facebook / facebook/infer

False Negative: NULL_DEREFERENCE missing when preceded by a useless if-else branch on a constant non-null check

Open
#2,015 0 comments 0 reactions 0 assignees View on GitHub
false-negative java
Dominant language
OCaml
Stars
15.7k
Forks
2.1k
Avg merge
19h 36m
Merged PRs (30d)
13

Description

**Description**
Infer fails to report a **NULL_DEREFERENCE** when a dereference occurs in a null-check branch that is preceded by an irrelevant if-else statement checking a constant non-null value (e.g., System.out != null, which is always true).
This leads to a **false negative** in path-sensitive analysis, while a structurally equivalent case without the useless branch is correctly reported.
```java
public class NPELinkRepro {
int[] arr;

int test1() {
int i = 0;
int a = 0;

if (!(System.out == null)) {
} else {
}
if ((arr == null)) {
a = arr[i]; // <-should report (FN)
}
return 0;
}
int test2() {
int i = 0;
int a = 0;

if ((arr == null)) {
a = arr[i]; // <-reported (TP)
}

return 0;
}
}
```
**Expected behavior**
Infer should report a NULL_DEREFERENCE for the line a = arr[i]; in both test1() and test2().
The analysis should propagate the null state through the conditional branch in both cases, ignoring the semantically empty if-else in test1() as it does not affect control flow or variable states.

**Actual behavior**
Infer only reports the issue in test2(). The dereference in test1() is silently ignored, even though the preceding if-else is a no-op (always true condition with empty bodies) and the null-dereference logic is identical to test2().

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.