Module escape 

Escape analysis: does a pointer leave its defining frame? (DF-8).

Build an escape-propagation Program:

use weir::escape::escape_analyze_with_count;

let program = escape_analyze_with_count("pts", "cg", "out", 64);

DF-8 - escape analysis.

Does this pointer leave its defining frame / cross a trust boundary? Closure over assignments to parameters, return values, heap fields reachable from globals, and indirect-call arguments.

Implementation

Escape is a reachability fixpoint in bitset space:

• escapes[v] is set iff any of:
  • v is a root (written to global, parameter, return value, indirect-call argument - seeded by caller),
  • v points to an escaped object (propagated through points_to),
  • v is passed to an escaped callee (propagated through callgraph).

Per invocation we OR-union both channels and AND-mask against the current escape-status to emit the new escape set. The caller drives the fixpoint via bitset_fixpoint and stops when the bitset is unchanged.

Soundness: MayOver.

Required for C03 (double-free on concurrent path), C17 (fd passing confused-deputy).

Structs

Escape

Marker type for the escape-analysis dataflow primitive.

Functions

escape_analyze

One escape-propagation step. Output bit v is set iff any of points_to_in[v], callgraph_in[v], or prior escape_out[v] was set. Host runs this in a fixpoint until the bitset is unchanged.

escape_analyze_with_count

Version that takes the lane count explicitly.