CodeQL library for JavaScript/TypeScript
codeql/javascript-all 0.8.13 (changelog, source)
Search

Member predicate CustomAbstractValueFromDefinition::getAPrototype

Gets an abstract value that represents a prototype object of this value.

We currently model three sources of prototypes:

  • direct assignments to o.__proto__ are tracked;

  • for an instance o of a function f, any value that can be shown to flow into f.prototype is considered a prototype object of o;

  • for an instance of a class C, any instance of a function or class that can be shown to flow into the extends clause of C is considered a prototype object of o.

In all cases, purely local flow tracking is used to find prototype objects, so this predicate cannot be relied on to compute all possible prototype objects.

DefiniteAbstractValue getAPrototype()