Handle interaction of captured types and library models

nullaway/src/main/java/com/uber/nullaway/generics/TypeSubstitutionUtils.java

@@ -100,6 +100,21 @@ public static Type restoreExplicitNullabilityAnnotations(
         .visit(newType, origType);
   }
 
+  /**
+   * Returns a copy of {@code type} with {@code wildcard} as its backing wildcard.
+   *
+   * <p>The copy is necessary because javac capture types can be shared across attributed types.
+   */
+  public static Type.CapturedType replaceCapturedTypeWildcard(
+      Type.CapturedType type, Type.WildcardType wildcard) {
+    Type.CapturedType updated =
+        (Type.CapturedType)
+            TYPE_METADATA_BUILDER.cloneTypeWithMetadata(
+                type, TYPE_METADATA_BUILDER.create(type.getAnnotationMirrors()));
+    updated.wildcard = wildcard;
+    return updated;
+  }
+
   /**
    * Updates a type {@code typeToUpdate} by applying inferred nullability for type variables. The
    * update proceeds in three steps:
@@ -339,9 +354,27 @@ public Type visitTypeVar(Type.TypeVar t, Type other) {
       return updateDirectNullabilityAnnotationsForType(t, other);
     }
 
+    /**
+     * Restores annotations on both the captured type {@code t} and its backing wildcard.
+     *
+     * <p>The corresponding type {@code other} may be an ordinary wildcard because javac can
+     * capture-convert {@code t} without capture-converting {@code other}. In such cases, the
+     * annotation on the bound of {@code other} should be restored to the bound of the wildcard
+     * corresponding to {@code t}.
+     */
     @Override
     public Type visitCapturedType(Type.CapturedType t, Type other) {
-      return updateDirectNullabilityAnnotationsForType(t, other);
+      Type updated = updateDirectNullabilityAnnotationsForType(t, other);
+      Type.WildcardType otherWildcard = GenericsUtils.asWildcard(other);
+      if (otherWildcard == null) {
+        return updated;
+      }
+      Type.WildcardType updatedWildcard =
+          (Type.WildcardType) t.wildcard.accept(this, otherWildcard);
+      if (updatedWildcard == t.wildcard) {
+        return updated;
+      }
+      return replaceCapturedTypeWildcard((Type.CapturedType) updated, updatedWildcard);
     }
 
     @Override

nullaway/src/main/java/com/uber/nullaway/librarymodel/AddAnnotationToNestedTypeVisitor.java

@@ -2,6 +2,7 @@
 
 import static com.uber.nullaway.generics.TypeMetadataBuilder.TYPE_METADATA_BUILDER;
 
+import com.google.common.base.Verify;
 import com.google.common.collect.ImmutableList;
 import com.sun.tools.javac.code.BoundKind;
 import com.sun.tools.javac.code.Type;
@@ -99,11 +100,11 @@ public Type visitWildcardType(Type.WildcardType t, Integer pathIndex) {
     if (entry.kind() != NestedAnnotationInfo.TypePathEntry.Kind.WILDCARD_BOUND) {
       return t;
     }
-    int boundIndex = entry.index();
-    if (t.type == null) {
+    if (t.kind == BoundKind.UNBOUND) {
       // TODO we need to add logic to _introduce_ a bound if none exists (add follow-up issue)
       return t;
     }
+    int boundIndex = entry.index();
     if (boundIndex == 0 && t.kind == BoundKind.EXTENDS) {
       Type newBound = t.type.accept(this, pathIndex + 1);
       return newBound == t.type ? t : TYPE_METADATA_BUILDER.createWildcardType(t, newBound);
@@ -115,6 +116,34 @@ public Type visitWildcardType(Type.WildcardType t, Integer pathIndex) {
     return t;
   }
 
+  /**
+   * Updates a captured type while preserving the backing wildcard used by NullAway's wildcard-bound
+   * reasoning.
+   *
+   * <p>javac represents a captured wildcard as a type variable plus its original wildcard. A direct
+   * annotation on the capture is insufficient because effective-bound computations unwrap the
+   * backing wildcard, so updates must be reflected there.
+   */
+  @Override
+  public Type visitCapturedType(Type.CapturedType t, Integer pathIndex) {
+    Type.WildcardType updatedWildcard;
+    if (pathIndex < typePath.size()) {
+      updatedWildcard = (Type.WildcardType) t.wildcard.accept(this, pathIndex);
+    } else {
+      Verify.verify(pathIndex == typePath.size(), "path index out of bounds");
+      if (t.wildcard.kind == BoundKind.UNBOUND) {
+        // Do not turn javac's placeholder bound for an unbounded wildcard into an explicit bound.
+        return t;
+      }
+      Type updatedBound = TypeSubstitutionUtils.typeWithAnnot(t.wildcard.type, annotationType);
+      updatedWildcard = TYPE_METADATA_BUILDER.createWildcardType(t.wildcard, updatedBound);
+    }
+    if (updatedWildcard == t.wildcard) {
+      return t;
+    }
+    return TypeSubstitutionUtils.replaceCapturedTypeWildcard(t, updatedWildcard);
+  }
+
   @Override
   public Type visitType(Type t, Integer pathIndex) {
     if (pathIndex == typePath.size()) {

test-java-lib/src/main/java/com/uber/lib/unannotated/NestedAnnots.java

@@ -3,6 +3,10 @@
 /* @NullMarked */
 @SuppressWarnings("DoNotCallSuggester")
 public class NestedAnnots<T /* extends @Nullable Object */> {
+  public NestedAnnots<T> self() {
+    return this;
+  }
+
   public static <T /* extends @Nullable Object */> NestedAnnots<T> genericMethod(
       Class</* @NonNull */ T> clazz) {
     return new NestedAnnots<>();
@@ -22,6 +26,10 @@ public static void wildcardUpper(NestedAnnots<? extends /* @NonNull */ String> t
 
   public static void wildcardLower(NestedAnnots<? super /* @Nullable */ String> t) {}
 
+  public NestedAnnots<? extends /* @Nullable */ T> wildcardUpperTypeVariable() {
+    throw new RuntimeException();
+  }
+
   public static void multipleArgs(
       NestedAnnots<String> t1, NestedAnnots</* @Nullable */ Integer> t2) {}
 }

test-library-models/src/main/java/com/uber/nullaway/testlibrarymodels/TestLibraryModels.java

@@ -253,6 +253,15 @@ public ImmutableSetMultimap<MethodRef, Integer> methodTypeVariablesWithNullableU
                     ImmutableList.of(
                         new TypePathEntry(TYPE_ARGUMENT, 0),
                         new TypePathEntry(WILDCARD_BOUND, 1)))))
+        .put(
+            methodRef("com.uber.lib.unannotated.NestedAnnots", "wildcardUpperTypeVariable()"),
+            ImmutableSetMultimap.of(
+                -1,
+                new NestedAnnotationInfo(
+                    Annotation.NULLABLE,
+                    ImmutableList.of(
+                        new TypePathEntry(TYPE_ARGUMENT, 0),
+                        new TypePathEntry(WILDCARD_BOUND, 0)))))
         .put(
             methodRef(
                 "com.uber.lib.unannotated.NestedAnnots",

test-library-models/src/test/java/com/uber/nullaway/CustomLibraryModelsTests.java

@@ -569,6 +569,34 @@ void testLower(NestedAnnots<String> t) {
         .doTest();
   }
 
+  @Test
+  public void nestedWildcardWithCapturedTypeVariableBound() {
+    makeLibraryModelsTestHelperWithArgs(
+            JSpecifyJavacConfig.withJSpecifyModeArgs(
+                Arrays.asList(
+                    "-d",
+                    temporaryFolder.getRoot().getAbsolutePath(),
+                    "-XepOpt:NullAway:OnlyNullMarked=true")))
+        .addSourceLines(
+            "Test.java",
+            """
+            import com.uber.lib.unannotated.NestedAnnots;
+            import org.jspecify.annotations.*;
+            @NullMarked
+            public class Test {
+              NestedAnnots<? extends String> test(
+                  NestedAnnots<? extends String> receiver) {
+                // should reject since return type of wildcardUpperTypeVariable
+                // is modeled to be NestedAnnots<? extends @Nullable T>, which
+                // here is incompatible with the return type NestedAnnots<? extends String>
+                // BUG: Diagnostic contains: incompatible types
+                return receiver.self().wildcardUpperTypeVariable();
+              }
+            }
+            """)
+        .doTest();
+  }
+
   @Test
   public void multipleArgs() {
     makeLibraryModelsTestHelperWithArgs(