//===----------------------------------------------------------------------===// // Random notes for the static analysis module. //===----------------------------------------------------------------------===// Currently the analyzer with basic store will report false alarm for such code: p[0] = "/bin/sh"; p[1] = NULL; execv(p[0], argv); This is because BasicStore "collapses" all elements of an array into their base region. BasicStore should return UnknownVal() when getLValueElement. But that way will break current test in null-deref-ps.c.