llvm / llvm/llvm-project

[clang][analyzer] False-positive null dereference after an indirect call

Open
#217,940 4 comments 0 reactions 0 assignees View on GitHub
clang:static analyzer false-positive
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

**Description:**
Analyzer loses a constraint on a global variable after an indirect function call and reports a false-positive null-pointer dereference. Reproducer: . The function pointer `p` is initialized to `n` and is never modified. Therefore, `p()` always calls `n()`, which does not modify `x`. When `q` is null, the preceding condition guarantees that `x != 0`. Since calling `n()` cannot change `x`, the later condition `!x` cannot be true and `*q` is unreachable. Replacing the indirect call: `p();` with the direct call: `n();` preserves the constraint and removes the warning.

Contributor guide

Open the contributing guide

Research direction

Start with the linked Compiler Explorer reproducer and compare the analyzer results for the indirect call p() and direct call n(). Trace how the analyzer carries the constraint on global x across the call; done means the indirect-call version no longer reports the unreachable null dereference.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.