Skip to content

A datatype named __proto__, constructor, or toString crashes both emitters through the inherited WORDS lookup #948

Description

@jasisz

What you did

bun bend2/main.ts proto_type.bend --check-only
bun bend2/main.ts proto_type.bend
bun bend2/main.ts proto_type.bend -o out.js
bun bend2/main.ts proto_type.bend -o out

proto_type.bend:

import Base

type __proto__ is Data:
  P{}

def main() -> __proto__:
  P{}

What happened

The checker accepts the file and the interpreter prints the expected value:

All terms check.
P{}

Both the JS and native build paths instead fail inside the compiler:

TypeError: undefined is not an object (evaluating 'lay.ks.length')

Why it happens

WORDS is a normal object, but datatype names are used to query it without an own-property check:

const WORDS: Record<string, Lay> = { U32: W32, F32: W32, Nat: W64 };

function lay_of(book: Bend.Book, A: HTerm | null): Lay {
  const t = ty_adt(book, A);
  if (t === null) {
    return BOX;
  }
  return WORDS[t.k] ?? memo(LAYS, A!, () => {

For __proto__, WORDS[t.k] returns the inherited Object.prototype rather than undefined, so lay_of returns a value that is not a Lay; the printer/layout path later reads its nonexistent ks. The same bug reproduces with datatypes named constructor and toString, confirming that this is the inherited-property class rather than a special parser case.

The compiler already gives the user-indexed OPERATIONS and OPTIMIZED tables null prototypes. WORDS needs the same treatment, or each lookup needs to require an own property.

This also reproduces on 2.0.23, so it is not a 2.0.24 regression.

bend --version

bend 2.0.24
commit 99f9c6cd

uname -sm

Darwin arm64

clang --version (the first line)

Apple clang version 21.0.0 (clang-2100.0.123.102)

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions