Consider mappings return values in control flow analysis.

Changelog.md

@@ -16,6 +16,7 @@ Breaking Changes:
  * Commandline interface: Remove obsolete ``--formal`` option.
  * Commandline interface: Rename the ``--julia`` option to ``--yul``.
  * Commandline interface: Require ``-`` if standard input is used as source.
+ * Control Flow Analyzer: Consider mappings as well when checking for uninitialized return values.
  * Control Flow Analyzer: Turn warning about returning uninitialized storage pointers into an error.
  * General: ``continue`` in a ``do...while`` loop jumps to the condition (it used to jump to the loop body). Warning: this may silently change the semantics of existing code.
  * General: Disallow declaring empty structs.

libsolidity/analysis/ControlFlowAnalyzer.cpp

@@ -75,7 +75,10 @@ void ControlFlowAnalyzer::checkUnassignedStorageReturnValues(
 	{
 		auto& unassignedAtFunctionEntry = unassigned[_functionEntry];
 		for (auto const& returnParameter: _function.returnParameterList()->parameters())
-			if (returnParameter->type()->dataStoredIn(DataLocation::Storage))
+			if (
+				returnParameter->type()->dataStoredIn(DataLocation::Storage) ||
+				returnParameter->type()->category() == Type::Category::Mapping
+			)
 				unassignedAtFunctionEntry.insert(returnParameter.get());
 	}
 
@@ -147,7 +150,9 @@ void ControlFlowAnalyzer::checkUnassignedStorageReturnValues(
 			m_errorReporter.typeError(
 				returnVal->location(),
 				ssl,
-				"This variable is of storage pointer type and might be returned without assignment and "
+				string("This variable is of ") +
+				(returnVal->type()->category() == Type::Category::Mapping ? "mapping" : "storage pointer") +
+				" type and might be returned without assignment and "
 				"could be used uninitialized. Assign the variable (potentially from itself) "
 				"to fix this error."
 			);

test/libsolidity/syntaxTests/controlFlow/mappingReturn/named_err.sol

@@ -0,0 +1,5 @@
+contract C {
+    function f() internal pure returns (mapping(uint=>uint) storage r) { }
+}
+// ----
+// TypeError: (53-82): This variable is of mapping type and might be returned without assignment and could be used uninitialized. Assign the variable (potentially from itself) to fix this error.

test/libsolidity/syntaxTests/controlFlow/mappingReturn/named_fine.sol

@@ -0,0 +1,5 @@
+contract C {
+    mapping(uint=>uint) m;
+    function f() internal view returns (mapping(uint=>uint) storage r) { r = m; }
+}
+// ----

test/libsolidity/syntaxTests/controlFlow/mappingReturn/unnamed_err.sol

@@ -0,0 +1,5 @@
+contract C {
+    function f() internal pure returns (mapping(uint=>uint) storage) {}
+}
+// ----
+// TypeError: (53-72): This variable is of mapping type and might be returned without assignment and could be used uninitialized. Assign the variable (potentially from itself) to fix this error.

test/libsolidity/syntaxTests/controlFlow/mappingReturn/unnamed_fine.sol

@@ -0,0 +1,5 @@
+contract C {
+    mapping(uint=>uint) m;
+    function f() internal view returns (mapping(uint=>uint) storage) { return m; }
+}
+// ----