facebook / facebook/infer

False Negative: NULL_DEREFERENCE missing when null check is done via instanceof

Open
#2,001 0 comments 0 reactions 0 assignees View on GitHub
false-negative java
Dominant language
OCaml
Stars
15.7k
Forks
2.1k
Avg merge
19h 36m
Merged PRs (30d)
13

Description

**Description**
Infer fails to report a **NULL_DEREFERENCE** error when the null check is performed using instanceof instead of an explicit != null comparison.
```java
class Foo {
// Case 1
void bugDetected(String s1) {
if (s1 != null) return;
String str = s1.toString(); // <- reported (TP)
}

// Case 2
void bugMissed(String s2) {
if (s2 instanceof String) return;
String str = s2.toString(); // <- should report (FN)
}
}
```
**Expected behavior**
Both Case1 and Case2 should be reported with NULL_DEREFERENCE.

**Actual behavior**
Only Case 1 is reported. **Case 2 is silently ignored**, even though both methods have identical runtime behavior and should trigger the same null pointer analysis.

**Additional context**
When a parameter with static type T is checked using instanceof T, this is semantically equivalent to a null check, since instanceof returns false for null values:

```java
// When x has static type T:
x instanceof T ≡ x != null
```
When s2 instanceof String returns false and the static type of s2 is already String, the only possible value is null. The presence of instanceof type checking should not interfere with the null pointer analysis when the type being checked matches the static type.

However, Infer only detects the explicit null check pattern and misses the equivalent instanceof pattern.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.