py/objtype: Fix assertion failures in mp_obj_new_type by checking types.

jepler · dpgeorge · commit 05b13fd292b4 · 2018-05-30T11:11:24.000+10:00
Fixes assertion failures when the arguments to type() were not of valid
types, e.g., when making calls like:

    type("", (), 3)
    type("", 3, {})
diff --git a/py/objtype.c b/py/objtype.c
@@ -1005,8 +1005,13 @@ const mp_obj_type_t mp_type_type = {
 };
 
 mp_obj_t mp_obj_new_type(qstr name, mp_obj_t bases_tuple, mp_obj_t locals_dict) {
-    assert(MP_OBJ_IS_TYPE(bases_tuple, &mp_type_tuple)); // MicroPython restriction, for now
-    assert(MP_OBJ_IS_TYPE(locals_dict, &mp_type_dict)); // MicroPython restriction, for now
+    // Verify input objects have expected type
+    if (!MP_OBJ_IS_TYPE(bases_tuple, &mp_type_tuple)) {
+        mp_raise_TypeError(NULL);
+    }
+    if (!MP_OBJ_IS_TYPE(locals_dict, &mp_type_dict)) {
+        mp_raise_TypeError(NULL);
+    }
 
     // TODO might need to make a copy of locals_dict; at least that's how CPython does it
 
@@ -1015,7 +1020,9 @@ mp_obj_t mp_obj_new_type(qstr name, mp_obj_t bases_tuple, mp_obj_t locals_dict)
     mp_obj_t *bases_items;
     mp_obj_tuple_get(bases_tuple, &bases_len, &bases_items);
     for (size_t i = 0; i < bases_len; i++) {
-        assert(MP_OBJ_IS_TYPE(bases_items[i], &mp_type_type));
+        if (!MP_OBJ_IS_TYPE(bases_items[i], &mp_type_type)) {
+            mp_raise_TypeError(NULL);
+        }
         mp_obj_type_t *t = MP_OBJ_TO_PTR(bases_items[i]);
         // TODO: Verify with CPy, tested on function type
         if (t->make_new == NULL) {
diff --git a/tests/basics/builtin_type.py b/tests/basics/builtin_type.py
@@ -11,3 +11,21 @@
     type(1, 2)
 except TypeError:
     print('TypeError')
+
+# second arg should be a tuple
+try:
+    type('abc', None, None)
+except TypeError:
+    print('TypeError')
+
+# third arg should be a dict
+try:
+    type('abc', (), None)
+except TypeError:
+    print('TypeError')
+
+# elements of second arg (the bases) should be types
+try:
+    type('abc', (1,), {})
+except TypeError:
+    print('TypeError')
