Fix #12453 fuzzing timeout in getUnsafeFunction()

[chrchr-github]

No description provided.

[firewave]

Need to merge #6018 first and rebase on that to make sure everything it working fine. The timeout was kinda broken.

[chrchr-github]

We could also throw an error in findExpressionStartEndTokens() to be on the safe side.

[firewave]

We could also throw an error in findExpressionStartEndTokens() to be on the safe side.

Do what you think is appropriate.

One of the fuzzing improvements so we use input closer to real code is that I would discard all cases where we encounter a syntaxError. That would prevent us from finding more potential issues but seems like more reasonable. I already do that for simplecpp.

[chrchr-github]

void f(double(&)[4]) {}
For &, findExpressionStartEndTokens() returns double as both start and end. Is this expected behavior?

There is an AST issue, ( only has one operand when there is no variable.

Additionally,

class c {
  typedef char foo[4];
  foo _a;
  operator foo &() { return _a; }
};

gets simplified to

2: class c {
3:
4: char _a@var1 [ 4 ] ;
5: operatorchar ( & ( ) ) [ 4 ] { return _a@var1 ; }
6: } ;

which is wrong.