Re-insert type switch case conditions into the CFG by TvdW · Pull Request #421 · uber-go/nilaway

TvdW · 2026-06-12T19:05:27Z

The CFG builder (golang.org/x/tools/go/cfg) represents each case type of a type switch as an empty two-successor branching block, with no expression for the implicit per-case type assertion. NilAway re-inserts the lost conditions for value switches (markSwitchStatements) but had nothing equivalent for type switches, so case nil arms were not recognized as nil guards:

ptr, err := f()
switch err.(type) {
case nil:
    _ = *ptr // FP: err is provably nil here, so ptr is non-nil
}

Real-world hits include gotest.tools/assert.NilError (reported inside gotest.tools, where it cannot be suppressed) and
protoreflect.ValueOf(nil).

The new markTypeSwitchStatements pass synthesizes operand == nil / operand != nil conditions for nil and interface-typed case arms, and replicates the binding assignment (x := v.(type)) into each case body so that assertions on x transfer to v while per-branch knowledge is available; see its doc comment for the full semantics and soundness reasoning. Arms are classified via the type checker (EnhancedPass.IsNil now consults TypesInfo before the name-based fallback needed for synthesized identifiers), which also hardens source-level nil checks against a user-shadowed nil.

PR #366 previously attempted this by matching (x.(type)) == nil, but no such conditions are ever synthesized, so its testdata passed vacuously. That dead special case is removed and the testdata made genuinely fallible, then extended with soundness tests: default arms, multi-type clauses, concrete and type-parameter arms, parenthesized case (nil), and a shadowed nil type (package shadownil).

Claude-assisted, human-reviewed.

The CFG builder (golang.org/x/tools/go/cfg) represents each case type of a type switch as an empty two-successor branching block, with no expression for the implicit per-case type assertion. NilAway re-inserts the lost conditions for value switches (markSwitchStatements) but had nothing equivalent for type switches, so `case nil` arms were not recognized as nil guards: ptr, err := f() switch err.(type) { case nil: _ = *ptr // FP: err is provably nil here, so ptr is non-nil } Real-world hits include gotest.tools/assert.NilError (reported inside gotest.tools, where it cannot be suppressed) and protoreflect.ValueOf(nil). The new markTypeSwitchStatements pass synthesizes `operand == nil` / `operand != nil` conditions for nil and interface-typed case arms, and replicates the binding assignment (`x := v.(type)`) into each case body so that assertions on `x` transfer to `v` while per-branch knowledge is available; see its doc comment for the full semantics and soundness reasoning. Arms are classified via the type checker (EnhancedPass.IsNil now consults TypesInfo before the name-based fallback needed for synthesized identifiers), which also hardens source-level nil checks against a user-shadowed `nil`. PR uber-go#366 previously attempted this by matching `(x.(type)) == nil`, but no such conditions are ever synthesized, so its testdata passed vacuously. That dead special case is removed and the testdata made genuinely fallible, then extended with soundness tests: default arms, multi-type clauses, concrete and type-parameter arms, parenthesized `case (nil)`, and a shadowed `nil` type (package shadownil). On the stdlib golden test this removes 18 errors (database/sql, go/printer, go/types, html/template, text/template) and adds 7, for a net 2269 -> 2258. The additions are the same go/printer nil sources re-surfacing at a different dereference point: the interface-typed arm (ast.Expr) of printNode's type switch is now discharged, so the flow through the concrete-typed *ast.File arm is reported instead.

codecov · 2026-06-17T21:14:31Z

Codecov Report

❌ Patch coverage is 87.83784% with 9 lines in your changes missing coverage. Please review.
✅ Project coverage is 87.30%. Comparing base (d3e528f) to head (2ed5bac).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
assertion/function/preprocess/cfg.go	86.95%	6 Missing and 3 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #421      +/-   ##
==========================================
+ Coverage   87.26%   87.30%   +0.03%     
==========================================
  Files          74       74              
  Lines        8444     8504      +60     
==========================================
+ Hits         7369     7424      +55     
- Misses        876      880       +4     
- Partials      199      200       +1

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

github-actions · 2026-06-18T03:30:00Z

Golden Test

Warning

❌ NilAway errors reported on stdlib are different 📉.

2187 errors on base branch (main, 01ab7e3)
2176 errors on test branch (c2f7ba0)

Diffs

+ /opt/hostedtoolcache/go/1.25.11/x64/src/go/printer/nodes.go:1997:13: Potential nil panic detected. Observed nil flow from source to dereference point: 
+ 	- printer/performance_test.go:22:2: nilable value assigned into global variable `fileNode`
+ 	- printer/performance_test.go:78:25: global variable `fileNode` passed as arg `node` to `testprint()`
+ 	- printer/performance_test.go:30:88: function parameter `node` passed as arg `node` to `Fprint()`
+ 	- printer/printer.go:1424:34: function parameter `node` passed as arg `node` to `fprint()`
+ 	- printer/printer.go:1364:23: function parameter `node` passed as arg `node` to `printNode()`
+ 	- printer/printer.go:1172:10: function parameter `node` passed as arg `src` to `file()`
+ 	- printer/nodes.go:1997:13: function parameter `src` accessed field `Decls`
+ /opt/hostedtoolcache/go/1.25.11/x64/src/go/printer/nodes.go:1997:13: Potential nil panic detected. Observed nil flow from source to dereference point: 
+ 	- printer/performance_test.go:25:2: nilable value assigned into global variable `declNode`
+ 	- printer/performance_test.go:89:25: global variable `declNode` passed as arg `node` to `testprint()`
+ 	- printer/performance_test.go:30:88: function parameter `node` passed as arg `node` to `Fprint()`
+ 	- printer/printer.go:1424:34: function parameter `node` passed as arg `node` to `fprint()`
+ 	- printer/printer.go:1364:23: function parameter `node` passed as arg `node` to `printNode()`
+ 	- printer/printer.go:1172:10: function parameter `node` passed as arg `src` to `file()`
+ 	- printer/nodes.go:1997:13: function parameter `src` accessed field `Decls`
+ /opt/hostedtoolcache/go/1.25.11/x64/src/go/printer/nodes.go:1997:13: Potential nil panic detected. Observed nil flow from source to dereference point: 
+ 	- printer/printer_test.go:269:21: result 0 of `ParseFile()` lacking guarding; passed as arg `node` to `Fprint()` via the assignment(s):
+ 		- `parser.ParseFile(...)` to `f` at printer/printer_test.go:264:2
+ 	- printer/printer.go:1432:53: function parameter `node` passed as arg `node` to `Fprint()`
+ 	- printer/printer.go:1424:34: function parameter `node` passed as arg `node` to `fprint()`
+ 	- printer/printer.go:1364:23: function parameter `node` passed as arg `node` to `printNode()`
+ 	- printer/printer.go:1172:10: function parameter `node` passed as arg `src` to `file()`
+ 	- printer/nodes.go:1997:13: function parameter `src` accessed field `Decls`
+ /opt/hostedtoolcache/go/1.25.11/x64/src/go/printer/nodes.go:1997:13: Potential nil panic detected. Observed nil flow from source to dereference point: 
+ 	- printer/printer_test.go:329:17: result 0 of `ParseFile()` lacking guarding; passed as arg `f` to `testComment()` via the assignment(s):
+ 		- `parser.ParseFile(...)` to `f` at printer/printer_test.go:318:2
+ 	- printer/printer_test.go:284:32: function parameter `f` passed as arg `node` to `Fprint()`
+ 	- printer/printer.go:1432:53: function parameter `node` passed as arg `node` to `Fprint()`
+ 	- printer/printer.go:1424:34: function parameter `node` passed as arg `node` to `fprint()`
+ 	- printer/printer.go:1364:23: function parameter `node` passed as arg `node` to `printNode()`
+ 	- printer/printer.go:1172:10: function parameter `node` passed as arg `src` to `file()`
+ 	- printer/nodes.go:1997:13: function parameter `src` accessed field `Decls`
+ /opt/hostedtoolcache/go/1.25.11/x64/src/go/printer/nodes.go:1997:13: Potential nil panic detected. Observed nil flow from source to dereference point: 
+ 	- printer/printer_test.go:330:17: result 0 of `ParseFile()` lacking guarding; passed as arg `f` to `testComment()` via the assignment(s):
+ 		- `parser.ParseFile(...)` to `f` at printer/printer_test.go:318:2
+ 	- printer/printer_test.go:284:32: function parameter `f` passed as arg `node` to `Fprint()`
+ 	- printer/printer.go:1432:53: function parameter `node` passed as arg `node` to `Fprint()`
+ 	- printer/printer.go:1424:34: function parameter `node` passed as arg `node` to `fprint()`
+ 	- printer/printer.go:1364:23: function parameter `node` passed as arg `node` to `printNode()`
+ 	- printer/printer.go:1172:10: function parameter `node` passed as arg `src` to `file()`
+ 	- printer/nodes.go:1997:13: function parameter `src` accessed field `Decls`
+ /opt/hostedtoolcache/go/1.25.11/x64/src/go/printer/nodes.go:1997:13: Potential nil panic detected. Observed nil flow from source to dereference point: 
+ 	- printer/printer_test.go:331:17: result 0 of `ParseFile()` lacking guarding; passed as arg `f` to `testComment()` via the assignment(s):
+ 		- `parser.ParseFile(...)` to `f` at printer/printer_test.go:318:2
+ 	- printer/printer_test.go:284:32: function parameter `f` passed as arg `node` to `Fprint()`
+ 	- printer/printer.go:1432:53: function parameter `node` passed as arg `node` to `Fprint()`
+ 	- printer/printer.go:1424:34: function parameter `node` passed as arg `node` to `fprint()`
+ 	- printer/printer.go:1364:23: functi

 ...(truncated)...

rameter `x` accessed field `Y`
- /opt/hostedtoolcache/go/1.25.11/x64/src/go/types/builtins.go:792:38: Potential nil panic detected. Observed nil flow from source to dereference point: 
- 	- types/builtins.go:792:38: result 0 of `lookupFieldOrMethod()` lacking guarding; called `Type()` via the assignment(s):
- 		- `lookupFieldOrMethod(...)` to `obj` at types/builtins.go:765:3
- 
- (Same nil source could also cause potential nil panic(s) at 1 other place(s): "types/builtins.go:802:61".)
- /opt/hostedtoolcache/go/1.25.11/x64/src/go/types/exprstring.go:38:19: Potential nil panic detected. Observed nil flow from source to dereference point: 
- 	- types/assignments.go:195:10: literal `nil` returned from `lhsVar()` in position 0
- 	- types/assignments.go:278:22: result 0 of `lhsVar()` passed as arg `T` to `assignment()` via the assignment(s):
- 		- `check.lhsVar(lhs)` to `T` at types/assignments.go:253:2
- 	- types/assignments.go:72:63: function parameter `T` passed as arg `args` to `sprintf()` via the assignment(s):
- 		- `T` to `target` at types/assignments.go:44:3
- 	- types/format.go:87:42: index of variadic parameter `args` passed as arg `args` to `sprintf()`
- 	- types/format.go:32:21: index of variadic parameter `args` passed as arg `x` to `ExprString()`
- 	- types/exprstring.go:20:18: function parameter `x` passed as arg `x` to `WriteExpr()`
- 	- types/exprstring.go:38:19: function parameter `x` accessed field `Name`
- /opt/hostedtoolcache/go/1.25.11/x64/src/go/types/exprstring.go:38:19: Potential nil panic detected. Observed nil flow from source to dereference point: 
- 	- types/call.go:113:44: unassigned variable `targs` passed as arg `targs` to `infer()`
- 	- types/infer.go:47:57: function parameter `targs` passed as arg `args` to `dump()`
- 	- types/format.go:121:65: index of variadic parameter `args` passed as arg `args` to `sprintf()`
- 	- types/format.go:32:21: index of variadic parameter `args` passed as arg `x` to `ExprString()`
- 	- types/exprstring.go:20:18: function parameter `x` passed as arg `x` to `WriteExpr()`
- 	- types/exprstring.go:38:19: function parameter `x` accessed field `Name`
- /opt/hostedtoolcache/go/1.25.11/x64/src/go/types/exprstring.go:38:19: Potential nil panic detected. Observed nil flow from source to dereference point: 
- 	- types/call.go:126:57: unassigned variable `targs` passed as arg `targs` to `instantiateSignature()`
- 	- types/call.go:137:66: function parameter `targs` passed as arg `args` to `trace()`
- 	- types/format.go:101:54: index of variadic parameter `args` passed as arg `args` to `sprintf()`
- 	- types/format.go:32:21: index of variadic parameter `args` passed as arg `x` to `ExprString()`
- 	- types/exprstring.go:20:18: function parameter `x` passed as arg `x` to `WriteExpr()`
- 	- types/exprstring.go:38:19: function parameter `x` accessed field `Name`
- /opt/hostedtoolcache/go/1.25.11/x64/src/go/types/exprstring.go:38:19: Potential nil panic detected. Observed nil flow from source to dereference point: 
- 	- types/infer.go:240:87: result 0 of `coreTerm()` lacking guarding; passed as arg `args` to `tracef()` via the assignment(s):
- 		- `coreTerm(...)` to `core` at types/infer.go:238:4
- 	- types/unify.go:148:79: index of variadic parameter `args` passed as arg `args` to `sprintf()`
- 	- types/format.go:32:21: index of variadic parameter `args` passed as arg `x` to `ExprString()`
- 	- types/exprstring.go:20:18: function parameter `x` passed as arg `x` to `WriteExpr()`
- 	- types/exprstring.go:38:19: function parameter `x` accessed field `Name`
- /opt/hostedtoolcache/go/1.25.11/x64/src/go/types/index.go:290:12: Potential nil panic detected. Observed nil flow from source to dereference point: 
- 	- types/index.go:290:12: unassigned variable `cu` accessed field `len`
- 
- (Same nil source could also cause potential nil panic(s) at 2 other place(s): "types/index.go:296:24", and "types/index.go:299:20".)
- /opt/hostedtoolcache/go/1.25.11/x64/src/go/types/typestring.go:136:12: Potential nil panic detected. Observed nil flow from source to dereference point: 
- 	- types/typestring.go:422:11: unassigned variable `prev` passed as arg `typ` to `typ()`
- 	- types/typestring.go:136:12: function parameter `typ` accessed field `name`
- /opt/hostedtoolcache/go/1.25.11/x64/src/html/template/js.go:165:8: Potential nil panic detected. Observed nil flow from source to dereference point: 
- 	- template/js.go:138:10: literal `nil` returned from `indirectToJSONMarshaler()` in position 0
- 	- template/js.go:165:8: result 0 of `indirectToJSONMarshaler()` called `String()` via the assignment(s):
- 		- `indirectToJSONMarshaler(...)` to `a` at template/js.go:155:3
- /opt/hostedtoolcache/go/1.25.11/x64/src/text/template/parse/parse.go:292:24: Potential nil panic detected. Observed nil flow from source to dereference point: 
- 	- parse/parse_test.go:479:18: literal `nil` passed as arg `n` to `IsEmptyTree()`
- 	- parse/parse.go:292:24: function parameter `n` accessed field `Nodes`

TvdW force-pushed the switch-case branch from 22326ef to e25727c Compare June 12, 2026 19:12

TvdW force-pushed the switch-case branch from 412be11 to 2ed5bac Compare June 17, 2026 19:20

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Re-insert type switch case conditions into the CFG#421

Re-insert type switch case conditions into the CFG#421
TvdW wants to merge 1 commit into
uber-go:mainfrom
TvdW:switch-case

TvdW commented Jun 12, 2026

Uh oh!

codecov Bot commented Jun 17, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jun 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

TvdW commented Jun 12, 2026

Uh oh!

codecov Bot commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions Bot commented Jun 18, 2026

Golden Test

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

codecov Bot commented Jun 17, 2026 •

edited

Loading