Capture the type of field accesses

Author: smillst

framework/src/main/java/org/checkerframework/framework/type/TypeFromExpressionVisitor.java

@@ -271,11 +271,11 @@ public AnnotatedTypeMirror visitMemberSelect(MemberSelectTree tree, AnnotatedTyp
       return AnnotatedTypes.asSuper(
           f, thisType, AnnotatedTypeMirror.createType(superTypeMirror, f, false));
     } else {
-      // tree must be a field access, so get the type of the expression, and then call
+      // tree must be a field access, so get the type of the (receiver) expression, and then call
       // asMemberOf.
-      AnnotatedTypeMirror t = f.getAnnotatedType(tree.getExpression());
-      t = f.applyCaptureConversion(t);
-      return AnnotatedTypes.asMemberOf(f.types, f, t, elt).asUse();
+      AnnotatedTypeMirror typeOfReceiver = f.getAnnotatedType(tree.getExpression());
+      typeOfReceiver = f.applyCaptureConversion(typeOfReceiver);
+      return f.applyCaptureConversion(AnnotatedTypes.asMemberOf(f.types, f, typeOfReceiver, elt));
     }
   }
 

framework/tests/all-systems/Issue6825.java

@@ -0,0 +1,12 @@
+@SuppressWarnings("all") // Just check for crashes.
+public class Issue6825 {
+  static class ClassA<T extends Number> {}
+
+  public static boolean flag;
+  ClassA<? super Number> f;
+
+  void method(Number n) {
+    var y = flag ? f : new ClassA<Number>();
+    var x = flag ? this.f : new ClassA<Number>();
+  }
+}