Kotlin: Fix findTopLevelPropertyOrWarn for K2 compiler

[david-allison]

Note

Assisted-by: Claude Opus 4.8 - diagnostics & initial fix

• Fixes False positive "use of implicit PendingIntents" alert #20153 (1/2 bugs)
  • Either bugfix fix would close the issue
  • K2 also broke or PendingIntent.FLAG_IMMUTABLE - see the issue for more details
• Fixes https://github.com/ankidroid/Anki-Android/security/code-scanning/35
• Mirrors Kotlin: Fix findTopLevelFunctionOrWarn for Kotlin 2 #14835

---

Receiver::class.java resolves differently from K1:

• K1: getJavaClass(KClass) - value argument
• K2: KClass.<get-java>() - property receiver

This caused the lookup to fail, so Intent(context, Receiver::class.java) dropped the second argument.

"Couldn't find JVM intrinsic property kotlin.jvm java in kotlin.jvm.JvmClassMappingKt"

This caused false positives in java/android/implicit-pendingintents

[andersfugmann]

Thanks for submitting
The approach and solution is sound and looks good. Also thanks for adding tests.

I added one comment on making the filter slightly more readable.

If you could address that comment and rebase on latest main, this will be good to merge.

[david-allison]

I added one comment on making the filter slightly more readable.

Hi @andersfugmann, thanks for the review. I don't see your comment in the GitHub UI, could you send a link? (Presumably for KotlinFileExtractor.kt‎, but I'd want to be certain).

I'll try and get to this before the weekend. Thanks again

[andersfugmann]

My bad. Forgot to submit the comment :-)

[andersfugmann]

Internal tests shows no blockers to merge; small reduction in alerts on java/android/implicit-pendingintents and java/local-variable-is-never-read and an increase in alerts on java/jdk-internal-api-access as a result of improved flow.

[andersfugmann]

Thanks for addressing the comments. All tests looks good.
Thank you for your contribution.