================
@@ -324,6 +326,10 @@ void FactsGenerator::VisitCastExpr(const CastExpr *CE) {
flow(Dest, Src, /*Kill=*/true);
return;
case CK_ArrayToPointerDecay:
+ // va_arg(ap, array_type) is UB and does not provide addressable array
+ // storage to model.
+ if (isa<VAArgExpr>(SubExpr))
----------------
Xazax-hun wrote:
Did this trigger a crash or a false positive? I wonder if `VAArgExpr` can
appear at more places where it can wreak havoc.
https://github.com/llvm/llvm-project/pull/203270
_______________________________________________
cfe-commits mailing list
[email protected]
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
