[clang] [SSAF][UnsafeBufferAnalysis] Filter out type-constrained pointers from reachable unsafe pointers (PR #209354)

Balázs Benics via cfe-commits cfe-commits at lists.llvm.org
Sun Jul 19 01:03:43 PDT 2026


================
@@ -233,6 +237,65 @@ class UnsafeBufferReachableAnalysis
 
       updateReachablesWithOutgoings(Node, Worklist);
     }
+  }
+
+  /// \return a lazy range over the pointers in \p UnsafePtrs whose entity is
+  /// NOT type-constrained (per \p TypeConstraints).
+  auto filterNonConstrainedPointers(
+      const EntityPointerLevelSet &UnsafePtrs,
+      const TypeConstrainedPointersAnalysisResult &TypeConstraints) {
+    return llvm::make_filter_range(
+        UnsafePtrs, [&TypeConstraints](const EntityPointerLevel &EPL) {
+          return !TypeConstraints.contains(EPL.getEntity());
+        });
----------------
steakhal wrote:

I've not checked the call-sites but this is potentially dangerous.
If anyone would pass a temporary `TypeConstraints` object, then the view we return would dangle after the semicolon of the call-site.

https://github.com/llvm/llvm-project/pull/209354


More information about the cfe-commits mailing list