NOTES.TXT

//===----------------------------------------------------------------------===//
// Random notes for the static analysis module.
//===----------------------------------------------------------------------===//

Currently the analyzer with basic store will report false alarm for such code:

p[0] = "/bin/sh";
p[1] = NULL;

execv(p[0], argv);

This is because BasicStore "collapses" all elements of an array into their base
region. BasicStore should return UnknownVal() when getLValueElement. But that
way will break current test in null-deref-ps.c.