Implement more restrictive checking of typedefs illegally referring to

runtime/vm/class_finalizer.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/class_finalizer.h"
 
 #include "vm/flags.h"
 #include "vm/heap.h"
 #include "vm/isolate.h"
 #include "vm/longjump.h"
@@ skipping 1645 matching lines @@
     test2 = test2.SuperClass();
     if (!test2.IsNull()) {
       test2 = test2.SuperClass();
     }
   }
   // No cycles.
   return true;
 }
 
 
+// Helper function called by IsAliasCycleFree.
+bool ClassFinalizer::IsParameterTypeCycleFree(
+    const Class& cls,
+    const AbstractType& type,
+    GrowableArray<intptr_t>* visited) {
+  ASSERT(visited != NULL);
+  ResolveType(cls, type, kCanonicalize);
+  if (type.IsType() && !type.IsMalformed()) {
+    const Class& type_class = Class::Handle(type.type_class());
+    if (!type_class.is_type_finalized() &&
+        type_class.IsSignatureClass() &&
+        !IsAliasCycleFree(type_class, visited)) {
+      return false;
+    }
+    const AbstractTypeArguments& type_args = AbstractTypeArguments::Handle(
+        type.arguments());
+    if (!type_args.IsNull()) {
+      AbstractType& type_arg = AbstractType::Handle();
+      for (intptr_t i = 0; i < type_args.Length(); i++) {
+        type_arg = type_args.TypeAt(i);
+        if (!IsParameterTypeCycleFree(cls, type_arg, visited)) {
+          return false;
+        }
+      }
+    }
+  }
+  return true;
+}
+
+
 // Returns false if the function type alias illegally refers to itself.
 bool ClassFinalizer::IsAliasCycleFree(const Class& cls,
                                       GrowableArray<intptr_t>* visited) {
   ASSERT(cls.IsSignatureClass());
   ASSERT(!cls.is_type_finalized());
   ASSERT(visited != NULL);
   const intptr_t cls_index = cls.id();
   for (int i = 0; i < visited->length(); i++) {
     if ((*visited)[i] == cls_index) {
       // We have already visited alias 'cls'. We found a cycle.
       return false;
     }
   }
 
   // Visit the result type and parameter types of this signature type.
   visited->Add(cls.id());
   const Function& function = Function::Handle(cls.signature_function());
   // Check class of result type.
   AbstractType& type = AbstractType::Handle(function.result_type());
-  ResolveType(cls, type, kCanonicalize);
-  if (type.IsType() && !type.IsMalformed()) {
-    const Class& type_class = Class::Handle(type.type_class());
-    if (!type_class.is_type_finalized() &&
-        type_class.IsSignatureClass() &&
-        !IsAliasCycleFree(type_class, visited)) {
-      return false;
-    }
+  if (!IsParameterTypeCycleFree(cls, type, visited)) {
+    return false;
   }
   // Check classes of formal parameter types.
   const intptr_t num_parameters = function.NumParameters();
   for (intptr_t i = 0; i < num_parameters; i++) {
     type = function.ParameterTypeAt(i);
-    ResolveType(cls, type, kCanonicalize);
-    if (type.IsType() && !type.IsMalformed()) {
-      const Class& type_class = Class::Handle(type.type_class());
-      if (!type_class.is_type_finalized() &&
-          type_class.IsSignatureClass() &&
-          !IsAliasCycleFree(type_class, visited)) {
-        return false;
-      }
+    if (!IsParameterTypeCycleFree(cls, type, visited)) {
+      return false;
     }
   }
   visited->RemoveLast();
   return true;
 }
 
 
 void ClassFinalizer::CollectTypeArguments(const Class& cls,
                               const Type& type,
                               const GrowableObjectArray& collected_args) {
@@ skipping 453 matching lines @@
   expected_name ^= String::New("_offset");
   ASSERT(String::EqualsIgnoringPrivateKey(name, expected_name));
   field ^= fields_array.At(2);
   ASSERT(field.Offset() == TypedDataView::length_offset());
   name ^= field.name();
   ASSERT(name.Equals("length"));
 #endif
 }
 
 }  // namespace dart