Hack to bypass actionscript vtable

Image may be NSFW.
Clik here to view.

Imagine a simple class hirarchy of A extended by B. A has a method foo and B overrides this method.

Now imagine both A and B to be classes of a library. Now you want to implemented C extending B. See the UML at the side for illustration.

Further you want to implement your own foo now and override B’s foo. But now you want to call A’s foo to have the base classes behaviour too.
In many object oriented programming languages like C++,C# and D you can explicitly do that.
In C++ for example you can simply do the following

1
2
3
4

virtual void foo()
{
	A::foo();
}

Now in Actionscript on the otherhand, even though it calls itself object oriented you simply cannot do that.
AS3 has super for calling the baseclass method but that is B’s foo in this case. So that is not intended. super.super.foo(); or A.foo(); does not work either Image may be NSFW.
Clik here to view.

So I was pretty lost yesterday when presented with that problem. But as always for those dirty edge case problems there is an even more dirty hack to circumvent it.

Since I know that A has this method foo implementation that I need I just have to find a way to explicitly call it. Like stated in the Docs¹ a function instance.methodname() can also be called like instance["methodname"].call(this_pointer);. Now the to prevent the vtable lookup from happening we have to create a dummy instance of class A to call the mothod from and pass the this pointer of C upcasted to a pointer of type A.

1
2
3
4
5

override function foo():void
{
	var dummy:A = new A();
	dummy["foo"].call(this as A);
}

And voilà, it works. As you can see we are exploiting actionscripts ECMAscript² roots a little bit here Image may be NSFW.
Clik here to view.

1. Flash documentation of Function object
2. ECMAscript on wikipedia