#1443 NP_NULL_ON_SOME_PATH_EXCEPTION false positive

[Mike Kienenberger]

The following code starts with dao = null, assigns it in a try/catch
block, then throws an exception if it was found to be null. The if
statement is where the bug is identified. At no point is dao
de-referenced.

Here's the simplest complete example that causes the problem:

package com.xyz.utilities.entity;

public class BaseDAOSimplified {
public BaseDAOSimplified getSubClassObject() {
BaseDAOSimplified dao = null;
try {
dao = this.getClass().newInstance();
}
catch(Exception e) {
}
if (null == dao) {
throw new NullPointerException("dao is null at
BaseDAO.getSubClassObject()");
}
return dao;
}
}
==============

Here is the output for javap:

javap -c -l -classpath . BaseDAOSimplified.classCompiled from
"BaseDAOSimplified.java"
public class com.xyz.utilities.entity.BaseDAOSimplified {
public com.xyz.utilities.entity.BaseDAOSimplified();
Code:
0: aload_0
1: invokespecial #8 // Method
java/lang/Object."<init>":()V
4: return
LineNumberTable:
line 3: 0
LocalVariableTable:
Start Length Slot Name Signature
0 5 0 this
Lcom/xyz/utilities/entity/BaseDAOSimplified;</init>

public com.xyz.utilities.entity.BaseDAOSimplified getSubClassObject();
Code:
0: aconst_null
1: astore_1
2: aload_0
3: invokevirtual #16 // Method
java/lang/Object.getClass:()Ljava/lang/Class;
6: invokevirtual #20 // Method
java/lang/Class.newInstance:()Ljava/lang/Object;
9: checkcast #1 // class
com/xyz/utilities/entity/BaseDAOSimplified
12: astore_1
13: goto 17
16: astore_2
17: aload_1
18: ifnonnull 31
21: new #26 // class
java/lang/NullPointerException
24: dup
25: ldc #28 // String dao is null at
BaseDAO.getSubClassObject()
27: invokespecial #30 // Method
java/lang/NullPointerException."<init>":(Ljava/lang/String;)V
30: athrow
31: aload_1
32: areturn
Exception table:
from to target type
2 13 16 Class java/lang/Exception
LineNumberTable:
line 5: 0
line 7: 2
line 8: 13
line 9: 16
line 11: 17
line 12: 21
line 14: 31
LocalVariableTable:
Start Length Slot Name Signature
0 33 0 this
Lcom/xyz/utilities/entity/BaseDAOSimplified;
2 31 1 dao
Lcom/xyz/utilities/entity/BaseDAOSimplified;
}</init>

[Mike Kienenberger]

Here is the comment from Dave Brosius on the issue:

Certainly reproducable, and certainly a false positive. I walked thru the FindNullDeref detector, and my guess is that it's a problem in the CFG (call flow graph) building, but that is some of the most heinous code you can find, so i can't say for sure.

You should add an issue with this sample