Merge pull request #10826 from ethereum/issue-10821

Fix missing error when accessing unintialized variables.

Changelog.md

@@ -32,6 +32,7 @@ Bugfixes:
  * SMTChecker: Fix internal error on pushing string literal to ``bytes`` array.
  * Type Checker: Fix internal error caused by constant structs containing mappings.
  * Type System: Disallow implicit conversion from ``uintN`` to ``intM`` when ``M > N``, and by extension, explicit conversion between the same types is also disallowed.
+ * Control Flow Graph: Fix missing error caused by read from/write to uninitialized variables.
 
 ### 0.8.0 (2020-12-16)
 

libsolidity/analysis/ControlFlowAnalyzer.cpp

@@ -110,7 +110,10 @@ void ControlFlowAnalyzer::checkUninitializedAccess(CFGNode const* _entry, CFGNod
 
 		// Propagate changes to all exits and queue them for traversal, if needed.
 		for (auto const& exit: currentNode->exits)
-			if (nodeInfos[exit].propagateFrom(nodeInfo))
+			if (
+				auto exists = valueOrNullptr(nodeInfos, exit);
+				nodeInfos[exit].propagateFrom(nodeInfo) || !exists
+			)
 				nodesToTraverse.insert(exit);
 	}
 

test/libsolidity/syntaxTests/controlFlow/uninitializedAccess/bug10821-for.sol

@@ -0,0 +1,9 @@
+contract Test {
+	function testFunc() external {
+		for (;;) {}
+		bytes storage b;
+		b[0] = 0x42;
+	}
+}
+// ----
+// TypeError 3464: (83-84): This variable is of storage pointer type and can be accessed without prior assignment, which would lead to undefined behaviour.

test/libsolidity/syntaxTests/controlFlow/uninitializedAccess/bug10821-if.sol

@@ -0,0 +1,13 @@
+contract Test {
+
+  struct Sample { bool flag; }
+  Sample public s;
+
+   function testFunc() external {
+        if(true){}
+        Sample storage t;
+        t.flag=true;
+    }
+}
+// ----
+// TypeError 3464: (155-156): This variable is of storage pointer type and can be accessed without prior assignment, which would lead to undefined behaviour.

test/libsolidity/syntaxTests/controlFlow/uninitializedAccess/bug10821-modifier.sol

@@ -0,0 +1,16 @@
+contract Test {
+
+  struct Sample { bool flag; }
+  Sample public s;
+
+  modifier checkAddr(address _a){
+      require(_a!=address(0));
+      _;
+  }
+  function testFunc(address _a) external checkAddr(_a) {
+        Sample storage t;
+        t.flag=true;
+    }
+}
+// ----
+// TypeError 3464: (237-238): This variable is of storage pointer type and can be accessed without prior assignment, which would lead to undefined behaviour.

test/libsolidity/syntaxTests/controlFlow/uninitializedAccess/bug10821-require.sol

@@ -0,0 +1,9 @@
+contract Test {
+	function testFunc() external {
+		require(true);
+		bytes storage b;
+		b[0] = 0x42;
+	}
+}
+// ----
+// TypeError 3464: (86-87): This variable is of storage pointer type and can be accessed without prior assignment, which would lead to undefined behaviour.

test/libsolidity/syntaxTests/controlFlow/uninitializedAccess/bug10821-while.sol

@@ -0,0 +1,9 @@
+contract Test {
+	function testFunc() external {
+		while (true) {}
+		bytes storage b;
+		b[0] = 0x42;
+	}
+}
+// ----
+// TypeError 3464: (87-88): This variable is of storage pointer type and can be accessed without prior assignment, which would lead to undefined behaviour.