-
\ No newline at end of file
+
diff --git a/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql b/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql
index 6a55557cf70b..8e921faf2117 100644
--- a/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql
+++ b/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql
@@ -5,7 +5,7 @@
* may lead to unpredictable behavior.
* @kind problem
* @problem.severity warning
- * @precision medium
+ * @precision high
* @id cpp/implicit-function-declaration
* @tags correctness
* maintainability
@@ -17,6 +17,11 @@ import TooFewArguments
import TooManyArguments
import semmle.code.cpp.commons.Exclusions
+/*
+ * This query is not compatible with build-mode: none databases, and produces
+ * no results on those databases.
+ */
+
predicate locInfo(Locatable e, File file, int line, int col) {
e.getFile() = file and
e.getLocation().getStartLine() = line and
@@ -39,6 +44,7 @@ predicate isCompiledAsC(File f) {
from FunctionDeclarationEntry fdeIm, FunctionCall fc
where
isCompiledAsC(fdeIm.getFile()) and
+ not any(Compilation c).buildModeNone() and
not isFromMacroDefinition(fc) and
fdeIm.isImplicit() and
sameLocation(fdeIm, fc) and
diff --git a/cpp/ql/src/Likely Bugs/Underspecified Functions/MistypedFunctionArguments.qll b/cpp/ql/src/Likely Bugs/Underspecified Functions/MistypedFunctionArguments.qll
index 2dced5d8d844..dbb457db505e 100644
--- a/cpp/ql/src/Likely Bugs/Underspecified Functions/MistypedFunctionArguments.qll
+++ b/cpp/ql/src/Likely Bugs/Underspecified Functions/MistypedFunctionArguments.qll
@@ -79,9 +79,7 @@ private predicate hasZeroParamDecl(Function f) {
// True if this file (or header) was compiled as a C file
private predicate isCompiledAsC(File f) {
- f.compiledAsC()
- or
- exists(File src | isCompiledAsC(src) | src.getAnIncludedFile() = f)
+ exists(File src | src.compiledAsC() | src.getAnIncludedFile*() = f)
}
predicate mistypedFunctionArguments(FunctionCall fc, Function f, Parameter p) {
diff --git a/cpp/ql/src/Likely Bugs/Underspecified Functions/TooFewArguments.qll b/cpp/ql/src/Likely Bugs/Underspecified Functions/TooFewArguments.qll
index 218a54b36c51..fd323513a49e 100644
--- a/cpp/ql/src/Likely Bugs/Underspecified Functions/TooFewArguments.qll
+++ b/cpp/ql/src/Likely Bugs/Underspecified Functions/TooFewArguments.qll
@@ -28,9 +28,7 @@ private predicate hasZeroParamDecl(Function f) {
/* Holds if this file (or header) was compiled as a C file. */
private predicate isCompiledAsC(File f) {
- f.compiledAsC()
- or
- exists(File src | isCompiledAsC(src) | src.getAnIncludedFile() = f)
+ exists(File src | src.compiledAsC() | src.getAnIncludedFile*() = f)
}
/** Holds if `fc` is a call to `f` with too few arguments. */
diff --git a/cpp/ql/src/Likely Bugs/Underspecified Functions/TooManyArguments.qll b/cpp/ql/src/Likely Bugs/Underspecified Functions/TooManyArguments.qll
index 7fba78b5550e..ab2a98ae3a55 100644
--- a/cpp/ql/src/Likely Bugs/Underspecified Functions/TooManyArguments.qll
+++ b/cpp/ql/src/Likely Bugs/Underspecified Functions/TooManyArguments.qll
@@ -19,9 +19,7 @@ private predicate hasZeroParamDecl(Function f) {
// True if this file (or header) was compiled as a C file
private predicate isCompiledAsC(File f) {
- f.compiledAsC()
- or
- exists(File src | isCompiledAsC(src) | src.getAnIncludedFile() = f)
+ exists(File src | src.compiledAsC() | src.getAnIncludedFile*() = f)
}
predicate tooManyArguments(FunctionCall fc, Function f) {
diff --git a/cpp/ql/src/Security/CWE/CWE-190/ComparisonWithWiderType.ql b/cpp/ql/src/Security/CWE/CWE-190/ComparisonWithWiderType.ql
index 3f330807304f..7d9ef88adea1 100644
--- a/cpp/ql/src/Security/CWE/CWE-190/ComparisonWithWiderType.ql
+++ b/cpp/ql/src/Security/CWE/CWE-190/ComparisonWithWiderType.ql
@@ -6,7 +6,7 @@
* @kind problem
* @problem.severity warning
* @security-severity 7.8
- * @precision medium
+ * @precision high
* @tags reliability
* security
* external/cwe/cwe-190
diff --git a/cpp/ql/src/Security/CWE/CWE-468/SuspiciousAddWithSizeof.ql b/cpp/ql/src/Security/CWE/CWE-468/SuspiciousAddWithSizeof.ql
index 343e96a00d39..d5a5cd8f6655 100644
--- a/cpp/ql/src/Security/CWE/CWE-468/SuspiciousAddWithSizeof.ql
+++ b/cpp/ql/src/Security/CWE/CWE-468/SuspiciousAddWithSizeof.ql
@@ -6,7 +6,7 @@
* @kind problem
* @problem.severity warning
* @security-severity 8.8
- * @precision medium
+ * @precision high
* @id cpp/suspicious-add-sizeof
* @tags security
* external/cwe/cwe-468
diff --git a/cpp/ql/src/change-notes/released/1.6.1.md b/cpp/ql/src/change-notes/released/1.6.1.md
new file mode 100644
index 000000000000..02ca1c2cd064
--- /dev/null
+++ b/cpp/ql/src/change-notes/released/1.6.1.md
@@ -0,0 +1,10 @@
+## 1.6.1
+
+### Minor Analysis Improvements
+
+* Added `AllocationFunction` models for `aligned_alloc`, `std::aligned_alloc`, and `bsl::aligned_alloc`.
+* The "Comparison of narrow type with wide type in loop condition" (`cpp/comparison-with-wider-type`) query has been upgraded to `high` precision. This query will now run in the default code scanning suite.
+* The "Multiplication result converted to larger type" (`cpp/integer-multiplication-cast-to-long`) query has been upgraded to `high` precision. This query will now run in the default code scanning suite.
+* The "Suspicious add with sizeof" (`cpp/suspicious-add-sizeof`) query has been upgraded to `high` precision. This query will now run in the default code scanning suite.
+* The "Wrong type of arguments to formatting function" (`cpp/wrong-type-format-argument`) query has been upgraded to `high` precision. This query will now run in the default code scanning suite.
+* The "Implicit function declaration" (`cpp/implicit-function-declaration`) query has been upgraded to `high` precision. However, for `build-mode: none` databases, it no longer produces any results. The results in this mode were found to be very noisy and fundamentally imprecise.
diff --git a/cpp/ql/src/change-notes/released/1.6.2.md b/cpp/ql/src/change-notes/released/1.6.2.md
new file mode 100644
index 000000000000..bbe3747556fb
--- /dev/null
+++ b/cpp/ql/src/change-notes/released/1.6.2.md
@@ -0,0 +1,3 @@
+## 1.6.2
+
+No user-facing changes.
diff --git a/cpp/ql/src/change-notes/released/1.6.3.md b/cpp/ql/src/change-notes/released/1.6.3.md
new file mode 100644
index 000000000000..bd2b7c9bdb1e
--- /dev/null
+++ b/cpp/ql/src/change-notes/released/1.6.3.md
@@ -0,0 +1,5 @@
+## 1.6.3
+
+### Minor Analysis Improvements
+
+* The 'Cleartext transmission of sensitive information' query (`cpp/cleartext-transmission`) no longer raises an alert on calls to `fscanf` (and variants) when the call reads from an "obviously local" `FILE` stream such as `stdin`.
diff --git a/cpp/ql/src/codeql-pack.release.yml b/cpp/ql/src/codeql-pack.release.yml
index c4f0b07d5336..00b51441d882 100644
--- a/cpp/ql/src/codeql-pack.release.yml
+++ b/cpp/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.6.0
+lastReleaseVersion: 1.6.3
diff --git a/cpp/ql/src/qlpack.yml b/cpp/ql/src/qlpack.yml
index fa0391ae9c15..a57263b53fc5 100644
--- a/cpp/ql/src/qlpack.yml
+++ b/cpp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/cpp-queries
-version: 1.6.0
+version: 1.6.3
groups:
- cpp
- queries
diff --git a/cpp/ql/test/library-tests/builtins/complex/builtin.expected b/cpp/ql/test/library-tests/builtins/complex/builtin.expected
index c1b9b18a4126..2537ff065ac6 100644
--- a/cpp/ql/test/library-tests/builtins/complex/builtin.expected
+++ b/cpp/ql/test/library-tests/builtins/complex/builtin.expected
@@ -1,4 +1,4 @@
| complex.c:3:23:3:51 | __builtin_complex | file://:0:0:0:0 | _Complex double | complex.c:3:41:3:44 | real | file://:0:0:0:0 | double | complex.c:3:47:3:50 | imag | file://:0:0:0:0 | double |
-| complex.c:4:23:4:57 | __builtin_complex | file://:0:0:0:0 | _Complex double | complex.c:4:41:4:47 | 2.71828000000000003 | file://:0:0:0:0 | double | complex.c:4:50:4:56 | 3.141589999999999883 | file://:0:0:0:0 | double |
+| complex.c:4:23:4:57 | __builtin_complex | file://:0:0:0:0 | _Complex double | complex.c:4:41:4:47 | 2.71828 | file://:0:0:0:0 | double | complex.c:4:50:4:56 | 3.14159 | file://:0:0:0:0 | double |
| complex.c:8:22:8:52 | __builtin_complex | file://:0:0:0:0 | _Complex float | complex.c:8:40:8:44 | realf | file://:0:0:0:0 | float | complex.c:8:47:8:51 | imagf | file://:0:0:0:0 | float |
-| complex.c:9:22:9:52 | __builtin_complex | file://:0:0:0:0 | _Complex float | complex.c:9:40:9:44 | 1.230000019 | file://:0:0:0:0 | float | complex.c:9:47:9:51 | 4.559999943 | file://:0:0:0:0 | float |
+| complex.c:9:22:9:52 | __builtin_complex | file://:0:0:0:0 | _Complex float | complex.c:9:40:9:44 | 1.23 | file://:0:0:0:0 | float | complex.c:9:47:9:51 | 4.56 | file://:0:0:0:0 | float |
diff --git a/cpp/ql/test/library-tests/controlflow/guards/GuardsCompare.expected b/cpp/ql/test/library-tests/controlflow/guards/GuardsCompare.expected
index 4d78c4016dab..f6833ab4ff13 100644
--- a/cpp/ql/test/library-tests/controlflow/guards/GuardsCompare.expected
+++ b/cpp/ql/test/library-tests/controlflow/guards/GuardsCompare.expected
@@ -298,16 +298,16 @@
| test.c:182:8:182:34 | ! ... | ! ... == 1 when ! ... is true |
| test.c:182:8:182:34 | ! ... | ... && ... != 0 when ! ... is false |
| test.c:182:8:182:34 | ! ... | ... && ... == 0 when ! ... is true |
-| test.c:182:10:182:20 | ... >= ... | 9.999999999999999547e-07 < foo+1 when ... >= ... is true |
-| test.c:182:10:182:20 | ... >= ... | 9.999999999999999547e-07 >= foo+1 when ... >= ... is false |
+| test.c:182:10:182:20 | ... >= ... | 1.0E-6 < foo+1 when ... >= ... is true |
+| test.c:182:10:182:20 | ... >= ... | 1.0E-6 >= foo+1 when ... >= ... is false |
| test.c:182:10:182:20 | ... >= ... | ... >= ... != 0 when ... >= ... is true |
| test.c:182:10:182:20 | ... >= ... | ... >= ... != 1 when ... >= ... is false |
| test.c:182:10:182:20 | ... >= ... | ... >= ... == 0 when ... >= ... is false |
| test.c:182:10:182:20 | ... >= ... | ... >= ... == 1 when ... >= ... is true |
-| test.c:182:10:182:20 | ... >= ... | foo < 9.999999999999999547e-07+0 when ... >= ... is false |
-| test.c:182:10:182:20 | ... >= ... | foo >= 9.999999999999999547e-07+0 when ... >= ... is true |
+| test.c:182:10:182:20 | ... >= ... | foo < 1.0E-6+0 when ... >= ... is false |
+| test.c:182:10:182:20 | ... >= ... | foo >= 1.0E-6+0 when ... >= ... is true |
| test.c:182:10:182:33 | ... && ... | 1.0 >= foo+1 when ... && ... is true |
-| test.c:182:10:182:33 | ... && ... | 9.999999999999999547e-07 < foo+1 when ... && ... is true |
+| test.c:182:10:182:33 | ... && ... | 1.0E-6 < foo+1 when ... && ... is true |
| test.c:182:10:182:33 | ... && ... | ! ... != 0 when ... && ... is false |
| test.c:182:10:182:33 | ... && ... | ! ... != 1 when ... && ... is true |
| test.c:182:10:182:33 | ... && ... | ! ... == 0 when ... && ... is true |
@@ -319,7 +319,7 @@
| test.c:182:10:182:33 | ... && ... | ... >= ... != 0 when ... && ... is true |
| test.c:182:10:182:33 | ... && ... | ... >= ... == 1 when ... && ... is true |
| test.c:182:10:182:33 | ... && ... | foo < 1.0+0 when ... && ... is true |
-| test.c:182:10:182:33 | ... && ... | foo >= 9.999999999999999547e-07+0 when ... && ... is true |
+| test.c:182:10:182:33 | ... && ... | foo >= 1.0E-6+0 when ... && ... is true |
| test.c:182:25:182:33 | ... < ... | 1.0 < foo+1 when ... < ... is false |
| test.c:182:25:182:33 | ... < ... | 1.0 >= foo+1 when ... < ... is true |
| test.c:182:25:182:33 | ... < ... | ... < ... != 0 when ... < ... is true |
diff --git a/cpp/ql/test/library-tests/controlflow/guards/GuardsEnsure.expected b/cpp/ql/test/library-tests/controlflow/guards/GuardsEnsure.expected
index 5a364e3deaad..cf99d2c20b8d 100644
--- a/cpp/ql/test/library-tests/controlflow/guards/GuardsEnsure.expected
+++ b/cpp/ql/test/library-tests/controlflow/guards/GuardsEnsure.expected
@@ -169,12 +169,12 @@ binary
| test.c:176:8:176:15 | ! ... | test.c:176:14:176:14 | b | < | test.c:176:10:176:10 | a | 1 | test.c:176:18:178:5 | { ... } |
| test.c:176:10:176:14 | ... < ... | test.c:176:10:176:10 | a | >= | test.c:176:14:176:14 | b | 0 | test.c:176:18:178:5 | { ... } |
| test.c:176:10:176:14 | ... < ... | test.c:176:14:176:14 | b | < | test.c:176:10:176:10 | a | 1 | test.c:176:18:178:5 | { ... } |
-| test.c:182:10:182:20 | ... >= ... | test.c:182:10:182:12 | foo | >= | test.c:182:17:182:20 | 9.999999999999999547e-07 | 0 | test.c:181:25:182:20 | { ... } |
-| test.c:182:10:182:20 | ... >= ... | test.c:182:10:182:12 | foo | >= | test.c:182:17:182:20 | 9.999999999999999547e-07 | 0 | test.c:182:25:182:33 | foo |
-| test.c:182:10:182:20 | ... >= ... | test.c:182:17:182:20 | 9.999999999999999547e-07 | < | test.c:182:10:182:12 | foo | 1 | test.c:181:25:182:20 | { ... } |
-| test.c:182:10:182:20 | ... >= ... | test.c:182:17:182:20 | 9.999999999999999547e-07 | < | test.c:182:10:182:12 | foo | 1 | test.c:182:25:182:33 | foo |
-| test.c:182:10:182:33 | ... && ... | test.c:182:10:182:12 | foo | >= | test.c:182:17:182:20 | 9.999999999999999547e-07 | 0 | test.c:181:25:182:20 | { ... } |
-| test.c:182:10:182:33 | ... && ... | test.c:182:17:182:20 | 9.999999999999999547e-07 | < | test.c:182:10:182:12 | foo | 1 | test.c:181:25:182:20 | { ... } |
+| test.c:182:10:182:20 | ... >= ... | test.c:182:10:182:12 | foo | >= | test.c:182:17:182:20 | 1.0E-6 | 0 | test.c:181:25:182:20 | { ... } |
+| test.c:182:10:182:20 | ... >= ... | test.c:182:10:182:12 | foo | >= | test.c:182:17:182:20 | 1.0E-6 | 0 | test.c:182:25:182:33 | foo |
+| test.c:182:10:182:20 | ... >= ... | test.c:182:17:182:20 | 1.0E-6 | < | test.c:182:10:182:12 | foo | 1 | test.c:181:25:182:20 | { ... } |
+| test.c:182:10:182:20 | ... >= ... | test.c:182:17:182:20 | 1.0E-6 | < | test.c:182:10:182:12 | foo | 1 | test.c:182:25:182:33 | foo |
+| test.c:182:10:182:33 | ... && ... | test.c:182:10:182:12 | foo | >= | test.c:182:17:182:20 | 1.0E-6 | 0 | test.c:181:25:182:20 | { ... } |
+| test.c:182:10:182:33 | ... && ... | test.c:182:17:182:20 | 1.0E-6 | < | test.c:182:10:182:12 | foo | 1 | test.c:181:25:182:20 | { ... } |
| test.c:182:10:182:33 | ... && ... | test.c:182:25:182:27 | foo | < | test.c:182:31:182:33 | 1.0 | 0 | test.c:181:25:182:20 | { ... } |
| test.c:182:10:182:33 | ... && ... | test.c:182:31:182:33 | 1.0 | >= | test.c:182:25:182:27 | foo | 1 | test.c:181:25:182:20 | { ... } |
| test.c:182:25:182:33 | ... < ... | test.c:182:25:182:27 | foo | < | test.c:182:31:182:33 | 1.0 | 0 | test.c:181:25:182:20 | { ... } |
diff --git a/cpp/ql/test/library-tests/dataflow/source-sink-tests/sources-and-sinks.cpp b/cpp/ql/test/library-tests/dataflow/source-sink-tests/sources-and-sinks.cpp
index c515a199f077..e4947a112f8d 100644
--- a/cpp/ql/test/library-tests/dataflow/source-sink-tests/sources-and-sinks.cpp
+++ b/cpp/ql/test/library-tests/dataflow/source-sink-tests/sources-and-sinks.cpp
@@ -115,3 +115,19 @@ void test_zmc(void *socket) {
// ...
}
}
+
+long StringCchGetsA(char *, size_t);
+long StringCchGetsExA(char *, size_t, char **, size_t *, unsigned long);
+
+void test_strsafe_gets() {
+ {
+ char dest[256] = {0};
+ StringCchGetsA(dest, sizeof(dest)); // $ local_source
+ }
+ {
+ char dest[256] = {0};
+ char *end;
+ size_t remaining;
+ StringCchGetsExA(dest, sizeof(dest), &end, &remaining, 0); // $ local_source
+ }
+}
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
index 0f4d67f2695f..d4d961a3a048 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
@@ -4928,6 +4928,8 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| stl.h:95:69:95:69 | x | stl.h:96:42:96:42 | x | |
| stl.h:96:42:96:42 | ref arg x | stl.h:95:69:95:69 | x | |
| stl.h:96:42:96:42 | ref arg x | stl.h:95:69:95:69 | x | |
+| stl.h:292:30:292:40 | 0 | file://:0:0:0:0 | noexcept(...) | TAINT |
+| stl.h:292:30:292:40 | 0 | file://:0:0:0:0 | noexcept(...) | TAINT |
| stl.h:292:30:292:40 | call to allocator | stl.h:292:21:292:41 | noexcept(...) | TAINT |
| stl.h:292:30:292:40 | call to allocator | stl.h:292:21:292:41 | noexcept(...) | TAINT |
| stl.h:292:30:292:40 | call to allocator | stl.h:292:21:292:41 | noexcept(...) | TAINT |
@@ -8008,6 +8010,174 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| taint.cpp:866:26:866:34 | ref arg & ... | taint.cpp:866:27:866:34 | size_out [inner post update] | |
| taint.cpp:866:27:866:34 | size_out | taint.cpp:866:26:866:34 | & ... | |
| taint.cpp:867:8:867:8 | p | taint.cpp:867:7:867:8 | * ... | TAINT |
+| taint.cpp:892:17:892:31 | call to indirect_source | taint.cpp:897:38:897:43 | source | |
+| taint.cpp:892:17:892:31 | call to indirect_source | taint.cpp:907:37:907:42 | source | |
+| taint.cpp:892:17:892:31 | call to indirect_source | taint.cpp:914:40:914:45 | source | |
+| taint.cpp:892:17:892:31 | call to indirect_source | taint.cpp:919:39:919:44 | source | |
+| taint.cpp:892:17:892:31 | call to indirect_source | taint.cpp:926:41:926:46 | source | |
+| taint.cpp:892:17:892:31 | call to indirect_source | taint.cpp:931:37:931:42 | source | |
+| taint.cpp:892:17:892:31 | call to indirect_source | taint.cpp:941:36:941:41 | source | |
+| taint.cpp:892:17:892:31 | call to indirect_source | taint.cpp:948:39:948:44 | source | |
+| taint.cpp:892:17:892:31 | call to indirect_source | taint.cpp:953:38:953:43 | source | |
+| taint.cpp:892:17:892:31 | call to indirect_source | taint.cpp:960:40:960:45 | source | |
+| taint.cpp:892:17:892:31 | call to indirect_source | taint.cpp:965:46:965:51 | source | |
+| taint.cpp:892:17:892:31 | call to indirect_source | taint.cpp:975:45:975:50 | source | |
+| taint.cpp:892:17:892:31 | call to indirect_source | taint.cpp:982:69:982:74 | source | |
+| taint.cpp:893:32:893:46 | call to indirect_source | taint.cpp:902:38:902:44 | wsource | |
+| taint.cpp:893:32:893:46 | call to indirect_source | taint.cpp:936:37:936:43 | wsource | |
+| taint.cpp:893:32:893:46 | call to indirect_source | taint.cpp:970:47:970:53 | wsource | |
+| taint.cpp:896:19:896:22 | {...} | taint.cpp:897:18:897:21 | dest | |
+| taint.cpp:896:19:896:22 | {...} | taint.cpp:897:31:897:34 | dest | |
+| taint.cpp:896:19:896:22 | {...} | taint.cpp:898:9:898:12 | dest | |
+| taint.cpp:896:21:896:21 | 0 | taint.cpp:896:19:896:22 | {...} | TAINT |
+| taint.cpp:897:18:897:21 | ref arg dest | taint.cpp:898:9:898:12 | dest | |
+| taint.cpp:898:9:898:12 | dest | taint.cpp:898:8:898:12 | * ... | |
+| taint.cpp:901:22:901:25 | {...} | taint.cpp:902:18:902:21 | dest | |
+| taint.cpp:901:22:901:25 | {...} | taint.cpp:902:31:902:34 | dest | |
+| taint.cpp:901:22:901:25 | {...} | taint.cpp:903:9:903:12 | dest | |
+| taint.cpp:901:24:901:24 | 0 | taint.cpp:901:22:901:25 | {...} | TAINT |
+| taint.cpp:902:18:902:21 | ref arg dest | taint.cpp:903:9:903:12 | dest | |
+| taint.cpp:903:9:903:12 | dest | taint.cpp:903:8:903:12 | * ... | |
+| taint.cpp:906:19:906:22 | {...} | taint.cpp:907:17:907:20 | dest | |
+| taint.cpp:906:19:906:22 | {...} | taint.cpp:907:30:907:33 | dest | |
+| taint.cpp:906:19:906:22 | {...} | taint.cpp:908:9:908:12 | dest | |
+| taint.cpp:906:21:906:21 | 0 | taint.cpp:906:19:906:22 | {...} | TAINT |
+| taint.cpp:907:17:907:20 | ref arg dest | taint.cpp:908:9:908:12 | dest | |
+| taint.cpp:908:9:908:12 | dest | taint.cpp:908:8:908:12 | * ... | |
+| taint.cpp:911:19:911:22 | {...} | taint.cpp:914:20:914:23 | dest | |
+| taint.cpp:911:19:911:22 | {...} | taint.cpp:914:33:914:36 | dest | |
+| taint.cpp:911:19:911:22 | {...} | taint.cpp:915:9:915:12 | dest | |
+| taint.cpp:911:21:911:21 | 0 | taint.cpp:911:19:911:22 | {...} | TAINT |
+| taint.cpp:912:9:912:11 | end | taint.cpp:914:49:914:51 | end | |
+| taint.cpp:913:10:913:18 | remaining | taint.cpp:914:55:914:63 | remaining | |
+| taint.cpp:914:20:914:23 | ref arg dest | taint.cpp:915:9:915:12 | dest | |
+| taint.cpp:914:48:914:51 | ref arg & ... | taint.cpp:914:49:914:51 | end [inner post update] | |
+| taint.cpp:914:49:914:51 | end | taint.cpp:914:48:914:51 | & ... | |
+| taint.cpp:914:54:914:63 | ref arg & ... | taint.cpp:914:55:914:63 | remaining [inner post update] | |
+| taint.cpp:914:55:914:63 | remaining | taint.cpp:914:54:914:63 | & ... | |
+| taint.cpp:915:9:915:12 | dest | taint.cpp:915:8:915:12 | * ... | |
+| taint.cpp:918:19:918:22 | {...} | taint.cpp:919:19:919:22 | dest | |
+| taint.cpp:918:19:918:22 | {...} | taint.cpp:919:32:919:35 | dest | |
+| taint.cpp:918:19:918:22 | {...} | taint.cpp:920:9:920:12 | dest | |
+| taint.cpp:918:21:918:21 | 0 | taint.cpp:918:19:918:22 | {...} | TAINT |
+| taint.cpp:919:19:919:22 | ref arg dest | taint.cpp:920:9:920:12 | dest | |
+| taint.cpp:920:9:920:12 | dest | taint.cpp:920:8:920:12 | * ... | |
+| taint.cpp:923:19:923:22 | {...} | taint.cpp:926:21:926:24 | dest | |
+| taint.cpp:923:19:923:22 | {...} | taint.cpp:926:34:926:37 | dest | |
+| taint.cpp:923:19:923:22 | {...} | taint.cpp:927:8:927:11 | dest | |
+| taint.cpp:923:21:923:21 | 0 | taint.cpp:923:19:923:22 | {...} | TAINT |
+| taint.cpp:924:9:924:11 | end | taint.cpp:926:55:926:57 | end | |
+| taint.cpp:925:10:925:18 | remaining | taint.cpp:926:61:926:69 | remaining | |
+| taint.cpp:926:21:926:24 | ref arg dest | taint.cpp:927:8:927:11 | dest | |
+| taint.cpp:926:54:926:57 | ref arg & ... | taint.cpp:926:55:926:57 | end [inner post update] | |
+| taint.cpp:926:55:926:57 | end | taint.cpp:926:54:926:57 | & ... | |
+| taint.cpp:926:60:926:69 | ref arg & ... | taint.cpp:926:61:926:69 | remaining [inner post update] | |
+| taint.cpp:926:61:926:69 | remaining | taint.cpp:926:60:926:69 | & ... | |
+| taint.cpp:930:20:930:27 | prefix | taint.cpp:931:17:931:20 | dest | |
+| taint.cpp:930:20:930:27 | prefix | taint.cpp:931:30:931:33 | dest | |
+| taint.cpp:930:20:930:27 | prefix | taint.cpp:932:9:932:12 | dest | |
+| taint.cpp:931:17:931:20 | ref arg dest | taint.cpp:932:9:932:12 | dest | |
+| taint.cpp:932:9:932:12 | dest | taint.cpp:932:8:932:12 | * ... | |
+| taint.cpp:935:23:935:31 | prefix | taint.cpp:936:17:936:20 | dest | |
+| taint.cpp:935:23:935:31 | prefix | taint.cpp:936:30:936:33 | dest | |
+| taint.cpp:935:23:935:31 | prefix | taint.cpp:937:9:937:12 | dest | |
+| taint.cpp:936:17:936:20 | ref arg dest | taint.cpp:937:9:937:12 | dest | |
+| taint.cpp:937:9:937:12 | dest | taint.cpp:937:8:937:12 | * ... | |
+| taint.cpp:940:20:940:27 | prefix | taint.cpp:941:16:941:19 | dest | |
+| taint.cpp:940:20:940:27 | prefix | taint.cpp:941:29:941:32 | dest | |
+| taint.cpp:940:20:940:27 | prefix | taint.cpp:942:9:942:12 | dest | |
+| taint.cpp:941:16:941:19 | ref arg dest | taint.cpp:942:9:942:12 | dest | |
+| taint.cpp:942:9:942:12 | dest | taint.cpp:942:8:942:12 | * ... | |
+| taint.cpp:945:20:945:27 | prefix | taint.cpp:948:19:948:22 | dest | |
+| taint.cpp:945:20:945:27 | prefix | taint.cpp:948:32:948:35 | dest | |
+| taint.cpp:945:20:945:27 | prefix | taint.cpp:949:9:949:12 | dest | |
+| taint.cpp:946:9:946:11 | end | taint.cpp:948:48:948:50 | end | |
+| taint.cpp:947:10:947:18 | remaining | taint.cpp:948:54:948:62 | remaining | |
+| taint.cpp:948:19:948:22 | ref arg dest | taint.cpp:949:9:949:12 | dest | |
+| taint.cpp:948:47:948:50 | ref arg & ... | taint.cpp:948:48:948:50 | end [inner post update] | |
+| taint.cpp:948:48:948:50 | end | taint.cpp:948:47:948:50 | & ... | |
+| taint.cpp:948:53:948:62 | ref arg & ... | taint.cpp:948:54:948:62 | remaining [inner post update] | |
+| taint.cpp:948:54:948:62 | remaining | taint.cpp:948:53:948:62 | & ... | |
+| taint.cpp:949:9:949:12 | dest | taint.cpp:949:8:949:12 | * ... | |
+| taint.cpp:952:20:952:27 | prefix | taint.cpp:953:18:953:21 | dest | |
+| taint.cpp:952:20:952:27 | prefix | taint.cpp:953:31:953:34 | dest | |
+| taint.cpp:952:20:952:27 | prefix | taint.cpp:954:9:954:12 | dest | |
+| taint.cpp:953:18:953:21 | ref arg dest | taint.cpp:954:9:954:12 | dest | |
+| taint.cpp:954:9:954:12 | dest | taint.cpp:954:8:954:12 | * ... | |
+| taint.cpp:957:20:957:27 | prefix | taint.cpp:960:20:960:23 | dest | |
+| taint.cpp:957:20:957:27 | prefix | taint.cpp:960:33:960:36 | dest | |
+| taint.cpp:957:20:957:27 | prefix | taint.cpp:961:9:961:12 | dest | |
+| taint.cpp:958:9:958:11 | end | taint.cpp:960:54:960:56 | end | |
+| taint.cpp:959:10:959:18 | remaining | taint.cpp:960:60:960:68 | remaining | |
+| taint.cpp:960:20:960:23 | ref arg dest | taint.cpp:961:9:961:12 | dest | |
+| taint.cpp:960:53:960:56 | ref arg & ... | taint.cpp:960:54:960:56 | end [inner post update] | |
+| taint.cpp:960:54:960:56 | end | taint.cpp:960:53:960:56 | & ... | |
+| taint.cpp:960:59:960:68 | ref arg & ... | taint.cpp:960:60:960:68 | remaining [inner post update] | |
+| taint.cpp:960:60:960:68 | remaining | taint.cpp:960:59:960:68 | & ... | |
+| taint.cpp:961:9:961:12 | dest | taint.cpp:961:8:961:12 | * ... | |
+| taint.cpp:964:19:964:22 | {...} | taint.cpp:965:20:965:23 | dest | |
+| taint.cpp:964:19:964:22 | {...} | taint.cpp:965:33:965:36 | dest | |
+| taint.cpp:964:19:964:22 | {...} | taint.cpp:966:9:966:12 | dest | |
+| taint.cpp:964:21:964:21 | 0 | taint.cpp:964:19:964:22 | {...} | TAINT |
+| taint.cpp:965:20:965:23 | ref arg dest | taint.cpp:966:9:966:12 | dest | |
+| taint.cpp:965:40:965:43 | %s | taint.cpp:965:20:965:23 | ref arg dest | TAINT |
+| taint.cpp:965:46:965:51 | ref arg source | taint.cpp:975:45:975:50 | source | |
+| taint.cpp:965:46:965:51 | ref arg source | taint.cpp:982:69:982:74 | source | |
+| taint.cpp:965:46:965:51 | source | taint.cpp:965:20:965:23 | ref arg dest | TAINT |
+| taint.cpp:966:9:966:12 | dest | taint.cpp:966:8:966:12 | * ... | |
+| taint.cpp:969:22:969:25 | {...} | taint.cpp:970:20:970:23 | dest | |
+| taint.cpp:969:22:969:25 | {...} | taint.cpp:970:33:970:36 | dest | |
+| taint.cpp:969:22:969:25 | {...} | taint.cpp:971:9:971:12 | dest | |
+| taint.cpp:969:24:969:24 | 0 | taint.cpp:969:22:969:25 | {...} | TAINT |
+| taint.cpp:970:20:970:23 | ref arg dest | taint.cpp:971:9:971:12 | dest | |
+| taint.cpp:970:40:970:44 | %s | taint.cpp:970:20:970:23 | ref arg dest | TAINT |
+| taint.cpp:970:47:970:53 | wsource | taint.cpp:970:20:970:23 | ref arg dest | TAINT |
+| taint.cpp:971:9:971:12 | dest | taint.cpp:971:8:971:12 | * ... | |
+| taint.cpp:974:19:974:22 | {...} | taint.cpp:975:19:975:22 | dest | |
+| taint.cpp:974:19:974:22 | {...} | taint.cpp:975:32:975:35 | dest | |
+| taint.cpp:974:19:974:22 | {...} | taint.cpp:976:9:976:12 | dest | |
+| taint.cpp:974:21:974:21 | 0 | taint.cpp:974:19:974:22 | {...} | TAINT |
+| taint.cpp:975:19:975:22 | ref arg dest | taint.cpp:976:9:976:12 | dest | |
+| taint.cpp:975:39:975:42 | %s | taint.cpp:975:19:975:22 | ref arg dest | TAINT |
+| taint.cpp:975:45:975:50 | ref arg source | taint.cpp:982:69:982:74 | source | |
+| taint.cpp:975:45:975:50 | source | taint.cpp:975:19:975:22 | ref arg dest | TAINT |
+| taint.cpp:976:9:976:12 | dest | taint.cpp:976:8:976:12 | * ... | |
+| taint.cpp:979:19:979:22 | {...} | taint.cpp:982:22:982:25 | dest | |
+| taint.cpp:979:19:979:22 | {...} | taint.cpp:982:35:982:38 | dest | |
+| taint.cpp:979:19:979:22 | {...} | taint.cpp:983:9:983:12 | dest | |
+| taint.cpp:979:21:979:21 | 0 | taint.cpp:979:19:979:22 | {...} | TAINT |
+| taint.cpp:980:9:980:11 | end | taint.cpp:982:43:982:45 | end | |
+| taint.cpp:981:10:981:18 | remaining | taint.cpp:982:49:982:57 | remaining | |
+| taint.cpp:982:22:982:25 | ref arg dest | taint.cpp:983:9:983:12 | dest | |
+| taint.cpp:982:42:982:45 | ref arg & ... | taint.cpp:982:43:982:45 | end [inner post update] | |
+| taint.cpp:982:43:982:45 | end | taint.cpp:982:42:982:45 | & ... | |
+| taint.cpp:982:48:982:57 | ref arg & ... | taint.cpp:982:49:982:57 | remaining [inner post update] | |
+| taint.cpp:982:49:982:57 | remaining | taint.cpp:982:48:982:57 | & ... | |
+| taint.cpp:982:63:982:66 | %s | taint.cpp:982:22:982:25 | ref arg dest | TAINT |
+| taint.cpp:982:69:982:74 | source | taint.cpp:982:22:982:25 | ref arg dest | TAINT |
+| taint.cpp:983:9:983:12 | dest | taint.cpp:983:8:983:12 | * ... | |
+| taint.cpp:986:19:986:22 | {...} | taint.cpp:988:20:988:23 | dest | |
+| taint.cpp:986:19:986:22 | {...} | taint.cpp:988:33:988:36 | dest | |
+| taint.cpp:986:19:986:22 | {...} | taint.cpp:989:9:989:12 | dest | |
+| taint.cpp:986:21:986:21 | 0 | taint.cpp:986:19:986:22 | {...} | TAINT |
+| taint.cpp:987:15:987:29 | call to indirect_source | taint.cpp:988:40:988:42 | fmt | |
+| taint.cpp:988:20:988:23 | ref arg dest | taint.cpp:989:9:989:12 | dest | |
+| taint.cpp:988:40:988:42 | fmt | taint.cpp:988:20:988:23 | ref arg dest | TAINT |
+| taint.cpp:989:9:989:12 | dest | taint.cpp:989:8:989:12 | * ... | |
+| taint.cpp:992:19:992:22 | {...} | taint.cpp:993:20:993:23 | dest | |
+| taint.cpp:992:19:992:22 | {...} | taint.cpp:993:33:993:36 | dest | |
+| taint.cpp:992:19:992:22 | {...} | taint.cpp:994:9:994:12 | dest | |
+| taint.cpp:992:21:992:21 | 0 | taint.cpp:992:19:992:22 | {...} | TAINT |
+| taint.cpp:993:20:993:23 | ref arg dest | taint.cpp:994:9:994:12 | dest | |
+| taint.cpp:993:40:993:43 | %d | taint.cpp:993:20:993:23 | ref arg dest | TAINT |
+| taint.cpp:993:46:993:47 | 42 | taint.cpp:993:20:993:23 | ref arg dest | TAINT |
+| taint.cpp:994:9:994:12 | dest | taint.cpp:994:8:994:12 | * ... | |
+| taint.cpp:997:19:997:22 | {...} | taint.cpp:998:18:998:21 | dest | |
+| taint.cpp:997:19:997:22 | {...} | taint.cpp:998:31:998:34 | dest | |
+| taint.cpp:997:19:997:22 | {...} | taint.cpp:999:9:999:12 | dest | |
+| taint.cpp:997:21:997:21 | 0 | taint.cpp:997:19:997:22 | {...} | TAINT |
+| taint.cpp:998:18:998:21 | ref arg dest | taint.cpp:999:9:999:12 | dest | |
+| taint.cpp:999:9:999:12 | dest | taint.cpp:999:8:999:12 | * ... | |
| thread.cpp:10:27:10:27 | s | thread.cpp:10:27:10:27 | s | |
| thread.cpp:10:27:10:27 | s | thread.cpp:11:8:11:8 | s | |
| thread.cpp:14:26:14:26 | s | thread.cpp:15:8:15:8 | s | |
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/taint.cpp b/cpp/ql/test/library-tests/dataflow/taint-tests/taint.cpp
index fa32e192239b..3168fb3a96f8 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/taint.cpp
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/taint.cpp
@@ -866,3 +866,136 @@ void test_iconv(size_t size) {
iconv(0, &s, &size, &p, &size_out);
sink(*p); // $ ast,ir
}
+
+using va_list = void*;
+
+long StringCchCopyA(char *, size_t, const char *);
+long StringCchCopyW(wchar_t *, size_t, const wchar_t *);
+long StringCbCopyA(char *, size_t, const char *);
+long StringCchCopyExA(char *, size_t, const char *, char **, size_t *, unsigned long);
+long StringCchCopyNA(char *, size_t, const char *, size_t);
+long StringCchCopyNExA(char *, size_t, const char *, size_t, char **, size_t *, unsigned long);
+long StringCchCatA(char *, size_t, const char *);
+long StringCchCatW(wchar_t *, size_t, const wchar_t *);
+long StringCbCatA(char *, size_t, const char *);
+long StringCchCatExA(char *, size_t, const char *, char **, size_t *, unsigned long);
+long StringCchCatNA(char *, size_t, const char *, size_t);
+long StringCchCatNExA(char *, size_t, const char *, size_t, char **, size_t *, unsigned long);
+long StringCchPrintfA(char *, size_t, const char *, ...);
+long StringCchPrintfW(wchar_t *, size_t, const wchar_t *, ...);
+long StringCbPrintfA(char *, size_t, const char *, ...);
+long StringCchPrintfExA(char *, size_t, char **, size_t *, unsigned long, const char *, ...);
+long StringCchVPrintfA(char *, size_t, const char *, va_list);
+long StringCchVPrintfExA(char *, size_t, char **, size_t *, unsigned long, const char *, va_list);
+
+void test_strsafe() {
+ char *source = indirect_source();
+ wchar_t *wsource = (wchar_t *)indirect_source();
+
+ {
+ char dest[256] = {0};
+ StringCchCopyA(dest, sizeof(dest), source);
+ sink(*dest); // $ ir MISSING: ast
+ }
+ {
+ wchar_t dest[256] = {0};
+ StringCchCopyW(dest, sizeof(dest), wsource);
+ sink(*dest); // $ ir MISSING: ast
+ }
+ {
+ char dest[256] = {0};
+ StringCbCopyA(dest, sizeof(dest), source);
+ sink(*dest); // $ ir MISSING: ast
+ }
+ {
+ char dest[256] = {0};
+ char *end;
+ size_t remaining;
+ StringCchCopyExA(dest, sizeof(dest), source, &end, &remaining, 0);
+ sink(*dest); // $ ir MISSING: ast
+ }
+ {
+ char dest[256] = {0};
+ StringCchCopyNA(dest, sizeof(dest), source, 128);
+ sink(*dest); // $ ir MISSING: ast
+ }
+ {
+ char dest[256] = {0};
+ char *end;
+ size_t remaining;
+ StringCchCopyNExA(dest, sizeof(dest), source, 128, &end, &remaining, 0);
+ sink(dest); // $ ir MISSING: ast
+ }
+ {
+ char dest[256] = "prefix";
+ StringCchCatA(dest, sizeof(dest), source);
+ sink(*dest); // $ ir MISSING: ast
+ }
+ {
+ wchar_t dest[256] = L"prefix";
+ StringCchCatW(dest, sizeof(dest), wsource);
+ sink(*dest); // $ ir MISSING: ast
+ }
+ {
+ char dest[256] = "prefix";
+ StringCbCatA(dest, sizeof(dest), source);
+ sink(*dest); // $ ir MISSING: ast
+ }
+ {
+ char dest[256] = "prefix";
+ char *end;
+ size_t remaining;
+ StringCchCatExA(dest, sizeof(dest), source, &end, &remaining, 0);
+ sink(*dest); // $ ir MISSING: ast
+ }
+ {
+ char dest[256] = "prefix";
+ StringCchCatNA(dest, sizeof(dest), source, 128);
+ sink(*dest); // $ ir MISSING: ast
+ }
+ {
+ char dest[256] = "prefix";
+ char *end;
+ size_t remaining;
+ StringCchCatNExA(dest, sizeof(dest), source, 128, &end, &remaining, 0);
+ sink(*dest); // $ ir MISSING: ast
+ }
+ {
+ char dest[256] = {0};
+ StringCchPrintfA(dest, sizeof(dest), "%s", source);
+ sink(*dest); // $ ir MISSING: ast
+ }
+ {
+ wchar_t dest[256] = {0};
+ StringCchPrintfW(dest, sizeof(dest), L"%s", wsource);
+ sink(*dest); // $ ir MISSING: ast
+ }
+ {
+ char dest[256] = {0};
+ StringCbPrintfA(dest, sizeof(dest), "%s", source);
+ sink(*dest); // $ ir MISSING: ast
+ }
+ {
+ char dest[256] = {0};
+ char *end;
+ size_t remaining;
+ StringCchPrintfExA(dest, sizeof(dest), &end, &remaining, 0, "%s", source);
+ sink(*dest); // $ ir MISSING: ast
+ }
+ {
+ char dest[256] = {0};
+ char *fmt = indirect_source();
+ StringCchPrintfA(dest, sizeof(dest), fmt);
+ sink(*dest); // $ ir MISSING: ast
+ }
+ {
+ char dest[256] = {0};
+ StringCchPrintfA(dest, sizeof(dest), "%d", 42);
+ sink(*dest); // clean
+ }
+ {
+ char dest[256] = {0};
+ StringCchCopyA(dest, sizeof(dest), "hello");
+ sink(*dest); // clean
+ }
+}
diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/test_mad-signatures.expected b/cpp/ql/test/library-tests/dataflow/taint-tests/test_mad-signatures.expected
index e0002aa9c03f..5ad32759da58 100644
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/test_mad-signatures.expected
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/test_mad-signatures.expected
@@ -28044,6 +28044,118 @@ getParameterTypeName
| taint.cpp:859:8:859:12 | iconv | 4 | unsigned long * |
| taint.cpp:861:6:861:15 | test_iconv | 0 | size_t |
| taint.cpp:861:6:861:15 | test_iconv | 0 | unsigned long |
+| taint.cpp:872:6:872:19 | StringCchCopyA | 0 | char * |
+| taint.cpp:872:6:872:19 | StringCchCopyA | 1 | size_t |
+| taint.cpp:872:6:872:19 | StringCchCopyA | 1 | unsigned long |
+| taint.cpp:872:6:872:19 | StringCchCopyA | 2 | const char * |
+| taint.cpp:873:6:873:19 | StringCchCopyW | 0 | wchar_t * |
+| taint.cpp:873:6:873:19 | StringCchCopyW | 1 | size_t |
+| taint.cpp:873:6:873:19 | StringCchCopyW | 1 | unsigned long |
+| taint.cpp:873:6:873:19 | StringCchCopyW | 2 | const wchar_t * |
+| taint.cpp:874:6:874:18 | StringCbCopyA | 0 | char * |
+| taint.cpp:874:6:874:18 | StringCbCopyA | 1 | size_t |
+| taint.cpp:874:6:874:18 | StringCbCopyA | 1 | unsigned long |
+| taint.cpp:874:6:874:18 | StringCbCopyA | 2 | const char * |
+| taint.cpp:875:6:875:21 | StringCchCopyExA | 0 | char * |
+| taint.cpp:875:6:875:21 | StringCchCopyExA | 1 | size_t |
+| taint.cpp:875:6:875:21 | StringCchCopyExA | 1 | unsigned long |
+| taint.cpp:875:6:875:21 | StringCchCopyExA | 2 | const char * |
+| taint.cpp:875:6:875:21 | StringCchCopyExA | 3 | char ** |
+| taint.cpp:875:6:875:21 | StringCchCopyExA | 4 | size_t * |
+| taint.cpp:875:6:875:21 | StringCchCopyExA | 4 | unsigned long * |
+| taint.cpp:875:6:875:21 | StringCchCopyExA | 5 | unsigned long |
+| taint.cpp:876:6:876:20 | StringCchCopyNA | 0 | char * |
+| taint.cpp:876:6:876:20 | StringCchCopyNA | 1 | size_t |
+| taint.cpp:876:6:876:20 | StringCchCopyNA | 1 | unsigned long |
+| taint.cpp:876:6:876:20 | StringCchCopyNA | 2 | const char * |
+| taint.cpp:876:6:876:20 | StringCchCopyNA | 3 | size_t |
+| taint.cpp:876:6:876:20 | StringCchCopyNA | 3 | unsigned long |
+| taint.cpp:877:6:877:22 | StringCchCopyNExA | 0 | char * |
+| taint.cpp:877:6:877:22 | StringCchCopyNExA | 1 | size_t |
+| taint.cpp:877:6:877:22 | StringCchCopyNExA | 1 | unsigned long |
+| taint.cpp:877:6:877:22 | StringCchCopyNExA | 2 | const char * |
+| taint.cpp:877:6:877:22 | StringCchCopyNExA | 3 | size_t |
+| taint.cpp:877:6:877:22 | StringCchCopyNExA | 3 | unsigned long |
+| taint.cpp:877:6:877:22 | StringCchCopyNExA | 4 | char ** |
+| taint.cpp:877:6:877:22 | StringCchCopyNExA | 5 | size_t * |
+| taint.cpp:877:6:877:22 | StringCchCopyNExA | 5 | unsigned long * |
+| taint.cpp:877:6:877:22 | StringCchCopyNExA | 6 | unsigned long |
+| taint.cpp:878:6:878:18 | StringCchCatA | 0 | char * |
+| taint.cpp:878:6:878:18 | StringCchCatA | 1 | size_t |
+| taint.cpp:878:6:878:18 | StringCchCatA | 1 | unsigned long |
+| taint.cpp:878:6:878:18 | StringCchCatA | 2 | const char * |
+| taint.cpp:879:6:879:18 | StringCchCatW | 0 | wchar_t * |
+| taint.cpp:879:6:879:18 | StringCchCatW | 1 | size_t |
+| taint.cpp:879:6:879:18 | StringCchCatW | 1 | unsigned long |
+| taint.cpp:879:6:879:18 | StringCchCatW | 2 | const wchar_t * |
+| taint.cpp:880:6:880:17 | StringCbCatA | 0 | char * |
+| taint.cpp:880:6:880:17 | StringCbCatA | 1 | size_t |
+| taint.cpp:880:6:880:17 | StringCbCatA | 1 | unsigned long |
+| taint.cpp:880:6:880:17 | StringCbCatA | 2 | const char * |
+| taint.cpp:881:6:881:20 | StringCchCatExA | 0 | char * |
+| taint.cpp:881:6:881:20 | StringCchCatExA | 1 | size_t |
+| taint.cpp:881:6:881:20 | StringCchCatExA | 1 | unsigned long |
+| taint.cpp:881:6:881:20 | StringCchCatExA | 2 | const char * |
+| taint.cpp:881:6:881:20 | StringCchCatExA | 3 | char ** |
+| taint.cpp:881:6:881:20 | StringCchCatExA | 4 | size_t * |
+| taint.cpp:881:6:881:20 | StringCchCatExA | 4 | unsigned long * |
+| taint.cpp:881:6:881:20 | StringCchCatExA | 5 | unsigned long |
+| taint.cpp:882:6:882:19 | StringCchCatNA | 0 | char * |
+| taint.cpp:882:6:882:19 | StringCchCatNA | 1 | size_t |
+| taint.cpp:882:6:882:19 | StringCchCatNA | 1 | unsigned long |
+| taint.cpp:882:6:882:19 | StringCchCatNA | 2 | const char * |
+| taint.cpp:882:6:882:19 | StringCchCatNA | 3 | size_t |
+| taint.cpp:882:6:882:19 | StringCchCatNA | 3 | unsigned long |
+| taint.cpp:883:6:883:21 | StringCchCatNExA | 0 | char * |
+| taint.cpp:883:6:883:21 | StringCchCatNExA | 1 | size_t |
+| taint.cpp:883:6:883:21 | StringCchCatNExA | 1 | unsigned long |
+| taint.cpp:883:6:883:21 | StringCchCatNExA | 2 | const char * |
+| taint.cpp:883:6:883:21 | StringCchCatNExA | 3 | size_t |
+| taint.cpp:883:6:883:21 | StringCchCatNExA | 3 | unsigned long |
+| taint.cpp:883:6:883:21 | StringCchCatNExA | 4 | char ** |
+| taint.cpp:883:6:883:21 | StringCchCatNExA | 5 | size_t * |
+| taint.cpp:883:6:883:21 | StringCchCatNExA | 5 | unsigned long * |
+| taint.cpp:883:6:883:21 | StringCchCatNExA | 6 | unsigned long |
+| taint.cpp:884:6:884:21 | StringCchPrintfA | 0 | char * |
+| taint.cpp:884:6:884:21 | StringCchPrintfA | 1 | size_t |
+| taint.cpp:884:6:884:21 | StringCchPrintfA | 1 | unsigned long |
+| taint.cpp:884:6:884:21 | StringCchPrintfA | 2 | const char * |
+| taint.cpp:884:6:884:21 | StringCchPrintfA | 3 | ... |
+| taint.cpp:885:6:885:21 | StringCchPrintfW | 0 | wchar_t * |
+| taint.cpp:885:6:885:21 | StringCchPrintfW | 1 | size_t |
+| taint.cpp:885:6:885:21 | StringCchPrintfW | 1 | unsigned long |
+| taint.cpp:885:6:885:21 | StringCchPrintfW | 2 | const wchar_t * |
+| taint.cpp:885:6:885:21 | StringCchPrintfW | 3 | ... |
+| taint.cpp:886:6:886:20 | StringCbPrintfA | 0 | char * |
+| taint.cpp:886:6:886:20 | StringCbPrintfA | 1 | size_t |
+| taint.cpp:886:6:886:20 | StringCbPrintfA | 1 | unsigned long |
+| taint.cpp:886:6:886:20 | StringCbPrintfA | 2 | const char * |
+| taint.cpp:886:6:886:20 | StringCbPrintfA | 3 | ... |
+| taint.cpp:887:6:887:23 | StringCchPrintfExA | 0 | char * |
+| taint.cpp:887:6:887:23 | StringCchPrintfExA | 1 | size_t |
+| taint.cpp:887:6:887:23 | StringCchPrintfExA | 1 | unsigned long |
+| taint.cpp:887:6:887:23 | StringCchPrintfExA | 2 | char ** |
+| taint.cpp:887:6:887:23 | StringCchPrintfExA | 3 | size_t * |
+| taint.cpp:887:6:887:23 | StringCchPrintfExA | 3 | unsigned long * |
+| taint.cpp:887:6:887:23 | StringCchPrintfExA | 4 | unsigned long |
+| taint.cpp:887:6:887:23 | StringCchPrintfExA | 5 | const char * |
+| taint.cpp:887:6:887:23 | StringCchPrintfExA | 6 | ... |
+| taint.cpp:888:6:888:22 | StringCchVPrintfA | 0 | char * |
+| taint.cpp:888:6:888:22 | StringCchVPrintfA | 1 | size_t |
+| taint.cpp:888:6:888:22 | StringCchVPrintfA | 1 | unsigned long |
+| taint.cpp:888:6:888:22 | StringCchVPrintfA | 2 | const char * |
+| taint.cpp:888:6:888:22 | StringCchVPrintfA | 3 | va_list |
+| taint.cpp:888:6:888:22 | StringCchVPrintfA | 3 | void * |
+| taint.cpp:889:6:889:24 | StringCchVPrintfExA | 0 | char * |
+| taint.cpp:889:6:889:24 | StringCchVPrintfExA | 1 | size_t |
+| taint.cpp:889:6:889:24 | StringCchVPrintfExA | 1 | unsigned long |
+| taint.cpp:889:6:889:24 | StringCchVPrintfExA | 2 | char ** |
+| taint.cpp:889:6:889:24 | StringCchVPrintfExA | 3 | size_t * |
+| taint.cpp:889:6:889:24 | StringCchVPrintfExA | 3 | unsigned long * |
+| taint.cpp:889:6:889:24 | StringCchVPrintfExA | 4 | unsigned long |
+| taint.cpp:889:6:889:24 | StringCchVPrintfExA | 5 | const char * |
+| taint.cpp:889:6:889:24 | StringCchVPrintfExA | 6 | va_list |
+| taint.cpp:889:6:889:24 | StringCchVPrintfExA | 6 | void * |
| thread.cpp:4:6:4:9 | sink | 0 | int |
| thread.cpp:6:8:6:8 | operator= | 0 | S && |
| thread.cpp:6:8:6:8 | operator= | 0 | const S & |
diff --git a/cpp/ql/test/library-tests/ir/ir/PrintAST.expected b/cpp/ql/test/library-tests/ir/ir/PrintAST.expected
index c3e46114edf4..59b5f6214f3d 100644
--- a/cpp/ql/test/library-tests/ir/ir/PrintAST.expected
+++ b/cpp/ql/test/library-tests/ir/ir/PrintAST.expected
@@ -25796,9 +25796,9 @@ ir.cpp:
# 2919| getExpr(): [FunctionCall] call to VariableTemplateFunc
# 2919| Type = [DoubleType] double
# 2919| ValueCategory = prvalue
-# 2919| getArgument(0): [Literal] 2.299999999999999822
+# 2919| getArgument(0): [Literal] 2.3
# 2919| Type = [DoubleType] double
-# 2919| Value = [Literal] 2.299999999999999822
+# 2919| Value = [Literal] 2.3
# 2919| ValueCategory = prvalue
# 2919| getExpr().getFullyConverted(): [CStyleCast] (int)...
# 2919| Conversion = [FloatingPointToIntegralConversion] floating point to integral conversion
diff --git a/cpp/ql/test/library-tests/ir/ir/aliased_ir.expected b/cpp/ql/test/library-tests/ir/ir/aliased_ir.expected
index 66810913e5d3..96035c165331 100644
--- a/cpp/ql/test/library-tests/ir/ir/aliased_ir.expected
+++ b/cpp/ql/test/library-tests/ir/ir/aliased_ir.expected
@@ -12954,21 +12954,21 @@ ir.cpp:
# 1592| double StructuredBindingTupleRefGet::d
# 1592| Block 0
-# 1592| v1592_1(void) = EnterFunction :
-# 1592| m1592_2(unknown) = AliasedDefinition :
-# 1592| m1592_3(unknown) = InitializeNonLocal :
-# 1592| m1592_4(unknown) = Chi : total:m1592_2, partial:m1592_3
-# 1592| r1592_5(glval) = VariableAddress[#this] :
-# 1592| m1592_6(glval) = InitializeParameter[#this] : &:r1592_5
-# 1592| r1592_7(glval) = Load[#this] : &:r1592_5, m1592_6
-# 1592| m1592_8(StructuredBindingTupleRefGet) = InitializeIndirection[#this] : &:r1592_7
-# 1592| r1592_9(glval) = FieldAddress[d] : r1592_7
-# 1592| r1592_10(double) = Constant[2.200000000000000178] :
-# 1592| m1592_11(double) = Store[?] : &:r1592_9, r1592_10
-# 1592| m1592_12(unknown) = Chi : total:m1592_8, partial:m1592_11
-# 1592| v1592_13(void) = ReturnVoid :
-# 1592| v1592_14(void) = AliasedUse : m1592_3
-# 1592| v1592_15(void) = ExitFunction :
+# 1592| v1592_1(void) = EnterFunction :
+# 1592| m1592_2(unknown) = AliasedDefinition :
+# 1592| m1592_3(unknown) = InitializeNonLocal :
+# 1592| m1592_4(unknown) = Chi : total:m1592_2, partial:m1592_3
+# 1592| r1592_5(glval) = VariableAddress[#this] :
+# 1592| m1592_6(glval) = InitializeParameter[#this] : &:r1592_5
+# 1592| r1592_7(glval) = Load[#this] : &:r1592_5, m1592_6
+# 1592| m1592_8(StructuredBindingTupleRefGet) = InitializeIndirection[#this] : &:r1592_7
+# 1592| r1592_9(glval) = FieldAddress[d] : r1592_7
+# 1592| r1592_10(double) = Constant[2.2] :
+# 1592| m1592_11(double) = Store[?] : &:r1592_9, r1592_10
+# 1592| m1592_12(unknown) = Chi : total:m1592_8, partial:m1592_11
+# 1592| v1592_13(void) = ReturnVoid :
+# 1592| v1592_14(void) = AliasedUse : m1592_3
+# 1592| v1592_15(void) = ExitFunction :
# 1593| int& StructuredBindingTupleRefGet::r
# 1593| Block 0
@@ -21761,7 +21761,7 @@ ir.cpp:
# 2919| m2919_2(unknown) = AliasedDefinition :
# 2919| r2919_3(glval) = VariableAddress[VariableTemplateFuncUse] :
# 2919| r2919_4(glval) = FunctionAddress[VariableTemplateFunc] :
-# 2919| r2919_5(double) = Constant[2.299999999999999822] :
+# 2919| r2919_5(double) = Constant[2.3] :
# 2919| r2919_6(double) = Call[VariableTemplateFunc] : func:r2919_4, 0:r2919_5
# 2919| m2919_7(unknown) = ^CallSideEffect : ~m2919_2
# 2919| m2919_8(unknown) = Chi : total:m2919_2, partial:m2919_7
diff --git a/cpp/ql/test/library-tests/ir/ir/raw_ir.expected b/cpp/ql/test/library-tests/ir/ir/raw_ir.expected
index 4e73b7d1aa6a..05ab6c50d703 100644
--- a/cpp/ql/test/library-tests/ir/ir/raw_ir.expected
+++ b/cpp/ql/test/library-tests/ir/ir/raw_ir.expected
@@ -11861,19 +11861,19 @@ ir.cpp:
# 1592| double StructuredBindingTupleRefGet::d
# 1592| Block 0
-# 1592| v1592_1(void) = EnterFunction :
-# 1592| mu1592_2(unknown) = AliasedDefinition :
-# 1592| mu1592_3(unknown) = InitializeNonLocal :
-# 1592| r1592_4(glval) = VariableAddress[#this] :
-# 1592| mu1592_5(glval) = InitializeParameter[#this] : &:r1592_4
-# 1592| r1592_6(glval) = Load[#this] : &:r1592_4, ~m?
-# 1592| mu1592_7(StructuredBindingTupleRefGet) = InitializeIndirection[#this] : &:r1592_6
-# 1592| r1592_8(glval) = FieldAddress[d] : r1592_6
-# 1592| r1592_9(double) = Constant[2.200000000000000178] :
-# 1592| mu1592_10(double) = Store[?] : &:r1592_8, r1592_9
-# 1592| v1592_11(void) = ReturnVoid :
-# 1592| v1592_12(void) = AliasedUse : ~m?
-# 1592| v1592_13(void) = ExitFunction :
+# 1592| v1592_1(void) = EnterFunction :
+# 1592| mu1592_2(unknown) = AliasedDefinition :
+# 1592| mu1592_3(unknown) = InitializeNonLocal :
+# 1592| r1592_4(glval) = VariableAddress[#this] :
+# 1592| mu1592_5(glval) = InitializeParameter[#this] : &:r1592_4
+# 1592| r1592_6(glval) = Load[#this] : &:r1592_4, ~m?
+# 1592| mu1592_7(StructuredBindingTupleRefGet) = InitializeIndirection[#this] : &:r1592_6
+# 1592| r1592_8(glval) = FieldAddress[d] : r1592_6
+# 1592| r1592_9(double) = Constant[2.2] :
+# 1592| mu1592_10(double) = Store[?] : &:r1592_8, r1592_9
+# 1592| v1592_11(void) = ReturnVoid :
+# 1592| v1592_12(void) = AliasedUse : ~m?
+# 1592| v1592_13(void) = ExitFunction :
# 1593| int& StructuredBindingTupleRefGet::r
# 1593| Block 0
@@ -19768,7 +19768,7 @@ ir.cpp:
# 2919| mu2919_2(unknown) = AliasedDefinition :
# 2919| r2919_3(glval) = VariableAddress[VariableTemplateFuncUse] :
# 2919| r2919_4(glval) = FunctionAddress[VariableTemplateFunc] :
-# 2919| r2919_5(double) = Constant[2.299999999999999822] :
+# 2919| r2919_5(double) = Constant[2.3] :
# 2919| r2919_6(double) = Call[VariableTemplateFunc] : func:r2919_4, 0:r2919_5
# 2919| mu2919_7(unknown) = ^CallSideEffect : ~m?
# 2919| r2919_8(int) = Convert : r2919_6
diff --git a/cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/nrOfBounds.expected b/cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/nrOfBounds.expected
index b8424b8f01ad..7d441d6293a6 100644
--- a/cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/nrOfBounds.expected
+++ b/cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/nrOfBounds.expected
@@ -1293,12 +1293,12 @@ estimateNrOfBounds
| test.c:415:26:415:69 | ... ? ... : ... | 1.0 | 1.0 | 1.0 |
| test.c:415:30:415:30 | q | 1.0 | 1.0 | 1.0 |
| test.c:415:30:415:56 | ... ? ... : ... | 1.0 | 1.0 | 1.0 |
-| test.c:415:34:415:43 | 0.4743882700000000008 | 1.0 | -1.0 | -1.0 |
-| test.c:415:47:415:56 | 0.1433388700000000071 | 1.0 | -1.0 | -1.0 |
-| test.c:415:60:415:69 | 0.3527920299999999787 | 1.0 | -1.0 | -1.0 |
-| test.c:415:73:415:82 | 0.3920645799999999959 | 1.0 | -1.0 | -1.0 |
-| test.c:415:86:415:95 | 0.2154022499999999896 | 1.0 | -1.0 | -1.0 |
-| test.c:415:99:415:108 | 0.4049680500000000238 | 1.0 | -1.0 | -1.0 |
+| test.c:415:34:415:43 | 0.47438827 | 1.0 | -1.0 | -1.0 |
+| test.c:415:47:415:56 | 0.14333887 | 1.0 | -1.0 | -1.0 |
+| test.c:415:60:415:69 | 0.35279203 | 1.0 | -1.0 | -1.0 |
+| test.c:415:73:415:82 | 0.39206458 | 1.0 | -1.0 | -1.0 |
+| test.c:415:86:415:95 | 0.21540225 | 1.0 | -1.0 | -1.0 |
+| test.c:415:99:415:108 | 0.40496805 | 1.0 | -1.0 | -1.0 |
| test.c:416:14:416:14 | m | 2.0 | 1.0 | 1.0 |
| test.c:416:14:416:108 | ... ? ... : ... | 1.0 | 1.0 | 1.0 |
| test.c:416:18:416:18 | n | 3.0 | 1.0 | 1.0 |
@@ -1309,12 +1309,12 @@ estimateNrOfBounds
| test.c:416:26:416:69 | ... ? ... : ... | 1.0 | 1.0 | 1.0 |
| test.c:416:30:416:30 | q | 3.0 | 1.0 | 1.0 |
| test.c:416:30:416:56 | ... ? ... : ... | 1.0 | 1.0 | 1.0 |
-| test.c:416:34:416:43 | 0.3418334800000000229 | 1.0 | -1.0 | -1.0 |
-| test.c:416:47:416:56 | 0.3533464000000000049 | 1.0 | -1.0 | -1.0 |
-| test.c:416:60:416:69 | 0.2224785300000000077 | 1.0 | -1.0 | -1.0 |
-| test.c:416:73:416:82 | 0.326618929999999974 | 1.0 | -1.0 | -1.0 |
-| test.c:416:86:416:95 | 0.5927046500000000551 | 1.0 | -1.0 | -1.0 |
-| test.c:416:99:416:108 | 0.5297741000000000255 | 1.0 | -1.0 | -1.0 |
+| test.c:416:34:416:43 | 0.34183348 | 1.0 | -1.0 | -1.0 |
+| test.c:416:47:416:56 | 0.3533464 | 1.0 | -1.0 | -1.0 |
+| test.c:416:60:416:69 | 0.22247853 | 1.0 | -1.0 | -1.0 |
+| test.c:416:73:416:82 | 0.32661893 | 1.0 | -1.0 | -1.0 |
+| test.c:416:86:416:95 | 0.59270465 | 1.0 | -1.0 | -1.0 |
+| test.c:416:99:416:108 | 0.5297741 | 1.0 | -1.0 | -1.0 |
| test.c:417:14:417:14 | m | 3.5 | 1.0 | 1.0 |
| test.c:417:14:417:108 | ... ? ... : ... | 1.0 | 1.0 | 1.0 |
| test.c:417:18:417:18 | n | 8.0 | 1.0 | 1.0 |
@@ -1325,12 +1325,12 @@ estimateNrOfBounds
| test.c:417:26:417:69 | ... ? ... : ... | 1.0 | 1.0 | 1.0 |
| test.c:417:30:417:30 | q | 8.0 | 1.0 | 1.0 |
| test.c:417:30:417:56 | ... ? ... : ... | 1.0 | 1.0 | 1.0 |
-| test.c:417:34:417:43 | 0.774296030000000024 | 1.0 | -1.0 | -1.0 |
-| test.c:417:47:417:56 | 0.3147808400000000062 | 1.0 | -1.0 | -1.0 |
-| test.c:417:60:417:69 | 0.3123551399999999756 | 1.0 | -1.0 | -1.0 |
-| test.c:417:73:417:82 | 0.05121255999999999725 | 1.0 | -1.0 | -1.0 |
-| test.c:417:86:417:95 | 0.7931074500000000471 | 1.0 | -1.0 | -1.0 |
-| test.c:417:99:417:108 | 0.6798145100000000385 | 1.0 | -1.0 | -1.0 |
+| test.c:417:34:417:43 | 0.77429603 | 1.0 | -1.0 | -1.0 |
+| test.c:417:47:417:56 | 0.31478084 | 1.0 | -1.0 | -1.0 |
+| test.c:417:60:417:69 | 0.31235514 | 1.0 | -1.0 | -1.0 |
+| test.c:417:73:417:82 | 0.05121256 | 1.0 | -1.0 | -1.0 |
+| test.c:417:86:417:95 | 0.79310745 | 1.0 | -1.0 | -1.0 |
+| test.c:417:99:417:108 | 0.67981451 | 1.0 | -1.0 | -1.0 |
| test.c:418:14:418:14 | m | 5.75 | 1.0 | 1.0 |
| test.c:418:14:418:108 | ... ? ... : ... | 1.0 | 1.0 | 1.0 |
| test.c:418:18:418:18 | n | 20.5 | 1.0 | 1.0 |
@@ -1341,12 +1341,12 @@ estimateNrOfBounds
| test.c:418:26:418:69 | ... ? ... : ... | 1.0 | 1.0 | 1.0 |
| test.c:418:30:418:30 | q | 20.5 | 1.0 | 1.0 |
| test.c:418:30:418:56 | ... ? ... : ... | 1.0 | 1.0 | 1.0 |
-| test.c:418:34:418:43 | 0.4472955599999999809 | 1.0 | -1.0 | -1.0 |
-| test.c:418:47:418:56 | 0.8059920200000000312 | 1.0 | -1.0 | -1.0 |
-| test.c:418:60:418:69 | 0.9899726199999999698 | 1.0 | -1.0 | -1.0 |
-| test.c:418:73:418:82 | 0.5995273199999999747 | 1.0 | -1.0 | -1.0 |
-| test.c:418:86:418:95 | 0.3697694799999999837 | 1.0 | -1.0 | -1.0 |
-| test.c:418:99:418:108 | 0.8386683499999999514 | 1.0 | -1.0 | -1.0 |
+| test.c:418:34:418:43 | 0.44729556 | 1.0 | -1.0 | -1.0 |
+| test.c:418:47:418:56 | 0.80599202 | 1.0 | -1.0 | -1.0 |
+| test.c:418:60:418:69 | 0.98997262 | 1.0 | -1.0 | -1.0 |
+| test.c:418:73:418:82 | 0.59952732 | 1.0 | -1.0 | -1.0 |
+| test.c:418:86:418:95 | 0.36976948 | 1.0 | -1.0 | -1.0 |
+| test.c:418:99:418:108 | 0.83866835 | 1.0 | -1.0 | -1.0 |
| test.c:419:14:419:14 | m | 9.125 | 1.0 | 1.0 |
| test.c:419:14:419:108 | ... ? ... : ... | 1.0 | 1.0 | 1.0 |
| test.c:419:18:419:18 | n | 51.75 | 1.0 | 1.0 |
@@ -1357,12 +1357,12 @@ estimateNrOfBounds
| test.c:419:26:419:69 | ... ? ... : ... | 1.0 | 1.0 | 1.0 |
| test.c:419:30:419:30 | q | 51.75 | 1.0 | 1.0 |
| test.c:419:30:419:56 | ... ? ... : ... | 1.0 | 1.0 | 1.0 |
-| test.c:419:34:419:43 | 0.4931182800000000199 | 1.0 | -1.0 | -1.0 |
-| test.c:419:47:419:56 | 0.9038991100000000056 | 1.0 | -1.0 | -1.0 |
-| test.c:419:60:419:69 | 0.1059771199999999941 | 1.0 | -1.0 | -1.0 |
-| test.c:419:73:419:82 | 0.2177842600000000073 | 1.0 | -1.0 | -1.0 |
-| test.c:419:86:419:95 | 0.7248596600000000167 | 1.0 | -1.0 | -1.0 |
-| test.c:419:99:419:108 | 0.6873487400000000136 | 1.0 | -1.0 | -1.0 |
+| test.c:419:34:419:43 | 0.49311828 | 1.0 | -1.0 | -1.0 |
+| test.c:419:47:419:56 | 0.90389911 | 1.0 | -1.0 | -1.0 |
+| test.c:419:60:419:69 | 0.10597712 | 1.0 | -1.0 | -1.0 |
+| test.c:419:73:419:82 | 0.21778426 | 1.0 | -1.0 | -1.0 |
+| test.c:419:86:419:95 | 0.72485966 | 1.0 | -1.0 | -1.0 |
+| test.c:419:99:419:108 | 0.68734874 | 1.0 | -1.0 | -1.0 |
| test.c:420:14:420:14 | m | 14.1875 | 1.0 | 1.0 |
| test.c:420:14:420:108 | ... ? ... : ... | 1.0 | 1.0 | 1.0 |
| test.c:420:18:420:18 | n | 129.875 | 1.0 | 1.0 |
@@ -1373,12 +1373,12 @@ estimateNrOfBounds
| test.c:420:26:420:69 | ... ? ... : ... | 1.0 | 1.0 | 1.0 |
| test.c:420:30:420:30 | q | 129.875 | 1.0 | 1.0 |
| test.c:420:30:420:56 | ... ? ... : ... | 1.0 | 1.0 | 1.0 |
-| test.c:420:34:420:43 | 0.4745284799999999747 | 1.0 | -1.0 | -1.0 |
-| test.c:420:47:420:56 | 0.107866500000000004 | 1.0 | -1.0 | -1.0 |
-| test.c:420:60:420:69 | 0.1188457599999999947 | 1.0 | -1.0 | -1.0 |
-| test.c:420:73:420:82 | 0.7616405200000000431 | 1.0 | -1.0 | -1.0 |
-| test.c:420:86:420:95 | 0.3480889200000000239 | 1.0 | -1.0 | -1.0 |
-| test.c:420:99:420:108 | 0.584408649999999974 | 1.0 | -1.0 | -1.0 |
+| test.c:420:34:420:43 | 0.47452848 | 1.0 | -1.0 | -1.0 |
+| test.c:420:47:420:56 | 0.1078665 | 1.0 | -1.0 | -1.0 |
+| test.c:420:60:420:69 | 0.11884576 | 1.0 | -1.0 | -1.0 |
+| test.c:420:73:420:82 | 0.76164052 | 1.0 | -1.0 | -1.0 |
+| test.c:420:86:420:95 | 0.34808892 | 1.0 | -1.0 | -1.0 |
+| test.c:420:99:420:108 | 0.58440865 | 1.0 | -1.0 | -1.0 |
| test.c:421:14:421:14 | m | 21.78125 | 1.0 | 1.0 |
| test.c:421:14:421:108 | ... ? ... : ... | 1.0 | 1.0 | 1.0 |
| test.c:421:18:421:18 | n | 325.1875 | 1.0 | 1.0 |
@@ -1390,11 +1390,11 @@ estimateNrOfBounds
| test.c:421:30:421:30 | q | 325.1875 | 1.0 | 1.0 |
| test.c:421:30:421:56 | ... ? ... : ... | 1.0 | 1.0 | 1.0 |
| test.c:421:34:421:43 | 0.02524326 | 1.0 | -1.0 | -1.0 |
-| test.c:421:47:421:56 | 0.8290504600000000446 | 1.0 | -1.0 | -1.0 |
-| test.c:421:60:421:69 | 0.95823075000000002 | 1.0 | -1.0 | -1.0 |
-| test.c:421:73:421:82 | 0.1251655799999999985 | 1.0 | -1.0 | -1.0 |
-| test.c:421:86:421:95 | 0.8523517900000000536 | 1.0 | -1.0 | -1.0 |
-| test.c:421:99:421:108 | 0.3623238400000000081 | 1.0 | -1.0 | -1.0 |
+| test.c:421:47:421:56 | 0.82905046 | 1.0 | -1.0 | -1.0 |
+| test.c:421:60:421:69 | 0.95823075 | 1.0 | -1.0 | -1.0 |
+| test.c:421:73:421:82 | 0.12516558 | 1.0 | -1.0 | -1.0 |
+| test.c:421:86:421:95 | 0.85235179 | 1.0 | -1.0 | -1.0 |
+| test.c:421:99:421:108 | 0.36232384 | 1.0 | -1.0 | -1.0 |
| test.c:422:14:422:14 | m | 33.171875 | 1.0 | 1.0 |
| test.c:422:14:422:108 | ... ? ... : ... | 1.0 | 1.0 | 1.0 |
| test.c:422:18:422:18 | n | 813.46875 | 1.0 | 1.0 |
@@ -1405,12 +1405,12 @@ estimateNrOfBounds
| test.c:422:26:422:69 | ... ? ... : ... | 1.0 | 1.0 | 1.0 |
| test.c:422:30:422:30 | q | 813.46875 | 1.0 | 1.0 |
| test.c:422:30:422:56 | ... ? ... : ... | 1.0 | 1.0 | 1.0 |
-| test.c:422:34:422:43 | 0.3870862600000000153 | 1.0 | -1.0 | -1.0 |
-| test.c:422:47:422:56 | 0.3287604399999999871 | 1.0 | -1.0 | -1.0 |
-| test.c:422:60:422:69 | 0.1496348500000000137 | 1.0 | -1.0 | -1.0 |
-| test.c:422:73:422:82 | 0.4504110800000000192 | 1.0 | -1.0 | -1.0 |
-| test.c:422:86:422:95 | 0.4864090899999999884 | 1.0 | -1.0 | -1.0 |
-| test.c:422:99:422:108 | 0.8433127200000000157 | 1.0 | -1.0 | -1.0 |
+| test.c:422:34:422:43 | 0.38708626 | 1.0 | -1.0 | -1.0 |
+| test.c:422:47:422:56 | 0.32876044 | 1.0 | -1.0 | -1.0 |
+| test.c:422:60:422:69 | 0.14963485 | 1.0 | -1.0 | -1.0 |
+| test.c:422:73:422:82 | 0.45041108 | 1.0 | -1.0 | -1.0 |
+| test.c:422:86:422:95 | 0.48640909 | 1.0 | -1.0 | -1.0 |
+| test.c:422:99:422:108 | 0.84331272 | 1.0 | -1.0 | -1.0 |
| test.c:423:14:423:14 | m | 50.2578125 | 1.0 | 1.0 |
| test.c:423:14:423:108 | ... ? ... : ... | 1.0 | 1.0 | 1.0 |
| test.c:423:18:423:18 | n | 2034.171875 | 1.0 | 1.0 |
@@ -1421,12 +1421,12 @@ estimateNrOfBounds
| test.c:423:26:423:69 | ... ? ... : ... | 1.0 | 1.0 | 1.0 |
| test.c:423:30:423:30 | q | 2034.171875 | 1.0 | 1.0 |
| test.c:423:30:423:56 | ... ? ... : ... | 1.0 | 1.0 | 1.0 |
-| test.c:423:34:423:43 | 0.1575506299999999971 | 1.0 | -1.0 | -1.0 |
-| test.c:423:47:423:56 | 0.7708683299999999905 | 1.0 | -1.0 | -1.0 |
-| test.c:423:60:423:69 | 0.2642848099999999811 | 1.0 | -1.0 | -1.0 |
-| test.c:423:73:423:82 | 0.1480050800000000111 | 1.0 | -1.0 | -1.0 |
-| test.c:423:86:423:95 | 0.374281430000000026 | 1.0 | -1.0 | -1.0 |
-| test.c:423:99:423:108 | 0.05328182000000000057 | 1.0 | -1.0 | -1.0 |
+| test.c:423:34:423:43 | 0.15755063 | 1.0 | -1.0 | -1.0 |
+| test.c:423:47:423:56 | 0.77086833 | 1.0 | -1.0 | -1.0 |
+| test.c:423:60:423:69 | 0.26428481 | 1.0 | -1.0 | -1.0 |
+| test.c:423:73:423:82 | 0.14800508 | 1.0 | -1.0 | -1.0 |
+| test.c:423:86:423:95 | 0.37428143 | 1.0 | -1.0 | -1.0 |
+| test.c:423:99:423:108 | 0.05328182 | 1.0 | -1.0 | -1.0 |
| test.c:424:14:424:14 | m | 75.88671875 | 1.0 | 1.0 |
| test.c:424:14:424:108 | ... ? ... : ... | 1.0 | 1.0 | 1.0 |
| test.c:424:18:424:18 | n | 5085.9296875 | 1.0 | 1.0 |
@@ -1437,12 +1437,12 @@ estimateNrOfBounds
| test.c:424:26:424:69 | ... ? ... : ... | 1.0 | 1.0 | 1.0 |
| test.c:424:30:424:30 | q | 5085.9296875 | 1.0 | 1.0 |
| test.c:424:30:424:56 | ... ? ... : ... | 1.0 | 1.0 | 1.0 |
-| test.c:424:34:424:43 | 0.4173653600000000186 | 1.0 | -1.0 | -1.0 |
-| test.c:424:47:424:56 | 0.7682662799999999681 | 1.0 | -1.0 | -1.0 |
-| test.c:424:60:424:69 | 0.2764323799999999776 | 1.0 | -1.0 | -1.0 |
-| test.c:424:73:424:82 | 0.5567927400000000082 | 1.0 | -1.0 | -1.0 |
-| test.c:424:86:424:95 | 0.3946885700000000163 | 1.0 | -1.0 | -1.0 |
-| test.c:424:99:424:108 | 0.6907214400000000198 | 1.0 | -1.0 | -1.0 |
+| test.c:424:34:424:43 | 0.41736536 | 1.0 | -1.0 | -1.0 |
+| test.c:424:47:424:56 | 0.76826628 | 1.0 | -1.0 | -1.0 |
+| test.c:424:60:424:69 | 0.27643238 | 1.0 | -1.0 | -1.0 |
+| test.c:424:73:424:82 | 0.55679274 | 1.0 | -1.0 | -1.0 |
+| test.c:424:86:424:95 | 0.39468857 | 1.0 | -1.0 | -1.0 |
+| test.c:424:99:424:108 | 0.69072144 | 1.0 | -1.0 | -1.0 |
| test.c:425:14:425:14 | m | 114.330078125 | 1.0 | 1.0 |
| test.c:425:14:425:108 | ... ? ... : ... | 1.0 | 1.0 | 1.0 |
| test.c:425:18:425:18 | n | 12715.32421875 | 1.0 | 1.0 |
@@ -1453,12 +1453,12 @@ estimateNrOfBounds
| test.c:425:26:425:69 | ... ? ... : ... | 1.0 | 1.0 | 1.0 |
| test.c:425:30:425:30 | q | 12715.32421875 | 1.0 | 1.0 |
| test.c:425:30:425:56 | ... ? ... : ... | 1.0 | 1.0 | 1.0 |
-| test.c:425:34:425:43 | 0.8895534499999999678 | 1.0 | -1.0 | -1.0 |
-| test.c:425:47:425:56 | 0.2990482400000000207 | 1.0 | -1.0 | -1.0 |
-| test.c:425:60:425:69 | 0.7624258299999999711 | 1.0 | -1.0 | -1.0 |
-| test.c:425:73:425:82 | 0.2051910999999999874 | 1.0 | -1.0 | -1.0 |
-| test.c:425:86:425:95 | 0.8874555899999999609 | 1.0 | -1.0 | -1.0 |
-| test.c:425:99:425:108 | 0.8137279800000000174 | 1.0 | -1.0 | -1.0 |
+| test.c:425:34:425:43 | 0.88955345 | 1.0 | -1.0 | -1.0 |
+| test.c:425:47:425:56 | 0.29904824 | 1.0 | -1.0 | -1.0 |
+| test.c:425:60:425:69 | 0.76242583 | 1.0 | -1.0 | -1.0 |
+| test.c:425:73:425:82 | 0.2051911 | 1.0 | -1.0 | -1.0 |
+| test.c:425:86:425:95 | 0.88745559 | 1.0 | -1.0 | -1.0 |
+| test.c:425:99:425:108 | 0.81372798 | 1.0 | -1.0 | -1.0 |
| test.c:426:14:426:14 | m | 171.9951171875 | 1.0 | 1.0 |
| test.c:426:14:426:108 | ... ? ... : ... | 1.0 | 1.0 | 1.0 |
| test.c:426:18:426:18 | n | 31788.810546875 | 1.0 | 1.0 |
@@ -1469,12 +1469,12 @@ estimateNrOfBounds
| test.c:426:26:426:69 | ... ? ... : ... | 1.0 | 1.0 | 1.0 |
| test.c:426:30:426:30 | q | 31788.810546875 | 1.0 | 1.0 |
| test.c:426:30:426:56 | ... ? ... : ... | 1.0 | 1.0 | 1.0 |
-| test.c:426:34:426:43 | 0.4218627600000000033 | 1.0 | -1.0 | -1.0 |
-| test.c:426:47:426:56 | 0.5384335799999999672 | 1.0 | -1.0 | -1.0 |
-| test.c:426:60:426:69 | 0.4499667900000000054 | 1.0 | -1.0 | -1.0 |
-| test.c:426:73:426:82 | 0.1320411400000000013 | 1.0 | -1.0 | -1.0 |
-| test.c:426:86:426:95 | 0.5203124099999999475 | 1.0 | -1.0 | -1.0 |
-| test.c:426:99:426:108 | 0.4276264699999999808 | 1.0 | -1.0 | -1.0 |
+| test.c:426:34:426:43 | 0.42186276 | 1.0 | -1.0 | -1.0 |
+| test.c:426:47:426:56 | 0.53843358 | 1.0 | -1.0 | -1.0 |
+| test.c:426:60:426:69 | 0.44996679 | 1.0 | -1.0 | -1.0 |
+| test.c:426:73:426:82 | 0.13204114 | 1.0 | -1.0 | -1.0 |
+| test.c:426:86:426:95 | 0.52031241 | 1.0 | -1.0 | -1.0 |
+| test.c:426:99:426:108 | 0.42762647 | 1.0 | -1.0 | -1.0 |
| test.c:432:19:432:19 | a | 1.0 | 1.0 | 1.0 |
| test.c:432:19:432:23 | ... + ... | 1.0 | 1.0 | 1.0 |
| test.c:432:19:432:27 | ... + ... | 1.0 | 1.0 | 1.0 |
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/NonConstantFormat.expected b/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/NonConstantFormat.expected
index 9424c731765e..63851030bba5 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/NonConstantFormat.expected
+++ b/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/NonConstantFormat.expected
@@ -11,8 +11,13 @@ edges
| nested.cpp:86:19:86:46 | *call to __builtin_alloca | nested.cpp:87:18:87:20 | *fmt | provenance | |
| test.cpp:46:27:46:30 | **argv | test.cpp:130:20:130:26 | *access to array | provenance | |
| test.cpp:167:31:167:34 | *data | test.cpp:170:12:170:14 | *res | provenance | DataFlowFunction |
+| test.cpp:179:6:179:21 | [summary param] *2 in StringCchPrintfW | test.cpp:179:6:179:21 | [summary param] *0 in StringCchPrintfW [Return] | provenance | MaD:403 |
+| test.cpp:193:32:193:34 | *str | test.cpp:195:31:195:33 | *str | provenance | |
| test.cpp:193:32:193:34 | *str | test.cpp:195:31:195:33 | *str | provenance | |
| test.cpp:193:32:193:34 | *str | test.cpp:197:11:197:14 | *wstr | provenance | TaintFunction |
+| test.cpp:195:20:195:23 | StringCchPrintfW output argument | test.cpp:197:11:197:14 | *wstr | provenance | |
+| test.cpp:195:31:195:33 | *str | test.cpp:179:6:179:21 | [summary param] *2 in StringCchPrintfW | provenance | |
+| test.cpp:195:31:195:33 | *str | test.cpp:195:20:195:23 | StringCchPrintfW output argument | provenance | MaD:403 |
| test.cpp:204:25:204:36 | *call to get_string | test.cpp:204:25:204:36 | *call to get_string | provenance | |
| test.cpp:204:25:204:36 | *call to get_string | test.cpp:205:12:205:20 | *... + ... | provenance | |
| test.cpp:204:25:204:36 | *call to get_string | test.cpp:206:12:206:16 | *hello | provenance | |
@@ -55,7 +60,11 @@ nodes
| test.cpp:130:20:130:26 | *access to array | semmle.label | *access to array |
| test.cpp:167:31:167:34 | *data | semmle.label | *data |
| test.cpp:170:12:170:14 | *res | semmle.label | *res |
+| test.cpp:179:6:179:21 | [summary param] *0 in StringCchPrintfW [Return] | semmle.label | [summary param] *0 in StringCchPrintfW [Return] |
+| test.cpp:179:6:179:21 | [summary param] *2 in StringCchPrintfW | semmle.label | [summary param] *2 in StringCchPrintfW |
| test.cpp:193:32:193:34 | *str | semmle.label | *str |
+| test.cpp:195:20:195:23 | StringCchPrintfW output argument | semmle.label | StringCchPrintfW output argument |
+| test.cpp:195:31:195:33 | *str | semmle.label | *str |
| test.cpp:195:31:195:33 | *str | semmle.label | *str |
| test.cpp:197:11:197:14 | *wstr | semmle.label | *wstr |
| test.cpp:204:25:204:36 | *call to get_string | semmle.label | *call to get_string |
@@ -88,6 +97,7 @@ nodes
| test.cpp:245:25:245:36 | *call to get_string | semmle.label | *call to get_string |
| test.cpp:247:12:247:16 | *hello | semmle.label | *hello |
subpaths
+| test.cpp:195:31:195:33 | *str | test.cpp:179:6:179:21 | [summary param] *2 in StringCchPrintfW | test.cpp:179:6:179:21 | [summary param] *0 in StringCchPrintfW [Return] | test.cpp:195:20:195:23 | StringCchPrintfW output argument |
#select
| NonConstantFormat.c:30:10:30:16 | *access to array | NonConstantFormat.c:28:27:28:30 | **argv | NonConstantFormat.c:30:10:30:16 | *access to array | The format string argument to $@ has a source which cannot be verified to originate from a string literal. | NonConstantFormat.c:30:3:30:8 | call to printf | printf |
| NonConstantFormat.c:41:9:41:45 | *call to any_random_function | NonConstantFormat.c:41:9:41:45 | *call to any_random_function | NonConstantFormat.c:41:9:41:45 | *call to any_random_function | The format string argument to $@ has a source which cannot be verified to originate from a string literal. | NonConstantFormat.c:41:2:41:7 | call to printf | printf |
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/autoconf/ExprHasNoEffect.expected b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/autoconf/ExprHasNoEffect.expected
new file mode 100644
index 000000000000..a87d2ddbd1bc
--- /dev/null
+++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/autoconf/ExprHasNoEffect.expected
@@ -0,0 +1,2 @@
+| conftest.c.c:4:3:4:8 | call to strlen | This expression has no effect (because $@ has no external side effects). | conftest.h:3:8:3:13 | strlen | strlen |
+| conftest_abc.c:4:3:4:8 | call to strlen | This expression has no effect (because $@ has no external side effects). | conftest.h:3:8:3:13 | strlen | strlen |
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/autoconf/ExprHasNoEffect.qlref b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/autoconf/ExprHasNoEffect.qlref
new file mode 100644
index 000000000000..82a90f5413a9
--- /dev/null
+++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/autoconf/ExprHasNoEffect.qlref
@@ -0,0 +1 @@
+Likely Bugs/Likely Typos/ExprHasNoEffect.ql
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/autoconf/conftest.c b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/autoconf/conftest.c
new file mode 100644
index 000000000000..2e067f5c4336
--- /dev/null
+++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/autoconf/conftest.c
@@ -0,0 +1,6 @@
+#include "conftest.h"
+
+int main2() {
+ strlen(""); // GOOD: conftest files are ignored
+ return 0;
+}
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/autoconf/conftest.c.c b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/autoconf/conftest.c.c
new file mode 100644
index 000000000000..4ff7c2253358
--- /dev/null
+++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/autoconf/conftest.c.c
@@ -0,0 +1,6 @@
+#include "conftest.h"
+
+int main3() {
+ strlen(""); // BAD: not a `conftest` file, as `conftest` is not directly followed by the extension or a sequence of numbers.
+ return 0;
+}
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/autoconf/conftest.cpp b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/autoconf/conftest.cpp
new file mode 100644
index 000000000000..7b8edf642610
--- /dev/null
+++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/autoconf/conftest.cpp
@@ -0,0 +1,6 @@
+#include "conftest.h"
+
+int main4() {
+ strlen(""); // GOOD: conftest files are ignored
+ return 0;
+}
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/autoconf/conftest.h b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/autoconf/conftest.h
new file mode 100644
index 000000000000..9cf6f7e0d9f8
--- /dev/null
+++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/autoconf/conftest.h
@@ -0,0 +1,3 @@
+typedef long long size_t;
+
+size_t strlen(const char *s);
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/autoconf/conftest123.c b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/autoconf/conftest123.c
new file mode 100644
index 000000000000..b227d53ad2a3
--- /dev/null
+++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/autoconf/conftest123.c
@@ -0,0 +1,6 @@
+#include "conftest.h"
+
+int main5() {
+ strlen(""); // GOOD: conftest files are ignored
+ return 0;
+}
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/autoconf/conftest_abc.c b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/autoconf/conftest_abc.c
new file mode 100644
index 000000000000..88215d7434cd
--- /dev/null
+++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/autoconf/conftest_abc.c
@@ -0,0 +1,6 @@
+#include "conftest.h"
+
+int main1() {
+ strlen(""); // BAD: not a `conftest` file, as `conftest` is not directly followed by the extension or a sequence of numbers.
+ return 0;
+}
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Underspecified Functions/MistypedFunctionArguments.expected b/cpp/ql/test/query-tests/Likely Bugs/Underspecified Functions/MistypedFunctionArguments.expected
index d067430aba9c..162161e369b5 100644
--- a/cpp/ql/test/query-tests/Likely Bugs/Underspecified Functions/MistypedFunctionArguments.expected
+++ b/cpp/ql/test/query-tests/Likely Bugs/Underspecified Functions/MistypedFunctionArguments.expected
@@ -2,10 +2,10 @@
| test.c:33:3:33:19 | call to not_yet_declared2 | Calling $@: argument $@ of type $@ is incompatible with parameter $@. | test.c:77:6:77:22 | not_yet_declared2 | not_yet_declared2 | test.c:33:21:33:22 | ca | ca | file://:0:0:0:0 | int[4] | int[4] | test.c:77:24:77:26 | (unnamed parameter 0) | int (unnamed parameter 0) |
| test.c:41:3:41:29 | call to declared_empty_defined_with | Calling $@: argument $@ of type $@ is incompatible with parameter $@. | test.c:78:6:78:32 | declared_empty_defined_with | declared_empty_defined_with | test.c:41:31:41:32 | & ... | & ... | file://:0:0:0:0 | int * | int * | test.c:78:38:78:38 | x | int x |
| test.c:45:3:45:27 | call to not_declared_defined_with | Calling $@: argument $@ of type $@ is incompatible with parameter $@. | test.c:81:6:81:30 | not_declared_defined_with | not_declared_defined_with | test.c:45:29:45:31 | 4 | 4 | file://:0:0:0:0 | long long | long long | test.c:81:36:81:36 | x | int x |
-| test.c:45:3:45:27 | call to not_declared_defined_with | Calling $@: argument $@ of type $@ is incompatible with parameter $@. | test.c:81:6:81:30 | not_declared_defined_with | not_declared_defined_with | test.c:45:37:45:42 | 2500000000.0 | 2500000000.0 | file://:0:0:0:0 | float | float | test.c:81:50:81:50 | z | int z |
-| test.c:48:3:48:24 | call to declared_with_pointers | Calling $@: argument $@ of type $@ is incompatible with parameter $@. | test.c:5:6:5:27 | declared_with_pointers | declared_with_pointers | test.c:48:26:48:31 | 3500000000000000.0 | 3500000000000000.0 | file://:0:0:0:0 | double | double | test.c:93:34:93:34 | x | int * x |
+| test.c:45:3:45:27 | call to not_declared_defined_with | Calling $@: argument $@ of type $@ is incompatible with parameter $@. | test.c:81:6:81:30 | not_declared_defined_with | not_declared_defined_with | test.c:45:37:45:42 | 2.5E9 | 2.5E9 | file://:0:0:0:0 | float | float | test.c:81:50:81:50 | z | int z |
+| test.c:48:3:48:24 | call to declared_with_pointers | Calling $@: argument $@ of type $@ is incompatible with parameter $@. | test.c:5:6:5:27 | declared_with_pointers | declared_with_pointers | test.c:48:26:48:31 | 3.5E15 | 3.5E15 | file://:0:0:0:0 | double | double | test.c:93:34:93:34 | x | int * x |
| test.c:48:3:48:24 | call to declared_with_pointers | Calling $@: argument $@ of type $@ is incompatible with parameter $@. | test.c:5:6:5:27 | declared_with_pointers | declared_with_pointers | test.c:48:34:48:34 | 0 | 0 | file://:0:0:0:0 | int | int | test.c:93:43:93:43 | y | void * y |
-| test.c:48:3:48:24 | call to declared_with_pointers | Calling $@: argument $@ of type $@ is incompatible with parameter $@. | test.c:93:6:93:27 | declared_with_pointers | declared_with_pointers | test.c:48:26:48:31 | 3500000000000000.0 | 3500000000000000.0 | file://:0:0:0:0 | double | double | test.c:93:34:93:34 | x | int * x |
+| test.c:48:3:48:24 | call to declared_with_pointers | Calling $@: argument $@ of type $@ is incompatible with parameter $@. | test.c:93:6:93:27 | declared_with_pointers | declared_with_pointers | test.c:48:26:48:31 | 3.5E15 | 3.5E15 | file://:0:0:0:0 | double | double | test.c:93:34:93:34 | x | int * x |
| test.c:48:3:48:24 | call to declared_with_pointers | Calling $@: argument $@ of type $@ is incompatible with parameter $@. | test.c:93:6:93:27 | declared_with_pointers | declared_with_pointers | test.c:48:34:48:34 | 0 | 0 | file://:0:0:0:0 | int | int | test.c:93:43:93:43 | y | void * y |
| test.c:50:3:50:21 | call to declared_with_array | Calling $@: argument $@ of type $@ is incompatible with parameter $@. | test.c:6:6:6:24 | declared_with_array | declared_with_array | test.c:50:23:50:24 | & ... | & ... | file://:0:0:0:0 | int * | int * | test.c:94:31:94:31 | a | char[6] a |
| test.c:50:3:50:21 | call to declared_with_array | Calling $@: argument $@ of type $@ is incompatible with parameter $@. | test.c:94:6:94:24 | declared_with_array | declared_with_array | test.c:50:23:50:24 | & ... | & ... | file://:0:0:0:0 | int * | int * | test.c:94:31:94:31 | a | char[6] a |
@@ -15,4 +15,4 @@
| test.c:58:3:58:24 | call to defined_with_long_long | Calling $@: argument $@ of type $@ is incompatible with parameter $@. | test.c:104:11:104:32 | defined_with_long_long | defined_with_long_long | test.c:58:26:58:28 | 99 | 99 | file://:0:0:0:0 | int | int | test.c:104:44:104:45 | ll | long long ll |
| test.c:59:3:59:24 | call to defined_with_long_long | Calling $@: argument $@ of type $@ is incompatible with parameter $@. | test.c:104:11:104:32 | defined_with_long_long | defined_with_long_long | test.c:59:26:59:26 | 3 | 3 | file://:0:0:0:0 | int | int | test.c:104:44:104:45 | ll | long long ll |
| test.c:61:3:61:21 | call to defined_with_double | Calling $@: argument $@ of type $@ is incompatible with parameter $@. | test.c:100:8:100:26 | defined_with_double | defined_with_double | test.c:61:23:61:25 | 2 | 2 | file://:0:0:0:0 | long long | long long | test.c:100:35:100:35 | d | double d |
-| test.c:62:3:62:24 | call to defined_with_long_long | Calling $@: argument $@ of type $@ is incompatible with parameter $@. | test.c:104:11:104:32 | defined_with_long_long | defined_with_long_long | test.c:62:26:62:31 | 3500000000000000.0 | 3500000000000000.0 | file://:0:0:0:0 | double | double | test.c:104:44:104:45 | ll | long long ll |
+| test.c:62:3:62:24 | call to defined_with_long_long | Calling $@: argument $@ of type $@ is incompatible with parameter $@. | test.c:104:11:104:32 | defined_with_long_long | defined_with_long_long | test.c:62:26:62:31 | 3.5E15 | 3.5E15 | file://:0:0:0:0 | double | double | test.c:104:44:104:45 | ll | long long ll |
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test3.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test3.cpp
index f4bfe5ca3405..35700d229e75 100644
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test3.cpp
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test3.cpp
@@ -577,3 +577,10 @@ void tests3()
str = get_home_address();
send(val(), str, strlen(str), val()); // BAD
}
+
+int fscanf(FILE* stream, const char* format, ... );
+
+void test_scanf() {
+ char password[256];
+ fscanf(stdin, "%255s", password); // GOOD: this is not a remote source
+}
\ No newline at end of file
diff --git a/csharp/downgrades/3cabc77473cbbda95edebafea345c2e3fdfa12d9/old.dbscheme b/csharp/downgrades/3cabc77473cbbda95edebafea345c2e3fdfa12d9/old.dbscheme
new file mode 100644
index 000000000000..3cabc77473cb
--- /dev/null
+++ b/csharp/downgrades/3cabc77473cbbda95edebafea345c2e3fdfa12d9/old.dbscheme
@@ -0,0 +1,1505 @@
+/* This is a dummy line to alter the dbscheme, so we can make a database upgrade
+ * without actually changing any of the dbscheme predicates. It contains a date
+ * to allow for such updates in the future as well.
+ *
+ * 2021-07-14
+ *
+ * DO NOT remove this comment carelessly, since it can revert the dbscheme back to a
+ * previously seen state (matching a previously seen SHA), which would make the upgrade
+ * mechanism not work properly.
+ */
+
+/**
+ * An invocation of the compiler. Note that more than one file may be
+ * compiled per invocation. For example, this command compiles three
+ * source files:
+ *
+ * csc f1.cs f2.cs f3.cs
+ *
+ * The `id` simply identifies the invocation, while `cwd` is the working
+ * directory from which the compiler was invoked.
+ */
+compilations(
+ unique int id : @compilation,
+ string cwd : string ref
+);
+
+compilation_info(
+ int id : @compilation ref,
+ string info_key: string ref,
+ string info_value: string ref
+)
+
+/**
+ * The arguments that were passed to the extractor for a compiler
+ * invocation. If `id` is for the compiler invocation
+ *
+ * csc f1.cs f2.cs f3.cs
+ *
+ * then typically there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0 | --compiler
+ * 1 | *path to compiler*
+ * 2 | f1.cs
+ * 3 | f2.cs
+ * 4 | f3.cs
+ */
+#keyset[id, num]
+compilation_args(
+ int id : @compilation ref,
+ int num : int ref,
+ string arg : string ref
+);
+
+/**
+ * The expanded arguments that were passed to the extractor for a
+ * compiler invocation. This is similar to `compilation_args`, but
+ * for a `@someFile.rsp` argument, it includes the arguments from that
+ * file, rather than just taking the argument literally.
+ */
+#keyset[id, num]
+compilation_expanded_args(
+ int id : @compilation ref,
+ int num : int ref,
+ string arg : string ref
+);
+
+/**
+ * The source files that are compiled by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ * csc f1.cs f2.cs f3.cs
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0 | f1.cs
+ * 1 | f2.cs
+ * 2 | f3.cs
+ */
+#keyset[id, num]
+compilation_compiling_files(
+ int id : @compilation ref,
+ int num : int ref,
+ int file : @file ref
+);
+
+/**
+ * The references used by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ * csc f1.cs f2.cs f3.cs /r:ref1.dll /r:ref2.dll /r:ref3.dll
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0 | ref1.dll
+ * 1 | ref2.dll
+ * 2 | ref3.dll
+ */
+#keyset[id, num]
+compilation_referencing_files(
+ int id : @compilation ref,
+ int num : int ref,
+ int file : @file ref
+);
+
+/**
+ * The time taken by the extractor for a compiler invocation.
+ *
+ * For each file `num`, there will be rows for
+ *
+ * kind | seconds
+ * ---- | ---
+ * 1 | CPU seconds used by the extractor frontend
+ * 2 | Elapsed seconds during the extractor frontend
+ * 3 | CPU seconds used by the extractor backend
+ * 4 | Elapsed seconds during the extractor backend
+ */
+#keyset[id, num, kind]
+compilation_time(
+ int id : @compilation ref,
+ int num : int ref,
+ /* kind:
+ 1 = frontend_cpu_seconds
+ 2 = frontend_elapsed_seconds
+ 3 = extractor_cpu_seconds
+ 4 = extractor_elapsed_seconds
+ */
+ int kind : int ref,
+ float seconds : float ref
+);
+
+/**
+ * An error or warning generated by the extractor.
+ * The diagnostic message `diagnostic` was generated during compiler
+ * invocation `compilation`, and is the `file_number_diagnostic_number`th
+ * message generated while extracting the `file_number`th file of that
+ * invocation.
+ */
+#keyset[compilation, file_number, file_number_diagnostic_number]
+diagnostic_for(
+ unique int diagnostic : @diagnostic ref,
+ int compilation : @compilation ref,
+ int file_number : int ref,
+ int file_number_diagnostic_number : int ref
+);
+
+diagnostics(
+ unique int id: @diagnostic,
+ int severity: int ref,
+ string error_tag: string ref,
+ string error_message: string ref,
+ string full_error_message: string ref,
+ int location: @location ref
+);
+
+extractor_messages(
+ unique int id: @extractor_message,
+ int severity: int ref,
+ string origin : string ref,
+ string text : string ref,
+ string entity : string ref,
+ int location: @location ref,
+ string stack_trace : string ref
+);
+
+/**
+ * If extraction was successful, then `cpu_seconds` and
+ * `elapsed_seconds` are the CPU time and elapsed time (respectively)
+ * that extraction took for compiler invocation `id`.
+ */
+compilation_finished(
+ unique int id : @compilation ref,
+ float cpu_seconds : float ref,
+ float elapsed_seconds : float ref
+);
+
+compilation_assembly(
+ unique int id : @compilation ref,
+ int assembly: @assembly ref
+)
+
+// Populated by the CSV extractor
+externalData(
+ int id: @externalDataElement,
+ string path: string ref,
+ int column: int ref,
+ string value: string ref);
+
+sourceLocationPrefix(
+ string prefix: string ref);
+
+/*
+ * Overlay support
+ */
+
+/**
+ * The CLI will automatically emit the tuple `databaseMetadata("isOverlay", "true")`,
+ * along with an `overlayChangedFiles` tuple for each new/modified/deleted file,
+ * when building an overlay database, and these can be used by the discard predicates.
+ */
+databaseMetadata(
+ string metadataKey : string ref,
+ string value : string ref
+);
+
+overlayChangedFiles(
+ string path : string ref
+);
+
+/*
+ * C# dbscheme
+ */
+
+/** ELEMENTS **/
+
+@element = @declaration | @stmt | @expr | @modifier | @attribute | @namespace_declaration
+ | @using_directive | @type_parameter_constraints | @externalDataElement
+ | @xmllocatable | @asp_element | @namespace | @preprocessor_directive;
+
+@declaration = @callable | @generic | @assignable | @namespace;
+
+@named_element = @namespace | @declaration;
+
+@declaration_with_accessors = @property | @indexer | @event;
+
+@assignable = @variable | @assignable_with_accessors | @event;
+
+@assignable_with_accessors = @property | @indexer;
+
+@attributable = @assembly | @field | @parameter | @operator | @method | @constructor
+ | @destructor | @callable_accessor | @value_or_ref_type | @declaration_with_accessors
+ | @local_function | @lambda_expr;
+
+/** LOCATIONS, ASEMMBLIES, MODULES, FILES and FOLDERS **/
+
+@location = @location_default | @assembly;
+
+@locatable = @declaration_with_accessors | @callable_accessor | @declaration_or_directive
+ | @diagnostic | @extractor_message | @preprocessor_directive | @attribute | @type_mention | @type_parameter_constraints
+ | @declaration_with_accessors | @callable_accessor | @operator | @method
+ | @constructor | @destructor | @field | @local_variable | @parameter | @stmt | @expr
+ | @xmllocatable | @commentline | @commentblock | @asp_element
+
+locations_default(
+ unique int id: @location_default,
+ int file: @file ref,
+ int beginLine: int ref,
+ int beginColumn: int ref,
+ int endLine: int ref,
+ int endColumn: int ref);
+
+locations_mapped(
+ unique int id: @location_default ref,
+ int mapped_to: @location_default ref);
+
+@sourceline = @file | @callable | @xmllocatable;
+
+numlines(
+ int element_id: @sourceline ref,
+ int num_lines: int ref,
+ int num_code: int ref,
+ int num_comment: int ref);
+
+assemblies(
+ unique int id: @assembly,
+ int file: @file ref,
+ string fullname: string ref,
+ string name: string ref,
+ string version: string ref);
+
+files(
+ unique int id: @file,
+ string name: string ref);
+
+folders(
+ unique int id: @folder,
+ string name: string ref);
+
+@container = @folder | @file ;
+
+containerparent(
+ int parent: @container ref,
+ unique int child: @container ref);
+
+file_extraction_mode(
+ unique int file: @file ref,
+ int mode: int ref
+ /* 0 = normal, 1 = standalone extractor */
+ );
+
+/** NAMESPACES **/
+
+@type_container = @namespace | @type;
+
+namespaces(
+ unique int id: @namespace,
+ string name: string ref);
+
+namespace_declarations(
+ unique int id: @namespace_declaration,
+ int namespace_id: @namespace ref);
+
+namespace_declaration_location(
+ unique int id: @namespace_declaration ref,
+ int loc: @location ref);
+
+parent_namespace(
+ unique int child_id: @type_container ref,
+ int namespace_id: @namespace ref);
+
+@declaration_or_directive = @namespace_declaration | @type | @using_directive;
+
+parent_namespace_declaration(
+ int child_id: @declaration_or_directive ref, // cannot be unique because of partial classes
+ int namespace_id: @namespace_declaration ref);
+
+@using_directive = @using_namespace_directive | @using_static_directive;
+
+using_global(
+ unique int id: @using_directive ref
+);
+
+using_namespace_directives(
+ unique int id: @using_namespace_directive,
+ int namespace_id: @namespace ref);
+
+using_static_directives(
+ unique int id: @using_static_directive,
+ int type_id: @type_or_ref ref);
+
+using_directive_location(
+ unique int id: @using_directive ref,
+ int loc: @location ref);
+
+@preprocessor_directive = @pragma_warning | @pragma_checksum | @directive_define | @directive_undefine | @directive_warning
+ | @directive_error | @directive_nullable | @directive_line | @directive_region | @directive_endregion | @directive_if
+ | @directive_elif | @directive_else | @directive_endif;
+
+@conditional_directive = @directive_if | @directive_elif;
+@branch_directive = @directive_if | @directive_elif | @directive_else;
+
+directive_ifs(
+ unique int id: @directive_if,
+ int branchTaken: int ref, /* 0: false, 1: true */
+ int conditionValue: int ref); /* 0: false, 1: true */
+
+directive_elifs(
+ unique int id: @directive_elif,
+ int branchTaken: int ref, /* 0: false, 1: true */
+ int conditionValue: int ref, /* 0: false, 1: true */
+ int parent: @directive_if ref,
+ int index: int ref);
+
+directive_elses(
+ unique int id: @directive_else,
+ int branchTaken: int ref, /* 0: false, 1: true */
+ int parent: @directive_if ref,
+ int index: int ref);
+
+#keyset[id, start]
+directive_endifs(
+ unique int id: @directive_endif,
+ unique int start: @directive_if ref);
+
+directive_define_symbols(
+ unique int id: @define_symbol_expr ref,
+ string name: string ref);
+
+directive_regions(
+ unique int id: @directive_region,
+ string name: string ref);
+
+#keyset[id, start]
+directive_endregions(
+ unique int id: @directive_endregion,
+ unique int start: @directive_region ref);
+
+directive_lines(
+ unique int id: @directive_line,
+ int kind: int ref); /* 0: default, 1: hidden, 2: numeric, 3: span */
+
+directive_line_value(
+ unique int id: @directive_line ref,
+ int line: int ref);
+
+directive_line_file(
+ unique int id: @directive_line ref,
+ int file: @file ref);
+
+directive_line_offset(
+ unique int id: @directive_line ref,
+ int offset: int ref);
+
+directive_line_span(
+ unique int id: @directive_line ref,
+ int startLine: int ref,
+ int startColumn: int ref,
+ int endLine: int ref,
+ int endColumn: int ref);
+
+directive_nullables(
+ unique int id: @directive_nullable,
+ int setting: int ref, /* 0: disable, 1: enable, 2: restore */
+ int target: int ref); /* 0: none, 1: annotations, 2: warnings */
+
+directive_warnings(
+ unique int id: @directive_warning,
+ string message: string ref);
+
+directive_errors(
+ unique int id: @directive_error,
+ string message: string ref);
+
+directive_undefines(
+ unique int id: @directive_undefine,
+ string name: string ref);
+
+directive_defines(
+ unique int id: @directive_define,
+ string name: string ref);
+
+pragma_checksums(
+ unique int id: @pragma_checksum,
+ int file: @file ref,
+ string guid: string ref,
+ string bytes: string ref);
+
+pragma_warnings(
+ unique int id: @pragma_warning,
+ int kind: int ref /* 0 = disable, 1 = restore */);
+
+#keyset[id, index]
+pragma_warning_error_codes(
+ int id: @pragma_warning ref,
+ string errorCode: string ref,
+ int index: int ref);
+
+preprocessor_directive_location(
+ unique int id: @preprocessor_directive ref,
+ int loc: @location ref);
+
+preprocessor_directive_compilation(
+ int id: @preprocessor_directive ref,
+ int compilation: @compilation ref);
+
+preprocessor_directive_active(
+ unique int id: @preprocessor_directive ref,
+ int active: int ref); /* 0: false, 1: true */
+
+/** TYPES **/
+
+types(
+ unique int id: @type,
+ int kind: int ref,
+ string name: string ref);
+
+case @type.kind of
+ 1 = @bool_type
+| 2 = @char_type
+| 3 = @decimal_type
+| 4 = @sbyte_type
+| 5 = @short_type
+| 6 = @int_type
+| 7 = @long_type
+| 8 = @byte_type
+| 9 = @ushort_type
+| 10 = @uint_type
+| 11 = @ulong_type
+| 12 = @float_type
+| 13 = @double_type
+| 14 = @enum_type
+| 15 = @struct_type
+| 17 = @class_type
+| 19 = @interface_type
+| 20 = @delegate_type
+| 21 = @null_type
+| 22 = @type_parameter
+| 23 = @pointer_type
+| 24 = @nullable_type
+| 25 = @array_type
+| 26 = @void_type
+| 27 = @int_ptr_type
+| 28 = @uint_ptr_type
+| 29 = @dynamic_type
+| 30 = @arglist_type
+| 31 = @unknown_type
+| 32 = @tuple_type
+| 33 = @function_pointer_type
+| 34 = @inline_array_type
+| 35 = @extension_type
+ ;
+
+@simple_type = @bool_type | @char_type | @integral_type | @floating_point_type | @decimal_type;
+@integral_type = @signed_integral_type | @unsigned_integral_type;
+@signed_integral_type = @sbyte_type | @short_type | @int_type | @long_type;
+@unsigned_integral_type = @byte_type | @ushort_type | @uint_type | @ulong_type;
+@floating_point_type = @float_type | @double_type;
+@value_type = @simple_type | @enum_type | @struct_type | @nullable_type | @int_ptr_type
+ | @uint_ptr_type | @tuple_type | @void_type | @inline_array_type;
+@ref_type = @class_type | @interface_type | @array_type | @delegate_type | @null_type
+ | @dynamic_type | @extension_type;
+@value_or_ref_type = @value_type | @ref_type;
+
+typerefs(
+ unique int id: @typeref,
+ string name: string ref);
+
+typeref_type(
+ int id: @typeref ref,
+ unique int typeId: @type ref);
+
+@type_or_ref = @type | @typeref;
+
+array_element_type(
+ unique int array: @array_type ref,
+ int dimension: int ref,
+ int rank: int ref,
+ int element: @type_or_ref ref);
+
+nullable_underlying_type(
+ unique int nullable: @nullable_type ref,
+ int underlying: @type_or_ref ref);
+
+pointer_referent_type(
+ unique int pointer: @pointer_type ref,
+ int referent: @type_or_ref ref);
+
+enum_underlying_type(
+ unique int enum_id: @enum_type ref,
+ int underlying_type_id: @type_or_ref ref);
+
+delegate_return_type(
+ unique int delegate_id: @delegate_type ref,
+ int return_type_id: @type_or_ref ref);
+
+function_pointer_return_type(
+ unique int function_pointer_id: @function_pointer_type ref,
+ int return_type_id: @type_or_ref ref);
+
+extension_receiver_type(
+ unique int extension: @extension_type ref,
+ int receiver_type_id: @type_or_ref ref);
+
+extend(
+ int sub: @type ref,
+ int super: @type_or_ref ref);
+
+anonymous_types(
+ unique int id: @type ref);
+
+@interface_or_ref = @interface_type | @typeref;
+
+implement(
+ int sub: @type ref,
+ int super: @type_or_ref ref);
+
+type_location(
+ int id: @type ref,
+ int loc: @location ref);
+
+tuple_underlying_type(
+ unique int tuple: @tuple_type ref,
+ int struct: @type_or_ref ref);
+
+#keyset[tuple, index]
+tuple_element(
+ int tuple: @tuple_type ref,
+ int index: int ref,
+ unique int field: @field ref);
+
+attributes(
+ unique int id: @attribute,
+ int kind: int ref,
+ int type_id: @type_or_ref ref,
+ int target: @attributable ref);
+
+case @attribute.kind of
+ 0 = @attribute_default
+| 1 = @attribute_return
+| 2 = @attribute_assembly
+| 3 = @attribute_module
+;
+
+attribute_location(
+ int id: @attribute ref,
+ int loc: @location ref);
+
+@type_mention_parent = @element | @type_mention;
+
+type_mention(
+ unique int id: @type_mention,
+ int type_id: @type_or_ref ref,
+ int parent: @type_mention_parent ref);
+
+type_mention_location(
+ unique int id: @type_mention ref,
+ int loc: @location ref);
+
+@has_type_annotation = @assignable | @type_parameter | @callable | @expr | @delegate_type | @generic | @function_pointer_type;
+
+/**
+ * A direct annotation on an entity, for example `string? x;`.
+ *
+ * Annotations:
+ * 2 = reftype is not annotated "!"
+ * 3 = reftype is annotated "?"
+ * 4 = readonly ref type / in parameter
+ * 5 = ref type parameter, return or local variable
+ * 6 = out parameter
+ *
+ * Note that the annotation depends on the element it annotates.
+ * @assignable: The annotation is on the type of the assignable, for example the variable type.
+ * @type_parameter: The annotation is on the reftype constraint
+ * @callable: The annotation is on the return type
+ * @array_type: The annotation is on the element type
+ */
+type_annotation(int id: @has_type_annotation ref, int annotation: int ref);
+
+nullability(unique int nullability: @nullability, int kind: int ref);
+
+case @nullability.kind of
+ 0 = @oblivious
+| 1 = @not_annotated
+| 2 = @annotated
+;
+
+#keyset[parent, index]
+nullability_parent(int nullability: @nullability ref, int index: int ref, int parent: @nullability ref)
+
+type_nullability(int id: @has_type_annotation ref, int nullability: @nullability ref);
+
+/**
+ * The nullable flow state of an expression, as determined by Roslyn.
+ * 0 = none (default, not populated)
+ * 1 = not null
+ * 2 = maybe null
+ */
+expr_flowstate(unique int id: @expr ref, int state: int ref);
+
+/** GENERICS **/
+
+@generic = @type | @method | @local_function;
+
+type_parameters(
+ unique int id: @type_parameter ref,
+ int index: int ref,
+ int generic_id: @generic ref,
+ int variance: int ref /* none = 0, out = 1, in = 2 */);
+
+#keyset[constructed_id, index]
+type_arguments(
+ int id: @type_or_ref ref,
+ int index: int ref,
+ int constructed_id: @generic_or_ref ref);
+
+@generic_or_ref = @generic | @typeref;
+
+constructed_generic(
+ unique int constructed: @generic ref,
+ int generic: @generic_or_ref ref);
+
+type_parameter_constraints(
+ unique int id: @type_parameter_constraints,
+ int param_id: @type_parameter ref);
+
+type_parameter_constraints_location(
+ int id: @type_parameter_constraints ref,
+ int loc: @location ref);
+
+general_type_parameter_constraints(
+ int id: @type_parameter_constraints ref,
+ int kind: int ref /* class = 1, struct = 2, new = 3 */);
+
+specific_type_parameter_constraints(
+ int id: @type_parameter_constraints ref,
+ int base_id: @type_or_ref ref);
+
+specific_type_parameter_nullability(
+ int id: @type_parameter_constraints ref,
+ int base_id: @type_or_ref ref,
+ int nullability: @nullability ref);
+
+/** FUNCTION POINTERS */
+
+function_pointer_calling_conventions(
+ int id: @function_pointer_type ref,
+ int kind: int ref);
+
+#keyset[id, index]
+has_unmanaged_calling_conventions(
+ int id: @function_pointer_type ref,
+ int index: int ref,
+ int conv_id: @type_or_ref ref);
+
+/** MODIFIERS */
+
+@modifiable = @modifiable_direct | @event_accessor;
+
+@modifiable_direct = @member | @accessor | @local_function | @anonymous_function_expr;
+
+modifiers(
+ unique int id: @modifier,
+ string name: string ref);
+
+has_modifiers(
+ int id: @modifiable_direct ref,
+ int mod_id: @modifier ref);
+
+/** MEMBERS **/
+
+@member = @method | @constructor | @destructor | @field | @property | @event | @operator | @indexer | @type;
+
+@named_exprorstmt = @goto_stmt | @labeled_stmt | @expr;
+
+@virtualizable = @method | @property | @indexer | @event | @operator;
+
+exprorstmt_name(
+ unique int parent_id: @named_exprorstmt ref,
+ string name: string ref);
+
+nested_types(
+ unique int id: @type ref,
+ int declaring_type_id: @type ref,
+ int unbound_id: @type ref);
+
+properties(
+ unique int id: @property,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @property ref);
+
+property_location(
+ int id: @property ref,
+ int loc: @location ref);
+
+indexers(
+ unique int id: @indexer,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @indexer ref);
+
+indexer_location(
+ int id: @indexer ref,
+ int loc: @location ref);
+
+accessors(
+ unique int id: @accessor,
+ int kind: int ref,
+ string name: string ref,
+ int declaring_member_id: @member ref,
+ int unbound_id: @accessor ref);
+
+case @accessor.kind of
+ 1 = @getter
+| 2 = @setter
+ ;
+
+init_only_accessors(
+ unique int id: @accessor ref);
+
+accessor_location(
+ int id: @accessor ref,
+ int loc: @location ref);
+
+events(
+ unique int id: @event,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @event ref);
+
+event_location(
+ int id: @event ref,
+ int loc: @location ref);
+
+event_accessors(
+ unique int id: @event_accessor,
+ int kind: int ref,
+ string name: string ref,
+ int declaring_event_id: @event ref,
+ int unbound_id: @event_accessor ref);
+
+case @event_accessor.kind of
+ 1 = @add_event_accessor
+| 2 = @remove_event_accessor
+ ;
+
+event_accessor_location(
+ int id: @event_accessor ref,
+ int loc: @location ref);
+
+operators(
+ unique int id: @operator,
+ string name: string ref,
+ string symbol: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @operator ref);
+
+operator_location(
+ int id: @operator ref,
+ int loc: @location ref);
+
+constant_value(
+ int id: @variable ref,
+ string value: string ref);
+
+/** CALLABLES **/
+
+@callable = @method | @constructor | @destructor | @operator | @callable_accessor | @anonymous_function_expr | @local_function;
+
+@callable_accessor = @accessor | @event_accessor;
+
+methods(
+ unique int id: @method,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @method ref);
+
+method_location(
+ int id: @method ref,
+ int loc: @location ref);
+
+constructors(
+ unique int id: @constructor,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int unbound_id: @constructor ref);
+
+constructor_location(
+ int id: @constructor ref,
+ int loc: @location ref);
+
+destructors(
+ unique int id: @destructor,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int unbound_id: @destructor ref);
+
+destructor_location(
+ int id: @destructor ref,
+ int loc: @location ref);
+
+overrides(
+ int id: @callable ref,
+ int base_id: @callable ref);
+
+explicitly_implements(
+ int id: @member ref,
+ int interface_id: @interface_or_ref ref);
+
+local_functions(
+ unique int id: @local_function,
+ string name: string ref,
+ int return_type: @type ref,
+ int unbound_id: @local_function ref);
+
+local_function_stmts(
+ unique int fn: @local_function_stmt ref,
+ int stmt: @local_function ref);
+
+/** VARIABLES **/
+
+@variable = @local_scope_variable | @field;
+
+@local_scope_variable = @local_variable | @parameter;
+
+fields(
+ unique int id: @field,
+ int kind: int ref,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @field ref);
+
+case @field.kind of
+ 1 = @addressable_field
+| 2 = @constant
+ ;
+
+field_location(
+ int id: @field ref,
+ int loc: @location ref);
+
+localvars(
+ unique int id: @local_variable,
+ int kind: int ref,
+ string name: string ref,
+ int implicitly_typed: int ref /* 0 = no, 1 = yes */,
+ int type_id: @type_or_ref ref,
+ int parent_id: @local_var_decl_expr ref);
+
+case @local_variable.kind of
+ 1 = @addressable_local_variable
+| 2 = @local_constant
+| 3 = @local_variable_ref
+ ;
+
+localvar_location(
+ unique int id: @local_variable ref,
+ int loc: @location ref);
+
+@parameterizable = @callable | @delegate_type | @indexer | @function_pointer_type | @extension_type;
+
+#keyset[name, parent_id]
+#keyset[index, parent_id]
+params(
+ unique int id: @parameter,
+ string name: string ref,
+ int type_id: @type_or_ref ref,
+ int index: int ref,
+ int mode: int ref, /* value = 0, ref = 1, out = 2, params/array = 3, this = 4, in = 5, ref readonly = 6 */
+ int parent_id: @parameterizable ref,
+ int unbound_id: @parameter ref);
+
+param_location(
+ int id: @parameter ref,
+ int loc: @location ref);
+
+@has_scoped_annotation = @local_scope_variable
+
+scoped_annotation(
+ int id: @has_scoped_annotation ref,
+ int kind: int ref // scoped ref = 1, scoped value = 2
+ );
+
+/** STATEMENTS **/
+
+@exprorstmt_parent = @control_flow_element | @top_level_exprorstmt_parent;
+
+statements(
+ unique int id: @stmt,
+ int kind: int ref);
+
+#keyset[index, parent]
+stmt_parent(
+ unique int stmt: @stmt ref,
+ int index: int ref,
+ int parent: @control_flow_element ref);
+
+@top_level_stmt_parent = @callable;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+stmt_parent_top_level(
+ unique int stmt: @stmt ref,
+ int index: int ref,
+ int parent: @top_level_stmt_parent ref);
+
+case @stmt.kind of
+ 1 = @block_stmt
+| 2 = @expr_stmt
+| 3 = @if_stmt
+| 4 = @switch_stmt
+| 5 = @while_stmt
+| 6 = @do_stmt
+| 7 = @for_stmt
+| 8 = @foreach_stmt
+| 9 = @break_stmt
+| 10 = @continue_stmt
+| 11 = @goto_stmt
+| 12 = @goto_case_stmt
+| 13 = @goto_default_stmt
+| 14 = @throw_stmt
+| 15 = @return_stmt
+| 16 = @yield_stmt
+| 17 = @try_stmt
+| 18 = @checked_stmt
+| 19 = @unchecked_stmt
+| 20 = @lock_stmt
+| 21 = @using_block_stmt
+| 22 = @var_decl_stmt
+| 23 = @const_decl_stmt
+| 24 = @empty_stmt
+| 25 = @unsafe_stmt
+| 26 = @fixed_stmt
+| 27 = @label_stmt
+| 28 = @catch
+| 29 = @case_stmt
+| 30 = @local_function_stmt
+| 31 = @using_decl_stmt
+ ;
+
+@using_stmt = @using_block_stmt | @using_decl_stmt;
+
+@labeled_stmt = @label_stmt | @case;
+
+@decl_stmt = @var_decl_stmt | @const_decl_stmt | @using_decl_stmt;
+
+@cond_stmt = @if_stmt | @switch_stmt;
+
+@loop_stmt = @while_stmt | @do_stmt | @for_stmt | @foreach_stmt;
+
+@jump_stmt = @break_stmt | @goto_any_stmt | @continue_stmt | @throw_stmt | @return_stmt
+ | @yield_stmt;
+
+@goto_any_stmt = @goto_default_stmt | @goto_case_stmt | @goto_stmt;
+
+
+stmt_location(
+ unique int id: @stmt ref,
+ int loc: @location ref);
+
+catch_type(
+ unique int catch_id: @catch ref,
+ int type_id: @type_or_ref ref,
+ int kind: int ref /* explicit = 1, implicit = 2 */);
+
+foreach_stmt_info(
+ unique int id: @foreach_stmt ref,
+ int kind: int ref /* non-async = 1, async = 2 */);
+
+@foreach_symbol = @method | @property | @type_or_ref;
+
+#keyset[id, kind]
+foreach_stmt_desugar(
+ int id: @foreach_stmt ref,
+ int symbol: @foreach_symbol ref,
+ int kind: int ref /* GetEnumeratorMethod = 1, CurrentProperty = 2, MoveNextMethod = 3, DisposeMethod = 4, ElementType = 5 */);
+
+/** EXPRESSIONS **/
+
+expressions(
+ unique int id: @expr,
+ int kind: int ref,
+ int type_id: @type_or_ref ref);
+
+#keyset[index, parent]
+expr_parent(
+ unique int expr: @expr ref,
+ int index: int ref,
+ int parent: @control_flow_element ref);
+
+@top_level_expr_parent = @attribute | @field | @property | @indexer | @parameter | @directive_if | @directive_elif;
+
+@top_level_exprorstmt_parent = @top_level_expr_parent | @top_level_stmt_parent;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+expr_parent_top_level(
+ unique int expr: @expr ref,
+ int index: int ref,
+ int parent: @top_level_exprorstmt_parent ref);
+
+case @expr.kind of
+/* literal */
+ 1 = @bool_literal_expr
+| 2 = @char_literal_expr
+| 3 = @decimal_literal_expr
+| 4 = @int_literal_expr
+| 5 = @long_literal_expr
+| 6 = @uint_literal_expr
+| 7 = @ulong_literal_expr
+| 8 = @float_literal_expr
+| 9 = @double_literal_expr
+| 10 = @utf16_string_literal_expr
+| 11 = @null_literal_expr
+/* primary & unary */
+| 12 = @this_access_expr
+| 13 = @base_access_expr
+| 14 = @local_variable_access_expr
+| 15 = @parameter_access_expr
+| 16 = @field_access_expr
+| 17 = @property_access_expr
+| 18 = @method_access_expr
+| 19 = @event_access_expr
+| 20 = @indexer_access_expr
+| 21 = @array_access_expr
+| 22 = @type_access_expr
+| 23 = @typeof_expr
+| 24 = @method_invocation_expr
+| 25 = @delegate_invocation_expr
+| 26 = @operator_invocation_expr
+| 27 = @cast_expr
+| 28 = @object_creation_expr
+| 29 = @explicit_delegate_creation_expr
+| 30 = @implicit_delegate_creation_expr
+| 31 = @array_creation_expr
+| 32 = @default_expr
+| 33 = @plus_expr
+| 34 = @minus_expr
+| 35 = @bit_not_expr
+| 36 = @log_not_expr
+| 37 = @post_incr_expr
+| 38 = @post_decr_expr
+| 39 = @pre_incr_expr
+| 40 = @pre_decr_expr
+/* multiplicative */
+| 41 = @mul_expr
+| 42 = @div_expr
+| 43 = @rem_expr
+/* additive */
+| 44 = @add_expr
+| 45 = @sub_expr
+/* shift */
+| 46 = @lshift_expr
+| 47 = @rshift_expr
+/* relational */
+| 48 = @lt_expr
+| 49 = @gt_expr
+| 50 = @le_expr
+| 51 = @ge_expr
+/* equality */
+| 52 = @eq_expr
+| 53 = @ne_expr
+/* logical */
+| 54 = @bit_and_expr
+| 55 = @bit_xor_expr
+| 56 = @bit_or_expr
+| 57 = @log_and_expr
+| 58 = @log_or_expr
+/* type testing */
+| 59 = @is_expr
+| 60 = @as_expr
+/* null coalescing */
+| 61 = @null_coalescing_expr
+/* conditional */
+| 62 = @conditional_expr
+/* assignment */
+| 63 = @simple_assign_expr
+| 64 = @assign_add_expr
+| 65 = @assign_sub_expr
+| 66 = @assign_mul_expr
+| 67 = @assign_div_expr
+| 68 = @assign_rem_expr
+| 69 = @assign_and_expr
+| 70 = @assign_xor_expr
+| 71 = @assign_or_expr
+| 72 = @assign_lshift_expr
+| 73 = @assign_rshift_expr
+/* more */
+| 74 = @object_init_expr
+| 75 = @collection_init_expr
+| 76 = @array_init_expr
+| 77 = @checked_expr
+| 78 = @unchecked_expr
+| 79 = @constructor_init_expr
+| 80 = @add_event_expr
+| 81 = @remove_event_expr
+| 82 = @par_expr
+| 83 = @local_var_decl_expr
+| 84 = @lambda_expr
+| 85 = @anonymous_method_expr
+| 86 = @namespace_expr
+/* dynamic */
+| 92 = @dynamic_element_access_expr
+| 93 = @dynamic_member_access_expr
+/* unsafe */
+| 100 = @pointer_indirection_expr
+| 101 = @address_of_expr
+| 102 = @sizeof_expr
+/* async */
+| 103 = @await_expr
+/* C# 6.0 */
+| 104 = @nameof_expr
+| 105 = @interpolated_string_expr
+| 106 = @unknown_expr
+/* C# 7.0 */
+| 107 = @throw_expr
+| 108 = @tuple_expr
+| 109 = @local_function_invocation_expr
+| 110 = @ref_expr
+| 111 = @discard_expr
+/* C# 8.0 */
+| 112 = @range_expr
+| 113 = @index_expr
+| 114 = @switch_expr
+| 115 = @recursive_pattern_expr
+| 116 = @property_pattern_expr
+| 117 = @positional_pattern_expr
+| 118 = @switch_case_expr
+| 119 = @assign_coalesce_expr
+| 120 = @suppress_nullable_warning_expr
+| 121 = @namespace_access_expr
+/* C# 9.0 */
+| 122 = @lt_pattern_expr
+| 123 = @gt_pattern_expr
+| 124 = @le_pattern_expr
+| 125 = @ge_pattern_expr
+| 126 = @not_pattern_expr
+| 127 = @and_pattern_expr
+| 128 = @or_pattern_expr
+| 129 = @function_pointer_invocation_expr
+| 130 = @with_expr
+/* C# 11.0 */
+| 131 = @list_pattern_expr
+| 132 = @slice_pattern_expr
+| 133 = @urshift_expr
+| 134 = @assign_urshift_expr
+| 135 = @utf8_string_literal_expr
+/* C# 12.0 */
+| 136 = @collection_expr
+| 137 = @spread_element_expr
+| 138 = @interpolated_string_insert_expr
+/* Preprocessor */
+| 999 = @define_symbol_expr
+;
+
+@switch = @switch_stmt | @switch_expr;
+@case = @case_stmt | @switch_case_expr;
+@pattern_match = @case | @is_expr;
+@unary_pattern_expr = @not_pattern_expr;
+@relational_pattern_expr = @gt_pattern_expr | @lt_pattern_expr | @ge_pattern_expr | @le_pattern_expr;
+@binary_pattern_expr = @and_pattern_expr | @or_pattern_expr;
+
+@integer_literal_expr = @int_literal_expr | @long_literal_expr | @uint_literal_expr | @ulong_literal_expr;
+@real_literal_expr = @float_literal_expr | @double_literal_expr | @decimal_literal_expr;
+@string_literal_expr = @utf16_string_literal_expr | @utf8_string_literal_expr;
+@literal_expr = @bool_literal_expr | @char_literal_expr | @integer_literal_expr | @real_literal_expr
+ | @string_literal_expr | @null_literal_expr;
+
+@assign_expr = @simple_assign_expr | @assign_op_expr | @local_var_decl_expr;
+@assign_op_call_expr = @assign_arith_expr | @assign_bitwise_expr
+@assign_op_expr = @assign_op_call_expr | @assign_event_expr | @assign_coalesce_expr;
+@assign_event_expr = @add_event_expr | @remove_event_expr;
+
+@add_operation = @add_expr | @assign_add_expr;
+@sub_operation = @sub_expr | @assign_sub_expr;
+@mul_operation = @mul_expr | @assign_mul_expr;
+@div_operation = @div_expr | @assign_div_expr;
+@rem_operation = @rem_expr | @assign_rem_expr;
+@and_operation = @bit_and_expr | @assign_and_expr;
+@xor_operation = @bit_xor_expr | @assign_xor_expr;
+@or_operation = @bit_or_expr | @assign_or_expr;
+@lshift_operation = @lshift_expr | @assign_lshift_expr;
+@rshift_operation = @rshift_expr | @assign_rshift_expr;
+@urshift_operation = @urshift_expr | @assign_urshift_expr;
+@null_coalescing_operation = @null_coalescing_expr | @assign_coalesce_expr;
+
+@assign_arith_expr = @assign_add_expr | @assign_sub_expr | @assign_mul_expr | @assign_div_expr
+ | @assign_rem_expr
+@assign_bitwise_expr = @assign_and_expr | @assign_or_expr | @assign_xor_expr
+ | @assign_lshift_expr | @assign_rshift_expr | @assign_urshift_expr;
+
+@member_access_expr = @field_access_expr | @property_access_expr | @indexer_access_expr | @event_access_expr
+ | @method_access_expr | @type_access_expr | @dynamic_member_access_expr;
+@access_expr = @member_access_expr | @this_access_expr | @base_access_expr | @assignable_access_expr | @namespace_access_expr;
+@element_access_expr = @indexer_access_expr | @array_access_expr | @dynamic_element_access_expr;
+
+@local_variable_access = @local_variable_access_expr | @local_var_decl_expr;
+@local_scope_variable_access_expr = @parameter_access_expr | @local_variable_access;
+@variable_access_expr = @local_scope_variable_access_expr | @field_access_expr;
+
+@assignable_access_expr = @variable_access_expr | @property_access_expr | @element_access_expr
+ | @event_access_expr | @dynamic_member_access_expr;
+
+@objectorcollection_init_expr = @object_init_expr | @collection_init_expr;
+
+@delegate_creation_expr = @explicit_delegate_creation_expr | @implicit_delegate_creation_expr;
+
+@bin_arith_op_expr = @mul_expr | @div_expr | @rem_expr | @add_expr | @sub_expr;
+@incr_op_expr = @pre_incr_expr | @post_incr_expr;
+@decr_op_expr = @pre_decr_expr | @post_decr_expr;
+@mut_op_expr = @incr_op_expr | @decr_op_expr;
+@un_arith_op_expr = @plus_expr | @minus_expr | @mut_op_expr;
+@arith_op_expr = @bin_arith_op_expr | @un_arith_op_expr;
+
+@ternary_log_op_expr = @conditional_expr;
+@bin_log_op_expr = @log_and_expr | @log_or_expr | @null_coalescing_expr;
+@un_log_op_expr = @log_not_expr;
+@log_expr = @un_log_op_expr | @bin_log_op_expr | @ternary_log_op_expr;
+
+@bin_bit_op_expr = @bit_and_expr | @bit_or_expr | @bit_xor_expr | @lshift_expr
+ | @rshift_expr | @urshift_expr;
+@un_bit_op_expr = @bit_not_expr;
+@bit_expr = @un_bit_op_expr | @bin_bit_op_expr;
+
+@equality_op_expr = @eq_expr | @ne_expr;
+@rel_op_expr = @gt_expr | @lt_expr| @ge_expr | @le_expr;
+@comp_expr = @equality_op_expr | @rel_op_expr;
+
+@op_expr = @un_op | @bin_op | @ternary_op;
+
+@ternary_op = @ternary_log_op_expr;
+@bin_op = @assign_expr | @bin_arith_op_expr | @bin_log_op_expr | @bin_bit_op_expr | @comp_expr;
+@un_op = @un_arith_op_expr | @un_log_op_expr | @un_bit_op_expr | @sizeof_expr
+ | @pointer_indirection_expr | @address_of_expr;
+
+@anonymous_function_expr = @lambda_expr | @anonymous_method_expr;
+
+@op_invoke_expr = @operator_invocation_expr | @assign_op_call_expr
+@call = @method_invocation_expr | @constructor_init_expr | @op_invoke_expr
+ | @delegate_invocation_expr | @object_creation_expr | @call_access_expr
+ | @local_function_invocation_expr | @function_pointer_invocation_expr;
+
+@call_access_expr = @property_access_expr | @event_access_expr | @indexer_access_expr;
+
+@late_bindable_expr = @dynamic_element_access_expr | @dynamic_member_access_expr
+ | @object_creation_expr | @method_invocation_expr | @op_invoke_expr;
+
+@throw_element = @throw_expr | @throw_stmt;
+
+@implicitly_typeable_object_creation_expr = @object_creation_expr | @explicit_delegate_creation_expr;
+
+implicitly_typed_array_creation(
+ unique int id: @array_creation_expr ref);
+
+explicitly_sized_array_creation(
+ unique int id: @array_creation_expr ref);
+
+stackalloc_array_creation(
+ unique int id: @array_creation_expr ref);
+
+implicitly_typed_object_creation(
+ unique int id: @implicitly_typeable_object_creation_expr ref);
+
+mutator_invocation_mode(
+ unique int id: @operator_invocation_expr ref,
+ int mode: int ref /* prefix = 1, postfix = 2*/);
+
+expr_value(
+ unique int id: @expr ref,
+ string value: string ref);
+
+expr_call(
+ unique int caller_id: @expr ref,
+ int target_id: @callable ref);
+
+expr_access(
+ unique int accesser_id: @access_expr ref,
+ int target_id: @accessible ref);
+
+@accessible = @method | @assignable | @local_function | @namespace;
+
+expr_location(
+ unique int id: @expr ref,
+ int loc: @location ref);
+
+dynamic_member_name(
+ unique int id: @late_bindable_expr ref,
+ string name: string ref);
+
+@qualifiable_expr = @member_access_expr
+ | @method_invocation_expr
+ | @element_access_expr
+ | @assign_op_call_expr;
+
+conditional_access(
+ unique int id: @qualifiable_expr ref);
+
+expr_argument(
+ unique int id: @expr ref,
+ int mode: int ref);
+ /* mode is the same as params: value = 0, ref = 1, out = 2 */
+
+expr_argument_name(
+ unique int id: @expr ref,
+ string name: string ref);
+
+lambda_expr_return_type(
+ unique int id: @lambda_expr ref,
+ int type_id: @type_or_ref ref);
+
+/* Compiler generated */
+
+compiler_generated(unique int id: @element ref);
+
+/** CONTROL/DATA FLOW **/
+
+@control_flow_element = @stmt | @expr | @parameter;
+
+/* XML Files */
+
+xmlEncoding (
+ unique int id: @file ref,
+ string encoding: string ref);
+
+xmlDTDs(
+ unique int id: @xmldtd,
+ string root: string ref,
+ string publicId: string ref,
+ string systemId: string ref,
+ int fileid: @file ref);
+
+xmlElements(
+ unique int id: @xmlelement,
+ string name: string ref,
+ int parentid: @xmlparent ref,
+ int idx: int ref,
+ int fileid: @file ref);
+
+xmlAttrs(
+ unique int id: @xmlattribute,
+ int elementid: @xmlelement ref,
+ string name: string ref,
+ string value: string ref,
+ int idx: int ref,
+ int fileid: @file ref);
+
+xmlNs(
+ int id: @xmlnamespace,
+ string prefixName: string ref,
+ string URI: string ref,
+ int fileid: @file ref);
+
+xmlHasNs(
+ int elementId: @xmlnamespaceable ref,
+ int nsId: @xmlnamespace ref,
+ int fileid: @file ref);
+
+xmlComments(
+ unique int id: @xmlcomment,
+ string text: string ref,
+ int parentid: @xmlparent ref,
+ int fileid: @file ref);
+
+xmlChars(
+ unique int id: @xmlcharacters,
+ string text: string ref,
+ int parentid: @xmlparent ref,
+ int idx: int ref,
+ int isCDATA: int ref,
+ int fileid: @file ref);
+
+@xmlparent = @file | @xmlelement;
+@xmlnamespaceable = @xmlelement | @xmlattribute;
+
+xmllocations(
+ int xmlElement: @xmllocatable ref,
+ int location: @location_default ref);
+
+@xmllocatable = @xmlcharacters | @xmlelement | @xmlcomment | @xmlattribute | @xmldtd | @file | @xmlnamespace;
+
+/* Comments */
+
+commentline(
+ unique int id: @commentline,
+ int kind: int ref,
+ string text: string ref,
+ string rawtext: string ref);
+
+case @commentline.kind of
+ 0 = @singlelinecomment
+| 1 = @xmldoccomment
+| 2 = @multilinecomment;
+
+commentline_location(
+ unique int id: @commentline ref,
+ int loc: @location ref);
+
+commentblock(
+ unique int id : @commentblock);
+
+commentblock_location(
+ unique int id: @commentblock ref,
+ int loc: @location ref);
+
+commentblock_binding(
+ int id: @commentblock ref,
+ int entity: @element ref,
+ int bindtype: int ref); /* 0: Parent, 1: Best, 2: Before, 3: After */
+
+commentblock_child(
+ int id: @commentblock ref,
+ int commentline: @commentline ref,
+ int index: int ref);
+
+/* ASP.NET */
+
+case @asp_element.kind of
+ 0=@asp_close_tag
+| 1=@asp_code
+| 2=@asp_comment
+| 3=@asp_data_binding
+| 4=@asp_directive
+| 5=@asp_open_tag
+| 6=@asp_quoted_string
+| 7=@asp_text
+| 8=@asp_xml_directive;
+
+@asp_attribute = @asp_code | @asp_data_binding | @asp_quoted_string;
+
+asp_elements(
+ unique int id: @asp_element,
+ int kind: int ref,
+ int loc: @location ref);
+
+asp_comment_server(unique int comment: @asp_comment ref);
+asp_code_inline(unique int code: @asp_code ref);
+asp_directive_attribute(
+ int directive: @asp_directive ref,
+ int index: int ref,
+ string name: string ref,
+ int value: @asp_quoted_string ref);
+asp_directive_name(
+ unique int directive: @asp_directive ref,
+ string name: string ref);
+asp_element_body(
+ unique int element: @asp_element ref,
+ string body: string ref);
+asp_tag_attribute(
+ int tag: @asp_open_tag ref,
+ int index: int ref,
+ string name: string ref,
+ int attribute: @asp_attribute ref);
+asp_tag_name(
+ unique int tag: @asp_open_tag ref,
+ string name: string ref);
+asp_tag_isempty(int tag: @asp_open_tag ref);
diff --git a/csharp/downgrades/3cabc77473cbbda95edebafea345c2e3fdfa12d9/semmlecode.csharp.dbscheme b/csharp/downgrades/3cabc77473cbbda95edebafea345c2e3fdfa12d9/semmlecode.csharp.dbscheme
new file mode 100644
index 000000000000..ea7ad33252e5
--- /dev/null
+++ b/csharp/downgrades/3cabc77473cbbda95edebafea345c2e3fdfa12d9/semmlecode.csharp.dbscheme
@@ -0,0 +1,1505 @@
+/* This is a dummy line to alter the dbscheme, so we can make a database upgrade
+ * without actually changing any of the dbscheme predicates. It contains a date
+ * to allow for such updates in the future as well.
+ *
+ * 2021-07-14
+ *
+ * DO NOT remove this comment carelessly, since it can revert the dbscheme back to a
+ * previously seen state (matching a previously seen SHA), which would make the upgrade
+ * mechanism not work properly.
+ */
+
+/**
+ * An invocation of the compiler. Note that more than one file may be
+ * compiled per invocation. For example, this command compiles three
+ * source files:
+ *
+ * csc f1.cs f2.cs f3.cs
+ *
+ * The `id` simply identifies the invocation, while `cwd` is the working
+ * directory from which the compiler was invoked.
+ */
+compilations(
+ unique int id : @compilation,
+ string cwd : string ref
+);
+
+compilation_info(
+ int id : @compilation ref,
+ string info_key: string ref,
+ string info_value: string ref
+)
+
+/**
+ * The arguments that were passed to the extractor for a compiler
+ * invocation. If `id` is for the compiler invocation
+ *
+ * csc f1.cs f2.cs f3.cs
+ *
+ * then typically there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0 | --compiler
+ * 1 | *path to compiler*
+ * 2 | f1.cs
+ * 3 | f2.cs
+ * 4 | f3.cs
+ */
+#keyset[id, num]
+compilation_args(
+ int id : @compilation ref,
+ int num : int ref,
+ string arg : string ref
+);
+
+/**
+ * The expanded arguments that were passed to the extractor for a
+ * compiler invocation. This is similar to `compilation_args`, but
+ * for a `@someFile.rsp` argument, it includes the arguments from that
+ * file, rather than just taking the argument literally.
+ */
+#keyset[id, num]
+compilation_expanded_args(
+ int id : @compilation ref,
+ int num : int ref,
+ string arg : string ref
+);
+
+/**
+ * The source files that are compiled by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ * csc f1.cs f2.cs f3.cs
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0 | f1.cs
+ * 1 | f2.cs
+ * 2 | f3.cs
+ */
+#keyset[id, num]
+compilation_compiling_files(
+ int id : @compilation ref,
+ int num : int ref,
+ int file : @file ref
+);
+
+/**
+ * The references used by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ * csc f1.cs f2.cs f3.cs /r:ref1.dll /r:ref2.dll /r:ref3.dll
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0 | ref1.dll
+ * 1 | ref2.dll
+ * 2 | ref3.dll
+ */
+#keyset[id, num]
+compilation_referencing_files(
+ int id : @compilation ref,
+ int num : int ref,
+ int file : @file ref
+);
+
+/**
+ * The time taken by the extractor for a compiler invocation.
+ *
+ * For each file `num`, there will be rows for
+ *
+ * kind | seconds
+ * ---- | ---
+ * 1 | CPU seconds used by the extractor frontend
+ * 2 | Elapsed seconds during the extractor frontend
+ * 3 | CPU seconds used by the extractor backend
+ * 4 | Elapsed seconds during the extractor backend
+ */
+#keyset[id, num, kind]
+compilation_time(
+ int id : @compilation ref,
+ int num : int ref,
+ /* kind:
+ 1 = frontend_cpu_seconds
+ 2 = frontend_elapsed_seconds
+ 3 = extractor_cpu_seconds
+ 4 = extractor_elapsed_seconds
+ */
+ int kind : int ref,
+ float seconds : float ref
+);
+
+/**
+ * An error or warning generated by the extractor.
+ * The diagnostic message `diagnostic` was generated during compiler
+ * invocation `compilation`, and is the `file_number_diagnostic_number`th
+ * message generated while extracting the `file_number`th file of that
+ * invocation.
+ */
+#keyset[compilation, file_number, file_number_diagnostic_number]
+diagnostic_for(
+ unique int diagnostic : @diagnostic ref,
+ int compilation : @compilation ref,
+ int file_number : int ref,
+ int file_number_diagnostic_number : int ref
+);
+
+diagnostics(
+ unique int id: @diagnostic,
+ int severity: int ref,
+ string error_tag: string ref,
+ string error_message: string ref,
+ string full_error_message: string ref,
+ int location: @location ref
+);
+
+extractor_messages(
+ unique int id: @extractor_message,
+ int severity: int ref,
+ string origin : string ref,
+ string text : string ref,
+ string entity : string ref,
+ int location: @location ref,
+ string stack_trace : string ref
+);
+
+/**
+ * If extraction was successful, then `cpu_seconds` and
+ * `elapsed_seconds` are the CPU time and elapsed time (respectively)
+ * that extraction took for compiler invocation `id`.
+ */
+compilation_finished(
+ unique int id : @compilation ref,
+ float cpu_seconds : float ref,
+ float elapsed_seconds : float ref
+);
+
+compilation_assembly(
+ unique int id : @compilation ref,
+ int assembly: @assembly ref
+)
+
+// Populated by the CSV extractor
+externalData(
+ int id: @externalDataElement,
+ string path: string ref,
+ int column: int ref,
+ string value: string ref);
+
+sourceLocationPrefix(
+ string prefix: string ref);
+
+/*
+ * Overlay support
+ */
+
+/**
+ * The CLI will automatically emit the tuple `databaseMetadata("isOverlay", "true")`,
+ * along with an `overlayChangedFiles` tuple for each new/modified/deleted file,
+ * when building an overlay database, and these can be used by the discard predicates.
+ */
+databaseMetadata(
+ string metadataKey : string ref,
+ string value : string ref
+);
+
+overlayChangedFiles(
+ string path : string ref
+);
+
+/*
+ * C# dbscheme
+ */
+
+/** ELEMENTS **/
+
+@element = @declaration | @stmt | @expr | @modifier | @attribute | @namespace_declaration
+ | @using_directive | @type_parameter_constraints | @externalDataElement
+ | @xmllocatable | @asp_element | @namespace | @preprocessor_directive;
+
+@declaration = @callable | @generic | @assignable | @namespace;
+
+@named_element = @namespace | @declaration;
+
+@declaration_with_accessors = @property | @indexer | @event;
+
+@assignable = @variable | @assignable_with_accessors | @event;
+
+@assignable_with_accessors = @property | @indexer;
+
+@attributable = @assembly | @field | @parameter | @operator | @method | @constructor
+ | @destructor | @callable_accessor | @value_or_ref_type | @declaration_with_accessors
+ | @local_function | @lambda_expr;
+
+/** LOCATIONS, ASEMMBLIES, MODULES, FILES and FOLDERS **/
+
+@location = @location_default | @assembly;
+
+@locatable = @declaration_with_accessors | @callable_accessor | @declaration_or_directive
+ | @diagnostic | @extractor_message | @preprocessor_directive | @attribute | @type_mention | @type_parameter_constraints
+ | @declaration_with_accessors | @callable_accessor | @operator | @method
+ | @constructor | @destructor | @field | @local_variable | @parameter | @stmt | @expr
+ | @xmllocatable | @commentline | @commentblock | @asp_element
+
+locations_default(
+ unique int id: @location_default,
+ int file: @file ref,
+ int beginLine: int ref,
+ int beginColumn: int ref,
+ int endLine: int ref,
+ int endColumn: int ref);
+
+locations_mapped(
+ unique int id: @location_default ref,
+ int mapped_to: @location_default ref);
+
+@sourceline = @file | @callable | @xmllocatable;
+
+numlines(
+ int element_id: @sourceline ref,
+ int num_lines: int ref,
+ int num_code: int ref,
+ int num_comment: int ref);
+
+assemblies(
+ unique int id: @assembly,
+ int file: @file ref,
+ string fullname: string ref,
+ string name: string ref,
+ string version: string ref);
+
+files(
+ unique int id: @file,
+ string name: string ref);
+
+folders(
+ unique int id: @folder,
+ string name: string ref);
+
+@container = @folder | @file ;
+
+containerparent(
+ int parent: @container ref,
+ unique int child: @container ref);
+
+file_extraction_mode(
+ unique int file: @file ref,
+ int mode: int ref
+ /* 0 = normal, 1 = standalone extractor */
+ );
+
+/** NAMESPACES **/
+
+@type_container = @namespace | @type;
+
+namespaces(
+ unique int id: @namespace,
+ string name: string ref);
+
+namespace_declarations(
+ unique int id: @namespace_declaration,
+ int namespace_id: @namespace ref);
+
+namespace_declaration_location(
+ unique int id: @namespace_declaration ref,
+ int loc: @location ref);
+
+parent_namespace(
+ unique int child_id: @type_container ref,
+ int namespace_id: @namespace ref);
+
+@declaration_or_directive = @namespace_declaration | @type | @using_directive;
+
+parent_namespace_declaration(
+ int child_id: @declaration_or_directive ref, // cannot be unique because of partial classes
+ int namespace_id: @namespace_declaration ref);
+
+@using_directive = @using_namespace_directive | @using_static_directive;
+
+using_global(
+ unique int id: @using_directive ref
+);
+
+using_namespace_directives(
+ unique int id: @using_namespace_directive,
+ int namespace_id: @namespace ref);
+
+using_static_directives(
+ unique int id: @using_static_directive,
+ int type_id: @type_or_ref ref);
+
+using_directive_location(
+ unique int id: @using_directive ref,
+ int loc: @location ref);
+
+@preprocessor_directive = @pragma_warning | @pragma_checksum | @directive_define | @directive_undefine | @directive_warning
+ | @directive_error | @directive_nullable | @directive_line | @directive_region | @directive_endregion | @directive_if
+ | @directive_elif | @directive_else | @directive_endif;
+
+@conditional_directive = @directive_if | @directive_elif;
+@branch_directive = @directive_if | @directive_elif | @directive_else;
+
+directive_ifs(
+ unique int id: @directive_if,
+ int branchTaken: int ref, /* 0: false, 1: true */
+ int conditionValue: int ref); /* 0: false, 1: true */
+
+directive_elifs(
+ unique int id: @directive_elif,
+ int branchTaken: int ref, /* 0: false, 1: true */
+ int conditionValue: int ref, /* 0: false, 1: true */
+ int parent: @directive_if ref,
+ int index: int ref);
+
+directive_elses(
+ unique int id: @directive_else,
+ int branchTaken: int ref, /* 0: false, 1: true */
+ int parent: @directive_if ref,
+ int index: int ref);
+
+#keyset[id, start]
+directive_endifs(
+ unique int id: @directive_endif,
+ unique int start: @directive_if ref);
+
+directive_define_symbols(
+ unique int id: @define_symbol_expr ref,
+ string name: string ref);
+
+directive_regions(
+ unique int id: @directive_region,
+ string name: string ref);
+
+#keyset[id, start]
+directive_endregions(
+ unique int id: @directive_endregion,
+ unique int start: @directive_region ref);
+
+directive_lines(
+ unique int id: @directive_line,
+ int kind: int ref); /* 0: default, 1: hidden, 2: numeric, 3: span */
+
+directive_line_value(
+ unique int id: @directive_line ref,
+ int line: int ref);
+
+directive_line_file(
+ unique int id: @directive_line ref,
+ int file: @file ref);
+
+directive_line_offset(
+ unique int id: @directive_line ref,
+ int offset: int ref);
+
+directive_line_span(
+ unique int id: @directive_line ref,
+ int startLine: int ref,
+ int startColumn: int ref,
+ int endLine: int ref,
+ int endColumn: int ref);
+
+directive_nullables(
+ unique int id: @directive_nullable,
+ int setting: int ref, /* 0: disable, 1: enable, 2: restore */
+ int target: int ref); /* 0: none, 1: annotations, 2: warnings */
+
+directive_warnings(
+ unique int id: @directive_warning,
+ string message: string ref);
+
+directive_errors(
+ unique int id: @directive_error,
+ string message: string ref);
+
+directive_undefines(
+ unique int id: @directive_undefine,
+ string name: string ref);
+
+directive_defines(
+ unique int id: @directive_define,
+ string name: string ref);
+
+pragma_checksums(
+ unique int id: @pragma_checksum,
+ int file: @file ref,
+ string guid: string ref,
+ string bytes: string ref);
+
+pragma_warnings(
+ unique int id: @pragma_warning,
+ int kind: int ref /* 0 = disable, 1 = restore */);
+
+#keyset[id, index]
+pragma_warning_error_codes(
+ int id: @pragma_warning ref,
+ string errorCode: string ref,
+ int index: int ref);
+
+preprocessor_directive_location(
+ unique int id: @preprocessor_directive ref,
+ int loc: @location ref);
+
+preprocessor_directive_compilation(
+ int id: @preprocessor_directive ref,
+ int compilation: @compilation ref);
+
+preprocessor_directive_active(
+ unique int id: @preprocessor_directive ref,
+ int active: int ref); /* 0: false, 1: true */
+
+/** TYPES **/
+
+types(
+ unique int id: @type,
+ int kind: int ref,
+ string name: string ref);
+
+case @type.kind of
+ 1 = @bool_type
+| 2 = @char_type
+| 3 = @decimal_type
+| 4 = @sbyte_type
+| 5 = @short_type
+| 6 = @int_type
+| 7 = @long_type
+| 8 = @byte_type
+| 9 = @ushort_type
+| 10 = @uint_type
+| 11 = @ulong_type
+| 12 = @float_type
+| 13 = @double_type
+| 14 = @enum_type
+| 15 = @struct_type
+| 17 = @class_type
+| 19 = @interface_type
+| 20 = @delegate_type
+| 21 = @null_type
+| 22 = @type_parameter
+| 23 = @pointer_type
+| 24 = @nullable_type
+| 25 = @array_type
+| 26 = @void_type
+| 27 = @int_ptr_type
+| 28 = @uint_ptr_type
+| 29 = @dynamic_type
+| 30 = @arglist_type
+| 31 = @unknown_type
+| 32 = @tuple_type
+| 33 = @function_pointer_type
+| 34 = @inline_array_type
+| 35 = @extension_type
+ ;
+
+@simple_type = @bool_type | @char_type | @integral_type | @floating_point_type | @decimal_type;
+@integral_type = @signed_integral_type | @unsigned_integral_type;
+@signed_integral_type = @sbyte_type | @short_type | @int_type | @long_type;
+@unsigned_integral_type = @byte_type | @ushort_type | @uint_type | @ulong_type;
+@floating_point_type = @float_type | @double_type;
+@value_type = @simple_type | @enum_type | @struct_type | @nullable_type | @int_ptr_type
+ | @uint_ptr_type | @tuple_type | @void_type | @inline_array_type;
+@ref_type = @class_type | @interface_type | @array_type | @delegate_type | @null_type
+ | @dynamic_type | @extension_type;
+@value_or_ref_type = @value_type | @ref_type;
+
+typerefs(
+ unique int id: @typeref,
+ string name: string ref);
+
+typeref_type(
+ int id: @typeref ref,
+ unique int typeId: @type ref);
+
+@type_or_ref = @type | @typeref;
+
+array_element_type(
+ unique int array: @array_type ref,
+ int dimension: int ref,
+ int rank: int ref,
+ int element: @type_or_ref ref);
+
+nullable_underlying_type(
+ unique int nullable: @nullable_type ref,
+ int underlying: @type_or_ref ref);
+
+pointer_referent_type(
+ unique int pointer: @pointer_type ref,
+ int referent: @type_or_ref ref);
+
+enum_underlying_type(
+ unique int enum_id: @enum_type ref,
+ int underlying_type_id: @type_or_ref ref);
+
+delegate_return_type(
+ unique int delegate_id: @delegate_type ref,
+ int return_type_id: @type_or_ref ref);
+
+function_pointer_return_type(
+ unique int function_pointer_id: @function_pointer_type ref,
+ int return_type_id: @type_or_ref ref);
+
+extension_receiver_type(
+ unique int extension: @extension_type ref,
+ int receiver_type_id: @type_or_ref ref);
+
+extend(
+ int sub: @type ref,
+ int super: @type_or_ref ref);
+
+anonymous_types(
+ unique int id: @type ref);
+
+@interface_or_ref = @interface_type | @typeref;
+
+implement(
+ int sub: @type ref,
+ int super: @type_or_ref ref);
+
+type_location(
+ int id: @type ref,
+ int loc: @location ref);
+
+tuple_underlying_type(
+ unique int tuple: @tuple_type ref,
+ int struct: @type_or_ref ref);
+
+#keyset[tuple, index]
+tuple_element(
+ int tuple: @tuple_type ref,
+ int index: int ref,
+ unique int field: @field ref);
+
+attributes(
+ unique int id: @attribute,
+ int kind: int ref,
+ int type_id: @type_or_ref ref,
+ int target: @attributable ref);
+
+case @attribute.kind of
+ 0 = @attribute_default
+| 1 = @attribute_return
+| 2 = @attribute_assembly
+| 3 = @attribute_module
+;
+
+attribute_location(
+ int id: @attribute ref,
+ int loc: @location ref);
+
+@type_mention_parent = @element | @type_mention;
+
+type_mention(
+ unique int id: @type_mention,
+ int type_id: @type_or_ref ref,
+ int parent: @type_mention_parent ref);
+
+type_mention_location(
+ unique int id: @type_mention ref,
+ int loc: @location ref);
+
+@has_type_annotation = @assignable | @type_parameter | @callable | @expr | @delegate_type | @generic | @function_pointer_type;
+
+/**
+ * A direct annotation on an entity, for example `string? x;`.
+ *
+ * Annotations:
+ * 2 = reftype is not annotated "!"
+ * 3 = reftype is annotated "?"
+ * 4 = readonly ref type / in parameter
+ * 5 = ref type parameter, return or local variable
+ * 6 = out parameter
+ *
+ * Note that the annotation depends on the element it annotates.
+ * @assignable: The annotation is on the type of the assignable, for example the variable type.
+ * @type_parameter: The annotation is on the reftype constraint
+ * @callable: The annotation is on the return type
+ * @array_type: The annotation is on the element type
+ */
+type_annotation(int id: @has_type_annotation ref, int annotation: int ref);
+
+nullability(unique int nullability: @nullability, int kind: int ref);
+
+case @nullability.kind of
+ 0 = @oblivious
+| 1 = @not_annotated
+| 2 = @annotated
+;
+
+#keyset[parent, index]
+nullability_parent(int nullability: @nullability ref, int index: int ref, int parent: @nullability ref)
+
+type_nullability(int id: @has_type_annotation ref, int nullability: @nullability ref);
+
+/**
+ * The nullable flow state of an expression, as determined by Roslyn.
+ * 0 = none (default, not populated)
+ * 1 = not null
+ * 2 = maybe null
+ */
+expr_flowstate(unique int id: @expr ref, int state: int ref);
+
+/** GENERICS **/
+
+@generic = @type | @method | @local_function;
+
+type_parameters(
+ unique int id: @type_parameter ref,
+ int index: int ref,
+ int generic_id: @generic ref,
+ int variance: int ref /* none = 0, out = 1, in = 2 */);
+
+#keyset[constructed_id, index]
+type_arguments(
+ int id: @type_or_ref ref,
+ int index: int ref,
+ int constructed_id: @generic_or_ref ref);
+
+@generic_or_ref = @generic | @typeref;
+
+constructed_generic(
+ unique int constructed: @generic ref,
+ int generic: @generic_or_ref ref);
+
+type_parameter_constraints(
+ unique int id: @type_parameter_constraints,
+ int param_id: @type_parameter ref);
+
+type_parameter_constraints_location(
+ int id: @type_parameter_constraints ref,
+ int loc: @location ref);
+
+general_type_parameter_constraints(
+ int id: @type_parameter_constraints ref,
+ int kind: int ref /* class = 1, struct = 2, new = 3 */);
+
+specific_type_parameter_constraints(
+ int id: @type_parameter_constraints ref,
+ int base_id: @type_or_ref ref);
+
+specific_type_parameter_nullability(
+ int id: @type_parameter_constraints ref,
+ int base_id: @type_or_ref ref,
+ int nullability: @nullability ref);
+
+/** FUNCTION POINTERS */
+
+function_pointer_calling_conventions(
+ int id: @function_pointer_type ref,
+ int kind: int ref);
+
+#keyset[id, index]
+has_unmanaged_calling_conventions(
+ int id: @function_pointer_type ref,
+ int index: int ref,
+ int conv_id: @type_or_ref ref);
+
+/** MODIFIERS */
+
+@modifiable = @modifiable_direct | @event_accessor;
+
+@modifiable_direct = @member | @accessor | @local_function | @anonymous_function_expr;
+
+modifiers(
+ unique int id: @modifier,
+ string name: string ref);
+
+has_modifiers(
+ int id: @modifiable_direct ref,
+ int mod_id: @modifier ref);
+
+/** MEMBERS **/
+
+@member = @method | @constructor | @destructor | @field | @property | @event | @operator | @indexer | @type;
+
+@named_exprorstmt = @goto_stmt | @labeled_stmt | @expr;
+
+@virtualizable = @method | @property | @indexer | @event | @operator;
+
+exprorstmt_name(
+ unique int parent_id: @named_exprorstmt ref,
+ string name: string ref);
+
+nested_types(
+ unique int id: @type ref,
+ int declaring_type_id: @type ref,
+ int unbound_id: @type ref);
+
+properties(
+ unique int id: @property,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @property ref);
+
+property_location(
+ int id: @property ref,
+ int loc: @location ref);
+
+indexers(
+ unique int id: @indexer,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @indexer ref);
+
+indexer_location(
+ int id: @indexer ref,
+ int loc: @location ref);
+
+accessors(
+ unique int id: @accessor,
+ int kind: int ref,
+ string name: string ref,
+ int declaring_member_id: @member ref,
+ int unbound_id: @accessor ref);
+
+case @accessor.kind of
+ 1 = @getter
+| 2 = @setter
+ ;
+
+init_only_accessors(
+ unique int id: @accessor ref);
+
+accessor_location(
+ int id: @accessor ref,
+ int loc: @location ref);
+
+events(
+ unique int id: @event,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @event ref);
+
+event_location(
+ int id: @event ref,
+ int loc: @location ref);
+
+event_accessors(
+ unique int id: @event_accessor,
+ int kind: int ref,
+ string name: string ref,
+ int declaring_event_id: @event ref,
+ int unbound_id: @event_accessor ref);
+
+case @event_accessor.kind of
+ 1 = @add_event_accessor
+| 2 = @remove_event_accessor
+ ;
+
+event_accessor_location(
+ int id: @event_accessor ref,
+ int loc: @location ref);
+
+operators(
+ unique int id: @operator,
+ string name: string ref,
+ string symbol: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @operator ref);
+
+operator_location(
+ int id: @operator ref,
+ int loc: @location ref);
+
+constant_value(
+ int id: @variable ref,
+ string value: string ref);
+
+/** CALLABLES **/
+
+@callable = @method | @constructor | @destructor | @operator | @callable_accessor | @anonymous_function_expr | @local_function;
+
+@callable_accessor = @accessor | @event_accessor;
+
+methods(
+ unique int id: @method,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @method ref);
+
+method_location(
+ int id: @method ref,
+ int loc: @location ref);
+
+constructors(
+ unique int id: @constructor,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int unbound_id: @constructor ref);
+
+constructor_location(
+ int id: @constructor ref,
+ int loc: @location ref);
+
+destructors(
+ unique int id: @destructor,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int unbound_id: @destructor ref);
+
+destructor_location(
+ int id: @destructor ref,
+ int loc: @location ref);
+
+overrides(
+ int id: @callable ref,
+ int base_id: @callable ref);
+
+explicitly_implements(
+ int id: @member ref,
+ int interface_id: @interface_or_ref ref);
+
+local_functions(
+ unique int id: @local_function,
+ string name: string ref,
+ int return_type: @type ref,
+ int unbound_id: @local_function ref);
+
+local_function_stmts(
+ unique int fn: @local_function_stmt ref,
+ int stmt: @local_function ref);
+
+/** VARIABLES **/
+
+@variable = @local_scope_variable | @field;
+
+@local_scope_variable = @local_variable | @parameter;
+
+fields(
+ unique int id: @field,
+ int kind: int ref,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @field ref);
+
+case @field.kind of
+ 1 = @addressable_field
+| 2 = @constant
+ ;
+
+field_location(
+ int id: @field ref,
+ int loc: @location ref);
+
+localvars(
+ unique int id: @local_variable,
+ int kind: int ref,
+ string name: string ref,
+ int implicitly_typed: int ref /* 0 = no, 1 = yes */,
+ int type_id: @type_or_ref ref,
+ int parent_id: @local_var_decl_expr ref);
+
+case @local_variable.kind of
+ 1 = @addressable_local_variable
+| 2 = @local_constant
+| 3 = @local_variable_ref
+ ;
+
+localvar_location(
+ unique int id: @local_variable ref,
+ int loc: @location ref);
+
+@parameterizable = @callable | @delegate_type | @indexer | @function_pointer_type | @extension_type;
+
+#keyset[name, parent_id]
+#keyset[index, parent_id]
+params(
+ unique int id: @parameter,
+ string name: string ref,
+ int type_id: @type_or_ref ref,
+ int index: int ref,
+ int mode: int ref, /* value = 0, ref = 1, out = 2, params/array = 3, this = 4, in = 5, ref readonly = 6 */
+ int parent_id: @parameterizable ref,
+ int unbound_id: @parameter ref);
+
+param_location(
+ int id: @parameter ref,
+ int loc: @location ref);
+
+@has_scoped_annotation = @local_scope_variable
+
+scoped_annotation(
+ int id: @has_scoped_annotation ref,
+ int kind: int ref // scoped ref = 1, scoped value = 2
+ );
+
+/** STATEMENTS **/
+
+@exprorstmt_parent = @control_flow_element | @top_level_exprorstmt_parent;
+
+statements(
+ unique int id: @stmt,
+ int kind: int ref);
+
+#keyset[index, parent]
+stmt_parent(
+ unique int stmt: @stmt ref,
+ int index: int ref,
+ int parent: @control_flow_element ref);
+
+@top_level_stmt_parent = @callable;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+stmt_parent_top_level(
+ unique int stmt: @stmt ref,
+ int index: int ref,
+ int parent: @top_level_stmt_parent ref);
+
+case @stmt.kind of
+ 1 = @block_stmt
+| 2 = @expr_stmt
+| 3 = @if_stmt
+| 4 = @switch_stmt
+| 5 = @while_stmt
+| 6 = @do_stmt
+| 7 = @for_stmt
+| 8 = @foreach_stmt
+| 9 = @break_stmt
+| 10 = @continue_stmt
+| 11 = @goto_stmt
+| 12 = @goto_case_stmt
+| 13 = @goto_default_stmt
+| 14 = @throw_stmt
+| 15 = @return_stmt
+| 16 = @yield_stmt
+| 17 = @try_stmt
+| 18 = @checked_stmt
+| 19 = @unchecked_stmt
+| 20 = @lock_stmt
+| 21 = @using_block_stmt
+| 22 = @var_decl_stmt
+| 23 = @const_decl_stmt
+| 24 = @empty_stmt
+| 25 = @unsafe_stmt
+| 26 = @fixed_stmt
+| 27 = @label_stmt
+| 28 = @catch
+| 29 = @case_stmt
+| 30 = @local_function_stmt
+| 31 = @using_decl_stmt
+ ;
+
+@using_stmt = @using_block_stmt | @using_decl_stmt;
+
+@labeled_stmt = @label_stmt | @case;
+
+@decl_stmt = @var_decl_stmt | @const_decl_stmt | @using_decl_stmt;
+
+@cond_stmt = @if_stmt | @switch_stmt;
+
+@loop_stmt = @while_stmt | @do_stmt | @for_stmt | @foreach_stmt;
+
+@jump_stmt = @break_stmt | @goto_any_stmt | @continue_stmt | @throw_stmt | @return_stmt
+ | @yield_stmt;
+
+@goto_any_stmt = @goto_default_stmt | @goto_case_stmt | @goto_stmt;
+
+
+stmt_location(
+ unique int id: @stmt ref,
+ int loc: @location ref);
+
+catch_type(
+ unique int catch_id: @catch ref,
+ int type_id: @type_or_ref ref,
+ int kind: int ref /* explicit = 1, implicit = 2 */);
+
+foreach_stmt_info(
+ unique int id: @foreach_stmt ref,
+ int kind: int ref /* non-async = 1, async = 2 */);
+
+@foreach_symbol = @method | @property | @type_or_ref;
+
+#keyset[id, kind]
+foreach_stmt_desugar(
+ int id: @foreach_stmt ref,
+ int symbol: @foreach_symbol ref,
+ int kind: int ref /* GetEnumeratorMethod = 1, CurrentProperty = 2, MoveNextMethod = 3, DisposeMethod = 4, ElementType = 5 */);
+
+/** EXPRESSIONS **/
+
+expressions(
+ unique int id: @expr,
+ int kind: int ref,
+ int type_id: @type_or_ref ref);
+
+#keyset[index, parent]
+expr_parent(
+ unique int expr: @expr ref,
+ int index: int ref,
+ int parent: @control_flow_element ref);
+
+@top_level_expr_parent = @attribute | @field | @property | @indexer | @parameter | @directive_if | @directive_elif;
+
+@top_level_exprorstmt_parent = @top_level_expr_parent | @top_level_stmt_parent;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+expr_parent_top_level(
+ unique int expr: @expr ref,
+ int index: int ref,
+ int parent: @top_level_exprorstmt_parent ref);
+
+case @expr.kind of
+/* literal */
+ 1 = @bool_literal_expr
+| 2 = @char_literal_expr
+| 3 = @decimal_literal_expr
+| 4 = @int_literal_expr
+| 5 = @long_literal_expr
+| 6 = @uint_literal_expr
+| 7 = @ulong_literal_expr
+| 8 = @float_literal_expr
+| 9 = @double_literal_expr
+| 10 = @utf16_string_literal_expr
+| 11 = @null_literal_expr
+/* primary & unary */
+| 12 = @this_access_expr
+| 13 = @base_access_expr
+| 14 = @local_variable_access_expr
+| 15 = @parameter_access_expr
+| 16 = @field_access_expr
+| 17 = @property_access_expr
+| 18 = @method_access_expr
+| 19 = @event_access_expr
+| 20 = @indexer_access_expr
+| 21 = @array_access_expr
+| 22 = @type_access_expr
+| 23 = @typeof_expr
+| 24 = @method_invocation_expr
+| 25 = @delegate_invocation_expr
+| 26 = @operator_invocation_expr
+| 27 = @cast_expr
+| 28 = @object_creation_expr
+| 29 = @explicit_delegate_creation_expr
+| 30 = @implicit_delegate_creation_expr
+| 31 = @array_creation_expr
+| 32 = @default_expr
+| 33 = @plus_expr
+| 34 = @minus_expr
+| 35 = @bit_not_expr
+| 36 = @log_not_expr
+| 37 = @post_incr_expr
+| 38 = @post_decr_expr
+| 39 = @pre_incr_expr
+| 40 = @pre_decr_expr
+/* multiplicative */
+| 41 = @mul_expr
+| 42 = @div_expr
+| 43 = @rem_expr
+/* additive */
+| 44 = @add_expr
+| 45 = @sub_expr
+/* shift */
+| 46 = @lshift_expr
+| 47 = @rshift_expr
+/* relational */
+| 48 = @lt_expr
+| 49 = @gt_expr
+| 50 = @le_expr
+| 51 = @ge_expr
+/* equality */
+| 52 = @eq_expr
+| 53 = @ne_expr
+/* logical */
+| 54 = @bit_and_expr
+| 55 = @bit_xor_expr
+| 56 = @bit_or_expr
+| 57 = @log_and_expr
+| 58 = @log_or_expr
+/* type testing */
+| 59 = @is_expr
+| 60 = @as_expr
+/* null coalescing */
+| 61 = @null_coalescing_expr
+/* conditional */
+| 62 = @conditional_expr
+/* assignment */
+| 63 = @simple_assign_expr
+| 64 = @assign_add_expr
+| 65 = @assign_sub_expr
+| 66 = @assign_mul_expr
+| 67 = @assign_div_expr
+| 68 = @assign_rem_expr
+| 69 = @assign_and_expr
+| 70 = @assign_xor_expr
+| 71 = @assign_or_expr
+| 72 = @assign_lshift_expr
+| 73 = @assign_rshift_expr
+/* more */
+| 74 = @object_init_expr
+| 75 = @collection_init_expr
+| 76 = @array_init_expr
+| 77 = @checked_expr
+| 78 = @unchecked_expr
+| 79 = @constructor_init_expr
+| 80 = @add_event_expr
+| 81 = @remove_event_expr
+| 82 = @par_expr
+| 83 = @local_var_decl_expr
+| 84 = @lambda_expr
+| 85 = @anonymous_method_expr
+| 86 = @namespace_expr
+/* dynamic */
+| 92 = @dynamic_element_access_expr
+| 93 = @dynamic_member_access_expr
+/* unsafe */
+| 100 = @pointer_indirection_expr
+| 101 = @address_of_expr
+| 102 = @sizeof_expr
+/* async */
+| 103 = @await_expr
+/* C# 6.0 */
+| 104 = @nameof_expr
+| 105 = @interpolated_string_expr
+| 106 = @unknown_expr
+/* C# 7.0 */
+| 107 = @throw_expr
+| 108 = @tuple_expr
+| 109 = @local_function_invocation_expr
+| 110 = @ref_expr
+| 111 = @discard_expr
+/* C# 8.0 */
+| 112 = @range_expr
+| 113 = @index_expr
+| 114 = @switch_expr
+| 115 = @recursive_pattern_expr
+| 116 = @property_pattern_expr
+| 117 = @positional_pattern_expr
+| 118 = @switch_case_expr
+| 119 = @assign_coalesce_expr
+| 120 = @suppress_nullable_warning_expr
+| 121 = @namespace_access_expr
+/* C# 9.0 */
+| 122 = @lt_pattern_expr
+| 123 = @gt_pattern_expr
+| 124 = @le_pattern_expr
+| 125 = @ge_pattern_expr
+| 126 = @not_pattern_expr
+| 127 = @and_pattern_expr
+| 128 = @or_pattern_expr
+| 129 = @function_pointer_invocation_expr
+| 130 = @with_expr
+/* C# 11.0 */
+| 131 = @list_pattern_expr
+| 132 = @slice_pattern_expr
+| 133 = @urshift_expr
+| 134 = @assign_urshift_expr
+| 135 = @utf8_string_literal_expr
+/* C# 12.0 */
+| 136 = @collection_expr
+| 137 = @spread_element_expr
+| 138 = @interpolated_string_insert_expr
+/* Preprocessor */
+| 999 = @define_symbol_expr
+;
+
+@switch = @switch_stmt | @switch_expr;
+@case = @case_stmt | @switch_case_expr;
+@pattern_match = @case | @is_expr;
+@unary_pattern_expr = @not_pattern_expr;
+@relational_pattern_expr = @gt_pattern_expr | @lt_pattern_expr | @ge_pattern_expr | @le_pattern_expr;
+@binary_pattern_expr = @and_pattern_expr | @or_pattern_expr;
+
+@integer_literal_expr = @int_literal_expr | @long_literal_expr | @uint_literal_expr | @ulong_literal_expr;
+@real_literal_expr = @float_literal_expr | @double_literal_expr | @decimal_literal_expr;
+@string_literal_expr = @utf16_string_literal_expr | @utf8_string_literal_expr;
+@literal_expr = @bool_literal_expr | @char_literal_expr | @integer_literal_expr | @real_literal_expr
+ | @string_literal_expr | @null_literal_expr;
+
+@assign_expr = @simple_assign_expr | @assign_op_expr | @local_var_decl_expr;
+@assign_op_call_expr = @assign_arith_expr | @assign_bitwise_expr
+@assign_op_expr = @assign_op_call_expr | @assign_event_expr | @assign_coalesce_expr;
+@assign_event_expr = @add_event_expr | @remove_event_expr;
+
+@add_operation = @add_expr | @assign_add_expr;
+@sub_operation = @sub_expr | @assign_sub_expr;
+@mul_operation = @mul_expr | @assign_mul_expr;
+@div_operation = @div_expr | @assign_div_expr;
+@rem_operation = @rem_expr | @assign_rem_expr;
+@and_operation = @bit_and_expr | @assign_and_expr;
+@xor_operation = @bit_xor_expr | @assign_xor_expr;
+@or_operation = @bit_or_expr | @assign_or_expr;
+@lshift_operation = @lshift_expr | @assign_lshift_expr;
+@rshift_operation = @rshift_expr | @assign_rshift_expr;
+@urshift_operation = @urshift_expr | @assign_urshift_expr;
+@null_coalescing_operation = @null_coalescing_expr | @assign_coalesce_expr;
+
+@assign_arith_expr = @assign_add_expr | @assign_sub_expr | @assign_mul_expr | @assign_div_expr
+ | @assign_rem_expr
+@assign_bitwise_expr = @assign_and_expr | @assign_or_expr | @assign_xor_expr
+ | @assign_lshift_expr | @assign_rshift_expr | @assign_urshift_expr;
+
+@member_access_expr = @field_access_expr | @property_access_expr | @indexer_access_expr | @event_access_expr
+ | @method_access_expr | @type_access_expr | @dynamic_member_access_expr;
+@access_expr = @member_access_expr | @this_access_expr | @base_access_expr | @assignable_access_expr | @namespace_access_expr;
+@element_access_expr = @indexer_access_expr | @array_access_expr | @dynamic_element_access_expr;
+
+@local_variable_access = @local_variable_access_expr | @local_var_decl_expr;
+@local_scope_variable_access_expr = @parameter_access_expr | @local_variable_access;
+@variable_access_expr = @local_scope_variable_access_expr | @field_access_expr;
+
+@assignable_access_expr = @variable_access_expr | @property_access_expr | @element_access_expr
+ | @event_access_expr | @dynamic_member_access_expr;
+
+@objectorcollection_init_expr = @object_init_expr | @collection_init_expr;
+
+@delegate_creation_expr = @explicit_delegate_creation_expr | @implicit_delegate_creation_expr;
+
+@bin_arith_op_expr = @mul_expr | @div_expr | @rem_expr | @add_expr | @sub_expr;
+@incr_op_expr = @pre_incr_expr | @post_incr_expr;
+@decr_op_expr = @pre_decr_expr | @post_decr_expr;
+@mut_op_expr = @incr_op_expr | @decr_op_expr;
+@un_arith_op_expr = @plus_expr | @minus_expr | @mut_op_expr;
+@arith_op_expr = @bin_arith_op_expr | @un_arith_op_expr;
+
+@ternary_log_op_expr = @conditional_expr;
+@bin_log_op_expr = @log_and_expr | @log_or_expr | @null_coalescing_expr;
+@un_log_op_expr = @log_not_expr;
+@log_expr = @un_log_op_expr | @bin_log_op_expr | @ternary_log_op_expr;
+
+@bin_bit_op_expr = @bit_and_expr | @bit_or_expr | @bit_xor_expr | @lshift_expr
+ | @rshift_expr | @urshift_expr;
+@un_bit_op_expr = @bit_not_expr;
+@bit_expr = @un_bit_op_expr | @bin_bit_op_expr;
+
+@equality_op_expr = @eq_expr | @ne_expr;
+@rel_op_expr = @gt_expr | @lt_expr| @ge_expr | @le_expr;
+@comp_expr = @equality_op_expr | @rel_op_expr;
+
+@op_expr = @un_op | @bin_op | @ternary_op;
+
+@ternary_op = @ternary_log_op_expr;
+@bin_op = @assign_expr | @bin_arith_op_expr | @bin_log_op_expr | @bin_bit_op_expr | @comp_expr;
+@un_op = @un_arith_op_expr | @un_log_op_expr | @un_bit_op_expr | @sizeof_expr
+ | @pointer_indirection_expr | @address_of_expr;
+
+@anonymous_function_expr = @lambda_expr | @anonymous_method_expr;
+
+@op_invoke_expr = @operator_invocation_expr | @assign_op_call_expr
+@call = @method_invocation_expr | @constructor_init_expr | @op_invoke_expr
+ | @delegate_invocation_expr | @object_creation_expr | @call_access_expr
+ | @local_function_invocation_expr | @function_pointer_invocation_expr;
+
+@call_access_expr = @property_access_expr | @event_access_expr | @indexer_access_expr;
+
+@late_bindable_expr = @dynamic_element_access_expr | @dynamic_member_access_expr
+ | @object_creation_expr | @method_invocation_expr | @op_invoke_expr;
+
+@throw_element = @throw_expr | @throw_stmt;
+
+@implicitly_typeable_object_creation_expr = @object_creation_expr | @explicit_delegate_creation_expr;
+
+implicitly_typed_array_creation(
+ unique int id: @array_creation_expr ref);
+
+explicitly_sized_array_creation(
+ unique int id: @array_creation_expr ref);
+
+stackalloc_array_creation(
+ unique int id: @array_creation_expr ref);
+
+implicitly_typed_object_creation(
+ unique int id: @implicitly_typeable_object_creation_expr ref);
+
+mutator_invocation_mode(
+ unique int id: @operator_invocation_expr ref,
+ int mode: int ref /* prefix = 1, postfix = 2*/);
+
+expr_value(
+ unique int id: @expr ref,
+ string value: string ref);
+
+expr_call(
+ unique int caller_id: @expr ref,
+ int target_id: @callable ref);
+
+expr_access(
+ unique int accesser_id: @access_expr ref,
+ int target_id: @accessible ref);
+
+@accessible = @method | @assignable | @local_function | @namespace;
+
+expr_location(
+ unique int id: @expr ref,
+ int loc: @location ref);
+
+dynamic_member_name(
+ unique int id: @late_bindable_expr ref,
+ string name: string ref);
+
+@qualifiable_expr = @member_access_expr
+ | @method_invocation_expr
+ | @element_access_expr
+ | @assign_op_call_expr;
+
+conditional_access(
+ unique int id: @qualifiable_expr ref);
+
+expr_argument(
+ unique int id: @expr ref,
+ int mode: int ref);
+ /* mode is the same as params: value = 0, ref = 1, out = 2 */
+
+expr_argument_name(
+ unique int id: @expr ref,
+ string name: string ref);
+
+lambda_expr_return_type(
+ unique int id: @lambda_expr ref,
+ int type_id: @type_or_ref ref);
+
+/* Compiler generated */
+
+compiler_generated(unique int id: @element ref);
+
+/** CONTROL/DATA FLOW **/
+
+@control_flow_element = @stmt | @expr;
+
+/* XML Files */
+
+xmlEncoding (
+ unique int id: @file ref,
+ string encoding: string ref);
+
+xmlDTDs(
+ unique int id: @xmldtd,
+ string root: string ref,
+ string publicId: string ref,
+ string systemId: string ref,
+ int fileid: @file ref);
+
+xmlElements(
+ unique int id: @xmlelement,
+ string name: string ref,
+ int parentid: @xmlparent ref,
+ int idx: int ref,
+ int fileid: @file ref);
+
+xmlAttrs(
+ unique int id: @xmlattribute,
+ int elementid: @xmlelement ref,
+ string name: string ref,
+ string value: string ref,
+ int idx: int ref,
+ int fileid: @file ref);
+
+xmlNs(
+ int id: @xmlnamespace,
+ string prefixName: string ref,
+ string URI: string ref,
+ int fileid: @file ref);
+
+xmlHasNs(
+ int elementId: @xmlnamespaceable ref,
+ int nsId: @xmlnamespace ref,
+ int fileid: @file ref);
+
+xmlComments(
+ unique int id: @xmlcomment,
+ string text: string ref,
+ int parentid: @xmlparent ref,
+ int fileid: @file ref);
+
+xmlChars(
+ unique int id: @xmlcharacters,
+ string text: string ref,
+ int parentid: @xmlparent ref,
+ int idx: int ref,
+ int isCDATA: int ref,
+ int fileid: @file ref);
+
+@xmlparent = @file | @xmlelement;
+@xmlnamespaceable = @xmlelement | @xmlattribute;
+
+xmllocations(
+ int xmlElement: @xmllocatable ref,
+ int location: @location_default ref);
+
+@xmllocatable = @xmlcharacters | @xmlelement | @xmlcomment | @xmlattribute | @xmldtd | @file | @xmlnamespace;
+
+/* Comments */
+
+commentline(
+ unique int id: @commentline,
+ int kind: int ref,
+ string text: string ref,
+ string rawtext: string ref);
+
+case @commentline.kind of
+ 0 = @singlelinecomment
+| 1 = @xmldoccomment
+| 2 = @multilinecomment;
+
+commentline_location(
+ unique int id: @commentline ref,
+ int loc: @location ref);
+
+commentblock(
+ unique int id : @commentblock);
+
+commentblock_location(
+ unique int id: @commentblock ref,
+ int loc: @location ref);
+
+commentblock_binding(
+ int id: @commentblock ref,
+ int entity: @element ref,
+ int bindtype: int ref); /* 0: Parent, 1: Best, 2: Before, 3: After */
+
+commentblock_child(
+ int id: @commentblock ref,
+ int commentline: @commentline ref,
+ int index: int ref);
+
+/* ASP.NET */
+
+case @asp_element.kind of
+ 0=@asp_close_tag
+| 1=@asp_code
+| 2=@asp_comment
+| 3=@asp_data_binding
+| 4=@asp_directive
+| 5=@asp_open_tag
+| 6=@asp_quoted_string
+| 7=@asp_text
+| 8=@asp_xml_directive;
+
+@asp_attribute = @asp_code | @asp_data_binding | @asp_quoted_string;
+
+asp_elements(
+ unique int id: @asp_element,
+ int kind: int ref,
+ int loc: @location ref);
+
+asp_comment_server(unique int comment: @asp_comment ref);
+asp_code_inline(unique int code: @asp_code ref);
+asp_directive_attribute(
+ int directive: @asp_directive ref,
+ int index: int ref,
+ string name: string ref,
+ int value: @asp_quoted_string ref);
+asp_directive_name(
+ unique int directive: @asp_directive ref,
+ string name: string ref);
+asp_element_body(
+ unique int element: @asp_element ref,
+ string body: string ref);
+asp_tag_attribute(
+ int tag: @asp_open_tag ref,
+ int index: int ref,
+ string name: string ref,
+ int attribute: @asp_attribute ref);
+asp_tag_name(
+ unique int tag: @asp_open_tag ref,
+ string name: string ref);
+asp_tag_isempty(int tag: @asp_open_tag ref);
diff --git a/csharp/downgrades/3cabc77473cbbda95edebafea345c2e3fdfa12d9/upgrade.properties b/csharp/downgrades/3cabc77473cbbda95edebafea345c2e3fdfa12d9/upgrade.properties
new file mode 100644
index 000000000000..72af45e177b8
--- /dev/null
+++ b/csharp/downgrades/3cabc77473cbbda95edebafea345c2e3fdfa12d9/upgrade.properties
@@ -0,0 +1,2 @@
+description: Remove `@parameter` from `@control_flow_element`
+compatibility: full
diff --git a/csharp/downgrades/ea7ad33252e550241975676f09fcc7b0a703deab/old.dbscheme b/csharp/downgrades/ea7ad33252e550241975676f09fcc7b0a703deab/old.dbscheme
new file mode 100644
index 000000000000..ea7ad33252e5
--- /dev/null
+++ b/csharp/downgrades/ea7ad33252e550241975676f09fcc7b0a703deab/old.dbscheme
@@ -0,0 +1,1505 @@
+/* This is a dummy line to alter the dbscheme, so we can make a database upgrade
+ * without actually changing any of the dbscheme predicates. It contains a date
+ * to allow for such updates in the future as well.
+ *
+ * 2021-07-14
+ *
+ * DO NOT remove this comment carelessly, since it can revert the dbscheme back to a
+ * previously seen state (matching a previously seen SHA), which would make the upgrade
+ * mechanism not work properly.
+ */
+
+/**
+ * An invocation of the compiler. Note that more than one file may be
+ * compiled per invocation. For example, this command compiles three
+ * source files:
+ *
+ * csc f1.cs f2.cs f3.cs
+ *
+ * The `id` simply identifies the invocation, while `cwd` is the working
+ * directory from which the compiler was invoked.
+ */
+compilations(
+ unique int id : @compilation,
+ string cwd : string ref
+);
+
+compilation_info(
+ int id : @compilation ref,
+ string info_key: string ref,
+ string info_value: string ref
+)
+
+/**
+ * The arguments that were passed to the extractor for a compiler
+ * invocation. If `id` is for the compiler invocation
+ *
+ * csc f1.cs f2.cs f3.cs
+ *
+ * then typically there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0 | --compiler
+ * 1 | *path to compiler*
+ * 2 | f1.cs
+ * 3 | f2.cs
+ * 4 | f3.cs
+ */
+#keyset[id, num]
+compilation_args(
+ int id : @compilation ref,
+ int num : int ref,
+ string arg : string ref
+);
+
+/**
+ * The expanded arguments that were passed to the extractor for a
+ * compiler invocation. This is similar to `compilation_args`, but
+ * for a `@someFile.rsp` argument, it includes the arguments from that
+ * file, rather than just taking the argument literally.
+ */
+#keyset[id, num]
+compilation_expanded_args(
+ int id : @compilation ref,
+ int num : int ref,
+ string arg : string ref
+);
+
+/**
+ * The source files that are compiled by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ * csc f1.cs f2.cs f3.cs
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0 | f1.cs
+ * 1 | f2.cs
+ * 2 | f3.cs
+ */
+#keyset[id, num]
+compilation_compiling_files(
+ int id : @compilation ref,
+ int num : int ref,
+ int file : @file ref
+);
+
+/**
+ * The references used by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ * csc f1.cs f2.cs f3.cs /r:ref1.dll /r:ref2.dll /r:ref3.dll
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0 | ref1.dll
+ * 1 | ref2.dll
+ * 2 | ref3.dll
+ */
+#keyset[id, num]
+compilation_referencing_files(
+ int id : @compilation ref,
+ int num : int ref,
+ int file : @file ref
+);
+
+/**
+ * The time taken by the extractor for a compiler invocation.
+ *
+ * For each file `num`, there will be rows for
+ *
+ * kind | seconds
+ * ---- | ---
+ * 1 | CPU seconds used by the extractor frontend
+ * 2 | Elapsed seconds during the extractor frontend
+ * 3 | CPU seconds used by the extractor backend
+ * 4 | Elapsed seconds during the extractor backend
+ */
+#keyset[id, num, kind]
+compilation_time(
+ int id : @compilation ref,
+ int num : int ref,
+ /* kind:
+ 1 = frontend_cpu_seconds
+ 2 = frontend_elapsed_seconds
+ 3 = extractor_cpu_seconds
+ 4 = extractor_elapsed_seconds
+ */
+ int kind : int ref,
+ float seconds : float ref
+);
+
+/**
+ * An error or warning generated by the extractor.
+ * The diagnostic message `diagnostic` was generated during compiler
+ * invocation `compilation`, and is the `file_number_diagnostic_number`th
+ * message generated while extracting the `file_number`th file of that
+ * invocation.
+ */
+#keyset[compilation, file_number, file_number_diagnostic_number]
+diagnostic_for(
+ unique int diagnostic : @diagnostic ref,
+ int compilation : @compilation ref,
+ int file_number : int ref,
+ int file_number_diagnostic_number : int ref
+);
+
+diagnostics(
+ unique int id: @diagnostic,
+ int severity: int ref,
+ string error_tag: string ref,
+ string error_message: string ref,
+ string full_error_message: string ref,
+ int location: @location ref
+);
+
+extractor_messages(
+ unique int id: @extractor_message,
+ int severity: int ref,
+ string origin : string ref,
+ string text : string ref,
+ string entity : string ref,
+ int location: @location ref,
+ string stack_trace : string ref
+);
+
+/**
+ * If extraction was successful, then `cpu_seconds` and
+ * `elapsed_seconds` are the CPU time and elapsed time (respectively)
+ * that extraction took for compiler invocation `id`.
+ */
+compilation_finished(
+ unique int id : @compilation ref,
+ float cpu_seconds : float ref,
+ float elapsed_seconds : float ref
+);
+
+compilation_assembly(
+ unique int id : @compilation ref,
+ int assembly: @assembly ref
+)
+
+// Populated by the CSV extractor
+externalData(
+ int id: @externalDataElement,
+ string path: string ref,
+ int column: int ref,
+ string value: string ref);
+
+sourceLocationPrefix(
+ string prefix: string ref);
+
+/*
+ * Overlay support
+ */
+
+/**
+ * The CLI will automatically emit the tuple `databaseMetadata("isOverlay", "true")`,
+ * along with an `overlayChangedFiles` tuple for each new/modified/deleted file,
+ * when building an overlay database, and these can be used by the discard predicates.
+ */
+databaseMetadata(
+ string metadataKey : string ref,
+ string value : string ref
+);
+
+overlayChangedFiles(
+ string path : string ref
+);
+
+/*
+ * C# dbscheme
+ */
+
+/** ELEMENTS **/
+
+@element = @declaration | @stmt | @expr | @modifier | @attribute | @namespace_declaration
+ | @using_directive | @type_parameter_constraints | @externalDataElement
+ | @xmllocatable | @asp_element | @namespace | @preprocessor_directive;
+
+@declaration = @callable | @generic | @assignable | @namespace;
+
+@named_element = @namespace | @declaration;
+
+@declaration_with_accessors = @property | @indexer | @event;
+
+@assignable = @variable | @assignable_with_accessors | @event;
+
+@assignable_with_accessors = @property | @indexer;
+
+@attributable = @assembly | @field | @parameter | @operator | @method | @constructor
+ | @destructor | @callable_accessor | @value_or_ref_type | @declaration_with_accessors
+ | @local_function | @lambda_expr;
+
+/** LOCATIONS, ASEMMBLIES, MODULES, FILES and FOLDERS **/
+
+@location = @location_default | @assembly;
+
+@locatable = @declaration_with_accessors | @callable_accessor | @declaration_or_directive
+ | @diagnostic | @extractor_message | @preprocessor_directive | @attribute | @type_mention | @type_parameter_constraints
+ | @declaration_with_accessors | @callable_accessor | @operator | @method
+ | @constructor | @destructor | @field | @local_variable | @parameter | @stmt | @expr
+ | @xmllocatable | @commentline | @commentblock | @asp_element
+
+locations_default(
+ unique int id: @location_default,
+ int file: @file ref,
+ int beginLine: int ref,
+ int beginColumn: int ref,
+ int endLine: int ref,
+ int endColumn: int ref);
+
+locations_mapped(
+ unique int id: @location_default ref,
+ int mapped_to: @location_default ref);
+
+@sourceline = @file | @callable | @xmllocatable;
+
+numlines(
+ int element_id: @sourceline ref,
+ int num_lines: int ref,
+ int num_code: int ref,
+ int num_comment: int ref);
+
+assemblies(
+ unique int id: @assembly,
+ int file: @file ref,
+ string fullname: string ref,
+ string name: string ref,
+ string version: string ref);
+
+files(
+ unique int id: @file,
+ string name: string ref);
+
+folders(
+ unique int id: @folder,
+ string name: string ref);
+
+@container = @folder | @file ;
+
+containerparent(
+ int parent: @container ref,
+ unique int child: @container ref);
+
+file_extraction_mode(
+ unique int file: @file ref,
+ int mode: int ref
+ /* 0 = normal, 1 = standalone extractor */
+ );
+
+/** NAMESPACES **/
+
+@type_container = @namespace | @type;
+
+namespaces(
+ unique int id: @namespace,
+ string name: string ref);
+
+namespace_declarations(
+ unique int id: @namespace_declaration,
+ int namespace_id: @namespace ref);
+
+namespace_declaration_location(
+ unique int id: @namespace_declaration ref,
+ int loc: @location ref);
+
+parent_namespace(
+ unique int child_id: @type_container ref,
+ int namespace_id: @namespace ref);
+
+@declaration_or_directive = @namespace_declaration | @type | @using_directive;
+
+parent_namespace_declaration(
+ int child_id: @declaration_or_directive ref, // cannot be unique because of partial classes
+ int namespace_id: @namespace_declaration ref);
+
+@using_directive = @using_namespace_directive | @using_static_directive;
+
+using_global(
+ unique int id: @using_directive ref
+);
+
+using_namespace_directives(
+ unique int id: @using_namespace_directive,
+ int namespace_id: @namespace ref);
+
+using_static_directives(
+ unique int id: @using_static_directive,
+ int type_id: @type_or_ref ref);
+
+using_directive_location(
+ unique int id: @using_directive ref,
+ int loc: @location ref);
+
+@preprocessor_directive = @pragma_warning | @pragma_checksum | @directive_define | @directive_undefine | @directive_warning
+ | @directive_error | @directive_nullable | @directive_line | @directive_region | @directive_endregion | @directive_if
+ | @directive_elif | @directive_else | @directive_endif;
+
+@conditional_directive = @directive_if | @directive_elif;
+@branch_directive = @directive_if | @directive_elif | @directive_else;
+
+directive_ifs(
+ unique int id: @directive_if,
+ int branchTaken: int ref, /* 0: false, 1: true */
+ int conditionValue: int ref); /* 0: false, 1: true */
+
+directive_elifs(
+ unique int id: @directive_elif,
+ int branchTaken: int ref, /* 0: false, 1: true */
+ int conditionValue: int ref, /* 0: false, 1: true */
+ int parent: @directive_if ref,
+ int index: int ref);
+
+directive_elses(
+ unique int id: @directive_else,
+ int branchTaken: int ref, /* 0: false, 1: true */
+ int parent: @directive_if ref,
+ int index: int ref);
+
+#keyset[id, start]
+directive_endifs(
+ unique int id: @directive_endif,
+ unique int start: @directive_if ref);
+
+directive_define_symbols(
+ unique int id: @define_symbol_expr ref,
+ string name: string ref);
+
+directive_regions(
+ unique int id: @directive_region,
+ string name: string ref);
+
+#keyset[id, start]
+directive_endregions(
+ unique int id: @directive_endregion,
+ unique int start: @directive_region ref);
+
+directive_lines(
+ unique int id: @directive_line,
+ int kind: int ref); /* 0: default, 1: hidden, 2: numeric, 3: span */
+
+directive_line_value(
+ unique int id: @directive_line ref,
+ int line: int ref);
+
+directive_line_file(
+ unique int id: @directive_line ref,
+ int file: @file ref);
+
+directive_line_offset(
+ unique int id: @directive_line ref,
+ int offset: int ref);
+
+directive_line_span(
+ unique int id: @directive_line ref,
+ int startLine: int ref,
+ int startColumn: int ref,
+ int endLine: int ref,
+ int endColumn: int ref);
+
+directive_nullables(
+ unique int id: @directive_nullable,
+ int setting: int ref, /* 0: disable, 1: enable, 2: restore */
+ int target: int ref); /* 0: none, 1: annotations, 2: warnings */
+
+directive_warnings(
+ unique int id: @directive_warning,
+ string message: string ref);
+
+directive_errors(
+ unique int id: @directive_error,
+ string message: string ref);
+
+directive_undefines(
+ unique int id: @directive_undefine,
+ string name: string ref);
+
+directive_defines(
+ unique int id: @directive_define,
+ string name: string ref);
+
+pragma_checksums(
+ unique int id: @pragma_checksum,
+ int file: @file ref,
+ string guid: string ref,
+ string bytes: string ref);
+
+pragma_warnings(
+ unique int id: @pragma_warning,
+ int kind: int ref /* 0 = disable, 1 = restore */);
+
+#keyset[id, index]
+pragma_warning_error_codes(
+ int id: @pragma_warning ref,
+ string errorCode: string ref,
+ int index: int ref);
+
+preprocessor_directive_location(
+ unique int id: @preprocessor_directive ref,
+ int loc: @location ref);
+
+preprocessor_directive_compilation(
+ int id: @preprocessor_directive ref,
+ int compilation: @compilation ref);
+
+preprocessor_directive_active(
+ unique int id: @preprocessor_directive ref,
+ int active: int ref); /* 0: false, 1: true */
+
+/** TYPES **/
+
+types(
+ unique int id: @type,
+ int kind: int ref,
+ string name: string ref);
+
+case @type.kind of
+ 1 = @bool_type
+| 2 = @char_type
+| 3 = @decimal_type
+| 4 = @sbyte_type
+| 5 = @short_type
+| 6 = @int_type
+| 7 = @long_type
+| 8 = @byte_type
+| 9 = @ushort_type
+| 10 = @uint_type
+| 11 = @ulong_type
+| 12 = @float_type
+| 13 = @double_type
+| 14 = @enum_type
+| 15 = @struct_type
+| 17 = @class_type
+| 19 = @interface_type
+| 20 = @delegate_type
+| 21 = @null_type
+| 22 = @type_parameter
+| 23 = @pointer_type
+| 24 = @nullable_type
+| 25 = @array_type
+| 26 = @void_type
+| 27 = @int_ptr_type
+| 28 = @uint_ptr_type
+| 29 = @dynamic_type
+| 30 = @arglist_type
+| 31 = @unknown_type
+| 32 = @tuple_type
+| 33 = @function_pointer_type
+| 34 = @inline_array_type
+| 35 = @extension_type
+ ;
+
+@simple_type = @bool_type | @char_type | @integral_type | @floating_point_type | @decimal_type;
+@integral_type = @signed_integral_type | @unsigned_integral_type;
+@signed_integral_type = @sbyte_type | @short_type | @int_type | @long_type;
+@unsigned_integral_type = @byte_type | @ushort_type | @uint_type | @ulong_type;
+@floating_point_type = @float_type | @double_type;
+@value_type = @simple_type | @enum_type | @struct_type | @nullable_type | @int_ptr_type
+ | @uint_ptr_type | @tuple_type | @void_type | @inline_array_type;
+@ref_type = @class_type | @interface_type | @array_type | @delegate_type | @null_type
+ | @dynamic_type | @extension_type;
+@value_or_ref_type = @value_type | @ref_type;
+
+typerefs(
+ unique int id: @typeref,
+ string name: string ref);
+
+typeref_type(
+ int id: @typeref ref,
+ unique int typeId: @type ref);
+
+@type_or_ref = @type | @typeref;
+
+array_element_type(
+ unique int array: @array_type ref,
+ int dimension: int ref,
+ int rank: int ref,
+ int element: @type_or_ref ref);
+
+nullable_underlying_type(
+ unique int nullable: @nullable_type ref,
+ int underlying: @type_or_ref ref);
+
+pointer_referent_type(
+ unique int pointer: @pointer_type ref,
+ int referent: @type_or_ref ref);
+
+enum_underlying_type(
+ unique int enum_id: @enum_type ref,
+ int underlying_type_id: @type_or_ref ref);
+
+delegate_return_type(
+ unique int delegate_id: @delegate_type ref,
+ int return_type_id: @type_or_ref ref);
+
+function_pointer_return_type(
+ unique int function_pointer_id: @function_pointer_type ref,
+ int return_type_id: @type_or_ref ref);
+
+extension_receiver_type(
+ unique int extension: @extension_type ref,
+ int receiver_type_id: @type_or_ref ref);
+
+extend(
+ int sub: @type ref,
+ int super: @type_or_ref ref);
+
+anonymous_types(
+ unique int id: @type ref);
+
+@interface_or_ref = @interface_type | @typeref;
+
+implement(
+ int sub: @type ref,
+ int super: @type_or_ref ref);
+
+type_location(
+ int id: @type ref,
+ int loc: @location ref);
+
+tuple_underlying_type(
+ unique int tuple: @tuple_type ref,
+ int struct: @type_or_ref ref);
+
+#keyset[tuple, index]
+tuple_element(
+ int tuple: @tuple_type ref,
+ int index: int ref,
+ unique int field: @field ref);
+
+attributes(
+ unique int id: @attribute,
+ int kind: int ref,
+ int type_id: @type_or_ref ref,
+ int target: @attributable ref);
+
+case @attribute.kind of
+ 0 = @attribute_default
+| 1 = @attribute_return
+| 2 = @attribute_assembly
+| 3 = @attribute_module
+;
+
+attribute_location(
+ int id: @attribute ref,
+ int loc: @location ref);
+
+@type_mention_parent = @element | @type_mention;
+
+type_mention(
+ unique int id: @type_mention,
+ int type_id: @type_or_ref ref,
+ int parent: @type_mention_parent ref);
+
+type_mention_location(
+ unique int id: @type_mention ref,
+ int loc: @location ref);
+
+@has_type_annotation = @assignable | @type_parameter | @callable | @expr | @delegate_type | @generic | @function_pointer_type;
+
+/**
+ * A direct annotation on an entity, for example `string? x;`.
+ *
+ * Annotations:
+ * 2 = reftype is not annotated "!"
+ * 3 = reftype is annotated "?"
+ * 4 = readonly ref type / in parameter
+ * 5 = ref type parameter, return or local variable
+ * 6 = out parameter
+ *
+ * Note that the annotation depends on the element it annotates.
+ * @assignable: The annotation is on the type of the assignable, for example the variable type.
+ * @type_parameter: The annotation is on the reftype constraint
+ * @callable: The annotation is on the return type
+ * @array_type: The annotation is on the element type
+ */
+type_annotation(int id: @has_type_annotation ref, int annotation: int ref);
+
+nullability(unique int nullability: @nullability, int kind: int ref);
+
+case @nullability.kind of
+ 0 = @oblivious
+| 1 = @not_annotated
+| 2 = @annotated
+;
+
+#keyset[parent, index]
+nullability_parent(int nullability: @nullability ref, int index: int ref, int parent: @nullability ref)
+
+type_nullability(int id: @has_type_annotation ref, int nullability: @nullability ref);
+
+/**
+ * The nullable flow state of an expression, as determined by Roslyn.
+ * 0 = none (default, not populated)
+ * 1 = not null
+ * 2 = maybe null
+ */
+expr_flowstate(unique int id: @expr ref, int state: int ref);
+
+/** GENERICS **/
+
+@generic = @type | @method | @local_function;
+
+type_parameters(
+ unique int id: @type_parameter ref,
+ int index: int ref,
+ int generic_id: @generic ref,
+ int variance: int ref /* none = 0, out = 1, in = 2 */);
+
+#keyset[constructed_id, index]
+type_arguments(
+ int id: @type_or_ref ref,
+ int index: int ref,
+ int constructed_id: @generic_or_ref ref);
+
+@generic_or_ref = @generic | @typeref;
+
+constructed_generic(
+ unique int constructed: @generic ref,
+ int generic: @generic_or_ref ref);
+
+type_parameter_constraints(
+ unique int id: @type_parameter_constraints,
+ int param_id: @type_parameter ref);
+
+type_parameter_constraints_location(
+ int id: @type_parameter_constraints ref,
+ int loc: @location ref);
+
+general_type_parameter_constraints(
+ int id: @type_parameter_constraints ref,
+ int kind: int ref /* class = 1, struct = 2, new = 3 */);
+
+specific_type_parameter_constraints(
+ int id: @type_parameter_constraints ref,
+ int base_id: @type_or_ref ref);
+
+specific_type_parameter_nullability(
+ int id: @type_parameter_constraints ref,
+ int base_id: @type_or_ref ref,
+ int nullability: @nullability ref);
+
+/** FUNCTION POINTERS */
+
+function_pointer_calling_conventions(
+ int id: @function_pointer_type ref,
+ int kind: int ref);
+
+#keyset[id, index]
+has_unmanaged_calling_conventions(
+ int id: @function_pointer_type ref,
+ int index: int ref,
+ int conv_id: @type_or_ref ref);
+
+/** MODIFIERS */
+
+@modifiable = @modifiable_direct | @event_accessor;
+
+@modifiable_direct = @member | @accessor | @local_function | @anonymous_function_expr;
+
+modifiers(
+ unique int id: @modifier,
+ string name: string ref);
+
+has_modifiers(
+ int id: @modifiable_direct ref,
+ int mod_id: @modifier ref);
+
+/** MEMBERS **/
+
+@member = @method | @constructor | @destructor | @field | @property | @event | @operator | @indexer | @type;
+
+@named_exprorstmt = @goto_stmt | @labeled_stmt | @expr;
+
+@virtualizable = @method | @property | @indexer | @event | @operator;
+
+exprorstmt_name(
+ unique int parent_id: @named_exprorstmt ref,
+ string name: string ref);
+
+nested_types(
+ unique int id: @type ref,
+ int declaring_type_id: @type ref,
+ int unbound_id: @type ref);
+
+properties(
+ unique int id: @property,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @property ref);
+
+property_location(
+ int id: @property ref,
+ int loc: @location ref);
+
+indexers(
+ unique int id: @indexer,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @indexer ref);
+
+indexer_location(
+ int id: @indexer ref,
+ int loc: @location ref);
+
+accessors(
+ unique int id: @accessor,
+ int kind: int ref,
+ string name: string ref,
+ int declaring_member_id: @member ref,
+ int unbound_id: @accessor ref);
+
+case @accessor.kind of
+ 1 = @getter
+| 2 = @setter
+ ;
+
+init_only_accessors(
+ unique int id: @accessor ref);
+
+accessor_location(
+ int id: @accessor ref,
+ int loc: @location ref);
+
+events(
+ unique int id: @event,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @event ref);
+
+event_location(
+ int id: @event ref,
+ int loc: @location ref);
+
+event_accessors(
+ unique int id: @event_accessor,
+ int kind: int ref,
+ string name: string ref,
+ int declaring_event_id: @event ref,
+ int unbound_id: @event_accessor ref);
+
+case @event_accessor.kind of
+ 1 = @add_event_accessor
+| 2 = @remove_event_accessor
+ ;
+
+event_accessor_location(
+ int id: @event_accessor ref,
+ int loc: @location ref);
+
+operators(
+ unique int id: @operator,
+ string name: string ref,
+ string symbol: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @operator ref);
+
+operator_location(
+ int id: @operator ref,
+ int loc: @location ref);
+
+constant_value(
+ int id: @variable ref,
+ string value: string ref);
+
+/** CALLABLES **/
+
+@callable = @method | @constructor | @destructor | @operator | @callable_accessor | @anonymous_function_expr | @local_function;
+
+@callable_accessor = @accessor | @event_accessor;
+
+methods(
+ unique int id: @method,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @method ref);
+
+method_location(
+ int id: @method ref,
+ int loc: @location ref);
+
+constructors(
+ unique int id: @constructor,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int unbound_id: @constructor ref);
+
+constructor_location(
+ int id: @constructor ref,
+ int loc: @location ref);
+
+destructors(
+ unique int id: @destructor,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int unbound_id: @destructor ref);
+
+destructor_location(
+ int id: @destructor ref,
+ int loc: @location ref);
+
+overrides(
+ int id: @callable ref,
+ int base_id: @callable ref);
+
+explicitly_implements(
+ int id: @member ref,
+ int interface_id: @interface_or_ref ref);
+
+local_functions(
+ unique int id: @local_function,
+ string name: string ref,
+ int return_type: @type ref,
+ int unbound_id: @local_function ref);
+
+local_function_stmts(
+ unique int fn: @local_function_stmt ref,
+ int stmt: @local_function ref);
+
+/** VARIABLES **/
+
+@variable = @local_scope_variable | @field;
+
+@local_scope_variable = @local_variable | @parameter;
+
+fields(
+ unique int id: @field,
+ int kind: int ref,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @field ref);
+
+case @field.kind of
+ 1 = @addressable_field
+| 2 = @constant
+ ;
+
+field_location(
+ int id: @field ref,
+ int loc: @location ref);
+
+localvars(
+ unique int id: @local_variable,
+ int kind: int ref,
+ string name: string ref,
+ int implicitly_typed: int ref /* 0 = no, 1 = yes */,
+ int type_id: @type_or_ref ref,
+ int parent_id: @local_var_decl_expr ref);
+
+case @local_variable.kind of
+ 1 = @addressable_local_variable
+| 2 = @local_constant
+| 3 = @local_variable_ref
+ ;
+
+localvar_location(
+ unique int id: @local_variable ref,
+ int loc: @location ref);
+
+@parameterizable = @callable | @delegate_type | @indexer | @function_pointer_type | @extension_type;
+
+#keyset[name, parent_id]
+#keyset[index, parent_id]
+params(
+ unique int id: @parameter,
+ string name: string ref,
+ int type_id: @type_or_ref ref,
+ int index: int ref,
+ int mode: int ref, /* value = 0, ref = 1, out = 2, params/array = 3, this = 4, in = 5, ref readonly = 6 */
+ int parent_id: @parameterizable ref,
+ int unbound_id: @parameter ref);
+
+param_location(
+ int id: @parameter ref,
+ int loc: @location ref);
+
+@has_scoped_annotation = @local_scope_variable
+
+scoped_annotation(
+ int id: @has_scoped_annotation ref,
+ int kind: int ref // scoped ref = 1, scoped value = 2
+ );
+
+/** STATEMENTS **/
+
+@exprorstmt_parent = @control_flow_element | @top_level_exprorstmt_parent;
+
+statements(
+ unique int id: @stmt,
+ int kind: int ref);
+
+#keyset[index, parent]
+stmt_parent(
+ unique int stmt: @stmt ref,
+ int index: int ref,
+ int parent: @control_flow_element ref);
+
+@top_level_stmt_parent = @callable;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+stmt_parent_top_level(
+ unique int stmt: @stmt ref,
+ int index: int ref,
+ int parent: @top_level_stmt_parent ref);
+
+case @stmt.kind of
+ 1 = @block_stmt
+| 2 = @expr_stmt
+| 3 = @if_stmt
+| 4 = @switch_stmt
+| 5 = @while_stmt
+| 6 = @do_stmt
+| 7 = @for_stmt
+| 8 = @foreach_stmt
+| 9 = @break_stmt
+| 10 = @continue_stmt
+| 11 = @goto_stmt
+| 12 = @goto_case_stmt
+| 13 = @goto_default_stmt
+| 14 = @throw_stmt
+| 15 = @return_stmt
+| 16 = @yield_stmt
+| 17 = @try_stmt
+| 18 = @checked_stmt
+| 19 = @unchecked_stmt
+| 20 = @lock_stmt
+| 21 = @using_block_stmt
+| 22 = @var_decl_stmt
+| 23 = @const_decl_stmt
+| 24 = @empty_stmt
+| 25 = @unsafe_stmt
+| 26 = @fixed_stmt
+| 27 = @label_stmt
+| 28 = @catch
+| 29 = @case_stmt
+| 30 = @local_function_stmt
+| 31 = @using_decl_stmt
+ ;
+
+@using_stmt = @using_block_stmt | @using_decl_stmt;
+
+@labeled_stmt = @label_stmt | @case;
+
+@decl_stmt = @var_decl_stmt | @const_decl_stmt | @using_decl_stmt;
+
+@cond_stmt = @if_stmt | @switch_stmt;
+
+@loop_stmt = @while_stmt | @do_stmt | @for_stmt | @foreach_stmt;
+
+@jump_stmt = @break_stmt | @goto_any_stmt | @continue_stmt | @throw_stmt | @return_stmt
+ | @yield_stmt;
+
+@goto_any_stmt = @goto_default_stmt | @goto_case_stmt | @goto_stmt;
+
+
+stmt_location(
+ unique int id: @stmt ref,
+ int loc: @location ref);
+
+catch_type(
+ unique int catch_id: @catch ref,
+ int type_id: @type_or_ref ref,
+ int kind: int ref /* explicit = 1, implicit = 2 */);
+
+foreach_stmt_info(
+ unique int id: @foreach_stmt ref,
+ int kind: int ref /* non-async = 1, async = 2 */);
+
+@foreach_symbol = @method | @property | @type_or_ref;
+
+#keyset[id, kind]
+foreach_stmt_desugar(
+ int id: @foreach_stmt ref,
+ int symbol: @foreach_symbol ref,
+ int kind: int ref /* GetEnumeratorMethod = 1, CurrentProperty = 2, MoveNextMethod = 3, DisposeMethod = 4, ElementType = 5 */);
+
+/** EXPRESSIONS **/
+
+expressions(
+ unique int id: @expr,
+ int kind: int ref,
+ int type_id: @type_or_ref ref);
+
+#keyset[index, parent]
+expr_parent(
+ unique int expr: @expr ref,
+ int index: int ref,
+ int parent: @control_flow_element ref);
+
+@top_level_expr_parent = @attribute | @field | @property | @indexer | @parameter | @directive_if | @directive_elif;
+
+@top_level_exprorstmt_parent = @top_level_expr_parent | @top_level_stmt_parent;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+expr_parent_top_level(
+ unique int expr: @expr ref,
+ int index: int ref,
+ int parent: @top_level_exprorstmt_parent ref);
+
+case @expr.kind of
+/* literal */
+ 1 = @bool_literal_expr
+| 2 = @char_literal_expr
+| 3 = @decimal_literal_expr
+| 4 = @int_literal_expr
+| 5 = @long_literal_expr
+| 6 = @uint_literal_expr
+| 7 = @ulong_literal_expr
+| 8 = @float_literal_expr
+| 9 = @double_literal_expr
+| 10 = @utf16_string_literal_expr
+| 11 = @null_literal_expr
+/* primary & unary */
+| 12 = @this_access_expr
+| 13 = @base_access_expr
+| 14 = @local_variable_access_expr
+| 15 = @parameter_access_expr
+| 16 = @field_access_expr
+| 17 = @property_access_expr
+| 18 = @method_access_expr
+| 19 = @event_access_expr
+| 20 = @indexer_access_expr
+| 21 = @array_access_expr
+| 22 = @type_access_expr
+| 23 = @typeof_expr
+| 24 = @method_invocation_expr
+| 25 = @delegate_invocation_expr
+| 26 = @operator_invocation_expr
+| 27 = @cast_expr
+| 28 = @object_creation_expr
+| 29 = @explicit_delegate_creation_expr
+| 30 = @implicit_delegate_creation_expr
+| 31 = @array_creation_expr
+| 32 = @default_expr
+| 33 = @plus_expr
+| 34 = @minus_expr
+| 35 = @bit_not_expr
+| 36 = @log_not_expr
+| 37 = @post_incr_expr
+| 38 = @post_decr_expr
+| 39 = @pre_incr_expr
+| 40 = @pre_decr_expr
+/* multiplicative */
+| 41 = @mul_expr
+| 42 = @div_expr
+| 43 = @rem_expr
+/* additive */
+| 44 = @add_expr
+| 45 = @sub_expr
+/* shift */
+| 46 = @lshift_expr
+| 47 = @rshift_expr
+/* relational */
+| 48 = @lt_expr
+| 49 = @gt_expr
+| 50 = @le_expr
+| 51 = @ge_expr
+/* equality */
+| 52 = @eq_expr
+| 53 = @ne_expr
+/* logical */
+| 54 = @bit_and_expr
+| 55 = @bit_xor_expr
+| 56 = @bit_or_expr
+| 57 = @log_and_expr
+| 58 = @log_or_expr
+/* type testing */
+| 59 = @is_expr
+| 60 = @as_expr
+/* null coalescing */
+| 61 = @null_coalescing_expr
+/* conditional */
+| 62 = @conditional_expr
+/* assignment */
+| 63 = @simple_assign_expr
+| 64 = @assign_add_expr
+| 65 = @assign_sub_expr
+| 66 = @assign_mul_expr
+| 67 = @assign_div_expr
+| 68 = @assign_rem_expr
+| 69 = @assign_and_expr
+| 70 = @assign_xor_expr
+| 71 = @assign_or_expr
+| 72 = @assign_lshift_expr
+| 73 = @assign_rshift_expr
+/* more */
+| 74 = @object_init_expr
+| 75 = @collection_init_expr
+| 76 = @array_init_expr
+| 77 = @checked_expr
+| 78 = @unchecked_expr
+| 79 = @constructor_init_expr
+| 80 = @add_event_expr
+| 81 = @remove_event_expr
+| 82 = @par_expr
+| 83 = @local_var_decl_expr
+| 84 = @lambda_expr
+| 85 = @anonymous_method_expr
+| 86 = @namespace_expr
+/* dynamic */
+| 92 = @dynamic_element_access_expr
+| 93 = @dynamic_member_access_expr
+/* unsafe */
+| 100 = @pointer_indirection_expr
+| 101 = @address_of_expr
+| 102 = @sizeof_expr
+/* async */
+| 103 = @await_expr
+/* C# 6.0 */
+| 104 = @nameof_expr
+| 105 = @interpolated_string_expr
+| 106 = @unknown_expr
+/* C# 7.0 */
+| 107 = @throw_expr
+| 108 = @tuple_expr
+| 109 = @local_function_invocation_expr
+| 110 = @ref_expr
+| 111 = @discard_expr
+/* C# 8.0 */
+| 112 = @range_expr
+| 113 = @index_expr
+| 114 = @switch_expr
+| 115 = @recursive_pattern_expr
+| 116 = @property_pattern_expr
+| 117 = @positional_pattern_expr
+| 118 = @switch_case_expr
+| 119 = @assign_coalesce_expr
+| 120 = @suppress_nullable_warning_expr
+| 121 = @namespace_access_expr
+/* C# 9.0 */
+| 122 = @lt_pattern_expr
+| 123 = @gt_pattern_expr
+| 124 = @le_pattern_expr
+| 125 = @ge_pattern_expr
+| 126 = @not_pattern_expr
+| 127 = @and_pattern_expr
+| 128 = @or_pattern_expr
+| 129 = @function_pointer_invocation_expr
+| 130 = @with_expr
+/* C# 11.0 */
+| 131 = @list_pattern_expr
+| 132 = @slice_pattern_expr
+| 133 = @urshift_expr
+| 134 = @assign_urshift_expr
+| 135 = @utf8_string_literal_expr
+/* C# 12.0 */
+| 136 = @collection_expr
+| 137 = @spread_element_expr
+| 138 = @interpolated_string_insert_expr
+/* Preprocessor */
+| 999 = @define_symbol_expr
+;
+
+@switch = @switch_stmt | @switch_expr;
+@case = @case_stmt | @switch_case_expr;
+@pattern_match = @case | @is_expr;
+@unary_pattern_expr = @not_pattern_expr;
+@relational_pattern_expr = @gt_pattern_expr | @lt_pattern_expr | @ge_pattern_expr | @le_pattern_expr;
+@binary_pattern_expr = @and_pattern_expr | @or_pattern_expr;
+
+@integer_literal_expr = @int_literal_expr | @long_literal_expr | @uint_literal_expr | @ulong_literal_expr;
+@real_literal_expr = @float_literal_expr | @double_literal_expr | @decimal_literal_expr;
+@string_literal_expr = @utf16_string_literal_expr | @utf8_string_literal_expr;
+@literal_expr = @bool_literal_expr | @char_literal_expr | @integer_literal_expr | @real_literal_expr
+ | @string_literal_expr | @null_literal_expr;
+
+@assign_expr = @simple_assign_expr | @assign_op_expr | @local_var_decl_expr;
+@assign_op_call_expr = @assign_arith_expr | @assign_bitwise_expr
+@assign_op_expr = @assign_op_call_expr | @assign_event_expr | @assign_coalesce_expr;
+@assign_event_expr = @add_event_expr | @remove_event_expr;
+
+@add_operation = @add_expr | @assign_add_expr;
+@sub_operation = @sub_expr | @assign_sub_expr;
+@mul_operation = @mul_expr | @assign_mul_expr;
+@div_operation = @div_expr | @assign_div_expr;
+@rem_operation = @rem_expr | @assign_rem_expr;
+@and_operation = @bit_and_expr | @assign_and_expr;
+@xor_operation = @bit_xor_expr | @assign_xor_expr;
+@or_operation = @bit_or_expr | @assign_or_expr;
+@lshift_operation = @lshift_expr | @assign_lshift_expr;
+@rshift_operation = @rshift_expr | @assign_rshift_expr;
+@urshift_operation = @urshift_expr | @assign_urshift_expr;
+@null_coalescing_operation = @null_coalescing_expr | @assign_coalesce_expr;
+
+@assign_arith_expr = @assign_add_expr | @assign_sub_expr | @assign_mul_expr | @assign_div_expr
+ | @assign_rem_expr
+@assign_bitwise_expr = @assign_and_expr | @assign_or_expr | @assign_xor_expr
+ | @assign_lshift_expr | @assign_rshift_expr | @assign_urshift_expr;
+
+@member_access_expr = @field_access_expr | @property_access_expr | @indexer_access_expr | @event_access_expr
+ | @method_access_expr | @type_access_expr | @dynamic_member_access_expr;
+@access_expr = @member_access_expr | @this_access_expr | @base_access_expr | @assignable_access_expr | @namespace_access_expr;
+@element_access_expr = @indexer_access_expr | @array_access_expr | @dynamic_element_access_expr;
+
+@local_variable_access = @local_variable_access_expr | @local_var_decl_expr;
+@local_scope_variable_access_expr = @parameter_access_expr | @local_variable_access;
+@variable_access_expr = @local_scope_variable_access_expr | @field_access_expr;
+
+@assignable_access_expr = @variable_access_expr | @property_access_expr | @element_access_expr
+ | @event_access_expr | @dynamic_member_access_expr;
+
+@objectorcollection_init_expr = @object_init_expr | @collection_init_expr;
+
+@delegate_creation_expr = @explicit_delegate_creation_expr | @implicit_delegate_creation_expr;
+
+@bin_arith_op_expr = @mul_expr | @div_expr | @rem_expr | @add_expr | @sub_expr;
+@incr_op_expr = @pre_incr_expr | @post_incr_expr;
+@decr_op_expr = @pre_decr_expr | @post_decr_expr;
+@mut_op_expr = @incr_op_expr | @decr_op_expr;
+@un_arith_op_expr = @plus_expr | @minus_expr | @mut_op_expr;
+@arith_op_expr = @bin_arith_op_expr | @un_arith_op_expr;
+
+@ternary_log_op_expr = @conditional_expr;
+@bin_log_op_expr = @log_and_expr | @log_or_expr | @null_coalescing_expr;
+@un_log_op_expr = @log_not_expr;
+@log_expr = @un_log_op_expr | @bin_log_op_expr | @ternary_log_op_expr;
+
+@bin_bit_op_expr = @bit_and_expr | @bit_or_expr | @bit_xor_expr | @lshift_expr
+ | @rshift_expr | @urshift_expr;
+@un_bit_op_expr = @bit_not_expr;
+@bit_expr = @un_bit_op_expr | @bin_bit_op_expr;
+
+@equality_op_expr = @eq_expr | @ne_expr;
+@rel_op_expr = @gt_expr | @lt_expr| @ge_expr | @le_expr;
+@comp_expr = @equality_op_expr | @rel_op_expr;
+
+@op_expr = @un_op | @bin_op | @ternary_op;
+
+@ternary_op = @ternary_log_op_expr;
+@bin_op = @assign_expr | @bin_arith_op_expr | @bin_log_op_expr | @bin_bit_op_expr | @comp_expr;
+@un_op = @un_arith_op_expr | @un_log_op_expr | @un_bit_op_expr | @sizeof_expr
+ | @pointer_indirection_expr | @address_of_expr;
+
+@anonymous_function_expr = @lambda_expr | @anonymous_method_expr;
+
+@op_invoke_expr = @operator_invocation_expr | @assign_op_call_expr
+@call = @method_invocation_expr | @constructor_init_expr | @op_invoke_expr
+ | @delegate_invocation_expr | @object_creation_expr | @call_access_expr
+ | @local_function_invocation_expr | @function_pointer_invocation_expr;
+
+@call_access_expr = @property_access_expr | @event_access_expr | @indexer_access_expr;
+
+@late_bindable_expr = @dynamic_element_access_expr | @dynamic_member_access_expr
+ | @object_creation_expr | @method_invocation_expr | @op_invoke_expr;
+
+@throw_element = @throw_expr | @throw_stmt;
+
+@implicitly_typeable_object_creation_expr = @object_creation_expr | @explicit_delegate_creation_expr;
+
+implicitly_typed_array_creation(
+ unique int id: @array_creation_expr ref);
+
+explicitly_sized_array_creation(
+ unique int id: @array_creation_expr ref);
+
+stackalloc_array_creation(
+ unique int id: @array_creation_expr ref);
+
+implicitly_typed_object_creation(
+ unique int id: @implicitly_typeable_object_creation_expr ref);
+
+mutator_invocation_mode(
+ unique int id: @operator_invocation_expr ref,
+ int mode: int ref /* prefix = 1, postfix = 2*/);
+
+expr_value(
+ unique int id: @expr ref,
+ string value: string ref);
+
+expr_call(
+ unique int caller_id: @expr ref,
+ int target_id: @callable ref);
+
+expr_access(
+ unique int accesser_id: @access_expr ref,
+ int target_id: @accessible ref);
+
+@accessible = @method | @assignable | @local_function | @namespace;
+
+expr_location(
+ unique int id: @expr ref,
+ int loc: @location ref);
+
+dynamic_member_name(
+ unique int id: @late_bindable_expr ref,
+ string name: string ref);
+
+@qualifiable_expr = @member_access_expr
+ | @method_invocation_expr
+ | @element_access_expr
+ | @assign_op_call_expr;
+
+conditional_access(
+ unique int id: @qualifiable_expr ref);
+
+expr_argument(
+ unique int id: @expr ref,
+ int mode: int ref);
+ /* mode is the same as params: value = 0, ref = 1, out = 2 */
+
+expr_argument_name(
+ unique int id: @expr ref,
+ string name: string ref);
+
+lambda_expr_return_type(
+ unique int id: @lambda_expr ref,
+ int type_id: @type_or_ref ref);
+
+/* Compiler generated */
+
+compiler_generated(unique int id: @element ref);
+
+/** CONTROL/DATA FLOW **/
+
+@control_flow_element = @stmt | @expr;
+
+/* XML Files */
+
+xmlEncoding (
+ unique int id: @file ref,
+ string encoding: string ref);
+
+xmlDTDs(
+ unique int id: @xmldtd,
+ string root: string ref,
+ string publicId: string ref,
+ string systemId: string ref,
+ int fileid: @file ref);
+
+xmlElements(
+ unique int id: @xmlelement,
+ string name: string ref,
+ int parentid: @xmlparent ref,
+ int idx: int ref,
+ int fileid: @file ref);
+
+xmlAttrs(
+ unique int id: @xmlattribute,
+ int elementid: @xmlelement ref,
+ string name: string ref,
+ string value: string ref,
+ int idx: int ref,
+ int fileid: @file ref);
+
+xmlNs(
+ int id: @xmlnamespace,
+ string prefixName: string ref,
+ string URI: string ref,
+ int fileid: @file ref);
+
+xmlHasNs(
+ int elementId: @xmlnamespaceable ref,
+ int nsId: @xmlnamespace ref,
+ int fileid: @file ref);
+
+xmlComments(
+ unique int id: @xmlcomment,
+ string text: string ref,
+ int parentid: @xmlparent ref,
+ int fileid: @file ref);
+
+xmlChars(
+ unique int id: @xmlcharacters,
+ string text: string ref,
+ int parentid: @xmlparent ref,
+ int idx: int ref,
+ int isCDATA: int ref,
+ int fileid: @file ref);
+
+@xmlparent = @file | @xmlelement;
+@xmlnamespaceable = @xmlelement | @xmlattribute;
+
+xmllocations(
+ int xmlElement: @xmllocatable ref,
+ int location: @location_default ref);
+
+@xmllocatable = @xmlcharacters | @xmlelement | @xmlcomment | @xmlattribute | @xmldtd | @file | @xmlnamespace;
+
+/* Comments */
+
+commentline(
+ unique int id: @commentline,
+ int kind: int ref,
+ string text: string ref,
+ string rawtext: string ref);
+
+case @commentline.kind of
+ 0 = @singlelinecomment
+| 1 = @xmldoccomment
+| 2 = @multilinecomment;
+
+commentline_location(
+ unique int id: @commentline ref,
+ int loc: @location ref);
+
+commentblock(
+ unique int id : @commentblock);
+
+commentblock_location(
+ unique int id: @commentblock ref,
+ int loc: @location ref);
+
+commentblock_binding(
+ int id: @commentblock ref,
+ int entity: @element ref,
+ int bindtype: int ref); /* 0: Parent, 1: Best, 2: Before, 3: After */
+
+commentblock_child(
+ int id: @commentblock ref,
+ int commentline: @commentline ref,
+ int index: int ref);
+
+/* ASP.NET */
+
+case @asp_element.kind of
+ 0=@asp_close_tag
+| 1=@asp_code
+| 2=@asp_comment
+| 3=@asp_data_binding
+| 4=@asp_directive
+| 5=@asp_open_tag
+| 6=@asp_quoted_string
+| 7=@asp_text
+| 8=@asp_xml_directive;
+
+@asp_attribute = @asp_code | @asp_data_binding | @asp_quoted_string;
+
+asp_elements(
+ unique int id: @asp_element,
+ int kind: int ref,
+ int loc: @location ref);
+
+asp_comment_server(unique int comment: @asp_comment ref);
+asp_code_inline(unique int code: @asp_code ref);
+asp_directive_attribute(
+ int directive: @asp_directive ref,
+ int index: int ref,
+ string name: string ref,
+ int value: @asp_quoted_string ref);
+asp_directive_name(
+ unique int directive: @asp_directive ref,
+ string name: string ref);
+asp_element_body(
+ unique int element: @asp_element ref,
+ string body: string ref);
+asp_tag_attribute(
+ int tag: @asp_open_tag ref,
+ int index: int ref,
+ string name: string ref,
+ int attribute: @asp_attribute ref);
+asp_tag_name(
+ unique int tag: @asp_open_tag ref,
+ string name: string ref);
+asp_tag_isempty(int tag: @asp_open_tag ref);
diff --git a/csharp/downgrades/ea7ad33252e550241975676f09fcc7b0a703deab/semmlecode.csharp.dbscheme b/csharp/downgrades/ea7ad33252e550241975676f09fcc7b0a703deab/semmlecode.csharp.dbscheme
new file mode 100644
index 000000000000..19b8cc3e2dc7
--- /dev/null
+++ b/csharp/downgrades/ea7ad33252e550241975676f09fcc7b0a703deab/semmlecode.csharp.dbscheme
@@ -0,0 +1,1504 @@
+/* This is a dummy line to alter the dbscheme, so we can make a database upgrade
+ * without actually changing any of the dbscheme predicates. It contains a date
+ * to allow for such updates in the future as well.
+ *
+ * 2021-07-14
+ *
+ * DO NOT remove this comment carelessly, since it can revert the dbscheme back to a
+ * previously seen state (matching a previously seen SHA), which would make the upgrade
+ * mechanism not work properly.
+ */
+
+/**
+ * An invocation of the compiler. Note that more than one file may be
+ * compiled per invocation. For example, this command compiles three
+ * source files:
+ *
+ * csc f1.cs f2.cs f3.cs
+ *
+ * The `id` simply identifies the invocation, while `cwd` is the working
+ * directory from which the compiler was invoked.
+ */
+compilations(
+ unique int id : @compilation,
+ string cwd : string ref
+);
+
+compilation_info(
+ int id : @compilation ref,
+ string info_key: string ref,
+ string info_value: string ref
+)
+
+/**
+ * The arguments that were passed to the extractor for a compiler
+ * invocation. If `id` is for the compiler invocation
+ *
+ * csc f1.cs f2.cs f3.cs
+ *
+ * then typically there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0 | --compiler
+ * 1 | *path to compiler*
+ * 2 | f1.cs
+ * 3 | f2.cs
+ * 4 | f3.cs
+ */
+#keyset[id, num]
+compilation_args(
+ int id : @compilation ref,
+ int num : int ref,
+ string arg : string ref
+);
+
+/**
+ * The expanded arguments that were passed to the extractor for a
+ * compiler invocation. This is similar to `compilation_args`, but
+ * for a `@someFile.rsp` argument, it includes the arguments from that
+ * file, rather than just taking the argument literally.
+ */
+#keyset[id, num]
+compilation_expanded_args(
+ int id : @compilation ref,
+ int num : int ref,
+ string arg : string ref
+);
+
+/**
+ * The source files that are compiled by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ * csc f1.cs f2.cs f3.cs
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0 | f1.cs
+ * 1 | f2.cs
+ * 2 | f3.cs
+ */
+#keyset[id, num]
+compilation_compiling_files(
+ int id : @compilation ref,
+ int num : int ref,
+ int file : @file ref
+);
+
+/**
+ * The references used by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ * csc f1.cs f2.cs f3.cs /r:ref1.dll /r:ref2.dll /r:ref3.dll
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0 | ref1.dll
+ * 1 | ref2.dll
+ * 2 | ref3.dll
+ */
+#keyset[id, num]
+compilation_referencing_files(
+ int id : @compilation ref,
+ int num : int ref,
+ int file : @file ref
+);
+
+/**
+ * The time taken by the extractor for a compiler invocation.
+ *
+ * For each file `num`, there will be rows for
+ *
+ * kind | seconds
+ * ---- | ---
+ * 1 | CPU seconds used by the extractor frontend
+ * 2 | Elapsed seconds during the extractor frontend
+ * 3 | CPU seconds used by the extractor backend
+ * 4 | Elapsed seconds during the extractor backend
+ */
+#keyset[id, num, kind]
+compilation_time(
+ int id : @compilation ref,
+ int num : int ref,
+ /* kind:
+ 1 = frontend_cpu_seconds
+ 2 = frontend_elapsed_seconds
+ 3 = extractor_cpu_seconds
+ 4 = extractor_elapsed_seconds
+ */
+ int kind : int ref,
+ float seconds : float ref
+);
+
+/**
+ * An error or warning generated by the extractor.
+ * The diagnostic message `diagnostic` was generated during compiler
+ * invocation `compilation`, and is the `file_number_diagnostic_number`th
+ * message generated while extracting the `file_number`th file of that
+ * invocation.
+ */
+#keyset[compilation, file_number, file_number_diagnostic_number]
+diagnostic_for(
+ unique int diagnostic : @diagnostic ref,
+ int compilation : @compilation ref,
+ int file_number : int ref,
+ int file_number_diagnostic_number : int ref
+);
+
+diagnostics(
+ unique int id: @diagnostic,
+ int severity: int ref,
+ string error_tag: string ref,
+ string error_message: string ref,
+ string full_error_message: string ref,
+ int location: @location ref
+);
+
+extractor_messages(
+ unique int id: @extractor_message,
+ int severity: int ref,
+ string origin : string ref,
+ string text : string ref,
+ string entity : string ref,
+ int location: @location ref,
+ string stack_trace : string ref
+);
+
+/**
+ * If extraction was successful, then `cpu_seconds` and
+ * `elapsed_seconds` are the CPU time and elapsed time (respectively)
+ * that extraction took for compiler invocation `id`.
+ */
+compilation_finished(
+ unique int id : @compilation ref,
+ float cpu_seconds : float ref,
+ float elapsed_seconds : float ref
+);
+
+compilation_assembly(
+ unique int id : @compilation ref,
+ int assembly: @assembly ref
+)
+
+// Populated by the CSV extractor
+externalData(
+ int id: @externalDataElement,
+ string path: string ref,
+ int column: int ref,
+ string value: string ref);
+
+sourceLocationPrefix(
+ string prefix: string ref);
+
+/*
+ * Overlay support
+ */
+
+/**
+ * The CLI will automatically emit the tuple `databaseMetadata("isOverlay", "true")`,
+ * along with an `overlayChangedFiles` tuple for each new/modified/deleted file,
+ * when building an overlay database, and these can be used by the discard predicates.
+ */
+databaseMetadata(
+ string metadataKey : string ref,
+ string value : string ref
+);
+
+overlayChangedFiles(
+ string path : string ref
+);
+
+/*
+ * C# dbscheme
+ */
+
+/** ELEMENTS **/
+
+@element = @declaration | @stmt | @expr | @modifier | @attribute | @namespace_declaration
+ | @using_directive | @type_parameter_constraints | @externalDataElement
+ | @xmllocatable | @asp_element | @namespace | @preprocessor_directive;
+
+@declaration = @callable | @generic | @assignable | @namespace;
+
+@named_element = @namespace | @declaration;
+
+@declaration_with_accessors = @property | @indexer | @event;
+
+@assignable = @variable | @assignable_with_accessors | @event;
+
+@assignable_with_accessors = @property | @indexer;
+
+@attributable = @assembly | @field | @parameter | @operator | @method | @constructor
+ | @destructor | @callable_accessor | @value_or_ref_type | @declaration_with_accessors
+ | @local_function | @lambda_expr;
+
+/** LOCATIONS, ASEMMBLIES, MODULES, FILES and FOLDERS **/
+
+@location = @location_default | @assembly;
+
+@locatable = @declaration_with_accessors | @callable_accessor | @declaration_or_directive
+ | @diagnostic | @extractor_message | @preprocessor_directive | @attribute | @type_mention | @type_parameter_constraints
+ | @declaration_with_accessors | @callable_accessor | @operator | @method
+ | @constructor | @destructor | @field | @local_variable | @parameter | @stmt | @expr
+ | @xmllocatable | @commentline | @commentblock | @asp_element
+
+locations_default(
+ unique int id: @location_default,
+ int file: @file ref,
+ int beginLine: int ref,
+ int beginColumn: int ref,
+ int endLine: int ref,
+ int endColumn: int ref);
+
+locations_mapped(
+ unique int id: @location_default ref,
+ int mapped_to: @location_default ref);
+
+@sourceline = @file | @callable | @xmllocatable;
+
+numlines(
+ int element_id: @sourceline ref,
+ int num_lines: int ref,
+ int num_code: int ref,
+ int num_comment: int ref);
+
+assemblies(
+ unique int id: @assembly,
+ int file: @file ref,
+ string fullname: string ref,
+ string name: string ref,
+ string version: string ref);
+
+files(
+ unique int id: @file,
+ string name: string ref);
+
+folders(
+ unique int id: @folder,
+ string name: string ref);
+
+@container = @folder | @file ;
+
+containerparent(
+ int parent: @container ref,
+ unique int child: @container ref);
+
+file_extraction_mode(
+ unique int file: @file ref,
+ int mode: int ref
+ /* 0 = normal, 1 = standalone extractor */
+ );
+
+/** NAMESPACES **/
+
+@type_container = @namespace | @type;
+
+namespaces(
+ unique int id: @namespace,
+ string name: string ref);
+
+namespace_declarations(
+ unique int id: @namespace_declaration,
+ int namespace_id: @namespace ref);
+
+namespace_declaration_location(
+ unique int id: @namespace_declaration ref,
+ int loc: @location ref);
+
+parent_namespace(
+ unique int child_id: @type_container ref,
+ int namespace_id: @namespace ref);
+
+@declaration_or_directive = @namespace_declaration | @type | @using_directive;
+
+parent_namespace_declaration(
+ int child_id: @declaration_or_directive ref, // cannot be unique because of partial classes
+ int namespace_id: @namespace_declaration ref);
+
+@using_directive = @using_namespace_directive | @using_static_directive;
+
+using_global(
+ unique int id: @using_directive ref
+);
+
+using_namespace_directives(
+ unique int id: @using_namespace_directive,
+ int namespace_id: @namespace ref);
+
+using_static_directives(
+ unique int id: @using_static_directive,
+ int type_id: @type_or_ref ref);
+
+using_directive_location(
+ unique int id: @using_directive ref,
+ int loc: @location ref);
+
+@preprocessor_directive = @pragma_warning | @pragma_checksum | @directive_define | @directive_undefine | @directive_warning
+ | @directive_error | @directive_nullable | @directive_line | @directive_region | @directive_endregion | @directive_if
+ | @directive_elif | @directive_else | @directive_endif;
+
+@conditional_directive = @directive_if | @directive_elif;
+@branch_directive = @directive_if | @directive_elif | @directive_else;
+
+directive_ifs(
+ unique int id: @directive_if,
+ int branchTaken: int ref, /* 0: false, 1: true */
+ int conditionValue: int ref); /* 0: false, 1: true */
+
+directive_elifs(
+ unique int id: @directive_elif,
+ int branchTaken: int ref, /* 0: false, 1: true */
+ int conditionValue: int ref, /* 0: false, 1: true */
+ int parent: @directive_if ref,
+ int index: int ref);
+
+directive_elses(
+ unique int id: @directive_else,
+ int branchTaken: int ref, /* 0: false, 1: true */
+ int parent: @directive_if ref,
+ int index: int ref);
+
+#keyset[id, start]
+directive_endifs(
+ unique int id: @directive_endif,
+ unique int start: @directive_if ref);
+
+directive_define_symbols(
+ unique int id: @define_symbol_expr ref,
+ string name: string ref);
+
+directive_regions(
+ unique int id: @directive_region,
+ string name: string ref);
+
+#keyset[id, start]
+directive_endregions(
+ unique int id: @directive_endregion,
+ unique int start: @directive_region ref);
+
+directive_lines(
+ unique int id: @directive_line,
+ int kind: int ref); /* 0: default, 1: hidden, 2: numeric, 3: span */
+
+directive_line_value(
+ unique int id: @directive_line ref,
+ int line: int ref);
+
+directive_line_file(
+ unique int id: @directive_line ref,
+ int file: @file ref);
+
+directive_line_offset(
+ unique int id: @directive_line ref,
+ int offset: int ref);
+
+directive_line_span(
+ unique int id: @directive_line ref,
+ int startLine: int ref,
+ int startColumn: int ref,
+ int endLine: int ref,
+ int endColumn: int ref);
+
+directive_nullables(
+ unique int id: @directive_nullable,
+ int setting: int ref, /* 0: disable, 1: enable, 2: restore */
+ int target: int ref); /* 0: none, 1: annotations, 2: warnings */
+
+directive_warnings(
+ unique int id: @directive_warning,
+ string message: string ref);
+
+directive_errors(
+ unique int id: @directive_error,
+ string message: string ref);
+
+directive_undefines(
+ unique int id: @directive_undefine,
+ string name: string ref);
+
+directive_defines(
+ unique int id: @directive_define,
+ string name: string ref);
+
+pragma_checksums(
+ unique int id: @pragma_checksum,
+ int file: @file ref,
+ string guid: string ref,
+ string bytes: string ref);
+
+pragma_warnings(
+ unique int id: @pragma_warning,
+ int kind: int ref /* 0 = disable, 1 = restore */);
+
+#keyset[id, index]
+pragma_warning_error_codes(
+ int id: @pragma_warning ref,
+ string errorCode: string ref,
+ int index: int ref);
+
+preprocessor_directive_location(
+ unique int id: @preprocessor_directive ref,
+ int loc: @location ref);
+
+preprocessor_directive_compilation(
+ int id: @preprocessor_directive ref,
+ int compilation: @compilation ref);
+
+preprocessor_directive_active(
+ unique int id: @preprocessor_directive ref,
+ int active: int ref); /* 0: false, 1: true */
+
+/** TYPES **/
+
+types(
+ unique int id: @type,
+ int kind: int ref,
+ string name: string ref);
+
+case @type.kind of
+ 1 = @bool_type
+| 2 = @char_type
+| 3 = @decimal_type
+| 4 = @sbyte_type
+| 5 = @short_type
+| 6 = @int_type
+| 7 = @long_type
+| 8 = @byte_type
+| 9 = @ushort_type
+| 10 = @uint_type
+| 11 = @ulong_type
+| 12 = @float_type
+| 13 = @double_type
+| 14 = @enum_type
+| 15 = @struct_type
+| 17 = @class_type
+| 19 = @interface_type
+| 20 = @delegate_type
+| 21 = @null_type
+| 22 = @type_parameter
+| 23 = @pointer_type
+| 24 = @nullable_type
+| 25 = @array_type
+| 26 = @void_type
+| 27 = @int_ptr_type
+| 28 = @uint_ptr_type
+| 29 = @dynamic_type
+| 30 = @arglist_type
+| 31 = @unknown_type
+| 32 = @tuple_type
+| 33 = @function_pointer_type
+| 34 = @inline_array_type
+| 35 = @extension_type
+ ;
+
+@simple_type = @bool_type | @char_type | @integral_type | @floating_point_type | @decimal_type;
+@integral_type = @signed_integral_type | @unsigned_integral_type;
+@signed_integral_type = @sbyte_type | @short_type | @int_type | @long_type;
+@unsigned_integral_type = @byte_type | @ushort_type | @uint_type | @ulong_type;
+@floating_point_type = @float_type | @double_type;
+@value_type = @simple_type | @enum_type | @struct_type | @nullable_type | @int_ptr_type
+ | @uint_ptr_type | @tuple_type | @void_type | @inline_array_type;
+@ref_type = @class_type | @interface_type | @array_type | @delegate_type | @null_type
+ | @dynamic_type | @extension_type;
+@value_or_ref_type = @value_type | @ref_type;
+
+typerefs(
+ unique int id: @typeref,
+ string name: string ref);
+
+typeref_type(
+ int id: @typeref ref,
+ unique int typeId: @type ref);
+
+@type_or_ref = @type | @typeref;
+
+array_element_type(
+ unique int array: @array_type ref,
+ int dimension: int ref,
+ int rank: int ref,
+ int element: @type_or_ref ref);
+
+nullable_underlying_type(
+ unique int nullable: @nullable_type ref,
+ int underlying: @type_or_ref ref);
+
+pointer_referent_type(
+ unique int pointer: @pointer_type ref,
+ int referent: @type_or_ref ref);
+
+enum_underlying_type(
+ unique int enum_id: @enum_type ref,
+ int underlying_type_id: @type_or_ref ref);
+
+delegate_return_type(
+ unique int delegate_id: @delegate_type ref,
+ int return_type_id: @type_or_ref ref);
+
+function_pointer_return_type(
+ unique int function_pointer_id: @function_pointer_type ref,
+ int return_type_id: @type_or_ref ref);
+
+extension_receiver_type(
+ unique int extension: @extension_type ref,
+ int receiver_type_id: @type_or_ref ref);
+
+extend(
+ int sub: @type ref,
+ int super: @type_or_ref ref);
+
+anonymous_types(
+ unique int id: @type ref);
+
+@interface_or_ref = @interface_type | @typeref;
+
+implement(
+ int sub: @type ref,
+ int super: @type_or_ref ref);
+
+type_location(
+ int id: @type ref,
+ int loc: @location ref);
+
+tuple_underlying_type(
+ unique int tuple: @tuple_type ref,
+ int struct: @type_or_ref ref);
+
+#keyset[tuple, index]
+tuple_element(
+ int tuple: @tuple_type ref,
+ int index: int ref,
+ unique int field: @field ref);
+
+attributes(
+ unique int id: @attribute,
+ int kind: int ref,
+ int type_id: @type_or_ref ref,
+ int target: @attributable ref);
+
+case @attribute.kind of
+ 0 = @attribute_default
+| 1 = @attribute_return
+| 2 = @attribute_assembly
+| 3 = @attribute_module
+;
+
+attribute_location(
+ int id: @attribute ref,
+ int loc: @location ref);
+
+@type_mention_parent = @element | @type_mention;
+
+type_mention(
+ unique int id: @type_mention,
+ int type_id: @type_or_ref ref,
+ int parent: @type_mention_parent ref);
+
+type_mention_location(
+ unique int id: @type_mention ref,
+ int loc: @location ref);
+
+@has_type_annotation = @assignable | @type_parameter | @callable | @expr | @delegate_type | @generic | @function_pointer_type;
+
+/**
+ * A direct annotation on an entity, for example `string? x;`.
+ *
+ * Annotations:
+ * 2 = reftype is not annotated "!"
+ * 3 = reftype is annotated "?"
+ * 4 = readonly ref type / in parameter
+ * 5 = ref type parameter, return or local variable
+ * 6 = out parameter
+ *
+ * Note that the annotation depends on the element it annotates.
+ * @assignable: The annotation is on the type of the assignable, for example the variable type.
+ * @type_parameter: The annotation is on the reftype constraint
+ * @callable: The annotation is on the return type
+ * @array_type: The annotation is on the element type
+ */
+type_annotation(int id: @has_type_annotation ref, int annotation: int ref);
+
+nullability(unique int nullability: @nullability, int kind: int ref);
+
+case @nullability.kind of
+ 0 = @oblivious
+| 1 = @not_annotated
+| 2 = @annotated
+;
+
+#keyset[parent, index]
+nullability_parent(int nullability: @nullability ref, int index: int ref, int parent: @nullability ref)
+
+type_nullability(int id: @has_type_annotation ref, int nullability: @nullability ref);
+
+/**
+ * The nullable flow state of an expression, as determined by Roslyn.
+ * 0 = none (default, not populated)
+ * 1 = not null
+ * 2 = maybe null
+ */
+expr_flowstate(unique int id: @expr ref, int state: int ref);
+
+/** GENERICS **/
+
+@generic = @type | @method | @local_function;
+
+type_parameters(
+ unique int id: @type_parameter ref,
+ int index: int ref,
+ int generic_id: @generic ref,
+ int variance: int ref /* none = 0, out = 1, in = 2 */);
+
+#keyset[constructed_id, index]
+type_arguments(
+ int id: @type_or_ref ref,
+ int index: int ref,
+ int constructed_id: @generic_or_ref ref);
+
+@generic_or_ref = @generic | @typeref;
+
+constructed_generic(
+ unique int constructed: @generic ref,
+ int generic: @generic_or_ref ref);
+
+type_parameter_constraints(
+ unique int id: @type_parameter_constraints,
+ int param_id: @type_parameter ref);
+
+type_parameter_constraints_location(
+ int id: @type_parameter_constraints ref,
+ int loc: @location ref);
+
+general_type_parameter_constraints(
+ int id: @type_parameter_constraints ref,
+ int kind: int ref /* class = 1, struct = 2, new = 3 */);
+
+specific_type_parameter_constraints(
+ int id: @type_parameter_constraints ref,
+ int base_id: @type_or_ref ref);
+
+specific_type_parameter_nullability(
+ int id: @type_parameter_constraints ref,
+ int base_id: @type_or_ref ref,
+ int nullability: @nullability ref);
+
+/** FUNCTION POINTERS */
+
+function_pointer_calling_conventions(
+ int id: @function_pointer_type ref,
+ int kind: int ref);
+
+#keyset[id, index]
+has_unmanaged_calling_conventions(
+ int id: @function_pointer_type ref,
+ int index: int ref,
+ int conv_id: @type_or_ref ref);
+
+/** MODIFIERS */
+
+@modifiable = @modifiable_direct | @event_accessor;
+
+@modifiable_direct = @member | @accessor | @local_function | @anonymous_function_expr;
+
+modifiers(
+ unique int id: @modifier,
+ string name: string ref);
+
+has_modifiers(
+ int id: @modifiable_direct ref,
+ int mod_id: @modifier ref);
+
+/** MEMBERS **/
+
+@member = @method | @constructor | @destructor | @field | @property | @event | @operator | @indexer | @type;
+
+@named_exprorstmt = @goto_stmt | @labeled_stmt | @expr;
+
+@virtualizable = @method | @property | @indexer | @event | @operator;
+
+exprorstmt_name(
+ unique int parent_id: @named_exprorstmt ref,
+ string name: string ref);
+
+nested_types(
+ unique int id: @type ref,
+ int declaring_type_id: @type ref,
+ int unbound_id: @type ref);
+
+properties(
+ unique int id: @property,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @property ref);
+
+property_location(
+ int id: @property ref,
+ int loc: @location ref);
+
+indexers(
+ unique int id: @indexer,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @indexer ref);
+
+indexer_location(
+ int id: @indexer ref,
+ int loc: @location ref);
+
+accessors(
+ unique int id: @accessor,
+ int kind: int ref,
+ string name: string ref,
+ int declaring_member_id: @member ref,
+ int unbound_id: @accessor ref);
+
+case @accessor.kind of
+ 1 = @getter
+| 2 = @setter
+ ;
+
+init_only_accessors(
+ unique int id: @accessor ref);
+
+accessor_location(
+ int id: @accessor ref,
+ int loc: @location ref);
+
+events(
+ unique int id: @event,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @event ref);
+
+event_location(
+ int id: @event ref,
+ int loc: @location ref);
+
+event_accessors(
+ unique int id: @event_accessor,
+ int kind: int ref,
+ string name: string ref,
+ int declaring_event_id: @event ref,
+ int unbound_id: @event_accessor ref);
+
+case @event_accessor.kind of
+ 1 = @add_event_accessor
+| 2 = @remove_event_accessor
+ ;
+
+event_accessor_location(
+ int id: @event_accessor ref,
+ int loc: @location ref);
+
+operators(
+ unique int id: @operator,
+ string name: string ref,
+ string symbol: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @operator ref);
+
+operator_location(
+ int id: @operator ref,
+ int loc: @location ref);
+
+constant_value(
+ int id: @variable ref,
+ string value: string ref);
+
+/** CALLABLES **/
+
+@callable = @method | @constructor | @destructor | @operator | @callable_accessor | @anonymous_function_expr | @local_function;
+
+@callable_accessor = @accessor | @event_accessor;
+
+methods(
+ unique int id: @method,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @method ref);
+
+method_location(
+ int id: @method ref,
+ int loc: @location ref);
+
+constructors(
+ unique int id: @constructor,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int unbound_id: @constructor ref);
+
+constructor_location(
+ int id: @constructor ref,
+ int loc: @location ref);
+
+destructors(
+ unique int id: @destructor,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int unbound_id: @destructor ref);
+
+destructor_location(
+ int id: @destructor ref,
+ int loc: @location ref);
+
+overrides(
+ int id: @callable ref,
+ int base_id: @callable ref);
+
+explicitly_implements(
+ int id: @member ref,
+ int interface_id: @interface_or_ref ref);
+
+local_functions(
+ unique int id: @local_function,
+ string name: string ref,
+ int return_type: @type ref,
+ int unbound_id: @local_function ref);
+
+local_function_stmts(
+ unique int fn: @local_function_stmt ref,
+ int stmt: @local_function ref);
+
+/** VARIABLES **/
+
+@variable = @local_scope_variable | @field;
+
+@local_scope_variable = @local_variable | @parameter;
+
+fields(
+ unique int id: @field,
+ int kind: int ref,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @field ref);
+
+case @field.kind of
+ 1 = @addressable_field
+| 2 = @constant
+ ;
+
+field_location(
+ int id: @field ref,
+ int loc: @location ref);
+
+localvars(
+ unique int id: @local_variable,
+ int kind: int ref,
+ string name: string ref,
+ int implicitly_typed: int ref /* 0 = no, 1 = yes */,
+ int type_id: @type_or_ref ref,
+ int parent_id: @local_var_decl_expr ref);
+
+case @local_variable.kind of
+ 1 = @addressable_local_variable
+| 2 = @local_constant
+| 3 = @local_variable_ref
+ ;
+
+localvar_location(
+ unique int id: @local_variable ref,
+ int loc: @location ref);
+
+@parameterizable = @callable | @delegate_type | @indexer | @function_pointer_type | @extension_type;
+
+#keyset[name, parent_id]
+#keyset[index, parent_id]
+params(
+ unique int id: @parameter,
+ string name: string ref,
+ int type_id: @type_or_ref ref,
+ int index: int ref,
+ int mode: int ref, /* value = 0, ref = 1, out = 2, params/array = 3, this = 4, in = 5, ref readonly = 6 */
+ int parent_id: @parameterizable ref,
+ int unbound_id: @parameter ref);
+
+param_location(
+ int id: @parameter ref,
+ int loc: @location ref);
+
+@has_scoped_annotation = @local_scope_variable
+
+scoped_annotation(
+ int id: @has_scoped_annotation ref,
+ int kind: int ref // scoped ref = 1, scoped value = 2
+ );
+
+/** STATEMENTS **/
+
+@exprorstmt_parent = @control_flow_element | @top_level_exprorstmt_parent;
+
+statements(
+ unique int id: @stmt,
+ int kind: int ref);
+
+#keyset[index, parent]
+stmt_parent(
+ unique int stmt: @stmt ref,
+ int index: int ref,
+ int parent: @control_flow_element ref);
+
+@top_level_stmt_parent = @callable;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+stmt_parent_top_level(
+ unique int stmt: @stmt ref,
+ int index: int ref,
+ int parent: @top_level_stmt_parent ref);
+
+case @stmt.kind of
+ 1 = @block_stmt
+| 2 = @expr_stmt
+| 3 = @if_stmt
+| 4 = @switch_stmt
+| 5 = @while_stmt
+| 6 = @do_stmt
+| 7 = @for_stmt
+| 8 = @foreach_stmt
+| 9 = @break_stmt
+| 10 = @continue_stmt
+| 11 = @goto_stmt
+| 12 = @goto_case_stmt
+| 13 = @goto_default_stmt
+| 14 = @throw_stmt
+| 15 = @return_stmt
+| 16 = @yield_stmt
+| 17 = @try_stmt
+| 18 = @checked_stmt
+| 19 = @unchecked_stmt
+| 20 = @lock_stmt
+| 21 = @using_block_stmt
+| 22 = @var_decl_stmt
+| 23 = @const_decl_stmt
+| 24 = @empty_stmt
+| 25 = @unsafe_stmt
+| 26 = @fixed_stmt
+| 27 = @label_stmt
+| 28 = @catch
+| 29 = @case_stmt
+| 30 = @local_function_stmt
+| 31 = @using_decl_stmt
+ ;
+
+@using_stmt = @using_block_stmt | @using_decl_stmt;
+
+@labeled_stmt = @label_stmt | @case;
+
+@decl_stmt = @var_decl_stmt | @const_decl_stmt | @using_decl_stmt;
+
+@cond_stmt = @if_stmt | @switch_stmt;
+
+@loop_stmt = @while_stmt | @do_stmt | @for_stmt | @foreach_stmt;
+
+@jump_stmt = @break_stmt | @goto_any_stmt | @continue_stmt | @throw_stmt | @return_stmt
+ | @yield_stmt;
+
+@goto_any_stmt = @goto_default_stmt | @goto_case_stmt | @goto_stmt;
+
+
+stmt_location(
+ unique int id: @stmt ref,
+ int loc: @location ref);
+
+catch_type(
+ unique int catch_id: @catch ref,
+ int type_id: @type_or_ref ref,
+ int kind: int ref /* explicit = 1, implicit = 2 */);
+
+foreach_stmt_info(
+ unique int id: @foreach_stmt ref,
+ int kind: int ref /* non-async = 1, async = 2 */);
+
+@foreach_symbol = @method | @property | @type_or_ref;
+
+#keyset[id, kind]
+foreach_stmt_desugar(
+ int id: @foreach_stmt ref,
+ int symbol: @foreach_symbol ref,
+ int kind: int ref /* GetEnumeratorMethod = 1, CurrentProperty = 2, MoveNextMethod = 3, DisposeMethod = 4, ElementType = 5 */);
+
+/** EXPRESSIONS **/
+
+expressions(
+ unique int id: @expr,
+ int kind: int ref,
+ int type_id: @type_or_ref ref);
+
+#keyset[index, parent]
+expr_parent(
+ unique int expr: @expr ref,
+ int index: int ref,
+ int parent: @control_flow_element ref);
+
+@top_level_expr_parent = @attribute | @field | @property | @indexer | @parameter | @directive_if | @directive_elif;
+
+@top_level_exprorstmt_parent = @top_level_expr_parent | @top_level_stmt_parent;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+expr_parent_top_level(
+ unique int expr: @expr ref,
+ int index: int ref,
+ int parent: @top_level_exprorstmt_parent ref);
+
+case @expr.kind of
+/* literal */
+ 1 = @bool_literal_expr
+| 2 = @char_literal_expr
+| 3 = @decimal_literal_expr
+| 4 = @int_literal_expr
+| 5 = @long_literal_expr
+| 6 = @uint_literal_expr
+| 7 = @ulong_literal_expr
+| 8 = @float_literal_expr
+| 9 = @double_literal_expr
+| 10 = @utf16_string_literal_expr
+| 11 = @null_literal_expr
+/* primary & unary */
+| 12 = @this_access_expr
+| 13 = @base_access_expr
+| 14 = @local_variable_access_expr
+| 15 = @parameter_access_expr
+| 16 = @field_access_expr
+| 17 = @property_access_expr
+| 18 = @method_access_expr
+| 19 = @event_access_expr
+| 20 = @indexer_access_expr
+| 21 = @array_access_expr
+| 22 = @type_access_expr
+| 23 = @typeof_expr
+| 24 = @method_invocation_expr
+| 25 = @delegate_invocation_expr
+| 26 = @operator_invocation_expr
+| 27 = @cast_expr
+| 28 = @object_creation_expr
+| 29 = @explicit_delegate_creation_expr
+| 30 = @implicit_delegate_creation_expr
+| 31 = @array_creation_expr
+| 32 = @default_expr
+| 33 = @plus_expr
+| 34 = @minus_expr
+| 35 = @bit_not_expr
+| 36 = @log_not_expr
+| 37 = @post_incr_expr
+| 38 = @post_decr_expr
+| 39 = @pre_incr_expr
+| 40 = @pre_decr_expr
+/* multiplicative */
+| 41 = @mul_expr
+| 42 = @div_expr
+| 43 = @rem_expr
+/* additive */
+| 44 = @add_expr
+| 45 = @sub_expr
+/* shift */
+| 46 = @lshift_expr
+| 47 = @rshift_expr
+/* relational */
+| 48 = @lt_expr
+| 49 = @gt_expr
+| 50 = @le_expr
+| 51 = @ge_expr
+/* equality */
+| 52 = @eq_expr
+| 53 = @ne_expr
+/* logical */
+| 54 = @bit_and_expr
+| 55 = @bit_xor_expr
+| 56 = @bit_or_expr
+| 57 = @log_and_expr
+| 58 = @log_or_expr
+/* type testing */
+| 59 = @is_expr
+| 60 = @as_expr
+/* null coalescing */
+| 61 = @null_coalescing_expr
+/* conditional */
+| 62 = @conditional_expr
+/* assignment */
+| 63 = @simple_assign_expr
+| 64 = @assign_add_expr
+| 65 = @assign_sub_expr
+| 66 = @assign_mul_expr
+| 67 = @assign_div_expr
+| 68 = @assign_rem_expr
+| 69 = @assign_and_expr
+| 70 = @assign_xor_expr
+| 71 = @assign_or_expr
+| 72 = @assign_lshift_expr
+| 73 = @assign_rshift_expr
+/* more */
+| 74 = @object_init_expr
+| 75 = @collection_init_expr
+| 76 = @array_init_expr
+| 77 = @checked_expr
+| 78 = @unchecked_expr
+| 79 = @constructor_init_expr
+| 80 = @add_event_expr
+| 81 = @remove_event_expr
+| 82 = @par_expr
+| 83 = @local_var_decl_expr
+| 84 = @lambda_expr
+| 85 = @anonymous_method_expr
+| 86 = @namespace_expr
+/* dynamic */
+| 92 = @dynamic_element_access_expr
+| 93 = @dynamic_member_access_expr
+/* unsafe */
+| 100 = @pointer_indirection_expr
+| 101 = @address_of_expr
+| 102 = @sizeof_expr
+/* async */
+| 103 = @await_expr
+/* C# 6.0 */
+| 104 = @nameof_expr
+| 105 = @interpolated_string_expr
+| 106 = @unknown_expr
+/* C# 7.0 */
+| 107 = @throw_expr
+| 108 = @tuple_expr
+| 109 = @local_function_invocation_expr
+| 110 = @ref_expr
+| 111 = @discard_expr
+/* C# 8.0 */
+| 112 = @range_expr
+| 113 = @index_expr
+| 114 = @switch_expr
+| 115 = @recursive_pattern_expr
+| 116 = @property_pattern_expr
+| 117 = @positional_pattern_expr
+| 118 = @switch_case_expr
+| 119 = @assign_coalesce_expr
+| 120 = @suppress_nullable_warning_expr
+| 121 = @namespace_access_expr
+/* C# 9.0 */
+| 122 = @lt_pattern_expr
+| 123 = @gt_pattern_expr
+| 124 = @le_pattern_expr
+| 125 = @ge_pattern_expr
+| 126 = @not_pattern_expr
+| 127 = @and_pattern_expr
+| 128 = @or_pattern_expr
+| 129 = @function_pointer_invocation_expr
+| 130 = @with_expr
+/* C# 11.0 */
+| 131 = @list_pattern_expr
+| 132 = @slice_pattern_expr
+| 133 = @urshift_expr
+| 134 = @assign_urshift_expr
+| 135 = @utf8_string_literal_expr
+/* C# 12.0 */
+| 136 = @collection_expr
+| 137 = @spread_element_expr
+| 138 = @interpolated_string_insert_expr
+/* Preprocessor */
+| 999 = @define_symbol_expr
+;
+
+@switch = @switch_stmt | @switch_expr;
+@case = @case_stmt | @switch_case_expr;
+@pattern_match = @case | @is_expr;
+@unary_pattern_expr = @not_pattern_expr;
+@relational_pattern_expr = @gt_pattern_expr | @lt_pattern_expr | @ge_pattern_expr | @le_pattern_expr;
+@binary_pattern_expr = @and_pattern_expr | @or_pattern_expr;
+
+@integer_literal_expr = @int_literal_expr | @long_literal_expr | @uint_literal_expr | @ulong_literal_expr;
+@real_literal_expr = @float_literal_expr | @double_literal_expr | @decimal_literal_expr;
+@string_literal_expr = @utf16_string_literal_expr | @utf8_string_literal_expr;
+@literal_expr = @bool_literal_expr | @char_literal_expr | @integer_literal_expr | @real_literal_expr
+ | @string_literal_expr | @null_literal_expr;
+
+@assign_expr = @simple_assign_expr | @assign_op_expr | @local_var_decl_expr;
+@assign_op_call_expr = @assign_arith_expr | @assign_bitwise_expr
+@assign_op_expr = @assign_op_call_expr | @assign_event_expr | @assign_coalesce_expr;
+@assign_event_expr = @add_event_expr | @remove_event_expr;
+
+@add_operation = @add_expr | @assign_add_expr;
+@sub_operation = @sub_expr | @assign_sub_expr;
+@mul_operation = @mul_expr | @assign_mul_expr;
+@div_operation = @div_expr | @assign_div_expr;
+@rem_operation = @rem_expr | @assign_rem_expr;
+@and_operation = @bit_and_expr | @assign_and_expr;
+@xor_operation = @bit_xor_expr | @assign_xor_expr;
+@or_operation = @bit_or_expr | @assign_or_expr;
+@lshift_operation = @lshift_expr | @assign_lshift_expr;
+@rshift_operation = @rshift_expr | @assign_rshift_expr;
+@urshift_operation = @urshift_expr | @assign_urshift_expr;
+@null_coalescing_operation = @null_coalescing_expr | @assign_coalesce_expr;
+
+@assign_arith_expr = @assign_add_expr | @assign_sub_expr | @assign_mul_expr | @assign_div_expr
+ | @assign_rem_expr
+@assign_bitwise_expr = @assign_and_expr | @assign_or_expr | @assign_xor_expr
+ | @assign_lshift_expr | @assign_rshift_expr | @assign_urshift_expr;
+
+@member_access_expr = @field_access_expr | @property_access_expr | @indexer_access_expr | @event_access_expr
+ | @method_access_expr | @type_access_expr | @dynamic_member_access_expr;
+@access_expr = @member_access_expr | @this_access_expr | @base_access_expr | @assignable_access_expr | @namespace_access_expr;
+@element_access_expr = @indexer_access_expr | @array_access_expr | @dynamic_element_access_expr;
+
+@local_variable_access = @local_variable_access_expr | @local_var_decl_expr;
+@local_scope_variable_access_expr = @parameter_access_expr | @local_variable_access;
+@variable_access_expr = @local_scope_variable_access_expr | @field_access_expr;
+
+@assignable_access_expr = @variable_access_expr | @property_access_expr | @element_access_expr
+ | @event_access_expr | @dynamic_member_access_expr;
+
+@objectorcollection_init_expr = @object_init_expr | @collection_init_expr;
+
+@delegate_creation_expr = @explicit_delegate_creation_expr | @implicit_delegate_creation_expr;
+
+@bin_arith_op_expr = @mul_expr | @div_expr | @rem_expr | @add_expr | @sub_expr;
+@incr_op_expr = @pre_incr_expr | @post_incr_expr;
+@decr_op_expr = @pre_decr_expr | @post_decr_expr;
+@mut_op_expr = @incr_op_expr | @decr_op_expr;
+@un_arith_op_expr = @plus_expr | @minus_expr | @mut_op_expr;
+@arith_op_expr = @bin_arith_op_expr | @un_arith_op_expr;
+
+@ternary_log_op_expr = @conditional_expr;
+@bin_log_op_expr = @log_and_expr | @log_or_expr | @null_coalescing_expr;
+@un_log_op_expr = @log_not_expr;
+@log_expr = @un_log_op_expr | @bin_log_op_expr | @ternary_log_op_expr;
+
+@bin_bit_op_expr = @bit_and_expr | @bit_or_expr | @bit_xor_expr | @lshift_expr
+ | @rshift_expr | @urshift_expr;
+@un_bit_op_expr = @bit_not_expr;
+@bit_expr = @un_bit_op_expr | @bin_bit_op_expr;
+
+@equality_op_expr = @eq_expr | @ne_expr;
+@rel_op_expr = @gt_expr | @lt_expr| @ge_expr | @le_expr;
+@comp_expr = @equality_op_expr | @rel_op_expr;
+
+@op_expr = @un_op | @bin_op | @ternary_op;
+
+@ternary_op = @ternary_log_op_expr;
+@bin_op = @assign_expr | @bin_arith_op_expr | @bin_log_op_expr | @bin_bit_op_expr | @comp_expr;
+@un_op = @un_arith_op_expr | @un_log_op_expr | @un_bit_op_expr | @sizeof_expr
+ | @pointer_indirection_expr | @address_of_expr;
+
+@anonymous_function_expr = @lambda_expr | @anonymous_method_expr;
+
+@op_invoke_expr = @operator_invocation_expr | @assign_op_call_expr
+@call = @method_invocation_expr | @constructor_init_expr | @op_invoke_expr
+ | @delegate_invocation_expr | @object_creation_expr | @call_access_expr
+ | @local_function_invocation_expr | @function_pointer_invocation_expr;
+
+@call_access_expr = @property_access_expr | @event_access_expr | @indexer_access_expr;
+
+@late_bindable_expr = @dynamic_element_access_expr | @dynamic_member_access_expr
+ | @object_creation_expr | @method_invocation_expr | @op_invoke_expr;
+
+@throw_element = @throw_expr | @throw_stmt;
+
+@implicitly_typeable_object_creation_expr = @object_creation_expr | @explicit_delegate_creation_expr;
+
+implicitly_typed_array_creation(
+ unique int id: @array_creation_expr ref);
+
+explicitly_sized_array_creation(
+ unique int id: @array_creation_expr ref);
+
+stackalloc_array_creation(
+ unique int id: @array_creation_expr ref);
+
+implicitly_typed_object_creation(
+ unique int id: @implicitly_typeable_object_creation_expr ref);
+
+mutator_invocation_mode(
+ unique int id: @operator_invocation_expr ref,
+ int mode: int ref /* prefix = 1, postfix = 2*/);
+
+expr_value(
+ unique int id: @expr ref,
+ string value: string ref);
+
+expr_call(
+ unique int caller_id: @expr ref,
+ int target_id: @callable ref);
+
+expr_access(
+ unique int accesser_id: @access_expr ref,
+ int target_id: @accessible ref);
+
+@accessible = @method | @assignable | @local_function | @namespace;
+
+expr_location(
+ unique int id: @expr ref,
+ int loc: @location ref);
+
+dynamic_member_name(
+ unique int id: @late_bindable_expr ref,
+ string name: string ref);
+
+@qualifiable_expr = @member_access_expr
+ | @method_invocation_expr
+ | @element_access_expr;
+
+conditional_access(
+ unique int id: @qualifiable_expr ref);
+
+expr_argument(
+ unique int id: @expr ref,
+ int mode: int ref);
+ /* mode is the same as params: value = 0, ref = 1, out = 2 */
+
+expr_argument_name(
+ unique int id: @expr ref,
+ string name: string ref);
+
+lambda_expr_return_type(
+ unique int id: @lambda_expr ref,
+ int type_id: @type_or_ref ref);
+
+/* Compiler generated */
+
+compiler_generated(unique int id: @element ref);
+
+/** CONTROL/DATA FLOW **/
+
+@control_flow_element = @stmt | @expr;
+
+/* XML Files */
+
+xmlEncoding (
+ unique int id: @file ref,
+ string encoding: string ref);
+
+xmlDTDs(
+ unique int id: @xmldtd,
+ string root: string ref,
+ string publicId: string ref,
+ string systemId: string ref,
+ int fileid: @file ref);
+
+xmlElements(
+ unique int id: @xmlelement,
+ string name: string ref,
+ int parentid: @xmlparent ref,
+ int idx: int ref,
+ int fileid: @file ref);
+
+xmlAttrs(
+ unique int id: @xmlattribute,
+ int elementid: @xmlelement ref,
+ string name: string ref,
+ string value: string ref,
+ int idx: int ref,
+ int fileid: @file ref);
+
+xmlNs(
+ int id: @xmlnamespace,
+ string prefixName: string ref,
+ string URI: string ref,
+ int fileid: @file ref);
+
+xmlHasNs(
+ int elementId: @xmlnamespaceable ref,
+ int nsId: @xmlnamespace ref,
+ int fileid: @file ref);
+
+xmlComments(
+ unique int id: @xmlcomment,
+ string text: string ref,
+ int parentid: @xmlparent ref,
+ int fileid: @file ref);
+
+xmlChars(
+ unique int id: @xmlcharacters,
+ string text: string ref,
+ int parentid: @xmlparent ref,
+ int idx: int ref,
+ int isCDATA: int ref,
+ int fileid: @file ref);
+
+@xmlparent = @file | @xmlelement;
+@xmlnamespaceable = @xmlelement | @xmlattribute;
+
+xmllocations(
+ int xmlElement: @xmllocatable ref,
+ int location: @location_default ref);
+
+@xmllocatable = @xmlcharacters | @xmlelement | @xmlcomment | @xmlattribute | @xmldtd | @file | @xmlnamespace;
+
+/* Comments */
+
+commentline(
+ unique int id: @commentline,
+ int kind: int ref,
+ string text: string ref,
+ string rawtext: string ref);
+
+case @commentline.kind of
+ 0 = @singlelinecomment
+| 1 = @xmldoccomment
+| 2 = @multilinecomment;
+
+commentline_location(
+ unique int id: @commentline ref,
+ int loc: @location ref);
+
+commentblock(
+ unique int id : @commentblock);
+
+commentblock_location(
+ unique int id: @commentblock ref,
+ int loc: @location ref);
+
+commentblock_binding(
+ int id: @commentblock ref,
+ int entity: @element ref,
+ int bindtype: int ref); /* 0: Parent, 1: Best, 2: Before, 3: After */
+
+commentblock_child(
+ int id: @commentblock ref,
+ int commentline: @commentline ref,
+ int index: int ref);
+
+/* ASP.NET */
+
+case @asp_element.kind of
+ 0=@asp_close_tag
+| 1=@asp_code
+| 2=@asp_comment
+| 3=@asp_data_binding
+| 4=@asp_directive
+| 5=@asp_open_tag
+| 6=@asp_quoted_string
+| 7=@asp_text
+| 8=@asp_xml_directive;
+
+@asp_attribute = @asp_code | @asp_data_binding | @asp_quoted_string;
+
+asp_elements(
+ unique int id: @asp_element,
+ int kind: int ref,
+ int loc: @location ref);
+
+asp_comment_server(unique int comment: @asp_comment ref);
+asp_code_inline(unique int code: @asp_code ref);
+asp_directive_attribute(
+ int directive: @asp_directive ref,
+ int index: int ref,
+ string name: string ref,
+ int value: @asp_quoted_string ref);
+asp_directive_name(
+ unique int directive: @asp_directive ref,
+ string name: string ref);
+asp_element_body(
+ unique int element: @asp_element ref,
+ string body: string ref);
+asp_tag_attribute(
+ int tag: @asp_open_tag ref,
+ int index: int ref,
+ string name: string ref,
+ int attribute: @asp_attribute ref);
+asp_tag_name(
+ unique int tag: @asp_open_tag ref,
+ string name: string ref);
+asp_tag_isempty(int tag: @asp_open_tag ref);
diff --git a/csharp/downgrades/ea7ad33252e550241975676f09fcc7b0a703deab/upgrade.properties b/csharp/downgrades/ea7ad33252e550241975676f09fcc7b0a703deab/upgrade.properties
new file mode 100644
index 000000000000..160cdb12de4c
--- /dev/null
+++ b/csharp/downgrades/ea7ad33252e550241975676f09fcc7b0a703deab/upgrade.properties
@@ -0,0 +1,2 @@
+description: Remove @assign_op_call_expr from @qualifiable_expr.
+compatibility: full
diff --git a/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/DotNet.cs b/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/DotNet.cs
index 9d3d79e4c4ff..699e06d273c8 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/DotNet.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/DotNet.cs
@@ -95,9 +95,9 @@ private string GetRestoreArgs(RestoreSettings restoreSettings)
args += " /p:EnableWindowsTargeting=true";
}
- if (restoreSettings.ExtraArgs is not null)
+ if (restoreSettings.NugetSources is not null)
{
- args += $" {restoreSettings.ExtraArgs}";
+ args += $" {restoreSettings.NugetSources}";
}
return args;
diff --git a/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/IDotNet.cs b/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/IDotNet.cs
index eec6a2b8d3b2..d14dee506524 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/IDotNet.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/IDotNet.cs
@@ -17,7 +17,7 @@ public interface IDotNet
IList GetNugetFeedsFromFolder(string folderPath);
}
- public record class RestoreSettings(string File, string PackageDirectory, bool ForceDotnetRefAssemblyFetching, string? ExtraArgs = null, string? PathToNugetConfig = null, bool ForceReevaluation = false, bool TargetWindows = false);
+ public record class RestoreSettings(string File, string PackageDirectory, bool ForceDotnetRefAssemblyFetching, string? NugetSources = null, string? PathToNugetConfig = null, bool ForceReevaluation = false, bool TargetWindows = false);
public partial record class RestoreResult(bool Success, IList Output)
{
@@ -33,6 +33,9 @@ public partial record class RestoreResult(bool Success, IList Output)
private readonly Lazy hasNugetNoStablePackageVersionError = new(() => Output.Any(s => s.Contains("NU1103")));
public bool HasNugetNoStablePackageVersionError => hasNugetNoStablePackageVersionError.Value;
+ private readonly Lazy hasNugetPackageMissingError = new(() => Output.Any(s => s.Contains("NU1101")));
+ public bool HasNugetPackageMissingError => hasNugetPackageMissingError.Value;
+
private static IEnumerable GetFirstGroupOnMatch(Regex regex, IEnumerable lines) =>
lines
.Select(line => regex.Match(line))
diff --git a/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/NugetExeWrapper.cs b/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/NugetExeWrapper.cs
index b90b388e865c..e97b0b118c68 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/NugetExeWrapper.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/NugetExeWrapper.cs
@@ -33,7 +33,7 @@ internal class NugetExeWrapper : IDisposable
///
/// Create the package manager for a specified source tree.
///
- public NugetExeWrapper(FileProvider fileProvider, DependencyDirectory packageDirectory, Semmle.Util.Logging.ILogger logger)
+ public NugetExeWrapper(FileProvider fileProvider, DependencyDirectory packageDirectory, Semmle.Util.Logging.ILogger logger, Func useDefaultFeed)
{
this.fileProvider = fileProvider;
this.packageDirectory = packageDirectory;
@@ -43,7 +43,7 @@ public NugetExeWrapper(FileProvider fileProvider, DependencyDirectory packageDir
{
logger.LogInfo($"Found packages.config files, trying to use nuget.exe for package restore");
nugetExe = ResolveNugetExe();
- if (HasNoPackageSource())
+ if (HasNoPackageSource() && useDefaultFeed())
{
// We only modify or add a top level nuget.config file
nugetConfigPath = Path.Combine(fileProvider.SourceDir.FullName, "nuget.config");
diff --git a/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/NugetPackageRestorer.cs b/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/NugetPackageRestorer.cs
index 1d01412ee051..e042285af11c 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/NugetPackageRestorer.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/NugetPackageRestorer.cs
@@ -1,6 +1,7 @@
using System;
using System.Collections.Concurrent;
using System.Collections.Generic;
+using System.Collections.Immutable;
using System.IO;
using System.Linq;
using System.Net;
@@ -27,8 +28,12 @@ internal sealed partial class NugetPackageRestorer : IDisposable
private readonly IDiagnosticsWriter diagnosticsWriter;
private readonly DependencyDirectory legacyPackageDirectory;
private readonly DependencyDirectory missingPackageDirectory;
+ private readonly DependencyDirectory emptyPackageDirectory;
private readonly ILogger logger;
private readonly ICompilationInfoContainer compilationInfoContainer;
+ private readonly bool checkNugetFeedResponsiveness = EnvironmentVariables.GetBooleanOptOut(EnvironmentVariableNames.CheckNugetFeedResponsiveness);
+ private readonly ImmutableHashSet privateRegistryFeeds;
+ private readonly bool hasPrivateRegistryFeeds;
public DependencyDirectory PackageDirectory { get; }
@@ -45,6 +50,8 @@ public NugetPackageRestorer(
this.fileContent = fileContent;
this.dotnet = dotnet;
this.dependabotProxy = dependabotProxy;
+ this.privateRegistryFeeds = dependabotProxy?.RegistryURLs.ToImmutableHashSet() ?? [];
+ this.hasPrivateRegistryFeeds = privateRegistryFeeds.Count > 0;
this.diagnosticsWriter = diagnosticsWriter;
this.logger = logger;
this.compilationInfoContainer = compilationInfoContainer;
@@ -52,6 +59,7 @@ public NugetPackageRestorer(
PackageDirectory = new DependencyDirectory("packages", "package", logger);
legacyPackageDirectory = new DependencyDirectory("legacypackages", "legacy package", logger);
missingPackageDirectory = new DependencyDirectory("missingpackages", "missing package", logger);
+ emptyPackageDirectory = new DependencyDirectory("empty", "empty package", logger);
}
public string? TryRestore(string package)
@@ -110,25 +118,50 @@ public DirectoryInfo[] GetOrderedPackageVersionSubDirectories(string packagePath
public HashSet Restore()
{
var assemblyLookupLocations = new HashSet();
- var checkNugetFeedResponsiveness = EnvironmentVariables.GetBooleanOptOut(EnvironmentVariableNames.CheckNugetFeedResponsiveness);
logger.LogInfo($"Checking NuGet feed responsiveness: {checkNugetFeedResponsiveness}");
compilationInfoContainer.CompilationInfos.Add(("NuGet feed responsiveness checked", checkNugetFeedResponsiveness ? "1" : "0"));
- HashSet? explicitFeeds = null;
- HashSet? allFeeds = null;
+ HashSet explicitFeeds = [];
+ HashSet reachableFeeds = [];
try
{
- if (checkNugetFeedResponsiveness && !CheckFeeds(out explicitFeeds, out allFeeds))
+ // Find feeds that are configured in NuGet.config files and divide them into ones that
+ // are explicitly configured for the project or by a private registry, and "all feeds"
+ // (including inherited ones) from other locations on the host outside of the working directory.
+ (explicitFeeds, var allFeeds) = GetAllFeeds();
+
+ if (checkNugetFeedResponsiveness)
{
- // todo: we could also check the reachability of the inherited nuget feeds, but to use those in the fallback we would need to handle authentication too.
- var unresponsiveMissingPackageLocation = DownloadMissingPackagesFromSpecificFeeds([], explicitFeeds);
- return unresponsiveMissingPackageLocation is null
- ? []
- : [unresponsiveMissingPackageLocation];
+ var inheritedFeeds = allFeeds.Except(explicitFeeds).ToHashSet();
+
+ if (inheritedFeeds.Count > 0)
+ {
+ compilationInfoContainer.CompilationInfos.Add(("Inherited NuGet feed count", inheritedFeeds.Count.ToString()));
+ }
+
+ var timeout = CheckSpecifiedFeeds(explicitFeeds, out var reachableExplicitFeeds);
+ reachableFeeds.UnionWith(reachableExplicitFeeds);
+
+ var allExplicitReachable = explicitFeeds.Count == reachableExplicitFeeds.Count;
+ EmitUnreachableFeedsDiagnostics(allExplicitReachable);
+
+ if (timeout)
+ {
+ // If we experience a timeout, we use this fallback.
+ // todo: we could also check the reachability of the inherited nuget feeds, but to use those in the fallback we would need to handle authentication too.
+ var unresponsiveMissingPackageLocation = DownloadMissingPackagesFromSpecificFeeds([], explicitFeeds);
+ return unresponsiveMissingPackageLocation is null
+ ? []
+ : [unresponsiveMissingPackageLocation];
+ }
+
+ // Inherited feeds should only be used, if they are indeed reachable (as they may be environment specific).
+ CheckSpecifiedFeeds(inheritedFeeds, out var reachableInheritedFeeds);
+ reachableFeeds.UnionWith(reachableInheritedFeeds);
}
- using (var nuget = new NugetExeWrapper(fileProvider, legacyPackageDirectory, logger))
+ using (var nuget = new NugetExeWrapper(fileProvider, legacyPackageDirectory, logger, IsDefaultFeedReachable))
{
var count = nuget.InstallPackages();
@@ -167,9 +200,10 @@ public HashSet Restore()
logger.LogError($"Failed to restore NuGet packages with nuget.exe: {exc.Message}");
}
- var restoredProjects = RestoreSolutions(out var container);
+ // Restore project dependencies with `dotnet restore`.
+ var restoredProjects = RestoreSolutions(reachableFeeds, out var container);
var projects = fileProvider.Projects.Except(restoredProjects);
- RestoreProjects(projects, allFeeds, out var containers);
+ RestoreProjects(projects, reachableFeeds, out var containers);
var dependencies = containers.Flatten(container);
@@ -192,6 +226,53 @@ public HashSet Restore()
return assemblyLookupLocations;
}
+ ///
+ /// Tests which of the feeds given by are reachable.
+ ///
+ /// The feeds to check.
+ /// Whether the feeds are fallback feeds or not.
+ /// Whether a timeout occurred while checking the feeds.
+ /// The list of feeds that could be reached.
+ private List GetReachableNuGetFeeds(HashSet feedsToCheck, bool isFallback, out bool isTimeout)
+ {
+ var fallbackStr = isFallback ? "fallback " : "";
+ logger.LogInfo($"Checking {fallbackStr}NuGet feed reachability on feeds: {string.Join(", ", feedsToCheck.OrderBy(f => f))}");
+
+ var (initialTimeout, tryCount) = GetFeedRequestSettings(isFallback);
+ var timeout = false;
+ var reachableFeeds = feedsToCheck
+ .Where(feed =>
+ {
+ var reachable = IsFeedReachable(feed, initialTimeout, tryCount, out var feedTimeout);
+ timeout |= feedTimeout;
+ return reachable;
+ })
+ .ToList();
+
+ if (reachableFeeds.Count == 0)
+ {
+ logger.LogWarning($"No {fallbackStr}NuGet feeds are reachable.");
+ }
+ else
+ {
+ logger.LogInfo($"Reachable {fallbackStr}NuGet feeds: {string.Join(", ", reachableFeeds.OrderBy(f => f))}");
+ }
+
+ isTimeout = timeout;
+ return reachableFeeds;
+ }
+
+ private bool IsDefaultFeedReachable()
+ {
+ if (checkNugetFeedResponsiveness)
+ {
+ var (initialTimeout, tryCount) = GetFeedRequestSettings(isFallback: false);
+ return IsFeedReachable(PublicNugetOrgFeed, initialTimeout, tryCount, out var _);
+ }
+
+ return true;
+ }
+
private List GetReachableFallbackNugetFeeds(HashSet? feedsFromNugetConfigs)
{
var fallbackFeeds = EnvironmentVariables.GetURLs(EnvironmentVariableNames.FallbackNugetFeeds).ToHashSet();
@@ -212,17 +293,7 @@ private List GetReachableFallbackNugetFeeds(HashSet? feedsFromNu
}
}
- logger.LogInfo($"Checking fallback NuGet feed reachability on feeds: {string.Join(", ", fallbackFeeds.OrderBy(f => f))}");
- var (initialTimeout, tryCount) = GetFeedRequestSettings(isFallback: true);
- var reachableFallbackFeeds = fallbackFeeds.Where(feed => IsFeedReachable(feed, initialTimeout, tryCount, allowExceptions: false)).ToList();
- if (reachableFallbackFeeds.Count == 0)
- {
- logger.LogWarning("No fallback NuGet feeds are reachable.");
- }
- else
- {
- logger.LogInfo($"Reachable fallback NuGet feeds: {string.Join(", ", reachableFallbackFeeds.OrderBy(f => f))}");
- }
+ var reachableFallbackFeeds = GetReachableNuGetFeeds(fallbackFeeds, isFallback: true, out var _);
compilationInfoContainer.CompilationInfos.Add(("Reachable fallback NuGet feed count", reachableFallbackFeeds.Count.ToString()));
@@ -237,10 +308,12 @@ private List GetReachableFallbackNugetFeeds(HashSet? feedsFromNu
/// Populates dependencies with the relevant dependencies from the assets files generated by the restore.
/// Returns a list of projects that are up to date with respect to restore.
///
- private IEnumerable RestoreSolutions(out DependencyContainer dependencies)
+ private IEnumerable RestoreSolutions(HashSet reachableFeeds, out DependencyContainer dependencies)
{
var successCount = 0;
var nugetSourceFailures = 0;
+ var nugetMissingPackageFailures = 0;
+
var assets = new Assets(logger);
var isWindows = fileContent.UseWindowsForms || fileContent.UseWpf;
@@ -248,7 +321,8 @@ private IEnumerable RestoreSolutions(out DependencyContainer dependencie
var projects = fileProvider.Solutions.SelectMany(solution =>
{
logger.LogInfo($"Restoring solution {solution}...");
- var res = dotnet.Restore(new(solution, PackageDirectory.DirInfo.FullName, ForceDotnetRefAssemblyFetching: true, TargetWindows: isWindows));
+ var nugetSources = MakeRestoreSourcesArgument(solution, reachableFeeds);
+ var res = dotnet.Restore(new(solution, PackageDirectory.DirInfo.FullName, ForceDotnetRefAssemblyFetching: true, NugetSources: nugetSources, TargetWindows: isWindows));
if (res.Success)
{
successCount++;
@@ -257,51 +331,84 @@ private IEnumerable RestoreSolutions(out DependencyContainer dependencie
{
nugetSourceFailures++;
}
+ if (res.HasNugetPackageMissingError)
+ {
+ nugetMissingPackageFailures++;
+ }
assets.AddDependenciesRange(res.AssetsFilePaths);
return res.RestoredProjects;
}).ToList();
dependencies = assets.Dependencies;
compilationInfoContainer.CompilationInfos.Add(("Successfully restored solution files", successCount.ToString()));
compilationInfoContainer.CompilationInfos.Add(("Failed solution restore with package source error", nugetSourceFailures.ToString()));
+ compilationInfoContainer.CompilationInfos.Add(("Failed solution restore with missing package error", nugetMissingPackageFailures.ToString()));
compilationInfoContainer.CompilationInfos.Add(("Restored projects through solution files", projects.Count.ToString()));
return projects;
}
+ private string FeedsToRestoreArgument(IEnumerable feeds)
+ {
+ // If there are no feeds, we want to override any default feeds that `dotnet restore` would use by passing a dummy source argument.
+ if (!feeds.Any())
+ {
+ return $" -s \"{emptyPackageDirectory.DirInfo.FullName}\"";
+ }
+
+ // Add package sources. If any are present, they override all sources specified in
+ // the configuration file(s).
+ var feedArgs = new StringBuilder();
+ foreach (var feed in feeds)
+ {
+ feedArgs.Append($" -s \"{feed}\"");
+ }
+
+ return feedArgs.ToString();
+ }
+
+ ///
+ /// Constructs the list of NuGet sources to use for this restore.
+ /// (1) Use the feeds we get from `dotnet nuget list source`
+ /// (2) Use private registries, if they are configured
+ ///
+ /// Path to project/solution
+ /// The set of reachable NuGet feeds.
+ /// A string representing the NuGet sources argument for the restore command.
+ private string? MakeRestoreSourcesArgument(string path, HashSet reachableFeeds)
+ {
+ // Do not construct an set of explicit NuGet sources to use for restore.
+ if (!checkNugetFeedResponsiveness && !hasPrivateRegistryFeeds)
+ {
+ return null;
+ }
+
+ // Find the path specific feeds.
+ var folder = GetDirectoryName(path);
+ var feedsToConsider = folder is not null ? GetFeeds(() => dotnet.GetNugetFeedsFromFolder(folder)).ToHashSet() : [];
+
+ if (hasPrivateRegistryFeeds)
+ {
+ feedsToConsider.UnionWith(privateRegistryFeeds);
+ }
+
+ var feedsToUse = checkNugetFeedResponsiveness
+ ? feedsToConsider.Where(reachableFeeds.Contains)
+ : feedsToConsider;
+
+ return FeedsToRestoreArgument(feedsToUse);
+ }
+
///
/// Executes `dotnet restore` on all projects in projects.
/// This is done in parallel for performance reasons.
/// Populates dependencies with the relative paths to the assets files generated by the restore.
///
/// A list of paths to project files.
- private void RestoreProjects(IEnumerable projects, HashSet? configuredSources, out ConcurrentBag dependencies)
- {
- // Conservatively, we only set this to a non-null value if a Dependabot proxy is enabled.
- // This ensures that we continue to get the old behaviour where feeds are taken from
- // `nuget.config` files instead of the command-line arguments.
- string? extraArgs = null;
-
- if (this.dependabotProxy is not null)
- {
- // If the Dependabot proxy is configured, then our main goal is to make `dotnet` aware
- // of the private registry feeds. However, since providing them as command-line arguments
- // to `dotnet` ignores other feeds that may be configured, we also need to add the feeds
- // we have discovered from analysing `nuget.config` files.
- var sources = configuredSources ?? new();
- this.dependabotProxy.RegistryURLs.ForEach(url => sources.Add(url));
-
- // Add package sources. If any are present, they override all sources specified in
- // the configuration file(s).
- var feedArgs = new StringBuilder();
- foreach (string source in sources)
- {
- feedArgs.Append($" -s {source}");
- }
-
- extraArgs = feedArgs.ToString();
- }
-
+ /// The set of reachable NuGet feeds.
+ private void RestoreProjects(IEnumerable projects, HashSet reachableFeeds, out ConcurrentBag dependencies)
+ {
var successCount = 0;
var nugetSourceFailures = 0;
+ var nugetMissingPackageFailures = 0;
ConcurrentBag collectedDependencies = [];
var isWindows = fileContent.UseWindowsForms || fileContent.UseWpf;
@@ -314,7 +421,8 @@ private void RestoreProjects(IEnumerable projects, HashSet? conf
foreach (var project in projectGroup)
{
logger.LogInfo($"Restoring project {project}...");
- var res = dotnet.Restore(new(project, PackageDirectory.DirInfo.FullName, ForceDotnetRefAssemblyFetching: true, extraArgs, TargetWindows: isWindows));
+ var nugetSources = MakeRestoreSourcesArgument(project, reachableFeeds);
+ var res = dotnet.Restore(new(project, PackageDirectory.DirInfo.FullName, ForceDotnetRefAssemblyFetching: true, NugetSources: nugetSources, TargetWindows: isWindows));
assets.AddDependenciesRange(res.AssetsFilePaths);
lock (sync)
{
@@ -326,6 +434,10 @@ private void RestoreProjects(IEnumerable projects, HashSet? conf
{
nugetSourceFailures++;
}
+ if (res.HasNugetPackageMissingError)
+ {
+ nugetMissingPackageFailures++;
+ }
}
}
collectedDependencies.Add(assets.Dependencies);
@@ -333,6 +445,7 @@ private void RestoreProjects(IEnumerable projects, HashSet? conf
dependencies = collectedDependencies;
compilationInfoContainer.CompilationInfos.Add(("Successfully restored project files", successCount.ToString()));
compilationInfoContainer.CompilationInfos.Add(("Failed project restore with package source error", nugetSourceFailures.ToString()));
+ compilationInfoContainer.CompilationInfos.Add(("Failed project restore with missing package error", nugetMissingPackageFailures.ToString()));
}
private AssemblyLookupLocation? DownloadMissingPackagesFromSpecificFeeds(IEnumerable usedPackageNames, HashSet? feedsFromNugetConfigs)
@@ -623,28 +736,22 @@ private void TryChangeProjectFile(DirectoryInfo projectDir, Regex pattern, strin
}
}
- private static async Task ExecuteGetRequest(string address, HttpClient httpClient, CancellationToken cancellationToken)
+ private static async Task ExecuteGetRequest(string address, HttpClient httpClient, CancellationToken cancellationToken)
{
- using var stream = await httpClient.GetStreamAsync(address, cancellationToken);
- var buffer = new byte[1024];
- int bytesRead;
- while ((bytesRead = stream.Read(buffer, 0, buffer.Length)) > 0)
- {
- // do nothing
- }
+ return await httpClient.GetAsync(address, HttpCompletionOption.ResponseHeadersRead, cancellationToken);
}
- private bool IsFeedReachable(string feed, int timeoutMilliSeconds, int tryCount, bool allowExceptions = true)
+ private bool IsFeedReachable(string feed, int timeoutMilliSeconds, int tryCount, out bool isTimeout)
{
logger.LogInfo($"Checking if NuGet feed '{feed}' is reachable...");
// Configure the HttpClient to be aware of the Dependabot Proxy, if used.
HttpClientHandler httpClientHandler = new();
- if (this.dependabotProxy != null)
+ if (dependabotProxy != null)
{
- httpClientHandler.Proxy = new WebProxy(this.dependabotProxy.Address);
+ httpClientHandler.Proxy = new WebProxy(dependabotProxy.Address);
- if (this.dependabotProxy.Certificate != null)
+ if (dependabotProxy.Certificate != null)
{
httpClientHandler.ServerCertificateCustomValidationCallback = (message, cert, chain, _) =>
{
@@ -659,7 +766,7 @@ private bool IsFeedReachable(string feed, int timeoutMilliSeconds, int tryCount,
return false;
}
chain.ChainPolicy.TrustMode = X509ChainTrustMode.CustomRootTrust;
- chain.ChainPolicy.CustomTrustStore.Add(this.dependabotProxy.Certificate);
+ chain.ChainPolicy.CustomTrustStore.Add(dependabotProxy.Certificate);
return chain.Build(cert);
};
}
@@ -667,13 +774,17 @@ private bool IsFeedReachable(string feed, int timeoutMilliSeconds, int tryCount,
using HttpClient client = new(httpClientHandler);
+ isTimeout = false;
+
for (var i = 0; i < tryCount; i++)
{
using var cts = new CancellationTokenSource();
cts.CancelAfter(timeoutMilliSeconds);
try
{
- ExecuteGetRequest(feed, client, cts.Token).GetAwaiter().GetResult();
+ logger.LogInfo($"Attempt {i + 1}/{tryCount} to reach NuGet feed '{feed}'.");
+ using var response = ExecuteGetRequest(feed, client, cts.Token).GetAwaiter().GetResult();
+ response.EnsureSuccessStatusCode();
logger.LogInfo($"Querying NuGet feed '{feed}' succeeded.");
return true;
}
@@ -688,14 +799,13 @@ private bool IsFeedReachable(string feed, int timeoutMilliSeconds, int tryCount,
continue;
}
- // We're only interested in timeouts.
- var start = allowExceptions ? "Considering" : "Not considering";
- logger.LogInfo($"Querying NuGet feed '{feed}' failed in a timely manner. {start} the feed for use. The reason for the failure: {exc.Message}");
- return allowExceptions;
+ logger.LogInfo($"Querying NuGet feed '{feed}' failed. The reason for the failure: {exc.Message}");
+ return false;
}
}
logger.LogWarning($"Didn't receive answer from NuGet feed '{feed}'. Tried it {tryCount} times.");
+ isTimeout = true;
return false;
}
@@ -719,53 +829,61 @@ private bool IsFeedReachable(string feed, int timeoutMilliSeconds, int tryCount,
}
///
- /// Checks that we can connect to all NuGet feeds that are explicitly configured in configuration files
- /// as well as any private package registry feeds that are configured.
+ /// Retrieves a list of excluded NuGet feeds from the corresponding environment variable.
///
- /// Outputs the set of explicit feeds.
- /// Outputs the set of all feeds (explicit and inherited).
- /// True if all feeds are reachable or false otherwise.
- private bool CheckFeeds(out HashSet explicitFeeds, out HashSet allFeeds)
+ private HashSet GetExcludedFeeds()
{
- (explicitFeeds, allFeeds) = GetAllFeeds();
- HashSet feedsToCheck = explicitFeeds;
-
- // If private package registries are configured for C#, then check those
- // in addition to the ones that are configured in `nuget.config` files.
- this.dependabotProxy?.RegistryURLs.ForEach(url => feedsToCheck.Add(url));
-
- var allFeedsReachable = this.CheckSpecifiedFeeds(feedsToCheck);
+ var excludedFeeds = EnvironmentVariables.GetURLs(EnvironmentVariableNames.ExcludedNugetFeedsFromResponsivenessCheck)
+ .ToHashSet();
- var inheritedFeeds = allFeeds.Except(explicitFeeds).ToHashSet();
- if (inheritedFeeds.Count > 0)
+ if (excludedFeeds.Count > 0)
{
- logger.LogInfo($"Inherited NuGet feeds (not checked for reachability): {string.Join(", ", inheritedFeeds.OrderBy(f => f))}");
- compilationInfoContainer.CompilationInfos.Add(("Inherited NuGet feed count", inheritedFeeds.Count.ToString()));
+ logger.LogInfo($"Excluded NuGet feeds from responsiveness check: {string.Join(", ", excludedFeeds.OrderBy(f => f))}");
}
- return allFeedsReachable;
+ return excludedFeeds;
}
///
/// Checks that we can connect to the specified NuGet feeds.
///
/// The set of package feeds to check.
- /// True if all feeds are reachable or false otherwise.
- private bool CheckSpecifiedFeeds(HashSet feeds)
+ /// The list of feeds that were reachable.
+ ///
+ /// True if there is a timeout when trying to reach the feeds (excluding any feeds that are configured
+ /// to be excluded from the check) or false otherwise.
+ ///
+ private bool CheckSpecifiedFeeds(HashSet feeds, out HashSet reachableFeeds)
{
- logger.LogInfo("Checking that NuGet feeds are reachable...");
-
- var excludedFeeds = EnvironmentVariables.GetURLs(EnvironmentVariableNames.ExcludedNugetFeedsFromResponsivenessCheck)
- .ToHashSet();
+ // Exclude any feeds from the feed check that are configured by the corresponding environment variable.
+ // These feeds are always assumed to be reachable.
+ var excludedFeeds = GetExcludedFeeds();
- if (excludedFeeds.Count > 0)
+ HashSet feedsToCheck = feeds.Where(feed =>
{
- logger.LogInfo($"Excluded NuGet feeds from responsiveness check: {string.Join(", ", excludedFeeds.OrderBy(f => f))}");
- }
+ if (excludedFeeds.Contains(feed))
+ {
+ logger.LogInfo($"Not checking reachability of NuGet feed '{feed}' as it is in the list of excluded feeds.");
+ return false;
+ }
+ return true;
+ }).ToHashSet();
+
+ reachableFeeds = GetReachableNuGetFeeds(feedsToCheck, isFallback: false, out var isTimeout).ToHashSet();
- var (initialTimeout, tryCount) = GetFeedRequestSettings(isFallback: false);
+ // Always consider feeds excluded for the reachability check as reachable.
+ reachableFeeds.UnionWith(feeds.Where(feed => excludedFeeds.Contains(feed)));
- var allFeedsReachable = feeds.All(feed => excludedFeeds.Contains(feed) || IsFeedReachable(feed, initialTimeout, tryCount));
+ return isTimeout;
+ }
+
+ ///
+ /// If is `false`, logs this and emits a diagnostic.
+ /// Adds a `CompilationInfos` entry either way.
+ ///
+ /// Whether all feeds were reachable or not.
+ private void EmitUnreachableFeedsDiagnostics(bool allFeedsReachable)
+ {
if (!allFeedsReachable)
{
logger.LogWarning("Found unreachable NuGet feed in C# analysis with build-mode 'none'. This may cause missing dependencies in the analysis.");
@@ -779,8 +897,6 @@ private bool CheckSpecifiedFeeds(HashSet feeds)
));
}
compilationInfoContainer.CompilationInfos.Add(("All NuGet feeds reachable", allFeedsReachable ? "1" : "0"));
-
- return allFeedsReachable;
}
private IEnumerable GetFeeds(Func> getNugetFeeds)
@@ -811,6 +927,19 @@ private IEnumerable GetFeeds(Func> getNugetFeeds)
}
}
+ private string? GetDirectoryName(string path)
+ {
+ try
+ {
+ return new FileInfo(path).Directory?.FullName;
+ }
+ catch (Exception exc)
+ {
+ logger.LogWarning($"Failed to get directory of '{path}': {exc}");
+ }
+ return null;
+ }
+
private (HashSet explicitFeeds, HashSet allFeeds) GetAllFeeds()
{
var nugetConfigs = fileProvider.NugetConfigs;
@@ -828,11 +957,11 @@ private IEnumerable GetFeeds(Func> getNugetFeeds)
if (invalidNugetConfigs.Count() > 0)
{
- this.logger.LogWarning(string.Format(
+ logger.LogWarning(string.Format(
"Found incorrectly named NuGet configuration files: {0}",
string.Join(", ", invalidNugetConfigs)
));
- this.diagnosticsWriter.AddEntry(new DiagnosticMessage(
+ diagnosticsWriter.AddEntry(new DiagnosticMessage(
Language.CSharp,
"buildless/case-sensitive-nuget-config",
"Found NuGet configuration files which are not correctly named",
@@ -864,41 +993,33 @@ private IEnumerable GetFeeds(Func> getNugetFeeds)
logger.LogDebug("No NuGet feeds found in nuget.config files.");
}
- // todo: this could be improved.
- HashSet? allFeeds = null;
+ // If private package registries are configured for C#, then consider those
+ // in addition to the ones that are configured in `nuget.config` files.
+ if (hasPrivateRegistryFeeds)
+ {
+ logger.LogInfo($"Found {privateRegistryFeeds.Count} private registry feeds configured for C#: {string.Join(", ", privateRegistryFeeds.OrderBy(f => f))}");
+ explicitFeeds.UnionWith(privateRegistryFeeds);
+ }
+
+ HashSet allFeeds = [];
+
+ // Add all explicitFeeds to the set of all feeds.
+ allFeeds.UnionWith(explicitFeeds);
+
+ // Obtain the list of feeds from the root source directory.
+ // If a NuGet file is present it will be respected, otherwise we will just get the machine/environment specific feeds.
+ var nugetFeedsFromRoot = GetFeeds(() => dotnet.GetNugetFeedsFromFolder(fileProvider.SourceDir.FullName));
+ allFeeds.UnionWith(nugetFeedsFromRoot);
if (nugetConfigs.Count > 0)
{
- // We don't have to get the feeds from each of the folders from below, it would be enought to check the folders that recursively contain the others.
- allFeeds = nugetConfigs
- .Select(config =>
- {
- try
- {
- return new FileInfo(config).Directory?.FullName;
- }
- catch (Exception exc)
- {
- logger.LogWarning($"Failed to get directory of '{config}': {exc}");
- }
- return null;
- })
+ var nugetConfigFeeds = nugetConfigs
+ .Select(GetDirectoryName)
.Where(folder => folder != null)
.SelectMany(folder => GetFeeds(() => dotnet.GetNugetFeedsFromFolder(folder!)))
.ToHashSet();
- // If we have discovered any explicit feeds, then we also expect these to be in the set of all feeds.
- // Normally, it is a safe assumption to make that `GetNugetFeedsFromFolder` will include the feeds configured
- // in a NuGet configuration file in the given directory. There is one exception: on a system with case-sensitive
- // file systems, we may discover a configuration file such as `Nuget.Config` which is not recognised by `dotnet nuget`.
- // In that case, our call to `GetNugetFeeds` will retrieve the feeds from that file (because it is accepted when
- // provided explicitly as `--configfile` argument), but the call to `GetNugetFeedsFromFolder` will not.
- allFeeds.UnionWith(explicitFeeds);
- }
- else
- {
- // If we haven't found any `nuget.config` files, then obtain a list of feeds from the root source directory.
- allFeeds = GetFeeds(() => dotnet.GetNugetFeedsFromFolder(this.fileProvider.SourceDir.FullName)).ToHashSet();
+ allFeeds.UnionWith(nugetConfigFeeds);
}
logger.LogInfo($"Found {allFeeds.Count} NuGet feeds (with inherited ones) in nuget.config files: {string.Join(", ", allFeeds.OrderBy(f => f))}");
@@ -923,6 +1044,7 @@ public void Dispose()
PackageDirectory?.Dispose();
legacyPackageDirectory?.Dispose();
missingPackageDirectory?.Dispose();
+ emptyPackageDirectory?.Dispose();
}
///
diff --git a/csharp/extractor/Semmle.Extraction.CSharp.Util/SymbolExtensions.cs b/csharp/extractor/Semmle.Extraction.CSharp.Util/SymbolExtensions.cs
index 659b26c2fe99..92d7ecfad6bb 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp.Util/SymbolExtensions.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp.Util/SymbolExtensions.cs
@@ -1,3 +1,5 @@
+using System.Collections.Generic;
+using System.Collections.ObjectModel;
using System.Text.RegularExpressions;
using Microsoft.CodeAnalysis;
@@ -18,114 +20,68 @@ public static string GetName(this ISymbol symbol, bool useMetadataName = false)
return symbol.CanBeReferencedByName ? name : name.Substring(symbol.Name.LastIndexOf('.') + 1);
}
+ private static readonly ReadOnlyDictionary methodToOperator = new(new Dictionary
+ {
+ { "op_LogicalNot", "!" },
+ { "op_BitwiseAnd", "&" },
+ { "op_Equality", "==" },
+ { "op_Inequality", "!=" },
+ { "op_UnaryPlus", "+" },
+ { "op_Addition", "+" },
+ { "op_UnaryNegation", "-" },
+ { "op_Subtraction", "-" },
+ { "op_Multiply", "*" },
+ { "op_Multiplication", "*" },
+ { "op_Division", "/" },
+ { "op_Modulus", "%" },
+ { "op_GreaterThan", ">" },
+ { "op_GreaterThanOrEqual", ">=" },
+ { "op_LessThan", "<" },
+ { "op_LessThanOrEqual", "<=" },
+ { "op_Decrement", "--" },
+ { "op_Increment", "++" },
+ { "op_Implicit", "implicit conversion" },
+ { "op_Explicit", "explicit conversion" },
+ { "op_OnesComplement", "~" },
+ { "op_RightShift", ">>" },
+ { "op_UnsignedRightShift", ">>>" },
+ { "op_LeftShift", "<<" },
+ { "op_BitwiseOr", "|" },
+ { "op_ExclusiveOr", "^" },
+ { "op_True", "true" },
+ { "op_False", "false" }
+ });
+
///
/// Convert an operator method name in to a symbolic name.
/// A return value indicates whether the conversion succeeded.
///
public static bool TryGetOperatorSymbol(this ISymbol symbol, out string operatorName)
{
- static bool TryGetOperatorSymbolFromName(string methodName, out string operatorName)
+ var methodName = symbol.GetName(useMetadataName: false);
+
+ // Most common use-case.
+ if (methodToOperator.TryGetValue(methodName, out var opName))
{
- var success = true;
- switch (methodName)
- {
- case "op_LogicalNot":
- operatorName = "!";
- break;
- case "op_BitwiseAnd":
- operatorName = "&";
- break;
- case "op_Equality":
- operatorName = "==";
- break;
- case "op_Inequality":
- operatorName = "!=";
- break;
- case "op_UnaryPlus":
- case "op_Addition":
- operatorName = "+";
- break;
- case "op_UnaryNegation":
- case "op_Subtraction":
- operatorName = "-";
- break;
- case "op_Multiply":
- operatorName = "*";
- break;
- case "op_Division":
- operatorName = "/";
- break;
- case "op_Modulus":
- operatorName = "%";
- break;
- case "op_GreaterThan":
- operatorName = ">";
- break;
- case "op_GreaterThanOrEqual":
- operatorName = ">=";
- break;
- case "op_LessThan":
- operatorName = "<";
- break;
- case "op_LessThanOrEqual":
- operatorName = "<=";
- break;
- case "op_Decrement":
- operatorName = "--";
- break;
- case "op_Increment":
- operatorName = "++";
- break;
- case "op_Implicit":
- operatorName = "implicit conversion";
- break;
- case "op_Explicit":
- operatorName = "explicit conversion";
- break;
- case "op_OnesComplement":
- operatorName = "~";
- break;
- case "op_RightShift":
- operatorName = ">>";
- break;
- case "op_UnsignedRightShift":
- operatorName = ">>>";
- break;
- case "op_LeftShift":
- operatorName = "<<";
- break;
- case "op_BitwiseOr":
- operatorName = "|";
- break;
- case "op_ExclusiveOr":
- operatorName = "^";
- break;
- case "op_True":
- operatorName = "true";
- break;
- case "op_False":
- operatorName = "false";
- break;
- default:
- var match = CheckedRegex().Match(methodName);
- if (match.Success)
- {
- TryGetOperatorSymbolFromName($"op_{match.Groups[1]}", out var uncheckedName);
- operatorName = $"checked {uncheckedName}";
- break;
- }
- operatorName = methodName;
- success = false;
- break;
- }
- return success;
+ operatorName = opName;
+ return true;
}
- var methodName = symbol.GetName(useMetadataName: false);
- return TryGetOperatorSymbolFromName(methodName, out operatorName);
+ // Attempt to parse using a regexp.
+ var match = OperatorRegex().Match(methodName);
+ if (match.Success && methodToOperator.TryGetValue($"op_{match.Groups[2]}", out var rawOperatorName))
+ {
+ var prefix = match.Groups[1].Success ? "checked " : "";
+ var postfix = match.Groups[3].Success ? "=" : "";
+ operatorName = $"{prefix}{rawOperatorName}{postfix}";
+ return true;
+ }
+
+ operatorName = methodName;
+ return false;
}
- [GeneratedRegex("^op_Checked(.*)$")]
- private static partial Regex CheckedRegex();
+ [GeneratedRegex("^op_(Checked)?(.*?)(Assignment)?$")]
+ private static partial Regex OperatorRegex();
}
}
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expression.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expression.cs
index 93107fc6dab8..4ab90def2c16 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expression.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expression.cs
@@ -228,6 +228,41 @@ type.SpecialType is SpecialType.System_IntPtr ||
return Literal.CreateGenerated(cx, parent, childIndex, type, defaultValue, location);
}
+ ///
+ /// Given an expression syntax node, attempt to resolve the target method symbol for it.
+ /// The operation takes extension methods into account.
+ ///
+ /// The expression syntax node.
+ /// Returns the target method symbol, or null if it cannot be resolved.
+ protected IMethodSymbol? GetTargetSymbol(ExpressionSyntax node)
+ {
+ var si = Context.GetSymbolInfo(node);
+ if (si.Symbol is ISymbol symbol)
+ {
+ var method = symbol as IMethodSymbol;
+ // Case for compiler-generated extension methods.
+ return method?.TryGetExtensionMethod() ?? method;
+ }
+
+ if (si.CandidateReason == CandidateReason.OverloadResolutionFailure && node is InvocationExpressionSyntax syntax)
+ {
+ // This seems to be a bug in Roslyn
+ // For some reason, typeof(X).InvokeMember(...) fails to resolve the correct
+ // InvokeMember() method, even though the number of parameters clearly identifies the correct method
+
+ var candidates = si.CandidateSymbols
+ .OfType()
+ .Where(method => method.Parameters.Length >= syntax.ArgumentList.Arguments.Count)
+ .Where(method => method.Parameters.Count(p => !p.HasExplicitDefaultValue) <= syntax.ArgumentList.Arguments.Count);
+
+ return Context.ExtractionContext.IsStandalone ?
+ candidates.FirstOrDefault() :
+ candidates.SingleOrDefault();
+ }
+
+ return si.Symbol as IMethodSymbol;
+ }
+
///
/// Adapt the operator kind depending on whether it's a dynamic call or a user-operator call.
///
@@ -244,10 +279,10 @@ public static ExprKind UnaryOperatorKind(Context cx, ExprKind originalKind, Expr
/// name if available.
///
/// The expression.
- public void OperatorCall(TextWriter trapFile, ExpressionSyntax node)
+ public void AddOperatorCall(TextWriter trapFile, ExpressionSyntax node)
{
- var @operator = Context.GetSymbolInfo(node);
- if (@operator.Symbol is IMethodSymbol method)
+ var @operator = GetTargetSymbol(node);
+ if (@operator is IMethodSymbol method)
{
var callType = GetCallType(Context, node);
if (callType == CallType.Dynamic)
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Assignment.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Assignment.cs
index 67e49b2919c2..6d869b256c58 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Assignment.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Assignment.cs
@@ -24,10 +24,9 @@ protected override void PopulateExpression(TextWriter trapFile)
{
Create(Context, Syntax.Left, this, 0);
Create(Context, Syntax.Right, this, 1);
-
if (Kind != ExprKind.SIMPLE_ASSIGN && Kind != ExprKind.ASSIGN_COALESCE)
{
- OperatorCall(trapFile, Syntax);
+ AddOperatorCall(trapFile, Syntax);
}
}
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Binary.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Binary.cs
index d4cc5cc81d58..2bc8c61f21f3 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Binary.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Binary.cs
@@ -40,7 +40,7 @@ private void CreateDeferred(Context cx, ExpressionSyntax node, int child)
protected override void PopulateExpression(TextWriter trapFile)
{
- OperatorCall(trapFile, Syntax);
+ AddOperatorCall(trapFile, Syntax);
CreateDeferred(Context, Syntax.Left, 0);
CreateDeferred(Context, Syntax.Right, 1);
}
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Cast.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Cast.cs
index 20a5dc611a31..c11711f30926 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Cast.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Cast.cs
@@ -25,7 +25,7 @@ protected override void PopulateExpression(TextWriter trapFile)
else
{
// Type conversion
- OperatorCall(trapFile, Syntax);
+ AddOperatorCall(trapFile, Syntax);
TypeMention.Create(Context, Syntax.Type, this, Type);
}
}
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Invocation.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Invocation.cs
index 2ed7aec9955c..343f288eeafe 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Invocation.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Invocation.cs
@@ -44,7 +44,7 @@ protected override void PopulateExpression(TextWriter trapFile)
var child = -1;
string? memberName = null;
- var target = TargetSymbol;
+ var target = GetTargetSymbol(Syntax);
switch (Syntax.Expression)
{
case MemberAccessExpressionSyntax memberAccess when IsValidMemberAccessKind():
@@ -129,39 +129,6 @@ private static bool IsOperatorLikeCall(ExpressionNodeInfo info)
method.TryGetExtensionMethod()?.MethodKind == MethodKind.UserDefinedOperator;
}
- public IMethodSymbol? TargetSymbol
- {
- get
- {
- var si = SymbolInfo;
-
- if (si.Symbol is ISymbol symbol)
- {
- var method = symbol as IMethodSymbol;
- // Case for compiler-generated extension methods.
- return method?.TryGetExtensionMethod() ?? method;
- }
-
- if (si.CandidateReason == CandidateReason.OverloadResolutionFailure)
- {
- // This seems to be a bug in Roslyn
- // For some reason, typeof(X).InvokeMember(...) fails to resolve the correct
- // InvokeMember() method, even though the number of parameters clearly identifies the correct method
-
- var candidates = si.CandidateSymbols
- .OfType()
- .Where(method => method.Parameters.Length >= Syntax.ArgumentList.Arguments.Count)
- .Where(method => method.Parameters.Count(p => !p.HasExplicitDefaultValue) <= Syntax.ArgumentList.Arguments.Count);
-
- return Context.ExtractionContext.IsStandalone ?
- candidates.FirstOrDefault() :
- candidates.SingleOrDefault();
- }
-
- return si.Symbol as IMethodSymbol;
- }
- }
-
private static bool IsDelegateLikeCall(ExpressionNodeInfo info)
{
return IsDelegateLikeCall(info, symbol => IsFunctionPointer(symbol) || IsDelegateInvoke(symbol));
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/PostfixUnary.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/PostfixUnary.cs
index dbe5ecb3d184..051a03e9f8c2 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/PostfixUnary.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/PostfixUnary.cs
@@ -25,7 +25,7 @@ protected override void PopulateExpression(TextWriter trapFile)
if ((operatorKind == ExprKind.POST_INCR || operatorKind == ExprKind.POST_DECR) &&
Kind == ExprKind.OPERATOR_INVOCATION)
{
- OperatorCall(trapFile, Syntax);
+ AddOperatorCall(trapFile, Syntax);
trapFile.mutator_invocation_mode(this, 2);
}
}
diff --git a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Unary.cs b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Unary.cs
index 161fbe62e3f1..699c3810d116 100644
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Unary.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Unary.cs
@@ -24,7 +24,7 @@ public static Unary Create(ExpressionNodeInfo info)
protected override void PopulateExpression(TextWriter trapFile)
{
Create(Context, Syntax.Operand, this, 0);
- OperatorCall(trapFile, Syntax);
+ AddOperatorCall(trapFile, Syntax);
if ((operatorKind == ExprKind.PRE_INCR || operatorKind == ExprKind.PRE_DECR) &&
Kind == ExprKind.OPERATOR_INVOCATION)
diff --git a/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
index f7107d18c014..eefb35f174ad 100644
--- a/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
+++ b/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
@@ -1,3 +1,15 @@
+## 1.7.67
+
+No user-facing changes.
+
+## 1.7.66
+
+No user-facing changes.
+
+## 1.7.65
+
+No user-facing changes.
+
## 1.7.64
No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.65.md b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.65.md
new file mode 100644
index 000000000000..12bf5dad4b08
--- /dev/null
+++ b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.65.md
@@ -0,0 +1,3 @@
+## 1.7.65
+
+No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.66.md b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.66.md
new file mode 100644
index 000000000000..7fc1a46a66ef
--- /dev/null
+++ b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.66.md
@@ -0,0 +1,3 @@
+## 1.7.66
+
+No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.67.md b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.67.md
new file mode 100644
index 000000000000..6ae3bdfde833
--- /dev/null
+++ b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.67.md
@@ -0,0 +1,3 @@
+## 1.7.67
+
+No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
index f41e954c9ae2..0293fdade8f5 100644
--- a/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
+++ b/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.7.64
+lastReleaseVersion: 1.7.67
diff --git a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
index 9c094c18dc6d..51b34483e1bf 100644
--- a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-all
-version: 1.7.64
+version: 1.7.67
groups:
- csharp
- solorigate
diff --git a/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
index f7107d18c014..eefb35f174ad 100644
--- a/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
+++ b/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
@@ -1,3 +1,15 @@
+## 1.7.67
+
+No user-facing changes.
+
+## 1.7.66
+
+No user-facing changes.
+
+## 1.7.65
+
+No user-facing changes.
+
## 1.7.64
No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/src/ModifiedFnvFunctionDetection.ql b/csharp/ql/campaigns/Solorigate/src/ModifiedFnvFunctionDetection.ql
index ca153bfb97db..515bbbd91c67 100644
--- a/csharp/ql/campaigns/Solorigate/src/ModifiedFnvFunctionDetection.ql
+++ b/csharp/ql/campaigns/Solorigate/src/ModifiedFnvFunctionDetection.ql
@@ -13,11 +13,13 @@ import csharp
import Solorigate
import experimental.code.csharp.Cryptography.NonCryptographicHashes
+ControlFlowNode loopExitNode(LoopStmt loop) { result.isAfter(loop) }
+
from Variable v, Literal l, LoopStmt loop, Expr additional_xor
where
maybeUsedInFnvFunction(v, _, _, loop) and
exists(BitwiseXorOperation xor2 | xor2.getAnOperand() = l and additional_xor = xor2 |
- loop.getAControlFlowExitNode().getASuccessor*() = xor2.getAControlFlowNode() and
+ loopExitNode(loop).getASuccessor*() = xor2.getControlFlowNode() and
xor2.getAnOperand() = v.getAnAccess()
)
select l, "This literal is used in an $@ after an FNV-like hash calculation with variable $@.",
diff --git a/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.65.md b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.65.md
new file mode 100644
index 000000000000..12bf5dad4b08
--- /dev/null
+++ b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.65.md
@@ -0,0 +1,3 @@
+## 1.7.65
+
+No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.66.md b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.66.md
new file mode 100644
index 000000000000..7fc1a46a66ef
--- /dev/null
+++ b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.66.md
@@ -0,0 +1,3 @@
+## 1.7.66
+
+No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.67.md b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.67.md
new file mode 100644
index 000000000000..6ae3bdfde833
--- /dev/null
+++ b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.67.md
@@ -0,0 +1,3 @@
+## 1.7.67
+
+No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
index f41e954c9ae2..0293fdade8f5 100644
--- a/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
+++ b/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.7.64
+lastReleaseVersion: 1.7.67
diff --git a/csharp/ql/campaigns/Solorigate/src/qlpack.yml b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
index 666c44a2805e..81f347373c52 100644
--- a/csharp/ql/campaigns/Solorigate/src/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-queries
-version: 1.7.64
+version: 1.7.67
groups:
- csharp
- solorigate
diff --git a/csharp/ql/consistency-queries/CfgConsistency.ql b/csharp/ql/consistency-queries/CfgConsistency.ql
index 4b0d15f8a819..883014fdcf08 100644
--- a/csharp/ql/consistency-queries/CfgConsistency.ql
+++ b/csharp/ql/consistency-queries/CfgConsistency.ql
@@ -1,5 +1,2 @@
import csharp
-import semmle.code.csharp.controlflow.internal.Completion
-import ControlFlow
-import semmle.code.csharp.controlflow.internal.ControlFlowGraphImpl::Consistency
-import semmle.code.csharp.controlflow.internal.Splitting
+import ControlFlow::Consistency
diff --git a/csharp/ql/consistency-queries/DataFlowConsistency.ql b/csharp/ql/consistency-queries/DataFlowConsistency.ql
index 03e0f3f1b740..6060304bd9c7 100644
--- a/csharp/ql/consistency-queries/DataFlowConsistency.ql
+++ b/csharp/ql/consistency-queries/DataFlowConsistency.ql
@@ -1,5 +1,4 @@
import csharp
-private import semmle.code.csharp.controlflow.internal.ControlFlowGraphImpl as ControlFlowGraphImpl
private import semmle.code.csharp.dataflow.internal.DataFlowImplSpecific
private import semmle.code.csharp.dataflow.internal.TaintTrackingImplSpecific
private import codeql.dataflow.internal.DataFlowImplConsistency
@@ -7,20 +6,6 @@ private import codeql.dataflow.internal.DataFlowImplConsistency
private module Input implements InputSig {
private import CsharpDataFlow
- private predicate isStaticAssignable(Assignable a) { a.(Modifiable).isStatic() }
-
- predicate uniqueEnclosingCallableExclude(Node node) {
- // TODO: Remove once static initializers are folded into the
- // static constructors
- isStaticAssignable(ControlFlowGraphImpl::getNodeCfgScope(node.getControlFlowNode()))
- }
-
- predicate uniqueCallEnclosingCallableExclude(DataFlowCall call) {
- // TODO: Remove once static initializers are folded into the
- // static constructors
- isStaticAssignable(ControlFlowGraphImpl::getNodeCfgScope(call.getControlFlowNode()))
- }
-
predicate uniqueNodeLocationExclude(Node n) {
// Methods with multiple implementations
n instanceof ParameterNode
@@ -70,17 +55,14 @@ private module Input implements InputSig {
init.getInitializer().getNumberOfChildren() > 1
)
or
- exists(ControlFlow::Nodes::ElementNode cfn, ControlFlow::Nodes::Split split |
- exists(arg.asExprAtNode(cfn))
- |
- split = cfn.getASplit() and
- not split = call.getControlFlowNode().getASplit()
- or
- split = call.getControlFlowNode().getASplit() and
- not split = cfn.getASplit()
- )
- or
call.(NonDelegateDataFlowCall).getDispatchCall().isReflection()
+ or
+ // Exclude calls that are both getter and setter calls, as they share the same argument nodes.
+ exists(AccessorCall ac |
+ call.(NonDelegateDataFlowCall).getDispatchCall().getCall() = ac and
+ ac instanceof AssignableRead and
+ ac instanceof AssignableWrite
+ )
)
}
}
diff --git a/csharp/ql/consistency-queries/SsaConsistency.ql b/csharp/ql/consistency-queries/SsaConsistency.ql
index e9c9191b63a1..003e7ddd5e94 100644
--- a/csharp/ql/consistency-queries/SsaConsistency.ql
+++ b/csharp/ql/consistency-queries/SsaConsistency.ql
@@ -7,8 +7,8 @@ query predicate localDeclWithSsaDef(LocalVariableDeclExpr d) {
// Local variables in C# must be initialized before every use, so uninitialized
// local variables should not have an SSA definition, as that would imply that
// the declaration is live (can reach a use without passing through a definition)
- exists(ExplicitDefinition def |
- d = def.getADefinition().(AssignableDefinitions::LocalVariableDefinition).getDeclaration()
+ exists(SsaExplicitWrite def |
+ d = def.getDefinition().(AssignableDefinitions::LocalVariableDefinition).getDeclaration()
|
not d = any(ForeachStmt fs).getVariableDeclExpr() and
not d = any(SpecificCatchClause scc).getVariableDeclExpr() and
diff --git a/csharp/ql/consistency-queries/VariableCaptureConsistency.ql b/csharp/ql/consistency-queries/VariableCaptureConsistency.ql
index 927741f07bfe..869be5aea9fe 100644
--- a/csharp/ql/consistency-queries/VariableCaptureConsistency.ql
+++ b/csharp/ql/consistency-queries/VariableCaptureConsistency.ql
@@ -1,13 +1,6 @@
import csharp
import semmle.code.csharp.dataflow.internal.DataFlowPrivate::VariableCapture::Flow::ConsistencyChecks
private import semmle.code.csharp.dataflow.internal.DataFlowPrivate::VariableCapture::Flow::ConsistencyChecks as ConsistencyChecks
-private import semmle.code.csharp.controlflow.BasicBlocks
-private import semmle.code.csharp.controlflow.internal.ControlFlowGraphImpl
-
-query predicate uniqueEnclosingCallable(BasicBlock bb, string msg) {
- ConsistencyChecks::uniqueEnclosingCallable(bb, msg) and
- getNodeCfgScope(bb.getFirstNode()) instanceof Callable
-}
query predicate consistencyOverview(string msg, int n) { none() }
diff --git a/csharp/ql/examples/snippets/integer_literal.ql b/csharp/ql/examples/snippets/integer_literal.ql
index 4546c1d174ba..36791fc8c374 100644
--- a/csharp/ql/examples/snippets/integer_literal.ql
+++ b/csharp/ql/examples/snippets/integer_literal.ql
@@ -9,5 +9,5 @@
import csharp
from IntegerLiteral literal
-where literal.getValue().toInt() = 0
+where literal.getIntValue() = 0
select literal
diff --git a/csharp/ql/integration-tests/all-platforms/standalone_resx/CompilationInfo.expected b/csharp/ql/integration-tests/all-platforms/standalone_resx/CompilationInfo.expected
index dfab1016a6b2..6d91b2700226 100644
--- a/csharp/ql/integration-tests/all-platforms/standalone_resx/CompilationInfo.expected
+++ b/csharp/ql/integration-tests/all-platforms/standalone_resx/CompilationInfo.expected
@@ -1,5 +1,7 @@
| All NuGet feeds reachable | 1.0 |
+| Failed project restore with missing package error | 0.0 |
| Failed project restore with package source error | 0.0 |
+| Failed solution restore with missing package error | 0.0 |
| Failed solution restore with package source error | 0.0 |
| Inherited NuGet feed count | 1.0 |
| NuGet feed responsiveness checked | 1.0 |
diff --git a/csharp/ql/integration-tests/all-platforms/standalone_slnx/CompilationInfo.expected b/csharp/ql/integration-tests/all-platforms/standalone_slnx/CompilationInfo.expected
index 3bd3941b27c5..82cf0509d345 100644
--- a/csharp/ql/integration-tests/all-platforms/standalone_slnx/CompilationInfo.expected
+++ b/csharp/ql/integration-tests/all-platforms/standalone_slnx/CompilationInfo.expected
@@ -1,5 +1,7 @@
| All NuGet feeds reachable | 1.0 |
+| Failed project restore with missing package error | 0.0 |
| Failed project restore with package source error | 0.0 |
+| Failed solution restore with missing package error | 0.0 |
| Failed solution restore with package source error | 0.0 |
| Inherited NuGet feed count | 1.0 |
| NuGet feed responsiveness checked | 1.0 |
diff --git a/csharp/ql/integration-tests/all-platforms/standalone_winforms/CompilationInfo.expected b/csharp/ql/integration-tests/all-platforms/standalone_winforms/CompilationInfo.expected
index 6b06566033c3..63ddd4903f3e 100644
--- a/csharp/ql/integration-tests/all-platforms/standalone_winforms/CompilationInfo.expected
+++ b/csharp/ql/integration-tests/all-platforms/standalone_winforms/CompilationInfo.expected
@@ -1,5 +1,7 @@
| All NuGet feeds reachable | 1.0 |
+| Failed project restore with missing package error | 0.0 |
| Failed project restore with package source error | 0.0 |
+| Failed solution restore with missing package error | 0.0 |
| Failed solution restore with package source error | 0.0 |
| Inherited NuGet feed count | 1.0 |
| NuGet feed responsiveness checked | 1.0 |
diff --git a/csharp/ql/integration-tests/posix/standalone_dependencies_nuget_clear/Assemblies.expected b/csharp/ql/integration-tests/posix/standalone_dependencies_nuget_clear/Assemblies.expected
new file mode 100644
index 000000000000..b676e41c1840
--- /dev/null
+++ b/csharp/ql/integration-tests/posix/standalone_dependencies_nuget_clear/Assemblies.expected
@@ -0,0 +1 @@
+| test-db/working/packages/newtonsoft.json/13.0.4/lib/net6.0/Newtonsoft.Json.dll:0:0:0:0 | Newtonsoft.Json, Version=13.0.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed |
diff --git a/csharp/ql/integration-tests/posix/standalone_dependencies_nuget_clear/Assemblies.ql b/csharp/ql/integration-tests/posix/standalone_dependencies_nuget_clear/Assemblies.ql
new file mode 100644
index 000000000000..0eb33b7ae37b
--- /dev/null
+++ b/csharp/ql/integration-tests/posix/standalone_dependencies_nuget_clear/Assemblies.ql
@@ -0,0 +1,5 @@
+import csharp
+
+from Assembly a
+where exists(a.getFile().getAbsolutePath().indexOf("newtonsoft.json"))
+select a
diff --git a/csharp/ql/integration-tests/posix/standalone_dependencies_nuget_clear/CompilationInfo.expected b/csharp/ql/integration-tests/posix/standalone_dependencies_nuget_clear/CompilationInfo.expected
new file mode 100644
index 000000000000..ff0b29da33fa
--- /dev/null
+++ b/csharp/ql/integration-tests/posix/standalone_dependencies_nuget_clear/CompilationInfo.expected
@@ -0,0 +1,22 @@
+| All NuGet feeds reachable | 1.0 |
+| Failed project restore with missing package error | 0.0 |
+| Failed project restore with package source error | 0.0 |
+| Failed solution restore with missing package error | 0.0 |
+| Failed solution restore with package source error | 0.0 |
+| Inherited NuGet feed count | 1.0 |
+| NuGet feed responsiveness checked | 1.0 |
+| Project files on filesystem | 1.0 |
+| Reachable fallback NuGet feed count | 1.0 |
+| Resolved assembly conflicts | 0.0 |
+| Resource extraction enabled | 0.0 |
+| Restored .NET framework variants | 1.0 |
+| Restored projects through solution files | 0.0 |
+| Solution files on filesystem | 0.0 |
+| Source files generated | 0.0 |
+| Source files on filesystem | 1.0 |
+| Successfully restored project files | 1.0 |
+| Successfully restored solution files | 0.0 |
+| Unresolved references | 0.0 |
+| UseWPF set | 0.0 |
+| UseWindowsForms set | 0.0 |
+| WebView extraction enabled | 1.0 |
diff --git a/csharp/ql/integration-tests/posix/standalone_dependencies_nuget_clear/CompilationInfo.ql b/csharp/ql/integration-tests/posix/standalone_dependencies_nuget_clear/CompilationInfo.ql
new file mode 100644
index 000000000000..073ffe3b224d
--- /dev/null
+++ b/csharp/ql/integration-tests/posix/standalone_dependencies_nuget_clear/CompilationInfo.ql
@@ -0,0 +1,15 @@
+import csharp
+import semmle.code.csharp.commons.Diagnostics
+
+query predicate compilationInfo(string key, float value) {
+ key != "Resolved references" and
+ not key.matches("Compiler diagnostic count for%") and
+ exists(Compilation c, string infoKey, string infoValue | infoValue = c.getInfo(infoKey) |
+ key = infoKey and
+ value = infoValue.toFloat()
+ or
+ not exists(infoValue.toFloat()) and
+ key = infoKey + ": " + infoValue and
+ value = 1
+ )
+}
diff --git a/csharp/ql/integration-tests/posix/standalone_dependencies_nuget_clear/clear/nuget.config b/csharp/ql/integration-tests/posix/standalone_dependencies_nuget_clear/clear/nuget.config
new file mode 100644
index 000000000000..a3f3aea61c8f
--- /dev/null
+++ b/csharp/ql/integration-tests/posix/standalone_dependencies_nuget_clear/clear/nuget.config
@@ -0,0 +1,6 @@
+
+
+
+
+
+
diff --git a/csharp/ql/integration-tests/posix/standalone_dependencies_nuget_clear/global.json b/csharp/ql/integration-tests/posix/standalone_dependencies_nuget_clear/global.json
new file mode 100644
index 000000000000..ed6049740701
--- /dev/null
+++ b/csharp/ql/integration-tests/posix/standalone_dependencies_nuget_clear/global.json
@@ -0,0 +1,5 @@
+{
+ "sdk": {
+ "version": "10.0.201"
+ }
+}
diff --git a/csharp/ql/integration-tests/posix/standalone_dependencies_nuget_clear/proj/Program.cs b/csharp/ql/integration-tests/posix/standalone_dependencies_nuget_clear/proj/Program.cs
new file mode 100644
index 000000000000..c340f4c32fd4
--- /dev/null
+++ b/csharp/ql/integration-tests/posix/standalone_dependencies_nuget_clear/proj/Program.cs
@@ -0,0 +1 @@
+class Program { }
diff --git a/csharp/ql/integration-tests/posix/standalone_dependencies_nuget_clear/proj/proj.csproj b/csharp/ql/integration-tests/posix/standalone_dependencies_nuget_clear/proj/proj.csproj
new file mode 100644
index 000000000000..6010c6c7f37c
--- /dev/null
+++ b/csharp/ql/integration-tests/posix/standalone_dependencies_nuget_clear/proj/proj.csproj
@@ -0,0 +1,16 @@
+
+
+
+ Exe
+ net10.0
+
+
+
+
+
+
+
+
+
+
+
diff --git a/csharp/ql/integration-tests/posix/standalone_dependencies_nuget_clear/test.py b/csharp/ql/integration-tests/posix/standalone_dependencies_nuget_clear/test.py
new file mode 100644
index 000000000000..cbbf2eb1d647
--- /dev/null
+++ b/csharp/ql/integration-tests/posix/standalone_dependencies_nuget_clear/test.py
@@ -0,0 +1,12 @@
+import os
+import runs_on
+
+
+@runs_on.posix
+def test(codeql, csharp):
+ # Making sure the reachability test of `nuget.org` succeeds:
+ os.environ["CODEQL_EXTRACTOR_CSHARP_BUILDLESS_NUGET_FEEDS_CHECK_FALLBACK_TIMEOUT"] = "1000"
+ os.environ["CODEQL_EXTRACTOR_CSHARP_BUILDLESS_NUGET_FEEDS_CHECK_FALLBACK_LIMIT"] = "5"
+
+ # This test checks that the nuget.config file in the clear folder is not applied to the restore of the project.
+ codeql.database.create(build_mode="none")
diff --git a/csharp/ql/integration-tests/posix/standalone_dependencies_nuget_config_error/CompilationInfo.expected b/csharp/ql/integration-tests/posix/standalone_dependencies_nuget_config_error/CompilationInfo.expected
index 3a74bcbd56ed..4acd4f54e8a6 100644
--- a/csharp/ql/integration-tests/posix/standalone_dependencies_nuget_config_error/CompilationInfo.expected
+++ b/csharp/ql/integration-tests/posix/standalone_dependencies_nuget_config_error/CompilationInfo.expected
@@ -1,7 +1,10 @@
-| All NuGet feeds reachable | 1.0 |
-| Failed project restore with package source error | 1.0 |
+| All NuGet feeds reachable | 0.0 |
+| Failed project restore with missing package error | 1.0 |
+| Failed project restore with package source error | 0.0 |
+| Failed solution restore with missing package error | 0.0 |
| Failed solution restore with package source error | 0.0 |
| Fallback nuget restore | 1.0 |
+| Inherited NuGet feed count | 1.0 |
| NuGet feed responsiveness checked | 1.0 |
| Project files on filesystem | 1.0 |
| Reachable fallback NuGet feed count | 1.0 |
diff --git a/csharp/ql/integration-tests/posix/standalone_dependencies_nuget_config_fallback/CompilationInfo.expected b/csharp/ql/integration-tests/posix/standalone_dependencies_nuget_config_fallback/CompilationInfo.expected
index c53a17f0300d..9cc03f2f5372 100644
--- a/csharp/ql/integration-tests/posix/standalone_dependencies_nuget_config_fallback/CompilationInfo.expected
+++ b/csharp/ql/integration-tests/posix/standalone_dependencies_nuget_config_fallback/CompilationInfo.expected
@@ -1,5 +1,6 @@
| All NuGet feeds reachable | 0.0 |
| Fallback nuget restore | 1.0 |
+| Inherited NuGet feed count | 1.0 |
| NuGet feed responsiveness checked | 1.0 |
| Project files on filesystem | 1.0 |
| Reachable fallback NuGet feed count | 2.0 |
diff --git a/csharp/ql/lib/CHANGELOG.md b/csharp/ql/lib/CHANGELOG.md
index 57d99a41480b..17fd83bcda76 100644
--- a/csharp/ql/lib/CHANGELOG.md
+++ b/csharp/ql/lib/CHANGELOG.md
@@ -1,3 +1,52 @@
+## 6.0.1
+
+No user-facing changes.
+
+## 6.0.0
+
+### Breaking Changes
+
+* The C# control flow graph (CFG) implementation has been completely
+ rewritten. The CFG now includes additional nodes to more accurately represent
+ certain constructs. This also means that any existing code that implicitly
+ relies on very specific details about the CFG may need to be updated.
+ The CFG no longer uses splitting, which means that AST nodes now have a unique
+ CFG node representation.
+ Additionally, the following breaking changes have been made:
+ - `ControlFlow::Node` has been renamed to `ControlFlowNode`.
+ - `ControlFlow::Nodes` has been renamed to `ControlFlowNodes`.
+ - `BasicBlock.getCallable` has been renamed to `BasicBlock.getEnclosingCallable`.
+ - `BasicBlocks.qll` has been deleted.
+ - `ControlFlowNode.getAstNode` has changed its meaning. The AST-to-CFG
+ mapping remains one-to-many, but now for a different reason. It used to be
+ because of splitting, but now it's because of additional "helper" CFG
+ nodes. To get the (now canonical) CFG node for a given AST node, use
+ `ControlFlowNode.asExpr()` or `ControlFlowNode.asStmt()` or
+ `ControlFlowElement.getControlFlowNode()` instead.
+
+### Deprecated APIs
+
+* The QL classes in the C# SSA library have been renamed to improve consistency between languages. Any custom QL code that makes use of SSA needs to be updated. The old classes have been deprecated and include more detailed migration instructions in their qldoc.
+
+### New Features
+
+* Data flow barriers and barrier guards can now be added using data extensions. For more information see [Customizing library models for C#](https://codeql.github.com/docs/codeql-language-guides/customizing-library-models-for-csharp/).
+
+### Major Analysis Improvements
+
+* When resolving dependencies in `build-mode: none`, `dotnet restore` now explicitly receives reachable NuGet feeds configured in `nuget.config` when feed responsiveness checking is enabled (the default), and any private registries directly, improving reliability when default feeds are unavailable or restricted.
+
+### Minor Analysis Improvements
+
+* Expanded ASP and ASP.NET remote source modeling to cover additional sources, including fields of tainted parameters as well as properties and fields that become tainted transitively.
+* C# 14: Added support for user-defined compound assignment operators.
+
+## 5.5.0
+
+### Deprecated APIs
+
+* The predicates `get[L|R]Value` in the class `Assignment` have been deprecated. Use `get[Left|Right]Operand` instead.
+
## 5.4.12
### Minor Analysis Improvements
@@ -58,9 +107,9 @@ No user-facing changes.
* When a code-scanning configuration specifies the `paths:` and/or `paths-ignore:` settings, these are now taken into account by the C# extractor's search for `.config`, `.props`, XML and project files.
* Updated the generated .NET “models as data” runtime models to cover .NET 10.
* C# 14: Support for *implicit* span conversions in the QL library.
-* Basic extractor support for .NET 10 is now available. Extraction is supported for .NET 10 projects in both traced mode and `build mode: none`. However, code that uses language features new to C# 14 is not yet fully supported for extraction and analysis.
+* Basic extractor support for .NET 10 is now available. Extraction is supported for .NET 10 projects in both traced mode and `build-mode: none`. However, code that uses language features new to C# 14 is not yet fully supported for extraction and analysis.
* Added autobuilder and `build-mode: none` support for `.slnx` solution files.
-* In `build mode: none`, .NET 10 is now used by default unless a specific .NET version is specified elsewhere.
+* In `build-mode: none`, .NET 10 is now used by default unless a specific .NET version is specified elsewhere.
* Added implicit reads of `System.Collections.Generic.KeyValuePair.Value` at taint-tracking sinks and at inputs to additional taint steps. As a result, taint-tracking queries will now produce more results when a container is tainted.
### Bug Fixes
diff --git a/csharp/ql/lib/Linq/Helpers.qll b/csharp/ql/lib/Linq/Helpers.qll
index d490868f4532..2a4d5c8c27a2 100644
--- a/csharp/ql/lib/Linq/Helpers.qll
+++ b/csharp/ql/lib/Linq/Helpers.qll
@@ -77,7 +77,7 @@ predicate missedAllOpportunity(ForeachStmtGenericEnumerable fes) {
// The then case of the if assigns false to something and breaks out of the loop.
exists(Assignment a, BoolLiteral bl |
a = is.getThen().getAChild*() and
- bl = a.getRValue() and
+ bl = a.getRightOperand() and
bl.toString() = "false"
) and
is.getThen().getAChild*() instanceof BreakStmt
@@ -121,15 +121,17 @@ predicate missedOfTypeOpportunity(ForeachStmtEnumerable fes, LocalVariableDeclSt
/**
* Holds if `foreach` statement `fes` can be converted to a `.Select()` call.
* That is, the loop variable is accessed only in the first statement of the
- * block, the access is not a cast, and the first statement is a
- * local variable declaration statement `s`.
+ * block, the access is not a cast, the first statement is a
+ * local variable declaration statement `s`, and the initializer does not
+ * contain an `await` expression (since `Select` does not support async lambdas).
*/
predicate missedSelectOpportunity(ForeachStmtGenericEnumerable fes, LocalVariableDeclStmt s) {
s = firstStmt(fes) and
forex(VariableAccess va | va = fes.getVariable().getAnAccess() |
va = s.getAVariableDeclExpr().getAChildExpr*()
) and
- not s.getAVariableDeclExpr().getInitializer() instanceof Cast
+ not s.getAVariableDeclExpr().getInitializer() instanceof Cast and
+ not s.getAVariableDeclExpr().getInitializer().getAChildExpr*() instanceof AwaitExpr
}
/**
diff --git a/csharp/ql/lib/change-notes/released/5.4.5.md b/csharp/ql/lib/change-notes/released/5.4.5.md
index a084df5f2008..fc1e8b8c4eeb 100644
--- a/csharp/ql/lib/change-notes/released/5.4.5.md
+++ b/csharp/ql/lib/change-notes/released/5.4.5.md
@@ -5,9 +5,9 @@
* When a code-scanning configuration specifies the `paths:` and/or `paths-ignore:` settings, these are now taken into account by the C# extractor's search for `.config`, `.props`, XML and project files.
* Updated the generated .NET “models as data” runtime models to cover .NET 10.
* C# 14: Support for *implicit* span conversions in the QL library.
-* Basic extractor support for .NET 10 is now available. Extraction is supported for .NET 10 projects in both traced mode and `build mode: none`. However, code that uses language features new to C# 14 is not yet fully supported for extraction and analysis.
+* Basic extractor support for .NET 10 is now available. Extraction is supported for .NET 10 projects in both traced mode and `build-mode: none`. However, code that uses language features new to C# 14 is not yet fully supported for extraction and analysis.
* Added autobuilder and `build-mode: none` support for `.slnx` solution files.
-* In `build mode: none`, .NET 10 is now used by default unless a specific .NET version is specified elsewhere.
+* In `build-mode: none`, .NET 10 is now used by default unless a specific .NET version is specified elsewhere.
* Added implicit reads of `System.Collections.Generic.KeyValuePair.Value` at taint-tracking sinks and at inputs to additional taint steps. As a result, taint-tracking queries will now produce more results when a container is tainted.
### Bug Fixes
diff --git a/csharp/ql/lib/change-notes/released/5.5.0.md b/csharp/ql/lib/change-notes/released/5.5.0.md
new file mode 100644
index 000000000000..b497d8ea51b4
--- /dev/null
+++ b/csharp/ql/lib/change-notes/released/5.5.0.md
@@ -0,0 +1,5 @@
+## 5.5.0
+
+### Deprecated APIs
+
+* The predicates `get[L|R]Value` in the class `Assignment` have been deprecated. Use `get[Left|Right]Operand` instead.
diff --git a/csharp/ql/lib/change-notes/released/6.0.0.md b/csharp/ql/lib/change-notes/released/6.0.0.md
new file mode 100644
index 000000000000..e249567d0958
--- /dev/null
+++ b/csharp/ql/lib/change-notes/released/6.0.0.md
@@ -0,0 +1,38 @@
+## 6.0.0
+
+### Breaking Changes
+
+* The C# control flow graph (CFG) implementation has been completely
+ rewritten. The CFG now includes additional nodes to more accurately represent
+ certain constructs. This also means that any existing code that implicitly
+ relies on very specific details about the CFG may need to be updated.
+ The CFG no longer uses splitting, which means that AST nodes now have a unique
+ CFG node representation.
+ Additionally, the following breaking changes have been made:
+ - `ControlFlow::Node` has been renamed to `ControlFlowNode`.
+ - `ControlFlow::Nodes` has been renamed to `ControlFlowNodes`.
+ - `BasicBlock.getCallable` has been renamed to `BasicBlock.getEnclosingCallable`.
+ - `BasicBlocks.qll` has been deleted.
+ - `ControlFlowNode.getAstNode` has changed its meaning. The AST-to-CFG
+ mapping remains one-to-many, but now for a different reason. It used to be
+ because of splitting, but now it's because of additional "helper" CFG
+ nodes. To get the (now canonical) CFG node for a given AST node, use
+ `ControlFlowNode.asExpr()` or `ControlFlowNode.asStmt()` or
+ `ControlFlowElement.getControlFlowNode()` instead.
+
+### Deprecated APIs
+
+* The QL classes in the C# SSA library have been renamed to improve consistency between languages. Any custom QL code that makes use of SSA needs to be updated. The old classes have been deprecated and include more detailed migration instructions in their qldoc.
+
+### New Features
+
+* Data flow barriers and barrier guards can now be added using data extensions. For more information see [Customizing library models for C#](https://codeql.github.com/docs/codeql-language-guides/customizing-library-models-for-csharp/).
+
+### Major Analysis Improvements
+
+* When resolving dependencies in `build-mode: none`, `dotnet restore` now explicitly receives reachable NuGet feeds configured in `nuget.config` when feed responsiveness checking is enabled (the default), and any private registries directly, improving reliability when default feeds are unavailable or restricted.
+
+### Minor Analysis Improvements
+
+* Expanded ASP and ASP.NET remote source modeling to cover additional sources, including fields of tainted parameters as well as properties and fields that become tainted transitively.
+* C# 14: Added support for user-defined compound assignment operators.
diff --git a/csharp/ql/lib/change-notes/released/6.0.1.md b/csharp/ql/lib/change-notes/released/6.0.1.md
new file mode 100644
index 000000000000..35b17912c81a
--- /dev/null
+++ b/csharp/ql/lib/change-notes/released/6.0.1.md
@@ -0,0 +1,3 @@
+## 6.0.1
+
+No user-facing changes.
diff --git a/csharp/ql/lib/codeql-pack.release.yml b/csharp/ql/lib/codeql-pack.release.yml
index 43db6e52c988..d1f3c68c8120 100644
--- a/csharp/ql/lib/codeql-pack.release.yml
+++ b/csharp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 5.4.12
+lastReleaseVersion: 6.0.1
diff --git a/csharp/ql/lib/definitions.qll b/csharp/ql/lib/definitions.qll
index 4feaf20629c9..d4f2540bbef5 100644
--- a/csharp/ql/lib/definitions.qll
+++ b/csharp/ql/lib/definitions.qll
@@ -96,7 +96,7 @@ private class MethodUse extends Use, QualifiableExpr {
private class AccessUse extends Access, Use {
AccessUse() {
not this.getTarget().(Parameter).getCallable() instanceof Accessor and
- not this = any(LocalVariableDeclAndInitExpr d).getLValue() and
+ not this = any(LocalVariableDeclAndInitExpr d).getLeftOperand() and
not this.isImplicit() and
not this instanceof MethodAccess and // handled by `MethodUse`
not this instanceof TypeAccess and // handled by `TypeMentionUse`
diff --git a/csharp/ql/lib/experimental/code/csharp/Cryptography/NonCryptographicHashes.qll b/csharp/ql/lib/experimental/code/csharp/Cryptography/NonCryptographicHashes.qll
index b09251cf6e42..130e563a6638 100644
--- a/csharp/ql/lib/experimental/code/csharp/Cryptography/NonCryptographicHashes.qll
+++ b/csharp/ql/lib/experimental/code/csharp/Cryptography/NonCryptographicHashes.qll
@@ -30,7 +30,7 @@ predicate maybeUsedInFnvFunction(Variable v, Operation xor, Operation mul, LoopS
e2.getAChild*() = v.getAnAccess() and
e1 = xor.getAnOperand() and
e2 = mul.getAnOperand() and
- xor.getAControlFlowNode().getASuccessor*() = mul.getAControlFlowNode() and
+ xor.getControlFlowNode().getASuccessor*() = mul.getControlFlowNode() and
(xor instanceof AssignXorExpr or xor instanceof BitwiseXorExpr) and
(mul instanceof AssignMulExpr or mul instanceof MulExpr)
) and
@@ -55,11 +55,11 @@ private predicate maybeUsedInElfHashFunction(Variable v, Operation xor, Operatio
v = addAssign.getTargetVariable() and
addAssign.getAChild*() = add and
(xor instanceof BitwiseXorExpr or xor instanceof AssignXorExpr) and
- addAssign.getAControlFlowNode().getASuccessor*() = xor.getAControlFlowNode() and
+ addAssign.getControlFlowNode().getASuccessor*() = xor.getControlFlowNode() and
xorAssign.getAChild*() = xor and
v = xorAssign.getTargetVariable() and
(notOp instanceof UnaryBitwiseOperation or notOp instanceof AssignBitwiseOperation) and
- xor.getAControlFlowNode().getASuccessor*() = notOp.getAControlFlowNode() and
+ xor.getControlFlowNode().getASuccessor*() = notOp.getControlFlowNode() and
notAssign.getAChild*() = notOp and
v = notAssign.getTargetVariable() and
loop.getAChild*() = add.getEnclosingStmt() and
diff --git a/csharp/ql/lib/ext/generated/Generators.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Generators.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Generators.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Generators.model.yml
diff --git a/csharp/ql/lib/ext/generated/ILCompiler.IBC.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/ILCompiler.IBC.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/ILCompiler.IBC.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/ILCompiler.IBC.model.yml
diff --git a/csharp/ql/lib/ext/generated/ILCompiler.Reflection.ReadyToRun.Amd64.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/ILCompiler.Reflection.ReadyToRun.Amd64.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/ILCompiler.Reflection.ReadyToRun.Amd64.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/ILCompiler.Reflection.ReadyToRun.Amd64.model.yml
diff --git a/csharp/ql/lib/ext/generated/ILCompiler.Reflection.ReadyToRun.Arm.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/ILCompiler.Reflection.ReadyToRun.Arm.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/ILCompiler.Reflection.ReadyToRun.Arm.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/ILCompiler.Reflection.ReadyToRun.Arm.model.yml
diff --git a/csharp/ql/lib/ext/generated/ILCompiler.Reflection.ReadyToRun.Arm64.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/ILCompiler.Reflection.ReadyToRun.Arm64.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/ILCompiler.Reflection.ReadyToRun.Arm64.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/ILCompiler.Reflection.ReadyToRun.Arm64.model.yml
diff --git a/csharp/ql/lib/ext/generated/ILCompiler.Reflection.ReadyToRun.LoongArch64.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/ILCompiler.Reflection.ReadyToRun.LoongArch64.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/ILCompiler.Reflection.ReadyToRun.LoongArch64.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/ILCompiler.Reflection.ReadyToRun.LoongArch64.model.yml
diff --git a/csharp/ql/lib/ext/generated/ILCompiler.Reflection.ReadyToRun.MachO.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/ILCompiler.Reflection.ReadyToRun.MachO.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/ILCompiler.Reflection.ReadyToRun.MachO.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/ILCompiler.Reflection.ReadyToRun.MachO.model.yml
diff --git a/csharp/ql/lib/ext/generated/ILCompiler.Reflection.ReadyToRun.RiscV64.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/ILCompiler.Reflection.ReadyToRun.RiscV64.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/ILCompiler.Reflection.ReadyToRun.RiscV64.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/ILCompiler.Reflection.ReadyToRun.RiscV64.model.yml
diff --git a/csharp/ql/lib/ext/generated/ILCompiler.Reflection.ReadyToRun.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/ILCompiler.Reflection.ReadyToRun.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/ILCompiler.Reflection.ReadyToRun.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/ILCompiler.Reflection.ReadyToRun.model.yml
diff --git a/csharp/ql/lib/ext/generated/ILCompiler.Reflection.ReadyToRun.x86.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/ILCompiler.Reflection.ReadyToRun.x86.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/ILCompiler.Reflection.ReadyToRun.x86.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/ILCompiler.Reflection.ReadyToRun.x86.model.yml
diff --git a/csharp/ql/lib/ext/generated/ILCompiler.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/ILCompiler.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/ILCompiler.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/ILCompiler.model.yml
diff --git a/csharp/ql/lib/ext/generated/ILLink.CodeFix.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/ILLink.CodeFix.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/ILLink.CodeFix.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/ILLink.CodeFix.model.yml
diff --git a/csharp/ql/lib/ext/generated/ILLink.RoslynAnalyzer.DataFlow.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/ILLink.RoslynAnalyzer.DataFlow.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/ILLink.RoslynAnalyzer.DataFlow.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/ILLink.RoslynAnalyzer.DataFlow.model.yml
diff --git a/csharp/ql/lib/ext/generated/ILLink.RoslynAnalyzer.TrimAnalysis.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/ILLink.RoslynAnalyzer.TrimAnalysis.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/ILLink.RoslynAnalyzer.TrimAnalysis.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/ILLink.RoslynAnalyzer.TrimAnalysis.model.yml
diff --git a/csharp/ql/lib/ext/generated/ILLink.RoslynAnalyzer.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/ILLink.RoslynAnalyzer.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/ILLink.RoslynAnalyzer.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/ILLink.RoslynAnalyzer.model.yml
diff --git a/csharp/ql/lib/ext/generated/ILLink.Shared.DataFlow.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/ILLink.Shared.DataFlow.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/ILLink.Shared.DataFlow.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/ILLink.Shared.DataFlow.model.yml
diff --git a/csharp/ql/lib/ext/generated/ILLink.Shared.TrimAnalysis.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/ILLink.Shared.TrimAnalysis.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/ILLink.Shared.TrimAnalysis.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/ILLink.Shared.TrimAnalysis.model.yml
diff --git a/csharp/ql/lib/ext/generated/ILLink.Shared.TypeSystemProxy.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/ILLink.Shared.TypeSystemProxy.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/ILLink.Shared.TypeSystemProxy.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/ILLink.Shared.TypeSystemProxy.model.yml
diff --git a/csharp/ql/lib/ext/generated/ILLink.Shared.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/ILLink.Shared.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/ILLink.Shared.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/ILLink.Shared.model.yml
diff --git a/csharp/ql/lib/ext/generated/ILLink.Tasks.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/ILLink.Tasks.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/ILLink.Tasks.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/ILLink.Tasks.model.yml
diff --git a/csharp/ql/lib/ext/generated/Internal.IL.Stubs.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Internal.IL.Stubs.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Internal.IL.Stubs.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Internal.IL.Stubs.model.yml
diff --git a/csharp/ql/lib/ext/generated/Internal.IL.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Internal.IL.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Internal.IL.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Internal.IL.model.yml
diff --git a/csharp/ql/lib/ext/generated/Internal.NativeFormat.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Internal.NativeFormat.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Internal.NativeFormat.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Internal.NativeFormat.model.yml
diff --git a/csharp/ql/lib/ext/generated/Internal.Pgo.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Internal.Pgo.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Internal.Pgo.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Internal.Pgo.model.yml
diff --git a/csharp/ql/lib/ext/generated/Internal.TypeSystem.Ecma.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Internal.TypeSystem.Ecma.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Internal.TypeSystem.Ecma.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Internal.TypeSystem.Ecma.model.yml
diff --git a/csharp/ql/lib/ext/generated/Internal.TypeSystem.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Internal.TypeSystem.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Internal.TypeSystem.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Internal.TypeSystem.model.yml
diff --git a/csharp/ql/lib/ext/generated/Internal.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Internal.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Internal.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Internal.model.yml
diff --git a/csharp/ql/lib/ext/generated/IntrinsicsInSystemPrivateCoreLib.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/IntrinsicsInSystemPrivateCoreLib.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/IntrinsicsInSystemPrivateCoreLib.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/IntrinsicsInSystemPrivateCoreLib.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.CSharp.RuntimeBinder.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.CSharp.RuntimeBinder.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.CSharp.RuntimeBinder.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.CSharp.RuntimeBinder.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.CSharp.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.CSharp.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.CSharp.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.CSharp.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Diagnostics.JitTrace.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Diagnostics.JitTrace.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Diagnostics.JitTrace.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Diagnostics.JitTrace.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Diagnostics.Tools.Pgo.TypeRefTypeSystem.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Diagnostics.Tools.Pgo.TypeRefTypeSystem.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Diagnostics.Tools.Pgo.TypeRefTypeSystem.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Diagnostics.Tools.Pgo.TypeRefTypeSystem.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Diagnostics.Tools.Pgo.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Diagnostics.Tools.Pgo.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Diagnostics.Tools.Pgo.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Diagnostics.Tools.Pgo.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.DotNet.Build.Tasks.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.DotNet.Build.Tasks.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.DotNet.Build.Tasks.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.DotNet.Build.Tasks.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.DotNet.PlatformAbstractions.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.DotNet.PlatformAbstractions.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.DotNet.PlatformAbstractions.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.DotNet.PlatformAbstractions.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.Caching.Distributed.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Caching.Distributed.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.Caching.Distributed.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Caching.Distributed.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.Caching.Hybrid.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Caching.Hybrid.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.Caching.Hybrid.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Caching.Hybrid.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.Caching.Memory.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Caching.Memory.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.Caching.Memory.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Caching.Memory.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.Configuration.Binder.SourceGeneration.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Configuration.Binder.SourceGeneration.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.Configuration.Binder.SourceGeneration.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Configuration.Binder.SourceGeneration.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.Configuration.CommandLine.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Configuration.CommandLine.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.Configuration.CommandLine.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Configuration.CommandLine.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.Configuration.EnvironmentVariables.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Configuration.EnvironmentVariables.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.Configuration.EnvironmentVariables.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Configuration.EnvironmentVariables.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.Configuration.Ini.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Configuration.Ini.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.Configuration.Ini.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Configuration.Ini.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.Configuration.Json.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Configuration.Json.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.Configuration.Json.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Configuration.Json.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.Configuration.Memory.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Configuration.Memory.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.Configuration.Memory.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Configuration.Memory.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.Configuration.UserSecrets.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Configuration.UserSecrets.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.Configuration.UserSecrets.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Configuration.UserSecrets.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.Configuration.Xml.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Configuration.Xml.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.Configuration.Xml.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Configuration.Xml.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.Configuration.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Configuration.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.Configuration.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Configuration.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.DependencyInjection.Extensions.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.DependencyInjection.Extensions.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.DependencyInjection.Extensions.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.DependencyInjection.Extensions.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.DependencyInjection.Specification.Fakes.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.DependencyInjection.Specification.Fakes.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.DependencyInjection.Specification.Fakes.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.DependencyInjection.Specification.Fakes.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.DependencyInjection.Specification.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.DependencyInjection.Specification.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.DependencyInjection.Specification.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.DependencyInjection.Specification.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.DependencyInjection.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.DependencyInjection.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.DependencyInjection.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.DependencyInjection.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.DependencyModel.Resolution.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.DependencyModel.Resolution.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.DependencyModel.Resolution.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.DependencyModel.Resolution.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.DependencyModel.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.DependencyModel.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.DependencyModel.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.DependencyModel.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.Diagnostics.Metrics.Configuration.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Diagnostics.Metrics.Configuration.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.Diagnostics.Metrics.Configuration.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Diagnostics.Metrics.Configuration.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.Diagnostics.Metrics.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Diagnostics.Metrics.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.Diagnostics.Metrics.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Diagnostics.Metrics.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.FileProviders.Composite.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.FileProviders.Composite.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.FileProviders.Composite.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.FileProviders.Composite.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.FileProviders.Internal.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.FileProviders.Internal.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.FileProviders.Internal.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.FileProviders.Internal.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.FileProviders.Physical.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.FileProviders.Physical.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.FileProviders.Physical.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.FileProviders.Physical.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.FileProviders.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.FileProviders.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.FileProviders.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.FileProviders.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.FileSystemGlobbing.Abstractions.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.FileSystemGlobbing.Abstractions.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.FileSystemGlobbing.Abstractions.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.FileSystemGlobbing.Abstractions.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.FileSystemGlobbing.Internal.PathSegments.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.FileSystemGlobbing.Internal.PathSegments.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.FileSystemGlobbing.Internal.PathSegments.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.FileSystemGlobbing.Internal.PathSegments.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.FileSystemGlobbing.Internal.PatternContexts.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.FileSystemGlobbing.Internal.PatternContexts.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.FileSystemGlobbing.Internal.PatternContexts.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.FileSystemGlobbing.Internal.PatternContexts.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.FileSystemGlobbing.Internal.Patterns.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.FileSystemGlobbing.Internal.Patterns.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.FileSystemGlobbing.Internal.Patterns.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.FileSystemGlobbing.Internal.Patterns.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.FileSystemGlobbing.Internal.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.FileSystemGlobbing.Internal.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.FileSystemGlobbing.Internal.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.FileSystemGlobbing.Internal.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.FileSystemGlobbing.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.FileSystemGlobbing.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.FileSystemGlobbing.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.FileSystemGlobbing.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.Hosting.Internal.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Hosting.Internal.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.Hosting.Internal.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Hosting.Internal.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.Hosting.Systemd.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Hosting.Systemd.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.Hosting.Systemd.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Hosting.Systemd.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.Hosting.WindowsServices.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Hosting.WindowsServices.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.Hosting.WindowsServices.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Hosting.WindowsServices.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.Hosting.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Hosting.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.Hosting.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Hosting.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.Http.Logging.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Http.Logging.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.Http.Logging.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Http.Logging.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.Http.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Http.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.Http.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Http.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.Internal.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Internal.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.Internal.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Internal.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.Logging.Abstractions.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Logging.Abstractions.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.Logging.Abstractions.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Logging.Abstractions.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.Logging.Configuration.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Logging.Configuration.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.Logging.Configuration.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Logging.Configuration.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.Logging.Console.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Logging.Console.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.Logging.Console.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Logging.Console.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.Logging.Debug.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Logging.Debug.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.Logging.Debug.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Logging.Debug.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.Logging.EventLog.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Logging.EventLog.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.Logging.EventLog.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Logging.EventLog.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.Logging.EventSource.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Logging.EventSource.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.Logging.EventSource.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Logging.EventSource.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.Logging.Generators.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Logging.Generators.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.Logging.Generators.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Logging.Generators.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.Logging.TraceSource.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Logging.TraceSource.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.Logging.TraceSource.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Logging.TraceSource.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.Logging.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Logging.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.Logging.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Logging.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.Options.Generators.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Options.Generators.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.Options.Generators.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Options.Generators.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.Options.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Options.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.Options.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Options.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Extensions.Primitives.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Primitives.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Extensions.Primitives.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Extensions.Primitives.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Interop.Analyzers.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Interop.Analyzers.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Interop.Analyzers.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Interop.Analyzers.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Interop.JavaScript.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Interop.JavaScript.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Interop.JavaScript.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Interop.JavaScript.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Interop.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Interop.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Interop.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Interop.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.NET.Build.Tasks.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.NET.Build.Tasks.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.NET.Build.Tasks.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.NET.Build.Tasks.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.NETCore.Platforms.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.NETCore.Platforms.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.NETCore.Platforms.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.NETCore.Platforms.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.VisualBasic.CompilerServices.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.VisualBasic.CompilerServices.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.VisualBasic.CompilerServices.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.VisualBasic.CompilerServices.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.VisualBasic.FileIO.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.VisualBasic.FileIO.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.VisualBasic.FileIO.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.VisualBasic.FileIO.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.VisualBasic.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.VisualBasic.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.VisualBasic.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.VisualBasic.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Win32.SafeHandles.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Win32.SafeHandles.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Win32.SafeHandles.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Win32.SafeHandles.model.yml
diff --git a/csharp/ql/lib/ext/generated/Microsoft.Win32.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Win32.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Microsoft.Win32.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Microsoft.Win32.model.yml
diff --git a/csharp/ql/lib/ext/generated/Mono.Linker.Dataflow.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Mono.Linker.Dataflow.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Mono.Linker.Dataflow.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Mono.Linker.Dataflow.model.yml
diff --git a/csharp/ql/lib/ext/generated/Mono.Linker.Steps.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Mono.Linker.Steps.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Mono.Linker.Steps.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Mono.Linker.Steps.model.yml
diff --git a/csharp/ql/lib/ext/generated/Mono.Linker.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/Mono.Linker.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/Mono.Linker.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/Mono.Linker.model.yml
diff --git a/csharp/ql/lib/ext/generated/SourceGenerators.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/SourceGenerators.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/SourceGenerators.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/SourceGenerators.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Buffers.Binary.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Buffers.Binary.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Buffers.Binary.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Buffers.Binary.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Buffers.Text.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Buffers.Text.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Buffers.Text.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Buffers.Text.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Buffers.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Buffers.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Buffers.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Buffers.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.CodeDom.Compiler.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.CodeDom.Compiler.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.CodeDom.Compiler.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.CodeDom.Compiler.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.CodeDom.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.CodeDom.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.CodeDom.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.CodeDom.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Collections.Concurrent.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Collections.Concurrent.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Collections.Concurrent.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Collections.Concurrent.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Collections.Frozen.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Collections.Frozen.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Collections.Frozen.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Collections.Frozen.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Collections.Generic.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Collections.Generic.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Collections.Generic.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Collections.Generic.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Collections.Immutable.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Collections.Immutable.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Collections.Immutable.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Collections.Immutable.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Collections.ObjectModel.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Collections.ObjectModel.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Collections.ObjectModel.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Collections.ObjectModel.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Collections.Specialized.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Collections.Specialized.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Collections.Specialized.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Collections.Specialized.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Collections.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Collections.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Collections.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Collections.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.ComponentModel.Composition.Hosting.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.ComponentModel.Composition.Hosting.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.ComponentModel.Composition.Hosting.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.ComponentModel.Composition.Hosting.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.ComponentModel.Composition.Primitives.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.ComponentModel.Composition.Primitives.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.ComponentModel.Composition.Primitives.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.ComponentModel.Composition.Primitives.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.ComponentModel.Composition.ReflectionModel.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.ComponentModel.Composition.ReflectionModel.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.ComponentModel.Composition.ReflectionModel.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.ComponentModel.Composition.ReflectionModel.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.ComponentModel.Composition.Registration.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.ComponentModel.Composition.Registration.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.ComponentModel.Composition.Registration.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.ComponentModel.Composition.Registration.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.ComponentModel.Composition.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.ComponentModel.Composition.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.ComponentModel.Composition.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.ComponentModel.Composition.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.ComponentModel.DataAnnotations.Schema.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.ComponentModel.DataAnnotations.Schema.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.ComponentModel.DataAnnotations.Schema.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.ComponentModel.DataAnnotations.Schema.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.ComponentModel.DataAnnotations.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.ComponentModel.DataAnnotations.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.ComponentModel.DataAnnotations.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.ComponentModel.DataAnnotations.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.ComponentModel.Design.Serialization.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.ComponentModel.Design.Serialization.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.ComponentModel.Design.Serialization.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.ComponentModel.Design.Serialization.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.ComponentModel.Design.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.ComponentModel.Design.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.ComponentModel.Design.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.ComponentModel.Design.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.ComponentModel.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.ComponentModel.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.ComponentModel.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.ComponentModel.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Composition.Convention.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Composition.Convention.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Composition.Convention.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Composition.Convention.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Composition.Hosting.Core.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Composition.Hosting.Core.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Composition.Hosting.Core.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Composition.Hosting.Core.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Composition.Hosting.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Composition.Hosting.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Composition.Hosting.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Composition.Hosting.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Composition.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Composition.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Composition.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Composition.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Configuration.Internal.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Configuration.Internal.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Configuration.Internal.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Configuration.Internal.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Configuration.Provider.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Configuration.Provider.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Configuration.Provider.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Configuration.Provider.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Configuration.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Configuration.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Configuration.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Configuration.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Data.Common.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Data.Common.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Data.Common.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Data.Common.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Data.Odbc.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Data.Odbc.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Data.Odbc.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Data.Odbc.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Data.OleDb.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Data.OleDb.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Data.OleDb.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Data.OleDb.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Data.OracleClient.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Data.OracleClient.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Data.OracleClient.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Data.OracleClient.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Data.SqlClient.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Data.SqlClient.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Data.SqlClient.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Data.SqlClient.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Data.SqlTypes.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Data.SqlTypes.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Data.SqlTypes.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Data.SqlTypes.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Data.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Data.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Data.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Data.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Diagnostics.CodeAnalysis.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Diagnostics.CodeAnalysis.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Diagnostics.CodeAnalysis.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Diagnostics.CodeAnalysis.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Diagnostics.Contracts.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Diagnostics.Contracts.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Diagnostics.Contracts.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Diagnostics.Contracts.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Diagnostics.Eventing.Reader.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Diagnostics.Eventing.Reader.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Diagnostics.Eventing.Reader.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Diagnostics.Eventing.Reader.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Diagnostics.Metrics.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Diagnostics.Metrics.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Diagnostics.Metrics.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Diagnostics.Metrics.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Diagnostics.PerformanceData.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Diagnostics.PerformanceData.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Diagnostics.PerformanceData.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Diagnostics.PerformanceData.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Diagnostics.SymbolStore.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Diagnostics.SymbolStore.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Diagnostics.SymbolStore.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Diagnostics.SymbolStore.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Diagnostics.Tracing.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Diagnostics.Tracing.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Diagnostics.Tracing.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Diagnostics.Tracing.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Diagnostics.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Diagnostics.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Diagnostics.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Diagnostics.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.DirectoryServices.AccountManagement.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.DirectoryServices.AccountManagement.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.DirectoryServices.AccountManagement.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.DirectoryServices.AccountManagement.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.DirectoryServices.ActiveDirectory.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.DirectoryServices.ActiveDirectory.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.DirectoryServices.ActiveDirectory.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.DirectoryServices.ActiveDirectory.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.DirectoryServices.Protocols.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.DirectoryServices.Protocols.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.DirectoryServices.Protocols.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.DirectoryServices.Protocols.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.DirectoryServices.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.DirectoryServices.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.DirectoryServices.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.DirectoryServices.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Drawing.Printing.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Drawing.Printing.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Drawing.Printing.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Drawing.Printing.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Drawing.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Drawing.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Drawing.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Drawing.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Dynamic.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Dynamic.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Dynamic.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Dynamic.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Formats.Asn1.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Formats.Asn1.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Formats.Asn1.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Formats.Asn1.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Formats.Cbor.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Formats.Cbor.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Formats.Cbor.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Formats.Cbor.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Formats.Nrbf.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Formats.Nrbf.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Formats.Nrbf.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Formats.Nrbf.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Formats.Tar.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Formats.Tar.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Formats.Tar.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Formats.Tar.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Globalization.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Globalization.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Globalization.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Globalization.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.IO.Compression.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.IO.Compression.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.IO.Compression.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.IO.Compression.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.IO.Enumeration.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.IO.Enumeration.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.IO.Enumeration.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.IO.Enumeration.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.IO.Hashing.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.IO.Hashing.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.IO.Hashing.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.IO.Hashing.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.IO.IsolatedStorage.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.IO.IsolatedStorage.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.IO.IsolatedStorage.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.IO.IsolatedStorage.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.IO.MemoryMappedFiles.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.IO.MemoryMappedFiles.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.IO.MemoryMappedFiles.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.IO.MemoryMappedFiles.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.IO.Packaging.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.IO.Packaging.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.IO.Packaging.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.IO.Packaging.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.IO.Pipelines.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.IO.Pipelines.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.IO.Pipelines.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.IO.Pipelines.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.IO.Pipes.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.IO.Pipes.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.IO.Pipes.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.IO.Pipes.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.IO.Ports.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.IO.Ports.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.IO.Ports.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.IO.Ports.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.IO.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.IO.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.IO.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.IO.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Linq.Expressions.Interpreter.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Linq.Expressions.Interpreter.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Linq.Expressions.Interpreter.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Linq.Expressions.Interpreter.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Linq.Expressions.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Linq.Expressions.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Linq.Expressions.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Linq.Expressions.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Linq.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Linq.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Linq.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Linq.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Management.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Management.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Management.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Management.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Media.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Media.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Media.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Media.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Net.Cache.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Net.Cache.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Net.Cache.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Net.Cache.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Net.Http.Headers.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Net.Http.Headers.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Net.Http.Headers.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Net.Http.Headers.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Net.Http.Json.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Net.Http.Json.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Net.Http.Json.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Net.Http.Json.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Net.Http.Metrics.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Net.Http.Metrics.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Net.Http.Metrics.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Net.Http.Metrics.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Net.Http.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Net.Http.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Net.Http.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Net.Http.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Net.Mail.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Net.Mail.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Net.Mail.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Net.Mail.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Net.Mime.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Net.Mime.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Net.Mime.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Net.Mime.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Net.NetworkInformation.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Net.NetworkInformation.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Net.NetworkInformation.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Net.NetworkInformation.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Net.PeerToPeer.Collaboration.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Net.PeerToPeer.Collaboration.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Net.PeerToPeer.Collaboration.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Net.PeerToPeer.Collaboration.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Net.PeerToPeer.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Net.PeerToPeer.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Net.PeerToPeer.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Net.PeerToPeer.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Net.Quic.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Net.Quic.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Net.Quic.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Net.Quic.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Net.Security.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Net.Security.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Net.Security.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Net.Security.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Net.ServerSentEvents.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Net.ServerSentEvents.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Net.ServerSentEvents.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Net.ServerSentEvents.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Net.Sockets.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Net.Sockets.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Net.Sockets.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Net.Sockets.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Net.WebSockets.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Net.WebSockets.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Net.WebSockets.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Net.WebSockets.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Net.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Net.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Net.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Net.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Numerics.Tensors.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Numerics.Tensors.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Numerics.Tensors.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Numerics.Tensors.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Numerics.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Numerics.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Numerics.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Numerics.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Reflection.Context.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Reflection.Context.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Reflection.Context.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Reflection.Context.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Reflection.Emit.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Reflection.Emit.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Reflection.Emit.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Reflection.Emit.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Reflection.Metadata.Ecma335.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Reflection.Metadata.Ecma335.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Reflection.Metadata.Ecma335.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Reflection.Metadata.Ecma335.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Reflection.Metadata.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Reflection.Metadata.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Reflection.Metadata.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Reflection.Metadata.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Reflection.PortableExecutable.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Reflection.PortableExecutable.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Reflection.PortableExecutable.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Reflection.PortableExecutable.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Reflection.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Reflection.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Reflection.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Reflection.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Resources.Extensions.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Resources.Extensions.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Resources.Extensions.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Resources.Extensions.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Resources.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Resources.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Resources.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Resources.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Runtime.Caching.Hosting.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.Caching.Hosting.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Runtime.Caching.Hosting.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.Caching.Hosting.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Runtime.Caching.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.Caching.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Runtime.Caching.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.Caching.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Runtime.CompilerServices.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.CompilerServices.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Runtime.CompilerServices.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.CompilerServices.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Runtime.ConstrainedExecution.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.ConstrainedExecution.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Runtime.ConstrainedExecution.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.ConstrainedExecution.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Runtime.ExceptionServices.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.ExceptionServices.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Runtime.ExceptionServices.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.ExceptionServices.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Runtime.InteropServices.ComTypes.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.InteropServices.ComTypes.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Runtime.InteropServices.ComTypes.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.InteropServices.ComTypes.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Runtime.InteropServices.Java.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.InteropServices.Java.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Runtime.InteropServices.Java.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.InteropServices.Java.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Runtime.InteropServices.JavaScript.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.InteropServices.JavaScript.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Runtime.InteropServices.JavaScript.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.InteropServices.JavaScript.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Runtime.InteropServices.Marshalling.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.InteropServices.Marshalling.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Runtime.InteropServices.Marshalling.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.InteropServices.Marshalling.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Runtime.InteropServices.ObjectiveC.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.InteropServices.ObjectiveC.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Runtime.InteropServices.ObjectiveC.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.InteropServices.ObjectiveC.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Runtime.InteropServices.Swift.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.InteropServices.Swift.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Runtime.InteropServices.Swift.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.InteropServices.Swift.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Runtime.InteropServices.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.InteropServices.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Runtime.InteropServices.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.InteropServices.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Runtime.Intrinsics.Arm.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.Intrinsics.Arm.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Runtime.Intrinsics.Arm.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.Intrinsics.Arm.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Runtime.Intrinsics.Wasm.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.Intrinsics.Wasm.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Runtime.Intrinsics.Wasm.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.Intrinsics.Wasm.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Runtime.Intrinsics.X86.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.Intrinsics.X86.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Runtime.Intrinsics.X86.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.Intrinsics.X86.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Runtime.Intrinsics.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.Intrinsics.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Runtime.Intrinsics.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.Intrinsics.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Runtime.Loader.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.Loader.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Runtime.Loader.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.Loader.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Runtime.Remoting.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.Remoting.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Runtime.Remoting.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.Remoting.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Runtime.Serialization.DataContracts.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.Serialization.DataContracts.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Runtime.Serialization.DataContracts.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.Serialization.DataContracts.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Runtime.Serialization.Formatters.Binary.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.Serialization.Formatters.Binary.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Runtime.Serialization.Formatters.Binary.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.Serialization.Formatters.Binary.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Runtime.Serialization.Json.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.Serialization.Json.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Runtime.Serialization.Json.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.Serialization.Json.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Runtime.Serialization.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.Serialization.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Runtime.Serialization.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.Serialization.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Runtime.Versioning.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.Versioning.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Runtime.Versioning.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.Versioning.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Runtime.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Runtime.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Runtime.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Security.AccessControl.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Security.AccessControl.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Security.AccessControl.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Security.AccessControl.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Security.Authentication.ExtendedProtection.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Security.Authentication.ExtendedProtection.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Security.Authentication.ExtendedProtection.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Security.Authentication.ExtendedProtection.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Security.Authentication.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Security.Authentication.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Security.Authentication.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Security.Authentication.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Security.Claims.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Security.Claims.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Security.Claims.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Security.Claims.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Security.Cryptography.Cose.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Security.Cryptography.Cose.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Security.Cryptography.Cose.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Security.Cryptography.Cose.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Security.Cryptography.Pkcs.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Security.Cryptography.Pkcs.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Security.Cryptography.Pkcs.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Security.Cryptography.Pkcs.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Security.Cryptography.X509Certificates.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Security.Cryptography.X509Certificates.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Security.Cryptography.X509Certificates.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Security.Cryptography.X509Certificates.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Security.Cryptography.Xml.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Security.Cryptography.Xml.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Security.Cryptography.Xml.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Security.Cryptography.Xml.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Security.Cryptography.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Security.Cryptography.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Security.Cryptography.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Security.Cryptography.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Security.Permissions.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Security.Permissions.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Security.Permissions.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Security.Permissions.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Security.Policy.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Security.Policy.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Security.Policy.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Security.Policy.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Security.Principal.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Security.Principal.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Security.Principal.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Security.Principal.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Security.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Security.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Security.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Security.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.ServiceModel.Syndication.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.ServiceModel.Syndication.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.ServiceModel.Syndication.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.ServiceModel.Syndication.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.ServiceProcess.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.ServiceProcess.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.ServiceProcess.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.ServiceProcess.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Speech.AudioFormat.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Speech.AudioFormat.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Speech.AudioFormat.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Speech.AudioFormat.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Speech.Recognition.SrgsGrammar.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Speech.Recognition.SrgsGrammar.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Speech.Recognition.SrgsGrammar.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Speech.Recognition.SrgsGrammar.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Speech.Recognition.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Speech.Recognition.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Speech.Recognition.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Speech.Recognition.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Speech.Synthesis.TtsEngine.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Speech.Synthesis.TtsEngine.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Speech.Synthesis.TtsEngine.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Speech.Synthesis.TtsEngine.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Speech.Synthesis.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Speech.Synthesis.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Speech.Synthesis.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Speech.Synthesis.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Text.Encodings.Web.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Text.Encodings.Web.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Text.Encodings.Web.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Text.Encodings.Web.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Text.Json.Nodes.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Text.Json.Nodes.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Text.Json.Nodes.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Text.Json.Nodes.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Text.Json.Schema.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Text.Json.Schema.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Text.Json.Schema.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Text.Json.Schema.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Text.Json.Serialization.Metadata.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Text.Json.Serialization.Metadata.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Text.Json.Serialization.Metadata.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Text.Json.Serialization.Metadata.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Text.Json.Serialization.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Text.Json.Serialization.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Text.Json.Serialization.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Text.Json.Serialization.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Text.Json.SourceGeneration.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Text.Json.SourceGeneration.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Text.Json.SourceGeneration.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Text.Json.SourceGeneration.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Text.Json.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Text.Json.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Text.Json.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Text.Json.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Text.RegularExpressions.Generator.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Text.RegularExpressions.Generator.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Text.RegularExpressions.Generator.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Text.RegularExpressions.Generator.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Text.RegularExpressions.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Text.RegularExpressions.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Text.RegularExpressions.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Text.RegularExpressions.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Text.Unicode.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Text.Unicode.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Text.Unicode.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Text.Unicode.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Text.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Text.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Text.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Text.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Threading.Channels.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Threading.Channels.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Threading.Channels.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Threading.Channels.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Threading.RateLimiting.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Threading.RateLimiting.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Threading.RateLimiting.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Threading.RateLimiting.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Threading.Tasks.Dataflow.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Threading.Tasks.Dataflow.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Threading.Tasks.Dataflow.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Threading.Tasks.Dataflow.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Threading.Tasks.Sources.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Threading.Tasks.Sources.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Threading.Tasks.Sources.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Threading.Tasks.Sources.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Threading.Tasks.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Threading.Tasks.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Threading.Tasks.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Threading.Tasks.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Threading.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Threading.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Threading.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Threading.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Timers.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Timers.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Timers.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Timers.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Transactions.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Transactions.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Transactions.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Transactions.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Web.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Web.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Web.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Web.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Windows.Input.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Windows.Input.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Windows.Input.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Windows.Input.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Windows.Markup.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Windows.Markup.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Windows.Markup.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Windows.Markup.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Xaml.Permissions.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Xaml.Permissions.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Xaml.Permissions.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Xaml.Permissions.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Xml.Linq.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Xml.Linq.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Xml.Linq.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Xml.Linq.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Xml.Resolvers.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Xml.Resolvers.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Xml.Resolvers.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Xml.Resolvers.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Xml.Schema.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Xml.Schema.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Xml.Schema.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Xml.Schema.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Xml.Serialization.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Xml.Serialization.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Xml.Serialization.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Xml.Serialization.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Xml.XPath.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Xml.XPath.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Xml.XPath.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Xml.XPath.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Xml.Xsl.Runtime.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Xml.Xsl.Runtime.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Xml.Xsl.Runtime.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Xml.Xsl.Runtime.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Xml.Xsl.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Xml.Xsl.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Xml.Xsl.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Xml.Xsl.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.Xml.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.Xml.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.Xml.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.Xml.model.yml
diff --git a/csharp/ql/lib/ext/generated/System.model.yml b/csharp/ql/lib/ext/generated/modelgenerator/System.model.yml
similarity index 100%
rename from csharp/ql/lib/ext/generated/System.model.yml
rename to csharp/ql/lib/ext/generated/modelgenerator/System.model.yml
diff --git a/csharp/ql/lib/printCfg.ql b/csharp/ql/lib/printCfg.ql
index aa92b1192042..c9910428bb09 100644
--- a/csharp/ql/lib/printCfg.ql
+++ b/csharp/ql/lib/printCfg.ql
@@ -7,7 +7,8 @@
* @tags ide-contextual-queries/print-cfg
*/
-private import semmle.code.csharp.controlflow.internal.ControlFlowGraphImpl
+import csharp
+import semmle.code.csharp.controlflow.internal.ControlFlowGraph
external string selectedSourceFile();
@@ -21,7 +22,9 @@ external int selectedSourceColumn();
private predicate selectedSourceColumnAlias = selectedSourceColumn/0;
-module ViewCfgQueryInput implements ViewCfgQueryInputSig {
+module ViewCfgQueryInput implements ControlFlow::ViewCfgQueryInputSig {
+ private import semmle.code.csharp.controlflow.ControlFlowGraph
+
predicate selectedSourceFile = selectedSourceFileAlias/0;
predicate selectedSourceLine = selectedSourceLineAlias/0;
@@ -29,7 +32,7 @@ module ViewCfgQueryInput implements ViewCfgQueryInputSig {
predicate selectedSourceColumn = selectedSourceColumnAlias/0;
predicate cfgScopeSpan(
- CfgScope scope, File file, int startLine, int startColumn, int endLine, int endColumn
+ Ast::Callable scope, File file, int startLine, int startColumn, int endLine, int endColumn
) {
file = scope.getFile() and
scope.getLocation().getStartLine() = startLine and
@@ -40,11 +43,20 @@ module ViewCfgQueryInput implements ViewCfgQueryInputSig {
|
loc = scope.(Callable).getBody().getLocation()
or
- loc = scope.(Field).getInitializer().getLocation()
+ loc = any(AssignExpr init | scope.(ObjectInitMethod).initializes(init)).getLocation()
or
- loc = scope.(Property).getInitializer().getLocation()
+ exists(AssignableMember a, Constructor ctor |
+ scope = ctor and
+ ctor.isStatic() and
+ a.isStatic() and
+ a.getDeclaringType() = ctor.getDeclaringType()
+ |
+ loc = a.(Field).getInitializer().getLocation()
+ or
+ loc = a.(Property).getInitializer().getLocation()
+ )
)
}
}
-import ViewCfgQuery
+import ControlFlow::ViewCfgQuery
diff --git a/csharp/ql/lib/qlpack.yml b/csharp/ql/lib/qlpack.yml
index 193da19b5530..278508f5f948 100644
--- a/csharp/ql/lib/qlpack.yml
+++ b/csharp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-all
-version: 5.4.12
+version: 6.0.1
groups: csharp
dbscheme: semmlecode.csharp.dbscheme
extractor: csharp
@@ -17,6 +17,6 @@ dependencies:
codeql/xml: ${workspace}
dataExtensions:
- ext/*.model.yml
- - ext/generated/*.model.yml
+ - ext/generated/**/*.model.yml
warnOnImplicitThis: true
compileForOverlayEval: true
diff --git a/csharp/ql/lib/semmle/code/csharp/Assignable.qll b/csharp/ql/lib/semmle/code/csharp/Assignable.qll
index a0e575218adc..7bd432d48ce4 100644
--- a/csharp/ql/lib/semmle/code/csharp/Assignable.qll
+++ b/csharp/ql/lib/semmle/code/csharp/Assignable.qll
@@ -85,8 +85,8 @@ class AssignableRead extends AssignableAccess {
}
pragma[noinline]
- private ControlFlow::Node getAnAdjacentReadSameVar() {
- SsaImpl::adjacentReadPairSameVar(_, this.getAControlFlowNode(), result)
+ private ControlFlowNode getAnAdjacentReadSameVar() {
+ SsaImpl::adjacentReadPairSameVar(_, this.getControlFlowNode(), result)
}
/**
@@ -114,11 +114,7 @@ class AssignableRead extends AssignableAccess {
* - The read of `this.Field` on line 11 is next to the read on line 10.
*/
pragma[nomagic]
- AssignableRead getANextRead() {
- forex(ControlFlow::Node cfn | cfn = result.getAControlFlowNode() |
- cfn = this.getAnAdjacentReadSameVar()
- )
- }
+ AssignableRead getANextRead() { result.getControlFlowNode() = this.getAnAdjacentReadSameVar() }
}
/**
@@ -235,7 +231,7 @@ private class RefArg extends AssignableAccess {
module AssignableInternal {
private predicate tupleAssignmentDefinition(AssignExpr ae, Expr leaf) {
exists(TupleExpr te |
- ae.getLValue() = te and
+ ae.getLeftOperand() = te and
te.getAnArgument+() = leaf and
// `leaf` is either an assignable access or a local variable declaration
not leaf instanceof TupleExpr
@@ -249,8 +245,8 @@ module AssignableInternal {
*/
private predicate tupleAssignmentPair(AssignExpr ae, Expr left, Expr right) {
tupleAssignmentDefinition(ae, _) and
- left = ae.getLValue() and
- right = ae.getRValue()
+ left = ae.getLeftOperand() and
+ right = ae.getRightOperand()
or
exists(TupleExpr l, TupleExpr r, int i | tupleAssignmentPair(ae, l, r) |
left = l.getArgument(i) and
@@ -275,6 +271,8 @@ module AssignableInternal {
def = TPatternDefinition(result)
or
def = TAssignOperationDefinition(result)
+ or
+ def = TParameterDefaultDefinition(_, result)
}
/** A local variable declaration at the top-level of a pattern. */
@@ -291,7 +289,7 @@ module AssignableInternal {
cached
newtype TAssignableDefinition =
TAssignmentDefinition(Assignment a) {
- not a.getLValue() instanceof TupleExpr and
+ not a.getLeftOperand() instanceof TupleExpr and
not a instanceof AssignCallOperation and
not a instanceof AssignCoalesceExpr
} or
@@ -312,14 +310,22 @@ module AssignableInternal {
exists(Callable c | p = c.getAParameter() |
c.hasBody()
or
- // Same as `c.(Constructor).hasInitializer()`, but avoids negative recursion warning
- c.getAChildExpr() instanceof @constructor_init_expr
+ c.(Constructor).hasInitializer()
)
} or
+ TParameterDefaultDefinition(Parameter p, Expr default) {
+ exists(Callable c | p = c.getAParameter() |
+ c.hasBody()
+ or
+ c.(Constructor).hasInitializer()
+ ) and
+ default = p.getDefaultValue()
+ } or
TAddressOfDefinition(AddressOfExpr aoe) or
TPatternDefinition(TopLevelPatternDecl tlpd) or
TAssignOperationDefinition(AssignOperation ao) {
- ao instanceof AssignCallOperation or
+ ao instanceof AssignCallOperation and not ao instanceof CompoundAssignmentOperatorCall
+ or
ao instanceof AssignCoalesceExpr
}
@@ -353,12 +359,14 @@ module AssignableInternal {
any(AssignableDefinitions::PatternDefinition pd | result = pd.getDeclaration().getVariable())
or
def = any(AssignableDefinitions::InitializerDefinition init | result = init.getAssignable())
+ or
+ def = TParameterDefaultDefinition(result, _)
}
// Not defined by dispatch in order to avoid too conservative negative recursion error
cached
AssignableAccess getTargetAccess(AssignableDefinition def) {
- def = TAssignmentDefinition(any(Assignment a | a.getLValue() = result))
+ def = TAssignmentDefinition(any(Assignment a | a.getLeftOperand() = result))
or
def = TTupleAssignmentDefinition(_, result)
or
@@ -381,8 +389,8 @@ module AssignableInternal {
tupleAssignmentPair(ae, ac, result)
)
or
- exists(Assignment ass | ac = ass.getLValue() |
- result = ass.getRValue() and
+ exists(Assignment ass | ac = ass.getLeftOperand() |
+ result = ass.getRightOperand() and
not ass instanceof AssignOperation
)
or
@@ -410,7 +418,7 @@ private import AssignableInternal
*/
class AssignableDefinition extends TAssignableDefinition {
/**
- * DEPRECATED: Use `this.getExpr().getAControlFlowNode()` instead.
+ * DEPRECATED: Use `this.getExpr().getControlFlowNode()` instead.
*
* Gets a control flow node that updates the targeted assignable when
* reached.
@@ -419,9 +427,7 @@ class AssignableDefinition extends TAssignableDefinition {
* the definitions of `x` and `y` in `M(out x, out y)` and `(x, y) = (0, 1)`
* relate to the same call to `M` and assignment node, respectively.
*/
- deprecated ControlFlow::Node getAControlFlowNode() {
- result = this.getExpr().getAControlFlowNode()
- }
+ deprecated ControlFlowNode getAControlFlowNode() { result = this.getExpr().getControlFlowNode() }
/**
* Gets the underlying expression that updates the targeted assignable when
@@ -494,16 +500,7 @@ class AssignableDefinition extends TAssignableDefinition {
*/
pragma[nomagic]
AssignableRead getAFirstRead() {
- forex(ControlFlow::Node cfn | cfn = result.getAControlFlowNode() |
- exists(Ssa::ExplicitDefinition def | result = def.getAFirstReadAtNode(cfn) |
- this = def.getADefinition()
- )
- or
- exists(Ssa::ImplicitParameterDefinition def | result = def.getAFirstReadAtNode(cfn) |
- this.(AssignableDefinitions::ImplicitParameterDefinition).getParameter() =
- def.getParameter()
- )
- )
+ exists(SsaExplicitWrite def | result = Ssa::ssaGetAFirstUse(def) | this = def.getDefinition())
}
/** Gets a textual representation of this assignable definition. */
@@ -527,7 +524,7 @@ module AssignableDefinitions {
Assignment getAssignment() { result = a }
override Expr getSource() {
- result = a.getRValue() and
+ result = a.getRightOperand() and
not a instanceof AddOrRemoveEventExpr
}
@@ -572,11 +569,9 @@ module AssignableDefinitions {
}
/** Holds if a node in basic block `bb` assigns to `ref` parameter `p` via definition `def`. */
- private predicate basicBlockRefParamDef(
- ControlFlow::BasicBlock bb, Parameter p, AssignableDefinition def
- ) {
+ private predicate basicBlockRefParamDef(BasicBlock bb, Parameter p, AssignableDefinition def) {
def = any(RefArg arg).getAnAnalyzableRefDef(p) and
- bb.getANode() = def.getExpr().getAControlFlowNode()
+ bb.getANode() = def.getExpr().getControlFlowNode()
}
/**
@@ -585,7 +580,7 @@ module AssignableDefinitions {
* any assignments to `p`.
*/
pragma[nomagic]
- private predicate parameterReachesWithoutDef(Parameter p, ControlFlow::BasicBlock bb) {
+ private predicate parameterReachesWithoutDef(Parameter p, BasicBlock bb) {
forall(AssignableDefinition def | basicBlockRefParamDef(bb, p, def) |
isUncertainRefCall(def.getTargetAccess())
) and
@@ -593,9 +588,7 @@ module AssignableDefinitions {
any(RefArg arg).isAnalyzable(p) and
p.getCallable().getEntryPoint() = bb.getFirstNode()
or
- exists(ControlFlow::BasicBlock mid | parameterReachesWithoutDef(p, mid) |
- bb = mid.getASuccessor()
- )
+ exists(BasicBlock mid | parameterReachesWithoutDef(p, mid) | bb = mid.getASuccessor())
)
}
@@ -607,7 +600,7 @@ module AssignableDefinitions {
cached
predicate isUncertainRefCall(RefArg arg) {
arg.isPotentialAssignment() and
- exists(ControlFlow::BasicBlock bb, Parameter p | arg.isAnalyzable(p) |
+ exists(BasicBlock bb, Parameter p | arg.isAnalyzable(p) |
parameterReachesWithoutDef(p, bb) and
bb.getLastNode() = p.getCallable().getExitPoint()
)
@@ -688,7 +681,7 @@ module AssignableDefinitions {
/** Gets the underlying parameter. */
Parameter getParameter() { result = p }
- deprecated override ControlFlow::Node getAControlFlowNode() {
+ deprecated override ControlFlowNode getAControlFlowNode() {
result = p.getCallable().getEntryPoint()
}
@@ -698,7 +691,33 @@ module AssignableDefinitions {
override string toString() { result = p.toString() }
- override Location getLocation() { result = this.getTarget().getLocation() }
+ override Location getLocation() { result = p.getLocation() }
+ }
+
+ /**
+ * A default value assigned to a parameter.
+ */
+ class ParameterDefaultDefinition extends AssignableDefinition, TParameterDefaultDefinition {
+ Parameter p;
+ Expr default;
+
+ ParameterDefaultDefinition() { this = TParameterDefaultDefinition(p, default) }
+
+ /** Gets the underlying parameter. */
+ Parameter getParameter() { result = p }
+
+ /** Gets the default value expression for the parameter. */
+ Expr getDefaultValue() { result = default }
+
+ override Expr getSource() { result = default }
+
+ override Expr getElement() { result = default }
+
+ override Callable getEnclosingCallable() { result = p.getCallable() }
+
+ override string toString() { result = p.toString() + " = ..." }
+
+ override Location getLocation() { result = default.getLocation() }
}
/**
diff --git a/csharp/ql/lib/semmle/code/csharp/Caching.qll b/csharp/ql/lib/semmle/code/csharp/Caching.qll
index bbe310fe69e5..134332ee75de 100644
--- a/csharp/ql/lib/semmle/code/csharp/Caching.qll
+++ b/csharp/ql/lib/semmle/code/csharp/Caching.qll
@@ -7,23 +7,6 @@ private import csharp
* in the same stage across different files.
*/
module Stages {
- cached
- module ControlFlowStage {
- private import semmle.code.csharp.controlflow.internal.Splitting
-
- cached
- predicate forceCachingInSameStage() { any() }
-
- cached
- private predicate forceCachingInSameStageRev() {
- exists(Split s)
- or
- exists(ControlFlow::Node n)
- or
- forceCachingInSameStageRev()
- }
- }
-
cached
module GuardsStage {
private import semmle.code.csharp.controlflow.Guards
diff --git a/csharp/ql/lib/semmle/code/csharp/Callable.qll b/csharp/ql/lib/semmle/code/csharp/Callable.qll
index 611b578b859a..9416a7d4d9c7 100644
--- a/csharp/ql/lib/semmle/code/csharp/Callable.qll
+++ b/csharp/ql/lib/semmle/code/csharp/Callable.qll
@@ -22,7 +22,7 @@ private import TypeRef
* an anonymous function (`AnonymousFunctionExpr`), or a local function
* (`LocalFunction`).
*/
-class Callable extends Parameterizable, ExprOrStmtParent, @callable {
+class Callable extends Parameterizable, ControlFlowElementOrCallable, @callable {
/** Gets the return type of this callable. */
Type getReturnType() { none() }
@@ -157,10 +157,10 @@ class Callable extends Parameterizable, ExprOrStmtParent, @callable {
final predicate hasExpressionBody() { exists(this.getExpressionBody()) }
/** Gets the entry point in the control graph for this callable. */
- ControlFlow::Nodes::EntryNode getEntryPoint() { result.getCallable() = this }
+ ControlFlow::EntryNode getEntryPoint() { result.getEnclosingCallable() = this }
/** Gets the exit point in the control graph for this callable. */
- ControlFlow::Nodes::ExitNode getExitPoint() { result.getCallable() = this }
+ ControlFlow::ExitNode getExitPoint() { result.getEnclosingCallable() = this }
/**
* Gets the enclosing callable of this callable, if any.
@@ -611,7 +611,8 @@ class ExtensionOperator extends ExtensionCallableImpl, Operator {
class UnaryOperator extends Operator {
UnaryOperator() {
this.getNumberOfParameters() = 1 and
- not this instanceof ConversionOperator
+ not this instanceof ConversionOperator and
+ not this instanceof CompoundAssignmentOperator
}
}
@@ -784,7 +785,7 @@ class TrueOperator extends UnaryOperator {
* A user-defined binary operator.
*
* Either an addition operator (`AddOperator`), a checked addition operator
- * (`CheckedAddOperator`) a subtraction operator (`SubOperator`), a checked
+ * (`CheckedAddOperator`), a subtraction operator (`SubOperator`), a checked
* subtraction operator (`CheckedSubOperator`), a multiplication operator
* (`MulOperator`), a checked multiplication operator (`CheckedMulOperator`),
* a division operator (`DivOperator`), a checked division operator
@@ -795,10 +796,16 @@ class TrueOperator extends UnaryOperator {
* operator(`UnsignedRightShiftOperator`), an equals operator (`EQOperator`),
* a not equals operator (`NEOperator`), a lesser than operator (`LTOperator`),
* a greater than operator (`GTOperator`), a less than or equals operator
- * (`LEOperator`), or a greater than or equals operator (`GEOperator`).
+ * (`LEOperator`), a greater than or equals operator (`GEOperator`), or
+ * a compound assignment operator (`CompoundAssignmentOperator`).
*/
class BinaryOperator extends Operator {
- BinaryOperator() { this.getNumberOfParameters() = 2 }
+ BinaryOperator() {
+ this.getNumberOfParameters() = 2
+ or
+ // Instance compound assignment operators only have one parameter.
+ this.getNumberOfParameters() = 1 and not this.isStatic()
+ }
}
/**
@@ -1184,6 +1191,249 @@ class CheckedExplicitConversionOperator extends ConversionOperator {
override string getAPrimaryQlClass() { result = "CheckedExplicitConversionOperator" }
}
+abstract private class CompoundAssignmentOperatorImpl extends BinaryOperator { }
+
+/**
+ * A user-defined compound assignment operator.
+ *
+ * Either an addition operator (`AddCompoundAssignmentOperator`), a checked addition operator
+ * (`CheckedAddCompoundAssignmentOperator`), a subtraction operator (`SubCompoundAssignmentOperator`), a checked
+ * subtraction operator (`CheckedSubCompoundAssignmentOperator`), a multiplication operator
+ * (`MulCompoundAssignmentOperator`), a checked multiplication operator (`CheckedMulCompoundAssignmentOperator`),
+ * a division operator (`DivCompoundAssignmentOperator`), a checked division operator
+ * (`CheckedDivCompoundAssignmentOperator`), a remainder operator (`RemCompoundAssignmentOperator`), an and
+ * operator (`AndCompoundAssignmentOperator`), an or operator (`OrCompoundAssignmentOperator`), an xor
+ * operator (`XorCompoundAssignmentOperator`), a left shift operator (`LeftShiftCompoundAssignmentOperator`),
+ * a right shift operator (`RightShiftCompoundAssignmentOperator`), or an unsigned right shift
+ * operator(`UnsignedRightShiftCompoundAssignmentOperator`).
+ */
+final class CompoundAssignmentOperator = CompoundAssignmentOperatorImpl;
+
+/**
+ * A user-defined compound assignment addition operator (`+=`), for example
+ *
+ * ```csharp
+ * public void operator checked +=(Widget w) {
+ * ...
+ * }
+ * ```
+ */
+class AddCompoundAssignmentOperator extends CompoundAssignmentOperatorImpl {
+ AddCompoundAssignmentOperator() { this.getName() = "+=" }
+
+ override string getAPrimaryQlClass() { result = "AddCompoundAssignmentOperator" }
+}
+
+/**
+ * A user-defined checked compound assignment addition operator (`checked +=`), for example
+ *
+ * ```csharp
+ * public void operator checked +=(Widget w) {
+ * ...
+ * }
+ * ```
+ */
+class CheckedAddCompoundAssignmentOperator extends CompoundAssignmentOperatorImpl {
+ CheckedAddCompoundAssignmentOperator() { this.getName() = "checked +=" }
+
+ override string getAPrimaryQlClass() { result = "CheckedAddCompoundAssignmentOperator" }
+}
+
+/**
+ * A user-defined compound assignment subtraction operator (`-=`), for example
+ *
+ * ```csharp
+ * public void operator -=(Widget w) {
+ * ...
+ * }
+ * ```
+ */
+class SubCompoundAssignmentOperator extends CompoundAssignmentOperatorImpl {
+ SubCompoundAssignmentOperator() { this.getName() = "-=" }
+
+ override string getAPrimaryQlClass() { result = "SubCompoundAssignmentOperator" }
+}
+
+/**
+ * A user-defined checked compound assignment subtraction operator (`checked -=`), for example
+ *
+ * ```csharp
+ * public void operator checked -=(Widget w) {
+ * ...
+ * }
+ * ```
+ */
+class CheckedSubCompoundAssignmentOperator extends CompoundAssignmentOperatorImpl {
+ CheckedSubCompoundAssignmentOperator() { this.getName() = "checked -=" }
+
+ override string getAPrimaryQlClass() { result = "CheckedSubCompoundAssignmentOperator" }
+}
+
+/**
+ * A user-defined compound assignment multiplication operator (`*=`), for example
+ *
+ * ```csharp
+ * public void operator *=(Widget w) {
+ * ...
+ * }
+ * ```
+ */
+class MulCompoundAssignmentOperator extends CompoundAssignmentOperatorImpl {
+ MulCompoundAssignmentOperator() { this.getName() = "*=" }
+
+ override string getAPrimaryQlClass() { result = "MulCompoundAssignmentOperator" }
+}
+
+/**
+ * A user-defined checked compound assignment multiplication operator (`checked *=`), for example
+ *
+ * ```csharp
+ * public void operator checked *=(Widget w) {
+ * ...
+ * }
+ * ```
+ */
+class CheckedMulCompoundAssignmentOperator extends CompoundAssignmentOperatorImpl {
+ CheckedMulCompoundAssignmentOperator() { this.getName() = "checked *=" }
+
+ override string getAPrimaryQlClass() { result = "CheckedMulCompoundAssignmentOperator" }
+}
+
+/**
+ * A user-defined compound assignment division operator (`/=`), for example
+ *
+ * ```csharp
+ * public void operator /=(Widget w) {
+ * ...
+ * }
+ * ```
+ */
+class DivCompoundAssignmentOperator extends CompoundAssignmentOperatorImpl {
+ DivCompoundAssignmentOperator() { this.getName() = "/=" }
+
+ override string getAPrimaryQlClass() { result = "DivCompoundAssignmentOperator" }
+}
+
+/**
+ * A user-defined checked compound assignment division operator (`checked /=`), for example
+ *
+ * ```csharp
+ * public void operator checked /=(Widget w) {
+ * ...
+ * }
+ * ```
+ */
+class CheckedDivCompoundAssignmentOperator extends CompoundAssignmentOperatorImpl {
+ CheckedDivCompoundAssignmentOperator() { this.getName() = "checked /=" }
+
+ override string getAPrimaryQlClass() { result = "CheckedDivCompoundAssignmentOperator" }
+}
+
+/**
+ * A user-defined compound assignment remainder operator (`%=`), for example
+ *
+ * ```csharp
+ * public void operator %=(Widget w) {
+ * ...
+ * }
+ * ```
+ */
+class RemCompoundAssignmentOperator extends CompoundAssignmentOperatorImpl {
+ RemCompoundAssignmentOperator() { this.getName() = "%=" }
+
+ override string getAPrimaryQlClass() { result = "RemCompoundAssignmentOperator" }
+}
+
+/**
+ * A user-defined compound assignment and operator (`&=`), for example
+ *
+ * ```csharp
+ * public void operator &=(Widget w) {
+ * ...
+ * }
+ * ```
+ */
+class AndCompoundAssignmentOperator extends CompoundAssignmentOperatorImpl {
+ AndCompoundAssignmentOperator() { this.getName() = "&=" }
+
+ override string getAPrimaryQlClass() { result = "AndCompoundAssignmentOperator" }
+}
+
+/**
+ * A user-defined compound assignment or operator (`|=`), for example
+ *
+ * ```csharp
+ * public void operator |=(Widget w) {
+ * ...
+ * }
+ * ```
+ */
+class OrCompoundAssignmentOperator extends CompoundAssignmentOperatorImpl {
+ OrCompoundAssignmentOperator() { this.getName() = "|=" }
+
+ override string getAPrimaryQlClass() { result = "OrCompoundAssignmentOperator" }
+}
+
+/**
+ * A user-defined compound assignment xor operator (`^=`), for example
+ *
+ * ```csharp
+ * public void operator ^=(Widget w) {
+ * ...
+ * }
+ * ```
+ */
+class XorCompoundAssignmentOperator extends CompoundAssignmentOperatorImpl {
+ XorCompoundAssignmentOperator() { this.getName() = "^=" }
+
+ override string getAPrimaryQlClass() { result = "XorCompoundAssignmentOperator" }
+}
+
+/**
+ * A user-defined compound assignment left shift operator (`<<=`), for example
+ *
+ * ```csharp
+ * public void operator <<=(Widget w) {
+ * ...
+ * }
+ * ```
+ */
+class LeftShiftCompoundAssignmentOperator extends CompoundAssignmentOperatorImpl {
+ LeftShiftCompoundAssignmentOperator() { this.getName() = "<<=" }
+
+ override string getAPrimaryQlClass() { result = "LeftShiftCompoundAssignmentOperator" }
+}
+
+/**
+ * A user-defined compound assignment right shift operator (`>>=`), for example
+ *
+ * ```csharp
+ * public void operator >>=(Widget w) {
+ * ...
+ * }
+ * ```
+ */
+class RightShiftCompoundAssignmentOperator extends CompoundAssignmentOperatorImpl {
+ RightShiftCompoundAssignmentOperator() { this.getName() = ">>=" }
+
+ override string getAPrimaryQlClass() { result = "RightShiftCompoundAssignmentOperator" }
+}
+
+/**
+ * A user-defined compound assignment unsigned right shift operator (`>>>=`), for example
+ *
+ * ```csharp
+ * public void operator >>>=(Widget w) {
+ * ...
+ * }
+ * ```
+ */
+class UnsignedRightShiftCompoundAssignmentOperator extends CompoundAssignmentOperatorImpl {
+ UnsignedRightShiftCompoundAssignmentOperator() { this.getName() = ">>>=" }
+
+ override string getAPrimaryQlClass() { result = "UnsignedRightShiftCompoundAssignmentOperator" }
+}
+
/**
* A local function, defined within the scope of another callable.
* For example, `Fac` on lines 2--4 in
diff --git a/csharp/ql/lib/semmle/code/csharp/Conversion.qll b/csharp/ql/lib/semmle/code/csharp/Conversion.qll
index ec7ef9cac952..e151944dc381 100644
--- a/csharp/ql/lib/semmle/code/csharp/Conversion.qll
+++ b/csharp/ql/lib/semmle/code/csharp/Conversion.qll
@@ -232,14 +232,9 @@ private module Identity {
*/
pragma[nomagic]
private predicate convTypeArguments(Type fromTypeArgument, Type toTypeArgument, int i) {
- exists(int j |
- fromTypeArgument = getTypeArgumentRanked(_, _, i) and
- toTypeArgument = getTypeArgumentRanked(_, _, j) and
- i <= j and
- j <= i
- |
- convIdentity(fromTypeArgument, toTypeArgument)
- )
+ fromTypeArgument = getTypeArgumentRanked(_, _, pragma[only_bind_into](i)) and
+ toTypeArgument = getTypeArgumentRanked(_, _, pragma[only_bind_into](i)) and
+ convIdentity(fromTypeArgument, toTypeArgument)
}
pragma[nomagic]
@@ -718,7 +713,7 @@ private class SignedIntegralConstantExpr extends Expr {
}
private predicate convConstantIntExpr(SignedIntegralConstantExpr e, SimpleType toType) {
- exists(int n | n = e.getValue().toInt() |
+ exists(int n | n = e.getIntValue() |
toType = any(SByteType t | n in [t.minValue() .. t.maxValue()])
or
toType = any(ByteType t | n in [t.minValue() .. t.maxValue()])
@@ -735,7 +730,7 @@ private predicate convConstantIntExpr(SignedIntegralConstantExpr e, SimpleType t
private predicate convConstantLongExpr(SignedIntegralConstantExpr e) {
e.getType() instanceof LongType and
- e.getValue().toInt() >= 0
+ e.getIntValue() >= 0
}
/** 6.1.10: Implicit reference conversions involving type parameters. */
@@ -929,19 +924,16 @@ private module Variance {
private predicate convTypeArguments(
TypeArgument fromTypeArgument, TypeArgument toTypeArgument, int i, TVariance v
) {
- exists(int j |
- fromTypeArgument = getTypeArgumentRanked(_, _, i, _) and
- toTypeArgument = getTypeArgumentRanked(_, _, j, _) and
- i <= j and
- j <= i
- |
+ fromTypeArgument = getTypeArgumentRanked(_, _, pragma[only_bind_into](i), _) and
+ toTypeArgument = getTypeArgumentRanked(_, _, pragma[only_bind_into](i), _) and
+ (
convIdentity(fromTypeArgument, toTypeArgument) and
v = TNone()
or
- convRefTypeTypeArgumentOut(fromTypeArgument, toTypeArgument, j) and
+ convRefTypeTypeArgumentOut(fromTypeArgument, toTypeArgument, i) and
v = TOut()
or
- convRefTypeTypeArgumentIn(toTypeArgument, fromTypeArgument, j) and
+ convRefTypeTypeArgumentIn(toTypeArgument, fromTypeArgument, i) and
v = TIn()
)
}
diff --git a/csharp/ql/lib/semmle/code/csharp/ExprOrStmtParent.qll b/csharp/ql/lib/semmle/code/csharp/ExprOrStmtParent.qll
index 8102b4a02880..2cf09707459d 100644
--- a/csharp/ql/lib/semmle/code/csharp/ExprOrStmtParent.qll
+++ b/csharp/ql/lib/semmle/code/csharp/ExprOrStmtParent.qll
@@ -13,7 +13,7 @@ private import internal.Location
* An element that can have a child statement or expression.
*/
class ExprOrStmtParent extends Element, @exprorstmt_parent {
- final override ControlFlowElement getChild(int i) {
+ override ControlFlowElement getChild(int i) {
result = this.getChildExpr(i) or
result = this.getChildStmt(i)
}
@@ -42,14 +42,8 @@ class ExprOrStmtParent extends Element, @exprorstmt_parent {
*
* An element that can have a child top-level expression.
*/
-class TopLevelExprParent extends Element, @top_level_expr_parent {
+class TopLevelExprParent extends ExprOrStmtParent, @top_level_expr_parent {
final override Expr getChild(int i) { result = this.getChildExpr(i) }
-
- /** Gets the `i`th child expression of this element (zero-based). */
- final Expr getChildExpr(int i) { expr_parent_top_level_adjusted(result, i, this) }
-
- /** Gets a child expression of this element, if any. */
- final Expr getAChildExpr() { result = this.getChildExpr(_) }
}
/** INTERNAL: Do not use. */
@@ -129,13 +123,6 @@ private module Cached {
result = parent.getAChildStmt()
}
- pragma[inline]
- private ControlFlowElement enclosingStart(ControlFlowElement cfe) {
- result = cfe
- or
- getAChild(result).(AnonymousFunctionExpr) = cfe
- }
-
private predicate parent(ControlFlowElement child, ExprOrStmtParent parent) {
child = getAChild(parent) and
not child = getBody(_)
@@ -145,7 +132,7 @@ private module Cached {
cached
predicate enclosingBody(ControlFlowElement cfe, ControlFlowElement body) {
body = getBody(_) and
- parent*(enclosingStart(cfe), body)
+ parent*(cfe, body)
}
/** Holds if the enclosing callable of `cfe` is `c`. */
@@ -153,7 +140,7 @@ private module Cached {
predicate enclosingCallable(ControlFlowElement cfe, Callable c) {
enclosingBody(cfe, getBody(c))
or
- parent*(enclosingStart(cfe), c.(Constructor).getInitializer())
+ parent*(cfe, c.(Constructor).getInitializer())
or
parent*(cfe, c.(Constructor).getObjectInitializerCall())
or
diff --git a/csharp/ql/lib/semmle/code/csharp/PrintAst.qll b/csharp/ql/lib/semmle/code/csharp/PrintAst.qll
index 1ac96c85e788..3b328c8393e6 100644
--- a/csharp/ql/lib/semmle/code/csharp/PrintAst.qll
+++ b/csharp/ql/lib/semmle/code/csharp/PrintAst.qll
@@ -299,7 +299,9 @@ class ControlFlowElementNode extends ElementNode {
not isNotNeeded(element.getParent+()) and
// LambdaExpr is both a Callable and a ControlFlowElement,
// print it with the more specific CallableNode
- not element instanceof Callable
+ not element instanceof Callable and
+ // Handled in `ParameterNode`
+ not element instanceof Parameter
}
override PrintAstNode getChild(int childIndex) {
@@ -343,10 +345,10 @@ final class AssignmentNode extends ControlFlowElementNode {
result.(TypeMentionNode).getTarget() = controlFlowElement
or
childIndex = 0 and
- result.(ElementNode).getElement() = assignment.getLValue()
+ result.(ElementNode).getElement() = assignment.getLeftOperand()
or
childIndex = 1 and
- result.(ElementNode).getElement() = assignment.getRValue()
+ result.(ElementNode).getElement() = assignment.getRightOperand()
}
}
diff --git a/csharp/ql/lib/semmle/code/csharp/Property.qll b/csharp/ql/lib/semmle/code/csharp/Property.qll
index bbd4fdd9d8ec..c9a338d0359f 100644
--- a/csharp/ql/lib/semmle/code/csharp/Property.qll
+++ b/csharp/ql/lib/semmle/code/csharp/Property.qll
@@ -535,8 +535,8 @@ class Setter extends Accessor, @setter {
exists(AssignExpr assign |
this.getStatementBody().getNumberOfStmts() = 1 and
assign.getParent() = this.getStatementBody().getAChild() and
- assign.getLValue() = result.getAnAccess() and
- assign.getRValue() = accessToValue()
+ assign.getLeftOperand() = result.getAnAccess() and
+ assign.getRightOperand() = accessToValue()
)
}
diff --git a/csharp/ql/lib/semmle/code/csharp/Type.qll b/csharp/ql/lib/semmle/code/csharp/Type.qll
index 54bbe9a6219f..7af167cd9bcb 100644
--- a/csharp/ql/lib/semmle/code/csharp/Type.qll
+++ b/csharp/ql/lib/semmle/code/csharp/Type.qll
@@ -1334,6 +1334,7 @@ class TypeMention extends @type_mention {
* ```csharp
* static class MyExtensions {
* extension(string s) { ... }
+ * }
* ```
*/
class ExtensionType extends Parameterizable, @extension_type {
diff --git a/csharp/ql/lib/semmle/code/csharp/Variable.qll b/csharp/ql/lib/semmle/code/csharp/Variable.qll
index 6d59816373d2..2d4cf578436d 100644
--- a/csharp/ql/lib/semmle/code/csharp/Variable.qll
+++ b/csharp/ql/lib/semmle/code/csharp/Variable.qll
@@ -87,7 +87,9 @@ class LocalScopeVariable extends Variable, @local_scope_variable {
* }
* ```
*/
-class Parameter extends LocalScopeVariable, Attributable, TopLevelExprParent, @parameter {
+class Parameter extends LocalScopeVariable, Attributable, TopLevelExprParent, ControlFlowElement,
+ @parameter
+{
/** Gets the raw position of this parameter, including the `this` parameter at index 0. */
final int getRawPosition() { this = this.getDeclaringElement().getRawParameter(result) }
diff --git a/csharp/ql/lib/semmle/code/csharp/commons/Collections.qll b/csharp/ql/lib/semmle/code/csharp/commons/Collections.qll
index b33c0f73d60d..c0752a720b26 100644
--- a/csharp/ql/lib/semmle/code/csharp/commons/Collections.qll
+++ b/csharp/ql/lib/semmle/code/csharp/commons/Collections.qll
@@ -54,21 +54,44 @@ private string genericCollectionTypeName() {
]
}
-/** A collection type. */
-class CollectionType extends RefType {
- CollectionType() {
+/** A collection type */
+abstract private class CollectionTypeImpl extends RefType {
+ /**
+ * Gets the element type of this collection, for example `int` in `List`.
+ */
+ abstract Type getElementType();
+}
+
+private class GenericCollectionType extends CollectionTypeImpl {
+ private ConstructedType base;
+
+ GenericCollectionType() {
+ base = this.getABaseType*() and
+ base.getUnboundGeneric()
+ .hasFullyQualifiedName(genericCollectionNamespaceName(), genericCollectionTypeName())
+ }
+
+ override Type getElementType() {
+ result = base.getTypeArgument(0) and base.getNumberOfTypeArguments() = 1
+ }
+}
+
+private class NonGenericCollectionType extends CollectionTypeImpl {
+ NonGenericCollectionType() {
exists(RefType base | base = this.getABaseType*() |
base.hasFullyQualifiedName(collectionNamespaceName(), collectionTypeName())
- or
- base.(ConstructedType)
- .getUnboundGeneric()
- .hasFullyQualifiedName(genericCollectionNamespaceName(), genericCollectionTypeName())
)
- or
- this instanceof ArrayType
}
+
+ override Type getElementType() { none() }
}
+private class ArrayCollectionType extends CollectionTypeImpl instanceof ArrayType {
+ override Type getElementType() { result = ArrayType.super.getElementType() }
+}
+
+final class CollectionType = CollectionTypeImpl;
+
/**
* A collection type that can be used as a `params` parameter type.
*/
diff --git a/csharp/ql/lib/semmle/code/csharp/commons/ComparisonTest.qll b/csharp/ql/lib/semmle/code/csharp/commons/ComparisonTest.qll
index 6a804f54490c..84bdda37fc9f 100644
--- a/csharp/ql/lib/semmle/code/csharp/commons/ComparisonTest.qll
+++ b/csharp/ql/lib/semmle/code/csharp/commons/ComparisonTest.qll
@@ -161,7 +161,7 @@ private newtype TComparisonTest =
compare.getComparisonKind().isCompare() and
outerKind = outer.getComparisonKind() and
outer.getAnArgument() = compare.getExpr() and
- i = outer.getAnArgument().getValue().toInt()
+ i = outer.getAnArgument().getIntValue()
|
outerKind.isEquality() and
(
diff --git a/csharp/ql/lib/semmle/code/csharp/commons/Constants.qll b/csharp/ql/lib/semmle/code/csharp/commons/Constants.qll
index 5025202eb217..a5f1bc43abee 100644
--- a/csharp/ql/lib/semmle/code/csharp/commons/Constants.qll
+++ b/csharp/ql/lib/semmle/code/csharp/commons/Constants.qll
@@ -32,13 +32,13 @@ private module ConstantComparisonOperation {
private int maxValue(Expr expr) {
if convertedType(expr) instanceof IntegralType and exists(expr.getValue())
- then result = expr.getValue().toInt()
+ then result = expr.getIntValue()
else result = convertedType(expr).maxValue()
}
private int minValue(Expr expr) {
if convertedType(expr) instanceof IntegralType and exists(expr.getValue())
- then result = expr.getValue().toInt()
+ then result = expr.getIntValue()
else result = convertedType(expr).minValue()
}
diff --git a/csharp/ql/lib/semmle/code/csharp/commons/Strings.qll b/csharp/ql/lib/semmle/code/csharp/commons/Strings.qll
index 678a1f928163..3fde913358b3 100644
--- a/csharp/ql/lib/semmle/code/csharp/commons/Strings.qll
+++ b/csharp/ql/lib/semmle/code/csharp/commons/Strings.qll
@@ -29,7 +29,7 @@ class ImplicitToStringExpr extends Expr {
m = p.getCallable()
|
m = any(SystemTextStringBuilderClass c).getAMethod() and
- m.getName().regexpMatch("Append(Line)?") and
+ m.getName() = "Append" and
not p.getType() instanceof ArrayType
or
p instanceof StringFormatItemParameter and
diff --git a/csharp/ql/lib/semmle/code/csharp/controlflow/BasicBlocks.qll b/csharp/ql/lib/semmle/code/csharp/controlflow/BasicBlocks.qll
deleted file mode 100644
index bf6a97728574..000000000000
--- a/csharp/ql/lib/semmle/code/csharp/controlflow/BasicBlocks.qll
+++ /dev/null
@@ -1,356 +0,0 @@
-/**
- * Provides classes representing basic blocks.
- */
-
-import csharp
-private import ControlFlow
-private import semmle.code.csharp.controlflow.internal.ControlFlowGraphImpl as CfgImpl
-private import CfgImpl::BasicBlocks as BasicBlocksImpl
-private import codeql.controlflow.BasicBlock as BB
-
-/**
- * A basic block, that is, a maximal straight-line sequence of control flow nodes
- * without branches or joins.
- */
-final class BasicBlock extends BasicBlocksImpl::BasicBlock {
- /** Gets an immediate successor of this basic block of a given type, if any. */
- BasicBlock getASuccessor(ControlFlow::SuccessorType t) { result = super.getASuccessor(t) }
-
- /** DEPRECATED: Use `getASuccessor` instead. */
- deprecated BasicBlock getASuccessorByType(ControlFlow::SuccessorType t) {
- result = this.getASuccessor(t)
- }
-
- /** Gets an immediate predecessor of this basic block of a given type, if any. */
- BasicBlock getAPredecessorByType(ControlFlow::SuccessorType t) {
- result = this.getAPredecessor(t)
- }
-
- /**
- * Gets an immediate `true` successor, if any.
- *
- * An immediate `true` successor is a successor that is reached when
- * the condition that ends this basic block evaluates to `true`.
- *
- * Example:
- *
- * ```csharp
- * if (x < 0)
- * x = -x;
- * ```
- *
- * The basic block on line 2 is an immediate `true` successor of the
- * basic block on line 1.
- */
- BasicBlock getATrueSuccessor() { result.getFirstNode() = this.getLastNode().getATrueSuccessor() }
-
- /**
- * Gets an immediate `false` successor, if any.
- *
- * An immediate `false` successor is a successor that is reached when
- * the condition that ends this basic block evaluates to `false`.
- *
- * Example:
- *
- * ```csharp
- * if (!(x >= 0))
- * x = -x;
- * ```
- *
- * The basic block on line 2 is an immediate `false` successor of the
- * basic block on line 1.
- */
- BasicBlock getAFalseSuccessor() {
- result.getFirstNode() = this.getLastNode().getAFalseSuccessor()
- }
-
- BasicBlock getASuccessor() { result = super.getASuccessor() }
-
- /** Gets the control flow node at a specific (zero-indexed) position in this basic block. */
- ControlFlow::Node getNode(int pos) { result = super.getNode(pos) }
-
- /** Gets a control flow node in this basic block. */
- ControlFlow::Node getANode() { result = super.getANode() }
-
- /** Gets the first control flow node in this basic block. */
- ControlFlow::Node getFirstNode() { result = super.getFirstNode() }
-
- /** Gets the last control flow node in this basic block. */
- ControlFlow::Node getLastNode() { result = super.getLastNode() }
-
- /** Gets the callable that this basic block belongs to. */
- final Callable getCallable() { result = this.getFirstNode().getEnclosingCallable() }
-
- /**
- * Holds if this basic block immediately dominates basic block `bb`.
- *
- * That is, this basic block is the unique basic block satisfying:
- * 1. This basic block strictly dominates `bb`
- * 2. There exists no other basic block that is strictly dominated by this
- * basic block and which strictly dominates `bb`.
- *
- * All basic blocks, except entry basic blocks, have a unique immediate
- * dominator.
- *
- * Example:
- *
- * ```csharp
- * int M(string s) {
- * if (s == null)
- * throw new ArgumentNullException(nameof(s));
- * return s.Length;
- * }
- * ```
- *
- * The basic block starting on line 2 strictly dominates the
- * basic block on line 4 (all paths from the entry point of `M`
- * to `return s.Length;` must go through the null check).
- */
- predicate immediatelyDominates(BasicBlock bb) { super.immediatelyDominates(bb) }
-
- /**
- * Holds if this basic block strictly dominates basic block `bb`.
- *
- * That is, all paths reaching basic block `bb` from some entry point
- * basic block must go through this basic block (which must be different
- * from `bb`).
- *
- * Example:
- *
- * ```csharp
- * int M(string s) {
- * if (s == null)
- * throw new ArgumentNullException(nameof(s));
- * return s.Length;
- * }
- * ```
- *
- * The basic block starting on line 2 strictly dominates the
- * basic block on line 4 (all paths from the entry point of `M`
- * to `return s.Length;` must go through the null check).
- */
- predicate strictlyDominates(BasicBlock bb) { super.strictlyDominates(bb) }
-
- /**
- * Holds if this basic block dominates basic block `bb`.
- *
- * That is, all paths reaching basic block `bb` from some entry point
- * basic block must go through this basic block.
- *
- * Example:
- *
- * ```csharp
- * int M(string s) {
- * if (s == null)
- * throw new ArgumentNullException(nameof(s));
- * return s.Length;
- * }
- * ```
- *
- * The basic block starting on line 2 dominates the basic
- * block on line 4 (all paths from the entry point of `M` to
- * `return s.Length;` must go through the null check).
- *
- * This predicate is *reflexive*, so for example `if (s == null)` dominates
- * itself.
- */
- predicate dominates(BasicBlock bb) {
- bb = this or
- this.strictlyDominates(bb)
- }
-
- /**
- * Holds if `df` is in the dominance frontier of this basic block.
- * That is, this basic block dominates a predecessor of `df`, but
- * does not dominate `df` itself.
- *
- * Example:
- *
- * ```csharp
- * if (x < 0) {
- * x = -x;
- * if (x > 10)
- * x--;
- * }
- * Console.Write(x);
- * ```
- *
- * The basic block on line 6 is in the dominance frontier
- * of the basic block starting on line 2 because that block
- * dominates the basic block on line 4, which is a predecessor of
- * `Console.Write(x);`. Also, the basic block starting on line 2
- * does not dominate the basic block on line 6.
- */
- predicate inDominanceFrontier(BasicBlock df) { super.inDominanceFrontier(df) }
-
- /**
- * Gets the basic block that immediately dominates this basic block, if any.
- *
- * That is, the result is the unique basic block satisfying:
- * 1. The result strictly dominates this basic block.
- * 2. There exists no other basic block that is strictly dominated by the
- * result and which strictly dominates this basic block.
- *
- * All basic blocks, except entry basic blocks, have a unique immediate
- * dominator.
- *
- * Example:
- *
- * ```csharp
- * int M(string s) {
- * if (s == null)
- * throw new ArgumentNullException(nameof(s));
- * return s.Length;
- * }
- * ```
- *
- * The basic block starting on line 2 is an immediate dominator of
- * the basic block online 4 (all paths from the entry point of `M`
- * to `return s.Length;` must go through the null check.
- */
- BasicBlock getImmediateDominator() { result = super.getImmediateDominator() }
-
- /**
- * Holds if the edge with successor type `s` out of this basic block is a
- * dominating edge for `dominated`.
- *
- * That is, all paths reaching `dominated` from the entry point basic
- * block must go through the `s` edge out of this basic block.
- *
- * Edge dominance is similar to node dominance except it concerns edges
- * instead of nodes: A basic block is dominated by a _basic block_ `bb` if it
- * can only be reached through `bb` and dominated by an _edge_ `e` if it can
- * only be reached through `e`.
- *
- * Note that where all basic blocks (except the entry basic block) are
- * strictly dominated by at least one basic block, a basic block may not be
- * dominated by any edge. If an edge dominates a basic block `bb`, then
- * both endpoints of the edge dominates `bb`. The converse is not the case,
- * as there may be multiple paths between the endpoints with none of them
- * dominating.
- */
- predicate edgeDominates(BasicBlock dominated, ControlFlow::SuccessorType s) {
- super.edgeDominates(dominated, s)
- }
-
- /**
- * Holds if this basic block strictly post-dominates basic block `bb`.
- *
- * That is, all paths reaching a normal exit point basic block from basic
- * block `bb` must go through this basic block (which must be different
- * from `bb`).
- *
- * Example:
- *
- * ```csharp
- * int M(string s) {
- * try {
- * return s.Length;
- * }
- * finally {
- * Console.WriteLine("M");
- * }
- * }
- * ```
- *
- * The basic block on line 6 strictly post-dominates the basic block on
- * line 3 (all paths to the exit point of `M` from `return s.Length;`
- * must go through the `WriteLine` call).
- */
- predicate strictlyPostDominates(BasicBlock bb) { super.strictlyPostDominates(bb) }
-
- /**
- * Holds if this basic block post-dominates basic block `bb`.
- *
- * That is, all paths reaching a normal exit point basic block from basic
- * block `bb` must go through this basic block.
- *
- * Example:
- *
- * ```csharp
- * int M(string s) {
- * try {
- * return s.Length;
- * }
- * finally {
- * Console.WriteLine("M");
- * }
- * }
- * ```
- *
- * The basic block on line 6 post-dominates the basic block on line 3
- * (all paths to the exit point of `M` from `return s.Length;` must go
- * through the `WriteLine` call).
- *
- * This predicate is *reflexive*, so for example `Console.WriteLine("M");`
- * post-dominates itself.
- */
- predicate postDominates(BasicBlock bb) { super.postDominates(bb) }
-
- /**
- * Holds if this basic block is in a loop in the control flow graph. This
- * includes loops created by `goto` statements. This predicate may not hold
- * even if this basic block is syntactically inside a `while` loop if the
- * necessary back edges are unreachable.
- */
- predicate inLoop() { this.getASuccessor+() = this }
-}
-
-/**
- * An entry basic block, that is, a basic block whose first node is
- * an entry node.
- */
-final class EntryBasicBlock extends BasicBlock, BasicBlocksImpl::EntryBasicBlock { }
-
-/**
- * An annotated exit basic block, that is, a basic block that contains an
- * annotated exit node.
- */
-final class AnnotatedExitBasicBlock extends BasicBlock, BasicBlocksImpl::AnnotatedExitBasicBlock { }
-
-/**
- * An exit basic block, that is, a basic block whose last node is
- * an exit node.
- */
-final class ExitBasicBlock extends BasicBlock, BasicBlocksImpl::ExitBasicBlock { }
-
-/** A basic block with more than one predecessor. */
-final class JoinBlock extends BasicBlock, BasicBlocksImpl::JoinBasicBlock {
- JoinBlockPredecessor getJoinBlockPredecessor(int i) { result = super.getJoinBlockPredecessor(i) }
-}
-
-/** A basic block that is an immediate predecessor of a join block. */
-final class JoinBlockPredecessor extends BasicBlock, BasicBlocksImpl::JoinPredecessorBasicBlock { }
-
-/**
- * A basic block that terminates in a condition, splitting the subsequent
- * control flow.
- */
-final class ConditionBlock extends BasicBlock, BasicBlocksImpl::ConditionBasicBlock {
- /** DEPRECATED: Use `edgeDominates` instead. */
- deprecated predicate immediatelyControls(BasicBlock succ, ConditionalSuccessor s) {
- this.getASuccessor(s) = succ and
- BasicBlocksImpl::dominatingEdge(this, succ)
- }
-
- /** DEPRECATED: Use `edgeDominates` instead. */
- deprecated predicate controls(BasicBlock controlled, ConditionalSuccessor s) {
- super.edgeDominates(controlled, s)
- }
-}
-
-private class BasicBlockAlias = BasicBlock;
-
-private class EntryBasicBlockAlias = EntryBasicBlock;
-
-module Cfg implements BB::CfgSig {
- class ControlFlowNode = ControlFlow::Node;
-
- class BasicBlock = BasicBlockAlias;
-
- class EntryBasicBlock = EntryBasicBlockAlias;
-
- predicate dominatingEdge(BasicBlock bb1, BasicBlock bb2) {
- BasicBlocksImpl::dominatingEdge(bb1, bb2)
- }
-}
diff --git a/csharp/ql/lib/semmle/code/csharp/controlflow/ControlFlowElement.qll b/csharp/ql/lib/semmle/code/csharp/controlflow/ControlFlowElement.qll
index 0d0ed6819698..f2b459b63f7f 100644
--- a/csharp/ql/lib/semmle/code/csharp/controlflow/ControlFlowElement.qll
+++ b/csharp/ql/lib/semmle/code/csharp/controlflow/ControlFlowElement.qll
@@ -4,20 +4,21 @@ import csharp
private import semmle.code.csharp.ExprOrStmtParent
private import semmle.code.csharp.commons.Compilation
private import ControlFlow
-private import ControlFlow::BasicBlocks
private import semmle.code.csharp.Caching
-private import internal.ControlFlowGraphImpl as Impl
+
+private class TControlFlowElementOrCallable = @callable or @control_flow_element;
+
+/** A `ControlFlowElement` or a `Callable`. */
+class ControlFlowElementOrCallable extends ExprOrStmtParent, TControlFlowElementOrCallable { }
/**
* A program element that can possess control flow. That is, either a statement or
* an expression.
*
- * A control flow element can be mapped to a control flow node (`ControlFlow::Node`)
- * via `getAControlFlowNode()`. There is a one-to-many relationship between
- * control flow elements and control flow nodes. This allows control flow
- * splitting, for example modeling the control flow through `finally` blocks.
+ * A control flow element can be mapped to a control flow node (`ControlFlowNode`)
+ * via `getControlFlowNode()`.
*/
-class ControlFlowElement extends ExprOrStmtParent, @control_flow_element {
+class ControlFlowElement extends ControlFlowElementOrCallable, @control_flow_element {
/** Gets the enclosing callable of this element, if any. */
Callable getEnclosingCallable() { none() }
@@ -30,41 +31,26 @@ class ControlFlowElement extends ExprOrStmtParent, @control_flow_element {
}
/**
+ * DEPRECATED: Use `getControlFlowNode()` instead.
+ *
* Gets a control flow node for this element. That is, a node in the
* control flow graph that corresponds to this element.
- *
- * Typically, there is exactly one `ControlFlow::Node` associated with a
- * `ControlFlowElement`, but a `ControlFlowElement` may be split into
- * several `ControlFlow::Node`s, for example to represent the continuation
- * flow in a `try/catch/finally` construction.
*/
- Nodes::ElementNode getAControlFlowNode() { result.getAstNode() = this }
+ deprecated ControlFlowNodes::ElementNode getAControlFlowNode() {
+ result = this.getControlFlowNode()
+ }
- /** Gets the control flow node for this element. */
- ControlFlow::Node getControlFlowNode() { result.getAstNode() = this }
+ /** Gets the control flow node for this element, if any. */
+ ControlFlowNode getControlFlowNode() { result.injects(this) }
/** Gets the basic block in which this element occurs. */
- BasicBlock getBasicBlock() { result = this.getAControlFlowNode().getBasicBlock() }
-
- /**
- * Gets a first control flow node executed within this element.
- */
- Nodes::ElementNode getAControlFlowEntryNode() {
- result = Impl::getAControlFlowEntryNode(this).(ControlFlowElement).getAControlFlowNode()
- }
-
- /**
- * Gets a potential last control flow node executed within this element.
- */
- Nodes::ElementNode getAControlFlowExitNode() {
- result = Impl::getAControlFlowExitNode(this).(ControlFlowElement).getAControlFlowNode()
- }
+ BasicBlock getBasicBlock() { result = this.getControlFlowNode().getBasicBlock() }
/**
* Holds if this element is live, that is this element can be reached
* from the entry point of its enclosing callable.
*/
- predicate isLive() { exists(this.getAControlFlowNode()) }
+ predicate isLive() { exists(this.getControlFlowNode()) }
/** Holds if the current element is reachable from `src`. */
// potentially very large predicate, so must be inlined
@@ -77,31 +63,13 @@ class ControlFlowElement extends ExprOrStmtParent, @control_flow_element {
ControlFlowElement getAReachableElement() {
// Reachable in same basic block
exists(BasicBlock bb, int i, int j |
- bb.getNode(i) = this.getAControlFlowNode() and
- bb.getNode(j) = result.getAControlFlowNode() and
+ bb.getNode(i) = this.getControlFlowNode() and
+ bb.getNode(j) = result.getControlFlowNode() and
i < j
)
or
// Reachable in different basic blocks
- this.getAControlFlowNode().getBasicBlock().getASuccessor+().getANode() =
- result.getAControlFlowNode()
- }
-
- /**
- * DEPRECATED: Use `Guard` class instead.
- *
- * Holds if basic block `controlled` is controlled by this control flow element
- * with conditional value `s`. That is, `controlled` can only be reached from
- * the callable entry point by going via the `s` edge out of *some* basic block
- * ending with this element.
- *
- * `cb` records all of the possible condition blocks for this control flow element
- * that a path from the callable entry point to `controlled` may go through.
- */
- deprecated predicate controlsBlock(
- BasicBlock controlled, ConditionalSuccessor s, ConditionBlock cb
- ) {
- cb.getLastNode() = this.getAControlFlowNode() and
- cb.edgeDominates(controlled, s)
+ this.getControlFlowNode().getBasicBlock().getASuccessor+().getANode() =
+ result.getControlFlowNode()
}
}
diff --git a/csharp/ql/lib/semmle/code/csharp/controlflow/ControlFlowGraph.qll b/csharp/ql/lib/semmle/code/csharp/controlflow/ControlFlowGraph.qll
index 438174fe2970..c56d3dab420c 100644
--- a/csharp/ql/lib/semmle/code/csharp/controlflow/ControlFlowGraph.qll
+++ b/csharp/ql/lib/semmle/code/csharp/controlflow/ControlFlowGraph.qll
@@ -1,315 +1,334 @@
-import csharp
-
/**
* Provides classes representing the control flow graph within callables.
*/
-module ControlFlow {
- private import semmle.code.csharp.controlflow.BasicBlocks as BBs
- import semmle.code.csharp.controlflow.internal.SuccessorType
- private import internal.ControlFlowGraphImpl as Impl
- private import internal.Splitting as Splitting
- /**
- * A control flow node.
- *
- * Either a callable entry node (`EntryNode`), a callable exit node (`ExitNode`),
- * or a control flow node for a control flow element, that is, an expression or a
- * statement (`ElementNode`).
- *
- * A control flow node is a node in the control flow graph (CFG). There is a
- * many-to-one relationship between `ElementNode`s and `ControlFlowElement`s.
- * This allows control flow splitting, for example modeling the control flow
- * through `finally` blocks.
- *
- * Only nodes that can be reached from the callable entry point are included in
- * the CFG.
- */
- class Node extends Impl::Node {
- /** Gets the control flow element that this node corresponds to, if any. */
- final ControlFlowElement getAstNode() { result = super.getAstNode() }
+import csharp
+private import internal.ControlFlowGraph
+private import codeql.controlflow.SuccessorType
+private import semmle.code.csharp.commons.Compilation
+private import semmle.code.csharp.controlflow.internal.NonReturning as NonReturning
- /** Gets the basic block that this control flow node belongs to. */
- BasicBlock getBasicBlock() { result.getANode() = this }
+private module Cfg0 = Make0;
- /**
- * Holds if this node dominates `that` node.
- *
- * That is, all paths reaching `that` node from some callable entry
- * node (`EntryNode`) must go through this node.
- *
- * Example:
- *
- * ```csharp
- * int M(string s)
- * {
- * if (s == null)
- * throw new ArgumentNullException(nameof(s));
- * return s.Length;
- * }
- * ```
- *
- * The node on line 3 dominates the node on line 5 (all paths from the
- * entry point of `M` to `return s.Length;` must go through the null check).
- *
- * This predicate is *reflexive*, so for example `if (s == null)` dominates
- * itself.
- */
- // potentially very large predicate, so must be inlined
- pragma[inline]
- predicate dominates(Node that) {
- this.strictlyDominates(that)
- or
- this = that
- }
+private module Cfg1 = Make1;
- /**
- * Holds if this node strictly dominates `that` node.
- *
- * That is, all paths reaching `that` node from some callable entry
- * node (`EntryNode`) must go through this node (which must
- * be different from `that` node).
- *
- * Example:
- *
- * ```csharp
- * int M(string s)
- * {
- * if (s == null)
- * throw new ArgumentNullException(nameof(s));
- * return s.Length;
- * }
- * ```
- *
- * The node on line 3 strictly dominates the node on line 5
- * (all paths from the entry point of `M` to `return s.Length;` must go
- * through the null check).
- */
- // potentially very large predicate, so must be inlined
- pragma[inline]
- predicate strictlyDominates(Node that) {
- this.getBasicBlock().strictlyDominates(that.getBasicBlock())
- or
- exists(BasicBlock bb, int i, int j |
- bb.getNode(i) = this and
- bb.getNode(j) = that and
- i < j
- )
- }
+private module Cfg2 = Make2;
- /**
- * Holds if this node post-dominates `that` node.
- *
- * That is, all paths reaching a normal callable exit node (an `AnnotatedExitNode`
- * with a normal exit type) from `that` node must go through this node.
- *
- * Example:
- *
- * ```csharp
- * int M(string s)
- * {
- * try
- * {
- * return s.Length;
- * }
- * finally
- * {
- * Console.WriteLine("M");
- * }
- * }
- * ```
- *
- * The node on line 9 post-dominates the node on line 5 (all paths to the
- * exit point of `M` from `return s.Length;` must go through the `WriteLine`
- * call).
- *
- * This predicate is *reflexive*, so for example `Console.WriteLine("M");`
- * post-dominates itself.
- */
- // potentially very large predicate, so must be inlined
- pragma[inline]
- predicate postDominates(Node that) {
- this.strictlyPostDominates(that)
- or
- this = that
- }
+private import Cfg0
+private import Cfg1
+private import Cfg2
+import Public
- /**
- * Holds if this node strictly post-dominates `that` node.
- *
- * That is, all paths reaching a normal callable exit node (an `AnnotatedExitNode`
- * with a normal exit type) from `that` node must go through this node
- * (which must be different from `that` node).
- *
- * Example:
- *
- * ```csharp
- * int M(string s)
- * {
- * try
- * {
- * return s.Length;
- * }
- * finally
- * {
- * Console.WriteLine("M");
- * }
- * }
- * ```
- *
- * The node on line 9 strictly post-dominates the node on line 5 (all
- * paths to the exit point of `M` from `return s.Length;` must go through
- * the `WriteLine` call).
- */
- // potentially very large predicate, so must be inlined
- pragma[inline]
- predicate strictlyPostDominates(Node that) {
- this.getBasicBlock().strictlyPostDominates(that.getBasicBlock())
- or
- exists(BasicBlock bb, int i, int j |
- bb.getNode(i) = this and
- bb.getNode(j) = that and
- i > j
- )
- }
+/**
+ * A compilation.
+ *
+ * Unlike the standard `Compilation` class, this class also supports buildless
+ * extraction.
+ */
+private newtype TCompilationExt =
+ TCompilation(Compilation c) { not extractionIsStandalone() } or
+ TBuildless() { extractionIsStandalone() }
+
+private class CompilationExt extends TCompilationExt {
+ string toString() {
+ exists(Compilation c |
+ this = TCompilation(c) and
+ result = c.toString()
+ )
+ or
+ this = TBuildless() and result = "buildless compilation"
+ }
+}
- /** Gets a successor node of a given type, if any. */
- Node getASuccessorByType(SuccessorType t) { result = this.getASuccessor(t) }
+/** Gets the compilation that source file `f` belongs to. */
+bindingset[e]
+pragma[inline_late]
+private CompilationExt getCompilation(Element e) {
+ exists(Compilation c |
+ e.getALocation().getFile() = c.getAFileCompiled() and
+ result = TCompilation(c)
+ )
+ or
+ result = TBuildless()
+}
- /** Gets an immediate successor, if any. */
- Node getASuccessor() { result = this.getASuccessorByType(_) }
+private module Exceptions {
+ private import semmle.code.csharp.commons.Assertions
- /** Gets an immediate predecessor node of a given flow type, if any. */
- Node getAPredecessorByType(SuccessorType t) { result.getASuccessorByType(t) = this }
+ private class Overflowable extends UnaryOperation {
+ Overflowable() {
+ not this instanceof UnaryBitwiseOperation and
+ this.getType() instanceof IntegralType
+ }
+ }
- /** Gets an immediate predecessor, if any. */
- Node getAPredecessor() { result = this.getAPredecessorByType(_) }
+ /** Holds if `cfe` is a control flow element that may throw an exception. */
+ predicate mayThrowException(ControlFlowElement cfe) {
+ cfe.(TriedControlFlowElement).mayThrowException()
+ or
+ cfe instanceof Assertion
+ }
- /**
- * Gets an immediate `true` successor, if any.
- *
- * An immediate `true` successor is a successor that is reached when
- * this condition evaluates to `true`.
- *
- * Example:
- *
- * ```csharp
- * if (x < 0)
- * x = -x;
- * ```
- *
- * The node on line 2 is an immediate `true` successor of the node
- * on line 1.
- */
- Node getATrueSuccessor() {
- result = this.getASuccessorByType(any(BooleanSuccessor t | t.getValue() = true))
+ /** A control flow element that is inside a `try` block. */
+ private class TriedControlFlowElement extends ControlFlowElement {
+ TriedControlFlowElement() {
+ this = any(TryStmt try).getATriedElement() and
+ not this instanceof NonReturning::NonReturningCall
}
/**
- * Gets an immediate `false` successor, if any.
- *
- * An immediate `false` successor is a successor that is reached when
- * this condition evaluates to `false`.
- *
- * Example:
- *
- * ```csharp
- * if (!(x >= 0))
- * x = -x;
- * ```
- *
- * The node on line 2 is an immediate `false` successor of the node
- * on line 1.
+ * Holds if this element may potentially throw an exception.
*/
- Node getAFalseSuccessor() {
- result = this.getASuccessorByType(any(BooleanSuccessor t | t.getValue() = false))
+ predicate mayThrowException() {
+ this instanceof Overflowable
+ or
+ this.(CastExpr).getType() instanceof IntegralType
+ or
+ invalidCastCandidate(this)
+ or
+ this instanceof Call
+ or
+ this =
+ any(MemberAccess ma |
+ not ma.isConditional() and
+ ma.getQualifier() = any(Expr e | not e instanceof TypeAccess)
+ )
+ or
+ this instanceof DelegateCreation
+ or
+ this instanceof ArrayCreation
+ or
+ this =
+ any(AddOperation ae |
+ ae.getType() instanceof StringType
+ or
+ ae.getType() instanceof IntegralType
+ )
+ or
+ this = any(SubOperation se | se.getType() instanceof IntegralType)
+ or
+ this = any(MulOperation me | me.getType() instanceof IntegralType)
+ or
+ this = any(DivOperation de | not de.getDenominator().getValue().toFloat() != 0)
+ or
+ this instanceof RemOperation
+ or
+ this instanceof DynamicExpr
}
-
- /** Gets the enclosing callable of this control flow node. */
- final Callable getEnclosingCallable() { result = Impl::getNodeCfgScope(this) }
}
- /** Provides different types of control flow nodes. */
- module Nodes {
- /** A node for a callable entry point. */
- class EntryNode extends Node instanceof Impl::EntryNode {
- /** Gets the callable that this entry applies to. */
- Callable getCallable() { result = this.getScope() }
-
- override BasicBlocks::EntryBlock getBasicBlock() { result = Node.super.getBasicBlock() }
- }
+ pragma[nomagic]
+ private ValueOrRefType getACastExprBaseType(CastExpr ce) {
+ result = ce.getType().(ValueOrRefType).getABaseType()
+ or
+ result = getACastExprBaseType(ce).getABaseType()
+ }
- /** A node for a callable exit point, annotated with the type of exit. */
- class AnnotatedExitNode extends Node instanceof Impl::AnnotatedExitNode {
- /** Holds if this node represent a normal exit. */
- final predicate isNormal() { super.isNormal() }
+ pragma[nomagic]
+ private predicate invalidCastCandidate(CastExpr ce) {
+ ce.getExpr().getType() = getACastExprBaseType(ce)
+ }
+}
- /** Gets the callable that this exit applies to. */
- Callable getCallable() { result = this.getScope() }
+private module Input implements InputSig1, InputSig2 {
+ predicate cfgCachedStageRef() { CfgCachedStage::ref() }
- override BasicBlocks::AnnotatedExitBlock getBasicBlock() {
- result = Node.super.getBasicBlock()
- }
- }
+ predicate catchAll(Ast::CatchClause catch) { catch instanceof GeneralCatchClause }
- /** A control flow node indicating normal termination of a callable. */
- class NormalExitNode extends AnnotatedExitNode instanceof Impl::NormalExitNode { }
+ predicate matchAll(Ast::Case c) { c instanceof DefaultCase or c.(SwitchCaseExpr).matchesAll() }
- /** A node for a callable exit point. */
- class ExitNode extends Node instanceof Impl::ExitNode {
- /** Gets the callable that this exit applies to. */
- Callable getCallable() { result = this.getScope() }
+ private newtype TLabel =
+ TLblGoto(string label) { any(GotoLabelStmt goto).getLabel() = label } or
+ TLblSwitchCase(string value) { any(GotoCaseStmt goto).getLabel() = value } or
+ TLblSwitchDefault()
- override BasicBlocks::ExitBlock getBasicBlock() { result = Node.super.getBasicBlock() }
+ class Label extends TLabel {
+ string toString() {
+ this = TLblGoto(result)
+ or
+ this = TLblSwitchCase(result)
+ or
+ this = TLblSwitchDefault() and result = "default"
}
+ }
- /**
- * A node for a control flow element, that is, an expression or a statement.
- *
- * Each control flow element maps to zero or more `ElementNode`s: zero when
- * the element is in unreachable (dead) code, and multiple when there are
- * different splits for the element.
- */
- class ElementNode extends Node instanceof Impl::AstCfgNode {
- /** Gets a comma-separated list of strings for each split in this node, if any. */
- final string getSplitsString() { result = super.getSplitsString() }
+ predicate hasLabel(Ast::AstNode n, Label l) {
+ l = TLblGoto(n.(GotoLabelStmt).getLabel())
+ or
+ l = TLblSwitchCase(n.(GotoCaseStmt).getLabel())
+ or
+ l = TLblSwitchDefault() and n instanceof GotoDefaultStmt
+ or
+ l = TLblGoto(n.(LabelStmt).getLabel())
+ }
- /** Gets a split for this control flow node, if any. */
- final Split getASplit() { result = super.getASplit() }
- }
+ class CallableContext = CompilationExt;
- /** A control-flow node for an expression. */
- class ExprNode extends ElementNode {
- Expr e;
+ pragma[nomagic]
+ Ast::AstNode callableGetBodyPart(Ast::Callable c, CallableContext ctx, int index) {
+ not Ast::skipControlFlow(result) and
+ ctx = getCompilation(result) and
+ (
+ result = Initializers::initializedInstanceMemberOrder(c, index)
+ or
+ result = Initializers::initializedStaticMemberOrder(c, index)
+ or
+ exists(Constructor ctor, int i, int staticMembers |
+ c = ctor and
+ staticMembers = count(Expr init | Initializers::staticMemberInitializer(ctor, init)) and
+ index = staticMembers + i + 1
+ |
+ i = 0 and result = ctor.getObjectInitializerCall()
+ or
+ i = 1 and result = ctor.getInitializer()
+ or
+ i = 2 and result = ctor.getBody()
+ )
+ or
+ not c instanceof Constructor and
+ result = c.getBody() and
+ index = 0
+ )
+ }
- ExprNode() { e = unique(Expr e_ | e_ = this.getAstNode() | e_) }
+ pragma[nomagic]
+ Ast::Parameter callableGetParameter(Ast::Callable c, CallableContext ctx, int index) {
+ result = Ast::callableGetParameter(c, index) and
+ ctx = getCompilation(result)
+ }
- /** Gets the expression that this control-flow node belongs to. */
- Expr getExpr() { result = e }
+ private Expr getQualifier(QualifiableExpr qe) {
+ result = qe.getQualifier() or
+ result = qe.(ExtensionMethodCall).getArgument(0)
+ }
- /** Gets the value of this expression node, if any. */
- string getValue() { result = e.getValue() }
+ predicate inConditionalContext(Ast::AstNode n, ConditionKind kind) {
+ kind.isNullness() and
+ exists(QualifiableExpr qe | qe.isConditional() | n = getQualifier(qe))
+ }
- /** Gets the type of this expression node. */
- Type getType() { result = e.getType() }
- }
+ predicate postOrInOrder(Ast::AstNode n) { n instanceof YieldStmt or n instanceof Call }
+
+ predicate beginAbruptCompletion(
+ Ast::AstNode ast, PreControlFlowNode n, AbruptCompletion c, boolean always
+ ) {
+ // `yield break` behaves like a return statement
+ ast instanceof YieldBreakStmt and
+ n.isIn(ast) and
+ c.asSimpleAbruptCompletion() instanceof ReturnSuccessor and
+ always = true
+ or
+ Exceptions::mayThrowException(ast) and
+ n.isIn(ast) and
+ c.asSimpleAbruptCompletion() instanceof ExceptionSuccessor and
+ always = false
+ or
+ ast instanceof NonReturning::NonReturningCall and
+ n.isIn(ast) and
+ c.asSimpleAbruptCompletion() instanceof ExceptionSuccessor and
+ always = true
+ }
- class Split = Splitting::Split;
+ predicate endAbruptCompletion(Ast::AstNode ast, PreControlFlowNode n, AbruptCompletion c) {
+ exists(SwitchStmt switch, Label l, Ast::Case case |
+ ast.(Stmt).getParent() = switch and
+ c.getSuccessorType() instanceof GotoSuccessor and
+ c.hasLabel(l) and
+ n.isAfterValue(case, any(MatchingSuccessor t | t.getValue() = true))
+ |
+ exists(string value, ConstCase cc |
+ l = TLblSwitchCase(value) and
+ switch.getAConstCase() = cc and
+ cc.getLabel() = value and
+ cc = case
+ )
+ or
+ l = TLblSwitchDefault() and switch.getDefaultCase() = case
+ )
}
- class BasicBlock = BBs::BasicBlock;
+ predicate step(PreControlFlowNode n1, PreControlFlowNode n2) {
+ exists(QualifiableExpr qe | qe.isConditional() |
+ n1.isBefore(qe) and n2.isBefore(getQualifier(qe))
+ or
+ exists(NullnessSuccessor t | n1.isAfterValue(getQualifier(qe), t) |
+ if t.isNull()
+ then (
+ // if `q` is null in `q?.f = x` then the assignment is skipped. This
+ // holds for both regular, compound, and null-coalescing assignments.
+ // On the other hand, the CFG definition for the assignment can treat
+ // the LHS the same regardless of whether it's a conditionally
+ // qualified access or not, as it just connects to the "before" and
+ // "after" nodes of the LHS, and the "after" node is skipped in this
+ // case.
+ exists(AssignableDefinition def |
+ def.getTargetAccess() = qe and
+ n2.isAfterValue(def.getExpr(), t)
+ )
+ or
+ not qe instanceof AssignableWrite and
+ n2.isAfterValue(qe, t)
+ ) else (
+ n2.isBefore(Ast::getChild(qe, 0))
+ or
+ n2.isIn(qe) and not exists(Ast::getChild(qe, 0))
+ )
+ )
+ or
+ exists(int i | i >= 0 and n1.isAfter(Ast::getChild(qe, i)) |
+ n2.isBefore(Ast::getChild(qe, i + 1))
+ or
+ not exists(Ast::getChild(qe, i + 1)) and n2.isIn(qe)
+ )
+ or
+ n1.isIn(qe) and n2.isAfter(qe) and not beginAbruptCompletion(qe, n1, _, true)
+ )
+ or
+ exists(ObjectCreation oc |
+ n1.isBefore(oc) and n2.isBefore(oc.getArgument(0))
+ or
+ n1.isBefore(oc) and n2.isIn(oc) and not exists(oc.getAnArgument())
+ or
+ exists(int i | n1.isAfter(oc.getArgument(i)) |
+ n2.isBefore(oc.getArgument(i + 1))
+ or
+ not exists(oc.getArgument(i + 1)) and n2.isIn(oc)
+ )
+ or
+ n1.isIn(oc) and n2.isBefore(oc.getInitializer())
+ or
+ n1.isIn(oc) and n2.isAfter(oc) and not exists(oc.getInitializer())
+ or
+ n1.isAfter(oc.getInitializer()) and n2.isAfter(oc)
+ )
+ }
+}
- /** Provides different types of basic blocks. */
- module BasicBlocks {
- class EntryBlock = BBs::EntryBasicBlock;
+/** Provides different types of control flow nodes. */
+module ControlFlowNodes {
+ /**
+ * A node for a control flow element, that is, an expression or a statement.
+ *
+ * Each control flow element maps to zero or one `ElementNode`s: zero when
+ * the element is in unreachable (dead) code, and otherwise one.
+ */
+ class ElementNode extends ControlFlowNode {
+ ElementNode() { exists(this.asExpr()) or exists(this.asStmt()) }
+ }
- class AnnotatedExitBlock = BBs::AnnotatedExitBasicBlock;
+ /** A control-flow node for an expression. */
+ class ExprNode extends ElementNode {
+ Expr e;
- class ExitBlock = BBs::ExitBasicBlock;
+ ExprNode() { e = this.asExpr() }
- class JoinBlock = BBs::JoinBlock;
+ /** Gets the expression that this control-flow node belongs to. */
+ Expr getExpr() { result = e }
- class JoinBlockPredecessor = BBs::JoinBlockPredecessor;
+ /** Gets the value of this expression node, if any. */
+ string getValue() { result = e.getValue() }
- class ConditionBlock = BBs::ConditionBlock;
+ /** Gets the type of this expression node. */
+ Type getType() { result = e.getType() }
}
}
diff --git a/csharp/ql/lib/semmle/code/csharp/controlflow/ControlFlowReachability.qll b/csharp/ql/lib/semmle/code/csharp/controlflow/ControlFlowReachability.qll
index aafe14402c7f..4ec4dad9e1be 100644
--- a/csharp/ql/lib/semmle/code/csharp/controlflow/ControlFlowReachability.qll
+++ b/csharp/ql/lib/semmle/code/csharp/controlflow/ControlFlowReachability.qll
@@ -4,16 +4,13 @@
import csharp
private import codeql.controlflow.ControlFlowReachability
-private import semmle.code.csharp.controlflow.BasicBlocks
private import semmle.code.csharp.controlflow.Guards as Guards
private import semmle.code.csharp.ExprOrStmtParent
-private module ControlFlowInput implements
- InputSig
-{
+private module ControlFlowInput implements InputSig {
private import csharp as CS
- AstNode getEnclosingAstNode(ControlFlow::Node node) {
+ AstNode getEnclosingAstNode(ControlFlowNode node) {
node.getAstNode() = result
or
not exists(node.getAstNode()) and result = node.getEnclosingCallable()
@@ -29,17 +26,7 @@ private module ControlFlowInput implements
class Expr = CS::Expr;
- class SourceVariable = Ssa::SourceVariable;
-
- class SsaDefinition = Ssa::Definition;
-
- class SsaExplicitWrite extends SsaDefinition instanceof Ssa::ExplicitDefinition {
- Expr getValue() { result = super.getADefinition().getSource() }
- }
-
- class SsaPhiDefinition = Ssa::PhiNode;
-
- class SsaUncertainWrite = Ssa::UncertainDefinition;
+ import Ssa
class GuardValue = Guards::GuardValue;
diff --git a/csharp/ql/lib/semmle/code/csharp/controlflow/Guards.qll b/csharp/ql/lib/semmle/code/csharp/controlflow/Guards.qll
index 03a5aa7e2b74..3353866e3343 100644
--- a/csharp/ql/lib/semmle/code/csharp/controlflow/Guards.qll
+++ b/csharp/ql/lib/semmle/code/csharp/controlflow/Guards.qll
@@ -7,20 +7,16 @@ private import ControlFlow
private import semmle.code.csharp.commons.Assertions
private import semmle.code.csharp.commons.ComparisonTest
private import semmle.code.csharp.commons.StructuralComparison as SC
-private import semmle.code.csharp.controlflow.BasicBlocks
-private import semmle.code.csharp.controlflow.internal.Completion
private import semmle.code.csharp.frameworks.System
private import semmle.code.csharp.frameworks.system.Linq
private import semmle.code.csharp.frameworks.system.Collections
private import semmle.code.csharp.frameworks.system.collections.Generic
private import codeql.controlflow.Guards as SharedGuards
-private module GuardsInput implements
- SharedGuards::InputSig
-{
+private module GuardsInput implements SharedGuards::InputSig {
private import csharp as CS
- class NormalExitNode = ControlFlow::Nodes::NormalExitNode;
+ class NormalExitNode = ControlFlow::NormalExitNode;
class AstNode = ControlFlowElement;
@@ -60,25 +56,16 @@ private module GuardsInput implements
override boolean asBooleanValue() { boolConst(this, result) }
}
- private predicate intConst(Expr e, int i) {
- e.getValue().toInt() = i and
- (
- e.getType() instanceof Enum
- or
- e.getType() instanceof IntegralType
- )
- }
-
private class IntegerConstant extends ConstantExpr {
- IntegerConstant() { intConst(this, _) }
+ IntegerConstant() { exists(this.getIntValue()) }
- override int asIntegerValue() { intConst(this, result) }
+ override int asIntegerValue() { result = this.getIntValue() }
}
private class EnumConst extends ConstantExpr {
EnumConst() { this.getType() instanceof Enum and this.hasValue() }
- override int asIntegerValue() { result = this.getValue().toInt() }
+ override int asIntegerValue() { result = this.getIntValue() }
}
private class StringConstant extends ConstantExpr instanceof StringLiteral {
@@ -96,21 +83,14 @@ private module GuardsInput implements
ConstantExpr asConstantCase() { super.getPattern() = result }
- private predicate hasEdge(BasicBlock bb1, BasicBlock bb2, MatchingCompletion c) {
- exists(PatternExpr pe |
- super.getPattern() = pe and
- c.isValidFor(pe) and
- bb1.getLastNode() = pe.getAControlFlowNode() and
- bb1.getASuccessor(c.getAMatchingSuccessorType()) = bb2
- )
- }
-
predicate matchEdge(BasicBlock bb1, BasicBlock bb2) {
- exists(MatchingCompletion c | this.hasEdge(bb1, bb2, c) and c.isMatch())
+ bb1.getASuccessor(any(MatchingSuccessor s | s.getValue() = true)) = bb2 and
+ bb1.getLastNode() = super.getPattern().getControlFlowNode()
}
predicate nonMatchEdge(BasicBlock bb1, BasicBlock bb2) {
- exists(MatchingCompletion c | this.hasEdge(bb1, bb2, c) and c.isNonMatch())
+ bb1.getASuccessor(any(MatchingSuccessor s | s.getValue() = false)) = bb2 and
+ bb1.getLastNode() = super.getPattern().getControlFlowNode()
}
}
@@ -136,7 +116,7 @@ private module GuardsInput implements
IdExpr() { this instanceof AssignExpr or this instanceof CastExpr }
Expr getEqualChildExpr() {
- result = this.(AssignExpr).getRValue()
+ result = this.(AssignExpr).getRightOperand()
or
result = this.(CastExpr).getExpr()
}
@@ -211,23 +191,7 @@ private module GuardsImpl = SharedGuards::Make;
class GuardValue = GuardsImpl::GuardValue;
private module LogicInput implements GuardsImpl::LogicInputSig {
- class SsaDefinition extends Ssa::Definition {
- Expr getARead() { super.getARead() = result }
- }
-
- class SsaExplicitWrite extends SsaDefinition instanceof Ssa::ExplicitDefinition {
- Expr getValue() { result = super.getADefinition().getSource() }
- }
-
- class SsaPhiDefinition extends SsaDefinition instanceof Ssa::PhiNode {
- predicate hasInputFromBlock(SsaDefinition inp, BasicBlock bb) {
- super.hasInputFromBlock(inp, bb)
- }
- }
-
- class SsaParameterInit extends SsaDefinition instanceof Ssa::ImplicitParameterDefinition {
- Parameter getParameter() { result = super.getParameter() }
- }
+ import Ssa
predicate additionalNullCheck(GuardsImpl::PreGuard guard, GuardValue val, Expr e, boolean isNull) {
// Comparison with a non-`null` value, for example `x?.Length > 0`
@@ -322,7 +286,7 @@ class Guard extends Guards::Guard {
* In case `cfn` or `sub` access an SSA variable in their left-most qualifier, then
* so must the other (accessing the same SSA variable).
*/
- predicate controlsNode(ControlFlow::Nodes::ElementNode cfn, AccessOrCallExpr sub, GuardValue v) {
+ predicate controlsNode(ControlFlowNodes::ElementNode cfn, AccessOrCallExpr sub, GuardValue v) {
isGuardedByNode(cfn, this, sub, v)
}
@@ -332,7 +296,7 @@ class Guard extends Guards::Guard {
* Note: This predicate is inlined.
*/
pragma[inline]
- predicate controlsNode(ControlFlow::Nodes::ElementNode cfn, GuardValue v) {
+ predicate controlsNode(ControlFlowNodes::ElementNode cfn, GuardValue v) {
guardControls(this, cfn.getBasicBlock(), v)
}
@@ -450,7 +414,8 @@ class DereferenceableExpr extends Expr {
predicate guardSuggestsMaybeNull(Guards::Guard guard) {
not nonNullValueImplied(this) and
(
- exists(NullnessCompletion c | c.isValidFor(this) and c.isNull() and guard = this)
+ exists(guard.getControlFlowNode().getASuccessor(any(NullnessSuccessor n | n.isNull()))) and
+ guard = this
or
LogicInput::additionalNullCheck(guard, _, this, true)
or
@@ -517,35 +482,35 @@ class EnumerableCollectionExpr extends Expr {
|
// x.Length == 0
ct.getComparisonKind().isEquality() and
- ct.getAnArgument().getValue().toInt() = 0 and
+ ct.getAnArgument().getIntValue() = 0 and
branch = isEmpty
or
// x.Length == k, k > 0
ct.getComparisonKind().isEquality() and
- ct.getAnArgument().getValue().toInt() > 0 and
+ ct.getAnArgument().getIntValue() > 0 and
branch = true and
isEmpty = false
or
// x.Length != 0
ct.getComparisonKind().isInequality() and
- ct.getAnArgument().getValue().toInt() = 0 and
+ ct.getAnArgument().getIntValue() = 0 and
branch = isEmpty.booleanNot()
or
// x.Length != k, k != 0
ct.getComparisonKind().isInequality() and
- ct.getAnArgument().getValue().toInt() != 0 and
+ ct.getAnArgument().getIntValue() != 0 and
branch = false and
isEmpty = false
or
// x.Length > k, k >= 0
ct.getComparisonKind().isLessThan() and
- ct.getFirstArgument().getValue().toInt() >= 0 and
+ ct.getFirstArgument().getIntValue() >= 0 and
branch = true and
isEmpty = false
or
// x.Length >= k, k > 0
ct.getComparisonKind().isLessThanEquals() and
- ct.getFirstArgument().getValue().toInt() > 0 and
+ ct.getFirstArgument().getIntValue() > 0 and
branch = true and
isEmpty = false
)
@@ -605,7 +570,7 @@ class AccessOrCallExpr extends Expr {
* An expression can have more than one SSA qualifier in the presence
* of control flow splitting.
*/
- Ssa::Definition getAnSsaQualifier(ControlFlow::Node cfn) { result = getAnSsaQualifier(this, cfn) }
+ SsaDefinition getAnSsaQualifier(ControlFlowNode cfn) { result = getAnSsaQualifier(this, cfn) }
}
private Declaration getDeclarationTarget(Expr e) {
@@ -613,22 +578,22 @@ private Declaration getDeclarationTarget(Expr e) {
result = e.(Call).getTarget()
}
-private Ssa::Definition getAnSsaQualifier(Expr e, ControlFlow::Node cfn) {
+private SsaDefinition getAnSsaQualifier(Expr e, ControlFlowNode cfn) {
e = getATrackedAccess(result, cfn)
or
not e = getATrackedAccess(_, _) and
result = getAnSsaQualifier(e.(QualifiableExpr).getQualifier(), cfn)
}
-private AssignableAccess getATrackedAccess(Ssa::Definition def, ControlFlow::Node cfn) {
- result = def.getAReadAtNode(cfn)
+private AssignableAccess getATrackedAccess(SsaDefinition def, ControlFlowNode cfn) {
+ result = def.getARead() and cfn = result.getControlFlowNode()
or
- result = def.(Ssa::ExplicitDefinition).getADefinition().getTargetAccess() and
+ result = def.(SsaExplicitWrite).getDefinition().getTargetAccess() and
cfn = def.getControlFlowNode()
}
private predicate ssaMustHaveValue(Expr e, GuardValue v) {
- exists(Ssa::Definition def, BasicBlock bb |
+ exists(SsaDefinition def, BasicBlock bb |
e = def.getARead() and
e.getBasicBlock() = bb and
Guards::ssaControls(def, bb, v)
@@ -729,7 +694,7 @@ class GuardedExpr extends AccessOrCallExpr {
* In the example above, the node for `x.ToString()` is null-guarded in the
* split `b == true`, but not in the split `b == false`.
*/
-class GuardedControlFlowNode extends ControlFlow::Nodes::ElementNode {
+class GuardedControlFlowNode extends ControlFlowNodes::ElementNode {
private Guard g;
private AccessOrCallExpr sub0;
private GuardValue v0;
@@ -785,7 +750,7 @@ class GuardedDataFlowNode extends DataFlow::ExprNode {
private GuardValue v0;
GuardedDataFlowNode() {
- exists(ControlFlow::Nodes::ElementNode cfn | exists(this.getExprAtNode(cfn)) |
+ exists(ControlFlowNodes::ElementNode cfn | exists(this.getExprAtNode(cfn)) |
g.controlsNode(cfn, sub0, v0)
)
}
@@ -836,7 +801,7 @@ module Internal {
/** Holds if expression `e2` is a `null` value whenever `e1` is. */
predicate nullValueImpliedUnary(Expr e1, Expr e2) {
- e1 = e2.(AssignExpr).getRValue()
+ e1 = e2.(AssignExpr).getRightOperand()
or
e1 = e2.(Cast).getExpr()
or
@@ -860,14 +825,12 @@ module Internal {
)
or
e =
- any(Ssa::Definition def |
- forex(Ssa::Definition u | u = def.getAnUltimateDefinition() | nullDef(u))
+ any(SsaDefinition def |
+ forex(SsaDefinition u | u = def.getAnUltimateDefinition() | nullDef(u))
).getARead()
}
- private predicate nullDef(Ssa::ExplicitDefinition def) {
- nullValueImplied(def.getADefinition().getSource())
- }
+ private predicate nullDef(SsaExplicitWrite def) { nullValueImplied(def.getValue()) }
predicate nonNullValueImplied(Expr e) {
nonNullValue(e)
@@ -875,14 +838,12 @@ module Internal {
exists(Expr e1 | nonNullValueImplied(e1) and nonNullValueImpliedUnary(e1, e))
or
e =
- any(Ssa::Definition def |
- forex(Ssa::Definition u | u = def.getAnUltimateDefinition() | nonNullDef(u))
+ any(SsaDefinition def |
+ forex(SsaDefinition u | u = def.getAnUltimateDefinition() | nonNullDef(u))
).getARead()
}
- private predicate nonNullDef(Ssa::ExplicitDefinition def) {
- nonNullValueImplied(def.getADefinition().getSource())
- }
+ private predicate nonNullDef(SsaExplicitWrite def) { nonNullValueImplied(def.getValue()) }
/** A callable that always returns a non-`null` value. */
private class NonNullCallable extends Callable {
@@ -923,7 +884,7 @@ module Internal {
/** Holds if expression `e2` is a non-`null` value whenever `e1` is. */
predicate nonNullValueImpliedUnary(Expr e1, Expr e2) {
e1 = e2.(CastExpr).getExpr() or
- e1 = e2.(AssignExpr).getRValue() or
+ e1 = e2.(AssignExpr).getRightOperand() or
e1 = e2.(NullCoalescingOperation).getAnOperand()
}
@@ -1083,7 +1044,7 @@ module Internal {
candidateAux(x, d, bb) and
y =
any(AccessOrCallExpr e |
- e.getAControlFlowNode().getBasicBlock() = bb and
+ e.getControlFlowNode().getBasicBlock() = bb and
e.getTarget() = d
)
)
@@ -1115,11 +1076,11 @@ module Internal {
pragma[nomagic]
private predicate nodeIsGuardedBySameSubExpr0(
- ControlFlow::Node guardedCfn, BasicBlock guardedBB, AccessOrCallExpr guarded, Guard g,
+ ControlFlowNode guardedCfn, BasicBlock guardedBB, AccessOrCallExpr guarded, Guard g,
AccessOrCallExpr sub, GuardValue v
) {
Stages::GuardsStage::forceCachingInSameStage() and
- guardedCfn = guarded.getAControlFlowNode() and
+ guardedCfn = guarded.getControlFlowNode() and
guardedBB = guardedCfn.getBasicBlock() and
guardControls(g, guardedBB, v) and
guardControlsSubSame(g, guardedBB, sub) and
@@ -1128,7 +1089,7 @@ module Internal {
pragma[nomagic]
private predicate nodeIsGuardedBySameSubExpr(
- ControlFlow::Node guardedCfn, BasicBlock guardedBB, AccessOrCallExpr guarded, Guard g,
+ ControlFlowNode guardedCfn, BasicBlock guardedBB, AccessOrCallExpr guarded, Guard g,
AccessOrCallExpr sub, GuardValue v
) {
nodeIsGuardedBySameSubExpr0(guardedCfn, guardedBB, guarded, g, sub, v) and
@@ -1137,9 +1098,9 @@ module Internal {
pragma[nomagic]
private predicate nodeIsGuardedBySameSubExprSsaDef0(
- ControlFlow::Node cfn, BasicBlock guardedBB, AccessOrCallExpr guarded, Guard g,
- ControlFlow::Node subCfn, BasicBlock subCfnBB, AccessOrCallExpr sub, GuardValue v,
- Ssa::Definition def
+ ControlFlowNode cfn, BasicBlock guardedBB, AccessOrCallExpr guarded, Guard g,
+ ControlFlowNode subCfn, BasicBlock subCfnBB, AccessOrCallExpr sub, GuardValue v,
+ SsaDefinition def
) {
nodeIsGuardedBySameSubExpr(cfn, guardedBB, guarded, g, sub, v) and
def = sub.getAnSsaQualifier(subCfn) and
@@ -1148,8 +1109,8 @@ module Internal {
pragma[nomagic]
private predicate nodeIsGuardedBySameSubExprSsaDef(
- ControlFlow::Node guardedCfn, AccessOrCallExpr guarded, Guard g, ControlFlow::Node subCfn,
- AccessOrCallExpr sub, GuardValue v, Ssa::Definition def
+ ControlFlowNode guardedCfn, AccessOrCallExpr guarded, Guard g, ControlFlowNode subCfn,
+ AccessOrCallExpr sub, GuardValue v, SsaDefinition def
) {
exists(BasicBlock guardedBB, BasicBlock subCfnBB |
nodeIsGuardedBySameSubExprSsaDef0(guardedCfn, guardedBB, guarded, g, subCfn, subCfnBB, sub,
@@ -1162,15 +1123,13 @@ module Internal {
private predicate isGuardedByExpr0(
AccessOrCallExpr guarded, Guard g, AccessOrCallExpr sub, GuardValue v
) {
- forex(ControlFlow::Node cfn | cfn = guarded.getAControlFlowNode() |
- nodeIsGuardedBySameSubExpr(cfn, _, guarded, g, sub, v)
- )
+ nodeIsGuardedBySameSubExpr(guarded.getControlFlowNode(), _, guarded, g, sub, v)
}
cached
predicate isGuardedByExpr(AccessOrCallExpr guarded, Guard g, AccessOrCallExpr sub, GuardValue v) {
isGuardedByExpr0(guarded, g, sub, v) and
- forall(ControlFlow::Node subCfn, Ssa::Definition def |
+ forall(ControlFlowNode subCfn, SsaDefinition def |
nodeIsGuardedBySameSubExprSsaDef(_, guarded, g, subCfn, sub, v, def)
|
def = guarded.getAnSsaQualifier(_)
@@ -1179,17 +1138,14 @@ module Internal {
cached
predicate isGuardedByNode(
- ControlFlow::Nodes::ElementNode guarded, Guard g, AccessOrCallExpr sub, GuardValue v
+ ControlFlowNodes::ElementNode guarded, Guard g, AccessOrCallExpr sub, GuardValue v
) {
nodeIsGuardedBySameSubExpr(guarded, _, _, g, sub, v) and
- forall(ControlFlow::Node subCfn, Ssa::Definition def |
+ forall(ControlFlowNode subCfn, SsaDefinition def |
nodeIsGuardedBySameSubExprSsaDef(guarded, _, g, subCfn, sub, v, def)
|
def =
- guarded
- .getAstNode()
- .(AccessOrCallExpr)
- .getAnSsaQualifier(guarded.getBasicBlock().getANode())
+ guarded.asExpr().(AccessOrCallExpr).getAnSsaQualifier(guarded.getBasicBlock().getANode())
)
}
}
diff --git a/csharp/ql/lib/semmle/code/csharp/controlflow/internal/Completion.qll b/csharp/ql/lib/semmle/code/csharp/controlflow/internal/Completion.qll
deleted file mode 100644
index e734e79402bf..000000000000
--- a/csharp/ql/lib/semmle/code/csharp/controlflow/internal/Completion.qll
+++ /dev/null
@@ -1,896 +0,0 @@
-/**
- * INTERNAL: Do not use.
- *
- * Provides classes representing control flow completions.
- *
- * A completion represents how a statement or expression terminates.
- *
- * There are six kinds of completions: normal completion,
- * `return` completion, `break` completion, `continue` completion,
- * `goto` completion, and `throw` completion.
- *
- * Normal completions are further subdivided into Boolean completions and all
- * other normal completions. A Boolean completion adds the information that the
- * expression terminated with the given boolean value due to a subexpression
- * terminating with the other given Boolean value. This is only relevant for
- * conditional contexts in which the value controls the control-flow successor.
- *
- * Goto successors are further subdivided into label gotos, case gotos, and
- * default gotos.
- */
-
-import csharp
-private import semmle.code.csharp.commons.Assertions
-private import semmle.code.csharp.commons.Constants
-private import semmle.code.csharp.frameworks.System
-private import ControlFlowGraphImpl
-private import NonReturning
-private import SuccessorType
-
-private newtype TCompletion =
- TSimpleCompletion() or
- TBooleanCompletion(boolean b) { b = true or b = false } or
- TNullnessCompletion(boolean isNull) { isNull = true or isNull = false } or
- TMatchingCompletion(boolean isMatch) { isMatch = true or isMatch = false } or
- TEmptinessCompletion(boolean isEmpty) { isEmpty = true or isEmpty = false } or
- TReturnCompletion() or
- TBreakCompletion() or
- TContinueCompletion() or
- TGotoCompletion(string label) { label = any(GotoStmt gs).getLabel() } or
- TThrowCompletion(ExceptionClass ec) or
- TExitCompletion() or
- TNestedCompletion(Completion inner, Completion outer, int nestLevel) {
- inner = TBreakCompletion() and
- outer instanceof NonNestedNormalCompletion and
- nestLevel = 0
- or
- inner instanceof NormalCompletion and
- nestedFinallyCompletion(outer, nestLevel)
- }
-
-pragma[nomagic]
-private int getAFinallyNestLevel() { result = any(Statements::TryStmtTree t).nestLevel() }
-
-pragma[nomagic]
-private predicate nestedFinallyCompletion(Completion outer, int nestLevel) {
- (
- outer = TReturnCompletion()
- or
- outer = TBreakCompletion()
- or
- outer = TContinueCompletion()
- or
- outer = TGotoCompletion(_)
- or
- outer = TThrowCompletion(_)
- or
- outer = TExitCompletion()
- ) and
- nestLevel = getAFinallyNestLevel()
-}
-
-pragma[noinline]
-private predicate completionIsValidForStmt(Stmt s, Completion c) {
- s instanceof BreakStmt and
- c = TBreakCompletion()
- or
- s instanceof ContinueStmt and
- c = TContinueCompletion()
- or
- s instanceof GotoStmt and
- c = TGotoCompletion(s.(GotoStmt).getLabel())
- or
- s instanceof ReturnStmt and
- c = TReturnCompletion()
- or
- s instanceof YieldBreakStmt and
- // `yield break` behaves like a return statement
- c = TReturnCompletion()
- or
- mustHaveEmptinessCompletion(s) and
- c = TEmptinessCompletion(_)
-}
-
-/**
- * A completion of a statement or an expression.
- */
-abstract class Completion extends TCompletion {
- /**
- * Holds if this completion is valid for control flow element `cfe`.
- *
- * If `cfe` is part of a `try` statement and `cfe` may throw an exception, this
- * completion can be a throw completion.
- *
- * If `cfe` is used in a Boolean context, this completion is a Boolean completion,
- * otherwise it is a normal non-Boolean completion.
- */
- predicate isValidFor(ControlFlowElement cfe) {
- this = cfe.(NonReturningCall).getACompletion()
- or
- this = TThrowCompletion(cfe.(TriedControlFlowElement).getAThrownException())
- or
- cfe instanceof ThrowElement and
- this = TThrowCompletion(cfe.(ThrowElement).getThrownExceptionType())
- or
- this = assertionCompletion(cfe, _)
- or
- completionIsValidForStmt(cfe, this)
- or
- mustHaveBooleanCompletion(cfe) and
- (
- exists(boolean value | isBooleanConstant(cfe, value) | this = TBooleanCompletion(value))
- or
- not isBooleanConstant(cfe, _) and
- this = TBooleanCompletion(_)
- or
- // Corner case: In `if (x ?? y) { ... }`, `x` must have both a `true`
- // completion, a `false` completion, and a `null` completion (but not a
- // non-`null` completion)
- mustHaveNullnessCompletion(cfe) and
- this = TNullnessCompletion(true)
- )
- or
- mustHaveNullnessCompletion(cfe) and
- not mustHaveBooleanCompletion(cfe) and
- (
- exists(boolean value | isNullnessConstant(cfe, value) | this = TNullnessCompletion(value))
- or
- not isNullnessConstant(cfe, _) and
- this = TNullnessCompletion(_)
- )
- or
- mustHaveMatchingCompletion(cfe) and
- (
- exists(boolean value | isMatchingConstant(cfe, value) | this = TMatchingCompletion(value))
- or
- not isMatchingConstant(cfe, _) and
- this = TMatchingCompletion(_)
- )
- or
- not cfe instanceof NonReturningCall and
- not cfe instanceof ThrowElement and
- not cfe instanceof BreakStmt and
- not cfe instanceof ContinueStmt and
- not cfe instanceof GotoStmt and
- not cfe instanceof ReturnStmt and
- not cfe instanceof YieldBreakStmt and
- not mustHaveBooleanCompletion(cfe) and
- not mustHaveNullnessCompletion(cfe) and
- not mustHaveMatchingCompletion(cfe) and
- not mustHaveEmptinessCompletion(cfe) and
- this = TSimpleCompletion()
- }
-
- /**
- * Holds if this completion will continue a loop when it is the completion
- * of a loop body.
- */
- predicate continuesLoop() {
- this instanceof NormalCompletion or
- this instanceof ContinueCompletion
- }
-
- /**
- * Gets the inner completion. This is either the inner completion,
- * when the completion is nested, or the completion itself.
- */
- Completion getInnerCompletion() { result = this }
-
- /**
- * Gets the outer completion. This is either the outer completion,
- * when the completion is nested, or the completion itself.
- */
- Completion getOuterCompletion() { result = this }
-
- /** Gets a successor type that matches this completion. */
- abstract SuccessorType getAMatchingSuccessorType();
-
- /** Gets a textual representation of this completion. */
- abstract string toString();
-}
-
-/** Holds if expression `e` has the Boolean constant value `value`. */
-private predicate isBooleanConstant(Expr e, boolean value) {
- mustHaveBooleanCompletion(e) and
- (
- e.getValue() = "true" and
- value = true
- or
- e.getValue() = "false" and
- value = false
- or
- isConstantComparison(e, value)
- or
- exists(Method m, Call c, Expr expr |
- m = any(SystemStringClass s).getIsNullOrEmptyMethod() and
- c.getTarget() = m and
- e = c and
- expr = c.getArgument(0) and
- expr.hasValue() and
- if expr.getValue().length() > 0 and not expr instanceof NullLiteral
- then value = false
- else value = true
- )
- )
-}
-
-/**
- * Holds if expression `e` is constantly `null` (`value = true`) or constantly
- * non-`null` (`value = false`).
- */
-private predicate isNullnessConstant(Expr e, boolean value) {
- mustHaveNullnessCompletion(e) and
- exists(Expr stripped | stripped = e.stripCasts() |
- stripped.getType() =
- any(ValueType t |
- not t instanceof NullableType and
- // Extractor bug: the type of `x?.Length` is reported as `int`, but it should
- // be `int?`
- not getQualifier*(stripped).(QualifiableExpr).isConditional()
- ) and
- value = false
- or
- stripped instanceof NullLiteral and
- value = true
- or
- stripped.hasValue() and
- not stripped instanceof NullLiteral and
- value = false
- )
-}
-
-private Expr getQualifier(QualifiableExpr e) {
- // `e.getQualifier()` does not work for calls to extension methods
- result = e.getChildExpr(-1)
-}
-
-pragma[noinline]
-private predicate typePatternMustHaveMatchingCompletion(
- TypePatternExpr tpe, Type t, Type strippedType
-) {
- exists(Expr e, Expr stripped | mustHaveMatchingCompletion(e, tpe) |
- stripped = e.stripCasts() and
- t = tpe.getCheckedType() and
- strippedType = stripped.getType() and
- not t.containsTypeParameters() and
- not strippedType.containsTypeParameters()
- )
-}
-
-pragma[noinline]
-private Type typePatternCommonSubTypeLeft(Type t) {
- typePatternMustHaveMatchingCompletion(_, t, _) and
- result.isImplicitlyConvertibleTo(t) and
- not result instanceof DynamicType
-}
-
-pragma[noinline]
-private Type typePatternCommonSubTypeRight(Type strippedType) {
- typePatternMustHaveMatchingCompletion(_, _, strippedType) and
- result.isImplicitlyConvertibleTo(strippedType) and
- not result instanceof DynamicType
-}
-
-pragma[noinline]
-private predicate typePatternCommonSubType(Type t, Type strippedType) {
- typePatternCommonSubTypeLeft(t) = typePatternCommonSubTypeRight(strippedType)
-}
-
-/**
- * Holds if pattern expression `pe` constantly matches (`value = true`) or
- * constantly non-matches (`value = false`).
- */
-private predicate isMatchingConstant(PatternExpr pe, boolean value) {
- exists(Expr e, string exprValue, string patternValue |
- mustHaveMatchingCompletion(e, pe) and
- exprValue = e.stripCasts().getValue() and
- patternValue = pe.getValue() and
- if exprValue = patternValue then value = true else value = false
- )
- or
- pe instanceof DiscardPatternExpr and
- value = true
- or
- exists(Type t, Type strippedType |
- not t instanceof UnknownType and
- not strippedType instanceof UnknownType and
- typePatternMustHaveMatchingCompletion(pe, t, strippedType) and
- not typePatternCommonSubType(t, strippedType) and
- value = false
- )
-}
-
-private class Overflowable extends UnaryOperation {
- Overflowable() {
- not this instanceof UnaryBitwiseOperation and
- this.getType() instanceof IntegralType
- }
-}
-
-/** A control flow element that is inside a `try` block. */
-private class TriedControlFlowElement extends ControlFlowElement {
- TriedControlFlowElement() {
- this = any(TryStmt try).getATriedElement() and
- not this instanceof NonReturningCall
- }
-
- /**
- * Gets an exception class that is potentially thrown by this element, if any.
- */
- Class getAThrownException() {
- this instanceof Overflowable and
- result instanceof SystemOverflowExceptionClass
- or
- this.(CastExpr).getType() instanceof IntegralType and
- result instanceof SystemOverflowExceptionClass
- or
- invalidCastCandidate(this) and
- result instanceof SystemInvalidCastExceptionClass
- or
- this instanceof Call and
- result instanceof SystemExceptionClass
- or
- this =
- any(MemberAccess ma |
- not ma.isConditional() and
- ma.getQualifier() = any(Expr e | not e instanceof TypeAccess) and
- result instanceof SystemNullReferenceExceptionClass
- )
- or
- this instanceof DelegateCreation and
- result instanceof SystemOutOfMemoryExceptionClass
- or
- this instanceof ArrayCreation and
- result instanceof SystemOutOfMemoryExceptionClass
- or
- this =
- any(AddOperation ae |
- ae.getType() instanceof StringType and
- result instanceof SystemOutOfMemoryExceptionClass
- or
- ae.getType() instanceof IntegralType and
- result instanceof SystemOverflowExceptionClass
- )
- or
- this =
- any(SubOperation se |
- se.getType() instanceof IntegralType and
- result instanceof SystemOverflowExceptionClass
- )
- or
- this =
- any(MulOperation me |
- me.getType() instanceof IntegralType and
- result instanceof SystemOverflowExceptionClass
- )
- or
- this =
- any(DivOperation de |
- not de.getDenominator().getValue().toFloat() != 0 and
- result instanceof SystemDivideByZeroExceptionClass
- )
- or
- this instanceof RemOperation and
- result instanceof SystemDivideByZeroExceptionClass
- or
- this instanceof DynamicExpr and
- result instanceof SystemExceptionClass
- }
-}
-
-pragma[nomagic]
-private ValueOrRefType getACastExprBaseType(CastExpr ce) {
- result = ce.getType().(ValueOrRefType).getABaseType()
- or
- result = getACastExprBaseType(ce).getABaseType()
-}
-
-pragma[nomagic]
-private predicate invalidCastCandidate(CastExpr ce) {
- ce.getExpr().getType() = getACastExprBaseType(ce)
-}
-
-/** Gets a valid completion when argument `i` fails in assertion `a`. */
-Completion assertionCompletion(Assertion a, int i) {
- exists(AssertMethod am | am = a.getAssertMethod() |
- if am.getAssertionFailure(i).isExit()
- then result = TExitCompletion()
- else
- exists(Class c |
- am.getAssertionFailure(i).isException(c) and
- result = TThrowCompletion(c)
- )
- )
-}
-
-/**
- * Holds if a normal completion of `e` must be a Boolean completion.
- */
-private predicate mustHaveBooleanCompletion(Expr e) {
- inBooleanContext(e) and
- not e instanceof NonReturningCall
-}
-
-/**
- * Holds if `e` is used in a Boolean context. That is, whether the value
- * that `e` evaluates to determines a true/false branch successor.
- */
-private predicate inBooleanContext(Expr e) {
- e = any(IfStmt is).getCondition()
- or
- e = any(LoopStmt ls).getCondition()
- or
- e = any(Case c).getCondition()
- or
- e = any(SpecificCatchClause scc).getFilterClause()
- or
- e = any(LogicalNotExpr lne | inBooleanContext(lne)).getAnOperand()
- or
- exists(LogicalAndExpr lae |
- lae.getLeftOperand() = e
- or
- inBooleanContext(lae) and
- lae.getRightOperand() = e
- )
- or
- exists(LogicalOrExpr lae |
- lae.getLeftOperand() = e
- or
- inBooleanContext(lae) and
- lae.getRightOperand() = e
- )
- or
- exists(ConditionalExpr ce |
- ce.getCondition() = e
- or
- inBooleanContext(ce) and
- e in [ce.getThen(), ce.getElse()]
- )
- or
- e = any(NullCoalescingOperation nce | inBooleanContext(nce)).getAnOperand()
- or
- e = any(SwitchExpr se | inBooleanContext(se)).getACase()
- or
- e = any(SwitchCaseExpr sce | inBooleanContext(sce)).getBody()
-}
-
-/**
- * Holds if a normal completion of `e` must be a nullness completion.
- */
-private predicate mustHaveNullnessCompletion(Expr e) {
- inNullnessContext(e) and
- not e instanceof NonReturningCall
-}
-
-/**
- * Holds if `e` is used in a nullness context. That is, whether the value
- * that `e` evaluates to determines a `null`/non-`null` branch successor.
- */
-private predicate inNullnessContext(Expr e) {
- e = any(NullCoalescingOperation nce).getLeftOperand()
- or
- exists(QualifiableExpr qe | qe.isConditional() | e = qe.getChildExpr(-1))
- or
- exists(ConditionalExpr ce | inNullnessContext(ce) | (e = ce.getThen() or e = ce.getElse()))
- or
- exists(NullCoalescingOperation nce | inNullnessContext(nce) | e = nce.getRightOperand())
- or
- e = any(SwitchExpr se | inNullnessContext(se)).getACase()
- or
- e = any(SwitchCaseExpr sce | inNullnessContext(sce)).getBody()
-}
-
-/**
- * Holds if `pe` is the pattern inside case `c`, belonging to `switch` `s`, that
- * has the matching completion.
- */
-predicate switchMatching(Switch s, Case c, PatternExpr pe) {
- s.getACase() = c and
- pe = c.getPattern()
-}
-
-/**
- * Holds if a normal completion of `cfe` must be a matching completion. Thats is,
- * whether `cfe` determines a match in a `switch/if` statement or `catch` clause.
- */
-private predicate mustHaveMatchingCompletion(ControlFlowElement cfe) {
- switchMatching(_, _, cfe)
- or
- cfe instanceof SpecificCatchClause
- or
- cfe = any(IsExpr ie | inBooleanContext(ie)).getPattern()
- or
- cfe = any(RecursivePatternExpr rpe).getAChildExpr()
- or
- cfe = any(PositionalPatternExpr ppe).getPattern(_)
- or
- cfe = any(PropertyPatternExpr ppe).getPattern(_)
- or
- cfe = any(UnaryPatternExpr upe | mustHaveMatchingCompletion(upe)).getPattern()
- or
- cfe = any(BinaryPatternExpr bpe).getAnOperand()
-}
-
-/**
- * Holds if `pe` must have a matching completion, and `e` is the expression
- * that is being matched.
- */
-private predicate mustHaveMatchingCompletion(Expr e, PatternExpr pe) {
- exists(Switch s |
- switchMatching(s, _, pe) and
- e = s.getExpr()
- )
- or
- e = any(IsExpr ie | pe = ie.getPattern()).getExpr() and
- mustHaveMatchingCompletion(pe)
- or
- exists(PatternExpr mid | mustHaveMatchingCompletion(e, mid) |
- pe = mid.(UnaryPatternExpr).getPattern()
- or
- pe = mid.(RecursivePatternExpr).getAChildExpr()
- or
- pe = mid.(BinaryPatternExpr).getAnOperand()
- )
-}
-
-/**
- * Holds if `cfe` is the element inside foreach statement `fs` that has the emptiness
- * completion.
- */
-predicate foreachEmptiness(ForeachStmt fs, ControlFlowElement cfe) {
- cfe = fs // use `foreach` statement itself to represent the emptiness test
-}
-
-/**
- * Holds if a normal completion of `cfe` must be an emptiness completion. Thats is,
- * whether `cfe` determines whether to execute the body of a `foreach` statement.
- */
-private predicate mustHaveEmptinessCompletion(ControlFlowElement cfe) { foreachEmptiness(_, cfe) }
-
-/**
- * A completion that represents normal evaluation of a statement or an
- * expression.
- */
-abstract class NormalCompletion extends Completion { }
-
-abstract private class NonNestedNormalCompletion extends NormalCompletion { }
-
-/** A simple (normal) completion. */
-class SimpleCompletion extends NonNestedNormalCompletion, TSimpleCompletion {
- override DirectSuccessor getAMatchingSuccessorType() { any() }
-
- override string toString() { result = "normal" }
-}
-
-/**
- * A completion that represents evaluation of an expression, whose value determines
- * the successor. Either a Boolean completion (`BooleanCompletion`), a nullness
- * completion (`NullnessCompletion`), a matching completion (`MatchingCompletion`),
- * or an emptiness completion (`EmptinessCompletion`).
- */
-abstract class ConditionalCompletion extends NonNestedNormalCompletion {
- /** Gets the Boolean value of this completion. */
- abstract boolean getValue();
-
- /** Gets the dual completion. */
- abstract ConditionalCompletion getDual();
-}
-
-/**
- * A completion that represents evaluation of an expression
- * with a Boolean value.
- */
-class BooleanCompletion extends ConditionalCompletion {
- private boolean value;
-
- BooleanCompletion() { this = TBooleanCompletion(value) }
-
- override boolean getValue() { result = value }
-
- override BooleanCompletion getDual() { result = TBooleanCompletion(value.booleanNot()) }
-
- override BooleanSuccessor getAMatchingSuccessorType() { result.getValue() = value }
-
- override string toString() { result = value.toString() }
-}
-
-/** A Boolean `true` completion. */
-class TrueCompletion extends BooleanCompletion {
- TrueCompletion() { this.getValue() = true }
-}
-
-/** A Boolean `false` completion. */
-class FalseCompletion extends BooleanCompletion {
- FalseCompletion() { this.getValue() = false }
-}
-
-/**
- * A completion that represents evaluation of an expression that is either
- * `null` or non-`null`.
- */
-class NullnessCompletion extends ConditionalCompletion, TNullnessCompletion {
- private boolean value;
-
- NullnessCompletion() { this = TNullnessCompletion(value) }
-
- /** Holds if the last sub expression of this expression evaluates to `null`. */
- predicate isNull() { value = true }
-
- /** Holds if the last sub expression of this expression evaluates to a non-`null` value. */
- predicate isNonNull() { value = false }
-
- override boolean getValue() { result = value }
-
- override NullnessCompletion getDual() { result = TNullnessCompletion(value.booleanNot()) }
-
- override NullnessSuccessor getAMatchingSuccessorType() { result.getValue() = value }
-
- override string toString() { if this.isNull() then result = "null" else result = "non-null" }
-}
-
-/**
- * A completion that represents matching, for example a `case` statement in a
- * `switch` statement.
- */
-class MatchingCompletion extends ConditionalCompletion, TMatchingCompletion {
- private boolean value;
-
- MatchingCompletion() { this = TMatchingCompletion(value) }
-
- /** Holds if there is a match. */
- predicate isMatch() { value = true }
-
- /** Holds if there is not a match. */
- predicate isNonMatch() { value = false }
-
- override boolean getValue() { result = value }
-
- override MatchingCompletion getDual() { result = TMatchingCompletion(value.booleanNot()) }
-
- override MatchingSuccessor getAMatchingSuccessorType() { result.getValue() = value }
-
- override string toString() { if this.isMatch() then result = "match" else result = "no-match" }
-}
-
-/**
- * A completion that represents evaluation of an emptiness test, for example
- * a test in a `foreach` statement.
- */
-class EmptinessCompletion extends ConditionalCompletion, TEmptinessCompletion {
- private boolean value;
-
- EmptinessCompletion() { this = TEmptinessCompletion(value) }
-
- /** Holds if the emptiness test evaluates to `true`. */
- predicate isEmpty() { value = true }
-
- override boolean getValue() { result = value }
-
- override EmptinessCompletion getDual() { result = TEmptinessCompletion(value.booleanNot()) }
-
- override EmptinessSuccessor getAMatchingSuccessorType() { result.getValue() = value }
-
- override string toString() { if this.isEmpty() then result = "empty" else result = "non-empty" }
-}
-
-/**
- * A nested completion. For example, in
- *
- * ```csharp
- * void M(bool b1, bool b2)
- * {
- * try
- * {
- * if (b1)
- * throw new Exception();
- * }
- * finally
- * {
- * if (b2)
- * System.Console.WriteLine("M called");
- * }
- * }
- * ```
- *
- * `b2` has an outer throw completion (inherited from `throw new Exception`)
- * and an inner `false` completion. `b2` also has a (normal) `true` completion.
- */
-class NestedCompletion extends Completion, TNestedCompletion {
- Completion inner;
- Completion outer;
- int nestLevel;
-
- NestedCompletion() { this = TNestedCompletion(inner, outer, nestLevel) }
-
- /** Gets a completion that is compatible with the inner completion. */
- Completion getAnInnerCompatibleCompletion() {
- result.getOuterCompletion() = this.getInnerCompletion()
- }
-
- /** Gets the level of this nested completion. */
- int getNestLevel() { result = nestLevel }
-
- override Completion getInnerCompletion() { result = inner }
-
- override Completion getOuterCompletion() { result = outer }
-
- override SuccessorType getAMatchingSuccessorType() { none() }
-
- override string toString() { result = outer + " [" + inner + "] (" + nestLevel + ")" }
-}
-
-/**
- * A nested completion for a loop that exists with a `break`.
- *
- * This completion is added for technical reasons only: when a loop
- * body can complete with a break completion, the loop itself completes
- * normally. However, if we choose `TSimpleCompletion` as the completion
- * of the loop, we lose the information that the last element actually
- * completed with a break, meaning that the control flow edge out of the
- * breaking node cannot be marked with a `break` label.
- *
- * Example:
- *
- * ```csharp
- * while (...) {
- * ...
- * break;
- * }
- * return;
- * ```
- *
- * The `break` on line 3 completes with a `TBreakCompletion`, therefore
- * the `while` loop can complete with a `NestedBreakCompletion`, so we
- * get an edge `break --break--> return`. (If we instead used a
- * `TSimpleCompletion`, we would get a less precise edge
- * `break --normal--> return`.)
- */
-class NestedBreakCompletion extends NormalCompletion, NestedCompletion {
- NestedBreakCompletion() {
- inner = TBreakCompletion() and
- outer instanceof NonNestedNormalCompletion
- }
-
- override BreakCompletion getInnerCompletion() { result = inner }
-
- override NonNestedNormalCompletion getOuterCompletion() { result = outer }
-
- override Completion getAnInnerCompatibleCompletion() {
- result = inner and
- outer = TSimpleCompletion()
- or
- result = TNestedCompletion(outer, inner, _)
- }
-
- override SuccessorType getAMatchingSuccessorType() {
- outer instanceof SimpleCompletion and
- result instanceof BreakSuccessor
- or
- result = outer.(ConditionalCompletion).getAMatchingSuccessorType()
- }
-}
-
-/**
- * A completion that represents evaluation of a statement or an
- * expression resulting in a return from a callable.
- */
-class ReturnCompletion extends Completion {
- ReturnCompletion() {
- this = TReturnCompletion() or
- this = TNestedCompletion(_, TReturnCompletion(), _)
- }
-
- override ReturnSuccessor getAMatchingSuccessorType() { any() }
-
- override string toString() {
- // `NestedCompletion` defines `toString()` for the other case
- this = TReturnCompletion() and result = "return"
- }
-}
-
-/**
- * A completion that represents evaluation of a statement or an
- * expression resulting in a break (in a loop or in a `switch`
- * statement).
- */
-class BreakCompletion extends Completion {
- BreakCompletion() {
- this = TBreakCompletion() or
- this = TNestedCompletion(_, TBreakCompletion(), _)
- }
-
- override BreakSuccessor getAMatchingSuccessorType() { any() }
-
- override string toString() {
- // `NestedCompletion` defines `toString()` for the other case
- this = TBreakCompletion() and result = "break"
- }
-}
-
-/**
- * A completion that represents evaluation of a statement or an
- * expression resulting in a loop continuation (a `continue`
- * statement).
- */
-class ContinueCompletion extends Completion {
- ContinueCompletion() {
- this = TContinueCompletion() or
- this = TNestedCompletion(_, TContinueCompletion(), _)
- }
-
- override ContinueSuccessor getAMatchingSuccessorType() { any() }
-
- override string toString() {
- // `NestedCompletion` defines `toString()` for the other case
- this = TContinueCompletion() and result = "continue"
- }
-}
-
-/**
- * A completion that represents evaluation of a statement or an
- * expression resulting in a `goto` jump.
- */
-class GotoCompletion extends Completion {
- private string label;
-
- GotoCompletion() {
- this = TGotoCompletion(label) or
- this = TNestedCompletion(_, TGotoCompletion(label), _)
- }
-
- /** Gets the label of the `goto` completion. */
- string getLabel() { result = label }
-
- override GotoSuccessor getAMatchingSuccessorType() { any() }
-
- override string toString() {
- // `NestedCompletion` defines `toString()` for the other case
- this = TGotoCompletion(label) and result = "goto(" + label + ")"
- }
-}
-
-/**
- * A completion that represents evaluation of a statement or an
- * expression resulting in a thrown exception.
- */
-class ThrowCompletion extends Completion {
- private ExceptionClass ec;
-
- ThrowCompletion() {
- this = TThrowCompletion(ec) or
- this = TNestedCompletion(_, TThrowCompletion(ec), _)
- }
-
- /** Gets the type of the exception being thrown. */
- ExceptionClass getExceptionClass() { result = ec }
-
- override ExceptionSuccessor getAMatchingSuccessorType() { any() }
-
- override string toString() {
- // `NestedCompletion` defines `toString()` for the other case
- this = TThrowCompletion(ec) and result = "throw(" + ec + ")"
- }
-}
-
-/**
- * A completion that represents evaluation of a statement or an
- * expression resulting in a program exit, for example
- * `System.Environment.Exit(0)`.
- *
- * An exit completion is different from a `return` completion; the former
- * exits the whole application, and exists inside `try` statements skip
- * `finally` blocks.
- */
-class ExitCompletion extends Completion {
- ExitCompletion() {
- this = TExitCompletion() or
- this = TNestedCompletion(_, TExitCompletion(), _)
- }
-
- override ExitSuccessor getAMatchingSuccessorType() { any() }
-
- override string toString() {
- // `NestedCompletion` defines `toString()` for the other case
- this = TExitCompletion() and result = "exit"
- }
-}
diff --git a/csharp/ql/lib/semmle/code/csharp/controlflow/internal/ControlFlowGraph.qll b/csharp/ql/lib/semmle/code/csharp/controlflow/internal/ControlFlowGraph.qll
new file mode 100644
index 000000000000..ca71e213e327
--- /dev/null
+++ b/csharp/ql/lib/semmle/code/csharp/controlflow/internal/ControlFlowGraph.qll
@@ -0,0 +1,282 @@
+import csharp
+import codeql.controlflow.ControlFlowGraph
+
+module Initializers {
+ private import semmle.code.csharp.ExprOrStmtParent as ExprOrStmtParent
+
+ /**
+ * The `expr_parent_top_level_adjusted()` relation restricted to exclude relations
+ * between properties and their getters' expression bodies in properties such as
+ * `int P => 0`.
+ *
+ * This is in order to only associate the expression body with one CFG scope, namely
+ * the getter (and not the declaration itself).
+ */
+ private predicate expr_parent_top_level_adjusted2(
+ Expr child, int i, @top_level_exprorstmt_parent parent
+ ) {
+ ExprOrStmtParent::expr_parent_top_level_adjusted(child, i, parent) and
+ not exists(Getter g |
+ g.getDeclaration() = parent and
+ i = 0
+ )
+ }
+
+ /**
+ * Holds if `init` is a static member initializer and `staticCtor` is the
+ * static constructor in the same declaring type. Hence, `staticCtor` can be
+ * considered to execute `init` prior to the execution of its body.
+ */
+ predicate staticMemberInitializer(Constructor staticCtor, Expr init) {
+ exists(Assignable a |
+ a.(Modifiable).isStatic() and
+ expr_parent_top_level_adjusted2(init, _, a) and
+ a.getDeclaringType() = staticCtor.getDeclaringType() and
+ staticCtor.isStatic()
+ )
+ }
+
+ /**
+ * Gets the `i`th static member initializer expression for static constructor `staticCtor`.
+ */
+ Expr initializedStaticMemberOrder(Constructor staticCtor, int i) {
+ result =
+ rank[i + 1](Expr init, Location l, string filepath, int startline, int startcolumn |
+ staticMemberInitializer(staticCtor, init) and
+ l = init.getLocation() and
+ l.hasLocationInfo(filepath, startline, startcolumn, _, _)
+ |
+ init order by startline, startcolumn, filepath
+ )
+ }
+
+ /**
+ * Gets the `i`th member initializer expression for object initializer method `obinit`.
+ */
+ AssignExpr initializedInstanceMemberOrder(ObjectInitMethod obinit, int i) {
+ result =
+ rank[i + 1](AssignExpr ae0, Location l, string filepath, int startline, int startcolumn |
+ obinit.initializes(ae0) and
+ l = ae0.getLocation() and
+ l.hasLocationInfo(filepath, startline, startcolumn, _, _)
+ |
+ ae0 order by startline, startcolumn, filepath
+ )
+ }
+}
+
+/**
+ * Provides an implementation of the AST signature for C#.
+ */
+module Ast implements AstSig {
+ private import csharp as CS
+
+ class AstNode = ControlFlowElementOrCallable;
+
+ additional predicate skipControlFlow(AstNode e) {
+ e instanceof TypeAccess and
+ not e instanceof TypeAccessPatternExpr
+ or
+ not e.getFile().fromSource()
+ }
+
+ private AstNode getExprChild0(Expr e, int i) {
+ not e instanceof NameOfExpr and
+ not e instanceof AnonymousFunctionExpr and
+ not skipControlFlow(result) and
+ result = e.getChild(i)
+ }
+
+ private AstNode getStmtChild0(Stmt s, int i) {
+ not s instanceof FixedStmt and
+ not s instanceof UsingBlockStmt and
+ result = s.getChild(i)
+ or
+ s =
+ any(FixedStmt fs |
+ result = fs.getVariableDeclExpr(i)
+ or
+ result = fs.getBody() and
+ i = max(int j | exists(fs.getVariableDeclExpr(j))) + 1
+ )
+ or
+ s =
+ any(UsingBlockStmt us |
+ result = us.getExpr() and
+ i = 0
+ or
+ result = us.getVariableDeclExpr(i)
+ or
+ result = us.getBody() and
+ i = max([1, count(us.getVariableDeclExpr(_))])
+ )
+ }
+
+ AstNode getChild(AstNode n, int index) {
+ result = getStmtChild0(n, index)
+ or
+ result = getExprChild0(n, index)
+ }
+
+ private AstNode getParent(AstNode n) { n = getChild(result, _) }
+
+ Callable getEnclosingCallable(AstNode node) {
+ result = node.(ControlFlowElement).getEnclosingCallable()
+ or
+ result.(ObjectInitMethod).initializes(getParent*(node))
+ or
+ Initializers::staticMemberInitializer(result, getParent*(node))
+ or
+ result = node.(Parameter).getCallable()
+ or
+ not skipControlFlow(node) and
+ getParent*(node) = any(Parameter p | result = p.getCallable()).getDefaultValue()
+ }
+
+ class Callable extends CS::Callable {
+ Callable() { this.isUnboundDeclaration() }
+ }
+
+ AstNode callableGetBody(Callable c) {
+ not skipControlFlow(result) and
+ result = c.getBody()
+ }
+
+ final private class ParameterFinal = CS::Parameter;
+
+ class Parameter extends ParameterFinal {
+ Expr getDefaultValue() {
+ // Avoid combinatorial explosions for callables with multiple bodies
+ result = unique( | | super.getDefaultValue())
+ }
+ }
+
+ Parameter callableGetParameter(Callable c, int i) {
+ not skipControlFlow(result) and
+ result = c.getParameter(i)
+ }
+
+ class Stmt = CS::Stmt;
+
+ class Expr = CS::Expr;
+
+ class BlockStmt = CS::BlockStmt;
+
+ class ExprStmt = CS::ExprStmt;
+
+ class IfStmt = CS::IfStmt;
+
+ class LoopStmt = CS::LoopStmt;
+
+ class WhileStmt = CS::WhileStmt;
+
+ class DoStmt = CS::DoStmt;
+
+ final private class FinalForStmt = CS::ForStmt;
+
+ class ForStmt extends FinalForStmt {
+ Expr getInit(int index) { result = this.getInitializer(index) }
+ }
+
+ final private class FinalForeachStmt = CS::ForeachStmt;
+
+ class ForeachStmt extends FinalForeachStmt {
+ Expr getVariable() {
+ result = this.getVariableDeclExpr() or result = this.getVariableDeclTuple()
+ }
+
+ Expr getCollection() { result = this.getIterableExpr() }
+ }
+
+ class BreakStmt = CS::BreakStmt;
+
+ class ContinueStmt = CS::ContinueStmt;
+
+ class GotoStmt = CS::GotoStmt;
+
+ class ReturnStmt = CS::ReturnStmt;
+
+ class Throw = CS::ThrowElement;
+
+ final private class FinalTryStmt = CS::TryStmt;
+
+ class TryStmt extends FinalTryStmt {
+ Stmt getBody() { result = this.getBlock() }
+
+ CatchClause getCatch(int index) { result = this.getCatchClause(index) }
+
+ Stmt getFinally() { result = super.getFinally() }
+ }
+
+ final private class FinalCatchClause = CS::CatchClause;
+
+ class CatchClause extends FinalCatchClause {
+ AstNode getVariable() { result = this.(CS::SpecificCatchClause).getVariableDeclExpr() }
+
+ Expr getCondition() { result = this.getFilterClause() }
+
+ Stmt getBody() { result = this.getBlock() }
+ }
+
+ final private class FinalSwitch = CS::Switch;
+
+ class Switch extends FinalSwitch {
+ Case getCase(int index) { result = super.getCase(index) }
+
+ Stmt getStmt(int index) { result = this.(CS::SwitchStmt).getStmt(index) }
+ }
+
+ final private class FinalCase = CS::Case;
+
+ class Case extends FinalCase {
+ AstNode getPattern(int index) { result = this.getPattern() and index = 0 }
+
+ Expr getGuard() { result = this.getCondition() }
+
+ AstNode getBody() { result = super.getBody() }
+ }
+
+ class DefaultCase extends Case instanceof CS::DefaultCase { }
+
+ class ConditionalExpr = CS::ConditionalExpr;
+
+ class BinaryExpr = CS::BinaryOperation;
+
+ class LogicalAndExpr = CS::LogicalAndExpr;
+
+ class LogicalOrExpr = CS::LogicalOrExpr;
+
+ class NullCoalescingExpr = CS::NullCoalescingExpr;
+
+ class UnaryExpr = CS::UnaryOperation;
+
+ class LogicalNotExpr = CS::LogicalNotExpr;
+
+ class Assignment = CS::Assignment;
+
+ class AssignExpr = CS::AssignExpr;
+
+ class CompoundAssignment = CS::AssignOperation;
+
+ class AssignLogicalAndExpr extends CompoundAssignment {
+ AssignLogicalAndExpr() { none() }
+ }
+
+ class AssignLogicalOrExpr extends CompoundAssignment {
+ AssignLogicalOrExpr() { none() }
+ }
+
+ class AssignNullCoalescingExpr = CS::AssignCoalesceExpr;
+
+ final private class FinalBoolLiteral = CS::BoolLiteral;
+
+ class BooleanLiteral extends FinalBoolLiteral {
+ boolean getValue() { result = this.getBoolValue() }
+ }
+
+ final private class FinalIsExpr = CS::IsExpr;
+
+ class PatternMatchExpr extends FinalIsExpr {
+ AstNode getPattern() { result = super.getPattern() }
+ }
+}
diff --git a/csharp/ql/lib/semmle/code/csharp/controlflow/internal/ControlFlowGraphImpl.qll b/csharp/ql/lib/semmle/code/csharp/controlflow/internal/ControlFlowGraphImpl.qll
deleted file mode 100644
index e29e92d26eba..000000000000
--- a/csharp/ql/lib/semmle/code/csharp/controlflow/internal/ControlFlowGraphImpl.qll
+++ /dev/null
@@ -1,1831 +0,0 @@
-/**
- * Provides an implementation for constructing control-flow graphs (CFGs) from
- * abstract syntax trees (ASTs), using the shared library from `codeql.controlflow.Cfg`.
- */
-
-import csharp
-private import codeql.controlflow.Cfg as CfgShared
-private import Completion
-private import semmle.code.csharp.ExprOrStmtParent
-private import semmle.code.csharp.commons.Compilation
-
-private module Initializers {
- /**
- * Gets the `i`th member initializer expression for object initializer method `obinit`
- * in compilation `comp`.
- */
- AssignExpr initializedInstanceMemberOrder(ObjectInitMethod obinit, CompilationExt comp, int i) {
- obinit.initializes(result) and
- result =
- rank[i + 1](AssignExpr ae0, Location l |
- obinit.initializes(ae0) and
- l = ae0.getLocation() and
- getCompilation(l.getFile()) = comp
- |
- ae0 order by l.getStartLine(), l.getStartColumn(), l.getFile().getAbsolutePath()
- )
- }
-
- /**
- * Gets the last member initializer expression for object initializer method `obinit`
- * in compilation `comp`.
- */
- AssignExpr lastInitializer(ObjectInitMethod obinit, CompilationExt comp) {
- exists(int i |
- result = initializedInstanceMemberOrder(obinit, comp, i) and
- not exists(initializedInstanceMemberOrder(obinit, comp, i + 1))
- )
- }
-}
-
-/** An element that defines a new CFG scope. */
-class CfgScope extends Element, @top_level_exprorstmt_parent {
- CfgScope() {
- this.getFile().fromSource() and
- (
- this =
- any(Callable c |
- c.(Constructor).hasInitializer()
- or
- c.(ObjectInitMethod).initializes(_)
- or
- c.hasBody()
- )
- or
- // For now, static initializer values have their own scope. Eventually, they
- // should be treated like instance initializers.
- this.(Assignable).(Modifiable).isStatic() and
- expr_parent_top_level_adjusted2(_, _, this)
- )
- }
-}
-
-private class TAstNode = @callable or @control_flow_element;
-
-pragma[nomagic]
-private predicate astNode(Element e) {
- e = any(@top_level_exprorstmt_parent p | not p instanceof Attribute)
- or
- exists(Element parent |
- astNode(parent) and
- e = parent.getAChild()
- )
-}
-
-/** An AST node. */
-class AstNode extends Element, TAstNode {
- AstNode() { astNode(this) }
-
- int getId() { idOf(this, result) }
-}
-
-private predicate id(AstNode x, AstNode y) { x = y }
-
-private predicate idOf(AstNode x, int y) = equivalenceRelation(id/2)(x, y)
-
-private module CfgInput implements CfgShared::InputSig {
- private import ControlFlowGraphImpl as Impl
- private import Completion as Comp
- private import SuccessorType as ST
- private import semmle.code.csharp.Caching
-
- class AstNode = Impl::AstNode;
-
- class Completion = Comp::Completion;
-
- predicate completionIsNormal(Completion c) { c instanceof Comp::NormalCompletion }
-
- predicate completionIsSimple(Completion c) { c instanceof Comp::SimpleCompletion }
-
- predicate completionIsValidFor(Completion c, AstNode e) { c.isValidFor(e) }
-
- class CfgScope = Impl::CfgScope;
-
- CfgScope getCfgScope(AstNode n) {
- Stages::ControlFlowStage::forceCachingInSameStage() and
- result = n.(ControlFlowElement).getEnclosingCallable()
- }
-
- predicate scopeFirst(CfgScope scope, AstNode first) { Impl::scopeFirst(scope, first) }
-
- predicate scopeLast(CfgScope scope, AstNode last, Completion c) {
- Impl::scopeLast(scope, last, c)
- }
-
- private class SuccessorType = ST::SuccessorType;
-
- SuccessorType getAMatchingSuccessorType(Completion c) { result = c.getAMatchingSuccessorType() }
-
- int idOfAstNode(AstNode node) { result = node.getId() }
-
- int idOfCfgScope(CfgScope node) { result = idOfAstNode(node) }
-}
-
-private module CfgSplittingInput implements CfgShared::SplittingInputSig {
- private import Splitting as S
-
- class SplitKindBase = S::TSplitKind;
-
- class Split = S::Split;
-}
-
-private module ConditionalCompletionSplittingInput implements
- CfgShared::ConditionalCompletionSplittingInputSig
-{
- import Splitting::ConditionalCompletionSplitting::ConditionalCompletionSplittingInput
-}
-
-import CfgShared::MakeWithSplitting
-
-/**
- * A compilation.
- *
- * Unlike the standard `Compilation` class, this class also supports buildless
- * extraction.
- */
-newtype CompilationExt =
- TCompilation(Compilation c) { not extractionIsStandalone() } or
- TBuildless() { extractionIsStandalone() }
-
-/** Gets the compilation that source file `f` belongs to. */
-CompilationExt getCompilation(File f) {
- exists(Compilation c |
- f = c.getAFileCompiled() and
- result = TCompilation(c)
- )
- or
- result = TBuildless()
-}
-
-/**
- * The `expr_parent_top_level_adjusted()` relation restricted to exclude relations
- * between properties and their getters' expression bodies in properties such as
- * `int P => 0`.
- *
- * This is in order to only associate the expression body with one CFG scope, namely
- * the getter (and not the declaration itself).
- */
-private predicate expr_parent_top_level_adjusted2(
- Expr child, int i, @top_level_exprorstmt_parent parent
-) {
- expr_parent_top_level_adjusted(child, i, parent) and
- not exists(Getter g |
- g.getDeclaration() = parent and
- i = 0
- )
-}
-
-/** Holds if `first` is first executed when entering `scope`. */
-predicate scopeFirst(CfgScope scope, AstNode first) {
- scope =
- any(Callable c |
- if exists(c.(Constructor).getObjectInitializerCall())
- then first(c.(Constructor).getObjectInitializerCall(), first)
- else
- if exists(c.(Constructor).getInitializer())
- then first(c.(Constructor).getInitializer(), first)
- else first(c.getBody(), first)
- )
- or
- first(Initializers::initializedInstanceMemberOrder(scope, _, 0), first)
- or
- expr_parent_top_level_adjusted2(any(Expr e | first(e, first)), _, scope) and
- not scope instanceof Callable
-}
-
-/** Holds if `scope` is exited when `last` finishes with completion `c`. */
-predicate scopeLast(CfgScope scope, AstNode last, Completion c) {
- scope =
- any(Callable callable |
- last(callable.getBody(), last, c) and
- not c instanceof GotoCompletion
- or
- last(callable.(Constructor).getInitializer(), last, c) and
- not callable.hasBody()
- or
- // This is only relevant in the context of compilation errors, since
- // normally the existence of an object initializer call implies the
- // existence of an initializer.
- last(callable.(Constructor).getObjectInitializerCall(), last, c) and
- not callable.(Constructor).hasInitializer() and
- not callable.hasBody()
- )
- or
- last(Initializers::lastInitializer(scope, _), last, c)
- or
- expr_parent_top_level_adjusted2(any(Expr e | last(e, last, c)), _, scope) and
- not scope instanceof Callable
-}
-
-private class ObjectInitTree extends ControlFlowTree instanceof ObjectInitMethod {
- final override predicate propagatesAbnormal(AstNode child) { none() }
-
- final override predicate first(AstNode first) { none() }
-
- final override predicate last(AstNode last, Completion c) { none() }
-
- final override predicate succ(AstNode pred, AstNode succ, Completion c) {
- exists(CompilationExt comp, int i |
- // Flow from one member initializer to the next
- last(Initializers::initializedInstanceMemberOrder(this, comp, i), pred, c) and
- c instanceof NormalCompletion and
- first(Initializers::initializedInstanceMemberOrder(this, comp, i + 1), succ)
- )
- }
-}
-
-private class ConstructorTree extends ControlFlowTree instanceof Constructor {
- final override predicate propagatesAbnormal(AstNode child) { none() }
-
- final override predicate first(AstNode first) { none() }
-
- final override predicate last(AstNode last, Completion c) { none() }
-
- /** Gets the body of this constructor belonging to compilation `comp`. */
- pragma[noinline]
- AstNode getBody(CompilationExt comp) {
- result = super.getBody() and
- comp = getCompilation(result.getFile())
- }
-
- pragma[noinline]
- private MethodCall getObjectInitializerCall(CompilationExt comp) {
- result = super.getObjectInitializerCall() and
- comp = getCompilation(result.getFile())
- }
-
- pragma[noinline]
- private ConstructorInitializer getInitializer(CompilationExt comp) {
- result = super.getInitializer() and
- comp = getCompilation(result.getFile())
- }
-
- final override predicate succ(AstNode pred, AstNode succ, Completion c) {
- exists(CompilationExt comp |
- last(this.getObjectInitializerCall(comp), pred, c) and
- c instanceof NormalCompletion
- |
- first(this.getInitializer(comp), succ)
- or
- // This is only relevant in the context of compilation errors, since
- // normally the existence of an object initializer call implies the
- // existence of an initializer.
- not exists(this.getInitializer(comp)) and
- first(this.getBody(comp), succ)
- )
- }
-}
-
-cached
-private module SwithStmtInternal {
- // Reorders default to be last if needed
- cached
- CaseStmt getCase(SwitchStmt ss, int i) {
- exists(int index, int rankIndex |
- caseIndex(ss, result, index) and
- rankIndex = i + 1 and
- index = rank[rankIndex](int j, CaseStmt cs | caseIndex(ss, cs, j) | j)
- )
- }
-
- /** Implicitly reorder case statements to put the default case last if needed. */
- private predicate caseIndex(SwitchStmt ss, CaseStmt case, int index) {
- exists(int i | case = ss.getChildStmt(i) |
- if case instanceof DefaultCase
- then index = max(int j | exists(ss.getChildStmt(j))) + 1
- else index = i
- )
- }
-
- /**
- * Gets the `i`th statement in the body of this `switch` statement.
- *
- * Example:
- *
- * ```csharp
- * switch (x) {
- * case "abc": // i = 0
- * return 0;
- * case int i when i > 0: // i = 1
- * return 1;
- * case string s: // i = 2
- * Console.WriteLine(s);
- * return 2; // i = 3
- * default: // i = 4
- * return 3; // i = 5
- * }
- * ```
- *
- * Note that each non-`default` case is a labeled statement, so the statement
- * that follows is a child of the labeled statement, and not the `switch` block.
- */
- cached
- Stmt getStmt(SwitchStmt ss, int i) {
- exists(int index, int rankIndex |
- result = ss.getChildStmt(index) and
- rankIndex = i + 1 and
- index =
- rank[rankIndex](int j, Stmt s |
- // `getChild` includes both labeled statements and the targeted
- // statements of labeled statement as separate children, but we
- // only want the labeled statement
- s = getLabeledStmt(ss, j)
- |
- j
- )
- )
- }
-
- private Stmt getLabeledStmt(SwitchStmt ss, int i) {
- result = ss.getChildStmt(i) and
- not result = caseStmtGetBody(_)
- }
-}
-
-private ControlFlowElement caseGetBody(Case c) {
- result = c.getBody() or result = caseStmtGetBody(c)
-}
-
-private ControlFlowElement caseStmtGetBody(CaseStmt c) {
- exists(int i, Stmt next |
- c = c.getParent().getChild(i) and
- next = c.getParent().getChild(i + 1)
- |
- result = next and
- not result instanceof CaseStmt
- or
- result = caseStmtGetBody(next)
- )
-}
-
-// Reorders default to be last if needed
-private Case switchGetCase(Switch s, int i) {
- result = s.(SwitchExpr).getCase(i) or result = SwithStmtInternal::getCase(s, i)
-}
-
-abstract private class SwitchTree extends ControlFlowTree instanceof Switch {
- override predicate propagatesAbnormal(AstNode child) { child = super.getExpr() }
-
- override predicate succ(AstNode pred, AstNode succ, Completion c) {
- // Flow from last element of switch expression to first element of first case
- last(super.getExpr(), pred, c) and
- c instanceof NormalCompletion and
- first(switchGetCase(this, 0), succ)
- or
- // Flow from last element of case pattern to next case
- exists(Case case, int i | case = switchGetCase(this, i) |
- last(case.getPattern(), pred, c) and
- c.(MatchingCompletion).isNonMatch() and
- first(switchGetCase(this, i + 1), succ)
- )
- or
- // Flow from last element of condition to next case
- exists(Case case, int i | case = switchGetCase(this, i) |
- last(case.getCondition(), pred, c) and
- c instanceof FalseCompletion and
- first(switchGetCase(this, i + 1), succ)
- )
- }
-}
-
-abstract private class CaseTree extends ControlFlowTree instanceof Case {
- final override predicate propagatesAbnormal(AstNode child) {
- child in [super.getPattern().(ControlFlowElement), super.getCondition(), caseGetBody(this)]
- }
-
- override predicate succ(AstNode pred, AstNode succ, Completion c) {
- last(super.getPattern(), pred, c) and
- c.(MatchingCompletion).isMatch() and
- (
- if exists(super.getCondition())
- then
- // Flow from the last element of pattern to the condition
- first(super.getCondition(), succ)
- else
- // Flow from last element of pattern to first element of body
- first(caseGetBody(this), succ)
- )
- or
- // Flow from last element of condition to first element of body
- last(super.getCondition(), pred, c) and
- c instanceof TrueCompletion and
- first(caseGetBody(this), succ)
- }
-}
-
-module Expressions {
- /** An expression that should not be included in the control flow graph. */
- abstract private class NoNodeExpr extends Expr { }
-
- private class SimpleNoNodeExpr extends NoNodeExpr {
- SimpleNoNodeExpr() {
- this instanceof TypeAccess and
- not this instanceof TypeAccessPatternExpr
- }
- }
-
- /** A write access that is not also a read access. */
- private class WriteAccess extends AssignableWrite {
- WriteAccess() {
- // `x++` is both a read and write access
- not this instanceof AssignableRead
- }
- }
-
- private class WriteAccessNoNodeExpr extends WriteAccess, NoNodeExpr {
- WriteAccessNoNodeExpr() {
- // For example a write to a static field, `Foo.Bar = 0`.
- forall(Expr e | e = this.getAChildExpr() | e instanceof NoNodeExpr)
- }
- }
-
- private AstNode getExprChild0(Expr e, int i) {
- not e instanceof NameOfExpr and
- not e instanceof QualifiableExpr and
- not e instanceof AnonymousFunctionExpr and
- result = e.getChild(i)
- or
- e = any(ExtensionMethodCall emc | result = emc.getArgument(i))
- or
- e =
- any(QualifiableExpr qe |
- not qe instanceof ExtensionMethodCall and
- result = qe.getChild(i)
- )
- }
-
- private AstNode getExprChild(Expr e, int i) {
- result =
- rank[i + 1](AstNode cfe, int j |
- cfe = getExprChild0(e, j) and
- not cfe instanceof NoNodeExpr
- |
- cfe order by j
- )
- }
-
- private AstNode getLastExprChild(Expr e) {
- exists(int last |
- result = getExprChild(e, last) and
- not exists(getExprChild(e, last + 1))
- )
- }
-
- private class StandardExpr extends StandardPostOrderTree instanceof Expr {
- StandardExpr() {
- // The following expressions need special treatment
- not this instanceof LogicalNotExpr and
- not this instanceof LogicalAndExpr and
- not this instanceof LogicalOrExpr and
- not this instanceof NullCoalescingOperation and
- not this instanceof ConditionalExpr and
- not this instanceof ConditionallyQualifiedExpr and
- not this instanceof ThrowExpr and
- not this instanceof ObjectCreation and
- not this instanceof ArrayCreation and
- not this instanceof QualifiedWriteAccess and
- not this instanceof QualifiedAccessorWrite and
- not this instanceof NoNodeExpr and
- not this instanceof SwitchExpr and
- not this instanceof SwitchCaseExpr and
- not this instanceof ConstructorInitializer and
- not this instanceof NotPatternExpr and
- not this instanceof OrPatternExpr and
- not this instanceof AndPatternExpr and
- not this instanceof RecursivePatternExpr and
- not this instanceof PositionalPatternExpr and
- not this instanceof PropertyPatternExpr
- }
-
- final override AstNode getChildNode(int i) { result = getExprChild(this, i) }
- }
-
- /**
- * A qualified write access.
- *
- * The successor declaration in `QualifiedAccessorWrite` ensures that the access itself
- * is evaluated after the qualifier and the indexer arguments (if any)
- * and the right hand side of the assignment.
- *
- * When a qualified write access is used as an `out/ref` argument, the access itself is evaluated immediately.
- */
- private class QualifiedWriteAccess extends ControlFlowTree instanceof WriteAccess, QualifiableExpr
- {
- QualifiedWriteAccess() {
- (
- this.hasQualifier()
- or
- // Member initializers like
- // ```csharp
- // new Dictionary() { [0] = "Zero", [1] = "One", [2] = "Two" }
- // ```
- // need special treatment, because the accesses `[0]`, `[1]`, and `[2]`
- // have no qualifier.
- this = any(MemberInitializer mi).getLValue()
- ) and
- not exists(AssignableDefinitions::OutRefDefinition def | def.getTargetAccess() = this)
- }
-
- final override predicate propagatesAbnormal(AstNode child) { child = getExprChild(this, _) }
-
- final override predicate first(AstNode first) { first(getExprChild(this, 0), first) }
-
- final override predicate last(AstNode last, Completion c) {
- // Skip the access in a qualified write access
- last(getLastExprChild(this), last, c)
- or
- // Qualifier exits with a null completion
- super.isConditional() and
- last(super.getQualifier(), last, c) and
- c.(NullnessCompletion).isNull()
- }
-
- final override predicate succ(AstNode pred, AstNode succ, Completion c) {
- exists(int i |
- last(getExprChild(this, i), pred, c) and
- c instanceof NormalCompletion and
- (if i = 0 then not c.(NullnessCompletion).isNull() else any()) and
- first(getExprChild(this, i + 1), succ)
- )
- }
- }
-
- /**
- * An expression that writes via a qualifiable expression, for example `x.Prop = 0`,
- * where `Prop` is a property.
- *
- * Accessor writes need special attention, because we need to model the fact
- * that the accessor is called *after* the assigned value has been evaluated.
- * In the example above, this means we want a CFG that looks like
- *
- * ```csharp
- * x -> 0 -> set_Prop -> x.Prop = 0
- * ```
- *
- * For consistency, control flow is implemented the same way for other qualified writes.
- * For example, `x.Field = 0`, where `Field` is a field, we want a CFG that looks like
- *
- * ```csharp
- * x -> 0 -> x.Field -> x.Field = 0
- * ```
- */
- private class QualifiedAccessorWrite extends PostOrderTree instanceof Expr {
- AssignableDefinition def;
-
- QualifiedAccessorWrite() {
- def.getExpr() = this and
- def.getTargetAccess().(WriteAccess) instanceof QualifiableExpr and
- not def instanceof AssignableDefinitions::OutRefDefinition
- }
-
- /**
- * Gets the `i`th accessor being called in this write. More than one call
- * can happen in tuple assignments.
- */
- QualifiableExpr getAccess(int i) {
- result =
- rank[i + 1](AssignableDefinitions::TupleAssignmentDefinition tdef |
- tdef.getExpr() = this and
- tdef.getTargetAccess() instanceof QualifiableExpr
- |
- tdef order by tdef.getEvaluationOrder()
- ).getTargetAccess()
- or
- i = 0 and
- result = def.getTargetAccess() and
- not def instanceof AssignableDefinitions::TupleAssignmentDefinition
- }
-
- final override predicate propagatesAbnormal(AstNode child) {
- child = getExprChild(this, _)
- or
- child = this.getAccess(_)
- }
-
- final override predicate last(AstNode last, Completion c) {
- PostOrderTree.super.last(last, c)
- or
- last(getExprChild(this, 0), last, c) and c.(NullnessCompletion).isNull()
- }
-
- final override predicate first(AstNode first) { first(getExprChild(this, 0), first) }
-
- final override predicate succ(AstNode pred, AstNode succ, Completion c) {
- // Standard left-to-right evaluation
- exists(int i |
- last(getExprChild(this, i), pred, c) and
- c instanceof NormalCompletion and
- (if i = 0 then not c.(NullnessCompletion).isNull() else any()) and
- first(getExprChild(this, i + 1), succ)
- )
- or
- // Flow from last element of last child to first accessor call
- last(getLastExprChild(this), pred, c) and
- succ = this.getAccess(0) and
- c instanceof NormalCompletion
- or
- // Flow from one call to the next
- exists(int i | pred = this.getAccess(i) |
- succ = this.getAccess(i + 1) and
- c.isValidFor(pred) and
- c instanceof NormalCompletion
- )
- or
- // Post-order: flow from last call to element itself
- exists(int last | last = max(int i | exists(this.getAccess(i))) |
- pred = this.getAccess(last) and
- succ = this and
- c.isValidFor(pred) and
- c instanceof NormalCompletion
- )
- }
- }
-
- private class LogicalNotExprTree extends PostOrderTree instanceof LogicalNotExpr {
- private Expr operand;
-
- LogicalNotExprTree() { operand = this.getOperand() }
-
- final override predicate propagatesAbnormal(AstNode child) { child = operand }
-
- final override predicate first(AstNode first) { first(operand, first) }
-
- final override predicate succ(AstNode pred, AstNode succ, Completion c) {
- succ = this and
- last(operand, pred, c) and
- c instanceof NormalCompletion
- }
- }
-
- private class LogicalAndExprTree extends PostOrderTree instanceof LogicalAndExpr {
- final override predicate propagatesAbnormal(AstNode child) {
- child in [super.getLeftOperand(), super.getRightOperand()]
- }
-
- final override predicate first(AstNode first) { first(super.getLeftOperand(), first) }
-
- final override predicate succ(AstNode pred, AstNode succ, Completion c) {
- // Flow from last element of left operand to first element of right operand
- last(super.getLeftOperand(), pred, c) and
- c instanceof TrueCompletion and
- first(super.getRightOperand(), succ)
- or
- // Post-order: flow from last element of left operand to element itself
- last(super.getLeftOperand(), pred, c) and
- c instanceof FalseCompletion and
- succ = this
- or
- // Post-order: flow from last element of right operand to element itself
- last(super.getRightOperand(), pred, c) and
- c instanceof NormalCompletion and
- succ = this
- }
- }
-
- private class LogicalOrExprTree extends PostOrderTree instanceof LogicalOrExpr {
- final override predicate propagatesAbnormal(AstNode child) {
- child in [super.getLeftOperand(), super.getRightOperand()]
- }
-
- final override predicate first(AstNode first) { first(super.getLeftOperand(), first) }
-
- final override predicate succ(AstNode pred, AstNode succ, Completion c) {
- // Flow from last element of left operand to first element of right operand
- last(super.getLeftOperand(), pred, c) and
- c instanceof FalseCompletion and
- first(super.getRightOperand(), succ)
- or
- // Post-order: flow from last element of left operand to element itself
- last(super.getLeftOperand(), pred, c) and
- c instanceof TrueCompletion and
- succ = this
- or
- // Post-order: flow from last element of right operand to element itself
- last(super.getRightOperand(), pred, c) and
- c instanceof NormalCompletion and
- succ = this
- }
- }
-
- private class NullCoalescingOperationTree extends PostOrderTree instanceof NullCoalescingOperation
- {
- final override predicate propagatesAbnormal(AstNode child) {
- child in [super.getLeftOperand(), super.getRightOperand()]
- }
-
- final override predicate first(AstNode first) { first(super.getLeftOperand(), first) }
-
- final override predicate succ(AstNode pred, AstNode succ, Completion c) {
- // Flow from last element of left operand to first element of right operand
- last(super.getLeftOperand(), pred, c) and
- c.(NullnessCompletion).isNull() and
- first(super.getRightOperand(), succ)
- or
- // Post-order: flow from last element of left operand to element itself
- last(super.getLeftOperand(), pred, c) and
- succ = this and
- c instanceof NormalCompletion and
- not c.(NullnessCompletion).isNull()
- or
- // Post-order: flow from last element of right operand to element itself
- last(super.getRightOperand(), pred, c) and
- c instanceof NormalCompletion and
- succ = this
- }
- }
-
- private class ConditionalExprTree extends PostOrderTree instanceof ConditionalExpr {
- final override predicate propagatesAbnormal(AstNode child) {
- child in [super.getCondition(), super.getThen(), super.getElse()]
- }
-
- final override predicate first(AstNode first) { first(super.getCondition(), first) }
-
- final override predicate succ(AstNode pred, AstNode succ, Completion c) {
- // Flow from last element of condition to first element of then branch
- last(super.getCondition(), pred, c) and
- c instanceof TrueCompletion and
- first(super.getThen(), succ)
- or
- // Flow from last element of condition to first element of else branch
- last(super.getCondition(), pred, c) and
- c instanceof FalseCompletion and
- first(super.getElse(), succ)
- or
- // Post-order: flow from last element of a branch to element itself
- last([super.getThen(), super.getElse()], pred, c) and
- c instanceof NormalCompletion and
- succ = this
- }
- }
-
- /** A conditionally qualified expression. */
- private class ConditionallyQualifiedExpr extends PostOrderTree instanceof QualifiableExpr {
- private Expr qualifier;
-
- ConditionallyQualifiedExpr() {
- this.isConditional() and qualifier = getExprChild(this, 0) and not this instanceof WriteAccess
- }
-
- final override predicate propagatesAbnormal(AstNode child) { child = qualifier }
-
- final override predicate first(AstNode first) { first(qualifier, first) }
-
- pragma[nomagic]
- private predicate lastQualifier(AstNode last, Completion c) { last(qualifier, last, c) }
-
- final override predicate last(AstNode last, Completion c) {
- PostOrderTree.super.last(last, c)
- or
- // Qualifier exits with a `null` completion
- this.lastQualifier(last, c) and
- c.(NullnessCompletion).isNull()
- }
-
- final override predicate succ(AstNode pred, AstNode succ, Completion c) {
- exists(int i |
- last(getExprChild(this, i), pred, c) and
- c instanceof NormalCompletion and
- if i = 0 then c.(NullnessCompletion).isNonNull() else any()
- |
- // Post-order: flow from last element of last child to element itself
- i = max(int j | exists(getExprChild(this, j))) and
- succ = this
- or
- // Standard left-to-right evaluation
- first(getExprChild(this, i + 1), succ)
- )
- }
- }
-
- private class ThrowExprTree extends PostOrderTree instanceof ThrowExpr {
- final override predicate propagatesAbnormal(AstNode child) { child = super.getExpr() }
-
- final override predicate first(AstNode first) { first(super.getExpr(), first) }
-
- final override predicate succ(AstNode pred, AstNode succ, Completion c) {
- last(super.getExpr(), pred, c) and
- c instanceof NormalCompletion and
- succ = this
- }
- }
-
- private class ObjectCreationTree extends ControlFlowTree instanceof ObjectCreation {
- private Expr getObjectCreationArgument(int i) {
- i >= 0 and
- if super.hasInitializer()
- then result = getExprChild(this, i + 1)
- else result = getExprChild(this, i)
- }
-
- final override predicate propagatesAbnormal(AstNode child) {
- child = this.getObjectCreationArgument(_)
- }
-
- final override predicate first(AstNode first) {
- first(this.getObjectCreationArgument(0), first)
- or
- not exists(this.getObjectCreationArgument(0)) and
- first = this
- }
-
- final override predicate last(AstNode last, Completion c) {
- // Post-order: element itself (when no initializer)
- last = this and
- not super.hasInitializer() and
- c.isValidFor(this)
- or
- // Last element of initializer
- last(super.getInitializer(), last, c)
- }
-
- final override predicate succ(AstNode pred, AstNode succ, Completion c) {
- // Flow from last element of argument `i` to first element of argument `i+1`
- exists(int i | last(this.getObjectCreationArgument(i), pred, c) |
- first(this.getObjectCreationArgument(i + 1), succ) and
- c instanceof NormalCompletion
- )
- or
- // Flow from last element of last argument to self
- exists(int last | last = max(int i | exists(this.getObjectCreationArgument(i))) |
- last(this.getObjectCreationArgument(last), pred, c) and
- succ = this and
- c instanceof NormalCompletion
- )
- or
- // Flow from self to first element of initializer
- pred = this and
- first(super.getInitializer(), succ) and
- c instanceof SimpleCompletion
- }
- }
-
- private class ArrayCreationTree extends ControlFlowTree instanceof ArrayCreation {
- final override predicate propagatesAbnormal(AstNode child) {
- child = super.getALengthArgument()
- }
-
- final override predicate first(AstNode first) {
- // First element of first length argument
- first(super.getLengthArgument(0), first)
- or
- // No length argument: element itself
- not exists(super.getLengthArgument(0)) and
- first = this
- }
-
- final override predicate last(AstNode last, Completion c) {
- // Post-order: element itself (when no initializer)
- last = this and
- not super.hasInitializer() and
- c.isValidFor(this)
- or
- // Last element of initializer
- last(super.getInitializer(), last, c)
- }
-
- final override predicate succ(AstNode pred, AstNode succ, Completion c) {
- // Flow from self to first element of initializer
- pred = this and
- first(super.getInitializer(), succ) and
- c instanceof SimpleCompletion
- or
- exists(int i |
- last(super.getLengthArgument(i), pred, c) and
- c instanceof SimpleCompletion
- |
- // Flow from last length argument to self
- i = max(int j | exists(super.getLengthArgument(j))) and
- succ = this
- or
- // Flow from one length argument to the next
- first(super.getLengthArgument(i + 1), succ)
- )
- }
- }
-
- private class SwitchExprTree extends PostOrderTree, SwitchTree instanceof SwitchExpr {
- final override predicate propagatesAbnormal(AstNode child) {
- SwitchTree.super.propagatesAbnormal(child)
- or
- child = super.getACase()
- }
-
- final override predicate first(AstNode first) { first(super.getExpr(), first) }
-
- final override predicate succ(AstNode pred, AstNode succ, Completion c) {
- SwitchTree.super.succ(pred, succ, c)
- or
- last(super.getACase(), pred, c) and
- succ = this and
- c instanceof NormalCompletion
- }
- }
-
- private class SwitchCaseExprTree extends PostOrderTree, CaseTree instanceof SwitchCaseExpr {
- final override predicate first(AstNode first) { first(super.getPattern(), first) }
-
- pragma[noinline]
- private predicate lastNoMatch(AstNode last, ConditionalCompletion cc) {
- last([super.getPattern(), super.getCondition()], last, cc) and
- (cc.(MatchingCompletion).isNonMatch() or cc instanceof FalseCompletion)
- }
-
- final override predicate last(AstNode last, Completion c) {
- PostOrderTree.super.last(last, c)
- or
- // Last case exists with a non-match
- exists(SwitchExpr se, int i, ConditionalCompletion cc |
- this = se.getCase(i) and
- not super.matchesAll() and
- not exists(se.getCase(i + 1)) and
- this.lastNoMatch(last, cc) and
- c =
- any(NestedCompletion nc |
- nc.getNestLevel() = 0 and
- nc.getInnerCompletion() = cc and
- nc.getOuterCompletion()
- .(ThrowCompletion)
- .getExceptionClass()
- .hasFullyQualifiedName("System", "InvalidOperationException")
- )
- )
- }
-
- final override predicate succ(AstNode pred, AstNode succ, Completion c) {
- CaseTree.super.succ(pred, succ, c)
- or
- last(super.getBody(), pred, c) and
- succ = this and
- c instanceof NormalCompletion
- }
- }
-
- private class ConstructorInitializerTree extends PostOrderTree instanceof ConstructorInitializer {
- private ControlFlowTree getChildNode(int i) { result = getExprChild(this, i) }
-
- final override predicate propagatesAbnormal(AstNode child) { child = this.getChildNode(_) }
-
- final override predicate first(AstNode first) {
- first(this.getChildNode(0), first)
- or
- not exists(this.getChildNode(0)) and
- first = this
- }
-
- final override predicate succ(AstNode pred, AstNode succ, Completion c) {
- // Post-order: flow from last element of last child to element itself
- exists(int lst |
- lst = max(int i | exists(this.getChildNode(i))) and
- last(this.getChildNode(lst), pred, c) and
- succ = this and
- c instanceof NormalCompletion
- )
- or
- // Standard left-to-right evaluation
- exists(int i |
- last(this.getChildNode(i), pred, c) and
- c instanceof NormalCompletion and
- first(this.getChildNode(i + 1), succ)
- )
- or
- exists(ConstructorTree con, CompilationExt comp |
- last(this, pred, c) and
- con = super.getConstructor() and
- comp = getCompilation(this.getFile()) and
- c instanceof NormalCompletion and
- first(con.getBody(comp), succ)
- )
- }
- }
-
- private class NotPatternExprTree extends PostOrderTree instanceof NotPatternExpr {
- final override predicate propagatesAbnormal(AstNode child) { child = super.getPattern() }
-
- final override predicate first(AstNode first) { first(super.getPattern(), first) }
-
- final override predicate succ(AstNode pred, AstNode succ, Completion c) {
- succ = this and
- last(super.getPattern(), pred, c) and
- c instanceof NormalCompletion
- }
- }
-
- private class AndPatternExprTree extends PostOrderTree instanceof AndPatternExpr {
- final override predicate propagatesAbnormal(AstNode child) { child = super.getAnOperand() }
-
- final override predicate first(AstNode first) { first(super.getLeftOperand(), first) }
-
- final override predicate succ(AstNode pred, AstNode succ, Completion c) {
- // Flow from last element of left operand to first element of right operand
- last(super.getLeftOperand(), pred, c) and
- c.(MatchingCompletion).getValue() = true and
- first(super.getRightOperand(), succ)
- or
- // Post-order: flow from last element of left operand to element itself
- last(super.getLeftOperand(), pred, c) and
- c.(MatchingCompletion).getValue() = false and
- succ = this
- or
- // Post-order: flow from last element of right operand to element itself
- last(super.getRightOperand(), pred, c) and
- c instanceof MatchingCompletion and
- succ = this
- }
- }
-
- private class OrPatternExprTree extends PostOrderTree instanceof OrPatternExpr {
- final override predicate propagatesAbnormal(AstNode child) { child = super.getAnOperand() }
-
- final override predicate first(AstNode first) { first(super.getLeftOperand(), first) }
-
- final override predicate succ(AstNode pred, AstNode succ, Completion c) {
- // Flow from last element of left operand to first element of right operand
- last(super.getLeftOperand(), pred, c) and
- c.(MatchingCompletion).getValue() = false and
- first(super.getRightOperand(), succ)
- or
- // Post-order: flow from last element of left operand to element itself
- last(super.getLeftOperand(), pred, c) and
- c.(MatchingCompletion).getValue() = true and
- succ = this
- or
- // Post-order: flow from last element of right operand to element itself
- last(super.getRightOperand(), pred, c) and
- c instanceof MatchingCompletion and
- succ = this
- }
- }
-}
-
-private class RecursivePatternExprTree extends PostOrderTree instanceof RecursivePatternExpr {
- private Expr getTypeExpr() {
- result = super.getVariableDeclExpr()
- or
- not exists(super.getVariableDeclExpr()) and
- result = super.getTypeAccess()
- }
-
- private PatternExpr getChildPattern() {
- result = super.getPositionalPatterns()
- or
- result = super.getPropertyPatterns()
- }
-
- final override predicate propagatesAbnormal(AstNode child) { child = this.getChildPattern() }
-
- final override predicate first(AstNode first) {
- first(this.getTypeExpr(), first)
- or
- not exists(this.getTypeExpr()) and
- first(this.getChildPattern(), first)
- }
-
- final override predicate succ(AstNode pred, AstNode succ, Completion c) {
- // Flow from type test to child pattern
- last(this.getTypeExpr(), pred, c) and
- first(this.getChildPattern(), succ) and
- c.(MatchingCompletion).getValue() = true
- or
- // Flow from type test to self
- last(this.getTypeExpr(), pred, c) and
- succ = this and
- c.(MatchingCompletion).getValue() = false
- or
- // Flow from child pattern to self
- last(this.getChildPattern(), pred, c) and
- succ = this and
- c instanceof MatchingCompletion
- }
-}
-
-private class PositionalPatternExprTree extends PreOrderTree instanceof PositionalPatternExpr {
- final override predicate propagatesAbnormal(AstNode child) { child = super.getPattern(_) }
-
- final override predicate last(AstNode last, Completion c) {
- last = this and
- c.(MatchingCompletion).getValue() = false
- or
- last(super.getPattern(_), last, c) and
- c.(MatchingCompletion).getValue() = false
- or
- exists(int lst |
- last(super.getPattern(lst), last, c) and
- not exists(super.getPattern(lst + 1))
- )
- }
-
- final override predicate succ(AstNode pred, AstNode succ, Completion c) {
- // Flow from self to first pattern
- pred = this and
- c.(MatchingCompletion).getValue() = true and
- first(super.getPattern(0), succ)
- or
- // Flow from one pattern to the next
- exists(int i |
- last(super.getPattern(i), pred, c) and
- c.(MatchingCompletion).getValue() = true and
- first(super.getPattern(i + 1), succ)
- )
- }
-}
-
-private class PropertyPatternExprExprTree extends PostOrderTree instanceof PropertyPatternExpr {
- final override predicate propagatesAbnormal(AstNode child) { child = super.getPattern(_) }
-
- final override predicate first(AstNode first) {
- first(super.getPattern(0), first)
- or
- not exists(super.getPattern(0)) and
- first = this
- }
-
- final override predicate succ(AstNode pred, AstNode succ, Completion c) {
- // Flow from one pattern to the next
- exists(int i |
- last(super.getPattern(i), pred, c) and
- c.(MatchingCompletion).getValue() = true and
- first(super.getPattern(i + 1), succ)
- )
- or
- // Post-order: flow from last element of failing pattern to element itself
- last(super.getPattern(_), pred, c) and
- c.(MatchingCompletion).getValue() = false and
- succ = this
- or
- // Post-order: flow from last element of last pattern to element itself
- exists(int last |
- last(super.getPattern(last), pred, c) and
- not exists(super.getPattern(last + 1)) and
- c instanceof MatchingCompletion and
- succ = this
- )
- }
-}
-
-module Statements {
- private class StandardStmt extends StandardPreOrderTree instanceof Stmt {
- StandardStmt() {
- // The following statements need special treatment
- not this instanceof IfStmt and
- not this instanceof SwitchStmt and
- not this instanceof CaseStmt and
- not this instanceof LoopStmt and
- not this instanceof TryStmt and
- not this instanceof SpecificCatchClause and
- not this instanceof JumpStmt and
- not this instanceof LabeledStmt
- }
-
- private ControlFlowTree getChildNode0(int i) {
- not this instanceof GeneralCatchClause and
- not this instanceof FixedStmt and
- not this instanceof UsingBlockStmt and
- result = this.getChild(i)
- or
- this = any(GeneralCatchClause gcc | i = 0 and result = gcc.getBlock())
- or
- this =
- any(FixedStmt fs |
- result = fs.getVariableDeclExpr(i)
- or
- result = fs.getBody() and
- i = max(int j | exists(fs.getVariableDeclExpr(j))) + 1
- )
- or
- this =
- any(UsingBlockStmt us |
- result = us.getExpr() and
- i = 0
- or
- result = us.getVariableDeclExpr(i)
- or
- result = us.getBody() and
- i = max([1, count(us.getVariableDeclExpr(_))])
- )
- }
-
- final override AstNode getChildNode(int i) {
- result = rank[i + 1](AstNode cfe, int j | cfe = this.getChildNode0(j) | cfe order by j)
- }
- }
-
- private class IfStmtTree extends PreOrderTree instanceof IfStmt {
- final override predicate propagatesAbnormal(AstNode child) { child = super.getCondition() }
-
- final override predicate last(AstNode last, Completion c) {
- // Condition exits with a false completion and there is no `else` branch
- last(super.getCondition(), last, c) and
- c instanceof FalseCompletion and
- not exists(super.getElse())
- or
- // Then branch exits with any completion
- last(super.getThen(), last, c)
- or
- // Else branch exits with any completion
- last(super.getElse(), last, c)
- }
-
- final override predicate succ(AstNode pred, AstNode succ, Completion c) {
- // Pre-order: flow from statement itself to first element of condition
- pred = this and
- first(super.getCondition(), succ) and
- c instanceof SimpleCompletion
- or
- last(super.getCondition(), pred, c) and
- (
- // Flow from last element of condition to first element of then branch
- c instanceof TrueCompletion and first(super.getThen(), succ)
- or
- // Flow from last element of condition to first element of else branch
- c instanceof FalseCompletion and first(super.getElse(), succ)
- )
- }
- }
-
- private class SwitchStmtTree extends PreOrderTree, SwitchTree instanceof SwitchStmt {
- final override predicate last(AstNode last, Completion c) {
- // Switch expression exits normally and there are no cases
- not exists(super.getACase()) and
- last(super.getExpr(), last, c) and
- c instanceof NormalCompletion
- or
- // A statement exits with a `break` completion
- last(SwithStmtInternal::getStmt(this, _), last,
- c.(NestedBreakCompletion).getAnInnerCompatibleCompletion())
- or
- // A statement exits abnormally
- last(SwithStmtInternal::getStmt(this, _), last, c) and
- not c instanceof BreakCompletion and
- not c instanceof NormalCompletion and
- not any(LabeledStmtTree t |
- t.hasLabelInCallable(c.(GotoCompletion).getLabel(), super.getEnclosingCallable())
- ) instanceof CaseStmt
- or
- // Last case exits with a non-match
- exists(CaseStmt cs, int last_ |
- last_ = max(int i | exists(SwithStmtInternal::getCase(this, i))) and
- cs = SwithStmtInternal::getCase(this, last_)
- |
- last(cs.getPattern(), last, c) and
- not c.(MatchingCompletion).isMatch()
- or
- last(cs.getCondition(), last, c) and
- c instanceof FalseCompletion
- )
- }
-
- final override predicate succ(AstNode pred, AstNode succ, Completion c) {
- SwitchTree.super.succ(pred, succ, c)
- or
- // Pre-order: flow from statement itself to first switch expression
- pred = this and
- first(super.getExpr(), succ) and
- c instanceof SimpleCompletion
- or
- // Flow from last element of non-`case` statement `i` to first element of statement `i+1`
- exists(int i | last(SwithStmtInternal::getStmt(this, i), pred, c) |
- not SwithStmtInternal::getStmt(this, i) instanceof CaseStmt and
- c instanceof NormalCompletion and
- first(SwithStmtInternal::getStmt(this, i + 1), succ)
- )
- or
- // Flow from last element of `case` statement `i` to first element of statement `i+1`
- exists(int i, Stmt body |
- body = caseStmtGetBody(SwithStmtInternal::getStmt(this, i)) and
- // in case of fall-through cases, make sure to not jump from their shared body back
- // to one of the fall-through cases
- not body = caseStmtGetBody(SwithStmtInternal::getStmt(this, i + 1)) and
- last(body, pred, c)
- |
- c instanceof NormalCompletion and
- first(SwithStmtInternal::getStmt(this, i + 1), succ)
- )
- }
- }
-
- private class CaseStmtTree extends PreOrderTree, CaseTree instanceof CaseStmt {
- final override predicate last(AstNode last, Completion c) {
- // Condition exists with a `false` completion
- last(super.getCondition(), last, c) and
- c instanceof FalseCompletion
- or
- // Case pattern exits with a non-match
- last(super.getPattern(), last, c) and
- not c.(MatchingCompletion).isMatch()
- or
- // Case body exits with any completion
- last(caseStmtGetBody(this), last, c)
- }
-
- final override predicate succ(AstNode pred, AstNode succ, Completion c) {
- CaseTree.super.succ(pred, succ, c)
- or
- pred = this and
- first(super.getPattern(), succ) and
- c instanceof SimpleCompletion
- }
- }
-
- abstract private class LoopStmtTree extends PreOrderTree instanceof LoopStmt {
- final override predicate propagatesAbnormal(AstNode child) { child = super.getCondition() }
-
- final override predicate last(AstNode last, Completion c) {
- // Condition exits with a false completion
- last(super.getCondition(), last, c) and
- c instanceof FalseCompletion
- or
- // Body exits with a break completion
- last(super.getBody(), last, c.(NestedBreakCompletion).getAnInnerCompatibleCompletion())
- or
- // Body exits with a completion that does not continue the loop
- last(super.getBody(), last, c) and
- not c instanceof BreakCompletion and
- not c.continuesLoop()
- }
-
- override predicate succ(AstNode pred, AstNode succ, Completion c) {
- // Flow from last element of condition to first element of loop body
- last(super.getCondition(), pred, c) and
- c instanceof TrueCompletion and
- first(super.getBody(), succ)
- or
- // Flow from last element of loop body back to first element of condition
- not this instanceof ForStmt and
- last(super.getBody(), pred, c) and
- c.continuesLoop() and
- first(super.getCondition(), succ)
- }
- }
-
- private class WhileStmtTree extends LoopStmtTree instanceof WhileStmt {
- final override predicate succ(AstNode pred, AstNode succ, Completion c) {
- LoopStmtTree.super.succ(pred, succ, c)
- or
- pred = this and
- first(super.getCondition(), succ) and
- c instanceof SimpleCompletion
- }
- }
-
- private class DoStmtTree extends LoopStmtTree instanceof DoStmt {
- final override predicate succ(AstNode pred, AstNode succ, Completion c) {
- LoopStmtTree.super.succ(pred, succ, c)
- or
- pred = this and
- first(super.getBody(), succ) and
- c instanceof SimpleCompletion
- }
- }
-
- private class ForStmtTree extends LoopStmtTree instanceof ForStmt {
- /** Gets the condition if it exists, otherwise the body. */
- private AstNode getConditionOrBody() {
- result = super.getCondition()
- or
- not exists(super.getCondition()) and
- result = super.getBody()
- }
-
- final override predicate succ(AstNode pred, AstNode succ, Completion c) {
- LoopStmtTree.super.succ(pred, succ, c)
- or
- // Pre-order: flow from statement itself to first element of first initializer/
- // condition/loop body
- exists(AstNode next |
- pred = this and
- first(next, succ) and
- c instanceof SimpleCompletion
- |
- next = super.getInitializer(0)
- or
- not exists(super.getInitializer(0)) and
- next = this.getConditionOrBody()
- )
- or
- // Flow from last element of initializer `i` to first element of initializer `i+1`
- exists(int i | last(super.getInitializer(i), pred, c) |
- c instanceof NormalCompletion and
- first(super.getInitializer(i + 1), succ)
- )
- or
- // Flow from last element of last initializer to first element of condition/loop body
- exists(int last | last = max(int i | exists(super.getInitializer(i))) |
- last(super.getInitializer(last), pred, c) and
- c instanceof NormalCompletion and
- first(this.getConditionOrBody(), succ)
- )
- or
- // Flow from last element of condition into first element of loop body
- last(super.getCondition(), pred, c) and
- c instanceof TrueCompletion and
- first(super.getBody(), succ)
- or
- // Flow from last element of loop body to first element of update/condition/self
- exists(AstNode next |
- last(super.getBody(), pred, c) and
- c.continuesLoop() and
- first(next, succ) and
- if exists(super.getUpdate(0))
- then next = super.getUpdate(0)
- else next = this.getConditionOrBody()
- )
- or
- // Flow from last element of update to first element of next update/condition/loop body
- exists(AstNode next, int i |
- last(super.getUpdate(i), pred, c) and
- c instanceof NormalCompletion and
- first(next, succ) and
- if exists(super.getUpdate(i + 1))
- then next = super.getUpdate(i + 1)
- else next = this.getConditionOrBody()
- )
- }
- }
-
- private class ForeachStmtTree extends ControlFlowTree instanceof ForeachStmt {
- final override predicate propagatesAbnormal(AstNode child) { child = super.getIterableExpr() }
-
- final override predicate first(AstNode first) {
- // Unlike most other statements, `foreach` statements are not modeled in
- // pre-order, because we use the `foreach` node itself to represent the
- // emptiness test that determines whether to execute the loop body
- first(super.getIterableExpr(), first)
- }
-
- final override predicate last(AstNode last, Completion c) {
- // Emptiness test exits with no more elements
- last = this and
- c.(EmptinessCompletion).isEmpty()
- or
- // Body exits with a break completion
- last(super.getBody(), last, c.(NestedBreakCompletion).getAnInnerCompatibleCompletion())
- or
- // Body exits abnormally
- last(super.getBody(), last, c) and
- not c instanceof NormalCompletion and
- not c instanceof ContinueCompletion and
- not c instanceof BreakCompletion
- }
-
- final override predicate succ(AstNode pred, AstNode succ, Completion c) {
- // Flow from last element of iterator expression to emptiness test
- last(super.getIterableExpr(), pred, c) and
- c instanceof NormalCompletion and
- succ = this
- or
- // Flow from emptiness test to first element of variable declaration/loop body
- pred = this and
- c = any(EmptinessCompletion ec | not ec.isEmpty()) and
- (
- first(super.getVariableDeclExpr(), succ)
- or
- first(super.getVariableDeclTuple(), succ)
- or
- not exists(super.getVariableDeclExpr()) and
- not exists(super.getVariableDeclTuple()) and
- first(super.getBody(), succ)
- )
- or
- // Flow from last element of variable declaration to first element of loop body
- (
- last(super.getVariableDeclExpr(), pred, c) or
- last(super.getVariableDeclTuple(), pred, c)
- ) and
- c instanceof SimpleCompletion and
- first(super.getBody(), succ)
- or
- // Flow from last element of loop body back to emptiness test
- last(super.getBody(), pred, c) and
- c.continuesLoop() and
- succ = this
- }
- }
-
- pragma[nomagic]
- private AstNode lastLastCatchClause(CatchClause cc, Completion c) {
- cc.isLast() and
- last(cc, result, c)
- }
-
- pragma[nomagic]
- private AstNode lastCatchClauseBlock(CatchClause cc, Completion c) {
- last(cc.getBlock(), result, c)
- }
-
- /** Gets a child of `cfe` that is in CFG scope `scope`. */
- pragma[noinline]
- private ControlFlowElement getAChildInScope(AstNode cfe, Callable scope) {
- result = cfe.getAChild() and
- scope = result.getEnclosingCallable()
- }
-
- class TryStmtTree extends PreOrderTree instanceof TryStmt {
- final override predicate propagatesAbnormal(AstNode child) { child = super.getFinally() }
-
- /**
- * Gets a descendant that belongs to the finally block of this try statement.
- */
- AstNode getAFinallyDescendant() {
- result = super.getFinally()
- or
- exists(ControlFlowElement mid |
- mid = this.getAFinallyDescendant() and
- result = getAChildInScope(mid, mid.getEnclosingCallable()) and
- not exists(TryStmt nestedTry |
- result = nestedTry.getFinally() and
- nestedTry != this
- )
- )
- }
-
- /**
- * Holds if `innerTry` has a finally block and is immediately nested inside the
- * finally block of this try statement.
- */
- private predicate nestedFinally(TryStmt innerTry) {
- exists(AstNode innerFinally |
- innerFinally = getAChildInScope(this.getAFinallyDescendant(), super.getEnclosingCallable()) and
- innerFinally = innerTry.getFinally()
- )
- }
-
- /**
- * Gets the finally-nesting level of this try statement. That is, the number of
- * finally blocks that this try statement is nested under.
- */
- int nestLevel() { result = count(TryStmtTree outer | outer.nestedFinally+(this)) }
-
- /** Holds if `last` is a last element of the block of this try statement. */
- pragma[nomagic]
- predicate lastBlock(AstNode last, Completion c) { last(super.getBlock(), last, c) }
-
- /**
- * Gets a last element from a `try` or `catch` block of this try statement
- * that may finish with completion `c`, such that control may be transferred
- * to the finally block (if it exists), but only if `finalizable = true`.
- */
- pragma[nomagic]
- AstNode getAFinallyPredecessor(Completion c, boolean finalizable) {
- // Exit completions skip the finally block
- (if c instanceof ExitCompletion then finalizable = false else finalizable = true) and
- (
- this.lastBlock(result, c) and
- (
- // Any non-throw completion from the `try` block will always continue directly
- // to the finally block
- not c instanceof ThrowCompletion
- or
- // Any completion from the `try` block will continue to the finally block
- // when there are no catch clauses
- not exists(super.getACatchClause())
- )
- or
- // Last element from any of the `catch` clause blocks continues to the finally block
- result = lastCatchClauseBlock(super.getACatchClause(), c)
- or
- // Last element of last `catch` clause continues to the finally block
- result = lastLastCatchClause(super.getACatchClause(), c)
- )
- }
-
- pragma[nomagic]
- private predicate lastFinally0(AstNode last, Completion c) { last(super.getFinally(), last, c) }
-
- pragma[nomagic]
- private predicate lastFinally(
- AstNode last, NormalCompletion finally, Completion outer, int nestLevel
- ) {
- this.lastFinally0(last, finally) and
- exists(
- this.getAFinallyPredecessor(any(Completion c0 | outer = c0.getOuterCompletion()), true)
- ) and
- nestLevel = this.nestLevel()
- }
-
- final override predicate last(AstNode last, Completion c) {
- exists(boolean finalizable | last = this.getAFinallyPredecessor(c, finalizable) |
- // If there is no finally block, last elements are from the body, from
- // the blocks of one of the `catch` clauses, or from the last `catch` clause
- not super.hasFinally()
- or
- finalizable = false
- )
- or
- this.lastFinally(last, c, any(NormalCompletion nc), _)
- or
- // If the finally block completes normally, it inherits any non-normal
- // completion that was current before the finally block was entered
- exists(int nestLevel |
- c =
- any(NestedCompletion nc |
- this.lastFinally(last, nc.getAnInnerCompatibleCompletion(), nc.getOuterCompletion(),
- nestLevel) and
- // unbind
- nc.getNestLevel() >= nestLevel and
- nc.getNestLevel() <= nestLevel
- )
- )
- }
-
- /**
- * Gets an exception type that is thrown by `cfe` in the block of this `try`
- * statement. Throw completion `c` matches the exception type.
- */
- ExceptionClass getAThrownException(AstNode cfe, ThrowCompletion c) {
- this.lastBlock(cfe, c) and
- result = c.getExceptionClass()
- }
-
- final override predicate succ(AstNode pred, AstNode succ, Completion c) {
- // Pre-order: flow from statement itself to first element of body
- pred = this and
- first(super.getBlock(), succ) and
- c instanceof SimpleCompletion
- or
- // Flow from last element of body to first `catch` clause
- exists(this.getAThrownException(pred, c)) and
- first(super.getCatchClause(0), succ)
- or
- exists(CatchClause cc, int i | cc = super.getCatchClause(i) |
- // Flow from one `catch` clause to the next
- pred = cc and
- last(super.getCatchClause(i), cc, c) and
- first(super.getCatchClause(i + 1), succ) and
- c = any(MatchingCompletion mc | not mc.isMatch())
- or
- // Flow from last element of `catch` clause filter to next `catch` clause
- last(super.getCatchClause(i), pred, c) and
- last(cc.getFilterClause(), pred, _) and
- first(super.getCatchClause(i + 1), succ) and
- c instanceof FalseCompletion
- )
- or
- // Flow into finally block
- pred = this.getAFinallyPredecessor(c, true) and
- first(super.getFinally(), succ)
- }
- }
-
- private class SpecificCatchClauseTree extends PreOrderTree instanceof SpecificCatchClause {
- final override predicate propagatesAbnormal(AstNode child) { child = super.getFilterClause() }
-
- pragma[nomagic]
- private predicate lastFilterClause(AstNode last, Completion c) {
- last(super.getFilterClause(), last, c)
- }
-
- /**
- * Holds if the `try` block that this catch clause belongs to may throw an
- * exception of type `c`, where no `catch` clause is guaranteed to catch it.
- * This catch clause is the last catch clause in the try statement that
- * it belongs to.
- */
- pragma[nomagic]
- private predicate throwMayBeUncaught(ThrowCompletion c) {
- exists(TryStmt ts |
- ts = super.getTryStmt() and
- ts.(TryStmtTree).lastBlock(_, c) and
- not ts.getACatchClause() instanceof GeneralCatchClause and
- forall(SpecificCatchClause scc | scc = ts.getACatchClause() |
- scc.hasFilterClause()
- or
- not c.getExceptionClass().getABaseType*() = scc.getCaughtExceptionType()
- ) and
- super.isLast()
- )
- }
-
- final override predicate last(AstNode last, Completion c) {
- // Last element of `catch` block
- last(super.getBlock(), last, c)
- or
- not super.isLast() and
- (
- // Incompatible exception type: clause itself
- last = this and
- c.(MatchingCompletion).isNonMatch()
- or
- // Incompatible filter
- this.lastFilterClause(last, c) and
- c instanceof FalseCompletion
- )
- or
- // Last `catch` clause inherits throw completions from the `try` block,
- // when the clause does not match
- super.isLast() and
- c =
- any(NestedCompletion nc |
- nc.getNestLevel() = 0 and
- this.throwMayBeUncaught(nc.getOuterCompletion()) and
- (
- // Incompatible exception type: clause itself
- last = this and
- nc.getInnerCompletion() =
- any(MatchingCompletion mc |
- mc.isNonMatch() and
- mc.isValidFor(this)
- )
- or
- // Incompatible filter
- this.lastFilterClause(last, nc.getInnerCompletion().(FalseCompletion))
- )
- )
- }
-
- final override predicate succ(AstNode pred, AstNode succ, Completion c) {
- // Flow from catch clause to variable declaration/filter clause/block
- pred = this and
- c.(MatchingCompletion).isMatch() and
- exists(AstNode next | first(next, succ) |
- if exists(super.getVariableDeclExpr())
- then next = super.getVariableDeclExpr()
- else
- if exists(super.getFilterClause())
- then next = super.getFilterClause()
- else next = super.getBlock()
- )
- or
- // Flow from variable declaration to filter clause/block
- last(super.getVariableDeclExpr(), pred, c) and
- c instanceof SimpleCompletion and
- exists(AstNode next | first(next, succ) |
- if exists(super.getFilterClause())
- then next = super.getFilterClause()
- else next = super.getBlock()
- )
- or
- // Flow from filter to block
- last(super.getFilterClause(), pred, c) and
- c instanceof TrueCompletion and
- first(super.getBlock(), succ)
- }
- }
-
- private class JumpStmtTree extends PostOrderTree instanceof JumpStmt {
- final override predicate propagatesAbnormal(AstNode child) { child = this.getChild(0) }
-
- final override predicate first(AstNode first) {
- first(this.getChild(0), first)
- or
- not exists(this.getChild(0)) and first = this
- }
-
- final override predicate succ(AstNode pred, AstNode succ, Completion c) {
- last(this.getChild(0), pred, c) and
- succ = this and
- c instanceof NormalCompletion
- }
- }
-
- pragma[nomagic]
- private predicate goto(ControlFlowElement cfe, GotoCompletion gc, string label, Callable enclosing) {
- last(_, cfe, gc) and
- // Special case: when a `goto` happens inside a try statement with a
- // finally block, flow does not go directly to the target, but instead
- // to the finally block (and from there possibly to the target)
- not cfe =
- any(Statements::TryStmtTree t | t.(TryStmt).hasFinally()).getAFinallyPredecessor(_, true) and
- label = gc.getLabel() and
- enclosing = cfe.getEnclosingCallable()
- }
-
- private class LabeledStmtTree extends PreOrderTree instanceof LabeledStmt {
- final override predicate propagatesAbnormal(AstNode child) { none() }
-
- final override predicate last(AstNode last, Completion c) {
- if this instanceof DefaultCase
- then last(super.getStmt(), last, c)
- else (
- not this instanceof CaseStmt and
- last = this and
- c.isValidFor(this)
- )
- }
-
- pragma[noinline]
- predicate hasLabelInCallable(string label, Callable c) {
- super.getEnclosingCallable() = c and
- label = super.getLabel()
- }
-
- final override predicate succ(AstNode pred, AstNode succ, Completion c) {
- this instanceof DefaultCase and
- pred = this and
- first(super.getStmt(), succ) and
- c instanceof SimpleCompletion
- or
- // Flow from element with matching `goto` completion to this statement
- exists(string label, Callable enclosing |
- goto(pred, c, label, enclosing) and
- this.hasLabelInCallable(label, enclosing) and
- succ = this
- )
- }
- }
-}
-
-/** A control flow element that is split into multiple control flow nodes. */
-class SplitAstNode extends AstNode, ControlFlowElement {
- SplitAstNode() { strictcount(this.getAControlFlowNode()) > 1 }
-}
diff --git a/csharp/ql/lib/semmle/code/csharp/controlflow/internal/NonReturning.qll b/csharp/ql/lib/semmle/code/csharp/controlflow/internal/NonReturning.qll
index 10f92d882b79..45f802619bed 100644
--- a/csharp/ql/lib/semmle/code/csharp/controlflow/internal/NonReturning.qll
+++ b/csharp/ql/lib/semmle/code/csharp/controlflow/internal/NonReturning.qll
@@ -9,13 +9,9 @@ import csharp
private import semmle.code.csharp.ExprOrStmtParent
private import semmle.code.csharp.commons.Assertions
private import semmle.code.csharp.frameworks.System
-private import Completion
/** A call that definitely does not return (conservative analysis). */
-abstract class NonReturningCall extends Call {
- /** Gets a valid completion for this non-returning call. */
- abstract Completion getACompletion();
-}
+abstract class NonReturningCall extends Call { }
private class ExitingCall extends NonReturningCall {
ExitingCall() {
@@ -23,36 +19,21 @@ private class ExitingCall extends NonReturningCall {
or
this = any(FailingAssertion fa | fa.getAssertionFailure().isExit())
}
-
- override ExitCompletion getACompletion() { not result instanceof NestedCompletion }
}
private class ThrowingCall extends NonReturningCall {
- private ThrowCompletion c;
-
ThrowingCall() {
- not c instanceof NestedCompletion and
- (
- c = this.getTarget().(ThrowingCallable).getACallCompletion()
- or
- this.(FailingAssertion).getAssertionFailure().isException(c.getExceptionClass())
- or
- this =
- any(MethodCall mc |
- mc.getTarget()
- .hasFullyQualifiedName("System.Runtime.ExceptionServices", "ExceptionDispatchInfo",
- "Throw") and
- (
- mc.hasNoArguments() and
- c.getExceptionClass() instanceof SystemExceptionClass
- or
- c.getExceptionClass() = mc.getArgument(0).getType()
- )
- )
- )
+ this.getTarget() instanceof ThrowingCallable
+ or
+ this.(FailingAssertion).getAssertionFailure().isException(_)
+ or
+ this =
+ any(MethodCall mc |
+ mc.getTarget()
+ .hasFullyQualifiedName("System.Runtime.ExceptionServices", "ExceptionDispatchInfo",
+ "Throw")
+ )
}
-
- override ThrowCompletion getACompletion() { result = c }
}
/** Holds if accessor `a` has an auto-implementation. */
@@ -107,44 +88,35 @@ private Stmt getAnExitingStmt() {
private class ThrowingCallable extends NonReturningCallable {
ThrowingCallable() {
- forex(ControlFlowElement body | body = this.getBody() | body = getAThrowingElement(_))
+ forex(ControlFlowElement body | body = this.getBody() | body = getAThrowingElement())
}
-
- /** Gets a valid completion for a call to this throwing callable. */
- ThrowCompletion getACallCompletion() { this.getBody() = getAThrowingElement(result) }
}
-private predicate directlyThrows(ThrowElement te, ThrowCompletion c) {
- c.getExceptionClass() = te.getThrownExceptionType() and
- not c instanceof NestedCompletion and
+private predicate directlyThrows(ThrowElement te) {
// For stub implementations, there may exist proper implementations that are not seen
// during compilation, so we conservatively rule those out
not isStub(te)
}
-private ControlFlowElement getAThrowingElement(ThrowCompletion c) {
- c = result.(ThrowingCall).getACompletion()
+private ControlFlowElement getAThrowingElement() {
+ result instanceof ThrowingCall
or
- directlyThrows(result, c)
+ directlyThrows(result)
or
- result = getAThrowingStmt(c)
+ result = getAThrowingStmt()
}
-private Stmt getAThrowingStmt(ThrowCompletion c) {
- directlyThrows(result, c)
+private Stmt getAThrowingStmt() {
+ directlyThrows(result)
or
- result.(ExprStmt).getExpr() = getAThrowingElement(c)
+ result.(ExprStmt).getExpr() = getAThrowingElement()
or
- result.(BlockStmt).getFirstStmt() = getAThrowingStmt(c)
+ result.(BlockStmt).getFirstStmt() = getAThrowingStmt()
or
- exists(IfStmt ifStmt, ThrowCompletion c1, ThrowCompletion c2 |
+ exists(IfStmt ifStmt |
result = ifStmt and
- ifStmt.getThen() = getAThrowingStmt(c1) and
- ifStmt.getElse() = getAThrowingStmt(c2)
- |
- c = c1
- or
- c = c2
+ ifStmt.getThen() = getAThrowingStmt() and
+ ifStmt.getElse() = getAThrowingStmt()
)
}
diff --git a/csharp/ql/lib/semmle/code/csharp/controlflow/internal/Splitting.qll b/csharp/ql/lib/semmle/code/csharp/controlflow/internal/Splitting.qll
deleted file mode 100644
index 173179216f3d..000000000000
--- a/csharp/ql/lib/semmle/code/csharp/controlflow/internal/Splitting.qll
+++ /dev/null
@@ -1,124 +0,0 @@
-/**
- * INTERNAL: Do not use.
- *
- * Provides classes and predicates relevant for splitting the control flow graph.
- */
-
-import csharp
-private import Completion as Comp
-private import Comp
-private import ControlFlowGraphImpl
-private import semmle.code.csharp.controlflow.ControlFlowGraph::ControlFlow as Cfg
-
-cached
-private module Cached {
- private import semmle.code.csharp.Caching
-
- cached
- newtype TSplitKind = TConditionalCompletionSplitKind()
-
- cached
- newtype TSplit = TConditionalCompletionSplit(ConditionalCompletion c)
-}
-
-import Cached
-
-/**
- * A split for a control flow element. For example, a tag that determines how to
- * continue execution after leaving a `finally` block.
- */
-class Split extends TSplit {
- /** Gets a textual representation of this split. */
- string toString() { none() }
-}
-
-module ConditionalCompletionSplitting {
- /**
- * A split for conditional completions. For example, in
- *
- * ```csharp
- * void M(int i)
- * {
- * if (x && !y)
- * System.Console.WriteLine("true")
- * }
- * ```
- *
- * we record whether `x`, `y`, and `!y` evaluate to `true` or `false`, and restrict
- * the edges out of `!y` and `x && !y` accordingly.
- */
- class ConditionalCompletionSplit extends Split, TConditionalCompletionSplit {
- ConditionalCompletion completion;
-
- ConditionalCompletionSplit() { this = TConditionalCompletionSplit(completion) }
-
- ConditionalCompletion getCompletion() { result = completion }
-
- override string toString() { result = completion.toString() }
- }
-
- private class ConditionalCompletionSplitKind_ extends SplitKind, TConditionalCompletionSplitKind {
- override int getListOrder() { result = 0 }
-
- override predicate isEnabled(AstNode cfe) { this.appliesTo(cfe) }
-
- override string toString() { result = "ConditionalCompletion" }
- }
-
- module ConditionalCompletionSplittingInput {
- private import Completion as Comp
-
- class ConditionalCompletion = Comp::ConditionalCompletion;
-
- class ConditionalCompletionSplitKind extends ConditionalCompletionSplitKind_, TSplitKind { }
-
- class ConditionalCompletionSplit = ConditionalCompletionSplitting::ConditionalCompletionSplit;
-
- bindingset[parent, parentCompletion]
- predicate condPropagateExpr(
- AstNode parent, ConditionalCompletion parentCompletion, AstNode child,
- ConditionalCompletion childCompletion
- ) {
- child = parent.(LogicalNotExpr).getOperand() and
- childCompletion.getDual() = parentCompletion
- or
- childCompletion = parentCompletion and
- (
- child = parent.(LogicalAndExpr).getAnOperand()
- or
- child = parent.(LogicalOrExpr).getAnOperand()
- or
- parent = any(ConditionalExpr ce | child = [ce.getThen(), ce.getElse()])
- or
- child = parent.(SwitchExpr).getACase()
- or
- child = parent.(SwitchCaseExpr).getBody()
- or
- parent =
- any(NullCoalescingOperation nce |
- if childCompletion instanceof NullnessCompletion
- then child = nce.getRightOperand()
- else child = nce.getAnOperand()
- )
- )
- or
- child = parent.(NotPatternExpr).getPattern() and
- childCompletion.getDual() = parentCompletion
- or
- child = parent.(IsExpr).getPattern() and
- parentCompletion.(BooleanCompletion).getValue() =
- childCompletion.(MatchingCompletion).getValue()
- or
- childCompletion = parentCompletion and
- (
- child = parent.(AndPatternExpr).getAnOperand()
- or
- child = parent.(OrPatternExpr).getAnOperand()
- or
- child = parent.(RecursivePatternExpr).getAChildExpr()
- or
- child = parent.(PropertyPatternExpr).getPattern(_)
- )
- }
- }
-}
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/Nullness.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/Nullness.qll
index a82779eaa5d7..1cd9c71acfc9 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/Nullness.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/Nullness.qll
@@ -31,7 +31,7 @@ private Expr maybeNullExpr(Expr reason) {
or
result instanceof AsExpr and reason = result
or
- result.(AssignExpr).getRValue() = maybeNullExpr(reason)
+ result.(AssignExpr).getRightOperand() = maybeNullExpr(reason)
or
result.(CastExpr).getExpr() = maybeNullExpr(reason)
or
@@ -67,8 +67,8 @@ class AlwaysNullExpr extends Expr {
exists(AlwaysNullExpr e1, AlwaysNullExpr e2 | G::Internal::nullValueImpliedBinary(e1, e2, this))
or
this =
- any(Ssa::Definition def |
- forex(Ssa::Definition u | u = def.getAnUltimateDefinition() | nullDef(u))
+ any(SsaDefinition def |
+ forex(SsaDefinition u | u = def.getAnUltimateDefinition() | nullDef(u))
).getARead()
or
exists(Callable target |
@@ -80,9 +80,7 @@ class AlwaysNullExpr extends Expr {
}
/** Holds if SSA definition `def` is always `null`. */
-private predicate nullDef(Ssa::ExplicitDefinition def) {
- def.getADefinition().getSource() instanceof AlwaysNullExpr
-}
+private predicate nullDef(SsaExplicitWrite def) { def.getValue() instanceof AlwaysNullExpr }
/** An expression that is never `null`. */
class NonNullExpr extends Expr {
@@ -94,8 +92,8 @@ class NonNullExpr extends Expr {
this instanceof G::NullGuardedExpr
or
this =
- any(Ssa::Definition def |
- forex(Ssa::Definition u | u = def.getAnUltimateDefinition() | nonNullDef(u))
+ any(SsaDefinition def |
+ forex(SsaDefinition u | u = def.getAnUltimateDefinition() | nonNullDef(u))
).getARead()
or
exists(Callable target |
@@ -108,10 +106,10 @@ class NonNullExpr extends Expr {
}
/** Holds if SSA definition `def` is never `null`. */
-private predicate nonNullDef(Ssa::ExplicitDefinition def) {
- def.getADefinition().getSource() instanceof NonNullExpr
+private predicate nonNullDef(SsaExplicitWrite def) {
+ def.getValue() instanceof NonNullExpr
or
- exists(AssignableDefinition ad | ad = def.getADefinition() |
+ exists(AssignableDefinition ad | ad = def.getDefinition() |
ad instanceof AssignableDefinitions::PatternDefinition
or
ad =
@@ -124,13 +122,11 @@ private predicate nonNullDef(Ssa::ExplicitDefinition def) {
}
/**
- * Holds if `node` is a dereference `d` of SSA definition `def`.
+ * Holds if `d` is a dereference of SSA definition `def`.
*/
-private predicate dereferenceAt(ControlFlow::Node node, Ssa::Definition def, Dereference d) {
- d = def.getAReadAtNode(node)
-}
+private predicate dereferenceAt(SsaDefinition def, Dereference d) { d = def.getARead() }
-private predicate isMaybeNullArgument(Ssa::ImplicitParameterDefinition def, MaybeNullExpr arg) {
+private predicate isMaybeNullArgument(SsaParameterInit def, MaybeNullExpr arg) {
exists(AssignableDefinitions::ImplicitParameterDefinition pdef, Parameter p |
p = def.getParameter()
|
@@ -181,20 +177,8 @@ private predicate hasMultipleParamsArguments(Call c) {
)
}
-private predicate isNullDefaultArgument(Ssa::ImplicitParameterDefinition def, AlwaysNullExpr arg) {
- exists(AssignableDefinitions::ImplicitParameterDefinition pdef, Parameter p |
- p = def.getParameter()
- |
- p = pdef.getParameter().getUnboundDeclaration() and
- arg = p.getDefaultValue() and
- not arg.getEnclosingCallable().getEnclosingCallable*() instanceof TestMethod
- )
-}
-
/** Holds if `def` is an SSA definition that may be `null`. */
-private predicate defMaybeNull(
- Ssa::Definition def, ControlFlow::Node node, string msg, Element reason
-) {
+private predicate defMaybeNull(SsaDefinition def, ControlFlowNode node, string msg, Element reason) {
not nonNullDef(def) and
(
// A variable compared to `null` might be `null`
@@ -202,10 +186,10 @@ private predicate defMaybeNull(
de.guardSuggestsMaybeNull(reason) and
msg = "as suggested by $@ null check" and
node = def.getControlFlowNode() and
- not de = any(Ssa::PhiNode phi).getARead() and
+ not de = any(SsaPhiDefinition phi).getARead() and
// Don't use a check as reason if there is a `null` assignment
// or argument
- not def.(Ssa::ExplicitDefinition).getADefinition().getSource() instanceof MaybeNullExpr and
+ not def.(SsaExplicitWrite).getValue() instanceof MaybeNullExpr and
not isMaybeNullArgument(def, _)
)
or
@@ -218,37 +202,33 @@ private predicate defMaybeNull(
else msg = "because of $@ potential null argument"
)
or
- isNullDefaultArgument(def, reason) and
- node = def.getControlFlowNode() and
- msg = "because the parameter has a null default value"
- or
// If the source of a variable is `null` then the variable may be `null`
- exists(AssignableDefinition adef | adef = def.(Ssa::ExplicitDefinition).getADefinition() |
- adef.getSource() = maybeNullExpr(node.getAstNode()) and
+ exists(AssignableDefinition adef | adef = def.(SsaExplicitWrite).getDefinition() |
+ adef.getSource() = maybeNullExpr(node.asExpr()) and
reason = adef.getExpr() and
msg = "because of $@ assignment"
)
or
// A variable of nullable type may be null
- exists(Dereference d | dereferenceAt(_, def, d) |
+ exists(Dereference d | dereferenceAt(def, d) |
node = def.getControlFlowNode() and
d.hasNullableType() and
- not def instanceof Ssa::PhiNode and
+ not def instanceof SsaPhiDefinition and
reason = def.getSourceVariable().getAssignable() and
msg = "because it has a nullable type"
)
)
}
-private Ssa::Definition getAPseudoInput(Ssa::Definition def) {
- result = def.(Ssa::PhiNode).getAnInput()
+private SsaDefinition getAPseudoInput(SsaDefinition def) {
+ result = def.(SsaPhiDefinition).getAnInput()
}
// `def.getAnUltimateDefinition()` includes inputs into uncertain
// definitions, but we only want inputs into pseudo nodes
-private Ssa::Definition getAnUltimateDefinition(Ssa::Definition def) {
+private SsaDefinition getAnUltimateDefinition(SsaDefinition def) {
result = getAPseudoInput*(def) and
- not result instanceof Ssa::PhiNode
+ not result instanceof SsaPhiDefinition
}
/**
@@ -256,21 +236,22 @@ private Ssa::Definition getAnUltimateDefinition(Ssa::Definition def) {
* through an intermediate dereference that always throws a null reference
* exception.
*/
-private predicate defReaches(Ssa::Definition def, ControlFlow::Node cfn) {
- exists(def.getAFirstReadAtNode(cfn))
+private predicate defReaches(SsaDefinition def, ControlFlowNode cfn) {
+ Ssa::ssaGetAFirstUse(def).getControlFlowNode() = cfn
or
- exists(ControlFlow::Node mid | defReaches(def, mid) |
+ exists(ControlFlowNode mid | defReaches(def, mid) |
SsaImpl::adjacentReadPairSameVar(_, mid, cfn) and
- not mid = any(Dereference d | d.isAlwaysNull(def.getSourceVariable())).getAControlFlowNode()
+ not mid = any(Dereference d | d.isAlwaysNull(def.getSourceVariable())).getControlFlowNode()
)
}
private module NullnessConfig implements ControlFlowReachability::ConfigSig {
- predicate source(ControlFlow::Node node, Ssa::Definition def) { defMaybeNull(def, node, _, _) }
+ predicate source(ControlFlowNode node, SsaDefinition def) { defMaybeNull(def, node, _, _) }
- predicate sink(ControlFlow::Node node, Ssa::Definition def) {
+ predicate sink(ControlFlowNode node, SsaDefinition def) {
exists(Dereference d |
- dereferenceAt(node, def, d) and
+ dereferenceAt(def, d) and
+ node = d.getControlFlowNode() and
not d instanceof NonNullExpr
)
}
@@ -283,13 +264,12 @@ private module NullnessConfig implements ControlFlowReachability::ConfigSig {
private module NullnessFlow = ControlFlowReachability::Flow;
predicate maybeNullDeref(Dereference d, Ssa::SourceVariable v, string msg, Element reason) {
- exists(
- Ssa::Definition origin, Ssa::Definition ssa, ControlFlow::Node src, ControlFlow::Node sink
- |
+ exists(SsaDefinition origin, SsaDefinition ssa, ControlFlowNode src, ControlFlowNode sink |
defMaybeNull(origin, src, msg, reason) and
NullnessFlow::flow(src, origin, sink, ssa) and
ssa.getSourceVariable() = v and
- dereferenceAt(sink, ssa, d) and
+ dereferenceAt(ssa, d) and
+ sink = d.getControlFlowNode() and
not d.isAlwaysNull(v)
)
}
@@ -340,10 +320,7 @@ class Dereference extends G::DereferenceableExpr {
not p.getAnnotatedType().isNullableRefType()
or
p.fromSource() and
- exists(
- Ssa::ImplicitParameterDefinition def,
- AssignableDefinitions::ImplicitParameterDefinition pdef
- |
+ exists(SsaParameterInit def, AssignableDefinitions::ImplicitParameterDefinition pdef |
p = def.getParameter()
|
p.getUnboundDeclaration() = pdef.getParameter() and
@@ -353,9 +330,9 @@ class Dereference extends G::DereferenceableExpr {
)
}
- private predicate isAlwaysNull0(Ssa::Definition def) {
- forall(Ssa::Definition input | input = getAnUltimateDefinition(def) |
- input.(Ssa::ExplicitDefinition).getADefinition().getSource() instanceof AlwaysNullExpr
+ private predicate isAlwaysNull0(SsaDefinition def) {
+ forall(SsaDefinition input | input = getAnUltimateDefinition(def) |
+ input.(SsaExplicitWrite).getValue() instanceof AlwaysNullExpr
) and
not nonNullDef(def) and
this = def.getARead() and
@@ -371,7 +348,7 @@ class Dereference extends G::DereferenceableExpr {
// Exclude fields and properties, as they may not have an accurate SSA representation
v.getAssignable() instanceof LocalScopeVariable and
(
- forex(Ssa::Definition def0 | this = def0.getARead() | this.isAlwaysNull0(def0))
+ forex(SsaDefinition def0 | this = def0.getARead() | this.isAlwaysNull0(def0))
or
exists(G::GuardValue nv |
this.(G::GuardedExpr).mustHaveValue(nv) and
@@ -388,6 +365,6 @@ class Dereference extends G::DereferenceableExpr {
*/
predicate isFirstAlwaysNull(Ssa::SourceVariable v) {
this.isAlwaysNull(v) and
- defReaches(v.getAnSsaDefinition(), this.getAControlFlowNode())
+ defReaches(v.getAnSsaDefinition(), this.getControlFlowNode())
}
}
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/SSA.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/SSA.qll
index e8180201b9a8..fee6bedf0f3e 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/SSA.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/SSA.qll
@@ -3,13 +3,14 @@
*/
import csharp
+private import internal.SsaImpl as SsaImpl
+import SsaImpl::Ssa_
/**
* Provides classes for working with static single assignment (SSA) form.
*/
module Ssa {
- private import internal.SsaImpl as SsaImpl
- private import semmle.code.csharp.internal.Location
+ import SsaImpl::Ssa_
pragma[nomagic]
private predicate assignableDefinitionLocalScopeVariable(
@@ -19,15 +20,6 @@ module Ssa {
ad.getEnclosingCallable() = c
}
- pragma[nomagic]
- private predicate localScopeSourceVariable(
- SourceVariables::LocalScopeSourceVariable sv, LocalScopeVariable v, Callable c1, Callable c2
- ) {
- sv.getAssignable() = v and
- sv.getEnclosingCallable() = c1 and
- v.getCallable() = c2
- }
-
/**
* A variable that can be SSA converted.
*
@@ -54,7 +46,7 @@ module Ssa {
not exists(result.getTargetAccess()) and
exists(LocalScopeVariable v, Callable c |
assignableDefinitionLocalScopeVariable(result, v, c) and
- localScopeSourceVariable(this, v, c, _)
+ SsaImpl::localScopeSourceVariable(this, v, c, _)
)
}
@@ -82,7 +74,7 @@ module Ssa {
* Gets an SSA definition that has this variable as its underlying
* source variable.
*/
- Definition getAnSsaDefinition() { result.getSourceVariable() = this }
+ SsaDefinition getAnSsaDefinition() { result.getSourceVariable() = this }
}
/** Provides different types of `SourceVariable`s. */
@@ -158,16 +150,52 @@ module Ssa {
}
/**
+ * Gets a read of the source variable underlying the SSA definition `def`
+ * that can be reached from `def` without passing through any
+ * other SSA definition or read. Example:
+ *
+ * ```csharp
+ * int Field;
+ *
+ * void SetField(int i) {
+ * this.Field = i;
+ * Use(this.Field);
+ * if (i > 0)
+ * this.Field = i - 1;
+ * else if (i < 0)
+ * SetField(1);
+ * Use(this.Field);
+ * Use(this.Field);
+ * }
+ * ```
+ *
+ * - The read of `i` on line 4 can be reached from the explicit SSA
+ * definition (wrapping an implicit entry definition) on line 3.
+ * - The reads of `i` on lines 6 and 7 are not the first reads of any SSA
+ * definition.
+ * - The read of `this.Field` on line 5 can be reached from the explicit SSA
+ * definition on line 4.
+ * - The read of `this.Field` on line 10 can be reached from the phi node
+ * between lines 9 and 10.
+ * - The read of `this.Field` on line 11 is not the first read of any SSA
+ * definition.
+ *
+ * Subsequent reads can be found by following the steps defined by
+ * `AssignableRead.getANextRead()`.
+ */
+ AssignableRead ssaGetAFirstUse(SsaDefinition def) { SsaImpl::firstReadSameVar(def, result) }
+
+ /**
+ * DEPRECATED: Use `SsaDefinition` instead.
+ *
* A static single assignment (SSA) definition. Either an explicit variable
* definition (`ExplicitDefinition`), an implicit variable definition
* (`ImplicitDefinition`), or a phi node (`PhiNode`).
*/
- class Definition extends SsaImpl::Definition {
+ deprecated class Definition extends SsaImpl::Definition {
/** Gets the control flow node of this SSA definition. */
- final ControlFlow::Node getControlFlowNode() {
- exists(ControlFlow::BasicBlock bb, int i | this.definesAt(_, bb, i) |
- result = bb.getNode(0.maximum(i))
- )
+ final ControlFlowNode getControlFlowNode() {
+ exists(BasicBlock bb, int i | this.definesAt(_, bb, i) | result = bb.getNode(0.maximum(i)))
}
/**
@@ -176,9 +204,7 @@ module Ssa {
* point it is still live, without crossing another SSA definition of the
* same source variable.
*/
- final predicate isLiveAtEndOfBlock(ControlFlow::BasicBlock bb) {
- SsaImpl::isLiveAtEndOfBlock(this, bb)
- }
+ final predicate isLiveAtEndOfBlock(BasicBlock bb) { SsaImpl::isLiveAtEndOfBlock(this, bb) }
/**
* Gets a read of the source variable underlying this SSA definition that
@@ -207,9 +233,11 @@ module Ssa {
* - The reads of `this.Field` on lines 10 and 11 can be reached from the phi
* node between lines 9 and 10.
*/
- final AssignableRead getARead() { result = this.getAReadAtNode(_) }
+ final AssignableRead getARead() { result = SsaImpl::getAReadAtNode(this, _) }
/**
+ * DEPRECATED: Use `getARead()` instead.
+ *
* Gets a read of the source variable underlying this SSA definition at
* control flow node `cfn` that can be reached from this SSA definition
* without passing through any other SSA definitions. Example:
@@ -236,11 +264,13 @@ module Ssa {
* - The reads of `this.Field` on lines 10 and 11 can be reached from the phi
* node between lines 9 and 10.
*/
- final AssignableRead getAReadAtNode(ControlFlow::Node cfn) {
+ deprecated final AssignableRead getAReadAtNode(ControlFlowNode cfn) {
result = SsaImpl::getAReadAtNode(this, cfn)
}
/**
+ * DEPRECATED: Use `ssaGetAFirstUse` instead.
+ *
* Gets a read of the source variable underlying this SSA definition that
* can be reached from this SSA definition without passing through any
* other SSA definition or read. Example:
@@ -274,9 +304,11 @@ module Ssa {
* Subsequent reads can be found by following the steps defined by
* `AssignableRead.getANextRead()`.
*/
- final AssignableRead getAFirstRead() { result = this.getAFirstReadAtNode(_) }
+ deprecated final AssignableRead getAFirstRead() { result = this.getAFirstReadAtNode(_) }
/**
+ * DEPRECATED: Use `ssaGetAFirstUse` instead.
+ *
* Gets a read of the source variable underlying this SSA definition at
* control flow node `cfn` that can be reached from this SSA definition
* without passing through any other SSA definition or read. Example:
@@ -310,72 +342,9 @@ module Ssa {
* Subsequent reads can be found by following the steps defined by
* `AssignableRead.getANextRead()`.
*/
- final AssignableRead getAFirstReadAtNode(ControlFlow::Node cfn) {
- SsaImpl::firstReadSameVar(this, cfn) and
- result.getAControlFlowNode() = cfn
- }
-
- /**
- * Gets a last read of the source variable underlying this SSA definition.
- * That is, a read that can reach the end of the enclosing callable, or
- * another SSA definition for the source variable, without passing through
- * any other read. Example:
- *
- * ```csharp
- * int Field;
- *
- * void SetField(int i) {
- * this.Field = i;
- * Use(this.Field);
- * if (i > 0)
- * this.Field = i - 1;
- * else if (i < 0)
- * SetField(1);
- * Use(this.Field);
- * Use(this.Field);
- * }
- * ```
- *
- * - The reads of `i` on lines 7 and 8 are the last reads for the implicit
- * parameter definition on line 3.
- * - The read of `this.Field` on line 5 is a last read of the definition on
- * line 4.
- * - The read of `this.Field` on line 11 is a last read of the phi node
- * between lines 9 and 10.
- */
- deprecated final AssignableRead getALastRead() { result = this.getALastReadAtNode(_) }
-
- /**
- * Gets a last read of the source variable underlying this SSA definition at
- * control flow node `cfn`. That is, a read that can reach the end of the
- * enclosing callable, or another SSA definition for the source variable,
- * without passing through any other read. Example:
- *
- * ```csharp
- * int Field;
- *
- * void SetField(int i) {
- * this.Field = i;
- * Use(this.Field);
- * if (i > 0)
- * this.Field = i - 1;
- * else if (i < 0)
- * SetField(1);
- * Use(this.Field);
- * Use(this.Field);
- * }
- * ```
- *
- * - The reads of `i` on lines 7 and 8 are the last reads for the implicit
- * parameter definition on line 3.
- * - The read of `this.Field` on line 5 is a last read of the definition on
- * line 4.
- * - The read of `this.Field` on line 11 is a last read of the phi node
- * between lines 9 and 10.
- */
- deprecated final AssignableRead getALastReadAtNode(ControlFlow::Node cfn) {
- SsaImpl::lastReadSameVar(this, cfn) and
- result.getAControlFlowNode() = cfn
+ deprecated final AssignableRead getAFirstReadAtNode(ControlFlowNode cfn) {
+ SsaImpl::firstReadSameVar(this, result) and
+ result.getControlFlowNode() = cfn
}
/**
@@ -383,8 +352,8 @@ module Ssa {
* includes inputs to phi nodes and the prior definitions of uncertain writes.
*/
private Definition getAPhiInputOrPriorDefinition() {
- result = this.(PhiNode).getAnInput() or
- result = this.(UncertainDefinition).getPriorDefinition()
+ result = this.(SsaPhiDefinition).getAnInput() or
+ result = this.(SsaUncertainWrite).getPriorDefinition()
}
/**
@@ -418,7 +387,7 @@ module Ssa {
*/
final Definition getAnUltimateDefinition() {
result = this.getAPhiInputOrPriorDefinition*() and
- not result instanceof PhiNode
+ not result instanceof SsaPhiDefinition
}
/**
@@ -426,39 +395,50 @@ module Ssa {
* This is either an expression, for example `x = 0`, a parameter, or a
* callable. Phi nodes have no associated syntax element.
*/
- Element getElement() { result = this.getControlFlowNode().getAstNode() }
+ Element getElement() {
+ result.(ControlFlowElement).getControlFlowNode() = this.getControlFlowNode()
+ }
- /** Gets the callable to which this SSA definition belongs. */
- final Callable getEnclosingCallable() {
+ /**
+ * DEPRECATED: Use `getSourceVariable().getEnclosingCallable()` instead.
+ *
+ * Gets the callable to which this SSA definition belongs.
+ */
+ deprecated final Callable getEnclosingCallable() {
result = this.getSourceVariable().getEnclosingCallable()
}
/**
+ * DEPRECATED.
+ *
* Holds if this SSA definition assigns to `out`/`ref` parameter `p`, and the
* parameter may remain unchanged throughout the rest of the enclosing callable.
*/
- final predicate isLiveOutRefParameterDefinition(Parameter p) {
+ deprecated final predicate isLiveOutRefParameterDefinition(Parameter p) {
SsaImpl::isLiveOutRefParameterDefinition(this, p)
}
-
- /** Gets the location of this SSA definition. */
- override Location getLocation() { none() }
}
/**
+ * DEPRECATED: Use `SsaExplicitWrite` instead.
+ *
* An SSA definition that corresponds to an explicit assignable definition.
*/
- class ExplicitDefinition extends Definition, SsaImpl::WriteDefinition {
+ deprecated class ExplicitDefinition extends Definition, SsaImpl::WriteDefinition {
AssignableDefinition ad;
ExplicitDefinition() { SsaImpl::explicitDefinition(this, _, ad) }
/**
+ * DEPRECATED: Use `SsaExplicitWrite.getDefinition()` instead.
+ *
* Gets an underlying assignable definition. The result is always unique,
* except for pathological `out`/`ref` assignments like `M(out x, out x)`,
* where there may be more than one underlying definition.
*/
- final AssignableDefinition getADefinition() { result = SsaImpl::getADefinition(this) }
+ deprecated final AssignableDefinition getADefinition() {
+ result = SsaImpl::getADefinition(this)
+ }
/**
* DEPRECATED.
@@ -484,7 +464,7 @@ module Ssa {
* `M2` via the call on line 6.
*/
deprecated final predicate isCapturedVariableDefinitionFlowIn(
- ImplicitEntryDefinition def, ControlFlow::Nodes::ElementNode c, boolean additionalCalls
+ ImplicitEntryDefinition def, ControlFlowNodes::ElementNode c, boolean additionalCalls
) {
none()
}
@@ -519,24 +499,20 @@ module Ssa {
}
override Element getElement() { result = ad.getElement() }
-
- override string toString() {
- result = SsaImpl::getToStringPrefix(this) + "SSA def(" + this.getSourceVariable() + ")"
- }
-
- override Location getLocation() { result = ad.getLocation() }
}
/**
+ * DEPRECATED: Use `SsaParameterInit` or `SsaImplicitWrite` instead.
+ *
* An SSA definition that does not correspond to an explicit variable definition.
* Either an implicit initialization of a variable at the beginning of a callable
* (`ImplicitEntryDefinition`), an implicit definition via a call
* (`ImplicitCallDefinition`), or an implicit definition where the qualifier is
* updated (`ImplicitQualifierDefinition`).
*/
- class ImplicitDefinition extends Definition, SsaImpl::WriteDefinition {
+ deprecated class ImplicitDefinition extends Definition, SsaImpl::WriteDefinition {
ImplicitDefinition() {
- exists(ControlFlow::BasicBlock bb, SourceVariable v, int i | this.definesAt(v, bb, i) |
+ exists(BasicBlock bb, SourceVariable v, int i | this.definesAt(v, bb, i) |
SsaImpl::implicitEntryDefinition(bb, v) and
i = -1
or
@@ -548,93 +524,62 @@ module Ssa {
}
/**
+ * DEPRECATED: Use `SsaParameterInit` or `SsaImplicitEntryDefinition` instead.
+ *
* An SSA definition representing the implicit initialization of a variable
- * at the beginning of a callable. Either a parameter, a local scope variable
- * captured by the callable, or a field or property accessed inside the callable.
+ * at the beginning of a callable. Either a local scope variable captured by
+ * the callable or a field or property accessed inside the callable.
*/
- class ImplicitEntryDefinition extends ImplicitDefinition {
+ deprecated class ImplicitEntryDefinition extends ImplicitDefinition {
ImplicitEntryDefinition() {
- exists(ControlFlow::BasicBlock bb, SourceVariable v |
+ exists(BasicBlock bb, SourceVariable v |
this.definesAt(v, bb, -1) and
SsaImpl::implicitEntryDefinition(bb, v)
)
}
/** Gets the callable that this entry definition belongs to. */
- final Callable getCallable() { result = this.getBasicBlock().getCallable() }
+ final Callable getCallable() { result = this.getBasicBlock().getEnclosingCallable() }
override Element getElement() { result = this.getCallable() }
-
- override string toString() {
- if this.getSourceVariable().getAssignable() instanceof LocalScopeVariable
- then
- result =
- SsaImpl::getToStringPrefix(this) + "SSA capture def(" + this.getSourceVariable() + ")"
- else
- result =
- SsaImpl::getToStringPrefix(this) + "SSA entry def(" + this.getSourceVariable() + ")"
- }
-
- override Location getLocation() { result = this.getCallable().getLocation() }
- }
-
- private module NearestLocationInput implements NearestLocationInputSig {
- class C = ImplicitParameterDefinition;
-
- predicate relevantLocations(ImplicitParameterDefinition def, Location l1, Location l2) {
- not def.getBasicBlock() instanceof ControlFlow::BasicBlocks::EntryBlock and
- l1 = def.getParameter().getALocation() and
- l2 = def.getBasicBlock().getLocation()
- }
- }
-
- pragma[nomagic]
- private predicate implicitEntryDef(ImplicitEntryDefinition def, SourceVariable v, Callable c) {
- v = def.getSourceVariable() and
- c = def.getCallable()
}
/**
- * An SSA definition representing the implicit initialization of a parameter
- * at the beginning of a callable.
+ * DEPRECATED: Use `SsaParameterInit` instead.
*/
- class ImplicitParameterDefinition extends ImplicitEntryDefinition {
+ deprecated final class ImplicitParameterDefinition = SsaImpl::ParameterDefinitionImpl;
+
+ deprecated private class ExplicitParameterDefinition extends ExplicitDefinition,
+ SsaImpl::ParameterDefinitionImpl
+ {
private Parameter p;
+ override AssignableDefinitions::ImplicitParameterDefinition ad;
- ImplicitParameterDefinition() {
- exists(SourceVariable sv, Callable c |
- implicitEntryDef(this, sv, c) and
- localScopeSourceVariable(sv, p, _, c)
- )
- }
+ ExplicitParameterDefinition() { p = ad.getParameter() }
- /** Gets the parameter that this entry definition represents. */
- Parameter getParameter() { result = p }
+ override Parameter getParameter() { result = p }
- override Element getElement() { result = this.getParameter() }
+ override string toString() { result = SsaImpl::ParameterDefinitionImpl.super.toString() }
+ }
- override string toString() {
- result = SsaImpl::getToStringPrefix(this) + "SSA param(" + this.getParameter() + ")"
+ /** An SSA definition in a closure that captures a variable. */
+ class SsaCapturedDefinition extends SsaImplicitEntryDefinition {
+ SsaCapturedDefinition() {
+ this.getSourceVariable().getAssignable() instanceof LocalScopeVariable
}
- override Location getLocation() {
- not NearestLocation::nearestLocation(this, _, _) and
- result = p.getLocation()
- or
- // multi-bodied method: use matching parameter location
- NearestLocation::nearestLocation(this, result, _)
- }
+ override string toString() { result = "SSA capture def(" + this.getSourceVariable() + ")" }
}
/**
* An SSA definition representing the potential definition of a variable
* via a call.
*/
- class ImplicitCallDefinition extends ImplicitDefinition {
+ class ImplicitCallDefinition extends SsaImplicitWrite {
private Call c;
ImplicitCallDefinition() {
- exists(ControlFlow::BasicBlock bb, SourceVariable v, int i |
+ exists(BasicBlock bb, SourceVariable v, int i |
this.definesAt(v, bb, i) and
SsaImpl::updatesNamedFieldOrProp(bb, i, c, v, _)
)
@@ -656,24 +601,19 @@ module Ssa {
)
}
- override string toString() {
- result = SsaImpl::getToStringPrefix(this) + "SSA call def(" + this.getSourceVariable() + ")"
- }
-
- override Location getLocation() { result = this.getCall().getLocation() }
+ override string toString() { result = "SSA call def(" + this.getSourceVariable() + ")" }
}
/**
* An SSA definition representing the potential definition of a variable
* via an SSA definition for the qualifier.
*/
- class ImplicitQualifierDefinition extends ImplicitDefinition, SsaImpl::WriteDefinition {
- private Definition q;
+ class ImplicitQualifierDefinition extends SsaImplicitWrite {
+ private SsaDefinition q;
ImplicitQualifierDefinition() {
- exists(
- ControlFlow::BasicBlock bb, int i, SourceVariables::QualifiedFieldOrPropSourceVariable v
- |
+ not this instanceof SsaImplicitEntryDefinition and
+ exists(BasicBlock bb, int i, SourceVariables::QualifiedFieldOrPropSourceVariable v |
this.definesAt(v, bb, i)
|
SsaImpl::variableWriteQualifier(bb, i, v, _) and
@@ -682,22 +622,19 @@ module Ssa {
}
/** Gets the SSA definition for the qualifier. */
- final Definition getQualifierDefinition() { result = q }
+ final SsaDefinition getQualifierDefinition() { result = q }
- override string toString() {
- result =
- SsaImpl::getToStringPrefix(this) + "SSA qualifier def(" + this.getSourceVariable() + ")"
- }
-
- override Location getLocation() { result = this.getQualifierDefinition().getLocation() }
+ override string toString() { result = "SSA qualifier def(" + this.getSourceVariable() + ")" }
}
/**
+ * DEPRECATED: Use `SsaPhiDefinition` instead.
+ *
* An SSA phi node, that is, a pseudo definition for a variable at a point
* in the flow graph where otherwise two or more definitions for the variable
* would be visible.
*/
- class PhiNode extends Definition, SsaImpl::PhiNode {
+ deprecated class PhiNode extends Definition, SsaImpl::PhiNode {
/**
* Gets an input of this phi node. Example:
*
@@ -723,32 +660,20 @@ module Ssa {
final Definition getAnInput() { this.hasInputFromBlock(result, _) }
/** Holds if `inp` is an input to this phi node along the edge originating in `bb`. */
- predicate hasInputFromBlock(Definition inp, ControlFlow::BasicBlock bb) {
+ predicate hasInputFromBlock(Definition inp, BasicBlock bb) {
inp = SsaImpl::phiHasInputFromBlock(this, bb)
}
-
- override string toString() {
- result = SsaImpl::getToStringPrefix(this) + "SSA phi(" + this.getSourceVariable() + ")"
- }
-
- /*
- * The location of a phi node is the same as the location of the first node
- * in the basic block in which it is defined.
- *
- * Strictly speaking, the node is *before* the first node, but such a location
- * does not exist in the source program.
- */
-
- override Location getLocation() { result = this.getBasicBlock().getFirstNode().getLocation() }
}
/**
+ * DEPRECATED: Use `SsaUncertainWrite` instead.
+ *
* An SSA definition that represents an uncertain update of the underlying
* assignable. Either an explicit update that is uncertain (`ref` assignments
* need not be certain), an implicit non-local update via a call, or an
* uncertain update of the qualifier.
*/
- class UncertainDefinition extends Definition, SsaImpl::UncertainWriteDefinition {
+ deprecated class UncertainDefinition extends Definition, SsaImpl::UncertainWriteDefinition {
/**
* Gets the immediately preceding definition. Since this update is uncertain,
* the value from the preceding definition might still be valid.
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/SignAnalysis.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/SignAnalysis.qll
index 6f6f38bd199f..e1d804e6548f 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/SignAnalysis.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/SignAnalysis.qll
@@ -11,36 +11,32 @@ private import semmle.code.csharp.dataflow.internal.rangeanalysis.SignAnalysisCo
/** Holds if `e` can be positive and cannot be negative. */
predicate positiveExpr(Expr e) {
- forex(ControlFlow::Node cfn | cfn = e.getAControlFlowNode() |
+ exists(ControlFlowNode cfn | cfn = e.getControlFlowNode() |
positive(cfn) or strictlyPositive(cfn)
)
}
/** Holds if `e` can be negative and cannot be positive. */
predicate negativeExpr(Expr e) {
- forex(ControlFlow::Node cfn | cfn = e.getAControlFlowNode() |
+ exists(ControlFlowNode cfn | cfn = e.getControlFlowNode() |
negative(cfn) or strictlyNegative(cfn)
)
}
/** Holds if `e` is strictly positive. */
-predicate strictlyPositiveExpr(Expr e) {
- forex(ControlFlow::Node cfn | cfn = e.getAControlFlowNode() | strictlyPositive(cfn))
-}
+predicate strictlyPositiveExpr(Expr e) { strictlyPositive(e.getControlFlowNode()) }
/** Holds if `e` is strictly negative. */
-predicate strictlyNegativeExpr(Expr e) {
- forex(ControlFlow::Node cfn | cfn = e.getAControlFlowNode() | strictlyNegative(cfn))
-}
+predicate strictlyNegativeExpr(Expr e) { strictlyNegative(e.getControlFlowNode()) }
/** Holds if `e` can be positive and cannot be negative. */
-predicate positive(ControlFlow::Nodes::ExprNode e) { Common::positive(e) }
+predicate positive(ControlFlowNodes::ExprNode e) { Common::positive(e) }
/** Holds if `e` can be negative and cannot be positive. */
-predicate negative(ControlFlow::Nodes::ExprNode e) { Common::negative(e) }
+predicate negative(ControlFlowNodes::ExprNode e) { Common::negative(e) }
/** Holds if `e` is strictly positive. */
-predicate strictlyPositive(ControlFlow::Nodes::ExprNode e) { Common::strictlyPositive(e) }
+predicate strictlyPositive(ControlFlowNodes::ExprNode e) { Common::strictlyPositive(e) }
/** Holds if `e` is strictly negative. */
-predicate strictlyNegative(ControlFlow::Nodes::ExprNode e) { Common::strictlyNegative(e) }
+predicate strictlyNegative(ControlFlowNodes::ExprNode e) { Common::strictlyNegative(e) }
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/BaseSSA.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/BaseSSA.qll
index a994873274af..0e879ac94123 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/BaseSSA.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/BaseSSA.qll
@@ -1,21 +1,40 @@
-import csharp
+private import csharp as CS
/**
* Provides a simple SSA implementation for local scope variables.
*/
module BaseSsa {
+ private import BaseSsaImpl
+
+ class SimpleLocalScopeVariable = BaseSsaImpl::SimpleLocalScopeVariable;
+
+ module Ssa = SsaImpl::MakeSsa;
+
+ import Ssa
+}
+
+private module BaseSsaImpl {
+ private import CS
private import AssignableDefinitions
- private import semmle.code.csharp.controlflow.BasicBlocks as BasicBlocks
private import codeql.ssa.Ssa as SsaImplCommon
+ cached
+ private module BaseSsaStage {
+ cached
+ predicate ref() { any() }
+
+ cached
+ predicate backref() { (exists(any(BaseSsa::SsaDefinition def).getARead()) implies any()) }
+ }
+
/**
* Holds if the `i`th node of basic block `bb` is assignable definition `def`,
* targeting local scope variable `v`.
*/
private predicate definitionAt(
- AssignableDefinition def, ControlFlow::BasicBlock bb, int i, SsaInput::SourceVariable v
+ AssignableDefinition def, BasicBlock bb, int i, SsaImplInput::SourceVariable v
) {
- bb.getNode(i) = def.getExpr().getAControlFlowNode() and
+ bb.getNode(i) = def.getExpr().getControlFlowNode() and
v = def.getTarget() and
// In cases like `(x, x) = (0, 1)`, we discard the first (dead) definition of `x`
not exists(TupleAssignmentDefinition first, TupleAssignmentDefinition second | first = def |
@@ -25,11 +44,9 @@ module BaseSsa {
)
}
- private predicate implicitEntryDef(
- Callable c, ControlFlow::BasicBlocks::EntryBlock bb, SsaInput::SourceVariable v
- ) {
- exists(ControlFlow::BasicBlocks::EntryBlock entry |
- c = entry.getCallable() and
+ private predicate entryDef(Callable c, BasicBlock bb, SsaImplInput::SourceVariable v) {
+ exists(EntryBasicBlock entry |
+ c = entry.getEnclosingCallable() and
// In case `c` has multiple bodies, we want each body to get its own implicit
// entry definition. In case `c` doesn't have multiple bodies, the line below
// is simply the same as `bb = entry`, because `entry.getFirstNode().getASuccessor()`
@@ -82,77 +99,53 @@ module BaseSsa {
}
}
- private module SsaInput implements SsaImplCommon::InputSig {
+ private module SsaImplInput implements SsaImplCommon::InputSig {
class SourceVariable = SimpleLocalScopeVariable;
- predicate variableWrite(ControlFlow::BasicBlock bb, int i, SourceVariable v, boolean certain) {
+ predicate variableWrite(BasicBlock bb, int i, SourceVariable v, boolean certain) {
+ BaseSsaStage::ref() and
exists(AssignableDefinition def |
definitionAt(def, bb, i, v) and
if def.isCertain() then certain = true else certain = false
)
or
- implicitEntryDef(_, bb, v) and
+ entryDef(_, bb, v) and
i = -1 and
certain = true
}
- predicate variableRead(ControlFlow::BasicBlock bb, int i, SourceVariable v, boolean certain) {
+ predicate variableRead(BasicBlock bb, int i, SourceVariable v, boolean certain) {
exists(AssignableRead read |
- read.getAControlFlowNode() = bb.getNode(i) and
+ read.getControlFlowNode() = bb.getNode(i) and
read.getTarget() = v and
certain = true
)
}
}
- private module SsaImpl = SsaImplCommon::Make;
+ module SsaImpl = SsaImplCommon::Make;
- class Definition extends SsaImpl::Definition {
- final AssignableRead getARead() {
- exists(ControlFlow::BasicBlock bb, int i |
- SsaImpl::ssaDefReachesRead(_, this, bb, i) and
- result.getAControlFlowNode() = bb.getNode(i)
- )
- }
+ module SsaInput implements SsaImpl::SsaInputSig {
+ class Expr = CS::Expr;
- final AssignableDefinition getDefinition() {
- exists(ControlFlow::BasicBlock bb, int i, SsaInput::SourceVariable v |
- this.definesAt(v, bb, i) and
- definitionAt(result, bb, i, v)
- )
- }
+ class Parameter = CS::Parameter;
- final predicate isImplicitEntryDefinition(SsaInput::SourceVariable v) {
- exists(ControlFlow::BasicBlock bb |
- this.definesAt(v, bb, -1) and
- implicitEntryDef(_, bb, v)
- )
- }
+ class VariableWrite extends AssignableDefinition {
+ Expr asExpr() { result = this.getExpr() }
- private Definition getAPhiInputOrPriorDefinition() {
- result = this.(PhiNode).getAnInput() or
- SsaImpl::uncertainWriteDefinitionInput(this, result)
- }
+ Expr getValue() { result = this.getSource() }
- final Definition getAnUltimateDefinition() {
- result = this.getAPhiInputOrPriorDefinition*() and
- not result instanceof PhiNode
+ predicate isParameterInit(Parameter p) {
+ this.(ImplicitParameterDefinition).getParameter() = p
+ }
}
- override Location getLocation() {
- result = this.getDefinition().getLocation()
+ predicate explicitWrite(VariableWrite w, BasicBlock bb, int i, SsaImplInput::SourceVariable v) {
+ definitionAt(w, bb, i, v)
or
- exists(Callable c, ControlFlow::BasicBlock bb, SsaInput::SourceVariable v |
- this.definesAt(v, bb, -1) and
- implicitEntryDef(c, bb, v) and
- result = c.getLocation()
- )
+ entryDef(_, bb, v) and
+ i = -1 and
+ w.isParameterInit(v)
}
}
-
- class PhiNode extends SsaImpl::PhiNode, Definition {
- override Location getLocation() { result = this.getBasicBlock().getLocation() }
-
- final Definition getAnInput() { SsaImpl::phiHasInputFromBlock(this, result, _) }
- }
}
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowDispatch.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowDispatch.qll
index be183815c715..e365385c6d44 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowDispatch.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowDispatch.qll
@@ -28,8 +28,8 @@ newtype TReturnKind =
private predicate hasMultipleSourceLocations(Callable c) { strictcount(getASourceLocation(c)) > 1 }
private predicate objectInitEntry(ObjectInitMethod m, ControlFlowElement first) {
- exists(ControlFlow::Nodes::EntryNode en |
- en.getCallable() = m and first.getControlFlowNode() = en.getASuccessor()
+ exists(ControlFlow::EntryNode en |
+ en.getEnclosingCallable() = m and first = en.getASuccessor().getAstNode()
)
}
@@ -73,12 +73,12 @@ private module Cached {
cached
newtype TDataFlowCall =
- TNonDelegateCall(ControlFlow::Nodes::ElementNode cfn, DispatchCall dc) {
+ TNonDelegateCall(ControlFlowNodes::ElementNode cfn, DispatchCall dc) {
DataFlowImplCommon::forceCachingInSameStage() and
- cfn.getAstNode() = dc.getCall()
+ cfn.asExpr() = dc.getCall()
} or
- TExplicitDelegateLikeCall(ControlFlow::Nodes::ElementNode cfn, DelegateLikeCall dc) {
- cfn.getAstNode() = dc
+ TExplicitDelegateLikeCall(ControlFlowNodes::ElementNode cfn, DelegateLikeCall dc) {
+ cfn.asExpr() = dc
} or
TSummaryCall(FlowSummary::SummarizedCallable c, FlowSummaryImpl::Private::SummaryNode receiver) {
FlowSummaryImpl::Private::summaryCallbackRange(c, receiver)
@@ -210,60 +210,63 @@ class DataFlowCallable extends TDataFlowCallable {
}
pragma[nomagic]
- private ControlFlow::Nodes::ElementNode getAMultiBodyEntryNode(ControlFlow::BasicBlock bb, int i) {
+ private BasicBlock getAMultiBodyEntryBlock() {
this.isMultiBodied() and
exists(ControlFlowElement body, Location l |
body = this.asCallable(l).getBody() or
objectInitEntry(this.asCallable(l), body)
|
NearestLocation::nearestLocation(body, l, _) and
- result = body.getAControlFlowEntryNode()
- ) and
- bb.getNode(i) = result
+ result.getANode().isBefore(body)
+ )
}
pragma[nomagic]
- private ControlFlow::Nodes::ElementNode getAMultiBodyControlFlowNodePred() {
- result = this.getAMultiBodyEntryNode(_, _).getAPredecessor()
+ private BasicBlock getAMultiBodyControlFlowPred() {
+ result = this.getAMultiBodyEntryBlock().getAPredecessor()
or
- result = this.getAMultiBodyControlFlowNodePred().getAPredecessor()
- }
-
- pragma[nomagic]
- private ControlFlow::Nodes::ElementNode getAMultiBodyControlFlowNodeSuccSameBasicBlock() {
- exists(ControlFlow::BasicBlock bb, int i, int j |
- exists(this.getAMultiBodyEntryNode(bb, i)) and
- result = bb.getNode(j) and
- j > i
- )
+ result = this.getAMultiBodyControlFlowPred().getAPredecessor()
}
pragma[nomagic]
- private ControlFlow::BasicBlock getAMultiBodyBasicBlockSucc() {
- result = this.getAMultiBodyEntryNode(_, _).getBasicBlock().getASuccessor()
+ private BasicBlock getAMultiBodyBasicBlockSucc() {
+ result = this.getAMultiBodyEntryBlock().getASuccessor()
or
result = this.getAMultiBodyBasicBlockSucc().getASuccessor()
}
- pragma[inline]
- private ControlFlow::Nodes::ElementNode getAMultiBodyControlFlowNode() {
+ pragma[nomagic]
+ private BasicBlock getAMultiBodyBasicBlock() {
result =
[
- this.getAMultiBodyEntryNode(_, _), this.getAMultiBodyControlFlowNodePred(),
- this.getAMultiBodyControlFlowNodeSuccSameBasicBlock(),
- this.getAMultiBodyBasicBlockSucc().getANode()
+ this.getAMultiBodyEntryBlock(), this.getAMultiBodyControlFlowPred(),
+ this.getAMultiBodyBasicBlockSucc()
]
}
+ pragma[inline]
+ private ControlFlowNode getAMultiBodyControlFlowNode() {
+ result = this.getAMultiBodyBasicBlock().getANode()
+ }
+
/** Gets a control flow node belonging to this callable. */
pragma[inline]
- ControlFlow::Node getAControlFlowNode() {
+ ControlFlowNode getAControlFlowNode() {
result = this.getAMultiBodyControlFlowNode()
or
not this.isMultiBodied() and
result.getEnclosingCallable() = this.asCallable(_)
}
+ /** Gets a basic block belonging to this callable. */
+ pragma[inline]
+ BasicBlock getABasicBlock() {
+ result = this.getAMultiBodyBasicBlock()
+ or
+ not this.isMultiBodied() and
+ result.getEnclosingCallable() = this.asCallable(_)
+ }
+
/** Gets the underlying summarized callable, if any. */
FlowSummary::SummarizedCallable asSummarizedCallable() { this = TSummarizedCallable(result) }
@@ -307,7 +310,7 @@ abstract class DataFlowCall extends TDataFlowCall {
abstract DataFlowCallable getARuntimeTarget();
/** Gets the control flow node where this call happens, if any. */
- abstract ControlFlow::Nodes::ElementNode getControlFlowNode();
+ abstract ControlFlowNodes::ElementNode getControlFlowNode();
/** Gets the data flow node corresponding to this call, if any. */
abstract DataFlow::Node getNode();
@@ -363,7 +366,7 @@ private predicate folderDist(Folder f1, Folder f2, int i) =
/** A non-delegate C# call relevant for data flow. */
class NonDelegateDataFlowCall extends DataFlowCall, TNonDelegateCall {
- private ControlFlow::Nodes::ElementNode cfn;
+ private ControlFlowNodes::ElementNode cfn;
private DispatchCall dc;
NonDelegateDataFlowCall() { this = TNonDelegateCall(cfn, dc) }
@@ -436,7 +439,7 @@ class NonDelegateDataFlowCall extends DataFlowCall, TNonDelegateCall {
not dc.isReflection()
}
- override ControlFlow::Nodes::ElementNode getControlFlowNode() { result = cfn }
+ override ControlFlowNodes::ElementNode getControlFlowNode() { result = cfn }
override DataFlow::ExprNode getNode() { result.getControlFlowNode() = cfn }
@@ -452,7 +455,7 @@ abstract class DelegateDataFlowCall extends DataFlowCall { }
/** An explicit delegate or function pointer call relevant for data flow. */
class ExplicitDelegateLikeDataFlowCall extends DelegateDataFlowCall, TExplicitDelegateLikeCall {
- private ControlFlow::Nodes::ElementNode cfn;
+ private ControlFlowNodes::ElementNode cfn;
private DelegateLikeCall dc;
ExplicitDelegateLikeDataFlowCall() { this = TExplicitDelegateLikeCall(cfn, dc) }
@@ -464,7 +467,7 @@ class ExplicitDelegateLikeDataFlowCall extends DelegateDataFlowCall, TExplicitDe
none() // handled by the shared library
}
- override ControlFlow::Nodes::ElementNode getControlFlowNode() { result = cfn }
+ override ControlFlowNodes::ElementNode getControlFlowNode() { result = cfn }
override DataFlow::ExprNode getNode() { result.getControlFlowNode() = cfn }
@@ -495,7 +498,7 @@ class SummaryCall extends DelegateDataFlowCall, TSummaryCall {
none() // handled by the shared library
}
- override ControlFlow::Nodes::ElementNode getControlFlowNode() { none() }
+ override ControlFlowNodes::ElementNode getControlFlowNode() { none() }
override DataFlow::Node getNode() { none() }
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImplSpecific.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImplSpecific.qll
index af104d777b87..ab1e75b3d0fc 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImplSpecific.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImplSpecific.qll
@@ -29,4 +29,8 @@ module CsharpDataFlow implements InputSig {
predicate neverSkipInPathGraph(Node n) {
exists(n.(AssignableDefinitionNode).getDefinition().getTargetAccess())
}
+
+ DataFlowType getSourceContextParameterNodeType(Node p) {
+ exists(p) and result.isSourceContextParameterType()
+ }
}
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
index 109c27de67be..f0d4bd996214 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
@@ -41,13 +41,13 @@ predicate isArgumentNode(ArgumentNode arg, DataFlowCall c, ArgumentPosition pos)
* Gets a control flow node used for data flow purposes for the primary constructor
* parameter access `pa`.
*/
-private ControlFlow::Node getAPrimaryConstructorParameterCfn(ParameterAccess pa) {
+private ControlFlowNode getAPrimaryConstructorParameterCfn(ParameterAccess pa) {
pa.getTarget().getCallable() instanceof PrimaryConstructor and
(
- result = pa.(ParameterRead).getAControlFlowNode()
+ result = pa.(ParameterRead).getControlFlowNode()
or
pa =
- any(AssignableDefinition def | result = def.getExpr().getAControlFlowNode()).getTargetAccess()
+ any(AssignableDefinition def | result = def.getExpr().getControlFlowNode()).getTargetAccess()
)
}
@@ -72,7 +72,7 @@ abstract class NodeImpl extends Node {
/** Do not call: use `getControlFlowNode()` instead. */
cached
- abstract ControlFlow::Node getControlFlowNodeImpl();
+ abstract ControlFlowNode getControlFlowNodeImpl();
/** Do not call: use `getLocation()` instead. */
cached
@@ -83,22 +83,9 @@ abstract class NodeImpl extends Node {
abstract string toStringImpl();
}
-// TODO: Remove once static initializers are folded into the
-// static constructors
-private DataFlowCallable getEnclosingStaticFieldOrProperty(Expr e) {
- result.asFieldOrProperty() =
- any(FieldOrProperty f |
- f.isStatic() and
- e = f.getAChild+() and
- not exists(e.getEnclosingCallable())
- )
-}
-
private class ExprNodeImpl extends ExprNode, NodeImpl {
override DataFlowCallable getEnclosingCallableImpl() {
result.getAControlFlowNode() = this.getControlFlowNodeImpl()
- or
- result = getEnclosingStaticFieldOrProperty(this.asExpr())
}
override Type getTypeImpl() {
@@ -106,7 +93,7 @@ private class ExprNodeImpl extends ExprNode, NodeImpl {
result = this.getExpr().getType()
}
- override ControlFlow::Nodes::ElementNode getControlFlowNodeImpl() {
+ override ControlFlowNodes::ElementNode getControlFlowNodeImpl() {
forceCachingInSameStage() and this = TExprNode(result)
}
@@ -127,13 +114,13 @@ private class ExprNodeImpl extends ExprNode, NodeImpl {
* as if they were lambdas.
*/
abstract private class LocalFunctionCreationNode extends NodeImpl, TLocalFunctionCreationNode {
- ControlFlow::Nodes::ElementNode cfn;
+ ControlFlowNodes::ElementNode cfn;
LocalFunction function;
boolean isPostUpdate;
LocalFunctionCreationNode() {
this = TLocalFunctionCreationNode(cfn, isPostUpdate) and
- function = cfn.getAstNode().(LocalFunctionStmt).getLocalFunction()
+ function = cfn.asStmt().(LocalFunctionStmt).getLocalFunction()
}
LocalFunction getFunction() { result = function }
@@ -151,9 +138,9 @@ abstract private class LocalFunctionCreationNode extends NodeImpl, TLocalFunctio
override DataFlowType getDataFlowType() { result.asDelegate() = function }
- override ControlFlow::Nodes::ElementNode getControlFlowNodeImpl() { none() }
+ override ControlFlowNodes::ElementNode getControlFlowNodeImpl() { none() }
- ControlFlow::Nodes::ElementNode getUnderlyingControlFlowNode() { result = cfn }
+ ControlFlowNodes::ElementNode getUnderlyingControlFlowNode() { result = cfn }
override Location getLocationImpl() { result = cfn.getLocation() }
}
@@ -166,13 +153,11 @@ private class LocalFunctionCreationPreNode extends LocalFunctionCreationNode {
/** Calculation of the relative order in which `this` references are read. */
private module ThisFlow {
- private class BasicBlock = ControlFlow::BasicBlock;
-
/** Holds if `e` is a `this` access. */
predicate thisAccessExpr(Expr e) { e instanceof ThisAccess or e instanceof BaseAccess }
/** Holds if `n` is a `this` access at control flow node `cfn`. */
- private predicate thisAccess(Node n, ControlFlow::Node cfn) {
+ private predicate thisAccess(Node n, ControlFlowNode cfn) {
thisAccessExpr(n.asExprAtNode(cfn))
or
cfn = n.(InstanceParameterAccessPreNode).getUnderlyingControlFlowNode()
@@ -181,7 +166,7 @@ private module ThisFlow {
private predicate primaryConstructorThisAccess(Node n, BasicBlock bb, int ppos) {
exists(Parameter p |
n.(PrimaryConstructorThisAccessPreNode).getParameter() = p and
- bb.getCallable() = p.getCallable() and
+ bb.getEnclosingCallable() = p.getCallable() and
ppos = p.getPosition()
)
}
@@ -190,6 +175,18 @@ private module ThisFlow {
result = strictcount(int primaryParamPos | primaryConstructorThisAccess(_, bb, primaryParamPos))
}
+ private module BodyNearestLocationInput implements NearestLocationInputSig {
+ class C = ControlFlowElement;
+
+ predicate relevantLocations(ControlFlowElement body, Location l1, Location l2) {
+ exists(DataFlowCallable c |
+ any(InstanceParameterNode p).isParameterOf(c, _) and
+ body = c.asCallable(l1).getBody() and
+ l2 = body.getLocation()
+ )
+ }
+ }
+
private predicate thisAccess(Node n, BasicBlock bb, int i) {
thisAccess(n, bb.getNode(i))
or
@@ -198,21 +195,29 @@ private module ThisFlow {
i = ppos - numberOfPrimaryConstructorParameters(bb)
)
or
- exists(DataFlowCallable c, ControlFlow::BasicBlocks::EntryBlock entry |
- n.(InstanceParameterNode).isParameterOf(c, _) and
- exists(ControlFlow::Node succ |
- succ = c.getAControlFlowNode() and
- succ = entry.getFirstNode().getASuccessor() and
+ exists(Callable c, InstanceParameterNode p, Location l |
+ p = n and
+ c = p.getCallable(l) and
+ (
// In case `c` has multiple bodies, we want each body to gets its own implicit
- // entry definition. In case `c` doesn't have multiple bodies, the line below
- // is simply the same as `bb = entry`, because `entry.getFirstNode().getASuccessor()`
- // will be in the entry block.
- bb = succ.getBasicBlock()
- |
- i = -1 - numberOfPrimaryConstructorParameters(bb)
+ // entry definition.
+ exists(ControlFlowElement body |
+ body = c.getBody() and
+ bb.getANode().isBefore(body) and
+ NearestLocation::nearestLocation(body, l, _)
+ )
or
- not exists(numberOfPrimaryConstructorParameters(bb)) and i = -1
+ not c.hasBody() and
+ exists(EntryBasicBlock entry, ControlFlowNode succ |
+ succ = p.getEnclosingCallableImpl().getAControlFlowNode() and
+ succ = entry.getFirstNode().getASuccessor() and
+ bb = succ.getBasicBlock()
+ )
)
+ |
+ i = -1 - numberOfPrimaryConstructorParameters(bb)
+ or
+ not exists(numberOfPrimaryConstructorParameters(bb)) and i = -1
)
}
@@ -261,33 +266,30 @@ private module ThisFlow {
/** Provides logic related to captured variables. */
module VariableCapture {
private import codeql.dataflow.VariableCapture as Shared
- private import semmle.code.csharp.controlflow.BasicBlocks as BasicBlocks
- private predicate closureFlowStep(ControlFlow::Nodes::ExprNode e1, ControlFlow::Nodes::ExprNode e2) {
+ private predicate closureFlowStep(ControlFlowNodes::ExprNode e1, ControlFlowNodes::ExprNode e2) {
e1.getExpr() = LocalFlow::getALastEvalNode(e2.getExpr())
or
- exists(Ssa::Definition def, AssignableDefinition adef |
+ exists(SsaDefinition def, AssignableDefinition adef |
LocalFlow::defAssigns(adef, _, _, e1) and
- def.getAnUltimateDefinition().(Ssa::ExplicitDefinition).getADefinition() = adef and
- exists(def.getAReadAtNode(e2))
+ def.getAnUltimateDefinition().(SsaExplicitWrite).getDefinition() = adef and
+ def.getARead().getControlFlowNode() = e2
)
}
- private module CaptureInput implements Shared::InputSig {
+ private module CaptureInput implements Shared::InputSig {
private import csharp as CS
private import semmle.code.csharp.controlflow.ControlFlowGraph as Cfg
private import TaintTrackingPrivate as TaintTrackingPrivate
- Callable basicBlockGetEnclosingCallable(BasicBlocks::BasicBlock bb) {
- result = bb.getCallable()
- }
+ Callable basicBlockGetEnclosingCallable(BasicBlock bb) { result = bb.getEnclosingCallable() }
- private predicate thisAccess(ControlFlow::Node cfn, InstanceCallable c) {
- ThisFlow::thisAccessExpr(cfn.getAstNode()) and
+ private predicate thisAccess(ControlFlowNode cfn, InstanceCallable c) {
+ ThisFlow::thisAccessExpr(cfn.asExpr()) and
cfn.getEnclosingCallable().getEnclosingCallable*() = c
}
- private predicate capturedThisAccess(ControlFlow::Node cfn, InstanceCallable c) {
+ private predicate capturedThisAccess(ControlFlowNode cfn, InstanceCallable c) {
thisAccess(cfn, c) and
cfn.getEnclosingCallable() != c
}
@@ -347,8 +349,8 @@ module VariableCapture {
}
}
- class Expr extends ControlFlow::Node {
- predicate hasCfgNode(BasicBlocks::BasicBlock bb, int i) { this = bb.getNode(i) }
+ class Expr extends ControlFlowNode {
+ predicate hasCfgNode(BasicBlock bb, int i) { this = bb.getNode(i) }
}
class VariableWrite extends Expr {
@@ -357,10 +359,10 @@ module VariableCapture {
VariableWrite() {
def.getTarget() = v.asLocalScopeVariable() and
- this = def.getExpr().getAControlFlowNode()
+ this = def.getExpr().getControlFlowNode()
}
- ControlFlow::Node getRhs() { LocalFlow::defAssigns(def, this, _, result) }
+ ControlFlowNode getRhs() { LocalFlow::defAssigns(def, this, _, result) }
CapturedVariable getVariable() { result = v }
}
@@ -369,7 +371,7 @@ module VariableCapture {
CapturedVariable v;
VariableRead() {
- this.getAstNode().(AssignableRead).getTarget() = v.asLocalScopeVariable()
+ this.asExpr().(AssignableRead).getTarget() = v.asLocalScopeVariable()
or
thisAccess(this, v.asThis())
}
@@ -380,14 +382,16 @@ module VariableCapture {
class ClosureExpr extends Expr {
Callable c;
- ClosureExpr() { lambdaCreationExpr(this.getAstNode(), c) }
+ ClosureExpr() {
+ lambdaCreationExpr(any(ControlFlowElement e | e.getControlFlowNode() = this), c)
+ }
predicate hasBody(Callable body) { body = c }
predicate hasAliasedAccess(Expr f) {
closureFlowStep+(this, f) and not closureFlowStep(f, _)
or
- isLocalFunctionCallReceiver(_, f.getAstNode(), c)
+ isLocalFunctionCallReceiver(_, f.asExpr(), c)
}
}
@@ -400,7 +404,7 @@ module VariableCapture {
class ClosureExpr = CaptureInput::ClosureExpr;
- module Flow = Shared::Flow;
+ module Flow = Shared::Flow;
private Flow::ClosureNode asClosureNode(Node n) {
result = n.(CaptureNode).getSynthesizedCaptureNode()
@@ -528,7 +532,7 @@ module LocalFlow {
e2 =
any(AssignExpr ae |
ae.getParent() = any(ControlFlowElement cfe | not cfe instanceof ExprStmt) and
- e1 = ae.getRValue()
+ e1 = ae.getRightOperand()
)
or
e1 = e2.(ObjectCreation).getInitializer()
@@ -554,7 +558,7 @@ module LocalFlow {
e2 = we
)
or
- exists(AssignExpr ae | ae.getLValue().(TupleExpr) = e2 and ae.getRValue() = e1)
+ exists(AssignExpr ae | ae.getLeftOperand().(TupleExpr) = e2 and ae.getRightOperand() = e1)
or
exists(ControlFlowElement cfe | cfe = e2.(TupleExpr).(PatternExpr).getPatternMatch() |
cfe.(IsExpr).getExpr() = e1
@@ -564,15 +568,15 @@ module LocalFlow {
}
predicate defAssigns(
- AssignableDefinition def, ControlFlow::Node cfnDef, Expr value, ControlFlow::Node valueCfn
+ AssignableDefinition def, ControlFlowNode cfnDef, Expr value, ControlFlowNode valueCfn
) {
def.getSource() = value and
valueCfn = value.getControlFlowNode() and
- cfnDef = def.getExpr().getAControlFlowNode()
+ cfnDef = def.getExpr().getControlFlowNode()
}
private predicate defAssigns(ExprNode value, AssignableDefinitionNode defNode) {
- exists(ControlFlow::Node cfn, AssignableDefinition def, ControlFlow::Node cfnDef |
+ exists(ControlFlowNode cfn, AssignableDefinition def, ControlFlowNode cfnDef |
defAssigns(def, cfnDef, value.getExpr(), _) and
cfn = value.getControlFlowNode() and
defNode = TAssignableDefinitionNode(def, cfnDef)
@@ -596,8 +600,8 @@ module LocalFlow {
or
ThisFlow::adjacentThisRefs(nodeFrom.(PostUpdateNode).getPreUpdateNode(), nodeTo)
or
- exists(AssignableDefinition def, ControlFlow::Node cfn, Ssa::ExplicitDefinition ssaDef |
- ssaDef.getADefinition() = def and
+ exists(AssignableDefinition def, ControlFlowNode cfn, SsaExplicitWrite ssaDef |
+ ssaDef.getDefinition() = def and
ssaDef.getControlFlowNode() = cfn and
nodeFrom = TAssignableDefinitionNode(def, cfn) and
nodeTo.(SsaDefinitionNode).getDefinition() = ssaDef
@@ -764,6 +768,7 @@ private class Argument extends Expr {
*
* `postUpdate` indicates whether the store targets a post-update node.
*/
+pragma[nomagic]
private predicate fieldOrPropertyStore(ContentSet c, Expr src, Expr q, boolean postUpdate) {
exists(FieldOrProperty f |
c = f.getContentSet() and
@@ -795,7 +800,7 @@ private predicate fieldOrPropertyStore(ContentSet c, Expr src, Expr q, boolean p
q = we and
mi = we.getInitializer().getAMemberInitializer() and
f = mi.getInitializedMember() and
- src = mi.getRValue() and
+ src = mi.getRightOperand() and
postUpdate = false
)
or
@@ -804,16 +809,16 @@ private predicate fieldOrPropertyStore(ContentSet c, Expr src, Expr q, boolean p
mi = q.(ObjectInitializer).getAMemberInitializer() and
q.getParent() instanceof ObjectCreation and
f = mi.getInitializedMember() and
- src = mi.getRValue() and
+ src = mi.getRightOperand() and
postUpdate = false
)
or
// Tuple element, `(..., src, ...)` `f` is `ItemX` of tuple `q`
exists(TupleExpr te, int i |
te = q and
- src = te.getArgument(i) and
+ src = te.getArgument(pragma[only_bind_into](i)) and
te.isConstruction() and
- f = q.getType().(TupleType).getElement(i) and
+ f = q.getType().(TupleType).getElement(pragma[only_bind_into](i)) and
postUpdate = false
)
)
@@ -879,8 +884,8 @@ private predicate arrayStore(Expr src, Expr a, boolean postUpdate) {
// Member initializer, `new C { Array = { [i] = src } }`
exists(MemberInitializer mi |
mi = a.(ObjectInitializer).getAMemberInitializer() and
- mi.getLValue() instanceof ArrayAccess and
- mi.getRValue() = src and
+ mi.getLeftOperand() instanceof ArrayAccess and
+ mi.getRightOperand() = src and
postUpdate = false
)
}
@@ -933,8 +938,6 @@ private Gvn::GvnType getANonTypeParameterSubTypeRestricted(RelevantGvnType t) {
/** A callable with an implicit `this` parameter. */
private class InstanceCallable extends Callable {
- private Location l;
-
InstanceCallable() {
not this.(Modifiable).isStatic() and
// local functions and delegate capture `this` and should therefore
@@ -942,8 +945,6 @@ private class InstanceCallable extends Callable {
not this instanceof LocalFunction and
not this instanceof AnonymousFunctionExpr
}
-
- Location getARelevantLocation() { result = l }
}
/**
@@ -1024,34 +1025,33 @@ private module Cached {
cached
newtype TNode =
- TExprNode(ControlFlow::Nodes::ElementNode cfn) { cfn.getAstNode() instanceof Expr } or
+ TExprNode(ControlFlowNodes::ElementNode cfn) { exists(cfn.asExpr()) } or
TSsaNode(SsaImpl::DataFlowIntegration::SsaNode node) or
- TAssignableDefinitionNode(AssignableDefinition def, ControlFlow::Node cfn) {
- cfn = def.getExpr().getAControlFlowNode()
+ TAssignableDefinitionNode(AssignableDefinition def, ControlFlowNode cfn) {
+ cfn = def.getExpr().getControlFlowNode()
} or
TExplicitParameterNode(Parameter p, DataFlowCallable c) {
p = c.asCallable(_).(CallableUsedInSource).getAParameter()
} or
TInstanceParameterNode(InstanceCallable c, Location l) {
c = any(DataFlowCallable dfc).asCallable(l) and
- c instanceof CallableUsedInSource and
- l = c.getARelevantLocation()
+ c instanceof CallableUsedInSource
} or
TDelegateSelfReferenceNode(Callable c) { lambdaCreationExpr(_, c) } or
- TLocalFunctionCreationNode(ControlFlow::Nodes::ElementNode cfn, Boolean isPostUpdate) {
- cfn.getAstNode() instanceof LocalFunctionStmt
+ TLocalFunctionCreationNode(ControlFlowNodes::ElementNode cfn, Boolean isPostUpdate) {
+ cfn.asStmt() instanceof LocalFunctionStmt
} or
- TYieldReturnNode(ControlFlow::Nodes::ElementNode cfn) {
- any(Callable c).canYieldReturn(cfn.getAstNode())
+ TYieldReturnNode(ControlFlowNodes::ElementNode cfn) {
+ any(Callable c).canYieldReturn(cfn.asExpr())
} or
- TAsyncReturnNode(ControlFlow::Nodes::ElementNode cfn) {
- any(Callable c | c.(Modifiable).isAsync()).canReturn(cfn.getAstNode())
+ TAsyncReturnNode(ControlFlowNodes::ElementNode cfn) {
+ any(Callable c | c.(Modifiable).isAsync()).canReturn(cfn.asExpr())
} or
- TMallocNode(ControlFlow::Nodes::ElementNode cfn) { cfn.getAstNode() instanceof ObjectCreation } or
- TObjectInitializerNode(ControlFlow::Nodes::ElementNode cfn) {
- cfn.getAstNode().(ObjectCreation).hasInitializer()
+ TMallocNode(ControlFlowNodes::ElementNode cfn) { cfn.asExpr() instanceof ObjectCreation } or
+ TObjectInitializerNode(ControlFlowNodes::ElementNode cfn) {
+ cfn.asExpr().(ObjectCreation).hasInitializer()
} or
- TExprPostUpdateNode(ControlFlow::Nodes::ExprNode cfn) {
+ TExprPostUpdateNode(ControlFlowNodes::ExprNode cfn) {
(
cfn.getExpr() instanceof Argument
or
@@ -1070,7 +1070,7 @@ private module Cached {
// needed for reverse stores; e.g. `x.f1.f2 = y` induces
// a store step of `f1` into `x`
exists(TExprPostUpdateNode upd, Expr read |
- upd = TExprPostUpdateNode(read.getAControlFlowNode())
+ upd = TExprPostUpdateNode(read.getControlFlowNode())
|
fieldOrPropertyRead(e, _, read)
or
@@ -1085,12 +1085,12 @@ private module Cached {
TFlowSummaryNode(FlowSummaryImpl::Private::SummaryNode sn) {
sn.getSummarizedCallable() instanceof CallableUsedInSource
} or
- TParamsArgumentNode(ControlFlow::Node callCfn) {
- callCfn = any(Call c | isParamsArg(c, _, _)).getAControlFlowNode()
+ TParamsArgumentNode(ControlFlowNode callCfn) {
+ callCfn = any(Call c | isParamsArg(c, _, _)).getControlFlowNode()
} or
TFlowInsensitiveFieldNode(FieldOrPropertyUsedInSource f) { f.isFieldLike() } or
TFlowInsensitiveCapturedVariableNode(LocalScopeVariable v) { v.isCaptured() } or
- TInstanceParameterAccessNode(ControlFlow::Node cfn, Boolean isPostUpdate) {
+ TInstanceParameterAccessNode(ControlFlowNode cfn, Boolean isPostUpdate) {
cfn = getAPrimaryConstructorParameterCfn(_)
} or
TPrimaryConstructorThisAccessNode(Parameter p, Boolean isPostUpdate, DataFlowCallable c) {
@@ -1179,7 +1179,8 @@ private module Cached {
cached
newtype TDataFlowType =
TGvnDataFlowType(Gvn::GvnType t) or
- TDelegateDataFlowType(Callable lambda) { lambdaCreationExpr(_, lambda) }
+ TDelegateDataFlowType(Callable lambda) { lambdaCreationExpr(_, lambda) } or
+ TSourceContextParameterType()
}
import Cached
@@ -1227,12 +1228,12 @@ class SsaNode extends NodeImpl, TSsaNode {
SsaNode() { this = TSsaNode(node) }
override DataFlowCallable getEnclosingCallableImpl() {
- result.getAControlFlowNode().getBasicBlock() = node.getBasicBlock()
+ result.getABasicBlock() = node.getBasicBlock()
}
override Type getTypeImpl() { result = node.getSourceVariable().getType() }
- override ControlFlow::Node getControlFlowNodeImpl() { none() }
+ override ControlFlowNode getControlFlowNodeImpl() { none() }
override Location getLocationImpl() { result = node.getLocation() }
@@ -1243,9 +1244,9 @@ class SsaNode extends NodeImpl, TSsaNode {
class SsaDefinitionNode extends SsaNode {
override SsaImpl::DataFlowIntegration::SsaDefinitionNode node;
- Ssa::Definition getDefinition() { result = node.getDefinition() }
+ SsaDefinition getDefinition() { result = node.getDefinition() }
- override ControlFlow::Node getControlFlowNodeImpl() {
+ override ControlFlowNode getControlFlowNodeImpl() {
result = this.getDefinition().getControlFlowNode()
}
}
@@ -1253,7 +1254,7 @@ class SsaDefinitionNode extends SsaNode {
/** A definition, viewed as a node in a data flow graph. */
class AssignableDefinitionNodeImpl extends NodeImpl, TAssignableDefinitionNode {
private AssignableDefinition def;
- private ControlFlow::Node cfn_;
+ private ControlFlowNode cfn_;
AssignableDefinitionNodeImpl() { this = TAssignableDefinitionNode(def, cfn_) }
@@ -1261,7 +1262,7 @@ class AssignableDefinitionNodeImpl extends NodeImpl, TAssignableDefinitionNode {
AssignableDefinition getDefinition() { result = def }
/** Gets the underlying definition, at control flow node `cfn`, if any. */
- AssignableDefinition getDefinitionAtNode(ControlFlow::Node cfn) {
+ AssignableDefinition getDefinitionAtNode(ControlFlowNode cfn) {
result = def and
cfn = cfn_
}
@@ -1270,7 +1271,7 @@ class AssignableDefinitionNodeImpl extends NodeImpl, TAssignableDefinitionNode {
override Type getTypeImpl() { result = def.getTarget().getType() }
- override ControlFlow::Node getControlFlowNodeImpl() { result = cfn_ }
+ override ControlFlowNode getControlFlowNodeImpl() { result = cfn_ }
override Location getLocationImpl() {
result = def.getTargetAccess().getLocation()
@@ -1301,12 +1302,6 @@ private module NearestLocationInputParamAfterCallable implements NearestLocation
}
private module ParameterNodes {
- pragma[nomagic]
- private predicate ssaParamDef(Ssa::ImplicitParameterDefinition ssaDef, Parameter p, Location l) {
- p = ssaDef.getParameter() and
- l = ssaDef.getLocation()
- }
-
private module NearestLocationInputParamBeforeCallable implements NearestLocationInputSig {
class C = Parameter;
@@ -1357,11 +1352,9 @@ private module ParameterNodes {
}
/** Gets the SSA definition corresponding to this parameter, if any. */
- Ssa::ImplicitParameterDefinition getSsaDefinition() {
- exists(Parameter p, Location l |
- l = this.getParameterLocation(p) and
- ssaParamDef(result, p, l)
- )
+ SsaParameterInit getSsaDefinition() {
+ result.getParameter() = parameter and
+ result.getBasicBlock() = callable.getABasicBlock()
}
override predicate isParameterOf(DataFlowCallable c, ParameterPosition pos) {
@@ -1373,7 +1366,7 @@ private module ParameterNodes {
override Type getTypeImpl() { result = parameter.getType() }
- override ControlFlow::Node getControlFlowNodeImpl() { none() }
+ override ControlFlowNode getControlFlowNodeImpl() { none() }
override Location getLocationImpl() { result = this.getParameterLocation(_) }
@@ -1398,7 +1391,7 @@ private module ParameterNodes {
override Type getTypeImpl() { result = callable.getDeclaringType() }
- override ControlFlow::Node getControlFlowNodeImpl() { none() }
+ override ControlFlowNode getControlFlowNodeImpl() { none() }
override Location getLocationImpl() { result = location }
@@ -1423,7 +1416,7 @@ private module ParameterNodes {
callable = c.asCallable(_) and pos.isDelegateSelf()
}
- override ControlFlow::Node getControlFlowNodeImpl() { none() }
+ override ControlFlowNode getControlFlowNodeImpl() { none() }
override DataFlowCallable getEnclosingCallableImpl() { result.asCallable(_) = callable }
@@ -1437,7 +1430,7 @@ private module ParameterNodes {
}
/** An implicit entry definition for a captured variable. */
- class SsaCapturedEntryDefinition extends Ssa::ImplicitEntryDefinition {
+ deprecated class SsaCapturedEntryDefinition extends Ssa::ImplicitEntryDefinition {
private LocalScopeVariable v;
SsaCapturedEntryDefinition() { this.getSourceVariable().getAssignable() = v }
@@ -1507,7 +1500,7 @@ private module ArgumentNodes {
* the constructor has run.
*/
class MallocNode extends ArgumentNodeImpl, NodeImpl, TMallocNode {
- private ControlFlow::Nodes::ElementNode cfn;
+ private ControlFlowNodes::ElementNode cfn;
MallocNode() { this = TMallocNode(cfn) }
@@ -1516,15 +1509,11 @@ private module ArgumentNodes {
pos.isQualifier()
}
- override ControlFlow::Node getControlFlowNodeImpl() { result = cfn }
+ override ControlFlowNode getControlFlowNodeImpl() { result = cfn }
- override DataFlowCallable getEnclosingCallableImpl() {
- result.getAControlFlowNode() = cfn
- or
- result = getEnclosingStaticFieldOrProperty(cfn.getAstNode())
- }
+ override DataFlowCallable getEnclosingCallableImpl() { result.getAControlFlowNode() = cfn }
- override Type getTypeImpl() { result = cfn.getAstNode().(Expr).getType() }
+ override Type getTypeImpl() { result = cfn.asExpr().getType() }
override Location getLocationImpl() { result = cfn.getLocation() }
@@ -1546,12 +1535,12 @@ private module ArgumentNodes {
* `Foo(new[] { "a", "b", "c" })`.
*/
class ParamsArgumentNode extends ArgumentNodeImpl, NodeImpl, TParamsArgumentNode {
- private ControlFlow::Node callCfn;
+ private ControlFlowNode callCfn;
ParamsArgumentNode() { this = TParamsArgumentNode(callCfn) }
private Parameter getParameter() {
- callCfn = any(Call c | isParamsArg(c, _, result)).getAControlFlowNode()
+ callCfn = any(Call c | isParamsArg(c, _, result)).getControlFlowNode()
}
override predicate argumentOf(DataFlowCall call, ArgumentPosition pos) {
@@ -1559,15 +1548,11 @@ private module ArgumentNodes {
pos.getPosition() = this.getParameter().getPosition()
}
- override DataFlowCallable getEnclosingCallableImpl() {
- result.getAControlFlowNode() = callCfn
- or
- result = getEnclosingStaticFieldOrProperty(callCfn.getAstNode())
- }
+ override DataFlowCallable getEnclosingCallableImpl() { result.getAControlFlowNode() = callCfn }
override Type getTypeImpl() { result = this.getParameter().getType() }
- override ControlFlow::Node getControlFlowNodeImpl() { none() }
+ override ControlFlowNode getControlFlowNodeImpl() { none() }
override Location getLocationImpl() { result = callCfn.getLocation() }
@@ -1620,7 +1605,7 @@ private module ReturnNodes {
OutRefReturnNode() {
exists(Parameter p |
- this.getDefinition().isLiveOutRefParameterDefinition(p) and
+ SsaImpl::isLiveOutRefParameterDefinition(this.getDefinition(), p) and
kind.getPosition() = p.getPosition()
|
p.isOut() and kind instanceof OutReturnKind
@@ -1638,10 +1623,10 @@ private module ReturnNodes {
* to `yield return e [e]`.
*/
class YieldReturnNode extends ReturnNode, NodeImpl, TYieldReturnNode {
- private ControlFlow::Nodes::ElementNode cfn;
+ private ControlFlowNodes::ElementNode cfn;
private YieldReturnStmt yrs;
- YieldReturnNode() { this = TYieldReturnNode(cfn) and yrs.getExpr().getAControlFlowNode() = cfn }
+ YieldReturnNode() { this = TYieldReturnNode(cfn) and yrs.getExpr().getControlFlowNode() = cfn }
YieldReturnStmt getYieldReturnStmt() { result = yrs }
@@ -1651,7 +1636,7 @@ private module ReturnNodes {
override Type getTypeImpl() { result = yrs.getEnclosingCallable().getReturnType() }
- override ControlFlow::Node getControlFlowNodeImpl() { result = cfn }
+ override ControlFlowNode getControlFlowNodeImpl() { result = cfn }
override Location getLocationImpl() { result = yrs.getLocation() }
@@ -1662,10 +1647,10 @@ private module ReturnNodes {
* A synthesized `return` node for returned expressions inside `async` methods.
*/
class AsyncReturnNode extends ReturnNode, NodeImpl, TAsyncReturnNode {
- private ControlFlow::Nodes::ElementNode cfn;
+ private ControlFlowNodes::ElementNode cfn;
private Expr expr;
- AsyncReturnNode() { this = TAsyncReturnNode(cfn) and expr = cfn.getAstNode() }
+ AsyncReturnNode() { this = TAsyncReturnNode(cfn) and expr = cfn.asExpr() }
Expr getExpr() { result = expr }
@@ -1675,7 +1660,7 @@ private module ReturnNodes {
override Type getTypeImpl() { result = expr.getEnclosingCallable().getReturnType() }
- override ControlFlow::Node getControlFlowNodeImpl() { result = cfn }
+ override ControlFlowNode getControlFlowNodeImpl() { result = cfn }
override Location getLocationImpl() { result = expr.getLocation() }
@@ -1727,7 +1712,7 @@ private module OutNodes {
private import semmle.code.csharp.frameworks.system.Collections
private import semmle.code.csharp.frameworks.system.collections.Generic
- private DataFlowCall csharpCall(Expr e, ControlFlow::Node cfn) {
+ private DataFlowCall csharpCall(Expr e, ControlFlowNode cfn) {
e = any(DispatchCall dc | result = TNonDelegateCall(cfn, dc)).getCall() or
result = TExplicitDelegateLikeCall(cfn, e)
}
@@ -1757,7 +1742,7 @@ private module OutNodes {
*/
class ParamOutNode extends OutNode, AssignableDefinitionNode {
private AssignableDefinitions::OutRefDefinition outRefDef;
- private ControlFlow::Node cfn;
+ private ControlFlowNode cfn;
ParamOutNode() { outRefDef = this.getDefinitionAtNode(cfn) }
@@ -1802,7 +1787,7 @@ class FlowSummaryNode extends NodeImpl, TFlowSummaryNode {
override Type getTypeImpl() { none() }
- override ControlFlow::Node getControlFlowNodeImpl() { none() }
+ override ControlFlowNode getControlFlowNodeImpl() { none() }
override Location getLocationImpl() { result = this.getSummarizedCallable().getLocation() }
@@ -1826,7 +1811,7 @@ class FlowSummaryNode extends NodeImpl, TFlowSummaryNode {
* all of which are represented by an `InstanceParameterAccessNode` node.
*/
abstract private class InstanceParameterAccessNode extends NodeImpl, TInstanceParameterAccessNode {
- ControlFlow::Node cfn;
+ ControlFlowNode cfn;
boolean isPostUpdate;
Parameter p;
@@ -1839,14 +1824,14 @@ abstract private class InstanceParameterAccessNode extends NodeImpl, TInstancePa
override Type getTypeImpl() { result = cfn.getEnclosingCallable().getDeclaringType() }
- override ControlFlow::Nodes::ElementNode getControlFlowNodeImpl() { none() }
+ override ControlFlowNodes::ElementNode getControlFlowNodeImpl() { none() }
override Location getLocationImpl() { result = cfn.getLocation() }
/**
* Gets the underlying control flow node.
*/
- ControlFlow::Node getUnderlyingControlFlowNode() { result = cfn }
+ ControlFlowNode getUnderlyingControlFlowNode() { result = cfn }
/**
* Gets the primary constructor parameter that this is a this access to.
@@ -1888,7 +1873,7 @@ abstract private class PrimaryConstructorThisAccessNode extends NodeImpl,
override Type getTypeImpl() { result = p.getCallable().getDeclaringType() }
- override ControlFlow::Nodes::ElementNode getControlFlowNodeImpl() { none() }
+ override ControlFlowNodes::ElementNode getControlFlowNodeImpl() { none() }
override Location getLocationImpl() {
NearestLocation::nearestLocation(p,
@@ -1926,7 +1911,7 @@ class CaptureNode extends NodeImpl, TCaptureNode {
VariableCapture::Flow::SynthesizedCaptureNode getSynthesizedCaptureNode() { result = cn }
override DataFlowCallable getEnclosingCallableImpl() {
- result.getAControlFlowNode().getBasicBlock() = cn.getBasicBlock()
+ result.getABasicBlock() = cn.getBasicBlock()
}
override Type getTypeImpl() {
@@ -1939,7 +1924,7 @@ class CaptureNode extends NodeImpl, TCaptureNode {
else result = super.getDataFlowType()
}
- override ControlFlow::Node getControlFlowNodeImpl() { none() }
+ override ControlFlowNode getControlFlowNodeImpl() { none() }
override Location getLocationImpl() { result = cn.getLocation() }
@@ -2023,12 +2008,9 @@ private class FieldOrPropertyRead extends FieldOrPropertyAccess, AssignableRead
* SSA updates.
*/
predicate hasNonlocalValue() {
- exists(Ssa::Definition def, Ssa::ImplicitDefinition idef |
+ exists(SsaDefinition def |
def.getARead() = this and
- idef = def.getAnUltimateDefinition()
- |
- idef instanceof Ssa::ImplicitEntryDefinition or
- idef instanceof Ssa::ImplicitCallDefinition
+ def.getAnUltimateDefinition() instanceof SsaImplicitWrite
)
}
}
@@ -2050,7 +2032,7 @@ class FlowInsensitiveFieldNode extends NodeImpl, TFlowInsensitiveFieldNode {
override Type getTypeImpl() { result = f.getType() }
- override ControlFlow::Node getControlFlowNodeImpl() { none() }
+ override ControlFlowNode getControlFlowNodeImpl() { none() }
override Location getLocationImpl() { result = f.getLocation() }
@@ -2074,7 +2056,7 @@ class FlowInsensitiveCapturedVariableNode extends NodeImpl, TFlowInsensitiveCapt
override Type getTypeImpl() { result = v.getType() }
- override ControlFlow::Node getControlFlowNodeImpl() { none() }
+ override ControlFlowNode getControlFlowNodeImpl() { none() }
override Location getLocationImpl() { result = v.getLocation() }
@@ -2117,7 +2099,7 @@ private ContentSet getResultContent() {
private predicate primaryConstructorParameterStore(
AssignableDefinitionNode node1, PrimaryConstructorParameterContent c, Node node2
) {
- exists(AssignableDefinition def, ControlFlow::Node cfn, Parameter p |
+ exists(AssignableDefinition def, ControlFlowNode cfn, Parameter p |
node1 = TAssignableDefinitionNode(def, cfn) and
p = def.getTarget() and
node2 = TInstanceParameterAccessNode(cfn, true) and
@@ -2227,12 +2209,11 @@ private predicate readContentStep(Node node1, Content c, Node node2) {
c instanceof ElementContent
or
exists(
- ForeachStmt fs, Ssa::ExplicitDefinition def,
- AssignableDefinitions::LocalVariableDefinition defTo
+ ForeachStmt fs, SsaExplicitWrite def, AssignableDefinitions::LocalVariableDefinition defTo
|
node1.asExpr() = fs.getIterableExpr() and
defTo.getDeclaration() = fs.getVariableDeclExpr() and
- def.getADefinition() = defTo and
+ def.getDefinition() = defTo and
node2.(SsaDefinitionNode).getDefinition() = def and
c instanceof ElementContent
)
@@ -2360,7 +2341,7 @@ predicate expectsContent(Node n, ContentSet c) {
n.asExpr() instanceof SpreadElementExpr and c.isElement()
}
-class NodeRegion instanceof ControlFlow::BasicBlock {
+class NodeRegion instanceof BasicBlock {
string toString() { result = "NodeRegion" }
predicate contains(Node n) { this = n.getControlFlowNode().getBasicBlock() }
@@ -2394,6 +2375,8 @@ class DataFlowType extends TDataFlowType {
Callable asDelegate() { this = TDelegateDataFlowType(result) }
+ predicate isSourceContextParameterType() { this = TSourceContextParameterType() }
+
/**
* Gets an expression that creates a delegate of this type.
*
@@ -2412,6 +2395,9 @@ class DataFlowType extends TDataFlowType {
result = this.asGvnType().toString()
or
result = this.asDelegate().toString()
+ or
+ this.isSourceContextParameterType() and
+ result = ""
}
}
@@ -2421,10 +2407,10 @@ DataFlowType getNodeType(Node n) {
not lambdaCreation(n, _, _) and
not isLocalFunctionCallReceiver(_, n.asExpr(), _)
or
- [
- n.asExpr().(ControlFlowElement),
- n.(LocalFunctionCreationPreNode).getUnderlyingControlFlowNode().getAstNode()
- ] = result.getADelegateCreation()
+ n.asExpr() = result.getADelegateCreation()
+ or
+ n.(LocalFunctionCreationPreNode).getUnderlyingControlFlowNode() =
+ result.getADelegateCreation().getControlFlowNode()
}
private class DataFlowNullType extends Gvn::GvnType {
@@ -2469,6 +2455,11 @@ private predicate compatibleTypesDelegateLeft(DataFlowType dt1, DataFlowType dt2
)
}
+pragma[nomagic]
+private predicate compatibleTypesSourceContextParameterTypeLeft(DataFlowType dt1, DataFlowType dt2) {
+ dt1.isSourceContextParameterType() and not exists(dt2.asDelegate())
+}
+
/**
* Holds if `t1` and `t2` are compatible, that is, whether data can flow from
* a node of type `t1` to a node of type `t2`.
@@ -2499,6 +2490,10 @@ predicate compatibleTypes(DataFlowType dt1, DataFlowType dt2) {
compatibleTypesDelegateLeft(dt2, dt1)
or
dt1.asDelegate() = dt2.asDelegate()
+ or
+ compatibleTypesSourceContextParameterTypeLeft(dt1, dt2)
+ or
+ compatibleTypesSourceContextParameterTypeLeft(dt2, dt1)
}
pragma[nomagic]
@@ -2511,6 +2506,8 @@ predicate typeStrongerThan(DataFlowType t1, DataFlowType t2) {
uselessTypebound(t2)
or
compatibleTypesDelegateLeft(t1, t2)
+ or
+ compatibleTypesSourceContextParameterTypeLeft(t1, t2)
}
/**
@@ -2540,10 +2537,10 @@ module PostUpdateNodes {
class ObjectCreationNode extends SourcePostUpdateNode, ExprNode, TExprNode {
private ObjectCreation oc;
- ObjectCreationNode() { this = TExprNode(oc.getAControlFlowNode()) }
+ ObjectCreationNode() { this = TExprNode(oc.getControlFlowNode()) }
override Node getPreUpdateSourceNode() {
- exists(ControlFlow::Nodes::ElementNode cfn | this = TExprNode(cfn) |
+ exists(ControlFlowNodes::ElementNode cfn | this = TExprNode(cfn) |
result = TObjectInitializerNode(cfn)
or
not oc.hasInitializer() and
@@ -2563,11 +2560,11 @@ module PostUpdateNodes {
TObjectInitializerNode
{
private ObjectCreation oc;
- private ControlFlow::Nodes::ElementNode cfn;
+ private ControlFlowNodes::ElementNode cfn;
ObjectInitializerNode() {
this = TObjectInitializerNode(cfn) and
- cfn = oc.getAControlFlowNode()
+ cfn = oc.getControlFlowNode()
}
/** Gets the initializer to which this initializer node belongs. */
@@ -2582,19 +2579,15 @@ module PostUpdateNodes {
call.getExpr() = init.(CollectionInitializer).getAnElementInitializer()
or
// E.g. `new Dictionary() { [0] = "a", [1] = "b" }`
- call.getExpr() = init.(ObjectInitializer).getAMemberInitializer().getLValue()
+ call.getExpr() = init.(ObjectInitializer).getAMemberInitializer().getLeftOperand()
)
}
- override DataFlowCallable getEnclosingCallableImpl() {
- result.getAControlFlowNode() = cfn
- or
- result = getEnclosingStaticFieldOrProperty(oc)
- }
+ override DataFlowCallable getEnclosingCallableImpl() { result.getAControlFlowNode() = cfn }
override Type getTypeImpl() { result = oc.getType() }
- override ControlFlow::Nodes::ElementNode getControlFlowNodeImpl() { result = cfn }
+ override ControlFlowNodes::ElementNode getControlFlowNodeImpl() { result = cfn }
override Location getLocationImpl() { result = cfn.getLocation() }
@@ -2602,21 +2595,17 @@ module PostUpdateNodes {
}
class ExprPostUpdateNode extends SourcePostUpdateNode, NodeImpl, TExprPostUpdateNode {
- private ControlFlow::Nodes::ElementNode cfn;
+ private ControlFlowNodes::ElementNode cfn;
ExprPostUpdateNode() { this = TExprPostUpdateNode(cfn) }
override ExprNode getPreUpdateSourceNode() { result = TExprNode(cfn) }
- override DataFlowCallable getEnclosingCallableImpl() {
- result.getAControlFlowNode() = cfn
- or
- result = getEnclosingStaticFieldOrProperty(cfn.getAstNode())
- }
+ override DataFlowCallable getEnclosingCallableImpl() { result.getAControlFlowNode() = cfn }
- override Type getTypeImpl() { result = cfn.getAstNode().(Expr).getType() }
+ override Type getTypeImpl() { result = cfn.asExpr().getType() }
- override ControlFlow::Node getControlFlowNodeImpl() { none() }
+ override ControlFlowNode getControlFlowNodeImpl() { none() }
override Location getLocationImpl() { result = cfn.getLocation() }
@@ -2745,7 +2734,7 @@ private predicate isLocalFunctionCallReceiver(
f = receiver.getTarget().getUnboundDeclaration()
}
-private predicate lambdaCallExpr(DataFlowCall call, Expr receiver, ControlFlow::Node receiverCfn) {
+private predicate lambdaCallExpr(DataFlowCall call, Expr receiver, ControlFlowNode receiverCfn) {
exists(DelegateLikeCall dc |
call.(ExplicitDelegateLikeDataFlowCall).getCall() = dc and
receiver = dc.getExpr() and
@@ -2766,7 +2755,7 @@ predicate lambdaCall(DataFlowCall call, LambdaCallKind kind, Node receiver) {
(
lambdaCallExpr(call, receiver.asExpr(), _) and
// local function calls can be resolved directly without a flow analysis
- not call.getControlFlowNode().getAstNode() instanceof LocalFunctionCall
+ not call.getControlFlowNode().asExpr() instanceof LocalFunctionCall
or
receiver.(FlowSummaryNode).getSummaryNode() = call.(SummaryCall).getReceiver()
) and
@@ -2795,7 +2784,7 @@ predicate additionalLambdaFlowStep(Node nodeFrom, Node nodeTo, boolean preserves
preservesValue = true
or
exists(AddEventExpr aee |
- nodeFrom.asExpr() = aee.getRValue() and
+ nodeFrom.asExpr() = aee.getRightOperand() and
nodeTo.asExpr().(EventRead).getTarget() = aee.getTarget() and
preservesValue = false
)
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPublic.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPublic.qll
index f4d24fdb5101..7919b38de3fd 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPublic.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPublic.qll
@@ -17,7 +17,7 @@ class Node extends TNode {
* Gets the expression corresponding to this node, at control flow node `cfn`,
* if any.
*/
- Expr asExprAtNode(ControlFlow::Nodes::ElementNode cfn) {
+ Expr asExprAtNode(ControlFlowNodes::ElementNode cfn) {
result = this.(ExprNode).getExprAtNode(cfn)
}
@@ -31,7 +31,7 @@ class Node extends TNode {
* Gets the definition corresponding to this node, at control flow node `cfn`,
* if any.
*/
- AssignableDefinition asDefinitionAtNode(ControlFlow::Node cfn) {
+ AssignableDefinition asDefinitionAtNode(ControlFlowNode cfn) {
result = this.(AssignableDefinitionNode).getDefinitionAtNode(cfn)
}
@@ -44,7 +44,7 @@ class Node extends TNode {
}
/** Gets the control flow node corresponding to this node, if any. */
- final ControlFlow::Node getControlFlowNode() { result = this.(NodeImpl).getControlFlowNodeImpl() }
+ final ControlFlowNode getControlFlowNode() { result = this.(NodeImpl).getControlFlowNodeImpl() }
/** Gets a textual representation of this node. */
final string toString() { result = this.(NodeImpl).toStringImpl() }
@@ -71,7 +71,7 @@ class Node extends TNode {
*
* Note that because of control-flow splitting, one `Expr` may correspond
* to multiple `ExprNode`s, just like it may correspond to multiple
- * `ControlFlow::Node`s.
+ * `ControlFlowNode`s.
*/
class ExprNode extends Node, TExprNode {
/** Gets the expression corresponding to this node. */
@@ -81,9 +81,9 @@ class ExprNode extends Node, TExprNode {
* Gets the expression corresponding to this node, at control flow node `cfn`,
* if any.
*/
- Expr getExprAtNode(ControlFlow::Nodes::ElementNode cfn) {
+ Expr getExprAtNode(ControlFlowNodes::ElementNode cfn) {
this = TExprNode(cfn) and
- result = cfn.getAstNode()
+ result = cfn.asExpr()
}
}
@@ -113,7 +113,7 @@ class AssignableDefinitionNode extends Node instanceof AssignableDefinitionNodeI
AssignableDefinition getDefinition() { result = super.getDefinition() }
/** Gets the underlying definition, at control flow node `cfn`, if any. */
- AssignableDefinition getDefinitionAtNode(ControlFlow::Node cfn) {
+ AssignableDefinition getDefinitionAtNode(ControlFlowNode cfn) {
result = super.getDefinitionAtNode(cfn)
}
}
@@ -133,12 +133,14 @@ AssignableDefinitionNode assignableDefinitionNode(AssignableDefinition def) {
predicate localFlowStep = localFlowStepImpl/2;
+private predicate localFlowStepPlus(Node source, Node sink) = fastTC(localFlowStep/2)(source, sink)
+
/**
* Holds if data flows from `source` to `sink` in zero or more local
* (intra-procedural) steps.
*/
pragma[inline]
-predicate localFlow(Node source, Node sink) { localFlowStep*(source, sink) }
+predicate localFlow(Node source, Node sink) { localFlowStepPlus(source, sink) or source = sink }
/**
* Holds if data can flow from `e1` to `e2` in zero or more
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll
index 024e9cf119d5..f8cec8c4d9f6 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll
@@ -4,13 +4,17 @@
* Provides classes and predicates for dealing with MaD flow models specified
* in data extensions and CSV format.
*
- * The CSV specification has the following columns:
+ * The extensible relations have the following columns:
* - Sources:
* `namespace; type; subtypes; name; signature; ext; output; kind; provenance`
* - Sinks:
* `namespace; type; subtypes; name; signature; ext; input; kind; provenance`
* - Summaries:
* `namespace; type; subtypes; name; signature; ext; input; output; kind; provenance`
+ * - Barriers:
+ * `namespace; type; subtypes; name; signature; ext; output; kind; provenance`
+ * - BarrierGuards:
+ * `namespace; type; subtypes; name; signature; ext; input; acceptingValue; kind; provenance`
* - Neutrals:
* `namespace; type; name; signature; kind; provenance`
* A neutral is used to indicate that a callable is neutral with respect to flow (no summary), source (is not a source) or sink (is not a sink).
@@ -69,14 +73,17 @@
* - "Field[f]": Selects the contents of field `f`.
* - "Property[p]": Selects the contents of property `p`.
*
- * 8. The `kind` column is a tag that can be referenced from QL to determine to
+ * 8. The `acceptingValue` column of barrier guard models specifies the condition
+ * under which the guard blocks flow. It can be one of "true" or "false". In
+ * the future "no-exception", "not-zero", "null", "not-null" may be supported.
+ * 9. The `kind` column is a tag that can be referenced from QL to determine to
* which classes the interpreted elements should be added. For example, for
* sources "remote" indicates a default remote flow source, and for summaries
* "taint" indicates a default additional taint step and "value" indicates a
* globally applicable value-preserving step. For neutrals the kind can be `summary`,
* `source` or `sink` to indicate that the neutral is neutral with respect to
* flow (no summary), source (is not a source) or sink (is not a sink).
- * 9. The `provenance` column is a tag to indicate the origin and verification of a model.
+ * 10. The `provenance` column is a tag to indicate the origin and verification of a model.
* The format is {origin}-{verification} or just "manual" where the origin describes
* the origin of the model and verification describes how the model has been verified.
* Some examples are:
@@ -230,11 +237,11 @@ module ModelValidation {
result = "Unrecognized provenance description \"" + provenance + "\" in " + pred + " model."
)
or
- exists(string acceptingvalue |
- barrierGuardModel(_, _, _, _, _, _, _, acceptingvalue, _, _, _) and
- invalidAcceptingValue(acceptingvalue) and
+ exists(string acceptingValue |
+ barrierGuardModel(_, _, _, _, _, _, _, acceptingValue, _, _, _) and
+ invalidAcceptingValue(acceptingValue) and
result =
- "Unrecognized accepting value description \"" + acceptingvalue +
+ "Unrecognized accepting value description \"" + acceptingValue +
"\" in barrier guard model."
)
}
@@ -482,13 +489,13 @@ private module Cached {
private predicate barrierGuardChecks(Guard g, Expr e, GuardValue gv, TKindModelPair kmp) {
exists(
- SourceSinkInterpretationInput::InterpretNode n, AcceptingValue acceptingvalue, string kind,
+ SourceSinkInterpretationInput::InterpretNode n, AcceptingValue acceptingValue, string kind,
string model
|
- isBarrierGuardNode(n, acceptingvalue, kind, model) and
+ isBarrierGuardNode(n, acceptingValue, kind, model) and
n.asNode().asExpr() = e and
kmp = TMkPair(kind, model) and
- gv = convertAcceptingValue(acceptingvalue)
+ gv = convertAcceptingValue(acceptingValue)
|
g.(Call).getAnArgument() = e or g.(QualifiableExpr).getQualifier() = e
)
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlowExtensions.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlowExtensions.qll
index 3461f0a51863..cd438ece284d 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlowExtensions.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlowExtensions.qll
@@ -33,7 +33,7 @@ extensible predicate barrierModel(
*/
extensible predicate barrierGuardModel(
string namespace, string type, boolean subtypes, string name, string signature, string ext,
- string input, string acceptingvalue, string kind, string provenance, QlBuiltins::ExtensionId madId
+ string input, string acceptingValue, string kind, string provenance, QlBuiltins::ExtensionId madId
);
/**
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll
index ec6bbf81fee1..a7ab18a62901 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll
@@ -253,13 +253,13 @@ module SourceSinkInterpretationInput implements
}
predicate barrierGuardElement(
- Element e, string input, Public::AcceptingValue acceptingvalue, string kind,
+ Element e, string input, Public::AcceptingValue acceptingValue, string kind,
Public::Provenance provenance, string model
) {
exists(
string namespace, string type, boolean subtypes, string name, string signature, string ext
|
- barrierGuardModel(namespace, type, subtypes, name, signature, ext, input, acceptingvalue,
+ barrierGuardModel(namespace, type, subtypes, name, signature, ext, input, acceptingValue,
kind, provenance, model) and
e = interpretElement(namespace, type, subtypes, name, signature, ext, _)
)
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/SsaImpl.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/SsaImpl.qll
index 2809f8187b91..b7257a2f5f2b 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/SsaImpl.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/SsaImpl.qll
@@ -5,11 +5,11 @@
import csharp
private import codeql.ssa.Ssa as SsaImplCommon
private import AssignableDefinitions
-private import semmle.code.csharp.controlflow.BasicBlocks as BasicBlocks
private import semmle.code.csharp.controlflow.Guards as Guards
private import semmle.code.csharp.dataflow.internal.BaseSSA
+private import semmle.code.csharp.internal.Location
-private module SsaInput implements SsaImplCommon::InputSig {
+private module SsaImplInput implements SsaImplCommon::InputSig {
class SourceVariable = Ssa::SourceVariable;
/**
@@ -18,7 +18,7 @@ private module SsaInput implements SsaImplCommon::InputSig as Impl
+import SsaImplCommon::Make as Impl
+
+private module SsaInput implements Impl::SsaInputSig {
+ private import csharp as CS
+
+ class Expr = CS::Expr;
+
+ class Parameter = CS::Parameter;
+
+ class VariableWrite extends AssignableDefinition {
+ Expr asExpr() { result = this.getExpr() }
+
+ Expr getValue() { result = this.getSource() }
+
+ predicate isParameterInit(Parameter p) { this.(ImplicitParameterDefinition).getParameter() = p }
+ }
+
+ predicate explicitWrite(VariableWrite w, BasicBlock bb, int i, SsaImplInput::SourceVariable v) {
+ exists(AssignableDefinition ad | variableDefinition(bb, i, v, ad) |
+ w = ad or
+ w = getASameOutRefDefAfter(v, ad)
+ )
+ or
+ exists(Parameter p |
+ implicitEntryDefinition(bb, v) and
+ i = -1 and
+ p = v.getAssignable() and
+ pragma[only_bind_out](p.getCallable()) = pragma[only_bind_out](v.getEnclosingCallable()) and
+ w.isParameterInit(p)
+ )
+ }
+}
+
+module Ssa_ = Impl::MakeSsa;
class Definition = Impl::Definition;
-class WriteDefinition = Impl::WriteDefinition;
+private class SsaDefinitionToStringProxy extends Definition {
+ override string toString() { result = this.(SsaDefinition).toString() }
+}
+
+deprecated class WriteDefinition = Impl::WriteDefinition;
-class UncertainWriteDefinition = Impl::UncertainWriteDefinition;
+deprecated class UncertainWriteDefinition = Impl::UncertainWriteDefinition;
-class PhiNode = Impl::PhiNode;
+deprecated class PhiNode = Impl::PhiNode;
module Consistency = Impl::Consistency;
/**
* Holds if the `i`th node of basic block `bb` reads source variable `v`.
*/
-private predicate variableReadActual(ControlFlow::BasicBlock bb, int i, Ssa::SourceVariable v) {
- v.getAnAccess().(AssignableRead) = bb.getNode(i).getAstNode()
+private predicate variableReadActual(BasicBlock bb, int i, Ssa::SourceVariable v) {
+ v.getAnAccess().(AssignableRead) = bb.getNode(i).asExpr()
}
private module SourceVariableImpl {
@@ -125,11 +162,8 @@ private module SourceVariableImpl {
* Holds if the `i`th node of basic block `bb` is assignable definition `ad`
* targeting source variable `v`.
*/
- predicate variableDefinition(
- ControlFlow::BasicBlock bb, int i, Ssa::SourceVariable v, AssignableDefinition ad
- ) {
+ predicate variableDefinition(BasicBlock bb, int i, Ssa::SourceVariable v, AssignableDefinition ad) {
ad = v.getADefinition() and
- ad.getExpr().getAControlFlowNode() = bb.getNode(i) and
// In cases like `(x, x) = (0, 1)`, we discard the first (dead) definition of `x`
not exists(TupleAssignmentDefinition first, TupleAssignmentDefinition second | first = ad |
second.getAssignment() = first.getAssignment() and
@@ -139,7 +173,13 @@ private module SourceVariableImpl {
// In cases like `M(out x, out x)`, there is no inherent evaluation order, so we
// collapse the two definitions of `x`, using the first access as the representative,
// and expose both definitions in `ExplicitDefinition.getADefinition()`
- not ad = getASameOutRefDefAfter(v, _)
+ not ad = getASameOutRefDefAfter(v, _) and
+ (
+ ad.getExpr().getControlFlowNode() = bb.getNode(i)
+ or
+ ad.(AssignableDefinitions::ImplicitParameterDefinition).getParameter().getControlFlowNode() =
+ bb.getNode(i)
+ )
}
/**
@@ -159,9 +199,7 @@ private module SourceVariableImpl {
*
* This excludes implicit writes via calls.
*/
- predicate variableWriteDirect(
- ControlFlow::BasicBlock bb, int i, Ssa::SourceVariable v, boolean certain
- ) {
+ predicate variableWriteDirect(BasicBlock bb, int i, Ssa::SourceVariable v, boolean certain) {
exists(AssignableDefinition ad | variableDefinition(bb, i, v, ad) |
if any(AssignableDefinition ad0 | ad0 = ad or ad0 = getASameOutRefDefAfter(v, ad)).isCertain()
then certain = true
@@ -186,13 +224,12 @@ private module SourceVariableImpl {
* }
* ```
*/
- predicate outRefExitRead(ControlFlow::BasicBlock bb, int i, LocalScopeSourceVariable v) {
- exists(ControlFlow::Nodes::AnnotatedExitNode exit |
- exit.isNormal() and
+ predicate outRefExitRead(BasicBlock bb, int i, LocalScopeSourceVariable v) {
+ exists(ControlFlow::NormalExitNode exit |
exists(LocalScopeVariable lsv |
lsv = v.getAssignable() and
bb.getNode(i) = exit and
- exit.getCallable() = lsv.getCallable()
+ exit.getEnclosingCallable() = lsv.getCallable()
|
lsv.(Parameter).isOutOrRef()
or
@@ -218,12 +255,12 @@ private module SourceVariableImpl {
* The pseudo read is inserted at the CFG node `i` on the left-hand side of the
* assignment on line 3.
*/
- predicate refReadBeforeWrite(ControlFlow::BasicBlock bb, int i, LocalScopeSourceVariable v) {
+ predicate refReadBeforeWrite(BasicBlock bb, int i, LocalScopeSourceVariable v) {
exists(AssignableDefinitions::AssignmentDefinition def, LocalVariable lv |
def.getTarget() = lv and
lv.isRef() and
lv = v.getAssignable() and
- bb.getNode(i) = def.getExpr().getAControlFlowNode() and
+ bb.getNode(i) = def.getExpr().getControlFlowNode() and
not def.getAssignment() instanceof LocalVariableDeclAndInitExpr
)
}
@@ -249,6 +286,15 @@ private module SourceVariableImpl {
private import SourceVariableImpl
private import Ssa::SourceVariables
+pragma[nomagic]
+predicate localScopeSourceVariable(
+ Ssa::SourceVariables::LocalScopeSourceVariable sv, LocalScopeVariable v, Callable c1, Callable c2
+) {
+ sv.getAssignable() = v and
+ sv.getEnclosingCallable() = c1 and
+ v.getCallable() = c2
+}
+
private module CallGraph {
private import semmle.code.csharp.dispatch.Dispatch
@@ -276,15 +322,17 @@ private module CallGraph {
*
* the constructor call `new Lazy(M2)` includes `M2` as a target.
*/
- Callable getARuntimeTarget(Call c, boolean libraryDelegateCall) {
+ Callable getARuntimeTarget(Call c, ControlFlowNode n, boolean libraryDelegateCall) {
// Non-delegate call: use dispatch library
exists(DispatchCall dc | dc.getCall() = c |
+ n = dc.getControlFlowNode() and
result = dc.getADynamicTarget().getUnboundDeclaration() and
libraryDelegateCall = false
)
or
// Delegate call: use simple analysis
- result = SimpleDelegateAnalysis::getARuntimeDelegateTarget(c, libraryDelegateCall)
+ result = SimpleDelegateAnalysis::getARuntimeDelegateTarget(c, libraryDelegateCall) and
+ n = c.getControlFlowNode()
}
private module SimpleDelegateAnalysis {
@@ -337,7 +385,7 @@ private module CallGraph {
pred = succ.(DelegateCreation).getArgument()
or
exists(AddEventExpr ae | succ.(EventAccess).getTarget() = ae.getTarget() |
- pred = ae.getRValue()
+ pred = ae.getRightOperand()
)
}
@@ -471,7 +519,7 @@ private module CallGraph {
/** Holds if `(c1,c2)` is an edge in the call graph. */
predicate callEdge(Callable c1, Callable c2) {
- exists(Call c | c.getEnclosingCallable() = c1 and c2 = getARuntimeTarget(c, _))
+ exists(Call c | c.getEnclosingCallable() = c1 and c2 = getARuntimeTarget(c, _, _))
}
}
@@ -605,7 +653,7 @@ private module FieldOrPropsImpl {
private predicate intraInstanceCallEdge(Callable c1, InstanceCallable c2) {
exists(Call c |
c.getEnclosingCallable() = c1 and
- c2 = getARuntimeTarget(c, _) and
+ c2 = getARuntimeTarget(c, _, _) and
c.(QualifiableExpr).targetIsLocalInstance()
)
}
@@ -620,9 +668,8 @@ private module FieldOrPropsImpl {
}
pragma[noinline]
- predicate callAt(ControlFlow::BasicBlock bb, int i, Call call) {
- bb.getNode(i) = call.getAControlFlowNode() and
- getARuntimeTarget(call, _).hasBody()
+ predicate callAt(BasicBlock bb, int i, Call call) {
+ getARuntimeTarget(call, bb.getNode(i), _).hasBody()
}
/**
@@ -630,9 +677,7 @@ private module FieldOrPropsImpl {
* an update somewhere, and `fp` is likely to be live in `bb` at index
* `i`.
*/
- predicate updateCandidate(
- ControlFlow::BasicBlock bb, int i, FieldOrPropSourceVariable fp, Call call
- ) {
+ predicate updateCandidate(BasicBlock bb, int i, FieldOrPropSourceVariable fp, Call call) {
callAt(bb, i, call) and
call.getEnclosingCallable() = fp.getEnclosingCallable() and
relevantDefinition(_, fp.getAssignable(), _) and
@@ -643,7 +688,7 @@ private module FieldOrPropsImpl {
Call call, FieldOrPropSourceVariable fps, FieldOrProp fp, Callable c, boolean fresh
) {
updateCandidate(_, _, fps, call) and
- c = getARuntimeTarget(call, _) and
+ c = getARuntimeTarget(call, _, _) and
fp = fps.getAssignable() and
if c instanceof Constructor then fresh = true else fresh = false
}
@@ -714,71 +759,12 @@ private module FieldOrPropsImpl {
}
}
-private predicate variableReadPseudo(ControlFlow::BasicBlock bb, int i, Ssa::SourceVariable v) {
+private predicate variableReadPseudo(BasicBlock bb, int i, Ssa::SourceVariable v) {
outRefExitRead(bb, i, v)
or
refReadBeforeWrite(bb, i, v)
}
-pragma[noinline]
-deprecated private predicate adjacentDefRead(
- Definition def, ControlFlow::BasicBlock bb1, int i1, ControlFlow::BasicBlock bb2, int i2,
- SsaInput::SourceVariable v
-) {
- Impl::adjacentDefRead(def, bb1, i1, bb2, i2) and
- v = def.getSourceVariable()
-}
-
-deprecated private predicate adjacentDefReachesRead(
- Definition def, SsaInput::SourceVariable v, ControlFlow::BasicBlock bb1, int i1,
- ControlFlow::BasicBlock bb2, int i2
-) {
- adjacentDefRead(def, bb1, i1, bb2, i2, v) and
- (
- def.definesAt(v, bb1, i1)
- or
- SsaInput::variableRead(bb1, i1, v, true)
- )
- or
- exists(ControlFlow::BasicBlock bb3, int i3 |
- adjacentDefReachesRead(def, v, bb1, i1, bb3, i3) and
- SsaInput::variableRead(bb3, i3, _, false) and
- Impl::adjacentDefRead(def, bb3, i3, bb2, i2)
- )
-}
-
-deprecated private predicate adjacentDefReachesUncertainRead(
- Definition def, ControlFlow::BasicBlock bb1, int i1, ControlFlow::BasicBlock bb2, int i2
-) {
- exists(SsaInput::SourceVariable v |
- adjacentDefReachesRead(def, v, bb1, i1, bb2, i2) and
- SsaInput::variableRead(bb2, i2, v, false)
- )
-}
-
-/** Same as `lastRefRedef`, but skips uncertain reads. */
-pragma[nomagic]
-deprecated private predicate lastRefSkipUncertainReads(
- Definition def, ControlFlow::BasicBlock bb, int i
-) {
- Impl::lastRef(def, bb, i) and
- not SsaInput::variableRead(bb, i, def.getSourceVariable(), false)
- or
- exists(ControlFlow::BasicBlock bb0, int i0 |
- Impl::lastRef(def, bb0, i0) and
- adjacentDefReachesUncertainRead(def, bb, i, bb0, i0)
- )
-}
-
-pragma[nomagic]
-deprecated predicate lastReadSameVar(Definition def, ControlFlow::Node cfn) {
- exists(ControlFlow::BasicBlock bb, int i |
- lastRefSkipUncertainReads(def, bb, i) and
- variableReadActual(bb, i, _) and
- cfn = bb.getNode(i)
- )
-}
-
cached
private module Cached {
cached
@@ -818,35 +804,27 @@ private module Cached {
}
cached
- predicate implicitEntryDefinition(ControlFlow::BasicBlock bb, Ssa::SourceVariable v) {
- exists(ControlFlow::BasicBlocks::EntryBlock entry, Callable c |
- c = entry.getCallable() and
- // In case `c` has multiple bodies, we want each body to get its own implicit
- // entry definition. In case `c` doesn't have multiple bodies, the line below
- // is simply the same as `bb = entry`, because `entry.getFirstNode().getASuccessor()`
- // will be in the entry block.
- bb = entry.getFirstNode().getASuccessor().getBasicBlock() and
- c = v.getEnclosingCallable()
- |
- // Captured variable
- exists(LocalScopeVariable lsv |
- v = any(LocalScopeSourceVariable lv | lsv = lv.getAssignable())
- |
- lsv.getCallable() != c
+ predicate implicitEntryDefinition(BasicBlock bb, Ssa::SourceVariable v) {
+ exists(Callable c | c = v.getEnclosingCallable() |
+ c = bb.(EntryBasicBlock).getEnclosingCallable() and
+ (
+ // Captured variable
+ exists(LocalScopeVariable lsv |
+ v = any(LocalScopeSourceVariable lv | lsv = lv.getAssignable())
+ |
+ lsv.getCallable() != c
+ )
+ or
+ // Each tracked field and property has an implicit entry definition
+ v instanceof PlainFieldOrPropSourceVariable
)
or
- // Each tracked field and property has an implicit entry definition
- v instanceof PlainFieldOrPropSourceVariable
- or
- v.getAssignable() instanceof Parameter
- )
- }
-
- cached
- AssignableDefinition getADefinition(Ssa::ExplicitDefinition def) {
- exists(Ssa::SourceVariable v, AssignableDefinition ad | explicitDefinition(def, v, ad) |
- result = ad or
- result = getASameOutRefDefAfter(v, ad)
+ // In case `c` has multiple bodies, we want each body to get its own set of
+ // parameter definitions, so we add special writes to the start of the basic
+ // blocks containing the bodies
+ strictcount(c.getBody()) > 1 and
+ v.getAssignable() instanceof Parameter and
+ bb.getANode().isBefore(c.getBody())
)
}
@@ -856,7 +834,7 @@ private module Cached {
*/
cached
predicate updatesNamedFieldOrProp(
- ControlFlow::BasicBlock bb, int i, Call c, FieldOrPropSourceVariable fp, Callable setter
+ BasicBlock bb, int i, Call c, FieldOrPropSourceVariable fp, Callable setter
) {
FieldOrPropsImpl::updateCandidate(bb, i, fp, c) and
FieldOrPropsImpl::updatesNamedFieldOrProp(fp, c, setter)
@@ -864,9 +842,9 @@ private module Cached {
cached
predicate variableWriteQualifier(
- ControlFlow::BasicBlock bb, int i, QualifiedFieldOrPropSourceVariable v, boolean certain
+ BasicBlock bb, int i, QualifiedFieldOrPropSourceVariable v, boolean certain
) {
- SsaInput::variableWrite(bb, i, v.getQualifier(), certain) and
+ SsaImplInput::variableWrite(bb, i, v.getQualifier(), certain) and
// Eliminate corner case where a call definition can overlap with a
// qualifier definition: if method `M` updates field `F`, then a call
// to `M` is both an update of `x.M` and `x.M.M`, so the former call
@@ -875,42 +853,14 @@ private module Cached {
not updatesNamedFieldOrProp(bb, i, _, v, _)
}
- cached
- predicate explicitDefinition(WriteDefinition def, Ssa::SourceVariable v, AssignableDefinition ad) {
- exists(ControlFlow::BasicBlock bb, int i |
- def.definesAt(v, bb, i) and
- variableDefinition(bb, i, v, ad)
- )
- }
-
- cached
- predicate isLiveAtEndOfBlock(Definition def, ControlFlow::BasicBlock bb) {
- Impl::ssaDefReachesEndOfBlock(bb, def, _)
- }
-
- cached
- Definition phiHasInputFromBlock(Ssa::PhiNode phi, ControlFlow::BasicBlock bb) {
- Impl::phiHasInputFromBlock(phi, result, bb)
- }
-
- cached
- AssignableRead getAReadAtNode(Definition def, ControlFlow::Node cfn) {
- exists(Ssa::SourceVariable v, ControlFlow::BasicBlock bb, int i |
- Impl::ssaDefReachesRead(v, def, bb, i) and
- variableReadActual(bb, i, v) and
- cfn = bb.getNode(i) and
- result.getAControlFlowNode() = cfn
- )
- }
-
/**
- * Holds if the value defined at SSA definition `def` can reach a read at `cfn`,
+ * Holds if the value defined at SSA definition `def` can reach a read `read`,
* without passing through any other read.
*/
cached
- predicate firstReadSameVar(Definition def, ControlFlow::Node cfn) {
- exists(ControlFlow::BasicBlock bb, int i |
- Impl::firstUse(def, bb, i, true) and cfn = bb.getNode(i)
+ predicate firstReadSameVar(Definition def, AssignableRead read) {
+ exists(BasicBlock bb, int i |
+ Impl::firstUse(def, bb, i, true) and read.getControlFlowNode() = bb.getNode(i)
)
}
@@ -920,11 +870,8 @@ private module Cached {
* passing through another read.
*/
cached
- predicate adjacentReadPairSameVar(Definition def, ControlFlow::Node cfn1, ControlFlow::Node cfn2) {
- exists(
- ControlFlow::BasicBlock bb1, int i1, ControlFlow::BasicBlock bb2, int i2,
- Ssa::SourceVariable v
- |
+ predicate adjacentReadPairSameVar(Definition def, ControlFlowNode cfn1, ControlFlowNode cfn2) {
+ exists(BasicBlock bb1, int i1, BasicBlock bb2, int i2, Ssa::SourceVariable v |
Impl::ssaDefReachesRead(v, def, bb1, i1) and
Impl::adjacentUseUse(bb1, i1, bb2, i2, v, true) and
cfn1 = bb1.getNode(i1) and
@@ -932,15 +879,14 @@ private module Cached {
)
}
+ /**
+ * Holds if the SSA definition `def` assigns to `out`/`ref` parameter `p`, and the
+ * parameter may remain unchanged throughout the rest of the enclosing callable.
+ */
cached
- Definition uncertainWriteDefinitionInput(UncertainWriteDefinition def) {
- Impl::uncertainWriteDefinitionInput(def, result)
- }
-
- cached
- predicate isLiveOutRefParameterDefinition(Ssa::Definition def, Parameter p) {
+ predicate isLiveOutRefParameterDefinition(SsaDefinition def, Parameter p) {
p.isOutOrRef() and
- exists(Ssa::SourceVariable v, Ssa::Definition def0, ControlFlow::BasicBlock bb, int i |
+ exists(Ssa::SourceVariable v, SsaDefinition def0, BasicBlock bb, int i |
v = def.getSourceVariable() and
p = v.getAssignable() and
def = def0.getAnUltimateDefinition() and
@@ -1022,47 +968,64 @@ private module Cached {
import Cached
-private string getSplitString(Definition def) {
- exists(ControlFlow::BasicBlock bb, int i, ControlFlow::Node cfn |
- def.definesAt(_, bb, i) and
- result = cfn.(ControlFlow::Nodes::ElementNode).getSplitsString()
- |
- cfn = bb.getNode(i)
- or
- not exists(bb.getNode(i)) and
- cfn = bb.getFirstNode()
+deprecated AssignableDefinition getADefinition(Ssa::ExplicitDefinition def) {
+ exists(Ssa::SourceVariable v, AssignableDefinition ad | explicitDefinition(def, v, ad) |
+ result = ad or
+ result = getASameOutRefDefAfter(v, ad)
)
}
-string getToStringPrefix(Definition def) {
- result = "[" + getSplitString(def) + "] "
- or
- not exists(getSplitString(def)) and
- result = ""
+deprecated predicate explicitDefinition(
+ WriteDefinition def, Ssa::SourceVariable v, AssignableDefinition ad
+) {
+ exists(BasicBlock bb, int i |
+ def.definesAt(v, bb, i) and
+ variableDefinition(bb, i, v, ad)
+ )
+}
+
+deprecated predicate isLiveAtEndOfBlock(Definition def, BasicBlock bb) {
+ Impl::ssaDefReachesEndOfBlock(bb, def, _)
+}
+
+deprecated Definition phiHasInputFromBlock(Ssa::PhiNode phi, BasicBlock bb) {
+ Impl::phiHasInputFromBlock(phi, result, bb)
+}
+
+deprecated AssignableRead getAReadAtNode(Definition def, ControlFlowNode cfn) {
+ exists(Ssa::SourceVariable v, BasicBlock bb, int i |
+ Impl::ssaDefReachesRead(v, def, bb, i) and
+ variableReadActual(bb, i, v) and
+ cfn = bb.getNode(i) and
+ result.getControlFlowNode() = cfn
+ )
+}
+
+deprecated Definition uncertainWriteDefinitionInput(UncertainWriteDefinition def) {
+ Impl::uncertainWriteDefinitionInput(def, result)
}
private module DataFlowIntegrationInput implements Impl::DataFlowIntegrationInputSig {
- private import semmle.code.csharp.controlflow.BasicBlocks
private import codeql.util.Boolean
- class Expr extends ControlFlow::Node {
- predicate hasCfgNode(ControlFlow::BasicBlock bb, int i) { this = bb.getNode(i) }
+ class Expr extends ControlFlowNode {
+ predicate hasCfgNode(BasicBlock bb, int i) { this = bb.getNode(i) }
}
- Expr getARead(Definition def) { exists(getAReadAtNode(def, result)) }
+ Expr getARead(Definition def) { def.(SsaDefinition).getARead().getControlFlowNode() = result }
- predicate ssaDefHasSource(WriteDefinition def) {
+ predicate ssaDefHasSource(Impl::WriteDefinition def) {
// exclude flow directly from RHS to SSA definition, as we instead want to
// go from RHS to matching assignable definition, and from there to SSA definition
- def instanceof Ssa::ImplicitParameterDefinition
+ def instanceof SsaParameterInit
}
/**
- * Allows for flow into uncertain defintions that are not call definitions,
+ * Allows for flow into uncertain definitions that are not call definitions,
* as we, conservatively, consider such definitions to be certain.
*/
- predicate allowFlowIntoUncertainDef(UncertainWriteDefinition def) {
- def instanceof Ssa::ExplicitDefinition
+ predicate allowFlowIntoUncertainDef(Impl::UncertainWriteDefinition def) {
+ def instanceof SsaExplicitWrite
or
def =
any(Ssa::ImplicitQualifierDefinition qdef |
@@ -1086,3 +1049,58 @@ private module DataFlowIntegrationInput implements Impl::DataFlowIntegrationInpu
}
private module DataFlowIntegrationImpl = Impl::DataFlowIntegration;
+
+deprecated private module MultiBodyNearestLocationInput implements NearestLocationInputSig {
+ class C = MultiBodyParameterDefinition;
+
+ predicate relevantLocations(MultiBodyParameterDefinition def, Location l1, Location l2) {
+ exists(Callable c, ControlFlowNode n |
+ l1 = def.getParameter().getALocation() and
+ n = def.getBasicBlock().getANode() and
+ n.isBefore(c.getBody()) and
+ l2 = n.getLocation()
+ )
+ }
+}
+
+pragma[nomagic]
+deprecated private predicate implicitEntryDef(
+ Ssa::ImplicitEntryDefinition def, Ssa::SourceVariable v, Callable c
+) {
+ v = def.getSourceVariable() and
+ c = def.getCallable()
+}
+
+/**
+ * An SSA definition representing the implicit initialization of a parameter
+ * at the beginning of a callable.
+ */
+abstract deprecated class ParameterDefinitionImpl extends Ssa::Definition {
+ /** Gets the parameter that this definition represents. */
+ abstract Parameter getParameter();
+
+ override string toString() {
+ result = "SSA param(" + pragma[only_bind_out](this.getParameter()) + ")"
+ }
+}
+
+deprecated class MultiBodyParameterDefinition extends ParameterDefinitionImpl,
+ Ssa::ImplicitEntryDefinition
+{
+ private Parameter p;
+
+ MultiBodyParameterDefinition() {
+ exists(Ssa::SourceVariable sv, Callable c |
+ implicitEntryDef(this, sv, c) and
+ localScopeSourceVariable(sv, p, _, c)
+ )
+ }
+
+ override Parameter getParameter() { result = p }
+
+ override string toString() { result = ParameterDefinitionImpl.super.toString() }
+
+ override Location getLocation() {
+ NearestLocation::nearestLocation(this, result, _)
+ }
+}
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/Steps.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/Steps.qll
index 63cd0b65dc67..7e2709468d6a 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/Steps.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/Steps.qll
@@ -15,8 +15,8 @@ module Steps {
* Gets a read that may read the value assigned at definition `def`.
*/
private AssignableRead getARead(AssignableDefinition def) {
- exists(BaseSsa::Definition ssaDef |
- ssaDef.getAnUltimateDefinition().getDefinition() = def and
+ exists(BaseSsa::SsaDefinition ssaDef |
+ ssaDef.getAnUltimateDefinition().(BaseSsa::SsaExplicitWrite).getDefinition() = def and
result = ssaDef.getARead()
)
or
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/TaintTrackingPublic.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/TaintTrackingPublic.qll
index 1e60165d7484..60ebece0ee5b 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/TaintTrackingPublic.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/TaintTrackingPublic.qll
@@ -1,12 +1,17 @@
private import csharp
private import TaintTrackingPrivate
+private predicate localTaintStepPlus(DataFlow::Node source, DataFlow::Node sink) =
+ fastTC(localTaintStep/2)(source, sink)
+
/**
* Holds if taint propagates from `source` to `sink` in zero or more local
* (intra-procedural) steps.
*/
pragma[inline]
-predicate localTaint(DataFlow::Node source, DataFlow::Node sink) { localTaintStep*(source, sink) }
+predicate localTaint(DataFlow::Node source, DataFlow::Node sink) {
+ localTaintStepPlus(source, sink) or source = sink
+}
/**
* Holds if taint can flow from `e1` to `e2` in zero or more
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/BoundSpecific.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/BoundSpecific.qll
index 3885c11afd14..037422684306 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/BoundSpecific.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/BoundSpecific.qll
@@ -10,7 +10,7 @@ private import semmle.code.csharp.dataflow.internal.rangeanalysis.SsaUtils as SU
class SsaVariable = SU::SsaVariable;
-class Expr = CS::ControlFlow::Nodes::ExprNode;
+class Expr = CS::ControlFlowNodes::ExprNode;
class Location = CS::Location;
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/ConstantUtils.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/ConstantUtils.qll
index e3f5deb98989..91e0ee50ef5c 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/ConstantUtils.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/ConstantUtils.qll
@@ -7,7 +7,7 @@ private import Ssa
private import SsaUtils
private import RangeUtils
-private class ExprNode = ControlFlow::Nodes::ExprNode;
+private class ExprNode = ControlFlowNodes::ExprNode;
/**
* Holds if `pa` is an access to the `Length` property of an array.
@@ -23,7 +23,7 @@ predicate systemArrayLengthAccess(PropertyAccess pa) {
* - a read of the `Length` of an array with `val` lengths.
*/
private predicate constantIntegerExpr(ExprNode e, int val) {
- e.getValue().toInt() = val
+ e.getExpr().getIntValue() = val
or
exists(ExprNode src |
e = getAnExplicitDefinitionRead(src) and
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/ModulusAnalysisSpecific.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/ModulusAnalysisSpecific.qll
index ca0aa83f29fc..34b5ec9a5e85 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/ModulusAnalysisSpecific.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/ModulusAnalysisSpecific.qll
@@ -4,15 +4,14 @@ module Private {
private import semmle.code.csharp.dataflow.internal.rangeanalysis.RangeUtils as RU
private import SsaUtils as SU
private import SsaReadPositionCommon
- private import semmle.code.csharp.controlflow.internal.ControlFlowGraphImpl as CfgImpl
- class BasicBlock = CS::ControlFlow::BasicBlock;
+ class BasicBlock = CS::BasicBlock;
class SsaVariable = SU::SsaVariable;
- class SsaPhiNode = CS::Ssa::PhiNode;
+ class SsaPhiNode = CS::SsaPhiDefinition;
- class Expr = CS::ControlFlow::Nodes::ExprNode;
+ class Expr = CS::ControlFlowNodes::ExprNode;
class Guard = RU::Guard;
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/RangeUtils.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/RangeUtils.qll
index 46153f18dae2..b85f68883ab6 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/RangeUtils.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/RangeUtils.qll
@@ -9,7 +9,7 @@ private module Impl {
private import SsaReadPositionCommon
private import semmle.code.csharp.controlflow.Guards as G
- private class ExprNode = ControlFlow::Nodes::ExprNode;
+ private class ExprNode = ControlFlowNodes::ExprNode;
/** Holds if `parent` having child `child` implies `parentNode` having child `childNode`. */
predicate hasChild(Expr parent, Expr child, ExprNode parentNode, ExprNode childNode) {
@@ -19,9 +19,9 @@ private module Impl {
}
/** Holds if SSA definition `def` equals `e + delta`. */
- predicate ssaUpdateStep(ExplicitDefinition def, ExprNode e, int delta) {
- exists(ControlFlow::Node cfn | cfn = def.getControlFlowNode() |
- e = cfn.(ExprNode::Assignment).getRValue() and
+ predicate ssaUpdateStep(SsaExplicitWrite def, ExprNode e, int delta) {
+ exists(ControlFlowNode cfn | cfn = def.getControlFlowNode() |
+ e = cfn.(ExprNode::Assignment).getRightOperand() and
delta = 0 and
not cfn instanceof ExprNode::AssignOperation
or
@@ -39,7 +39,7 @@ private module Impl {
/** Holds if `e1 + delta` equals `e2`. */
predicate valueFlowStep(ExprNode e2, ExprNode e1, int delta) {
- e2.(ExprNode::AssignExpr).getRValue() = e1 and delta = 0
+ e2.(ExprNode::AssignExpr).getRightOperand() = e1 and delta = 0
or
e2.(ExprNode::UnaryPlusExpr).getOperand() = e1 and delta = 0
or
@@ -83,9 +83,7 @@ private module Impl {
/**
* Holds if basic block `bb` is guarded by this guard having value `v`.
*/
- predicate controlsBasicBlock(ControlFlow::BasicBlock bb, G::GuardValue v) {
- super.controlsBasicBlock(bb, v)
- }
+ predicate controlsBasicBlock(BasicBlock bb, G::GuardValue v) { super.controlsBasicBlock(bb, v) }
/**
* Holds if this guard is an equality test between `e1` and `e2`. If the test is
@@ -108,7 +106,7 @@ private module Impl {
* - `isEq = true` : `def == e + delta`
* - `isEq = false` : `def != e + delta`
*/
- Guard eqFlowCond(Definition def, ExprNode e, int delta, boolean isEq, boolean testIsTrue) {
+ Guard eqFlowCond(SsaDefinition def, ExprNode e, int delta, boolean isEq, boolean testIsTrue) {
exists(boolean eqpolarity |
result.isEquality(ssaRead(def, delta), e, eqpolarity) and
testIsTrue = [false, true] and
@@ -160,7 +158,7 @@ import Impl
module ExprNode {
private import csharp as CS
- private class ExprNode = CS::ControlFlow::Nodes::ExprNode;
+ private class ExprNode = CS::ControlFlowNodes::ExprNode;
private import Sign
@@ -207,13 +205,13 @@ module ExprNode {
override CS::Assignment e;
/** Gets the left operand of this assignment. */
- ExprNode getLValue() {
- result = unique(ExprNode res | hasChild(e, e.getLValue(), this, res) | res)
+ ExprNode getLeftOperand() {
+ result = unique(ExprNode res | hasChild(e, e.getLeftOperand(), this, res) | res)
}
/** Gets the right operand of this assignment. */
- ExprNode getRValue() {
- result = unique(ExprNode res | hasChild(e, e.getRValue(), this, res) | res)
+ ExprNode getRightOperand() {
+ result = unique(ExprNode res | hasChild(e, e.getRightOperand(), this, res) | res)
}
}
@@ -225,6 +223,10 @@ module ExprNode {
/** A compound assignment operation. */
class AssignOperation extends Assignment, BinaryOperation {
override CS::AssignOperation e;
+
+ override ExprNode getLeftOperand() { result = Assignment.super.getLeftOperand() }
+
+ override ExprNode getRightOperand() { result = Assignment.super.getRightOperand() }
}
/** A unary operation. */
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/SignAnalysisSpecific.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/SignAnalysisSpecific.qll
index d59d7958765a..48ed00858a0d 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/SignAnalysisSpecific.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/SignAnalysisSpecific.qll
@@ -13,9 +13,9 @@ module Private {
class ConstantIntegerExpr = CU::ConstantIntegerExpr;
- class SsaVariable = CS::Ssa::Definition;
+ class SsaVariable = CS::SsaDefinition;
- class SsaPhiNode = CS::Ssa::PhiNode;
+ class SsaPhiNode = CS::SsaPhiDefinition;
class VarAccess = RU::ExprNode::AssignableAccess;
@@ -33,9 +33,9 @@ module Private {
class Type = CS::Type;
- class Expr = CS::ControlFlow::Nodes::ExprNode;
+ class Expr = CS::ControlFlowNodes::ExprNode;
- class VariableUpdate = CS::Ssa::ExplicitDefinition;
+ class VariableUpdate = CS::SsaExplicitWrite;
class Field = CS::Field;
@@ -63,7 +63,7 @@ private module Impl {
private import SsaReadPositionCommon
private import semmle.code.csharp.commons.ComparisonTest
- private class ExprNode = ControlFlow::Nodes::ExprNode;
+ private class ExprNode = ControlFlowNodes::ExprNode;
/** Gets the character value of expression `e`. */
string getCharValue(ExprNode e) { result = e.getValue() and e.getType() instanceof CharType }
@@ -122,53 +122,41 @@ private module Impl {
}
/** Returns the underlying variable update of the explicit SSA variable `v`. */
- Ssa::ExplicitDefinition getExplicitSsaAssignment(Ssa::ExplicitDefinition v) { result = v }
+ SsaExplicitWrite getExplicitSsaAssignment(SsaExplicitWrite v) { result = v }
/** Returns the assignment of the variable update `def`. */
- ExprNode getExprFromSsaAssignment(Ssa::ExplicitDefinition def) {
- exists(AssignableDefinition adef |
- adef = def.getADefinition() and
- hasChild(adef.getExpr(), adef.getSource(), def.getControlFlowNode(), result)
- )
- or
- exists(AssignableDefinitions::AssignOperationDefinition adef |
- adef = def.getADefinition() and
- result.getExpr() = adef.getSource()
- )
- }
+ ExprNode getExprFromSsaAssignment(SsaExplicitWrite def) { result.getExpr() = def.getValue() }
/** Holds if `def` can have any sign. */
- predicate explicitSsaDefWithAnySign(Ssa::ExplicitDefinition def) {
- not exists(def.getADefinition().getSource()) and
- not def.getElement() instanceof MutatorOperation
+ predicate explicitSsaDefWithAnySign(SsaExplicitWrite def) {
+ not exists(def.getValue()) and
+ not def.getDefiningExpr() instanceof MutatorOperation
}
/** Returns the operand of the operation if `def` is a decrement. */
- ExprNode getDecrementOperand(Ssa::ExplicitDefinition def) {
- hasChild(def.getElement(), def.getElement().(DecrementOperation).getOperand(),
- def.getControlFlowNode(), result)
+ ExprNode getDecrementOperand(SsaExplicitWrite def) {
+ result.getExpr() = def.getDefiningExpr().(DecrementOperation).getOperand()
}
/** Returns the operand of the operation if `def` is an increment. */
- ExprNode getIncrementOperand(Ssa::ExplicitDefinition def) {
- hasChild(def.getElement(), def.getElement().(IncrementOperation).getOperand(),
- def.getControlFlowNode(), result)
+ ExprNode getIncrementOperand(SsaExplicitWrite def) {
+ result.getExpr() = def.getDefiningExpr().(IncrementOperation).getOperand()
}
/** Gets the variable underlying the implicit SSA variable `def`. */
- Declaration getImplicitSsaDeclaration(Ssa::ImplicitDefinition def) {
+ Declaration getImplicitSsaDeclaration(SsaImplicitWrite def) {
result = def.getSourceVariable().getAssignable()
}
/** Holds if the variable underlying the implicit SSA variable `def` is not a field. */
- predicate nonFieldImplicitSsaDefinition(Ssa::ImplicitDefinition def) {
+ predicate nonFieldImplicitSsaDefinition(SsaImplicitWrite def) {
not getImplicitSsaDeclaration(def) instanceof Field
}
/** Returned an expression that is assigned to `f`. */
ExprNode getAssignedValueToField(Field f) {
result.getExpr() in [
- f.getAnAssignedValue(), any(AssignOperation a | a.getLValue() = f.getAnAccess())
+ f.getAnAssignedValue(), any(AssignOperation a | a.getLeftOperand() = f.getAnAccess())
]
}
@@ -231,7 +219,7 @@ private module Impl {
/** Returns a sub expression of `e` for expression types where the sign depends on the child. */
ExprNode getASubExprWithSameSign(ExprNode e) {
exists(Expr e_, Expr child | hasChild(e_, child, e, result) |
- child = e_.(AssignExpr).getRValue() or
+ child = e_.(AssignExpr).getRightOperand() or
child = e_.(UnaryPlusExpr).getOperand() or
child = e_.(PostIncrExpr).getOperand() or
child = e_.(PostDecrExpr).getOperand() or
@@ -245,7 +233,7 @@ private module Impl {
)
}
- ExprNode getARead(Ssa::Definition v) { exists(v.getAReadAtNode(result)) }
+ ExprNode getARead(SsaDefinition v) { v.getARead().getControlFlowNode() = result }
Field getField(ExprNode fa) { result = fa.getExpr().(FieldAccess).getTarget() }
@@ -254,7 +242,7 @@ private module Impl {
Guard getComparisonGuard(ComparisonExpr ce) { result = ce.getExpr() }
private newtype TComparisonExpr =
- MkComparisonExpr(ComparisonTest ct, ExprNode e) { e = ct.getExpr().getAControlFlowNode() }
+ MkComparisonExpr(ComparisonTest ct, ExprNode e) { e = ct.getExpr().getControlFlowNode() }
/** A relational comparison */
class ComparisonExpr extends MkComparisonExpr {
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/SsaReadPositionSpecific.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/SsaReadPositionSpecific.qll
index cbf4a1d57393..77833591c3eb 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/SsaReadPositionSpecific.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/SsaReadPositionSpecific.qll
@@ -2,39 +2,34 @@
* Provides C#-specific definitions for use in the `SsaReadPosition`.
*/
-private import csharp
+private import csharp as CS
private import SsaReadPositionCommon
-private import semmle.code.csharp.controlflow.internal.ControlFlowGraphImpl as CfgImpl
-class SsaVariable = Ssa::Definition;
+class SsaVariable = CS::SsaDefinition;
-class SsaPhiNode = Ssa::PhiNode;
+class SsaPhiNode = CS::SsaPhiDefinition;
-class BasicBlock = ControlFlow::BasicBlock;
+class BasicBlock = CS::BasicBlock;
/** Gets a basic block in which SSA variable `v` is read. */
-BasicBlock getAReadBasicBlock(SsaVariable v) {
- result = v.getARead().getAControlFlowNode().getBasicBlock()
-}
+BasicBlock getAReadBasicBlock(SsaVariable v) { result = v.getARead().getBasicBlock() }
private class PhiInputEdgeBlock extends BasicBlock {
PhiInputEdgeBlock() { this = any(SsaReadPositionPhiInputEdge edge).getOrigBlock() }
}
-private int getId(PhiInputEdgeBlock bb) {
- exists(CfgImpl::AstNode n | result = n.getId() |
- n = bb.getFirstNode().getAstNode()
- or
- n = bb.(ControlFlow::BasicBlocks::EntryBlock).getCallable()
- )
+private predicate id(CS::ControlFlowElementOrCallable x, CS::ControlFlowElementOrCallable y) {
+ x = y
}
-private string getSplitString(PhiInputEdgeBlock bb) {
- result = bb.getFirstNode().(ControlFlow::Nodes::ElementNode).getSplitsString()
- or
- not exists(bb.getFirstNode().(ControlFlow::Nodes::ElementNode).getSplitsString()) and
- result = ""
-}
+private predicate idOfAst(CS::ControlFlowElementOrCallable x, int y) =
+ equivalenceRelation(id/2)(x, y)
+
+private predicate idOf(PhiInputEdgeBlock x, int y) { idOfAst(x.getFirstNode().getAstNode(), y) }
+
+private int getId1(PhiInputEdgeBlock bb) { idOf(bb, result) }
+
+private string getId2(PhiInputEdgeBlock bb) { bb.getFirstNode().getIdTag() = result }
/**
* Declarations to be exposed to users of SsaReadPositionCommon.
@@ -50,7 +45,7 @@ module Public {
rank[r](SsaReadPositionPhiInputEdge e |
e.phiInput(phi, _)
|
- e order by getId(e.getOrigBlock()), getSplitString(e.getOrigBlock())
+ e order by getId1(e.getOrigBlock()), getId2(e.getOrigBlock())
)
}
}
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/SsaUtils.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/SsaUtils.qll
index 89117d90ba79..33afe07dae33 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/SsaUtils.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/SsaUtils.qll
@@ -7,27 +7,27 @@ private import Ssa
private import RangeUtils
private import ConstantUtils
-private class ExprNode = ControlFlow::Nodes::ExprNode;
+private class ExprNode = ControlFlowNodes::ExprNode;
/** An SSA variable. */
-class SsaVariable extends Definition {
+class SsaVariable extends SsaDefinition {
/** Gets a read of this SSA variable. */
- ExprNode getAUse() { exists(this.getAReadAtNode(result)) }
+ ExprNode getAUse() { this.getARead().getControlFlowNode() = result }
}
/** Gets a node that reads `src` via an SSA explicit definition. */
ExprNode getAnExplicitDefinitionRead(ExprNode src) {
- exists(ExplicitDefinition def |
- exists(def.getAReadAtNode(result)) and
- hasChild(def.getElement(), def.getADefinition().getSource(), def.getControlFlowNode(), src)
+ exists(SsaExplicitWrite def |
+ def.getARead().getControlFlowNode() = result and
+ hasChild(def.getDefiningExpr(), def.getValue(), def.getControlFlowNode(), src)
)
}
/**
* Gets an expression that equals `v - delta`.
*/
-ExprNode ssaRead(Definition v, int delta) {
- exists(v.getAReadAtNode(result)) and delta = 0
+ExprNode ssaRead(SsaDefinition v, int delta) {
+ v.getARead().getControlFlowNode() = result and delta = 0
or
exists(ExprNode::AddOperation add, int d1, ConstantIntegerExpr c |
result = add and
@@ -45,15 +45,15 @@ ExprNode ssaRead(Definition v, int delta) {
delta = d1 + c.getIntValue()
)
or
- v.(ExplicitDefinition).getControlFlowNode().(ExprNode::PreIncrExpr) = result and delta = 0
+ v.(SsaExplicitWrite).getControlFlowNode().(ExprNode::PreIncrExpr) = result and delta = 0
or
- v.(ExplicitDefinition).getControlFlowNode().(ExprNode::PreDecrExpr) = result and delta = 0
+ v.(SsaExplicitWrite).getControlFlowNode().(ExprNode::PreDecrExpr) = result and delta = 0
or
- v.(ExplicitDefinition).getControlFlowNode().(ExprNode::PostIncrExpr) = result and delta = 1 // x++ === ++x - 1
+ v.(SsaExplicitWrite).getControlFlowNode().(ExprNode::PostIncrExpr) = result and delta = 1 // x++ === ++x - 1
or
- v.(ExplicitDefinition).getControlFlowNode().(ExprNode::PostDecrExpr) = result and delta = -1 // x-- === --x + 1
+ v.(SsaExplicitWrite).getControlFlowNode().(ExprNode::PostDecrExpr) = result and delta = -1 // x-- === --x + 1
or
- v.(ExplicitDefinition).getControlFlowNode().(ExprNode::Assignment) = result and delta = 0
+ v.(SsaExplicitWrite).getControlFlowNode().(ExprNode::Assignment) = result and delta = 0
or
- result.(ExprNode::AssignExpr).getRValue() = ssaRead(v, delta)
+ result.(ExprNode::AssignExpr).getRightOperand() = ssaRead(v, delta)
}
diff --git a/csharp/ql/lib/semmle/code/csharp/dispatch/Dispatch.qll b/csharp/ql/lib/semmle/code/csharp/dispatch/Dispatch.qll
index f7f6c7a50be4..15a64d12b499 100644
--- a/csharp/ql/lib/semmle/code/csharp/dispatch/Dispatch.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dispatch/Dispatch.qll
@@ -20,6 +20,9 @@ class DispatchCall extends Internal::TDispatchCall {
/** Gets the underlying expression of this call. */
Expr getCall() { result = Internal::getCall(this) }
+ /** Gets the control flow node of this call. */
+ ControlFlowNode getControlFlowNode() { result = Internal::getControlFlowNode(this) }
+
/** Gets the `i`th argument of this call. */
Expr getArgument(int i) { result = Internal::getArgument(this, i) }
@@ -90,8 +93,17 @@ private module Internal {
not mc.isLateBound() and
not isExtensionAccessorCall(mc)
} or
- TDispatchAccessorCall(AccessorCall ac) or
- TDispatchOperatorCall(OperatorCall oc) { not oc.isLateBound() } or
+ TDispatchAccessorCall(AccessorCall ac, boolean isRead) {
+ // For compound assignments an AccessorCall can be both a read and a write
+ ac instanceof AssignableRead and isRead = true
+ or
+ ac instanceof AssignableWrite and isRead = false
+ } or
+ TDispatchOperatorCall(OperatorCall oc) {
+ not oc.isLateBound() and
+ not oc instanceof CompoundAssignmentOperatorCall
+ } or
+ TDispatchCompoundAssignmentOperatorCall(CompoundAssignmentOperatorCall caoc) or
TDispatchReflectionCall(MethodCall mc, string name, Expr object, Expr qualifier, int args) {
isReflectionCall(mc, name, object, qualifier, args)
} or
@@ -117,6 +129,11 @@ private module Internal {
cached
Expr getCall(DispatchCall dc) { result = dc.(DispatchCallImpl).getCall() }
+ cached
+ ControlFlowNode getControlFlowNode(DispatchCall dc) {
+ result = dc.(DispatchCallImpl).getControlFlowNode()
+ }
+
cached
Expr getArgument(DispatchCall dc, int i) { result = dc.(DispatchCallImpl).getArgument(i) }
@@ -224,6 +241,9 @@ private module Internal {
/** Gets the underlying expression of this call. */
abstract Expr getCall();
+ /** Gets the control flow node of this call. */
+ ControlFlowNode getControlFlowNode() { result = this.getCall().getControlFlowNode() }
+
/** Gets the `i`th argument of this call. */
abstract Expr getArgument(int i);
@@ -339,8 +359,8 @@ private module Internal {
1 < strictcount(this.getADynamicTarget().getUnboundDeclaration()) and
c = this.getCall().getEnclosingCallable().getUnboundDeclaration() and
(
- exists(BaseSsa::Definition def, Parameter p |
- def.isImplicitEntryDefinition(p) and
+ exists(BaseSsa::SsaParameterInit def, Parameter p |
+ def.getParameter() = p and
this.getSyntheticQualifier() = def.getARead() and
p.getPosition() = i and
c.getAParameter() = p and
@@ -870,6 +890,20 @@ private module Internal {
override Operator getAStaticTarget() { result = this.getCall().getTarget() }
}
+ private class DispatchCompoundAssignmentOperatorCall extends DispatchOverridableCall,
+ TDispatchCompoundAssignmentOperatorCall
+ {
+ override CompoundAssignmentOperatorCall getCall() {
+ this = TDispatchCompoundAssignmentOperatorCall(result)
+ }
+
+ override Expr getArgument(int i) { result = this.getCall().getArgument(i) }
+
+ override Expr getQualifier() { result = this.getCall().getQualifier() }
+
+ override Operator getAStaticTarget() { result = this.getCall().getTarget() }
+ }
+
/**
* A call to an accessor.
*
@@ -877,13 +911,28 @@ private module Internal {
* into account.
*/
private class DispatchAccessorCall extends DispatchOverridableCall, TDispatchAccessorCall {
- override AccessorCall getCall() { this = TDispatchAccessorCall(result) }
+ private predicate isRead() { this = TDispatchAccessorCall(_, true) }
+
+ override ControlFlowNode getControlFlowNode() {
+ if this.isRead()
+ then result = this.getCall().getControlFlowNode()
+ else
+ exists(AssignableDefinition def |
+ def.getTargetAccess() = this.getCall() and result = def.getExpr().getControlFlowNode()
+ )
+ }
+
+ override AccessorCall getCall() { this = TDispatchAccessorCall(result, _) }
override Expr getArgument(int i) { result = this.getCall().getArgument(i) }
override Expr getQualifier() { result = this.getCall().(MemberAccess).getQualifier() }
- override Accessor getAStaticTarget() { result = this.getCall().getTarget() }
+ override Accessor getAStaticTarget() {
+ if this.isRead()
+ then result = this.getCall().getReadTarget()
+ else result = this.getCall().getWriteTarget()
+ }
override RuntimeAccessor getADynamicTarget() {
result = DispatchOverridableCall.super.getADynamicTarget() and
@@ -1348,7 +1397,7 @@ private module Internal {
any(DynamicMemberAccess dma | this = TDispatchDynamicEventAccess(_, dma, _)).getQualifier()
}
- override Expr getArgument(int i) { i = 0 and result = this.getCall().getRValue() }
+ override Expr getArgument(int i) { i = 0 and result = this.getCall().getRightOperand() }
}
/** A call to a constructor using dynamic types. */
diff --git a/csharp/ql/lib/semmle/code/csharp/exprs/Access.qll b/csharp/ql/lib/semmle/code/csharp/exprs/Access.qll
index 84375bc70130..d9fb16f0974b 100644
--- a/csharp/ql/lib/semmle/code/csharp/exprs/Access.qll
+++ b/csharp/ql/lib/semmle/code/csharp/exprs/Access.qll
@@ -112,7 +112,7 @@ class BaseAccess extends Access, @base_access_expr {
class MemberAccess extends Access, QualifiableExpr, @member_access_expr {
override predicate hasImplicitThisQualifier() {
QualifiableExpr.super.hasImplicitThisQualifier() and
- not exists(MemberInitializer mi | mi.getLValue() = this)
+ not exists(MemberInitializer mi | mi.getLeftOperand() = this)
}
override Member getQualifiedDeclaration() { result = this.getTarget() }
diff --git a/csharp/ql/lib/semmle/code/csharp/exprs/Assignment.qll b/csharp/ql/lib/semmle/code/csharp/exprs/Assignment.qll
index 467149011d2c..f65b13bf8ecb 100644
--- a/csharp/ql/lib/semmle/code/csharp/exprs/Assignment.qll
+++ b/csharp/ql/lib/semmle/code/csharp/exprs/Assignment.qll
@@ -20,14 +20,22 @@ class Assignment extends BinaryOperation, @assign_expr {
expr_parent(_, 1, this)
}
- /** Gets the left operand of this assignment. */
- Expr getLValue() { result = this.getLeftOperand() }
+ /**
+ * DEPRECATED: Use `getLeftOperand` instead.
+ *
+ * Gets the left operand of this assignment.
+ */
+ deprecated Expr getLValue() { result = this.getLeftOperand() }
- /** Gets the right operand of this assignment. */
- Expr getRValue() { result = this.getRightOperand() }
+ /**
+ * DEPRECATED: Use `getRightOperand` instead.
+ *
+ * Gets the right operand of this assignment.
+ */
+ deprecated Expr getRValue() { result = this.getRightOperand() }
/** Gets the variable being assigned to, if any. */
- Variable getTargetVariable() { result.getAnAccess() = this.getLValue() }
+ Variable getTargetVariable() { result.getAnAccess() = this.getLeftOperand() }
override string getOperator() { none() }
}
@@ -40,7 +48,12 @@ class LocalVariableDeclAndInitExpr extends LocalVariableDeclExpr, Assignment {
override LocalVariable getTargetVariable() { result = this.getVariable() }
- override LocalVariableAccess getLValue() { result = Assignment.super.getLValue() }
+ /**
+ * DEPRECATED: Use `getLeftOperand` instead.
+ */
+ deprecated override LocalVariableAccess getLValue() { result = this.getLeftOperand() }
+
+ override LocalVariableAccess getLeftOperand() { result = Assignment.super.getLeftOperand() }
override string toString() { result = LocalVariableDeclExpr.super.toString() + " = ..." }
@@ -81,13 +94,17 @@ class AssignOperation extends Assignment, @assign_op_expr {
}
/**
- * A compound assignment operation that implicitly invokes an operator.
- * For example, `x += y` assigns the result of `x + y` to `x`.
+ * A compound assignment operation that invokes an operator.
+ *
+ * (1) `x += y` invokes the compound assignment operator `+=` (if it exists).
+ * (2) `x += y` invokes the operator `+` and assigns `x + y` to `x`.
*
* Either an arithmetic assignment operation (`AssignArithmeticOperation`) or a bitwise
* assignment operation (`AssignBitwiseOperation`).
*/
-class AssignCallOperation extends AssignOperation, OperatorCall, @assign_op_call_expr {
+class AssignCallOperation extends AssignOperation, OperatorCall, QualifiableExpr,
+ @assign_op_call_expr
+{
override string toString() { result = AssignOperation.super.toString() }
}
@@ -223,9 +240,12 @@ deprecated class AssignUnsighedRightShiftExpr = AssignUnsignedRightShiftExpr;
*/
class AddOrRemoveEventExpr extends AssignOperation, @assign_event_expr {
/** Gets the event targeted by this event assignment. */
- Event getTarget() { result = this.getLValue().getTarget() }
+ Event getTarget() { result = this.getLeftOperand().getTarget() }
- override EventAccess getLValue() { result = this.getChild(0) }
+ /**
+ * DEPRECATED: Use `getLeftOperand` instead.
+ */
+ deprecated override EventAccess getLValue() { result = this.getLeftOperand() }
override EventAccess getLeftOperand() { result = this.getChild(0) }
}
diff --git a/csharp/ql/lib/semmle/code/csharp/exprs/Call.qll b/csharp/ql/lib/semmle/code/csharp/exprs/Call.qll
index c3be99deac4c..4b86a4f6cd43 100644
--- a/csharp/ql/lib/semmle/code/csharp/exprs/Call.qll
+++ b/csharp/ql/lib/semmle/code/csharp/exprs/Call.qll
@@ -530,6 +530,19 @@ class ExtensionOperatorCall extends OperatorCall {
ExtensionOperatorCall() { this.getTarget() instanceof ExtensionOperator }
override string getAPrimaryQlClass() { result = "ExtensionOperatorCall" }
+
+ private predicate isOrdinaryStaticCall() {
+ not exists(Expr e | e = this.getChildExpr(-1) | not e instanceof TypeAccess)
+ }
+
+ override Expr getArgument(int i) {
+ exists(int j | result = this.getChildExpr(j) |
+ i >= 0 and
+ if this.isOrdinaryStaticCall() or this.getTarget() instanceof CompoundAssignmentOperator
+ then j = i
+ else j = i - 1
+ )
+ }
}
/**
@@ -558,6 +571,58 @@ class MutatorOperatorCall extends OperatorCall {
predicate isPostfix() { mutator_invocation_mode(this, 2) }
}
+/**
+ * A call to a compound assignment operator, for example `this += other`
+ * on line 7 in
+ *
+ * ```csharp
+ * class A {
+ * public void operator +=(A other) {
+ * ...
+ * }
+ *
+ * public void Add(A other) {
+ * this += other;
+ * }
+ * }
+ * ```
+ */
+class CompoundAssignmentOperatorCall extends AssignCallOperation {
+ CompoundAssignmentOperatorCall() { this.getTarget() instanceof CompoundAssignmentOperator }
+
+ override Expr getArgument(int i) { result = this.getChildExpr(i + 1) and i >= 0 }
+
+ /** Gets the qualifier of this compound assignment operator call. */
+ override Expr getQualifier() { result = this.getChildExpr(0) }
+}
+
+/**
+ * A call to a compound assignment extension operator, for example `s1 *= s2` on
+ * line 9 in
+ *
+ * ```csharp
+ * static class MyExtensions {
+ * extension(string s) {
+ * public void operator *=(string other) { ... }
+ * }
+ * }
+ *
+ * class A {
+ * void M(string s1, string s2) {
+ * s1 *= s2;
+ * }
+ * }
+ */
+class ExtensionCompoundAssignmentOperatorCall extends CompoundAssignmentOperatorCall,
+ ExtensionOperatorCall
+{
+ override Expr getArgument(int i) { result = ExtensionOperatorCall.super.getArgument(i) }
+
+ override Expr getQualifier() { none() }
+
+ override string getAPrimaryQlClass() { result = "ExtensionCompoundAssignmentOperatorCall" }
+}
+
private class DelegateLikeCall_ = @delegate_invocation_expr or @function_pointer_invocation_expr;
/**
@@ -634,7 +699,25 @@ class FunctionPointerCall extends DelegateLikeCall, @function_pointer_invocation
* (`EventCall`).
*/
class AccessorCall extends Call, QualifiableExpr, @call_access_expr {
- override Accessor getTarget() { none() }
+ override Accessor getTarget() { result = this.getReadTarget() or result = this.getWriteTarget() }
+
+ /**
+ * Gets the static (compile-time) target of this call, assuming that this is
+ * an `AssignableRead`.
+ *
+ * Note that left-hand sides of compound assignments are both
+ * `AssignableRead`s and `AssignableWrite`s.
+ */
+ Accessor getReadTarget() { none() }
+
+ /**
+ * Gets the static (compile-time) target of this call, assuming that this is
+ * an `AssignableWrite`.
+ *
+ * Note that left-hand sides of compound assignments are both
+ * `AssignableRead`s and `AssignableWrite`s.
+ */
+ Accessor getWriteTarget() { none() }
override Expr getArgument(int i) { none() }
@@ -656,12 +739,12 @@ class AccessorCall extends Call, QualifiableExpr, @call_access_expr {
* ```
*/
class PropertyCall extends AccessorCall, PropertyAccessExpr {
- override Accessor getTarget() {
- exists(PropertyAccess pa, Property p | pa = this and p = this.getProperty() |
- pa instanceof AssignableRead and result = p.getGetter()
- or
- pa instanceof AssignableWrite and result = p.getSetter()
- )
+ override Accessor getReadTarget() {
+ this instanceof AssignableRead and result = this.getProperty().getGetter()
+ }
+
+ override Accessor getWriteTarget() {
+ this instanceof AssignableWrite and result = this.getProperty().getSetter()
}
override Expr getArgument(int i) {
@@ -691,12 +774,12 @@ class PropertyCall extends AccessorCall, PropertyAccessExpr {
* ```
*/
class IndexerCall extends AccessorCall, IndexerAccessExpr {
- override Accessor getTarget() {
- exists(IndexerAccess ia, Indexer i | ia = this and i = this.getIndexer() |
- ia instanceof AssignableRead and result = i.getGetter()
- or
- ia instanceof AssignableWrite and result = i.getSetter()
- )
+ override Accessor getReadTarget() {
+ this instanceof AssignableRead and result = this.getIndexer().getGetter()
+ }
+
+ override Accessor getWriteTarget() {
+ this instanceof AssignableWrite and result = this.getIndexer().getSetter()
}
override Expr getArgument(int i) {
@@ -771,10 +854,10 @@ class ExtensionPropertyCall extends PropertyCall {
* ```
*/
class EventCall extends AccessorCall, EventAccessExpr {
- override EventAccessor getTarget() {
+ override EventAccessor getWriteTarget() {
exists(Event e, AddOrRemoveEventExpr aoree |
e = this.getEvent() and
- aoree.getLValue() = this
+ aoree.getLeftOperand() = this
|
aoree instanceof AddEventExpr and result = e.getAddEventAccessor()
or
@@ -785,8 +868,8 @@ class EventCall extends AccessorCall, EventAccessExpr {
override Expr getArgument(int i) {
i = 0 and
exists(AddOrRemoveEventExpr aoree |
- aoree.getLValue() = this and
- result = aoree.getRValue()
+ aoree.getLeftOperand() = this and
+ result = aoree.getRightOperand()
)
}
diff --git a/csharp/ql/lib/semmle/code/csharp/exprs/Creation.qll b/csharp/ql/lib/semmle/code/csharp/exprs/Creation.qll
index 0e16e0da9c3c..19ff9fac53b2 100644
--- a/csharp/ql/lib/semmle/code/csharp/exprs/Creation.qll
+++ b/csharp/ql/lib/semmle/code/csharp/exprs/Creation.qll
@@ -95,7 +95,7 @@ class MemberInitializer extends AssignExpr {
MemberInitializer() { this.getParent() instanceof ObjectInitializer }
/** Gets the initialized member. */
- Member getInitializedMember() { result.getAnAccess() = this.getLValue() }
+ Member getInitializedMember() { result.getAnAccess() = this.getLeftOperand() }
override string getAPrimaryQlClass() { result = "MemberInitializer" }
}
diff --git a/csharp/ql/lib/semmle/code/csharp/exprs/Expr.qll b/csharp/ql/lib/semmle/code/csharp/exprs/Expr.qll
index 66764d06479d..a26afb004901 100644
--- a/csharp/ql/lib/semmle/code/csharp/exprs/Expr.qll
+++ b/csharp/ql/lib/semmle/code/csharp/exprs/Expr.qll
@@ -57,6 +57,13 @@ class Expr extends ControlFlowElement, @expr {
/** Gets the value of this expression, if any */
string getValue() { expr_value(this, result) }
+ /** Gets the integer value of this expression, if any. */
+ cached
+ int getIntValue() {
+ result = this.getValue().toInt() and
+ (this.getType() instanceof IntegralType or this.getType() instanceof Enum)
+ }
+
/** Holds if this expression has a value. */
final predicate hasValue() { exists(this.getValue()) }
@@ -1099,7 +1106,7 @@ class QualifiableExpr extends Expr, @qualifiable_expr {
}
private Expr getAnAssignOrForeachChild() {
- result = any(AssignExpr e).getLValue()
+ result = any(AssignExpr e).getLeftOperand()
or
result = any(ForeachStmt fs).getVariableDeclTuple()
or
diff --git a/csharp/ql/lib/semmle/code/csharp/frameworks/Format.qll b/csharp/ql/lib/semmle/code/csharp/frameworks/Format.qll
index b00459c64b0e..d191f62aa920 100644
--- a/csharp/ql/lib/semmle/code/csharp/frameworks/Format.qll
+++ b/csharp/ql/lib/semmle/code/csharp/frameworks/Format.qll
@@ -126,7 +126,7 @@ private class SystemDiagnosticsFormatMethods extends FormatMethodImpl {
pragma[nomagic]
private predicate parameterReadPostDominatesEntry(ParameterRead pr) {
- pr.getAControlFlowNode().postDominates(pr.getEnclosingCallable().getEntryPoint()) and
+ pr.getControlFlowNode().postDominates(pr.getEnclosingCallable().getEntryPoint()) and
getParameterType(pr.getTarget()) instanceof ObjectType
}
diff --git a/csharp/ql/lib/semmle/code/csharp/frameworks/Moq.qll b/csharp/ql/lib/semmle/code/csharp/frameworks/Moq.qll
index 9ab9a026fd29..0beec9a84b28 100644
--- a/csharp/ql/lib/semmle/code/csharp/frameworks/Moq.qll
+++ b/csharp/ql/lib/semmle/code/csharp/frameworks/Moq.qll
@@ -41,6 +41,6 @@ class ReturnedByMockObject extends ObjectCreation {
* Gets a value used to initialize a member of this object creation.
*/
Expr getAMemberInitializationValue() {
- result = this.getInitializer().(ObjectInitializer).getAMemberInitializer().getRValue()
+ result = this.getInitializer().(ObjectInitializer).getAMemberInitializer().getRightOperand()
}
}
diff --git a/csharp/ql/lib/semmle/code/csharp/frameworks/Sql.qll b/csharp/ql/lib/semmle/code/csharp/frameworks/Sql.qll
index 6b1eb7b67fb7..58d6d68bf0ea 100644
--- a/csharp/ql/lib/semmle/code/csharp/frameworks/Sql.qll
+++ b/csharp/ql/lib/semmle/code/csharp/frameworks/Sql.qll
@@ -17,14 +17,14 @@ abstract class SqlExpr extends Expr {
class CommandTextAssignmentSqlExpr extends SqlExpr, AssignExpr {
CommandTextAssignmentSqlExpr() {
exists(Property p, SystemDataIDbCommandInterface i, Property text |
- p = this.getLValue().(PropertyAccess).getTarget() and
+ p = this.getLeftOperand().(PropertyAccess).getTarget() and
text = i.getCommandTextProperty()
|
p.overridesOrImplementsOrEquals(text)
)
}
- override Expr getSql() { result = this.getRValue() }
+ override Expr getSql() { result = this.getRightOperand() }
}
/** A construction of an unknown `IDbCommand` object. */
diff --git a/csharp/ql/lib/semmle/code/csharp/frameworks/system/runtime/CompilerServices.qll b/csharp/ql/lib/semmle/code/csharp/frameworks/system/runtime/CompilerServices.qll
index 2c0ba292b9c5..aca2cb2cb1c3 100644
--- a/csharp/ql/lib/semmle/code/csharp/frameworks/system/runtime/CompilerServices.qll
+++ b/csharp/ql/lib/semmle/code/csharp/frameworks/system/runtime/CompilerServices.qll
@@ -81,7 +81,7 @@ class SystemRuntimeCompilerServicesInlineArrayAttribute extends Attribute {
/**
* Gets the length of the inline array.
*/
- int getLength() { result = this.getConstructorArgument(0).getValue().toInt() }
+ int getLength() { result = this.getConstructorArgument(0).getIntValue() }
}
/** An attribute of type `System.Runtime.CompilerServices.OverloadResolutionPriority`. */
@@ -94,5 +94,5 @@ class SystemRuntimeCompilerServicesOverloadResolutionPriorityAttribute extends A
/**
* Gets the priority number.
*/
- int getPriority() { result = this.getConstructorArgument(0).getValue().toInt() }
+ int getPriority() { result = this.getConstructorArgument(0).getIntValue() }
}
diff --git a/csharp/ql/lib/semmle/code/csharp/security/auth/SecureCookies.qll b/csharp/ql/lib/semmle/code/csharp/security/auth/SecureCookies.qll
index 56b6294949b8..e7cb6d8e3081 100644
--- a/csharp/ql/lib/semmle/code/csharp/security/auth/SecureCookies.qll
+++ b/csharp/ql/lib/semmle/code/csharp/security/auth/SecureCookies.qll
@@ -100,20 +100,20 @@ Expr getAValueForCookiePolicyProp(string prop) {
Expr getAValueForProp(ObjectCreation create, Assignment a, string prop) {
// values set in object init
exists(MemberInitializer init, Expr src, PropertyAccess pa |
- a.getLValue() = pa and
+ a.getLeftOperand() = pa and
pa.getTarget().hasName(prop) and
init = create.getInitializer().(ObjectInitializer).getAMemberInitializer() and
- init.getLValue() = pa and
- DataFlow::localExprFlow(src, init.getRValue()) and
+ init.getLeftOperand() = pa and
+ DataFlow::localExprFlow(src, init.getRightOperand()) and
result = src
)
or
// values set on var that create is assigned to
exists(Expr src, PropertyAccess pa |
- a.getLValue() = pa and
+ a.getLeftOperand() = pa and
pa.getTarget().hasName(prop) and
DataFlow::localExprFlow(create, pa.getQualifier()) and
- DataFlow::localExprFlow(src, a.getRValue()) and
+ DataFlow::localExprFlow(src, a.getRightOperand()) and
result = src
)
}
@@ -138,15 +138,15 @@ private module OnAppendCookieTrackingConfig impl
exists(PropertyWrite pw, Assignment delegateAssign, Callable c |
pw.getProperty().getName() = "OnAppendCookie" and
pw.getProperty().getDeclaringType() instanceof MicrosoftAspNetCoreBuilderCookiePolicyOptions and
- delegateAssign.getLValue() = pw and
+ delegateAssign.getLeftOperand() = pw and
(
exists(LambdaExpr lambda |
- delegateAssign.getRValue() = lambda and
+ delegateAssign.getRightOperand() = lambda and
lambda = c
)
or
exists(DelegateCreation delegate |
- delegateAssign.getRValue() = delegate and
+ delegateAssign.getRightOperand() = delegate and
delegate.getArgument().(CallableAccess).getTarget() = c
)
) and
@@ -159,9 +159,9 @@ private module OnAppendCookieTrackingConfig impl
exists(PropertyWrite pw, Assignment a |
pw.getProperty().getDeclaringType() instanceof MicrosoftAspNetCoreHttpCookieOptions and
pw.getProperty().getName() = getPropertyName() and
- a.getLValue() = pw and
+ a.getLeftOperand() = pw and
exists(Expr val |
- DataFlow::localExprFlow(val, a.getRValue()) and
+ DataFlow::localExprFlow(val, a.getRightOperand()) and
val.getValue() = "true"
) and
sink.asExpr() = pw.getQualifier()
diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/ConditionalBypassQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/ConditionalBypassQuery.qll
index 53b44f873a64..a9ad31dc804c 100644
--- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/ConditionalBypassQuery.qll
+++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/ConditionalBypassQuery.qll
@@ -5,7 +5,6 @@
import csharp
private import semmle.code.csharp.controlflow.Guards
-private import semmle.code.csharp.controlflow.BasicBlocks
private import semmle.code.csharp.security.dataflow.flowsinks.FlowSinks
private import semmle.code.csharp.security.dataflow.flowsources.FlowSources
private import semmle.code.csharp.frameworks.System
diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/UnsafeDeserializationQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/UnsafeDeserializationQuery.qll
index 5b2bd407a5ce..3c8911ef8074 100644
--- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/UnsafeDeserializationQuery.qll
+++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/UnsafeDeserializationQuery.qll
@@ -126,16 +126,16 @@ private module TypeNameTrackingConfig implements DataFlow::ConfigSig {
or
node1.getType() instanceof TypeNameHandlingEnum and
exists(PropertyWrite pw, Property p, Assignment a |
- a.getLValue() = pw and
+ a.getLeftOperand() = pw and
pw.getProperty() = p and
p.getDeclaringType() instanceof JsonSerializerSettingsClass and
p.hasName("TypeNameHandling") and
(
- node1.asExpr() = a.getRValue() and
+ node1.asExpr() = a.getRightOperand() and
node2.asExpr() = pw.getQualifier()
or
exists(ObjectInitializer oi |
- node1.asExpr() = oi.getAMemberInitializer().getRValue() and
+ node1.asExpr() = oi.getAMemberInitializer().getRightOperand() and
node2.asExpr() = oi
)
)
diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/Remote.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/Remote.qll
index 2906fde4e1de..aa8c8536556e 100644
--- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/Remote.qll
+++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/Remote.qll
@@ -3,6 +3,7 @@
*/
import csharp
+private import semmle.code.csharp.commons.Collections
private import semmle.code.csharp.frameworks.system.Net
private import semmle.code.csharp.frameworks.system.Web
private import semmle.code.csharp.frameworks.system.web.Http
@@ -104,7 +105,7 @@ class WcfRemoteFlowSource extends RemoteFlowSource, DataFlow::ParameterNode {
}
/** A data flow source of remote user input (ASP.NET web service). */
-class AspNetServiceRemoteFlowSource extends RemoteFlowSource, DataFlow::ParameterNode {
+class AspNetServiceRemoteFlowSource extends AspNetRemoteFlowSource, DataFlow::ParameterNode {
AspNetServiceRemoteFlowSource() {
exists(Method m |
m.getAParameter() = this.getParameter() and
@@ -115,8 +116,50 @@ class AspNetServiceRemoteFlowSource extends RemoteFlowSource, DataFlow::Paramete
override string getSourceType() { result = "ASP.NET web service input" }
}
+private class CandidateMemberToTaint extends Member {
+ CandidateMemberToTaint() {
+ this.isPublic() and
+ not this.isStatic() and
+ (
+ this =
+ any(Property p |
+ p.isAutoImplemented() and
+ p.getGetter().isPublic() and
+ p.getSetter().isPublic()
+ )
+ or
+ this = any(Field f | f.isPublic())
+ )
+ }
+}
+
+/**
+ * Taint members (transitively) on types used in
+ * 1. Action method parameters.
+ * 2. WebMethod parameters.
+ *
+ * Note that this also impacts uses of such types in other contexts.
+ */
+private class AspNetRemoteFlowSourceMember extends TaintTracking::TaintedMember,
+ CandidateMemberToTaint
+{
+ AspNetRemoteFlowSourceMember() {
+ exists(Type t, Type t0 | t = this.getDeclaringType() |
+ (t = t0 or t = t0.(CollectionType).getElementType()) and
+ (
+ t0 = any(AspNetRemoteFlowSourceMember m).getType()
+ or
+ t0 = any(ActionMethodParameter p).getType()
+ or
+ t0 = any(AspNetServiceRemoteFlowSource source).getType()
+ )
+ )
+ }
+}
+
/** A data flow source of remote user input (ASP.NET request message). */
-class SystemNetHttpRequestMessageRemoteFlowSource extends RemoteFlowSource, DataFlow::ExprNode {
+class SystemNetHttpRequestMessageRemoteFlowSource extends AspNetRemoteFlowSource, DataFlow::ExprNode
+{
SystemNetHttpRequestMessageRemoteFlowSource() {
this.getType() instanceof SystemWebHttpRequestMessageClass
}
@@ -166,7 +209,7 @@ class MicrosoftOwinRequestRemoteFlowSource extends RemoteFlowSource, DataFlow::E
}
/** A parameter to an Mvc controller action method, viewed as a source of remote user input. */
-class ActionMethodParameter extends RemoteFlowSource, DataFlow::ParameterNode {
+class ActionMethodParameter extends AspNetRemoteFlowSource, DataFlow::ParameterNode {
ActionMethodParameter() {
exists(Parameter p |
p = this.getParameter() and
@@ -218,14 +261,18 @@ class AspNetCoreRoutingMethodParameter extends AspNetCoreRemoteFlowSource, DataF
* Flow is defined from any ASP.NET Core remote source object to any of its member
* properties.
*/
-private class AspNetCoreRemoteFlowSourceMember extends TaintTracking::TaintedMember, Property {
+private class AspNetCoreRemoteFlowSourceMember extends TaintTracking::TaintedMember,
+ CandidateMemberToTaint
+{
AspNetCoreRemoteFlowSourceMember() {
- this.getDeclaringType() = any(AspNetCoreRemoteFlowSource source).getType() and
- this.isPublic() and
- not this.isStatic() and
- this.isAutoImplemented() and
- this.getGetter().isPublic() and
- this.getSetter().isPublic()
+ exists(Type t, Type t0 | t = this.getDeclaringType() |
+ (t = t0 or t = t0.(CollectionType).getElementType()) and
+ (
+ t0 = any(AspNetCoreRemoteFlowSourceMember m).getType()
+ or
+ t0 = any(AspNetCoreRemoteFlowSource m).getType()
+ )
+ )
}
}
diff --git a/csharp/ql/lib/semmle/code/csharp/security/xml/InsecureXMLQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/xml/InsecureXMLQuery.qll
index 1abeaf797b00..765dc2adf54a 100644
--- a/csharp/ql/lib/semmle/code/csharp/security/xml/InsecureXMLQuery.qll
+++ b/csharp/ql/lib/semmle/code/csharp/security/xml/InsecureXMLQuery.qll
@@ -84,15 +84,15 @@ private Expr getAValueForProp(ObjectCreation create, string prop) {
// values set in object init
exists(MemberInitializer init |
init = create.getInitializer().(ObjectInitializer).getAMemberInitializer() and
- init.getLValue().(PropertyAccess).getTarget().hasName(prop) and
- result = init.getRValue()
+ init.getLeftOperand().(PropertyAccess).getTarget().hasName(prop) and
+ result = init.getRightOperand()
)
or
// values set on var that create is assigned to
exists(Assignment propAssign |
- DataFlow::localExprFlow(create, propAssign.getLValue().(PropertyAccess).getQualifier()) and
- propAssign.getLValue().(PropertyAccess).getTarget().hasName(prop) and
- result = propAssign.getRValue()
+ DataFlow::localExprFlow(create, propAssign.getLeftOperand().(PropertyAccess).getQualifier()) and
+ propAssign.getLeftOperand().(PropertyAccess).getTarget().hasName(prop) and
+ result = propAssign.getRightOperand()
)
}
diff --git a/csharp/ql/lib/semmlecode.csharp.dbscheme b/csharp/ql/lib/semmlecode.csharp.dbscheme
index 19b8cc3e2dc7..3cabc77473cb 100644
--- a/csharp/ql/lib/semmlecode.csharp.dbscheme
+++ b/csharp/ql/lib/semmlecode.csharp.dbscheme
@@ -1338,7 +1338,8 @@ dynamic_member_name(
@qualifiable_expr = @member_access_expr
| @method_invocation_expr
- | @element_access_expr;
+ | @element_access_expr
+ | @assign_op_call_expr;
conditional_access(
unique int id: @qualifiable_expr ref);
@@ -1362,7 +1363,7 @@ compiler_generated(unique int id: @element ref);
/** CONTROL/DATA FLOW **/
-@control_flow_element = @stmt | @expr;
+@control_flow_element = @stmt | @expr | @parameter;
/* XML Files */
diff --git a/csharp/ql/lib/upgrades/19b8cc3e2dc768d4cbc03d6e3773b709bbebd036/old.dbscheme b/csharp/ql/lib/upgrades/19b8cc3e2dc768d4cbc03d6e3773b709bbebd036/old.dbscheme
new file mode 100644
index 000000000000..19b8cc3e2dc7
--- /dev/null
+++ b/csharp/ql/lib/upgrades/19b8cc3e2dc768d4cbc03d6e3773b709bbebd036/old.dbscheme
@@ -0,0 +1,1504 @@
+/* This is a dummy line to alter the dbscheme, so we can make a database upgrade
+ * without actually changing any of the dbscheme predicates. It contains a date
+ * to allow for such updates in the future as well.
+ *
+ * 2021-07-14
+ *
+ * DO NOT remove this comment carelessly, since it can revert the dbscheme back to a
+ * previously seen state (matching a previously seen SHA), which would make the upgrade
+ * mechanism not work properly.
+ */
+
+/**
+ * An invocation of the compiler. Note that more than one file may be
+ * compiled per invocation. For example, this command compiles three
+ * source files:
+ *
+ * csc f1.cs f2.cs f3.cs
+ *
+ * The `id` simply identifies the invocation, while `cwd` is the working
+ * directory from which the compiler was invoked.
+ */
+compilations(
+ unique int id : @compilation,
+ string cwd : string ref
+);
+
+compilation_info(
+ int id : @compilation ref,
+ string info_key: string ref,
+ string info_value: string ref
+)
+
+/**
+ * The arguments that were passed to the extractor for a compiler
+ * invocation. If `id` is for the compiler invocation
+ *
+ * csc f1.cs f2.cs f3.cs
+ *
+ * then typically there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0 | --compiler
+ * 1 | *path to compiler*
+ * 2 | f1.cs
+ * 3 | f2.cs
+ * 4 | f3.cs
+ */
+#keyset[id, num]
+compilation_args(
+ int id : @compilation ref,
+ int num : int ref,
+ string arg : string ref
+);
+
+/**
+ * The expanded arguments that were passed to the extractor for a
+ * compiler invocation. This is similar to `compilation_args`, but
+ * for a `@someFile.rsp` argument, it includes the arguments from that
+ * file, rather than just taking the argument literally.
+ */
+#keyset[id, num]
+compilation_expanded_args(
+ int id : @compilation ref,
+ int num : int ref,
+ string arg : string ref
+);
+
+/**
+ * The source files that are compiled by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ * csc f1.cs f2.cs f3.cs
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0 | f1.cs
+ * 1 | f2.cs
+ * 2 | f3.cs
+ */
+#keyset[id, num]
+compilation_compiling_files(
+ int id : @compilation ref,
+ int num : int ref,
+ int file : @file ref
+);
+
+/**
+ * The references used by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ * csc f1.cs f2.cs f3.cs /r:ref1.dll /r:ref2.dll /r:ref3.dll
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0 | ref1.dll
+ * 1 | ref2.dll
+ * 2 | ref3.dll
+ */
+#keyset[id, num]
+compilation_referencing_files(
+ int id : @compilation ref,
+ int num : int ref,
+ int file : @file ref
+);
+
+/**
+ * The time taken by the extractor for a compiler invocation.
+ *
+ * For each file `num`, there will be rows for
+ *
+ * kind | seconds
+ * ---- | ---
+ * 1 | CPU seconds used by the extractor frontend
+ * 2 | Elapsed seconds during the extractor frontend
+ * 3 | CPU seconds used by the extractor backend
+ * 4 | Elapsed seconds during the extractor backend
+ */
+#keyset[id, num, kind]
+compilation_time(
+ int id : @compilation ref,
+ int num : int ref,
+ /* kind:
+ 1 = frontend_cpu_seconds
+ 2 = frontend_elapsed_seconds
+ 3 = extractor_cpu_seconds
+ 4 = extractor_elapsed_seconds
+ */
+ int kind : int ref,
+ float seconds : float ref
+);
+
+/**
+ * An error or warning generated by the extractor.
+ * The diagnostic message `diagnostic` was generated during compiler
+ * invocation `compilation`, and is the `file_number_diagnostic_number`th
+ * message generated while extracting the `file_number`th file of that
+ * invocation.
+ */
+#keyset[compilation, file_number, file_number_diagnostic_number]
+diagnostic_for(
+ unique int diagnostic : @diagnostic ref,
+ int compilation : @compilation ref,
+ int file_number : int ref,
+ int file_number_diagnostic_number : int ref
+);
+
+diagnostics(
+ unique int id: @diagnostic,
+ int severity: int ref,
+ string error_tag: string ref,
+ string error_message: string ref,
+ string full_error_message: string ref,
+ int location: @location ref
+);
+
+extractor_messages(
+ unique int id: @extractor_message,
+ int severity: int ref,
+ string origin : string ref,
+ string text : string ref,
+ string entity : string ref,
+ int location: @location ref,
+ string stack_trace : string ref
+);
+
+/**
+ * If extraction was successful, then `cpu_seconds` and
+ * `elapsed_seconds` are the CPU time and elapsed time (respectively)
+ * that extraction took for compiler invocation `id`.
+ */
+compilation_finished(
+ unique int id : @compilation ref,
+ float cpu_seconds : float ref,
+ float elapsed_seconds : float ref
+);
+
+compilation_assembly(
+ unique int id : @compilation ref,
+ int assembly: @assembly ref
+)
+
+// Populated by the CSV extractor
+externalData(
+ int id: @externalDataElement,
+ string path: string ref,
+ int column: int ref,
+ string value: string ref);
+
+sourceLocationPrefix(
+ string prefix: string ref);
+
+/*
+ * Overlay support
+ */
+
+/**
+ * The CLI will automatically emit the tuple `databaseMetadata("isOverlay", "true")`,
+ * along with an `overlayChangedFiles` tuple for each new/modified/deleted file,
+ * when building an overlay database, and these can be used by the discard predicates.
+ */
+databaseMetadata(
+ string metadataKey : string ref,
+ string value : string ref
+);
+
+overlayChangedFiles(
+ string path : string ref
+);
+
+/*
+ * C# dbscheme
+ */
+
+/** ELEMENTS **/
+
+@element = @declaration | @stmt | @expr | @modifier | @attribute | @namespace_declaration
+ | @using_directive | @type_parameter_constraints | @externalDataElement
+ | @xmllocatable | @asp_element | @namespace | @preprocessor_directive;
+
+@declaration = @callable | @generic | @assignable | @namespace;
+
+@named_element = @namespace | @declaration;
+
+@declaration_with_accessors = @property | @indexer | @event;
+
+@assignable = @variable | @assignable_with_accessors | @event;
+
+@assignable_with_accessors = @property | @indexer;
+
+@attributable = @assembly | @field | @parameter | @operator | @method | @constructor
+ | @destructor | @callable_accessor | @value_or_ref_type | @declaration_with_accessors
+ | @local_function | @lambda_expr;
+
+/** LOCATIONS, ASEMMBLIES, MODULES, FILES and FOLDERS **/
+
+@location = @location_default | @assembly;
+
+@locatable = @declaration_with_accessors | @callable_accessor | @declaration_or_directive
+ | @diagnostic | @extractor_message | @preprocessor_directive | @attribute | @type_mention | @type_parameter_constraints
+ | @declaration_with_accessors | @callable_accessor | @operator | @method
+ | @constructor | @destructor | @field | @local_variable | @parameter | @stmt | @expr
+ | @xmllocatable | @commentline | @commentblock | @asp_element
+
+locations_default(
+ unique int id: @location_default,
+ int file: @file ref,
+ int beginLine: int ref,
+ int beginColumn: int ref,
+ int endLine: int ref,
+ int endColumn: int ref);
+
+locations_mapped(
+ unique int id: @location_default ref,
+ int mapped_to: @location_default ref);
+
+@sourceline = @file | @callable | @xmllocatable;
+
+numlines(
+ int element_id: @sourceline ref,
+ int num_lines: int ref,
+ int num_code: int ref,
+ int num_comment: int ref);
+
+assemblies(
+ unique int id: @assembly,
+ int file: @file ref,
+ string fullname: string ref,
+ string name: string ref,
+ string version: string ref);
+
+files(
+ unique int id: @file,
+ string name: string ref);
+
+folders(
+ unique int id: @folder,
+ string name: string ref);
+
+@container = @folder | @file ;
+
+containerparent(
+ int parent: @container ref,
+ unique int child: @container ref);
+
+file_extraction_mode(
+ unique int file: @file ref,
+ int mode: int ref
+ /* 0 = normal, 1 = standalone extractor */
+ );
+
+/** NAMESPACES **/
+
+@type_container = @namespace | @type;
+
+namespaces(
+ unique int id: @namespace,
+ string name: string ref);
+
+namespace_declarations(
+ unique int id: @namespace_declaration,
+ int namespace_id: @namespace ref);
+
+namespace_declaration_location(
+ unique int id: @namespace_declaration ref,
+ int loc: @location ref);
+
+parent_namespace(
+ unique int child_id: @type_container ref,
+ int namespace_id: @namespace ref);
+
+@declaration_or_directive = @namespace_declaration | @type | @using_directive;
+
+parent_namespace_declaration(
+ int child_id: @declaration_or_directive ref, // cannot be unique because of partial classes
+ int namespace_id: @namespace_declaration ref);
+
+@using_directive = @using_namespace_directive | @using_static_directive;
+
+using_global(
+ unique int id: @using_directive ref
+);
+
+using_namespace_directives(
+ unique int id: @using_namespace_directive,
+ int namespace_id: @namespace ref);
+
+using_static_directives(
+ unique int id: @using_static_directive,
+ int type_id: @type_or_ref ref);
+
+using_directive_location(
+ unique int id: @using_directive ref,
+ int loc: @location ref);
+
+@preprocessor_directive = @pragma_warning | @pragma_checksum | @directive_define | @directive_undefine | @directive_warning
+ | @directive_error | @directive_nullable | @directive_line | @directive_region | @directive_endregion | @directive_if
+ | @directive_elif | @directive_else | @directive_endif;
+
+@conditional_directive = @directive_if | @directive_elif;
+@branch_directive = @directive_if | @directive_elif | @directive_else;
+
+directive_ifs(
+ unique int id: @directive_if,
+ int branchTaken: int ref, /* 0: false, 1: true */
+ int conditionValue: int ref); /* 0: false, 1: true */
+
+directive_elifs(
+ unique int id: @directive_elif,
+ int branchTaken: int ref, /* 0: false, 1: true */
+ int conditionValue: int ref, /* 0: false, 1: true */
+ int parent: @directive_if ref,
+ int index: int ref);
+
+directive_elses(
+ unique int id: @directive_else,
+ int branchTaken: int ref, /* 0: false, 1: true */
+ int parent: @directive_if ref,
+ int index: int ref);
+
+#keyset[id, start]
+directive_endifs(
+ unique int id: @directive_endif,
+ unique int start: @directive_if ref);
+
+directive_define_symbols(
+ unique int id: @define_symbol_expr ref,
+ string name: string ref);
+
+directive_regions(
+ unique int id: @directive_region,
+ string name: string ref);
+
+#keyset[id, start]
+directive_endregions(
+ unique int id: @directive_endregion,
+ unique int start: @directive_region ref);
+
+directive_lines(
+ unique int id: @directive_line,
+ int kind: int ref); /* 0: default, 1: hidden, 2: numeric, 3: span */
+
+directive_line_value(
+ unique int id: @directive_line ref,
+ int line: int ref);
+
+directive_line_file(
+ unique int id: @directive_line ref,
+ int file: @file ref);
+
+directive_line_offset(
+ unique int id: @directive_line ref,
+ int offset: int ref);
+
+directive_line_span(
+ unique int id: @directive_line ref,
+ int startLine: int ref,
+ int startColumn: int ref,
+ int endLine: int ref,
+ int endColumn: int ref);
+
+directive_nullables(
+ unique int id: @directive_nullable,
+ int setting: int ref, /* 0: disable, 1: enable, 2: restore */
+ int target: int ref); /* 0: none, 1: annotations, 2: warnings */
+
+directive_warnings(
+ unique int id: @directive_warning,
+ string message: string ref);
+
+directive_errors(
+ unique int id: @directive_error,
+ string message: string ref);
+
+directive_undefines(
+ unique int id: @directive_undefine,
+ string name: string ref);
+
+directive_defines(
+ unique int id: @directive_define,
+ string name: string ref);
+
+pragma_checksums(
+ unique int id: @pragma_checksum,
+ int file: @file ref,
+ string guid: string ref,
+ string bytes: string ref);
+
+pragma_warnings(
+ unique int id: @pragma_warning,
+ int kind: int ref /* 0 = disable, 1 = restore */);
+
+#keyset[id, index]
+pragma_warning_error_codes(
+ int id: @pragma_warning ref,
+ string errorCode: string ref,
+ int index: int ref);
+
+preprocessor_directive_location(
+ unique int id: @preprocessor_directive ref,
+ int loc: @location ref);
+
+preprocessor_directive_compilation(
+ int id: @preprocessor_directive ref,
+ int compilation: @compilation ref);
+
+preprocessor_directive_active(
+ unique int id: @preprocessor_directive ref,
+ int active: int ref); /* 0: false, 1: true */
+
+/** TYPES **/
+
+types(
+ unique int id: @type,
+ int kind: int ref,
+ string name: string ref);
+
+case @type.kind of
+ 1 = @bool_type
+| 2 = @char_type
+| 3 = @decimal_type
+| 4 = @sbyte_type
+| 5 = @short_type
+| 6 = @int_type
+| 7 = @long_type
+| 8 = @byte_type
+| 9 = @ushort_type
+| 10 = @uint_type
+| 11 = @ulong_type
+| 12 = @float_type
+| 13 = @double_type
+| 14 = @enum_type
+| 15 = @struct_type
+| 17 = @class_type
+| 19 = @interface_type
+| 20 = @delegate_type
+| 21 = @null_type
+| 22 = @type_parameter
+| 23 = @pointer_type
+| 24 = @nullable_type
+| 25 = @array_type
+| 26 = @void_type
+| 27 = @int_ptr_type
+| 28 = @uint_ptr_type
+| 29 = @dynamic_type
+| 30 = @arglist_type
+| 31 = @unknown_type
+| 32 = @tuple_type
+| 33 = @function_pointer_type
+| 34 = @inline_array_type
+| 35 = @extension_type
+ ;
+
+@simple_type = @bool_type | @char_type | @integral_type | @floating_point_type | @decimal_type;
+@integral_type = @signed_integral_type | @unsigned_integral_type;
+@signed_integral_type = @sbyte_type | @short_type | @int_type | @long_type;
+@unsigned_integral_type = @byte_type | @ushort_type | @uint_type | @ulong_type;
+@floating_point_type = @float_type | @double_type;
+@value_type = @simple_type | @enum_type | @struct_type | @nullable_type | @int_ptr_type
+ | @uint_ptr_type | @tuple_type | @void_type | @inline_array_type;
+@ref_type = @class_type | @interface_type | @array_type | @delegate_type | @null_type
+ | @dynamic_type | @extension_type;
+@value_or_ref_type = @value_type | @ref_type;
+
+typerefs(
+ unique int id: @typeref,
+ string name: string ref);
+
+typeref_type(
+ int id: @typeref ref,
+ unique int typeId: @type ref);
+
+@type_or_ref = @type | @typeref;
+
+array_element_type(
+ unique int array: @array_type ref,
+ int dimension: int ref,
+ int rank: int ref,
+ int element: @type_or_ref ref);
+
+nullable_underlying_type(
+ unique int nullable: @nullable_type ref,
+ int underlying: @type_or_ref ref);
+
+pointer_referent_type(
+ unique int pointer: @pointer_type ref,
+ int referent: @type_or_ref ref);
+
+enum_underlying_type(
+ unique int enum_id: @enum_type ref,
+ int underlying_type_id: @type_or_ref ref);
+
+delegate_return_type(
+ unique int delegate_id: @delegate_type ref,
+ int return_type_id: @type_or_ref ref);
+
+function_pointer_return_type(
+ unique int function_pointer_id: @function_pointer_type ref,
+ int return_type_id: @type_or_ref ref);
+
+extension_receiver_type(
+ unique int extension: @extension_type ref,
+ int receiver_type_id: @type_or_ref ref);
+
+extend(
+ int sub: @type ref,
+ int super: @type_or_ref ref);
+
+anonymous_types(
+ unique int id: @type ref);
+
+@interface_or_ref = @interface_type | @typeref;
+
+implement(
+ int sub: @type ref,
+ int super: @type_or_ref ref);
+
+type_location(
+ int id: @type ref,
+ int loc: @location ref);
+
+tuple_underlying_type(
+ unique int tuple: @tuple_type ref,
+ int struct: @type_or_ref ref);
+
+#keyset[tuple, index]
+tuple_element(
+ int tuple: @tuple_type ref,
+ int index: int ref,
+ unique int field: @field ref);
+
+attributes(
+ unique int id: @attribute,
+ int kind: int ref,
+ int type_id: @type_or_ref ref,
+ int target: @attributable ref);
+
+case @attribute.kind of
+ 0 = @attribute_default
+| 1 = @attribute_return
+| 2 = @attribute_assembly
+| 3 = @attribute_module
+;
+
+attribute_location(
+ int id: @attribute ref,
+ int loc: @location ref);
+
+@type_mention_parent = @element | @type_mention;
+
+type_mention(
+ unique int id: @type_mention,
+ int type_id: @type_or_ref ref,
+ int parent: @type_mention_parent ref);
+
+type_mention_location(
+ unique int id: @type_mention ref,
+ int loc: @location ref);
+
+@has_type_annotation = @assignable | @type_parameter | @callable | @expr | @delegate_type | @generic | @function_pointer_type;
+
+/**
+ * A direct annotation on an entity, for example `string? x;`.
+ *
+ * Annotations:
+ * 2 = reftype is not annotated "!"
+ * 3 = reftype is annotated "?"
+ * 4 = readonly ref type / in parameter
+ * 5 = ref type parameter, return or local variable
+ * 6 = out parameter
+ *
+ * Note that the annotation depends on the element it annotates.
+ * @assignable: The annotation is on the type of the assignable, for example the variable type.
+ * @type_parameter: The annotation is on the reftype constraint
+ * @callable: The annotation is on the return type
+ * @array_type: The annotation is on the element type
+ */
+type_annotation(int id: @has_type_annotation ref, int annotation: int ref);
+
+nullability(unique int nullability: @nullability, int kind: int ref);
+
+case @nullability.kind of
+ 0 = @oblivious
+| 1 = @not_annotated
+| 2 = @annotated
+;
+
+#keyset[parent, index]
+nullability_parent(int nullability: @nullability ref, int index: int ref, int parent: @nullability ref)
+
+type_nullability(int id: @has_type_annotation ref, int nullability: @nullability ref);
+
+/**
+ * The nullable flow state of an expression, as determined by Roslyn.
+ * 0 = none (default, not populated)
+ * 1 = not null
+ * 2 = maybe null
+ */
+expr_flowstate(unique int id: @expr ref, int state: int ref);
+
+/** GENERICS **/
+
+@generic = @type | @method | @local_function;
+
+type_parameters(
+ unique int id: @type_parameter ref,
+ int index: int ref,
+ int generic_id: @generic ref,
+ int variance: int ref /* none = 0, out = 1, in = 2 */);
+
+#keyset[constructed_id, index]
+type_arguments(
+ int id: @type_or_ref ref,
+ int index: int ref,
+ int constructed_id: @generic_or_ref ref);
+
+@generic_or_ref = @generic | @typeref;
+
+constructed_generic(
+ unique int constructed: @generic ref,
+ int generic: @generic_or_ref ref);
+
+type_parameter_constraints(
+ unique int id: @type_parameter_constraints,
+ int param_id: @type_parameter ref);
+
+type_parameter_constraints_location(
+ int id: @type_parameter_constraints ref,
+ int loc: @location ref);
+
+general_type_parameter_constraints(
+ int id: @type_parameter_constraints ref,
+ int kind: int ref /* class = 1, struct = 2, new = 3 */);
+
+specific_type_parameter_constraints(
+ int id: @type_parameter_constraints ref,
+ int base_id: @type_or_ref ref);
+
+specific_type_parameter_nullability(
+ int id: @type_parameter_constraints ref,
+ int base_id: @type_or_ref ref,
+ int nullability: @nullability ref);
+
+/** FUNCTION POINTERS */
+
+function_pointer_calling_conventions(
+ int id: @function_pointer_type ref,
+ int kind: int ref);
+
+#keyset[id, index]
+has_unmanaged_calling_conventions(
+ int id: @function_pointer_type ref,
+ int index: int ref,
+ int conv_id: @type_or_ref ref);
+
+/** MODIFIERS */
+
+@modifiable = @modifiable_direct | @event_accessor;
+
+@modifiable_direct = @member | @accessor | @local_function | @anonymous_function_expr;
+
+modifiers(
+ unique int id: @modifier,
+ string name: string ref);
+
+has_modifiers(
+ int id: @modifiable_direct ref,
+ int mod_id: @modifier ref);
+
+/** MEMBERS **/
+
+@member = @method | @constructor | @destructor | @field | @property | @event | @operator | @indexer | @type;
+
+@named_exprorstmt = @goto_stmt | @labeled_stmt | @expr;
+
+@virtualizable = @method | @property | @indexer | @event | @operator;
+
+exprorstmt_name(
+ unique int parent_id: @named_exprorstmt ref,
+ string name: string ref);
+
+nested_types(
+ unique int id: @type ref,
+ int declaring_type_id: @type ref,
+ int unbound_id: @type ref);
+
+properties(
+ unique int id: @property,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @property ref);
+
+property_location(
+ int id: @property ref,
+ int loc: @location ref);
+
+indexers(
+ unique int id: @indexer,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @indexer ref);
+
+indexer_location(
+ int id: @indexer ref,
+ int loc: @location ref);
+
+accessors(
+ unique int id: @accessor,
+ int kind: int ref,
+ string name: string ref,
+ int declaring_member_id: @member ref,
+ int unbound_id: @accessor ref);
+
+case @accessor.kind of
+ 1 = @getter
+| 2 = @setter
+ ;
+
+init_only_accessors(
+ unique int id: @accessor ref);
+
+accessor_location(
+ int id: @accessor ref,
+ int loc: @location ref);
+
+events(
+ unique int id: @event,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @event ref);
+
+event_location(
+ int id: @event ref,
+ int loc: @location ref);
+
+event_accessors(
+ unique int id: @event_accessor,
+ int kind: int ref,
+ string name: string ref,
+ int declaring_event_id: @event ref,
+ int unbound_id: @event_accessor ref);
+
+case @event_accessor.kind of
+ 1 = @add_event_accessor
+| 2 = @remove_event_accessor
+ ;
+
+event_accessor_location(
+ int id: @event_accessor ref,
+ int loc: @location ref);
+
+operators(
+ unique int id: @operator,
+ string name: string ref,
+ string symbol: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @operator ref);
+
+operator_location(
+ int id: @operator ref,
+ int loc: @location ref);
+
+constant_value(
+ int id: @variable ref,
+ string value: string ref);
+
+/** CALLABLES **/
+
+@callable = @method | @constructor | @destructor | @operator | @callable_accessor | @anonymous_function_expr | @local_function;
+
+@callable_accessor = @accessor | @event_accessor;
+
+methods(
+ unique int id: @method,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @method ref);
+
+method_location(
+ int id: @method ref,
+ int loc: @location ref);
+
+constructors(
+ unique int id: @constructor,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int unbound_id: @constructor ref);
+
+constructor_location(
+ int id: @constructor ref,
+ int loc: @location ref);
+
+destructors(
+ unique int id: @destructor,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int unbound_id: @destructor ref);
+
+destructor_location(
+ int id: @destructor ref,
+ int loc: @location ref);
+
+overrides(
+ int id: @callable ref,
+ int base_id: @callable ref);
+
+explicitly_implements(
+ int id: @member ref,
+ int interface_id: @interface_or_ref ref);
+
+local_functions(
+ unique int id: @local_function,
+ string name: string ref,
+ int return_type: @type ref,
+ int unbound_id: @local_function ref);
+
+local_function_stmts(
+ unique int fn: @local_function_stmt ref,
+ int stmt: @local_function ref);
+
+/** VARIABLES **/
+
+@variable = @local_scope_variable | @field;
+
+@local_scope_variable = @local_variable | @parameter;
+
+fields(
+ unique int id: @field,
+ int kind: int ref,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @field ref);
+
+case @field.kind of
+ 1 = @addressable_field
+| 2 = @constant
+ ;
+
+field_location(
+ int id: @field ref,
+ int loc: @location ref);
+
+localvars(
+ unique int id: @local_variable,
+ int kind: int ref,
+ string name: string ref,
+ int implicitly_typed: int ref /* 0 = no, 1 = yes */,
+ int type_id: @type_or_ref ref,
+ int parent_id: @local_var_decl_expr ref);
+
+case @local_variable.kind of
+ 1 = @addressable_local_variable
+| 2 = @local_constant
+| 3 = @local_variable_ref
+ ;
+
+localvar_location(
+ unique int id: @local_variable ref,
+ int loc: @location ref);
+
+@parameterizable = @callable | @delegate_type | @indexer | @function_pointer_type | @extension_type;
+
+#keyset[name, parent_id]
+#keyset[index, parent_id]
+params(
+ unique int id: @parameter,
+ string name: string ref,
+ int type_id: @type_or_ref ref,
+ int index: int ref,
+ int mode: int ref, /* value = 0, ref = 1, out = 2, params/array = 3, this = 4, in = 5, ref readonly = 6 */
+ int parent_id: @parameterizable ref,
+ int unbound_id: @parameter ref);
+
+param_location(
+ int id: @parameter ref,
+ int loc: @location ref);
+
+@has_scoped_annotation = @local_scope_variable
+
+scoped_annotation(
+ int id: @has_scoped_annotation ref,
+ int kind: int ref // scoped ref = 1, scoped value = 2
+ );
+
+/** STATEMENTS **/
+
+@exprorstmt_parent = @control_flow_element | @top_level_exprorstmt_parent;
+
+statements(
+ unique int id: @stmt,
+ int kind: int ref);
+
+#keyset[index, parent]
+stmt_parent(
+ unique int stmt: @stmt ref,
+ int index: int ref,
+ int parent: @control_flow_element ref);
+
+@top_level_stmt_parent = @callable;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+stmt_parent_top_level(
+ unique int stmt: @stmt ref,
+ int index: int ref,
+ int parent: @top_level_stmt_parent ref);
+
+case @stmt.kind of
+ 1 = @block_stmt
+| 2 = @expr_stmt
+| 3 = @if_stmt
+| 4 = @switch_stmt
+| 5 = @while_stmt
+| 6 = @do_stmt
+| 7 = @for_stmt
+| 8 = @foreach_stmt
+| 9 = @break_stmt
+| 10 = @continue_stmt
+| 11 = @goto_stmt
+| 12 = @goto_case_stmt
+| 13 = @goto_default_stmt
+| 14 = @throw_stmt
+| 15 = @return_stmt
+| 16 = @yield_stmt
+| 17 = @try_stmt
+| 18 = @checked_stmt
+| 19 = @unchecked_stmt
+| 20 = @lock_stmt
+| 21 = @using_block_stmt
+| 22 = @var_decl_stmt
+| 23 = @const_decl_stmt
+| 24 = @empty_stmt
+| 25 = @unsafe_stmt
+| 26 = @fixed_stmt
+| 27 = @label_stmt
+| 28 = @catch
+| 29 = @case_stmt
+| 30 = @local_function_stmt
+| 31 = @using_decl_stmt
+ ;
+
+@using_stmt = @using_block_stmt | @using_decl_stmt;
+
+@labeled_stmt = @label_stmt | @case;
+
+@decl_stmt = @var_decl_stmt | @const_decl_stmt | @using_decl_stmt;
+
+@cond_stmt = @if_stmt | @switch_stmt;
+
+@loop_stmt = @while_stmt | @do_stmt | @for_stmt | @foreach_stmt;
+
+@jump_stmt = @break_stmt | @goto_any_stmt | @continue_stmt | @throw_stmt | @return_stmt
+ | @yield_stmt;
+
+@goto_any_stmt = @goto_default_stmt | @goto_case_stmt | @goto_stmt;
+
+
+stmt_location(
+ unique int id: @stmt ref,
+ int loc: @location ref);
+
+catch_type(
+ unique int catch_id: @catch ref,
+ int type_id: @type_or_ref ref,
+ int kind: int ref /* explicit = 1, implicit = 2 */);
+
+foreach_stmt_info(
+ unique int id: @foreach_stmt ref,
+ int kind: int ref /* non-async = 1, async = 2 */);
+
+@foreach_symbol = @method | @property | @type_or_ref;
+
+#keyset[id, kind]
+foreach_stmt_desugar(
+ int id: @foreach_stmt ref,
+ int symbol: @foreach_symbol ref,
+ int kind: int ref /* GetEnumeratorMethod = 1, CurrentProperty = 2, MoveNextMethod = 3, DisposeMethod = 4, ElementType = 5 */);
+
+/** EXPRESSIONS **/
+
+expressions(
+ unique int id: @expr,
+ int kind: int ref,
+ int type_id: @type_or_ref ref);
+
+#keyset[index, parent]
+expr_parent(
+ unique int expr: @expr ref,
+ int index: int ref,
+ int parent: @control_flow_element ref);
+
+@top_level_expr_parent = @attribute | @field | @property | @indexer | @parameter | @directive_if | @directive_elif;
+
+@top_level_exprorstmt_parent = @top_level_expr_parent | @top_level_stmt_parent;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+expr_parent_top_level(
+ unique int expr: @expr ref,
+ int index: int ref,
+ int parent: @top_level_exprorstmt_parent ref);
+
+case @expr.kind of
+/* literal */
+ 1 = @bool_literal_expr
+| 2 = @char_literal_expr
+| 3 = @decimal_literal_expr
+| 4 = @int_literal_expr
+| 5 = @long_literal_expr
+| 6 = @uint_literal_expr
+| 7 = @ulong_literal_expr
+| 8 = @float_literal_expr
+| 9 = @double_literal_expr
+| 10 = @utf16_string_literal_expr
+| 11 = @null_literal_expr
+/* primary & unary */
+| 12 = @this_access_expr
+| 13 = @base_access_expr
+| 14 = @local_variable_access_expr
+| 15 = @parameter_access_expr
+| 16 = @field_access_expr
+| 17 = @property_access_expr
+| 18 = @method_access_expr
+| 19 = @event_access_expr
+| 20 = @indexer_access_expr
+| 21 = @array_access_expr
+| 22 = @type_access_expr
+| 23 = @typeof_expr
+| 24 = @method_invocation_expr
+| 25 = @delegate_invocation_expr
+| 26 = @operator_invocation_expr
+| 27 = @cast_expr
+| 28 = @object_creation_expr
+| 29 = @explicit_delegate_creation_expr
+| 30 = @implicit_delegate_creation_expr
+| 31 = @array_creation_expr
+| 32 = @default_expr
+| 33 = @plus_expr
+| 34 = @minus_expr
+| 35 = @bit_not_expr
+| 36 = @log_not_expr
+| 37 = @post_incr_expr
+| 38 = @post_decr_expr
+| 39 = @pre_incr_expr
+| 40 = @pre_decr_expr
+/* multiplicative */
+| 41 = @mul_expr
+| 42 = @div_expr
+| 43 = @rem_expr
+/* additive */
+| 44 = @add_expr
+| 45 = @sub_expr
+/* shift */
+| 46 = @lshift_expr
+| 47 = @rshift_expr
+/* relational */
+| 48 = @lt_expr
+| 49 = @gt_expr
+| 50 = @le_expr
+| 51 = @ge_expr
+/* equality */
+| 52 = @eq_expr
+| 53 = @ne_expr
+/* logical */
+| 54 = @bit_and_expr
+| 55 = @bit_xor_expr
+| 56 = @bit_or_expr
+| 57 = @log_and_expr
+| 58 = @log_or_expr
+/* type testing */
+| 59 = @is_expr
+| 60 = @as_expr
+/* null coalescing */
+| 61 = @null_coalescing_expr
+/* conditional */
+| 62 = @conditional_expr
+/* assignment */
+| 63 = @simple_assign_expr
+| 64 = @assign_add_expr
+| 65 = @assign_sub_expr
+| 66 = @assign_mul_expr
+| 67 = @assign_div_expr
+| 68 = @assign_rem_expr
+| 69 = @assign_and_expr
+| 70 = @assign_xor_expr
+| 71 = @assign_or_expr
+| 72 = @assign_lshift_expr
+| 73 = @assign_rshift_expr
+/* more */
+| 74 = @object_init_expr
+| 75 = @collection_init_expr
+| 76 = @array_init_expr
+| 77 = @checked_expr
+| 78 = @unchecked_expr
+| 79 = @constructor_init_expr
+| 80 = @add_event_expr
+| 81 = @remove_event_expr
+| 82 = @par_expr
+| 83 = @local_var_decl_expr
+| 84 = @lambda_expr
+| 85 = @anonymous_method_expr
+| 86 = @namespace_expr
+/* dynamic */
+| 92 = @dynamic_element_access_expr
+| 93 = @dynamic_member_access_expr
+/* unsafe */
+| 100 = @pointer_indirection_expr
+| 101 = @address_of_expr
+| 102 = @sizeof_expr
+/* async */
+| 103 = @await_expr
+/* C# 6.0 */
+| 104 = @nameof_expr
+| 105 = @interpolated_string_expr
+| 106 = @unknown_expr
+/* C# 7.0 */
+| 107 = @throw_expr
+| 108 = @tuple_expr
+| 109 = @local_function_invocation_expr
+| 110 = @ref_expr
+| 111 = @discard_expr
+/* C# 8.0 */
+| 112 = @range_expr
+| 113 = @index_expr
+| 114 = @switch_expr
+| 115 = @recursive_pattern_expr
+| 116 = @property_pattern_expr
+| 117 = @positional_pattern_expr
+| 118 = @switch_case_expr
+| 119 = @assign_coalesce_expr
+| 120 = @suppress_nullable_warning_expr
+| 121 = @namespace_access_expr
+/* C# 9.0 */
+| 122 = @lt_pattern_expr
+| 123 = @gt_pattern_expr
+| 124 = @le_pattern_expr
+| 125 = @ge_pattern_expr
+| 126 = @not_pattern_expr
+| 127 = @and_pattern_expr
+| 128 = @or_pattern_expr
+| 129 = @function_pointer_invocation_expr
+| 130 = @with_expr
+/* C# 11.0 */
+| 131 = @list_pattern_expr
+| 132 = @slice_pattern_expr
+| 133 = @urshift_expr
+| 134 = @assign_urshift_expr
+| 135 = @utf8_string_literal_expr
+/* C# 12.0 */
+| 136 = @collection_expr
+| 137 = @spread_element_expr
+| 138 = @interpolated_string_insert_expr
+/* Preprocessor */
+| 999 = @define_symbol_expr
+;
+
+@switch = @switch_stmt | @switch_expr;
+@case = @case_stmt | @switch_case_expr;
+@pattern_match = @case | @is_expr;
+@unary_pattern_expr = @not_pattern_expr;
+@relational_pattern_expr = @gt_pattern_expr | @lt_pattern_expr | @ge_pattern_expr | @le_pattern_expr;
+@binary_pattern_expr = @and_pattern_expr | @or_pattern_expr;
+
+@integer_literal_expr = @int_literal_expr | @long_literal_expr | @uint_literal_expr | @ulong_literal_expr;
+@real_literal_expr = @float_literal_expr | @double_literal_expr | @decimal_literal_expr;
+@string_literal_expr = @utf16_string_literal_expr | @utf8_string_literal_expr;
+@literal_expr = @bool_literal_expr | @char_literal_expr | @integer_literal_expr | @real_literal_expr
+ | @string_literal_expr | @null_literal_expr;
+
+@assign_expr = @simple_assign_expr | @assign_op_expr | @local_var_decl_expr;
+@assign_op_call_expr = @assign_arith_expr | @assign_bitwise_expr
+@assign_op_expr = @assign_op_call_expr | @assign_event_expr | @assign_coalesce_expr;
+@assign_event_expr = @add_event_expr | @remove_event_expr;
+
+@add_operation = @add_expr | @assign_add_expr;
+@sub_operation = @sub_expr | @assign_sub_expr;
+@mul_operation = @mul_expr | @assign_mul_expr;
+@div_operation = @div_expr | @assign_div_expr;
+@rem_operation = @rem_expr | @assign_rem_expr;
+@and_operation = @bit_and_expr | @assign_and_expr;
+@xor_operation = @bit_xor_expr | @assign_xor_expr;
+@or_operation = @bit_or_expr | @assign_or_expr;
+@lshift_operation = @lshift_expr | @assign_lshift_expr;
+@rshift_operation = @rshift_expr | @assign_rshift_expr;
+@urshift_operation = @urshift_expr | @assign_urshift_expr;
+@null_coalescing_operation = @null_coalescing_expr | @assign_coalesce_expr;
+
+@assign_arith_expr = @assign_add_expr | @assign_sub_expr | @assign_mul_expr | @assign_div_expr
+ | @assign_rem_expr
+@assign_bitwise_expr = @assign_and_expr | @assign_or_expr | @assign_xor_expr
+ | @assign_lshift_expr | @assign_rshift_expr | @assign_urshift_expr;
+
+@member_access_expr = @field_access_expr | @property_access_expr | @indexer_access_expr | @event_access_expr
+ | @method_access_expr | @type_access_expr | @dynamic_member_access_expr;
+@access_expr = @member_access_expr | @this_access_expr | @base_access_expr | @assignable_access_expr | @namespace_access_expr;
+@element_access_expr = @indexer_access_expr | @array_access_expr | @dynamic_element_access_expr;
+
+@local_variable_access = @local_variable_access_expr | @local_var_decl_expr;
+@local_scope_variable_access_expr = @parameter_access_expr | @local_variable_access;
+@variable_access_expr = @local_scope_variable_access_expr | @field_access_expr;
+
+@assignable_access_expr = @variable_access_expr | @property_access_expr | @element_access_expr
+ | @event_access_expr | @dynamic_member_access_expr;
+
+@objectorcollection_init_expr = @object_init_expr | @collection_init_expr;
+
+@delegate_creation_expr = @explicit_delegate_creation_expr | @implicit_delegate_creation_expr;
+
+@bin_arith_op_expr = @mul_expr | @div_expr | @rem_expr | @add_expr | @sub_expr;
+@incr_op_expr = @pre_incr_expr | @post_incr_expr;
+@decr_op_expr = @pre_decr_expr | @post_decr_expr;
+@mut_op_expr = @incr_op_expr | @decr_op_expr;
+@un_arith_op_expr = @plus_expr | @minus_expr | @mut_op_expr;
+@arith_op_expr = @bin_arith_op_expr | @un_arith_op_expr;
+
+@ternary_log_op_expr = @conditional_expr;
+@bin_log_op_expr = @log_and_expr | @log_or_expr | @null_coalescing_expr;
+@un_log_op_expr = @log_not_expr;
+@log_expr = @un_log_op_expr | @bin_log_op_expr | @ternary_log_op_expr;
+
+@bin_bit_op_expr = @bit_and_expr | @bit_or_expr | @bit_xor_expr | @lshift_expr
+ | @rshift_expr | @urshift_expr;
+@un_bit_op_expr = @bit_not_expr;
+@bit_expr = @un_bit_op_expr | @bin_bit_op_expr;
+
+@equality_op_expr = @eq_expr | @ne_expr;
+@rel_op_expr = @gt_expr | @lt_expr| @ge_expr | @le_expr;
+@comp_expr = @equality_op_expr | @rel_op_expr;
+
+@op_expr = @un_op | @bin_op | @ternary_op;
+
+@ternary_op = @ternary_log_op_expr;
+@bin_op = @assign_expr | @bin_arith_op_expr | @bin_log_op_expr | @bin_bit_op_expr | @comp_expr;
+@un_op = @un_arith_op_expr | @un_log_op_expr | @un_bit_op_expr | @sizeof_expr
+ | @pointer_indirection_expr | @address_of_expr;
+
+@anonymous_function_expr = @lambda_expr | @anonymous_method_expr;
+
+@op_invoke_expr = @operator_invocation_expr | @assign_op_call_expr
+@call = @method_invocation_expr | @constructor_init_expr | @op_invoke_expr
+ | @delegate_invocation_expr | @object_creation_expr | @call_access_expr
+ | @local_function_invocation_expr | @function_pointer_invocation_expr;
+
+@call_access_expr = @property_access_expr | @event_access_expr | @indexer_access_expr;
+
+@late_bindable_expr = @dynamic_element_access_expr | @dynamic_member_access_expr
+ | @object_creation_expr | @method_invocation_expr | @op_invoke_expr;
+
+@throw_element = @throw_expr | @throw_stmt;
+
+@implicitly_typeable_object_creation_expr = @object_creation_expr | @explicit_delegate_creation_expr;
+
+implicitly_typed_array_creation(
+ unique int id: @array_creation_expr ref);
+
+explicitly_sized_array_creation(
+ unique int id: @array_creation_expr ref);
+
+stackalloc_array_creation(
+ unique int id: @array_creation_expr ref);
+
+implicitly_typed_object_creation(
+ unique int id: @implicitly_typeable_object_creation_expr ref);
+
+mutator_invocation_mode(
+ unique int id: @operator_invocation_expr ref,
+ int mode: int ref /* prefix = 1, postfix = 2*/);
+
+expr_value(
+ unique int id: @expr ref,
+ string value: string ref);
+
+expr_call(
+ unique int caller_id: @expr ref,
+ int target_id: @callable ref);
+
+expr_access(
+ unique int accesser_id: @access_expr ref,
+ int target_id: @accessible ref);
+
+@accessible = @method | @assignable | @local_function | @namespace;
+
+expr_location(
+ unique int id: @expr ref,
+ int loc: @location ref);
+
+dynamic_member_name(
+ unique int id: @late_bindable_expr ref,
+ string name: string ref);
+
+@qualifiable_expr = @member_access_expr
+ | @method_invocation_expr
+ | @element_access_expr;
+
+conditional_access(
+ unique int id: @qualifiable_expr ref);
+
+expr_argument(
+ unique int id: @expr ref,
+ int mode: int ref);
+ /* mode is the same as params: value = 0, ref = 1, out = 2 */
+
+expr_argument_name(
+ unique int id: @expr ref,
+ string name: string ref);
+
+lambda_expr_return_type(
+ unique int id: @lambda_expr ref,
+ int type_id: @type_or_ref ref);
+
+/* Compiler generated */
+
+compiler_generated(unique int id: @element ref);
+
+/** CONTROL/DATA FLOW **/
+
+@control_flow_element = @stmt | @expr;
+
+/* XML Files */
+
+xmlEncoding (
+ unique int id: @file ref,
+ string encoding: string ref);
+
+xmlDTDs(
+ unique int id: @xmldtd,
+ string root: string ref,
+ string publicId: string ref,
+ string systemId: string ref,
+ int fileid: @file ref);
+
+xmlElements(
+ unique int id: @xmlelement,
+ string name: string ref,
+ int parentid: @xmlparent ref,
+ int idx: int ref,
+ int fileid: @file ref);
+
+xmlAttrs(
+ unique int id: @xmlattribute,
+ int elementid: @xmlelement ref,
+ string name: string ref,
+ string value: string ref,
+ int idx: int ref,
+ int fileid: @file ref);
+
+xmlNs(
+ int id: @xmlnamespace,
+ string prefixName: string ref,
+ string URI: string ref,
+ int fileid: @file ref);
+
+xmlHasNs(
+ int elementId: @xmlnamespaceable ref,
+ int nsId: @xmlnamespace ref,
+ int fileid: @file ref);
+
+xmlComments(
+ unique int id: @xmlcomment,
+ string text: string ref,
+ int parentid: @xmlparent ref,
+ int fileid: @file ref);
+
+xmlChars(
+ unique int id: @xmlcharacters,
+ string text: string ref,
+ int parentid: @xmlparent ref,
+ int idx: int ref,
+ int isCDATA: int ref,
+ int fileid: @file ref);
+
+@xmlparent = @file | @xmlelement;
+@xmlnamespaceable = @xmlelement | @xmlattribute;
+
+xmllocations(
+ int xmlElement: @xmllocatable ref,
+ int location: @location_default ref);
+
+@xmllocatable = @xmlcharacters | @xmlelement | @xmlcomment | @xmlattribute | @xmldtd | @file | @xmlnamespace;
+
+/* Comments */
+
+commentline(
+ unique int id: @commentline,
+ int kind: int ref,
+ string text: string ref,
+ string rawtext: string ref);
+
+case @commentline.kind of
+ 0 = @singlelinecomment
+| 1 = @xmldoccomment
+| 2 = @multilinecomment;
+
+commentline_location(
+ unique int id: @commentline ref,
+ int loc: @location ref);
+
+commentblock(
+ unique int id : @commentblock);
+
+commentblock_location(
+ unique int id: @commentblock ref,
+ int loc: @location ref);
+
+commentblock_binding(
+ int id: @commentblock ref,
+ int entity: @element ref,
+ int bindtype: int ref); /* 0: Parent, 1: Best, 2: Before, 3: After */
+
+commentblock_child(
+ int id: @commentblock ref,
+ int commentline: @commentline ref,
+ int index: int ref);
+
+/* ASP.NET */
+
+case @asp_element.kind of
+ 0=@asp_close_tag
+| 1=@asp_code
+| 2=@asp_comment
+| 3=@asp_data_binding
+| 4=@asp_directive
+| 5=@asp_open_tag
+| 6=@asp_quoted_string
+| 7=@asp_text
+| 8=@asp_xml_directive;
+
+@asp_attribute = @asp_code | @asp_data_binding | @asp_quoted_string;
+
+asp_elements(
+ unique int id: @asp_element,
+ int kind: int ref,
+ int loc: @location ref);
+
+asp_comment_server(unique int comment: @asp_comment ref);
+asp_code_inline(unique int code: @asp_code ref);
+asp_directive_attribute(
+ int directive: @asp_directive ref,
+ int index: int ref,
+ string name: string ref,
+ int value: @asp_quoted_string ref);
+asp_directive_name(
+ unique int directive: @asp_directive ref,
+ string name: string ref);
+asp_element_body(
+ unique int element: @asp_element ref,
+ string body: string ref);
+asp_tag_attribute(
+ int tag: @asp_open_tag ref,
+ int index: int ref,
+ string name: string ref,
+ int attribute: @asp_attribute ref);
+asp_tag_name(
+ unique int tag: @asp_open_tag ref,
+ string name: string ref);
+asp_tag_isempty(int tag: @asp_open_tag ref);
diff --git a/csharp/ql/lib/upgrades/19b8cc3e2dc768d4cbc03d6e3773b709bbebd036/semmlecode.csharp.dbscheme b/csharp/ql/lib/upgrades/19b8cc3e2dc768d4cbc03d6e3773b709bbebd036/semmlecode.csharp.dbscheme
new file mode 100644
index 000000000000..ea7ad33252e5
--- /dev/null
+++ b/csharp/ql/lib/upgrades/19b8cc3e2dc768d4cbc03d6e3773b709bbebd036/semmlecode.csharp.dbscheme
@@ -0,0 +1,1505 @@
+/* This is a dummy line to alter the dbscheme, so we can make a database upgrade
+ * without actually changing any of the dbscheme predicates. It contains a date
+ * to allow for such updates in the future as well.
+ *
+ * 2021-07-14
+ *
+ * DO NOT remove this comment carelessly, since it can revert the dbscheme back to a
+ * previously seen state (matching a previously seen SHA), which would make the upgrade
+ * mechanism not work properly.
+ */
+
+/**
+ * An invocation of the compiler. Note that more than one file may be
+ * compiled per invocation. For example, this command compiles three
+ * source files:
+ *
+ * csc f1.cs f2.cs f3.cs
+ *
+ * The `id` simply identifies the invocation, while `cwd` is the working
+ * directory from which the compiler was invoked.
+ */
+compilations(
+ unique int id : @compilation,
+ string cwd : string ref
+);
+
+compilation_info(
+ int id : @compilation ref,
+ string info_key: string ref,
+ string info_value: string ref
+)
+
+/**
+ * The arguments that were passed to the extractor for a compiler
+ * invocation. If `id` is for the compiler invocation
+ *
+ * csc f1.cs f2.cs f3.cs
+ *
+ * then typically there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0 | --compiler
+ * 1 | *path to compiler*
+ * 2 | f1.cs
+ * 3 | f2.cs
+ * 4 | f3.cs
+ */
+#keyset[id, num]
+compilation_args(
+ int id : @compilation ref,
+ int num : int ref,
+ string arg : string ref
+);
+
+/**
+ * The expanded arguments that were passed to the extractor for a
+ * compiler invocation. This is similar to `compilation_args`, but
+ * for a `@someFile.rsp` argument, it includes the arguments from that
+ * file, rather than just taking the argument literally.
+ */
+#keyset[id, num]
+compilation_expanded_args(
+ int id : @compilation ref,
+ int num : int ref,
+ string arg : string ref
+);
+
+/**
+ * The source files that are compiled by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ * csc f1.cs f2.cs f3.cs
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0 | f1.cs
+ * 1 | f2.cs
+ * 2 | f3.cs
+ */
+#keyset[id, num]
+compilation_compiling_files(
+ int id : @compilation ref,
+ int num : int ref,
+ int file : @file ref
+);
+
+/**
+ * The references used by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ * csc f1.cs f2.cs f3.cs /r:ref1.dll /r:ref2.dll /r:ref3.dll
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0 | ref1.dll
+ * 1 | ref2.dll
+ * 2 | ref3.dll
+ */
+#keyset[id, num]
+compilation_referencing_files(
+ int id : @compilation ref,
+ int num : int ref,
+ int file : @file ref
+);
+
+/**
+ * The time taken by the extractor for a compiler invocation.
+ *
+ * For each file `num`, there will be rows for
+ *
+ * kind | seconds
+ * ---- | ---
+ * 1 | CPU seconds used by the extractor frontend
+ * 2 | Elapsed seconds during the extractor frontend
+ * 3 | CPU seconds used by the extractor backend
+ * 4 | Elapsed seconds during the extractor backend
+ */
+#keyset[id, num, kind]
+compilation_time(
+ int id : @compilation ref,
+ int num : int ref,
+ /* kind:
+ 1 = frontend_cpu_seconds
+ 2 = frontend_elapsed_seconds
+ 3 = extractor_cpu_seconds
+ 4 = extractor_elapsed_seconds
+ */
+ int kind : int ref,
+ float seconds : float ref
+);
+
+/**
+ * An error or warning generated by the extractor.
+ * The diagnostic message `diagnostic` was generated during compiler
+ * invocation `compilation`, and is the `file_number_diagnostic_number`th
+ * message generated while extracting the `file_number`th file of that
+ * invocation.
+ */
+#keyset[compilation, file_number, file_number_diagnostic_number]
+diagnostic_for(
+ unique int diagnostic : @diagnostic ref,
+ int compilation : @compilation ref,
+ int file_number : int ref,
+ int file_number_diagnostic_number : int ref
+);
+
+diagnostics(
+ unique int id: @diagnostic,
+ int severity: int ref,
+ string error_tag: string ref,
+ string error_message: string ref,
+ string full_error_message: string ref,
+ int location: @location ref
+);
+
+extractor_messages(
+ unique int id: @extractor_message,
+ int severity: int ref,
+ string origin : string ref,
+ string text : string ref,
+ string entity : string ref,
+ int location: @location ref,
+ string stack_trace : string ref
+);
+
+/**
+ * If extraction was successful, then `cpu_seconds` and
+ * `elapsed_seconds` are the CPU time and elapsed time (respectively)
+ * that extraction took for compiler invocation `id`.
+ */
+compilation_finished(
+ unique int id : @compilation ref,
+ float cpu_seconds : float ref,
+ float elapsed_seconds : float ref
+);
+
+compilation_assembly(
+ unique int id : @compilation ref,
+ int assembly: @assembly ref
+)
+
+// Populated by the CSV extractor
+externalData(
+ int id: @externalDataElement,
+ string path: string ref,
+ int column: int ref,
+ string value: string ref);
+
+sourceLocationPrefix(
+ string prefix: string ref);
+
+/*
+ * Overlay support
+ */
+
+/**
+ * The CLI will automatically emit the tuple `databaseMetadata("isOverlay", "true")`,
+ * along with an `overlayChangedFiles` tuple for each new/modified/deleted file,
+ * when building an overlay database, and these can be used by the discard predicates.
+ */
+databaseMetadata(
+ string metadataKey : string ref,
+ string value : string ref
+);
+
+overlayChangedFiles(
+ string path : string ref
+);
+
+/*
+ * C# dbscheme
+ */
+
+/** ELEMENTS **/
+
+@element = @declaration | @stmt | @expr | @modifier | @attribute | @namespace_declaration
+ | @using_directive | @type_parameter_constraints | @externalDataElement
+ | @xmllocatable | @asp_element | @namespace | @preprocessor_directive;
+
+@declaration = @callable | @generic | @assignable | @namespace;
+
+@named_element = @namespace | @declaration;
+
+@declaration_with_accessors = @property | @indexer | @event;
+
+@assignable = @variable | @assignable_with_accessors | @event;
+
+@assignable_with_accessors = @property | @indexer;
+
+@attributable = @assembly | @field | @parameter | @operator | @method | @constructor
+ | @destructor | @callable_accessor | @value_or_ref_type | @declaration_with_accessors
+ | @local_function | @lambda_expr;
+
+/** LOCATIONS, ASEMMBLIES, MODULES, FILES and FOLDERS **/
+
+@location = @location_default | @assembly;
+
+@locatable = @declaration_with_accessors | @callable_accessor | @declaration_or_directive
+ | @diagnostic | @extractor_message | @preprocessor_directive | @attribute | @type_mention | @type_parameter_constraints
+ | @declaration_with_accessors | @callable_accessor | @operator | @method
+ | @constructor | @destructor | @field | @local_variable | @parameter | @stmt | @expr
+ | @xmllocatable | @commentline | @commentblock | @asp_element
+
+locations_default(
+ unique int id: @location_default,
+ int file: @file ref,
+ int beginLine: int ref,
+ int beginColumn: int ref,
+ int endLine: int ref,
+ int endColumn: int ref);
+
+locations_mapped(
+ unique int id: @location_default ref,
+ int mapped_to: @location_default ref);
+
+@sourceline = @file | @callable | @xmllocatable;
+
+numlines(
+ int element_id: @sourceline ref,
+ int num_lines: int ref,
+ int num_code: int ref,
+ int num_comment: int ref);
+
+assemblies(
+ unique int id: @assembly,
+ int file: @file ref,
+ string fullname: string ref,
+ string name: string ref,
+ string version: string ref);
+
+files(
+ unique int id: @file,
+ string name: string ref);
+
+folders(
+ unique int id: @folder,
+ string name: string ref);
+
+@container = @folder | @file ;
+
+containerparent(
+ int parent: @container ref,
+ unique int child: @container ref);
+
+file_extraction_mode(
+ unique int file: @file ref,
+ int mode: int ref
+ /* 0 = normal, 1 = standalone extractor */
+ );
+
+/** NAMESPACES **/
+
+@type_container = @namespace | @type;
+
+namespaces(
+ unique int id: @namespace,
+ string name: string ref);
+
+namespace_declarations(
+ unique int id: @namespace_declaration,
+ int namespace_id: @namespace ref);
+
+namespace_declaration_location(
+ unique int id: @namespace_declaration ref,
+ int loc: @location ref);
+
+parent_namespace(
+ unique int child_id: @type_container ref,
+ int namespace_id: @namespace ref);
+
+@declaration_or_directive = @namespace_declaration | @type | @using_directive;
+
+parent_namespace_declaration(
+ int child_id: @declaration_or_directive ref, // cannot be unique because of partial classes
+ int namespace_id: @namespace_declaration ref);
+
+@using_directive = @using_namespace_directive | @using_static_directive;
+
+using_global(
+ unique int id: @using_directive ref
+);
+
+using_namespace_directives(
+ unique int id: @using_namespace_directive,
+ int namespace_id: @namespace ref);
+
+using_static_directives(
+ unique int id: @using_static_directive,
+ int type_id: @type_or_ref ref);
+
+using_directive_location(
+ unique int id: @using_directive ref,
+ int loc: @location ref);
+
+@preprocessor_directive = @pragma_warning | @pragma_checksum | @directive_define | @directive_undefine | @directive_warning
+ | @directive_error | @directive_nullable | @directive_line | @directive_region | @directive_endregion | @directive_if
+ | @directive_elif | @directive_else | @directive_endif;
+
+@conditional_directive = @directive_if | @directive_elif;
+@branch_directive = @directive_if | @directive_elif | @directive_else;
+
+directive_ifs(
+ unique int id: @directive_if,
+ int branchTaken: int ref, /* 0: false, 1: true */
+ int conditionValue: int ref); /* 0: false, 1: true */
+
+directive_elifs(
+ unique int id: @directive_elif,
+ int branchTaken: int ref, /* 0: false, 1: true */
+ int conditionValue: int ref, /* 0: false, 1: true */
+ int parent: @directive_if ref,
+ int index: int ref);
+
+directive_elses(
+ unique int id: @directive_else,
+ int branchTaken: int ref, /* 0: false, 1: true */
+ int parent: @directive_if ref,
+ int index: int ref);
+
+#keyset[id, start]
+directive_endifs(
+ unique int id: @directive_endif,
+ unique int start: @directive_if ref);
+
+directive_define_symbols(
+ unique int id: @define_symbol_expr ref,
+ string name: string ref);
+
+directive_regions(
+ unique int id: @directive_region,
+ string name: string ref);
+
+#keyset[id, start]
+directive_endregions(
+ unique int id: @directive_endregion,
+ unique int start: @directive_region ref);
+
+directive_lines(
+ unique int id: @directive_line,
+ int kind: int ref); /* 0: default, 1: hidden, 2: numeric, 3: span */
+
+directive_line_value(
+ unique int id: @directive_line ref,
+ int line: int ref);
+
+directive_line_file(
+ unique int id: @directive_line ref,
+ int file: @file ref);
+
+directive_line_offset(
+ unique int id: @directive_line ref,
+ int offset: int ref);
+
+directive_line_span(
+ unique int id: @directive_line ref,
+ int startLine: int ref,
+ int startColumn: int ref,
+ int endLine: int ref,
+ int endColumn: int ref);
+
+directive_nullables(
+ unique int id: @directive_nullable,
+ int setting: int ref, /* 0: disable, 1: enable, 2: restore */
+ int target: int ref); /* 0: none, 1: annotations, 2: warnings */
+
+directive_warnings(
+ unique int id: @directive_warning,
+ string message: string ref);
+
+directive_errors(
+ unique int id: @directive_error,
+ string message: string ref);
+
+directive_undefines(
+ unique int id: @directive_undefine,
+ string name: string ref);
+
+directive_defines(
+ unique int id: @directive_define,
+ string name: string ref);
+
+pragma_checksums(
+ unique int id: @pragma_checksum,
+ int file: @file ref,
+ string guid: string ref,
+ string bytes: string ref);
+
+pragma_warnings(
+ unique int id: @pragma_warning,
+ int kind: int ref /* 0 = disable, 1 = restore */);
+
+#keyset[id, index]
+pragma_warning_error_codes(
+ int id: @pragma_warning ref,
+ string errorCode: string ref,
+ int index: int ref);
+
+preprocessor_directive_location(
+ unique int id: @preprocessor_directive ref,
+ int loc: @location ref);
+
+preprocessor_directive_compilation(
+ int id: @preprocessor_directive ref,
+ int compilation: @compilation ref);
+
+preprocessor_directive_active(
+ unique int id: @preprocessor_directive ref,
+ int active: int ref); /* 0: false, 1: true */
+
+/** TYPES **/
+
+types(
+ unique int id: @type,
+ int kind: int ref,
+ string name: string ref);
+
+case @type.kind of
+ 1 = @bool_type
+| 2 = @char_type
+| 3 = @decimal_type
+| 4 = @sbyte_type
+| 5 = @short_type
+| 6 = @int_type
+| 7 = @long_type
+| 8 = @byte_type
+| 9 = @ushort_type
+| 10 = @uint_type
+| 11 = @ulong_type
+| 12 = @float_type
+| 13 = @double_type
+| 14 = @enum_type
+| 15 = @struct_type
+| 17 = @class_type
+| 19 = @interface_type
+| 20 = @delegate_type
+| 21 = @null_type
+| 22 = @type_parameter
+| 23 = @pointer_type
+| 24 = @nullable_type
+| 25 = @array_type
+| 26 = @void_type
+| 27 = @int_ptr_type
+| 28 = @uint_ptr_type
+| 29 = @dynamic_type
+| 30 = @arglist_type
+| 31 = @unknown_type
+| 32 = @tuple_type
+| 33 = @function_pointer_type
+| 34 = @inline_array_type
+| 35 = @extension_type
+ ;
+
+@simple_type = @bool_type | @char_type | @integral_type | @floating_point_type | @decimal_type;
+@integral_type = @signed_integral_type | @unsigned_integral_type;
+@signed_integral_type = @sbyte_type | @short_type | @int_type | @long_type;
+@unsigned_integral_type = @byte_type | @ushort_type | @uint_type | @ulong_type;
+@floating_point_type = @float_type | @double_type;
+@value_type = @simple_type | @enum_type | @struct_type | @nullable_type | @int_ptr_type
+ | @uint_ptr_type | @tuple_type | @void_type | @inline_array_type;
+@ref_type = @class_type | @interface_type | @array_type | @delegate_type | @null_type
+ | @dynamic_type | @extension_type;
+@value_or_ref_type = @value_type | @ref_type;
+
+typerefs(
+ unique int id: @typeref,
+ string name: string ref);
+
+typeref_type(
+ int id: @typeref ref,
+ unique int typeId: @type ref);
+
+@type_or_ref = @type | @typeref;
+
+array_element_type(
+ unique int array: @array_type ref,
+ int dimension: int ref,
+ int rank: int ref,
+ int element: @type_or_ref ref);
+
+nullable_underlying_type(
+ unique int nullable: @nullable_type ref,
+ int underlying: @type_or_ref ref);
+
+pointer_referent_type(
+ unique int pointer: @pointer_type ref,
+ int referent: @type_or_ref ref);
+
+enum_underlying_type(
+ unique int enum_id: @enum_type ref,
+ int underlying_type_id: @type_or_ref ref);
+
+delegate_return_type(
+ unique int delegate_id: @delegate_type ref,
+ int return_type_id: @type_or_ref ref);
+
+function_pointer_return_type(
+ unique int function_pointer_id: @function_pointer_type ref,
+ int return_type_id: @type_or_ref ref);
+
+extension_receiver_type(
+ unique int extension: @extension_type ref,
+ int receiver_type_id: @type_or_ref ref);
+
+extend(
+ int sub: @type ref,
+ int super: @type_or_ref ref);
+
+anonymous_types(
+ unique int id: @type ref);
+
+@interface_or_ref = @interface_type | @typeref;
+
+implement(
+ int sub: @type ref,
+ int super: @type_or_ref ref);
+
+type_location(
+ int id: @type ref,
+ int loc: @location ref);
+
+tuple_underlying_type(
+ unique int tuple: @tuple_type ref,
+ int struct: @type_or_ref ref);
+
+#keyset[tuple, index]
+tuple_element(
+ int tuple: @tuple_type ref,
+ int index: int ref,
+ unique int field: @field ref);
+
+attributes(
+ unique int id: @attribute,
+ int kind: int ref,
+ int type_id: @type_or_ref ref,
+ int target: @attributable ref);
+
+case @attribute.kind of
+ 0 = @attribute_default
+| 1 = @attribute_return
+| 2 = @attribute_assembly
+| 3 = @attribute_module
+;
+
+attribute_location(
+ int id: @attribute ref,
+ int loc: @location ref);
+
+@type_mention_parent = @element | @type_mention;
+
+type_mention(
+ unique int id: @type_mention,
+ int type_id: @type_or_ref ref,
+ int parent: @type_mention_parent ref);
+
+type_mention_location(
+ unique int id: @type_mention ref,
+ int loc: @location ref);
+
+@has_type_annotation = @assignable | @type_parameter | @callable | @expr | @delegate_type | @generic | @function_pointer_type;
+
+/**
+ * A direct annotation on an entity, for example `string? x;`.
+ *
+ * Annotations:
+ * 2 = reftype is not annotated "!"
+ * 3 = reftype is annotated "?"
+ * 4 = readonly ref type / in parameter
+ * 5 = ref type parameter, return or local variable
+ * 6 = out parameter
+ *
+ * Note that the annotation depends on the element it annotates.
+ * @assignable: The annotation is on the type of the assignable, for example the variable type.
+ * @type_parameter: The annotation is on the reftype constraint
+ * @callable: The annotation is on the return type
+ * @array_type: The annotation is on the element type
+ */
+type_annotation(int id: @has_type_annotation ref, int annotation: int ref);
+
+nullability(unique int nullability: @nullability, int kind: int ref);
+
+case @nullability.kind of
+ 0 = @oblivious
+| 1 = @not_annotated
+| 2 = @annotated
+;
+
+#keyset[parent, index]
+nullability_parent(int nullability: @nullability ref, int index: int ref, int parent: @nullability ref)
+
+type_nullability(int id: @has_type_annotation ref, int nullability: @nullability ref);
+
+/**
+ * The nullable flow state of an expression, as determined by Roslyn.
+ * 0 = none (default, not populated)
+ * 1 = not null
+ * 2 = maybe null
+ */
+expr_flowstate(unique int id: @expr ref, int state: int ref);
+
+/** GENERICS **/
+
+@generic = @type | @method | @local_function;
+
+type_parameters(
+ unique int id: @type_parameter ref,
+ int index: int ref,
+ int generic_id: @generic ref,
+ int variance: int ref /* none = 0, out = 1, in = 2 */);
+
+#keyset[constructed_id, index]
+type_arguments(
+ int id: @type_or_ref ref,
+ int index: int ref,
+ int constructed_id: @generic_or_ref ref);
+
+@generic_or_ref = @generic | @typeref;
+
+constructed_generic(
+ unique int constructed: @generic ref,
+ int generic: @generic_or_ref ref);
+
+type_parameter_constraints(
+ unique int id: @type_parameter_constraints,
+ int param_id: @type_parameter ref);
+
+type_parameter_constraints_location(
+ int id: @type_parameter_constraints ref,
+ int loc: @location ref);
+
+general_type_parameter_constraints(
+ int id: @type_parameter_constraints ref,
+ int kind: int ref /* class = 1, struct = 2, new = 3 */);
+
+specific_type_parameter_constraints(
+ int id: @type_parameter_constraints ref,
+ int base_id: @type_or_ref ref);
+
+specific_type_parameter_nullability(
+ int id: @type_parameter_constraints ref,
+ int base_id: @type_or_ref ref,
+ int nullability: @nullability ref);
+
+/** FUNCTION POINTERS */
+
+function_pointer_calling_conventions(
+ int id: @function_pointer_type ref,
+ int kind: int ref);
+
+#keyset[id, index]
+has_unmanaged_calling_conventions(
+ int id: @function_pointer_type ref,
+ int index: int ref,
+ int conv_id: @type_or_ref ref);
+
+/** MODIFIERS */
+
+@modifiable = @modifiable_direct | @event_accessor;
+
+@modifiable_direct = @member | @accessor | @local_function | @anonymous_function_expr;
+
+modifiers(
+ unique int id: @modifier,
+ string name: string ref);
+
+has_modifiers(
+ int id: @modifiable_direct ref,
+ int mod_id: @modifier ref);
+
+/** MEMBERS **/
+
+@member = @method | @constructor | @destructor | @field | @property | @event | @operator | @indexer | @type;
+
+@named_exprorstmt = @goto_stmt | @labeled_stmt | @expr;
+
+@virtualizable = @method | @property | @indexer | @event | @operator;
+
+exprorstmt_name(
+ unique int parent_id: @named_exprorstmt ref,
+ string name: string ref);
+
+nested_types(
+ unique int id: @type ref,
+ int declaring_type_id: @type ref,
+ int unbound_id: @type ref);
+
+properties(
+ unique int id: @property,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @property ref);
+
+property_location(
+ int id: @property ref,
+ int loc: @location ref);
+
+indexers(
+ unique int id: @indexer,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @indexer ref);
+
+indexer_location(
+ int id: @indexer ref,
+ int loc: @location ref);
+
+accessors(
+ unique int id: @accessor,
+ int kind: int ref,
+ string name: string ref,
+ int declaring_member_id: @member ref,
+ int unbound_id: @accessor ref);
+
+case @accessor.kind of
+ 1 = @getter
+| 2 = @setter
+ ;
+
+init_only_accessors(
+ unique int id: @accessor ref);
+
+accessor_location(
+ int id: @accessor ref,
+ int loc: @location ref);
+
+events(
+ unique int id: @event,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @event ref);
+
+event_location(
+ int id: @event ref,
+ int loc: @location ref);
+
+event_accessors(
+ unique int id: @event_accessor,
+ int kind: int ref,
+ string name: string ref,
+ int declaring_event_id: @event ref,
+ int unbound_id: @event_accessor ref);
+
+case @event_accessor.kind of
+ 1 = @add_event_accessor
+| 2 = @remove_event_accessor
+ ;
+
+event_accessor_location(
+ int id: @event_accessor ref,
+ int loc: @location ref);
+
+operators(
+ unique int id: @operator,
+ string name: string ref,
+ string symbol: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @operator ref);
+
+operator_location(
+ int id: @operator ref,
+ int loc: @location ref);
+
+constant_value(
+ int id: @variable ref,
+ string value: string ref);
+
+/** CALLABLES **/
+
+@callable = @method | @constructor | @destructor | @operator | @callable_accessor | @anonymous_function_expr | @local_function;
+
+@callable_accessor = @accessor | @event_accessor;
+
+methods(
+ unique int id: @method,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @method ref);
+
+method_location(
+ int id: @method ref,
+ int loc: @location ref);
+
+constructors(
+ unique int id: @constructor,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int unbound_id: @constructor ref);
+
+constructor_location(
+ int id: @constructor ref,
+ int loc: @location ref);
+
+destructors(
+ unique int id: @destructor,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int unbound_id: @destructor ref);
+
+destructor_location(
+ int id: @destructor ref,
+ int loc: @location ref);
+
+overrides(
+ int id: @callable ref,
+ int base_id: @callable ref);
+
+explicitly_implements(
+ int id: @member ref,
+ int interface_id: @interface_or_ref ref);
+
+local_functions(
+ unique int id: @local_function,
+ string name: string ref,
+ int return_type: @type ref,
+ int unbound_id: @local_function ref);
+
+local_function_stmts(
+ unique int fn: @local_function_stmt ref,
+ int stmt: @local_function ref);
+
+/** VARIABLES **/
+
+@variable = @local_scope_variable | @field;
+
+@local_scope_variable = @local_variable | @parameter;
+
+fields(
+ unique int id: @field,
+ int kind: int ref,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @field ref);
+
+case @field.kind of
+ 1 = @addressable_field
+| 2 = @constant
+ ;
+
+field_location(
+ int id: @field ref,
+ int loc: @location ref);
+
+localvars(
+ unique int id: @local_variable,
+ int kind: int ref,
+ string name: string ref,
+ int implicitly_typed: int ref /* 0 = no, 1 = yes */,
+ int type_id: @type_or_ref ref,
+ int parent_id: @local_var_decl_expr ref);
+
+case @local_variable.kind of
+ 1 = @addressable_local_variable
+| 2 = @local_constant
+| 3 = @local_variable_ref
+ ;
+
+localvar_location(
+ unique int id: @local_variable ref,
+ int loc: @location ref);
+
+@parameterizable = @callable | @delegate_type | @indexer | @function_pointer_type | @extension_type;
+
+#keyset[name, parent_id]
+#keyset[index, parent_id]
+params(
+ unique int id: @parameter,
+ string name: string ref,
+ int type_id: @type_or_ref ref,
+ int index: int ref,
+ int mode: int ref, /* value = 0, ref = 1, out = 2, params/array = 3, this = 4, in = 5, ref readonly = 6 */
+ int parent_id: @parameterizable ref,
+ int unbound_id: @parameter ref);
+
+param_location(
+ int id: @parameter ref,
+ int loc: @location ref);
+
+@has_scoped_annotation = @local_scope_variable
+
+scoped_annotation(
+ int id: @has_scoped_annotation ref,
+ int kind: int ref // scoped ref = 1, scoped value = 2
+ );
+
+/** STATEMENTS **/
+
+@exprorstmt_parent = @control_flow_element | @top_level_exprorstmt_parent;
+
+statements(
+ unique int id: @stmt,
+ int kind: int ref);
+
+#keyset[index, parent]
+stmt_parent(
+ unique int stmt: @stmt ref,
+ int index: int ref,
+ int parent: @control_flow_element ref);
+
+@top_level_stmt_parent = @callable;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+stmt_parent_top_level(
+ unique int stmt: @stmt ref,
+ int index: int ref,
+ int parent: @top_level_stmt_parent ref);
+
+case @stmt.kind of
+ 1 = @block_stmt
+| 2 = @expr_stmt
+| 3 = @if_stmt
+| 4 = @switch_stmt
+| 5 = @while_stmt
+| 6 = @do_stmt
+| 7 = @for_stmt
+| 8 = @foreach_stmt
+| 9 = @break_stmt
+| 10 = @continue_stmt
+| 11 = @goto_stmt
+| 12 = @goto_case_stmt
+| 13 = @goto_default_stmt
+| 14 = @throw_stmt
+| 15 = @return_stmt
+| 16 = @yield_stmt
+| 17 = @try_stmt
+| 18 = @checked_stmt
+| 19 = @unchecked_stmt
+| 20 = @lock_stmt
+| 21 = @using_block_stmt
+| 22 = @var_decl_stmt
+| 23 = @const_decl_stmt
+| 24 = @empty_stmt
+| 25 = @unsafe_stmt
+| 26 = @fixed_stmt
+| 27 = @label_stmt
+| 28 = @catch
+| 29 = @case_stmt
+| 30 = @local_function_stmt
+| 31 = @using_decl_stmt
+ ;
+
+@using_stmt = @using_block_stmt | @using_decl_stmt;
+
+@labeled_stmt = @label_stmt | @case;
+
+@decl_stmt = @var_decl_stmt | @const_decl_stmt | @using_decl_stmt;
+
+@cond_stmt = @if_stmt | @switch_stmt;
+
+@loop_stmt = @while_stmt | @do_stmt | @for_stmt | @foreach_stmt;
+
+@jump_stmt = @break_stmt | @goto_any_stmt | @continue_stmt | @throw_stmt | @return_stmt
+ | @yield_stmt;
+
+@goto_any_stmt = @goto_default_stmt | @goto_case_stmt | @goto_stmt;
+
+
+stmt_location(
+ unique int id: @stmt ref,
+ int loc: @location ref);
+
+catch_type(
+ unique int catch_id: @catch ref,
+ int type_id: @type_or_ref ref,
+ int kind: int ref /* explicit = 1, implicit = 2 */);
+
+foreach_stmt_info(
+ unique int id: @foreach_stmt ref,
+ int kind: int ref /* non-async = 1, async = 2 */);
+
+@foreach_symbol = @method | @property | @type_or_ref;
+
+#keyset[id, kind]
+foreach_stmt_desugar(
+ int id: @foreach_stmt ref,
+ int symbol: @foreach_symbol ref,
+ int kind: int ref /* GetEnumeratorMethod = 1, CurrentProperty = 2, MoveNextMethod = 3, DisposeMethod = 4, ElementType = 5 */);
+
+/** EXPRESSIONS **/
+
+expressions(
+ unique int id: @expr,
+ int kind: int ref,
+ int type_id: @type_or_ref ref);
+
+#keyset[index, parent]
+expr_parent(
+ unique int expr: @expr ref,
+ int index: int ref,
+ int parent: @control_flow_element ref);
+
+@top_level_expr_parent = @attribute | @field | @property | @indexer | @parameter | @directive_if | @directive_elif;
+
+@top_level_exprorstmt_parent = @top_level_expr_parent | @top_level_stmt_parent;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+expr_parent_top_level(
+ unique int expr: @expr ref,
+ int index: int ref,
+ int parent: @top_level_exprorstmt_parent ref);
+
+case @expr.kind of
+/* literal */
+ 1 = @bool_literal_expr
+| 2 = @char_literal_expr
+| 3 = @decimal_literal_expr
+| 4 = @int_literal_expr
+| 5 = @long_literal_expr
+| 6 = @uint_literal_expr
+| 7 = @ulong_literal_expr
+| 8 = @float_literal_expr
+| 9 = @double_literal_expr
+| 10 = @utf16_string_literal_expr
+| 11 = @null_literal_expr
+/* primary & unary */
+| 12 = @this_access_expr
+| 13 = @base_access_expr
+| 14 = @local_variable_access_expr
+| 15 = @parameter_access_expr
+| 16 = @field_access_expr
+| 17 = @property_access_expr
+| 18 = @method_access_expr
+| 19 = @event_access_expr
+| 20 = @indexer_access_expr
+| 21 = @array_access_expr
+| 22 = @type_access_expr
+| 23 = @typeof_expr
+| 24 = @method_invocation_expr
+| 25 = @delegate_invocation_expr
+| 26 = @operator_invocation_expr
+| 27 = @cast_expr
+| 28 = @object_creation_expr
+| 29 = @explicit_delegate_creation_expr
+| 30 = @implicit_delegate_creation_expr
+| 31 = @array_creation_expr
+| 32 = @default_expr
+| 33 = @plus_expr
+| 34 = @minus_expr
+| 35 = @bit_not_expr
+| 36 = @log_not_expr
+| 37 = @post_incr_expr
+| 38 = @post_decr_expr
+| 39 = @pre_incr_expr
+| 40 = @pre_decr_expr
+/* multiplicative */
+| 41 = @mul_expr
+| 42 = @div_expr
+| 43 = @rem_expr
+/* additive */
+| 44 = @add_expr
+| 45 = @sub_expr
+/* shift */
+| 46 = @lshift_expr
+| 47 = @rshift_expr
+/* relational */
+| 48 = @lt_expr
+| 49 = @gt_expr
+| 50 = @le_expr
+| 51 = @ge_expr
+/* equality */
+| 52 = @eq_expr
+| 53 = @ne_expr
+/* logical */
+| 54 = @bit_and_expr
+| 55 = @bit_xor_expr
+| 56 = @bit_or_expr
+| 57 = @log_and_expr
+| 58 = @log_or_expr
+/* type testing */
+| 59 = @is_expr
+| 60 = @as_expr
+/* null coalescing */
+| 61 = @null_coalescing_expr
+/* conditional */
+| 62 = @conditional_expr
+/* assignment */
+| 63 = @simple_assign_expr
+| 64 = @assign_add_expr
+| 65 = @assign_sub_expr
+| 66 = @assign_mul_expr
+| 67 = @assign_div_expr
+| 68 = @assign_rem_expr
+| 69 = @assign_and_expr
+| 70 = @assign_xor_expr
+| 71 = @assign_or_expr
+| 72 = @assign_lshift_expr
+| 73 = @assign_rshift_expr
+/* more */
+| 74 = @object_init_expr
+| 75 = @collection_init_expr
+| 76 = @array_init_expr
+| 77 = @checked_expr
+| 78 = @unchecked_expr
+| 79 = @constructor_init_expr
+| 80 = @add_event_expr
+| 81 = @remove_event_expr
+| 82 = @par_expr
+| 83 = @local_var_decl_expr
+| 84 = @lambda_expr
+| 85 = @anonymous_method_expr
+| 86 = @namespace_expr
+/* dynamic */
+| 92 = @dynamic_element_access_expr
+| 93 = @dynamic_member_access_expr
+/* unsafe */
+| 100 = @pointer_indirection_expr
+| 101 = @address_of_expr
+| 102 = @sizeof_expr
+/* async */
+| 103 = @await_expr
+/* C# 6.0 */
+| 104 = @nameof_expr
+| 105 = @interpolated_string_expr
+| 106 = @unknown_expr
+/* C# 7.0 */
+| 107 = @throw_expr
+| 108 = @tuple_expr
+| 109 = @local_function_invocation_expr
+| 110 = @ref_expr
+| 111 = @discard_expr
+/* C# 8.0 */
+| 112 = @range_expr
+| 113 = @index_expr
+| 114 = @switch_expr
+| 115 = @recursive_pattern_expr
+| 116 = @property_pattern_expr
+| 117 = @positional_pattern_expr
+| 118 = @switch_case_expr
+| 119 = @assign_coalesce_expr
+| 120 = @suppress_nullable_warning_expr
+| 121 = @namespace_access_expr
+/* C# 9.0 */
+| 122 = @lt_pattern_expr
+| 123 = @gt_pattern_expr
+| 124 = @le_pattern_expr
+| 125 = @ge_pattern_expr
+| 126 = @not_pattern_expr
+| 127 = @and_pattern_expr
+| 128 = @or_pattern_expr
+| 129 = @function_pointer_invocation_expr
+| 130 = @with_expr
+/* C# 11.0 */
+| 131 = @list_pattern_expr
+| 132 = @slice_pattern_expr
+| 133 = @urshift_expr
+| 134 = @assign_urshift_expr
+| 135 = @utf8_string_literal_expr
+/* C# 12.0 */
+| 136 = @collection_expr
+| 137 = @spread_element_expr
+| 138 = @interpolated_string_insert_expr
+/* Preprocessor */
+| 999 = @define_symbol_expr
+;
+
+@switch = @switch_stmt | @switch_expr;
+@case = @case_stmt | @switch_case_expr;
+@pattern_match = @case | @is_expr;
+@unary_pattern_expr = @not_pattern_expr;
+@relational_pattern_expr = @gt_pattern_expr | @lt_pattern_expr | @ge_pattern_expr | @le_pattern_expr;
+@binary_pattern_expr = @and_pattern_expr | @or_pattern_expr;
+
+@integer_literal_expr = @int_literal_expr | @long_literal_expr | @uint_literal_expr | @ulong_literal_expr;
+@real_literal_expr = @float_literal_expr | @double_literal_expr | @decimal_literal_expr;
+@string_literal_expr = @utf16_string_literal_expr | @utf8_string_literal_expr;
+@literal_expr = @bool_literal_expr | @char_literal_expr | @integer_literal_expr | @real_literal_expr
+ | @string_literal_expr | @null_literal_expr;
+
+@assign_expr = @simple_assign_expr | @assign_op_expr | @local_var_decl_expr;
+@assign_op_call_expr = @assign_arith_expr | @assign_bitwise_expr
+@assign_op_expr = @assign_op_call_expr | @assign_event_expr | @assign_coalesce_expr;
+@assign_event_expr = @add_event_expr | @remove_event_expr;
+
+@add_operation = @add_expr | @assign_add_expr;
+@sub_operation = @sub_expr | @assign_sub_expr;
+@mul_operation = @mul_expr | @assign_mul_expr;
+@div_operation = @div_expr | @assign_div_expr;
+@rem_operation = @rem_expr | @assign_rem_expr;
+@and_operation = @bit_and_expr | @assign_and_expr;
+@xor_operation = @bit_xor_expr | @assign_xor_expr;
+@or_operation = @bit_or_expr | @assign_or_expr;
+@lshift_operation = @lshift_expr | @assign_lshift_expr;
+@rshift_operation = @rshift_expr | @assign_rshift_expr;
+@urshift_operation = @urshift_expr | @assign_urshift_expr;
+@null_coalescing_operation = @null_coalescing_expr | @assign_coalesce_expr;
+
+@assign_arith_expr = @assign_add_expr | @assign_sub_expr | @assign_mul_expr | @assign_div_expr
+ | @assign_rem_expr
+@assign_bitwise_expr = @assign_and_expr | @assign_or_expr | @assign_xor_expr
+ | @assign_lshift_expr | @assign_rshift_expr | @assign_urshift_expr;
+
+@member_access_expr = @field_access_expr | @property_access_expr | @indexer_access_expr | @event_access_expr
+ | @method_access_expr | @type_access_expr | @dynamic_member_access_expr;
+@access_expr = @member_access_expr | @this_access_expr | @base_access_expr | @assignable_access_expr | @namespace_access_expr;
+@element_access_expr = @indexer_access_expr | @array_access_expr | @dynamic_element_access_expr;
+
+@local_variable_access = @local_variable_access_expr | @local_var_decl_expr;
+@local_scope_variable_access_expr = @parameter_access_expr | @local_variable_access;
+@variable_access_expr = @local_scope_variable_access_expr | @field_access_expr;
+
+@assignable_access_expr = @variable_access_expr | @property_access_expr | @element_access_expr
+ | @event_access_expr | @dynamic_member_access_expr;
+
+@objectorcollection_init_expr = @object_init_expr | @collection_init_expr;
+
+@delegate_creation_expr = @explicit_delegate_creation_expr | @implicit_delegate_creation_expr;
+
+@bin_arith_op_expr = @mul_expr | @div_expr | @rem_expr | @add_expr | @sub_expr;
+@incr_op_expr = @pre_incr_expr | @post_incr_expr;
+@decr_op_expr = @pre_decr_expr | @post_decr_expr;
+@mut_op_expr = @incr_op_expr | @decr_op_expr;
+@un_arith_op_expr = @plus_expr | @minus_expr | @mut_op_expr;
+@arith_op_expr = @bin_arith_op_expr | @un_arith_op_expr;
+
+@ternary_log_op_expr = @conditional_expr;
+@bin_log_op_expr = @log_and_expr | @log_or_expr | @null_coalescing_expr;
+@un_log_op_expr = @log_not_expr;
+@log_expr = @un_log_op_expr | @bin_log_op_expr | @ternary_log_op_expr;
+
+@bin_bit_op_expr = @bit_and_expr | @bit_or_expr | @bit_xor_expr | @lshift_expr
+ | @rshift_expr | @urshift_expr;
+@un_bit_op_expr = @bit_not_expr;
+@bit_expr = @un_bit_op_expr | @bin_bit_op_expr;
+
+@equality_op_expr = @eq_expr | @ne_expr;
+@rel_op_expr = @gt_expr | @lt_expr| @ge_expr | @le_expr;
+@comp_expr = @equality_op_expr | @rel_op_expr;
+
+@op_expr = @un_op | @bin_op | @ternary_op;
+
+@ternary_op = @ternary_log_op_expr;
+@bin_op = @assign_expr | @bin_arith_op_expr | @bin_log_op_expr | @bin_bit_op_expr | @comp_expr;
+@un_op = @un_arith_op_expr | @un_log_op_expr | @un_bit_op_expr | @sizeof_expr
+ | @pointer_indirection_expr | @address_of_expr;
+
+@anonymous_function_expr = @lambda_expr | @anonymous_method_expr;
+
+@op_invoke_expr = @operator_invocation_expr | @assign_op_call_expr
+@call = @method_invocation_expr | @constructor_init_expr | @op_invoke_expr
+ | @delegate_invocation_expr | @object_creation_expr | @call_access_expr
+ | @local_function_invocation_expr | @function_pointer_invocation_expr;
+
+@call_access_expr = @property_access_expr | @event_access_expr | @indexer_access_expr;
+
+@late_bindable_expr = @dynamic_element_access_expr | @dynamic_member_access_expr
+ | @object_creation_expr | @method_invocation_expr | @op_invoke_expr;
+
+@throw_element = @throw_expr | @throw_stmt;
+
+@implicitly_typeable_object_creation_expr = @object_creation_expr | @explicit_delegate_creation_expr;
+
+implicitly_typed_array_creation(
+ unique int id: @array_creation_expr ref);
+
+explicitly_sized_array_creation(
+ unique int id: @array_creation_expr ref);
+
+stackalloc_array_creation(
+ unique int id: @array_creation_expr ref);
+
+implicitly_typed_object_creation(
+ unique int id: @implicitly_typeable_object_creation_expr ref);
+
+mutator_invocation_mode(
+ unique int id: @operator_invocation_expr ref,
+ int mode: int ref /* prefix = 1, postfix = 2*/);
+
+expr_value(
+ unique int id: @expr ref,
+ string value: string ref);
+
+expr_call(
+ unique int caller_id: @expr ref,
+ int target_id: @callable ref);
+
+expr_access(
+ unique int accesser_id: @access_expr ref,
+ int target_id: @accessible ref);
+
+@accessible = @method | @assignable | @local_function | @namespace;
+
+expr_location(
+ unique int id: @expr ref,
+ int loc: @location ref);
+
+dynamic_member_name(
+ unique int id: @late_bindable_expr ref,
+ string name: string ref);
+
+@qualifiable_expr = @member_access_expr
+ | @method_invocation_expr
+ | @element_access_expr
+ | @assign_op_call_expr;
+
+conditional_access(
+ unique int id: @qualifiable_expr ref);
+
+expr_argument(
+ unique int id: @expr ref,
+ int mode: int ref);
+ /* mode is the same as params: value = 0, ref = 1, out = 2 */
+
+expr_argument_name(
+ unique int id: @expr ref,
+ string name: string ref);
+
+lambda_expr_return_type(
+ unique int id: @lambda_expr ref,
+ int type_id: @type_or_ref ref);
+
+/* Compiler generated */
+
+compiler_generated(unique int id: @element ref);
+
+/** CONTROL/DATA FLOW **/
+
+@control_flow_element = @stmt | @expr;
+
+/* XML Files */
+
+xmlEncoding (
+ unique int id: @file ref,
+ string encoding: string ref);
+
+xmlDTDs(
+ unique int id: @xmldtd,
+ string root: string ref,
+ string publicId: string ref,
+ string systemId: string ref,
+ int fileid: @file ref);
+
+xmlElements(
+ unique int id: @xmlelement,
+ string name: string ref,
+ int parentid: @xmlparent ref,
+ int idx: int ref,
+ int fileid: @file ref);
+
+xmlAttrs(
+ unique int id: @xmlattribute,
+ int elementid: @xmlelement ref,
+ string name: string ref,
+ string value: string ref,
+ int idx: int ref,
+ int fileid: @file ref);
+
+xmlNs(
+ int id: @xmlnamespace,
+ string prefixName: string ref,
+ string URI: string ref,
+ int fileid: @file ref);
+
+xmlHasNs(
+ int elementId: @xmlnamespaceable ref,
+ int nsId: @xmlnamespace ref,
+ int fileid: @file ref);
+
+xmlComments(
+ unique int id: @xmlcomment,
+ string text: string ref,
+ int parentid: @xmlparent ref,
+ int fileid: @file ref);
+
+xmlChars(
+ unique int id: @xmlcharacters,
+ string text: string ref,
+ int parentid: @xmlparent ref,
+ int idx: int ref,
+ int isCDATA: int ref,
+ int fileid: @file ref);
+
+@xmlparent = @file | @xmlelement;
+@xmlnamespaceable = @xmlelement | @xmlattribute;
+
+xmllocations(
+ int xmlElement: @xmllocatable ref,
+ int location: @location_default ref);
+
+@xmllocatable = @xmlcharacters | @xmlelement | @xmlcomment | @xmlattribute | @xmldtd | @file | @xmlnamespace;
+
+/* Comments */
+
+commentline(
+ unique int id: @commentline,
+ int kind: int ref,
+ string text: string ref,
+ string rawtext: string ref);
+
+case @commentline.kind of
+ 0 = @singlelinecomment
+| 1 = @xmldoccomment
+| 2 = @multilinecomment;
+
+commentline_location(
+ unique int id: @commentline ref,
+ int loc: @location ref);
+
+commentblock(
+ unique int id : @commentblock);
+
+commentblock_location(
+ unique int id: @commentblock ref,
+ int loc: @location ref);
+
+commentblock_binding(
+ int id: @commentblock ref,
+ int entity: @element ref,
+ int bindtype: int ref); /* 0: Parent, 1: Best, 2: Before, 3: After */
+
+commentblock_child(
+ int id: @commentblock ref,
+ int commentline: @commentline ref,
+ int index: int ref);
+
+/* ASP.NET */
+
+case @asp_element.kind of
+ 0=@asp_close_tag
+| 1=@asp_code
+| 2=@asp_comment
+| 3=@asp_data_binding
+| 4=@asp_directive
+| 5=@asp_open_tag
+| 6=@asp_quoted_string
+| 7=@asp_text
+| 8=@asp_xml_directive;
+
+@asp_attribute = @asp_code | @asp_data_binding | @asp_quoted_string;
+
+asp_elements(
+ unique int id: @asp_element,
+ int kind: int ref,
+ int loc: @location ref);
+
+asp_comment_server(unique int comment: @asp_comment ref);
+asp_code_inline(unique int code: @asp_code ref);
+asp_directive_attribute(
+ int directive: @asp_directive ref,
+ int index: int ref,
+ string name: string ref,
+ int value: @asp_quoted_string ref);
+asp_directive_name(
+ unique int directive: @asp_directive ref,
+ string name: string ref);
+asp_element_body(
+ unique int element: @asp_element ref,
+ string body: string ref);
+asp_tag_attribute(
+ int tag: @asp_open_tag ref,
+ int index: int ref,
+ string name: string ref,
+ int attribute: @asp_attribute ref);
+asp_tag_name(
+ unique int tag: @asp_open_tag ref,
+ string name: string ref);
+asp_tag_isempty(int tag: @asp_open_tag ref);
diff --git a/csharp/ql/lib/upgrades/19b8cc3e2dc768d4cbc03d6e3773b709bbebd036/upgrade.properties b/csharp/ql/lib/upgrades/19b8cc3e2dc768d4cbc03d6e3773b709bbebd036/upgrade.properties
new file mode 100644
index 000000000000..1a6c09d74158
--- /dev/null
+++ b/csharp/ql/lib/upgrades/19b8cc3e2dc768d4cbc03d6e3773b709bbebd036/upgrade.properties
@@ -0,0 +1,2 @@
+description: Add @assign_op_call_expr to @qualifiable_expr.
+compatibility: full
diff --git a/csharp/ql/lib/upgrades/ea7ad33252e550241975676f09fcc7b0a703deab/old.dbscheme b/csharp/ql/lib/upgrades/ea7ad33252e550241975676f09fcc7b0a703deab/old.dbscheme
new file mode 100644
index 000000000000..ea7ad33252e5
--- /dev/null
+++ b/csharp/ql/lib/upgrades/ea7ad33252e550241975676f09fcc7b0a703deab/old.dbscheme
@@ -0,0 +1,1505 @@
+/* This is a dummy line to alter the dbscheme, so we can make a database upgrade
+ * without actually changing any of the dbscheme predicates. It contains a date
+ * to allow for such updates in the future as well.
+ *
+ * 2021-07-14
+ *
+ * DO NOT remove this comment carelessly, since it can revert the dbscheme back to a
+ * previously seen state (matching a previously seen SHA), which would make the upgrade
+ * mechanism not work properly.
+ */
+
+/**
+ * An invocation of the compiler. Note that more than one file may be
+ * compiled per invocation. For example, this command compiles three
+ * source files:
+ *
+ * csc f1.cs f2.cs f3.cs
+ *
+ * The `id` simply identifies the invocation, while `cwd` is the working
+ * directory from which the compiler was invoked.
+ */
+compilations(
+ unique int id : @compilation,
+ string cwd : string ref
+);
+
+compilation_info(
+ int id : @compilation ref,
+ string info_key: string ref,
+ string info_value: string ref
+)
+
+/**
+ * The arguments that were passed to the extractor for a compiler
+ * invocation. If `id` is for the compiler invocation
+ *
+ * csc f1.cs f2.cs f3.cs
+ *
+ * then typically there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0 | --compiler
+ * 1 | *path to compiler*
+ * 2 | f1.cs
+ * 3 | f2.cs
+ * 4 | f3.cs
+ */
+#keyset[id, num]
+compilation_args(
+ int id : @compilation ref,
+ int num : int ref,
+ string arg : string ref
+);
+
+/**
+ * The expanded arguments that were passed to the extractor for a
+ * compiler invocation. This is similar to `compilation_args`, but
+ * for a `@someFile.rsp` argument, it includes the arguments from that
+ * file, rather than just taking the argument literally.
+ */
+#keyset[id, num]
+compilation_expanded_args(
+ int id : @compilation ref,
+ int num : int ref,
+ string arg : string ref
+);
+
+/**
+ * The source files that are compiled by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ * csc f1.cs f2.cs f3.cs
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0 | f1.cs
+ * 1 | f2.cs
+ * 2 | f3.cs
+ */
+#keyset[id, num]
+compilation_compiling_files(
+ int id : @compilation ref,
+ int num : int ref,
+ int file : @file ref
+);
+
+/**
+ * The references used by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ * csc f1.cs f2.cs f3.cs /r:ref1.dll /r:ref2.dll /r:ref3.dll
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0 | ref1.dll
+ * 1 | ref2.dll
+ * 2 | ref3.dll
+ */
+#keyset[id, num]
+compilation_referencing_files(
+ int id : @compilation ref,
+ int num : int ref,
+ int file : @file ref
+);
+
+/**
+ * The time taken by the extractor for a compiler invocation.
+ *
+ * For each file `num`, there will be rows for
+ *
+ * kind | seconds
+ * ---- | ---
+ * 1 | CPU seconds used by the extractor frontend
+ * 2 | Elapsed seconds during the extractor frontend
+ * 3 | CPU seconds used by the extractor backend
+ * 4 | Elapsed seconds during the extractor backend
+ */
+#keyset[id, num, kind]
+compilation_time(
+ int id : @compilation ref,
+ int num : int ref,
+ /* kind:
+ 1 = frontend_cpu_seconds
+ 2 = frontend_elapsed_seconds
+ 3 = extractor_cpu_seconds
+ 4 = extractor_elapsed_seconds
+ */
+ int kind : int ref,
+ float seconds : float ref
+);
+
+/**
+ * An error or warning generated by the extractor.
+ * The diagnostic message `diagnostic` was generated during compiler
+ * invocation `compilation`, and is the `file_number_diagnostic_number`th
+ * message generated while extracting the `file_number`th file of that
+ * invocation.
+ */
+#keyset[compilation, file_number, file_number_diagnostic_number]
+diagnostic_for(
+ unique int diagnostic : @diagnostic ref,
+ int compilation : @compilation ref,
+ int file_number : int ref,
+ int file_number_diagnostic_number : int ref
+);
+
+diagnostics(
+ unique int id: @diagnostic,
+ int severity: int ref,
+ string error_tag: string ref,
+ string error_message: string ref,
+ string full_error_message: string ref,
+ int location: @location ref
+);
+
+extractor_messages(
+ unique int id: @extractor_message,
+ int severity: int ref,
+ string origin : string ref,
+ string text : string ref,
+ string entity : string ref,
+ int location: @location ref,
+ string stack_trace : string ref
+);
+
+/**
+ * If extraction was successful, then `cpu_seconds` and
+ * `elapsed_seconds` are the CPU time and elapsed time (respectively)
+ * that extraction took for compiler invocation `id`.
+ */
+compilation_finished(
+ unique int id : @compilation ref,
+ float cpu_seconds : float ref,
+ float elapsed_seconds : float ref
+);
+
+compilation_assembly(
+ unique int id : @compilation ref,
+ int assembly: @assembly ref
+)
+
+// Populated by the CSV extractor
+externalData(
+ int id: @externalDataElement,
+ string path: string ref,
+ int column: int ref,
+ string value: string ref);
+
+sourceLocationPrefix(
+ string prefix: string ref);
+
+/*
+ * Overlay support
+ */
+
+/**
+ * The CLI will automatically emit the tuple `databaseMetadata("isOverlay", "true")`,
+ * along with an `overlayChangedFiles` tuple for each new/modified/deleted file,
+ * when building an overlay database, and these can be used by the discard predicates.
+ */
+databaseMetadata(
+ string metadataKey : string ref,
+ string value : string ref
+);
+
+overlayChangedFiles(
+ string path : string ref
+);
+
+/*
+ * C# dbscheme
+ */
+
+/** ELEMENTS **/
+
+@element = @declaration | @stmt | @expr | @modifier | @attribute | @namespace_declaration
+ | @using_directive | @type_parameter_constraints | @externalDataElement
+ | @xmllocatable | @asp_element | @namespace | @preprocessor_directive;
+
+@declaration = @callable | @generic | @assignable | @namespace;
+
+@named_element = @namespace | @declaration;
+
+@declaration_with_accessors = @property | @indexer | @event;
+
+@assignable = @variable | @assignable_with_accessors | @event;
+
+@assignable_with_accessors = @property | @indexer;
+
+@attributable = @assembly | @field | @parameter | @operator | @method | @constructor
+ | @destructor | @callable_accessor | @value_or_ref_type | @declaration_with_accessors
+ | @local_function | @lambda_expr;
+
+/** LOCATIONS, ASEMMBLIES, MODULES, FILES and FOLDERS **/
+
+@location = @location_default | @assembly;
+
+@locatable = @declaration_with_accessors | @callable_accessor | @declaration_or_directive
+ | @diagnostic | @extractor_message | @preprocessor_directive | @attribute | @type_mention | @type_parameter_constraints
+ | @declaration_with_accessors | @callable_accessor | @operator | @method
+ | @constructor | @destructor | @field | @local_variable | @parameter | @stmt | @expr
+ | @xmllocatable | @commentline | @commentblock | @asp_element
+
+locations_default(
+ unique int id: @location_default,
+ int file: @file ref,
+ int beginLine: int ref,
+ int beginColumn: int ref,
+ int endLine: int ref,
+ int endColumn: int ref);
+
+locations_mapped(
+ unique int id: @location_default ref,
+ int mapped_to: @location_default ref);
+
+@sourceline = @file | @callable | @xmllocatable;
+
+numlines(
+ int element_id: @sourceline ref,
+ int num_lines: int ref,
+ int num_code: int ref,
+ int num_comment: int ref);
+
+assemblies(
+ unique int id: @assembly,
+ int file: @file ref,
+ string fullname: string ref,
+ string name: string ref,
+ string version: string ref);
+
+files(
+ unique int id: @file,
+ string name: string ref);
+
+folders(
+ unique int id: @folder,
+ string name: string ref);
+
+@container = @folder | @file ;
+
+containerparent(
+ int parent: @container ref,
+ unique int child: @container ref);
+
+file_extraction_mode(
+ unique int file: @file ref,
+ int mode: int ref
+ /* 0 = normal, 1 = standalone extractor */
+ );
+
+/** NAMESPACES **/
+
+@type_container = @namespace | @type;
+
+namespaces(
+ unique int id: @namespace,
+ string name: string ref);
+
+namespace_declarations(
+ unique int id: @namespace_declaration,
+ int namespace_id: @namespace ref);
+
+namespace_declaration_location(
+ unique int id: @namespace_declaration ref,
+ int loc: @location ref);
+
+parent_namespace(
+ unique int child_id: @type_container ref,
+ int namespace_id: @namespace ref);
+
+@declaration_or_directive = @namespace_declaration | @type | @using_directive;
+
+parent_namespace_declaration(
+ int child_id: @declaration_or_directive ref, // cannot be unique because of partial classes
+ int namespace_id: @namespace_declaration ref);
+
+@using_directive = @using_namespace_directive | @using_static_directive;
+
+using_global(
+ unique int id: @using_directive ref
+);
+
+using_namespace_directives(
+ unique int id: @using_namespace_directive,
+ int namespace_id: @namespace ref);
+
+using_static_directives(
+ unique int id: @using_static_directive,
+ int type_id: @type_or_ref ref);
+
+using_directive_location(
+ unique int id: @using_directive ref,
+ int loc: @location ref);
+
+@preprocessor_directive = @pragma_warning | @pragma_checksum | @directive_define | @directive_undefine | @directive_warning
+ | @directive_error | @directive_nullable | @directive_line | @directive_region | @directive_endregion | @directive_if
+ | @directive_elif | @directive_else | @directive_endif;
+
+@conditional_directive = @directive_if | @directive_elif;
+@branch_directive = @directive_if | @directive_elif | @directive_else;
+
+directive_ifs(
+ unique int id: @directive_if,
+ int branchTaken: int ref, /* 0: false, 1: true */
+ int conditionValue: int ref); /* 0: false, 1: true */
+
+directive_elifs(
+ unique int id: @directive_elif,
+ int branchTaken: int ref, /* 0: false, 1: true */
+ int conditionValue: int ref, /* 0: false, 1: true */
+ int parent: @directive_if ref,
+ int index: int ref);
+
+directive_elses(
+ unique int id: @directive_else,
+ int branchTaken: int ref, /* 0: false, 1: true */
+ int parent: @directive_if ref,
+ int index: int ref);
+
+#keyset[id, start]
+directive_endifs(
+ unique int id: @directive_endif,
+ unique int start: @directive_if ref);
+
+directive_define_symbols(
+ unique int id: @define_symbol_expr ref,
+ string name: string ref);
+
+directive_regions(
+ unique int id: @directive_region,
+ string name: string ref);
+
+#keyset[id, start]
+directive_endregions(
+ unique int id: @directive_endregion,
+ unique int start: @directive_region ref);
+
+directive_lines(
+ unique int id: @directive_line,
+ int kind: int ref); /* 0: default, 1: hidden, 2: numeric, 3: span */
+
+directive_line_value(
+ unique int id: @directive_line ref,
+ int line: int ref);
+
+directive_line_file(
+ unique int id: @directive_line ref,
+ int file: @file ref);
+
+directive_line_offset(
+ unique int id: @directive_line ref,
+ int offset: int ref);
+
+directive_line_span(
+ unique int id: @directive_line ref,
+ int startLine: int ref,
+ int startColumn: int ref,
+ int endLine: int ref,
+ int endColumn: int ref);
+
+directive_nullables(
+ unique int id: @directive_nullable,
+ int setting: int ref, /* 0: disable, 1: enable, 2: restore */
+ int target: int ref); /* 0: none, 1: annotations, 2: warnings */
+
+directive_warnings(
+ unique int id: @directive_warning,
+ string message: string ref);
+
+directive_errors(
+ unique int id: @directive_error,
+ string message: string ref);
+
+directive_undefines(
+ unique int id: @directive_undefine,
+ string name: string ref);
+
+directive_defines(
+ unique int id: @directive_define,
+ string name: string ref);
+
+pragma_checksums(
+ unique int id: @pragma_checksum,
+ int file: @file ref,
+ string guid: string ref,
+ string bytes: string ref);
+
+pragma_warnings(
+ unique int id: @pragma_warning,
+ int kind: int ref /* 0 = disable, 1 = restore */);
+
+#keyset[id, index]
+pragma_warning_error_codes(
+ int id: @pragma_warning ref,
+ string errorCode: string ref,
+ int index: int ref);
+
+preprocessor_directive_location(
+ unique int id: @preprocessor_directive ref,
+ int loc: @location ref);
+
+preprocessor_directive_compilation(
+ int id: @preprocessor_directive ref,
+ int compilation: @compilation ref);
+
+preprocessor_directive_active(
+ unique int id: @preprocessor_directive ref,
+ int active: int ref); /* 0: false, 1: true */
+
+/** TYPES **/
+
+types(
+ unique int id: @type,
+ int kind: int ref,
+ string name: string ref);
+
+case @type.kind of
+ 1 = @bool_type
+| 2 = @char_type
+| 3 = @decimal_type
+| 4 = @sbyte_type
+| 5 = @short_type
+| 6 = @int_type
+| 7 = @long_type
+| 8 = @byte_type
+| 9 = @ushort_type
+| 10 = @uint_type
+| 11 = @ulong_type
+| 12 = @float_type
+| 13 = @double_type
+| 14 = @enum_type
+| 15 = @struct_type
+| 17 = @class_type
+| 19 = @interface_type
+| 20 = @delegate_type
+| 21 = @null_type
+| 22 = @type_parameter
+| 23 = @pointer_type
+| 24 = @nullable_type
+| 25 = @array_type
+| 26 = @void_type
+| 27 = @int_ptr_type
+| 28 = @uint_ptr_type
+| 29 = @dynamic_type
+| 30 = @arglist_type
+| 31 = @unknown_type
+| 32 = @tuple_type
+| 33 = @function_pointer_type
+| 34 = @inline_array_type
+| 35 = @extension_type
+ ;
+
+@simple_type = @bool_type | @char_type | @integral_type | @floating_point_type | @decimal_type;
+@integral_type = @signed_integral_type | @unsigned_integral_type;
+@signed_integral_type = @sbyte_type | @short_type | @int_type | @long_type;
+@unsigned_integral_type = @byte_type | @ushort_type | @uint_type | @ulong_type;
+@floating_point_type = @float_type | @double_type;
+@value_type = @simple_type | @enum_type | @struct_type | @nullable_type | @int_ptr_type
+ | @uint_ptr_type | @tuple_type | @void_type | @inline_array_type;
+@ref_type = @class_type | @interface_type | @array_type | @delegate_type | @null_type
+ | @dynamic_type | @extension_type;
+@value_or_ref_type = @value_type | @ref_type;
+
+typerefs(
+ unique int id: @typeref,
+ string name: string ref);
+
+typeref_type(
+ int id: @typeref ref,
+ unique int typeId: @type ref);
+
+@type_or_ref = @type | @typeref;
+
+array_element_type(
+ unique int array: @array_type ref,
+ int dimension: int ref,
+ int rank: int ref,
+ int element: @type_or_ref ref);
+
+nullable_underlying_type(
+ unique int nullable: @nullable_type ref,
+ int underlying: @type_or_ref ref);
+
+pointer_referent_type(
+ unique int pointer: @pointer_type ref,
+ int referent: @type_or_ref ref);
+
+enum_underlying_type(
+ unique int enum_id: @enum_type ref,
+ int underlying_type_id: @type_or_ref ref);
+
+delegate_return_type(
+ unique int delegate_id: @delegate_type ref,
+ int return_type_id: @type_or_ref ref);
+
+function_pointer_return_type(
+ unique int function_pointer_id: @function_pointer_type ref,
+ int return_type_id: @type_or_ref ref);
+
+extension_receiver_type(
+ unique int extension: @extension_type ref,
+ int receiver_type_id: @type_or_ref ref);
+
+extend(
+ int sub: @type ref,
+ int super: @type_or_ref ref);
+
+anonymous_types(
+ unique int id: @type ref);
+
+@interface_or_ref = @interface_type | @typeref;
+
+implement(
+ int sub: @type ref,
+ int super: @type_or_ref ref);
+
+type_location(
+ int id: @type ref,
+ int loc: @location ref);
+
+tuple_underlying_type(
+ unique int tuple: @tuple_type ref,
+ int struct: @type_or_ref ref);
+
+#keyset[tuple, index]
+tuple_element(
+ int tuple: @tuple_type ref,
+ int index: int ref,
+ unique int field: @field ref);
+
+attributes(
+ unique int id: @attribute,
+ int kind: int ref,
+ int type_id: @type_or_ref ref,
+ int target: @attributable ref);
+
+case @attribute.kind of
+ 0 = @attribute_default
+| 1 = @attribute_return
+| 2 = @attribute_assembly
+| 3 = @attribute_module
+;
+
+attribute_location(
+ int id: @attribute ref,
+ int loc: @location ref);
+
+@type_mention_parent = @element | @type_mention;
+
+type_mention(
+ unique int id: @type_mention,
+ int type_id: @type_or_ref ref,
+ int parent: @type_mention_parent ref);
+
+type_mention_location(
+ unique int id: @type_mention ref,
+ int loc: @location ref);
+
+@has_type_annotation = @assignable | @type_parameter | @callable | @expr | @delegate_type | @generic | @function_pointer_type;
+
+/**
+ * A direct annotation on an entity, for example `string? x;`.
+ *
+ * Annotations:
+ * 2 = reftype is not annotated "!"
+ * 3 = reftype is annotated "?"
+ * 4 = readonly ref type / in parameter
+ * 5 = ref type parameter, return or local variable
+ * 6 = out parameter
+ *
+ * Note that the annotation depends on the element it annotates.
+ * @assignable: The annotation is on the type of the assignable, for example the variable type.
+ * @type_parameter: The annotation is on the reftype constraint
+ * @callable: The annotation is on the return type
+ * @array_type: The annotation is on the element type
+ */
+type_annotation(int id: @has_type_annotation ref, int annotation: int ref);
+
+nullability(unique int nullability: @nullability, int kind: int ref);
+
+case @nullability.kind of
+ 0 = @oblivious
+| 1 = @not_annotated
+| 2 = @annotated
+;
+
+#keyset[parent, index]
+nullability_parent(int nullability: @nullability ref, int index: int ref, int parent: @nullability ref)
+
+type_nullability(int id: @has_type_annotation ref, int nullability: @nullability ref);
+
+/**
+ * The nullable flow state of an expression, as determined by Roslyn.
+ * 0 = none (default, not populated)
+ * 1 = not null
+ * 2 = maybe null
+ */
+expr_flowstate(unique int id: @expr ref, int state: int ref);
+
+/** GENERICS **/
+
+@generic = @type | @method | @local_function;
+
+type_parameters(
+ unique int id: @type_parameter ref,
+ int index: int ref,
+ int generic_id: @generic ref,
+ int variance: int ref /* none = 0, out = 1, in = 2 */);
+
+#keyset[constructed_id, index]
+type_arguments(
+ int id: @type_or_ref ref,
+ int index: int ref,
+ int constructed_id: @generic_or_ref ref);
+
+@generic_or_ref = @generic | @typeref;
+
+constructed_generic(
+ unique int constructed: @generic ref,
+ int generic: @generic_or_ref ref);
+
+type_parameter_constraints(
+ unique int id: @type_parameter_constraints,
+ int param_id: @type_parameter ref);
+
+type_parameter_constraints_location(
+ int id: @type_parameter_constraints ref,
+ int loc: @location ref);
+
+general_type_parameter_constraints(
+ int id: @type_parameter_constraints ref,
+ int kind: int ref /* class = 1, struct = 2, new = 3 */);
+
+specific_type_parameter_constraints(
+ int id: @type_parameter_constraints ref,
+ int base_id: @type_or_ref ref);
+
+specific_type_parameter_nullability(
+ int id: @type_parameter_constraints ref,
+ int base_id: @type_or_ref ref,
+ int nullability: @nullability ref);
+
+/** FUNCTION POINTERS */
+
+function_pointer_calling_conventions(
+ int id: @function_pointer_type ref,
+ int kind: int ref);
+
+#keyset[id, index]
+has_unmanaged_calling_conventions(
+ int id: @function_pointer_type ref,
+ int index: int ref,
+ int conv_id: @type_or_ref ref);
+
+/** MODIFIERS */
+
+@modifiable = @modifiable_direct | @event_accessor;
+
+@modifiable_direct = @member | @accessor | @local_function | @anonymous_function_expr;
+
+modifiers(
+ unique int id: @modifier,
+ string name: string ref);
+
+has_modifiers(
+ int id: @modifiable_direct ref,
+ int mod_id: @modifier ref);
+
+/** MEMBERS **/
+
+@member = @method | @constructor | @destructor | @field | @property | @event | @operator | @indexer | @type;
+
+@named_exprorstmt = @goto_stmt | @labeled_stmt | @expr;
+
+@virtualizable = @method | @property | @indexer | @event | @operator;
+
+exprorstmt_name(
+ unique int parent_id: @named_exprorstmt ref,
+ string name: string ref);
+
+nested_types(
+ unique int id: @type ref,
+ int declaring_type_id: @type ref,
+ int unbound_id: @type ref);
+
+properties(
+ unique int id: @property,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @property ref);
+
+property_location(
+ int id: @property ref,
+ int loc: @location ref);
+
+indexers(
+ unique int id: @indexer,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @indexer ref);
+
+indexer_location(
+ int id: @indexer ref,
+ int loc: @location ref);
+
+accessors(
+ unique int id: @accessor,
+ int kind: int ref,
+ string name: string ref,
+ int declaring_member_id: @member ref,
+ int unbound_id: @accessor ref);
+
+case @accessor.kind of
+ 1 = @getter
+| 2 = @setter
+ ;
+
+init_only_accessors(
+ unique int id: @accessor ref);
+
+accessor_location(
+ int id: @accessor ref,
+ int loc: @location ref);
+
+events(
+ unique int id: @event,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @event ref);
+
+event_location(
+ int id: @event ref,
+ int loc: @location ref);
+
+event_accessors(
+ unique int id: @event_accessor,
+ int kind: int ref,
+ string name: string ref,
+ int declaring_event_id: @event ref,
+ int unbound_id: @event_accessor ref);
+
+case @event_accessor.kind of
+ 1 = @add_event_accessor
+| 2 = @remove_event_accessor
+ ;
+
+event_accessor_location(
+ int id: @event_accessor ref,
+ int loc: @location ref);
+
+operators(
+ unique int id: @operator,
+ string name: string ref,
+ string symbol: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @operator ref);
+
+operator_location(
+ int id: @operator ref,
+ int loc: @location ref);
+
+constant_value(
+ int id: @variable ref,
+ string value: string ref);
+
+/** CALLABLES **/
+
+@callable = @method | @constructor | @destructor | @operator | @callable_accessor | @anonymous_function_expr | @local_function;
+
+@callable_accessor = @accessor | @event_accessor;
+
+methods(
+ unique int id: @method,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @method ref);
+
+method_location(
+ int id: @method ref,
+ int loc: @location ref);
+
+constructors(
+ unique int id: @constructor,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int unbound_id: @constructor ref);
+
+constructor_location(
+ int id: @constructor ref,
+ int loc: @location ref);
+
+destructors(
+ unique int id: @destructor,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int unbound_id: @destructor ref);
+
+destructor_location(
+ int id: @destructor ref,
+ int loc: @location ref);
+
+overrides(
+ int id: @callable ref,
+ int base_id: @callable ref);
+
+explicitly_implements(
+ int id: @member ref,
+ int interface_id: @interface_or_ref ref);
+
+local_functions(
+ unique int id: @local_function,
+ string name: string ref,
+ int return_type: @type ref,
+ int unbound_id: @local_function ref);
+
+local_function_stmts(
+ unique int fn: @local_function_stmt ref,
+ int stmt: @local_function ref);
+
+/** VARIABLES **/
+
+@variable = @local_scope_variable | @field;
+
+@local_scope_variable = @local_variable | @parameter;
+
+fields(
+ unique int id: @field,
+ int kind: int ref,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @field ref);
+
+case @field.kind of
+ 1 = @addressable_field
+| 2 = @constant
+ ;
+
+field_location(
+ int id: @field ref,
+ int loc: @location ref);
+
+localvars(
+ unique int id: @local_variable,
+ int kind: int ref,
+ string name: string ref,
+ int implicitly_typed: int ref /* 0 = no, 1 = yes */,
+ int type_id: @type_or_ref ref,
+ int parent_id: @local_var_decl_expr ref);
+
+case @local_variable.kind of
+ 1 = @addressable_local_variable
+| 2 = @local_constant
+| 3 = @local_variable_ref
+ ;
+
+localvar_location(
+ unique int id: @local_variable ref,
+ int loc: @location ref);
+
+@parameterizable = @callable | @delegate_type | @indexer | @function_pointer_type | @extension_type;
+
+#keyset[name, parent_id]
+#keyset[index, parent_id]
+params(
+ unique int id: @parameter,
+ string name: string ref,
+ int type_id: @type_or_ref ref,
+ int index: int ref,
+ int mode: int ref, /* value = 0, ref = 1, out = 2, params/array = 3, this = 4, in = 5, ref readonly = 6 */
+ int parent_id: @parameterizable ref,
+ int unbound_id: @parameter ref);
+
+param_location(
+ int id: @parameter ref,
+ int loc: @location ref);
+
+@has_scoped_annotation = @local_scope_variable
+
+scoped_annotation(
+ int id: @has_scoped_annotation ref,
+ int kind: int ref // scoped ref = 1, scoped value = 2
+ );
+
+/** STATEMENTS **/
+
+@exprorstmt_parent = @control_flow_element | @top_level_exprorstmt_parent;
+
+statements(
+ unique int id: @stmt,
+ int kind: int ref);
+
+#keyset[index, parent]
+stmt_parent(
+ unique int stmt: @stmt ref,
+ int index: int ref,
+ int parent: @control_flow_element ref);
+
+@top_level_stmt_parent = @callable;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+stmt_parent_top_level(
+ unique int stmt: @stmt ref,
+ int index: int ref,
+ int parent: @top_level_stmt_parent ref);
+
+case @stmt.kind of
+ 1 = @block_stmt
+| 2 = @expr_stmt
+| 3 = @if_stmt
+| 4 = @switch_stmt
+| 5 = @while_stmt
+| 6 = @do_stmt
+| 7 = @for_stmt
+| 8 = @foreach_stmt
+| 9 = @break_stmt
+| 10 = @continue_stmt
+| 11 = @goto_stmt
+| 12 = @goto_case_stmt
+| 13 = @goto_default_stmt
+| 14 = @throw_stmt
+| 15 = @return_stmt
+| 16 = @yield_stmt
+| 17 = @try_stmt
+| 18 = @checked_stmt
+| 19 = @unchecked_stmt
+| 20 = @lock_stmt
+| 21 = @using_block_stmt
+| 22 = @var_decl_stmt
+| 23 = @const_decl_stmt
+| 24 = @empty_stmt
+| 25 = @unsafe_stmt
+| 26 = @fixed_stmt
+| 27 = @label_stmt
+| 28 = @catch
+| 29 = @case_stmt
+| 30 = @local_function_stmt
+| 31 = @using_decl_stmt
+ ;
+
+@using_stmt = @using_block_stmt | @using_decl_stmt;
+
+@labeled_stmt = @label_stmt | @case;
+
+@decl_stmt = @var_decl_stmt | @const_decl_stmt | @using_decl_stmt;
+
+@cond_stmt = @if_stmt | @switch_stmt;
+
+@loop_stmt = @while_stmt | @do_stmt | @for_stmt | @foreach_stmt;
+
+@jump_stmt = @break_stmt | @goto_any_stmt | @continue_stmt | @throw_stmt | @return_stmt
+ | @yield_stmt;
+
+@goto_any_stmt = @goto_default_stmt | @goto_case_stmt | @goto_stmt;
+
+
+stmt_location(
+ unique int id: @stmt ref,
+ int loc: @location ref);
+
+catch_type(
+ unique int catch_id: @catch ref,
+ int type_id: @type_or_ref ref,
+ int kind: int ref /* explicit = 1, implicit = 2 */);
+
+foreach_stmt_info(
+ unique int id: @foreach_stmt ref,
+ int kind: int ref /* non-async = 1, async = 2 */);
+
+@foreach_symbol = @method | @property | @type_or_ref;
+
+#keyset[id, kind]
+foreach_stmt_desugar(
+ int id: @foreach_stmt ref,
+ int symbol: @foreach_symbol ref,
+ int kind: int ref /* GetEnumeratorMethod = 1, CurrentProperty = 2, MoveNextMethod = 3, DisposeMethod = 4, ElementType = 5 */);
+
+/** EXPRESSIONS **/
+
+expressions(
+ unique int id: @expr,
+ int kind: int ref,
+ int type_id: @type_or_ref ref);
+
+#keyset[index, parent]
+expr_parent(
+ unique int expr: @expr ref,
+ int index: int ref,
+ int parent: @control_flow_element ref);
+
+@top_level_expr_parent = @attribute | @field | @property | @indexer | @parameter | @directive_if | @directive_elif;
+
+@top_level_exprorstmt_parent = @top_level_expr_parent | @top_level_stmt_parent;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+expr_parent_top_level(
+ unique int expr: @expr ref,
+ int index: int ref,
+ int parent: @top_level_exprorstmt_parent ref);
+
+case @expr.kind of
+/* literal */
+ 1 = @bool_literal_expr
+| 2 = @char_literal_expr
+| 3 = @decimal_literal_expr
+| 4 = @int_literal_expr
+| 5 = @long_literal_expr
+| 6 = @uint_literal_expr
+| 7 = @ulong_literal_expr
+| 8 = @float_literal_expr
+| 9 = @double_literal_expr
+| 10 = @utf16_string_literal_expr
+| 11 = @null_literal_expr
+/* primary & unary */
+| 12 = @this_access_expr
+| 13 = @base_access_expr
+| 14 = @local_variable_access_expr
+| 15 = @parameter_access_expr
+| 16 = @field_access_expr
+| 17 = @property_access_expr
+| 18 = @method_access_expr
+| 19 = @event_access_expr
+| 20 = @indexer_access_expr
+| 21 = @array_access_expr
+| 22 = @type_access_expr
+| 23 = @typeof_expr
+| 24 = @method_invocation_expr
+| 25 = @delegate_invocation_expr
+| 26 = @operator_invocation_expr
+| 27 = @cast_expr
+| 28 = @object_creation_expr
+| 29 = @explicit_delegate_creation_expr
+| 30 = @implicit_delegate_creation_expr
+| 31 = @array_creation_expr
+| 32 = @default_expr
+| 33 = @plus_expr
+| 34 = @minus_expr
+| 35 = @bit_not_expr
+| 36 = @log_not_expr
+| 37 = @post_incr_expr
+| 38 = @post_decr_expr
+| 39 = @pre_incr_expr
+| 40 = @pre_decr_expr
+/* multiplicative */
+| 41 = @mul_expr
+| 42 = @div_expr
+| 43 = @rem_expr
+/* additive */
+| 44 = @add_expr
+| 45 = @sub_expr
+/* shift */
+| 46 = @lshift_expr
+| 47 = @rshift_expr
+/* relational */
+| 48 = @lt_expr
+| 49 = @gt_expr
+| 50 = @le_expr
+| 51 = @ge_expr
+/* equality */
+| 52 = @eq_expr
+| 53 = @ne_expr
+/* logical */
+| 54 = @bit_and_expr
+| 55 = @bit_xor_expr
+| 56 = @bit_or_expr
+| 57 = @log_and_expr
+| 58 = @log_or_expr
+/* type testing */
+| 59 = @is_expr
+| 60 = @as_expr
+/* null coalescing */
+| 61 = @null_coalescing_expr
+/* conditional */
+| 62 = @conditional_expr
+/* assignment */
+| 63 = @simple_assign_expr
+| 64 = @assign_add_expr
+| 65 = @assign_sub_expr
+| 66 = @assign_mul_expr
+| 67 = @assign_div_expr
+| 68 = @assign_rem_expr
+| 69 = @assign_and_expr
+| 70 = @assign_xor_expr
+| 71 = @assign_or_expr
+| 72 = @assign_lshift_expr
+| 73 = @assign_rshift_expr
+/* more */
+| 74 = @object_init_expr
+| 75 = @collection_init_expr
+| 76 = @array_init_expr
+| 77 = @checked_expr
+| 78 = @unchecked_expr
+| 79 = @constructor_init_expr
+| 80 = @add_event_expr
+| 81 = @remove_event_expr
+| 82 = @par_expr
+| 83 = @local_var_decl_expr
+| 84 = @lambda_expr
+| 85 = @anonymous_method_expr
+| 86 = @namespace_expr
+/* dynamic */
+| 92 = @dynamic_element_access_expr
+| 93 = @dynamic_member_access_expr
+/* unsafe */
+| 100 = @pointer_indirection_expr
+| 101 = @address_of_expr
+| 102 = @sizeof_expr
+/* async */
+| 103 = @await_expr
+/* C# 6.0 */
+| 104 = @nameof_expr
+| 105 = @interpolated_string_expr
+| 106 = @unknown_expr
+/* C# 7.0 */
+| 107 = @throw_expr
+| 108 = @tuple_expr
+| 109 = @local_function_invocation_expr
+| 110 = @ref_expr
+| 111 = @discard_expr
+/* C# 8.0 */
+| 112 = @range_expr
+| 113 = @index_expr
+| 114 = @switch_expr
+| 115 = @recursive_pattern_expr
+| 116 = @property_pattern_expr
+| 117 = @positional_pattern_expr
+| 118 = @switch_case_expr
+| 119 = @assign_coalesce_expr
+| 120 = @suppress_nullable_warning_expr
+| 121 = @namespace_access_expr
+/* C# 9.0 */
+| 122 = @lt_pattern_expr
+| 123 = @gt_pattern_expr
+| 124 = @le_pattern_expr
+| 125 = @ge_pattern_expr
+| 126 = @not_pattern_expr
+| 127 = @and_pattern_expr
+| 128 = @or_pattern_expr
+| 129 = @function_pointer_invocation_expr
+| 130 = @with_expr
+/* C# 11.0 */
+| 131 = @list_pattern_expr
+| 132 = @slice_pattern_expr
+| 133 = @urshift_expr
+| 134 = @assign_urshift_expr
+| 135 = @utf8_string_literal_expr
+/* C# 12.0 */
+| 136 = @collection_expr
+| 137 = @spread_element_expr
+| 138 = @interpolated_string_insert_expr
+/* Preprocessor */
+| 999 = @define_symbol_expr
+;
+
+@switch = @switch_stmt | @switch_expr;
+@case = @case_stmt | @switch_case_expr;
+@pattern_match = @case | @is_expr;
+@unary_pattern_expr = @not_pattern_expr;
+@relational_pattern_expr = @gt_pattern_expr | @lt_pattern_expr | @ge_pattern_expr | @le_pattern_expr;
+@binary_pattern_expr = @and_pattern_expr | @or_pattern_expr;
+
+@integer_literal_expr = @int_literal_expr | @long_literal_expr | @uint_literal_expr | @ulong_literal_expr;
+@real_literal_expr = @float_literal_expr | @double_literal_expr | @decimal_literal_expr;
+@string_literal_expr = @utf16_string_literal_expr | @utf8_string_literal_expr;
+@literal_expr = @bool_literal_expr | @char_literal_expr | @integer_literal_expr | @real_literal_expr
+ | @string_literal_expr | @null_literal_expr;
+
+@assign_expr = @simple_assign_expr | @assign_op_expr | @local_var_decl_expr;
+@assign_op_call_expr = @assign_arith_expr | @assign_bitwise_expr
+@assign_op_expr = @assign_op_call_expr | @assign_event_expr | @assign_coalesce_expr;
+@assign_event_expr = @add_event_expr | @remove_event_expr;
+
+@add_operation = @add_expr | @assign_add_expr;
+@sub_operation = @sub_expr | @assign_sub_expr;
+@mul_operation = @mul_expr | @assign_mul_expr;
+@div_operation = @div_expr | @assign_div_expr;
+@rem_operation = @rem_expr | @assign_rem_expr;
+@and_operation = @bit_and_expr | @assign_and_expr;
+@xor_operation = @bit_xor_expr | @assign_xor_expr;
+@or_operation = @bit_or_expr | @assign_or_expr;
+@lshift_operation = @lshift_expr | @assign_lshift_expr;
+@rshift_operation = @rshift_expr | @assign_rshift_expr;
+@urshift_operation = @urshift_expr | @assign_urshift_expr;
+@null_coalescing_operation = @null_coalescing_expr | @assign_coalesce_expr;
+
+@assign_arith_expr = @assign_add_expr | @assign_sub_expr | @assign_mul_expr | @assign_div_expr
+ | @assign_rem_expr
+@assign_bitwise_expr = @assign_and_expr | @assign_or_expr | @assign_xor_expr
+ | @assign_lshift_expr | @assign_rshift_expr | @assign_urshift_expr;
+
+@member_access_expr = @field_access_expr | @property_access_expr | @indexer_access_expr | @event_access_expr
+ | @method_access_expr | @type_access_expr | @dynamic_member_access_expr;
+@access_expr = @member_access_expr | @this_access_expr | @base_access_expr | @assignable_access_expr | @namespace_access_expr;
+@element_access_expr = @indexer_access_expr | @array_access_expr | @dynamic_element_access_expr;
+
+@local_variable_access = @local_variable_access_expr | @local_var_decl_expr;
+@local_scope_variable_access_expr = @parameter_access_expr | @local_variable_access;
+@variable_access_expr = @local_scope_variable_access_expr | @field_access_expr;
+
+@assignable_access_expr = @variable_access_expr | @property_access_expr | @element_access_expr
+ | @event_access_expr | @dynamic_member_access_expr;
+
+@objectorcollection_init_expr = @object_init_expr | @collection_init_expr;
+
+@delegate_creation_expr = @explicit_delegate_creation_expr | @implicit_delegate_creation_expr;
+
+@bin_arith_op_expr = @mul_expr | @div_expr | @rem_expr | @add_expr | @sub_expr;
+@incr_op_expr = @pre_incr_expr | @post_incr_expr;
+@decr_op_expr = @pre_decr_expr | @post_decr_expr;
+@mut_op_expr = @incr_op_expr | @decr_op_expr;
+@un_arith_op_expr = @plus_expr | @minus_expr | @mut_op_expr;
+@arith_op_expr = @bin_arith_op_expr | @un_arith_op_expr;
+
+@ternary_log_op_expr = @conditional_expr;
+@bin_log_op_expr = @log_and_expr | @log_or_expr | @null_coalescing_expr;
+@un_log_op_expr = @log_not_expr;
+@log_expr = @un_log_op_expr | @bin_log_op_expr | @ternary_log_op_expr;
+
+@bin_bit_op_expr = @bit_and_expr | @bit_or_expr | @bit_xor_expr | @lshift_expr
+ | @rshift_expr | @urshift_expr;
+@un_bit_op_expr = @bit_not_expr;
+@bit_expr = @un_bit_op_expr | @bin_bit_op_expr;
+
+@equality_op_expr = @eq_expr | @ne_expr;
+@rel_op_expr = @gt_expr | @lt_expr| @ge_expr | @le_expr;
+@comp_expr = @equality_op_expr | @rel_op_expr;
+
+@op_expr = @un_op | @bin_op | @ternary_op;
+
+@ternary_op = @ternary_log_op_expr;
+@bin_op = @assign_expr | @bin_arith_op_expr | @bin_log_op_expr | @bin_bit_op_expr | @comp_expr;
+@un_op = @un_arith_op_expr | @un_log_op_expr | @un_bit_op_expr | @sizeof_expr
+ | @pointer_indirection_expr | @address_of_expr;
+
+@anonymous_function_expr = @lambda_expr | @anonymous_method_expr;
+
+@op_invoke_expr = @operator_invocation_expr | @assign_op_call_expr
+@call = @method_invocation_expr | @constructor_init_expr | @op_invoke_expr
+ | @delegate_invocation_expr | @object_creation_expr | @call_access_expr
+ | @local_function_invocation_expr | @function_pointer_invocation_expr;
+
+@call_access_expr = @property_access_expr | @event_access_expr | @indexer_access_expr;
+
+@late_bindable_expr = @dynamic_element_access_expr | @dynamic_member_access_expr
+ | @object_creation_expr | @method_invocation_expr | @op_invoke_expr;
+
+@throw_element = @throw_expr | @throw_stmt;
+
+@implicitly_typeable_object_creation_expr = @object_creation_expr | @explicit_delegate_creation_expr;
+
+implicitly_typed_array_creation(
+ unique int id: @array_creation_expr ref);
+
+explicitly_sized_array_creation(
+ unique int id: @array_creation_expr ref);
+
+stackalloc_array_creation(
+ unique int id: @array_creation_expr ref);
+
+implicitly_typed_object_creation(
+ unique int id: @implicitly_typeable_object_creation_expr ref);
+
+mutator_invocation_mode(
+ unique int id: @operator_invocation_expr ref,
+ int mode: int ref /* prefix = 1, postfix = 2*/);
+
+expr_value(
+ unique int id: @expr ref,
+ string value: string ref);
+
+expr_call(
+ unique int caller_id: @expr ref,
+ int target_id: @callable ref);
+
+expr_access(
+ unique int accesser_id: @access_expr ref,
+ int target_id: @accessible ref);
+
+@accessible = @method | @assignable | @local_function | @namespace;
+
+expr_location(
+ unique int id: @expr ref,
+ int loc: @location ref);
+
+dynamic_member_name(
+ unique int id: @late_bindable_expr ref,
+ string name: string ref);
+
+@qualifiable_expr = @member_access_expr
+ | @method_invocation_expr
+ | @element_access_expr
+ | @assign_op_call_expr;
+
+conditional_access(
+ unique int id: @qualifiable_expr ref);
+
+expr_argument(
+ unique int id: @expr ref,
+ int mode: int ref);
+ /* mode is the same as params: value = 0, ref = 1, out = 2 */
+
+expr_argument_name(
+ unique int id: @expr ref,
+ string name: string ref);
+
+lambda_expr_return_type(
+ unique int id: @lambda_expr ref,
+ int type_id: @type_or_ref ref);
+
+/* Compiler generated */
+
+compiler_generated(unique int id: @element ref);
+
+/** CONTROL/DATA FLOW **/
+
+@control_flow_element = @stmt | @expr;
+
+/* XML Files */
+
+xmlEncoding (
+ unique int id: @file ref,
+ string encoding: string ref);
+
+xmlDTDs(
+ unique int id: @xmldtd,
+ string root: string ref,
+ string publicId: string ref,
+ string systemId: string ref,
+ int fileid: @file ref);
+
+xmlElements(
+ unique int id: @xmlelement,
+ string name: string ref,
+ int parentid: @xmlparent ref,
+ int idx: int ref,
+ int fileid: @file ref);
+
+xmlAttrs(
+ unique int id: @xmlattribute,
+ int elementid: @xmlelement ref,
+ string name: string ref,
+ string value: string ref,
+ int idx: int ref,
+ int fileid: @file ref);
+
+xmlNs(
+ int id: @xmlnamespace,
+ string prefixName: string ref,
+ string URI: string ref,
+ int fileid: @file ref);
+
+xmlHasNs(
+ int elementId: @xmlnamespaceable ref,
+ int nsId: @xmlnamespace ref,
+ int fileid: @file ref);
+
+xmlComments(
+ unique int id: @xmlcomment,
+ string text: string ref,
+ int parentid: @xmlparent ref,
+ int fileid: @file ref);
+
+xmlChars(
+ unique int id: @xmlcharacters,
+ string text: string ref,
+ int parentid: @xmlparent ref,
+ int idx: int ref,
+ int isCDATA: int ref,
+ int fileid: @file ref);
+
+@xmlparent = @file | @xmlelement;
+@xmlnamespaceable = @xmlelement | @xmlattribute;
+
+xmllocations(
+ int xmlElement: @xmllocatable ref,
+ int location: @location_default ref);
+
+@xmllocatable = @xmlcharacters | @xmlelement | @xmlcomment | @xmlattribute | @xmldtd | @file | @xmlnamespace;
+
+/* Comments */
+
+commentline(
+ unique int id: @commentline,
+ int kind: int ref,
+ string text: string ref,
+ string rawtext: string ref);
+
+case @commentline.kind of
+ 0 = @singlelinecomment
+| 1 = @xmldoccomment
+| 2 = @multilinecomment;
+
+commentline_location(
+ unique int id: @commentline ref,
+ int loc: @location ref);
+
+commentblock(
+ unique int id : @commentblock);
+
+commentblock_location(
+ unique int id: @commentblock ref,
+ int loc: @location ref);
+
+commentblock_binding(
+ int id: @commentblock ref,
+ int entity: @element ref,
+ int bindtype: int ref); /* 0: Parent, 1: Best, 2: Before, 3: After */
+
+commentblock_child(
+ int id: @commentblock ref,
+ int commentline: @commentline ref,
+ int index: int ref);
+
+/* ASP.NET */
+
+case @asp_element.kind of
+ 0=@asp_close_tag
+| 1=@asp_code
+| 2=@asp_comment
+| 3=@asp_data_binding
+| 4=@asp_directive
+| 5=@asp_open_tag
+| 6=@asp_quoted_string
+| 7=@asp_text
+| 8=@asp_xml_directive;
+
+@asp_attribute = @asp_code | @asp_data_binding | @asp_quoted_string;
+
+asp_elements(
+ unique int id: @asp_element,
+ int kind: int ref,
+ int loc: @location ref);
+
+asp_comment_server(unique int comment: @asp_comment ref);
+asp_code_inline(unique int code: @asp_code ref);
+asp_directive_attribute(
+ int directive: @asp_directive ref,
+ int index: int ref,
+ string name: string ref,
+ int value: @asp_quoted_string ref);
+asp_directive_name(
+ unique int directive: @asp_directive ref,
+ string name: string ref);
+asp_element_body(
+ unique int element: @asp_element ref,
+ string body: string ref);
+asp_tag_attribute(
+ int tag: @asp_open_tag ref,
+ int index: int ref,
+ string name: string ref,
+ int attribute: @asp_attribute ref);
+asp_tag_name(
+ unique int tag: @asp_open_tag ref,
+ string name: string ref);
+asp_tag_isempty(int tag: @asp_open_tag ref);
diff --git a/csharp/ql/lib/upgrades/ea7ad33252e550241975676f09fcc7b0a703deab/semmlecode.csharp.dbscheme b/csharp/ql/lib/upgrades/ea7ad33252e550241975676f09fcc7b0a703deab/semmlecode.csharp.dbscheme
new file mode 100644
index 000000000000..3cabc77473cb
--- /dev/null
+++ b/csharp/ql/lib/upgrades/ea7ad33252e550241975676f09fcc7b0a703deab/semmlecode.csharp.dbscheme
@@ -0,0 +1,1505 @@
+/* This is a dummy line to alter the dbscheme, so we can make a database upgrade
+ * without actually changing any of the dbscheme predicates. It contains a date
+ * to allow for such updates in the future as well.
+ *
+ * 2021-07-14
+ *
+ * DO NOT remove this comment carelessly, since it can revert the dbscheme back to a
+ * previously seen state (matching a previously seen SHA), which would make the upgrade
+ * mechanism not work properly.
+ */
+
+/**
+ * An invocation of the compiler. Note that more than one file may be
+ * compiled per invocation. For example, this command compiles three
+ * source files:
+ *
+ * csc f1.cs f2.cs f3.cs
+ *
+ * The `id` simply identifies the invocation, while `cwd` is the working
+ * directory from which the compiler was invoked.
+ */
+compilations(
+ unique int id : @compilation,
+ string cwd : string ref
+);
+
+compilation_info(
+ int id : @compilation ref,
+ string info_key: string ref,
+ string info_value: string ref
+)
+
+/**
+ * The arguments that were passed to the extractor for a compiler
+ * invocation. If `id` is for the compiler invocation
+ *
+ * csc f1.cs f2.cs f3.cs
+ *
+ * then typically there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0 | --compiler
+ * 1 | *path to compiler*
+ * 2 | f1.cs
+ * 3 | f2.cs
+ * 4 | f3.cs
+ */
+#keyset[id, num]
+compilation_args(
+ int id : @compilation ref,
+ int num : int ref,
+ string arg : string ref
+);
+
+/**
+ * The expanded arguments that were passed to the extractor for a
+ * compiler invocation. This is similar to `compilation_args`, but
+ * for a `@someFile.rsp` argument, it includes the arguments from that
+ * file, rather than just taking the argument literally.
+ */
+#keyset[id, num]
+compilation_expanded_args(
+ int id : @compilation ref,
+ int num : int ref,
+ string arg : string ref
+);
+
+/**
+ * The source files that are compiled by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ * csc f1.cs f2.cs f3.cs
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0 | f1.cs
+ * 1 | f2.cs
+ * 2 | f3.cs
+ */
+#keyset[id, num]
+compilation_compiling_files(
+ int id : @compilation ref,
+ int num : int ref,
+ int file : @file ref
+);
+
+/**
+ * The references used by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ * csc f1.cs f2.cs f3.cs /r:ref1.dll /r:ref2.dll /r:ref3.dll
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0 | ref1.dll
+ * 1 | ref2.dll
+ * 2 | ref3.dll
+ */
+#keyset[id, num]
+compilation_referencing_files(
+ int id : @compilation ref,
+ int num : int ref,
+ int file : @file ref
+);
+
+/**
+ * The time taken by the extractor for a compiler invocation.
+ *
+ * For each file `num`, there will be rows for
+ *
+ * kind | seconds
+ * ---- | ---
+ * 1 | CPU seconds used by the extractor frontend
+ * 2 | Elapsed seconds during the extractor frontend
+ * 3 | CPU seconds used by the extractor backend
+ * 4 | Elapsed seconds during the extractor backend
+ */
+#keyset[id, num, kind]
+compilation_time(
+ int id : @compilation ref,
+ int num : int ref,
+ /* kind:
+ 1 = frontend_cpu_seconds
+ 2 = frontend_elapsed_seconds
+ 3 = extractor_cpu_seconds
+ 4 = extractor_elapsed_seconds
+ */
+ int kind : int ref,
+ float seconds : float ref
+);
+
+/**
+ * An error or warning generated by the extractor.
+ * The diagnostic message `diagnostic` was generated during compiler
+ * invocation `compilation`, and is the `file_number_diagnostic_number`th
+ * message generated while extracting the `file_number`th file of that
+ * invocation.
+ */
+#keyset[compilation, file_number, file_number_diagnostic_number]
+diagnostic_for(
+ unique int diagnostic : @diagnostic ref,
+ int compilation : @compilation ref,
+ int file_number : int ref,
+ int file_number_diagnostic_number : int ref
+);
+
+diagnostics(
+ unique int id: @diagnostic,
+ int severity: int ref,
+ string error_tag: string ref,
+ string error_message: string ref,
+ string full_error_message: string ref,
+ int location: @location ref
+);
+
+extractor_messages(
+ unique int id: @extractor_message,
+ int severity: int ref,
+ string origin : string ref,
+ string text : string ref,
+ string entity : string ref,
+ int location: @location ref,
+ string stack_trace : string ref
+);
+
+/**
+ * If extraction was successful, then `cpu_seconds` and
+ * `elapsed_seconds` are the CPU time and elapsed time (respectively)
+ * that extraction took for compiler invocation `id`.
+ */
+compilation_finished(
+ unique int id : @compilation ref,
+ float cpu_seconds : float ref,
+ float elapsed_seconds : float ref
+);
+
+compilation_assembly(
+ unique int id : @compilation ref,
+ int assembly: @assembly ref
+)
+
+// Populated by the CSV extractor
+externalData(
+ int id: @externalDataElement,
+ string path: string ref,
+ int column: int ref,
+ string value: string ref);
+
+sourceLocationPrefix(
+ string prefix: string ref);
+
+/*
+ * Overlay support
+ */
+
+/**
+ * The CLI will automatically emit the tuple `databaseMetadata("isOverlay", "true")`,
+ * along with an `overlayChangedFiles` tuple for each new/modified/deleted file,
+ * when building an overlay database, and these can be used by the discard predicates.
+ */
+databaseMetadata(
+ string metadataKey : string ref,
+ string value : string ref
+);
+
+overlayChangedFiles(
+ string path : string ref
+);
+
+/*
+ * C# dbscheme
+ */
+
+/** ELEMENTS **/
+
+@element = @declaration | @stmt | @expr | @modifier | @attribute | @namespace_declaration
+ | @using_directive | @type_parameter_constraints | @externalDataElement
+ | @xmllocatable | @asp_element | @namespace | @preprocessor_directive;
+
+@declaration = @callable | @generic | @assignable | @namespace;
+
+@named_element = @namespace | @declaration;
+
+@declaration_with_accessors = @property | @indexer | @event;
+
+@assignable = @variable | @assignable_with_accessors | @event;
+
+@assignable_with_accessors = @property | @indexer;
+
+@attributable = @assembly | @field | @parameter | @operator | @method | @constructor
+ | @destructor | @callable_accessor | @value_or_ref_type | @declaration_with_accessors
+ | @local_function | @lambda_expr;
+
+/** LOCATIONS, ASEMMBLIES, MODULES, FILES and FOLDERS **/
+
+@location = @location_default | @assembly;
+
+@locatable = @declaration_with_accessors | @callable_accessor | @declaration_or_directive
+ | @diagnostic | @extractor_message | @preprocessor_directive | @attribute | @type_mention | @type_parameter_constraints
+ | @declaration_with_accessors | @callable_accessor | @operator | @method
+ | @constructor | @destructor | @field | @local_variable | @parameter | @stmt | @expr
+ | @xmllocatable | @commentline | @commentblock | @asp_element
+
+locations_default(
+ unique int id: @location_default,
+ int file: @file ref,
+ int beginLine: int ref,
+ int beginColumn: int ref,
+ int endLine: int ref,
+ int endColumn: int ref);
+
+locations_mapped(
+ unique int id: @location_default ref,
+ int mapped_to: @location_default ref);
+
+@sourceline = @file | @callable | @xmllocatable;
+
+numlines(
+ int element_id: @sourceline ref,
+ int num_lines: int ref,
+ int num_code: int ref,
+ int num_comment: int ref);
+
+assemblies(
+ unique int id: @assembly,
+ int file: @file ref,
+ string fullname: string ref,
+ string name: string ref,
+ string version: string ref);
+
+files(
+ unique int id: @file,
+ string name: string ref);
+
+folders(
+ unique int id: @folder,
+ string name: string ref);
+
+@container = @folder | @file ;
+
+containerparent(
+ int parent: @container ref,
+ unique int child: @container ref);
+
+file_extraction_mode(
+ unique int file: @file ref,
+ int mode: int ref
+ /* 0 = normal, 1 = standalone extractor */
+ );
+
+/** NAMESPACES **/
+
+@type_container = @namespace | @type;
+
+namespaces(
+ unique int id: @namespace,
+ string name: string ref);
+
+namespace_declarations(
+ unique int id: @namespace_declaration,
+ int namespace_id: @namespace ref);
+
+namespace_declaration_location(
+ unique int id: @namespace_declaration ref,
+ int loc: @location ref);
+
+parent_namespace(
+ unique int child_id: @type_container ref,
+ int namespace_id: @namespace ref);
+
+@declaration_or_directive = @namespace_declaration | @type | @using_directive;
+
+parent_namespace_declaration(
+ int child_id: @declaration_or_directive ref, // cannot be unique because of partial classes
+ int namespace_id: @namespace_declaration ref);
+
+@using_directive = @using_namespace_directive | @using_static_directive;
+
+using_global(
+ unique int id: @using_directive ref
+);
+
+using_namespace_directives(
+ unique int id: @using_namespace_directive,
+ int namespace_id: @namespace ref);
+
+using_static_directives(
+ unique int id: @using_static_directive,
+ int type_id: @type_or_ref ref);
+
+using_directive_location(
+ unique int id: @using_directive ref,
+ int loc: @location ref);
+
+@preprocessor_directive = @pragma_warning | @pragma_checksum | @directive_define | @directive_undefine | @directive_warning
+ | @directive_error | @directive_nullable | @directive_line | @directive_region | @directive_endregion | @directive_if
+ | @directive_elif | @directive_else | @directive_endif;
+
+@conditional_directive = @directive_if | @directive_elif;
+@branch_directive = @directive_if | @directive_elif | @directive_else;
+
+directive_ifs(
+ unique int id: @directive_if,
+ int branchTaken: int ref, /* 0: false, 1: true */
+ int conditionValue: int ref); /* 0: false, 1: true */
+
+directive_elifs(
+ unique int id: @directive_elif,
+ int branchTaken: int ref, /* 0: false, 1: true */
+ int conditionValue: int ref, /* 0: false, 1: true */
+ int parent: @directive_if ref,
+ int index: int ref);
+
+directive_elses(
+ unique int id: @directive_else,
+ int branchTaken: int ref, /* 0: false, 1: true */
+ int parent: @directive_if ref,
+ int index: int ref);
+
+#keyset[id, start]
+directive_endifs(
+ unique int id: @directive_endif,
+ unique int start: @directive_if ref);
+
+directive_define_symbols(
+ unique int id: @define_symbol_expr ref,
+ string name: string ref);
+
+directive_regions(
+ unique int id: @directive_region,
+ string name: string ref);
+
+#keyset[id, start]
+directive_endregions(
+ unique int id: @directive_endregion,
+ unique int start: @directive_region ref);
+
+directive_lines(
+ unique int id: @directive_line,
+ int kind: int ref); /* 0: default, 1: hidden, 2: numeric, 3: span */
+
+directive_line_value(
+ unique int id: @directive_line ref,
+ int line: int ref);
+
+directive_line_file(
+ unique int id: @directive_line ref,
+ int file: @file ref);
+
+directive_line_offset(
+ unique int id: @directive_line ref,
+ int offset: int ref);
+
+directive_line_span(
+ unique int id: @directive_line ref,
+ int startLine: int ref,
+ int startColumn: int ref,
+ int endLine: int ref,
+ int endColumn: int ref);
+
+directive_nullables(
+ unique int id: @directive_nullable,
+ int setting: int ref, /* 0: disable, 1: enable, 2: restore */
+ int target: int ref); /* 0: none, 1: annotations, 2: warnings */
+
+directive_warnings(
+ unique int id: @directive_warning,
+ string message: string ref);
+
+directive_errors(
+ unique int id: @directive_error,
+ string message: string ref);
+
+directive_undefines(
+ unique int id: @directive_undefine,
+ string name: string ref);
+
+directive_defines(
+ unique int id: @directive_define,
+ string name: string ref);
+
+pragma_checksums(
+ unique int id: @pragma_checksum,
+ int file: @file ref,
+ string guid: string ref,
+ string bytes: string ref);
+
+pragma_warnings(
+ unique int id: @pragma_warning,
+ int kind: int ref /* 0 = disable, 1 = restore */);
+
+#keyset[id, index]
+pragma_warning_error_codes(
+ int id: @pragma_warning ref,
+ string errorCode: string ref,
+ int index: int ref);
+
+preprocessor_directive_location(
+ unique int id: @preprocessor_directive ref,
+ int loc: @location ref);
+
+preprocessor_directive_compilation(
+ int id: @preprocessor_directive ref,
+ int compilation: @compilation ref);
+
+preprocessor_directive_active(
+ unique int id: @preprocessor_directive ref,
+ int active: int ref); /* 0: false, 1: true */
+
+/** TYPES **/
+
+types(
+ unique int id: @type,
+ int kind: int ref,
+ string name: string ref);
+
+case @type.kind of
+ 1 = @bool_type
+| 2 = @char_type
+| 3 = @decimal_type
+| 4 = @sbyte_type
+| 5 = @short_type
+| 6 = @int_type
+| 7 = @long_type
+| 8 = @byte_type
+| 9 = @ushort_type
+| 10 = @uint_type
+| 11 = @ulong_type
+| 12 = @float_type
+| 13 = @double_type
+| 14 = @enum_type
+| 15 = @struct_type
+| 17 = @class_type
+| 19 = @interface_type
+| 20 = @delegate_type
+| 21 = @null_type
+| 22 = @type_parameter
+| 23 = @pointer_type
+| 24 = @nullable_type
+| 25 = @array_type
+| 26 = @void_type
+| 27 = @int_ptr_type
+| 28 = @uint_ptr_type
+| 29 = @dynamic_type
+| 30 = @arglist_type
+| 31 = @unknown_type
+| 32 = @tuple_type
+| 33 = @function_pointer_type
+| 34 = @inline_array_type
+| 35 = @extension_type
+ ;
+
+@simple_type = @bool_type | @char_type | @integral_type | @floating_point_type | @decimal_type;
+@integral_type = @signed_integral_type | @unsigned_integral_type;
+@signed_integral_type = @sbyte_type | @short_type | @int_type | @long_type;
+@unsigned_integral_type = @byte_type | @ushort_type | @uint_type | @ulong_type;
+@floating_point_type = @float_type | @double_type;
+@value_type = @simple_type | @enum_type | @struct_type | @nullable_type | @int_ptr_type
+ | @uint_ptr_type | @tuple_type | @void_type | @inline_array_type;
+@ref_type = @class_type | @interface_type | @array_type | @delegate_type | @null_type
+ | @dynamic_type | @extension_type;
+@value_or_ref_type = @value_type | @ref_type;
+
+typerefs(
+ unique int id: @typeref,
+ string name: string ref);
+
+typeref_type(
+ int id: @typeref ref,
+ unique int typeId: @type ref);
+
+@type_or_ref = @type | @typeref;
+
+array_element_type(
+ unique int array: @array_type ref,
+ int dimension: int ref,
+ int rank: int ref,
+ int element: @type_or_ref ref);
+
+nullable_underlying_type(
+ unique int nullable: @nullable_type ref,
+ int underlying: @type_or_ref ref);
+
+pointer_referent_type(
+ unique int pointer: @pointer_type ref,
+ int referent: @type_or_ref ref);
+
+enum_underlying_type(
+ unique int enum_id: @enum_type ref,
+ int underlying_type_id: @type_or_ref ref);
+
+delegate_return_type(
+ unique int delegate_id: @delegate_type ref,
+ int return_type_id: @type_or_ref ref);
+
+function_pointer_return_type(
+ unique int function_pointer_id: @function_pointer_type ref,
+ int return_type_id: @type_or_ref ref);
+
+extension_receiver_type(
+ unique int extension: @extension_type ref,
+ int receiver_type_id: @type_or_ref ref);
+
+extend(
+ int sub: @type ref,
+ int super: @type_or_ref ref);
+
+anonymous_types(
+ unique int id: @type ref);
+
+@interface_or_ref = @interface_type | @typeref;
+
+implement(
+ int sub: @type ref,
+ int super: @type_or_ref ref);
+
+type_location(
+ int id: @type ref,
+ int loc: @location ref);
+
+tuple_underlying_type(
+ unique int tuple: @tuple_type ref,
+ int struct: @type_or_ref ref);
+
+#keyset[tuple, index]
+tuple_element(
+ int tuple: @tuple_type ref,
+ int index: int ref,
+ unique int field: @field ref);
+
+attributes(
+ unique int id: @attribute,
+ int kind: int ref,
+ int type_id: @type_or_ref ref,
+ int target: @attributable ref);
+
+case @attribute.kind of
+ 0 = @attribute_default
+| 1 = @attribute_return
+| 2 = @attribute_assembly
+| 3 = @attribute_module
+;
+
+attribute_location(
+ int id: @attribute ref,
+ int loc: @location ref);
+
+@type_mention_parent = @element | @type_mention;
+
+type_mention(
+ unique int id: @type_mention,
+ int type_id: @type_or_ref ref,
+ int parent: @type_mention_parent ref);
+
+type_mention_location(
+ unique int id: @type_mention ref,
+ int loc: @location ref);
+
+@has_type_annotation = @assignable | @type_parameter | @callable | @expr | @delegate_type | @generic | @function_pointer_type;
+
+/**
+ * A direct annotation on an entity, for example `string? x;`.
+ *
+ * Annotations:
+ * 2 = reftype is not annotated "!"
+ * 3 = reftype is annotated "?"
+ * 4 = readonly ref type / in parameter
+ * 5 = ref type parameter, return or local variable
+ * 6 = out parameter
+ *
+ * Note that the annotation depends on the element it annotates.
+ * @assignable: The annotation is on the type of the assignable, for example the variable type.
+ * @type_parameter: The annotation is on the reftype constraint
+ * @callable: The annotation is on the return type
+ * @array_type: The annotation is on the element type
+ */
+type_annotation(int id: @has_type_annotation ref, int annotation: int ref);
+
+nullability(unique int nullability: @nullability, int kind: int ref);
+
+case @nullability.kind of
+ 0 = @oblivious
+| 1 = @not_annotated
+| 2 = @annotated
+;
+
+#keyset[parent, index]
+nullability_parent(int nullability: @nullability ref, int index: int ref, int parent: @nullability ref)
+
+type_nullability(int id: @has_type_annotation ref, int nullability: @nullability ref);
+
+/**
+ * The nullable flow state of an expression, as determined by Roslyn.
+ * 0 = none (default, not populated)
+ * 1 = not null
+ * 2 = maybe null
+ */
+expr_flowstate(unique int id: @expr ref, int state: int ref);
+
+/** GENERICS **/
+
+@generic = @type | @method | @local_function;
+
+type_parameters(
+ unique int id: @type_parameter ref,
+ int index: int ref,
+ int generic_id: @generic ref,
+ int variance: int ref /* none = 0, out = 1, in = 2 */);
+
+#keyset[constructed_id, index]
+type_arguments(
+ int id: @type_or_ref ref,
+ int index: int ref,
+ int constructed_id: @generic_or_ref ref);
+
+@generic_or_ref = @generic | @typeref;
+
+constructed_generic(
+ unique int constructed: @generic ref,
+ int generic: @generic_or_ref ref);
+
+type_parameter_constraints(
+ unique int id: @type_parameter_constraints,
+ int param_id: @type_parameter ref);
+
+type_parameter_constraints_location(
+ int id: @type_parameter_constraints ref,
+ int loc: @location ref);
+
+general_type_parameter_constraints(
+ int id: @type_parameter_constraints ref,
+ int kind: int ref /* class = 1, struct = 2, new = 3 */);
+
+specific_type_parameter_constraints(
+ int id: @type_parameter_constraints ref,
+ int base_id: @type_or_ref ref);
+
+specific_type_parameter_nullability(
+ int id: @type_parameter_constraints ref,
+ int base_id: @type_or_ref ref,
+ int nullability: @nullability ref);
+
+/** FUNCTION POINTERS */
+
+function_pointer_calling_conventions(
+ int id: @function_pointer_type ref,
+ int kind: int ref);
+
+#keyset[id, index]
+has_unmanaged_calling_conventions(
+ int id: @function_pointer_type ref,
+ int index: int ref,
+ int conv_id: @type_or_ref ref);
+
+/** MODIFIERS */
+
+@modifiable = @modifiable_direct | @event_accessor;
+
+@modifiable_direct = @member | @accessor | @local_function | @anonymous_function_expr;
+
+modifiers(
+ unique int id: @modifier,
+ string name: string ref);
+
+has_modifiers(
+ int id: @modifiable_direct ref,
+ int mod_id: @modifier ref);
+
+/** MEMBERS **/
+
+@member = @method | @constructor | @destructor | @field | @property | @event | @operator | @indexer | @type;
+
+@named_exprorstmt = @goto_stmt | @labeled_stmt | @expr;
+
+@virtualizable = @method | @property | @indexer | @event | @operator;
+
+exprorstmt_name(
+ unique int parent_id: @named_exprorstmt ref,
+ string name: string ref);
+
+nested_types(
+ unique int id: @type ref,
+ int declaring_type_id: @type ref,
+ int unbound_id: @type ref);
+
+properties(
+ unique int id: @property,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @property ref);
+
+property_location(
+ int id: @property ref,
+ int loc: @location ref);
+
+indexers(
+ unique int id: @indexer,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @indexer ref);
+
+indexer_location(
+ int id: @indexer ref,
+ int loc: @location ref);
+
+accessors(
+ unique int id: @accessor,
+ int kind: int ref,
+ string name: string ref,
+ int declaring_member_id: @member ref,
+ int unbound_id: @accessor ref);
+
+case @accessor.kind of
+ 1 = @getter
+| 2 = @setter
+ ;
+
+init_only_accessors(
+ unique int id: @accessor ref);
+
+accessor_location(
+ int id: @accessor ref,
+ int loc: @location ref);
+
+events(
+ unique int id: @event,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @event ref);
+
+event_location(
+ int id: @event ref,
+ int loc: @location ref);
+
+event_accessors(
+ unique int id: @event_accessor,
+ int kind: int ref,
+ string name: string ref,
+ int declaring_event_id: @event ref,
+ int unbound_id: @event_accessor ref);
+
+case @event_accessor.kind of
+ 1 = @add_event_accessor
+| 2 = @remove_event_accessor
+ ;
+
+event_accessor_location(
+ int id: @event_accessor ref,
+ int loc: @location ref);
+
+operators(
+ unique int id: @operator,
+ string name: string ref,
+ string symbol: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @operator ref);
+
+operator_location(
+ int id: @operator ref,
+ int loc: @location ref);
+
+constant_value(
+ int id: @variable ref,
+ string value: string ref);
+
+/** CALLABLES **/
+
+@callable = @method | @constructor | @destructor | @operator | @callable_accessor | @anonymous_function_expr | @local_function;
+
+@callable_accessor = @accessor | @event_accessor;
+
+methods(
+ unique int id: @method,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @method ref);
+
+method_location(
+ int id: @method ref,
+ int loc: @location ref);
+
+constructors(
+ unique int id: @constructor,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int unbound_id: @constructor ref);
+
+constructor_location(
+ int id: @constructor ref,
+ int loc: @location ref);
+
+destructors(
+ unique int id: @destructor,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int unbound_id: @destructor ref);
+
+destructor_location(
+ int id: @destructor ref,
+ int loc: @location ref);
+
+overrides(
+ int id: @callable ref,
+ int base_id: @callable ref);
+
+explicitly_implements(
+ int id: @member ref,
+ int interface_id: @interface_or_ref ref);
+
+local_functions(
+ unique int id: @local_function,
+ string name: string ref,
+ int return_type: @type ref,
+ int unbound_id: @local_function ref);
+
+local_function_stmts(
+ unique int fn: @local_function_stmt ref,
+ int stmt: @local_function ref);
+
+/** VARIABLES **/
+
+@variable = @local_scope_variable | @field;
+
+@local_scope_variable = @local_variable | @parameter;
+
+fields(
+ unique int id: @field,
+ int kind: int ref,
+ string name: string ref,
+ int declaring_type_id: @type ref,
+ int type_id: @type_or_ref ref,
+ int unbound_id: @field ref);
+
+case @field.kind of
+ 1 = @addressable_field
+| 2 = @constant
+ ;
+
+field_location(
+ int id: @field ref,
+ int loc: @location ref);
+
+localvars(
+ unique int id: @local_variable,
+ int kind: int ref,
+ string name: string ref,
+ int implicitly_typed: int ref /* 0 = no, 1 = yes */,
+ int type_id: @type_or_ref ref,
+ int parent_id: @local_var_decl_expr ref);
+
+case @local_variable.kind of
+ 1 = @addressable_local_variable
+| 2 = @local_constant
+| 3 = @local_variable_ref
+ ;
+
+localvar_location(
+ unique int id: @local_variable ref,
+ int loc: @location ref);
+
+@parameterizable = @callable | @delegate_type | @indexer | @function_pointer_type | @extension_type;
+
+#keyset[name, parent_id]
+#keyset[index, parent_id]
+params(
+ unique int id: @parameter,
+ string name: string ref,
+ int type_id: @type_or_ref ref,
+ int index: int ref,
+ int mode: int ref, /* value = 0, ref = 1, out = 2, params/array = 3, this = 4, in = 5, ref readonly = 6 */
+ int parent_id: @parameterizable ref,
+ int unbound_id: @parameter ref);
+
+param_location(
+ int id: @parameter ref,
+ int loc: @location ref);
+
+@has_scoped_annotation = @local_scope_variable
+
+scoped_annotation(
+ int id: @has_scoped_annotation ref,
+ int kind: int ref // scoped ref = 1, scoped value = 2
+ );
+
+/** STATEMENTS **/
+
+@exprorstmt_parent = @control_flow_element | @top_level_exprorstmt_parent;
+
+statements(
+ unique int id: @stmt,
+ int kind: int ref);
+
+#keyset[index, parent]
+stmt_parent(
+ unique int stmt: @stmt ref,
+ int index: int ref,
+ int parent: @control_flow_element ref);
+
+@top_level_stmt_parent = @callable;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+stmt_parent_top_level(
+ unique int stmt: @stmt ref,
+ int index: int ref,
+ int parent: @top_level_stmt_parent ref);
+
+case @stmt.kind of
+ 1 = @block_stmt
+| 2 = @expr_stmt
+| 3 = @if_stmt
+| 4 = @switch_stmt
+| 5 = @while_stmt
+| 6 = @do_stmt
+| 7 = @for_stmt
+| 8 = @foreach_stmt
+| 9 = @break_stmt
+| 10 = @continue_stmt
+| 11 = @goto_stmt
+| 12 = @goto_case_stmt
+| 13 = @goto_default_stmt
+| 14 = @throw_stmt
+| 15 = @return_stmt
+| 16 = @yield_stmt
+| 17 = @try_stmt
+| 18 = @checked_stmt
+| 19 = @unchecked_stmt
+| 20 = @lock_stmt
+| 21 = @using_block_stmt
+| 22 = @var_decl_stmt
+| 23 = @const_decl_stmt
+| 24 = @empty_stmt
+| 25 = @unsafe_stmt
+| 26 = @fixed_stmt
+| 27 = @label_stmt
+| 28 = @catch
+| 29 = @case_stmt
+| 30 = @local_function_stmt
+| 31 = @using_decl_stmt
+ ;
+
+@using_stmt = @using_block_stmt | @using_decl_stmt;
+
+@labeled_stmt = @label_stmt | @case;
+
+@decl_stmt = @var_decl_stmt | @const_decl_stmt | @using_decl_stmt;
+
+@cond_stmt = @if_stmt | @switch_stmt;
+
+@loop_stmt = @while_stmt | @do_stmt | @for_stmt | @foreach_stmt;
+
+@jump_stmt = @break_stmt | @goto_any_stmt | @continue_stmt | @throw_stmt | @return_stmt
+ | @yield_stmt;
+
+@goto_any_stmt = @goto_default_stmt | @goto_case_stmt | @goto_stmt;
+
+
+stmt_location(
+ unique int id: @stmt ref,
+ int loc: @location ref);
+
+catch_type(
+ unique int catch_id: @catch ref,
+ int type_id: @type_or_ref ref,
+ int kind: int ref /* explicit = 1, implicit = 2 */);
+
+foreach_stmt_info(
+ unique int id: @foreach_stmt ref,
+ int kind: int ref /* non-async = 1, async = 2 */);
+
+@foreach_symbol = @method | @property | @type_or_ref;
+
+#keyset[id, kind]
+foreach_stmt_desugar(
+ int id: @foreach_stmt ref,
+ int symbol: @foreach_symbol ref,
+ int kind: int ref /* GetEnumeratorMethod = 1, CurrentProperty = 2, MoveNextMethod = 3, DisposeMethod = 4, ElementType = 5 */);
+
+/** EXPRESSIONS **/
+
+expressions(
+ unique int id: @expr,
+ int kind: int ref,
+ int type_id: @type_or_ref ref);
+
+#keyset[index, parent]
+expr_parent(
+ unique int expr: @expr ref,
+ int index: int ref,
+ int parent: @control_flow_element ref);
+
+@top_level_expr_parent = @attribute | @field | @property | @indexer | @parameter | @directive_if | @directive_elif;
+
+@top_level_exprorstmt_parent = @top_level_expr_parent | @top_level_stmt_parent;
+
+// [index, parent] is not a keyset because the same parent may be compiled multiple times
+expr_parent_top_level(
+ unique int expr: @expr ref,
+ int index: int ref,
+ int parent: @top_level_exprorstmt_parent ref);
+
+case @expr.kind of
+/* literal */
+ 1 = @bool_literal_expr
+| 2 = @char_literal_expr
+| 3 = @decimal_literal_expr
+| 4 = @int_literal_expr
+| 5 = @long_literal_expr
+| 6 = @uint_literal_expr
+| 7 = @ulong_literal_expr
+| 8 = @float_literal_expr
+| 9 = @double_literal_expr
+| 10 = @utf16_string_literal_expr
+| 11 = @null_literal_expr
+/* primary & unary */
+| 12 = @this_access_expr
+| 13 = @base_access_expr
+| 14 = @local_variable_access_expr
+| 15 = @parameter_access_expr
+| 16 = @field_access_expr
+| 17 = @property_access_expr
+| 18 = @method_access_expr
+| 19 = @event_access_expr
+| 20 = @indexer_access_expr
+| 21 = @array_access_expr
+| 22 = @type_access_expr
+| 23 = @typeof_expr
+| 24 = @method_invocation_expr
+| 25 = @delegate_invocation_expr
+| 26 = @operator_invocation_expr
+| 27 = @cast_expr
+| 28 = @object_creation_expr
+| 29 = @explicit_delegate_creation_expr
+| 30 = @implicit_delegate_creation_expr
+| 31 = @array_creation_expr
+| 32 = @default_expr
+| 33 = @plus_expr
+| 34 = @minus_expr
+| 35 = @bit_not_expr
+| 36 = @log_not_expr
+| 37 = @post_incr_expr
+| 38 = @post_decr_expr
+| 39 = @pre_incr_expr
+| 40 = @pre_decr_expr
+/* multiplicative */
+| 41 = @mul_expr
+| 42 = @div_expr
+| 43 = @rem_expr
+/* additive */
+| 44 = @add_expr
+| 45 = @sub_expr
+/* shift */
+| 46 = @lshift_expr
+| 47 = @rshift_expr
+/* relational */
+| 48 = @lt_expr
+| 49 = @gt_expr
+| 50 = @le_expr
+| 51 = @ge_expr
+/* equality */
+| 52 = @eq_expr
+| 53 = @ne_expr
+/* logical */
+| 54 = @bit_and_expr
+| 55 = @bit_xor_expr
+| 56 = @bit_or_expr
+| 57 = @log_and_expr
+| 58 = @log_or_expr
+/* type testing */
+| 59 = @is_expr
+| 60 = @as_expr
+/* null coalescing */
+| 61 = @null_coalescing_expr
+/* conditional */
+| 62 = @conditional_expr
+/* assignment */
+| 63 = @simple_assign_expr
+| 64 = @assign_add_expr
+| 65 = @assign_sub_expr
+| 66 = @assign_mul_expr
+| 67 = @assign_div_expr
+| 68 = @assign_rem_expr
+| 69 = @assign_and_expr
+| 70 = @assign_xor_expr
+| 71 = @assign_or_expr
+| 72 = @assign_lshift_expr
+| 73 = @assign_rshift_expr
+/* more */
+| 74 = @object_init_expr
+| 75 = @collection_init_expr
+| 76 = @array_init_expr
+| 77 = @checked_expr
+| 78 = @unchecked_expr
+| 79 = @constructor_init_expr
+| 80 = @add_event_expr
+| 81 = @remove_event_expr
+| 82 = @par_expr
+| 83 = @local_var_decl_expr
+| 84 = @lambda_expr
+| 85 = @anonymous_method_expr
+| 86 = @namespace_expr
+/* dynamic */
+| 92 = @dynamic_element_access_expr
+| 93 = @dynamic_member_access_expr
+/* unsafe */
+| 100 = @pointer_indirection_expr
+| 101 = @address_of_expr
+| 102 = @sizeof_expr
+/* async */
+| 103 = @await_expr
+/* C# 6.0 */
+| 104 = @nameof_expr
+| 105 = @interpolated_string_expr
+| 106 = @unknown_expr
+/* C# 7.0 */
+| 107 = @throw_expr
+| 108 = @tuple_expr
+| 109 = @local_function_invocation_expr
+| 110 = @ref_expr
+| 111 = @discard_expr
+/* C# 8.0 */
+| 112 = @range_expr
+| 113 = @index_expr
+| 114 = @switch_expr
+| 115 = @recursive_pattern_expr
+| 116 = @property_pattern_expr
+| 117 = @positional_pattern_expr
+| 118 = @switch_case_expr
+| 119 = @assign_coalesce_expr
+| 120 = @suppress_nullable_warning_expr
+| 121 = @namespace_access_expr
+/* C# 9.0 */
+| 122 = @lt_pattern_expr
+| 123 = @gt_pattern_expr
+| 124 = @le_pattern_expr
+| 125 = @ge_pattern_expr
+| 126 = @not_pattern_expr
+| 127 = @and_pattern_expr
+| 128 = @or_pattern_expr
+| 129 = @function_pointer_invocation_expr
+| 130 = @with_expr
+/* C# 11.0 */
+| 131 = @list_pattern_expr
+| 132 = @slice_pattern_expr
+| 133 = @urshift_expr
+| 134 = @assign_urshift_expr
+| 135 = @utf8_string_literal_expr
+/* C# 12.0 */
+| 136 = @collection_expr
+| 137 = @spread_element_expr
+| 138 = @interpolated_string_insert_expr
+/* Preprocessor */
+| 999 = @define_symbol_expr
+;
+
+@switch = @switch_stmt | @switch_expr;
+@case = @case_stmt | @switch_case_expr;
+@pattern_match = @case | @is_expr;
+@unary_pattern_expr = @not_pattern_expr;
+@relational_pattern_expr = @gt_pattern_expr | @lt_pattern_expr | @ge_pattern_expr | @le_pattern_expr;
+@binary_pattern_expr = @and_pattern_expr | @or_pattern_expr;
+
+@integer_literal_expr = @int_literal_expr | @long_literal_expr | @uint_literal_expr | @ulong_literal_expr;
+@real_literal_expr = @float_literal_expr | @double_literal_expr | @decimal_literal_expr;
+@string_literal_expr = @utf16_string_literal_expr | @utf8_string_literal_expr;
+@literal_expr = @bool_literal_expr | @char_literal_expr | @integer_literal_expr | @real_literal_expr
+ | @string_literal_expr | @null_literal_expr;
+
+@assign_expr = @simple_assign_expr | @assign_op_expr | @local_var_decl_expr;
+@assign_op_call_expr = @assign_arith_expr | @assign_bitwise_expr
+@assign_op_expr = @assign_op_call_expr | @assign_event_expr | @assign_coalesce_expr;
+@assign_event_expr = @add_event_expr | @remove_event_expr;
+
+@add_operation = @add_expr | @assign_add_expr;
+@sub_operation = @sub_expr | @assign_sub_expr;
+@mul_operation = @mul_expr | @assign_mul_expr;
+@div_operation = @div_expr | @assign_div_expr;
+@rem_operation = @rem_expr | @assign_rem_expr;
+@and_operation = @bit_and_expr | @assign_and_expr;
+@xor_operation = @bit_xor_expr | @assign_xor_expr;
+@or_operation = @bit_or_expr | @assign_or_expr;
+@lshift_operation = @lshift_expr | @assign_lshift_expr;
+@rshift_operation = @rshift_expr | @assign_rshift_expr;
+@urshift_operation = @urshift_expr | @assign_urshift_expr;
+@null_coalescing_operation = @null_coalescing_expr | @assign_coalesce_expr;
+
+@assign_arith_expr = @assign_add_expr | @assign_sub_expr | @assign_mul_expr | @assign_div_expr
+ | @assign_rem_expr
+@assign_bitwise_expr = @assign_and_expr | @assign_or_expr | @assign_xor_expr
+ | @assign_lshift_expr | @assign_rshift_expr | @assign_urshift_expr;
+
+@member_access_expr = @field_access_expr | @property_access_expr | @indexer_access_expr | @event_access_expr
+ | @method_access_expr | @type_access_expr | @dynamic_member_access_expr;
+@access_expr = @member_access_expr | @this_access_expr | @base_access_expr | @assignable_access_expr | @namespace_access_expr;
+@element_access_expr = @indexer_access_expr | @array_access_expr | @dynamic_element_access_expr;
+
+@local_variable_access = @local_variable_access_expr | @local_var_decl_expr;
+@local_scope_variable_access_expr = @parameter_access_expr | @local_variable_access;
+@variable_access_expr = @local_scope_variable_access_expr | @field_access_expr;
+
+@assignable_access_expr = @variable_access_expr | @property_access_expr | @element_access_expr
+ | @event_access_expr | @dynamic_member_access_expr;
+
+@objectorcollection_init_expr = @object_init_expr | @collection_init_expr;
+
+@delegate_creation_expr = @explicit_delegate_creation_expr | @implicit_delegate_creation_expr;
+
+@bin_arith_op_expr = @mul_expr | @div_expr | @rem_expr | @add_expr | @sub_expr;
+@incr_op_expr = @pre_incr_expr | @post_incr_expr;
+@decr_op_expr = @pre_decr_expr | @post_decr_expr;
+@mut_op_expr = @incr_op_expr | @decr_op_expr;
+@un_arith_op_expr = @plus_expr | @minus_expr | @mut_op_expr;
+@arith_op_expr = @bin_arith_op_expr | @un_arith_op_expr;
+
+@ternary_log_op_expr = @conditional_expr;
+@bin_log_op_expr = @log_and_expr | @log_or_expr | @null_coalescing_expr;
+@un_log_op_expr = @log_not_expr;
+@log_expr = @un_log_op_expr | @bin_log_op_expr | @ternary_log_op_expr;
+
+@bin_bit_op_expr = @bit_and_expr | @bit_or_expr | @bit_xor_expr | @lshift_expr
+ | @rshift_expr | @urshift_expr;
+@un_bit_op_expr = @bit_not_expr;
+@bit_expr = @un_bit_op_expr | @bin_bit_op_expr;
+
+@equality_op_expr = @eq_expr | @ne_expr;
+@rel_op_expr = @gt_expr | @lt_expr| @ge_expr | @le_expr;
+@comp_expr = @equality_op_expr | @rel_op_expr;
+
+@op_expr = @un_op | @bin_op | @ternary_op;
+
+@ternary_op = @ternary_log_op_expr;
+@bin_op = @assign_expr | @bin_arith_op_expr | @bin_log_op_expr | @bin_bit_op_expr | @comp_expr;
+@un_op = @un_arith_op_expr | @un_log_op_expr | @un_bit_op_expr | @sizeof_expr
+ | @pointer_indirection_expr | @address_of_expr;
+
+@anonymous_function_expr = @lambda_expr | @anonymous_method_expr;
+
+@op_invoke_expr = @operator_invocation_expr | @assign_op_call_expr
+@call = @method_invocation_expr | @constructor_init_expr | @op_invoke_expr
+ | @delegate_invocation_expr | @object_creation_expr | @call_access_expr
+ | @local_function_invocation_expr | @function_pointer_invocation_expr;
+
+@call_access_expr = @property_access_expr | @event_access_expr | @indexer_access_expr;
+
+@late_bindable_expr = @dynamic_element_access_expr | @dynamic_member_access_expr
+ | @object_creation_expr | @method_invocation_expr | @op_invoke_expr;
+
+@throw_element = @throw_expr | @throw_stmt;
+
+@implicitly_typeable_object_creation_expr = @object_creation_expr | @explicit_delegate_creation_expr;
+
+implicitly_typed_array_creation(
+ unique int id: @array_creation_expr ref);
+
+explicitly_sized_array_creation(
+ unique int id: @array_creation_expr ref);
+
+stackalloc_array_creation(
+ unique int id: @array_creation_expr ref);
+
+implicitly_typed_object_creation(
+ unique int id: @implicitly_typeable_object_creation_expr ref);
+
+mutator_invocation_mode(
+ unique int id: @operator_invocation_expr ref,
+ int mode: int ref /* prefix = 1, postfix = 2*/);
+
+expr_value(
+ unique int id: @expr ref,
+ string value: string ref);
+
+expr_call(
+ unique int caller_id: @expr ref,
+ int target_id: @callable ref);
+
+expr_access(
+ unique int accesser_id: @access_expr ref,
+ int target_id: @accessible ref);
+
+@accessible = @method | @assignable | @local_function | @namespace;
+
+expr_location(
+ unique int id: @expr ref,
+ int loc: @location ref);
+
+dynamic_member_name(
+ unique int id: @late_bindable_expr ref,
+ string name: string ref);
+
+@qualifiable_expr = @member_access_expr
+ | @method_invocation_expr
+ | @element_access_expr
+ | @assign_op_call_expr;
+
+conditional_access(
+ unique int id: @qualifiable_expr ref);
+
+expr_argument(
+ unique int id: @expr ref,
+ int mode: int ref);
+ /* mode is the same as params: value = 0, ref = 1, out = 2 */
+
+expr_argument_name(
+ unique int id: @expr ref,
+ string name: string ref);
+
+lambda_expr_return_type(
+ unique int id: @lambda_expr ref,
+ int type_id: @type_or_ref ref);
+
+/* Compiler generated */
+
+compiler_generated(unique int id: @element ref);
+
+/** CONTROL/DATA FLOW **/
+
+@control_flow_element = @stmt | @expr | @parameter;
+
+/* XML Files */
+
+xmlEncoding (
+ unique int id: @file ref,
+ string encoding: string ref);
+
+xmlDTDs(
+ unique int id: @xmldtd,
+ string root: string ref,
+ string publicId: string ref,
+ string systemId: string ref,
+ int fileid: @file ref);
+
+xmlElements(
+ unique int id: @xmlelement,
+ string name: string ref,
+ int parentid: @xmlparent ref,
+ int idx: int ref,
+ int fileid: @file ref);
+
+xmlAttrs(
+ unique int id: @xmlattribute,
+ int elementid: @xmlelement ref,
+ string name: string ref,
+ string value: string ref,
+ int idx: int ref,
+ int fileid: @file ref);
+
+xmlNs(
+ int id: @xmlnamespace,
+ string prefixName: string ref,
+ string URI: string ref,
+ int fileid: @file ref);
+
+xmlHasNs(
+ int elementId: @xmlnamespaceable ref,
+ int nsId: @xmlnamespace ref,
+ int fileid: @file ref);
+
+xmlComments(
+ unique int id: @xmlcomment,
+ string text: string ref,
+ int parentid: @xmlparent ref,
+ int fileid: @file ref);
+
+xmlChars(
+ unique int id: @xmlcharacters,
+ string text: string ref,
+ int parentid: @xmlparent ref,
+ int idx: int ref,
+ int isCDATA: int ref,
+ int fileid: @file ref);
+
+@xmlparent = @file | @xmlelement;
+@xmlnamespaceable = @xmlelement | @xmlattribute;
+
+xmllocations(
+ int xmlElement: @xmllocatable ref,
+ int location: @location_default ref);
+
+@xmllocatable = @xmlcharacters | @xmlelement | @xmlcomment | @xmlattribute | @xmldtd | @file | @xmlnamespace;
+
+/* Comments */
+
+commentline(
+ unique int id: @commentline,
+ int kind: int ref,
+ string text: string ref,
+ string rawtext: string ref);
+
+case @commentline.kind of
+ 0 = @singlelinecomment
+| 1 = @xmldoccomment
+| 2 = @multilinecomment;
+
+commentline_location(
+ unique int id: @commentline ref,
+ int loc: @location ref);
+
+commentblock(
+ unique int id : @commentblock);
+
+commentblock_location(
+ unique int id: @commentblock ref,
+ int loc: @location ref);
+
+commentblock_binding(
+ int id: @commentblock ref,
+ int entity: @element ref,
+ int bindtype: int ref); /* 0: Parent, 1: Best, 2: Before, 3: After */
+
+commentblock_child(
+ int id: @commentblock ref,
+ int commentline: @commentline ref,
+ int index: int ref);
+
+/* ASP.NET */
+
+case @asp_element.kind of
+ 0=@asp_close_tag
+| 1=@asp_code
+| 2=@asp_comment
+| 3=@asp_data_binding
+| 4=@asp_directive
+| 5=@asp_open_tag
+| 6=@asp_quoted_string
+| 7=@asp_text
+| 8=@asp_xml_directive;
+
+@asp_attribute = @asp_code | @asp_data_binding | @asp_quoted_string;
+
+asp_elements(
+ unique int id: @asp_element,
+ int kind: int ref,
+ int loc: @location ref);
+
+asp_comment_server(unique int comment: @asp_comment ref);
+asp_code_inline(unique int code: @asp_code ref);
+asp_directive_attribute(
+ int directive: @asp_directive ref,
+ int index: int ref,
+ string name: string ref,
+ int value: @asp_quoted_string ref);
+asp_directive_name(
+ unique int directive: @asp_directive ref,
+ string name: string ref);
+asp_element_body(
+ unique int element: @asp_element ref,
+ string body: string ref);
+asp_tag_attribute(
+ int tag: @asp_open_tag ref,
+ int index: int ref,
+ string name: string ref,
+ int attribute: @asp_attribute ref);
+asp_tag_name(
+ unique int tag: @asp_open_tag ref,
+ string name: string ref);
+asp_tag_isempty(int tag: @asp_open_tag ref);
diff --git a/csharp/ql/lib/upgrades/ea7ad33252e550241975676f09fcc7b0a703deab/upgrade.properties b/csharp/ql/lib/upgrades/ea7ad33252e550241975676f09fcc7b0a703deab/upgrade.properties
new file mode 100644
index 000000000000..cd2dfa3d4d5d
--- /dev/null
+++ b/csharp/ql/lib/upgrades/ea7ad33252e550241975676f09fcc7b0a703deab/upgrade.properties
@@ -0,0 +1,2 @@
+description: Add `@parameter` to `@control_flow_element`
+compatibility: full
diff --git a/csharp/ql/src/Bad Practices/Control-Flow/ConstantCondition.ql b/csharp/ql/src/Bad Practices/Control-Flow/ConstantCondition.ql
index c1eb996863c5..295bdba1f7af 100644
--- a/csharp/ql/src/Bad Practices/Control-Flow/ConstantCondition.ql
+++ b/csharp/ql/src/Bad Practices/Control-Flow/ConstantCondition.ql
@@ -16,12 +16,11 @@
import csharp
import semmle.code.csharp.commons.Assertions
import semmle.code.csharp.commons.Constants
-import semmle.code.csharp.controlflow.BasicBlocks
import semmle.code.csharp.controlflow.Guards as Guards
import codeql.controlflow.queries.ConstantCondition as ConstCond
-module ConstCondInput implements ConstCond::InputSig {
- class SsaDefinition = Ssa::Definition;
+module ConstCondInput implements ConstCond::InputSig {
+ class SsaDefinition = Ssa::SsaDefinition;
class GuardValue = Guards::GuardValue;
diff --git a/csharp/ql/src/CHANGELOG.md b/csharp/ql/src/CHANGELOG.md
index fc0f8c58d794..8c4388fe2bb6 100644
--- a/csharp/ql/src/CHANGELOG.md
+++ b/csharp/ql/src/CHANGELOG.md
@@ -1,3 +1,20 @@
+## 1.7.3
+
+No user-facing changes.
+
+## 1.7.2
+
+No user-facing changes.
+
+## 1.7.1
+
+### Minor Analysis Improvements
+
+* The query `cs/useless-tostring-call` has been updated to avoid false
+ positive results in calls to `StringBuilder.AppendLine` and calls of
+ the form `base.ToString()`. Moreover, the alert message has been
+ made more precise.
+
## 1.7.0
### Query Metadata Changes
diff --git a/csharp/ql/src/Concurrency/UnsynchronizedStaticAccess.ql b/csharp/ql/src/Concurrency/UnsynchronizedStaticAccess.ql
index 150ae78ae090..340663c6701f 100644
--- a/csharp/ql/src/Concurrency/UnsynchronizedStaticAccess.ql
+++ b/csharp/ql/src/Concurrency/UnsynchronizedStaticAccess.ql
@@ -22,22 +22,32 @@ predicate correctlySynchronized(CollectionMember c, Expr access) {
(
c.getType().(ValueOrRefType).getABaseType*().getName().matches("Concurrent%") or
access.getEnclosingStmt().getParent*() instanceof LockStmt or
- any(LockingCall call).getAControlFlowNode().getASuccessor+() = access.getAControlFlowNode()
+ any(LockingCall call).getControlFlowNode().getASuccessor+() = access.getControlFlowNode()
)
}
-ControlFlow::Node unlockedReachable(Callable a) {
- result = a.getEntryPoint()
+predicate firstLockingCallInBlock(BasicBlock b, int i) {
+ i = min(int j | b.getNode(j).asExpr() instanceof LockingCall)
+}
+
+BasicBlock unlockedReachable(Callable a) {
+ result = a.getEntryPoint().getBasicBlock()
or
- exists(ControlFlow::Node mid | mid = unlockedReachable(a) |
- not mid.getAstNode() instanceof LockingCall and
+ exists(BasicBlock mid | mid = unlockedReachable(a) |
+ not firstLockingCallInBlock(mid, _) and
result = mid.getASuccessor()
)
}
predicate unlockedCalls(Callable a, Callable b) {
- exists(Call call |
- call.getAControlFlowNode() = unlockedReachable(a) and
+ exists(Call call, BasicBlock callBlock, int j |
+ call.getControlFlowNode() = callBlock.getNode(j) and
+ callBlock = unlockedReachable(a) and
+ (
+ exists(int i | j <= i and firstLockingCallInBlock(callBlock, i))
+ or
+ not firstLockingCallInBlock(callBlock, _)
+ ) and
call.getARuntimeTarget() = b and
not call.getParent*() instanceof LockStmt
)
diff --git a/csharp/ql/src/Dead Code/DeadStoreOfLocal.ql b/csharp/ql/src/Dead Code/DeadStoreOfLocal.ql
index 59816a18b3fb..cf57707608b4 100644
--- a/csharp/ql/src/Dead Code/DeadStoreOfLocal.ql
+++ b/csharp/ql/src/Dead Code/DeadStoreOfLocal.ql
@@ -92,7 +92,7 @@ class RelevantDefinition extends AssignableDefinition {
private predicate isMaybeLive() {
exists(LocalVariable v | v = this.getTarget() |
// SSA definitions are only created for live variables
- this = any(Ssa::ExplicitDefinition ssaDef).getADefinition()
+ this = any(SsaExplicitWrite ssaDef).getDefinition()
or
mayEscape(v)
or
@@ -131,7 +131,7 @@ class RelevantDefinition extends AssignableDefinition {
/** Holds if this definition is dead and we want to report it. */
predicate isDead() {
// Ensure that the definition is not in dead code
- exists(this.getExpr().getAControlFlowNode()) and
+ exists(this.getExpr().getControlFlowNode()) and
not this.isMaybeLive() and
// Allow dead initializer assignments, such as `string s = string.Empty`, but only
// if the initializer expression assigns a default-like value, and there exists another
diff --git a/csharp/ql/src/Dead Code/NonAssignedFields.ql b/csharp/ql/src/Dead Code/NonAssignedFields.ql
index 83aa889b77c7..b9e868097493 100644
--- a/csharp/ql/src/Dead Code/NonAssignedFields.ql
+++ b/csharp/ql/src/Dead Code/NonAssignedFields.ql
@@ -84,9 +84,9 @@ where
not f.getDeclaringType() instanceof Enum and
not f.getType() instanceof Struct and
not exists(Assignment ae, Field g |
- ae.getLValue().(FieldAccess).getTarget() = g and
+ ae.getLeftOperand().(FieldAccess).getTarget() = g and
g.getUnboundDeclaration() = f and
- not ae.getRValue() instanceof NullLiteral
+ not ae.getRightOperand() instanceof NullLiteral
) and
not exists(MethodCall mc, int i, Field g |
exists(Parameter p | mc.getTarget().getParameter(i) = p | p.isOut() or p.isRef()) and
@@ -101,7 +101,7 @@ where
not init instanceof NullLiteral
) and
not exists(AssignOperation ua, Field g |
- ua.getLValue().(FieldAccess).getTarget() = g and
+ ua.getLeftOperand().(FieldAccess).getTarget() = g and
g.getUnboundDeclaration() = f
) and
not exists(MutatorOperation op |
diff --git a/csharp/ql/src/Language Abuse/ForeachCapture.ql b/csharp/ql/src/Language Abuse/ForeachCapture.ql
index 03f1f99a044c..2ed24b42eba9 100644
--- a/csharp/ql/src/Language Abuse/ForeachCapture.ql
+++ b/csharp/ql/src/Language Abuse/ForeachCapture.ql
@@ -60,16 +60,16 @@ module LambdaDataFlow {
}
Element getAssignmentTarget(Expr e) {
- exists(Assignment a | a.getRValue() = e |
- result = a.getLValue().(PropertyAccess).getTarget() or
- result = a.getLValue().(FieldAccess).getTarget() or
- result = a.getLValue().(LocalVariableAccess).getTarget() or
- result = a.getLValue().(EventAccess).getTarget()
+ exists(Assignment a | a.getRightOperand() = e |
+ result = a.getLeftOperand().(PropertyAccess).getTarget() or
+ result = a.getLeftOperand().(FieldAccess).getTarget() or
+ result = a.getLeftOperand().(LocalVariableAccess).getTarget() or
+ result = a.getLeftOperand().(EventAccess).getTarget()
)
or
exists(AddEventExpr aee |
- e = aee.getRValue() and
- result = aee.getLValue().getTarget()
+ e = aee.getRightOperand() and
+ result = aee.getLeftOperand().getTarget()
)
or
result = getCollectionAssignmentTarget(e)
@@ -97,8 +97,8 @@ Element getCollectionAssignmentTarget(Expr e) {
// Store values using indexer
exists(IndexerAccess ia, AssignExpr ae |
ia.getQualifier() = result.(Variable).getAnAccess() and
- ia = ae.getLValue() and
- e = ae.getRValue()
+ ia = ae.getLeftOperand() and
+ e = ae.getRightOperand()
)
}
diff --git a/csharp/ql/src/Language Abuse/MissedTernaryOpportunity.ql b/csharp/ql/src/Language Abuse/MissedTernaryOpportunity.ql
index bd7492b8583e..01d6baa95732 100644
--- a/csharp/ql/src/Language Abuse/MissedTernaryOpportunity.ql
+++ b/csharp/ql/src/Language Abuse/MissedTernaryOpportunity.ql
@@ -15,7 +15,7 @@ import csharp
import semmle.code.csharp.commons.StructuralComparison
private Expr getAssignedExpr(Stmt stmt) {
- result = stmt.stripSingletonBlocks().(ExprStmt).getExpr().(AssignExpr).getLValue()
+ result = stmt.stripSingletonBlocks().(ExprStmt).getExpr().(AssignExpr).getLeftOperand()
}
from IfStmt is, string what
diff --git a/csharp/ql/src/Likely Bugs/BadCheckOdd.ql b/csharp/ql/src/Likely Bugs/BadCheckOdd.ql
index 34ae4b632aec..72924f9103d8 100644
--- a/csharp/ql/src/Likely Bugs/BadCheckOdd.ql
+++ b/csharp/ql/src/Likely Bugs/BadCheckOdd.ql
@@ -13,7 +13,7 @@
import csharp
predicate isDefinitelyPositive(Expr e) {
- e.getValue().toInt() >= 0 or
+ e.getIntValue() >= 0 or
e.(PropertyAccess).getTarget().hasName("Length") or
e.(MethodCall).getTarget().hasUndecoratedName("Count")
}
@@ -23,12 +23,12 @@ where
t.getLeftOperand() = lhs and
t.getRightOperand() = rhs and
not isDefinitelyPositive(lhs.getLeftOperand().stripCasts()) and
- lhs.getRightOperand().(IntegerLiteral).getValue() = "2" and
+ lhs.getRightOperand().(IntegerLiteral).getIntValue() = 2 and
(
- t instanceof EQExpr and rhs.getValue() = "1" and parity = "oddness"
+ t instanceof EQExpr and rhs.getIntValue() = 1 and parity = "oddness"
or
- t instanceof NEExpr and rhs.getValue() = "1" and parity = "evenness"
+ t instanceof NEExpr and rhs.getIntValue() = 1 and parity = "evenness"
or
- t instanceof GTExpr and rhs.getValue() = "0" and parity = "oddness"
+ t instanceof GTExpr and rhs.getIntValue() = 0 and parity = "oddness"
)
select t, "Possibly invalid test for " + parity + ". This will fail for negative numbers."
diff --git a/csharp/ql/src/Likely Bugs/Collections/WriteOnlyContainer.ql b/csharp/ql/src/Likely Bugs/Collections/WriteOnlyContainer.ql
index 5fcb140e6791..046099213cc6 100644
--- a/csharp/ql/src/Likely Bugs/Collections/WriteOnlyContainer.ql
+++ b/csharp/ql/src/Likely Bugs/Collections/WriteOnlyContainer.ql
@@ -23,9 +23,10 @@ where
) and
forex(Access a | a = v.getAnAccess() |
a = any(ModifierMethodCall m).getQualifier() or
- a = any(AssignExpr ass | ass.getRValue() instanceof ObjectCreation).getLValue() or
+ a = any(AssignExpr ass | ass.getRightOperand() instanceof ObjectCreation).getLeftOperand() or
a =
- any(LocalVariableDeclAndInitExpr ass | ass.getRValue() instanceof ObjectCreation).getLValue()
+ any(LocalVariableDeclAndInitExpr ass | ass.getRightOperand() instanceof ObjectCreation)
+ .getLeftOperand()
) and
not v = any(ForeachStmt fs).getVariable() and
not v = any(BindingPatternExpr vpe).getVariableDeclExpr().getVariable() and
diff --git a/csharp/ql/src/Likely Bugs/Dynamic/BadDynamicCall.ql b/csharp/ql/src/Likely Bugs/Dynamic/BadDynamicCall.ql
index 75f152b38de1..afb44727e34f 100644
--- a/csharp/ql/src/Likely Bugs/Dynamic/BadDynamicCall.ql
+++ b/csharp/ql/src/Likely Bugs/Dynamic/BadDynamicCall.ql
@@ -36,17 +36,16 @@ abstract class BadDynamicCall extends DynamicExpr {
}
private Type possibleTypeForRelevantSource(Variable v, int i, Expr source) {
- exists(AssignableRead read, Ssa::Definition ssaDef, Ssa::ExplicitDefinition ultimateSsaDef |
+ exists(AssignableRead read, SsaDefinition ssaDef, SsaExplicitWrite ultimateSsaDef |
read = this.getARelevantVariableAccess(i) and
v = read.getTarget() and
result = source.getType() and
read = ssaDef.getARead() and
ultimateSsaDef = ssaDef.getAnUltimateDefinition()
|
- ultimateSsaDef.getADefinition() =
- any(AssignableDefinition def | source = def.getSource().stripImplicit())
+ ultimateSsaDef.getValue().stripImplicit() = source
or
- ultimateSsaDef.getADefinition() =
+ ultimateSsaDef.getDefinition() =
any(AssignableDefinitions::ImplicitParameterDefinition p |
source = p.getParameter().getAnAssignedValue().stripImplicit()
)
diff --git a/csharp/ql/src/Likely Bugs/MishandlingJapaneseEra.ql b/csharp/ql/src/Likely Bugs/MishandlingJapaneseEra.ql
index c8df36bf7bf2..3e54a3a00dbd 100644
--- a/csharp/ql/src/Likely Bugs/MishandlingJapaneseEra.ql
+++ b/csharp/ql/src/Likely Bugs/MishandlingJapaneseEra.ql
@@ -27,8 +27,8 @@ predicate isExactEraStartDateCreation(ObjectCreation cr) {
cr.getType().hasFullyQualifiedName("System", "DateTime") or
cr.getType().hasFullyQualifiedName("System", "DateTimeOffset")
) and
- isEraStart(cr.getArgument(0).getValue().toInt(), cr.getArgument(1).getValue().toInt(),
- cr.getArgument(2).getValue().toInt())
+ isEraStart(cr.getArgument(0).getIntValue(), cr.getArgument(1).getIntValue(),
+ cr.getArgument(2).getIntValue())
}
predicate isDateFromJapaneseCalendarToDateTime(MethodCall mc) {
@@ -44,7 +44,7 @@ predicate isDateFromJapaneseCalendarToDateTime(MethodCall mc) {
mc.getNumberOfArguments() = 7 // implicitly current era
or
mc.getNumberOfArguments() = 8 and
- mc.getArgument(7).getValue() = "0"
+ mc.getArgument(7).getIntValue() = 0
) // explicitly current era
}
diff --git a/csharp/ql/src/Likely Bugs/NestedLoopsSameVariable.ql b/csharp/ql/src/Likely Bugs/NestedLoopsSameVariable.ql
index 0831eb561997..d616c2377c3f 100644
--- a/csharp/ql/src/Likely Bugs/NestedLoopsSameVariable.ql
+++ b/csharp/ql/src/Likely Bugs/NestedLoopsSameVariable.ql
@@ -80,21 +80,20 @@ class NestedForLoopSameVariable extends ForStmt {
}
/** Finds elements inside the outer loop that are no longer guarded by the loop invariant. */
- private ControlFlow::Node getAnUnguardedNode() {
+ private ControlFlowNode getAnUnguardedNode() {
hasChild(this.getOuterForStmt().getBody(), result.getAstNode()) and
(
- result =
- this.getCondition().(ControlFlowElement).getAControlFlowExitNode().getAFalseSuccessor()
+ result.isAfterFalse(this.getCondition())
or
- exists(ControlFlow::Node mid | mid = this.getAnUnguardedNode() |
+ exists(ControlFlowNode mid | mid = this.getAnUnguardedNode() |
mid.getASuccessor() = result and
- not exists(this.getAComparisonTest(result.getAstNode()))
+ not exists(this.getAComparisonTest(result.asExpr()))
)
)
}
private VariableAccess getAnUnguardedAccess() {
- result = this.getAnUnguardedNode().getAstNode() and
+ result = this.getAnUnguardedNode().asExpr() and
result.getTarget() = iteration
}
}
diff --git a/csharp/ql/src/Likely Bugs/PossibleLossOfPrecision.ql b/csharp/ql/src/Likely Bugs/PossibleLossOfPrecision.ql
index 8b719bb92a57..1c41d24fb3c1 100644
--- a/csharp/ql/src/Likely Bugs/PossibleLossOfPrecision.ql
+++ b/csharp/ql/src/Likely Bugs/PossibleLossOfPrecision.ql
@@ -40,8 +40,8 @@ predicate convertedToFloatOrDecimal(Expr e, Type t) {
/** Holds if `div` is an exact integer division. */
predicate exactDivision(DivExpr div) {
exists(int numerator, int denominator |
- numerator = div.getNumerator().stripCasts().getValue().toInt() and
- denominator = div.getDenominator().stripCasts().getValue().toInt() and
+ numerator = div.getNumerator().stripCasts().getIntValue() and
+ denominator = div.getDenominator().stripCasts().getIntValue() and
numerator % denominator = 0
)
}
diff --git a/csharp/ql/src/Likely Bugs/SelfAssignment.ql b/csharp/ql/src/Likely Bugs/SelfAssignment.ql
index f01a1378242e..6e51b87a779f 100644
--- a/csharp/ql/src/Likely Bugs/SelfAssignment.ql
+++ b/csharp/ql/src/Likely Bugs/SelfAssignment.ql
@@ -19,7 +19,7 @@ private predicate candidate(AssignExpr ae) {
not ae instanceof MemberInitializer and
// Enum field initializers are never self assignments. `enum E { A = 42 }`
not ae.getParent().(Field).getDeclaringType() instanceof Enum and
- forall(Expr e | e = ae.getLValue().getAChildExpr*() |
+ forall(Expr e | e = ae.getLeftOperand().getAChildExpr*() |
// Non-trivial property accesses may have side-effects,
// so these are not considered
e instanceof PropertyAccess implies e instanceof TrivialPropertyAccess
@@ -28,7 +28,7 @@ private predicate candidate(AssignExpr ae) {
private predicate selfAssignExpr(AssignExpr ae) {
candidate(ae) and
- sameGvn(ae.getLValue(), ae.getRValue())
+ sameGvn(ae.getLeftOperand(), ae.getRightOperand())
}
private Declaration getDeclaration(Expr e) {
@@ -40,5 +40,5 @@ private Declaration getDeclaration(Expr e) {
}
from AssignExpr ae, Declaration target
-where selfAssignExpr(ae) and target = getDeclaration(ae.getLValue())
+where selfAssignExpr(ae) and target = getDeclaration(ae.getLeftOperand())
select ae, "This assignment assigns $@ to itself.", target, target.getName()
diff --git a/csharp/ql/src/Likely Bugs/Statements/UseBraces.ql b/csharp/ql/src/Likely Bugs/Statements/UseBraces.ql
index f639b060ac17..39f0bfddf6aa 100644
--- a/csharp/ql/src/Likely Bugs/Statements/UseBraces.ql
+++ b/csharp/ql/src/Likely Bugs/Statements/UseBraces.ql
@@ -15,15 +15,15 @@
import csharp
// Iterate the control flow until we reach a Stmt
-Stmt findSuccessorStmt(ControlFlow::Node n) {
- result = n.getAstNode()
+Stmt findSuccessorStmt(ControlFlowNode n) {
+ result = n.asStmt()
or
- not n.getAstNode() instanceof Stmt and result = findSuccessorStmt(n.getASuccessor())
+ not exists(n.asStmt()) and result = findSuccessorStmt(n.getASuccessor())
}
// Return a successor statement to s
Stmt getASuccessorStmt(Stmt s) {
- result = findSuccessorStmt(s.getAControlFlowNode().getASuccessor())
+ result = findSuccessorStmt(s.getControlFlowNode().getASuccessor())
}
class IfThenStmt extends IfStmt {
diff --git a/csharp/ql/src/Likely Bugs/UncheckedCastInEquals.ql b/csharp/ql/src/Likely Bugs/UncheckedCastInEquals.ql
index 5c11a77f30df..0b87b12041a0 100644
--- a/csharp/ql/src/Likely Bugs/UncheckedCastInEquals.ql
+++ b/csharp/ql/src/Likely Bugs/UncheckedCastInEquals.ql
@@ -13,20 +13,15 @@
import csharp
import semmle.code.csharp.frameworks.System
-private predicate equalsMethodChild(EqualsMethod equals, Element child) {
- child = equals
+pragma[nomagic]
+predicate nodeBeforeParameterAccess(ControlFlowNode node) {
+ exists(EqualsMethod equals | equals.getBody().getControlFlowNode() = node)
or
- equalsMethodChild(equals, child.getParent())
-}
-
-predicate nodeBeforeParameterAccess(ControlFlow::Node node) {
- exists(EqualsMethod equals | equals.getBody() = node.getAstNode())
- or
- exists(EqualsMethod equals, Parameter param, ControlFlow::Node mid |
+ exists(EqualsMethod equals, Parameter param, ControlFlowNode mid |
equals.getParameter(0) = param and
- equalsMethodChild(equals, mid.getAstNode()) and
+ equals = mid.getEnclosingCallable() and
nodeBeforeParameterAccess(mid) and
- not param.getAnAccess() = mid.getAstNode() and
+ not param.getAnAccess().getControlFlowNode() = mid and
mid.getASuccessor() = node
)
}
@@ -35,5 +30,5 @@ from ParameterAccess access, CastExpr cast
where
access = cast.getAChild() and
access.getTarget().getDeclaringElement() = access.getEnclosingCallable() and
- nodeBeforeParameterAccess(access.getAControlFlowNode())
+ nodeBeforeParameterAccess(access.getControlFlowNode())
select cast, "Equals() method does not check argument type."
diff --git a/csharp/ql/src/Linq/BadMultipleIteration.ql b/csharp/ql/src/Linq/BadMultipleIteration.ql
index 8146bbf167d8..0f9e335e2251 100644
--- a/csharp/ql/src/Linq/BadMultipleIteration.ql
+++ b/csharp/ql/src/Linq/BadMultipleIteration.ql
@@ -50,7 +50,7 @@ predicate potentiallyConsumingAccess(VariableAccess va) {
Expr sequenceSource(IEnumerableSequence seq) {
result = seq.getInitializer()
or
- exists(Assignment a | a.getLValue() = seq.getAnAccess() and result = a.getRValue())
+ exists(Assignment a | a.getLeftOperand() = seq.getAnAccess() and result = a.getRightOperand())
}
from IEnumerableSequence seq, VariableAccess va
diff --git a/csharp/ql/src/Performance/StringBuilderInLoop.ql b/csharp/ql/src/Performance/StringBuilderInLoop.ql
index f1f23ebf5e0d..1f7e24988ceb 100644
--- a/csharp/ql/src/Performance/StringBuilderInLoop.ql
+++ b/csharp/ql/src/Performance/StringBuilderInLoop.ql
@@ -13,10 +13,10 @@
import csharp
import semmle.code.csharp.frameworks.system.Text
-from ObjectCreation creation, LoopStmt loop, ControlFlow::Node loopEntryNode
+from ObjectCreation creation, LoopStmt loop, ControlFlowNode loopEntryNode
where
creation.getType() instanceof SystemTextStringBuilderClass and
- loopEntryNode = loop.getBody().getAControlFlowEntryNode() and
+ loopEntryNode.isBefore(loop.getBody()) and
loop.getBody().getAChild*() = creation and
- creation.getAControlFlowNode().postDominates(loopEntryNode)
+ creation.getControlFlowNode().postDominates(loopEntryNode)
select creation, "Creating a 'StringBuilder' in a loop."
diff --git a/csharp/ql/src/Performance/StringConcatenationInLoop.ql b/csharp/ql/src/Performance/StringConcatenationInLoop.ql
index 3b3228588a4b..d27b99e7bdd0 100644
--- a/csharp/ql/src/Performance/StringConcatenationInLoop.ql
+++ b/csharp/ql/src/Performance/StringConcatenationInLoop.ql
@@ -24,7 +24,7 @@ class StringCat extends AddExpr {
*/
predicate isSelfConcatAssignExpr(AssignExpr e, Variable v) {
exists(VariableAccess use |
- stringCatContains(e.getRValue(), use) and
+ stringCatContains(e.getRightOperand(), use) and
use.getTarget() = e.getTargetVariable() and
v = use.getTarget()
)
@@ -41,7 +41,7 @@ predicate stringCatContains(StringCat expr, Expr child) {
* where `v` is a simple variable (and not, for example, a property).
*/
predicate isConcatExpr(AssignAddExpr e, Variable v) {
- e.getLValue().getType() instanceof StringType and
+ e.getLeftOperand().getType() instanceof StringType and
v = e.getTargetVariable()
}
diff --git a/csharp/ql/src/Security Features/CWE-1004/CookieWithoutHttpOnly.ql b/csharp/ql/src/Security Features/CWE-1004/CookieWithoutHttpOnly.ql
index dcc520540bb0..f72de01b5db2 100644
--- a/csharp/ql/src/Security Features/CWE-1004/CookieWithoutHttpOnly.ql
+++ b/csharp/ql/src/Security Features/CWE-1004/CookieWithoutHttpOnly.ql
@@ -27,8 +27,8 @@ predicate cookieAppendHttpOnlyByDefault() {
predicate httpOnlyFalse(ObjectCreation oc) {
exists(Assignment a |
- getAValueForProp(oc, a, "HttpOnly") = a.getRValue() and
- a.getRValue().getValue() = "false"
+ getAValueForProp(oc, a, "HttpOnly") = a.getRightOperand() and
+ a.getRightOperand().getValue() = "false"
)
}
@@ -100,8 +100,8 @@ predicate nonHttpOnlyCookieBuilderAssignment(Assignment a, Expr val) {
MicrosoftAspNetCoreAuthenticationCookiesCookieAuthenticationOptions
) and
pw.getProperty().getName() = "HttpOnly" and
- a.getLValue() = pw and
- DataFlow::localExprFlow(val, a.getRValue())
+ a.getLeftOperand() = pw and
+ DataFlow::localExprFlow(val, a.getRightOperand())
)
}
@@ -111,7 +111,7 @@ where
nonHttpOnlyCookieCall(httpOnlySink)
or
exists(Assignment a |
- httpOnlySink = a.getRValue() and
+ httpOnlySink = a.getRightOperand() and
nonHttpOnlyCookieBuilderAssignment(a, _)
)
)
diff --git a/csharp/ql/src/Security Features/CWE-327/InsecureSQLConnection.ql b/csharp/ql/src/Security Features/CWE-327/InsecureSQLConnection.ql
index 710228ffc0ef..eaee12a731a8 100644
--- a/csharp/ql/src/Security Features/CWE-327/InsecureSQLConnection.ql
+++ b/csharp/ql/src/Security Features/CWE-327/InsecureSQLConnection.ql
@@ -39,7 +39,12 @@ class Sink extends DataFlow::Node {
or
oc.getType().getName() = "SqlConnection"
) and
- version = oc.getType().getALocation().(Assembly).getVersion()
+ version = oc.getType().getALocation().(Assembly).getVersion() and
+ not exists(MemberInitializer mi |
+ mi = oc.getInitializer().(ObjectInitializer).getAMemberInitializer() and
+ mi.getLeftOperand().(PropertyAccess).getTarget().getName() = "Encrypt" and
+ mi.getRightOperand().(BoolLiteral).getValue() = "true"
+ )
)
}
diff --git a/csharp/ql/src/Security Features/CWE-384/AbandonSession.ql b/csharp/ql/src/Security Features/CWE-384/AbandonSession.ql
index c350c8f37554..2654b48c233f 100644
--- a/csharp/ql/src/Security Features/CWE-384/AbandonSession.ql
+++ b/csharp/ql/src/Security Features/CWE-384/AbandonSession.ql
@@ -56,18 +56,18 @@ predicate sessionUse(MemberAccess ma) {
}
/** A control flow step that is not sanitised by a call to clear the session. */
-predicate controlStep(ControlFlow::Node s1, ControlFlow::Node s2) {
+predicate controlStep(ControlFlowNode s1, ControlFlowNode s2) {
s2 = s1.getASuccessor() and
- not sessionEndMethod(s2.getAstNode().(MethodCall).getTarget())
+ not sessionEndMethod(s2.asExpr().(MethodCall).getTarget())
}
from
- ControlFlow::Node loginCall, Method loginMethod, ControlFlow::Node sessionUse,
+ ControlFlowNode loginCall, Method loginMethod, ControlFlowNode sessionUse,
ControlFlow::SuccessorType fromLoginFlow
where
- loginMethod = loginCall.getAstNode().(MethodCall).getTarget() and
+ loginMethod = loginCall.asExpr().(MethodCall).getTarget() and
loginMethod(loginMethod, fromLoginFlow) and
- sessionUse(sessionUse.getAstNode()) and
- controlStep+(loginCall.getASuccessorByType(fromLoginFlow), sessionUse)
+ sessionUse(sessionUse.asExpr()) and
+ controlStep+(loginCall.getASuccessor(fromLoginFlow), sessionUse)
select sessionUse, "This session has not been invalidated following the call to $@.", loginCall,
loginMethod.getName()
diff --git a/csharp/ql/src/Security Features/CWE-502/UnsafeDeserialization.qhelp b/csharp/ql/src/Security Features/CWE-502/UnsafeDeserialization.qhelp
index 3c68b74a1d92..4cc76003fbf8 100644
--- a/csharp/ql/src/Security Features/CWE-502/UnsafeDeserialization.qhelp
+++ b/csharp/ql/src/Security Features/CWE-502/UnsafeDeserialization.qhelp
@@ -7,6 +7,17 @@
Deserializing an object from untrusted input may result in security problems, such
as denial of service or remote code execution.
+
+Note that a deserialization method is only dangerous if it can instantiate
+arbitrary classes. Serialization frameworks that use a schema to instantiate
+only expected, predefined types are generally not tracked by this query. Such
+frameworks are generally safe with respect to arbitrary-class-instantiation and
+gadget-chain attacks when the schema is trusted and does not permit
+user-controlled type resolution. However, care must be taken to ensure the schema
+strictly limits the allowed types. Permitting common standard library classes
+can still leave the application vulnerable to gadget-chain attacks.
+
Deserializing an object from untrusted input may result in security problems, such
as denial of service or remote code execution.
+
+Note that a deserialization method is only dangerous if it can instantiate
+arbitrary classes. Serialization frameworks that use a schema to instantiate
+only expected, predefined types are generally not tracked by this query. Such
+frameworks are generally safe with respect to arbitrary-class-instantiation and
+gadget-chain attacks when the schema is trusted and does not permit
+user-controlled type resolution. However, care must be taken to ensure the schema
+strictly limits the allowed types. Permitting common standard library classes
+can still leave the application vulnerable to gadget-chain attacks.
+
+
diff --git a/csharp/ql/src/Security Features/CWE-614/CookieWithoutSecure.ql b/csharp/ql/src/Security Features/CWE-614/CookieWithoutSecure.ql
index ce1f75d627c7..1149b4bcad24 100644
--- a/csharp/ql/src/Security Features/CWE-614/CookieWithoutSecure.ql
+++ b/csharp/ql/src/Security Features/CWE-614/CookieWithoutSecure.ql
@@ -31,8 +31,8 @@ predicate cookieAppendSecureByDefault() {
predicate secureFalse(ObjectCreation oc) {
exists(Assignment a |
- getAValueForProp(oc, a, "Secure") = a.getRValue() and
- a.getRValue().getValue() = "false"
+ getAValueForProp(oc, a, "Secure") = a.getRightOperand() and
+ a.getRightOperand().getValue() = "false"
)
}
@@ -96,8 +96,8 @@ predicate insecureSecurePolicyAssignment(Assignment a, Expr val) {
MicrosoftAspNetCoreAuthenticationCookiesCookieAuthenticationOptions
) and
pw.getProperty().getName() = "SecurePolicy" and
- a.getLValue() = pw and
- DataFlow::localExprFlow(val, a.getRValue()) and
+ a.getLeftOperand() = pw and
+ DataFlow::localExprFlow(val, a.getRightOperand()) and
val.getValue() = "2" // None
)
}
@@ -107,7 +107,7 @@ where
insecureCookieCall(secureSink)
or
exists(Assignment a |
- secureSink = a.getRValue() and
+ secureSink = a.getRightOperand() and
insecureSecurePolicyAssignment(a, _)
)
select secureSink, "Cookie attribute 'Secure' is not set to true."
diff --git a/csharp/ql/src/Security Features/CookieWithOverlyBroadDomain.ql b/csharp/ql/src/Security Features/CookieWithOverlyBroadDomain.ql
index 9c6e69351860..59a6340104a9 100644
--- a/csharp/ql/src/Security Features/CookieWithOverlyBroadDomain.ql
+++ b/csharp/ql/src/Security Features/CookieWithOverlyBroadDomain.ql
@@ -14,11 +14,11 @@ import csharp
from Assignment a, PropertyAccess pa
where
- a.getLValue() = pa and
+ a.getLeftOperand() = pa and
pa.getTarget().hasName("Domain") and
pa.getTarget().getDeclaringType().hasFullyQualifiedName("System.Web", "HttpCookie") and
(
- a.getRValue().getValue().regexpReplaceAll("[^.]", "").length() < 2 or
- a.getRValue().getValue().matches(".%")
+ a.getRightOperand().getValue().regexpReplaceAll("[^.]", "").length() < 2 or
+ a.getRightOperand().getValue().matches(".%")
)
select a, "Overly broad domain for cookie."
diff --git a/csharp/ql/src/Security Features/CookieWithOverlyBroadPath.ql b/csharp/ql/src/Security Features/CookieWithOverlyBroadPath.ql
index 6690cac47d26..d659f7c8dc56 100644
--- a/csharp/ql/src/Security Features/CookieWithOverlyBroadPath.ql
+++ b/csharp/ql/src/Security Features/CookieWithOverlyBroadPath.ql
@@ -14,8 +14,8 @@ import csharp
from Assignment a, PropertyAccess pa
where
- a.getLValue() = pa and
+ a.getLeftOperand() = pa and
pa.getTarget().hasName("Path") and
pa.getTarget().getDeclaringType().hasFullyQualifiedName("System.Web", "HttpCookie") and
- a.getRValue().getValue() = "/"
+ a.getRightOperand().getValue() = "/"
select a, "Overly broad path for cookie."
diff --git a/csharp/ql/src/Security Features/HeaderCheckingDisabled.ql b/csharp/ql/src/Security Features/HeaderCheckingDisabled.ql
index 7a3a5fdc4f20..bc9bf289c2dd 100644
--- a/csharp/ql/src/Security Features/HeaderCheckingDisabled.ql
+++ b/csharp/ql/src/Security Features/HeaderCheckingDisabled.ql
@@ -17,12 +17,12 @@ from Element l
where
// header checking is disabled programmatically in the code
exists(Assignment a, PropertyAccess pa |
- a.getLValue() = pa and
+ a.getLeftOperand() = pa and
pa.getTarget().hasName("EnableHeaderChecking") and
pa.getTarget()
.getDeclaringType()
.hasFullyQualifiedName("System.Web.Configuration", "HttpRuntimeSection") and
- a.getRValue().getValue() = "false" and
+ a.getRightOperand().getValue() = "false" and
a = l
)
or
diff --git a/csharp/ql/src/Security Features/InsecureRandomness.ql b/csharp/ql/src/Security Features/InsecureRandomness.ql
index 8237afdff130..649969a27782 100644
--- a/csharp/ql/src/Security Features/InsecureRandomness.ql
+++ b/csharp/ql/src/Security Features/InsecureRandomness.ql
@@ -89,10 +89,10 @@ module Random {
e = any(SensitiveLibraryParameter v).getAnAssignedArgument()
or
// Assignment operation, e.g. += or similar
- exists(AssignOperation ao | ao.getRValue() = e |
- ao.getLValue() = any(SensitiveVariable v).getAnAccess() or
- ao.getLValue() = any(SensitiveProperty v).getAnAccess() or
- ao.getLValue() = any(SensitiveLibraryParameter v).getAnAccess()
+ exists(AssignOperation ao | ao.getRightOperand() = e |
+ ao.getLeftOperand() = any(SensitiveVariable v).getAnAccess() or
+ ao.getLeftOperand() = any(SensitiveProperty v).getAnAccess() or
+ ao.getLeftOperand() = any(SensitiveLibraryParameter v).getAnAccess()
)
)
}
diff --git a/csharp/ql/src/Security Features/InsufficientKeySize.ql b/csharp/ql/src/Security Features/InsufficientKeySize.ql
index 94ae6b9286f2..98a7852fbaf5 100644
--- a/csharp/ql/src/Security Features/InsufficientKeySize.ql
+++ b/csharp/ql/src/Security Features/InsufficientKeySize.ql
@@ -20,7 +20,7 @@ predicate incorrectUseOfRC2(Assignment e, string msg) {
.getDeclaringType()
.hasFullyQualifiedName("System.Security.Cryptography", "RC2CryptoServiceProvider")
) and
- e.getRValue().getValue().toInt() < 128 and
+ e.getRightOperand().getIntValue() < 128 and
msg = "Key size should be at least 128 bits for RC2 encryption."
}
@@ -28,7 +28,7 @@ predicate incorrectUseOfDsa(ObjectCreation e, string msg) {
e.getTarget()
.getDeclaringType()
.hasFullyQualifiedName("System.Security.Cryptography", "DSACryptoServiceProvider") and
- exists(Expr i | e.getArgument(0) = i and i.getValue().toInt() < 2048) and
+ exists(Expr i | e.getArgument(0) = i and i.getIntValue() < 2048) and
msg = "Key size should be at least 2048 bits for DSA encryption."
}
@@ -36,7 +36,7 @@ predicate incorrectUseOfRsa(ObjectCreation e, string msg) {
e.getTarget()
.getDeclaringType()
.hasFullyQualifiedName("System.Security.Cryptography", "RSACryptoServiceProvider") and
- exists(Expr i | e.getArgument(0) = i and i.getValue().toInt() < 2048) and
+ exists(Expr i | e.getArgument(0) = i and i.getIntValue() < 2048) and
msg = "Key size should be at least 2048 bits for RSA encryption."
}
diff --git a/csharp/ql/src/Security Features/PersistentCookie.ql b/csharp/ql/src/Security Features/PersistentCookie.ql
index 7f9861213fc1..edc97b464e5c 100644
--- a/csharp/ql/src/Security Features/PersistentCookie.ql
+++ b/csharp/ql/src/Security Features/PersistentCookie.ql
@@ -52,8 +52,8 @@ class FutureDateExpr extends MethodCall {
from Assignment a, PropertyAccess pa, FutureDateExpr fde
where
- a.getLValue() = pa and
- a.getRValue() = fde and
+ a.getLeftOperand() = pa and
+ a.getRightOperand() = fde and
pa.getTarget().hasName("Expires") and
pa.getTarget().getDeclaringType().hasFullyQualifiedName("System.Web", "HttpCookie") and
(fde.timeIsNotClear() or fde.getTimeInSecond() > 300) // 5 minutes max
diff --git a/csharp/ql/src/Telemetry/DatabaseQuality.qll b/csharp/ql/src/Telemetry/DatabaseQuality.qll
index ca2ab3e7e165..ad7ac682bf5c 100644
--- a/csharp/ql/src/Telemetry/DatabaseQuality.qll
+++ b/csharp/ql/src/Telemetry/DatabaseQuality.qll
@@ -27,7 +27,7 @@ module CallTargetStats implements StatsSig {
p = c.getProperty() and
not p.getAnAccessor() instanceof Setter and
assign = c.getParent() and
- assign.getLValue() = c and
+ assign.getLeftOperand() = c and
assign.getParent() instanceof Property
)
}
@@ -36,7 +36,7 @@ module CallTargetStats implements StatsSig {
exists(Property p, AssignExpr assign |
p = c.getProperty() and
assign = c.getParent() and
- assign.getLValue() = c and
+ assign.getLeftOperand() = c and
assign.getParent() instanceof ObjectInitializer and
assign.getParent().getParent() instanceof AnonymousObjectCreation
)
@@ -46,8 +46,8 @@ module CallTargetStats implements StatsSig {
exists(Property p, AssignExpr assign |
p = c.getProperty() and
assign = c.getParent() and
- assign.getLValue() = c and
- assign.getRValue() instanceof ObjectOrCollectionInitializer
+ assign.getLeftOperand() = c and
+ assign.getRightOperand() instanceof ObjectOrCollectionInitializer
)
}
diff --git a/csharp/ql/src/Useless code/DefaultToStringQuery.qll b/csharp/ql/src/Useless code/DefaultToStringQuery.qll
index 411ca47b5e67..cd7a1419028b 100644
--- a/csharp/ql/src/Useless code/DefaultToStringQuery.qll
+++ b/csharp/ql/src/Useless code/DefaultToStringQuery.qll
@@ -30,7 +30,7 @@ predicate invokesToString(Expr e, ValueOrRefType t) {
pragma[nomagic]
private predicate parameterReadPostDominatesEntry(ParameterRead pr) {
- pr.getAControlFlowNode().postDominates(pr.getEnclosingCallable().getEntryPoint())
+ pr.getControlFlowNode().postDominates(pr.getEnclosingCallable().getEntryPoint())
}
pragma[nomagic]
diff --git a/csharp/ql/src/Useless code/RedundantToStringCall.ql b/csharp/ql/src/Useless code/RedundantToStringCall.ql
index 55e7056e9a08..e29e071b4d9b 100644
--- a/csharp/ql/src/Useless code/RedundantToStringCall.ql
+++ b/csharp/ql/src/Useless code/RedundantToStringCall.ql
@@ -18,5 +18,6 @@ import semmle.code.csharp.frameworks.System
from MethodCall mc
where
mc instanceof ImplicitToStringExpr and
- mc.getTarget() instanceof ToStringMethod
-select mc, "Redundant call to 'ToString' on a String object."
+ mc.getTarget() instanceof ToStringMethod and
+ not mc.getQualifier() instanceof BaseAccess
+select mc, "Redundant call to 'ToString'."
diff --git a/csharp/ql/src/change-notes/released/1.7.1.md b/csharp/ql/src/change-notes/released/1.7.1.md
new file mode 100644
index 000000000000..0b5df9629c67
--- /dev/null
+++ b/csharp/ql/src/change-notes/released/1.7.1.md
@@ -0,0 +1,8 @@
+## 1.7.1
+
+### Minor Analysis Improvements
+
+* The query `cs/useless-tostring-call` has been updated to avoid false
+ positive results in calls to `StringBuilder.AppendLine` and calls of
+ the form `base.ToString()`. Moreover, the alert message has been
+ made more precise.
diff --git a/csharp/ql/src/change-notes/released/1.7.2.md b/csharp/ql/src/change-notes/released/1.7.2.md
new file mode 100644
index 000000000000..b950385c16d7
--- /dev/null
+++ b/csharp/ql/src/change-notes/released/1.7.2.md
@@ -0,0 +1,3 @@
+## 1.7.2
+
+No user-facing changes.
diff --git a/csharp/ql/src/change-notes/released/1.7.3.md b/csharp/ql/src/change-notes/released/1.7.3.md
new file mode 100644
index 000000000000..a629082e2155
--- /dev/null
+++ b/csharp/ql/src/change-notes/released/1.7.3.md
@@ -0,0 +1,3 @@
+## 1.7.3
+
+No user-facing changes.
diff --git a/csharp/ql/src/codeql-pack.release.yml b/csharp/ql/src/codeql-pack.release.yml
index d1184cc67507..9f9661b1e77a 100644
--- a/csharp/ql/src/codeql-pack.release.yml
+++ b/csharp/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.7.0
+lastReleaseVersion: 1.7.3
diff --git a/csharp/ql/src/experimental/Security Features/CWE-759/HashWithoutSalt.ql b/csharp/ql/src/experimental/Security Features/CWE-759/HashWithoutSalt.ql
index d43050c2deb4..0dc8fc362d61 100644
--- a/csharp/ql/src/experimental/Security Features/CWE-759/HashWithoutSalt.ql
+++ b/csharp/ql/src/experimental/Security Features/CWE-759/HashWithoutSalt.ql
@@ -187,10 +187,10 @@ module HashWithoutSaltConfig implements DataFlow::ConfigSig {
or
// a salt or key is included in subclasses of `KeyedHashAlgorithm`
exists(MethodCall mc, Assignment a, ObjectCreation oc |
- a.getRValue() = oc and
+ a.getRightOperand() = oc and
oc.getObjectType().getABaseType+() instanceof KeyedHashAlgorithm and
mc.getTarget() instanceof HashMethod and
- a.getLValue() = mc.getQualifier().(VariableAccess).getTarget().getAnAccess() and
+ a.getLeftOperand() = mc.getQualifier().(VariableAccess).getTarget().getAnAccess() and
mc.getArgument(0) = node.asExpr()
)
}
diff --git a/csharp/ql/src/qlpack.yml b/csharp/ql/src/qlpack.yml
index 64d02609317a..84a1271fcad4 100644
--- a/csharp/ql/src/qlpack.yml
+++ b/csharp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-queries
-version: 1.7.0
+version: 1.7.3
groups:
- csharp
- queries
diff --git a/csharp/ql/test/library-tests/assignables/AssignableDefinitionNode.ql b/csharp/ql/test/library-tests/assignables/AssignableDefinitionNode.ql
index 8ff3aad95fcb..2e4af6cfe9b9 100644
--- a/csharp/ql/test/library-tests/assignables/AssignableDefinitionNode.ql
+++ b/csharp/ql/test/library-tests/assignables/AssignableDefinitionNode.ql
@@ -1,4 +1,4 @@
import csharp
from AssignableDefinition def
-select def, def.getExpr().getAControlFlowNode()
+select def, def.getExpr().getControlFlowNode()
diff --git a/csharp/ql/test/library-tests/assignments/AssignOperation.ql b/csharp/ql/test/library-tests/assignments/AssignOperation.ql
index 2ca3b11a8313..2fa23ed0a9f3 100644
--- a/csharp/ql/test/library-tests/assignments/AssignOperation.ql
+++ b/csharp/ql/test/library-tests/assignments/AssignOperation.ql
@@ -1,4 +1,4 @@
import csharp
from AssignOperation ao
-select ao, ao.getLValue(), ao.getRValue()
+select ao, ao.getLeftOperand(), ao.getRightOperand()
diff --git a/csharp/ql/test/library-tests/controlflow/graph/BasicBlock.expected b/csharp/ql/test/library-tests/controlflow/graph/BasicBlock.expected
index 9802f2b01955..819674d2746d 100644
--- a/csharp/ql/test/library-tests/controlflow/graph/BasicBlock.expected
+++ b/csharp/ql/test/library-tests/controlflow/graph/BasicBlock.expected
@@ -1,1178 +1,1329 @@
-| AccessorCalls.cs:1:7:1:19 | enter AccessorCalls | AccessorCalls.cs:1:7:1:19 | exit AccessorCalls | 7 |
-| AccessorCalls.cs:5:23:5:25 | enter get_Item | AccessorCalls.cs:5:23:5:25 | exit get_Item | 4 |
-| AccessorCalls.cs:5:33:5:35 | enter set_Item | AccessorCalls.cs:5:33:5:35 | exit set_Item | 4 |
-| AccessorCalls.cs:7:32:7:34 | enter add_Event | AccessorCalls.cs:7:32:7:34 | exit add_Event | 4 |
-| AccessorCalls.cs:7:40:7:45 | enter remove_Event | AccessorCalls.cs:7:40:7:45 | exit remove_Event | 4 |
-| AccessorCalls.cs:10:10:10:11 | enter M1 | AccessorCalls.cs:10:10:10:11 | exit M1 | 34 |
-| AccessorCalls.cs:19:10:19:11 | enter M2 | AccessorCalls.cs:19:10:19:11 | exit M2 | 42 |
-| AccessorCalls.cs:28:10:28:11 | enter M3 | AccessorCalls.cs:28:10:28:11 | exit M3 | 17 |
-| AccessorCalls.cs:35:10:35:11 | enter M4 | AccessorCalls.cs:35:10:35:11 | exit M4 | 20 |
-| AccessorCalls.cs:42:10:42:11 | enter M5 | AccessorCalls.cs:42:10:42:11 | exit M5 | 24 |
-| AccessorCalls.cs:49:10:49:11 | enter M6 | AccessorCalls.cs:49:10:49:11 | exit M6 | 30 |
-| AccessorCalls.cs:56:10:56:11 | enter M7 | AccessorCalls.cs:56:10:56:11 | exit M7 | 25 |
-| AccessorCalls.cs:61:10:61:11 | enter M8 | AccessorCalls.cs:61:10:61:11 | exit M8 | 31 |
-| AccessorCalls.cs:66:10:66:11 | enter M9 | AccessorCalls.cs:66:10:66:11 | exit M9 | 51 |
-| ArrayCreation.cs:1:7:1:19 | enter ArrayCreation | ArrayCreation.cs:1:7:1:19 | exit ArrayCreation | 7 |
-| ArrayCreation.cs:3:11:3:12 | enter M1 | ArrayCreation.cs:3:11:3:12 | exit M1 | 5 |
-| ArrayCreation.cs:5:12:5:13 | enter M2 | ArrayCreation.cs:5:12:5:13 | exit M2 | 6 |
-| ArrayCreation.cs:7:11:7:12 | enter M3 | ArrayCreation.cs:7:11:7:12 | exit M3 | 8 |
-| ArrayCreation.cs:9:12:9:13 | enter M4 | ArrayCreation.cs:9:12:9:13 | exit M4 | 13 |
-| Assert.cs:5:7:5:17 | enter AssertTests | Assert.cs:5:7:5:17 | exit AssertTests | 7 |
-| Assert.cs:7:10:7:11 | enter M1 | Assert.cs:9:20:9:20 | access to parameter b | 4 |
-| Assert.cs:7:10:7:11 | exit M1 | Assert.cs:7:10:7:11 | exit M1 | 1 |
-| Assert.cs:7:10:7:11 | exit M1 (abnormal) | Assert.cs:7:10:7:11 | exit M1 (abnormal) | 1 |
-| Assert.cs:9:20:9:32 | ... ? ... : ... | Assert.cs:10:9:10:31 | call to method Assert | 7 |
-| Assert.cs:9:24:9:27 | null | Assert.cs:9:24:9:27 | null | 1 |
-| Assert.cs:9:31:9:32 | "" | Assert.cs:9:31:9:32 | "" | 1 |
-| Assert.cs:11:9:11:36 | ...; | Assert.cs:7:10:7:11 | exit M1 (normal) | 5 |
-| Assert.cs:14:10:14:11 | enter M2 | Assert.cs:16:20:16:20 | access to parameter b | 4 |
-| Assert.cs:14:10:14:11 | exit M2 | Assert.cs:14:10:14:11 | exit M2 | 1 |
-| Assert.cs:14:10:14:11 | exit M2 (abnormal) | Assert.cs:14:10:14:11 | exit M2 (abnormal) | 1 |
-| Assert.cs:16:20:16:32 | ... ? ... : ... | Assert.cs:17:9:17:24 | call to method IsNull | 5 |
-| Assert.cs:16:24:16:27 | null | Assert.cs:16:24:16:27 | null | 1 |
-| Assert.cs:16:31:16:32 | "" | Assert.cs:16:31:16:32 | "" | 1 |
-| Assert.cs:18:9:18:36 | ...; | Assert.cs:14:10:14:11 | exit M2 (normal) | 5 |
-| Assert.cs:21:10:21:11 | enter M3 | Assert.cs:23:20:23:20 | access to parameter b | 4 |
-| Assert.cs:21:10:21:11 | exit M3 | Assert.cs:21:10:21:11 | exit M3 | 1 |
-| Assert.cs:21:10:21:11 | exit M3 (abnormal) | Assert.cs:21:10:21:11 | exit M3 (abnormal) | 1 |
-| Assert.cs:23:20:23:32 | ... ? ... : ... | Assert.cs:24:9:24:27 | call to method IsNotNull | 5 |
-| Assert.cs:23:24:23:27 | null | Assert.cs:23:24:23:27 | null | 1 |
-| Assert.cs:23:31:23:32 | "" | Assert.cs:23:31:23:32 | "" | 1 |
-| Assert.cs:25:9:25:36 | ...; | Assert.cs:21:10:21:11 | exit M3 (normal) | 5 |
-| Assert.cs:28:10:28:11 | enter M4 | Assert.cs:30:20:30:20 | access to parameter b | 4 |
-| Assert.cs:28:10:28:11 | exit M4 | Assert.cs:28:10:28:11 | exit M4 | 1 |
-| Assert.cs:28:10:28:11 | exit M4 (abnormal) | Assert.cs:28:10:28:11 | exit M4 (abnormal) | 1 |
-| Assert.cs:30:20:30:32 | ... ? ... : ... | Assert.cs:31:9:31:32 | call to method IsTrue | 7 |
-| Assert.cs:30:24:30:27 | null | Assert.cs:30:24:30:27 | null | 1 |
-| Assert.cs:30:31:30:32 | "" | Assert.cs:30:31:30:32 | "" | 1 |
-| Assert.cs:32:9:32:36 | ...; | Assert.cs:28:10:28:11 | exit M4 (normal) | 5 |
-| Assert.cs:35:10:35:11 | enter M5 | Assert.cs:37:20:37:20 | access to parameter b | 4 |
-| Assert.cs:35:10:35:11 | exit M5 | Assert.cs:35:10:35:11 | exit M5 | 1 |
-| Assert.cs:35:10:35:11 | exit M5 (abnormal) | Assert.cs:35:10:35:11 | exit M5 (abnormal) | 1 |
-| Assert.cs:37:20:37:32 | ... ? ... : ... | Assert.cs:38:9:38:32 | call to method IsTrue | 7 |
-| Assert.cs:37:24:37:27 | null | Assert.cs:37:24:37:27 | null | 1 |
-| Assert.cs:37:31:37:32 | "" | Assert.cs:37:31:37:32 | "" | 1 |
-| Assert.cs:39:9:39:36 | ...; | Assert.cs:35:10:35:11 | exit M5 (normal) | 5 |
-| Assert.cs:42:10:42:11 | enter M6 | Assert.cs:44:20:44:20 | access to parameter b | 4 |
-| Assert.cs:42:10:42:11 | exit M6 | Assert.cs:42:10:42:11 | exit M6 | 1 |
-| Assert.cs:42:10:42:11 | exit M6 (abnormal) | Assert.cs:42:10:42:11 | exit M6 (abnormal) | 1 |
-| Assert.cs:44:20:44:32 | ... ? ... : ... | Assert.cs:45:9:45:33 | call to method IsFalse | 7 |
-| Assert.cs:44:24:44:27 | null | Assert.cs:44:24:44:27 | null | 1 |
-| Assert.cs:44:31:44:32 | "" | Assert.cs:44:31:44:32 | "" | 1 |
-| Assert.cs:46:9:46:36 | ...; | Assert.cs:42:10:42:11 | exit M6 (normal) | 5 |
-| Assert.cs:49:10:49:11 | enter M7 | Assert.cs:51:20:51:20 | access to parameter b | 4 |
-| Assert.cs:49:10:49:11 | exit M7 | Assert.cs:49:10:49:11 | exit M7 | 1 |
-| Assert.cs:49:10:49:11 | exit M7 (abnormal) | Assert.cs:49:10:49:11 | exit M7 (abnormal) | 1 |
-| Assert.cs:51:20:51:32 | ... ? ... : ... | Assert.cs:52:9:52:33 | call to method IsFalse | 7 |
-| Assert.cs:51:24:51:27 | null | Assert.cs:51:24:51:27 | null | 1 |
-| Assert.cs:51:31:51:32 | "" | Assert.cs:51:31:51:32 | "" | 1 |
-| Assert.cs:53:9:53:36 | ...; | Assert.cs:49:10:49:11 | exit M7 (normal) | 5 |
-| Assert.cs:56:10:56:11 | enter M8 | Assert.cs:58:20:58:20 | access to parameter b | 4 |
-| Assert.cs:56:10:56:11 | exit M8 | Assert.cs:56:10:56:11 | exit M8 | 1 |
-| Assert.cs:56:10:56:11 | exit M8 (abnormal) | Assert.cs:56:10:56:11 | exit M8 (abnormal) | 1 |
-| Assert.cs:58:20:58:32 | ... ? ... : ... | Assert.cs:59:23:59:31 | ... != ... | 6 |
-| Assert.cs:58:24:58:27 | null | Assert.cs:58:24:58:27 | null | 1 |
-| Assert.cs:58:31:58:32 | "" | Assert.cs:58:31:58:32 | "" | 1 |
-| Assert.cs:59:23:59:36 | ... && ... | Assert.cs:59:9:59:37 | call to method IsTrue | 2 |
-| Assert.cs:59:36:59:36 | access to parameter b | Assert.cs:59:36:59:36 | access to parameter b | 1 |
-| Assert.cs:60:9:60:36 | ...; | Assert.cs:56:10:56:11 | exit M8 (normal) | 5 |
-| Assert.cs:63:10:63:11 | enter M9 | Assert.cs:65:20:65:20 | access to parameter b | 4 |
-| Assert.cs:63:10:63:11 | exit M9 | Assert.cs:63:10:63:11 | exit M9 | 1 |
-| Assert.cs:63:10:63:11 | exit M9 (abnormal) | Assert.cs:63:10:63:11 | exit M9 (abnormal) | 1 |
-| Assert.cs:65:20:65:32 | ... ? ... : ... | Assert.cs:66:24:66:32 | ... == ... | 6 |
-| Assert.cs:65:24:65:27 | null | Assert.cs:65:24:65:27 | null | 1 |
-| Assert.cs:65:31:65:32 | "" | Assert.cs:65:31:65:32 | "" | 1 |
-| Assert.cs:66:24:66:37 | ... \|\| ... | Assert.cs:66:9:66:38 | call to method IsFalse | 2 |
-| Assert.cs:66:37:66:37 | access to parameter b | Assert.cs:66:37:66:37 | access to parameter b | 1 |
-| Assert.cs:67:9:67:36 | ...; | Assert.cs:63:10:63:11 | exit M9 (normal) | 5 |
-| Assert.cs:70:10:70:12 | enter M10 | Assert.cs:72:20:72:20 | access to parameter b | 4 |
-| Assert.cs:70:10:70:12 | exit M10 | Assert.cs:70:10:70:12 | exit M10 | 1 |
-| Assert.cs:70:10:70:12 | exit M10 (abnormal) | Assert.cs:70:10:70:12 | exit M10 (abnormal) | 1 |
-| Assert.cs:72:20:72:32 | ... ? ... : ... | Assert.cs:73:23:73:31 | ... == ... | 6 |
-| Assert.cs:72:24:72:27 | null | Assert.cs:72:24:72:27 | null | 1 |
-| Assert.cs:72:31:72:32 | "" | Assert.cs:72:31:72:32 | "" | 1 |
-| Assert.cs:73:23:73:36 | ... && ... | Assert.cs:73:9:73:37 | call to method IsTrue | 2 |
-| Assert.cs:73:36:73:36 | access to parameter b | Assert.cs:73:36:73:36 | access to parameter b | 1 |
-| Assert.cs:74:9:74:36 | ...; | Assert.cs:70:10:70:12 | exit M10 (normal) | 5 |
-| Assert.cs:77:10:77:12 | enter M11 | Assert.cs:79:20:79:20 | access to parameter b | 4 |
-| Assert.cs:77:10:77:12 | exit M11 | Assert.cs:77:10:77:12 | exit M11 | 1 |
-| Assert.cs:77:10:77:12 | exit M11 (abnormal) | Assert.cs:77:10:77:12 | exit M11 (abnormal) | 1 |
-| Assert.cs:79:20:79:32 | ... ? ... : ... | Assert.cs:80:24:80:32 | ... != ... | 6 |
-| Assert.cs:79:24:79:27 | null | Assert.cs:79:24:79:27 | null | 1 |
-| Assert.cs:79:31:79:32 | "" | Assert.cs:79:31:79:32 | "" | 1 |
-| Assert.cs:80:24:80:37 | ... \|\| ... | Assert.cs:80:9:80:38 | call to method IsFalse | 2 |
-| Assert.cs:80:37:80:37 | access to parameter b | Assert.cs:80:37:80:37 | access to parameter b | 1 |
-| Assert.cs:81:9:81:36 | ...; | Assert.cs:77:10:77:12 | exit M11 (normal) | 5 |
-| Assert.cs:84:10:84:12 | enter M12 | Assert.cs:86:20:86:20 | access to parameter b | 4 |
-| Assert.cs:84:10:84:12 | exit M12 | Assert.cs:84:10:84:12 | exit M12 | 1 |
-| Assert.cs:84:10:84:12 | exit M12 (abnormal) | Assert.cs:84:10:84:12 | exit M12 (abnormal) | 1 |
-| Assert.cs:86:20:86:32 | ... ? ... : ... | Assert.cs:87:9:87:31 | call to method Assert | 7 |
-| Assert.cs:86:24:86:27 | null | Assert.cs:86:24:86:27 | null | 1 |
-| Assert.cs:86:31:86:32 | "" | Assert.cs:86:31:86:32 | "" | 1 |
-| Assert.cs:88:9:88:36 | ...; | Assert.cs:90:13:90:13 | access to parameter b | 6 |
-| Assert.cs:90:13:90:25 | ... ? ... : ... | Assert.cs:91:9:91:24 | call to method IsNull | 5 |
-| Assert.cs:90:17:90:20 | null | Assert.cs:90:17:90:20 | null | 1 |
-| Assert.cs:90:24:90:25 | "" | Assert.cs:90:24:90:25 | "" | 1 |
-| Assert.cs:92:9:92:36 | ...; | Assert.cs:94:13:94:13 | access to parameter b | 6 |
-| Assert.cs:94:13:94:25 | ... ? ... : ... | Assert.cs:95:9:95:27 | call to method IsNotNull | 5 |
-| Assert.cs:94:17:94:20 | null | Assert.cs:94:17:94:20 | null | 1 |
-| Assert.cs:94:24:94:25 | "" | Assert.cs:94:24:94:25 | "" | 1 |
-| Assert.cs:96:9:96:36 | ...; | Assert.cs:98:13:98:13 | access to parameter b | 6 |
-| Assert.cs:98:13:98:25 | ... ? ... : ... | Assert.cs:99:9:99:32 | call to method IsTrue | 7 |
-| Assert.cs:98:17:98:20 | null | Assert.cs:98:17:98:20 | null | 1 |
-| Assert.cs:98:24:98:25 | "" | Assert.cs:98:24:98:25 | "" | 1 |
-| Assert.cs:100:9:100:36 | ...; | Assert.cs:102:13:102:13 | access to parameter b | 6 |
-| Assert.cs:102:13:102:25 | ... ? ... : ... | Assert.cs:103:9:103:32 | call to method IsTrue | 7 |
-| Assert.cs:102:17:102:20 | null | Assert.cs:102:17:102:20 | null | 1 |
-| Assert.cs:102:24:102:25 | "" | Assert.cs:102:24:102:25 | "" | 1 |
-| Assert.cs:104:9:104:36 | ...; | Assert.cs:106:13:106:13 | access to parameter b | 6 |
-| Assert.cs:106:13:106:25 | ... ? ... : ... | Assert.cs:107:9:107:33 | call to method IsFalse | 7 |
-| Assert.cs:106:17:106:20 | null | Assert.cs:106:17:106:20 | null | 1 |
-| Assert.cs:106:24:106:25 | "" | Assert.cs:106:24:106:25 | "" | 1 |
-| Assert.cs:108:9:108:36 | ...; | Assert.cs:110:13:110:13 | access to parameter b | 6 |
-| Assert.cs:110:13:110:25 | ... ? ... : ... | Assert.cs:111:9:111:33 | call to method IsFalse | 7 |
-| Assert.cs:110:17:110:20 | null | Assert.cs:110:17:110:20 | null | 1 |
-| Assert.cs:110:24:110:25 | "" | Assert.cs:110:24:110:25 | "" | 1 |
-| Assert.cs:112:9:112:36 | ...; | Assert.cs:114:13:114:13 | access to parameter b | 6 |
-| Assert.cs:114:13:114:25 | ... ? ... : ... | Assert.cs:115:23:115:31 | ... != ... | 6 |
-| Assert.cs:114:17:114:20 | null | Assert.cs:114:17:114:20 | null | 1 |
-| Assert.cs:114:24:114:25 | "" | Assert.cs:114:24:114:25 | "" | 1 |
-| Assert.cs:115:23:115:36 | ... && ... | Assert.cs:115:9:115:37 | call to method IsTrue | 2 |
-| Assert.cs:115:36:115:36 | access to parameter b | Assert.cs:115:36:115:36 | access to parameter b | 1 |
-| Assert.cs:116:9:116:36 | ...; | Assert.cs:118:13:118:13 | access to parameter b | 6 |
-| Assert.cs:118:13:118:25 | ... ? ... : ... | Assert.cs:119:24:119:32 | ... == ... | 6 |
-| Assert.cs:118:17:118:20 | null | Assert.cs:118:17:118:20 | null | 1 |
-| Assert.cs:118:24:118:25 | "" | Assert.cs:118:24:118:25 | "" | 1 |
-| Assert.cs:119:24:119:38 | ... \|\| ... | Assert.cs:119:9:119:39 | call to method IsFalse | 2 |
-| Assert.cs:119:38:119:38 | access to parameter b | Assert.cs:119:37:119:38 | !... | 2 |
-| Assert.cs:120:9:120:36 | ...; | Assert.cs:122:13:122:13 | access to parameter b | 6 |
-| Assert.cs:122:13:122:25 | ... ? ... : ... | Assert.cs:123:23:123:31 | ... == ... | 6 |
-| Assert.cs:122:17:122:20 | null | Assert.cs:122:17:122:20 | null | 1 |
-| Assert.cs:122:24:122:25 | "" | Assert.cs:122:24:122:25 | "" | 1 |
-| Assert.cs:123:23:123:36 | ... && ... | Assert.cs:123:9:123:37 | call to method IsTrue | 2 |
-| Assert.cs:123:36:123:36 | access to parameter b | Assert.cs:123:36:123:36 | access to parameter b | 1 |
-| Assert.cs:124:9:124:36 | ...; | Assert.cs:126:13:126:13 | access to parameter b | 6 |
-| Assert.cs:126:13:126:25 | ... ? ... : ... | Assert.cs:127:24:127:32 | ... != ... | 6 |
-| Assert.cs:126:17:126:20 | null | Assert.cs:126:17:126:20 | null | 1 |
-| Assert.cs:126:24:126:25 | "" | Assert.cs:126:24:126:25 | "" | 1 |
-| Assert.cs:127:24:127:38 | ... \|\| ... | Assert.cs:127:9:127:39 | call to method IsFalse | 2 |
-| Assert.cs:127:38:127:38 | access to parameter b | Assert.cs:127:37:127:38 | !... | 2 |
-| Assert.cs:128:9:128:36 | ...; | Assert.cs:84:10:84:12 | exit M12 (normal) | 5 |
-| Assert.cs:131:18:131:32 | enter AssertTrueFalse | Assert.cs:131:18:131:32 | exit AssertTrueFalse | 4 |
-| Assert.cs:138:10:138:12 | enter M13 | Assert.cs:140:9:140:35 | call to method AssertTrueFalse | 8 |
-| Assert.cs:138:10:138:12 | exit M13 | Assert.cs:138:10:138:12 | exit M13 | 1 |
-| Assert.cs:138:10:138:12 | exit M13 (abnormal) | Assert.cs:138:10:138:12 | exit M13 (abnormal) | 1 |
-| Assert.cs:141:9:141:15 | return ...; | Assert.cs:138:10:138:12 | exit M13 (normal) | 2 |
-| Assignments.cs:1:7:1:17 | enter Assignments | Assignments.cs:1:7:1:17 | exit Assignments | 7 |
-| Assignments.cs:3:10:3:10 | enter M | Assignments.cs:3:10:3:10 | exit M | 31 |
-| Assignments.cs:14:18:14:35 | enter (...) => ... | Assignments.cs:14:18:14:35 | exit (...) => ... | 4 |
-| Assignments.cs:17:40:17:40 | enter + | Assignments.cs:17:40:17:40 | exit + | 6 |
-| Assignments.cs:27:10:27:23 | enter SetParamSingle | Assignments.cs:27:10:27:23 | exit SetParamSingle | 7 |
-| Assignments.cs:32:10:32:22 | enter SetParamMulti | Assignments.cs:32:10:32:22 | exit SetParamMulti | 10 |
-| Assignments.cs:38:10:38:11 | enter M2 | Assignments.cs:38:10:38:11 | exit M2 | 28 |
-| BreakInTry.cs:1:7:1:16 | enter BreakInTry | BreakInTry.cs:1:7:1:16 | exit BreakInTry | 7 |
-| BreakInTry.cs:3:10:3:11 | enter M1 | BreakInTry.cs:7:33:7:36 | access to parameter args | 5 |
-| BreakInTry.cs:3:10:3:11 | exit M1 (normal) | BreakInTry.cs:3:10:3:11 | exit M1 | 2 |
-| BreakInTry.cs:7:13:11:13 | foreach (... ... in ...) ... | BreakInTry.cs:7:13:11:13 | foreach (... ... in ...) ... | 1 |
-| BreakInTry.cs:7:26:7:28 | String arg | BreakInTry.cs:9:21:9:31 | ... == ... | 6 |
-| BreakInTry.cs:10:21:10:26 | break; | BreakInTry.cs:10:21:10:26 | break; | 1 |
-| BreakInTry.cs:14:9:17:9 | {...} | BreakInTry.cs:15:17:15:28 | ... == ... | 5 |
-| BreakInTry.cs:16:17:16:17 | ; | BreakInTry.cs:16:17:16:17 | ; | 1 |
-| BreakInTry.cs:20:10:20:11 | enter M2 | BreakInTry.cs:22:29:22:32 | access to parameter args | 3 |
-| BreakInTry.cs:22:9:34:9 | foreach (... ... in ...) ... | BreakInTry.cs:22:9:34:9 | foreach (... ... in ...) ... | 1 |
-| BreakInTry.cs:22:22:22:24 | String arg | BreakInTry.cs:26:21:26:31 | ... == ... | 8 |
-| BreakInTry.cs:27:21:27:26 | break; | BreakInTry.cs:27:21:27:26 | break; | 1 |
-| BreakInTry.cs:30:13:33:13 | {...} | BreakInTry.cs:31:21:31:32 | ... == ... | 5 |
-| BreakInTry.cs:32:21:32:21 | ; | BreakInTry.cs:32:21:32:21 | ; | 1 |
-| BreakInTry.cs:35:7:35:7 | ; | BreakInTry.cs:20:10:20:11 | exit M2 | 3 |
-| BreakInTry.cs:38:10:38:11 | enter M3 | BreakInTry.cs:42:17:42:28 | ... == ... | 8 |
-| BreakInTry.cs:38:10:38:11 | exit M3 (normal) | BreakInTry.cs:38:10:38:11 | exit M3 | 2 |
-| BreakInTry.cs:43:17:43:23 | return ...; | BreakInTry.cs:43:17:43:23 | return ...; | 1 |
-| BreakInTry.cs:46:9:52:9 | {...} | BreakInTry.cs:47:33:47:36 | access to parameter args | 2 |
-| BreakInTry.cs:47:13:51:13 | foreach (... ... in ...) ... | BreakInTry.cs:47:13:51:13 | foreach (... ... in ...) ... | 1 |
-| BreakInTry.cs:47:26:47:28 | String arg | BreakInTry.cs:49:21:49:31 | ... == ... | 6 |
-| BreakInTry.cs:50:21:50:26 | break; | BreakInTry.cs:50:21:50:26 | break; | 1 |
-| BreakInTry.cs:53:7:53:7 | ; | BreakInTry.cs:53:7:53:7 | ; | 1 |
-| BreakInTry.cs:56:10:56:11 | enter M4 | BreakInTry.cs:60:17:60:28 | ... == ... | 8 |
-| BreakInTry.cs:56:10:56:11 | exit M4 (normal) | BreakInTry.cs:56:10:56:11 | exit M4 | 2 |
-| BreakInTry.cs:61:17:61:23 | return ...; | BreakInTry.cs:61:17:61:23 | return ...; | 1 |
-| BreakInTry.cs:64:9:70:9 | {...} | BreakInTry.cs:65:33:65:36 | access to parameter args | 2 |
-| BreakInTry.cs:65:13:69:13 | foreach (... ... in ...) ... | BreakInTry.cs:65:13:69:13 | foreach (... ... in ...) ... | 1 |
-| BreakInTry.cs:65:26:65:28 | String arg | BreakInTry.cs:67:21:67:31 | ... == ... | 6 |
-| BreakInTry.cs:68:21:68:26 | break; | BreakInTry.cs:68:21:68:26 | break; | 1 |
-| CompileTimeOperators.cs:3:7:3:26 | enter CompileTimeOperators | CompileTimeOperators.cs:3:7:3:26 | exit CompileTimeOperators | 7 |
-| CompileTimeOperators.cs:5:9:5:15 | enter Default | CompileTimeOperators.cs:5:9:5:15 | exit Default | 6 |
-| CompileTimeOperators.cs:10:9:10:14 | enter Sizeof | CompileTimeOperators.cs:10:9:10:14 | exit Sizeof | 6 |
-| CompileTimeOperators.cs:15:10:15:15 | enter Typeof | CompileTimeOperators.cs:15:10:15:15 | exit Typeof | 6 |
-| CompileTimeOperators.cs:20:12:20:17 | enter Nameof | CompileTimeOperators.cs:20:12:20:17 | exit Nameof | 6 |
-| CompileTimeOperators.cs:26:7:26:22 | enter GotoInTryFinally | CompileTimeOperators.cs:26:7:26:22 | exit GotoInTryFinally | 7 |
-| CompileTimeOperators.cs:28:10:28:10 | enter M | CompileTimeOperators.cs:37:13:37:40 | call to method WriteLine | 9 |
-| CompileTimeOperators.cs:28:10:28:10 | exit M | CompileTimeOperators.cs:28:10:28:10 | exit M | 1 |
-| CompileTimeOperators.cs:28:10:28:10 | exit M (abnormal) | CompileTimeOperators.cs:28:10:28:10 | exit M (abnormal) | 1 |
-| CompileTimeOperators.cs:39:9:39:34 | ...; | CompileTimeOperators.cs:39:9:39:33 | call to method WriteLine | 3 |
-| CompileTimeOperators.cs:40:9:40:11 | End: | CompileTimeOperators.cs:28:10:28:10 | exit M (normal) | 5 |
-| ConditionalAccess.cs:1:7:1:23 | enter ConditionalAccess | ConditionalAccess.cs:1:7:1:23 | exit ConditionalAccess | 7 |
-| ConditionalAccess.cs:3:12:3:13 | enter M1 | ConditionalAccess.cs:3:26:3:26 | access to parameter i | 2 |
-| ConditionalAccess.cs:3:12:3:13 | exit M1 (normal) | ConditionalAccess.cs:3:12:3:13 | exit M1 | 2 |
-| ConditionalAccess.cs:3:26:3:38 | call to method ToString | ConditionalAccess.cs:3:26:3:38 | call to method ToString | 1 |
-| ConditionalAccess.cs:3:26:3:49 | call to method ToLower | ConditionalAccess.cs:3:26:3:49 | call to method ToLower | 1 |
-| ConditionalAccess.cs:5:10:5:11 | enter M2 | ConditionalAccess.cs:5:26:5:26 | access to parameter s | 2 |
-| ConditionalAccess.cs:5:10:5:11 | exit M2 (normal) | ConditionalAccess.cs:5:10:5:11 | exit M2 | 2 |
-| ConditionalAccess.cs:5:26:5:34 | access to property Length | ConditionalAccess.cs:5:26:5:34 | access to property Length | 1 |
-| ConditionalAccess.cs:7:10:7:11 | enter M3 | ConditionalAccess.cs:7:39:7:40 | access to parameter s1 | 2 |
-| ConditionalAccess.cs:7:10:7:11 | exit M3 (normal) | ConditionalAccess.cs:7:10:7:11 | exit M3 | 2 |
-| ConditionalAccess.cs:7:38:7:55 | access to property Length | ConditionalAccess.cs:7:38:7:55 | access to property Length | 1 |
-| ConditionalAccess.cs:7:39:7:46 | ... ?? ... | ConditionalAccess.cs:7:39:7:46 | ... ?? ... | 1 |
-| ConditionalAccess.cs:7:39:7:46 | [non-null] ... ?? ... | ConditionalAccess.cs:7:39:7:46 | [non-null] ... ?? ... | 1 |
-| ConditionalAccess.cs:7:39:7:46 | [null] ... ?? ... | ConditionalAccess.cs:7:39:7:46 | [null] ... ?? ... | 1 |
-| ConditionalAccess.cs:7:45:7:46 | access to parameter s2 | ConditionalAccess.cs:7:45:7:46 | access to parameter s2 | 1 |
-| ConditionalAccess.cs:9:9:9:10 | enter M4 | ConditionalAccess.cs:9:25:9:25 | access to parameter s | 2 |
-| ConditionalAccess.cs:9:25:9:33 | access to property Length | ConditionalAccess.cs:9:25:9:33 | access to property Length | 1 |
-| ConditionalAccess.cs:9:25:9:38 | ... ?? ... | ConditionalAccess.cs:9:9:9:10 | exit M4 | 3 |
-| ConditionalAccess.cs:9:38:9:38 | 0 | ConditionalAccess.cs:9:38:9:38 | 0 | 1 |
-| ConditionalAccess.cs:11:9:11:10 | enter M5 | ConditionalAccess.cs:13:13:13:13 | access to parameter s | 4 |
-| ConditionalAccess.cs:11:9:11:10 | exit M5 (normal) | ConditionalAccess.cs:11:9:11:10 | exit M5 | 2 |
-| ConditionalAccess.cs:13:13:13:21 | access to property Length | ConditionalAccess.cs:13:13:13:21 | access to property Length | 1 |
-| ConditionalAccess.cs:13:25:13:25 | 0 | ConditionalAccess.cs:13:13:13:25 | ... > ... | 3 |
-| ConditionalAccess.cs:14:20:14:20 | 0 | ConditionalAccess.cs:14:13:14:21 | return ...; | 2 |
-| ConditionalAccess.cs:16:20:16:20 | 1 | ConditionalAccess.cs:16:13:16:21 | return ...; | 2 |
-| ConditionalAccess.cs:19:12:19:13 | enter M6 | ConditionalAccess.cs:19:40:19:41 | access to parameter s1 | 2 |
-| ConditionalAccess.cs:19:12:19:13 | exit M6 (normal) | ConditionalAccess.cs:19:12:19:13 | exit M6 | 2 |
-| ConditionalAccess.cs:19:58:19:59 | access to parameter s2 | ConditionalAccess.cs:19:40:19:60 | call to method CommaJoinWith | 2 |
-| ConditionalAccess.cs:21:10:21:11 | enter M7 | ConditionalAccess.cs:23:18:23:29 | (...) ... | 5 |
-| ConditionalAccess.cs:23:13:23:38 | Nullable j = ... | ConditionalAccess.cs:24:18:24:24 | (...) ... | 4 |
-| ConditionalAccess.cs:24:17:24:37 | call to method ToString | ConditionalAccess.cs:25:13:25:14 | "" | 4 |
-| ConditionalAccess.cs:25:31:25:31 | access to local variable s | ConditionalAccess.cs:21:10:21:11 | exit M7 | 5 |
-| ConditionalAccess.cs:30:10:30:12 | enter Out | ConditionalAccess.cs:30:10:30:12 | exit Out | 5 |
-| ConditionalAccess.cs:32:10:32:11 | enter M8 | ConditionalAccess.cs:35:9:35:12 | access to property Prop | 8 |
-| ConditionalAccess.cs:32:10:32:11 | exit M8 (normal) | ConditionalAccess.cs:32:10:32:11 | exit M8 | 2 |
-| ConditionalAccess.cs:35:9:35:24 | call to method Out | ConditionalAccess.cs:35:9:35:24 | call to method Out | 1 |
-| ConditionalAccess.cs:42:9:42:11 | enter get_Item | ConditionalAccess.cs:42:9:42:11 | exit get_Item | 6 |
-| ConditionalAccess.cs:43:9:43:11 | enter set_Item | ConditionalAccess.cs:43:9:43:11 | exit set_Item | 4 |
-| ConditionalAccess.cs:46:10:46:11 | enter M9 | ConditionalAccess.cs:48:9:48:10 | access to parameter ca | 4 |
-| ConditionalAccess.cs:48:24:48:25 | 42 | ConditionalAccess.cs:48:12:48:25 | ... = ... | 3 |
-| ConditionalAccess.cs:49:9:49:33 | ...; | ConditionalAccess.cs:49:9:49:10 | access to parameter ca | 2 |
-| ConditionalAccess.cs:49:26:49:32 | "Hello" | ConditionalAccess.cs:49:12:49:32 | ... = ... | 3 |
-| ConditionalAccess.cs:50:9:50:24 | ...; | ConditionalAccess.cs:50:9:50:10 | access to parameter ca | 2 |
-| ConditionalAccess.cs:50:13:50:13 | 0 | ConditionalAccess.cs:50:12:50:23 | ... = ... | 4 |
-| ConditionalAccess.cs:51:9:51:16 | access to property Prop | ConditionalAccess.cs:51:9:51:16 | access to property Prop | 1 |
-| ConditionalAccess.cs:51:9:51:32 | ...; | ConditionalAccess.cs:51:9:51:10 | access to parameter ca | 2 |
-| ConditionalAccess.cs:51:30:51:31 | 84 | ConditionalAccess.cs:51:18:51:31 | ... = ... | 3 |
-| ConditionalAccess.cs:52:9:52:16 | access to property Prop | ConditionalAccess.cs:52:9:52:16 | access to property Prop | 1 |
-| ConditionalAccess.cs:52:9:52:39 | ...; | ConditionalAccess.cs:52:9:52:10 | access to parameter ca | 2 |
-| ConditionalAccess.cs:52:32:52:38 | "World" | ConditionalAccess.cs:52:18:52:38 | ... = ... | 3 |
-| ConditionalAccess.cs:53:9:53:20 | access to field IntField | ConditionalAccess.cs:53:9:53:20 | access to field IntField | 1 |
-| ConditionalAccess.cs:53:9:53:26 | ...; | ConditionalAccess.cs:53:9:53:10 | access to parameter ca | 2 |
-| ConditionalAccess.cs:53:25:53:25 | 1 | ConditionalAccess.cs:54:9:54:10 | access to parameter ca | 4 |
-| ConditionalAccess.cs:54:9:54:22 | access to property StringProp | ConditionalAccess.cs:54:9:54:22 | access to property StringProp | 1 |
-| ConditionalAccess.cs:54:27:54:29 | "!" | ConditionalAccess.cs:46:10:46:11 | exit M9 | 4 |
-| ConditionalAccess.cs:60:26:60:38 | enter CommaJoinWith | ConditionalAccess.cs:60:26:60:38 | exit CommaJoinWith | 8 |
-| Conditions.cs:1:7:1:16 | enter Conditions | Conditions.cs:1:7:1:16 | exit Conditions | 7 |
-| Conditions.cs:3:10:3:19 | enter IncrOrDecr | Conditions.cs:5:13:5:15 | access to parameter inc | 4 |
-| Conditions.cs:3:10:3:19 | exit IncrOrDecr (normal) | Conditions.cs:3:10:3:19 | exit IncrOrDecr | 2 |
-| Conditions.cs:6:13:6:16 | ...; | Conditions.cs:6:13:6:15 | ...++ | 3 |
-| Conditions.cs:7:9:8:16 | if (...) ... | Conditions.cs:7:14:7:16 | access to parameter inc | 2 |
-| Conditions.cs:7:13:7:16 | [false] !... | Conditions.cs:7:13:7:16 | [false] !... | 1 |
-| Conditions.cs:7:13:7:16 | [true] !... | Conditions.cs:7:13:7:16 | [true] !... | 1 |
-| Conditions.cs:8:13:8:16 | ...; | Conditions.cs:8:13:8:15 | ...-- | 3 |
-| Conditions.cs:11:9:11:10 | enter M1 | Conditions.cs:14:13:14:13 | access to parameter b | 7 |
-| Conditions.cs:15:13:15:16 | ...; | Conditions.cs:15:13:15:15 | ...++ | 3 |
-| Conditions.cs:16:9:18:20 | if (...) ... | Conditions.cs:16:13:16:17 | ... > ... | 4 |
-| Conditions.cs:17:13:18:20 | if (...) ... | Conditions.cs:17:18:17:18 | access to parameter b | 2 |
-| Conditions.cs:17:17:17:18 | [false] !... | Conditions.cs:17:17:17:18 | [false] !... | 1 |
-| Conditions.cs:17:17:17:18 | [true] !... | Conditions.cs:17:17:17:18 | [true] !... | 1 |
-| Conditions.cs:18:17:18:20 | ...; | Conditions.cs:18:17:18:19 | ...-- | 3 |
-| Conditions.cs:19:16:19:16 | access to local variable x | Conditions.cs:11:9:11:10 | exit M1 | 4 |
-| Conditions.cs:22:9:22:10 | enter M2 | Conditions.cs:25:13:25:14 | access to parameter b1 | 7 |
-| Conditions.cs:26:13:27:20 | if (...) ... | Conditions.cs:26:17:26:18 | access to parameter b2 | 2 |
-| Conditions.cs:27:17:27:20 | ...; | Conditions.cs:27:17:27:19 | ...++ | 3 |
-| Conditions.cs:28:9:29:16 | if (...) ... | Conditions.cs:28:13:28:14 | access to parameter b2 | 2 |
-| Conditions.cs:29:13:29:16 | ...; | Conditions.cs:29:13:29:15 | ...++ | 3 |
-| Conditions.cs:30:16:30:16 | access to local variable x | Conditions.cs:22:9:22:10 | exit M2 | 4 |
-| Conditions.cs:33:9:33:10 | enter M3 | Conditions.cs:37:13:37:14 | access to parameter b1 | 10 |
-| Conditions.cs:38:13:38:20 | ...; | Conditions.cs:38:13:38:19 | ... = ... | 3 |
-| Conditions.cs:39:9:40:16 | if (...) ... | Conditions.cs:39:13:39:14 | access to local variable b2 | 2 |
-| Conditions.cs:40:13:40:16 | ...; | Conditions.cs:40:13:40:15 | ...++ | 3 |
-| Conditions.cs:41:9:42:16 | if (...) ... | Conditions.cs:41:13:41:14 | access to local variable b2 | 2 |
-| Conditions.cs:42:13:42:16 | ...; | Conditions.cs:42:13:42:15 | ...++ | 3 |
-| Conditions.cs:43:16:43:16 | access to local variable x | Conditions.cs:33:9:33:10 | exit M3 | 4 |
-| Conditions.cs:46:9:46:10 | enter M4 | Conditions.cs:49:9:53:9 | while (...) ... | 6 |
-| Conditions.cs:49:16:49:16 | access to parameter x | Conditions.cs:49:16:49:22 | ... > ... | 4 |
-| Conditions.cs:50:9:53:9 | {...} | Conditions.cs:51:17:51:17 | access to parameter b | 3 |
-| Conditions.cs:52:17:52:20 | ...; | Conditions.cs:52:17:52:19 | ...++ | 3 |
-| Conditions.cs:54:16:54:16 | access to local variable y | Conditions.cs:46:9:46:10 | exit M4 | 4 |
-| Conditions.cs:57:9:57:10 | enter M5 | Conditions.cs:60:9:64:9 | while (...) ... | 6 |
-| Conditions.cs:60:16:60:16 | access to parameter x | Conditions.cs:60:16:60:22 | ... > ... | 4 |
-| Conditions.cs:61:9:64:9 | {...} | Conditions.cs:62:17:62:17 | access to parameter b | 3 |
-| Conditions.cs:63:17:63:20 | ...; | Conditions.cs:63:17:63:19 | ...++ | 3 |
-| Conditions.cs:65:9:66:16 | if (...) ... | Conditions.cs:65:13:65:13 | access to parameter b | 2 |
-| Conditions.cs:66:13:66:16 | ...; | Conditions.cs:66:13:66:15 | ...++ | 3 |
-| Conditions.cs:67:16:67:16 | access to local variable y | Conditions.cs:57:9:57:10 | exit M5 | 4 |
-| Conditions.cs:70:9:70:10 | enter M6 | Conditions.cs:74:27:74:28 | access to parameter ss | 12 |
-| Conditions.cs:74:9:80:9 | foreach (... ... in ...) ... | Conditions.cs:74:9:80:9 | foreach (... ... in ...) ... | 1 |
+| AccessorCalls.cs:1:7:1:19 | Entry | AccessorCalls.cs:1:7:1:19 | Exit | 11 |
+| AccessorCalls.cs:5:23:5:25 | Entry | AccessorCalls.cs:5:23:5:25 | Exit | 5 |
+| AccessorCalls.cs:5:33:5:35 | Entry | AccessorCalls.cs:5:33:5:35 | Exit | 6 |
+| AccessorCalls.cs:7:32:7:34 | Entry | AccessorCalls.cs:7:32:7:34 | Exit | 5 |
+| AccessorCalls.cs:7:40:7:45 | Entry | AccessorCalls.cs:7:40:7:45 | Exit | 5 |
+| AccessorCalls.cs:10:10:10:11 | Entry | AccessorCalls.cs:10:10:10:11 | Exit | 67 |
+| AccessorCalls.cs:19:10:19:11 | Entry | AccessorCalls.cs:19:10:19:11 | Exit | 91 |
+| AccessorCalls.cs:28:10:28:11 | Entry | AccessorCalls.cs:28:10:28:11 | Exit | 33 |
+| AccessorCalls.cs:35:10:35:11 | Entry | AccessorCalls.cs:35:10:35:11 | Exit | 42 |
+| AccessorCalls.cs:42:10:42:11 | Entry | AccessorCalls.cs:42:10:42:11 | Exit | 46 |
+| AccessorCalls.cs:49:10:49:11 | Entry | AccessorCalls.cs:49:10:49:11 | Exit | 64 |
+| AccessorCalls.cs:56:10:56:11 | Entry | AccessorCalls.cs:56:10:56:11 | Exit | 51 |
+| AccessorCalls.cs:61:10:61:11 | Entry | AccessorCalls.cs:61:10:61:11 | Exit | 69 |
+| AccessorCalls.cs:66:10:66:11 | Entry | AccessorCalls.cs:66:10:66:11 | Exit | 107 |
+| ArrayCreation.cs:1:7:1:19 | Entry | ArrayCreation.cs:1:7:1:19 | Exit | 11 |
+| ArrayCreation.cs:3:11:3:12 | Entry | ArrayCreation.cs:3:11:3:12 | Exit | 7 |
+| ArrayCreation.cs:5:12:5:13 | Entry | ArrayCreation.cs:5:12:5:13 | Exit | 8 |
+| ArrayCreation.cs:7:11:7:12 | Entry | ArrayCreation.cs:7:11:7:12 | Exit | 12 |
+| ArrayCreation.cs:9:12:9:13 | Entry | ArrayCreation.cs:9:12:9:13 | Exit | 21 |
+| Assert.cs:5:7:5:17 | Entry | Assert.cs:5:7:5:17 | Exit | 11 |
+| Assert.cs:7:10:7:11 | Entry | Assert.cs:9:20:9:20 | access to parameter b | 8 |
+| Assert.cs:7:10:7:11 | Exceptional Exit | Assert.cs:7:10:7:11 | Exceptional Exit | 1 |
+| Assert.cs:7:10:7:11 | Exit | Assert.cs:7:10:7:11 | Exit | 1 |
+| Assert.cs:9:20:9:20 | After access to parameter b [false] | Assert.cs:9:31:9:32 | "" | 2 |
+| Assert.cs:9:20:9:20 | After access to parameter b [true] | Assert.cs:9:24:9:27 | null | 2 |
+| Assert.cs:9:20:9:32 | After ... ? ... : ... | Assert.cs:10:9:10:31 | call to method Assert | 12 |
+| Assert.cs:10:9:10:31 | After call to method Assert | Assert.cs:7:10:7:11 | Normal Exit | 13 |
+| Assert.cs:14:10:14:11 | Entry | Assert.cs:16:20:16:20 | access to parameter b | 8 |
+| Assert.cs:14:10:14:11 | Exceptional Exit | Assert.cs:14:10:14:11 | Exceptional Exit | 1 |
+| Assert.cs:14:10:14:11 | Exit | Assert.cs:14:10:14:11 | Exit | 1 |
+| Assert.cs:16:20:16:20 | After access to parameter b [false] | Assert.cs:16:31:16:32 | "" | 2 |
+| Assert.cs:16:20:16:20 | After access to parameter b [true] | Assert.cs:16:24:16:27 | null | 2 |
+| Assert.cs:16:20:16:32 | After ... ? ... : ... | Assert.cs:17:9:17:24 | call to method IsNull | 8 |
+| Assert.cs:17:9:17:24 | After call to method IsNull | Assert.cs:14:10:14:11 | Normal Exit | 13 |
+| Assert.cs:21:10:21:11 | Entry | Assert.cs:23:20:23:20 | access to parameter b | 8 |
+| Assert.cs:21:10:21:11 | Exceptional Exit | Assert.cs:21:10:21:11 | Exceptional Exit | 1 |
+| Assert.cs:21:10:21:11 | Exit | Assert.cs:21:10:21:11 | Exit | 1 |
+| Assert.cs:23:20:23:20 | After access to parameter b [false] | Assert.cs:23:31:23:32 | "" | 2 |
+| Assert.cs:23:20:23:20 | After access to parameter b [true] | Assert.cs:23:24:23:27 | null | 2 |
+| Assert.cs:23:20:23:32 | After ... ? ... : ... | Assert.cs:24:9:24:27 | call to method IsNotNull | 8 |
+| Assert.cs:24:9:24:27 | After call to method IsNotNull | Assert.cs:21:10:21:11 | Normal Exit | 13 |
+| Assert.cs:28:10:28:11 | Entry | Assert.cs:30:20:30:20 | access to parameter b | 8 |
+| Assert.cs:28:10:28:11 | Exceptional Exit | Assert.cs:28:10:28:11 | Exceptional Exit | 1 |
+| Assert.cs:28:10:28:11 | Exit | Assert.cs:28:10:28:11 | Exit | 1 |
+| Assert.cs:30:20:30:20 | After access to parameter b [false] | Assert.cs:30:31:30:32 | "" | 2 |
+| Assert.cs:30:20:30:20 | After access to parameter b [true] | Assert.cs:30:24:30:27 | null | 2 |
+| Assert.cs:30:20:30:32 | After ... ? ... : ... | Assert.cs:31:9:31:32 | call to method IsTrue | 12 |
+| Assert.cs:31:9:31:32 | After call to method IsTrue | Assert.cs:28:10:28:11 | Normal Exit | 13 |
+| Assert.cs:35:10:35:11 | Entry | Assert.cs:37:20:37:20 | access to parameter b | 8 |
+| Assert.cs:35:10:35:11 | Exceptional Exit | Assert.cs:35:10:35:11 | Exceptional Exit | 1 |
+| Assert.cs:35:10:35:11 | Exit | Assert.cs:35:10:35:11 | Exit | 1 |
+| Assert.cs:37:20:37:20 | After access to parameter b [false] | Assert.cs:37:31:37:32 | "" | 2 |
+| Assert.cs:37:20:37:20 | After access to parameter b [true] | Assert.cs:37:24:37:27 | null | 2 |
+| Assert.cs:37:20:37:32 | After ... ? ... : ... | Assert.cs:38:9:38:32 | call to method IsTrue | 12 |
+| Assert.cs:38:9:38:32 | After call to method IsTrue | Assert.cs:35:10:35:11 | Normal Exit | 13 |
+| Assert.cs:42:10:42:11 | Entry | Assert.cs:44:20:44:20 | access to parameter b | 8 |
+| Assert.cs:42:10:42:11 | Exceptional Exit | Assert.cs:42:10:42:11 | Exceptional Exit | 1 |
+| Assert.cs:42:10:42:11 | Exit | Assert.cs:42:10:42:11 | Exit | 1 |
+| Assert.cs:44:20:44:20 | After access to parameter b [false] | Assert.cs:44:31:44:32 | "" | 2 |
+| Assert.cs:44:20:44:20 | After access to parameter b [true] | Assert.cs:44:24:44:27 | null | 2 |
+| Assert.cs:44:20:44:32 | After ... ? ... : ... | Assert.cs:45:9:45:33 | call to method IsFalse | 12 |
+| Assert.cs:45:9:45:33 | After call to method IsFalse | Assert.cs:42:10:42:11 | Normal Exit | 13 |
+| Assert.cs:49:10:49:11 | Entry | Assert.cs:51:20:51:20 | access to parameter b | 8 |
+| Assert.cs:49:10:49:11 | Exceptional Exit | Assert.cs:49:10:49:11 | Exceptional Exit | 1 |
+| Assert.cs:49:10:49:11 | Exit | Assert.cs:49:10:49:11 | Exit | 1 |
+| Assert.cs:51:20:51:20 | After access to parameter b [false] | Assert.cs:51:31:51:32 | "" | 2 |
+| Assert.cs:51:20:51:20 | After access to parameter b [true] | Assert.cs:51:24:51:27 | null | 2 |
+| Assert.cs:51:20:51:32 | After ... ? ... : ... | Assert.cs:52:9:52:33 | call to method IsFalse | 12 |
+| Assert.cs:52:9:52:33 | After call to method IsFalse | Assert.cs:49:10:49:11 | Normal Exit | 13 |
+| Assert.cs:56:10:56:11 | Entry | Assert.cs:58:20:58:20 | access to parameter b | 8 |
+| Assert.cs:56:10:56:11 | Exceptional Exit | Assert.cs:56:10:56:11 | Exceptional Exit | 1 |
+| Assert.cs:56:10:56:11 | Exit | Assert.cs:56:10:56:11 | Exit | 1 |
+| Assert.cs:58:20:58:20 | After access to parameter b [false] | Assert.cs:58:31:58:32 | "" | 2 |
+| Assert.cs:58:20:58:20 | After access to parameter b [true] | Assert.cs:58:24:58:27 | null | 2 |
+| Assert.cs:58:20:58:32 | After ... ? ... : ... | Assert.cs:59:23:59:31 | ... != ... | 11 |
+| Assert.cs:59:9:59:37 | After call to method IsTrue | Assert.cs:56:10:56:11 | Normal Exit | 13 |
+| Assert.cs:59:23:59:31 | After ... != ... [false] | Assert.cs:59:23:59:31 | After ... != ... [false] | 1 |
+| Assert.cs:59:23:59:31 | After ... != ... [true] | Assert.cs:59:36:59:36 | access to parameter b | 2 |
+| Assert.cs:59:23:59:36 | After ... && ... | Assert.cs:59:9:59:37 | call to method IsTrue | 2 |
+| Assert.cs:63:10:63:11 | Entry | Assert.cs:65:20:65:20 | access to parameter b | 8 |
+| Assert.cs:63:10:63:11 | Exceptional Exit | Assert.cs:63:10:63:11 | Exceptional Exit | 1 |
+| Assert.cs:63:10:63:11 | Exit | Assert.cs:63:10:63:11 | Exit | 1 |
+| Assert.cs:65:20:65:20 | After access to parameter b [false] | Assert.cs:65:31:65:32 | "" | 2 |
+| Assert.cs:65:20:65:20 | After access to parameter b [true] | Assert.cs:65:24:65:27 | null | 2 |
+| Assert.cs:65:20:65:32 | After ... ? ... : ... | Assert.cs:66:24:66:32 | ... == ... | 11 |
+| Assert.cs:66:9:66:38 | After call to method IsFalse | Assert.cs:63:10:63:11 | Normal Exit | 13 |
+| Assert.cs:66:24:66:32 | After ... == ... [false] | Assert.cs:66:37:66:37 | access to parameter b | 2 |
+| Assert.cs:66:24:66:32 | After ... == ... [true] | Assert.cs:66:24:66:32 | After ... == ... [true] | 1 |
+| Assert.cs:66:24:66:37 | After ... \|\| ... | Assert.cs:66:9:66:38 | call to method IsFalse | 2 |
+| Assert.cs:70:10:70:12 | Entry | Assert.cs:72:20:72:20 | access to parameter b | 8 |
+| Assert.cs:70:10:70:12 | Exceptional Exit | Assert.cs:70:10:70:12 | Exceptional Exit | 1 |
+| Assert.cs:70:10:70:12 | Exit | Assert.cs:70:10:70:12 | Exit | 1 |
+| Assert.cs:72:20:72:20 | After access to parameter b [false] | Assert.cs:72:31:72:32 | "" | 2 |
+| Assert.cs:72:20:72:20 | After access to parameter b [true] | Assert.cs:72:24:72:27 | null | 2 |
+| Assert.cs:72:20:72:32 | After ... ? ... : ... | Assert.cs:73:23:73:31 | ... == ... | 11 |
+| Assert.cs:73:9:73:37 | After call to method IsTrue | Assert.cs:70:10:70:12 | Normal Exit | 13 |
+| Assert.cs:73:23:73:31 | After ... == ... [false] | Assert.cs:73:23:73:31 | After ... == ... [false] | 1 |
+| Assert.cs:73:23:73:31 | After ... == ... [true] | Assert.cs:73:36:73:36 | access to parameter b | 2 |
+| Assert.cs:73:23:73:36 | After ... && ... | Assert.cs:73:9:73:37 | call to method IsTrue | 2 |
+| Assert.cs:77:10:77:12 | Entry | Assert.cs:79:20:79:20 | access to parameter b | 8 |
+| Assert.cs:77:10:77:12 | Exceptional Exit | Assert.cs:77:10:77:12 | Exceptional Exit | 1 |
+| Assert.cs:77:10:77:12 | Exit | Assert.cs:77:10:77:12 | Exit | 1 |
+| Assert.cs:79:20:79:20 | After access to parameter b [false] | Assert.cs:79:31:79:32 | "" | 2 |
+| Assert.cs:79:20:79:20 | After access to parameter b [true] | Assert.cs:79:24:79:27 | null | 2 |
+| Assert.cs:79:20:79:32 | After ... ? ... : ... | Assert.cs:80:24:80:32 | ... != ... | 11 |
+| Assert.cs:80:9:80:38 | After call to method IsFalse | Assert.cs:77:10:77:12 | Normal Exit | 13 |
+| Assert.cs:80:24:80:32 | After ... != ... [false] | Assert.cs:80:37:80:37 | access to parameter b | 2 |
+| Assert.cs:80:24:80:32 | After ... != ... [true] | Assert.cs:80:24:80:32 | After ... != ... [true] | 1 |
+| Assert.cs:80:24:80:37 | After ... \|\| ... | Assert.cs:80:9:80:38 | call to method IsFalse | 2 |
+| Assert.cs:84:10:84:12 | Entry | Assert.cs:86:20:86:20 | access to parameter b | 8 |
+| Assert.cs:84:10:84:12 | Exceptional Exit | Assert.cs:84:10:84:12 | Exceptional Exit | 1 |
+| Assert.cs:84:10:84:12 | Exit | Assert.cs:84:10:84:12 | Exit | 1 |
+| Assert.cs:86:20:86:20 | After access to parameter b [false] | Assert.cs:86:31:86:32 | "" | 2 |
+| Assert.cs:86:20:86:20 | After access to parameter b [true] | Assert.cs:86:24:86:27 | null | 2 |
+| Assert.cs:86:20:86:32 | After ... ? ... : ... | Assert.cs:87:9:87:31 | call to method Assert | 12 |
+| Assert.cs:87:9:87:31 | After call to method Assert | Assert.cs:90:13:90:13 | access to parameter b | 16 |
+| Assert.cs:90:13:90:13 | After access to parameter b [false] | Assert.cs:90:24:90:25 | "" | 2 |
+| Assert.cs:90:13:90:13 | After access to parameter b [true] | Assert.cs:90:17:90:20 | null | 2 |
+| Assert.cs:90:13:90:25 | After ... ? ... : ... | Assert.cs:91:9:91:24 | call to method IsNull | 8 |
+| Assert.cs:91:9:91:24 | After call to method IsNull | Assert.cs:94:13:94:13 | access to parameter b | 16 |
+| Assert.cs:94:13:94:13 | After access to parameter b [false] | Assert.cs:94:24:94:25 | "" | 2 |
+| Assert.cs:94:13:94:13 | After access to parameter b [true] | Assert.cs:94:17:94:20 | null | 2 |
+| Assert.cs:94:13:94:25 | After ... ? ... : ... | Assert.cs:95:9:95:27 | call to method IsNotNull | 8 |
+| Assert.cs:95:9:95:27 | After call to method IsNotNull | Assert.cs:98:13:98:13 | access to parameter b | 16 |
+| Assert.cs:98:13:98:13 | After access to parameter b [false] | Assert.cs:98:24:98:25 | "" | 2 |
+| Assert.cs:98:13:98:13 | After access to parameter b [true] | Assert.cs:98:17:98:20 | null | 2 |
+| Assert.cs:98:13:98:25 | After ... ? ... : ... | Assert.cs:99:9:99:32 | call to method IsTrue | 12 |
+| Assert.cs:99:9:99:32 | After call to method IsTrue | Assert.cs:102:13:102:13 | access to parameter b | 16 |
+| Assert.cs:102:13:102:13 | After access to parameter b [false] | Assert.cs:102:24:102:25 | "" | 2 |
+| Assert.cs:102:13:102:13 | After access to parameter b [true] | Assert.cs:102:17:102:20 | null | 2 |
+| Assert.cs:102:13:102:25 | After ... ? ... : ... | Assert.cs:103:9:103:32 | call to method IsTrue | 12 |
+| Assert.cs:103:9:103:32 | After call to method IsTrue | Assert.cs:106:13:106:13 | access to parameter b | 16 |
+| Assert.cs:106:13:106:13 | After access to parameter b [false] | Assert.cs:106:24:106:25 | "" | 2 |
+| Assert.cs:106:13:106:13 | After access to parameter b [true] | Assert.cs:106:17:106:20 | null | 2 |
+| Assert.cs:106:13:106:25 | After ... ? ... : ... | Assert.cs:107:9:107:33 | call to method IsFalse | 12 |
+| Assert.cs:107:9:107:33 | After call to method IsFalse | Assert.cs:110:13:110:13 | access to parameter b | 16 |
+| Assert.cs:110:13:110:13 | After access to parameter b [false] | Assert.cs:110:24:110:25 | "" | 2 |
+| Assert.cs:110:13:110:13 | After access to parameter b [true] | Assert.cs:110:17:110:20 | null | 2 |
+| Assert.cs:110:13:110:25 | After ... ? ... : ... | Assert.cs:111:9:111:33 | call to method IsFalse | 12 |
+| Assert.cs:111:9:111:33 | After call to method IsFalse | Assert.cs:114:13:114:13 | access to parameter b | 16 |
+| Assert.cs:114:13:114:13 | After access to parameter b [false] | Assert.cs:114:24:114:25 | "" | 2 |
+| Assert.cs:114:13:114:13 | After access to parameter b [true] | Assert.cs:114:17:114:20 | null | 2 |
+| Assert.cs:114:13:114:25 | After ... ? ... : ... | Assert.cs:115:23:115:31 | ... != ... | 11 |
+| Assert.cs:115:9:115:37 | After call to method IsTrue | Assert.cs:118:13:118:13 | access to parameter b | 16 |
+| Assert.cs:115:23:115:31 | After ... != ... [false] | Assert.cs:115:23:115:31 | After ... != ... [false] | 1 |
+| Assert.cs:115:23:115:31 | After ... != ... [true] | Assert.cs:115:36:115:36 | access to parameter b | 2 |
+| Assert.cs:115:23:115:36 | After ... && ... | Assert.cs:115:9:115:37 | call to method IsTrue | 2 |
+| Assert.cs:118:13:118:13 | After access to parameter b [false] | Assert.cs:118:24:118:25 | "" | 2 |
+| Assert.cs:118:13:118:13 | After access to parameter b [true] | Assert.cs:118:17:118:20 | null | 2 |
+| Assert.cs:118:13:118:25 | After ... ? ... : ... | Assert.cs:119:24:119:32 | ... == ... | 11 |
+| Assert.cs:119:9:119:39 | After call to method IsFalse | Assert.cs:122:13:122:13 | access to parameter b | 16 |
+| Assert.cs:119:24:119:32 | After ... == ... [false] | Assert.cs:119:37:119:38 | After !... | 4 |
+| Assert.cs:119:24:119:32 | After ... == ... [true] | Assert.cs:119:24:119:32 | After ... == ... [true] | 1 |
+| Assert.cs:119:24:119:38 | After ... \|\| ... | Assert.cs:119:9:119:39 | call to method IsFalse | 2 |
+| Assert.cs:122:13:122:13 | After access to parameter b [false] | Assert.cs:122:24:122:25 | "" | 2 |
+| Assert.cs:122:13:122:13 | After access to parameter b [true] | Assert.cs:122:17:122:20 | null | 2 |
+| Assert.cs:122:13:122:25 | After ... ? ... : ... | Assert.cs:123:23:123:31 | ... == ... | 11 |
+| Assert.cs:123:9:123:37 | After call to method IsTrue | Assert.cs:126:13:126:13 | access to parameter b | 16 |
+| Assert.cs:123:23:123:31 | After ... == ... [false] | Assert.cs:123:23:123:31 | After ... == ... [false] | 1 |
+| Assert.cs:123:23:123:31 | After ... == ... [true] | Assert.cs:123:36:123:36 | access to parameter b | 2 |
+| Assert.cs:123:23:123:36 | After ... && ... | Assert.cs:123:9:123:37 | call to method IsTrue | 2 |
+| Assert.cs:126:13:126:13 | After access to parameter b [false] | Assert.cs:126:24:126:25 | "" | 2 |
+| Assert.cs:126:13:126:13 | After access to parameter b [true] | Assert.cs:126:17:126:20 | null | 2 |
+| Assert.cs:126:13:126:25 | After ... ? ... : ... | Assert.cs:127:24:127:32 | ... != ... | 11 |
+| Assert.cs:127:9:127:39 | After call to method IsFalse | Assert.cs:84:10:84:12 | Normal Exit | 13 |
+| Assert.cs:127:24:127:32 | After ... != ... [false] | Assert.cs:127:37:127:38 | After !... | 4 |
+| Assert.cs:127:24:127:32 | After ... != ... [true] | Assert.cs:127:24:127:32 | After ... != ... [true] | 1 |
+| Assert.cs:127:24:127:38 | After ... \|\| ... | Assert.cs:127:9:127:39 | call to method IsFalse | 2 |
+| Assert.cs:131:18:131:32 | Entry | Assert.cs:131:18:131:32 | Exit | 7 |
+| Assert.cs:138:10:138:12 | Entry | Assert.cs:140:9:140:35 | call to method AssertTrueFalse | 12 |
+| Assert.cs:138:10:138:12 | Exceptional Exit | Assert.cs:138:10:138:12 | Exceptional Exit | 1 |
+| Assert.cs:138:10:138:12 | Exit | Assert.cs:138:10:138:12 | Exit | 1 |
+| Assert.cs:140:9:140:35 | After call to method AssertTrueFalse | Assert.cs:138:10:138:12 | Normal Exit | 5 |
+| Assignments.cs:1:7:1:17 | Entry | Assignments.cs:1:7:1:17 | Exit | 11 |
+| Assignments.cs:3:10:3:10 | Entry | Assignments.cs:3:10:3:10 | Exit | 62 |
+| Assignments.cs:14:18:14:35 | Entry | Assignments.cs:14:18:14:35 | Exit | 6 |
+| Assignments.cs:17:40:17:40 | Entry | Assignments.cs:17:40:17:40 | Exit | 9 |
+| Assignments.cs:27:10:27:23 | Entry | Assignments.cs:27:10:27:23 | Exit | 13 |
+| Assignments.cs:32:10:32:22 | Entry | Assignments.cs:32:10:32:22 | Exit | 22 |
+| Assignments.cs:38:10:38:11 | Entry | Assignments.cs:38:10:38:11 | Exit | 52 |
+| BreakInTry.cs:1:7:1:16 | Entry | BreakInTry.cs:1:7:1:16 | Exit | 11 |
+| BreakInTry.cs:3:10:3:11 | Entry | BreakInTry.cs:7:33:7:36 | access to parameter args | 7 |
+| BreakInTry.cs:7:13:11:13 | After foreach (... ... in ...) ... | BreakInTry.cs:15:17:15:28 | ... == ... | 8 |
+| BreakInTry.cs:7:26:7:28 | String arg | BreakInTry.cs:9:21:9:31 | ... == ... | 7 |
+| BreakInTry.cs:7:33:7:36 | After access to parameter args [empty] | BreakInTry.cs:7:33:7:36 | After access to parameter args [empty] | 1 |
+| BreakInTry.cs:7:33:7:36 | After access to parameter args [non-empty] | BreakInTry.cs:7:33:7:36 | After access to parameter args [non-empty] | 1 |
+| BreakInTry.cs:9:21:9:31 | After ... == ... [false] | BreakInTry.cs:7:13:11:13 | [LoopHeader] foreach (... ... in ...) ... | 4 |
+| BreakInTry.cs:9:21:9:31 | After ... == ... [true] | BreakInTry.cs:10:21:10:26 | break; | 3 |
+| BreakInTry.cs:15:13:16:17 | After if (...) ... | BreakInTry.cs:3:10:3:11 | Exit | 6 |
+| BreakInTry.cs:15:17:15:28 | After ... == ... [false] | BreakInTry.cs:15:17:15:28 | After ... == ... [false] | 1 |
+| BreakInTry.cs:15:17:15:28 | After ... == ... [true] | BreakInTry.cs:16:17:16:17 | ; | 2 |
+| BreakInTry.cs:20:10:20:11 | Entry | BreakInTry.cs:22:29:22:32 | access to parameter args | 5 |
+| BreakInTry.cs:22:9:34:9 | After foreach (... ... in ...) ... | BreakInTry.cs:20:10:20:11 | Exit | 5 |
+| BreakInTry.cs:22:22:22:24 | String arg | BreakInTry.cs:26:21:26:31 | ... == ... | 9 |
+| BreakInTry.cs:22:29:22:32 | After access to parameter args [empty] | BreakInTry.cs:22:29:22:32 | After access to parameter args [empty] | 1 |
+| BreakInTry.cs:22:29:22:32 | After access to parameter args [non-empty] | BreakInTry.cs:22:29:22:32 | After access to parameter args [non-empty] | 1 |
+| BreakInTry.cs:24:13:33:13 | After try {...} ... | BreakInTry.cs:22:9:34:9 | [LoopHeader] foreach (... ... in ...) ... | 3 |
+| BreakInTry.cs:26:21:26:31 | After ... == ... [false] | BreakInTry.cs:25:13:28:13 | After {...} | 3 |
+| BreakInTry.cs:26:21:26:31 | After ... == ... [true] | BreakInTry.cs:27:21:27:26 | break; | 3 |
+| BreakInTry.cs:30:13:33:13 | {...} | BreakInTry.cs:31:21:31:32 | ... == ... | 6 |
+| BreakInTry.cs:31:17:32:21 | After if (...) ... | BreakInTry.cs:30:13:33:13 | After {...} | 2 |
+| BreakInTry.cs:31:21:31:32 | After ... == ... [false] | BreakInTry.cs:31:21:31:32 | After ... == ... [false] | 1 |
+| BreakInTry.cs:31:21:31:32 | After ... == ... [true] | BreakInTry.cs:32:21:32:21 | ; | 2 |
+| BreakInTry.cs:38:10:38:11 | Entry | BreakInTry.cs:42:17:42:28 | ... == ... | 10 |
+| BreakInTry.cs:38:10:38:11 | Normal Exit | BreakInTry.cs:38:10:38:11 | Exit | 2 |
+| BreakInTry.cs:40:9:52:9 | After try {...} ... | BreakInTry.cs:39:5:54:5 | After {...} | 3 |
+| BreakInTry.cs:42:17:42:28 | After ... == ... [false] | BreakInTry.cs:41:9:44:9 | After {...} | 3 |
+| BreakInTry.cs:42:17:42:28 | After ... == ... [true] | BreakInTry.cs:43:17:43:23 | return ...; | 3 |
+| BreakInTry.cs:46:9:52:9 | {...} | BreakInTry.cs:47:33:47:36 | access to parameter args | 3 |
+| BreakInTry.cs:47:13:51:13 | After foreach (... ... in ...) ... | BreakInTry.cs:46:9:52:9 | After {...} | 2 |
+| BreakInTry.cs:47:26:47:28 | String arg | BreakInTry.cs:49:21:49:31 | ... == ... | 7 |
+| BreakInTry.cs:47:33:47:36 | After access to parameter args [empty] | BreakInTry.cs:47:33:47:36 | After access to parameter args [empty] | 1 |
+| BreakInTry.cs:47:33:47:36 | After access to parameter args [non-empty] | BreakInTry.cs:47:33:47:36 | After access to parameter args [non-empty] | 1 |
+| BreakInTry.cs:49:21:49:31 | After ... == ... [false] | BreakInTry.cs:47:13:51:13 | [LoopHeader] foreach (... ... in ...) ... | 4 |
+| BreakInTry.cs:49:21:49:31 | After ... == ... [true] | BreakInTry.cs:50:21:50:26 | break; | 3 |
+| BreakInTry.cs:56:10:56:11 | Entry | BreakInTry.cs:60:17:60:28 | ... == ... | 10 |
+| BreakInTry.cs:56:10:56:11 | Normal Exit | BreakInTry.cs:56:10:56:11 | Exit | 2 |
+| BreakInTry.cs:58:9:70:9 | After try {...} ... | BreakInTry.cs:57:5:71:5 | After {...} | 2 |
+| BreakInTry.cs:60:17:60:28 | After ... == ... [false] | BreakInTry.cs:59:9:62:9 | After {...} | 3 |
+| BreakInTry.cs:60:17:60:28 | After ... == ... [true] | BreakInTry.cs:61:17:61:23 | return ...; | 3 |
+| BreakInTry.cs:64:9:70:9 | {...} | BreakInTry.cs:65:33:65:36 | access to parameter args | 3 |
+| BreakInTry.cs:65:13:69:13 | After foreach (... ... in ...) ... | BreakInTry.cs:64:9:70:9 | After {...} | 2 |
+| BreakInTry.cs:65:26:65:28 | String arg | BreakInTry.cs:67:21:67:31 | ... == ... | 7 |
+| BreakInTry.cs:65:33:65:36 | After access to parameter args [empty] | BreakInTry.cs:65:33:65:36 | After access to parameter args [empty] | 1 |
+| BreakInTry.cs:65:33:65:36 | After access to parameter args [non-empty] | BreakInTry.cs:65:33:65:36 | After access to parameter args [non-empty] | 1 |
+| BreakInTry.cs:67:21:67:31 | After ... == ... [false] | BreakInTry.cs:65:13:69:13 | [LoopHeader] foreach (... ... in ...) ... | 4 |
+| BreakInTry.cs:67:21:67:31 | After ... == ... [true] | BreakInTry.cs:68:21:68:26 | break; | 3 |
+| CompileTimeOperators.cs:3:7:3:26 | Entry | CompileTimeOperators.cs:3:7:3:26 | Exit | 11 |
+| CompileTimeOperators.cs:5:9:5:15 | Entry | CompileTimeOperators.cs:5:9:5:15 | Exit | 7 |
+| CompileTimeOperators.cs:10:9:10:14 | Entry | CompileTimeOperators.cs:10:9:10:14 | Exit | 7 |
+| CompileTimeOperators.cs:15:10:15:15 | Entry | CompileTimeOperators.cs:15:10:15:15 | Exit | 7 |
+| CompileTimeOperators.cs:20:12:20:17 | Entry | CompileTimeOperators.cs:20:12:20:17 | Exit | 8 |
+| CompileTimeOperators.cs:26:7:26:22 | Entry | CompileTimeOperators.cs:26:7:26:22 | Exit | 11 |
+| CompileTimeOperators.cs:28:10:28:10 | Entry | CompileTimeOperators.cs:36:9:38:9 | After {...} | 14 |
+| CompileTimeOperators.cs:28:10:28:10 | Exceptional Exit | CompileTimeOperators.cs:28:10:28:10 | Exceptional Exit | 1 |
+| CompileTimeOperators.cs:28:10:28:10 | Exit | CompileTimeOperators.cs:28:10:28:10 | Exit | 1 |
+| CompileTimeOperators.cs:30:9:38:9 | After try {...} ... | CompileTimeOperators.cs:39:9:39:34 | After ...; | 7 |
+| CompileTimeOperators.cs:40:9:40:11 | End: | CompileTimeOperators.cs:28:10:28:10 | Normal Exit | 9 |
+| ConditionalAccess.cs:1:7:1:23 | Entry | ConditionalAccess.cs:1:7:1:23 | Exit | 11 |
+| ConditionalAccess.cs:3:12:3:13 | Entry | ConditionalAccess.cs:3:26:3:26 | access to parameter i | 5 |
+| ConditionalAccess.cs:3:26:3:26 | After access to parameter i [non-null] | ConditionalAccess.cs:3:26:3:38 | call to method ToString | 2 |
+| ConditionalAccess.cs:3:26:3:26 | After access to parameter i [null] | ConditionalAccess.cs:3:26:3:26 | After access to parameter i [null] | 1 |
+| ConditionalAccess.cs:3:26:3:38 | After call to method ToString [non-null] | ConditionalAccess.cs:3:26:3:49 | call to method ToLower | 2 |
+| ConditionalAccess.cs:3:26:3:38 | After call to method ToString [null] | ConditionalAccess.cs:3:26:3:38 | After call to method ToString [null] | 1 |
+| ConditionalAccess.cs:3:26:3:49 | After call to method ToLower | ConditionalAccess.cs:3:12:3:13 | Exit | 3 |
+| ConditionalAccess.cs:5:10:5:11 | Entry | ConditionalAccess.cs:5:26:5:26 | access to parameter s | 4 |
+| ConditionalAccess.cs:5:26:5:26 | After access to parameter s [non-null] | ConditionalAccess.cs:5:26:5:34 | access to property Length | 2 |
+| ConditionalAccess.cs:5:26:5:26 | After access to parameter s [null] | ConditionalAccess.cs:5:26:5:26 | After access to parameter s [null] | 1 |
+| ConditionalAccess.cs:5:26:5:34 | After access to property Length | ConditionalAccess.cs:5:10:5:11 | Exit | 3 |
+| ConditionalAccess.cs:7:10:7:11 | Entry | ConditionalAccess.cs:7:39:7:40 | access to parameter s1 | 6 |
+| ConditionalAccess.cs:7:38:7:55 | After access to property Length | ConditionalAccess.cs:7:10:7:11 | Exit | 3 |
+| ConditionalAccess.cs:7:39:7:40 | After access to parameter s1 [non-null] | ConditionalAccess.cs:7:39:7:40 | After access to parameter s1 [non-null] | 1 |
+| ConditionalAccess.cs:7:39:7:40 | After access to parameter s1 [null] | ConditionalAccess.cs:7:45:7:46 | access to parameter s2 | 2 |
+| ConditionalAccess.cs:7:39:7:46 | After ... ?? ... [non-null] | ConditionalAccess.cs:7:38:7:55 | access to property Length | 2 |
+| ConditionalAccess.cs:7:45:7:46 | After access to parameter s2 [non-null] | ConditionalAccess.cs:7:45:7:46 | After access to parameter s2 [non-null] | 1 |
+| ConditionalAccess.cs:7:45:7:46 | After access to parameter s2 [null] | ConditionalAccess.cs:7:39:7:46 | After ... ?? ... [null] | 2 |
+| ConditionalAccess.cs:9:9:9:10 | Entry | ConditionalAccess.cs:9:25:9:25 | access to parameter s | 5 |
+| ConditionalAccess.cs:9:25:9:25 | After access to parameter s [non-null] | ConditionalAccess.cs:9:25:9:33 | access to property Length | 2 |
+| ConditionalAccess.cs:9:25:9:25 | After access to parameter s [null] | ConditionalAccess.cs:9:25:9:25 | After access to parameter s [null] | 1 |
+| ConditionalAccess.cs:9:25:9:33 | After access to property Length [non-null] | ConditionalAccess.cs:9:25:9:33 | After access to property Length [non-null] | 1 |
+| ConditionalAccess.cs:9:25:9:33 | After access to property Length [null] | ConditionalAccess.cs:9:38:9:38 | 0 | 2 |
+| ConditionalAccess.cs:9:25:9:38 | After ... ?? ... | ConditionalAccess.cs:9:9:9:10 | Exit | 3 |
+| ConditionalAccess.cs:11:9:11:10 | Entry | ConditionalAccess.cs:13:13:13:13 | access to parameter s | 7 |
+| ConditionalAccess.cs:11:9:11:10 | Normal Exit | ConditionalAccess.cs:11:9:11:10 | Exit | 2 |
+| ConditionalAccess.cs:13:13:13:13 | After access to parameter s [non-null] | ConditionalAccess.cs:13:13:13:21 | access to property Length | 2 |
+| ConditionalAccess.cs:13:13:13:13 | After access to parameter s [null] | ConditionalAccess.cs:13:13:13:13 | After access to parameter s [null] | 1 |
+| ConditionalAccess.cs:13:13:13:21 | After access to property Length | ConditionalAccess.cs:13:13:13:25 | ... > ... | 6 |
+| ConditionalAccess.cs:13:13:13:25 | After ... > ... [false] | ConditionalAccess.cs:16:13:16:21 | return ...; | 4 |
+| ConditionalAccess.cs:13:13:13:25 | After ... > ... [true] | ConditionalAccess.cs:14:13:14:21 | return ...; | 4 |
+| ConditionalAccess.cs:19:12:19:13 | Entry | ConditionalAccess.cs:19:40:19:41 | access to parameter s1 | 5 |
+| ConditionalAccess.cs:19:40:19:41 | After access to parameter s1 [non-null] | ConditionalAccess.cs:19:40:19:60 | call to method CommaJoinWith | 3 |
+| ConditionalAccess.cs:19:40:19:41 | After access to parameter s1 [null] | ConditionalAccess.cs:19:40:19:41 | After access to parameter s1 [null] | 1 |
+| ConditionalAccess.cs:19:40:19:60 | After call to method CommaJoinWith | ConditionalAccess.cs:19:12:19:13 | Exit | 3 |
+| ConditionalAccess.cs:21:10:21:11 | Entry | ConditionalAccess.cs:23:18:23:29 | (...) ... | 10 |
+| ConditionalAccess.cs:23:17:23:38 | After access to property Length | ConditionalAccess.cs:24:18:24:24 | (...) ... | 11 |
+| ConditionalAccess.cs:23:18:23:29 | After (...) ... [non-null] | ConditionalAccess.cs:23:17:23:38 | access to property Length | 2 |
+| ConditionalAccess.cs:23:18:23:29 | After (...) ... [null] | ConditionalAccess.cs:23:18:23:29 | After (...) ... [null] | 1 |
+| ConditionalAccess.cs:24:17:24:37 | After call to method ToString | ConditionalAccess.cs:25:13:25:14 | "" | 9 |
+| ConditionalAccess.cs:24:18:24:24 | After (...) ... [non-null] | ConditionalAccess.cs:24:17:24:37 | call to method ToString | 2 |
+| ConditionalAccess.cs:24:18:24:24 | After (...) ... [null] | ConditionalAccess.cs:24:18:24:24 | After (...) ... [null] | 1 |
+| ConditionalAccess.cs:25:13:25:14 | After "" [non-null] | ConditionalAccess.cs:25:13:25:32 | call to method CommaJoinWith | 3 |
+| ConditionalAccess.cs:25:13:25:14 | After "" [null] | ConditionalAccess.cs:25:13:25:14 | After "" [null] | 1 |
+| ConditionalAccess.cs:25:13:25:32 | After call to method CommaJoinWith | ConditionalAccess.cs:21:10:21:11 | Exit | 7 |
+| ConditionalAccess.cs:30:10:30:12 | Entry | ConditionalAccess.cs:30:10:30:12 | Exit | 9 |
+| ConditionalAccess.cs:32:10:32:11 | Entry | ConditionalAccess.cs:35:9:35:12 | access to property Prop | 16 |
+| ConditionalAccess.cs:35:9:35:12 | After access to property Prop [non-null] | ConditionalAccess.cs:35:9:35:24 | call to method Out | 3 |
+| ConditionalAccess.cs:35:9:35:12 | After access to property Prop [null] | ConditionalAccess.cs:35:9:35:12 | After access to property Prop [null] | 1 |
+| ConditionalAccess.cs:35:9:35:24 | After call to method Out | ConditionalAccess.cs:32:10:32:11 | Exit | 5 |
+| ConditionalAccess.cs:42:9:42:11 | Entry | ConditionalAccess.cs:42:9:42:11 | Exit | 8 |
+| ConditionalAccess.cs:43:9:43:11 | Entry | ConditionalAccess.cs:43:9:43:11 | Exit | 6 |
+| ConditionalAccess.cs:46:10:46:11 | Entry | ConditionalAccess.cs:48:9:48:10 | access to parameter ca | 7 |
+| ConditionalAccess.cs:48:9:48:10 | After access to parameter ca [non-null] | ConditionalAccess.cs:48:12:48:25 | ... = ... | 5 |
+| ConditionalAccess.cs:48:9:48:10 | After access to parameter ca [null] | ConditionalAccess.cs:48:9:48:10 | After access to parameter ca [null] | 1 |
+| ConditionalAccess.cs:48:12:48:25 | After ... = ... | ConditionalAccess.cs:49:9:49:10 | access to parameter ca | 6 |
+| ConditionalAccess.cs:49:9:49:10 | After access to parameter ca [non-null] | ConditionalAccess.cs:49:12:49:32 | ... = ... | 5 |
+| ConditionalAccess.cs:49:9:49:10 | After access to parameter ca [null] | ConditionalAccess.cs:49:9:49:10 | After access to parameter ca [null] | 1 |
+| ConditionalAccess.cs:49:12:49:32 | After ... = ... | ConditionalAccess.cs:50:9:50:10 | access to parameter ca | 6 |
+| ConditionalAccess.cs:50:9:50:10 | After access to parameter ca [non-null] | ConditionalAccess.cs:50:12:50:23 | ... = ... | 6 |
+| ConditionalAccess.cs:50:9:50:10 | After access to parameter ca [null] | ConditionalAccess.cs:50:9:50:10 | After access to parameter ca [null] | 1 |
+| ConditionalAccess.cs:50:12:50:23 | After ... = ... | ConditionalAccess.cs:51:9:51:10 | access to parameter ca | 7 |
+| ConditionalAccess.cs:51:9:51:10 | After access to parameter ca [non-null] | ConditionalAccess.cs:51:9:51:16 | access to property Prop | 2 |
+| ConditionalAccess.cs:51:9:51:10 | After access to parameter ca [null] | ConditionalAccess.cs:51:9:51:10 | After access to parameter ca [null] | 1 |
+| ConditionalAccess.cs:51:9:51:16 | After access to property Prop [non-null] | ConditionalAccess.cs:51:18:51:31 | ... = ... | 5 |
+| ConditionalAccess.cs:51:9:51:16 | After access to property Prop [null] | ConditionalAccess.cs:51:9:51:16 | After access to property Prop [null] | 1 |
+| ConditionalAccess.cs:51:18:51:31 | After ... = ... | ConditionalAccess.cs:52:9:52:10 | access to parameter ca | 7 |
+| ConditionalAccess.cs:52:9:52:10 | After access to parameter ca [non-null] | ConditionalAccess.cs:52:9:52:16 | access to property Prop | 2 |
+| ConditionalAccess.cs:52:9:52:10 | After access to parameter ca [null] | ConditionalAccess.cs:52:9:52:10 | After access to parameter ca [null] | 1 |
+| ConditionalAccess.cs:52:9:52:16 | After access to property Prop [non-null] | ConditionalAccess.cs:52:18:52:38 | ... = ... | 5 |
+| ConditionalAccess.cs:52:9:52:16 | After access to property Prop [null] | ConditionalAccess.cs:52:9:52:16 | After access to property Prop [null] | 1 |
+| ConditionalAccess.cs:52:18:52:38 | After ... = ... | ConditionalAccess.cs:53:9:53:10 | access to parameter ca | 6 |
+| ConditionalAccess.cs:53:9:53:10 | After access to parameter ca [non-null] | ConditionalAccess.cs:53:12:53:25 | ... -= ... | 5 |
+| ConditionalAccess.cs:53:9:53:10 | After access to parameter ca [null] | ConditionalAccess.cs:53:9:53:10 | After access to parameter ca [null] | 1 |
+| ConditionalAccess.cs:53:12:53:25 | After ... -= ... | ConditionalAccess.cs:54:9:54:10 | access to parameter ca | 6 |
+| ConditionalAccess.cs:54:9:54:10 | After access to parameter ca [non-null] | ConditionalAccess.cs:54:12:54:29 | ... += ... | 5 |
+| ConditionalAccess.cs:54:9:54:10 | After access to parameter ca [null] | ConditionalAccess.cs:54:9:54:10 | After access to parameter ca [null] | 1 |
+| ConditionalAccess.cs:54:12:54:29 | After ... += ... | ConditionalAccess.cs:46:10:46:11 | Exit | 5 |
+| ConditionalAccess.cs:60:26:60:38 | Entry | ConditionalAccess.cs:60:26:60:38 | Exit | 14 |
+| Conditions.cs:1:7:1:16 | Entry | Conditions.cs:1:7:1:16 | Exit | 11 |
+| Conditions.cs:3:10:3:19 | Entry | Conditions.cs:5:13:5:15 | access to parameter inc | 6 |
+| Conditions.cs:5:9:6:16 | After if (...) ... | Conditions.cs:7:14:7:16 | access to parameter inc | 4 |
+| Conditions.cs:5:13:5:15 | After access to parameter inc [false] | Conditions.cs:5:13:5:15 | After access to parameter inc [false] | 1 |
+| Conditions.cs:5:13:5:15 | After access to parameter inc [true] | Conditions.cs:6:13:6:16 | After ...; | 7 |
+| Conditions.cs:7:9:8:16 | After if (...) ... | Conditions.cs:3:10:3:19 | Exit | 4 |
+| Conditions.cs:7:14:7:16 | After access to parameter inc [false] | Conditions.cs:8:13:8:16 | After ...; | 8 |
+| Conditions.cs:7:14:7:16 | After access to parameter inc [true] | Conditions.cs:7:13:7:16 | After !... [false] | 2 |
+| Conditions.cs:11:9:11:10 | Entry | Conditions.cs:14:13:14:13 | access to parameter b | 12 |
+| Conditions.cs:14:9:15:16 | After if (...) ... | Conditions.cs:16:13:16:17 | ... > ... | 6 |
+| Conditions.cs:14:13:14:13 | After access to parameter b [false] | Conditions.cs:14:13:14:13 | After access to parameter b [false] | 1 |
+| Conditions.cs:14:13:14:13 | After access to parameter b [true] | Conditions.cs:15:13:15:16 | After ...; | 7 |
+| Conditions.cs:16:9:18:20 | After if (...) ... | Conditions.cs:11:9:11:10 | Exit | 6 |
+| Conditions.cs:16:13:16:17 | After ... > ... [false] | Conditions.cs:16:13:16:17 | After ... > ... [false] | 1 |
+| Conditions.cs:16:13:16:17 | After ... > ... [true] | Conditions.cs:17:18:17:18 | access to parameter b | 4 |
+| Conditions.cs:17:13:18:20 | After if (...) ... | Conditions.cs:17:13:18:20 | After if (...) ... | 1 |
+| Conditions.cs:17:18:17:18 | After access to parameter b [false] | Conditions.cs:18:17:18:20 | After ...; | 8 |
+| Conditions.cs:17:18:17:18 | After access to parameter b [true] | Conditions.cs:17:17:17:18 | After !... [false] | 2 |
+| Conditions.cs:22:9:22:10 | Entry | Conditions.cs:25:13:25:14 | access to parameter b1 | 13 |
+| Conditions.cs:25:9:27:20 | After if (...) ... | Conditions.cs:28:13:28:14 | access to parameter b2 | 3 |
+| Conditions.cs:25:13:25:14 | After access to parameter b1 [false] | Conditions.cs:25:13:25:14 | After access to parameter b1 [false] | 1 |
+| Conditions.cs:25:13:25:14 | After access to parameter b1 [true] | Conditions.cs:26:17:26:18 | access to parameter b2 | 3 |
+| Conditions.cs:26:13:27:20 | After if (...) ... | Conditions.cs:26:13:27:20 | After if (...) ... | 1 |
+| Conditions.cs:26:17:26:18 | After access to parameter b2 [false] | Conditions.cs:26:17:26:18 | After access to parameter b2 [false] | 1 |
+| Conditions.cs:26:17:26:18 | After access to parameter b2 [true] | Conditions.cs:27:17:27:20 | After ...; | 7 |
+| Conditions.cs:28:9:29:16 | After if (...) ... | Conditions.cs:22:9:22:10 | Exit | 6 |
+| Conditions.cs:28:13:28:14 | After access to parameter b2 [false] | Conditions.cs:28:13:28:14 | After access to parameter b2 [false] | 1 |
+| Conditions.cs:28:13:28:14 | After access to parameter b2 [true] | Conditions.cs:29:13:29:16 | After ...; | 7 |
+| Conditions.cs:33:9:33:10 | Entry | Conditions.cs:37:13:37:14 | access to parameter b1 | 19 |
+| Conditions.cs:37:9:38:20 | After if (...) ... | Conditions.cs:39:13:39:14 | access to local variable b2 | 3 |
+| Conditions.cs:37:13:37:14 | After access to parameter b1 [false] | Conditions.cs:37:13:37:14 | After access to parameter b1 [false] | 1 |
+| Conditions.cs:37:13:37:14 | After access to parameter b1 [true] | Conditions.cs:38:13:38:20 | After ...; | 8 |
+| Conditions.cs:39:9:40:16 | After if (...) ... | Conditions.cs:41:13:41:14 | access to local variable b2 | 3 |
+| Conditions.cs:39:13:39:14 | After access to local variable b2 [false] | Conditions.cs:39:13:39:14 | After access to local variable b2 [false] | 1 |
+| Conditions.cs:39:13:39:14 | After access to local variable b2 [true] | Conditions.cs:40:13:40:16 | After ...; | 7 |
+| Conditions.cs:41:9:42:16 | After if (...) ... | Conditions.cs:33:9:33:10 | Exit | 6 |
+| Conditions.cs:41:13:41:14 | After access to local variable b2 [false] | Conditions.cs:41:13:41:14 | After access to local variable b2 [false] | 1 |
+| Conditions.cs:41:13:41:14 | After access to local variable b2 [true] | Conditions.cs:42:13:42:16 | After ...; | 7 |
+| Conditions.cs:46:9:46:10 | Entry | Conditions.cs:49:9:53:9 | while (...) ... | 12 |
+| Conditions.cs:49:9:53:9 | [LoopHeader] while (...) ... | Conditions.cs:49:16:49:22 | ... > ... | 8 |
+| Conditions.cs:49:16:49:22 | After ... > ... [false] | Conditions.cs:46:9:46:10 | Exit | 7 |
+| Conditions.cs:49:16:49:22 | After ... > ... [true] | Conditions.cs:51:17:51:17 | access to parameter b | 4 |
+| Conditions.cs:51:13:52:20 | After if (...) ... | Conditions.cs:50:9:53:9 | After {...} | 2 |
+| Conditions.cs:51:17:51:17 | After access to parameter b [false] | Conditions.cs:51:17:51:17 | After access to parameter b [false] | 1 |
+| Conditions.cs:51:17:51:17 | After access to parameter b [true] | Conditions.cs:52:17:52:20 | After ...; | 7 |
+| Conditions.cs:57:9:57:10 | Entry | Conditions.cs:60:9:64:9 | while (...) ... | 12 |
+| Conditions.cs:60:9:64:9 | [LoopHeader] while (...) ... | Conditions.cs:60:16:60:22 | ... > ... | 8 |
+| Conditions.cs:60:16:60:22 | After ... > ... [false] | Conditions.cs:65:13:65:13 | access to parameter b | 4 |
+| Conditions.cs:60:16:60:22 | After ... > ... [true] | Conditions.cs:62:17:62:17 | access to parameter b | 4 |
+| Conditions.cs:62:13:63:20 | After if (...) ... | Conditions.cs:61:9:64:9 | After {...} | 2 |
+| Conditions.cs:62:17:62:17 | After access to parameter b [false] | Conditions.cs:62:17:62:17 | After access to parameter b [false] | 1 |
+| Conditions.cs:62:17:62:17 | After access to parameter b [true] | Conditions.cs:63:17:63:20 | After ...; | 7 |
+| Conditions.cs:65:9:66:16 | After if (...) ... | Conditions.cs:57:9:57:10 | Exit | 6 |
+| Conditions.cs:65:13:65:13 | After access to parameter b [false] | Conditions.cs:65:13:65:13 | After access to parameter b [false] | 1 |
+| Conditions.cs:65:13:65:13 | After access to parameter b [true] | Conditions.cs:66:13:66:16 | After ...; | 7 |
+| Conditions.cs:70:9:70:10 | Entry | Conditions.cs:74:27:74:28 | access to parameter ss | 26 |
+| Conditions.cs:74:9:80:9 | After foreach (... ... in ...) ... | Conditions.cs:81:13:81:13 | access to local variable b | 3 |
| Conditions.cs:74:22:74:22 | String _ | Conditions.cs:76:17:76:17 | access to local variable b | 4 |
-| Conditions.cs:77:17:77:20 | ...; | Conditions.cs:77:17:77:19 | ...++ | 3 |
-| Conditions.cs:78:13:79:26 | if (...) ... | Conditions.cs:78:17:78:21 | ... > ... | 4 |
-| Conditions.cs:79:17:79:26 | ...; | Conditions.cs:79:17:79:25 | ... = ... | 3 |
-| Conditions.cs:81:9:82:16 | if (...) ... | Conditions.cs:81:13:81:13 | access to local variable b | 2 |
-| Conditions.cs:82:13:82:16 | ...; | Conditions.cs:82:13:82:15 | ...++ | 3 |
-| Conditions.cs:83:16:83:16 | access to local variable x | Conditions.cs:70:9:70:10 | exit M6 | 4 |
-| Conditions.cs:86:9:86:10 | enter M7 | Conditions.cs:90:27:90:28 | access to parameter ss | 12 |
-| Conditions.cs:90:9:98:9 | foreach (... ... in ...) ... | Conditions.cs:90:9:98:9 | foreach (... ... in ...) ... | 1 |
+| Conditions.cs:74:27:74:28 | After access to parameter ss [empty] | Conditions.cs:74:27:74:28 | After access to parameter ss [empty] | 1 |
+| Conditions.cs:74:27:74:28 | After access to parameter ss [non-empty] | Conditions.cs:74:27:74:28 | After access to parameter ss [non-empty] | 1 |
+| Conditions.cs:76:13:77:20 | After if (...) ... | Conditions.cs:78:17:78:21 | ... > ... | 6 |
+| Conditions.cs:76:17:76:17 | After access to local variable b [false] | Conditions.cs:76:17:76:17 | After access to local variable b [false] | 1 |
+| Conditions.cs:76:17:76:17 | After access to local variable b [true] | Conditions.cs:77:17:77:20 | After ...; | 7 |
+| Conditions.cs:78:13:79:26 | After if (...) ... | Conditions.cs:74:9:80:9 | [LoopHeader] foreach (... ... in ...) ... | 3 |
+| Conditions.cs:78:17:78:21 | After ... > ... [false] | Conditions.cs:78:17:78:21 | After ... > ... [false] | 1 |
+| Conditions.cs:78:17:78:21 | After ... > ... [true] | Conditions.cs:79:17:79:26 | After ...; | 8 |
+| Conditions.cs:81:9:82:16 | After if (...) ... | Conditions.cs:70:9:70:10 | Exit | 6 |
+| Conditions.cs:81:13:81:13 | After access to local variable b [false] | Conditions.cs:81:13:81:13 | After access to local variable b [false] | 1 |
+| Conditions.cs:81:13:81:13 | After access to local variable b [true] | Conditions.cs:82:13:82:16 | After ...; | 7 |
+| Conditions.cs:86:9:86:10 | Entry | Conditions.cs:90:27:90:28 | access to parameter ss | 26 |
+| Conditions.cs:90:9:98:9 | After foreach (... ... in ...) ... | Conditions.cs:86:9:86:10 | Exit | 6 |
| Conditions.cs:90:22:90:22 | String _ | Conditions.cs:92:17:92:17 | access to local variable b | 4 |
-| Conditions.cs:93:17:93:20 | ...; | Conditions.cs:93:17:93:19 | ...++ | 3 |
-| Conditions.cs:94:13:95:26 | if (...) ... | Conditions.cs:94:17:94:21 | ... > ... | 4 |
-| Conditions.cs:95:17:95:26 | ...; | Conditions.cs:95:17:95:25 | ... = ... | 3 |
-| Conditions.cs:96:13:97:20 | if (...) ... | Conditions.cs:96:17:96:17 | access to local variable b | 2 |
-| Conditions.cs:97:17:97:20 | ...; | Conditions.cs:97:17:97:19 | ...++ | 3 |
-| Conditions.cs:99:16:99:16 | access to local variable x | Conditions.cs:86:9:86:10 | exit M7 | 4 |
-| Conditions.cs:102:12:102:13 | enter M8 | Conditions.cs:105:13:105:13 | access to parameter b | 8 |
-| Conditions.cs:106:13:106:20 | ...; | Conditions.cs:106:13:106:19 | ... += ... | 4 |
-| Conditions.cs:107:9:109:24 | if (...) ... | Conditions.cs:107:13:107:24 | ... > ... | 5 |
-| Conditions.cs:108:13:109:24 | if (...) ... | Conditions.cs:108:18:108:18 | access to parameter b | 2 |
-| Conditions.cs:108:17:108:18 | [false] !... | Conditions.cs:108:17:108:18 | [false] !... | 1 |
-| Conditions.cs:108:17:108:18 | [true] !... | Conditions.cs:108:17:108:18 | [true] !... | 1 |
-| Conditions.cs:109:17:109:24 | ...; | Conditions.cs:109:17:109:23 | ... += ... | 4 |
-| Conditions.cs:110:16:110:16 | access to local variable x | Conditions.cs:102:12:102:13 | exit M8 | 4 |
-| Conditions.cs:113:10:113:11 | enter M9 | Conditions.cs:116:18:116:22 | Int32 i = ... | 8 |
-| Conditions.cs:113:10:113:11 | exit M9 (normal) | Conditions.cs:113:10:113:11 | exit M9 | 2 |
-| Conditions.cs:116:25:116:25 | access to local variable i | Conditions.cs:116:25:116:39 | ... < ... | 4 |
-| Conditions.cs:116:42:116:42 | access to local variable i | Conditions.cs:116:42:116:44 | ...++ | 2 |
-| Conditions.cs:117:9:123:9 | {...} | Conditions.cs:119:18:119:21 | access to local variable last | 11 |
-| Conditions.cs:119:17:119:21 | [false] !... | Conditions.cs:119:17:119:21 | [false] !... | 1 |
-| Conditions.cs:119:17:119:21 | [true] !... | Conditions.cs:119:17:119:21 | [true] !... | 1 |
-| Conditions.cs:120:17:120:23 | ...; | Conditions.cs:120:17:120:22 | ... = ... | 3 |
-| Conditions.cs:121:13:122:25 | if (...) ... | Conditions.cs:121:17:121:20 | access to local variable last | 2 |
-| Conditions.cs:122:17:122:25 | ...; | Conditions.cs:122:17:122:24 | ... = ... | 3 |
-| Conditions.cs:129:10:129:12 | enter M10 | Conditions.cs:131:9:140:9 | while (...) ... | 3 |
-| Conditions.cs:131:16:131:19 | true | Conditions.cs:131:16:131:19 | true | 1 |
-| Conditions.cs:132:9:140:9 | {...} | Conditions.cs:133:17:133:22 | access to field Field1 | 4 |
-| Conditions.cs:134:13:139:13 | {...} | Conditions.cs:135:21:135:26 | access to field Field2 | 4 |
-| Conditions.cs:136:17:138:17 | {...} | Conditions.cs:137:21:137:37 | call to method ToString | 5 |
-| Conditions.cs:143:10:143:12 | enter M11 | Conditions.cs:145:17:145:17 | access to parameter b | 4 |
-| Conditions.cs:143:10:143:12 | exit M11 (normal) | Conditions.cs:143:10:143:12 | exit M11 | 2 |
-| Conditions.cs:145:17:145:29 | ... ? ... : ... | Conditions.cs:146:13:146:13 | access to parameter b | 4 |
-| Conditions.cs:145:21:145:23 | "a" | Conditions.cs:145:21:145:23 | "a" | 1 |
-| Conditions.cs:145:27:145:29 | "b" | Conditions.cs:145:27:145:29 | "b" | 1 |
-| Conditions.cs:147:13:147:49 | ...; | Conditions.cs:147:13:147:48 | call to method WriteLine | 6 |
-| Conditions.cs:149:13:149:49 | ...; | Conditions.cs:149:13:149:48 | call to method WriteLine | 6 |
-| ExitMethods.cs:6:7:6:17 | enter ExitMethods | ExitMethods.cs:6:7:6:17 | exit ExitMethods | 7 |
-| ExitMethods.cs:8:10:8:11 | enter M1 | ExitMethods.cs:8:10:8:11 | exit M1 | 8 |
-| ExitMethods.cs:14:10:14:11 | enter M2 | ExitMethods.cs:14:10:14:11 | exit M2 | 8 |
-| ExitMethods.cs:20:10:20:11 | enter M3 | ExitMethods.cs:20:10:20:11 | exit M3 | 7 |
-| ExitMethods.cs:26:10:26:11 | enter M4 | ExitMethods.cs:26:10:26:11 | exit M4 | 7 |
-| ExitMethods.cs:32:10:32:11 | enter M5 | ExitMethods.cs:32:10:32:11 | exit M5 | 7 |
-| ExitMethods.cs:38:10:38:11 | enter M6 | ExitMethods.cs:44:9:47:9 | catch (...) {...} | 8 |
-| ExitMethods.cs:38:10:38:11 | exit M6 (normal) | ExitMethods.cs:38:10:38:11 | exit M6 | 2 |
-| ExitMethods.cs:45:9:47:9 | {...} | ExitMethods.cs:46:13:46:19 | return ...; | 2 |
-| ExitMethods.cs:48:9:51:9 | catch (...) {...} | ExitMethods.cs:48:9:51:9 | catch (...) {...} | 1 |
-| ExitMethods.cs:49:9:51:9 | {...} | ExitMethods.cs:50:13:50:19 | return ...; | 2 |
-| ExitMethods.cs:54:10:54:11 | enter M7 | ExitMethods.cs:54:10:54:11 | exit M7 | 6 |
-| ExitMethods.cs:60:10:60:11 | enter M8 | ExitMethods.cs:60:10:60:11 | exit M8 | 6 |
-| ExitMethods.cs:66:17:66:26 | enter ErrorMaybe | ExitMethods.cs:68:13:68:13 | access to parameter b | 4 |
-| ExitMethods.cs:66:17:66:26 | exit ErrorMaybe | ExitMethods.cs:66:17:66:26 | exit ErrorMaybe | 1 |
-| ExitMethods.cs:66:17:66:26 | exit ErrorMaybe (normal) | ExitMethods.cs:66:17:66:26 | exit ErrorMaybe (normal) | 1 |
-| ExitMethods.cs:69:19:69:33 | object creation of type Exception | ExitMethods.cs:66:17:66:26 | exit ErrorMaybe (abnormal) | 3 |
-| ExitMethods.cs:72:17:72:27 | enter ErrorAlways | ExitMethods.cs:74:13:74:13 | access to parameter b | 4 |
-| ExitMethods.cs:72:17:72:27 | exit ErrorAlways (abnormal) | ExitMethods.cs:72:17:72:27 | exit ErrorAlways | 2 |
-| ExitMethods.cs:75:19:75:33 | object creation of type Exception | ExitMethods.cs:75:13:75:34 | throw ...; | 2 |
-| ExitMethods.cs:77:41:77:43 | "b" | ExitMethods.cs:77:13:77:45 | throw ...; | 3 |
-| ExitMethods.cs:80:17:80:28 | enter ErrorAlways2 | ExitMethods.cs:80:17:80:28 | exit ErrorAlways2 | 6 |
-| ExitMethods.cs:85:17:85:28 | enter ErrorAlways3 | ExitMethods.cs:85:17:85:28 | exit ErrorAlways3 | 5 |
-| ExitMethods.cs:87:10:87:13 | enter Exit | ExitMethods.cs:87:10:87:13 | exit Exit | 7 |
-| ExitMethods.cs:92:10:92:18 | enter ExitInTry | ExitMethods.cs:92:10:92:18 | exit ExitInTry | 9 |
-| ExitMethods.cs:105:10:105:24 | enter ApplicationExit | ExitMethods.cs:105:10:105:24 | exit ApplicationExit | 6 |
-| ExitMethods.cs:110:13:110:21 | enter ThrowExpr | ExitMethods.cs:112:16:112:25 | ... != ... | 6 |
-| ExitMethods.cs:110:13:110:21 | exit ThrowExpr | ExitMethods.cs:110:13:110:21 | exit ThrowExpr | 1 |
-| ExitMethods.cs:112:29:112:29 | 1 | ExitMethods.cs:110:13:110:21 | exit ThrowExpr (normal) | 7 |
-| ExitMethods.cs:112:69:112:75 | "input" | ExitMethods.cs:110:13:110:21 | exit ThrowExpr (abnormal) | 4 |
-| ExitMethods.cs:115:16:115:34 | enter ExtensionMethodCall | ExitMethods.cs:117:16:117:30 | call to method Contains | 5 |
-| ExitMethods.cs:117:16:117:38 | ... ? ... : ... | ExitMethods.cs:115:16:115:34 | exit ExtensionMethodCall | 4 |
-| ExitMethods.cs:117:34:117:34 | 0 | ExitMethods.cs:117:34:117:34 | 0 | 1 |
-| ExitMethods.cs:117:38:117:38 | 1 | ExitMethods.cs:117:38:117:38 | 1 | 1 |
-| ExitMethods.cs:120:17:120:32 | enter FailingAssertion | ExitMethods.cs:120:17:120:32 | exit FailingAssertion | 7 |
-| ExitMethods.cs:126:17:126:33 | enter FailingAssertion2 | ExitMethods.cs:126:17:126:33 | exit FailingAssertion2 | 7 |
-| ExitMethods.cs:132:10:132:20 | enter AssertFalse | ExitMethods.cs:132:33:132:49 | call to method IsFalse | 3 |
-| ExitMethods.cs:132:10:132:20 | exit AssertFalse | ExitMethods.cs:132:10:132:20 | exit AssertFalse | 1 |
-| ExitMethods.cs:132:10:132:20 | exit AssertFalse (abnormal) | ExitMethods.cs:132:10:132:20 | exit AssertFalse (abnormal) | 1 |
-| ExitMethods.cs:132:10:132:20 | exit AssertFalse (normal) | ExitMethods.cs:132:10:132:20 | exit AssertFalse (normal) | 1 |
-| ExitMethods.cs:134:17:134:33 | enter FailingAssertion3 | ExitMethods.cs:134:17:134:33 | exit FailingAssertion3 | 8 |
-| ExitMethods.cs:140:17:140:42 | enter ExceptionDispatchInfoThrow | ExitMethods.cs:142:13:142:13 | access to parameter b | 4 |
-| ExitMethods.cs:140:17:140:42 | exit ExceptionDispatchInfoThrow (abnormal) | ExitMethods.cs:140:17:140:42 | exit ExceptionDispatchInfoThrow | 2 |
-| ExitMethods.cs:143:13:143:43 | ...; | ExitMethods.cs:143:13:143:42 | call to method Throw | 3 |
-| ExitMethods.cs:145:13:145:53 | ...; | ExitMethods.cs:145:13:145:52 | call to method Throw | 4 |
-| Extensions.cs:5:23:5:29 | enter ToInt32 | Extensions.cs:5:23:5:29 | exit ToInt32 | 7 |
-| Extensions.cs:10:24:10:29 | enter ToBool | Extensions.cs:10:24:10:29 | exit ToBool | 8 |
-| Extensions.cs:15:23:15:33 | enter CallToInt32 | Extensions.cs:15:23:15:33 | exit CallToInt32 | 5 |
-| Extensions.cs:20:17:20:20 | enter Main | Extensions.cs:20:17:20:20 | exit Main | 20 |
-| Finally.cs:3:14:3:20 | enter Finally | Finally.cs:3:14:3:20 | exit Finally | 7 |
-| Finally.cs:7:10:7:11 | enter M1 | Finally.cs:15:13:15:40 | call to method WriteLine | 11 |
-| Finally.cs:7:10:7:11 | exit M1 | Finally.cs:7:10:7:11 | exit M1 | 1 |
-| Finally.cs:7:10:7:11 | exit M1 (abnormal) | Finally.cs:7:10:7:11 | exit M1 (abnormal) | 1 |
-| Finally.cs:7:10:7:11 | exit M1 (normal) | Finally.cs:7:10:7:11 | exit M1 (normal) | 1 |
-| Finally.cs:19:10:19:11 | enter M2 | Finally.cs:23:13:23:37 | call to method WriteLine | 7 |
-| Finally.cs:19:10:19:11 | exit M2 | Finally.cs:19:10:19:11 | exit M2 | 1 |
-| Finally.cs:19:10:19:11 | exit M2 (abnormal) | Finally.cs:19:10:19:11 | exit M2 (abnormal) | 1 |
-| Finally.cs:19:10:19:11 | exit M2 (normal) | Finally.cs:19:10:19:11 | exit M2 (normal) | 1 |
-| Finally.cs:24:13:24:19 | return ...; | Finally.cs:24:13:24:19 | return ...; | 1 |
+| Conditions.cs:90:27:90:28 | After access to parameter ss [empty] | Conditions.cs:90:27:90:28 | After access to parameter ss [empty] | 1 |
+| Conditions.cs:90:27:90:28 | After access to parameter ss [non-empty] | Conditions.cs:90:27:90:28 | After access to parameter ss [non-empty] | 1 |
+| Conditions.cs:92:13:93:20 | After if (...) ... | Conditions.cs:94:17:94:21 | ... > ... | 6 |
+| Conditions.cs:92:17:92:17 | After access to local variable b [false] | Conditions.cs:92:17:92:17 | After access to local variable b [false] | 1 |
+| Conditions.cs:92:17:92:17 | After access to local variable b [true] | Conditions.cs:93:17:93:20 | After ...; | 7 |
+| Conditions.cs:94:13:95:26 | After if (...) ... | Conditions.cs:96:17:96:17 | access to local variable b | 3 |
+| Conditions.cs:94:17:94:21 | After ... > ... [false] | Conditions.cs:94:17:94:21 | After ... > ... [false] | 1 |
+| Conditions.cs:94:17:94:21 | After ... > ... [true] | Conditions.cs:95:17:95:26 | After ...; | 8 |
+| Conditions.cs:96:13:97:20 | After if (...) ... | Conditions.cs:90:9:98:9 | [LoopHeader] foreach (... ... in ...) ... | 3 |
+| Conditions.cs:96:17:96:17 | After access to local variable b [false] | Conditions.cs:96:17:96:17 | After access to local variable b [false] | 1 |
+| Conditions.cs:96:17:96:17 | After access to local variable b [true] | Conditions.cs:97:17:97:20 | After ...; | 7 |
+| Conditions.cs:102:12:102:13 | Entry | Conditions.cs:105:13:105:13 | access to parameter b | 15 |
+| Conditions.cs:105:9:106:20 | After if (...) ... | Conditions.cs:107:13:107:24 | ... > ... | 9 |
+| Conditions.cs:105:13:105:13 | After access to parameter b [false] | Conditions.cs:105:13:105:13 | After access to parameter b [false] | 1 |
+| Conditions.cs:105:13:105:13 | After access to parameter b [true] | Conditions.cs:106:13:106:20 | After ...; | 8 |
+| Conditions.cs:107:9:109:24 | After if (...) ... | Conditions.cs:102:12:102:13 | Exit | 6 |
+| Conditions.cs:107:13:107:24 | After ... > ... [false] | Conditions.cs:107:13:107:24 | After ... > ... [false] | 1 |
+| Conditions.cs:107:13:107:24 | After ... > ... [true] | Conditions.cs:108:18:108:18 | access to parameter b | 4 |
+| Conditions.cs:108:13:109:24 | After if (...) ... | Conditions.cs:108:13:109:24 | After if (...) ... | 1 |
+| Conditions.cs:108:18:108:18 | After access to parameter b [false] | Conditions.cs:109:17:109:24 | After ...; | 9 |
+| Conditions.cs:108:18:108:18 | After access to parameter b [true] | Conditions.cs:108:17:108:18 | After !... [false] | 2 |
+| Conditions.cs:113:10:113:11 | Entry | Conditions.cs:116:18:116:22 | After Int32 i = ... | 16 |
+| Conditions.cs:116:25:116:39 | After ... < ... [false] | Conditions.cs:113:10:113:11 | Exit | 5 |
+| Conditions.cs:116:25:116:39 | After ... < ... [true] | Conditions.cs:119:18:119:21 | access to local variable last | 23 |
+| Conditions.cs:116:25:116:39 | Before ... < ... | Conditions.cs:116:25:116:39 | ... < ... | 7 |
+| Conditions.cs:119:13:120:23 | After if (...) ... | Conditions.cs:121:17:121:20 | access to local variable last | 3 |
+| Conditions.cs:119:18:119:21 | After access to local variable last [false] | Conditions.cs:120:17:120:23 | After ...; | 9 |
+| Conditions.cs:119:18:119:21 | After access to local variable last [true] | Conditions.cs:119:17:119:21 | After !... [false] | 2 |
+| Conditions.cs:121:13:122:25 | After if (...) ... | Conditions.cs:116:42:116:44 | After ...++ | 7 |
+| Conditions.cs:121:17:121:20 | After access to local variable last [false] | Conditions.cs:121:17:121:20 | After access to local variable last [false] | 1 |
+| Conditions.cs:121:17:121:20 | After access to local variable last [true] | Conditions.cs:122:17:122:25 | After ...; | 8 |
+| Conditions.cs:129:10:129:12 | Entry | Conditions.cs:131:9:140:9 | while (...) ... | 3 |
+| Conditions.cs:131:9:140:9 | [LoopHeader] while (...) ... | Conditions.cs:133:17:133:22 | access to field Field1 | 8 |
+| Conditions.cs:133:13:139:13 | After if (...) ... | Conditions.cs:132:9:140:9 | After {...} | 2 |
+| Conditions.cs:133:17:133:22 | After access to field Field1 [false] | Conditions.cs:133:17:133:22 | After access to field Field1 [false] | 1 |
+| Conditions.cs:133:17:133:22 | After access to field Field1 [true] | Conditions.cs:135:21:135:26 | access to field Field2 | 6 |
+| Conditions.cs:135:17:138:17 | After if (...) ... | Conditions.cs:134:13:139:13 | After {...} | 2 |
+| Conditions.cs:135:21:135:26 | After access to field Field2 [false] | Conditions.cs:135:21:135:26 | After access to field Field2 [false] | 1 |
+| Conditions.cs:135:21:135:26 | After access to field Field2 [true] | Conditions.cs:136:17:138:17 | After {...} | 12 |
+| Conditions.cs:143:10:143:12 | Entry | Conditions.cs:145:17:145:17 | access to parameter b | 8 |
+| Conditions.cs:145:17:145:17 | After access to parameter b [false] | Conditions.cs:145:27:145:29 | "b" | 2 |
+| Conditions.cs:145:17:145:17 | After access to parameter b [true] | Conditions.cs:145:21:145:23 | "a" | 2 |
+| Conditions.cs:145:17:145:29 | After ... ? ... : ... | Conditions.cs:146:13:146:13 | access to parameter b | 6 |
+| Conditions.cs:146:9:149:49 | After if (...) ... | Conditions.cs:143:10:143:12 | Exit | 4 |
+| Conditions.cs:146:13:146:13 | After access to parameter b [false] | Conditions.cs:149:13:149:49 | After ...; | 14 |
+| Conditions.cs:146:13:146:13 | After access to parameter b [true] | Conditions.cs:147:13:147:49 | After ...; | 14 |
+| DefaultParam.cs:1:7:1:18 | Entry | DefaultParam.cs:1:7:1:18 | Exit | 11 |
+| DefaultParam.cs:3:12:3:13 | Entry | DefaultParam.cs:3:30:3:30 | s | 3 |
+| DefaultParam.cs:3:30:3:30 | After s [match] | DefaultParam.cs:3:30:3:30 | After s [match] | 1 |
+| DefaultParam.cs:3:30:3:30 | After s [no-match] | DefaultParam.cs:3:34:3:35 | "" | 2 |
+| DefaultParam.cs:3:42:3:42 | After i [match] | DefaultParam.cs:3:42:3:42 | After i [match] | 1 |
+| DefaultParam.cs:3:42:3:42 | After i [no-match] | DefaultParam.cs:3:46:3:46 | 0 | 2 |
+| DefaultParam.cs:3:42:3:42 | i | DefaultParam.cs:3:42:3:42 | i | 1 |
+| DefaultParam.cs:4:5:6:5 | {...} | DefaultParam.cs:3:12:3:13 | Exit | 20 |
+| ExitMethods.cs:6:7:6:17 | Entry | ExitMethods.cs:6:7:6:17 | Exit | 11 |
+| ExitMethods.cs:8:10:8:11 | Entry | ExitMethods.cs:8:10:8:11 | Exit | 12 |
+| ExitMethods.cs:14:10:14:11 | Entry | ExitMethods.cs:14:10:14:11 | Exit | 12 |
+| ExitMethods.cs:20:10:20:11 | Entry | ExitMethods.cs:20:10:20:11 | Exit | 8 |
+| ExitMethods.cs:26:10:26:11 | Entry | ExitMethods.cs:26:10:26:11 | Exit | 8 |
+| ExitMethods.cs:32:10:32:11 | Entry | ExitMethods.cs:32:10:32:11 | Exit | 8 |
+| ExitMethods.cs:38:10:38:11 | Entry | ExitMethods.cs:44:9:47:9 | catch (...) {...} | 9 |
+| ExitMethods.cs:38:10:38:11 | Exit | ExitMethods.cs:38:10:38:11 | Exit | 1 |
+| ExitMethods.cs:38:10:38:11 | Normal Exit | ExitMethods.cs:38:10:38:11 | Normal Exit | 1 |
+| ExitMethods.cs:44:9:47:9 | After catch (...) {...} [match] | ExitMethods.cs:46:13:46:19 | return ...; | 4 |
+| ExitMethods.cs:44:9:47:9 | After catch (...) {...} [no-match] | ExitMethods.cs:48:9:51:9 | catch (...) {...} | 2 |
+| ExitMethods.cs:48:9:51:9 | After catch (...) {...} [match] | ExitMethods.cs:50:13:50:19 | return ...; | 4 |
+| ExitMethods.cs:48:9:51:9 | After catch (...) {...} [no-match] | ExitMethods.cs:38:10:38:11 | Exceptional Exit | 2 |
+| ExitMethods.cs:54:10:54:11 | Entry | ExitMethods.cs:54:10:54:11 | Exit | 7 |
+| ExitMethods.cs:60:10:60:11 | Entry | ExitMethods.cs:60:10:60:11 | Exit | 7 |
+| ExitMethods.cs:66:17:66:26 | Entry | ExitMethods.cs:68:13:68:13 | access to parameter b | 5 |
+| ExitMethods.cs:66:17:66:26 | Exit | ExitMethods.cs:66:17:66:26 | Exit | 1 |
+| ExitMethods.cs:68:13:68:13 | After access to parameter b [false] | ExitMethods.cs:66:17:66:26 | Normal Exit | 4 |
+| ExitMethods.cs:68:13:68:13 | After access to parameter b [true] | ExitMethods.cs:66:17:66:26 | Exceptional Exit | 7 |
+| ExitMethods.cs:72:17:72:27 | Entry | ExitMethods.cs:74:13:74:13 | access to parameter b | 5 |
+| ExitMethods.cs:72:17:72:27 | Exceptional Exit | ExitMethods.cs:72:17:72:27 | Exit | 2 |
+| ExitMethods.cs:74:13:74:13 | After access to parameter b [false] | ExitMethods.cs:77:13:77:45 | throw ...; | 7 |
+| ExitMethods.cs:74:13:74:13 | After access to parameter b [true] | ExitMethods.cs:75:13:75:34 | throw ...; | 6 |
+| ExitMethods.cs:80:17:80:28 | Entry | ExitMethods.cs:80:17:80:28 | Exit | 9 |
+| ExitMethods.cs:85:17:85:28 | Entry | ExitMethods.cs:85:17:85:28 | Exit | 8 |
+| ExitMethods.cs:87:10:87:13 | Entry | ExitMethods.cs:87:10:87:13 | Exit | 8 |
+| ExitMethods.cs:92:10:92:18 | Entry | ExitMethods.cs:99:9:102:9 | After {...} | 16 |
+| ExitMethods.cs:92:10:92:18 | Exceptional Exit | ExitMethods.cs:92:10:92:18 | Exceptional Exit | 1 |
+| ExitMethods.cs:92:10:92:18 | Exit | ExitMethods.cs:92:10:92:18 | Exit | 1 |
+| ExitMethods.cs:94:9:102:9 | After try {...} ... | ExitMethods.cs:92:10:92:18 | Normal Exit | 3 |
+| ExitMethods.cs:105:10:105:24 | Entry | ExitMethods.cs:105:10:105:24 | Exit | 7 |
+| ExitMethods.cs:110:13:110:21 | Entry | ExitMethods.cs:112:16:112:25 | ... != ... | 12 |
+| ExitMethods.cs:110:13:110:21 | Exit | ExitMethods.cs:110:13:110:21 | Exit | 1 |
+| ExitMethods.cs:112:16:112:25 | After ... != ... [false] | ExitMethods.cs:110:13:110:21 | Exceptional Exit | 8 |
+| ExitMethods.cs:112:16:112:25 | After ... != ... [true] | ExitMethods.cs:110:13:110:21 | Normal Exit | 12 |
+| ExitMethods.cs:115:16:115:34 | Entry | ExitMethods.cs:117:16:117:30 | call to method Contains | 9 |
+| ExitMethods.cs:117:16:117:30 | After call to method Contains [false] | ExitMethods.cs:117:38:117:38 | 1 | 2 |
+| ExitMethods.cs:117:16:117:30 | After call to method Contains [true] | ExitMethods.cs:117:34:117:34 | 0 | 2 |
+| ExitMethods.cs:117:16:117:38 | After ... ? ... : ... | ExitMethods.cs:115:16:115:34 | Exit | 4 |
+| ExitMethods.cs:120:17:120:32 | Entry | ExitMethods.cs:120:17:120:32 | Exit | 8 |
+| ExitMethods.cs:126:17:126:33 | Entry | ExitMethods.cs:126:17:126:33 | Exit | 8 |
+| ExitMethods.cs:132:10:132:20 | Entry | ExitMethods.cs:132:33:132:49 | call to method IsFalse | 5 |
+| ExitMethods.cs:132:10:132:20 | Exceptional Exit | ExitMethods.cs:132:10:132:20 | Exceptional Exit | 1 |
+| ExitMethods.cs:132:10:132:20 | Exit | ExitMethods.cs:132:10:132:20 | Exit | 1 |
+| ExitMethods.cs:132:33:132:49 | After call to method IsFalse | ExitMethods.cs:132:10:132:20 | Normal Exit | 2 |
+| ExitMethods.cs:134:17:134:33 | Entry | ExitMethods.cs:134:17:134:33 | Exit | 9 |
+| ExitMethods.cs:140:17:140:42 | Entry | ExitMethods.cs:142:13:142:13 | access to parameter b | 6 |
+| ExitMethods.cs:140:17:140:42 | Exceptional Exit | ExitMethods.cs:140:17:140:42 | Exit | 2 |
+| ExitMethods.cs:142:13:142:13 | After access to parameter b [false] | ExitMethods.cs:145:13:145:52 | call to method Throw | 8 |
+| ExitMethods.cs:142:13:142:13 | After access to parameter b [true] | ExitMethods.cs:143:13:143:42 | call to method Throw | 5 |
+| Extensions.cs:5:23:5:29 | Entry | Extensions.cs:5:23:5:29 | Exit | 11 |
+| Extensions.cs:10:24:10:29 | Entry | Extensions.cs:10:24:10:29 | Exit | 13 |
+| Extensions.cs:15:23:15:33 | Entry | Extensions.cs:15:23:15:33 | Exit | 7 |
+| Extensions.cs:20:17:20:20 | Entry | Extensions.cs:20:17:20:20 | Exit | 38 |
+| Finally.cs:3:14:3:20 | Entry | Finally.cs:3:14:3:20 | Exit | 11 |
+| Finally.cs:7:10:7:11 | Entry | Finally.cs:11:13:11:37 | call to method WriteLine | 8 |
+| Finally.cs:7:10:7:11 | Exceptional Exit | Finally.cs:7:10:7:11 | Exceptional Exit | 1 |
+| Finally.cs:7:10:7:11 | Exit | Finally.cs:7:10:7:11 | Exit | 1 |
+| Finally.cs:9:9:16:9 | After try {...} ... | Finally.cs:7:10:7:11 | Normal Exit | 3 |
+| Finally.cs:11:13:11:37 | After call to method WriteLine | Finally.cs:10:9:12:9 | After {...} | 3 |
+| Finally.cs:14:9:16:9 | {...} | Finally.cs:14:9:16:9 | After {...} | 8 |
+| Finally.cs:19:10:19:11 | Entry | Finally.cs:23:13:23:37 | call to method WriteLine | 8 |
+| Finally.cs:19:10:19:11 | Exceptional Exit | Finally.cs:19:10:19:11 | Exceptional Exit | 1 |
+| Finally.cs:19:10:19:11 | Exit | Finally.cs:19:10:19:11 | Exit | 1 |
+| Finally.cs:19:10:19:11 | Normal Exit | Finally.cs:19:10:19:11 | Normal Exit | 1 |
+| Finally.cs:21:9:51:9 | After try {...} ... | Finally.cs:20:5:52:5 | After {...} | 2 |
+| Finally.cs:23:13:23:37 | After call to method WriteLine | Finally.cs:24:13:24:19 | return ...; | 4 |
+| Finally.cs:26:9:29:9 | After catch (...) {...} [match] | Finally.cs:28:13:28:18 | throw ...; | 7 |
+| Finally.cs:26:9:29:9 | After catch (...) {...} [no-match] | Finally.cs:30:9:40:9 | catch (...) {...} | 2 |
| Finally.cs:26:9:29:9 | catch (...) {...} | Finally.cs:26:9:29:9 | catch (...) {...} | 1 |
-| Finally.cs:26:38:26:39 | IOException ex | Finally.cs:26:48:26:51 | true | 2 |
-| Finally.cs:27:9:29:9 | {...} | Finally.cs:28:13:28:18 | throw ...; | 2 |
-| Finally.cs:30:9:40:9 | catch (...) {...} | Finally.cs:30:9:40:9 | catch (...) {...} | 1 |
-| Finally.cs:30:41:30:42 | ArgumentException ex | Finally.cs:34:21:34:24 | true | 6 |
-| Finally.cs:34:27:34:32 | throw ...; | Finally.cs:38:17:38:44 | throw ...; | 5 |
-| Finally.cs:41:9:43:9 | catch (...) {...} | Finally.cs:41:9:43:9 | catch (...) {...} | 1 |
-| Finally.cs:42:9:43:9 | {...} | Finally.cs:42:9:43:9 | {...} | 1 |
-| Finally.cs:44:9:47:9 | catch {...} | Finally.cs:46:13:46:19 | return ...; | 3 |
-| Finally.cs:49:9:51:9 | {...} | Finally.cs:50:13:50:40 | call to method WriteLine | 4 |
-| Finally.cs:54:10:54:11 | enter M3 | Finally.cs:58:13:58:37 | call to method WriteLine | 7 |
-| Finally.cs:54:10:54:11 | exit M3 | Finally.cs:54:10:54:11 | exit M3 | 1 |
-| Finally.cs:54:10:54:11 | exit M3 (abnormal) | Finally.cs:54:10:54:11 | exit M3 (abnormal) | 1 |
-| Finally.cs:54:10:54:11 | exit M3 (normal) | Finally.cs:54:10:54:11 | exit M3 (normal) | 1 |
-| Finally.cs:59:13:59:19 | return ...; | Finally.cs:59:13:59:19 | return ...; | 1 |
+| Finally.cs:30:9:40:9 | After catch (...) {...} [match] | Finally.cs:38:17:38:44 | throw ...; | 17 |
+| Finally.cs:30:9:40:9 | After catch (...) {...} [no-match] | Finally.cs:41:9:43:9 | catch (...) {...} | 2 |
+| Finally.cs:41:9:43:9 | After catch (...) {...} [match] | Finally.cs:42:9:43:9 | {...} | 2 |
+| Finally.cs:41:9:43:9 | After catch (...) {...} [no-match] | Finally.cs:46:13:46:19 | return ...; | 6 |
+| Finally.cs:49:9:51:9 | {...} | Finally.cs:49:9:51:9 | After {...} | 8 |
+| Finally.cs:54:10:54:11 | Entry | Finally.cs:58:13:58:37 | call to method WriteLine | 8 |
+| Finally.cs:54:10:54:11 | Exceptional Exit | Finally.cs:54:10:54:11 | Exceptional Exit | 1 |
+| Finally.cs:54:10:54:11 | Exit | Finally.cs:54:10:54:11 | Exit | 1 |
+| Finally.cs:54:10:54:11 | Normal Exit | Finally.cs:54:10:54:11 | Normal Exit | 1 |
+| Finally.cs:56:9:71:9 | After try {...} ... | Finally.cs:55:5:72:5 | After {...} | 2 |
+| Finally.cs:58:13:58:37 | After call to method WriteLine | Finally.cs:59:13:59:19 | return ...; | 4 |
+| Finally.cs:61:9:64:9 | After catch (...) {...} [match] | Finally.cs:63:13:63:18 | throw ...; | 7 |
+| Finally.cs:61:9:64:9 | After catch (...) {...} [no-match] | Finally.cs:65:9:67:9 | catch (...) {...} | 2 |
| Finally.cs:61:9:64:9 | catch (...) {...} | Finally.cs:61:9:64:9 | catch (...) {...} | 1 |
-| Finally.cs:61:38:61:39 | IOException ex | Finally.cs:61:48:61:51 | true | 2 |
-| Finally.cs:62:9:64:9 | {...} | Finally.cs:63:13:63:18 | throw ...; | 2 |
-| Finally.cs:65:9:67:9 | catch (...) {...} | Finally.cs:65:9:67:9 | catch (...) {...} | 1 |
-| Finally.cs:65:26:65:26 | Exception e | Finally.cs:65:35:65:51 | ... != ... | 5 |
-| Finally.cs:66:9:67:9 | {...} | Finally.cs:66:9:67:9 | {...} | 1 |
-| Finally.cs:69:9:71:9 | {...} | Finally.cs:70:13:70:40 | call to method WriteLine | 4 |
-| Finally.cs:74:10:74:11 | enter M4 | Finally.cs:77:9:100:9 | while (...) ... | 6 |
-| Finally.cs:74:10:74:11 | exit M4 | Finally.cs:74:10:74:11 | exit M4 | 1 |
-| Finally.cs:74:10:74:11 | exit M4 (abnormal) | Finally.cs:74:10:74:11 | exit M4 (abnormal) | 1 |
-| Finally.cs:74:10:74:11 | exit M4 (normal) | Finally.cs:74:10:74:11 | exit M4 (normal) | 1 |
-| Finally.cs:77:16:77:16 | access to local variable i | Finally.cs:77:16:77:20 | ... > ... | 3 |
-| Finally.cs:78:9:100:9 | {...} | Finally.cs:81:21:81:26 | ... == ... | 7 |
-| Finally.cs:82:21:82:27 | return ...; | Finally.cs:82:21:82:27 | return ...; | 1 |
-| Finally.cs:83:17:84:29 | if (...) ... | Finally.cs:83:21:83:26 | ... == ... | 4 |
-| Finally.cs:84:21:84:29 | continue; | Finally.cs:84:21:84:29 | continue; | 1 |
-| Finally.cs:85:17:86:26 | if (...) ... | Finally.cs:85:21:85:26 | ... == ... | 4 |
-| Finally.cs:86:21:86:26 | break; | Finally.cs:86:21:86:26 | break; | 1 |
-| Finally.cs:89:13:99:13 | {...} | Finally.cs:92:25:92:30 | ... == ... | 7 |
-| Finally.cs:93:25:93:46 | throw ...; | Finally.cs:93:25:93:46 | throw ...; | 1 |
-| Finally.cs:93:31:93:45 | object creation of type Exception | Finally.cs:93:31:93:45 | object creation of type Exception | 1 |
-| Finally.cs:96:17:98:17 | {...} | Finally.cs:97:21:97:23 | ...-- | 4 |
-| Finally.cs:103:10:103:11 | enter M5 | Finally.cs:107:17:107:21 | access to field Field | 7 |
-| Finally.cs:103:10:103:11 | exit M5 | Finally.cs:103:10:103:11 | exit M5 | 1 |
-| Finally.cs:103:10:103:11 | exit M5 (abnormal) | Finally.cs:103:10:103:11 | exit M5 (abnormal) | 1 |
-| Finally.cs:103:10:103:11 | exit M5 (normal) | Finally.cs:103:10:103:11 | exit M5 (normal) | 1 |
-| Finally.cs:107:17:107:28 | access to property Length | Finally.cs:107:17:107:28 | access to property Length | 1 |
-| Finally.cs:107:33:107:33 | 0 | Finally.cs:107:17:107:33 | ... == ... | 2 |
-| Finally.cs:108:17:108:23 | return ...; | Finally.cs:108:17:108:23 | return ...; | 1 |
-| Finally.cs:109:13:110:49 | if (...) ... | Finally.cs:109:17:109:21 | access to field Field | 3 |
-| Finally.cs:109:17:109:28 | access to property Length | Finally.cs:109:17:109:28 | access to property Length | 1 |
-| Finally.cs:109:33:109:33 | 1 | Finally.cs:109:17:109:33 | ... == ... | 2 |
-| Finally.cs:110:17:110:49 | throw ...; | Finally.cs:110:17:110:49 | throw ...; | 1 |
-| Finally.cs:110:23:110:48 | object creation of type OutOfMemoryException | Finally.cs:110:23:110:48 | object creation of type OutOfMemoryException | 1 |
-| Finally.cs:113:9:118:9 | {...} | Finally.cs:114:19:114:35 | ... == ... | 7 |
-| Finally.cs:114:17:114:36 | [false] !... | Finally.cs:114:17:114:36 | [false] !... | 1 |
-| Finally.cs:114:17:114:36 | [true] !... | Finally.cs:114:17:114:36 | [true] !... | 1 |
-| Finally.cs:115:17:115:41 | ...; | Finally.cs:115:17:115:40 | call to method WriteLine | 4 |
-| Finally.cs:116:13:117:37 | if (...) ... | Finally.cs:116:17:116:32 | ... > ... | 6 |
-| Finally.cs:117:17:117:37 | ...; | Finally.cs:117:17:117:36 | call to method WriteLine | 3 |
-| Finally.cs:121:10:121:11 | enter M6 | Finally.cs:121:10:121:11 | exit M6 | 12 |
-| Finally.cs:133:10:133:11 | enter M7 | Finally.cs:133:10:133:11 | exit M7 | 13 |
-| Finally.cs:147:10:147:11 | enter M8 | Finally.cs:151:17:151:28 | ... == ... | 8 |
-| Finally.cs:147:10:147:11 | exit M8 | Finally.cs:147:10:147:11 | exit M8 | 1 |
-| Finally.cs:147:10:147:11 | exit M8 (abnormal) | Finally.cs:147:10:147:11 | exit M8 (abnormal) | 1 |
-| Finally.cs:147:10:147:11 | exit M8 (normal) | Finally.cs:147:10:147:11 | exit M8 (normal) | 1 |
-| Finally.cs:152:17:152:50 | throw ...; | Finally.cs:152:17:152:50 | throw ...; | 1 |
-| Finally.cs:152:23:152:49 | object creation of type ArgumentNullException | Finally.cs:152:23:152:49 | object creation of type ArgumentNullException | 1 |
-| Finally.cs:155:9:169:9 | {...} | Finally.cs:158:21:158:31 | access to property Length | 6 |
-| Finally.cs:158:36:158:36 | 1 | Finally.cs:158:21:158:36 | ... == ... | 2 |
-| Finally.cs:159:21:159:45 | throw ...; | Finally.cs:159:21:159:45 | throw ...; | 1 |
-| Finally.cs:159:41:159:43 | "1" | Finally.cs:159:27:159:44 | object creation of type Exception | 2 |
+| Finally.cs:65:9:67:9 | After catch (...) {...} [match] | Finally.cs:65:35:65:51 | ... != ... | 9 |
+| Finally.cs:65:9:67:9 | After catch (...) {...} [no-match] | Finally.cs:65:9:67:9 | After catch (...) {...} [no-match] | 1 |
+| Finally.cs:65:35:65:51 | After ... != ... [false] | Finally.cs:65:35:65:51 | After ... != ... [false] | 1 |
+| Finally.cs:65:35:65:51 | After ... != ... [true] | Finally.cs:66:9:67:9 | {...} | 2 |
+| Finally.cs:69:9:71:9 | {...} | Finally.cs:69:9:71:9 | After {...} | 8 |
+| Finally.cs:74:10:74:11 | Entry | Finally.cs:77:9:100:9 | while (...) ... | 10 |
+| Finally.cs:74:10:74:11 | Exceptional Exit | Finally.cs:74:10:74:11 | Exceptional Exit | 1 |
+| Finally.cs:74:10:74:11 | Exit | Finally.cs:74:10:74:11 | Exit | 1 |
+| Finally.cs:74:10:74:11 | Normal Exit | Finally.cs:74:10:74:11 | Normal Exit | 1 |
+| Finally.cs:77:9:100:9 | After while (...) ... | Finally.cs:75:5:101:5 | After {...} | 2 |
+| Finally.cs:77:9:100:9 | [LoopHeader] while (...) ... | Finally.cs:77:16:77:20 | ... > ... | 5 |
+| Finally.cs:77:16:77:20 | After ... > ... [false] | Finally.cs:77:16:77:20 | After ... > ... [false] | 1 |
+| Finally.cs:77:16:77:20 | After ... > ... [true] | Finally.cs:81:21:81:26 | ... == ... | 9 |
+| Finally.cs:79:13:99:13 | After try {...} ... | Finally.cs:78:9:100:9 | After {...} | 2 |
+| Finally.cs:81:21:81:26 | After ... == ... [false] | Finally.cs:83:21:83:26 | ... == ... | 7 |
+| Finally.cs:81:21:81:26 | After ... == ... [true] | Finally.cs:82:21:82:27 | return ...; | 3 |
+| Finally.cs:83:21:83:26 | After ... == ... [false] | Finally.cs:85:21:85:26 | ... == ... | 7 |
+| Finally.cs:83:21:83:26 | After ... == ... [true] | Finally.cs:84:21:84:29 | continue; | 3 |
+| Finally.cs:85:21:85:26 | After ... == ... [false] | Finally.cs:80:13:87:13 | After {...} | 3 |
+| Finally.cs:85:21:85:26 | After ... == ... [true] | Finally.cs:86:21:86:26 | break; | 3 |
+| Finally.cs:89:13:99:13 | {...} | Finally.cs:92:25:92:30 | ... == ... | 8 |
+| Finally.cs:90:17:98:17 | After try {...} ... | Finally.cs:89:13:99:13 | After {...} | 2 |
+| Finally.cs:92:25:92:30 | After ... == ... [false] | Finally.cs:91:17:94:17 | After {...} | 3 |
+| Finally.cs:92:25:92:30 | After ... == ... [true] | Finally.cs:93:31:93:45 | object creation of type Exception | 4 |
+| Finally.cs:93:31:93:45 | After object creation of type Exception | Finally.cs:93:25:93:46 | throw ...; | 2 |
+| Finally.cs:96:17:98:17 | {...} | Finally.cs:96:17:98:17 | After {...} | 8 |
+| Finally.cs:103:10:103:11 | Entry | Finally.cs:107:17:107:21 | access to field Field | 10 |
+| Finally.cs:103:10:103:11 | Exceptional Exit | Finally.cs:103:10:103:11 | Exceptional Exit | 1 |
+| Finally.cs:103:10:103:11 | Exit | Finally.cs:103:10:103:11 | Exit | 1 |
+| Finally.cs:103:10:103:11 | Normal Exit | Finally.cs:103:10:103:11 | Normal Exit | 1 |
+| Finally.cs:105:9:118:9 | After try {...} ... | Finally.cs:104:5:119:5 | After {...} | 2 |
+| Finally.cs:107:17:107:21 | After access to field Field | Finally.cs:107:17:107:28 | access to property Length | 2 |
+| Finally.cs:107:17:107:28 | After access to property Length | Finally.cs:107:17:107:33 | ... == ... | 3 |
+| Finally.cs:107:17:107:33 | After ... == ... [false] | Finally.cs:109:17:109:21 | access to field Field | 8 |
+| Finally.cs:107:17:107:33 | After ... == ... [true] | Finally.cs:108:17:108:23 | return ...; | 3 |
+| Finally.cs:109:17:109:21 | After access to field Field | Finally.cs:109:17:109:28 | access to property Length | 2 |
+| Finally.cs:109:17:109:28 | After access to property Length | Finally.cs:109:17:109:33 | ... == ... | 3 |
+| Finally.cs:109:17:109:33 | After ... == ... [false] | Finally.cs:106:9:111:9 | After {...} | 3 |
+| Finally.cs:109:17:109:33 | After ... == ... [true] | Finally.cs:110:23:110:48 | object creation of type OutOfMemoryException | 4 |
+| Finally.cs:110:23:110:48 | After object creation of type OutOfMemoryException | Finally.cs:110:17:110:49 | throw ...; | 2 |
+| Finally.cs:113:9:118:9 | {...} | Finally.cs:114:19:114:35 | ... == ... | 13 |
+| Finally.cs:114:13:115:41 | After if (...) ... | Finally.cs:116:17:116:32 | ... > ... | 12 |
+| Finally.cs:114:19:114:35 | After ... == ... [false] | Finally.cs:115:17:115:41 | After ...; | 11 |
+| Finally.cs:114:19:114:35 | After ... == ... [true] | Finally.cs:114:17:114:36 | After !... [false] | 2 |
+| Finally.cs:116:13:117:37 | After if (...) ... | Finally.cs:113:9:118:9 | After {...} | 2 |
+| Finally.cs:116:17:116:32 | After ... > ... [false] | Finally.cs:116:17:116:32 | After ... > ... [false] | 1 |
+| Finally.cs:116:17:116:32 | After ... > ... [true] | Finally.cs:117:17:117:37 | After ...; | 7 |
+| Finally.cs:121:10:121:11 | Entry | Finally.cs:121:10:121:11 | Exit | 23 |
+| Finally.cs:133:10:133:11 | Entry | Finally.cs:137:13:137:36 | call to method WriteLine | 8 |
+| Finally.cs:137:13:137:36 | After call to method WriteLine | Finally.cs:136:9:138:9 | After {...} | 3 |
+| Finally.cs:140:9:143:9 | {...} | Finally.cs:133:10:133:11 | Exit | 9 |
+| Finally.cs:147:10:147:11 | Entry | Finally.cs:151:17:151:28 | ... == ... | 10 |
+| Finally.cs:147:10:147:11 | Exceptional Exit | Finally.cs:147:10:147:11 | Exceptional Exit | 1 |
+| Finally.cs:147:10:147:11 | Exit | Finally.cs:147:10:147:11 | Exit | 1 |
+| Finally.cs:149:9:169:9 | After try {...} ... | Finally.cs:147:10:147:11 | Normal Exit | 3 |
+| Finally.cs:151:17:151:28 | After ... == ... [false] | Finally.cs:150:9:153:9 | After {...} | 3 |
+| Finally.cs:151:17:151:28 | After ... == ... [true] | Finally.cs:152:23:152:49 | object creation of type ArgumentNullException | 4 |
+| Finally.cs:152:23:152:49 | After object creation of type ArgumentNullException | Finally.cs:152:17:152:50 | throw ...; | 2 |
+| Finally.cs:155:9:169:9 | {...} | Finally.cs:158:21:158:31 | access to property Length | 8 |
+| Finally.cs:156:13:168:13 | After try {...} ... | Finally.cs:155:9:169:9 | After {...} | 2 |
+| Finally.cs:158:21:158:31 | After access to property Length | Finally.cs:158:21:158:36 | ... == ... | 3 |
+| Finally.cs:158:21:158:36 | After ... == ... [false] | Finally.cs:157:13:160:13 | After {...} | 3 |
+| Finally.cs:158:21:158:36 | After ... == ... [true] | Finally.cs:159:27:159:44 | object creation of type Exception | 5 |
+| Finally.cs:159:27:159:44 | After object creation of type Exception | Finally.cs:159:21:159:45 | throw ...; | 2 |
+| Finally.cs:161:13:164:13 | After catch (...) {...} [match] | Finally.cs:161:39:161:54 | ... == ... | 9 |
+| Finally.cs:161:13:164:13 | After catch (...) {...} [no-match] | Finally.cs:166:13:168:13 | After {...} | 11 |
| Finally.cs:161:13:164:13 | catch (...) {...} | Finally.cs:161:13:164:13 | catch (...) {...} | 1 |
-| Finally.cs:161:30:161:30 | Exception e | Finally.cs:161:39:161:54 | ... == ... | 5 |
-| Finally.cs:162:13:164:13 | {...} | Finally.cs:163:17:163:42 | call to method WriteLine | 6 |
-| Finally.cs:165:13:168:13 | catch {...} | Finally.cs:167:17:167:37 | call to method WriteLine | 5 |
-| Finally.cs:172:11:172:20 | enter ExceptionA | Finally.cs:172:11:172:20 | exit ExceptionA | 7 |
-| Finally.cs:173:11:173:20 | enter ExceptionB | Finally.cs:173:11:173:20 | exit ExceptionB | 7 |
-| Finally.cs:174:11:174:20 | enter ExceptionC | Finally.cs:174:11:174:20 | exit ExceptionC | 7 |
-| Finally.cs:176:10:176:11 | enter M9 | Finally.cs:180:17:180:18 | access to parameter b1 | 6 |
-| Finally.cs:176:10:176:11 | exit M9 | Finally.cs:176:10:176:11 | exit M9 | 1 |
-| Finally.cs:176:10:176:11 | exit M9 (abnormal) | Finally.cs:176:10:176:11 | exit M9 (abnormal) | 1 |
-| Finally.cs:176:10:176:11 | exit M9 (normal) | Finally.cs:176:10:176:11 | exit M9 (normal) | 1 |
-| Finally.cs:180:21:180:43 | throw ...; | Finally.cs:180:21:180:43 | throw ...; | 1 |
-| Finally.cs:180:27:180:42 | object creation of type ExceptionA | Finally.cs:180:27:180:42 | object creation of type ExceptionA | 1 |
+| Finally.cs:161:39:161:54 | After ... == ... [false] | Finally.cs:161:39:161:54 | After ... == ... [false] | 1 |
+| Finally.cs:161:39:161:54 | After ... == ... [true] | Finally.cs:162:13:164:13 | After {...} | 13 |
+| Finally.cs:172:11:172:20 | Entry | Finally.cs:172:11:172:20 | Exit | 11 |
+| Finally.cs:173:11:173:20 | Entry | Finally.cs:173:11:173:20 | Exit | 11 |
+| Finally.cs:174:11:174:20 | Entry | Finally.cs:174:11:174:20 | Exit | 11 |
+| Finally.cs:176:10:176:11 | Entry | Finally.cs:180:17:180:18 | access to parameter b1 | 8 |
+| Finally.cs:176:10:176:11 | Exceptional Exit | Finally.cs:176:10:176:11 | Exceptional Exit | 1 |
+| Finally.cs:176:10:176:11 | Exit | Finally.cs:176:10:176:11 | Exit | 1 |
+| Finally.cs:178:9:192:9 | After try {...} ... | Finally.cs:176:10:176:11 | Normal Exit | 3 |
+| Finally.cs:180:17:180:18 | After access to parameter b1 [false] | Finally.cs:179:9:181:9 | After {...} | 3 |
+| Finally.cs:180:17:180:18 | After access to parameter b1 [true] | Finally.cs:180:27:180:42 | object creation of type ExceptionA | 4 |
+| Finally.cs:180:27:180:42 | After object creation of type ExceptionA | Finally.cs:180:21:180:43 | throw ...; | 2 |
| Finally.cs:183:9:192:9 | {...} | Finally.cs:186:21:186:22 | access to parameter b2 | 5 |
-| Finally.cs:186:25:186:47 | throw ...; | Finally.cs:186:25:186:47 | throw ...; | 1 |
-| Finally.cs:186:31:186:46 | object creation of type ExceptionB | Finally.cs:186:31:186:46 | object creation of type ExceptionB | 1 |
+| Finally.cs:184:13:191:13 | After try {...} ... | Finally.cs:183:9:192:9 | After {...} | 2 |
+| Finally.cs:186:21:186:22 | After access to parameter b2 [false] | Finally.cs:185:13:187:13 | After {...} | 3 |
+| Finally.cs:186:21:186:22 | After access to parameter b2 [true] | Finally.cs:186:31:186:46 | object creation of type ExceptionB | 4 |
+| Finally.cs:186:31:186:46 | After object creation of type ExceptionB | Finally.cs:186:25:186:47 | throw ...; | 2 |
+| Finally.cs:188:13:191:13 | After catch (...) {...} [match] | Finally.cs:188:38:188:39 | access to parameter b2 | 2 |
+| Finally.cs:188:13:191:13 | After catch (...) {...} [no-match] | Finally.cs:188:13:191:13 | After catch (...) {...} [no-match] | 1 |
| Finally.cs:188:13:191:13 | catch (...) {...} | Finally.cs:188:13:191:13 | catch (...) {...} | 1 |
-| Finally.cs:188:38:188:39 | access to parameter b2 | Finally.cs:188:38:188:39 | access to parameter b2 | 1 |
-| Finally.cs:189:13:191:13 | {...} | Finally.cs:190:21:190:22 | access to parameter b1 | 3 |
-| Finally.cs:190:31:190:46 | object creation of type ExceptionC | Finally.cs:190:25:190:47 | throw ...; | 2 |
-| Finally.cs:195:10:195:12 | enter M10 | Finally.cs:199:17:199:18 | access to parameter b1 | 6 |
-| Finally.cs:195:10:195:12 | exit M10 | Finally.cs:195:10:195:12 | exit M10 | 1 |
-| Finally.cs:195:10:195:12 | exit M10 (abnormal) | Finally.cs:195:10:195:12 | exit M10 (abnormal) | 1 |
-| Finally.cs:199:21:199:43 | throw ...; | Finally.cs:199:21:199:43 | throw ...; | 1 |
-| Finally.cs:199:27:199:42 | object creation of type ExceptionA | Finally.cs:199:27:199:42 | object creation of type ExceptionA | 1 |
+| Finally.cs:188:38:188:39 | After access to parameter b2 [false] | Finally.cs:188:38:188:39 | After access to parameter b2 [false] | 1 |
+| Finally.cs:188:38:188:39 | After access to parameter b2 [true] | Finally.cs:190:21:190:22 | access to parameter b1 | 4 |
+| Finally.cs:190:21:190:22 | After access to parameter b1 [false] | Finally.cs:189:13:191:13 | After {...} | 3 |
+| Finally.cs:190:21:190:22 | After access to parameter b1 [true] | Finally.cs:190:25:190:47 | throw ...; | 6 |
+| Finally.cs:195:10:195:12 | Entry | Finally.cs:199:17:199:18 | access to parameter b1 | 9 |
+| Finally.cs:195:10:195:12 | Exceptional Exit | Finally.cs:195:10:195:12 | Exceptional Exit | 1 |
+| Finally.cs:195:10:195:12 | Exit | Finally.cs:195:10:195:12 | Exit | 1 |
+| Finally.cs:197:9:212:9 | After try {...} ... | Finally.cs:195:10:195:12 | Normal Exit | 13 |
+| Finally.cs:199:17:199:18 | After access to parameter b1 [false] | Finally.cs:198:9:200:9 | After {...} | 3 |
+| Finally.cs:199:17:199:18 | After access to parameter b1 [true] | Finally.cs:199:27:199:42 | object creation of type ExceptionA | 4 |
+| Finally.cs:199:27:199:42 | After object creation of type ExceptionA | Finally.cs:199:21:199:43 | throw ...; | 2 |
| Finally.cs:202:9:212:9 | {...} | Finally.cs:205:21:205:22 | access to parameter b2 | 5 |
-| Finally.cs:205:25:205:47 | throw ...; | Finally.cs:205:25:205:47 | throw ...; | 1 |
-| Finally.cs:205:31:205:46 | object creation of type ExceptionB | Finally.cs:205:31:205:46 | object creation of type ExceptionB | 1 |
+| Finally.cs:203:13:210:13 | After try {...} ... | Finally.cs:202:9:212:9 | After {...} | 12 |
+| Finally.cs:205:21:205:22 | After access to parameter b2 [false] | Finally.cs:204:13:206:13 | After {...} | 3 |
+| Finally.cs:205:21:205:22 | After access to parameter b2 [true] | Finally.cs:205:31:205:46 | object creation of type ExceptionB | 4 |
+| Finally.cs:205:31:205:46 | After object creation of type ExceptionB | Finally.cs:205:25:205:47 | throw ...; | 2 |
| Finally.cs:208:13:210:13 | {...} | Finally.cs:209:21:209:22 | access to parameter b3 | 3 |
-| Finally.cs:209:31:209:46 | object creation of type ExceptionC | Finally.cs:209:25:209:47 | throw ...; | 2 |
-| Finally.cs:211:13:211:29 | ...; | Finally.cs:211:13:211:28 | ... = ... | 5 |
-| Finally.cs:213:9:213:25 | ...; | Finally.cs:195:10:195:12 | exit M10 (normal) | 6 |
-| Finally.cs:216:10:216:12 | enter M11 | Finally.cs:220:13:220:36 | call to method WriteLine | 7 |
-| Finally.cs:222:9:225:9 | catch {...} | Finally.cs:224:13:224:38 | call to method WriteLine | 5 |
-| Finally.cs:227:9:229:9 | {...} | Finally.cs:216:10:216:12 | exit M11 | 9 |
-| Finally.cs:233:10:233:12 | enter M12 | Finally.cs:239:21:239:22 | access to parameter b1 | 8 |
-| Finally.cs:233:10:233:12 | exit M12 | Finally.cs:233:10:233:12 | exit M12 | 1 |
-| Finally.cs:233:10:233:12 | exit M12 (abnormal) | Finally.cs:233:10:233:12 | exit M12 (abnormal) | 1 |
-| Finally.cs:240:21:240:43 | throw ...; | Finally.cs:240:21:240:43 | throw ...; | 1 |
-| Finally.cs:240:27:240:42 | object creation of type ExceptionA | Finally.cs:240:27:240:42 | object creation of type ExceptionA | 1 |
+| Finally.cs:209:21:209:22 | After access to parameter b3 [false] | Finally.cs:208:13:210:13 | After {...} | 3 |
+| Finally.cs:209:21:209:22 | After access to parameter b3 [true] | Finally.cs:209:25:209:47 | throw ...; | 6 |
+| Finally.cs:216:10:216:12 | Entry | Finally.cs:220:13:220:36 | call to method WriteLine | 8 |
+| Finally.cs:220:13:220:36 | After call to method WriteLine | Finally.cs:219:9:221:9 | After {...} | 3 |
+| Finally.cs:222:9:225:9 | catch {...} | Finally.cs:223:9:225:9 | After {...} | 10 |
+| Finally.cs:227:9:229:9 | {...} | Finally.cs:216:10:216:12 | Exit | 18 |
+| Finally.cs:233:10:233:12 | Entry | Finally.cs:239:21:239:22 | access to parameter b1 | 10 |
+| Finally.cs:233:10:233:12 | Exceptional Exit | Finally.cs:233:10:233:12 | Exceptional Exit | 1 |
+| Finally.cs:233:10:233:12 | Exit | Finally.cs:233:10:233:12 | Exit | 1 |
+| Finally.cs:235:9:259:9 | After try {...} ... | Finally.cs:233:10:233:12 | Normal Exit | 9 |
+| Finally.cs:237:13:253:13 | After try {...} ... | Finally.cs:254:13:254:44 | call to method WriteLine | 5 |
+| Finally.cs:239:21:239:22 | After access to parameter b1 [false] | Finally.cs:238:13:241:13 | After {...} | 3 |
+| Finally.cs:239:21:239:22 | After access to parameter b1 [true] | Finally.cs:240:27:240:42 | object creation of type ExceptionA | 4 |
+| Finally.cs:240:27:240:42 | After object creation of type ExceptionA | Finally.cs:240:21:240:43 | throw ...; | 2 |
| Finally.cs:243:13:253:13 | {...} | Finally.cs:246:25:246:26 | access to parameter b2 | 5 |
-| Finally.cs:247:25:247:47 | throw ...; | Finally.cs:247:25:247:47 | throw ...; | 1 |
-| Finally.cs:247:31:247:46 | object creation of type ExceptionA | Finally.cs:247:31:247:46 | object creation of type ExceptionA | 1 |
-| Finally.cs:250:17:252:17 | {...} | Finally.cs:251:21:251:54 | call to method WriteLine | 4 |
-| Finally.cs:254:13:254:45 | ...; | Finally.cs:254:13:254:44 | call to method WriteLine | 3 |
-| Finally.cs:257:9:259:9 | {...} | Finally.cs:258:13:258:46 | call to method WriteLine | 4 |
-| Finally.cs:260:9:260:34 | ...; | Finally.cs:233:10:233:12 | exit M12 (normal) | 4 |
-| Finally.cs:263:10:263:12 | enter M13 | Finally.cs:272:13:272:18 | ... += ... | 15 |
-| Finally.cs:263:10:263:12 | exit M13 | Finally.cs:263:10:263:12 | exit M13 | 1 |
-| Finally.cs:263:10:263:12 | exit M13 (abnormal) | Finally.cs:263:10:263:12 | exit M13 (abnormal) | 1 |
-| Finally.cs:263:10:263:12 | exit M13 (normal) | Finally.cs:263:10:263:12 | exit M13 (normal) | 1 |
-| Foreach.cs:4:7:4:13 | enter Foreach | Foreach.cs:4:7:4:13 | exit Foreach | 7 |
-| Foreach.cs:6:10:6:11 | enter M1 | Foreach.cs:8:29:8:32 | access to parameter args | 3 |
-| Foreach.cs:6:10:6:11 | exit M1 (normal) | Foreach.cs:6:10:6:11 | exit M1 | 2 |
-| Foreach.cs:8:9:9:13 | foreach (... ... in ...) ... | Foreach.cs:8:9:9:13 | foreach (... ... in ...) ... | 1 |
-| Foreach.cs:8:22:8:24 | String arg | Foreach.cs:9:13:9:13 | ; | 2 |
-| Foreach.cs:12:10:12:11 | enter M2 | Foreach.cs:14:27:14:30 | access to parameter args | 3 |
-| Foreach.cs:12:10:12:11 | exit M2 (normal) | Foreach.cs:12:10:12:11 | exit M2 | 2 |
-| Foreach.cs:14:9:15:13 | foreach (... ... in ...) ... | Foreach.cs:14:9:15:13 | foreach (... ... in ...) ... | 1 |
-| Foreach.cs:14:22:14:22 | String _ | Foreach.cs:15:13:15:13 | ; | 2 |
-| Foreach.cs:18:10:18:11 | enter M3 | Foreach.cs:20:27:20:27 | access to parameter e | 3 |
-| Foreach.cs:18:10:18:11 | exit M3 (normal) | Foreach.cs:18:10:18:11 | exit M3 | 2 |
-| Foreach.cs:20:9:21:11 | foreach (... ... in ...) ... | Foreach.cs:20:9:21:11 | foreach (... ... in ...) ... | 1 |
-| Foreach.cs:20:22:20:22 | String x | Foreach.cs:21:11:21:11 | ; | 2 |
-| Foreach.cs:20:27:20:38 | call to method ToArray | Foreach.cs:20:27:20:38 | call to method ToArray | 1 |
-| Foreach.cs:20:27:20:68 | ... ?? ... | Foreach.cs:20:27:20:68 | ... ?? ... | 1 |
-| Foreach.cs:20:43:20:68 | call to method Empty | Foreach.cs:20:43:20:68 | call to method Empty | 1 |
-| Foreach.cs:24:10:24:11 | enter M4 | Foreach.cs:26:36:26:39 | access to parameter args | 3 |
-| Foreach.cs:24:10:24:11 | exit M4 (normal) | Foreach.cs:24:10:24:11 | exit M4 | 2 |
-| Foreach.cs:26:9:27:11 | foreach (... ... in ...) ... | Foreach.cs:26:9:27:11 | foreach (... ... in ...) ... | 1 |
-| Foreach.cs:26:23:26:23 | String x | Foreach.cs:27:11:27:11 | ; | 4 |
-| Foreach.cs:30:10:30:11 | enter M5 | Foreach.cs:32:32:32:35 | access to parameter args | 3 |
-| Foreach.cs:30:10:30:11 | exit M5 (normal) | Foreach.cs:30:10:30:11 | exit M5 | 2 |
-| Foreach.cs:32:9:33:11 | foreach (... ... in ...) ... | Foreach.cs:32:9:33:11 | foreach (... ... in ...) ... | 1 |
-| Foreach.cs:32:23:32:23 | String x | Foreach.cs:33:11:33:11 | ; | 4 |
-| Foreach.cs:36:10:36:11 | enter M6 | Foreach.cs:38:39:38:42 | access to parameter args | 3 |
-| Foreach.cs:36:10:36:11 | exit M6 (normal) | Foreach.cs:36:10:36:11 | exit M6 | 2 |
-| Foreach.cs:38:9:39:11 | foreach (... ... in ...) ... | Foreach.cs:38:9:39:11 | foreach (... ... in ...) ... | 1 |
-| Foreach.cs:38:26:38:26 | String x | Foreach.cs:39:11:39:11 | ; | 4 |
-| Initializers.cs:3:7:3:18 | enter