https://github.com/NagyDonat commented:
I added a few additional suggestions in inline comments (I'm still not done with reviewing every part of the code đŸ˜…). However, I'm also anxious about the overall size and complexity of this checker code. Unfortunately the toolbox of the analyzer contains many footguns, and if you write so much code, you will almost surely introduce a few logic errors (like the ones that I highlighted in this part of the review). AI "assistance" is especially dangerous here, because it tends to assume that the called functions behave reasonably -- and this is not a safe assumption on this codebase đŸ˜“. I can catch some of these errors because I'm familiar with some of the footguns (because I've shot myself in the foot with several of them đŸ˜…), but it would be very difficult to reach a level where I can confidently claim that the PR is logically correct. (My instincts say that it may be possible to "take shortcuts" and implement smarter logic that is – at least on real-world code – checks whether an array is null-terminated in an easier way.) ------ I'm also curious about the motivations and use cases behind this PR (especially since it is a big task, even just reviewing it would take lots of time). Are there concrete projects where you want to use this? Did you try to analyze real-world code with the current implementation? Is is capable of finding real-world bugs? https://github.com/llvm/llvm-project/pull/188128 _______________________________________________ cfe-commits mailing list [email protected] https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
