[-Wunsafe-buffer-usage] Handle pointer initializations for grouping related variables

[t-rasmud]

Summary

This patch introduces a fiaxable for pointer initializations of the type T *p = q so that p and q are added as nodes to the pointer assignment graph introduced in https://reviews.llvm.org/D145739

[ziqingluo-90]

clang/lib/Analysis/UnsafeBufferUsage.cpp

727–728

PtrInitExpr is unused. Why do we need to match PtrInitExpr here while we already have PointerInitGadget?

737

2015

Why can we safely remove this check? Did we move this check to somewhere else?

[ziqingluo-90]

clang/lib/Analysis/UnsafeBufferUsage.cpp

566

It seems that PointerInitTag never gets to bind a node? It is used in the constructor to initialize the member PI, which is also never used. I suggest we either remove the member or bind the node with the tag.

clang/test/SemaCXX/warn-unsafe-buffer-usage-multi-decl-ptr-init.cpp

28

Did we miss to add expected-note for change type of 'p' ... or we cannot fix p, q or r or some reason (curious)?

[t-rasmud]

clang/lib/Analysis/UnsafeBufferUsage.cpp

2015

Sorry, this version of the patch was never meant to be reviewed. I uploaded purely to make sure I don't lose those changes.

[t-rasmud]

Address comments.

[t-rasmud]

Minor fixes.

[t-rasmud]

clang/test/SemaCXX/warn-unsafe-buffer-usage-multi-decl-ptr-init.cpp

28

That's a great observation! You are right that the fixit for p implies a fixit for q due to the assignment statement int *p = q;. However, q is part of another fixable (int *r = q) that doesn't have a fixit. Since p and q need to be fixed either both together or none at all, we do not emit fixits for either (the method impossibleToFixForVar has the check that decides whether a fixit is impossible if any variable in the group doesn't have a fixit.)

More generally, when a variable doesn't have a fixit, it either means that the operation is safe or that the operation isn't handled by our machine. Currently, we over-approximate and do not emit fixits. In this particular test case, we don't know how r will be fixed and therefore can't tell how it affects the fixit for q

[NoQ]

This is interesting, your new gadget is a single-variable gadget for the purposes of grouping and DRE claiming, but a multi-variable gadget for the purposes of strategy implications.

In particular it's never put into the bucket of fixables for the LHS variable.

This sounds scary but seems to be fine in this case. Indeed,

• If the LHS variable is safe (i.e. the strategy is wontfix even after variable grouping), we're not emitting any fixes for it so it doesn't matter what the bucket contains, so everything works well.
  • In the future we may need to implement a .data() fix for the situation where the LHS is safe but RHS isn't. But we aren't actually fixing the LHS in this case, just the RHS, so buckets are still irrelevant.
• If the LHS variable is unsafe, the RHS variable is brought in through strategy implications, so we choose a span strategy for both variables and run impossibleToFixForVar() on each of them to confirm that the RHS can be fixed, so this scenario works well too.
  • In particular, in the hypothetical situation that both strategies are span but the new gadget refuses to produce the fix (currently it always produces a trivial fix), fixits for the entire group will be correctly abandoned because the RHS is guaranteed to be part of the group.

So I think I'm ok with keeping such clever gadgets legal. Namely, it's ok for a fixable to not declare relation to a variable that participates in a strategy implication, as long as it's the source of the strategy implication. We should probably add an assert to verify that the gadget actually behaves this way - maybe put in the code that iterates over all strategy implications?

Another side effect of such implementation is that when the new gadget isn't found on a variable declaration statement, the declaration of the variable does not constitute an unclaimed use of that variable. The machine still believes that it fully understands the variable. This may or may not be a good thing; ultimately we may need a safeguard against declarations that *may* constitute a strategy implication (but aren't covered by any initialization fixables), so that to avoid suggesting low-quality fixits in such cases. But this isn't a regression; we already suggest such low-quality fixits and the patch only makes it better (https://godbolt.org/z/Mcn3Por5d). So we may want to implement that separately, but this doesn't necessarily need to follow the usual claiming process.

clang/test/SemaCXX/warn-unsafe-buffer-usage-multi-decl-ptr-init.cpp

28

Maybe let's add a // FIXME to the test then?

[NoQ]

Other than me trying to understand the architectural implications here, I think the patch looks great and almost good to go!

clang/lib/Analysis/UnsafeBufferUsage.cpp

564

Am I reading this right that isInUnspecifiedUntypedContext() is here to avoid situations like

void foo(int *p) P
  // Changing `q` to `span` is quite problematic!
  if (int *q = p) {
    // ...
  }
}

?

Don't we already avoid that when we decide on fixability of variables themselves (https://godbolt.org/z/vGK7Ezo8j)? I suspect it may be unnecessary.

564

(typo, P => {)

[t-rasmud]

Address comments.

[NoQ]

We've had an offline discussion about this and I think the right way to do that architecturally is to separate concerns. The new gadget doesn't really participate in fixit generation all that much, it's only there for the strategy implications. We struggle to implement getClaimedVarUseSites() in a way that makes sense, because it doesn't make sense to implement it in the first place. This isn't really a FixableGadget, this is something else, like we can call it StrategyGadget and make getStrategyImplications() a pure virtual method of StrategyGadget while getClaimedVarUseSites() remains in FixableGadget. Then for this gadget we can leave fixit generation to the code that fixes variable declarations.

Same with the assignment gadget in the previous patch; we can split it into a StrategyGadget that returns implication but doesn't claim variables, and a FixableGadget that fixes variable uses depending on the chosen strategy without participating in deciding the strategy. In this case such separation has a valuable effect of removing the UUC check from the StrategyGadget's matcher, so that strategy implications were always visible regardless of our ability to enumerate all possible contexts in which it becomes fixable.

It also plays nicely with the idea that FixableGadget should have always been a very thin abstraction layer on top of RewriteRule. At first we were like "But muh strategy implications!" but now it's quite clear that we shouldn't really be conflating them together.

We should address this separately though. It'll keep biting us, so we *should* address it soon-ish, but the current patch works well and I that shouldn't stop us from having progress, so LGTM!

clang/lib/Analysis/UnsafeBufferUsage.cpp

564

I think they're both statement matchers, no need for an extra layer.

clang/include/clang/Analysis/Analyses/UnsafeBufferUsageGadgets.def

 WARNING_GADGET(UnsafeBufferUsageAttr)
 FIXABLE_GADGET(ULCArraySubscript)          // `DRE[any]` in an Unspecified Lvalue Context
 FIXABLE_GADGET(DerefSimplePtrArithFixable)
 FIXABLE_GADGET(PointerDereference)
 FIXABLE_GADGET(UPCAddressofArraySubscript) // '&DRE[any]' in an Unspecified Pointer Context
 FIXABLE_GADGET(UPCStandalonePointer)
 FIXABLE_GADGET(UPCPreIncrement)            // '++Ptr' in an Unspecified Pointer Context
 FIXABLE_GADGET(PointerAssignment)
+FIXABLE_GADGET(PointerInit)
 
 #undef FIXABLE_GADGET
 #undef WARNING_GADGET
 #undef GADGET

clang/lib/Analysis/UnsafeBufferUsage.cpp

DeclUseList getClaimedVarUseSites() const override {
     }
 
     return {};
   }
   // FIXME: pointer adding zero should be fine
   // FIXME: this gadge will need a fix-it
 };
 
+/// A pointer initialization expression of the form:
+///  \code
+///  int *p = q;
+///  \endcode
+class PointerInitGadget : public FixableGadget {
+private:
+  static constexpr const char *const PointerInitLHSTag = "ptrInitLHS";
+  static constexpr const char *const PointerInitRHSTag = "ptrInitRHS";
+  const VarDecl * PtrInitLHS;         // the LHS pointer expression in `PI`
+  const DeclRefExpr * PtrInitRHS;         // the RHS pointer expression in `PI`
+
+public:
+  PointerInitGadget(const MatchFinder::MatchResult &Result)
+      : FixableGadget(Kind::PointerInit),
+    PtrInitLHS(Result.Nodes.getNodeAs<VarDecl>(PointerInitLHSTag)),
+    PtrInitRHS(Result.Nodes.getNodeAs<DeclRefExpr>(PointerInitRHSTag)) {}
+
+  static bool classof(const Gadget *G) {
+    return G->getKind() == Kind::PointerInit;
+  }
+
+  static Matcher matcher() {
+    auto PtrInitStmt = declStmt(hasSingleDecl(varDecl(
+                                 hasInitializer(ignoringImpCasts(declRefExpr(
+                                                  hasPointerType()).
+                                                  bind(PointerInitRHSTag)))).
+                                              bind(PointerInitLHSTag)));
+
+    return stmt(PtrInitStmt);
+  }
+
+  virtual std::optional<FixItList> getFixits(const Strategy &S) const override;
+
+  virtual const Stmt *getBaseStmt() const override { return nullptr; }
+
+  virtual DeclUseList getClaimedVarUseSites() const override {
+    return DeclUseList{PtrInitRHS};
+  }
+
+  virtual std::optional<std::pair<const VarDecl *, const VarDecl *>>
+  getStrategyImplications() const override {
+      return std::make_pair(PtrInitLHS,
+                            cast<VarDecl>(PtrInitRHS->getDecl()));
+  }
+};
+
 /// A pointer assignment expression of the form:
 ///  \code
 ///  p = q;
 ///  \endcode
 class PointerAssignmentGadget : public FixableGadget {
 private:
-  static constexpr const char *const PointerAssignmentTag = "ptrAssign";
   static constexpr const char *const PointerAssignLHSTag = "ptrLHS";
   static constexpr const char *const PointerAssignRHSTag = "ptrRHS";
-  const BinaryOperator *PA;    // pointer arithmetic expression
   const DeclRefExpr * PtrLHS;         // the LHS pointer expression in `PA`
   const DeclRefExpr * PtrRHS;         // the RHS pointer expression in `PA`
 
 public:
   PointerAssignmentGadget(const MatchFinder::MatchResult &Result)
       : FixableGadget(Kind::PointerAssignment),
-    PA(Result.Nodes.getNodeAs<BinaryOperator>(PointerAssignmentTag)),
     PtrLHS(Result.Nodes.getNodeAs<DeclRefExpr>(PointerAssignLHSTag)),
     PtrRHS(Result.Nodes.getNodeAs<DeclRefExpr>(PointerAssignRHSTag)) {}
 
   static bool classof(const Gadget *G) {
     return G->getKind() == Kind::PointerAssignment;
   }
 
   static Matcher matcher() {
     auto PtrAssignExpr = binaryOperator(allOf(hasOperatorName("="),
       hasRHS(ignoringParenImpCasts(declRefExpr(hasPointerType(),
                                                to(varDecl())).
                                    bind(PointerAssignRHSTag))),
                                    hasLHS(declRefExpr(hasPointerType(),
                                                       to(varDecl())).
                                           bind(PointerAssignLHSTag))));
     
-    //FIXME: Handle declarations at assignments
     return stmt(isInUnspecifiedUntypedContext(PtrAssignExpr));
   }
   
   virtual std::optional<FixItList> getFixits(const Strategy &S) const override;
 
-  virtual const Stmt *getBaseStmt() const override { return PA; }
+  virtual const Stmt *getBaseStmt() const override { return nullptr; }
 
   virtual DeclUseList getClaimedVarUseSites() const override {
     return DeclUseList{PtrLHS, PtrRHS};
   }
 
   virtual std::optional<std::pair<const VarDecl *, const VarDecl *>>
   getStrategyImplications() const override {
     return std::make_pair(cast<VarDecl>(PtrLHS->getDecl()),
auto target = expr(
         ignoringParenImpCasts(declRefExpr(allOf(ArrayOrPtr, to(varDecl()))).bind(DeclRefExprTag)));
     return stmt(isInUnspecifiedPointerContext(target));
   }
 
   virtual std::optional<FixItList> getFixits(const Strategy &S) const override;
 
   virtual const Stmt *getBaseStmt() const override { return Node; }
 
   virtual DeclUseList getClaimedVarUseSites() const override {
     return {Node};
   }
 };
 
 class PointerDereferenceGadget : public FixableGadget {
   static constexpr const char *const BaseDeclRefExprTag = "BaseDRE";
   static constexpr const char *const OperatorTag = "op";
 
   const DeclRefExpr *BaseDeclRefExpr = nullptr;
   const UnaryOperator *Op = nullptr;
 
 public:
   PointerDereferenceGadget(const MatchFinder::MatchResult &Result)
       : FixableGadget(Kind::PointerDereference),
         BaseDeclRefExpr(
             Result.Nodes.getNodeAs<DeclRefExpr>(BaseDeclRefExprTag)),
         Op(Result.Nodes.getNodeAs<UnaryOperator>(OperatorTag)) {}
 
const auto *DRE =
         cast<DeclRefExpr>(ArraySubst->getBase()->IgnoreImpCasts());
     return {DRE};
   }
 };
 } // namespace
 
 namespace {
 // An auxiliary tracking facility for the fixit analysis. It helps connect
-// declarations to its and make sure we've covered all uses with our analysis
-// before we try to fix the declaration.
+// declarations to its uses and make sure we've covered all uses with our
+// analysis before we try to fix the declaration.
 class DeclUseTracker {
   using UseSetTy = SmallSet<const DeclRefExpr *, 16>;
   using DefMapTy = DenseMap<const VarDecl *, const DeclStmt *>;
 
   // Allocate on the heap for easier move.
   std::unique_ptr<UseSetTy> Uses{std::make_unique<UseSetTy>()};
   DefMapTy Defs{};
 
switch (S.lookup(LeftVD)) {
     case Strategy::Kind::Iterator:
     case Strategy::Kind::Array:
     case Strategy::Kind::Vector:
       llvm_unreachable("unsupported strategies for FixableGadgets");
   }
   return std::nullopt;
 }
 
+std::optional<FixItList>
+PointerInitGadget::getFixits(const Strategy &S) const {
+  const auto *LeftVD = PtrInitLHS;
+  const auto *RightVD = cast<VarDecl>(PtrInitRHS->getDecl());
+  switch (S.lookup(LeftVD)) {
+    case Strategy::Kind::Span:
+      if (S.lookup(RightVD) == Strategy::Kind::Span)
+        return FixItList{};
+      return std::nullopt;
+    case Strategy::Kind::Wontfix:
+      return std::nullopt;
+    case Strategy::Kind::Iterator:
+    case Strategy::Kind::Array:
+    case Strategy::Kind::Vector:
+    llvm_unreachable("unsupported strategies for FixableGadgets");
+  }
+  return std::nullopt;
+}
 
 std::optional<FixItList>
 ULCArraySubscriptGadget::getFixits(const Strategy &S) const {
   if (const auto *DRE =
           dyn_cast<DeclRefExpr>(Node->getBase()->IgnoreImpCasts()))
     if (const auto *VD = dyn_cast<VarDecl>(DRE->getDecl())) {
       switch (S.lookup(VD)) {
       case Strategy::Kind::Span: {
if (!DS->isSingleDecl()) {
     // FIXME: to support handling multiple `VarDecl`s in a single `DeclStmt`
     return {};
   }
   // Currently DS is an unused variable but we'll need it when
   // non-single decls are implemented, where the pointee type name
   // and the '*' are spread around the place.
   (void)DS;
 
   // FIXME: handle cases where DS has multiple declarations
   return fixVarDeclWithSpan(VD, Ctx, Handler.getUserFillPlaceHolder());
 }
 
 // TODO: we should be consistent to use `std::nullopt` to represent no-fix due
 // to any unexpected problem.
 static FixItList
 fixVariable(const VarDecl *VD, Strategy::Kind K,
             /* The function decl under analysis */ const Decl *D,
return llvm::any_of(FixIts, [](const FixItHint &Hint) {
     auto Range = Hint.RemoveRange;
     if (Range.getBegin().isMacroID() || Range.getEnd().isMacroID())
       // If the range (or the first token) is (part of) a macro expansion:
       return true;
     return false;
   });
 }
 
-static bool impossibleToFixForVar(const FixableGadgetSets &FixablesForUnsafeVars,
+static bool impossibleToFixForVar(const FixableGadgetSets &FixablesForAllVars,
                                   const Strategy &S,
                                   const VarDecl * Var) {
-  for (const auto &F : FixablesForUnsafeVars.byVar.find(Var)->second) {
+  for (const auto &F : FixablesForAllVars.byVar.find(Var)->second) {
     std::optional<FixItList> Fixits = F->getFixits(S);
     if (!Fixits) {
       return true;
     }
   }
   return false;
 }
 
 static std::map<const VarDecl *, FixItList>
-getFixIts(FixableGadgetSets &FixablesForUnsafeVars, const Strategy &S,
+getFixIts(FixableGadgetSets &FixablesForAllVars, const Strategy &S,
     ASTContext &Ctx,
           /* The function decl under analysis */ const Decl *D,
     const DeclUseTracker &Tracker, UnsafeBufferUsageHandler &Handler,
     const DefMapTy &VarGrpMap) {
   std::map<const VarDecl *, FixItList> FixItsForVariable;
-  for (const auto &[VD, Fixables] : FixablesForUnsafeVars.byVar) {
+  for (const auto &[VD, Fixables] : FixablesForAllVars.byVar) {
     FixItsForVariable[VD] =
         fixVariable(VD, S.lookup(VD), D, Tracker, Ctx, Handler);
     // If we fail to produce Fix-It for the declaration we have to skip the
     // variable entirely.
     if (FixItsForVariable[VD].empty()) {
       FixItsForVariable.erase(VD);
       continue;
     }
for (const auto &[VD, Fixables] : FixablesForAllVars.byVar) {
     }
     
     const auto VarGroupForVD = VarGrpMap.find(VD);
     if (VarGroupForVD != VarGrpMap.end()) {
       for (const VarDecl * V : VarGroupForVD->second) {
         if (V == VD) {
           continue;
         }
-        if (impossibleToFixForVar(FixablesForUnsafeVars, S, V)) {
+        if (impossibleToFixForVar(FixablesForAllVars, S, V)) {
           ImpossibleToFix = true;
           break;
         }
       }
 
       if (ImpossibleToFix) {
         FixItsForVariable.erase(VD);
         for (const VarDecl * V : VarGroupForVD->second) {

clang/test/SemaCXX/warn-unsafe-buffer-usage-multi-decl-ptr-init-fixits.cpp

+// RUN: %clang_cc1 -std=c++20 -Wunsafe-buffer-usage \
+// RUN:            -fsafe-buffer-usage-suggestions \
+// RUN:            -fdiagnostics-parseable-fixits %s 2>&1 | FileCheck %s
+
+void lhs_span_multi_assign() {
+  int *a = new int[2];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> a"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:22-[[@LINE-3]]:22}:", 2}"
+  int *b = a;
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> b"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:13-[[@LINE-3]]:13}:", <# placeholder #>}"
+  int *c = b;
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> c"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:13-[[@LINE-3]]:13}:", <# placeholder #>}"
+  int *d = c;
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> d"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:13-[[@LINE-3]]:13}:", <# placeholder #>}"
+  int tmp = d[2];  // expected-note{{used in buffer access here}}
+}
+
+void rhs_span1() {
+  int *q = new int[12];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> q"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:23-[[@LINE-3]]:23}:", 12}"
+  int *p = q;
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> p"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:13-[[@LINE-3]]:13}:", <# placeholder #>}"
+  p[5] = 10;
+  int *r = q;
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> r"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:13-[[@LINE-3]]:13}:", <# placeholder #>}"
+  r[10] = 5;  // expected-note{{used in buffer access here}}
+}
+
+void rhs_span2() {
+  int *q = new int[6];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> q"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:22-[[@LINE-3]]:22}:", 6}"
+  int *p = q;
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> p"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:13-[[@LINE-3]]:13}:", <# placeholder #>}"
+  p[5] = 10;  // expected-note{{used in buffer access here}}
+}
+
+void rhs_span3() {
+  int *q = new int[6];
+  int *p = q;  // expected-warning{{'p' is an unsafe pointer used for buffer access}}
+  p[5] = 10;  // expected-note{{used in buffer access here}}
+  int *r = q;
+}
+
+void test_grouping() {
+  int *z = new int[8];
+  int tmp;
+  int *y = new int[10];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> y"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:23-[[@LINE-3]]:23}:", 10}"
+  tmp = y[5];
+
+  int *x = new int[10];
+  x = y;
+
+  int *w = z;
+}
+
+void test_crash() {
+  int *r = new int[8];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> r"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:22-[[@LINE-3]]:22}:", 8}"
+  int *q = r;
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> q"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:13-[[@LINE-3]]:13}:", <# placeholder #>}"
+  int *p;
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:9}:"std::span<int> p"
+  p = q;
+  int tmp = p[9];  // expected-note{{used in buffer access here}}
+}

clang/test/SemaCXX/warn-unsafe-buffer-usage-multi-decl-ptr-init.cpp

+// RUN: %clang_cc1 -std=c++20 -Wunsafe-buffer-usage -fsafe-buffer-usage-suggestions -verify %s
+
+void lhs_span_multi_assign() {
+  int *a = new int[2];
+  int *b = a;
+  int *c = b;
+  int *d = c;  // expected-warning{{'d' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'd' to 'std::span' to preserve bounds information, and change ('a', 'b', and 'c'|'a', 'c', and 'b'|'b', 'a', and 'c'|'b', 'c', and 'a'|'c', 'a', and 'b'|'c', 'b', and 'a') to 'std::span' to propagate bounds information between them$}}}}
+  int tmp = d[2];  // expected-note{{used in buffer access here}}
+}
+
+void rhs_span1() {
+  int *q = new int[12];
+  int *p = q;  // expected-warning{{'p' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'p' to 'std::span' to preserve bounds information, and change ('q' and 'r'|'r' and 'q') to 'std::span' to propagate bounds information between them$}}}}
+  p[5] = 10;  // expected-note{{used in buffer access here}}
+  int *r = q;  // expected-warning{{'r' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'r' to 'std::span' to preserve bounds information, and change ('p' and 'q'|'q' and 'p') to 'std::span' to propagate bounds information between them$}}}}
+  r[10] = 5;  // expected-note{{used in buffer access here}}
+}
+
+void rhs_span2() {
+  int *q = new int[6];
+  int *p = q;  // expected-warning{{'p' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'p' to 'std::span' to preserve bounds information, and change 'q' to 'std::span' to propagate bounds information between them$}}}}
+  p[5] = 10;  // expected-note{{used in buffer access here}}
+}
+
+// FIXME: Suggest fixits for p, q, and r since span a valid fixit for r.
+void rhs_span3() {
+  int *q = new int[6];
+  int *p = q;  // expected-warning{{'p' is an unsafe pointer used for buffer access}}
+  p[5] = 10;  // expected-note{{used in buffer access here}}
+  int *r = q;
+}
+
+void test_grouping() {
+  int *z = new int[8];
+  int tmp;
+  int *y = new int[10];  // expected-warning{{'y' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'y' to 'std::span' to preserve bounds information$}}}}
+  tmp = y[5]; // expected-note{{used in buffer access here}}
+
+  int *x = new int[10];
+  x = y;
+
+  int *w = z;
+}
+
+void test_crash() {
+  int *r = new int[8];
+  int *q = r;
+  int *p;  // expected-warning{{'p' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'p' to 'std::span' to preserve bounds information, and change ('r' and 'q'|'q' and 'r') to 'std::span' to propagate bounds information between them$}}}}
+  p = q;
+  int tmp = p[9];  // expected-note{{used in buffer access here}}
+}

clang/test/SemaCXX/warn-unsafe-buffer-usage-multi-decl-uuc-fixits.cpp

void uuc_if_body1(bool flag) {
   // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
   // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:22-[[@LINE-3]]:22}:", 4}"
   if (flag) {
     p = r;
   }
   p[5] = 4;
 }
 
+void uuc_if_body2_ptr_init(bool flag) {
+  int *r = new int[7];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> r"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:22-[[@LINE-3]]:22}:", 7}"
+  if (flag) {
+  } else {
+    int* p = r;
+    // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:5-[[@LINE-1]]:13}:"std::span<int> p"
+    // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:14-[[@LINE-2]]:14}:"{"
+    // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:15-[[@LINE-3]]:15}:", <# placeholder #>}"
+    p[5] = 4;
+  }
+}
+
 void uuc_if_cond_no_unsafe_op() {
   int *r = new int[7];
   int *p = new int[4];
   if ((p = r)) {
     int x = 0;
   }
 }
 
 void uuc_if_cond_unsafe_op() {
   int *r = new int[7];
-  int *p = new int[4];  //expected-warning{{'p' is an unsafe pointer used for buffer access}}
+  int *p = new int[4];
   if ((p = r)) {
-    p[3] = 2;  // expected-note{{used in buffer access here}}
+    p[3] = 2;
   }
 }
 
 void uuc_if_cond_unsafe_op1() {
-  int *r = new int[7];  // expected-warning{{'r' is an unsafe pointer used for buffer access}}
+  int *r = new int[7];
   int *p = new int[4];
   if ((p = r)) {
-    r[3] = 2;  // expected-note{{used in buffer access here}}
+    r[3] = 2;
   }
 }
 
 void uuc_if_cond_unsafe_op2() {
-  int *r = new int[7];  // expected-warning{{'r' is an unsafe pointer used for buffer access}}
-  int *p = new int[4];  // expected-warning{{'p' is an unsafe pointer used for buffer access}}
+  int *r = new int[7];
+  int *p = new int[4];
   if ((p = r)) {
-    r[3] = 2;  // expected-note{{used in buffer access here}}
+    r[3] = 2;
   }
-  p[4] = 6;  // expected-note{{used in buffer access here}}
+  p[4] = 6;
 }
 
 void uuc_call1() {
-  int *w = new int[4];  // expected-warning{{'w' is an unsafe pointer used for buffer access}}
+  int *w = new int[4];
   int *y = new int[4];
   bar(w = y);
-  w[5] = 0;  // expected-note{{used in buffer access here}}
+  w[5] = 0;
 }

clang/test/SemaCXX/warn-unsafe-buffer-usage-multi-decl-uuc.cpp

void uuc_if_body2(bool flag) {
   if (flag) {
   } else {
     p = r;
   }
 
   p[5] = 4;  // expected-note{{used in buffer access here}}
 }
 
+void uuc_if_body2_ptr_init(bool flag) {
+  int *r = new int[7];
+  if (flag) {
+  } else {
+    int* p = r;  // expected-warning{{'p' is an unsafe pointer used for buffer access}} // expected-note-re{{{{^change type of 'p' to 'std::span' to preserve bounds information, and change 'r' to 'std::span' to propagate bounds information between them$}}}}
+    p[5] = 4;  // expected-note{{used in buffer access here}}
+  }
+}
+
 void uuc_if_cond_no_unsafe_op() {
   int *r = new int[7];
   int *p = new int[4];
   if ((p = r)) {
     int x = 0;
   }
 }
 

clang/test/SemaCXX/warn-unsafe-buffer-usage-multi-decl-warnings.cpp

void local_assign_lhs_span() {
   int tmp;
   int* p = new int[10];  // expected-warning{{'p' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'p' to 'std::span' to preserve bounds information, and change 'q' to 'std::span' to propagate bounds information between them$}}}}
   tmp = p[4];  // expected-note{{used in buffer access here}}
   int* q = new int[10];
 
   p = q;
 }
 
-
-// FIXME: Support initializations at declarations.
 void lhs_span_multi_assign() {
   int *a = new int[2];
   int *b = a;
   int *c = b;
-  int *d = c;  // expected-warning{{'d' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'd' to 'std::span' to preserve bounds information$}}}}
+  int *d = c;  // expected-warning{{'d' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'd' to 'std::span' to preserve bounds information, and change ('a', 'b', and 'c'|'a', 'c', and 'b'|'b', 'a', and 'c'|'b', 'c', and 'a'|'c', 'a', and 'b'|'c', 'b', and 'a') to 'std::span' to propagate bounds information between them$}}}}
   int tmp = d[2];  // expected-note{{used in buffer access here}}
 }
 
 void rhs_span() {
   int *x = new int[3];
   int *y;  // expected-warning{{'y' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'y' to 'std::span' to preserve bounds information$}}}}
   y[5] = 10;  // expected-note{{used in buffer access here}}
 
   x = y;
 }
 
 void rhs_span1() {
   int *q = new int[12];
-  int *p = q;  // expected-warning{{'p' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'p' to 'std::span' to preserve bounds information$}}}}
+  int *p = q;  // expected-warning{{'p' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'p' to 'std::span' to preserve bounds information, and change ('q' and 'r'|'r' and 'q') to 'std::span' to propagate bounds information between them$}}}}
   p[5] = 10;  // expected-note{{used in buffer access here}}
-  int *r = q;  // expected-warning{{'r' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'r' to 'std::span' to preserve bounds information$}}}}
+  int *r = q;  // expected-warning{{'r' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'r' to 'std::span' to preserve bounds information, and change ('p' and 'q'|'q' and 'p') to 'std::span' to propagate bounds information between them$}}}}
   r[10] = 5;  // expected-note{{used in buffer access here}}
 }
 
 void rhs_span2() {
   int *q = new int[6];
-  int *p = q;  // expected-warning{{'p' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'p' to 'std::span' to preserve bounds information$}}}}
+  int *p = q;  // expected-warning{{'p' is an unsafe pointer used for buffer access}}
   p[5] = 10;  // expected-note{{used in buffer access here}}
   int *r = q;
 }
 
 void test_grouping() {
   int *z = new int[8];
   int tmp;
   int *y = new int[10];  // expected-warning{{'y' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'y' to 'std::span' to preserve bounds information$}}}}
void foo3b() {
   q = p;
   int tmp = q[8];  // expected-note{{used in buffer access here}}
   q = r;
 }
 
 void test_crash() {
   int *r = new int[8];
   int *q = r;
-  int *p;  // expected-warning{{'p' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'p' to 'std::span' to preserve bounds information, and change 'q' to 'std::span' to propagate bounds information between them$}}}}
+  int *p;  // expected-warning{{'p' is an unsafe pointer used for buffer access}} expected-note-re{{{{^change type of 'p' to 'std::span' to preserve bounds information, and change ('r' and 'q'|'q' and 'r') to 'std::span' to propagate bounds information between them$}}}}
   p = q;
   int tmp = p[9];  // expected-note{{used in buffer access here}}
 }
 
 void foo_uuc() {
   int *ptr;
   int *local;  // expected-warning{{'local' is an unsafe pointer used for buffer access}}
   local = ptr;