CodeQL library for C/C++
codeql/cpp-all 0.12.10 (changelog, source)

Class ControlFlowNode

A control-flow node is either a statement or an expression; in addition, functions are control-flow nodes representing the exit point of the function. The graph represents one possible evaluation order out of all the ones the compiler might have picked.

Control-flow nodes have successors and predecessors at the expression level, so control flow is accurately represented in expressions as well as between statements. Statements and initializers precede their contained expressions, and expressions deeper in the tree precede those higher up; for example, the statement x = y + 1 gets a control-flow graph that looks like

ExprStmt -> y -> 1 -> (+) -> x -> (=)

The first control-flow node in a function is the body of the function (a block), and the last is the function itself, which is used to represent the exit point.

Each throw expression or Handler has a path (along any necessary destructor calls) to its nearest enclosing Handler within the same function, or to the exit point of the function if there is no such Handler. There are no edges from function calls to Handlers.

Import path

import cpp

Direct supertypes

Indirect supertypes

Known direct subtypes



Gets a node such that the control-flow edge (this, result) may be taken when this expression is false.


Gets a direct predecessor of this control-flow node, if any.


Gets a direct successor of this control-flow node, if any.


Gets a node such that the control-flow edge (this, result) may be taken when this expression is true.


Gets the BasicBlock containing this control-flow node.


Gets the function containing this control-flow node.


Gets the smallest statement containing this control-flow node.


Holds if this node is the top-level expression of a conditional statement, meaning that this.getATrueSuccessor() or this.getAFalseSuccessor() will have a result.

Inherited predicates


Gets the source of this element: either itself or a macro that expanded to this element.

from Element

Holds if this element may be from source. This predicate holds for all elements, except for those in the dummy file, whose name is the empty string. The dummy file contains declarations that are built directly into the compiler.

from Element

Gets the name of a primary CodeQL class to which this element belongs.

from ElementBase

Gets the closest Element enclosing this one.

from Element

Gets the primary file where this element occurs.

from Element

Gets the primary location of this element.

from Element

Gets the parent scope of this Element, if any. A scope is a Type (Class / Enum), a Namespace, a BlockStmt, a Function, or certain kinds of Statement.

from Element

Gets a comma-separated list of the names of the primary CodeQL classes to which this element belongs.

from ElementBase

Holds if this element is affected in any way by a macro. All elements that are totally or partially generated by a macro are included, so this is a super-set of isInMacroExpansion.

from Element

Holds if this Element is a part of a template instantiation (but not the template itself).

from Element

Holds if this Element is part of a template template (not if it is part of an instantiation of template). This means it is represented in the database purely as syntax and without guarantees on the presence or correctness of type-based operations such as implicit conversions.

from Element

Holds if this element comes from a macro expansion. Only elements that are entirely generated by a macro are included - for elements that partially come from a macro, see isAffectedByMacro.

from Element

Gets a textual representation of this element.

from ElementBase