NullPointerException in Type.equalsIgnoreMetadata in TypesUtils.leastUpperBound

[cpovirk]

This is as minimized as I've managed to get it, starting from the original code.

$ cat Caller.java 
import org.checkerframework.checker.nullness.qual.Nullable;

class Caller {
  <T> void foo(Sub<? super T> arg) {
    bar(arg);
    hashCode();
  }

  void bar(Sub<?> arg) {}
}

interface Super<T> {}

interface Sub<T> extends Super<@Nullable T> {}

$ checker/bin/javac -processor org.checkerframework.checker.nullness.NullnessChecker Caller.java
error: SourceChecker.typeProcess: unexpected Throwable (NullPointerException) while processing Caller.java
  Compilation unit: Caller.java
  Last visited tree at line 3 column 1:
  class Caller {
  Exception: java.lang.NullPointerException; Stack trace: com.sun.tools.javac.code.Type.equalsIgnoreMetadata(Type.java:499)
  com.sun.tools.javac.code.Types$SameTypeVisitor.visitType(Types.java:1039)
  com.sun.tools.javac.code.Types$SameTypeVisitor.visitType(Types.java:1036)
  com.sun.tools.javac.code.Types$DefaultTypeVisitor.visitTypeVar(Types.java:4630)
  com.sun.tools.javac.code.Types$SimpleVisitor.visitCapturedType(Types.java:4675)
  com.sun.tools.javac.code.Type$CapturedType.accept(Type.java:1732)
  com.sun.tools.javac.code.Types$DefaultTypeVisitor.visit(Types.java:4623)
  com.sun.tools.javac.code.Types$SameTypeVisitor.visitType(Types.java:1060)
  com.sun.tools.javac.code.Types$SameTypeVisitor.visitType(Types.java:1036)
  com.sun.tools.javac.code.Types$DefaultTypeVisitor.visitTypeVar(Types.java:4630)
  com.sun.tools.javac.code.Types$SimpleVisitor.visitCapturedType(Types.java:4675)
  com.sun.tools.javac.code.Type$CapturedType.accept(Type.java:1732)
  com.sun.tools.javac.code.Types$DefaultTypeVisitor.visit(Types.java:4623)
  com.sun.tools.javac.code.Types.isSameType(Types.java:1033)
  com.sun.tools.javac.code.Types.isSameType(Types.java:1028)
  com.sun.tools.javac.code.Types.containsTypeEquivalent(Types.java:4286)
  com.sun.tools.javac.code.Types.containsTypeEquivalent(Types.java:1378)
  com.sun.tools.javac.code.Types$LooseSameTypeVisitor.containsTypes(Types.java:1193)
  com.sun.tools.javac.code.Types$SameTypeVisitor.visitClassType(Types.java:1114)
  com.sun.tools.javac.code.Types$SameTypeVisitor.visitClassType(Types.java:1036)
  com.sun.tools.javac.code.Type$ClassType.accept(Type.java:992)
  com.sun.tools.javac.code.Types$DefaultTypeVisitor.visit(Types.java:4623)
  com.sun.tools.javac.code.Types.isSameType(Types.java:1033)
  com.sun.tools.javac.code.Types.isSameType(Types.java:1028)
  com.sun.tools.javac.code.Types.intersect(Types.java:3535)
  com.sun.tools.javac.code.Types.lub(Types.java:3768)
  org.checkerframework.javacutil.TypesUtils.leastUpperBound(TypesUtils.java:565)
  org.checkerframework.framework.flow.CFAbstractValue.upperBound(CFAbstractValue.java:331)
  org.checkerframework.framework.flow.CFAbstractValue.leastUpperBound(CFAbstractValue.java:315)
  org.checkerframework.framework.flow.CFAbstractStore.upperBoundOfValues(CFAbstractStore.java:929)
  org.checkerframework.framework.flow.CFAbstractStore.upperBound(CFAbstractStore.java:854)
  org.checkerframework.framework.flow.CFAbstractStore.leastUpperBound(CFAbstractStore.java:835)
  org.checkerframework.checker.initialization.InitializationStore.leastUpperBound(InitializationStore.java:202)
  org.checkerframework.checker.nullness.NullnessStore.leastUpperBound(NullnessStore.java:32)
  org.checkerframework.checker.nullness.NullnessStore.leastUpperBound(NullnessStore.java:14)
  org.checkerframework.dataflow.analysis.Analysis.mergeStores(Analysis.java:595)
  org.checkerframework.dataflow.analysis.Analysis.addStoreBefore(Analysis.java:554)
  org.checkerframework.dataflow.analysis.Analysis.performAnalysisBlock(Analysis.java:270)
  org.checkerframework.dataflow.analysis.Analysis.performAnalysis(Analysis.java:190)
  org.checkerframework.framework.flow.CFAbstractAnalysis.performAnalysis(CFAbstractAnalysis.java:91)
  org.checkerframework.framework.type.GenericAnnotatedTypeFactory.analyze(GenericAnnotatedTypeFactory.java:1253)
  org.checkerframework.framework.type.GenericAnnotatedTypeFactory.performFlowAnalysis(GenericAnnotatedTypeFactory.java:1171)
  org.checkerframework.framework.type.GenericAnnotatedTypeFactory.checkAndPerformFlowAnalysis(GenericAnnotatedTypeFactory.java:1520)
  org.checkerframework.framework.type.GenericAnnotatedTypeFactory.preProcessClassTree(GenericAnnotatedTypeFactory.java:258)
  org.checkerframework.common.basetype.BaseTypeVisitor.visitClass(BaseTypeVisitor.java:320)
  org.checkerframework.common.basetype.BaseTypeVisitor.visitClass(BaseTypeVisitor.java:167)
  com.sun.tools.javac.tree.JCTree$JCClassDecl.accept(JCTree.java:808)
  com.sun.source.util.TreePathScanner.scan(TreePathScanner.java:56)
  org.checkerframework.framework.source.SourceVisitor.visit(SourceVisitor.java:82)
  org.checkerframework.framework.source.SourceChecker.typeProcess(SourceChecker.java:1020)
  org.checkerframework.common.basetype.BaseTypeChecker.typeProcess(BaseTypeChecker.java:523)
  org.checkerframework.javacutil.AbstractTypeProcessor$AttributionTaskListener.finished(AbstractTypeProcessor.java:182)
  com.sun.tools.javac.api.ClientCodeWrapper$WrappedTaskListener.finished(ClientCodeWrapper.java:828)
  com.sun.tools.javac.api.MultiTaskListener.finished(MultiTaskListener.java:120)
  com.sun.tools.javac.main.JavaCompiler.flow(JavaCompiler.java:1404)
  com.sun.tools.javac.main.JavaCompiler.flow(JavaCompiler.java:1363)
  com.sun.tools.javac.main.JavaCompiler.compile(JavaCompiler.java:959)
  com.sun.tools.javac.main.Main.compile(Main.java:302)
  com.sun.tools.javac.main.Main.compile(Main.java:162)
  com.sun.tools.javac.Main.compile(Main.java:57)
  com.sun.tools.javac.Main.main(Main.java:43)
1 error

Source file and -version -verbose -AprintAllQualifiers output attached.

[smillst]

The arguments to TypesUtils.leastUpperBound are:
Sub<capture#556 of ? super T> and Sub<? super T>.

[mernst]

The crash is in javac. That suggests that the problem is either:

• it's a bug in Types.lub, or
• the invocation is outside the contract of Types.lub, which is not supposed to be able to take Sub<capture#556 of ? super T> and Sub<? super T> as arguments, or
• the Checker Framework is passing malformed types to Types.lub.

Can we think of a way to reproduce the problem outside the Checker Framework -- that is, a Java file that will cause javac to compute this particular lub?