| test.c:508:48:508:49 | ui | 4294967295 |
-| test.c:509:12:509:17 | result | 18446744065119617024 |
-| test.c:511:7:511:8 | ul | 18446744073709551616 |
-| test.c:512:28:512:29 | ul | 18446744073709551616 |
-| test.c:512:33:512:34 | ul | 18446744073709551616 |
-| test.c:513:12:513:17 | result | 18446744073709551616 |
-| test.c:519:7:519:8 | ui | 4294967295 |
-| test.c:519:19:519:20 | ui | 10 |
-| test.c:520:5:520:6 | ui | 10 |
-| test.c:520:11:520:12 | ui | 10 |
-| test.c:521:12:521:13 | ui | 100 |
-| test.c:525:3:525:9 | uiconst | 10 |
-| test.c:528:3:528:9 | ulconst | 10 |
-| test.c:529:10:529:16 | uiconst | 40 |
-| test.c:529:20:529:26 | ulconst | 40 |
-| test.c:533:7:533:7 | i | 2147483647 |
-| test.c:533:18:533:18 | i | 2147483647 |
-| test.c:534:5:534:5 | i | 2147483647 |
-| test.c:534:13:534:13 | i | 2 |
-| test.c:535:9:535:9 | i | 10 |
-| test.c:537:5:537:5 | i | 2147483647 |
-| test.c:537:9:537:9 | i | 10 |
-| test.c:538:9:538:9 | i | 15 |
-| test.c:540:5:540:5 | i | 15 |
-| test.c:541:9:541:9 | i | 105 |
-| test.c:543:5:543:5 | i | 105 |
-| test.c:544:9:544:9 | i | 2310 |
-| test.c:546:7:546:7 | i | 2147483647 |
-| test.c:547:5:547:5 | i | 2147483647 |
-| test.c:547:9:547:9 | i | -1 |
-| test.c:548:9:548:9 | i | 1 |
-| test.c:550:3:550:3 | i | 2147483647 |
-| test.c:550:7:550:7 | i | 2147483647 |
-| test.c:551:10:551:10 | i | 2147483647 |
-| test.c:554:3:554:3 | i | 2147483647 |
-| test.c:554:10:554:11 | sc | 1 |
-| test.c:556:7:556:7 | i | 127 |
-| test.c:563:7:563:7 | n | 4294967295 |
-| test.c:565:7:565:7 | n | 4294967295 |
-| test.c:566:9:566:9 | n | 4294967295 |
-| test.c:569:7:569:7 | n | 4294967295 |
-| test.c:570:9:570:9 | n | 4294967295 |
-| test.c:572:9:572:9 | n | 0 |
-| test.c:575:8:575:8 | n | 4294967295 |
-| test.c:576:9:576:9 | n | 0 |
-| test.c:578:9:578:9 | n | 4294967295 |
-| test.c:581:10:581:10 | n | 4294967295 |
-| test.c:582:5:582:5 | n | 4294967295 |
-| test.c:585:7:585:7 | n | 0 |
-| test.c:589:7:589:7 | n | 32767 |
-| test.c:592:7:592:7 | n | 32767 |
-| test.c:593:9:593:9 | n | 0 |
-| test.c:595:9:595:9 | n | 32767 |
-| test.c:598:7:598:7 | n | 32767 |
-| test.c:599:9:599:9 | n | 32767 |
-| test.c:601:9:601:9 | n | 0 |
-| test.c:604:10:604:10 | n | 32767 |
-| test.c:605:5:605:5 | n | 32767 |
-| test.c:608:7:608:7 | n | 0 |
-| test.c:612:7:612:7 | n | 32767 |
-| test.c:613:9:613:9 | n | 32767 |
-| test.c:614:11:614:11 | n | 32767 |
-| test.c:618:7:618:7 | n | 32767 |
-| test.c:619:13:619:13 | n | 32767 |
-| test.c:622:9:622:9 | n | 32767 |
-| test.c:625:7:625:7 | n | 32767 |
-| test.c:625:22:625:22 | n | 32767 |
-| test.c:626:9:626:9 | n | 32767 |
-| test.c:629:7:629:7 | n | 32767 |
-| test.c:630:5:630:5 | n | 32767 |
-| test.c:630:10:630:10 | n | 32767 |
-| test.c:630:14:630:14 | n | 0 |
-| test.c:631:6:631:6 | n | 32767 |
-| test.c:631:10:631:10 | n | 0 |
-| test.c:631:14:631:14 | n | 32767 |
-| test.c:642:7:642:8 | ss | 32767 |
-| test.c:643:9:643:10 | ss | 3 |
-| test.c:646:7:646:8 | ss | 32767 |
-| test.c:647:9:647:10 | ss | 32767 |
-| test.c:650:14:650:15 | us | 65535 |
-| test.c:651:9:651:10 | us | 32767 |
-| test.c:654:14:654:15 | us | 65535 |
-| test.c:655:9:655:10 | us | 65535 |
-| test.c:658:7:658:8 | ss | 32767 |
-| test.c:659:9:659:10 | ss | 32767 |
-| test.c:662:7:662:8 | ss | 32767 |
-| test.c:663:9:663:10 | ss | 2 |
-| test.c:669:8:669:8 | s | 2147483647 |
-| test.c:669:15:669:15 | s | 127 |
-| test.c:669:23:669:23 | s | 9 |
-| test.c:670:18:670:18 | s | 9 |
-| test.c:670:22:670:22 | s | 9 |
-| test.c:671:9:671:14 | result | 127 |
-| test.c:677:7:677:7 | i | 0 |
-| test.c:678:9:678:9 | i | 2147483647 |
-| test.c:682:7:682:7 | u | 0 |
-| test.c:683:9:683:9 | u | 4294967295 |
-| test.c:688:12:688:12 | s | 2147483647 |
-| test.c:689:7:689:8 | s2 | 4 |
-| test.c:694:7:694:7 | x | 2147483647 |
-| test.c:695:9:695:9 | y | 2147483647 |
-| test.c:699:7:699:7 | y | 2147483647 |
-| test.c:708:7:708:7 | x | 2147483647 |
-| test.c:713:7:713:7 | x | 15 |
-| test.c:720:8:720:8 | x | 2147483647 |
-| test.c:720:12:720:12 | y | 256 |
-| test.c:721:9:721:9 | x | 2147483647 |
-| test.c:722:9:722:9 | y | 256 |
+| test.c:420:7:420:9 | rhs | 4294967295 |
+| test.c:420:19:420:21 | rhs | 11 |
+| test.c:421:7:421:9 | rhs | 4294967295 |
+| test.c:421:19:421:21 | rhs | 12 |
+| test.c:422:7:422:9 | rhs | 4294967295 |
+| test.c:422:19:422:21 | rhs | 13 |
+| test.c:423:7:423:9 | rhs | 4294967295 |
+| test.c:423:19:423:21 | rhs | 14 |
+| test.c:424:7:424:9 | rhs | 4294967295 |
+| test.c:424:19:424:21 | rhs | 15 |
+| test.c:425:10:425:12 | rhs | 4294967295 |
+| test.c:432:10:432:11 | ip | 4294967295 |
+| test.c:432:20:432:21 | ip | 4294967295 |
+| test.c:432:40:432:41 | ip | 4294967295 |
+| test.c:433:14:433:15 | ip | 4294967295 |
+| test.c:434:14:434:15 | ip | 4294967295 |
+| test.c:434:34:434:35 | ip | 4294967295 |
+| test.c:435:11:435:12 | ip | 4294967295 |
+| test.c:436:13:436:14 | ip | 4294967295 |
+| test.c:437:14:437:15 | ip | 4294967295 |
+| test.c:438:14:438:15 | ip | 4294967295 |
+| test.c:439:15:439:16 | ip | 4294967295 |
+| test.c:439:41:439:42 | ip | 4294967295 |
+| test.c:439:52:439:53 | ip | 4294967295 |
+| test.c:439:67:439:68 | ip | 4294967295 |
+| test.c:439:78:439:79 | ip | 4294967295 |
+| test.c:440:18:440:19 | ip | 4294967295 |
+| test.c:441:23:441:24 | ip | 4294967295 |
+| test.c:441:34:441:35 | ip | 4294967295 |
+| test.c:442:25:442:26 | ip | 4294967295 |
+| test.c:443:20:443:21 | ip | 4294967295 |
+| test.c:444:11:444:12 | ip | 4294967295 |
+| test.c:444:26:444:27 | ip | 4294967295 |
+| test.c:445:16:445:17 | ip | 4294967295 |
+| test.c:446:16:446:17 | ip | 4294967295 |
+| test.c:447:16:447:17 | ip | 4294967295 |
+| test.c:448:17:448:18 | ip | 4294967295 |
+| test.c:449:22:449:23 | ip | 4294967295 |
+| test.c:449:33:449:34 | ip | 4294967295 |
+| test.c:449:48:449:49 | ip | 4294967295 |
+| test.c:449:59:449:60 | ip | 4294967295 |
+| test.c:450:20:450:21 | ip | 4294967295 |
+| test.c:451:25:451:26 | ip | 4294967295 |
+| test.c:451:36:451:37 | ip | 4294967295 |
+| test.c:452:27:452:28 | ip | 4294967295 |
+| test.c:453:22:453:23 | ip | 4294967295 |
+| test.c:454:15:454:16 | ip | 4294967295 |
+| test.c:454:30:454:31 | ip | 4294967295 |
+| test.c:455:11:455:12 | ip | 4294967295 |
+| test.c:456:12:456:13 | ip | 4294967295 |
+| test.c:457:12:457:13 | ip | 4294967295 |
+| test.c:458:13:458:14 | ip | 4294967295 |
+| test.c:458:39:458:40 | ip | 4294967295 |
+| test.c:458:50:458:51 | ip | 4294967295 |
+| test.c:458:65:458:66 | ip | 4294967295 |
+| test.c:458:76:458:77 | ip | 4294967295 |
+| test.c:459:16:459:17 | ip | 4294967295 |
+| test.c:460:21:460:22 | ip | 4294967295 |
+| test.c:460:32:460:33 | ip | 4294967295 |
+| test.c:461:23:461:24 | ip | 4294967295 |
+| test.c:462:18:462:19 | ip | 4294967295 |
+| test.c:463:11:463:12 | ip | 4294967295 |
+| test.c:463:17:463:18 | ip | 4294967295 |
+| test.c:463:37:463:38 | ip | 4294967295 |
+| test.c:463:43:463:44 | ip | 4294967295 |
+| test.c:464:14:464:15 | ip | 4294967295 |
+| test.c:465:14:465:15 | ip | 4294967295 |
+| test.c:466:14:466:15 | ip | 4294967295 |
+| test.c:467:15:467:16 | ip | 4294967295 |
+| test.c:467:41:467:42 | ip | 4294967295 |
+| test.c:467:52:467:53 | ip | 4294967295 |
+| test.c:467:67:467:68 | ip | 4294967295 |
+| test.c:467:78:467:79 | ip | 4294967295 |
+| test.c:468:18:468:19 | ip | 4294967295 |
+| test.c:469:23:469:24 | ip | 4294967295 |
+| test.c:469:34:469:35 | ip | 4294967295 |
+| test.c:470:25:470:26 | ip | 4294967295 |
+| test.c:471:20:471:21 | ip | 4294967295 |
+| test.c:472:14:472:15 | ip | 4294967295 |
+| test.c:472:20:472:21 | ip | 4294967295 |
+| test.c:473:16:473:17 | ip | 4294967295 |
+| test.c:474:12:474:13 | ip | 4294967295 |
+| test.c:475:14:475:15 | ip | 4294967295 |
+| test.c:476:15:476:16 | ip | 4294967295 |
+| test.c:477:16:477:17 | ip | 4294967295 |
+| test.c:478:16:478:17 | ip | 4294967295 |
+| test.c:479:17:479:18 | ip | 4294967295 |
+| test.c:480:22:480:23 | ip | 4294967295 |
+| test.c:480:33:480:34 | ip | 4294967295 |
+| test.c:480:48:480:49 | ip | 4294967295 |
+| test.c:480:59:480:60 | ip | 4294967295 |
+| test.c:481:20:481:21 | ip | 4294967295 |
+| test.c:482:25:482:26 | ip | 4294967295 |
+| test.c:482:36:482:37 | ip | 4294967295 |
+| test.c:483:27:483:28 | ip | 4294967295 |
+| test.c:484:22:484:23 | ip | 4294967295 |
+| test.c:485:13:485:14 | ip | 4294967295 |
+| test.c:485:28:485:29 | ip | 4294967295 |
+| test.c:486:18:486:19 | ip | 4294967295 |
+| test.c:487:18:487:19 | ip | 4294967295 |
+| test.c:488:18:488:19 | ip | 4294967295 |
+| test.c:489:19:489:20 | ip | 4294967295 |
+| test.c:490:24:490:25 | ip | 4294967295 |
+| test.c:490:35:490:36 | ip | 4294967295 |
+| test.c:490:50:490:51 | ip | 4294967295 |
+| test.c:490:61:490:62 | ip | 4294967295 |
+| test.c:491:22:491:23 | ip | 4294967295 |
+| test.c:492:27:492:28 | ip | 4294967295 |
+| test.c:492:38:492:39 | ip | 4294967295 |
+| test.c:493:29:493:30 | ip | 4294967295 |
+| test.c:494:24:494:25 | ip | 4294967295 |
+| test.c:495:17:495:18 | ip | 4294967295 |
+| test.c:495:32:495:33 | ip | 4294967295 |
+| test.c:496:14:496:15 | ip | 4294967295 |
+| test.c:497:18:497:19 | ip | 4294967295 |
+| test.c:498:18:498:19 | ip | 4294967295 |
+| test.c:499:19:499:20 | ip | 4294967295 |
+| test.c:500:24:500:25 | ip | 4294967295 |
+| test.c:500:35:500:36 | ip | 4294967295 |
+| test.c:500:50:500:51 | ip | 4294967295 |
+| test.c:500:61:500:62 | ip | 4294967295 |
+| test.c:501:22:501:23 | ip | 4294967295 |
+| test.c:502:27:502:28 | ip | 4294967295 |
+| test.c:502:38:502:39 | ip | 4294967295 |
+| test.c:503:29:503:30 | ip | 4294967295 |
+| test.c:504:24:504:25 | ip | 4294967295 |
+| test.c:505:17:505:18 | ip | 4294967295 |
+| test.c:505:23:505:24 | ip | 4294967295 |
+| test.c:505:43:505:44 | ip | 4294967295 |
+| test.c:505:49:505:50 | ip | 4294967295 |
+| test.c:506:16:506:17 | ip | 4294967295 |
+| test.c:507:16:507:17 | ip | 4294967295 |
+| test.c:508:16:508:17 | ip | 4294967295 |
+| test.c:509:17:509:18 | ip | 4294967295 |
+| test.c:510:22:510:23 | ip | 4294967295 |
+| test.c:510:33:510:34 | ip | 4294967295 |
+| test.c:510:48:510:49 | ip | 4294967295 |
+| test.c:510:59:510:60 | ip | 4294967295 |
+| test.c:511:20:511:21 | ip | 4294967295 |
+| test.c:512:25:512:26 | ip | 4294967295 |
+| test.c:512:36:512:37 | ip | 4294967295 |
+| test.c:513:27:513:28 | ip | 4294967295 |
+| test.c:514:22:514:23 | ip | 4294967295 |
+| test.c:515:16:515:17 | ip | 4294967295 |
+| test.c:515:22:515:23 | ip | 4294967295 |
+| test.c:516:18:516:19 | ip | 4294967295 |
+| test.c:517:14:517:15 | ip | 4294967295 |
+| test.c:518:14:518:15 | ip | 4294967295 |
+| test.c:518:24:518:25 | ip | 4294967295 |
+| test.c:518:44:518:45 | ip | 4294967295 |
+| test.c:519:16:519:17 | ip | 4294967295 |
+| test.c:520:16:520:17 | ip | 4294967295 |
+| test.c:520:36:520:37 | ip | 4294967295 |
+| test.c:521:14:521:15 | ip | 4294967295 |
+| test.c:522:19:522:20 | ip | 4294967295 |
+| test.c:523:20:523:21 | ip | 4294967295 |
+| test.c:524:20:524:21 | ip | 4294967295 |
+| test.c:525:21:525:22 | ip | 4294967295 |
+| test.c:526:26:526:27 | ip | 4294967295 |
+| test.c:526:37:526:38 | ip | 4294967295 |
+| test.c:526:52:526:53 | ip | 4294967295 |
+| test.c:526:63:526:64 | ip | 4294967295 |
+| test.c:527:24:527:25 | ip | 4294967295 |
+| test.c:528:29:528:30 | ip | 4294967295 |
+| test.c:528:40:528:41 | ip | 4294967295 |
+| test.c:529:31:529:32 | ip | 4294967295 |
+| test.c:530:26:530:27 | ip | 4294967295 |
+| test.c:531:17:531:18 | ip | 4294967295 |
+| test.c:531:32:531:33 | ip | 4294967295 |
+| test.c:532:22:532:23 | ip | 4294967295 |
+| test.c:533:22:533:23 | ip | 4294967295 |
+| test.c:534:22:534:23 | ip | 4294967295 |
+| test.c:535:23:535:24 | ip | 4294967295 |
+| test.c:536:28:536:29 | ip | 4294967295 |
+| test.c:536:39:536:40 | ip | 4294967295 |
+| test.c:536:54:536:55 | ip | 4294967295 |
+| test.c:536:65:536:66 | ip | 4294967295 |
+| test.c:537:26:537:27 | ip | 4294967295 |
+| test.c:538:31:538:32 | ip | 4294967295 |
+| test.c:538:42:538:43 | ip | 4294967295 |
+| test.c:539:33:539:34 | ip | 4294967295 |
+| test.c:540:28:540:29 | ip | 4294967295 |
+| test.c:541:21:541:22 | ip | 4294967295 |
+| test.c:541:36:541:37 | ip | 4294967295 |
+| test.c:542:17:542:18 | ip | 4294967295 |
+| test.c:543:18:543:19 | ip | 4294967295 |
+| test.c:544:18:544:19 | ip | 4294967295 |
+| test.c:545:19:545:20 | ip | 4294967295 |
+| test.c:546:24:546:25 | ip | 4294967295 |
+| test.c:546:35:546:36 | ip | 4294967295 |
+| test.c:546:50:546:51 | ip | 4294967295 |
+| test.c:546:61:546:62 | ip | 4294967295 |
+| test.c:547:22:547:23 | ip | 4294967295 |
+| test.c:548:27:548:28 | ip | 4294967295 |
+| test.c:548:38:548:39 | ip | 4294967295 |
+| test.c:549:29:549:30 | ip | 4294967295 |
+| test.c:550:24:550:25 | ip | 4294967295 |
+| test.c:551:17:551:18 | ip | 4294967295 |
+| test.c:551:23:551:24 | ip | 4294967295 |
+| test.c:551:43:551:44 | ip | 4294967295 |
+| test.c:551:49:551:50 | ip | 4294967295 |
+| test.c:552:20:552:21 | ip | 4294967295 |
+| test.c:553:20:553:21 | ip | 4294967295 |
+| test.c:554:20:554:21 | ip | 4294967295 |
+| test.c:555:21:555:22 | ip | 4294967295 |
+| test.c:556:26:556:27 | ip | 4294967295 |
+| test.c:556:37:556:38 | ip | 4294967295 |
+| test.c:556:52:556:53 | ip | 4294967295 |
+| test.c:556:63:556:64 | ip | 4294967295 |
+| test.c:557:24:557:25 | ip | 4294967295 |
+| test.c:558:29:558:30 | ip | 4294967295 |
+| test.c:558:40:558:41 | ip | 4294967295 |
+| test.c:559:31:559:32 | ip | 4294967295 |
+| test.c:560:26:560:27 | ip | 4294967295 |
+| test.c:561:20:561:21 | ip | 4294967295 |
+| test.c:561:26:561:27 | ip | 4294967295 |
+| test.c:562:22:562:23 | ip | 4294967295 |
+| test.c:563:18:563:19 | ip | 4294967295 |
+| test.c:564:16:564:17 | ip | 4294967295 |
+| test.c:565:17:565:18 | ip | 4294967295 |
+| test.c:566:18:566:19 | ip | 4294967295 |
+| test.c:567:18:567:19 | ip | 4294967295 |
+| test.c:568:19:568:20 | ip | 4294967295 |
+| test.c:569:24:569:25 | ip | 4294967295 |
+| test.c:569:35:569:36 | ip | 4294967295 |
+| test.c:569:50:569:51 | ip | 4294967295 |
+| test.c:569:61:569:62 | ip | 4294967295 |
+| test.c:570:22:570:23 | ip | 4294967295 |
+| test.c:571:27:571:28 | ip | 4294967295 |
+| test.c:571:38:571:39 | ip | 4294967295 |
+| test.c:572:29:572:30 | ip | 4294967295 |
+| test.c:573:24:573:25 | ip | 4294967295 |
+| test.c:574:15:574:16 | ip | 4294967295 |
+| test.c:574:30:574:31 | ip | 4294967295 |
+| test.c:575:20:575:21 | ip | 4294967295 |
+| test.c:576:20:576:21 | ip | 4294967295 |
+| test.c:577:20:577:21 | ip | 4294967295 |
+| test.c:578:21:578:22 | ip | 4294967295 |
+| test.c:579:26:579:27 | ip | 4294967295 |
+| test.c:579:37:579:38 | ip | 4294967295 |
+| test.c:579:52:579:53 | ip | 4294967295 |
+| test.c:579:63:579:64 | ip | 4294967295 |
+| test.c:580:24:580:25 | ip | 4294967295 |
+| test.c:581:29:581:30 | ip | 4294967295 |
+| test.c:581:40:581:41 | ip | 4294967295 |
+| test.c:582:31:582:32 | ip | 4294967295 |
+| test.c:583:26:583:27 | ip | 4294967295 |
+| test.c:584:19:584:20 | ip | 4294967295 |
+| test.c:584:34:584:35 | ip | 4294967295 |
+| test.c:585:16:585:17 | ip | 4294967295 |
+| test.c:586:20:586:21 | ip | 4294967295 |
+| test.c:587:20:587:21 | ip | 4294967295 |
+| test.c:588:21:588:22 | ip | 4294967295 |
+| test.c:589:26:589:27 | ip | 4294967295 |
+| test.c:589:37:589:38 | ip | 4294967295 |
+| test.c:589:52:589:53 | ip | 4294967295 |
+| test.c:589:63:589:64 | ip | 4294967295 |
+| test.c:590:24:590:25 | ip | 4294967295 |
+| test.c:591:29:591:30 | ip | 4294967295 |
+| test.c:591:40:591:41 | ip | 4294967295 |
+| test.c:592:31:592:32 | ip | 4294967295 |
+| test.c:593:26:593:27 | ip | 4294967295 |
+| test.c:594:19:594:20 | ip | 4294967295 |
+| test.c:594:25:594:26 | ip | 4294967295 |
+| test.c:594:45:594:46 | ip | 4294967295 |
+| test.c:594:51:594:52 | ip | 4294967295 |
+| test.c:595:18:595:19 | ip | 4294967295 |
+| test.c:596:18:596:19 | ip | 4294967295 |
+| test.c:597:18:597:19 | ip | 4294967295 |
+| test.c:598:19:598:20 | ip | 4294967295 |
+| test.c:599:24:599:25 | ip | 4294967295 |
+| test.c:599:35:599:36 | ip | 4294967295 |
+| test.c:599:50:599:51 | ip | 4294967295 |
+| test.c:599:61:599:62 | ip | 4294967295 |
+| test.c:600:22:600:23 | ip | 4294967295 |
+| test.c:601:27:601:28 | ip | 4294967295 |
+| test.c:601:38:601:39 | ip | 4294967295 |
+| test.c:602:29:602:30 | ip | 4294967295 |
+| test.c:603:24:603:25 | ip | 4294967295 |
+| test.c:604:18:604:19 | ip | 4294967295 |
+| test.c:604:24:604:25 | ip | 4294967295 |
+| test.c:605:20:605:21 | ip | 4294967295 |
+| test.c:606:16:606:17 | ip | 4294967295 |
+| test.c:607:10:607:23 | special_number | 4294967295 |
+| test.c:615:7:615:8 | c1 | 2147483647 |
+| test.c:615:13:615:13 | x | 0 |
+| test.c:616:7:616:8 | c2 | 2147483647 |
+| test.c:616:13:616:13 | x | 748596 |
+| test.c:617:7:617:8 | c3 | 2147483647 |
+| test.c:617:13:617:13 | x | 85400991 |
+| test.c:618:7:618:8 | c4 | 2147483647 |
+| test.c:618:13:618:13 | x | 89076886 |
+| test.c:619:7:619:8 | c5 | 2147483647 |
+| test.c:619:13:619:13 | x | 89175520 |
+| test.c:620:7:620:8 | c1 | 2147483647 |
+| test.c:620:13:620:14 | c2 | 2147483647 |
+| test.c:620:19:620:19 | x | 97010505 |
+| test.c:621:7:621:8 | c1 | 2147483647 |
+| test.c:621:13:621:14 | c3 | 2147483647 |
+| test.c:621:19:621:19 | x | 1035467903 |
+| test.c:622:7:622:8 | c1 | 2147483647 |
+| test.c:622:13:622:14 | c4 | 2147483647 |
+| test.c:622:19:622:19 | x | 1109363551 |
+| test.c:623:7:623:8 | c1 | 2147483647 |
+| test.c:623:13:623:14 | c5 | 2147483647 |
+| test.c:623:19:623:19 | x | 1121708983 |
+| test.c:624:7:624:8 | c2 | 2147483647 |
+| test.c:624:13:624:14 | c3 | 2147483647 |
+| test.c:624:19:624:19 | x | 1121747830 |
+| test.c:626:11:626:11 | x | 2147483647 |
+| test.c:626:15:626:15 | x | 2147483647 |
+| test.c:626:19:626:19 | x | 2147483647 |
+| test.c:626:23:626:23 | x | 2147483647 |
+| test.c:626:27:626:27 | x | 2147483647 |
+| test.c:626:31:626:31 | x | 2147483647 |
+| test.c:626:35:626:35 | x | 2147483647 |
+| test.c:626:39:626:39 | x | 2147483647 |
+| test.c:626:43:626:43 | x | 2147483647 |
+| test.c:626:47:626:47 | x | 2147483647 |
+| test.c:626:51:626:51 | x | 2147483647 |
+| test.c:626:55:626:55 | x | 2147483647 |
+| test.c:627:10:627:10 | y | 2147483647 |
+| test.c:632:20:632:20 | x | 4294967295 |
+| test.c:632:30:632:30 | x | 99 |
+| test.c:635:3:635:4 | y1 | 4294967295 |
+| test.c:635:11:635:11 | y | 100 |
+| test.c:635:14:635:14 | y | 101 |
+| test.c:636:3:636:4 | y2 | 4294967295 |
+| test.c:636:9:636:9 | y | 101 |
+| test.c:636:14:636:14 | y | 102 |
+| test.c:636:22:636:22 | y | 105 |
+| test.c:637:10:637:11 | y1 | 101 |
+| test.c:637:15:637:16 | y2 | 105 |
+| test.c:645:3:645:3 | i | 2147483647 |
+| test.c:646:7:646:7 | i | 10 |
+| test.c:648:3:648:3 | i | 2147483647 |
+| test.c:649:3:649:3 | i | 10 |
+| test.c:650:7:650:7 | i | 20 |
+| test.c:652:3:652:3 | i | 2147483647 |
+| test.c:653:3:653:3 | i | 40 |
+| test.c:654:7:654:7 | i | 30 |
+| test.c:656:3:656:3 | i | 2147483647 |
+| test.c:656:7:656:7 | j | 2147483647 |
+| test.c:657:7:657:7 | i | 40 |
+| test.c:659:3:659:3 | i | 2147483647 |
+| test.c:659:8:659:8 | j | 40 |
+| test.c:660:7:660:7 | i | 50 |
+| test.c:662:3:662:3 | i | 2147483647 |
+| test.c:662:13:662:13 | j | 50 |
+| test.c:663:7:663:7 | i | 60 |
+| test.c:670:12:670:12 | a | 4294967295 |
+| test.c:670:17:670:17 | a | 4294967295 |
+| test.c:670:33:670:33 | b | 4294967295 |
+| test.c:670:38:670:38 | b | 4294967295 |
+| test.c:671:13:671:13 | a | 11 |
+| test.c:671:15:671:15 | b | 23 |
+| test.c:672:5:672:9 | total | 0 |
+| test.c:672:14:672:14 | r | 253 |
+| test.c:674:12:674:12 | a | 4294967295 |
+| test.c:674:17:674:17 | a | 4294967295 |
+| test.c:674:33:674:33 | b | 4294967295 |
+| test.c:674:38:674:38 | b | 4294967295 |
+| test.c:675:13:675:13 | a | 11 |
+| test.c:675:15:675:15 | b | 23 |
+| test.c:676:5:676:9 | total | 253 |
+| test.c:676:14:676:14 | r | 253 |
+| test.c:678:12:678:12 | a | 4294967295 |
+| test.c:678:17:678:17 | a | 4294967295 |
+| test.c:678:34:678:34 | b | 4294967295 |
+| test.c:678:39:678:39 | b | 4294967295 |
+| test.c:679:13:679:13 | a | 11 |
+| test.c:679:15:679:15 | b | 23 |
+| test.c:680:5:680:9 | total | 506 |
+| test.c:680:14:680:14 | r | 253 |
+| test.c:683:10:683:14 | total | 759 |
+| test.c:689:12:689:12 | b | 4294967295 |
+| test.c:689:17:689:17 | b | 4294967295 |
+| test.c:690:16:690:16 | b | 23 |
+| test.c:691:5:691:9 | total | 0 |
+| test.c:691:14:691:14 | r | 253 |
+| test.c:693:12:693:12 | b | 4294967295 |
+| test.c:693:17:693:17 | b | 4294967295 |
+| test.c:694:16:694:16 | b | 23 |
+| test.c:695:5:695:9 | total | 253 |
+| test.c:695:14:695:14 | r | 253 |
+| test.c:697:13:697:13 | b | 4294967295 |
+| test.c:697:18:697:18 | b | 4294967295 |
+| test.c:698:16:698:16 | b | 23 |
+| test.c:699:5:699:9 | total | 506 |
+| test.c:699:14:699:14 | r | 253 |
+| test.c:702:10:702:14 | total | 759 |
+| test.c:707:3:707:3 | x | 18446744073709551616 |
+| test.c:707:7:707:7 | y | 18446744073709551616 |
+| test.c:708:3:708:4 | xy | 18446744073709551616 |
+| test.c:708:8:708:8 | x | 1000000003 |
+| test.c:708:12:708:12 | y | 1000000003 |
+| test.c:709:10:709:11 | xy | 1000000006000000000 |
+| test.c:714:3:714:3 | x | 18446744073709551616 |
+| test.c:715:3:715:3 | y | 18446744073709551616 |
+| test.c:716:3:716:4 | xy | 18446744073709551616 |
+| test.c:716:8:716:8 | x | 274177 |
+| test.c:716:12:716:12 | y | 67280421310721 |
+| test.c:717:10:717:11 | xy | 18446744073709551616 |
+| test.c:721:7:721:8 | ui | 4294967295 |
+| test.c:722:43:722:44 | ui | 4294967295 |
+| test.c:722:48:722:49 | ui | 4294967295 |
+| test.c:723:12:723:17 | result | 18446744065119617024 |
+| test.c:725:7:725:8 | ul | 18446744073709551616 |
+| test.c:726:28:726:29 | ul | 18446744073709551616 |
+| test.c:726:33:726:34 | ul | 18446744073709551616 |
+| test.c:727:12:727:17 | result | 18446744073709551616 |
+| test.c:733:7:733:8 | ui | 4294967295 |
+| test.c:733:19:733:20 | ui | 10 |
+| test.c:734:5:734:6 | ui | 10 |
+| test.c:734:11:734:12 | ui | 10 |
+| test.c:735:12:735:13 | ui | 100 |
+| test.c:739:3:739:9 | uiconst | 10 |
+| test.c:742:3:742:9 | ulconst | 10 |
+| test.c:743:10:743:16 | uiconst | 40 |
+| test.c:743:20:743:26 | ulconst | 40 |
+| test.c:747:7:747:7 | i | 2147483647 |
+| test.c:747:18:747:18 | i | 2147483647 |
+| test.c:748:5:748:5 | i | 2147483647 |
+| test.c:748:13:748:13 | i | 2 |
+| test.c:749:9:749:9 | i | 10 |
+| test.c:751:5:751:5 | i | 2147483647 |
+| test.c:751:9:751:9 | i | 10 |
+| test.c:752:9:752:9 | i | 15 |
+| test.c:754:5:754:5 | i | 15 |
+| test.c:755:9:755:9 | i | 105 |
+| test.c:757:5:757:5 | i | 105 |
+| test.c:758:9:758:9 | i | 2310 |
+| test.c:760:7:760:7 | i | 2147483647 |
+| test.c:761:5:761:5 | i | 2147483647 |
+| test.c:761:9:761:9 | i | -1 |
+| test.c:762:9:762:9 | i | 1 |
+| test.c:764:3:764:3 | i | 2147483647 |
+| test.c:764:7:764:7 | i | 2147483647 |
+| test.c:765:10:765:10 | i | 2147483647 |
+| test.c:768:3:768:3 | i | 2147483647 |
+| test.c:768:10:768:11 | sc | 1 |
+| test.c:770:7:770:7 | i | 127 |
+| test.c:777:7:777:7 | n | 4294967295 |
+| test.c:779:7:779:7 | n | 4294967295 |
+| test.c:780:9:780:9 | n | 4294967295 |
+| test.c:783:7:783:7 | n | 4294967295 |
+| test.c:784:9:784:9 | n | 4294967295 |
+| test.c:786:9:786:9 | n | 0 |
+| test.c:789:8:789:8 | n | 4294967295 |
+| test.c:790:9:790:9 | n | 0 |
+| test.c:792:9:792:9 | n | 4294967295 |
+| test.c:795:10:795:10 | n | 4294967295 |
+| test.c:796:5:796:5 | n | 4294967295 |
+| test.c:799:7:799:7 | n | 0 |
+| test.c:803:7:803:7 | n | 32767 |
+| test.c:806:7:806:7 | n | 32767 |
+| test.c:807:9:807:9 | n | 0 |
+| test.c:809:9:809:9 | n | 32767 |
+| test.c:812:7:812:7 | n | 32767 |
+| test.c:813:9:813:9 | n | 32767 |
+| test.c:815:9:815:9 | n | 0 |
+| test.c:818:10:818:10 | n | 32767 |
+| test.c:819:5:819:5 | n | 32767 |
+| test.c:822:7:822:7 | n | 0 |
+| test.c:826:7:826:7 | n | 32767 |
+| test.c:827:9:827:9 | n | 32767 |
+| test.c:828:11:828:11 | n | 32767 |
+| test.c:832:7:832:7 | n | 32767 |
+| test.c:833:13:833:13 | n | 32767 |
+| test.c:836:9:836:9 | n | 32767 |
+| test.c:839:7:839:7 | n | 32767 |
+| test.c:839:22:839:22 | n | 32767 |
+| test.c:840:9:840:9 | n | 32767 |
+| test.c:843:7:843:7 | n | 32767 |
+| test.c:844:5:844:5 | n | 32767 |
+| test.c:844:10:844:10 | n | 32767 |
+| test.c:844:14:844:14 | n | 0 |
+| test.c:845:6:845:6 | n | 32767 |
+| test.c:845:10:845:10 | n | 0 |
+| test.c:845:14:845:14 | n | 32767 |
+| test.c:856:7:856:8 | ss | 32767 |
+| test.c:857:9:857:10 | ss | 3 |
+| test.c:860:7:860:8 | ss | 32767 |
+| test.c:861:9:861:10 | ss | 32767 |
+| test.c:864:14:864:15 | us | 65535 |
+| test.c:865:9:865:10 | us | 32767 |
+| test.c:868:14:868:15 | us | 65535 |
+| test.c:869:9:869:10 | us | 65535 |
+| test.c:872:7:872:8 | ss | 32767 |
+| test.c:873:9:873:10 | ss | 32767 |
+| test.c:876:7:876:8 | ss | 32767 |
+| test.c:877:9:877:10 | ss | 2 |
+| test.c:883:8:883:8 | s | 2147483647 |
+| test.c:883:15:883:15 | s | 127 |
+| test.c:883:23:883:23 | s | 9 |
+| test.c:884:18:884:18 | s | 9 |
+| test.c:884:22:884:22 | s | 9 |
+| test.c:885:9:885:14 | result | 127 |
+| test.c:891:7:891:7 | i | 0 |
+| test.c:892:9:892:9 | i | 2147483647 |
+| test.c:896:7:896:7 | u | 0 |
+| test.c:897:9:897:9 | u | 4294967295 |
+| test.c:902:12:902:12 | s | 2147483647 |
+| test.c:903:7:903:8 | s2 | 4 |
+| test.c:908:7:908:7 | x | 2147483647 |
+| test.c:909:9:909:9 | y | 2147483647 |
+| test.c:913:7:913:7 | y | 2147483647 |
+| test.c:922:7:922:7 | x | 2147483647 |
+| test.c:927:7:927:7 | x | 15 |
+| test.c:934:8:934:8 | x | 2147483647 |
+| test.c:934:12:934:12 | y | 256 |
+| test.c:935:9:935:9 | x | 2147483647 |
+| test.c:936:9:936:9 | y | 256 |
 | test.cpp:10:7:10:7 | b | 2147483647 |
 | test.cpp:11:5:11:5 | x | 2147483647 |
 | test.cpp:13:10:13:10 | x | 2147483647 |

csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/DotNetCliInvoker.cs

@@ -44,7 +44,7 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
             // Configure the proxy settings, if applicable.
             if (this.proxy != null)
             {
-                logger.LogInfo($"Setting up Dependabot proxy at {this.proxy.Address}");
+                logger.LogDebug($"Configuring environment variables for the Dependabot proxy at {this.proxy.Address}");
 
                 startInfo.EnvironmentVariables["HTTP_PROXY"] = this.proxy.Address;
                 startInfo.EnvironmentVariables["HTTPS_PROXY"] = this.proxy.Address;
@@ -57,11 +57,11 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
         private bool RunCommandAux(string args, string? workingDirectory, out IList<string> output, bool silent)
         {
             var dirLog = string.IsNullOrWhiteSpace(workingDirectory) ? "" : $" in {workingDirectory}";
-            logger.LogInfo($"Running '{Exec} {args}'{dirLog}");
             var pi = MakeDotnetStartInfo(args, workingDirectory);
             var threadId = Environment.CurrentManagedThreadId;
             void onOut(string s) => logger.Log(silent ? Severity.Debug : Severity.Info, s, threadId);
             void onError(string s) => logger.LogError(s, threadId);
+            logger.LogInfo($"Running '{Exec} {args}'{dirLog}");
             var exitCode = pi.ReadOutput(out output, onOut, onError);
             if (exitCode != 0)
             {

csharp/extractor/Semmle.Extraction.CSharp/Entities/Constructor.cs

@@ -29,7 +29,10 @@ namespace Semmle.Extraction.CSharp.Entities
             ContainingType!.PopulateGenerics();
 
             trapFile.constructors(this, Symbol.ContainingType.Name, ContainingType, (Constructor)OriginalDefinition);
-            WriteLocationToTrap(trapFile.constructor_location, this, Location);
+            if (Context.ExtractLocation(Symbol) && (!IsDefault || IsBestSourceLocation))
+            {
+                WriteLocationToTrap(trapFile.constructor_location, this, Location);
+            }
 
             if (MakeSynthetic)
             {
@@ -168,7 +171,15 @@ namespace Semmle.Extraction.CSharp.Entities
             Symbol.ContainingType.IsSourceDeclaration() &&
             !Symbol.ContainingType.IsAnonymousType;
 
-        private bool MakeSynthetic => IsPrimary || IsDefault;
+        /// <summary>
+        /// Returns true if we consider the reporting location of this constructor entity the best
+        /// location of the constructor.
+        /// For partial classes with default constructors, Roslyn consider each partial class declaration
+        /// as the possible location for the implicit default constructor.
+        /// </summary>
+        private bool IsBestSourceLocation => ReportingLocation is not null && Context.IsLocationInContext(ReportingLocation);
+
+        private bool MakeSynthetic => IsPrimary || (IsDefault && IsBestSourceLocation);
 
         [return: NotNullIfNotNull(nameof(constructor))]
         public static new Constructor? Create(Context cx, IMethodSymbol? constructor)

csharp/extractor/Semmle.Extraction.CSharp/Entities/Destructor.cs

@@ -15,7 +15,10 @@ namespace Semmle.Extraction.CSharp.Entities
             ContainingType!.PopulateGenerics();
 
             trapFile.destructors(this, $"~{Symbol.ContainingType.Name}", ContainingType, OriginalDefinition(Context, this, Symbol));
-            WriteLocationToTrap(trapFile.destructor_location, this, Location);
+            if (Context.ExtractLocation(Symbol))
+            {
+                WriteLocationToTrap(trapFile.destructor_location, this, Location);
+            }
         }
 
         private static new Destructor OriginalDefinition(Context cx, Destructor original, IMethodSymbol symbol)

csharp/extractor/Semmle.Extraction.CSharp/Entities/Field.cs

@@ -49,7 +49,10 @@ namespace Semmle.Extraction.CSharp.Entities
                 }
             }
 
-            WriteLocationsToTrap(trapFile.field_location, this, Locations);
+            if (Context.ExtractLocation(Symbol))
+            {
+                WriteLocationsToTrap(trapFile.field_location, this, Locations);
+            }
 
             if (!IsSourceDeclaration || !Symbol.FromSource())
                 return;

csharp/extractor/Semmle.Extraction.CSharp/Entities/Locations/NonGeneratedSourceLocation.cs

@@ -40,8 +40,29 @@ namespace Semmle.Extraction.CSharp.Entities
             get;
         }
 
+        private static void WriteStarId(EscapingTextWriter writer)
+        {
+            writer.Write('*');
+        }
+
+        public sealed override void WriteQuotedId(EscapingTextWriter writer)
+        {
+            if (Context.ExtractionContext.IsStandalone)
+            {
+                WriteStarId(writer);
+                return;
+            }
+            base.WriteQuotedId(writer);
+        }
+
         public override void WriteId(EscapingTextWriter trapFile)
         {
+            if (Context.ExtractionContext.IsStandalone)
+            {
+                WriteStarId(trapFile);
+                return;
+            }
+
             trapFile.Write("loc,");
             trapFile.WriteSubId(FileEntity);
             trapFile.Write(',');

csharp/extractor/Semmle.Extraction.CSharp/Entities/Parameter.cs

@@ -115,9 +115,10 @@ namespace Semmle.Extraction.CSharp.Entities
             var type = Type.Create(Context, Symbol.Type);
             trapFile.@params(this, Name, type.TypeRef, Ordinal, ParamKind, Parent!, Original);
 
-            foreach (var l in Symbol.Locations)
+            if (Context.ExtractLocation(Symbol))
             {
-                WriteLocationToTrap(trapFile.param_location, this, Context.CreateLocation(l));
+                var locations = Context.GetLocations(Symbol);
+                WriteLocationsToTrap(trapFile.param_location, this, locations);
             }
 
             if (!Symbol.Locations.Any() &&

csharp/extractor/Semmle.Extraction.CSharp/Entities/UserOperator.cs

@@ -26,7 +26,10 @@ namespace Semmle.Extraction.CSharp.Entities
                 returnType.TypeRef,
                 (UserOperator)OriginalDefinition);
 
-            WriteLocationsToTrap(trapFile.operator_location, this, Locations);
+            if (Context.ExtractLocation(Symbol))
+            {
+                WriteLocationsToTrap(trapFile.operator_location, this, Locations);
+            }
 
             if (IsSourceDeclaration)
             {

csharp/extractor/Semmle.Extraction.CSharp/Extractor/CompilerVersion.cs

@@ -74,7 +74,9 @@ namespace Semmle.Extraction.CSharp
                     specifiedFramework = compilerDir;
                 }
 
-                var versionInfo = FileVersionInfo.GetVersionInfo(SpecifiedCompiler);
+                // If csc is specified as compiler name, then attempt to read the version information from csc.dll
+                var compilerBinaryName = Path.GetFileName(SpecifiedCompiler) == "csc" ? $"{SpecifiedCompiler}.dll" : SpecifiedCompiler;
+                var versionInfo = FileVersionInfo.GetVersionInfo(File.Exists(compilerBinaryName) ? compilerBinaryName : SpecifiedCompiler);
                 if (!knownCompilerNames.TryGetValue(versionInfo.OriginalFilename ?? string.Empty, out var vendor))
                 {
                     SkipExtractionBecause("the compiler name is not recognised");

csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 1.7.50
+
+No user-facing changes.
+
 ## 1.7.49
 
 No user-facing changes.

csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.50.md

@@ -0,0 +1,3 @@
+## 1.7.50
+
+No user-facing changes.

csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.7.49
+lastReleaseVersion: 1.7.50

csharp/ql/campaigns/Solorigate/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-all
-version: 1.7.50-dev
+version: 1.7.51-dev
 groups:
   - csharp
   - solorigate

csharp/ql/campaigns/Solorigate/src/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 1.7.50
+
+No user-facing changes.
+
 ## 1.7.49
 
 No user-facing changes.

csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.50.md

@@ -0,0 +1,3 @@
+## 1.7.50
+
+No user-facing changes.

csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.7.49
+lastReleaseVersion: 1.7.50

csharp/ql/campaigns/Solorigate/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-queries
-version: 1.7.50-dev
+version: 1.7.51-dev
 groups:
   - csharp
   - solorigate

csharp/ql/integration-tests/linux/dotnet_10_rc2/Program.cs

@@ -0,0 +1 @@
+Console.WriteLine($"<arguments>{string.Join(",", args)}</arguments>");

csharp/ql/integration-tests/linux/dotnet_10_rc2/dotnet_build.csproj

@@ -0,0 +1,10 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+  </PropertyGroup>
+
+</Project>

csharp/ql/integration-tests/linux/dotnet_10_rc2/global.json

@@ -0,0 +1,5 @@
+{
+    "sdk": {
+        "version": "10.0.100-rc.2.25502.107"
+    }
+}

csharp/ql/integration-tests/linux/dotnet_10_rc2/test.py

@@ -0,0 +1,6 @@
+import os
+import runs_on
+
+@runs_on.linux
+def test(codeql, csharp):
+    codeql.database.create()

csharp/ql/integration-tests/windows/dotnet_10_rc2/Program.cs

@@ -0,0 +1 @@
+Console.WriteLine($"<arguments>{string.Join(",", args)}</arguments>");

csharp/ql/integration-tests/windows/dotnet_10_rc2/dotnet_build.csproj

@@ -0,0 +1,10 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+  </PropertyGroup>
+
+</Project>

csharp/ql/integration-tests/windows/dotnet_10_rc2/global.json

@@ -0,0 +1,5 @@
+{
+    "sdk": {
+        "version": "10.0.100-rc.2.25502.107"
+    }
+}

csharp/ql/integration-tests/windows/dotnet_10_rc2/test.py

@@ -0,0 +1,6 @@
+import os
+import runs_on
+
+@runs_on.windows
+def test(codeql, csharp):
+    codeql.database.create()

csharp/ql/lib/CHANGELOG.md

@@ -1,3 +1,12 @@
+## 5.2.6
+
+### Minor Analysis Improvements
+
+* The extraction of location information for parameters, fields, constructors, destructors and user operators has been optimized. Previously, location information was extracted multiple times for each bound generic. Now, only the location of the unbound generic declaration is extracted during the extraction phase, and the QL library explicitly reuses this location for all bound instances of the same generic.
+* The extraction of location information for type parameters and tuples types has been optimized. Previously, location information was extracted multiple times for each type when it was declared across multiple files. Now, the extraction context is respected during the extraction phase, ensuring locations are only extracted within the appropriate context. This change should be transparent to end-users but may improve extraction performance in some cases.
+* The extraction of location information for named types (classes, structs, etc.) has been optimized. Previously, location information was extracted multiple times for each type when it was declared across multiple files. Now, the extraction context is respected during the extraction phase, ensuring locations are only extracted within the appropriate context. This change should be transparent to end-users but may improve extraction performance in some cases.
+* The extraction of the location for bound generic entities (methods, accessors, indexers, properties, and events) has been optimized. Previously, location information was extracted multiple times for each bound generic. Now, only the location of the unbound generic declaration is extracted during the extraction phase, and the QL library explicitly reuses this location for all bound instances of the same generic.
+
 ## 5.2.5
 
 No user-facing changes.

csharp/ql/lib/change-notes/2025-10-02-entity-locations.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* The extraction of the location for bound generic entities (methods, accessors, indexers, properties, and events) has been optimized. Previously, location information was extracted multiple times for each bound generic. Now, only the location of the unbound generic declaration is extracted during the extraction phase, and the QL library explicitly reuses this location for all bound instances of the same generic.

csharp/ql/lib/change-notes/2025-10-03-nullness.md

@@ -0,0 +1,4 @@
+---
+category: majorAnalysis
+---
+* The representation of the C# control-flow graph has been significantly changed. This has minor effects on a wide range of queries including both minor improvements and minor regressions, for example, improved precision has been observed for `cs/inefficient-containskey` and `cs/stringbuilder-creation-in-loop`. Two queries stand out as being significantly affected with great improvements: `cs/dereferenced-value-may-be-null` has been completely rewritten which removes a very significant number of false positives. Furthermore, `cs/constant-condition` has been updated to report many new results - these new results are primarily expected to be true positives, but a few new false positives are expected as well. As part of these changes, `cs/dereferenced-value-may-be-null` has been changed from a `path-problem` query to a `problem` query, so paths are no longer reported for this query.

csharp/ql/lib/change-notes/2025-10-07-entity-locations.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* The extraction of location information for named types (classes, structs, etc.) has been optimized. Previously, location information was extracted multiple times for each type when it was declared across multiple files. Now, the extraction context is respected during the extraction phase, ensuring locations are only extracted within the appropriate context. This change should be transparent to end-users but may improve extraction performance in some cases.

csharp/ql/lib/change-notes/2025-10-08-entity-locations.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* The extraction of location information for type parameters and tuples types has been optimized. Previously, location information was extracted multiple times for each type when it was declared across multiple files. Now, the extraction context is respected during the extraction phase, ensuring locations are only extracted within the appropriate context. This change should be transparent to end-users but may improve extraction performance in some cases.