FALSE POSITIVE: java:S2259 ignores the known empty state of a fresh ArrayList

Rules and Languages Report False-positive / False-negative...
1

Hi, I found a false positive in SonarQube 26.7.0 with sonar-java 8.34 when a newly constructed ArrayList is tested with isEmpty().

Affected tool

SonarQube 26.7.0.124771; sonar-java 8.34 (build 44906)

Affected checker

SonarQube java:S2259

Minimal reproducer

import java.util.ArrayList;
import java.util.List;

class S2259EmptyListState {
  void test() {
    List<Object> values = new ArrayList<>();
    if (!values.isEmpty()) {
      Object object = null;
      object.toString();
    }
  }
}

Reproduction command

sonar-scanner --version
sonar-scanner -Dsonar.projectKey=s2259-reproducer -Dsonar.sources=sonarqube-s2259-fp-empty-list-state.java -Dsonar.host.url="$SONAR_HOST_URL" -Dsonar.token="$SONAR_TOKEN"

Current behavior

SonarQube reports sonarqube-s2259-fp-empty-list-state.java:9: java:S2259: A NullPointerException could be thrown; object is nullable here.

Expected behavior

S2259 should not report this dereference because the fresh local ArrayList does not escape and is empty when isEmpty() is called.