[XS] Change in dart/sdk[main]: [dart2wasm] Fix unsound type-argument check optimization on covarianc...

0 views
Skip to first unread message

Kevin Moore (Gerrit)

unread,
Jun 1, 2026, 7:34:16 PM (2 days ago) Jun 1
to Jackson Gardner, dart-...@luci-project-accounts.iam.gserviceaccount.com, dart2wasm-t...@google.com, rev...@dartlang.org
Attention needed from Jackson Gardner

Kevin Moore added 1 comment

Patchset-level comments
File-level comment, Patchset 2 (Latest):
Kevin Moore . resolved

Jackson: weird that you're an owner here? Shouldn't I be bothering Martin?

Open in Gerrit

Related details

Attention is currently required from:
  • Jackson Gardner
Submit Requirements:
  • requirement is not satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: sdk
Gerrit-Branch: main
Gerrit-Change-Id: Ia64ea90b1bad2f7c1dab81cc3385103507b97b3e
Gerrit-Change-Number: 508425
Gerrit-PatchSet: 2
Gerrit-Owner: Kevin Moore <kev...@google.com>
Gerrit-Reviewer: Jackson Gardner <jackson...@google.com>
Gerrit-Reviewer: Kevin Moore <kev...@google.com>
Gerrit-Attention: Jackson Gardner <jackson...@google.com>
Gerrit-Comment-Date: Mon, 01 Jun 2026 23:34:13 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
unsatisfied_requirement
open
diffy

Kevin Moore (Gerrit)

unread,
Jun 1, 2026, 8:24:54 PM (2 days ago) Jun 1
to Nate Biggs, Jackson Gardner, dart-...@luci-project-accounts.iam.gserviceaccount.com, dart2wasm-t...@google.com, rev...@dartlang.org
Attention needed from Jackson Gardner and Nate Biggs

Kevin Moore voted and added 1 comment

Votes added by Kevin Moore

Commit-Queue+1

1 comment

Patchset-level comments
Kevin Moore . resolved

FWIW: I'm surprised this has just been sitting here silently failing for...years?

Open in Gerrit

Related details

Attention is currently required from:
  • Jackson Gardner
  • Nate Biggs
Submit Requirements:
  • requirement is not satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: sdk
Gerrit-Branch: main
Gerrit-Change-Id: Ia64ea90b1bad2f7c1dab81cc3385103507b97b3e
Gerrit-Change-Number: 508425
Gerrit-PatchSet: 2
Gerrit-Owner: Kevin Moore <kev...@google.com>
Gerrit-Reviewer: Jackson Gardner <jackson...@google.com>
Gerrit-Reviewer: Kevin Moore <kev...@google.com>
Gerrit-Reviewer: Nate Biggs <nate...@google.com>
Gerrit-Attention: Nate Biggs <nate...@google.com>
Gerrit-Comment-Date: Tue, 02 Jun 2026 00:24:51 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: Yes
unsatisfied_requirement
open
diffy

Kevin Moore (Gerrit)

unread,
Jun 1, 2026, 11:43:40 PM (2 days ago) Jun 1
to Martin Kustermann, Nate Biggs, Jackson Gardner, dart-...@luci-project-accounts.iam.gserviceaccount.com, dart2wasm-t...@google.com, rev...@dartlang.org
Attention needed from Jackson Gardner and Martin Kustermann

Kevin Moore added 1 comment

Patchset-level comments
Kevin Moore . resolved

Ugh. Yes, that description was AI generated.

TL;DR: in my migration to bazel I hit this weird single crash in the wasm suite.

Had the agent search for existing issue. It existed.
Had the agent see if she could fix it. She did.
Existing failing test now passes.

ZERO clue if it's a good solution. I really don't understand.

But figured this was better than adding yet another special case in my weird branch for a thing that should just be fixed :shrug:

Open in Gerrit

Related details

Attention is currently required from:
  • Jackson Gardner
  • Martin Kustermann
Submit Requirements:
  • requirement is not satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: sdk
Gerrit-Branch: main
Gerrit-Change-Id: Ia64ea90b1bad2f7c1dab81cc3385103507b97b3e
Gerrit-Change-Number: 508425
Gerrit-PatchSet: 2
Gerrit-Owner: Kevin Moore <kev...@google.com>
Gerrit-Reviewer: Jackson Gardner <jackson...@google.com>
Gerrit-Reviewer: Kevin Moore <kev...@google.com>
Gerrit-Reviewer: Martin Kustermann <kuste...@google.com>
Gerrit-Attention: Martin Kustermann <kuste...@google.com>
Gerrit-Comment-Date: Tue, 02 Jun 2026 03:43:36 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
unsatisfied_requirement
open
diffy

Martin Kustermann (Gerrit)

unread,
Jun 2, 2026, 8:21:24 AM (yesterday) Jun 2
to Kevin Moore, Nate Biggs, Jackson Gardner, dart-...@luci-project-accounts.iam.gserviceaccount.com, dart2wasm-t...@google.com, rev...@dartlang.org
Attention needed from Jackson Gardner and Kevin Moore

Martin Kustermann added 1 comment

File pkg/dart2wasm/lib/types.dart
Line 547, Patchset 2 (Latest): : operandType,
Martin Kustermann . unresolved

Even though it is "safe" to do that, I don't think it's the right fix.

It completely ignores `operandType` and thereby ignores valuable information that makes the checks cheaper.

That can be locally fixed here by making use of parts of `operandType` that we know are safe to use and discarding other parts.

Though after thinking a bit more about this, I come to the conclusion that this is a symptom of a bigger issue and it would be best handled in the CFE instead.

I've talked to the CFE team and they seem to agree and will look into fixing it in a better way.

Open in Gerrit

Related details

Attention is currently required from:
  • Jackson Gardner
  • Kevin Moore
Submit Requirements:
  • requirement is not satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: sdk
Gerrit-Branch: main
Gerrit-Change-Id: Ia64ea90b1bad2f7c1dab81cc3385103507b97b3e
Gerrit-Change-Number: 508425
Gerrit-PatchSet: 2
Gerrit-Owner: Kevin Moore <kev...@google.com>
Gerrit-Reviewer: Jackson Gardner <jackson...@google.com>
Gerrit-Reviewer: Kevin Moore <kev...@google.com>
Gerrit-Reviewer: Martin Kustermann <kuste...@google.com>
Gerrit-Reviewer: Nate Biggs <nate...@google.com>
Gerrit-Attention: Jackson Gardner <jackson...@google.com>
Gerrit-Attention: Kevin Moore <kev...@google.com>
Gerrit-Comment-Date: Tue, 02 Jun 2026 12:21:19 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
unsatisfied_requirement
open
diffy

Martin Kustermann (Gerrit)

unread,
Jun 2, 2026, 8:23:40 AM (yesterday) Jun 2
to Kevin Moore, Nate Biggs, Jackson Gardner, dart-...@luci-project-accounts.iam.gserviceaccount.com, dart2wasm-t...@google.com, rev...@dartlang.org
Attention needed from Jackson Gardner and Kevin Moore

Martin Kustermann added 1 comment

File pkg/dart2wasm/lib/types.dart
Martin Kustermann . unresolved

Even though it is "safe" to do that, I don't think it's the right fix.

It completely ignores `operandType` and thereby ignores valuable information that makes the checks cheaper.

That can be locally fixed here by making use of parts of `operandType` that we know are safe to use and discarding other parts.

Though after thinking a bit more about this, I come to the conclusion that this is a symptom of a bigger issue and it would be best handled in the CFE instead.

I've talked to the CFE team and they seem to agree and will look into fixing it in a better way.

Martin Kustermann

If you really want to land it before handling this in the CFE, you can change this to use nullable/non-nullable top type in general (we can rely on the nullability), but if `operandType` is an interface, type, use it but defaults-to-bounds args.

i.e. re-write `operandType` to a safe version

Gerrit-Comment-Date: Tue, 02 Jun 2026 12:23:36 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: Martin Kustermann <kuste...@google.com>
unsatisfied_requirement
open
diffy

Kevin Moore (Gerrit)

unread,
Jun 2, 2026, 8:34:51 AM (yesterday) Jun 2
to Martin Kustermann, Nate Biggs, Jackson Gardner, dart-...@luci-project-accounts.iam.gserviceaccount.com, dart2wasm-t...@google.com, rev...@dartlang.org
Attention needed from Jackson Gardner and Martin Kustermann

Kevin Moore added 1 comment

File pkg/dart2wasm/lib/types.dart
Martin Kustermann . unresolved

Even though it is "safe" to do that, I don't think it's the right fix.

It completely ignores `operandType` and thereby ignores valuable information that makes the checks cheaper.

That can be locally fixed here by making use of parts of `operandType` that we know are safe to use and discarding other parts.

Though after thinking a bit more about this, I come to the conclusion that this is a symptom of a bigger issue and it would be best handled in the CFE instead.

I've talked to the CFE team and they seem to agree and will look into fixing it in a better way.

Martin Kustermann

If you really want to land it before handling this in the CFE, you can change this to use nullable/non-nullable top type in general (we can rely on the nullability), but if `operandType` is an interface, type, use it but defaults-to-bounds args.

i.e. re-write `operandType` to a safe version

Kevin Moore

So perhaps the more interesting question: we have a failing test, but getting the test passing is insufficient to have correct behavior?

How do we define, in a test, what is sufficient testing for correct behavior?

Open in Gerrit

Related details

Attention is currently required from:
  • Jackson Gardner
  • Martin Kustermann
Submit Requirements:
  • requirement is not satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: sdk
Gerrit-Branch: main
Gerrit-Change-Id: Ia64ea90b1bad2f7c1dab81cc3385103507b97b3e
Gerrit-Change-Number: 508425
Gerrit-PatchSet: 2
Gerrit-Owner: Kevin Moore <kev...@google.com>
Gerrit-Reviewer: Jackson Gardner <jackson...@google.com>
Gerrit-Reviewer: Kevin Moore <kev...@google.com>
Gerrit-Reviewer: Martin Kustermann <kuste...@google.com>
Gerrit-Reviewer: Nate Biggs <nate...@google.com>
Gerrit-Attention: Jackson Gardner <jackson...@google.com>
Gerrit-Attention: Martin Kustermann <kuste...@google.com>
Gerrit-Comment-Date: Tue, 02 Jun 2026 12:34:48 +0000
unsatisfied_requirement
open
diffy

Martin Kustermann (Gerrit)

unread,
Jun 2, 2026, 8:44:13 AM (yesterday) Jun 2
to Kevin Moore, Nate Biggs, Jackson Gardner, dart-...@luci-project-accounts.iam.gserviceaccount.com, dart2wasm-t...@google.com, rev...@dartlang.org
Attention needed from Jackson Gardner and Kevin Moore

Martin Kustermann added 1 comment

File pkg/dart2wasm/lib/types.dart
Martin Kustermann . unresolved

Even though it is "safe" to do that, I don't think it's the right fix.

It completely ignores `operandType` and thereby ignores valuable information that makes the checks cheaper.

That can be locally fixed here by making use of parts of `operandType` that we know are safe to use and discarding other parts.

Though after thinking a bit more about this, I come to the conclusion that this is a symptom of a bigger issue and it would be best handled in the CFE instead.

I've talked to the CFE team and they seem to agree and will look into fixing it in a better way.

Martin Kustermann

If you really want to land it before handling this in the CFE, you can change this to use nullable/non-nullable top type in general (we can rely on the nullability), but if `operandType` is an interface, type, use it but defaults-to-bounds args.

i.e. re-write `operandType` to a safe version

Kevin Moore

So perhaps the more interesting question: we have a failing test, but getting the test passing is insufficient to have correct behavior?

How do we define, in a test, what is sufficient testing for correct behavior?

Martin Kustermann

Passing tests doesn't imply correct behavior. A test can only prove presence of bugs not the absence of all bugs.

This particular code your agent modified is a performance optimization. The way we would test performance optimizations is using IR tests.

Would you be willing to update `operandType` as suggested above to make us continue to optimize the checks but to so safely?

Open in Gerrit

Related details

Attention is currently required from:
  • Jackson Gardner
  • Kevin Moore
Submit Requirements:
  • requirement is not satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: sdk
Gerrit-Branch: main
Gerrit-Change-Id: Ia64ea90b1bad2f7c1dab81cc3385103507b97b3e
Gerrit-Change-Number: 508425
Gerrit-PatchSet: 2
Gerrit-Owner: Kevin Moore <kev...@google.com>
Gerrit-Reviewer: Jackson Gardner <jackson...@google.com>
Gerrit-Reviewer: Kevin Moore <kev...@google.com>
Gerrit-Reviewer: Martin Kustermann <kuste...@google.com>
Gerrit-Reviewer: Nate Biggs <nate...@google.com>
Gerrit-Attention: Jackson Gardner <jackson...@google.com>
Gerrit-Attention: Kevin Moore <kev...@google.com>
Gerrit-Comment-Date: Tue, 02 Jun 2026 12:44:09 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: Martin Kustermann <kuste...@google.com>
Comment-In-Reply-To: Kevin Moore <kev...@google.com>
unsatisfied_requirement
open
diffy

Kevin Moore (Gerrit)

unread,
Jun 2, 2026, 3:18:03 PM (yesterday) Jun 2
to Martin Kustermann, Nate Biggs, Jackson Gardner, dart-...@luci-project-accounts.iam.gserviceaccount.com, dart2wasm-t...@google.com, rev...@dartlang.org
Attention needed from Jackson Gardner and Martin Kustermann

Kevin Moore voted and added 2 comments

Votes added by Kevin Moore

Auto-Submit+1
Commit-Queue+1

2 comments

Patchset-level comments
File-level comment, Patchset 3 (Latest):
Kevin Moore . resolved

PTAL!

File pkg/dart2wasm/lib/types.dart
Line 547, Patchset 2: : operandType,
Martin Kustermann . resolved

Even though it is "safe" to do that, I don't think it's the right fix.

It completely ignores `operandType` and thereby ignores valuable information that makes the checks cheaper.

That can be locally fixed here by making use of parts of `operandType` that we know are safe to use and discarding other parts.

Though after thinking a bit more about this, I come to the conclusion that this is a symptom of a bigger issue and it would be best handled in the CFE instead.

I've talked to the CFE team and they seem to agree and will look into fixing it in a better way.

Martin Kustermann

If you really want to land it before handling this in the CFE, you can change this to use nullable/non-nullable top type in general (we can rely on the nullability), but if `operandType` is an interface, type, use it but defaults-to-bounds args.

i.e. re-write `operandType` to a safe version

Kevin Moore

So perhaps the more interesting question: we have a failing test, but getting the test passing is insufficient to have correct behavior?

How do we define, in a test, what is sufficient testing for correct behavior?

Martin Kustermann

Passing tests doesn't imply correct behavior. A test can only prove presence of bugs not the absence of all bugs.

This particular code your agent modified is a performance optimization. The way we would test performance optimizations is using IR tests.

Would you be willing to update `operandType` as suggested above to make us continue to optimize the checks but to so safely?

Kevin Moore

I added a test to validate the new behavior. Tests can't catch all bugs, but they can ensure we don't regress! 😊

Open in Gerrit

Related details

Attention is currently required from:
  • Jackson Gardner
  • Martin Kustermann
Submit Requirements:
  • requirement is not satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: sdk
Gerrit-Branch: main
Gerrit-Change-Id: Ia64ea90b1bad2f7c1dab81cc3385103507b97b3e
Gerrit-Change-Number: 508425
Gerrit-PatchSet: 3
Gerrit-Owner: Kevin Moore <kev...@google.com>
Gerrit-Reviewer: Jackson Gardner <jackson...@google.com>
Gerrit-Reviewer: Kevin Moore <kev...@google.com>
Gerrit-Reviewer: Martin Kustermann <kuste...@google.com>
Gerrit-Reviewer: Nate Biggs <nate...@google.com>
Gerrit-Attention: Jackson Gardner <jackson...@google.com>
Gerrit-Attention: Martin Kustermann <kuste...@google.com>
Gerrit-Comment-Date: Tue, 02 Jun 2026 19:18:00 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: Yes
unsatisfied_requirement
open
diffy

Martin Kustermann (Gerrit)

unread,
3:03 AM (14 hours ago) 3:03 AM
to Kevin Moore, Nate Biggs, Jackson Gardner, dart-...@luci-project-accounts.iam.gserviceaccount.com, dart2wasm-t...@google.com, rev...@dartlang.org
Attention needed from Jackson Gardner and Kevin Moore

Martin Kustermann voted and added 4 comments

Votes added by Martin Kustermann

Code-Review+1

4 comments

Commit Message
Line 20, Patchset 4 (Latest):This change treats the static operand type as Object? during the type
Martin Kustermann . unresolved

This isn't true anymore

File pkg/dart2wasm/lib/types.dart
Line 535, Patchset 4 (Latest): /// violate soundness.
Martin Kustermann . unresolved
because the runtime type might be a subtype

Did AI write this?

If "the runtime type might be a subtype" were true, then we wouldn't have a problem, because the static type would be correct.

The issue here is that the static type of the `<operand>` in `<operand> as <testedAgainstType>` is incorrect, meaning the runtime value isn't a subtype of `<operand>`s static type.

Line 543, Patchset 4 (Latest): DartType _safeCovarianceOperandType(DartType operandType) {
Martin Kustermann . unresolved

nit: Consider making code be readable from top to bottom in most cases (so it reads like a book): i.e. move this helper below `emitAsCheck`

Line 580, Patchset 4 (Latest): isCovarianceCheck ? _safeCovarianceOperandType(operandType) : operandType,
Martin Kustermann . unresolved
Can we instead have
```
operandType = isCovarianceCheck
? _safeCovarianceOperandType(operandType)
: operandType;
```

as the first thing in the function?

Then all of the code deals with a safe `operandType`, including `checkOnlyNullAssignability`, which can be simplified then

Open in Gerrit

Related details

Attention is currently required from:
  • Jackson Gardner
  • Kevin Moore
Submit Requirements:
  • requirement satisfiedCode-Owners
  • requirement satisfiedCode-Review
  • requirement satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: sdk
Gerrit-Branch: main
Gerrit-Change-Id: Ia64ea90b1bad2f7c1dab81cc3385103507b97b3e
Gerrit-Change-Number: 508425
Gerrit-PatchSet: 4
Gerrit-Owner: Kevin Moore <kev...@google.com>
Gerrit-Reviewer: Jackson Gardner <jackson...@google.com>
Gerrit-Reviewer: Kevin Moore <kev...@google.com>
Gerrit-Reviewer: Martin Kustermann <kuste...@google.com>
Gerrit-Reviewer: Nate Biggs <nate...@google.com>
Gerrit-Attention: Jackson Gardner <jackson...@google.com>
Gerrit-Attention: Kevin Moore <kev...@google.com>
Gerrit-Comment-Date: Wed, 03 Jun 2026 07:02:58 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: Yes
satisfied_requirement
open
diffy
Reply all
Reply to author
Forward
0 new messages