CodeQL library for C/C++
codeql/cpp-all 1.1.2-dev (changelog, source)
Search

Member predicate Node::asDefinition

Gets the definition associated with this node, if any.

For example, consider the following example

int x = 42;     // 1
x = 34;         // 2
++x;            // 3
x++;            // 4
x += 1;         // 5
int y = x += 2; // 6
  • For (1) the result is 42.
  • For (2) the result is x = 34.
  • For (3) the result is ++x.
  • For (4) the result is x++.
  • For (5) the result is x += 1.
  • For (6) there are two results:
    • For the definition generated by x += 2 the result is x += 2
    • For the definition generated by int y = ... the result is also x += 2.

For assignments, node.asDefinition() and node.asExpr() will both exist for the same dataflow node. However, for expression such as x++ that both write to x and read the current value of x, node.asDefinition() will give the node corresponding to the value after the increment, and node.asExpr() will give the node corresponding to the value before the increment. For an example of this, consider the following:

sink(x++);

in the above program, there will not be flow from a node n such that n.asDefinition() instanceof IncrementOperation to the argument of sink since the value passed to sink is the value before to the increment. However, there will be dataflow from a node n such that n.asExpr() instanceof IncrementOperation since the result of evaluating the expression x++ is passed to sink.

Expr asDefinition()