The searchlocal, dot and davinci commands each take an expression as a parameter. This expression is built from the following grammar:
Expr := <filename> # FunExpr | FunExpr FunExpr := <functionname> : BasicExpr | BasicExpr BasicExpr := <identifier> | * BasicExpr | & BasicExpr | ( BasicExpr ) | BasicExpr -> <identifier> | BasicExpr . <identifier> | BasicExpr [ <token-sequence-with-balanced-square-brackets> ](The array index expression is ignored.) The expression is parsed just like a C expression, except that Lackwit allows you to specify the scope using an optional module name and/or function name.
The searchlocal and searchglobal commands let you specify a "tag predicate" to constrain the query. This is given to the searchlocal command with the "-check" option (e.g. "searchlocal &foo->bar -check deref").
The predicate is given in Reverse Polish Notation. Valid operators are "!" (not), "&" (and), and "|" (or). Valid literals include "deref" (pointer contents are read), "assign" (pointer contents are assigned to) and "ref" (pointer contents are allocated). E.g. to find all writes to structure field foo->bar in fuction f, use "searchlocal f:&foo->bar -check assign".