Fix models

.bazelrc

@@ -25,6 +25,5 @@ common --registry=https://bcr.bazel.build
 
 common --@rules_dotnet//dotnet/settings:strict_deps=false
 common --experimental_isolated_extension_usages
-common --incompatible_use_plus_in_repo_names
 
 try-import %workspace%/local.bazelrc

Cargo.lock

@@ -112,16 +112,6 @@ version = "0.7.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7c02d123df017efcdfbd739ef81735b36c5ba83ec3c59c80a9d7ecc718f92e50"
 
-[[package]]
-name = "ast-generator"
-version = "0.1.0"
-dependencies = [
- "itertools 0.10.5",
- "proc-macro2",
- "quote",
- "ungrammar",
-]
-
 [[package]]
 name = "atomic"
 version = "0.6.0"
@@ -390,13 +380,11 @@ dependencies = [
  "ra_ap_base_db",
  "ra_ap_hir",
  "ra_ap_hir_def",
- "ra_ap_hir_expand",
  "ra_ap_ide_db",
  "ra_ap_load-cargo",
  "ra_ap_parser",
  "ra_ap_paths",
  "ra_ap_project_model",
- "ra_ap_span",
  "ra_ap_syntax",
  "ra_ap_vfs",
  "rust-extractor-macros",
@@ -693,6 +681,16 @@ version = "0.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7ab85b9b05e3978cc9a9cf8fea7f01b494e1a09ed3037e16ba39edc7a29eb61a"
 
+[[package]]
+name = "generate-schema"
+version = "0.1.0"
+dependencies = [
+ "itertools 0.10.5",
+ "proc-macro2",
+ "quote",
+ "ungrammar",
+]
+
 [[package]]
 name = "getrandom"
 version = "0.2.15"

Cargo.toml

@@ -7,7 +7,7 @@ members = [
     "ruby/extractor",
     "rust/extractor",
     "rust/extractor/macros",
-    "rust/ast-generator",
+    "rust/generate-schema",
 ]
 
 [patch.crates-io]

MODULE.bazel

@@ -23,11 +23,11 @@ bazel_dep(name = "bazel_skylib", version = "1.6.1")
 bazel_dep(name = "abseil-cpp", version = "20240116.0", repo_name = "absl")
 bazel_dep(name = "nlohmann_json", version = "3.11.3", repo_name = "json")
 bazel_dep(name = "fmt", version = "10.0.0")
-bazel_dep(name = "rules_kotlin", version = "2.0.0-codeql.1")
+bazel_dep(name = "rules_kotlin", version = "1.9.4-codeql.1")
 bazel_dep(name = "gazelle", version = "0.38.0")
 bazel_dep(name = "rules_dotnet", version = "0.15.1")
 bazel_dep(name = "googletest", version = "1.14.0.bcr.1")
-bazel_dep(name = "rules_rust", version = "0.52.2")
+bazel_dep(name = "rules_rust", version = "0.50.0")
 
 bazel_dep(name = "buildifier_prebuilt", version = "6.4.0", dev_dependency = True)
 
@@ -61,7 +61,7 @@ r.from_cargo(
         "//ruby/extractor:Cargo.toml",
         "//rust/extractor:Cargo.toml",
         "//rust/extractor/macros:Cargo.toml",
-        "//rust/ast-generator:Cargo.toml",
+        "//rust/generate-schema:Cargo.toml",
         "//shared/tree-sitter-extractor:Cargo.toml",
     ],
 )
@@ -128,7 +128,6 @@ use_repo(
     "kotlin-compiler-1.9.20-Beta",
     "kotlin-compiler-2.0.0-RC1",
     "kotlin-compiler-2.0.20-Beta2",
-    "kotlin-compiler-2.1.0-Beta1",
     "kotlin-compiler-embeddable-1.5.0",
     "kotlin-compiler-embeddable-1.5.10",
     "kotlin-compiler-embeddable-1.5.20",
@@ -142,7 +141,6 @@ use_repo(
     "kotlin-compiler-embeddable-1.9.20-Beta",
     "kotlin-compiler-embeddable-2.0.0-RC1",
     "kotlin-compiler-embeddable-2.0.20-Beta2",
-    "kotlin-compiler-embeddable-2.1.0-Beta1",
     "kotlin-stdlib-1.5.0",
     "kotlin-stdlib-1.5.10",
     "kotlin-stdlib-1.5.20",
@@ -156,7 +154,6 @@ use_repo(
     "kotlin-stdlib-1.9.20-Beta",
     "kotlin-stdlib-2.0.0-RC1",
     "kotlin-stdlib-2.0.20-Beta2",
-    "kotlin-stdlib-2.1.0-Beta1",
 )
 
 go_sdk = use_extension("@rules_go//go:extensions.bzl", "go_sdk")

config/identical-files.json

@@ -57,6 +57,10 @@
     "java/ql/lib/semmle/code/java/dataflow/internal/rangeanalysis/SsaReadPositionCommon.qll",
     "csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/SsaReadPositionCommon.qll"
   ],
+  "Model as Data Generation Java/C# - CaptureModels": [
+    "java/ql/src/utils/modelgenerator/internal/CaptureModels.qll",
+    "csharp/ql/src/utils/modelgenerator/internal/CaptureModels.qll"
+  ],
   "Sign Java/C#": [
     "java/ql/lib/semmle/code/java/dataflow/internal/rangeanalysis/Sign.qll",
     "csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/Sign.qll"
@@ -351,9 +355,5 @@
   "Python model summaries test extension": [
     "python/ql/test/library-tests/dataflow/model-summaries/InlineTaintTest.ext.yml",
     "python/ql/test/library-tests/dataflow/model-summaries/NormalDataflowTest.ext.yml"
-  ],
-  "Diagnostics.qll": [
-    "ruby/ql/lib/codeql/ruby/Diagnostics.qll",
-    "rust/ql/lib/codeql/rust/Diagnostics.qll"
   ]
 }

cpp/downgrades/6f5d51e89e762fe4609fd4ac8ee3afb04221e873/exprs.ql

@@ -1,15 +0,0 @@
-class Expr extends @expr {
-  string toString() { none() }
-}
-
-class Location extends @location_expr {
-  string toString() { none() }
-}
-
-predicate isExprRequires(Expr expr) { exists(int kind | exprs(expr, kind, _) | kind = 390) }
-
-from Expr expr, int kind, int kind_new, Location location
-where
-  exprs(expr, kind, location) and
-  if isExprRequires(expr) then kind_new = 1 else kind_new = kind
-select expr, kind_new, location

cpp/downgrades/6f5d51e89e762fe4609fd4ac8ee3afb04221e873/upgrade.properties

@@ -1,3 +0,0 @@
-description: Add requires expr
-compatibility: partial
-exprs.rel: run exprs.qlo

cpp/downgrades/e51fad7a2436caefab0c6bd52f05e28e7cce4d92/exprs.ql

@@ -1,17 +0,0 @@
-class Expr extends @expr {
-  string toString() { none() }
-}
-
-class Location extends @location_expr {
-  string toString() { none() }
-}
-
-predicate isExprRequirement(Expr expr) {
-  exists(int kind | exprs(expr, kind, _) | kind = [391, 392, 393])
-}
-
-from Expr expr, int kind, int kind_new, Location location
-where
-  exprs(expr, kind, location) and
-  if isExprRequirement(expr) then kind_new = 1 else kind_new = kind
-select expr, kind_new, location

cpp/downgrades/e51fad7a2436caefab0c6bd52f05e28e7cce4d92/params.ql

@@ -1,17 +0,0 @@
-class Parameter extends @parameter {
-  string toString() { none() }
-}
-
-class ParameterizedElement extends @parameterized_element {
-  string toString() { none() }
-}
-
-class Type extends @type {
-  string toString() { none() }
-}
-
-from Parameter param, ParameterizedElement pe, int index, Type type
-where
-  params(param, pe, index, type) and
-  not pe instanceof @requires_expr
-select param, pe, index, type

cpp/downgrades/e51fad7a2436caefab0c6bd52f05e28e7cce4d92/upgrade.properties

@@ -1,5 +0,0 @@
-description: Support C++20 requires expressions
-compatibility: partial
-compound_requirement_is_noexcept.rel: delete
-exprs.rel: run exprs.qlo
-params.rel: run params.qlo

cpp/ql/lib/CHANGELOG.md

@@ -1,14 +1,3 @@
-## 2.0.2
-
-### Minor Analysis Improvements
-
-* Added taint flow model for `fopen` and related functions.
-* The `SimpleRangeAnalysis` library (`semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis`) now generates more precise ranges for calls to `fgetc` and `getc`.
-
-## 2.0.1
-
-No user-facing changes.
-
 ## 2.0.0
 
 ### Breaking Changes

cpp/ql/lib/change-notes/2014-10-11-requires-expressions.md

@@ -1,4 +0,0 @@
----
-category: feature
----
-* Added classes `RequiresExpr`, `SimpleRequirementExpr`, `TypeRequirementExpr`, `CompoundRequirementExpr`, and `NestedRequirementExpr` to represent C++20 requires expressions and the simple, type, compound, and nested requirements that can occur in `requires` expressions.

cpp/ql/lib/change-notes/2024-10-16-function-pointer-resolution.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* The function call target resolution algorithm has been improved to resolve more calls through function pointers. As a result, dataflow queries may have more results.

cpp/ql/lib/change-notes/2024-10-16-new-api-for-call-target-resolution.md

@@ -1,4 +0,0 @@
----
-category: feature
----
-* Added a new predicate `DataFlow::getARuntimeTarget` for getting a function that may be invoked by a `Call` expression. Unlike `Call.getTarget` this new predicate may also resolve function pointers.

cpp/ql/lib/change-notes/released/2.0.1.md

@@ -1,3 +0,0 @@
-## 2.0.1
-
-No user-facing changes.

cpp/ql/lib/change-notes/released/2.0.2.md

@@ -1,6 +0,0 @@
-## 2.0.2
-
-### Minor Analysis Improvements
-
-* Added taint flow model for `fopen` and related functions.
-* The `SimpleRangeAnalysis` library (`semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis`) now generates more precise ranges for calls to `fgetc` and `getc`.

cpp/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 2.0.2
+lastReleaseVersion: 2.0.0

cpp/ql/lib/cpp.qll

@@ -17,7 +17,6 @@ import semmle.code.cpp.File
 import semmle.code.cpp.Linkage
 import semmle.code.cpp.Location
 import semmle.code.cpp.Compilation
-import semmle.code.cpp.Concept
 import semmle.code.cpp.Element
 import semmle.code.cpp.Namespace
 import semmle.code.cpp.Specifier

cpp/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/cpp-all
-version: 2.0.3-dev
+version: 2.0.1-dev
 groups: cpp
 dbscheme: semmlecode.cpp.dbscheme
 extractor: cpp

cpp/ql/lib/semmle/code/cpp/Concept.qll

@@ -1,161 +0,0 @@
-/**
- * Provides classes for working with C++ concepts.
- */
-
-import semmle.code.cpp.exprs.Expr
-
-/**
- * A C++ requires expression.
- *
- * For example, with `T` and `U` template parameters:
- * ```cpp
- * requires (T x, U y) { x + y; };
- * ```
- */
-class RequiresExpr extends Expr, @requires_expr {
-  override string toString() {
-    if exists(this.getAParameter())
-    then result = "requires(...) { ... }"
-    else result = "requires { ... }"
-  }
-
-  override string getAPrimaryQlClass() { result = "RequiresExpr" }
-
-  /**
-   * Gets a requirement in this requires expression.
-   */
-  RequirementExpr getARequirement() { result = this.getAChild() }
-
-  /**
-   * Gets the nth requirement in this requires expression.
-   */
-  RequirementExpr getRequirement(int n) { result = this.getChild(n) }
-
-  /**
-   * Gets the number of requirements in this requires expression.
-   */
-  int getNumberOfRequirements() { result = count(this.getARequirement()) }
-
-  /**
-   * Gets a parameter of this requires expression, if any.
-   */
-  Parameter getAParameter() { result.getRequiresExpr() = underlyingElement(this) }
-
-  /**
-   * Gets the the nth parameter of this requires expression.
-   */
-  Parameter getParameter(int n) {
-    result.getRequiresExpr() = underlyingElement(this) and result.getIndex() = n
-  }
-
-  /**
-   * Gets the number of parameters of this requires expression.
-   */
-  int getNumberOfParameters() { result = count(this.getAParameter()) }
-}
-
-/**
- * A C++ requirement in a requires expression.
- */
-class RequirementExpr extends Expr { }
-
-/**
- * A C++ simple requirement in a requires expression.
- *
- * For example, if:
- * ```cpp
- * requires(T x, U y) { x + y; };
- * ```
- * with `T` and `U` template parameters, then `x + y;` is a simple requirement.
- */
-class SimpleRequirementExpr extends RequirementExpr {
-  SimpleRequirementExpr() {
-    this.getParent() instanceof RequiresExpr and
-    not this instanceof TypeRequirementExpr and
-    not this instanceof CompoundRequirementExpr and
-    not this instanceof NestedRequirementExpr
-  }
-
-  override string getAPrimaryQlClass() { result = "SimpleRequirementExpr" }
-}
-
-/**
- * A C++ type requirement in a requires expression.
- *
- * For example, if:
- * ```cpp
- * requires { typename T::a_field; };
- * ```
- * with `T` a template parameter, then `typename T::a_field;` is a type requirement.
- */
-class TypeRequirementExpr extends RequirementExpr, TypeName {
-  TypeRequirementExpr() { this.getParent() instanceof RequiresExpr }
-
-  override string getAPrimaryQlClass() { result = "TypeRequirementExpr" }
-}
-
-/**
- * A C++ compound requirement in a requires expression.
- *
- * For example, if:
- * ```cpp
- * requires(T x) { { x } noexcept -> std::same_as<int>; };
- * ```
- * with `T` a template parameter, then `{ x } noexcept -> std::same_as<int>;` is
- * a compound requirement.
- */
-class CompoundRequirementExpr extends RequirementExpr, @compound_requirement {
-  override string toString() {
-    if exists(this.getReturnTypeRequirement())
-    then result = "{ ... } -> ..."
-    else result = "{ ... }"
-  }
-
-  override string getAPrimaryQlClass() { result = "CompoundRequirementExpr" }
-
-  /**
-   * Gets the expression from the compound requirement.
-   */
-  Expr getExpr() { result = this.getChild(0) }
-
-  /**
-   * Gets the return type requirement from the compound requirement, if any.
-   */
-  Expr getReturnTypeRequirement() { result = this.getChild(1) }
-
-  /**
-   * Holds if the expression from the compound requirement must not be
-   * potentially throwing.
-   */
-  predicate isNoExcept() { compound_requirement_is_noexcept(underlyingElement(this)) }
-}
-
-/**
- * A C++ nested requirement in a requires expression.
- *
- * For example, if:
- * ```cpp
- * requires { requires std::is_same<T, int>::value; };
- * ```
- * with `T` a template parameter, then `requires std::is_same<T, int>::value;` is
- * a nested requirement.
- */
-class NestedRequirementExpr extends Expr, @nested_requirement {
-  override string toString() { result = "requires ..." }
-
-  override string getAPrimaryQlClass() { result = "NestedRequirementExpr" }
-
-  /**
-   * Gets the constraint from the nested requirement.
-   */
-  Expr getConstraint() { result = this.getChild(0) }
-}
-
-/**
- * A C++ concept id expression.
- */
-class ConceptIdExpr extends RequirementExpr, @concept_id {
-  override string toString() { result = "concept<...>" }
-
-  override string getAPrimaryQlClass() { result = "ConceptIdExpr" }
-}

cpp/ql/lib/semmle/code/cpp/Element.qll

@@ -129,7 +129,7 @@ class Element extends ElementBase {
    * or certain kinds of `Statement`.
    */
   Element getParentScope() {
-    // result instanceof Class
+    // result instanceof class
     exists(Declaration m |
       m = this and
       result = m.getDeclaringType() and
@@ -138,40 +138,31 @@ class Element extends ElementBase {
     or
     exists(TemplateClass tc | this = tc.getATemplateArgument() and result = tc)
     or
-    // result instanceof Namespace
+    // result instanceof namespace
     exists(Namespace n | result = n and n.getADeclaration() = this)
     or
     exists(FriendDecl d, Namespace n | this = d and n.getADeclaration() = d and result = n)
     or
     exists(Namespace n | this = n and result = n.getParentNamespace())
     or
-    // result instanceof Stmt
+    // result instanceof stmt
     exists(LocalVariable v |
       this = v and
       exists(DeclStmt ds | ds.getADeclaration() = v and result = ds.getParent())
     )
     or
-    exists(Parameter p |
-      this = p and
-      (
-        result = p.getFunction() or
-        result = p.getCatchBlock().getParent().(Handler).getParent().(TryStmt).getParent() or
-        result = p.getRequiresExpr().getEnclosingStmt().getParent()
-      )
-    )
+    exists(Parameter p | this = p and result = p.getFunction())
     or
     exists(GlobalVariable g, Namespace n | this = g and n.getADeclaration() = g and result = n)
     or
-    exists(TemplateVariable tv | this = tv.getATemplateArgument() and result = tv)
-    or
     exists(EnumConstant e | this = e and result = e.getDeclaringEnum())
     or
-    // result instanceof Block|Function
+    // result instanceof block|function
     exists(BlockStmt b | this = b and blockscope(unresolveElement(b), unresolveElement(result)))
     or
     exists(TemplateFunction tf | this = tf.getATemplateArgument() and result = tf)
     or
-    // result instanceof Stmt
+    // result instanceof stmt
     exists(ControlStructure s | this = s and result = s.getParent())
     or
     using_container(unresolveElement(result), underlyingElement(this))

cpp/ql/lib/semmle/code/cpp/Function.qll

@@ -500,17 +500,6 @@ class Function extends Declaration, ControlFlowNode, AccessHolder, @function {
    * Gets the nearest enclosing AccessHolder.
    */
   override AccessHolder getEnclosingAccessHolder() { result = this.getDeclaringType() }
-
-  /**
-   * Holds if this function has extraction errors that create an `ErrorExpr`.
-   */
-  predicate hasErrors() {
-    exists(ErrorExpr e |
-      e.getEnclosingFunction() = this and
-      // Exclude the first allocator call argument because it is always extracted as `ErrorExpr`.
-      not exists(NewOrNewArrayExpr new | e = new.getAllocatorCall().getArgument(0))
-    )
-  }
 }
 
 pragma[noinline]
@@ -662,8 +651,7 @@ class FunctionDeclarationEntry extends DeclarationEntry, @fun_decl {
 
   /**
    * Holds if this declaration is an implicit function declaration, that is,
-   * where a function is used before it is declared (under older C standards,
-   * or when there were parse errors).
+   * where a function is used before it is declared (under older C standards).
    */
   predicate isImplicit() { fun_implicit(underlyingElement(this)) }
 

cpp/ql/lib/semmle/code/cpp/Parameter.qll

@@ -7,8 +7,8 @@ import semmle.code.cpp.Declaration
 private import semmle.code.cpp.internal.ResolveClass
 
 /**
- * A C/C++ function parameter, catch block parameter, or requires expression parameter.
- * For example the function parameter `p` and the catch block parameter `e` in the following
+ * A C/C++ function parameter or catch block parameter. For example the
+ * function parameter `p` and the catch block parameter `e` in the following
  * code:
  * ```
  * void myFunction(int p) {
@@ -20,8 +20,8 @@ private import semmle.code.cpp.internal.ResolveClass
  * }
  * ```
  *
- * For catch block parameters and expression , there is a one-to-one
- * correspondence between the `Parameter` and its `VariableDeclarationEntry`.
+ * For catch block parameters, there is a one-to-one correspondence between
+ * the `Parameter` and its `ParameterDeclarationEntry`.
  *
  * For function parameters, there is a one-to-many relationship between
  * `Parameter` and `ParameterDeclarationEntry`, because one function can
@@ -73,8 +73,7 @@ class Parameter extends LocalScopeVariable, @parameter {
   }
 
   private VariableDeclarationEntry getANamedDeclarationEntry() {
-    result = this.getAnEffectiveDeclarationEntry() and
-    exists(string name | var_decls(unresolveElement(result), _, _, name, _) | name != "")
+    result = this.getAnEffectiveDeclarationEntry() and result.getName() != ""
   }
 
   /**
@@ -119,12 +118,6 @@ class Parameter extends LocalScopeVariable, @parameter {
    */
   BlockStmt getCatchBlock() { params(underlyingElement(this), unresolveElement(result), _, _) }
 
-  /**
-   * Gets the requires expression to which the parameter belongs, if it is a
-   * requires expression parameter.
-   */
-  RequiresExpr getRequiresExpr() { params(underlyingElement(this), unresolveElement(result), _, _) }
-
   /**
    * Gets the zero-based index of this parameter.
    *

cpp/ql/lib/semmle/code/cpp/PrintAST.qll

@@ -80,10 +80,6 @@ private Declaration getAnEnclosingDeclaration(Locatable ast) {
   or
   result = ast.(Parameter).getFunction()
   or
-  result = ast.(Parameter).getCatchBlock().getEnclosingFunction()
-  or
-  result = ast.(Parameter).getRequiresExpr().getEnclosingFunction()
-  or
   result = ast.(Expr).getEnclosingDeclaration()
   or
   result = ast.(Initializer).getDeclaration()
@@ -103,10 +99,7 @@ private newtype TPrintAstNode =
     stmt.getADeclarationEntry() = entry and
     shouldPrintDeclaration(stmt.getEnclosingFunction())
   } or
-  TFunctionParametersNode(Function func) { shouldPrintDeclaration(func) } or
-  TRequiresExprParametersNode(RequiresExpr req) {
-    shouldPrintDeclaration(getAnEnclosingDeclaration(req))
-  } or
+  TParametersNode(Function func) { shouldPrintDeclaration(func) } or
   TConstructorInitializersNode(Constructor ctor) {
     ctor.hasEntryPoint() and
     shouldPrintDeclaration(ctor)
@@ -310,14 +303,14 @@ class ExprNode extends AstNode {
 
   ExprNode() { expr = ast }
 
-  override PrintAstNode getChildInternal(int childIndex) {
-    result.(AstNode).getAst() = expr.getChild(childIndex)
+  override AstNode getChildInternal(int childIndex) {
+    result.getAst() = expr.getChild(childIndex)
     or
     childIndex = max(int index | exists(expr.getChild(index)) or index = 0) + 1 and
-    result.(AstNode).getAst() = expr.(ConditionDeclExpr).getInitializingExpr()
+    result.getAst() = expr.(ConditionDeclExpr).getInitializingExpr()
     or
     exists(int destructorIndex |
-      result.(AstNode).getAst() = expr.getImplicitDestructorCall(destructorIndex) and
+      result.getAst() = expr.getImplicitDestructorCall(destructorIndex) and
       childIndex = destructorIndex + max(int index | exists(expr.getChild(index)) or index = 0) + 2
     )
   }
@@ -336,8 +329,7 @@ class ExprNode extends AstNode {
   }
 
   override string getChildAccessorPredicateInternal(int childIndex) {
-    result =
-      getChildAccessorWithoutConversions(ast, this.getChildInternal(childIndex).(AstNode).getAst())
+    result = getChildAccessorWithoutConversions(ast, this.getChildInternal(childIndex).getAst())
   }
 
   /**
@@ -417,26 +409,6 @@ class StmtExprNode extends ExprNode {
   }
 }
 
-/**
- * A node representing a `RequiresExpr`
- */
-class RequiresExprNode extends ExprNode {
-  override RequiresExpr expr;
-
-  override PrintAstNode getChildInternal(int childIndex) {
-    result = super.getChildInternal(childIndex)
-    or
-    childIndex = -1 and
-    result.(RequiresExprParametersNode).getRequiresExpr() = expr
-  }
-
-  override string getChildAccessorPredicateInternal(int childIndex) {
-    result = super.getChildAccessorPredicateInternal(childIndex)
-    or
-    childIndex = -1 and result = "<params>"
-  }
-}
-
 /**
  * A node representing a `DeclarationEntry`.
  */
@@ -538,22 +510,6 @@ class DeclStmtNode extends StmtNode {
   }
 }
 
-/**
- * A node representing a `Handler`.
- */
-class HandlerNode extends ChildStmtNode {
-  Handler handler;
-
-  HandlerNode() { handler = stmt }
-
-  override BaseAstNode getChildInternal(int childIndex) {
-    result = super.getChildInternal(childIndex)
-    or
-    childIndex = -1 and
-    result.getAst() = handler.getParameter()
-  }
-}
-
 /**
  * A node representing a `Parameter`.
  */
@@ -596,10 +552,10 @@ class InitializerNode extends AstNode {
 /**
  * A node representing the parameters of a `Function`.
  */
-class FunctionParametersNode extends PrintAstNode, TFunctionParametersNode {
+class ParametersNode extends PrintAstNode, TParametersNode {
   Function func;
 
-  FunctionParametersNode() { this = TFunctionParametersNode(func) }
+  ParametersNode() { this = TParametersNode(func) }
 
   final override string toString() { result = "" }
 
@@ -620,33 +576,6 @@ class FunctionParametersNode extends PrintAstNode, TFunctionParametersNode {
   final Function getFunction() { result = func }
 }
 
-/**
- * A node representing the parameters of a `RequiresExpr`.
- */
-class RequiresExprParametersNode extends PrintAstNode, TRequiresExprParametersNode {
-  RequiresExpr req;
-
-  RequiresExprParametersNode() { this = TRequiresExprParametersNode(req) }
-
-  final override string toString() { result = "" }
-
-  final override Location getLocation() { result = getRepresentativeLocation(req) }
-
-  override AstNode getChildInternal(int childIndex) {
-    result.getAst() = req.getParameter(childIndex)
-  }
-
-  override string getChildAccessorPredicateInternal(int childIndex) {
-    exists(this.getChildInternal(childIndex)) and
-    result = "getParameter(" + childIndex.toString() + ")"
-  }
-
-  /**
-   * Gets the `RequiresExpr` for which this node represents the parameters.
-   */
-  final RequiresExpr getRequiresExpr() { result = req }
-}
-
 /**
  * A node representing the initializer list of a `Constructor`.
  */
@@ -750,7 +679,7 @@ class FunctionNode extends FunctionOrGlobalOrNamespaceVariableNode {
 
   override PrintAstNode getChildInternal(int childIndex) {
     childIndex = 0 and
-    result.(FunctionParametersNode).getFunction() = func
+    result.(ParametersNode).getFunction() = func
     or
     childIndex = 1 and
     result.(ConstructorInitializersNode).getConstructor() = func
@@ -825,8 +754,6 @@ private predicate namedStmtChildPredicates(Locatable s, Element e, string pred)
     or
     s.(ConstexprIfStmt).getElse() = e and pred = "getElse()"
     or
-    s.(Handler).getParameter() = e and pred = "getParameter()"
-    or
     s.(IfStmt).getInitialization() = e and pred = "getInitialization()"
     or
     s.(IfStmt).getCondition() = e and pred = "getCondition()"
@@ -974,11 +901,6 @@ private predicate namedExprChildPredicates(Expr expr, Element ele, string pred)
     or
     expr.(CommaExpr).getRightOperand() = ele and pred = "getRightOperand()"
     or
-    expr.(CompoundRequirementExpr).getExpr() = ele and pred = "getExpr()"
-    or
-    expr.(CompoundRequirementExpr).getReturnTypeRequirement() = ele and
-    pred = "getReturnTypeRequirement()"
-    or
     expr.(ConditionDeclExpr).getVariableAccess() = ele and pred = "getVariableAccess()"
     or
     expr.(ConstructorFieldInit).getExpr() = ele and pred = "getExpr()"
@@ -999,8 +921,6 @@ private predicate namedExprChildPredicates(Expr expr, Element ele, string pred)
     or
     expr.(LambdaExpression).getInitializer() = ele and pred = "getInitializer()"
     or
-    expr.(NestedRequirementExpr).getConstraint() = ele and pred = "getConstraint()"
-    or
     expr.(NewOrNewArrayExpr).getAllocatorCall() = ele and pred = "getAllocatorCall()"
     or
     expr.(NewOrNewArrayExpr).getAlignmentArgument() = ele and pred = "getAlignmentArgument()"
@@ -1040,11 +960,6 @@ private predicate namedExprChildPredicates(Expr expr, Element ele, string pred)
     or
     expr.(UnaryOperation).getOperand() = ele and pred = "getOperand()"
     or
-    exists(int n |
-      expr.(RequiresExpr).getRequirement(n) = ele and
-      pred = "getRequirement(" + n + ")"
-    )
-    or
     expr.(SizeofExprOperator).getExprOperand() = ele and pred = "getExprOperand()"
     or
     expr.(StmtExpr).getStmt() = ele and pred = "getStmt()"

cpp/ql/lib/semmle/code/cpp/Type.qll

@@ -39,8 +39,8 @@ class Type extends Locatable, @type {
 
   /**
    * Gets a specifier of this type, recursively looking through `typedef` and
-   * `decltype`. For example, in the context of `typedef const int *restrict t`,
-   * the type `volatile t` has specifiers `volatile` and `restrict` but not
+   * `decltype`. For example, in the context of `typedef const int *restrict
+   * t`, the type `volatile t` has specifiers `volatile` and `restrict` but not
    * `const` since the `const` is attached to the type being pointed to rather
    * than the pointer itself.
    */

cpp/ql/lib/semmle/code/cpp/Variable.qll

@@ -241,10 +241,6 @@ class VariableDeclarationEntry extends DeclarationEntry, @var_decl {
         name != "" and result = name
         or
         name = "" and result = this.getVariable().(LocalVariable).getName()
-        or
-        name = "" and
-        not this instanceof ParameterDeclarationEntry and
-        result = this.getVariable().(Parameter).getName()
       )
     )
   }
@@ -299,11 +295,19 @@ class ParameterDeclarationEntry extends VariableDeclarationEntry {
 
   private string getAnonymousParameterDescription() {
     not exists(this.getName()) and
-    exists(string anon |
-      anon = "(unnamed parameter " + this.getIndex().toString() + ")" and
+    exists(string idx |
+      idx =
+        ((this.getIndex() + 1).toString() + "th")
+            .replaceAll("1th", "1st")
+            .replaceAll("2th", "2nd")
+            .replaceAll("3th", "3rd")
+            .replaceAll("11st", "11th")
+            .replaceAll("12nd", "12th")
+            .replaceAll("13rd", "13th") and
       if exists(this.getCanonicalName())
-      then result = "declaration of " + this.getCanonicalName() + " as " + anon
-      else result = "declaration of " + anon
+      then
+        result = "declaration of " + this.getCanonicalName() + " as anonymous " + idx + " parameter"
+      else result = "declaration of " + idx + " parameter"
     )
   }
 

cpp/ql/lib/semmle/code/cpp/internal/QualifiedName.qll

@@ -181,7 +181,12 @@ class VariableDeclarationEntry extends @var_decl {
   string getName() { var_decls(this, _, _, result, _) and result != "" }
 }
 
-class Parameter extends LocalScopeVariable, @parameter { }
+class Parameter extends LocalScopeVariable, @parameter {
+  @functionorblock function;
+  int index;
+
+  Parameter() { params(this, function, index, _) }
+}
 
 class GlobalOrNamespaceVariable extends Variable, @globalvariable { }
 

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll

@@ -1328,10 +1328,7 @@ predicate lambdaCreation(Node creation, LambdaCallKind kind, DataFlowCallable c)
 
 /** Holds if `call` is a lambda call of kind `kind` where `receiver` is the lambda expression. */
 predicate lambdaCall(DataFlowCall call, LambdaCallKind kind, Node receiver) {
-  (
-    call.(SummaryCall).getReceiver() = receiver.(FlowSummaryNode).getSummaryNode() or
-    call.asCallInstruction().getCallTargetOperand() = receiver.asOperand()
-  ) and
+  call.(SummaryCall).getReceiver() = receiver.(FlowSummaryNode).getSummaryNode() and
   exists(kind)
 }
 

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll

@@ -17,7 +17,6 @@ private import SsaInternals as Ssa
 private import DataFlowImplCommon as DataFlowImplCommon
 private import codeql.util.Unit
 private import Node0ToString
-private import DataFlowDispatch as DataFlowDispatch
 import ExprNodes
 
 /**
@@ -2498,16 +2497,3 @@ class AdditionalCallTarget extends Unit {
    */
   abstract Declaration viableTarget(Call call);
 }
-
-/**
- * Gets a function that may be called by `call`.
- *
- * Note that `call` may be a call to a function pointer expression.
- */
-Function getARuntimeTarget(Call call) {
-  exists(DataFlowCall dfCall | dfCall.asCallInstruction().getUnconvertedResultExpression() = call |
-    result = DataFlowDispatch::viableCallable(dfCall).asSourceCallable()
-    or
-    result = DataFlowImplCommon::viableCallableLambda(dfCall, _).asSourceCallable()
-  )
-}

cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/PrintIR.qll

@@ -6,112 +6,6 @@
  * uses, however, it is better to write a query that imports `PrintIR.qll`, extends
  * `PrintIRConfiguration`, and overrides `shouldPrintDeclaration()` to select a subset of declarations
  * to dump.
- *
- * Anatomy of a printed IR instruction
- *
- * An instruction:
- *
- * ```
- * # 2281|     v2281_19(void) = Call[~String]     : func:r2281_18, this:r2281_17
- * ```
- *
- * The prefix `# 2281|` specifies that this instruction was generated by the C++ source code on line 2281.
- * Scrolling up in the printed output, one will eventually find the name of the file to which the line
- * belongs.
- *
- * `v2281_19(void)` is the result of the instruction. Here, `v` means this is a void result or operand (so
- * there should be no later uses of the result; see below for other possible values). The `2281_19` is a
- * unique ID for the result. This is usually just the line number plus a small integer suffix to make it
- * unique within the function. The type of the result is `void`. In this case, it is `void`, because
- * `~String` returns `void`. The type of the result is usually just the name of the appropriate C++ type,
- * but it will sometimes be a type like `glval<int>`, which means result holds a glvalue, which at the
- * IR level works like a pointer. In other words, in the source code the type was `int`, but it is really
- * more like an `int*`. We see this, for example, in `x = y;`, where `x` is a glvalue.
- *
- * `Call` is the opcode of the instruction. Common opcodes include:
- *
- * * Arithmetic operations: `Add`, `Sub`, `Mul`, etc.
- * * Memory access operations: `Load`, `Store`.
- * * Function calls: `Call`.
- * * Literals: `Constant`.
- * * Variable addresses: `VariableAddress`.
- * * Function entry points: `EnterFunction`.
- * * Return from a function: `Return`, `ReturnVoid`. Note that the value being returned is set separately by a
- *   `Store` to a special `#return` variable.
- * * Stack unwinding for C++ function that throw and where the exception escapes the function: `Unwind`.
- * * Common exit point for `Unwind` and `Return`: `ExitFunction`.
- * * SSA-related opcodes: `Phi`, `Chi`.
- *
- * `[~String]` denotes additional information. The information might be present earlier in the IR, as is the case
- * for `Call`, where it is the name of the called function. This is also the case for `Load` and `Store`, where it
- * is the name of the variable that loaded or stored (if known). In the case of `Constant`, `FieldAddress`, and
- * `VariableAddress`, the information between brackets does not occur earlier.
- *
- * `func:r2281_18` and `this:r28281_17` are the operands of the instruction. The `func:` prefix denotes the operand
- * that holds the address of the called function. The `this:` prefix denotes the argument to the special `this`
- * parameter of an instance member function. `r2281_18`, `r2281_17` are the unique IDs of the operands. Each of these
- * matches the ID of a previously seen result, showing where that value came from. The `r` means that these are
- * "register" operands (see below).
- *
- * Result and operand kinds:
- *
- * Every result and operand is one of these three kinds:
- *
- * * `r` "register". These operands are not stored in any particular memory location. We can think of them as
- *   temporary values created during the evaluation of an expression. A register operand almost always has one
- *   use, often in the same block as its definition.
- * *  `m` "memory". These operands represents accesses to a specific memory location. The location could be a
- *    local variable, a global variable, a field of an object, an element of an array, or any memory that we happen
- *    to have a pointer to. These only occur as the result of a `Store`, the source operand of a `Load` or on the
- *    SSA instructions (`Phi`, `Chi`).
- * * `v` "void". Really just a register operand, but we mark register operands of type void with this special prefix
- *   so we know that there is no actual value there.
- *
- * Branches in the IR:
- *
- * The IR is divided into basic blocks. At the end of each block, there are one or more edges showing the possible
- * control flow successors of the block.
- *
- * ```
- * #   44|     v44_3(void)    = ConditionalBranch : r44_2
- * #-----|   False -> Block 4
- * #-----|   True -> Block 3
- * ```
- * Here we have a block that ends with a conditional branch. The two edges show where the control flows to depending
- * on whether the condition is true or false.
- *
- * SSA instructions:
- *
- * We use `Phi` instructions in SSA to create a single definition for a variable that might be assigned on multiple
- * control flow paths. The `Phi` instruction merges the potential values of that variable from each predecessor edge,
- * and the resulting definition is then used wherever that variable is accessed later on.
- *
- * When dealing with aliased memory, we use the `Chi` instruction to create a single definition for memory that might
- * or might not have been updated by a store, depending on the actual address that was written to. For example, take:
- *
- * ```cpp
- * int x = 5;
- * int y = 7;
- * int* p = condition ? &x : &y;
- * *p = 6;
- * return x;
- * ```
- *
- * At the point where we store to `*p`, we do not know whether `p` points to `x` or `y`. Thus, we do not know whether
- * `return x;` is going to return the value that `x` was originally initialized to (5), or whether it will return 6,
- *  because it was overwritten by `*p = 6;`. We insert a `Chi` instruction immediately after the store to `*p`:
- *
- * ```
- * r2(int)     = Constant[6]
- * r3(int*)    = <<value of p>>
- * m4(int)     = Store           : &r3, r2  // Stores the constant 6 to *p
- * m5(unknown) = Chi             : total:m1, partial:m4
- * ```
- * The `partial:` operand represents the memory that was just stored. The `total:` operand represents the previous
- * contents of all of the memory that `p` might have pointed to (in this case, both `x` and `y`). The result of the
- * `Chi` represents the new contents of whatever memory the `total:` operand referred to. We usually do not know exactly
- * which parts of that memory were overwritten, but it does model that any of that memory could have been modified, so
- * that later instructions do not assume that the memory was unchanged.
  */
 
 private import internal.IRInternal

cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasedSSA.qll

@@ -683,13 +683,8 @@ private Overlap getExtentOverlap(MemoryLocation0 def, MemoryLocation0 use) {
     def.getVirtualVariable() = use.getVirtualVariable() and
     def instanceof EntireAllocationMemoryLocation and
     (
-      // EntireAllocationMemoryLocation exactly overlaps any EntireAllocationMemoryLocation for the
-      // same allocation. Checking the allocation, rather than the memory location itself, ensures
-      // that we get the right relationship between the "must" and "may" memory locations for that
-      // allocation.
-      // Note that if one of the locations is a "may" access, the overlap will be downgraded to
-      // `MustTotallyOverlap` or `MayPartialOverlap` in `getOverlap()`.
-      use.(EntireAllocationMemoryLocation).getAnAllocation() = def.getAnAllocation() and
+      // EntireAllocationMemoryLocation exactly overlaps itself.
+      use instanceof EntireAllocationMemoryLocation and
       result instanceof MustExactlyOverlap
       or
       not use instanceof EntireAllocationMemoryLocation and

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/PrintIR.qll

@@ -6,112 +6,6 @@
  * uses, however, it is better to write a query that imports `PrintIR.qll`, extends
  * `PrintIRConfiguration`, and overrides `shouldPrintDeclaration()` to select a subset of declarations
  * to dump.
- *
- * Anatomy of a printed IR instruction
- *
- * An instruction:
- *
- * ```
- * # 2281|     v2281_19(void) = Call[~String]     : func:r2281_18, this:r2281_17
- * ```
- *
- * The prefix `# 2281|` specifies that this instruction was generated by the C++ source code on line 2281.
- * Scrolling up in the printed output, one will eventually find the name of the file to which the line
- * belongs.
- *
- * `v2281_19(void)` is the result of the instruction. Here, `v` means this is a void result or operand (so
- * there should be no later uses of the result; see below for other possible values). The `2281_19` is a
- * unique ID for the result. This is usually just the line number plus a small integer suffix to make it
- * unique within the function. The type of the result is `void`. In this case, it is `void`, because
- * `~String` returns `void`. The type of the result is usually just the name of the appropriate C++ type,
- * but it will sometimes be a type like `glval<int>`, which means result holds a glvalue, which at the
- * IR level works like a pointer. In other words, in the source code the type was `int`, but it is really
- * more like an `int*`. We see this, for example, in `x = y;`, where `x` is a glvalue.
- *
- * `Call` is the opcode of the instruction. Common opcodes include:
- *
- * * Arithmetic operations: `Add`, `Sub`, `Mul`, etc.
- * * Memory access operations: `Load`, `Store`.
- * * Function calls: `Call`.
- * * Literals: `Constant`.
- * * Variable addresses: `VariableAddress`.
- * * Function entry points: `EnterFunction`.
- * * Return from a function: `Return`, `ReturnVoid`. Note that the value being returned is set separately by a
- *   `Store` to a special `#return` variable.
- * * Stack unwinding for C++ function that throw and where the exception escapes the function: `Unwind`.
- * * Common exit point for `Unwind` and `Return`: `ExitFunction`.
- * * SSA-related opcodes: `Phi`, `Chi`.
- *
- * `[~String]` denotes additional information. The information might be present earlier in the IR, as is the case
- * for `Call`, where it is the name of the called function. This is also the case for `Load` and `Store`, where it
- * is the name of the variable that loaded or stored (if known). In the case of `Constant`, `FieldAddress`, and
- * `VariableAddress`, the information between brackets does not occur earlier.
- *
- * `func:r2281_18` and `this:r28281_17` are the operands of the instruction. The `func:` prefix denotes the operand
- * that holds the address of the called function. The `this:` prefix denotes the argument to the special `this`
- * parameter of an instance member function. `r2281_18`, `r2281_17` are the unique IDs of the operands. Each of these
- * matches the ID of a previously seen result, showing where that value came from. The `r` means that these are
- * "register" operands (see below).
- *
- * Result and operand kinds:
- *
- * Every result and operand is one of these three kinds:
- *
- * * `r` "register". These operands are not stored in any particular memory location. We can think of them as
- *   temporary values created during the evaluation of an expression. A register operand almost always has one
- *   use, often in the same block as its definition.
- * *  `m` "memory". These operands represents accesses to a specific memory location. The location could be a
- *    local variable, a global variable, a field of an object, an element of an array, or any memory that we happen
- *    to have a pointer to. These only occur as the result of a `Store`, the source operand of a `Load` or on the
- *    SSA instructions (`Phi`, `Chi`).
- * * `v` "void". Really just a register operand, but we mark register operands of type void with this special prefix
- *   so we know that there is no actual value there.
- *
- * Branches in the IR:
- *
- * The IR is divided into basic blocks. At the end of each block, there are one or more edges showing the possible
- * control flow successors of the block.
- *
- * ```
- * #   44|     v44_3(void)    = ConditionalBranch : r44_2
- * #-----|   False -> Block 4
- * #-----|   True -> Block 3
- * ```
- * Here we have a block that ends with a conditional branch. The two edges show where the control flows to depending
- * on whether the condition is true or false.
- *
- * SSA instructions:
- *
- * We use `Phi` instructions in SSA to create a single definition for a variable that might be assigned on multiple
- * control flow paths. The `Phi` instruction merges the potential values of that variable from each predecessor edge,
- * and the resulting definition is then used wherever that variable is accessed later on.
- *
- * When dealing with aliased memory, we use the `Chi` instruction to create a single definition for memory that might
- * or might not have been updated by a store, depending on the actual address that was written to. For example, take:
- *
- * ```cpp
- * int x = 5;
- * int y = 7;
- * int* p = condition ? &x : &y;
- * *p = 6;
- * return x;
- * ```
- *
- * At the point where we store to `*p`, we do not know whether `p` points to `x` or `y`. Thus, we do not know whether
- * `return x;` is going to return the value that `x` was originally initialized to (5), or whether it will return 6,
- *  because it was overwritten by `*p = 6;`. We insert a `Chi` instruction immediately after the store to `*p`:
- *
- * ```
- * r2(int)     = Constant[6]
- * r3(int*)    = <<value of p>>
- * m4(int)     = Store           : &r3, r2  // Stores the constant 6 to *p
- * m5(unknown) = Chi             : total:m1, partial:m4
- * ```
- * The `partial:` operand represents the memory that was just stored. The `total:` operand represents the previous
- * contents of all of the memory that `p` might have pointed to (in this case, both `x` and `y`). The result of the
- * `Chi` represents the new contents of whatever memory the `total:` operand referred to. We usually do not know exactly
- * which parts of that memory were overwritten, but it does model that any of that memory could have been modified, so
- * that later instructions do not assume that the memory was unchanged.
  */
 
 private import internal.IRInternal

cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/PrintIR.qll

@@ -6,112 +6,6 @@
  * uses, however, it is better to write a query that imports `PrintIR.qll`, extends
  * `PrintIRConfiguration`, and overrides `shouldPrintDeclaration()` to select a subset of declarations
  * to dump.
- *
- * Anatomy of a printed IR instruction
- *
- * An instruction:
- *
- * ```
- * # 2281|     v2281_19(void) = Call[~String]     : func:r2281_18, this:r2281_17
- * ```
- *
- * The prefix `# 2281|` specifies that this instruction was generated by the C++ source code on line 2281.
- * Scrolling up in the printed output, one will eventually find the name of the file to which the line
- * belongs.
- *
- * `v2281_19(void)` is the result of the instruction. Here, `v` means this is a void result or operand (so
- * there should be no later uses of the result; see below for other possible values). The `2281_19` is a
- * unique ID for the result. This is usually just the line number plus a small integer suffix to make it
- * unique within the function. The type of the result is `void`. In this case, it is `void`, because
- * `~String` returns `void`. The type of the result is usually just the name of the appropriate C++ type,
- * but it will sometimes be a type like `glval<int>`, which means result holds a glvalue, which at the
- * IR level works like a pointer. In other words, in the source code the type was `int`, but it is really
- * more like an `int*`. We see this, for example, in `x = y;`, where `x` is a glvalue.
- *
- * `Call` is the opcode of the instruction. Common opcodes include:
- *
- * * Arithmetic operations: `Add`, `Sub`, `Mul`, etc.
- * * Memory access operations: `Load`, `Store`.
- * * Function calls: `Call`.
- * * Literals: `Constant`.
- * * Variable addresses: `VariableAddress`.
- * * Function entry points: `EnterFunction`.
- * * Return from a function: `Return`, `ReturnVoid`. Note that the value being returned is set separately by a
- *   `Store` to a special `#return` variable.
- * * Stack unwinding for C++ function that throw and where the exception escapes the function: `Unwind`.
- * * Common exit point for `Unwind` and `Return`: `ExitFunction`.
- * * SSA-related opcodes: `Phi`, `Chi`.
- *
- * `[~String]` denotes additional information. The information might be present earlier in the IR, as is the case
- * for `Call`, where it is the name of the called function. This is also the case for `Load` and `Store`, where it
- * is the name of the variable that loaded or stored (if known). In the case of `Constant`, `FieldAddress`, and
- * `VariableAddress`, the information between brackets does not occur earlier.
- *
- * `func:r2281_18` and `this:r28281_17` are the operands of the instruction. The `func:` prefix denotes the operand
- * that holds the address of the called function. The `this:` prefix denotes the argument to the special `this`
- * parameter of an instance member function. `r2281_18`, `r2281_17` are the unique IDs of the operands. Each of these
- * matches the ID of a previously seen result, showing where that value came from. The `r` means that these are
- * "register" operands (see below).
- *
- * Result and operand kinds:
- *
- * Every result and operand is one of these three kinds:
- *
- * * `r` "register". These operands are not stored in any particular memory location. We can think of them as
- *   temporary values created during the evaluation of an expression. A register operand almost always has one
- *   use, often in the same block as its definition.
- * *  `m` "memory". These operands represents accesses to a specific memory location. The location could be a
- *    local variable, a global variable, a field of an object, an element of an array, or any memory that we happen
- *    to have a pointer to. These only occur as the result of a `Store`, the source operand of a `Load` or on the
- *    SSA instructions (`Phi`, `Chi`).
- * * `v` "void". Really just a register operand, but we mark register operands of type void with this special prefix
- *   so we know that there is no actual value there.
- *
- * Branches in the IR:
- *
- * The IR is divided into basic blocks. At the end of each block, there are one or more edges showing the possible
- * control flow successors of the block.
- *
- * ```
- * #   44|     v44_3(void)    = ConditionalBranch : r44_2
- * #-----|   False -> Block 4
- * #-----|   True -> Block 3
- * ```
- * Here we have a block that ends with a conditional branch. The two edges show where the control flows to depending
- * on whether the condition is true or false.
- *
- * SSA instructions:
- *
- * We use `Phi` instructions in SSA to create a single definition for a variable that might be assigned on multiple
- * control flow paths. The `Phi` instruction merges the potential values of that variable from each predecessor edge,
- * and the resulting definition is then used wherever that variable is accessed later on.
- *
- * When dealing with aliased memory, we use the `Chi` instruction to create a single definition for memory that might
- * or might not have been updated by a store, depending on the actual address that was written to. For example, take:
- *
- * ```cpp
- * int x = 5;
- * int y = 7;
- * int* p = condition ? &x : &y;
- * *p = 6;
- * return x;
- * ```
- *
- * At the point where we store to `*p`, we do not know whether `p` points to `x` or `y`. Thus, we do not know whether
- * `return x;` is going to return the value that `x` was originally initialized to (5), or whether it will return 6,
- *  because it was overwritten by `*p = 6;`. We insert a `Chi` instruction immediately after the store to `*p`:
- *
- * ```
- * r2(int)     = Constant[6]
- * r3(int*)    = <<value of p>>
- * m4(int)     = Store           : &r3, r2  // Stores the constant 6 to *p
- * m5(unknown) = Chi             : total:m1, partial:m4
- * ```
- * The `partial:` operand represents the memory that was just stored. The `total:` operand represents the previous
- * contents of all of the memory that `p` might have pointed to (in this case, both `x` and `y`). The result of the
- * `Chi` represents the new contents of whatever memory the `total:` operand referred to. We usually do not know exactly
- * which parts of that memory were overwritten, but it does model that any of that memory could have been modified, so
- * that later instructions do not assume that the memory was unchanged.
  */
 
 private import internal.IRInternal

cpp/ql/lib/semmle/code/cpp/models/implementations/Fopen.qll

@@ -7,7 +7,7 @@ import semmle.code.cpp.models.interfaces.Alias
 import semmle.code.cpp.models.interfaces.SideEffect
 
 /** The function `fopen` and friends. */
-private class Fopen extends Function, AliasFunction, SideEffectFunction, TaintFunction {
+private class Fopen extends Function, AliasFunction, SideEffectFunction {
   Fopen() {
     this.hasGlobalOrStdName(["fopen", "fopen_s", "freopen"])
     or
@@ -47,22 +47,4 @@ private class Fopen extends Function, AliasFunction, SideEffectFunction, TaintFu
     i = 0 and
     buffer = true
   }
-
-  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
-    (
-      this.hasGlobalOrStdName(["fopen", "freopen"]) or
-      this.hasGlobalName(["_wfopen", "_fsopen", "_wfsopen"])
-    ) and
-    input.isParameterDeref(0) and
-    output.isReturnValueDeref()
-    or
-    // The out parameter is a pointer to a `FILE*`.
-    this.hasGlobalOrStdName("fopen_s") and
-    input.isParameterDeref(1) and
-    output.isParameterDeref(0, 2)
-    or
-    this.hasGlobalName(["_open", "_wopen"]) and
-    input.isParameterDeref(0) and
-    output.isReturnValue()
-  }
 }

cpp/ql/lib/semmle/code/cpp/models/interfaces/FormattingFunction.qll

@@ -118,34 +118,19 @@ abstract class FormattingFunction extends ArrayFunction, TaintFunction {
 
   /**
    * Gets the position of the first format argument, corresponding with
-   * the first format specifier in the format string. We ignore all
-   * implicit function definitions.
+   * the first format specifier in the format string.
    */
   int getFirstFormatArgumentIndex() {
-    // The formatting function either has a definition in the snapshot, or all
+    result = this.getNumberOfParameters() and
+    // the formatting function either has a definition in the snapshot, or all
     // `DeclarationEntry`s agree on the number of parameters (otherwise we don't
     // really know the correct number)
-    if this.hasDefinition()
-    then result = this.getDefinition().getNumberOfParameters()
-    else result = this.getNumberOfExplicitParameters()
-  }
-
-  /**
-   * Gets a non-implicit function declaration entry.
-   */
-  private FunctionDeclarationEntry getAnExplicitDeclarationEntry() {
-    result = this.getADeclarationEntry() and
-    not result.isImplicit()
-  }
-
-  /**
-   * Gets the number of parameters, excluding any parameters that have been defined
-   * from implicit function declarations. If there is some inconsistency in the number
-   * of parameters, then don't return anything.
-   */
-  private int getNumberOfExplicitParameters() {
-    forex(FunctionDeclarationEntry fde | fde = this.getAnExplicitDeclarationEntry() |
-      result = fde.getNumberOfParameters()
+    (
+      this.hasDefinition()
+      or
+      forall(FunctionDeclarationEntry fde | fde = this.getADeclarationEntry() |
+        result = fde.getNumberOfParameters()
+      )
     )
   }
 

cpp/ql/lib/semmle/code/cpp/rangeanalysis/SimpleRangeAnalysis.qll

@@ -192,37 +192,6 @@ private class UnsignedMulExpr extends MulExpr {
   }
 }
 
-/**
- * Gets the value of the `EOF` macro.
- *
- * This is typically `"-1"`, but this is not guaranteed to be the case on all
- * systems.
- */
-private int getEofValue() {
-  exists(MacroInvocation mi |
-    mi.getMacroName() = "EOF" and
-    result = unique( | | mi.getExpr().getValue().toInt())
-  )
-}
-
-/** Get standard `getc` function or related variants. */
-private class Getc extends Function {
-  Getc() { this.hasGlobalOrStdOrBslName(["fgetc", "getc"]) }
-}
-
-/** A call to `getc` */
-private class CallToGetc extends FunctionCall {
-  CallToGetc() { this.getTarget() instanceof Getc }
-}
-
-/**
- * A call to `getc` that we can analyze because we know
- * the value of the `EOF` macro.
- */
-private class AnalyzableCallToGetc extends CallToGetc {
-  AnalyzableCallToGetc() { exists(getEofValue()) }
-}
-
 /**
  * Holds if `expr` is effectively a multiplication of `operand` with the
  * positive constant `positive`.
@@ -318,8 +287,6 @@ private predicate analyzableExpr(Expr e) {
     or
     e instanceof RemExpr
     or
-    e instanceof AnalyzableCallToGetc
-    or
     // A conversion is analyzable, provided that its child has an arithmetic
     // type. (Sometimes the child is a reference type, and so does not get
     // any bounds.) Rather than checking whether the type of the child is
@@ -894,14 +861,6 @@ private float getLowerBoundsImpl(Expr expr) {
       )
     )
     or
-    exists(AnalyzableCallToGetc getc |
-      expr = getc and
-      // from https://en.cppreference.com/w/c/io/fgetc:
-      // On success, returns the obtained character as an unsigned char
-      // converted to an int. On failure, returns EOF.
-      result = min([typeLowerBound(any(UnsignedCharType pct)), getEofValue()])
-    )
-    or
     // If the conversion is to an arithmetic type then we just return the
     // lower bound of the child. We do not need to handle truncation and
     // overflow here, because that is done in `getTruncatedLowerBounds`.
@@ -1096,14 +1055,6 @@ private float getUpperBoundsImpl(Expr expr) {
       )
     )
     or
-    exists(AnalyzableCallToGetc getc |
-      expr = getc and
-      // from https://en.cppreference.com/w/c/io/fgetc:
-      // On success, returns the obtained character as an unsigned char
-      // converted to an int. On failure, returns EOF.
-      result = max([typeUpperBound(any(UnsignedCharType pct)), getEofValue()])
-    )
-    or
     // If the conversion is to an arithmetic type then we just return the
     // upper bound of the child. We do not need to handle truncation and
     // overflow here, because that is done in `getTruncatedUpperBounds`.

cpp/ql/lib/semmle/code/cpp/security/InvalidPointerDereference/InvalidPointerToDereference.qll

@@ -160,26 +160,6 @@ private module InvalidPointerToDerefBarrier {
   }
 }
 
-/**
- * BEWARE: This configuration uses an unrestricted sink, so accessing its full
- * flow computation or any stages beyond the first 2 will likely diverge.
- * Stage 1 will still be fast and we use it to restrict the subsequent sink
- * computation.
- */
-private module InvalidPointerReachesConfig implements DataFlow::ConfigSig {
-  predicate isSource(DataFlow::Node source) { invalidPointerToDerefSource(_, _, source) }
-
-  predicate isSink(DataFlow::Node sink) { any() }
-
-  predicate isBarrier(DataFlow::Node node) { InvalidPointerToDerefConfig::isBarrier(node) }
-
-  int fieldFlowBranchLimit() { result = invalidPointerToDereferenceFieldFlowBranchLimit() }
-}
-
-private module InvalidPointerReachesFlow = DataFlow::Global<InvalidPointerReachesConfig>;
-
-private import semmle.code.cpp.ir.dataflow.internal.DataFlowImplCommon as DataFlowImplCommon
-
 /**
  * A configuration to track flow from a pointer-arithmetic operation found
  * by `AllocToInvalidPointerConfig` to a dereference of the pointer.
@@ -193,13 +173,8 @@ private module InvalidPointerToDerefConfig implements DataFlow::StateConfigSig {
     invalidPointerToDerefSource(_, pai, source)
   }
 
-  predicate isSink(DataFlow::Node sink) {
-    exists(DataFlowImplCommon::NodeEx n |
-      InvalidPointerReachesFlow::Stages::Stage1::sinkNode(n, _) and
-      n.asNode() = sink and
-      isInvalidPointerDerefSink(sink, _, _, _, _)
-    )
-  }
+  pragma[inline]
+  predicate isSink(DataFlow::Node sink) { isInvalidPointerDerefSink(sink, _, _, _, _) }
 
   predicate isSink(DataFlow::Node sink, FlowState pai) { none() }
 

cpp/ql/lib/semmle/code/cpp/security/flowafterfree/FlowAfterFree.qll

@@ -72,6 +72,7 @@ module FlowFromFree<FlowFromFreeParamSig P> {
 
     predicate isSource(DataFlow::Node node, FlowState state) { isFree(node, _, state, _) }
 
+    pragma[inline]
     predicate isSink(DataFlow::Node sink, FlowState state) {
       exists(Expr e, DataFlow::Node source, DeallocationExpr dealloc |
         P::isSink(sink, e) and

cpp/ql/lib/semmlecode.cpp.dbscheme

@@ -534,7 +534,7 @@ static_asserts(
 #keyset[function, index, type_id]
 params(
     int id: @parameter,
-    int function: @parameterized_element ref,
+    int function: @functionorblock ref,
     int index: int ref,
     int type_id: @type ref
 );
@@ -1790,10 +1790,6 @@ case @expr.kind of
 | 387 = @istriviallyrelocatable
 | 388 = @datasizeof
 | 389 = @c11_generic
-| 390 = @requires_expr
-| 391 = @nested_requirement
-| 392 = @compound_requirement
-| 393 = @concept_id
 ;
 
 @var_args_expr = @vastartexpr
@@ -1912,10 +1908,6 @@ case @expr.kind of
             | @istriviallyrelocatable
             ;
 
-compound_requirement_is_noexcept(
-    int expr: @compound_requirement ref
-);
-
 new_allocated_type(
     unique int expr: @new_expr ref,
     int type_id: @type ref
@@ -2175,11 +2167,11 @@ stmt_decl_entry_bind(
     int decl_entry: @element ref
 );
 
-@parameterized_element = @function | @stmt_block | @requires_expr;
+@functionorblock = @function | @stmt_block;
 
 blockscope(
     unique int block: @stmt_block ref,
-    int enclosing: @parameterized_element ref
+    int enclosing: @functionorblock ref
 );
 
 @jump = @stmt_goto | @stmt_break | @stmt_continue;

cpp/ql/lib/upgrades/6f5d51e89e762fe4609fd4ac8ee3afb04221e873/upgrade.properties

@@ -1,2 +0,0 @@
-description: Support C++20 requires expressions
-compatibility: backwards

cpp/ql/lib/upgrades/7ff6a6e53dbcff09d1b9b758b594bc6d17366863/upgrade.properties

@@ -1,2 +0,0 @@
-description: Add requires expressions
-compatibility: full

cpp/ql/src/Best Practices/Unused Entities/UnusedLocals.ql

@@ -57,5 +57,5 @@ where
   not declarationHasSideEffects(v) and
   not exists(AsmStmt s | f = s.getEnclosingFunction()) and
   not v.getAnAttribute().getName() = "unused" and
-  not f.hasErrors() // Unextracted expressions may use `v`
+  not any(ErrorExpr e).getEnclosingFunction() = f // unextracted expr may use `v`
 select v, "Variable " + v.getName() + " is not used."

cpp/ql/src/CHANGELOG.md

@@ -1,24 +1,9 @@
-## 1.2.5
-
-### Minor Analysis Improvements
-
-* The `cpp/unclear-array-index-validation` ("Unclear validation of array index") query has been improved to reduce false positives and increase true positives.
-* Fixed false positives in the `cpp/uninitialized-local` ("Potentially uninitialized local variable") query if there are extraction errors in the function.
-* The `cpp/incorrect-string-type-conversion` query now produces fewer false positives caused by failure to detect byte arrays.
-* The `cpp/incorrect-string-type-conversion` query now produces fewer false positives caused by failure to recognize dynamic checks prior to possible dangerous widening.
-
-## 1.2.4
-
-### Minor Analysis Improvements
-
-* Fixed false positives in the `cpp/wrong-number-format-arguments` ("Too few arguments to formatting function") query when the formatting function has been declared implicitly.
-
 ## 1.2.3
 
 ### Minor Analysis Improvements
 
-* Removed false positives caused by buffer accesses in unreachable code
-* Removed false positives caused by inconsistent type checking
+* Removed false positives caused by buffer accesses in unreachable code.
+* Removed false positives caused by inconsistent type checking.
 * Add modeling of C functions that don't throw, thereby increasing the precision of the `cpp/incorrect-allocation-error-handling` ("Incorrect allocation-error handling") query. The query now produces additional true positives.
 
 ## 1.2.2

cpp/ql/src/Likely Bugs/Memory Management/ReturnStackAllocatedMemory.ql

@@ -29,7 +29,7 @@ class ReturnStackAllocatedMemoryConfig extends MustFlowConfiguration {
   override predicate isSource(Instruction source) {
     exists(Function func |
       // Rule out FPs caused by extraction errors.
-      not func.hasErrors() and
+      not any(ErrorExpr e).getEnclosingFunction() = func and
       not intentionallyReturnsStackPointer(func) and
       func = source.getEnclosingFunction()
     |

cpp/ql/src/Likely Bugs/Memory Management/UninitializedLocal.ql

@@ -65,7 +65,6 @@ predicate isSinkImpl(Instruction sink, VariableAccess va) {
   exists(LoadInstruction load |
     va = load.getUnconvertedResultExpression() and
     not va = commonException() and
-    not va.getTarget().(LocalVariable).getFunction().hasErrors() and
     sink = load.getSourceValue()
   )
 }

cpp/ql/src/Likely Bugs/Memory Management/UsingExpiredStackAddress.ql

@@ -24,7 +24,7 @@ predicate instructionHasVariable(VariableAddressInstruction vai, StackVariable v
   // Pointer-to-member types aren't properly handled in the dbscheme.
   not vai.getResultType() instanceof PointerToMemberType and
   // Rule out FPs caused by extraction errors.
-  not f.hasErrors()
+  not any(ErrorExpr e).getEnclosingFunction() = f
 }
 
 /**

cpp/ql/src/Security/CWE/CWE-129/ImproperArrayIndexValidation.ql

@@ -14,56 +14,102 @@
 
 import cpp
 import semmle.code.cpp.controlflow.IRGuards
-import semmle.code.cpp.security.FlowSources as FS
-import semmle.code.cpp.dataflow.new.TaintTracking
-import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis
+import semmle.code.cpp.security.FlowSources
+import semmle.code.cpp.ir.dataflow.TaintTracking
+import semmle.code.cpp.rangeanalysis.RangeAnalysisUtils
 import ImproperArrayIndexValidation::PathGraph
+import semmle.code.cpp.security.Security
 
-predicate isFlowSource(FS::FlowSource source, string sourceType) {
-  sourceType = source.getSourceType()
-}
-
-predicate guardChecks(IRGuardCondition g, Expr e, boolean branch) {
-  exists(Operand op | op.getDef().getConvertedResultExpression() = e |
-    // `op < k` is true and `k > 0`
-    g.comparesLt(op, any(int k | k > 0), true, any(BooleanValue bv | bv.getValue() = branch))
-    or
-    // `op < _ + k` is true and `k > 0`.
-    g.comparesLt(op, _, any(int k | k > 0), true, branch)
-    or
-    // op == k
-    g.comparesEq(op, _, true, any(BooleanValue bv | bv.getValue() = branch))
-    or
-    // op == _ + k
-    g.comparesEq(op, _, _, true, branch)
+predicate hasUpperBound(VariableAccess offsetExpr) {
+  exists(BasicBlock controlled, StackVariable offsetVar, SsaDefinition def |
+    controlled.contains(offsetExpr) and
+    linearBoundControls(controlled, def, offsetVar) and
+    offsetExpr = def.getAUse(offsetVar)
   )
 }
 
-/**
- * Holds if `arrayExpr` accesses an `ArrayType` with a constant size `N`, and
- * the value of `offsetExpr` is known to be smaller than `N`.
- */
-predicate offsetIsAlwaysInBounds(ArrayExpr arrayExpr, VariableAccess offsetExpr) {
-  exists(ArrayType arrayType |
-    arrayType = arrayExpr.getArrayBase().getUnspecifiedType() and
-    arrayType.getArraySize() > upperBound(offsetExpr.getFullyConverted())
+pragma[noinline]
+predicate linearBoundControls(BasicBlock controlled, SsaDefinition def, StackVariable offsetVar) {
+  exists(GuardCondition guard, boolean branch |
+    guard.controls(controlled, branch) and
+    cmpWithLinearBound(guard, def.getAUse(offsetVar), Lesser(), branch)
   )
 }
 
+predicate readsVariable(LoadInstruction load, Variable var) {
+  load.getSourceAddress().(VariableAddressInstruction).getAstVariable() = var
+}
+
+predicate hasUpperBoundsCheck(Variable var) {
+  exists(RelationalOperation oper, VariableAccess access |
+    oper.getAnOperand() = access and
+    access.getTarget() = var and
+    // Comparing to 0 is not an upper bound check
+    not oper.getAnOperand().getValue() = "0"
+  )
+}
+
+predicate nodeIsBarrierEqualityCandidate(DataFlow::Node node, Operand access, Variable checkedVar) {
+  readsVariable(node.asInstruction(), checkedVar) and
+  any(IRGuardCondition guard).ensuresEq(access, _, _, node.asInstruction().getBlock(), true)
+}
+
+predicate isFlowSource(FlowSource source, string sourceType) { sourceType = source.getSourceType() }
+
+predicate predictableInstruction(Instruction instr) {
+  instr instanceof ConstantInstruction
+  or
+  instr instanceof StringConstantInstruction
+  or
+  // This could be a conversion on a string literal
+  predictableInstruction(instr.(UnaryInstruction).getUnary())
+}
+
 module ImproperArrayIndexValidationConfig implements DataFlow::ConfigSig {
   predicate isSource(DataFlow::Node source) { isFlowSource(source, _) }
 
   predicate isBarrier(DataFlow::Node node) {
-    node = DataFlow::BarrierGuard<guardChecks/3>::getABarrierNode()
+    hasUpperBound(node.asExpr())
+    or
+    // These barriers are ported from `DefaultTaintTracking` because this query is quite noisy
+    // otherwise.
+    exists(Variable checkedVar |
+      readsVariable(node.asInstruction(), checkedVar) and
+      hasUpperBoundsCheck(checkedVar)
+    )
+    or
+    exists(Variable checkedVar, Operand access |
+      readsVariable(access.getDef(), checkedVar) and
+      nodeIsBarrierEqualityCandidate(node, access, checkedVar)
+    )
+    or
+    // Don't use dataflow into binary instructions if both operands are unpredictable
+    exists(BinaryInstruction iTo |
+      iTo = node.asInstruction() and
+      not predictableInstruction(iTo.getLeft()) and
+      not predictableInstruction(iTo.getRight()) and
+      // propagate taint from either the pointer or the offset, regardless of predictability
+      not iTo instanceof PointerArithmeticInstruction
+    )
+    or
+    // don't use dataflow through calls to pure functions if two or more operands
+    // are unpredictable
+    exists(Instruction iFrom1, Instruction iFrom2, CallInstruction iTo |
+      iTo = node.asInstruction() and
+      isPureFunction(iTo.getStaticCallTarget().getName()) and
+      iFrom1 = iTo.getAnArgument() and
+      iFrom2 = iTo.getAnArgument() and
+      not predictableInstruction(iFrom1) and
+      not predictableInstruction(iFrom2) and
+      iFrom1 != iFrom2
+    )
   }
 
-  predicate isBarrierOut(DataFlow::Node node) { isSink(node) }
-
   predicate isSink(DataFlow::Node sink) {
     exists(ArrayExpr arrayExpr, VariableAccess offsetExpr |
       offsetExpr = arrayExpr.getArrayOffset() and
       sink.asExpr() = offsetExpr and
-      not offsetIsAlwaysInBounds(arrayExpr, offsetExpr)
+      not hasUpperBound(offsetExpr)
     )
   }
 }

cpp/ql/src/Security/CWE/CWE-704/WcharCharConversion.ql

@@ -13,85 +13,23 @@
  */
 
 import cpp
-import semmle.code.cpp.controlflow.Guards
 
 class WideCharPointerType extends PointerType {
   WideCharPointerType() { this.getBaseType() instanceof WideCharType }
 }
 
-/**
- * Given type `t`, recurses through and returns all
- * intermediate base types, including `t`.
- */
-Type getABaseType(Type t) {
-  result = t
-  or
-  result = getABaseType(t.(DerivedType).getBaseType())
-  or
-  result = getABaseType(t.(TypedefType).getBaseType())
-}
-
 /**
  * A type that may also be `CharPointerType`, but that are likely used as arbitrary buffers.
  */
 class UnlikelyToBeAStringType extends Type {
   UnlikelyToBeAStringType() {
-    exists(Type targ | getABaseType(this) = targ |
-      // NOTE: not using CharType isUnsigned, but rather look for any explicitly declared unsigned
-      // char types. Assuming these are used for buffers, not strings.
-      targ.(CharType).getName().toLowerCase().matches("unsigned%") or
-      targ.getName().toLowerCase().matches(["uint8_t", "%byte%"])
-    )
+    this.(PointerType).getBaseType().(CharType).isUnsigned() or
+    this.(PointerType).getBaseType().getName().toLowerCase().matches("%byte") or
+    this.getName().toLowerCase().matches("%byte") or
+    this.(PointerType).getBaseType().hasName("uint8_t")
   }
 }
 
-// Types that can be wide depending on the UNICODE macro
-// see https://learn.microsoft.com/en-us/windows/win32/winprog/windows-data-types
-class UnicodeMacroDependentWidthType extends Type {
-  UnicodeMacroDependentWidthType() {
-    exists(Type targ | getABaseType(this) = targ |
-      targ.getName() in [
-          "LPCTSTR",
-          "LPTSTR",
-          "PCTSTR",
-          "PTSTR",
-          "TBYTE",
-          "TCHAR"
-        ]
-    )
-  }
-}
-
-class UnicodeMacro extends Macro {
-  UnicodeMacro() { this.getName().toLowerCase().matches("%unicode%") }
-}
-
-class UnicodeMacroInvocation extends MacroInvocation {
-  UnicodeMacroInvocation() { this.getMacro() instanceof UnicodeMacro }
-}
-
-/**
- * Holds when a expression whose type is UnicodeMacroDependentWidthType and
- * is observed to be guarded by a check involving a bitwise-and operation
- * with a UnicodeMacroInvocation.
- * Such expressions are assumed to be checked dynamically, i.e.,
- * the flag would indicate if UNICODE typing is set correctly to allow
- * or disallow a widening cast.
- */
-predicate isLikelyDynamicallyChecked(Expr e) {
-  e.getType() instanceof UnicodeMacroDependentWidthType and
-  exists(GuardCondition gc, BitwiseAndExpr bai, UnicodeMacroInvocation umi |
-    bai.getAnOperand() = umi.getExpr()
-  |
-    // bai == 0 is false when reaching `e.getBasicBlock()`.
-    // That is, bai != 0 when reaching `e.getBasicBlock()`.
-    gc.ensuresEq(bai, 0, e.getBasicBlock(), false)
-    or
-    // bai == k and k != 0 is true when reaching `e.getBasicBlock()`.
-    gc.ensuresEq(bai, any(int k | k != 0), e.getBasicBlock(), true)
-  )
-}
-
 from Expr e1, Cast e2
 where
   e2 = e1.getConversion() and
@@ -104,11 +42,7 @@ where
   not e1.getType() instanceof UnlikelyToBeAStringType and
   // Avoid castings from 'new' expressions as typically these will be safe
   // Example: `__Type* ret = reinterpret_cast<__Type*>(New(m_pmo) char[num * sizeof(__Type)]);`
-  not exists(NewOrNewArrayExpr newExpr | newExpr.getAChild*() = e1) and
-  // Avoid cases where the cast is guarded by a check to determine if
-  // unicode encoding is enabled in such a way to disallow the dangerous cast
-  // at runtime.
-  not isLikelyDynamicallyChecked(e1)
+  not exists(NewOrNewArrayExpr newExpr | newExpr.getAChild*() = e1)
 select e1,
   "Conversion from " + e1.getType().toString() + " to " + e2.getType().toString() +
     ". Use of invalid string can lead to undefined behavior."

cpp/ql/src/change-notes/released/1.2.4.md

@@ -1,5 +0,0 @@
-## 1.2.4
-
-### Minor Analysis Improvements
-
-* Fixed false positives in the `cpp/wrong-number-format-arguments` ("Too few arguments to formatting function") query when the formatting function has been declared implicitly.

cpp/ql/src/change-notes/released/1.2.5.md

@@ -1,8 +0,0 @@
-## 1.2.5
-
-### Minor Analysis Improvements
-
-* The `cpp/unclear-array-index-validation` ("Unclear validation of array index") query has been improved to reduce false positives and increase true positives.
-* Fixed false positives in the `cpp/uninitialized-local` ("Potentially uninitialized local variable") query if there are extraction errors in the function.
-* The `cpp/incorrect-string-type-conversion` query now produces fewer false positives caused by failure to detect byte arrays.
-* The `cpp/incorrect-string-type-conversion` query now produces fewer false positives caused by failure to recognize dynamic checks prior to possible dangerous widening.

cpp/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.2.5
+lastReleaseVersion: 1.2.3

cpp/ql/src/jsf/4.13 Functions/AV Rule 114.ql

@@ -49,7 +49,7 @@ predicate functionsMissingReturnStmt(Function f, ControlFlowNode blame) {
 predicate functionImperfectlyExtracted(Function f) {
   exists(CompilerError e | f.getBlock().getLocation().subsumes(e.getLocation()))
   or
-  f.hasErrors()
+  exists(ErrorExpr ee | ee.getEnclosingFunction() = f)
   or
   count(f.getType()) > 1
   or

cpp/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/cpp-queries
-version: 1.2.6-dev
+version: 1.2.4-dev
 groups:
   - cpp
   - queries

cpp/ql/test/examples/expressions/PrintAST.expected

@@ -870,8 +870,6 @@ Throw.cpp:
 #    8|               Type = [BoolType] bool
 #    8|               ValueCategory = prvalue
 #   12|       getChild(1): [Handler] <handler>
-#   12|         getParameter(): [Parameter] e
-#   12|             Type = [PointerType] E *
 #   12|         getBlock(): [CatchBlock] { ... }
 #   13|           getStmt(0): [ExprStmt] ExprStmt
 #   13|             getExpr(): [ReThrowExpr] re-throw exception 

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-125/semmle/tests/test.cpp

@@ -6,7 +6,7 @@ int wprintf (const wchar_t* format, ...);
 int strlen( const char * string );
 int checkErrors();
 
-static void goodTest0()
+void goodTest0()
 {
   char * ptr = "123456789";
   int ret;
@@ -17,7 +17,7 @@ static void goodTest0()
     ptr += ret;
   }
 }
-static void goodTest1(const char* ptr)
+void goodTest1(const char* ptr)
 {
   int ret;
   int len;
@@ -27,7 +27,7 @@ static void goodTest1(const char* ptr)
     ptr += ret;
   }
 }
-static void goodTest2(char* ptr)
+void goodTest2(char* ptr)
 {
   int ret;
   ptr[10]=0;
@@ -38,7 +38,7 @@ static void goodTest2(char* ptr)
   }
 }
 
-static void goodTest3(const char* ptr)
+void goodTest3(const char* ptr)
 {
   int ret;
   int len;
@@ -48,7 +48,7 @@ static void goodTest3(const char* ptr)
     ptr += ret;
   }
 }
-static void goodTest4(const char* ptr)
+void goodTest4(const char* ptr)
 {
   int ret;
   int len;
@@ -58,7 +58,7 @@ static void goodTest4(const char* ptr)
     ptr += ret;
   }
 }
-static void badTest1(const char* ptr)
+void badTest1(const char* ptr)
 {
   int ret;
   int len;
@@ -68,7 +68,7 @@ static void badTest1(const char* ptr)
     ptr += ret;
   }
 }
-static void badTest2(const char* ptr)
+void badTest2(const char* ptr)
 {
   int ret;
   int len;
@@ -79,7 +79,7 @@ static void badTest2(const char* ptr)
   }
 }
 
-static void goodTest5(const char* ptr,wchar_t *wc,int wc_len)
+void goodTest5(const char* ptr,wchar_t *wc,int wc_len)
 {
   int ret;
   int len;
@@ -96,7 +96,7 @@ static void goodTest5(const char* ptr,wchar_t *wc,int wc_len)
   }
 }
 
-static void badTest3(const char* ptr,int wc_len)
+void badTest3(const char* ptr,int wc_len)
 {
   int ret;
   int len;
@@ -113,7 +113,7 @@ static void badTest3(const char* ptr,int wc_len)
     wc++;
   }
 }
-static void badTest4(const char* ptr,int wc_len)
+void badTest4(const char* ptr,int wc_len)
 {
   int ret;
   int len;
@@ -130,7 +130,7 @@ static void badTest4(const char* ptr,int wc_len)
     wc++;
   }
 }
-static void badTest5(const char* ptr,int wc_len)
+void badTest5(const char* ptr,int wc_len)
 {
   int ret;
   int len;
@@ -148,7 +148,7 @@ static void badTest5(const char* ptr,int wc_len)
   }
 }
 
-static void badTest6(const char* ptr,int wc_len)
+void badTest6(const char* ptr,int wc_len)
 {
   int ret;
   int len;
@@ -171,7 +171,7 @@ static void badTest6(const char* ptr,int wc_len)
     ptr+=ret;
   }
 }
-static void badTest7(const char* ptr,int wc_len)
+void badTest7(const char* ptr,int wc_len)
 {
   int ret;
   int len;
@@ -188,7 +188,7 @@ static void badTest7(const char* ptr,int wc_len)
     ptr+=ret;
   }
 }
-static void badTest8(const char* ptr,wchar_t *wc)
+void badTest8(const char* ptr,wchar_t *wc)
 {
   int ret;
   int len;

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-125/semmle/tests/test1.cpp

@@ -24,7 +24,7 @@ typedef unsigned int size_t;
 void* calloc (size_t num, size_t size);
 void* malloc (size_t size);
 
-static void badTest1(void *src,  int size) {
+void badTest1(void *src,  int size) {
     WideCharToMultiByte(CP_ACP, 0, (LPCWSTR)src, -1, (LPSTR)src, size, 0, 0); // BAD
     MultiByteToWideChar(CP_ACP, 0, (LPCSTR)src, -1, (LPCWSTR)src, 30); // BAD
 }
@@ -39,43 +39,43 @@ void goodTest2(){
   }
   printf("%s\n", dst);
 }
-static void badTest2(){
+void badTest2(){
   wchar_t src[] = L"0123456789ABCDEF";
   char dst[16];
   WideCharToMultiByte(CP_UTF8, 0, src, -1, dst, 16, NULL, NULL); // BAD
   printf("%s\n", dst);
 }
-static void goodTest3(){
+void goodTest3(){
   char src[] = "0123456789ABCDEF";
   int size = MultiByteToWideChar(CP_UTF8, 0, src,sizeof(src),NULL,0);
   wchar_t * dst = (wchar_t*)calloc(size + 1, sizeof(wchar_t));
   MultiByteToWideChar(CP_UTF8, 0, src, -1, dst, size+1); // GOOD
 }
-static void badTest3(){
+void badTest3(){
   char src[] = "0123456789ABCDEF";
   int size = MultiByteToWideChar(CP_UTF8, 0, src,sizeof(src),NULL,0);
   wchar_t * dst = (wchar_t*)calloc(size + 1, 1);
   MultiByteToWideChar(CP_UTF8, 0, src, -1, dst, size+1); // BAD
 }
-static void goodTest4(){
+void goodTest4(){
   char src[] = "0123456789ABCDEF";
   int size = MultiByteToWideChar(CP_UTF8, 0, src,sizeof(src),NULL,0);
   wchar_t * dst = (wchar_t*)malloc((size + 1)*sizeof(wchar_t));
   MultiByteToWideChar(CP_UTF8, 0, src, -1, dst, size+1); // GOOD
 }
-static void badTest4(){
+void badTest4(){
   char src[] = "0123456789ABCDEF";
   int size = MultiByteToWideChar(CP_UTF8, 0, src,sizeof(src),NULL,0);
   wchar_t * dst = (wchar_t*)malloc(size + 1);
   MultiByteToWideChar(CP_UTF8, 0, src, -1, dst, size+1); // BAD
 }
-static int goodTest5(void *src){
+int goodTest5(void *src){
   return WideCharToMultiByte(CP_ACP, 0, (LPCWSTR)src, -1, 0, 0, 0, 0); // GOOD
 }
-static int badTest5 (void *src) {
+int badTest5 (void *src) {
   return WideCharToMultiByte(CP_ACP, 0, (LPCWSTR)src, -1, 0, 3, 0, 0);  // BAD
 }
-static void goodTest6(WCHAR *src)
+void goodTest6(WCHAR *src)
 {
   int size;
   char dst[5] ="";
@@ -87,7 +87,7 @@ static void goodTest6(WCHAR *src)
   WideCharToMultiByte(CP_ACP, 0, src, -1, dst, sizeof(dst), 0, 0); // GOOD
   printf("%s\n", dst);
 }
-static void badTest6(WCHAR *src)
+void badTest6(WCHAR *src)
 {
     char dst[5] ="";
     WideCharToMultiByte(CP_ACP, 0, src, -1, dst, 260, 0, 0); // BAD

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-125/semmle/tests/test2.cpp

@@ -11,14 +11,14 @@ size_t _mbstowcs_l(wchar_t *wcstr,const char *mbstr,size_t count, _locale_t loca
 size_t mbsrtowcs(wchar_t *wcstr,const char *mbstr,size_t count, mbstate_t *mbstate);
 
 
-static void badTest1(void *src,  int size) {
+void badTest1(void *src,  int size) {
     mbstowcs((wchar_t*)src,(char*)src,size); // BAD
     _locale_t locale;
     _mbstowcs_l((wchar_t*)src,(char*)src,size,locale); // BAD
     mbstate_t *mbstate;
     mbsrtowcs((wchar_t*)src,(char*)src,size,mbstate); // BAD
 }
-static void goodTest2(){
+void goodTest2(){
   char src[] = "0123456789ABCDEF";
   wchar_t dst[16];
   int res = mbstowcs(dst, src,16); // GOOD
@@ -29,43 +29,43 @@ static void goodTest2(){
   }
   printf("%s\n", dst);
 }
-static void badTest2(){
+void badTest2(){
   char src[] = "0123456789ABCDEF";
   wchar_t dst[16];
   mbstowcs(dst, src,16); // BAD
   printf("%s\n", dst);
 }
-static void goodTest3(){
+void goodTest3(){
   char src[] = "0123456789ABCDEF";
   int size = mbstowcs(NULL, src,NULL);
   wchar_t * dst = (wchar_t*)calloc(size + 1, sizeof(wchar_t));
   mbstowcs(dst, src,size+1); // GOOD
 }
-static void badTest3(){
+void badTest3(){
   char src[] = "0123456789ABCDEF";
   int size = mbstowcs(NULL, src,NULL);
   wchar_t * dst = (wchar_t*)calloc(size + 1, 1);
   mbstowcs(dst, src,size+1); // BAD
 }
-static void goodTest4(){
+void goodTest4(){
   char src[] = "0123456789ABCDEF";
   int size = mbstowcs(NULL, src,NULL);
   wchar_t * dst = (wchar_t*)malloc((size + 1)*sizeof(wchar_t));
   mbstowcs(dst, src,size+1); // GOOD
 }
-static void badTest4(){
+void badTest4(){
   char src[] = "0123456789ABCDEF";
   int size = mbstowcs(NULL, src,NULL);
   wchar_t * dst = (wchar_t*)malloc(size + 1);
   mbstowcs(dst, src,size+1); // BAD
 }
-static int goodTest5(void *src){
+int goodTest5(void *src){
   return mbstowcs(NULL, (char*)src,NULL); // GOOD
 }
-static int badTest5 (void *src) {
+int badTest5 (void *src) {
   return mbstowcs(NULL, (char*)src,3); // BAD
 }
-static void goodTest6(void *src){
+void goodTest6(void *src){
   wchar_t dst[5];
   int size = mbstowcs(NULL, (char*)src,NULL);
   if(size>=sizeof(dst)){
@@ -75,7 +75,7 @@ static void goodTest6(void *src){
   mbstowcs(dst, (char*)src,sizeof(dst)); // GOOD
   printf("%s\n", dst);
 }
-static void badTest6(void *src){
+void badTest6(void *src){
   wchar_t dst[5];
   mbstowcs(dst, (char*)src,260); // BAD
   printf("%s\n", dst);

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-125/semmle/tests/test3.cpp

@@ -9,14 +9,14 @@ void goodTest1(unsigned char *src){
   unsigned char dst[50];
   _mbsnbcpy(dst,src,sizeof(dst)); // GOOD
 }
-static size_t badTest1(unsigned char *src){
+size_t badTest1(unsigned char *src){
   int cb = 0;
   unsigned char dst[50];
   while( cb < sizeof(dst) )
     dst[cb++]=*src++; // BAD
   return _mbclen(dst);
 }
-static void goodTest2(unsigned char *src){
+void goodTest2(unsigned char *src){
 
   int cb = 0;
   unsigned char dst[50];
@@ -27,7 +27,7 @@ static void goodTest2(unsigned char *src){
     src=_mbsinc(src);
   }
 }
-static void badTest2(unsigned char *src){
+void badTest2(unsigned char *src){
 
   int cb = 0;
   unsigned char dst[50];
@@ -38,11 +38,11 @@ static void badTest2(unsigned char *src){
     src=_mbsinc(src);
   }
 }
-static void goodTest3(){
+void goodTest3(){
   wchar_t name[50];
   name[sizeof(name) / sizeof(*name) - 1] = L'\0'; // GOOD
 }
-static void badTest3(){
+void badTest3(){
   wchar_t name[50];
   name[sizeof(name) - 1] = L'\0'; // BAD
 }

cpp/ql/test/library-tests/basic_blocks/bb_cfg.ql

@@ -1,9 +1,4 @@
-/**
- * query-type: graph
- *
- * @kind graph-equivalence-test
- */
-
+// query-type: graph
 import cpp
 
 class DestructorCallEnhanced extends DestructorCall {

cpp/ql/test/library-tests/basic_blocks/cfg.ql

@@ -1,9 +1,4 @@
-/**
- * query-type: graph
- *
- * @kind graph-equivalence-test
- */
-
+// query-type: graph
 import cpp
 
 class DestructorCallEnhanced extends DestructorCall {

cpp/ql/test/library-tests/c++_exceptions/graphable.ql

@@ -1,9 +1,4 @@
-/**
- * query-type: graph
- *
- * @kind graph-equivalence-test
- */
-
+// query-type: graph
 import cpp
 
 class DestructorCallEnhanced extends DestructorCall {

cpp/ql/test/library-tests/constexpr_if/cfg.ql

@@ -1,9 +1,4 @@
-/**
- * query-type: graph
- *
- * @kind graph-equivalence-test
- */
-
+// query-type: graph
 import cpp
 
 class DestructorCallEnhanced extends DestructorCall {

cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-consistency.expected

@@ -3,9 +3,6 @@ uniqueEnclosingCallable
 | test.cpp:864:47:864:54 | call to source | Node should have one enclosing callable but has 0. |
 | test.cpp:872:46:872:51 | call to source | Node should have one enclosing callable but has 0. |
 | test.cpp:872:53:872:56 | 1 | Node should have one enclosing callable but has 0. |
-| test.cpp:1126:33:1129:1 | {...} | Node should have one enclosing callable but has 0. |
-| test.cpp:1127:3:1127:13 | reads_input | Node should have one enclosing callable but has 0. |
-| test.cpp:1128:3:1128:21 | not_does_read_input | Node should have one enclosing callable but has 0. |
 uniqueCallEnclosingCallable
 | test.cpp:864:47:864:54 | call to source | Call should have one enclosing callable but has 0. |
 | test.cpp:872:46:872:51 | call to source | Call should have one enclosing callable but has 0. |

cpp/ql/test/library-tests/dataflow/dataflow-tests/flowOut.cpp

@@ -78,7 +78,7 @@ int* deref(int** p) { // $ ast-def=p ir-def=*p ir-def=**p
   return q;
 }
 
-void flowout_test1() {
+void test1() {
   int x = 0;
   int* p = &x;
   deref(&p)[0] = source();
@@ -95,7 +95,7 @@ void addtaint2(int** p) { // $ ast-def=p ir-def=*p ir-def=**p
   addtaint1(q);
 }
 
-void flowout_test2() {
+void test2() {
   int x = 0;
   int* p = &x;
   addtaint2(&p);

cpp/ql/test/library-tests/dataflow/dataflow-tests/self-Iterator.cpp

@@ -15,7 +15,7 @@ template<> struct std::iterator_traits<unsigned long>
 };
 
 
-int iterator_test() {
+int test() {
     unsigned long x = source();
     sink(x); // $ ast ir
 }

cpp/ql/test/library-tests/dataflow/dataflow-tests/test-source-sink.expected

@@ -323,7 +323,6 @@ irFlow
 | test.cpp:1069:9:1069:14 | call to source | test.cpp:1074:10:1074:10 | i |
 | test.cpp:1069:9:1069:14 | call to source | test.cpp:1081:10:1081:10 | i |
 | test.cpp:1117:27:1117:34 | call to source | test.cpp:1117:27:1117:34 | call to source |
-| test.cpp:1132:11:1132:16 | call to source | test.cpp:1121:8:1121:8 | x |
 | true_upon_entry.cpp:9:11:9:16 | call to source | true_upon_entry.cpp:13:8:13:8 | x |
 | true_upon_entry.cpp:17:11:17:16 | call to source | true_upon_entry.cpp:21:8:21:8 | x |
 | true_upon_entry.cpp:27:9:27:14 | call to source | true_upon_entry.cpp:29:8:29:8 | x |

cpp/ql/test/library-tests/dataflow/dataflow-tests/test.cpp

@@ -1115,20 +1115,4 @@ void indirect_sink_const_ref(const T&);
 
 void test_temp_with_conversion_from_materialization() {
   indirect_sink_const_ref(source()); // $ ir MISSING: ast
-}
-
-void reads_input(int x) {
-  sink(x); // $ ir MISSING: ast
-}
-
-void not_does_read_input(int x);
-
-void (*dispatch_table[])(int) = {
-  reads_input,
-  not_does_read_input
-};
-
-void test_dispatch_table(int i) {
-  int x = source();
-  dispatch_table[i](x);
 }

cpp/ql/test/library-tests/dataflow/dataflow-tests/true_upon_entry.cpp

@@ -5,7 +5,7 @@ int source();
 void sink(...);
 bool random();
 
-void on_entry_test1() {
+void test1() {
   int x = source();
   for (int i = 0; i < 10; i++) {
     x = 0;
@@ -13,7 +13,7 @@ void on_entry_test1() {
   sink(x); // $ SPURIOUS: ir
 }
 
-void on_entry_test2(int iterations) {
+void test2(int iterations) {
   int x = source();
   for (int i = 0; i < iterations; i++) {
     x = 0;
@@ -21,7 +21,7 @@ void on_entry_test2(int iterations) {
   sink(x); // $ ast,ir
 }
 
-void on_entry_test3() {
+void test3() {
   int x = 0;
   for (int i = 0; i < 10; i++) {
     x = source();
@@ -29,7 +29,7 @@ void on_entry_test3() {
   sink(x); // $ ast,ir
 }
 
-void on_entry_test4() {
+void test4() {
   int x = source();
   for (int i = 0; i < 10; i++) {
     if (random())
@@ -39,7 +39,7 @@ void on_entry_test4() {
   sink(x); // $ ast,ir
 }
 
-void on_entry_test5() {
+void test5() {
   int x = source();
   for (int i = 0; i < 10; i++) {
     if (random())
@@ -49,7 +49,7 @@ void on_entry_test5() {
   sink(x); // $ ast,ir
 }
 
-void on_entry_test6() {
+void test6() {
   int y;
   int x = source();
   for (int i = 0; i < 10 && (y = 1); i++) {
@@ -57,7 +57,7 @@ void on_entry_test6() {
   sink(x); // $ ast,ir
 }
 
-void on_entry_test7() {
+void test7() {
   int y;
   int x = source();
   for (int i = 0; i < 10 && (y = 1); i++) {
@@ -66,7 +66,7 @@ void on_entry_test7() {
   sink(x); // $ SPURIOUS: ir
 }
 
-void on_entry_test8() {
+void test8() {
   int x = source();
   // It appears to the analysis that the condition can exit after `i < 10`
   // without having assigned to `x`. That is an effect of how the
@@ -78,7 +78,7 @@ void on_entry_test8() {
   sink(x); // $ SPURIOUS: ast,ir
 }
 
-void on_entry_test9() {
+void test9() {
   int y;
   int x = source();
   for (int i = 0; (y = 1) && i < 10; i++) {
@@ -86,14 +86,14 @@ void on_entry_test9() {
   sink(x); // $ ast,ir
 }
 
-void on_entry_test10() {
+void test10() {
   int x = source();
   for (int i = 0; (x = 1) && i < 10; i++) {
   }
   sink(x); // no flow
 }
 
-void on_entry_test10(int b, int d) {
+void test10(int b, int d) {
   int i = 0;
   int x = source();
   if (b)

cpp/ql/test/library-tests/dataflow/fields/dataflow-consistency.expected

@@ -185,8 +185,6 @@ postWithInFlow
 | simple.cpp:83:12:83:13 | f1 [post update] | PostUpdateNode should not be the target of local flow. |
 | simple.cpp:92:7:92:7 | i [post update] | PostUpdateNode should not be the target of local flow. |
 | simple.cpp:118:7:118:7 | i [post update] | PostUpdateNode should not be the target of local flow. |
-| simple.cpp:124:5:124:6 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
-| simple.cpp:124:6:124:6 | p [inner post update] | PostUpdateNode should not be the target of local flow. |
 | struct_init.c:24:11:24:12 | ab [inner post update] | PostUpdateNode should not be the target of local flow. |
 | struct_init.c:36:17:36:24 | nestedAB [inner post update] | PostUpdateNode should not be the target of local flow. |
 viableImplInCallContextTooLarge

cpp/ql/test/library-tests/dataflow/fields/partial-definition-diff.expected

@@ -291,6 +291,3 @@ WARNING: module 'DataFlow' has been deprecated and may be removed in future (par
 | simple.cpp:94:10:94:11 | a2 | IR only |
 | simple.cpp:118:7:118:7 | i | AST only |
 | simple.cpp:120:8:120:8 | a | IR only |
-| simple.cpp:124:5:124:6 | * ... | AST only |
-| simple.cpp:131:14:131:14 | a | IR only |
-| simple.cpp:136:10:136:10 | a | IR only |

cpp/ql/test/library-tests/dataflow/fields/partial-definition-ir.expected

@@ -651,9 +651,6 @@
 | simple.cpp:94:10:94:11 | a2 |
 | simple.cpp:118:5:118:5 | a |
 | simple.cpp:120:8:120:8 | a |
-| simple.cpp:131:14:131:14 | a |
-| simple.cpp:135:20:135:20 | q |
-| simple.cpp:136:10:136:10 | a |
 | struct_init.c:15:8:15:9 | ab |
 | struct_init.c:15:12:15:12 | a |
 | struct_init.c:16:8:16:9 | ab |

cpp/ql/test/library-tests/dataflow/fields/partial-definition.expected

@@ -581,8 +581,6 @@ WARNING: module 'DataFlow' has been deprecated and may be removed in future (par
 | simple.cpp:92:7:92:7 | i |
 | simple.cpp:118:5:118:5 | a |
 | simple.cpp:118:7:118:7 | i |
-| simple.cpp:124:5:124:6 | * ... |
-| simple.cpp:135:20:135:20 | q |
 | struct_init.c:15:8:15:9 | ab |
 | struct_init.c:15:12:15:12 | a |
 | struct_init.c:16:8:16:9 | ab |

cpp/ql/test/library-tests/dataflow/fields/simple.cpp

@@ -120,20 +120,4 @@ void post_update_to_phi_input(bool b)
   sink(a.i); // $ ast,ir
 }
 
-void write_to_param(int* p) {
-    *p = user_input();
-}
-
-void alias_with_fields(bool b) {
-    A a;
-    int* q;
-    if(b) {
-        q = &a.i;
-    } else {
-        q = nullptr;
-    }
-    write_to_param(q);
-    sink(a.i); // $ MISSING: ast,ir
-}
-
-} // namespace Simple
+} // namespace Simple

cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected

@@ -6584,16 +6584,6 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
 | taint.cpp:767:21:767:24 | ref arg path | taint.cpp:768:8:768:11 | path |  |
 | taint.cpp:768:8:768:11 | path | taint.cpp:768:7:768:11 | * ... |  |
 | taint.cpp:778:37:778:42 | call to source | taint.cpp:779:7:779:9 | obj |  |
-| taint.cpp:785:23:785:28 | source | taint.cpp:785:23:785:28 | source |  |
-| taint.cpp:785:23:785:28 | source | taint.cpp:786:18:786:23 | source |  |
-| taint.cpp:785:23:785:28 | source | taint.cpp:790:15:790:20 | source |  |
-| taint.cpp:786:12:786:16 | call to fopen | taint.cpp:787:7:787:7 | f |  |
-| taint.cpp:786:18:786:23 | source | taint.cpp:786:12:786:16 | call to fopen | TAINT |
-| taint.cpp:789:8:789:9 | f2 | taint.cpp:790:11:790:12 | f2 |  |
-| taint.cpp:789:8:789:9 | f2 | taint.cpp:791:7:791:8 | f2 |  |
-| taint.cpp:790:10:790:12 | ref arg & ... | taint.cpp:790:11:790:12 | f2 [inner post update] |  |
-| taint.cpp:790:10:790:12 | ref arg & ... | taint.cpp:791:7:791:8 | f2 |  |
-| taint.cpp:790:11:790:12 | f2 | taint.cpp:790:10:790:12 | & ... |  |
 | vector.cpp:16:43:16:49 | source1 | vector.cpp:17:26:17:32 | source1 |  |
 | vector.cpp:16:43:16:49 | source1 | vector.cpp:31:38:31:44 | source1 |  |
 | vector.cpp:17:21:17:33 | call to vector | vector.cpp:19:14:19:14 | v |  |

cpp/ql/test/library-tests/dataflow/taint-tests/taint.cpp

@@ -777,16 +777,4 @@ TaintInheritingContentObject source(bool);
 void test_TaintInheritingContent() {
 	TaintInheritingContentObject obj = source(true);
 	sink(obj.flowFromObject); // $ ir MISSING: ast
-}
-
-FILE* fopen(const char*, const char*);
-int fopen_s(FILE** pFile, const char *filename, const char *mode);
-
-void fopen_test(char* source) {
-	FILE* f = fopen(source, "r");
-	sink(f); // $ ast,ir
-
-	FILE* f2;
-	fopen_s(&f2, source, "r");
-	sink(f2); // $ ast,ir
 }

cpp/ql/test/library-tests/declarationEntry/declarationEntry/roundTrip.expected

@@ -25,8 +25,8 @@
 | declarationEntry.cpp:39:7:39:7 | declaration of operator= | declarationEntry.cpp:39:7:39:7 | operator= | yes |
 | declarationEntry.cpp:39:7:39:13 | definition of myClass | declarationEntry.cpp:39:7:39:13 | myClass | yes |
 | declarationEntry.cpp:42:6:42:21 | definition of myMemberVariable | declarationEntry.cpp:42:6:42:21 | myMemberVariable | yes |
-| file://:0:0:0:0 | declaration of (unnamed parameter 0) | file://:0:0:0:0 | (unnamed parameter 0) | yes |
-| file://:0:0:0:0 | declaration of (unnamed parameter 0) | file://:0:0:0:0 | (unnamed parameter 0) | yes |
+| file://:0:0:0:0 | declaration of 1st parameter | file://:0:0:0:0 | (unnamed parameter 0) | yes |
+| file://:0:0:0:0 | declaration of 1st parameter | file://:0:0:0:0 | (unnamed parameter 0) | yes |
 | file://:0:0:0:0 | definition of fp_offset | file://:0:0:0:0 | fp_offset | yes |
 | file://:0:0:0:0 | definition of gp_offset | file://:0:0:0:0 | gp_offset | yes |
 | file://:0:0:0:0 | definition of overflow_arg_area | file://:0:0:0:0 | overflow_arg_area | yes |

cpp/ql/test/library-tests/declarationEntry/more/declarationEntry.expected

@@ -1,7 +1,7 @@
-| file://:0:0:0:0 | declaration of (unnamed parameter 0) |
-| file://:0:0:0:0 | declaration of (unnamed parameter 0) |
-| file://:0:0:0:0 | declaration of (unnamed parameter 0) |
-| file://:0:0:0:0 | declaration of (unnamed parameter 0) |
+| file://:0:0:0:0 | declaration of 1st parameter |
+| file://:0:0:0:0 | declaration of 1st parameter |
+| file://:0:0:0:0 | declaration of 1st parameter |
+| file://:0:0:0:0 | declaration of 1st parameter |
 | file://:0:0:0:0 | definition of fp_offset |
 | file://:0:0:0:0 | definition of gp_offset |
 | file://:0:0:0:0 | definition of overflow_arg_area |

cpp/ql/test/library-tests/destructors/cfg.ql

@@ -1,9 +1,4 @@
-/**
- * query-type: graph
- *
- * @kind graph-equivalence-test
- */
-
+// query-type: graph
 import cpp
 
 class DestructorCallEnhanced extends DestructorCall {

cpp/ql/test/library-tests/files/Files.expected

@@ -1,4 +1,4 @@
-| c.c | c.c | CFile, MetricFile | C |  |  |
-| files1.cpp | files1.cpp | CppFile, MetricFile | C++ | swap | t |
-| files1.h | files1.h | HeaderFile, MetricFile |  | swap |  |
-| files2.cpp | files2.cpp | CppFile, MetricFile | C++ | g | x, y |
+| c.c | library-tests/files/c.c | CFile, MetricFile | C |  |  |
+| files1.cpp | library-tests/files/files1.cpp | CppFile, MetricFile | C++ | swap | t |
+| files1.h | library-tests/files/files1.h | HeaderFile, MetricFile |  | swap |  |
+| files2.cpp | library-tests/files/files2.cpp | CppFile, MetricFile | C++ | g | x, y |

cpp/ql/test/library-tests/ir/ir/PrintAST.expected

@@ -9055,8 +9055,6 @@ ir.cpp:
 #  733|                 Value = [Literal] 7
 #  733|                 ValueCategory = prvalue
 #  735|       getChild(1): [Handler] <handler>
-#  735|         getParameter(): [Parameter] s
-#  735|             Type = [PointerType] const char *
 #  735|         getBlock(): [CatchBlock] { ... }
 #  736|           getStmt(0): [ExprStmt] ExprStmt
 #  736|             getExpr(): [ThrowExpr] throw ...
@@ -9069,8 +9067,6 @@ ir.cpp:
 #  736|                     Type = [PointerType] const char *
 #  736|                     ValueCategory = prvalue(load)
 #  738|       getChild(2): [Handler] <handler>
-#  738|         getParameter(): [Parameter] e
-#  738|             Type = [LValueReferenceType] const String &
 #  738|         getBlock(): [CatchBlock] { ... }
 #  740|       getChild(3): [Handler] <handler>
 #  740|         getBlock(): [CatchAnyBlock] { ... }
@@ -12856,8 +12852,6 @@ ir.cpp:
 # 1200|                 Value = [Literal] 7
 # 1200|                 ValueCategory = prvalue
 # 1202|       getChild(1): [Handler] <handler>
-# 1202|         getParameter(): [Parameter] s
-# 1202|             Type = [PointerType] const char *
 # 1202|         getBlock(): [CatchBlock] { ... }
 # 1203|           getStmt(0): [ExprStmt] ExprStmt
 # 1203|             getExpr(): [ThrowExpr] throw ...
@@ -12870,8 +12864,6 @@ ir.cpp:
 # 1203|                     Type = [PointerType] const char *
 # 1203|                     ValueCategory = prvalue(load)
 # 1205|       getChild(2): [Handler] <handler>
-# 1205|         getParameter(): [Parameter] e
-# 1205|             Type = [LValueReferenceType] const String &
 # 1205|         getBlock(): [CatchBlock] { ... }
 # 1207|     getStmt(1): [ReturnStmt] return ...
 # 1211| [TopLevelFunction] void VectorTypes(int)
@@ -20594,8 +20586,6 @@ ir.cpp:
 # 2281|               Type = [Struct] String
 # 2281|               ValueCategory = lvalue
 # 2282|       getChild(1): [Handler] <handler>
-# 2282|         getParameter(): [Parameter] s
-# 2282|             Type = [PointerType] const char *
 # 2282|         getBlock(): [CatchBlock] { ... }
 # 2283|           getStmt(0): [ExprStmt] ExprStmt
 # 2283|             getExpr(): [ThrowExpr] throw ...
@@ -20608,8 +20598,6 @@ ir.cpp:
 # 2283|                     Type = [PointerType] const char *
 # 2283|                     ValueCategory = prvalue(load)
 # 2285|       getChild(2): [Handler] <handler>
-# 2285|         getParameter(): [Parameter] e
-# 2285|             Type = [LValueReferenceType] const String &
 # 2285|         getBlock(): [CatchBlock] { ... }
 # 2287|       getChild(3): [Handler] <handler>
 # 2287|         getBlock(): [CatchAnyBlock] { ... }
@@ -22857,8 +22845,6 @@ ir.cpp:
 # 2537|                 Value = [Literal] 42
 # 2537|                 ValueCategory = prvalue
 # 2539|       getChild(1): [Handler] <handler>
-# 2539|         getParameter(): [Parameter] (unnamed parameter 0)
-# 2539|             Type = [PlainCharType] char
 # 2539|         getBlock(): [CatchBlock] { ... }
 # 2541|         getImplicitDestructorCall(0): [DestructorCall] call to ~ClassWithDestructor
 # 2541|             Type = [VoidType] void
@@ -23578,42 +23564,6 @@ ir.cpp:
 # 2686|           Value = [CStyleCast] 0
 # 2686|           ValueCategory = prvalue
 # 2687|     getStmt(1): [ReturnStmt] return ...
-# 2691| [TopLevelFunction] int concepts::requires_use()
-# 2691|   <params>: 
-# 2691|   getEntryPoint(): [BlockStmt] { ... }
-# 2692|     getStmt(0): [DeclStmt] declaration
-# 2692|       getDeclarationEntry(0): [VariableDeclarationEntry] definition of y
-# 2692|           Type = [IntType] int
-# 2692|         getVariable().getInitializer(): [Initializer] initializer for y
-#-----|           getExpr(): [RequiresExpr] requires { ... }
-#-----|               Type = [BoolType] bool
-#-----|               Value = [RequiresExpr] 1
-#-----|               ValueCategory = prvalue
-#-----|             <params>: 
-# 2692|             getRequirement(0): [GTExpr,SimpleRequirementExpr] ... > ...
-# 2692|                 Type = [BoolType] bool
-# 2692|                 ValueCategory = prvalue
-# 2692|               getGreaterOperand(): [SizeofTypeOperator] sizeof(int)
-# 2692|                   Type = [LongType] unsigned long
-# 2692|                   Value = [SizeofTypeOperator] 4
-# 2692|                   ValueCategory = prvalue
-# 2692|               getLesserOperand(): [Literal] 0
-# 2692|                   Type = [IntType] int
-# 2692|                   Value = [Literal] 0
-# 2692|                   ValueCategory = prvalue
-# 2692|               getLesserOperand().getFullyConverted(): [CStyleCast] (unsigned long)...
-# 2692|                   Conversion = [IntegralConversion] integral conversion
-# 2692|                   Type = [LongType] unsigned long
-# 2692|                   ValueCategory = prvalue
-#-----|           getExpr().getFullyConverted(): [CStyleCast] (int)...
-#-----|               Conversion = [IntegralConversion] integral conversion
-#-----|               Type = [IntType] int
-#-----|               Value = [CStyleCast] 1
-#-----|               ValueCategory = prvalue
-# 2693|     getStmt(1): [ReturnStmt] return ...
-# 2693|       getExpr(): [VariableAccess] y
-# 2693|           Type = [IntType] int
-# 2693|           ValueCategory = prvalue(load)
 many-defs-per-use.cpp:
 #   34| [TopLevelFunction] void many_defs_per_use()
 #   34|   <params>: 

cpp/ql/test/library-tests/ir/ir/aliased_ir.expected

@@ -19099,24 +19099,6 @@ ir.cpp:
 # 2684|   Block 8
 # 2684|     v2684_14(void) = Unreached : 
 
-# 2691| int concepts::requires_use()
-# 2691|   Block 0
-# 2691|     v2691_1(void)       = EnterFunction            : 
-# 2691|     m2691_2(unknown)    = AliasedDefinition        : 
-# 2691|     m2691_3(unknown)    = InitializeNonLocal       : 
-# 2691|     m2691_4(unknown)    = Chi                      : total:m2691_2, partial:m2691_3
-# 2692|     r2692_1(glval<int>) = VariableAddress[y]       : 
-#-----|     r0_1(int)           = Constant[1]              : 
-#-----|     m0_2(int)           = Store[y]                 : &:r2692_1, r0_1
-# 2693|     r2693_1(glval<int>) = VariableAddress[#return] : 
-# 2693|     r2693_2(glval<int>) = VariableAddress[y]       : 
-# 2693|     r2693_3(int)        = Load[y]                  : &:r2693_2, m0_2
-# 2693|     m2693_4(int)        = Store[#return]           : &:r2693_1, r2693_3
-# 2691|     r2691_5(glval<int>) = VariableAddress[#return] : 
-# 2691|     v2691_6(void)       = ReturnValue              : &:r2691_5, m2693_4
-# 2691|     v2691_7(void)       = AliasedUse               : m2691_3
-# 2691|     v2691_8(void)       = ExitFunction             : 
-
 many-defs-per-use.cpp:
 #   34| void many_defs_per_use()
 #   34|   Block 0

cpp/ql/test/library-tests/ir/ir/ir.cpp

@@ -2686,13 +2686,4 @@ void test(bool b)
   twice_call_use(b ? "" : "");
 }
 
-namespace concepts {
-
-int requires_use() {
-  int y = requires { sizeof(int) > 0; };
-  return y;
-}
-
-}
-
 // semmle-extractor-options: -std=c++20 --clang

cpp/ql/test/library-tests/ir/ir/raw_ir.expected

@@ -17422,23 +17422,6 @@ ir.cpp:
 # 2684|     v2684_7(void) = AliasedUse   : ~m?
 # 2684|     v2684_8(void) = ExitFunction : 
 
-# 2691| int concepts::requires_use()
-# 2691|   Block 0
-# 2691|     v2691_1(void)       = EnterFunction            : 
-# 2691|     mu2691_2(unknown)   = AliasedDefinition        : 
-# 2691|     mu2691_3(unknown)   = InitializeNonLocal       : 
-# 2692|     r2692_1(glval<int>) = VariableAddress[y]       : 
-#-----|     r0_1(int)           = Constant[1]              : 
-#-----|     mu0_2(int)          = Store[y]                 : &:r2692_1, r0_1
-# 2693|     r2693_1(glval<int>) = VariableAddress[#return] : 
-# 2693|     r2693_2(glval<int>) = VariableAddress[y]       : 
-# 2693|     r2693_3(int)        = Load[y]                  : &:r2693_2, ~m?
-# 2693|     mu2693_4(int)       = Store[#return]           : &:r2693_1, r2693_3
-# 2691|     r2691_4(glval<int>) = VariableAddress[#return] : 
-# 2691|     v2691_5(void)       = ReturnValue              : &:r2691_4, ~m?
-# 2691|     v2691_6(void)       = AliasedUse               : ~m?
-# 2691|     v2691_7(void)       = ExitFunction             : 
-
 many-defs-per-use.cpp:
 #   34| void many_defs_per_use()
 #   34|   Block 0

cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected

@@ -2200,65 +2200,3 @@ ssa.cpp:
 #  439|     r439_15(glval<int>) = VariableAddress[#temp439:13] : 
 #  439|     m439_16(int)        = Store[#temp439:13]           : &:r439_15, r439_14
 #-----|   Goto -> Block 1
-
-#  442| void NonEscapingParams(void*, void*)
-#  442|   Block 0
-#  442|     v442_1(void)          = EnterFunction            : 
-#  442|     m442_2(unknown)       = AliasedDefinition        : 
-#  442|     m442_3(unknown)       = InitializeNonLocal       : 
-#  442|     m442_4(unknown)       = Chi                      : total:m442_2, partial:m442_3
-#  442|     r442_5(glval<void *>) = VariableAddress[a]       : 
-#  442|     m442_6(void *)        = InitializeParameter[a]   : &:r442_5
-#  442|     r442_7(void *)        = Load[a]                  : &:r442_5, m442_6
-#  442|     m442_8(unknown)       = InitializeIndirection[a] : &:r442_7
-#  442|     r442_9(glval<void *>) = VariableAddress[b]       : 
-#  442|     m442_10(void *)       = InitializeParameter[b]   : &:r442_9
-#  442|     r442_11(void *)       = Load[b]                  : &:r442_9, m442_10
-#  442|     m442_12(unknown)      = InitializeIndirection[b] : &:r442_11
-#  444|     v444_1(void)          = NoOp                     : 
-#  442|     v442_13(void)         = ReturnIndirection[a]     : &:r442_7, m442_8
-#  442|     v442_14(void)         = ReturnIndirection[b]     : &:r442_11, m442_12
-#  442|     v442_15(void)         = ReturnVoid               : 
-#  442|     v442_16(void)         = AliasedUse               : m442_3
-#  442|     v442_17(void)         = ExitFunction             : 
-
-#  446| void EscapingParams(void*, void*)
-#  446|   Block 0
-#  446|     v446_1(void)           = EnterFunction                : 
-#  446|     m446_2(unknown)        = AliasedDefinition            : 
-#  446|     m446_3(unknown)        = InitializeNonLocal           : 
-#  446|     m446_4(unknown)        = Chi                          : total:m446_2, partial:m446_3
-#  446|     r446_5(glval<void *>)  = VariableAddress[a]           : 
-#  446|     m446_6(void *)         = InitializeParameter[a]       : &:r446_5
-#  446|     r446_7(void *)         = Load[a]                      : &:r446_5, m446_6
-#  446|     m446_8(unknown)        = InitializeIndirection[a]     : &:r446_7
-#  446|     m446_9(unknown)        = Chi                          : total:m446_4, partial:m446_8
-#  446|     r446_10(glval<void *>) = VariableAddress[b]           : 
-#  446|     m446_11(void *)        = InitializeParameter[b]       : &:r446_10
-#  446|     r446_12(void *)        = Load[b]                      : &:r446_10, m446_11
-#  446|     m446_13(unknown)       = InitializeIndirection[b]     : &:r446_12
-#  446|     m446_14(unknown)       = Chi                          : total:m446_9, partial:m446_13
-#  448|     r448_1(glval<unknown>) = FunctionAddress[Escape]      : 
-#  448|     r448_2(glval<void *>)  = VariableAddress[a]           : 
-#  448|     r448_3(void *)         = Load[a]                      : &:r448_2, m446_6
-#  448|     v448_4(void)           = Call[Escape]                 : func:r448_1, 0:r448_3
-#  448|     m448_5(unknown)        = ^CallSideEffect              : ~m446_14
-#  448|     m448_6(unknown)        = Chi                          : total:m446_14, partial:m448_5
-#  448|     v448_7(void)           = ^BufferReadSideEffect[0]     : &:r448_3, ~m448_6
-#  448|     m448_8(unknown)        = ^BufferMayWriteSideEffect[0] : &:r448_3
-#  448|     m448_9(unknown)        = Chi                          : total:m448_6, partial:m448_8
-#  449|     r449_1(glval<unknown>) = FunctionAddress[Escape]      : 
-#  449|     r449_2(glval<void *>)  = VariableAddress[b]           : 
-#  449|     r449_3(void *)         = Load[b]                      : &:r449_2, m446_11
-#  449|     v449_4(void)           = Call[Escape]                 : func:r449_1, 0:r449_3
-#  449|     m449_5(unknown)        = ^CallSideEffect              : ~m448_9
-#  449|     m449_6(unknown)        = Chi                          : total:m448_9, partial:m449_5
-#  449|     v449_7(void)           = ^BufferReadSideEffect[0]     : &:r449_3, ~m449_6
-#  449|     m449_8(unknown)        = ^BufferMayWriteSideEffect[0] : &:r449_3
-#  449|     m449_9(unknown)        = Chi                          : total:m449_6, partial:m449_8
-#  450|     v450_1(void)           = NoOp                         : 
-#  446|     v446_15(void)          = ReturnIndirection[a]         : &:r446_7, ~m449_9
-#  446|     v446_16(void)          = ReturnIndirection[b]         : &:r446_12, ~m449_9
-#  446|     v446_17(void)          = ReturnVoid                   : 
-#  446|     v446_18(void)          = AliasedUse                   : ~m449_9
-#  446|     v446_19(void)          = ExitFunction                 : 

cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir_unsound.expected

@@ -2200,65 +2200,3 @@ ssa.cpp:
 #  439|     r439_15(glval<int>) = VariableAddress[#temp439:13] : 
 #  439|     m439_16(int)        = Store[#temp439:13]           : &:r439_15, r439_14
 #-----|   Goto -> Block 1
-
-#  442| void NonEscapingParams(void*, void*)
-#  442|   Block 0
-#  442|     v442_1(void)          = EnterFunction            : 
-#  442|     m442_2(unknown)       = AliasedDefinition        : 
-#  442|     m442_3(unknown)       = InitializeNonLocal       : 
-#  442|     m442_4(unknown)       = Chi                      : total:m442_2, partial:m442_3
-#  442|     r442_5(glval<void *>) = VariableAddress[a]       : 
-#  442|     m442_6(void *)        = InitializeParameter[a]   : &:r442_5
-#  442|     r442_7(void *)        = Load[a]                  : &:r442_5, m442_6
-#  442|     m442_8(unknown)       = InitializeIndirection[a] : &:r442_7
-#  442|     r442_9(glval<void *>) = VariableAddress[b]       : 
-#  442|     m442_10(void *)       = InitializeParameter[b]   : &:r442_9
-#  442|     r442_11(void *)       = Load[b]                  : &:r442_9, m442_10
-#  442|     m442_12(unknown)      = InitializeIndirection[b] : &:r442_11
-#  444|     v444_1(void)          = NoOp                     : 
-#  442|     v442_13(void)         = ReturnIndirection[a]     : &:r442_7, m442_8
-#  442|     v442_14(void)         = ReturnIndirection[b]     : &:r442_11, m442_12
-#  442|     v442_15(void)         = ReturnVoid               : 
-#  442|     v442_16(void)         = AliasedUse               : m442_3
-#  442|     v442_17(void)         = ExitFunction             : 
-
-#  446| void EscapingParams(void*, void*)
-#  446|   Block 0
-#  446|     v446_1(void)           = EnterFunction                : 
-#  446|     m446_2(unknown)        = AliasedDefinition            : 
-#  446|     m446_3(unknown)        = InitializeNonLocal           : 
-#  446|     m446_4(unknown)        = Chi                          : total:m446_2, partial:m446_3
-#  446|     r446_5(glval<void *>)  = VariableAddress[a]           : 
-#  446|     m446_6(void *)         = InitializeParameter[a]       : &:r446_5
-#  446|     r446_7(void *)         = Load[a]                      : &:r446_5, m446_6
-#  446|     m446_8(unknown)        = InitializeIndirection[a]     : &:r446_7
-#  446|     m446_9(unknown)        = Chi                          : total:m446_4, partial:m446_8
-#  446|     r446_10(glval<void *>) = VariableAddress[b]           : 
-#  446|     m446_11(void *)        = InitializeParameter[b]       : &:r446_10
-#  446|     r446_12(void *)        = Load[b]                      : &:r446_10, m446_11
-#  446|     m446_13(unknown)       = InitializeIndirection[b]     : &:r446_12
-#  446|     m446_14(unknown)       = Chi                          : total:m446_9, partial:m446_13
-#  448|     r448_1(glval<unknown>) = FunctionAddress[Escape]      : 
-#  448|     r448_2(glval<void *>)  = VariableAddress[a]           : 
-#  448|     r448_3(void *)         = Load[a]                      : &:r448_2, m446_6
-#  448|     v448_4(void)           = Call[Escape]                 : func:r448_1, 0:r448_3
-#  448|     m448_5(unknown)        = ^CallSideEffect              : ~m446_14
-#  448|     m448_6(unknown)        = Chi                          : total:m446_14, partial:m448_5
-#  448|     v448_7(void)           = ^BufferReadSideEffect[0]     : &:r448_3, ~m448_6
-#  448|     m448_8(unknown)        = ^BufferMayWriteSideEffect[0] : &:r448_3
-#  448|     m448_9(unknown)        = Chi                          : total:m448_6, partial:m448_8
-#  449|     r449_1(glval<unknown>) = FunctionAddress[Escape]      : 
-#  449|     r449_2(glval<void *>)  = VariableAddress[b]           : 
-#  449|     r449_3(void *)         = Load[b]                      : &:r449_2, m446_11
-#  449|     v449_4(void)           = Call[Escape]                 : func:r449_1, 0:r449_3
-#  449|     m449_5(unknown)        = ^CallSideEffect              : ~m448_9
-#  449|     m449_6(unknown)        = Chi                          : total:m448_9, partial:m449_5
-#  449|     v449_7(void)           = ^BufferReadSideEffect[0]     : &:r449_3, ~m449_6
-#  449|     m449_8(unknown)        = ^BufferMayWriteSideEffect[0] : &:r449_3
-#  449|     m449_9(unknown)        = Chi                          : total:m449_6, partial:m449_8
-#  450|     v450_1(void)           = NoOp                         : 
-#  446|     v446_15(void)          = ReturnIndirection[a]         : &:r446_7, ~m449_9
-#  446|     v446_16(void)          = ReturnIndirection[b]         : &:r446_12, ~m449_9
-#  446|     v446_17(void)          = ReturnVoid                   : 
-#  446|     v446_18(void)          = AliasedUse                   : ~m449_9
-#  446|     v446_19(void)          = ExitFunction                 : 

cpp/ql/test/library-tests/ir/ssa/aliased_ssa_overlap.expected

@@ -1,526 +0,0 @@
-| ssa.c:3:14:3:16 | foo | ssa.c:3:14:3:16 | foo | MustExactlyOverlap |
-| ssa.c:3:14:3:16 | foo | ssa.c:3:14:3:16 | foo[0..4)<int> | MustTotallyOverlap |
-| ssa.c:3:14:3:16 | foo | ssa.c:3:14:3:16 | foo[4..8)<int> | MustTotallyOverlap |
-| ssa.c:3:14:3:16 | foo[0..4)<int> | ssa.c:3:14:3:16 | foo | MayPartiallyOverlap |
-| ssa.c:3:14:3:16 | foo[0..4)<int> | ssa.c:3:14:3:16 | foo[0..4)<int> | MustExactlyOverlap |
-| ssa.c:3:14:3:16 | foo[4..8)<int> | ssa.c:3:14:3:16 | foo | MayPartiallyOverlap |
-| ssa.c:3:14:3:16 | foo[4..8)<int> | ssa.c:3:14:3:16 | foo[4..8)<int> | MustExactlyOverlap |
-| ssa.c:7:7:7:7 | x | ssa.c:7:7:7:7 | x | MustExactlyOverlap |
-| ssa.c:7:7:7:7 | x | ssa.c:7:7:7:7 | x<int> | MustTotallyOverlap |
-| ssa.c:7:7:7:7 | x<int> | ssa.c:7:7:7:7 | x | MustTotallyOverlap |
-| ssa.c:7:7:7:7 | x<int> | ssa.c:7:7:7:7 | x<int> | MustExactlyOverlap |
-| ssa.c:12:15:12:17 | foo | ssa.c:12:15:12:17 | foo | MustExactlyOverlap |
-| ssa.c:12:15:12:17 | foo | ssa.c:12:15:12:17 | foo[0..4)<int> | MustTotallyOverlap |
-| ssa.c:12:15:12:17 | foo | ssa.c:12:15:12:17 | foo[4..8)<int> | MustTotallyOverlap |
-| ssa.c:12:15:12:17 | foo[0..4)<int> | ssa.c:12:15:12:17 | foo | MayPartiallyOverlap |
-| ssa.c:12:15:12:17 | foo[0..4)<int> | ssa.c:12:15:12:17 | foo[0..4)<int> | MustExactlyOverlap |
-| ssa.c:12:15:12:17 | foo[4..8)<int> | ssa.c:12:15:12:17 | foo | MayPartiallyOverlap |
-| ssa.c:12:15:12:17 | foo[4..8)<int> | ssa.c:12:15:12:17 | foo[4..8)<int> | MustExactlyOverlap |
-| ssa.c:14:15:14:25 | foo_swapped | ssa.c:14:15:14:25 | foo_swapped | MustExactlyOverlap |
-| ssa.c:14:15:14:25 | foo_swapped | ssa.c:14:15:14:25 | foo_swapped[0..4)<int> | MustTotallyOverlap |
-| ssa.c:14:15:14:25 | foo_swapped | ssa.c:14:15:14:25 | foo_swapped[4..8)<int> | MustTotallyOverlap |
-| ssa.c:14:15:14:25 | foo_swapped[0..4)<int> | ssa.c:14:15:14:25 | foo_swapped | MayPartiallyOverlap |
-| ssa.c:14:15:14:25 | foo_swapped[0..4)<int> | ssa.c:14:15:14:25 | foo_swapped[0..4)<int> | MustExactlyOverlap |
-| ssa.c:14:15:14:25 | foo_swapped[4..8)<int> | ssa.c:14:15:14:25 | foo_swapped | MayPartiallyOverlap |
-| ssa.c:14:15:14:25 | foo_swapped[4..8)<int> | ssa.c:14:15:14:25 | foo_swapped[4..8)<int> | MustExactlyOverlap |
-| ssa.c:18:7:18:7 | x | ssa.c:18:7:18:7 | x | MustExactlyOverlap |
-| ssa.c:18:7:18:7 | x | ssa.c:18:7:18:7 | x[0..4)<int> | MustTotallyOverlap |
-| ssa.c:18:7:18:7 | x | ssa.c:18:7:18:7 | x[4..8)<int> | MustTotallyOverlap |
-| ssa.c:18:7:18:7 | x[0..4)<int> | ssa.c:18:7:18:7 | x | MayPartiallyOverlap |
-| ssa.c:18:7:18:7 | x[0..4)<int> | ssa.c:18:7:18:7 | x[0..4)<int> | MustExactlyOverlap |
-| ssa.c:18:7:18:7 | x[4..8)<int> | ssa.c:18:7:18:7 | x | MayPartiallyOverlap |
-| ssa.c:18:7:18:7 | x[4..8)<int> | ssa.c:18:7:18:7 | x[4..8)<int> | MustExactlyOverlap |
-| ssa.c:20:7:20:7 | y | ssa.c:20:7:20:7 | y | MustExactlyOverlap |
-| ssa.c:20:7:20:7 | y | ssa.c:20:7:20:7 | y[0..4)<int> | MustTotallyOverlap |
-| ssa.c:20:7:20:7 | y | ssa.c:20:7:20:7 | y[4..8)<int> | MustTotallyOverlap |
-| ssa.c:20:7:20:7 | y[0..4)<int> | ssa.c:20:7:20:7 | y | MayPartiallyOverlap |
-| ssa.c:20:7:20:7 | y[0..4)<int> | ssa.c:20:7:20:7 | y[0..4)<int> | MustExactlyOverlap |
-| ssa.c:20:7:20:7 | y[4..8)<int> | ssa.c:20:7:20:7 | y | MayPartiallyOverlap |
-| ssa.c:20:7:20:7 | y[4..8)<int> | ssa.c:20:7:20:7 | y[4..8)<int> | MustExactlyOverlap |
-| ssa.c:29:28:29:28 | f | ssa.c:29:28:29:28 | f | MustExactlyOverlap |
-| ssa.c:29:28:29:28 | f | ssa.c:29:28:29:28 | f[0..4)<int> | MustTotallyOverlap |
-| ssa.c:29:28:29:28 | f | ssa.c:29:28:29:28 | f[4..8)<int> | MustTotallyOverlap |
-| ssa.c:29:28:29:28 | f | ssa.c:29:28:29:28 | f[8..12)<int> | MustTotallyOverlap |
-| ssa.c:29:28:29:28 | f[0..4)<int> | ssa.c:29:28:29:28 | f | MayPartiallyOverlap |
-| ssa.c:29:28:29:28 | f[0..4)<int> | ssa.c:29:28:29:28 | f[0..4)<int> | MustExactlyOverlap |
-| ssa.c:29:28:29:28 | f[4..8)<int> | ssa.c:29:28:29:28 | f | MayPartiallyOverlap |
-| ssa.c:29:28:29:28 | f[4..8)<int> | ssa.c:29:28:29:28 | f[4..8)<int> | MustExactlyOverlap |
-| ssa.c:29:28:29:28 | f[8..12)<int> | ssa.c:29:28:29:28 | f | MayPartiallyOverlap |
-| ssa.c:29:28:29:28 | f[8..12)<int> | ssa.c:29:28:29:28 | f[8..12)<int> | MustExactlyOverlap |
-| ssa.cpp:13:23:13:23 | *p | ssa.cpp:13:23:13:23 | *p | MustExactlyOverlap |
-| ssa.cpp:13:23:13:23 | *p | ssa.cpp:13:23:13:23 | *p[0..4)<int> | MustTotallyOverlap |
-| ssa.cpp:13:23:13:23 | *p | ssa.cpp:13:23:13:23 | *p[4..8)<int> | MustTotallyOverlap |
-| ssa.cpp:13:23:13:23 | *p | ssa.cpp:13:23:13:23 | ?*p | MustTotallyOverlap |
-| ssa.cpp:13:23:13:23 | *p[0..4)<int> | ssa.cpp:13:23:13:23 | *p | MayPartiallyOverlap |
-| ssa.cpp:13:23:13:23 | *p[0..4)<int> | ssa.cpp:13:23:13:23 | *p[0..4)<int> | MustExactlyOverlap |
-| ssa.cpp:13:23:13:23 | *p[0..4)<int> | ssa.cpp:13:23:13:23 | ?*p | MayPartiallyOverlap |
-| ssa.cpp:13:23:13:23 | *p[4..8)<int> | ssa.cpp:13:23:13:23 | *p | MayPartiallyOverlap |
-| ssa.cpp:13:23:13:23 | *p[4..8)<int> | ssa.cpp:13:23:13:23 | *p[4..8)<int> | MustExactlyOverlap |
-| ssa.cpp:13:23:13:23 | *p[4..8)<int> | ssa.cpp:13:23:13:23 | ?*p | MayPartiallyOverlap |
-| ssa.cpp:13:23:13:23 | ?*p | ssa.cpp:13:23:13:23 | *p | MayPartiallyOverlap |
-| ssa.cpp:13:23:13:23 | ?*p | ssa.cpp:13:23:13:23 | *p[0..4)<int> | MayPartiallyOverlap |
-| ssa.cpp:13:23:13:23 | ?*p | ssa.cpp:13:23:13:23 | *p[4..8)<int> | MayPartiallyOverlap |
-| ssa.cpp:13:23:13:23 | ?*p | ssa.cpp:13:23:13:23 | ?*p | MayPartiallyOverlap |
-| ssa.cpp:68:38:68:38 | *p | ssa.cpp:68:38:68:38 | *p | MustExactlyOverlap |
-| ssa.cpp:68:38:68:38 | *p | ssa.cpp:68:38:68:38 | *p[?..?)<char> | MustTotallyOverlap |
-| ssa.cpp:68:38:68:38 | *p | ssa.cpp:68:38:68:38 | ?*p | MustTotallyOverlap |
-| ssa.cpp:68:38:68:38 | *p[?..?)<char> | ssa.cpp:68:38:68:38 | *p | MayPartiallyOverlap |
-| ssa.cpp:68:38:68:38 | *p[?..?)<char> | ssa.cpp:68:38:68:38 | *p[?..?)<char> | MayPartiallyOverlap |
-| ssa.cpp:68:38:68:38 | *p[?..?)<char> | ssa.cpp:68:38:68:38 | ?*p | MayPartiallyOverlap |
-| ssa.cpp:68:38:68:38 | ?*p | ssa.cpp:68:38:68:38 | *p | MayPartiallyOverlap |
-| ssa.cpp:68:38:68:38 | ?*p | ssa.cpp:68:38:68:38 | *p[?..?)<char> | MayPartiallyOverlap |
-| ssa.cpp:68:38:68:38 | ?*p | ssa.cpp:68:38:68:38 | ?*p | MayPartiallyOverlap |
-| ssa.cpp:95:38:95:38 | ?a[0..?)<unknown> | ssa.cpp:95:38:95:38 | ?a[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:95:38:95:38 | ?a[0..?)<unknown> | ssa.cpp:95:38:95:38 | a | MayPartiallyOverlap |
-| ssa.cpp:95:38:95:38 | ?a[0..?)<unknown> | ssa.cpp:95:38:95:38 | a[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:95:38:95:38 | a | ssa.cpp:95:38:95:38 | ?a[0..?)<unknown> | MustTotallyOverlap |
-| ssa.cpp:95:38:95:38 | a | ssa.cpp:95:38:95:38 | a | MustExactlyOverlap |
-| ssa.cpp:95:38:95:38 | a | ssa.cpp:95:38:95:38 | a[0..?)<unknown> | MustTotallyOverlap |
-| ssa.cpp:95:38:95:38 | a[0..?)<unknown> | ssa.cpp:95:38:95:38 | ?a[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:95:38:95:38 | a[0..?)<unknown> | ssa.cpp:95:38:95:38 | a | MayPartiallyOverlap |
-| ssa.cpp:95:38:95:38 | a[0..?)<unknown> | ssa.cpp:95:38:95:38 | a[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:100:31:100:31 | a | ssa.cpp:100:31:100:31 | a | MustExactlyOverlap |
-| ssa.cpp:100:31:100:31 | a | ssa.cpp:100:31:100:31 | a[0..4)<int> | MustTotallyOverlap |
-| ssa.cpp:100:31:100:31 | a | ssa.cpp:100:31:100:31 | a[4..8)<int> | MustTotallyOverlap |
-| ssa.cpp:100:31:100:31 | a[0..4)<int> | ssa.cpp:100:31:100:31 | a | MayPartiallyOverlap |
-| ssa.cpp:100:31:100:31 | a[0..4)<int> | ssa.cpp:100:31:100:31 | a[0..4)<int> | MustExactlyOverlap |
-| ssa.cpp:100:31:100:31 | a[4..8)<int> | ssa.cpp:100:31:100:31 | a | MayPartiallyOverlap |
-| ssa.cpp:100:31:100:31 | a[4..8)<int> | ssa.cpp:100:31:100:31 | a[4..8)<int> | MustExactlyOverlap |
-| ssa.cpp:105:38:105:38 | ?a[0..?)<unknown> | ssa.cpp:105:38:105:38 | ?a[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:105:38:105:38 | ?a[0..?)<unknown> | ssa.cpp:105:38:105:38 | a | MayPartiallyOverlap |
-| ssa.cpp:105:38:105:38 | ?a[0..?)<unknown> | ssa.cpp:105:38:105:38 | a[0..4)<int> | MayPartiallyOverlap |
-| ssa.cpp:105:38:105:38 | ?a[0..?)<unknown> | ssa.cpp:105:38:105:38 | a[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:105:38:105:38 | ?a[0..?)<unknown> | ssa.cpp:105:38:105:38 | a[4..8)<int> | MayPartiallyOverlap |
-| ssa.cpp:105:38:105:38 | a | ssa.cpp:105:38:105:38 | ?a[0..?)<unknown> | MustTotallyOverlap |
-| ssa.cpp:105:38:105:38 | a | ssa.cpp:105:38:105:38 | a | MustExactlyOverlap |
-| ssa.cpp:105:38:105:38 | a | ssa.cpp:105:38:105:38 | a[0..4)<int> | MustTotallyOverlap |
-| ssa.cpp:105:38:105:38 | a | ssa.cpp:105:38:105:38 | a[0..?)<unknown> | MustTotallyOverlap |
-| ssa.cpp:105:38:105:38 | a | ssa.cpp:105:38:105:38 | a[4..8)<int> | MustTotallyOverlap |
-| ssa.cpp:105:38:105:38 | a[0..4)<int> | ssa.cpp:105:38:105:38 | ?a[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:105:38:105:38 | a[0..4)<int> | ssa.cpp:105:38:105:38 | a | MayPartiallyOverlap |
-| ssa.cpp:105:38:105:38 | a[0..4)<int> | ssa.cpp:105:38:105:38 | a[0..4)<int> | MustExactlyOverlap |
-| ssa.cpp:105:38:105:38 | a[0..4)<int> | ssa.cpp:105:38:105:38 | a[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:105:38:105:38 | a[0..?)<unknown> | ssa.cpp:105:38:105:38 | ?a[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:105:38:105:38 | a[0..?)<unknown> | ssa.cpp:105:38:105:38 | a | MayPartiallyOverlap |
-| ssa.cpp:105:38:105:38 | a[0..?)<unknown> | ssa.cpp:105:38:105:38 | a[0..4)<int> | MayPartiallyOverlap |
-| ssa.cpp:105:38:105:38 | a[0..?)<unknown> | ssa.cpp:105:38:105:38 | a[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:105:38:105:38 | a[0..?)<unknown> | ssa.cpp:105:38:105:38 | a[4..8)<int> | MayPartiallyOverlap |
-| ssa.cpp:105:38:105:38 | a[4..8)<int> | ssa.cpp:105:38:105:38 | ?a[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:105:38:105:38 | a[4..8)<int> | ssa.cpp:105:38:105:38 | a | MayPartiallyOverlap |
-| ssa.cpp:105:38:105:38 | a[4..8)<int> | ssa.cpp:105:38:105:38 | a[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:105:38:105:38 | a[4..8)<int> | ssa.cpp:105:38:105:38 | a[4..8)<int> | MustExactlyOverlap |
-| ssa.cpp:112:9:112:9 | a | ssa.cpp:112:9:112:9 | a | MustExactlyOverlap |
-| ssa.cpp:112:9:112:9 | a | ssa.cpp:112:9:112:9 | a[0..4)<int> | MustTotallyOverlap |
-| ssa.cpp:112:9:112:9 | a | ssa.cpp:112:9:112:9 | a[4..8)<int> | MustTotallyOverlap |
-| ssa.cpp:112:9:112:9 | a[0..4)<int> | ssa.cpp:112:9:112:9 | a | MayPartiallyOverlap |
-| ssa.cpp:112:9:112:9 | a[0..4)<int> | ssa.cpp:112:9:112:9 | a[0..4)<int> | MustExactlyOverlap |
-| ssa.cpp:112:9:112:9 | a[4..8)<int> | ssa.cpp:112:9:112:9 | a | MayPartiallyOverlap |
-| ssa.cpp:112:9:112:9 | a[4..8)<int> | ssa.cpp:112:9:112:9 | a[4..8)<int> | MustExactlyOverlap |
-| ssa.cpp:117:9:117:9 | ?a[0..?)<unknown> | ssa.cpp:117:9:117:9 | ?a[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:117:9:117:9 | ?a[0..?)<unknown> | ssa.cpp:117:9:117:9 | a | MayPartiallyOverlap |
-| ssa.cpp:117:9:117:9 | ?a[0..?)<unknown> | ssa.cpp:117:9:117:9 | a[0..4)<int> | MayPartiallyOverlap |
-| ssa.cpp:117:9:117:9 | ?a[0..?)<unknown> | ssa.cpp:117:9:117:9 | a[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:117:9:117:9 | ?a[0..?)<unknown> | ssa.cpp:117:9:117:9 | a[4..8)<int> | MayPartiallyOverlap |
-| ssa.cpp:117:9:117:9 | a | ssa.cpp:117:9:117:9 | ?a[0..?)<unknown> | MustTotallyOverlap |
-| ssa.cpp:117:9:117:9 | a | ssa.cpp:117:9:117:9 | a | MustExactlyOverlap |
-| ssa.cpp:117:9:117:9 | a | ssa.cpp:117:9:117:9 | a[0..4)<int> | MustTotallyOverlap |
-| ssa.cpp:117:9:117:9 | a | ssa.cpp:117:9:117:9 | a[0..?)<unknown> | MustTotallyOverlap |
-| ssa.cpp:117:9:117:9 | a | ssa.cpp:117:9:117:9 | a[4..8)<int> | MustTotallyOverlap |
-| ssa.cpp:117:9:117:9 | a[0..4)<int> | ssa.cpp:117:9:117:9 | ?a[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:117:9:117:9 | a[0..4)<int> | ssa.cpp:117:9:117:9 | a | MayPartiallyOverlap |
-| ssa.cpp:117:9:117:9 | a[0..4)<int> | ssa.cpp:117:9:117:9 | a[0..4)<int> | MustExactlyOverlap |
-| ssa.cpp:117:9:117:9 | a[0..4)<int> | ssa.cpp:117:9:117:9 | a[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:117:9:117:9 | a[0..?)<unknown> | ssa.cpp:117:9:117:9 | ?a[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:117:9:117:9 | a[0..?)<unknown> | ssa.cpp:117:9:117:9 | a | MayPartiallyOverlap |
-| ssa.cpp:117:9:117:9 | a[0..?)<unknown> | ssa.cpp:117:9:117:9 | a[0..4)<int> | MayPartiallyOverlap |
-| ssa.cpp:117:9:117:9 | a[0..?)<unknown> | ssa.cpp:117:9:117:9 | a[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:117:9:117:9 | a[0..?)<unknown> | ssa.cpp:117:9:117:9 | a[4..8)<int> | MayPartiallyOverlap |
-| ssa.cpp:117:9:117:9 | a[4..8)<int> | ssa.cpp:117:9:117:9 | ?a[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:117:9:117:9 | a[4..8)<int> | ssa.cpp:117:9:117:9 | a | MayPartiallyOverlap |
-| ssa.cpp:117:9:117:9 | a[4..8)<int> | ssa.cpp:117:9:117:9 | a[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:117:9:117:9 | a[4..8)<int> | ssa.cpp:117:9:117:9 | a[4..8)<int> | MustExactlyOverlap |
-| ssa.cpp:123:9:123:9 | a | ssa.cpp:123:9:123:9 | a | MustExactlyOverlap |
-| ssa.cpp:123:9:123:9 | a | ssa.cpp:123:9:123:9 | a[0..4)<int> | MustTotallyOverlap |
-| ssa.cpp:123:9:123:9 | a | ssa.cpp:123:9:123:9 | a[4..8)<int> | MustTotallyOverlap |
-| ssa.cpp:123:9:123:9 | a[0..4)<int> | ssa.cpp:123:9:123:9 | a | MayPartiallyOverlap |
-| ssa.cpp:123:9:123:9 | a[0..4)<int> | ssa.cpp:123:9:123:9 | a[0..4)<int> | MustExactlyOverlap |
-| ssa.cpp:123:9:123:9 | a[4..8)<int> | ssa.cpp:123:9:123:9 | a | MayPartiallyOverlap |
-| ssa.cpp:123:9:123:9 | a[4..8)<int> | ssa.cpp:123:9:123:9 | a[4..8)<int> | MustExactlyOverlap |
-| ssa.cpp:135:9:135:9 | a | ssa.cpp:135:9:135:9 | a | MustExactlyOverlap |
-| ssa.cpp:135:9:135:9 | a | ssa.cpp:135:9:135:9 | a[0..4)<int> | MustTotallyOverlap |
-| ssa.cpp:135:9:135:9 | a | ssa.cpp:135:9:135:9 | a[4..8)<int> | MustTotallyOverlap |
-| ssa.cpp:135:9:135:9 | a[0..4)<int> | ssa.cpp:135:9:135:9 | a | MayPartiallyOverlap |
-| ssa.cpp:135:9:135:9 | a[0..4)<int> | ssa.cpp:135:9:135:9 | a[0..4)<int> | MustExactlyOverlap |
-| ssa.cpp:135:9:135:9 | a[4..8)<int> | ssa.cpp:135:9:135:9 | a | MayPartiallyOverlap |
-| ssa.cpp:135:9:135:9 | a[4..8)<int> | ssa.cpp:135:9:135:9 | a[4..8)<int> | MustExactlyOverlap |
-| ssa.cpp:146:9:146:9 | a | ssa.cpp:146:9:146:9 | a | MustExactlyOverlap |
-| ssa.cpp:146:9:146:9 | a | ssa.cpp:146:9:146:9 | a[0..4)<int> | MustTotallyOverlap |
-| ssa.cpp:146:9:146:9 | a | ssa.cpp:146:9:146:9 | a[4..8)<int> | MustTotallyOverlap |
-| ssa.cpp:146:9:146:9 | a[0..4)<int> | ssa.cpp:146:9:146:9 | a | MayPartiallyOverlap |
-| ssa.cpp:146:9:146:9 | a[0..4)<int> | ssa.cpp:146:9:146:9 | a[0..4)<int> | MustExactlyOverlap |
-| ssa.cpp:146:9:146:9 | a[4..8)<int> | ssa.cpp:146:9:146:9 | a | MayPartiallyOverlap |
-| ssa.cpp:146:9:146:9 | a[4..8)<int> | ssa.cpp:146:9:146:9 | a[4..8)<int> | MustExactlyOverlap |
-| ssa.cpp:157:8:157:8 | a | ssa.cpp:157:8:157:8 | a | MustExactlyOverlap |
-| ssa.cpp:157:8:157:8 | a | ssa.cpp:157:8:157:8 | a[0..4)<int> | MustTotallyOverlap |
-| ssa.cpp:157:8:157:8 | a | ssa.cpp:157:8:157:8 | a[0..8)<Point> | MustTotallyOverlap |
-| ssa.cpp:157:8:157:8 | a | ssa.cpp:157:8:157:8 | a[8..16)<Point> | MustTotallyOverlap |
-| ssa.cpp:157:8:157:8 | a[0..4)<int> | ssa.cpp:157:8:157:8 | a | MayPartiallyOverlap |
-| ssa.cpp:157:8:157:8 | a[0..4)<int> | ssa.cpp:157:8:157:8 | a[0..4)<int> | MustExactlyOverlap |
-| ssa.cpp:157:8:157:8 | a[0..4)<int> | ssa.cpp:157:8:157:8 | a[0..8)<Point> | MayPartiallyOverlap |
-| ssa.cpp:157:8:157:8 | a[0..8)<Point> | ssa.cpp:157:8:157:8 | a | MayPartiallyOverlap |
-| ssa.cpp:157:8:157:8 | a[0..8)<Point> | ssa.cpp:157:8:157:8 | a[0..4)<int> | MustTotallyOverlap |
-| ssa.cpp:157:8:157:8 | a[0..8)<Point> | ssa.cpp:157:8:157:8 | a[0..8)<Point> | MustExactlyOverlap |
-| ssa.cpp:157:8:157:8 | a[8..16)<Point> | ssa.cpp:157:8:157:8 | a | MayPartiallyOverlap |
-| ssa.cpp:157:8:157:8 | a[8..16)<Point> | ssa.cpp:157:8:157:8 | a[8..16)<Point> | MustExactlyOverlap |
-| ssa.cpp:171:28:171:28 | w | ssa.cpp:171:28:171:28 | w | MustExactlyOverlap |
-| ssa.cpp:171:28:171:28 | w | ssa.cpp:171:28:171:28 | w<int> | MustTotallyOverlap |
-| ssa.cpp:171:28:171:28 | w<int> | ssa.cpp:171:28:171:28 | w | MustTotallyOverlap |
-| ssa.cpp:171:28:171:28 | w<int> | ssa.cpp:171:28:171:28 | w<int> | MustExactlyOverlap |
-| ssa.cpp:179:18:179:18 | *p | ssa.cpp:179:18:179:18 | *p | MustExactlyOverlap |
-| ssa.cpp:179:18:179:18 | *p | ssa.cpp:179:18:179:18 | *p[0..4)<int> | MustTotallyOverlap |
-| ssa.cpp:179:18:179:18 | *p | ssa.cpp:179:18:179:18 | ?*p | MustTotallyOverlap |
-| ssa.cpp:179:18:179:18 | *p[0..4)<int> | ssa.cpp:179:18:179:18 | *p | MayPartiallyOverlap |
-| ssa.cpp:179:18:179:18 | *p[0..4)<int> | ssa.cpp:179:18:179:18 | *p[0..4)<int> | MustExactlyOverlap |
-| ssa.cpp:179:18:179:18 | *p[0..4)<int> | ssa.cpp:179:18:179:18 | ?*p | MayPartiallyOverlap |
-| ssa.cpp:179:18:179:18 | ?*p | ssa.cpp:179:18:179:18 | *p | MayPartiallyOverlap |
-| ssa.cpp:179:18:179:18 | ?*p | ssa.cpp:179:18:179:18 | *p[0..4)<int> | MayPartiallyOverlap |
-| ssa.cpp:179:18:179:18 | ?*p | ssa.cpp:179:18:179:18 | ?*p | MayPartiallyOverlap |
-| ssa.cpp:184:46:184:46 | *a | ssa.cpp:184:46:184:46 | *a | MustExactlyOverlap |
-| ssa.cpp:184:46:184:46 | *a | ssa.cpp:184:46:184:46 | ?*a | MustTotallyOverlap |
-| ssa.cpp:184:46:184:46 | ?*a | ssa.cpp:184:46:184:46 | *a | MayPartiallyOverlap |
-| ssa.cpp:184:46:184:46 | ?*a | ssa.cpp:184:46:184:46 | ?*a | MayPartiallyOverlap |
-| ssa.cpp:184:63:184:63 | *b | ssa.cpp:184:63:184:63 | *b | MustExactlyOverlap |
-| ssa.cpp:184:63:184:63 | *b | ssa.cpp:184:63:184:63 | ?*b | MustTotallyOverlap |
-| ssa.cpp:184:63:184:63 | ?*b | ssa.cpp:184:63:184:63 | *b | MayPartiallyOverlap |
-| ssa.cpp:184:63:184:63 | ?*b | ssa.cpp:184:63:184:63 | ?*b | MayPartiallyOverlap |
-| ssa.cpp:184:80:184:80 | *c | ssa.cpp:184:80:184:80 | *c | MustExactlyOverlap |
-| ssa.cpp:184:80:184:80 | *c | ssa.cpp:184:80:184:80 | *c[0..4)<unsigned int> | MustTotallyOverlap |
-| ssa.cpp:184:80:184:80 | *c | ssa.cpp:184:80:184:80 | ?*c | MustTotallyOverlap |
-| ssa.cpp:184:80:184:80 | *c[0..4)<unsigned int> | ssa.cpp:184:80:184:80 | *c | MayPartiallyOverlap |
-| ssa.cpp:184:80:184:80 | *c[0..4)<unsigned int> | ssa.cpp:184:80:184:80 | *c[0..4)<unsigned int> | MustExactlyOverlap |
-| ssa.cpp:184:80:184:80 | *c[0..4)<unsigned int> | ssa.cpp:184:80:184:80 | ?*c | MayPartiallyOverlap |
-| ssa.cpp:184:80:184:80 | ?*c | ssa.cpp:184:80:184:80 | *c | MayPartiallyOverlap |
-| ssa.cpp:184:80:184:80 | ?*c | ssa.cpp:184:80:184:80 | *c[0..4)<unsigned int> | MayPartiallyOverlap |
-| ssa.cpp:184:80:184:80 | ?*c | ssa.cpp:184:80:184:80 | ?*c | MayPartiallyOverlap |
-| ssa.cpp:184:97:184:97 | *d | ssa.cpp:184:97:184:97 | *d | MustExactlyOverlap |
-| ssa.cpp:184:97:184:97 | *d | ssa.cpp:184:97:184:97 | *d[0..4)<unsigned int> | MustTotallyOverlap |
-| ssa.cpp:184:97:184:97 | *d | ssa.cpp:184:97:184:97 | ?*d | MustTotallyOverlap |
-| ssa.cpp:184:97:184:97 | *d[0..4)<unsigned int> | ssa.cpp:184:97:184:97 | *d | MayPartiallyOverlap |
-| ssa.cpp:184:97:184:97 | *d[0..4)<unsigned int> | ssa.cpp:184:97:184:97 | *d[0..4)<unsigned int> | MustExactlyOverlap |
-| ssa.cpp:184:97:184:97 | *d[0..4)<unsigned int> | ssa.cpp:184:97:184:97 | ?*d | MayPartiallyOverlap |
-| ssa.cpp:184:97:184:97 | ?*d | ssa.cpp:184:97:184:97 | *d | MayPartiallyOverlap |
-| ssa.cpp:184:97:184:97 | ?*d | ssa.cpp:184:97:184:97 | *d[0..4)<unsigned int> | MayPartiallyOverlap |
-| ssa.cpp:184:97:184:97 | ?*d | ssa.cpp:184:97:184:97 | ?*d | MayPartiallyOverlap |
-| ssa.cpp:198:25:198:28 | *str1 | ssa.cpp:198:25:198:28 | *str1 | MustExactlyOverlap |
-| ssa.cpp:198:25:198:28 | *str1 | ssa.cpp:198:25:198:28 | *str1[0..?)<unknown> | MustTotallyOverlap |
-| ssa.cpp:198:25:198:28 | *str1 | ssa.cpp:198:25:198:28 | ?*str1 | MustTotallyOverlap |
-| ssa.cpp:198:25:198:28 | *str1[0..?)<unknown> | ssa.cpp:198:25:198:28 | *str1 | MayPartiallyOverlap |
-| ssa.cpp:198:25:198:28 | *str1[0..?)<unknown> | ssa.cpp:198:25:198:28 | *str1[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:198:25:198:28 | *str1[0..?)<unknown> | ssa.cpp:198:25:198:28 | ?*str1 | MayPartiallyOverlap |
-| ssa.cpp:198:25:198:28 | ?*str1 | ssa.cpp:198:25:198:28 | *str1 | MayPartiallyOverlap |
-| ssa.cpp:198:25:198:28 | ?*str1 | ssa.cpp:198:25:198:28 | *str1[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:198:25:198:28 | ?*str1 | ssa.cpp:198:25:198:28 | ?*str1 | MayPartiallyOverlap |
-| ssa.cpp:198:37:198:40 | *str2 | ssa.cpp:198:37:198:40 | *str2 | MustExactlyOverlap |
-| ssa.cpp:198:37:198:40 | *str2 | ssa.cpp:198:37:198:40 | *str2[0..?)<unknown> | MustTotallyOverlap |
-| ssa.cpp:198:37:198:40 | *str2 | ssa.cpp:198:37:198:40 | ?*str2 | MustTotallyOverlap |
-| ssa.cpp:198:37:198:40 | *str2[0..?)<unknown> | ssa.cpp:198:37:198:40 | *str2 | MayPartiallyOverlap |
-| ssa.cpp:198:37:198:40 | *str2[0..?)<unknown> | ssa.cpp:198:37:198:40 | *str2[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:198:37:198:40 | *str2[0..?)<unknown> | ssa.cpp:198:37:198:40 | ?*str2 | MayPartiallyOverlap |
-| ssa.cpp:198:37:198:40 | ?*str2 | ssa.cpp:198:37:198:40 | *str2 | MayPartiallyOverlap |
-| ssa.cpp:198:37:198:40 | ?*str2 | ssa.cpp:198:37:198:40 | *str2[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:198:37:198:40 | ?*str2 | ssa.cpp:198:37:198:40 | ?*str2 | MayPartiallyOverlap |
-| ssa.cpp:207:27:207:27 | x | ssa.cpp:207:27:207:27 | x | MustExactlyOverlap |
-| ssa.cpp:207:27:207:27 | x | ssa.cpp:207:27:207:27 | x[0..?)<unknown> | MustTotallyOverlap |
-| ssa.cpp:207:27:207:27 | x[0..?)<unknown> | ssa.cpp:207:27:207:27 | x | MayPartiallyOverlap |
-| ssa.cpp:207:27:207:27 | x[0..?)<unknown> | ssa.cpp:207:27:207:27 | x[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:208:7:208:7 | y | ssa.cpp:208:7:208:7 | y | MustExactlyOverlap |
-| ssa.cpp:208:7:208:7 | y | ssa.cpp:208:7:208:7 | y[0..?)<unknown> | MustTotallyOverlap |
-| ssa.cpp:208:7:208:7 | y[0..?)<unknown> | ssa.cpp:208:7:208:7 | y | MayPartiallyOverlap |
-| ssa.cpp:208:7:208:7 | y[0..?)<unknown> | ssa.cpp:208:7:208:7 | y[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:218:10:218:10 | c | ssa.cpp:218:10:218:10 | c | MustExactlyOverlap |
-| ssa.cpp:218:10:218:10 | c | ssa.cpp:218:10:218:10 | c<unknown[2]> | MustTotallyOverlap |
-| ssa.cpp:218:10:218:10 | c<unknown[2]> | ssa.cpp:218:10:218:10 | c | MustTotallyOverlap |
-| ssa.cpp:218:10:218:10 | c<unknown[2]> | ssa.cpp:218:10:218:10 | c<unknown[2]> | MustExactlyOverlap |
-| ssa.cpp:219:10:219:10 | d | ssa.cpp:219:10:219:10 | d | MustExactlyOverlap |
-| ssa.cpp:219:10:219:10 | d | ssa.cpp:219:10:219:10 | d[0..1)<char> | MustTotallyOverlap |
-| ssa.cpp:219:10:219:10 | d | ssa.cpp:219:10:219:10 | d[1..2)<char> | MustTotallyOverlap |
-| ssa.cpp:219:10:219:10 | d[0..1)<char> | ssa.cpp:219:10:219:10 | d | MayPartiallyOverlap |
-| ssa.cpp:219:10:219:10 | d[0..1)<char> | ssa.cpp:219:10:219:10 | d[0..1)<char> | MustExactlyOverlap |
-| ssa.cpp:219:10:219:10 | d[1..2)<char> | ssa.cpp:219:10:219:10 | d | MayPartiallyOverlap |
-| ssa.cpp:219:10:219:10 | d[1..2)<char> | ssa.cpp:219:10:219:10 | d[1..2)<char> | MustExactlyOverlap |
-| ssa.cpp:220:10:220:10 | e | ssa.cpp:220:10:220:10 | e | MustExactlyOverlap |
-| ssa.cpp:220:10:220:10 | e | ssa.cpp:220:10:220:10 | e[0..1)<char> | MustTotallyOverlap |
-| ssa.cpp:220:10:220:10 | e | ssa.cpp:220:10:220:10 | e[1..2)<char> | MustTotallyOverlap |
-| ssa.cpp:220:10:220:10 | e[0..1)<char> | ssa.cpp:220:10:220:10 | e | MayPartiallyOverlap |
-| ssa.cpp:220:10:220:10 | e[0..1)<char> | ssa.cpp:220:10:220:10 | e[0..1)<char> | MustExactlyOverlap |
-| ssa.cpp:220:10:220:10 | e[1..2)<char> | ssa.cpp:220:10:220:10 | e | MayPartiallyOverlap |
-| ssa.cpp:220:10:220:10 | e[1..2)<char> | ssa.cpp:220:10:220:10 | e[1..2)<char> | MustExactlyOverlap |
-| ssa.cpp:221:10:221:10 | f | ssa.cpp:221:10:221:10 | f | MustExactlyOverlap |
-| ssa.cpp:221:10:221:10 | f | ssa.cpp:221:10:221:10 | f[0..1)<char> | MustTotallyOverlap |
-| ssa.cpp:221:10:221:10 | f | ssa.cpp:221:10:221:10 | f[1..3)<unknown[2]> | MustTotallyOverlap |
-| ssa.cpp:221:10:221:10 | f[0..1)<char> | ssa.cpp:221:10:221:10 | f | MayPartiallyOverlap |
-| ssa.cpp:221:10:221:10 | f[0..1)<char> | ssa.cpp:221:10:221:10 | f[0..1)<char> | MustExactlyOverlap |
-| ssa.cpp:221:10:221:10 | f[1..3)<unknown[2]> | ssa.cpp:221:10:221:10 | f | MayPartiallyOverlap |
-| ssa.cpp:221:10:221:10 | f[1..3)<unknown[2]> | ssa.cpp:221:10:221:10 | f[1..3)<unknown[2]> | MustExactlyOverlap |
-| ssa.cpp:235:5:235:17 | *#this | ssa.cpp:235:5:235:17 | *#this | MustExactlyOverlap |
-| ssa.cpp:235:5:235:17 | *#this | ssa.cpp:235:5:235:17 | ?*#this | MustTotallyOverlap |
-| ssa.cpp:235:5:235:17 | ?*#this | ssa.cpp:235:5:235:17 | *#this | MayPartiallyOverlap |
-| ssa.cpp:235:5:235:17 | ?*#this | ssa.cpp:235:5:235:17 | ?*#this | MayPartiallyOverlap |
-| ssa.cpp:236:10:236:10 | *#this | ssa.cpp:236:10:236:10 | *#this | MustExactlyOverlap |
-| ssa.cpp:236:10:236:10 | *#this | ssa.cpp:236:10:236:10 | ?*#this | MustTotallyOverlap |
-| ssa.cpp:236:10:236:10 | ?*#this | ssa.cpp:236:10:236:10 | *#this | MayPartiallyOverlap |
-| ssa.cpp:236:10:236:10 | ?*#this | ssa.cpp:236:10:236:10 | ?*#this | MayPartiallyOverlap |
-| ssa.cpp:240:17:240:17 | ?c | ssa.cpp:240:17:240:17 | ?c | MayPartiallyOverlap |
-| ssa.cpp:240:17:240:17 | ?c | ssa.cpp:240:17:240:17 | c | MayPartiallyOverlap |
-| ssa.cpp:240:17:240:17 | c | ssa.cpp:240:17:240:17 | ?c | MustTotallyOverlap |
-| ssa.cpp:240:17:240:17 | c | ssa.cpp:240:17:240:17 | c | MustExactlyOverlap |
-| ssa.cpp:243:17:243:18 | ?c2 | ssa.cpp:243:17:243:18 | ?c2 | MayPartiallyOverlap |
-| ssa.cpp:243:17:243:18 | ?c2 | ssa.cpp:243:17:243:18 | c2 | MayPartiallyOverlap |
-| ssa.cpp:243:17:243:18 | c2 | ssa.cpp:243:17:243:18 | ?c2 | MustTotallyOverlap |
-| ssa.cpp:243:17:243:18 | c2 | ssa.cpp:243:17:243:18 | c2 | MustExactlyOverlap |
-| ssa.cpp:247:40:247:42 | *src | ssa.cpp:247:40:247:42 | *src | MustExactlyOverlap |
-| ssa.cpp:247:40:247:42 | *src | ssa.cpp:247:40:247:42 | *src[0..1)<char> | MustTotallyOverlap |
-| ssa.cpp:247:40:247:42 | *src | ssa.cpp:247:40:247:42 | *src[0..?)<unknown> | MustTotallyOverlap |
-| ssa.cpp:247:40:247:42 | *src | ssa.cpp:247:40:247:42 | ?*src | MustTotallyOverlap |
-| ssa.cpp:247:40:247:42 | *src[0..1)<char> | ssa.cpp:247:40:247:42 | *src | MayPartiallyOverlap |
-| ssa.cpp:247:40:247:42 | *src[0..1)<char> | ssa.cpp:247:40:247:42 | *src[0..1)<char> | MustExactlyOverlap |
-| ssa.cpp:247:40:247:42 | *src[0..1)<char> | ssa.cpp:247:40:247:42 | *src[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:247:40:247:42 | *src[0..1)<char> | ssa.cpp:247:40:247:42 | ?*src | MayPartiallyOverlap |
-| ssa.cpp:247:40:247:42 | *src[0..?)<unknown> | ssa.cpp:247:40:247:42 | *src | MayPartiallyOverlap |
-| ssa.cpp:247:40:247:42 | *src[0..?)<unknown> | ssa.cpp:247:40:247:42 | *src[0..1)<char> | MayPartiallyOverlap |
-| ssa.cpp:247:40:247:42 | *src[0..?)<unknown> | ssa.cpp:247:40:247:42 | *src[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:247:40:247:42 | *src[0..?)<unknown> | ssa.cpp:247:40:247:42 | ?*src | MayPartiallyOverlap |
-| ssa.cpp:247:40:247:42 | ?*src | ssa.cpp:247:40:247:42 | *src | MayPartiallyOverlap |
-| ssa.cpp:247:40:247:42 | ?*src | ssa.cpp:247:40:247:42 | *src[0..1)<char> | MayPartiallyOverlap |
-| ssa.cpp:247:40:247:42 | ?*src | ssa.cpp:247:40:247:42 | *src[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:247:40:247:42 | ?*src | ssa.cpp:247:40:247:42 | ?*src | MayPartiallyOverlap |
-| ssa.cpp:248:15:248:28 | ?dynamic{1} | ssa.cpp:248:15:248:28 | ?dynamic{1} | MayPartiallyOverlap |
-| ssa.cpp:248:15:248:28 | ?dynamic{1} | ssa.cpp:248:15:248:28 | dynamic{1} | MayPartiallyOverlap |
-| ssa.cpp:248:15:248:28 | ?dynamic{1} | ssa.cpp:248:15:248:28 | dynamic{1}[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:248:15:248:28 | dynamic{1} | ssa.cpp:248:15:248:28 | ?dynamic{1} | MustTotallyOverlap |
-| ssa.cpp:248:15:248:28 | dynamic{1} | ssa.cpp:248:15:248:28 | dynamic{1} | MustExactlyOverlap |
-| ssa.cpp:248:15:248:28 | dynamic{1} | ssa.cpp:248:15:248:28 | dynamic{1}[0..?)<unknown> | MustTotallyOverlap |
-| ssa.cpp:248:15:248:28 | dynamic{1}[0..?)<unknown> | ssa.cpp:248:15:248:28 | ?dynamic{1} | MayPartiallyOverlap |
-| ssa.cpp:248:15:248:28 | dynamic{1}[0..?)<unknown> | ssa.cpp:248:15:248:28 | dynamic{1} | MayPartiallyOverlap |
-| ssa.cpp:248:15:248:28 | dynamic{1}[0..?)<unknown> | ssa.cpp:248:15:248:28 | dynamic{1}[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:268:28:268:28 | *s | ssa.cpp:268:28:268:28 | *s | MustExactlyOverlap |
-| ssa.cpp:268:28:268:28 | *s | ssa.cpp:268:28:268:28 | *s[0..?)<unknown> | MustTotallyOverlap |
-| ssa.cpp:268:28:268:28 | *s | ssa.cpp:268:28:268:28 | ?*s | MustTotallyOverlap |
-| ssa.cpp:268:28:268:28 | *s[0..?)<unknown> | ssa.cpp:268:28:268:28 | *s | MayPartiallyOverlap |
-| ssa.cpp:268:28:268:28 | *s[0..?)<unknown> | ssa.cpp:268:28:268:28 | *s[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:268:28:268:28 | *s[0..?)<unknown> | ssa.cpp:268:28:268:28 | ?*s | MayPartiallyOverlap |
-| ssa.cpp:268:28:268:28 | ?*s | ssa.cpp:268:28:268:28 | *s | MayPartiallyOverlap |
-| ssa.cpp:268:28:268:28 | ?*s | ssa.cpp:268:28:268:28 | *s[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:268:28:268:28 | ?*s | ssa.cpp:268:28:268:28 | ?*s | MayPartiallyOverlap |
-| ssa.cpp:269:15:269:20 | ?dynamic{1} | ssa.cpp:269:15:269:20 | ?dynamic{1} | MayPartiallyOverlap |
-| ssa.cpp:269:15:269:20 | ?dynamic{1} | ssa.cpp:269:15:269:20 | dynamic{1} | MayPartiallyOverlap |
-| ssa.cpp:269:15:269:20 | ?dynamic{1} | ssa.cpp:269:15:269:20 | dynamic{1}[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:269:15:269:20 | dynamic{1} | ssa.cpp:269:15:269:20 | ?dynamic{1} | MustTotallyOverlap |
-| ssa.cpp:269:15:269:20 | dynamic{1} | ssa.cpp:269:15:269:20 | dynamic{1} | MustExactlyOverlap |
-| ssa.cpp:269:15:269:20 | dynamic{1} | ssa.cpp:269:15:269:20 | dynamic{1}[0..?)<unknown> | MustTotallyOverlap |
-| ssa.cpp:269:15:269:20 | dynamic{1}[0..?)<unknown> | ssa.cpp:269:15:269:20 | ?dynamic{1} | MayPartiallyOverlap |
-| ssa.cpp:269:15:269:20 | dynamic{1}[0..?)<unknown> | ssa.cpp:269:15:269:20 | dynamic{1} | MayPartiallyOverlap |
-| ssa.cpp:269:15:269:20 | dynamic{1}[0..?)<unknown> | ssa.cpp:269:15:269:20 | dynamic{1}[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:274:8:274:9 | pp | ssa.cpp:274:8:274:9 | pp | MustExactlyOverlap |
-| ssa.cpp:276:9:276:9 | a | ssa.cpp:276:9:276:9 | a | MustExactlyOverlap |
-| ssa.cpp:276:9:276:9 | a | ssa.cpp:276:9:276:9 | a[0..4)<int> | MustTotallyOverlap |
-| ssa.cpp:276:9:276:9 | a | ssa.cpp:276:9:276:9 | a[4..8)<int> | MustTotallyOverlap |
-| ssa.cpp:276:9:276:9 | a[0..4)<int> | ssa.cpp:276:9:276:9 | a | MayPartiallyOverlap |
-| ssa.cpp:276:9:276:9 | a[0..4)<int> | ssa.cpp:276:9:276:9 | a[0..4)<int> | MustExactlyOverlap |
-| ssa.cpp:276:9:276:9 | a[4..8)<int> | ssa.cpp:276:9:276:9 | a | MayPartiallyOverlap |
-| ssa.cpp:276:9:276:9 | a[4..8)<int> | ssa.cpp:276:9:276:9 | a[4..8)<int> | MustExactlyOverlap |
-| ssa.cpp:286:3:286:3 | *#this | ssa.cpp:286:3:286:3 | *#this | MustExactlyOverlap |
-| ssa.cpp:286:3:286:3 | *#this | ssa.cpp:286:3:286:3 | ?*#this | MustTotallyOverlap |
-| ssa.cpp:286:3:286:3 | ?*#this | ssa.cpp:286:3:286:3 | *#this | MayPartiallyOverlap |
-| ssa.cpp:286:3:286:3 | ?*#this | ssa.cpp:286:3:286:3 | ?*#this | MayPartiallyOverlap |
-| ssa.cpp:287:3:287:3 | *#this | ssa.cpp:287:3:287:3 | *#this | MustExactlyOverlap |
-| ssa.cpp:287:3:287:3 | *#this | ssa.cpp:287:3:287:3 | ?*#this | MustTotallyOverlap |
-| ssa.cpp:287:3:287:3 | ?*#this | ssa.cpp:287:3:287:3 | *#this | MayPartiallyOverlap |
-| ssa.cpp:287:3:287:3 | ?*#this | ssa.cpp:287:3:287:3 | ?*#this | MayPartiallyOverlap |
-| ssa.cpp:287:5:287:5 | *(unnamed parameter 0) | ssa.cpp:287:5:287:5 | *(unnamed parameter 0) | MustExactlyOverlap |
-| ssa.cpp:287:5:287:5 | *(unnamed parameter 0) | ssa.cpp:287:5:287:5 | ?*(unnamed parameter 0) | MustTotallyOverlap |
-| ssa.cpp:287:5:287:5 | ?*(unnamed parameter 0) | ssa.cpp:287:5:287:5 | *(unnamed parameter 0) | MayPartiallyOverlap |
-| ssa.cpp:287:5:287:5 | ?*(unnamed parameter 0) | ssa.cpp:287:5:287:5 | ?*(unnamed parameter 0) | MayPartiallyOverlap |
-| ssa.cpp:288:3:288:3 | *#this | ssa.cpp:288:3:288:3 | *#this | MustExactlyOverlap |
-| ssa.cpp:288:3:288:3 | *#this | ssa.cpp:288:3:288:3 | ?*#this | MustTotallyOverlap |
-| ssa.cpp:288:3:288:3 | ?*#this | ssa.cpp:288:3:288:3 | *#this | MayPartiallyOverlap |
-| ssa.cpp:288:3:288:3 | ?*#this | ssa.cpp:288:3:288:3 | ?*#this | MayPartiallyOverlap |
-| ssa.cpp:292:14:292:22 | ?dynamic{1} | ssa.cpp:292:14:292:22 | ?dynamic{1} | MayPartiallyOverlap |
-| ssa.cpp:292:14:292:22 | ?dynamic{1} | ssa.cpp:292:14:292:22 | dynamic{1} | MayPartiallyOverlap |
-| ssa.cpp:292:14:292:22 | dynamic{1} | ssa.cpp:292:14:292:22 | ?dynamic{1} | MustTotallyOverlap |
-| ssa.cpp:292:14:292:22 | dynamic{1} | ssa.cpp:292:14:292:22 | dynamic{1} | MustExactlyOverlap |
-| ssa.cpp:293:14:293:22 | ?dynamic{2} | ssa.cpp:293:14:293:22 | ?dynamic{2} | MayPartiallyOverlap |
-| ssa.cpp:293:14:293:22 | ?dynamic{2} | ssa.cpp:293:14:293:22 | dynamic{2} | MayPartiallyOverlap |
-| ssa.cpp:293:14:293:22 | dynamic{2} | ssa.cpp:293:14:293:22 | ?dynamic{2} | MustTotallyOverlap |
-| ssa.cpp:293:14:293:22 | dynamic{2} | ssa.cpp:293:14:293:22 | dynamic{2} | MustExactlyOverlap |
-| ssa.cpp:294:12:294:26 | ?dynamic{3} | ssa.cpp:294:12:294:26 | ?dynamic{3} | MayPartiallyOverlap |
-| ssa.cpp:294:12:294:26 | ?dynamic{3} | ssa.cpp:294:12:294:26 | ?dynamic{3}[0..4)<A> | MayPartiallyOverlap |
-| ssa.cpp:294:12:294:26 | ?dynamic{3} | ssa.cpp:294:12:294:26 | dynamic{3} | MayPartiallyOverlap |
-| ssa.cpp:294:12:294:26 | ?dynamic{3} | ssa.cpp:294:12:294:26 | dynamic{3}[0..4)<int> | MayPartiallyOverlap |
-| ssa.cpp:294:12:294:26 | ?dynamic{3}[0..4)<A> | ssa.cpp:294:12:294:26 | ?dynamic{3} | MayPartiallyOverlap |
-| ssa.cpp:294:12:294:26 | ?dynamic{3}[0..4)<A> | ssa.cpp:294:12:294:26 | ?dynamic{3}[0..4)<A> | MayPartiallyOverlap |
-| ssa.cpp:294:12:294:26 | ?dynamic{3}[0..4)<A> | ssa.cpp:294:12:294:26 | dynamic{3} | MayPartiallyOverlap |
-| ssa.cpp:294:12:294:26 | ?dynamic{3}[0..4)<A> | ssa.cpp:294:12:294:26 | dynamic{3}[0..4)<int> | MayPartiallyOverlap |
-| ssa.cpp:294:12:294:26 | dynamic{3} | ssa.cpp:294:12:294:26 | ?dynamic{3} | MustTotallyOverlap |
-| ssa.cpp:294:12:294:26 | dynamic{3} | ssa.cpp:294:12:294:26 | ?dynamic{3}[0..4)<A> | MustTotallyOverlap |
-| ssa.cpp:294:12:294:26 | dynamic{3} | ssa.cpp:294:12:294:26 | dynamic{3} | MustExactlyOverlap |
-| ssa.cpp:294:12:294:26 | dynamic{3} | ssa.cpp:294:12:294:26 | dynamic{3}[0..4)<int> | MustTotallyOverlap |
-| ssa.cpp:294:12:294:26 | dynamic{3}[0..4)<int> | ssa.cpp:294:12:294:26 | ?dynamic{3} | MayPartiallyOverlap |
-| ssa.cpp:294:12:294:26 | dynamic{3}[0..4)<int> | ssa.cpp:294:12:294:26 | ?dynamic{3}[0..4)<A> | MustTotallyOverlap |
-| ssa.cpp:294:12:294:26 | dynamic{3}[0..4)<int> | ssa.cpp:294:12:294:26 | dynamic{3} | MayPartiallyOverlap |
-| ssa.cpp:294:12:294:26 | dynamic{3}[0..4)<int> | ssa.cpp:294:12:294:26 | dynamic{3}[0..4)<int> | MustExactlyOverlap |
-| ssa.cpp:294:18:294:25 | ?dynamic{3} | ssa.cpp:294:18:294:25 | ?dynamic{3} | MayPartiallyOverlap |
-| ssa.cpp:294:18:294:25 | ?dynamic{3} | ssa.cpp:294:18:294:25 | ?dynamic{3}[0..4)<A> | MayPartiallyOverlap |
-| ssa.cpp:294:18:294:25 | ?dynamic{3} | ssa.cpp:294:18:294:25 | ?dynamic{3}[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:294:18:294:25 | ?dynamic{3} | ssa.cpp:294:18:294:25 | dynamic{3} | MayPartiallyOverlap |
-| ssa.cpp:294:18:294:25 | ?dynamic{3} | ssa.cpp:294:18:294:25 | dynamic{3}[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:294:18:294:25 | ?dynamic{3}[0..4)<A> | ssa.cpp:294:18:294:25 | ?dynamic{3} | MayPartiallyOverlap |
-| ssa.cpp:294:18:294:25 | ?dynamic{3}[0..4)<A> | ssa.cpp:294:18:294:25 | ?dynamic{3}[0..4)<A> | MayPartiallyOverlap |
-| ssa.cpp:294:18:294:25 | ?dynamic{3}[0..4)<A> | ssa.cpp:294:18:294:25 | ?dynamic{3}[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:294:18:294:25 | ?dynamic{3}[0..4)<A> | ssa.cpp:294:18:294:25 | dynamic{3} | MayPartiallyOverlap |
-| ssa.cpp:294:18:294:25 | ?dynamic{3}[0..4)<A> | ssa.cpp:294:18:294:25 | dynamic{3}[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:294:18:294:25 | ?dynamic{3}[0..?)<unknown> | ssa.cpp:294:18:294:25 | ?dynamic{3} | MayPartiallyOverlap |
-| ssa.cpp:294:18:294:25 | ?dynamic{3}[0..?)<unknown> | ssa.cpp:294:18:294:25 | ?dynamic{3}[0..4)<A> | MayPartiallyOverlap |
-| ssa.cpp:294:18:294:25 | ?dynamic{3}[0..?)<unknown> | ssa.cpp:294:18:294:25 | ?dynamic{3}[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:294:18:294:25 | ?dynamic{3}[0..?)<unknown> | ssa.cpp:294:18:294:25 | dynamic{3} | MayPartiallyOverlap |
-| ssa.cpp:294:18:294:25 | ?dynamic{3}[0..?)<unknown> | ssa.cpp:294:18:294:25 | dynamic{3}[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:294:18:294:25 | dynamic{3} | ssa.cpp:294:18:294:25 | ?dynamic{3} | MustTotallyOverlap |
-| ssa.cpp:294:18:294:25 | dynamic{3} | ssa.cpp:294:18:294:25 | ?dynamic{3}[0..4)<A> | MustTotallyOverlap |
-| ssa.cpp:294:18:294:25 | dynamic{3} | ssa.cpp:294:18:294:25 | ?dynamic{3}[0..?)<unknown> | MustTotallyOverlap |
-| ssa.cpp:294:18:294:25 | dynamic{3} | ssa.cpp:294:18:294:25 | dynamic{3} | MustExactlyOverlap |
-| ssa.cpp:294:18:294:25 | dynamic{3} | ssa.cpp:294:18:294:25 | dynamic{3}[0..?)<unknown> | MustTotallyOverlap |
-| ssa.cpp:294:18:294:25 | dynamic{3}[0..?)<unknown> | ssa.cpp:294:18:294:25 | ?dynamic{3} | MayPartiallyOverlap |
-| ssa.cpp:294:18:294:25 | dynamic{3}[0..?)<unknown> | ssa.cpp:294:18:294:25 | ?dynamic{3}[0..4)<A> | MayPartiallyOverlap |
-| ssa.cpp:294:18:294:25 | dynamic{3}[0..?)<unknown> | ssa.cpp:294:18:294:25 | ?dynamic{3}[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:294:18:294:25 | dynamic{3}[0..?)<unknown> | ssa.cpp:294:18:294:25 | dynamic{3} | MayPartiallyOverlap |
-| ssa.cpp:294:18:294:25 | dynamic{3}[0..?)<unknown> | ssa.cpp:294:18:294:25 | dynamic{3}[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:295:10:295:14 | ?dynamic{5} | ssa.cpp:295:10:295:14 | ?dynamic{5} | MayPartiallyOverlap |
-| ssa.cpp:295:10:295:14 | ?dynamic{5} | ssa.cpp:295:10:295:14 | ?dynamic{5}[0..4)<A> | MayPartiallyOverlap |
-| ssa.cpp:295:10:295:14 | ?dynamic{5} | ssa.cpp:295:10:295:14 | dynamic{5} | MayPartiallyOverlap |
-| ssa.cpp:295:10:295:14 | ?dynamic{5}[0..4)<A> | ssa.cpp:295:10:295:14 | ?dynamic{5} | MayPartiallyOverlap |
-| ssa.cpp:295:10:295:14 | ?dynamic{5}[0..4)<A> | ssa.cpp:295:10:295:14 | ?dynamic{5}[0..4)<A> | MayPartiallyOverlap |
-| ssa.cpp:295:10:295:14 | ?dynamic{5}[0..4)<A> | ssa.cpp:295:10:295:14 | dynamic{5} | MayPartiallyOverlap |
-| ssa.cpp:295:10:295:14 | dynamic{5} | ssa.cpp:295:10:295:14 | ?dynamic{5} | MustTotallyOverlap |
-| ssa.cpp:295:10:295:14 | dynamic{5} | ssa.cpp:295:10:295:14 | ?dynamic{5}[0..4)<A> | MustTotallyOverlap |
-| ssa.cpp:295:10:295:14 | dynamic{5} | ssa.cpp:295:10:295:14 | dynamic{5} | MustExactlyOverlap |
-| ssa.cpp:301:27:301:30 | *argv | ssa.cpp:301:27:301:30 | *argv | MustExactlyOverlap |
-| ssa.cpp:301:27:301:30 | *argv | ssa.cpp:301:27:301:30 | *argv[0..8)<decltype(nullptr)> | MustTotallyOverlap |
-| ssa.cpp:301:27:301:30 | *argv | ssa.cpp:301:27:301:30 | *argv[0..?)<unknown> | MustTotallyOverlap |
-| ssa.cpp:301:27:301:30 | *argv | ssa.cpp:301:27:301:30 | ?*argv | MustTotallyOverlap |
-| ssa.cpp:301:27:301:30 | *argv | ssa.cpp:301:27:301:30 | ?*argv[0..?)<unknown> | MustTotallyOverlap |
-| ssa.cpp:301:27:301:30 | *argv[0..8)<decltype(nullptr)> | ssa.cpp:301:27:301:30 | *argv | MayPartiallyOverlap |
-| ssa.cpp:301:27:301:30 | *argv[0..8)<decltype(nullptr)> | ssa.cpp:301:27:301:30 | *argv[0..8)<decltype(nullptr)> | MustExactlyOverlap |
-| ssa.cpp:301:27:301:30 | *argv[0..8)<decltype(nullptr)> | ssa.cpp:301:27:301:30 | *argv[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:301:27:301:30 | *argv[0..8)<decltype(nullptr)> | ssa.cpp:301:27:301:30 | ?*argv | MayPartiallyOverlap |
-| ssa.cpp:301:27:301:30 | *argv[0..8)<decltype(nullptr)> | ssa.cpp:301:27:301:30 | ?*argv[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:301:27:301:30 | *argv[0..?)<unknown> | ssa.cpp:301:27:301:30 | *argv | MayPartiallyOverlap |
-| ssa.cpp:301:27:301:30 | *argv[0..?)<unknown> | ssa.cpp:301:27:301:30 | *argv[0..8)<decltype(nullptr)> | MayPartiallyOverlap |
-| ssa.cpp:301:27:301:30 | *argv[0..?)<unknown> | ssa.cpp:301:27:301:30 | *argv[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:301:27:301:30 | *argv[0..?)<unknown> | ssa.cpp:301:27:301:30 | ?*argv | MayPartiallyOverlap |
-| ssa.cpp:301:27:301:30 | *argv[0..?)<unknown> | ssa.cpp:301:27:301:30 | ?*argv[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:301:27:301:30 | ?*argv | ssa.cpp:301:27:301:30 | *argv | MayPartiallyOverlap |
-| ssa.cpp:301:27:301:30 | ?*argv | ssa.cpp:301:27:301:30 | *argv[0..8)<decltype(nullptr)> | MayPartiallyOverlap |
-| ssa.cpp:301:27:301:30 | ?*argv | ssa.cpp:301:27:301:30 | *argv[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:301:27:301:30 | ?*argv | ssa.cpp:301:27:301:30 | ?*argv | MayPartiallyOverlap |
-| ssa.cpp:301:27:301:30 | ?*argv | ssa.cpp:301:27:301:30 | ?*argv[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:301:27:301:30 | ?*argv[0..?)<unknown> | ssa.cpp:301:27:301:30 | *argv | MayPartiallyOverlap |
-| ssa.cpp:301:27:301:30 | ?*argv[0..?)<unknown> | ssa.cpp:301:27:301:30 | *argv[0..8)<decltype(nullptr)> | MayPartiallyOverlap |
-| ssa.cpp:301:27:301:30 | ?*argv[0..?)<unknown> | ssa.cpp:301:27:301:30 | *argv[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:301:27:301:30 | ?*argv[0..?)<unknown> | ssa.cpp:301:27:301:30 | ?*argv | MayPartiallyOverlap |
-| ssa.cpp:301:27:301:30 | ?*argv[0..?)<unknown> | ssa.cpp:301:27:301:30 | ?*argv[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:310:8:310:11 | *#this | ssa.cpp:310:8:310:11 | *#this | MustExactlyOverlap |
-| ssa.cpp:310:8:310:11 | *#this | ssa.cpp:310:8:310:11 | *#this[0..4)<int> | MustTotallyOverlap |
-| ssa.cpp:310:8:310:11 | *#this | ssa.cpp:310:8:310:11 | ?*#this | MustTotallyOverlap |
-| ssa.cpp:310:8:310:11 | *#this[0..4)<int> | ssa.cpp:310:8:310:11 | *#this | MayPartiallyOverlap |
-| ssa.cpp:310:8:310:11 | *#this[0..4)<int> | ssa.cpp:310:8:310:11 | *#this[0..4)<int> | MustExactlyOverlap |
-| ssa.cpp:310:8:310:11 | *#this[0..4)<int> | ssa.cpp:310:8:310:11 | ?*#this | MayPartiallyOverlap |
-| ssa.cpp:310:8:310:11 | ?*#this | ssa.cpp:310:8:310:11 | *#this | MayPartiallyOverlap |
-| ssa.cpp:310:8:310:11 | ?*#this | ssa.cpp:310:8:310:11 | *#this[0..4)<int> | MayPartiallyOverlap |
-| ssa.cpp:310:8:310:11 | ?*#this | ssa.cpp:310:8:310:11 | ?*#this | MayPartiallyOverlap |
-| ssa.cpp:319:37:319:37 | *s | ssa.cpp:319:37:319:37 | *s | MustExactlyOverlap |
-| ssa.cpp:319:37:319:37 | *s | ssa.cpp:319:37:319:37 | *s[0..?)<unknown> | MustTotallyOverlap |
-| ssa.cpp:319:37:319:37 | *s | ssa.cpp:319:37:319:37 | ?*s | MustTotallyOverlap |
-| ssa.cpp:319:37:319:37 | *s[0..?)<unknown> | ssa.cpp:319:37:319:37 | *s | MayPartiallyOverlap |
-| ssa.cpp:319:37:319:37 | *s[0..?)<unknown> | ssa.cpp:319:37:319:37 | *s[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:319:37:319:37 | *s[0..?)<unknown> | ssa.cpp:319:37:319:37 | ?*s | MayPartiallyOverlap |
-| ssa.cpp:319:37:319:37 | ?*s | ssa.cpp:319:37:319:37 | *s | MayPartiallyOverlap |
-| ssa.cpp:319:37:319:37 | ?*s | ssa.cpp:319:37:319:37 | *s[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:319:37:319:37 | ?*s | ssa.cpp:319:37:319:37 | ?*s | MayPartiallyOverlap |
-| ssa.cpp:321:7:321:12 | ?buffer[0..?)<unknown> | ssa.cpp:321:7:321:12 | ?buffer[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:321:7:321:12 | ?buffer[0..?)<unknown> | ssa.cpp:321:7:321:12 | buffer | MayPartiallyOverlap |
-| ssa.cpp:321:7:321:12 | ?buffer[0..?)<unknown> | ssa.cpp:321:7:321:12 | buffer[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:321:7:321:12 | buffer | ssa.cpp:321:7:321:12 | ?buffer[0..?)<unknown> | MustTotallyOverlap |
-| ssa.cpp:321:7:321:12 | buffer | ssa.cpp:321:7:321:12 | buffer | MustExactlyOverlap |
-| ssa.cpp:321:7:321:12 | buffer | ssa.cpp:321:7:321:12 | buffer[0..?)<unknown> | MustTotallyOverlap |
-| ssa.cpp:321:7:321:12 | buffer[0..?)<unknown> | ssa.cpp:321:7:321:12 | ?buffer[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:321:7:321:12 | buffer[0..?)<unknown> | ssa.cpp:321:7:321:12 | buffer | MayPartiallyOverlap |
-| ssa.cpp:321:7:321:12 | buffer[0..?)<unknown> | ssa.cpp:321:7:321:12 | buffer[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:322:8:322:11 | ?ptr1[0..?)<unknown> | ssa.cpp:322:8:322:11 | ?ptr1[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:322:8:322:11 | ?ptr1[0..?)<unknown> | ssa.cpp:322:8:322:11 | ptr1 | MayPartiallyOverlap |
-| ssa.cpp:322:8:322:11 | ?ptr1[0..?)<unknown> | ssa.cpp:322:8:322:11 | ptr1[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:322:8:322:11 | ptr1 | ssa.cpp:322:8:322:11 | ?ptr1[0..?)<unknown> | MustTotallyOverlap |
-| ssa.cpp:322:8:322:11 | ptr1 | ssa.cpp:322:8:322:11 | ptr1 | MustExactlyOverlap |
-| ssa.cpp:322:8:322:11 | ptr1 | ssa.cpp:322:8:322:11 | ptr1[0..?)<unknown> | MustTotallyOverlap |
-| ssa.cpp:322:8:322:11 | ptr1[0..?)<unknown> | ssa.cpp:322:8:322:11 | ?ptr1[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:322:8:322:11 | ptr1[0..?)<unknown> | ssa.cpp:322:8:322:11 | ptr1 | MayPartiallyOverlap |
-| ssa.cpp:322:8:322:11 | ptr1[0..?)<unknown> | ssa.cpp:322:8:322:11 | ptr1[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:402:7:402:7 | b | ssa.cpp:402:7:402:7 | b | MustExactlyOverlap |
-| ssa.cpp:402:7:402:7 | b | ssa.cpp:402:7:402:7 | b[0..4)<int> | MustTotallyOverlap |
-| ssa.cpp:402:7:402:7 | b[0..4)<int> | ssa.cpp:402:7:402:7 | b | MayPartiallyOverlap |
-| ssa.cpp:402:7:402:7 | b[0..4)<int> | ssa.cpp:402:7:402:7 | b[0..4)<int> | MustExactlyOverlap |
-| ssa.cpp:403:7:403:7 | c | ssa.cpp:403:7:403:7 | c | MustExactlyOverlap |
-| ssa.cpp:418:7:418:7 | x | ssa.cpp:418:7:418:7 | x | MustExactlyOverlap |
-| ssa.cpp:418:7:418:7 | x | ssa.cpp:418:7:418:7 | x[0..4)<int> | MustTotallyOverlap |
-| ssa.cpp:418:7:418:7 | x | ssa.cpp:418:7:418:7 | x[4..8)<int> | MustTotallyOverlap |
-| ssa.cpp:418:7:418:7 | x[0..4)<int> | ssa.cpp:418:7:418:7 | x | MayPartiallyOverlap |
-| ssa.cpp:418:7:418:7 | x[0..4)<int> | ssa.cpp:418:7:418:7 | x[0..4)<int> | MustExactlyOverlap |
-| ssa.cpp:418:7:418:7 | x[4..8)<int> | ssa.cpp:418:7:418:7 | x | MayPartiallyOverlap |
-| ssa.cpp:418:7:418:7 | x[4..8)<int> | ssa.cpp:418:7:418:7 | x[4..8)<int> | MustExactlyOverlap |
-| ssa.cpp:442:37:442:37 | *a | ssa.cpp:442:37:442:37 | *a | MustExactlyOverlap |
-| ssa.cpp:442:37:442:37 | *a | ssa.cpp:442:37:442:37 | ?*a | MustTotallyOverlap |
-| ssa.cpp:442:37:442:37 | ?*a | ssa.cpp:442:37:442:37 | *a | MayPartiallyOverlap |
-| ssa.cpp:442:37:442:37 | ?*a | ssa.cpp:442:37:442:37 | ?*a | MayPartiallyOverlap |
-| ssa.cpp:442:46:442:46 | *b | ssa.cpp:442:46:442:46 | *b | MustExactlyOverlap |
-| ssa.cpp:442:46:442:46 | *b | ssa.cpp:442:46:442:46 | ?*b | MustTotallyOverlap |
-| ssa.cpp:442:46:442:46 | ?*b | ssa.cpp:442:46:442:46 | *b | MayPartiallyOverlap |
-| ssa.cpp:442:46:442:46 | ?*b | ssa.cpp:442:46:442:46 | ?*b | MayPartiallyOverlap |
-| ssa.cpp:446:34:446:34 | *a | ssa.cpp:446:34:446:34 | *a | MustExactlyOverlap |
-| ssa.cpp:446:34:446:34 | *a | ssa.cpp:446:34:446:34 | *a[0..?)<unknown> | MustTotallyOverlap |
-| ssa.cpp:446:34:446:34 | *a | ssa.cpp:446:34:446:34 | ?*a | MustTotallyOverlap |
-| ssa.cpp:446:34:446:34 | *a | ssa.cpp:446:34:446:34 | ?*a[0..?)<unknown> | MustTotallyOverlap |
-| ssa.cpp:446:34:446:34 | *a[0..?)<unknown> | ssa.cpp:446:34:446:34 | *a | MayPartiallyOverlap |
-| ssa.cpp:446:34:446:34 | *a[0..?)<unknown> | ssa.cpp:446:34:446:34 | *a[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:446:34:446:34 | *a[0..?)<unknown> | ssa.cpp:446:34:446:34 | ?*a | MayPartiallyOverlap |
-| ssa.cpp:446:34:446:34 | *a[0..?)<unknown> | ssa.cpp:446:34:446:34 | ?*a[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:446:34:446:34 | *a[0..?)<unknown> | ssa.cpp:446:43:446:43 | *b | MayPartiallyOverlap |
-| ssa.cpp:446:34:446:34 | *a[0..?)<unknown> | ssa.cpp:446:43:446:43 | ?*b | MayPartiallyOverlap |
-| ssa.cpp:446:34:446:34 | ?*a | ssa.cpp:446:34:446:34 | *a | MayPartiallyOverlap |
-| ssa.cpp:446:34:446:34 | ?*a | ssa.cpp:446:34:446:34 | *a[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:446:34:446:34 | ?*a | ssa.cpp:446:34:446:34 | ?*a | MayPartiallyOverlap |
-| ssa.cpp:446:34:446:34 | ?*a | ssa.cpp:446:34:446:34 | ?*a[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:446:34:446:34 | ?*a[0..?)<unknown> | ssa.cpp:446:34:446:34 | *a | MayPartiallyOverlap |
-| ssa.cpp:446:34:446:34 | ?*a[0..?)<unknown> | ssa.cpp:446:34:446:34 | *a[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:446:34:446:34 | ?*a[0..?)<unknown> | ssa.cpp:446:34:446:34 | ?*a | MayPartiallyOverlap |
-| ssa.cpp:446:34:446:34 | ?*a[0..?)<unknown> | ssa.cpp:446:34:446:34 | ?*a[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:446:34:446:34 | ?*a[0..?)<unknown> | ssa.cpp:446:43:446:43 | *b | MayPartiallyOverlap |
-| ssa.cpp:446:34:446:34 | ?*a[0..?)<unknown> | ssa.cpp:446:43:446:43 | ?*b | MayPartiallyOverlap |
-| ssa.cpp:446:43:446:43 | *b | ssa.cpp:446:43:446:43 | *b | MustExactlyOverlap |
-| ssa.cpp:446:43:446:43 | *b | ssa.cpp:446:43:446:43 | *b[0..?)<unknown> | MustTotallyOverlap |
-| ssa.cpp:446:43:446:43 | *b | ssa.cpp:446:43:446:43 | ?*b | MustTotallyOverlap |
-| ssa.cpp:446:43:446:43 | *b | ssa.cpp:446:43:446:43 | ?*b[0..?)<unknown> | MustTotallyOverlap |
-| ssa.cpp:446:43:446:43 | *b[0..?)<unknown> | ssa.cpp:446:34:446:34 | *a | MayPartiallyOverlap |
-| ssa.cpp:446:43:446:43 | *b[0..?)<unknown> | ssa.cpp:446:34:446:34 | ?*a | MayPartiallyOverlap |
-| ssa.cpp:446:43:446:43 | *b[0..?)<unknown> | ssa.cpp:446:43:446:43 | *b | MayPartiallyOverlap |
-| ssa.cpp:446:43:446:43 | *b[0..?)<unknown> | ssa.cpp:446:43:446:43 | *b[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:446:43:446:43 | *b[0..?)<unknown> | ssa.cpp:446:43:446:43 | ?*b | MayPartiallyOverlap |
-| ssa.cpp:446:43:446:43 | *b[0..?)<unknown> | ssa.cpp:446:43:446:43 | ?*b[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:446:43:446:43 | ?*b | ssa.cpp:446:43:446:43 | *b | MayPartiallyOverlap |
-| ssa.cpp:446:43:446:43 | ?*b | ssa.cpp:446:43:446:43 | *b[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:446:43:446:43 | ?*b | ssa.cpp:446:43:446:43 | ?*b | MayPartiallyOverlap |
-| ssa.cpp:446:43:446:43 | ?*b | ssa.cpp:446:43:446:43 | ?*b[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:446:43:446:43 | ?*b[0..?)<unknown> | ssa.cpp:446:34:446:34 | *a | MayPartiallyOverlap |
-| ssa.cpp:446:43:446:43 | ?*b[0..?)<unknown> | ssa.cpp:446:34:446:34 | ?*a | MayPartiallyOverlap |
-| ssa.cpp:446:43:446:43 | ?*b[0..?)<unknown> | ssa.cpp:446:43:446:43 | *b | MayPartiallyOverlap |
-| ssa.cpp:446:43:446:43 | ?*b[0..?)<unknown> | ssa.cpp:446:43:446:43 | *b[0..?)<unknown> | MayPartiallyOverlap |
-| ssa.cpp:446:43:446:43 | ?*b[0..?)<unknown> | ssa.cpp:446:43:446:43 | ?*b | MayPartiallyOverlap |
-| ssa.cpp:446:43:446:43 | ?*b[0..?)<unknown> | ssa.cpp:446:43:446:43 | ?*b[0..?)<unknown> | MayPartiallyOverlap |

cpp/ql/test/library-tests/ir/ssa/aliased_ssa_overlap.ql

@@ -1,5 +0,0 @@
-import semmle.code.cpp.ir.implementation.aliased_ssa.internal.AliasedSSA
-
-from AllocationMemoryLocation def, AllocationMemoryLocation use, Overlap ovr
-where ovr = getOverlap(def, use)
-select def, use, ovr

cpp/ql/test/library-tests/ir/ssa/ssa.cpp

@@ -211,7 +211,7 @@ int ModeledCallTarget(int x) {
 }
 
 void InitArray() {
-    char a_pad[32] = "";
+    char a_pad[32] = ""; 
     char a_nopad[4] = "foo";
     char a_infer[] = "blah";
     char b[2];
@@ -306,7 +306,7 @@ int main(int argc, char **argv) {
 
 class ThisAliasTest {
   int x, y;
-
+  
   void setX(int arg) {
     this->x = arg;
   }
@@ -438,13 +438,3 @@ int noreturnTest2(int x) {
 void Conditional(bool a, int x, int y) {
     int z = a ? x : y;
 }
-
-static void NonEscapingParams(void *a, void *b)
-{
-}
-
-static void EscapingParams(void *a, void *b)
-{
-  Escape(a);
-  Escape(b);
-}

cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected

@@ -2044,57 +2044,3 @@ ssa.cpp:
 #  439|     r439_15(glval<int>) = VariableAddress[#temp439:13] : 
 #  439|     m439_16(int)        = Store[#temp439:13]           : &:r439_15, r439_14
 #-----|   Goto -> Block 1
-
-#  442| void NonEscapingParams(void*, void*)
-#  442|   Block 0
-#  442|     v442_1(void)          = EnterFunction            : 
-#  442|     mu442_2(unknown)      = AliasedDefinition        : 
-#  442|     mu442_3(unknown)      = InitializeNonLocal       : 
-#  442|     r442_4(glval<void *>) = VariableAddress[a]       : 
-#  442|     m442_5(void *)        = InitializeParameter[a]   : &:r442_4
-#  442|     r442_6(void *)        = Load[a]                  : &:r442_4, m442_5
-#  442|     mu442_7(unknown)      = InitializeIndirection[a] : &:r442_6
-#  442|     r442_8(glval<void *>) = VariableAddress[b]       : 
-#  442|     m442_9(void *)        = InitializeParameter[b]   : &:r442_8
-#  442|     r442_10(void *)       = Load[b]                  : &:r442_8, m442_9
-#  442|     mu442_11(unknown)     = InitializeIndirection[b] : &:r442_10
-#  444|     v444_1(void)          = NoOp                     : 
-#  442|     v442_12(void)         = ReturnIndirection[a]     : &:r442_6, ~m?
-#  442|     v442_13(void)         = ReturnIndirection[b]     : &:r442_10, ~m?
-#  442|     v442_14(void)         = ReturnVoid               : 
-#  442|     v442_15(void)         = AliasedUse               : ~m?
-#  442|     v442_16(void)         = ExitFunction             : 
-
-#  446| void EscapingParams(void*, void*)
-#  446|   Block 0
-#  446|     v446_1(void)           = EnterFunction                : 
-#  446|     mu446_2(unknown)       = AliasedDefinition            : 
-#  446|     mu446_3(unknown)       = InitializeNonLocal           : 
-#  446|     r446_4(glval<void *>)  = VariableAddress[a]           : 
-#  446|     m446_5(void *)         = InitializeParameter[a]       : &:r446_4
-#  446|     r446_6(void *)         = Load[a]                      : &:r446_4, m446_5
-#  446|     mu446_7(unknown)       = InitializeIndirection[a]     : &:r446_6
-#  446|     r446_8(glval<void *>)  = VariableAddress[b]           : 
-#  446|     m446_9(void *)         = InitializeParameter[b]       : &:r446_8
-#  446|     r446_10(void *)        = Load[b]                      : &:r446_8, m446_9
-#  446|     mu446_11(unknown)      = InitializeIndirection[b]     : &:r446_10
-#  448|     r448_1(glval<unknown>) = FunctionAddress[Escape]      : 
-#  448|     r448_2(glval<void *>)  = VariableAddress[a]           : 
-#  448|     r448_3(void *)         = Load[a]                      : &:r448_2, m446_5
-#  448|     v448_4(void)           = Call[Escape]                 : func:r448_1, 0:r448_3
-#  448|     mu448_5(unknown)       = ^CallSideEffect              : ~m?
-#  448|     v448_6(void)           = ^BufferReadSideEffect[0]     : &:r448_3, ~m?
-#  448|     mu448_7(unknown)       = ^BufferMayWriteSideEffect[0] : &:r448_3
-#  449|     r449_1(glval<unknown>) = FunctionAddress[Escape]      : 
-#  449|     r449_2(glval<void *>)  = VariableAddress[b]           : 
-#  449|     r449_3(void *)         = Load[b]                      : &:r449_2, m446_9
-#  449|     v449_4(void)           = Call[Escape]                 : func:r449_1, 0:r449_3
-#  449|     mu449_5(unknown)       = ^CallSideEffect              : ~m?
-#  449|     v449_6(void)           = ^BufferReadSideEffect[0]     : &:r449_3, ~m?
-#  449|     mu449_7(unknown)       = ^BufferMayWriteSideEffect[0] : &:r449_3
-#  450|     v450_1(void)           = NoOp                         : 
-#  446|     v446_12(void)          = ReturnIndirection[a]         : &:r446_6, ~m?
-#  446|     v446_13(void)          = ReturnIndirection[b]         : &:r446_10, ~m?
-#  446|     v446_14(void)          = ReturnVoid                   : 
-#  446|     v446_15(void)          = AliasedUse                   : ~m?
-#  446|     v446_16(void)          = ExitFunction                 : 

cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir_unsound.expected

@@ -2044,57 +2044,3 @@ ssa.cpp:
 #  439|     r439_15(glval<int>) = VariableAddress[#temp439:13] : 
 #  439|     m439_16(int)        = Store[#temp439:13]           : &:r439_15, r439_14
 #-----|   Goto -> Block 1
-
-#  442| void NonEscapingParams(void*, void*)
-#  442|   Block 0
-#  442|     v442_1(void)          = EnterFunction            : 
-#  442|     mu442_2(unknown)      = AliasedDefinition        : 
-#  442|     mu442_3(unknown)      = InitializeNonLocal       : 
-#  442|     r442_4(glval<void *>) = VariableAddress[a]       : 
-#  442|     m442_5(void *)        = InitializeParameter[a]   : &:r442_4
-#  442|     r442_6(void *)        = Load[a]                  : &:r442_4, m442_5
-#  442|     mu442_7(unknown)      = InitializeIndirection[a] : &:r442_6
-#  442|     r442_8(glval<void *>) = VariableAddress[b]       : 
-#  442|     m442_9(void *)        = InitializeParameter[b]   : &:r442_8
-#  442|     r442_10(void *)       = Load[b]                  : &:r442_8, m442_9
-#  442|     mu442_11(unknown)     = InitializeIndirection[b] : &:r442_10
-#  444|     v444_1(void)          = NoOp                     : 
-#  442|     v442_12(void)         = ReturnIndirection[a]     : &:r442_6, ~m?
-#  442|     v442_13(void)         = ReturnIndirection[b]     : &:r442_10, ~m?
-#  442|     v442_14(void)         = ReturnVoid               : 
-#  442|     v442_15(void)         = AliasedUse               : ~m?
-#  442|     v442_16(void)         = ExitFunction             : 
-
-#  446| void EscapingParams(void*, void*)
-#  446|   Block 0
-#  446|     v446_1(void)           = EnterFunction                : 
-#  446|     mu446_2(unknown)       = AliasedDefinition            : 
-#  446|     mu446_3(unknown)       = InitializeNonLocal           : 
-#  446|     r446_4(glval<void *>)  = VariableAddress[a]           : 
-#  446|     m446_5(void *)         = InitializeParameter[a]       : &:r446_4
-#  446|     r446_6(void *)         = Load[a]                      : &:r446_4, m446_5
-#  446|     mu446_7(unknown)       = InitializeIndirection[a]     : &:r446_6
-#  446|     r446_8(glval<void *>)  = VariableAddress[b]           : 
-#  446|     m446_9(void *)         = InitializeParameter[b]       : &:r446_8
-#  446|     r446_10(void *)        = Load[b]                      : &:r446_8, m446_9
-#  446|     mu446_11(unknown)      = InitializeIndirection[b]     : &:r446_10
-#  448|     r448_1(glval<unknown>) = FunctionAddress[Escape]      : 
-#  448|     r448_2(glval<void *>)  = VariableAddress[a]           : 
-#  448|     r448_3(void *)         = Load[a]                      : &:r448_2, m446_5
-#  448|     v448_4(void)           = Call[Escape]                 : func:r448_1, 0:r448_3
-#  448|     mu448_5(unknown)       = ^CallSideEffect              : ~m?
-#  448|     v448_6(void)           = ^BufferReadSideEffect[0]     : &:r448_3, ~m?
-#  448|     mu448_7(unknown)       = ^BufferMayWriteSideEffect[0] : &:r448_3
-#  449|     r449_1(glval<unknown>) = FunctionAddress[Escape]      : 
-#  449|     r449_2(glval<void *>)  = VariableAddress[b]           : 
-#  449|     r449_3(void *)         = Load[b]                      : &:r449_2, m446_9
-#  449|     v449_4(void)           = Call[Escape]                 : func:r449_1, 0:r449_3
-#  449|     mu449_5(unknown)       = ^CallSideEffect              : ~m?
-#  449|     v449_6(void)           = ^BufferReadSideEffect[0]     : &:r449_3, ~m?
-#  449|     mu449_7(unknown)       = ^BufferMayWriteSideEffect[0] : &:r449_3
-#  450|     v450_1(void)           = NoOp                         : 
-#  446|     v446_12(void)          = ReturnIndirection[a]         : &:r446_6, ~m?
-#  446|     v446_13(void)          = ReturnIndirection[b]         : &:r446_10, ~m?
-#  446|     v446_14(void)          = ReturnVoid                   : 
-#  446|     v446_15(void)          = AliasedUse                   : ~m?
-#  446|     v446_16(void)          = ExitFunction                 : 

cpp/ql/test/library-tests/lambdas/cfg/cfg.ql

@@ -1,9 +1,4 @@
-/**
- * query-type: graph
- *
- * @kind graph-equivalence-test
- */
-
+// query-type: graph
 import cpp
 
 class DestructorCallEnhanced extends DestructorCall {