Distinguish between malformed and malbounded types (fix issues 12552 and 12554).

runtime/vm/object.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/object.h"
 
 #include "include/dart_api.h"
 #include "platform/assert.h"
 #include "vm/assembler.h"
 #include "vm/cpu.h"
@@ skipping 43 matching lines @@
 DEFINE_FLAG(int, huge_method_cutoff_in_code_size, 200000,
     "Huge method cutoff in unoptimized code size (in bytes).");
 DEFINE_FLAG(bool, throw_on_javascript_int_overflow, false,
     "Throw an exception when the result of an integer calculation will not "
     "fit into a javascript integer.");
 DECLARE_FLAG(bool, trace_compiler);
 DECLARE_FLAG(bool, eliminate_type_checks);
 DECLARE_FLAG(bool, enable_type_checks);
 DECLARE_FLAG(bool, trace_deoptimization);
 DECLARE_FLAG(bool, trace_deoptimization_verbose);
+DECLARE_FLAG(bool, error_on_malformed_type);
 DECLARE_FLAG(bool, error_on_bad_override);
 
 static const char* kGetterPrefix = "get:";
 static const intptr_t kGetterPrefixLength = strlen(kGetterPrefix);
 static const char* kSetterPrefix = "set:";
 static const intptr_t kSetterPrefixLength = strlen(kSetterPrefix);
 
 cpp_vtable Object::handle_vtable_ = 0;
 cpp_vtable Object::builtin_vtables_[kNumPredefinedCids] = { 0 };
 cpp_vtable Smi::handle_vtable_ = 0;
@@ skipping 1670 matching lines @@
 // Return null otherwise.
 RawTypeParameter* Class::LookupTypeParameter(const String& type_name) const {
   ASSERT(!type_name.IsNull());
   Isolate* isolate = Isolate::Current();
   ReusableHandleScope reused_handles(isolate);
   TypeArguments& type_params = reused_handles.TypeArgumentsHandle();
   type_params ^= type_parameters();
   TypeParameter& type_param = reused_handles.TypeParameterHandle();
   String& type_param_name = reused_handles.StringHandle();
   if (!type_params.IsNull()) {
-    intptr_t num_type_params = type_params.Length();
+    const intptr_t num_type_params = type_params.Length();
     for (intptr_t i = 0; i < num_type_params; i++) {
       type_param ^= type_params.TypeAt(i);
       type_param_name = type_param.name();
       if (type_param_name.Equals(type_name)) {
         return type_param.raw();
       }
     }
   }
   return TypeParameter::null();
 }
@@ skipping 1262 matching lines @@
   hash += hash << 3;
   hash ^= hash >> 11;
   hash += hash << 15;
   return hash;
 }
 
 
 intptr_t AbstractTypeArguments::Hash() const {
   if (IsNull()) return 0;
   uword result = 0;
-  intptr_t num_types = Length();
+  const intptr_t num_types = Length();
   AbstractType& type = AbstractType::Handle();
   for (intptr_t i = 0; i < num_types; i++) {
     type = TypeAt(i);
     result += type.Hash();
     result += result << 10;
     result ^= result >> 6;
   }
   return FinalizeHash(result);
 }
 
@@ skipping 25 matching lines @@
 
 
 bool AbstractTypeArguments::Equals(const AbstractTypeArguments& other) const {
   ASSERT(!IsNull());  // Use AbstractTypeArguments::AreEqual().
   if (this->raw() == other.raw()) {
     return true;
   }
   if (other.IsNull()) {
     return false;
   }
-  intptr_t num_types = Length();
+  const intptr_t num_types = Length();
   if (num_types != other.Length()) {
     return false;
   }
   AbstractType& type = AbstractType::Handle();
   AbstractType& other_type = AbstractType::Handle();
   for (intptr_t i = 0; i < num_types; i++) {
     type = TypeAt(i);
     other_type = other.TypeAt(i);
     if (!type.Equals(other_type)) {
       return false;
@@ skipping 108 matching lines @@
 
 
 void TypeArguments::SetTypeAt(intptr_t index, const AbstractType& value) const {
   ASSERT(!IsCanonical());
   StorePointer(TypeAddr(index), value.raw());
 }
 
 
 bool TypeArguments::IsResolved() const {
   AbstractType& type = AbstractType::Handle();
-  intptr_t num_types = Length();
+  const intptr_t num_types = Length();
   for (intptr_t i = 0; i < num_types; i++) {
     type = TypeAt(i);
     if (!type.IsResolved()) {
       return false;
     }
   }
   return true;
 }
 
 
 bool TypeArguments::IsInstantiated() const {
   AbstractType& type = AbstractType::Handle();
-  intptr_t num_types = Length();
+  const intptr_t num_types = Length();
   for (intptr_t i = 0; i < num_types; i++) {
     type = TypeAt(i);
     ASSERT(!type.IsNull());
     if (!type.IsInstantiated()) {
       return false;
     }
   }
   return true;
 }
 
@@ skipping 77 matching lines @@
     if (!type_arg.Equals(super_type_arg)) {
       return false;
     }
   }
   return true;
 }
 
 
 bool TypeArguments::IsBounded() const {
   AbstractType& type = AbstractType::Handle();
-  intptr_t num_types = Length();
+  const intptr_t num_types = Length();
   for (intptr_t i = 0; i < num_types; i++) {
     type = TypeAt(i);
     if (type.IsBoundedType()) {
       return true;
     }
     if (type.IsTypeParameter()) {
       const AbstractType& bound = AbstractType::Handle(
           TypeParameter::Cast(type).bound());
       if (!bound.IsObjectType() && !bound.IsDynamicType()) {
         return true;
@@ skipping 1425 matching lines @@
     // (e.g. "Map<K, V>(K) => bool"). In case of a function type alias, the
     // signature class name is the alias name.
     // The signature of static functions cannot be type parameterized.
     const Class& function_class = Class::Handle(Owner());
     ASSERT(!function_class.IsNull());
     const TypeArguments& type_parameters = TypeArguments::Handle(
         function_class.type_parameters());
     if (!type_parameters.IsNull()) {
       const String& function_class_name = String::Handle(function_class.Name());
       pieces.Add(function_class_name);
-      intptr_t num_type_parameters = type_parameters.Length();
+      const intptr_t num_type_parameters = type_parameters.Length();
       pieces.Add(Symbols::LAngleBracket());
       TypeParameter& type_parameter = TypeParameter::Handle();
       AbstractType& bound = AbstractType::Handle();
       for (intptr_t i = 0; i < num_type_parameters; i++) {
         type_parameter ^= type_parameters.TypeAt(i);
         name = type_parameter.name();
         pieces.Add(name);
         bound = type_parameter.bound();
         if (!bound.IsNull() && !bound.IsObjectType()) {
           pieces.Add(Symbols::SpaceExtendsSpace());
@@ skipping 3543 matching lines @@
   RawExceptionHandlers::HandlerInfo info;
   // First compute the buffer size required.
   const char* kFormat = "%" Pd " => %#" Px "  (%" Pd
                         " types) (outer %" Pd ")\n";
   const char* kFormat2 = "  %d. %s\n";
   intptr_t len = 1;  // Trailing '\0'.
   for (intptr_t i = 0; i < Length(); i++) {
     GetHandlerInfo(i, &info);
     handled_types = GetHandledTypes(i);
     ASSERT(!handled_types.IsNull());
-    intptr_t num_types = handled_types.Length();
+    const intptr_t num_types = handled_types.Length();
     len += OS::SNPrint(NULL, 0, kFormat,
                        i,
                        info.handler_pc,
                        num_types,
                        info.outer_try_index);
     for (int k = 0; k < num_types; k++) {
       type ^= handled_types.At(k);
       ASSERT(!type.IsNull());
       len += OS::SNPrint(NULL, 0, kFormat2, k, type.ToCString());
     }
   }
   // Allocate the buffer.
   char* buffer = Isolate::Current()->current_zone()->Alloc<char>(len);
   // Layout the fields in the buffer.
   intptr_t num_chars = 0;
   for (intptr_t i = 0; i < Length(); i++) {
     GetHandlerInfo(i, &info);
     handled_types = GetHandledTypes(i);
-    intptr_t num_types = handled_types.Length();
+    const intptr_t num_types = handled_types.Length();
     num_chars += OS::SNPrint((buffer + num_chars),
                              (len - num_chars),
                              kFormat,
                              i,
                              info.handler_pc,
                              num_types,
                              info.outer_try_index);
     for (int k = 0; k < num_types; k++) {
       type ^= handled_types.At(k);
       num_chars += OS::SNPrint((buffer + num_chars),
@@ skipping 1858 matching lines @@
 
 
 void Instance::SetTypeArguments(const AbstractTypeArguments& value) const {
   const Class& cls = Class::Handle(clazz());
   intptr_t field_offset = cls.type_arguments_field_offset();
   ASSERT(field_offset != Class::kNoTypeArguments);
   SetFieldAtOffset(field_offset, value);
 }
 
 
+// TODO(regis): Rename malformed_error to bound_error.
 bool Instance::IsInstanceOf(const AbstractType& other,
                             const AbstractTypeArguments& other_instantiator,
                             Error* malformed_error) const {
   ASSERT(other.IsFinalized());
   ASSERT(!other.IsDynamicType());
   ASSERT(!other.IsMalformed());
+  ASSERT(!other.IsMalbounded(NULL));
   if (other.IsVoidType()) {
     return false;
   }
   const Class& cls = Class::Handle(clazz());
   AbstractTypeArguments& type_arguments = AbstractTypeArguments::Handle();
   const intptr_t num_type_arguments = cls.NumTypeArguments();
   if (num_type_arguments > 0) {
     type_arguments = GetTypeArguments();
     if (!type_arguments.IsNull() && !type_arguments.IsCanonical()) {
       type_arguments = type_arguments.Canonicalize();
@@ skipping 206 matching lines @@
 }
 
 
 bool AbstractType::IsMalformed() const {
   // AbstractType is an abstract class.
   UNREACHABLE();
   return false;
 }
 
 
+bool AbstractType::IsMalbounded(Error* error) const {
+  // AbstractType is an abstract class.
+  UNREACHABLE();
+  return false;
+}
+
+
 RawError* AbstractType::malformed_error() const {
   // AbstractType is an abstract class.
   UNREACHABLE();
   return Error::null();
 }
 
 
 void AbstractType::set_malformed_error(const Error& value) const {
   // AbstractType is an abstract class.
   UNREACHABLE();
@@ skipping 377 matching lines @@
   ASSERT(!IsFinalized() && !IsBeingFinalized());
   set_type_state(RawType::kBeingFinalized);
 }
 
 
 bool Type::IsMalformed() const {
   return raw_ptr()->malformed_error_ != Error::null();
 }
 
 
+bool Type::IsMalbounded(Error* bound_error) const {
+  if (!FLAG_enable_type_checks && !FLAG_error_on_malformed_type) {
+    return false;
+  }
+  ASSERT(IsFinalized());
+  ASSERT(!IsMalformed());  // Must be checked first.
+  AbstractTypeArguments& type_arguments =
+      AbstractTypeArguments::Handle(arguments());
+  if (type_arguments.IsNull()) {

[hausner, 2013/08/23 16:55:23]

You could avoid this handle allocation by comparing arguments() directly to
AbstractTypeArguments::null(). Only if it is non-null do you need to allocate
the handle.

[regis, 2013/08/26 17:44:57]

Done.

+    return false;
+  }
+  const intptr_t num_type_args = type_arguments.Length();
+  AbstractType& type_arg = AbstractType::Handle();
+  for (intptr_t i = 0; i < num_type_args; i++) {
+    type_arg = type_arguments.TypeAt(i);
+    ASSERT(!type_arg.IsNull());
+    if (type_arg.IsMalbounded(bound_error)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+
 void Type::set_malformed_error(const Error& value) const {
   StorePointer(&raw_ptr()->malformed_error_, value.raw());
 }
 
 
 RawError* Type::malformed_error() const {
   ASSERT(IsMalformed());
   return raw_ptr()->malformed_error_;
 }
 
@@ skipping 353 matching lines @@
   if (instantiator_type_arguments.IsNull()) {
     return Type::DynamicType();
   }
   // Bound checks may appear in the instantiator type arguments, as is the case
   // with a pair of type parameters of the same class referring to each other
   // via their bounds.
   AbstractType& type_arg = AbstractType::Handle(
       instantiator_type_arguments.TypeAt(index()));
   if (type_arg.IsBoundedType()) {
     const BoundedType& bounded_type = BoundedType::Cast(type_arg);
-    ASSERT(!bounded_type.IsInstantiated());
-    ASSERT(AbstractType::Handle(bounded_type.bound()).IsInstantiated());
-    type_arg = bounded_type.InstantiateFrom(AbstractTypeArguments::Handle(),
-                                            malformed_error);
+    // Bounds checking of a type is postponed to run time if the type is still
+    // uninstantiated at compile time, or if the bound and the type are mutually
+    // recursive. In the latter case, the type may already be instantiated.
+    if (!bounded_type.IsInstantiated()) {
+      ASSERT(AbstractType::Handle(bounded_type.bound()).IsInstantiated());
+      type_arg = bounded_type.InstantiateFrom(AbstractTypeArguments::Handle(),
+                                              malformed_error);
+    }
   }
   return type_arg.raw();
 }
 
 
 bool TypeParameter::CheckBound(const AbstractType& bounded_type,
                                const AbstractType& upper_bound,
                                Error* malformed_error) const {
   ASSERT((malformed_error == NULL) || malformed_error->IsNull());
   ASSERT(bounded_type.IsFinalized());
@@ skipping 96 matching lines @@
 }
 
 
 void TypeParameter::PrintToJSONStream(JSONStream* stream, bool ref) const {
   stream->OpenObject();
   stream->CloseObject();
 }
 
 
 bool BoundedType::IsMalformed() const {
-  return FLAG_enable_type_checks && AbstractType::Handle(bound()).IsMalformed();
+  return AbstractType::Handle(type()).IsMalformed();
+}
+
+
+bool BoundedType::IsMalbounded(Error* bound_error) const {
+  if (!FLAG_enable_type_checks && !FLAG_error_on_malformed_type) {
+    return false;
+  }
+  const AbstractType& upper_bound = AbstractType::Handle(bound());
+  if (upper_bound.IsMalformed()) {
+    if (bound_error != NULL) {
+      *bound_error = upper_bound.malformed_error();
+      ASSERT(!bound_error->IsNull());
+    }
+    return true;
+  }
+  return false;
 }
 
 
 RawError* BoundedType::malformed_error() const {
-  ASSERT(FLAG_enable_type_checks);
-  return AbstractType::Handle(bound()).malformed_error();
+  return AbstractType::Handle(type()).malformed_error();
 }
 
 
 bool BoundedType::Equals(const Instance& other) const {
   // BoundedType are not canonicalized, because their bound may get finalized
   // after the BoundedType is created and initialized.
   if (raw() == other.raw()) {
     return true;
   }
   if (!other.IsBoundedType()) {
@@ skipping 3404 matching lines @@
 }
 
 
 void MirrorReference::PrintToJSONStream(JSONStream* stream, bool ref) const {
   stream->OpenObject();
   stream->CloseObject();
 }
 
 
 }  // namespace dart