Incorrect "Called C++ object pointer is null" report -- when user code NULL-checks the dynamically casted value

[vakatov]

It looks that when the Static Analyzer sees a code branch which checks for a NULL dynamically casted value, then it (mistakenly) decides that the original pointer therefore is liable to be NULL as well:

class A { public: virtual void f(void) const; };
class B : public A { public: virtual void f(void) const; };

void g(const A* a)
{
    const B* b = dynamic_cast<const B*>(a);
    if (b) {
        b->f();
        return;
    }
    a->f();
}

$ /usr/local/llvm/20.1.1/bin/clang++ --analyze fp.cpp
fp.cpp:11:5: warning: Called C++ object pointer is null [core.CallAndMessage]
   11 |     a->f();
      |     ^~~~~~
1 warning generated.

[llvmbot]

@llvm/issue-subscribers-clang-static-analyzer

Author: Denis Vakatov, NCBI (vakatov)

It looks that when the Static Analyzer sees a code branch which checks for a NULL **dynamically casted** value, then it (mistakenly) decides that the original pointer therefore is liable to be NULL as well:

class A { public: virtual void f(void) const; };
class B : public A { public: virtual void f(void) const; };

void g(const A* a)
{
    const B* b = dynamic_cast<const B*>(a);
    if (b) {
        b->f();
        return;
    }
    a->f();
}

$ /usr/local/llvm/20.1.1/bin/clang++ --analyze fp.cpp
fp.cpp:11:5: warning: Called C++ object pointer is null [core.CallAndMessage]
   11 |     a->f();
      |     ^~~~~~
1 warning generated.