NilAway: Practical Nil Panic Detection for Go

Summary

NilAway is Uber’s static analyzer for detecting potential nil pointer dereferences in Go before they reach production, where nil panics have caused incorrect behavior, outages, and denial-of-service risks. It models nilability flows as global typing constraints over struct fields, function parameters, and return values, builds an implication graph, and uses 2-SAT-style reasoning with forward nilness and backward nonnil propagation to identify contradictions. The analysis is interprocedural, requires no developer annotations, and reports detailed flows, while acknowledging false positives when runtime invariants are not captured. In one Uber service logging more than 3,000 nil panics daily, NilAway identified a receive-from-closed-channel path; adding a nilness check reduced the reported panics to zero, and the tool was released as open source with comprehensive and changed-code onboarding options.

Takeaways

1. 1

   NilAway identifies contradictions where a witnessed nil value flows to a site requiring a nonnil value, then reports the detailed path from the nil source to the dereference.

2. 2

   The analysis can produce false positives when subtle interprocedural execution invariants prevent a nil flow at runtime, although the source reports a low false-positive rate in practice.

3. 3

   In a service logging more than 3,000 nil panics per day, NilAway found a receive-from-closed-channel path; adding a nilness check reduced the reported panics to zero.