Skip to content

Fix null dereference and FalseBoundException crash in type argument inference; fixes #7681#7735

Open
kavya685 wants to merge 5 commits into
typetools:masterfrom
kavya685:fix/7681-typeinference8-assuper-capture-npe
Open

Fix null dereference and FalseBoundException crash in type argument inference; fixes #7681#7735
kavya685 wants to merge 5 commits into
typetools:masterfrom
kavya685:fix/7681-typeinference8-assuper-capture-npe

Conversation

@kavya685
Copy link
Copy Markdown

@kavya685 kavya685 commented May 23, 2026

PR Description:

## Summary

Fixes two crashes that occurred when running the nullness checker on code
involving nested generics, lambdas, and method references (as reported in #7681).

## Changes

### 1. Fix NPE in `Typing.java` (`reduceSubtypeClass`)

`S.asSuper(T.getJavaType())` can return `null` when no corresponding supertype
exists, but `.capture(context)` was being chained directly on the result,
causing a `NullPointerException`.

**Fix:** Split the call into two steps and return `ConstraintSet.FALSE` when
`asSuper()` returns null, which is the correct JLS behavior — if no
corresponding supertype exists, the constraint reduces to false.

### 2. Fix `FalseBoundException` crash in `InvocationTypeInference.java` (`getB4`)

After fixing the NPE, a `FalseBoundException` was thrown during
`reduceAdditionalArgOnce()` when processing additional argument constraints
for a method reference inside a lambda. This exception was not being caught
at that level and bubbled up as a `BugInCF` crash.

**Fix:** Wrap `reduceAdditionalArgOnce()` in a try-catch for
`FalseBoundException` and `continue` to the next constraint. This is
consistent with the existing graceful degradation pattern already used
elsewhere in the codebase (e.g. `createAdditionalArgConstraintsNoLambda`).

## Testing

Added `checker/tests/nullness/java8inference/Issue7681.java` with the exact
repro from the issue. The test passes without any crash.

Before this fix:

error: [type.argument.inference.crashed] Type argument inference crashed
error: An exception occurred: Cannot invoke "AbstractType.capture(...)"
because the return value of "AbstractType.asSuper(...)" is null


After this fix: compiles cleanly with no crash.

Fixes: #7681

typetools#7681

- In Typing.java reduceSubtypeClass(), null-check the result of asSuper()
  before calling capture() on it.
- In InvocationTypeInference.java getB4(), catch FalseBoundException from
  reduceAdditionalArgOnce() and continue gracefully.
@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai Bot commented May 23, 2026

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 6371f49a-cef6-4951-8d1a-04ea9345b824

📥 Commits

Reviewing files that changed from the base of the PR and between 2977931 and b6d73bf.

📒 Files selected for processing (1)
  • checker/tests/nullness/java8inference/Issue7681.java

📝 Walkthrough

Walkthrough

This PR: (1) guards against a null dereference in Typing.reduceSubtypeClass by checking asSuper before capture, (2) wraps reduceAdditionalArgOnce in InvocationTypeInference.getB4 with a try/catch for FalseBoundException and skips failing additional-arg constraints, and (3) adds checker/tests/nullness/java8inference/Issue7681.java, a regression test exercising nested generics, lambdas, and a method reference.

Possibly related issues

  • crash: TO MANY CONSTRAINTS #7697 — The changes to InvocationTypeInference and Typing address robustness in constraint reduction and exception handling during Java 8 type inference, which relates to the inference failures described.

Suggested reviewers

  • mernst
🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check name Status Explanation
Linked Issues check ✅ Passed The PR directly addresses the two crashes reported in issue #7681 by implementing null-safe handling in Typing.reduceSubtypeClass and graceful exception handling in InvocationTypeInference.getB4.
Out of Scope Changes check ✅ Passed All changes are scoped to fixing the type inference crashes: two targeted fixes in framework core classes and one regression test matching the exact issue reproduction.
Docstring Coverage ✅ Passed Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@kavya685
Copy link
Copy Markdown
Author

Hi @mernst, this PR fixes the two crashes reported in #7681 (NPE in Typing.java and FalseBoundException in InvocationTypeInference.java). All functional CI jobs pass (junit, inference, typecheck, nonjunit). The misc_jdk25 and misc_jdk26 failures are maybe pre-existing — ./gradlew requireJavadoc fails on upstream/master itself with the same 1189 violations, none of which were introduced by this PR. Would you be able to review?

@mernst mernst requested a review from smillst May 24, 2026 11:01
Copy link
Copy Markdown
Member

@smillst smillst left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This pull request does not fix the issue. It converts it to a different exception and then ignores the exception.

@smillst smillst assigned kavya685 and unassigned smillst May 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Type argument inference crashed

3 participants