================
@@ -294,6 +295,51 @@ static bool CanElideOverflowCheck(ASTContext &Ctx, const
BinOpInfo &Op) {
(2 * Ctx.getTypeSize(RHSTy)) < PromotedSize;
}
+/// Walks a C function body once, collecting local scalar VarDecls that are
+/// never assigned and never have their address taken. These are candidates
+/// for MSan's local uninitialized-read check (ISO C 6.3.2.1p2 indeterminate
+/// value; the "address never taken" gate is spec-correct since DR338/C11,
+/// not C23-specific). Scoped to C only — C++ lambdas, captures, and
+/// aggregates are out of scope.
+class UninitLocalVarVisitor
+ : public RecursiveASTVisitor<UninitLocalVarVisitor> {
+ llvm::DenseMap<const VarDecl *, bool> &Candidates;
+
+public:
+ UninitLocalVarVisitor(llvm::DenseMap<const VarDecl *, bool> &Candidates)
+ : Candidates(Candidates) {}
+
+ bool VisitVarDecl(VarDecl *VD) {
+ if (VD->isLocalVarDecl() && !VD->isStaticLocal() && !VD->hasInit() &&
+ VD->getType()->isScalarType())
+ Candidates[VD] = true;
+ return true;
+ }
+
+ // Deliberately no VisitBinaryOperator override to erase candidates on
+ // assignment. Under MSan, attaching the check to more loads is safe:
+ // if a path actually initializes the variable, MSan's own shadow
+ // tracking (genuinely path-sensitive at runtime, via phi-node shadow
+ // merging) reflects that and the check silently passes. Erasing on
+ // any assignment, anywhere in the function, made sense for the prior
+ // UBSan-based design (an unconditional trap with no runtime awareness
+ // of which path was taken) but is unnecessarily conservative here --
+ // it would produce false negatives on variables that are correctly
+ // initialized on some paths and read uninitialized on others.
+ // Verified empirically: no regressions on check-msan/check-ubsan, and
+ // confirmed correct runtime behavior on both branches of a genuinely
+ // conditional assignment (warns on the uninitialized path, silent on
+ // the initialized one).
----------------
MaskRay wrote:
Describe the final state of the change — the process of getting there is often
useless.
This is pretty typical AI slop. I would encourage a sanitizer maintainer to
take over of this patch, instead of wasting time on reviews.
https://github.com/llvm/llvm-project/pull/207529
_______________________________________________
cfe-commits mailing list
[email protected]
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
