andyames-a11y wrote: One more isolation, since I wanted to pin down exactly what's special about constructors here. Tested reading `*p` (pointer to an uninitialized local array) through several call shapes:
| Call shape | Result | |---|---| | Direct pointer deref, no function call | `UndefinedVal` — correctly flagged as uninitialized | | Plain free function taking the array by reference | Still `UndefinedVal` — correctly flagged | | Non-constructor member function taking the array by reference | Still `UndefinedVal` — correctly flagged | | **Constructor** taking the array by reference | **`LazyCompoundVal`** — precision lost | So it's specifically constructor calls, not "by-reference parameter" in general. I traced this as far as `CallEvent::invalidateRegions()` — `AnyCXXConstructorCall` pushes non-`const`-reference arguments into the invalidation list in a way regular calls don't hit once inlined — but the bulk-invalidation code that consumes that list (`InvalidateRegionsWorker` in `RegionStore.cpp`) only produces plain conjured scalars for arrays there, not `LazyCompoundVal`, so I haven't found the exact line that produces the `LazyCompoundVal` specifically. https://github.com/llvm/llvm-project/pull/210200 _______________________________________________ cfe-commits mailing list [email protected] https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
