fix(go): a call through a local bound from a type assertion reaches the asserted type's method

[colbymchenry]

Problem

Receiver inference reads v := T{}, var v T and parameters, but never a local bound from a type assertion. #2444 resolved a call made through the assertion itself (x.(T).M()), but the more common shape binds the value first:

if flusher, ok := w.(http.Flusher); ok {
	flusher.Flush() // went to a project type's Flush, by name
}
wr := v.(*Wrapper)
wr.job.Start() // linked to nothing

Such calls went to whichever project method name matching picked, or nowhere. etcd's fi.Action() after fi := s.kvindex.(*fakeIndex) linked to nothing. grpc-go's currBal.waitForClose() after currBal := gsb.balancerCurrent.Balancer.(*mockBalancer) went to buildCallbackBal::waitForClose, and simpleResp.GetPayload() on a *testpb.SimpleResponse went to SimpleRequest::GetPayload.

Fix

• A Go local has the asserted type when its declaration in scope at the call binds a type assertion's value (v := x.(T), v, ok := x.(T), var v, _ = x.(T)). The type is found where Go finds it, with the lookup fix(go): a call through a type assertion reaches the asserted type's method #2444 uses: the own package or a dot import for a bare T, the imported project package for pkg.T, aliases followed. Calls, method values (register(st.Fetch)) and field chains (wr.job.Start()) through the local reach the type's own method, its interface's, or one promoted by embedding.

• The binding comes from fix(go): a dotted call is written through its own receiver, and a local named like an import is that variable #2448's scope reader:

  • an if header's binding ends with its statement;
  • a nearer declaration in a block that has ended doesn't hide it;
  • a comment declares nothing.

  A type switch's variable, an assignment to an already-declared variable (st = v.(*sink)) and a value that only starts with an assertion (x.(T).field) resolve as before.

• A type from outside the project, a predeclared type (error) or an alias of an outside type links nothing, as for the assertion itself.

• Some types the index can't tell: a type literal (interface{ GetDeadline() time.Time }), or a type declared inside a function (grpc-go's internalInfo and grpcstatus). Calls through those are left to name matching, as before. The chain form x.(interface{…}).M() keeps fix(go): a call through a type assertion reaches the asserted type's method #2444's "nothing", because its bare-name ref gives name matching no receiver to go on.

• A local bound from an assertion and named like a standard-library package (parser, ok := builder.(balancer.ConfigParser)) is no longer dropped by the built-in filter as a call into go/parser.

Validation

Each repo was fully indexed with main and with this branch, and every call or method-value site whose edges differ was compared. The comparison ran on b635dd4, the branch's base before it was rebased onto 0951105. The seven commits in between touch C++, React/JS, sync and context code, and no Go resolution.

Repo	Changed sites	Newly linked	Retargeted	Same target, now through T	Dropped
etcd	57	29	0	22	6
harbor	48	33	4	10	1
kratos	45	30	0	15	0
grpc-go	208	124	34	42	8
total	358	216	38	89	15

An oracle independent of the resolver classified every changed site: a brace-depth scan for the binding in scope, with T located through the repos' go.mod files and imports. Sites whose target isn't owned by T itself (field chains, embedding) were checked by hand against the declarations.

• Added and retargeted (254 sites): every one lands on T's method, or for a field chain on the field type's method:

  • etcd b.tx.Action() → testutil.Recorder::Action, through fakeBatchTx's embedded Recorder;
  • grpc-go conn.CloseCh.Receive() → testutils.Channel::Receive;
  • harbor a.client.GetClient() → common_http.Client::GetClient;
  • grpc-go's 21 parser.ParseConfig(…) calls now reach balancer.ConfigParser::ParseConfig.

  Retargets in grpc-go include mockBalancer/verifyBalancer (16, from buildCallbackBal), SimpleResponse::GetPayload (6, from SimpleRequest), alts.AuthInfo::PeerRPCVersions (4, from the internal altsAuthInfo) and balancer.ClientConn::ResolveNow (4, from ccBalancerWrapper).

• Dropped (15 sites): each was a link through a type from outside the project, or a field read linked to a function:

  • HTTP/2 frame types (hf.StreamEnded() → parsedDataFrame::StreamEnded);
  • syscall.WaitStatus and *descriptorpb.EnumValueOptions in etcd;
  • harbor's robotVal.String() → CreateRobotEvent::String;
  • field reads tv.CreateRevision → the clientv3.CreateRevision function, and onFinishOpt.OnFinish → grpc.OnFinish.

  Four are netErr.Timeout() through net.Error in grpc-go's bufconn tests. There the error does come from bufconn's own netErrorTimeout, but as with fix(go): a call through a type assertion reaches the asserted type's method #2444's x.(net.Error).Timeout(), a method of an outside interface is not guessed.

• Left to name matching, unchanged from main:

  • 11 grpc-go calls through inline or function-local interfaces, all reaching the one implementer (ci.GetCommonAuthInfo() → CommonAuthInfo::GetCommonAuthInfo);
  • 2 in harbor: w.WithArtifactDigest(…) → vuln.Report, which is right, and wrappedErr.Unwrap() through interface{ Unwrap() []error } → ErrImmutable::Unwrap() error, which is wrong, as it was before.

Tests

__tests__/go-asserted-locals.test.ts, on both the kernel and wasm extraction paths, covers:

• outside, predeclared and alias-of-outside types;
• own, embedded and qualified types, generics, aliases and dot imports;
• field chains, method values, assignment to a declared variable, scoping (if headers, ended blocks, comments, type switches) and same-name decoys in other packages;
• type literals and function-local types left to name matching;
• a local named parser.

A mutation check fails exactly the two new cases on both backends. Disabling the fall-back to name matching fails one; disabling the standard-library exemption fails the other. The 56 test files that index Go pass.

Notes

• Overlap: fix(go): a project package named like a standard-library package is not the standard library #2368 (open) rewrites the same standard-library check in isBuiltInOrExternal. Whichever lands second keeps both conditions.
• Not covered: a local named like a standard-library package that is not bound from an assertion is still dropped by that filter. Examples are grpc-go's parser := bb{} (3 sites) and gin's context.AbortWithError, a gap noted in fix(go): a dotted call is written through its own receiver, and a local named like an import is that variable #2448.

🤖 Generated with Claude Code