Issue a strong mode warning for type inference that is unsafe with AST-based summaries.

pkg/analyzer/lib/src/task/strong/checker.dart

 // Copyright (c) 2015, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 // TODO(jmesserly): this was ported from package:dev_compiler, and needs to be
 // refactored to fit into analyzer.
 library analyzer.src.task.strong.checker;
 
 import 'package:analyzer/analyzer.dart';
 import 'package:analyzer/dart/ast/ast.dart';
@@ skipping 362 matching lines @@
 
   @override
   void visitForStatement(ForStatement node) {
     if (node.condition != null) {
       checkBoolean(node.condition);
     }
     node.visitChildren(this);
   }
 
   @override
+  void visitFunctionExpression(FunctionExpression node) {
+    _checkForUnsafeBlockClosureInference(node);
+    super.visitFunctionExpression(node);
+  }
+
+  @override
   void visitFunctionExpressionInvocation(FunctionExpressionInvocation node) {
     checkFunctionApplication(node, node.function, node.argumentList);
     node.visitChildren(this);
   }
 
   @override
   void visitIfStatement(IfStatement node) {
     checkBoolean(node.condition);
     node.visitChildren(this);
   }
@@ skipping 313 matching lines @@
   }
 
   void _checkFieldAccess(AstNode node, AstNode target, SimpleIdentifier field) {
     if ((_isDynamicTarget(target) || field.staticElement == null) &&
         !_isObjectProperty(target, field)) {
       _recordDynamicInvoke(node, target);
     }
     node.visitChildren(this);
   }
 
+  /**
+   * Check if the closure [node] is unsafe due to dartbug.com/26947.  If so,
+   * issue a warning.
+   *
+   * TODO(paulberry): eliminate this once dartbug.com/26947 is fixed.
+   */
+  void _checkForUnsafeBlockClosureInference(FunctionExpression node) {
+    if (node.body is! BlockFunctionBody) {
+      return;
+    }
+    if (node.element.returnType.isDynamic) {
+      return;
+    }
+    // Find the enclosing variable declaration whose inferred type might depend
+    // on the inferred return type of the block closure (if any).
+    VariableDeclaration decl = null;
+    AstNode ancestor = node.parent;
+    while (ancestor != null) {
+      if (ancestor is BlockFunctionBody) {
+        // node is inside another block function body; if that block
+        // function body is unsafe, we've already warned about it.
+        return;
+      }
+      if (ancestor is VariableDeclaration) {

[Leaf, 2016/07/22 23:34:41]

Might be a bit clearer just to make this part of the while loop test (ancestor
!= null && ancestor is! VariableDeclaration)?  Once less control flow path to
follow through the loop

[Paul Berry, 2016/07/23 16:18:18]

Done.

+        decl = ancestor;
+        break;
+      }
+      if (ancestor is InstanceCreationExpression) {

[Leaf, 2016/07/22 23:34:41]

Presumably this same logic could be applied to List and Map literals, and to
generic method invocations.  Is it worth doing so?

[Paul Berry, 2016/07/23 16:18:18]

Done.  PTAL.

+        // node appears inside an instance creation expression; we may be safe
+        // if the type of the instance creation expression requires no
+        // inference.
+        TypeName typeName = ancestor.constructorName.type;
+        DartType type = typeName.type;
+        if (typeName.typeArguments != null) {
+          // Type arguments were explicitly specified.  We are safe.
+          return;
+        }
+        if (!(type is ParameterizedType && type.typeParameters.isNotEmpty)) {
+          // Type is not generic.  We are safe.
+          return;
+        }
+      }
+      ancestor = ancestor.parent;
+    }
+    if (decl == null) {
+      // node is not inside a variable declaration, so it is safe.
+      return;
+    }
+    VariableElement declElement = decl.element;
+    if (!declElement.hasImplicitType) {
+      // Variable declaration has an explicit type, so it's safe.
+      return;
+    }
+    if (declElement.type.isDynamic) {
+      // No type was successfully inferred for this variable, so it's safe.
+      return;
+    }
+    if (declElement.enclosingElement is ExecutableElement) {
+      // Variable declaration is inside a function or method, so it's safe.
+      return;
+    }
+    _recordMessage(node, StrongModeCode.UNSAFE_BLOCK_CLOSURE_INFERENCE,
+        [declElement.name]);
+  }
+
   void _checkReturnOrYield(Expression expression, AstNode node,
       {bool yieldStar: false}) {
     FunctionBody body = node.getAncestor((n) => n is FunctionBody);
     var type = _getExpectedReturnType(body, yieldStar: yieldStar);
     if (type == null) {
       // We have a type mismatch: the async/async*/sync* modifier does
       // not match the return or yield type.  We should have already gotten an
       // analyzer error in this case.
       return;
     }
@@ skipping 644 matching lines @@
     var visited = new Set<InterfaceType>();
     do {
       visited.add(current);
       current.mixins.reversed.forEach(
           (m) => _checkIndividualOverridesFromClass(node, m, seen, true));
       _checkIndividualOverridesFromClass(node, current.superclass, seen, true);
       current = current.superclass;
     } while (!current.isObject && !visited.contains(current));
   }
 }