Incorrect output from simple test in AOT mode when the option --enable-experiment=non-nullable is used

[a-siva]

The following test generates incorrect output when run in precompiled (AOT) mode

import 'dart:typed_data';

main() {
  var list = Float64List.fromList([
      1, 2, 3, 4,
      5, 6, 7, 8,
      9, 10, 11, 12,
      13, 14, 15, 16
    ]);
  print(list);
}

When run using the JIT it works fine

asiva-desktop[sdk]>out/ReleaseX64/dart-sdk/bin/dart --enable-experiment=non-nullable /tmp/test.dart
[1.0, 2.0, 3.0, 4.0, 5.0, 6.0, 7.0, 8.0, 9.0, 10.0, 11.0, 12.0, 13.0, 14.0, 15.0, 16.0]

However we running on the precompiled runtime the results are different

/usr/local/google/home/asiva/workspace/dart-tot/sdk/pkg/vm/tool/gen_kernel --enable-experiment=non-nullable --aot --platform=out/ReleaseX64/vm_platform_strong_product.dill -o /tmp/test.dill /tmp/test.dart -Ddart.vm.product=true

out/ReleaseX64/gen_snapshot_product --enable-experiment=non-nullable --snapshot-kind=app-aot-elf --elf=/tmp/test.elf /tmp/test.dill

out/ReleaseX64/dart_precompiled_runtime_product /tmp/test.elf
[1.0, 3.0, 5.0, 7.0, 9.0, 11.0, 13.0, 15.0, 0.0, 10.0, 0.0, 12.0, 0.0, 14.0, 0.0, 16.0]

The flutter engine also uses the product configuration and is seeing a similar issue.

[a-siva]

/cc @alexmarkov @crelier

[a-siva]

/cc @chinmaygarde

[a-siva]

The error does not reproduce when the --enable-experiment=non-nullable option is not used.

[franklinyow]

@franklinyow following

[alexmarkov]

The problem is that the first argument of _Float64List.[]= was unboxed, but flow graph intrinsic provided by the VM expects it to be boxed.

Kernel (should be both product and with sound null safety):

[@vm.procedure-attributes.metadata=methodOrSetterCalledDynamically:false,getterCalledDynamically:false,hasTearOffUses:false,methodOrSetterSelectorId:774] [@vm.unboxing-info.metadata=(i,b)->b]    operator []=([@vm.inferred-type.metadata=int] core::int index, [@vm.inferred-type.metadata=!] generic-covariant-impl core::double value) → void {

Regular flow graph (argument is unboxed):

==== dart:typed_data__Float64List@7027147_[]= (RegularFunction)
  0: B0[graph]:0 {
      v0 <- Constant(#null) T{Null?}
      v1 <- Constant(#<optimized out>) T{_OneByteString}
      v5 <- Constant(#Type: double) T{_Type}
      v8 <- Constant(#0) [0, 0] T{_Smi}
      v11 <- Constant(#true) T{bool}
      v18 <- Constant(#index) T{_OneByteString}
      v35 <- Constant(#8) [8, 8] T{_Smi}
}
  2: B8[function entry]:2 {
      v2 <- Parameter(0) T{_Float64List}
      v3 <- Parameter(1) [-9223372036854775808, 9223372036854775807] T{int}
      v4 <- Parameter(2) T{*}
}
  4:     CheckStackOverflow:8(stack=0, loop=0)
  5:     ParallelMove rax <- S+2, rdx <- C, rcx <- C
  6:     t0 <- AssertAssignable:12(v4, v5, 'value', instantiator_type_args(v0), function_type_args(v0)) T{double}
  8:     v51 <- UnboxedConstant(#0) [0, 0] T{_Smi}
  9:     ParallelMove rax <- S+3
 10:     Branch if RelationalOp(<, v3, v51) T{bool} goto (5, 3)
 12: B5[target]:36
 14:     ParallelMove rcx <- S+4 goto:38 B4
 16: B3[target]:32 ParallelMove rcx <- S+4
 18:     v41 <- LoadField(v2 . TypedDataBase.length {final}) [0, 4611686018427387903] T{_Smi}
 20:     ParallelMove rdx <- rdx
 20:     v47 <- UnboxInt64(v41) [0, 4611686018427387903] T{int}
 22:     Branch if RelationalOp(>=, v3, v47 T{_Smi}) T{bool} goto (6, 7)
 24: B6[target]:40
 26:     ParallelMove  goto:42 B4
 28: B4[join]:34 pred(B5, B6)
 30:     v16 <- AllocateObject(IndexError) T{IndexError}
 31:     ParallelMove rax <- rax
 32:     ParallelMove S-1 <- rax
 32:     PushArgument(v16)
 33:     ParallelMove rcx <- S+3
 34:     PushArgument(v3)
 36:     PushArgument(v2)
 38:     PushArgument(v18)
 40:     StaticCall:44( IndexError.<0> v16, v3, v2, v18)
 41:     ParallelMove rax <- S-1
 42:     Throw:46(v16)
 44: B7[target]:48 ParallelMove rdx <- rcx, rcx <- rax, rbx <- S+2
 46:     v53 <- UnboxedConstant(#8) [8, 8] T{_Smi}
 48:     ParallelMove rcx <- rcx
 48:     v31 <- BinaryInt64Op(* [tr], v3 T{int}, v53) [-9223372036854775808, 9223372036854775807] T{int}
 50:     ParallelMove rbx <- rbx
 50:     v33 <- Unbox:14(v4 T{double}) T{_Double}
 52:     StoreIndexed:14(v2, v31, v33, NoStoreBarrier)
 53:     ParallelMove rax <- C
 54:     Return:54(v0)
*** END CFG

Intrinsic graph:

Intrinsic graph after
==== dart:typed_data__Float64List@7027147_[]= (RegularFunction)
  0: B0[graph]:68 {
      v9 <- Constant(#null)
}
  2: B1[function entry]:70 {
      v0 <- Parameter(0)
      v1 <- Parameter(1) T{int}
      v2 <- Parameter(2) T{!null}
}
  3:     ParallelMove rcx <- S+3
  4:     v3 <- LoadField(v0 . TypedDataBase.length {final})
  5:     ParallelMove rbx <- S+2
  6:     CheckArrayBound(v3, v1)
  7:     ParallelMove rdx <- S+1
  8:     CheckClass(v2 Cids[1: _Double@0150898 etc.  cid 54])
 10:     v7 <- Unbox(v2 T{_Double}) T{_Double}
 12:     StoreIndexed(v0, v1, v7, NoStoreBarrier)
 13:     ParallelMove rax <- C
 14:     Return:72(v9)

@mkustermann

[alexmarkov]

Fix for this particular case: https://dart-review.googlesource.com/c/sdk/+/167865
Issue to check if this bug occurs in other cases: #43819

[a-siva]

flutter/engine#21919 is the PR that is rolling this change into the Flutter engine.