[vm/bytecode] Check number of type arguments in non-generic closures

Fixes #39283

Change-Id: I5a5fdf158c6a7ce068be36754ea0487cb754584b
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/124470
Reviewed-by: Régis Crelier <regis@google.com>
Commit-Queue: Alexander Markov <alexmarkov@google.com>

Author: alexmarkov

pkg/vm/lib/bytecode/gen_bytecode.dart

@@ -1943,6 +1943,14 @@ class BytecodeGenerator extends RecursiveVisitor<Null> {
       _handleDefaultTypeArguments(function, done);
 
       asm.bind(done);
+    } else if (isClosure &&
+        !(parentFunction != null &&
+            parentFunction.dartAsyncMarker != AsyncMarker.Sync)) {
+      // Closures can be called dynamically with arbitrary arguments,
+      // so they should check number of type arguments, even if
+      // closure is not generic.
+      // Synthetic async_op closures don't need this check.
+      asm.emitCheckFunctionTypeArgs(0, locals.scratchVarIndexInFrame);
     }
 
     // Open initial scope before the first CheckStack, as VM might

pkg/vm/testcases/bytecode/async.dart.expect

@@ -73,6 +73,7 @@ ClosureCode {
   Push                 FP[-6]
   LoadFieldTOS         CP#1
   PopLocal             r0
+  CheckFunctionTypeArgs 0, r1
   CheckStack           0
   AllocateContext      0, 9
   PopLocal             r0
@@ -1560,6 +1561,7 @@ ClosureCode {
   Push                 FP[-5]
   LoadFieldTOS         CP#1
   PopLocal             r0
+  CheckFunctionTypeArgs 0, r1
   CheckStack           0
   AllocateContext      1, 9
   StoreLocal           r1

pkg/vm/testcases/bytecode/closures.dart.expect

@@ -69,6 +69,7 @@ ClosureCode {
   Push                 FP[-6]
   LoadFieldTOS         CP#1
   PopLocal             r0
+  CheckFunctionTypeArgs 0, r1
   CheckStack           0
   JumpIfUnchecked      L1
   Push                 FP[-5]
@@ -768,6 +769,7 @@ ClosureCode {
   Push                 FP[-5]
   LoadFieldTOS         CP#1
   PopLocal             r1
+  CheckFunctionTypeArgs 0, r2
   CheckStack           0
   Push                 FP[-5]
   LoadFieldTOS         CP#6
@@ -987,6 +989,7 @@ ClosureCode {
   Push                 FP[-6]
   LoadFieldTOS         CP#1
   PopLocal             r0
+  CheckFunctionTypeArgs 0, r1
   CheckStack           0
   AllocateContext      1, 2
   StoreLocal           r1
@@ -1057,6 +1060,7 @@ ClosureCode {
   Push                 FP[-5]
   LoadFieldTOS         CP#1
   PopLocal             r0
+  CheckFunctionTypeArgs 0, r1
   CheckStack           0
   Push                 r0
   LoadContextParent
@@ -1085,6 +1089,7 @@ ClosureCode {
   Push                 FP[-5]
   LoadFieldTOS         CP#1
   PopLocal             r0
+  CheckFunctionTypeArgs 0, r1
   CheckStack           0
   Push                 r0
   LoadContextVar       0, 0
@@ -1242,6 +1247,7 @@ ClosureCode {
   Push                 FP[-5]
   LoadFieldTOS         CP#5
   PopLocal             r0
+  CheckFunctionTypeArgs 0, r1
   CheckStack           0
   Push                 r0
   LoadContextVar       1, 0
@@ -1258,6 +1264,7 @@ ClosureCode {
   Push                 FP[-6]
   LoadFieldTOS         CP#5
   PopLocal             r0
+  CheckFunctionTypeArgs 0, r1
   CheckStack           0
   JumpIfUnchecked      L1
   Push                 FP[-5]
@@ -1360,6 +1367,7 @@ ClosureCode {
   Push                 FP[-5]
   LoadFieldTOS         CP#7
   PopLocal             r0
+  CheckFunctionTypeArgs 0, r1
   CheckStack           0
   Push                 r0
   Push                 r0
@@ -1457,6 +1465,7 @@ ClosureCode {
   Push                 FP[-5]
   LoadFieldTOS         CP#5
   PopLocal             r0
+  CheckFunctionTypeArgs 0, r1
   CheckStack           0
   Push                 r0
   LoadContextVar       0, 0
@@ -1515,6 +1524,7 @@ ClosureCode {
   Push                 FP[-5]
   LoadFieldTOS         CP#1
   PopLocal             r0
+  CheckFunctionTypeArgs 0, r1
   CheckStack           0
   AllocateClosure      CP#3
   StoreLocal           r3
@@ -1548,6 +1558,7 @@ ClosureCode {
   Push                 FP[-5]
   LoadFieldTOS         CP#1
   PopLocal             r0
+  CheckFunctionTypeArgs 0, r1
   CheckStack           0
   PushNull
   ReturnTOS

pkg/vm/testcases/bytecode/try_blocks.dart.expect

@@ -341,6 +341,7 @@ ClosureCode {
   Push                 FP[-5]
   LoadFieldTOS         CP#1
   PopLocal             r0
+  CheckFunctionTypeArgs 0, r1
   CheckStack           0
   Push                 r0
   PopLocal             r2
@@ -377,6 +378,7 @@ ClosureCode {
   Push                 FP[-5]
   LoadFieldTOS         CP#1
   PopLocal             r0
+  CheckFunctionTypeArgs 0, r1
   CheckStack           0
   Push                 r0
   PopLocal             r2
@@ -723,6 +725,7 @@ ClosureCode {
   Push                 FP[-5]
   LoadFieldTOS         CP#7
   PopLocal             r0
+  CheckFunctionTypeArgs 0, r1
   CheckStack           0
   Push                 r0
   LoadContextVar       0, 0
@@ -831,6 +834,7 @@ ClosureCode {
   Push                 FP[-5]
   LoadFieldTOS         CP#1
   PopLocal             r0
+  CheckFunctionTypeArgs 0, r1
   CheckStack           0
   Push                 r0
   LoadContextVar       0, 0

runtime/vm/compiler/frontend/bytecode_flow_graph_builder.cc

@@ -696,7 +696,6 @@ void BytecodeFlowGraphBuilder::BuildCheckFunctionTypeArgs() {
 
   const intptr_t expected_num_type_args = DecodeOperandA().value();
   LocalVariable* type_args_var = LocalVariableAt(DecodeOperandE().value());
-  ASSERT(function().IsGeneric());
 
   if (throw_no_such_method_ == nullptr) {
     throw_no_such_method_ = B->BuildThrowNoSuchMethod();

tests/language_2/vm/regress_39283_test.dart

@@ -0,0 +1,22 @@
+// Copyright (c) 2019, the Dart project authors.  Please see the AUTHORS file
+// for details. All rights reserved. Use of this source code is governed by a
+// BSD-style license that can be found in the LICENSE file.
+
+import "package:expect/expect.dart";
+
+class A {
+  dynamic foo(a) {
+    baz() {
+      Expect.fail('Should not be reachable');
+    }
+
+    return baz;
+  }
+}
+
+main() {
+  Expect.throws(() {
+    dynamic x = A().foo(1);
+    x<List>();
+  }, (e) => e is NoSuchMethodError);
+}