[dart2wasm] Compile-time crash with mixin with a monomorphised `WasmArray` member

[osa1]

This is not a user-visible crash, but it's causing issues in the standard libraries.

import 'dart:_wasm';

class A {
  final int a;

  A(this.a);
}

class B extends A {
  final int b;

  B(int a, this.b): super(a);
}

class C extends A {
  final int c;

  C(int a, this.c): super(a);
}

mixin ArrayMixin<T extends A> {
  WasmArray<T?> array = WasmArray<T?>(10);

  void reallocate() {
    final newSize = array.length * 2;
    array = WasmArray<T?>(newSize);
  }
}

class Bs with ArrayMixin<B> {}

class Cs with ArrayMixin<C> {}

void main() {
  final bs = Bs();
  bs.reallocate();

  final cs = Cs();
  cs.reallocate();
}

Crash:

Null check operator used on a null value
#0      SelectorInfo._upperBound.<anonymous closure> (package:dart2wasm/dispatch_table.dart:203)
#1      MappedIterator.moveNext (dart:_internal/iterable.dart:413)
#2      SetBase.addAll (dart:collection/set.dart:58)
#3      _Set.addAll (dart:_compact_hash:1068)
#4      new LinkedHashSet.of (dart:collection/linked_hash_set.dart:192)
#5      Iterable.toSet (dart:core/iterable.dart:513)
#6      SelectorInfo._upperBound (package:dart2wasm/dispatch_table.dart:206)
#7      SelectorInfo._computeSignature.<anonymous closure> (package:dart2wasm/dispatch_table.dart:159)
#8      new _GrowableList.generate (dart:core-patch/growable_array.dart:136)
#9      SelectorInfo._computeSignature (package:dart2wasm/dispatch_table.dart:158)
#10     SelectorInfo.signature (package:dart2wasm/dispatch_table.dart:61)
#11     Translator.signatureForDirectCall (package:dart2wasm/translator.dart)
#12     AstCodeGenerator._directSet (package:dart2wasm/code_generator.dart:2285)
#13     AstCodeGenerator.visitInstanceSet (package:dart2wasm/code_generator.dart:2252)
#14     InstanceSet.accept1 (package:kernel/src/ast/expressions.dart:860)
#15     AstCodeGenerator.translateExpression (package:dart2wasm/code_generator.dart:667)
#16     AstCodeGenerator.visitExpressionStatement (package:dart2wasm/code_generator.dart:1158)
#17     ExpressionStatement.accept (package:kernel/src/ast/statements.dart:50)
#18     AstCodeGenerator.translateStatement (package:dart2wasm/code_generator.dart:684)
#19     AstCodeGenerator.visitBlock (package:dart2wasm/code_generator.dart:796)
#20     Block.accept (package:kernel/src/ast/statements.dart:103)
#21     AstCodeGenerator.translateStatement (package:dart2wasm/code_generator.dart:684)
#22     SynchronousProcedureCodeGenerator.generateInternal (package:dart2wasm/code_generator.dart:3195)
#23     AstCodeGenerator.generate (package:dart2wasm/code_generator.dart:212)
#24     AstCompilationTask.run (package:dart2wasm/translator.dart:1313)
#25     Translator.translate (package:dart2wasm/translator.dart:401)
#26     compileToModule (package:dart2wasm/compile.dart:253)
<asynchronous suspension>
#27     generateWasm (package:dart2wasm/generate_wasm.dart:80)
<asynchronous suspension>
#28     main (file:///usr/local/google/home/omersa/dart/sdk/sdk/pkg/dart2wasm/bin/dart2wasm.dart:10)
<asynchronous suspension>

Relevant code:

sdk/pkg/dart2wasm/lib/code_generator.dart

Lines 2278 to 2300 in 01238a4

	w.ValueType _directSet(Member target, Expression receiver, Expression value,
	{required bool preserved}) {
	w.Local? temp;
	final Reference reference = (target is Field)
	? target.setterReference!
	: (target as Procedure).reference;
	final w.FunctionType targetFunctionType =
	translator.signatureForDirectCall(reference);
	final w.ValueType paramType = targetFunctionType.inputs.last;
	translateExpression(receiver, targetFunctionType.inputs.first);
	translateExpression(value, paramType);
	if (preserved) {
	temp = addLocal(paramType);
	b.local_tee(temp);
	}
	call(reference, useUncheckedEntry: receiver is ThisExpression);
	if (preserved) {
	b.local_get(temp!);
	return temp.type;
	} else {
	return voidMarker;
	}
	}

It looks like the reference for the field array is not a field but a setter (not sure why), so we generate its signature via the dispatch table, which tries to take the LUB of WasmArray<B?> and WasmArray<C?>, and failing as WasmArray is a top type on its own.

[osa1]

I think there's two part to fixing this.

The problem occurs in polymorphic code like this:

WasmArray<T?> getArray<T extends A>(ArrayMixin<T> array) => array.array;

Even if we copy the array field to every mixin application this code remains polymorphic.

Currently this code tries to compute the least upper bound of different WasmArray types, which always fails. I can fix this in a hacky way with this:

diff --git a/pkg/dart2wasm/lib/dispatch_table.dart b/pkg/dart2wasm/lib/dispatch_table.dart
index b270441f303..6658649afe9 100644
--- a/pkg/dart2wasm/lib/dispatch_table.dart
+++ b/pkg/dart2wasm/lib/dispatch_table.dart
@@ -197,13 +197,18 @@ class SelectorInfo {
       return w.RefType(heapTypes.single, nullable: nullable);
     }
     int targetDepth = minDepth;
+
     while (heapTypes.length > 1) {
-      heapTypes = heapTypes.map((s) {
-        while (s.depth > targetDepth) {
-          s = s.superType!;
-        }
-        return s;
-      }).toSet();
+      if (heapTypes.every((heapType) => heapType is w.ArrayType)) {
+        return w.RefType(w.HeapType.array, nullable: false);
+      } else {
+        heapTypes = heapTypes.map((s) {
+          while (s.depth > targetDepth) {
+            s = s.superType!;
+          }
+          return s;
+        }).toSet();
+      }
       targetDepth -= 1;
     }
     return w.RefType.def(heapTypes.single, nullable: nullable);

That fixes the type of array.array expression, but the function itself still returns WasmArray<A?>:

  (rec
    (type $Array<A> (;557;) (array (field (mut (ref $A)))))
  )
  (rec
    (type $Array<B?> (;176;) (array (field (mut (ref null $B)))))
  )
  (rec
    (type $Array<C?> (;172;) (array (field (mut (ref null $C)))))
  )
  (func $getArray (;587;) (param $var0 (ref $_Type)) (param $var1 (ref $Object)) (result (ref $Array<A>))
    (local $var2 (ref $Object))
    local.get $var1
    local.tee $var2
    local.get $var2
    struct.get $#Top $field0
    i32.const 689
    i32.add
    call_indirect (param (ref $Object)) (result (ref array))
    ref.cast $Array<A>
    return
  )

So the ref.cast here always fails because none of the array getters return Array<A>:

  (func $_Cs&Object&ArrayMixin.array (;591;) (param $var0 (ref $Object)) (result (ref array))
    local.get $var0
    ref.cast $_Cs&Object&ArrayMixin
    struct.get $_Cs&Object&ArrayMixin $field2
  )
  (func $_Bs&Object&ArrayMixin.array (;592;) (param $var0 (ref $Object)) (result (ref array))
    local.get $var0
    ref.cast $_Bs&Object&ArrayMixin
    struct.get $_Bs&Object&ArrayMixin $field2
  )

The return type of getArray should be ref array.

[osa1]

In our dart:convert I want to make the UTF8 parser to operate on Wasm arrays instead of U8Lists. I haven't tried this yet, but I think this issue will block that change as we pass the chunk type to a mixin type parameter:

sdk/sdk/lib/_internal/wasm/lib/convert_patch.dart

Lines 1613 to 1614 in a946926

	class _JsonUtf8Parser extends _JsonParserWithListener
	with _ChunkedJsonParser<U8List> {

Here the mixin type will be _ChunkedJsonParser<WasmArray<WasmI8>>.