[clang] 84494cd - [clang][csa] Bypass sandbox in `ExprEngine::DumpGraph()` (#174497)

[via cfe-commits]

Author: Jan Svoboda
Date: 2026-01-05T15:48:28-08:00
New Revision: 84494cd8beb69cdd7959d6adf78a94accc9c5d40

URL: https://github.com/llvm/llvm-project/commit/84494cd8beb69cdd7959d6adf78a94accc9c5d40
DIFF: https://github.com/llvm/llvm-project/commit/84494cd8beb69cdd7959d6adf78a94accc9c5d40.diff

LOG: [clang][csa] Bypass sandbox in `ExprEngine::DumpGraph()` (#174497)

Clang static analyzer violates the sandbox in `ExprEngine::DumpGraph()`.
This PR bypasses the sandbox and leaves a FIXME behind.

Added: 
    

Modified: 
    clang/lib/StaticAnalyzer/Core/ExprEngine.cpp

Removed: 
    


################################################################################
diff  --git a/clang/lib/StaticAnalyzer/Core/ExprEngine.cpp b/clang/lib/StaticAnalyzer/Core/ExprEngine.cpp
index c8dc5b6e81b16..a6a96b594fe85 100644
--- a/clang/lib/StaticAnalyzer/Core/ExprEngine.cpp
+++ b/clang/lib/StaticAnalyzer/Core/ExprEngine.cpp
@@ -72,6 +72,7 @@
 #include "llvm/Support/DOTGraphTraits.h"
 #include "llvm/Support/ErrorHandling.h"
 #include "llvm/Support/GraphWriter.h"
+#include "llvm/Support/IOSandbox.h"
 #include "llvm/Support/TimeProfiler.h"
 #include "llvm/Support/raw_ostream.h"
 #include <cassert>
@@ -4109,6 +4110,8 @@ std::string ExprEngine::DumpGraph(bool trim, StringRef Filename) {
     return DumpGraph(Src, Filename);
   }
 
+  // FIXME(sandboxing): Remove this by adopting `llvm::vfs::OutputBackend`.
+  auto BypassSandbox = llvm::sys::sandbox::scopedDisable();
   return llvm::WriteGraph(&G, "ExprEngine", /*ShortNames=*/false,
                           /*Title=*/"Exploded Graph",
                           /*Filename=*/std::string(Filename));
@@ -4123,6 +4126,8 @@ std::string ExprEngine::DumpGraph(ArrayRef<const ExplodedNode *> Nodes,
     return "";
   }
 
+  // FIXME(sandboxing): Remove this by adopting `llvm::vfs::OutputBackend`.
+  auto BypassSandbox = llvm::sys::sandbox::scopedDisable();
   return llvm::WriteGraph(TrimmedG.get(), "TrimmedExprEngine",
                           /*ShortNames=*/false,
                           /*Title=*/"Trimmed Exploded Graph",