VM crashes on local function partial instantiation with interdependent types.

[biggs0125]

This combination of method type variables and local function type variables bounded by the enclosing method's type variables causes the compiler to crash when the local function is partially instantiated. The value of both type parameters on the local function are inferred from the declared type on the partial instantiation since they are interdependent.

class B {
  void foo<Q1 extends num, Q2 extends Q1>() {
    void bar<T1 extends Q1, T2 extends T1>(T2? arg) {
    }

    final void Function(Q1? arg) instantiated = bar;
    instantiated(null);
  }
}

main() {
  new B().foo();
}

Crash 1

version=3.3.0-edge.742e3bb9f8d28233c8afbc89c6839af01f9228e3 (main) (Tue Nov 28 13:15:59 2023 -0500) on "linux_x64"
pid=4051519, thread=4051544, isolate_group=main(0x55e7ebe8b570), isolate=main(0x55e7ebe8cd90)
os=linux, arch=x64, comp=no, sim=no
isolate_instructions=55e7e9ca3160, vm_instructions=55e7e9ca3160
fp=7f0b87a7daf0, sp=7f0b87a7d9b8, pc=55e7e9eab84c
  pc 0x000055e7e9eab84c fp 0x00007f0b87a7daf0 dart::Profiler::DumpStackTrace+0x7c
  pc 0x000055e7e9ca3354 fp 0x00007f0b87a7dbd0 dart::Assert::Fail+0x84
  pc 0x000055e7e9e7f5ec fp 0x00007f0b87a7dbf0 dart::LibraryPrefix::~LibraryPrefix+0x2c
  pc 0x000055e7e9e47f4b fp 0x00007f0b87a7dc50 dart::AbstractType::IsSubtypeOf+0x3b
  pc 0x000055e7e9e4d4aa fp 0x00007f0b87a7dd20 dart::Class::IsSubtypeOf+0x82a
  pc 0x000055e7e9d90c59 fp 0x00007f0b87a7de20 dart::BootstrapNatives::DN_Internal_boundsCheckForPartialInstantiation+0x1c9
  pc 0x000055e7e9e2d564 fp 0x00007f0b87a7e340 dart::NativeEntry::BootstrapNativeCallWrapper+0x54
  pc 0x00007f0b99082ae4 fp 0x00007f0b87a7e380 Unknown symbol
  pc 0x00007f0b8bfa2aa4 fp 0x00007f0b87a7e3c0 Unknown symbol
  pc 0x00007f0b8bfa292b fp 0x00007f0b87a7e438 Unknown symbol
  pc 0x00007f0b8bfa26d0 fp 0x00007f0b87a7e470 Unknown symbol
  pc 0x00007f0b8bfa25f6 fp 0x00007f0b87a7e498 Unknown symbol
  pc 0x00007f0b8bfa2523 fp 0x00007f0b87a7e4f8 Unknown symbol
  pc 0x00007f0b8bfa13e3 fp 0x00007f0b87a7e538 Unknown symbol
  pc 0x00007f0b8bfa1126 fp 0x00007f0b87a7e5a0 Unknown symbol
  pc 0x00007f0b8bfa01dc fp 0x00007f0b87a7e5f8 Unknown symbol
  pc 0x00007f0b99082e46 fp 0x00007f0b87a7e670 Unknown symbol
  pc 0x000055e7e9de12f3 fp 0x00007f0b87a7e6d0 dart::DartEntry::InvokeFunction+0x163
  pc 0x000055e7e9de2d26 fp 0x00007f0b87a7e710 dart::DartLibraryCalls::HandleMessage+0x126
  pc 0x000055e7e9dff29f fp 0x00007f0b87a7eca0 dart::IsolateMessageHandler::HandleMessage+0x2bf
  pc 0x000055e7e9e21626 fp 0x00007f0b87a7ed10 dart::MessageHandler::HandleMessages+0x116
  pc 0x000055e7e9e21c18 fp 0x00007f0b87a7ed60 dart::MessageHandler::TaskCallback+0x1e8
  pc 0x000055e7e9f1f1bb fp 0x00007f0b87a7ede0 dart::ThreadPool::WorkerLoop+0x14b
  pc 0x000055e7e9f1f452 fp 0x00007f0b87a7ee10 dart::ThreadPool::Worker::Main+0x72
  pc 0x000055e7e9ea86c6 fp 0x00007f0b87a7eed0 dart::ThreadStart+0xd6
-- End of DumpStackTrace
  pc 0x0000000000000000 fp 0x00007f0b87a7e380 sp 0x0000000000000000 [Stub] CallBootstrapNative
  pc 0x00007f0b8bfa2aa4 fp 0x00007f0b87a7e3c0 sp 0x00007f0b87a7e390 [Unoptimized] _boundsCheckForPartialInstantiation@9040228
  pc 0x00007f0b8bfa292b fp 0x00007f0b87a7e438 sp 0x00007f0b87a7e3d0 [Unoptimized] B.foo
  pc 0x00007f0b8bfa26d0 fp 0x00007f0b87a7e470 sp 0x00007f0b87a7e448 [Unoptimized] main
  pc 0x00007f0b8bfa25f6 fp 0x00007f0b87a7e498 sp 0x00007f0b87a7e480 [Unoptimized] main
  pc 0x00007f0b8bfa2523 fp 0x00007f0b87a7e4f8 sp 0x00007f0b87a7e4a8 [Unoptimized] _Closure@0150898.dyn:call
  pc 0x00007f0b8bfa13e3 fp 0x00007f0b87a7e538 sp 0x00007f0b87a7e508 [Unoptimized] _delayEntrypointInvocation@1026248.<anonymous closure>
  pc 0x00007f0b8bfa1126 fp 0x00007f0b87a7e5a0 sp 0x00007f0b87a7e548 [Unoptimized] _Closure@0150898.dyn:call
  pc 0x00007f0b8bfa01dc fp 0x00007f0b87a7e5f8 sp 0x00007f0b87a7e5b0 [Unoptimized] _RawReceivePort@1026248._handleMessage@1026248
  pc 0x00007f0b99082e46 fp 0x00007f0b87a7e670 sp 0x00007f0b87a7e608 [Stub] InvokeDartCode
Aborted

This slight modification of removing the second (unused) type parameter, Q2, on the method causes a slightly different error:

class B {
  void foo<Q1 extends num>() {
    void bar<T1 extends Q1, T2 extends T1>(T2? arg) {
    }

    final void Function(Q1? arg) instantiated = bar;
    instantiated(null);
  }
}

main() {
  new B().foo();
}

Crash 2

si_signo=Segmentation fault(11), si_code=SEGV_MAPERR(1), si_addr=(nil)
version=3.3.0-edge.742e3bb9f8d28233c8afbc89c6839af01f9228e3 (main) (Tue Nov 28 13:15:59 2023 -0500) on "linux_x64"
pid=4053556, thread=4053572, isolate_group=main(0x559ec70df570), isolate=main(0x559ec70e1c30)
os=linux, arch=x64, comp=no, sim=no
isolate_instructions=559ec52d6160, vm_instructions=559ec52d6160
fp=7f48feffdc00, sp=7f48feffdb78, pc=0
  pc 0x0000000000000000 fp 0x00007f48feffdc00 Unknown symbol
  pc 0x0000559ec5476fb2 fp 0x00007f48feffdc70 dart::TypeArguments::InstantiateFrom+0x142
  pc 0x0000559ec54a40ac fp 0x00007f48feffdce0 dart::Type::InstantiateFrom+0x8c
  pc 0x0000559ec547aee1 fp 0x00007f48feffdd20 dart::AbstractType::InstantiateAndTestSubtype+0xa1
  pc 0x0000559ec53c3c59 fp 0x00007f48feffde20 dart::BootstrapNatives::DN_Internal_boundsCheckForPartialInstantiation+0x1c9
  pc 0x0000559ec5460564 fp 0x00007f48feffe340 dart::NativeEntry::BootstrapNativeCallWrapper+0x54
  pc 0x00007f4910382ae4 fp 0x00007f48feffe380 Unknown symbol
  pc 0x00007f4903c22aa4 fp 0x00007f48feffe3c0 Unknown symbol
  pc 0x00007f4903c2292b fp 0x00007f48feffe438 Unknown symbol
  pc 0x00007f4903c226d0 fp 0x00007f48feffe470 Unknown symbol
  pc 0x00007f4903c225f6 fp 0x00007f48feffe498 Unknown symbol
  pc 0x00007f4903c22523 fp 0x00007f48feffe4f8 Unknown symbol
  pc 0x00007f4903c213e3 fp 0x00007f48feffe538 Unknown symbol
  pc 0x00007f4903c21126 fp 0x00007f48feffe5a0 Unknown symbol
  pc 0x00007f4903c201dc fp 0x00007f48feffe5f8 Unknown symbol
  pc 0x00007f4910382e46 fp 0x00007f48feffe670 Unknown symbol
  pc 0x0000559ec54142f3 fp 0x00007f48feffe6d0 dart::DartEntry::InvokeFunction+0x163
  pc 0x0000559ec5415d26 fp 0x00007f48feffe710 dart::DartLibraryCalls::HandleMessage+0x126
  pc 0x0000559ec543229f fp 0x00007f48feffeca0 dart::IsolateMessageHandler::HandleMessage+0x2bf
  pc 0x0000559ec5454626 fp 0x00007f48feffed10 dart::MessageHandler::HandleMessages+0x116
  pc 0x0000559ec5454c18 fp 0x00007f48feffed60 dart::MessageHandler::TaskCallback+0x1e8
  pc 0x0000559ec55521bb fp 0x00007f48feffede0 dart::ThreadPool::WorkerLoop+0x14b
  pc 0x0000559ec5552452 fp 0x00007f48feffee10 dart::ThreadPool::Worker::Main+0x72
  pc 0x0000559ec54db6c6 fp 0x00007f48feffeed0 dart::ThreadStart+0xd6
-- End of DumpStackTrace
  pc 0x0000000000000000 fp 0x00007f48feffe380 sp 0x0000000000000000 [Stub] CallBootstrapNative
  pc 0x00007f4903c22aa4 fp 0x00007f48feffe3c0 sp 0x00007f48feffe390 [Unoptimized] _boundsCheckForPartialInstantiation@9040228
  pc 0x00007f4903c2292b fp 0x00007f48feffe438 sp 0x00007f48feffe3d0 [Unoptimized] B.foo
  pc 0x00007f4903c226d0 fp 0x00007f48feffe470 sp 0x00007f48feffe448 [Unoptimized] main
  pc 0x00007f4903c225f6 fp 0x00007f48feffe498 sp 0x00007f48feffe480 [Unoptimized] main
  pc 0x00007f4903c22523 fp 0x00007f48feffe4f8 sp 0x00007f48feffe4a8 [Unoptimized] _Closure@0150898.dyn:call
  pc 0x00007f4903c213e3 fp 0x00007f48feffe538 sp 0x00007f48feffe508 [Unoptimized] _delayEntrypointInvocation@1026248.<anonymous closure>
  pc 0x00007f4903c21126 fp 0x00007f48feffe5a0 sp 0x00007f48feffe548 [Unoptimized] _Closure@0150898.dyn:call
  pc 0x00007f4903c201dc fp 0x00007f48feffe5f8 sp 0x00007f48feffe5b0 [Unoptimized] _RawReceivePort@1026248._handleMessage@1026248
  pc 0x00007f4910382e46 fp 0x00007f48feffe670 sp 0x00007f48feffe608 [Stub] InvokeDartCode
Aborted

I played around with removing various parts of this code and this was the most minimal reproduction I could get.

Both errors seem to come out of Internal_boundsCheckForPartialInstantiation.