JAVA.DEEPNULL.FIELD : Field may be null (deep) (Java)

Summary

A field might hold null.

This checker looks for program points where, at runtime, a null pointer might be dereferenced and the execution stopped with a NullPointerException. It also looks for calls to library methods where null, or a collection or array containing a null element, might be passed as a parameter in a place where this is not allowed.

Since nullness is undecidable, it is impossible to find all and only the nullness bugs, without any false positive. As a consequence, the analyzer will often issue spurious warnings, where a fake bug is signalled because the analyzer is not clever enough to understand that some value is never actually null. However, the analyzer is currently the only analyzer that does not miss nullness bugs: if there is a real bug, it will be signalled. If the number of false alarms is too high and soundness is not paramount, it is also possible to use the corresponding basic warning class, which is unsound but yields its results much more quickly and with fewer false alarms.

Manually-provided Annotations

In order to reduce the number of false positives, you can instruct the analyzer with nullness annotations, placed in the code that you analyze. Usually, one performs a first nullness analysis and gets many fake warnings (false positives), but most of them have the same origin: a field that the analyzer does not identify as non-null or a method that the analyzer does not identify as always returning a non-null value. Hence, you can use this first analysis to place annotations in your code and then start the analysis again. In particular, the analyzer can be helped by putting the following annotations in the code under analysis:

• @NonNull for fields and return values: states that the field is never null when it is read, or that the method always returns a non-null value;
• @Inner0NonNull for fields and return values of generic type: states that the first generic type variable of the values held in the field or returned by the method is non-null. For instance, this allows one to state that a set bound to a field contains non-null elements only or that a method returns a map whose keys are all non-null;
• @Inner1NonNull for fields and return values of generic type: as in the case above, but predicates over the second generic type variable. For instance, this allows one to state that the values of a map held in a field are all non-null.
• @Nullable for the formal parameters of a method or constructor in a library: it states that it is allowed to pass null for that parameter.

It is also possible to state that a given expression is non-null at a specific program point. For that, use NullnessAssertions.assertNonNull(expression). Note that the fact that a variable is non-null at a program point does not prevent it from holding null later.

Strict and Non-Strict Checking

When JAVA_ANALYSIS_STRICT_MODE=No, warnings of this class will not be issued if there are indications that the possibility of a NullPointerException has been recognized and accounted for. For example, warnings will not be issued for code inside a try-catch block that explicitly catches NullPointerException, or for a JUnit test that is annotated as expecting this exception.

When JAVA_ANALYSIS_STRICT_MODE=Yes, warnings will be issued even in these cases.

Properties

WARNING_FILTER += allow class="Field may be null (deep) (Java)"

Example

The following code fragment is taken from the BluetoothChat sample application by Google, distributed with its ADT.

  // Read from the InputStream 
  int bytes = this.mmInStream.read(buffer);  // "Field may be null (deep) (Java)" warning issued here

CodeSonar has determined that field mmInStream might hold null there and a runtime NullPointerException might be thrown. A similar warning will be issued if there is an attempt to dereference field mmOutStream. Those fields are initialized inside the constructor, but may end up null-valued:

private class ConnectedThread extends Thread {
  private final BluetoothSocket mmSocket;
  private final InputStream mmInStream;
  private final OutputStream mmOutStream;

  public ConnectedThread(BluetoothSocket socket, String socketType) {
      Log.d(TAG, "create ConnectedThread: " + socketType);
      mmSocket = socket;
      InputStream tmpIn = null;
      OutputStream tmpOut = null;

      try {
          tmpIn = socket.getInputStream(); /* Throws IOException if the input stream of the Bluetooth socket cannot be opened.
                                            * This could happen if, for example, the mobile device has no Bluetooth hardware interface,
                                            * or if that interface is turned off or broken
                                            */ 
          tmpOut = socket.getOutputStream();
        } catch (IOException e) {
          Log.e(TAG, "temp sockets not created", e);
        }

      // If socket.getInputStream() throws IOException, both tmpIn and tmpOut are still null here.
      mmInStream = tmpIn;
      mmOutStream = tmpOut;
  }
}

To fix this bug, the ConnectedThread constructor should abort with an exception if either of the streams cannot be opened.

private class ConnectedThread extends Thread {
    private final BluetoothSocket mmSocket;
    private final InputStream mmInStream;
    private final OutputStream mmOutStream;

    public ConnectedThread(BluetoothSocket socket, String socketType) throws IOException {
        Log.d(TAG, "create ConnectedThread: " + socketType);
        mmSocket = socket;
        InputStream tmpIn = null;
        OutputStream tmpOut = null;

        try {
            tmpIn = socket.getInputStream();
            tmpOut = socket.getOutputStream();
        } catch (IOException e) {
            Log.e(TAG, "temp sockets not created", e);
            throw e;
        }
        // Both tmpIn and tmpOut are non-null here.
        mmInStream = tmpIn;
        mmOutStream = tmpOut;
    }
}

Resolution

Check if the value is actually null and modify the program in such a way to be sure that it is never null again. In most cases, a nullness bug is the consequence of a more complex bug, where some field is not always initialized before being used. Try to define as many as possible of your fields as final. Do not use null as a special value returned by a method.

Relevant Configuration File Parameters

The following configuration file parameters affect checks for this warning class.

• JAVA_ANALYSIS_DEEP_NULLNESS_CONSERVATIVE_CHECK
• JAVA_ANALYSIS_FAST_DEEP_CHECK
• JAVA_ANALYSIS_FIELD_SENSITIVE
• JAVA_ANALYSIS_INITIALIZATION_CHECK
• JAVA_ANALYSIS_MERGE_CREATION_POINTS
• JAVA_ANALYSIS_STRICT_MODE
• REPORT_SIMILAR_WARNINGS
• WARNING_FILTER