Complete implementation of bounds checking in the vm, by introducing a vm object

runtime/vm/class_finalizer.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/class_finalizer.h"
 
 #include "vm/flags.h"
 #include "vm/heap.h"
 #include "vm/isolate.h"
 #include "vm/longjump.h"
@@ skipping 47 matching lines @@
       ASSERT(!function.IsNull());
       if (function.HasOptimizedCode()) {
         function.SwitchToUnoptimizedCode();
       }
     }
   }
 #endif
 }
 
 
-void AddSuperType(const Type& type,
+void AddSuperType(const AbstractType& type,
                   GrowableArray<intptr_t>* finalized_super_classes) {
   ASSERT(type.HasResolvedTypeClass());
   if (type.IsObjectType()) {
     return;
   }
   const Class& cls = Class::Handle(type.type_class());
   ASSERT(cls.is_finalized());
   const intptr_t cid = cls.id();
   for (intptr_t i = 0; i < finalized_super_classes->length(); i++) {
     if ((*finalized_super_classes)[i] == cid) {
       // Already added.
       return;
     }
   }
   finalized_super_classes->Add(cid);
-  const Type& super_type = Type::Handle(cls.super_type());
+  const AbstractType& super_type = AbstractType::Handle(cls.super_type());
   AddSuperType(super_type, finalized_super_classes);
 }
 
 
 // Use array instead of set since we expect very few subclassed classes
 // to occur.
 static void CollectFinalizedSuperClasses(
     const GrowableObjectArray& pending_classes,
     GrowableArray<intptr_t>* finalized_super_classes) {
   Class& cls = Class::Handle();
-  Type& super_type = Type::Handle();
+  AbstractType& super_type = Type::Handle();
   for (intptr_t i = 0; i < pending_classes.Length(); i++) {
     cls ^= pending_classes.At(i);
     ASSERT(!cls.is_finalized());
-    super_type ^= cls.super_type();
+    super_type = cls.super_type();
     if (!super_type.IsNull()) {
       if (!super_type.IsMalformed() &&
           super_type.HasResolvedTypeClass() &&
           Class::Handle(super_type.type_class()).is_finalized()) {
         AddSuperType(super_type, finalized_super_classes);
       }
     }
   }
 }
 
@@ skipping 317 matching lines @@
   Type& target_type = Type::Handle(target.RedirectionType());
   Function& target_target = Function::Handle(target.RedirectionTarget());
   if (target_target.IsNull()) {
     ASSERT(target_type.IsMalformed());
   } else {
     // If the target type refers to type parameters, substitute them with the
     // type arguments of the redirection type.
     if (!target_type.IsInstantiated()) {
       const AbstractTypeArguments& type_args = AbstractTypeArguments::Handle(
           type.arguments());
-      target_type ^= target_type.InstantiateFrom(type_args);
-      // TODO(regis): Check bounds in checked mode.
-      target_type ^= FinalizeType(cls, target_type, kCanonicalize);
-      if (target_type.IsMalformed()) {
+      Error& malformed_error = Error::Handle();
+      target_type ^= target_type.InstantiateFrom(type_args, &malformed_error);
+      if (malformed_error.IsNull()) {
+        target_type ^= FinalizeType(cls, target_type, kCanonicalize);
+      } else {
+        FinalizeMalformedType(malformed_error,
+                              cls, target_type, kFinalize,
+                              "cannot resolve redirecting factory");
         target_target = Function::null();
       }
     }
   }
   factory.SetRedirectionType(target_type);
   factory.SetRedirectionTarget(target_target);
 }
 
 
 void ClassFinalizer::ResolveType(const Class& cls,
@@ skipping 46 matching lines @@
     AbstractType& type_argument = AbstractType::Handle();
     for (intptr_t i = 0; i < num_arguments; i++) {
       type_argument = arguments.TypeAt(i);
       ResolveType(cls, type_argument, finalization);
     }
   }
 }
 
 
 void ClassFinalizer::FinalizeTypeParameters(const Class& cls) {
+  // The type parameter bounds are not finalized here.
   const TypeArguments& type_parameters =
       TypeArguments::Handle(cls.type_parameters());
   if (!type_parameters.IsNull()) {
     TypeParameter& type_parameter = TypeParameter::Handle();
     const intptr_t num_types = type_parameters.Length();
     for (intptr_t i = 0; i < num_types; i++) {
       type_parameter ^= type_parameters.TypeAt(i);
       type_parameter ^= FinalizeType(cls,
                                      type_parameter,
                                      kCanonicalizeWellFormed);
@@ skipping 13 matching lines @@
 // Example:
 //   Declared: class C<K, V> extends B<V> { ... }
 //             class B<T> extends A<int> { ... }
 //   Input:    C<String, double> expressed as
 //             cls = C, arguments = [null, null, String, double],
 //             i.e. cls_args = [String, double], offset = 2, length = 2.
 //   Output:   arguments = [int, double, String, double]
 void ClassFinalizer::FinalizeTypeArguments(
     const Class& cls,
     const AbstractTypeArguments& arguments,
-    FinalizationKind finalization) {
+    FinalizationKind finalization,
+    Error* bound_error) {
   ASSERT(arguments.Length() >= cls.NumTypeArguments());
   if (!cls.is_finalized()) {
     FinalizeTypeParameters(cls);
   }
-  Type& super_type = Type::Handle(cls.super_type());
+  AbstractType& super_type = AbstractType::Handle(cls.super_type());
   if (!super_type.IsNull()) {
     const Class& super_class = Class::Handle(super_type.type_class());
     AbstractTypeArguments& super_type_args = AbstractTypeArguments::Handle();
     if (super_type.IsBeingFinalized()) {
       // This type references itself via its type arguments. This is legal, but
       // we must avoid endless recursion. We therefore map the innermost
       // super type to dynamic.
       // Note that a direct self-reference via the super class chain is illegal
       // and reported as an error earlier.
       // Such legal self-references occur with F-bounded quantification.
@@ skipping 13 matching lines @@
     }
     const intptr_t num_super_type_params = super_class.NumTypeParameters();
     const intptr_t offset = super_class.NumTypeArguments();
     const intptr_t super_offset = offset - num_super_type_params;
     ASSERT(offset == (cls.NumTypeArguments() - cls.NumTypeParameters()));
     AbstractType& super_type_arg = AbstractType::Handle(Type::DynamicType());
     for (intptr_t i = 0; i < num_super_type_params; i++) {
       if (!super_type_args.IsNull()) {
         super_type_arg = super_type_args.TypeAt(super_offset + i);
         if (!super_type_arg.IsInstantiated()) {
-          super_type_arg = super_type_arg.InstantiateFrom(arguments);
+          Error& malformed_error = Error::Handle();
+          super_type_arg = super_type_arg.InstantiateFrom(arguments,
+                                                          &malformed_error);
+          if (!malformed_error.IsNull()) {
+            if (!super_type_arg.IsInstantiated()) {
+              // CheckTypeArgumentBounds will insert a BoundedType.
+            } else if (bound_error->IsNull()) {
+              *bound_error = malformed_error.raw();
+            }
+          }
         }
         if (finalization >= kCanonicalize) {
           super_type_arg = super_type_arg.Canonicalize();
         }
       }
       arguments.SetTypeAt(super_offset + i, super_type_arg);
     }
-    FinalizeTypeArguments(super_class, arguments, finalization);
+    FinalizeTypeArguments(super_class, arguments, finalization, bound_error);
+  }
+}
+
+
+// Check the type argument vector 'arguments' against the corresponding bounds
+// of the type parameters of class 'cls' and, recursively, of its superclasses.
+// Replace a type argument that cannot be checked at compile time by a
+// BoundedType, thereby postponing the bound check to run time.
+// Return a bound error if a type argument is not within bound at compile time.
+void ClassFinalizer::CheckTypeArgumentBounds(
+    const Class& cls,
+    const AbstractTypeArguments& arguments,
+    Error* bound_error) {
+  if (!cls.is_finalized()) {
+    ResolveAndFinalizeUpperBounds(cls);
+  }
+  // Note that when finalizing a type, we need to verify the bounds in both
+  // production mode and checked mode, because the finalized type may be written
+  // to a snapshot. It would be wrong to ignore bounds when generating the
+  // snapshot in production mode and then use the unchecked type in checked mode
+  // after reading it from the snapshot.
+  // However, we do not immediately report a bound error, which would be wrong
+  // in production mode, but simply postpone the bound checking to runtime.
+  const intptr_t num_type_params = cls.NumTypeParameters();
+  const intptr_t offset = cls.NumTypeArguments() - num_type_params;
+  AbstractType& type_arg = AbstractType::Handle();
+  AbstractType& cls_type_param = AbstractType::Handle();
+  AbstractType& bound = AbstractType::Handle();
+  const TypeArguments& cls_type_params =
+      TypeArguments::Handle(cls.type_parameters());
+  ASSERT((cls_type_params.IsNull() && (num_type_params == 0)) ||
+         (cls_type_params.Length() == num_type_params));
+  for (intptr_t i = 0; i < num_type_params; i++) {
+    type_arg = arguments.TypeAt(offset + i);
+    if (type_arg.IsDynamicType()) {
+      continue;
+    }
+    cls_type_param = cls_type_params.TypeAt(i);
+    const TypeParameter& type_param = TypeParameter::Cast(cls_type_param);
+    ASSERT(type_param.IsFinalized());
+    bound = type_param.bound();
+    if (!bound.IsObjectType() && !bound.IsDynamicType()) {
+      Error& malformed_error = Error::Handle();
+      // Note that the bound may be malformed, in which case the bound check
+      // will return an error and the bound check will be postponed to run time.
+      // Note also that the bound may still be unfinalized.
+      if (!bound.IsFinalized()) {
+        ASSERT(bound.IsBeingFinalized());
+        // The bound refers to type parameters, creating a cycle; postpone
+        // bound check to run time, when the bound will be finalized.
+        // TODO(regis): Do we need to instantiate an uninstantiated bound here?
+        type_arg = BoundedType::New(type_arg, bound, type_param);
+        arguments.SetTypeAt(offset + i, type_arg);
+        continue;
+      }
+      if (!bound.IsInstantiated()) {
+        bound = bound.InstantiateFrom(arguments, &malformed_error);
+      }
+      // TODO(regis): We could simplify this code if we could differentiate
+      // between a failed bound check and a bound check that is undecidable at
+      // compile time.
+      if (malformed_error.IsNull()) {
+        type_param.CheckBound(type_arg, bound, &malformed_error);
+      }
+      if (!malformed_error.IsNull()) {
+        if (!type_arg.IsInstantiated() || !bound.IsInstantiated()) {
+          type_arg = BoundedType::New(type_arg, bound, type_param);
+          arguments.SetTypeAt(offset + i, type_arg);
+        } else if (bound_error->IsNull()) {
+          *bound_error = malformed_error.raw();
+        }
+      }
+    }
+  }
+  AbstractType& super_type = AbstractType::Handle(cls.super_type());
+  if (!super_type.IsNull()) {
+    const Class& super_class = Class::Handle(super_type.type_class());
+    CheckTypeArgumentBounds(super_class, arguments, bound_error);
   }
 }
 
 
 RawAbstractType* ClassFinalizer::FinalizeType(const Class& cls,
                                               const AbstractType& type,
                                               FinalizationKind finalization) {
   if (type.IsFinalized()) {
     // Ensure type is canonical if canonicalization is requested, unless type is
     // malformed.
@@ skipping 22 matching lines @@
     ASSERT(!parameterized_class.IsNull());
     // The index must reflect the position of this type parameter in the type
     // arguments vector of its parameterized class. The offset to add is the
     // number of type arguments in the super type, which is equal to the
     // difference in number of type arguments and type parameters of the
     // parameterized class.
     const intptr_t offset = parameterized_class.NumTypeArguments() -
                             parameterized_class.NumTypeParameters();
     type_parameter.set_index(type_parameter.index() + offset);
     type_parameter.set_is_finalized();
-    // TODO(regis): We are not able to finalize the bound here without getting
-    // into cycles. Revisit.
     // We do not canonicalize type parameters.
     return type_parameter.raw();
   }
 
   // At this point, we can only have a parameterized_type.
   const Type& parameterized_type = Type::Cast(type);
 
   if (parameterized_type.IsBeingFinalized()) {
     // Self reference detected. The type is malformed.
     FinalizeMalformedType(
@@ skipping 69 matching lines @@
         Error::Handle(),  // No previous error.
         cls, parameterized_type, finalization,
         "wrong number of type arguments in type '%s'",
         String::Handle(parameterized_type.UserVisibleName()).ToCString());
     return parameterized_type.raw();
   }
   // The full type argument vector consists of the type arguments of the
   // super types of type_class, which may be initialized from the parsed
   // type arguments, followed by the parsed type arguments.
   TypeArguments& full_arguments = TypeArguments::Handle();
+  Error& bound_error = Error::Handle();
   if (num_type_arguments > 0) {
     // If no type arguments were parsed and if the super types do not prepend
     // type arguments to the vector, we can leave the vector as null.
     if (!arguments.IsNull() || (num_type_arguments > num_type_parameters)) {
       full_arguments = TypeArguments::New(num_type_arguments);
       // Copy the parsed type arguments at the correct offset in the full type
       // argument vector.
       const intptr_t offset = num_type_arguments - num_type_parameters;
       AbstractType& type_arg = AbstractType::Handle(Type::DynamicType());
       for (intptr_t i = 0; i < num_type_parameters; i++) {
@@ skipping 11 matching lines @@
       // of its signature function and no super type is involved.
       // If the signature class is canonical (not an alias), the owner of its
       // signature function may either be an alias or the enclosing class of a
       // local function, in which case the super type of the enclosing class is
       // also considered when filling up the argument vector.
       if (type_class.IsSignatureClass()) {
         const Function& signature_fun =
             Function::Handle(type_class.signature_function());
         ASSERT(!signature_fun.is_static());
         const Class& sig_fun_owner = Class::Handle(signature_fun.Owner());
-        FinalizeTypeArguments(sig_fun_owner, full_arguments, finalization);
+        FinalizeTypeArguments(
+            sig_fun_owner, full_arguments, finalization, &bound_error);
+        CheckTypeArgumentBounds(sig_fun_owner, full_arguments, &bound_error);
       } else {
-        FinalizeTypeArguments(type_class, full_arguments, finalization);
+        FinalizeTypeArguments(
+            type_class, full_arguments, finalization, &bound_error);
+        CheckTypeArgumentBounds(type_class, full_arguments, &bound_error);
       }
       if (full_arguments.IsRaw(num_type_arguments)) {
         // The parameterized_type is raw. Set its argument vector to null, which
         // is more efficient in type tests.
         full_arguments = TypeArguments::null();
       } else if (finalization >= kCanonicalize) {
         // FinalizeTypeArguments can modify 'full_arguments',
         // canonicalize afterwards.
         full_arguments ^= full_arguments.Canonicalize();
       }
       parameterized_type.set_arguments(full_arguments);
     } else {
       ASSERT(full_arguments.IsNull());  // Use null vector for raw type.
     }
   }
 
   // Self referencing types may get finalized indirectly.
   if (!parameterized_type.IsFinalized()) {
     // Mark the type as finalized.
     parameterized_type.SetIsFinalized();
   }
 
-  // Upper bounds of the finalized type arguments are only verified in checked
-  // mode, since bound errors are never reported by the vm in production mode.
-  if (FLAG_enable_type_checks &&
-      !full_arguments.IsNull() &&
-      full_arguments.IsInstantiated()) {
-    ResolveAndFinalizeUpperBounds(type_class);
-    Error& malformed_error = Error::Handle();
-    // Pass the full type argument vector as the bounds instantiator.
-    if (!full_arguments.IsWithinBoundsOf(type_class,
-                                         full_arguments,
-                                         &malformed_error)) {
-      ASSERT(!malformed_error.IsNull());
-      // The type argument vector of the type is not within bounds. The type
-      // is malformed. Prepend malformed_error to new malformed type error in
-      // order to report both locations.
-      // Note that malformed bounds never result in a compile time error, even
-      // in checked mode. Therefore, overwrite finalization with kFinalize
-      // when finalizing the malformed type.
-      FinalizeMalformedType(
-          malformed_error,
-          cls, parameterized_type, kFinalize,
-          "type arguments of type '%s' are not within bounds",
-          String::Handle(parameterized_type.UserVisibleName()).ToCString());
-      return parameterized_type.raw();
-    }
-  }
-
   // If the type class is a signature class, we are currently finalizing a
   // signature type, i.e. finalizing the result type and parameter types of the
   // signature function of this signature type.
   // We do this after marking this type as finalized in order to allow a
   // function type to refer to itself via its parameter types and result type.
   if (type_class.IsSignatureClass()) {
     // The class may be created while parsing a function body, after all
     // pending classes have already been finalized.
     FinalizeClass(type_class);
   }
 
+  // If a bound error occurred, return a BoundedType with a malformed bound.
+  // The malformed bound will be ignored in production mode.
+  if (!bound_error.IsNull()) {
+    FinalizationKind bound_finalization = kTryResolve;  // No compile error.
+    if (FLAG_enable_type_checks || FLAG_error_on_malformed_type) {
+      bound_finalization = finalization;
+    }
+    const String& parameterized_type_name = String::Handle(
+        parameterized_type.UserVisibleName());
+    const Type& malformed_bound = Type::Handle(
+        NewFinalizedMalformedType(bound_error,
+                                  cls,
+                                  parameterized_type.token_pos(),
+                                  bound_finalization,
+                                  "type '%s' has an out of bound type argument",
+                                  parameterized_type_name.ToCString()));
+    return BoundedType::New(parameterized_type,
+                            malformed_bound,
+                            TypeParameter::Handle());
+  }
+
   if (finalization >= kCanonicalize) {
     return parameterized_type.Canonicalize();
   } else {
     return parameterized_type.raw();
   }
 }
 
 
 void ClassFinalizer::ResolveAndFinalizeSignature(const Class& cls,
                                                  const Function& function) {
@@ skipping 276 matching lines @@
   const Class& mixin_cls = Class::Handle(mixin_type.type_class());
 
   if (FLAG_trace_class_finalization) {
     OS::Print("Applying mixin '%s' to '%s'\n",
               String::Handle(mixin_cls.Name()).ToCString(),
               cls.ToCString());
   }
 
   // Check that the super class of the mixin class is extending
   // class Object.
-  const Type& mixin_super_type = Type::Handle(mixin_cls.super_type());
+  const AbstractType& mixin_super_type =
+      AbstractType::Handle(mixin_cls.super_type());
   if (!mixin_super_type.IsObjectType()) {
     const Script& script = Script::Handle(cls.script());
     const String& class_name = String::Handle(mixin_cls.Name());
     ReportError(script, cls.token_pos(),
                 "mixin class %s must extend class Object",
                 class_name.ToCString());
   }
 
   // Copy the type parameters of the mixin class to the mixin
   // application class.
@@ skipping 95 matching lines @@
   }
   if (cls.mixin() != Type::null()) {
     // Copy instance methods and fields from the mixin class.
     // This has to happen before the check whether the methods of
     // the class conflict with inherited methods.
     ApplyMixin(cls);
   }
   // Finalize type parameters before finalizing the super type.
   FinalizeTypeParameters(cls);
   // Finalize super type.
-  Type& super_type = Type::Handle(cls.super_type());
+  AbstractType& super_type = AbstractType::Handle(cls.super_type());
   if (!super_type.IsNull()) {
-    super_type ^= FinalizeType(cls, super_type, kCanonicalizeWellFormed);
+    // In case of a bound error in the super type in production mode, the
+    // finalized super type will be a BoundedType with a malformed bound.
+    // It should not be a problem if the class is written to a snapshot and
+    // later executed in checked mode. Note that the finalized type argument
+    // vector of any type of the base class will contain a BoundedType for the
+    // out of bound type argument.
+    super_type = FinalizeType(cls, super_type, kCanonicalizeWellFormed);
     cls.set_super_type(super_type);
   }
   if (cls.IsSignatureClass()) {
     // Check for illegal self references.
     GrowableArray<intptr_t> visited_aliases;
     if (!IsAliasCycleFree(cls, &visited_aliases)) {
       const String& name = String::Handle(cls.Name());
       const Script& script = Script::Handle(cls.script());
       ReportError(script, cls.token_pos(),
                   "typedef '%s' illegally refers to itself",
                   name.ToCString());
     }
     cls.Finalize();
     // Signature classes extend Object. No need to add this class to the direct
     // subclasses of Object.
     ASSERT(super_type.IsNull() || super_type.IsObjectType());
 
+    // The type parameters of signature classes may have bounds.
+    ResolveAndFinalizeUpperBounds(cls);
+
     // Resolve and finalize the result and parameter types of the signature
     // function of this signature class.
     const Function& sig_function = Function::Handle(cls.signature_function());
     ResolveAndFinalizeSignature(cls, sig_function);
 
     // Resolve and finalize the signature type of this signature class.
     const Type& sig_type = Type::Handle(cls.SignatureType());
     FinalizeType(cls, sig_type, kCanonicalizeWellFormed);
     return;
   }
   // Finalize interface types (but not necessarily interface classes).
   Array& interface_types = Array::Handle(cls.interfaces());
   AbstractType& interface_type = AbstractType::Handle();
   for (intptr_t i = 0; i < interface_types.Length(); i++) {
     interface_type ^= interface_types.At(i);
     interface_type = FinalizeType(cls, interface_type, kCanonicalizeWellFormed);
     interface_types.SetAt(i, interface_type);
   }
   // Mark as finalized before resolving type parameter upper bounds and member
   // types in order to break cycles.
   cls.Finalize();
+  // Finalize bounds even if running in production mode, so that a snapshot
+  // contains them.
   ResolveAndFinalizeUpperBounds(cls);
   ResolveAndFinalizeMemberTypes(cls);
   // Run additional checks after all types are finalized.
   if (cls.is_const()) {
     CheckForLegalConstClass(cls);
   }
   // Add this class to the direct subclasses of the superclass, unless the
   // superclass is Object.
   if (!super_type.IsNull() && !super_type.IsObjectType()) {
     ASSERT(!super_class.IsNull());
@@ skipping 88 matching lines @@
       const String& class_name = String::Handle(cls.Name());
       const Script& script = Script::Handle(cls.script());
       ReportError(script, cls.token_pos(),
                   "cyclic reference found for class '%s'",
                   class_name.ToCString());
     }
   }
 
   // If the class/interface has no explicit super class/interfaces
   // and is not a mixin application, we are done.
-  Type& super_type = Type::Handle(cls.super_type());
+  AbstractType& super_type = AbstractType::Handle(cls.super_type());
   Type& mixin_type = Type::Handle(cls.mixin());
   Array& super_interfaces = Array::Handle(cls.interfaces());
   if ((super_type.IsNull() || super_type.IsObjectType()) &&
       (super_interfaces.Length() == 0) &&
       (mixin_type.IsNull())) {
     return;
   }
 
   if (!mixin_type.IsNull()) {
     ResolveType(cls, mixin_type, kCanonicalizeWellFormed);
@@ skipping 159 matching lines @@
   const String& class_name = String::Handle(cls.Name());
   OS::Print("class '%s'", class_name.ToCString());
   const Library& library = Library::Handle(cls.library());
   if (!library.IsNull()) {
     OS::Print(" library '%s%s':\n",
               String::Handle(library.url()).ToCString(),
               String::Handle(library.private_key()).ToCString());
   } else {
     OS::Print(" (null library):\n");
   }
-  const Type& super_type = Type::Handle(cls.super_type());
+  const AbstractType& super_type = AbstractType::Handle(cls.super_type());
   if (super_type.IsNull()) {
     OS::Print("  Super: NULL");
   } else {
     const String& super_name = String::Handle(super_type.Name());
     OS::Print("  Super: %s", super_name.ToCString());
   }
   const Array& interfaces_array = Array::Handle(cls.interfaces());
   if (interfaces_array.Length() > 0) {
     OS::Print("; interfaces: ");
     AbstractType& interface = AbstractType::Handle();
@@ skipping 38 matching lines @@
           script, type.token_pos(), "Error", format, args);
     } else {
       error ^= Parser::FormatErrorWithAppend(
           prev_error, script, type.token_pos(), "Error", format, args);
     }
     if ((finalization == kCanonicalizeWellFormed) ||
         FLAG_error_on_malformed_type) {
       ReportError(error);
     }
   }
+  // In checked mode, always mark the type as malformed.
+  // In production mode, mark the type as malformed only if its type class is
+  // not resolved.
+  // In both mode, make the type raw, since it may not be possible to
+  // properly finalize its type arguments.
   if (FLAG_enable_type_checks || !type.HasResolvedTypeClass()) {
-    // In check mode, always mark the type as malformed.
-    // In production mode, mark the type as malformed only if its type class is
-    // not resolved.
     type.set_malformed_error(error);
-    if (!type.HasResolvedTypeClass()) {
-      // We do not want an unresolved class to end up in a snapshot.
-      type.set_type_class(Object::Handle(Object::null_class()));
-    }
-  } else {
-     // In production mode, do not mark the type with a resolved type class as
-     // malformed, but make it raw.
-    type.set_arguments(AbstractTypeArguments::Handle());
   }
-  ASSERT(type.HasResolvedTypeClass());
+  type.set_arguments(AbstractTypeArguments::Handle());
   if (!type.IsFinalized()) {
     type.SetIsFinalized();
     // Do not canonicalize malformed types, since they may not be resolved.
   } else {
     // The only case where the malformed type was already finalized is when its
     // type arguments are not within bounds. In that case, we have a prev_error.
     ASSERT(!prev_error.IsNull());
   }
 }
 
 
 RawType* ClassFinalizer::NewFinalizedMalformedType(
     const Error& prev_error,
     const Class& cls,
     intptr_t type_pos,
     FinalizationKind finalization,
     const char* format, ...) {
   va_list args;
   va_start(args, format);
   const UnresolvedClass& unresolved_class = UnresolvedClass::Handle(
       UnresolvedClass::New(LibraryPrefix::Handle(),
                            Symbols::Empty(),
                            type_pos));
   const Type& type = Type::Handle(
       Type::New(unresolved_class, TypeArguments::Handle(), type_pos));
   ReportMalformedType(prev_error, cls, type, finalization, format, args);
   va_end(args);
   ASSERT(type.IsMalformed());
+  ASSERT(type.IsFinalized());
   return type.raw();
 }
 
 
 void ClassFinalizer::FinalizeMalformedType(const Error& prev_error,
                                            const Class& cls,
                                            const Type& type,
                                            FinalizationKind finalization,
                                            const char* format, ...) {
   va_list args;
@@ skipping 24 matching lines @@
 void ClassFinalizer::ReportError(const char* format, ...) {
   va_list args;
   va_start(args, format);
   const Error& error = Error::Handle(
       Parser::FormatError(Script::Handle(), -1, "Error", format, args));
   va_end(args);
   ReportError(error);
 }
 
 }  // namespace dart