views:

774

answers:

1

Support for generics (currently only Vector.<*>, and called 'postfix type parameters' by Adobe) was added in Flash Player 10, but the only AVM2 documentation does not describe how these objects are accessed.

Specifically, I noticed a new opcode (0x53) and a new multiname kind (0x1D) that seem relevant, but their usage is not documented.

NB: This question was created with the answer already known as it is more easily found here than on my blog or the Adobe Bug DB.

+10  A: 

The reverse engineering work I did on this did not include declaring your own generic types, though it's very likely possible.

References to the declaring (parameterless) generic type (Vector) are made through a regular qualified name (though any multiname should do).

References to a typed generic type (Vector.<int> as opposed to Vector.<>) are made by a new multiname kind (0x1D), which I call GenericName. GenericName has a format like so:

[Kind] [TypeDefinition] [ParamCount] [Param1] [Param2] [ParamN]

Where:

  • [TypeDefinition] is a U30 into the multiname table
  • [ParamCount] is a U8 (U30?) of how many type parameters there are
  • [ParamX] is a U30 into the multiname table.

Obviously generics are not generally supported yet, so ParamCount will always be 1 (for Vector.<*>).

The other interesting thing is how instances of the class are created. A new opcode was added in Flash 10 (0x53), which I will call MakeGenericType. MakeGenericType is declared with the following stack:

TypeDefinition, ParameterType1, ParameterTypeN -> GenericType

It also has one parameter, a U8 (U30?) specifying how many parameters are on the stack. You will generally see MakeGenericType being used like this:

GetLex [TypeDefinitionMultiname]
GetLex [ParameterTypeMultiname]
MakeGeneric [ParamCount]
Coerce [GenericNameMultiname]
Construct [ConstructorParamCount]

So if you had the following...

GetLex __AS3__.vec::Vector
GetLex int
MakeGeneric 1
Coerce __AS3__.vec::Vector.<int>
Construct 0

You would now have an instance of Vector.<int>

Richard Szalay
I really enjoy knowing internals of as3/avm2. Thanks for sharing this!
yuku
You are wonderful. Thank you.
Heath Hunnicutt
Here is a link to a PDF with opcodes 0x35-0x38, 0x3a-0x3e, 0x50-0x52 -- these were new for the "alchemy" project. I know that 0x39 exists and it appears to consume one integer value off the stack, but I do not know what it might do. Link: http://llvm.org/devmtg/2008-08/Petersen_FlashCCompiler.pdf
Heath Hunnicutt
Per the tamarin source code at http://hg.mozilla.org/tamarin-central/file/072e85a58498/core/Interpreter.cpp, line 2492, the paramcount is a u30.Also, the instruction name given there is, "applytype".
Heath Hunnicutt
Accourding to tamarin source, PoolObject.cpp, line 552, the ParamCount in the multiname (which must be 1) is also a U30 (in the multiname_info). The paramcount to applytype is a U30 in the opcode stream.
Heath Hunnicutt