Nullable arrays are supported by marshalling code, but never demarshaled as NULL

is_nullable_type() defines ARRAY as a nullable type, and TEST(connection_marshal_nullables) tests marshaling of the ?a. It doesn't seem to have a test for demarshalling, however.

wl_closure_marshal allows serializing where args[i].a == NULL if arg.nullable. And serialize_closure sends this as a length of 0. But wl_connection_demarshal never demarshals anything as a NULL wl_array. This would be interpreted as a non-null zero length array.

This differs from ?s, where NULL is a zero-length array, and "" is a 1-element array containing just NUL. I don't see any way the wire protocol could make such a distinction for arrays.

Nullable array arguments don't seem to be used anywhere than I can find, except a rather old commented out use in plasma-shell.

If my understanding is correct, is_nullable_type() should be changed to not treat arrays as a nullable type. This could also be better documented. As is, the documentation doesn't mention which types are nullable. Nor does the wire format documention mention how NULL is represented.