[cfe-dev] [analyzer] Should analyzer report about potential null-dereferencing?

[Denis Petrov via cfe-dev]

Next code generates a sink node and a bug report:


int setPtr(const int&);
int* getPtr();
void f(bool is, const int x, const int y)
{
  const int *ptr = &x;
  if (is) {
    ptr = nullptr;?
  }
  setPtr(*ptr);
}


But next code just generates a sink node without a bug report:?


int setPtr(const int&);
int* getPtr();
void f(bool is, const int x, const int y)
{
  const int *ptr = &x;
  if (is) {
    ptr = getPtr();?
  }
  setPtr(*ptr);
}


Why does analyzer act like that? Is there any command line option to turn this on?

________________________________
Denys Petrov
Senior С++ Developer | Kharkiv, Ukraine

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/cfe-dev/attachments/20200416/b6cdbc99/attachment.html>