[clang] [clang][analyzer] Add support for detecting uninitialized dynamically-allocated objects (PR #193001)

via cfe-commits cfe-commits at lists.llvm.org
Tue Apr 28 08:52:12 PDT 2026


================
@@ -451,26 +451,44 @@ static void printTail(llvm::raw_ostream &Out,
 //                           Utility functions.
 //===----------------------------------------------------------------------===//
 
+static const SubRegion *
+getConstructedSubRegion(const CXXConstructorDecl *CtorDecl,
+                        CheckerContext &Context) {
+  Loc ThisLoc =
+      Context.getSValBuilder().getCXXThis(CtorDecl, Context.getStackFrame());
+  SVal ObjectV = Context.getState()->getSVal(ThisLoc);
----------------
guillem-bartrina-sonarsource wrote:

```cpp
#include "Inputs/system-header-simulator-cxx.h"

struct Str {
  int i, j;
  Str() : i(0) {}
};

void test() {
    char *invalidPtr = reinterpret_cast<char *>(0xDEADBEEF);
    Str * s = ::new (invalidPtr) Str(); // no-crash
    (void)s;
}
```
Using the code above, `ObjectV` is `&temp_object{Str, #}`, and we get the `uninitialized field at the end of the constructor call` diagnostic. It is not an `UnknownVal`.

https://github.com/llvm/llvm-project/pull/193001


More information about the cfe-commits mailing list