假阳性和假阴性

Question

In static analysis, is there any examples explaining false negative and false positive ?

For the null dereference analysis ?

Answer 1

A false positive in general is when something is detected (ie "positive") when it's not there (ie "false").

A false negative in general is when something is not detected (ie "negative") when it is really there.

For null dereference analysis that means:

• a false positive is when it tells you that there is a potential null pointer dereference when in fact that can never happen at runtime.
• a false negative is when it fails to tell you about a potential null pointer dereference that can actually happen at runtime.

For example, consider this method:

public void frobnicate(Object foo) {
  int hash = foo.hashCode(); // line #1
  int hash2 = foo.hashCode(); // line #2
}

If the analysis tells you that there's a potential null pointer dereference at the line labelled "#2", then it is wrong because when execution reaches that point, foo can not be null. Therefore such a notification would be considered a false positive.

If the analysis fails to tells you that there's a potentital null pointer dereference at the line labelled "#1" then it would also be wrong, because foo can clearly be null at that point. That would be a false negative.