Merge branch 'master' of git.semmle.com:Semmle/ql into FalsySanitizer

change-notes/1.24/analysis-csharp.md

@@ -20,6 +20,7 @@ The following changes in version 1.24 affect C# analysis in all applications.
 | Useless assignment to local variable (`cs/useless-assignment-to-local`) | Fewer false positive results | Results have been removed when the variable is named `_` in a `foreach` statement. | 
 | Potentially dangerous use of non-short-circuit logic (`cs/non-short-circuit`) | Fewer false positive results | Results have been removed when the expression contains an `out` parameter. |
 | Dereferenced variable may be null (`cs/dereferenced-value-may-be-null`) | More results | Results are reported from parameters with a default value of `null`. |
+| Useless assignment to local variable (`cs/useless-assignment-to-local`) | Fewer false positive results | Results have been removed when the value assigned is an (implicitly or explicitly) cast default-like value. For example, `var s = (string)null` and `string s = default`. |
 
 ## Removal of old queries
 

change-notes/1.24/analysis-javascript.md

@@ -21,6 +21,9 @@
   - [ws](https://github.com/websockets/ws)
   - [WebSocket](https://developer.mozilla.org/en-US/docs/Web/API/WebSockets_API)
   - [Koa](https://www.npmjs.com/package/koa)
+  - [lazy-cache](https://www.npmjs.com/package/lazy-cache)
+  - [for-in](https://www.npmjs.com/package/for-in)
+  - [for-own](https://www.npmjs.com/package/for-own)
 
 ## New queries
 

config/identical-files.json

@@ -222,7 +222,12 @@
     "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/PrintSSA.qll",
     "csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/internal/PrintSSA.qll"
   ],
-  "IR ValueNumber": [
+  "C++ IR ValueNumberInternal": [
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/gvn/internal/ValueNumberingInternal.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/internal/ValueNumberingInternal.qll",
+    "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/internal/ValueNumberingInternal.qll"
+  ],
+  "C++ IR ValueNumber": [
     "cpp/ql/src/semmle/code/cpp/ir/implementation/raw/gvn/ValueNumbering.qll",
     "cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/ValueNumbering.qll",
     "cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/ValueNumbering.qll",

cpp/ql/src/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll

@@ -21,6 +21,40 @@ private predicate predictableInstruction(Instruction instr) {
   predictableInstruction(instr.(UnaryInstruction).getUnary())
 }
 
+/**
+ * Functions that we should only allow taint to flow through (to the return
+ * value) if all but the source argument are 'predictable'.  This is done to
+ * emulate the old security library's implementation rather than due to any
+ * strong belief that this is the right approach.
+ *
+ * Note that the list itself is not very principled; it consists of all the
+ * functions listed in the old security library's [default] `isPureFunction`
+ * that have more than one argument, but are not in the old taint tracking
+ * library's `returnArgument` predicate.  In addition, `strlen` is included
+ * because it's also a special case in flow to return values.
+ */
+predicate predictableOnlyFlow(string name) {
+  name = "strcasestr" or
+  name = "strchnul" or
+  name = "strchr" or
+  name = "strchrnul" or
+  name = "strcmp" or
+  name = "strcspn" or
+  name = "strlen" or // special case
+  name = "strncmp" or
+  name = "strndup" or
+  name = "strnlen" or
+  name = "strrchr" or
+  name = "strspn" or
+  name = "strstr" or
+  name = "strtod" or
+  name = "strtof" or
+  name = "strtol" or
+  name = "strtoll" or
+  name = "strtoq" or
+  name = "strtoul"
+}
+
 private DataFlow::Node getNodeForSource(Expr source) {
   isUserInput(source, _) and
   (
@@ -35,7 +69,7 @@ private class DefaultTaintTrackingCfg extends DataFlow::Configuration {
 
   override predicate isSource(DataFlow::Node source) { source = getNodeForSource(_) }
 
-  override predicate isSink(DataFlow::Node sink) { any() }
+  override predicate isSink(DataFlow::Node sink) { exists(adjustedSink(sink)) }
 
   override predicate isAdditionalFlowStep(DataFlow::Node n1, DataFlow::Node n2) {
     instructionTaintStep(n1.asInstruction(), n2.asInstruction())
@@ -50,18 +84,15 @@ private class ToGlobalVarTaintTrackingCfg extends DataFlow::Configuration {
   override predicate isSource(DataFlow::Node source) { source = getNodeForSource(_) }
 
   override predicate isSink(DataFlow::Node sink) {
-    exists(GlobalOrNamespaceVariable gv | writesVariable(sink.asInstruction(), gv))
+    sink.asVariable() instanceof GlobalOrNamespaceVariable
   }
 
   override predicate isAdditionalFlowStep(DataFlow::Node n1, DataFlow::Node n2) {
     instructionTaintStep(n1.asInstruction(), n2.asInstruction())
     or
-    exists(StoreInstruction i1, LoadInstruction i2, GlobalOrNamespaceVariable gv |
-      writesVariable(i1, gv) and
-      readsVariable(i2, gv) and
-      i1 = n1.asInstruction() and
-      i2 = n2.asInstruction()
-    )
+    writesVariable(n1.asInstruction(), n2.asVariable().(GlobalOrNamespaceVariable))
+    or
+    readsVariable(n2.asInstruction(), n1.asVariable().(GlobalOrNamespaceVariable))
   }
 
   override predicate isBarrier(DataFlow::Node node) { nodeIsBarrier(node) }
@@ -71,19 +102,20 @@ private class FromGlobalVarTaintTrackingCfg extends DataFlow2::Configuration {
   FromGlobalVarTaintTrackingCfg() { this = "FromGlobalVarTaintTrackingCfg" }
 
   override predicate isSource(DataFlow::Node source) {
-    exists(
-      ToGlobalVarTaintTrackingCfg other, DataFlow::Node prevSink, GlobalOrNamespaceVariable gv
-    |
-      other.hasFlowTo(prevSink) and
-      writesVariable(prevSink.asInstruction(), gv) and
-      readsVariable(source.asInstruction(), gv)
-    )
+    // This set of sources should be reasonably small, which is good for
+    // performance since the set of sinks is very large.
+    exists(ToGlobalVarTaintTrackingCfg otherCfg | otherCfg.hasFlowTo(source))
   }
 
-  override predicate isSink(DataFlow::Node sink) { any() }
+  override predicate isSink(DataFlow::Node sink) { exists(adjustedSink(sink)) }
 
   override predicate isAdditionalFlowStep(DataFlow::Node n1, DataFlow::Node n2) {
     instructionTaintStep(n1.asInstruction(), n2.asInstruction())
+    or
+    // Additional step for flow out of variables. There is no flow _into_
+    // variables in this configuration, so this step only serves to take flow
+    // out of a variable that's a source.
+    readsVariable(n2.asInstruction(), n1.asVariable())
   }
 
   override predicate isBarrier(DataFlow::Node node) { nodeIsBarrier(node) }
@@ -123,15 +155,16 @@ private predicate nodeIsBarrier(DataFlow::Node node) {
 
 private predicate instructionTaintStep(Instruction i1, Instruction i2) {
   // Expressions computed from tainted data are also tainted
-  i2 =
-    any(CallInstruction call |
-      isPureFunction(call.getStaticCallTarget().getName()) and
-      call.getAnArgument() = i1 and
-      forall(Instruction arg | arg = call.getAnArgument() | arg = i1 or predictableInstruction(arg)) and
-      // flow through `strlen` tends to cause dubious results, if the length is
-      // bounded.
-      not call.getStaticCallTarget().getName() = "strlen"
-    )
+  exists(CallInstruction call, int argIndex | call = i2 |
+    isPureFunction(call.getStaticCallTarget().getName()) and
+    i1 = getACallArgumentOrIndirection(call, argIndex) and
+    forall(Instruction arg | arg = call.getAnArgument() |
+      arg = getACallArgumentOrIndirection(call, argIndex) or predictableInstruction(arg)
+    ) and
+    // flow through `strlen` tends to cause dubious results, if the length is
+    // bounded.
+    not call.getStaticCallTarget().getName() = "strlen"
+  )
   or
   // Flow through pointer dereference
   i2.(LoadInstruction).getSourceAddress() = i1
@@ -172,7 +205,8 @@ private predicate instructionTaintStep(Instruction i1, Instruction i2) {
     any(CallInstruction call |
       exists(int indexIn |
         modelTaintToReturnValue(call.getStaticCallTarget(), indexIn) and
-        i1 = getACallArgumentOrIndirection(call, indexIn)
+        i1 = getACallArgumentOrIndirection(call, indexIn) and
+        not predictableOnlyFlow(call.getStaticCallTarget().getName())
       )
     )
   or
@@ -315,23 +349,12 @@ predicate taintedIncludingGlobalVars(Expr source, Element tainted, string global
   globalVar = ""
   or
   exists(
-    ToGlobalVarTaintTrackingCfg toCfg, FromGlobalVarTaintTrackingCfg fromCfg, DataFlow::Node store,
-    GlobalOrNamespaceVariable global, DataFlow::Node load, DataFlow::Node sink
+    ToGlobalVarTaintTrackingCfg toCfg, FromGlobalVarTaintTrackingCfg fromCfg,
+    DataFlow::VariableNode variableNode, GlobalOrNamespaceVariable global, DataFlow::Node sink
   |
-    toCfg.hasFlow(getNodeForSource(source), store) and
-    store
-        .asInstruction()
-        .(StoreInstruction)
-        .getDestinationAddress()
-        .(VariableAddressInstruction)
-        .getASTVariable() = global and
-    load
-        .asInstruction()
-        .(LoadInstruction)
-        .getSourceAddress()
-        .(VariableAddressInstruction)
-        .getASTVariable() = global and
-    fromCfg.hasFlow(load, sink) and
+    global = variableNode.getVariable() and
+    toCfg.hasFlow(getNodeForSource(source), variableNode) and
+    fromCfg.hasFlow(variableNode, sink) and
     tainted = adjustedSink(sink) and
     global = globalVarFromId(globalVar)
   )

cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll

@@ -7,17 +7,17 @@ private import DataFlowDispatch
  * A data flow node that occurs as the argument of a call and is passed as-is
  * to the callable. Instance arguments (`this` pointer) are also included.
  */
-class ArgumentNode extends Node {
-  ArgumentNode() { exists(CallInstruction call | this.asInstruction() = call.getAnArgument()) }
+class ArgumentNode extends InstructionNode {
+  ArgumentNode() { exists(CallInstruction call | this.getInstruction() = call.getAnArgument()) }
 
   /**
    * Holds if this argument occurs at the given position in the given call.
    * The instance argument is considered to have index `-1`.
    */
   predicate argumentOf(DataFlowCall call, int pos) {
-    this.asInstruction() = call.getPositionalArgument(pos)
+    this.getInstruction() = call.getPositionalArgument(pos)
     or
-    this.asInstruction() = call.getThisArgument() and pos = -1
+    this.getInstruction() = call.getThisArgument() and pos = -1
   }
 
   /** Gets the call in which this node is an argument. */
@@ -36,15 +36,15 @@ class ReturnKind extends TReturnKind {
 }
 
 /** A data flow node that occurs as the result of a `ReturnStmt`. */
-class ReturnNode extends Node {
-  ReturnNode() { exists(ReturnValueInstruction ret | this.asInstruction() = ret.getReturnValue()) }
+class ReturnNode extends InstructionNode {
+  ReturnNode() { exists(ReturnValueInstruction ret | this.getInstruction() = ret.getReturnValue()) }
 
   /** Gets the kind of this returned value. */
   ReturnKind getKind() { result = TNormalReturnKind() }
 }
 
 /** A data flow node that represents the output of a call. */
-class OutNode extends Node {
+class OutNode extends InstructionNode {
   override CallInstruction instr;
 
   /** Gets the underlying call. */
@@ -181,11 +181,17 @@ private predicate suppressUnusedType(Type t) { any() }
 // Java QL library compatibility wrappers
 //////////////////////////////////////////////////////////////////////////////
 /** A node that performs a type cast. */
-class CastNode extends Node {
+class CastNode extends InstructionNode {
   CastNode() { none() } // stub implementation
 }
 
-class DataFlowCallable = Function;
+/**
+ * A function that may contain code or a variable that may contain itself. When
+ * flow crosses from one _enclosing callable_ to another, the interprocedural
+ * data-flow library discards call contexts and inserts a node in the big-step
+ * relation used for human-readable path explanations.
+ */
+class DataFlowCallable = Declaration;
 
 class DataFlowExpr = Expr;
 

cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll

@@ -8,12 +8,9 @@ private import semmle.code.cpp.controlflow.IRGuards
 private import semmle.code.cpp.ir.ValueNumbering
 private import semmle.code.cpp.models.interfaces.DataFlow
 
-/**
- * A newtype wrapper to prevent accidental casts between `Node` and
- * `Instruction`. This ensures we can add `Node`s that are not `Instruction`s
- * in the future.
- */
-private newtype TIRDataFlowNode = MkIRDataFlowNode(Instruction i)
+private newtype TIRDataFlowNode =
+  TInstructionNode(Instruction i) or
+  TVariableNode(Variable var)
 
 /**
  * A node in a data flow graph.
@@ -23,21 +20,19 @@ private newtype TIRDataFlowNode = MkIRDataFlowNode(Instruction i)
  * `DataFlow::parameterNode`, and `DataFlow::uninitializedNode` respectively.
  */
 class Node extends TIRDataFlowNode {
-  Instruction instr;
-
-  Node() { this = MkIRDataFlowNode(instr) }
-
   /**
-   * INTERNAL: Do not use. Alternative name for `getFunction`.
+   * INTERNAL: Do not use.
    */
-  Function getEnclosingCallable() { result = this.getFunction() }
+  Declaration getEnclosingCallable() { none() } // overridden in subclasses
 
-  Function getFunction() { result = instr.getEnclosingFunction() }
+  /** Gets the function to which this node belongs, if any. */
+  Function getFunction() { none() } // overridden in subclasses
 
   /** Gets the type of this node. */
-  Type getType() { result = instr.getResultType() }
+  Type getType() { none() } // overridden in subclasses
 
-  Instruction asInstruction() { this = MkIRDataFlowNode(result) }
+  /** Gets the instruction corresponding to this node, if any. */
+  Instruction asInstruction() { result = this.(InstructionNode).getInstruction() }
 
   /**
    * Gets the non-conversion expression corresponding to this node, if any. If
@@ -45,22 +40,25 @@ class Node extends TIRDataFlowNode {
    * `Conversion`, then the result is that `Conversion`'s non-`Conversion` base
    * expression.
    */
-  Expr asExpr() {
-    result.getConversion*() = instr.getConvertedResultExpression() and
-    not result instanceof Conversion
-  }
+  Expr asExpr() { result = this.(ExprNode).getExpr() }
 
   /**
    * Gets the expression corresponding to this node, if any. The returned
    * expression may be a `Conversion`.
    */
-  Expr asConvertedExpr() { result = instr.getConvertedResultExpression() }
+  Expr asConvertedExpr() { result = this.(ExprNode).getConvertedExpr() }
 
   /** Gets the argument that defines this `DefinitionByReferenceNode`, if any. */
   Expr asDefiningArgument() { result = this.(DefinitionByReferenceNode).getArgument() }
 
   /** Gets the parameter corresponding to this node, if any. */
-  Parameter asParameter() { result = instr.(InitializeParameterInstruction).getParameter() }
+  Parameter asParameter() { result = this.(ParameterNode).getParameter() }
+
+  /**
+   * Gets the variable corresponding to this node, if any. This can be used for
+   * modelling flow in and out of global variables.
+   */
+  Variable asVariable() { result = this.(VariableNode).getVariable() }
 
   /**
    * DEPRECATED: See UninitializedNode.
@@ -76,7 +74,7 @@ class Node extends TIRDataFlowNode {
   Type getTypeBound() { result = getType() }
 
   /** Gets the location of this element. */
-  Location getLocation() { result = instr.getLocation() }
+  Location getLocation() { none() } // overridden by subclasses
 
   /**
    * Holds if this element is at the specified location.
@@ -91,18 +89,38 @@ class Node extends TIRDataFlowNode {
     this.getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
   }
 
-  string toString() {
+  /** Gets a textual representation of this element. */
+  string toString() { none() } // overridden by subclasses
+}
+
+class InstructionNode extends Node, TInstructionNode {
+  Instruction instr;
+
+  InstructionNode() { this = TInstructionNode(instr) }
+
+  /** Gets the instruction corresponding to this node. */
+  Instruction getInstruction() { result = instr }
+
+  override Declaration getEnclosingCallable() { result = this.getFunction() }
+
+  override Function getFunction() { result = instr.getEnclosingFunction() }
+
+  override Type getType() { result = instr.getResultType() }
+
+  override Location getLocation() { result = instr.getLocation() }
+
+  override string toString() {
     // This predicate is overridden in subclasses. This default implementation
     // does not use `Instruction.toString` because that's expensive to compute.
-    result = this.asInstruction().getOpcode().toString()
+    result = this.getInstruction().getOpcode().toString()
   }
 }
 
 /**
  * An expression, viewed as a node in a data flow graph.
  */
-class ExprNode extends Node {
-  ExprNode() { exists(this.asExpr()) }
+class ExprNode extends InstructionNode {
+  ExprNode() { exists(instr.getConvertedResultExpression()) }
 
   /**
    * Gets the non-conversion expression corresponding to this node, if any. If
@@ -110,13 +128,16 @@ class ExprNode extends Node {
    * `Conversion`, then the result is that `Conversion`'s non-`Conversion` base
    * expression.
    */
-  Expr getExpr() { result = this.asExpr() }
+  Expr getExpr() {
+    result.getConversion*() = instr.getConvertedResultExpression() and
+    not result instanceof Conversion
+  }
 
   /**
    * Gets the expression corresponding to this node, if any. The returned
    * expression may be a `Conversion`.
    */
-  Expr getConvertedExpr() { result = this.asConvertedExpr() }
+  Expr getConvertedExpr() { result = instr.getConvertedResultExpression() }
 
   override string toString() { result = this.asConvertedExpr().toString() }
 }
@@ -125,7 +146,7 @@ class ExprNode extends Node {
  * The value of a parameter at function entry, viewed as a node in a data
  * flow graph.
  */
-class ParameterNode extends Node {
+class ParameterNode extends InstructionNode {
   override InitializeParameterInstruction instr;
 
   /**
@@ -139,7 +160,7 @@ class ParameterNode extends Node {
   override string toString() { result = instr.getParameter().toString() }
 }
 
-private class ThisParameterNode extends Node {
+private class ThisParameterNode extends InstructionNode {
   override InitializeThisInstruction instr;
 
   override string toString() { result = "this" }
@@ -176,7 +197,7 @@ deprecated class UninitializedNode extends Node {
  * This class exists to match the interface used by Java. There are currently no non-abstract
  * classes that extend it. When we implement field flow, we can revisit this.
  */
-abstract class PostUpdateNode extends Node {
+abstract class PostUpdateNode extends InstructionNode {
   /**
    * Gets the node before the state update.
    */
@@ -193,7 +214,7 @@ abstract class PostUpdateNode extends Node {
  * returned. This node will have its `getArgument()` equal to `&x` and its
  * `getVariableAccess()` equal to `x`.
  */
-class DefinitionByReferenceNode extends Node {
+class DefinitionByReferenceNode extends InstructionNode {
   override WriteSideEffectInstruction instr;
 
   /** Gets the argument corresponding to this node. */
@@ -220,10 +241,41 @@ class DefinitionByReferenceNode extends Node {
   }
 }
 
+/**
+ * A `Node` corresponding to a variable in the program, as opposed to the
+ * value of that variable at some particular point. This can be used for
+ * modelling flow in and out of global variables.
+ */
+class VariableNode extends Node, TVariableNode {
+  Variable v;
+
+  VariableNode() { this = TVariableNode(v) }
+
+  /** Gets the variable corresponding to this node. */
+  Variable getVariable() { result = v }
+
+  override Function getFunction() { none() }
+
+  override Declaration getEnclosingCallable() {
+    // When flow crosses from one _enclosing callable_ to another, the
+    // interprocedural data-flow library discards call contexts and inserts a
+    // node in the big-step relation used for human-readable path explanations.
+    // Therefore we want a distinct enclosing callable for each `VariableNode`,
+    // and that can be the `Variable` itself.
+    result = v
+  }
+
+  override Type getType() { result = v.getType() }
+
+  override Location getLocation() { result = v.getLocation() }
+
+  override string toString() { result = v.toString() }
+}
+
 /**
  * Gets the node corresponding to `instr`.
  */
-Node instructionNode(Instruction instr) { result.asInstruction() = instr }
+InstructionNode instructionNode(Instruction instr) { result.getInstruction() = instr }
 
 DefinitionByReferenceNode definitionByReferenceNode(Expr e) { result.getArgument() = e }
 
@@ -244,6 +296,9 @@ ExprNode convertedExprNode(Expr e) { result.getExpr() = e }
  */
 ParameterNode parameterNode(Parameter p) { result.getParameter() = p }
 
+/** Gets the `VariableNode` corresponding to the variable `v`. */
+VariableNode variableNode(Variable v) { result.getVariable() = v }
+
 /**
  * Gets the `Node` corresponding to the value of an uninitialized local
  * variable `v`.

cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/ValueNumbering.qll

@@ -1,6 +1,5 @@
 private import internal.ValueNumberingInternal
 private import internal.ValueNumberingImports
-private import IR
 
 /**
  * Provides additional information about value numbering in IR dumps.
@@ -10,57 +9,38 @@ class ValueNumberPropertyProvider extends IRPropertyProvider {
     exists(ValueNumber vn |
       vn = valueNumber(instr) and
       key = "valnum" and
-      if strictcount(vn.getAnInstruction()) > 1 then result = vn.toString() else result = "unique"
+      if strictcount(vn.getAnInstruction()) > 1
+      then result = vn.getDebugString()
+      else result = "unique"
     )
   }
 }
 
-newtype TValueNumber =
-  TVariableAddressValueNumber(IRFunction irFunc, IRVariable var) {
-    variableAddressValueNumber(_, irFunc, var)
-  } or
-  TInitializeParameterValueNumber(IRFunction irFunc, IRVariable var) {
-    initializeParameterValueNumber(_, irFunc, var)
-  } or
-  TInitializeThisValueNumber(IRFunction irFunc) { initializeThisValueNumber(_, irFunc) } or
-  TConstantValueNumber(IRFunction irFunc, IRType type, string value) {
-    constantValueNumber(_, irFunc, type, value)
-  } or
-  TStringConstantValueNumber(IRFunction irFunc, IRType type, string value) {
-    stringConstantValueNumber(_, irFunc, type, value)
-  } or
-  TFieldAddressValueNumber(IRFunction irFunc, Language::Field field, ValueNumber objectAddress) {
-    fieldAddressValueNumber(_, irFunc, field, objectAddress)
-  } or
-  TBinaryValueNumber(
-    IRFunction irFunc, Opcode opcode, IRType type, ValueNumber leftOperand, ValueNumber rightOperand
-  ) {
-    binaryValueNumber(_, irFunc, opcode, type, leftOperand, rightOperand)
-  } or
-  TPointerArithmeticValueNumber(
-    IRFunction irFunc, Opcode opcode, IRType type, int elementSize, ValueNumber leftOperand,
-    ValueNumber rightOperand
-  ) {
-    pointerArithmeticValueNumber(_, irFunc, opcode, type, elementSize, leftOperand, rightOperand)
-  } or
-  TUnaryValueNumber(IRFunction irFunc, Opcode opcode, IRType type, ValueNumber operand) {
-    unaryValueNumber(_, irFunc, opcode, type, operand)
-  } or
-  TInheritanceConversionValueNumber(
-    IRFunction irFunc, Opcode opcode, Language::Class baseClass, Language::Class derivedClass,
-    ValueNumber operand
-  ) {
-    inheritanceConversionValueNumber(_, irFunc, opcode, baseClass, derivedClass, operand)
-  } or
-  TUniqueValueNumber(IRFunction irFunc, Instruction instr) { uniqueValueNumber(instr, irFunc) }
-
 /**
  * The value number assigned to a particular set of instructions that produce equivalent results.
  */
 class ValueNumber extends TValueNumber {
-  final string toString() { result = getExampleInstruction().getResultId() }
+  final string toString() { result = "GVN" }
 
-  final Language::Location getLocation() { result = getExampleInstruction().getLocation() }
+  final string getDebugString() { result = strictconcat(getAnInstruction().getResultId(), ", ") }
+
+  final Language::Location getLocation() {
+    if
+      exists(Instruction i |
+        i = getAnInstruction() and not i.getLocation() instanceof UnknownLocation
+      )
+    then
+      result =
+        min(Language::Location l |
+          l = getAnInstruction().getLocation() and not l instanceof UnknownLocation
+        |
+          l
+          order by
+            l.getFile().getAbsolutePath(), l.getStartLine(), l.getStartColumn(), l.getEndLine(),
+            l.getEndColumn()
+        )
+    else result instanceof UnknownDefaultLocation
+  }
 
   /**
    * Gets the instructions that have been assigned this value number. This will always produce at
@@ -85,236 +65,39 @@ class ValueNumber extends TValueNumber {
    * Gets an `Operand` whose definition is exact and has this value number.
    */
   final Operand getAUse() { this = valueNumber(result.getDef()) }
-}
 
-/**
- * A `CopyInstruction` whose source operand's value is congruent to the definition of that source
- * operand.
- * For example:
- * ```
- * Point p = { 1, 2 };
- * Point q = p;
- * int a = p.x;
- * ```
- * The use of `p` on line 2 is linked to the definition of `p` on line 1, and is congruent to that
- * definition because it accesses the exact same memory.
- * The use of `p.x` on line 3 is linked to the definition of `p` on line 1 as well, but is not
- * congruent to that definition because `p.x` accesses only a subset of the memory defined by `p`.
- */
-private class CongruentCopyInstruction extends CopyInstruction {
-  CongruentCopyInstruction() {
-    this.getSourceValueOperand().getDefinitionOverlap() instanceof MustExactlyOverlap
+  final string getKind() {
+    this instanceof TVariableAddressValueNumber and result = "VariableAddress"
+    or
+    this instanceof TInitializeParameterValueNumber and result = "InitializeParameter"
+    or
+    this instanceof TInitializeThisValueNumber and result = "InitializeThis"
+    or
+    this instanceof TStringConstantValueNumber and result = "StringConstant"
+    or
+    this instanceof TFieldAddressValueNumber and result = "FieldAddress"
+    or
+    this instanceof TBinaryValueNumber and result = "Binary"
+    or
+    this instanceof TPointerArithmeticValueNumber and result = "PointerArithmetic"
+    or
+    this instanceof TUnaryValueNumber and result = "Unary"
+    or
+    this instanceof TInheritanceConversionValueNumber and result = "InheritanceConversion"
+    or
+    this instanceof TLoadTotalOverlapValueNumber and result = "LoadTotalOverlap"
+    or
+    this instanceof TUniqueValueNumber and result = "Unique"
   }
 }
 
-/**
- * Holds if this library knows how to assign a value number to the specified instruction, other than
- * a `unique` value number that is never shared by multiple instructions.
- */
-private predicate numberableInstruction(Instruction instr) {
-  instr instanceof VariableAddressInstruction
-  or
-  instr instanceof InitializeParameterInstruction
-  or
-  instr instanceof InitializeThisInstruction
-  or
-  instr instanceof ConstantInstruction
-  or
-  instr instanceof StringConstantInstruction
-  or
-  instr instanceof FieldAddressInstruction
-  or
-  instr instanceof BinaryInstruction
-  or
-  instr instanceof UnaryInstruction and not instr instanceof CopyInstruction
-  or
-  instr instanceof PointerArithmeticInstruction
-  or
-  instr instanceof CongruentCopyInstruction
-}
-
-private predicate variableAddressValueNumber(
-  VariableAddressInstruction instr, IRFunction irFunc, IRVariable var
-) {
-  instr.getEnclosingIRFunction() = irFunc and
-  instr.getIRVariable() = var
-}
-
-private predicate initializeParameterValueNumber(
-  InitializeParameterInstruction instr, IRFunction irFunc, IRVariable var
-) {
-  instr.getEnclosingIRFunction() = irFunc and
-  instr.getIRVariable() = var
-}
-
-private predicate initializeThisValueNumber(InitializeThisInstruction instr, IRFunction irFunc) {
-  instr.getEnclosingIRFunction() = irFunc
-}
-
-private predicate constantValueNumber(
-  ConstantInstruction instr, IRFunction irFunc, IRType type, string value
-) {
-  instr.getEnclosingIRFunction() = irFunc and
-  instr.getResultIRType() = type and
-  instr.getValue() = value
-}
-
-private predicate stringConstantValueNumber(
-  StringConstantInstruction instr, IRFunction irFunc, IRType type, string value
-) {
-  instr.getEnclosingIRFunction() = irFunc and
-  instr.getResultIRType() = type and
-  instr.getValue().getValue() = value
-}
-
-private predicate fieldAddressValueNumber(
-  FieldAddressInstruction instr, IRFunction irFunc, Language::Field field, ValueNumber objectAddress
-) {
-  instr.getEnclosingIRFunction() = irFunc and
-  instr.getField() = field and
-  valueNumber(instr.getObjectAddress()) = objectAddress
-}
-
-private predicate binaryValueNumber(
-  BinaryInstruction instr, IRFunction irFunc, Opcode opcode, IRType type, ValueNumber leftOperand,
-  ValueNumber rightOperand
-) {
-  instr.getEnclosingIRFunction() = irFunc and
-  not instr instanceof PointerArithmeticInstruction and
-  instr.getOpcode() = opcode and
-  instr.getResultIRType() = type and
-  valueNumber(instr.getLeft()) = leftOperand and
-  valueNumber(instr.getRight()) = rightOperand
-}
-
-private predicate pointerArithmeticValueNumber(
-  PointerArithmeticInstruction instr, IRFunction irFunc, Opcode opcode, IRType type,
-  int elementSize, ValueNumber leftOperand, ValueNumber rightOperand
-) {
-  instr.getEnclosingIRFunction() = irFunc and
-  instr.getOpcode() = opcode and
-  instr.getResultIRType() = type and
-  instr.getElementSize() = elementSize and
-  valueNumber(instr.getLeft()) = leftOperand and
-  valueNumber(instr.getRight()) = rightOperand
-}
-
-private predicate unaryValueNumber(
-  UnaryInstruction instr, IRFunction irFunc, Opcode opcode, IRType type, ValueNumber operand
-) {
-  instr.getEnclosingIRFunction() = irFunc and
-  not instr instanceof InheritanceConversionInstruction and
-  not instr instanceof CopyInstruction and
-  instr.getOpcode() = opcode and
-  instr.getResultIRType() = type and
-  valueNumber(instr.getUnary()) = operand
-}
-
-private predicate inheritanceConversionValueNumber(
-  InheritanceConversionInstruction instr, IRFunction irFunc, Opcode opcode,
-  Language::Class baseClass, Language::Class derivedClass, ValueNumber operand
-) {
-  instr.getEnclosingIRFunction() = irFunc and
-  instr.getOpcode() = opcode and
-  instr.getBaseClass() = baseClass and
-  instr.getDerivedClass() = derivedClass and
-  valueNumber(instr.getUnary()) = operand
-}
-
-/**
- * Holds if `instr` should be assigned a unique value number because this library does not know how
- * to determine if two instances of that instruction are equivalent.
- */
-private predicate uniqueValueNumber(Instruction instr, IRFunction irFunc) {
-  instr.getEnclosingIRFunction() = irFunc and
-  not instr.getResultIRType() instanceof IRVoidType and
-  not numberableInstruction(instr)
-}
-
 /**
  * Gets the value number assigned to `instr`, if any. Returns at most one result.
  */
-cached
-ValueNumber valueNumber(Instruction instr) {
-  result = nonUniqueValueNumber(instr)
-  or
-  exists(IRFunction irFunc |
-    uniqueValueNumber(instr, irFunc) and
-    result = TUniqueValueNumber(irFunc, instr)
-  )
-}
+ValueNumber valueNumber(Instruction instr) { result = tvalueNumber(instr) }
 
 /**
  * Gets the value number assigned to the exact definition of `op`, if any.
  * Returns at most one result.
  */
-ValueNumber valueNumberOfOperand(Operand op) { result = valueNumber(op.getDef()) }
-
-/**
- * Gets the value number assigned to `instr`, if any, unless that instruction is assigned a unique
- * value number.
- */
-private ValueNumber nonUniqueValueNumber(Instruction instr) {
-  exists(IRFunction irFunc |
-    irFunc = instr.getEnclosingIRFunction() and
-    (
-      exists(IRVariable var |
-        variableAddressValueNumber(instr, irFunc, var) and
-        result = TVariableAddressValueNumber(irFunc, var)
-      )
-      or
-      exists(IRVariable var |
-        initializeParameterValueNumber(instr, irFunc, var) and
-        result = TInitializeParameterValueNumber(irFunc, var)
-      )
-      or
-      initializeThisValueNumber(instr, irFunc) and
-      result = TInitializeThisValueNumber(irFunc)
-      or
-      exists(IRType type, string value |
-        constantValueNumber(instr, irFunc, type, value) and
-        result = TConstantValueNumber(irFunc, type, value)
-      )
-      or
-      exists(IRType type, string value |
-        stringConstantValueNumber(instr, irFunc, type, value) and
-        result = TStringConstantValueNumber(irFunc, type, value)
-      )
-      or
-      exists(Language::Field field, ValueNumber objectAddress |
-        fieldAddressValueNumber(instr, irFunc, field, objectAddress) and
-        result = TFieldAddressValueNumber(irFunc, field, objectAddress)
-      )
-      or
-      exists(Opcode opcode, IRType type, ValueNumber leftOperand, ValueNumber rightOperand |
-        binaryValueNumber(instr, irFunc, opcode, type, leftOperand, rightOperand) and
-        result = TBinaryValueNumber(irFunc, opcode, type, leftOperand, rightOperand)
-      )
-      or
-      exists(Opcode opcode, IRType type, ValueNumber operand |
-        unaryValueNumber(instr, irFunc, opcode, type, operand) and
-        result = TUnaryValueNumber(irFunc, opcode, type, operand)
-      )
-      or
-      exists(
-        Opcode opcode, Language::Class baseClass, Language::Class derivedClass, ValueNumber operand
-      |
-        inheritanceConversionValueNumber(instr, irFunc, opcode, baseClass, derivedClass, operand) and
-        result = TInheritanceConversionValueNumber(irFunc, opcode, baseClass, derivedClass, operand)
-      )
-      or
-      exists(
-        Opcode opcode, IRType type, int elementSize, ValueNumber leftOperand,
-        ValueNumber rightOperand
-      |
-        pointerArithmeticValueNumber(instr, irFunc, opcode, type, elementSize, leftOperand,
-          rightOperand) and
-        result =
-          TPointerArithmeticValueNumber(irFunc, opcode, type, elementSize, leftOperand, rightOperand)
-      )
-      or
-      // The value number of a copy is just the value number of its source value.
-      result = valueNumber(instr.(CongruentCopyInstruction).getSourceValue())
-    )
-  )
-}
+ValueNumber valueNumberOfOperand(Operand op) { result = tvalueNumberOfOperand(op) }

cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/internal/ValueNumberingImports.qll

@@ -1,2 +1,4 @@
+import semmle.code.cpp.ir.implementation.aliased_ssa.IR
 import semmle.code.cpp.ir.internal.Overlap
 import semmle.code.cpp.ir.internal.IRCppLanguage as Language
+import semmle.code.cpp.Location

cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/internal/ValueNumberingInternal.qll

@@ -1 +1,303 @@
-import semmle.code.cpp.ir.implementation.aliased_ssa.IR as IR
+private import ValueNumberingImports
+private import cpp
+
+newtype TValueNumber =
+  TVariableAddressValueNumber(IRFunction irFunc, IRVariable var) {
+    variableAddressValueNumber(_, irFunc, var)
+  } or
+  TInitializeParameterValueNumber(IRFunction irFunc, IRVariable var) {
+    initializeParameterValueNumber(_, irFunc, var)
+  } or
+  TInitializeThisValueNumber(IRFunction irFunc) { initializeThisValueNumber(_, irFunc) } or
+  TConstantValueNumber(IRFunction irFunc, IRType type, string value) {
+    constantValueNumber(_, irFunc, type, value)
+  } or
+  TStringConstantValueNumber(IRFunction irFunc, IRType type, string value) {
+    stringConstantValueNumber(_, irFunc, type, value)
+  } or
+  TFieldAddressValueNumber(IRFunction irFunc, Field field, TValueNumber objectAddress) {
+    fieldAddressValueNumber(_, irFunc, field, objectAddress)
+  } or
+  TBinaryValueNumber(
+    IRFunction irFunc, Opcode opcode, IRType type, TValueNumber leftOperand,
+    TValueNumber rightOperand
+  ) {
+    binaryValueNumber(_, irFunc, opcode, type, leftOperand, rightOperand)
+  } or
+  TPointerArithmeticValueNumber(
+    IRFunction irFunc, Opcode opcode, IRType type, int elementSize, TValueNumber leftOperand,
+    TValueNumber rightOperand
+  ) {
+    pointerArithmeticValueNumber(_, irFunc, opcode, type, elementSize, leftOperand, rightOperand)
+  } or
+  TUnaryValueNumber(IRFunction irFunc, Opcode opcode, IRType type, TValueNumber operand) {
+    unaryValueNumber(_, irFunc, opcode, type, operand)
+  } or
+  TInheritanceConversionValueNumber(
+    IRFunction irFunc, Opcode opcode, Class baseClass, Class derivedClass, TValueNumber operand
+  ) {
+    inheritanceConversionValueNumber(_, irFunc, opcode, baseClass, derivedClass, operand)
+  } or
+  TLoadTotalOverlapValueNumber(
+    IRFunction irFunc, IRType type, TValueNumber memOperand, TValueNumber operand
+  ) {
+    loadTotalOverlapValueNumber(_, irFunc, type, memOperand, operand)
+  } or
+  TUniqueValueNumber(IRFunction irFunc, Instruction instr) { uniqueValueNumber(instr, irFunc) }
+
+/**
+ * A `CopyInstruction` whose source operand's value is congruent to the definition of that source
+ * operand.
+ * For example:
+ * ```
+ * Point p = { 1, 2 };
+ * Point q = p;
+ * int a = p.x;
+ * ```
+ * The use of `p` on line 2 is linked to the definition of `p` on line 1, and is congruent to that
+ * definition because it accesses the exact same memory.
+ * The use of `p.x` on line 3 is linked to the definition of `p` on line 1 as well, but is not
+ * congruent to that definition because `p.x` accesses only a subset of the memory defined by `p`.
+ */
+class CongruentCopyInstruction extends CopyInstruction {
+  CongruentCopyInstruction() {
+    this.getSourceValueOperand().getDefinitionOverlap() instanceof MustExactlyOverlap
+  }
+}
+
+class LoadTotalOverlapInstruction extends LoadInstruction {
+  LoadTotalOverlapInstruction() {
+    this.getSourceValueOperand().getDefinitionOverlap() instanceof MustTotallyOverlap
+  }
+}
+
+/**
+ * Holds if this library knows how to assign a value number to the specified instruction, other than
+ * a `unique` value number that is never shared by multiple instructions.
+ */
+private predicate numberableInstruction(Instruction instr) {
+  instr instanceof VariableAddressInstruction
+  or
+  instr instanceof InitializeParameterInstruction
+  or
+  instr instanceof InitializeThisInstruction
+  or
+  instr instanceof ConstantInstruction
+  or
+  instr instanceof StringConstantInstruction
+  or
+  instr instanceof FieldAddressInstruction
+  or
+  instr instanceof BinaryInstruction
+  or
+  instr instanceof UnaryInstruction and not instr instanceof CopyInstruction
+  or
+  instr instanceof PointerArithmeticInstruction
+  or
+  instr instanceof CongruentCopyInstruction
+  or
+  instr instanceof LoadTotalOverlapInstruction
+}
+
+private predicate variableAddressValueNumber(
+  VariableAddressInstruction instr, IRFunction irFunc, IRVariable var
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  instr.getIRVariable() = var
+}
+
+private predicate initializeParameterValueNumber(
+  InitializeParameterInstruction instr, IRFunction irFunc, IRVariable var
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  instr.getIRVariable() = var
+}
+
+private predicate initializeThisValueNumber(InitializeThisInstruction instr, IRFunction irFunc) {
+  instr.getEnclosingIRFunction() = irFunc
+}
+
+private predicate constantValueNumber(
+  ConstantInstruction instr, IRFunction irFunc, IRType type, string value
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  instr.getResultIRType() = type and
+  instr.getValue() = value
+}
+
+private predicate stringConstantValueNumber(
+  StringConstantInstruction instr, IRFunction irFunc, IRType type, string value
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  instr.getResultIRType() = type and
+  instr.getValue().getValue() = value
+}
+
+private predicate fieldAddressValueNumber(
+  FieldAddressInstruction instr, IRFunction irFunc, Language::Field field,
+  TValueNumber objectAddress
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  instr.getField() = field and
+  tvalueNumber(instr.getObjectAddress()) = objectAddress
+}
+
+private predicate binaryValueNumber(
+  BinaryInstruction instr, IRFunction irFunc, Opcode opcode, IRType type, TValueNumber leftOperand,
+  TValueNumber rightOperand
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  not instr instanceof PointerArithmeticInstruction and
+  instr.getOpcode() = opcode and
+  instr.getResultIRType() = type and
+  tvalueNumber(instr.getLeft()) = leftOperand and
+  tvalueNumber(instr.getRight()) = rightOperand
+}
+
+private predicate pointerArithmeticValueNumber(
+  PointerArithmeticInstruction instr, IRFunction irFunc, Opcode opcode, IRType type,
+  int elementSize, TValueNumber leftOperand, TValueNumber rightOperand
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  instr.getOpcode() = opcode and
+  instr.getResultIRType() = type and
+  instr.getElementSize() = elementSize and
+  tvalueNumber(instr.getLeft()) = leftOperand and
+  tvalueNumber(instr.getRight()) = rightOperand
+}
+
+private predicate unaryValueNumber(
+  UnaryInstruction instr, IRFunction irFunc, Opcode opcode, IRType type, TValueNumber operand
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  not instr instanceof InheritanceConversionInstruction and
+  not instr instanceof CopyInstruction and
+  not instr instanceof FieldAddressInstruction and
+  instr.getOpcode() = opcode and
+  instr.getResultIRType() = type and
+  tvalueNumber(instr.getUnary()) = operand
+}
+
+private predicate inheritanceConversionValueNumber(
+  InheritanceConversionInstruction instr, IRFunction irFunc, Opcode opcode,
+  Language::Class baseClass, Language::Class derivedClass, TValueNumber operand
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  instr.getOpcode() = opcode and
+  instr.getBaseClass() = baseClass and
+  instr.getDerivedClass() = derivedClass and
+  tvalueNumber(instr.getUnary()) = operand
+}
+
+private predicate loadTotalOverlapValueNumber(
+  LoadTotalOverlapInstruction instr, IRFunction irFunc, IRType type, TValueNumber memOperand,
+  TValueNumber operand
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  instr.getResultIRType() = type and
+  tvalueNumber(instr.getAnOperand().(MemoryOperand).getAnyDef()) = memOperand and
+  tvalueNumberOfOperand(instr.getAnOperand().(AddressOperand)) = operand
+}
+
+/**
+ * Holds if `instr` should be assigned a unique value number because this library does not know how
+ * to determine if two instances of that instruction are equivalent.
+ */
+private predicate uniqueValueNumber(Instruction instr, IRFunction irFunc) {
+  instr.getEnclosingIRFunction() = irFunc and
+  not instr.getResultIRType() instanceof IRVoidType and
+  not numberableInstruction(instr)
+}
+
+/**
+ * Gets the value number assigned to `instr`, if any. Returns at most one result.
+ */
+cached
+TValueNumber tvalueNumber(Instruction instr) {
+  result = nonUniqueValueNumber(instr)
+  or
+  exists(IRFunction irFunc |
+    uniqueValueNumber(instr, irFunc) and
+    result = TUniqueValueNumber(irFunc, instr)
+  )
+}
+
+/**
+ * Gets the value number assigned to the exact definition of `op`, if any.
+ * Returns at most one result.
+ */
+TValueNumber tvalueNumberOfOperand(Operand op) { result = tvalueNumber(op.getDef()) }
+
+/**
+ * Gets the value number assigned to `instr`, if any, unless that instruction is assigned a unique
+ * value number.
+ */
+private TValueNumber nonUniqueValueNumber(Instruction instr) {
+  exists(IRFunction irFunc |
+    irFunc = instr.getEnclosingIRFunction() and
+    (
+      exists(IRVariable var |
+        variableAddressValueNumber(instr, irFunc, var) and
+        result = TVariableAddressValueNumber(irFunc, var)
+      )
+      or
+      exists(IRVariable var |
+        initializeParameterValueNumber(instr, irFunc, var) and
+        result = TInitializeParameterValueNumber(irFunc, var)
+      )
+      or
+      initializeThisValueNumber(instr, irFunc) and
+      result = TInitializeThisValueNumber(irFunc)
+      or
+      exists(IRType type, string value |
+        constantValueNumber(instr, irFunc, type, value) and
+        result = TConstantValueNumber(irFunc, type, value)
+      )
+      or
+      exists(IRType type, string value |
+        stringConstantValueNumber(instr, irFunc, type, value) and
+        result = TStringConstantValueNumber(irFunc, type, value)
+      )
+      or
+      exists(Language::Field field, TValueNumber objectAddress |
+        fieldAddressValueNumber(instr, irFunc, field, objectAddress) and
+        result = TFieldAddressValueNumber(irFunc, field, objectAddress)
+      )
+      or
+      exists(Opcode opcode, IRType type, TValueNumber leftOperand, TValueNumber rightOperand |
+        binaryValueNumber(instr, irFunc, opcode, type, leftOperand, rightOperand) and
+        result = TBinaryValueNumber(irFunc, opcode, type, leftOperand, rightOperand)
+      )
+      or
+      exists(Opcode opcode, IRType type, TValueNumber operand |
+        unaryValueNumber(instr, irFunc, opcode, type, operand) and
+        result = TUnaryValueNumber(irFunc, opcode, type, operand)
+      )
+      or
+      exists(
+        Opcode opcode, Language::Class baseClass, Language::Class derivedClass, TValueNumber operand
+      |
+        inheritanceConversionValueNumber(instr, irFunc, opcode, baseClass, derivedClass, operand) and
+        result = TInheritanceConversionValueNumber(irFunc, opcode, baseClass, derivedClass, operand)
+      )
+      or
+      exists(
+        Opcode opcode, IRType type, int elementSize, TValueNumber leftOperand,
+        TValueNumber rightOperand
+      |
+        pointerArithmeticValueNumber(instr, irFunc, opcode, type, elementSize, leftOperand,
+          rightOperand) and
+        result =
+          TPointerArithmeticValueNumber(irFunc, opcode, type, elementSize, leftOperand, rightOperand)
+      )
+      or
+      exists(IRType type, TValueNumber memOperand, TValueNumber operand |
+        loadTotalOverlapValueNumber(instr, irFunc, type, memOperand, operand) and
+        result = TLoadTotalOverlapValueNumber(irFunc, type, memOperand, operand)
+      )
+      or
+      // The value number of a copy is just the value number of its source value.
+      result = tvalueNumber(instr.(CongruentCopyInstruction).getSourceValue())
+    )
+  )
+}

cpp/ql/src/semmle/code/cpp/ir/implementation/raw/gvn/ValueNumbering.qll

@@ -1,6 +1,5 @@
 private import internal.ValueNumberingInternal
 private import internal.ValueNumberingImports
-private import IR
 
 /**
  * Provides additional information about value numbering in IR dumps.
@@ -10,57 +9,38 @@ class ValueNumberPropertyProvider extends IRPropertyProvider {
     exists(ValueNumber vn |
       vn = valueNumber(instr) and
       key = "valnum" and
-      if strictcount(vn.getAnInstruction()) > 1 then result = vn.toString() else result = "unique"
+      if strictcount(vn.getAnInstruction()) > 1
+      then result = vn.getDebugString()
+      else result = "unique"
     )
   }
 }
 
-newtype TValueNumber =
-  TVariableAddressValueNumber(IRFunction irFunc, IRVariable var) {
-    variableAddressValueNumber(_, irFunc, var)
-  } or
-  TInitializeParameterValueNumber(IRFunction irFunc, IRVariable var) {
-    initializeParameterValueNumber(_, irFunc, var)
-  } or
-  TInitializeThisValueNumber(IRFunction irFunc) { initializeThisValueNumber(_, irFunc) } or
-  TConstantValueNumber(IRFunction irFunc, IRType type, string value) {
-    constantValueNumber(_, irFunc, type, value)
-  } or
-  TStringConstantValueNumber(IRFunction irFunc, IRType type, string value) {
-    stringConstantValueNumber(_, irFunc, type, value)
-  } or
-  TFieldAddressValueNumber(IRFunction irFunc, Language::Field field, ValueNumber objectAddress) {
-    fieldAddressValueNumber(_, irFunc, field, objectAddress)
-  } or
-  TBinaryValueNumber(
-    IRFunction irFunc, Opcode opcode, IRType type, ValueNumber leftOperand, ValueNumber rightOperand
-  ) {
-    binaryValueNumber(_, irFunc, opcode, type, leftOperand, rightOperand)
-  } or
-  TPointerArithmeticValueNumber(
-    IRFunction irFunc, Opcode opcode, IRType type, int elementSize, ValueNumber leftOperand,
-    ValueNumber rightOperand
-  ) {
-    pointerArithmeticValueNumber(_, irFunc, opcode, type, elementSize, leftOperand, rightOperand)
-  } or
-  TUnaryValueNumber(IRFunction irFunc, Opcode opcode, IRType type, ValueNumber operand) {
-    unaryValueNumber(_, irFunc, opcode, type, operand)
-  } or
-  TInheritanceConversionValueNumber(
-    IRFunction irFunc, Opcode opcode, Language::Class baseClass, Language::Class derivedClass,
-    ValueNumber operand
-  ) {
-    inheritanceConversionValueNumber(_, irFunc, opcode, baseClass, derivedClass, operand)
-  } or
-  TUniqueValueNumber(IRFunction irFunc, Instruction instr) { uniqueValueNumber(instr, irFunc) }
-
 /**
  * The value number assigned to a particular set of instructions that produce equivalent results.
  */
 class ValueNumber extends TValueNumber {
-  final string toString() { result = getExampleInstruction().getResultId() }
+  final string toString() { result = "GVN" }
 
-  final Language::Location getLocation() { result = getExampleInstruction().getLocation() }
+  final string getDebugString() { result = strictconcat(getAnInstruction().getResultId(), ", ") }
+
+  final Language::Location getLocation() {
+    if
+      exists(Instruction i |
+        i = getAnInstruction() and not i.getLocation() instanceof UnknownLocation
+      )
+    then
+      result =
+        min(Language::Location l |
+          l = getAnInstruction().getLocation() and not l instanceof UnknownLocation
+        |
+          l
+          order by
+            l.getFile().getAbsolutePath(), l.getStartLine(), l.getStartColumn(), l.getEndLine(),
+            l.getEndColumn()
+        )
+    else result instanceof UnknownDefaultLocation
+  }
 
   /**
    * Gets the instructions that have been assigned this value number. This will always produce at
@@ -85,236 +65,39 @@ class ValueNumber extends TValueNumber {
    * Gets an `Operand` whose definition is exact and has this value number.
    */
   final Operand getAUse() { this = valueNumber(result.getDef()) }
-}
 
-/**
- * A `CopyInstruction` whose source operand's value is congruent to the definition of that source
- * operand.
- * For example:
- * ```
- * Point p = { 1, 2 };
- * Point q = p;
- * int a = p.x;
- * ```
- * The use of `p` on line 2 is linked to the definition of `p` on line 1, and is congruent to that
- * definition because it accesses the exact same memory.
- * The use of `p.x` on line 3 is linked to the definition of `p` on line 1 as well, but is not
- * congruent to that definition because `p.x` accesses only a subset of the memory defined by `p`.
- */
-private class CongruentCopyInstruction extends CopyInstruction {
-  CongruentCopyInstruction() {
-    this.getSourceValueOperand().getDefinitionOverlap() instanceof MustExactlyOverlap
+  final string getKind() {
+    this instanceof TVariableAddressValueNumber and result = "VariableAddress"
+    or
+    this instanceof TInitializeParameterValueNumber and result = "InitializeParameter"
+    or
+    this instanceof TInitializeThisValueNumber and result = "InitializeThis"
+    or
+    this instanceof TStringConstantValueNumber and result = "StringConstant"
+    or
+    this instanceof TFieldAddressValueNumber and result = "FieldAddress"
+    or
+    this instanceof TBinaryValueNumber and result = "Binary"
+    or
+    this instanceof TPointerArithmeticValueNumber and result = "PointerArithmetic"
+    or
+    this instanceof TUnaryValueNumber and result = "Unary"
+    or
+    this instanceof TInheritanceConversionValueNumber and result = "InheritanceConversion"
+    or
+    this instanceof TLoadTotalOverlapValueNumber and result = "LoadTotalOverlap"
+    or
+    this instanceof TUniqueValueNumber and result = "Unique"
   }
 }
 
-/**
- * Holds if this library knows how to assign a value number to the specified instruction, other than
- * a `unique` value number that is never shared by multiple instructions.
- */
-private predicate numberableInstruction(Instruction instr) {
-  instr instanceof VariableAddressInstruction
-  or
-  instr instanceof InitializeParameterInstruction
-  or
-  instr instanceof InitializeThisInstruction
-  or
-  instr instanceof ConstantInstruction
-  or
-  instr instanceof StringConstantInstruction
-  or
-  instr instanceof FieldAddressInstruction
-  or
-  instr instanceof BinaryInstruction
-  or
-  instr instanceof UnaryInstruction and not instr instanceof CopyInstruction
-  or
-  instr instanceof PointerArithmeticInstruction
-  or
-  instr instanceof CongruentCopyInstruction
-}
-
-private predicate variableAddressValueNumber(
-  VariableAddressInstruction instr, IRFunction irFunc, IRVariable var
-) {
-  instr.getEnclosingIRFunction() = irFunc and
-  instr.getIRVariable() = var
-}
-
-private predicate initializeParameterValueNumber(
-  InitializeParameterInstruction instr, IRFunction irFunc, IRVariable var
-) {
-  instr.getEnclosingIRFunction() = irFunc and
-  instr.getIRVariable() = var
-}
-
-private predicate initializeThisValueNumber(InitializeThisInstruction instr, IRFunction irFunc) {
-  instr.getEnclosingIRFunction() = irFunc
-}
-
-private predicate constantValueNumber(
-  ConstantInstruction instr, IRFunction irFunc, IRType type, string value
-) {
-  instr.getEnclosingIRFunction() = irFunc and
-  instr.getResultIRType() = type and
-  instr.getValue() = value
-}
-
-private predicate stringConstantValueNumber(
-  StringConstantInstruction instr, IRFunction irFunc, IRType type, string value
-) {
-  instr.getEnclosingIRFunction() = irFunc and
-  instr.getResultIRType() = type and
-  instr.getValue().getValue() = value
-}
-
-private predicate fieldAddressValueNumber(
-  FieldAddressInstruction instr, IRFunction irFunc, Language::Field field, ValueNumber objectAddress
-) {
-  instr.getEnclosingIRFunction() = irFunc and
-  instr.getField() = field and
-  valueNumber(instr.getObjectAddress()) = objectAddress
-}
-
-private predicate binaryValueNumber(
-  BinaryInstruction instr, IRFunction irFunc, Opcode opcode, IRType type, ValueNumber leftOperand,
-  ValueNumber rightOperand
-) {
-  instr.getEnclosingIRFunction() = irFunc and
-  not instr instanceof PointerArithmeticInstruction and
-  instr.getOpcode() = opcode and
-  instr.getResultIRType() = type and
-  valueNumber(instr.getLeft()) = leftOperand and
-  valueNumber(instr.getRight()) = rightOperand
-}
-
-private predicate pointerArithmeticValueNumber(
-  PointerArithmeticInstruction instr, IRFunction irFunc, Opcode opcode, IRType type,
-  int elementSize, ValueNumber leftOperand, ValueNumber rightOperand
-) {
-  instr.getEnclosingIRFunction() = irFunc and
-  instr.getOpcode() = opcode and
-  instr.getResultIRType() = type and
-  instr.getElementSize() = elementSize and
-  valueNumber(instr.getLeft()) = leftOperand and
-  valueNumber(instr.getRight()) = rightOperand
-}
-
-private predicate unaryValueNumber(
-  UnaryInstruction instr, IRFunction irFunc, Opcode opcode, IRType type, ValueNumber operand
-) {
-  instr.getEnclosingIRFunction() = irFunc and
-  not instr instanceof InheritanceConversionInstruction and
-  not instr instanceof CopyInstruction and
-  instr.getOpcode() = opcode and
-  instr.getResultIRType() = type and
-  valueNumber(instr.getUnary()) = operand
-}
-
-private predicate inheritanceConversionValueNumber(
-  InheritanceConversionInstruction instr, IRFunction irFunc, Opcode opcode,
-  Language::Class baseClass, Language::Class derivedClass, ValueNumber operand
-) {
-  instr.getEnclosingIRFunction() = irFunc and
-  instr.getOpcode() = opcode and
-  instr.getBaseClass() = baseClass and
-  instr.getDerivedClass() = derivedClass and
-  valueNumber(instr.getUnary()) = operand
-}
-
-/**
- * Holds if `instr` should be assigned a unique value number because this library does not know how
- * to determine if two instances of that instruction are equivalent.
- */
-private predicate uniqueValueNumber(Instruction instr, IRFunction irFunc) {
-  instr.getEnclosingIRFunction() = irFunc and
-  not instr.getResultIRType() instanceof IRVoidType and
-  not numberableInstruction(instr)
-}
-
 /**
  * Gets the value number assigned to `instr`, if any. Returns at most one result.
  */
-cached
-ValueNumber valueNumber(Instruction instr) {
-  result = nonUniqueValueNumber(instr)
-  or
-  exists(IRFunction irFunc |
-    uniqueValueNumber(instr, irFunc) and
-    result = TUniqueValueNumber(irFunc, instr)
-  )
-}
+ValueNumber valueNumber(Instruction instr) { result = tvalueNumber(instr) }
 
 /**
  * Gets the value number assigned to the exact definition of `op`, if any.
  * Returns at most one result.
  */
-ValueNumber valueNumberOfOperand(Operand op) { result = valueNumber(op.getDef()) }
-
-/**
- * Gets the value number assigned to `instr`, if any, unless that instruction is assigned a unique
- * value number.
- */
-private ValueNumber nonUniqueValueNumber(Instruction instr) {
-  exists(IRFunction irFunc |
-    irFunc = instr.getEnclosingIRFunction() and
-    (
-      exists(IRVariable var |
-        variableAddressValueNumber(instr, irFunc, var) and
-        result = TVariableAddressValueNumber(irFunc, var)
-      )
-      or
-      exists(IRVariable var |
-        initializeParameterValueNumber(instr, irFunc, var) and
-        result = TInitializeParameterValueNumber(irFunc, var)
-      )
-      or
-      initializeThisValueNumber(instr, irFunc) and
-      result = TInitializeThisValueNumber(irFunc)
-      or
-      exists(IRType type, string value |
-        constantValueNumber(instr, irFunc, type, value) and
-        result = TConstantValueNumber(irFunc, type, value)
-      )
-      or
-      exists(IRType type, string value |
-        stringConstantValueNumber(instr, irFunc, type, value) and
-        result = TStringConstantValueNumber(irFunc, type, value)
-      )
-      or
-      exists(Language::Field field, ValueNumber objectAddress |
-        fieldAddressValueNumber(instr, irFunc, field, objectAddress) and
-        result = TFieldAddressValueNumber(irFunc, field, objectAddress)
-      )
-      or
-      exists(Opcode opcode, IRType type, ValueNumber leftOperand, ValueNumber rightOperand |
-        binaryValueNumber(instr, irFunc, opcode, type, leftOperand, rightOperand) and
-        result = TBinaryValueNumber(irFunc, opcode, type, leftOperand, rightOperand)
-      )
-      or
-      exists(Opcode opcode, IRType type, ValueNumber operand |
-        unaryValueNumber(instr, irFunc, opcode, type, operand) and
-        result = TUnaryValueNumber(irFunc, opcode, type, operand)
-      )
-      or
-      exists(
-        Opcode opcode, Language::Class baseClass, Language::Class derivedClass, ValueNumber operand
-      |
-        inheritanceConversionValueNumber(instr, irFunc, opcode, baseClass, derivedClass, operand) and
-        result = TInheritanceConversionValueNumber(irFunc, opcode, baseClass, derivedClass, operand)
-      )
-      or
-      exists(
-        Opcode opcode, IRType type, int elementSize, ValueNumber leftOperand,
-        ValueNumber rightOperand
-      |
-        pointerArithmeticValueNumber(instr, irFunc, opcode, type, elementSize, leftOperand,
-          rightOperand) and
-        result =
-          TPointerArithmeticValueNumber(irFunc, opcode, type, elementSize, leftOperand, rightOperand)
-      )
-      or
-      // The value number of a copy is just the value number of its source value.
-      result = valueNumber(instr.(CongruentCopyInstruction).getSourceValue())
-    )
-  )
-}
+ValueNumber valueNumberOfOperand(Operand op) { result = tvalueNumberOfOperand(op) }

cpp/ql/src/semmle/code/cpp/ir/implementation/raw/gvn/internal/ValueNumberingImports.qll

@@ -1,2 +1,4 @@
+import semmle.code.cpp.ir.implementation.aliased_ssa.IR
 import semmle.code.cpp.ir.internal.Overlap
 import semmle.code.cpp.ir.internal.IRCppLanguage as Language
+import semmle.code.cpp.Location

cpp/ql/src/semmle/code/cpp/ir/implementation/raw/gvn/internal/ValueNumberingInternal.qll

@@ -1 +1,303 @@
-import semmle.code.cpp.ir.implementation.raw.IR as IR
+private import ValueNumberingImports
+private import cpp
+
+newtype TValueNumber =
+  TVariableAddressValueNumber(IRFunction irFunc, IRVariable var) {
+    variableAddressValueNumber(_, irFunc, var)
+  } or
+  TInitializeParameterValueNumber(IRFunction irFunc, IRVariable var) {
+    initializeParameterValueNumber(_, irFunc, var)
+  } or
+  TInitializeThisValueNumber(IRFunction irFunc) { initializeThisValueNumber(_, irFunc) } or
+  TConstantValueNumber(IRFunction irFunc, IRType type, string value) {
+    constantValueNumber(_, irFunc, type, value)
+  } or
+  TStringConstantValueNumber(IRFunction irFunc, IRType type, string value) {
+    stringConstantValueNumber(_, irFunc, type, value)
+  } or
+  TFieldAddressValueNumber(IRFunction irFunc, Field field, TValueNumber objectAddress) {
+    fieldAddressValueNumber(_, irFunc, field, objectAddress)
+  } or
+  TBinaryValueNumber(
+    IRFunction irFunc, Opcode opcode, IRType type, TValueNumber leftOperand,
+    TValueNumber rightOperand
+  ) {
+    binaryValueNumber(_, irFunc, opcode, type, leftOperand, rightOperand)
+  } or
+  TPointerArithmeticValueNumber(
+    IRFunction irFunc, Opcode opcode, IRType type, int elementSize, TValueNumber leftOperand,
+    TValueNumber rightOperand
+  ) {
+    pointerArithmeticValueNumber(_, irFunc, opcode, type, elementSize, leftOperand, rightOperand)
+  } or
+  TUnaryValueNumber(IRFunction irFunc, Opcode opcode, IRType type, TValueNumber operand) {
+    unaryValueNumber(_, irFunc, opcode, type, operand)
+  } or
+  TInheritanceConversionValueNumber(
+    IRFunction irFunc, Opcode opcode, Class baseClass, Class derivedClass, TValueNumber operand
+  ) {
+    inheritanceConversionValueNumber(_, irFunc, opcode, baseClass, derivedClass, operand)
+  } or
+  TLoadTotalOverlapValueNumber(
+    IRFunction irFunc, IRType type, TValueNumber memOperand, TValueNumber operand
+  ) {
+    loadTotalOverlapValueNumber(_, irFunc, type, memOperand, operand)
+  } or
+  TUniqueValueNumber(IRFunction irFunc, Instruction instr) { uniqueValueNumber(instr, irFunc) }
+
+/**
+ * A `CopyInstruction` whose source operand's value is congruent to the definition of that source
+ * operand.
+ * For example:
+ * ```
+ * Point p = { 1, 2 };
+ * Point q = p;
+ * int a = p.x;
+ * ```
+ * The use of `p` on line 2 is linked to the definition of `p` on line 1, and is congruent to that
+ * definition because it accesses the exact same memory.
+ * The use of `p.x` on line 3 is linked to the definition of `p` on line 1 as well, but is not
+ * congruent to that definition because `p.x` accesses only a subset of the memory defined by `p`.
+ */
+class CongruentCopyInstruction extends CopyInstruction {
+  CongruentCopyInstruction() {
+    this.getSourceValueOperand().getDefinitionOverlap() instanceof MustExactlyOverlap
+  }
+}
+
+class LoadTotalOverlapInstruction extends LoadInstruction {
+  LoadTotalOverlapInstruction() {
+    this.getSourceValueOperand().getDefinitionOverlap() instanceof MustTotallyOverlap
+  }
+}
+
+/**
+ * Holds if this library knows how to assign a value number to the specified instruction, other than
+ * a `unique` value number that is never shared by multiple instructions.
+ */
+private predicate numberableInstruction(Instruction instr) {
+  instr instanceof VariableAddressInstruction
+  or
+  instr instanceof InitializeParameterInstruction
+  or
+  instr instanceof InitializeThisInstruction
+  or
+  instr instanceof ConstantInstruction
+  or
+  instr instanceof StringConstantInstruction
+  or
+  instr instanceof FieldAddressInstruction
+  or
+  instr instanceof BinaryInstruction
+  or
+  instr instanceof UnaryInstruction and not instr instanceof CopyInstruction
+  or
+  instr instanceof PointerArithmeticInstruction
+  or
+  instr instanceof CongruentCopyInstruction
+  or
+  instr instanceof LoadTotalOverlapInstruction
+}
+
+private predicate variableAddressValueNumber(
+  VariableAddressInstruction instr, IRFunction irFunc, IRVariable var
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  instr.getIRVariable() = var
+}
+
+private predicate initializeParameterValueNumber(
+  InitializeParameterInstruction instr, IRFunction irFunc, IRVariable var
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  instr.getIRVariable() = var
+}
+
+private predicate initializeThisValueNumber(InitializeThisInstruction instr, IRFunction irFunc) {
+  instr.getEnclosingIRFunction() = irFunc
+}
+
+private predicate constantValueNumber(
+  ConstantInstruction instr, IRFunction irFunc, IRType type, string value
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  instr.getResultIRType() = type and
+  instr.getValue() = value
+}
+
+private predicate stringConstantValueNumber(
+  StringConstantInstruction instr, IRFunction irFunc, IRType type, string value
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  instr.getResultIRType() = type and
+  instr.getValue().getValue() = value
+}
+
+private predicate fieldAddressValueNumber(
+  FieldAddressInstruction instr, IRFunction irFunc, Language::Field field,
+  TValueNumber objectAddress
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  instr.getField() = field and
+  tvalueNumber(instr.getObjectAddress()) = objectAddress
+}
+
+private predicate binaryValueNumber(
+  BinaryInstruction instr, IRFunction irFunc, Opcode opcode, IRType type, TValueNumber leftOperand,
+  TValueNumber rightOperand
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  not instr instanceof PointerArithmeticInstruction and
+  instr.getOpcode() = opcode and
+  instr.getResultIRType() = type and
+  tvalueNumber(instr.getLeft()) = leftOperand and
+  tvalueNumber(instr.getRight()) = rightOperand
+}
+
+private predicate pointerArithmeticValueNumber(
+  PointerArithmeticInstruction instr, IRFunction irFunc, Opcode opcode, IRType type,
+  int elementSize, TValueNumber leftOperand, TValueNumber rightOperand
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  instr.getOpcode() = opcode and
+  instr.getResultIRType() = type and
+  instr.getElementSize() = elementSize and
+  tvalueNumber(instr.getLeft()) = leftOperand and
+  tvalueNumber(instr.getRight()) = rightOperand
+}
+
+private predicate unaryValueNumber(
+  UnaryInstruction instr, IRFunction irFunc, Opcode opcode, IRType type, TValueNumber operand
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  not instr instanceof InheritanceConversionInstruction and
+  not instr instanceof CopyInstruction and
+  not instr instanceof FieldAddressInstruction and
+  instr.getOpcode() = opcode and
+  instr.getResultIRType() = type and
+  tvalueNumber(instr.getUnary()) = operand
+}
+
+private predicate inheritanceConversionValueNumber(
+  InheritanceConversionInstruction instr, IRFunction irFunc, Opcode opcode,
+  Language::Class baseClass, Language::Class derivedClass, TValueNumber operand
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  instr.getOpcode() = opcode and
+  instr.getBaseClass() = baseClass and
+  instr.getDerivedClass() = derivedClass and
+  tvalueNumber(instr.getUnary()) = operand
+}
+
+private predicate loadTotalOverlapValueNumber(
+  LoadTotalOverlapInstruction instr, IRFunction irFunc, IRType type, TValueNumber memOperand,
+  TValueNumber operand
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  instr.getResultIRType() = type and
+  tvalueNumber(instr.getAnOperand().(MemoryOperand).getAnyDef()) = memOperand and
+  tvalueNumberOfOperand(instr.getAnOperand().(AddressOperand)) = operand
+}
+
+/**
+ * Holds if `instr` should be assigned a unique value number because this library does not know how
+ * to determine if two instances of that instruction are equivalent.
+ */
+private predicate uniqueValueNumber(Instruction instr, IRFunction irFunc) {
+  instr.getEnclosingIRFunction() = irFunc and
+  not instr.getResultIRType() instanceof IRVoidType and
+  not numberableInstruction(instr)
+}
+
+/**
+ * Gets the value number assigned to `instr`, if any. Returns at most one result.
+ */
+cached
+TValueNumber tvalueNumber(Instruction instr) {
+  result = nonUniqueValueNumber(instr)
+  or
+  exists(IRFunction irFunc |
+    uniqueValueNumber(instr, irFunc) and
+    result = TUniqueValueNumber(irFunc, instr)
+  )
+}
+
+/**
+ * Gets the value number assigned to the exact definition of `op`, if any.
+ * Returns at most one result.
+ */
+TValueNumber tvalueNumberOfOperand(Operand op) { result = tvalueNumber(op.getDef()) }
+
+/**
+ * Gets the value number assigned to `instr`, if any, unless that instruction is assigned a unique
+ * value number.
+ */
+private TValueNumber nonUniqueValueNumber(Instruction instr) {
+  exists(IRFunction irFunc |
+    irFunc = instr.getEnclosingIRFunction() and
+    (
+      exists(IRVariable var |
+        variableAddressValueNumber(instr, irFunc, var) and
+        result = TVariableAddressValueNumber(irFunc, var)
+      )
+      or
+      exists(IRVariable var |
+        initializeParameterValueNumber(instr, irFunc, var) and
+        result = TInitializeParameterValueNumber(irFunc, var)
+      )
+      or
+      initializeThisValueNumber(instr, irFunc) and
+      result = TInitializeThisValueNumber(irFunc)
+      or
+      exists(IRType type, string value |
+        constantValueNumber(instr, irFunc, type, value) and
+        result = TConstantValueNumber(irFunc, type, value)
+      )
+      or
+      exists(IRType type, string value |
+        stringConstantValueNumber(instr, irFunc, type, value) and
+        result = TStringConstantValueNumber(irFunc, type, value)
+      )
+      or
+      exists(Language::Field field, TValueNumber objectAddress |
+        fieldAddressValueNumber(instr, irFunc, field, objectAddress) and
+        result = TFieldAddressValueNumber(irFunc, field, objectAddress)
+      )
+      or
+      exists(Opcode opcode, IRType type, TValueNumber leftOperand, TValueNumber rightOperand |
+        binaryValueNumber(instr, irFunc, opcode, type, leftOperand, rightOperand) and
+        result = TBinaryValueNumber(irFunc, opcode, type, leftOperand, rightOperand)
+      )
+      or
+      exists(Opcode opcode, IRType type, TValueNumber operand |
+        unaryValueNumber(instr, irFunc, opcode, type, operand) and
+        result = TUnaryValueNumber(irFunc, opcode, type, operand)
+      )
+      or
+      exists(
+        Opcode opcode, Language::Class baseClass, Language::Class derivedClass, TValueNumber operand
+      |
+        inheritanceConversionValueNumber(instr, irFunc, opcode, baseClass, derivedClass, operand) and
+        result = TInheritanceConversionValueNumber(irFunc, opcode, baseClass, derivedClass, operand)
+      )
+      or
+      exists(
+        Opcode opcode, IRType type, int elementSize, TValueNumber leftOperand,
+        TValueNumber rightOperand
+      |
+        pointerArithmeticValueNumber(instr, irFunc, opcode, type, elementSize, leftOperand,
+          rightOperand) and
+        result =
+          TPointerArithmeticValueNumber(irFunc, opcode, type, elementSize, leftOperand, rightOperand)
+      )
+      or
+      exists(IRType type, TValueNumber memOperand, TValueNumber operand |
+        loadTotalOverlapValueNumber(instr, irFunc, type, memOperand, operand) and
+        result = TLoadTotalOverlapValueNumber(irFunc, type, memOperand, operand)
+      )
+      or
+      // The value number of a copy is just the value number of its source value.
+      result = tvalueNumber(instr.(CongruentCopyInstruction).getSourceValue())
+    )
+  )
+}

cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/ValueNumbering.qll

@@ -1,6 +1,5 @@
 private import internal.ValueNumberingInternal
 private import internal.ValueNumberingImports
-private import IR
 
 /**
  * Provides additional information about value numbering in IR dumps.
@@ -10,57 +9,38 @@ class ValueNumberPropertyProvider extends IRPropertyProvider {
     exists(ValueNumber vn |
       vn = valueNumber(instr) and
       key = "valnum" and
-      if strictcount(vn.getAnInstruction()) > 1 then result = vn.toString() else result = "unique"
+      if strictcount(vn.getAnInstruction()) > 1
+      then result = vn.getDebugString()
+      else result = "unique"
     )
   }
 }
 
-newtype TValueNumber =
-  TVariableAddressValueNumber(IRFunction irFunc, IRVariable var) {
-    variableAddressValueNumber(_, irFunc, var)
-  } or
-  TInitializeParameterValueNumber(IRFunction irFunc, IRVariable var) {
-    initializeParameterValueNumber(_, irFunc, var)
-  } or
-  TInitializeThisValueNumber(IRFunction irFunc) { initializeThisValueNumber(_, irFunc) } or
-  TConstantValueNumber(IRFunction irFunc, IRType type, string value) {
-    constantValueNumber(_, irFunc, type, value)
-  } or
-  TStringConstantValueNumber(IRFunction irFunc, IRType type, string value) {
-    stringConstantValueNumber(_, irFunc, type, value)
-  } or
-  TFieldAddressValueNumber(IRFunction irFunc, Language::Field field, ValueNumber objectAddress) {
-    fieldAddressValueNumber(_, irFunc, field, objectAddress)
-  } or
-  TBinaryValueNumber(
-    IRFunction irFunc, Opcode opcode, IRType type, ValueNumber leftOperand, ValueNumber rightOperand
-  ) {
-    binaryValueNumber(_, irFunc, opcode, type, leftOperand, rightOperand)
-  } or
-  TPointerArithmeticValueNumber(
-    IRFunction irFunc, Opcode opcode, IRType type, int elementSize, ValueNumber leftOperand,
-    ValueNumber rightOperand
-  ) {
-    pointerArithmeticValueNumber(_, irFunc, opcode, type, elementSize, leftOperand, rightOperand)
-  } or
-  TUnaryValueNumber(IRFunction irFunc, Opcode opcode, IRType type, ValueNumber operand) {
-    unaryValueNumber(_, irFunc, opcode, type, operand)
-  } or
-  TInheritanceConversionValueNumber(
-    IRFunction irFunc, Opcode opcode, Language::Class baseClass, Language::Class derivedClass,
-    ValueNumber operand
-  ) {
-    inheritanceConversionValueNumber(_, irFunc, opcode, baseClass, derivedClass, operand)
-  } or
-  TUniqueValueNumber(IRFunction irFunc, Instruction instr) { uniqueValueNumber(instr, irFunc) }
-
 /**
  * The value number assigned to a particular set of instructions that produce equivalent results.
  */
 class ValueNumber extends TValueNumber {
-  final string toString() { result = getExampleInstruction().getResultId() }
+  final string toString() { result = "GVN" }
 
-  final Language::Location getLocation() { result = getExampleInstruction().getLocation() }
+  final string getDebugString() { result = strictconcat(getAnInstruction().getResultId(), ", ") }
+
+  final Language::Location getLocation() {
+    if
+      exists(Instruction i |
+        i = getAnInstruction() and not i.getLocation() instanceof UnknownLocation
+      )
+    then
+      result =
+        min(Language::Location l |
+          l = getAnInstruction().getLocation() and not l instanceof UnknownLocation
+        |
+          l
+          order by
+            l.getFile().getAbsolutePath(), l.getStartLine(), l.getStartColumn(), l.getEndLine(),
+            l.getEndColumn()
+        )
+    else result instanceof UnknownDefaultLocation
+  }
 
   /**
    * Gets the instructions that have been assigned this value number. This will always produce at
@@ -85,236 +65,39 @@ class ValueNumber extends TValueNumber {
    * Gets an `Operand` whose definition is exact and has this value number.
    */
   final Operand getAUse() { this = valueNumber(result.getDef()) }
-}
 
-/**
- * A `CopyInstruction` whose source operand's value is congruent to the definition of that source
- * operand.
- * For example:
- * ```
- * Point p = { 1, 2 };
- * Point q = p;
- * int a = p.x;
- * ```
- * The use of `p` on line 2 is linked to the definition of `p` on line 1, and is congruent to that
- * definition because it accesses the exact same memory.
- * The use of `p.x` on line 3 is linked to the definition of `p` on line 1 as well, but is not
- * congruent to that definition because `p.x` accesses only a subset of the memory defined by `p`.
- */
-private class CongruentCopyInstruction extends CopyInstruction {
-  CongruentCopyInstruction() {
-    this.getSourceValueOperand().getDefinitionOverlap() instanceof MustExactlyOverlap
+  final string getKind() {
+    this instanceof TVariableAddressValueNumber and result = "VariableAddress"
+    or
+    this instanceof TInitializeParameterValueNumber and result = "InitializeParameter"
+    or
+    this instanceof TInitializeThisValueNumber and result = "InitializeThis"
+    or
+    this instanceof TStringConstantValueNumber and result = "StringConstant"
+    or
+    this instanceof TFieldAddressValueNumber and result = "FieldAddress"
+    or
+    this instanceof TBinaryValueNumber and result = "Binary"
+    or
+    this instanceof TPointerArithmeticValueNumber and result = "PointerArithmetic"
+    or
+    this instanceof TUnaryValueNumber and result = "Unary"
+    or
+    this instanceof TInheritanceConversionValueNumber and result = "InheritanceConversion"
+    or
+    this instanceof TLoadTotalOverlapValueNumber and result = "LoadTotalOverlap"
+    or
+    this instanceof TUniqueValueNumber and result = "Unique"
   }
 }
 
-/**
- * Holds if this library knows how to assign a value number to the specified instruction, other than
- * a `unique` value number that is never shared by multiple instructions.
- */
-private predicate numberableInstruction(Instruction instr) {
-  instr instanceof VariableAddressInstruction
-  or
-  instr instanceof InitializeParameterInstruction
-  or
-  instr instanceof InitializeThisInstruction
-  or
-  instr instanceof ConstantInstruction
-  or
-  instr instanceof StringConstantInstruction
-  or
-  instr instanceof FieldAddressInstruction
-  or
-  instr instanceof BinaryInstruction
-  or
-  instr instanceof UnaryInstruction and not instr instanceof CopyInstruction
-  or
-  instr instanceof PointerArithmeticInstruction
-  or
-  instr instanceof CongruentCopyInstruction
-}
-
-private predicate variableAddressValueNumber(
-  VariableAddressInstruction instr, IRFunction irFunc, IRVariable var
-) {
-  instr.getEnclosingIRFunction() = irFunc and
-  instr.getIRVariable() = var
-}
-
-private predicate initializeParameterValueNumber(
-  InitializeParameterInstruction instr, IRFunction irFunc, IRVariable var
-) {
-  instr.getEnclosingIRFunction() = irFunc and
-  instr.getIRVariable() = var
-}
-
-private predicate initializeThisValueNumber(InitializeThisInstruction instr, IRFunction irFunc) {
-  instr.getEnclosingIRFunction() = irFunc
-}
-
-private predicate constantValueNumber(
-  ConstantInstruction instr, IRFunction irFunc, IRType type, string value
-) {
-  instr.getEnclosingIRFunction() = irFunc and
-  instr.getResultIRType() = type and
-  instr.getValue() = value
-}
-
-private predicate stringConstantValueNumber(
-  StringConstantInstruction instr, IRFunction irFunc, IRType type, string value
-) {
-  instr.getEnclosingIRFunction() = irFunc and
-  instr.getResultIRType() = type and
-  instr.getValue().getValue() = value
-}
-
-private predicate fieldAddressValueNumber(
-  FieldAddressInstruction instr, IRFunction irFunc, Language::Field field, ValueNumber objectAddress
-) {
-  instr.getEnclosingIRFunction() = irFunc and
-  instr.getField() = field and
-  valueNumber(instr.getObjectAddress()) = objectAddress
-}
-
-private predicate binaryValueNumber(
-  BinaryInstruction instr, IRFunction irFunc, Opcode opcode, IRType type, ValueNumber leftOperand,
-  ValueNumber rightOperand
-) {
-  instr.getEnclosingIRFunction() = irFunc and
-  not instr instanceof PointerArithmeticInstruction and
-  instr.getOpcode() = opcode and
-  instr.getResultIRType() = type and
-  valueNumber(instr.getLeft()) = leftOperand and
-  valueNumber(instr.getRight()) = rightOperand
-}
-
-private predicate pointerArithmeticValueNumber(
-  PointerArithmeticInstruction instr, IRFunction irFunc, Opcode opcode, IRType type,
-  int elementSize, ValueNumber leftOperand, ValueNumber rightOperand
-) {
-  instr.getEnclosingIRFunction() = irFunc and
-  instr.getOpcode() = opcode and
-  instr.getResultIRType() = type and
-  instr.getElementSize() = elementSize and
-  valueNumber(instr.getLeft()) = leftOperand and
-  valueNumber(instr.getRight()) = rightOperand
-}
-
-private predicate unaryValueNumber(
-  UnaryInstruction instr, IRFunction irFunc, Opcode opcode, IRType type, ValueNumber operand
-) {
-  instr.getEnclosingIRFunction() = irFunc and
-  not instr instanceof InheritanceConversionInstruction and
-  not instr instanceof CopyInstruction and
-  instr.getOpcode() = opcode and
-  instr.getResultIRType() = type and
-  valueNumber(instr.getUnary()) = operand
-}
-
-private predicate inheritanceConversionValueNumber(
-  InheritanceConversionInstruction instr, IRFunction irFunc, Opcode opcode,
-  Language::Class baseClass, Language::Class derivedClass, ValueNumber operand
-) {
-  instr.getEnclosingIRFunction() = irFunc and
-  instr.getOpcode() = opcode and
-  instr.getBaseClass() = baseClass and
-  instr.getDerivedClass() = derivedClass and
-  valueNumber(instr.getUnary()) = operand
-}
-
-/**
- * Holds if `instr` should be assigned a unique value number because this library does not know how
- * to determine if two instances of that instruction are equivalent.
- */
-private predicate uniqueValueNumber(Instruction instr, IRFunction irFunc) {
-  instr.getEnclosingIRFunction() = irFunc and
-  not instr.getResultIRType() instanceof IRVoidType and
-  not numberableInstruction(instr)
-}
-
 /**
  * Gets the value number assigned to `instr`, if any. Returns at most one result.
  */
-cached
-ValueNumber valueNumber(Instruction instr) {
-  result = nonUniqueValueNumber(instr)
-  or
-  exists(IRFunction irFunc |
-    uniqueValueNumber(instr, irFunc) and
-    result = TUniqueValueNumber(irFunc, instr)
-  )
-}
+ValueNumber valueNumber(Instruction instr) { result = tvalueNumber(instr) }
 
 /**
  * Gets the value number assigned to the exact definition of `op`, if any.
  * Returns at most one result.
  */
-ValueNumber valueNumberOfOperand(Operand op) { result = valueNumber(op.getDef()) }
-
-/**
- * Gets the value number assigned to `instr`, if any, unless that instruction is assigned a unique
- * value number.
- */
-private ValueNumber nonUniqueValueNumber(Instruction instr) {
-  exists(IRFunction irFunc |
-    irFunc = instr.getEnclosingIRFunction() and
-    (
-      exists(IRVariable var |
-        variableAddressValueNumber(instr, irFunc, var) and
-        result = TVariableAddressValueNumber(irFunc, var)
-      )
-      or
-      exists(IRVariable var |
-        initializeParameterValueNumber(instr, irFunc, var) and
-        result = TInitializeParameterValueNumber(irFunc, var)
-      )
-      or
-      initializeThisValueNumber(instr, irFunc) and
-      result = TInitializeThisValueNumber(irFunc)
-      or
-      exists(IRType type, string value |
-        constantValueNumber(instr, irFunc, type, value) and
-        result = TConstantValueNumber(irFunc, type, value)
-      )
-      or
-      exists(IRType type, string value |
-        stringConstantValueNumber(instr, irFunc, type, value) and
-        result = TStringConstantValueNumber(irFunc, type, value)
-      )
-      or
-      exists(Language::Field field, ValueNumber objectAddress |
-        fieldAddressValueNumber(instr, irFunc, field, objectAddress) and
-        result = TFieldAddressValueNumber(irFunc, field, objectAddress)
-      )
-      or
-      exists(Opcode opcode, IRType type, ValueNumber leftOperand, ValueNumber rightOperand |
-        binaryValueNumber(instr, irFunc, opcode, type, leftOperand, rightOperand) and
-        result = TBinaryValueNumber(irFunc, opcode, type, leftOperand, rightOperand)
-      )
-      or
-      exists(Opcode opcode, IRType type, ValueNumber operand |
-        unaryValueNumber(instr, irFunc, opcode, type, operand) and
-        result = TUnaryValueNumber(irFunc, opcode, type, operand)
-      )
-      or
-      exists(
-        Opcode opcode, Language::Class baseClass, Language::Class derivedClass, ValueNumber operand
-      |
-        inheritanceConversionValueNumber(instr, irFunc, opcode, baseClass, derivedClass, operand) and
-        result = TInheritanceConversionValueNumber(irFunc, opcode, baseClass, derivedClass, operand)
-      )
-      or
-      exists(
-        Opcode opcode, IRType type, int elementSize, ValueNumber leftOperand,
-        ValueNumber rightOperand
-      |
-        pointerArithmeticValueNumber(instr, irFunc, opcode, type, elementSize, leftOperand,
-          rightOperand) and
-        result =
-          TPointerArithmeticValueNumber(irFunc, opcode, type, elementSize, leftOperand, rightOperand)
-      )
-      or
-      // The value number of a copy is just the value number of its source value.
-      result = valueNumber(instr.(CongruentCopyInstruction).getSourceValue())
-    )
-  )
-}
+ValueNumber valueNumberOfOperand(Operand op) { result = tvalueNumberOfOperand(op) }

cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/internal/ValueNumberingImports.qll

@@ -1,2 +1,4 @@
+import semmle.code.cpp.ir.implementation.aliased_ssa.IR
 import semmle.code.cpp.ir.internal.Overlap
 import semmle.code.cpp.ir.internal.IRCppLanguage as Language
+import semmle.code.cpp.Location

cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/internal/ValueNumberingInternal.qll

@@ -1 +1,303 @@
-import semmle.code.cpp.ir.implementation.unaliased_ssa.IR as IR
+private import ValueNumberingImports
+private import cpp
+
+newtype TValueNumber =
+  TVariableAddressValueNumber(IRFunction irFunc, IRVariable var) {
+    variableAddressValueNumber(_, irFunc, var)
+  } or
+  TInitializeParameterValueNumber(IRFunction irFunc, IRVariable var) {
+    initializeParameterValueNumber(_, irFunc, var)
+  } or
+  TInitializeThisValueNumber(IRFunction irFunc) { initializeThisValueNumber(_, irFunc) } or
+  TConstantValueNumber(IRFunction irFunc, IRType type, string value) {
+    constantValueNumber(_, irFunc, type, value)
+  } or
+  TStringConstantValueNumber(IRFunction irFunc, IRType type, string value) {
+    stringConstantValueNumber(_, irFunc, type, value)
+  } or
+  TFieldAddressValueNumber(IRFunction irFunc, Field field, TValueNumber objectAddress) {
+    fieldAddressValueNumber(_, irFunc, field, objectAddress)
+  } or
+  TBinaryValueNumber(
+    IRFunction irFunc, Opcode opcode, IRType type, TValueNumber leftOperand,
+    TValueNumber rightOperand
+  ) {
+    binaryValueNumber(_, irFunc, opcode, type, leftOperand, rightOperand)
+  } or
+  TPointerArithmeticValueNumber(
+    IRFunction irFunc, Opcode opcode, IRType type, int elementSize, TValueNumber leftOperand,
+    TValueNumber rightOperand
+  ) {
+    pointerArithmeticValueNumber(_, irFunc, opcode, type, elementSize, leftOperand, rightOperand)
+  } or
+  TUnaryValueNumber(IRFunction irFunc, Opcode opcode, IRType type, TValueNumber operand) {
+    unaryValueNumber(_, irFunc, opcode, type, operand)
+  } or
+  TInheritanceConversionValueNumber(
+    IRFunction irFunc, Opcode opcode, Class baseClass, Class derivedClass, TValueNumber operand
+  ) {
+    inheritanceConversionValueNumber(_, irFunc, opcode, baseClass, derivedClass, operand)
+  } or
+  TLoadTotalOverlapValueNumber(
+    IRFunction irFunc, IRType type, TValueNumber memOperand, TValueNumber operand
+  ) {
+    loadTotalOverlapValueNumber(_, irFunc, type, memOperand, operand)
+  } or
+  TUniqueValueNumber(IRFunction irFunc, Instruction instr) { uniqueValueNumber(instr, irFunc) }
+
+/**
+ * A `CopyInstruction` whose source operand's value is congruent to the definition of that source
+ * operand.
+ * For example:
+ * ```
+ * Point p = { 1, 2 };
+ * Point q = p;
+ * int a = p.x;
+ * ```
+ * The use of `p` on line 2 is linked to the definition of `p` on line 1, and is congruent to that
+ * definition because it accesses the exact same memory.
+ * The use of `p.x` on line 3 is linked to the definition of `p` on line 1 as well, but is not
+ * congruent to that definition because `p.x` accesses only a subset of the memory defined by `p`.
+ */
+class CongruentCopyInstruction extends CopyInstruction {
+  CongruentCopyInstruction() {
+    this.getSourceValueOperand().getDefinitionOverlap() instanceof MustExactlyOverlap
+  }
+}
+
+class LoadTotalOverlapInstruction extends LoadInstruction {
+  LoadTotalOverlapInstruction() {
+    this.getSourceValueOperand().getDefinitionOverlap() instanceof MustTotallyOverlap
+  }
+}
+
+/**
+ * Holds if this library knows how to assign a value number to the specified instruction, other than
+ * a `unique` value number that is never shared by multiple instructions.
+ */
+private predicate numberableInstruction(Instruction instr) {
+  instr instanceof VariableAddressInstruction
+  or
+  instr instanceof InitializeParameterInstruction
+  or
+  instr instanceof InitializeThisInstruction
+  or
+  instr instanceof ConstantInstruction
+  or
+  instr instanceof StringConstantInstruction
+  or
+  instr instanceof FieldAddressInstruction
+  or
+  instr instanceof BinaryInstruction
+  or
+  instr instanceof UnaryInstruction and not instr instanceof CopyInstruction
+  or
+  instr instanceof PointerArithmeticInstruction
+  or
+  instr instanceof CongruentCopyInstruction
+  or
+  instr instanceof LoadTotalOverlapInstruction
+}
+
+private predicate variableAddressValueNumber(
+  VariableAddressInstruction instr, IRFunction irFunc, IRVariable var
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  instr.getIRVariable() = var
+}
+
+private predicate initializeParameterValueNumber(
+  InitializeParameterInstruction instr, IRFunction irFunc, IRVariable var
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  instr.getIRVariable() = var
+}
+
+private predicate initializeThisValueNumber(InitializeThisInstruction instr, IRFunction irFunc) {
+  instr.getEnclosingIRFunction() = irFunc
+}
+
+private predicate constantValueNumber(
+  ConstantInstruction instr, IRFunction irFunc, IRType type, string value
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  instr.getResultIRType() = type and
+  instr.getValue() = value
+}
+
+private predicate stringConstantValueNumber(
+  StringConstantInstruction instr, IRFunction irFunc, IRType type, string value
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  instr.getResultIRType() = type and
+  instr.getValue().getValue() = value
+}
+
+private predicate fieldAddressValueNumber(
+  FieldAddressInstruction instr, IRFunction irFunc, Language::Field field,
+  TValueNumber objectAddress
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  instr.getField() = field and
+  tvalueNumber(instr.getObjectAddress()) = objectAddress
+}
+
+private predicate binaryValueNumber(
+  BinaryInstruction instr, IRFunction irFunc, Opcode opcode, IRType type, TValueNumber leftOperand,
+  TValueNumber rightOperand
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  not instr instanceof PointerArithmeticInstruction and
+  instr.getOpcode() = opcode and
+  instr.getResultIRType() = type and
+  tvalueNumber(instr.getLeft()) = leftOperand and
+  tvalueNumber(instr.getRight()) = rightOperand
+}
+
+private predicate pointerArithmeticValueNumber(
+  PointerArithmeticInstruction instr, IRFunction irFunc, Opcode opcode, IRType type,
+  int elementSize, TValueNumber leftOperand, TValueNumber rightOperand
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  instr.getOpcode() = opcode and
+  instr.getResultIRType() = type and
+  instr.getElementSize() = elementSize and
+  tvalueNumber(instr.getLeft()) = leftOperand and
+  tvalueNumber(instr.getRight()) = rightOperand
+}
+
+private predicate unaryValueNumber(
+  UnaryInstruction instr, IRFunction irFunc, Opcode opcode, IRType type, TValueNumber operand
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  not instr instanceof InheritanceConversionInstruction and
+  not instr instanceof CopyInstruction and
+  not instr instanceof FieldAddressInstruction and
+  instr.getOpcode() = opcode and
+  instr.getResultIRType() = type and
+  tvalueNumber(instr.getUnary()) = operand
+}
+
+private predicate inheritanceConversionValueNumber(
+  InheritanceConversionInstruction instr, IRFunction irFunc, Opcode opcode,
+  Language::Class baseClass, Language::Class derivedClass, TValueNumber operand
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  instr.getOpcode() = opcode and
+  instr.getBaseClass() = baseClass and
+  instr.getDerivedClass() = derivedClass and
+  tvalueNumber(instr.getUnary()) = operand
+}
+
+private predicate loadTotalOverlapValueNumber(
+  LoadTotalOverlapInstruction instr, IRFunction irFunc, IRType type, TValueNumber memOperand,
+  TValueNumber operand
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  instr.getResultIRType() = type and
+  tvalueNumber(instr.getAnOperand().(MemoryOperand).getAnyDef()) = memOperand and
+  tvalueNumberOfOperand(instr.getAnOperand().(AddressOperand)) = operand
+}
+
+/**
+ * Holds if `instr` should be assigned a unique value number because this library does not know how
+ * to determine if two instances of that instruction are equivalent.
+ */
+private predicate uniqueValueNumber(Instruction instr, IRFunction irFunc) {
+  instr.getEnclosingIRFunction() = irFunc and
+  not instr.getResultIRType() instanceof IRVoidType and
+  not numberableInstruction(instr)
+}
+
+/**
+ * Gets the value number assigned to `instr`, if any. Returns at most one result.
+ */
+cached
+TValueNumber tvalueNumber(Instruction instr) {
+  result = nonUniqueValueNumber(instr)
+  or
+  exists(IRFunction irFunc |
+    uniqueValueNumber(instr, irFunc) and
+    result = TUniqueValueNumber(irFunc, instr)
+  )
+}
+
+/**
+ * Gets the value number assigned to the exact definition of `op`, if any.
+ * Returns at most one result.
+ */
+TValueNumber tvalueNumberOfOperand(Operand op) { result = tvalueNumber(op.getDef()) }
+
+/**
+ * Gets the value number assigned to `instr`, if any, unless that instruction is assigned a unique
+ * value number.
+ */
+private TValueNumber nonUniqueValueNumber(Instruction instr) {
+  exists(IRFunction irFunc |
+    irFunc = instr.getEnclosingIRFunction() and
+    (
+      exists(IRVariable var |
+        variableAddressValueNumber(instr, irFunc, var) and
+        result = TVariableAddressValueNumber(irFunc, var)
+      )
+      or
+      exists(IRVariable var |
+        initializeParameterValueNumber(instr, irFunc, var) and
+        result = TInitializeParameterValueNumber(irFunc, var)
+      )
+      or
+      initializeThisValueNumber(instr, irFunc) and
+      result = TInitializeThisValueNumber(irFunc)
+      or
+      exists(IRType type, string value |
+        constantValueNumber(instr, irFunc, type, value) and
+        result = TConstantValueNumber(irFunc, type, value)
+      )
+      or
+      exists(IRType type, string value |
+        stringConstantValueNumber(instr, irFunc, type, value) and
+        result = TStringConstantValueNumber(irFunc, type, value)
+      )
+      or
+      exists(Language::Field field, TValueNumber objectAddress |
+        fieldAddressValueNumber(instr, irFunc, field, objectAddress) and
+        result = TFieldAddressValueNumber(irFunc, field, objectAddress)
+      )
+      or
+      exists(Opcode opcode, IRType type, TValueNumber leftOperand, TValueNumber rightOperand |
+        binaryValueNumber(instr, irFunc, opcode, type, leftOperand, rightOperand) and
+        result = TBinaryValueNumber(irFunc, opcode, type, leftOperand, rightOperand)
+      )
+      or
+      exists(Opcode opcode, IRType type, TValueNumber operand |
+        unaryValueNumber(instr, irFunc, opcode, type, operand) and
+        result = TUnaryValueNumber(irFunc, opcode, type, operand)
+      )
+      or
+      exists(
+        Opcode opcode, Language::Class baseClass, Language::Class derivedClass, TValueNumber operand
+      |
+        inheritanceConversionValueNumber(instr, irFunc, opcode, baseClass, derivedClass, operand) and
+        result = TInheritanceConversionValueNumber(irFunc, opcode, baseClass, derivedClass, operand)
+      )
+      or
+      exists(
+        Opcode opcode, IRType type, int elementSize, TValueNumber leftOperand,
+        TValueNumber rightOperand
+      |
+        pointerArithmeticValueNumber(instr, irFunc, opcode, type, elementSize, leftOperand,
+          rightOperand) and
+        result =
+          TPointerArithmeticValueNumber(irFunc, opcode, type, elementSize, leftOperand, rightOperand)
+      )
+      or
+      exists(IRType type, TValueNumber memOperand, TValueNumber operand |
+        loadTotalOverlapValueNumber(instr, irFunc, type, memOperand, operand) and
+        result = TLoadTotalOverlapValueNumber(irFunc, type, memOperand, operand)
+      )
+      or
+      // The value number of a copy is just the value number of its source value.
+      result = tvalueNumber(instr.(CongruentCopyInstruction).getSourceValue())
+    )
+  )
+}

cpp/ql/src/semmle/code/cpp/ir/internal/ASTValueNumbering.qll

@@ -0,0 +1,114 @@
+/**
+ * Provides an implementation of Global Value Numbering.
+ * See https://en.wikipedia.org/wiki/Global_value_numbering
+ *
+ * The predicate `globalValueNumber` converts an expression into a `GVN`,
+ * which is an abstract type representing the value of the expression. If
+ * two expressions have the same `GVN` then they compute the same value.
+ * For example:
+ *
+ * ```
+ * void f(int x, int y) {
+ *   g(x+y, x+y);
+ * }
+ * ```
+ *
+ * In this example, both arguments in the call to `g` compute the same value,
+ * so both arguments have the same `GVN`. In other words, we can find
+ * this call with the following query:
+ *
+ * ```
+ * from FunctionCall call, GVN v
+ * where v = globalValueNumber(call.getArgument(0))
+ *   and v = globalValueNumber(call.getArgument(1))
+ * select call
+ * ```
+ *
+ * The analysis is conservative, so two expressions might have different
+ * `GVN`s even though the actually always compute the same value. The most
+ * common reason for this is that the analysis cannot prove that there
+ * are no side-effects that might cause the computed value to change.
+ */
+
+import cpp
+private import semmle.code.cpp.ir.implementation.aliased_ssa.gvn.internal.ValueNumberingInternal
+private import semmle.code.cpp.ir.IR
+
+/**
+ * A Global Value Number. A GVN is an abstract representation of the value
+ * computed by an expression. The relationship between `Expr` and `GVN` is
+ * many-to-one: every `Expr` has exactly one `GVN`, but multiple
+ * expressions can have the same `GVN`. If two expressions have the same
+ * `GVN`, it means that they compute the same value at run time. The `GVN`
+ * is an opaque value, so you cannot deduce what the run-time value of an
+ * expression will be from its `GVN`. The only use for the `GVN` of an
+ * expression is to find other expressions that compute the same value.
+ * Use the predicate `globalValueNumber` to get the `GVN` for an `Expr`.
+ *
+ * Note: `GVN` has `toString` and `getLocation` methods, so that it can be
+ * displayed in a results list. These work by picking an arbitrary
+ * expression with this `GVN` and using its `toString` and `getLocation`
+ * methods.
+ */
+class GVN extends TValueNumber {
+  GVN() {
+    exists(Instruction instr |
+      this = tvalueNumber(instr) and exists(instr.getUnconvertedResultExpression())
+    )
+  }
+
+  private Instruction getAnInstruction() { this = tvalueNumber(result) }
+
+  final string toString() { result = "GVN" }
+
+  final string getDebugString() { result = strictconcat(getAnExpr().toString(), ", ") }
+
+  final Location getLocation() {
+    if exists(Expr e | e = getAnExpr() and not e.getLocation() instanceof UnknownLocation)
+    then
+      result =
+        min(Location l |
+          l = getAnExpr().getLocation() and not l instanceof UnknownLocation
+        |
+          l
+          order by
+            l.getFile().getAbsolutePath(), l.getStartLine(), l.getStartColumn(), l.getEndLine(),
+            l.getEndColumn()
+        )
+    else result instanceof UnknownDefaultLocation
+  }
+
+  final string getKind() {
+    this instanceof TVariableAddressValueNumber and result = "VariableAddress"
+    or
+    this instanceof TInitializeParameterValueNumber and result = "InitializeParameter"
+    or
+    this instanceof TInitializeThisValueNumber and result = "InitializeThis"
+    or
+    this instanceof TStringConstantValueNumber and result = "StringConstant"
+    or
+    this instanceof TFieldAddressValueNumber and result = "FieldAddress"
+    or
+    this instanceof TBinaryValueNumber and result = "Binary"
+    or
+    this instanceof TPointerArithmeticValueNumber and result = "PointerArithmetic"
+    or
+    this instanceof TUnaryValueNumber and result = "Unary"
+    or
+    this instanceof TInheritanceConversionValueNumber and result = "InheritanceConversion"
+    or
+    this instanceof TUniqueValueNumber and result = "Unique"
+  }
+
+  /** Gets an expression that has this GVN. */
+  Expr getAnExpr() { result = getAnUnconvertedExpr() }
+
+  /** Gets an expression that has this GVN. */
+  Expr getAnUnconvertedExpr() { result = getAnInstruction().getUnconvertedResultExpression() }
+
+  /** Gets an expression that has this GVN. */
+  Expr getAConvertedExpr() { result = getAnInstruction().getConvertedResultExpression() }
+}
+
+/** Gets the global value number of expression `e`. */
+GVN globalValueNumber(Expr e) { e = result.getAnExpr() }

cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/global.expected

@@ -0,0 +1,4 @@
+| globals.cpp:13:15:13:20 | call to getenv | globals.cpp:2:17:2:25 | sinkParam | global1 |
+| globals.cpp:13:15:13:20 | call to getenv | globals.cpp:12:10:12:16 | global1 | global1 |
+| globals.cpp:23:15:23:20 | call to getenv | globals.cpp:2:17:2:25 | sinkParam | global2 |
+| globals.cpp:23:15:23:20 | call to getenv | globals.cpp:19:10:19:16 | global2 | global2 |

cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/global.ql

@@ -0,0 +1,7 @@
+import semmle.code.cpp.ir.dataflow.DefaultTaintTracking
+
+from Expr source, Element tainted, string globalVar
+where
+  taintedIncludingGlobalVars(source, tainted, globalVar) and
+  globalVar != ""
+select source, tainted, globalVar

cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/globals.cpp

@@ -0,0 +1,24 @@
+char * getenv(const char *);
+void sink(char *sinkParam);
+
+void throughLocal() {
+    char * local = getenv("VAR");
+    sink(local); // flow
+}
+
+char * global1 = 0;
+
+void readWriteGlobal1() {
+    sink(global1); // flow
+    global1 = getenv("VAR");
+}
+
+static char * global2 = 0;
+
+void readGlobal2() {
+    sink(global2); // flow
+}
+
+void writeGlobal2() {
+    global2 = getenv("VAR");
+}

cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/tainted.expected

@@ -101,6 +101,14 @@
 | defaulttainttracking.cpp:88:18:88:23 | call to getenv | defaulttainttracking.cpp:88:18:88:23 | call to getenv |
 | defaulttainttracking.cpp:88:18:88:23 | call to getenv | defaulttainttracking.cpp:88:18:88:30 | (reference to) |
 | defaulttainttracking.cpp:88:18:88:23 | call to getenv | test_diff.cpp:1:11:1:20 | p#0 |
+| globals.cpp:5:20:5:25 | call to getenv | globals.cpp:2:17:2:25 | sinkParam |
+| globals.cpp:5:20:5:25 | call to getenv | globals.cpp:5:12:5:16 | local |
+| globals.cpp:5:20:5:25 | call to getenv | globals.cpp:5:20:5:25 | call to getenv |
+| globals.cpp:5:20:5:25 | call to getenv | globals.cpp:6:10:6:14 | local |
+| globals.cpp:13:15:13:20 | call to getenv | globals.cpp:9:8:9:14 | global1 |
+| globals.cpp:13:15:13:20 | call to getenv | globals.cpp:13:15:13:20 | call to getenv |
+| globals.cpp:23:15:23:20 | call to getenv | globals.cpp:16:15:16:21 | global2 |
+| globals.cpp:23:15:23:20 | call to getenv | globals.cpp:23:15:23:20 | call to getenv |
 | test_diff.cpp:92:10:92:13 | argv | defaulttainttracking.cpp:9:11:9:20 | p#0 |
 | test_diff.cpp:92:10:92:13 | argv | test_diff.cpp:1:11:1:20 | p#0 |
 | test_diff.cpp:92:10:92:13 | argv | test_diff.cpp:92:10:92:13 | argv |

cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/test_diff.expected

@@ -15,6 +15,8 @@
 | defaulttainttracking.cpp:88:18:88:23 | call to getenv | defaulttainttracking.cpp:88:8:88:32 | (reference dereference) | IR only |
 | defaulttainttracking.cpp:88:18:88:23 | call to getenv | defaulttainttracking.cpp:88:18:88:30 | (reference to) | IR only |
 | defaulttainttracking.cpp:88:18:88:23 | call to getenv | test_diff.cpp:1:11:1:20 | p#0 | IR only |
+| globals.cpp:13:15:13:20 | call to getenv | globals.cpp:13:5:13:11 | global1 | AST only |
+| globals.cpp:23:15:23:20 | call to getenv | globals.cpp:23:5:23:11 | global2 | AST only |
 | test_diff.cpp:104:12:104:15 | argv | test_diff.cpp:104:11:104:20 | (...) | IR only |
 | test_diff.cpp:108:10:108:13 | argv | test_diff.cpp:36:24:36:24 | p | AST only |
 | test_diff.cpp:111:10:111:13 | argv | defaulttainttracking.cpp:9:11:9:20 | p#0 | AST only |

cpp/ql/test/library-tests/dataflow/dataflow-tests/IRDataflowTestCommon.qll

@@ -36,9 +36,27 @@ class TestAllocationConfig extends DataFlow::Configuration {
     )
   }
 
+  override predicate isAdditionalFlowStep(DataFlow::Node n1, DataFlow::Node n2) {
+    exists(GlobalOrNamespaceVariable var | var.getName().matches("flowTestGlobal%") |
+      writesVariable(n1.asInstruction(), var) and
+      var = n2.asVariable()
+      or
+      readsVariable(n2.asInstruction(), var) and
+      var = n1.asVariable()
+    )
+  }
+
   override predicate isBarrier(DataFlow::Node barrier) {
     barrier.asExpr().(VariableAccess).getTarget().hasName("barrier")
   }
 
   override predicate isBarrierGuard(DataFlow::BarrierGuard bg) { bg instanceof TestBarrierGuard }
 }
+
+private predicate readsVariable(LoadInstruction load, Variable var) {
+  load.getSourceAddress().(VariableAddressInstruction).getASTVariable() = var
+}
+
+private predicate writesVariable(StoreInstruction store, Variable var) {
+  store.getDestinationAddress().(VariableAddressInstruction).getASTVariable() = var
+}

cpp/ql/test/library-tests/dataflow/dataflow-tests/globals.cpp

@@ -0,0 +1,24 @@
+int source();
+void sink(int);
+
+void throughLocal() {
+    int local = source();
+    sink(local); // flow
+}
+
+int flowTestGlobal1 = 0;
+
+void readWriteGlobal1() {
+    sink(flowTestGlobal1); // flow
+    flowTestGlobal1 = source();
+}
+
+static int flowTestGlobal2 = 0;
+
+void readGlobal2() {
+    sink(flowTestGlobal2); // flow
+}
+
+void writeGlobal2() {
+    flowTestGlobal2 = source();
+}

cpp/ql/test/library-tests/dataflow/dataflow-tests/test.expected

@@ -22,6 +22,7 @@
 | dispatch.cpp:36:16:36:25 | call to notSource2 | dispatch.cpp:10:37:10:42 | call to source |
 | dispatch.cpp:43:15:43:24 | call to notSource1 | dispatch.cpp:9:37:9:42 | call to source |
 | dispatch.cpp:44:15:44:24 | call to notSource2 | dispatch.cpp:10:37:10:42 | call to source |
+| globals.cpp:6:10:6:14 | local | globals.cpp:5:17:5:22 | call to source |
 | lambdas.cpp:14:3:14:6 | t | lambdas.cpp:8:10:8:15 | call to source |
 | lambdas.cpp:18:8:18:8 | call to operator() | lambdas.cpp:8:10:8:15 | call to source |
 | lambdas.cpp:21:3:21:6 | t | lambdas.cpp:8:10:8:15 | call to source |

cpp/ql/test/library-tests/dataflow/dataflow-tests/test_diff.expected

@@ -17,6 +17,8 @@
 | dispatch.cpp:107:17:107:22 | dispatch.cpp:96:8:96:8 | IR only |
 | dispatch.cpp:140:8:140:13 | dispatch.cpp:96:8:96:8 | IR only |
 | dispatch.cpp:144:8:144:13 | dispatch.cpp:96:8:96:8 | IR only |
+| globals.cpp:13:23:13:28 | globals.cpp:12:10:12:24 | IR only |
+| globals.cpp:23:23:23:28 | globals.cpp:19:10:19:24 | IR only |
 | lambdas.cpp:8:10:8:15 | lambdas.cpp:14:3:14:6 | AST only |
 | lambdas.cpp:8:10:8:15 | lambdas.cpp:18:8:18:8 | AST only |
 | lambdas.cpp:8:10:8:15 | lambdas.cpp:21:3:21:6 | AST only |

cpp/ql/test/library-tests/dataflow/dataflow-tests/test_ir.expected

@@ -35,6 +35,9 @@
 | dispatch.cpp:96:8:96:8 | x | dispatch.cpp:107:17:107:22 | call to source |
 | dispatch.cpp:96:8:96:8 | x | dispatch.cpp:140:8:140:13 | call to source |
 | dispatch.cpp:96:8:96:8 | x | dispatch.cpp:144:8:144:13 | call to source |
+| globals.cpp:6:10:6:14 | local | globals.cpp:5:17:5:22 | call to source |
+| globals.cpp:12:10:12:24 | flowTestGlobal1 | globals.cpp:13:23:13:28 | call to source |
+| globals.cpp:19:10:19:24 | flowTestGlobal2 | globals.cpp:23:23:23:28 | call to source |
 | lambdas.cpp:35:8:35:8 | a | lambdas.cpp:8:10:8:15 | call to source |
 | test.cpp:7:8:7:9 | t1 | test.cpp:6:12:6:17 | call to source |
 | test.cpp:9:8:9:9 | t1 | test.cpp:6:12:6:17 | call to source |

cpp/ql/test/library-tests/dataflow/security-taint/tainted_diff.expected

@@ -1,15 +1,8 @@
-| test.cpp:38:23:38:28 | call to getenv | test.cpp:40:6:40:33 | ! ... | IR only |
-| test.cpp:38:23:38:28 | call to getenv | test.cpp:40:7:40:12 | call to strcmp | IR only |
-| test.cpp:38:23:38:28 | call to getenv | test.cpp:40:7:40:33 | (bool)... | IR only |
 | test.cpp:49:23:49:28 | call to getenv | test.cpp:50:15:50:24 | envStr_ptr | AST only |
 | test.cpp:49:23:49:28 | call to getenv | test.cpp:50:28:50:40 | & ... | AST only |
 | test.cpp:49:23:49:28 | call to getenv | test.cpp:50:29:50:40 | envStrGlobal | AST only |
 | test.cpp:49:23:49:28 | call to getenv | test.cpp:52:2:52:12 | * ... | AST only |
 | test.cpp:49:23:49:28 | call to getenv | test.cpp:52:3:52:12 | envStr_ptr | AST only |
-| test.cpp:60:29:60:34 | call to getenv | test.cpp:64:10:64:14 | bytes | IR only |
-| test.cpp:60:29:60:34 | call to getenv | test.cpp:64:18:64:23 | call to strlen | IR only |
-| test.cpp:60:29:60:34 | call to getenv | test.cpp:64:18:64:37 | (int)... | IR only |
-| test.cpp:60:29:60:34 | call to getenv | test.cpp:64:18:64:37 | ... + ... | IR only |
 | test.cpp:68:28:68:33 | call to getenv | test.cpp:11:20:11:21 | s1 | AST only |
 | test.cpp:68:28:68:33 | call to getenv | test.cpp:67:7:67:13 | copying | AST only |
 | test.cpp:68:28:68:33 | call to getenv | test.cpp:69:10:69:13 | copy | AST only |

cpp/ql/test/library-tests/dataflow/security-taint/tainted_ir.expected

@@ -14,9 +14,6 @@
 | test.cpp:38:23:38:28 | call to getenv | test.cpp:38:14:38:19 | envStr |  |
 | test.cpp:38:23:38:28 | call to getenv | test.cpp:38:23:38:28 | call to getenv |  |
 | test.cpp:38:23:38:28 | call to getenv | test.cpp:38:23:38:40 | (const char *)... |  |
-| test.cpp:38:23:38:28 | call to getenv | test.cpp:40:6:40:33 | ! ... |  |
-| test.cpp:38:23:38:28 | call to getenv | test.cpp:40:7:40:12 | call to strcmp |  |
-| test.cpp:38:23:38:28 | call to getenv | test.cpp:40:7:40:33 | (bool)... |  |
 | test.cpp:38:23:38:28 | call to getenv | test.cpp:40:14:40:19 | envStr |  |
 | test.cpp:49:23:49:28 | call to getenv | test.cpp:8:24:8:25 | s1 |  |
 | test.cpp:49:23:49:28 | call to getenv | test.cpp:45:13:45:24 | envStrGlobal |  |
@@ -32,10 +29,6 @@
 | test.cpp:60:29:60:34 | call to getenv | test.cpp:60:18:60:25 | userName |  |
 | test.cpp:60:29:60:34 | call to getenv | test.cpp:60:29:60:34 | call to getenv |  |
 | test.cpp:60:29:60:34 | call to getenv | test.cpp:60:29:60:47 | (const char *)... |  |
-| test.cpp:60:29:60:34 | call to getenv | test.cpp:64:10:64:14 | bytes |  |
-| test.cpp:60:29:60:34 | call to getenv | test.cpp:64:18:64:23 | call to strlen |  |
-| test.cpp:60:29:60:34 | call to getenv | test.cpp:64:18:64:37 | (int)... |  |
-| test.cpp:60:29:60:34 | call to getenv | test.cpp:64:18:64:37 | ... + ... |  |
 | test.cpp:60:29:60:34 | call to getenv | test.cpp:64:25:64:32 | userName |  |
 | test.cpp:68:28:68:33 | call to getenv | test.cpp:11:36:11:37 | s2 |  |
 | test.cpp:68:28:68:33 | call to getenv | test.cpp:68:17:68:24 | userName |  |

cpp/ql/test/library-tests/valuenumbering/GlobalValueNumbering/GlobalValueNumbering.expected

@@ -30,3 +30,11 @@
 | test.cpp:105:11:105:12 | (Base *)... | 105:c11-c12 106:c14-c35 107:c11-c12 |
 | test.cpp:105:11:105:12 | pd | 105:c11-c12 106:c33-c34 |
 | test.cpp:105:15:105:15 | b | 105:c15-c15 107:c15-c15 109:c10-c10 |
+| test.cpp:125:11:125:12 | pa | 125:c11-c12 126:c11-c12 128:c3-c4 129:c11-c12 |
+| test.cpp:125:15:125:15 | x | 125:c15-c15 126:c15-c15 128:c7-c7 |
+| test.cpp:136:11:136:18 | global_a | 136:c11-c18 137:c11-c18 139:c3-c10 |
+| test.cpp:136:21:136:21 | x | 136:c21-c21 137:c21-c21 139:c13-c13 |
+| test.cpp:144:11:144:12 | pa | 144:c11-c12 145:c11-c12 147:c3-c4 149:c11-c12 |
+| test.cpp:145:15:145:15 | y | 145:c15-c15 147:c7-c7 |
+| test.cpp:153:11:153:18 | global_a | 153:c11-c18 154:c11-c18 156:c3-c10 |
+| test.cpp:153:21:153:21 | x | 153:c21-c21 154:c21-c21 |

cpp/ql/test/library-tests/valuenumbering/GlobalValueNumbering/diff_ir_expr.expected

@@ -0,0 +1,142 @@
+| test.cpp:5:3:5:13 | ... = ... | test.cpp:5:3:5:13 | ... = ... | AST only |
+| test.cpp:6:3:6:13 | ... = ... | test.cpp:6:3:6:13 | ... = ... | AST only |
+| test.cpp:7:3:7:7 | ... = ... | test.cpp:7:3:7:7 | ... = ... | AST only |
+| test.cpp:10:16:10:16 | 1 | test.cpp:10:16:10:16 | 1 | AST only |
+| test.cpp:16:3:16:24 | ... = ... | test.cpp:16:3:16:24 | ... = ... | AST only |
+| test.cpp:17:3:17:24 | ... = ... | test.cpp:17:3:17:24 | ... = ... | AST only |
+| test.cpp:18:3:18:7 | ... = ... | test.cpp:18:3:18:7 | ... = ... | AST only |
+| test.cpp:21:16:21:16 | 2 | test.cpp:21:16:21:16 | 2 | AST only |
+| test.cpp:29:3:29:3 | x | test.cpp:31:3:31:3 | x | IR only |
+| test.cpp:29:3:29:24 | ... = ... | test.cpp:29:3:29:24 | ... = ... | AST only |
+| test.cpp:30:3:30:17 | call to change_global02 | test.cpp:30:3:30:17 | call to change_global02 | AST only |
+| test.cpp:31:3:31:3 | x | test.cpp:29:3:29:3 | x | IR only |
+| test.cpp:31:3:31:24 | ... = ... | test.cpp:31:3:31:24 | ... = ... | AST only |
+| test.cpp:32:3:32:7 | ... = ... | test.cpp:32:3:32:7 | ... = ... | AST only |
+| test.cpp:35:16:35:16 | 3 | test.cpp:35:16:35:16 | 3 | AST only |
+| test.cpp:43:3:43:3 | x | test.cpp:45:3:45:3 | x | IR only |
+| test.cpp:43:3:43:24 | ... = ... | test.cpp:43:3:43:24 | ... = ... | AST only |
+| test.cpp:43:7:43:24 | ... + ... | test.cpp:45:7:45:24 | ... + ... | IR only |
+| test.cpp:43:7:43:24 | ... + ... | test.cpp:46:7:46:7 | x | IR only |
+| test.cpp:43:17:43:24 | global03 | test.cpp:45:17:45:24 | global03 | IR only |
+| test.cpp:44:3:44:5 | * ... | test.cpp:44:4:44:5 | p2 | IR only |
+| test.cpp:44:3:44:9 | ... = ... | test.cpp:44:3:44:9 | ... = ... | AST only |
+| test.cpp:44:4:44:5 | p2 | test.cpp:44:3:44:5 | * ... | IR only |
+| test.cpp:44:9:44:9 | 0 | test.cpp:51:25:51:25 | 0 | AST only |
+| test.cpp:44:9:44:9 | 0 | test.cpp:53:18:53:21 | (int)... | AST only |
+| test.cpp:44:9:44:9 | 0 | test.cpp:56:39:56:42 | (int)... | AST only |
+| test.cpp:44:9:44:9 | 0 | test.cpp:59:17:59:20 | (int)... | AST only |
+| test.cpp:44:9:44:9 | 0 | test.cpp:88:12:88:12 | 0 | AST only |
+| test.cpp:45:3:45:3 | x | test.cpp:43:3:43:3 | x | IR only |
+| test.cpp:45:3:45:24 | ... = ... | test.cpp:45:3:45:24 | ... = ... | AST only |
+| test.cpp:45:7:45:24 | ... + ... | test.cpp:43:7:43:24 | ... + ... | IR only |
+| test.cpp:45:17:45:24 | global03 | test.cpp:43:17:43:24 | global03 | IR only |
+| test.cpp:46:3:46:7 | ... = ... | test.cpp:46:3:46:7 | ... = ... | AST only |
+| test.cpp:46:7:46:7 | x | test.cpp:43:7:43:24 | ... + ... | IR only |
+| test.cpp:51:25:51:25 | 0 | test.cpp:44:9:44:9 | 0 | AST only |
+| test.cpp:51:25:51:25 | 0 | test.cpp:53:18:53:21 | (int)... | AST only |
+| test.cpp:51:25:51:25 | 0 | test.cpp:56:39:56:42 | (int)... | AST only |
+| test.cpp:51:25:51:25 | 0 | test.cpp:59:17:59:20 | (int)... | AST only |
+| test.cpp:51:25:51:25 | 0 | test.cpp:88:12:88:12 | 0 | AST only |
+| test.cpp:51:25:51:25 | (unsigned int)... | test.cpp:51:25:51:25 | (unsigned int)... | AST only |
+| test.cpp:53:10:53:13 | (int)... | test.cpp:53:10:53:13 | (int)... | AST only |
+| test.cpp:53:10:53:13 | (int)... | test.cpp:56:21:56:24 | (int)... | AST only |
+| test.cpp:53:18:53:21 | (int)... | test.cpp:44:9:44:9 | 0 | AST only |
+| test.cpp:53:18:53:21 | (int)... | test.cpp:51:25:51:25 | 0 | AST only |
+| test.cpp:53:18:53:21 | (int)... | test.cpp:53:18:53:21 | (int)... | AST only |
+| test.cpp:53:18:53:21 | (int)... | test.cpp:56:39:56:42 | (int)... | AST only |
+| test.cpp:53:18:53:21 | (int)... | test.cpp:59:17:59:20 | (int)... | AST only |
+| test.cpp:53:18:53:21 | (int)... | test.cpp:88:12:88:12 | 0 | AST only |
+| test.cpp:55:5:55:15 | ... = ... | test.cpp:55:5:55:15 | ... = ... | AST only |
+| test.cpp:56:12:56:25 | (...) | test.cpp:56:12:56:25 | (...) | AST only |
+| test.cpp:56:12:56:43 | ... && ... | test.cpp:56:12:56:43 | ... && ... | AST only |
+| test.cpp:56:13:56:16 | (int)... | test.cpp:56:13:56:16 | (int)... | AST only |
+| test.cpp:56:13:56:16 | (int)... | test.cpp:56:31:56:34 | (int)... | AST only |
+| test.cpp:56:13:56:16 | (int)... | test.cpp:59:9:59:12 | (int)... | AST only |
+| test.cpp:56:13:56:16 | * ... | test.cpp:56:31:56:34 | * ... | AST only |
+| test.cpp:56:13:56:16 | * ... | test.cpp:59:9:59:12 | * ... | AST only |
+| test.cpp:56:21:56:24 | (int)... | test.cpp:53:10:53:13 | (int)... | AST only |
+| test.cpp:56:21:56:24 | (int)... | test.cpp:56:21:56:24 | (int)... | AST only |
+| test.cpp:56:30:56:43 | (...) | test.cpp:56:30:56:43 | (...) | AST only |
+| test.cpp:56:31:56:34 | (int)... | test.cpp:56:13:56:16 | (int)... | AST only |
+| test.cpp:56:31:56:34 | (int)... | test.cpp:56:31:56:34 | (int)... | AST only |
+| test.cpp:56:31:56:34 | (int)... | test.cpp:59:9:59:12 | (int)... | AST only |
+| test.cpp:56:31:56:34 | * ... | test.cpp:56:13:56:16 | * ... | AST only |
+| test.cpp:56:31:56:34 | * ... | test.cpp:59:9:59:12 | * ... | AST only |
+| test.cpp:56:39:56:42 | (int)... | test.cpp:44:9:44:9 | 0 | AST only |
+| test.cpp:56:39:56:42 | (int)... | test.cpp:51:25:51:25 | 0 | AST only |
+| test.cpp:56:39:56:42 | (int)... | test.cpp:53:18:53:21 | (int)... | AST only |
+| test.cpp:56:39:56:42 | (int)... | test.cpp:56:39:56:42 | (int)... | AST only |
+| test.cpp:56:39:56:42 | (int)... | test.cpp:59:17:59:20 | (int)... | AST only |
+| test.cpp:56:39:56:42 | (int)... | test.cpp:88:12:88:12 | 0 | AST only |
+| test.cpp:56:47:56:51 | ... ++ | test.cpp:56:47:56:51 | ... ++ | AST only |
+| test.cpp:59:9:59:12 | (int)... | test.cpp:56:13:56:16 | (int)... | AST only |
+| test.cpp:59:9:59:12 | (int)... | test.cpp:56:31:56:34 | (int)... | AST only |
+| test.cpp:59:9:59:12 | (int)... | test.cpp:59:9:59:12 | (int)... | AST only |
+| test.cpp:59:9:59:12 | * ... | test.cpp:56:13:56:16 | * ... | AST only |
+| test.cpp:59:9:59:12 | * ... | test.cpp:56:31:56:34 | * ... | AST only |
+| test.cpp:59:17:59:20 | (int)... | test.cpp:44:9:44:9 | 0 | AST only |
+| test.cpp:59:17:59:20 | (int)... | test.cpp:51:25:51:25 | 0 | AST only |
+| test.cpp:59:17:59:20 | (int)... | test.cpp:53:18:53:21 | (int)... | AST only |
+| test.cpp:59:17:59:20 | (int)... | test.cpp:56:39:56:42 | (int)... | AST only |
+| test.cpp:59:17:59:20 | (int)... | test.cpp:59:17:59:20 | (int)... | AST only |
+| test.cpp:59:17:59:20 | (int)... | test.cpp:88:12:88:12 | 0 | AST only |
+| test.cpp:62:5:62:12 | ... ++ | test.cpp:62:5:62:12 | ... ++ | AST only |
+| test.cpp:77:20:77:28 | call to getAValue | test.cpp:79:7:79:7 | v | IR only |
+| test.cpp:77:20:77:30 | (signed short)... | test.cpp:77:20:77:30 | (signed short)... | AST only |
+| test.cpp:77:20:77:30 | (signed short)... | test.cpp:79:7:79:7 | v | AST only |
+| test.cpp:79:7:79:7 | (int)... | test.cpp:79:7:79:7 | (int)... | AST only |
+| test.cpp:79:7:79:7 | v | test.cpp:77:20:77:28 | call to getAValue | IR only |
+| test.cpp:79:7:79:7 | v | test.cpp:77:20:77:30 | (signed short)... | AST only |
+| test.cpp:79:11:79:20 | (int)... | test.cpp:79:11:79:20 | (int)... | AST only |
+| test.cpp:79:24:79:33 | (int)... | test.cpp:79:24:79:33 | (int)... | AST only |
+| test.cpp:80:5:80:19 | ... = ... | test.cpp:80:5:80:19 | ... = ... | AST only |
+| test.cpp:80:9:80:19 | (signed short)... | test.cpp:80:9:80:19 | (signed short)... | AST only |
+| test.cpp:88:3:88:20 | ... = ... | test.cpp:88:3:88:20 | ... = ... | AST only |
+| test.cpp:88:12:88:12 | 0 | test.cpp:44:9:44:9 | 0 | AST only |
+| test.cpp:88:12:88:12 | 0 | test.cpp:51:25:51:25 | 0 | AST only |
+| test.cpp:88:12:88:12 | 0 | test.cpp:53:18:53:21 | (int)... | AST only |
+| test.cpp:88:12:88:12 | 0 | test.cpp:56:39:56:42 | (int)... | AST only |
+| test.cpp:88:12:88:12 | 0 | test.cpp:59:17:59:20 | (int)... | AST only |
+| test.cpp:88:12:88:12 | (void *)... | test.cpp:88:12:88:12 | (void *)... | AST only |
+| test.cpp:92:11:92:16 | ... = ... | test.cpp:92:15:92:16 | 10 | IR only |
+| test.cpp:92:11:92:16 | ... = ... | test.cpp:93:10:93:10 | x | IR only |
+| test.cpp:92:15:92:16 | 10 | test.cpp:92:11:92:16 | ... = ... | IR only |
+| test.cpp:92:15:92:16 | 10 | test.cpp:93:10:93:10 | x | IR only |
+| test.cpp:93:10:93:10 | x | test.cpp:92:11:92:16 | ... = ... | IR only |
+| test.cpp:93:10:93:10 | x | test.cpp:92:15:92:16 | 10 | IR only |
+| test.cpp:105:11:105:12 | (Base *)... | test.cpp:105:11:105:12 | (Base *)... | AST only |
+| test.cpp:105:11:105:12 | (Base *)... | test.cpp:106:14:106:35 | static_cast<Base *>... | AST only |
+| test.cpp:105:11:105:12 | (Base *)... | test.cpp:107:11:107:12 | pb | AST only |
+| test.cpp:105:11:105:12 | pd | test.cpp:107:11:107:12 | pb | IR only |
+| test.cpp:106:14:106:35 | static_cast<Base *>... | test.cpp:105:11:105:12 | (Base *)... | AST only |
+| test.cpp:106:14:106:35 | static_cast<Base *>... | test.cpp:106:14:106:35 | static_cast<Base *>... | AST only |
+| test.cpp:106:14:106:35 | static_cast<Base *>... | test.cpp:107:11:107:12 | pb | AST only |
+| test.cpp:106:33:106:34 | pd | test.cpp:107:11:107:12 | pb | IR only |
+| test.cpp:107:11:107:12 | pb | test.cpp:105:11:105:12 | (Base *)... | AST only |
+| test.cpp:107:11:107:12 | pb | test.cpp:105:11:105:12 | pd | IR only |
+| test.cpp:107:11:107:12 | pb | test.cpp:106:14:106:35 | static_cast<Base *>... | AST only |
+| test.cpp:107:11:107:12 | pb | test.cpp:106:33:106:34 | pd | IR only |
+| test.cpp:113:3:113:5 | a | test.cpp:115:3:115:5 | a | IR only |
+| test.cpp:115:3:115:5 | a | test.cpp:113:3:113:5 | a | IR only |
+| test.cpp:125:15:125:15 | x | test.cpp:128:7:128:7 | x | AST only |
+| test.cpp:126:15:126:15 | x | test.cpp:128:7:128:7 | x | AST only |
+| test.cpp:128:3:128:11 | ... = ... | test.cpp:128:3:128:11 | ... = ... | AST only |
+| test.cpp:128:7:128:7 | x | test.cpp:125:15:125:15 | x | AST only |
+| test.cpp:128:7:128:7 | x | test.cpp:126:15:126:15 | x | AST only |
+| test.cpp:128:11:128:11 | n | test.cpp:129:15:129:15 | x | IR only |
+| test.cpp:129:15:129:15 | x | test.cpp:128:11:128:11 | n | IR only |
+| test.cpp:136:21:136:21 | x | test.cpp:137:21:137:21 | x | AST only |
+| test.cpp:136:21:136:21 | x | test.cpp:139:13:139:13 | x | AST only |
+| test.cpp:137:21:137:21 | x | test.cpp:136:21:136:21 | x | AST only |
+| test.cpp:137:21:137:21 | x | test.cpp:139:13:139:13 | x | AST only |
+| test.cpp:139:3:139:24 | ... = ... | test.cpp:139:3:139:24 | ... = ... | AST only |
+| test.cpp:139:13:139:13 | x | test.cpp:136:21:136:21 | x | AST only |
+| test.cpp:139:13:139:13 | x | test.cpp:137:21:137:21 | x | AST only |
+| test.cpp:144:15:144:15 | x | test.cpp:149:15:149:15 | x | IR only |
+| test.cpp:145:15:145:15 | y | test.cpp:147:7:147:7 | y | AST only |
+| test.cpp:147:3:147:18 | ... = ... | test.cpp:147:3:147:18 | ... = ... | AST only |
+| test.cpp:147:7:147:7 | y | test.cpp:145:15:145:15 | y | AST only |
+| test.cpp:149:15:149:15 | x | test.cpp:144:15:144:15 | x | IR only |
+| test.cpp:153:21:153:21 | x | test.cpp:154:21:154:21 | x | AST only |
+| test.cpp:154:21:154:21 | x | test.cpp:153:21:153:21 | x | AST only |
+| test.cpp:156:3:156:17 | ... = ... | test.cpp:156:3:156:17 | ... = ... | AST only |

cpp/ql/test/library-tests/valuenumbering/GlobalValueNumbering/diff_ir_expr.ql

@@ -0,0 +1,15 @@
+import cpp
+import semmle.code.cpp.valuenumbering.GlobalValueNumbering as AST
+import semmle.code.cpp.ir.internal.ASTValueNumbering as IR
+import semmle.code.cpp.ir.IR
+
+Expr ir(Expr e) { result = IR::globalValueNumber(e).getAnExpr() }
+
+Expr ast(Expr e) { result = AST::globalValueNumber(e).getAnExpr() }
+
+from Expr e, Expr evn, string note
+where
+  evn = ast(e) and not evn = ir(e) and note = "AST only"
+  or
+  evn = ir(e) and not evn = ast(e) and note = "IR only"
+select e, evn, note

cpp/ql/test/library-tests/valuenumbering/GlobalValueNumbering/ir_uniqueness.ql

@@ -0,0 +1,11 @@
+import cpp
+import semmle.code.cpp.ir.ValueNumbering
+import semmle.code.cpp.ir.IR
+
+// Every non-void instruction should have exactly one GVN.
+// So this query should have zero results.
+from Instruction i
+where
+  not i.getResultIRType() instanceof IRVoidType and
+  count(valueNumber(i)) != 1
+select i, concat(ValueNumber g | g = valueNumber(i) | g.getKind(), ", ")

cpp/ql/test/library-tests/valuenumbering/GlobalValueNumbering/test.cpp

@@ -42,7 +42,7 @@ int test03(int p0, int p1, int* p2) {
 
   x = p0 + p1 + global03;
   *p2 = 0; // Might change global03
-  x = p0 + p1 + global03; // Not the same value
+  x = p0 + p1 + global03; // BUG: Not the same value, but given the same value number (this is likely due to #2696)
   y = x;
 }
 
@@ -115,3 +115,45 @@ void test06() {
   "a";
   "c";
 }
+
+struct A {
+  int x;
+  int y;
+};
+
+void test_read_arg_same(A *pa, int n) {
+  int b = pa->x;
+  int c = pa->x;
+
+  pa->x = n;
+  int d = pa->x;
+}
+
+A* global_a;
+int global_n;
+
+void test_read_global_same() {
+  int b = global_a->x;
+  int c = global_a->x;
+
+  global_a->x = global_n;
+  int d = global_a->x;
+}
+
+void test_read_arg_different(A *pa) {
+  int b = pa->x;
+  int c = pa->y;
+
+  pa->y = global_n;
+
+  int d = pa->x;
+}
+
+void test_read_global_different(int n) {
+  int b = global_a->x;
+  int c = global_a->x;
+
+  global_a->y = n;
+
+  int d = global_a->x;
+}

cpp/ql/test/query-tests/Likely Bugs/RedundantNullCheckSimple/RedundantNullCheckSimple.cpp

@@ -17,7 +17,7 @@ void test_not_same_basic_block(int *p) {
 void test_indirect(int **p) {
   int x;
   x = **p;
-  if (*p == nullptr) { // BAD [NOT DETECTED]
+  if (*p == nullptr) { // BAD
     return;
   }
 }

cpp/ql/test/query-tests/Likely Bugs/RedundantNullCheckSimple/RedundantNullCheckSimple.expected

@@ -1,5 +1,6 @@
 | RedundantNullCheckSimple.cpp:4:7:4:7 | Load: p | This null check is redundant because the value is $@ in any case | RedundantNullCheckSimple.cpp:3:7:3:8 | Load: * ... | dereferenced here |
 | RedundantNullCheckSimple.cpp:13:8:13:8 | Load: p | This null check is redundant because the value is $@ in any case | RedundantNullCheckSimple.cpp:10:11:10:12 | Load: * ... | dereferenced here |
+| RedundantNullCheckSimple.cpp:20:7:20:8 | Load: * ... | This null check is redundant because the value is $@ in any case | RedundantNullCheckSimple.cpp:19:7:19:9 | Load: * ... | dereferenced here |
 | RedundantNullCheckSimple.cpp:48:12:48:12 | Load: p | This null check is redundant because the value is $@ in any case | RedundantNullCheckSimple.cpp:51:10:51:11 | Load: * ... | dereferenced here |
 | RedundantNullCheckSimple.cpp:79:7:79:9 | Load: * ... | This null check is redundant because the value is $@ in any case | RedundantNullCheckSimple.cpp:78:7:78:10 | Load: * ... | dereferenced here |
 | RedundantNullCheckSimple.cpp:93:13:93:13 | Load: p | This null check is redundant because the value is $@ in any case | RedundantNullCheckSimple.cpp:92:13:92:18 | Load: * ... | dereferenced here |

cpp/ql/test/query-tests/Security/CWE/CWE-807/semmle/TaintedCondition/test.cpp

@@ -35,7 +35,7 @@ void processRequest()
         adminPrivileges = 0; // OK, since it's a 0 and not a 1
      }
 
-     // BAD, but it requires pointer analysis to catch
+     // BAD (requires pointer analysis to catch)
      const char** userp = &currentUser;
      *userp = userName;
      if (!strcmp(currentUser, "admin")) {

csharp/ql/src/Dead Code/DeadStoreOfLocal.ql

@@ -114,7 +114,7 @@ class RelevantDefinition extends AssignableDefinition {
    */
   private predicate isDefaultLikeInitializer() {
     this.isInitializer() and
-    exists(Expr e | e = this.getSource() |
+    exists(Expr e | e = this.getSource().stripCasts() |
       exists(string val | val = e.getValue() |
         val = "0" or
         val = "-1" or

csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll

@@ -554,15 +554,10 @@ class SsaDefinitionNode extends Node, TSsaDefinitionNode {
 
 private module ParameterNodes {
   /**
-   * Holds if SSA definition node `node` is an entry definition for parameter `p`.
+   * Holds if definition node `node` is an entry definition for parameter `p`.
    */
-  predicate explicitParameterNode(SsaDefinitionNode node, Parameter p) {
-    exists(Ssa::ExplicitDefinition def, AssignableDefinitions::ImplicitParameterDefinition pdef |
-      node = TSsaDefinitionNode(def)
-    |
-      pdef = def.getADefinition() and
-      p = pdef.getParameter()
-    )
+  predicate explicitParameterNode(AssignableDefinitionNode node, Parameter p) {
+    p = node.getDefinition().(AssignableDefinitions::ImplicitParameterDefinition).getParameter()
   }
 
   /**
@@ -1126,13 +1121,14 @@ private module OutNodes {
    * A data flow node that reads a value returned by a callable using an
    * `out` or `ref` parameter.
    */
-  class ParamOutNode extends OutNode, SsaDefinitionNode {
+  class ParamOutNode extends OutNode, AssignableDefinitionNode {
     private AssignableDefinitions::OutRefDefinition outRefDef;
+    private ControlFlow::Node cfn;
 
-    ParamOutNode() { outRefDef = this.getDefinition().(Ssa::ExplicitDefinition).getADefinition() }
+    ParamOutNode() { outRefDef = this.getDefinitionAtNode(cfn) }
 
     override DataFlowCall getCall(ReturnKind kind) {
-      result = csharpCall(_, this.getDefinition().getControlFlowNode()) and
+      result = csharpCall(_, cfn) and
       exists(Parameter p |
         p.getSourceDeclaration().getPosition() = kind.(OutRefReturnKind).getPosition() and
         outRefDef.getTargetAccess() = result.getExpr().(Call).getArgumentForParameter(p)
@@ -1458,10 +1454,8 @@ class CastNode extends Node {
   CastNode() {
     this.asExpr() instanceof Cast
     or
-    exists(Ssa::ExplicitDefinition def |
-      def = this.(SsaDefinitionNode).getDefinition() and
-      def.getADefinition() instanceof AssignableDefinitions::PatternDefinition
-    )
+    this.(AssignableDefinitionNode).getDefinition() instanceof
+      AssignableDefinitions::PatternDefinition
     or
     readStep(_, _, this)
     or

csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPublic.qll

@@ -19,13 +19,23 @@ class Node extends TNode {
    * if any.
    */
   Expr asExprAtNode(ControlFlow::Nodes::ElementNode cfn) {
-    this = TExprNode(cfn) and
-    result = cfn.getElement()
+    result = this.(ExprNode).getExprAtNode(cfn)
   }
 
   /** Gets the parameter corresponding to this node, if any. */
   DotNet::Parameter asParameter() { result = this.(ParameterNode).getParameter() }
 
+  /** Gets the definition corresponding to this node, if any. */
+  AssignableDefinition asDefinition() { result = this.asDefinitionAtNode(_) }
+
+  /**
+   * Gets the definition corresponding to this node, at control flow node `cfn`,
+   * if any.
+   */
+  AssignableDefinition asDefinitionAtNode(ControlFlow::Node cfn) {
+    result = this.(AssignableDefinitionNode).getDefinitionAtNode(cfn)
+  }
+
   /** Gets the type of this node. */
   cached
   DotNet::Type getType() { none() }
@@ -140,6 +150,22 @@ class ParameterNode extends Node {
   predicate isParameterOf(DataFlowCallable c, int i) { none() }
 }
 
+/** A definition, viewed as a node in a data flow graph. */
+class AssignableDefinitionNode extends Node, TSsaDefinitionNode {
+  private Ssa::ExplicitDefinition edef;
+
+  AssignableDefinitionNode() { this = TSsaDefinitionNode(edef) }
+
+  /** Gets the underlying definition. */
+  AssignableDefinition getDefinition() { result = this.getDefinitionAtNode(_) }
+
+  /** Gets the underlying definition, at control flow node `cfn`, if any. */
+  AssignableDefinition getDefinitionAtNode(ControlFlow::Node cfn) {
+    result = edef.getADefinition() and
+    cfn = edef.getControlFlowNode()
+  }
+}
+
 /** Gets a node corresponding to expression `e`. */
 ExprNode exprNode(DotNet::Expr e) { result.getExpr() = e }
 
@@ -148,6 +174,11 @@ ExprNode exprNode(DotNet::Expr e) { result.getExpr() = e }
  */
 ParameterNode parameterNode(DotNet::Parameter p) { result.getParameter() = p }
 
+/** Gets a node corresponding to the definition `def`. */
+AssignableDefinitionNode assignableDefinitionNode(AssignableDefinition def) {
+  result.getDefinition() = def
+}
+
 /**
  * Holds if data flows from `nodeFrom` to `nodeTo` in exactly one local
  * (intra-procedural) step.

csharp/ql/src/semmle/code/csharp/ir/implementation/raw/gvn/ValueNumbering.qll

@@ -1,6 +1,5 @@
 private import internal.ValueNumberingInternal
 private import internal.ValueNumberingImports
-private import IR
 
 /**
  * Provides additional information about value numbering in IR dumps.
@@ -10,57 +9,38 @@ class ValueNumberPropertyProvider extends IRPropertyProvider {
     exists(ValueNumber vn |
       vn = valueNumber(instr) and
       key = "valnum" and
-      if strictcount(vn.getAnInstruction()) > 1 then result = vn.toString() else result = "unique"
+      if strictcount(vn.getAnInstruction()) > 1
+      then result = vn.getDebugString()
+      else result = "unique"
     )
   }
 }
 
-newtype TValueNumber =
-  TVariableAddressValueNumber(IRFunction irFunc, IRVariable var) {
-    variableAddressValueNumber(_, irFunc, var)
-  } or
-  TInitializeParameterValueNumber(IRFunction irFunc, IRVariable var) {
-    initializeParameterValueNumber(_, irFunc, var)
-  } or
-  TInitializeThisValueNumber(IRFunction irFunc) { initializeThisValueNumber(_, irFunc) } or
-  TConstantValueNumber(IRFunction irFunc, IRType type, string value) {
-    constantValueNumber(_, irFunc, type, value)
-  } or
-  TStringConstantValueNumber(IRFunction irFunc, IRType type, string value) {
-    stringConstantValueNumber(_, irFunc, type, value)
-  } or
-  TFieldAddressValueNumber(IRFunction irFunc, Language::Field field, ValueNumber objectAddress) {
-    fieldAddressValueNumber(_, irFunc, field, objectAddress)
-  } or
-  TBinaryValueNumber(
-    IRFunction irFunc, Opcode opcode, IRType type, ValueNumber leftOperand, ValueNumber rightOperand
-  ) {
-    binaryValueNumber(_, irFunc, opcode, type, leftOperand, rightOperand)
-  } or
-  TPointerArithmeticValueNumber(
-    IRFunction irFunc, Opcode opcode, IRType type, int elementSize, ValueNumber leftOperand,
-    ValueNumber rightOperand
-  ) {
-    pointerArithmeticValueNumber(_, irFunc, opcode, type, elementSize, leftOperand, rightOperand)
-  } or
-  TUnaryValueNumber(IRFunction irFunc, Opcode opcode, IRType type, ValueNumber operand) {
-    unaryValueNumber(_, irFunc, opcode, type, operand)
-  } or
-  TInheritanceConversionValueNumber(
-    IRFunction irFunc, Opcode opcode, Language::Class baseClass, Language::Class derivedClass,
-    ValueNumber operand
-  ) {
-    inheritanceConversionValueNumber(_, irFunc, opcode, baseClass, derivedClass, operand)
-  } or
-  TUniqueValueNumber(IRFunction irFunc, Instruction instr) { uniqueValueNumber(instr, irFunc) }
-
 /**
  * The value number assigned to a particular set of instructions that produce equivalent results.
  */
 class ValueNumber extends TValueNumber {
-  final string toString() { result = getExampleInstruction().getResultId() }
+  final string toString() { result = "GVN" }
 
-  final Language::Location getLocation() { result = getExampleInstruction().getLocation() }
+  final string getDebugString() { result = strictconcat(getAnInstruction().getResultId(), ", ") }
+
+  final Language::Location getLocation() {
+    if
+      exists(Instruction i |
+        i = getAnInstruction() and not i.getLocation() instanceof UnknownLocation
+      )
+    then
+      result =
+        min(Language::Location l |
+          l = getAnInstruction().getLocation() and not l instanceof UnknownLocation
+        |
+          l
+          order by
+            l.getFile().getAbsolutePath(), l.getStartLine(), l.getStartColumn(), l.getEndLine(),
+            l.getEndColumn()
+        )
+    else result instanceof UnknownDefaultLocation
+  }
 
   /**
    * Gets the instructions that have been assigned this value number. This will always produce at
@@ -85,236 +65,39 @@ class ValueNumber extends TValueNumber {
    * Gets an `Operand` whose definition is exact and has this value number.
    */
   final Operand getAUse() { this = valueNumber(result.getDef()) }
-}
 
-/**
- * A `CopyInstruction` whose source operand's value is congruent to the definition of that source
- * operand.
- * For example:
- * ```
- * Point p = { 1, 2 };
- * Point q = p;
- * int a = p.x;
- * ```
- * The use of `p` on line 2 is linked to the definition of `p` on line 1, and is congruent to that
- * definition because it accesses the exact same memory.
- * The use of `p.x` on line 3 is linked to the definition of `p` on line 1 as well, but is not
- * congruent to that definition because `p.x` accesses only a subset of the memory defined by `p`.
- */
-private class CongruentCopyInstruction extends CopyInstruction {
-  CongruentCopyInstruction() {
-    this.getSourceValueOperand().getDefinitionOverlap() instanceof MustExactlyOverlap
+  final string getKind() {
+    this instanceof TVariableAddressValueNumber and result = "VariableAddress"
+    or
+    this instanceof TInitializeParameterValueNumber and result = "InitializeParameter"
+    or
+    this instanceof TInitializeThisValueNumber and result = "InitializeThis"
+    or
+    this instanceof TStringConstantValueNumber and result = "StringConstant"
+    or
+    this instanceof TFieldAddressValueNumber and result = "FieldAddress"
+    or
+    this instanceof TBinaryValueNumber and result = "Binary"
+    or
+    this instanceof TPointerArithmeticValueNumber and result = "PointerArithmetic"
+    or
+    this instanceof TUnaryValueNumber and result = "Unary"
+    or
+    this instanceof TInheritanceConversionValueNumber and result = "InheritanceConversion"
+    or
+    this instanceof TLoadTotalOverlapValueNumber and result = "LoadTotalOverlap"
+    or
+    this instanceof TUniqueValueNumber and result = "Unique"
   }
 }
 
-/**
- * Holds if this library knows how to assign a value number to the specified instruction, other than
- * a `unique` value number that is never shared by multiple instructions.
- */
-private predicate numberableInstruction(Instruction instr) {
-  instr instanceof VariableAddressInstruction
-  or
-  instr instanceof InitializeParameterInstruction
-  or
-  instr instanceof InitializeThisInstruction
-  or
-  instr instanceof ConstantInstruction
-  or
-  instr instanceof StringConstantInstruction
-  or
-  instr instanceof FieldAddressInstruction
-  or
-  instr instanceof BinaryInstruction
-  or
-  instr instanceof UnaryInstruction and not instr instanceof CopyInstruction
-  or
-  instr instanceof PointerArithmeticInstruction
-  or
-  instr instanceof CongruentCopyInstruction
-}
-
-private predicate variableAddressValueNumber(
-  VariableAddressInstruction instr, IRFunction irFunc, IRVariable var
-) {
-  instr.getEnclosingIRFunction() = irFunc and
-  instr.getIRVariable() = var
-}
-
-private predicate initializeParameterValueNumber(
-  InitializeParameterInstruction instr, IRFunction irFunc, IRVariable var
-) {
-  instr.getEnclosingIRFunction() = irFunc and
-  instr.getIRVariable() = var
-}
-
-private predicate initializeThisValueNumber(InitializeThisInstruction instr, IRFunction irFunc) {
-  instr.getEnclosingIRFunction() = irFunc
-}
-
-private predicate constantValueNumber(
-  ConstantInstruction instr, IRFunction irFunc, IRType type, string value
-) {
-  instr.getEnclosingIRFunction() = irFunc and
-  instr.getResultIRType() = type and
-  instr.getValue() = value
-}
-
-private predicate stringConstantValueNumber(
-  StringConstantInstruction instr, IRFunction irFunc, IRType type, string value
-) {
-  instr.getEnclosingIRFunction() = irFunc and
-  instr.getResultIRType() = type and
-  instr.getValue().getValue() = value
-}
-
-private predicate fieldAddressValueNumber(
-  FieldAddressInstruction instr, IRFunction irFunc, Language::Field field, ValueNumber objectAddress
-) {
-  instr.getEnclosingIRFunction() = irFunc and
-  instr.getField() = field and
-  valueNumber(instr.getObjectAddress()) = objectAddress
-}
-
-private predicate binaryValueNumber(
-  BinaryInstruction instr, IRFunction irFunc, Opcode opcode, IRType type, ValueNumber leftOperand,
-  ValueNumber rightOperand
-) {
-  instr.getEnclosingIRFunction() = irFunc and
-  not instr instanceof PointerArithmeticInstruction and
-  instr.getOpcode() = opcode and
-  instr.getResultIRType() = type and
-  valueNumber(instr.getLeft()) = leftOperand and
-  valueNumber(instr.getRight()) = rightOperand
-}
-
-private predicate pointerArithmeticValueNumber(
-  PointerArithmeticInstruction instr, IRFunction irFunc, Opcode opcode, IRType type,
-  int elementSize, ValueNumber leftOperand, ValueNumber rightOperand
-) {
-  instr.getEnclosingIRFunction() = irFunc and
-  instr.getOpcode() = opcode and
-  instr.getResultIRType() = type and
-  instr.getElementSize() = elementSize and
-  valueNumber(instr.getLeft()) = leftOperand and
-  valueNumber(instr.getRight()) = rightOperand
-}
-
-private predicate unaryValueNumber(
-  UnaryInstruction instr, IRFunction irFunc, Opcode opcode, IRType type, ValueNumber operand
-) {
-  instr.getEnclosingIRFunction() = irFunc and
-  not instr instanceof InheritanceConversionInstruction and
-  not instr instanceof CopyInstruction and
-  instr.getOpcode() = opcode and
-  instr.getResultIRType() = type and
-  valueNumber(instr.getUnary()) = operand
-}
-
-private predicate inheritanceConversionValueNumber(
-  InheritanceConversionInstruction instr, IRFunction irFunc, Opcode opcode,
-  Language::Class baseClass, Language::Class derivedClass, ValueNumber operand
-) {
-  instr.getEnclosingIRFunction() = irFunc and
-  instr.getOpcode() = opcode and
-  instr.getBaseClass() = baseClass and
-  instr.getDerivedClass() = derivedClass and
-  valueNumber(instr.getUnary()) = operand
-}
-
-/**
- * Holds if `instr` should be assigned a unique value number because this library does not know how
- * to determine if two instances of that instruction are equivalent.
- */
-private predicate uniqueValueNumber(Instruction instr, IRFunction irFunc) {
-  instr.getEnclosingIRFunction() = irFunc and
-  not instr.getResultIRType() instanceof IRVoidType and
-  not numberableInstruction(instr)
-}
-
 /**
  * Gets the value number assigned to `instr`, if any. Returns at most one result.
  */
-cached
-ValueNumber valueNumber(Instruction instr) {
-  result = nonUniqueValueNumber(instr)
-  or
-  exists(IRFunction irFunc |
-    uniqueValueNumber(instr, irFunc) and
-    result = TUniqueValueNumber(irFunc, instr)
-  )
-}
+ValueNumber valueNumber(Instruction instr) { result = tvalueNumber(instr) }
 
 /**
  * Gets the value number assigned to the exact definition of `op`, if any.
  * Returns at most one result.
  */
-ValueNumber valueNumberOfOperand(Operand op) { result = valueNumber(op.getDef()) }
-
-/**
- * Gets the value number assigned to `instr`, if any, unless that instruction is assigned a unique
- * value number.
- */
-private ValueNumber nonUniqueValueNumber(Instruction instr) {
-  exists(IRFunction irFunc |
-    irFunc = instr.getEnclosingIRFunction() and
-    (
-      exists(IRVariable var |
-        variableAddressValueNumber(instr, irFunc, var) and
-        result = TVariableAddressValueNumber(irFunc, var)
-      )
-      or
-      exists(IRVariable var |
-        initializeParameterValueNumber(instr, irFunc, var) and
-        result = TInitializeParameterValueNumber(irFunc, var)
-      )
-      or
-      initializeThisValueNumber(instr, irFunc) and
-      result = TInitializeThisValueNumber(irFunc)
-      or
-      exists(IRType type, string value |
-        constantValueNumber(instr, irFunc, type, value) and
-        result = TConstantValueNumber(irFunc, type, value)
-      )
-      or
-      exists(IRType type, string value |
-        stringConstantValueNumber(instr, irFunc, type, value) and
-        result = TStringConstantValueNumber(irFunc, type, value)
-      )
-      or
-      exists(Language::Field field, ValueNumber objectAddress |
-        fieldAddressValueNumber(instr, irFunc, field, objectAddress) and
-        result = TFieldAddressValueNumber(irFunc, field, objectAddress)
-      )
-      or
-      exists(Opcode opcode, IRType type, ValueNumber leftOperand, ValueNumber rightOperand |
-        binaryValueNumber(instr, irFunc, opcode, type, leftOperand, rightOperand) and
-        result = TBinaryValueNumber(irFunc, opcode, type, leftOperand, rightOperand)
-      )
-      or
-      exists(Opcode opcode, IRType type, ValueNumber operand |
-        unaryValueNumber(instr, irFunc, opcode, type, operand) and
-        result = TUnaryValueNumber(irFunc, opcode, type, operand)
-      )
-      or
-      exists(
-        Opcode opcode, Language::Class baseClass, Language::Class derivedClass, ValueNumber operand
-      |
-        inheritanceConversionValueNumber(instr, irFunc, opcode, baseClass, derivedClass, operand) and
-        result = TInheritanceConversionValueNumber(irFunc, opcode, baseClass, derivedClass, operand)
-      )
-      or
-      exists(
-        Opcode opcode, IRType type, int elementSize, ValueNumber leftOperand,
-        ValueNumber rightOperand
-      |
-        pointerArithmeticValueNumber(instr, irFunc, opcode, type, elementSize, leftOperand,
-          rightOperand) and
-        result =
-          TPointerArithmeticValueNumber(irFunc, opcode, type, elementSize, leftOperand, rightOperand)
-      )
-      or
-      // The value number of a copy is just the value number of its source value.
-      result = valueNumber(instr.(CongruentCopyInstruction).getSourceValue())
-    )
-  )
-}
+ValueNumber valueNumberOfOperand(Operand op) { result = tvalueNumberOfOperand(op) }

csharp/ql/src/semmle/code/csharp/ir/implementation/raw/gvn/internal/ValueNumberingInternal.qll

@@ -1,2 +1,275 @@
-import semmle.code.csharp.ir.implementation.raw.IR as IR
+private import ValueNumberingImports
 import semmle.code.csharp.ir.internal.IRCSharpLanguage as Language
+import semmle.code.csharp.ir.implementation.raw.IR
+private import semmle.code.csharp.Location
+
+class UnknownLocation = EmptyLocation;
+
+class UnknownDefaultLocation = EmptyLocation;
+
+newtype TValueNumber =
+  TVariableAddressValueNumber(IRFunction irFunc, IRVariable var) {
+    variableAddressValueNumber(_, irFunc, var)
+  } or
+  TInitializeParameterValueNumber(IRFunction irFunc, IRVariable var) {
+    initializeParameterValueNumber(_, irFunc, var)
+  } or
+  TInitializeThisValueNumber(IRFunction irFunc) { initializeThisValueNumber(_, irFunc) } or
+  TConstantValueNumber(IRFunction irFunc, IRType type, string value) {
+    constantValueNumber(_, irFunc, type, value)
+  } or
+  TStringConstantValueNumber(IRFunction irFunc, IRType type, string value) {
+    stringConstantValueNumber(_, irFunc, type, value)
+  } or
+  TFieldAddressValueNumber(IRFunction irFunc, Language::Field field, TValueNumber objectAddress) {
+    fieldAddressValueNumber(_, irFunc, field, objectAddress)
+  } or
+  TBinaryValueNumber(
+    IRFunction irFunc, Opcode opcode, IRType type, TValueNumber leftOperand,
+    TValueNumber rightOperand
+  ) {
+    binaryValueNumber(_, irFunc, opcode, type, leftOperand, rightOperand)
+  } or
+  TPointerArithmeticValueNumber(
+    IRFunction irFunc, Opcode opcode, IRType type, int elementSize, TValueNumber leftOperand,
+    TValueNumber rightOperand
+  ) {
+    pointerArithmeticValueNumber(_, irFunc, opcode, type, elementSize, leftOperand, rightOperand)
+  } or
+  TUnaryValueNumber(IRFunction irFunc, Opcode opcode, IRType type, TValueNumber operand) {
+    unaryValueNumber(_, irFunc, opcode, type, operand)
+  } or
+  TInheritanceConversionValueNumber(
+    IRFunction irFunc, Opcode opcode, Language::Class baseClass, Language::Class derivedClass,
+    TValueNumber operand
+  ) {
+    inheritanceConversionValueNumber(_, irFunc, opcode, baseClass, derivedClass, operand)
+  } or
+  TUniqueValueNumber(IRFunction irFunc, Instruction instr) { uniqueValueNumber(instr, irFunc) }
+
+/**
+ * A `CopyInstruction` whose source operand's value is congruent to the definition of that source
+ * operand.
+ * For example:
+ * ```
+ * Point p = { 1, 2 };
+ * Point q = p;
+ * int a = p.x;
+ * ```
+ * The use of `p` on line 2 is linked to the definition of `p` on line 1, and is congruent to that
+ * definition because it accesses the exact same memory.
+ * The use of `p.x` on line 3 is linked to the definition of `p` on line 1 as well, but is not
+ * congruent to that definition because `p.x` accesses only a subset of the memory defined by `p`.
+ */
+private class CongruentCopyInstruction extends CopyInstruction {
+  CongruentCopyInstruction() {
+    this.getSourceValueOperand().getDefinitionOverlap() instanceof MustExactlyOverlap
+  }
+}
+
+/**
+ * Holds if this library knows how to assign a value number to the specified instruction, other than
+ * a `unique` value number that is never shared by multiple instructions.
+ */
+private predicate numberableInstruction(Instruction instr) {
+  instr instanceof VariableAddressInstruction
+  or
+  instr instanceof InitializeParameterInstruction
+  or
+  instr instanceof InitializeThisInstruction
+  or
+  instr instanceof ConstantInstruction
+  or
+  instr instanceof StringConstantInstruction
+  or
+  instr instanceof FieldAddressInstruction
+  or
+  instr instanceof BinaryInstruction
+  or
+  instr instanceof UnaryInstruction and not instr instanceof CopyInstruction
+  or
+  instr instanceof PointerArithmeticInstruction
+  or
+  instr instanceof CongruentCopyInstruction
+}
+
+private predicate variableAddressValueNumber(
+  VariableAddressInstruction instr, IRFunction irFunc, IRVariable var
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  instr.getIRVariable() = var
+}
+
+private predicate initializeParameterValueNumber(
+  InitializeParameterInstruction instr, IRFunction irFunc, IRVariable var
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  instr.getIRVariable() = var
+}
+
+private predicate initializeThisValueNumber(InitializeThisInstruction instr, IRFunction irFunc) {
+  instr.getEnclosingIRFunction() = irFunc
+}
+
+private predicate constantValueNumber(
+  ConstantInstruction instr, IRFunction irFunc, IRType type, string value
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  instr.getResultIRType() = type and
+  instr.getValue() = value
+}
+
+private predicate stringConstantValueNumber(
+  StringConstantInstruction instr, IRFunction irFunc, IRType type, string value
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  instr.getResultIRType() = type and
+  instr.getValue().getValue() = value
+}
+
+private predicate fieldAddressValueNumber(
+  FieldAddressInstruction instr, IRFunction irFunc, Language::Field field,
+  TValueNumber objectAddress
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  instr.getField() = field and
+  tvalueNumber(instr.getObjectAddress()) = objectAddress
+}
+
+private predicate binaryValueNumber(
+  BinaryInstruction instr, IRFunction irFunc, Opcode opcode, IRType type, TValueNumber leftOperand,
+  TValueNumber rightOperand
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  not instr instanceof PointerArithmeticInstruction and
+  instr.getOpcode() = opcode and
+  instr.getResultIRType() = type and
+  tvalueNumber(instr.getLeft()) = leftOperand and
+  tvalueNumber(instr.getRight()) = rightOperand
+}
+
+private predicate pointerArithmeticValueNumber(
+  PointerArithmeticInstruction instr, IRFunction irFunc, Opcode opcode, IRType type,
+  int elementSize, TValueNumber leftOperand, TValueNumber rightOperand
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  instr.getOpcode() = opcode and
+  instr.getResultIRType() = type and
+  instr.getElementSize() = elementSize and
+  tvalueNumber(instr.getLeft()) = leftOperand and
+  tvalueNumber(instr.getRight()) = rightOperand
+}
+
+private predicate unaryValueNumber(
+  UnaryInstruction instr, IRFunction irFunc, Opcode opcode, IRType type, TValueNumber operand
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  not instr instanceof InheritanceConversionInstruction and
+  not instr instanceof CopyInstruction and
+  instr.getOpcode() = opcode and
+  instr.getResultIRType() = type and
+  tvalueNumber(instr.getUnary()) = operand
+}
+
+private predicate inheritanceConversionValueNumber(
+  InheritanceConversionInstruction instr, IRFunction irFunc, Opcode opcode,
+  Language::Class baseClass, Language::Class derivedClass, TValueNumber operand
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  instr.getOpcode() = opcode and
+  instr.getBaseClass() = baseClass and
+  instr.getDerivedClass() = derivedClass and
+  tvalueNumber(instr.getUnary()) = operand
+}
+
+/**
+ * Holds if `instr` should be assigned a unique value number because this library does not know how
+ * to determine if two instances of that instruction are equivalent.
+ */
+private predicate uniqueValueNumber(Instruction instr, IRFunction irFunc) {
+  instr.getEnclosingIRFunction() = irFunc and
+  not instr.getResultIRType() instanceof IRVoidType and
+  not numberableInstruction(instr)
+}
+
+/**
+ * Gets the value number assigned to `instr`, if any. Returns at most one result.
+ */
+cached
+TValueNumber tvalueNumber(Instruction instr) {
+  result = nonUniqueValueNumber(instr)
+  or
+  exists(IRFunction irFunc |
+    uniqueValueNumber(instr, irFunc) and
+    result = TUniqueValueNumber(irFunc, instr)
+  )
+}
+
+/**
+ * Gets the value number assigned to `instr`, if any, unless that instruction is assigned a unique
+ * value number.
+ */
+private TValueNumber nonUniqueValueNumber(Instruction instr) {
+  exists(IRFunction irFunc |
+    irFunc = instr.getEnclosingIRFunction() and
+    (
+      exists(IRVariable var |
+        variableAddressValueNumber(instr, irFunc, var) and
+        result = TVariableAddressValueNumber(irFunc, var)
+      )
+      or
+      exists(IRVariable var |
+        initializeParameterValueNumber(instr, irFunc, var) and
+        result = TInitializeParameterValueNumber(irFunc, var)
+      )
+      or
+      initializeThisValueNumber(instr, irFunc) and
+      result = TInitializeThisValueNumber(irFunc)
+      or
+      exists(IRType type, string value |
+        constantValueNumber(instr, irFunc, type, value) and
+        result = TConstantValueNumber(irFunc, type, value)
+      )
+      or
+      exists(IRType type, string value |
+        stringConstantValueNumber(instr, irFunc, type, value) and
+        result = TStringConstantValueNumber(irFunc, type, value)
+      )
+      or
+      exists(Language::Field field, TValueNumber objectAddress |
+        fieldAddressValueNumber(instr, irFunc, field, objectAddress) and
+        result = TFieldAddressValueNumber(irFunc, field, objectAddress)
+      )
+      or
+      exists(Opcode opcode, IRType type, TValueNumber leftOperand, TValueNumber rightOperand |
+        binaryValueNumber(instr, irFunc, opcode, type, leftOperand, rightOperand) and
+        result = TBinaryValueNumber(irFunc, opcode, type, leftOperand, rightOperand)
+      )
+      or
+      exists(Opcode opcode, IRType type, TValueNumber operand |
+        unaryValueNumber(instr, irFunc, opcode, type, operand) and
+        result = TUnaryValueNumber(irFunc, opcode, type, operand)
+      )
+      or
+      exists(
+        Opcode opcode, Language::Class baseClass, Language::Class derivedClass, TValueNumber operand
+      |
+        inheritanceConversionValueNumber(instr, irFunc, opcode, baseClass, derivedClass, operand) and
+        result = TInheritanceConversionValueNumber(irFunc, opcode, baseClass, derivedClass, operand)
+      )
+      or
+      exists(
+        Opcode opcode, IRType type, int elementSize, TValueNumber leftOperand,
+        TValueNumber rightOperand
+      |
+        pointerArithmeticValueNumber(instr, irFunc, opcode, type, elementSize, leftOperand,
+          rightOperand) and
+        result =
+          TPointerArithmeticValueNumber(irFunc, opcode, type, elementSize, leftOperand, rightOperand)
+      )
+      or
+      // The value number of a copy is just the value number of its source value.
+      result = tvalueNumber(instr.(CongruentCopyInstruction).getSourceValue())
+    )
+  )
+}

csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/gvn/ValueNumbering.qll

@@ -1,6 +1,5 @@
 private import internal.ValueNumberingInternal
 private import internal.ValueNumberingImports
-private import IR
 
 /**
  * Provides additional information about value numbering in IR dumps.
@@ -10,57 +9,38 @@ class ValueNumberPropertyProvider extends IRPropertyProvider {
     exists(ValueNumber vn |
       vn = valueNumber(instr) and
       key = "valnum" and
-      if strictcount(vn.getAnInstruction()) > 1 then result = vn.toString() else result = "unique"
+      if strictcount(vn.getAnInstruction()) > 1
+      then result = vn.getDebugString()
+      else result = "unique"
     )
   }
 }
 
-newtype TValueNumber =
-  TVariableAddressValueNumber(IRFunction irFunc, IRVariable var) {
-    variableAddressValueNumber(_, irFunc, var)
-  } or
-  TInitializeParameterValueNumber(IRFunction irFunc, IRVariable var) {
-    initializeParameterValueNumber(_, irFunc, var)
-  } or
-  TInitializeThisValueNumber(IRFunction irFunc) { initializeThisValueNumber(_, irFunc) } or
-  TConstantValueNumber(IRFunction irFunc, IRType type, string value) {
-    constantValueNumber(_, irFunc, type, value)
-  } or
-  TStringConstantValueNumber(IRFunction irFunc, IRType type, string value) {
-    stringConstantValueNumber(_, irFunc, type, value)
-  } or
-  TFieldAddressValueNumber(IRFunction irFunc, Language::Field field, ValueNumber objectAddress) {
-    fieldAddressValueNumber(_, irFunc, field, objectAddress)
-  } or
-  TBinaryValueNumber(
-    IRFunction irFunc, Opcode opcode, IRType type, ValueNumber leftOperand, ValueNumber rightOperand
-  ) {
-    binaryValueNumber(_, irFunc, opcode, type, leftOperand, rightOperand)
-  } or
-  TPointerArithmeticValueNumber(
-    IRFunction irFunc, Opcode opcode, IRType type, int elementSize, ValueNumber leftOperand,
-    ValueNumber rightOperand
-  ) {
-    pointerArithmeticValueNumber(_, irFunc, opcode, type, elementSize, leftOperand, rightOperand)
-  } or
-  TUnaryValueNumber(IRFunction irFunc, Opcode opcode, IRType type, ValueNumber operand) {
-    unaryValueNumber(_, irFunc, opcode, type, operand)
-  } or
-  TInheritanceConversionValueNumber(
-    IRFunction irFunc, Opcode opcode, Language::Class baseClass, Language::Class derivedClass,
-    ValueNumber operand
-  ) {
-    inheritanceConversionValueNumber(_, irFunc, opcode, baseClass, derivedClass, operand)
-  } or
-  TUniqueValueNumber(IRFunction irFunc, Instruction instr) { uniqueValueNumber(instr, irFunc) }
-
 /**
  * The value number assigned to a particular set of instructions that produce equivalent results.
  */
 class ValueNumber extends TValueNumber {
-  final string toString() { result = getExampleInstruction().getResultId() }
+  final string toString() { result = "GVN" }
 
-  final Language::Location getLocation() { result = getExampleInstruction().getLocation() }
+  final string getDebugString() { result = strictconcat(getAnInstruction().getResultId(), ", ") }
+
+  final Language::Location getLocation() {
+    if
+      exists(Instruction i |
+        i = getAnInstruction() and not i.getLocation() instanceof UnknownLocation
+      )
+    then
+      result =
+        min(Language::Location l |
+          l = getAnInstruction().getLocation() and not l instanceof UnknownLocation
+        |
+          l
+          order by
+            l.getFile().getAbsolutePath(), l.getStartLine(), l.getStartColumn(), l.getEndLine(),
+            l.getEndColumn()
+        )
+    else result instanceof UnknownDefaultLocation
+  }
 
   /**
    * Gets the instructions that have been assigned this value number. This will always produce at
@@ -85,236 +65,39 @@ class ValueNumber extends TValueNumber {
    * Gets an `Operand` whose definition is exact and has this value number.
    */
   final Operand getAUse() { this = valueNumber(result.getDef()) }
-}
 
-/**
- * A `CopyInstruction` whose source operand's value is congruent to the definition of that source
- * operand.
- * For example:
- * ```
- * Point p = { 1, 2 };
- * Point q = p;
- * int a = p.x;
- * ```
- * The use of `p` on line 2 is linked to the definition of `p` on line 1, and is congruent to that
- * definition because it accesses the exact same memory.
- * The use of `p.x` on line 3 is linked to the definition of `p` on line 1 as well, but is not
- * congruent to that definition because `p.x` accesses only a subset of the memory defined by `p`.
- */
-private class CongruentCopyInstruction extends CopyInstruction {
-  CongruentCopyInstruction() {
-    this.getSourceValueOperand().getDefinitionOverlap() instanceof MustExactlyOverlap
+  final string getKind() {
+    this instanceof TVariableAddressValueNumber and result = "VariableAddress"
+    or
+    this instanceof TInitializeParameterValueNumber and result = "InitializeParameter"
+    or
+    this instanceof TInitializeThisValueNumber and result = "InitializeThis"
+    or
+    this instanceof TStringConstantValueNumber and result = "StringConstant"
+    or
+    this instanceof TFieldAddressValueNumber and result = "FieldAddress"
+    or
+    this instanceof TBinaryValueNumber and result = "Binary"
+    or
+    this instanceof TPointerArithmeticValueNumber and result = "PointerArithmetic"
+    or
+    this instanceof TUnaryValueNumber and result = "Unary"
+    or
+    this instanceof TInheritanceConversionValueNumber and result = "InheritanceConversion"
+    or
+    this instanceof TLoadTotalOverlapValueNumber and result = "LoadTotalOverlap"
+    or
+    this instanceof TUniqueValueNumber and result = "Unique"
   }
 }
 
-/**
- * Holds if this library knows how to assign a value number to the specified instruction, other than
- * a `unique` value number that is never shared by multiple instructions.
- */
-private predicate numberableInstruction(Instruction instr) {
-  instr instanceof VariableAddressInstruction
-  or
-  instr instanceof InitializeParameterInstruction
-  or
-  instr instanceof InitializeThisInstruction
-  or
-  instr instanceof ConstantInstruction
-  or
-  instr instanceof StringConstantInstruction
-  or
-  instr instanceof FieldAddressInstruction
-  or
-  instr instanceof BinaryInstruction
-  or
-  instr instanceof UnaryInstruction and not instr instanceof CopyInstruction
-  or
-  instr instanceof PointerArithmeticInstruction
-  or
-  instr instanceof CongruentCopyInstruction
-}
-
-private predicate variableAddressValueNumber(
-  VariableAddressInstruction instr, IRFunction irFunc, IRVariable var
-) {
-  instr.getEnclosingIRFunction() = irFunc and
-  instr.getIRVariable() = var
-}
-
-private predicate initializeParameterValueNumber(
-  InitializeParameterInstruction instr, IRFunction irFunc, IRVariable var
-) {
-  instr.getEnclosingIRFunction() = irFunc and
-  instr.getIRVariable() = var
-}
-
-private predicate initializeThisValueNumber(InitializeThisInstruction instr, IRFunction irFunc) {
-  instr.getEnclosingIRFunction() = irFunc
-}
-
-private predicate constantValueNumber(
-  ConstantInstruction instr, IRFunction irFunc, IRType type, string value
-) {
-  instr.getEnclosingIRFunction() = irFunc and
-  instr.getResultIRType() = type and
-  instr.getValue() = value
-}
-
-private predicate stringConstantValueNumber(
-  StringConstantInstruction instr, IRFunction irFunc, IRType type, string value
-) {
-  instr.getEnclosingIRFunction() = irFunc and
-  instr.getResultIRType() = type and
-  instr.getValue().getValue() = value
-}
-
-private predicate fieldAddressValueNumber(
-  FieldAddressInstruction instr, IRFunction irFunc, Language::Field field, ValueNumber objectAddress
-) {
-  instr.getEnclosingIRFunction() = irFunc and
-  instr.getField() = field and
-  valueNumber(instr.getObjectAddress()) = objectAddress
-}
-
-private predicate binaryValueNumber(
-  BinaryInstruction instr, IRFunction irFunc, Opcode opcode, IRType type, ValueNumber leftOperand,
-  ValueNumber rightOperand
-) {
-  instr.getEnclosingIRFunction() = irFunc and
-  not instr instanceof PointerArithmeticInstruction and
-  instr.getOpcode() = opcode and
-  instr.getResultIRType() = type and
-  valueNumber(instr.getLeft()) = leftOperand and
-  valueNumber(instr.getRight()) = rightOperand
-}
-
-private predicate pointerArithmeticValueNumber(
-  PointerArithmeticInstruction instr, IRFunction irFunc, Opcode opcode, IRType type,
-  int elementSize, ValueNumber leftOperand, ValueNumber rightOperand
-) {
-  instr.getEnclosingIRFunction() = irFunc and
-  instr.getOpcode() = opcode and
-  instr.getResultIRType() = type and
-  instr.getElementSize() = elementSize and
-  valueNumber(instr.getLeft()) = leftOperand and
-  valueNumber(instr.getRight()) = rightOperand
-}
-
-private predicate unaryValueNumber(
-  UnaryInstruction instr, IRFunction irFunc, Opcode opcode, IRType type, ValueNumber operand
-) {
-  instr.getEnclosingIRFunction() = irFunc and
-  not instr instanceof InheritanceConversionInstruction and
-  not instr instanceof CopyInstruction and
-  instr.getOpcode() = opcode and
-  instr.getResultIRType() = type and
-  valueNumber(instr.getUnary()) = operand
-}
-
-private predicate inheritanceConversionValueNumber(
-  InheritanceConversionInstruction instr, IRFunction irFunc, Opcode opcode,
-  Language::Class baseClass, Language::Class derivedClass, ValueNumber operand
-) {
-  instr.getEnclosingIRFunction() = irFunc and
-  instr.getOpcode() = opcode and
-  instr.getBaseClass() = baseClass and
-  instr.getDerivedClass() = derivedClass and
-  valueNumber(instr.getUnary()) = operand
-}
-
-/**
- * Holds if `instr` should be assigned a unique value number because this library does not know how
- * to determine if two instances of that instruction are equivalent.
- */
-private predicate uniqueValueNumber(Instruction instr, IRFunction irFunc) {
-  instr.getEnclosingIRFunction() = irFunc and
-  not instr.getResultIRType() instanceof IRVoidType and
-  not numberableInstruction(instr)
-}
-
 /**
  * Gets the value number assigned to `instr`, if any. Returns at most one result.
  */
-cached
-ValueNumber valueNumber(Instruction instr) {
-  result = nonUniqueValueNumber(instr)
-  or
-  exists(IRFunction irFunc |
-    uniqueValueNumber(instr, irFunc) and
-    result = TUniqueValueNumber(irFunc, instr)
-  )
-}
+ValueNumber valueNumber(Instruction instr) { result = tvalueNumber(instr) }
 
 /**
  * Gets the value number assigned to the exact definition of `op`, if any.
  * Returns at most one result.
  */
-ValueNumber valueNumberOfOperand(Operand op) { result = valueNumber(op.getDef()) }
-
-/**
- * Gets the value number assigned to `instr`, if any, unless that instruction is assigned a unique
- * value number.
- */
-private ValueNumber nonUniqueValueNumber(Instruction instr) {
-  exists(IRFunction irFunc |
-    irFunc = instr.getEnclosingIRFunction() and
-    (
-      exists(IRVariable var |
-        variableAddressValueNumber(instr, irFunc, var) and
-        result = TVariableAddressValueNumber(irFunc, var)
-      )
-      or
-      exists(IRVariable var |
-        initializeParameterValueNumber(instr, irFunc, var) and
-        result = TInitializeParameterValueNumber(irFunc, var)
-      )
-      or
-      initializeThisValueNumber(instr, irFunc) and
-      result = TInitializeThisValueNumber(irFunc)
-      or
-      exists(IRType type, string value |
-        constantValueNumber(instr, irFunc, type, value) and
-        result = TConstantValueNumber(irFunc, type, value)
-      )
-      or
-      exists(IRType type, string value |
-        stringConstantValueNumber(instr, irFunc, type, value) and
-        result = TStringConstantValueNumber(irFunc, type, value)
-      )
-      or
-      exists(Language::Field field, ValueNumber objectAddress |
-        fieldAddressValueNumber(instr, irFunc, field, objectAddress) and
-        result = TFieldAddressValueNumber(irFunc, field, objectAddress)
-      )
-      or
-      exists(Opcode opcode, IRType type, ValueNumber leftOperand, ValueNumber rightOperand |
-        binaryValueNumber(instr, irFunc, opcode, type, leftOperand, rightOperand) and
-        result = TBinaryValueNumber(irFunc, opcode, type, leftOperand, rightOperand)
-      )
-      or
-      exists(Opcode opcode, IRType type, ValueNumber operand |
-        unaryValueNumber(instr, irFunc, opcode, type, operand) and
-        result = TUnaryValueNumber(irFunc, opcode, type, operand)
-      )
-      or
-      exists(
-        Opcode opcode, Language::Class baseClass, Language::Class derivedClass, ValueNumber operand
-      |
-        inheritanceConversionValueNumber(instr, irFunc, opcode, baseClass, derivedClass, operand) and
-        result = TInheritanceConversionValueNumber(irFunc, opcode, baseClass, derivedClass, operand)
-      )
-      or
-      exists(
-        Opcode opcode, IRType type, int elementSize, ValueNumber leftOperand,
-        ValueNumber rightOperand
-      |
-        pointerArithmeticValueNumber(instr, irFunc, opcode, type, elementSize, leftOperand,
-          rightOperand) and
-        result =
-          TPointerArithmeticValueNumber(irFunc, opcode, type, elementSize, leftOperand, rightOperand)
-      )
-      or
-      // The value number of a copy is just the value number of its source value.
-      result = valueNumber(instr.(CongruentCopyInstruction).getSourceValue())
-    )
-  )
-}
+ValueNumber valueNumberOfOperand(Operand op) { result = tvalueNumberOfOperand(op) }

csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/gvn/internal/ValueNumberingInternal.qll

@@ -1,2 +1,309 @@
-import semmle.code.csharp.ir.implementation.unaliased_ssa.IR as IR
+private import ValueNumberingImports
 import semmle.code.csharp.ir.internal.IRCSharpLanguage as Language
+import semmle.code.csharp.ir.implementation.unaliased_ssa.IR
+private import semmle.code.csharp.Location
+
+class UnknownLocation = EmptyLocation;
+
+class UnknownDefaultLocation = EmptyLocation;
+
+newtype TValueNumber =
+  TVariableAddressValueNumber(IRFunction irFunc, IRVariable var) {
+    variableAddressValueNumber(_, irFunc, var)
+  } or
+  TInitializeParameterValueNumber(IRFunction irFunc, IRVariable var) {
+    initializeParameterValueNumber(_, irFunc, var)
+  } or
+  TInitializeThisValueNumber(IRFunction irFunc) { initializeThisValueNumber(_, irFunc) } or
+  TConstantValueNumber(IRFunction irFunc, IRType type, string value) {
+    constantValueNumber(_, irFunc, type, value)
+  } or
+  TStringConstantValueNumber(IRFunction irFunc, IRType type, string value) {
+    stringConstantValueNumber(_, irFunc, type, value)
+  } or
+  TFieldAddressValueNumber(IRFunction irFunc, Language::Field field, TValueNumber objectAddress) {
+    fieldAddressValueNumber(_, irFunc, field, objectAddress)
+  } or
+  TBinaryValueNumber(
+    IRFunction irFunc, Opcode opcode, IRType type, TValueNumber leftOperand,
+    TValueNumber rightOperand
+  ) {
+    binaryValueNumber(_, irFunc, opcode, type, leftOperand, rightOperand)
+  } or
+  TPointerArithmeticValueNumber(
+    IRFunction irFunc, Opcode opcode, IRType type, int elementSize, TValueNumber leftOperand,
+    TValueNumber rightOperand
+  ) {
+    pointerArithmeticValueNumber(_, irFunc, opcode, type, elementSize, leftOperand, rightOperand)
+  } or
+  TUnaryValueNumber(IRFunction irFunc, Opcode opcode, IRType type, TValueNumber operand) {
+    unaryValueNumber(_, irFunc, opcode, type, operand)
+  } or
+  TInheritanceConversionValueNumber(
+    IRFunction irFunc, Opcode opcode, Language::Class baseClass, Language::Class derivedClass,
+    TValueNumber operand
+  ) {
+    inheritanceConversionValueNumber(_, irFunc, opcode, baseClass, derivedClass, operand)
+  } or
+  TLoadTotalOverlapValueNumber(
+    IRFunction irFunc, IRType type, TValueNumber memOperand, TValueNumber operand
+  ) {
+    loadTotalOverlapValueNumber(_, irFunc, type, memOperand, operand)
+  } or
+  TUniqueValueNumber(IRFunction irFunc, Instruction instr) { uniqueValueNumber(instr, irFunc) }
+
+/**
+ * A `CopyInstruction` whose source operand's value is congruent to the definition of that source
+ * operand.
+ * For example:
+ * ```
+ * Point p = { 1, 2 };
+ * Point q = p;
+ * int a = p.x;
+ * ```
+ * The use of `p` on line 2 is linked to the definition of `p` on line 1, and is congruent to that
+ * definition because it accesses the exact same memory.
+ * The use of `p.x` on line 3 is linked to the definition of `p` on line 1 as well, but is not
+ * congruent to that definition because `p.x` accesses only a subset of the memory defined by `p`.
+ */
+class CongruentCopyInstruction extends CopyInstruction {
+  CongruentCopyInstruction() {
+    this.getSourceValueOperand().getDefinitionOverlap() instanceof MustExactlyOverlap
+  }
+}
+
+class LoadTotalOverlapInstruction extends LoadInstruction {
+  LoadTotalOverlapInstruction() {
+    this.getSourceValueOperand().getDefinitionOverlap() instanceof MustTotallyOverlap
+  }
+}
+
+/**
+ * Holds if this library knows how to assign a value number to the specified instruction, other than
+ * a `unique` value number that is never shared by multiple instructions.
+ */
+private predicate numberableInstruction(Instruction instr) {
+  instr instanceof VariableAddressInstruction
+  or
+  instr instanceof InitializeParameterInstruction
+  or
+  instr instanceof InitializeThisInstruction
+  or
+  instr instanceof ConstantInstruction
+  or
+  instr instanceof StringConstantInstruction
+  or
+  instr instanceof FieldAddressInstruction
+  or
+  instr instanceof BinaryInstruction
+  or
+  instr instanceof UnaryInstruction and not instr instanceof CopyInstruction
+  or
+  instr instanceof PointerArithmeticInstruction
+  or
+  instr instanceof CongruentCopyInstruction
+  or
+  instr instanceof LoadTotalOverlapInstruction
+}
+
+private predicate variableAddressValueNumber(
+  VariableAddressInstruction instr, IRFunction irFunc, IRVariable var
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  instr.getIRVariable() = var
+}
+
+private predicate initializeParameterValueNumber(
+  InitializeParameterInstruction instr, IRFunction irFunc, IRVariable var
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  instr.getIRVariable() = var
+}
+
+private predicate initializeThisValueNumber(InitializeThisInstruction instr, IRFunction irFunc) {
+  instr.getEnclosingIRFunction() = irFunc
+}
+
+private predicate constantValueNumber(
+  ConstantInstruction instr, IRFunction irFunc, IRType type, string value
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  instr.getResultIRType() = type and
+  instr.getValue() = value
+}
+
+private predicate stringConstantValueNumber(
+  StringConstantInstruction instr, IRFunction irFunc, IRType type, string value
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  instr.getResultIRType() = type and
+  instr.getValue().getValue() = value
+}
+
+private predicate fieldAddressValueNumber(
+  FieldAddressInstruction instr, IRFunction irFunc, Language::Field field,
+  TValueNumber objectAddress
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  instr.getField() = field and
+  tvalueNumber(instr.getObjectAddress()) = objectAddress
+}
+
+private predicate binaryValueNumber(
+  BinaryInstruction instr, IRFunction irFunc, Opcode opcode, IRType type, TValueNumber leftOperand,
+  TValueNumber rightOperand
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  not instr instanceof PointerArithmeticInstruction and
+  instr.getOpcode() = opcode and
+  instr.getResultIRType() = type and
+  tvalueNumber(instr.getLeft()) = leftOperand and
+  tvalueNumber(instr.getRight()) = rightOperand
+}
+
+private predicate pointerArithmeticValueNumber(
+  PointerArithmeticInstruction instr, IRFunction irFunc, Opcode opcode, IRType type,
+  int elementSize, TValueNumber leftOperand, TValueNumber rightOperand
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  instr.getOpcode() = opcode and
+  instr.getResultIRType() = type and
+  instr.getElementSize() = elementSize and
+  tvalueNumber(instr.getLeft()) = leftOperand and
+  tvalueNumber(instr.getRight()) = rightOperand
+}
+
+private predicate unaryValueNumber(
+  UnaryInstruction instr, IRFunction irFunc, Opcode opcode, IRType type, TValueNumber operand
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  not instr instanceof InheritanceConversionInstruction and
+  not instr instanceof CopyInstruction and
+  instr.getOpcode() = opcode and
+  instr.getResultIRType() = type and
+  tvalueNumber(instr.getUnary()) = operand
+}
+
+private predicate inheritanceConversionValueNumber(
+  InheritanceConversionInstruction instr, IRFunction irFunc, Opcode opcode,
+  Language::Class baseClass, Language::Class derivedClass, TValueNumber operand
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  instr.getOpcode() = opcode and
+  instr.getBaseClass() = baseClass and
+  instr.getDerivedClass() = derivedClass and
+  tvalueNumber(instr.getUnary()) = operand
+}
+
+private predicate loadTotalOverlapValueNumber(
+  LoadTotalOverlapInstruction instr, IRFunction irFunc, IRType type, TValueNumber memOperand,
+  TValueNumber operand
+) {
+  instr.getEnclosingIRFunction() = irFunc and
+  instr.getResultIRType() = type and
+  tvalueNumber(instr.getAnOperand().(MemoryOperand).getAnyDef()) = memOperand and
+  tvalueNumberOfOperand(instr.getAnOperand().(AddressOperand)) = operand
+}
+
+/**
+ * Holds if `instr` should be assigned a unique value number because this library does not know how
+ * to determine if two instances of that instruction are equivalent.
+ */
+private predicate uniqueValueNumber(Instruction instr, IRFunction irFunc) {
+  instr.getEnclosingIRFunction() = irFunc and
+  not instr.getResultIRType() instanceof IRVoidType and
+  not numberableInstruction(instr)
+}
+
+/**
+ * Gets the value number assigned to `instr`, if any. Returns at most one result.
+ */
+cached
+TValueNumber tvalueNumber(Instruction instr) {
+  result = nonUniqueValueNumber(instr)
+  or
+  exists(IRFunction irFunc |
+    uniqueValueNumber(instr, irFunc) and
+    result = TUniqueValueNumber(irFunc, instr)
+  )
+}
+
+/**
+ * Gets the value number assigned to the exact definition of `op`, if any.
+ * Returns at most one result.
+ */
+TValueNumber tvalueNumberOfOperand(Operand op) { result = tvalueNumber(op.getDef()) }
+
+/**
+ * Gets the value number assigned to `instr`, if any, unless that instruction is assigned a unique
+ * value number.
+ */
+private TValueNumber nonUniqueValueNumber(Instruction instr) {
+  exists(IRFunction irFunc |
+    irFunc = instr.getEnclosingIRFunction() and
+    (
+      exists(IRVariable var |
+        variableAddressValueNumber(instr, irFunc, var) and
+        result = TVariableAddressValueNumber(irFunc, var)
+      )
+      or
+      exists(IRVariable var |
+        initializeParameterValueNumber(instr, irFunc, var) and
+        result = TInitializeParameterValueNumber(irFunc, var)
+      )
+      or
+      initializeThisValueNumber(instr, irFunc) and
+      result = TInitializeThisValueNumber(irFunc)
+      or
+      exists(IRType type, string value |
+        constantValueNumber(instr, irFunc, type, value) and
+        result = TConstantValueNumber(irFunc, type, value)
+      )
+      or
+      exists(IRType type, string value |
+        stringConstantValueNumber(instr, irFunc, type, value) and
+        result = TStringConstantValueNumber(irFunc, type, value)
+      )
+      or
+      exists(Language::Field field, TValueNumber objectAddress |
+        fieldAddressValueNumber(instr, irFunc, field, objectAddress) and
+        result = TFieldAddressValueNumber(irFunc, field, objectAddress)
+      )
+      or
+      exists(Opcode opcode, IRType type, TValueNumber leftOperand, TValueNumber rightOperand |
+        binaryValueNumber(instr, irFunc, opcode, type, leftOperand, rightOperand) and
+        result = TBinaryValueNumber(irFunc, opcode, type, leftOperand, rightOperand)
+      )
+      or
+      exists(Opcode opcode, IRType type, TValueNumber operand |
+        unaryValueNumber(instr, irFunc, opcode, type, operand) and
+        result = TUnaryValueNumber(irFunc, opcode, type, operand)
+      )
+      or
+      exists(
+        Opcode opcode, Language::Class baseClass, Language::Class derivedClass, TValueNumber operand
+      |
+        inheritanceConversionValueNumber(instr, irFunc, opcode, baseClass, derivedClass, operand) and
+        result = TInheritanceConversionValueNumber(irFunc, opcode, baseClass, derivedClass, operand)
+      )
+      or
+      exists(
+        Opcode opcode, IRType type, int elementSize, TValueNumber leftOperand,
+        TValueNumber rightOperand
+      |
+        pointerArithmeticValueNumber(instr, irFunc, opcode, type, elementSize, leftOperand,
+          rightOperand) and
+        result =
+          TPointerArithmeticValueNumber(irFunc, opcode, type, elementSize, leftOperand, rightOperand)
+      )
+      or
+      exists(IRType type, TValueNumber memOperand, TValueNumber operand |
+        loadTotalOverlapValueNumber(instr, irFunc, type, memOperand, operand) and
+        result = TLoadTotalOverlapValueNumber(irFunc, type, memOperand, operand)
+      )
+      or
+      // The value number of a copy is just the value number of its source value.
+      result = tvalueNumber(instr.(CongruentCopyInstruction).getSourceValue())
+    )
+  )
+}

csharp/ql/test/query-tests/Dead Code/DeadStoreOfLocal/DeadStoreOfLocal.cs

@@ -389,6 +389,20 @@ class Initializers
             return s;
         return null;
     }
+
+    string M8()
+    {
+        string s = default; // "GOOD"
+        s = "";
+        return s;
+    }
+
+    string M9()
+    {
+        var s = (string)null; // "GOOD"
+        s = "";
+        return s;
+    }
 }
 
 class Anonymous

docs/language/ql-handbook/modules.rst

@@ -160,7 +160,7 @@ into the :ref:`namespace <namespaces>` of the current module.
 Import statements
 =================
 
-Import statements are used for importing modules and are of the form::
+Import statements are used for importing modules. They are of the form::
 
     import <module_expression1> as <name>
     import <module_expression2>
@@ -175,3 +175,6 @@ for example ``import javascript as js``.
 
 The ``<module_expression>`` itself can be a module name, a selection, or a qualified
 reference. See :ref:`name-resolution` for more details.
+
+For information about how import statements are looked up, see `Module resolution <https://help.semmle.com/QL/ql-spec/language.html#module-resolution>`__
+in the QL language specification. 

java/ql/src/semmle/code/java/dataflow/internal/ContainerFlow.qll

@@ -161,10 +161,27 @@ private predicate argToQualifierStep(Expr tracked, Expr sink) {
 /**
  * Holds if the step from `n1` to `n2` is either extracting a value from a
  * container, inserting a value into a container, or transforming one container
- * to another.
+ * to another. This is restricted to cases where `n2` is the returned value of
+ * a call.
  */
-predicate containerStep(Expr n1, Expr n2) {
-  qualifierToMethodStep(n1, n2) or
+predicate containerReturnValueStep(Expr n1, Expr n2) { qualifierToMethodStep(n1, n2) }
+
+/**
+ * Holds if the step from `n1` to `n2` is either extracting a value from a
+ * container, inserting a value into a container, or transforming one container
+ * to another. This is restricted to cases where the value of `n2` is being modified.
+ */
+predicate containerUpdateStep(Expr n1, Expr n2) {
   qualifierToArgumentStep(n1, n2) or
   argToQualifierStep(n1, n2)
 }
+
+/**
+ * Holds if the step from `n1` to `n2` is either extracting a value from a
+ * container, inserting a value into a container, or transforming one container
+ * to another.
+ */
+predicate containerStep(Expr n1, Expr n2) {
+  containerReturnValueStep(n1, n2) or
+  containerUpdateStep(n1, n2)
+}

java/ql/src/semmle/code/java/dataflow/internal/DataFlowUtil.qll

@@ -26,6 +26,8 @@ private newtype TNode =
     e instanceof Argument and not e.getType() instanceof ImmutableType
     or
     exists(FieldAccess fa | fa.getField() instanceof InstanceField and e = fa.getQualifier())
+    or
+    exists(ArrayAccess aa | e = aa.getArray())
   } or
   TImplicitExprPostUpdate(InstanceAccessExt ia) {
     implicitInstanceArgument(_, ia)

java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll

@@ -41,6 +41,9 @@ predicate localTaintStep(DataFlow::Node src, DataFlow::Node sink) {
 predicate localAdditionalTaintStep(DataFlow::Node src, DataFlow::Node sink) {
   localAdditionalTaintExprStep(src.asExpr(), sink.asExpr())
   or
+  localAdditionalTaintUpdateStep(src.asExpr(),
+    sink.(DataFlow::PostUpdateNode).getPreUpdateNode().asExpr())
+  or
   exists(Argument arg |
     src.asExpr() = arg and
     arg.isVararg() and
@@ -105,30 +108,20 @@ private predicate localAdditionalTaintExprStep(Expr src, Expr sink) {
   or
   sink.(LogicExpr).getAnOperand() = src
   or
-  exists(Assignment assign | assign.getSource() = src |
-    sink = assign.getDest().(ArrayAccess).getArray()
-  )
-  or
   exists(EnhancedForStmt for, SsaExplicitUpdate v |
     for.getExpr() = src and
     v.getDefiningExpr() = for.getVariable() and
     v.getAFirstUse() = sink
   )
   or
-  containerStep(src, sink)
+  containerReturnValueStep(src, sink)
   or
   constructorStep(src, sink)
   or
   qualifierToMethodStep(src, sink)
   or
-  qualifierToArgumentStep(src, sink)
-  or
   argToMethodStep(src, sink)
   or
-  argToArgStep(src, sink)
-  or
-  argToQualifierStep(src, sink)
-  or
   comparisonStep(src, sink)
   or
   stringBuilderStep(src, sink)
@@ -136,6 +129,26 @@ private predicate localAdditionalTaintExprStep(Expr src, Expr sink) {
   serializationStep(src, sink)
 }
 
+/**
+ * Holds if taint can flow in one local step from `src` to `sink` excluding
+ * local data flow steps. That is, `src` and `sink` are likely to represent
+ * different objects.
+ * This is restricted to cases where the step updates the value of `sink`.
+ */
+private predicate localAdditionalTaintUpdateStep(Expr src, Expr sink) {
+  exists(Assignment assign | assign.getSource() = src |
+    sink = assign.getDest().(ArrayAccess).getArray()
+  )
+  or
+  containerUpdateStep(src, sink)
+  or
+  qualifierToArgumentStep(src, sink)
+  or
+  argToArgStep(src, sink)
+  or
+  argToQualifierStep(src, sink)
+}
+
 private class BulkData extends RefType {
   BulkData() {
     this.(Array).getElementType().(PrimitiveType).getName().regexpMatch("byte|char")
@@ -242,7 +255,7 @@ private predicate constructorStep(Expr tracked, ConstructorCall sink) {
 }
 
 /** Access to a method that passes taint from qualifier to argument. */
-private predicate qualifierToArgumentStep(Expr tracked, RValue sink) {
+private predicate qualifierToArgumentStep(Expr tracked, Expr sink) {
   exists(MethodAccess ma, int arg |
     taintPreservingQualifierToArgument(ma.getMethod(), arg) and
     tracked = ma.getQualifier() and
@@ -458,7 +471,7 @@ private predicate taintPreservingArgumentToMethod(Method method, int arg) {
  * Holds if `tracked` and `sink` are arguments to a method that transfers taint
  * between arguments.
  */
-private predicate argToArgStep(Expr tracked, RValue sink) {
+private predicate argToArgStep(Expr tracked, Expr sink) {
   exists(MethodAccess ma, Method method, int input, int output |
     taintPreservingArgToArg(method, input, output) and
     ma.getMethod() = method and

java/ql/test/library-tests/dataflow/taint-ioutils/dataFlow.expected

@@ -19,36 +19,36 @@
 | Test.java:22:20:22:52 | toInputStream(...) |
 | Test.java:22:42:22:42 | s |
 | Test.java:26:16:26:18 | inp |
-| Test.java:26:21:26:26 | writer |
+| Test.java:26:21:26:26 | writer [post update] |
 | Test.java:27:3:27:8 | writer |
 | Test.java:27:3:27:19 | toString(...) |
 | Test.java:31:21:31:27 | bufread |
-| Test.java:31:30:31:35 | writer |
+| Test.java:31:30:31:35 | writer [post update] |
 | Test.java:32:3:32:8 | writer |
 | Test.java:32:3:32:19 | toString(...) |
 | Test.java:37:16:37:18 | inp |
-| Test.java:37:21:37:23 | tgt |
+| Test.java:37:21:37:23 | tgt [post update] |
 | Test.java:38:3:38:12 | ...=... |
 | Test.java:38:7:38:9 | tgt |
 | Test.java:38:7:38:12 | ...[...] |
 | Test.java:42:21:42:23 | inp |
-| Test.java:42:26:42:28 | tgt |
+| Test.java:42:26:42:28 | tgt [post update] |
 | Test.java:43:3:43:12 | ...=... |
 | Test.java:43:7:43:9 | tgt |
 | Test.java:43:7:43:12 | ...[...] |
 | Test.java:47:17:47:21 | chars |
-| Test.java:47:24:47:29 | writer |
+| Test.java:47:24:47:29 | writer [post update] |
 | Test.java:48:3:48:8 | writer |
 | Test.java:48:3:48:19 | toString(...) |
 | Test.java:52:24:52:28 | chars |
-| Test.java:52:31:52:36 | writer |
+| Test.java:52:31:52:36 | writer [post update] |
 | Test.java:53:3:53:8 | writer |
 | Test.java:53:3:53:19 | toString(...) |
 | Test.java:57:22:57:26 | lines |
-| Test.java:57:35:57:40 | writer |
+| Test.java:57:35:57:40 | writer [post update] |
 | Test.java:58:3:58:8 | writer |
 | Test.java:58:3:58:19 | toString(...) |
 | Test.java:62:47:62:47 | s |
-| Test.java:62:50:62:55 | writer |
+| Test.java:62:50:62:55 | writer [post update] |
 | Test.java:63:3:63:8 | writer |
 | Test.java:63:3:63:19 | toString(...) |

java/ql/test/library-tests/dataflow/taint/A.java

@@ -24,4 +24,52 @@ public class A {
     bInput.read(b2);
     sink(b2);
   }
+
+  void streamWrite(ByteArrayOutputStream baos, byte[] data) {
+    baos.write(data);
+  }
+
+  void test3(ByteArrayOutputStream baos) {
+    streamWrite(baos, taint());
+    sink(baos.toByteArray());
+  }
+
+  static class BaosHolder {
+    ByteArrayOutputStream baos = new ByteArrayOutputStream();
+  }
+
+  void streamWriteHolder(BaosHolder bh, byte[] data) {
+    bh.baos.write(data);
+  }
+
+  void test4(BaosHolder bh) {
+    streamWriteHolder(bh, taint());
+    sink(bh.baos.toByteArray());
+  }
+
+  static class DataHolder {
+    byte[] data = new byte[10];
+  }
+
+  void test5_a(DataHolder dh) {
+    ByteArrayInputStream bais = new ByteArrayInputStream(taint());
+    bais.read(dh.data);
+    test5_b(dh);
+  }
+
+  void test5_b(DataHolder dh) {
+    sink(dh.data);
+  }
+
+  void arrayWrite(byte[] from, byte[] to) {
+    for (int i = 0; i < 10; i++) {
+      to[i] = from[i];
+    }
+  }
+
+  void test6() {
+    byte[] b = new byte[10];
+    arrayWrite(taint(), b);
+    sink(b);
+  }
 }

java/ql/test/library-tests/dataflow/taint/test.expected

@@ -1,5 +1,9 @@
 | A.java:10:19:10:25 | taint(...) | A.java:15:10:15:11 | b2 |
 | A.java:20:19:20:25 | taint(...) | A.java:25:10:25:11 | b2 |
+| A.java:33:23:33:29 | taint(...) | A.java:34:10:34:27 | toByteArray(...) |
+| A.java:46:27:46:33 | taint(...) | A.java:47:10:47:30 | toByteArray(...) |
+| A.java:55:58:55:64 | taint(...) | A.java:61:10:61:16 | dh.data |
+| A.java:72:16:72:22 | taint(...) | A.java:73:10:73:10 | b |
 | B.java:15:21:15:27 | taint(...) | B.java:18:10:18:16 | aaaargs |
 | B.java:15:21:15:27 | taint(...) | B.java:21:10:21:10 | s |
 | B.java:15:21:15:27 | taint(...) | B.java:24:10:24:15 | concat |

javascript/extractor/src/com/semmle/js/extractor/Main.java

@@ -37,7 +37,7 @@ public class Main {
    * A version identifier that should be updated every time the extractor changes in such a way that
    * it may produce different tuples for the same file under the same {@link ExtractorConfig}.
    */
-  public static final String EXTRACTOR_VERSION = "2020-01-06";
+  public static final String EXTRACTOR_VERSION = "2020-02-05";
 
   public static final Pattern NEWLINE = Pattern.compile("\n");
 

javascript/ql/src/Security/CWE-400/PrototypePollutionUtility.ql

@@ -42,12 +42,19 @@ SourceNode getAnEnumeratedArrayElement(SourceNode array) {
  */
 abstract class EnumeratedPropName extends DataFlow::Node {
   /**
-   * Gets the object whose properties are being enumerated.
+   * Gets the data flow node holding the object whose properties are being enumerated.
    *
    * For example, gets `src` in `for (var key in src)`.
    */
   abstract DataFlow::Node getSourceObject();
 
+  /**
+   * Gets a source node that refers to the object whose properties are being enumerated.
+   */
+  DataFlow::SourceNode getASourceObjectRef() {
+    result = AccessPath::getAnAliasedSourceNode(getSourceObject())
+  }
+
   /**
    * Gets a property read that accesses the corresponding property value in the source object.
    *
@@ -56,7 +63,7 @@ abstract class EnumeratedPropName extends DataFlow::Node {
   SourceNode getASourceProp() {
     exists(Node base, Node key |
       dynamicPropReadStep(base, key, result) and
-      AccessPath::getAnAliasedSourceNode(getSourceObject()).flowsTo(base) and
+      getASourceObjectRef().flowsTo(base) and
       key.getImmediatePredecessor*() = this
     )
   }
@@ -113,11 +120,57 @@ class EntriesEnumeratedPropName extends EnumeratedPropName {
   }
 }
 
+/**
+ * Gets a function that enumerates object properties when invoked.
+ *
+ * Invocations takes the following form:
+ * ```js
+ * fn(obj, (value, key, o) => { ... })
+ * ```
+ */
+SourceNode propertyEnumerator() {
+  result = moduleImport("for-own") or
+  result = moduleImport("for-in") or
+  result = moduleMember("ramda", "forEachObjIndexed") or
+  result = LodashUnderscore::member("forEach") or
+  result = LodashUnderscore::member("each")
+}
+
+/**
+ * Property enumeration through a library function taking a callback.
+ */
+class LibraryCallbackEnumeratedPropName extends EnumeratedPropName {
+  CallNode call;
+  FunctionNode callback;
+
+  LibraryCallbackEnumeratedPropName() {
+    call = propertyEnumerator().getACall() and
+    callback = call.getCallback(1) and
+    this = callback.getParameter(1)
+  }
+
+  override Node getSourceObject() {
+    result = call.getArgument(0)
+  }
+
+  override SourceNode getASourceObjectRef() {
+    result = super.getASourceObjectRef()
+    or
+    result = callback.getParameter(2)
+  }
+
+  override SourceNode getASourceProp() {
+    result = super.getASourceProp()
+    or
+    result = callback.getParameter(0)
+  }
+}
+
 /**
  * Holds if the properties of `node` are enumerated locally.
  */
 predicate arePropertiesEnumerated(DataFlow::SourceNode node) {
-  node = AccessPath::getAnAliasedSourceNode(any(EnumeratedPropName name).getSourceObject())
+  node = any(EnumeratedPropName name).getASourceObjectRef()
 }
 
 /**

javascript/ql/src/javascript.qll

@@ -78,6 +78,7 @@ import semmle.javascript.frameworks.Files
 import semmle.javascript.frameworks.Firebase
 import semmle.javascript.frameworks.jQuery
 import semmle.javascript.frameworks.Handlebars
+import semmle.javascript.frameworks.LazyCache
 import semmle.javascript.frameworks.LodashUnderscore
 import semmle.javascript.frameworks.Logging
 import semmle.javascript.frameworks.HttpFrameworks

javascript/ql/src/semmle/javascript/frameworks/LazyCache.qll

@@ -0,0 +1,55 @@
+/**
+ * Models imports through the NPM `lazy-cache` package.
+ */
+
+import javascript
+
+module LazyCache {
+  /**
+   * A lazy-cache object, usually created through an expression of form `require('lazy-cache')(require)`.
+   */
+  class LazyCacheObject extends DataFlow::SourceNode {
+    LazyCacheObject() {
+      // Use `require` directly instead of `moduleImport` to avoid recursion.
+      // For the same reason, avoid `Import.getImportedPath`.
+      exists(Require req |
+        req.getArgument(0).getStringValue() = "lazy-cache" and
+        this = req.flow().(DataFlow::SourceNode).getAnInvocation()
+      )
+    }
+  }
+
+  /**
+   * An import through `lazy-cache`.
+   */
+  class LazyCacheImport extends CallExpr, Import {
+    LazyCacheObject cache;
+
+    LazyCacheImport() { this = cache.getACall().asExpr() }
+
+    /** Gets the name of the package as it's exposed on the lazy-cache object. */
+    string getLocalAlias() {
+      result = getArgument(1).getStringValue()
+      or
+      not exists(getArgument(1)) and
+      result = getArgument(0).getStringValue()
+    }
+
+    override Module getEnclosingModule() { result = getTopLevel() }
+
+    override PathExpr getImportedPath() { result = getArgument(0) }
+
+    override DataFlow::Node getImportedModuleNode() {
+      result = this.flow()
+      or
+      result = cache.getAPropertyRead(getLocalAlias())
+    }
+  }
+
+  /** A constant path element appearing in a call to a lazy-cache object. */
+  private class LazyCachePathExpr extends PathExprInModule, ConstantString {
+    LazyCachePathExpr() { this = any(LazyCacheImport rp).getArgument(0) }
+
+    override string getValue() { result = getStringValue() }
+  }
+}

javascript/ql/test/library-tests/frameworks/LazyCache/LazyCache.expected

@@ -0,0 +1,7 @@
+| bar | tst.js:4:11:4:21 | lazy('bar') |
+| bar | tst.js:10:1:10:8 | lazy.bar |
+| baz-baz | tst.js:5:1:5:22 | lazy('b ...  'BAZ') |
+| baz-baz | tst.js:12:1:12:8 | lazy.BAZ |
+| foo | tst.js:3:1:3:11 | lazy('foo') |
+| foo | tst.js:7:1:7:8 | lazy.foo |
+| lazy-cache | tst.js:1:12:1:32 | require ... cache') |

javascript/ql/test/library-tests/frameworks/LazyCache/LazyCache.ql

@@ -0,0 +1,5 @@
+import javascript
+
+query DataFlow::Node moduleImport(string name) {
+    result = DataFlow::moduleImport(name)
+}

javascript/ql/test/library-tests/frameworks/LazyCache/tst.js

@@ -0,0 +1,12 @@
+let lazy = require('lazy-cache')(require);
+
+lazy('foo');
+let bar = lazy('bar');
+lazy('baz-baz', 'BAZ');
+
+lazy.foo();
+
+bar();
+lazy.bar();
+
+lazy.BAZ();

javascript/ql/test/query-tests/Security/CWE-400/PrototypePollutionUtility.expected

@@ -953,6 +953,95 @@ nodes
 | PrototypePollutionUtility/tests.js:437:24:437:28 | value |
 | PrototypePollutionUtility/tests.js:437:24:437:28 | value |
 | PrototypePollutionUtility/tests.js:437:24:437:28 | value |
+| PrototypePollutionUtility/tests.js:442:26:442:28 | dst |
+| PrototypePollutionUtility/tests.js:442:26:442:28 | dst |
+| PrototypePollutionUtility/tests.js:442:31:442:33 | src |
+| PrototypePollutionUtility/tests.js:442:31:442:33 | src |
+| PrototypePollutionUtility/tests.js:444:18:444:22 | value |
+| PrototypePollutionUtility/tests.js:444:18:444:22 | value |
+| PrototypePollutionUtility/tests.js:444:18:444:22 | value |
+| PrototypePollutionUtility/tests.js:444:25:444:27 | key |
+| PrototypePollutionUtility/tests.js:444:25:444:27 | key |
+| PrototypePollutionUtility/tests.js:444:25:444:27 | key |
+| PrototypePollutionUtility/tests.js:446:29:446:31 | dst |
+| PrototypePollutionUtility/tests.js:446:29:446:31 | dst |
+| PrototypePollutionUtility/tests.js:446:29:446:36 | dst[key] |
+| PrototypePollutionUtility/tests.js:446:29:446:36 | dst[key] |
+| PrototypePollutionUtility/tests.js:446:29:446:36 | dst[key] |
+| PrototypePollutionUtility/tests.js:446:29:446:36 | dst[key] |
+| PrototypePollutionUtility/tests.js:446:33:446:35 | key |
+| PrototypePollutionUtility/tests.js:446:33:446:35 | key |
+| PrototypePollutionUtility/tests.js:446:39:446:41 | src |
+| PrototypePollutionUtility/tests.js:446:39:446:41 | src |
+| PrototypePollutionUtility/tests.js:446:39:446:46 | src[key] |
+| PrototypePollutionUtility/tests.js:446:39:446:46 | src[key] |
+| PrototypePollutionUtility/tests.js:446:39:446:46 | src[key] |
+| PrototypePollutionUtility/tests.js:446:39:446:46 | src[key] |
+| PrototypePollutionUtility/tests.js:446:39:446:46 | src[key] |
+| PrototypePollutionUtility/tests.js:446:43:446:45 | key |
+| PrototypePollutionUtility/tests.js:446:43:446:45 | key |
+| PrototypePollutionUtility/tests.js:449:30:449:32 | dst |
+| PrototypePollutionUtility/tests.js:449:30:449:32 | dst |
+| PrototypePollutionUtility/tests.js:449:30:449:32 | dst |
+| PrototypePollutionUtility/tests.js:449:34:449:36 | key |
+| PrototypePollutionUtility/tests.js:449:34:449:36 | key |
+| PrototypePollutionUtility/tests.js:449:34:449:36 | key |
+| PrototypePollutionUtility/tests.js:449:41:449:43 | src |
+| PrototypePollutionUtility/tests.js:449:41:449:43 | src |
+| PrototypePollutionUtility/tests.js:449:41:449:48 | src[key] |
+| PrototypePollutionUtility/tests.js:449:41:449:48 | src[key] |
+| PrototypePollutionUtility/tests.js:449:41:449:48 | src[key] |
+| PrototypePollutionUtility/tests.js:449:41:449:48 | src[key] |
+| PrototypePollutionUtility/tests.js:449:41:449:48 | src[key] |
+| PrototypePollutionUtility/tests.js:449:41:449:48 | src[key] |
+| PrototypePollutionUtility/tests.js:449:45:449:47 | key |
+| PrototypePollutionUtility/tests.js:449:45:449:47 | key |
+| PrototypePollutionUtility/tests.js:450:30:450:32 | dst |
+| PrototypePollutionUtility/tests.js:450:30:450:32 | dst |
+| PrototypePollutionUtility/tests.js:450:30:450:32 | dst |
+| PrototypePollutionUtility/tests.js:450:34:450:36 | key |
+| PrototypePollutionUtility/tests.js:450:34:450:36 | key |
+| PrototypePollutionUtility/tests.js:450:34:450:36 | key |
+| PrototypePollutionUtility/tests.js:450:41:450:46 | o[key] |
+| PrototypePollutionUtility/tests.js:450:41:450:46 | o[key] |
+| PrototypePollutionUtility/tests.js:450:41:450:46 | o[key] |
+| PrototypePollutionUtility/tests.js:450:41:450:46 | o[key] |
+| PrototypePollutionUtility/tests.js:450:43:450:45 | key |
+| PrototypePollutionUtility/tests.js:450:43:450:45 | key |
+| PrototypePollutionUtility/tests.js:451:30:451:32 | dst |
+| PrototypePollutionUtility/tests.js:451:30:451:32 | dst |
+| PrototypePollutionUtility/tests.js:451:30:451:32 | dst |
+| PrototypePollutionUtility/tests.js:451:34:451:36 | key |
+| PrototypePollutionUtility/tests.js:451:34:451:36 | key |
+| PrototypePollutionUtility/tests.js:451:34:451:36 | key |
+| PrototypePollutionUtility/tests.js:451:41:451:45 | value |
+| PrototypePollutionUtility/tests.js:451:41:451:45 | value |
+| PrototypePollutionUtility/tests.js:451:41:451:45 | value |
+| PrototypePollutionUtility/tests.js:456:38:456:40 | dst |
+| PrototypePollutionUtility/tests.js:456:38:456:40 | dst |
+| PrototypePollutionUtility/tests.js:457:18:457:22 | value |
+| PrototypePollutionUtility/tests.js:457:18:457:22 | value |
+| PrototypePollutionUtility/tests.js:457:18:457:22 | value |
+| PrototypePollutionUtility/tests.js:457:25:457:27 | key |
+| PrototypePollutionUtility/tests.js:457:25:457:27 | key |
+| PrototypePollutionUtility/tests.js:457:25:457:27 | key |
+| PrototypePollutionUtility/tests.js:459:41:459:43 | dst |
+| PrototypePollutionUtility/tests.js:459:41:459:43 | dst |
+| PrototypePollutionUtility/tests.js:459:41:459:48 | dst[key] |
+| PrototypePollutionUtility/tests.js:459:41:459:48 | dst[key] |
+| PrototypePollutionUtility/tests.js:459:41:459:48 | dst[key] |
+| PrototypePollutionUtility/tests.js:459:41:459:48 | dst[key] |
+| PrototypePollutionUtility/tests.js:459:45:459:47 | key |
+| PrototypePollutionUtility/tests.js:459:45:459:47 | key |
+| PrototypePollutionUtility/tests.js:461:13:461:15 | dst |
+| PrototypePollutionUtility/tests.js:461:13:461:15 | dst |
+| PrototypePollutionUtility/tests.js:461:13:461:15 | dst |
+| PrototypePollutionUtility/tests.js:461:17:461:19 | key |
+| PrototypePollutionUtility/tests.js:461:17:461:19 | key |
+| PrototypePollutionUtility/tests.js:461:17:461:19 | key |
+| PrototypePollutionUtility/tests.js:461:24:461:28 | value |
+| PrototypePollutionUtility/tests.js:461:24:461:28 | value |
+| PrototypePollutionUtility/tests.js:461:24:461:28 | value |
 | examples/PrototypePollutionUtility.js:1:16:1:18 | dst |
 | examples/PrototypePollutionUtility.js:1:16:1:18 | dst |
 | examples/PrototypePollutionUtility.js:1:21:1:23 | src |
@@ -2242,6 +2331,132 @@ edges
 | PrototypePollutionUtility/tests.js:435:39:435:43 | value | PrototypePollutionUtility/tests.js:430:33:430:35 | src |
 | PrototypePollutionUtility/tests.js:435:39:435:43 | value | PrototypePollutionUtility/tests.js:430:33:430:35 | src |
 | PrototypePollutionUtility/tests.js:435:39:435:43 | value | PrototypePollutionUtility/tests.js:430:33:430:35 | src |
+| PrototypePollutionUtility/tests.js:442:26:442:28 | dst | PrototypePollutionUtility/tests.js:446:29:446:31 | dst |
+| PrototypePollutionUtility/tests.js:442:26:442:28 | dst | PrototypePollutionUtility/tests.js:446:29:446:31 | dst |
+| PrototypePollutionUtility/tests.js:442:26:442:28 | dst | PrototypePollutionUtility/tests.js:449:30:449:32 | dst |
+| PrototypePollutionUtility/tests.js:442:26:442:28 | dst | PrototypePollutionUtility/tests.js:449:30:449:32 | dst |
+| PrototypePollutionUtility/tests.js:442:26:442:28 | dst | PrototypePollutionUtility/tests.js:449:30:449:32 | dst |
+| PrototypePollutionUtility/tests.js:442:26:442:28 | dst | PrototypePollutionUtility/tests.js:449:30:449:32 | dst |
+| PrototypePollutionUtility/tests.js:442:26:442:28 | dst | PrototypePollutionUtility/tests.js:450:30:450:32 | dst |
+| PrototypePollutionUtility/tests.js:442:26:442:28 | dst | PrototypePollutionUtility/tests.js:450:30:450:32 | dst |
+| PrototypePollutionUtility/tests.js:442:26:442:28 | dst | PrototypePollutionUtility/tests.js:450:30:450:32 | dst |
+| PrototypePollutionUtility/tests.js:442:26:442:28 | dst | PrototypePollutionUtility/tests.js:450:30:450:32 | dst |
+| PrototypePollutionUtility/tests.js:442:26:442:28 | dst | PrototypePollutionUtility/tests.js:451:30:451:32 | dst |
+| PrototypePollutionUtility/tests.js:442:26:442:28 | dst | PrototypePollutionUtility/tests.js:451:30:451:32 | dst |
+| PrototypePollutionUtility/tests.js:442:26:442:28 | dst | PrototypePollutionUtility/tests.js:451:30:451:32 | dst |
+| PrototypePollutionUtility/tests.js:442:26:442:28 | dst | PrototypePollutionUtility/tests.js:451:30:451:32 | dst |
+| PrototypePollutionUtility/tests.js:442:31:442:33 | src | PrototypePollutionUtility/tests.js:446:39:446:41 | src |
+| PrototypePollutionUtility/tests.js:442:31:442:33 | src | PrototypePollutionUtility/tests.js:446:39:446:41 | src |
+| PrototypePollutionUtility/tests.js:442:31:442:33 | src | PrototypePollutionUtility/tests.js:449:41:449:43 | src |
+| PrototypePollutionUtility/tests.js:442:31:442:33 | src | PrototypePollutionUtility/tests.js:449:41:449:43 | src |
+| PrototypePollutionUtility/tests.js:444:18:444:22 | value | PrototypePollutionUtility/tests.js:451:41:451:45 | value |
+| PrototypePollutionUtility/tests.js:444:18:444:22 | value | PrototypePollutionUtility/tests.js:451:41:451:45 | value |
+| PrototypePollutionUtility/tests.js:444:18:444:22 | value | PrototypePollutionUtility/tests.js:451:41:451:45 | value |
+| PrototypePollutionUtility/tests.js:444:18:444:22 | value | PrototypePollutionUtility/tests.js:451:41:451:45 | value |
+| PrototypePollutionUtility/tests.js:444:18:444:22 | value | PrototypePollutionUtility/tests.js:451:41:451:45 | value |
+| PrototypePollutionUtility/tests.js:444:18:444:22 | value | PrototypePollutionUtility/tests.js:451:41:451:45 | value |
+| PrototypePollutionUtility/tests.js:444:18:444:22 | value | PrototypePollutionUtility/tests.js:451:41:451:45 | value |
+| PrototypePollutionUtility/tests.js:444:25:444:27 | key | PrototypePollutionUtility/tests.js:446:33:446:35 | key |
+| PrototypePollutionUtility/tests.js:444:25:444:27 | key | PrototypePollutionUtility/tests.js:446:33:446:35 | key |
+| PrototypePollutionUtility/tests.js:444:25:444:27 | key | PrototypePollutionUtility/tests.js:446:33:446:35 | key |
+| PrototypePollutionUtility/tests.js:444:25:444:27 | key | PrototypePollutionUtility/tests.js:446:33:446:35 | key |
+| PrototypePollutionUtility/tests.js:444:25:444:27 | key | PrototypePollutionUtility/tests.js:446:43:446:45 | key |
+| PrototypePollutionUtility/tests.js:444:25:444:27 | key | PrototypePollutionUtility/tests.js:446:43:446:45 | key |
+| PrototypePollutionUtility/tests.js:444:25:444:27 | key | PrototypePollutionUtility/tests.js:446:43:446:45 | key |
+| PrototypePollutionUtility/tests.js:444:25:444:27 | key | PrototypePollutionUtility/tests.js:446:43:446:45 | key |
+| PrototypePollutionUtility/tests.js:444:25:444:27 | key | PrototypePollutionUtility/tests.js:449:34:449:36 | key |
+| PrototypePollutionUtility/tests.js:444:25:444:27 | key | PrototypePollutionUtility/tests.js:449:34:449:36 | key |
+| PrototypePollutionUtility/tests.js:444:25:444:27 | key | PrototypePollutionUtility/tests.js:449:34:449:36 | key |
+| PrototypePollutionUtility/tests.js:444:25:444:27 | key | PrototypePollutionUtility/tests.js:449:34:449:36 | key |
+| PrototypePollutionUtility/tests.js:444:25:444:27 | key | PrototypePollutionUtility/tests.js:449:34:449:36 | key |
+| PrototypePollutionUtility/tests.js:444:25:444:27 | key | PrototypePollutionUtility/tests.js:449:34:449:36 | key |
+| PrototypePollutionUtility/tests.js:444:25:444:27 | key | PrototypePollutionUtility/tests.js:449:34:449:36 | key |
+| PrototypePollutionUtility/tests.js:444:25:444:27 | key | PrototypePollutionUtility/tests.js:449:45:449:47 | key |
+| PrototypePollutionUtility/tests.js:444:25:444:27 | key | PrototypePollutionUtility/tests.js:449:45:449:47 | key |
+| PrototypePollutionUtility/tests.js:444:25:444:27 | key | PrototypePollutionUtility/tests.js:449:45:449:47 | key |
+| PrototypePollutionUtility/tests.js:444:25:444:27 | key | PrototypePollutionUtility/tests.js:449:45:449:47 | key |
+| PrototypePollutionUtility/tests.js:444:25:444:27 | key | PrototypePollutionUtility/tests.js:450:34:450:36 | key |
+| PrototypePollutionUtility/tests.js:444:25:444:27 | key | PrototypePollutionUtility/tests.js:450:34:450:36 | key |
+| PrototypePollutionUtility/tests.js:444:25:444:27 | key | PrototypePollutionUtility/tests.js:450:34:450:36 | key |
+| PrototypePollutionUtility/tests.js:444:25:444:27 | key | PrototypePollutionUtility/tests.js:450:34:450:36 | key |
+| PrototypePollutionUtility/tests.js:444:25:444:27 | key | PrototypePollutionUtility/tests.js:450:34:450:36 | key |
+| PrototypePollutionUtility/tests.js:444:25:444:27 | key | PrototypePollutionUtility/tests.js:450:34:450:36 | key |
+| PrototypePollutionUtility/tests.js:444:25:444:27 | key | PrototypePollutionUtility/tests.js:450:34:450:36 | key |
+| PrototypePollutionUtility/tests.js:444:25:444:27 | key | PrototypePollutionUtility/tests.js:450:43:450:45 | key |
+| PrototypePollutionUtility/tests.js:444:25:444:27 | key | PrototypePollutionUtility/tests.js:450:43:450:45 | key |
+| PrototypePollutionUtility/tests.js:444:25:444:27 | key | PrototypePollutionUtility/tests.js:450:43:450:45 | key |
+| PrototypePollutionUtility/tests.js:444:25:444:27 | key | PrototypePollutionUtility/tests.js:450:43:450:45 | key |
+| PrototypePollutionUtility/tests.js:444:25:444:27 | key | PrototypePollutionUtility/tests.js:451:34:451:36 | key |
+| PrototypePollutionUtility/tests.js:444:25:444:27 | key | PrototypePollutionUtility/tests.js:451:34:451:36 | key |
+| PrototypePollutionUtility/tests.js:444:25:444:27 | key | PrototypePollutionUtility/tests.js:451:34:451:36 | key |
+| PrototypePollutionUtility/tests.js:444:25:444:27 | key | PrototypePollutionUtility/tests.js:451:34:451:36 | key |
+| PrototypePollutionUtility/tests.js:444:25:444:27 | key | PrototypePollutionUtility/tests.js:451:34:451:36 | key |
+| PrototypePollutionUtility/tests.js:444:25:444:27 | key | PrototypePollutionUtility/tests.js:451:34:451:36 | key |
+| PrototypePollutionUtility/tests.js:444:25:444:27 | key | PrototypePollutionUtility/tests.js:451:34:451:36 | key |
+| PrototypePollutionUtility/tests.js:446:29:446:31 | dst | PrototypePollutionUtility/tests.js:446:29:446:36 | dst[key] |
+| PrototypePollutionUtility/tests.js:446:29:446:31 | dst | PrototypePollutionUtility/tests.js:446:29:446:36 | dst[key] |
+| PrototypePollutionUtility/tests.js:446:29:446:36 | dst[key] | PrototypePollutionUtility/tests.js:442:26:442:28 | dst |
+| PrototypePollutionUtility/tests.js:446:29:446:36 | dst[key] | PrototypePollutionUtility/tests.js:442:26:442:28 | dst |
+| PrototypePollutionUtility/tests.js:446:29:446:36 | dst[key] | PrototypePollutionUtility/tests.js:442:26:442:28 | dst |
+| PrototypePollutionUtility/tests.js:446:29:446:36 | dst[key] | PrototypePollutionUtility/tests.js:442:26:442:28 | dst |
+| PrototypePollutionUtility/tests.js:446:33:446:35 | key | PrototypePollutionUtility/tests.js:446:29:446:36 | dst[key] |
+| PrototypePollutionUtility/tests.js:446:33:446:35 | key | PrototypePollutionUtility/tests.js:446:29:446:36 | dst[key] |
+| PrototypePollutionUtility/tests.js:446:39:446:41 | src | PrototypePollutionUtility/tests.js:446:39:446:46 | src[key] |
+| PrototypePollutionUtility/tests.js:446:39:446:41 | src | PrototypePollutionUtility/tests.js:446:39:446:46 | src[key] |
+| PrototypePollutionUtility/tests.js:446:39:446:46 | src[key] | PrototypePollutionUtility/tests.js:442:31:442:33 | src |
+| PrototypePollutionUtility/tests.js:446:39:446:46 | src[key] | PrototypePollutionUtility/tests.js:442:31:442:33 | src |
+| PrototypePollutionUtility/tests.js:446:39:446:46 | src[key] | PrototypePollutionUtility/tests.js:442:31:442:33 | src |
+| PrototypePollutionUtility/tests.js:446:39:446:46 | src[key] | PrototypePollutionUtility/tests.js:442:31:442:33 | src |
+| PrototypePollutionUtility/tests.js:446:39:446:46 | src[key] | PrototypePollutionUtility/tests.js:442:31:442:33 | src |
+| PrototypePollutionUtility/tests.js:446:39:446:46 | src[key] | PrototypePollutionUtility/tests.js:442:31:442:33 | src |
+| PrototypePollutionUtility/tests.js:446:43:446:45 | key | PrototypePollutionUtility/tests.js:446:39:446:46 | src[key] |
+| PrototypePollutionUtility/tests.js:446:43:446:45 | key | PrototypePollutionUtility/tests.js:446:39:446:46 | src[key] |
+| PrototypePollutionUtility/tests.js:449:41:449:43 | src | PrototypePollutionUtility/tests.js:449:41:449:48 | src[key] |
+| PrototypePollutionUtility/tests.js:449:41:449:43 | src | PrototypePollutionUtility/tests.js:449:41:449:48 | src[key] |
+| PrototypePollutionUtility/tests.js:449:41:449:43 | src | PrototypePollutionUtility/tests.js:449:41:449:48 | src[key] |
+| PrototypePollutionUtility/tests.js:449:41:449:43 | src | PrototypePollutionUtility/tests.js:449:41:449:48 | src[key] |
+| PrototypePollutionUtility/tests.js:449:41:449:48 | src[key] | PrototypePollutionUtility/tests.js:449:41:449:48 | src[key] |
+| PrototypePollutionUtility/tests.js:449:45:449:47 | key | PrototypePollutionUtility/tests.js:449:41:449:48 | src[key] |
+| PrototypePollutionUtility/tests.js:449:45:449:47 | key | PrototypePollutionUtility/tests.js:449:41:449:48 | src[key] |
+| PrototypePollutionUtility/tests.js:449:45:449:47 | key | PrototypePollutionUtility/tests.js:449:41:449:48 | src[key] |
+| PrototypePollutionUtility/tests.js:449:45:449:47 | key | PrototypePollutionUtility/tests.js:449:41:449:48 | src[key] |
+| PrototypePollutionUtility/tests.js:450:41:450:46 | o[key] | PrototypePollutionUtility/tests.js:450:41:450:46 | o[key] |
+| PrototypePollutionUtility/tests.js:450:43:450:45 | key | PrototypePollutionUtility/tests.js:450:41:450:46 | o[key] |
+| PrototypePollutionUtility/tests.js:450:43:450:45 | key | PrototypePollutionUtility/tests.js:450:41:450:46 | o[key] |
+| PrototypePollutionUtility/tests.js:450:43:450:45 | key | PrototypePollutionUtility/tests.js:450:41:450:46 | o[key] |
+| PrototypePollutionUtility/tests.js:450:43:450:45 | key | PrototypePollutionUtility/tests.js:450:41:450:46 | o[key] |
+| PrototypePollutionUtility/tests.js:456:38:456:40 | dst | PrototypePollutionUtility/tests.js:459:41:459:43 | dst |
+| PrototypePollutionUtility/tests.js:456:38:456:40 | dst | PrototypePollutionUtility/tests.js:459:41:459:43 | dst |
+| PrototypePollutionUtility/tests.js:456:38:456:40 | dst | PrototypePollutionUtility/tests.js:461:13:461:15 | dst |
+| PrototypePollutionUtility/tests.js:456:38:456:40 | dst | PrototypePollutionUtility/tests.js:461:13:461:15 | dst |
+| PrototypePollutionUtility/tests.js:456:38:456:40 | dst | PrototypePollutionUtility/tests.js:461:13:461:15 | dst |
+| PrototypePollutionUtility/tests.js:456:38:456:40 | dst | PrototypePollutionUtility/tests.js:461:13:461:15 | dst |
+| PrototypePollutionUtility/tests.js:457:18:457:22 | value | PrototypePollutionUtility/tests.js:461:24:461:28 | value |
+| PrototypePollutionUtility/tests.js:457:18:457:22 | value | PrototypePollutionUtility/tests.js:461:24:461:28 | value |
+| PrototypePollutionUtility/tests.js:457:18:457:22 | value | PrototypePollutionUtility/tests.js:461:24:461:28 | value |
+| PrototypePollutionUtility/tests.js:457:18:457:22 | value | PrototypePollutionUtility/tests.js:461:24:461:28 | value |
+| PrototypePollutionUtility/tests.js:457:18:457:22 | value | PrototypePollutionUtility/tests.js:461:24:461:28 | value |
+| PrototypePollutionUtility/tests.js:457:18:457:22 | value | PrototypePollutionUtility/tests.js:461:24:461:28 | value |
+| PrototypePollutionUtility/tests.js:457:18:457:22 | value | PrototypePollutionUtility/tests.js:461:24:461:28 | value |
+| PrototypePollutionUtility/tests.js:457:25:457:27 | key | PrototypePollutionUtility/tests.js:459:45:459:47 | key |
+| PrototypePollutionUtility/tests.js:457:25:457:27 | key | PrototypePollutionUtility/tests.js:459:45:459:47 | key |
+| PrototypePollutionUtility/tests.js:457:25:457:27 | key | PrototypePollutionUtility/tests.js:459:45:459:47 | key |
+| PrototypePollutionUtility/tests.js:457:25:457:27 | key | PrototypePollutionUtility/tests.js:459:45:459:47 | key |
+| PrototypePollutionUtility/tests.js:457:25:457:27 | key | PrototypePollutionUtility/tests.js:461:17:461:19 | key |
+| PrototypePollutionUtility/tests.js:457:25:457:27 | key | PrototypePollutionUtility/tests.js:461:17:461:19 | key |
+| PrototypePollutionUtility/tests.js:457:25:457:27 | key | PrototypePollutionUtility/tests.js:461:17:461:19 | key |
+| PrototypePollutionUtility/tests.js:457:25:457:27 | key | PrototypePollutionUtility/tests.js:461:17:461:19 | key |
+| PrototypePollutionUtility/tests.js:457:25:457:27 | key | PrototypePollutionUtility/tests.js:461:17:461:19 | key |
+| PrototypePollutionUtility/tests.js:457:25:457:27 | key | PrototypePollutionUtility/tests.js:461:17:461:19 | key |
+| PrototypePollutionUtility/tests.js:457:25:457:27 | key | PrototypePollutionUtility/tests.js:461:17:461:19 | key |
+| PrototypePollutionUtility/tests.js:459:41:459:43 | dst | PrototypePollutionUtility/tests.js:459:41:459:48 | dst[key] |
+| PrototypePollutionUtility/tests.js:459:41:459:43 | dst | PrototypePollutionUtility/tests.js:459:41:459:48 | dst[key] |
+| PrototypePollutionUtility/tests.js:459:41:459:48 | dst[key] | PrototypePollutionUtility/tests.js:456:38:456:40 | dst |
+| PrototypePollutionUtility/tests.js:459:41:459:48 | dst[key] | PrototypePollutionUtility/tests.js:456:38:456:40 | dst |
+| PrototypePollutionUtility/tests.js:459:41:459:48 | dst[key] | PrototypePollutionUtility/tests.js:456:38:456:40 | dst |
+| PrototypePollutionUtility/tests.js:459:41:459:48 | dst[key] | PrototypePollutionUtility/tests.js:456:38:456:40 | dst |
+| PrototypePollutionUtility/tests.js:459:45:459:47 | key | PrototypePollutionUtility/tests.js:459:41:459:48 | dst[key] |
+| PrototypePollutionUtility/tests.js:459:45:459:47 | key | PrototypePollutionUtility/tests.js:459:41:459:48 | dst[key] |
 | examples/PrototypePollutionUtility.js:1:16:1:18 | dst | examples/PrototypePollutionUtility.js:5:19:5:21 | dst |
 | examples/PrototypePollutionUtility.js:1:16:1:18 | dst | examples/PrototypePollutionUtility.js:5:19:5:21 | dst |
 | examples/PrototypePollutionUtility.js:1:16:1:18 | dst | examples/PrototypePollutionUtility.js:7:13:7:15 | dst |
@@ -2364,4 +2579,8 @@ edges
 | PrototypePollutionUtility/tests.js:387:13:387:15 | dst | PrototypePollutionUtility/tests.js:365:14:365:16 | key | PrototypePollutionUtility/tests.js:387:13:387:15 | dst | Properties are copied from $@ to $@ without guarding against prototype pollution. | PrototypePollutionUtility/tests.js:365:21:365:23 | obj | obj | PrototypePollutionUtility/tests.js:387:13:387:15 | dst | dst |
 | PrototypePollutionUtility/tests.js:403:13:403:15 | dst | PrototypePollutionUtility/tests.js:397:14:397:16 | key | PrototypePollutionUtility/tests.js:403:13:403:15 | dst | Properties are copied from $@ to $@ without guarding against prototype pollution. | PrototypePollutionUtility/tests.js:397:21:397:23 | src | src | PrototypePollutionUtility/tests.js:403:13:403:15 | dst | dst |
 | PrototypePollutionUtility/tests.js:420:13:420:15 | dst | PrototypePollutionUtility/tests.js:414:14:414:16 | key | PrototypePollutionUtility/tests.js:420:13:420:15 | dst | Properties are copied from $@ to $@ without guarding against prototype pollution. | PrototypePollutionUtility/tests.js:414:21:414:23 | src | src | PrototypePollutionUtility/tests.js:420:13:420:15 | dst | dst |
+| PrototypePollutionUtility/tests.js:449:30:449:32 | dst | PrototypePollutionUtility/tests.js:444:25:444:27 | key | PrototypePollutionUtility/tests.js:449:30:449:32 | dst | Properties are copied from $@ to $@ without guarding against prototype pollution. | PrototypePollutionUtility/tests.js:444:12:444:14 | src | src | PrototypePollutionUtility/tests.js:449:30:449:32 | dst | dst |
+| PrototypePollutionUtility/tests.js:450:30:450:32 | dst | PrototypePollutionUtility/tests.js:444:25:444:27 | key | PrototypePollutionUtility/tests.js:450:30:450:32 | dst | Properties are copied from $@ to $@ without guarding against prototype pollution. | PrototypePollutionUtility/tests.js:444:12:444:14 | src | src | PrototypePollutionUtility/tests.js:450:30:450:32 | dst | dst |
+| PrototypePollutionUtility/tests.js:451:30:451:32 | dst | PrototypePollutionUtility/tests.js:444:25:444:27 | key | PrototypePollutionUtility/tests.js:451:30:451:32 | dst | Properties are copied from $@ to $@ without guarding against prototype pollution. | PrototypePollutionUtility/tests.js:444:12:444:14 | src | src | PrototypePollutionUtility/tests.js:451:30:451:32 | dst | dst |
+| PrototypePollutionUtility/tests.js:461:13:461:15 | dst | PrototypePollutionUtility/tests.js:457:25:457:27 | key | PrototypePollutionUtility/tests.js:461:13:461:15 | dst | Properties are copied from $@ to $@ without guarding against prototype pollution. | PrototypePollutionUtility/tests.js:457:12:457:14 | src | src | PrototypePollutionUtility/tests.js:461:13:461:15 | dst | dst |
 | examples/PrototypePollutionUtility.js:7:13:7:15 | dst | examples/PrototypePollutionUtility.js:2:14:2:16 | key | examples/PrototypePollutionUtility.js:7:13:7:15 | dst | Properties are copied from $@ to $@ without guarding against prototype pollution. | examples/PrototypePollutionUtility.js:2:21:2:23 | src | src | examples/PrototypePollutionUtility.js:7:13:7:15 | dst | dst |

javascript/ql/test/query-tests/Security/CWE-400/PrototypePollutionUtility/tests.js

@@ -438,3 +438,27 @@ function copyUsingSafeRead(dst, src) {
         }
     }
 }
+
+function copyUsingForOwn(dst, src) {
+    let forOwn = import('for-own');
+    forOwn(src, (value, key, o) => {
+        if (dst[key]) {
+            copyUsingForOwn(dst[key], src[key]);
+        } else {
+            // Handle a few different ways to access src[key]
+            if (something()) dst[key] = src[key]; // NOT OK
+            if (something()) dst[key] = o[key]; // NOT OK
+            if (something()) dst[key] = value; // NOT OK
+        }
+    });
+}
+
+function copyUsingUnderscoreOrLodash(dst, src) {
+    _.each(src, (value, key, o) => {
+        if (dst[key]) {
+            copyUsingUnderscoreOrLodash(dst[key], src[key]);
+        } else {
+            dst[key] = value; // NOT OK
+        }
+    });
+}