Make UninitializedValues detect the use of uninitialized fields in a constructor.

[epertoso]

Summary

This patch removes DiagnoseUninitializedFields from SemaDeclCXX, and modifies the UninitializedValues checker to detect the use of uninitialized fields not only in member initializer lists, but also in the constructor bodies.

[klimek]

+richard as reviewer

[rsmith]

This looks really exciting, and a great direction for the -Wuninitialized warning. (I'm a little sad that we're losing the enabled-by-default warning here, but I can live with that...)

I think there are a few small pieces here that you could factor out and could be committed separately (handling of .* and ->*, for instance).

Longer-term, I think it'd be useful to extend this to model subobjects of fields and base classes (for instance, we should catch using a field of base class B2 from an initializer for base class B1), but this is a big step in the right direction, and I certainly don't want any scope creep on this change.

Have you run this over a significant quantity of code? Does it find many bugs, and were there any false positives?

lib/Analysis/UninitializedValues.cpp

53–54

Micro-optimization: move the if (!cd) test to before the loop.

97

The isTrackedField check here seems redundant. All fields you will see here are tracked.

304–310

Why do you need the extra complexity of building a list and iterating backwards here, rather than just visiting the children inside the first loop?

306

" &", not "& ", please.

[rsmith]

lib/Analysis/UninitializedValues.cpp

41

You seem to have no problem dealing with fields of non-scalar, non-vector types. I expect you could do the same for variables.

55

What if the field is of a class type with no data members?

struct X {};
struct Y {
  X x, y;
  Y() : y(x) {} // should probably not warn, but presumably will
};

323

if is redundant: fd can't be null here. Please combine this with the above check to use a dyn_cast:

FieldDecl *fd = dyn_cast<FieldDecl>(me->getMemberDecl());
if (!fd)
  return 0;
// ...

392

I don't think it matters, but !D || !isTracked(D) makes more sense to me.

426

I think this should be classified as Use. If we have:

(x ?: y) = 0;

x is used before it's initialized. Maybe this doesn't matter, because we'll separately have an lvalue-to-rvalue conversion for x?

Can you change the above ConditionalOperator code to instead handle AbstractConditionalOperator and fold the two checks together?

469–470

Why is this necessary? This would seem to fall under the general rule that "if we can't classify it, it's initialization".

493

Did you mean to use IsPointerToConst here?

496–500

Please add braces around this.

512

This looks like it would do the wrong thing if we had a c-style cast that only performed an lvalue-to-rvalue conversion or decay. Push the return into the void check?

519

This looks curious. Treating this case as Init seems appropriate to me: we don't track how the resulting pointer is used, and it might be used to initialize the object. Is the idea to ignore all array subobjects of class type in the analysis? That is:

struct X {
  int a[3];
  int b;
};
struct Y {
  X x;
  Y() {
    x.a[0] = 1; // don't treat 'x' as initialized
    x.a[1] = x.b; // warning: 'x' used uninitialized
  }
};

If so, this really deserves a comment.

535

Seems this case should apply if any of the FieldDecls in the chain are of reference type, not just if the last one is.

552–557

This looks suspicious. If we're visiting a CXXDefaultInitExpr for an object other than this, and that initializer references this, we'll think that we have a reference to one of our subobjects, but we don't.

566

" *", not "* ".

567

Do you really need a member for this? Seems trivial to reconstruct.

755–756

I assume you're trying to cope with this[0].blah here? This doesn't look quite right: it'll also find this[-1].blah (which might sometimes be valid) and will do the wrong thing on 0[this].blah. Maybe just drop the array indexing support here -- it's a corner case and not worth the cost of getting all the details right.

765–769

What about indirect fields from anonymous structs or unions?

803–817

Handle this in VisitCallExpr instead. This approach will do the wrong thing for a call to an operator marked returns_twice or analyzer_noreturn, or for an explicit call to the assignment operator, like this->operator=(foo);

824–825

if (constructor) ?

839–852

Please either fold this into VisitCallExpr or call VisitCallExpr if you don't handle the call here.

884

Is the cast here correct? findLeftmostMemberExpr might return a MemberExpr that references a static member (for an expression like this->static_member), and that's a VarDecl, not a FieldDecl.

898–899

I'm unconvinced that this and the CXXThisExpr-as-function-argument checks are sufficient; CXXThisExpr could be used to indirectly initialize the object through various other forms of expression. I think you should make the classification code also classify all the CXXThisExprs, and treat all fields as initialized if we see a CXXThisExpr that is classified as Init.

949–956

Again, I don't think this does the right thing if this appears in a default initializer for an object other than *this. Elsewhere we handle this by visiting the CXXDefaultInitExpr while holding an override for what this binds to. You could do something similar here.

986–987

Do you need to pass these in? TransferFunctions can work this out for itself.

993

" *", not "* ".

lib/Sema/AnalysisBasedWarnings.cpp

1243

" *"

lib/Sema/SemaDeclCXX.cpp

7980–7984

A comment explaining this would be useful.

test/SemaCXX/uninitialized.cpp

444

We should really warn on this. A FIXME for that would be nice.

[epertoso]

Thanks for the review.

Yes, I've run it over a big code base. I didn't spot false positives, but I still think there are too many false negatives.

lib/Analysis/UninitializedValues.cpp

41

Maybe. I'd prefer to run a few test before.

53–54

Done.

55

It doesn't, x is default initialized.

97

Done.

304–310

That's the way statements are appended to the CFG in the base case.
But it doesn't seem to cause problems if I don't do it here (classify is always called when there's enough context).

306

Done.

323

Done.

392

Done.

426

Done.
But we have to explicitly classify the common expr as Use, because an OpaqueValueExpr will appear between the lvalue-to-rvalue cast and x.

469–470

Done. It wasn't, indeed.

493

Done.

496–500

Done.

512

Done.

519

This is actually another case in which x is treated as initialized because the default constructor is called, hence x is immediately treated as initialized.
The analysis could potentially be made smarter for aggregates, but I'm not sure this patch is the best place to do it.

This was intended for:

void foo(int *a);
struct X {
  int a[3];
  int b;
  X() {
    foo(a);
    b = a[1]; // do not warn on 'a' here.
  }
};

But actually it's not necessary because the current code is not classifying ArraySubscriptExprs.
Should I try to deal with ArraySubscriptExpr it in this same patch?

535

I'm not sure I understand:

struct A {
  int &a;
};
struct B {
  A &a;
  B(int) {}
};
struct C {
  B &ref;
  B b;
  C() : b(ref.a.a) {}
  C(B &o) : b(o.a.a) {}
};

The only thing we know here is that "ref" is uninitialized.
Do you have anything specific in mind?

552–557

isTrackedField verifies that the specified field has the same parent of the constructor. A CXXDefaultInitExpr appears either in a CtorInitializer or within the context of (c++1y) aggregate initialization, in which case the record of the current constructor and that of any MemberExpr## in the aggregate can't be the same.

566

Done.

567

Done.

755–756

Actually no. This just detects things like

struct X {
  int x, y;
  X(int f) {
    reinterpret_cast<int*>(this)[0] = f;
    y = x;
  }
};

Warning on y = x is wrong. On the other hand, I'm simply doing as if this escaped analysis here, and yes, it won't work on 0[reinterpret_cast<int*>(this)] = f.
It's still seems to be a corner case, though, plus it's not warning on member access via this[0].

Should I still drop this?

765–769

Done.

803–817

Done.
An explicit call to the assignment operator would have been handled by VisitCXXMemberCallExpr, but I've also moved that code in VisitCallExpr.
I added the tests for both: *this = foo and this->operator=(foo) in uninitialized.cpp.

824–825

Done.

839–852

Done.

884

Yes. classification.get(e) calls ClassifyRefs::isTracked, which will be false for such a VarDecl.

898–899

I'll try to do it. I need a little more time.

949–956

Please see my comment in ClassifyRefs::VisitCXXDefaultInitExpr.

986–987

Done.

993

Done.

lib/Sema/AnalysisBasedWarnings.cpp

1243

Done.

lib/Sema/SemaDeclCXX.cpp

7980–7984

Done.

test/SemaCXX/uninitialized.cpp

444

I don't think we should. J is a union, and one of its fields (a) has been initialized.
If you're really sure that a warning should still be issued here, it's actually easier to do so rather than not.

[rsmith]

lib/Analysis/UninitializedValues.cpp

304–310

Hmm, does this do good things if there is control flow in the CXXDefaultInitExpr?

struct S {
  enum Kind { Foo, Bar } K;
  int FooVal;
  int BarVal;
  int Value = K == Foo ? FooVal : BarVal;
  S() : K(Foo), FooVal(0) {} // warning about uninitialized use of BarVal?
};

Maybe we should teach the CFG builder to inline CXXDefaultInitExprs when they appear as a CXXCtorInitializer? That should not break the CFG's invariants, and allow you to drop a lot (all?) of your special-case handling for them (since you don't actually want to walk into them when they occur within aggregate initialization).

519

My preference would be to keep this patch as small as possible while adding the new constructor-handling functionality. I'd prefer for ArraySubscriptExpr support to be added separately if that's practical.

535

Suppose we had:

struct A { int n; };
struct B { A &a; };
struct C {
  int n;
  B b;
  C(A &a) : b{a}, n(b.a.n = 0) {}
};

Here (because the n initializer runs before the b initializer), b is uninitialized in the b.a.n = 0 expression. Because b.a is a reference, that expression is a use of b, not an initialization of it. So we should diagnose this.

552–557

I don't think that is the case. For instance:

struct A {
  int a;
  int b;
  int c;
  struct B;
  A();
};
struct A::B : A {
  int d = (c = 0);
};
A::A() : a(B{}.d), b(c) {} // B{} should not mark our `c` as initialized.

As I alluded to in another comment, I think we could handle this correctly by not walking into a CXXDefaultInitExpr in aggregate initialization (perhaps only walk into them when they appear at the top level in a CtorInitializer, and do that in the CFG builder).

755–756

Unless you have real-world examples of bugs the extra accuracy catches here, I'd prefer to drop this for simplicity's sake.

test/SemaCXX/uninitialized.cpp

444

Well, it's undefined behavior to write to field a then read from field b. The "uninitialized" warning isn't really the right one to issue, though, so I think your approach in this patch is fine.

[rsmith]

include/clang/Analysis/Analyses/UninitializedValues.h

51

Please extend the comment here: something like "If the use happens in a default initializer for a field, this is the constructor in which the default initializer was used."

74

Maybe getConstructorForDefaultInit?

[epertoso]

include/clang/Analysis/Analyses/UninitializedValues.h

51

Done.

74

Done.

lib/Analysis/UninitializedValues.cpp

304–310

The only difference I see is that, as there's no control flow information at all, what's usually reported as sometimes uninitialized will be reported as always uninitialized.
But I'll have a look at the CFGBuilder.

493

I've changed this a bit to make sure that #IsPointerToConst() is only called if (*I)->isGLValue()## is false. This is to avoid a regression for cases like:

int foo(const int *&a) { a = &some_global_int_; }
void bar() {
  const int *j;
  foo(j); // don't classify the DeclRefExpr for j as Ignore here, just let it escape
  int a = *j;
}

519

Acknowledged.

535

Thanks, you helped me diagnose a bigger problem here (record access wasn't being counted as use in general).
I did this because when you have

struct A {
  int &a;
  int &b;
  int n;
  A() : a(b), n(b) {}
};

the use of b in n(b) will be detected because of the lvalue-to-rvalue cast, but there's no such cast on references.
Each MemberExpr is visited, so the code warns on your example. I've added a test case.

552–557

In that case B{} is a CXXConstructExpr. You can't use aggregate initialization for B because it has a base class.
Unless there's a change in the aggregate definition after n3653.

755–756

Actually, it prevents a false warning, but it's still not common. I'll get rid of it.

And I've realized that this function could get into an infinite loop. Fixed that.

test/SemaCXX/uninitialized.cpp

444

Acknowledged.

[epertoso]

CFGBuilder now appends the expressions wrapped by a CXXDefaultInitExpr.

[rsmith]

This looks really great. Let's start getting bits of this checked in!

I've marked a few pieces of this patch that I'd like to be checked in as separate pieces (to avoid the big monolithic change here). In addition to those, can you factor out the CXXDefaultInitExpr handling code into a separate patch, too?

Additionally, now we've basically converged on the functional side, there's a couple of coding standard issues that should be sorted out prior to commit. Variable names should be capitalized (don't worry about pre-existing variables in this file, it's currently a big mess with regard to coding style issues), and you have a "* " in ClassifyRefs::VisitMemberExpr.

After getting the side-pieces committed, we can circle back to the bulk of this patch. There's only really one substantive comment that I have there (and I think it's something you said you're already working on): it's hard to tell if CXXThisExpr is being handled appropriately in all cases, and I'd like for it to be tracked with a ClassifyRefs-based approach too (so if a CXXThisExpr escapes we can conservatively-correctly mark all fields as initialized). I don't know what you think about this -- do you think the patch is already handling this sufficiently reliably that it'd be OK to commit without this, and fix it up later? I know you've tested this against a lot of code already, but cases like passing this through an ObjCMessageExpr or a CXXConstructExpr (which may not have come up in your testing) don't look like they're handled here.

lib/Analysis/UninitializedValues.cpp

391

Do you need the isa check here? This should only be called on DeclRefExpr and MemberExpr, as far as I can tell, so we should assert if something else gets passed in (or, ideally, not compile).

393–394

I'm concerned about this removal. The old model was:

• Visiting the DeclRefExpr on the LHS of an assignment does not initialize the variable
• Visiting the assignment expression itself initializes the variable on its LHS

The new model seems to be:

• Visiting the DeclRefExpr or MemberExpr on the LHS of an assignment initializes the variable or field
• Visiting the assignment expression itself *also* initializes the variable

I think this may be subtly incorrect. If we have:

int x;
x = x + 1;

... and the CFG happens to emit the LHS and then the RHS, we won't find the uninitialized use, because we'll think that x is already initialized.

413–437

The improvements here are great, but they're orthogonal to handling class members. Please factor them out into a separate patch.

476–480

This comment could describe what's going on here better. Usually if an address is taken, we treat the value as initialized; the thing we should call out here is that the value is *not* treated as initialized if passed to a const pointer parameter. Maybe just change the first comment to "If a value is passed by const pointer or const reference to a function, ..."?

487–493

This is orthogonal to field handling; please break this out into a separate patch.

495–500

What happens here:

int f();
struct S {
  int a, b;
  int init() { a = b = 0; return f(); }
};
struct T {
  int k;
  S s;
  T() { s.init(); } // ok? warning?
  T(int) : k(s.init()) {} // ok? warning?
};

I think both of these are fine: because T::s has trivial initialization, its lifetime begins when storage for it is obtained (per [basic.life]p1).

519–523

Is this necessary? The VisitMemberExpr check seems like it should do the right thing here.

541–544

This doesn't look quite right (though I think the issue is in findLeftmostMemberExpr). Consider:

this->member.static_member.non_static_member

When we visit this, I think we'll mark 'member' as Use. Suggestion: teach findLeftmostMemberExpr not to walk through MemberExprs for static data members.

547–550

I think you should also handle the arguments the same way that VisitCallExpr does.

struct A { A(const int&); };
struct B {
  int x, y;
  B() { A a(x); y = x; } // should warn on this
};

I think we won't warn here, because our usual handling for conservatively marking the x in a(x) as Ignore won't fire.

(Even if this is a copy or move constructor, it could still have additional arguments, so you should do this in that case too.)

That said, this is also orthogonal to handling of fields, and fixing this in a separate patch would be preferred.

993

This counting approach seems rather complex to me, and I think we can get the same effect with something much simpler: remove the 'ReportConstructor' code entirely, and when you come to issue a diagnostic for an uninitialized use of a field, check whether the source location of the use is within the source range of the constructor. If not, emit the additional note pointing out which constructor it was.

lib/Sema/AnalysisBasedWarnings.cpp

1672

I don't think you need this any more.

[jordan_rose]

The analyzer can probably be modified (later) to take advantage of this as well. Awesome.

lib/Analysis/CFG.cpp

769–777

I'm assuming "the context is not ambiguous here" means "we can guarantee that this expression will only appear once in the CFG, unlike when it is used in list-initialization". That's why we didn't do this before.

It would be nice to have a CFG validator that enforced this "appears-once" restriction, but that can come later.

lib/Analysis/UninitializedValues.cpp

993

I'm always iffy about source ranges because of macros. It doesn't seem like it'd be too awful if it misfired here, but at the same time you could notice that the field (a) has an in-class initializer, and (b) does not have an associated initializer. (And calculate the latter with a simple linear walk, since we've already decided to emit an error message.)

[rsmith]

lib/Analysis/CFG.cpp

769–777

Exactly; we only expand default initializers when they're (implicitly) used from a constructor initializer list, and each such default initializer can only be used once in any given constructor. Maybe a more detailed comment here would help.

lib/Analysis/UninitializedValues.cpp

993

isBeforeInTranslationUnit does the right thing in the presence of macros (it compares the order of tokens after preprocessing).

[klimek]

Remind me: what's the state of this?

include/clang/Analysis/Analyses/UninitializedValues.h

 
 #include "clang/AST/Stmt.h"
 #include "llvm/ADT/SmallVector.h"
 
 namespace clang {
 
 class AnalysisDeclContext;
 class CFG;
+class CXXConstructorDecl;
 class DeclContext;
 class Expr;
 class VarDecl;
 
-/// A use of a variable, which might be uninitialized.
+/// A use of a variable or field, which might be uninitialized.
 class UninitUse {
 public:
   struct Branch {
     const Stmt *Terminator;
     unsigned Output;
   };
 
 private:
   /// The expression which uses this variable.
   const Expr *User;
 
   /// Is this use uninitialized whenever the function is called?
   bool UninitAfterCall;
 
   /// Is this use uninitialized whenever the variable declaration is reached?
   bool UninitAfterDecl;
 
   /// Does this use always see an uninitialized value?
   bool AlwaysUninit;
 
+  /// If this use happens in a default initializer for a field, this is the
+  /// constructor in which that initializer was used.
+  const CXXConstructorDecl *Constructor;
+
   /// This use is always uninitialized if it occurs after any of these branches
   /// is taken.
   SmallVector<Branch, 2> UninitBranches;
 
 public:
-  UninitUse(const Expr *User, bool AlwaysUninit)
+  UninitUse(const Expr *User, bool AlwaysUninit,
+            const CXXConstructorDecl *Constructor = 0)
       : User(User), UninitAfterCall(false), UninitAfterDecl(false),
-        AlwaysUninit(AlwaysUninit) {}
+        AlwaysUninit(AlwaysUninit), Constructor(Constructor) {}
 
   void addUninitBranch(Branch B) {
     UninitBranches.push_back(B);
   }
 
   void setUninitAfterCall() { UninitAfterCall = true; }
   void setUninitAfterDecl() { UninitAfterDecl = true; }
 
   /// Get the expression containing the uninitialized use.
   const Expr *getUser() const { return User; }
+  const CXXConstructorDecl *getConstructorForDefaultInit() const {
+    return Constructor;
+  }
 
   /// The kind of uninitialized use.
   enum Kind {
     /// The use might be uninitialized.
     Maybe,
     /// The use is uninitialized whenever a certain branch is taken.
     Sometimes,
     /// The use is uninitialized the first time it is reached after we reach

 };
 
 class UninitVariablesHandler {
 public:
   UninitVariablesHandler() {}
   virtual ~UninitVariablesHandler();
 
   /// Called when the uninitialized variable is used at the given expression.
-  virtual void handleUseOfUninitVariable(const VarDecl *vd,
+  virtual void handleUseOfUninitVariable(const ValueDecl *vd,
                                          const UninitUse &use) {}
 
   /// Called when the uninitialized variable analysis detects the
   /// idiom 'int x = x'.  All other uses of 'x' within the initializer
   /// are handled by handleUseOfUninitVariable.
-  virtual void handleSelfInit(const VarDecl *vd) {}
+  virtual void handleSelfInit(const ValueDecl *vd) {}
 };
 
 struct UninitVariablesAnalysisStats {
   unsigned NumVariablesAnalyzed;
   unsigned NumBlockVisits;
 };
 
 void runUninitializedVariablesAnalysis(const DeclContext &dc, const CFG &cfg,
                                        AnalysisDeclContext &ac,
                                        UninitVariablesHandler &handler,
                                        UninitVariablesAnalysisStats &stats);
 
 }
 #endif

include/clang/Basic/DiagnosticSemaKinds.td

 def warn_uninit_self_reference_in_init : Warning<
   "variable %0 is uninitialized when used within its own initialization">,
   InGroup<Uninitialized>;
 def warn_uninit_self_reference_in_reference_init : Warning<
   "reference %0 is not yet bound to a value when used within its own"
   " initialization">,
   InGroup<Uninitialized>;
 def warn_uninit_var : Warning<
-  "variable %0 is uninitialized when %select{used here|captured by block}1">,
+  "%select{variable|field}0 %1 is uninitialized when %select{used here|captured by block}2">,
   InGroup<Uninitialized>, DefaultIgnore;
 def warn_sometimes_uninit_var : Warning<
-  "variable %0 is %select{used|captured}1 uninitialized whenever "
-  "%select{'%3' condition is %select{true|false}4|"
-  "'%3' loop %select{is entered|exits because its condition is false}4|"
-  "'%3' loop %select{condition is true|exits because its condition is false}4|"
-  "switch %3 is taken|"
+  "%select{variable|field}0 %1 is %select{used|captured}2 uninitialized whenever "
+  "%select{'%4' condition is %select{true|false}5|"
+  "'%4' loop %select{is entered|exits because its condition is false}5|"
+  "'%4' loop %select{condition is true|exits because its condition is false}5|"
+  "switch %4 is taken|"
   "its declaration is reached|"
-  "%3 is called}2">,
+  "%4 is called}3">,
   InGroup<UninitializedSometimes>, DefaultIgnore;
 def warn_maybe_uninit_var : Warning<
-  "variable %0 may be uninitialized when "
-  "%select{used here|captured by block}1">,
+  "%select{variable|field}0 %1 may be uninitialized when "
+  "%select{used here|captured by block}2">,
   InGroup<UninitializedMaybe>, DefaultIgnore;
 def note_uninit_var_def : Note<"variable %0 is declared here">;
 def note_uninit_var_use : Note<
   "%select{uninitialized use occurs|variable is captured by block}0 here">;
 def warn_uninit_byref_blockvar_captured_by_block : Warning<
   "block pointer variable %0 is uninitialized when captured by block">,
   InGroup<Uninitialized>, DefaultIgnore;
 def note_block_var_fixit_add_initialization : Note<

lib/Analysis/CFG.cpp

CFGBlock *CFGBuilder::addInitializer(CXXCtorInitializer *I) {
   appendInitializer(Block, I);
 
   if (Init) {
     if (HasTemporaries) {
       // For expression with temporaries go directly to subexpression to omit
       // generating destructors for the second time.
       return Visit(cast<ExprWithCleanups>(Init)->getSubExpr());
     }
+    if (CXXDefaultInitExpr *Default = dyn_cast<CXXDefaultInitExpr>(Init)) {
+      // Append the actual expression here. The context is not ambiguous here.
+      autoCreateBlock();
+      appendStmt(Block, Default);
+      if (Stmt *Child = Default->getExpr())
+        if (CFGBlock *R = Visit(Child))
+          Block = R;
+      return Block;
+    }
     return Visit(Init);
   }
-
   return Block;
 }
 
 /// \brief Retrieve the type of the temporary object whose lifetime was 
 /// extended by a local reference with the given initializer.
 static QualType getReferenceInitTemporaryType(ASTContext &Context,
                                               const Expr *Init) {
   while (true) {

lib/Analysis/UninitializedValues.cpp

 //==- UninitializedValues.cpp - Find Uninitialized Values -------*- C++ --*-==//
 //
 //                     The LLVM Compiler Infrastructure
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 //
 // This file implements uninitialized values analysis for source-level CFGs.
 //
 //===----------------------------------------------------------------------===//
 
 #include "clang/AST/ASTContext.h"
 #include "clang/AST/Attr.h"
 #include "clang/AST/Decl.h"
+#include "clang/AST/DeclCXX.h"
 #include "clang/AST/StmtVisitor.h"
 #include "clang/Analysis/Analyses/PostOrderCFGView.h"
 #include "clang/Analysis/Analyses/UninitializedValues.h"
 #include "clang/Analysis/AnalysisContext.h"
 #include "clang/Analysis/CFG.h"
 #include "clang/Analysis/DomainSpecific/ObjCNoReturn.h"
 #include "llvm/ADT/DenseMap.h"
 #include "llvm/ADT/Optional.h"
 #include "llvm/ADT/PackedVector.h"
 #include "llvm/ADT/SmallBitVector.h"
 #include "llvm/ADT/SmallVector.h"
 #include "llvm/Support/SaveAndRestore.h"
 #include <utility>
 
 using namespace clang;
 
 #define DEBUG_LOGGING 0
 
 static bool isTrackedVar(const VarDecl *vd, const DeclContext *dc) {
   if (vd->isLocalVarDecl() && !vd->hasGlobalStorage() &&
       !vd->isExceptionVariable() &&
       vd->getDeclContext() == dc) {
     QualType ty = vd->getType();
     return ty->isScalarType() || ty->isVectorType();
   }
   return false;
 }
 
+static bool isTrackedField(const FieldDecl *fd, const DeclContext *dc) {
+  if (fd->isAnonymousStructOrUnion())
+    return false;
+  const CXXConstructorDecl *cd = dyn_cast<CXXConstructorDecl>(dc);
+  if (!cd)
+    return false;
+  const RecordDecl *declaringClass = fd->getParent();
+  while (declaringClass && declaringClass->isAnonymousStructOrUnion())
+    declaringClass = dyn_cast<RecordDecl>(declaringClass->getDeclContext());
+  return cd->getParent() == declaringClass;
+}
+
 //------------------------------------------------------------------------====//
 // DeclToIndex: a mapping from Decls we track to value indices.
 //====------------------------------------------------------------------------//
 
 namespace {
 class DeclToIndex {
-  llvm::DenseMap<const VarDecl *, unsigned> map;
+  llvm::DenseMap<const ValueDecl *, unsigned> map;
 public:
   DeclToIndex() {}
   
   /// Compute the actual mapping from declarations to bits.
   void computeMap(const DeclContext &dc);
   
   /// Return the number of declarations in the map.
   unsigned size() const { return map.size(); }
   
   /// Returns the bit vector index for a given declaration.
-  Optional<unsigned> getValueIndex(const VarDecl *d) const;
+  Optional<unsigned> getValueIndex(const ValueDecl *d) const;
 };
 }
 
 void DeclToIndex::computeMap(const DeclContext &dc) {
   unsigned count = 0;
   DeclContext::specific_decl_iterator<VarDecl> I(dc.decls_begin()),
                                                E(dc.decls_end());
   for ( ; I != E; ++I) {
     const VarDecl *vd = *I;
     if (isTrackedVar(vd, &dc))
       map[vd] = count++;
   }
+
+  if (const CXXConstructorDecl *CD = dyn_cast<CXXConstructorDecl>(&dc)) {
+    const CXXRecordDecl *rd = CD->getParent();
+    DeclContext::specific_decl_iterator<ValueDecl> I(rd->decls_begin()),
+                                                   E(rd->decls_end());
+    for (; I != E; ++I) {
+      const FieldDecl *fd = isa<IndirectFieldDecl>(*I)
+                                ? cast<IndirectFieldDecl>(*I)->getAnonField()
+                                : dyn_cast<FieldDecl>(*I);
+      if (fd)
+        map[fd] = count++;
+    }
+  }
 }
 
-Optional<unsigned> DeclToIndex::getValueIndex(const VarDecl *d) const {
-  llvm::DenseMap<const VarDecl *, unsigned>::const_iterator I = map.find(d);
+Optional<unsigned> DeclToIndex::getValueIndex(const ValueDecl *d) const {
+  llvm::DenseMap<const ValueDecl *, unsigned>::const_iterator I = map.find(d);
   if (I == map.end())
     return None;
   return I->second;
 }
 
 //------------------------------------------------------------------------====//
 // CFGBlockValues: dataflow values for CFG blocks.
 //====------------------------------------------------------------------------//
public:
   bool updateValueVectorWithScratch(const CFGBlock *block);
   
   bool hasNoDeclarations() const {
     return declToIndex.size() == 0;
   }
 
   void resetScratch();
   
-  ValueVector::reference operator[](const VarDecl *vd);
+  ValueVector::reference operator[](const ValueDecl *vd);
 
   Value getValue(const CFGBlock *block, const CFGBlock *dstBlock,
-                 const VarDecl *vd) {
+                 const ValueDecl *vd) {
     const Optional<unsigned> &idx = declToIndex.getValueIndex(vd);
     assert(idx.hasValue());
     return getValueVector(block)[idx.getValue()];
   }
 };  
 } // end anonymous namespace
 
 CFGBlockValues::CFGBlockValues(const CFG &c) : cfg(c), vals(0) {}

 #endif
   return changed;
 }
 
 void CFGBlockValues::resetScratch() {
   scratch.reset();
 }
 
-ValueVector::reference CFGBlockValues::operator[](const VarDecl *vd) {
+ValueVector::reference CFGBlockValues::operator[](const ValueDecl *vd) {
   const Optional<unsigned> &idx = declToIndex.getValueIndex(vd);
   assert(idx.hasValue());
   return scratch[idx.getValue()];
 }
 
 //------------------------------------------------------------------------====//
 // Worklist: worklist for dataflow analysis.
 //====------------------------------------------------------------------------//
const CFGBlock *DataflowWorklist::dequeue() {
   return B;
 }
 
 //------------------------------------------------------------------------====//
 // Classification of DeclRefExprs as use or initialization.
 //====------------------------------------------------------------------------//
 
 namespace {
-class FindVarResult {
-  const VarDecl *vd;
-  const DeclRefExpr *dr;
+class FindDeclResult {
+  const ValueDecl *vd;
+  const Expr *expr;
 public:
-  FindVarResult(const VarDecl *vd, const DeclRefExpr *dr) : vd(vd), dr(dr) {}
+  FindDeclResult(const ValueDecl *vd, const Expr *expr) : vd(vd), expr(expr) {}
 
-  const DeclRefExpr *getDeclRefExpr() const { return dr; }
-  const VarDecl *getDecl() const { return vd; }
+  const Expr *getExpr() const { return expr; }
+  const ValueDecl *getDecl() const { return vd; }
 };
 
 static const Expr *stripCasts(ASTContext &C, const Expr *Ex) {
   while (Ex) {
     Ex = Ex->IgnoreParenNoopCasts(C);
     if (const CastExpr *CE = dyn_cast<CastExpr>(Ex)) {
       if (CE->getCastKind() == CK_LValueBitCast) {
         Ex = CE->getSubExpr();
         continue;
       }
     }
     break;
   }
   return Ex;
 }
 
-/// If E is an expression comprising a reference to a single variable, find that
-/// variable.
-static FindVarResult findVar(const Expr *E, const DeclContext *DC) {
-  if (const DeclRefExpr *DRE =
-        dyn_cast<DeclRefExpr>(stripCasts(DC->getParentASTContext(), E)))
+const MemberExpr *findLeftmostMemberExpr(const MemberExpr *me) {
+  const Expr *Base = me;
+  const MemberExpr *FieldExpr = me;
+  while (isa<MemberExpr>(Base)) {
+    me = cast<MemberExpr>(Base);
+    FieldDecl *fd = dyn_cast<FieldDecl>(me->getMemberDecl());
+    if (fd && !fd->isAnonymousStructOrUnion())
+      FieldExpr = me;
+    Base = me->getBase();
+  }
+  return isa<CXXThisExpr>(Base) ? FieldExpr : 0;
+}
+
+/// If E is an expression comprising a reference to a single variable or field,
+/// find that variable or field.
+static FindDeclResult findDecl(const Expr *E, const DeclContext *DC) {
+  const Expr *SE = stripCasts(DC->getParentASTContext(), E);
+  if (const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(SE)) {
     if (const VarDecl *VD = dyn_cast<VarDecl>(DRE->getDecl()))
       if (isTrackedVar(VD, DC))
-        return FindVarResult(VD, DRE);
-  return FindVarResult(0, 0);
+        return FindDeclResult(VD, DRE);
+  } else if (const MemberExpr *ME = dyn_cast<MemberExpr>(SE)) {
+    if (const FieldDecl *FD = dyn_cast<FieldDecl>(ME->getMemberDecl()))
+      if (isTrackedField(FD, DC))
+        return FindDeclResult(FD, ME);
+  }
+  return FindDeclResult(0, 0);
 }
 
-/// \brief Classify each DeclRefExpr as an initialization or a use. Any
-/// DeclRefExpr which isn't explicitly classified will be assumed to have
-/// escaped the analysis and will be treated as an initialization.
+/// \brief Classify each DeclRefExpr or MemberExpr as an initialization or a
+/// use. Any DeclRefExpr or MemberExpr which isn't explicitly classified will
+/// be assumed to have escaped the analysis and will be treated as an
+/// initialization.
 class ClassifyRefs : public StmtVisitor<ClassifyRefs> {
 public:
   enum Class {
     Init,
     Use,
     SelfInit,
     Ignore
   };
 
 private:
   const DeclContext *DC;
-  llvm::DenseMap<const DeclRefExpr*, Class> Classification;
+  llvm::DenseMap<const Expr*, Class> Classification;
 
-  bool isTrackedVar(const VarDecl *VD) const {
-    return ::isTrackedVar(VD, DC);
+  bool isTracked(const Decl *D) const {
+    return (isa<VarDecl>(D) && ::isTrackedVar(cast<VarDecl>(D), DC)) ||
+           (isa<FieldDecl>(D) && ::isTrackedField(cast<FieldDecl>(D), (DC)));
   }
 
   void classify(const Expr *E, Class C);
 
 public:
   ClassifyRefs(AnalysisDeclContext &AC) : DC(cast<DeclContext>(AC.getDecl())) {}
 
   void VisitDeclStmt(DeclStmt *DS);
   void VisitUnaryOperator(UnaryOperator *UO);
   void VisitBinaryOperator(BinaryOperator *BO);
   void VisitCallExpr(CallExpr *CE);
   void VisitCastExpr(CastExpr *CE);
+  void VisitMemberExpr(MemberExpr *ME);
+  void VisitCXXConstructExpr(CXXConstructExpr *CE);
 
   void operator()(Stmt *S) { Visit(S); }
 
-  Class get(const DeclRefExpr *DRE) const {
-    llvm::DenseMap<const DeclRefExpr*, Class>::const_iterator I
-        = Classification.find(DRE);
+  Class get(const Expr *E) const {
+    llvm::DenseMap<const Expr *, Class>::const_iterator I =
+        Classification.find(E);
     if (I != Classification.end())
       return I->second;
 
-    const VarDecl *VD = dyn_cast<VarDecl>(DRE->getDecl());
-    if (!VD || !isTrackedVar(VD))
+    const Decl *D =
+        isa<DeclRefExpr>(E)
+            ? cast<DeclRefExpr>(E)->getDecl()
+            : isa<MemberExpr>(E) ? cast<MemberExpr>(E)->getMemberDecl() : 0;
+    if (!D || !isTracked(D))
       return Ignore;
 
     return Init;
   }
 };
 }
 
 static const DeclRefExpr *getSelfInitExpr(VarDecl *VD) {
   if (Expr *Init = VD->getInit()) {
     const DeclRefExpr *DRE
       = dyn_cast<DeclRefExpr>(stripCasts(VD->getASTContext(), Init));
     if (DRE && DRE->getDecl() == VD)
       return DRE;
   }
   return 0;
 }
 
 void ClassifyRefs::classify(const Expr *E, Class C) {
   // The result of a ?: could also be an lvalue.
   E = E->IgnoreParens();
-  if (const ConditionalOperator *CO = dyn_cast<ConditionalOperator>(E)) {
-    const Expr *TrueExpr = CO->getTrueExpr();
+  if (const AbstractConditionalOperator *ACO =
+          dyn_cast<AbstractConditionalOperator>(E)) {
+    if (isa<BinaryConditionalOperator>(ACO))
+      classify(cast<BinaryConditionalOperator>(ACO)->getCommon(), Use);
+    const Expr *TrueExpr = ACO->getTrueExpr();
     if (!isa<OpaqueValueExpr>(TrueExpr))
       classify(TrueExpr, C);
-    classify(CO->getFalseExpr(), C);
+    classify(ACO->getFalseExpr(), C);
     return;
   }
 
-  FindVarResult Var = findVar(E, DC);
-  if (const DeclRefExpr *DRE = Var.getDeclRefExpr())
-    Classification[DRE] = std::max(Classification[DRE], C);
+  if (const BinaryOperator *BO = dyn_cast<BinaryOperator>(E)) {
+    switch (BO->getOpcode()) {
+      case BO_PtrMemD:
+      case BO_PtrMemI:
+        classify(BO->getLHS(), C);
+        return;
+      case BO_Comma:
+        classify(BO->getLHS(), Ignore);
+        classify(BO->getRHS(), C);
+        return;
+      default:
+        return;
+    }
+  }
+
+  FindDeclResult Var = findDecl(E, DC);
+  if (const Expr *Ex = Var.getExpr())
+      Classification[Ex] = std::max(Classification[Ex], C);
 }
 
 void ClassifyRefs::VisitDeclStmt(DeclStmt *DS) {
   for (DeclStmt::decl_iterator DI = DS->decl_begin(), DE = DS->decl_end();
        DI != DE; ++DI) {
     VarDecl *VD = dyn_cast<VarDecl>(*DI);
-    if (VD && isTrackedVar(VD))
+    if (VD && isTracked(VD))
       if (const DeclRefExpr *DRE = getSelfInitExpr(VD))
         Classification[DRE] = SelfInit;
   }
 }
 
 void ClassifyRefs::VisitBinaryOperator(BinaryOperator *BO) {
   // Ignore the evaluation of a DeclRefExpr on the LHS of an assignment. If this
   // is not a compound-assignment, we will treat it as initializing the variable
   // when TransferFunctions visits it. A compound-assignment does not affect
   // whether a variable is uninitialized, and there's no point counting it as a
   // use.
   if (BO->isCompoundAssignmentOp())
     classify(BO->getLHS(), Use);
-  else if (BO->getOpcode() == BO_Assign)
-    classify(BO->getLHS(), Ignore);
 }
 
 void ClassifyRefs::VisitUnaryOperator(UnaryOperator *UO) {
   // Increment and decrement are uses despite there being no lvalue-to-rvalue
   // conversion.
   if (UO->isIncrementDecrementOp())
     classify(UO->getSubExpr(), Use);
 }
 
+static bool IsPointerToConst(const QualType &QT) {
+  return QT->isAnyPointerType() && QT->getPointeeType().isConstQualified();
+}
+
 void ClassifyRefs::VisitCallExpr(CallExpr *CE) {
   // If a value is passed by const reference to a function, we should not assume
   // that it is initialized by the call, and we conservatively do not assume
   // that it is used.
+  // If the address of a value is passed to a function, we treat the value as
+  // initialized.
   for (CallExpr::arg_iterator I = CE->arg_begin(), E = CE->arg_end();
-       I != E; ++I)
-    if ((*I)->getType().isConstQualified() && (*I)->isGLValue())
-      classify(*I, Ignore);
+       I != E; ++I) {
+    if ((*I)->isGLValue()) {
+      if ((*I)->getType().isConstQualified())
+        classify((*I), Ignore);
+      continue;
+    } else if (IsPointerToConst((*I)->getType())) {
+      const Expr *Ex = stripCasts(DC->getParentASTContext(), *I);
+      const UnaryOperator *UO = dyn_cast<UnaryOperator>(Ex);
+      if (UO && UO->getOpcode() == UO_AddrOf)
+        Ex = UO->getSubExpr();
+      classify(Ex, Ignore);
+    }
+  }
+  if (CXXMemberCallExpr *MCE = dyn_cast<CXXMemberCallExpr>(CE)) {
+    if (const MemberExpr *ME =
+            dyn_cast<MemberExpr>(MCE->getImplicitObjectArgument())) {
+      classify(ME, Use);
+    }
+  }
 }
 
 void ClassifyRefs::VisitCastExpr(CastExpr *CE) {
-  if (CE->getCastKind() == CK_LValueToRValue)
-    classify(CE->getSubExpr(), Use);
-  else if (CStyleCastExpr *CSE = dyn_cast<CStyleCastExpr>(CE)) {
+  if (CStyleCastExpr *CSE = dyn_cast<CStyleCastExpr>(CE)) {
     if (CSE->getType()->isVoidType()) {
       // Squelch any detected load of an uninitialized value if
       // we cast it to void.
       // e.g. (void) x;
       classify(CSE->getSubExpr(), Ignore);
+      return;
     }
   }
+
+  switch (CE->getCastKind()) {
+    case CK_LValueToRValue:
+      classify(CE->getSubExpr(), Use);
+      break;
+    case CK_FunctionToPointerDecay:
+      if (const MemberExpr *ME = dyn_cast<MemberExpr>(CE->getSubExpr())) {
+        if (isa<CXXMethodDecl>(ME->getMemberDecl()) &&
+            cast<CXXMethodDecl>(ME->getMemberDecl())->isStatic())
+          classify(ME->getBase(), Ignore);
+      }
+      break;
+    default:
+      break;
+  }
+}
+
+static bool isFieldOrNonStaticMethod(const Decl *D) {
+  return isa<FieldDecl>(D) ||
+         (isa<CXXMethodDecl>(D) && !cast<CXXMethodDecl>(D)->isStatic());
+}
+
+void ClassifyRefs::VisitMemberExpr(MemberExpr *ME) {
+  const MemberExpr* LME = findLeftmostMemberExpr(ME);
+  if (!LME)
+    return;
+
+  // If it's not a reference, it will be classified appropriately by a cast
+  if (LME == ME && LME->getMemberDecl()->getType()->isReferenceType())
+    classify(LME, Use);
+  else if (LME != ME)
+    classify(LME, isFieldOrNonStaticMethod(ME->getMemberDecl()) ? Use : Ignore);
+}
+
+void ClassifyRefs::VisitCXXConstructExpr(CXXConstructExpr *CE) {
+  if (CE->getConstructor()->isCopyOrMoveConstructor())
+    classify(CE->getArg(0), Use);
 }
 
 //------------------------------------------------------------------------====//
 // Transfer function for uninitialized values analysis.
 //====------------------------------------------------------------------------//
 
 namespace {
 class TransferFunctions : public StmtVisitor<TransferFunctions> {
   CFGBlockValues &vals;
   const CFG &cfg;
   const CFGBlock *block;
   AnalysisDeclContext &ac;
   const ClassifyRefs &classification;
   ObjCNoReturn objCNoRet;
   UninitVariablesHandler &handler;
+  bool reportConstructor;
+  const CXXConstructorDecl *constructor;
 
 public:
-  TransferFunctions(CFGBlockValues &vals, const CFG &cfg,
-                    const CFGBlock *block, AnalysisDeclContext &ac,
-                    const ClassifyRefs &classification,
+  TransferFunctions(CFGBlockValues &vals, const CFG &cfg, const CFGBlock *block,
+                    AnalysisDeclContext &ac, const ClassifyRefs &classification,
                     UninitVariablesHandler &handler)
       : vals(vals), cfg(cfg), block(block), ac(ac),
         classification(classification), objCNoRet(ac.getASTContext()),
-      handler(handler) {}
+        handler(handler), reportConstructor(false),
+        constructor(dyn_cast<CXXConstructorDecl>(ac.getDecl())) {}
 
-  void reportUse(const Expr *ex, const VarDecl *vd);
+  void reportUse(const Expr *ex, const ValueDecl *vd);
+  void setAllFields(Value v);
+
+  void setReportConstructor(bool b) {
+    reportConstructor = b;
+  }
 
   void VisitBinaryOperator(BinaryOperator *bo);
   void VisitBlockExpr(BlockExpr *be);
   void VisitCallExpr(CallExpr *ce);
   void VisitDeclRefExpr(DeclRefExpr *dr);
   void VisitDeclStmt(DeclStmt *ds);
+  void VisitMemberExpr(MemberExpr *me);
   void VisitObjCForCollectionStmt(ObjCForCollectionStmt *FS);
   void VisitObjCMessageExpr(ObjCMessageExpr *ME);
+  void VisitCXXConstructExpr(CXXConstructExpr *ce);
 
   bool isTrackedVar(const VarDecl *vd) {
     return ::isTrackedVar(vd, cast<DeclContext>(ac.getDecl()));
   }
 
-  FindVarResult findVar(const Expr *ex) {
-    return ::findVar(ex, cast<DeclContext>(ac.getDecl()));
+  FindDeclResult findDecl(const Expr *ex) {
+    return ::findDecl(ex, cast<DeclContext>(ac.getDecl()));
   }
 
-  UninitUse getUninitUse(const Expr *ex, const VarDecl *vd, Value v) {
-    UninitUse Use(ex, isAlwaysUninit(v));
+  UninitUse getUninitUse(const Expr *ex, const ValueDecl *vd, Value v) {
+    UninitUse Use(ex, isAlwaysUninit(v), reportConstructor ? constructor : 0);
 
     assert(isUninitialized(v));
     if (Use.getKind() == UninitUse::Always)
       return Use;
 
     // If an edge which leads unconditionally to this use did not initialize
     // the variable, we can say something stronger than 'may be uninitialized':
     // we can say 'either it's used uninitialized or you have dead code'.
for (CFG::const_iterator BI = cfg.begin(), BE = cfg.end(); BI != BE; ++BI) {
           }
         }
       }
     }
 
     return Use;
   }
 };
+
+const CXXThisExpr *findThisExpr(const Expr *E) {
+  const Expr *OE;
+  do {
+    OE = E = E->IgnoreParenCasts();
+    if (const UnaryOperator *UO = dyn_cast<UnaryOperator>(OE))
+      E = UO->getSubExpr()->IgnoreParenCasts();
+  } while (OE != E);
+  return dyn_cast<CXXThisExpr>(E);
+}
 }
 
-void TransferFunctions::reportUse(const Expr *ex, const VarDecl *vd) {
+void TransferFunctions::setAllFields(Value v) {
+  assert(constructor);
+  const CXXRecordDecl *RD = constructor->getParent();
+  DeclContext::specific_decl_iterator<ValueDecl> I(RD->decls_begin()),
+                                                 E(RD->decls_end());
+  for (; I != E; ++I) {
+    if (const FieldDecl *fd = isa<IndirectFieldDecl>(*I)
+                                  ? cast<IndirectFieldDecl>(*I)->getAnonField()
+                                  : dyn_cast<FieldDecl>(*I))
+      vals[fd] = v;
+  }
+}
+
+void TransferFunctions::reportUse(const Expr *ex, const ValueDecl *vd) {
   Value v = vals[vd];
   if (isUninitialized(v))
     handler.handleUseOfUninitVariable(vd, getUninitUse(ex, vd, v));
 }
 
 void TransferFunctions::VisitObjCForCollectionStmt(ObjCForCollectionStmt *FS) {
   // This represents an initialization of the 'element' value.
   if (DeclStmt *DS = dyn_cast<DeclStmt>(FS->getElement())) {
for (BlockDecl::capture_const_iterator i = bd->capture_begin(),
     if (i->isByRef()) {
       vals[vd] = Initialized;
       continue;
     }
     reportUse(be, vd);
   }
 }
 
 void TransferFunctions::VisitCallExpr(CallExpr *ce) {
   if (Decl *Callee = ce->getCalleeDecl()) {
     if (Callee->hasAttr<ReturnsTwiceAttr>()) {
       // After a call to a function like setjmp or vfork, any variable which is
       // initialized anywhere within this function may now be initialized. For
       // now, just assume such a call initializes all variables.  FIXME: Only
       // mark variables as initialized if they have an initializer which is
       // reachable from here.
       vals.setAllScratchValues(Initialized);
     }
     else if (Callee->hasAttr<AnalyzerNoReturnAttr>()) {
       // Functions labeled like "analyzer_noreturn" are often used to denote
       // "panic" functions that in special debug situations can still return,
       // but for the most part should not be treated as returning.  This is a
       // useful annotation borrowed from the static analyzer that is useful for
       // suppressing branch-specific false positives when we call one of these
       // functions but keep pretending the path continues (when in reality the
       // user doesn't care).
       vals.setAllScratchValues(Unknown);
     }
   }
+  if (!constructor)
+    return;
+
+  // If "this" is passed to a function without the const qualifier, assume
+  // that all the fields are initialized.
+  for (CallExpr::arg_iterator I = ce->arg_begin(), E = ce->arg_end(); I != E;
+       ++I) {
+    if (isa<CXXThisExpr>(stripCasts(constructor->getParentASTContext(), *I)) &&
+        !IsPointerToConst((*I)->getType())) {
+      setAllFields(Initialized);
+      return;
+    }
+  }
+
+  const CXXThisExpr *te = 0;
+  const CXXMethodDecl *Callee = 0;
+
+  if (CXXOperatorCallExpr *oce = dyn_cast<CXXOperatorCallExpr>(ce)) {
+    if (oce->getOperator() == OO_Equal) {
+      te = findThisExpr(oce->getArgs()[0]);
+      Callee = cast<CXXMethodDecl>(oce->getCalleeDecl());
+    }
+  } else if (CXXMemberCallExpr *mce = dyn_cast<CXXMemberCallExpr>(ce)) {
+    te = dyn_cast<CXXThisExpr>(mce->getImplicitObjectArgument());
+    Callee = cast<CXXMethodDecl>(mce->getCalleeDecl());
+  }
+
+  if (te && Callee && (constructor->getParent() == Callee->getParent()))
+    setAllFields(Initialized);
 }
 
 void TransferFunctions::VisitDeclRefExpr(DeclRefExpr *dr) {
   switch (classification.get(dr)) {
   case ClassifyRefs::Ignore:
     break;
   case ClassifyRefs::Use:
     reportUse(dr, cast<VarDecl>(dr->getDecl()));
     break;
   case ClassifyRefs::Init:
     vals[cast<VarDecl>(dr->getDecl())] = Initialized;
     break;
   case ClassifyRefs::SelfInit:
-      handler.handleSelfInit(cast<VarDecl>(dr->getDecl()));
     break;
   }
 }
 
+void TransferFunctions::VisitMemberExpr(MemberExpr *me) {
+  if (const MemberExpr *e = findLeftmostMemberExpr(me)) {
+    switch (classification.get(e)) {
+    case ClassifyRefs::Ignore:
+      break;
+    case ClassifyRefs::Use:
+    case ClassifyRefs::SelfInit:
+      reportUse(e, cast<FieldDecl>(e->getMemberDecl()));
+      break;
+    case ClassifyRefs::Init:
+      if (constructor && constructor->getParent()->isUnion())
+        setAllFields(Initialized);
+      else
+        vals[cast<FieldDecl>(e->getMemberDecl())] = Initialized;
+      break;
+    }
+  }
+}
+
 void TransferFunctions::VisitBinaryOperator(BinaryOperator *BO) {
   if (BO->getOpcode() == BO_Assign) {
-    FindVarResult Var = findVar(BO->getLHS());
-    if (const VarDecl *VD = Var.getDecl())
+    FindDeclResult Var = findDecl(BO->getLHS());
+    if (const ValueDecl *VD = Var.getDecl()) {
+      if (!VD->getType()->isReferenceType())
         vals[VD] = Initialized;
+    } else if (constructor) {
+      // We treat this as if it escaped analysis.
+      if (findThisExpr(BO->getLHS()))
+        setAllFields(Initialized);
+    }
   }
 }
 
 void TransferFunctions::VisitDeclStmt(DeclStmt *DS) {
   for (DeclStmt::decl_iterator DI = DS->decl_begin(), DE = DS->decl_end();
        DI != DE; ++DI) {
     VarDecl *VD = dyn_cast<VarDecl>(*DI);
     if (VD && isTrackedVar(VD)) {

 void TransferFunctions::VisitObjCMessageExpr(ObjCMessageExpr *ME) {
   // If the Objective-C message expression is an implicit no-return that
   // is not modeled in the CFG, set the tracked dataflow values to Unknown.
   if (objCNoRet.isImplicitNoReturn(ME)) {
     vals.setAllScratchValues(Unknown);
   }
 }
 
+void TransferFunctions::VisitCXXConstructExpr(CXXConstructExpr *ce) {
+  if (ce->getConstructionKind() == CXXConstructExpr::CK_Delegating)
+    setAllFields(Initialized);
+}
+
+static bool isInClassInitializer(const CXXConstructorDecl *ctor, unsigned idx) {
+  if (idx >= ctor->getNumCtorInitializers())
+    return false;
+  CXXConstructorDecl::init_const_iterator I = ctor->init_begin();
+  return I[idx]->isInClassMemberInitializer();
+}
 //------------------------------------------------------------------------====//
 // High-level "driver" logic for uninitialized values analysis.
 //====------------------------------------------------------------------------//
 
 static bool runOnBlock(const CFGBlock *block, const CFG &cfg,
                        AnalysisDeclContext &ac, CFGBlockValues &vals,
                        const ClassifyRefs &classification,
                        llvm::BitVector &wasAnalyzed,
-                       UninitVariablesHandler &handler) {
+                       UninitVariablesHandler &handler,
+                       unsigned &initIdx) {
   wasAnalyzed[block->getBlockID()] = true;
   vals.resetScratch();
   // Merge in values of predecessor blocks.
   bool isFirst = true;
   for (CFGBlock::const_pred_iterator I = block->pred_begin(),
        E = block->pred_end(); I != E; ++I) {
     const CFGBlock *pred = *I;
     if (wasAnalyzed[pred->getBlockID()]) {
       vals.mergeIntoScratch(vals.getValueVector(pred), isFirst);
       isFirst = false;
     }
   }
+
   // Apply the transfer function.
+  const CXXConstructorDecl *ctor = dyn_cast<CXXConstructorDecl>(ac.getDecl());
+  bool isUnion = ctor && ctor->getParent()->isUnion();
   TransferFunctions tf(vals, cfg, block, ac, classification, handler);
-  for (CFGBlock::const_iterator I = block->begin(), E = block->end(); 
-       I != E; ++I) {
+  tf.setReportConstructor(ctor && isInClassInitializer(ctor, initIdx));
+  for (CFGBlock::const_iterator I = block->begin(), E = block->end(); I != E;
+       ++I) {
     if (Optional<CFGStmt> cs = I->getAs<CFGStmt>())
-      tf.Visit(const_cast<Stmt*>(cs->getStmt()));
+      tf.Visit(const_cast<Stmt *>(cs->getStmt()));
+    else if (Optional<CFGInitializer> ci = I->getAs<CFGInitializer>()) {
+      tf.setReportConstructor(isInClassInitializer(ctor, ++initIdx));
+      FieldDecl *fd = ci->getInitializer()->getMember();
+      if (fd && isTrackedField(fd, cast<DeclContext>(ac.getDecl()))) {
+        if (isUnion)
+          tf.setAllFields(Initialized);
+        else
+          vals[fd] = Initialized;
+      }
+    }
   }
   return vals.updateValueVectorWithScratch(block);
 }
 
 /// PruneBlocksHandler is a special UninitVariablesHandler that is used
 /// to detect when a CFGBlock has any *potential* use of an uninitialized
 /// variable.  It is mainly used to prune out work during the final
 /// reporting pass.
struct PruneBlocksHandler : public UninitVariablesHandler {
   llvm::BitVector hadUse;
 
   /// Records if any CFGBlock had a potential use of an uninitialized variable.
   bool hadAnyUse;
 
   /// The current block to scribble use information.
   unsigned currentBlock;
 
-  virtual void handleUseOfUninitVariable(const VarDecl *vd,
+  virtual void handleUseOfUninitVariable(const ValueDecl *vd,
                                          const UninitUse &use) {
     hadUse[currentBlock] = true;
     hadAnyUse = true;
   }
 
   /// Called when the uninitialized variable analysis detects the
   /// idiom 'int x = x'.  All other uses of 'x' within the initializer
   /// are handled by handleUseOfUninitVariable.
-  virtual void handleSelfInit(const VarDecl *vd) {
+  virtual void handleSelfInit(const ValueDecl *vd) {
     hadUse[currentBlock] = true;
     hadAnyUse = true;
   }
 };
 }
 
 void clang::runUninitializedVariablesAnalysis(
     const DeclContext &dc,
void clang::runUninitializedVariablesAnalysis(
 
   // Proceed with the workist.
   DataflowWorklist worklist(cfg, *ac.getAnalysis<PostOrderCFGView>());
   llvm::BitVector previouslyVisited(cfg.getNumBlockIDs());
   worklist.enqueueSuccessors(&cfg.getEntry());
   llvm::BitVector wasAnalyzed(cfg.getNumBlockIDs(), false);
   wasAnalyzed[cfg.getEntry().getBlockID()] = true;
   PruneBlocksHandler PBH(cfg.getNumBlockIDs());
+  std::vector<unsigned> blockInitIdx(cfg.getNumBlockIDs());
+  unsigned initIdx = 0;
 
   while (const CFGBlock *block = worklist.dequeue()) {
     PBH.currentBlock = block->getBlockID();
+    if (previouslyVisited[block->getBlockID()])
+      initIdx = blockInitIdx[block->getBlockID()];
+    else
+      blockInitIdx[block->getBlockID()] = initIdx;
 
     // Did the block change?
-    bool changed = runOnBlock(block, cfg, ac, vals,
-                              classification, wasAnalyzed, PBH);
+    bool changed = runOnBlock(block, cfg, ac, vals, classification, wasAnalyzed,
+                              PBH, initIdx);
     ++stats.NumBlockVisits;
     if (changed || !previouslyVisited[block->getBlockID()])
       worklist.enqueueSuccessors(block);    
     previouslyVisited[block->getBlockID()] = true;
   }
 
   if (!PBH.hadAnyUse)
     return;
 
   // Run through the blocks one more time, and report uninitialized variables.
   for (CFG::const_iterator BI = cfg.begin(), BE = cfg.end(); BI != BE; ++BI) {
     const CFGBlock *block = *BI;
     if (PBH.hadUse[block->getBlockID()]) {
-      runOnBlock(block, cfg, ac, vals, classification, wasAnalyzed, handler);
+      initIdx = blockInitIdx[block->getBlockID()];
+      runOnBlock(block, cfg, ac, vals, classification, wasAnalyzed, handler,
+                 initIdx);
       ++stats.NumBlockVisits;
     }
   }
 }
 
 UninitVariablesHandler::~UninitVariablesHandler() {}

lib/Sema/AnalysisBasedWarnings.cpp

if (Else)
           CharSourceRange::getCharRange(If->getLocStart(),
                                         Else->getLocStart()));
     else
       Fixit1 = FixItHint::CreateRemoval(If->getSourceRange());
   }
 }
 
 /// DiagUninitUse -- Helper function to produce a diagnostic for an
-/// uninitialized use of a variable.
-static void DiagUninitUse(Sema &S, const VarDecl *VD, const UninitUse &Use,
+/// uninitialized use of a variable or field.
+static void DiagUninitUse(Sema &S, const DeclaratorDecl *DD, const UninitUse &Use,
                           bool IsCapturedByBlock) {
   bool Diagnosed = false;
 
   switch (Use.getKind()) {
   case UninitUse::Always:
+    if (isa<FieldDecl>(DD) && DD->getType()->isReferenceType()) {
+      S.Diag(Use.getUser()->getLocStart(), diag::warn_reference_field_is_uninit)
+          << DD->getDeclName();
+    } else {
       S.Diag(Use.getUser()->getLocStart(), diag::warn_uninit_var)
-        << VD->getDeclName() << IsCapturedByBlock
+          << isa<FieldDecl>(DD) << DD->getDeclName() << IsCapturedByBlock
           << Use.getUser()->getSourceRange();
+    }
+    if (const CXXConstructorDecl *Constructor =
+            Use.getConstructorForDefaultInit()) {
+      S.Diag(Constructor->getLocation(), diag::note_uninit_in_this_constructor)
+          << (Constructor->isDefaultConstructor() && Constructor->isImplicit());
+    }
     return;
 
   case UninitUse::AfterDecl:
   case UninitUse::AfterCall:
-    S.Diag(VD->getLocation(), diag::warn_sometimes_uninit_var)
-      << VD->getDeclName() << IsCapturedByBlock
+    S.Diag(DD->getLocation(), diag::warn_sometimes_uninit_var)
+      << isa<FieldDecl>(DD) << DD->getDeclName() << IsCapturedByBlock
       << (Use.getKind() == UninitUse::AfterDecl ? 4 : 5)
-      << const_cast<DeclContext*>(VD->getLexicalDeclContext())
-      << VD->getSourceRange();
+      << const_cast<DeclContext*>(DD->getLexicalDeclContext())
+      << DD->getSourceRange();
     S.Diag(Use.getUser()->getLocStart(), diag::note_uninit_var_use)
       << IsCapturedByBlock << Use.getUser()->getSourceRange();
     return;
 
   case UninitUse::Maybe:
   case UninitUse::Sometimes:
     // Carry on to report sometimes-uninitialized branches, if possible,
     // or a 'may be used uninitialized' diagnostic otherwise.
for (UninitUse::branch_iterator I = Use.branch_begin(), E = Use.branch_end();
     case Stmt::DefaultStmtClass:
       DiagKind = 3;
       Str = "default";
       Range = cast<DefaultStmt>(Term)->getDefaultLoc();
       break;
     }
 
     S.Diag(Range.getBegin(), diag::warn_sometimes_uninit_var)
-      << VD->getDeclName() << IsCapturedByBlock << DiagKind
-      << Str << I->Output << Range;
+      << isa<FieldDecl>(DD) << DD->getDeclName() << IsCapturedByBlock
+      << DiagKind << Str << I->Output << Range;
     S.Diag(User->getLocStart(), diag::note_uninit_var_use)
       << IsCapturedByBlock << User->getSourceRange();
     if (RemoveDiagKind != -1)
       S.Diag(Fixit1.RemoveRange.getBegin(), diag::note_uninit_fixit_remove_cond)
         << RemoveDiagKind << Str << I->Output << Fixit1 << Fixit2;
 
     Diagnosed = true;
   }
 
   if (!Diagnosed)
     S.Diag(Use.getUser()->getLocStart(), diag::warn_maybe_uninit_var)
-        << VD->getDeclName() << IsCapturedByBlock
+        << isa<FieldDecl>(DD) << DD->getDeclName() << IsCapturedByBlock
         << Use.getUser()->getSourceRange();
 }
 
 /// DiagnoseUninitializedUse -- Helper function for diagnosing uses of an
 /// uninitialized variable. This manages the different forms of diagnostic
 /// emitted for particular types of uses. Returns true if the use was diagnosed
 /// as a warning. If a particular use is one we omit warnings for, returns
 /// false.
static bool DiagnoseUninitializedUse(Sema &S, const VarDecl *VD,
   // an initialization fixit.
   if (!SuggestInitializationFixit(S, VD))
     S.Diag(VD->getLocStart(), diag::note_uninit_var_def)
       << VD->getDeclName();
 
   return true;
 }
 
+static bool DiagnoseUninitializedUse(Sema &S, const FieldDecl *FD,
+                                     const UninitUse &Use,
+                                     bool alwaysReportSelfInit = false) {
+  DiagUninitUse(S, FD, Use, false);
+  return true;
+}
+
 namespace {
   class FallthroughMapper : public RecursiveASTVisitor<FallthroughMapper> {
   public:
     FallthroughMapper(Sema &S)
       : FoundSwitchStatements(false),
         S(S) {
     }
 

 
 class UninitValsDiagReporter : public UninitVariablesHandler {
   Sema &S;
   typedef SmallVector<UninitUse, 2> UsesVec;
   typedef llvm::PointerIntPair<UsesVec *, 1, bool> MappedType;
   // Prefer using MapVector to DenseMap, so that iteration order will be
   // the same as insertion order. This is needed to obtain a deterministic
   // order of diagnostics when calling flushDiagnostics().
-  typedef llvm::MapVector<const VarDecl *, MappedType> UsesMap;
+  typedef llvm::MapVector<const Decl *, MappedType> UsesMap;
   UsesMap *uses;
   
 public:
   UninitValsDiagReporter(Sema &S) : S(S), uses(0) {}
   ~UninitValsDiagReporter() { 
     flushDiagnostics();
   }
 
-  MappedType &getUses(const VarDecl *vd) {
+  MappedType &getUses(const Decl *vd) {
     if (!uses)
       uses = new UsesMap();
 
     MappedType &V = (*uses)[vd];
     if (!V.getPointer())
       V.setPointer(new UsesVec());
     
     return V;
   }
   
-  void handleUseOfUninitVariable(const VarDecl *vd, const UninitUse &use) {
+  void handleUseOfUninitVariable(const ValueDecl *vd, const UninitUse &use) {
     getUses(vd).getPointer()->push_back(use);
   }
-  
-  void handleSelfInit(const VarDecl *vd) {
+  void handleSelfInit(const ValueDecl *vd) {
     getUses(vd).setInt(true);
   }
-  
   void flushDiagnostics() {
     if (!uses)
       return;
 
     for (UsesMap::iterator i = uses->begin(), e = uses->end(); i != e; ++i) {
-      const VarDecl *vd = i->first;
       const MappedType &V = i->second;
+      const Decl *d = i->first;
 
       UsesVec *vec = V.getPointer();
       bool hasSelfInit = V.getInt();
 
       // Specially handle the case where we have uses of an uninitialized 
       // variable, but the root cause is an idiomatic self-init.  We want
       // to report the diagnostic at the self-init since that is the root cause.
-      if (!vec->empty() && hasSelfInit && hasAlwaysUninitializedUse(vec))
-        DiagnoseUninitializedUse(S, vd,
-                                 UninitUse(vd->getInit()->IgnoreParenCasts(),
-                                           /* isAlwaysUninit */ true),
-                                 /* alwaysReportSelfInit */ true);
+      if (!vec->empty() && hasSelfInit && hasAlwaysUninitializedUse(vec) &&
+          isa<VarDecl>(d))
+        DiagnoseUninitializedUse(
+            S, cast<VarDecl>(d),
+            UninitUse(cast<VarDecl>(d)->getInit()->IgnoreParenCasts(),
       else {
         // Sort the uses by their SourceLocations.  While not strictly
         // guaranteed to produce them in line/column order, this will provide
         // a stable ordering.
         std::sort(vec->begin(), vec->end(), SLocSort());
         
         for (UsesVec::iterator vi = vec->begin(), ve = vec->end(); vi != ve;
              ++vi) {
           // If we have self-init, downgrade all uses to 'may be uninitialized'.
           UninitUse Use = hasSelfInit ? UninitUse(vi->getUser(), false) : *vi;
 
-          if (DiagnoseUninitializedUse(S, vd, Use))
+          if (isa<VarDecl>(d)
+                  ? DiagnoseUninitializedUse(S, cast<VarDecl>(d), Use)
+                  : DiagnoseUninitializedUse(S, cast<FieldDecl>(d), Use))
             // Skip further diagnostics for this variable. We try to warn only
             // on the first point at which a variable is used uninitialized.
             break;
         }
       }
-      
       // Release the uses vector.
       delete vec;
     }
     delete uses;
   }
 
 private:
   static bool hasAlwaysUninitializedUse(const UsesVec* vec) {
AnalysisBasedWarnings::IssueWarnings(sema::AnalysisBasedWarnings::Policy P,
   // (1) The CFGs often can't be constructed (if the body is invalid), so
   //     don't bother trying.
   // (2) The code already has problems; running the analysis just takes more
   //     time.
   DiagnosticsEngine &Diags = S.getDiagnostics();
 
   // Do not do any analysis for declarations in system headers if we are
   // going to just ignore them.
-  if (Diags.getSuppressSystemWarnings() &&
+  if (Diags.getSuppressSystemWarnings() && D->getLocation().isValid() &&
       S.SourceMgr.isInSystemHeader(D->getLocation()))
     return;
 
   // For code in dependent contexts, we'll do this at instantiation time.
   if (cast<DeclContext>(D)->isDependentContext())
     return;
 
   if (Diags.hasUncompilableErrorOccurred() || Diags.hasFatalErrorOccurred()) {
AnalysisBasedWarnings::IssueWarnings(sema::AnalysisBasedWarnings::Policy P,
   }
   else {
     AC.getCFGBuildOptions()
       .setAlwaysAdd(Stmt::BinaryOperatorClass)
       .setAlwaysAdd(Stmt::CompoundAssignOperatorClass)
       .setAlwaysAdd(Stmt::BlockExprClass)
       .setAlwaysAdd(Stmt::CStyleCastExprClass)
       .setAlwaysAdd(Stmt::DeclRefExprClass)
+      .setAlwaysAdd(Stmt::MemberExprClass)
+      .setAlwaysAdd(Stmt::CXXDefaultInitExprClass)
       .setAlwaysAdd(Stmt::ImplicitCastExprClass)
       .setAlwaysAdd(Stmt::UnaryOperatorClass)
       .setAlwaysAdd(Stmt::AttributedStmtClass);
   }
 
 
   // Emit delayed diagnostics.
   if (!fscope->PossiblyUnreachableDiags.empty()) {

lib/Sema/SemaDeclCXX.cpp

 #include "clang/AST/RecursiveASTVisitor.h"
 #include "clang/AST/StmtVisitor.h"
 #include "clang/AST/TypeLoc.h"
 #include "clang/AST/TypeOrdering.h"
 #include "clang/Basic/PartialDiagnostic.h"
 #include "clang/Basic/TargetInfo.h"
 #include "clang/Lex/LiteralSupport.h"
 #include "clang/Lex/Preprocessor.h"
+#include "clang/Sema/AnalysisBasedWarnings.h"
 #include "clang/Sema/CXXFieldCollector.h"
 #include "clang/Sema/DeclSpec.h"
 #include "clang/Sema/Initialization.h"
 #include "clang/Sema/Lookup.h"
 #include "clang/Sema/ParsedTemplate.h"
 #include "clang/Sema/Scope.h"
 #include "clang/Sema/ScopeInfo.h"
 #include "llvm/ADT/STLExtras.h"
if (Diags.getDiagnosticLevel(diag::warn_unused_private_field,
           !InitializationHasSideEffects(*FD))
         UnusedPrivateFields.insert(FD);
     }
   }
 
   return Member;
 }
 
-namespace {
-  class UninitializedFieldVisitor
-      : public EvaluatedExprVisitor<UninitializedFieldVisitor> {
-    Sema &S;
-    // List of Decls to generate a warning on.  Also remove Decls that become
-    // initialized.
-    llvm::SmallPtrSet<ValueDecl*, 4> &Decls;
-    // If non-null, add a note to the warning pointing back to the constructor.
-    const CXXConstructorDecl *Constructor;
-  public:
-    typedef EvaluatedExprVisitor<UninitializedFieldVisitor> Inherited;
-    UninitializedFieldVisitor(Sema &S,
-                              llvm::SmallPtrSet<ValueDecl*, 4> &Decls,
-                              const CXXConstructorDecl *Constructor)
-      : Inherited(S.Context), S(S), Decls(Decls),
-        Constructor(Constructor) { }
-
-    void HandleMemberExpr(MemberExpr *ME, bool CheckReferenceOnly) {
-      if (isa<EnumConstantDecl>(ME->getMemberDecl()))
-        return;
-
-      // FieldME is the inner-most MemberExpr that is not an anonymous struct
-      // or union.
-      MemberExpr *FieldME = ME;
-
-      Expr *Base = ME;
-      while (isa<MemberExpr>(Base)) {
-        ME = cast<MemberExpr>(Base);
-
-        if (isa<VarDecl>(ME->getMemberDecl()))
-          return;
-
-        if (FieldDecl *FD = dyn_cast<FieldDecl>(ME->getMemberDecl()))
-          if (!FD->isAnonymousStructOrUnion())
-            FieldME = ME;
-
-        Base = ME->getBase();
-      }
-
-      if (!isa<CXXThisExpr>(Base))
-        return;
-
-      ValueDecl* FoundVD = FieldME->getMemberDecl();
-
-      if (!Decls.count(FoundVD))
-        return;
-
-      const bool IsReference = FoundVD->getType()->isReferenceType();
-
-      // Prevent double warnings on use of unbounded references.
-      if (IsReference != CheckReferenceOnly)
-        return;
-
-      unsigned diag = IsReference
-          ? diag::warn_reference_field_is_uninit
-          : diag::warn_field_is_uninit;
-      S.Diag(FieldME->getExprLoc(), diag) << FoundVD;
-      if (Constructor)
-        S.Diag(Constructor->getLocation(),
-               diag::note_uninit_in_this_constructor)
-          << (Constructor->isDefaultConstructor() && Constructor->isImplicit());
-
-    }
-
-    void HandleValue(Expr *E) {
-      E = E->IgnoreParens();
-
-      if (MemberExpr *ME = dyn_cast<MemberExpr>(E)) {
-        HandleMemberExpr(ME, false /*CheckReferenceOnly*/);
-        return;
-      }
-
-      if (ConditionalOperator *CO = dyn_cast<ConditionalOperator>(E)) {
-        HandleValue(CO->getTrueExpr());
-        HandleValue(CO->getFalseExpr());
-        return;
-      }
-
-      if (BinaryConditionalOperator *BCO =
-              dyn_cast<BinaryConditionalOperator>(E)) {
-        HandleValue(BCO->getCommon());
-        HandleValue(BCO->getFalseExpr());
-        return;
-      }
-
-      if (BinaryOperator *BO = dyn_cast<BinaryOperator>(E)) {
-        switch (BO->getOpcode()) {
-        default:
-          return;
-        case(BO_PtrMemD):
-        case(BO_PtrMemI):
-          HandleValue(BO->getLHS());
-          return;
-        case(BO_Comma):
-          HandleValue(BO->getRHS());
-          return;
-        }
-      }
-    }
-
-    void VisitMemberExpr(MemberExpr *ME) {
-      // All uses of unbounded reference fields will warn.
-      HandleMemberExpr(ME, true /*CheckReferenceOnly*/);
-
-      Inherited::VisitMemberExpr(ME);
-    }
-
-    void VisitImplicitCastExpr(ImplicitCastExpr *E) {
-      if (E->getCastKind() == CK_LValueToRValue)
-        HandleValue(E->getSubExpr());
-
-      Inherited::VisitImplicitCastExpr(E);
-    }
-
-    void VisitCXXConstructExpr(CXXConstructExpr *E) {
-      if (E->getConstructor()->isCopyConstructor())
-        if (ImplicitCastExpr* ICE = dyn_cast<ImplicitCastExpr>(E->getArg(0)))
-          if (ICE->getCastKind() == CK_NoOp)
-            if (MemberExpr *ME = dyn_cast<MemberExpr>(ICE->getSubExpr()))
-              HandleMemberExpr(ME, false /*CheckReferenceOnly*/);
-      
-      Inherited::VisitCXXConstructExpr(E);
-    }
-
-    void VisitCXXMemberCallExpr(CXXMemberCallExpr *E) {
-      Expr *Callee = E->getCallee();
-      if (isa<MemberExpr>(Callee))
-        HandleValue(Callee);
-
-      Inherited::VisitCXXMemberCallExpr(E);
-    }
-
-    void VisitBinaryOperator(BinaryOperator *E) {
-      // If a field assignment is detected, remove the field from the
-      // uninitiailized field set.
-      if (E->getOpcode() == BO_Assign)
-        if (MemberExpr *ME = dyn_cast<MemberExpr>(E->getLHS()))
-          if (FieldDecl *FD = dyn_cast<FieldDecl>(ME->getMemberDecl()))
-            if (!FD->getType()->isReferenceType())
-              Decls.erase(FD);
-
-      Inherited::VisitBinaryOperator(E);
-    }
-  };
-  static void CheckInitExprContainsUninitializedFields(
-      Sema &S, Expr *E, llvm::SmallPtrSet<ValueDecl*, 4> &Decls,
-      const CXXConstructorDecl *Constructor) {
-    if (Decls.size() == 0)
-      return;
-
-    if (!E)
-      return;
-
-    if (CXXDefaultInitExpr *Default = dyn_cast<CXXDefaultInitExpr>(E)) {
-      E = Default->getExpr();
-      if (!E)
-        return;
-      // In class initializers will point to the constructor.
-      UninitializedFieldVisitor(S, Decls, Constructor).Visit(E);
-    } else {
-      UninitializedFieldVisitor(S, Decls, 0).Visit(E);
-    }
-  }
-
-  // Diagnose value-uses of fields to initialize themselves, e.g.
-  //   foo(foo)
-  // where foo is not also a parameter to the constructor.
-  // Also diagnose across field uninitialized use such as
-  //   x(y), y(x)
-  // TODO: implement -Wuninitialized and fold this into that framework.
-  static void DiagnoseUninitializedFields(
-      Sema &SemaRef, const CXXConstructorDecl *Constructor) {
-
-    if (SemaRef.getDiagnostics().getDiagnosticLevel(diag::warn_field_is_uninit,
-                                                    Constructor->getLocation())
-        == DiagnosticsEngine::Ignored) {
-      return;
-    }
-
-    if (Constructor->isInvalidDecl())
-      return;
-
-    const CXXRecordDecl *RD = Constructor->getParent();
-
-    // Holds fields that are uninitialized.
-    llvm::SmallPtrSet<ValueDecl*, 4> UninitializedFields;
-
-    // At the beginning, all fields are uninitialized.
-    for (DeclContext::decl_iterator I = RD->decls_begin(), E = RD->decls_end();
-         I != E; ++I) {
-      if (FieldDecl *FD = dyn_cast<FieldDecl>(*I)) {
-        UninitializedFields.insert(FD);
-      } else if (IndirectFieldDecl *IFD = dyn_cast<IndirectFieldDecl>(*I)) {
-        UninitializedFields.insert(IFD->getAnonField());
-      }
-    }
-
-    for (CXXConstructorDecl::init_const_iterator FieldInit =
-             Constructor->init_begin(),
-             FieldInitEnd = Constructor->init_end();
-         FieldInit != FieldInitEnd; ++FieldInit) {
-
-      Expr *InitExpr = (*FieldInit)->getInit();
-
-      CheckInitExprContainsUninitializedFields(
-          SemaRef, InitExpr, UninitializedFields, Constructor);
-
-      if (FieldDecl *Field = (*FieldInit)->getAnyMember())
-        UninitializedFields.erase(Field);
-    }
-  }
-} // namespace
-
 /// ActOnCXXInClassMemberInitializer - This is invoked after parsing an
 /// in-class initializer for a non-static C++ class member, and after
 /// instantiating an in-class initializer in a class template. Such actions
 /// are deferred until the class is complete.
 void
 Sema::ActOnCXXInClassMemberInitializer(Decl *D, SourceLocation InitLoc,
                                        Expr *InitExpr) {
   FieldDecl *FD = cast<FieldDecl>(D);
void Sema::ActOnMemInitializers(Decl *ConstructorDecl,
   }
 
   if (HadError)
     return;
 
   DiagnoseBaseOrMemInitializerOrder(*this, Constructor, MemInits);
 
   SetCtorInitializers(Constructor, AnyErrors, MemInits);
-
-  DiagnoseUninitializedFields(*this, Constructor);
 }
 
 void
 Sema::MarkBaseAndMemberDestructorsReferenced(SourceLocation Location,
                                              CXXRecordDecl *ClassDecl) {
   // Ignore dependent contexts. Also ignore unions, since their members never
   // have destructors implicitly called.
   if (ClassDecl->isDependentContext() || ClassDecl->isUnion())

 
 void Sema::ActOnDefaultCtorInitializers(Decl *CDtorDecl) {
   if (!CDtorDecl)
     return;
 
   if (CXXConstructorDecl *Constructor
       = dyn_cast<CXXConstructorDecl>(CDtorDecl)) {
     SetCtorInitializers(Constructor, /*AnyErrors=*/false);
-    DiagnoseUninitializedFields(*this, Constructor);
   }
 }
 
 bool Sema::RequireNonAbstractType(SourceLocation Loc, QualType T,
                                   unsigned DiagID, AbstractDiagSelID SelID) {
   class NonAbstractTypeDiagnoser : public TypeDiagnoser {
     unsigned DiagID;
     AbstractDiagSelID SelID;
void Sema::DefineImplicitDefaultConstructor(SourceLocation CurrentLocation,
 
   Constructor->markUsed(Context);
   MarkVTableUsed(CurrentLocation, ClassDecl);
 
   if (ASTMutationListener *L = getASTMutationListener()) {
     L->CompletedImplicitDefinition(Constructor);
   }
 
-  DiagnoseUninitializedFields(*this, Constructor);
+  // CXXDefaultInitExprs will be used for in-class initialized members. This
+  // triggers the UninitializedValues check.
+  sema::AnalysisBasedWarnings::Policy P = AnalysisWarnings.getDefaultPolicy();
+  AnalysisWarnings.IssueWarnings(P, FunctionScopes.back(), Constructor, 0);
 }
 
 void Sema::ActOnFinishDelayedMemberInitializers(Decl *D) {
   // Perform any delayed checks on exception specifications.
   CheckDelayedMemberExceptionSpecs();
 }
 
 namespace {
 /// Information on inheriting constructors to declare.

lib/StaticAnalyzer/Core/BugReporter.cpp

for (PathPieces::iterator I = Pieces.begin(), E = Pieces.end(); I != E; ++I) {
     else
       ThisCallLocation = &Call->callEnter;
 
     assert(ThisCallLocation && "Outermost call has an invalid location");
     adjustCallLocations(Call->path, ThisCallLocation);
   }
 }
 
+/// Returns true if the children tree spanned by the first statement contains
+/// the second statement.
+static bool containsStmt(const Stmt *Ex, const Stmt *S) {
+  if (Ex == S)
+    return true;
+
+  for (Stmt::const_child_iterator I = Ex->child_begin(), E = Ex->child_end();
+       I != E; ++I) {
+    if (containsStmt(*I, S))
+      return true;
+  }
+  return false;
+}
+
 /// Remove edges in and out of C++ default initializer expressions. These are
 /// for fields that have in-class initializers, as opposed to being initialized
 /// explicitly in a constructor or braced list.
 static void removeEdgesToDefaultInitializers(PathPieces &Pieces) {
   for (PathPieces::iterator I = Pieces.begin(), E = Pieces.end(); I != E;) {
     if (PathDiagnosticCallPiece *C = dyn_cast<PathDiagnosticCallPiece>(*I))
       removeEdgesToDefaultInitializers(C->path);
 
     if (PathDiagnosticMacroPiece *M = dyn_cast<PathDiagnosticMacroPiece>(*I))
       removeEdgesToDefaultInitializers(M->subPieces);
 
     if (PathDiagnosticControlFlowPiece *CF =
           dyn_cast<PathDiagnosticControlFlowPiece>(*I)) {
       const Stmt *Start = CF->getStartLocation().asStmt();
       const Stmt *End = CF->getEndLocation().asStmt();
       if (Start && isa<CXXDefaultInitExpr>(Start)) {
         I = Pieces.erase(I);
         continue;
       } else if (End && isa<CXXDefaultInitExpr>(End)) {
+        const Expr *InitExpr = cast<CXXDefaultInitExpr>(End)->getExpr();
+        if (Start && containsStmt(InitExpr, Start)) {
+          if (I != Pieces.begin()) {
+            PathPieces::iterator Prev = llvm::prior(I);
+            if (PathDiagnosticControlFlowPiece *PrevCF =
+                    dyn_cast<PathDiagnosticControlFlowPiece>(*Prev)) {
+              CF->setStartLocation(PrevCF->getStartLocation());
+              Start = CF->getStartLocation().asStmt();
+              Pieces.erase(Prev);
+              continue;
+            }
+          }
+        } else {
           PathPieces::iterator Next = llvm::next(I);
           if (Next != E) {
             if (PathDiagnosticControlFlowPiece *NextCF =
                     dyn_cast<PathDiagnosticControlFlowPiece>(*Next)) {
               NextCF->setStartLocation(CF->getStartLocation());
             }
           }
+        }
         I = Pieces.erase(I);
         continue;
       }
     }
 
     I++;
   }
 }

test/Analysis/edges-new.mm

POINTER(void) testMacroInFunctionDecl(void *q) {
   int *p = 0;
   *p = 1;
   return q;
 }
 
 namespace rdar14960554 {
   class Foo {
     int a = 1;
-    int b = 2;
+    int b = a ? 2 : 4;
     int c = 3;
 
     Foo() :
       a(0),
       c(3) {
       // Check that we don't have an edge to the in-class initializer for 'b'.
       if (b == 2)
         *(volatile int *)0 = 1;

test/SemaCXX/constructor-initializer.cpp

 struct Q {
   Q() : f1(1,2),       // expected-error {{excess elements in scalar initializer}}
         pf(0.0)  { }   // expected-error {{cannot initialize a member subobject of type 'float *' with an rvalue of type 'double'}}
   float f1;
 
   float *pf;
 };
 
-// A silly class used to demonstrate field-is-uninitialized in constructors with
-// multiple params.
-int IntParam(int i) { return 0; };
-class TwoInOne { public: TwoInOne(TwoInOne a, TwoInOne b) {} };
-class InitializeUsingSelfTest {
-  bool A;
-  char* B;
-  int C;
-  TwoInOne D;
-  int E;
-  InitializeUsingSelfTest(int F)
-      : A(A),  // expected-warning {{field 'A' is uninitialized when used here}}
-        B((((B)))),  // expected-warning {{field 'B' is uninitialized when used here}}
-        C(A && InitializeUsingSelfTest::C),  // expected-warning {{field 'C' is uninitialized when used here}}
-        D(D,  // expected-warning {{field 'D' is uninitialized when used here}}
-          D), // expected-warning {{field 'D' is uninitialized when used here}}
-        E(IntParam(E)) {} // expected-warning {{field 'E' is uninitialized when used here}}
-};
-
-int IntWrapper(int &i) { return 0; };
-class InitializeUsingSelfExceptions {
-  int A;
-  int B;
-  int C;
-  void *P;
-  InitializeUsingSelfExceptions(int B)
-      : A(IntWrapper(A)),  // Due to a conservative implementation, we do not report warnings inside function/ctor calls even though it is possible to do so.
-        B(B),  // Not a warning; B is a local variable.
-        C(sizeof(C)),  // sizeof doesn't reference contents, do not warn
-        P(&P) {} // address-of doesn't reference contents (the pointer may be dereferenced in the same expression but it would be rare; and weird)
-};
-
-class CopyConstructorTest {
-  bool A, B, C;
-  CopyConstructorTest(const CopyConstructorTest& rhs)
-      : A(rhs.A),
-        B(B),  // expected-warning {{field 'B' is uninitialized when used here}}
-        C(rhs.C || C) { }  // expected-warning {{field 'C' is uninitialized when used here}}
-};
-
 // Make sure we aren't marking default constructors when we shouldn't be.
 template<typename T>
 struct NDC {
   T &ref;
   
   NDC() { }
   NDC(T &ref) : ref(ref) { }
 };
namespace PR12049 {
   class Class
   {
   public:
       Class() : member(function() {} // expected-note {{to match this '('}}
 
       int member; // expected-error {{expected ')'}}
   };
 }
-
-namespace PR14073 {
-  struct S1 { union { int n; }; S1() : n(n) {} };  // expected-warning {{field 'n' is uninitialized when used here}}
-  struct S2 { union { union { int n; }; char c; }; S2() : n(n) {} };  // expected-warning {{field 'n' is uninitialized when used here}}
-  struct S3 { struct { int n; }; S3() : n(n) {} };  // expected-warning {{field 'n' is uninitialized when used here}}
-}

test/SemaCXX/defaulted-ctor-loop.cpp

-// RUN: %clang_cc1 -fsyntax-only -verify -std=c++11 %s
+// RUN: %clang_cc1 -fsyntax-only -verify -std=c++11 -Wuninitialized %s
 
 // WARNING: This test may recurse infinitely if failing.
 
 struct foo;
 struct bar {
   bar(foo&);
 };
 struct foo {
   bar b;
   foo()
     : b(b) // expected-warning{{field 'b' is uninitialized}}
   {}
 };

test/SemaCXX/uninitialized.cpp

-// RUN: %clang_cc1 -fsyntax-only -Wall -Wuninitialized -Wno-unused-value -std=c++11 -verify %s
+// RUN: %clang_cc1 -fsyntax-only -Wall -Wuninitialized -Wno-unused-value -Wno-reorder -std=c++11 -verify %s
 
 int foo(int x);
 int bar(int* x);
 int boo(int& x);
 int far(const int& x);
 
 // Test self-references within initializers which are guaranteed to be
 // uninitialized.
void setupA(bool x) {
   A a20{a20};  // expected-warning {{variable 'a20' is uninitialized when used within its own initialization}}
   A a21 = {a21};  // expected-warning {{variable 'a21' is uninitialized when used within its own initialization}}
 
   // FIXME: Make the local uninitialized warning consistant with the global
   // uninitialized checking.
   A *a22 = new A(a22->count);  // expected-warning {{variable 'a22' is uninitialized when used within its own initialization}}
   A *a23 = new A(a23->ONE);  // expected-warning {{variable 'a23' is uninitialized when used within its own initialization}}
   A *a24 = new A(a24->TWO);  // expected-warning {{variable 'a24' is uninitialized when used within its own initialization}}
-  A *a25 = new A(a25->zero());  // expected-warning {{variable 'a25' is uninitialized when used within its own initialization}}
+  A *a25 = new A(a25->zero());  // no-warning: zero is a static method.
 
   A *a26 = new A(a26->get());    // expected-warning {{variable 'a26' is uninitialized when used within its own initialization}}
   A *a27 = new A(a27->get2());  // expected-warning {{variable 'a27' is uninitialized when used within its own initialization}}
   A *a28 = new A(a28->num);  // expected-warning {{variable 'a28' is uninitialized when used within its own initialization}}
 }
 
 bool x;
 

 
 // Also test similar constructs in a field's initializer.
 struct S {
   int x;
   void *ptr;
 
   S(bool (*)[1]) : x(x) {} // expected-warning {{field 'x' is uninitialized when used here}}
   S(bool (*)[2]) : x(x + 1) {} // expected-warning {{field 'x' is uninitialized when used here}}
-  S(bool (*)[3]) : x(x + x) {} // expected-warning 2{{field 'x' is uninitialized when used here}}
+  S(bool (*)[3]) : x(x + x) {} // expected-warning {{field 'x' is uninitialized when used here}}
   S(bool (*)[4]) : x(static_cast<long>(x) + 1) {} // expected-warning {{field 'x' is uninitialized when used here}}
   S(bool (*)[5]) : x(foo(x)) {} // expected-warning {{field 'x' is uninitialized when used here}}
 
   // These don't actually require the value of x and so shouldn't warn.
   S(char (*)[1]) : x(sizeof(x)) {} // rdar://8610363
   S(char (*)[2]) : ptr(&ptr) {}
   S(char (*)[3]) : x(__alignof__(x)) {}
   S(char (*)[4]) : x(bar(&x)) {}
namespace {
   };
 
   struct E {
     int b = 1;
     int c = 1;
     int a;  // This field needs to be last to prevent the cross field
             // uninitialized warning.
     E(char (*)[1]) : a(a ? b : c) {}  // expected-warning {{field 'a' is uninitialized when used here}}
-    E(char (*)[2]) : a(b ? a : a) {} // expected-warning 2{{field 'a' is uninitialized when used here}}
+    E(char (*)[2]) : a(b ? a : a) {} // expected-warning {{field 'a' is uninitialized when used here}}
     E(char (*)[3]) : a(b ? (a) : c) {} // expected-warning {{field 'a' is uninitialized when used here}}
     E(char (*)[4]) : a(b ? c : (a+c)) {} // expected-warning {{field 'a' is uninitialized when used here}}
     E(char (*)[5]) : a(b ? c : b) {}
 
-    E(char (*)[6]) : a(a ?: a) {} // expected-warning 2{{field 'a' is uninitialized when used here}}
+    E(char (*)[6]) : a(a ?: a) {} // expected-warning {{field 'a' is uninitialized when used here}}
     E(char (*)[7]) : a(b ?: a) {} // expected-warning {{field 'a' is uninitialized when used here}}
     E(char (*)[8]) : a(a ?: c) {} // expected-warning {{field 'a' is uninitialized when used here}}
     E(char (*)[9]) : a(b ?: c) {}
 
     E(char (*)[10]) : a((a, a, b)) {}
-    E(char (*)[11]) : a((c + a, a + 1, b)) {} // expected-warning 2{{field 'a' is uninitialized when used here}}
+    E(char (*)[11]) : a((c + a, a + 1, b)) {} // expected-warning {{field 'a' is uninitialized when used here}}
     E(char (*)[12]) : a((b + c, c, a)) {} // expected-warning {{field 'a' is uninitialized when used here}}
     E(char (*)[13]) : a((a, a, a, a)) {} // expected-warning {{field 'a' is uninitialized when used here}}
     E(char (*)[14]) : a((b, c, c)) {}
   };
 
   struct F {
     int a;
     F* f;
struct G {
 
     G(char (*)[4]) : f1(f1.*ptr) {} // expected-warning {{field 'f1' is uninitialized when used here}}
     G(char (*)[5]) : f2(f1.*ptr) {}
 
     G(char (*)[6]) : f3(f3) {}  // expected-warning {{field 'f3' is uninitialized when used here}}
     G(char (*)[7]) : f3(f3->*f_ptr) {} // expected-warning {{field 'f3' is uninitialized when used here}}
     G(char (*)[8]) : f3(new F(f3->*ptr)) {} // expected-warning {{field 'f3' is uninitialized when used here}}
   };
+
+  int H2() { return 2; };
+  struct H;
+  void H3(const H *h) {}
+  void H4(H *h) {}
+  void H5(int *a) {
+    *a = 42;
+  }
+  void H6(const int &a) { }
+
+  struct H {
+    int a, b;
+    F* f;
+    void H1() {}
+    H() : a(0), b(1), f(nullptr) {}
+    H(char (*)[1]) : a(1) { b = a; }
+    H(char (*)[2]) { b = a; } // expected-warning {{field 'a' is uninitialized when used here}}
+    H(char (*)[3]) { H1(); b = a; } // no-warning: H1 may initialize a and b
+    H(char (*)[4]) { H2(); a = b; } // expected-warning {{field 'b' is uninitialized when used here}}
+    H(char (*)[5]) : b(2) {
+      a = f->a; // expected-warning {{field 'f' is uninitialized when used here}}
+      f->a = b; // no-warning: b is initialized
+    }
+    H(char (*)[6]) : f(new F()) { a = f->a; f->a = b; } // expected-warning {{field 'b' is uninitialized when used here}}
+    H(char (*)[7]) : a(2) {
+      int a1 = a;
+      int b1 = b; // expected-warning {{field 'b' is uninitialized when used here}}
+      F f1 = *f; // expected-warning {{field 'f' is uninitialized when used here}}
+      a = a1 + b1;
+      b = f1.a;
+    }
+    H(char (*)[8]) { H h2; h2.H1(); b = a; } // expected-warning {{field 'a' is uninitialized when used here}}
+    H(char (*)[9]) { H3(this); b = f->a; } // expected-warning {{field 'f' is uninitialized when used here}}
+    H(char (*)[10]) { H4(this); b = f->a; }
+    H(char (*)[11]) { H h2; h2.H1(); b = h2.b; h2.a = a; } // expected-warning {{field 'a' is uninitialized when used here}}
+    H(char (*)[12]) {
+      H5(&b);
+      a = b;
+    }
+    H(char (*)[13]) {
+      H6(b);
+      a = b; // expected-warning {{field 'b' is uninitialized when used here}}
+    }
+    H(const H &h) { a = h.a; b = h.b; f = h.f; }
+  };
+
+  struct I {
+    int c;
+    G *g;
+    I(char (*)[1]) { c = g->f2.f->a; } // expected-warning {{field 'g' is uninitialized when used here}}
+  };
+
+  union J {
+    int a;
+    float b;
+    J() : a(1) {
+      float f = b;
+      b = -f;
+    }
+    J(char (*)[1]) {
+      float x = b; // expected-warning {{field 'b' is uninitialized when used here}}
+      b = -x;
+    }
+  };
+
+  struct K {
+    int k;
+    int j;
+    static const K k2;
+    K() {
+      this->operator=(k2);
+      j = k;
+    }
+    K(int) {
+      *this = k2;
+      k = j;
+    }
+  };
+  const K K::k2;
+
+  struct L { int l; };
+  struct M { L &l; };
+  struct N {
+    int n;
+    M m;
+    N(L &l) : m{l}, n(m.l.l = 0) {} // expected-warning {{field 'm' is uninitialized when used here}}
+  };
 }
 
 namespace statics {
   static int a = a; // no-warning: used to signal intended lack of initialization.
   static int b = b + 1; // expected-warning {{variable 'b' is uninitialized when used within its own initialization}}
   static int c = (c + c); // expected-warning 2{{variable 'c' is uninitialized when used within its own initialization}}
   static int e = static_cast<long>(e) + 1; // expected-warning {{variable 'e' is uninitialized when used within its own initialization}}
   static int f = foo(f); // expected-warning {{variable 'f' is uninitialized when used within its own initialization}}
struct B {
     B(char (*)[5]) : a(a.something(a)) {}
     B(char (*)[6]) : a(ref(a)) {}
     B(char (*)[7]) : a(const_ref(a)) {}
     B(char (*)[8]) : a(pointer(&a)) {}
     B(char (*)[9]) : a(normal(a)) {}  // expected-warning {{uninitialized}}
   };
   struct C {
     C() {} // expected-note4{{in this constructor}}
-    A a1 = a1;  // expected-warning {{uninitialized}}
-    A a2 = a2.get();  // expected-warning {{uninitialized}}
+    A a1 = a1;  // expected-warning{{uninitialized}}
+    A a2 = a2.get();  // expected-warning{{uninitialized}}
     A a3 = a3.num();
-    A a4 = a4.copy(a4);  // expected-warning {{uninitialized}}
+    A a4 = a4.copy(a4);  // expected-warning{{uninitialized}}
     A a5 = a5.something(a5);
     A a6 = ref(a6);
     A a7 = const_ref(a7);
     A a8 = pointer(&a8);
-    A a9 = normal(a9);  // expected-warning {{uninitialized}}
+    A a9 = normal(a9);  // expected-warning{{uninitialized}}
   };
   struct D {  // expected-note4{{in the implicit default constructor}}
     A a1 = a1;  // expected-warning {{uninitialized}}
     A a2 = a2.get();  // expected-warning {{uninitialized}}
     A a3 = a3.num();
     A a4 = a4.copy(a4);  // expected-warning {{uninitialized}}
     A a5 = a5.something(a5);
     A a6 = ref(a6);
namespace cross_field_warnings {
   };
 
   struct Q {
     int a;
     int b;
     int &c;
     Q() :
       a(c = 5),  // expected-warning{{reference 'c' is not yet bound to a value when used here}}
+      b(c),  // no warning: warned above
+      c(a) {}
+    Q(int) :
       b(c),  // expected-warning{{reference 'c' is not yet bound to a value when used here}}
       c(a) {}
   };
 
   struct R {
     int a;
     int b;
     int c;
namespace base_class {
   };
 
   struct C : public A {
     int x;
     int y;
     C() : A(y = 4), x(y) {}
   };
 }
+
+// A silly class used to demonstrate field-is-uninitialized in constructors with
+// multiple params.
+int IntParam(int i) { return 0; };
+class TwoInOne { public: TwoInOne(TwoInOne a, TwoInOne b) {} };
+class InitializeUsingSelfTest {
+  bool A;
+  char* B;
+  int C;
+  TwoInOne D;
+  int E;
+  InitializeUsingSelfTest(int F)
+      : A(A),  // expected-warning {{field 'A' is uninitialized when used here}}
+        B((((B)))),  // expected-warning {{field 'B' is uninitialized when used here}}
+        C(A && InitializeUsingSelfTest::C),  // expected-warning {{field 'C' is uninitialized when used here}}
+        D(D, D), // expected-warning {{field 'D' is uninitialized when used here}}
+        E(IntParam(E)) {} // expected-warning {{field 'E' is uninitialized when used here}}
+};
+
+int IntWrapper(int &i) { return 0; };
+class InitializeUsingSelfExceptions {
+  int A;
+  int B;
+  int C;
+  void *P;
+  InitializeUsingSelfExceptions(int B)
+      : A(IntWrapper(A)),  // Due to a conservative implementation, we do not report warnings inside function/ctor calls even though it is possible to do so.
+        B(B),  // Not a warning; B is a local variable.
+        C(sizeof(C)),  // sizeof doesn't reference contents, do not warn
+        P(&P) { (void) this->B; } // address-of doesn't reference contents (the pointer may be dereferenced in the same expression but it would be rare; and weird)
+};
+
+class CopyConstructorTest {
+  bool A, B, C;
+  CopyConstructorTest(const CopyConstructorTest& rhs)
+      : A(rhs.A),
+        B(B),  // expected-warning {{field 'B' is uninitialized when used here}}
+        C(rhs.C || C) { }  // expected-warning {{field 'C' is uninitialized when used here}}
+};
+
+namespace PR14073 {
+  struct S1 { union { int n; }; S1() : n(n) {} };  // expected-warning {{field 'n' is uninitialized when used here}}
+  struct S2 { union { union { int n; }; char c; }; S2() : n(n) {} };  // expected-warning {{field 'n' is uninitialized when used here}}
+  struct S3 { struct { int n; }; S3() : n(n) {} };  // expected-warning {{field 'n' is uninitialized when used here}}
+}