[vm,aot] Fix type check in implicit setter of a covariant field

Inferred type of a covariant field should not be used as
an argument type of an implicit setter, as setter of a covariant
field performs a type check before assigning value to the field.

Correct such uses of covariant field types in unboxing
and AOT type propagation in order to avoid incorrect removal of
a type check in the implicit setter of a covariant field.

TEST=runtime/tests/vm/dart/regress_56051_test.dart
Fixes #56051

Change-Id: I55bfedfd96e918aac9597706c6eab1b81e1202ee
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/372721
Reviewed-by: Slava Egorov <[email protected]>
Commit-Queue: Alexander Markov <[email protected]>

Author: alexmarkov

pkg/vm/lib/transformations/type_flow/unboxing_info.dart

@@ -176,6 +176,14 @@ class UnboxingInfoManager {
       final inferredType = typeFlowAnalysis.getFieldValue(member).value;
       if (member.hasSetter) {
         _applyToArg(member, unboxingInfo, 0, inferredType);
+        // Arguments of implicit setters for covariant fields
+        // cannot be unboxed based on the field type as setter
+        // performs a type check before value is assigned to the field.
+        if (member.isCovariantByDeclaration) {
+          unboxingInfo.argsInfo.length = 0;
+        } else {
+          _applyToArg(member, unboxingInfo, 0, inferredType);
+        }
       }
       _applyToReturn(member, unboxingInfo, inferredType);
     } else {

runtime/tests/vm/dart/regress_56051_test.dart

@@ -0,0 +1,29 @@
+// Copyright (c) 2024, the Dart project authors.  Please see the AUTHORS file
+// for details. All rights reserved. Use of this source code is governed by a
+// BSD-style license that can be found in the LICENSE file.
+
+// Regression test for https://github.com/dart-lang/sdk/issues/56051.
+
+// VMOptions=--compiler-passes=-Inlining
+
+import 'package:expect/expect.dart';
+
+class Foo {
+  covariant late num a;
+}
+
+class Bar extends Foo {
+  @override
+  late int a;
+}
+
+void main() {
+  Foo bar = Bar();
+  bar.a = 2;
+  Expect.equals(2, bar.a);
+  Expect.throws(() {
+    bar.a = 3.14 as dynamic;
+    print('bar.a is now ${bar.a}');
+  });
+  print("success!");
+}

runtime/vm/compiler/frontend/scope_builder.cc

@@ -300,15 +300,17 @@ ScopeBuildingResult* ScopeBuilder::BuildScopes() {
       if (is_setter) {
         if (CompilerState::Current().is_aot()) {
           const intptr_t kernel_offset = field.kernel_offset();
-          const InferredTypeMetadata parameter_type =
+          const InferredTypeMetadata inferred_field_type =
               inferred_type_metadata_helper_.GetInferredType(kernel_offset);
           result_->setter_value = MakeVariable(
               TokenPosition::kNoSource, TokenPosition::kNoSource,
               Symbols::Value(),
               AbstractType::ZoneHandle(Z, function.ParameterTypeAt(pos)),
               LocalVariable::kNoKernelOffset, /*is_late=*/false,
               /*inferred_type=*/nullptr,
-              /*inferred_arg_type=*/&parameter_type);
+              /*inferred_arg_type=*/field.is_covariant()
+                  ? nullptr
+                  : &inferred_field_type);
         } else {
           result_->setter_value = MakeVariable(
               TokenPosition::kNoSource, TokenPosition::kNoSource,