Fix this longstanding bug that luckily did not bite us yet: Use Class.prototype.foo$bailout.call(th…

sdk/lib/_internal/compiler/implementation/js_backend/namer.dart

 // Copyright (c) 2011, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 part of js_backend;
 
 /**
  * Assigns JavaScript identifiers to Dart variables, class-names and members.
  */
 class Namer {
@@ skipping 17 matching lines @@
    */
   final Compiler compiler;
   final Map<Element, String> globals;
   final Map<String, LibraryElement> shortPrivateNameOwners;
   final Set<String> usedGlobalNames;
   final Set<String> usedInstanceNames;
   final Map<String, String> instanceNameMap;
   final Map<String, String> globalNameMap;
   final Map<String, int> popularNameCounters;
 
+  /**
+   * A cache of names used for bailout methods. We make sure two
+   * bailout methods cannot have the same name because if the two
+   * bailout methods are in a class and a subclass, we would
+   * call the wrong bailout method at runtime. To make it
+   * simple, we don't keep track of inheritance and always avoid
+   * similar names.
+   */
+  final Set<String> usedBailoutInstanceNames;
+  final Map<Element, String> bailoutNames;
+
   final Map<Constant, String> constantNames;
 
   Namer(this.compiler)
       : globals = new Map<Element, String>(),
         shortPrivateNameOwners = new Map<String, LibraryElement>(),
+        bailoutNames = new Map<Element, String>(),
+        usedBailoutInstanceNames = new Set<String>(),
         usedGlobalNames = new Set<String>(),
         usedInstanceNames = new Set<String>(),
         instanceNameMap = new Map<String, String>(),
         globalNameMap = new Map<String, String>(),
         constantNames = new Map<Constant, String>(),
         popularNameCounters = new Map<String, int>();
 
   String get ISOLATE => 'Isolate';
   String get ISOLATE_PROPERTIES => r'$isolateProperties';
-  /** Some closures must contain their name. The name is stored in
-    * [STATIC_CLOSURE_NAME_NAME]. */
+  /**
+   * Some closures must contain their name. The name is stored in
+   * [STATIC_CLOSURE_NAME_NAME].
+   */
   String get STATIC_CLOSURE_NAME_NAME => r'$name';
   SourceString get CLOSURE_INVOCATION_NAME => Compiler.CALL_OPERATOR_NAME;
   bool get shouldMinify => false;
 
   bool isReserved(String name) => name == ISOLATE;
 
   String constantName(Constant constant) {
     // In the current implementation it doesn't make sense to give names to
     // function constants since the function-implementation itself serves as
     // constant and can be accessed directly.
@@ skipping 232 matching lines @@
     } else if (element.isLibrary()) {
       name = LIBRARY_PREFIX;
     } else {
       name = element.name.slowToString();
     }
     // Prefix the name with '$' if it is reserved.
     return name;
   }
 
   String getBailoutName(Element element) {
+    String name = bailoutNames[element];
+    if (name != null) return name;
     bool global = !element.isInstanceMember();
-    var unminifiedName = '${getName(element)}\$bailout';
+    String unminifiedName = '${getName(element)}\$bailout';
     if (global) {
-      return getMappedGlobalName(unminifiedName);
+      name = getMappedGlobalName(unminifiedName);
     } else {
-      return getMappedInstanceName(unminifiedName);
+      name = unminifiedName;
+      int i = 0;
+      while (usedBailoutInstanceNames.contains(name)) {
+        name = '$unminifiedName${i++}';
+      }
+      name = getMappedInstanceName(name);
+      usedBailoutInstanceNames.add(name);
     }
+    bailoutNames[element] = name;
+    return name;
   }
 
   /**
    * Returns a preferred JS-id for the given element. The returned id is
    * guaranteed to be a valid JS-id. Globals and static fields are furthermore
    * guaranteed to be unique.
    *
    * For accessing statics consider calling
    * [isolateAccess]/[isolateBailoutAccess] or [isolatePropertyAccess] instead.
    */
@@ skipping 84 matching lines @@
   }
 
   String safeName(String name) {
     if (jsReserved.contains(name) || name.startsWith('\$')) {
       name = "\$$name";
       assert(!jsReserved.contains(name));
     }
     return name;
   }
 }