[-Wunsafe-buffer-usage] Group variables associated by pointer assignments

[t-rasmud]

Summary

• For assignments involving pointer types, if the machine decides that the LHS pointer has to be fixed to std::span, this patch introduces the same fixit for the RHS pointer.
• It groups all such pointer variables (that transitively depend on the unsafe pointer) and suggests that they all be fixed atomically to correctly propagate bounds information among them.
• TODOs: UUC, variables claimed by multiple gadgets (ex: int *p = q), handle parameters.

[NoQ]

Brilliant!!

I guess we can abandon D143133 now in favor of this patch?

Before I jump to nitpicking, I think we should sync up on how the end result should look like, in terms of warnings and notes that we display. This may affect the overall algorithm, like require us to gather more data.

clang/test/SemaCXX/warn-unsafe-buffer-usage-multi-decl-warnings.cpp

5–14

We probably want to build some finer narrative here 🤔 In this case p and q are both independently unsafe and there's a one-way connection between them. Would it make sense to emit just one warning for both of them? I suspect it also makes sense to leave a note at q = p with a text like "note: bounds information needs to propagate from p to q here" (I've no idea if it'll scale to more than 2 variables, or how much more information we'll need to gather).

57–63

In this case we definitely want to spanify q, for two independent reasons. We need to figure out how to tell that to the user though 🤔

[ziqingluo-90]

I have one general question: suppose we have two variables A and B in the same group. So fix-its emitted for A includes fix-its for B and vice verse, right? Does it mean that we cannot apply all fix-its at once from the command line?

clang/include/clang/Analysis/Analyses/UnsafeBufferUsage.h

42

It could be nice to have a document for this function since it is in the header.

clang/lib/Analysis/UnsafeBufferUsage.cpp

365

So every Fixable needs to implement this. I would love to see a document for this function.

726

DeclPtrAtLeft is not used.

1836

It seems like we do not care about the direction of edges in the graph, maybe we should call it UndirectedGraph?

clang/lib/Sema/AnalysisBasedWarnings.cpp

2289

would it be better if to make VariableGroups a map from VarDecls to groups ?

[ziqingluo-90]

clang/lib/Sema/AnalysisBasedWarnings.cpp

2313

These note messages are nice. Maybe we can have some tests for them. It will also help telling whether variables are grouped correctly.

clang/test/SemaCXX/warn-unsafe-buffer-usage-multi-decl-fixits-test.cpp

139

Could we have an example where there is a cyclic dependency? Such as p = q; q = r; r = p;.

[t-rasmud]

Adds tests that were accidentally deleted in the last diff.

[t-rasmud]

• Handle the case where implied variables don't have a fixit strategy
• TODO: address feedback for the previous diff

[t-rasmud]

• Address review comments.

[t-rasmud]

clang/lib/Analysis/UnsafeBufferUsage.cpp

1836

I changed it to PtrAssignmentGraph which seems (atleast to me) to give more context. It is still a directed graph because Deps[0] represents the LHS pointer and Deps[1] the RHS pointer. Hopefully the new documentation on getStrategyImplications makes this clear!

clang/test/SemaCXX/warn-unsafe-buffer-usage-multi-decl-warnings.cpp

5–14

The new note is more descriptive and summarizes the reason for grouping variables together. We still don't inform the user of the direction of bounds propagation or the fact that buffers are independently unsafe. Like we discussed offline, we could consider these refinements in future versions of the tool.

[ziqingluo-90]

clang/lib/Analysis/UnsafeBufferUsage.cpp

718

I was wondering if we need this sub-matcher declRefExpr(expr()).bind(PointerAssignRHSTag). It is eventually used as an inner matcher of binaryOperator. I doubt it will match anything.

Ditto for line 582-583.

1672

How about using FixablesForUnsafeVars.byVar[Var] instead of the outer loop?

[t-rasmud]

Address review comments.

[t-rasmud]

clang/lib/Analysis/UnsafeBufferUsage.cpp

718

Great catch @ziqingluo-90! I was experimenting to match assignments at declarations and never intended for those sub-matchers to be part of this patch.

[NoQ]

I think it'd be really valuable to document the algorithm.

It's essential for the reader to understand why this is a two-step process and a simple flood-fill through bidirectional implications graph isn't going to be correct.

Then, you did something very clever to avoid finding intersections between directed "zones of influence" of every variable (and then joining them), and I really like it. In inline comments i have a couple suggestions on how to demonstrate to the reader that it's equivalent to (my) intuitive understanding of the problem. It looks like your algorithm is pretty much linear over the size of the AST, which is great because this means we don't have to worry too much about budgets! - this is probably worth proclaiming as well.

clang/lib/Analysis/UnsafeBufferUsage.cpp

365–369

You're saying this is a two-element list with well-defined LHS and RHS, but the caller implementation accepts arbitrarily long list and treats it as implication from item [0] to items [1 ... N-1].

I'm not really sure how it *should* behave in the more-than-two-elements case.

IIRC our primary motivating example for more than 2 elements is foo(p1, p2, ..., pN) where foo has attribute [[unsafe_buffer_usage]] with respect to all N parameters and has a safe version that accepts N spans, but no safe versions for smaller subsets of parameters. If we try to represent it with these "directed" vectors, it becomes quadratic over N as you'll need edges from each argument to each argument.

Maybe before we get to handling the other case, it makes sense to have an abstract class StrategyImplication, so that assignment-like implication was one concrete subclass, and a symmetric set of N related variables was another concrete subclass. Then the call site can handle these cases separately. For the purposes of this patch it probably makes sense for this function to just return optional<pair<VarDecl *>>, so that to manage the reader's expectations :)

1768

Probably better to compare pointers. There could be variables with the same name in the same function (in smaller scopes). Also IIRC getName() crashes on anonymous declarations (not sure if it can happen in this case).

1828

I was about to say that, there could be fixables that don't connect any unsafe variables, but connect two implicated variables together, so you need to iterate over *all* fixables instead.

But then I noticed that FixablesForUnsafeVars is actually mis-named 🙁 According to groupFixablesByVar() contains fixables for *all* variables, sorted by variable, and nobody ever checks whether it's unsafe. It'd be really valuable if we could rename it before or together with this patch! – as it makes the code much harder to read and reason about, there could even be existing bugs based on this misunderstanding.

Also, iterating over FixablesForUnsafeVars.byVar here would cause you to visit multivariable fixables twice (once for each variable), so there could be a bit of duplicated work here, maybe it still makes sense to iterate over the whole list.

1857–1858

Using Var here instead of CurrentVar is really clever. I think there needs to be a comment bragging about this decision! I was quite confused initially when I was thinking of it as essential to the algorithm, whereas in reality it looks like it's just an optimization.

If CurrentVar was used, this would have straightforwardly meant "Just keep the edges in the original graph that are reachable from unsafe variables, and add reverse edges; and also no need to explore from the same var more than once". It's somewhat obvious that it would correctly define the graph for the second part of the algorithm.

By using Var you're most likely achieving the same result, but dramatically cutting the amount of hoops the second part of the algorithm needs to jump through, given that a lot of these connections become "direct". But this results in a dramatically different graph, and the shape of that graph is non-deterministic (depends on iteration order in this loop).

So I guess my point is, it's valuable to tell the reader that they shouldn't try to imagine how the graph is transformed because of using Var instead of CurrentVar. It's still essentially the same graph, just a bit shallower. The reader can continue reading as if CurrentVar was used, and think about why it's equivalent later.

[jkorous]

This looks good!
I am trying to catch up with this patch and my comments are meant as "Did we consider case X?" rather than "This doesn't work for case X."

clang/lib/Analysis/UnsafeBufferUsage.cpp

716

Shall we back-port how matcher() and getFixits() methods split responsibilities that we've started to use in more recent patches?
For other fixables we now check if the DRE refers to a var decl already in the matcher like this:
declRefExpr(to(varDecl()))

1668

Array subscript operator adds an entry to the map if the key is not found.
https://en.cppreference.com/w/cpp/container/map/operator_at
That might or might not be ok here.
But we might also just take FixablesForUnsafeVars as a const reference and use find() instead.
https://en.cppreference.com/w/cpp/container/map/find

1708

I am trying to understand how do the Fixables matched to other variables in the VarGroupForVD learn that they shouldn't emit any Fix-It.
I was naively expecting that we'd do:

for (const VarDecl * V : VarGroupForVD) {
    FixItsForVariable.erase(VD);
}

1711

Note: VarGrpMap being std::map inserts a record if VD is not among the keys yet.

[jkorous]

clang/lib/Analysis/UnsafeBufferUsage.cpp

1768

+1 to comparing pointers
That's what we do above.

1835

IIUC we're copying elements from an std::vector to an std::set.
Nit: Maybe we could avoid the explicit iteration?

assert(Deps.size() > 1);
PtrAssignmentGraph[Deps[0]].insert(Deps.begin() + 1, Deps.end());

But I feel we might want to handle the case where Deps has exactly one element regardless.

1857–1858

+1 to adding comments
Our future selves might be pretty grateful if they have to debug this code :)

clang/test/SemaCXX/warn-unsafe-buffer-usage-multi-decl-warnings.cpp

2

I am looking for a test that checks that if one of the variables in the group is referred to by at least one DRE for which we don't have a Fix-It (e. g. negative index for span strategy) that the whole group will remain Fix-It-less (and note-less).
I can't find any and maybe that's just because I didn't look hard enough but it makes me wonder - should we add a short explanation to such test (either an existing one or the one we should add)?

[t-rasmud]

Address partial feedback.

[ziqingluo-90]

I'm working on fixing multiple parameters at a time. It is based on this patch. So I suddenly had a few more questions.

clang/lib/Analysis/UnsafeBufferUsage.cpp

1723

If VD is removed (it means giving up on fixing VD), do we also need to remove the whole group of VD?

1772

Could we do the grouping after all variables having their fix-its generated so that we can directly copy their fix-its instead of re-generating them?
This requires fix-its generated for two different variables to be independent. And, I think so far they are independent.

[t-rasmud]

clang/lib/Analysis/UnsafeBufferUsage.cpp

1723

That is right and a good optimization to have. I'll include it in the next iteration of the patch along.

[t-rasmud]

Address more feedback.

[t-rasmud]

Minor fix.

[t-rasmud]

Address feedback.

[t-rasmud]

clang/lib/Analysis/UnsafeBufferUsage.cpp

365–369

You are right, hadn't considered the case with more than two elements and will address it in a separate patch.

[t-rasmud]

Add documentation.

[NoQ]

Alright I think everything looks mostly good from high-level perspective! I have a few minor nitpicks.

clang/include/clang/Analysis/Analyses/UnsafeBufferUsage.h

35–37

We can remove the old interface now right? You removed both the definition and the call site.

43

We should probably turn VarGrpMap into a const reference. Otherwise it'll be deep-copied every time we call the function.

It's probably also better to make a typedef for this map type, as it shows up multiple times.

Does this map need to be ordered/tree-based? Maybe we should use std::unordered_map or llvm::DenseMap?

clang/lib/Analysis/UnsafeBufferUsage.cpp

718

Looks like the hasOperatorName("=") check is duplicated on both sides.

736–737

We're confident that this cast always succeeds. And we really don't want to see null pointers inside these pairs.

1229–1230

(valid use case for auto according to https://llvm.org/docs/CodingStandards.html#use-auto-type-deduction-to-make-code-more-readable)

clang/lib/Sema/AnalysisBasedWarnings.cpp

2278

We should probably find a way to put all these plain text pieces into DiagnosticSemaKinds.td (except probably the and part). I wonder if a

... %select{|, and change %2 to %select{std::span|std::array|std::span::iterator}1 to propagate bounds information betwen them'.}`

would work (like, nest more format specifiers into a %select). Or we could keep using the old diagnostic id when we don't need extra stuff at the end.

(It might be a good idea to make a new format specifier for this purpose, like plural but with lists. But this is probably an overkill if there's just one warning of this kind.)

clang/test/SemaCXX/warn-unsafe-buffer-usage-multi-decl-warnings.cpp

44

This is a FIXME test right? In theory we want to propagate all the way up to a, but we only support assignments so far, not initializations.

[NoQ]

TODOs: UUC

I think now is a good time to address this. The patch isn't going to be correct without it so we can't land it until the context is checked.

[t-rasmud]

Address comments.

[t-rasmud]

clang/include/clang/Analysis/Analyses/UnsafeBufferUsage.h

35–37

Assuming you're referring to handleFixableVariable I have already removed it in this patch. Did I miss something here?

[t-rasmud]

Modify diagnostic message.

[t-rasmud]

Use nested %select in format specifier of the diagnostic message.

[t-rasmud]

Friendly Ping.

[NoQ]

Ok this looks great to me, almost ready to land! Still needs the UUC work.

clang/include/clang/Analysis/Analyses/UnsafeBufferUsage.h

35–37

Yeah nvm I misread, you're absolutely right!

clang/include/clang/Basic/DiagnosticSemaKinds.td

11824–11828

Ok this one's also unused right?

11827

Found a typo!

Also I think we shouldn't have single quotes around %0 here, but instead we're supposed to stuff our const VarDecl * directly into the diagnostic stream, just like we already do in warn_unsafe_buffer_variable, which automatically surrounds it with single quotes.

(unfortunately we can't do the same with %2 so we add quotes manually when we build the dynamic string)

clang/lib/Analysis/UnsafeBufferUsage.cpp

696

[t-rasmud]

Squash changes from https://reviews.llvm.org/D150811.

[t-rasmud]

Address comments.

[NoQ]

Ok I think this is good to go! Amazing work!!

[barannikov88]

Hi, just a heads-up, some bots seem to be unhappy with the test:

https://lab.llvm.org/buildbot/#/builders/216/builds/21765

error: 'note' diagnostics expected but not seen: 
  File Z:\b\llvm-clang-x86_64-sie-win\llvm-project\clang\test\SemaCXX\warn-unsafe-buffer-usage-multi-decl-warnings.cpp Line 169: {{^change type of 'q' to 'std::span' to preserve bounds information, and change 'r' and 'p' to 'std::span' to propagate bounds information between them$}}
error: 'note' diagnostics seen but not expected: 
  File Z:\b\llvm-clang-x86_64-sie-win\llvm-project\clang\test\SemaCXX\warn-unsafe-buffer-usage-multi-decl-warnings.cpp Line 169: change type of 'q' to 'std::span' to preserve bounds information, and change 'p' and 'r' to 'std::span' to propagate bounds information between them
2 errors generated.

[dyung]

In D145739#4370674, @barannikov88 wrote:

Hi, just a heads-up, some bots seem to be unhappy with the test:

https://lab.llvm.org/buildbot/#/builders/216/builds/21765

error: 'note' diagnostics expected but not seen: 
  File Z:\b\llvm-clang-x86_64-sie-win\llvm-project\clang\test\SemaCXX\warn-unsafe-buffer-usage-multi-decl-warnings.cpp Line 169: {{^change type of 'q' to 'std::span' to preserve bounds information, and change 'r' and 'p' to 'std::span' to propagate bounds information between them$}}
error: 'note' diagnostics seen but not expected: 
  File Z:\b\llvm-clang-x86_64-sie-win\llvm-project\clang\test\SemaCXX\warn-unsafe-buffer-usage-multi-decl-warnings.cpp Line 169: change type of 'q' to 'std::span' to preserve bounds information, and change 'p' and 'r' to 'std::span' to propagate bounds information between them
2 errors generated.

The test seems to randomly pass and fail on the bot. It seems that the order of 'p' and 'r' in the output string may not be deterministic? Can you make the test more reliable or make it handle each situation (if appropriate)?

[dyung]

@t-rasmud I am sorry, but I had to revert your change, it is randomly failing on the Windows bots causing a lot of instability. See the revert commit message for examples.

[t-rasmud]

Hi Douglas,

No worries, I know the root cause for the issue. I will make the necessary changes and re-commit the patch.

Thanks,
Rashmi

[NoQ]

Thank you Sergei for catching this! Thank you Rashmi for fixing this!

clang/include/clang/Analysis/Analyses/UnsafeBufferUsage.h

 #ifndef LLVM_CLANG_ANALYSIS_ANALYSES_UNSAFEBUFFERUSAGE_H
 #define LLVM_CLANG_ANALYSIS_ANALYSES_UNSAFEBUFFERUSAGE_H
 
 #include "clang/AST/Decl.h"
 #include "clang/AST/Stmt.h"
 
 namespace clang {
 
+using DefMapTy = llvm::DenseMap<const VarDecl *, std::vector<const VarDecl *>>;
+
 /// The interface that lets the caller handle unsafe buffer usage analysis
 /// results by overriding this class's handle... methods.
 class UnsafeBufferUsageHandler {
 public:
   UnsafeBufferUsageHandler() = default;
   virtual ~UnsafeBufferUsageHandler() = default;
 
   /// This analyses produces large fixits that are organized into lists
   /// of primitive fixits (individual insertions/removals/replacements).
   using FixItList = llvm::SmallVectorImpl<FixItHint>;
 
   /// Invoked when an unsafe operation over raw pointers is found.
   virtual void handleUnsafeOperation(const Stmt *Operation,
                                      bool IsRelatedToDecl) = 0;
 
-  /// Invoked when a fix is suggested against a variable.
-  virtual void handleFixableVariable(const VarDecl *Variable,
-                                     FixItList &&List) = 0;
+  /// Invoked when a fix is suggested against a variable. This function groups
+  /// all variables that must be fixed together (i.e their types must be changed to the
+  /// same target type to prevent type mismatches) into a single fixit.
+  virtual void handleUnsafeVariableGroup(const VarDecl *Variable,
+                                         const DefMapTy &VarGrpMap,
+                                         FixItList &&Fixes) = 0;
 
   /// Returns a reference to the `Preprocessor`:
   virtual bool isSafeBufferOptOut(const SourceLocation &Loc) const = 0;
 
   /// Returns the text indicating that the user needs to provide input there:
   virtual std::string
   getUserFillPlaceHolder(StringRef HintTextToUser = "placeholder") const {
     std::string s = std::string("<# ");

clang/include/clang/Analysis/Analyses/UnsafeBufferUsageGadgets.def

 WARNING_GADGET(PointerArithmetic)
 WARNING_GADGET(UnsafeBufferUsageAttr)
 FIXABLE_GADGET(ULCArraySubscript)          // `DRE[any]` in an Unspecified Lvalue Context
 FIXABLE_GADGET(DerefSimplePtrArithFixable)
 FIXABLE_GADGET(PointerDereference)
 FIXABLE_GADGET(UPCAddressofArraySubscript) // '&DRE[any]' in an Unspecified Pointer Context
 FIXABLE_GADGET(UPCStandalonePointer)
 FIXABLE_GADGET(UPCPreIncrement)            // '++Ptr' in an Unspecified Pointer Context
+FIXABLE_GADGET(PointerAssignment)
 
 #undef FIXABLE_GADGET
 #undef WARNING_GADGET
 #undef GADGET

clang/include/clang/Basic/DiagnosticSemaKinds.td

def warn_unsafe_buffer_variable : Warning<
   "%0 is an %select{unsafe pointer used for buffer access|unsafe buffer that "
   "does not perform bounds checks}1">,
   InGroup<UnsafeBufferUsage>, DefaultIgnore;
 def warn_unsafe_buffer_operation : Warning<
   "%select{unsafe pointer operation|unsafe pointer arithmetic|"
   "unsafe buffer access|function introduces unsafe buffer manipulation}0">,
   InGroup<UnsafeBufferUsage>, DefaultIgnore;
 def note_unsafe_buffer_operation : Note<
   "used%select{| in pointer arithmetic| in buffer access}0 here">;
-def note_unsafe_buffer_variable_fixit : Note<
-  "change type of '%0' to '%select{std::span|std::array|std::span::iterator}1' to preserve bounds information">;
+def note_unsafe_buffer_variable_fixit_group : Note<
+  "change type of %0 to '%select{std::span|std::array|std::span::iterator}1' to preserve bounds information%select{|, and change %2 to '%select{std::span|std::array|std::span::iterator}1' to propagate bounds information between them}3">;
 def note_safe_buffer_usage_suggestions_disabled : Note<
   "pass -fsafe-buffer-usage-suggestions to receive code hardening suggestions">;
 def err_loongarch_builtin_requires_la32 : Error<
   "this builtin requires target: loongarch32">;
 
 def err_builtin_pass_in_regs_non_class : Error<
   "argument %0 is not an unqualified class type">;
 
 
 // WebAssembly reference type and table diagnostics.
 def err_wasm_reference_pr : Error<
   "%select{pointer|reference}0 to WebAssembly reference type is not allowed">;
 def err_wasm_ca_reference : Error<
   "cannot %select{capture|take address of}0 WebAssembly reference">;
 def err_wasm_funcref_not_wasm : Error<
   "invalid use of '__funcref' keyword outside the WebAssembly triple">;
 } // end of sema component.

clang/lib/Analysis/UnsafeBufferUsage.cpp

 #include "clang/AST/RecursiveASTVisitor.h"
 #include "clang/ASTMatchers/ASTMatchFinder.h"
 #include "clang/Lex/Lexer.h"
 #include "clang/Lex/Preprocessor.h"
 #include "llvm/ADT/SmallVector.h"
 #include <memory>
 #include <optional>
 #include <sstream>
+#include <queue>
 
 using namespace llvm;
 using namespace clang;
 using namespace ast_matchers;
 
 namespace clang::ast_matchers {
 // A `RecursiveASTVisitor` that traverses all descendants of a given node "n"
 // except for those belonging to a different callable of "n".
auto PtrSubtractionMatcher =
          eachOf(hasLHS(InnerMatcher),
           hasRHS(InnerMatcher)));
 
   return stmt(anyOf(CallArgMatcher, CastOperandMatcher, CompOperandMatcher,
         PtrSubtractionMatcher));
   // FIXME: any more cases? (UPC excludes the RHS of an assignment.  For now we
   // don't have to check that.)
 }
+
+// Returns a matcher that matches any expression 'e' such that `innerMatcher`
+// matches 'e' and 'e' is in an unspecified untyped context (i.e the expression
+// 'e' isn't evaluated to an RValue). For example, consider the following code:
+//    int *p = new int[4];
+//    int *q = new int[4];
+//    if ((p = q)) {}
+//    p = q;
+// The expression `p = q` in the conditional of the `if` statement
+// `if ((p = q))` is evaluated as an RValue, whereas the expression `p = q;`
+// in the assignment statement is in an untyped context.
+static internal::Matcher<Stmt>
+isInUnspecifiedUntypedContext(internal::Matcher<Stmt> InnerMatcher) {
+  // An unspecified context can be
+  // 1. A compound statement,
+  // 2. The body of an if statement
+  // 3. Body of a loop
+  auto CompStmt = compoundStmt(forEach(InnerMatcher));
+  auto IfStmtThen = ifStmt(hasThen(InnerMatcher));
+  auto IfStmtElse = ifStmt(hasElse(InnerMatcher));
+  // FIXME: Handle loop bodies.
+  return stmt(anyOf(CompStmt, IfStmtThen, IfStmtElse));
+}
 } // namespace clang::ast_matchers
 
 namespace {
 // Because the analysis revolves around variables and their types, we'll need to
 // track uses of variables (aka DeclRefExprs).
 using DeclUseList = SmallVector<const DeclRefExpr *, 1>;
 
 // Convenience typedef.
public:
   bool isWarningGadget() const final { return false; }
 
   /// Returns a fixit that would fix the current gadget according to
   /// the current strategy. Returns std::nullopt if the fix cannot be produced;
   /// returns an empty list if no fixes are necessary.
   virtual std::optional<FixItList> getFixits(const Strategy &) const {
     return std::nullopt;
   }
+  
+  /// Returns a list of two elements where the first element is the LHS of a pointer assignment
+  /// statement and the second element is the RHS. This two-element list represents the fact that
+  /// the LHS buffer gets its bounds information from the RHS buffer. This information will be used
+  /// later to group all those variables whose types must be modified together to prevent type
+  /// mismatches.
+  virtual std::optional<std::pair<const VarDecl *, const VarDecl *>>
+  getStrategyImplications() const {
+    return std::nullopt;
+  }
 };
 
 using FixableGadgetList = std::vector<std::unique_ptr<FixableGadget>>;
 using WarningGadgetList = std::vector<std::unique_ptr<WarningGadget>>;
 
 /// An increment of a pointer-type value is unsafe as it may run the pointer
 /// out of bounds.
 class IncrementGadget : public WarningGadget {
DeclUseList getClaimedVarUseSites() const override {
     }
 
     return {};
   }
   // FIXME: pointer adding zero should be fine
   // FIXME: this gadge will need a fix-it
 };
 
+/// A pointer assignment expression of the form:
+///  \code
+///  p = q;
+///  \endcode
+class PointerAssignmentGadget : public FixableGadget {
+private:
+  static constexpr const char *const PointerAssignmentTag = "ptrAssign";
+  static constexpr const char *const PointerAssignLHSTag = "ptrLHS";
+  static constexpr const char *const PointerAssignRHSTag = "ptrRHS";
+  const BinaryOperator *PA;    // pointer arithmetic expression
+  const DeclRefExpr * PtrLHS;         // the LHS pointer expression in `PA`
+  const DeclRefExpr * PtrRHS;         // the RHS pointer expression in `PA`
+
+public:
+  PointerAssignmentGadget(const MatchFinder::MatchResult &Result)
+      : FixableGadget(Kind::PointerAssignment),
+    PA(Result.Nodes.getNodeAs<BinaryOperator>(PointerAssignmentTag)),
+    PtrLHS(Result.Nodes.getNodeAs<DeclRefExpr>(PointerAssignLHSTag)),
+    PtrRHS(Result.Nodes.getNodeAs<DeclRefExpr>(PointerAssignRHSTag)) {}
+
+  static bool classof(const Gadget *G) {
+    return G->getKind() == Kind::PointerAssignment;
+  }
+
+  static Matcher matcher() {
+    auto PtrAssignExpr = binaryOperator(allOf(hasOperatorName("="),
+      hasRHS(ignoringParenImpCasts(declRefExpr(hasPointerType(),
+                                               to(varDecl())).
+                                   bind(PointerAssignRHSTag))),
+                                   hasLHS(declRefExpr(hasPointerType(),
+                                                      to(varDecl())).
+                                          bind(PointerAssignLHSTag))));
+    
+    //FIXME: Handle declarations at assignments
+    return stmt(isInUnspecifiedUntypedContext(PtrAssignExpr));
+  }
+  
+  virtual std::optional<FixItList> getFixits(const Strategy &S) const override;
+
+  virtual const Stmt *getBaseStmt() const override { return PA; }
+
+  virtual DeclUseList getClaimedVarUseSites() const override {
+    return DeclUseList{PtrLHS, PtrRHS};
+  }
+
+  virtual std::optional<std::pair<const VarDecl *, const VarDecl *>>
+  getStrategyImplications() const override {
+    return std::make_pair(cast<VarDecl>(PtrLHS->getDecl()),
+                          cast<VarDecl>(PtrRHS->getDecl()));
+  }
+};
+
 /// A call of a function or method that performs unchecked buffer operations
 /// over one of its pointer parameters.
 class UnsafeBufferUsageAttrGadget : public WarningGadget {
   constexpr static const char *const OpTag = "call_expr";
   const CallExpr *Op;
 
 public:
   UnsafeBufferUsageAttrGadget(const MatchFinder::MatchResult &Result)

 };
 
 class PointerDereferenceGadget : public FixableGadget {
   static constexpr const char *const BaseDeclRefExprTag = "BaseDRE";
   static constexpr const char *const OperatorTag = "op";
 
   const DeclRefExpr *BaseDeclRefExpr = nullptr;
   const UnaryOperator *Op = nullptr;
 
 public:
   PointerDereferenceGadget(const MatchFinder::MatchResult &Result)
       : FixableGadget(Kind::PointerDereference),
         BaseDeclRefExpr(
             Result.Nodes.getNodeAs<DeclRefExpr>(BaseDeclRefExprTag)),
         Op(Result.Nodes.getNodeAs<UnaryOperator>(OperatorTag)) {}
 
   static bool classof(const Gadget *G) {
     return G->getKind() == Kind::PointerDereference;
   }
 
   static Matcher matcher() {
     auto Target =
         unaryOperator(
             hasOperatorName("*"),
             has(expr(ignoringParenImpCasts(
                 declRefExpr(to(varDecl())).bind(BaseDeclRefExprTag)))))
             .bind(OperatorTag);
 
     return expr(isInUnspecifiedLvalueContext(Target));
   }
 
   DeclUseList getClaimedVarUseSites() const override {
     return {BaseDeclRefExpr};
   }
 
   virtual const Stmt *getBaseStmt() const final { return Op; }
 
   virtual std::optional<FixItList> getFixits(const Strategy &S) const override;
 };
 
 // Represents expressions of the form `&DRE[any]` in the Unspecified Pointer
 // Context (see `isInUnspecifiedPointerContext`).
 // Note here `[]` is the built-in subscript operator.
 class UPCAddressofArraySubscriptGadget : public FixableGadget {
 private:
   static constexpr const char *const UPCAddressofArraySubscriptTag =
       "AddressofArraySubscriptUnderUPC";
   const UnaryOperator *Node; // the `&DRE[any]` node
 
 public:
   UPCAddressofArraySubscriptGadget(const MatchFinder::MatchResult &Result)
       : FixableGadget(Kind::ULCArraySubscript),
         Node(Result.Nodes.getNodeAs<UnaryOperator>(
             UPCAddressofArraySubscriptTag)) {
     assert(Node != nullptr && "Expecting a non-null matching result");
   }
 
   static bool classof(const Gadget *G) {

 template <typename NodeTy> struct CompareNode {
   bool operator()(const NodeTy *N1, const NodeTy *N2) const {
     return N1->getBeginLoc().getRawEncoding() <
            N2->getBeginLoc().getRawEncoding();
   }
 };
 
 struct WarningGadgetSets {
-  std::map<const VarDecl *, std::set<std::unique_ptr<WarningGadget>>,
+  std::map<const VarDecl *, std::set<const WarningGadget *>,
            // To keep keys sorted by their locations in the map so that the
            // order is deterministic:
            CompareNode<VarDecl>>
       byVar;
   // These Gadgets are not related to pointer variables (e. g. temporaries).
-  llvm::SmallVector<std::unique_ptr<WarningGadget>, 16> noVar;
+  llvm::SmallVector<const WarningGadget *, 16> noVar;
 };
 
 static WarningGadgetSets
-groupWarningGadgetsByVar(WarningGadgetList &&AllUnsafeOperations) {
+groupWarningGadgetsByVar(const WarningGadgetList &AllUnsafeOperations) {
   WarningGadgetSets result;
   // If some gadgets cover more than one
   // variable, they'll appear more than once in the map.
   for (auto &G : AllUnsafeOperations) {
     DeclUseList ClaimedVarUseSites = G->getClaimedVarUseSites();
 
     bool AssociatedWithVarDecl = false;
     for (const DeclRefExpr *DRE : ClaimedVarUseSites) {
       if (const auto *VD = dyn_cast<VarDecl>(DRE->getDecl())) {
-        result.byVar[VD].emplace(std::move(G));
+        result.byVar[VD].insert(G.get());
         AssociatedWithVarDecl = true;
       }
     }
 
     if (!AssociatedWithVarDecl) {
-      result.noVar.emplace_back(std::move(G));
+      result.noVar.push_back(G.get());
       continue;
     }
   }
   return result;
 }
 
 struct FixableGadgetSets {
-  std::map<const VarDecl *, std::set<std::unique_ptr<FixableGadget>>> byVar;
+  std::map<const VarDecl *, std::set<const FixableGadget *>> byVar;
 };
 
 static FixableGadgetSets
 groupFixablesByVar(FixableGadgetList &&AllFixableOperations) {
   FixableGadgetSets FixablesForUnsafeVars;
   for (auto &F : AllFixableOperations) {
     DeclUseList DREs = F->getClaimedVarUseSites();
 
     for (const DeclRefExpr *DRE : DREs) {
       if (const auto *VD = dyn_cast<VarDecl>(DRE->getDecl())) {
-        FixablesForUnsafeVars.byVar[VD].emplace(std::move(F));
+        FixablesForUnsafeVars.byVar[VD].insert(F.get());
       }
     }
   }
   return FixablesForUnsafeVars;
 }
 
 bool clang::internal::anyConflict(const SmallVectorImpl<FixItHint> &FixIts,
                                   const SourceManager &SM) {
if (!CurrHint ||
       // In case `Hint` overlaps the `CurrHint`, we found at least one
       // conflict:
       return true;
   }
   return false;
 }
 
 std::optional<FixItList>
+PointerAssignmentGadget::getFixits(const Strategy &S) const {
+  const auto *LeftVD = cast<VarDecl>(PtrLHS->getDecl());
+  const auto *RightVD = cast<VarDecl>(PtrRHS->getDecl());
+  switch (S.lookup(LeftVD)) {
+    case Strategy::Kind::Span:
+      if (S.lookup(RightVD) == Strategy::Kind::Span)
+        return FixItList{};
+      return std::nullopt;
+    case Strategy::Kind::Wontfix:
+      return std::nullopt;
+    case Strategy::Kind::Iterator:
+    case Strategy::Kind::Array:
+    case Strategy::Kind::Vector:
+      llvm_unreachable("unsupported strategies for FixableGadgets");
+  }
+  return std::nullopt;
+}
+
+
+std::optional<FixItList>
 ULCArraySubscriptGadget::getFixits(const Strategy &S) const {
   if (const auto *DRE =
           dyn_cast<DeclRefExpr>(Node->getBase()->IgnoreImpCasts()))
     if (const auto *VD = dyn_cast<VarDecl>(DRE->getDecl())) {
       switch (S.lookup(VD)) {
       case Strategy::Kind::Span: {
         // If the index has a negative constant value, we give up as no valid
         // fix-it can be generated:
UPCAddressofArraySubscriptGadget::getFixits(const Strategy &S) const {
   case Strategy::Kind::Vector:
     llvm_unreachable("unsupported strategies for FixableGadgets");
   }
   return std::nullopt; // something went wrong, no fix-it
 }
 
 // Return the text representation of the given `APInt Val`:
 static std::string getAPIntText(APInt Val) {
   SmallVector<char> Txt;
   Val.toString(Txt, 10, true);
   // APInt::toString does not add '\0' to the end of the string for us:
   Txt.push_back('\0');
   return Txt.data();
 }
 
 // Return the source location of the last character of the AST `Node`.
 template <typename NodeTy>
 static std::optional<SourceLocation>
return llvm::any_of(FixIts, [](const FixItHint &Hint) {
     auto Range = Hint.RemoveRange;
     if (Range.getBegin().isMacroID() || Range.getEnd().isMacroID())
       // If the range (or the first token) is (part of) a macro expansion:
       return true;
     return false;
   });
 }
 
+static bool impossibleToFixForVar(const FixableGadgetSets &FixablesForUnsafeVars,
+                                  const Strategy &S,
+                                  const VarDecl * Var) {
+  for (const auto &F : FixablesForUnsafeVars.byVar.find(Var)->second) {
+    std::optional<FixItList> Fixits = F->getFixits(S);
+    if (!Fixits) {
+      return true;
+    }
+  }
+  return false;
+}
+
 static std::map<const VarDecl *, FixItList>
 getFixIts(FixableGadgetSets &FixablesForUnsafeVars, const Strategy &S,
-          const DeclUseTracker &Tracker, const ASTContext &Ctx,
-          UnsafeBufferUsageHandler &Handler) {
+        UnsafeBufferUsageHandler &Handler,
+        const DefMapTy &VarGrpMap) {
   std::map<const VarDecl *, FixItList> FixItsForVariable;
   for (const auto &[VD, Fixables] : FixablesForUnsafeVars.byVar) {
+    const Strategy::Kind ReplacementTypeForVD = S.lookup(VD);
     FixItsForVariable[VD] =
-        fixVariable(VD, S.lookup(VD), Tracker, Ctx, Handler);
+        fixVariable(VD, ReplacementTypeForVD, Tracker, Ctx, Handler);
     // If we fail to produce Fix-It for the declaration we have to skip the
     // variable entirely.
     if (FixItsForVariable[VD].empty()) {
       FixItsForVariable.erase(VD);
       continue;
     }
     bool ImpossibleToFix = false;
     llvm::SmallVector<FixItHint, 16> FixItsForVD;
     for (const auto &F : Fixables) {
       std::optional<FixItList> Fixits = F->getFixits(S);
       if (!Fixits) {
         ImpossibleToFix = true;
         break;
       } else {
         const FixItList CorrectFixes = Fixits.value();
         FixItsForVD.insert(FixItsForVD.end(), CorrectFixes.begin(),
                            CorrectFixes.end());
       }
     }
-    if (ImpossibleToFix)
+
+    if (ImpossibleToFix) {
       FixItsForVariable.erase(VD);
-    else
-      FixItsForVariable[VD].insert(FixItsForVariable[VD].end(),
-                                   FixItsForVD.begin(), FixItsForVD.end());
-    // We conservatively discard fix-its of a variable if
-    // a fix-it overlaps with macros; or
-    // a fix-it conflicts with another one
+      continue;
+    }
+    
+    const auto VarGroupForVD = VarGrpMap.find(VD);
+    if (VarGroupForVD != VarGrpMap.end()) {
+      for (const VarDecl * V : VarGroupForVD->second) {
+        if (V == VD) {
+          continue;
+        }
+        if (impossibleToFixForVar(FixablesForUnsafeVars, S, V)) {
+          ImpossibleToFix = true;
+          break;
+        }
+      }
+
+      if (ImpossibleToFix) {
+        FixItsForVariable.erase(VD);
+        for (const VarDecl * V : VarGroupForVD->second) {
+          FixItsForVariable.erase(V);
+        }
+        continue;
+      }
+    }
+
+    // Fix-it shall not overlap with macros or/and templates:
     if (overlapWithMacro(FixItsForVariable[VD]) ||
         clang::internal::anyConflict(FixItsForVariable[VD],
                                      Ctx.getSourceManager())) {
       FixItsForVariable.erase(VD);
+      continue;
+    }
+  }
+  
+  for (auto VD : FixItsForVariable) {
+    const auto VarGroupForVD = VarGrpMap.find(VD.first);
+    const Strategy::Kind ReplacementTypeForVD = S.lookup(VD.first);
+    if (VarGroupForVD != VarGrpMap.end()) {
+      for (const VarDecl * Var : VarGroupForVD->second) {
+        if (Var == VD.first) {
+          continue;
+        }
+        
+        FixItList GroupFix;
+        if (FixItsForVariable.find(Var) == FixItsForVariable.end()) {
+          GroupFix = fixVariable(Var, ReplacementTypeForVD, Tracker,
+                                           Var->getASTContext(), Handler);
+        } else {
+          GroupFix = FixItsForVariable[Var];
+        }
+        
+        for (auto Fix : GroupFix) {
+          FixItsForVariable[VD.first].push_back(Fix);
+        }
+      }
     }
   }
   return FixItsForVariable;
 }
 
+
 static Strategy
 getNaiveStrategy(const llvm::SmallVectorImpl<const VarDecl *> &UnsafeVars) {
   Strategy S;
   for (const VarDecl *VD : UnsafeVars) {
     S.set(VD, Strategy::Kind::Span);
   }
   return S;
 }
 
 void clang::checkUnsafeBufferUsage(const Decl *D,
                                    UnsafeBufferUsageHandler &Handler,
                                    bool EmitSuggestions) {
   assert(D && D->getBody());
   WarningGadgetSets UnsafeOps;
-  FixableGadgetSets FixablesForUnsafeVars;
-  DeclUseTracker Tracker;
+  FixableGadgetSets FixablesForAllVars;
 
-  {
-    auto [FixableGadgets, WarningGadgets, TrackerRes] =
-      findGadgets(D, Handler, EmitSuggestions);
+  auto [FixableGadgets, WarningGadgets, Tracker] =
 
-    if (!EmitSuggestions) {
-      // Our job is very easy without suggestions. Just warn about
-      // every problematic operation and consider it done. No need to deal
-      // with fixable gadgets, no need to group operations by variable.
-      for (const auto &G : WarningGadgets) {
-        Handler.handleUnsafeOperation(G->getBaseStmt(),
-                                      /*IsRelatedToDecl=*/false);
-      }
 
-      // This return guarantees that most of the machine doesn't run when
-      // suggestions aren't requested.
-      assert(FixableGadgets.size() == 0 &&
-             "Fixable gadgets found but suggestions not requested!");
-      return;
-    }
 
-    UnsafeOps = groupWarningGadgetsByVar(std::move(WarningGadgets));
-    FixablesForUnsafeVars = groupFixablesByVar(std::move(FixableGadgets));
-    Tracker = std::move(TrackerRes);
-  }
+  FixablesForAllVars = groupFixablesByVar(std::move(FixableGadgets));
 
-  std::map<const VarDecl *, FixItList> FixItsForVariable;
+  std::map<const VarDecl *, FixItList> FixItsForVariableGroup;
+  DefMapTy VariableGroupsMap{};
 
   // Filter out non-local vars and vars with unclaimed DeclRefExpr-s.
-  for (auto it = FixablesForUnsafeVars.byVar.cbegin();
-       it != FixablesForUnsafeVars.byVar.cend();) {
+  for (auto it = FixablesForAllVars.byVar.cbegin();
+       it != FixablesForAllVars.byVar.cend();) {
     // FIXME: Support ParmVarDecl as well.
     if (!it->first->isLocalVarDecl() || Tracker.hasUnclaimedUses(it->first)) {
-      it = FixablesForUnsafeVars.byVar.erase(it);
+      it = FixablesForAllVars.byVar.erase(it);
     } else {
       ++it;
     }
   }
 
   llvm::SmallVector<const VarDecl *, 16> UnsafeVars;
-  for (const auto &[VD, ignore] : FixablesForUnsafeVars.byVar)
+  for (const auto &[VD, ignore] : FixablesForAllVars.byVar)
     UnsafeVars.push_back(VD);
   
+  // Fixpoint iteration for pointer assignments
+  using DepMapTy = DenseMap<const VarDecl *, std::set<const VarDecl *>>;
+  DepMapTy DependenciesMap{};
+  DepMapTy PtrAssignmentGraph{};
+    
+  for (auto it : FixablesForAllVars.byVar) {
+    for (const FixableGadget *fixable : it.second) {
+      std::optional<std::pair<const VarDecl *, const VarDecl *>> ImplPair =
+                                  fixable->getStrategyImplications();
+      if (ImplPair) {
+        std::pair<const VarDecl *, const VarDecl *> Impl = ImplPair.value();
+        PtrAssignmentGraph[Impl.first].insert(Impl.second);
+      }
+    }
+  }
+    
+  /*
+   The following code does a BFS traversal of the `PtrAssignmentGraph`
+   considering all unsafe vars as starting nodes and constructs an undirected
+   graph `DependenciesMap`. Constructing the `DependenciesMap` in this manner
+   elimiates all variables that are unreachable from any unsafe var. In other
+   words, this removes all dependencies that don't include any unsafe variable
+   and consequently don't need any fixit generation.
+   Note: A careful reader would observe that the code traverses
+   `PtrAssignmentGraph` using `CurrentVar` but adds edges between `Var` and
+   `Adj` and not between `CurrentVar` and `Adj`. Both approaches would
+   achieve the same result but the one used here dramatically cuts the
+   amount of hoops the second part of the algorithm needs to jump, given that
+   a lot of these connections become "direct". The reader is advised not to
+   imagine how the graph is transformed because of using `Var` instead of
+   `CurrentVar`. The reader can continue reading as if `CurrentVar` was used,
+   and think about why it's equivalent later.
+   */
+  std::set<const VarDecl *> VisitedVarsDirected{};
+  for (const auto &[Var, ignore] : UnsafeOps.byVar) {
+    if (VisitedVarsDirected.find(Var) == VisitedVarsDirected.end()) {
+  
+      std::queue<const VarDecl*> QueueDirected{};
+      QueueDirected.push(Var);
+      while(!QueueDirected.empty()) {
+        const VarDecl* CurrentVar = QueueDirected.front();
+        QueueDirected.pop();
+        VisitedVarsDirected.insert(CurrentVar);
+        auto AdjacentNodes = PtrAssignmentGraph[CurrentVar];
+        for (const VarDecl *Adj : AdjacentNodes) {
+          if (VisitedVarsDirected.find(Adj) == VisitedVarsDirected.end()) {
+            QueueDirected.push(Adj);
+          }
+          DependenciesMap[Var].insert(Adj);
+          DependenciesMap[Adj].insert(Var);
+        }
+      }
+    }
+  }
+  
+  // Group Connected Components for Unsafe Vars
+  // (Dependencies based on pointer assignments)
+  std::set<const VarDecl *> VisitedVars{};
+  for (const auto &[Var, ignore] : UnsafeOps.byVar) {
+    if (VisitedVars.find(Var) == VisitedVars.end()) {
+      std::vector<const VarDecl *> VarGroup{};
+  
+      std::queue<const VarDecl*> Queue{};
+      Queue.push(Var);
+      while(!Queue.empty()) {
+        const VarDecl* CurrentVar = Queue.front();
+        Queue.pop();
+        VisitedVars.insert(CurrentVar);
+        VarGroup.push_back(CurrentVar);
+        auto AdjacentNodes = DependenciesMap[CurrentVar];
+        for (const VarDecl *Adj : AdjacentNodes) {
+          if (VisitedVars.find(Adj) == VisitedVars.end()) {
+            Queue.push(Adj);
+          }
+        }
+      }
+      for (const VarDecl * V : VarGroup) {
+        if (UnsafeOps.byVar.find(V) != UnsafeOps.byVar.end()) {
+          VariableGroupsMap[V] = VarGroup;
+        }
+      }
+    }
+  }
+
   Strategy NaiveStrategy = getNaiveStrategy(UnsafeVars);
-  FixItsForVariable = getFixIts(FixablesForUnsafeVars, NaiveStrategy, Tracker,
-                                D->getASTContext(), Handler);
+  FixItsForVariableGroup = getFixIts(FixablesForAllVars, NaiveStrategy, Tracker,
+                                D->getASTContext(), Handler, VariableGroupsMap);
 
   // FIXME Detect overlapping FixIts.
 
   for (const auto &G : UnsafeOps.noVar) {
     Handler.handleUnsafeOperation(G->getBaseStmt(), /*IsRelatedToDecl=*/false);
   }
 
   for (const auto &[VD, WarningGadgets] : UnsafeOps.byVar) {
-    auto FixItsIt = FixItsForVariable.find(VD);
-    Handler.handleFixableVariable(VD, FixItsIt != FixItsForVariable.end()
-                                          ? std::move(FixItsIt->second)
-                                          : FixItList{});
+    auto FixItsIt = FixItsForVariableGroup.find(VD);
+    Handler.handleUnsafeVariableGroup(VD, VariableGroupsMap,
+                                      FixItsIt != FixItsForVariableGroup.end()
     for (const auto &G : WarningGadgets) {
       Handler.handleUnsafeOperation(G->getBaseStmt(), /*IsRelatedToDecl=*/true);
     }
   }
 }

clang/lib/Sema/AnalysisBasedWarnings.cpp

void handleUnsafeOperation(const Stmt *Operation,
     } else {
       S.Diag(Loc, diag::warn_unsafe_buffer_operation) << MsgParam << Range;
       if (SuggestSuggestions) {
         S.Diag(Loc, diag::note_safe_buffer_usage_suggestions_disabled);
       }
     }
   }
 
-  // FIXME: rename to handleUnsafeVariable
-  void handleFixableVariable(const VarDecl *Variable,
+  void handleUnsafeVariableGroup(const VarDecl *Variable,
+                                 const DefMapTy &VarGrpMap,
                              FixItList &&Fixes) override {
     assert(!SuggestSuggestions &&
            "Unsafe buffer usage fixits displayed without suggestions!");
     S.Diag(Variable->getLocation(), diag::warn_unsafe_buffer_variable)
         << Variable << (Variable->getType()->isPointerType() ? 0 : 1)
         << Variable->getSourceRange();
     if (!Fixes.empty()) {
-      unsigned FixItStrategy = 0; // For now we only has 'std::span' strategy
+      const auto VarGroupForVD = VarGrpMap.find(Variable)->second;
+      unsigned FixItStrategy = 0; // For now we only have 'std::span' strategy
       const auto &FD = S.Diag(Variable->getLocation(),
-                              diag::note_unsafe_buffer_variable_fixit);
+                              diag::note_unsafe_buffer_variable_fixit_group);
+      
+      FD << Variable << FixItStrategy;
+      std::string AllVars = "";
+      if (VarGroupForVD.size() > 1) {
+        if (VarGroupForVD.size() == 2) {
+          if (VarGroupForVD[0] == Variable) {
+            AllVars.append("'" + VarGroupForVD[1]->getName().str() + "'");
+          } else {
+            AllVars.append("'" + VarGroupForVD[0]->getName().str() + "'");
+          }
+        } else {
+          bool first = false;
+          if (VarGroupForVD.size() == 3) {
+            for (const VarDecl * V : VarGroupForVD) {
+              if (V == Variable) {
+                continue;
+              }
+              if (!first) {
+                first = true;
+                AllVars.append("'" + V->getName().str() + "'" + " and ");
+              } else {
+                AllVars.append("'" + V->getName().str() + "'");
+              }
+            }
+          } else {
+            for (const VarDecl * V : VarGroupForVD) {
+              if (V == Variable) {
+                continue;
+              }
+              if (VarGroupForVD.back() != V) {
+                AllVars.append("'" + V->getName().str() + "'" + ", ");
+              } else {
+                AllVars.append("and '" + V->getName().str() + "'");
+              }
+            }
+          }
+        }
+        FD << AllVars << 1;
+      } else {
+        FD << "" << 0;
+      }
 
-      FD << Variable->getName() << FixItStrategy;
       for (const auto &F : Fixes)
         FD << F;
     }
   }
 
   bool isSafeBufferOptOut(const SourceLocation &Loc) const override {
     return S.PP.isSafeBufferOptOut(S.getSourceManager(), Loc);
   }
 };
 } // namespace
 
 //===----------------------------------------------------------------------===//
 // AnalysisBasedWarnings - Worker object used by Sema to execute analysis-based
 //  warnings on a function, method, or block.
 //===----------------------------------------------------------------------===//
 
 sema::AnalysisBasedWarnings::Policy::Policy() {
   enableCheckFallThrough = 1;
   enableCheckUnreachable = 0;
   enableThreadSafetyAnalysis = 0;
   enableConsumedAnalysis = 0;
 }
 
 /// InterProceduralData aims to be a storage of whatever data should be passed
 /// between analyses of different functions.
 ///
 /// At the moment, its primary goal is to make the information gathered during
 /// the analysis of the blocks available during the analysis of the enclosing
 /// function.  This is important due to the fact that blocks are analyzed before
 /// the enclosed function is even parsed fully, so it is not viable to access
 /// anything in the outer scope while analyzing the block.  On the other hand,
 /// re-building CFG for blocks and re-analyzing them when we do have all the
 /// information (i.e. during the analysis of the enclosing function) seems to be
 /// ill-designed.
 class sema::AnalysisBasedWarnings::InterProceduralData {
 public:
   // It is important to analyze blocks within functions because it's a very
   // common pattern to capture completion handler parameters by blocks.
   CalledOnceInterProceduralData CalledOnceData;
 };
 
 static unsigned isEnabled(DiagnosticsEngine &D, unsigned diag) {
   return (unsigned)!D.isIgnored(diag, SourceLocation());
 }
 
 sema::AnalysisBasedWarnings::AnalysisBasedWarnings(Sema &s)

clang/test/SemaCXX/warn-unsafe-buffer-usage-multi-decl-fixits-test.cpp

+// RUN: %clang_cc1 -std=c++20 -Wunsafe-buffer-usage -fdiagnostics-parseable-fixits -fsafe-buffer-usage-suggestions %s 2>&1 | FileCheck %s
+
+void foo1a() {
+  int *r = new int[7];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> r"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:22-[[@LINE-3]]:22}:", 7}"
+  int *p = new int[4];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> p"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:22-[[@LINE-3]]:22}:", 4}"
+  p = r;
+  int tmp = p[9];
+  int *q;
+  // CHECK-NOT: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> q"
+  q = r;
+}
+
+void foo1b() {
+  int *r = new int[7];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> r"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:22-[[@LINE-3]]:22}:", 7}"
+  int *p = new int[4];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> p"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:22-[[@LINE-3]]:22}:", 4}"
+  p = r;
+  int tmp = p[9];
+  int *q = new int[4];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> q"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:22-[[@LINE-3]]:22}:", 4}"
+  q = r;
+  tmp = q[9];
+}
+
+void foo1c() {
+  int *r = new int[7];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> r"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:22-[[@LINE-3]]:22}:", 7}"
+  int *p = new int[4];
+  // CHECK-NOT: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> p"
+  p = r;
+  int tmp = r[9];
+  int *q;
+  // CHECK-NOT: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> q"
+  q = r;
+  tmp = q[9];
+}
+
+void foo2a() {
+  int *r = new int[7];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> r"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:22-[[@LINE-3]]:22}:", 7}"
+  int *p = new int[5];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> p"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:22-[[@LINE-3]]:22}:", 5}"
+  int *q = new int[4];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> q"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:22-[[@LINE-3]]:22}:", 4}"
+  p = q;
+  int tmp = p[8];
+  q = r;
+}
+
+void foo2b() {
+  int *r = new int[7];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> r"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:22-[[@LINE-3]]:22}:", 7}"
+  int *p = new int[5];
+  // CHECK-NOT: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> p"
+  // CHECK-NOT: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-NOT: fix-it:"{{.*}}":{[[@LINE-3]]:22-[[@LINE-3]]:22}:", 5}"
+  int *q = new int[4];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> q"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:22-[[@LINE-3]]:22}:", 4}"
+  p = q;
+  int tmp = q[8];
+  q = r;
+}
+
+void foo2c() {
+  int *r = new int[7];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> r"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:22-[[@LINE-3]]:22}:", 7}"
+  int *p = new int[5];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> p"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:22-[[@LINE-3]]:22}:", 5}"
+  int *q = new int[4];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> q"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:22-[[@LINE-3]]:22}:", 4}"
+  p = q;
+  int tmp = p[8];
+  q = r;
+  tmp = q[8];
+}
+
+void foo3a() {
+  int *r = new int[7];
+  // CHECK-NOT: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> r"
+  int *p = new int[5];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> p"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:22-[[@LINE-3]]:22}:", 5}"
+  int *q = new int[4];
+  // CHECK-NOT: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> q"
+  q = p;
+  int tmp = p[8];
+  q = r;
+}
+
+void foo3b() {
+  int *r = new int[10];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> r"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:23-[[@LINE-3]]:23}:", 10}"
+  int *p = new int[10];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> p"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:23-[[@LINE-3]]:23}:", 10}"
+  int *q = new int[10];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> q"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:23-[[@LINE-3]]:23}:", 10}"
+  q = p;
+  int tmp = q[8];
+  q = r;
+}

clang/test/SemaCXX/warn-unsafe-buffer-usage-multi-decl-uuc-fixits.cpp

+// RUN: %clang_cc1 -std=c++20 -Wunsafe-buffer-usage \
+// RUN:            -fsafe-buffer-usage-suggestions \
+// RUN:            -fdiagnostics-parseable-fixits %s 2>&1 | FileCheck %s
+
+void bar(int * param) {}
+
+void foo1a() {
+  int *r = new int[7];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> r"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:22-[[@LINE-3]]:22}:", 7}"
+  int *p = new int[4];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> p"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:22-[[@LINE-3]]:22}:", 4}"
+  p = r;
+  int tmp = p[9];
+  int *q;
+  q = r;
+}
+
+void uuc_if_body() {
+  int *r = new int[7];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> r"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:22-[[@LINE-3]]:22}:", 7}"
+  int *p = new int[4];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> p"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:22-[[@LINE-3]]:22}:", 4}"
+  if (true)
+    p = r;
+  p[5] = 4;
+}
+
+void uuc_if_body1(bool flag) {
+  int *r = new int[7];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> r"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:22-[[@LINE-3]]:22}:", 7}"
+  int *p = new int[4];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> p"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:22-[[@LINE-3]]:22}:", 4}"
+  if (flag) {
+    p = r;
+  }
+  p[5] = 4;
+}
+
+void uuc_if_cond_no_unsafe_op() {
+  int *r = new int[7];
+  int *p = new int[4];
+  if ((p = r)) {
+    int x = 0;
+  }
+}
+
+void uuc_if_cond_unsafe_op() {
+  int *r = new int[7];
+  int *p = new int[4];  //expected-warning{{'p' is an unsafe pointer used for buffer access}}
+  if ((p = r)) {
+    p[3] = 2;  // expected-note{{used in buffer access here}}
+  }
+}
+
+void uuc_if_cond_unsafe_op1() {
+  int *r = new int[7];  // expected-warning{{'r' is an unsafe pointer used for buffer access}}
+  int *p = new int[4];
+  if ((p = r)) {
+    r[3] = 2;  // expected-note{{used in buffer access here}}
+  }
+}
+
+void uuc_if_cond_unsafe_op2() {
+  int *r = new int[7];  // expected-warning{{'r' is an unsafe pointer used for buffer access}}
+  int *p = new int[4];  // expected-warning{{'p' is an unsafe pointer used for buffer access}}
+  if ((p = r)) {
+    r[3] = 2;  // expected-note{{used in buffer access here}}
+  }
+  p[4] = 6;  // expected-note{{used in buffer access here}}
+}
+
+void uuc_call1() {
+  int *w = new int[4];  // expected-warning{{'w' is an unsafe pointer used for buffer access}}
+  int *y = new int[4];
+  bar(w = y);
+  w[5] = 0;  // expected-note{{used in buffer access here}}
+}

clang/test/SemaCXX/warn-unsafe-buffer-usage-multi-decl-uuc.cpp

+// RUN: %clang_cc1 -std=c++20 -Wunsafe-buffer-usage -fsafe-buffer-usage-suggestions -verify %s
+void bar(int * param) {}
+
+void foo1a() {
+  int *r = new int[7];
+  int *p = new int[4];  // expected-warning{{'p' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'p' to 'std::span' to preserve bounds information, and change 'r' to 'std::span' to propagate bounds information between them$}}}}
+  p = r;
+  int tmp = p[9];  // expected-note{{used in buffer access here}}
+  int *q;
+  q = r;
+}
+
+void uuc_if_body() {
+  int *r = new int[7];
+  int *p = new int[4];  // expected-warning{{'p' is an unsafe pointer used for buffer access}} // expected-note-re{{{{^change type of 'p' to 'std::span' to preserve bounds information, and change 'r' to 'std::span' to propagate bounds information between them$}}}}
+  if (true)
+    p = r;
+  p[5] = 4;  // expected-note{{used in buffer access here}}
+}
+
+void uuc_if_body1(bool flag) {
+  int *r = new int[7];
+  int *p = new int[4];  // expected-warning{{'p' is an unsafe pointer used for buffer access}} // expected-note-re{{{{^change type of 'p' to 'std::span' to preserve bounds information, and change 'r' to 'std::span' to propagate bounds information between them$}}}}
+  if (flag) {
+    p = r;
+  }
+  p[5] = 4;  // expected-note{{used in buffer access here}}
+}
+
+void uuc_if_body2(bool flag) {
+  int *r = new int[7];
+  int *p = new int[4];  // expected-warning{{'p' is an unsafe pointer used for buffer access}} // expected-note-re{{{{^change type of 'p' to 'std::span' to preserve bounds information, and change 'r' to 'std::span' to propagate bounds information between them$}}}}
+  if (flag) {
+  } else {
+    p = r;
+  }
+
+  p[5] = 4;  // expected-note{{used in buffer access here}}
+}
+
+void uuc_if_cond_no_unsafe_op() {
+  int *r = new int[7];
+  int *p = new int[4];
+  if ((p = r)) {
+    int x = 0;
+  }
+}
+
+void uuc_if_cond_no_unsafe_op1() {
+  int *r = new int[7];
+  int *p = new int[4];
+  if (true) {
+    int x = 0;
+  } else if ((p = r))
+    int y = 10;
+}
+
+void uuc_if_cond_unsafe_op() {
+  int *r = new int[7];
+  int *p = new int[4];  //expected-warning{{'p' is an unsafe pointer used for buffer access}}
+  if ((p = r)) {
+    p[3] = 2;  // expected-note{{used in buffer access here}}
+  }
+}
+
+void uuc_if_cond_unsafe_op1() {
+  int *r = new int[7];  // expected-warning{{'r' is an unsafe pointer used for buffer access}}
+  int *p = new int[4];
+  if ((p = r)) {
+    r[3] = 2;  // expected-note{{used in buffer access here}}
+  }
+}
+
+void uuc_if_cond_unsafe_op2() {
+  int *r = new int[7];  // expected-warning{{'r' is an unsafe pointer used for buffer access}}
+  int *p = new int[4];  // expected-warning{{'p' is an unsafe pointer used for buffer access}}
+  if ((p = r)) {
+    r[3] = 2;  // expected-note{{used in buffer access here}}
+  }
+  p[4] = 6;  // expected-note{{used in buffer access here}}
+}
+
+void uuc_call1() {
+  int *w = new int[4];  // expected-warning{{'w' is an unsafe pointer used for buffer access}}
+  int *y = new int[4];
+  bar(w = y);
+  w[5] = 0;  // expected-note{{used in buffer access here}}
+}

clang/test/SemaCXX/warn-unsafe-buffer-usage-multi-decl-warnings.cpp

+// RUN: %clang_cc1 -std=c++20 -Wunsafe-buffer-usage -fsafe-buffer-usage-suggestions -verify %s
+
+namespace std {
+  class type_info { };
+}
+
+void local_assign_both_span() {
+  int tmp;
+  int* p = new int[10]; // expected-warning{{'p' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'p' to 'std::span' to preserve bounds information, and change 'q' to 'std::span' to propagate bounds information between them$}}}}
+  tmp = p[4];  // expected-note{{used in buffer access here}}
+
+  int* q = new int[10];  // expected-warning{{'q' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'q' to 'std::span' to preserve bounds information, and change 'p' to 'std::span' to propagate bounds information between them$}}}}
+  tmp = q[4];  // expected-note{{used in buffer access here}}
+
+  q = p;
+}
+
+void local_assign_rhs_span() {
+  int tmp;
+  int* p = new int[10];
+  int* q = new int[10];  // expected-warning{{'q' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'q' to 'std::span' to preserve bounds information$}}}}
+  tmp = q[4];  // expected-note{{used in buffer access here}}
+  p = q;
+}
+
+void local_assign_no_span() {
+  int tmp;
+  int* p = new int[10];
+  int* q = new int[10];
+  p = q;
+}
+
+void local_assign_lhs_span() {
+  int tmp;
+  int* p = new int[10];  // expected-warning{{'p' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'p' to 'std::span' to preserve bounds information, and change 'q' to 'std::span' to propagate bounds information between them$}}}}
+  tmp = p[4];  // expected-note{{used in buffer access here}}
+  int* q = new int[10];
+
+  p = q;
+}
+
+
+// FIXME: Support initializations at declarations.
+void lhs_span_multi_assign() {
+  int *a = new int[2];
+  int *b = a;
+  int *c = b;
+  int *d = c;  // expected-warning{{'d' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'd' to 'std::span' to preserve bounds information$}}}}
+  int tmp = d[2];  // expected-note{{used in buffer access here}}
+}
+
+void rhs_span() {
+  int *x = new int[3];
+  int *y;  // expected-warning{{'y' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'y' to 'std::span' to preserve bounds information$}}}}
+  y[5] = 10;  // expected-note{{used in buffer access here}}
+
+  x = y;
+}
+
+void rhs_span1() {
+  int *q = new int[12];
+  int *p = q;  // expected-warning{{'p' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'p' to 'std::span' to preserve bounds information$}}}}
+  p[5] = 10;  // expected-note{{used in buffer access here}}
+  int *r = q;  // expected-warning{{'r' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'r' to 'std::span' to preserve bounds information$}}}}
+  r[10] = 5;  // expected-note{{used in buffer access here}}
+}
+
+void rhs_span2() {
+  int *q = new int[6];
+  int *p = q;  // expected-warning{{'p' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'p' to 'std::span' to preserve bounds information$}}}}
+  p[5] = 10;  // expected-note{{used in buffer access here}}
+  int *r = q;
+}
+
+void test_grouping() {
+  int *z = new int[8];
+  int tmp;
+  int *y = new int[10];  // expected-warning{{'y' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'y' to 'std::span' to preserve bounds information$}}}}
+  tmp = y[5]; // expected-note{{used in buffer access here}}
+
+  int *x = new int[10];
+  x = y;
+
+  int *w = z;
+}
+
+void test_grouping1() {
+  int tmp;
+  int *y = new int[10];  // expected-warning{{'y' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'y' to 'std::span' to preserve bounds information$}}}}
+  tmp = y[5];  // expected-note{{used in buffer access here}}
+  int *x = new int[10];
+  x = y;
+
+  int *w = new int[10];  // expected-warning{{'w' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'w' to 'std::span' to preserve bounds information$}}}}
+  tmp = w[5];  // expected-note{{used in buffer access here}}
+  int *z = new int[10];
+  z = w;
+}
+
+void foo1a() {
+  int *r = new int[7];
+  int *p = new int[4];  // expected-warning{{'p' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'p' to 'std::span' to preserve bounds information, and change 'r' to 'std::span' to propagate bounds information between them$}}}}
+  p = r;
+  int tmp = p[9];  // expected-note{{used in buffer access here}}
+  int *q;
+  q = r;
+}
+
+void foo1b() {
+  int *r = new int[7];
+  int *p = new int[4];  // expected-warning{{'p' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'p' to 'std::span' to preserve bounds information, and change 'r' and 'q' to 'std::span' to propagate bounds information between them$}}}}
+  p = r;
+  int tmp = p[9];  // expected-note{{used in buffer access here}}
+  int *q;  // expected-warning{{'q' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'q' to 'std::span' to preserve bounds information, and change 'p' and 'r' to 'std::span' to propagate bounds information between them$}}}}
+  q = r;
+  tmp = q[9];  // expected-note{{used in buffer access here}}
+}
+
+void foo1c() {
+  int *r = new int[7];  // expected-warning{{'r' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'r' to 'std::span' to preserve bounds information, and change 'q' to 'std::span' to propagate bounds information between them$}}}}
+  int *p = new int[4];
+  p = r;
+  int tmp = r[9];  // expected-note{{used in buffer access here}}
+  int *q;  // expected-warning{{'q' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'q' to 'std::span' to preserve bounds information, and change 'r' to 'std::span' to propagate bounds information between them$}}}}
+  q = r;
+  tmp = q[9];  // expected-note{{used in buffer access here}}
+}
+
+void foo2a() {
+  int *r = new int[7];
+  int *p = new int[5];  // expected-warning{{'p' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'p' to 'std::span' to preserve bounds information, and change 'r' and 'q' to 'std::span' to propagate bounds information between them$}}}}
+  int *q = new int[4];
+  p = q;
+  int tmp = p[8];  // expected-note{{used in buffer access here}}
+  q = r;
+}
+
+void foo2b() {
+  int *r = new int[7];
+  int *p = new int[5];
+  int *q = new int[4];  // expected-warning{{'q' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'q' to 'std::span' to preserve bounds information, and change 'r' to 'std::span' to propagate bounds information between them$}}}}
+  p = q;
+  int tmp = q[8];  // expected-note{{used in buffer access here}}
+  q = r;
+}
+
+void foo2c() {
+  int *r = new int[7];
+  int *p = new int[5];  // expected-warning{{'p' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'p' to 'std::span' to preserve bounds information, and change 'r' and 'q' to 'std::span' to propagate bounds information between them$}}}}
+  int *q = new int[4];  // expected-warning{{'q' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'q' to 'std::span' to preserve bounds information, and change 'p' and 'r' to 'std::span' to propagate bounds information between them$}}}}
+  p = q;
+  int tmp = p[8];  // expected-note{{used in buffer access here}}
+  q = r;
+  tmp = q[8];  // expected-note{{used in buffer access here}}
+}
+
+void foo3a() {
+  int *r = new int[7];
+  int *p = new int[5];  // expected-warning{{'p' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'p' to 'std::span' to preserve bounds information$}}}}
+  int *q = new int[4];
+  q = p;
+  int tmp = p[8];  // expected-note{{used in buffer access here}}
+  q = r;
+}
+
+void foo3b() {
+  int *r = new int[7];
+  int *p = new int[5];
+  int *q = new int[4];  // expected-warning{{'q' is an unsafe pointer used for buffer access}} //expected-note-re{{{{^change type of 'q' to 'std::span' to preserve bounds information, and change 'r' and 'p' to 'std::span' to propagate bounds information between them$}}}}
+  q = p;
+  int tmp = q[8];  // expected-note{{used in buffer access here}}
+  q = r;
+}
+
+void test_crash() {
+  int *r = new int[8];
+  int *q = r;
+  int *p;  // expected-warning{{'p' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'p' to 'std::span' to preserve bounds information, and change 'q' to 'std::span' to propagate bounds information between them$}}}}
+  p = q;
+  int tmp = p[9];  // expected-note{{used in buffer access here}}
+}
+
+void foo_uuc() {
+  int *ptr;
+  int *local;  // expected-warning{{'local' is an unsafe pointer used for buffer access}}
+  local = ptr;
+  local++;  // expected-note{{used in pointer arithmetic here}}
+
+  (local = ptr) += 5;  // expected-warning{{unsafe pointer arithmetic}}
+}
+
+void check_rhs_fix() {
+  int *r = new int[8];  // expected-warning{{'r' is an unsafe pointer used for buffer access}}  // expected-note-re{{{{^change type of 'r' to 'std::span' to preserve bounds information, and change 'x' to 'std::span' to propagate bounds information between them$}}}}
+  int *x;
+  r[7] = 9;  // expected-note{{used in buffer access here}}
+  r = x;
+}
+
+void check_rhs_nofix() {
+  int *r = new int[8];  // expected-warning{{'r' is an unsafe pointer used for buffer access}}
+  int *x;  // expected-warning{{'x' is an unsafe pointer used for buffer access}}
+  r[7] = 9;  // expected-note{{used in buffer access here}}
+  r = x;
+  x++;  // expected-note{{used in pointer arithmetic here}}
+}
+
+void check_rhs_nofix_order() {
+  int *r = new int[8];  // expected-warning{{'r' is an unsafe pointer used for buffer access}}
+  int *x;  // expected-warning{{'x' is an unsafe pointer used for buffer access}}
+  x++;  // expected-note{{used in pointer arithmetic here}}
+  r[7] = 9;  // expected-note{{used in buffer access here}}
+  r = x;
+}
+
+void check_rhs_nofix_order1() {
+  int *r = new int[8];  // expected-warning{{'r' is an unsafe pointer used for buffer access}}
+  r[7] = 9;  // expected-note{{used in buffer access here}}
+  int *x;  // expected-warning{{'x' is an unsafe pointer used for buffer access}}
+  x++;  // expected-note{{used in pointer arithmetic here}}
+  r = x;
+}
+
+void check_rhs_nofix_order2() {
+  int *x;  // expected-warning{{'x' is an unsafe pointer used for buffer access}}
+  int *r = new int[8];  // expected-warning{{'r' is an unsafe pointer used for buffer access}}
+  r[7] = 9;  // expected-note{{used in buffer access here}}
+  x++;  // expected-note{{used in pointer arithmetic here}}
+  r = x;
+}
+
+void check_rhs_nofix_order3() {
+  int *x;  // expected-warning{{'x' is an unsafe pointer used for buffer access}}
+  int *r = new int[8];  // expected-warning{{'r' is an unsafe pointer used for buffer access}}
+  r = x;
+  r[7] = 9;  // expected-note{{used in buffer access here}}
+  x++;  // expected-note{{used in pointer arithmetic here}}
+}
+
+void check_rhs_nofix_order4() {
+  int *x;  // expected-warning{{'x' is an unsafe pointer used for buffer access}}
+  int *r = new int[8];  // expected-warning{{'r' is an unsafe pointer used for buffer access}}
+  r[7] = 9;  // expected-note{{used in buffer access here}}
+  r = x;
+  x++;  // expected-note{{used in pointer arithmetic here}}
+}
+
+void no_unhandled_lhs() {
+  int *r = new int[8];  // expected-warning{{'r' is an unsafe pointer used for buffer access}}  // expected-note-re{{{{^change type of 'r' to 'std::span' to preserve bounds information, and change 'x' to 'std::span' to propagate bounds information between them$}}}}
+  r[7] = 9;  // expected-note{{used in buffer access here}}
+  int *x;
+  r = x;
+}
+
+const std::type_info unhandled_lhs() {
+  int *r = new int[8];  // expected-warning{{'r' is an unsafe pointer used for buffer access}}
+  r[7] = 9;  // expected-note{{used in buffer access here}}
+  int *x;
+  r = x;
+  return typeid(*r);
+}
+
+const std::type_info unhandled_rhs() {
+  int *r = new int[8];  // expected-warning{{'r' is an unsafe pointer used for buffer access}}
+  r[7] = 9;  // expected-note{{used in buffer access here}}
+  int *x;
+  r = x;
+  return typeid(*x);
+}
+
+void test_negative_index() {
+  int *x = new int[4];  // expected-warning{{'x' is an unsafe pointer used for buffer access}}
+  int *p;  // expected-warning{{'p' is an unsafe pointer used for buffer access}}
+  p = &x[1];  // expected-note{{used in buffer access here}}
+  p[-1] = 9;  // expected-note{{used in buffer access here}}
+}
+
+void test_unfixable() {
+  int *r = new int[8];  // expected-warning{{'r' is an unsafe pointer used for buffer access}}
+  int *x;  // expected-warning{{'x' is an unsafe pointer used for buffer access}}
+  x[7] = 9;  // expected-note{{used in buffer access here}}
+  r = x;
+  r++;  // expected-note{{used in pointer arithmetic here}}
+}
+
+void test_cyclic_deps() {
+  int *r = new int[10];  // expected-warning{{'r' is an unsafe pointer used for buffer access}}  expected-note-re{{{{^change type of 'r' to 'std::span' to preserve bounds information, and change 'q' and 'p' to 'std::span' to propagate bounds information between them$}}}}
+  int *q;
+  q = r;
+  int *p;
+  p = q;
+  r[3] = 9; // expected-note{{used in buffer access here}}
+  r = p;
+}
+
+void test_cyclic_deps_a() {
+  int *r = new int[10];  // expected-warning{{'r' is an unsafe pointer used for buffer access}}
+  int *q;
+  q = r;
+  int *p;  // expected-warning{{'p' is an unsafe pointer used for buffer access}}
+  p = q;
+  r[3] = 9; // expected-note{{used in buffer access here}}
+  r = p;
+  p++;  // expected-note{{used in pointer arithmetic here}}
+}
+
+void test_cyclic_deps1() {
+  int *r = new int[10];
+  int *q;
+  q = r;
+  int *p;  // expected-warning{{'p' is an unsafe pointer used for buffer access}}  expected-note-re{{{{^change type of 'p' to 'std::span' to preserve bounds information, and change 'r' and 'q' to 'std::span' to propagate bounds information between them$}}}}
+  p = q;
+  p[3] = 9; // expected-note{{used in buffer access here}}
+  r = p;
+}
+
+void test_cyclic_deps2() {
+  int *r = new int[10];
+  int *q;  // expected-warning{{'q' is an unsafe pointer used for buffer access}}  expected-note-re{{{{^change type of 'q' to 'std::span' to preserve bounds information, and change 'r' and 'p' to 'std::span' to propagate bounds information between them$}}}}
+  q = r;
+  int *p;
+  p = q;
+  q[3] = 9; // expected-note{{used in buffer access here}}
+  r = p;
+}
+
+void test_cyclic_deps3() {
+  int *r = new int[10];
+  int *q;  // expected-warning{{'q' is an unsafe pointer used for buffer access}}  expected-note-re{{{{^change type of 'q' to 'std::span' to preserve bounds information, and change 'r' and 'p' to 'std::span' to propagate bounds information between them$}}}}
+  q = r;
+  int *p;  // expected-warning{{'p' is an unsafe pointer used for buffer access}}  expected-note-re{{{{^change type of 'p' to 'std::span' to preserve bounds information, and change 'q' and 'r' to 'std::span' to propagate bounds information between them$}}}}
+  p = q;
+  q[3] = 9; // expected-note{{used in buffer access here}}
+  p[4] = 7; // expected-note{{used in buffer access here}}
+  r = p;
+}
+
+void test_cyclic_deps4() {
+  int *r = new int[10];  // expected-warning{{'r' is an unsafe pointer used for buffer access}}  expected-note-re{{{{^change type of 'r' to 'std::span' to preserve bounds information, and change 'q' and 'p' to 'std::span' to propagate bounds information between them$}}}}
+  int *q;  // expected-warning{{'q' is an unsafe pointer used for buffer access}}  expected-note-re{{{{^change type of 'q' to 'std::span' to preserve bounds information, and change 'r' and 'p' to 'std::span' to propagate bounds information between them$}}}}
+  q = r;
+  int *p;  // expected-warning{{'p' is an unsafe pointer used for buffer access}}  expected-note-re{{{{^change type of 'p' to 'std::span' to preserve bounds information, and change 'r' and 'q' to 'std::span' to propagate bounds information between them$}}}}
+  p = q;
+  q[3] = 9; // expected-note{{used in buffer access here}}
+  p[4] = 7; // expected-note{{used in buffer access here}}
+  r[1] = 5; // expected-note{{used in buffer access here}}
+  r = p;
+}