Disallow eval on lists containing non-instances.

runtime/vm/service.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/service.h"
 
 #include "include/dart_api.h"
 #include "platform/globals.h"
 
 #include "vm/compiler.h"
@@ skipping 833 matching lines @@
   // Skip the dash.
   s++;
   // Extract the PC.
   if (!GetUnsignedIntegerId(s, address, 16)) {
     return false;
   }
   return true;
 }
 
 
+static bool IsInternal(const Object& obj) {

[turnidge, 2014/05/20 23:21:34]

The name is a bit vague.  Not sure what to suggest.  Maybe something like
"PointsToNonInstanceObjects"

[koda, 2014/05/21 15:49:23]

Done.

+  if (obj.IsArray()) {

[turnidge, 2014/05/20 23:21:34]

Do you need to add a case for obj.IsGrowableArray as well?  Not sure if we use
those internally or not.

[koda, 2014/05/21 15:49:23]

Good point. Done.

+    const Array& array = Array::Cast(obj);
+    Object& element = Object::Handle();
+    for (intptr_t i = 0; i < array.Length(); ++i) {
+      element = array.At(i);
+      if (!element.IsInstance()) {
+        return true;
+      }
+    }
+    return false;
+  } else {
+    return !obj.IsInstance();
+  }
+}
+
+
 static bool HandleInstanceCommands(Isolate* isolate,
                                    const Object& obj,
                                    JSONStream* js,
                                    intptr_t arg_pos) {
   ASSERT(js->num_arguments() > arg_pos);
   const char* action = js->GetArgument(arg_pos);
   if (strcmp(action, "eval") == 0) {
     if (js->num_arguments() > (arg_pos + 1)) {
       PrintError(js, "expected at most %" Pd " arguments but found %" Pd "\n",
                  arg_pos + 1,
                  js->num_arguments());
       return true;
     }
     if (obj.IsNull()) {
       PrintErrorWithKind(js, "EvalCollected",
                          "attempt to evaluate against collected object\n",
                          js->num_arguments());
       return true;
     }
     if (obj.raw() == Object::sentinel().raw()) {
       PrintErrorWithKind(js, "EvalExpired",
                          "attempt to evaluate against expired object\n",
                          js->num_arguments());
       return true;
     }
+    if (IsInternal(obj)) {
+      PrintError(js, "attempt to evaluate against internal VM object\n");
+      return true;
+    }
     const char* expr = js->LookupOption("expr");
     if (expr == NULL) {
       PrintError(js, "eval expects an 'expr' option\n",
                  js->num_arguments());
       return true;
     }
     const String& expr_str = String::Handle(isolate, String::New(expr));
     ASSERT(obj.IsInstance());
     const Instance& instance = Instance::Cast(obj);
     const Object& result =
@@ skipping 1123 matching lines @@
   while (current != NULL) {
     if (strcmp(name, current->name()) == 0) {
       return current;
     }
     current = current->next();
   }
   return NULL;
 }
 
 }  // namespace dart