clang with -Wnull-dereference doesn't produce expected warning

[tklengyel]

Greetings,
while compiling the following program with -Wnull-dereference no warning is produced by clang (Ubuntu clang version 20.0.0 (++20241009053718+c198f775cdcd-1~exp1~20241009053853.1977):

#include <stdio.h>

int main(int argc, char **argv)
{
    int *yikes = NULL;
    *yikes = 1;

    fprintf(stdout, "Hello world!\n");

    return *yikes;
}

Expected result would be like what you get with gcc (although it only seems to work with gcc if you have optimizations enabled and not with -O0):

$ gcc -O1 -Wnull-dereference -o yikes yikes.c
yikes.c: In function ‘main’:
yikes.c:8:12: warning: null pointer dereference [-Wnull-dereference]
    8 |     *yikes = 1;
      |     ~~~~~~~^~~
yikes.c:12:12: warning: null pointer dereference [-Wnull-dereference]
   12 |     return *yikes;
      |            ^~~~~~

[shafik]

Godbolt: https://godbolt.org/z/4bv5a35TE

[a-tarasyuk]

@shafik what diagnostic should be used in this case? should it be one of these, or is there a need for a new one?

llvm-project/clang/lib/Sema/SemaExpr.cpp

Line 578 in 34d4f66

S.PDiag(diag::warn_indirection_through_null)

llvm-project/clang/lib/Sema/SemaInit.cpp

Line 7522 in 34d4f66

S.PDiag(diag::warn_binding_null_to_reference)

[shafik]

I think we could possibly make warn_indirection_through_null via CheckForNullPointerDereference but I don't think the diagnostic would be accurate b/c I am guessing the optimizer won't have the same information or won't want to do the extra work.

CC @AaronBallman

[AaronBallman]

The issue is that CheckForNullPointerDereference() is only run during initialization, and this is not initialization but assignment. In order to support this, we need to build a CFG, and that's an expensive operation that we would typically only do as an opt-in analysis diagnostic or through the static analyzer. And the static analyzer does catch this: https://godbolt.org/z/96K169hEe

[a-tarasyuk]

@AaronBallman thank you for the explanation.

[eyalroz]

The minimal example can be simplified further...:

int main() {
    int* ptr = nullptr;
    return *ptr + 1;
}

This has just come up in this StackOverflow question.