The searchlocal, dot and davinci commands each take an expression as a parameter. This expression is built from the following grammar:
Expr := <filename> # FunExpr
| FunExpr
FunExpr := <functionname> : BasicExpr
| BasicExpr
BasicExpr := <identifier>
| * BasicExpr
| & BasicExpr
| ( BasicExpr )
| BasicExpr -> <identifier>
| BasicExpr . <identifier>
| BasicExpr [ <token-sequence-with-balanced-square-brackets> ]
(The array index expression is ignored.) The expression is parsed just like
a C expression, except that Lackwit allows you to specify the scope
using an optional module name and/or function name.
The searchlocal and searchglobal commands let you specify a "tag predicate" to constrain the query. This is given to the searchlocal command with the "-check" option (e.g. "searchlocal &foo->bar -check deref").
The predicate is given in Reverse Polish Notation. Valid operators are "!" (not), "&" (and), and "|" (or). Valid literals include "deref" (pointer contents are read), "assign" (pointer contents are assigned to) and "ref" (pointer contents are allocated). E.g. to find all writes to structure field foo->bar in fuction f, use "searchlocal f:&foo->bar -check assign".