[vm/compiler] Fix receiver redefinition type for poly inlining.

In cases where the same target function is used for multiple
CID ranges, we only perform the inlining once. However, if the
CID range used for the initial inlining is a single CID, we will
set the type of the redefinition to that CID.

Detect this case and clear the concrete type associated with
the redefinition if it was given one.

Change-Id: I3c27c46c71e10e71624ce3b969cb741eb9b2915f
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/104781
Commit-Queue: Teagan Strickland <sstrickl@google.com>
Reviewed-by: Martin Kustermann <kustermann@google.com>

runtime/vm/compiler/backend/inliner.cc

@@ -1731,6 +1731,11 @@ bool PolymorphicInliner::CheckInlinedDuplicate(const Function& target) {
           BlockEntryInstr* block = old_target->dominated_blocks()[j];
           new_join->AddDominatedBlock(block);
         }
+        // Since we are reusing the same inlined body across multiple cids,
+        // reset the type information on the redefinition of the receiver
+        // in case it was originally given a concrete type.
+        ASSERT(new_join->next()->IsRedefinition());
+        new_join->next()->AsRedefinition()->UpdateType(CompileType::Dynamic());
         // Create a new target with the join as unconditional successor.
         TargetEntryInstr* new_target = new TargetEntryInstr(
             AllocateBlockId(), old_target->try_index(), DeoptId::kNone);

runtime/vm/compiler/backend/inliner_test.cc

@@ -0,0 +1,83 @@
+// Copyright (c) 2019, the Dart project authors.  Please see the AUTHORS file
+// for details. All rights reserved. Use of this source code is governed by a
+// BSD-style license that can be found in the LICENSE file.
+
+#include "vm/compiler/backend/inliner.h"
+
+#include "vm/compiler/backend/il_printer.h"
+#include "vm/compiler/backend/il_test_helper.h"
+#include "vm/compiler/compiler_pass.h"
+#include "vm/object.h"
+#include "vm/unit_test.h"
+
+namespace dart {
+
+// Test that the redefinition for an inlined polymorphic function used with
+// multiple receiver cids does not have a concrete type.
+ISOLATE_UNIT_TEST_CASE(Inliner_PolyInliningRedefinition) {
+  const char* kScript = R"(
+    class A {
+      String toInline() { return "A"; }
+    }
+
+    class B extends A {
+      @override
+      String toInline() { return "B"; }
+    }
+    class C extends A {}
+    class D extends A {
+      @override
+      String toInline() { return "D";}
+    }
+    class E extends A {}
+
+    testInlining(A arg) {
+      arg.toInline();
+    }
+
+    main() {
+      for (var i = 0; i < 10; i++) {
+        testInlining(B());
+        testInlining(C());
+        testInlining(D());
+        testInlining(E());
+      }
+    }
+  )";
+
+  const auto& root_library = Library::Handle(LoadTestScript(kScript));
+  const auto& function =
+      Function::Handle(GetFunction(root_library, "testInlining"));
+
+  Invoke(root_library, "main");
+
+  TestPipeline pipeline(function, CompilerPass::kJIT);
+  FlowGraph* flow_graph = pipeline.RunPasses({
+      CompilerPass::kComputeSSA,
+      CompilerPass::kApplyICData,
+      CompilerPass::kTryOptimizePatterns,
+      CompilerPass::kSetOuterInliningId,
+      CompilerPass::kTypePropagation,
+      CompilerPass::kApplyClassIds,
+      CompilerPass::kInlining,
+  });
+
+  auto entry = flow_graph->graph_entry()->normal_entry();
+  EXPECT(entry != nullptr);
+
+  RedefinitionInstr* redefn = nullptr;
+
+  ILMatcher cursor(flow_graph, entry);
+  RELEASE_ASSERT(cursor.TryMatch(
+      {
+          kMatchAndMoveBranchFalse,
+          kMatchAndMoveBranchTrue,
+          {kMatchAndMoveRedefinition, &redefn},
+          kMatchReturn,
+      },
+      /*insert_before=*/kMoveGlob));
+
+  EXPECT(redefn->Type()->ToCid() == kDynamicCid);
+}
+
+}  // namespace dart

runtime/vm/compiler/compiler_sources.gni

@@ -168,6 +168,7 @@ compiler_sources_tests = [
   "backend/il_test.cc",
   "backend/il_test_helper.h",
   "backend/il_test_helper.cc",
+  "backend/inliner_test.cc",
   "backend/locations_helpers_test.cc",
   "backend/loops_test.cc",
   "backend/range_analysis_test.cc",