Fix 12197: FP uninitvar with two loops over buffer (#6417)

Author: pfultz2

lib/forwardanalyzer.cpp

@@ -97,6 +97,15 @@ namespace {
             return actions.isModified();
         }
 
+        bool stopOnCondition(const Token* condTok) const
+        {
+            if (analyzer->isConditional() && findAstNode(condTok, [](const Token* tok) {
+                return tok->isIncompleteVar();
+            }))
+                return true;
+            return analyzer->stopOnCondition(condTok);
+        }
+
         std::pair<bool, bool> evalCond(const Token* tok, const Token* ctx = nullptr) const {
             if (!tok)
                 return std::make_pair(false, false);
@@ -194,12 +203,12 @@ namespace {
         template<class T, class F, REQUIRES("T must be a Token class", std::is_convertible<T*, const Token*> )>
         Progress traverseConditional(T* tok, F f, bool traverseUnknown) {
             if (Token::Match(tok, "?|&&|%oror%") && tok->astOperand1() && tok->astOperand2()) {
-                T* condTok = tok->astOperand1();
+                const T* condTok = tok->astOperand1();
                 T* childTok = tok->astOperand2();
                 bool checkThen, checkElse;
                 std::tie(checkThen, checkElse) = evalCond(condTok);
                 if (!checkThen && !checkElse) {
-                    if (!traverseUnknown && analyzer->stopOnCondition(condTok) && stopUpdates()) {
+                    if (!traverseUnknown && stopOnCondition(condTok) && stopUpdates()) {
                         return Progress::Continue;
                     }
                     checkThen = true;
@@ -467,7 +476,7 @@ namespace {
                     if (updateRecursive(condTok) == Progress::Break)
                         return Break();
             }
-            if (!checkThen && !checkElse && !isDoWhile && analyzer->stopOnCondition(condTok) && stopUpdates())
+            if (!checkThen && !checkElse && !isDoWhile && stopOnCondition(condTok) && stopUpdates())
                 return Break(Analyzer::Terminate::Conditional);
             // condition is false, we don't enter the loop
             if (checkElse)
@@ -689,7 +698,7 @@ namespace {
                         Branch elseBranch{endBlock->tokAt(2) ? endBlock->linkAt(2) : nullptr};
                         // Check if condition is true or false
                         std::tie(thenBranch.check, elseBranch.check) = evalCond(condTok);
-                        if (!thenBranch.check && !elseBranch.check && analyzer->stopOnCondition(condTok) && stopUpdates())
+                        if (!thenBranch.check && !elseBranch.check && stopOnCondition(condTok) && stopUpdates())
                             return Break(Analyzer::Terminate::Conditional);
                         const bool hasElse = Token::simpleMatch(endBlock, "} else {");
                         bool bail = false;

lib/symboldatabase.cpp

@@ -745,10 +745,8 @@ void SymbolDatabase::createSymbolDatabaseFindAllScopes()
                     scopeList.emplace_back(this, tok, scope, Scope::eUnconditional, tok);
                     scope->nestedList.push_back(&scopeList.back());
                     scope = &scopeList.back();
-                } else if (scope->isExecutable()) {
-                    endInitList.emplace(tok->link(), scope);
                 } else {
-                    tok = tok->link();
+                    endInitList.emplace(tok->link(), scope);
                 }
             } else if (Token::Match(tok, "extern %type%")) {
                 const Token * ftok = tok->next();

test/testuninitvar.cpp

@@ -3645,7 +3645,7 @@ class TestUninitVar : public TestFixture {
                         "}");
         ASSERT_EQUALS("", errout_str());
 
-        valueFlowUninit("int f(int x) {\n"
+        valueFlowUninit("int f(int x, int y) {\n"
                         "    int a;\n"
                         "    if (x)\n"
                         "        a = y;\n"
@@ -6493,6 +6493,18 @@ class TestUninitVar : public TestFixture {
                         "}\n");
         ASSERT_EQUALS("[test.cpp:4] -> [test.cpp:1]: (warning) Uninitialized variable: r\n", errout_str());
 
+        // #12197
+        valueFlowUninit("void f() {\n"
+                        "    char a[N];\n"
+                        "    for (int i = 0; i < N; i++)\n"
+                        "        a[i] = 1;\n"
+                        "    const int* p = a;\n"
+                        "    for (int i = 0; i < N; i++) {\n"
+                        "        if (p[i]) {}\n"
+                        "    }\n"
+                        "}\n");
+        ASSERT_EQUALS("", errout_str());
+
         // #12247
         valueFlowUninit("void f() {\n"
                         "    char a[10], *p = &a[0];\n"