CodeQL library for C/C++
codeql/cpp-all 2.0.3-dev (changelog, source)
Search

Class HeuristicAllocationExpr

An expression that might allocate memory.

Unlike AllocationExpr, this class uses heuristics (such as a call target’s name and parameters) to include additional expressions.

Import path

import cpp

Direct supertypes

Indirect supertypes

Known direct subtypes

    Predicates

    getAllocatedElementType

    Gets the type of the elements that are allocated, if it can be determined.

    getReallocPtr

    Gets the expression for the input pointer argument to be reallocated, if this is a realloc function.

    getSizeBytes

    Gets the size of this allocation in bytes, if it is a fixed size and that size can be determined. This predicate should be used with caution as it can be inaccurate for allocations identified using heuristics.

    getSizeExpr

    Gets an expression for the allocation size, if any. The actual allocation size is the value of this expression multiplied by the result of getSizeMult(), in bytes.

    getSizeMult

    Gets a constant multiplier for the allocation size given by getSizeExpr, in bytes. This predicate should be used with caution as it can be inaccurate for allocations identified using heuristics.

    requiresDealloc

    Whether or not this allocation requires a corresponding deallocation of some sort (most do, but alloca for example does not). If it is unclear, we default to no (for example a placement new allocation may or may not require a corresponding delete).

    Inherited predicates

    findRootCause

    Gets the source of this element: either itself or a macro that expanded to this element.

    from Element
    fromSource

    Holds if this element may be from source. This predicate holds for all elements, except for those in the dummy file, whose name is the empty string. The dummy file contains declarations that are built directly into the compiler.

    from Element
    getAChild

    Gets a child of this expression.

    from Expr
    getAFalseSuccessor

    Gets a node such that the control-flow edge (this, result) may be taken when this expression is false.

    from ControlFlowNode
    getAPredecessor

    Gets a direct predecessor of this control-flow node, if any.

    from ControlFlowNode
    getAPrimaryQlClass

    Gets the name of a primary CodeQL class to which this element belongs.

    from ElementBase
    getASuccessor

    Gets a direct successor of this control-flow node, if any.

    from ControlFlowNode
    getATrueSuccessor

    Gets a node such that the control-flow edge (this, result) may be taken when this expression is true.

    from ControlFlowNode
    getActualType

    Gets the type of this expression, after any implicit conversions and explicit casts, and after resolving typedefs.

    from Expr
    getAnImplicitDestructorCall

    Gets a compiler-generated destructor call that is performed after this expression.

    from Expr
    getBasicBlock

    Gets the BasicBlock containing this control-flow node.

    from ControlFlowNode
    getChild

    Gets the nth child of this expression.

    from Expr
    getControlFlowScope

    Gets the function containing this control-flow node.

    from Expr
    getConversion

    Gets the conversion associated with this expression, if any.

    from Expr
    getConversionString

    Gets a string describing the conversion associated with this expression, or "" if there is none.

    from Expr
    getEnclosingBlock

    Gets the nearest enclosing set of curly braces around this expression in the source, if any.

    from Expr
    getEnclosingDeclaration

    Gets the enclosing variable or function of this expression.

    from Expr
    getEnclosingElement

    Gets the closest Element enclosing this one.

    from Element
    getEnclosingFunction

    Gets the enclosing function of this expression, if any.

    from Expr
    getEnclosingStmt

    Gets the smallest statement containing this control-flow node.

    from Expr
    getEnclosingVariable

    Gets the enclosing variable of this expression, if any.

    from Expr
    getExplicitlyConverted

    Gets this expression with all of its explicit casts, but none of its implicit casts. More precisely this takes conversions up to the last explicit cast (there may be implicit conversions along the way), but does not include conversions after the last explicit cast.

    from Expr
    getFile

    Gets the primary file where this element occurs.

    from Element
    getFullyConverted

    Gets the fully converted form of this expression, including all type casts and other conversions.

    from Expr
    getImplicitDestructorCall

    Gets the nth compiler-generated destructor call that is performed after this expression, in order of destruction.

    from Expr
    getImplicitlyConverted

    Gets this expression with all of its initial implicit casts, but none of its explicit casts. More precisely, this takes all implicit conversions up to (but not including) the first explicit cast (if any).

    from Expr
    getLocation

    Gets the location of this expression.

    from Expr
    getNumChild

    Gets the number of direct children of this expression.

    from Expr
    getParent

    Gets the parent of this expression, if any.

    from Expr
    getParentScope

    Gets the parent scope of this Element, if any. A scope is a Type (Class / Enum), a Namespace, a BlockStmt, a Function, or certain kinds of Statement.

    from Element
    getParentWithConversions

    Gets the parent of this expression, if any, in an alternative syntax tree that has Conversions as part of the tree.

    from Expr
    getPrecedence

    Gets the precedence of the main operator of this expression; higher precedence binds tighter.

    from Expr
    getPrimaryQlClasses

    Gets a comma-separated list of the names of the primary CodeQL classes to which this element belongs.

    from ElementBase
    getType

    Gets the type of this expression.

    from Expr
    getUnconverted

    Gets the unique non-Conversion expression e for which this = e.getConversion*().

    from Expr
    getUnderlyingType

    Gets the type of this expression after typedefs have been resolved.

    from Expr
    getUnspecifiedType

    Gets the type of this expression after specifiers have been deeply stripped and typedefs have been resolved.

    from Expr
    getValue

    Gets the value of this expression, if it is a constant.

    from Expr
    getValueCategoryString

    Gets a string representation of the value category of the expression. This is intended only for debugging. The possible values are:

    from Expr
    getValueText

    Gets the source text for the value of this expression, if it is a constant.

    from Expr
    hasChild

    Holds if e is the nth child of this expression.

    from Expr
    hasConversion

    Holds if this expression has a conversion.

    from Expr
    hasExplicitConversion

    Holds if this expression has an explicit conversion.

    from Expr
    hasImplicitConversion

    Holds if this expression has an implicit conversion.

    from Expr
    hasLValueToRValueConversion

    Holds if this expression has undergone an lvalue-to-rvalue conversion to extract its value. for example: y = x; The VariableAccess for x is a prvalue, and hasLValueToRValueConversion() holds because the value of x was loaded from the location of x. The VariableAccess for y is an lvalue, and hasLValueToRValueConversion() does not hold because the value of y was not extracted.

    from Expr
    isAffectedByMacro

    Holds if this element is affected in any way by a macro. All elements that are totally or partially generated by a macro are included, so this is a super-set of isInMacroExpansion.

    from Element
    isCompilerGenerated

    Holds if this is an auxiliary expression generated by the compiler.

    from Expr
    isCondition

    Holds if this node is the top-level expression of a conditional statement, meaning that this.getATrueSuccessor() or this.getAFalseSuccessor() will have a result.

    from ControlFlowNode
    isConstant

    Holds if this expression has a value that can be determined at compile time.

    from Expr
    isFromTemplateInstantiation

    Holds if this Element is a part of a template instantiation (but not the template itself).

    from Element
    isFromUninstantiatedTemplate

    Holds if this Element is part of a template template (not if it is part of an instantiation of template). This means it is represented in the database purely as syntax and without guarantees on the presence or correctness of type-based operations such as implicit conversions.

    from Element
    isGLValueCategory

    Holds if this expression is a glvalue. A glvalue is either an lvalue or an xvalue.

    from Expr
    isInMacroExpansion

    Holds if this element comes from a macro expansion. Only elements that are entirely generated by a macro are included - for elements that partially come from a macro, see isAffectedByMacro.

    from Element
    isLValue

    Holds if this expression is an lvalue, in the sense of having an address.

    from Expr
    isLValueCategory

    Holds if this expression is an lvalue. An lvalue is an expression that represents a location, rather than a value. See [basic.lval] for more about lvalues.

    from Expr
    isPRValueCategory

    Holds if this expression is a prvalue. A prvalue is an expression that represents a value, rather than a location. See [basic.lval] for more about prvalues.

    from Expr
    isParenthesised

    Holds if this expression is parenthesised.

    from Expr
    isPure

    Holds if this expression is side-effect free (conservative approximation). This predicate cannot be overridden; override mayBeImpure() instead.

    from Expr
    isRValueCategory

    Holds if this expression is an rvalue. An rvalue is either a prvalue or an xvalue.

    from Expr
    isUnevaluated

    Holds if this expression will not be evaluated because of its context, such as an expression inside a sizeof.

    from Expr
    isXValueCategory

    Holds if this expression is an xvalue. An xvalue is a location whose lifetime is about to end (e.g. an rvalue reference returned from a function call). See [basic.lval] for more about xvalues.

    from Expr
    mayBeGloballyImpure

    Holds if it is possible that the expression may be impure. If we are not sure, then it holds. Unlike mayBeImpure(), this predicate does not consider modifications to temporary local variables to be impure. If you call a function in which nothing may be globally impure then the function as a whole will have no side-effects, even if it mutates its own fresh stack variables.

    from Expr
    mayBeImpure

    Holds if it is possible that the expression may be impure. If we are not sure, then it holds.

    from Expr
    toString

    Gets a textual representation of this expression.

    from Expr