`reflectType` does not check type parameter bounds

[lrhn]

You can invoke reflectType with a type argument that is not a valid bound, creating a reflection of a mal-bounded type.
If you do so, you can also invoke newInstance to create an instance of that invalid type.

Example:

import "dart:mirrors";
void main() {
  dynamic d = (reflectType(E, [String]) as ClassMirror)
      .newInstance(Symbol.empty, ["A string"]).reflectee;
  E<dynamic> e =  d; // Successful cast.
  print(e.runtimeType); // E<String>
  num n = e.numValue;
  print(n.runtimeType); // String. Soundness broken.

  d = (reflectType(F, [int]) as ClassMirror)
      .newInstance(Symbol.empty, [42]).reflectee; // seg-fault here.
  F<dynamic> f = d;
  F<dynamic> i = f.typedValue;
  print(i.runtimeType);
}

class E<T extends num> {
  final T value;
  E(this.value);
  num get numValue => value; // Valid up-cast.
}

class F<T extends F<T>> {
  final T value;
  F(this.value);
  F<T> get typedValue => value; // Valid up-cast.
}

The first, non-F-bounded, example succeeds in assigning a String to a variable of type num, breaking soundness.

The second part crashes with a segmentation fault in the F constructor, suggesting that it tries to do something with the type argument, maybe assuming it to implement F or at least have a type variable, but it then fails horribly when it finds int. (If I change int to List<int> and 42 to <int>[42] the code runs and prints List<int>, so the crash is probably related to not being a generic type).

[a-siva]

dart:mirrors is an unsupported library and we do not intend on fixing this issue.

[lrhn]

The JIT runtime seems to handle unsoundness gracefully, and mirrors cant be used in AOT compiled code, so it's probably not unsafe.

You can crash things, fx by putting a Smi into a position where an object is expected.

import "dart:mirrors";

void main() {
  String v = unsafeCast(0x20000000);
  print(v[10000]);
}

Never unsafeCast(Object? value) {
  var result = (reflectType(_UnsafeCast, [dynamic]) as ClassMirror)
      .newInstance(Symbol.empty, [value]).reflectee;
  return (result as _UnsafeCast<Object?>).value;
}

final class _UnsafeCast<T extends Never> {
  final Never value;
  _UnsafeCast(T this.value);
}

which gives a segmentation fault, but simply breaking exhaustiveness or soundness doesn't always crash.