[TG-7815] Fix bug in get_recursively_instantiated_type

jbmc/src/java_bytecode/java_types.h

@@ -735,13 +735,23 @@ class java_generic_parametert : public reference_typet
   }
 };
 
+/// Check whether a reference to a typet is a java generic parameter/variable,
+/// e.g., `T` in `List<T>`.
+/// \param type: Source type.
+/// \return True if \p type is a generic Java parameter type
+template <>
+inline bool can_cast_type<java_generic_parametert>(const typet &base)
+{
+  return is_reference(base) && is_java_generic_parameter_tag(base.subtype());
+}
+
 /// Checks whether the type is a java generic parameter/variable, e.g., `T` in
 /// `List<T>`.
 /// \param type: the type to check
 /// \return true if type is a generic Java parameter type
 inline bool is_java_generic_parameter(const typet &type)
 {
-  return is_reference(type) && is_java_generic_parameter_tag(type.subtype());
+  return can_cast_type<java_generic_parametert>(type);
 }
 
 /// \param type: source type

jbmc/src/java_bytecode/select_pointer_type.cpp

@@ -43,11 +43,10 @@ pointer_typet select_pointer_typet::specialize_generics(
     &generic_parameter_specialization_map,
   generic_parameter_recursion_trackingt &visited_nodes) const
 {
-  if(is_java_generic_parameter(pointer_type))
+  auto parameter = type_try_dynamic_cast<java_generic_parametert>(pointer_type);
+  if(parameter != nullptr)
   {
-    const java_generic_parametert &parameter =
-      to_java_generic_parameter(pointer_type);
-    const irep_idt &parameter_name = parameter.get_name();
+    const irep_idt &parameter_name = parameter->get_name();
 
     // avoid infinite recursion by looking at each generic argument from
     // previous assignments
@@ -82,26 +81,27 @@ pointer_typet select_pointer_typet::specialize_generics(
     visited_nodes.erase(parameter_name);
     return returned_type;
   }
-  else if(pointer_type.subtype().id() == ID_struct_tag)
+
+  auto subtype =
+    type_try_dynamic_cast<struct_tag_typet>(pointer_type.subtype());
+  if(subtype != nullptr && is_java_array_tag(subtype->get_identifier()))
   {
     // if the pointer is an array, recursively specialize its element type
-    const auto &array_subtype = to_struct_tag_type(pointer_type.subtype());
-    if(is_java_array_tag(array_subtype.get_identifier()))
-    {
-      const typet &array_element_type = java_array_element_type(array_subtype);
-      if(array_element_type.id() == ID_pointer)
-      {
-        const pointer_typet &new_array_type = specialize_generics(
-          to_pointer_type(array_element_type),
-          generic_parameter_specialization_map,
-          visited_nodes);
-
-        pointer_typet replacement_array_type = java_array_type('a');
-        replacement_array_type.subtype().set(ID_element_type, new_array_type);
-        return replacement_array_type;
-      }
-    }
+    auto array_element_type =
+      type_try_dynamic_cast<pointer_typet>(java_array_element_type(*subtype));
+    if(array_element_type == nullptr)
+      return pointer_type;
+
+    const pointer_typet &new_array_type = specialize_generics(
+      *array_element_type,
+      generic_parameter_specialization_map,
+      visited_nodes);
+
+    pointer_typet replacement_array_type = java_array_type('a');
+    replacement_array_type.subtype().set(ID_element_type, new_array_type);
+    return replacement_array_type;
   }
+
   return pointer_type;
 }