[LLVMbugs] [Bug 16629] New: Static analyzer fails to detect pointer escape

[bugzilla-daemon at llvm.org]

http://llvm.org/bugs/show_bug.cgi?id=16629

            Bug ID: 16629
           Summary: Static analyzer fails to detect pointer escape
           Product: clang
           Version: trunk
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P
         Component: Static Analyzer
          Assignee: kremenek at apple.com
          Reporter: labath at google.com
                CC: klimek at google.com, llvmbugs at cs.uiuc.edu
    Classification: Unclassified

$ cat a.cc
struct A {
  explicit A(int* p) : p_(p) {}
  int* p_;
};

void escape(const A*[]);
void foo(int);

void f(const A& a) {
  const A* args[] = { &a };
  escape(args); // pointer to x escapes here
}

void g() {
  int x;
  f(A(&x));
  foo(x); // "uninitialized" warning should not be reported
}
$ clang --analyze a.cc
a.cc:17:3: warning: Function call argument is an uninitialized value
  foo(x); // "uninitialized" warning should not be reported
  ^~~~~~
1 warning generated.
--------
When analyzing the code above, the static analyzer fails to detect the escape
of the pointer to local variable x. Therefore, it thinks the variable is still
uninitialized and reports the false warning.

My investigation yielded a couple of interesting remarks:
- if I use a local variable of type A instead of a temporary as a parameter to
f, the warning goes away.
- if I do escape(a) in f, the warning also goes away.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20130715/92ba2012/attachment.html>