[uninit] look at complex HIL expressions too

Summary: Fixes #1112

Reviewed By: ngorogiannis

Differential Revision: D16028736

fbshipit-source-id: 9eaec2016

infer/src/checkers/uninit.ml

@@ -190,8 +190,9 @@ module TransferFunctions (CFG : ProcCfg.S) = struct
           check_hil_expr ~loc e
       | HilExp.AccessExpression access_expr ->
           check_access_expr ~loc access_expr
-      | _ ->
+      | hil_expr ->
-          ()
+          HilExp.get_access_exprs hil_expr
+          |> List.iter ~f:(fun access_expr -> check_access_expr ~loc access_expr)
     in
     let update_prepost access_expr rhs =
       let lhs_base = HilExp.AccessExpression.get_base access_expr in

infer/tests/codetoanalyze/cpp/uninit/issues.exp

@@ -17,9 +17,11 @@ codetoanalyze/cpp/uninit/uninit.cpp, bad2, 2, UNINITIALIZED_VALUE, no_bucket, ER
 codetoanalyze/cpp/uninit/uninit.cpp, branch1_FP, 11, UNINITIALIZED_VALUE, no_bucket, ERROR, []
 codetoanalyze/cpp/uninit/uninit.cpp, capture_by_ref_init2_FP, 4, UNINITIALIZED_VALUE, no_bucket, ERROR, []
 codetoanalyze/cpp/uninit/uninit.cpp, capture_by_ref_init_FP, 3, UNINITIALIZED_VALUE, no_bucket, ERROR, []
+codetoanalyze/cpp/uninit/uninit.cpp, capture_read_bad, 2, UNINITIALIZED_VALUE, no_bucket, ERROR, []
 codetoanalyze/cpp/uninit/uninit.cpp, condition_no_init_bad, 2, UNINITIALIZED_VALUE, no_bucket, ERROR, []
 codetoanalyze/cpp/uninit/uninit.cpp, copy_pointer_bad, 3, UNINITIALIZED_VALUE, no_bucket, ERROR, []
 codetoanalyze/cpp/uninit/uninit.cpp, loop1_FP, 10, UNINITIALIZED_VALUE, no_bucket, ERROR, []
 codetoanalyze/cpp/uninit/uninit.cpp, no_init_return_bad, 2, UNINITIALIZED_VALUE, no_bucket, ERROR, []
 codetoanalyze/cpp/uninit/uninit.cpp, ret_undef_bad, 2, UNINITIALIZED_VALUE, no_bucket, ERROR, []
+codetoanalyze/cpp/uninit/uninit.cpp, use_uninit_in_expr_bad, 2, UNINITIALIZED_VALUE, no_bucket, ERROR, []
 codetoanalyze/cpp/uninit/uninit.cpp, warning_when_throw_in_other_branch_bad, 9, UNINITIALIZED_VALUE, no_bucket, ERROR, []

infer/tests/codetoanalyze/cpp/uninit/uninit.cpp

@@ -193,7 +193,7 @@ int ok10() {
   return 1;
 }
 
-void FN_capture_read_bad() {
+void capture_read_bad() {
   int x;
   [x]() {
     int y = x;
@@ -330,3 +330,8 @@ void FN_call_to_maybe_uninit_fn_ptr_bad(bool nondet) {
     f = use_square_ok1;
   f();
 }
+
+void use_uninit_in_expr_bad() {
+  int x;
+  int y = x + 2;
+}