[clang:static analyzer] CTU false positive: `core.NullDereference`
- Dominant language
- LLVM
- Stars
- 40.5k
- Forks
- 18.7k
- PR merge metrics
- PR metrics pending
Description
clang Static Analyzer reports a false positive `core.NullDereference` under CTU analysis for this test case (See attachment).
dep = bar(e);
if (dep != NULL && e->a > 0)
In this program, `bar()` returns non-null only when `e != NULL`, so the dereference of `e->a` is infeasible on the `dep != NULL` branch.
The same code does not warn when `bar()` and `foo()` are placed into a single translation unit and analyzed with `clang --analyze`.
This looks like a CTU precision issue where the analyzer loses the implication:
- dep = bar(e)
- dep != NULL
- therefore e != NULL
Observed diagnostic:
main.c:12:24: warning: Access to field 'a' results in a dereference of a null pointer (loaded from variable 'e') [core.NullDereference]
12 | if (dep != NULL && e->a > 0)
| ^~~~
The issue can be reproduced with clang version 23.0.0git
[testcase.rtf](https://github.com/user-attachments/files/29493156/testcase.rtf)
Contributor guide
Research direction
Start with the attached testcase and reproduce the warning at main.c:12 using CTU analysis, then compare it with clang --analyze when bar() and foo() are in one translation unit. Trace how the analyzer handles dep = bar(e) and the dep != NULL branch; done means the reported core.NullDereference false positive no longer occurs for this case.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100