- About Scala
- Documentation
- Code Examples
- Software
- Scala Developers
new type soundness hole
Sun, 2009-03-08, 17:08
I suppose one of the key steps in attaining scala street cred is finding
your own type soundness hole. I can't actually claim much credit for
this one because it was geoff's bug report which drew my attention to
it, and even though I knew it was there I couldn't figure out how to
induce a CCE without DRMacIver's help, curse his oily hide.
https://lampsvn.epfl.ch/trac/scala/ticket/963
"Bug in structural types/refinements allows singleton
property to be violated"
...but it's worse than that, a generalizable hole. I think this
one's unknown, anyway.
// example mostly by DRMacIver, prettified a bit by paulp and
// commented largely for self-pedagogical reasons
object o {
trait X { type T; def t: T; def doStuff(t : T): Unit }
var stuff: X = new X {
type T = String
def t = "abc"
def doStuff(t: String) = ()
}
// here is the hole: x will now be treated as a stable identifier
// even though the actual implementation of it is a def, because
// structural types don't perform the necessary override checks
val evil: { val x: X } = new { def x = stuff }
// t is a String
val t = evil.x.t
// replace "stable" id with class which thinks t is an Int
stuff = new X {
type T = Int
def t = 21
def doStuff(t : Int) = ()
}
// oh noes!
def cce() = evil.x.doStuff(t)
}
$ scala -e 'o.cce'
java.lang.ClassCastException: java.lang.String
at scala.runtime.BoxesRunTime.unboxToInt(Unknown Source)
at o$$anon$2.doStuff(me.scala:20)
at o$.cce(me.scala:27)
Yep, I think that's a hole, but an easy to fix one. I think one just
has to add one more condition to specializesSym in Types. The spec
mandates it, but somehow it has not been done. I'm just verifying
whether the fix works.
Cheers