title: How to find potential points of NullReferenceException in a static code analyzer utility?
body: <p>We're developing a static code analysis tool that aims at improving code via some hints. </p>
  
  <p>We want to find places where developer has forgotten to check nullability of a variable or property or method return and has accessed the members via Dot Notation, because it might encounter NullReferenceException.</p>
  
  <p>For example this code:</p>
  
  <pre><code>class Program
  {
      static void Main(string[] args)
      {
          var human = new Human();
          if (human.Name.Length &gt; 10)
          {
              // Jeez! you have a long name;
          }
      }
  }
  
  public class Human
  {
      public string Name { get; set; }
  }
  </code></pre>
  
  <p>We use Mono.Cecil and we find the body of all methods of all types in a given assembly, and for each method body we find the Instructions of it, and then we check for Callvirt operations. Yet that doesn't support this example:</p>
  
  <pre><code>class Program
  {
      static string name;
  
      static void Main(string[] args)
      {
          if (name.Length &gt; 10)
          {
          }
      }
  }
  </code></pre>
  
  <p>How can we find all of the accesses to members (variable, field, property, method) of a given nullable type?</p>
  
  <p><strong>Update:</strong>
  In fact we're searching for OpCodes which represent <strong>member access</strong> for a given variable in IL. Is this possible?</p>