Skip to content

SONARJAVA-7282 False negative java:S2168: not reported when the outer null check is written !(helper != null) - #6450

Merged
david-schroeter merged 3 commits into
masterfrom
ds/SONARJAVA-7282
Nov 2, 2026
Merged

david-schroeter merged 3 commits into
masterfrom
ds/SONARJAVA-7282

Conversation

@david-schroeter

@david-schroeter david-schroeter commented Nov 2, 2026 •

Copy link
Copy Markdown
Contributor

Summary by Gitar

  • Bug fix:
    • Extended DoubleCheckedLockingCheck to unwrap parentheses and logical complements in if conditions, so !(helper != null) is detected
  • Tests:
    • Added regression samples for negated, double-negated, and triple-negated outer and inner null checks
    • Added compliant cases for volatile fields and already-synchronized methods, plus a non-compiling sample

This will update automatically on new commits.

@hashicorp-vault-sonar-prod

hashicorp-vault-sonar-prod Bot commented Nov 2, 2026 •

Copy link
Copy Markdown
Contributor

SONARJAVA-7282

@rombirli

rombirli commented Nov 2, 2026

Copy link
Copy Markdown
Contributor

/pvf

@rombirli rombirli left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@hashicorp-vault-sonar-prod

Copy link
Copy Markdown
Contributor

📊 Performance Validation complete
🆕 0 new · 🗑️ 0 lost issues
View dashboard

Projects with unexpected PVF results:

  • crate

@gitar-bot

gitar-bot Bot commented Nov 2, 2026

Copy link
Copy Markdown
Code Review ✅ Approved

🟡 Medium risk · Extending the double-checked-locking rule to unwrap negations could add diagnostics for previously missed patterns, changing analysis results in affected projects.

Extends DoubleCheckedLockingCheck to unwrap parentheses and logical complements in if conditions, so negated outer null checks like !(helper != null) are now detected for S2168. Regression samples cover negated, double-negated, and triple-negated checks, plus compliant cases for volatile fields and synchronized methods. No issues found.

Verification Rules 1/1 met Repos 4 inspected · PRs 1 inspected

Functional validation No results

Rules 1 passed 2 not applicable

✅ Repository license compliance

Broader impact Repos 4 inspected PRs 1 inspected
Cross-repo 4 repositories inspected 0 open impacts

SonarSource/sonar-java-symbolic-execution Inspected
SonarSource/sonarlint-intellij Inspected
SonarSource/sonarqube Inspected
SonarSource/sonarlint-vscode Inspected

Cross-PR 1 PR inspected 0 open impacts

PR 6456: SONARJAVA-7288 Replace Eclipse JDT core with PSI in the Java frontend Inspected

Auto-approval Not enabled

Set up

For more verification details, comment gitar display:verbose.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply Compact
gitar auto-apply:on         
gitar display:verbose         

Was this helpful? React with 👍 / 👎 | Gitar

@sonarqube-next

sonarqube-next Bot commented Nov 2, 2026

Copy link
Copy Markdown
Contributor

@david-schroeter
david-schroeter merged commit c4aab02 into master Nov 2, 2026
18 checks passed
@david-schroeter
david-schroeter deleted the ds/SONARJAVA-7282 branch November 2, 2026 16:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants