Go: Update supported versions to include 1.27

MODULE.bazel

@@ -273,7 +273,7 @@ use_repo(
 )
 
 go_sdk = use_extension("@rules_go//go:extensions.bzl", "go_sdk")
-go_sdk.download(version = "1.26.4")
+go_sdk.download(version = "1.27rc1")
 
 go_deps = use_extension("@gazelle//:extensions.bzl", "go_deps")
 go_deps.from_file(go_mod = "//go/extractor:go.mod")

docs/codeql/reusables/supported-versions-compilers.rst

@@ -17,7 +17,7 @@
 
    .NET 5, .NET 6, .NET 7, .NET 8, .NET 9, .NET 10","``.sln``, ``.slnx``, ``.csproj``, ``.cs``, ``.cshtml``, ``.xaml``"
    GitHub Actions,"Not applicable",Not applicable,"``.github/workflows/*.yml``, ``.github/workflows/*.yaml``, ``**/action.yml``, ``**/action.yaml``"
-   Go (aka Golang), "Go up to 1.26", "Go 1.11 or more recent", ``.go``
+   Go (aka Golang), "Go up to 1.27", "Go 1.11 or more recent", ``.go``
    Java,"Java 7 to 26 [6]_","javac (OpenJDK and Oracle JDK),
 
    Eclipse compiler for Java (ECJ) [7]_",``.java``

go/actions/test/action.yml

@@ -4,7 +4,7 @@ inputs:
   go-test-version:
     description: Which Go version to use for running the tests
     required: false
-    default: "~1.26.4"
+    default: "1.27.0-rc.1"
   run-code-checks:
     description: Whether to run formatting, code and qhelp generation checks
     required: false

go/extractor/autobuilder/build-environment.go

@@ -12,7 +12,7 @@ import (
 )
 
 var minGoVersion = util.NewSemVer("1.11")
-var maxGoVersion = util.NewSemVer("1.26")
+var maxGoVersion = util.NewSemVer("1.27")
 
 type versionInfo struct {
 	goModVersion util.SemVer // The version of Go found in the go directive in the `go.mod` file.

go/extractor/go.mod

@@ -1,8 +1,8 @@
 module github.com/github/codeql-go/extractor
 
-go 1.26
+go 1.27
 
-toolchain go1.26.4
+toolchain go1.27rc1
 
 // when updating this, run
 //    bazel run @rules_go//go -- mod tidy

go/extractor/toolchain/toolchain_test.go

@@ -8,9 +8,9 @@ import (
 
 func TestParseGoVersion(t *testing.T) {
 	tests := map[string]string{
-		"go version go1.18.9 linux/amd64":            "go1.18.9",
-		"go version go1.26.3-X:nodwarf5 linux/amd64": "go1.26.3",
-		"go version go1.26.3rc1 linux/amd64":         "go1.26.3rc1",
+		"go version go1.18.9 linux/amd64":                                                              "go1.18.9",
+		"go version go1.26.3-X:nodwarf5 linux/amd64":                                                   "go1.26.3",
+		"go version go1.26.3rc1 linux/amd64":                                                           "go1.26.3rc1",
 		"warning: GOPATH set to GOROOT (/usr/local/go) has no effect\ngo version go1.18.9 linux/amd64": "go1.18.9",
 	}
 	for input, expected := range tests {

go/ql/lib/change-notes/2026-06-25-go-1.27.md

@@ -0,0 +1,4 @@
+---
+category: majorAnalysis
+---
+* Go 1.27 is now supported.

python/ql/consistency-queries/CfgConsistency.ql

@@ -1,2 +0,0 @@
-import semmle.python.controlflow.internal.AstNodeImpl
-import ControlFlow::Consistency

python/ql/lib/change-notes/2026-05-19-add-shared-cfg.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* A new Python control flow graph implementation has been added under `semmle.python.controlflow.internal.Cfg` (backed by `AstNodeImpl.qll`), built on the shared `codeql.controlflow.ControlFlowGraph` library. It is not yet used by the dataflow library or any production query; the legacy CFG in `semmle/python/Flow.qll` remains the default. The new library is exposed for tests and for upcoming migrations.

python/ql/lib/change-notes/2026-05-19-add-shared-ssa.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* A new SSA adapter has been added under `semmle.python.dataflow.new.internal.SsaImpl`, built on the shared `codeql.ssa.Ssa` library and the new shared CFG (`semmle.python.controlflow.internal.Cfg`). It is not yet used by the dataflow library or any production query; the legacy ESSA SSA in `semmle/python/essa/*` remains the default. The new SSA adapter is exposed for tests and for the upcoming dataflow migration.

python/ql/lib/printCfgNew.ql

@@ -1,45 +0,0 @@
-/**
- * @name Print CFG (New)
- * @description Produces a representation of a file's Control Flow Graph
- *              using the new shared control flow library.
- *              This query is used by the VS Code extension.
- * @id python/print-cfg
- * @kind graph
- * @tags ide-contextual-queries/print-cfg
- */
-
-private import python as Py
-import semmle.python.controlflow.internal.AstNodeImpl
-
-external string selectedSourceFile();
-
-private predicate selectedSourceFileAlias = selectedSourceFile/0;
-
-external int selectedSourceLine();
-
-private predicate selectedSourceLineAlias = selectedSourceLine/0;
-
-external int selectedSourceColumn();
-
-private predicate selectedSourceColumnAlias = selectedSourceColumn/0;
-
-module ViewCfgQueryInput implements ControlFlow::ViewCfgQueryInputSig<Py::File> {
-  predicate selectedSourceFile = selectedSourceFileAlias/0;
-
-  predicate selectedSourceLine = selectedSourceLineAlias/0;
-
-  predicate selectedSourceColumn = selectedSourceColumnAlias/0;
-
-  predicate cfgScopeSpan(
-    Ast::Callable callable, Py::File file, int startLine, int startColumn, int endLine,
-    int endColumn
-  ) {
-    exists(Py::Scope scope |
-      scope = callable.asScope() and
-      file = scope.getLocation().getFile() and
-      scope.getLocation().hasLocationInfo(_, startLine, startColumn, endLine, endColumn)
-    )
-  }
-}
-
-import ControlFlow::ViewCfgQuery<Py::File, ViewCfgQueryInput>

python/ql/lib/semmle/python/dataflow/new/internal/SsaImpl.qll

@@ -1,547 +0,0 @@
-/**
- * Provides the Python SSA implementation built on the new (shared) CFG.
- *
- * Mirrors the Java SSA adapter at
- * `java/ql/lib/semmle/code/java/dataflow/internal/SsaImpl.qll`:
- * an `InputSig` is defined in terms of positional `(BasicBlock, int)`
- * variable references, and the shared
- * `codeql.ssa.Ssa::Make<Location, Cfg, Input>` module is then
- * instantiated.
- *
- * `SourceVariable` is the AST-level `Py::Variable`. Variable references
- * are looked up via the CFG facade's `NameNode.defines`/`uses`/`deletes`
- * predicates, which themselves are one-line bridges to AST-level
- * `Name.defines`/`uses`/`deletes`.
- *
- * Implicit-entry definitions are inserted for:
- *   - non-local / global / builtin variables that are read in the scope
- *     but never assigned (no enclosing CFG node defines them),
- *   - captured variables (variables defined in an enclosing scope that
- *     are read inside the scope), and
- *   - parameters, but only if the corresponding parameter name is *not*
- *     itself a CFG node. With the C#-style parameter wiring already
- *     installed in `AstNodeImpl.qll`, parameter names *are* CFG nodes,
- *     so the regular `variableWrite` path handles them — no `i = -1`
- *     entry is needed for ordinary parameters.
- */
-overlay[local?]
-module;
-
-private import python as Py
-private import semmle.python.controlflow.internal.AstNodeImpl as CfgImpl
-private import semmle.python.controlflow.internal.Cfg as Cfg
-private import codeql.ssa.Ssa as SsaImplCommon
-private import codeql.controlflow.BasicBlock as BB
-
-/**
- * Adapts the Python `Cfg` facade to the shared SSA library's `CfgSig`.
- * All members are inherited from `Cfg::ControlFlowNode` and
- * `Cfg::BasicBlock`.
- */
-private module CfgForSsa implements BB::CfgSig<Py::Location> {
-  class ControlFlowNode = CfgImpl::ControlFlowNode;
-
-  class BasicBlock = CfgImpl::BasicBlock;
-
-  class EntryBasicBlock = CfgImpl::Cfg::EntryBasicBlock;
-
-  predicate dominatingEdge = CfgImpl::Cfg::dominatingEdge/2;
-}
-
-/**
- * A source variable for SSA, wrapping a Python AST `Variable`.
- *
- * We only track variables that are read at least once in their scope —
- * tracking write-only variables would be unnecessary work — *except*
- * for module-scope globals, where the "read" can be external (e.g.
- * `import mymodule; mymodule.x`). Such globals are tracked
- * unconditionally so that import-resolution can find their defining
- * write.
- */
-private newtype TSsaSourceVariable =
-  TPyVar(Py::Variable v) {
-    // Has a use somewhere — read-relevant for SSA.
-    exists(Cfg::NameNode n | n.uses(v))
-    or
-    // Or has a deletion (treated as a write that destroys the value).
-    exists(Cfg::NameNode n | n.deletes(v))
-    or
-    // Or is a module-scope global written in this module — must be
-    // tracked even if never read locally, because importers may read
-    // it as an attribute on the module object.
-    v.getScope() instanceof Py::Module and
-    exists(Cfg::NameNode n | n.defines(v))
-    or
-    // Or is a parameter — parameters must always have a
-    // `ParameterDefinition` for dataflow argument-routing to work,
-    // even if the parameter is never read in its scope. Mirrors
-    // legacy ESSA's `ParameterDefinition` (which fired for every
-    // parameter binding regardless of liveness).
-    exists(Py::Parameter p | p.asName() = v.getAStore())
-  }
-
-/**
- * A source variable for SSA, wrapping a Python AST `Variable`.
- */
-class SsaSourceVariable extends TSsaSourceVariable {
-  /** Gets the underlying Python AST variable. */
-  Py::Variable getVariable() { this = TPyVar(result) }
-
-  /** Gets the (textual) name of this variable. */
-  string getName() { result = this.getVariable().getId() }
-
-  /** Gets a textual representation of this source variable. */
-  string toString() { result = this.getVariable().toString() }
-
-  /** Gets the location of this source variable. */
-  Py::Location getLocation() { result = this.getVariable().getScope().getLocation() }
-
-  /** Gets the scope in which this variable lives. */
-  Py::Scope getScope() { result = this.getVariable().getScope() }
-
-  /**
-   * Gets a use of this variable as it appears in the source — a `NameNode`
-   * that loads or deletes the variable. Mirrors legacy
-   * `SsaSourceVariable.getASourceUse()`.
-   */
-  Cfg::ControlFlowNode getASourceUse() {
-    exists(Cfg::NameNode n | result = n |
-      n.uses(this.getVariable()) or n.deletes(this.getVariable())
-    )
-  }
-
-  /**
-   * Gets an implicit use of this variable. The new SSA does not have
-   * implicit-use refinements, but we keep this for API parity — every
-   * normal-exit of the variable's scope counts as a sink, ensuring
-   * variables stay live to scope exit for taint-tracking.
-   */
-  Cfg::ControlFlowNode getAnImplicitUse() {
-    result.isNormalExit() and result.getScope() = this.getScope()
-  }
-
-  /**
-   * Gets a use of this variable — either an explicit source use or an
-   * implicit use at scope exit. Mirrors legacy `SsaSourceVariable.getAUse()`.
-   */
-  Cfg::ControlFlowNode getAUse() {
-    result = this.getASourceUse() or result = this.getAnImplicitUse()
-  }
-}
-
-/**
- * Holds if `v` is a non-local read in scope `s`, in the sense that `s`
- * uses `v` but does not write it within `s`. This includes globals,
- * builtins, and variables captured from an enclosing function scope.
- *
- * The `Py::Variable` `v` lives in some defining scope (the module for
- * globals, an outer function for closures, etc.); the reading scope
- * `s` is the scope where the use of `v` occurs.
- */
-private predicate nonLocalReadIn(Py::Variable v, Py::Scope s) {
-  exists(Cfg::NameNode n |
-    n.uses(v) and
-    n.getScope() = s and
-    not exists(Cfg::NameNode def | def.defines(v) and def.getScope() = s)
-  ) and
-  // Match legacy ESSA: only create entry defs for variables that have
-  // at least one defining store somewhere — otherwise the entry def
-  // represents "nothing reaches here", which is the default anyway and
-  // introduces no useful flow. (Legacy's `ModuleVariable` required a
-  // store; this is the closure-aware generalisation.)
-  exists(Cfg::NameNode store | store.defines(v))
-}
-
-/**
- * Holds if `bb` is the entry basic block of a scope where `v` should
- * have an implicit entry definition. This covers:
- *   - non-local / global / builtin variables read in `s`, and
- *   - captured variables (defined in an enclosing scope but read in `s`).
- *
- * Each reading scope gets its own entry def, so a closure variable can
- * have multiple entry defs across all functions/methods that read it.
- *
- * Parameters are *not* included: their bound `Name` is itself a CFG
- * node (per the C#-style parameter wiring), so `variableWrite` fires at
- * the parameter's natural CFG index.
- */
-private predicate hasEntryDefIn(SsaSourceVariable v, CfgImpl::BasicBlock bb) {
-  exists(Py::Scope s |
-    nonLocalReadIn(v.getVariable(), s) and
-    bb = entryBlock(s)
-  )
-}
-
-/**
- * Gets the entry basic block of scope `s`, where implicit entry
- * definitions are placed (at synthetic index `-1`).
- */
-private CfgImpl::BasicBlock entryBlock(Py::Scope s) {
-  exists(CfgImpl::ControlFlowNode entry |
-    entry instanceof CfgImpl::ControlFlow::EntryNode and
-    entry.getEnclosingCallable().asScope() = s and
-    result = entry.getBasicBlock()
-  )
-}
-
-/**
- * The SSA `InputSig` for Python. References are positional
- * `(BasicBlock, int)` pairs into the new CFG.
- */
-private module SsaImplInput implements SsaImplCommon::InputSig<Py::Location, CfgImpl::BasicBlock> {
-  class SourceVariable = SsaSourceVariable;
-
-  predicate variableWrite(CfgImpl::BasicBlock bb, int i, SourceVariable v, boolean certain) {
-    // Explicit binding at a CFG node — includes assignments,
-    // parameter Names (wired in via the C# pattern), exception-handler
-    // `as`-bindings, import aliases, and match-pattern captures.
-    exists(Cfg::NameNode n |
-      bb.getNode(i) = n and
-      n.defines(v.getVariable()) and
-      certain = true
-    )
-    or
-    // `del x` — removes the binding. Modelled as a certain write that
-    // makes any subsequent read invalid.
-    exists(Cfg::NameNode n |
-      bb.getNode(i) = n and
-      n.deletes(v.getVariable()) and
-      certain = true
-    )
-    or
-    // Implicit entry definition for non-local / captured / global /
-    // builtin variables read in some scope. Each reading scope's entry
-    // block gets one such write, allowing closures: e.g. when `x` is a
-    // parameter of an outer function and read inside a nested
-    // function, both scopes get entry defs for `x`.
-    hasEntryDefIn(v, bb) and
-    i = -1 and
-    certain = true
-    or
-    // `from X import *` — possibly rebinds every name in the importing
-    // scope. Modelled as an uncertain write at the import-star's CFG
-    // position for every variable that lives in (or is referenced
-    // from) the same scope as the import-star. Mirrors legacy ESSA's
-    // `ImportStarRefinement` (see `essa/SsaDefinitions.qll`'s
-    // `import_star_refinement` predicate). The write is uncertain so
-    // that prior definitions of the variable remain available — the
-    // shared-SSA `SsaUncertainWrite` merges the new value with the
-    // immediately preceding definition.
-    exists(Cfg::ImportStarNode imp |
-      bb.getNode(i) = imp and
-      certain = false and
-      (
-        v.getVariable().getScope() = imp.getScope()
-        or
-        // Variable is defined in some other scope but referenced in
-        // the same scope as the import-star (matches legacy clause 2:
-        // `other.uses(v) and def.getScope() = other.getScope()`).
-        exists(Cfg::NameNode other |
-          other.uses(v.getVariable()) and
-          imp.getScope() = other.getScope()
-        )
-      )
-    )
-  }
-
-  predicate variableRead(CfgImpl::BasicBlock bb, int i, SourceVariable v, boolean certain) {
-    // Explicit source use — a `Name` load or a `del x` of the variable.
-    exists(Cfg::NameNode n |
-      bb.getNode(i) = n and
-      n.uses(v.getVariable()) and
-      certain = true
-    )
-    or
-    // Synthetic use at the normal exit of the variable's defining scope.
-    // This keeps every variable live to scope exit so that callers (e.g.
-    // `module_export` in ImportResolution.qll, or taint-tracking pass-through
-    // through unread locals) can ask "which definition reaches end of
-    // scope?". Mirrors legacy ESSA's `SsaSourceVariable.getAUse()` which
-    // included `getScope().getANormalExit()`.
-    exists(Cfg::ControlFlowNode exit |
-      exit.isNormalExit() and
-      exit.getScope() = v.getVariable().getScope() and
-      bb.getNode(i) = exit and
-      certain = true
-    )
-  }
-}
-
-/**
- * The shared SSA instantiation for Python.
- *
- * Members:
- *   - `Definition` — the union of explicit, uncertain, and phi definitions
- *   - `WriteDefinition`, `UncertainWriteDefinition`, `PhiNode`
- *   - the standard SSA predicates (`getAUse`, `getAnUltimateDefinition`, ...).
- */
-module Ssa = SsaImplCommon::Make<Py::Location, CfgForSsa, SsaImplInput>;
-
-final class Definition = Ssa::Definition;
-
-final class WriteDefinition = Ssa::WriteDefinition;
-
-final class UncertainWriteDefinition = Ssa::UncertainWriteDefinition;
-
-final class PhiNode = Ssa::PhiNode;
-
-// ===========================================================================
-// ESSA-shaped adapter layer
-//
-// The dataflow library (`python/ql/lib/semmle/python/dataflow/new/`) and
-// related modules (`ApiGraphs.qll`, etc.) consume the legacy ESSA API
-// (`EssaVariable`, `EssaDefinition`, `AssignmentDefinition`,
-// `ScopeEntryDefinition`, `ParameterDefinition`, `WithDefinition`,
-// `PhiFunction`, plus the `AdjacentUses` module). To migrate them off
-// the legacy CFG, we expose the same API surface on top of the
-// shared SSA built above.
-//
-// This adapter is intentionally narrow: it covers only the predicates
-// that new dataflow consumes. The richer legacy ESSA — refinement
-// nodes, attribute refinements, edge refinements — stays available
-// via `semmle.python.essa.Essa` for points-to / legacy code.
-// ===========================================================================
-/**
- * Gets the CFG node at which a write definition's binding takes place.
- *
- * For ordinary writes (assignment, deletion, parameter) this is the
- * canonical CFG node of the bound Name. For implicit entry definitions
- * (synthesised at position `-1` of a scope's entry BB) this is the
- * scope's entry node.
- */
-private Cfg::ControlFlowNode writeDefNode(Ssa::WriteDefinition def) {
-  exists(CfgImpl::BasicBlock bb, int i | def.definesAt(_, bb, i) |
-    i >= 0 and result = bb.getNode(i)
-    or
-    i = -1 and result = bb.getNode(0)
-  )
-}
-
-/**
- * A write definition whose binding has a corresponding CFG node — i.e.
- * everything that's not a phi node. Mirrors legacy ESSA's
- * `EssaNodeDefinition`.
- */
-class EssaNodeDefinition extends Ssa::WriteDefinition {
-  /** Gets the CFG node where this definition's binding takes place. */
-  Cfg::ControlFlowNode getDefiningNode() { result = writeDefNode(this) }
-
-  /** Gets the variable defined here (legacy name). */
-  SsaSourceVariable getVariable() { result = this.getSourceVariable() }
-
-  /** Gets the enclosing scope. */
-  Py::Scope getScope() {
-    exists(Cfg::ControlFlowNode n | n = this.getDefiningNode() | result = n.getScope())
-  }
-
-  /**
-   * Holds if this definition defines source variable `v` at CFG node
-   * `defNode`. Flatter form of `getSourceVariable()` +
-   * `getDefiningNode()`, matching legacy ESSA's `definedBy`.
-   */
-  predicate definedBy(SsaSourceVariable v, Cfg::ControlFlowNode defNode) {
-    v = this.getSourceVariable() and defNode = this.getDefiningNode()
-  }
-}
-
-/**
- * An assignment definition: any binding where the value being assigned
- * is statically known via `Cfg::DefinitionNode.getValue()`. Includes
- * plain assignments, walrus, annotated assignments, augmented
- * assignments, import aliases (`import x` / `from m import x [as y]`),
- * `with ... as x`, and for-target bindings (where `getValue()` returns
- * the iter expression's CFG node). Excludes parameter bindings —
- * those are modelled by `ParameterDefinition`.
- */
-class AssignmentDefinition extends EssaNodeDefinition {
-  AssignmentDefinition() {
-    exists(Cfg::NameNode n | n = this.getDefiningNode() |
-      exists(n.(Cfg::DefinitionNode).getValue()) and
-      not n.(Cfg::ControlFlowNode).isParameter()
-    )
-  }
-
-  /** Gets the CFG node for the value being assigned, if statically known. */
-  Cfg::ControlFlowNode getValue() {
-    result = this.getDefiningNode().(Cfg::DefinitionNode).getValue()
-  }
-}
-
-/**
- * A parameter definition — the binding of a parameter name in a
- * function's scope.
- */
-class ParameterDefinition extends EssaNodeDefinition {
-  ParameterDefinition() { this.getDefiningNode().isParameter() }
-
-  /** Gets the AST `Parameter` (a `Py::Name` in param context). */
-  Py::Name getParameter() { result = this.getDefiningNode().getNode() }
-}
-
-/**
- * A definition introduced by a `with ... as x:` clause.
- */
-class WithDefinition extends EssaNodeDefinition {
-  WithDefinition() {
-    exists(Cfg::NameNode n, Py::With w |
-      n = this.getDefiningNode() and
-      w.getOptionalVars() = n.getNode()
-    )
-  }
-}
-
-/**
- * An assignment where the LHS is a tuple/list and the RHS is unpacked:
- * `a, b = (1, 2)` or `a, *rest = xs`. The SSA def lives at the inner
- * `Name` CFG node, but for IterableUnpacking integration we expose
- * the enclosing `StarredNode` as the `getDefiningNode()` for `*rest`
- * patterns — mirroring legacy ESSA's `multi_assignment_definition`,
- * which placed the def at the StarredNode CFG node.
- */
-class MultiAssignmentDefinition extends EssaNodeDefinition {
-  MultiAssignmentDefinition() {
-    exists(Cfg::NameNode n | n = super.getDefiningNode() |
-      exists(Py::Assign a, Py::Expr lhs |
-        a.getATarget() = lhs and
-        (lhs instanceof Py::Tuple or lhs instanceof Py::List) and
-        lhs.getASubExpression+() = n.getNode()
-      )
-      or
-      // For-loop with tuple/list target: `for a, b in xs:` —
-      // tuple-unpacking semantics applies to the for-target.
-      exists(Py::For f, Py::Expr lhs |
-        f.getTarget() = lhs and
-        (lhs instanceof Py::Tuple or lhs instanceof Py::List) and
-        lhs.getASubExpression+() = n.getNode()
-      )
-    )
-  }
-
-  override Cfg::ControlFlowNode getDefiningNode() {
-    // Default: the underlying `Name` CFG node (where the SSA def lives).
-    not exists(Cfg::StarredNode s |
-      s.getNode().(Py::Starred).getValue() = super.getDefiningNode().getNode()
-    ) and
-    result = super.getDefiningNode()
-    or
-    // Exception: for `*rest`, expose the enclosing `Starred` CFG node
-    // so that `IterableUnpacking::iterableUnpackingStarredElementStoreStep`
-    // can attach the rest-list to it.
-    exists(Cfg::StarredNode s |
-      s.getNode().(Py::Starred).getValue() = super.getDefiningNode().getNode()
-    |
-      result = s
-    )
-  }
-}
-
-/**
- * An implicit entry definition for a non-local / captured / global /
- * builtin variable read in a scope but not defined there.
- *
- * Inherits from `EssaNodeDefinition` and exposes the scope's entry node
- * as its defining node (matching legacy ESSA semantics).
- */
-class ScopeEntryDefinition extends EssaNodeDefinition {
-  ScopeEntryDefinition() {
-    exists(CfgImpl::BasicBlock bb |
-      this.definesAt(_, bb, -1) and
-      bb instanceof CfgImpl::Cfg::EntryBasicBlock
-    )
-  }
-
-  /** Gets the enclosing scope (the scope whose entry block this def is in). */
-  override Py::Scope getScope() {
-    exists(CfgImpl::BasicBlock bb |
-      this.definesAt(_, bb, -1) and
-      result = bb.getNode(0).(Cfg::ControlFlowNode).getScope()
-    )
-  }
-}
-
-/** A phi node (alias matching legacy naming). */
-class PhiFunction extends PhiNode {
-  /**
-   * Gets an input to this phi function (a definition that flows into
-   * the phi from one of its predecessor blocks). Mirrors legacy
-   * ESSA's `PhiFunction.getAnInput()`.
-   */
-  Ssa::Definition getAnInput() { Ssa::phiHasInputFromBlock(this, result, _) }
-}
-
-/** Base class for all ESSA definitions (legacy-shaped). */
-class EssaDefinition = Ssa::Definition;
-
-/**
- * An adapter representing a single SSA-defined "variable" — wrapping
- * one `Ssa::Definition`. Mirrors legacy `EssaVariable` API.
- */
-class EssaVariable extends Ssa::Definition {
-  /** Gets the underlying SSA definition (legacy name). */
-  Ssa::Definition getDefinition() { result = this }
-
-  /**
-   * Gets a CFG node where this definition is used. Includes regular
-   * `Name` reads as well as the synthetic scope-exit "use" registered
-   * via `SsaImplInput::variableRead` — mirrors legacy ESSA's
-   * `EssaVariable.getAUse()` which inherited the synthetic exit-use
-   * from `SsaSourceVariable`.
-   */
-  Cfg::ControlFlowNode getAUse() {
-    exists(CfgImpl::BasicBlock bb, int i |
-      Ssa::ssaDefReachesRead(this.getSourceVariable(), this, bb, i) and
-      bb.getNode(i) = result
-    )
-  }
-
-  /** Gets the (textual) name of the underlying variable. */
-  string getName() { result = this.getSourceVariable().getVariable().getId() }
-
-  /** Gets the scope in which this variable lives. */
-  Py::Scope getScope() { result = this.getSourceVariable().getVariable().getScope() }
-
-  /** Gets an ultimate non-phi ancestor of this definition. */
-  EssaVariable getAnUltimateDefinition() {
-    if this instanceof PhiNode
-    then
-      exists(Ssa::Definition input |
-        Ssa::phiHasInputFromBlock(this, input, _) and
-        result = input.(EssaVariable).getAnUltimateDefinition()
-      )
-    else result = this
-  }
-}
-
-/**
- * Adjacent use-use and def-use relations exposed by the shared SSA
- * library. Provides the same interface as legacy
- * `semmle.python.essa.SsaCompute::AdjacentUses`.
- */
-module AdjacentUses {
-  /** Holds if `nodeFrom` and `nodeTo` are adjacent uses of the same SSA variable. */
-  predicate adjacentUseUse(Cfg::NameNode nodeFrom, Cfg::NameNode nodeTo) {
-    exists(SsaSourceVariable v, CfgImpl::BasicBlock bb1, int i1, CfgImpl::BasicBlock bb2, int i2 |
-      Ssa::adjacentUseUse(bb1, i1, bb2, i2, v, _) and
-      nodeFrom = bb1.getNode(i1) and
-      nodeTo = bb2.getNode(i2)
-    )
-  }
-
-  /** Holds if `use` is a first use of definition `def`. */
-  predicate firstUse(Ssa::Definition def, Cfg::NameNode use) {
-    exists(CfgImpl::BasicBlock bb, int i |
-      Ssa::firstUse(def, bb, i, _) and
-      use = bb.getNode(i)
-    )
-  }
-
-  /**
-   * Holds if `use` is any reachable use of definition `def`. Combines
-   * `firstUse` with transitive use-use adjacency.
-   */
-  predicate useOfDef(Ssa::Definition def, Cfg::NameNode use) {
-    firstUse(def, use)
-    or
-    exists(Cfg::NameNode mid | useOfDef(def, mid) and adjacentUseUse(mid, use))
-  }
-}

python/ql/test/extractor-tests/syntax_error/CONSISTENCY/CfgConsistency.expected

@@ -1,4 +0,0 @@
-consistencyOverview
-| deadEnd | 1 |
-deadEnd
-| without_loop.py:7:5:7:9 | Break |

python/ql/test/library-tests/ControlFlow/bindings/BindingsTest.ql

@@ -1,32 +0,0 @@
-/**
- * Phase -1 of the dataflow CFG migration: verifies that every variable
- * binding visible to the AST (`Name.defines(v)`) corresponds to a CFG node
- * in the new CFG (`semmle.python.controlflow.internal.AstNodeImpl`).
- *
- * The expected tag is `cfgdefines=<name>`. Each binding annotation in the
- * test sources looks like `# $ cfgdefines=x` for a binding currently
- * covered by the new CFG, or `# $ MISSING: cfgdefines=x` for a binding
- * that is known to be uncovered (a "red" test case that should be
- * green-flipped once the corresponding `cfg-ext-*` extension lands).
- */
-
-import python
-import semmle.python.controlflow.internal.AstNodeImpl as CfgImpl
-import utils.test.InlineExpectationsTest
-
-module CfgBindingsTest implements TestSig {
-  string getARelevantTag() { result = "cfgdefines" }
-
-  predicate hasActualResult(Location location, string element, string tag, string value) {
-    exists(Name n, Variable v, CfgImpl::ControlFlowNode cfg |
-      n.defines(v) and
-      cfg.getAstNode().asExpr() = n and
-      location = n.getLocation() and
-      element = n.toString() and
-      tag = "cfgdefines" and
-      value = v.getId()
-    )
-  }
-}
-
-import MakeTest<CfgBindingsTest>

python/ql/test/library-tests/ControlFlow/bindings/annassign.py

@@ -1,13 +0,0 @@
-# Annotated assignment (PEP 526). Both with and without an initializer.
-
-a: int = 1  # $ cfgdefines=a
-b: str = "hi"  # $ cfgdefines=b
-
-# Annotation without value: the AST records `c` as defined,
-# and the new CFG now visits it via the AnnAssignStmt wrapper.
-c: int  # $ cfgdefines=c
-
-class K:  # $ cfgdefines=K
-    field: int = 0  # $ cfgdefines=field
-
-

python/ql/test/library-tests/ControlFlow/bindings/compound.py

@@ -1,14 +0,0 @@
-# Compound (tuple/list) assignment targets — actually wired in the new CFG.
-
-a, b = (1, 2)  # $ cfgdefines=a cfgdefines=b
-[c, d] = [3, 4]  # $ cfgdefines=c cfgdefines=d
-
-# Nested unpacking.
-(e, (f, g)) = (1, (2, 3))  # $ cfgdefines=e cfgdefines=f cfgdefines=g
-
-# Star unpacking.
-h, *i = [1, 2, 3]  # $ cfgdefines=h cfgdefines=i
-
-# Chained assignment with compound target.
-j = k, l = (5, 6)  # $ cfgdefines=j cfgdefines=k cfgdefines=l
-

python/ql/test/library-tests/ControlFlow/bindings/comprehension.py

@@ -1,21 +0,0 @@
-# Comprehension and `for` loop targets — wired in the new CFG.
-# Comprehensions are nested function scopes with a synthetic `.0` parameter
-# bound to the iterable.
-
-# Bare-name `for` target.
-for i in range(3):  # $ cfgdefines=i
-    pass
-
-# Compound `for` target.
-for k, v in [(1, 2)]:  # $ cfgdefines=k cfgdefines=v
-    pass
-
-# Comprehension targets.
-_ = [x for x in range(3)]  # $ cfgdefines=_ cfgdefines=x cfgdefines=.0
-_ = {y: z for y, z in []}  # $ cfgdefines=_ cfgdefines=y cfgdefines=z cfgdefines=.0
-_ = (a for a in [])  # $ cfgdefines=_ cfgdefines=a cfgdefines=.0
-
-# Nested comprehensions.
-_ = [b for c in [] for b in c]  # $ cfgdefines=_ cfgdefines=c cfgdefines=b cfgdefines=.0
-
-

python/ql/test/library-tests/ControlFlow/bindings/dead_under_no_raise.py

@@ -1,53 +0,0 @@
-# Reachability of code following a try whose body always returns.
-#
-# The new CFG models exception edges for raise-prone expressions when
-# they appear inside a `try` (or `with`) statement, mirroring Java's
-# `mayThrow`. This means the body of a `try` has both a normal
-# completion edge and an exception edge to its handlers, so code
-# following the try-statement is reachable via the except-handler path
-# even when the try-body would otherwise always return.
-#
-# Code that is not reachable under either normal or exception flow
-# (for example, the `else` clause of a try whose body unconditionally
-# raises) remains correctly classified as dead.
-
-
-def f(obj):  # $ cfgdefines=f cfgdefines=obj
-    try:
-        return len(obj)
-    except TypeError:
-        pass
-
-    # The try-body always returns, but `len(obj)` can raise (it is
-    # inside the try, so we model its exception edge). The
-    # `except TypeError: pass` handler falls through to here, making
-    # the code below reachable.
-    try:
-        hint = type(obj).__length_hint__  # $ cfgdefines=hint
-    except AttributeError:
-        return None
-    return hint
-
-
-def g():  # $ cfgdefines=g
-    try:
-        raise Exception("inner")
-    except:
-        raise Exception("outer")
-    else:
-        # Unreachable: the inner try body always raises (via an explicit
-        # `raise`, which is modelled unconditionally), so the `else:`
-        # clause never runs.
-        hit_inner_else = True
-
-
-def h(cache, key):  # $ cfgdefines=h cfgdefines=cache cfgdefines=key
-    try:
-        return cache[key]
-    except KeyError:
-        pass
-
-    # Same pattern as `f`: reachable via the except-handler fall-through.
-    value = compute(key)  # $ cfgdefines=value
-    cache[key] = value
-    return value

python/ql/test/library-tests/ControlFlow/bindings/decorated.py

@@ -1,30 +0,0 @@
-# Decorated `def`/`class` — wired in the new CFG.
-
-
-def deco(f):  # $ cfgdefines=deco cfgdefines=f
-    return f
-
-
-@deco
-def decorated_func():  # $ cfgdefines=decorated_func
-    pass
-
-
-@deco
-class DecoratedClass:  # $ cfgdefines=DecoratedClass
-    pass
-
-
-# Stacked decorators.
-@deco
-@deco
-def doubly():  # $ cfgdefines=doubly
-    pass
-
-
-# Inside a class body.
-class Outer:  # $ cfgdefines=Outer
-    @staticmethod
-    def inner():  # $ cfgdefines=inner
-        pass
-

python/ql/test/library-tests/ControlFlow/bindings/except_handler.py

@@ -1,19 +0,0 @@
-# Exception-handler name bindings. These are already wired in the new
-# CFG provided the try body can raise; `raise` statements are reliably
-# treated as exception sources.
-
-try:
-    raise ValueError("oops")
-except ValueError as e:  # $ cfgdefines=e
-    pass
-
-try:
-    raise TypeError("oops")
-except (TypeError, KeyError) as err:  # $ cfgdefines=err
-    pass
-
-# Exception groups (Python 3.11+).
-try:
-    raise ValueError("oops")
-except* ValueError as eg:  # $ cfgdefines=eg
-    pass

python/ql/test/library-tests/ControlFlow/bindings/imports.py

@@ -1,14 +0,0 @@
-# Import aliases — all bound names below are now reachable via the new
-# CFG's `ImportStmt` wrapper.
-
-import os  # $ cfgdefines=os
-import os.path  # $ cfgdefines=os
-import os as o  # $ cfgdefines=o
-from os import path  # $ cfgdefines=path
-from os import path as p  # $ cfgdefines=p
-from os import sep, linesep  # $ cfgdefines=sep cfgdefines=linesep
-from os import (
-    getcwd,  # $ cfgdefines=getcwd
-    getcwdb,  # $ cfgdefines=getcwdb
-)
-

python/ql/test/library-tests/ControlFlow/bindings/match_pattern.py

@@ -1,24 +0,0 @@
-# Match-statement pattern bindings — wired in the new CFG.
-
-def f(subject):  # $ cfgdefines=f cfgdefines=subject
-    match subject:
-        case x:  # $ cfgdefines=x
-            pass
-        case [a, b]:  # $ cfgdefines=a cfgdefines=b
-            pass
-        case {"k": v}:  # $ cfgdefines=v
-            pass
-        case Point(p, q):  # $ cfgdefines=p cfgdefines=q
-            pass
-        case [_, *rest]:  # $ cfgdefines=rest
-            pass
-        case (1 | 2) as n:  # $ cfgdefines=n
-            pass
-
-
-class Point:  # $ cfgdefines=Point
-    __match_args__ = ("x", "y")  # $ cfgdefines=__match_args__
-    x: int  # $ cfgdefines=x
-    y: int  # $ cfgdefines=y
-
-

python/ql/test/library-tests/ControlFlow/bindings/parameters.py

@@ -1,42 +0,0 @@
-# Function parameters.
-
-def positional(a, b):  # $ cfgdefines=positional cfgdefines=a cfgdefines=b
-    pass
-
-
-def with_default(x=1, y=2):  # $ cfgdefines=with_default cfgdefines=x cfgdefines=y
-    pass
-
-
-def with_vararg(*args):  # $ cfgdefines=with_vararg cfgdefines=args
-    pass
-
-
-def with_kwarg(**kwargs):  # $ cfgdefines=with_kwarg cfgdefines=kwargs
-    pass
-
-
-def with_kwonly(*, k1, k2=5):  # $ cfgdefines=with_kwonly cfgdefines=k1 cfgdefines=k2
-    pass
-
-
-def kitchen_sink(a, b=2, *args, k1, k2=5, **kw):  # $ cfgdefines=kitchen_sink cfgdefines=a cfgdefines=b cfgdefines=args cfgdefines=k1 cfgdefines=k2 cfgdefines=kw
-    pass
-
-
-# Methods get `self` / `cls`.
-class C:  # $ cfgdefines=C
-    def method(self, x):  # $ cfgdefines=method cfgdefines=self cfgdefines=x
-        pass
-
-    @classmethod
-    def cmethod(cls, x):  # $ cfgdefines=cmethod cfgdefines=cls cfgdefines=x
-        pass
-
-
-# Lambda parameter.
-_ = lambda p: p + 1  # $ cfgdefines=_ cfgdefines=p
-
-# PEP 570 positional-only.
-def pos_only(a, b, /, c):  # $ cfgdefines=pos_only cfgdefines=a cfgdefines=b cfgdefines=c
-    pass

python/ql/test/library-tests/ControlFlow/bindings/simple.py

@@ -1,14 +0,0 @@
-# Simple bindings that should already work in the new CFG.
-# No MISSING annotations expected.
-
-x = 1  # $ cfgdefines=x
-y = x + 1  # $ cfgdefines=y
-
-def f():  # $ cfgdefines=f
-    pass
-
-class C:  # $ cfgdefines=C
-    pass
-
-# Re-assignment.
-x = 2  # $ cfgdefines=x

python/ql/test/library-tests/ControlFlow/bindings/type_params.py

@@ -1,21 +0,0 @@
-# PEP 695 type parameters (Python 3.12+).
-
-# PEP 695 type-param names on `def`/`class` bind in an annotation scope
-# that nests the function/class body — they have no CFG node in the
-# enclosing scope (matching the legacy CFG).
-def func[T](x: T) -> T:  # $ cfgdefines=func cfgdefines=x
-    return x
-
-
-class Box[T]:  # $ cfgdefines=Box
-    item: T  # $ cfgdefines=item
-
-
-# Multi-parameter, with bound and variadics.
-def multi[T: int, *Ts, **P](x: T, *args: *Ts, **kwargs: P.kwargs) -> T:  # $ cfgdefines=multi cfgdefines=x cfgdefines=args cfgdefines=kwargs
-    return x
-
-
-# `type` statement (PEP 695).
-type Alias[T] = list[T]  # $ cfgdefines=Alias cfgdefines=T
-

python/ql/test/library-tests/ControlFlow/bindings/walrus_starred.py

@@ -1,14 +0,0 @@
-# Walrus and starred-target edge cases — wired in the new CFG.
-
-# Walrus in expression context.
-if (y := 5) > 0:  # $ cfgdefines=y
-    pass
-
-# Walrus in a comprehension. The comprehension introduces a synthetic
-# `.0` parameter bound to the iterable.
-_ = [w for _ in range(3) if (w := 1)]  # $ cfgdefines=_ cfgdefines=w cfgdefines=.0
-
-# Starred target in a Tuple LHS.
-*head, tail = [1, 2, 3]  # $ cfgdefines=head cfgdefines=tail
-
-

python/ql/test/library-tests/ControlFlow/bindings/with_stmt.py

@@ -1,21 +0,0 @@
-# `with cm() as x:` bindings — wired in the new CFG.
-
-class CM:  # $ cfgdefines=CM
-    def __enter__(self): return self  # $ cfgdefines=__enter__ cfgdefines=self
-    def __exit__(self, *a): pass  # $ cfgdefines=__exit__ cfgdefines=self cfgdefines=a
-
-with CM() as x:  # $ cfgdefines=x
-    pass
-
-# Multiple items.
-with CM() as a, CM() as b:  # $ cfgdefines=a cfgdefines=b
-    pass
-
-# Parenthesised form (Python 3.10+).
-with (CM() as p, CM() as q):  # $ cfgdefines=p cfgdefines=q
-    pass
-
-# Compound target in `with`.
-with CM() as (m, n):  # $ cfgdefines=m cfgdefines=n
-    pass
-

python/ql/test/library-tests/ControlFlow/evaluation-order/AllLiveReachable.ql

@@ -5,8 +5,6 @@
  * have separate CFGs and are excluded from this check.
  */
 
-import python
-import TimerUtils
 import OldCfgImpl
 
 private module Utils = EvalOrderCfgUtils<OldCfg>;

python/ql/test/library-tests/ControlFlow/evaluation-order/AnnotationHasCfgNode.ql

@@ -2,8 +2,6 @@
  * Checks that every timer annotation has a corresponding CFG node.
  */
 
-import python
-import TimerUtils
 import OldCfgImpl
 
 private module Utils = EvalOrderCfgUtils<OldCfg>;

python/ql/test/library-tests/ControlFlow/evaluation-order/BasicBlockAnnotationGap.ql

@@ -8,8 +8,6 @@
  * edge leaves the basic block and the normal successor may be dead.
  */
 
-import python
-import TimerUtils
 import OldCfgImpl
 
 private module Utils = EvalOrderCfgUtils<OldCfg>;

python/ql/test/library-tests/ControlFlow/evaluation-order/BasicBlockOrdering.expected

@@ -1,7 +1,7 @@
 | test_boolean.py:9:10:9:43 | ControlFlowNode for BoolExpr | Basic block ordering: $@ appears before $@ | test_boolean.py:9:59:9:59 | IntegerLiteral | timestamp 2 | test_boolean.py:9:19:9:19 | IntegerLiteral | timestamp 0 |
 | test_boolean.py:15:10:15:43 | ControlFlowNode for BoolExpr | Basic block ordering: $@ appears before $@ | test_boolean.py:15:50:15:50 | IntegerLiteral | timestamp 1 | test_boolean.py:15:20:15:20 | IntegerLiteral | timestamp 0 |
 | test_boolean.py:21:10:21:42 | ControlFlowNode for BoolExpr | Basic block ordering: $@ appears before $@ | test_boolean.py:21:49:21:49 | IntegerLiteral | timestamp 1 | test_boolean.py:21:19:21:19 | IntegerLiteral | timestamp 0 |
-| test_boolean.py:27:10:27:43 | ControlFlowNode for BoolExpr | Basic block ordering: $@ appears before $@ | test_boolean.py:27:59:27:59 | IntegerLiteral | timestamp 2 | test_boolean.py:27:20:27:20 | IntegerLiteral | timestamp 0 |
+| test_boolean.py:27:10:27:34 | ControlFlowNode for BoolExpr | Basic block ordering: $@ appears before $@ | test_boolean.py:27:50:27:50 | IntegerLiteral | timestamp 2 | test_boolean.py:27:20:27:20 | IntegerLiteral | timestamp 0 |
 | test_boolean.py:40:10:40:61 | ControlFlowNode for BoolExpr | Basic block ordering: $@ appears before $@ | test_boolean.py:40:86:40:86 | IntegerLiteral | timestamp 3 | test_boolean.py:40:16:40:16 | IntegerLiteral | timestamp 0 |
 | test_boolean.py:46:10:46:61 | ControlFlowNode for BoolExpr | Basic block ordering: $@ appears before $@ | test_boolean.py:46:86:46:86 | IntegerLiteral | timestamp 3 | test_boolean.py:46:16:46:16 | IntegerLiteral | timestamp 0 |
 | test_boolean.py:52:10:52:95 | ControlFlowNode for BoolExpr | Basic block ordering: $@ appears before $@ | test_boolean.py:52:120:52:120 | IntegerLiteral | timestamp 4 | test_boolean.py:52:20:52:20 | IntegerLiteral | timestamp 0 |

python/ql/test/library-tests/ControlFlow/evaluation-order/BasicBlockOrdering.ql

@@ -3,8 +3,6 @@
  * increasing minimum-timestamp order.
  */
 
-import python
-import TimerUtils
 import OldCfgImpl
 
 private module Utils = EvalOrderCfgUtils<OldCfg>;

python/ql/test/library-tests/ControlFlow/evaluation-order/ConsecutiveTimestamps.ql

@@ -11,8 +11,6 @@
  * lambdas that have annotations in nested scopes).
  */
 
-import python
-import TimerUtils
 import OldCfgImpl
 
 private module Utils = EvalOrderCfgUtils<OldCfg>;

python/ql/test/library-tests/ControlFlow/evaluation-order/ContiguousTimestamps.ql

@@ -4,7 +4,6 @@
  * in at least one annotation (live or dead).
  */
 
-import python
 import TimerUtils
 
 from TestFunction f, int missing, int maxTs, TimerAnnotation maxAnn

python/ql/test/library-tests/ControlFlow/evaluation-order/NeverReachable.ql

@@ -4,8 +4,6 @@
  * entry (including within the same basic block).
  */
 
-import python
-import TimerUtils
 import OldCfgImpl
 
 private module Utils = EvalOrderCfgUtils<OldCfg>;

python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgAllLiveReachable.ql

@@ -1,14 +0,0 @@
-/** New-CFG version of AllLiveReachable. */
-
-import python
-import TimerUtils
-import NewCfgImpl
-
-private module Utils = EvalOrderCfgUtils<NewCfg>;
-
-private import Utils
-private import Utils::CfgTests
-
-from TimerCfgNode a, TestFunction f
-where allLiveReachable(a, f)
-select a, "Unreachable live annotation; entry of $@ does not reach this node", f, f.getName()

python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgAnnotationHasCfgNode.expected

@@ -1 +0,0 @@
-

python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgAnnotationHasCfgNode.ql

@@ -1,18 +0,0 @@
-/**
- * New-CFG version of AnnotationHasCfgNode.
- *
- * Checks that every timer annotation has a corresponding CFG node.
- */
-
-import python
-import TimerUtils
-import NewCfgImpl
-
-private module Utils = EvalOrderCfgUtils<NewCfg>;
-
-private import Utils::CfgTests
-
-from TimerAnnotation ann
-where annotationWithoutCfgNode(ann)
-select ann, "Annotation in $@ has no CFG node", ann.getTestFunction(),
-  ann.getTestFunction().getName()

python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgBasicBlockAnnotationGap.ql

@@ -1,26 +0,0 @@
-/**
- * New-CFG version of BasicBlockAnnotationGap.
- *
- * Original:
- * Checks that within a basic block, if a node is annotated then its
- * successor is also annotated (or excluded). A gap in annotations
- * within a basic block indicates a missing annotation, since there
- * are no branches to justify the gap.
- *
- * Nodes with exceptional successors are excluded, as the exception
- * edge leaves the basic block and the normal successor may be dead.
- */
-
-import python
-import TimerUtils
-import NewCfgImpl
-
-private module Utils = EvalOrderCfgUtils<NewCfg>;
-
-private import Utils
-private import Utils::CfgTests
-
-from TimerCfgNode a, CfgNode succ
-where basicBlockAnnotationGap(a, succ)
-select a, "Annotated node followed by unannotated $@ in the same basic block", succ,
-  succ.getNode().toString()

python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgBasicBlockOrdering.ql

@@ -1,21 +0,0 @@
-/**
- * New-CFG version of BasicBlockOrdering.
- *
- * Original:
- * Checks that within a single basic block, annotations appear in
- * increasing minimum-timestamp order.
- */
-
-import python
-import TimerUtils
-import NewCfgImpl
-
-private module Utils = EvalOrderCfgUtils<NewCfg>;
-
-private import Utils
-private import Utils::CfgTests
-
-from TimerCfgNode a, TimerCfgNode b, int minA, int minB
-where basicBlockOrdering(a, b, minA, minB)
-select a, "Basic block ordering: $@ appears before $@", a.getTimestampExpr(minA),
-  "timestamp " + minA, b.getTimestampExpr(minB), "timestamp " + minB

python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgBranchTimestamps.ql

@@ -1,80 +0,0 @@
-/**
- * New-CFG version of BranchTimestamps.
- *
- * Checks that when a node has both a true and false successor, the
- * live timestamps on one branch are marked as dead on the other.
- * This ensures that boolean branches are fully annotated with dead()
- * markers for the paths not taken.
- *
- * Limitation: the `@ t[ts, ...]` / `dead(ts)` annotation scheme can only
- * model branch-dead-ness for plain boolean control flow that reconverges
- * linearly after the split — i.e. `if`-with-else and `if`-expression.
- * It cannot model:
- *
- *   * loops (`while` / `for`): body timestamps repeat across iterations,
- *     so the loop-exit annotation can't list them as dead;
- *   * `match` statements: each `case` body is a syntactically distinct
- *     sub-tree, and the branches don't reconverge through a common
- *     annotation point in the timeline;
- *   * `try` / `with` and `raise` / `assert`: exception edges are modelled
- *     as true/false but flow to syntactically distinct handlers, with no
- *     reconvergence in the linear annotation order;
- *   * short-circuit `and` / `or` (`BoolExpr`): the branches reconverge at
- *     the BoolExpr's after-node, so timestamps on one branch are live
- *     downstream of the other rather than dead;
- *   * `if` without an `else` clause, and `if`/`elif` chains: the false
- *     branch reconverges with the true branch at the post-if statement
- *     (no-else) or fans out across multiple elif-test annotations,
- *     neither of which fit the binary annotation scheme.
- *
- * Branch nodes inside those constructs are therefore whitelisted out
- * below. The check still fires (and is useful) for plain `if`/`else`
- * and conditional-expression branching.
- */
-
-import python
-import TimerUtils
-import NewCfgImpl
-
-private module Utils = EvalOrderCfgUtils<NewCfg>;
-
-private import Utils
-private import Utils::CfgTests
-
-/**
- * Holds if `f` contains a construct whose branches the linear-timestamp
- * annotation scheme cannot describe (see file-level comment).
- */
-private predicate hasUnmodellableBranching(Function f) {
-  exists(AstNode bad |
-    bad.getScope() = f and
-    (
-      bad instanceof While
-      or
-      bad instanceof For
-      or
-      bad instanceof MatchStmt
-      or
-      bad instanceof Try
-      or
-      bad instanceof With
-      or
-      bad instanceof Raise
-      or
-      bad instanceof Assert
-      or
-      bad instanceof BoolExpr
-      or
-      bad instanceof If and
-      (not exists(bad.(If).getAnOrelse()) or bad.(If).isElif())
-    )
-  )
-}
-
-from TimerCfgNode node, int ts, string branch
-where
-  missingBranchTimestamp(node, ts, branch) and
-  not hasUnmodellableBranching(node.getTestFunction())
-select node,
-  "Timestamp " + ts + " on true/false branch is missing a dead() annotation on the " + branch +
-    " successor in $@", node.getTestFunction(), node.getTestFunction().getName()

python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgConsecutivePredecessorTimestamps.expected

@@ -1 +0,0 @@
-

python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgConsecutivePredecessorTimestamps.ql

@@ -1,22 +0,0 @@
-/**
- * New-CFG version of ConsecutivePredecessorTimestamps.
- *
- * Checks that each annotated node (except the minimum timestamp) has
- * a predecessor annotation with timestamp `a - 1`. This is the reverse
- * of ConsecutiveTimestamps: it catches nodes that are reachable but
- * arrived at from the wrong place (skipping an intermediate node).
- */
-
-import python
-import TimerUtils
-import NewCfgImpl
-
-private module Utils = EvalOrderCfgUtils<NewCfg>;
-
-private import Utils
-private import Utils::CfgTests
-
-from TimerAnnotation ann, int a
-where consecutivePredecessorTimestamps(ann, a)
-select ann, "$@ in $@ has no consecutive predecessor (expected " + (a - 1) + ")",
-  ann.getTimestampExpr(a), "Timestamp " + a, ann.getTestFunction(), ann.getTestFunction().getName()

python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgConsecutiveTimestamps.ql

@@ -1,29 +0,0 @@
-/**
- * New-CFG version of ConsecutiveTimestamps.
- *
- * Original:
- * Checks that consecutive annotated nodes have consecutive timestamps:
- * for each annotation with timestamp `a`, some CFG node for that annotation
- * must have a next annotation containing `a + 1`.
- *
- * Handles CFG splitting (e.g., finally blocks duplicated for normal/exceptional
- * flow) by checking that at least one split has the required successor.
- *
- * Only applies to functions where all annotations are in the function's
- * own scope (excludes tests with generators, async, comprehensions, or
- * lambdas that have annotations in nested scopes).
- */
-
-import python
-import TimerUtils
-import NewCfgImpl
-
-private module Utils = EvalOrderCfgUtils<NewCfg>;
-
-private import Utils
-private import Utils::CfgTests
-
-from TimerAnnotation ann, int a
-where consecutiveTimestamps(ann, a)
-select ann, "$@ in $@ has no consecutive successor (expected " + (a + 1) + ")",
-  ann.getTimestampExpr(a), "Timestamp " + a, ann.getTestFunction(), ann.getTestFunction().getName()

python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgImpl.qll

@@ -1,101 +0,0 @@
-/**
- * Implementation of the evaluation-order CFG signature using the new
- * shared control flow graph from AstNodeImpl.
- */
-
-private import python as Py
-import TimerUtils
-private import semmle.python.controlflow.internal.AstNodeImpl as CfgImpl
-private import codeql.controlflow.SuccessorType
-
-private class NewControlFlowNode = CfgImpl::ControlFlowNode;
-
-private class NewBasicBlock = CfgImpl::BasicBlock;
-
-/** New (shared) CFG implementation of the evaluation-order signature. */
-module NewCfg implements EvalOrderCfgSig {
-  class CfgNode instanceof NewControlFlowNode {
-    // Use the post-order representative for each AST node: the "after" node.
-    // For simple leaf nodes this is the merged before/after node. For
-    // post-order expressions this is the TAstNode. For pre-order expressions
-    // (and/or/not/ternary) this uses an AfterValueNode, which places the
-    // expression after its operands — matching the timer test expectations.
-    CfgNode() { NewControlFlowNode.super.isAfter(_) }
-
-    string toString() { result = NewControlFlowNode.super.toString() }
-
-    Py::Location getLocation() { result = NewControlFlowNode.super.getLocation() }
-
-    Py::AstNode getNode() {
-      result = CfgImpl::astNodeToPyNode(NewControlFlowNode.super.getAstNode())
-    }
-
-    CfgNode getASuccessor() { nextCfgNode(this, result) }
-
-    CfgNode getATrueSuccessor() {
-      NewControlFlowNode.super.isAfterTrue(_) and
-      // Only where there's also a false branch (true boolean split)
-      exists(NewControlFlowNode other | other.isAfterFalse(NewControlFlowNode.super.getAstNode())) and
-      nextCfgNodeFrom(this, result)
-    }
-
-    CfgNode getAFalseSuccessor() {
-      NewControlFlowNode.super.isAfterFalse(_) and
-      // Only where there's also a true branch (true boolean split)
-      exists(NewControlFlowNode other | other.isAfterTrue(NewControlFlowNode.super.getAstNode())) and
-      nextCfgNodeFrom(this, result)
-    }
-
-    CfgNode getAnExceptionalSuccessor() {
-      exists(NewControlFlowNode mid |
-        mid = NewControlFlowNode.super.getAnExceptionSuccessor() and
-        nextCfgNodeFrom(mid, result)
-      )
-    }
-
-    Py::Scope getScope() { result = NewControlFlowNode.super.getEnclosingCallable().asScope() }
-
-    BasicBlock getBasicBlock() {
-      exists(NewBasicBlock bb, int i | bb.getNode(i) = this and result = bb)
-    }
-  }
-
-  /**
-   * Holds if `next` is the nearest CfgNode reachable from `n` via
-   * one or more raw CFG successor edges, skipping non-CfgNode intermediaries.
-   */
-  private predicate nextCfgNodeFrom(NewControlFlowNode n, CfgNode next) {
-    next = n.getASuccessor()
-    or
-    exists(NewControlFlowNode mid |
-      mid = n.getASuccessor() and
-      not mid instanceof CfgNode and
-      nextCfgNodeFrom(mid, next)
-    )
-  }
-
-  /**
-   * Holds if `next` is the nearest CfgNode successor of `n`,
-   * skipping synthetic intermediate nodes.
-   */
-  private predicate nextCfgNode(CfgNode n, CfgNode next) { nextCfgNodeFrom(n, next) }
-
-  class BasicBlock instanceof NewBasicBlock {
-    string toString() { result = NewBasicBlock.super.toString() }
-
-    CfgNode getNode(int n) { result = NewBasicBlock.super.getNode(n) }
-
-    predicate reaches(BasicBlock bb) { this = bb or this.strictlyReaches(bb) }
-
-    predicate strictlyReaches(BasicBlock bb) { NewBasicBlock.super.getASuccessor+() = bb }
-
-    predicate strictlyDominates(BasicBlock bb) { NewBasicBlock.super.strictlyDominates(bb) }
-  }
-
-  CfgNode scopeGetEntryNode(Py::Scope s) {
-    exists(CfgImpl::ControlFlow::EntryNode entry |
-      entry.getEnclosingCallable().asScope() = s and
-      nextCfgNodeFrom(entry, result)
-    )
-  }
-}

python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgNeverReachable.ql

@@ -1,21 +0,0 @@
-/**
- * New-CFG version of NeverReachable.
- *
- * Original:
- * Checks that expressions annotated with `t.never` either have no CFG
- * node, or if they do, that the node is not reachable from its scope's
- * entry (including within the same basic block).
- */
-
-import python
-import TimerUtils
-import NewCfgImpl
-
-private module Utils = EvalOrderCfgUtils<NewCfg>;
-
-private import Utils::CfgTests
-
-from TimerAnnotation ann
-where neverReachable(ann)
-select ann, "Node annotated with t.never is reachable in $@", ann.getTestFunction(),
-  ann.getTestFunction().getName()

python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgNoBackwardFlow.ql

@@ -1,22 +0,0 @@
-/**
- * New-CFG version of NoBackwardFlow.
- *
- * Original:
- * Checks that time never flows backward between consecutive timer annotations
- * in the CFG. For each pair of consecutive annotated nodes (A -> B), there must
- * exist timestamps a in A and b in B with a < b.
- */
-
-import python
-import TimerUtils
-import NewCfgImpl
-
-private module Utils = EvalOrderCfgUtils<NewCfg>;
-
-private import Utils
-private import Utils::CfgTests
-
-from TimerCfgNode a, TimerCfgNode b, int minA, int maxB
-where noBackwardFlow(a, b, minA, maxB)
-select a, "Backward flow: $@ flows to $@ (max timestamp $@)", a.getTimestampExpr(minA),
-  minA.toString(), b, b.getNode().toString(), b.getTimestampExpr(maxB), maxB.toString()

python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgNoBasicBlock.expected

@@ -1 +0,0 @@
-

python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgNoBasicBlock.ql

@@ -1,18 +0,0 @@
-/**
- * New-CFG version of NoBasicBlock.
- *
- * Checks that every annotated CFG node belongs to a basic block.
- */
-
-import python
-import TimerUtils
-import NewCfgImpl
-
-private module Utils = EvalOrderCfgUtils<NewCfg>;
-
-private import Utils
-private import Utils::CfgTests
-
-from CfgNode n, TestFunction f
-where noBasicBlock(n, f)
-select n, "CFG node in $@ does not belong to any basic block", f, f.getName()

python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgNoSharedReachable.ql

@@ -1,21 +0,0 @@
-/**
- * New-CFG version of NoSharedReachable.
- *
- * Original:
- * Checks that two annotations sharing a timestamp value are on
- * mutually exclusive CFG paths (neither can reach the other).
- */
-
-import python
-import TimerUtils
-import NewCfgImpl
-
-private module Utils = EvalOrderCfgUtils<NewCfg>;
-
-private import Utils
-private import Utils::CfgTests
-
-from TimerCfgNode a, TimerCfgNode b, int ts
-where noSharedReachable(a, b, ts)
-select a, "Shared timestamp $@ but this node reaches $@", a.getTimestampExpr(ts), ts.toString(), b,
-  b.getNode().toString()

python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgStrictForward.ql

@@ -1,22 +0,0 @@
-/**
- * New-CFG version of StrictForward.
- *
- * Original:
- * Stronger version of NoBackwardFlow: for consecutive annotated nodes
- * A -> B that both have a single timestamp (non-loop code) and B does
- * NOT dominate A (forward edge), requires max(A) < min(B).
- */
-
-import python
-import TimerUtils
-import NewCfgImpl
-
-private module Utils = EvalOrderCfgUtils<NewCfg>;
-
-private import Utils
-private import Utils::CfgTests
-
-from TimerCfgNode a, TimerCfgNode b, int maxA, int minB
-where strictForward(a, b, maxA, minB)
-select a, "Strict forward violation: $@ flows to $@", a.getTimestampExpr(maxA), "timestamp " + maxA,
-  b.getTimestampExpr(minB), "timestamp " + minB

python/ql/test/library-tests/ControlFlow/evaluation-order/NoBackwardFlow.expected

@@ -1,7 +1,7 @@
 | test_boolean.py:9:10:9:43 | ControlFlowNode for BoolExpr | Backward flow: $@ flows to $@ (max timestamp $@) | test_boolean.py:9:59:9:59 | IntegerLiteral | 2 | test_boolean.py:9:10:9:13 | ControlFlowNode for True | True | test_boolean.py:9:19:9:19 | IntegerLiteral | 0 |
 | test_boolean.py:15:10:15:43 | ControlFlowNode for BoolExpr | Backward flow: $@ flows to $@ (max timestamp $@) | test_boolean.py:15:50:15:50 | IntegerLiteral | 1 | test_boolean.py:15:10:15:14 | ControlFlowNode for False | False | test_boolean.py:15:20:15:20 | IntegerLiteral | 0 |
 | test_boolean.py:21:10:21:42 | ControlFlowNode for BoolExpr | Backward flow: $@ flows to $@ (max timestamp $@) | test_boolean.py:21:49:21:49 | IntegerLiteral | 1 | test_boolean.py:21:10:21:13 | ControlFlowNode for True | True | test_boolean.py:21:19:21:19 | IntegerLiteral | 0 |
-| test_boolean.py:27:10:27:43 | ControlFlowNode for BoolExpr | Backward flow: $@ flows to $@ (max timestamp $@) | test_boolean.py:27:59:27:59 | IntegerLiteral | 2 | test_boolean.py:27:10:27:14 | ControlFlowNode for False | False | test_boolean.py:27:20:27:20 | IntegerLiteral | 0 |
+| test_boolean.py:27:10:27:34 | ControlFlowNode for BoolExpr | Backward flow: $@ flows to $@ (max timestamp $@) | test_boolean.py:27:50:27:50 | IntegerLiteral | 2 | test_boolean.py:27:10:27:14 | ControlFlowNode for False | False | test_boolean.py:27:20:27:20 | IntegerLiteral | 0 |
 | test_boolean.py:40:10:40:61 | ControlFlowNode for BoolExpr | Backward flow: $@ flows to $@ (max timestamp $@) | test_boolean.py:40:86:40:86 | IntegerLiteral | 3 | test_boolean.py:40:10:40:10 | ControlFlowNode for IntegerLiteral | IntegerLiteral | test_boolean.py:40:16:40:16 | IntegerLiteral | 0 |
 | test_boolean.py:46:10:46:61 | ControlFlowNode for BoolExpr | Backward flow: $@ flows to $@ (max timestamp $@) | test_boolean.py:46:86:46:86 | IntegerLiteral | 3 | test_boolean.py:46:10:46:10 | ControlFlowNode for IntegerLiteral | IntegerLiteral | test_boolean.py:46:16:46:16 | IntegerLiteral | 0 |
 | test_boolean.py:52:10:52:95 | ControlFlowNode for BoolExpr | Backward flow: $@ flows to $@ (max timestamp $@) | test_boolean.py:52:120:52:120 | IntegerLiteral | 4 | test_boolean.py:52:11:52:47 | ControlFlowNode for BoolExpr | BoolExpr | test_boolean.py:52:63:52:63 | IntegerLiteral | 2 |

python/ql/test/library-tests/ControlFlow/evaluation-order/NoBackwardFlow.ql

@@ -4,8 +4,6 @@
  * exist timestamps a in A and b in B with a < b.
  */
 
-import python
-import TimerUtils
 import OldCfgImpl
 
 private module Utils = EvalOrderCfgUtils<OldCfg>;

python/ql/test/library-tests/ControlFlow/evaluation-order/NoBasicBlock.ql

@@ -2,8 +2,6 @@
  * Checks that every annotated CFG node belongs to a basic block.
  */
 
-import python
-import TimerUtils
 import OldCfgImpl
 
 private module Utils = EvalOrderCfgUtils<OldCfg>;

python/ql/test/library-tests/ControlFlow/evaluation-order/NoSharedReachable.ql

@@ -3,8 +3,6 @@
  * mutually exclusive CFG paths (neither can reach the other).
  */
 
-import python
-import TimerUtils
 import OldCfgImpl
 
 private module Utils = EvalOrderCfgUtils<OldCfg>;

python/ql/test/library-tests/ControlFlow/evaluation-order/OldCfgImpl.qll

@@ -3,14 +3,14 @@
  * Python control flow graph.
  */
 
-private import python as Py
+private import python as PY
 import TimerUtils
 
 /** Existing Python CFG implementation of the evaluation-order signature. */
 module OldCfg implements EvalOrderCfgSig {
-  class CfgNode = Py::ControlFlowNode;
+  class CfgNode = PY::ControlFlowNode;
 
-  class BasicBlock = Py::BasicBlock;
+  class BasicBlock = PY::BasicBlock;
 
-  CfgNode scopeGetEntryNode(Py::Scope s) { result = s.getEntryNode() }
+  CfgNode scopeGetEntryNode(PY::Scope s) { result = s.getEntryNode() }
 }

python/ql/test/library-tests/ControlFlow/evaluation-order/StrictForward.expected

@@ -1,7 +1,7 @@
 | test_boolean.py:9:10:9:43 | ControlFlowNode for BoolExpr | Strict forward violation: $@ flows to $@ | test_boolean.py:9:59:9:59 | IntegerLiteral | timestamp 2 | test_boolean.py:9:19:9:19 | IntegerLiteral | timestamp 0 |
 | test_boolean.py:15:10:15:43 | ControlFlowNode for BoolExpr | Strict forward violation: $@ flows to $@ | test_boolean.py:15:50:15:50 | IntegerLiteral | timestamp 1 | test_boolean.py:15:20:15:20 | IntegerLiteral | timestamp 0 |
 | test_boolean.py:21:10:21:42 | ControlFlowNode for BoolExpr | Strict forward violation: $@ flows to $@ | test_boolean.py:21:49:21:49 | IntegerLiteral | timestamp 1 | test_boolean.py:21:19:21:19 | IntegerLiteral | timestamp 0 |
-| test_boolean.py:27:10:27:43 | ControlFlowNode for BoolExpr | Strict forward violation: $@ flows to $@ | test_boolean.py:27:59:27:59 | IntegerLiteral | timestamp 2 | test_boolean.py:27:20:27:20 | IntegerLiteral | timestamp 0 |
+| test_boolean.py:27:10:27:34 | ControlFlowNode for BoolExpr | Strict forward violation: $@ flows to $@ | test_boolean.py:27:50:27:50 | IntegerLiteral | timestamp 2 | test_boolean.py:27:20:27:20 | IntegerLiteral | timestamp 0 |
 | test_boolean.py:40:10:40:61 | ControlFlowNode for BoolExpr | Strict forward violation: $@ flows to $@ | test_boolean.py:40:86:40:86 | IntegerLiteral | timestamp 3 | test_boolean.py:40:16:40:16 | IntegerLiteral | timestamp 0 |
 | test_boolean.py:46:10:46:61 | ControlFlowNode for BoolExpr | Strict forward violation: $@ flows to $@ | test_boolean.py:46:86:46:86 | IntegerLiteral | timestamp 3 | test_boolean.py:46:16:46:16 | IntegerLiteral | timestamp 0 |
 | test_boolean.py:52:10:52:95 | ControlFlowNode for BoolExpr | Strict forward violation: $@ flows to $@ | test_boolean.py:52:120:52:120 | IntegerLiteral | timestamp 4 | test_boolean.py:52:63:52:63 | IntegerLiteral | timestamp 2 |

python/ql/test/library-tests/ControlFlow/evaluation-order/StrictForward.ql

@@ -4,8 +4,6 @@
  * NOT dominate A (forward edge), requires max(A) < min(B).
  */
 
-import python
-import TimerUtils
 import OldCfgImpl
 
 private module Utils = EvalOrderCfgUtils<OldCfg>;

python/ql/test/library-tests/ControlFlow/evaluation-order/test_boolean.py

@@ -24,7 +24,7 @@ def test_or_short_circuit(t):
 @test
 def test_or_both_sides(t):
     # False or X — both operands evaluated, result is X
-    x = (False @ t[0] or 42 @ t[1, dead(2)]) @ t[dead(1), 2]
+    x = (False @ t[0] or 42 @ t[1]) @ t[dead(1), 2]
 
 
 @test

python/ql/test/library-tests/ControlFlow/evaluation-order/test_if.py

@@ -85,7 +85,7 @@ def test_nested_if_else(t):
         else:
             z = 2 @ t[dead(4)]
     else:
-        z = 3 @ t[dead(3), dead(4)]
+        z = 3 @ t[dead(4)]
     w = 0 @ t[5]
 
 

python/ql/test/library-tests/ControlFlow/store-load/StoreLoadTest.ql

@@ -1,41 +0,0 @@
-/**
- * Inline-expectations test for the store/load/delete/parameter
- * classification predicates on the new-CFG facade.
- *
- * Each tag fires when the corresponding predicate (`isLoad`,
- * `isStore`, `isDelete`, `isParameter`, `isAugLoad`, `isAugStore`)
- * holds on the canonical CFG node wrapping a `Py::Name` with the
- * given identifier. Subscript and attribute stores are not covered
- * by these tags — only the `Name`-typed targets/loads they involve.
- */
-
-import python
-import semmle.python.controlflow.internal.Cfg as Cfg
-import utils.test.InlineExpectationsTest
-
-module StoreLoadTest implements TestSig {
-  string getARelevantTag() { result = ["load", "store", "delete", "param", "augload", "augstore"] }
-
-  predicate hasActualResult(Location location, string element, string tag, string value) {
-    exists(Cfg::NameNode n |
-      location = n.getLocation() and
-      element = n.toString() and
-      value = n.getId() and
-      (
-        n.isLoad() and not n.isAugLoad() and tag = "load"
-        or
-        n.isStore() and not n.isAugStore() and tag = "store"
-        or
-        n.isDelete() and tag = "delete"
-        or
-        n.isParameter() and tag = "param"
-        or
-        n.isAugLoad() and tag = "augload"
-        or
-        n.isAugStore() and tag = "augstore"
-      )
-    )
-  }
-}
-
-import MakeTest<StoreLoadTest>

python/ql/test/library-tests/ControlFlow/store-load/test.py

@@ -1,56 +0,0 @@
-# Store/load/delete/parameter classification on the new-CFG facade.
-#
-# Each annotated location carries the (sorted, deduplicated) set of
-# kinds the CFG facade reports there. Comparing against the legacy
-# 'semmle.python.Flow' classification is done by the comparison query
-# 'StoreLoadParity.ql' — annotations here are only the positive
-# assertions for the new facade.
-#
-# Tags:
-#   load=<id>       -- isLoad() fires on the Name
-#   store=<id>      -- isStore() fires
-#   delete=<id>     -- isDelete() fires
-#   param=<id>      -- isParameter() fires
-#   augload=<id>    -- isAugLoad() fires (the LHS of x += ... when read)
-#   augstore=<id>   -- isAugStore() fires (the LHS of x += ... when written)
-
-
-# --- plain load / store / delete ---
-
-x = 1  # $ store=x
-y = x + 1  # $ store=y load=x
-print(y)  # $ load=print load=y
-del x  # $ delete=x
-
-
-# --- function definitions (parameters) ---
-
-def f(a, b=2, *args, c, **kwargs):  # $ store=f param=a param=b param=args param=c param=kwargs
-    return a + b + c  # $ load=a load=b load=c
-
-
-# --- augmented assignment splits one Name into load + store halves ---
-
-def aug():  # $ store=aug
-    n = 0  # $ store=n
-    n += 1  # $ augload=n augstore=n
-    return n  # $ load=n
-
-
-# --- subscript / attribute stores ---
-
-class C:  # $ store=C
-    pass
-
-
-def stores(obj, container, idx):  # $ store=stores param=obj param=container param=idx
-    obj.attr = 1  # $ load=obj
-    container[idx] = 2  # $ load=container load=idx
-    return obj  # $ load=obj
-
-
-# --- tuple unpacking ---
-
-def unpack(pair):  # $ store=unpack param=pair
-    a, b = pair  # $ store=a store=b load=pair
-    return a + b  # $ load=a load=b

python/ql/test/library-tests/dataflow-new-ssa-vs-legacy/CmpTest.expected

@@ -1,6 +0,0 @@
-| def-only-old | $:0:0 |
-| def-only-old | __name__:0:0 |
-| def-only-old | __package__:0:0 |
-| def-only-old | e:37:1 |
-| def-only-old | e:40:25 |
-| def-only-old | x:20:1 |

python/ql/test/library-tests/dataflow-new-ssa-vs-legacy/CmpTest.ql

@@ -1,59 +0,0 @@
-/**
- * Compares the new-CFG SSA against the legacy ESSA on the same Python
- * sources. Reports definitions present in one implementation but not
- * the other, identified by variable name + source position.
- *
- * The `.expected` file records the current diff as a snapshot: as the
- * new SSA matures (closing captured-variable gap, exception bindings,
- * etc.) and tracks more variables, the snapshot should monotonically
- * shrink.
- *
- * Known categories of `def-only-old` mismatches:
- *   - Function / class / global definitions with no in-scope read
- *     (intentional: SSA is liveness-pruned, write-only variables are
- *     not tracked).
- *   - Captured / closure variables (gap: new SSA does not yet model
- *     closure captures).
- *   - Module variables `__name__`, `__package__`, `$` (legacy ESSA
- *     adds implicit bindings the new SSA does not).
- *   - Exception-handler `as` bindings (depend on raise modelling).
- *
- * `def-only-new` mismatches would indicate the new SSA produces spurious
- * definitions; currently none are expected.
- */
-
-import python
-import semmle.python.dataflow.new.internal.SsaImpl as NewSsa
-import semmle.python.controlflow.internal.Cfg as Cfg
-import semmle.python.essa.Essa
-
-string newDefSig(NewSsa::EssaNodeDefinition def) {
-  exists(Cfg::ControlFlowNode n | n = def.getDefiningNode() |
-    result =
-      def.getVariable().getVariable().getId() + ":" + n.getLocation().getStartLine() + ":" +
-        n.getLocation().getStartColumn()
-  )
-}
-
-string legacyDefSig(EssaNodeDefinition def) {
-  exists(ControlFlowNode n | n = def.getDefiningNode() |
-    result =
-      def.getSourceVariable().getName() + ":" + n.getLocation().getStartLine() + ":" +
-        n.getLocation().getStartColumn()
-  )
-}
-
-from string kind, string sig
-where
-  kind = "def-only-new" and
-  exists(NewSsa::EssaNodeDefinition def |
-    sig = newDefSig(def) and
-    not exists(EssaNodeDefinition legacyDef | sig = legacyDefSig(legacyDef))
-  )
-  or
-  kind = "def-only-old" and
-  exists(EssaNodeDefinition legacyDef |
-    sig = legacyDefSig(legacyDef) and
-    not exists(NewSsa::EssaNodeDefinition def | sig = newDefSig(def))
-  )
-select kind, sig

python/ql/test/library-tests/dataflow-new-ssa-vs-legacy/test.py

@@ -1,53 +0,0 @@
-def simple_assign():
-    x = 1
-    return x
-
-
-def reassignment():
-    x = 1
-    x = 2
-    return x
-
-
-def if_else_branch(cond):
-    if cond:
-        x = 1
-    else:
-        x = 2
-    return x
-
-
-def loop(xs):
-    total = 0
-    for x in xs:
-        total = total + x
-    return total
-
-
-def parameter(a, b=2, *args, **kwargs):
-    return a + b + sum(args)
-
-
-def closure(x):
-    def inner():
-        return x
-    return inner
-
-
-def exception_binding():
-    try:
-        compute()
-    except Exception as e:
-        return e
-
-
-def with_binding():
-    with open("file") as f:
-        return f.read()
-
-
-GLOBAL = 1
-
-
-def read_global():
-    return GLOBAL

python/ql/test/library-tests/dataflow-new-ssa/SsaTest.ql

@@ -1,59 +0,0 @@
-/**
- * Inline-expectations test for the new-CFG SSA adapter
- * (`semmle.python.dataflow.new.internal.SsaImpl`).
- *
- * Tags:
- *   - `def=<var>`: there is an SSA write definition of `<var>` at this
- *     line (parameter init, plain assignment, augmented assignment,
- *     exception-handler binding, deletion, etc.).
- *   - `use=<var>`: `<var>` is used at this line, and some SSA definition
- *     of `<var>` reaches the read.
- *   - `phi=<var>`: there is an SSA phi definition of `<var>` whose BB
- *     starts on this line.
- */
-
-import python
-import semmle.python.dataflow.new.internal.SsaImpl as SsaImpl
-import semmle.python.controlflow.internal.AstNodeImpl as CfgImpl
-import semmle.python.controlflow.internal.Cfg as Cfg
-import utils.test.InlineExpectationsTest
-
-module SsaTest implements TestSig {
-  string getARelevantTag() { result = ["def", "use", "phi"] }
-
-  predicate hasActualResult(Location location, string element, string tag, string value) {
-    // A `def=<id>` fires when an SSA WriteDefinition is at a CFG node
-    // on the given line.
-    exists(SsaImpl::Ssa::WriteDefinition def, CfgImpl::BasicBlock bb, int i, Cfg::NameNode n |
-      def.definesAt(_, bb, i) and
-      bb.getNode(i) = n and
-      tag = "def" and
-      location = n.getLocation() and
-      element = n.toString() and
-      value = n.getId()
-    )
-    or
-    // A `use=<id>` fires when an SSA Definition reaches a read at this
-    // CFG node.
-    exists(SsaImpl::Ssa::Definition def, CfgImpl::BasicBlock bb, int i, Cfg::NameNode n |
-      SsaImpl::Ssa::ssaDefReachesRead(_, def, bb, i) and
-      bb.getNode(i) = n and
-      tag = "use" and
-      location = n.getLocation() and
-      element = n.toString() and
-      value = n.getId()
-    )
-    or
-    // A `phi=<id>` fires when there is a phi node whose BB's first
-    // CFG node is on the given line.
-    exists(SsaImpl::Ssa::PhiNode phi, CfgImpl::BasicBlock bb |
-      phi.definesAt(_, bb, _) and
-      tag = "phi" and
-      location = bb.getNode(0).getLocation() and
-      element = bb.toString() and
-      value = phi.getSourceVariable().(SsaImpl::SsaSourceVariable).getVariable().getId()
-    )
-  }
-}
-
-import MakeTest<SsaTest>

python/ql/test/library-tests/dataflow-new-ssa/test.py

@@ -1,48 +0,0 @@
-# Basic SSA tests for the new-CFG SSA adapter.
-#
-# The shared SSA implementation prunes its construction by liveness:
-# definitions of variables that are not read are never materialised.
-# This is by design — write-only variables would only bloat the SSA
-# graph. Tests therefore must always include a read of each variable
-# being verified.
-#
-# Annotations:
-#   def=<var>: there is an SSA write definition of <var> at this line
-#   use=<var>: <var> is used here and the read resolves to some def
-#
-# Note: a module-level `def name(...)` statement is itself a write
-# definition of the module global `name`, which is live (it can be read
-# externally), so every function below carries a `def=<name>` annotation
-# on its `def` line.
-
-
-def basic_param(x):  # $ def=basic_param def=x
-    return x  # $ use=x
-
-
-def basic_assign():  # $ def=basic_assign
-    y = 1  # $ def=y
-    return y  # $ use=y
-
-
-def reassignment():  # $ def=reassignment
-    x = 1
-    x = 2  # $ def=x
-    return x  # $ use=x
-
-
-def if_else_phi(cond):  # $ def=if_else_phi def=cond
-    if cond:  # $ use=cond phi=x
-        x = 1  # $ def=x
-    else:
-        x = 2  # $ def=x
-    return x  # $ use=x
-
-
-# `some_undefined` is never assigned anywhere, so (matching legacy ESSA)
-# the SSA library creates no entry definition for it: an undefined-name
-# read resolves to no SSA def, hence there is no `use=` here.
-def use_global():  # $ def=use_global
-    return some_undefined
-
-