[all-commits] [llvm/llvm-project] 954496: [SSAF] Close unsafe-buffer reachability over overr...

[Balázs Benics via All-commits]

  Branch: refs/heads/users/steakhal/ssaf/virtual-method-family-closure
  Home:   https://github.com/llvm/llvm-project
  Commit: 9544962902522b1ae14a2baa20786022230534a0
      https://github.com/llvm/llvm-project/commit/9544962902522b1ae14a2baa20786022230534a0
  Author: Balazs Benics <benicsbalazs at gmail.com>
  Date:   2026-07-31 (Fri, 31 Jul 2026)

  Changed paths:
    M clang/lib/ScalableStaticAnalysis/Analyses/UnsafeBufferUsage/UnsafeBufferUsageAnalysis.cpp
    M clang/test/Analysis/Scalable/PointerFlow/external-inline-function-in-multi-tu.test
    M clang/test/Analysis/Scalable/PointerFlow/lref-to-rref-cast.test
    M clang/test/Analysis/Scalable/PointerFlow/multi-decl-contributor.cpp
    M clang/test/Analysis/Scalable/PointerFlow/multi-dim-pointer-flow-constraint.test
    M clang/unittests/ScalableStaticAnalysis/WholeProgramAnalysis/UnsafeBufferReachableAnalysisTest.cpp

  Log Message:
  -----------
  [SSAF] Close unsafe-buffer reachability over override families

An unsafe pointer reaching one override's parameter is equally unsafe in every
sibling and base override of that method, because the call site picks the
target dynamically. Without closing over the families, reachability depended
on which override the extractor happened to see the flow through, so a fix
suggested for the base could be contradicted by a derived override.

Mirroring is level-preserving: families relate slot entities, so a reachable
EPL propagates only to the same pointer level on its family members.

The closure runs after the pointer-flow DFS has converged and does not feed
its own output back in, so a flow edge out of a newly discovered EPL is still
missed. FamilyClosureDoesNotRerunDFS pins that gap.

§4 of rdar://179151603



To unsubscribe from these emails, change your notification settings at https://github.com/llvm/llvm-project/settings/notifications