I added a few more NOWARNs to the old tests and it revealed even more weirdness with the malloc_null analysis:

1. It warned on one sizeof(*v) although that doesn't actually evaluate the argument, it just gets the type, which is statically known. The base analysis uses Cil.constFold which takes care of it for us so the base analysis never even sees it as evaluation of *v.
2. If sizeof(*v) was done with v being uninitialized (maybe NULL, maybe not), then the same thing did not warn. So I think the analysis is weird and possibly wrong in other ways as well: because v is possibly NULL initially, malloc_null doesn't have it as such in its state and doesn't handle it soundly even. But this becomes irrelevant when it's only for path-sensitivity anyway: it just doesn't induce a path-split on the entry state immediately.

malloc_null doesn't have any warning facilities after this PR, so the weirdness must come from the base analysis (maybe exposed by doing more path-splitting)?

Sorry, I meant the warnings from malloc_null as they are before this PR. So some of the NOWARNs that I added failed before but pass now that only base does the warnings.