Check type bounds of redirecting factories (issue 14699).

runtime/lib/mirrors.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "lib/invocation_mirror.h"
 #include "vm/bootstrap_natives.h"
 #include "vm/class_finalizer.h"
 #include "vm/compiler.h"
 #include "vm/dart_entry.h"
 #include "vm/exceptions.h"
@@ skipping 1651 matching lines @@
 
   Class& redirected_klass = Class::Handle(klass.raw());
   Function& redirected_constructor = Function::Handle(lookup_constructor.raw());
   if (lookup_constructor.IsRedirectingFactory()) {
     ClassFinalizer::ResolveRedirectingFactory(klass, lookup_constructor);
     Type& redirect_type = Type::Handle(lookup_constructor.RedirectionType());
 
     if (!redirect_type.IsInstantiated()) {
       // The type arguments of the redirection type are instantiated from the
       // type arguments of the type reflected by the class mirror.
-      Error& malformed_error = Error::Handle();
+      Error& bound_error = Error::Handle();
       redirect_type ^= redirect_type.InstantiateFrom(type_arguments,
-                                                     &malformed_error);
-      if (!malformed_error.IsNull()) {
-        ThrowInvokeError(malformed_error);
+                                                     &bound_error);
+      if (!bound_error.IsNull()) {
+        ThrowInvokeError(bound_error);
         UNREACHABLE();
       }
     }
 
     type = redirect_type.raw();
     type_arguments = redirect_type.arguments();
 
     redirected_constructor = lookup_constructor.RedirectionTarget();
     ASSERT(!redirected_constructor.IsNull());
     redirected_klass = type.type_class();
@@ skipping 268 matching lines @@
 
 DEFINE_NATIVE_ENTRY(VariableMirror_type, 2) {
   GET_NON_NULL_NATIVE_ARGUMENT(MirrorReference, ref, arguments->NativeArgAt(0));
   const Field& field = Field::Handle(ref.GetFieldReferent());
   GET_NATIVE_ARGUMENT(AbstractType, instantiator, arguments->NativeArgAt(1));
   const AbstractType& type = AbstractType::Handle(field.type());
   return InstantiateType(type, instantiator);
 }
 
 }  // namespace dart