Support checking of malbounded types.

sdk/lib/_internal/compiler/implementation/ssa/builder.dart

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 part of ssa;
 
 /**
  * A special element for the extra parameter taken by intercepted
  * methods. We need to override [Element.computeType] because our
  * optimizers may look at its declared type.
@@ skipping 1903 matching lines @@
 
   HInstruction potentiallyCheckType(HInstruction original, DartType type,
       { int kind: HTypeConversion.CHECKED_MODE_CHECK }) {
     if (!compiler.enableTypeAssertions) return original;
     HInstruction other = buildTypeConversion(original, type, kind);
     if (other != original) add(other);
     compiler.enqueuer.codegen.registerIsCheck(type, work.resolutionTree);
     return other;
   }
 
+  void assertIsSubtype(Node node, DartType subtype, DartType supertype,
+                       String message) {
+    HInstruction subtypeInstruction = analyzeTypeArgument(subtype);
+    HInstruction supertypeInstruction = analyzeTypeArgument(supertype);
+    HInstruction messageInstruction =
+        graph.addConstantString(new DartString.literal(message),
+                                node, compiler);
+    Element element = backend.getAssertIsSubtype();
+    var inputs = <HInstruction>[subtypeInstruction, supertypeInstruction,
+                                messageInstruction];
+    HInstruction assertIsSubtype = new HInvokeStatic(
+        element, inputs, subtypeInstruction.instructionType);
+    compiler.backend.registerTypeVariableBoundsSubtypeCheck(subtype, supertype);
+    add(assertIsSubtype);
+  }
+
   HGraph closeFunction() {
     // TODO(kasperl): Make this goto an implicit return.
     if (!isAborted()) closeAndGotoExit(new HGoto());
     graph.finalize();
     return graph;
   }
 
   HBasicBlock addNewBlock() {
     HBasicBlock block = graph.addNewBlock();
     // If adding a new block during building of an expression, it is due to
@@ skipping 1704 matching lines @@
                        message: 'Constructor Symbol.validated is missing'));
     }
 
     bool isRedirected = functionElement.isRedirectingFactory;
     InterfaceType type = elements.getType(node);
     DartType expectedType = type;
     if (isRedirected) {
       type = functionElement.computeTargetType(compiler, type);
     }
 
+    if (checkTypeVariableBounds(node, type)) return;
+
     var inputs = <HInstruction>[];
     if (constructor.isGenerativeConstructor() &&
         Elements.isNativeOrExtendsNative(constructor.getEnclosingClass())) {
       // Native class generative constructors take a pre-constructed object.
       inputs.add(graph.addConstantNull(compiler));
     }
     // TODO(5347): Try to avoid the need for calling [implementation] before
     // calling [addStaticSendArgumentsToList].
     bool succeeded = addStaticSendArgumentsToList(selector, send.arguments,
                                                   constructor.implementation,
@@ skipping 37 matching lines @@
     // Finally, if we called a redirecting factory constructor, check the type.
     if (isRedirected) {
       HInstruction checked = potentiallyCheckType(newInstance, expectedType);
       if (checked != newInstance) {
         pop();
         stack.add(checked);
       }
     }
   }
 
+  /// In checked mode checks the [type] of [node] to be well-bounded. The method
+  /// returns [:true:] if an error can be statically determined.
+  bool checkTypeVariableBounds(NewExpression node, InterfaceType type) {
+    if (!compiler.enableTypeAssertions) return false;
+
+    Map<DartType, Set<DartType>> seenChecksMap =
+        new Map<DartType, Set<DartType>>();
+    bool definitelyFails = false;
+
+    addTypeVariableBoundCheck(GenericType instance,
+                              DartType typeArgument,
+                              TypeVariableType typeVariable,
+                              DartType bound) {
+      if (definitelyFails) return;
+
+      int subtypeRelation = compiler.types.computeSubtypeRelation(typeArgument, bound);
+      if (subtypeRelation == Types.IS_SUBTYPE) return;
+
+      String message =
+          "Can't create an instance of malbounded type '$type': "
+          "'${typeArgument}' is not a subtype of bound '${bound}' for "
+          "type variable '${typeVariable}' of type "
+          "${type == instance
+              ? "'${type.element.thisType}'"
+              : "'${instance.element.thisType}' on the supertype "
+                "'${instance}' of '${type}'"
+            }.";
+      if (subtypeRelation == Types.NOT_SUBTYPE) {
+        generateTypeError(node, message);
+        definitelyFails = true;
+        return;
+      } else if (subtypeRelation == Types.MAYBE_SUBTYPE) {
+        Set<DartType> seenChecks =
+            seenChecksMap.putIfAbsent(typeArgument, () => new Set<DartType>());
+        if (!seenChecks.contains(bound)) {
+          seenChecks.add(bound);
+          assertIsSubtype(node, typeArgument, bound, message);
+        }
+      }
+    }
+
+    compiler.types.checkTypeVariableBounds(type, addTypeVariableBoundCheck);
+    if (definitelyFails) {
+      return true;
+    }
+    for (InterfaceType supertype in type.element.allSupertypes) {
+      DartType instance = type.asInstanceOf(supertype.element);
+      compiler.types.checkTypeVariableBounds(instance,
+          addTypeVariableBoundCheck);
+      if (definitelyFails) {
+        return true;
+      }
+    }
+    return false;
+  }
+
   visitAssert(node) {
     if (!compiler.enableUserAssertions) {
       stack.add(graph.addConstantNull(compiler));
       return;
     }
     visitStaticSend(node);
   }
 
   visitStaticSend(Send node) {
     Selector selector = elements.getSelector(node);
@@ skipping 92 matching lines @@
 
   void generateError(Node node, String message, Element helper) {
     HInstruction errorMessage = addConstantString(node, message);
     pushInvokeStatic(node, helper, [errorMessage]);
   }
 
   void generateRuntimeError(Node node, String message) {
     generateError(node, message, backend.getThrowRuntimeError());
   }
 
+  void generateTypeError(Node node, String message) {
+    generateError(node, message, backend.getThrowTypeError());
+  }
+
   void generateAbstractClassInstantiationError(Node node, String message) {
     generateError(node,
                   message,
                   backend.getThrowAbstractClassInstantiationError());
   }
 
   void generateThrowNoSuchMethod(Node diagnosticNode,
                                  String methodName,
                                  {Link<Node> argumentNodes,
                                   List<HInstruction> argumentValues,
@@ skipping 1767 matching lines @@
           new HSubGraphBlockInformation(elseBranch.graph));
 
     HBasicBlock conditionStartBlock = conditionBranch.block;
     conditionStartBlock.setBlockFlow(info, joinBlock);
     SubGraph conditionGraph = conditionBranch.graph;
     HIf branch = conditionGraph.end.last;
     assert(branch is HIf);
     branch.blockInformation = conditionStartBlock.blockFlow;
   }
 }