Fix bound checking in self referencing type (issue 12553).

runtime/vm/class_finalizer.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/class_finalizer.h"
 
 #include "vm/flags.h"
 #include "vm/heap.h"
 #include "vm/isolate.h"
 #include "vm/longjump.h"
@@ skipping 630 matching lines @@
   for (intptr_t i = 0; i < num_type_params; i++) {
     type_arg = arguments.TypeAt(offset + i);
     if (type_arg.IsDynamicType()) {
       continue;
     }
     cls_type_param = cls_type_params.TypeAt(i);
     const TypeParameter& type_param = TypeParameter::Cast(cls_type_param);
     ASSERT(type_param.IsFinalized());
     declared_bound = type_param.bound();
     if (!declared_bound.IsObjectType() && !declared_bound.IsDynamicType()) {
+      if (!declared_bound.IsFinalized() && !declared_bound.IsBeingFinalized()) {
+        declared_bound = FinalizeType(cls, declared_bound, kCanonicalize);
+        type_param.set_bound(declared_bound);
+      }
+      ASSERT(declared_bound.IsFinalized() || declared_bound.IsBeingFinalized());
       Error& malformed_error = Error::Handle();
       // Note that the bound may be malformed, in which case the bound check
       // will return an error and the bound check will be postponed to run time.
-      // Note also that the bound may still be unfinalized.
       if (declared_bound.IsInstantiated()) {
         instantiated_bound = declared_bound.raw();
       } else {
         instantiated_bound =
             declared_bound.InstantiateFrom(arguments, &malformed_error);
       }
       if (!instantiated_bound.IsFinalized()) {
         // The bound refers to type parameters, creating a cycle; postpone
         // bound check to run time, when the bound will be finalized.
         // The bound may not necessarily be 'IsBeingFinalized' yet, as is the
@@ skipping 149 matching lines @@
   Error& bound_error = Error::Handle();
   if (num_type_arguments > 0) {
     // If no type arguments were parsed and if the super types do not prepend
     // type arguments to the vector, we can leave the vector as null.
     if (!arguments.IsNull() || (num_type_arguments > num_type_parameters)) {
       full_arguments = TypeArguments::New(num_type_arguments);
       // Copy the parsed type arguments at the correct offset in the full type
       // argument vector.
       const intptr_t offset = num_type_arguments - num_type_parameters;
       AbstractType& type_arg = AbstractType::Handle(Type::DynamicType());
+      for (intptr_t i = 0; i < offset; i++) {
+        // Temporarily set the type arguments of the super classes to dynamic.
+        full_arguments.SetTypeAt(i, type_arg);
+      }
       for (intptr_t i = 0; i < num_type_parameters; i++) {
         // If no type parameters were provided, a raw type is desired, so we
-        // create a vector of DynamicType.
+        // create a vector of dynamic.
         if (!arguments.IsNull()) {
           type_arg = arguments.TypeAt(i);
         }
         ASSERT(type_arg.IsFinalized());  // Index of type parameter is adjusted.
         full_arguments.SetTypeAt(offset + i, type_arg);
       }
+      // Replace the compile-time argument vector (of length zero or
+      // num_type_parameters) of this type being finalized with the still
+      // unfinalized run-time argument vector (of length num_type_arguments).
+      // This type being finalized may be recursively reached via bounds
+      // checking, in which case type arguments of super classes will be seen
+      // as dynamic.
+      parameterized_type.set_arguments(full_arguments);
       // If the type class is a signature class, the full argument vector
       // must include the argument vector of the super type.
       // If the signature class is a function type alias, it is also the owner
       // of its signature function and no super type is involved.
       // If the signature class is canonical (not an alias), the owner of its
       // signature function may either be an alias or the enclosing class of a
       // local function, in which case the super type of the enclosing class is
       // also considered when filling up the argument vector.
       if (type_class.IsSignatureClass()) {
         const Function& signature_fun =
@@ skipping 1465 matching lines @@
   expected_name ^= String::New("_offset");
   ASSERT(String::EqualsIgnoringPrivateKey(name, expected_name));
   field ^= fields_array.At(2);
   ASSERT(field.Offset() == TypedDataView::length_offset());
   name ^= field.name();
   ASSERT(name.Equals("length"));
 #endif
 }
 
 }  // namespace dart