Lifted null comparison decompiles to HasValue/GetValueOrDefault with a '? true : false'

[siegfriedpammer]

Input code

SixLabors.ImageSharp 4.1.1, SixLabors.ImageSharp.Formats.Png.PngEncoderCore.WriteXmpChunk (and
WriteExifChunk, same shape):

ilspycmd ~/.cache/nugetfuzz/sixlabors.imagesharp/4.1.1/lib/net8.0/SixLabors.ImageSharp.dll \
    -t SixLabors.ImageSharp.Formats.Png.PngEncoderCore

Erroneous output

Current master (dbf23c6):

byte[] data = meta.XmpProfile.Data;
int? num = data?.Length;
if ((num ?? 0) == 0)
{
    return;
}

With #4091 (6fcb387) the lifted comparison is expanded and wrapped in a no-op conditional:

byte[] data = meta.XmpProfile.Data;
int? num = data?.Length;
if ((!num.HasValue || num.GetValueOrDefault() == 0) ? true : false)
{
    return;
}

Two separate things happen here: the ?? form is lost, and the resulting bool expression gains a
? true : false.

Other instances from the same corpus run (top-200 nuget.org packages, #4091 against its merge base):

• Swashbuckle.AspNetCore.SwaggerGen 10.2.3, XmlCommentsRequestBodyFilter:
  if ((num2 ?? 1) == 0 || num == 0) becomes
  if ((num2.HasValue && num2.GetValueOrDefault() == 0) || num == 0)
• OpenTelemetry.Exporter.OpenTelemetryProtocol serializer:
  ((statusCode ?? StatusCode.Unset) != StatusCode.Unset) becomes
  (statusCode.HasValue && statusCode.GetValueOrDefault() != StatusCode.Unset)

Details

• Product in use: ICSharpCode.Decompiler, built from source
• Version in use: not reproducible on master (dbf23c6); measured at 6fcb387 against merge base
  712ad1a. Three types in the corpus are affected; the output remains correct.

Filed by an AI agent (Claude) on Siegfried's behalf.

[Sadik00789]

@siegfriedpammer I've opened a PR with the fix and regression test coverage for this issue.

Root Cause

Commit c760a1d62 (from PR #4091) narrowed the comp(x != 0) simplification in ExpressionTransforms.VisitComp to trigger only when InferType is boolean or matches constants 0/1.

In the reported methods (e.g., SixLabors.ImageSharp's PngEncoderCore.WriteXmpChunk), inst.Left is a call to GetValueOrDefault() returning Int32 inside an IfInstruction condition slot. Because comp(call GetValueOrDefault() != 0) was no longer simplified to its operand:

1. NullableLiftingTransform failed to match the candidate AST tree, falling back to explicit HasValue / GetValueOrDefault() expansion.
2. The unreduced conditional escaped through to the output visitor as the redundant ? true : false ternary wrapper.

Fix

Re-allowed condition-slot simplification in ExpressionTransforms.VisitComp when inst.Left is not IfInstruction:

|| (IfInstruction.IsInConditionSlot(inst) && inst.Left is not IfInstruction)

This retains the invariant introduced in c760a1d62 (preventing int-valued conditionals like flag ? 2 : 0 from truncating to boolean values) while restoring expected reduction for non-IfInstruction integer expressions in condition slots. The ? true : false artifact disappears naturally downstream.

Validation

• Tested against SixLabors.ImageSharp 4.1.1 and Swashbuckle.AspNetCore.SwaggerGen 10.2.3 packages — decompiled output matches the pre-Split StackType.O into StackType.Obj+StackType.VT #4091 baseline cleanly.
• Added regression tests in TestCases/Pretty/Issue4136.cs covering zero-fallbacks, non-zero fallbacks, enum fallbacks, and null-conditional propagation (registered in PrettyTestRunner.cs), along with evaluation coverage in TestCases/Correctness/Comparisons.cs.