<table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Issue</th>
<td>
<a href=https://github.com/llvm/llvm-project/issues/134454>134454</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>
Incorrect "Called C++ object pointer is null" report -- when user code NULL-checks the dynamically casted value
</td>
</tr>
<tr>
<th>Labels</th>
<td>
new issue
</td>
</tr>
<tr>
<th>Assignees</th>
<td>
</td>
</tr>
<tr>
<th>Reporter</th>
<td>
vakatov
</td>
</tr>
</table>
<pre>
It looks that when the Static Analyzer sees a code branch which checks for a NULL **dynamically casted** value, then it (mistakenly) decides that the original pointer therefore is liable to be NULL as well:
```
class A { public: virtual void f(void) const; };
class B : public A { public: virtual void f(void) const; };
void g(const A* a)
{
const B* b = dynamic_cast<const B*>(a);
if (b) {
b->f();
return;
}
a->f();
}
$ /usr/local/llvm/20.1.1/bin/clang++ --analyze fp.cpp
fp.cpp:11:5: warning: Called C++ object pointer is null [core.CallAndMessage]
11 | a->f();
| ^~~~~~
1 warning generated.
```
</pre>
<img width="1" height="1" alt="" src="http://email.email.llvm.org/o/eJykVMGO4zYM_RrmQiSwKTtxDj44M2NggW0vRc-FLNO2OooUSHKC9NBvL2R7N0C3hwJrCDChR1KPDyRlCHq0zDWUFyjfd3KOk_P1XX7K6O67zvXP-ktE49xnwDjJiI-JLcaJ8bcoo1bYWGmef7HHwBxQonI9Y-elVRM-Jq0mVBOrz4CD8yjx19-_fkWgBqjpn1ZetZLGPFHJELlf7_EuzcxAb-kZizoiUHXVIcpPtuYJdMaele55Y5TIOK9HbaXBm9M2sk-XngfnGXVAo2VnGKPDjlcGMuCDjQHRQLacY7adrFFGhoANwumCt7kzWoFo8K59nKXBu9M9DkBVMhIX5WyIIC4Ip3cQl-8JLpjC1gQ_kw2yZvEagaoFxUUkCXRO6Cn5rGF4SUCHIN5xE_ePJCyItxcO4gOoWqKX9IiIekgSd-n9Ld_2dXsQH4ney91znL19xSaeqyV_cF6xdKhAoHYOHqg1TkmT_uZ-BWopO-SHHKjttAVqlZF2BLoAXXC_l2t34XA7qNsNsmYzRJPnIJoyafmQ3mo7JvNNGsM9vm3xrvuTVfzeEzqgnY1BKC_KeT4k78b2v3AIcmQot0LyHOH0hv9d0qrLNxzKj7_TB1mTf-OBI1v2MnJ_-Fdj7fpa9Gdxljuu81MhqqzIqtNuqkt1Hs5VV1QDi04ch2qoVC9EIctSnYryvNM1ZVRmRVYQZTmdDmV3zMrhqM4kjnQqjlBkfJXaHJKoB-fHnQ5h5joXRVEWOyM7NmEZciLLD1xQIEoz7-sUtO_mMUCRGR1ieKWJOhquv1jlvE9aAtH_EhmI0PPN-Yj7_bo05sB-XQ9pBPfbWkjT--MmWHfAbvamnmK8hTSo1AK1o47T3B2Uu746aKF_8y7xAGqX2gJQuxV_r-mfAAAA___yfXtj">