Predicate EscapesTree_Cached::variableAddressEscapesTree
Holds if e
is a fully-converted expression that evaluates to an address
derived from the address of va
and is stored in a variable or passed
across functions. This means e
is the Expr.getFullyConverted
-form of:
- The right-hand side of an assignment or initialization;
- A function argument or return value;
- The argument to
throw
. - An entry in an
AggregateLiteral
, including the compiler-generatedClassAggregateLiteral
that initializes aLambdaExpression
; or - An expression in an inline assembly statement.
This predicate includes pointers or reference to const
types. See
variableAddressEscapesTreeNonConst
for a version of this predicate that
does not.
If va
has reference type, the escape analysis concerns the value pointed
to by the reference rather than the reference itself. The C++ language does
not allow taking the address of a reference in any way, so this predicate
would never produce any results for the reference itself. Callers that are
not interested in the value referred to by references should exclude
variable accesses to reference-typed values.
Import path
import semmle.code.cpp.dataflow.EscapesTree
predicate variableAddressEscapesTree(VariableAccess va, Expr e)