https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95848
--- Comment #4 from Martin Sebor <msebor at gcc dot gnu.org> --- There's no code code to handle the last case. The first case is handled because the local s is assigned to a temporary and there is code to detect uninitialized sources of assignments. The second case is handled in the new maybe_warn_pass_by_reference() function. The third case enters the function but is excluded because the argument is passed by value and nothing else checks passing non-SSA_NAME operands. In the test case below passing the uninitialized i is diagnosed because i's an SSA_NAME. Passing s isn't because it's not one. maybe_warn_pass_by_reference() should handle this case as well (and be renamed appropriately). $ gcc -S -Wall -fdump-tree-ssa=/dev/stdout ../t.c ;; Function h (h, funcdef_no=0, decl_uid=1948, cgraph_uid=1, symbol_order=0) void h () { int i; struct S s; <bb 2> : fs (s, i_2(D)); s ={v} {CLOBBER}; return; } ../t.c: In function ‘h’: ../t.c:9:3: warning: ‘i’ is used uninitialized [-Wuninitialized] 9 | fs (s, i); | ^~~~~~~~~