[clang][analyzer] False-positive null dereference after an indirect call
- Dominant language
- LLVM
- Stars
- 40.5k
- Forks
- 18.7k
- PR merge metrics
- PR metrics pending
Description
**Description:**
Analyzer loses a constraint on a global variable after an indirect function call and reports a false-positive null-pointer dereference. Reproducer: . The function pointer `p` is initialized to `n` and is never modified. Therefore, `p()` always calls `n()`, which does not modify `x`. When `q` is null, the preceding condition guarantees that `x != 0`. Since calling `n()` cannot change `x`, the later condition `!x` cannot be true and `*q` is unreachable. Replacing the indirect call: `p();` with the direct call: `n();` preserves the constraint and removes the warning.
Contributor guide
Research direction
Start with the linked Compiler Explorer reproducer and compare the analyzer results for the indirect call p() and direct call n(). Trace how the analyzer carries the constraint on global x across the call; done means the indirect-call version no longer reports the unreachable null dereference.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100