[ASDAlexander77]

Comparing a field of a union-typed object with null or undefined crashed the compiler. The debug build asserts, and the release build fails with an access violation. Found in the BrowserLib sources attached to #231.

interface Circle { kind: "circle"; r: number | null; }
interface Square { kind: "square"; r: number | null; }
function hasR(s: Circle | Square) { return s.r !== null; }   // crashed

Cause

checkSafeCastPropertyAccessLogic narrows discriminated unions such as s.kind === "circle". It checks that the compared value is a constant with isConstValue, then assumes that value is a ConstantOp. But isConstValue is also true for NullOp and UndefOp, so constantOp was null and getValueAttr() dereferenced it.

Fix

• The narrowing now runs only for a real ConstantOp. null and undefined are never discriminant literals, so skipping them loses nothing.
• In the same loop, a field that is missing from one member of the union no longer indexes the tuple with -1 or dereferences a null FieldInfo.

Tests

• New 00safe_cast_null_field.ts (compile, jit, and the rc/none corpus). It compares an interface union's field with null and with undefined, and checks that s.kind === "circle" still narrows. The old build fails it with 0xC0000005.
• Full release suite: 2968/2968 passed.

Not in this PR

These are the other #231 findings, left out on purpose:

• Narrowing in an else branch leaks past the if (a separate crash): next PR.
• Reading a property through a union of object-literal types (type S = {kind:"a"} | {kind:"b"}) fails verification with 'ts.PropertyRef' op operand #0 must be …, even with no null involved. It fails the same way before this change.
• A property of an un-narrowed N | null (h.next !== null) now gets that same verification error instead of crashing. TypeScript in strict mode rejects it too ("possibly null").

🤖 Generated with Claude Code