[CP] Fix Dart2JS type inference for record accesses on invalid indices. #52443
Labels
area-web
Use area-web for Dart web related issues, including the DDC and dart2js compilers and JS interop.
cherry-pick-approved
Label for approved cherrypick request
cherry-pick-merged
Cherry-pick has been merged to the stable or beta branch.
cherry-pick-review
Issue that need cherry pick triage to approve
merge-to-stable
Commit(s) to merge
327a680
Target
stable
Prepared changelist for beta/stable
https://dart-review.googlesource.com/c/sdk/+/304420
Issue Description
#52438
Dart2JS type inference crashes when a record field is accessed but the receiver type does not contain that field.
Users cannot manually generate code like that but code generated by switches can. Specifically when a record is demoted to dynamic/Object and then cased on in a switch with non-matching cases. The generated code from such a switch can contain record accesses that cause these crashes.
What is the fix
The fix is for each record access to check that the type of the receiver supports the selector being used.
Why cherry-pick
This causes crashes in Dart2JS on fairly trivial code. Multiple developers have discovered this bug.
Risk
low
Issue link(s)
#52438
Extra Info
No response
The text was updated successfully, but these errors were encountered: