fix(scratch-vm): repair broken shadow references from cursed inputs bug

Projects corrupted by the Blockly blockToDom serialization bug (878291)
contain inputs with shadow references that point to nonexistent blocks.
This causes a TypeError crash in moveBlock when a reporter is dragged
out of such an input, and perpetuates the corruption through save/load.

Three fixes:

1. Load-time repair in deserializeBlocks: after deserialization, scan
   all inputs for shadow references that point to block IDs not present
   in the project. Recreate the shadow block by finding a peer block of
   the same opcode with an intact shadow (peer lookup). Falls back to a
   text shadow if no peer is available. Only primitive shadow types are
   recreated — menu shadows are cleared to prevent crashes.

2. Defensive guard in moveBlock: when restoring a shadow after a block
   is disconnected, check that the shadow block actually exists before
   accessing it. If missing, clear the stale reference instead of
   crashing.

3. findPeerShadow helper: scans the blocks map for another block of
   the same opcode that has a working primitive shadow on the same
   input name, to use as a template for recreation.

Author: cwillisf

packages/scratch-vm/src/engine/blocks.js

@@ -775,8 +775,15 @@ class Blocks {
                 // this input, or null out the input's block.
                 const shadow = oldParent.inputs[e.oldInput].shadow;
                 if (shadow && e.id !== shadow) {
-                    oldParent.inputs[e.oldInput].block = shadow;
-                    this._blocks[shadow].parent = oldParent.id;
+                    if (this._blocks[shadow]) {
+                        oldParent.inputs[e.oldInput].block = shadow;
+                        this._blocks[shadow].parent = oldParent.id;
+                    } else {
+                        // Shadow block is referenced but missing — clear
+                        // the stale reference rather than crashing.
+                        oldParent.inputs[e.oldInput].block = null;
+                        oldParent.inputs[e.oldInput].shadow = null;
+                    }
                     this._blocks[e.id].parent = null;
                 } else {
                     oldParent.inputs[e.oldInput].block = null;

packages/scratch-vm/src/serialization/sb3.js

@@ -95,6 +95,33 @@ const primitiveOpcodeInfoMap = {
     data_listcontents: [LIST_PRIMITIVE, 'LIST']
 };
 
+/**
+ * Find a working shadow block for the given (opcode, inputName) pair by
+ * looking at other blocks of the same opcode in the project. Returns a
+ * shallow copy of the shadow block suitable for use as a template, or
+ * null if no peer has a working shadow for that input.
+ * @param {object} blocks The full blocks map for the target.
+ * @param {string} opcode The parent block's opcode.
+ * @param {string} inputName The name of the input.
+ * @returns {?object} A template shadow block, or null.
+ */
+const findPeerShadow = function (blocks, opcode, inputName) {
+    for (const peerId in blocks) {
+        if (!hasOwnProperty.call(blocks, peerId)) continue;
+        const peer = blocks[peerId];
+        if (Array.isArray(peer) || peer.opcode !== opcode) continue;
+        const peerInput = peer.inputs[inputName];
+        if (!peerInput || !peerInput.shadow) continue;
+        const shadowBlock = blocks[peerInput.shadow];
+        if (!shadowBlock || Array.isArray(shadowBlock)) continue;
+        // Only use primitive shadow types (text, math_number, etc.) as
+        // templates — menu shadows have state that can't be safely copied.
+        if (!hasOwnProperty.call(primitiveOpcodeInfoMap, shadowBlock.opcode)) continue;
+        return shadowBlock;
+    }
+    return null;
+};
+
 /**
  * Serializes primitives described above into a more compact format
  * @param {object} block the block to serialize
@@ -885,6 +912,70 @@ const deserializeBlocks = function (blocks) {
         block.inputs = {};
     }
 
+    // Third pass: repair missing or broken shadow blocks. Shadows can be
+    // missing in two ways:
+    //   1. shadow is a stale ID pointing to a nonexistent block
+    //   2. shadow is null when it shouldn't be (lost before save)
+    // Both are leftovers from a serialization bug where shadow blocks were
+    // dropped during save. Recreate the shadow by finding a peer block of
+    // the same opcode with an intact shadow on the same input (peer lookup).
+    // Fall back to a text shadow if no peer is available.
+    for (const blockId in blocks) {
+        if (!Object.prototype.hasOwnProperty.call(blocks, blockId)) continue;
+        const block = blocks[blockId];
+        if (Array.isArray(block)) continue;
+        for (const inputName in block.inputs) {
+            if (!Object.prototype.hasOwnProperty.call(block.inputs, inputName)) continue;
+            const input = block.inputs[inputName];
+
+            const shadowIsBroken = input.shadow &&
+                !Object.prototype.hasOwnProperty.call(blocks, input.shadow);
+            const shadowIsMissing = !input.shadow && input.block &&
+                Object.prototype.hasOwnProperty.call(blocks, input.block) &&
+                !blocks[input.block].shadow;
+
+            if (!shadowIsBroken && !shadowIsMissing) continue;
+
+            // Try to find a peer block with a working shadow for this input.
+            const template = findPeerShadow(blocks, block.opcode, inputName);
+            if (!template && !shadowIsBroken) {
+                // No peer has a shadow either — this input probably doesn't
+                // use one (e.g. custom procedure inputs). Leave it alone.
+                continue;
+            }
+            const shadowOpcode = template ? template.opcode : 'text';
+            const primitiveInfo = primitiveOpcodeInfoMap[shadowOpcode];
+            if (!primitiveInfo) {
+                // Not a primitive shadow type — clear any stale
+                // reference so it doesn't cause crashes.
+                if (shadowIsBroken) input.shadow = null;
+                continue;
+            }
+            const fieldName = primitiveInfo[1];
+            const newShadowId = uid();
+            blocks[newShadowId] = {
+                id: newShadowId,
+                opcode: shadowOpcode,
+                next: null,
+                parent: blockId,
+                shadow: true,
+                topLevel: false,
+                inputs: Object.create(null),
+                fields: {
+                    [fieldName]: {
+                        name: fieldName,
+                        value: ''
+                    }
+                }
+            };
+            input.shadow = newShadowId;
+            // If no block is connected, also set block to the shadow
+            if (!input.block || !Object.prototype.hasOwnProperty.call(blocks, input.block)) {
+                input.block = newShadowId;
+            }
+        }
+    }
+
     return blocks;
 };
 

packages/scratch-vm/test/unit/engine_blocks.js

@@ -1145,3 +1145,53 @@ test('getAllVariableAndListReferences returns broadcast when we tell it to', t =
 
     t.end();
 });
+
+// Regression test for bug 878291: moveBlock should not crash when a
+// shadow reference points to a block that does not exist.
+test('moveBlock tolerates missing shadow block', t => {
+    const b = new Blocks(new Runtime());
+
+    // Create a parent block with an input whose shadow reference is stale
+    b.createBlock({
+        id: 'parent',
+        opcode: 'data_setvariableto',
+        next: null,
+        parent: null,
+        shadow: false,
+        topLevel: true,
+        inputs: {
+            VALUE: {
+                name: 'VALUE',
+                block: 'reporter',
+                shadow: 'nonexistent_shadow' // references a block that does not exist
+            }
+        },
+        fields: {}
+    });
+    b.createBlock({
+        id: 'reporter',
+        opcode: 'sensing_answer',
+        next: null,
+        parent: 'parent',
+        shadow: false,
+        topLevel: false,
+        inputs: {},
+        fields: {}
+    });
+
+    // Detaching the reporter should not throw even though the shadow is missing
+    t.doesNotThrow(() => {
+        b.moveBlock({
+            id: 'reporter',
+            oldParent: 'parent',
+            oldInput: 'VALUE',
+            newCoordinate: {x: 0, y: 0}
+        });
+    });
+
+    // The stale shadow reference should be cleared
+    t.equal(b.getBlock('parent').inputs.VALUE.shadow, null);
+    t.equal(b.getBlock('parent').inputs.VALUE.block, null);
+
+    t.end();
+});