Open
Description
It looks that when the Static Analyzer sees a code branch which checks for a NULL dynamically casted value, then it (mistakenly) decides that the original pointer therefore is liable to be NULL as well:
$ cat test.cpp
class A { public: virtual void f(); };
class B : public A { public: virtual void f(); void fb(); };
void g(A* a)
{
B* b = dynamic_cast<B*>(a);
if (b)
b->fb();
else
a->f();
}
$ /usr/local/llvm/20.1.1/bin/clang++ --analyze test.cpp
test.cpp:10:9: warning: Called C++ object pointer is null [core.CallAndMessage]
10 | a->f();
| ^~~~~~
1 warning generated.