Why does "count" aggregate counts multiple time the same result ?

[Sixelayo]

I've read this post and documentation but I'm still confused. What's explained :

count: This aggregate determines the number of distinct values of for each possible assignment of the aggregation variables.

So, from what I understand, count(<variable declarations> | <formula> | <expression>) will count the number of result of the following Code QL request :

from <variable declarations>
where <formula>
select <expression>

From what I understand CodeQL doesn't return the same tuple result twice. identical result are merged. This is why the request in the other post was returning 1.

However here's a simple case where this is clearly not the case :

class SmallInt extends int {
    SmallInt() {
        this in [5..15]
    }
}

class TenMult extends int{
    TenMult(){
        exists(int k | k in [0..10] and this = 10*k)
    }
}

from SmallInt i, TenMult tm
where 
    tm = i
    or tm =i+1
select tm, i

The above request return :

| tm | i |
| 10 | 9 |
| 10 | 10 |

Nothing unusual.

from SmallInt i, TenMult tm
where 
    tm = i
    or tm =i+1
select tm

The above request return :

| tm |
| 10 |

which I also understand. Because there was tm = 10 twice they got merged

However, I can't make sens of this request :

select count(SmallInt i, TenMult tm| 
    tm = i or 
    tm = i+1
    | tm)

The above request return :

| [0] |
| 2 |

Which I don't understand at all !
The <expression> part of the count aggregate is tm and the number of distinct value tm can take for each possible assignment of the aggregation variables (that is to say : (9,10) and (10,10)) is only 1, being 10. So the result should be 1, and not 2. This is word to word interpretation from the documentation so what am I missing ? Is this a bug ? Is the documentation wrong ? Actually it also makes sens that we want the result to be 1 and not 2 for various reason (this example is my attempt to simplify the real request where I encountered this, I was running CodeQL over the juliet test suite and wanted to count the number of true positive. Obviously if
a CodeQL request detects 2 results in the same function, I only want to count this function once because each function correspond to a single test case.

Actually, after some tries I got this request which returns 1, as expected (this also solved my problem for the real request I was writting)

select count(TenMult tm| 
    exists(SmallInt i | 
        tm = i or 
        tm = i+1
    )
    | tm)

However I have no idea why the version without the exists doesn't work as I expected.

EDIT : after some more testing, i looks like (9,10) and (10,10), the tm being 10 is like "it not the same 10 because one is in the tuple with i=9 and i=10". And ok that may expains things, but if so then I think the documentation is clearly missleading, and that raises 2 other question :

• is there any reason that justify this behavior ? if I want to count the number of distinct couple I would've naturally put a simple class wrapper (with 2 int insides corresponding to i and tm in the expression part.
• what's the point of the <expression> part in the count aggregate ? Because know I feel like this litteraly useless. In fact replacing <expression> with 1 litteraly gives the same result...

Those 2 requests return the same result, even if it's obvious than <expression> takes only one distinct value

bindingset[e]
int foo(int e){
    result= 1
}

select count(SmallInt i, TenMult tm | 
    tm = i or 
    tm = i+1
    | foo)

select count(SmallInt i, TenMult tm | 
    tm = i or 
    tm = i+1
    | 1 )

EDIT 2
Ok nevermind, from the same documentation page, we learn that the <expression> part of count is indeed useless.

As a special case, you can omit the part from count even if there is more than one aggregation variable. In such a case, it counts the number of distinct tuples of aggregation variables that satisfy the formula. In other words, the expression part is considered to be the constant 1. For example, the following aggregations are equivalent:

My 2 questions above still holds, I don't understand the logic behind it at all. And now I'm convinced that the documentation about count is wrong. Or I'm missing something now I don't see how a count request could have a different result wether you omit the expression part or put a constant in it.

Also, VScode syntax coloration is wrong. In the following request it consider ott as an "unused variable" and display a warning but this request returns 3 (proff that ott is in fact used)

class OneTwoThree extends int{
    OneTwoThree(){
        this = 1 or this = 2 or this = 3
    }
}
select count(OneTwoThree ott | | 1)
//returns 3

Not sure about this but it seems like count behave as a monotonic aggregate.

[ginsbach]

Thank you for the questions @ayosten, I hope I'll be able to help.

count: This aggregate determines the number of distinct values of <expression> for each possible assignment of the aggregation variables.

Note the precise wording here: the distinct values for each possible assignment of the aggregation variables are counted - they do not have to be distinct across different assignments.

Consider the following example:

class SmallInt extends int {
  SmallInt() { this in [5 .. 15] }
}

int foo(SmallInt i) { result in [i - 1, i, 1] }

select count(SmallInt i | | foo(i))

• There are eleven possible assignments of the aggregation variable i (5, 6, ..., 14, 15).
• For each of those assignments, the expression evaluates to three distinct values. These values overlap for consecutive assignments of i, but that is not relevant for the result.
• The total count is 33.

To bring this to its logical conclusion: select count(SmallInt i | | 1) evaluates to 11.

So, from what I understand, count(<variable declarations> | <formula> | <expression>) will count the number of result of the following Code QL request :

from <variable declarations>
where <formula>
select <expression>

As explained above, this is not correct.

Also, VScode syntax coloration is wrong. In the following request it consider ott as an "unused variable" and display a warning but this request returns 3 (proff that ott is in fact used)

class OneTwoThree extends int{
    OneTwoThree(){
        this = 1 or this = 2 or this = 3
    }
}
select count(OneTwoThree ott | | 1)
//returns 3

Agreed, VScode should not complain about this. Thank you for bringing it to our attention - I have opened an internal bug report.

[Sixelayo]

Thank you for your answer ! I now understand why <expression>is important.