[StaticAnalyzer] Checker to find uninitialized fields after a constructor call

[Szelethus]

Summary

This checker checks at the end of a constructor call whether all fields of the object were initialized.

Note that a significant portion of the code is for handling unions, for which there is very little support in the CSA. In most cases, all fields of a union is regarded as unknown. I checked these cases by regarding unknown fields as uninitialized.

The test files also contain checks for heap allocated objects and unions, but heap regions are mostly conjured in the CSA and unions have little to no support, so the tests for them and unions should work theoretically, but its not 100%. so the tests are not yet functional (used no-warning at places where a warning is expected).

[Szelethus]

Reuploaded the diff with full context.

[NoQ]

That's a lot of code, so it'll take me some time to understand what's going on here. You might be able to help me by the large patch in smaller logical chunks.

The idea looks reasonable. We're having specific warnings for, eg., assigning an uninitialized value, which fire much more often now that we have proper constructor support (eg. they'll fire in the copy constructor when the value was not initialized in the "actual" constructor). While some bugs can be found this way, i agree that it's not the best way to find them.

That said, your checker finds non-bugs, which is always risky. Sometimes the user should be allowed to initialize the field after construction but before the first use as a potentially important performance optimization. Did you find any such intentionally uninitialized fields with your checker? Were there many of those? If a user wants to have his codebase "analyzer-clean", would he be able to suppress the warning without changing the behavior of the program?

If union support is causing problems and you have a lot of workaround in the checker for these problems, i'll definitely suggest removing these workarounds from the initial commit and replacing them with FIXME comments (even if it assumes completely suppressing all warnings on classes that mention unions anywhere in the chain) because i'd much rather move towards better modeling in RegionStore than having checkers work around that. You might also be interested in D45241.

In most cases, all fields of a union is regarded as unknown. I checked these cases by regarding unknown fields as uninitialized.

The whole point of making them unknown, as far as i understand, was to suppress uninitialized field warnings. So i feel what we're doing here is a bit upside down.

test/Analysis/ctor-uninitialized-member.cpp

683 ↗

(On Diff #142053)

I managed to find the thread, but this link doesn't work for me.

869 ↗

(On Diff #142053)

Hmm, shouldn't it say "expected"? Do these tests actually work?

[Szelethus]

test/Analysis/ctor-uninitialized-member.cpp

869 ↗

(On Diff #142053)

Since unions are not yet supported by the CSA, this is only what would be expected from this checker to find in the future. I purposely wrote 'xpected' so tests wouldn't break.

[Szelethus]

In D45532#1064652, @NoQ wrote:

In most cases, all fields of a union is regarded as unknown. I checked these cases by regarding unknown fields as uninitialized.

The whole point of making them unknown, as far as i understand, was to suppress uninitialized field warnings. So i feel what we're doing here is a bit upside down.

I wasn't too clear on this one: unknown fields are regarded as uninitialized, what I wrote was a temporary change in the code so I could check whether it would work.

I agree with you regarding unions, and will remove the code that relies on non existing implementation.

[NoQ]

Ok, thanks, looking forward to it!

test/Analysis/ctor-uninitialized-member.cpp

869 ↗

(On Diff #142053)

Aha, okay, got it. The tradition is to say "// no-warning" and then put a FIXME nearby saying that it should warn, how it should warn, probably why it should warn, if it's non-obvious.

[Szelethus]

In D45532#1064670, @Szelethus wrote:

I wasn't too clear on this one: unknown fields are regarded as uninitialized, what I wrote was a temporary change in the code so I could check whether it would work.

Woops, I meant that unknown fields are regarded az initialized.

[NoQ]

In D45532#1064685, @Szelethus wrote:

In D45532#1064670, @Szelethus wrote:

I wasn't too clear on this one: unknown fields are regarded as uninitialized, what I wrote was a temporary change in the code so I could check whether it would work.

Woops, I meant that unknown fields are regarded az initialized.

Aha, yep, that makes a lot more sense =)

[whisperity]

@NoQ Do you reckon these tests files are too long? Perhaps the one about this inheritance, that inheritance, diamond inheritance, etc. could be split into multiple files.

include/clang/StaticAnalyzer/Checkers/Checkers.td

317

This always pokes me in the eye, but shouldn't this file be sorted alphabetically?

lib/StaticAnalyzer/Checkers/CtorUninitializedMemberChecker.cpp

103 ↗

(On Diff #142053)

I believe fundamental object should be rephrased as of fundamental type (as in: object that is of fundamental type), as the standard talks about fundamental types.

187 ↗

(On Diff #142053)

I think somewhere there should be a bit of reasoning why exactly these cases are ignored by the checker.

218 ↗

(On Diff #142053)

Maybe one could use a Twine or a string builder to avoid all these unneccessary string instantiations? Or std::string::append()?

316 ↗

(On Diff #142053)

(See, you use fundamental type here.)

340 ↗

(On Diff #142053)

Please put : after TODO.

342 ↗

(On Diff #142053)

What does it refer to in this sentence?

421 ↗

(On Diff #142053)

Please insert a : after TODO here too.

475 ↗

(On Diff #142053)

Maybe this could be made more explicit (as opposed to a comment) by using [[http://llvm.org/doxygen/classllvm_1_1StringRef.html#a3f45a78650a72626cdf9210de0c6d701|StringRef::rtrim(StringRef)]], like this:

return OS.str().rtrim('.').rtrim("->");

How does this code behave if the Chain is empty and thus OS contains no string whatsoever? drop_back asserts if you want to drop more elements than the length of the string.

498 ↗

(On Diff #142053)

Comment isn't formatted as full sentence.

501 ↗

(On Diff #142053)

Neither here.

test/Analysis/ctor-uninitialized-member.cpp

683 ↗

(On Diff #142053)

Confirmed, this link is a 404.

[whisperity]

Sorry, one comment has gone missing meanwhile, I'm still getting used to this interface and hit Submit early.

test/Analysis/ctor-uninitialized-member-inheritance.cpp

24 ↗

(On Diff #142053)

The literal 420 is repeated everywhere in this file. I think this (the same value appearing over and over again) will make debugging bad if something goes haywire and one has to look at memory dumps, control-flow-graphs, etc.

[Szelethus]

Thank you for all your comments so far! I'll probably only be able to update the diff tomorrow (with me being in the GMT + 1 timezone).

That's a lot of code, so it'll take me some time to understand what's going on here. You might be able to help me by the large patch in smaller logical chunks.

I know, and I tried to look for ways to split this checker into smaller logical chunks, but I didn't find a satisfying solution. I'll be sure to review the comments I have in the code so it's as easy as possible to understand what I did and why I did it. Also, I'd be delighted to help any way I can to guide you through it! :)

That said, your checker finds non-bugs, which is always risky. Sometimes the user should be allowed to initialize the field after construction but before the first use as a potentially important performance optimization. [...] If a user wants to have his codebase "analyzer-clean", would he be able to suppress the warning without changing the behavior of the program?

I didn't implement anything explicitly to suppress warnings, so if there is nothing in the CSA by default for it, I'm afraid this isn't possible (just yet).

My checker is mainly a tool to enforce the rule that every field should be initialized in a C++ object. While I see that this approach could result reduced performance, I think it's fine to say that those users who find this important (by 'this' I mean not initializing every field) should not enable this checker.

Nevertheless, I'd be happy to know what you think of this.

Did you find any such intentionally uninitialized fields with your checker? Were there many of those?

I ran the checker on some projects, but it's little difficult to analyze larger ones as this checker emits very important information in notes, and those are not yet part of the plist output. But it's coming: https://reviews.llvm.org/D45407! I'll be sure to answer these questions as soon as I can.

lib/StaticAnalyzer/Checkers/CtorUninitializedMemberChecker.cpp

187 ↗

(On Diff #142053)

At this function's declaration I have some comments describing what this does and why it does it. Did you find it insufficient?

test/Analysis/ctor-uninitialized-member-inheritance.cpp

24 ↗

(On Diff #142053)

Would you say that I should rather use a different number for each test case?

[Szelethus]

test/Analysis/ctor-uninitialized-member-inheritance.cpp

24 ↗

(On Diff #142053)

I mean, a different number for each variable within a test case.

[xazax.hun]

lib/StaticAnalyzer/Checkers/CtorUninitializedMemberChecker.cpp

31 ↗

(On Diff #142053)

As far as I understand, for every operation, the only relevant contribution of the non-last elements in the chain is the diagnostic message.
I wonder if you would build a string instead of a FieldRegion chain and only store the last FieldRegion would make this more explicit in the code.

187 ↗

(On Diff #142053)

I am a bit surprised why these errors are not deduplicated by the analyzer. Maybe it would worth some investigation?

272 ↗

(On Diff #142053)

I find the documentation and the name of the function below misleading. isNonUnionUninit tells me this function is not supposed to be called for unions but the documentation suggests otherwise.

283 ↗

(On Diff #142053)

Why do you copy here explicitly instead of taking the Chain argument by value?

292 ↗

(On Diff #142053)

Don't you need to pop somewhere?

[Szelethus]

lib/StaticAnalyzer/Checkers/CtorUninitializedMemberChecker.cpp

187 ↗

(On Diff #142053)

Copied from BugReports constructor documentation for uniqueing:

The reports that have the same report location, description, bug type, and ranges are uniqued - only one of the equivalent reports will be presented to the user. [...]

For this code snippet:

struct A {
   struct B {
      int x, y;
      
      B() {}
   } b;
   int w;

   A() {
      b = B();
   }
};

the warning message after a call to A::A() would be "3 uninitialized fields[...]", and for B::B() inside As constructor would be "2 uninitialized fields[...]", so it wouldn't be filtered out.

292 ↗

(On Diff #142053)

Nice catch! This isn't covered by tests, and would most probably cause an incorrect note message. I'll be sure to fix it.

[MTC]

lib/StaticAnalyzer/Checkers/CtorUninitializedMemberChecker.cpp

10 ↗

(On Diff #142053)

typo :) cunstructors -> constructors

54 ↗

(On Diff #142053)

When I apply this patch, hit a compiler warning. Maybe friend struct is better.

warning: 'FieldChainInfoComparator' defined as a struct here but previously declared as a class [-Wmismatched-tags]

[xazax.hun]

lib/StaticAnalyzer/Checkers/CtorUninitializedMemberChecker.cpp

35 ↗

(On Diff #142053)

I was wondering, do you need the chain at all? I think a field region might be sufficient. The enclosing object of the field should be accessible by querying the super region of the field region.

[Szelethus]

I'm about to update the diff, I changed a quite a lot of stuff, so I'm not sure that I'd be able to respond to these inline comments.

lib/StaticAnalyzer/Checkers/CtorUninitializedMemberChecker.cpp

31 ↗

(On Diff #142053)

I experimented with a number of implementations along this idea, but I just couldn't get it to work. Here are my findings:

• Twine-s aren't meant to be copied, so using them didn't work out
• StringRefs for some reason get invalidated by the time it'd make a call to FieldChainInfo::getAsString()
• I didn't like the idea of storing the string because it'd not only impact performance greatly, but it'd also make the code a lot harder to understand, as opposed to making it more explicit

I did however try to make the implementation more easy to understand.

35 ↗

(On Diff #142053)

I tried it, but that approach made it impossible to include pointers and references in the fieldchain.

218 ↗

(On Diff #142053)

Doesn't move semantics take care of that? I'm not too sure on this one.

[Szelethus]

Among many other things:

• The checker class is now on top of the file.
• Reviewed all comments, fixed typos, tried to make the general idea more understandable.
• Removed all (at least, all I could find) unnecessary functions and function arguments.
• Removed support for unions entirely.

[Szelethus]

Note that there was a comment made about the test files being too long. I still haven't split them, as I didn't find a good "splitting point". Is this okay, or shall I try to split these into numerous smaller ones?

[dkrupp]

Would be interesting to extend this checker (maybe in an upcoming patch) to report on uninitialized members not only in constructors, but also copy constructors and move constructors.

See related https://bugs.llvm.org/show_bug.cgi?id=37086

This bug report also mentions assignment operator. But for that a warning may be not so useful. In that case the members of the assigned to object should have some initialized value already which the programmer may not want to overwrite in the assignment operator.

[Szelethus]

Would be interesting to extend this checker (maybe in an upcoming patch) to report on uninitialized members not only in constructors, but also copy constructors and move constructors.

Added 3 new test cases to cover them. Interestingly, move constructors don't emit any warnings - the core can only assert that the fields after a move construction are valid (returns true for SVal::isValid()).
Came to think of it, I'm not 100% confident in the checkers name. It could be misleading, as this checker doesn't check constructors, but rather objects after construction. The end of a constructor call is only the point at which we know that analysis can be done.

This bug report also mentions assignment operator. But for that a warning may be not so useful. In that case the members of the assigned to object should have some initialized value already which the programmer may not want to overwrite in the assignment operator.

I believe there's a checker for that already, but I'm really not sure whether UndefinedAssignmentChecker covers all such cases.

Also, I managed to cause a crash with the class linked_ptr_internal from google's boringssl when I analyzed the grpc project. I'll look deeper into this, but I have a strong suspicion that the error lies within the CSA core.

[whisperity]

In D45532#1068700, @Szelethus wrote:

In D45532#1068647, @dkrupp wrote:

This bug report also mentions assignment operator. But for that a warning may be not so useful. In that case the members of the assigned to object should have some initialized value already which the programmer may not want to overwrite in the assignment operator.

I believe there's a checker for that already, but I'm really not sure whether UndefinedAssignmentChecker covers all such cases.

Indeed, there are two different targets for analysis here:

• The rhs of the assignment contains an uninitialised value, that is copied/moved into the this of the assignment. --> This should be checked by UndefinedAssignmentChecker.
• Not every field is initialised by the assignment operator. This one, I believe, is hard to check and prove, and also feels superfluous. As @NoQ wrote earlier, the amount of reports this checker emits in itself is, at least expected to be, huge, and while it can be a valid programming approach that a ctor must initialise all, tracking in the CSA on an operator= that the this-side had something uninitialised but it was also not initialised by the assignment? Hard, and also not very useful, as far as I see.

---

In D45532#1064652, @NoQ wrote:

That said, your checker finds non-bugs, which is always risky. Sometimes the user should be allowed to initialize the field after construction but before the first use as a potentially important performance optimization. Did you find any such intentionally uninitialized fields with your checker? Were there many of those?

Where I can vision the usefulness of this checker the most is code that is evolving. There are many communities and codebases where coding standards and practices aren't laid out in a well-formed manner like LLVM has. There are also projects which are traditionally C code that has evolved into C++-ish code. When moving into C++, people start to realise they can write things like constructors, so they write them, but then leave out some members, and we can only guess (and perhaps make use of other checkers related to dereference or read of undefineds) what needs to be initialised, what is used without initialisation.

This checker is more close to something like a bugprone- Tidy matcher from the user's perspective, but proper analysis requires it to be executed in the SA.

A valid constriction of what this checker can find could be members that can "seemingly" be only be set in the constructor, there are no write operations or public exposure on them.

I have reviewed some findings of the checker, consider the following very trivial example:

#define HEAD_ELEMENT_SPECIFIER 0xDEADF00D // some magic yadda

struct linked_list;

struct linked_list
{
    int elem;
    linked_list* next;
};

class some_information_chain_class
{
  public:
    some_information_chain_class() : iList(new linked_list())
    {
      iList->elem = HEAD_ELEMENT_SPECIFIER;
    }

  private:
    linked_list* iList;
};

In this case, the "next" is in many cases remain as a garbage value. Of course, the checker cannot know, if, for example, there is also a count field and we don't rely on next == nullptr to signify the end of the list. But this can very well be a mistake from the programmer's end.

If a user wants to have his codebase "analyzer-clean", would he be able to suppress the warning without changing the behavior of the program?

I'm not entirely sure what you mean by "changing the behaviour of the program". As far as I can see, this checker only reads information from the SA, so it should not mess up any preconception set or state potentially used by other checkers.

---

In D45532#1065716, @Szelethus wrote:

I didn't implement anything explicitly to suppress warnings, so if there is nothing in the CSA by default for it, I'm afraid this isn't possible (just yet).

So far the only thing I can think of is coming up with new command-line arguments that can fine-tune the behaviour of the checker - but in this case, you can just as well just toggle the whole thing to be disabled.

An improvement heuristic (implemented in a later patch, toggleable with a command-line option perhaps?), as discussed above, would be checking only for members for whom there isn't any "setter" capability anywhere in the type.

[whisperity]

There is something that came up in my mind:

Consider a construct like this:

class A
{
  A()
  {
    memset(X, 0, 10 * sizeof(int));
  }

  int X[10];
};

I think it's worthy for a test case if this X is considered unitialised at the end of the constructor or not. (And if not, a ticket, or a fix for SA in a subpatch.)

---

Also, there are some debug prints left behind in the current patch.

[MTC]

In D45532#1069683, @whisperity wrote:

There is something that came up in my mind:

Consider a construct like this:

class A
{
  A()
  {
    memset(X, 0, 10 * sizeof(int));
  }

  int X[10];
};

I think it's worthy for a test case if this X is considered unitialised at the end of the constructor or not. (And if not, a ticket, or a fix for SA in a subpatch.)

Just for a reminding, there is a very primitive patch to model memset(), see D44934. And if we think that memset is a way of initialization, we may need to distinguish between POD objects and non-POD Objects.

[Szelethus]

In D45532#1068700, @Szelethus wrote:

Also, I managed to cause a crash with the class linked_ptr_internal from google's boringssl when I analyzed the grpc project. I'll look deeper into this, but I have a strong suspicion that the error lies within the CSA core.

I was very much wrong on that, the checker didn't handle cyclic references. I fixed that and some other crashes I encountered when checking the LLVM project.

To summarize, in this diff I

• added some more test cases,
• fixed crashes,
• removed unnecessary headers,
• fixed some typos in the documentation.

[george.karpenkov]

The code looks good apart from a few minor nits. I think I would prefer a new category created for this checker instead of using alpha; let's see what @NoQ has to say.

include/clang/StaticAnalyzer/Checkers/Checkers.td

305

alpha might not be a right place for this checker.
The meaning of alpha seems to be "this checker is currently too immature to be used by default because it generates too many FPs".

This is not the case for the uninitialized-fields checker, as it finds non-bugs by design, and each project might want to decide whether using such checker is a right fit.
I would suggest introducing a new category here, e.g. bugprone (other suggestions: lint?)
@NoQ any objections?

lib/StaticAnalyzer/Checkers/CtorUninitializedMemberChecker.cpp

162 ↗

(On Diff #142760)

"returns"

212 ↗

(On Diff #142760)

nitpicking: llvm::Twine is normally used for such constructs

448 ↗

(On Diff #142760)

Might be a naive question, but what about a chain intermixing references and pointers?
Wouldn't it be simpler to write

while (T)
  if (T->isVoidPointerType())
    return true;
  T = T->getPointeeType();

?

test/Analysis/ctor-uninitialized-member.cpp

817 ↗

(On Diff #142053)

What happened to e? Here and in all notes below.

[george.karpenkov]

antipatterns or security could be another potential category name.

[whisperity]

@george.karpenkov @NoQ bugprone. as a category sounds nice. It also nicely corresponds to the Clang-Tidy bugprone- category. It would not be nice to further fragment the "top levels" of checker categories.

I can say with confidence that CodeChecker does not break if the same category name is used by two different analyzers. Does the same stand for XCode / Scan-Build? In this case, introducing the bugprone category with the same principle that is behind Tidy's one is a good step.

lib/StaticAnalyzer/Checkers/CtorUninitializedMemberChecker.cpp

162 ↗

(On Diff #142760)

Actually, this explanation is superfluous. I believe

Returns if FD can be (transitively) dereferenced to a void* (void**, ...). The type of the region behind a void pointer isn't known, and thus FD can not be analyzed.

should suffice?

212 ↗

(On Diff #142760)

I have also suggested the usage of Twine for this line (it's just the diff that got out of sync with the line numbers!), but I don't recall what @Szelethus' concern was about them. In case we have move semantics enabled, this line will compile into using the moving concatenator.

[NoQ]

Guys, what do you think about a checker that warns on uninitialized fields only when at least one field is initialized? I'd be much more confident about turning such check on by default. We can still keep a pedantic version.

I can say with confidence that CodeChecker does not break if the same category name is used by two different analyzers. Does the same stand for XCode / Scan-Build?

Xcode and scan-build only support one analyzer, so it won't be a problem (at least not until more analyzers get supported).

But in general if we do overlapping names, we must be super sure that they mean the same thing in both analyzers, so that we didn't end up with a user interface in which one of the relatively common task would be to enable clang-tidy "bugprone" checkers and disable static analyzer "bugprone" checkers but the user would have to list all checkers by name in order to accomplish that because they all stay in the same package.

[Szelethus]

I'd also like to point out that as I mentioned before, the checker's name itself is misleading (it is a leftover from an earlier implementation of this checker). Here are just some ideas I came up with:

• UninitializedObjectChecker
• UninitializedFieldsChecker
• UninitializedFieldsAfterConstructionChecker
• UninitializedMembersChecker
• UninitializedMembersAfterConstructionChecker

Of these I like the first the most, but I'm open for anything, if you have an idea for it.

In D45532#1075789, @NoQ wrote:

Guys, what do you think about a checker that warns on uninitialized fields only when at least one field is initialized? I'd be much more confident about turning such check on by default. We can still keep a pedantic version.

Sounds good! I just finished implementing it along with a few minor (like some TODOs and fixes according to inline comments) and not-so-minor (like ignoring fields from system headers) changes. I'll update the diff and post results on it once I finish rechecking the LLVM/Clang project. I feel very confident about the upcoming version.

[Szelethus]

In this diff I

• added a Pedantic flag that is set to false by default to filter out results from objects that don't have a single field initialized,
• made it so that fields that are declared in system headers are now ignored,
• refactored isFullyInitialized to hasUnintializedFields (it returned true when there were in fact uninit fields),
• fixed everything mentioned in inline comments aside from the naming and the category,
• added TODOs for FieldChainInfo::toString, I decided to fix those in a later patch to keep the diff just a little bit smaller,
• added many more test cases, including tests for the Pedantic flag
• added support for arrays. Granted, they worked wonderfully with the checker before, but there was nothing mentioned about them in the code.

If you like how I implemented the Pedantic flag, then I think only the naming and choosing the correct category is left.

I also rechecked the entire LLVM/Clang project before the system header fix and after the fix with Pedantic set to true and set to false. Here are my findings:

How many reports did the checker emit?

• Without fields in system headers being ignored: 208 (only functional had some fields uninitialized)
• With fields in system headers being ignored and Pedantic set to true: 181
• With fields in system headers being ignored and Pedantic set to false: 150

Most of these are intentional, as a very large portion of the project is performance critical. I did however find some constructors with the checker that would benefit from having the rest of their fields initialized.
I also found some constructors that didn't use = default for no good reason.

[a.sidorin]

lib/StaticAnalyzer/Checkers/CtorUninitializedMemberChecker.cpp

72 ↗

(On Diff #143875)

This can be rewritten like `void toString(SmallVectorImpl<char> &Buf) const;

306 ↗

(On Diff #143875)

What will happen if we analyze a member which is a pointer to a structure type and the structure is of incomplete type?

534 ↗

(On Diff #143875)

while (!T.isNull())

test/Analysis/ctor-uninitialized-member.cpp

554 ↗

(On Diff #143875)

Could you please explain what is the logic of test naming?

[Szelethus]

Fixes according to inline comments.

[Szelethus]

By the way, thank you all for taking the time to review my code!

lib/StaticAnalyzer/Checkers/CtorUninitializedMemberChecker.cpp

306 ↗

(On Diff #143875)

For that field isPointerOrReferenceUninit will be called. If it happens not to be null, unknown or undef, the CSA core will construct a symbolic region for it, and the checker always assumes that symbolic regions are initialized, meaning that we'll never call isNonUnionUninit for a field of incomplete type.

However, I did not cover this with tests, thanks for pointing it out!

test/Analysis/ctor-uninitialized-member.cpp

554 ↗

(On Diff #143875)

The test files follow the strict structure that for each test case we'll define a structure type and then call its constructor(s) in a function right after it (functions are used to avoid zero initializations).

To be honest, there is no real logic behind the naming of the functions, it is only to keep the ODR. I used numbers in an increasing order, however I later added there cases, so in between f23 and f24 I used f23p5 and so on.

I figured that the strict structure of the test files would avoid confusion. Do you find it distracting?

[Szelethus]

Renamed the checker to cplusplus.uninitialized.UninitializedObject.

I've read your comments regarding the category this should be in thoroughly, and should the clang-tidy category naming not be an issue, cplusplus.bugprone would've probably been the best option. However, since it is a concern, I did find many checkers in the core in the uninitialized subcategory, so I thought I'll place it in cplusplus.uninitialized for now. This could be a little too specific though, as I don't think many other checkers could be implemented that would reside in there.

What do you guys think?

[Szelethus]

test/Analysis/cxx-uninitialized-object.cpp

527

I haven't marked @a.sidorin's comment as done, but it disappeared because I renamed the file, so here it is:

Could you please explain what is the logic of test naming?

To which I replied:

The test files follow the strict structure that for each test case we'll define a structure type and then call its constructor(s) in a function right after it (functions are used to avoid zero initializations).

To be honest, there is no real logic behind the naming of the functions, it is only to keep the ODR. I used numbers in an increasing order, however I later added there cases, so in between f23 and f24 I used f23p5 and so on.

I figured that the strict structure of the test files would avoid confusion. Do you find it distracting?

[Szelethus]

Forgot to rename the system header simulator file. Sorry about the spam :)

[whisperity]

Two minor comments.

With regards to the function naming, the problem with incremental counts is that they get out of sync, like they did with fXpY and such, and if someone wants to keep the count incremental down the file, adding any new test will result in an unnecessarily large patch. Perhaps you could use void T_() for the test that calls T::T()?

test/Analysis/cxx-uninitialized-object.cpp

661

A newline between #endif and the next token is missing here.

1413

What is this comment symbolising? Is this actually something the test infrastructure picks up?

[NoQ]

Had a look at the actual code, came up with some comments, most are fairly minor, so good job! You did a good job explaining the overall idea, but a lot of specifics were difficult to understand, so i made a few comments on how to make the code a bit easier to read.

I know, and I tried to look for ways to split this checker into smaller logical chunks, but I didn't find a satisfying solution.

What i would have done:

1. A checker that straightforwardly iterates through immediate fields of the current object and reports uninitialized fields.
2. Add base classes support.
3. Heuristic for skipping sub-constructors could use a separate review.
4. Start skipping arrays and unions.
5. Add simple pointer dereference support - introduce chains of fields.
6. More heuristics - the one for symbolic regions, the one for system header fields, etc.

etc.

I'm asking for this because it's, like, actually difficult and painful to understand formal information in large chunks. One-solution-at-a-time would have been so much easier. It is really a bad idea to start by presenting a working solution; the great idea is to present a small non-working solution with a reasonable idea behind it, and then extend it "in place" as much as it seems necessary. It is very comfortable when parts of the patch with different "status" (main ideas, corner-case fixes, heuristics, refactoring) stay in separate patches. Alpha checkers are essentially branches: because our svn doesn't have branches, we have alpha checkers and off-by-default flags. Even before step 1, you should be totally fine with committing an empty checker with a single empty callback and a header comment - even on such "step 0." we would be able to discuss if your approach to the checker seems right or might have inevitable issues, and it could have saved a lot of time.

Essentially every part of the solution that you implement, if you think it might deserve a separate discussion, also deserves a separate patch. It is reasonable to split the work into logical chunks before you start it. It's very unlikely that you have a single idea that takes 500 non-trivial lines of code to express. Splitting up ideas so that they were easy to grasp is an invaluable effort. I had very positive experience with that recently, both as a coder and as a reviewer, so i encourage that a lot.

lib/StaticAnalyzer/Checkers/UninitializedObjectChecker.cpp

48

At a glance it looks like a great use case for an immutable list. It's easy to use the immutable list as a stack, and it's also O(1) to copy/move and take snapshots of it.

Note that you copy 10 pointers every time you copy or move a SmallVector. Small vectors don't make much sense as fields of actively used data structures - their main purpose is to live on the stack as local variables.

52–54

Please move this doc to the getter/setter function. That's where people expect to find it when they're reading code.

59–60

Do we really need the other field (IsDereferenced) to be mutable? Or maybe we can keep the whole object immutable? I.e., instead of dereference() we'll get a constructor that constructs a FieldChainInfo with the same chain but with the dereferenced flag set.

87–90

All of these can be replaced with a single ProgramStateRef object.

94

This field is worth documenting.

157–158

Please explain what these methods do in a more direct manner. Something like "This method returns true if an uninitialized field was found within the region. It should only be used with regions of union-type objects".

171–172

Something's missing before with.

177–178

The second sentence would look great at the call site.

182–183

Type of an object pointed to by a void pointer is something that our path-sensitive engine is sometimes able to provide. It is not uncommon that a void pointer points to a concrete variable on the current path, and we may know it in the analyzer. I'm not sure this sort of check is necessary (i.e. require more information).

You may also want to have a look at getDynamicTypeInfo() which is sometimes capable of retrieving the dynamic type of the object pointed to by a pointer or a reference - i.e. even if it's different from the pointee type of the pointer.

186

We're traditionally writing "end anonymous namespace" or "end of anonymous namespace".

224–226

I suspect that a fatal error is better here. We don't want the user to receive duplicate report from other checkers that catch uninitialized values; just one report is enough.

234–237

I believe that you only need the first Twine; then all operator+ calls will be resolved to operator+(Twine, ...) automatically. Or just use a string and a stream like pretty much all other checkers.

245

This is the third approach to concatenating strings in the last 10 lines of code. I think you should make a method FieldChainInfo::print(llvm::raw_ostream &) and use streams everywhere.

259–261

Aha, ok, got it, so you're putting the warning at the end of the constructor and squeezing all uninitialized fields into a single warning by presenting them as notes.

Because for now notes aren't supported everywhere (and aren't always supported really well), i guess it'd be necessary to at least provide an option to make note-less reports before the checker is enabled by default everywhere. In this case notes contain critical pieces of information and as such cannot be really discarded.

I'm not sure that notes are providing a better user experience here than simply saying that "field x.y->z is never initialized". With notes, the user will have to scroll around (at least in scan-build) to find which field is uninitialized.

Notes will probably also not decrease the number of reports too much because in most cases there will be just one uninitialized field. Though i agree that when there is more than one report, the user will be likely to deal with all fields at once rather than separately.

So it's a bit wonky.

We might want to enable one mode or another in the checker depending on the analyzer output flag. Probably in the driver (RenderAnalyzerOptions()).

It'd be a good idea to land the checker into alpha first and fix this in a follow-up patch because this review is already overweight.

293

Why is checking done lazily in the first place? Are there many situations in which we want to construct the object but never do the actual scan?

If it was actually necessary, i would have split out the side effect of this getter into a separate private method.

347

Please check the type explicitly, and then assert that the value is a Loc. There are a lot of nuances that you don't want to be dealing with here (eg. ObjCObjectPointerType, which can be present in C++ as well because Objective-C++ is a thing, is not a PointerType or a ReferenceType, but it is modeled with a Loc).

353

Please formalize what you mean by a fundamental type and assert that. You probably mean something like "an integer or a floating-point number or maybe an enum or, well, bool".

I suspect that many cases here are missed (complex types, vector types, ...).

360–373

Are there many warnings that will be caused by this but won't be caused by conducting the check for the constructor-within-constructor that's currently disabled? Not sure - is it even syntactically possible to not initialize the base class?

385

Please assert here that FR is a pointer/reference-type field.

387

As i mentioned above, you can simply store a ProgramStateRef within FindUninitializedFields. In this case this code will be simplified to State->getSVal(FR).

406–407

Is this loop guaranteed to terminate? Is something like void *v; v = &v; possible?

I think this loop should unwrap the AST type on every iteration and dereference the pointer accordingly.

In general, i believe that every symbolic pointer dereference should be made with awareness of the type of the object we're trying to retrieve. Which is an optional argument for State->getSVal(R, ...), but it seems that it should be made mandatory because in a lot of cases omitting it causes problems.

418

CSA is not a commonly used acronym around the codebase.

418

I'd like to change the word "conjure" to something else because in most cases it won't be an actual SymbolConjured, but it'd be a SymbolRegionValue or SymbolDerived. Conjuring occurs in different circumstances.

431

Add llvm_unreachable("") to find out :)

433

Needs a comment on why the IsDereferenced flag on this path.

481

Can we at least detect these situations and suppress the warning? It should be relatively easy for lambdas (captured variable mapping should be stored somewhere, as far as i remember), not sure how easy it'd be for double inheritance (there are fancy methods for scanning this stuff, but that's equivalent to actually implementing the correct warning message).

Weird warning messages are pretty scary to show to the users.

It'd be a good idea to land the checker into alpha first and fix this in a follow-up patch because this review is already overweight.

560–561

This doesn't check that the constructor on the parent stack frame is anyhow related to the current constructor, so it may introduce false negatives. For instance, a class may lazy-initialize a singleton but never store a reference to it within itself (because, well, it's a singleton, you can always obtain the reference to it). In this case we'll never find the bug in the constructor of the singleton.

test/Analysis/cxx-uninitialized-object.cpp

932

CSA is not a commonly used acronym around the codebase.

[Szelethus]

Thanks @NoQ for taking the time to review my code!

I'm sorry that the patch became this long. It was an error on my part, and I completely get that the checker now takes an uncomfortably long time to read and understand. This is my first "bigger" project in the CSA, I learned a lot so far, and I'll definitely review how I should've handled developing and uploading it here better, so next time I will do my best to make my contributions a lot more reviewer-friendly.

edit: Not just review-wise, but development-wise. This could've easily turned out wrong as a whole, and if it was, it could've been avoided if I shared my thoughts here.

It's very unlikely that you have a single idea that takes 500 non-trivial lines of code to express.

That's true. Since this was the first time I wrote anything the StaticAnalyzer project, I often found myself almost completely rewriting everything. Looking back, I still could've uploaded the code in parts, so notes taken, will do better next time!

It'll be some time before I sort everything out you commented on, just wanted to leave this here.

lib/StaticAnalyzer/Checkers/UninitializedObjectChecker.cpp

259–261

[...]i guess it'd be necessary to at least provide an option to make note-less reports before the checker is enabled by default everywhere. In this case notes contain critical pieces of information and as such cannot be really discarded.

This can already be achieved with -analyzer-config notes-as-events=true. There no good reason however not to make an additional flag that would emit warnings instead of notes.

I'm not sure that notes are providing a better user experience here than simply saying that "field x.y->z is never initialized". With notes, the user will have to scroll around (at least in scan-build) to find which field is uninitialized.

This checker had a previous implementation that emitted a warning for each uninitialized field, instead of squeezing them in a single warning per constructor call. One of the major reasons behind rewriting it was that it emitted so many of them that it was difficult to differentiate which warning belonged to which constructor call. Also, in the case of the LLVM/Clang project, the warnings from this checker alone would be in the thousands.

Notes will probably also not decrease the number of reports too much because in most cases there will be just one uninitialized field.

While this is true to some extent, it's not uncommon that a single constructor call leaves 7 uninitialized -- in the LLVM/Clang project I found one that had over 30!
Since its practically impossible to determine whether this was a performance enhancement or just poor programming, the few cases where it is intentional, an object would emit many more warnings would make make majority of the findings (where an object truly had only 1 or 2 fields uninit) a lot harder to spot in my opinion.

In general, I think one warning per constructor call makes the best user experience, but a temporary solution should be implemented until there's better support for notes.

I agree, this should be a topic of a follow-up patch.

test/Analysis/cxx-uninitialized-object.cpp

1413

// no-crash is something I found in many other test files, in this case it symbolizes that the point of this test isn't to check whether the checker correctly finds or ignores an uninit field, but that it doesn't crash.

[NoQ]

lib/StaticAnalyzer/Checkers/UninitializedObjectChecker.cpp

259–261

This can already be achieved with -analyzer-config notes-as-events=true.

Yep. But the resulting user experience seems pretty bad to me. It was a good quick proof-of-concept trick to test things, but the fact that notes aren't path pieces is way too apparent in case of this checker. So i guess this flag was a bad idea.

Also, in the case of the LLVM/Clang project, the warnings from this checker alone would be in the thousands.

This makes me a bit worried, i wonder what's the reason why does the checker shout so loudly on a codebase that doesn't seem to have actual uninitialized value bugs all over the place.

Are any of these duplicates found in the same constructor for the same field in different translation units? Suppose we discard the duplicates (if any) and warn exactly once (across the whole LLVM) for every uninitialized field (which is probably more than once per constructor). Then I wonder:

1. How many uninitialize fields would we be able to find this way?
2. How many of such fields were intentionally left uninitialized?
3. How many were found by deep inspection of the heap through field chains involving pointer dereference "links"?

[NoQ]

lib/StaticAnalyzer/Checkers/UninitializedObjectChecker.cpp

259–261

(when i'm asking this sort of stuff, i don't mean you should look through thousands of positives, a uniform random sample of ~50 should be just fine)
(but we really do need this info before enabling stuff by default)

[Szelethus]

I'm afraid it'll be even more time before I post a new diff. There are some things that ProgramState is lacking, so I'll get that fixed first in a different pull request.

Quick edit: When I said "non-unique warnings", I meant that warnings before uniqueing.

lib/StaticAnalyzer/Checkers/UninitializedObjectChecker.cpp

259–261

This can already be achieved with -analyzer-config notes-as-events=true.

Yep. But the resulting user experience seems pretty bad to me. It was a good quick proof-of-concept trick to test things, but the fact that notes aren't path pieces is way too apparent in case of this checker. So i guess this flag was a bad idea.

I totally agree, I meant that a note-less solution should only be a (arguably better) workaround just as notes-as-events=true.

Are any of these duplicates found in the same constructor for the same field in different translation units? Suppose we discard the duplicates (if any) and warn exactly once (across the whole LLVM) for every uninitialized field (which is probably more than once per constructor).

Sure, having the same field field reported from the same constructor call in different TUs happens quite a lot, but they can easily be uniqued.

In the checkers current state, meaning that one warning per ctor call, the LLVM/Clang project in pedantic mode resulted in 409 non-unique warnings, and using CodeChecker I found that 181 of these is unique.

How many uninitialize fields would we be able to find this way?

In its current state, in pedantic mode, after uniqueing ~581. Now that's quite a bit off from what I remembered "the warnings from this checker alone would be in the thousands", but having one warning per uninit field would still result in a ~320% increase in reports.

How many of such fields were intentionally left uninitialized?

(I checked around 95 reports a couple weeks back before uploading this diff)
Almost all of them. Note that this is a very performance-critical project. From what I saw, many times several fields are left uninitialized, but these fields are inaccessible due to a kind field being asserted at their getter functions.
Also, I found cases where the constructor wasn't defaulted with = default;.

In fact, I struggled to find a case where a field was 100% left out by accident. Maybe in llvm/lib/IR/ConstantsContext.h, calling ConstantExprKeyType(ArrayRef<Constant *> Operands, const ConstantExpr *CE).

This is not the case however in other projects I checked. In Xerces for example every find was a true positive.

How many were found by deep inspection of the heap through field chains involving pointer dereference "links"?

This is somewhat harder to measure. The best I could come up with is uniqueing the fieldchains from the plist files with lexicographical sorting. Your question can be answered by measuring the length of the fieldchains. I found

• 3 fieldchains with the length of 5
• 18 fieldchains with the length of 4
• 62 fieldchains with the lenfth of 3
• 108 fieldchains with the length of 2
• 137 fieldchains with the length of 1

(that is a total of 328 unique fieldchains lexicographically)
Because heap objects are not modeled, only 3 of the 328 fieldchains contains pointer dereferences. However, reference objects are very common from what I saw, but sadly I can't give you an exact number on those.

I hope these answers were satisfying, but I'll follow up with more information if needed.

360–373

I'm not a 100% sure what you mean. Can you clarify?

Not sure - is it even syntactically possible to not initialize the base class?

If I understand the question correctly, no, as far as I know.

431

It does! :)

[Szelethus]

In this diff, I preferred placing TODOs in places where the logic of the checker would have changed too much. While I didn't have a strict rule for this in mind, I tried changing as little as possible in order to implement the fixes in smaller followup patches.

Now with that being said, I still did make numerous changes to address the inline comments, so here is a complete list of them:

• I placed the checker back in alpha.cplusplus
• While the main logic of the checker is unchanged, I did make some small additions: it turned out (thanks to @NoQ) that objects I wrongly referred to as fundamental were in fact of BuiltinType or EnumeralType. In the checker I defined these types as "primitive", as neither clang or the C++ standard defines a type called "primitive"
• A new node is added to the directed tree: objects of MemberPointerType. I updated the documentation, and added a function to FindUninitializedFields but left the implementation to be done in a followup patch
• String concatenations are all done with streams
• FieldChainInfo now uses llvm::ImmutableList
• FieldChainInfo is now completely immutable
• FindUninitializedFields no longer checks lazily, and has only a single getUninitFields public non-special member function.
• FindUninitializedFields now has a ProgramStateRef field instead of a bunch of managers (this added a dependency D46891)
• Added asserts and llvm_unreachable at numerous locations
• More comments for easier reading

For the test files:

• Changed all non-member function names to eliminate numbering
• Split cxx-uninitialized-object.cpp up, and placed pointer/reference tests in a different file
• Added tests for
  • loc::ConcreteInt
  • Member pointers
  • BuiltinType and EnumeralType
  • Constructorcall within a constructor, without the two constructors being in relation, to highlight a false negative
  • C++11 member initializers.

I'll be the first to admit that I'm not 100% sure I implemented the change to llvm::ImmutableList perfectly, so I guess maybe it's worth taking a deeper look at (but it certainly works!). Shall I tie its lifetime to the checker object's lifetime?
Edit: I mean, the Factory's lifetime.
Of course, I rechecked the entire LLVM/Clang project and I'm happy to report that no crashes occured, and it emitted almost the same amount of warning (almost, because I used a newer version of clang).

[Szelethus]

lib/StaticAnalyzer/Checkers/UninitializedObjectChecker.cpp

182–183

I took a look at it, but I found that it'd change the implementation of isPointerOrReferenceUninit so much, I'd be a lot more comfortable if I could implement it in a smaller followup patch. I placed some TODOs in the code about this.

224–226

I think that would be a bad idea. For example, this checker shouts so loudly while checking the LLVM project, it would practically halt the analysis of the code, reducing the coverage, which means that checkers other then uninit value checkers would "suffer" from it.

However, I also think that having multiple uninit reports for the same object might be good, especially with this checker, as it would be very easy to see where the problem originated from.

What do you think?

406–407

Is this loop guaranteed to terminate? Is something like void *v; v = &v; possible?

I looked this up, and I am confident that it is not possible for a pointer to point to itself. Only a void** object may point to a void*. The loop terminates even if you do something evil like v = reinterpret_cast<void*>(&v); (I have tried this with ints).

I think this loop should unwrap the AST type on every iteration and dereference the pointer accordingly.

In general, i believe that every symbolic pointer dereference should be made with awareness of the type of the object we're trying to retrieve. Which is an optional argument for State->getSVal(R, ...), but it seems that it should be made mandatory because in a lot of cases omitting it causes problems.

I invested some serious effort into getDynamicType, but I think it'll require more time and some serious refactoring of this (isPointerOrReferenceUninit) function, so I'd post it separately.

433

Added a comment at the line where I dereference the field that after that point we'll check the pointee.

560–561

Added a TODO and a test case to highlight this issue, and I'm planning to fix it in a followup patch.

[NoQ]

Ok! Putting any remaining work into follow-up patches would be great indeed. Let's land this into alpha.cplusplus for now because i still haven't made up my mind for how to organize the proposed bugprone category (sorry!).

lib/StaticAnalyzer/Checkers/UninitializedObjectChecker.cpp

224–226

Well, i guess that's the reason to not use the checker on LLVM. Regardless of fatal/nonfatal warnings, enabling this checker on LLVM regularly would be a bad idea because it's unlikely that anybody will be able to fix all the false positives to make it usable. And for other projects that don't demonstrate many false positives, this shouldn't be a problem.

In order to indicate where the problem originates from, we have our bug reporter visitors that try their best to add such info directly to the report. In particular, @george.karpenkov's recent NoStoreFuncVisitor highlights functions in which a variable was not initialized but was probably expected to be. Not sure if it highlights constructors in its current shape, but that's definitely a better way to give this piece of information to the user because it doesn't make the user look for a different report to understand the current report.

259–261

Thanks for the detailed stats! Yeah, that's a lot of "immediately" uninitialized fields. My concerns are mostly clarified. Yeah i was curious about references as well, but it's clear that chains of length 1 contain no references.

360–373

You have a check for isCalledByConstructor() in order to skip base class constructors but then you check them manually. That's a lot of code, but it seems that the same result could have been achieved by simply skipping the descent into the base class.

Same question for class-type fields, actually.

406–407

Only a void** object may point to a void*.

That's definitely not true. The whole point of void * is that it can point to anything, including another void *. In fact, even void *v = &v; compiles in both C and C++.

I think it's better to have a stronger guarantee that this loop terminates.

test/Analysis/cxx-uninitialized-object.cpp

1413

Yup, // no-crash is indeed a good thing to mention.

Note: // no-warning is also not picked up by any infrastructure. It is only for the reader.

[Szelethus]

Thanks again for taking a look :)

lib/StaticAnalyzer/Checkers/UninitializedObjectChecker.cpp

360–373

Same question for class-type fields, actually.

My problem with that approach is that the same uninitialized field could've been emitted multiple times in different warnings. From an earlier conversation (assume that its run in pedantic mode):

For this code snippet:

struct A {
   struct B {
      int x, y;
      
      B() {}
   } b;
   int w;

   A() {
      b = B();
   }
};

the warning message after a call to A::A() would be "3 uninitialized fields[...]", and for B::B() inside As constructor would be "2 uninitialized fields[...]", so it wouldn't be filtered out.

In my opinion, if A contains a field of type B, it should be the responsibility of A's constructors to initialize those fields properly.

You have a check for isCalledByConstructor() in order to skip base class constructors but then you check them manually. That's a lot of code, but it seems that the same result could have been achieved by simply skipping the descent into the base class.

I also believe that a constructor "should be held responsible" for the initialization of the inherited data members. However, in the case of base classes, uniqueing isn't an issue, as in this case:

struct B {
  int a;
  B() {}
};

struct D : public B {
  int b;
  D() {}
};

a call to D::D() would not check the inherited member (a), if I didn't implement it explicitly. That also means that if isCalledByConstructor was refactored to not filter out base classes, we would get two warning each with a single note, reporting b and a respectively. (I haven't actually checked it, but its a reasonable assumption)

Actually, I'm not 100% sure which approach is better: a warning for each base, or one warning for the object, bases included. I personally think one warning per object results in the best user experience.

I like both ideas, but I think if we'd come to the conclusion that a warning per base should be the way to go, it should definitely be implemented in a followup patch, as isCalledByConstructor is already in line for some major refactoring.

What do you think? :)

406–407

Oh, right. Yea. Silly me. Well in any case, non-void pointers can't point to themselves, as I understand it. And since void pointers are skipped for now, I think (and have found after some serious testing) that loop will terminate just fine.

I think it's better to have a stronger guarantee that this loop terminates.

Agreed. I see now however why did you find parts of this function so fishy.

[Szelethus]

I decided to mark the inline comments in isPointerOrReferenceUninit regarding the dereferencing loop termination done for now. I left several TODO's in the function to be fixed later, with many of them depending on one another, so fixing them all or many at once would probably be the best solution.

I left two conversations "not done" (fatal/nonfatal errors and base classes), but if I may, do you have any other objections?

lib/StaticAnalyzer/Checkers/UninitializedObjectChecker.cpp

224–226

LLVM is a special project in the fact that almost every part of it is so performance critical, that leaving many fields uninit matters. However, I would believe that in most projects, only a smaller portion of the code would be like that.

Suppose that we have a project that also defines a set of ADTs, like an std::list-like container. If that container had a field that would be left uninit after a ctor call, analysis on every execution path would be halted which would use an object like that.

My point is, as long as there is no way to tell the analyzer (or the checker) to ignore certain constructor calls, I think it would be best not to generate a fatal error.

Regardless of fatal/nonfatal warnings, enabling this checker on LLVM regularly would be a bad idea because it's unlikely that anybody will be able to fix all the false positives to make it usable. And for other projects that don't demonstrate many false positives, this shouldn't be a problem.

I wouldn't necessarily call them false positives. This checker doesn't look for bugs, and all reports I checked were correct in the fact that those fields really were left uninit. They just don't cause any trouble (just yet!).

360–373

[...]but it seems that the same result could have been achieved by simply skipping the descent into the base class.

I can't edit inline comments sadly, but I'd just like to point out that it wouldn't achieve the same thing, as highlighted above. But, both solution would be okay.

[george.karpenkov]

@Szelethus I personally really like this idea, and I think it would be a great checker.
Could you perform more evaluation on other projects?

[Szelethus]

• Rebased to 1cefbc5593d2f017ae56a853b0723a31865aa602 (revision 333276)
• Fixed some typos
• Added tests CyclicPointerTest and CyclicVoidPointerTest to highlight an issue to be fixed in a later patch

[xazax.hun]

lib/StaticAnalyzer/Checkers/UninitializedObjectChecker.cpp

224–226

I think of this check as a tool to support a specific programming model where every field needs to be initialized by the constructor. This programming model might be followed by some parts of the projects while a 3rd party library in the same project or some other files might not follow this model. Right now there is no easy way to turn off some checks for a set of files, and there is no way to turn off a set of checks for some headers. For this reason, I think it is not a good idea to make these errors fatal, as 3rd party headers might reduce the coverage of the analysis on a project in a way that the user cannot control.

If we are afraid of having multiple reports from this check we could turn off the check for that particular path, for example, we could have a bool stored in the GDM for each path whether this check is already reported an error or not and we can check that before emitting warnings.

[Szelethus]

In D45532#1116992, @george.karpenkov wrote:

@Szelethus I personally really like this idea, and I think it would be a great checker.
Could you perform more evaluation on other projects?

Thanks for the encouraging words!

I have checked some other projects:

• Xerces: I only found one uninit field (shockingly), and I found that it was probably unintentional.
• grpc: This project depends on numerous third-party libraries, so it has a variety of coding and implementation styles. The checker emitted 5 warnings, and I think it's very likely that at least 3 of those were unintentional (4, if we count the missing =default;).
• CppCheck: No warnings at all :)

The checker didn't crash during the analysis of any of the projects.

After some thinking, I decided to mark the comments on base classes done. I believe that the current implementation results in the best user experience, but even if we were come to the conclusion that it is not, we could resume the conversation on this when I submit a patch to fix related issues within isCalledByConstructor.

[Szelethus]

Polite ping :)

This diff fixed a minor issue in FieldChainInfo's constructor.

[NoQ]

Ok, let's land this one and see how it goes! I'm looking forward to seeing the follow-up patches.

lib/StaticAnalyzer/Checkers/UninitializedObjectChecker.cpp

360–373

I still don't fully understand the reasoning behind who's responsible for initializing the field, i.e., the exact rule that you're enforcing seems to cause warnings to depend heavily on meta-information such as where does the analysis start, which is confusing. Because we're trying to enforce a coding guideline here, i believe that the guideline itself should be transparent and easy to explain. In particular, it should be obvious to the user which constructor is responsible for initializing a field, and by obvious i mean it should be obvious both from the guideline itself and from the analyzer's warning, and both of them should be the same "obvious".

[whisperity]

Ah, and the function names in the test files have been made more logical.

Let's roll. 😉

[Szelethus]

Whoo! Thank you all for helping me with the reviews. Very excited about the upcoming fixes, I have neat ideas for some already.

• Rebased to 8186139d6aa0619e2057ae617c074e486a7b2f2b (revision 334929),
• Added a FIXME around base class handling as a reminder that this topic still needs to be discussed,
• Re-run tests on some projects just to be sure.

[sylvestre.ledru]

If you are interested, I executed this checker on Firefox code. Results can be found here
http://sylvestre.ledru.info/reports/fx-scan-build/

Andi reported this bug https://bugs.llvm.org/show_bug.cgi?id=37965

[george.karpenkov]

@sylvestre.ledru Have you found any actual bugs using this checker?
@Szelethus Interesting, it seems that the pointer itself is initialized, but not what it's pointing to.
I think we should just check the fields directly, and do not attempt to traverse the pointer hierarchy.

[Szelethus]

In D45532#1145512, @sylvestre.ledru wrote:

If you are interested, I executed this checker on Firefox code. Results can be found here
http://sylvestre.ledru.info/reports/fx-scan-build/

Absolutely, thank you! :)

Andi reported this bug https://bugs.llvm.org/show_bug.cgi?id=37965

Well, that is intentional: not the pointer, but the pointee is uninitialized, as you can see from the note message. Now with that being said, I have had an other colleague of mine complain about a report, as he didn't see that the note message said "pointee" not "pointer", so maybe there's a point in trying to come up with a better message.

In D45532#1145592, @george.karpenkov wrote:

@sylvestre.ledru Have you found any actual bugs using this checker?
@Szelethus Interesting, it seems that the pointer itself is initialized, but not what it's pointing to.

Exactly.

I think we should just check the fields directly, and do not attempt to traverse the pointer hierarchy.

Hmm, that's one way of thinking, but I think it's more beneficial to check pointers too.

I'll take a look at some results and try to get back to you with some stats to support my view on this issue :)

include/clang/StaticAnalyzer/Checkers/Checkers.td

def VirtualCallChecker : Checker<"VirtualCall">,
   DescFile<"VirtualCallChecker.cpp">;
 
 } // end: "optin.cplusplus"
 
 let ParentPackage = CplusplusAlpha in {
 
 def DeleteWithNonVirtualDtorChecker : Checker<"DeleteWithNonVirtualDtor">,
   HelpText<"Reports destructions of polymorphic objects with a non-virtual "
            "destructor in their base class">,
   DescFile<"DeleteWithNonVirtualDtorChecker.cpp">;
 
 def IteratorRangeChecker : Checker<"IteratorRange">,
   HelpText<"Check for iterators used outside their valid ranges">,
   DescFile<"IteratorChecker.cpp">;
 
 def MisusedMovedObjectChecker: Checker<"MisusedMovedObject">,
      HelpText<"Method calls on a moved-from object and copying a moved-from "
               "object will be reported">,
      DescFile<"MisusedMovedObjectChecker.cpp">;
 
+def UninitializedObjectChecker: Checker<"UninitializedObject">,
+     HelpText<"Reports uninitialized fields after object construction">,
+     DescFile<"UninitializedObjectChecker.cpp">;
+
 } // end: "alpha.cplusplus"
 
 
 //===----------------------------------------------------------------------===//
 // Valist checkers.
 //===----------------------------------------------------------------------===//
 
 let ParentPackage = Valist in {

lib/StaticAnalyzer/Checkers/CMakeLists.txt

add_clang_library(clangStaticAnalyzerCheckers
   TestAfterDivZeroChecker.cpp
   TraversalChecker.cpp
   TrustNonnullChecker.cpp
   UndefBranchChecker.cpp
   UndefCapturedBlockVarChecker.cpp
   UndefResultChecker.cpp
   UndefinedArraySubscriptChecker.cpp
   UndefinedAssignmentChecker.cpp
+  UninitializedObjectChecker.cpp
   UnixAPIChecker.cpp
   UnreachableCodeChecker.cpp
   VforkChecker.cpp
   VLASizeChecker.cpp
   ValistChecker.cpp
   VirtualCallChecker.cpp
 
   DEPENDS

lib/StaticAnalyzer/Checkers/UninitializedObjectChecker.cpp

+//===----- UninitializedObjectChecker.cpp ------------------------*- C++ -*-==//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// This file defines a checker that reports uninitialized fields in objects
+// created after a constructor call.
+//
+// This checker has an option "Pedantic" (boolean). If its not set or is set to
+// false, the checker won't emit warnings for objects that don't have at least
+// one initialized field. This may be set with
+// `-analyzer-config alpha.cplusplus.UninitializedObject:Pedantic=true`.
+//
+//===----------------------------------------------------------------------===//
+
+#include "ClangSACheckers.h"
+#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
+#include <algorithm>
+
+using namespace clang;
+using namespace clang::ento;
+
+namespace {
+
+class UninitializedObjectChecker : public Checker<check::EndFunction> {
+  std::unique_ptr<BuiltinBug> BT_uninitField;
+
+public:
+  bool IsPedantic; // Will be initialized when registering the checker.
+
+  UninitializedObjectChecker()
+      : BT_uninitField(new BuiltinBug(this, "Uninitialized fields")) {}
+  void checkEndFunction(CheckerContext &C) const;
+};
+
+llvm::ImmutableListFactory<const FieldRegion *> Factory;
+
+/// Represents a field chain. A field chain is a vector of fields where the
+/// first element of the chain is the object under checking (not stored), and
+/// every other element is a field, and the element that precedes it is the
+/// object that contains it.
+///
+/// Note that this class is immutable, and new fields may only be added through
+/// constructor calls.
+class FieldChainInfo {
+  using FieldChain = llvm::ImmutableList<const FieldRegion *>;
+
+  FieldChain Chain;
+
+  const bool IsDereferenced = false;
+
+public:
+  FieldChainInfo() = default;
+  FieldChainInfo(const FieldChainInfo &Other, const bool IsDereferenced)
+      : IsDereferenced(IsDereferenced) {}
+
+  /// Delegates to the copy ctor and adds FR to Chain.
+  FieldChainInfo(const FieldChainInfo &Other, const FieldRegion *FR,
+                 const bool IsDereferenced = false);
+
+  bool contains(const FieldRegion *FR) const { return Chain.contains(FR); }
+  bool isPointer() const;
+
+  /// If this is a fieldchain whose last element is an uninitialized region of a
+  /// pointer type, `IsDereferenced` will store whether the pointer itself or
+  /// the pointee is uninitialized.
+  bool isDereferenced() const;
+  const FieldDecl *getEndOfChain() const;
+  void print(llvm::raw_ostream &Out) const;
+
+private:
+  /// Prints every element except the last to `Out`. Since ImmutableLists store
+  /// elements in reverse order, and have no reverse iterators, we use a
+  /// recursive function to print the fieldchain correctly. The last element in
+  /// the chain is to be printed by `print`.
+  static void printTail(llvm::raw_ostream &Out,
+                        const llvm::ImmutableListImpl<const FieldRegion *> *L);
+  friend struct FieldChainInfoComparator;
+};
+
+struct FieldChainInfoComparator {
+  bool operator()(const FieldChainInfo &lhs, const FieldChainInfo &rhs) {
+    assert(!lhs.Chain.isEmpty() && !rhs.Chain.isEmpty() &&
+           "Attempted to store an empty fieldchain!");
+    return *lhs.Chain.begin() < *rhs.Chain.begin();
+  }
+};
+
+using UninitFieldSet = std::set<FieldChainInfo, FieldChainInfoComparator>;
+
+/// Searches for and stores uninitialized fields in a non-union object.
+class FindUninitializedFields {
+  ProgramStateRef State;
+  const TypedValueRegion *const ObjectR;
+
+  const bool IsPedantic;
+  bool IsAnyFieldInitialized = false;
+
+  UninitFieldSet UninitFields;
+
+public:
+  FindUninitializedFields(ProgramStateRef State,
+                          const TypedValueRegion *const R, bool IsPedantic);
+  const UninitFieldSet &getUninitFields();
+
+private:
+  /// Adds a FieldChainInfo object to UninitFields. Return true if an insertion
+  /// took place.
+  bool addFieldToUninits(FieldChainInfo LocalChain);
+
+  // For the purposes of this checker, we'll regard the object under checking as
+  // a directed tree, where
+  //   * the root is the object under checking
+  //   * every node is an object that is
+  //     - a union
+  //     - a non-union record
+  //     - a pointer/reference
+  //     - an array
+  //     - of a member pointer type
+  //     - of a primitive type, which we'll define as either a BuiltinType or
+  //       EnumeralType.
+  //   * the parent of each node is the object that contains it
+  //   * every leaf is an array, a primitive object, a member pointer, a nullptr
+  //     or an undefined pointer.
+  //
+  // Example:
+  //
+  //   struct A {
+  //      struct B {
+  //        int x, y = 0;
+  //      };
+  //      B b;
+  //      int *iptr = new int;
+  //      B* bptr;
+  //
+  //      A() {}
+  //   };
+  //
+  // The directed tree:
+  //
+  //           ->x
+  //          /
+  //      ->b--->y
+  //     /
+  //    A-->iptr->(int value)
+  //     \
+  //      ->bptr
+  //
+  // From this we'll construct a vector of fieldchains, where each fieldchain
+  // represents an uninitialized field. An uninitialized field may be a
+  // primitive object, a member pointer, a pointer, a pointee or a union without
+  // a single initialized field.
+  // In the above example, for the default constructor call we'll end up with
+  // these fieldchains:
+  //
+  //   this->b.x
+  //   this->iptr (pointee uninit)
+  //   this->bptr (pointer uninit)
+  //
+  // We'll traverse each node of the above graph with the appropiate one of
+  // these methods:
+
+  /// This method checks a region of a union object, and returns true if no
+  /// field is initialized within the region.
+  bool isUnionUninit(const TypedValueRegion *R);
+
+  /// This method checks a region of a non-union object, and returns true if
+  /// an uninitialized field is found within the region.
+  bool isNonUnionUninit(const TypedValueRegion *R, FieldChainInfo LocalChain);
+
+  /// This method checks a region of a pointer or reference object, and returns
+  /// true if the ptr/ref object itself or any field within the pointee's region
+  /// is uninitialized.
+  bool isPointerOrReferenceUninit(const FieldRegion *FR,
+                                  FieldChainInfo LocalChain);
+
+  /// This method checks a region of MemberPointerType, and returns true if the
+  /// the pointer is uninitialized.
+  bool isMemberPointerUninit(const FieldRegion *FR, FieldChainInfo LocalChain);
+
+  /// This method returns true if the value of a primitive object is
+  /// uninitialized.
+  bool isPrimitiveUninit(const SVal &V);
+
+  // Note that we don't have a method for arrays -- the elements of an array are
+  // often left uninitialized intentionally even when it is of a C++ record
+  // type, so we'll assume that an array is always initialized.
+  // TODO: Add a support for nonloc::LocAsInteger.
+};
+
+// Utility function declarations.
+
+/// Returns the object that was constructed by CtorDecl, or None if that isn't
+/// possible.
+Optional<nonloc::LazyCompoundVal>
+getObjectVal(const CXXConstructorDecl *CtorDecl, CheckerContext &Context);
+
+/// Checks whether the constructor under checking is called by another
+/// constructor.
+bool isCalledByConstructor(const CheckerContext &Context);
+
+/// Returns whether FD can be (transitively) dereferenced to a void pointer type
+/// (void*, void**, ...). The type of the region behind a void pointer isn't
+/// known, and thus FD can not be analyzed.
+bool isVoidPointer(const FieldDecl *FD);
+
+/// Returns true if T is a primitive type. We'll call a type primitive if it's
+/// either a BuiltinType or an EnumeralType.
+bool isPrimitiveType(const QualType &T) {
+  return T->isBuiltinType() || T->isEnumeralType();
+}
+
+} // end of anonymous namespace
+
+//===----------------------------------------------------------------------===//
+//                  Methods for UninitializedObjectChecker.
+//===----------------------------------------------------------------------===//
+
+void UninitializedObjectChecker::checkEndFunction(
+    CheckerContext &Context) const {
+
+  const auto *CtorDecl = dyn_cast_or_null<CXXConstructorDecl>(
+      Context.getLocationContext()->getDecl());
+  if (!CtorDecl)
+    return;
+
+  if (!CtorDecl->isUserProvided())
+    return;
+
+  if (CtorDecl->getParent()->isUnion())
+    return;
+
+  // This avoids essentially the same error being reported multiple times.
+  if (isCalledByConstructor(Context))
+    return;
+
+  Optional<nonloc::LazyCompoundVal> Object = getObjectVal(CtorDecl, Context);
+  if (!Object)
+    return;
+
+  FindUninitializedFields F(Context.getState(), Object->getRegion(),
+                            IsPedantic);
+
+  const UninitFieldSet &UninitFields = F.getUninitFields();
+
+  if (UninitFields.empty())
+    return;
+
+  // There are uninitialized fields in the record.
+
+  ExplodedNode *Node = Context.generateNonFatalErrorNode(Context.getState());
+  if (!Node)
+    return;
+
+  PathDiagnosticLocation LocUsedForUniqueing;
+  const Stmt *CallSite = Context.getStackFrame()->getCallSite();
+  if (CallSite)
+    LocUsedForUniqueing = PathDiagnosticLocation::createBegin(
+        CallSite, Context.getSourceManager(), Node->getLocationContext());
+
+  SmallString<100> WarningBuf;
+  llvm::raw_svector_ostream WarningOS(WarningBuf);
+  WarningOS << UninitFields.size() << " uninitialized field"
+            << (UninitFields.size() == 1 ? "" : "s")
+            << " at the end of the constructor call";
+
+  auto Report = llvm::make_unique<BugReport>(
+      *BT_uninitField, WarningOS.str(), Node, LocUsedForUniqueing,
+      Node->getLocationContext()->getDecl());
+
+  // TODO: As of now, one warning is emitted per constructor call, and the
+  // uninitialized fields are listed in notes. Until there's a better support
+  // for notes avaible, a note-less version of this checker should be
+  // implemented.
+  for (const auto &FieldChain : UninitFields) {
+    SmallString<200> NoteBuf;
+    llvm::raw_svector_ostream NoteOS(NoteBuf);
+
+    if (FieldChain.isPointer()) {
+      if (FieldChain.isDereferenced())
+        NoteOS << "uninitialized pointee 'this->";
+      else
+        NoteOS << "uninitialized pointer 'this->";
+    } else
+      NoteOS << "uninitialized field 'this->";
+    FieldChain.print(NoteOS);
+    NoteOS << "'";
+
+    Report->addNote(NoteOS.str(),
+                    PathDiagnosticLocation::create(FieldChain.getEndOfChain(),
+                                                   Context.getSourceManager()));
+  }
+
+  Context.emitReport(std::move(Report));
+}
+
+//===----------------------------------------------------------------------===//
+//                   Methods for FindUninitializedFields.
+//===----------------------------------------------------------------------===//
+
+FindUninitializedFields::FindUninitializedFields(
+    ProgramStateRef State, const TypedValueRegion *const R, bool IsPedantic)
+    : State(State), ObjectR(R), IsPedantic(IsPedantic) {}
+
+const UninitFieldSet &FindUninitializedFields::getUninitFields() {
+  isNonUnionUninit(ObjectR, FieldChainInfo());
+
+  if (!IsPedantic && !IsAnyFieldInitialized)
+    UninitFields.clear();
+
+  return UninitFields;
+}
+
+bool FindUninitializedFields::addFieldToUninits(FieldChainInfo Chain) {
+  if (State->getStateManager().getContext().getSourceManager().isInSystemHeader(
+          Chain.getEndOfChain()->getLocation()))
+    return false;
+
+  return UninitFields.insert(Chain).second;
+}
+
+bool FindUninitializedFields::isNonUnionUninit(const TypedValueRegion *R,
+                                               FieldChainInfo LocalChain) {
+  assert(R->getValueType()->isRecordType() &&
+         "This method only checks record objects!");
+
+  const RecordDecl *RD =
+      R->getValueType()->getAs<RecordType>()->getDecl()->getDefinition();
+  assert(RD && "Referred record has no definition");
+
+  bool ContainsUninitField = false;
+
+  // Are all of this non-union's fields initialized?
+  for (const FieldDecl *I : RD->fields()) {
+
+    loc::MemRegionVal FieldVal =
+        State->getLValue(I, loc::MemRegionVal(R)).castAs<loc::MemRegionVal>();
+    const auto *FR = FieldVal.getRegionAs<FieldRegion>();
+    QualType T = I->getType();
+
+    // If LocalChain already contains FR, then we encountered a cyclic
+    // reference. In this case, region FR is already under checking at an
+    // earlier node in the directed tree.
+    if (LocalChain.contains(FR))
+      return false;
+
+    if (T->isStructureOrClassType()) {
+      if (isNonUnionUninit(FR, {LocalChain, FR}))
+        ContainsUninitField = true;
+      continue;
+    }
+
+    if (T->isUnionType()) {
+      if (isUnionUninit(FR)) {
+        if (addFieldToUninits({LocalChain, FR}))
+          ContainsUninitField = true;
+      } else
+        IsAnyFieldInitialized = true;
+      continue;
+    }
+
+    if (T->isArrayType()) {
+      IsAnyFieldInitialized = true;
+      continue;
+    }
+
+    if (T->isMemberPointerType()) {
+      if (isMemberPointerUninit(FR, LocalChain))
+        ContainsUninitField = true;
+      continue;
+    }
+
+    // If this is a pointer or reference type.
+    if (T->isPointerType() || T->isReferenceType()) {
+      if (isPointerOrReferenceUninit(FR, LocalChain))
+        ContainsUninitField = true;
+      continue;
+    }
+
+    assert(isPrimitiveType(T) && "Non-primitive type! "
+                                 "At this point FR must be primitive!");
+
+    SVal V = State->getSVal(FieldVal);
+
+    if (isPrimitiveUninit(V)) {
+      if (addFieldToUninits({LocalChain, FR}))
+        ContainsUninitField = true;
+    }
+  }
+
+  // Checking bases.
+  const auto *CXXRD = dyn_cast<CXXRecordDecl>(RD);
+  if (!CXXRD)
+    return ContainsUninitField;
+
+  for (const CXXBaseSpecifier &BaseSpec : CXXRD->bases()) {
+    const auto *BaseRegion = State->getLValue(BaseSpec, R)
+                                 .castAs<loc::MemRegionVal>()
+                                 .getRegionAs<TypedValueRegion>();
+
+    if (isNonUnionUninit(BaseRegion, LocalChain))
+      ContainsUninitField = true;
+  }
+
+  return ContainsUninitField;
+}
+
+bool FindUninitializedFields::isUnionUninit(const TypedValueRegion *R) {
+  assert(R->getValueType()->isUnionType() &&
+         "This method only checks record objects!");
+  // TODO: Implement support for union fields.
+  return false;
+}
+
+// Note that pointers/references don't contain fields themselves, so in this
+// function we won't add anything to LocalChain.
+bool FindUninitializedFields::isPointerOrReferenceUninit(
+    const FieldRegion *FR, FieldChainInfo LocalChain) {
+
+  assert((FR->getDecl()->getType()->isPointerType() ||
+          FR->getDecl()->getType()->isReferenceType()) &&
+         "This method only checks pointer/reference objects!");
+
+  SVal V = State->getSVal(FR);
+
+  if (V.isUnknown() || V.isZeroConstant()) {
+    IsAnyFieldInitialized = true;
+    return false;
+  }
+
+  if (V.isUndef()) {
+    return addFieldToUninits({LocalChain, FR});
+  }
+
+  const FieldDecl *FD = FR->getDecl();
+
+  // TODO: The dynamic type of a void pointer may be retrieved with
+  // `getDynamicTypeInfo`.
+  if (isVoidPointer(FD)) {
+    IsAnyFieldInitialized = true;
+    return false;
+  }
+
+  assert(V.getAs<Loc>() && "V should be Loc at this point!");
+
+  // At this point the pointer itself is initialized and points to a valid
+  // location, we'll now check the pointee.
+  SVal DerefdV = State->getSVal(V.castAs<Loc>());
+
+  // TODO: Dereferencing should be done according to the dynamic type.
+  while (Optional<Loc> L = DerefdV.getAs<Loc>()) {
+    DerefdV = State->getSVal(*L);
+  }
+
+  // If V is a pointer pointing to a record type.
+  if (Optional<nonloc::LazyCompoundVal> RecordV =
+          DerefdV.getAs<nonloc::LazyCompoundVal>()) {
+
+    const TypedValueRegion *R = RecordV->getRegion();
+
+    // We can't reason about symbolic regions, assume its initialized.
+    // Note that this also avoids a potential infinite recursion, because
+    // constructors for list-like classes are checked without being called, and
+    // the Static Analyzer will construct a symbolic region for Node *next; or
+    // similar code snippets.
+    if (R->getSymbolicBase()) {
+      IsAnyFieldInitialized = true;
+      return false;
+    }
+
+    const QualType T = R->getValueType();
+
+    if (T->isStructureOrClassType())
+      return isNonUnionUninit(R, {LocalChain, FR});
+
+    if (T->isUnionType()) {
+      if (isUnionUninit(R)) {
+        return addFieldToUninits({LocalChain, FR, /*IsDereferenced*/ true});
+      } else {
+        IsAnyFieldInitialized = true;
+        return false;
+      }
+    }
+
+    if (T->isArrayType()) {
+      IsAnyFieldInitialized = true;
+      return false;
+    }
+
+    llvm_unreachable("All cases are handled!");
+  }
+
+  // TODO: If possible, it should be asserted that the DerefdV at this point is
+  // primitive.
+
+  if (isPrimitiveUninit(DerefdV))
+    return addFieldToUninits({LocalChain, FR, /*IsDereferenced*/ true});
+
+  IsAnyFieldInitialized = true;
+  return false;
+}
+
+bool FindUninitializedFields::isMemberPointerUninit(const FieldRegion *FR,
+                                                    FieldChainInfo LocalChain) {
+  assert(FR->getDecl()->getType()->isMemberPointerType() &&
+         "This function only checks regions that hold MemberPointerTypes!");
+  // TODO: Implement support for MemberPointerTypes.
+  return false;
+}
+
+bool FindUninitializedFields::isPrimitiveUninit(const SVal &V) {
+  if (V.isUndef())
+    return true;
+
+  IsAnyFieldInitialized = true;
+  return false;
+}
+
+//===----------------------------------------------------------------------===//
+//                       Methods for FieldChainInfo.
+//===----------------------------------------------------------------------===//
+
+FieldChainInfo::FieldChainInfo(const FieldChainInfo &Other,
+                               const FieldRegion *FR, const bool IsDereferenced)
+    : FieldChainInfo(Other, IsDereferenced) {
+  assert(!contains(FR) && "Can't add a field that is already a part of the "
+                          "fieldchain! Is this a cyclic reference?");
+  Chain = Factory.add(FR, Other.Chain);
+  assert(!Chain.contains(nullptr) && "contains nullptr!");
+}
+
+bool FieldChainInfo::isPointer() const {
+  assert(!Chain.isEmpty() && "Empty fieldchain!");
+  return (*Chain.begin())->getDecl()->getType()->isPointerType();
+}
+
+bool FieldChainInfo::isDereferenced() const {
+  assert(isPointer() && "Only pointers may or may not be dereferenced!");
+  return IsDereferenced;
+}
+
+const FieldDecl *FieldChainInfo::getEndOfChain() const {
+  assert(!Chain.isEmpty() && "Empty fieldchain!");
+  return (*Chain.begin())->getDecl();
+}
+
+// TODO: This function constructs an incorrect fieldchain string in the
+// following case:
+//
+//   struct Base { int x; };
+//   struct D1 : Base {}; struct D2 : Base {};
+//
+//   struct MostDerived : D1, D2 {
+//     MostDerived() {}
+//   }
+//
+// A call to MostDerived::MostDerived() will cause two notes that say
+// "uninitialized field 'this->x'", but we can't refer to 'x' directly,
+// we need an explicit namespace resolution whether the uninit field was
+// 'D1::x' or 'D2::x'.
+//
+// TODO: If a field in the fieldchain is a captured lambda parameter, this
+// function constructs an empty string for it:
+//
+//   template <class Callable> struct A {
+//     Callable c;
+//     A(const Callable &c, int) : c(c) {}
+//   };
+//
+//   int b; // say that this isn't zero initialized
+//   auto alwaysTrue = [&b](int a) { return true; };
+//
+// A call with these parameters: A<decltype(alwaysTrue)>::A(alwaysTrue, int())
+// will emit a note with the message "uninitialized field: 'this->c.'". If
+// possible, the lambda parameter name should be retrieved or be replaced with a
+// "<lambda parameter>" or something similar.
+void FieldChainInfo::print(llvm::raw_ostream &Out) const {
+  if (Chain.isEmpty())
+    return;
+
+  const llvm::ImmutableListImpl<const FieldRegion *> *L =
+      Chain.getInternalPointer();
+  printTail(Out, L->getTail());
+  Out << L->getHead()->getDecl()->getNameAsString();
+}
+
+void FieldChainInfo::printTail(
+    llvm::raw_ostream &Out,
+    const llvm::ImmutableListImpl<const FieldRegion *> *L) {
+  if (!L)
+    return;
+
+  printTail(Out, L->getTail());
+  const FieldDecl *Field = L->getHead()->getDecl();
+  Out << Field->getNameAsString();
+  Out << (Field->getType()->isPointerType() ? "->" : ".");
+}
+
+//===----------------------------------------------------------------------===//
+//                           Utility functions.
+//===----------------------------------------------------------------------===//
+
+namespace {
+
+bool isVoidPointer(const FieldDecl *FD) {
+  QualType T = FD->getType();
+
+  while (!T.isNull()) {
+    if (T->isVoidPointerType())
+      return true;
+    T = T->getPointeeType();
+  }
+  return false;
+}
+
+Optional<nonloc::LazyCompoundVal>
+getObjectVal(const CXXConstructorDecl *CtorDecl, CheckerContext &Context) {
+
+  Loc ThisLoc = Context.getSValBuilder().getCXXThis(CtorDecl->getParent(),
+                                                    Context.getStackFrame());
+  // Getting the value for 'this'.
+  SVal This = Context.getState()->getSVal(ThisLoc);
+
+  // Getting the value for '*this'.
+  SVal Object = Context.getState()->getSVal(This.castAs<Loc>());
+
+  return Object.getAs<nonloc::LazyCompoundVal>();
+}
+
+// TODO: We should also check that if the constructor was called by another
+// constructor, whether those two are in any relation to one another. In it's
+// current state, this introduces some false negatives.
+bool isCalledByConstructor(const CheckerContext &Context) {
+  const LocationContext *LC = Context.getLocationContext()->getParent();
+
+  while (LC) {
+    if (isa<CXXConstructorDecl>(LC->getDecl()))
+      return true;
+
+    LC = LC->getParent();
+  }
+  return false;
+}
+
+} // end of anonymous namespace
+
+void ento::registerUninitializedObjectChecker(CheckerManager &Mgr) {
+  auto Chk = Mgr.registerChecker<UninitializedObjectChecker>();
+  Chk->IsPedantic = Mgr.getAnalyzerOptions().getBooleanOption(
+      "Pedantic", /*DefaultVal*/ false, Chk);
+}

test/Analysis/Inputs/system-header-simulator-for-cxx-uninitialized-object.h

+// Like the compiler, the static analyzer treats some functions differently if
+// they come from a system header -- for example, it is assumed that system
+// functions do not arbitrarily free() their parameters, and that some bugs
+// found in system headers cannot be fixed by the user and should be
+// suppressed.
+
+#pragma clang system_header
+
+struct RecordInSystemHeader {
+  int a;
+  int b;
+};
+
+template <class T>
+struct ContainerInSystemHeader {
+  T &t;
+  ContainerInSystemHeader(T& t) : t(t) {}
+};

test/Analysis/cxx-uninitialized-object-inheritance.cpp

+// RUN: %clang_analyze_cc1 -analyzer-checker=core,alpha.cplusplus.UninitializedObject -analyzer-config alpha.cplusplus.UninitializedObject:Pedantic=true -std=c++11 -verify %s
+
+//===----------------------------------------------------------------------===//
+// Non-polymorphic inheritance tests
+//===----------------------------------------------------------------------===//
+
+class NonPolymorphicLeft1 {
+  int x;
+
+protected:
+  int y;
+
+public:
+  NonPolymorphicLeft1() = default;
+  NonPolymorphicLeft1(int) : x(1) {}
+};
+
+class NonPolymorphicInheritanceTest1 : public NonPolymorphicLeft1 {
+  int z;
+
+public:
+  NonPolymorphicInheritanceTest1()
+      : NonPolymorphicLeft1(int{}) {
+    y = 2;
+    z = 3;
+    // All good!
+  }
+};
+
+void fNonPolymorphicInheritanceTest1() {
+  NonPolymorphicInheritanceTest1();
+}
+
+class NonPolymorphicBaseClass2 {
+  int x; // expected-note{{uninitialized field 'this->x'}}
+protected:
+  int y;
+
+public:
+  NonPolymorphicBaseClass2() = default;
+  NonPolymorphicBaseClass2(int) : x(4) {}
+};
+
+class NonPolymorphicInheritanceTest2 : public NonPolymorphicBaseClass2 {
+  int z;
+
+public:
+  NonPolymorphicInheritanceTest2() {
+    y = 5;
+    z = 6; // expected-warning{{1 uninitialized field}}
+  }
+};
+
+void fNonPolymorphicInheritanceTest2() {
+  NonPolymorphicInheritanceTest2();
+}
+
+class NonPolymorphicBaseClass3 {
+  int x;
+
+protected:
+  int y; // expected-note{{uninitialized field 'this->y'}}
+public:
+  NonPolymorphicBaseClass3() = default;
+  NonPolymorphicBaseClass3(int) : x(7) {}
+};
+
+class NonPolymorphicInheritanceTest3 : public NonPolymorphicBaseClass3 {
+  int z;
+
+public:
+  NonPolymorphicInheritanceTest3()
+      : NonPolymorphicBaseClass3(int{}) {
+    z = 8; // expected-warning{{1 uninitialized field}}
+  }
+};
+
+void fNonPolymorphicInheritanceTest3() {
+  NonPolymorphicInheritanceTest3();
+}
+
+class NonPolymorphicBaseClass4 {
+  int x;
+
+protected:
+  int y;
+
+public:
+  NonPolymorphicBaseClass4() = default;
+  NonPolymorphicBaseClass4(int) : x(9) {}
+};
+
+class NonPolymorphicInheritanceTest4 : public NonPolymorphicBaseClass4 {
+  int z; // expected-note{{uninitialized field 'this->z'}}
+
+public:
+  NonPolymorphicInheritanceTest4()
+      : NonPolymorphicBaseClass4(int{}) {
+    y = 10; // expected-warning{{1 uninitialized field}}
+  }
+};
+
+void fNonPolymorphicInheritanceTest4() {
+  NonPolymorphicInheritanceTest4();
+}
+
+//===----------------------------------------------------------------------===//
+// Polymorphic inheritance tests
+//===----------------------------------------------------------------------===//
+
+class PolymorphicLeft1 {
+  int x;
+
+protected:
+  int y;
+
+public:
+  virtual ~PolymorphicLeft1() = default;
+  PolymorphicLeft1() = default;
+  PolymorphicLeft1(int) : x(11) {}
+};
+
+class PolymorphicInheritanceTest1 : public PolymorphicLeft1 {
+  int z;
+
+public:
+  PolymorphicInheritanceTest1()
+      : PolymorphicLeft1(int{}) {
+    y = 12;
+    z = 13;
+    // All good!
+  }
+};
+
+void fPolymorphicInheritanceTest1() {
+  PolymorphicInheritanceTest1();
+}
+
+class PolymorphicRight1 {
+  int x; // expected-note{{uninitialized field 'this->x'}}
+protected:
+  int y;
+
+public:
+  virtual ~PolymorphicRight1() = default;
+  PolymorphicRight1() = default;
+  PolymorphicRight1(int) : x(14) {}
+};
+
+class PolymorphicInheritanceTest2 : public PolymorphicRight1 {
+  int z;
+
+public:
+  PolymorphicInheritanceTest2() {
+    y = 15;
+    z = 16; // expected-warning{{1 uninitialized field}}
+  }
+};
+
+void fPolymorphicInheritanceTest2() {
+  PolymorphicInheritanceTest2();
+}
+
+class PolymorphicBaseClass3 {
+  int x;
+
+protected:
+  int y; // expected-note{{uninitialized field 'this->y'}}
+public:
+  virtual ~PolymorphicBaseClass3() = default;
+  PolymorphicBaseClass3() = default;
+  PolymorphicBaseClass3(int) : x(17) {}
+};
+
+class PolymorphicInheritanceTest3 : public PolymorphicBaseClass3 {
+  int z;
+
+public:
+  PolymorphicInheritanceTest3()
+      : PolymorphicBaseClass3(int{}) {
+    z = 18; // expected-warning{{1 uninitialized field}}
+  }
+};
+
+void fPolymorphicInheritanceTest3() {
+  PolymorphicInheritanceTest3();
+}
+
+class PolymorphicBaseClass4 {
+  int x;
+
+protected:
+  int y;
+
+public:
+  virtual ~PolymorphicBaseClass4() = default;
+  PolymorphicBaseClass4() = default;
+  PolymorphicBaseClass4(int) : x(19) {}
+};
+
+class PolymorphicInheritanceTest4 : public PolymorphicBaseClass4 {
+  int z; // expected-note{{uninitialized field 'this->z'}}
+
+public:
+  PolymorphicInheritanceTest4()
+      : PolymorphicBaseClass4(int{}) {
+    y = 20; // expected-warning{{1 uninitialized field}}
+  }
+};
+
+void fPolymorphicInheritanceTest4() {
+  PolymorphicInheritanceTest4();
+}
+
+//===----------------------------------------------------------------------===//
+// Virtual inheritance tests
+//===----------------------------------------------------------------------===//
+
+class VirtualPolymorphicLeft1 {
+  int x;
+
+protected:
+  int y;
+
+public:
+  virtual ~VirtualPolymorphicLeft1() = default;
+  VirtualPolymorphicLeft1() = default;
+  VirtualPolymorphicLeft1(int) : x(21) {}
+};
+
+class VirtualInheritanceTest1 : virtual public VirtualPolymorphicLeft1 {
+  int z;
+
+public:
+  VirtualInheritanceTest1()
+      : VirtualPolymorphicLeft1(int()) {
+    y = 22;
+    z = 23;
+    // All good!
+  }
+};
+
+void fVirtualInheritanceTest1() {
+  VirtualInheritanceTest1();
+}
+
+class VirtualPolymorphicRight1 {
+  int x; // expected-note{{uninitialized field 'this->x'}}
+protected:
+  int y;
+
+public:
+  virtual ~VirtualPolymorphicRight1() = default;
+  VirtualPolymorphicRight1() = default;
+  VirtualPolymorphicRight1(int) : x(24) {}
+};
+
+class VirtualInheritanceTest2 : virtual public VirtualPolymorphicRight1 {
+  int z;
+
+public:
+  VirtualInheritanceTest2() {
+    y = 25;
+    z = 26; // expected-warning{{1 uninitialized field}}
+  }
+};
+
+void fVirtualInheritanceTest2() {
+  VirtualInheritanceTest2();
+}
+
+class VirtualPolymorphicBaseClass3 {
+  int x;
+
+protected:
+  int y; // expected-note{{uninitialized field 'this->y'}}
+public:
+  virtual ~VirtualPolymorphicBaseClass3() = default;
+  VirtualPolymorphicBaseClass3() = default;
+  VirtualPolymorphicBaseClass3(int) : x(27) {}
+};
+
+class VirtualInheritanceTest3 : virtual public VirtualPolymorphicBaseClass3 {
+  int z;
+
+public:
+  VirtualInheritanceTest3()
+      : VirtualPolymorphicBaseClass3(int{}) {
+    z = 28; // expected-warning{{1 uninitialized field}}
+  }
+};
+
+void fVirtualInheritanceTest3() {
+  VirtualInheritanceTest3();
+}
+
+//===----------------------------------------------------------------------===//
+// Multiple inheritance tests
+//===----------------------------------------------------------------------===//
+
+/*
+        Left        Right
+          \           /
+           \         /
+            \       /
+     MultipleInheritanceTest
+*/
+
+struct Left1 {
+  int x;
+  Left1() = default;
+  Left1(int) : x(29) {}
+};
+struct Right1 {
+  int y;
+  Right1() = default;
+  Right1(int) : y(30) {}
+};
+
+class MultipleInheritanceTest1 : public Left1, public Right1 {
+  int z;
+
+public:
+  MultipleInheritanceTest1()
+      : Left1(int{}),
+        Right1(char{}) {
+    z = 31;
+    // All good!
+  }
+
+  MultipleInheritanceTest1(int)
+      : Left1(int{}) {
+    y = 32;
+    z = 33;
+    // All good!
+  }
+
+  MultipleInheritanceTest1(int, int)
+      : Right1(char{}) {
+    x = 34;
+    z = 35;
+    // All good!
+  }
+};
+
+void fMultipleInheritanceTest1() {
+  MultipleInheritanceTest1();
+  MultipleInheritanceTest1(int());
+  MultipleInheritanceTest1(int(), int());
+}
+
+struct Left2 {
+  int x;
+  Left2() = default;
+  Left2(int) : x(36) {}
+};
+struct Right2 {
+  int y; // expected-note{{uninitialized field 'this->y'}}
+  Right2() = default;
+  Right2(int) : y(37) {}
+};
+
+class MultipleInheritanceTest2 : public Left2, public Right2 {
+  int z;
+
+public:
+  MultipleInheritanceTest2()
+      : Left2(int{}) {
+    z = 38; // expected-warning{{1 uninitialized field}}
+  }
+};
+
+void fMultipleInheritanceTest2() {
+  MultipleInheritanceTest2();
+}
+
+struct Left3 {
+  int x; // expected-note{{uninitialized field 'this->x'}}
+  Left3() = default;
+  Left3(int) : x(39) {}
+};
+struct Right3 {
+  int y;
+  Right3() = default;
+  Right3(int) : y(40) {}
+};
+
+class MultipleInheritanceTest3 : public Left3, public Right3 {
+  int z;
+
+public:
+  MultipleInheritanceTest3()
+      : Right3(char{}) {
+    z = 41; // expected-warning{{1 uninitialized field}}
+  }
+};
+
+void fMultipleInheritanceTest3() {
+  MultipleInheritanceTest3();
+}
+
+struct Left4 {
+  int x;
+  Left4() = default;
+  Left4(int) : x(42) {}
+};
+struct Right4 {
+  int y;
+  Right4() = default;
+  Right4(int) : y(43) {}
+};
+
+class MultipleInheritanceTest4 : public Left4, public Right4 {
+  int z; // expected-note{{uninitialized field 'this->z'}}
+
+public:
+  MultipleInheritanceTest4()
+      : Left4(int{}),
+        Right4(char{}) { // expected-warning{{1 uninitialized field}}
+  }
+};
+
+void fMultipleInheritanceTest4() {
+  MultipleInheritanceTest4();
+}
+
+struct Left5 {
+  int x;
+  Left5() = default;
+  Left5(int) : x(44) {}
+};
+struct Right5 {
+  int y; // expected-note{{uninitialized field 'this->y'}}
+  Right5() = default;
+  Right5(int) : y(45) {}
+};
+
+class MultipleInheritanceTest5 : public Left5, public Right5 {
+  int z; // expected-note{{uninitialized field 'this->z'}}
+
+public:
+  MultipleInheritanceTest5() // expected-warning{{2 uninitialized fields}}
+      : Left5(int{}) {
+  }
+};
+
+void fMultipleInheritanceTest5() {
+  MultipleInheritanceTest5();
+}
+
+//===----------------------------------------------------------------------===//
+// Non-virtual diamond inheritance tests
+//===----------------------------------------------------------------------===//
+
+/*
+  NonVirtualBase   NonVirtualBase
+        |                |
+        |                |
+        |                |
+     First              Second
+        \                /
+         \              /
+          \            /
+  NonVirtualDiamondInheritanceTest
+*/
+
+struct NonVirtualBase1 {
+  int x;
+  NonVirtualBase1() = default;
+  NonVirtualBase1(int) : x(46) {}
+};
+struct First1 : public NonVirtualBase1 {
+  First1() = default;
+  First1(int) : NonVirtualBase1(int{}) {}
+};
+struct Second1 : public NonVirtualBase1 {
+  Second1() = default;
+  Second1(int) : NonVirtualBase1(int{}) {}
+};
+
+class NonVirtualDiamondInheritanceTest1 : public First1, public Second1 {
+  int z;
+
+public:
+  NonVirtualDiamondInheritanceTest1()
+      : First1(int{}),
+        Second1(int{}) {
+    z = 47;
+    // All good!
+  }
+
+  NonVirtualDiamondInheritanceTest1(int)
+      : First1(int{}) {
+    Second1::x = 48;
+    z = 49;
+    // All good!
+  }
+
+  NonVirtualDiamondInheritanceTest1(int, int)
+      : Second1(int{}) {
+    First1::x = 50;
+    z = 51;
+    // All good!
+  }
+};
+
+void fNonVirtualDiamondInheritanceTest1() {
+  NonVirtualDiamondInheritanceTest1();
+  NonVirtualDiamondInheritanceTest1(int());
+  NonVirtualDiamondInheritanceTest1(int(), int());
+}
+
+struct NonVirtualBase2 {
+  int x; // expected-note{{uninitialized field 'this->x'}}
+  NonVirtualBase2() = default;
+  NonVirtualBase2(int) : x(52) {}
+};
+struct First2 : public NonVirtualBase2 {
+  First2() = default;
+  First2(int) : NonVirtualBase2(int{}) {}
+};
+struct Second2 : public NonVirtualBase2 {
+  Second2() = default;
+  Second2(int) : NonVirtualBase2(int{}) {}
+};
+
+class NonVirtualDiamondInheritanceTest2 : public First2, public Second2 {
+  int z;
+
+public:
+  NonVirtualDiamondInheritanceTest2()
+      : First2(int{}) {
+    z = 53; // expected-warning{{1 uninitialized field}}
+  }
+};
+
+void fNonVirtualDiamondInheritanceTest2() {
+  NonVirtualDiamondInheritanceTest2();
+}
+
+struct NonVirtualBase3 {
+  int x; // expected-note{{uninitialized field 'this->x'}}
+  NonVirtualBase3() = default;
+  NonVirtualBase3(int) : x(54) {}
+};
+struct First3 : public NonVirtualBase3 {
+  First3() = default;
+  First3(int) : NonVirtualBase3(int{}) {}
+};
+struct Second3 : public NonVirtualBase3 {
+  Second3() = default;
+  Second3(int) : NonVirtualBase3(int{}) {}
+};
+
+class NonVirtualDiamondInheritanceTest3 : public First3, public Second3 {
+  int z;
+
+public:
+  NonVirtualDiamondInheritanceTest3()
+      : Second3(int{}) {
+    z = 55; // expected-warning{{1 uninitialized field}}
+  }
+};
+
+void fNonVirtualDiamondInheritanceTest3() {
+  NonVirtualDiamondInheritanceTest3();
+}
+
+struct NonVirtualBase4 {
+  int x; // expected-note{{uninitialized field 'this->x'}}
+  // expected-note@-1{{uninitialized field 'this->x'}}
+  NonVirtualBase4() = default;
+  NonVirtualBase4(int) : x(56) {}
+};
+struct First4 : public NonVirtualBase4 {
+  First4() = default;
+  First4(int) : NonVirtualBase4(int{}) {}
+};
+struct Second4 : public NonVirtualBase4 {
+  Second4() = default;
+  Second4(int) : NonVirtualBase4(int{}) {}
+};
+
+class NonVirtualDiamondInheritanceTest4 : public First4, public Second4 {
+  int z;
+
+public:
+  NonVirtualDiamondInheritanceTest4() {
+    z = 57; // expected-warning{{2 uninitialized fields}}
+  }
+};
+
+void fNonVirtualDiamondInheritanceTest4() {
+  NonVirtualDiamondInheritanceTest4();
+}
+
+struct NonVirtualBase5 {
+  int x;
+  NonVirtualBase5() = default;
+  NonVirtualBase5(int) : x(58) {}
+};
+struct First5 : public NonVirtualBase5 {
+  First5() = default;
+  First5(int) : NonVirtualBase5(int{}) {}
+};
+struct Second5 : public NonVirtualBase5 {
+  Second5() = default;
+  Second5(int) : NonVirtualBase5(int{}) {}
+};
+
+class NonVirtualDiamondInheritanceTest5 : public First5, public Second5 {
+  int z; // expected-note{{uninitialized field 'this->z'}}
+
+public:
+  NonVirtualDiamondInheritanceTest5()
+      : First5(int{}),
+        Second5(int{}) { // expected-warning{{1 uninitialized field}}
+  }
+};
+
+void fNonVirtualDiamondInheritanceTest5() {
+  NonVirtualDiamondInheritanceTest5();
+}
+
+struct NonVirtualBase6 {
+  int x; // expected-note{{uninitialized field 'this->x'}}
+  NonVirtualBase6() = default;
+  NonVirtualBase6(int) : x(59) {}
+};
+struct First6 : public NonVirtualBase6 {
+  First6() = default;
+  First6(int) : NonVirtualBase6(int{}) {}
+};
+struct Second6 : public NonVirtualBase6 {
+  Second6() = default;
+  Second6(int) : NonVirtualBase6(int{}) {}
+};
+
+class NonVirtualDiamondInheritanceTest6 : public First6, public Second6 {
+  int z; // expected-note{{uninitialized field 'this->z'}}
+
+public:
+  NonVirtualDiamondInheritanceTest6() // expected-warning{{2 uninitialized fields}}
+      : First6(int{}) {
+    // 'z' and 'Second::x' unintialized
+  }
+};
+
+void fNonVirtualDiamondInheritanceTest6() {
+  NonVirtualDiamondInheritanceTest6();
+}
+
+//===----------------------------------------------------------------------===//
+// Virtual diamond inheritance tests
+//===----------------------------------------------------------------------===//
+
+/*
+           VirtualBase
+            /       \
+           /         \
+          /           \
+  VirtualFirst     VirtualSecond
+          \           /
+           \         /
+            \       /
+   VirtualDiamondInheritanceTest
+*/
+
+struct VirtualBase1 {
+  int x;
+  VirtualBase1() = default;
+  VirtualBase1(int) : x(60) {}
+};
+struct VirtualFirst1 : virtual public VirtualBase1 {
+  VirtualFirst1() = default;
+  VirtualFirst1(int) : VirtualBase1(int{}) {}
+  VirtualFirst1(int, int) { x = 61; }
+};
+struct VirtualSecond1 : virtual public VirtualBase1 {
+  VirtualSecond1() = default;
+  VirtualSecond1(int) : VirtualBase1(int{}) {}
+  VirtualSecond1(int, int) { x = 62; }
+};
+
+class VirtualDiamondInheritanceTest1 : public VirtualFirst1, public VirtualSecond1 {
+
+public:
+  VirtualDiamondInheritanceTest1() {
+    x = 0;
+    // All good!
+  }
+
+  VirtualDiamondInheritanceTest1(int)
+      : VirtualFirst1(int{}, int{}),
+        VirtualSecond1(int{}, int{}) {
+    // All good!
+  }
+
+  VirtualDiamondInheritanceTest1(int, int)
+      : VirtualFirst1(int{}, int{}) {
+    // All good!
+  }
+};
+
+void fVirtualDiamondInheritanceTest1() {
+  VirtualDiamondInheritanceTest1();
+  VirtualDiamondInheritanceTest1(int());
+  VirtualDiamondInheritanceTest1(int(), int());
+}
+
+struct VirtualBase2 {
+  int x; // expected-note{{uninitialized field 'this->x'}}
+  VirtualBase2() = default;
+  VirtualBase2(int) : x(63) {}
+};
+struct VirtualFirst2 : virtual public VirtualBase2 {
+  VirtualFirst2() = default;
+  VirtualFirst2(int) : VirtualBase2(int{}) {}
+  VirtualFirst2(int, int) { x = 64; }
+};
+struct VirtualSecond2 : virtual public VirtualBase2 {
+  VirtualSecond2() = default;
+  VirtualSecond2(int) : VirtualBase2(int{}) {}
+  VirtualSecond2(int, int) { x = 65; }
+};
+
+class VirtualDiamondInheritanceTest2 : public VirtualFirst2, public VirtualSecond2 {
+
+public:
+  VirtualDiamondInheritanceTest2() // expected-warning{{1 uninitialized field}}
+      : VirtualFirst2(int{}) {
+    // From the N4659 C++ Standard Working Draft:
+    //
+    //   (15.6.2.7)
+    //   [...] A 'mem-initializer' where the 'mem-initializer-id' denotes a
+    //   virtual base class is ignored during execution of a constructor of any
+    //   class that is not the most derived class.
+    //
+    // This means that Left1::x will not be initialized, because in both
+    // VirtualFirst::VirtualFirst(int) and VirtualSecond::VirtualSecond(int)
+    // the constructor delegation to Left1::Left1(int) will be
+    // ignored.
+  }
+};
+
+void fVirtualDiamondInheritanceTest2() {
+  VirtualDiamondInheritanceTest2();
+}
+
+struct VirtualBase3 {
+  int x; // expected-note{{uninitialized field 'this->x'}}
+  VirtualBase3() = default;
+  VirtualBase3(int) : x(66) {}
+};
+struct VirtualFirst3 : virtual public VirtualBase3 {
+  VirtualFirst3() = default;
+  VirtualFirst3(int) : VirtualBase3(int{}) {}
+  VirtualFirst3(int, int) { x = 67; }
+};
+struct VirtualSecond3 : virtual public VirtualBase3 {
+  VirtualSecond3() = default;
+  VirtualSecond3(int) : VirtualBase3(int{}) {}
+  VirtualSecond3(int, int) { x = 68; }
+};
+
+class VirtualDiamondInheritanceTest3 : public VirtualFirst3, public VirtualSecond3 {
+
+public:
+  VirtualDiamondInheritanceTest3() // expected-warning{{1 uninitialized field}}
+      : VirtualFirst3(int{}) {}
+};
+
+void fVirtualDiamondInheritanceTest3() {
+  VirtualDiamondInheritanceTest3();
+}

test/Analysis/cxx-uninitialized-object-ptr-ref.cpp

+// RUN: %clang_analyze_cc1 -analyzer-checker=core,alpha.cplusplus.UninitializedObject -analyzer-config alpha.cplusplus.UninitializedObject:Pedantic=true -std=c++11 -DPEDANTIC -verify %s
+
+// RUN: %clang_analyze_cc1 -analyzer-checker=core,alpha.cplusplus.UninitializedObject -std=c++11 -verify %s
+
+//===----------------------------------------------------------------------===//
+// Concrete location tests.
+//===----------------------------------------------------------------------===//
+
+struct ConcreteIntLocTest {
+  int *ptr;
+
+  ConcreteIntLocTest() : ptr(reinterpret_cast<int *>(0xDEADBEEF)) {}
+};
+
+void fConcreteIntLocTest() {
+  ConcreteIntLocTest();
+}
+
+//===----------------------------------------------------------------------===//
+// Null pointer tests.
+//===----------------------------------------------------------------------===//
+
+class NullPtrTest {
+  struct RecordType {
+    int x;
+    int y;
+  };
+
+  float *fptr = nullptr;
+  int *ptr;
+  RecordType *recPtr;
+
+public:
+  NullPtrTest() : ptr(nullptr), recPtr(nullptr) {
+    // All good!
+  }
+};
+
+void fNullPtrTest() {
+  NullPtrTest();
+}
+
+//===----------------------------------------------------------------------===//
+// Heap pointer tests.
+//===----------------------------------------------------------------------===//
+
+class HeapPointerTest1 {
+  struct RecordType {
+    // TODO: we'd expect the note: {{uninitialized field 'this->recPtr->y'}}
+    int x; // no-note
+    // TODO: we'd expect the note: {{uninitialized field 'this->recPtr->y'}}
+    int y; // no-note
+  };
+  // TODO: we'd expect the note: {{uninitialized pointee 'this->fptr'}}
+  float *fptr = new float; // no-note
+  // TODO: we'd expect the note: {{uninitialized pointee 'this->ptr'}}
+  int *ptr; // no-note
+  RecordType *recPtr;
+
+public:
+  // TODO: we'd expect the warning: {{4 uninitialized fields}}
+  HeapPointerTest1() : ptr(new int), recPtr(new RecordType) { // no-note
+  }
+};
+
+void fHeapPointerTest1() {
+  HeapPointerTest1();
+}
+
+class HeapPointerTest2 {
+  struct RecordType {
+    int x;
+    int y;
+  };
+
+  float *fptr = new float(); // initializes to 0
+  int *ptr;
+  RecordType *recPtr;
+
+public:
+  HeapPointerTest2() : ptr(new int{25}), recPtr(new RecordType{26, 27}) {
+    // All good!
+  }
+};
+
+void fHeapPointerTest2() {
+  HeapPointerTest2();
+}
+
+//===----------------------------------------------------------------------===//
+// Stack pointer tests.
+//===----------------------------------------------------------------------===//
+
+class StackPointerTest1 {
+public:
+  struct RecordType {
+    int x;
+    int y;
+  };
+
+private:
+  int *ptr;
+  RecordType *recPtr;
+
+public:
+  StackPointerTest1(int *_ptr, StackPointerTest1::RecordType *_recPtr) : ptr(_ptr), recPtr(_recPtr) {
+    // All good!
+  }
+};
+
+void fStackPointerTest1() {
+  int ok_a = 28;
+  StackPointerTest1::RecordType ok_rec{29, 30};
+  StackPointerTest1(&ok_a, &ok_rec); // 'a', 'rec.x', 'rec.y' uninitialized
+}
+
+#ifdef PEDANTIC
+class StackPointerTest2 {
+public:
+  struct RecordType {
+    int x; // expected-note{{uninitialized field 'this->recPtr->x'}}
+    int y; // expected-note{{uninitialized field 'this->recPtr->y'}}
+  };
+
+private:
+  int *ptr; // expected-note{{uninitialized pointee 'this->ptr'}}
+  RecordType *recPtr;
+
+public:
+  StackPointerTest2(int *_ptr, RecordType *_recPtr) : ptr(_ptr), recPtr(_recPtr) { // expected-warning{{3 uninitialized fields}}
+  }
+};
+
+void fStackPointerTest2() {
+  int a;
+  StackPointerTest2::RecordType rec;
+  StackPointerTest2(&a, &rec); // 'a', 'rec.x', 'rec.y' uninitialized
+}
+#else
+class StackPointerTest2 {
+public:
+  struct RecordType {
+    int x;
+    int y;
+  };
+
+private:
+  int *ptr;
+  RecordType *recPtr;
+
+public:
+  StackPointerTest2(int *_ptr, RecordType *_recPtr) : ptr(_ptr), recPtr(_recPtr) {
+  }
+};
+
+void fStackPointerTest2() {
+  int a;
+  StackPointerTest2::RecordType rec;
+  StackPointerTest2(&a, &rec); // 'a', 'rec.x', 'rec.y' uninitialized
+}
+#endif // PEDANTIC
+
+class UninitPointerTest {
+  struct RecordType {
+    int x;
+    int y;
+  };
+
+  int *ptr; // expected-note{{uninitialized pointer 'this->ptr'}}
+  RecordType *recPtr;
+
+public:
+  UninitPointerTest() : recPtr(new RecordType{13, 13}) { // expected-warning{{1 uninitialized field}}
+  }
+};
+
+void fUninitPointerTest() {
+  UninitPointerTest();
+}
+
+struct CharPointerTest {
+  const char *str;
+  int dontGetFilteredByNonPedanticMode = 0;
+
+  CharPointerTest() : str("") {}
+};
+
+void fCharPointerTest() {
+  CharPointerTest();
+}
+
+//===----------------------------------------------------------------------===//
+// Void pointer tests.
+//===----------------------------------------------------------------------===//
+
+// Void pointer tests are mainly no-crash tests.
+
+void *malloc(int size);
+
+class VoidPointerTest1 {
+  void *vptr;
+
+public:
+  VoidPointerTest1(void *vptr, char) : vptr(vptr) {
+    // All good!
+  }
+};
+
+void fVoidPointerTest1() {
+  void *vptr = malloc(sizeof(int));
+  VoidPointerTest1(vptr, char());
+}
+
+class VoidPointerTest2 {
+  void **vpptr;
+
+public:
+  VoidPointerTest2(void **vpptr, char) : vpptr(vpptr) {
+    // All good!
+  }
+};
+
+void fVoidPointerTest2() {
+  void *vptr = malloc(sizeof(int));
+  VoidPointerTest2(&vptr, char());
+}
+
+class VoidPointerRRefTest1 {
+  void *&&vptrrref;
+
+public:
+  VoidPointerRRefTest1(void *vptr, char) : vptrrref(static_cast<void *&&>(vptr)) {
+    // All good!
+  }
+};
+
+void fVoidPointerRRefTest1() {
+  void *vptr = malloc(sizeof(int));
+  VoidPointerRRefTest1(vptr, char());
+}
+
+class VoidPointerRRefTest2 {
+  void **&&vpptrrref;
+
+public:
+  VoidPointerRRefTest2(void **vptr, char) : vpptrrref(static_cast<void **&&>(vptr)) {
+    // All good!
+  }
+};
+
+void fVoidPointerRRefTest2() {
+  void *vptr = malloc(sizeof(int));
+  VoidPointerRRefTest2(&vptr, char());
+}
+
+class VoidPointerLRefTest {
+  void *&vptrrref;
+
+public:
+  VoidPointerLRefTest(void *vptr, char) : vptrrref(static_cast<void *&>(vptr)) {
+    // All good!
+  }
+};
+
+void fVoidPointerLRefTest() {
+  void *vptr = malloc(sizeof(int));
+  VoidPointerLRefTest(vptr, char());
+}
+
+//===----------------------------------------------------------------------===//
+// Multipointer tests.
+//===----------------------------------------------------------------------===//
+
+#ifdef PEDANTIC
+class MultiPointerTest1 {
+public:
+  struct RecordType {
+    int x;
+    int y;
+  };
+
+private:
+  RecordType **mptr; // expected-note{{uninitialized pointee 'this->mptr'}}
+
+public:
+  MultiPointerTest1(RecordType **p, int) : mptr(p) { // expected-warning{{1 uninitialized field}}
+  }
+};
+
+void fMultiPointerTest1() {
+  MultiPointerTest1::RecordType *p1;
+  MultiPointerTest1::RecordType **mptr = &p1;
+  MultiPointerTest1(mptr, int()); // '*mptr' uninitialized
+}
+#else
+class MultiPointerTest1 {
+public:
+  struct RecordType {
+    int x;
+    int y;
+  };
+
+private:
+  RecordType **mptr;
+
+public:
+  MultiPointerTest1(RecordType **p, int) : mptr(p) {}
+};
+
+void fMultiPointerTest1() {
+  MultiPointerTest1::RecordType *p1;
+  MultiPointerTest1::RecordType **mptr = &p1;
+  MultiPointerTest1(mptr, int()); // '*mptr' uninitialized
+}
+#endif // PEDANTIC
+
+#ifdef PEDANTIC
+class MultiPointerTest2 {
+public:
+  struct RecordType {
+    int x; // expected-note{{uninitialized field 'this->mptr->x'}}
+    int y; // expected-note{{uninitialized field 'this->mptr->y'}}
+  };
+
+private:
+  RecordType **mptr;
+
+public:
+  MultiPointerTest2(RecordType **p, int) : mptr(p) { // expected-warning{{2 uninitialized fields}}
+  }
+};
+
+void fMultiPointerTest2() {
+  MultiPointerTest2::RecordType i;
+  MultiPointerTest2::RecordType *p1 = &i;
+  MultiPointerTest2::RecordType **mptr = &p1;
+  MultiPointerTest2(mptr, int()); // '**mptr' uninitialized
+}
+#else
+class MultiPointerTest2 {
+public:
+  struct RecordType {
+    int x;
+    int y;
+  };
+
+private:
+  RecordType **mptr;
+
+public:
+  MultiPointerTest2(RecordType **p, int) : mptr(p) {
+  }
+};
+
+void fMultiPointerTest2() {
+  MultiPointerTest2::RecordType i;
+  MultiPointerTest2::RecordType *p1 = &i;
+  MultiPointerTest2::RecordType **mptr = &p1;
+  MultiPointerTest2(mptr, int()); // '**mptr' uninitialized
+}
+#endif // PEDANTIC
+
+class MultiPointerTest3 {
+public:
+  struct RecordType {
+    int x;
+    int y;
+  };
+
+private:
+  RecordType **mptr;
+
+public:
+  MultiPointerTest3(RecordType **p, int) : mptr(p) {
+    // All good!
+  }
+};
+
+void fMultiPointerTest3() {
+  MultiPointerTest3::RecordType i{31, 32};
+  MultiPointerTest3::RecordType *p1 = &i;
+  MultiPointerTest3::RecordType **mptr = &p1;
+  MultiPointerTest3(mptr, int()); // '**mptr' uninitialized
+}
+
+//===----------------------------------------------------------------------===//
+// Member pointer tests.
+//===----------------------------------------------------------------------===//
+
+struct UsefulFunctions {
+  int a, b;
+
+  void print() {}
+  void dump() {}
+};
+
+#ifdef PEDANTIC
+struct PointerToMemberFunctionTest1 {
+  // TODO: we'd expect the note {{uninitialized field 'this->f'}}
+  void (UsefulFunctions::*f)(void); // no-note
+  PointerToMemberFunctionTest1() {}
+};
+
+void fPointerToMemberFunctionTest1() {
+  // TODO: we'd expect the warning {{1 uninitialized field}}
+  PointerToMemberFunctionTest1(); // no-warning
+}
+
+struct PointerToMemberFunctionTest2 {
+  void (UsefulFunctions::*f)(void);
+  PointerToMemberFunctionTest2(void (UsefulFunctions::*f)(void)) : f(f) {
+    // All good!
+  }
+};
+
+void fPointerToMemberFunctionTest2() {
+  void (UsefulFunctions::*f)(void) = &UsefulFunctions::print;
+  PointerToMemberFunctionTest2 a(f);
+}
+
+struct MultiPointerToMemberFunctionTest1 {
+  void (UsefulFunctions::**f)(void); // expected-note{{uninitialized pointer 'this->f'}}
+  MultiPointerToMemberFunctionTest1() {}
+};
+
+void fMultiPointerToMemberFunctionTest1() {
+  MultiPointerToMemberFunctionTest1(); // expected-warning{{1 uninitialized field}}
+}
+
+struct MultiPointerToMemberFunctionTest2 {
+  void (UsefulFunctions::**f)(void);
+  MultiPointerToMemberFunctionTest2(void (UsefulFunctions::**f)(void)) : f(f) {
+    // All good!
+  }
+};
+
+void fMultiPointerToMemberFunctionTest2() {
+  void (UsefulFunctions::*f)(void) = &UsefulFunctions::print;
+  MultiPointerToMemberFunctionTest2 a(&f);
+}
+
+struct PointerToMemberDataTest1 {
+  // TODO: we'd expect the note {{uninitialized field 'this->f'}}
+  int UsefulFunctions::*d; // no-note
+  PointerToMemberDataTest1() {}
+};
+
+void fPointerToMemberDataTest1() {
+  // TODO: we'd expect the warning {{1 uninitialized field}}
+  PointerToMemberDataTest1(); // no-warning
+}
+
+struct PointerToMemberDataTest2 {
+  int UsefulFunctions::*d;
+  PointerToMemberDataTest2(int UsefulFunctions::*d) : d(d) {
+    // All good!
+  }
+};
+
+void fPointerToMemberDataTest2() {
+  int UsefulFunctions::*d = &UsefulFunctions::a;
+  PointerToMemberDataTest2 a(d);
+}
+
+struct MultiPointerToMemberDataTest1 {
+  int UsefulFunctions::**d; // expected-note{{uninitialized pointer 'this->d'}}
+  MultiPointerToMemberDataTest1() {}
+};
+
+void fMultiPointerToMemberDataTest1() {
+  MultiPointerToMemberDataTest1(); // expected-warning{{1 uninitialized field}}
+}
+
+struct MultiPointerToMemberDataTest2 {
+  int UsefulFunctions::**d;
+  MultiPointerToMemberDataTest2(int UsefulFunctions::**d) : d(d) {
+    // All good!
+  }
+};
+
+void fMultiPointerToMemberDataTest2() {
+  int UsefulFunctions::*d = &UsefulFunctions::a;
+  MultiPointerToMemberDataTest2 a(&d);
+}
+#endif // PEDANTIC
+
+//===----------------------------------------------------------------------===//
+// Tests for list-like records.
+//===----------------------------------------------------------------------===//
+
+class ListTest1 {
+public:
+  struct Node {
+    Node *next = nullptr; // no crash
+    int i;
+  };
+
+private:
+  Node *head = nullptr;
+
+public:
+  ListTest1() {
+    // All good!
+  }
+};
+
+void fListTest1() {
+  ListTest1();
+}
+
+class ListTest2 {
+public:
+  struct Node {
+    Node *next = nullptr;
+    int i; // expected-note{{uninitialized field 'this->head->i'}}
+  };
+
+private:
+  Node *head = nullptr;
+
+public:
+  ListTest2(Node *node, int) : head(node) { // expected-warning{{1 uninitialized field}}
+  }
+};
+
+void fListTest2() {
+  ListTest2::Node n;
+  ListTest2(&n, int());
+}
+
+class CyclicList {
+public:
+  struct Node {
+    Node *next = nullptr;
+    int i; // expected-note{{uninitialized field 'this->head->i'}}
+  };
+
+private:
+  Node *head = nullptr;
+
+public:
+  CyclicList(Node *node, int) : head(node) { // expected-warning{{1 uninitialized field}}
+  }
+};
+
+void fCyclicList() {
+  /*
+               n3
+              /  \
+    this -- n1 -- n2
+  */
+
+  CyclicList::Node n1;
+  CyclicList::Node n2;
+  n2.next = &n1;
+  n2.i = 50;
+  CyclicList::Node n3;
+  n3.next = &n2;
+  n3.i = 50;
+  n1.next = &n3;
+  // note that n1.i is uninitialized
+  CyclicList(&n1, int());
+}
+
+//===----------------------------------------------------------------------===//
+// Tests for classes containing references.
+//===----------------------------------------------------------------------===//
+
+class ReferenceTest1 {
+public:
+  struct RecordType {
+    int x;
+    int y;
+  };
+
+private:
+  RecordType &lref;
+  RecordType &&rref;
+
+public:
+  ReferenceTest1(RecordType &lref, RecordType &rref) : lref(lref), rref(static_cast<RecordType &&>(rref)) {
+    // All good!
+  }
+};
+
+void fReferenceTest1() {
+  ReferenceTest1::RecordType d{33, 34};
+  ReferenceTest1(d, d);
+}
+
+#ifdef PEDANTIC
+class ReferenceTest2 {
+public:
+  struct RecordType {
+    int x; // expected-note{{uninitialized field 'this->lref.x'}}
+    int y; // expected-note{{uninitialized field 'this->lref.y'}}
+  };
+
+private:
+  RecordType &lref;
+  RecordType &&rref;
+
+public:
+  ReferenceTest2(RecordType &lref, RecordType &rref)
+      : lref(lref), rref(static_cast<RecordType &&>(rref)) { // expected-warning{{2 uninitialized fields}}
+  }
+};
+
+void fReferenceTest2() {
+  ReferenceTest2::RecordType c;
+  ReferenceTest2(c, c);
+}
+#else
+class ReferenceTest2 {
+public:
+  struct RecordType {
+    int x;
+    int y;
+  };
+
+private:
+  RecordType &lref;
+  RecordType &&rref;
+
+public:
+  ReferenceTest2(RecordType &lref, RecordType &rref)
+      : lref(lref), rref(static_cast<RecordType &&>(rref)) {
+  }
+};
+
+void fReferenceTest2() {
+  ReferenceTest2::RecordType c;
+  ReferenceTest2(c, c);
+}
+#endif // PEDANTIC
+
+class ReferenceTest3 {
+public:
+  struct RecordType {
+    int x; // expected-note{{uninitialized field 'this->lref.x'}}
+    int y; // expected-note{{uninitialized field 'this->lref.y'}}
+  };
+
+private:
+  RecordType &lref;
+  RecordType &&rref;
+
+public:
+  ReferenceTest3(RecordType &lref, RecordType &rref)
+      : lref(lref), rref(static_cast<RecordType &&>(rref)) { // expected-warning{{2 uninitialized fields}}
+  }
+};
+
+void fReferenceTest3() {
+  ReferenceTest3::RecordType c, d{35, 36};
+  ReferenceTest3(c, d);
+}
+
+class ReferenceTest4 {
+public:
+  struct RecordType {
+    int x; // expected-note{{uninitialized field 'this->rref.x'}}
+    int y; // expected-note{{uninitialized field 'this->rref.y'}}
+  };
+
+private:
+  RecordType &lref;
+  RecordType &&rref;
+
+public:
+  ReferenceTest4(RecordType &lref, RecordType &rref)
+      : lref(lref), rref(static_cast<RecordType &&>(rref)) { // expected-warning{{2 uninitialized fields}}
+  }
+};
+
+void fReferenceTest5() {
+  ReferenceTest4::RecordType c, d{37, 38};
+  ReferenceTest4(d, c);
+}

test/Analysis/cxx-uninitialized-object.cpp

+// RUN: %clang_analyze_cc1 -analyzer-checker=core,alpha.cplusplus.UninitializedObject -analyzer-config alpha.cplusplus.UninitializedObject:Pedantic=true -std=c++11 -DPEDANTIC -verify %s
+
+// RUN: %clang_analyze_cc1 -analyzer-checker=core,alpha.cplusplus.UninitializedObject -std=c++11 -verify %s
+
+//===----------------------------------------------------------------------===//
+// Default constructor test.
+//===----------------------------------------------------------------------===//
+
+class CompilerGeneratedConstructorTest {
+  int a, b, c, d, e, f, g, h, i, j;
+
+public:
+  CompilerGeneratedConstructorTest() = default;
+};
+
+void fCompilerGeneratedConstructorTest() {
+  CompilerGeneratedConstructorTest();
+}
+
+#ifdef PEDANTIC
+class DefaultConstructorTest {
+  int a; // expected-note{{uninitialized field 'this->a'}}
+
+public:
+  DefaultConstructorTest();
+};
+
+DefaultConstructorTest::DefaultConstructorTest() = default;
+
+void fDefaultConstructorTest() {
+  DefaultConstructorTest(); // expected-warning{{1 uninitialized field}}
+}
+#else
+class DefaultConstructorTest {
+  int a;
+
+public:
+  DefaultConstructorTest();
+};
+
+DefaultConstructorTest::DefaultConstructorTest() = default;
+
+void fDefaultConstructorTest() {
+  DefaultConstructorTest();
+}
+#endif // PEDANTIC
+
+//===----------------------------------------------------------------------===//
+// Initializer list test.
+//===----------------------------------------------------------------------===//
+
+class InitListTest1 {
+  int a;
+  int b;
+
+public:
+  InitListTest1()
+      : a(1),
+        b(2) {
+    // All good!
+  }
+};
+
+void fInitListTest1() {
+  InitListTest1();
+}
+
+class InitListTest2 {
+  int a;
+  int b; // expected-note{{uninitialized field 'this->b'}}
+
+public:
+  InitListTest2()
+      : a(3) {} // expected-warning{{1 uninitialized field}}
+};
+
+void fInitListTest2() {
+  InitListTest2();
+}
+
+class InitListTest3 {
+  int a; // expected-note{{uninitialized field 'this->a'}}
+  int b;
+
+public:
+  InitListTest3()
+      : b(4) {} // expected-warning{{1 uninitialized field}}
+};
+
+void fInitListTest3() {
+  InitListTest3();
+}
+
+//===----------------------------------------------------------------------===//
+// Constructor body test.
+//===----------------------------------------------------------------------===//
+
+class CtorBodyTest1 {
+  int a, b;
+
+public:
+  CtorBodyTest1() {
+    a = 5;
+    b = 6;
+    // All good!
+  }
+};
+
+void fCtorBodyTest1() {
+  CtorBodyTest1();
+}
+
+class CtorBodyTest2 {
+  int a;
+  int b; // expected-note{{uninitialized field 'this->b'}}
+
+public:
+  CtorBodyTest2() {
+    a = 7; // expected-warning{{1 uninitialized field}}
+  }
+};
+
+void fCtorBodyTest2() {
+  CtorBodyTest2();
+}
+
+class CtorBodyTest3 {
+  int a; // expected-note{{uninitialized field 'this->a'}}
+  int b;
+
+public:
+  CtorBodyTest3() {
+    b = 8; // expected-warning{{1 uninitialized field}}
+  }
+};
+
+void fCtorBodyTest3() {
+  CtorBodyTest3();
+}
+
+#ifdef PEDANTIC
+class CtorBodyTest4 {
+  int a; // expected-note{{uninitialized field 'this->a'}}
+  int b; // expected-note{{uninitialized field 'this->b'}}
+
+public:
+  CtorBodyTest4() {}
+};
+
+void fCtorBodyTest4() {
+  CtorBodyTest4(); // expected-warning{{2 uninitialized fields}}
+}
+#else
+class CtorBodyTest4 {
+  int a;
+  int b;
+
+public:
+  CtorBodyTest4() {}
+};
+
+void fCtorBodyTest4() {
+  CtorBodyTest4();
+}
+#endif
+
+//===----------------------------------------------------------------------===//
+// Constructor delegation test.
+//===----------------------------------------------------------------------===//
+
+class CtorDelegationTest1 {
+  int a;
+  int b;
+
+public:
+  CtorDelegationTest1(int)
+      : a(9) {
+    // leaves 'b' unintialized, but we'll never check this function
+  }
+
+  CtorDelegationTest1()
+      : CtorDelegationTest1(int{}) { // Initializing 'a'
+    b = 10;
+    // All good!
+  }
+};
+
+void fCtorDelegationTest1() {
+  CtorDelegationTest1();
+}
+
+class CtorDelegationTest2 {
+  int a; // expected-note{{uninitialized field 'this->a'}}
+  int b;
+
+public:
+  CtorDelegationTest2(int)
+      : b(11) {
+    // leaves 'a' unintialized, but we'll never check this function
+  }
+
+  CtorDelegationTest2()
+      : CtorDelegationTest2(int{}) { // expected-warning{{1 uninitialized field}}
+  }
+};
+
+void fCtorDelegationTest2() {
+  CtorDelegationTest2();
+}
+
+//===----------------------------------------------------------------------===//
+// Tests for classes containing records.
+//===----------------------------------------------------------------------===//
+
+class ContainsRecordTest1 {
+  struct RecordType {
+    int x;
+    int y;
+  } rec;
+  int c, d;
+
+public:
+  ContainsRecordTest1()
+      : rec({12, 13}),
+        c(14),
+        d(15) {
+    // All good!
+  }
+};
+
+void fContainsRecordTest1() {
+  ContainsRecordTest1();
+}
+
+class ContainsRecordTest2 {
+  struct RecordType {
+    int x;
+    int y; // expected-note{{uninitialized field 'this->rec.y'}}
+  } rec;
+  int c, d;
+
+public:
+  ContainsRecordTest2()
+      : c(16),
+        d(17) {
+    rec.x = 18; // expected-warning{{1 uninitialized field}}
+  }
+};
+
+void fContainsRecordTest2() {
+  ContainsRecordTest2();
+}
+
+class ContainsRecordTest3 {
+  struct RecordType {
+    int x; // expected-note{{uninitialized field 'this->rec.x'}}
+    int y; // expected-note{{uninitialized field 'this->rec.y'}}
+  } rec;
+  int c, d;
+
+public:
+  ContainsRecordTest3()
+      : c(19),
+        d(20) { // expected-warning{{2 uninitialized fields}}
+  }
+};
+
+void fContainsRecordTest3() {
+  ContainsRecordTest3();
+}
+
+class ContainsRecordTest4 {
+  struct RecordType {
+    int x; // expected-note{{uninitialized field 'this->rec.x'}}
+    int y; // expected-note{{uninitialized field 'this->rec.y'}}
+  } rec;
+  int c, d; // expected-note{{uninitialized field 'this->d'}}
+
+public:
+  ContainsRecordTest4()
+      : c(19) { // expected-warning{{3 uninitialized fields}}
+  }
+};
+
+void fContainsRecordTest4() {
+  ContainsRecordTest4();
+}
+
+//===----------------------------------------------------------------------===//
+// Tests for template classes.
+//===----------------------------------------------------------------------===//
+
+template <class T>
+class IntTemplateClassTest1 {
+  T t;
+  int b;
+
+public:
+  IntTemplateClassTest1(T i) {
+    b = 21;
+    t = i;
+    // All good!
+  }
+};
+
+void fIntTemplateClassTest1() {
+  IntTemplateClassTest1<int>(22);
+}
+
+template <class T>
+class IntTemplateClassTest2 {
+  T t; // expected-note{{uninitialized field 'this->t'}}
+  int b;
+
+public:
+  IntTemplateClassTest2() {
+    b = 23; // expected-warning{{1 uninitialized field}}
+  }
+};
+
+void fIntTemplateClassTest2() {
+  IntTemplateClassTest2<int>();
+}
+
+struct Record {
+  int x; // expected-note{{uninitialized field 'this->t.x'}}
+  int y; // expected-note{{uninitialized field 'this->t.y'}}
+};
+
+template <class T>
+class RecordTemplateClassTest {
+  T t;
+  int b;
+
+public:
+  RecordTemplateClassTest() {
+    b = 24; // expected-warning{{2 uninitialized fields}}
+  }
+};
+
+void fRecordTemplateClassTest() {
+  RecordTemplateClassTest<Record>();
+}
+
+//===----------------------------------------------------------------------===//
+// Tests involving functions with unknown implementations.
+//===----------------------------------------------------------------------===//
+
+template <class T>
+void mayInitialize(T &);
+
+template <class T>
+void wontInitialize(const T &);
+
+class PassingToUnknownFunctionTest1 {
+  int a, b;
+
+public:
+  PassingToUnknownFunctionTest1() {
+    mayInitialize(a);
+    mayInitialize(b);
+    // All good!
+  }
+
+  PassingToUnknownFunctionTest1(int) {
+    mayInitialize(a);
+    // All good!
+  }
+
+  PassingToUnknownFunctionTest1(int, int) {
+    mayInitialize(*this);
+    // All good!
+  }
+};
+
+void fPassingToUnknownFunctionTest1() {
+  PassingToUnknownFunctionTest1();
+  PassingToUnknownFunctionTest1(int());
+  PassingToUnknownFunctionTest1(int(), int());
+}
+
+class PassingToUnknownFunctionTest2 {
+  int a; // expected-note{{uninitialized field 'this->a'}}
+  int b;
+
+public:
+  PassingToUnknownFunctionTest2() {
+    wontInitialize(a);
+    b = 4; // expected-warning{{1 uninitialized field}}
+  }
+};
+
+void fPassingToUnknownFunctionTest2() {
+  PassingToUnknownFunctionTest2();
+}
+
+//===----------------------------------------------------------------------===//
+// Tests for classes containing unions.
+//===----------------------------------------------------------------------===//
+
+// FIXME: As of writing this checker, there is no good support for union types
+// in the Static Analyzer. Here is non-exhaustive list of cases.
+// Note that the rules for unions are different in C and C++.
+// http://lists.llvm.org/pipermail/cfe-dev/2017-March/052910.html
+
+class ContainsSimpleUnionTest1 {
+  union SimpleUnion {
+    float uf;
+    int ui;
+    char uc;
+  } u;
+
+public:
+  ContainsSimpleUnionTest1() {
+    u.uf = 3.14;
+    // All good!
+  }
+};
+
+void fContainsSimpleUnionTest1() {
+  ContainsSimpleUnionTest1();
+}
+
+class ContainsSimpleUnionTest2 {
+  union SimpleUnion {
+    float uf;
+    int ui;
+    char uc;
+    // TODO: we'd expect the note: {{uninitialized field 'this->u'}}
+  } u; // no-note
+
+public:
+  ContainsSimpleUnionTest2() {}
+};
+
+void fContainsSimpleUnionTest2() {
+  // TODO: we'd expect the warning: {{1 uninitialized field}}
+  ContainsSimpleUnionTest2(); // no-warning
+}
+
+class UnionPointerTest1 {
+public:
+  union SimpleUnion {
+    float uf;
+    int ui;
+    char uc;
+  };
+
+private:
+  SimpleUnion *uptr;
+
+public:
+  UnionPointerTest1(SimpleUnion *uptr, int) : uptr(uptr) {
+    // All good!
+  }
+};
+
+void fUnionPointerTest1() {
+  UnionPointerTest1::SimpleUnion u;
+  u.uf = 41;
+  UnionPointerTest1(&u, int());
+}
+
+class UnionPointerTest2 {
+public:
+  union SimpleUnion {
+    float uf;
+    int ui;
+    char uc;
+  };
+
+private:
+  // TODO: we'd expect the note: {{uninitialized field 'this->uptr'}}
+  SimpleUnion *uptr; // no-note
+
+public:
+  UnionPointerTest2(SimpleUnion *uptr, char) : uptr(uptr) {}
+};
+
+void fUnionPointerTest2() {
+  UnionPointerTest2::SimpleUnion u;
+  // TODO: we'd expect the warning: {{1 uninitialized field}}
+  UnionPointerTest2(&u, int()); // no-warning
+}
+
+class ContainsUnionWithRecordTest1 {
+  union UnionWithRecord {
+    struct RecordType {
+      int x;
+      int y;
+    } us;
+    double ud;
+    long ul;
+
+    UnionWithRecord(){};
+  } u;
+
+public:
+  ContainsUnionWithRecordTest1() {
+    u.ud = 3.14;
+    // All good!
+  }
+};
+
+void fContainsUnionWithRecordTest1() {
+  ContainsUnionWithRecordTest1();
+}
+
+class ContainsUnionWithRecordTest2 {
+  union UnionWithRecord {
+    struct RecordType {
+      int x;
+      int y;
+    } us;
+    double ud;
+    long ul;
+
+    UnionWithRecord(){};
+  } u;
+
+public:
+  ContainsUnionWithRecordTest2() {
+    u.us = UnionWithRecord::RecordType{42, 43};
+    // All good!
+  }
+};
+
+void fContainsUnionWithRecordTest2() {
+  ContainsUnionWithRecordTest1();
+}
+
+class ContainsUnionWithRecordTest3 {
+  union UnionWithRecord {
+    struct RecordType {
+      int x;
+      int y;
+    } us;
+    double ud;
+    long ul;
+
+    UnionWithRecord(){};
+    // TODO: we'd expect the note: {{uninitialized field 'this->u'}}
+  } u; // no-note
+
+public:
+  ContainsUnionWithRecordTest3() {
+    UnionWithRecord::RecordType rec;
+    rec.x = 44;
+    // TODO: we'd expect the warning: {{1 uninitialized field}}
+    u.us = rec; // no-warning
+  }
+};
+
+void fContainsUnionWithRecordTest3() {
+  ContainsUnionWithRecordTest3();
+}
+
+class ContainsUnionWithSimpleUnionTest1 {
+  union UnionWithSimpleUnion {
+    union SimpleUnion {
+      float uf;
+      int ui;
+      char uc;
+    } usu;
+    long ul;
+    unsigned uu;
+  } u;
+
+public:
+  ContainsUnionWithSimpleUnionTest1() {
+    u.usu.ui = 5;
+    // All good!
+  }
+};
+
+void fContainsUnionWithSimpleUnionTest1() {
+  ContainsUnionWithSimpleUnionTest1();
+}
+
+class ContainsUnionWithSimpleUnionTest2 {
+  union UnionWithSimpleUnion {
+    union SimpleUnion {
+      float uf;
+      int ui;
+      char uc;
+    } usu;
+    long ul;
+    unsigned uu;
+    // TODO: we'd expect the note: {{uninitialized field 'this->u'}}
+  } u; // no-note
+
+public:
+  ContainsUnionWithSimpleUnionTest2() {}
+};
+
+void fContainsUnionWithSimpleUnionTest2() {
+  // TODO: we'd expect the warning: {{1 uninitialized field}}
+  ContainsUnionWithSimpleUnionTest2(); // no-warning
+}
+
+//===----------------------------------------------------------------------===//
+// Zero initialization tests.
+//===----------------------------------------------------------------------===//
+
+struct GlobalVariableTest {
+  int i;
+
+  GlobalVariableTest() {}
+};
+
+GlobalVariableTest gvt; // no-warning
+
+//===----------------------------------------------------------------------===//
+// Copy and move constructor tests.
+//===----------------------------------------------------------------------===//
+
+template <class T>
+void funcToSquelchCompilerWarnings(const T &t);
+
+#ifdef PEDANTIC
+struct CopyConstructorTest {
+  int i; // expected-note{{uninitialized field 'this->i'}}
+
+  CopyConstructorTest() : i(1337) {}
+  CopyConstructorTest(const CopyConstructorTest &other) {}
+};
+
+void fCopyConstructorTest() {
+  CopyConstructorTest cct;
+  CopyConstructorTest copy = cct; // expected-warning{{1 uninitialized field}}
+  funcToSquelchCompilerWarnings(copy);
+}
+#else
+struct CopyConstructorTest {
+  int i;
+
+  CopyConstructorTest() : i(1337) {}
+  CopyConstructorTest(const CopyConstructorTest &other) {}
+};
+
+void fCopyConstructorTest() {
+  CopyConstructorTest cct;
+  CopyConstructorTest copy = cct;
+  funcToSquelchCompilerWarnings(copy);
+}
+#endif // PEDANTIC
+
+struct MoveConstructorTest {
+  // TODO: we'd expect the note: {{uninitialized field 'this->i'}}
+  int i; // no-note
+
+  MoveConstructorTest() : i(1337) {}
+  MoveConstructorTest(const CopyConstructorTest &other) = delete;
+  MoveConstructorTest(const CopyConstructorTest &&other) {}
+};
+
+void fMoveConstructorTest() {
+  MoveConstructorTest cct;
+  // TODO: we'd expect the warning: {{1 uninitialized field}}
+  MoveConstructorTest copy(static_cast<MoveConstructorTest &&>(cct)); // no-warning
+  funcToSquelchCompilerWarnings(copy);
+}
+
+//===----------------------------------------------------------------------===//
+// Array tests.
+//===----------------------------------------------------------------------===//
+
+struct IntArrayTest {
+  int arr[256];
+
+  IntArrayTest() {
+    // All good!
+  }
+};
+
+void fIntArrayTest() {
+  IntArrayTest();
+}
+
+struct RecordTypeArrayTest {
+  struct RecordType {
+    int x, y;
+  } arr[256];
+
+  RecordTypeArrayTest() {
+    // All good!
+  }
+};
+
+void fRecordTypeArrayTest() {
+  RecordTypeArrayTest();
+}
+
+template <class T>
+class CharArrayPointerTest {
+  T *t; // no-crash
+
+public:
+  CharArrayPointerTest(T *t, int) : t(t) {}
+};
+
+void fCharArrayPointerTest() {
+  char str[16] = "012345678912345";
+  CharArrayPointerTest<char[16]>(&str, int());
+}
+
+//===----------------------------------------------------------------------===//
+// Memset tests.
+//===----------------------------------------------------------------------===//
+
+struct MemsetTest1 {
+  int a, b, c;
+
+  MemsetTest1() {
+    __builtin_memset(this, 0, sizeof(decltype(*this)));
+  }
+};
+
+void fMemsetTest1() {
+  MemsetTest1();
+}
+
+struct MemsetTest2 {
+  int a;
+
+  MemsetTest2() {
+    __builtin_memset(&a, 0, sizeof(int));
+  }
+};
+
+void fMemsetTest2() {
+  MemsetTest2();
+}
+
+//===----------------------------------------------------------------------===//
+// Lambda tests.
+//===----------------------------------------------------------------------===//
+
+template <class Callable>
+struct LambdaTest1 {
+  Callable functor;
+
+  LambdaTest1(const Callable &functor, int) : functor(functor) {
+    // All good!
+  }
+};
+
+void fLambdaTest1() {
+  auto isEven = [](int a) { return a % 2 == 0; };
+  LambdaTest1<decltype(isEven)>(isEven, int());
+}
+
+#ifdef PEDANTIC
+template <class Callable>
+struct LambdaTest2 {
+  Callable functor;
+
+  LambdaTest2(const Callable &functor, int) : functor(functor) {} // expected-warning{{1 uninitialized field}}
+};
+
+void fLambdaTest2() {
+  int b;
+  auto equals = [&b](int a) { return a == b; }; // expected-note{{uninitialized field 'this->functor.'}}
+  LambdaTest2<decltype(equals)>(equals, int());
+}
+#else
+template <class Callable>
+struct LambdaTest2 {
+  Callable functor;
+
+  LambdaTest2(const Callable &functor, int) : functor(functor) {}
+};
+
+void fLambdaTest2() {
+  int b;
+  auto equals = [&b](int a) { return a == b; };
+  LambdaTest2<decltype(equals)>(equals, int());
+}
+#endif //PEDANTIC
+
+#ifdef PEDANTIC
+namespace LT3Detail {
+
+struct RecordType {
+  int x; // expected-note{{uninitialized field 'this->functor..x'}}
+  int y; // expected-note{{uninitialized field 'this->functor..y'}}
+};
+
+} // namespace LT3Detail
+template <class Callable>
+struct LambdaTest3 {
+  Callable functor;
+
+  LambdaTest3(const Callable &functor, int) : functor(functor) {} // expected-warning{{2 uninitialized fields}}
+};
+
+void fLambdaTest3() {
+  LT3Detail::RecordType rec1;
+  auto equals = [&rec1](LT3Detail::RecordType rec2) {
+    return rec1.x == rec2.x;
+  };
+  LambdaTest3<decltype(equals)>(equals, int());
+}
+#else
+namespace LT3Detail {
+
+struct RecordType {
+  int x;
+  int y;
+};
+
+} // namespace LT3Detail
+template <class Callable>
+struct LambdaTest3 {
+  Callable functor;
+
+  LambdaTest3(const Callable &functor, int) : functor(functor) {}
+};
+
+void fLambdaTest3() {
+  LT3Detail::RecordType rec1;
+  auto equals = [&rec1](LT3Detail::RecordType rec2) {
+    return rec1.x == rec2.x;
+  };
+  LambdaTest3<decltype(equals)>(equals, int());
+}
+#endif //PEDANTIC
+
+//===----------------------------------------------------------------------===//
+// System header tests.
+//===----------------------------------------------------------------------===//
+
+#include "Inputs/system-header-simulator-for-cxx-uninitialized-object.h"
+
+struct SystemHeaderTest1 {
+  RecordInSystemHeader rec; // defined in the system header simulator
+
+  SystemHeaderTest1() {
+    // All good!
+  }
+};
+
+void fSystemHeaderTest1() {
+  SystemHeaderTest1();
+}
+
+#ifdef PEDANTIC
+struct SystemHeaderTest2 {
+  struct RecordType {
+    int x; // expected-note{{uninitialized field 'this->container.t.x}}
+    int y; // expected-note{{uninitialized field 'this->container.t.y}}
+  };
+  ContainerInSystemHeader<RecordType> container;
+
+  SystemHeaderTest2(RecordType &rec, int) : container(rec) {} // expected-warning{{2 uninitialized fields}}
+};
+
+void fSystemHeaderTest2() {
+  SystemHeaderTest2::RecordType rec;
+  SystemHeaderTest2(rec, int());
+}
+#else
+struct SystemHeaderTest2 {
+  struct RecordType {
+    int x;
+    int y;
+  };
+  ContainerInSystemHeader<RecordType> container;
+
+  SystemHeaderTest2(RecordType &rec, int) : container(rec) {}
+};
+
+void fSystemHeaderTest2() {
+  SystemHeaderTest2::RecordType rec;
+  SystemHeaderTest2(rec, int());
+}
+#endif //PEDANTIC
+
+//===----------------------------------------------------------------------===//
+// Incomplete type tests.
+//===----------------------------------------------------------------------===//
+
+struct IncompleteTypeTest1 {
+  struct RecordType;
+  // no-crash
+  RecordType *recptr; // expected-note{{uninitialized pointer 'this->recptr}}
+  int dontGetFilteredByNonPedanticMode = 0;
+
+  IncompleteTypeTest1() {} // expected-warning{{1 uninitialized field}}
+};
+
+void fIncompleteTypeTest1() {
+  IncompleteTypeTest1();
+}
+
+struct IncompleteTypeTest2 {
+  struct RecordType;
+  RecordType *recptr; // no-crash
+  int dontGetFilteredByNonPedanticMode = 0;
+
+  RecordType *recordTypeFactory();
+
+  IncompleteTypeTest2() : recptr(recordTypeFactory()) {}
+};
+
+void fIncompleteTypeTest2() {
+  IncompleteTypeTest2();
+}
+
+struct IncompleteTypeTest3 {
+  struct RecordType;
+  RecordType &recref; // no-crash
+  int dontGetFilteredByNonPedanticMode = 0;
+
+  RecordType &recordTypeFactory();
+
+  IncompleteTypeTest3() : recref(recordTypeFactory()) {}
+};
+
+void fIncompleteTypeTest3() {
+  IncompleteTypeTest3();
+}
+
+//===----------------------------------------------------------------------===//
+// Builtin type or enumeration type related tests.
+//===----------------------------------------------------------------------===//
+
+struct IntegralTypeTest {
+  int a; // expected-note{{uninitialized field 'this->a'}}
+  int dontGetFilteredByNonPedanticMode = 0;
+
+  IntegralTypeTest() {} // expected-warning{{1 uninitialized field}}
+};
+
+void fIntegralTypeTest() {
+  IntegralTypeTest();
+}
+
+struct FloatingTypeTest {
+  float a; // expected-note{{uninitialized field 'this->a'}}
+  int dontGetFilteredByNonPedanticMode = 0;
+
+  FloatingTypeTest() {} // expected-warning{{1 uninitialized field}}
+};
+
+void fFloatingTypeTest() {
+  FloatingTypeTest();
+}
+
+struct NullptrTypeTypeTest {
+  decltype(nullptr) a; // expected-note{{uninitialized field 'this->a'}}
+  int dontGetFilteredByNonPedanticMode = 0;
+
+  NullptrTypeTypeTest() {} // expected-warning{{1 uninitialized field}}
+};
+
+void fNullptrTypeTypeTest() {
+  NullptrTypeTypeTest();
+}
+
+struct EnumTest {
+  enum Enum {
+    A,
+    B
+  } enum1; // expected-note{{uninitialized field 'this->enum1'}}
+  enum class Enum2 {
+    A,
+    B
+  } enum2; // expected-note{{uninitialized field 'this->enum2'}}
+  int dontGetFilteredByNonPedanticMode = 0;
+
+  EnumTest() {} // expected-warning{{2 uninitialized fields}}
+};
+
+void fEnumTest() {
+  EnumTest();
+}
+
+//===----------------------------------------------------------------------===//
+// Tests for constructor calls within another cunstructor, without the two
+// records being in any relation.
+//===----------------------------------------------------------------------===//
+
+void halt() __attribute__((__noreturn__));
+void assert(int b) {
+  if (!b)
+    halt();
+}
+
+// While a singleton would make more sense as a static variable, that would zero
+// initialize all of its fields, hence the not too practical implementation.
+struct Singleton {
+  // TODO: we'd expect the note: {{uninitialized field 'this->i'}}
+  int i; // no-note
+
+  Singleton() {
+    assert(!isInstantiated);
+    // TODO: we'd expect the warning: {{1 uninitialized field}}
+    isInstantiated = true; // no-warning
+  }
+
+  ~Singleton() {
+    isInstantiated = false;
+  }
+
+  static bool isInstantiated;
+};
+
+bool Singleton::isInstantiated = false;
+
+struct SingletonTest {
+  int dontGetFilteredByNonPedanticMode = 0;
+
+  SingletonTest() {
+    Singleton();
+  }
+};
+
+void fSingletonTest() {
+  SingletonTest();
+}
+
+//===----------------------------------------------------------------------===//
+// C++11 member initializer tests.
+//===----------------------------------------------------------------------===//
+
+struct CXX11MemberInitTest1 {
+  int a = 3;
+  int b;
+  CXX11MemberInitTest1() : b(2) {
+    // All good!
+  }
+};
+
+void fCXX11MemberInitTest1() {
+  CXX11MemberInitTest1();
+}
+
+struct CXX11MemberInitTest2 {
+  struct RecordType {
+    // TODO: we'd expect the note: {{uninitialized field 'this->rec.a'}}
+    int a; // no-note
+    // TODO: we'd expect the note: {{uninitialized field 'this->rec.b'}}
+    int b; // no-note
+
+    RecordType(int) {}
+  };
+
+  RecordType rec = RecordType(int());
+  int dontGetFilteredByNonPedanticMode = 0;
+
+  CXX11MemberInitTest2() {}
+};
+
+void fCXX11MemberInitTest2() {
+  // TODO: we'd expect the warning: {{2 uninitializeds field}}
+  CXX11MemberInitTest2(); // no-warning
+}