reflectType does not check type parameter bounds

[lrhn]

You can invoke reflectType with a type argument that is not a valid bound, creating a reflection of a mal-bounded type.
If you do so, you can also invoke newInstance to create an instance of that invalid type.

Example:

import "dart:mirrors";
void main() {
  dynamic d = (reflectType(E, [String]) as ClassMirror)
      .newInstance(Symbol.empty, ["A string"]).reflectee;
  E<dynamic> e =  d; // Successful cast.
  print(e.runtimeType); // E<String>
  num n = e.numValue;
  print(n.runtimeType); // String. Soundness broken.

  d = (reflectType(F, [int]) as ClassMirror)
      .newInstance(Symbol.empty, [42]).reflectee; // seg-fault here.
  F<dynamic> f = d;
  F<dynamic> i = f.typedValue;
  print(i.runtimeType);
}

class E<T extends num> {
  final T value;
  E(this.value);
  num get numValue => value; // Valid up-cast.
}

class F<T extends F<T>> {
  final T value;
  F(this.value);
  F<T> get typedValue => value; // Valid up-cast.
}

The first, non-F-bounded, example succeeds in assigning a String to a variable of type num, breaking soundness.

The second part crashes with a segmentation fault in the F constructor, suggesting that it tries to do something with the type argument, maybe assuming it to implement F or at least have a type variable, but it then fails horribly when it finds int. (If I change int to List<int> and 42 to <int>[42] the code runs and prints List<int>, so the crash is probably related to not being a generic type).

[a-siva]

dart:mirrors is an unsupported library and we do not intend on fixing this issue.