dart-lang / sdk

The Dart SDK, including the VM, JS and Wasm compilers, analysis, core libraries, and more.
https://dart.dev
BSD 3-Clause "New" or "Revised" License
10.2k stars 1.57k forks source link

Soundness issue with generator element type #53052

Open eernstg opened 1 year ago

eernstg commented 1 year ago

Thanks to @lrhn for spotting this issue and reporting it here.

The specification of the element type of a generator has just been updated accordingly, cf. https://github.com/dart-lang/language/pull/3218.

The old rule gave rise to a soundness issue:

import 'dart:async';

FutureOr<Iterable<int>> f() sync* {
  yield 'Hello!' as dynamic;
}

void main() {
  var iterable = f();
  if (iterable is Future<Object?>) return;
  int i = iterable.first;
  print(i); // 'Hello!' is not an `int`.
}

The main idea in the correction is that the element type of a generator function uses a reduction step where the given return type is simplified to an Iterable<T> for some T (for a sync* function body) or a Stream<T> for some T (for an async* body), and the element type is then extracted from that Iterable<T> / Stream<T>.

Subtasks:

chloestefantsova commented 1 year ago

Sorry, I accidentally closed this one instead of https://github.com/dart-lang/sdk/issues/53053. Reopened it again. Thanks for noticing, @eernstg!