'Scan for constants that might be used as exit targets later, and add them into pending_exits.
:param SimState successor_state: A successing state.
:return:                                 A list of discovered code addresses.
:rtype:                                  list'

def _search_for_function_hints(self, successor_state):

    function_hints = []
    for action in successor_state.history.recent_actions:
        if ((action.type == 'reg') and (action.offset == self.project.arch.ip_offset)):
            continue
        elif (action.type == 'exit'):
            continue
        if isinstance(action, SimActionData):
            data = action.data
            if (data is not None):
                try:
                    const = successor_state.se.exactly_n_int(data.ast, 1)[0]
                except:
                    continue
                if self._is_address_executable(const):
                    if ((self._pending_function_hints is not None) and (const in self._pending_function_hints)):
                        continue
                    function_hints.append(const)
    l.debug('Got    %d    possible    exits,    including:    %s', len(function_hints), ',    '.join([('0x%x' % f) for f in function_hints]))
    return function_hints
