Module cpp

Holds if element is affected by a macro.

Holds if an external allocation model exists for the given parameters.

Holds if any file was compiled by a Microsoft compiler.

Holds if dominator is a dominator of node in the control-flow graph of basic blocks. This is reflexive.

Holds if dominator is an immediate dominator of node in the control-flow graph of basic blocks.

Holds if postDominator is an immediate post-dominator of node in the control-flow graph of basic blocks.

Holds if postDominator is a post-dominator of node in the control-flow graph of basic blocks. This is reflexive.

Holds if dominator is a strict dominator of node in the control-flow graph of basic blocks. Being strict means that dominator != node.

Holds if postDominator is a strict post-dominator of node in the control-flow graph of basic blocks. Being strict means that postDominator != node.

Holds if call passes v by reference, either with an explicit address-of operator or implicitly as a C++ reference. Both const and non-const references are included.

Holds if the call fc will dereference argument i.

Holds if call may, directly or indirectly, evaluate to a null literal.

Holds if a value can flow directly from one expr to another.

Holds if var is likely to be null at node.

Holds if var is likely to be non-null at node.

Holds if condition always evaluates to zero.

Holds if condition always evaluates to a nonzero value.

Gets the number of branching statements and expressions in a block. This is for computing cyclomatic complexity.

Holds if an external deallocation model exists for the given parameters.

Holds if a simple data-flow analysis determines that e is definitely null.

Holds if def is a (potential) assignment to stack variable v. That is, the variable may hold another value in the control-flow node(s) following def than before.

Holds if barrier is either a (potential) definition of v or follows an access that gets the address of v. In both cases, the value of v after barrier cannot be assumed to be the same as before.

Holds if va is a variable passed by reference as argument def, where the callee potentially assigns the corresponding parameter. The definitions-and-uses library models assignment by reference as if it happens on evaluation of the argument, def.

Holds if the definition def of some stack variable can reach node, which is a definition or use, without crossing definitions of the same variable.

Computed relation: A “definition-use-pair” for a particular variable. Intuitively, this means that def is an assignment to var, and use is a read of var at which the value assigned by def may be read. (There can be more than one definition reaching a single use, and a single definition can reach many uses.)

Holds if evaluation of op dereferences v.

Holds if e will be dereferenced after being evaluated.

Holds if evaluation of op dereferences e.

Holds if evaluation of op dereferences e directly.

Holds if dominator is a dominator of node in the control-flow graph. This is reflexive.

Holds if def is a (definite) assignment to the stack variable v. e is the assigned expression.

A library routine that frees memory.

Holds if the body of a function f is likely to dereference its ith parameter unconditionally. This analysis does not account for reassignment.

Holds if entry is the entry point of a function.

Holds if exit is the exit node of a function.

A type that is used as a format string by any formatting function.

Holds if f is a getter member function for v, in class c. See StructLikeClass.getAGetter.

Holds if dominator is an immediate dominator of node in the control-flow graph.

Holds if postDominator is an immediate post-dominator of node in the control-flow graph.

Holds if element is in the expansion of a macro.

Holds if element is in the expansion of a macro from a system header.

Is e some kind of allocation (new, alloc, realloc etc)?

Holds if this database was created with the linker awareness feature switched on.

Is e some kind of allocation or deallocation (new, alloc, realloc, delete, free etc)?

Holds if call is a call that locks or tries to lock its argument arg.

The condition condition for the loop loop is provably true upon entry. That is, at least one iteration of the loop is guaranteed.

Holds if there is a macro invocation on line line of file f.

Holds if l is the location of a macro.

Holds if f may, directly or indirectly, return a null literal.

Holds if a simple data-flow analysis determines that e may be null.

Get the Element that represents this @element. Normally this will simply be a cast of e, but sometimes it is not. For example, for an incomplete struct e the result may be a complete struct with the same name.

Holds if call is a call that always locks its argument arg.

Holds if var is null when checkExpr evaluates to a true value.

Holds if the evaluation of n may have the effect of, directly or indirectly, assigning a null literal to var.

Holds if val is a null literal or a call to a function that may return a null literal.

Holds if va is a use of the parameter p that could observe the passed-in value.

Holds if there might be a macro invocation at location l.

Holds if postDominator is a post-dominator of node in the control-flow graph. This is reflexive.

A standard function such as vprintf that has a format parameter and a variable argument list of type va_arg. formatParamIndex indicates the format parameter and type indicates the type of vprintf: - "" is a vprintf variant, outputParamIndex is -1. - "f" is a vfprintf variant, outputParamIndex indicates the output stream parameter. - "s" is a vsprintf variant, outputParamIndex indicates the output buffer parameter. - "?" if the type cannot be determined. outputParamIndex is -1.

A node representing the Cast sub-class of entity cast.

A node representing the Conversion sub-class of entity cast.

Holds if the control-flow node n is reachable, meaning that either it is an entry point, or there exists a path in the control-flow graph of its function that connects an entry point to it. Compile-time constant conditions are taken into account, so that the call to f is not reachable in if (0) f(); even if the if statement as a whole is reachable.

Holds if f is a setter member function for v, in class c. See StructLikeClass.getASetter.

Holds if dominator is a strict dominator of node in the control-flow graph. Being strict means that dominator != node.

Holds if postDominator is a strict post-dominator of node in the control-flow graph. Being strict means that postDominator != node.

Holds if there is a control-flow edge from source to target in either the extractor-generated control-flow graph or in a subclass of AdditionalControlFlowEdge. Use this relation instead of qlCFGSuccessor.

Holds if call is a call that tries to lock its argument arg, but may return without success.

INTERNAL: Do not use.

Holds if call is a call that unlocks its argument arg.

Correct relation for reachability of ControlFlowNodes.

INTERNAL: Do not use.

Holds if use is a non-definition use of stack variable v. This will not include accesses on the LHS of an assignment (which don’t retrieve the variable value), but will include accesses in increment/decrement operations.

Same as useOfVar(v, use), but with the extra condition that the access use actually reads the value of the stack variable v at run-time. (Non-examples include &x and function calls where the callee does not use the relevant parameter.)

A use/use pair is a pair of uses of a particular variable var where the same value might be read (meaning that there is a control-flow path from first to second without crossing a definition of var).

Holds if var is non-null when checkExpr evaluates to a true value.

Extended version of definition that also includes parameters.

Holds if f is a function such as vprintf that has a format parameter and a variable argument list of type va_arg. formatParamIndex indicates the format parameter and type indicates the type of vprintf: - "" is a vprintf variant, outputParamIndex is -1. - "f" is a vfprintf variant, outputParamIndex indicates the output stream parameter. - "s" is a vsprintf variant, outputParamIndex indicates the output buffer parameter. - "?" if the type cannot be determined. outputParamIndex is -1.

An “abstract class”, in other words a class/struct that contains at least one pure virtual function.

A C/C++ access expression. This refers to a function (excluding function references in function call expressions), variable, or enum constant.

A declaration that can potentially have more C++ access rights than its enclosing element. This comprises Class (they have access to their own private members) along with other UserTypes and Function (they can be the target of friend declarations). For example MyClass and myFunction in the following code:

A C++ access specifier: public, protected, or private.

A C/C++ add expression. c = a + b;

An abstract class that can be extended to add additional edges to the control-flow graph. Instances of this class correspond to the source nodes of such edges, and the predicate getAnEdgeTarget should be overridden to produce the target nodes of each source.

A C/C++ address-of expression. int *ptr = &var;

A C/C++ aggregate literal.

A C++11 alignas construct. For example the attribute in the following code: struct alignas(16) MyStruct { int x; }; Though it doesn’t use the attribute syntax, alignas(...) is presented as an Attribute for consistency with the [[align(...)]] attribute.

A C++11 alignof expression whose operand is an expression. int addrMask = ~(alignof(expr) - 1);

A C++11 alignof expression.

A C++11 alignof expression whose operand is a type name. bool proper_alignment = (alignof(T) == alignof(T[0]);

An allocation expression such as call to malloc or a new expression.

An allocation function such as malloc.

An expression that has been extended with member predicates that provide information about the role of this expression in nullness checks.

An analyzed null terminated string.

A conversion from one arithmetic or enum type to another.

The C/C++ arithmetic types. See 4.1.1.

A C/C++ aggregate literal that initializes an array S s[4] = { s_1, s_2, s_3, s_n };

A C/C++ array access expression. For example, the access to as in myFunction in the following code:

A library function with input and/or output buffer parameters

A C/C++ aggregate literal that initializes an array or a GNU vector type.

A C/C++ array to pointer conversion.

A C/C++ array type. See 4.9.1. char table[32];

A C/C++ ‘asm’ statement.

A non-overloaded += assignment expression on a non-pointer lvalue. a += b;

A non-overloaded AND (&=) assignment expression. a &= b;

A non-overloaded arithmetic assignment operation on a non-pointer lvalue: +=, -=, *=, /= and %=.

A non-overloaded bitwise assignment operation: &=, |=, ^=, <<=, and >>=.

A non-overloaded /= assignment expression. a /= b;

A non-overloaded assignment operation with the operator =. a = b; Note that int a = b; is not an AssignExpr. It is a Variable, and b can be obtained using Variable.getInitializer().

A non-overloaded <<= assignment expression. a <<= b;

A non-overloaded *= assignment expression. a *= b;

A non-overloaded binary assignment operation other than =.

A non-overloaded OR (|=) assignment expression. a |= b;

A non-overloaded += pointer assignment expression. ptr += index;

A non-overloaded -= pointer assignment expression. ptr -= index;

A non-overloaded >>= assignment expression. a >>= b;

A non-overloaded %= assignment expression. a %= b;

A non-overloaded -= assignment expression on a non-pointer lvalue. a -= b;

A non-overloaded XOR (^=) assignment expression. a ^= b;

A non-overloaded binary assignment operation, including =, +=, &=, etc. A C++ overloaded assignment operation looks syntactically identical but is instead a FunctionCall. This class does not include variable initializers. To get a variable initializer, use Initializer instead.

A Microsoft C/C++ __assume expression.

An attribute introduced by GNU’s __attribute__((name)) syntax, Microsoft’s __declspec(name) syntax, Microsoft’s [name] syntax, the C++11 standard [[name]] syntax, or the C++11 alignas syntax.

An argument to an Attribute. For example the argument “dllimport” on the attribute in the following code: __declspec(dllimport) void myFunction();

A function that can be identified as a printf style formatting function by its use of the GNU format attribute.

A type representing the use of the C++11 auto keyword. auto val = some_typed_expr();

A conversion from a pointer or glvalue of a derived class to a pointer or glvalue of a direct or virtual base class.

A basic block in the C/C++ control-flow graph.

A C/C++ binary arithmetic operation.

A C/C++ binary bitwise operation.

A floating-point type whose representation is base 2.

A C/C++ binary logical operation.

A C/C++ binary operation.

A C structure member or C++ member variable declared with an explicit size in bits. For example the member variable x in the following code: struct MyStruct { int x : 3; };

A C/C++ bitwise AND expression. unsigned c = a & b;

A C/C++ bitwise OR expression. unsigned c = a | b;

A C/C++ bitwise XOR expression. unsigned c = a ^ b;

A compiler generated assignment operation that may occur in a compiler generated copy/move constructor or assignment operator, and which functions like memcpy where the size argument is based on the type of the rvalue of the assignment.

A code block expression, for example: ^ int (int x, int y) {return x + y;} Blocks are a language extension supported by Clang, and by Apple’s branch of GCC.

A C/C++ block statement.

A block type, for example, int(^)(char, float).

A conversion to bool. Returns false if the source value is zero, false, or nullptr. Returns true otherwise.

The C/C++ boolean type. See 4.2. This is the C _Bool type or the C++ bool type. For example: extern bool a, b; // C++ _Bool c, d; // C

A C/C++ ‘break’ statement.

A reason for a specific buffer write size estimate.

A C/C++ __builtin_bit_cast built-in operation (used by some implementations of std::bit_cast).

The __builtin_choose_expr expression. This is a gcc/clang extension.

The GNU __builtin_complex operation.

A GCC built-in function. For example: __builtin___memcpy_chk.

A C/C++ __INTADDR__ built-in operation (used by some implementations of offsetof). The operation retains its semantics even in the presence of an overloaded operator &). This is an EDG extension. struct S { int a, b; }; int d = __INTADDR__(struct S, b); // usually 4

A C++ __is_trivial built-in operation (used by some implementations of the <type_traits> header).

A Microsoft C/C++ __noop expression, which does nothing. __noop;

A C/C++ built-in operation. This is the root QL class encompassing built-in functionality.

A C++ __array_extent built-in operation (used by some implementations of the <type_traits> header).

A C++ __array_rank built-in operation (used by some implementations of the <type_traits> header).

A clang __builtin_addressof function (can be used to implement C++’s std::addressof).

A clang __builtin_convertvector expression.

A C++ __builtin_is_corresponding_member built-in operation (used by some implementations of the <type_traits> header).

A C++ __builtin_is_pointer_interconvertible_with_class built-in operation (used by some implementations of the <type_traits> header).

A C/C++ __builtin_offsetof built-in operation (used by some implementations of offsetof). The operation retains its semantics even in the presence of an overloaded operator &). This is a gcc/clang extension. struct S { int a, b; }; int d = __builtin_offsetof(struct S, b); // usually 4

A gcc __builtin_shuffle expression.

A clang __builtin_shufflevector expression.

A C++ __builtin_types_compatible_p built-in operation (used by some implementations of the <type_traits> header).

A C++ __has_assign built-in operation (used by some implementations of the <type_traits> header).

A C++ __builtin_has_attribute built-in operation.

A C++ __has_copy built-in operation (used by some implementations of the <type_traits> header).

The __has_finalizer built-in operation. This is a Microsoft extension.

A C++ __has_nothrow_assign built-in operation (used by some implementations of the <type_traits> header).

A C++ __has_nothrow_constructor built-in operation (used by some implementations of the <type_traits> header).

A C++ __has_nothrow_copy built-in operation (used by some implementations of the <type_traits> header).

The __has_nothrow_move_assign built-in operation (used by some implementations of the <type_traits> header).

A C++ __has_trivial_assign built-in operation (used by some implementations of the <type_traits> header).

A C++ __has_trivial_constructor built-in operation (used by some implementations of the <type_traits> header).

A C++ __has_trivial_copy built-in operation (used by some implementations of the <type_traits> header).

A C++ __has_trivial_destructor built-in operation (used by some implementations of the <type_traits> header).

The __has_trivial_move_assign built-in operation (used by some implementations of the <type_traits> header).

The __has_trivial_move_constructor built-in operation (used by some implementations of the <type_traits> header).

A C++ __has_unique_object_representations built-in operation (used by some implementations of the <type_traits> header).

A C++ __has_user_destructor built-in operation (used by some implementations of the <type_traits> header).

A C++ __has_virtual_destructor built-in operation (used by some implementations of the <type_traits> header).

A C++ __is_abstract built-in operation (used by some implementations of the <type_traits> header).

A C++ __is_aggregate built-in operation (used by some implementations of the <type_traits> header).

A C++ __is_arithmetic built-in operation (used by some implementations of the <type_traits> header).

A C++ __is_array built-in operation (used by some implementations of the <type_traits> header).

The __is_assignable built-in operation (used by some implementations of the <type_traits> header).

The __is_assignable_no_precondition_check built-in operation (used by some implementations of the <type_traits> header).

A C++ __is_base_of built-in operation (used by some implementations of the <type_traits> header).

A C++ __is_bounded_array built-in operation (used by some implementations of the <type_traits> header).

A C++ __is_class built-in operation (used by some implementations of the <type_traits> header).

A C++ __is_complete_type built-in operation.

A C++ __is_compound built-in operation (used by some implementations of the <type_traits> header).

A C++ __is_const built-in operation (used by some implementations of the <type_traits> header).

The __is_constructible built-in operation (used by some implementations of the <type_traits> header).

A C++ __is_convertible built-in operation (used by some implementations of the <type_traits> header).

A C++ __is_convertible_to built-in operation (used by some implementations of the <type_traits> header).

A C++ __is_corresponding_member built-in operation (used by some implementations of the <type_traits> header).

The __is_delegate built-in operation. This is a Microsoft extension.

The __is_destructible built-in operation (used by some implementations of the <type_traits> header).

A C++ __is_empty built-in operation (used by some implementations of the <type_traits> header).

A C++ __is_enum built-in operation (used by some implementations of the <type_traits> header).

The __is_final built-in operation (used by some implementations of the <type_traits> header).

A C++ __is_floating_point built-in operation (used by some implementations of the <type_traits> header).

A C++ __is_function built-in operation (used by some implementations of the <type_traits> header).

A C++ __is_fundamental built-in operation (used by some implementations of the <type_traits> header).

A C++ __is_integral built-in operation (used by some implementations of the <type_traits> header).

The __is_interface_class built-in operation. This is a Microsoft extension.

A C++ __is_layout_compatible built-in operation (used by some implementations of the <type_traits> header).

The __is_literal_type built-in operation (used by some implementations of the <type_traits> header).

A C++ __is_lvalue_reference built-in operation (used by some implementations of the <type_traits> header).

A C++ __is_member_function_pointer built-in operation (used by some implementations of the <type_traits> header).

A C++ __is_member_object_pointer built-in operation (used by some implementations of the <type_traits> header).

A C++ __is_member_pointer built-in operation (used by some implementations of the <type_traits> header).

The __is_nothrow_assignable built-in operation (used by some implementations of the <type_traits> header).

The __is_nothrow_constructible built-in operation (used by some implementations of the <type_traits> header).

A C++ __is_nothrow_convertible built-in operation (used by some implementations of the <type_traits> header).

The __is_nothrow_destructible built-in operation (used by some implementations of the <type_traits> header).

A C++ __is_object built-in operation (used by some implementations of the <type_traits> header).

A C++ __is_pod built-in operation (used by some implementations of the <type_traits> header).

A C++ __is_pointer built-in operation (used by some implementations of the <type_traits> header).

A C++ __is_pointer_interconvertible_base_of built-in operation (used by some implementations of the <type_traits> header).

A C++ __is_pointer_interconvertible_with_class built-in operation (used by some implementations of the <type_traits> header).

A C++ __is_polymorphic built-in operation (used by some implementations of the <type_traits> header).

The __is_ref_array built-in operation. This is a Microsoft extension.

The __is_ref_class built-in operation. This is a Microsoft extension.

A C++ __is_reference built-in operation (used by some implementations of the <type_traits> header).

A C++ __is_referenceable built-in operation.

A C++ __is_rvalue_reference built-in operation (used by some implementations of the <type_traits> header).

A C++ __is_same built-in operation (used by some implementations of the <type_traits> header).

A C++ __is_same_as built-in operation (used by some implementations of the <type_traits> header).

A C++ __is_scalar built-in operation (used by some implementations of the <type_traits> header).

A C++ __is_scoped_enum built-in operation (used by some implementations of the <type_traits> header).

The __is_sealed built-in operation. This is a Microsoft extension.

A C++ __is_signed built-in operation (used by some implementations of the <type_traits> header).

The __is_simple_value_class built-in operation. This is a Microsoft extension.

The __is_standard_layout built-in operation (used by some implementations of the <type_traits> header).

The __is_trivially_assignable built-in operation (used by some implementations of the <type_traits> header).

The __is_trivially_constructible built-in operation (used by some implementations of the <type_traits> header).

The __is_trivially_copy_assignable built-in operation (used by some implementations of the <type_traits> header).

The __is_trivially_copyable built-in operation (used by some implementations of the <type_traits> header).

The __is_trivially_destructible built-in operation (used by some implementations of the <type_traits> header).

A C++ __is_trivially_equality_comparable built-in operation.

A C++ __is_trivially_relocatable built-in operation.

A C++ __is_unbounded_array built-in operation (used by some implementations of the <type_traits> header).

A C++ __is_union built-in operation (used by some implementations of the <type_traits> header).

A C++ __is_unsigned built-in operation (used by some implementations of the <type_traits> header).

The __is_valid_winrt_type built-in operation. This is a Microsoft extension.

The __is_value_class built-in operation. This is a Microsoft extension.

A C++ __is_void built-in operation (used by some implementations of the <type_traits> header).

A C++ __is_volatile built-in operation (used by some implementations of the <type_traits> header).

The __is_win_class built-in operation. This is a Microsoft extension.

The __is_win_class built-in operation. This is a Microsoft extension.

A C++ __reference_binds_to_temporary built-in operation (used by some implementations of the <tuple> header).

A C++ __reference_constructs_from_temporary built-in operation (used by some implementations of the <type_traits> header).

A C++ __reference_converts_from_temporary built-in operation (used by some implementations of the <type_traits> header).

A C/C++ built-in primitive type (int, float, void, and so on). See 4.1.1. In the following example, unsigned int and double denote primitive built-in types: double a; unsigned int ua[40]; typedef double LargeFloat;

A C/C++ __builtin_va_arg built-in operation (used by some implementations of va_arg). ap = __builtin_va_arg(ap, long);

A C/C++ __builtin_va_copy built-in operation (used by some implementations of va_copy). va_list ap, aq; __builtin_va_start(ap, last_named_param); va_copy(aq, ap);

A C/C++ __builtin_va_end built-in operation (used by some implementations of va_end). __builtin_va_start(ap, last_named_param); ap = __builtin_va_arg(ap, long); __builtin_va_end(ap);

The __builtin_va_list type, used to provide variadic functionality.

A C/C++ __builtin_va_start built-in operation (used by some implementations of va_start). __builtin_va_list ap; __builtin_va_start(ap, last_named_param);

A node representing a C11 _Generic selection expression.

A C source file, as determined by file extension.

A cast expression in C, or a C-style cast expression in C++. float f = 3.0f; int i = (int)f;

A C style comment (one which starts with /*).

A traditional C/C++ typedef type. See 4.9.1. For example the type declared in the following code: typedef int my_int;

A C/C++ call.

A C/C++ cast expression.

A C++ ‘catch-any block’, for example the third block in the following code: try { f(); } catch(std::exception &e) { g(); } catch(...) { h(); }

A ‘catch block’, for example the second and third blocks in the following code: try { f(); } catch(std::exception &e) { g(); } catch(...) { h(); }

The C/C++ char16_t type. This is available starting with C11 and C++11. char16_t c16;

The C/C++ char32_t type. This is available starting with C11 and C++11. char32_t c32;

The C/C++ char8_t type. This is available starting with C++20. char8_t c8;

A character literal. For example: char c1 = 'a'; wchar_t c2 = L'b';

The C/C++ char* type.

The C/C++ character types. See 4.3. This includes the char, signed char and unsigned char types, all of which are distinct from one another. For example: char a, b; signed char c, d; unsigned char e, f;

A class type [N4140 9].

A C/C++ aggregate literal that initializes a class, struct, or union. For example: S s = { arg1, arg2, { arg3, arg4 }, arg5 };

A class derivation, for example the public B in the following code: class D : public B { ... };

A class that is an instantiation of a template. For example in the following code there is a MyTemplateClass<int> instantiation:

A specialization of a class template (this may be a full or partial template specialization - see FullClassTemplateSpecialization and PartialClassTemplateSpecialization).

A class written by the compiler to be the type of a C++11 lambda expression. For example the variable a in the following code has a closure type: auto a = [x, y](int z) -> int { return x + y + z; };

A C/C++ co_await expression. co_await foo();

A C/C++ co_return statement.

A C/C++ co_yield expression. co_yield 1;

A C/C++ comma expression.

A C/C++ comment. For example the comment in the following code: // C++ style single-line comment or a C style comment (which starts with /*).

A C/C++ comparison operation, that is, either an equality operation or a relational operation.

An invocation of the compiler. Note that more than one file may be compiled per invocation. For example, this command compiles three source files:

A compiler error that prevents compilation from continuing.

A compiler-generated discretionary error (a compile-time error that may be suppressed).

A compiler error message.

A compiler-generated remark (milder than a warning).

A compiler-generated warning.

A C/C++ complement expression. unsigned c = ~a;

The type domain of a floating-point type that represents a complex number.

A floating-point type representing a complex number.

A C++ compound requirement in a requires expression.

A ‘goto’ statement whose target is computed by a non-constant expression (a non-standard extension to C/C++).

A C++ concept id expression.

A C++ variable declaration inside the conditional expression of a while, if or for compound statement. Declaring a variable this way narrows its lifetime and scope to be strictly the compound statement itself. For example: extern int x, y; if (bool c = x < y) { do_something_with(c); } // c is no longer in scope while (int d = x - y) { do_something_else_with(d); } // d is no longer is scope

A C/C++ conditional ternary expression. a = (b > c ? d : e);

A C/C++ conditional statement, that is, either an ‘if’ statement or a ‘switch’ statement.

A C/C++ GNU conjugation expression. It operates on _Complex or __complex__numbers, and is similar to the C99 conj, conjf and conjl functions. _Complex double a = ( 1.0, 2.0 ); _Complex double b = ~ a; // ( 1.0, - 2.0 )

A C++ const_cast expression.

A const C++ member function [N4140 9.3.1/4]. A const function has the const specifier and does not modify the state of its class. For example the member function day in the following code:

A C/C++ ‘constexpr if’ statement. For example, the if constexpr statement in the following code: if constexpr (x) { ... }

A C++ constructor [N4140 12.1]. For example the function MyClass in the following code is a constructor: class MyClass { public: MyClass() { ... } };

A call to a constructor of a base class as part of a constructor’s initializer list or compiler-generated actions.

A call to a constructor. struct S { S(void) {} }; S s;

A call to a constructor of the same class as part of a constructor’s initializer list, which delegates object construction (C++11 only). struct S { int a; S(int b): a(b) { } S(): S(0) { } // delegation to another constructor };

A call to a constructor of a direct non-virtual base class as part of a constructor’s initializer list or compiler-generated actions. struct S { int a; S(int b): a(b) {} }; struct T: S { T(): S(33) {} // S(33) is a constructor call };

An initialization of a member variable performed as part of a constructor’s explicit initializer list or implicit actions. In the example below, member variable b is being initialized by constructor parameter a: struct S { int b; S(int a): b(a) {} } s(2);

An initialization of a base class or member variable performed as part of a constructor’s explicit initializer list or implicit actions.

A call to a constructor of a virtual base class as part of a constructor’s initializer list or compiler-generated actions.

A file or folder.

A C/C++ ‘continue’ statement.

A control-flow node is either a statement or an expression; in addition, functions are control-flow nodes representing the exit point of the function. The graph represents one possible evaluation order out of all the ones the compiler might have picked.

An element that is convertible to ControlFlowNode. This class is similar to ControlFlowNode except that is has no member predicates apart from toString.

A C/C++ control structure, that is, either a conditional statement or a loop.

A C/C++ cast expression or similar unary expression that doesn’t affect the logical value of its operand.

A C++ conversion operator [N4140 12.3.2]. For example the function operator int in the following code is a ConversionOperator: class MyClass { public: operator int(); };

A C++ copy assignment operator [N4140 12.8]. For example the function operator= in the following code is a CopyAssignmentOperator: class MyClass { public: MyClass &operator=(const MyClass &other); };

A C++ copy constructor [N4140 12.8]. For example the function MyClass in the following code is a CopyConstructor: class MyClass { public: MyClass(const MyClass &from) { ... } };

A C++ source file, as determined by file extension.

A CPP style comment. For example the comment in the following code: // C++ style single-line comment

A C/C++ ++ or -- expression (either prefix or postfix).

INTERNAL: Do not use. A string that identifies a data flow analysis along with a set of member predicates that implement this analysis.

A C++ __datasizeof expression whose operand is an expression.

A C++ __datasizeof expression (used by some implementations of the <type_traits> header).

A C++ __datasizeof expression whose operand is a type name.

An deallocation expression such as call to free or a delete expression.

A deallocation function such as free.

The GNU C _Decimal128 primitive type. This is not standard C/C++. _Decimal128 d128;

The GNU C _Decimal32 primitive type. This is not standard C/C++. _Decimal32 d32;

The GNU C _Decimal64 primitive type. This is not standard C/C++. _Decimal64 d64;

A floating-point type whose representation is base 10.

A C/C++ ‘declaration’ statement.

A C/C++ declaration: for example, a variable declaration, a type declaration, or a function declaration.

A C/C++ declaration entry. For example the following code contains five declaration entries: extern int myGlobal; int myVariable; typedef char MyChar; void myFunction(); void myFunction() { // ... } See the comment above Declaration for an explanation of the relationship between Declaration and DeclarationEntry.

An attribute introduced by Microsoft’s __declspec(name) syntax. For example the attribute on the following declaration: __declspec(dllimport) void myFunction();

An instance of the C++11 decltype operator. For example: int a; decltype(a) b;

A C/C++ -- expression (either prefix or postfix).

A C++ deduction guide [N4659 17.9].

A definition of a stack variable.

Utility class: A definition or use of a stack variable.

A C/C++ ‘default case’ statement.

A class or struct type that has both a lock and an unlock function candidate, and is therefore a mutex.

A C++ delete[] (array) expression. delete[] arr;

A C++ delete (non-array) expression. delete ptr;

A C++ delete or delete[] expression.

A conversion from a pointer or glvalue to a base class to a pointer or glvalue to a direct derived class.

A C/C++ derived type.

A C++ destructor [N4140 12.4]. For example the function ~MyClass in the following code is a destructor: class MyClass { public: ~MyClass() { ... } };

A call to a destructor of a base class as part of a destructor’s compiler-generated actions.

A call to a destructor. struct S { ~S(void) {} } *s; s->~S();

A call to a destructor of a base class or field as part of a destructor’s compiler-generated actions.

A call to a destructor of a direct non-virtual base class as part of a destructor’s compiler-generated actions. struct S { ~S(void) {} }; struct T: S { ~T(void) {} // will call ~S() };

A destruction of a member variable performed as part of a destructor’s compiler-generated actions. struct S { ~S(void) {} }; struct T { S s; ~T(void) {} // will call s.~S() };

A call to a destructor of a direct virtual base class as part of a destructor’s compiler-generated actions.

A compiler-generated error, warning or remark.

A C/C++ divide expression. c = a / b;

A C/C++ ‘do’ statement.

A field access of the form obj.field. The type of obj is either a class/struct/union or a reference to one. DotFieldAccess has two sub-classes, ValueFieldAccess and ReferenceFieldAccess, to distinguish whether or not the type of obj is a reference type.

The C/C++ double type. double d;

A C++ dynamic_cast expression.

A C/C++ equal expression. bool c = (a == b);

A C/C++ element. This class is the base class for all C/C++ elements, such as functions, classes, expressions, and so on.

A C/C++ element with no member predicates other than toString. Not for general use. This class does not define a location, so classes wanting to change their location without affecting other classes can extend ElementBase instead of Element to create a new rootdef for getURL, getLocation, or hasLocationInfo.

A C/C++ ‘empty’ statement.

An entry point of a function.

A C/C++ enum [N4140 7.2]. For example, the types MyEnum and MyScopedEnum in:

A C/C++ enumerator [N4140 7.2], also known as an enumeration constant.

A C/C++ enum constant access expression. For example the access to MYENUMCONST1 in myFunction in the following code:

A C/C++ ‘switch’ statement where the controlling expression has an enum type.

A C/C++ equality operation, that is, either “==” or “!=”.

An erroneous type. This type has no corresponding C/C++ syntax.

A C/C++ expression that could not be resolved, or that can no longer be represented due to a database upgrade or downgrade.

A basic block whose last node is the exit point of a function.

A C/C++ expression.

A C/C++ call which is performed through a function pointer.

An expression that occurs in a void context, i.e. either as the toplevel expression of an expression statement or on the left hand side of the comma operator.

A C/C++ ‘expression’ statement.

A C/C++ minimum-width numeric type, representing the fastest integer type with a width of at least N such as int_fast8_t.

A C structure member or C++ non-static member variable. For example the member variable m in the following code (but not s): class MyClass { public: int m; static int s; };

A C/C++ field access expression. For example the accesses to x and y in myMethod in the following code:

A file that was observed on disk during the build process.

An enum type based on a fixed-width integer type. For instance, enum e: uint8_t = { a, b };

A C/C++ fixed-width numeric type, such as int8_t.

The GNU C __float128 primitive type. This is not standard C/C++. __float128 f128;

The C/C++ float type. float f;

A conversion from one floating point type.

A conversion from a floating point type to an integral or enum type.

The C/C++ floating point types. See 4.5. This includes float, double and long double, the fixed-size floating-point types like _Float32, the extended-precision floating-point types like _Float64x, and the decimal floating-point types like _Decimal32. It also includes the complex and imaginary versions of all of these types.

A C++17 fold expression. This will only appear in an uninstantiated template; any instantiations of the template will instead contain the sequence of expressions given by expanding the fold. template < typename... T > auto sum ( T... t ) { return ( t + ... + 0 ); }

A folder that was observed on disk during the build process.

A C/C++ ‘for’ statement.

A GNU format attribute of the form __attribute__((format(archetype, format-index, first-arg))) that declares a function to accept a printf style format string. For example the attribute on the following declaration: int myPrintf(const char *format, ...) __attribute__((format(printf, 1, 2)));

A class to represent format strings that occur as arguments to invocations of formatting functions.

A standard library function that uses a printf-like formatting string.

A call to one of the formatting functions.

A C++ friend declaration [N4140 11.3]. For example the two friend declarations in class A of the following code:

A full specialization of a class template. For example MyTemplateClass<int> in the following code is a FullClassTemplateSpecialization:

A C/C++ function [N4140 8.3.5]. Both member functions and non-member functions are included. For example the function MyFunction in: void MyFunction() { DoSomething(); }

A C/C++ function access expression. For example the access to myFunctionTarget in myFunction in the following code:

A C/C++ function call where the name of the target function is known at compile-time.

A particular declaration or definition of a C/C++ function. For example the declaration and definition of MyFunction in the following code are each a FunctionDeclarationEntry:

An input to a function. This can be: - The value of one of the function’s parameters - The value pointed to by one of function’s pointer or reference parameters - The value of the function’s this pointer - The value pointed to by the function’s this pointer

An output from a function. This can be: - The value pointed to by one of function’s pointer or reference parameters - The value pointed to by the function’s this pointer - The function’s return value - The value pointed to by the function’s return value, if the return value is a pointer or reference

A C/C++ pointer to a function, a C++ function reference, or a clang/Apple block.

A C/C++ pointer to a function. See 7.7. int(* pointer)(const void *element1, const void *element2);

A C++ reference to a function. int(& reference)(const void *element1, const void *element2);

A C/C++ function specifier: inline, virtual, or explicit.

A function that is an instantiation of a template. For example the instantiation myTemplateFunction<int> in the following code:

An explicit specialization of a C++ function template. For example the function myTemplateFunction<int> in the following code:

A C++ ‘function try’ statement.

A C/C++ greater than or equal expression. bool c = (a >= b);

A GNU/Clang vector type.

A C/C++ greater than expression. bool c = (a > b);

The C/C++ global namespace.

A C/C++ variable which has global scope or namespace scope. For example the variables a and b in the following code:

A C/C++ variable which has global scope. For example the variable a in the following code:

A conversion of a glvalue from one type to another. The conversion does not modify the address of the glvalue. For glvalue conversions involving base and derived classes, see BaseClassConversion and DerivedClassConversion.

An attribute introduced by GNU’s __attribute__((name)) syntax, for example: __attribute__((__noreturn__)).

A C/C++ ‘goto’ statement which jumps to a label.

A handler for a ‘try’ statement.

A C/C++ header file, as determined (mainly) by file extension.

An expression that might allocate memory.

An function that might allocate memory.

A hexadecimal literal. unsigned int32_t minus2 = 0xfffffffe;

A C/C++ ‘if’ statement. For example, the if statement in the following code: if (x == 1) { ... }

A C/C++ divide expression with an imaginary number. This is specific to C99 and later. double z; _Imaginary double y; z = z / y;

The type domain of a floating-point type that represents an imaginary number.

A C/C++ multiply expression with an imaginary number. This is specific to C99 and later. double z; _Imaginary double x, y; z = x * y;

A floating-point type representing an imaginary number.

A C/C++ GNU imaginary part expression. It operates on _Complex or __complex__ numbers. _Complex double f = { 2.0, 3.0 }; double d = __imag(f); // 3.0

A C/C++ add expression with an imaginary term and a real term. This is specific to C99 and later. double z; _Imaginary double x; _Complex double w; w = x + z;

A C/C++ subtract expression with an imaginary term and a real term. This is specific to C99 and later. double z; _Imaginary double x; _Complex double w; w = x - z;

A function that defines an implicit conversion.

A field access of a field of this which has no qualifier because the use of this is implicit. For example, in the following code the implicit call to the destructor of A has no qualifier because the use of this is implicit:

A #import preprocessor directive (used heavily in Objective C, and supported by GCC as an extension in C). For example the following code contains one Import directive: #import <header3.h>

The input value of a parameter.

The input value pointed to by a pointer parameter to a function, or the input value referred to by a reference parameter to a function.

The input value of the this pointer of an instance member function.

The input value pointed to by the this pointer of an instance member function.

The input value pointed to by the return value of a function, if the function returns a pointer, or the input value referred to by the return value of a function, if the function returns a reference.

A C/C++ #include, #include_next, or #import preprocessor directive. The following example contains four different Include directives: #include "header.h" #include <string> #include_next <header2.h> #import <header3.h>

A #include_next preprocessor directive (a non-standard extension to C/C++). For example the following code contains one IncludeNext directive: #include_next <header2.h>

A C/C++ ++ expression (either prefix or postfix).

A conversion between two pointers or _glvalue_s related by inheritance.

A C/C++ declaration initializer. For example the initializers 1, 2 and 3 in the following code:

The GNU C __int128 primitive types. They are not part of standard C/C++.

The C/C++ int16_t type.

The C/C++ int32_t type.

The C/C++ int64_t type.

The C/C++ int8_t type.

The C/C++ int* type.

The C/C++ integer types. See 4.4. This includes int, signed int and unsigned int. unsigned int ui;

The C/C++ int_fast16_t type.

The C/C++ int_fast32_t type.

The C/C++ int_fast64_t type.

The C/C++ int_fast8_t type.

The C/C++ int_least16_t type.

The C/C++ int_least32_t type.

The C/C++ int_least64_t type.

The C/C++ int_least8_t type.

A conversion from one integral or enum type to another.

A C/C++ integral or enum type.

A conversion from an integral or enum type to a floating point type.

A conversion from an integral or enum type to a pointer type.

The C/C++ integral types. See 4.1.1. These are types that are represented as integers of varying sizes. Both enum types and floating-point types are excluded.

The C/C++ intmax_t type.

A C/C++ jump statement.

A C/C++ less than or equal expression. bool c = (a <= b);

A C/C++ left shift expression. unsigned c = a << b;

A C/C++ less than expression. bool c = (a < b);

A C++11 lvalue reference type (e.g. int &). int a; int& b = a;

A label literal, that is, a use of the ‘&&’ operator to take the address of a label for use in a computed goto statement. This is a non-standard C/C++ extension.

A C/C++ ‘label’ statement.

Information about a value captured as part of a lambda expression. For example in the following code, information about x and y is captured: auto a = [x, y](int z) -> int { return x + y + z; };

A C++11 lambda expression, for example the expression initializing a in the following code: auto a = [x, y](int z) -> int { return x + y + z; };

A linker call during the build process, typically resulting in an executable or a shared library.

A C/C++ literal.

A class, struct or union that is directly enclosed by a function. For example the struct in the following code is a LocalClass: void myFunction() { struct { int x; int y; } vec = { 1, 2 }; };

A C/C++ enum that is directly enclosed by a function. For example, the type MyLocalEnum in: void myFunction() { enum MyLocalEnum { MyLocalEnumConstant }; }

A C/C++ variable with block scope [N4140 3.3.3]. In other words, a local variable or a function parameter. For example, the variables a, b and c in the following code: void myFunction(int a) { int b; static int c; }

A C/C++ struct that is directly enclosed by a function. For example, the type MyLocalStruct in: void myFunction() { struct MyLocalStruct { int x, y, z; }; }

A C++ typedef type that is directly enclosed by a function. For example the type declared inside the function foo in the following code: int foo(void) { typedef int local; }

A C/C++ union that is directly enclosed by a function. For example, the type MyLocalUnion in: void myFunction() { union MyLocalUnion { int i; float f; }; }

A C/C++ local variable. In other words, any variable that has block scope [N4140 3.3.3], but is not a parameter of a Function or CatchBlock. For example the variables b and c in the following code: void myFunction(int a) { int b; static int c; }

A C/C++ element that has a location in a file

A location of a C/C++ artifact.

A C/C++ logical AND expression. if (a && b) { }

A C/C++ logical OR expression. if (a || b) { }

The C/C++ long double type. long double ld;

The C/C++ long long types. See 4.4. This includes long long, signed long long and unsigned long long. signed long long sll;

The C/C++ long types. See 4.4. This includes long, signed long and unsigned long. long l;

A C/C++ loop, that is, either a ‘while’ loop, a ‘for’ loop, or a ‘do’ loop.

A C/C++ variable which is used within the initialization, condition, or update expression of a ‘for’ loop.

A C/C++ variable which is used within the condition of a ‘for’ loop, and mutated within the update expression of the same ‘for’ loop.

A macro. For example, the macro MYMACRO in the following code: #define MYMACRO 1

A macro access. For example: #ifdef MACRO1 // this line contains a MacroAccess int x = MACRO2; // this line contains a MacroAccess #endif

A macro invocation (macro access that is expanded). For example: #ifdef MACRO1 int x = MACRO2; // this line contains a MacroInvocation #endif

A C/C++ GNU max expression. c = a >? b;

A C/C++ maximum-width numeric type, either intmax_t or uintmax_t.

A C++ function declared as a member of a class [N4140 9.3]. This includes static member functions. For example the functions MyStaticMemberFunction and MyMemberFunction in:

A C structure member or C++ member variable. For example the member variables m and s in the following code: class MyClass { public: int m; static int s; };

A wrapper that provides metrics for a C++ class.

A wrapper that provides metrics for a C/C++ file.

A wrapper that provides metrics for a C/C++ function.

A wrapper that provides metrics for a C/C++ namespace.

An attribute introduced by Microsoft’s “[name]” syntax, for example “[SA_Pre(Deref=1,Access=SA_Read)]”.

The type that the Microsoft C/C++ __int16 type specifier is a synonym for. Note that since __int16 is not a distinct type, MicrosoftInt16Type corresponds to an existing IntegralType as well.

The type that the Microsoft C/C++ __int32 type specifier is a synonym for. Note that since __int32 is not a distinct type, MicrosoftInt32Type corresponds to an existing IntegralType as well.

The type that the Microsoft C/C++ __int64 type specifier is a synonym for. Note that since __int64 is not a distinct type, MicrosoftInt64Type corresponds to an existing IntegralType as well.

The type that the Microsoft C/C++ __int8 type specifier is a synonym for. Note that since __int8 is not a distinct type, MicrosoftInt8Type corresponds to an existing IntegralType as well.

A structured exception handling ‘try except’ statement, for example the __try statement in the following code: __try { f(); } __except(myExceptionFilter()) { g() } This is a Microsoft C/C++ extension.

A structured exception handling ‘try finally’ statement, for example the __try statement in the following code: __try { f(); } __finally { g() } This is a Microsoft C/C++ extension.

A structured exception handling ‘try’ statement, that is, a __try __except or __try __finally statement. This is a Microsoft C/C++ extension.

A C/C++ GNU min expression. c = a <? b;

A C/C++ minimum-width numeric type, such as int_least8_t.

A C++ move assignment operator [N4140 12.8]. For example the function operator= in the following code is a MoveAssignmentOperator: class MyClass { public: MyClass &operator=(MyClass &&other); };

A C++ move constructor [N4140 12.8]. For example the function MyClass in the following code is a MoveConstructor: class MyClass { public: MyClass(MyClass &&from) { ... } };

A C/C++ multiply expression. c = a * b;

A type that acts as a mutex. This class is extended below and and may be extended in Options.qll.

A C/C++ not equal expression. bool c = (a != b);

A use of the NULL macro.

A C++ element that can be qualified with a name. This is in practice either an expression or a name qualifier. For example, there are two name-qualifiable elements in the following code, the expression f() (which is qualified by N::), and the qualifier N:: (which is not itself qualified in this example):

A C++ name qualifier, for example N:: in the following code:

A C++ element that can qualify a name. For example, the namespaces A and A::B and the class A::C in the following code:

A C++ namespace. For example the (single) namespace A in the following code:

A declaration of (part of) a C++ namespace. This corresponds to a single namespace N { ... } occurrence in the source code. For example the two mentions of A in the following code:

A C/C++ variable which has namespace scope. For example the variable b in the following code:

A class, struct or union that is declared within another class. For example the struct PairT in the following code is a nested class: template<class T> class MyTemplateClass { public: struct PairT { T first, second; }; };

A C/C++ enum that is declared within a class/struct. For example, the type MyNestedEnum in: class MyClass { public: enum MyNestedEnum { MyNestedEnumConstant }; };

A C++ nested requirement in a requires expression.

A C/C++ nested struct. See 11.12. For example, the type MyNestedStruct in: class MyClass { public: struct MyNestedStruct { int x, y, z; }; };

A C++ typedef type that is directly enclosed by a class, struct or union. For example the type declared inside the class C in the following code: class C { typedef int nested; };

A C/C++ nested union. For example, the type MyNestedUnion in: class MyClass { public: union MyNestedUnion { int i; float f; }; };

A C++ new[] (array) expression. Foo *foo = new Foo[]{1, 3, 5}; Bar *bar = new Bar[5];

A C++ new (non-array) expression. Foo *ptr = new Foo(3);

A C++ new or new[] expression.

A C++ constructor that takes no arguments (‘default’ constructor). This is the constructor that is invoked when no initializer is given. For example the function MyClass in the following code is a NoArgConstructor: class MyClass { public: MyClass() { ... } };

A C++11 noexcept expression, returning true if its subexpression is guaranteed not to throw exceptions. For example: if (noexcept(func_1() + func_2())) { }

A C/C++ logical not expression. c = !a;

A macro defining NULL.

The (primitive) type of the C++11 nullptr constant. It is a distinct type, denoted by decltype(nullptr), that is not itself a pointer type or a pointer to member type. The <cstddef> header usually defines the std::nullptr_t type as follows: typedef decltype(nullptr) nullptr_t;

A C/C++ literal whose value is considered null.

INTERNAL: Do not use. Two analyses relating to nullness: "pointer-null" and "pointer-valid". These analyses mark expressions that are possibly null or possibly non-null, respectively.

An octal literal. For example: char esc = 033; Octal literals must always start with the digit 0.

A C/C++ operation.

A C++ user-defined operator [N4140 13.5].

An operator delete or operator delete[] function that may be associated with delete or delete[] expressions. Note that delete and delete[] are not function calls, but these functions may also be called directly.

An operator new or operator new[] function that may be associated with new or new[] expressions. Note that new and new[] are not function calls, but these functions may also be called directly.

Default predicates that specify information about the behavior of the program being analyzed.

The output value pointed to by a pointer parameter to a function, or the output value referred to by a reference parameter to a function.

The output value pointed to by the this pointer of an instance member function.

The value returned by a function.

The output value pointed to by the return value of a function, if the function returns a pointer, or the output value referred to by the return value of a function, if the function returns a reference.

An instance of a user-defined binary operator[] applied to its arguments. struct T2 { T1 operator[](const T3 &); }; T1 a; T2 b; T3 c; a = b[c];

An instance of a user-defined unary operator* applied to its argument. T1 operator*(const T2 &); T1 a; T2 b; a = *b;

A user-defined unary operator* function.

An access to a parameter of a function signature for the purposes of a decltype.

A C/C++ function parameter, catch block parameter, or requires expression parameter. For example the function parameter p and the catch block parameter e in the following code: void myFunction(int p) { try { ... } catch (const std::exception &e) { ... } }

A parameter as described within a particular declaration or definition of a C/C++ function. For example the declaration of a in the following code: void myFunction(int a) { int b; }

A definition of a parameter.

An int that is a parameter index for some function. This is needed for binding in certain cases.

A C/C++ parenthesis expression.

A C++11 parenthesized braced initializer list within a template.

A partial specialization of a class template. For example MyTemplateClass<int, T> in the following code is a PartialClassTemplateSpecialization:

A function that may update part of a FunctionOutput.

The C/C++ char type (which is distinct from signed char and unsigned char). For example: char a, b;

A C/C++ pointer add expression. foo *ptr = &f[0]; ptr = ptr + 2;

A C/C++ pointer arithmetic operation.

A conversion from one pointer type to another.

An instance of the built-in unary operator * applied to a type.

A C/C++ pointer difference expression. foo *start = &f[0], *end = &f[4]; int size = end - size;

A field access whose qualifier is a pointer to a class, struct or union. These typically take the form obj->field. Another case is a field access with an implicit this-> qualifier, which is often a PointerFieldAccess (but see also ImplicitThisFieldAccess).

A C/C++ pointer subtract expression. foo *ptr = &f[3]; ptr = ptr - 2;

A C++ pointer to non-static data member literal. For example, &C::x is an expression that refers to field x of class C. If the type of that field is int, then &C::x ought to have type int C::*. It is currently modeled in QL as having type int.

A conversion from a pointer type to an integral or enum type.

A conversion from a pointer-to-member of a derived class to a pointer-to-member of an immediate base class.

A conversion from one pointer-to-member type to another.

A conversion from a pointer-to-member of a base class to a pointer-to-member of an immediate derived class.

A C++ pointer to data member. See 15.5. class C { public: int m; }; int C::* p = &C::m; // pointer to data member m of class C class C c; int val = c.*p; // access data member

A C/C++ pointer type. See 4.9.1. void *ptr; void **ptr2 = &ptr;

A C++ class or structure which (possibly by inheritance) has at least one virtual method.

A C/C++ ++ or -- postfix expression.

A C/C++ postfix decrement expression, as in x--.

A C/C++ postfix increment expression, as in x++.

A C/C++ ++ or -- prefix expression.

A C/C++ prefix decrement expression, as in --x.

A C/C++ prefix increment expression, as in ++x.

A C/C++ preprocessor branching directive: #if, #ifdef, #ifndef, or #elif.

A C/C++ preprocessor branch related directive: #if, #ifdef, #ifndef, #elif, #else or #endif.

A C/C++ preprocessor directive. For example each of the following lines of code contains a PreprocessorDirective: #pragma once #ifdef MYDEFINE #include "myfile.h" #line 1 "source.c"

A C/C++ preprocessor #elif directive. For example there is a PreprocessorElif on the third line of the following code: #ifdef MYDEFINE1 // ... #elif MYDEFINE2 // ... #else // ... #endif

A C/C++ preprocessor #else directive. For example there is a PreprocessorElse on the fifth line of the following code: #ifdef MYDEFINE1 // ... #elif MYDEFINE2 // ... #else // ... #endif

A C/C++ preprocessor #endif directive. For example there is a PreprocessorEndif on the third line of the following code: #ifdef MYDEFINE // ... #endif

A C/C++ preprocessor #error directive. For example: #error "This configuration is not implemented."

A C/C++ preprocessor #if directive. For example there is a PreprocessorIf on the first line of the following code: #if defined(MYDEFINE) // ... #endif For the related notion of a directive which causes branching (which includes #if, plus also #ifdef, #ifndef, and #elif), see PreprocessorBranch.

A C/C++ preprocessor #ifdef directive. For example there is a PreprocessorIfdef on the first line of the following code: #ifdef MYDEFINE // ... #endif The syntax #ifdef X is shorthand for #if defined(X).

A C/C++ preprocessor #ifndef directive. For example there is a PreprocessorIfndef on the first line of the following code: #ifndef MYDEFINE // ... #endif The syntax #ifndef X is shorthand for #if !defined(X).

A C/C++ preprocessor #line directive. For example: #line 1 "source.c"

A C/C++ preprocessor #pragma directive. For example: #pragma once

A C/C++ preprocessor #undef directive. For example there is a PreprocessorUndef on the second line of the following code: #ifdef MYMACRO #undef MYMACRO #endif

A C/C++ preprocessor #warning directive. For example: #warning "This configuration is not supported."

The proxy class (where needed) associated with a template parameter, as in the following code: template <typename T> struct S : T { // the type of this T is a proxy class ... };

The adjustment of the type of a class prvalue. Most commonly seen in code similar to: class String { ... }; String func(); void caller() { const String& r = func(); } In the above example, the result of the call to func is a prvalue of type String, which will be adjusted to type const String before being bound to the reference.

The C/C++ ptrdiff_t type.

A C++ pure virtual function [N4140 10.4]. For example the first function called myVirtualFunction in the following code:

An expression that is used to qualify some other expression.

A C/C++ right shift expression. unsigned c = a >> b;

A C++11 rvalue reference type (e.g., int &&). It is used to implement “move” semantics for object construction and assignment. class C { E e; C(C&& from): e(std::move(from.e)) { } };

A C++11 range-based ‘for’ statement.

The SSA logic comes in two versions: the standard SSA and range-analysis RangeSSA. This class provides the range-analysis SSA logic.

A definition of one or more SSA variables, including phi node definitions. An SSA variable is effectively the pair of a definition and the (non-SSA) variable that it defines. Note definitions and uses can be coincident, due to the presence of parameter definitions and phi nodes.

A C++ throw expression with no argument (which causes the current exception to be re-thrown). throw;

The type domain of a floating-point type that represents a real number.

A C/C++ add expression with a real term and an imaginary term. This is specific to C99 and later. double z; _Imaginary double x; _Complex double w; w = z + x;

A C/C++ subtract expression with a real term and an imaginary term. This is specific to C99 and later. double z; _Imaginary double x; _Complex double w; w = z - x;

A floating-point type representing a real number.

A C/C++ GNU real part expression. It operates on _Complex or __complex__ numbers. _Complex double f = { 2.0, 3.0 }; double d = __real(f); // 2.0

An implicit conversion from type T & to type T.

A field access of the form obj.field, where the type of obj is a reference to a class/struct/union. For example the accesses to y in myMethod in the following code:

An implicit conversion from type T to type T &.

A C++ reference type. See 4.9.1.

A C++ reinterpret_cast expression.

A C/C++ relational operation, that is, one of <=, <, >, or >=.

A C/C++ remainder expression. c = a % b;

A C++ requirement in a requires expression.

A C++ requires expression.

A C/C++ ‘return’ statement.

An expression representing the re-use of another expression.

A C/C++ routine type. Conceptually, this is what results from stripping away the pointer from a function pointer type. It can also occur in C++ code, for example the base type of myRoutineType in the following code:

A C++ scoped enum, that is, an enum whose constants must be qualified with the name of the enum. For example, the type Color in: enum class Color { red, blue }

A non-static local variable or parameter that is not part of an uninstantiated template. Uninstantiated templates are purely syntax, and only on instantiation will they be complete with information about types, conversions, call targets, etc. For example in the following code, the variables a in myFunction and b in the instantiation myTemplateFunction<int>, but not b in the template myTemplateFunction<T>:

The C/C++ short types. See 4.3. This includes short, signed short and unsigned short. signed short ss;

The C/C++ signed char type (which is distinct from plain char even when char is signed by default). signed char c, d;

A C++ simple requirement in a requires expression.

The C/C++ size_t type.

A C/C++ sizeof expression whose operand is an expression. if (sizeof(a) == sizeof(b)) { c = (b)a; }

A C/C++ sizeof expression.

A C++11 sizeof... expression which determines the size of a template parameter pack.

A C/C++ sizeof expression whose operand is a type name. int szlong = sizeof(int) == sizeof(long)? 4 : 8;

The standard functions snprintf and swprintf, and their Microsoft and glib variants.

A C++ three-way comparison operation, also known as the spaceship operation. This is specific to C++20 and later. auto c = (a <=> b);

A special name-qualifying element. For example: __super.

A type with specifiers. const int a; volatile char v;

A C/C++ specifier: friend, auto, register, static, extern, mutable, inline, virtual, or explicit.

A definition of one or more SSA variables, including phi node definitions. An SSA variable, as defined in the literature, is effectively the pair of an SsaDefinition d and a StackVariable v, written (d, v) in this documentation. Note that definitions and uses can be coincident due to the presence of parameter definitions and phi nodes.

Common SSA logic for standard SSA and range-analysis SSA.

The C/C++ ssize_t type.

A C/C++ variable with automatic storage duration. In other words, a function parameter or a local variable that is not static or thread-local. For example, the variables a and b in the following code. void myFunction(int a) { int b; static int c; }

The SSA logic comes in two versions: the standard SSA and range-analysis RangeSSA. This class provides the standard SSA logic.

A C++11 static_assert or C11 _Static_assert construct. For example each line in the following example contains a static assert: static_assert(sizeof(MyStruct) <= 4096); static_assert(sizeof(MyStruct) <= 4096, "MyStruct is too big!");

A C++ static_cast expression.

A C++ local variable declared as static.

A variable whose contents always have static storage duration. This can be a global variable, a namespace variable, a static local variable, or a static member variable.

An attribute introduced by the C++11 standard [[name]] syntax, for example: [[clang::fallthrough]].

The C++ std:: namespace and its inline namespaces.

A C/C++ statement.

A compound statement enclosed in parentheses used as an expression (a GNU extension to C/C++). In the example below, b is the return value from the compound statement. int a = ({ int b = c + d; b; });

An element that is the parent of a statement in the C/C++ AST.

A C/C++ storage class specifier: auto, register, static, extern, or mutable.

A string literal. For example: const char *s1 = "abcdef"; const wchar_t *s2 = L"123456";

A call to a strlen like function.

A C/C++ structure or union. For example, the types MyStruct and MyUnion in:

A class that is either a struct or just has getters and setters for its members. In either case it just stores data and has no real encapsulation.

A C/C++ subtract expression. c = a - b;

A C/C++ ‘switch case’ statement.

A C/C++ ‘switch’ statement.

A library function for which a taint-tracking library should propagate taint from a parameter or qualifier to an output buffer, return value, or qualifier.

A class template (this class also finds partial specializations of class templates). For example in the following code there is a MyTemplateClass<T> template: template<class T> class MyTemplateClass { ... }; Note that this does not include template instantiations, and full specializations. See ClassTemplateInstantiation and FullClassTemplateSpecialization.

A C++ function which has a non-empty template argument list. For example the function myTemplateFunction in the following code: template<class T> void myTemplateFunction(T t) { ... }

A C++ typename (or class) template parameter.

A C++ template template parameter.

A C++14 variable template. For example, in the following code the variable template v defines a family of variables: template<class T> T v;

A node representing a temporary object created as part of an expression.

A character literal or a string literal.

A C++ this expression.

A C++ throw expression. throw Exc(2);

A C/C++ non-member function (a function that is not a member of any class). For example, in the following code, MyFunction is a TopLevelFunction but MyMemberFunction is not:

A C/C++ ‘try’ statement.

A C/C++ type.

The estimation comes from rough bounds just based on the type (e.g. 0 <= x < 2^32 for an unsigned 32 bit integer).

A particular definition or forward declaration of a C/C++ user-defined type. class C; typedef int ti;

The type domain of a floating-point type. One of RealDomain, ComplexDomain, or ImaginaryDomain.

A source code location referring to a user-defined type.

An access to a type. This occurs in certain contexts where a built-in works on types directly rather than variables, expressions etc. For example the reference to MyClass in __is_pod in the following code:

A C++ type requirement in a requires expression.

A C/C++ typedef type. See 4.9.1. For example the types declared on each line of the following code: typedef int my_int; using my_int2 = int;

A C++ typeid expression which provides run-time type information (RTTI) about its argument.

The C/C++ uint16_t type.

The C/C++ uint32_t type.

The C/C++ uint64_t type.

The C/C++ uint8_t type.

The C/C++ uint_fast16_t type.

The C/C++ uint_fast32_t type.

The C/C++ uint_fast64_t type.

The C/C++ uint_fast8_t type.

The C/C++ uint_least16_t type.

The C/C++ uint_least32_t type.

The C/C++ uint_least64_t type.

The C/C++ uint_least8_t type.

The C/C++ uintmax_t type.

A C/C++ unary arithmetic operation.

A C/C++ unary bitwise operation.

A C/C++ unary logical operation.

A C/C++ unary minus expression. b = - a;

A C/C++ unary operation.

A C/C++ unary plus expression. b = + a;

A C/C++ union. See C.8.2. For example, the type MyUnion in: union MyUnion { int i; float f; };

A dummy location which is used when something doesn’t have a location in the source code but needs to have a Location associated with it.

A dummy location which is used when an expression doesn’t have a location in the source code but needs to have a Location associated with it.

A dummy location which is used when something doesn’t have a location in the source code but needs to have a Location associated with it. There may be several distinct kinds of unknown locations. For example: one for expressions, one for statements and one for other program elements.

A dummy location which is used when a statement doesn’t have a location in the source code but needs to have a Location associated with it.

The unknown type. This type has no corresponding C/C++ syntax.

The C/C++ unsigned char type (which is distinct from plain char even when char is unsigned by default). unsigned char e, f;

No particular reason given. This is currently used for backward compatibility so that classes derived from BufferWrite and overriding getMaxData/0 still work with the queries as intended.

A use of a stack variable.

A function not in the standard library which takes a printf-like formatting string and a variable number of arguments.

A C++ user-defined literal [N4140 13.5.8].

A C/C++ user-defined type. Examples include class, struct, union, enum and typedef types. enum e1 { val1, val2 } b; enum class e2: short { val3, val4 } c; typedef int my_int; class C { int a, b; };

A using alias C++ typedef type. For example the type declared in the following code: using my_int2 = int;

A C++ using declaration. For example: using std::string;

A C++ using directive. For example: using namespace std;

A C++ using directive or using declaration.

A C++ using enum declaration. For example: enum class Foo { a, b }; using enum Foo;

A Microsoft C/C++ __uuidof expression that returns the UUID of a type, as specified by the __declspec(uuid) attribute. struct UUID { char a[16]; }; struct __declspec(uuid("{01234567-89ab-cdef-0123-456789ABCDEF}")) S {}; UUID uuid = __uuidof(S);

An expression that looks like a destructor call, but has no effect.

A field access of the form obj.field, where the type of obj is a class/struct/union (and not a reference). For example the accesses to x in myMethod in the following code:

The estimation comes from non trivial bounds found via actual flow analysis. For example unsigned u = x; if (u < 1000) { //... <- estimation done here based on u }

A C/C++ built-in operation that is used to support functions with variable numbers of arguments. This includes va_start, va_end, va_copy, and va_arg.

A C/C++ variable. For example, in the following code there are four variables, a, b, c and d:

A C/C++ variable access expression. For example the accesses to x and y in myFunction in the following code:

A C/C++ call which is performed through a variable of function pointer type. int call_via_ptr(int (*pfn)(int)) { return pfn(5); }

A particular declaration or definition of a C/C++ variable. For example, in the following code there are six variable declaration entries - two each for a and d, and one each for b and c:

A variable that is an instantiation of a template. For example the instantiation myTemplateVariable<int> in the following code:

A C/C++ aggregate literal that initializes a GNU vector type.

Fill operation on a vector. This is a GNU extension.

A class/struct that is the base of some virtual class derivation. For example MyBaseClass in the following code is a VirtualBaseClass of MyClass:

A class/struct derivation that is virtual. For example the derivation in the following code is a VirtualClassDerivation: class MyClass : public virtual MyBaseClass { ... };

A C++ virtual function. For example the two functions called myVirtualFunction in the following code are each a VirtualFunction:

A C99 statement which declares a variable length array. For example the variable length array declaration in the following code: int myArray[x];

A C99 statement which computes the size of a single dimension of a variable length array. For example the variable length array dimension (x) in the following code: int myArray[x];

A conversion to void.

The C/C++ void* type.

The C/C++ void type. See 4.7. void foo();

The C/C++ wchar_t type.

A C/C++ ‘while’ statement.

The C/C++ wide character type.

The estimation comes from non trivial bounds found via actual flow analysis, but a widening approximation might have been used for variables in loops. For example for (int i = 0; i < 10; ++i) { int j = i + i; //... <- estimation done here based on j }

A C/C++ literal whose value is zero.

INTERNAL: Do not use. Query predicates used to check invariants that should hold for all Cast nodes. To run all consistency queries for the ASTs, including the ones below, run “semmle/code/cpp/ASTConsistency.ql”.

Successor relation for basic blocks.