Refactoring of the ControlFlowGraph and use for detecting all uninitialized storage accesses.

22 files changed, 122 insertions, 46 deletions

diff --git a/test/libsolidity/syntaxTests/controlFlow/mappingReturn/named_err.sol b/test/libsolidity/syntaxTests/controlFlow/mappingReturn/named_err.sol
index 35420b6d..dbd3db08 100644
--- a/test/libsolidity/syntaxTests/controlFlow/mappingReturn/named_err.sol
+++ b/test/libsolidity/syntaxTests/controlFlow/mappingReturn/named_err.sol
@@ -2,4 +2,4 @@ contract C {
     function f() internal pure returns (mapping(uint=>uint) storage r) { }
 }
 // ----
-// TypeError: (53-82): This variable is of storage pointer type and might be returned without assignment and could be used uninitialized. Assign the variable (potentially from itself) to fix this error.
+// TypeError: (53-82): This variable is of storage pointer type and can be returned without prior assignment.
diff --git a/test/libsolidity/syntaxTests/controlFlow/mappingReturn/unnamed_err.sol b/test/libsolidity/syntaxTests/controlFlow/mappingReturn/unnamed_err.sol
index 52a8b3d7..476e799b 100644
--- a/test/libsolidity/syntaxTests/controlFlow/mappingReturn/unnamed_err.sol
+++ b/test/libsolidity/syntaxTests/controlFlow/mappingReturn/unnamed_err.sol
@@ -2,4 +2,4 @@ contract C {
     function f() internal pure returns (mapping(uint=>uint) storage) {}
 }
 // ----
-// TypeError: (53-80): This variable is of storage pointer type and might be returned without assignment and could be used uninitialized. Assign the variable (potentially from itself) to fix this error.
+// TypeError: (53-80): This variable is of storage pointer type and can be returned without prior assignment.
diff --git a/test/libsolidity/syntaxTests/controlFlow/storageReturn/assembly_err.sol b/test/libsolidity/syntaxTests/controlFlow/storageReturn/assembly_err.sol
index cad9b8e8..a6df889d 100644
--- a/test/libsolidity/syntaxTests/controlFlow/storageReturn/assembly_err.sol
+++ b/test/libsolidity/syntaxTests/controlFlow/storageReturn/assembly_err.sol
@@ -7,4 +7,4 @@ contract C {
     }
 }
 // ----
-// TypeError: (87-96): This variable is of storage pointer type and might be returned without assignment and could be used uninitialized. Assign the variable (potentially from itself) to fix this error.
+// TypeError: (87-96): This variable is of storage pointer type and can be returned without prior assignment.
diff --git a/test/libsolidity/syntaxTests/controlFlow/storageReturn/assembly_fine.sol b/test/libsolidity/syntaxTests/controlFlow/storageReturn/assembly_fine.sol
deleted file mode 100644
index 0d3db856..00000000
--- a/test/libsolidity/syntaxTests/controlFlow/storageReturn/assembly_fine.sol
+++ /dev/null
@@ -1,26 +0,0 @@
-contract C {
-    struct S { bool f; }
-    S s;
-    function f() internal returns (S storage c) {
-        assembly {
-            sstore(c_slot, sload(s_slot))
-        }
-    }
-    function g(bool flag) internal returns (S storage c) {
-        // control flow in assembly will not be analyzed for now,
-        // so this will not issue an error
-        assembly {
-            if flag {
-                sstore(c_slot, sload(s_slot))
-            }
-        }
-    }
-    function h() internal returns (S storage c) {
-        // any reference from assembly will be sufficient for now,
-        // so this will not issue an error
-        assembly {
-            sstore(s_slot, sload(c_slot))
-        }
-    }
-}
-// ----
diff --git a/test/libsolidity/syntaxTests/controlFlow/storageReturn/dowhile_err.sol b/test/libsolidity/syntaxTests/controlFlow/storageReturn/dowhile_err.sol
index eb574c96..b868d61d 100644
--- a/test/libsolidity/syntaxTests/controlFlow/storageReturn/dowhile_err.sol
+++ b/test/libsolidity/syntaxTests/controlFlow/storageReturn/dowhile_err.sol
@@ -45,8 +45,8 @@ contract C {
     }
 }
 // ----
-// TypeError: (87-98): This variable is of storage pointer type and might be returned without assignment and could be used uninitialized. Assign the variable (potentially from itself) to fix this error.
-// TypeError: (223-234): This variable is of storage pointer type and might be returned without assignment and could be used uninitialized. Assign the variable (potentially from itself) to fix this error.
-// TypeError: (440-451): This variable is of storage pointer type and might be returned without assignment and could be used uninitialized. Assign the variable (potentially from itself) to fix this error.
-// TypeError: (654-665): This variable is of storage pointer type and might be returned without assignment and could be used uninitialized. Assign the variable (potentially from itself) to fix this error.
-// TypeError: (871-882): This variable is of storage pointer type and might be returned without assignment and could be used uninitialized. Assign the variable (potentially from itself) to fix this error.
+// TypeError: (87-98): This variable is of storage pointer type and can be returned without prior assignment.
+// TypeError: (223-234): This variable is of storage pointer type and can be returned without prior assignment.
+// TypeError: (440-451): This variable is of storage pointer type and can be returned without prior assignment.
+// TypeError: (654-665): This variable is of storage pointer type and can be returned without prior assignment.
+// TypeError: (871-882): This variable is of storage pointer type and can be returned without prior assignment.
diff --git a/test/libsolidity/syntaxTests/controlFlow/storageReturn/for_err.sol b/test/libsolidity/syntaxTests/controlFlow/storageReturn/for_err.sol
index 9aa580a4..d2dec9c1 100644
--- a/test/libsolidity/syntaxTests/controlFlow/storageReturn/for_err.sol
+++ b/test/libsolidity/syntaxTests/controlFlow/storageReturn/for_err.sol
@@ -12,5 +12,5 @@ contract C {
     }
 }
 // ----
-// TypeError: (87-98): This variable is of storage pointer type and might be returned without assignment and could be used uninitialized. Assign the variable (potentially from itself) to fix this error.
-// TypeError: (182-193): This variable is of storage pointer type and might be returned without assignment and could be used uninitialized. Assign the variable (potentially from itself) to fix this error.
+// TypeError: (87-98): This variable is of storage pointer type and can be returned without prior assignment.
+// TypeError: (182-193): This variable is of storage pointer type and can be returned without prior assignment.
diff --git a/test/libsolidity/syntaxTests/controlFlow/storageReturn/if_err.sol b/test/libsolidity/syntaxTests/controlFlow/storageReturn/if_err.sol
index f3e55318..12ec31e4 100644
--- a/test/libsolidity/syntaxTests/controlFlow/storageReturn/if_err.sol
+++ b/test/libsolidity/syntaxTests/controlFlow/storageReturn/if_err.sol
@@ -14,5 +14,5 @@ contract C {
     }
 }
 // ----
-// TypeError: (96-107): This variable is of storage pointer type and might be returned without assignment and could be used uninitialized. Assign the variable (potentially from itself) to fix this error.
-// TypeError: (186-197): This variable is of storage pointer type and might be returned without assignment and could be used uninitialized. Assign the variable (potentially from itself) to fix this error.
+// TypeError: (96-107): This variable is of storage pointer type and can be returned without prior assignment.
+// TypeError: (186-197): This variable is of storage pointer type and can be returned without prior assignment.
diff --git a/test/libsolidity/syntaxTests/controlFlow/storageReturn/modifier_err.sol b/test/libsolidity/syntaxTests/controlFlow/storageReturn/modifier_err.sol
index 42342979..ee1e08fd 100644
--- a/test/libsolidity/syntaxTests/controlFlow/storageReturn/modifier_err.sol
+++ b/test/libsolidity/syntaxTests/controlFlow/storageReturn/modifier_err.sol
@@ -18,5 +18,5 @@ contract C {
     }
 }
 // ----
-// TypeError: (249-258): This variable is of storage pointer type and might be returned without assignment and could be used uninitialized. Assign the variable (potentially from itself) to fix this error.
-// TypeError: (367-376): This variable is of storage pointer type and might be returned without assignment and could be used uninitialized. Assign the variable (potentially from itself) to fix this error.
+// TypeError: (249-258): This variable is of storage pointer type and can be returned without prior assignment.
+// TypeError: (367-376): This variable is of storage pointer type and can be returned without prior assignment.
diff --git a/test/libsolidity/syntaxTests/controlFlow/storageReturn/short_circuit_err.sol b/test/libsolidity/syntaxTests/controlFlow/storageReturn/short_circuit_err.sol
index d0ad8245..e3579628 100644
--- a/test/libsolidity/syntaxTests/controlFlow/storageReturn/short_circuit_err.sol
+++ b/test/libsolidity/syntaxTests/controlFlow/storageReturn/short_circuit_err.sol
@@ -13,6 +13,6 @@ contract C {
     }
 }
 // ----
-// TypeError: (87-98): This variable is of storage pointer type and might be returned without assignment and could be used uninitialized. Assign the variable (potentially from itself) to fix this error.
-// TypeError: (176-187): This variable is of storage pointer type and might be returned without assignment and could be used uninitialized. Assign the variable (potentially from itself) to fix this error.
-// TypeError: (264-275): This variable is of storage pointer type and might be returned without assignment and could be used uninitialized. Assign the variable (potentially from itself) to fix this error.
+// TypeError: (87-98): This variable is of storage pointer type and can be returned without prior assignment.
+// TypeError: (176-187): This variable is of storage pointer type and can be returned without prior assignment.
+// TypeError: (264-275): This variable is of storage pointer type and can be returned without prior assignment.
diff --git a/test/libsolidity/syntaxTests/controlFlow/storageReturn/ternary_err.sol b/test/libsolidity/syntaxTests/controlFlow/storageReturn/ternary_err.sol
index 6d10287b..d5ad73c5 100644
--- a/test/libsolidity/syntaxTests/controlFlow/storageReturn/ternary_err.sol
+++ b/test/libsolidity/syntaxTests/controlFlow/storageReturn/ternary_err.sol
@@ -9,5 +9,5 @@ contract C {
     }
 }
 // ----
-// TypeError: (96-107): This variable is of storage pointer type and might be returned without assignment and could be used uninitialized. Assign the variable (potentially from itself) to fix this error.
-// TypeError: (200-211): This variable is of storage pointer type and might be returned without assignment and could be used uninitialized. Assign the variable (potentially from itself) to fix this error.
+// TypeError: (96-107): This variable is of storage pointer type and can be returned without prior assignment.
+// TypeError: (200-211): This variable is of storage pointer type and can be returned without prior assignment.
diff --git a/test/libsolidity/syntaxTests/controlFlow/storageReturn/while_err.sol b/test/libsolidity/syntaxTests/controlFlow/storageReturn/while_err.sol
index e7b4fae7..aabb76dd 100644
--- a/test/libsolidity/syntaxTests/controlFlow/storageReturn/while_err.sol
+++ b/test/libsolidity/syntaxTests/controlFlow/storageReturn/while_err.sol
@@ -8,4 +8,4 @@ contract C {
     }
 }
 // ----
-// TypeError: (87-98): This variable is of storage pointer type and might be returned without assignment and could be used uninitialized. Assign the variable (potentially from itself) to fix this error.
+// TypeError: (87-98): This variable is of storage pointer type and can be returned without prior assignment.
diff --git a/test/libsolidity/syntaxTests/controlFlow/uninitializedAccess/always_revert.sol b/test/libsolidity/syntaxTests/controlFlow/uninitializedAccess/always_revert.sol
new file mode 100644
index 00000000..96767402
--- /dev/null
+++ b/test/libsolidity/syntaxTests/controlFlow/uninitializedAccess/always_revert.sol
@@ -0,0 +1,8 @@
+contract C {
+    function f() internal view returns(uint[] storage a)
+    {
+        uint b = a[0];
+        revert();
+        b;
+    }
+}
\ No newline at end of file
diff --git a/test/libsolidity/syntaxTests/controlFlow/uninitializedAccess/assembly.sol b/test/libsolidity/syntaxTests/controlFlow/uninitializedAccess/assembly.sol
new file mode 100644
index 00000000..bfcbbef5
--- /dev/null
+++ b/test/libsolidity/syntaxTests/controlFlow/uninitializedAccess/assembly.sol
@@ -0,0 +1,9 @@
+contract C {
+	uint[] r;
+    function f() internal view returns (uint[] storage s) {
+        assembly { pop(s_slot) }
+        s = r;
+    }
+}
+// ----
+// TypeError: (92-126): This variable is of storage pointer type and can be accessed without prior assignment.
diff --git a/test/libsolidity/syntaxTests/controlFlow/uninitializedAccess/functionType.sol b/test/libsolidity/syntaxTests/controlFlow/uninitializedAccess/functionType.sol
new file mode 100644
index 00000000..1d683eff
--- /dev/null
+++ b/test/libsolidity/syntaxTests/controlFlow/uninitializedAccess/functionType.sol
@@ -0,0 +1,8 @@
+contract C {
+    // Make sure function parameters and return values are not considered
+    // for uninitialized return detection in the control flow analysis.
+    function f(function(uint[] storage) internal returns (uint[] storage)) internal pure
+    returns (function(uint[] storage) internal returns (uint[] storage))
+    {
+    }
+}
diff --git a/test/libsolidity/syntaxTests/controlFlow/uninitializedAccess/modifier_order_fail.sol b/test/libsolidity/syntaxTests/controlFlow/uninitializedAccess/modifier_order_fail.sol
new file mode 100644
index 00000000..90d228fa
--- /dev/null
+++ b/test/libsolidity/syntaxTests/controlFlow/uninitializedAccess/modifier_order_fail.sol
@@ -0,0 +1,8 @@
+contract C {
+    modifier m1(uint[] storage a) { _; }
+    modifier m2(uint[] storage a) { _; }
+    uint[] s;
+    function f() m1(b) m2(b = s) internal view returns (uint[] storage b) {}
+}
+// ----
+// TypeError: (129-130): This variable is of storage pointer type and can be accessed without prior assignment.
diff --git a/test/libsolidity/syntaxTests/controlFlow/uninitializedAccess/modifier_order_fine.sol b/test/libsolidity/syntaxTests/controlFlow/uninitializedAccess/modifier_order_fine.sol
new file mode 100644
index 00000000..af133929
--- /dev/null
+++ b/test/libsolidity/syntaxTests/controlFlow/uninitializedAccess/modifier_order_fine.sol
@@ -0,0 +1,6 @@
+contract C {
+    modifier m1(uint[] storage a) { _; }
+    modifier m2(uint[] storage a) { _; }
+    uint[] s;
+    function f() m1(b = s) m2(b) internal view returns (uint[] storage b) {}
+}
\ No newline at end of file
diff --git a/test/libsolidity/syntaxTests/controlFlow/uninitializedAccess/modifier_post_access.sol b/test/libsolidity/syntaxTests/controlFlow/uninitializedAccess/modifier_post_access.sol
new file mode 100644
index 00000000..b9f08615
--- /dev/null
+++ b/test/libsolidity/syntaxTests/controlFlow/uninitializedAccess/modifier_post_access.sol
@@ -0,0 +1,13 @@
+contract C {
+    uint[] s;
+    modifier mod(uint[] storage b) {
+        _;
+        b[0] = 0;
+    }
+    function f() mod(a) internal returns (uint[] storage a)
+    {
+		a = s;
+    }
+}
+// ----
+// TypeError: (120-121): This variable is of storage pointer type and can be accessed without prior assignment.
diff --git a/test/libsolidity/syntaxTests/controlFlow/uninitializedAccess/modifier_pre_access.sol b/test/libsolidity/syntaxTests/controlFlow/uninitializedAccess/modifier_pre_access.sol
new file mode 100644
index 00000000..81618aec
--- /dev/null
+++ b/test/libsolidity/syntaxTests/controlFlow/uninitializedAccess/modifier_pre_access.sol
@@ -0,0 +1,13 @@
+contract C {
+    uint[] s;
+    modifier mod(uint[] storage b) {
+        b[0] = 0;
+        _;
+    }
+    function f() mod(a) internal returns (uint[] storage a)
+    {
+		a = s;
+    }
+}
+// ----
+// TypeError: (120-121): This variable is of storage pointer type and can be accessed without prior assignment.
diff --git a/test/libsolidity/syntaxTests/controlFlow/uninitializedAccess/smoke.sol b/test/libsolidity/syntaxTests/controlFlow/uninitializedAccess/smoke.sol
new file mode 100644
index 00000000..41ced51d
--- /dev/null
+++ b/test/libsolidity/syntaxTests/controlFlow/uninitializedAccess/smoke.sol
@@ -0,0 +1,10 @@
+contract C {
+    uint[] s;
+    function f() internal returns (uint[] storage a)
+    {
+        a[0] = 0;
+        a = s;
+    }
+}
+// ----
+// TypeError: (94-95): This variable is of storage pointer type and can be accessed without prior assignment.
diff --git a/test/libsolidity/syntaxTests/controlFlow/uninitializedAccess/struct.sol b/test/libsolidity/syntaxTests/controlFlow/uninitializedAccess/struct.sol
new file mode 100644
index 00000000..b4f2be5d
--- /dev/null
+++ b/test/libsolidity/syntaxTests/controlFlow/uninitializedAccess/struct.sol
@@ -0,0 +1,11 @@
+contract C {
+    struct S { uint a; }
+    S s;
+    function f() internal returns (S storage r)
+    {
+        r.a = 0;
+        r = s;
+    }
+}
+// ----
+// TypeError: (109-110): This variable is of storage pointer type and can be accessed without prior assignment.
diff --git a/test/libsolidity/syntaxTests/controlFlow/uninitializedAccess/unreachable.sol b/test/libsolidity/syntaxTests/controlFlow/uninitializedAccess/unreachable.sol
new file mode 100644
index 00000000..b941ad34
--- /dev/null
+++ b/test/libsolidity/syntaxTests/controlFlow/uninitializedAccess/unreachable.sol
@@ -0,0 +1,10 @@
+contract C {
+    uint[] s;
+    function f() internal returns (uint[] storage a)
+    {
+        revert();
+        a[0] = 0;
+        a = s;
+    }
+}
+// ----
diff --git a/test/libsolidity/syntaxTests/dataLocations/libraries/library_function_with_data_location_fine.sol b/test/libsolidity/syntaxTests/dataLocations/libraries/library_function_with_data_location_fine.sol
index 7a276f95..95d4e02a 100644
--- a/test/libsolidity/syntaxTests/dataLocations/libraries/library_function_with_data_location_fine.sol
+++ b/test/libsolidity/syntaxTests/dataLocations/libraries/library_function_with_data_location_fine.sol
@@ -8,3 +8,9 @@ library L {
     function i(uint[] calldata, uint[] storage) external pure returns (S storage x) {return x; }
 }
 // ----
+// TypeError: (197-198): This variable is of storage pointer type and can be accessed without prior assignment.
+// TypeError: (203-204): This variable is of storage pointer type and can be accessed without prior assignment.
+// TypeError: (359-360): This variable is of storage pointer type and can be accessed without prior assignment.
+// TypeError: (365-366): This variable is of storage pointer type and can be accessed without prior assignment.
+// TypeError: (460-461): This variable is of storage pointer type and can be accessed without prior assignment.
+// TypeError: (557-558): This variable is of storage pointer type and can be accessed without prior assignment.