@@ -56,17 +56,22 @@ predicate explicitNullTestOfInstruction(Instruction checked, Instruction bool) {
5656 )
5757}
5858
59+ predicate candidateResult ( LoadInstruction checked , SingleValuedInstruction sourceValue )
60+ {
61+ explicitNullTestOfInstruction ( checked , _) and
62+ not checked .getAST ( ) .isInMacroExpansion ( ) and
63+ sourceValue = checked .getSourceValue ( )
64+ }
65+
5966from LoadInstruction checked , LoadInstruction deref , SingleValuedInstruction sourceValue
6067where
61- explicitNullTestOfInstruction ( checked , _ ) and
68+ candidateResult ( checked , sourceValue ) and
6269 sourceValue = deref .getSourceAddress ( ) .( LoadInstruction ) .getSourceValue ( ) and
63- sourceValue = checked .getSourceValue ( ) and
6470 // This also holds if the blocks are equal, meaning that the check could come
6571 // before the deref. That's still not okay because when they're in the same
6672 // basic block then the deref is unavoidable even if the check concluded that
6773 // the pointer was null. To follow this idea to its full generality, we
6874 // should also give an alert when `check` post-dominates `deref`.
69- deref .getBlock ( ) .dominates ( checked .getBlock ( ) ) and
70- not checked .getAST ( ) .isInMacroExpansion ( )
75+ deref .getBlock ( ) .dominates ( checked .getBlock ( ) )
7176select checked , "This null check is redundant because the value is $@ in any case" , deref ,
7277 "dereferenced here"
0 commit comments