On Feb 25, 2009, at 9:20 AM, Sebastian Redl wrote: > I'm pretty sure the analyzer works under the assumption that null > pointer dereferences are unrecoverable. That's correct. It's an excellent way to prune paths. We also try avoiding the cascading of "hard errors"; e.g. dereferencing garbage values, but halting the simulation of a path.