False Negative: NULL_DEREFERENCE missing when preceded by a useless if-else branch on a constant non-null check
javafalse-negative
**Description**
Infer fails to report a **NULL_DEREFERENCE** when a dereference occurs in a null-check branch that is preceded by an irrelevant if-else statement checking a constant non-null value (e.g., System.out != null, which is always true).
This leads to a **false negative** in path-sensitive analysis, while a structurally equivalent case without the useless branch is correctly reported.
```java
public class NPELinkRepro {
int[] arr;
int test1() {
int i = 0;
int a = 0;
if (!(System.out == null)) {
} else {
}
if ((arr == null)) {
a = arr[i]; // <-should report (FN)
}
return 0;
}
int test2() {
int i = 0;
int a = 0;
if ((arr == null)) {
a = arr[i]; // <-reported (TP)
}
return 0;
}
}
```
**Expected behavior**
Infer should report a NULL_DEREFERENCE for the line a = arr[i]; in both test1() and test2().
The analysis should propagate the null state through the conditional branch in both cases, ignoring the semantically empty if-else in test1() as it does not affect control flow or variable states.
**Actual behavior**
Infer only reports the issue in test2(). The dereference in test1() is silently ignored, even though the preceding if-else is a no-op (always true condition with empty bodies) and the null-dereference logic is identical to test2().
0 条评论