JavaScript Library Reference
Copyright © 2020 Synopsys, Inc. All rights reserved worldwide.
CodeXM is a domain-specific language that allows you to create custom code checkers. CodeXM checkers analyze source code for specific coding patterns, and report these issues with messages that you provide. Like other Coverity checkers, the issues are displayed in Coverity Connect. They can be archived with the cov-commit-defect feature.
The CodeXM JavaScript library provides access to JavaScript coding constructs.
This document provides information about the patterns and functions provided by the JavaScript library. To learn how to get started with CodeXM, please see Learning to Write CodeXM Checkers.
Describing CodeXM is a bit different from describing other languages. Most programming books talk about one language only. To describe CodeXM, we have to talk about CodeXM code itself, and the code of the language it is inspecting—the target language.
This reference shows all code in monospace
type.
CodeXM code appears in shades of green.
Target code (whatever the language) appears in shades of orange.
Reminder: By default, many browsers do not print out background colors.
The type of certain pattern properties is said to be nullable. This means that the property might return a value, or it might not. If it does not, its value matches the CodeXM keyword null. In the CodeXM documents, a nullable type is indicated by the name of the type the property might return, followed by a question mark; for example, int?.
In checker code, a nullable type requires some special handling in order to avoid the error of referencing the null. The Handling Null Values section of Learning to Write CodeXM Checkers describes how to do this.
In your CodeXM source, begin with an include declaration that names the library target language: include `JavaScript`.
Specifying the target language makes the library’s special patterns and functions available within this CodeXM file. These patterns and functions are the subject of this reference.
The language specification also causes the checkers defined in your CodeXM file to be applied only to the target source code in your code base.
Class definitions match class entities in the abstract representation of the target code, and provide properties that describe the classes that the library supports.
Every target-code object that Coverity inspects is a node in an abstract syntax tree. For a brief overview of how Coverity uses these syntax trees, see How Does Coverity Analysis Work? in the Syntax Reference.
Every astnode has the following properties:
Name | Type | Description |
---|---|---|
location | sourceloc | The location of this code construct in the source files |
children | list<astnode> | A list of child nodes that are sub-parts of this code construct |
parent | astnode? | This node’s parent node, if there is one; null if there is no parent |
macrosExpandedFrom | list<macroinfo> | If the code is produced by macro expansion, this list contains the macros that generated that expansion. Otherwise, this list is empty. |
implicit | bool | Indicates whether the node is the result of compiler intervention, as opposed to being explicitly stated in the source code. For example, if ( x ) in the source code is interpreted as if ( x != 0 ) by the compiler. The not-equals binary operator and the literal constant zero are implicit. |
The astnode elements are further classified as statement, expression, initializer, and declaration elements (declaration elements declare symbols). Certain kinds of elements have their own set of properties in addition to the astnode properties shown here.
This class represents a function definition.
The functionDefinition class appears in the following hierarchy:
functionDefinition produces a record that contains the following properties:
Name | Type | Description |
---|---|---|
allCode | set<astnode> | All source code in this function |
body | statement | A blockStatement of the function body |
formalParameterList | list<symbol> | A list of parameterSymbols for each argument to the function |
functionSymbol | symbol | The functionSymbol that represents this function |
location | sourceloc | The location of the definition |
paths | executionPaths | All execution paths in this function |
The sets described in this can help narrow the search of your checker. Typically they are used in for loop constructions such as the following:
Includes all the Abstract Syntax Tree (AST) nodes in all the functions of the current JavaScript code.
allFunctionsAndGlobalVariableCode
Includes all function definitions in the current C# code.
Matches all the Abstract Syntax Tree (AST) nodes in all the functions and global variable initializers of the current C# code.
Includes all source files in the current project that are coded in the JavaScript language.
These patterns, organized by category, match the constructs that might be found in the target source code.
Patterns in this section belong to the statement class. They match executable statements in the target code.
Matches all the Abstract Syntax Tree (AST) nodes in all the functions of the current JavaScript code.
This pattern does not expose any new properties.
Inherits properties from:
Matches all the Abstract Syntax Tree (AST) nodes in all the functions and global variable initializers of the current JavaScript code.
This pattern does not expose any new properties.
Inherits properties from:
Matches any of the loop types, such as forLoop (and its various specializations, such as forLoopSimple, forLoopIn, and forLoopOf), whileLoop, and doWhileLoop.
This pattern does not expose any new properties.
Inherits properties from:
Matches block statements.
This pattern only matches nodes of type statement.
blockStatement produces a record that contains the following property:
Name | Type | Description |
---|---|---|
containedStatements | statement | The statements contained in the block |
Inherits properties from:
The blockStatement pattern matches the body of the following function:
In this instance, the .containedStatement property is a list that contains the return statement.
Matches both labeled and unlabeled break statements.
breakStatement produces a record that contains the following properties:
Name | Type | Description |
---|---|---|
controlStatement | statement | The flow-of-control statement within which the break statement occurs, such as a for, while, or switch |
target | statement? | The break target statement; null if there is none |
Inherits properties from:
The breakStatement pattern matches the following cases:
In the first case, the .controlStatement property is the for loop, and the .target property is the labelStatement label: ....
In the second case, the .controlStatement property is the switch statement, and the .target property is null.
Matches individual case statements within switch statements.
This pattern only matches nodes of type statement.
caseStatement produces a record that contains the following property:
Name | Type | Description |
---|---|---|
valueExpression | expression | The value associated with the case |
Inherits properties from:
The caseStatement pattern matches the statement case 0: in the following source code:
In this instance, the .valueExpression property is 0.
The switchStatement pattern.
Matches both labeled and unlabeled continue statements.
continueStatement produces a record that contains the following properties:
Name | Type | Description |
---|---|---|
controlStatement | statement | The flow-of-control statement within which the continue statement occurs, such as a for loop or while loop |
target | statement? | The continue target statement; null if there is none |
Inherits properties from:
The continueStatement pattern matches the following cases:
In the first case, the .controlStatement property is the for loop, and the .target property is the labelStatement label: ....
In the second case, the .controlStatement property is the while loop, and the .target property is null.
Matches debugger statements.
This pattern only matches nodes of type statement.
This pattern does not expose any new properties.
Inherits properties from:
Matches the default clause within switch statements.
This pattern only matches nodes of type statement.
This pattern does not expose any new properties.
Inherits properties from:
The defaultStatement pattern matches the statement default: in the following source code:
The switchStatement pattern.
Matches do ... while loops.
This pattern only matches nodes of type statement.
doWhileLoop produces a record that contains the following properties:
Name | Type | Description |
---|---|---|
bodyStatement | statement | The statement that the loop iterates. Frequently, this is a blockStatement. |
conditionExpression | expression | The condition that causes the loop to terminate |
Inherits properties from:
The doWhileLoop pattern matches the following loop:
In this instance, the .conditionExpression property is the literal true, and the .bodyStatement property is the statement {i++;}.
Matches empty, placeholder statements.
This pattern only matches nodes of type statement.
This pattern does not expose any new properties.
Inherits properties from:
The emptyStatement pattern matches each of the two lines that follow:
Matches any of the for loop constructs.
forLoop produces a record that contains the following properties:
Name | Type | Description |
---|---|---|
bodyStatement | statement | The statement that the loop repeatedly executes. Frequently, this is a blockStatement. |
kind | enum | The kind of for loop: `in`, `of`, or `simple` |
Inherits properties from:
The forLoopSimple, forLoopIn and forLoopOf patterns.
Matches simple for in loops.
This pattern only matches nodes of type statement.
forLoopIn produces a record that contains the following properties:
Name | Type | Description |
---|---|---|
bodyStatement | statement | The statement that the loop repeatedly executes. Frequently, this is a blockStatement. |
containerExpression | expression | The iterated container |
kind | enum | Always `in` |
Inherits properties from:
The forLoopIn pattern matches the following for loop:
The forLoopSimple and forLoopOf patterns.
Matches simple for of loops.
This pattern only matches nodes of type statement.
forLoopOf produces a record that contains the following properties:
Name | Type | Description |
---|---|---|
bodyStatement | statement | The statement that the loop repeatedly executes. Frequently, this is a blockStatement. |
iterableExpression | expression | The iterable object |
kind | enum | Always `of` |
Inherits properties from:
The forLoopOf pattern matches the following for loop:
The forLoopSimple and forLoopIn patterns.
Matches simple for loops of the form for (int i = 0; i < 10; ++i).
This pattern only matches nodes of type statement.
forLoopSimple produces a record that contains the following properties:
Name | Type | Description |
---|---|---|
bodyStatement | statement | The statement that the loop repeatedly executes. Frequently, this is a blockStatement. |
conditionExpression | expression | The condition that causes the loop to terminate |
initializationStatement | statement | Initialization clause of the for loop |
kind | enum | Always `simple` |
updateStatement | statement | The expression statement to update the loop value (frequently something like i++) |
Inherits properties from:
The forLoopSimple pattern matches the following for loop:
The forLoopIn and forLoopOf patterns.
Matches return statements in the body of generator functions.
This pattern only matches nodes of type statement.
This pattern does not expose any new properties.
Inherits properties from:
The generatorReturnStatement pattern matches the following two cases:
Note: The generatorReturnValue pattern does not match the second case.
Matches entire if statements, including their condition expressions and their true and (optional) false branches.
This pattern only matches nodes of type statement.
ifStatement produces a record that contains the following properties:
Name | Type | Description |
---|---|---|
conditionExpression | expression | The condition that determines whether the trueStatement or falseStatement is executed. |
falseStatement | statement? | The else statement, which, if present, is only executed if conditionExpression is false. If there is no else statement in the source code, this property is null. |
trueStatement | statement | The then statement, which is only executed if conditionExpression is true |
Inherits properties from:
The ifStatement pattern matches the following two cases:
In the second case, the .falseStatement property is null.
Matches label statements.
This pattern only matches nodes of type statement.
labelStatement produces a record that contains the following properties:
Name | Type | Description |
---|---|---|
nameString | string | The label string |
targetStatement | statement | The statement to which this label is assigned |
Inherits properties from:
The labelStatement pattern matches the following cases:
In this instance, the .nameString property is "lab", and the .targetStatement property is the statement x++;.
Matches return statements.
This pattern only matches nodes of type statement.
returnStatement produces a record that contains the following properties:
Name | Type | Description |
---|---|---|
isVoid | bool | Indicates that this is a simple return statement as used in a void function |
returnedExpression | expression? | The expression that returns when the return type is is not void; null if the return type is void |
Inherits properties from:
The returnStatement pattern matches the following two cases:
In the first case, the .returnedExpression property is the literal 1.
In the second case, the .isVoid property is true.
Matches individual executable statements.
This pattern only matches nodes of type statement.
simpleStatement produces a record that contains the following property:
Name | Type | Description |
---|---|---|
expression | expression | The expression, such as a function call or an assignment |
Inherits properties from:
The simpleStatement pattern matches the following case:
In this instance, the .expression property is the expression i++.
Matches switch statements.
This pattern only matches nodes of type statement.
switchStatement produces a record that contains the following properties:
Name | Type | Description |
---|---|---|
bodyStatement | statement | The body of the switch statement. In most cases it is a blockStatement. |
caseList | list<statement> | A list of targets of this switch statement. The target can either be a caseStatement or a defaultStatement. |
conditionExpression | expression | The expression that determines which case is to be taken |
Inherits properties from:
The switchStatement pattern matches the following source code:
In this instance, the .conditionExpression property is i, the .caseList property is the list containing both case 0 and default cases, and the .bodyStatement property is the blockStatement that represents the body of the switch statement.
Matches throw statements.
A throw statement must have an explicit expression as an argument.
This pattern only matches nodes of type statement.
throwStatement produces a record that contains the following property:
Name | Type | Description |
---|---|---|
thrownExpression | expression | The expression to be thrown by this statement |
Inherits properties from:
The throwStatement pattern matches the following case:
In this instance, the .thrownExpression property is the literal 1.
Matches try ... catch ... finally statements.
This pattern only matches nodes of type statement.
tryStatement produces a record that contains the following properties:
Name | Type | Description |
---|---|---|
bodyStatement | statement | The statements in the body of the try statement |
catchBlockList | list<record> | The list of catch blocks |
finallyStatement | statement? | The finally statement; null if there isn’t one |
Inherits properties from:
The tryStatement pattern matches the following case:
In the first case, the .bodyStatement property is the blockStatement {f1(0);}, the .catchBlockList property is a list with one element, and the .finallyStatement property is the blockStatement {f2();}.
In the second case, the .finallyStatement property is null.
Matches while loops.
This pattern only matches nodes of type statement.
whileLoop produces a record that contains the following properties:
Name | Type | Description |
---|---|---|
bodyStatement | statement | The statement that the loop iterates. Frequently, this is a blockStatement. |
conditionExpression | expression | The condition that causes the loop to terminate |
Inherits properties from:
The whileLoop pattern matches the following loop:
In this instance, the .conditionExpression property is the literal true, and the .bodyStatement property is the statement {i++;}.
Matches with statements.
This pattern only matches nodes of type statement.
withStatement produces a record that contains the following properties:
Name | Type | Description |
---|---|---|
bodyStatement | statement | The statement to be evaluated |
objectExpression | expression | The expression to be added to the scope chain used when evaluating the body statement |
Inherits properties from:
The withStatement pattern matches the following case:
In this instance, the .objectExpression property is the expression Math, and the .bodyStatement property is the statement {a = PI;}.
Patterns in this section belong to the declaration class. They match object declarations in the target code.
Matches class declaration statements.
A classDeclaration (as specified in ECMAScript 2015, 14.5) is a statement that defines a class. In JavaScript, all source code is in the body of the top-level function. So a stand-alone class declaration is also a statement of the top-level function. This is also the case for functionDeclaration.
This pattern only matches nodes of type statement.
This pattern does not expose any new properties.
Inherits properties from:
The classDeclaration pattern matches the following case:
The classExpression pattern.
Matches JavaScript destructuring declarations.
This pattern only matches nodes of type statement.
destructuringDeclaration produces a record that contains the following properties:
Name | Type | Description |
---|---|---|
sourceExpression | expression | The expression on the right side of the = operator |
targetExpressions | list<expression> | The list of targets being assigned (on the left side of the = operator) |
Inherits properties from:
A destructuring declaration has the following form:
In this instance, the .targetExpressions property is the expression [a, b], and the .sourceExpression property is the expression c.
Matches function declaration statements.
A functionDeclaration (as specified in ECMAScript 2015, 14.1) is a statement that defines a function.
This pattern only matches nodes of type statement.
functionDeclaration produces a record that contains the following property:
Name | Type | Description |
---|---|---|
functionSymbol | symbol | The declared function |
Inherits properties from:
The functionDeclaration pattern matches the following case:
The functionExpression pattern.
Matches variable declarations.
This pattern only matches nodes of type statement.
This pattern does not expose any new properties.
Inherits properties from:
Matches the declaration of the variable a in the following function:
In this instance, the .variable property is the symbol representing a, and the .initializer property is the initializer 0.
These patterns match various types of values in the target code.
Matches function types.
This pattern only matches nodes of type type.
functionType produces a record that contains the following property:
Name | Type | Description |
---|---|---|
parameterCount | int | The number of parameters declared by this function |
In the following example,
... the type of f matches functionType with .parameterCount being 2, because of the two implicit parameters this and new.target.
Matches scalar types (integer and floating-point literals).
This pattern only matches nodes of type type.
This pattern does not expose any properties.
The type of literal 1 matches scalarType.
Patterns in this section belong to the expression class. They match expressions in the target code.
Many statements in JavaScript code contain expressions. The patterns in this section match specific kinds of expressions.
Please be aware: The patterns shown in the “Literals” and “Operators” sections are expressions, too.
For example, in the following snippet of target code:
... we see a pair of if statements. As described in the previous section, the ifStatement pattern detects either instance.
But each statement has a condition: namely, the part enclosed by the parentheses that follow the keyword if. Both conditions in this example are expressions. The first is simply a variable reference. The second is more complicated: It is made up of a binary operator (specifically, the equality operator) with operands (which are themselves expressions) appearing on either side. The left-hand operand is a function call, and the right-hand operand is a variable reference.
You could match the first of these conditions by using the expression pattern variableReference (which also matches the right-hand side of the second condition), and you could match the second of these conditions by using the expression pattern binaryOperator.
To inspect a complete condition expression, look at the .conditionExpression property of the ifStatement pattern.
In addition to the properties specific to each pattern, and the properties inherited from astnode, all expression patterns have the following properties:
Name | Type | Description |
---|---|---|
type | type | The JavaScript type of the expression |
isParenthesized | bool | Whether there are parenthesis around this expression |
Matches boxed arguments after the list expansion argument.
This pattern only matches nodes of type expression.
argumentAfterExpansion produces a record that contains the following property:
Name | Type | Description |
---|---|---|
argumentExpression | expression | The argument |
Inherits properties from:
The argumentAfterExpansion pattern matches the literal 3 argument in the following function call f(...l, 3):
The .argumentExpression property is the expression "3".
The listExpansionArgument pattern.
Matches references to the implicitly declared arguments variable.
This pattern only matches nodes of type expression.
argumentsReference produces a record that contains the following property:
Name | Type | Description |
---|---|---|
variable | symbol | The arguments symbol |
Inherits properties from:
Matches elisions in arrays. (An elision is the “hole” created when using commas within an array literal.)
The elision is specified in ECMAScript 2015, 12.2.5.1.
This pattern only matches nodes of type expression.
This pattern does not expose any new properties.
Inherits properties from:
The arrayElision pattern matches the elements between the trailing commas in the following array literal:
The arrayLiteral pattern.
Matches class expressions.
A classExpression (as specified in ECMAScript 2015, 14.5) is a way to define a possibly unnamed class.
Note: This is an expression and not a stand-alone statement.
This pattern only matches nodes of type expression.
This pattern does not expose any new properties.
Inherits properties from:
The classDefinition pattern matches the initializer in following case:
The classDeclaration pattern.
Matches references to closed variables.
This pattern only matches nodes of type expression.
closedVariableReference produces a record that contains the following properties:
Name | Type | Description |
---|---|---|
identifier | string? | The identifier of the referenced variable; null if there is none |
mangledName | string | The mangled name of the referenced variable |
variable | symbol | The symbol referenced |
Inherits properties from:
The closedVariableSymbol pattern.
Matches closure expressions that represent class constructor definitions.
This pattern only matches nodes of type expression.
constructorDefinition produces a record that contains the following property:
Name | Type | Description |
---|---|---|
functionSymbol | symbol | The symbol that represents the defined constructor |
Inherits properties from:
The constructorDefinition pattern matches the constructor definition in the following case:
In this instance, the .functionSymbol property is the symbol that represents the constructor.
Matches full destructuring assignment expressions.
< h4 id="cxm_js_destructuringAssignment_Details">DetailsA destructuring assignment has the form [a, b] = c. The pattern yields [a, b] as targetExpressions, and c as sourceExpression.
This pattern only matches nodes of type expression
destructuringAssignment produces a record that contains the following properties:
Name | Type | Description |
---|---|---|
sourceExpression | expression | The source expression |
targetExpressions | expression | The target expression |
Inherits properties from:
The destructuringDeclaration pattern.
Matches JavaScript destructuring parameters.
This pattern only matches nodes of type statement.
destructuringParameter produces a record that contains the following properties:
Name | Type | Description |
---|---|---|
 originalParameter | expression | The reference to the original parameter |
parameterList | list<record> | The list that contains the parameters and their default values |
Inherits properties from:
Matches the declaration of the parameter in the following function:
In this instance, the .originalParameter property is a reference to parameter {name, age}, and the .parameterList property is a list of two record elements. The first element has the .defaultExpression property, which is literal 'a', and the parameter property which is a reference to the variable name. The second element has a null .defaultExpression property, and the .parameter property, which is a reference to the variable age.
Matches function calls.
Note: The argumentList only contains explicit arguments. It does not include this or new.target.
This pattern only matches nodes of type expression.
functionCall produces a record that contains the following properties:
Name | Type | Description |
---|---|---|
argumentList | list<expression> | The list of explicit arguments |
calledExpression | expression | The called expression |
calledFunction | symbol? | The symbol of the called function; null if there is none |
isMethodCall | bool | true if this is a method call against an object |
Inherits properties from:
Matches f(1).
Matches function definitions. From each, this pattern produces a functionDefinition object.
This pattern only matches nodes of type astnode.
This pattern does not expose any new properties.
Inherits properties from:
Matches closure expressions that define a function.
A functionExpression (as specified in ECMAScript 2015, 14.1w) is a way to define a possibly unnamed function.
This pattern only matches nodes of type expression.
This pattern does not expose any new properties.
Inherits properties from:
The functionExpression pattern matches the returned unnamed lambda function in the following source code:
The functionDeclaration pattern.
Matches references to functions.
This pattern only matches nodes of type expression.
functionReference produces a record that contains the following properties:
Name | Type | Description |
---|---|---|
identifier | string? | The identifier of the referenced function |
mangledName | string | The mangled name of the referenced function |
variable | symbol | The function referenced |
Inherits properties from:
The functionSymbol pattern.
This pattern, together with a generatorReturnStatement, matches non-void returns in generator-function bodies.
A valueExpression property holds the return value.
This pattern only matches nodes of type statement.
generatorReturnValue produces a record that contains the following property:
Name | Type | Description |
---|---|---|
valueExpression | expression | The expression that generates the return value |
Inherits properties from:
The generatorReturnValue pattern matches the following case:
In this instance, the .valueExpression property is the expression "x".
The generatorReturnStatement pattern.
Matches implicit accesses of properties of the global object.
This pattern only matches nodes of type expression.
globalAccess produces a record that contains the following property:
Name | Type | Description |
---|---|---|
key | string | The property accessed |
Inherits properties from:
The theGlobalObjectSymbol pattern.
Matches instannces of spread syntax in JavaScript function calls.
Spread syntax allows an iterable to be used as an argument.
This pattern only matches nodes of type expression.
listExpansionArgument produces a record that contains the following property:
Name | Type | Description |
---|---|---|
listExpression | expression | The list to be expanded |
Inherits properties from:
The listExpansionArgument pattern matches the argument in the following function call f(...l):
The .operandExpression property is the expression l.
The argumentAfterExpansion pattern, and also the spreadOperator for similar syntax used in array literal.
Matches references to locally declared variables.
This includes references to let, const, and class variables declared at the global scope, since these behave as local variables.
Declarations with var and function at the global scope are not included because these behave as accesses of properties of the global object: Use the globalAccess pattern to match these cases.
This pattern only matches nodes of type expression.
localVariableReference produces a record that contains the following properties:
Name | Type | Description |
---|---|---|
identifier | string? | The identifier of the referenced variable; null if there is none |
mangledName | string? | The mangled name of the referenced variable; null if there is none |
variable | symbol | The symbol referenced |
Inherits properties from:
globalAccess (matches var and function definitions occurring in the global scope), localVariableSymbol
Matches references to new.target.
This pattern only matches nodes of type expression.
newTargetReference produces a record that contains the following property:
Name | Type | Description |
---|---|---|
variable | symbol | The new.target symbol |
Inherits properties from:
Matches Node.js
require imports.
Unlike ES6 imports, the module specifier can be an expression, not just a string.
This pattern only matches nodes of type expression.
nodejsRequire produces a record that contains the following property:
Name | Type | Description |
---|---|---|
moduleExpression | expression | The module specifier |
Inherits properties from:
The nodejsRequire pattern matches the following expression:
The .moduleExpression property is "module".
Matches references to parameters.
This pattern only matches nodes of type expression.
parameterReference produces a record that contains the following properties:
Name | Type | Description |
---|---|---|
identifier | string? | The identifier of the referenced variable; null if there is none |
mangledName | string? | The mangled name of the referenced variable; null if there is none |
variable | symbol | The symbol referenced |
Inherits properties from:
The parameterSymbol pattern.
Matches function parameters that have a default value expression.
The pattern returns the default value in defaultExpression.
This pattern only matches nodes of type statement.
parameterWithDefault produces a record that contains the following properties:
Name | Type | Description |
---|---|---|
defaultExpression | expression | The default value of this parameter |
parameter | expression | The parameter |
Inherits properties from:
The parameterWithDefault pattern matches the statement that initialize the parameter b in the following function definition:
In this instance, the .parameter property is the variable reference to b, and the .defaultExpression property is the literal 1.
Matches accesses to an object property that are not implicit accesses to a property of the global object.
This pattern only matches nodes of type expression.
propertyAccess produces a record that contains the following properties:
Name | Type | Description |
---|---|---|
key | string | The property accessed |
map | expression | The object with the property |
notation | enum (see below) | The notation used in the access |
These are the possible values of the notation property:
Name | Description |
---|---|
`bracket` | Array notation access as in obj[ "index" ] |
`dot` | Dot notation access as in obj.index |
Inherits properties from:
Matches obj[ "index" ] or obj.index, where the property .map is obj and the property .key is "index".
Matches object property accesses that use array notation.
This pattern only matches nodes of type expression.
propertyAccessBracket produces a record that contains the following properties:
Name | Type | Description |
---|---|---|
key | string | The property accessed |
map | expression | The object with the property |
Inherits properties from:
Matches obj["index" ].
The propertyAccess pattern.
Matches object property accesses that use dot notation.
This pattern only matches nodes of type expression.
propertyAccessDot produces a record that contains the following properties:
Name | Type | Description |
---|---|---|
key | string | The property accessed |
map | expression | The object with the property |
Inherits properties from:
Matches obj.index.
The propertyAccess pattern.
Matches property accesses and for each, returns the key string.
This pattern only matches nodes of type expression.
propertyKey produces a record that contains the following property:
Name | Type | Description |
---|---|---|
value | string | The key accessed |
Inherits properties from:
The propertyKey pattern matches the following expression:
The .value property is "b".
Matches rest parameter declarations that use the prefix ....
This pattern only matches nodes of type statement.
restParameter produces a record that contains the following property:
Name | Type | Description |
---|---|---|
parameter | expression | The reference to the parameter |
Inherits properties from:
The restParameter pattern matches the declaration of j in the following case:
In this instance, the .parameter property is the reference to parameter j.
Matches references to super.
This pattern only matches nodes of type expression.
superReference produces a record that contains the following property:
Name | Type | Description |
---|---|---|
variable | symbol | The super symbol |
Inherits properties from:
Matches references to this.
This pattern only matches nodes of type expression.
thisReference produces a record that contains the following property:
Name | Type | Description |
---|---|---|
variable | symbol | The this symbol |
Inherits properties from:
Matches references to a variables.
This pattern only matches nodes of type expression.
variableReference produces a record that contains the following properties:
Name | Type | Description |
---|---|---|
identifier | string? | The identifier of the referenced variable; null if there is none |
mangledName | string? | The mangled name of the referenced variable; null if there is none |
variable | symbol | The symbol referenced |
Inherits properties from:
Matches JavaScript variable references under with statements.
A variable under a with statement can only be resolved at run time. This pattern distinguishes such variables from regular ones.
This pattern only matches nodes of type expression.
variableReferenceUnderWith produces a record that contains the following property:
Name | Type | Description |
---|---|---|
identifier | string | The identifier of the variable referenced |
Inherits properties from:
In the following JavaScript example:
... the expression PI matches variableReferenceUnderWith, and the .identifier property is "PI".
The withStatement pattern.
These patterns match literal values in the target code.
Matches array literals.
An arrayLiteral (as specified in ECMAScript 2015, 12.2.5) is an expression that describes the initialization of an array object.
This pattern only matches nodes of type expression.
arrayLiteral produces a record that contains the following property:
Name | Type | Description |
---|---|---|
elementList | list<expression> | The array elements |
Inherits properties from:
The arrayLiteral pattern matches the initializer of arr:
The .elementList property is a list of three string literal expressions, representing "a", "b", and "c".
The arrayElision and spreadOperator patterns match special array elements.
Matches Boolean literals: that is, either true or false.
This pattern only matches nodes of type expression.
booleanLiteral produces a record that contains the following property:
Name | Type | Description |
---|---|---|
value | bool | Either true or false |
Inherits properties from:
Matches numeric values represented in the source code as floating-point numbers.
All JavaScript numeric values are stored and processed as floats, but this pattern matches only those that appear as floats (that is, have a decimal point) in the source code.
This pattern only matches nodes of type expression.
floatLiteral produces a record that contains the following property:
Name | Type | Description |
---|---|---|
valueString | string | The floating-point value in string form |
Inherits properties from:
Matches numeric values represented in the source code as integers.
All JavaScript numeric values are stored and processed as floats, but this pattern matches only those that appear as integers (that is, have no decimal point) in the source code.
This pattern only matches nodes of type expression.
integerLiteral produces a record that contains the following property:
Name | Type | Description |
---|---|---|
value | int | The integer value |
Inherits properties from:
Matches all null literals.
This pattern only matches nodes of type expression. It does not expose any new properties.
Inherits properties from:
Matches object literals.
An objectLiteral (as specified in ECMAScript 2015, 12.2.6.) is an expression that describes the initialization of an object.
This pattern only matches nodes of type expression.
objectLiteral produces a record that contains the following property:
Name | Type | Description |
---|---|---|
propertyDefinitionList | list<propertyAssignment> | The list of property assignments |
Inherits properties from:
The objectLiteral pattern matches the initializer of obj:
The .propertyDefinitionList property is a list of three elements. For the first element, its propertyName is a string "a", and its value is a string literal "hello".
Matches regular expression literals that have the form /pattern/flags.
This pattern only matches nodes of type expression.
regularExpressionLiteral produces a record that contains the following properties:
Name | Type | Description |
---|---|---|
body | The regular expression | |
flags | string | The flags for advanced searches |
Inherits properties from:
The regularExpressionLiteral pattern matches the following initializer of re:
The .body property is "\w+\s", and the .flags property is "g".
Matches string literals.
This pattern is independent of the type of quotation mark used (either single or double).
This pattern also matches individual string portions of template literals.
This pattern only matches nodes of type expression.
stringLiteral produces a record that contains the following property:
Name | Type | Description |
---|---|---|
value | string | The contents of the string |
Inherits properties from:
Matches the undefined value.
This pattern only matches nodes of type expression.
This pattern does not expose any new properties.
Inherits properties from:
These patterns match operators in the target code.
Matches all forms of the assignment operator where it occurs.
This pattern only matches nodes of type expression.
assignmentOperator produces a record that contains the following properties:
Name | Type | Description |
---|---|---|
kind | enum (see below) | The kind of assignment operator matched |
operator | enum (see binaryOperator Properties) | The specific assignment operator matched |
sourceExpression | expression | The expression that is evaluated, and that will be assigned |
targetExpression | expression | The expression (typically a variable) that is being assigned |
These are the possible values for the kind property:
Name | Description |
---|---|
`compound` | Compound assignment, as in += |
`simple` | Simple assignment via = |
Inherits properties from:
Matches expressions such as x = 5 or x += 5.
Matches only compound assignment operators such as a += b.
assignmentOperatorCompound produces a record that contains the following properties:
Name | Type | Description |
---|---|---|
kind | enum | Always `compound` |
operator | enum (see binaryOperator Properties) | The specific assignment operator matched |
sourceExpression | expression | The expression that is evaluated, and that will be assigned |
targetExpression | expression | The expression (typically a variable) that is being assigned |
Inherits properties from:
Matches assignments such as x += 5.
The assignmentOperator pattern.
Matches only simple assignments such as a = 1.
This pattern does not expose any new properties.
Inherits properties from:
Matches assignments such as x = 5.
The assignmentOperator pattern.
Matches all possible JavaScript binary operators.
Note: This pattern does not match assignment operators, as these have their own specific patterns.
binaryOperator produces a record that contains the following properties:
Name | Type | Description |
---|---|---|
isImplicit | bool | Whether this expression is implicit |
lhsExpression | expression | The operand on the left-hand side of the operator |
operator | enum (see below) | The operator matched |
rhsExpression | expression | The operand on the right-hand side of the operator |
These are the possible values for the operator property:
Name | Description |
---|---|
`=` | The simple assignment operator |
`+=` | The addition assignment operator |
`-=` | The subtraction assignment operator |
`*=` | The multiplication assignment operator |
`/=` | The division assignment operator |
`%=` | The modulo assignment operator |
`**=` | The exponentiation assignment operator |
`&=` | The bitwise assignment operator |
`|=` | The bitwise OR assignment operator |
`^=` | The bitwise codexmspan AND assignment operator |
`<<=` | The left-shift assignment operator |
`>>=` | The sign-preserving right-shift operator |
`>>>=` | The unsigned right-shift operator |
Inherits properties from:
Complex binary operations are specifically represented with the correct order of operations, regardless of operator precedence (the compiler has already evaluated the precedence in order to build the expression’s tree structure). When pattern matching, be aware that either operand of a binary operator, or both, can also act as a binary operator representing operations that are completed before the match operation is performed.
For example, a + b * c is understood as a + (b * c) due to operator precedence. It is encoded as a binary addition that has a right-hand operand of b * c: this must be computed before the addition is performed. On the other hand, (a + b) * c is a multiplication where the left-hand operand, a + b, must be computed before it is multiplied by c.
The following illustration shows this situation:
In both cases, a binaryOperator{.operand == `*`} pattern matches some part of the expression. In the left-hand case, it matches b * c. In the right-hand case, it matches the entire expression.
This pattern only matches nodes of type expression.
This pattern would match a + b, and yield "a" as lhsExpressions, "b" as rhsExpression, and `+` as operator.
The following pattern matches only multiplication:
Sometimes there will be implicit binary operators, such as in the following example:
... where the initializer is actually an implicit string concatenation.
The various assignmentOperator patterns, including assignmentOperatorSimple and assignmentOperatorCompound. The unaryOperator pattern can be used to match unary operators.
Matches all kinds of casts.
castOperator produces a record that contains the following properties:
Name | Type | Description |
---|---|---|
isImplicitCast | bool | Whether or not this cast is implicit |
operandExpression | expression | The cast operand |
Inherits properties from:
Matches the conditional operator ? :, sometimes called the “ternary” operator.
This pattern only matches nodes of type expression.
conditionalOperator produces a record that contains the following properties:
Name | Type | Description |
---|---|---|
conditionExpression | expression | The condition (the operand before the ? symbol) |
falseExpression | expression | The expression to evaluate if the condition is false (that is, the operand to the right of the : symbol) |
trueExpression | expression | The expression to evaluate if the condition is true (that is, the operand between the ? and : symbols) |
Inherits properties from:
The conditionalOperator pattern matches the following expression:
The .conditionalExpression property is the expression "isA", the .trueExpression property is the literal "A", and the .falseExpression property is the literal "B"
Matches the -- operation, as either a prefix or postfix.
Note: The decrement operator is not matched by the unaryOperator pattern.
This pattern only matches nodes of type expression
decrementOperator produces a record that contains the following properties:
Name | Type | Description |
---|---|---|
kind | enum | The operator kind: either `postfix` or `prefix` |
operandExpression | expression | The operand |
Inherits properties from:
The decrementOperator pattern matches the following expressions:
In the first instance, the .kind property is `prefix`. In the second, it is `postfix`.
Matches a delete expression.
The JavaScript delete operator removes a property from an object.
This pattern only matches nodes of type expression.
This pattern does not expose any new properties.
Inherits properties from:
This pattern could match the JavaScript expression delete c1.a, where the property .operandExpression is "c1.a".
Matches the ++ operation, as either a prefix or postfix.
Note: The increment operator is not matched by the unaryOperator pattern.
This pattern only matches nodes of type expression.
incrementOperator produces a record that contains the following properties:
Name | Type | Description |
---|---|---|
kind | enum | The operator kind: either `postfix` or `prefix` |
operandExpression | expression | The operand |
Inherits properties from:
The incrementOperator pattern matches the following expressions:
In the first instance, the .kind property is `prefix`. In the second, it is `postfix`.
Matches binary operations where the operator is instanceof.
This pattern does not expose any new properties.
Inherits properties from:
The instanceofOperator pattern matches the following expression:
The binaryOperator pattern.
Matches the JavaScript new operator.
A newExpression (as specified in ECMAScript 2015 section 12.3) is an expression that creates an object.
This pattern only matches nodes of type expression.
newOperator produces a record that contains the following properties:
Name | Type | Description |
---|---|---|
argumentList | list<expression> | The ordered list of explicit parameters |
constructor | functionSymbol | The constructor |
Inherits properties from:
In the following JavaScript example:
... the expression new C("Hello") matches newOperator, where the .constructor property is the symbol that represents C and the .argumentList property is the list ["Hello"].
Matches instances of the ... (spread) operator.
The spread operator is specified in ECMAScript 2015, 12.2.5.
This pattern only matches nodes of type expression.
spreadOperator produces a record that contains the following property:
Name | Type | Description |
---|---|---|
operandExpression | expression | The operand |
Inherits properties from:
The spreadOperator pattern matches the element with a ... prefix in the following array literal:
The .operandExpression property is the expression otherList.
The arrayLiteral and objectLiteral patterns.
Matches instances of the typeof operator.
This pattern only matches nodes of type expression.
typeofOperator produces a record that contains the following property:
Name | Type | Description |
---|---|---|
operandExpression | expression | The operand |
Inherits properties from:
The typeofOperator pattern matches the following expression:
The .operandExpression property is 0.
Matches unary operators—those operators that have only one operand.
Note: The increment, decrement, void, typeof, and delete operators are matched by their own special patterns.
This pattern only matches nodes of type expression.
unaryOperator produces a record that contains the following properties:
Name | Type | Description |
---|---|---|
isImplicit | bool | Whether this expression is implicit |
operandExpression | expression | The operand |
operator | enum (see below) | The operator matched |
These are the possible values of the operator property:
Name | Description |
---|---|
`+` | The unary plus/positive operator |
`-` | The negation operator |
`!` | The logical negation operator |
`~` | The bitwise negation operator |
Inherits properties from:
The unaryOperator pattern matches the source expression of the following assignments:
In the first instance, the .operator property is `-`. In the second, it is `!`.
binaryOperator, incrementOperator, decrementOperator, voidOperator, typeofOperator, and deleteOperator
Matches instances of the void operator.
This pattern only matches nodes of type expression.
voidOperator produces a record that contains the following property:
Name | Type | Description |
---|---|---|
operandExpression | expression | The operand |
Inherits properties from:
The voidOperator pattern matches the following expression:
The .operandExpression property is 0.
Matches yield or yield* (delegate) expressions in a generator.
This pattern only matches nodes of type expression.
yieldOperator produces a record that contains the following properties:
Name | Type | Description |
---|---|---|
isDelegate | bool | Whether this is a delegate yield |
operandExpression | expression | The expression that returns an iterable object |
Inherits properties from:
The yieldOperator pattern matches the following yield operators:
For the first instance in f1, the .isDelegate property is true. For the second instance in f2, it is false.
Patterns in this section belong to the initializer class. They match initializers in the target code.
In many cases, an initializer can look the same as an assigment statement. However, many languages treat initialization as its own, special case. The CodeXM language libraries treat initialization in this way, as well.
Matches expression initializers.
This pattern only matches nodes of type initializer.
expressionInitializer produces a record that contains the following property:
Name | Type | Description |
---|---|---|
expression | expression | The expression that evaluates to the value used to initialize the object |
Inherits properties from:
Matches the initializer for the variable a in the following code:
In this instance, the .expression property is the literal 0.
These patterns match symbols in the target code.
A symbol is an entity that can have an identifier; for example, a symbol might be a variable, a function, or a field in a record.
In Coverity Analysis, each symbol in a program is its own node in the abstract syntax tree, and is distinct from the identifier that represents it in the source.
In addition to the properties that are specific to each pattern, all symbol patterns have the following properties in common:
Name | Type | Description |
---|---|---|
identifier | string? | The string used as an unqualified name for the symbol; null if there is none |
mangledName | string? | The internal “mangled” name used for the symbol (the mangled name includes type and scope information, to disambiguate this instance of the identifier); null if the mangled name is not available |
location | sourceloc | The location where this symbol was declared |
type | type | The JavaScript type declared for this symbol |
access | enum AccessKeyword | The scoping keywords associated with the symbol, such as `public` or `private` |
is_file_or_readonly | bool | true if the symbol has a final specifier |
scopeList | list<string> | A list of the class names and namespaces that enclose the symbol |
Matches captured outer variables.
This pattern only matches nodes of type symbol.
This pattern does not expose any new properties.
Inherits properties from:
In the following JavaScript example:
... the symbol representing counter in the returned lambda matches closedVariableSymbol.
Matches function symbols.
This pattern only matches nodes of type symbol.
functionSymbol produces a record that contains the following property:
Name | Type | Description |
---|---|---|
functionType | type | The type description of the function |
Inherits properties from:
In the following JavaScript example:
... the symbol representing f() matches functionSymbol.
Matches locally defined variables.
This pattern only matches nodes of type symbol.
This pattern does not expose any new properties.
Inherits properties from:
In the following JavaScript source:
... the symbol representing a in the function body matches localVariableSymbol.
Matches variables defined as parameters to functions.
This pattern only matches nodes of type symbol.
parameterSymbol produces a record that contains the following properties:
Name | Type | Description |
---|---|---|
isThis | bool | Whether or not the parameter represents this |
position | int | The numerical position in the parameter list |
Inherits properties from:
In the following example,
... the symbol representing a in the function body matches parameterSymbol.
Matches the global object.
This pattern only matches nodes of type symbol.
This pattern does not expose any new properties.
Inherits properties from:
The window object is the global object in the Browser.
The globalAccess pattern.
Matches variables.
A variable might be a global, local, parameter, or closed variable.
This pattern only matches nodes of type symbol.
This pattern does not expose any new properties.
Inherits properties from:
The theGlobalObjectSymbol, parameterSymbol, localVariableSymbol, and closedVariableSymbol patterns.
The JavaScript library provides a number of functions to help you handle, and analyze, the target source code.
See the Common Library Reference for descriptions of some general-purpose functions that are available to all language libraries.
Decomposing functions deal explicitly with managing casts and qualifiers.
This function strips implicit casts from an expression.
In some circumstances, such as loop conditions, JavaScript wraps expressions with implicit casts.
Name | Type | Description |
---|---|---|
e | expression | The expression to be stripped |
return value | expression | The resulting expression that is not an implicit cast |