[dart2js] Move decision to do static type refinement to dataflow

This is a follow-up to https://dart-review.googlesource.com/c/sdk/+/426660

The "using" of the static type didn't work in loops since the variables used in the loop start out as phis with a top type, so the guard to avoid trusting the static type for legacy js-interop always applied.

There are very few code differences with this change, but if we can address the TODOs, especially to partition Dart closures from JavaScriptFunctions, there are some nice changes in loops that call function parameters.

Bug: #60327
Change-Id: I76252d99b8047f74547d34ddc10e23d1fa380b2e
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/426820
Reviewed-by: Mayank Patke <[email protected]>
Commit-Queue: Stephen Adams <[email protected]>

Author: rakudrama

pkg/compiler/lib/src/ssa/builder.dart

@@ -7030,17 +7030,11 @@ class KernelSsaGraphBuilder extends ir.VisitorDefault<void>
       final staticType = _abstractValueDomain
           .createFromStaticType(_getStaticType(node as ir.Expression))
           .abstractValue;
-      // Narrow to front-end inferred type, but only if `receiverType` is
-      // disjoint with LegacyJavaScriptObject.  Global type inference does not
-      // trust the legacy js-interop methods, so we should not start doing so
-      // here.
-      if (!_possiblyLegacyJavaScriptObject(selector, receiverType)) {
-        invoke.staticType = staticType;
-        invoke.instructionType = invoke.computeInstructionType(
-          resultType,
-          _abstractValueDomain,
-        );
-      }
+      invoke.staticType = staticType;
+      invoke.instructionType = invoke.computeInstructionType(
+        resultType,
+        _abstractValueDomain,
+      );
     }
     push(invoke);
     if (element != null &&
@@ -7052,18 +7046,6 @@ class KernelSsaGraphBuilder extends ir.VisitorDefault<void>
     }
   }
 
-  bool _possiblyLegacyJavaScriptObject(Selector selector, AbstractValue type) {
-    // Legacy js-interop cannot override `[]`.
-    if (selector.isIndex) return false;
-
-    if (_abstractValueDomain.isInterceptor(type).isDefinitelyFalse ||
-        _abstractValueDomain.isPrimitive(type).isDefinitelyTrue) {
-      return false;
-    }
-
-    return true;
-  }
-
   void _invokeJsInteropFunction(
     FunctionEntity element,
     List<HInstruction?> arguments, {

pkg/compiler/lib/src/ssa/nodes.dart

@@ -1967,6 +1967,18 @@ abstract class HInvokeDynamic extends HInvoke implements InstructionContext {
     AbstractValueDomain abstractValueDomain,
   ) {
     if (staticType == null) return value;
+
+    // When the receiver might be a LegacyJavaScriptObject, we don't trust the
+    // static type.  Global type inference is conservative for legacy js-interop
+    // methods, so we should be conservative here too.
+    if (_possiblyLegacyJavaScriptObject(
+      selector,
+      receiverType,
+      abstractValueDomain,
+    )) {
+      return value;
+    }
+
     final narrowed = abstractValueDomain.intersection(value, staticType!);
     // Preserve the sentinel in [value] since the static type does not include
     // a sentinel and the intersection would remove it.
@@ -1975,6 +1987,22 @@ abstract class HInvokeDynamic extends HInvoke implements InstructionContext {
         : narrowed;
   }
 
+  static bool _possiblyLegacyJavaScriptObject(
+    Selector selector,
+    AbstractValue type,
+    AbstractValueDomain domain,
+  ) {
+    // Legacy js-interop cannot override `[]`.
+    if (selector.isIndex) return false;
+    if (domain.isPrimitiveOrNull(type).isDefinitelyTrue) return false;
+    if (domain.isInterceptor(type).isDefinitelyFalse) return false;
+    // We get here for typed_data classes.
+    // TODO(sra): Test against LegacyJavaScriptObject explicitly.
+    // TODO(sra): Ensure that regular closures are not conflated with
+    // JavaScriptFunction which also implements `Function`.
+    return true;
+  }
+
   @override
   String toString() => 'invoke dynamic: selector=$selector, mask=$receiverType';