dart2js runtime: Harden objectTypeName.

sdk/lib/_internal/js_runtime/lib/js_helper.dart

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 library _js_helper;
 
 import 'dart:_js_embedded_names' show
     DEFERRED_LIBRARY_URIS,
     DEFERRED_LIBRARY_HASHES,
     GET_TYPE_FROM_NAME,
@@ skipping 31 matching lines @@
     DART_CLOSURE_TO_JS,
     JS,
     JS_BUILTIN,
     JS_CALL_IN_ISOLATE,
     JS_CONST,
     JS_CURRENT_ISOLATE_CONTEXT,
     JS_EFFECT,
     JS_EMBEDDED_GLOBAL,
     JS_GET_FLAG,
     JS_GET_NAME,
+    JS_INTERCEPTOR_CONSTANT,
     JS_STRING_CONCAT,
     RAW_DART_FUNCTION_REF;
 
 import 'dart:_interceptors';
 import 'dart:_internal' as _symbol_dev;
 import 'dart:_internal' show
     EfficientLength,
     MappedIterable,
     IterableElementError;
 
@@ skipping 776 matching lines @@
   /// constructor of the given class.
   static String formatType(String className, List typeArguments) {
     return unmangleAllIdentifiersIfPreservedAnyways
         ('$className${joinArguments(typeArguments, 0)}');
   }
 
   /// Returns the type of [object] as a string (including type arguments).
   ///
   /// In minified mode, uses the unminified names if available.
   static String objectTypeName(Object object) {
-    String name = constructorNameFallback(getInterceptor(object));
-    if (name == 'Object') {
-      // Try to decompile the constructor by turning it into a string and get
-      // the name out of that. If the decompiled name is a string containing an
-      // identifier, we use that instead of the very generic 'Object'.
-      var decompiled =
-          JS('var', r'#.match(/^\s*function\s*([\w$]*)\s*\(/)[1]',
-              JS('var', r'String(#.constructor)', object));
-      if (decompiled is String)
-        if (JS('bool', r'/^\w+$/.test(#)', decompiled))
-          name = decompiled;
+    return formatType(_objectRawTypeName(object), getRuntimeTypeInfo(object));
+  }
+
+  static String _objectRawTypeName(Object object) {
+    var interceptor = getInterceptor(object);
+    // The interceptor is either an object (self-intercepting plain Dart class),
+    // the prototype of the constructor for an Interceptor class (like
+    // `JSString.prototype`, `JSNull.prototype`), or an Interceptor object
+    // instance (`const JSString()`, should use `JSString.prototype`).
+    //
+    // These all should have a `constructor` property with a `name` property.
+    String name;
+    var interceptorConstructor = JS('', '#.constructor', interceptor);
+    if (JS('bool', 'typeof # == "function"', interceptorConstructor)) {
+      var interceptorConstructorName = JS('', '#.name', interceptorConstructor);
+      if (interceptorConstructorName is String) {
+        name = interceptorConstructorName;
+      }
     }
+
+    if (name == null ||
+        identical(interceptor,
+            JS_INTERCEPTOR_CONSTANT(UnknownJavaScriptObject)) ||
+        identical(interceptor, JS_INTERCEPTOR_CONSTANT(Interceptor))) {
+      // Try to do better.  If we do not find something better, leave the name
+      // as 'UnknownJavaScriptObject' or 'Interceptor' (or the minified name).
+      //
+      // When we get here via the UnknownJavaScriptObject test (for JavaScript
+      // objects from outside the program), the object's constructor has a
+      // better name that 'UnknownJavaScriptObject'.
+      //
+      // When we get here the Interceptor test (for Native classes that are
+      // declared in the Dart program but have been 'folded' into Interceptor),
+      // the native class's constructor name is better than the generic
+      // 'Interceptor' (an abstract class).
+
+      // Try the [constructorNameFallback]. This gets the constructor name for
+      // any browser (used by [getNativeInterceptor]).
+      String dispatchName = constructorNameFallback(object);
+      if (name == null) name = dispatchName;
+      if (dispatchName == 'Object') {
+        // Try to decompile the constructor by turning it into a string and get
+        // the name out of that. If the decompiled name is a string containing
+        // an identifier, we use that instead of the very generic 'Object'.
+        var objectConstructor = JS('', '#.constructor', object);
+        if (JS('bool', 'typeof # == "function"', objectConstructor)) {
+          var decompiledName =
+              JS('var', r'#.match(/^\s*function\s*([\w$]*)\s*\(/)[1]',
+                  JS('var', r'String(#)', objectConstructor));
+          if (decompiledName is String &&
+              JS('bool', r'/^\w+$/.test(#)', decompiledName)) {
+            name = decompiledName;
+          }
+        }
+      } else {
+        name = dispatchName;
+      }
+    }
+
     // TODO(kasperl): If the namer gave us a fresh global name, we may
     // want to remove the numeric suffix that makes it unique too.
     if (name.length > 1 && identical(name.codeUnitAt(0), DOLLAR_CHAR_VALUE)) {
       name = name.substring(1);
     }
-    return formatType(name, getRuntimeTypeInfo(object));
+    return name;
   }
 
   /// In minified mode, uses the unminified names if available.
   static String objectToHumanReadableString(Object object) {
     String name = objectTypeName(object);
     return "Instance of '$name'";
   }
 
   static num dateNow() => JS('int', r'Date.now()');
 
@@ skipping 3145 matching lines @@
 // unneeded code.
 class _UnreachableError extends AssertionError {
   _UnreachableError();
   String toString() => "Assertion failed: Reached dead code";
 }
 
 @NoInline()
 void assertUnreachable() {
   throw new _UnreachableError();
 }