[-Wunsafe-buffer-usage] Group variables associated by pointer assignments

[t-rasmud]

Summary

• For assignments involving pointer types, if the machine decides that the LHS pointer has to be fixed to std::span, this patch introduces the same fixit for the RHS pointer.
• It groups all such pointer variables (that transitively depend on the unsafe pointer) and suggests that they all be fixed atomically to correctly propagate bounds information among them.
• TODOs: UUC, variables claimed by multiple gadgets (ex: int *p = q), handle parameters.

[NoQ]

Brilliant!!

I guess we can abandon D143133 now in favor of this patch?

Before I jump to nitpicking, I think we should sync up on how the end result should look like, in terms of warnings and notes that we display. This may affect the overall algorithm, like require us to gather more data.

clang/test/SemaCXX/warn-unsafe-buffer-usage-multi-decl-warnings.cpp

5–14

We probably want to build some finer narrative here 🤔 In this case p and q are both independently unsafe and there's a one-way connection between them. Would it make sense to emit just one warning for both of them? I suspect it also makes sense to leave a note at q = p with a text like "note: bounds information needs to propagate from p to q here" (I've no idea if it'll scale to more than 2 variables, or how much more information we'll need to gather).

57–63

In this case we definitely want to spanify q, for two independent reasons. We need to figure out how to tell that to the user though 🤔

[ziqingluo-90]

I have one general question: suppose we have two variables A and B in the same group. So fix-its emitted for A includes fix-its for B and vice verse, right? Does it mean that we cannot apply all fix-its at once from the command line?

clang/include/clang/Analysis/Analyses/UnsafeBufferUsage.h

42

It could be nice to have a document for this function since it is in the header.

clang/lib/Analysis/UnsafeBufferUsage.cpp

277

So every Fixable needs to implement this. I would love to see a document for this function.

587

DeclPtrAtLeft is not used.

1828

It seems like we do not care about the direction of edges in the graph, maybe we should call it UndirectedGraph?

clang/lib/Sema/AnalysisBasedWarnings.cpp

2267

would it be better if to make VariableGroups a map from VarDecls to groups ?

[ziqingluo-90]

clang/lib/Sema/AnalysisBasedWarnings.cpp

2250

These note messages are nice. Maybe we can have some tests for them. It will also help telling whether variables are grouped correctly.

clang/test/SemaCXX/warn-unsafe-buffer-usage-multi-decl-fixits-test.cpp

139

Could we have an example where there is a cyclic dependency? Such as p = q; q = r; r = p;.

[t-rasmud]

Adds tests that were accidentally deleted in the last diff.

[t-rasmud]

• Handle the case where implied variables don't have a fixit strategy
• TODO: address feedback for the previous diff

[t-rasmud]

• Address review comments.

[t-rasmud]

clang/lib/Analysis/UnsafeBufferUsage.cpp

1828

I changed it to PtrAssignmentGraph which seems (atleast to me) to give more context. It is still a directed graph because Deps[0] represents the LHS pointer and Deps[1] the RHS pointer. Hopefully the new documentation on getStrategyImplications makes this clear!

clang/test/SemaCXX/warn-unsafe-buffer-usage-multi-decl-warnings.cpp

5–14

The new note is more descriptive and summarizes the reason for grouping variables together. We still don't inform the user of the direction of bounds propagation or the fact that buffers are independently unsafe. Like we discussed offline, we could consider these refinements in future versions of the tool.

[ziqingluo-90]

clang/lib/Analysis/UnsafeBufferUsage.cpp

579

I was wondering if we need this sub-matcher declRefExpr(expr()).bind(PointerAssignRHSTag). It is eventually used as an inner matcher of binaryOperator. I doubt it will match anything.

Ditto for line 582-583.

1658

How about using FixablesForUnsafeVars.byVar[Var] instead of the outer loop?

[t-rasmud]

Address review comments.

[t-rasmud]

clang/lib/Analysis/UnsafeBufferUsage.cpp

579

Great catch @ziqingluo-90! I was experimenting to match assignments at declarations and never intended for those sub-matchers to be part of this patch.

[NoQ]

I think it'd be really valuable to document the algorithm.

It's essential for the reader to understand why this is a two-step process and a simple flood-fill through bidirectional implications graph isn't going to be correct.

Then, you did something very clever to avoid finding intersections between directed "zones of influence" of every variable (and then joining them), and I really like it. In inline comments i have a couple suggestions on how to demonstrate to the reader that it's equivalent to (my) intuitive understanding of the problem. It looks like your algorithm is pretty much linear over the size of the AST, which is great because this means we don't have to worry too much about budgets! - this is probably worth proclaiming as well.

clang/lib/Analysis/UnsafeBufferUsage.cpp

277–281

You're saying this is a two-element list with well-defined LHS and RHS, but the caller implementation accepts arbitrarily long list and treats it as implication from item [0] to items [1 ... N-1].

I'm not really sure how it *should* behave in the more-than-two-elements case.

IIRC our primary motivating example for more than 2 elements is foo(p1, p2, ..., pN) where foo has attribute [[unsafe_buffer_usage]] with respect to all N parameters and has a safe version that accepts N spans, but no safe versions for smaller subsets of parameters. If we try to represent it with these "directed" vectors, it becomes quadratic over N as you'll need edges from each argument to each argument.

Maybe before we get to handling the other case, it makes sense to have an abstract class StrategyImplication, so that assignment-like implication was one concrete subclass, and a symmetric set of N related variables was another concrete subclass. Then the call site can handle these cases separately. For the purposes of this patch it probably makes sense for this function to just return optional<pair<VarDecl *>>, so that to manage the reader's expectations :)

1760

Probably better to compare pointers. There could be variables with the same name in the same function (in smaller scopes). Also IIRC getName() crashes on anonymous declarations (not sure if it can happen in this case).

1820

I was about to say that, there could be fixables that don't connect any unsafe variables, but connect two implicated variables together, so you need to iterate over *all* fixables instead.

But then I noticed that FixablesForUnsafeVars is actually mis-named 🙁 According to groupFixablesByVar() contains fixables for *all* variables, sorted by variable, and nobody ever checks whether it's unsafe. It'd be really valuable if we could rename it before or together with this patch! – as it makes the code much harder to read and reason about, there could even be existing bugs based on this misunderstanding.

Also, iterating over FixablesForUnsafeVars.byVar here would cause you to visit multivariable fixables twice (once for each variable), so there could be a bit of duplicated work here, maybe it still makes sense to iterate over the whole list.

1849–1850

Using Var here instead of CurrentVar is really clever. I think there needs to be a comment bragging about this decision! I was quite confused initially when I was thinking of it as essential to the algorithm, whereas in reality it looks like it's just an optimization.

If CurrentVar was used, this would have straightforwardly meant "Just keep the edges in the original graph that are reachable from unsafe variables, and add reverse edges; and also no need to explore from the same var more than once". It's somewhat obvious that it would correctly define the graph for the second part of the algorithm.

By using Var you're most likely achieving the same result, but dramatically cutting the amount of hoops the second part of the algorithm needs to jump through, given that a lot of these connections become "direct". But this results in a dramatically different graph, and the shape of that graph is non-deterministic (depends on iteration order in this loop).

So I guess my point is, it's valuable to tell the reader that they shouldn't try to imagine how the graph is transformed because of using Var instead of CurrentVar. It's still essentially the same graph, just a bit shallower. The reader can continue reading as if CurrentVar was used, and think about why it's equivalent later.

[jkorous]

This looks good!
I am trying to catch up with this patch and my comments are meant as "Did we consider case X?" rather than "This doesn't work for case X."

clang/lib/Analysis/UnsafeBufferUsage.cpp

577

Shall we back-port how matcher() and getFixits() methods split responsibilities that we've started to use in more recent patches?
For other fixables we now check if the DRE refers to a var decl already in the matcher like this:
declRefExpr(to(varDecl()))

1654

Array subscript operator adds an entry to the map if the key is not found.
https://en.cppreference.com/w/cpp/container/map/operator_at
That might or might not be ok here.
But we might also just take FixablesForUnsafeVars as a const reference and use find() instead.
https://en.cppreference.com/w/cpp/container/map/find

1695

I am trying to understand how do the Fixables matched to other variables in the VarGroupForVD learn that they shouldn't emit any Fix-It.
I was naively expecting that we'd do:

for (const VarDecl * V : VarGroupForVD) {
    FixItsForVariable.erase(VD);
}

1699

Note: VarGrpMap being std::map inserts a record if VD is not among the keys yet.

[jkorous]

clang/lib/Analysis/UnsafeBufferUsage.cpp

1760

+1 to comparing pointers
That's what we do above.

1827

IIUC we're copying elements from an std::vector to an std::set.
Nit: Maybe we could avoid the explicit iteration?

assert(Deps.size() > 1);
PtrAssignmentGraph[Deps[0]].insert(Deps.begin() + 1, Deps.end());

But I feel we might want to handle the case where Deps has exactly one element regardless.

1849–1850

+1 to adding comments
Our future selves might be pretty grateful if they have to debug this code :)

clang/test/SemaCXX/warn-unsafe-buffer-usage-multi-decl-warnings.cpp

2

I am looking for a test that checks that if one of the variables in the group is referred to by at least one DRE for which we don't have a Fix-It (e. g. negative index for span strategy) that the whole group will remain Fix-It-less (and note-less).
I can't find any and maybe that's just because I didn't look hard enough but it makes me wonder - should we add a short explanation to such test (either an existing one or the one we should add)?

[t-rasmud]

Address partial feedback.

[ziqingluo-90]

I'm working on fixing multiple parameters at a time. It is based on this patch. So I suddenly had a few more questions.

clang/lib/Analysis/UnsafeBufferUsage.cpp

1712

If VD is removed (it means giving up on fixing VD), do we also need to remove the whole group of VD?

1764

Could we do the grouping after all variables having their fix-its generated so that we can directly copy their fix-its instead of re-generating them?
This requires fix-its generated for two different variables to be independent. And, I think so far they are independent.

[t-rasmud]

clang/lib/Analysis/UnsafeBufferUsage.cpp

1712

That is right and a good optimization to have. I'll include it in the next iteration of the patch along.

[t-rasmud]

Address more feedback.

[t-rasmud]

Minor fix.

[t-rasmud]

Address feedback.

[t-rasmud]

clang/lib/Analysis/UnsafeBufferUsage.cpp

277–281

You are right, hadn't considered the case with more than two elements and will address it in a separate patch.

[t-rasmud]

Add documentation.

[NoQ]

Alright I think everything looks mostly good from high-level perspective! I have a few minor nitpicks.

clang/include/clang/Analysis/Analyses/UnsafeBufferUsage.h

35–37

We can remove the old interface now right? You removed both the definition and the call site.

43

We should probably turn VarGrpMap into a const reference. Otherwise it'll be deep-copied every time we call the function.

It's probably also better to make a typedef for this map type, as it shows up multiple times.

Does this map need to be ordered/tree-based? Maybe we should use std::unordered_map or llvm::DenseMap?

clang/lib/Analysis/UnsafeBufferUsage.cpp

579

Looks like the hasOperatorName("=") check is duplicated on both sides.

597–598

We're confident that this cast always succeeds. And we really don't want to see null pointers inside these pairs.

1125–1126

(valid use case for auto according to https://llvm.org/docs/CodingStandards.html#use-auto-type-deduction-to-make-code-more-readable)

clang/lib/Sema/AnalysisBasedWarnings.cpp

2215

We should probably find a way to put all these plain text pieces into DiagnosticSemaKinds.td (except probably the and part). I wonder if a

... %select{|, and change %2 to %select{std::span|std::array|std::span::iterator}1 to propagate bounds information betwen them'.}`

would work (like, nest more format specifiers into a %select). Or we could keep using the old diagnostic id when we don't need extra stuff at the end.

(It might be a good idea to make a new format specifier for this purpose, like plural but with lists. But this is probably an overkill if there's just one warning of this kind.)

clang/test/SemaCXX/warn-unsafe-buffer-usage-multi-decl-warnings.cpp

44

This is a FIXME test right? In theory we want to propagate all the way up to a, but we only support assignments so far, not initializations.

[NoQ]

TODOs: UUC

I think now is a good time to address this. The patch isn't going to be correct without it so we can't land it until the context is checked.

[t-rasmud]

Address comments.

[t-rasmud]

clang/include/clang/Analysis/Analyses/UnsafeBufferUsage.h

35–37

Assuming you're referring to handleFixableVariable I have already removed it in this patch. Did I miss something here?

[t-rasmud]

Modify diagnostic message.

[t-rasmud]

Use nested %select in format specifier of the diagnostic message.

[t-rasmud]

Friendly Ping.

[NoQ]

Ok this looks great to me, almost ready to land! Still needs the UUC work.

clang/include/clang/Analysis/Analyses/UnsafeBufferUsage.h

35–37

Yeah nvm I misread, you're absolutely right!

clang/include/clang/Basic/DiagnosticSemaKinds.td

11793–11796

Ok this one's also unused right?

11796

Found a typo!

Also I think we shouldn't have single quotes around %0 here, but instead we're supposed to stuff our const VarDecl * directly into the diagnostic stream, just like we already do in warn_unsafe_buffer_variable, which automatically surrounds it with single quotes.

(unfortunately we can't do the same with %2 so we add quotes manually when we build the dynamic string)

clang/lib/Analysis/UnsafeBufferUsage.cpp

557

[t-rasmud]

Squash changes from https://reviews.llvm.org/D150811.

[t-rasmud]

Address comments.

[NoQ]

Ok I think this is good to go! Amazing work!!

[barannikov88]

Hi, just a heads-up, some bots seem to be unhappy with the test:

https://lab.llvm.org/buildbot/#/builders/216/builds/21765

error: 'note' diagnostics expected but not seen: 
  File Z:\b\llvm-clang-x86_64-sie-win\llvm-project\clang\test\SemaCXX\warn-unsafe-buffer-usage-multi-decl-warnings.cpp Line 169: {{^change type of 'q' to 'std::span' to preserve bounds information, and change 'r' and 'p' to 'std::span' to propagate bounds information between them$}}
error: 'note' diagnostics seen but not expected: 
  File Z:\b\llvm-clang-x86_64-sie-win\llvm-project\clang\test\SemaCXX\warn-unsafe-buffer-usage-multi-decl-warnings.cpp Line 169: change type of 'q' to 'std::span' to preserve bounds information, and change 'p' and 'r' to 'std::span' to propagate bounds information between them
2 errors generated.

[dyung]

In D145739#4370674, @barannikov88 wrote:

Hi, just a heads-up, some bots seem to be unhappy with the test:

https://lab.llvm.org/buildbot/#/builders/216/builds/21765

error: 'note' diagnostics expected but not seen: 
  File Z:\b\llvm-clang-x86_64-sie-win\llvm-project\clang\test\SemaCXX\warn-unsafe-buffer-usage-multi-decl-warnings.cpp Line 169: {{^change type of 'q' to 'std::span' to preserve bounds information, and change 'r' and 'p' to 'std::span' to propagate bounds information between them$}}
error: 'note' diagnostics seen but not expected: 
  File Z:\b\llvm-clang-x86_64-sie-win\llvm-project\clang\test\SemaCXX\warn-unsafe-buffer-usage-multi-decl-warnings.cpp Line 169: change type of 'q' to 'std::span' to preserve bounds information, and change 'p' and 'r' to 'std::span' to propagate bounds information between them
2 errors generated.

The test seems to randomly pass and fail on the bot. It seems that the order of 'p' and 'r' in the output string may not be deterministic? Can you make the test more reliable or make it handle each situation (if appropriate)?

[dyung]

@t-rasmud I am sorry, but I had to revert your change, it is randomly failing on the Windows bots causing a lot of instability. See the revert commit message for examples.

[t-rasmud]

Hi Douglas,

No worries, I know the root cause for the issue. I will make the necessary changes and re-commit the patch.

Thanks,
Rashmi

[NoQ]

Thank you Sergei for catching this! Thank you Rashmi for fixing this!

clang/include/clang/Analysis/Analyses/UnsafeBufferUsage.h

 public:
   UnsafeBufferUsageHandler() = default;
   virtual ~UnsafeBufferUsageHandler() = default;
 
   /// This analyses produces large fixits that are organized into lists
   /// of primitive fixits (individual insertions/removals/replacements).
   using FixItList = llvm::SmallVectorImpl<FixItHint>;
 
   /// Invoked when an unsafe operation over raw pointers is found.
   virtual void handleUnsafeOperation(const Stmt *Operation,
                                      bool IsRelatedToDecl) = 0;
 
-  /// Invoked when a fix is suggested against a variable.
-  virtual void handleFixableVariable(const VarDecl *Variable,
-                                     FixItList &&List) = 0;
+  /// Invoked when a fix is suggested against a variable. This function groups
+  /// all variables that must be fixed together (i.e their types must be changed to the
+  /// same target type to prevent type mismatches) into a single fixit.
+  virtual void handleUnsafeVariableGroup(const VarDecl *Variable,
+            std::map<const VarDecl *, std::vector<const VarDecl *>> VarGrpMap,
+            FixItList &&Fixes) = 0;
 
   /// Returns a reference to the `Preprocessor`:
   virtual bool isSafeBufferOptOut(const SourceLocation &Loc) const = 0;
 
   /// Returns the text indicating that the user needs to provide input there:
   virtual std::string
   getUserFillPlaceHolder(StringRef HintTextToUser = "placeholder") const {
     std::string s = std::string("<# ");

clang/include/clang/Analysis/Analyses/UnsafeBufferUsageGadgets.def

 WARNING_GADGET(PointerArithmetic)
 WARNING_GADGET(UnsafeBufferUsageAttr)
 
 FIXABLE_GADGET(ULCArraySubscript)          // `DRE[any]` in an Unspecified Lvalue Context
 FIXABLE_GADGET(PointerDereference)
 FIXABLE_GADGET(UPCAddressofArraySubscript) // '&DRE[any]' in an Unspecified Pointer Context
 FIXABLE_GADGET(DerefSimplePtrArithFixable)
 FIXABLE_GADGET(PointerCtxAccess)
+FIXABLE_GADGET(PointerAssignment)
 
 #undef FIXABLE_GADGET
 #undef WARNING_GADGET
 #undef GADGET

clang/include/clang/Basic/DiagnosticSemaKinds.td

def warn_unsafe_buffer_variable : Warning<
   "does not perform bounds checks}1">,
   InGroup<UnsafeBufferUsage>, DefaultIgnore;
 def warn_unsafe_buffer_operation : Warning<
   "%select{unsafe pointer operation|unsafe pointer arithmetic|"
   "unsafe buffer access|function introduces unsafe buffer manipulation}0">,
   InGroup<UnsafeBufferUsage>, DefaultIgnore;
 def note_unsafe_buffer_operation : Note<
   "used%select{| in pointer arithmetic| in buffer access}0 here">;
 def note_unsafe_buffer_variable_fixit : Note<
   "change type of '%0' to '%select{std::span|std::array|std::span::iterator}1' to preserve bounds information">;
+def note_unsafe_buffer_variable_fixit_group : Note<
+  "change type of '%0' to '%select{std::span|std::array|std::span::iterator}1' to preserve bounds information%2">;
 def err_loongarch_builtin_requires_la32 : Error<
   "this builtin requires target: loongarch32">;
 } // end of sema component.

clang/lib/Analysis/UnsafeBufferUsage.cpp

 #include "clang/Lex/Lexer.h"
 #include "clang/Lex/Preprocessor.h"
 #include "clang/Tooling/Inclusions/HeaderIncludes.h"
 #include "clang/Tooling/Inclusions/IncludeStyle.h"
 #include "clang/Sema/Lookup.h"
 #include "llvm/ADT/SmallVector.h"
 #include <memory>
 #include <optional>
+#include <queue>
 
 using namespace llvm;
 using namespace clang;
 using namespace ast_matchers;
 
 namespace clang::ast_matchers {
 // A `RecursiveASTVisitor` that traverses all descendants of a given node "n"
 // except for those belonging to a different callable of "n".

 }
 } // namespace clang::ast_matchers
 
 namespace {
 // Because the analysis revolves around variables and their types, we'll need to
 // track uses of variables (aka DeclRefExprs).
 using DeclUseList = SmallVector<const DeclRefExpr *, 1>;
 
+using ImplicationsList = std::vector<const VarDecl *>;
+
 // Convenience typedef.
 using FixItList = SmallVector<FixItHint, 4>;
 
 // Defined below.
 class Strategy;
 } // namespace
 
 namespace {
public:
   bool isWarningGadget() const final { return false; }
 
   /// Returns a fixit that would fix the current gadget according to
   /// the current strategy. Returns None if the fix cannot be produced;
   /// returns an empty list if no fixes are necessary.
   virtual std::optional<FixItList> getFixits(const Strategy &) const {
     return std::nullopt;
   }
+  
+  /// Returns a list of two elements where the first element is the LHS of a pointer assignment
+  /// statement and the second element is the RHS. This two-element list represents the fact that
+  /// the LHS buffer gets its bounds information from the RHS buffer. This information will be used
+  /// later to group all those variables whose types must be modified together to prevent type
+  /// mismatches.
+  virtual std::optional<ImplicationsList> getStrategyImplications() const {
+    return std::nullopt;
+  }
 };
 
 using FixableGadgetList = std::vector<std::unique_ptr<FixableGadget>>;
 using WarningGadgetList = std::vector<std::unique_ptr<WarningGadget>>;
 
 /// An increment of a pointer-type value is unsafe as it may run the pointer
 /// out of bounds.
 class IncrementGadget : public WarningGadget {
public:
   virtual DeclUseList getClaimedVarUseSites() const override {
     if (const auto *DRE = dyn_cast<DeclRefExpr>(Node)) {
       return {DRE};
     }
     return {};
   }
 };
 
+/// A pointer assignment expression of the form:
+///  \code
+///  p = q;
+///  \endcode
+class PointerAssignmentGadget : public FixableGadget {
+private:
+  static constexpr const char *const PointerAssignemntTag = "ptrAssign";
+  static constexpr const char *const PointerAssignLHSTag = "ptrLHS";
+  static constexpr const char *const PointerAssignRHSTag = "ptrRHS";
+  const BinaryOperator *PA;    // pointer arithmetic expression
+  const DeclRefExpr * PtrLHS;         // the LHS pointer expression in `PA`
+  const DeclRefExpr * PtrRHS;         // the RHS pointer expression in `PA`
+
+public:
+  PointerAssignmentGadget(const MatchFinder::MatchResult &Result)
+      : FixableGadget(Kind::PointerAssignment),
+    PA(Result.Nodes.getNodeAs<BinaryOperator>(PointerAssignemntTag)),
+    PtrLHS(Result.Nodes.getNodeAs<DeclRefExpr>(PointerAssignLHSTag)),
+    PtrRHS(Result.Nodes.getNodeAs<DeclRefExpr>(PointerAssignRHSTag)) {}
+
+  static bool classof(const Gadget *G) {
+    return G->getKind() == Kind::PointerAssignment;
+  }
+
+  static Matcher matcher() {
+    auto PtrAtRight = allOf(hasOperatorName("="),
+      hasRHS(ignoringParenImpCasts(declRefExpr(hasPointerType()).
+                                   bind(PointerAssignRHSTag))));
+    auto PtrAtLeft = allOf(hasOperatorName("="),
+      hasLHS(declRefExpr(hasPointerType()).bind(PointerAssignLHSTag)));
+
+    //FIXME: Handle declarations at assignments
+
+    return stmt(binaryOperator(allOf(PtrAtLeft, PtrAtRight)));
+  }
+
+  virtual std::optional<FixItList> getFixits(const Strategy &S) const override;
+
+  virtual const Stmt *getBaseStmt() const override { return PA; }
+
+  virtual DeclUseList getClaimedVarUseSites() const override {
+    return DeclUseList{PtrLHS, PtrRHS};
+  }
+
+  virtual std::optional<ImplicationsList> getStrategyImplications()
+    const override {
+      return ImplicationsList{dyn_cast<VarDecl>(PtrLHS->getDecl()),
+        dyn_cast<VarDecl>(PtrRHS->getDecl())};
+  }
+};
+
 class PointerDereferenceGadget : public FixableGadget {
   static constexpr const char *const BaseDeclRefExprTag = "BaseDRE";
   static constexpr const char *const OperatorTag = "op";
 
   const DeclRefExpr *BaseDeclRefExpr = nullptr;
   const UnaryOperator *Op;
 
 public:
for (const auto &G : CB.FixableGadgets) {
     }
   }
 
   return {std::move(CB.FixableGadgets), std::move(CB.WarningGadgets),
           std::move(CB.Tracker)};
 }
 
 struct WarningGadgetSets {
-  std::map<const VarDecl *, std::set<std::unique_ptr<WarningGadget>>> byVar;
+  std::map<const VarDecl *, std::set<const WarningGadget *>> byVar;
   // These Gadgets are not related to pointer variables (e. g. temporaries).
-  llvm::SmallVector<std::unique_ptr<WarningGadget>, 16> noVar;
+  llvm::SmallVector<const WarningGadget *, 16> noVar;
 };
 
 static WarningGadgetSets
-groupWarningGadgetsByVar(WarningGadgetList &&AllUnsafeOperations) {
+groupWarningGadgetsByVar(const WarningGadgetList &AllUnsafeOperations) {
   WarningGadgetSets result;
   // If some gadgets cover more than one
   // variable, they'll appear more than once in the map.
   for (auto &G : AllUnsafeOperations) {
     DeclUseList ClaimedVarUseSites = G->getClaimedVarUseSites();
 
     bool AssociatedWithVarDecl = false;
     for (const DeclRefExpr *DRE : ClaimedVarUseSites) {
       if (const auto *VD = dyn_cast<VarDecl>(DRE->getDecl())) {
-        result.byVar[VD].emplace(std::move(G));
+        result.byVar[VD].insert(G.get());
         AssociatedWithVarDecl = true;
       }
     }
 
     if (!AssociatedWithVarDecl) {
-      result.noVar.emplace_back(std::move(G));
+      result.noVar.push_back(G.get());
       continue;
     }
   }
   return result;
 }
 
 struct FixableGadgetSets {
-  std::map<const VarDecl *, std::set<std::unique_ptr<FixableGadget>>> byVar;
+  std::map<const VarDecl *, std::set<const FixableGadget *>> byVar;
 };
 
 static FixableGadgetSets
 groupFixablesByVar(FixableGadgetList &&AllFixableOperations) {
   FixableGadgetSets FixablesForUnsafeVars;
   for (auto &F : AllFixableOperations) {
     DeclUseList DREs = F->getClaimedVarUseSites();
 
     for (const DeclRefExpr *DRE : DREs) {
       if (const auto *VD = dyn_cast<VarDecl>(DRE->getDecl())) {
-        FixablesForUnsafeVars.byVar[VD].emplace(std::move(F));
+        FixablesForUnsafeVars.byVar[VD].insert(F.get());
       }
     }
   }
   return FixablesForUnsafeVars;
 }
 
 bool clang::internal::anyConflict(const SmallVectorImpl<FixItHint> &FixIts,
                                   const SourceManager &SM) {
if (const auto *VD = dyn_cast<VarDecl>(DREs.front()->getDecl())) {
       case Strategy::Kind::Array:
       case Strategy::Kind::Vector:
         llvm_unreachable("unsupported strategies for FixableGadgets");
       }
     }
   return std::nullopt; // something went wrong, no fix-it
 }
 
+std::optional<FixItList>
+PointerAssignmentGadget::getFixits(const Strategy &S) const {
+  if (const VarDecl *LeftVD = dyn_cast<VarDecl>(PtrLHS->getDecl()))
+    if (const VarDecl *RightVD = dyn_cast<VarDecl>(PtrRHS->getDecl())) {
+      switch (S.lookup(LeftVD)) {
+        case Strategy::Kind::Span:
+          if (S.lookup(RightVD) == Strategy::Kind::Span)
+            return FixItList{};
+          return std::nullopt;
+        case Strategy::Kind::Wontfix:
+          return std::nullopt;
+        case Strategy::Kind::Iterator:
+        case Strategy::Kind::Array:
+        case Strategy::Kind::Vector:
+          llvm_unreachable("unsupported strategies for FixableGadgets");
+      }
+    }
+  return std::nullopt;
+}
+
 // Return the text representation of the given `APInt Val`:
 static std::string getAPIntText(APInt Val) {
   SmallVector<char> Txt;
   Val.toString(Txt, 10, true);
   // APInt::toString does not add '\0' to the end of the string for us:
   Txt.push_back('\0');
   return Txt.data();
 }
case Strategy::Kind::Vector:
     return "vector";
   case Strategy::Kind::Iterator:
     return "span";
   case Strategy::Kind::Wontfix:
     assert(false && "Wonfix strategy shouldn't be used to generate Fix-Its");
   };
 }
 
+static bool impossibleToFixForVar(const FixableGadgetSets &FixablesForUnsafeVars,
+                                  const Strategy &S,
+                                  const VarDecl * Var) {
+  for (const auto &F : FixablesForUnsafeVars.byVar.find(Var)->second) {
+    std::optional<FixItList> Fixits = F->getFixits(S);
+    if (!Fixits) {
+      return true;
+    }
+  }
+  return false;
+}
+
 static std::map<const VarDecl *, FixItList>
 getFixIts(FixableGadgetSets &FixablesForUnsafeVars, const Strategy &S,
-          const DeclUseTracker &Tracker, const ASTContext &Ctx, Sema &SA,
-          UnsafeBufferUsageHandler &Handler) {
+        UnsafeBufferUsageHandler &Handler,
+        const std::map<const VarDecl *, std::vector<const VarDecl *>> &VarGrpMap) {
   const SourceManager &SM = Ctx.getSourceManager();
   std::map<const VarDecl *, FixItList> FixItsForVariable;
   for (const auto &[VD, Fixables] : FixablesForUnsafeVars.byVar) {
     const Strategy::Kind ReplacementTypeForVD = S.lookup(VD);
     FixItsForVariable[VD] =
         fixVariable(VD, ReplacementTypeForVD, Tracker, Ctx, SA, Handler);
     // If we fail to produce Fix-It for the declaration we have to skip the
     // variable entirely.
for (const auto &F : Fixables) {
       } else {
         const FixItList CorrectFixes = Fixits.value();
         FixItsForVD.insert(FixItsForVD.end(), CorrectFixes.begin(),
                            CorrectFixes.end());
       }
     }
 
     if (ImpossibleToFix) {
       FixItsForVariable.erase(VD);
       continue;
     }
     
+    const auto VarGroupForVD = VarGrpMap.find(VD);
+    if (VarGroupForVD != VarGrpMap.end()) {
+      for (const VarDecl * V : VarGroupForVD->second) {
+        if (V == VD) {
+          continue;
+        }
+        if (impossibleToFixForVar(FixablesForUnsafeVars, S, V)) {
+          ImpossibleToFix = true;
+          break;
+        }
+      }
+      
+      if (ImpossibleToFix) {
+        FixItsForVariable.erase(VD);
+        continue;
+      }
+    }
+
     FixItsForVariable[VD].insert(FixItsForVariable[VD].end(),
                                  FixItsForVD.begin(), FixItsForVD.end());
 
     // Fix-it shall not overlap with macros or/and templates:
     if (overlapWithMacro(FixItsForVariable[VD]) ||
         clang::internal::anyConflict(FixItsForVariable[VD],
                                      Ctx.getSourceManager())) {
       FixItsForVariable.erase(VD);
std::optional<tooling::Replacement> Include = HeaderIncls.insert(
         getHeaderFilenameForStrategyKind(ReplacementTypeForVD), true,
         clang::tooling::IncludeDirective::Include);
     if (Include.has_value()) {
       SourceLocation HeaderInsertLoc =
           SM.getComposedLoc(FileOfVarDeclFixIt, Include->getOffset());
       FixItsForVariable[VD].push_back(FixItHint::CreateInsertion(
           HeaderInsertLoc, Include->getReplacementText()));
     }
+    
+    if (VarGroupForVD != VarGrpMap.end()) {
+      for (const VarDecl * Var : VarGroupForVD->second) {
+        if (Var == VD) {
+          continue;
+        }
+        FixItList GroupFix = fixVariable(Var, ReplacementTypeForVD, Tracker,
+                                         Var->getASTContext(), SA, Handler);
+        for (auto Fix : GroupFix) {
+          FixItsForVariable[VD].push_back(Fix);
+        }
+      }
+    }
   }
   return FixItsForVariable;
 }
 
 static Strategy
 getNaiveStrategy(const llvm::SmallVectorImpl<const VarDecl *> &UnsafeVars) {
   Strategy S;
   for (const VarDecl *VD : UnsafeVars) {
     S.set(VD, Strategy::Kind::Span);
   }
   return S;
 }
 
 void clang::checkUnsafeBufferUsage(const Decl *D,
                                    UnsafeBufferUsageHandler &Handler,
                                    bool EmitFixits, Sema &S) {
   assert(D && D->getBody());
 
   WarningGadgetSets UnsafeOps;
-  FixableGadgetSets FixablesForUnsafeVars;
-  DeclUseTracker Tracker;
+  FixableGadgetSets FixablesForAllVars;
 
-  {
-    auto [FixableGadgets, WarningGadgets, TrackerRes] = findGadgets(D, Handler);
-    UnsafeOps = groupWarningGadgetsByVar(std::move(WarningGadgets));
-    FixablesForUnsafeVars = groupFixablesByVar(std::move(FixableGadgets));
-    Tracker = std::move(TrackerRes);
-  }
+  auto [FixableGadgets, WarningGadgets, Tracker] = findGadgets(D, Handler);
+  FixablesForAllVars = groupFixablesByVar(std::move(FixableGadgets));
 
   std::map<const VarDecl *, FixItList> FixItsForVariable;
+  std::map<const VarDecl *, FixItList> FixItsForVariableGroup;
+  std::map<const VarDecl *, std::vector<const VarDecl *>> VariableGroupsMap{};
 
   if (EmitFixits) {
     // Filter out non-local vars and vars with unclaimed DeclRefExpr-s.
-    for (auto it = FixablesForUnsafeVars.byVar.cbegin();
-         it != FixablesForUnsafeVars.byVar.cend();) {
+    for (auto it = FixablesForAllVars.byVar.cbegin();
+         it != FixablesForAllVars.byVar.cend();) {
       if (Tracker.hasUnclaimedUses(it->first)) {
-        it = FixablesForUnsafeVars.byVar.erase(it);
+        it = FixablesForAllVars.byVar.erase(it);
       } else {
         ++it;
       }
     }
 
     llvm::SmallVector<const VarDecl *, 16> UnsafeVars;
-    for (const auto &[VD, ignore] : FixablesForUnsafeVars.byVar)
+    for (const auto &[VD, ignore] : FixablesForAllVars.byVar)
       UnsafeVars.push_back(VD);
 
+    // Fixpoint iteration for pointer assignments
+    using DepMapTy = DenseMap<const VarDecl *, std::set<const VarDecl *>>;
+    DepMapTy DependenciesMap{};
+    DepMapTy PtrAssignmentGraph{};
+    
+    for (auto it : FixablesForAllVars.byVar) {
+      for (const FixableGadget *fixable : it.second) {
+        std::optional<ImplicationsList> ImplList =
+                                   fixable->getStrategyImplications();
+        if (ImplList) {
+          ImplicationsList Deps = ImplList.value();
+          assert(Deps.size() > 1);
+          PtrAssignmentGraph[Deps[0]].insert(Deps.begin() + 1, Deps.end());
+        }
+      }
+    }
+    
+    std::set<const VarDecl *> VisitedVarsDirected{};
+    for (const auto &[Var, ignore] : UnsafeOps.byVar) {
+      if (VisitedVarsDirected.find(Var) == VisitedVarsDirected.end()) {
+    
+        std::queue<const VarDecl*> QueueDirected{};
+        QueueDirected.push(Var);
+        while(!QueueDirected.empty()) {
+          const VarDecl* CurrentVar = QueueDirected.front();
+          QueueDirected.pop();
+          VisitedVarsDirected.insert(CurrentVar);
+          auto AdjacentNodes = PtrAssignmentGraph[CurrentVar];
+          for (const VarDecl *Adj : AdjacentNodes) {
+            if (VisitedVarsDirected.find(Adj) == VisitedVarsDirected.end()) {
+              QueueDirected.push(Adj);
+            }
+            DependenciesMap[Var].insert(Adj);
+            DependenciesMap[Adj].insert(Var);
+          }
+        }
+      }
+    }
+    
+    // Group Connected Components for Unsafe Vars
+    // (Dependencies based on pointer assignments)
+    std::set<const VarDecl *> VisitedVars{};
+    for (const auto &[Var, ignore] : UnsafeOps.byVar) {
+      if (VisitedVars.find(Var) == VisitedVars.end()) {
+        std::vector<const VarDecl *> VarGroup{};
+    
+        std::queue<const VarDecl*> Queue{};
+        Queue.push(Var);
+        while(!Queue.empty()) {
+          const VarDecl* CurrentVar = Queue.front();
+          Queue.pop();
+          VisitedVars.insert(CurrentVar);
+          VarGroup.push_back(CurrentVar);
+          auto AdjacentNodes = DependenciesMap[CurrentVar];
+          for (const VarDecl *Adj : AdjacentNodes) {
+            if (VisitedVars.find(Adj) == VisitedVars.end()) {
+              Queue.push(Adj);
+            }
+          }
+        }
+        for (const VarDecl * V : VarGroup) {
+          if (UnsafeOps.byVar.find(V) != UnsafeOps.byVar.end()) {
+            VariableGroupsMap[V] = VarGroup;
+          }
+        }
+      }
+    }
+    
     Strategy NaiveStrategy = getNaiveStrategy(UnsafeVars);
-    FixItsForVariable = getFixIts(FixablesForUnsafeVars, NaiveStrategy, Tracker,
-                                  D->getASTContext(), S, Handler);
+    FixItsForVariableGroup =
+            getFixIts(FixablesForAllVars, NaiveStrategy, Tracker,
+                      D->getASTContext(), S, Handler, VariableGroupsMap);
 
     // FIXME Detect overlapping FixIts.
   }
 
   for (const auto &G : UnsafeOps.noVar) {
     Handler.handleUnsafeOperation(G->getBaseStmt(), /*IsRelatedToDecl=*/false);
   }
 
   for (const auto &[VD, WarningGadgets] : UnsafeOps.byVar) {
-    auto FixItsIt =
-        EmitFixits ? FixItsForVariable.find(VD) : FixItsForVariable.end();
-    Handler.handleFixableVariable(VD, FixItsIt != FixItsForVariable.end()
+    auto FixItsIt = FixItsForVariableGroup.find(VD);
+    Handler.handleUnsafeVariableGroup(VD, VariableGroupsMap, FixItsIt !=
+                                          FixItsForVariableGroup.end()
                                           ? std::move(FixItsIt->second)
                                           : FixItList{});
     for (const auto &G : WarningGadgets) {
       Handler.handleUnsafeOperation(G->getBaseStmt(), /*IsRelatedToDecl=*/true);
     }
   }
 }

clang/lib/Sema/AnalysisBasedWarnings.cpp

if (const auto *ASE = dyn_cast<ArraySubscriptExpr>(Operation)) {
       Range = Operation->getSourceRange();
     }
     if (IsRelatedToDecl)
       S.Diag(Loc, diag::note_unsafe_buffer_operation) << MsgParam << Range;
     else
       S.Diag(Loc, diag::warn_unsafe_buffer_operation) << MsgParam << Range;
   }
 
-  // FIXME: rename to handleUnsafeVariable
-  void handleFixableVariable(const VarDecl *Variable,
-                             FixItList &&Fixes) override {
+  void handleUnsafeVariableGroup(const VarDecl *Variable,
+              std::map<const VarDecl *, std::vector<const VarDecl *>> VarGrpMap,
     S.Diag(Variable->getLocation(), diag::warn_unsafe_buffer_variable)
         << Variable << (Variable->getType()->isPointerType() ? 0 : 1)
         << Variable->getSourceRange();
+    std::vector<const VarDecl *> VarGroupForVD = VarGrpMap[Variable];
     if (!Fixes.empty()) {
-      unsigned FixItStrategy = 0; // For now we only has 'std::span' strategy
-      const auto &FD = S.Diag(Variable->getLocation(),
-                              diag::note_unsafe_buffer_variable_fixit);
+      unsigned FixItStrategy = 0; // For now we only have 'std::span' strategy
+      Sema::SemaDiagnosticBuilder const &FD = S.Diag(Variable->getLocation(),
+                              diag::note_unsafe_buffer_variable_fixit_group);
       
       FD << Variable->getName() << FixItStrategy;
+      std::string AllVars = "";
+      if (VarGroupForVD.size() > 1) {
+        AllVars.append(", and change ");
+        if (VarGroupForVD.size() == 2) {
+          if (VarGroupForVD[0] == Variable) {
+            AllVars.append("'" + VarGroupForVD[1]->getName().str() + "'");
+          } else {
+            AllVars.append("'" + VarGroupForVD[0]->getName().str() + "'");
+          }
+        } else {
+          bool first = false;
+          if (VarGroupForVD.size() == 3) {
+            for (const VarDecl * V : VarGroupForVD) {
+              if (V == Variable) {
+                continue;
+              }
+              if (!first) {
+                first = true;
+                AllVars.append("'" + V->getName().str() + "'" + " and ");
+              } else {
+                AllVars.append("'" + V->getName().str() + "'");
+              }
+            }
+          } else {
+            for (const VarDecl * V : VarGroupForVD) {
+              if (V == Variable) {
+                continue;
+              }
+              if (VarGroupForVD.back() != V) {
+                AllVars.append("'" + V->getName().str() + "'" + ", ");
+              } else {
+                AllVars.append("and '" + V->getName().str() + "'");
+              }
+            }
+          }
+        }
+        // FIXME: change std::span to the correct type (array/iterator)
+        AllVars.append(" to 'std::span' to propagate bounds information between them");
+      }
+      FD << AllVars;
+      
       for (const auto &F : Fixes)
         FD << F;
     }
   }
 
   bool isSafeBufferOptOut(const SourceLocation &Loc) const override {
     return S.PP.isSafeBufferOptOut(S.getSourceManager(), Loc);
   }
 };
 } // namespace
 
 //===----------------------------------------------------------------------===//
 // AnalysisBasedWarnings - Worker object used by Sema to execute analysis-based
 //  warnings on a function, method, or block.
 //===----------------------------------------------------------------------===//
 
 sema::AnalysisBasedWarnings::Policy::Policy() {
   enableCheckFallThrough = 1;
   enableCheckUnreachable = 0;
   enableThreadSafetyAnalysis = 0;
   enableConsumedAnalysis = 0;
 }

clang/test/SemaCXX/warn-unsafe-buffer-usage-multi-decl-fixits-test.cpp

+// RUN: %clang_cc1 -std=c++20 -Wunsafe-buffer-usage -fdiagnostics-parseable-fixits %s 2>&1 | FileCheck %s
+
+void foo1a() {
+  int *r = new int[7];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> r"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:22-[[@LINE-3]]:22}:", 7}"
+  int *p = new int[4];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> p"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:22-[[@LINE-3]]:22}:", 4}"
+  p = r;
+  int tmp = p[9];
+  int *q;
+  // CHECK-NOT: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> q"
+  q = r;
+}
+
+void foo1b() {
+  int *r = new int[7];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> r"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:22-[[@LINE-3]]:22}:", 7}"
+  int *p = new int[4];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> p"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:22-[[@LINE-3]]:22}:", 4}"
+  p = r;
+  int tmp = p[9];
+  int *q = new int[4];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> q"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:22-[[@LINE-3]]:22}:", 4}"
+  q = r;
+  tmp = q[9];
+}
+
+void foo1c() {
+  int *r = new int[7];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> r"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:22-[[@LINE-3]]:22}:", 7}"
+  int *p = new int[4];
+  // CHECK-NOT: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> p"
+  p = r;
+  int tmp = r[9];
+  int *q;
+  // CHECK-NOT: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> q"
+  q = r;
+  tmp = q[9];
+}
+
+void foo2a() {
+  int *r = new int[7];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> r"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:22-[[@LINE-3]]:22}:", 7}"
+  int *p = new int[5];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> p"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:22-[[@LINE-3]]:22}:", 5}"
+  int *q = new int[4];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> q"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:22-[[@LINE-3]]:22}:", 4}"
+  p = q;
+  int tmp = p[8];
+  q = r;
+}
+
+void foo2b() {
+  int *r = new int[7];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> r"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:22-[[@LINE-3]]:22}:", 7}"
+  int *p = new int[5];
+  // CHECK-NOT: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> p"
+  // CHECK-NOT: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-NOT: fix-it:"{{.*}}":{[[@LINE-3]]:22-[[@LINE-3]]:22}:", 5}"
+  int *q = new int[4];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> q"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:22-[[@LINE-3]]:22}:", 4}"
+  p = q;
+  int tmp = q[8];
+  q = r;
+}
+
+void foo2c() {
+  int *r = new int[7];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> r"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:22-[[@LINE-3]]:22}:", 7}"
+  int *p = new int[5];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> p"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:22-[[@LINE-3]]:22}:", 5}"
+  int *q = new int[4];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> q"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:22-[[@LINE-3]]:22}:", 4}"
+  p = q;
+  int tmp = p[8];
+  q = r;
+  tmp = q[8];
+}
+
+void foo3a() {
+  int *r = new int[7];
+  // CHECK-NOT: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> r"
+  int *p = new int[5];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> p"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:22-[[@LINE-3]]:22}:", 5}"
+  int *q = new int[4];
+  // CHECK-NOT: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> q"
+  q = p;
+  int tmp = p[8];
+  q = r;
+}
+
+void foo3b() {
+  int *r = new int[10];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> r"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:23-[[@LINE-3]]:23}:", 10}"
+  int *p = new int[10];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> p"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:23-[[@LINE-3]]:23}:", 10}"
+  int *q = new int[10];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> q"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:23-[[@LINE-3]]:23}:", 10}"
+  q = p;
+  int tmp = q[8];
+  q = r;
+}

clang/test/SemaCXX/warn-unsafe-buffer-usage-multi-decl-warnings.cpp

+// RUN: %clang_cc1 -std=c++20 -Wunsafe-buffer-usage -verify %s
+
+namespace std {
+  class type_info { };
+}
+
+void local_assign_both_span() {
+  int tmp;
+  int* p = new int[10]; // expected-warning{{'p' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'p' to 'std::span' to preserve bounds information, and change 'q' to 'std::span' to propagate bounds information between them$}}}}
+  tmp = p[4];  // expected-note{{used in buffer access here}}
+
+  int* q = new int[10];  // expected-warning{{'q' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'q' to 'std::span' to preserve bounds information, and change 'p' to 'std::span' to propagate bounds information between them$}}}}
+  tmp = q[4];  // expected-note{{used in buffer access here}}
+
+  q = p;
+}
+
+void local_assign_rhs_span() {
+  int tmp;
+  int* p = new int[10];
+  int* q = new int[10];  // expected-warning{{'q' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'q' to 'std::span' to preserve bounds information$}}}}
+  tmp = q[4];  // expected-note{{used in buffer access here}}
+  p = q;
+}
+
+void local_assign_no_span() {
+  int tmp;
+  int* p = new int[10];
+  int* q = new int[10];
+  p = q;
+}
+
+void local_assign_lhs_span() {
+  int tmp;
+  int* p = new int[10];  // expected-warning{{'p' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'p' to 'std::span' to preserve bounds information, and change 'q' to 'std::span' to propagate bounds information between them$}}}}
+  tmp = p[4];  // expected-note{{used in buffer access here}}
+  int* q = new int[10];
+
+  p = q;
+}
+
+
+void lhs_span_multi_assign() {
+  int *a = new int[2];
+  int *b = a;
+  int *c = b;
+  int *d = c;  // expected-warning{{'d' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'd' to 'std::span' to preserve bounds information$}}}}
+  int tmp = d[2];  // expected-note{{used in buffer access here}}
+}
+
+void rhs_span() {
+  int *x = new int[3];
+  int *y;  // expected-warning{{'y' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'y' to 'std::span' to preserve bounds information$}}}}
+  y[5] = 10;  // expected-note{{used in buffer access here}}
+
+  x = y;
+}
+
+void rhs_span1() {
+  int *q = new int[12];
+  int *p = q;  // expected-warning{{'p' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'p' to 'std::span' to preserve bounds information$}}}}
+  p[5] = 10;  // expected-note{{used in buffer access here}}
+  int *r = q;  // expected-warning{{'r' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'r' to 'std::span' to preserve bounds information$}}}}
+  r[10] = 5;  // expected-note{{used in buffer access here}}
+}
+
+void rhs_span2() {
+  int *q = new int[6];
+  int *p = q;  // expected-warning{{'p' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'p' to 'std::span' to preserve bounds information$}}}}
+  p[5] = 10;  // expected-note{{used in buffer access here}}
+  int *r = q;
+}
+
+void test_grouping() {
+  int *z = new int[8];
+  int tmp;
+  int *y = new int[10];  // expected-warning{{'y' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'y' to 'std::span' to preserve bounds information$}}}}
+  tmp = y[5]; // expected-note{{used in buffer access here}}
+
+  int *x = new int[10];
+  x = y;
+
+  int *w = z;
+}
+
+void test_grouping1() {
+  int tmp;
+  int *y = new int[10];  // expected-warning{{'y' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'y' to 'std::span' to preserve bounds information$}}}}
+  tmp = y[5];  // expected-note{{used in buffer access here}}
+  int *x = new int[10];
+  x = y;
+
+  int *w = new int[10];  // expected-warning{{'w' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'w' to 'std::span' to preserve bounds information$}}}}
+  tmp = w[5];  // expected-note{{used in buffer access here}}
+  int *z = new int[10];
+  z = w;
+}
+
+void foo1a() {
+  int *r = new int[7];
+  int *p = new int[4];  // expected-warning{{'p' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'p' to 'std::span' to preserve bounds information, and change 'r' to 'std::span' to propagate bounds information between them$}}}}
+  p = r;
+  int tmp = p[9];  // expected-note{{used in buffer access here}}
+  int *q;
+  q = r;
+}
+
+void foo1b() {
+  int *r = new int[7];
+  int *p = new int[4];  // expected-warning{{'p' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'p' to 'std::span' to preserve bounds information, and change 'r' and 'q' to 'std::span' to propagate bounds information between them$}}}}
+  p = r;
+  int tmp = p[9];  // expected-note{{used in buffer access here}}
+  int *q;  // expected-warning{{'q' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'q' to 'std::span' to preserve bounds information, and change 'p' and 'r' to 'std::span' to propagate bounds information between them$}}}}
+  q = r;
+  tmp = q[9];  // expected-note{{used in buffer access here}}
+}
+
+void foo1c() {
+  int *r = new int[7];  // expected-warning{{'r' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'r' to 'std::span' to preserve bounds information, and change 'q' to 'std::span' to propagate bounds information between them$}}}}
+  int *p = new int[4];
+  p = r;
+  int tmp = r[9];  // expected-note{{used in buffer access here}}
+  int *q;  // expected-warning{{'q' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'q' to 'std::span' to preserve bounds information, and change 'r' to 'std::span' to propagate bounds information between them$}}}}
+  q = r;
+  tmp = q[9];  // expected-note{{used in buffer access here}}
+}
+
+void foo2a() {
+  int *r = new int[7];
+  int *p = new int[5];  // expected-warning{{'p' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'p' to 'std::span' to preserve bounds information, and change 'r' and 'q' to 'std::span' to propagate bounds information between them$}}}}
+  int *q = new int[4];
+  p = q;
+  int tmp = p[8];  // expected-note{{used in buffer access here}}
+  q = r;
+}
+
+void foo2b() {
+  int *r = new int[7];
+  int *p = new int[5];
+  int *q = new int[4];  // expected-warning{{'q' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'q' to 'std::span' to preserve bounds information, and change 'r' to 'std::span' to propagate bounds information between them$}}}}
+  p = q;
+  int tmp = q[8];  // expected-note{{used in buffer access here}}
+  q = r;
+}
+
+void foo2c() {
+  int *r = new int[7];
+  int *p = new int[5];  // expected-warning{{'p' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'p' to 'std::span' to preserve bounds information, and change 'r' and 'q' to 'std::span' to propagate bounds information between them$}}}}
+  int *q = new int[4];  // expected-warning{{'q' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'q' to 'std::span' to preserve bounds information, and change 'p' and 'r' to 'std::span' to propagate bounds information between them$}}}}
+  p = q;
+  int tmp = p[8];  // expected-note{{used in buffer access here}}
+  q = r;
+  tmp = q[8];  // expected-note{{used in buffer access here}}
+}
+
+void foo3a() {
+  int *r = new int[7];
+  int *p = new int[5];  // expected-warning{{'p' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'p' to 'std::span' to preserve bounds information$}}}}
+  int *q = new int[4];
+  q = p;
+  int tmp = p[8];  // expected-note{{used in buffer access here}}
+  q = r;
+}
+
+void foo3b() {
+  int *r = new int[7];
+  int *p = new int[5];
+  int *q = new int[4];  // expected-warning{{'q' is an unsafe pointer used for buffer access}} //expected-note-re{{{{^change type of 'q' to 'std::span' to preserve bounds information, and change 'r' and 'p' to 'std::span' to propagate bounds information between them$}}}}
+  q = p;
+  int tmp = q[8];  // expected-note{{used in buffer access here}}
+  q = r;
+}
+
+void test_crash() {
+  int *r = new int[8];
+  int *q = r;
+  int *p;  // expected-warning{{'p' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'p' to 'std::span' to preserve bounds information, and change 'q' to 'std::span' to propagate bounds information between them$}}}}
+  p = q;
+  int tmp = p[9];  // expected-note{{used in buffer access here}}
+}
+
+void foo_uuc() {
+  int *ptr;
+  int *local;  // expected-warning{{'local' is an unsafe pointer used for buffer access}}
+  local = ptr;
+  local++;  // expected-note{{used in pointer arithmetic here}}
+
+  (local = ptr) += 5;  // expected-warning{{unsafe pointer arithmetic}}
+}
+
+void check_rhs_fix() {
+  int *r = new int[8];  // expected-warning{{'r' is an unsafe pointer used for buffer access}}  // expected-note-re{{{{^change type of 'r' to 'std::span' to preserve bounds information, and change 'x' to 'std::span' to propagate bounds information between them$}}}}
+  int *x;
+  r[7] = 9;  // expected-note{{used in buffer access here}}
+  r = x;
+}
+
+void check_rhs_nofix() {
+  int *r = new int[8];  // expected-warning{{'r' is an unsafe pointer used for buffer access}}
+  int *x;  // expected-warning{{'x' is an unsafe pointer used for buffer access}}
+  r[7] = 9;  // expected-note{{used in buffer access here}}
+  r = x;
+  x++;  // expected-note{{used in pointer arithmetic here}}
+}
+
+void check_rhs_nofix_order() {
+  int *r = new int[8];  // expected-warning{{'r' is an unsafe pointer used for buffer access}}
+  int *x;  // expected-warning{{'x' is an unsafe pointer used for buffer access}}
+  x++;  // expected-note{{used in pointer arithmetic here}}
+  r[7] = 9;  // expected-note{{used in buffer access here}}
+  r = x;
+}
+
+void check_rhs_nofix_order1() {
+  int *r = new int[8];  // expected-warning{{'r' is an unsafe pointer used for buffer access}}
+  r[7] = 9;  // expected-note{{used in buffer access here}}
+  int *x;  // expected-warning{{'x' is an unsafe pointer used for buffer access}}
+  x++;  // expected-note{{used in pointer arithmetic here}}
+  r = x;
+}
+
+void check_rhs_nofix_order2() {
+  int *x;  // expected-warning{{'x' is an unsafe pointer used for buffer access}}
+  int *r = new int[8];  // expected-warning{{'r' is an unsafe pointer used for buffer access}}
+  r[7] = 9;  // expected-note{{used in buffer access here}}
+  x++;  // expected-note{{used in pointer arithmetic here}}
+  r = x;
+}
+
+void check_rhs_nofix_order3() {
+  int *x;  // expected-warning{{'x' is an unsafe pointer used for buffer access}}
+  int *r = new int[8];  // expected-warning{{'r' is an unsafe pointer used for buffer access}}
+  r = x;
+  r[7] = 9;  // expected-note{{used in buffer access here}}
+  x++;  // expected-note{{used in pointer arithmetic here}}
+}
+
+void check_rhs_nofix_order4() {
+  int *x;  // expected-warning{{'x' is an unsafe pointer used for buffer access}}
+  int *r = new int[8];  // expected-warning{{'r' is an unsafe pointer used for buffer access}}
+  r[7] = 9;  // expected-note{{used in buffer access here}}
+  r = x;
+  x++;  // expected-note{{used in pointer arithmetic here}}
+}
+
+void no_unhandled_lhs() {
+  int *r = new int[8];  // expected-warning{{'r' is an unsafe pointer used for buffer access}}  // expected-note-re{{{{^change type of 'r' to 'std::span' to preserve bounds information, and change 'x' to 'std::span' to propagate bounds information between them$}}}}
+  r[7] = 9;  // expected-note{{used in buffer access here}}
+  int *x;
+  r = x;
+}
+
+const std::type_info unhandled_lhs() {
+  int *r = new int[8];  // expected-warning{{'r' is an unsafe pointer used for buffer access}}
+  r[7] = 9;  // expected-note{{used in buffer access here}}
+  int *x;
+  r = x;
+  return typeid(*r);
+}
+
+const std::type_info unhandled_rhs() {
+  int *r = new int[8];  // expected-warning{{'r' is an unsafe pointer used for buffer access}}
+  r[7] = 9;  // expected-note{{used in buffer access here}}
+  int *x;
+  r = x;
+  return typeid(*x);
+}
+
+void test_negative_index() {
+  int *x = new int[4];  // expected-warning{{'x' is an unsafe pointer used for buffer access}}
+  int *p;  // expected-warning{{'p' is an unsafe pointer used for buffer access}}
+  p = &x[1];  // expected-note{{used in buffer access here}}
+  p[-1] = 9;  // expected-note{{used in buffer access here}}
+}
+
+void test_unfixable() {
+  int *r = new int[8];  // expected-warning{{'r' is an unsafe pointer used for buffer access}}
+  int *x;  // expected-warning{{'x' is an unsafe pointer used for buffer access}}
+  x[7] = 9;  // expected-note{{used in buffer access here}}
+  r = x;
+  r++;  // expected-note{{used in pointer arithmetic here}}
+}
+
+void test_cyclic_deps() {
+  int *r = new int[10];  // expected-warning{{'r' is an unsafe pointer used for buffer access}}  expected-note-re{{{{^change type of 'r' to 'std::span' to preserve bounds information, and change 'q' and 'p' to 'std::span' to propagate bounds information between them$}}}}
+  int *q;
+  q = r;
+  int *p;
+  p = q;
+  r[3] = 9; // expected-note{{used in buffer access here}}
+  r = p;
+}
+
+void test_cyclic_deps_a() {
+  int *r = new int[10];  // expected-warning{{'r' is an unsafe pointer used for buffer access}}
+  int *q;
+  q = r;
+  int *p;  // expected-warning{{'p' is an unsafe pointer used for buffer access}}
+  p = q;
+  r[3] = 9; // expected-note{{used in buffer access here}}
+  r = p;
+  p++;  // expected-note{{used in pointer arithmetic here}}
+}
+
+void test_cyclic_deps1() {
+  int *r = new int[10];
+  int *q;
+  q = r;
+  int *p;  // expected-warning{{'p' is an unsafe pointer used for buffer access}}  expected-note-re{{{{^change type of 'p' to 'std::span' to preserve bounds information, and change 'r' and 'q' to 'std::span' to propagate bounds information between them$}}}}
+  p = q;
+  p[3] = 9; // expected-note{{used in buffer access here}}
+  r = p;
+}
+
+void test_cyclic_deps2() {
+  int *r = new int[10];
+  int *q;  // expected-warning{{'q' is an unsafe pointer used for buffer access}}  expected-note-re{{{{^change type of 'q' to 'std::span' to preserve bounds information, and change 'r' and 'p' to 'std::span' to propagate bounds information between them$}}}}
+  q = r;
+  int *p;
+  p = q;
+  q[3] = 9; // expected-note{{used in buffer access here}}
+  r = p;
+}
+
+void test_cyclic_deps3() {
+  int *r = new int[10];
+  int *q;  // expected-warning{{'q' is an unsafe pointer used for buffer access}}  expected-note-re{{{{^change type of 'q' to 'std::span' to preserve bounds information, and change 'r' and 'p' to 'std::span' to propagate bounds information between them$}}}}
+  q = r;
+  int *p;  // expected-warning{{'p' is an unsafe pointer used for buffer access}}  expected-note-re{{{{^change type of 'p' to 'std::span' to preserve bounds information, and change 'q' and 'r' to 'std::span' to propagate bounds information between them$}}}}
+  p = q;
+  q[3] = 9; // expected-note{{used in buffer access here}}
+  p[4] = 7; // expected-note{{used in buffer access here}}
+  r = p;
+}
+
+void test_cyclic_deps4() {
+  int *r = new int[10];  // expected-warning{{'r' is an unsafe pointer used for buffer access}}  expected-note-re{{{{^change type of 'r' to 'std::span' to preserve bounds information, and change 'q' and 'p' to 'std::span' to propagate bounds information between them$}}}}
+  int *q;  // expected-warning{{'q' is an unsafe pointer used for buffer access}}  expected-note-re{{{{^change type of 'q' to 'std::span' to preserve bounds information, and change 'r' and 'p' to 'std::span' to propagate bounds information between them$}}}}
+  q = r;
+  int *p;  // expected-warning{{'p' is an unsafe pointer used for buffer access}}  expected-note-re{{{{^change type of 'p' to 'std::span' to preserve bounds information, and change 'r' and 'q' to 'std::span' to propagate bounds information between them$}}}}
+  p = q;
+  q[3] = 9; // expected-note{{used in buffer access here}}
+  p[4] = 7; // expected-note{{used in buffer access here}}
+  r[1] = 5; // expected-note{{used in buffer access here}}
+  r = p;
+}