You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
As part of the unification of StaticArray's static and instance methods in #2404, now accounting for both Array<T> and StaticArray<T> results via a type parameter in instance methods, code like the following was introduced:
where U is also the return type of the respective function. This code is brittle for several reasons:
1) If an U triggers a dynamic instanceof check, null is passed to the instanceof helper, exploding with an OOB memory access. This can potentially be addressed with a hack like
letout=changetype<U>(this);
so there is at least some value, which would also work with #2578 (where I noticed this) once merged, BUT will stop working with Wasm GC because the assignment is invalid codegen.
2) Both concat<U> and slice<U> return U, but the actual value returned is either Array<T> or StaticArray<T> that is merely changetype'd to U, which is unsound if U is a subclass. Not an issue for StaticArray since it is final, but for Array. Even if an U would be __newed, the subclass would not always be properly initialized because the constructor isn't called.
3) As mentioned, tricks like these likely won't work forever anyhow.
These seem like reasons to me to revert the PR in question, unless there is a solution I haven't thought of. cc @MaxGraey as the author of the code.
The text was updated successfully, but these errors were encountered:
For problem 1), I think so. The others are a little more tricky and seem to indicate that there should perhaps be separate methods for Array and StaticArray, as it was before.
As part of the unification of
StaticArray
's static and instance methods in #2404, now accounting for bothArray<T>
andStaticArray<T>
results via a type parameter in instance methods, code like the following was introduced:where
U
is also the return type of the respective function. This code is brittle for several reasons:1) If an
U
triggers a dynamic instanceof check,null
is passed to the instanceof helper, exploding with an OOB memory access. This can potentially be addressed with a hack likeso there is at least some value, which would also work with #2578 (where I noticed this) once merged, BUT will stop working with Wasm GC because the assignment is invalid codegen.
2) Both
concat<U>
andslice<U>
returnU
, but the actual value returned is eitherArray<T>
orStaticArray<T>
that is merely changetype'd toU
, which is unsound ifU
is a subclass. Not an issue forStaticArray
since it is final, but forArray
. Even if anU
would be__new
ed, the subclass would not always be properly initialized because the constructor isn't called.3) As mentioned, tricks like these likely won't work forever anyhow.
These seem like reasons to me to revert the PR in question, unless there is a solution I haven't thought of. cc @MaxGraey as the author of the code.
The text was updated successfully, but these errors were encountered: