<html>
    <head>
      <base href="http://llvm.org/bugs/" />
    </head>
    <body><table border="1" cellspacing="0" cellpadding="8">
        <tr>
          <th>Bug ID</th>
          <td><a class="bz_bug_link 
          bz_status_NEW "
   title="NEW --- - Analyzer misses potential null dereference"
   href="http://llvm.org/bugs/show_bug.cgi?id=15314">15314</a>
          </td>
        </tr>

        <tr>
          <th>Summary</th>
          <td>Analyzer misses potential null dereference
          </td>
        </tr>

        <tr>
          <th>Product</th>
          <td>clang
          </td>
        </tr>

        <tr>
          <th>Version</th>
          <td>3.2
          </td>
        </tr>

        <tr>
          <th>Hardware</th>
          <td>PC
          </td>
        </tr>

        <tr>
          <th>OS</th>
          <td>All
          </td>
        </tr>

        <tr>
          <th>Status</th>
          <td>NEW
          </td>
        </tr>

        <tr>
          <th>Severity</th>
          <td>enhancement
          </td>
        </tr>

        <tr>
          <th>Priority</th>
          <td>P
          </td>
        </tr>

        <tr>
          <th>Component</th>
          <td>Static Analyzer
          </td>
        </tr>

        <tr>
          <th>Assignee</th>
          <td>kremenek@apple.com
          </td>
        </tr>

        <tr>
          <th>Reporter</th>
          <td>jim.correia@pobox.com
          </td>
        </tr>

        <tr>
          <th>CC</th>
          <td>llvmbugs@cs.uiuc.edu
          </td>
        </tr>

        <tr>
          <th>Classification</th>
          <td>Unclassified
          </td>
        </tr></table>
      <p>
        <div>
        <pre>Created <span class=""><a href="attachment.cgi?id=10049" name="attach_10049" title="Sample code which demonstrates the bug.">attachment 10049</a> <a href="attachment.cgi?id=10049&action=edit" title="Sample code which demonstrates the bug.">[details]</a></span>
Sample code which demonstrates the bug.

In the attached sample, the incorrect if on line 52 in -doSomethingElse:
confuses the analyzer. It misses the potential null dereference on line 52,
line 53, and line 59.

===


Build command:

  xcrun clang analyzer-null-dereference.m -fobjc-arc --analyze

Details:

  Expect 2 "Potential null dereference" warnings to be generated for the
  -doSomethingElse: method. None are generated. The erroneous
  `if (*error != NULL)` seems to be confusing the analyzer.

  Warnings generated:

     analyzer-null-dereference.m:45:12: warning: Potential null dereference.
According to coding standards in 'Creating and Returning NSError Objects' the
parameter '' may be null
         *error = [NSError errorWithDomain:@"MyErrorDomain" code:1
userInfo:nil];
        
~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     1 warning generated.

  (I hit this in production code — this isn't a contrived example.)

Compiler version:

  % xcrun clang -v
  Apple LLVM version 4.2 (clang-425.0.24) (based on LLVM 3.2svn)
  Target: x86_64-apple-darwin12.2.1
  Thread model: posix</pre>
        </div>
      </p>
      <hr>
      <span>You are receiving this mail because:</span>
      
      <ul>
          <li>You are on the CC list for the bug.</li>
      </ul>
    </body>
</html>