Points-to analysis does not detect dereferences in optimized LLVM IR about cclyzer HOT 2 OPEN

I'm not sure I follow your point. The code is dereferencing a null pointer, which is undefined behavior. So, what should variable %1 point to?

Why would you expect it to point to null?

Right now, there is a constraint that states that the special null location object cannot point to anything. This is important because we do not want our analysis to treat null as an ordinary pointer, to which you can store other memory addresses into.

The only sensible thing to add maybe, is a rule that returns the special unknown location object, after dereferencing null (after a load instruction). (However, this does not inform about undefined behavior, which is not the meaning of unknown location per se.)

from cclyzer.

My point is that when I run cclyzer on the un-optimized code, it tells me that there is a source pointer (%1) that points to *null*, but when I run it on the optimized code, there is no report of a null pointer being dereferenced. However, there is clearly a dereference to a null pointer in the code. Ultimately, I see a pointer dereference in the code that is not reflected in pointer-dereferences.tsv.

Does that clarify my question?

from cclyzer.