<table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Issue</th>
<td>
<a href=https://github.com/llvm/llvm-project/issues/61491>61491</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>
[clang static analyzer] core.NullDereference false negative with *c = 404
</td>
</tr>
<tr>
<th>Labels</th>
<td>
new issue
</td>
</tr>
<tr>
<th>Assignees</th>
<td>
</td>
</tr>
<tr>
<th>Reporter</th>
<td>
bagelming
</td>
</tr>
</table>
<pre>
Thanks a lot for taking the time to review this case.
test case:
```c
void clang_analyzer_eval();
int main()
{
int a = 0;
int *c = (void *)0;
for (; a < 4; a++)
{
;
}
clang_analyzer_eval(a == 0);
clang_analyzer_eval(c == 0);
*c = 404;
}
```
See it live: https://godbolt.org/z/71KGz3Whq.
In this case, `*c = 404` is reachable code, yet there is no `[core.NullDereference]` warning, and `analyzer_eval(a == 0)` and `analyzer_eval(c == 0)` have no output. However, if the `for` branch is commented out, all this appears (https://godbolt.org/z/s6rn8fan3).
</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJyEVMtu6zYQ_RpqM7iCROq50MK-htuiQDct0OUFSY0lNhTpkpSM5OsL0knsGEkvQOgxc2bOmQfIvVeTQRxIvSf1IeNrmK0bBJ9QL8pMmbDj8_DXzM2TBw7aBjhZB4E_KTNBmBGCWhCCBYebwguEWXmQ3GNOigMpdtdnQB-SlbDdvZ00xfXI6_9m1QhSczP94Ibr5xd0P3DjmtCO0J6w_X2wMgEWrsyr8-ppXyEAABHAgbADFO-hb3ZCdzK5CO0SK6E7QvvigSPCY8GRg-1Ttu9QpU9C9-n0N-QH9mS4pyXt4TH156UmzVfZd0V_jZdf4t-rrIrqVtm7jrfu38v6ExFUAK22OCyYQzj7ODV6JPQ42VFYHXLrJkKPL4Qe2_L3X17Y3_O_H-b9m7ktAqHfIXLcS2kKUB4ccjlzoRGkHRPuGUNcKofRbWyKq_fSOsz_WLU-oMMTOjQSSX2IWS7cGWWmGMvNGPH_38ym-AonH3Ez3zBqsGs4ryGHX-0FN3SRSp3S6pOmOFkXscJxI-coWtplQRNwjHFJltbXXvDzGbnzcZV-1lTfONOduGGE9jlk48DGnvU8w6Fs2r6kbd-wbB64qMpq7NqqRNHgiXWcIWspCoGs7-sqUwMtKCtY2RUdbQqWi44KlFLWzViLqhWkKnDhSudab0sUkCnvVxyasurLTHOB2qergVKDF0hOQmm8KdwQY76JdfKkKrTywd-yBBV0ulPSwoIPPCgJby0n9QE-mymcuPYIBice1IZwUWH-sMLZ6vTw0DwV5lXk0i6EHiP_6-vb2dl_UAZCj0m1J_SYqvovAAD__49Ob2Y">