Distinguish between malformed and malbounded types (fix issues 12552 and 12554).

runtime/vm/flow_graph_builder.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/flow_graph_builder.h"
 
 #include "lib/invocation_mirror.h"
 #include "vm/ast_printer.h"
 #include "vm/bit_vector.h"
 #include "vm/code_descriptors.h"
@@ skipping 834 matching lines @@
 // Type nodes are used when a type is referenced as a literal. Type nodes
 // can also be used for the right-hand side of instanceof comparisons,
 // but they are handled specially in that context, not here.
 void EffectGraphVisitor::VisitTypeNode(TypeNode* node) {
   return;
 }
 
 
 void ValueGraphVisitor::VisitTypeNode(TypeNode* node) {
   const AbstractType& type = node->type();
-  ASSERT(type.IsFinalized() && !type.IsMalformed());
+  ASSERT(type.IsFinalized() && !type.IsMalformed() && !type.IsMalbounded(NULL));
   if (type.IsInstantiated()) {
     ReturnDefinition(new ConstantInstr(type));
   } else {
     const Class& instantiator_class = Class::ZoneHandle(
         owner()->parsed_function()->function().Owner());
     Value* instantiator_value = BuildInstantiatorTypeArguments(
         node->token_pos(), instantiator_class, NULL);
     ReturnDefinition(new InstantiateTypeInstr(
         node->token_pos(), type, instantiator_class, instantiator_value));
   }
 }
 
 
 // Returns true if the type check can be skipped, for example, if the
 // destination type is dynamic or if the compile type of the value is a subtype
 // of the destination type.
 bool EffectGraphVisitor::CanSkipTypeCheck(intptr_t token_pos,
                                           Value* value,
                                           const AbstractType& dst_type,
                                           const String& dst_name) {
   ASSERT(!dst_type.IsNull());
   ASSERT(dst_type.IsFinalized());
 
-  // If the destination type is malformed, a dynamic type error must be thrown
-  // at run time.
-  if (dst_type.IsMalformed()) {
+  // If the destination type is malformed or malbounded, a dynamic type error
+  // must be thrown at run time.
+  if (dst_type.IsMalformed() || dst_type.IsMalbounded(NULL)) {
     return false;
   }
 
   // Any type is more specific than the dynamic type and than the Object type.
   if (dst_type.IsDynamicType() || dst_type.IsObjectType()) {
     return true;
   }
 
   // Do not perform type check elimination if this optimization is turned off.
   if (!FLAG_eliminate_type_checks) {
@@ skipping 304 matching lines @@
   ASSERT(Token::IsTypeTestOperator(node->kind()));
   EffectGraphVisitor for_left_value(owner(), temp_index());
   node->left()->Visit(&for_left_value);
   Append(for_left_value);
 }
 
 
 void ValueGraphVisitor::BuildTypeTest(ComparisonNode* node) {
   ASSERT(Token::IsTypeTestOperator(node->kind()));
   const AbstractType& type = node->right()->AsTypeNode()->type();
-  ASSERT(type.IsFinalized() && !type.IsMalformed());
+  ASSERT(type.IsFinalized() && !type.IsMalformed() && !type.IsMalbounded(NULL));
   const bool negate_result = (node->kind() == Token::kISNOT);
   // All objects are instances of type T if Object type is a subtype of type T.
   const Type& object_type = Type::Handle(Type::ObjectType());
   if (type.IsInstantiated() && object_type.IsSubtypeOf(type, NULL)) {
     // Must evaluate left side.
     EffectGraphVisitor for_left_value(owner(), temp_index());
     node->left()->Visit(&for_left_value);
     Append(for_left_value);
     ReturnDefinition(new ConstantInstr(negate_result ?
                                        Bool::False() : Bool::True()));
@@ skipping 82 matching lines @@
 void ValueGraphVisitor::BuildTypeCast(ComparisonNode* node) {
   ASSERT(Token::IsTypeCastOperator(node->kind()));
   ASSERT(!node->right()->AsTypeNode()->type().IsNull());
   const AbstractType& type = node->right()->AsTypeNode()->type();
   ASSERT(type.IsFinalized());  // The type in a type cast may be malformed.
   ValueGraphVisitor for_value(owner(), temp_index());
   node->left()->Visit(&for_value);
   Append(for_value);
   const String& dst_name = String::ZoneHandle(
       Symbols::New(Exceptions::kCastErrorDstName));
-  if (type.IsMalformed()) {
+  if (type.IsMalformed() || type.IsMalbounded(NULL)) {
     ReturnValue(BuildAssignableValue(node->token_pos(),
                                      for_value.value(),
                                      type,
                                      dst_name));
   } else {
     if (CanSkipTypeCheck(node->token_pos(),
                          for_value.value(),
                          type,
                          dst_name)) {
       ReturnValue(for_value.value());
@@ skipping 1140 matching lines @@
     const Class& instantiator_class,
     Value* instantiator) {
   if (instantiator_class.NumTypeParameters() == 0) {
     // The type arguments are compile time constants.
     AbstractTypeArguments& type_arguments = AbstractTypeArguments::ZoneHandle();
     // Type is temporary. Only its type arguments are preserved.
     Type& type = Type::Handle(
         Type::New(instantiator_class, type_arguments, token_pos, Heap::kNew));
     type ^= ClassFinalizer::FinalizeType(
         instantiator_class, type, ClassFinalizer::kFinalize);
-    ASSERT(!type.IsMalformed());
+    ASSERT(!type.IsMalformed() && !type.IsMalbounded(NULL));
     type_arguments = type.arguments();
     type_arguments = type_arguments.Canonicalize();
     return Bind(new ConstantInstr(type_arguments));
   }
   Function& outer_function =
       Function::Handle(owner()->parsed_function()->function().raw());
   while (outer_function.IsLocalFunction()) {
     outer_function = outer_function.parent_function();
   }
   if (outer_function.IsFactory()) {
@@ skipping 1262 matching lines @@
   intptr_t len = OS::SNPrint(NULL, 0, kFormat, function_name, reason) + 1;
   char* chars = Isolate::Current()->current_zone()->Alloc<char>(len);
   OS::SNPrint(chars, len, kFormat, function_name, reason);
   const Error& error = Error::Handle(
       LanguageError::New(String::Handle(String::New(chars))));
   Isolate::Current()->long_jump_base()->Jump(1, error);
 }
 
 
 }  // namespace dart