Fix initialization through singleton owned arrow writes

Author: KiritoYG

lib/astutils.cpp

@@ -3512,6 +3512,88 @@ bool isLeafDot(const Token* tok)
     return isLeafDot(parent);
 }
 
+static const Variable* singlePlainDataMember(const Scope* scope)
+{
+    if (!scope || (scope->type != ScopeType::eStruct && scope->type != ScopeType::eClass) ||
+        !scope->definedType || !scope->definedType->derivedFrom.empty() || scope->numConstructors != 0)
+        return nullptr;
+    if (std::any_of(scope->functionList.cbegin(), scope->functionList.cend(), [](const Function& function) {
+        return function.hasVirtualSpecifier() || function.hasOverrideSpecifier();
+    }))
+        return nullptr;
+    if (std::any_of(scope->nestedList.cbegin(), scope->nestedList.cend(), [](const Scope* nested) {
+        return nested->type == ScopeType::eUnion;
+    }))
+        return nullptr;
+    const Variable* member = nullptr;
+    for (const Variable& var : scope->varlist) {
+        if (var.isStatic())
+            continue;
+        if (member || !var.isPublic() || var.isArray() || var.isPointer() || var.isReference() ||
+            var.isRValueReference() || var.isVolatile() || var.hasDefault())
+            return nullptr;
+        member = &var;
+    }
+    return member;
+}
+
+const Variable* getSingleMemberArrowWriteTarget(const Token* tok)
+{
+    if (!Token::Match(tok, ". %name%") || tok->originalName() != "->" || !tok->astOperand1())
+        return nullptr;
+    // Exclude bindings, conditional/unevaluated operands and nested writes
+    // whose evaluation order is not established by this projection.
+    const Token* operation = tok->astParent();
+    if (!operation || operation->astParent() || operation->astOperand1() != tok ||
+        (!operation->isAssignmentOp() && !Token::Match(operation, "++|--")))
+        return nullptr;
+    const Variable* receiver = tok->astOperand1()->variable();
+    if (!receiver || !receiver->isLocal() || receiver->isPointer() || receiver->isArray() || receiver->isReference() ||
+        receiver->isRValueReference() || receiver->isVolatile())
+        return nullptr;
+    // A deferred lambda body does not initialize a captured outer object.
+    for (const Scope* enclosing = tok->scope(); enclosing && enclosing != receiver->scope(); enclosing = enclosing->nestedIn) {
+        if (enclosing->type == ScopeType::eLambda || enclosing->type == ScopeType::eFunction)
+            return nullptr;
+    }
+    const Scope* scope = receiver->typeScope();
+    const Variable* member = singlePlainDataMember(scope);
+    if (!member)
+        return nullptr;
+    const Variable* leaf = singlePlainDataMember(member->typeScope());
+    if (!leaf || !leaf->valueType() || !leaf->valueType()->isPrimitive() ||
+        tok->astOperand2() != tok->next() || tok->strAt(1) != leaf->name() ||
+        (tok->next()->variable() && tok->next()->variable() != leaf))
+        return nullptr;
+
+    const auto operators = scope->functionMap.equal_range("operator->");
+    if (operators.first == operators.second)
+        return nullptr;
+    for (auto it = operators.first; it != operators.second; ++it) {
+        const Function* function = it->second;
+        if (!function->functionScope || !Function::returnsPointer(function) ||
+            function->retType != member->type() || function->argCount() != 0 || function->isVolatile())
+            return nullptr;
+        const Token* body = function->functionScope->bodyStart;
+        if (!Token::simpleMatch(body, "{ return &") || !body->tokAt(2)->isUnaryOp("&"))
+            return nullptr;
+        const Token* memberToken = body->tokAt(3);
+        if (Token::simpleMatch(memberToken, "this ."))
+            memberToken = memberToken->tokAt(2);
+        if (!Token::Match(memberToken, "%var% ; }") || memberToken->variable() != member ||
+            memberToken->tokAt(2) != function->functionScope->bodyEnd)
+            return nullptr;
+    }
+
+    // A member, free or friend operator& can change the returned address.
+    // Keep the proof independent of overload resolution for address-of.
+    if (std::any_of(scope->symdb.scopeList.cbegin(), scope->symdb.scopeList.cend(), [](const Scope& candidate) {
+        return candidate.functionMap.count("operator&") != 0;
+    }))
+        return nullptr;
+    return member;
+}
+
 ExprUsage getExprUsage(const Token* tok, int indirect, const Settings& settings)
 {
     const Token* parent = tok->astParent();

lib/astutils.h

@@ -439,6 +439,11 @@ bool isConstVarExpression(const Token* tok, const std::function<bool(const Token
 
 bool isLeafDot(const Token* tok);
 
+// Identify a standalone scalar write through a pure overloaded arrow when the
+// receiver's only member contains only that scalar. This is not a general alias
+// summary: reads, bindings, nested expressions and captured writes are excluded.
+const Variable* getSingleMemberArrowWriteTarget(const Token* tok);
+
 enum class ExprUsage : std::uint8_t { None, NotUsed, PassedByReference, Used, Inconclusive };
 
 ExprUsage getExprUsage(const Token* tok, int indirect, const Settings& settings);

lib/checkuninitvar.cpp

@@ -1441,6 +1441,12 @@ int CheckUninitVarImpl::isFunctionParUsage(const Token *vartok, bool pointer, Al
 
 bool CheckUninitVarImpl::isMemberVariableAssignment(const Token *tok, const std::string &membervar) const
 {
+    if (const Variable* member = getSingleMemberArrowWriteTarget(tok->astParent())) {
+        const Token* access = tok->astParent();
+        if (access->astOperand1() == tok && member->name() == membervar &&
+            Token::simpleMatch(access->astParent(), "=") && astIsLHS(access))
+            return true;
+    }
     if (Token::Match(tok, "%name% . %name%") && tok->strAt(2) == membervar) {
         if (Token::Match(tok->tokAt(3), "[=.[]"))
             return true;
@@ -1671,7 +1677,13 @@ void CheckUninitVarImpl::valueFlowUninit()
                         (tok->astParent()->next()->variable() || tok->astParent()->next()->isEnumerator()))
                         continue;
                 }
-                const ExprUsage usage = getExprUsage(tok, v->indirect, mSettings);
+                // For a proven singleton accessor, the scalar operation also
+                // describes the receiver's initialization state (including ++).
+                const Token* usageToken = tok;
+                if (v->indirect == 0 && getSingleMemberArrowWriteTarget(tok->astParent()) &&
+                    tok->astParent()->astOperand1() == tok)
+                    usageToken = tok->astParent();
+                const ExprUsage usage = getExprUsage(usageToken, v->indirect, mSettings);
                 if (usage == ExprUsage::NotUsed || usage == ExprUsage::Inconclusive)
                     continue;
                 if (!v->subexpressions.empty() && usage == ExprUsage::PassedByReference)

lib/vf_analyzers.cpp

@@ -570,6 +570,14 @@ struct ValueFlowAnalyzer : Analyzer {
 
     Action analyzeMatch(const Token* tok, Direction d) const {
         const Token* parent = tok->astParent();
+        const ValueFlow::Value* value = getValue(tok);
+        if (value && value->isUninitValue() && value->indirect == 0 &&
+            getSingleMemberArrowWriteTarget(parent) && parent->astOperand1() == tok) {
+            // The accessor only takes an address. For this singleton layout,
+            // the selected scalar and the receiver have the same init state.
+            const Token* operation = parent->astParent();
+            return operation->str() == "=" ? Action::Invalid : Action::Read | Action::Invalid;
+        }
         if (d == Direction::Reverse && isGlobal() && !dependsOnThis() && Token::Match(parent, ". %name% (")) {
             Action a = isGlobalModified(parent->next());
             if (a != Action::None)
@@ -1505,6 +1513,8 @@ struct MemberExpressionAnalyzer : SubExpressionAnalyzer {
     {
         if (!Token::Match(tok, ". %var%"))
             return false;
+        if (const Variable* member = getSingleMemberArrowWriteTarget(tok))
+            return !exact || member->name() == varname;
         if (!exact)
             return true;
         return tok->strAt(1) == varname;

test/testuninitvar.cpp

@@ -43,6 +43,13 @@ class TestUninitVar : public TestFixture {
         TEST_CASE(uninitvar_alloc);     // data is allocated but not initialized
         TEST_CASE(uninitvar_arrays);    // arrays
         TEST_CASE(uninitvar_class);     // class/struct
+        TEST_CASE(uninitvar_ownedArrow);
+        TEST_CASE(uninitvar_ownedArrowEscapes);
+        TEST_CASE(valueFlowUninit_ownedArrow);
+        TEST_CASE(valueFlowUninit_ownedArrowWrites);
+        TEST_CASE(valueFlowUninit_ownedArrowReadModify);
+        TEST_CASE(valueFlowUninit_ownedArrowReceivers);
+        TEST_CASE(valueFlowUninit_ownedArrowConditional);
         TEST_CASE(uninitvar_enum);      // enum variables
         TEST_CASE(uninitvar_if);        // handling if
         TEST_CASE(uninitvar_loops);     // handling for/while
@@ -3677,6 +3684,172 @@ class TestUninitVar : public TestFixture {
         (checkuninitvar.valueFlowUninit)();
     }
 
+    void uninitvar_ownedArrow() { // #6572
+        checkUninitVar("struct CCommitPointer { int m_place; };\n"
+                       "struct iterator {\n"
+                       "    CCommitPointer m_ptr;\n"
+                       "    CCommitPointer& operator*() { return m_ptr; }\n"
+                       "    CCommitPointer* operator->() { return &m_ptr; }\n"
+                       "    iterator& operator++() { ++m_ptr.m_place; return *this; }\n"
+                       "};\n"
+                       "iterator begin() {\n"
+                       "    iterator it;\n"
+                       "    it->m_place = 0;\n"
+                       "    return it;\n"
+                       "}\n");
+        ASSERT_EQUALS("", errout_str());
+    }
+
+    void uninitvar_ownedArrowEscapes() {
+        checkUninitVar("struct Item { int value; };\n"
+                       "struct Cursor { Item item; Item* operator->() { return &item; } };\n"
+                       "Cursor f(bool b) {\n"
+                       "    Cursor it;\n"
+                       "    b && (it->value = 1);\n"
+                       "    return it;\n"
+                       "}\n");
+        ASSERT_EQUALS("[test.cpp:6:12]: (error) Uninitialized struct member: it.item [uninitStructMember]\n", errout_str());
+
+        checkUninitVar("struct Item { int value; };\n"
+                       "struct Cursor { Item item; Item* operator->() { return &item; } };\n"
+                       "Cursor f() {\n"
+                       "    Cursor it;\n"
+                       "    (void)noexcept(it->value = 1);\n"
+                       "    return it;\n"
+                       "}\n");
+        ASSERT_EQUALS("[test.cpp:6:12]: (error) Uninitialized struct member: it.item [uninitStructMember]\n", errout_str());
+
+        checkUninitVar("struct Item { int value; };\n"
+                       "struct Cursor { Item item; Item* operator->() { return &item; } };\n"
+                       "Cursor f() {\n"
+                       "    Cursor it;\n"
+                       "    int& r = it->value;\n"
+                       "    ++r;\n"
+                       "    return it;\n"
+                       "}\n");
+        ASSERT_EQUALS("[test.cpp:7:12]: (error) Uninitialized struct member: it.item [uninitStructMember]\n", errout_str());
+
+
+    }
+
+    void valueFlowUninit_ownedArrow() { // #6572
+        valueFlowUninit("struct CCommitPointer { int m_place; };\n"
+                        "struct iterator {\n"
+                        "    CCommitPointer m_ptr;\n"
+                        "    CCommitPointer& operator*() { return m_ptr; }\n"
+                        "    CCommitPointer* operator->() { return &m_ptr; }\n"
+                        "    iterator& operator++() { ++m_ptr.m_place; return *this; }\n"
+                        "};\n"
+                        "iterator begin() {\n"
+                        "    iterator it;\n"
+                        "    it->m_place = 0;\n"
+                        "    return it;\n"
+                        "}\n");
+        ASSERT_EQUALS("", errout_str());
+    }
+
+    void valueFlowUninit_ownedArrowWrites() {
+        valueFlowUninit("struct Item { int value; };\n"
+                        "struct Cursor { Item item; Item* operator->() { return &this->item; }\n"
+                        "    const Item* operator->() const { return &item; } };\n"
+                        "int f(bool b) {\n"
+                        "    Cursor it;\n"
+                        "    if (b) it->value = 1; else it->value = 2;\n"
+                        "    it->value += 1;\n"
+                        "    return it->value;\n"
+                        "}\n");
+        ASSERT_EQUALS("", errout_str());
+    }
+
+    void valueFlowUninit_ownedArrowReadModify() {
+        valueFlowUninit("struct Item { int value; };\n"
+                        "struct Cursor { Item item; Item* operator->() { return &item; } };\n"
+                        "Cursor f() {\n"
+                        "    Cursor it;\n"
+                        "    it->value++;\n"
+                        "    return it;\n"
+                        "}\n");
+        ASSERT_EQUALS("[test.cpp:5:5]: (error) Uninitialized variable: it [uninitvar]\n", errout_str());
+
+        valueFlowUninit("struct Item { int value; };\n"
+                        "struct Cursor { Item item; Item* operator->() { return &item; } };\n"
+                        "Cursor f() {\n"
+                        "    Cursor it;\n"
+                        "    --it->value;\n"
+                        "    return it;\n"
+                        "}\n");
+        ASSERT_EQUALS("[test.cpp:5:7]: (error) Uninitialized variable: it [uninitvar]\n", errout_str());
+
+        valueFlowUninit("struct Item { int value; };\n"
+                        "struct Cursor { Item item; Item* operator->() { return &item; } };\n"
+                        "Cursor f() {\n"
+                        "    Cursor it;\n"
+                        "    it->value += 1;\n"
+                        "    return it;\n"
+                        "}\n");
+        ASSERT_EQUALS("[test.cpp:5:5]: (error) Uninitialized variable: it [uninitvar]\n", errout_str());
+    }
+
+    void valueFlowUninit_ownedArrowReceivers() {
+        valueFlowUninit("struct Item { int value; };\n"
+                        "struct Cursor { Item item; Item* operator->() { return &item; } };\n"
+                        "Cursor f() {\n"
+                        "    Cursor it;\n"
+                        "    it->value = it->value + 1;\n"
+                        "    return it;\n"
+                        "}\n");
+        ASSERT_EQUALS("[test.cpp:5:17]: (error) Uninitialized variable: it [uninitvar]\n", errout_str());
+
+        valueFlowUninit("struct Item { int value; };\n"
+                        "struct Cursor { Item item; Item* operator->() { return &item; } };\n"
+                        "Cursor f() {\n"
+                        "    Cursor first, second;\n"
+                        "    first->value = second->value;\n"
+                        "    return first;\n"
+                        "}\n");
+        ASSERT_EQUALS("[test.cpp:5:20]: (error) Uninitialized variable: second [uninitvar]\n", errout_str());
+
+        valueFlowUninit("struct Item { int value; };\n"
+                        "struct Cursor { Item item; Item* operator->() { return &item; } };\n"
+                        "Cursor f() {\n"
+                        "    Cursor first, second;\n"
+                        "    first->value = 1;\n"
+                        "    second->value = first->value;\n"
+                        "    return second;\n"
+                        "}\n");
+        ASSERT_EQUALS("", errout_str());
+    }
+
+    void valueFlowUninit_ownedArrowConditional() {
+        valueFlowUninit("struct Item { int value; };\n"
+                        "struct Cursor { Item item; Item* operator->() { return &item; } };\n"
+                        "Cursor f(bool b) {\n"
+                        "    Cursor it;\n"
+                        "    if (b) it->value = 1;\n"
+                        "    return it;\n"
+                        "}\n");
+        ASSERT_EQUALS("[test.cpp:5:9] -> [test.cpp:6:12]: (warning) Uninitialized variable: it.item [uninitvar]\n", errout_str());
+
+        valueFlowUninit("struct Item { int value; };\n"
+                        "struct Cursor { Item item; Item* operator->() { return &item; } };\n"
+                        "Cursor f() {\n"
+                        "    Cursor it;\n"
+                        "    auto l = [&it] { it->value = 1; };\n"
+                        "    return it;\n"
+                        "}\n");
+        ASSERT_EQUALS("[test.cpp:6:12]: (error) Uninitialized variable: it [uninitvar]\n", errout_str());
+
+        // Reference writes are not projected into the owning object.
+        valueFlowUninit("struct Item { int value; };\n"
+                        "struct Cursor { Item item; Item* operator->() { return &item; } };\n"
+                        "void f() {\n"
+                        "    Cursor it;\n"
+                        "    int& r = it->value;\n"
+                        "    ++r;\n"
+                        "}\n");
+        ASSERT_EQUALS("[test.cpp:5:14]: (error) Uninitialized variable: it [uninitvar]\n", errout_str());
+    }
+
     void uninitvar15() { // #13685
         const char code[] = "int f() {\n"
                             "    int x;\n"