[Merge chakra-core/ChakraCore@e0fb812bc1] [1.6>1.7] [MERGE #3440 @Lou…

…isLaf] Initialize locals

Merge pull request #3440 from LouisLaf:uninitialize

OS:11689018, OS:11688872, OS:11688790, OS:11688685, OS:11688481, OS:11666867,
OS:11500875, OS:11499068, OS:11498539, OS:11500490, OS:11498110, OS:11497430,
OS:11495656 and OS:11445851. Initialize a bunch of uninitialized local variables
used as out params.  This doesn't fix existing bugs but is good code hygiene
and can prevent future issues.

deps/chakrashim/core/lib/Backend/BackwardPass.cpp

@@ -3284,7 +3284,7 @@ BackwardPass::ProcessNoImplicitCallUses(IR::Instr *const instr)
     {
         IR::Opnd *const src = srcs[i];
         IR::ArrayRegOpnd *arraySrc = nullptr;
-        Sym *sym;
+        Sym *sym = nullptr;
         switch(src->GetKind())
         {
             case IR::OpndKindReg:
@@ -3412,7 +3412,7 @@ BackwardPass::ProcessNoImplicitCallDef(IR::Instr *const instr)
         return;
     }
 
-    Sym *srcSym;
+    Sym *srcSym = nullptr;
     switch(src->GetKind())
     {
         case IR::OpndKindReg:
@@ -6385,7 +6385,7 @@ BackwardPass::TrackFloatSymEquivalence(IR::Instr *const instr)
             return;
         }
 
-        FloatSymEquivalenceClass *dstEquivalenceClass, *srcEquivalenceClass;
+        FloatSymEquivalenceClass *dstEquivalenceClass = nullptr, *srcEquivalenceClass = nullptr;
         const bool dstHasEquivalenceClass = floatSymEquivalenceMap->TryGetValue(dst->m_id, &dstEquivalenceClass);
         const bool srcHasEquivalenceClass = floatSymEquivalenceMap->TryGetValue(src->m_id, &srcEquivalenceClass);
 
@@ -6446,7 +6446,7 @@ BackwardPass::TrackFloatSymEquivalence(IR::Instr *const instr)
     // kind on the instruction. Both are checked because in functions without loops, equivalence tracking is not done and only
     // the sym's non-number bailout bit will have the information, and in functions with loops, equivalence tracking is done
     // throughout the function and checking just the sym's non-number bailout bit is insufficient.
-    FloatSymEquivalenceClass *dstEquivalenceClass;
+    FloatSymEquivalenceClass *dstEquivalenceClass = nullptr;
     if(dst->m_requiresBailOnNotNumber ||
         (floatSymEquivalenceMap->TryGetValue(dst->m_id, &dstEquivalenceClass) && dstEquivalenceClass->RequiresBailOnNotNumber()))
     {

deps/chakrashim/core/lib/Backend/BailOut.cpp

@@ -1191,7 +1191,7 @@ BailOutRecord::BailOutInlinedCommon(Js::JavascriptCallStackLayout * layout, Bail
         sizeof(registerSaves));
     BailOutRecord const * currentBailOutRecord = bailOutRecord;
     BailOutReturnValue bailOutReturnValue;
-    Js::ScriptFunction * innerMostInlinee;
+    Js::ScriptFunction * innerMostInlinee = nullptr;
     BailOutInlinedHelper(layout, currentBailOutRecord, bailOutOffset, returnAddress, bailOutKind, registerSaves, &bailOutReturnValue, &innerMostInlinee, false, branchValue);
     Js::Var result = BailOutCommonNoCodeGen(layout, currentBailOutRecord, currentBailOutRecord->bailOutOffset, returnAddress, bailOutKind, branchValue,
         registerSaves, &bailOutReturnValue);
@@ -1218,7 +1218,7 @@ BailOutRecord::BailOutFromLoopBodyInlinedCommon(Js::JavascriptCallStackLayout *
         sizeof(registerSaves));
     BailOutRecord const * currentBailOutRecord = bailOutRecord;
     BailOutReturnValue bailOutReturnValue;
-    Js::ScriptFunction * innerMostInlinee;
+    Js::ScriptFunction * innerMostInlinee = nullptr;
     BailOutInlinedHelper(layout, currentBailOutRecord, bailOutOffset, returnAddress, bailOutKind, registerSaves, &bailOutReturnValue, &innerMostInlinee, true, branchValue);
     uint32 result = BailOutFromLoopBodyHelper(layout, currentBailOutRecord, currentBailOutRecord->bailOutOffset,
         bailOutKind, nullptr, registerSaves, &bailOutReturnValue);

deps/chakrashim/core/lib/Backend/FlowGraph.cpp

@@ -2874,7 +2874,7 @@ FlowGraph::PeepCm(IR::Instr *instr)
     instrBr->SetSrc2(instr->UnlinkSrc2());
     instrBr->m_func = instr->m_func;
 
-    Js::OpCode newOpcode;
+    Js::OpCode newOpcode = Js::OpCode::InvalidOpCode;
 
     switch(instr->m_opcode)
     {

deps/chakrashim/core/lib/Backend/Func.cpp

@@ -1524,7 +1524,7 @@ Func::GetOrCreateSingleTypeGuard(intptr_t typeAddr)
 {
     EnsureSingleTypeGuards();
 
-    Js::JitTypePropertyGuard* guard;
+    Js::JitTypePropertyGuard* guard = nullptr;
     if (!this->singleTypeGuards->TryGetValue(typeAddr, &guard))
     {
         // Property guards are allocated by NativeCodeData::Allocator so that their lifetime extends as long as the EntryPointInfo is alive.

deps/chakrashim/core/lib/Backend/GlobOpt.cpp

@@ -1131,7 +1131,7 @@ BOOL GlobOpt::PreloadPRECandidate(Loop *loop, GlobHashBucket* candidate)
     loop->fieldPRESymStore->Set(symStore->m_id);
 
     ValueType valueType(ValueType::Uninitialized);
-    Value *initialValue;
+    Value *initialValue = nullptr;
 
     if (loop->initialValueFieldMap.TryGetValue(propertySym, &initialValue))
     {
@@ -3110,7 +3110,7 @@ GlobOpt::CopyPropDstUses(IR::Opnd *opnd, IR::Instr *instr, Value *src1Val)
 void
 GlobOpt::SetLoopFieldInitialValue(Loop *loop, IR::Instr *instr, PropertySym *propertySym, PropertySym *originalPropertySym)
 {
-    Value *initialValue;
+    Value *initialValue = nullptr;
     StackSym *symStore;
 
     if (loop->allFieldsKilled || loop->fieldKilled->Test(originalPropertySym->m_id))
@@ -4333,7 +4333,7 @@ GlobOpt::GetVarConstantValue(IR::AddrOpnd *addrOpnd)
     bool isVar = addrOpnd->IsVar();
     bool isString = isVar && addrOpnd->m_localAddress && JITJavascriptString::Is(addrOpnd->m_localAddress);
     Value *val = nullptr;
-    Value *cachedValue;
+    Value *cachedValue = nullptr;
     if(this->addrConstantToValueMap->TryGetValue(addrOpnd->m_address, &cachedValue))
     {
         // The cached value could be from a different block since this is a global (as opposed to a per-block) cache. Since
@@ -4468,7 +4468,7 @@ GlobOpt::NewFixedFunctionValue(Js::JavascriptFunction *function, IR::AddrOpnd *a
     Assert(function != nullptr);
 
     Value *val = nullptr;
-    Value *cachedValue;
+    Value *cachedValue = nullptr;
     if(this->addrConstantToValueMap->TryGetValue(addrOpnd->m_address, &cachedValue))
     {
         // The cached value could be from a different block since this is a global (as opposed to a per-block) cache. Since
@@ -13656,7 +13656,7 @@ GlobOpt::OptArraySrc(IR::Instr * *const instrRef)
             for(Loop *loop = currentBlock->loop; loop; loop = loop->parent)
             {
                 const JsArrayKills loopKills(loop->jsArrayKills);
-                Value *baseValueInLoopLandingPad;
+                Value *baseValueInLoopLandingPad = nullptr;
                 if((isLikelyJsArray && loopKills.KillsValueType(newBaseValueType)) ||
                     !OptIsInvariant(baseOpnd->m_sym, currentBlock, loop, baseValue, true, true, &baseValueInLoopLandingPad) ||
                     !(doArrayChecks || baseValueInLoopLandingPad->GetValueInfo()->IsObject()))

deps/chakrashim/core/lib/Backend/GlobOptFields.cpp

@@ -1736,7 +1736,7 @@ void
 GlobOpt::ReloadFieldHoistStackSym(IR::Instr * instr, PropertySym * propertySym)
 {
     Assert(instr->TransfersSrcValue());
-    StackSym * fieldHoistSym;
+    StackSym * fieldHoistSym = nullptr;
     Loop * loop = this->FindFieldHoistStackSym(this->currentBlock->loop, propertySym->m_id, &fieldHoistSym, instr);
 
     if (loop == nullptr)

deps/chakrashim/core/lib/Backend/GlobOptIntBounds.cpp

@@ -2822,8 +2822,8 @@ void GlobOpt::DetermineArrayBoundCheckHoistability(
     // If the loop count is constant, (inductionVariableOffset + loopCount * maxMagnitudeChange) can be folded into an offset:
     //     bound = index + offset
     int offset;
-    StackSym *indexLoopCountBasedBoundBaseSym;
-    Value *indexLoopCountBasedBoundBaseValue;
+    StackSym *indexLoopCountBasedBoundBaseSym = nullptr;
+    Value *indexLoopCountBasedBoundBaseValue = nullptr;
     IntConstantBounds indexLoopCountBasedBoundBaseConstantBounds;
     bool generateLoopCountBasedIndexBound;
     if(!loopCount->HasBeenGenerated() || loopCount->LoopCountMinusOneSym())

deps/chakrashim/core/lib/Backend/IR.cpp

@@ -1138,7 +1138,7 @@ Instr::UnlinkBailOutInfo()
 bool
 Instr::ReplaceBailOutInfo(BailOutInfo *newBailOutInfo)
 {
-    BailOutInfo *oldBailOutInfo;
+    BailOutInfo *oldBailOutInfo = nullptr;
     bool deleteOld = false;
 
 #if DBG
@@ -3625,7 +3625,7 @@ bool Instr::UsesAllFields()
 BranchInstr *
 Instr::ChangeCmCCToBranchInstr(LabelInstr *targetInstr)
 {
-    Js::OpCode newOpcode;
+    Js::OpCode newOpcode = Js::OpCode::InvalidOpCode;
     switch (this->m_opcode)
     {
     case Js::OpCode::CmEq_A:

deps/chakrashim/core/lib/Backend/IRBuilder.cpp

@@ -1010,7 +1010,7 @@ IRBuilder::InsertLabels()
 
     while (iter.Next())
     {
-        IR::LabelInstr * labelInstr;
+        IR::LabelInstr * labelInstr = nullptr;
         BranchReloc * reloc = iter.Data();
         IR::BranchInstr * branchInstr = reloc->GetBranchInstr();
         uint offset = reloc->GetOffset();

deps/chakrashim/core/lib/Backend/IRBuilderAsmJs.cpp

@@ -933,7 +933,7 @@ IRBuilderAsmJs::InsertLabels()
 
     while (iter.Next())
     {
-        IR::LabelInstr * labelInstr;
+        IR::LabelInstr * labelInstr = nullptr;
         BranchReloc * reloc = iter.Data();
         IR::BranchInstr * branchInstr = reloc->GetBranchInstr();
         uint offset = reloc->GetOffset();

deps/chakrashim/core/lib/Backend/Inline.cpp

@@ -5147,13 +5147,14 @@ Inline::FixupExtraActualParams(IR::Instr * instr, IR::Instr *argOuts[], IR::Inst
 {
     Assert(instr->m_opcode == Js::OpCode::ArgOut_A_FromStackArgs);
 
-    int offsetFixup;
+    int offsetFixup = INT_MAX;
     Assert(instr->m_func->callSiteToArgumentsOffsetFixupMap->ContainsKey(callSiteId));
     instr->m_func->callSiteToArgumentsOffsetFixupMap->TryGetValue(callSiteId, &offsetFixup);
 
     StackSym *sym = instr->GetDst()->AsSymOpnd()->m_sym->AsStackSym();
     while (index < actualCount)
     {
+        Assert(offsetFixup != INT_MAX);
         IR::Instr* argOutToMapTo = argOuts[index] ? argOuts[index] : argOutsExtra[index];
         StackSym* newStackSym = StackSym::NewArgSlotSym(sym->GetArgSlotNum(), instr->m_func);
         newStackSym->m_isInlinedArgSlot = true;
@@ -5180,14 +5181,15 @@ Inline::RemoveExtraFixupArgouts(IR::Instr* instr, uint argoutRemoveCount, Js::Pr
 {
     Assert(instr->m_opcode == Js::OpCode::ArgOut_A_FromStackArgs);
 
-    int offsetFixup;
+    int offsetFixup = -1;
     Assert(instr->m_func->callSiteToArgumentsOffsetFixupMap->ContainsKey(callSiteId));
     instr->m_func->callSiteToArgumentsOffsetFixupMap->TryGetValue(callSiteId, &offsetFixup);
 
     StackSym* argSym = instr->GetDst()->AsSymOpnd()->m_sym->AsStackSym();
     IR::Instr* argInstr = instr->GetSrc2()->AsSymOpnd()->m_sym->AsStackSym()->GetInstrDef();
     for(uint argIndex = 0; argIndex < argoutRemoveCount; argIndex++)
     {
+        Assert(offsetFixup != -1);
         Assert(argInstr->m_opcode == Js::OpCode::ArgOut_A_FixupForStackArgs);
         Assert(!argInstr->HasByteCodeArgOutCapture()); // ArgOut_A_FixupForStackArgs should not be restored on bailout, so we don't generate ByteCodeArgOutCapture for these argouts.
 

deps/chakrashim/core/lib/Backend/InterpreterThunkEmitter.cpp

@@ -339,8 +339,8 @@ bool InterpreterThunkEmitter::NewThunkBlock()
     }
 
 #if PDATA_ENABLED
-    PRUNTIME_FUNCTION pdataStart;
-    intptr_t epilogEnd;
+    PRUNTIME_FUNCTION pdataStart = nullptr;
+    intptr_t epilogEnd = 0;
 #endif
 
     DWORD count = this->thunkCount;

deps/chakrashim/core/lib/Backend/Lower.cpp

@@ -1159,7 +1159,7 @@ Lowerer::LowerRange(IR::Instr *instrStart, IR::Instr *instrEnd, bool defaultDoFa
                 }
             }
 
-            bool instrIsInHelperBlock;
+            bool instrIsInHelperBlock = false;
             if(!fastPath)
             {
                 LowerLdLen(instr, false);
@@ -1590,7 +1590,7 @@ Lowerer::LowerRange(IR::Instr *instrStart, IR::Instr *instrEnd, bool defaultDoFa
                 baseOpnd->SetValueType(baseOpnd->FindProfiledValueType());
             }
 
-            bool instrIsInHelperBlock;
+            bool instrIsInHelperBlock = false;
             if (!fastPath)
             {
                 this->LowerStElemI(
@@ -1657,7 +1657,7 @@ Lowerer::LowerRange(IR::Instr *instrStart, IR::Instr *instrEnd, bool defaultDoFa
                 baseOpnd->SetValueType(baseOpnd->FindProfiledValueType());
             }
 
-            bool instrIsInHelperBlock;
+            bool instrIsInHelperBlock = false;
 
             if (!fastPath)
             {
@@ -2662,7 +2662,7 @@ Lowerer::LowerRange(IR::Instr *instrStart, IR::Instr *instrEnd, bool defaultDoFa
 
         case Js::OpCode::BailOnNotArray:
         {
-            IR::Instr *bailOnNotArray, *bailOnMissingValue;
+            IR::Instr *bailOnNotArray = nullptr, *bailOnMissingValue = nullptr;
             SplitBailOnNotArray(instr, &bailOnNotArray, &bailOnMissingValue);
             IR::RegOpnd *const arrayOpnd = LowerBailOnNotArray(bailOnNotArray);
             if(bailOnMissingValue)
@@ -5141,8 +5141,7 @@ Lowerer::LowerUpdateNewScObjectCache(IR::Instr * insertInstr, IR::Opnd *dst, IR:
 IR::Instr *
 Lowerer::LowerNewScObjArray(IR::Instr *newObjInstr)
 {
-    IR::Instr* startCallInstr;
-    if (newObjInstr->HasEmptyArgOutChain(&startCallInstr))
+    if (newObjInstr->HasEmptyArgOutChain())
     {
         newObjInstr->FreeSrc2();
         return LowerNewScObjArrayNoArg(newObjInstr);
@@ -5277,7 +5276,7 @@ Lowerer::LowerNewScObjArray(IR::Instr *newObjInstr)
                 linkSym = linkOpnd->AsRegOpnd()->m_sym->AsStackSym();
                 AssertMsg(!linkSym->IsArgSlotSym() && linkSym->m_isSingleDef, "Arg tree not single def...");
 
-                startCallInstr = linkSym->m_instrDef;
+                IR::Instr* startCallInstr = linkSym->m_instrDef;
                 AssertMsg(startCallInstr->GetArgOutCount(false) == 2, "Generating ArrayFastPath for more than 1 parameter not allowed.");
 
                 // Since we emitted fast path above, move the startCall/argOut instruction right before helper
@@ -5673,7 +5672,7 @@ Lowerer::LowerProfiledLdFld(IR::JitProfilingInstr *ldFldInstr)
     auto src = ldFldInstr->UnlinkSrc1();
     AssertMsg(src->IsSymOpnd() && src->AsSymOpnd()->m_sym->IsPropertySym(), "Expected property sym as src");
 
-    IR::JnHelperMethod helper;
+    IR::JnHelperMethod helper = IR::HelperInvalid;
     switch (ldFldInstr->m_opcode)
     {
         case Js::OpCode::LdFld:
@@ -5755,7 +5754,6 @@ Lowerer::LowerProfiledLdFld(IR::JitProfilingInstr *ldFldInstr)
 
         default:
             Assert(false);
-            __assume(false);
     }
 
     ldFldInstr->SetSrc1(IR::HelperCallOpnd::New(helper, m_func));
@@ -7468,7 +7466,7 @@ Lowerer::CreateEquivalentTypeGuardAndLinkToGuardedProperties(JITTypeHolder type,
 
         AssertMsg(!isTypeStatic || !propOpInfo->IsBeingStored(), "Why are we storing a field to an object of static type?");
 
-        Js::EquivalentPropertyEntry* entry;
+        Js::EquivalentPropertyEntry* entry = nullptr;
         if (propIds.TryGetValue(propertyId, &entry))
         {
             if (propOpIndex == entry->slotIndex && propOpUsesAuxSlot == entry->isAuxSlot)
@@ -11043,7 +11041,7 @@ Lowerer::InlineBuiltInLibraryCall(IR::Instr *callInstr)
 void Lowerer::LowerInlineBuiltIn(IR::Instr* builtInEndInstr)
 {
     Assert(builtInEndInstr->m_opcode == Js::OpCode::InlineBuiltInEnd || builtInEndInstr->m_opcode == Js::OpCode::InlineNonTrackingBuiltInEnd);
-    IR::Instr* startCallInstr;
+    IR::Instr* startCallInstr = nullptr;
     builtInEndInstr->IterateArgInstrs([&](IR::Instr* argInstr) {
         startCallInstr = argInstr->GetSrc2()->GetStackSym()->m_instrDef;
         return false;
@@ -18495,7 +18493,7 @@ Lowerer::GenerateFastInlineStringSplitMatch(IR::Instr * instr)
     // script context
     LoadScriptContext(instr);
 
-    IR::JnHelperMethod helperMethod;
+    IR::JnHelperMethod helperMethod = IR::JnHelperMethod::HelperInvalid;
     IR::AutoReuseOpnd autoReuseStackAllocationOpnd;
     if(callDst && instr->dstIsTempObject)
     {

deps/chakrashim/core/lib/Backend/LowerMDShared.cpp

@@ -3721,7 +3721,7 @@ LowererMD::GenerateFastBrS(IR::BranchInstr *brInstr)
     brInstr->InsertBefore(cmpInstr);
     Legalize(cmpInstr);
 
-    Js::OpCode opcode;
+    Js::OpCode opcode = Js::OpCode::InvalidOpCode;
 
     switch(brInstr->m_opcode)
     {

deps/chakrashim/core/lib/Backend/Opnd.cpp

@@ -1868,6 +1868,7 @@ HelperCallOpnd::New(JnHelperMethod fnHelper, Func *func)
 void
 HelperCallOpnd::Init(JnHelperMethod fnHelper)
 {
+    Assert(fnHelper    != IR::HelperInvalid);
     this->m_fnHelper    = fnHelper;
     this->m_type        = TyMachPtr;
 

deps/chakrashim/core/lib/Backend/Peeps.cpp

@@ -1113,7 +1113,7 @@ Peeps::PeepCondMove(IR::LabelInstr *labelInstr, IR::Instr *nextInstr, const bool
 {
     IR::Instr *instr = labelInstr->GetPrevRealInstrOrLabel();
 
-    Js::OpCode newOpCode;
+    Js::OpCode newOpCode = Js::OpCode::InvalidOpCode;
 
     // Check if BB is all MOVs with both RegOpnd
     while(instr->m_opcode == Js::OpCode::MOV)

deps/chakrashim/core/lib/Backend/SymTable.cpp

@@ -161,7 +161,7 @@ SymTable::FindPropertySym(SymID id) const
 PropertySym *
 SymTable::FindPropertySym(SymID stackSymID, int32 propertyId) const
 {
-    PropertySym *  propertySym;
+    PropertySym *  propertySym = nullptr;
 
     stackSymID += this->m_IDAdjustment;
 

deps/chakrashim/core/lib/Backend/TempTracker.cpp

@@ -818,7 +818,7 @@ NumberTemp::GetRepresentativePropertySymId(PropertySym * propertySym, BackwardPa
 {
     // Since we don't track alias with objects, all property accesses are all grouped together.
     // Use a single property sym id to represent a propertyId to track dependencies.
-    SymID symId;
+    SymID symId = (SymID)-1;
     Js::PropertyId propertyId = propertySym->m_propertyId;
     if (!backwardPass->numberTempRepresentativePropertySym->TryGetValue(propertyId, &symId))
     {
@@ -1146,15 +1146,15 @@ ObjectTemp::ProcessInstr(IR::Instr * instr)
         {
             // First (non-this) parameter is either a regexp or search string.
             // It doesn't escape.
-            IR::Instr * instrArgDef;
+            IR::Instr * instrArgDef = nullptr;
             instr->FindCallArgumentOpnd(2, &instrArgDef);
             instrArgDef->dstIsTempObject = true;
             break;
         }
 
         case IR::JnHelperMethod::HelperRegExp_Exec:
         {
-            IR::Instr * instrArgDef;
+            IR::Instr * instrArgDef = nullptr;
             instr->FindCallArgumentOpnd(1, &instrArgDef);
             instrArgDef->dstIsTempObject = true;
             break;

deps/chakrashim/core/lib/Backend/amd64/LowererMDArch.cpp

@@ -752,7 +752,7 @@ LowererMDArch::LowerCallI(IR::Instr * callInstr, ushort callFlags, bool isHelper
     GeneratePreCall(callInstr, functionObjOpnd, insertBeforeInstrForCFGCheck);
 
     // We need to get the calculated CallInfo in SimpleJit because that doesn't include any changes for stack alignment
-    IR::IntConstOpnd *callInfo;
+    IR::IntConstOpnd *callInfo = nullptr;
     int32 argCount = LowerCallArgs(callInstr, callFlags, 1, &callInfo);
 
 
@@ -1065,7 +1065,7 @@ LowererMDArch::GetArgSlotOpnd(uint16 index, StackSym * argSym, bool isHelper /*=
 IR::Instr *
 LowererMDArch::LowerAsmJsCallE(IR::Instr *callInstr)
 {
-    IR::IntConstOpnd *callInfo;
+    IR::IntConstOpnd *callInfo = nullptr;
     int32 argCount = this->LowerCallArgs(callInstr, Js::CallFlags_Value, 1, &callInfo);
 
     IR::Instr* ret = this->LowerCall(callInstr, argCount);