A union of pointer types stores null in its pointer, not as a member

[ASDAlexander77]

The rule

A class or a string holds null in its own pointer. That's why Class | null is stored as just the class, with | null kept on the type only so that strict-null code can allow or refuse assigning null. This PR applies the same rule to unions of several such types:

Union	Stored as	Null is
Class | null	the class (unchanged)	a null pointer
A | B | null, string | A | null	tagged A | B (was null | A | B)	a null pointer in whichever member
boolean | A | null, string | number | null	tagged, with its own null member (unchanged)	the null member (0 can't stand for null)

The declared type keeps null under strict null checks, so assigning null is still allowed or refused as before.

What this fixes

A null A widened to A | B | null crashed === null, truth tests and ??: each went through a generated cast whose instanceof read the vtable through the null pointer. Printing an A | B | null (${u}) didn't compile in strict mode ("can't cast from 'null' to 'string'"). This also closes the gap #540 left for unions with several classes.

Changes

• Type rule (MLIRTypeHelper): needsNullMember is false when every non-null member absorbs null (isNullAbsorbingType: class, string, array, object, opaque). The merged path of getUnionTypeMergeTypes no longer adds null to the storage type (disableStrickNullCheck) in strict mode; the non-merged path already worked that way. The storage layout doesn't change, because null and the absorbing members are all pointer-sized.
• === null / != null: syncUnionTypes no longer casts a tagged union to null through a generated cast before comparing. LogicOp compares the union directly: by its tag when the actual type (from isUnionTypeNeedsTag) has a null member, otherwise by the first word of its value field.
• Generated union cast (castFromUnion): for such a union it first asks if (t === null), so no member test meets a null instance. The result is false for a truth test, "null" for text, null where the target accepts null, and otherwise the same throw the function ends with. A union of null and several types can be tested for truth #540's one-class special case is removed; between A null class, string or array widened to a union becomes its null member #546 and this check, a class member never sees a null pointer.
• CastLogicHelper (A null class, string or array widened to a union becomes its null member #546) uses the shared MLIRTypeHelper::isNullAbsorbingType.

Unchanged: typeof of a null held this way says class, which is what it already says for a Class | null holding null.

Testing

• New 00union_null_in_pointer.ts (compile + JIT + rc/none corpus): a widened null and a literal null in A | B | null (=== null, != null, truth test, ??, narrowing by !== null, as text), non-null values, and string | A | null (null, empty string, text, class). It passes under gc, rc and none. On current main it fails to compile (can't cast from 'null' to 'string').
• Full ctest: 3976/3976 pass. That includes typeGuardFunction.ts, which caught a first version of the null check that returned null to a B | C | A target.

🤖 Generated with Claude Code