Fix result type checking of redirecting factory in checked mode (issue 6596).

runtime/vm/parser.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/parser.h"
 
 #include "vm/bigint_operations.h"
 #include "vm/class_finalizer.h"
 #include "vm/compiler.h"
 #include "vm/compiler_stats.h"
@@ skipping 9061 matching lines @@
 AstNode* Parser::ParseNewOperator() {
   TRACE_PARSER("ParseNewOperator");
   const intptr_t new_pos = TokenPos();
   ASSERT((CurrentToken() == Token::kNEW) || (CurrentToken() == Token::kCONST));
   bool is_const = (CurrentToken() == Token::kCONST);
   ConsumeToken();
   if (!IsIdentifier()) {
     ErrorMsg("type name expected");
   }
   intptr_t type_pos = TokenPos();
-  AbstractType& type = AbstractType::ZoneHandle(
+  AbstractType& type = AbstractType::Handle(
       ParseType(ClassFinalizer::kCanonicalizeForCreation));
   // In case the type is malformed, throw a dynamic type error after finishing
   // parsing the instance creation expression.
   if (type.IsTypeParameter() || type.IsDynamicType()) {
     ASSERT(!type.IsMalformed());
     // Replace the type with a malformed type.
     type = ClassFinalizer::NewFinalizedMalformedType(
         Error::Handle(),  // No previous error.
         current_class(),
         type_pos,
@@ skipping 113 matching lines @@
       constructor_class_name = factory_class.Name();
     }
     // Always change the result type of the constructor to the factory type.
     constructor_class = factory_class.raw();
     // The finalized type_arguments are still those of the interface type.
     ASSERT(!constructor_class.is_interface());
   }
 
   // An additional type check of the result of a redirecting factory may be
   // required.
-  bool check_result_type = false;
+  AbstractType& type_bound = AbstractType::ZoneHandle();
 
   // Make sure that an appropriate constructor exists.
   const String& constructor_name =
       BuildConstructorName(constructor_class_name, named_constructor);
   Function& constructor = Function::ZoneHandle(
       constructor_class.LookupConstructor(constructor_name));
   if (constructor.IsNull()) {
     constructor = constructor_class.LookupFactory(constructor_name);
     if (constructor.IsNull()) {
       const String& external_constructor_name =
@@ skipping 20 matching lines @@
         // type arguments of the parsed type of the 'new' or 'const' expression.
         redirect_type ^= redirect_type.InstantiateFrom(type_arguments);
       }
       if (redirect_type.IsMalformed()) {
         if (is_const) {
           const Error& error = Error::Handle(redirect_type.malformed_error());
           ErrorMsg(error);
         }
         return ThrowTypeError(redirect_type.token_pos(), redirect_type);
       }
-      check_result_type =
-          FLAG_enable_type_checks && !redirect_type.IsSubtypeOf(type, NULL);
+      if (FLAG_enable_type_checks && !redirect_type.IsSubtypeOf(type, NULL)) {
+        // Additional type checking of the result is necessary.
+        type_bound = type.raw();
+      }
       type = redirect_type.raw();
       type_class = type.type_class();
       type_arguments = type.arguments();
       constructor = constructor.RedirectionTarget();
       ASSERT(!constructor.IsNull());
       constructor_class = constructor.Owner();
       ASSERT(type_class.raw() == constructor_class.raw());
     }
     if (constructor.IsFactory()) {
       // A factory does not have the implicit 'phase' parameter.
@@ skipping 95 matching lines @@
         EvaluateConstConstructorCall(constructor_class,
                                      type_arguments,
                                      constructor,
                                      arguments));
     if (constructor_result.IsUnhandledException()) {
       new_object = GenerateRethrow(new_pos, constructor_result);
     } else {
       const Instance& const_instance = Instance::Cast(constructor_result);
       new_object = new LiteralNode(new_pos,
                                    Instance::ZoneHandle(const_instance.raw()));
-      if (check_result_type) {
-        ASSERT(!type.IsMalformed());
+      if (!type_bound.IsNull()) {
+        ASSERT(!type_bound.IsMalformed());
         Error& malformed_error = Error::Handle();
-        if (!const_instance.IsInstanceOf(type,
+        if (!const_instance.IsInstanceOf(type_bound,
                                          TypeArguments::Handle(),
                                          &malformed_error)) {
-          type = ClassFinalizer::NewFinalizedMalformedType(
+          type_bound = ClassFinalizer::NewFinalizedMalformedType(
               malformed_error,
               current_class(),
               new_pos,
               ClassFinalizer::kTryResolve,  // No compile-time error.
               "const factory result is not an instance of '%s'",
-              String::Handle(type.UserVisibleName()).ToCString());
-          new_object = ThrowTypeError(new_pos, type);
+              String::Handle(type_bound.UserVisibleName()).ToCString());
+          new_object = ThrowTypeError(new_pos, type_bound);
         }
-        check_result_type = false;
+        type_bound = AbstractType::null();
       }
     }
   } else {
     CheckFunctionIsCallable(new_pos, constructor);
     CheckConstructorCallTypeArguments(new_pos, constructor, type_arguments);
     if (!type_arguments.IsNull() &&
         !type_arguments.IsInstantiated() &&
         (current_block_->scope->function_level() > 0)) {
       // Make sure that the instantiator is captured.
       CaptureInstantiator();
     }
     // If the type argument vector is not instantiated, we verify in checked
     // mode at runtime that it is within its declared bounds.
     new_object = CreateConstructorCallNode(
         new_pos, type_arguments, constructor, arguments);
   }
-  if (check_result_type) {
+  if (!type_bound.IsNull()) {
     const String& dst_name = String::ZoneHandle(Symbols::FactoryResult());
-    new_object = new AssignableNode(new_pos, new_object, type, dst_name);
+    new_object = new AssignableNode(new_pos, new_object, type_bound, dst_name);
   }
   return new_object;
 }
 
 
 String& Parser::Interpolate(ArrayNode* values) {
   const String& class_name = String::Handle(Symbols::StringBase());
   const Class& cls = Class::Handle(LookupCoreClass(class_name));
   ASSERT(!cls.IsNull());
   const String& func_name = String::Handle(Symbols::Interpolate());
@@ skipping 590 matching lines @@
 void Parser::SkipQualIdent() {
   ASSERT(IsIdentifier());
   ConsumeToken();
   if (CurrentToken() == Token::kPERIOD) {
     ConsumeToken();  // Consume the kPERIOD token.
     ExpectIdentifier("identifier expected after '.'");
   }
 }
 
 }  // namespace dart