ITADN

False Negative: NULL_DEREFERENCE missing when preceded by a useless if-else branch on a constant non-null check

#2015Openleemeii 创建于 2026-03-05
javafalse-negative
L
leemeiicommented
**Description** Infer fails to report a **NULL_DEREFERENCE** when a dereference occurs in a null-check branch that is preceded by an irrelevant if-else statement checking a constant non-null value (e.g., System.out != null, which is always true). This leads to a **false negative** in path-sensitive analysis, while a structurally equivalent case without the useless branch is correctly reported. ```java public class NPELinkRepro { int[] arr; int test1() { int i = 0; int a = 0; if (!(System.out == null)) { } else { } if ((arr == null)) { a = arr[i]; // <-should report (FN) } return 0; } int test2() { int i = 0; int a = 0; if ((arr == null)) { a = arr[i]; // <-reported (TP) } return 0; } } ``` **Expected behavior** Infer should report a NULL_DEREFERENCE for the line a = arr[i]; in both test1() and test2(). The analysis should propagate the null state through the conditional branch in both cases, ignoring the semantically empty if-else in test1() as it does not affect control flow or variable states. **Actual behavior** Infer only reports the issue in test2(). The dereference in test1() is silently ignored, even though the preceding if-else is a no-op (always true condition with empty bodies) and the null-dereference logic is identical to test2().
0 条评论