std::tie(State, Target) =
prepareForObjectConstruction(Call.getOriginExpr(), State, LCtx,
RTC->getConstructionContext(), CallOpts);
- assert(Target.getAsRegion());
- // Invalidate the region so that it didn't look uninitialized. Don't notify
- // the checkers.
- State = State->invalidateRegions(Target.getAsRegion(), E, Count, LCtx,
+ const MemRegion *TargetR = Target.getAsRegion();
+ assert(TargetR);
+ // Invalidate the region so that it didn't look uninitialized. If this is
+ // a field or element constructor, we do not want to invalidate
+ // the whole structure. Pointer escape is meaningless because
+ // the structure is a product of conservative evaluation
+ // and therefore contains nothing interesting at this point.
+ RegionAndSymbolInvalidationTraits ITraits;
+ ITraits.setTrait(TargetR,
+ RegionAndSymbolInvalidationTraits::TK_DoNotInvalidateSuperRegion);
+ State = State->invalidateRegions(TargetR, E, Count, LCtx,
/* CausedByPointerEscape=*/false, nullptr,
- &Call, nullptr);
+ &Call, &ITraits);
R = State->getSVal(Target.castAs<Loc>(), E->getType());
} else {
--- /dev/null
+// RUN: %clang_analyze_cc1 -analyzer-checker core,cplusplus \
+// RUN: -analyzer-checker debug.ExprInspection -verify %s
+
+void clang_analyzer_eval(bool);
+
+struct A {
+ int x;
+};
+
+A getA();
+
+struct B {
+ int *p;
+ A a;
+
+ B(int *p) : p(p), a(getA()) {}
+};
+
+void foo() {
+ B b1(nullptr);
+ clang_analyzer_eval(b1.p == nullptr); // expected-warning{{TRUE}}
+ B b2(new int); // No leak yet!
+ clang_analyzer_eval(b2.p == nullptr); // expected-warning{{FALSE}}
+ // expected-warning@-1{{Potential leak of memory pointed to by 'b2.p'}}
+}