[vm,compiler] Treat 'Never' return type as unreachable

When building a flow graph, break control flow (close fragment) after
a call with return type 'Never'. Append 'Stop' instruction after
the call to make sure the return address is still within function
code range.

TEST=runtime/tests/vm/dart/regress_59941_il_test.dart

Fixes #59941
Issue #56969

Change-Id: I5bbc0b9740a4f7e06b8560589daeb2b44f13d084
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/405604
Reviewed-by: Slava Egorov <[email protected]>
Commit-Queue: Alexander Markov <[email protected]>

Author: alexmarkov

runtime/tests/vm/dart/regress_59941_il_test.dart

@@ -0,0 +1,57 @@
+// Copyright (c) 2025, the Dart project authors.  Please see the AUTHORS file
+// for details. All rights reserved. Use of this source code is governed by a
+// BSD-style license that can be found in the LICENSE file.
+
+// Verify that calling a method which returns Never breaks control flow.
+// Regression test for https://github.com/dart-lang/sdk/issues/59941.
+
+import 'package:expect/expect.dart';
+import 'package:vm/testing/il_matchers.dart';
+
+@pragma('vm:never-inline')
+void myprint(Object o) {
+  print(o);
+}
+
+@pragma('vm:never-inline')
+Never bar() {
+  throw 'baz';
+}
+
+@pragma('vm:never-inline')
+@pragma('vm:testing:print-flow-graph')
+int foo(bool condition, int arg) {
+  int i = arg;
+  if (condition) {
+    i = 2;
+    bar(); // <-- Return type `Never`, so it always throws and can never fall through.
+  }
+  return i;
+}
+
+main() {
+  Expect.equals(42, foo(false, 42));
+  Expect.equals(43, foo(false, 43));
+  Expect.throws(() {
+    foo(true, 44);
+  });
+}
+
+void matchIL$foo(FlowGraph graph) {
+  graph.dump();
+  graph.match([
+    match.block('Graph', []),
+    match.block('Function', [
+      'condition' << match.Parameter(index: 0),
+      'arg' << match.Parameter(index: 1),
+      match.CheckStackOverflow(),
+      match.Branch(
+        match.StrictCompare('condition', match.any, kind: '==='),
+        ifTrue: 'B3',
+        ifFalse: 'B4',
+      ),
+    ]),
+    'B3' << match.block('Target', [match.StaticCall(), match.Stop()]),
+    'B4' << match.block('Target', [match.DartReturn('arg')]),
+  ]);
+}

runtime/vm/compiler/backend/block_scheduler.cc

@@ -286,7 +286,7 @@ class AOTBlockScheduler {
       if ((marks & kVisitedMark) == 0) {
         marks |= kVisitedMark;
 
-        if (last->IsThrow() || last->IsReThrow()) {
+        if (last->IsThrow() || last->IsReThrow() || last->IsStop()) {
           marks |= kColdMark;
         } else {
           // When visiting a block inside a loop with two successors

runtime/vm/compiler/backend/flow_graph_checker.cc

@@ -117,6 +117,7 @@ static bool DefDominatesUse(Definition* def, Instruction* instruction) {
 static bool IsControlFlow(Instruction* instruction) {
   return instruction->IsBranch() || instruction->IsGoto() ||
          instruction->IsIndirectGoto() || instruction->IsReturnBase() ||
+         (instruction->IsStop() && instruction->next() == nullptr) ||
          instruction->IsThrow() || instruction->IsReThrow() ||
          instruction->IsTailCall();
 }

runtime/vm/compiler/frontend/base_flow_graph_builder.cc

@@ -224,6 +224,10 @@ Fragment BaseFlowGraphBuilder::Return(TokenPosition position) {
   return instructions.closed();
 }
 
+Fragment BaseFlowGraphBuilder::Stop(const char* message) {
+  return Fragment(new (Z) StopInstr(message)).closed();
+}
+
 bool BaseFlowGraphBuilder::ShouldOmitCheckBoundsIn(const Function& function,
                                                    const Function* caller) {
   auto& state = CompilerState::Current();
@@ -1233,6 +1237,13 @@ Fragment BaseFlowGraphBuilder::ClosureCall(
     instructions += Drop();
     instructions += Constant(result_type->constant_value);
   }
+  if (!target_function.IsNull()) {
+    const auto& return_type =
+        AbstractType::Handle(Z, target_function.result_type());
+    if (return_type.IsNeverType() && return_type.IsNonNullable()) {
+      instructions += Stop("unreachable after returning Never");
+    }
+  }
   return instructions;
 }
 

runtime/vm/compiler/frontend/base_flow_graph_builder.h

@@ -344,6 +344,7 @@ class BaseFlowGraphBuilder {
   Fragment BranchIfStrictEqual(TargetEntryInstr** then_entry,
                                TargetEntryInstr** otherwise_entry);
   Fragment Return(TokenPosition position);
+  Fragment Stop(const char* message);
   Fragment CheckStackOverflow(TokenPosition position,
                               intptr_t stack_depth,
                               intptr_t loop_depth);

runtime/vm/compiler/frontend/kernel_to_il.cc

@@ -418,6 +418,13 @@ Fragment FlowGraphBuilder::InstanceCall(
     instructions += Drop();
     instructions += Constant(result_type->constant_value);
   }
+  if (!interface_target.IsNull()) {
+    const auto& return_type =
+        AbstractType::Handle(Z, interface_target.result_type());
+    if (return_type.IsNeverType() && return_type.IsNonNullable()) {
+      instructions += Stop("unreachable after returning Never");
+    }
+  }
   return instructions;
 }
 
@@ -666,6 +673,10 @@ Fragment FlowGraphBuilder::StaticCall(TokenPosition position,
     instructions += Drop();
     instructions += Constant(result_type->constant_value);
   }
+  const auto& return_type = AbstractType::Handle(Z, target.result_type());
+  if (return_type.IsNeverType() && return_type.IsNonNullable()) {
+    instructions += Stop("unreachable after returning Never");
+  }
   return instructions;
 }