Crash in CFG construction when unboxing an Integer-bounded type variable

Open

#8,328 opened on Oct 8, 2026 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

@msridhar is already working on this.

Since Oct 8, 2026.

#8329 by @msridhar — open

Assessment

Difficulty: 3/5
Estimated time: 1-2 days
Newbie friendliness: 20/100

Issue type: Bug
Clarity: Clearly specified
Activity status: Stale
Tech stack: java
Domain: testing-qa

Research direction

Start in dataflow/src/main/java/org/checkerframework/dataflow/cfg/builder/CFGTranslationPhaseOne.java, at binaryPromotedType around lines 1021–1040, and compare ordinary type-variable handling with the captured-variable case. Reproduce with the Java input in the issue and add a regression test for arithmetic on an Integer-bounded type variable; done means CFG construction no longer crashes. A linked pull request (#8329) is already open.

Written by the indexing model from the issue text.

Description

The Nullness Checker crashes when building the CFG for arithmetic that unboxes an ordinary type variable bounded by Integer. This was originally reported in uber/NullAway#1933, and reproduces directly in Checker Framework without NullAway.

Environment

Checker Framework 4.3.1-SNAPSHOT, built from master at 0091b160928cda73f8c3dff4cd871fada0a7518e.
JDK:

openjdk version "25.0.4.1" 2026-08-18 LTS
OpenJDK Runtime Environment Temurin-25.0.4.1+1 (build 25.0.4.1+1-LTS)
OpenJDK 64-Bit Server VM Temurin-25.0.4.1+1 (build 25.0.4.1+1-LTS, mixed mode, sharing)

Input

class Test<T extends Integer> {
    int test(T t) {
        return t + 1;
    }
}

Actual output

When run with the Nullness Checker:

Full compiler output

error: SourceChecker.typeProcess: unexpected Throwable (IllegalArgumentException) while processing Test.java; message: T
  ; The Checker Framework crashed.  Please report the crash.  Version: Checker Framework 4.3.1-SNAPSHOT, branch master, 2026-10-04, commit 0091b16, dirty=true. 
  Compilation unit: Test.java
  Last visited tree at line 1 column 1:
  class Test<T extends Integer> {
  Exception: java.lang.IllegalArgumentException: T; java.lang.IllegalArgumentException: T
  	at jdk.compiler/com.sun.tools.javac.model.JavacTypes.unboxedType(JavacTypes.java:148)
  	at org.checkerframework.dataflow.cfg.builder.CFGTranslationPhaseOne.binaryPromotedType(CFGTranslationPhaseOne.java:1027)
  	at org.checkerframework.dataflow.cfg.builder.CFGTranslationPhaseOne.visitBinary(CFGTranslationPhaseOne.java:3947)
  	at org.checkerframework.dataflow.cfg.builder.CFGTranslationPhaseOne.visitBinary(CFGTranslationPhaseOne.java:211)
  	at jdk.compiler/com.sun.tools.javac.tree.JCTree$JCBinary.accept(JCTree.java:2230)
  	at org.checkerframework.dataflow.cfg.builder.CFGTranslationPhaseOne.scan(CFGTranslationPhaseOne.java:579)
  	at org.checkerframework.dataflow.cfg.builder.CFGTranslationPhaseOne.visitReturn(CFGTranslationPhaseOne.java:3065)
  	at org.checkerframework.dataflow.cfg.builder.CFGTranslationPhaseOne.visitReturn(CFGTranslationPhaseOne.java:211)
  	at jdk.compiler/com.sun.tools.javac.tree.JCTree$JCReturn.accept(JCTree.java:1780)
  	at org.checkerframework.dataflow.cfg.builder.CFGTranslationPhaseOne.scan(CFGTranslationPhaseOne.java:579)
  	at org.checkerframework.dataflow.cfg.builder.CFGTranslationPhaseOne.visitBlock(CFGTranslationPhaseOne.java:1537)
  	at org.checkerframework.dataflow.cfg.builder.CFGTranslationPhaseOne.visitBlock(CFGTranslationPhaseOne.java:211)
  	at jdk.compiler/com.sun.tools.javac.tree.JCTree$JCBlock.accept(JCTree.java:1148)
  	at org.checkerframework.dataflow.cfg.builder.CFGTranslationPhaseOne.scan(CFGTranslationPhaseOne.java:579)
  	at org.checkerframework.dataflow.cfg.builder.CFGTranslationPhaseOne.process(CFGTranslationPhaseOne.java:478)
  	at org.checkerframework.dataflow.cfg.builder.CFGTranslationPhaseOne.process(CFGTranslationPhaseOne.java:530)
  	at org.checkerframework.framework.flow.CFCFGBuilder.build(CFCFGBuilder.java:71)
  	at org.checkerframework.framework.type.GenericAnnotatedTypeFactory.analyze(GenericAnnotatedTypeFactory.java:1631)
  	at org.checkerframework.framework.type.GenericAnnotatedTypeFactory.performFlowAnalysisForMethod(GenericAnnotatedTypeFactory.java:1514)
  	at org.checkerframework.framework.type.GenericAnnotatedTypeFactory.performFlowAnalysisForClass(GenericAnnotatedTypeFactory.java:1443)
  	at org.checkerframework.framework.type.GenericAnnotatedTypeFactory.performFlowAnalysisForClassOnce(GenericAnnotatedTypeFactory.java:2053)
  	at org.checkerframework.framework.type.GenericAnnotatedTypeFactory.preProcessClassTree(GenericAnnotatedTypeFactory.java:431)
  	at org.checkerframework.common.basetype.BaseTypeVisitor.visitClass(BaseTypeVisitor.java:591)
  	at org.checkerframework.common.basetype.BaseTypeVisitor.visitClass(BaseTypeVisitor.java:197)
  	at jdk.compiler/com.sun.tools.javac.tree.JCTree$JCClassDecl.accept(JCTree.java:899)
  	at jdk.compiler/com.sun.source.util.TreePathScanner.scan(TreePathScanner.java:66)
  	at org.checkerframework.framework.source.SourceVisitor.visit(SourceVisitor.java:88)
  	at org.checkerframework.framework.source.SourceChecker.typeProcess(SourceChecker.java:1395)
  	at org.checkerframework.framework.source.SourceChecker.typeProcess(SourceChecker.java:1316)
  	at org.checkerframework.javacutil.AbstractTypeProcessor$AttributionTaskListener.finished(AbstractTypeProcessor.java:196)
  	at jdk.compiler/com.sun.tools.javac.api.ClientCodeWrapper$WrappedTaskListener.finished(ClientCodeWrapper.java:876)
  	at jdk.compiler/com.sun.tools.javac.api.MultiTaskListener.finished(MultiTaskListener.java:133)
  	at jdk.compiler/com.sun.tools.javac.main.JavaCompiler.flow(JavaCompiler.java:1423)
  	at jdk.compiler/com.sun.tools.javac.main.JavaCompiler.flow(JavaCompiler.java:1380)
  	at jdk.compiler/com.sun.tools.javac.main.JavaCompiler.compile(JavaCompiler.java:968)
  	at jdk.compiler/com.sun.tools.javac.main.Main.compile(Main.java:319)
  	at jdk.compiler/com.sun.tools.javac.main.Main.compile(Main.java:178)
  	at jdk.compiler/com.sun.tools.javac.Main.compile(Main.java:66)
  	at jdk.compiler/com.sun.tools.javac.Main.main(Main.java:52)
error: SourceChecker.typeProcess: unexpected Throwable (IllegalArgumentException) while processing Test.java; message: T
  ; The Checker Framework crashed.  Please report the crash.  Version: Checker Framework 4.3.1-SNAPSHOT, branch master, 2026-10-04, commit 0091b16, dirty=true. 
  Compilation unit: Test.java
  Last visited tree at line 1 column 1:
  class Test<T extends Integer> {
  Exception: java.lang.IllegalArgumentException: T; java.lang.IllegalArgumentException: T
  	at jdk.compiler/com.sun.tools.javac.model.JavacTypes.unboxedType(JavacTypes.java:148)
  	at org.checkerframework.dataflow.cfg.builder.CFGTranslationPhaseOne.binaryPromotedType(CFGTranslationPhaseOne.java:1027)
  	at org.checkerframework.dataflow.cfg.builder.CFGTranslationPhaseOne.visitBinary(CFGTranslationPhaseOne.java:3947)
  	at org.checkerframework.dataflow.cfg.builder.CFGTranslationPhaseOne.visitBinary(CFGTranslationPhaseOne.java:211)
  	at jdk.compiler/com.sun.tools.javac.tree.JCTree$JCBinary.accept(JCTree.java:2230)
  	at org.checkerframework.dataflow.cfg.builder.CFGTranslationPhaseOne.scan(CFGTranslationPhaseOne.java:579)
  	at org.checkerframework.dataflow.cfg.builder.CFGTranslationPhaseOne.visitReturn(CFGTranslationPhaseOne.java:3065)
  	at org.checkerframework.dataflow.cfg.builder.CFGTranslationPhaseOne.visitReturn(CFGTranslationPhaseOne.java:211)
  	at jdk.compiler/com.sun.tools.javac.tree.JCTree$JCReturn.accept(JCTree.java:1780)
  	at org.checkerframework.dataflow.cfg.builder.CFGTranslationPhaseOne.scan(CFGTranslationPhaseOne.java:579)
  	at org.checkerframework.dataflow.cfg.builder.CFGTranslationPhaseOne.visitBlock(CFGTranslationPhaseOne.java:1537)
  	at org.checkerframework.dataflow.cfg.builder.CFGTranslationPhaseOne.visitBlock(CFGTranslationPhaseOne.java:211)
  	at jdk.compiler/com.sun.tools.javac.tree.JCTree$JCBlock.accept(JCTree.java:1148)
  	at org.checkerframework.dataflow.cfg.builder.CFGTranslationPhaseOne.scan(CFGTranslationPhaseOne.java:579)
  	at org.checkerframework.dataflow.cfg.builder.CFGTranslationPhaseOne.process(CFGTranslationPhaseOne.java:478)
  	at org.checkerframework.dataflow.cfg.builder.CFGTranslationPhaseOne.process(CFGTranslationPhaseOne.java:530)
  	at org.checkerframework.framework.flow.CFCFGBuilder.build(CFCFGBuilder.java:71)
  	at org.checkerframework.framework.type.GenericAnnotatedTypeFactory.analyze(GenericAnnotatedTypeFactory.java:1631)
  	at org.checkerframework.framework.type.GenericAnnotatedTypeFactory.performFlowAnalysisForMethod(GenericAnnotatedTypeFactory.java:1514)
  	at org.checkerframework.framework.type.GenericAnnotatedTypeFactory.performFlowAnalysisForClass(GenericAnnotatedTypeFactory.java:1443)
  	at org.checkerframework.framework.type.GenericAnnotatedTypeFactory.performFlowAnalysisForClassOnce(GenericAnnotatedTypeFactory.java:2053)
  	at org.checkerframework.framework.type.GenericAnnotatedTypeFactory.preProcessClassTree(GenericAnnotatedTypeFactory.java:431)
  	at org.checkerframework.common.basetype.BaseTypeVisitor.visitClass(BaseTypeVisitor.java:591)
  	at org.checkerframework.common.basetype.BaseTypeVisitor.visitClass(BaseTypeVisitor.java:197)
  	at jdk.compiler/com.sun.tools.javac.tree.JCTree$JCClassDecl.accept(JCTree.java:899)
  	at jdk.compiler/com.sun.source.util.TreePathScanner.scan(TreePathScanner.java:66)
  	at org.checkerframework.framework.source.SourceVisitor.visit(SourceVisitor.java:88)
  	at org.checkerframework.framework.source.SourceChecker.typeProcess(SourceChecker.java:1395)
  	at org.checkerframework.javacutil.AbstractTypeProcessor$AttributionTaskListener.finished(AbstractTypeProcessor.java:196)
  	at jdk.compiler/com.sun.tools.javac.api.ClientCodeWrapper$WrappedTaskListener.finished(ClientCodeWrapper.java:876)
  	at jdk.compiler/com.sun.tools.javac.api.MultiTaskListener.finished(MultiTaskListener.java:133)
  	at jdk.compiler/com.sun.tools.javac.main.JavaCompiler.flow(JavaCompiler.java:1423)
  	at jdk.compiler/com.sun.tools.javac.main.JavaCompiler.flow(JavaCompiler.java:1380)
  	at jdk.compiler/com.sun.tools.javac.main.JavaCompiler.compile(JavaCompiler.java:968)
  	at jdk.compiler/com.sun.tools.javac.main.Main.compile(Main.java:319)
  	at jdk.compiler/com.sun.tools.javac.main.Main.compile(Main.java:178)
  	at jdk.compiler/com.sun.tools.javac.Main.compile(Main.java:66)
  	at jdk.compiler/com.sun.tools.javac.Main.main(Main.java:52)
2 errors

Investigation

CFGTranslationPhaseOne.binaryPromotedType resolves the upper bound for captured type variables, but passes ordinary type variables directly to Types.unboxedType. Javac's implementation rejects T with IllegalArgumentException, even though its bound is a wrapper class.

Related: #6811 covered a crash involving captured wildcards; this reproducer has no wildcards.

Dominant language: Java
Stars: 1.1k
Forks: 440
Avg merge: 1d 8h
Merged PRs (30d): 149

Getting set up

Read the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

More from typetools/checker-framework

Enforce type declaration bounds
Open
- Is something wrong?
Difficulty 2/5 1-3 hours Newbie friendliness 72/100

typetools/checker-framework#8043 · Opened Aug 21, 2026

Maintainers usually reply within 1 day
Enforce `@TargetLocations`
Possibly taken @w3lld1 claimed this 35 days ago. Open
- Is something wrong?
Difficulty 1/5 Under an hour Newbie friendliness 85/100

typetools/checker-framework#8042 · Opened Aug 21, 2026

Maintainers usually reply within 1 day
isVariableTreeDeclaredUsingVar assumes var types don't have start positions, is broken by changes in JDK-8329951
Open
- Is something wrong?
Difficulty 2/5 1-3 hours Newbie friendliness 68/100

typetools/checker-framework#7096 · 1 comment · Opened Jun 10, 2025

Maintainers usually reply within 1 day
Inference crashes on a chained call whose lambda returns a capture of an F-bounded type argument
Possibly taken @smillst claimed this 2 days ago. Open
- Is something wrong?
crash

typetools/checker-framework#8323 · 1 assignee · Opened Oct 6, 2026

Maintainers usually reply within 1 day
Index Checker crash: "Cannot be negated: a class java.lang.Character" on (char) ('a' + i)
Possibly taken @mernst claimed this 3 days ago. Open
- Is something wrong?
Difficulty 3/5 1-2 days Newbie friendliness 35/100

typetools/checker-framework#8320 · Opened Oct 5, 2026

Maintainers usually reply within 1 day

All issues in typetools/checker-framework

Similar issues

[Bug] AI unread message badge counts a batch of new bubbles as one message
Possibly taken A pull request linked to this issue is open or already merged. Open
- Is something wrong?
Difficulty 2/5 1-3 hours Newbie friendliness 74/100

apache/rocketmq-dashboard#5784 · Opened Oct 9, 2026

Maintainers usually reply within 3 days
[i18n] 安装实例完成后的成功提示未正确本地化
Open
- Is something wrong?
Difficulty 2/5 1-3 hours Newbie friendliness 62/100

PCL-Community/PCL-CE#3658 · Opened Oct 9, 2026

Maintainers usually reply within 1 day
[Bug] BanyanDB backup reports success even when a catalog backup fails
Open
- Is something wrong?
Difficulty 2/5 1-3 hours Newbie friendliness 66/100

apache/skywalking#14127 · Opened Oct 9, 2026

Maintainers usually reply within 1 day
Old testsuite on embedded Undertow: second server start in a JVM fails with "Invalid jboss.server.data.dir"
Open
- Is something wrong?
Difficulty 2/5 1-3 hours Newbie friendliness 82/100

keycloak/keycloak#53771 · Opened Oct 9, 2026

Maintainers usually reply within 1 day
[Feature Request] Request to Support Custom AppRole Mount Path in HashiCorp Vault Connector
Open
- Is something wrong?
Team/Identity Server Core Type/Improvement U2

Difficulty 2/5 1-3 hours Newbie friendliness 62/100

wso2/product-is#28553 · Opened Oct 9, 2026

Maintainers usually reply within 1 day

More Java issues

Crash in CFG construction when unboxing an Integer-bounded type variable

Is something wrong?

Assessment

Research direction

Description

Environment

Input

Actual output

Investigation

Getting set up

First steps

More from typetools/checker-framework

Is something wrong?

Is something wrong?

Is something wrong?

Is something wrong?

Is something wrong?

Similar issues

Is something wrong?

Is something wrong?

Is something wrong?

Is something wrong?

Is something wrong?

Get new issues in your inbox