From 9ddddd86e18a0047d131d896ed1b1acf9cb582a4 Mon Sep 17 00:00:00 2001
From: Rahul Krishna <i.m.ralk@gmail.com>
Date: Tue, 29 Sep 2026 14:27:22 -0400
Subject: [PATCH] fix(artifacts): a non-identifier view-dispatch target is not
 a dataflow variable, not a NullPointerException

ViewDispatches.resolve() ran the intra-procedural dataflow tier on
s.varName() unguarded, but Site.varName() returns null for any dispatch
target that is not a bare identifier -- a call expression like
`return String.valueOf(count);` inside a @RestController, as seen in
Robot Shop's shipping service (Controller.count()). Spring entrypoint
detection does not yet distinguish @RestController from @Controller
(SpringEntrypointFinder.isEntrypointClass matches on
annotation.getNameAsString().contains("Controller")), so a REST
endpoint's String return is still gated into the view-name tier. That
null then reached DataflowTiers.intra and crashed in
IntraTier.reachingLiteral's `var.equals(edge.getVar())` at analysis
level >= 3. The very next tier down (interprocAll, L4) already guards
the identical null with `s.varName() == null ? null : ...` -- the L3
call was just missing the equivalent check.

Guarded `var == null` at the shared DataflowTiers.intra choke point
rather than only at the call site, so any future caller is protected
too. Added ViewNameDispatchTest.aNonIdentifierReturnExpressionStaysNonLiteralInsteadOfCrashing,
reproducing the exact Robot Shop shape, and
ViewDispatchDataflowTierTest.aCallExpressionTargetStaysNonLiteralInsteadOfCrashing
for the analogous dispatcher-call-site shape; both reproduce the NPE
on the old code and pass with the guard. Full suite: 606 tests, only
the Docker-only integration test unrun (no local Docker daemon).

Separately, @RestController return values are HTTP response bodies,
not Spring view names -- conflating them with @Controller in
SpringEntrypointFinder is a real semantic gap, left untouched here
since it changes detection scope rather than just fixing the crash.
---
 .../com/ibm/cldk/artifacts/DataflowTiers.java |  3 ++-
 .../ViewDispatchDataflowTierTest.java         | 15 +++++++++++
 .../cldk/artifacts/ViewNameDispatchTest.java  | 26 +++++++++++++++++++
 3 files changed, 43 insertions(+), 1 deletion(-)

diff --git a/src/main/java/com/ibm/cldk/artifacts/DataflowTiers.java b/src/main/java/com/ibm/cldk/artifacts/DataflowTiers.java
index 1e823745..d6fa8758 100644
--- a/src/main/java/com/ibm/cldk/artifacts/DataflowTiers.java
+++ b/src/main/java/com/ibm/cldk/artifacts/DataflowTiers.java
@@ -65,7 +65,8 @@ private static void collect(Map<String, JType> types, String source, Map<String,
 
     /** L3: the one literal every reaching definition of {@code var} closes on at {@code useLocalId}. */
     static String intra(Owner owner, String useLocalId, String var) {
-        if (owner == null || owner.callable.getDdg() == null || owner.source == null) {
+        if (owner == null || var == null || owner.callable.getDdg() == null
+                || owner.source == null) {
             return null;
         }
         return IntraTier.reachingLiteral(owner.callable, owner.source, useLocalId, var);
diff --git a/src/test/java/com/ibm/cldk/artifacts/ViewDispatchDataflowTierTest.java b/src/test/java/com/ibm/cldk/artifacts/ViewDispatchDataflowTierTest.java
index c6660e94..aa58c586 100644
--- a/src/test/java/com/ibm/cldk/artifacts/ViewDispatchDataflowTierTest.java
+++ b/src/test/java/com/ibm/cldk/artifacts/ViewDispatchDataflowTierTest.java
@@ -83,6 +83,21 @@ void aLocalClosesOverTheDdgAtLevelThree() throws Exception {
         assertTrue(r.unresolved.isEmpty());
     }
 
+    // A dispatcher target that is neither a literal nor a bare identifier (a call expression) used
+    // to NPE in the dataflow tier: `Site.varName()` returns null for this shape too, and the tier
+    // dereferenced it unguarded.
+    @Test
+    void aCallExpressionTargetStaysNonLiteralInsteadOfCrashing() throws Exception {
+        ViewDispatches.Result r = run(HEAD
+                + "  void doGet(HttpServletRequest req, HttpServletResponse res) {\n"
+                + "    req.getRequestDispatcher(computePage()).forward(req, res);\n"
+                + "  }\n"
+                + "  String computePage() { return \"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/pages/x.jsp\"; }\n"
+                + "}\n", 3);
+        assertTrue(r.dispatches.isEmpty());
+        assertEquals("non-literal", only(r).getReason());
+    }
+
     @Test
     void twoDisagreeingDefinitionsStayNonLiteral() throws Exception {
         ViewDispatches.Result r = run(HEAD
diff --git a/src/test/java/com/ibm/cldk/artifacts/ViewNameDispatchTest.java b/src/test/java/com/ibm/cldk/artifacts/ViewNameDispatchTest.java
index 0652df8b..7f85c74d 100644
--- a/src/test/java/com/ibm/cldk/artifacts/ViewNameDispatchTest.java
+++ b/src/test/java/com/ibm/cldk/artifacts/ViewNameDispatchTest.java
@@ -34,6 +34,9 @@ private ViewDispatches.Result run(String controller, String properties, String..
             throws Exception {
         ServletApiStubs.write(root, "src/main/java/org/springframework/stereotype/Controller.java",
                 "package org.springframework.stereotype;\npublic @interface Controller {}\n");
+        ServletApiStubs.write(root,
+                "src/main/java/org/springframework/web/bind/annotation/RestController.java",
+                "package org.springframework.web.bind.annotation;\npublic @interface RestController {}\n");
         ServletApiStubs.write(root,
                 "src/main/java/org/springframework/web/bind/annotation/GetMapping.java",
                 "package org.springframework.web.bind.annotation;\n"
@@ -136,4 +139,27 @@ void aViewNameWithNoTemplateIsNoSuchArtifact() throws Exception {
         assertEquals("missing", r.unresolved.get(0).getTarget());
         assertEquals("view-name", r.unresolved.get(0).getVia());
     }
+
+    // Robot Shop's shipping service: a `@RestController`'s `return String.valueOf(x)` is
+    // still gated into the view-name tier (the entrypoint check does not yet distinguish
+    // `@RestController` from `@Controller`) and the target is neither a literal nor a bare
+    // identifier, so `Site.varName()` is null. That null used to reach `DataflowTiers.intra`
+    // unguarded and NPE in `IntraTier.reachingLiteral`; it must instead just stay unresolved.
+    @Test
+    void aNonIdentifierReturnExpressionStaysNonLiteralInsteadOfCrashing() throws Exception {
+        ViewDispatches.Result r = run(
+                "package demo;\n"
+                        + "import org.springframework.web.bind.annotation.RestController;\n"
+                        + "import org.springframework.web.bind.annotation.GetMapping;\n"
+                        + "@RestController\npublic class Home {\n"
+                        + "  @GetMapping(\"/count\") public String count() {\n"
+                        + "    long n = 10;\n"
+                        + "    return String.valueOf(n);\n"
+                        + "  }\n}\n",
+                null);
+        assertTrue(r.dispatches.isEmpty());
+        assertEquals(1, r.unresolved.size());
+        assertEquals("non-literal", r.unresolved.get(0).getReason());
+        assertEquals("view-name", r.unresolved.get(0).getVia());
+    }
 }