[clang][analyzer]: fix 'UninitializedObject false positive with unnamed fields'

[YLChenZ]

Fixes #132001:

False positives generated by this issue can be avoided by skipping the check on the unnamed bitfield.

Here are my test results：

Testing Time: 49.22s

Total Discovered Tests: 990
  Unsupported      :  19 (1.92%)
  Passed           : 965 (97.47%)
  Expectedly Failed:   6 (0.61%)

[github-actions]

Thank you for submitting a Pull Request (PR) to the LLVM Project!

This PR will be automatically labeled and the relevant teams will be notified.

If you wish to, you can add reviewers by using the "Reviewers" section on this page.

If this is not working for you, it is probably because you do not have write permissions for the repository. In which case you can instead tag reviewers by name in a comment by using @ followed by their GitHub username.

If you have received no comments on your PR for a week, you can request a review by "ping"ing the PR by adding a comment “Ping”. The common courtesy "ping" rate is once a week. Please remember that you are asking for valuable time from other developers.

If you have further questions, they may be answered by the LLVM GitHub User Guide.

You can also ask questions in a comment on this PR, on the LLVM Discord or on the forums.

[llvmbot]

@llvm/pr-subscribers-clang-static-analyzer-1

Author: None (YLChenZ)

Changes

Fixes #132001:

False positives generated by this issue can be avoided by skipping the check on the unnamed bitfield.

Here are my test results：

Testing Time: 49.22s

Total Discovered Tests: 990
  Unsupported      :  19 (1.92%)
  Passed           : 965 (97.47%)
  Expectedly Failed:   6 (0.61%)

---

Full diff: https://github.com/llvm/llvm-project/pull/132457.diff

2 Files Affected:

• (modified) clang/lib/StaticAnalyzer/Checkers/UninitializedObject/UninitializedObjectChecker.cpp (+6-2)
• (added) clang/test/Analysis/unnamed_bitfield.cpp (+16)

diff --git a/clang/lib/StaticAnalyzer/Checkers/UninitializedObject/UninitializedObjectChecker.cpp b/clang/lib/StaticAnalyzer/Checkers/UninitializedObject/UninitializedObjectChecker.cpp
index 6e1222fedad3e..dadb206ba1197 100644
--- a/clang/lib/StaticAnalyzer/Checkers/UninitializedObject/UninitializedObjectChecker.cpp
+++ b/clang/lib/StaticAnalyzer/Checkers/UninitializedObject/UninitializedObjectChecker.cpp
@@ -17,14 +17,15 @@
 //
 //===----------------------------------------------------------------------===//
 
-#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
 #include "UninitializedObject.h"
 #include "clang/ASTMatchers/ASTMatchFinder.h"
 #include "clang/Driver/DriverDiagnostic.h"
+#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
 #include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/DynamicType.h"
+#include "clang/include/clang/AST/Decl.h"
 
 using namespace clang;
 using namespace clang::ento;
@@ -291,7 +292,10 @@ bool FindUninitializedFields::isNonUnionUninit(const TypedValueRegion *R,
 
   // Are all of this non-union's fields initialized?
   for (const FieldDecl *I : RD->fields()) {
-
+    // Skip checking for unnamed bitfield
+    if (I->isUnnamedBitField()) {
+      continue;
+    }
     const auto FieldVal =
         State->getLValue(I, loc::MemRegionVal(R)).castAs<loc::MemRegionVal>();
     const auto *FR = FieldVal.getRegionAs<FieldRegion>();
diff --git a/clang/test/Analysis/unnamed_bitfield.cpp b/clang/test/Analysis/unnamed_bitfield.cpp
new file mode 100644
index 0000000000000..56c9d56195a72
--- /dev/null
+++ b/clang/test/Analysis/unnamed_bitfield.cpp
@@ -0,0 +1,16 @@
+// RUN: %clang_analyze_cc1 -analyzer-checker=optin.cplusplus.UninitializedObject -verify %s
+// expected-no-diagnostics
+
+struct S
+{
+    S(bool b)
+    : b(b)
+    {}
+    bool b{false};
+    long long : 7; // padding
+};
+
+void f()
+{
+    S s(true);
+}

[llvmbot]

@llvm/pr-subscribers-clang

Author: None (YLChenZ)

Changes

Fixes #132001:

False positives generated by this issue can be avoided by skipping the check on the unnamed bitfield.

Here are my test results：

Testing Time: 49.22s

Total Discovered Tests: 990
  Unsupported      :  19 (1.92%)
  Passed           : 965 (97.47%)
  Expectedly Failed:   6 (0.61%)

---

Full diff: https://github.com/llvm/llvm-project/pull/132457.diff

2 Files Affected:

• (modified) clang/lib/StaticAnalyzer/Checkers/UninitializedObject/UninitializedObjectChecker.cpp (+6-2)
• (added) clang/test/Analysis/unnamed_bitfield.cpp (+16)

diff --git a/clang/lib/StaticAnalyzer/Checkers/UninitializedObject/UninitializedObjectChecker.cpp b/clang/lib/StaticAnalyzer/Checkers/UninitializedObject/UninitializedObjectChecker.cpp
index 6e1222fedad3e..dadb206ba1197 100644
--- a/clang/lib/StaticAnalyzer/Checkers/UninitializedObject/UninitializedObjectChecker.cpp
+++ b/clang/lib/StaticAnalyzer/Checkers/UninitializedObject/UninitializedObjectChecker.cpp
@@ -17,14 +17,15 @@
 //
 //===----------------------------------------------------------------------===//
 
-#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
 #include "UninitializedObject.h"
 #include "clang/ASTMatchers/ASTMatchFinder.h"
 #include "clang/Driver/DriverDiagnostic.h"
+#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
 #include "clang/StaticAnalyzer/Core/Checker.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
 #include "clang/StaticAnalyzer/Core/PathSensitive/DynamicType.h"
+#include "clang/include/clang/AST/Decl.h"
 
 using namespace clang;
 using namespace clang::ento;
@@ -291,7 +292,10 @@ bool FindUninitializedFields::isNonUnionUninit(const TypedValueRegion *R,
 
   // Are all of this non-union's fields initialized?
   for (const FieldDecl *I : RD->fields()) {
-
+    // Skip checking for unnamed bitfield
+    if (I->isUnnamedBitField()) {
+      continue;
+    }
     const auto FieldVal =
         State->getLValue(I, loc::MemRegionVal(R)).castAs<loc::MemRegionVal>();
     const auto *FR = FieldVal.getRegionAs<FieldRegion>();
diff --git a/clang/test/Analysis/unnamed_bitfield.cpp b/clang/test/Analysis/unnamed_bitfield.cpp
new file mode 100644
index 0000000000000..56c9d56195a72
--- /dev/null
+++ b/clang/test/Analysis/unnamed_bitfield.cpp
@@ -0,0 +1,16 @@
+// RUN: %clang_analyze_cc1 -analyzer-checker=optin.cplusplus.UninitializedObject -verify %s
+// expected-no-diagnostics
+
+struct S
+{
+    S(bool b)
+    : b(b)
+    {}
+    bool b{false};
+    long long : 7; // padding
+};
+
+void f()
+{
+    S s(true);
+}

[steakhal]

Hey @YLChenZ. Please join the review of #132427.
Your test case and review comments are more than welcomed!

You probably have debugged the checker thus gained important insights that would be useful to challenge the existing proposal.