This looks great! I guess uses of avg is also likely to be broken in the same way, right?

I guess uses of avg is also likely to be broken in the same way, right?

Yes, that's true.

You could also think about count being broken, but I didn't think that case came up so much because you often count things that aren't numbers, so count(this.getChild(_)) is quite common and correct providing you're not counting numbers.

You could also think about count being broken, but I didn't think that case came up so much because you often count things that aren't numbers, so count(this.getChild(_)) is quite common and correct providing you're not counting numbers.

You could check whether the type of the inner expression to determine whether it's counting integers.

You could check whether the type of the inner expression to determine whether it's counting integers.

I did think about this, but didn't do this initially as I wasn't sure how often people people counted integers, and whether it's legitimate. So I coded this up and it turns out that we do this a lot in CodeQL for many different reasons. e.g.

count(body.indexOf("(")) != count(body.indexOf(")"))

strictcount(e.getValue().toInt()) = 1

result = count(this.getFormat().indexOf("%"))

count(node.getStackSizeAfter()) != 1

actualArity = count(row.indexOf(";")) + 1

I couldn't see any additional true positives. For that reason, let's not try to cover count/strictcount as well.