Crash in type inference on increment in operator assignment rhs

[askeksa-google]

Compiling

main() {
  int a = 1;
  int b = 0;
  b += a++;
}

produces this exception:

Unhandled exception:
'package:front_end/src/fasta/kernel/kernel_shadow_ast.dart': Failed assertion: line 436 pos 16: 'identical(combiner.arguments.positional[0], rhs)': is not true.
#0      _AssertionError._doThrowNew (dart:core-patch/dart:core/errors_patch.dart:37)
#1      _AssertionError._throwNew (dart:core-patch/dart:core/errors_patch.dart:33)
#2      ShadowComplexAssignment._inferRhs (package:front_end/src/fasta/kernel/kernel_shadow_ast.dart:436:16)
#3      ShadowVariableAssignment._inferExpression (package:front_end/src/fasta/kernel/kernel_shadow_ast.dart:2317:26)
#4      ShadowTypeInferrer.inferExpression (package:front_end/src/fasta/kernel/kernel_shadow_ast.dart:2152:25)
#5      ShadowExpressionStatement._inferStatement (package:front_end/src/fasta/kernel/kernel_shadow_ast.dart:688:14)
#6      ShadowTypeInferrer.inferStatement (package:front_end/src/fasta/kernel/kernel_shadow_ast.dart:2195:24)
#7      ShadowBlock._inferStatement (package:front_end/src/fasta/kernel/kernel_shadow_ast.dart:187:16)
#8      ShadowTypeInferrer.inferStatement (package:front_end/src/fasta/kernel/kernel_shadow_ast.dart:2195:24)
#9      TypeInferrerImpl.inferFunctionBody (package:front_end/src/fasta/type_inference/type_inferrer.dart:876:5)
#10     BodyBuilder.finishFunction (package:front_end/src/fasta/kernel/body_builder.dart:628:19)
#11     DietListener.listenerFinishFunction (package:front_end/src/fasta/source/diet_listener.dart:678:14)
#12     DietListener.parseFunctionBody (package:front_end/src/fasta/source/diet_listener.dart:712:7)
#13     DietListener.buildFunctionBody (package:front_end/src/fasta/source/diet_listener.dart:559:5)
#14     DietListener.endTopLevelMethod (package:front_end/src/fasta/source/diet_listener.dart:241:5)
#15     Parser.parseTopLevelMethod (package:front_end/src/fasta/parser/parser.dart:3176:14)
#16     Parser.parseTopLevelMember (package:front_end/src/fasta/parser/parser.dart:3055:14)
#17     Parser.parseTopLevelDeclarationImpl (package:front_end/src/fasta/parser/parser.dart:453:14)
#18     Parser.parseUnit (package:front_end/src/fasta/parser/parser.dart:307:15)
#19     SourceLoader.buildBody (package:front_end/src/fasta/source/source_loader.dart:199:14)
<asynchronous suspension>
#20     Loader.buildBodies (package:front_end/src/fasta/loader.dart:150:15)
<asynchronous suspension>
#21     KernelTarget.buildProgram (package:front_end/src/fasta/kernel/kernel_target.dart:280:20)
<asynchronous suspension>
#22     CompileTask.compile (file:///usr/local/google/home/askesc/dart-sdk/sdk/pkg/front_end/tool/_fasta/entry_points.dart:166:38)
<asynchronous suspension>
#23     compile.<anonymous closure> (file:///usr/local/google/home/askesc/dart-sdk/sdk/pkg/front_end/tool/_fasta/entry_points.dart:104:25)
<asynchronous suspension>
#24     withGlobalOptions.<anonymous closure> (file:///usr/local/google/home/askesc/dart-sdk/sdk/pkg/front_end/tool/_fasta/command_line.dart:368:13)
#25     CompilerContext.runInContext.<anonymous closure> (package:front_end/src/fasta/compiler_context.dart:96:35)
#26     _rootRun (dart:async/zone.dart:1126)
#27     _CustomZone.run (dart:async/zone.dart:1023)
#28     runZoned (dart:async/zone.dart:1501)
#29     CompilerContext.runInContext (package:front_end/src/fasta/compiler_context.dart:96:14)
#30     CompilerContext.runWithOptions (package:front_end/src/fasta/compiler_context.dart:107:41)
#31     withGlobalOptions (file:///usr/local/google/home/askesc/dart-sdk/sdk/pkg/front_end/tool/_fasta/command_line.dart:361:26)
#32     compile (file:///usr/local/google/home/askesc/dart-sdk/sdk/pkg/front_end/tool/_fasta/entry_points.dart:97:18)
<asynchronous suspension>
#33     compileEntryPoint (file:///usr/local/google/home/askesc/dart-sdk/sdk/pkg/front_end/tool/_fasta/entry_points.dart:55:11)
<asynchronous suspension>
#34     main (file:///usr/local/google/home/askesc/dart-sdk/sdk/pkg/front_end/tool/_fasta/compile.dart:7:33)
#35     _startIsolate.<anonymous closure> (dart:isolate-patch/dart:isolate/isolate_patch.dart:276)
#36     _RawReceivePortImpl._handleMessage (dart:isolate-patch/dart:isolate/isolate_patch.dart:164)

The situation arises in the language/language_2 tests branches_test, operator_test and prefix5_negative_test.

[kmillikin]

This is a consequence of how the Shadow nodes are designed. Some of them have a complicated Kernel desugaring and they also have "false children" for convenience that appear as if they were direct children of the Shadow node but are really pointing somewhere in the middle of the desugaring.

It's not completely safe to use any of these false children after inferring their type, because type inference will rewrite the tree.

The assertion failure asserts that one of these false children is identical to some other tree structure, but that is just not true if you try to assert it after the other structure has been rewritten.

I'll try to fix it by (1) moving the assertion to a place in the code where it is true, (2) using the correct subexpression for subsequent check insertion, and (3) setting the parent pointer to null when a node is replaced in the tree to try to catch problems like this without relying on a (wrong) assertion to trigger.

Proposed fix in https://dart-review.googlesource.com/c/sdk/+/52525