[analyzer] Extend NoStoreFuncVisitor to recursively follow fields

[george.karpenkov]

Summary

It's probably worth to refactor a machinery for finding a path to a particular region from a particular region into a common subroutine.

rdar://39701823

[george.karpenkov]

clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp

391

@Szelethus the code below does pointer-chasing and tries to find a chain of regions from an input region to the region of interest.
Do you think it would make sense to extract in and share with your checker?

[NoQ]

Looks great! Marking as "requested changes" as per repeated requests from the working class.

clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp

298–303

This would need a rebase after an update to D49772.

332–339

Hmm, shouldn't we also verify that the receiver is the super-region of the region of interest, like we do in other places?

353–354

I think you should use my new function, Call->getAdjustedParameterIndex(I), that's added in D49715, because parameters and arguments aren't always in sync. Then you also don't have to check parameters explicitly.

391

+

393

Maybe let's add a TODO to warn people that we're passing vectors around quadratically?

461

Let's instead cast it to ImplicitParamDecl and check its kind, just to be sure.

617

I'm not sure i understand this comment.

[NoQ]

Looks good, apart from waiting on D49715 for getAdjustedParameterIndex().

clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp

336–339

Let's re-order the checks. The isSubRegionOf() check is cheaper.

[Szelethus]

Is something like this worth adding to the C++ test file?

struct HasRefToItself {
  HasRefToItself &Ref; // no infinite loop
  int &z;
  HasRefToItself(int &z) : Ref(*this), z(z) {}
};

Maybe a list-like struct that has a cycle?

clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp

391

Whoo, thanks for tagging me! Sadly I have little knowledge about visitors so I can't add anything meaningful to the conversation just yet, but I really like what I'm seeing in this function. I'll definitely take a look how I could incorporate this into my checker, as pointer handling is kind of a mess there.

[george.karpenkov]

Is something like this worth adding to the C++ test file?

We limit the recursion depth to 1 for fields, so it won't dereference fields more than once. It could be still worthwhile to have this test to make sure this condition does not break.

clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp

391

@Szelethus the fact that it's in the visitor is immaterial here, I'm just talking about the function findRegionOfInterestInRecord.
Basically, it tries to solve a (subset) of the problem of "whether there's a path from region A to region B".
The output should either be "no path" or a sequence of regions denoting a path.

In a broad sense, that's a breadth-first-search where possible operations are

• Dereferencing the region
• Looking for subregions
• Going through the fields
• Going through superclasses

That seems too expensive though, so here we only dereference fields twice.

393

I'll add a note. It's not an issue if our vectors are of size <= 2, and for a bigger size we'll have other problems first.

461

OK. Probably deserves a separate matcher.

[george.karpenkov]

clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp

336–339

it depends, but OK

353–354

I don't understand the semantics if the optional is empty. What then?

[NoQ]

clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp

353–354

If the optional is empty, then the argument doesn't correspond to any parameter. For example, CXXOperatorCallExpr takes this-argument as an explicit argument, but CXXMethodDecl of a member operator doesn't take it as a parameter, but treats it as an implicit parameter instead, so no valid index into parameters() can be returned.

[NoQ]

Looks good!

[NoQ]

cfe/trunk/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp

354–356 ↗

(On Diff #158679)

Uhm! I realized that i was wrong about this one. You don't need the adjustment when iterating through CallEvent arguments; you only need it when iterating through CallExpr arguments, which are also conveniently shifted against each other.

clang/lib/StaticAnalyzer/Core/BugReporterVisitors.cpp

 
 namespace {
 
 /// Put a diagnostic on return statement of all inlined functions
 /// for which  the region of interest \p RegionOfInterest was passed into,
 /// but not written inside, and it has caused an undefined read or a null
 /// pointer dereference outside.
 class NoStoreFuncVisitor final : public BugReporterVisitor {
+
   const SubRegion *RegionOfInterest;
   const SourceManager &SM;
   const PrintingPolicy &PP;
+  MemRegionManager &MmrMgr;
+
   static constexpr const char *DiagnosticsMsg =
       "Returning without writing to '";
 
+  /// Recursion limit for dereferencing fields when looking for the
+  /// region of interest.
+  static const unsigned DEREFERENCE_LIMIT = 3;
+
   /// Frames writing into \c RegionOfInterest.
   /// This visitor generates a note only if a function does not write into
   /// a region of interest. This information is not immediately available
   /// by looking at the node associated with the exit from the function
   /// (usually the return statement). To avoid recomputing the same information
   /// many times (going up the path for each node and checking whether the
   /// region was written into) we instead lazily compute the
   /// stack frames along the path which write into the region of interest.
   llvm::SmallPtrSet<const StackFrameContext *, 32> FramesModifyingRegion;
   llvm::SmallPtrSet<const StackFrameContext *, 32> FramesModifyingCalculated;
 
+  using FieldVector = SmallVector<const FieldRegion *, 5>;
+
 public:
   NoStoreFuncVisitor(const SubRegion *R, const ASTContext &Ctx,
-                     SourceManager &SM)
-      : RegionOfInterest(R), SM(SM), PP(Ctx.getPrintingPolicy()) {}
+                     SourceManager &SM,
+                     MemRegionManager &MmrMgr)
+      : RegionOfInterest(R), SM(SM), PP(Ctx.getPrintingPolicy()),
+        MmrMgr(MmrMgr) {}
 
   void Profile(llvm::FoldingSetNodeID &ID) const override {
     static int Tag = 0;
     ID.AddPointer(&Tag);
   }
 
   std::shared_ptr<PathDiagnosticPiece> VisitNode(const ExplodedNode *N,
                                                  const ExplodedNode *PrevN,
                                                  BugReporterContext &BRC,
                                                  BugReport &BR) override {
 
     const LocationContext *Ctx = N->getLocationContext();
     const StackFrameContext *SCtx = Ctx->getStackFrame();
     ProgramStateRef State = N->getState();
     auto CallExitLoc = N->getLocationAs<CallExitBegin>();
 
     // No diagnostic if region was modified inside the frame.
-    if (!CallExitLoc)
+    if (!CallExitLoc || isRegionOfInterestModifiedInFrame(N))
       return nullptr;
 
     CallEventRef<> Call =
         BRC.getStateManager().getCallEventManager().getCaller(SCtx, State);
 
+    if (SM.isInSystemHeader(Call->getDecl()->getSourceRange().getBegin())) {
+
+      // TODO: test coverage
+      return nullptr;
+    }
+
     // Region of interest corresponds to an IVar, exiting a method
     // which could have written into that IVar, but did not.
     if (const auto *MC = dyn_cast<ObjCMethodCall>(Call))
       if (const auto *IvarR = dyn_cast<ObjCIvarRegion>(RegionOfInterest))
         if (potentiallyWritesIntoIvar(Call->getRuntimeDefinition().getDecl(),
-                                      IvarR->getDecl()) &&
-            !isRegionOfInterestModifiedInFrame(N))
+                                      IvarR->getDecl()))
           return notModifiedMemberDiagnostics(
               Ctx, *CallExitLoc, Call, MC->getReceiverSVal().getAsRegion());
 
     if (const auto *CCall = dyn_cast<CXXConstructorCall>(Call)) {
       const MemRegion *ThisR = CCall->getCXXThisVal().getAsRegion();
       if (RegionOfInterest->isSubRegionOf(ThisR)
-          && !CCall->getDecl()->isImplicit()
-          && !isRegionOfInterestModifiedInFrame(N))
+          && !CCall->getDecl()->isImplicit())
         return notModifiedMemberDiagnostics(Ctx, *CallExitLoc, Call, ThisR);
+
+      // Do not generate diagnostics for not modified parameters in
+      // constructors.
+      return nullptr;
     }
 
     ArrayRef<ParmVarDecl *> parameters = getCallParameters(Call);
     for (unsigned I = 0; I < Call->getNumArgs() && I < parameters.size(); ++I) {
       const ParmVarDecl *PVD = parameters[I];
       SVal S = Call->getArgSVal(I);
       unsigned IndirectionLevel = 1;
       QualType T = PVD->getType();
       while (const MemRegion *R = S.getAsRegion()) {
-        if (RegionOfInterest->isSubRegionOf(R)
-            && !isPointerToConst(PVD->getType())) {
-
-          if (isRegionOfInterestModifiedInFrame(N))
-            return nullptr;
 
+        if (RegionOfInterest->isSubRegionOf(R) && !isPointerToConst(T))
           return notModifiedParameterDiagnostics(
               Ctx, *CallExitLoc, Call, PVD, R, IndirectionLevel);
-        }
+
         QualType PT = T->getPointeeType();
+
         if (PT.isNull() || PT->isVoidType()) break;
+
+        if (const CXXRecordDecl *RD = PT->getAsCXXRecordDecl())
+          if (auto P = findRegionOfInterestInRecord(RD, State, R))
+            return notModifiedParameterDiagnostics(Ctx, *CallExitLoc, Call, PVD,
+                                                   RegionOfInterest,
+                                                   IndirectionLevel, *P);
+
         S = State->getSVal(R, PT);
         T = PT;
+
         IndirectionLevel++;
       }
+
     }
 
     return nullptr;
   }
 
 private:
+  /// Attempts to find the region of interest in a given CXX decl,
+  /// by either following the base classes or fields.
+  /// Dereferences fields up to a given recursion limit.
+  /// \return A chain fields leading to the region of interest or None.
+  const Optional<FieldVector>
+  findRegionOfInterestInRecord(const CXXRecordDecl *RD, ProgramStateRef State,
+                               const MemRegion *R, FieldVector Vec = {},
+                               int depth = 0) {
+
+    if (depth == DEREFERENCE_LIMIT) // Limit the recursion depth.
+      return None;
+
+    if (!RD->hasDefinition())
+      return None;
+
+    for (const auto II : RD->bases()) {
+      if (const CXXRecordDecl *RRD = II.getType()->getAsCXXRecordDecl())
+        if (auto Out =
+                findRegionOfInterestInRecord(RRD, State, R, Vec, depth + 1))
+          return Out;
+    }
+
+    for (const FieldDecl *I : RD->fields()) {
+      QualType FT = I->getType();
+      const FieldRegion *FR = MmrMgr.getFieldRegion(I, cast<SubRegion>(R));
+      const SVal V = State->getSVal(FR);
+      const MemRegion *VR = V.getAsRegion();
+
+      FieldVector VecF = Vec;
+      VecF.push_back(FR);
+
+      if (RegionOfInterest == VR) {
+        return VecF;
+      }
+
+      if (const CXXRecordDecl *RRD = FT->getAsCXXRecordDecl())
+        if (auto Out =
+                findRegionOfInterestInRecord(RRD, State, FR, VecF, depth + 1))
+          return Out;
+
+      QualType PT = FT->getPointeeType();
+      if (PT.isNull() || PT->isVoidType() || !VR) continue;
+
+      if (const CXXRecordDecl *RRD = PT->getAsCXXRecordDecl())
+        if (auto Out =
+                findRegionOfInterestInRecord(RRD, State, VR, VecF, depth + 1))
+          return Out;
+
+    }
+
+    return None;
+  }
 
   /// \return Whether the method declaration \p Parent
   /// syntactically has a binary operation writing into the ivar \p Ivar.
   bool potentiallyWritesIntoIvar(const Decl *Parent,
                                  const ObjCIvarDecl *Ivar) {
     using namespace ast_matchers;
     if (!Parent)
       return false;
     StatementMatcher WriteIntoIvarM = binaryOperator(
         hasOperatorName("="), hasLHS(ignoringParenImpCasts(objcIvarRefExpr(
                                   hasDeclaration(equalsNode(Ivar))))));
     StatementMatcher ParentM = stmt(hasDescendant(WriteIntoIvarM));
     auto Matches = match(ParentM, *Parent->getBody(), Parent->getASTContext());
     return !Matches.empty();
   }
 
   /// Check and lazily calculate whether the region of interest is
   /// modified in the stack frame to which \p N belongs.
   /// The calculation is cached in FramesModifyingRegion.
   bool isRegionOfInterestModifiedInFrame(const ExplodedNode *N) {
     const LocationContext *Ctx = N->getLocationContext();
     const StackFrameContext *SCtx = Ctx->getStackFrame();
     if (!FramesModifyingCalculated.count(SCtx))
       findModifyingFrames(N);
     return FramesModifyingRegion.count(SCtx);
   }
 
 
   /// Write to \c FramesModifyingRegion all stack frames along
   /// the path in the current stack frame which modify \c RegionOfInterest.
   void findModifyingFrames(const ExplodedNode *N) {
     assert(N->getLocationAs<CallExitBegin>());
std::shared_ptr<PathDiagnosticPiece> notModifiedMemberDiagnostics(
       CallExitBegin &CallExitLoc,
       CallEventRef<> Call,
       const MemRegion *ArgRegion) {
     const char *TopRegionName = isa<ObjCMethodCall>(Call) ? "self" : "this";
     SmallString<256> sbuf;
     llvm::raw_svector_ostream os(sbuf);
     os << DiagnosticsMsg;
     bool out = prettyPrintRegionName(TopRegionName, "->", /*IsReference=*/true,
-                                     /*IndirectionLevel=*/1, ArgRegion, os, PP);
+                                     /*IndirectionLevel=*/1, ArgRegion, os);
 
     // Return nothing if we have failed to pretty-print.
     if (!out)
       return nullptr;
 
     os << "'";
     PathDiagnosticLocation L =
         getPathDiagnosticLocation(CallExitLoc.getReturnStmt(), SM, Ctx, Call);
     return std::make_shared<PathDiagnosticEventPiece>(L, os.str());
   }
 
   /// \return Diagnostics piece for the parameter \p PVD not modified
   /// in a given function.
   /// \p IndirectionLevel How many times \c ArgRegion has to be dereferenced
   /// before we get to the super region of \c RegionOfInterest
   std::shared_ptr<PathDiagnosticPiece>
   notModifiedParameterDiagnostics(const LocationContext *Ctx,
                          CallExitBegin &CallExitLoc,
                          CallEventRef<> Call,
                          const ParmVarDecl *PVD,
                          const MemRegion *ArgRegion,
-                         unsigned IndirectionLevel) {
+                         unsigned IndirectionLevel=1,
+                         FieldVector UsedFields={}) {
     PathDiagnosticLocation L = getPathDiagnosticLocation(
         CallExitLoc.getReturnStmt(), SM, Ctx, Call);
     SmallString<256> sbuf;
     llvm::raw_svector_ostream os(sbuf);
     os << DiagnosticsMsg;
     bool IsReference = PVD->getType()->isReferenceType();
     const char *Sep = IsReference && IndirectionLevel == 1 ? "." : "->";
-    bool Success = prettyPrintRegionName(
-        PVD->getQualifiedNameAsString().c_str(),
-        Sep, IsReference, IndirectionLevel, ArgRegion, os, PP);
+    bool Success =
+        prettyPrintRegionName(PVD->getQualifiedNameAsString(), Sep, IsReference,
+                              IndirectionLevel, ArgRegion, os, UsedFields);
 
     // Print the parameter name if the pretty-printing has failed.
     if (!Success)
       PVD->printQualifiedName(os);
+
     os << "'";
     return std::make_shared<PathDiagnosticEventPiece>(L, os.str());
   }
 
   /// \return a path diagnostic location for the optionally
   /// present return statement \p RS.
   PathDiagnosticLocation getPathDiagnosticLocation(const ReturnStmt *RS,
                                                    const SourceManager &SM,
                                                    const LocationContext *Ctx,
                                                    CallEventRef<> Call) {
     if (RS)
       return PathDiagnosticLocation::createBegin(RS, SM, Ctx);
     return PathDiagnosticLocation(
         Call->getRuntimeDefinition().getDecl()->getSourceRange().getEnd(), SM);
   }
 
   /// Pretty-print region \p ArgRegion starting from parent to \p os.
   /// \return whether printing has succeeded
   bool prettyPrintRegionName(StringRef TopRegionName,
                              StringRef Sep,
                              bool IsReference,
                              int IndirectionLevel,
                              const MemRegion *ArgRegion,
                              llvm::raw_svector_ostream &os,
-                             const PrintingPolicy &PP) {
+                             FieldVector Vec={}) {
     SmallVector<const MemRegion *, 5> Subregions;
     const MemRegion *R = RegionOfInterest;
     while (R != ArgRegion) {
       if (!(isa<FieldRegion>(R) || isa<CXXBaseObjectRegion>(R) ||
             isa<ObjCIvarRegion>(R)))
         return false; // Pattern-matching failed.
       Subregions.push_back(R);
       R = cast<SubRegion>(R)->getSuperRegion();
     }
     bool IndirectReference = !Subregions.empty();
 
     if (IndirectReference)
       IndirectionLevel--; // Due to "->" symbol.
 
     if (IsReference)
       IndirectionLevel--; // Due to reference semantics.
 
     bool ShouldSurround = IndirectReference && IndirectionLevel > 0;
 
     if (ShouldSurround)
       os << "(";
     for (int i = 0; i < IndirectionLevel; i++)
       os << "*";
     os << TopRegionName;
     if (ShouldSurround)
       os << ")";
 
     for (auto I = Subregions.rbegin(), E = Subregions.rend(); I != E; ++I) {
       if (const auto *FR = dyn_cast<FieldRegion>(*I)) {
         os << Sep;
         FR->getDecl()->getDeclName().print(os, PP);
         Sep = ".";
       } else if (const auto *IR = dyn_cast<ObjCIvarRegion>(*I)) {
         os << "->";
         IR->getDecl()->getDeclName().print(os, PP);
         Sep = ".";
       } else if (isa<CXXBaseObjectRegion>(*I)) {
         continue; // Just keep going up to the base region.
       } else {
         llvm_unreachable("Previous check has missed an unexpected region");
       }
     }
+
+    for (const FieldRegion *FR : Vec) {
+      os << "."; // FIXME: differentiate between '.' and '->'
+      FR->getDecl()->getDeclName().print(os, PP);
+    }
     return true;
   }
 };
 
 /// Suppress null-pointer-dereference bugs where dereferenced null was returned
 /// the macro.
 class MacroNullReturnSuppressionVisitor final : public BugReporterVisitor {
   const SubRegion *RegionOfInterest;
if (Inner && ExplodedGraph::isInterestingLValueExpr(Inner)) {
     // In case of C++ references, we want to differentiate between a null
     // reference and reference to null pointer.
     // If the LVal is null, check if we are dealing with null reference.
     // For those, we want to track the location of the reference.
     const MemRegion *R = (RR && LVIsNull) ? RR :
         LVNode->getSVal(Inner).getAsRegion();
 
     if (R) {
+      ProgramStateRef S = N->getState();
 
       // Mark both the variable region and its contents as interesting.
       SVal V = LVState->getRawSVal(loc::MemRegionVal(R));
       report.addVisitor(
           llvm::make_unique<NoStoreFuncVisitor>(
             cast<SubRegion>(R),
-            N->getState()->getStateManager().getContext(),
-            N->getState()->getAnalysisManager().getSourceManager()));
+            S->getStateManager().getContext(),
+            S->getAnalysisManager().getSourceManager(),
+            S->getStateManager().getRegionManager()));
 
       MacroNullReturnSuppressionVisitor::addMacroVisitorIfNecessary(
           N, R, EnableNullFPSuppression, report, V);
 
       report.markInteresting(R);
       report.markInteresting(V);
       report.addVisitor(llvm::make_unique<UndefOrNullArgVisitor>(R));
 

clang/test/Analysis/diagnostics/no-store-func-path-notes.cpp

void rdar40335545() {
     void (*takes_int_ptr_argument)(int *) = (void (*)(int*))has_no_argument_and_returns_null;
 
     takes_int_ptr_argument(&local); // no-crash
 
     int useLocal = local; //expected-warning{{}}
                           //expected-note@-1{{}}
     (void)useLocal;
 }
+
+////////
+
+struct HasRef {
+  int &a;
+  HasRef(int &a) : a(a) {}
+};
+
+
+void maybeInitialize(const HasRef &&pA) {
+  if (coin()) // expected-note{{Assuming the condition is false}}
+              // expected-note@-1{{Taking false branch}}
+    pA.a = 120;
+} // expected-note{{Returning without writing to 'pA.a'}}
+
+int useMaybeInitializerWritingIntoField() {
+  int z; // expected-note{{'z' declared without an initial value}}
+  maybeInitialize(HasRef(z)); // expected-note{{Calling constructor for 'HasRef'}}
+                              // expected-note@-1{{Returning from constructor for 'HasRef'}}
+                              // expected-note@-2{{Calling 'maybeInitialize'}}
+                              // expected-note@-3{{Returning from 'maybeInitialize'}}
+  return z; // expected-warning{{Undefined or garbage value returned to caller}}
+            // expected-note@-1{{Undefined or garbage value returned to caller}}
+}
+
+////////
+
+struct HasParentWithRef : public HasRef {
+  HasParentWithRef(int &a) : HasRef(a) {} // expected-note{{Calling constructor for 'HasRef'}}
+                                          // expected-note@-1{{Returning from constructor for 'HasRef'}}
+};
+
+void maybeInitializeWithParent(const HasParentWithRef &pA) {
+  if (coin()) // expected-note{{Assuming the condition is false}}
+              // expected-note@-1{{Taking false branch}}
+    pA.a = 120;
+} // expected-note{{Returning without writing to 'pA.a'}}
+
+int useMaybeInitializerWritingIntoParentField() {
+  int z; // expected-note{{'z' declared without an initial value}}
+  maybeInitializeWithParent(HasParentWithRef(z)); // expected-note{{Calling constructor for 'HasParentWithRef'}}
+                              // expected-note@-1{{Returning from constructor for 'HasParentWithRef'}}
+                              // expected-note@-2{{Calling 'maybeInitializeWithParent'}}
+                              // expected-note@-3{{Returning from 'maybeInitializeWithParent'}}
+  return z; // expected-warning{{Undefined or garbage value returned to caller}}
+            // expected-note@-1{{Undefined or garbage value returned to caller}}
+}
+
+////////
+
+struct HasIndirectRef {
+  HasRef &Ref;
+  HasIndirectRef(HasRef &Ref) : Ref(Ref) {}
+};
+
+void maybeInitializeIndirectly(const HasIndirectRef &pA) {
+  if (coin()) // expected-note{{Assuming the condition is false}}
+              // expected-note@-1{{Taking false branch}}
+    pA.Ref.a = 120;
+} // expected-note{{Returning without writing to 'pA.Ref.a'}}
+
+int useMaybeInitializeIndirectly() {
+  int z; // expected-note{{'z' declared without an initial value}}
+  HasRef r(z); // expected-note{{Calling constructor for 'HasRef'}}
+               // expected-note@-1{{Returning from constructor for 'HasRef'}}
+  maybeInitializeIndirectly(HasIndirectRef(r)); // expected-note{{Calling 'maybeInitializeIndirectly'}}
+                                                // expected-note@-1{{Returning from 'maybeInitializeIndirectly'}}
+  return z; // expected-warning{{Undefined or garbage value returned to caller}}
+            // expected-note@-1{{Undefined or garbage value returned to caller}}
+}
+
+////////
+
+struct HasIndirectRefByValue {
+  HasRef Ref;
+  HasIndirectRefByValue(HasRef Ref) : Ref(Ref) {}
+};
+
+void maybeInitializeIndirectly(const HasIndirectRefByValue &pA) {
+  if (coin()) // expected-note{{Assuming the condition is false}}
+              // expected-note@-1{{Taking false branch}}
+    pA.Ref.a = 120;
+} // expected-note{{Returning without writing to 'pA.Ref.a'}}
+
+int useMaybeInitializeIndirectlyIndirectRefByValue() {
+  int z; // expected-note{{'z' declared without an initial value}}
+  HasRef r(z); // expected-note{{Calling constructor for 'HasRef'}}
+               // expected-note@-1{{Returning from constructor for 'HasRef'}}
+  maybeInitializeIndirectly(HasIndirectRefByValue(r)); // expected-note{{Calling 'maybeInitializeIndirectly'}}
+                                                // expected-note@-1{{Returning from 'maybeInitializeIndirectly'}}
+  return z; // expected-warning{{Undefined or garbage value returned to caller}}
+            // expected-note@-1{{Undefined or garbage value returned to caller}}
+}
+
+////////
+
+struct HasIndirectPointerRef {
+  HasRef *Ref;
+  HasIndirectPointerRef(HasRef *Ref) : Ref(Ref) {}
+};
+
+void maybeInitializeIndirectly(const HasIndirectPointerRef &pA) {
+  if (coin()) // expected-note{{Assuming the condition is false}}
+              // expected-note@-1{{Taking false branch}}
+    pA.Ref->a = 120;
+} // expected-note{{Returning without writing to 'pA.Ref.a'}}
+
+int useMaybeInitializeIndirectlyWithPointer() {
+  int z; // expected-note{{'z' declared without an initial value}}
+  HasRef r(z); // expected-note{{Calling constructor for 'HasRef'}}
+               // expected-note@-1{{Returning from constructor for 'HasRef'}}
+  maybeInitializeIndirectly(HasIndirectPointerRef(&r)); // expected-note{{Calling 'maybeInitializeIndirectly'}}
+                                                // expected-note@-1{{Returning from 'maybeInitializeIndirectly'}}
+  return z; // expected-warning{{Undefined or garbage value returned to caller}}
+            // expected-note@-1{{Undefined or garbage value returned to caller}}
+}