Class with generic that extends another class causes core dump and unexpected memory issue

[Jtplouffe]

Issue

There seems to be something wrong when having a class with a generic that extends another class.

The issue describe bellow only happens when compiling and running with machine code (dart compile exe).
Running with JIT (dart run) does not cause any issue.

The core issue originally occurred in a production flutter app compiled in release mode (debug mode does not crash).

The best way to understand the issue is to have a look a this gist (3 different sample):
https://gist.github.com/Jtplouffe/b6db1916e43f0d0c9814eee7995b98d4

This gist has 3 files, with 3 different sample:

crash.dart is a core dumped. The value inside the instantiated object evaluates to null when printed, but when null-checked, acts like a non-null value. When calling methods on this value, dart crashes with the following error:

../../runtime/vm/code_descriptors.cc: 816: error: expected: current_pc_offset <= pc_offset
zsh: IOT instruction (core dumped)  ./bin/main.exe

object_value_becomes_random.dart makes a variable value become random. After creating an object in a factory, with the nested value coming from a switch case, the value is null, until it is returned from the factory, where it becomes random.

object_value_changes.dart: The value of a variable becomes the value assigned in an else branch, which is never entered.

It think all of these samples / results are caused by the same issue. If it is not the case, let my know if I need to create separate issues.

Platforms

Tested on:

• Linux (Fedora 36), kernel 6.0.5
  • Dart 2.18.4, tested with dart only and with Flutter desktop
• MacOS (12.5)
  • Dart 2.18.4, tested with dart only and with Flutter desktop
  • Dart 2.19.0-374.0.dev (dev)
• Android (12, 13)
  • Dart 2.18.4, bundled with flutter 3.3.7
  • Tested on Pixel 5 and 6 (Android 12, 13) and on a Samsung device
• iOS
  • Dart 2.18.4, bundled with flutter 3.3.7

[mraleph]

@alexmarkov could you take a look?

[alexmarkov]

@Jtplouffe Thank you for the detailed bug report!

This crash and incorrect behavior is caused by an incorrect handling of type parameters inside factory constructors in AOT compiler (in TFA). In the expression value as T?, analysis incorrectly ignored the nullability of type parameter and made the incorrect conclusion that parameter of Model._ constructor and field Model.value are never null, causing incorrect optimizations. The effects you saw are the results of those optimizations. In the 2nd and the 3rd examples the cast as T? is implicit, where dynamic value is passed to Model._ constructor which takes T?.

Fix: https://dart-review.git.corp.google.com/c/sdk/+/268381.