Fix crash when Nullable<T> creation takes dynamic argument (#38647)

src/Compilers/CSharp/Portable/FlowAnalysis/NullableWalker.cs

@@ -1712,6 +1712,7 @@ public override BoundNode VisitObjectCreationExpression(BoundObjectCreationExpre
             return null;
         }
 
+#nullable enable
         private void VisitObjectOrDynamicObjectCreation(
             BoundExpression node,
             ImmutableArray<BoundExpression> arguments,
@@ -1724,9 +1725,9 @@ public override BoundNode VisitObjectCreationExpression(BoundObjectCreationExpre
             var argumentTypes = argumentResults.SelectAsArray(ar => ar.RValueType);
 
             int slot = -1;
-            TypeSymbol type = node.Type;
-            NullableFlowState resultState = NullableFlowState.NotNull;
-            if ((object)type != null)
+            var type = node.Type;
+            var resultState = NullableFlowState.NotNull;
+            if (type is object)
             {
                 slot = GetOrCreatePlaceholderSlot(node);
                 if (slot > 0)
@@ -1737,7 +1738,7 @@ public override BoundNode VisitObjectCreationExpression(BoundObjectCreationExpre
                     if (EmptyStructTypeCache.IsTrackableStructType(type))
                     {
                         var tupleType = constructor?.ContainingType as TupleTypeSymbol;
-                        if ((object)tupleType != null && !isDefaultValueTypeConstructor)
+                        if (tupleType is object && !isDefaultValueTypeConstructor)
                         {
                             // new System.ValueTuple<T1, ..., TN>(e1, ..., eN)
                             TrackNullableStateOfTupleElements(slot, tupleType, arguments, argumentTypes, useRestField: true);
@@ -1758,7 +1759,7 @@ public override BoundNode VisitObjectCreationExpression(BoundObjectCreationExpre
                             // a nullable value type created with its default constructor is by definition null
                             resultState = NullableFlowState.MaybeNull;
                         }
-                        else if (constructor.ParameterCount == 1)
+                        else if (constructor?.ParameterCount == 1)
                         {
                             // if we deal with one-parameter ctor that takes underlying, then Value state is inferred from the argument.
                             var parameterType = constructor.ParameterTypesWithAnnotations[0];
@@ -1785,6 +1786,7 @@ public override BoundNode VisitObjectCreationExpression(BoundObjectCreationExpre
 
             SetResultType(node, TypeWithState.Create(type, resultState));
         }
+#nullable restore
 
         private void VisitObjectCreationInitializer(Symbol containingSymbol, int containingSlot, BoundExpression node)
         {

src/Compilers/CSharp/Test/Semantic/Semantics/NullableReferenceTypesTests.cs

@@ -102676,6 +102676,27 @@ static void F()
                 Diagnostic(ErrorCode.WRN_NullReferenceReceiver, "z.Value.F").WithLocation(20, 9));
         }
 
+        [Fact, WorkItem(38575, "https://github.com/dotnet/roslyn/issues/38575")]
+        public void NullableCtor_Dynamic()
+        {
+            var source = @"
+using System;
+
+class C
+{
+    void M()
+    {
+        var value = GetValue((dynamic)"""");
+        _ = new DateTime?(value);
+    }
+
+    DateTime GetValue(object o) => default;
+}
+";
+            var comp = CreateCompilation(source, options: WithNonNullTypesTrue());
+            comp.VerifyDiagnostics();
+        }
+
         [Fact]
         public void NullableT_AlwaysTrueOrFalse()
         {