Add Null type support across AST, IR, and type checker.

Signed-off-by: Cong Wang <cwang@multikernel.io>

Author: congwang-mk

src/ast.ml

@@ -90,6 +90,8 @@ and bpf_type =
   | Ringbuf of bpf_type * int (* value_type, size - ring buffer object *)
   (* None type - represents missing/absent values *)
   | NoneType
+  (* Null type - represents null pointers, compatible with any pointer type *)
+  | Null
 
 (** Map configuration *)
 type map_config = {
@@ -644,6 +646,7 @@ let rec string_of_bpf_type = function
   | RingbufRef value_type -> Printf.sprintf "ringbuf_ref<%s>" (string_of_bpf_type value_type)
   | Ringbuf (value_type, size) -> Printf.sprintf "ringbuf<%s>(%d)" (string_of_bpf_type value_type) size
   | NoneType -> "none"
+  | Null -> "null"
 
 let rec string_of_literal = function
   | IntLit (i, original_opt) -> 

src/ir.ml

@@ -732,7 +732,8 @@ let rec ast_type_to_ir_type = function
   | ProgramHandle -> IRI32 (* Program handles are represented as file descriptors (i32) in IR to support error codes *)
   | Ringbuf (value_type, size) -> IRRingbuf (ast_type_to_ir_type value_type, size) (* Ring buffer object *)
   | RingbufRef _ -> IRU32 (* Ring buffer references are represented as pointers/handles (u32) in IR *)
-  | NoneType -> IRU32 (* None type represented as u32 sentinel value in IR *)
+  | NoneType -> IRU32  (* None type represented as u32 sentinel value in IR *)
+  | Null -> IRPointer (IRU32, {min_size = Some 0; max_size = Some 0; alignment = 1; nullable = true})  (* Null is represented as a nullable pointer in IR *)
 
 (* Helper function that preserves type aliases when converting AST types to IR types *)
 let rec ast_type_to_ir_type_with_context symbol_table ast_type =

src/type_checker.ml

@@ -312,16 +312,18 @@ let rec unify_types t1 t2 =
        | Some unified -> Some (Array (unified, s1))
        | None -> None)
 
-  (* Pointer types - any pointer can be null *)
+  (* Null type unification - null can unify with any pointer or function type *)
+  | Null, Pointer t -> Some (Pointer t)  (* null unifies with any pointer *)
+  | Pointer t, Null -> Some (Pointer t)  (* any pointer unifies with null *)
+  | Null, Function (params, ret) -> Some (Function (params, ret))  (* null unifies with functions *)
+  | Function (params, ret), Null -> Some (Function (params, ret))  (* functions unify with null *)
+  
+  (* Pointer types *)
   | Pointer t1, Pointer t2 ->
       (match unify_types t1 t2 with
        | Some unified -> Some (Pointer unified)
        | None -> None)
 
-  (* Special case: null pointer (Pointer U32) can unify with any function type *)
-  | Pointer U32, Function (params, ret) -> Some (Function (params, ret))
-  | Function (params, ret), Pointer U32 -> Some (Function (params, ret))
-  
   (* Result types *)
   | Result (ok1, err1), Result (ok2, err2) ->
       (match unify_types ok1 ok2, unify_types err1 err2 with
@@ -430,7 +432,7 @@ let type_check_literal lit pos =
         Str (max 1 len)  (* At least size 1 to handle empty strings *)
     | CharLit _ -> Char
     | BoolLit _ -> Bool
-    | NullLit -> Pointer U32  (* null literal as nullable pointer, can be unified with any pointer type *)
+    | NullLit -> Null  (* null literal - can unify with any pointer or function type *)
     | NoneLit -> NoneType  (* none literal represents missing/absent values *)
     | ArrayLit init_style ->
         (* Handle enhanced array literal type checking *)
@@ -1080,7 +1082,8 @@ and type_check_binary_op ctx left op right pos =
         (match resolved_left_type, resolved_right_type with
          | Str _, Str _ -> Bool  (* Allow string comparison regardless of size *)
          (* Null comparisons - any type can be compared with null *)
-         | _, Pointer _ | Pointer _, _ -> Bool
+         | Null, _ | _, Null -> Bool  (* Direct null comparisons *)
+         | _, Pointer _ | Pointer _, _ -> Bool  (* Pointer comparisons (legacy) *)
          (* None comparisons - allow with map access expressions or variables that could contain map results *)
          | NoneType, _ | _, NoneType -> 
              (* Check if at least one operand is a map access or could reasonably be a map result *)