Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

dart2js: Type checks can be fooled by native objects #13010

Open
rakudrama opened this issue Sep 4, 2013 · 12 comments
Open

dart2js: Type checks can be fooled by native objects #13010

rakudrama opened this issue Sep 4, 2013 · 12 comments
Labels
area-web Use area-web for Dart web related issues, including the DDC and dart2js compilers and JS interop. P2 A bug or feature request we're likely to work on type-bug Incorrect behavior (everything from a crash to more subtle misbehavior) web-dart2js

Comments

@rakudrama
Copy link
Member

It should not be possible for native objects to be mistaken for Dart objects.

See tests/compiler/dart2js_native/fake_thing_test.dart

Type tests must use getInterceptor when (1) the test relies on a property on an object (e.g. $isThing) (2) the receiver could be a native instance.

@DartBot
Copy link

DartBot commented Sep 4, 2013

This comment was originally written by ngeoffray@google.com


I don't understand this bug. There are many ways a native object can fool dart2js generated code. What is is with type tests that we need to do something about it?


Added NeedsInfo label.

@peter-ahe-google
Copy link
Contributor

I don't think there are many ways a native object can fool dart2js after Stephen switched to using interceptors instead of monkey patching.

Generally, a generated type test on obj should look like this:

var t = $.getInterceptor(obj);
t.is$Foo

Not:

obj.is$Foo

The latter breaks if obj is a native object that has a is$Foo property.

If we always use getInterceptor, the only way to break dart2js output is to create a native object that has a property matching displayPropertyName.


Added Triaged label.

@DartBot
Copy link

DartBot commented Sep 4, 2013

This comment was originally written by ngeoffray@google.com


I still don't understand. The native object can as well mimic Dart behavior, e.g. have a get$foo method that has side effects whereas the compiler thought all foo getters don't have any. I could think of tons of other examples.

So what is it that makes type tests so special that we don't want native objects to pretend they are Dart objects? And displayPropertyName is as fakable as $isFoo.

@DartBot
Copy link

DartBot commented Sep 4, 2013

This comment was originally written by ngeoffray@google.com


Added NeedsInfo label.

@peter-ahe-google
Copy link
Contributor

That's a good point. Especially when we minify code, the chances that method names conflict with properties on native objects is substantial.

One could argue that type tests are more important than accidentally calling a native method that looks like a Dart method. This is because the type test is used in checked mode which is the first thing you should try if a native object is causing confusion.

@rakudrama
Copy link
Member Author

When we generate a use of a selector (e.g. get$length) that is understood by some native objects and the receiver is not statically proven to be non-native, we use interceptors. 'is T' is another selector that is understood by all native objects for all T, so we should also use an interceptor unless proven unnecessary.

(1) it is really hard to debug code when 'is T' is unreliable
(2) using interceptors for type checks is consistent with other selectors
(3) we can use or modify the existing optimizations to simplify the generated code

@peter-ahe-google
Copy link
Contributor

Added Triaged label.

@kasperl
Copy link

kasperl commented Sep 18, 2013

Added this to the M7 milestone.

@kasperl
Copy link

kasperl commented Oct 2, 2013

Removed this from the M7 milestone.
Added this to the M8 milestone.

@kasperl
Copy link

kasperl commented Jun 4, 2014

Removed this from the M8 milestone.
Added this to the 1.6 milestone.

@kasperl
Copy link

kasperl commented Jul 10, 2014

Removed this from the 1.6 milestone.
Added Oldschool-Milestone-1.6 label.

@kasperl
Copy link

kasperl commented Aug 4, 2014

Removed Oldschool-Milestone-1.6 label.

@kevmoo kevmoo added P2 A bug or feature request we're likely to work on type-bug Incorrect behavior (everything from a crash to more subtle misbehavior) and removed triaged labels Feb 29, 2016
@vsmenon vsmenon added the area-web Use area-web for Dart web related issues, including the DDC and dart2js compilers and JS interop. label Jul 20, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area-web Use area-web for Dart web related issues, including the DDC and dart2js compilers and JS interop. P2 A bug or feature request we're likely to work on type-bug Incorrect behavior (everything from a crash to more subtle misbehavior) web-dart2js
Projects
None yet
Development

No branches or pull requests

6 participants