This is an archive of the discontinued LLVM Phabricator instance.

[analyzer] Improve tracing for uninitialized struct fields
ClosedPublic

Authored by george.karpenkov on Aug 27 2018, 2:18 PM.

Diff Detail

Repository
rC Clang

Event Timeline

NoQ added inline comments.Aug 27 2018, 2:31 PM
clang/test/Analysis/uninit-vals-ps-region.m
51–66 ↗(On Diff #162747)

Am i understanding correctly that only these two notes are new? I.e., we track the structure to its definition.

I guess it might be useful, but it's not super useful, because it's always obvious anyway where the structure is declared. The actually interesting thing to do would be to track the structure as it's being copied (or, well, moved) from one region to another, eg. partially-initialized within a function and then returned from that function by value. And i guess that it requires more sophisticated tracking.

With the newly added tracking, do we also find places where a C++ method call mutates the structure? If it does, let's add a test. It's easier because the structure's region doesn't change. I guess this may be useful when the structure is uninitialized after construction and then partially initialized by a method call. I suspect that tracking this back to the constructor that fails to initialize the structure would still require more effort.

NoQ added a comment.Aug 29 2018, 12:04 PM

Eg., let's test something like this, in both C and C++:

struct Point {
  int x, y;
};

struct Point getHalfPoint() {
  struct Point p; // Track the undef value to explain that 'y' is uninitialized here.
  p.x = 0;
  return p;
}

void use(struct Point p); 

void test1() {
  struct Point p = getHalfPoint();
  use(p); // Use of partially initialized value.
}

void test2() {
  struct Point p;
  p = getHalfPoint();
  use(p); // Use of partially initialized value.
}
NoQ accepted this revision.Aug 29 2018, 3:31 PM

The code looks great.

This revision is now accepted and ready to land.Aug 29 2018, 3:31 PM
This revision was automatically updated to reflect the committed changes.
lib/StaticAnalyzer/Checkers/CallAndMessageChecker.cpp