@@ -46,22 +46,24 @@ predicate explicitNullTestOfInstruction(Instruction checked, Instruction bool) {
4646 )
4747}
4848
49- predicate candidateResult ( LoadInstruction checked , ValueNumber value )
49+ pragma [ noinline]
50+ predicate candidateResult ( LoadInstruction checked , ValueNumber value , IRBlock dominator )
5051{
5152 explicitNullTestOfInstruction ( checked , _) and
5253 not checked .getAST ( ) .isInMacroExpansion ( ) and
53- value .getAnInstruction ( ) = checked
54+ value .getAnInstruction ( ) = checked and
55+ dominator .dominates ( checked .getBlock ( ) )
5456}
5557
56- from LoadInstruction checked , LoadInstruction deref , ValueNumber sourceValue
58+ from LoadInstruction checked , LoadInstruction deref , ValueNumber sourceValue , IRBlock dominator
5759where
58- candidateResult ( checked , sourceValue ) and
60+ candidateResult ( checked , sourceValue , dominator ) and
5961 sourceValue .getAnInstruction ( ) = deref .getSourceAddress ( ) and
6062 // This also holds if the blocks are equal, meaning that the check could come
6163 // before the deref. That's still not okay because when they're in the same
6264 // basic block then the deref is unavoidable even if the check concluded that
6365 // the pointer was null. To follow this idea to its full generality, we
6466 // should also give an alert when `check` post-dominates `deref`.
65- deref .getBlock ( ) . dominates ( checked . getBlock ( ) )
67+ deref .getBlock ( ) = dominator
6668select checked , "This null check is redundant because the value is $@ in any case" , deref ,
6769 "dereferenced here"
0 commit comments