[cfe] Soundness issue with missing caller-side check #46784
Description
Consider the following program:
class C<X> {
void m<Y extends X>(Y y) {}
}
void main() {
C<num> c = C<int>();
void Function<Z extends num>(Z) f = c.m;
print(f.runtimeType);
}This program is accepted by dart (from commit a4afb06), it runs without any dynamic errors, and it prints '<Y0 extends int>(Y0) => void'.
However, this is a soundness violation: The variable f holds a value whose dynamic type is not a subtype of the declared type of the variable.
We do not specify how to deal with this situation, but in a number of similar situations it is currently handled by performing a caller-side check (so the object which is the value of c.m is obtained, then it is checked that this object has the required type, and a dynamic error occurs if that is not the case).