Implement null-safety checker as DataFlow analysis

[Copilot]

Investigates using the existing SSA-based DataFlow module for null-safety checking. The framework is adequate with one extension: a narrow hook on DataFlowApi for refining phi incoming values based on edge conditions.

DataFlow framework extension

• Added narrow : analyzer_context -> opt_ctx -> cfg_edge -> texpr -> t -> t to DataFlowApi signature
• Called during phi node evaluation, allows implementations to refine incoming values based on the CFG edge (e.g., which branch of a null check we came from)
• Existing implementations (ConstPropagationImpl, CopyPropagationImpl) use identity narrowing

NullAnalysisImpl

• Lattice: Top | NotNull | IsNull | Bottom — tracks whether variables are provably non-null, provably null, or potentially null
• Transfer: Type-based — Null<T> return types → Bottom, non-nullable → NotNull, TConst TNull → IsNull
• Narrow: Resolves if (x == null) / if (x != null) through temp var lookups via get_var_value, narrowing phi inputs on each branch
• Commit: Walks the dominator tree with a narrowing stack for intra-block narrowing (early return/throw/break guards), reports WNullSafety warnings for field access, method calls, and array access on potentially-null Null<T> values

Activated by -D analyzer-check-null, runs after const/copy propagation and before local DCE.

What works

var ns = getNullString(); // Null<String>
trace(ns.length);         // ⚠ warns: field access on potentially null value

if (ns == null) { ns = getString(); }
trace(ns.length);         // no warning — phi narrowing proves non-null

var ns2 = getNullString();
if (ns2 == null) return;
trace(ns2.length);        // no warning — intra-block narrowing via dominator tree

Config / plumbing

• FlagNullAnalysis added to cfg_edge_Flag
• null_safety field on AnalyzerConfig.t, reads analyzer_check_null define
• Updated TestNullChecker.hx: removed legacy @:analyzer(testIsNull) annotations, replaced with test methods exercising null-flow patterns

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.