diff options
Diffstat (limited to 'js/src/wasm/AsmJS.cpp')
| -rw-r--r-- | js/src/wasm/AsmJS.cpp | 8986 |
1 files changed, 8986 insertions, 0 deletions
diff --git a/js/src/wasm/AsmJS.cpp b/js/src/wasm/AsmJS.cpp new file mode 100644 index 000000000..6964c5d62 --- /dev/null +++ b/js/src/wasm/AsmJS.cpp @@ -0,0 +1,8986 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- + * vim: set ts=8 sts=4 et sw=4 tw=99: + * + * Copyright 2014 Mozilla Foundation + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "wasm/AsmJS.h" + +#include "mozilla/Attributes.h" +#include "mozilla/Compression.h" +#include "mozilla/MathAlgorithms.h" + +#include "jsmath.h" +#include "jsprf.h" +#include "jsstr.h" +#include "jsutil.h" + +#include "jswrapper.h" + +#include "builtin/SIMD.h" +#include "frontend/Parser.h" +#include "gc/Policy.h" +#include "js/MemoryMetrics.h" +#include "vm/StringBuffer.h" +#include "vm/Time.h" +#include "vm/TypedArrayObject.h" +#include "wasm/WasmBinaryFormat.h" +#include "wasm/WasmGenerator.h" +#include "wasm/WasmInstance.h" +#include "wasm/WasmJS.h" +#include "wasm/WasmSerialize.h" + +#include "jsobjinlines.h" + +#include "frontend/ParseNode-inl.h" +#include "vm/ArrayBufferObject-inl.h" + +using namespace js; +using namespace js::frontend; +using namespace js::jit; +using namespace js::wasm; + +using mozilla::CeilingLog2; +using mozilla::Compression::LZ4; +using mozilla::HashGeneric; +using mozilla::IsNaN; +using mozilla::IsNegativeZero; +using mozilla::IsPowerOfTwo; +using mozilla::Maybe; +using mozilla::Move; +using mozilla::PodCopy; +using mozilla::PodEqual; +using mozilla::PodZero; +using mozilla::PositiveInfinity; +using JS::AsmJSOption; +using JS::GenericNaN; + +/*****************************************************************************/ + +// The asm.js valid heap lengths are precisely the WASM valid heap lengths for ARM +// greater or equal to MinHeapLength +static const size_t MinHeapLength = PageSize; + +static uint32_t +RoundUpToNextValidAsmJSHeapLength(uint32_t length) +{ + if (length <= MinHeapLength) + return MinHeapLength; + + return wasm::RoundUpToNextValidARMImmediate(length); +} + + +/*****************************************************************************/ +// asm.js module object + +// The asm.js spec recognizes this set of builtin Math functions. +enum AsmJSMathBuiltinFunction +{ + AsmJSMathBuiltin_sin, AsmJSMathBuiltin_cos, AsmJSMathBuiltin_tan, + AsmJSMathBuiltin_asin, AsmJSMathBuiltin_acos, AsmJSMathBuiltin_atan, + AsmJSMathBuiltin_ceil, AsmJSMathBuiltin_floor, AsmJSMathBuiltin_exp, + AsmJSMathBuiltin_log, AsmJSMathBuiltin_pow, AsmJSMathBuiltin_sqrt, + AsmJSMathBuiltin_abs, AsmJSMathBuiltin_atan2, AsmJSMathBuiltin_imul, + AsmJSMathBuiltin_fround, AsmJSMathBuiltin_min, AsmJSMathBuiltin_max, + AsmJSMathBuiltin_clz32 +}; + +// The asm.js spec will recognize this set of builtin Atomics functions. +enum AsmJSAtomicsBuiltinFunction +{ + AsmJSAtomicsBuiltin_compareExchange, + AsmJSAtomicsBuiltin_exchange, + AsmJSAtomicsBuiltin_load, + AsmJSAtomicsBuiltin_store, + AsmJSAtomicsBuiltin_add, + AsmJSAtomicsBuiltin_sub, + AsmJSAtomicsBuiltin_and, + AsmJSAtomicsBuiltin_or, + AsmJSAtomicsBuiltin_xor, + AsmJSAtomicsBuiltin_isLockFree +}; + + +// An AsmJSGlobal represents a JS global variable in the asm.js module function. +class AsmJSGlobal +{ + public: + enum Which { Variable, FFI, ArrayView, ArrayViewCtor, MathBuiltinFunction, + AtomicsBuiltinFunction, Constant, SimdCtor, SimdOp }; + enum VarInitKind { InitConstant, InitImport }; + enum ConstantKind { GlobalConstant, MathConstant }; + + private: + struct CacheablePod { + Which which_; + union V { + struct { + VarInitKind initKind_; + union U { + ValType importType_; + Val val_; + U() {} + } u; + } var; + uint32_t ffiIndex_; + Scalar::Type viewType_; + AsmJSMathBuiltinFunction mathBuiltinFunc_; + AsmJSAtomicsBuiltinFunction atomicsBuiltinFunc_; + SimdType simdCtorType_; + struct { + SimdType type_; + SimdOperation which_; + } simdOp; + struct { + ConstantKind kind_; + double value_; + } constant; + V() {} + } u; + } pod; + CacheableChars field_; + + friend class ModuleValidator; + + public: + AsmJSGlobal() = default; + AsmJSGlobal(Which which, UniqueChars field) { + mozilla::PodZero(&pod); // zero padding for Valgrind + pod.which_ = which; + field_ = Move(field); + } + const char* field() const { + return field_.get(); + } + Which which() const { + return pod.which_; + } + VarInitKind varInitKind() const { + MOZ_ASSERT(pod.which_ == Variable); + return pod.u.var.initKind_; + } + Val varInitVal() const { + MOZ_ASSERT(pod.which_ == Variable); + MOZ_ASSERT(pod.u.var.initKind_ == InitConstant); + return pod.u.var.u.val_; + } + ValType varInitImportType() const { + MOZ_ASSERT(pod.which_ == Variable); + MOZ_ASSERT(pod.u.var.initKind_ == InitImport); + return pod.u.var.u.importType_; + } + uint32_t ffiIndex() const { + MOZ_ASSERT(pod.which_ == FFI); + return pod.u.ffiIndex_; + } + // When a view is created from an imported constructor: + // var I32 = stdlib.Int32Array; + // var i32 = new I32(buffer); + // the second import has nothing to validate and thus has a null field. + Scalar::Type viewType() const { + MOZ_ASSERT(pod.which_ == ArrayView || pod.which_ == ArrayViewCtor); + return pod.u.viewType_; + } + AsmJSMathBuiltinFunction mathBuiltinFunction() const { + MOZ_ASSERT(pod.which_ == MathBuiltinFunction); + return pod.u.mathBuiltinFunc_; + } + AsmJSAtomicsBuiltinFunction atomicsBuiltinFunction() const { + MOZ_ASSERT(pod.which_ == AtomicsBuiltinFunction); + return pod.u.atomicsBuiltinFunc_; + } + SimdType simdCtorType() const { + MOZ_ASSERT(pod.which_ == SimdCtor); + return pod.u.simdCtorType_; + } + SimdOperation simdOperation() const { + MOZ_ASSERT(pod.which_ == SimdOp); + return pod.u.simdOp.which_; + } + SimdType simdOperationType() const { + MOZ_ASSERT(pod.which_ == SimdOp); + return pod.u.simdOp.type_; + } + ConstantKind constantKind() const { + MOZ_ASSERT(pod.which_ == Constant); + return pod.u.constant.kind_; + } + double constantValue() const { + MOZ_ASSERT(pod.which_ == Constant); + return pod.u.constant.value_; + } + + WASM_DECLARE_SERIALIZABLE(AsmJSGlobal); +}; + +typedef Vector<AsmJSGlobal, 0, SystemAllocPolicy> AsmJSGlobalVector; + +// An AsmJSImport is slightly different than an asm.js FFI function: a single +// asm.js FFI function can be called with many different signatures. When +// compiled to wasm, each unique FFI function paired with signature generates a +// wasm import. +class AsmJSImport +{ + uint32_t ffiIndex_; + public: + AsmJSImport() = default; + explicit AsmJSImport(uint32_t ffiIndex) : ffiIndex_(ffiIndex) {} + uint32_t ffiIndex() const { return ffiIndex_; } +}; + +typedef Vector<AsmJSImport, 0, SystemAllocPolicy> AsmJSImportVector; + +// An AsmJSExport logically extends Export with the extra information needed for +// an asm.js exported function, viz., the offsets in module's source chars in +// case the function is toString()ed. +class AsmJSExport +{ + uint32_t funcIndex_; + + // All fields are treated as cacheable POD: + uint32_t startOffsetInModule_; // Store module-start-relative offsets + uint32_t endOffsetInModule_; // so preserved by serialization. + + public: + AsmJSExport() { PodZero(this); } + AsmJSExport(uint32_t funcIndex, uint32_t startOffsetInModule, uint32_t endOffsetInModule) + : funcIndex_(funcIndex), + startOffsetInModule_(startOffsetInModule), + endOffsetInModule_(endOffsetInModule) + {} + uint32_t funcIndex() const { + return funcIndex_; + } + uint32_t startOffsetInModule() const { + return startOffsetInModule_; + } + uint32_t endOffsetInModule() const { + return endOffsetInModule_; + } +}; + +typedef Vector<AsmJSExport, 0, SystemAllocPolicy> AsmJSExportVector; + +enum class CacheResult +{ + Hit, + Miss +}; + +// Holds the immutable guts of an AsmJSModule. +// +// AsmJSMetadata is built incrementally by ModuleValidator and then shared +// immutably between AsmJSModules. + +struct AsmJSMetadataCacheablePod +{ + uint32_t numFFIs; + uint32_t srcLength; + uint32_t srcLengthWithRightBrace; + bool usesSimd; + + AsmJSMetadataCacheablePod() { PodZero(this); } +}; + +struct js::AsmJSMetadata : Metadata, AsmJSMetadataCacheablePod +{ + AsmJSGlobalVector asmJSGlobals; + AsmJSImportVector asmJSImports; + AsmJSExportVector asmJSExports; + CacheableCharsVector asmJSFuncNames; + CacheableChars globalArgumentName; + CacheableChars importArgumentName; + CacheableChars bufferArgumentName; + + CacheResult cacheResult; + + // These values are not serialized since they are relative to the + // containing script which can be different between serialization and + // deserialization contexts. Thus, they must be set explicitly using the + // ambient Parser/ScriptSource after deserialization. + // + // srcStart refers to the offset in the ScriptSource to the beginning of + // the asm.js module function. If the function has been created with the + // Function constructor, this will be the first character in the function + // source. Otherwise, it will be the opening parenthesis of the arguments + // list. + uint32_t srcStart; + uint32_t srcBodyStart; + bool strict; + ScriptSourceHolder scriptSource; + + uint32_t srcEndBeforeCurly() const { + return srcStart + srcLength; + } + uint32_t srcEndAfterCurly() const { + return srcStart + srcLengthWithRightBrace; + } + + AsmJSMetadata() + : Metadata(ModuleKind::AsmJS), + cacheResult(CacheResult::Miss), + srcStart(0), + srcBodyStart(0), + strict(false) + {} + ~AsmJSMetadata() override {} + + const AsmJSExport& lookupAsmJSExport(uint32_t funcIndex) const { + // The AsmJSExportVector isn't stored in sorted order so do a linear + // search. This is for the super-cold and already-expensive toString() + // path and the number of exports is generally small. + for (const AsmJSExport& exp : asmJSExports) { + if (exp.funcIndex() == funcIndex) + return exp; + } + MOZ_CRASH("missing asm.js func export"); + } + + bool mutedErrors() const override { + return scriptSource.get()->mutedErrors(); + } + const char16_t* displayURL() const override { + return scriptSource.get()->hasDisplayURL() ? scriptSource.get()->displayURL() : nullptr; + } + ScriptSource* maybeScriptSource() const override { + return scriptSource.get(); + } + bool getFuncName(JSContext* cx, const Bytes*, uint32_t funcIndex, + TwoByteName* name) const override + { + // asm.js doesn't allow exporting imports or putting imports in tables + MOZ_ASSERT(funcIndex >= AsmJSFirstDefFuncIndex); + + const char* p = asmJSFuncNames[funcIndex - AsmJSFirstDefFuncIndex].get(); + UTF8Chars utf8(p, strlen(p)); + + size_t twoByteLength; + UniqueTwoByteChars chars(JS::UTF8CharsToNewTwoByteCharsZ(cx, utf8, &twoByteLength).get()); + if (!chars) + return false; + + if (!name->growByUninitialized(twoByteLength)) + return false; + + PodCopy(name->begin(), chars.get(), twoByteLength); + return true; + } + + AsmJSMetadataCacheablePod& pod() { return *this; } + const AsmJSMetadataCacheablePod& pod() const { return *this; } + + WASM_DECLARE_SERIALIZABLE_OVERRIDE(AsmJSMetadata) +}; + +typedef RefPtr<AsmJSMetadata> MutableAsmJSMetadata; + +/*****************************************************************************/ +// ParseNode utilities + +static inline ParseNode* +NextNode(ParseNode* pn) +{ + return pn->pn_next; +} + +static inline ParseNode* +UnaryKid(ParseNode* pn) +{ + MOZ_ASSERT(pn->isArity(PN_UNARY)); + return pn->pn_kid; +} + +static inline ParseNode* +BinaryRight(ParseNode* pn) +{ + MOZ_ASSERT(pn->isArity(PN_BINARY)); + return pn->pn_right; +} + +static inline ParseNode* +BinaryLeft(ParseNode* pn) +{ + MOZ_ASSERT(pn->isArity(PN_BINARY)); + return pn->pn_left; +} + +static inline ParseNode* +ReturnExpr(ParseNode* pn) +{ + MOZ_ASSERT(pn->isKind(PNK_RETURN)); + return UnaryKid(pn); +} + +static inline ParseNode* +TernaryKid1(ParseNode* pn) +{ + MOZ_ASSERT(pn->isArity(PN_TERNARY)); + return pn->pn_kid1; +} + +static inline ParseNode* +TernaryKid2(ParseNode* pn) +{ + MOZ_ASSERT(pn->isArity(PN_TERNARY)); + return pn->pn_kid2; +} + +static inline ParseNode* +TernaryKid3(ParseNode* pn) +{ + MOZ_ASSERT(pn->isArity(PN_TERNARY)); + return pn->pn_kid3; +} + +static inline ParseNode* +ListHead(ParseNode* pn) +{ + MOZ_ASSERT(pn->isArity(PN_LIST)); + return pn->pn_head; +} + +static inline unsigned +ListLength(ParseNode* pn) +{ + MOZ_ASSERT(pn->isArity(PN_LIST)); + return pn->pn_count; +} + +static inline ParseNode* +CallCallee(ParseNode* pn) +{ + MOZ_ASSERT(pn->isKind(PNK_CALL)); + return ListHead(pn); +} + +static inline unsigned +CallArgListLength(ParseNode* pn) +{ + MOZ_ASSERT(pn->isKind(PNK_CALL)); + MOZ_ASSERT(ListLength(pn) >= 1); + return ListLength(pn) - 1; +} + +static inline ParseNode* +CallArgList(ParseNode* pn) +{ + MOZ_ASSERT(pn->isKind(PNK_CALL)); + return NextNode(ListHead(pn)); +} + +static inline ParseNode* +VarListHead(ParseNode* pn) +{ + MOZ_ASSERT(pn->isKind(PNK_VAR) || pn->isKind(PNK_CONST)); + return ListHead(pn); +} + +static inline bool +IsDefaultCase(ParseNode* pn) +{ + return pn->as<CaseClause>().isDefault(); +} + +static inline ParseNode* +CaseExpr(ParseNode* pn) +{ + return pn->as<CaseClause>().caseExpression(); +} + +static inline ParseNode* +CaseBody(ParseNode* pn) +{ + return pn->as<CaseClause>().statementList(); +} + +static inline ParseNode* +BinaryOpLeft(ParseNode* pn) +{ + MOZ_ASSERT(pn->isBinaryOperation()); + MOZ_ASSERT(pn->isArity(PN_LIST)); + MOZ_ASSERT(pn->pn_count == 2); + return ListHead(pn); +} + +static inline ParseNode* +BinaryOpRight(ParseNode* pn) +{ + MOZ_ASSERT(pn->isBinaryOperation()); + MOZ_ASSERT(pn->isArity(PN_LIST)); + MOZ_ASSERT(pn->pn_count == 2); + return NextNode(ListHead(pn)); +} + +static inline ParseNode* +BitwiseLeft(ParseNode* pn) +{ + return BinaryOpLeft(pn); +} + +static inline ParseNode* +BitwiseRight(ParseNode* pn) +{ + return BinaryOpRight(pn); +} + +static inline ParseNode* +MultiplyLeft(ParseNode* pn) +{ + MOZ_ASSERT(pn->isKind(PNK_STAR)); + return BinaryOpLeft(pn); +} + +static inline ParseNode* +MultiplyRight(ParseNode* pn) +{ + MOZ_ASSERT(pn->isKind(PNK_STAR)); + return BinaryOpRight(pn); +} + +static inline ParseNode* +AddSubLeft(ParseNode* pn) +{ + MOZ_ASSERT(pn->isKind(PNK_ADD) || pn->isKind(PNK_SUB)); + return BinaryOpLeft(pn); +} + +static inline ParseNode* +AddSubRight(ParseNode* pn) +{ + MOZ_ASSERT(pn->isKind(PNK_ADD) || pn->isKind(PNK_SUB)); + return BinaryOpRight(pn); +} + +static inline ParseNode* +DivOrModLeft(ParseNode* pn) +{ + MOZ_ASSERT(pn->isKind(PNK_DIV) || pn->isKind(PNK_MOD)); + return BinaryOpLeft(pn); +} + +static inline ParseNode* +DivOrModRight(ParseNode* pn) +{ + MOZ_ASSERT(pn->isKind(PNK_DIV) || pn->isKind(PNK_MOD)); + return BinaryOpRight(pn); +} + +static inline ParseNode* +ComparisonLeft(ParseNode* pn) +{ + return BinaryOpLeft(pn); +} + +static inline ParseNode* +ComparisonRight(ParseNode* pn) +{ + return BinaryOpRight(pn); +} + +static inline bool +IsExpressionStatement(ParseNode* pn) +{ + return pn->isKind(PNK_SEMI); +} + +static inline ParseNode* +ExpressionStatementExpr(ParseNode* pn) +{ + MOZ_ASSERT(pn->isKind(PNK_SEMI)); + return UnaryKid(pn); +} + +static inline PropertyName* +LoopControlMaybeLabel(ParseNode* pn) +{ + MOZ_ASSERT(pn->isKind(PNK_BREAK) || pn->isKind(PNK_CONTINUE)); + MOZ_ASSERT(pn->isArity(PN_NULLARY)); + return pn->as<LoopControlStatement>().label(); +} + +static inline PropertyName* +LabeledStatementLabel(ParseNode* pn) +{ + return pn->as<LabeledStatement>().label(); +} + +static inline ParseNode* +LabeledStatementStatement(ParseNode* pn) +{ + return pn->as<LabeledStatement>().statement(); +} + +static double +NumberNodeValue(ParseNode* pn) +{ + MOZ_ASSERT(pn->isKind(PNK_NUMBER)); + return pn->pn_dval; +} + +static bool +NumberNodeHasFrac(ParseNode* pn) +{ + MOZ_ASSERT(pn->isKind(PNK_NUMBER)); + return pn->pn_u.number.decimalPoint == HasDecimal; +} + +static ParseNode* +DotBase(ParseNode* pn) +{ + MOZ_ASSERT(pn->isKind(PNK_DOT)); + MOZ_ASSERT(pn->isArity(PN_NAME)); + return pn->expr(); +} + +static PropertyName* +DotMember(ParseNode* pn) +{ + MOZ_ASSERT(pn->isKind(PNK_DOT)); + MOZ_ASSERT(pn->isArity(PN_NAME)); + return pn->pn_atom->asPropertyName(); +} + +static ParseNode* +ElemBase(ParseNode* pn) +{ + MOZ_ASSERT(pn->isKind(PNK_ELEM)); + return BinaryLeft(pn); +} + +static ParseNode* +ElemIndex(ParseNode* pn) +{ + MOZ_ASSERT(pn->isKind(PNK_ELEM)); + return BinaryRight(pn); +} + +static inline JSFunction* +FunctionObject(ParseNode* fn) +{ + MOZ_ASSERT(fn->isKind(PNK_FUNCTION)); + MOZ_ASSERT(fn->isArity(PN_CODE)); + return fn->pn_funbox->function(); +} + +static inline PropertyName* +FunctionName(ParseNode* fn) +{ + if (JSAtom* name = FunctionObject(fn)->name()) + return name->asPropertyName(); + return nullptr; +} + +static inline ParseNode* +FunctionStatementList(ParseNode* fn) +{ + MOZ_ASSERT(fn->pn_body->isKind(PNK_PARAMSBODY)); + ParseNode* last = fn->pn_body->last(); + MOZ_ASSERT(last->isKind(PNK_LEXICALSCOPE)); + MOZ_ASSERT(last->isEmptyScope()); + ParseNode* body = last->scopeBody(); + MOZ_ASSERT(body->isKind(PNK_STATEMENTLIST)); + return body; +} + +static inline bool +IsNormalObjectField(ExclusiveContext* cx, ParseNode* pn) +{ + return pn->isKind(PNK_COLON) && + pn->getOp() == JSOP_INITPROP && + BinaryLeft(pn)->isKind(PNK_OBJECT_PROPERTY_NAME); +} + +static inline PropertyName* +ObjectNormalFieldName(ExclusiveContext* cx, ParseNode* pn) +{ + MOZ_ASSERT(IsNormalObjectField(cx, pn)); + MOZ_ASSERT(BinaryLeft(pn)->isKind(PNK_OBJECT_PROPERTY_NAME)); + return BinaryLeft(pn)->pn_atom->asPropertyName(); +} + +static inline ParseNode* +ObjectNormalFieldInitializer(ExclusiveContext* cx, ParseNode* pn) +{ + MOZ_ASSERT(IsNormalObjectField(cx, pn)); + return BinaryRight(pn); +} + +static inline ParseNode* +MaybeInitializer(ParseNode* pn) +{ + return pn->expr(); +} + +static inline bool +IsUseOfName(ParseNode* pn, PropertyName* name) +{ + return pn->isKind(PNK_NAME) && pn->name() == name; +} + +static inline bool +IsIgnoredDirectiveName(ExclusiveContext* cx, JSAtom* atom) +{ + return atom != cx->names().useStrict; +} + +static inline bool +IsIgnoredDirective(ExclusiveContext* cx, ParseNode* pn) +{ + return pn->isKind(PNK_SEMI) && + UnaryKid(pn) && + UnaryKid(pn)->isKind(PNK_STRING) && + IsIgnoredDirectiveName(cx, UnaryKid(pn)->pn_atom); +} + +static inline bool +IsEmptyStatement(ParseNode* pn) +{ + return pn->isKind(PNK_SEMI) && !UnaryKid(pn); +} + +static inline ParseNode* +SkipEmptyStatements(ParseNode* pn) +{ + while (pn && IsEmptyStatement(pn)) + pn = pn->pn_next; + return pn; +} + +static inline ParseNode* +NextNonEmptyStatement(ParseNode* pn) +{ + return SkipEmptyStatements(pn->pn_next); +} + +static bool +GetToken(AsmJSParser& parser, TokenKind* tkp) +{ + TokenStream& ts = parser.tokenStream; + TokenKind tk; + while (true) { + if (!ts.getToken(&tk, TokenStream::Operand)) + return false; + if (tk != TOK_SEMI) + break; + } + *tkp = tk; + return true; +} + +static bool +PeekToken(AsmJSParser& parser, TokenKind* tkp) +{ + TokenStream& ts = parser.tokenStream; + TokenKind tk; + while (true) { + if (!ts.peekToken(&tk, TokenStream::Operand)) + return false; + if (tk != TOK_SEMI) + break; + ts.consumeKnownToken(TOK_SEMI, TokenStream::Operand); + } + *tkp = tk; + return true; +} + +static bool +ParseVarOrConstStatement(AsmJSParser& parser, ParseNode** var) +{ + TokenKind tk; + if (!PeekToken(parser, &tk)) + return false; + if (tk != TOK_VAR && tk != TOK_CONST) { + *var = nullptr; + return true; + } + + *var = parser.statementListItem(YieldIsName); + if (!*var) + return false; + + MOZ_ASSERT((*var)->isKind(PNK_VAR) || (*var)->isKind(PNK_CONST)); + return true; +} + +/*****************************************************************************/ + +// Represents the type and value of an asm.js numeric literal. +// +// A literal is a double iff the literal contains a decimal point (even if the +// fractional part is 0). Otherwise, integers may be classified: +// fixnum: [0, 2^31) +// negative int: [-2^31, 0) +// big unsigned: [2^31, 2^32) +// out of range: otherwise +// Lastly, a literal may be a float literal which is any double or integer +// literal coerced with Math.fround. +// +// This class distinguishes between signed and unsigned integer SIMD types like +// Int32x4 and Uint32x4, and so does Type below. The wasm ValType and ExprType +// enums, and the wasm::Val class do not. +class NumLit +{ + public: + enum Which { + Fixnum, + NegativeInt, + BigUnsigned, + Double, + Float, + Int8x16, + Int16x8, + Int32x4, + Uint8x16, + Uint16x8, + Uint32x4, + Float32x4, + Bool8x16, + Bool16x8, + Bool32x4, + OutOfRangeInt = -1 + }; + + private: + Which which_; + union { + Value scalar_; + SimdConstant simd_; + } u; + + public: + NumLit() = default; + + NumLit(Which w, const Value& v) : which_(w) { + u.scalar_ = v; + MOZ_ASSERT(!isSimd()); + } + + NumLit(Which w, SimdConstant c) : which_(w) { + u.simd_ = c; + MOZ_ASSERT(isSimd()); + } + + Which which() const { + return which_; + } + + int32_t toInt32() const { + MOZ_ASSERT(which_ == Fixnum || which_ == NegativeInt || which_ == BigUnsigned); + return u.scalar_.toInt32(); + } + + uint32_t toUint32() const { + return (uint32_t)toInt32(); + } + + RawF64 toDouble() const { + MOZ_ASSERT(which_ == Double); + return RawF64(u.scalar_.toDouble()); + } + + RawF32 toFloat() const { + MOZ_ASSERT(which_ == Float); + return RawF32(float(u.scalar_.toDouble())); + } + + Value scalarValue() const { + MOZ_ASSERT(which_ != OutOfRangeInt); + return u.scalar_; + } + + bool isSimd() const + { + return which_ == Int8x16 || which_ == Uint8x16 || which_ == Int16x8 || + which_ == Uint16x8 || which_ == Int32x4 || which_ == Uint32x4 || + which_ == Float32x4 || which_ == Bool8x16 || which_ == Bool16x8 || + which_ == Bool32x4; + } + + const SimdConstant& simdValue() const { + MOZ_ASSERT(isSimd()); + return u.simd_; + } + + bool valid() const { + return which_ != OutOfRangeInt; + } + + bool isZeroBits() const { + MOZ_ASSERT(valid()); + switch (which()) { + case NumLit::Fixnum: + case NumLit::NegativeInt: + case NumLit::BigUnsigned: + return toInt32() == 0; + case NumLit::Double: + return toDouble().bits() == 0; + case NumLit::Float: + return toFloat().bits() == 0; + case NumLit::Int8x16: + case NumLit::Uint8x16: + case NumLit::Bool8x16: + return simdValue() == SimdConstant::SplatX16(0); + case NumLit::Int16x8: + case NumLit::Uint16x8: + case NumLit::Bool16x8: + return simdValue() == SimdConstant::SplatX8(0); + case NumLit::Int32x4: + case NumLit::Uint32x4: + case NumLit::Bool32x4: + return simdValue() == SimdConstant::SplatX4(0); + case NumLit::Float32x4: + return simdValue() == SimdConstant::SplatX4(0.f); + case NumLit::OutOfRangeInt: + MOZ_CRASH("can't be here because of valid() check above"); + } + return false; + } + + Val value() const { + switch (which_) { + case NumLit::Fixnum: + case NumLit::NegativeInt: + case NumLit::BigUnsigned: + return Val(toUint32()); + case NumLit::Float: + return Val(toFloat()); + case NumLit::Double: + return Val(toDouble()); + case NumLit::Int8x16: + case NumLit::Uint8x16: + return Val(simdValue().asInt8x16()); + case NumLit::Int16x8: + case NumLit::Uint16x8: + return Val(simdValue().asInt16x8()); + case NumLit::Int32x4: + case NumLit::Uint32x4: + return Val(simdValue().asInt32x4()); + case NumLit::Float32x4: + return Val(simdValue().asFloat32x4()); + case NumLit::Bool8x16: + return Val(simdValue().asInt8x16(), ValType::B8x16); + case NumLit::Bool16x8: + return Val(simdValue().asInt16x8(), ValType::B16x8); + case NumLit::Bool32x4: + return Val(simdValue().asInt32x4(), ValType::B32x4); + case NumLit::OutOfRangeInt:; + } + MOZ_CRASH("bad literal"); + } +}; + +// Represents the type of a general asm.js expression. +// +// A canonical subset of types representing the coercion targets: Int, Float, +// Double, and the SIMD types. This is almost equivalent to wasm::ValType, +// except the integer SIMD types have signed/unsigned variants. +// +// Void is also part of the canonical subset which then maps to wasm::ExprType. +// +// Note that while the canonical subset distinguishes signed and unsigned SIMD +// types, it only uses |Int| to represent signed and unsigned 32-bit integers. +// This is because the scalar coersions x|0 and x>>>0 work with any kind of +// integer input, while the SIMD check functions throw a TypeError if the passed +// type doesn't match. +// +class Type +{ + public: + enum Which { + Fixnum = NumLit::Fixnum, + Signed = NumLit::NegativeInt, + Unsigned = NumLit::BigUnsigned, + DoubleLit = NumLit::Double, + Float = NumLit::Float, + Int8x16 = NumLit::Int8x16, + Int16x8 = NumLit::Int16x8, + Int32x4 = NumLit::Int32x4, + Uint8x16 = NumLit::Uint8x16, + Uint16x8 = NumLit::Uint16x8, + Uint32x4 = NumLit::Uint32x4, + Float32x4 = NumLit::Float32x4, + Bool8x16 = NumLit::Bool8x16, + Bool16x8 = NumLit::Bool16x8, + Bool32x4 = NumLit::Bool32x4, + Double, + MaybeDouble, + MaybeFloat, + Floatish, + Int, + Intish, + Void + }; + + private: + Which which_; + + public: + Type() = default; + MOZ_IMPLICIT Type(Which w) : which_(w) {} + MOZ_IMPLICIT Type(SimdType type) { + switch (type) { + case SimdType::Int8x16: which_ = Int8x16; return; + case SimdType::Int16x8: which_ = Int16x8; return; + case SimdType::Int32x4: which_ = Int32x4; return; + case SimdType::Uint8x16: which_ = Uint8x16; return; + case SimdType::Uint16x8: which_ = Uint16x8; return; + case SimdType::Uint32x4: which_ = Uint32x4; return; + case SimdType::Float32x4: which_ = Float32x4; return; + case SimdType::Bool8x16: which_ = Bool8x16; return; + case SimdType::Bool16x8: which_ = Bool16x8; return; + case SimdType::Bool32x4: which_ = Bool32x4; return; + default: break; + } + MOZ_MAKE_COMPILER_ASSUME_IS_UNREACHABLE("bad SimdType"); + } + + // Map an already canonicalized Type to the return type of a function call. + static Type ret(Type t) { + MOZ_ASSERT(t.isCanonical()); + // The 32-bit external type is Signed, not Int. + return t.isInt() ? Signed: t; + } + + static Type lit(const NumLit& lit) { + MOZ_ASSERT(lit.valid()); + Which which = Type::Which(lit.which()); + MOZ_ASSERT(which >= Fixnum && which <= Bool32x4); + Type t; + t.which_ = which; + return t; + } + + // Map |t| to one of the canonical vartype representations of a + // wasm::ExprType. + static Type canonicalize(Type t) { + switch(t.which()) { + case Fixnum: + case Signed: + case Unsigned: + case Int: + return Int; + + case Float: + return Float; + + case DoubleLit: + case Double: + return Double; + + case Void: + return Void; + + case Int8x16: + case Int16x8: + case Int32x4: + case Uint8x16: + case Uint16x8: + case Uint32x4: + case Float32x4: + case Bool8x16: + case Bool16x8: + case Bool32x4: + return t; + + case MaybeDouble: + case MaybeFloat: + case Floatish: + case Intish: + // These types need some kind of coercion, they can't be mapped + // to an ExprType. + break; + } + MOZ_CRASH("Invalid vartype"); + } + + Which which() const { return which_; } + + bool operator==(Type rhs) const { return which_ == rhs.which_; } + bool operator!=(Type rhs) const { return which_ != rhs.which_; } + + bool operator<=(Type rhs) const { + switch (rhs.which_) { + case Signed: return isSigned(); + case Unsigned: return isUnsigned(); + case DoubleLit: return isDoubleLit(); + case Double: return isDouble(); + case Float: return isFloat(); + case Int8x16: return isInt8x16(); + case Int16x8: return isInt16x8(); + case Int32x4: return isInt32x4(); + case Uint8x16: return isUint8x16(); + case Uint16x8: return isUint16x8(); + case Uint32x4: return isUint32x4(); + case Float32x4: return isFloat32x4(); + case Bool8x16: return isBool8x16(); + case Bool16x8: return isBool16x8(); + case Bool32x4: return isBool32x4(); + case MaybeDouble: return isMaybeDouble(); + case MaybeFloat: return isMaybeFloat(); + case Floatish: return isFloatish(); + case Int: return isInt(); + case Intish: return isIntish(); + case Fixnum: return isFixnum(); + case Void: return isVoid(); + } + MOZ_MAKE_COMPILER_ASSUME_IS_UNREACHABLE("unexpected rhs type"); + } + + bool isFixnum() const { + return which_ == Fixnum; + } + + bool isSigned() const { + return which_ == Signed || which_ == Fixnum; + } + + bool isUnsigned() const { + return which_ == Unsigned || which_ == Fixnum; + } + + bool isInt() const { + return isSigned() || isUnsigned() || which_ == Int; + } + + bool isIntish() const { + return isInt() || which_ == Intish; + } + + bool isDoubleLit() const { + return which_ == DoubleLit; + } + + bool isDouble() const { + return isDoubleLit() || which_ == Double; + } + + bool isMaybeDouble() const { + return isDouble() || which_ == MaybeDouble; + } + + bool isFloat() const { + return which_ == Float; + } + + bool isMaybeFloat() const { + return isFloat() || which_ == MaybeFloat; + } + + bool isFloatish() const { + return isMaybeFloat() || which_ == Floatish; + } + + bool isVoid() const { + return which_ == Void; + } + + bool isExtern() const { + return isDouble() || isSigned(); + } + + bool isInt8x16() const { + return which_ == Int8x16; + } + + bool isInt16x8() const { + return which_ == Int16x8; + } + + bool isInt32x4() const { + return which_ == Int32x4; + } + + bool isUint8x16() const { + return which_ == Uint8x16; + } + + bool isUint16x8() const { + return which_ == Uint16x8; + } + + bool isUint32x4() const { + return which_ == Uint32x4; + } + + bool isFloat32x4() const { + return which_ == Float32x4; + } + + bool isBool8x16() const { + return which_ == Bool8x16; + } + + bool isBool16x8() const { + return which_ == Bool16x8; + } + + bool isBool32x4() const { + return which_ == Bool32x4; + } + + bool isSimd() const { + return isInt8x16() || isInt16x8() || isInt32x4() || isUint8x16() || isUint16x8() || + isUint32x4() || isFloat32x4() || isBool8x16() || isBool16x8() || isBool32x4(); + } + + bool isUnsignedSimd() const { + return isUint8x16() || isUint16x8() || isUint32x4(); + } + + // Check if this is one of the valid types for a function argument. + bool isArgType() const { + return isInt() || isFloat() || isDouble() || (isSimd() && !isUnsignedSimd()); + } + + // Check if this is one of the valid types for a function return value. + bool isReturnType() const { + return isSigned() || isFloat() || isDouble() || (isSimd() && !isUnsignedSimd()) || + isVoid(); + } + + // Check if this is one of the valid types for a global variable. + bool isGlobalVarType() const { + return isArgType(); + } + + // Check if this is one of the canonical vartype representations of a + // wasm::ExprType. See Type::canonicalize(). + bool isCanonical() const { + switch (which()) { + case Int: + case Float: + case Double: + case Void: + return true; + default: + return isSimd(); + } + } + + // Check if this is a canonical representation of a wasm::ValType. + bool isCanonicalValType() const { + return !isVoid() && isCanonical(); + } + + // Convert this canonical type to a wasm::ExprType. + ExprType canonicalToExprType() const { + switch (which()) { + case Int: return ExprType::I32; + case Float: return ExprType::F32; + case Double: return ExprType::F64; + case Void: return ExprType::Void; + case Uint8x16: + case Int8x16: return ExprType::I8x16; + case Uint16x8: + case Int16x8: return ExprType::I16x8; + case Uint32x4: + case Int32x4: return ExprType::I32x4; + case Float32x4: return ExprType::F32x4; + case Bool8x16: return ExprType::B8x16; + case Bool16x8: return ExprType::B16x8; + case Bool32x4: return ExprType::B32x4; + default: MOZ_CRASH("Need canonical type"); + } + } + + // Convert this canonical type to a wasm::ValType. + ValType canonicalToValType() const { + return NonVoidToValType(canonicalToExprType()); + } + + // Convert this type to a wasm::ExprType for use in a wasm + // block signature. This works for all types, including non-canonical + // ones. Consequently, the type isn't valid for subsequent asm.js + // validation; it's only valid for use in producing wasm. + ExprType toWasmBlockSignatureType() const { + switch (which()) { + case Fixnum: + case Signed: + case Unsigned: + case Int: + case Intish: + return ExprType::I32; + + case Float: + case MaybeFloat: + case Floatish: + return ExprType::F32; + + case DoubleLit: + case Double: + case MaybeDouble: + return ExprType::F64; + + case Void: + return ExprType::Void; + + case Uint8x16: + case Int8x16: return ExprType::I8x16; + case Uint16x8: + case Int16x8: return ExprType::I16x8; + case Uint32x4: + case Int32x4: return ExprType::I32x4; + case Float32x4: return ExprType::F32x4; + case Bool8x16: return ExprType::B8x16; + case Bool16x8: return ExprType::B16x8; + case Bool32x4: return ExprType::B32x4; + } + MOZ_CRASH("Invalid Type"); + } + + const char* toChars() const { + switch (which_) { + case Double: return "double"; + case DoubleLit: return "doublelit"; + case MaybeDouble: return "double?"; + case Float: return "float"; + case Floatish: return "floatish"; + case MaybeFloat: return "float?"; + case Fixnum: return "fixnum"; + case Int: return "int"; + case Signed: return "signed"; + case Unsigned: return "unsigned"; + case Intish: return "intish"; + case Int8x16: return "int8x16"; + case Int16x8: return "int16x8"; + case Int32x4: return "int32x4"; + case Uint8x16: return "uint8x16"; + case Uint16x8: return "uint16x8"; + case Uint32x4: return "uint32x4"; + case Float32x4: return "float32x4"; + case Bool8x16: return "bool8x16"; + case Bool16x8: return "bool16x8"; + case Bool32x4: return "bool32x4"; + case Void: return "void"; + } + MOZ_CRASH("Invalid Type"); + } +}; + +static const unsigned VALIDATION_LIFO_DEFAULT_CHUNK_SIZE = 4 * 1024; + +// The ModuleValidator encapsulates the entire validation of an asm.js module. +// Its lifetime goes from the validation of the top components of an asm.js +// module (all the globals), the emission of bytecode for all the functions in +// the module and the validation of function's pointer tables. It also finishes +// the compilation of all the module's stubs. +// +// Rooting note: ModuleValidator is a stack class that contains unrooted +// PropertyName (JSAtom) pointers. This is safe because it cannot be +// constructed without a TokenStream reference. TokenStream is itself a stack +// class that cannot be constructed without an AutoKeepAtoms being live on the +// stack, which prevents collection of atoms. +// +// ModuleValidator is marked as rooted in the rooting analysis. Don't add +// non-JSAtom pointers, or this will break! +class MOZ_STACK_CLASS ModuleValidator +{ + public: + class Func + { + PropertyName* name_; + uint32_t firstUse_; + uint32_t index_; + uint32_t srcBegin_; + uint32_t srcEnd_; + bool defined_; + + public: + Func(PropertyName* name, uint32_t firstUse, uint32_t index) + : name_(name), firstUse_(firstUse), index_(index), + srcBegin_(0), srcEnd_(0), defined_(false) + {} + + PropertyName* name() const { return name_; } + uint32_t firstUse() const { return firstUse_; } + bool defined() const { return defined_; } + uint32_t index() const { return index_; } + + void define(ParseNode* fn) { + MOZ_ASSERT(!defined_); + defined_ = true; + srcBegin_ = fn->pn_pos.begin; + srcEnd_ = fn->pn_pos.end; + } + + uint32_t srcBegin() const { MOZ_ASSERT(defined_); return srcBegin_; } + uint32_t srcEnd() const { MOZ_ASSERT(defined_); return srcEnd_; } + }; + + typedef Vector<const Func*> ConstFuncVector; + typedef Vector<Func*> FuncVector; + + class FuncPtrTable + { + uint32_t sigIndex_; + PropertyName* name_; + uint32_t firstUse_; + uint32_t mask_; + bool defined_; + + FuncPtrTable(FuncPtrTable&& rhs) = delete; + + public: + FuncPtrTable(uint32_t sigIndex, PropertyName* name, uint32_t firstUse, uint32_t mask) + : sigIndex_(sigIndex), name_(name), firstUse_(firstUse), mask_(mask), defined_(false) + {} + + uint32_t sigIndex() const { return sigIndex_; } + PropertyName* name() const { return name_; } + uint32_t firstUse() const { return firstUse_; } + unsigned mask() const { return mask_; } + bool defined() const { return defined_; } + void define() { MOZ_ASSERT(!defined_); defined_ = true; } + }; + + typedef Vector<FuncPtrTable*> FuncPtrTableVector; + + class Global + { + public: + enum Which { + Variable, + ConstantLiteral, + ConstantImport, + Function, + FuncPtrTable, + FFI, + ArrayView, + ArrayViewCtor, + MathBuiltinFunction, + AtomicsBuiltinFunction, + SimdCtor, + SimdOp + }; + + private: + Which which_; + union { + struct { + Type::Which type_; + unsigned index_; + NumLit literalValue_; + } varOrConst; + uint32_t funcIndex_; + uint32_t funcPtrTableIndex_; + uint32_t ffiIndex_; + struct { + Scalar::Type viewType_; + } viewInfo; + AsmJSMathBuiltinFunction mathBuiltinFunc_; + AsmJSAtomicsBuiltinFunction atomicsBuiltinFunc_; + SimdType simdCtorType_; + struct { + SimdType type_; + SimdOperation which_; + } simdOp; + } u; + + friend class ModuleValidator; + friend class js::LifoAlloc; + + explicit Global(Which which) : which_(which) {} + + public: + Which which() const { + return which_; + } + Type varOrConstType() const { + MOZ_ASSERT(which_ == Variable || which_ == ConstantLiteral || which_ == ConstantImport); + return u.varOrConst.type_; + } + unsigned varOrConstIndex() const { + MOZ_ASSERT(which_ == Variable || which_ == ConstantImport); + return u.varOrConst.index_; + } + bool isConst() const { + return which_ == ConstantLiteral || which_ == ConstantImport; + } + NumLit constLiteralValue() const { + MOZ_ASSERT(which_ == ConstantLiteral); + return u.varOrConst.literalValue_; + } + uint32_t funcIndex() const { + MOZ_ASSERT(which_ == Function); + return u.funcIndex_; + } + uint32_t funcPtrTableIndex() const { + MOZ_ASSERT(which_ == FuncPtrTable); + return u.funcPtrTableIndex_; + } + unsigned ffiIndex() const { + MOZ_ASSERT(which_ == FFI); + return u.ffiIndex_; + } + bool isAnyArrayView() const { + return which_ == ArrayView || which_ == ArrayViewCtor; + } + Scalar::Type viewType() const { + MOZ_ASSERT(isAnyArrayView()); + return u.viewInfo.viewType_; + } + bool isMathFunction() const { + return which_ == MathBuiltinFunction; + } + AsmJSMathBuiltinFunction mathBuiltinFunction() const { + MOZ_ASSERT(which_ == MathBuiltinFunction); + return u.mathBuiltinFunc_; + } + bool isAtomicsFunction() const { + return which_ == AtomicsBuiltinFunction; + } + AsmJSAtomicsBuiltinFunction atomicsBuiltinFunction() const { + MOZ_ASSERT(which_ == AtomicsBuiltinFunction); + return u.atomicsBuiltinFunc_; + } + bool isSimdCtor() const { + return which_ == SimdCtor; + } + SimdType simdCtorType() const { + MOZ_ASSERT(which_ == SimdCtor); + return u.simdCtorType_; + } + bool isSimdOperation() const { + return which_ == SimdOp; + } + SimdOperation simdOperation() const { + MOZ_ASSERT(which_ == SimdOp); + return u.simdOp.which_; + } + SimdType simdOperationType() const { + MOZ_ASSERT(which_ == SimdOp); + return u.simdOp.type_; + } + }; + + struct MathBuiltin + { + enum Kind { Function, Constant }; + Kind kind; + + union { + double cst; + AsmJSMathBuiltinFunction func; + } u; + + MathBuiltin() : kind(Kind(-1)) {} + explicit MathBuiltin(double cst) : kind(Constant) { + u.cst = cst; + } + explicit MathBuiltin(AsmJSMathBuiltinFunction func) : kind(Function) { + u.func = func; + } + }; + + struct ArrayView + { + ArrayView(PropertyName* name, Scalar::Type type) + : name(name), type(type) + {} + + PropertyName* name; + Scalar::Type type; + }; + + private: + class NamedSig + { + PropertyName* name_; + const SigWithId* sig_; + + public: + NamedSig(PropertyName* name, const SigWithId& sig) + : name_(name), sig_(&sig) + {} + PropertyName* name() const { + return name_; + } + const Sig& sig() const { + return *sig_; + } + + // Implement HashPolicy: + struct Lookup { + PropertyName* name; + const Sig& sig; + Lookup(PropertyName* name, const Sig& sig) : name(name), sig(sig) {} + }; + static HashNumber hash(Lookup l) { + return HashGeneric(l.name, l.sig.hash()); + } + static bool match(NamedSig lhs, Lookup rhs) { + return lhs.name_ == rhs.name && *lhs.sig_ == rhs.sig; + } + }; + typedef HashMap<NamedSig, uint32_t, NamedSig> ImportMap; + typedef HashMap<const SigWithId*, uint32_t, SigHashPolicy> SigMap; + typedef HashMap<PropertyName*, Global*> GlobalMap; + typedef HashMap<PropertyName*, MathBuiltin> MathNameMap; + typedef HashMap<PropertyName*, AsmJSAtomicsBuiltinFunction> AtomicsNameMap; + typedef HashMap<PropertyName*, SimdOperation> SimdOperationNameMap; + typedef Vector<ArrayView> ArrayViewVector; + + ExclusiveContext* cx_; + AsmJSParser& parser_; + ParseNode* moduleFunctionNode_; + PropertyName* moduleFunctionName_; + PropertyName* globalArgumentName_; + PropertyName* importArgumentName_; + PropertyName* bufferArgumentName_; + MathNameMap standardLibraryMathNames_; + AtomicsNameMap standardLibraryAtomicsNames_; + SimdOperationNameMap standardLibrarySimdOpNames_; + RootedFunction dummyFunction_; + + // Validation-internal state: + LifoAlloc validationLifo_; + FuncVector functions_; + FuncPtrTableVector funcPtrTables_; + GlobalMap globalMap_; + SigMap sigMap_; + ImportMap importMap_; + ArrayViewVector arrayViews_; + bool atomicsPresent_; + bool simdPresent_; + + // State used to build the AsmJSModule in finish(): + ModuleGenerator mg_; + MutableAsmJSMetadata asmJSMetadata_; + + // Error reporting: + UniqueChars errorString_; + uint32_t errorOffset_; + bool errorOverRecursed_; + + // Helpers: + bool addStandardLibraryMathName(const char* name, AsmJSMathBuiltinFunction func) { + JSAtom* atom = Atomize(cx_, name, strlen(name)); + if (!atom) + return false; + MathBuiltin builtin(func); + return standardLibraryMathNames_.putNew(atom->asPropertyName(), builtin); + } + bool addStandardLibraryMathName(const char* name, double cst) { + JSAtom* atom = Atomize(cx_, name, strlen(name)); + if (!atom) + return false; + MathBuiltin builtin(cst); + return standardLibraryMathNames_.putNew(atom->asPropertyName(), builtin); + } + bool addStandardLibraryAtomicsName(const char* name, AsmJSAtomicsBuiltinFunction func) { + JSAtom* atom = Atomize(cx_, name, strlen(name)); + if (!atom) + return false; + return standardLibraryAtomicsNames_.putNew(atom->asPropertyName(), func); + } + bool addStandardLibrarySimdOpName(const char* name, SimdOperation op) { + JSAtom* atom = Atomize(cx_, name, strlen(name)); + if (!atom) + return false; + return standardLibrarySimdOpNames_.putNew(atom->asPropertyName(), op); + } + bool newSig(Sig&& sig, uint32_t* sigIndex) { + *sigIndex = 0; + if (mg_.numSigs() >= MaxSigs) + return failCurrentOffset("too many signatures"); + + *sigIndex = mg_.numSigs(); + mg_.initSig(*sigIndex, Move(sig)); + return true; + } + bool declareSig(Sig&& sig, uint32_t* sigIndex) { + SigMap::AddPtr p = sigMap_.lookupForAdd(sig); + if (p) { + *sigIndex = p->value(); + MOZ_ASSERT(mg_.sig(*sigIndex) == sig); + return true; + } + + return newSig(Move(sig), sigIndex) && + sigMap_.add(p, &mg_.sig(*sigIndex), *sigIndex); + } + + public: + ModuleValidator(ExclusiveContext* cx, AsmJSParser& parser, ParseNode* moduleFunctionNode) + : cx_(cx), + parser_(parser), + moduleFunctionNode_(moduleFunctionNode), + moduleFunctionName_(FunctionName(moduleFunctionNode)), + globalArgumentName_(nullptr), + importArgumentName_(nullptr), + bufferArgumentName_(nullptr), + standardLibraryMathNames_(cx), + standardLibraryAtomicsNames_(cx), + standardLibrarySimdOpNames_(cx), + dummyFunction_(cx), + validationLifo_(VALIDATION_LIFO_DEFAULT_CHUNK_SIZE), + functions_(cx), + funcPtrTables_(cx), + globalMap_(cx), + sigMap_(cx), + importMap_(cx), + arrayViews_(cx), + atomicsPresent_(false), + simdPresent_(false), + mg_(ImportVector()), + errorString_(nullptr), + errorOffset_(UINT32_MAX), + errorOverRecursed_(false) + {} + + ~ModuleValidator() { + if (errorString_) { + MOZ_ASSERT(errorOffset_ != UINT32_MAX); + tokenStream().reportAsmJSError(errorOffset_, + JSMSG_USE_ASM_TYPE_FAIL, + errorString_.get()); + } + if (errorOverRecursed_) + ReportOverRecursed(cx_); + } + + bool init() { + asmJSMetadata_ = cx_->new_<AsmJSMetadata>(); + if (!asmJSMetadata_) + return false; + + asmJSMetadata_->srcStart = moduleFunctionNode_->pn_body->pn_pos.begin; + asmJSMetadata_->srcBodyStart = parser_.tokenStream.currentToken().pos.end; + asmJSMetadata_->strict = parser_.pc->sc()->strict() && + !parser_.pc->sc()->hasExplicitUseStrict(); + asmJSMetadata_->scriptSource.reset(parser_.ss); + + if (!globalMap_.init() || !sigMap_.init() || !importMap_.init()) + return false; + + if (!standardLibraryMathNames_.init() || + !addStandardLibraryMathName("sin", AsmJSMathBuiltin_sin) || + !addStandardLibraryMathName("cos", AsmJSMathBuiltin_cos) || + !addStandardLibraryMathName("tan", AsmJSMathBuiltin_tan) || + !addStandardLibraryMathName("asin", AsmJSMathBuiltin_asin) || + !addStandardLibraryMathName("acos", AsmJSMathBuiltin_acos) || + !addStandardLibraryMathName("atan", AsmJSMathBuiltin_atan) || + !addStandardLibraryMathName("ceil", AsmJSMathBuiltin_ceil) || + !addStandardLibraryMathName("floor", AsmJSMathBuiltin_floor) || + !addStandardLibraryMathName("exp", AsmJSMathBuiltin_exp) || + !addStandardLibraryMathName("log", AsmJSMathBuiltin_log) || + !addStandardLibraryMathName("pow", AsmJSMathBuiltin_pow) || + !addStandardLibraryMathName("sqrt", AsmJSMathBuiltin_sqrt) || + !addStandardLibraryMathName("abs", AsmJSMathBuiltin_abs) || + !addStandardLibraryMathName("atan2", AsmJSMathBuiltin_atan2) || + !addStandardLibraryMathName("imul", AsmJSMathBuiltin_imul) || + !addStandardLibraryMathName("clz32", AsmJSMathBuiltin_clz32) || + !addStandardLibraryMathName("fround", AsmJSMathBuiltin_fround) || + !addStandardLibraryMathName("min", AsmJSMathBuiltin_min) || + !addStandardLibraryMathName("max", AsmJSMathBuiltin_max) || + !addStandardLibraryMathName("E", M_E) || + !addStandardLibraryMathName("LN10", M_LN10) || + !addStandardLibraryMathName("LN2", M_LN2) || + !addStandardLibraryMathName("LOG2E", M_LOG2E) || + !addStandardLibraryMathName("LOG10E", M_LOG10E) || + !addStandardLibraryMathName("PI", M_PI) || + !addStandardLibraryMathName("SQRT1_2", M_SQRT1_2) || + !addStandardLibraryMathName("SQRT2", M_SQRT2)) + { + return false; + } + + if (!standardLibraryAtomicsNames_.init() || + !addStandardLibraryAtomicsName("compareExchange", AsmJSAtomicsBuiltin_compareExchange) || + !addStandardLibraryAtomicsName("exchange", AsmJSAtomicsBuiltin_exchange) || + !addStandardLibraryAtomicsName("load", AsmJSAtomicsBuiltin_load) || + !addStandardLibraryAtomicsName("store", AsmJSAtomicsBuiltin_store) || + !addStandardLibraryAtomicsName("add", AsmJSAtomicsBuiltin_add) || + !addStandardLibraryAtomicsName("sub", AsmJSAtomicsBuiltin_sub) || + !addStandardLibraryAtomicsName("and", AsmJSAtomicsBuiltin_and) || + !addStandardLibraryAtomicsName("or", AsmJSAtomicsBuiltin_or) || + !addStandardLibraryAtomicsName("xor", AsmJSAtomicsBuiltin_xor) || + !addStandardLibraryAtomicsName("isLockFree", AsmJSAtomicsBuiltin_isLockFree)) + { + return false; + } + +#define ADDSTDLIBSIMDOPNAME(op) || !addStandardLibrarySimdOpName(#op, SimdOperation::Fn_##op) + if (!standardLibrarySimdOpNames_.init() + FORALL_SIMD_ASMJS_OP(ADDSTDLIBSIMDOPNAME)) + { + return false; + } +#undef ADDSTDLIBSIMDOPNAME + + // This flows into FunctionBox, so must be tenured. + dummyFunction_ = NewScriptedFunction(cx_, 0, JSFunction::INTERPRETED, nullptr, + /* proto = */ nullptr, gc::AllocKind::FUNCTION, + TenuredObject); + if (!dummyFunction_) + return false; + + ScriptedCaller scriptedCaller; + if (parser_.ss->filename()) { + scriptedCaller.line = scriptedCaller.column = 0; // unused + scriptedCaller.filename = DuplicateString(parser_.ss->filename()); + if (!scriptedCaller.filename) + return false; + } + + CompileArgs args; + if (!args.initFromContext(cx_, Move(scriptedCaller))) + return false; + + auto genData = MakeUnique<ModuleGeneratorData>(ModuleKind::AsmJS); + if (!genData || + !genData->sigs.resize(MaxSigs) || + !genData->funcSigs.resize(MaxFuncs) || + !genData->funcImportGlobalDataOffsets.resize(AsmJSMaxImports) || + !genData->tables.resize(MaxTables) || + !genData->asmJSSigToTableIndex.resize(MaxSigs)) + { + return false; + } + + genData->minMemoryLength = RoundUpToNextValidAsmJSHeapLength(0); + + if (!mg_.init(Move(genData), args, asmJSMetadata_.get())) + return false; + + return true; + } + + ExclusiveContext* cx() const { return cx_; } + PropertyName* moduleFunctionName() const { return moduleFunctionName_; } + PropertyName* globalArgumentName() const { return globalArgumentName_; } + PropertyName* importArgumentName() const { return importArgumentName_; } + PropertyName* bufferArgumentName() const { return bufferArgumentName_; } + ModuleGenerator& mg() { return mg_; } + AsmJSParser& parser() const { return parser_; } + TokenStream& tokenStream() const { return parser_.tokenStream; } + RootedFunction& dummyFunction() { return dummyFunction_; } + bool supportsSimd() const { return cx_->jitSupportsSimd(); } + bool atomicsPresent() const { return atomicsPresent_; } + uint32_t minMemoryLength() const { return mg_.minMemoryLength(); } + + void initModuleFunctionName(PropertyName* name) { + MOZ_ASSERT(!moduleFunctionName_); + moduleFunctionName_ = name; + } + MOZ_MUST_USE bool initGlobalArgumentName(PropertyName* n) { + MOZ_ASSERT(n->isTenured()); + globalArgumentName_ = n; + if (n) { + asmJSMetadata_->globalArgumentName = StringToNewUTF8CharsZ(cx_, *n); + if (!asmJSMetadata_->globalArgumentName) + return false; + } + return true; + } + MOZ_MUST_USE bool initImportArgumentName(PropertyName* n) { + MOZ_ASSERT(n->isTenured()); + importArgumentName_ = n; + if (n) { + asmJSMetadata_->importArgumentName = StringToNewUTF8CharsZ(cx_, *n); + if (!asmJSMetadata_->importArgumentName) + return false; + } + return true; + } + MOZ_MUST_USE bool initBufferArgumentName(PropertyName* n) { + MOZ_ASSERT(n->isTenured()); + bufferArgumentName_ = n; + if (n) { + asmJSMetadata_->bufferArgumentName = StringToNewUTF8CharsZ(cx_, *n); + if (!asmJSMetadata_->bufferArgumentName) + return false; + } + return true; + } + bool addGlobalVarInit(PropertyName* var, const NumLit& lit, Type type, bool isConst) { + MOZ_ASSERT(type.isGlobalVarType()); + MOZ_ASSERT(type == Type::canonicalize(Type::lit(lit))); + + uint32_t index; + if (!mg_.addGlobal(type.canonicalToValType(), isConst, &index)) + return false; + + Global::Which which = isConst ? Global::ConstantLiteral : Global::Variable; + Global* global = validationLifo_.new_<Global>(which); + if (!global) + return false; + global->u.varOrConst.index_ = index; + global->u.varOrConst.type_ = (isConst ? Type::lit(lit) : type).which(); + if (isConst) + global->u.varOrConst.literalValue_ = lit; + if (!globalMap_.putNew(var, global)) + return false; + + AsmJSGlobal g(AsmJSGlobal::Variable, nullptr); + g.pod.u.var.initKind_ = AsmJSGlobal::InitConstant; + g.pod.u.var.u.val_ = lit.value(); + return asmJSMetadata_->asmJSGlobals.append(Move(g)); + } + bool addGlobalVarImport(PropertyName* var, PropertyName* field, Type type, bool isConst) { + MOZ_ASSERT(type.isGlobalVarType()); + + UniqueChars fieldChars = StringToNewUTF8CharsZ(cx_, *field); + if (!fieldChars) + return false; + + uint32_t index; + ValType valType = type.canonicalToValType(); + if (!mg_.addGlobal(valType, isConst, &index)) + return false; + + Global::Which which = isConst ? Global::ConstantImport : Global::Variable; + Global* global = validationLifo_.new_<Global>(which); + if (!global) + return false; + global->u.varOrConst.index_ = index; + global->u.varOrConst.type_ = type.which(); + if (!globalMap_.putNew(var, global)) + return false; + + AsmJSGlobal g(AsmJSGlobal::Variable, Move(fieldChars)); + g.pod.u.var.initKind_ = AsmJSGlobal::InitImport; + g.pod.u.var.u.importType_ = valType; + return asmJSMetadata_->asmJSGlobals.append(Move(g)); + } + bool addArrayView(PropertyName* var, Scalar::Type vt, PropertyName* maybeField) { + UniqueChars fieldChars; + if (maybeField) { + fieldChars = StringToNewUTF8CharsZ(cx_, *maybeField); + if (!fieldChars) + return false; + } + + if (!arrayViews_.append(ArrayView(var, vt))) + return false; + + Global* global = validationLifo_.new_<Global>(Global::ArrayView); + if (!global) + return false; + global->u.viewInfo.viewType_ = vt; + if (!globalMap_.putNew(var, global)) + return false; + + AsmJSGlobal g(AsmJSGlobal::ArrayView, Move(fieldChars)); + g.pod.u.viewType_ = vt; + return asmJSMetadata_->asmJSGlobals.append(Move(g)); + } + bool addMathBuiltinFunction(PropertyName* var, AsmJSMathBuiltinFunction func, + PropertyName* field) + { + UniqueChars fieldChars = StringToNewUTF8CharsZ(cx_, *field); + if (!fieldChars) + return false; + + Global* global = validationLifo_.new_<Global>(Global::MathBuiltinFunction); + if (!global) + return false; + global->u.mathBuiltinFunc_ = func; + if (!globalMap_.putNew(var, global)) + return false; + + AsmJSGlobal g(AsmJSGlobal::MathBuiltinFunction, Move(fieldChars)); + g.pod.u.mathBuiltinFunc_ = func; + return asmJSMetadata_->asmJSGlobals.append(Move(g)); + } + private: + bool addGlobalDoubleConstant(PropertyName* var, double constant) { + Global* global = validationLifo_.new_<Global>(Global::ConstantLiteral); + if (!global) + return false; + global->u.varOrConst.type_ = Type::Double; + global->u.varOrConst.literalValue_ = NumLit(NumLit::Double, DoubleValue(constant)); + return globalMap_.putNew(var, global); + } + public: + bool addMathBuiltinConstant(PropertyName* var, double constant, PropertyName* field) { + UniqueChars fieldChars = StringToNewUTF8CharsZ(cx_, *field); + if (!fieldChars) + return false; + + if (!addGlobalDoubleConstant(var, constant)) + return false; + + AsmJSGlobal g(AsmJSGlobal::Constant, Move(fieldChars)); + g.pod.u.constant.value_ = constant; + g.pod.u.constant.kind_ = AsmJSGlobal::MathConstant; + return asmJSMetadata_->asmJSGlobals.append(Move(g)); + } + bool addGlobalConstant(PropertyName* var, double constant, PropertyName* field) { + UniqueChars fieldChars = StringToNewUTF8CharsZ(cx_, *field); + if (!fieldChars) + return false; + + if (!addGlobalDoubleConstant(var, constant)) + return false; + + AsmJSGlobal g(AsmJSGlobal::Constant, Move(fieldChars)); + g.pod.u.constant.value_ = constant; + g.pod.u.constant.kind_ = AsmJSGlobal::GlobalConstant; + return asmJSMetadata_->asmJSGlobals.append(Move(g)); + } + bool addAtomicsBuiltinFunction(PropertyName* var, AsmJSAtomicsBuiltinFunction func, + PropertyName* field) + { + if (!JitOptions.asmJSAtomicsEnable) + return failCurrentOffset("asm.js Atomics only enabled in wasm test mode"); + + atomicsPresent_ = true; + + UniqueChars fieldChars = StringToNewUTF8CharsZ(cx_, *field); + if (!fieldChars) + return false; + + Global* global = validationLifo_.new_<Global>(Global::AtomicsBuiltinFunction); + if (!global) + return false; + global->u.atomicsBuiltinFunc_ = func; + if (!globalMap_.putNew(var, global)) + return false; + + AsmJSGlobal g(AsmJSGlobal::AtomicsBuiltinFunction, Move(fieldChars)); + g.pod.u.atomicsBuiltinFunc_ = func; + return asmJSMetadata_->asmJSGlobals.append(Move(g)); + } + bool addSimdCtor(PropertyName* var, SimdType type, PropertyName* field) { + simdPresent_ = true; + + UniqueChars fieldChars = StringToNewUTF8CharsZ(cx_, *field); + if (!fieldChars) + return false; + + Global* global = validationLifo_.new_<Global>(Global::SimdCtor); + if (!global) + return false; + global->u.simdCtorType_ = type; + if (!globalMap_.putNew(var, global)) + return false; + + AsmJSGlobal g(AsmJSGlobal::SimdCtor, Move(fieldChars)); + g.pod.u.simdCtorType_ = type; + return asmJSMetadata_->asmJSGlobals.append(Move(g)); + } + bool addSimdOperation(PropertyName* var, SimdType type, SimdOperation op, PropertyName* field) { + simdPresent_ = true; + + UniqueChars fieldChars = StringToNewUTF8CharsZ(cx_, *field); + if (!fieldChars) + return false; + + Global* global = validationLifo_.new_<Global>(Global::SimdOp); + if (!global) + return false; + global->u.simdOp.type_ = type; + global->u.simdOp.which_ = op; + if (!globalMap_.putNew(var, global)) + return false; + + AsmJSGlobal g(AsmJSGlobal::SimdOp, Move(fieldChars)); + g.pod.u.simdOp.type_ = type; + g.pod.u.simdOp.which_ = op; + return asmJSMetadata_->asmJSGlobals.append(Move(g)); + } + bool addArrayViewCtor(PropertyName* var, Scalar::Type vt, PropertyName* field) { + UniqueChars fieldChars = StringToNewUTF8CharsZ(cx_, *field); + if (!fieldChars) + return false; + + Global* global = validationLifo_.new_<Global>(Global::ArrayViewCtor); + if (!global) + return false; + global->u.viewInfo.viewType_ = vt; + if (!globalMap_.putNew(var, global)) + return false; + + AsmJSGlobal g(AsmJSGlobal::ArrayViewCtor, Move(fieldChars)); + g.pod.u.viewType_ = vt; + return asmJSMetadata_->asmJSGlobals.append(Move(g)); + } + bool addFFI(PropertyName* var, PropertyName* field) { + UniqueChars fieldChars = StringToNewUTF8CharsZ(cx_, *field); + if (!fieldChars) + return false; + + if (asmJSMetadata_->numFFIs == UINT32_MAX) + return false; + uint32_t ffiIndex = asmJSMetadata_->numFFIs++; + + Global* global = validationLifo_.new_<Global>(Global::FFI); + if (!global) + return false; + global->u.ffiIndex_ = ffiIndex; + if (!globalMap_.putNew(var, global)) + return false; + + AsmJSGlobal g(AsmJSGlobal::FFI, Move(fieldChars)); + g.pod.u.ffiIndex_ = ffiIndex; + return asmJSMetadata_->asmJSGlobals.append(Move(g)); + } + bool addExportField(ParseNode* pn, const Func& func, PropertyName* maybeField) { + // Record the field name of this export. + CacheableChars fieldChars; + if (maybeField) + fieldChars = StringToNewUTF8CharsZ(cx_, *maybeField); + else + fieldChars = DuplicateString(""); + if (!fieldChars) + return false; + + // Declare which function is exported which gives us an index into the + // module FuncExportVector. + if (!mg_.addFuncExport(Move(fieldChars), func.index())) + return false; + + // The exported function might have already been exported in which case + // the index will refer into the range of AsmJSExports. + return asmJSMetadata_->asmJSExports.emplaceBack(func.index(), + func.srcBegin() - asmJSMetadata_->srcStart, + func.srcEnd() - asmJSMetadata_->srcStart); + } + bool addFunction(PropertyName* name, uint32_t firstUse, Sig&& sig, Func** func) { + uint32_t sigIndex; + if (!declareSig(Move(sig), &sigIndex)) + return false; + uint32_t funcIndex = AsmJSFirstDefFuncIndex + numFunctions(); + if (funcIndex >= MaxFuncs) + return failCurrentOffset("too many functions"); + mg_.initFuncSig(funcIndex, sigIndex); + Global* global = validationLifo_.new_<Global>(Global::Function); + if (!global) + return false; + global->u.funcIndex_ = funcIndex; + if (!globalMap_.putNew(name, global)) + return false; + *func = validationLifo_.new_<Func>(name, firstUse, funcIndex); + return *func && functions_.append(*func); + } + bool declareFuncPtrTable(Sig&& sig, PropertyName* name, uint32_t firstUse, uint32_t mask, + uint32_t* index) + { + if (mask > MaxTableElems) + return failCurrentOffset("function pointer table too big"); + uint32_t sigIndex; + if (!newSig(Move(sig), &sigIndex)) + return false; + if (!mg_.initSigTableLength(sigIndex, mask + 1)) + return false; + Global* global = validationLifo_.new_<Global>(Global::FuncPtrTable); + if (!global) + return false; + global->u.funcPtrTableIndex_ = *index = funcPtrTables_.length(); + if (!globalMap_.putNew(name, global)) + return false; + FuncPtrTable* t = validationLifo_.new_<FuncPtrTable>(sigIndex, name, firstUse, mask); + return t && funcPtrTables_.append(t); + } + bool defineFuncPtrTable(uint32_t funcPtrTableIndex, Uint32Vector&& elems) { + FuncPtrTable& table = *funcPtrTables_[funcPtrTableIndex]; + if (table.defined()) + return false; + table.define(); + return mg_.initSigTableElems(table.sigIndex(), Move(elems)); + } + bool declareImport(PropertyName* name, Sig&& sig, unsigned ffiIndex, uint32_t* funcIndex) { + ImportMap::AddPtr p = importMap_.lookupForAdd(NamedSig::Lookup(name, sig)); + if (p) { + *funcIndex = p->value(); + return true; + } + *funcIndex = asmJSMetadata_->asmJSImports.length(); + if (*funcIndex > AsmJSMaxImports) + return failCurrentOffset("too many imports"); + if (!asmJSMetadata_->asmJSImports.emplaceBack(ffiIndex)) + return false; + uint32_t sigIndex; + if (!declareSig(Move(sig), &sigIndex)) + return false; + if (!mg_.initImport(*funcIndex, sigIndex)) + return false; + return importMap_.add(p, NamedSig(name, mg_.sig(sigIndex)), *funcIndex); + } + + bool tryConstantAccess(uint64_t start, uint64_t width) { + MOZ_ASSERT(UINT64_MAX - start > width); + uint64_t len = start + width; + if (len > uint64_t(INT32_MAX) + 1) + return false; + len = RoundUpToNextValidAsmJSHeapLength(len); + if (len > mg_.minMemoryLength()) + mg_.bumpMinMemoryLength(len); + return true; + } + + // Error handling. + bool hasAlreadyFailed() const { + return !!errorString_; + } + + bool failOffset(uint32_t offset, const char* str) { + MOZ_ASSERT(!hasAlreadyFailed()); + MOZ_ASSERT(errorOffset_ == UINT32_MAX); + MOZ_ASSERT(str); + errorOffset_ = offset; + errorString_ = DuplicateString(str); + return false; + } + + bool failCurrentOffset(const char* str) { + return failOffset(tokenStream().currentToken().pos.begin, str); + } + + bool fail(ParseNode* pn, const char* str) { + return failOffset(pn->pn_pos.begin, str); + } + + bool failfVAOffset(uint32_t offset, const char* fmt, va_list ap) { + MOZ_ASSERT(!hasAlreadyFailed()); + MOZ_ASSERT(errorOffset_ == UINT32_MAX); + MOZ_ASSERT(fmt); + errorOffset_ = offset; + errorString_.reset(JS_vsmprintf(fmt, ap)); + return false; + } + + bool failfOffset(uint32_t offset, const char* fmt, ...) MOZ_FORMAT_PRINTF(3, 4) { + va_list ap; + va_start(ap, fmt); + failfVAOffset(offset, fmt, ap); + va_end(ap); + return false; + } + + bool failf(ParseNode* pn, const char* fmt, ...) MOZ_FORMAT_PRINTF(3, 4) { + va_list ap; + va_start(ap, fmt); + failfVAOffset(pn->pn_pos.begin, fmt, ap); + va_end(ap); + return false; + } + + bool failNameOffset(uint32_t offset, const char* fmt, PropertyName* name) { + // This function is invoked without the caller properly rooting its locals. + gc::AutoSuppressGC suppress(cx_); + JSAutoByteString bytes; + if (AtomToPrintableString(cx_, name, &bytes)) + failfOffset(offset, fmt, bytes.ptr()); + return false; + } + + bool failName(ParseNode* pn, const char* fmt, PropertyName* name) { + return failNameOffset(pn->pn_pos.begin, fmt, name); + } + + bool failOverRecursed() { + errorOverRecursed_ = true; + return false; + } + + unsigned numArrayViews() const { + return arrayViews_.length(); + } + const ArrayView& arrayView(unsigned i) const { + return arrayViews_[i]; + } + unsigned numFunctions() const { + return functions_.length(); + } + Func& function(unsigned i) const { + return *functions_[i]; + } + unsigned numFuncPtrTables() const { + return funcPtrTables_.length(); + } + FuncPtrTable& funcPtrTable(unsigned i) const { + return *funcPtrTables_[i]; + } + + const Global* lookupGlobal(PropertyName* name) const { + if (GlobalMap::Ptr p = globalMap_.lookup(name)) + return p->value(); + return nullptr; + } + + Func* lookupFunction(PropertyName* name) { + if (GlobalMap::Ptr p = globalMap_.lookup(name)) { + Global* value = p->value(); + if (value->which() == Global::Function) { + MOZ_ASSERT(value->funcIndex() >= AsmJSFirstDefFuncIndex); + return functions_[value->funcIndex() - AsmJSFirstDefFuncIndex]; + } + } + return nullptr; + } + + bool lookupStandardLibraryMathName(PropertyName* name, MathBuiltin* mathBuiltin) const { + if (MathNameMap::Ptr p = standardLibraryMathNames_.lookup(name)) { + *mathBuiltin = p->value(); + return true; + } + return false; + } + bool lookupStandardLibraryAtomicsName(PropertyName* name, AsmJSAtomicsBuiltinFunction* atomicsBuiltin) const { + if (AtomicsNameMap::Ptr p = standardLibraryAtomicsNames_.lookup(name)) { + *atomicsBuiltin = p->value(); + return true; + } + return false; + } + bool lookupStandardSimdOpName(PropertyName* name, SimdOperation* op) const { + if (SimdOperationNameMap::Ptr p = standardLibrarySimdOpNames_.lookup(name)) { + *op = p->value(); + return true; + } + return false; + } + + bool startFunctionBodies() { + return mg_.startFuncDefs(); + } + bool finishFunctionBodies() { + return mg_.finishFuncDefs(); + } + SharedModule finish() { + if (!arrayViews_.empty()) + mg_.initMemoryUsage(atomicsPresent_ ? MemoryUsage::Shared : MemoryUsage::Unshared); + + asmJSMetadata_->usesSimd = simdPresent_; + + MOZ_ASSERT(asmJSMetadata_->asmJSFuncNames.empty()); + for (const Func* func : functions_) { + CacheableChars funcName = StringToNewUTF8CharsZ(cx_, *func->name()); + if (!funcName || !asmJSMetadata_->asmJSFuncNames.emplaceBack(Move(funcName))) + return nullptr; + } + + uint32_t endBeforeCurly = tokenStream().currentToken().pos.end; + asmJSMetadata_->srcLength = endBeforeCurly - asmJSMetadata_->srcStart; + + TokenPos pos; + JS_ALWAYS_TRUE(tokenStream().peekTokenPos(&pos, TokenStream::Operand)); + uint32_t endAfterCurly = pos.end; + asmJSMetadata_->srcLengthWithRightBrace = endAfterCurly - asmJSMetadata_->srcStart; + + // asm.js does not have any wasm bytecode to save; view-source is + // provided through the ScriptSource. + SharedBytes bytes = js_new<ShareableBytes>(); + if (!bytes) + return nullptr; + + return mg_.finish(*bytes); + } +}; + +/*****************************************************************************/ +// Numeric literal utilities + +static bool +IsNumericNonFloatLiteral(ParseNode* pn) +{ + // Note: '-' is never rolled into the number; numbers are always positive + // and negations must be applied manually. + return pn->isKind(PNK_NUMBER) || + (pn->isKind(PNK_NEG) && UnaryKid(pn)->isKind(PNK_NUMBER)); +} + +static bool +IsCallToGlobal(ModuleValidator& m, ParseNode* pn, const ModuleValidator::Global** global) +{ + if (!pn->isKind(PNK_CALL)) + return false; + + ParseNode* callee = CallCallee(pn); + if (!callee->isKind(PNK_NAME)) + return false; + + *global = m.lookupGlobal(callee->name()); + return !!*global; +} + +static bool +IsCoercionCall(ModuleValidator& m, ParseNode* pn, Type* coerceTo, ParseNode** coercedExpr) +{ + const ModuleValidator::Global* global; + if (!IsCallToGlobal(m, pn, &global)) + return false; + + if (CallArgListLength(pn) != 1) + return false; + + if (coercedExpr) + *coercedExpr = CallArgList(pn); + + if (global->isMathFunction() && global->mathBuiltinFunction() == AsmJSMathBuiltin_fround) { + *coerceTo = Type::Float; + return true; + } + + if (global->isSimdOperation() && global->simdOperation() == SimdOperation::Fn_check) { + *coerceTo = global->simdOperationType(); + return true; + } + + return false; +} + +static bool +IsFloatLiteral(ModuleValidator& m, ParseNode* pn) +{ + ParseNode* coercedExpr; + Type coerceTo; + if (!IsCoercionCall(m, pn, &coerceTo, &coercedExpr)) + return false; + // Don't fold into || to avoid clang/memcheck bug (bug 1077031). + if (!coerceTo.isFloat()) + return false; + return IsNumericNonFloatLiteral(coercedExpr); +} + +static bool +IsSimdTuple(ModuleValidator& m, ParseNode* pn, SimdType* type) +{ + const ModuleValidator::Global* global; + if (!IsCallToGlobal(m, pn, &global)) + return false; + + if (!global->isSimdCtor()) + return false; + + if (CallArgListLength(pn) != GetSimdLanes(global->simdCtorType())) + return false; + + *type = global->simdCtorType(); + return true; +} + +static bool +IsNumericLiteral(ModuleValidator& m, ParseNode* pn, bool* isSimd = nullptr); + +static NumLit +ExtractNumericLiteral(ModuleValidator& m, ParseNode* pn); + +static inline bool +IsLiteralInt(ModuleValidator& m, ParseNode* pn, uint32_t* u32); + +static bool +IsSimdLiteral(ModuleValidator& m, ParseNode* pn) +{ + SimdType type; + if (!IsSimdTuple(m, pn, &type)) + return false; + + ParseNode* arg = CallArgList(pn); + unsigned length = GetSimdLanes(type); + for (unsigned i = 0; i < length; i++) { + if (!IsNumericLiteral(m, arg)) + return false; + + uint32_t _; + switch (type) { + case SimdType::Int8x16: + case SimdType::Int16x8: + case SimdType::Int32x4: + case SimdType::Uint8x16: + case SimdType::Uint16x8: + case SimdType::Uint32x4: + case SimdType::Bool8x16: + case SimdType::Bool16x8: + case SimdType::Bool32x4: + if (!IsLiteralInt(m, arg, &_)) + return false; + break; + case SimdType::Float32x4: + if (!IsNumericNonFloatLiteral(arg)) + return false; + break; + default: + MOZ_CRASH("unhandled simd type"); + } + + arg = NextNode(arg); + } + + MOZ_ASSERT(arg == nullptr); + return true; +} + +static bool +IsNumericLiteral(ModuleValidator& m, ParseNode* pn, bool* isSimd) +{ + if (IsNumericNonFloatLiteral(pn) || IsFloatLiteral(m, pn)) + return true; + if (IsSimdLiteral(m, pn)) { + if (isSimd) + *isSimd = true; + return true; + } + return false; +} + +// The JS grammar treats -42 as -(42) (i.e., with separate grammar +// productions) for the unary - and literal 42). However, the asm.js spec +// recognizes -42 (modulo parens, so -(42) and -((42))) as a single literal +// so fold the two potential parse nodes into a single double value. +static double +ExtractNumericNonFloatValue(ParseNode* pn, ParseNode** out = nullptr) +{ + MOZ_ASSERT(IsNumericNonFloatLiteral(pn)); + + if (pn->isKind(PNK_NEG)) { + pn = UnaryKid(pn); + if (out) + *out = pn; + return -NumberNodeValue(pn); + } + + return NumberNodeValue(pn); +} + +static NumLit +ExtractSimdValue(ModuleValidator& m, ParseNode* pn) +{ + MOZ_ASSERT(IsSimdLiteral(m, pn)); + + SimdType type = SimdType::Count; + JS_ALWAYS_TRUE(IsSimdTuple(m, pn, &type)); + MOZ_ASSERT(CallArgListLength(pn) == GetSimdLanes(type)); + + ParseNode* arg = CallArgList(pn); + switch (type) { + case SimdType::Int8x16: + case SimdType::Uint8x16: { + MOZ_ASSERT(GetSimdLanes(type) == 16); + int8_t val[16]; + for (size_t i = 0; i < 16; i++, arg = NextNode(arg)) { + uint32_t u32; + JS_ALWAYS_TRUE(IsLiteralInt(m, arg, &u32)); + val[i] = int8_t(u32); + } + MOZ_ASSERT(arg == nullptr); + NumLit::Which w = type == SimdType::Uint8x16 ? NumLit::Uint8x16 : NumLit::Int8x16; + return NumLit(w, SimdConstant::CreateX16(val)); + } + case SimdType::Int16x8: + case SimdType::Uint16x8: { + MOZ_ASSERT(GetSimdLanes(type) == 8); + int16_t val[8]; + for (size_t i = 0; i < 8; i++, arg = NextNode(arg)) { + uint32_t u32; + JS_ALWAYS_TRUE(IsLiteralInt(m, arg, &u32)); + val[i] = int16_t(u32); + } + MOZ_ASSERT(arg == nullptr); + NumLit::Which w = type == SimdType::Uint16x8 ? NumLit::Uint16x8 : NumLit::Int16x8; + return NumLit(w, SimdConstant::CreateX8(val)); + } + case SimdType::Int32x4: + case SimdType::Uint32x4: { + MOZ_ASSERT(GetSimdLanes(type) == 4); + int32_t val[4]; + for (size_t i = 0; i < 4; i++, arg = NextNode(arg)) { + uint32_t u32; + JS_ALWAYS_TRUE(IsLiteralInt(m, arg, &u32)); + val[i] = int32_t(u32); + } + MOZ_ASSERT(arg == nullptr); + NumLit::Which w = type == SimdType::Uint32x4 ? NumLit::Uint32x4 : NumLit::Int32x4; + return NumLit(w, SimdConstant::CreateX4(val)); + } + case SimdType::Float32x4: { + MOZ_ASSERT(GetSimdLanes(type) == 4); + float val[4]; + for (size_t i = 0; i < 4; i++, arg = NextNode(arg)) + val[i] = float(ExtractNumericNonFloatValue(arg)); + MOZ_ASSERT(arg == nullptr); + return NumLit(NumLit::Float32x4, SimdConstant::CreateX4(val)); + } + case SimdType::Bool8x16: { + MOZ_ASSERT(GetSimdLanes(type) == 16); + int8_t val[16]; + for (size_t i = 0; i < 16; i++, arg = NextNode(arg)) { + uint32_t u32; + JS_ALWAYS_TRUE(IsLiteralInt(m, arg, &u32)); + val[i] = u32 ? -1 : 0; + } + MOZ_ASSERT(arg == nullptr); + return NumLit(NumLit::Bool8x16, SimdConstant::CreateX16(val)); + } + case SimdType::Bool16x8: { + MOZ_ASSERT(GetSimdLanes(type) == 8); + int16_t val[8]; + for (size_t i = 0; i < 8; i++, arg = NextNode(arg)) { + uint32_t u32; + JS_ALWAYS_TRUE(IsLiteralInt(m, arg, &u32)); + val[i] = u32 ? -1 : 0; + } + MOZ_ASSERT(arg == nullptr); + return NumLit(NumLit::Bool16x8, SimdConstant::CreateX8(val)); + } + case SimdType::Bool32x4: { + MOZ_ASSERT(GetSimdLanes(type) == 4); + int32_t val[4]; + for (size_t i = 0; i < 4; i++, arg = NextNode(arg)) { + uint32_t u32; + JS_ALWAYS_TRUE(IsLiteralInt(m, arg, &u32)); + val[i] = u32 ? -1 : 0; + } + MOZ_ASSERT(arg == nullptr); + return NumLit(NumLit::Bool32x4, SimdConstant::CreateX4(val)); + } + default: + break; + } + + MOZ_CRASH("Unexpected SIMD type."); +} + +static NumLit +ExtractNumericLiteral(ModuleValidator& m, ParseNode* pn) +{ + MOZ_ASSERT(IsNumericLiteral(m, pn)); + + if (pn->isKind(PNK_CALL)) { + // Float literals are explicitly coerced and thus the coerced literal may be + // any valid (non-float) numeric literal. + if (CallArgListLength(pn) == 1) { + pn = CallArgList(pn); + double d = ExtractNumericNonFloatValue(pn); + return NumLit(NumLit::Float, DoubleValue(d)); + } + + return ExtractSimdValue(m, pn); + } + + double d = ExtractNumericNonFloatValue(pn, &pn); + + // The asm.js spec syntactically distinguishes any literal containing a + // decimal point or the literal -0 as having double type. + if (NumberNodeHasFrac(pn) || IsNegativeZero(d)) + return NumLit(NumLit::Double, DoubleValue(d)); + + // The syntactic checks above rule out these double values. + MOZ_ASSERT(!IsNegativeZero(d)); + MOZ_ASSERT(!IsNaN(d)); + + // Although doubles can only *precisely* represent 53-bit integers, they + // can *imprecisely* represent integers much bigger than an int64_t. + // Furthermore, d may be inf or -inf. In both cases, casting to an int64_t + // is undefined, so test against the integer bounds using doubles. + if (d < double(INT32_MIN) || d > double(UINT32_MAX)) + return NumLit(NumLit::OutOfRangeInt, UndefinedValue()); + + // With the above syntactic and range limitations, d is definitely an + // integer in the range [INT32_MIN, UINT32_MAX] range. + int64_t i64 = int64_t(d); + if (i64 >= 0) { + if (i64 <= INT32_MAX) + return NumLit(NumLit::Fixnum, Int32Value(i64)); + MOZ_ASSERT(i64 <= UINT32_MAX); + return NumLit(NumLit::BigUnsigned, Int32Value(uint32_t(i64))); + } + MOZ_ASSERT(i64 >= INT32_MIN); + return NumLit(NumLit::NegativeInt, Int32Value(i64)); +} + +static inline bool +IsLiteralInt(const NumLit& lit, uint32_t* u32) +{ + switch (lit.which()) { + case NumLit::Fixnum: + case NumLit::BigUnsigned: + case NumLit::NegativeInt: + *u32 = lit.toUint32(); + return true; + case NumLit::Double: + case NumLit::Float: + case NumLit::OutOfRangeInt: + case NumLit::Int8x16: + case NumLit::Uint8x16: + case NumLit::Int16x8: + case NumLit::Uint16x8: + case NumLit::Int32x4: + case NumLit::Uint32x4: + case NumLit::Float32x4: + case NumLit::Bool8x16: + case NumLit::Bool16x8: + case NumLit::Bool32x4: + return false; + } + MOZ_MAKE_COMPILER_ASSUME_IS_UNREACHABLE("Bad literal type"); +} + +static inline bool +IsLiteralInt(ModuleValidator& m, ParseNode* pn, uint32_t* u32) +{ + return IsNumericLiteral(m, pn) && + IsLiteralInt(ExtractNumericLiteral(m, pn), u32); +} + +/*****************************************************************************/ + +namespace { + +#define CASE(TYPE, OP) case SimdOperation::Fn_##OP: return Op::TYPE##OP; +#define I8x16CASE(OP) CASE(I8x16, OP) +#define I16x8CASE(OP) CASE(I16x8, OP) +#define I32x4CASE(OP) CASE(I32x4, OP) +#define F32x4CASE(OP) CASE(F32x4, OP) +#define B8x16CASE(OP) CASE(B8x16, OP) +#define B16x8CASE(OP) CASE(B16x8, OP) +#define B32x4CASE(OP) CASE(B32x4, OP) +#define ENUMERATE(TYPE, FOR_ALL, DO) \ + switch(op) { \ + case SimdOperation::Constructor: return Op::TYPE##Constructor; \ + FOR_ALL(DO) \ + default: break; \ + } + +static inline Op +SimdToOp(SimdType type, SimdOperation op) +{ + switch (type) { + case SimdType::Uint8x16: + // Handle the special unsigned opcodes, then fall through to Int8x16. + switch (op) { + case SimdOperation::Fn_addSaturate: return Op::I8x16addSaturateU; + case SimdOperation::Fn_subSaturate: return Op::I8x16subSaturateU; + case SimdOperation::Fn_extractLane: return Op::I8x16extractLaneU; + case SimdOperation::Fn_shiftRightByScalar: return Op::I8x16shiftRightByScalarU; + case SimdOperation::Fn_lessThan: return Op::I8x16lessThanU; + case SimdOperation::Fn_lessThanOrEqual: return Op::I8x16lessThanOrEqualU; + case SimdOperation::Fn_greaterThan: return Op::I8x16greaterThanU; + case SimdOperation::Fn_greaterThanOrEqual: return Op::I8x16greaterThanOrEqualU; + case SimdOperation::Fn_fromInt8x16Bits: return Op::Limit; + default: break; + } + MOZ_FALLTHROUGH; + case SimdType::Int8x16: + // Bitcasts Uint8x16 <--> Int8x16 become noops. + switch (op) { + case SimdOperation::Fn_fromUint8x16Bits: return Op::Limit; + case SimdOperation::Fn_fromUint16x8Bits: return Op::I8x16fromInt16x8Bits; + case SimdOperation::Fn_fromUint32x4Bits: return Op::I8x16fromInt32x4Bits; + default: break; + } + ENUMERATE(I8x16, FORALL_INT8X16_ASMJS_OP, I8x16CASE) + break; + + case SimdType::Uint16x8: + // Handle the special unsigned opcodes, then fall through to Int16x8. + switch(op) { + case SimdOperation::Fn_addSaturate: return Op::I16x8addSaturateU; + case SimdOperation::Fn_subSaturate: return Op::I16x8subSaturateU; + case SimdOperation::Fn_extractLane: return Op::I16x8extractLaneU; + case SimdOperation::Fn_shiftRightByScalar: return Op::I16x8shiftRightByScalarU; + case SimdOperation::Fn_lessThan: return Op::I16x8lessThanU; + case SimdOperation::Fn_lessThanOrEqual: return Op::I16x8lessThanOrEqualU; + case SimdOperation::Fn_greaterThan: return Op::I16x8greaterThanU; + case SimdOperation::Fn_greaterThanOrEqual: return Op::I16x8greaterThanOrEqualU; + case SimdOperation::Fn_fromInt16x8Bits: return Op::Limit; + default: break; + } + MOZ_FALLTHROUGH; + case SimdType::Int16x8: + // Bitcasts Uint16x8 <--> Int16x8 become noops. + switch (op) { + case SimdOperation::Fn_fromUint8x16Bits: return Op::I16x8fromInt8x16Bits; + case SimdOperation::Fn_fromUint16x8Bits: return Op::Limit; + case SimdOperation::Fn_fromUint32x4Bits: return Op::I16x8fromInt32x4Bits; + default: break; + } + ENUMERATE(I16x8, FORALL_INT16X8_ASMJS_OP, I16x8CASE) + break; + + case SimdType::Uint32x4: + // Handle the special unsigned opcodes, then fall through to Int32x4. + switch(op) { + case SimdOperation::Fn_shiftRightByScalar: return Op::I32x4shiftRightByScalarU; + case SimdOperation::Fn_lessThan: return Op::I32x4lessThanU; + case SimdOperation::Fn_lessThanOrEqual: return Op::I32x4lessThanOrEqualU; + case SimdOperation::Fn_greaterThan: return Op::I32x4greaterThanU; + case SimdOperation::Fn_greaterThanOrEqual: return Op::I32x4greaterThanOrEqualU; + case SimdOperation::Fn_fromFloat32x4: return Op::I32x4fromFloat32x4U; + case SimdOperation::Fn_fromInt32x4Bits: return Op::Limit; + default: break; + } + MOZ_FALLTHROUGH; + case SimdType::Int32x4: + // Bitcasts Uint32x4 <--> Int32x4 become noops. + switch (op) { + case SimdOperation::Fn_fromUint8x16Bits: return Op::I32x4fromInt8x16Bits; + case SimdOperation::Fn_fromUint16x8Bits: return Op::I32x4fromInt16x8Bits; + case SimdOperation::Fn_fromUint32x4Bits: return Op::Limit; + default: break; + } + ENUMERATE(I32x4, FORALL_INT32X4_ASMJS_OP, I32x4CASE) + break; + + case SimdType::Float32x4: + switch (op) { + case SimdOperation::Fn_fromUint8x16Bits: return Op::F32x4fromInt8x16Bits; + case SimdOperation::Fn_fromUint16x8Bits: return Op::F32x4fromInt16x8Bits; + case SimdOperation::Fn_fromUint32x4Bits: return Op::F32x4fromInt32x4Bits; + default: break; + } + ENUMERATE(F32x4, FORALL_FLOAT32X4_ASMJS_OP, F32x4CASE) + break; + + case SimdType::Bool8x16: + ENUMERATE(B8x16, FORALL_BOOL_SIMD_OP, B8x16CASE) + break; + + case SimdType::Bool16x8: + ENUMERATE(B16x8, FORALL_BOOL_SIMD_OP, B16x8CASE) + break; + + case SimdType::Bool32x4: + ENUMERATE(B32x4, FORALL_BOOL_SIMD_OP, B32x4CASE) + break; + + default: break; + } + MOZ_CRASH("unexpected SIMD (type, operator) combination"); +} + +#undef CASE +#undef I8x16CASE +#undef I16x8CASE +#undef I32x4CASE +#undef F32x4CASE +#undef B8x16CASE +#undef B16x8CASE +#undef B32x4CASE +#undef ENUMERATE + +typedef Vector<PropertyName*, 4, SystemAllocPolicy> NameVector; + +// Encapsulates the building of an asm bytecode function from an asm.js function +// source code, packing the asm.js code into the asm bytecode form that can +// be decoded and compiled with a FunctionCompiler. +class MOZ_STACK_CLASS FunctionValidator +{ + public: + struct Local + { + Type type; + unsigned slot; + Local(Type t, unsigned slot) : type(t), slot(slot) { + MOZ_ASSERT(type.isCanonicalValType()); + } + }; + + private: + typedef HashMap<PropertyName*, Local> LocalMap; + typedef HashMap<PropertyName*, uint32_t> LabelMap; + + ModuleValidator& m_; + ParseNode* fn_; + + FunctionGenerator fg_; + Maybe<Encoder> encoder_; + + LocalMap locals_; + + // Labels + LabelMap breakLabels_; + LabelMap continueLabels_; + Uint32Vector breakableStack_; + Uint32Vector continuableStack_; + uint32_t blockDepth_; + + bool hasAlreadyReturned_; + ExprType ret_; + + public: + FunctionValidator(ModuleValidator& m, ParseNode* fn) + : m_(m), + fn_(fn), + locals_(m.cx()), + breakLabels_(m.cx()), + continueLabels_(m.cx()), + blockDepth_(0), + hasAlreadyReturned_(false), + ret_(ExprType::Limit) + {} + + ModuleValidator& m() const { return m_; } + ExclusiveContext* cx() const { return m_.cx(); } + ParseNode* fn() const { return fn_; } + + bool init(PropertyName* name, unsigned line) { + if (!locals_.init() || !breakLabels_.init() || !continueLabels_.init()) + return false; + + if (!m_.mg().startFuncDef(line, &fg_)) + return false; + + encoder_.emplace(fg_.bytes()); + return true; + } + + bool finish(uint32_t funcIndex) { + MOZ_ASSERT(!blockDepth_); + MOZ_ASSERT(breakableStack_.empty()); + MOZ_ASSERT(continuableStack_.empty()); + MOZ_ASSERT(breakLabels_.empty()); + MOZ_ASSERT(continueLabels_.empty()); + for (auto iter = locals_.all(); !iter.empty(); iter.popFront()) { + if (iter.front().value().type.isSimd()) { + setUsesSimd(); + break; + } + } + + return m_.mg().finishFuncDef(funcIndex, &fg_); + } + + bool fail(ParseNode* pn, const char* str) { + return m_.fail(pn, str); + } + + bool failf(ParseNode* pn, const char* fmt, ...) MOZ_FORMAT_PRINTF(3, 4) { + va_list ap; + va_start(ap, fmt); + m_.failfVAOffset(pn->pn_pos.begin, fmt, ap); + va_end(ap); + return false; + } + + bool failName(ParseNode* pn, const char* fmt, PropertyName* name) { + return m_.failName(pn, fmt, name); + } + + /***************************************************** Attributes */ + + void setUsesSimd() { + fg_.setUsesSimd(); + } + + void setUsesAtomics() { + fg_.setUsesAtomics(); + } + + /***************************************************** Local scope setup */ + + bool addLocal(ParseNode* pn, PropertyName* name, Type type) { + LocalMap::AddPtr p = locals_.lookupForAdd(name); + if (p) + return failName(pn, "duplicate local name '%s' not allowed", name); + return locals_.add(p, name, Local(type, locals_.count())); + } + + /****************************** For consistency of returns in a function */ + + bool hasAlreadyReturned() const { + return hasAlreadyReturned_; + } + + ExprType returnedType() const { + return ret_; + } + + void setReturnedType(ExprType ret) { + ret_ = ret; + hasAlreadyReturned_ = true; + } + + /**************************************************************** Labels */ + private: + bool writeBr(uint32_t absolute, Op op = Op::Br) { + MOZ_ASSERT(op == Op::Br || op == Op::BrIf); + MOZ_ASSERT(absolute < blockDepth_); + return encoder().writeOp(op) && + encoder().writeVarU32(blockDepth_ - 1 - absolute); + } + void removeLabel(PropertyName* label, LabelMap* map) { + LabelMap::Ptr p = map->lookup(label); + MOZ_ASSERT(p); + map->remove(p); + } + + public: + bool pushBreakableBlock() { + return encoder().writeOp(Op::Block) && + encoder().writeFixedU8(uint8_t(ExprType::Void)) && + breakableStack_.append(blockDepth_++); + } + bool popBreakableBlock() { + JS_ALWAYS_TRUE(breakableStack_.popCopy() == --blockDepth_); + return encoder().writeOp(Op::End); + } + + bool pushUnbreakableBlock(const NameVector* labels = nullptr) { + if (labels) { + for (PropertyName* label : *labels) { + if (!breakLabels_.putNew(label, blockDepth_)) + return false; + } + } + blockDepth_++; + return encoder().writeOp(Op::Block) && + encoder().writeFixedU8(uint8_t(ExprType::Void)); + } + bool popUnbreakableBlock(const NameVector* labels = nullptr) { + if (labels) { + for (PropertyName* label : *labels) + removeLabel(label, &breakLabels_); + } + --blockDepth_; + return encoder().writeOp(Op::End); + } + + bool pushContinuableBlock() { + return encoder().writeOp(Op::Block) && + encoder().writeFixedU8(uint8_t(ExprType::Void)) && + continuableStack_.append(blockDepth_++); + } + bool popContinuableBlock() { + JS_ALWAYS_TRUE(continuableStack_.popCopy() == --blockDepth_); + return encoder().writeOp(Op::End); + } + + bool pushLoop() { + return encoder().writeOp(Op::Block) && + encoder().writeFixedU8(uint8_t(ExprType::Void)) && + encoder().writeOp(Op::Loop) && + encoder().writeFixedU8(uint8_t(ExprType::Void)) && + breakableStack_.append(blockDepth_++) && + continuableStack_.append(blockDepth_++); + } + bool popLoop() { + JS_ALWAYS_TRUE(continuableStack_.popCopy() == --blockDepth_); + JS_ALWAYS_TRUE(breakableStack_.popCopy() == --blockDepth_); + return encoder().writeOp(Op::End) && + encoder().writeOp(Op::End); + } + + bool pushIf(size_t* typeAt) { + ++blockDepth_; + return encoder().writeOp(Op::If) && + encoder().writePatchableFixedU7(typeAt); + } + bool switchToElse() { + MOZ_ASSERT(blockDepth_ > 0); + return encoder().writeOp(Op::Else); + } + void setIfType(size_t typeAt, ExprType type) { + encoder().patchFixedU7(typeAt, uint8_t(type)); + } + bool popIf() { + MOZ_ASSERT(blockDepth_ > 0); + --blockDepth_; + return encoder().writeOp(Op::End); + } + bool popIf(size_t typeAt, ExprType type) { + MOZ_ASSERT(blockDepth_ > 0); + --blockDepth_; + if (!encoder().writeOp(Op::End)) + return false; + + setIfType(typeAt, type); + return true; + } + + bool writeBreakIf() { + return writeBr(breakableStack_.back(), Op::BrIf); + } + bool writeContinueIf() { + return writeBr(continuableStack_.back(), Op::BrIf); + } + bool writeUnlabeledBreakOrContinue(bool isBreak) { + return writeBr(isBreak? breakableStack_.back() : continuableStack_.back()); + } + bool writeContinue() { + return writeBr(continuableStack_.back()); + } + + bool addLabels(const NameVector& labels, uint32_t relativeBreakDepth, + uint32_t relativeContinueDepth) + { + for (PropertyName* label : labels) { + if (!breakLabels_.putNew(label, blockDepth_ + relativeBreakDepth)) + return false; + if (!continueLabels_.putNew(label, blockDepth_ + relativeContinueDepth)) + return false; + } + return true; + } + void removeLabels(const NameVector& labels) { + for (PropertyName* label : labels) { + removeLabel(label, &breakLabels_); + removeLabel(label, &continueLabels_); + } + } + bool writeLabeledBreakOrContinue(PropertyName* label, bool isBreak) { + LabelMap& map = isBreak ? breakLabels_ : continueLabels_; + if (LabelMap::Ptr p = map.lookup(label)) + return writeBr(p->value()); + MOZ_CRASH("nonexistent label"); + } + + /*************************************************** Read-only interface */ + + const Local* lookupLocal(PropertyName* name) const { + if (auto p = locals_.lookup(name)) + return &p->value(); + return nullptr; + } + + const ModuleValidator::Global* lookupGlobal(PropertyName* name) const { + if (locals_.has(name)) + return nullptr; + return m_.lookupGlobal(name); + } + + size_t numLocals() const { return locals_.count(); } + + /**************************************************** Encoding interface */ + + Encoder& encoder() { return *encoder_; } + + MOZ_MUST_USE bool writeInt32Lit(int32_t i32) { + return encoder().writeOp(Op::I32Const) && + encoder().writeVarS32(i32); + } + MOZ_MUST_USE bool writeConstExpr(const NumLit& lit) { + switch (lit.which()) { + case NumLit::Fixnum: + case NumLit::NegativeInt: + case NumLit::BigUnsigned: + return writeInt32Lit(lit.toInt32()); + case NumLit::Float: + return encoder().writeOp(Op::F32Const) && + encoder().writeFixedF32(lit.toFloat()); + case NumLit::Double: + return encoder().writeOp(Op::F64Const) && + encoder().writeFixedF64(lit.toDouble()); + case NumLit::Int8x16: + case NumLit::Uint8x16: + return encoder().writeOp(Op::I8x16Const) && + encoder().writeFixedI8x16(lit.simdValue().asInt8x16()); + case NumLit::Int16x8: + case NumLit::Uint16x8: + return encoder().writeOp(Op::I16x8Const) && + encoder().writeFixedI16x8(lit.simdValue().asInt16x8()); + case NumLit::Int32x4: + case NumLit::Uint32x4: + return encoder().writeOp(Op::I32x4Const) && + encoder().writeFixedI32x4(lit.simdValue().asInt32x4()); + case NumLit::Float32x4: + return encoder().writeOp(Op::F32x4Const) && + encoder().writeFixedF32x4(lit.simdValue().asFloat32x4()); + case NumLit::Bool8x16: + // Boolean vectors use the Int8x16 memory representation. + return encoder().writeOp(Op::B8x16Const) && + encoder().writeFixedI8x16(lit.simdValue().asInt8x16()); + case NumLit::Bool16x8: + // Boolean vectors use the Int16x8 memory representation. + return encoder().writeOp(Op::B16x8Const) && + encoder().writeFixedI16x8(lit.simdValue().asInt16x8()); + case NumLit::Bool32x4: + // Boolean vectors use the Int32x4 memory representation. + return encoder().writeOp(Op::B32x4Const) && + encoder().writeFixedI32x4(lit.simdValue().asInt32x4()); + case NumLit::OutOfRangeInt: + break; + } + MOZ_CRASH("unexpected literal type"); + } + MOZ_MUST_USE bool writeCall(ParseNode* pn, Op op) { + return encoder().writeOp(op) && + fg_.addCallSiteLineNum(m().tokenStream().srcCoords.lineNum(pn->pn_pos.begin)); + } + MOZ_MUST_USE bool prepareCall(ParseNode* pn) { + return fg_.addCallSiteLineNum(m().tokenStream().srcCoords.lineNum(pn->pn_pos.begin)); + } + MOZ_MUST_USE bool writeSimdOp(SimdType simdType, SimdOperation simdOp) { + Op op = SimdToOp(simdType, simdOp); + if (op == Op::Limit) + return true; + return encoder().writeOp(op); + } +}; + +} /* anonymous namespace */ + +/*****************************************************************************/ +// asm.js type-checking and code-generation algorithm + +static bool +CheckIdentifier(ModuleValidator& m, ParseNode* usepn, PropertyName* name) +{ + if (name == m.cx()->names().arguments || name == m.cx()->names().eval) + return m.failName(usepn, "'%s' is not an allowed identifier", name); + return true; +} + +static bool +CheckModuleLevelName(ModuleValidator& m, ParseNode* usepn, PropertyName* name) +{ + if (!CheckIdentifier(m, usepn, name)) + return false; + + if (name == m.moduleFunctionName() || + name == m.globalArgumentName() || + name == m.importArgumentName() || + name == m.bufferArgumentName() || + m.lookupGlobal(name)) + { + return m.failName(usepn, "duplicate name '%s' not allowed", name); + } + + return true; +} + +static bool +CheckFunctionHead(ModuleValidator& m, ParseNode* fn) +{ + JSFunction* fun = FunctionObject(fn); + if (fun->hasRest()) + return m.fail(fn, "rest args not allowed"); + if (fun->isExprBody()) + return m.fail(fn, "expression closures not allowed"); + if (fn->pn_funbox->hasDestructuringArgs) + return m.fail(fn, "destructuring args not allowed"); + return true; +} + +static bool +CheckArgument(ModuleValidator& m, ParseNode* arg, PropertyName** name) +{ + *name = nullptr; + + if (!arg->isKind(PNK_NAME)) + return m.fail(arg, "argument is not a plain name"); + + if (!CheckIdentifier(m, arg, arg->name())) + return false; + + *name = arg->name(); + return true; +} + +static bool +CheckModuleArgument(ModuleValidator& m, ParseNode* arg, PropertyName** name) +{ + if (!CheckArgument(m, arg, name)) + return false; + + if (!CheckModuleLevelName(m, arg, *name)) + return false; + + return true; +} + +static bool +CheckModuleArguments(ModuleValidator& m, ParseNode* fn) +{ + unsigned numFormals; + ParseNode* arg1 = FunctionFormalParametersList(fn, &numFormals); + ParseNode* arg2 = arg1 ? NextNode(arg1) : nullptr; + ParseNode* arg3 = arg2 ? NextNode(arg2) : nullptr; + + if (numFormals > 3) + return m.fail(fn, "asm.js modules takes at most 3 argument"); + + PropertyName* arg1Name = nullptr; + if (arg1 && !CheckModuleArgument(m, arg1, &arg1Name)) + return false; + if (!m.initGlobalArgumentName(arg1Name)) + return false; + + PropertyName* arg2Name = nullptr; + if (arg2 && !CheckModuleArgument(m, arg2, &arg2Name)) + return false; + if (!m.initImportArgumentName(arg2Name)) + return false; + + PropertyName* arg3Name = nullptr; + if (arg3 && !CheckModuleArgument(m, arg3, &arg3Name)) + return false; + if (!m.initBufferArgumentName(arg3Name)) + return false; + + return true; +} + +static bool +CheckPrecedingStatements(ModuleValidator& m, ParseNode* stmtList) +{ + MOZ_ASSERT(stmtList->isKind(PNK_STATEMENTLIST)); + + ParseNode* stmt = ListHead(stmtList); + for (unsigned i = 0, n = ListLength(stmtList); i < n; i++) { + if (!IsIgnoredDirective(m.cx(), stmt)) + return m.fail(stmt, "invalid asm.js statement"); + } + + return true; +} + +static bool +CheckGlobalVariableInitConstant(ModuleValidator& m, PropertyName* varName, ParseNode* initNode, + bool isConst) +{ + NumLit lit = ExtractNumericLiteral(m, initNode); + if (!lit.valid()) + return m.fail(initNode, "global initializer is out of representable integer range"); + + Type canonicalType = Type::canonicalize(Type::lit(lit)); + if (!canonicalType.isGlobalVarType()) + return m.fail(initNode, "global variable type not allowed"); + + return m.addGlobalVarInit(varName, lit, canonicalType, isConst); +} + +static bool +CheckTypeAnnotation(ModuleValidator& m, ParseNode* coercionNode, Type* coerceTo, + ParseNode** coercedExpr = nullptr) +{ + switch (coercionNode->getKind()) { + case PNK_BITOR: { + ParseNode* rhs = BitwiseRight(coercionNode); + uint32_t i; + if (!IsLiteralInt(m, rhs, &i) || i != 0) + return m.fail(rhs, "must use |0 for argument/return coercion"); + *coerceTo = Type::Int; + if (coercedExpr) + *coercedExpr = BitwiseLeft(coercionNode); + return true; + } + case PNK_POS: { + *coerceTo = Type::Double; + if (coercedExpr) + *coercedExpr = UnaryKid(coercionNode); + return true; + } + case PNK_CALL: { + if (IsCoercionCall(m, coercionNode, coerceTo, coercedExpr)) + return true; + break; + } + default:; + } + + return m.fail(coercionNode, "must be of the form +x, x|0, fround(x), or a SIMD check(x)"); +} + +static bool +CheckGlobalVariableInitImport(ModuleValidator& m, PropertyName* varName, ParseNode* initNode, + bool isConst) +{ + Type coerceTo; + ParseNode* coercedExpr; + if (!CheckTypeAnnotation(m, initNode, &coerceTo, &coercedExpr)) + return false; + + if (!coercedExpr->isKind(PNK_DOT)) + return m.failName(coercedExpr, "invalid import expression for global '%s'", varName); + + if (!coerceTo.isGlobalVarType()) + return m.fail(initNode, "global variable type not allowed"); + + ParseNode* base = DotBase(coercedExpr); + PropertyName* field = DotMember(coercedExpr); + + PropertyName* importName = m.importArgumentName(); + if (!importName) + return m.fail(coercedExpr, "cannot import without an asm.js foreign parameter"); + if (!IsUseOfName(base, importName)) + return m.failName(coercedExpr, "base of import expression must be '%s'", importName); + + return m.addGlobalVarImport(varName, field, coerceTo, isConst); +} + +static bool +IsArrayViewCtorName(ModuleValidator& m, PropertyName* name, Scalar::Type* type) +{ + JSAtomState& names = m.cx()->names(); + if (name == names.Int8Array) { + *type = Scalar::Int8; + } else if (name == names.Uint8Array) { + *type = Scalar::Uint8; + } else if (name == names.Int16Array) { + *type = Scalar::Int16; + } else if (name == names.Uint16Array) { + *type = Scalar::Uint16; + } else if (name == names.Int32Array) { + *type = Scalar::Int32; + } else if (name == names.Uint32Array) { + *type = Scalar::Uint32; + } else if (name == names.Float32Array) { + *type = Scalar::Float32; + } else if (name == names.Float64Array) { + *type = Scalar::Float64; + } else { + return false; + } + return true; +} + +static bool +CheckNewArrayViewArgs(ModuleValidator& m, ParseNode* ctorExpr, PropertyName* bufferName) +{ + ParseNode* bufArg = NextNode(ctorExpr); + if (!bufArg || NextNode(bufArg) != nullptr) + return m.fail(ctorExpr, "array view constructor takes exactly one argument"); + + if (!IsUseOfName(bufArg, bufferName)) + return m.failName(bufArg, "argument to array view constructor must be '%s'", bufferName); + + return true; +} + +static bool +CheckNewArrayView(ModuleValidator& m, PropertyName* varName, ParseNode* newExpr) +{ + PropertyName* globalName = m.globalArgumentName(); + if (!globalName) + return m.fail(newExpr, "cannot create array view without an asm.js global parameter"); + + PropertyName* bufferName = m.bufferArgumentName(); + if (!bufferName) + return m.fail(newExpr, "cannot create array view without an asm.js heap parameter"); + + ParseNode* ctorExpr = ListHead(newExpr); + + PropertyName* field; + Scalar::Type type; + if (ctorExpr->isKind(PNK_DOT)) { + ParseNode* base = DotBase(ctorExpr); + + if (!IsUseOfName(base, globalName)) + return m.failName(base, "expecting '%s.*Array", globalName); + + field = DotMember(ctorExpr); + if (!IsArrayViewCtorName(m, field, &type)) + return m.fail(ctorExpr, "could not match typed array name"); + } else { + if (!ctorExpr->isKind(PNK_NAME)) + return m.fail(ctorExpr, "expecting name of imported array view constructor"); + + PropertyName* globalName = ctorExpr->name(); + const ModuleValidator::Global* global = m.lookupGlobal(globalName); + if (!global) + return m.failName(ctorExpr, "%s not found in module global scope", globalName); + + if (global->which() != ModuleValidator::Global::ArrayViewCtor) + return m.failName(ctorExpr, "%s must be an imported array view constructor", globalName); + + field = nullptr; + type = global->viewType(); + } + + if (!CheckNewArrayViewArgs(m, ctorExpr, bufferName)) + return false; + + return m.addArrayView(varName, type, field); +} + +static bool +IsSimdValidOperationType(SimdType type, SimdOperation op) +{ +#define CASE(op) case SimdOperation::Fn_##op: + switch(type) { + case SimdType::Int8x16: + switch (op) { + case SimdOperation::Constructor: + case SimdOperation::Fn_fromUint8x16Bits: + case SimdOperation::Fn_fromUint16x8Bits: + case SimdOperation::Fn_fromUint32x4Bits: + FORALL_INT8X16_ASMJS_OP(CASE) return true; + default: return false; + } + break; + case SimdType::Int16x8: + switch (op) { + case SimdOperation::Constructor: + case SimdOperation::Fn_fromUint8x16Bits: + case SimdOperation::Fn_fromUint16x8Bits: + case SimdOperation::Fn_fromUint32x4Bits: + FORALL_INT16X8_ASMJS_OP(CASE) return true; + default: return false; + } + break; + case SimdType::Int32x4: + switch (op) { + case SimdOperation::Constructor: + case SimdOperation::Fn_fromUint8x16Bits: + case SimdOperation::Fn_fromUint16x8Bits: + case SimdOperation::Fn_fromUint32x4Bits: + FORALL_INT32X4_ASMJS_OP(CASE) return true; + default: return false; + } + break; + case SimdType::Uint8x16: + switch (op) { + case SimdOperation::Constructor: + case SimdOperation::Fn_fromInt8x16Bits: + case SimdOperation::Fn_fromUint16x8Bits: + case SimdOperation::Fn_fromUint32x4Bits: + FORALL_INT8X16_ASMJS_OP(CASE) return true; + default: return false; + } + break; + case SimdType::Uint16x8: + switch (op) { + case SimdOperation::Constructor: + case SimdOperation::Fn_fromUint8x16Bits: + case SimdOperation::Fn_fromInt16x8Bits: + case SimdOperation::Fn_fromUint32x4Bits: + FORALL_INT16X8_ASMJS_OP(CASE) return true; + default: return false; + } + break; + case SimdType::Uint32x4: + switch (op) { + case SimdOperation::Constructor: + case SimdOperation::Fn_fromUint8x16Bits: + case SimdOperation::Fn_fromUint16x8Bits: + case SimdOperation::Fn_fromInt32x4Bits: + FORALL_INT32X4_ASMJS_OP(CASE) return true; + default: return false; + } + break; + case SimdType::Float32x4: + switch (op) { + case SimdOperation::Constructor: + case SimdOperation::Fn_fromUint8x16Bits: + case SimdOperation::Fn_fromUint16x8Bits: + case SimdOperation::Fn_fromUint32x4Bits: + FORALL_FLOAT32X4_ASMJS_OP(CASE) return true; + default: return false; + } + break; + case SimdType::Bool8x16: + case SimdType::Bool16x8: + case SimdType::Bool32x4: + switch (op) { + case SimdOperation::Constructor: + FORALL_BOOL_SIMD_OP(CASE) return true; + default: return false; + } + break; + default: + // Unimplemented SIMD type. + return false; + } +#undef CASE +} + +static bool +CheckGlobalMathImport(ModuleValidator& m, ParseNode* initNode, PropertyName* varName, + PropertyName* field) +{ + // Math builtin, with the form glob.Math.[[builtin]] + ModuleValidator::MathBuiltin mathBuiltin; + if (!m.lookupStandardLibraryMathName(field, &mathBuiltin)) + return m.failName(initNode, "'%s' is not a standard Math builtin", field); + + switch (mathBuiltin.kind) { + case ModuleValidator::MathBuiltin::Function: + return m.addMathBuiltinFunction(varName, mathBuiltin.u.func, field); + case ModuleValidator::MathBuiltin::Constant: + return m.addMathBuiltinConstant(varName, mathBuiltin.u.cst, field); + default: + break; + } + MOZ_CRASH("unexpected or uninitialized math builtin type"); +} + +static bool +CheckGlobalAtomicsImport(ModuleValidator& m, ParseNode* initNode, PropertyName* varName, + PropertyName* field) +{ + // Atomics builtin, with the form glob.Atomics.[[builtin]] + AsmJSAtomicsBuiltinFunction func; + if (!m.lookupStandardLibraryAtomicsName(field, &func)) + return m.failName(initNode, "'%s' is not a standard Atomics builtin", field); + + return m.addAtomicsBuiltinFunction(varName, func, field); +} + +static bool +CheckGlobalSimdImport(ModuleValidator& m, ParseNode* initNode, PropertyName* varName, + PropertyName* field) +{ + if (!m.supportsSimd()) + return m.fail(initNode, "SIMD is not supported on this platform"); + + // SIMD constructor, with the form glob.SIMD.[[type]] + SimdType simdType; + if (!IsSimdTypeName(m.cx()->names(), field, &simdType)) + return m.failName(initNode, "'%s' is not a standard SIMD type", field); + + // IsSimdTypeName will return true for any SIMD type supported by the VM. + // + // Since we may not support all of those SIMD types in asm.js, use the + // asm.js-specific IsSimdValidOperationType() to check if this specific + // constructor is supported in asm.js. + if (!IsSimdValidOperationType(simdType, SimdOperation::Constructor)) + return m.failName(initNode, "'%s' is not a supported SIMD type", field); + + return m.addSimdCtor(varName, simdType, field); +} + +static bool +CheckGlobalSimdOperationImport(ModuleValidator& m, const ModuleValidator::Global* global, + ParseNode* initNode, PropertyName* varName, PropertyName* opName) +{ + SimdType simdType = global->simdCtorType(); + SimdOperation simdOp; + if (!m.lookupStandardSimdOpName(opName, &simdOp)) + return m.failName(initNode, "'%s' is not a standard SIMD operation", opName); + if (!IsSimdValidOperationType(simdType, simdOp)) + return m.failName(initNode, "'%s' is not an operation supported by the SIMD type", opName); + return m.addSimdOperation(varName, simdType, simdOp, opName); +} + +static bool +CheckGlobalDotImport(ModuleValidator& m, PropertyName* varName, ParseNode* initNode) +{ + ParseNode* base = DotBase(initNode); + PropertyName* field = DotMember(initNode); + + if (base->isKind(PNK_DOT)) { + ParseNode* global = DotBase(base); + PropertyName* mathOrAtomicsOrSimd = DotMember(base); + + PropertyName* globalName = m.globalArgumentName(); + if (!globalName) + return m.fail(base, "import statement requires the module have a stdlib parameter"); + + if (!IsUseOfName(global, globalName)) { + if (global->isKind(PNK_DOT)) { + return m.failName(base, "imports can have at most two dot accesses " + "(e.g. %s.Math.sin)", globalName); + } + return m.failName(base, "expecting %s.*", globalName); + } + + if (mathOrAtomicsOrSimd == m.cx()->names().Math) + return CheckGlobalMathImport(m, initNode, varName, field); + if (mathOrAtomicsOrSimd == m.cx()->names().Atomics) + return CheckGlobalAtomicsImport(m, initNode, varName, field); + if (mathOrAtomicsOrSimd == m.cx()->names().SIMD) + return CheckGlobalSimdImport(m, initNode, varName, field); + return m.failName(base, "expecting %s.{Math|SIMD}", globalName); + } + + if (!base->isKind(PNK_NAME)) + return m.fail(base, "expected name of variable or parameter"); + + if (base->name() == m.globalArgumentName()) { + if (field == m.cx()->names().NaN) + return m.addGlobalConstant(varName, GenericNaN(), field); + if (field == m.cx()->names().Infinity) + return m.addGlobalConstant(varName, PositiveInfinity<double>(), field); + + Scalar::Type type; + if (IsArrayViewCtorName(m, field, &type)) + return m.addArrayViewCtor(varName, type, field); + + return m.failName(initNode, "'%s' is not a standard constant or typed array name", field); + } + + if (base->name() == m.importArgumentName()) + return m.addFFI(varName, field); + + const ModuleValidator::Global* global = m.lookupGlobal(base->name()); + if (!global) + return m.failName(initNode, "%s not found in module global scope", base->name()); + + if (!global->isSimdCtor()) + return m.failName(base, "expecting SIMD constructor name, got %s", field); + + return CheckGlobalSimdOperationImport(m, global, initNode, varName, field); +} + +static bool +CheckModuleGlobal(ModuleValidator& m, ParseNode* var, bool isConst) +{ + if (!var->isKind(PNK_NAME)) + return m.fail(var, "import variable is not a plain name"); + + if (!CheckModuleLevelName(m, var, var->name())) + return false; + + ParseNode* initNode = MaybeInitializer(var); + if (!initNode) + return m.fail(var, "module import needs initializer"); + + if (IsNumericLiteral(m, initNode)) + return CheckGlobalVariableInitConstant(m, var->name(), initNode, isConst); + + if (initNode->isKind(PNK_BITOR) || initNode->isKind(PNK_POS) || initNode->isKind(PNK_CALL)) + return CheckGlobalVariableInitImport(m, var->name(), initNode, isConst); + + if (initNode->isKind(PNK_NEW)) + return CheckNewArrayView(m, var->name(), initNode); + + if (initNode->isKind(PNK_DOT)) + return CheckGlobalDotImport(m, var->name(), initNode); + + return m.fail(initNode, "unsupported import expression"); +} + +static bool +CheckModuleProcessingDirectives(ModuleValidator& m) +{ + TokenStream& ts = m.parser().tokenStream; + while (true) { + bool matched; + if (!ts.matchToken(&matched, TOK_STRING, TokenStream::Operand)) + return false; + if (!matched) + return true; + + if (!IsIgnoredDirectiveName(m.cx(), ts.currentToken().atom())) + return m.failCurrentOffset("unsupported processing directive"); + + TokenKind tt; + if (!ts.getToken(&tt)) + return false; + if (tt != TOK_SEMI) + return m.failCurrentOffset("expected semicolon after string literal"); + } +} + +static bool +CheckModuleGlobals(ModuleValidator& m) +{ + while (true) { + ParseNode* varStmt; + if (!ParseVarOrConstStatement(m.parser(), &varStmt)) + return false; + if (!varStmt) + break; + for (ParseNode* var = VarListHead(varStmt); var; var = NextNode(var)) { + if (!CheckModuleGlobal(m, var, varStmt->isKind(PNK_CONST))) + return false; + } + } + + return true; +} + +static bool +ArgFail(FunctionValidator& f, PropertyName* argName, ParseNode* stmt) +{ + return f.failName(stmt, "expecting argument type declaration for '%s' of the " + "form 'arg = arg|0' or 'arg = +arg' or 'arg = fround(arg)'", argName); +} + +static bool +CheckArgumentType(FunctionValidator& f, ParseNode* stmt, PropertyName* name, Type* type) +{ + if (!stmt || !IsExpressionStatement(stmt)) + return ArgFail(f, name, stmt ? stmt : f.fn()); + + ParseNode* initNode = ExpressionStatementExpr(stmt); + if (!initNode || !initNode->isKind(PNK_ASSIGN)) + return ArgFail(f, name, stmt); + + ParseNode* argNode = BinaryLeft(initNode); + ParseNode* coercionNode = BinaryRight(initNode); + + if (!IsUseOfName(argNode, name)) + return ArgFail(f, name, stmt); + + ParseNode* coercedExpr; + if (!CheckTypeAnnotation(f.m(), coercionNode, type, &coercedExpr)) + return false; + + if (!type->isArgType()) + return f.failName(stmt, "invalid type for argument '%s'", name); + + if (!IsUseOfName(coercedExpr, name)) + return ArgFail(f, name, stmt); + + return true; +} + +static bool +CheckProcessingDirectives(ModuleValidator& m, ParseNode** stmtIter) +{ + ParseNode* stmt = *stmtIter; + + while (stmt && IsIgnoredDirective(m.cx(), stmt)) + stmt = NextNode(stmt); + + *stmtIter = stmt; + return true; +} + +static bool +CheckArguments(FunctionValidator& f, ParseNode** stmtIter, ValTypeVector* argTypes) +{ + ParseNode* stmt = *stmtIter; + + unsigned numFormals; + ParseNode* argpn = FunctionFormalParametersList(f.fn(), &numFormals); + + for (unsigned i = 0; i < numFormals; i++, argpn = NextNode(argpn), stmt = NextNode(stmt)) { + PropertyName* name; + if (!CheckArgument(f.m(), argpn, &name)) + return false; + + Type type; + if (!CheckArgumentType(f, stmt, name, &type)) + return false; + + if (!argTypes->append(type.canonicalToValType())) + return false; + + if (!f.addLocal(argpn, name, type)) + return false; + } + + *stmtIter = stmt; + return true; +} + +static bool +IsLiteralOrConst(FunctionValidator& f, ParseNode* pn, NumLit* lit) +{ + if (pn->isKind(PNK_NAME)) { + const ModuleValidator::Global* global = f.lookupGlobal(pn->name()); + if (!global || global->which() != ModuleValidator::Global::ConstantLiteral) + return false; + + *lit = global->constLiteralValue(); + return true; + } + + bool isSimd = false; + if (!IsNumericLiteral(f.m(), pn, &isSimd)) + return false; + + if (isSimd) + f.setUsesSimd(); + + *lit = ExtractNumericLiteral(f.m(), pn); + return true; +} + +static bool +CheckFinalReturn(FunctionValidator& f, ParseNode* lastNonEmptyStmt) +{ + if (!f.encoder().writeOp(Op::End)) + return false; + + if (!f.hasAlreadyReturned()) { + f.setReturnedType(ExprType::Void); + return true; + } + + if (!lastNonEmptyStmt->isKind(PNK_RETURN) && !IsVoid(f.returnedType())) + return f.fail(lastNonEmptyStmt, "void incompatible with previous return type"); + + return true; +} + +static bool +CheckVariable(FunctionValidator& f, ParseNode* var, ValTypeVector* types, Vector<NumLit>* inits) +{ + if (!var->isKind(PNK_NAME)) + return f.fail(var, "local variable is not a plain name"); + + PropertyName* name = var->name(); + + if (!CheckIdentifier(f.m(), var, name)) + return false; + + ParseNode* initNode = MaybeInitializer(var); + if (!initNode) + return f.failName(var, "var '%s' needs explicit type declaration via an initial value", name); + + NumLit lit; + if (!IsLiteralOrConst(f, initNode, &lit)) + return f.failName(var, "var '%s' initializer must be literal or const literal", name); + + if (!lit.valid()) + return f.failName(var, "var '%s' initializer out of range", name); + + Type type = Type::canonicalize(Type::lit(lit)); + + return f.addLocal(var, name, type) && + types->append(type.canonicalToValType()) && + inits->append(lit); +} + +static bool +CheckVariables(FunctionValidator& f, ParseNode** stmtIter) +{ + ParseNode* stmt = *stmtIter; + + uint32_t firstVar = f.numLocals(); + + ValTypeVector types; + Vector<NumLit> inits(f.cx()); + + for (; stmt && stmt->isKind(PNK_VAR); stmt = NextNonEmptyStatement(stmt)) { + for (ParseNode* var = VarListHead(stmt); var; var = NextNode(var)) { + if (!CheckVariable(f, var, &types, &inits)) + return false; + } + } + + MOZ_ASSERT(f.encoder().empty()); + + if (!EncodeLocalEntries(f.encoder(), types)) + return false; + + for (uint32_t i = 0; i < inits.length(); i++) { + NumLit lit = inits[i]; + if (lit.isZeroBits()) + continue; + if (!f.writeConstExpr(lit)) + return false; + if (!f.encoder().writeOp(Op::SetLocal)) + return false; + if (!f.encoder().writeVarU32(firstVar + i)) + return false; + } + + *stmtIter = stmt; + return true; +} + +static bool +CheckExpr(FunctionValidator& f, ParseNode* op, Type* type); + +static bool +CheckNumericLiteral(FunctionValidator& f, ParseNode* num, Type* type) +{ + NumLit lit = ExtractNumericLiteral(f.m(), num); + if (!lit.valid()) + return f.fail(num, "numeric literal out of representable integer range"); + *type = Type::lit(lit); + return f.writeConstExpr(lit); +} + +static bool +CheckVarRef(FunctionValidator& f, ParseNode* varRef, Type* type) +{ + PropertyName* name = varRef->name(); + + if (const FunctionValidator::Local* local = f.lookupLocal(name)) { + if (!f.encoder().writeOp(Op::GetLocal)) + return false; + if (!f.encoder().writeVarU32(local->slot)) + return false; + *type = local->type; + return true; + } + + if (const ModuleValidator::Global* global = f.lookupGlobal(name)) { + switch (global->which()) { + case ModuleValidator::Global::ConstantLiteral: + *type = global->varOrConstType(); + return f.writeConstExpr(global->constLiteralValue()); + case ModuleValidator::Global::ConstantImport: + case ModuleValidator::Global::Variable: { + *type = global->varOrConstType(); + return f.encoder().writeOp(Op::GetGlobal) && + f.encoder().writeVarU32(global->varOrConstIndex()); + } + case ModuleValidator::Global::Function: + case ModuleValidator::Global::FFI: + case ModuleValidator::Global::MathBuiltinFunction: + case ModuleValidator::Global::AtomicsBuiltinFunction: + case ModuleValidator::Global::FuncPtrTable: + case ModuleValidator::Global::ArrayView: + case ModuleValidator::Global::ArrayViewCtor: + case ModuleValidator::Global::SimdCtor: + case ModuleValidator::Global::SimdOp: + break; + } + return f.failName(varRef, "'%s' may not be accessed by ordinary expressions", name); + } + + return f.failName(varRef, "'%s' not found in local or asm.js module scope", name); +} + +static inline bool +IsLiteralOrConstInt(FunctionValidator& f, ParseNode* pn, uint32_t* u32) +{ + NumLit lit; + if (!IsLiteralOrConst(f, pn, &lit)) + return false; + + return IsLiteralInt(lit, u32); +} + +static const int32_t NoMask = -1; +static const bool YesSimd = true; +static const bool NoSimd = false; + +static bool +CheckArrayAccess(FunctionValidator& f, ParseNode* viewName, ParseNode* indexExpr, + bool isSimd, Scalar::Type* viewType) +{ + if (!viewName->isKind(PNK_NAME)) + return f.fail(viewName, "base of array access must be a typed array view name"); + + const ModuleValidator::Global* global = f.lookupGlobal(viewName->name()); + if (!global || !global->isAnyArrayView()) + return f.fail(viewName, "base of array access must be a typed array view name"); + + *viewType = global->viewType(); + + uint32_t index; + if (IsLiteralOrConstInt(f, indexExpr, &index)) { + uint64_t byteOffset = uint64_t(index) << TypedArrayShift(*viewType); + uint64_t width = isSimd ? Simd128DataSize : TypedArrayElemSize(*viewType); + if (!f.m().tryConstantAccess(byteOffset, width)) + return f.fail(indexExpr, "constant index out of range"); + + return f.writeInt32Lit(byteOffset); + } + + // Mask off the low bits to account for the clearing effect of a right shift + // followed by the left shift implicit in the array access. E.g., H32[i>>2] + // loses the low two bits. + int32_t mask = ~(TypedArrayElemSize(*viewType) - 1); + + if (indexExpr->isKind(PNK_RSH)) { + ParseNode* shiftAmountNode = BitwiseRight(indexExpr); + + uint32_t shift; + if (!IsLiteralInt(f.m(), shiftAmountNode, &shift)) + return f.failf(shiftAmountNode, "shift amount must be constant"); + + unsigned requiredShift = TypedArrayShift(*viewType); + if (shift != requiredShift) + return f.failf(shiftAmountNode, "shift amount must be %u", requiredShift); + + ParseNode* pointerNode = BitwiseLeft(indexExpr); + + Type pointerType; + if (!CheckExpr(f, pointerNode, &pointerType)) + return false; + + if (!pointerType.isIntish()) + return f.failf(pointerNode, "%s is not a subtype of int", pointerType.toChars()); + } else { + // For SIMD access, and legacy scalar access compatibility, accept + // Int8/Uint8 accesses with no shift. + if (TypedArrayShift(*viewType) != 0) + return f.fail(indexExpr, "index expression isn't shifted; must be an Int8/Uint8 access"); + + MOZ_ASSERT(mask == NoMask); + + ParseNode* pointerNode = indexExpr; + + Type pointerType; + if (!CheckExpr(f, pointerNode, &pointerType)) + return false; + + if (isSimd) { + if (!pointerType.isIntish()) + return f.failf(pointerNode, "%s is not a subtype of intish", pointerType.toChars()); + } else { + if (!pointerType.isInt()) + return f.failf(pointerNode, "%s is not a subtype of int", pointerType.toChars()); + } + } + + // Don't generate the mask op if there is no need for it which could happen for + // a shift of zero or a SIMD access. + if (mask != NoMask) { + return f.writeInt32Lit(mask) && + f.encoder().writeOp(Op::I32And); + } + + return true; +} + +static bool +CheckAndPrepareArrayAccess(FunctionValidator& f, ParseNode* viewName, ParseNode* indexExpr, + bool isSimd, Scalar::Type* viewType) +{ + return CheckArrayAccess(f, viewName, indexExpr, isSimd, viewType); +} + +static bool +WriteArrayAccessFlags(FunctionValidator& f, Scalar::Type viewType) +{ + // asm.js only has naturally-aligned accesses. + size_t align = TypedArrayElemSize(viewType); + MOZ_ASSERT(IsPowerOfTwo(align)); + if (!f.encoder().writeFixedU8(CeilingLog2(align))) + return false; + + // asm.js doesn't have constant offsets, so just encode a 0. + if (!f.encoder().writeVarU32(0)) + return false; + + return true; +} + +static bool +CheckLoadArray(FunctionValidator& f, ParseNode* elem, Type* type) +{ + Scalar::Type viewType; + + if (!CheckAndPrepareArrayAccess(f, ElemBase(elem), ElemIndex(elem), NoSimd, &viewType)) + return false; + + switch (viewType) { + case Scalar::Int8: if (!f.encoder().writeOp(Op::I32Load8S)) return false; break; + case Scalar::Uint8: if (!f.encoder().writeOp(Op::I32Load8U)) return false; break; + case Scalar::Int16: if (!f.encoder().writeOp(Op::I32Load16S)) return false; break; + case Scalar::Uint16: if (!f.encoder().writeOp(Op::I32Load16U)) return false; break; + case Scalar::Uint32: + case Scalar::Int32: if (!f.encoder().writeOp(Op::I32Load)) return false; break; + case Scalar::Float32: if (!f.encoder().writeOp(Op::F32Load)) return false; break; + case Scalar::Float64: if (!f.encoder().writeOp(Op::F64Load)) return false; break; + default: MOZ_CRASH("unexpected scalar type"); + } + + switch (viewType) { + case Scalar::Int8: + case Scalar::Int16: + case Scalar::Int32: + case Scalar::Uint8: + case Scalar::Uint16: + case Scalar::Uint32: + *type = Type::Intish; + break; + case Scalar::Float32: + *type = Type::MaybeFloat; + break; + case Scalar::Float64: + *type = Type::MaybeDouble; + break; + default: MOZ_CRASH("Unexpected array type"); + } + + if (!WriteArrayAccessFlags(f, viewType)) + return false; + + return true; +} + +static bool +CheckStoreArray(FunctionValidator& f, ParseNode* lhs, ParseNode* rhs, Type* type) +{ + Scalar::Type viewType; + if (!CheckAndPrepareArrayAccess(f, ElemBase(lhs), ElemIndex(lhs), NoSimd, &viewType)) + return false; + + Type rhsType; + if (!CheckExpr(f, rhs, &rhsType)) + return false; + + switch (viewType) { + case Scalar::Int8: + case Scalar::Int16: + case Scalar::Int32: + case Scalar::Uint8: + case Scalar::Uint16: + case Scalar::Uint32: + if (!rhsType.isIntish()) + return f.failf(lhs, "%s is not a subtype of intish", rhsType.toChars()); + break; + case Scalar::Float32: + if (!rhsType.isMaybeDouble() && !rhsType.isFloatish()) + return f.failf(lhs, "%s is not a subtype of double? or floatish", rhsType.toChars()); + break; + case Scalar::Float64: + if (!rhsType.isMaybeFloat() && !rhsType.isMaybeDouble()) + return f.failf(lhs, "%s is not a subtype of float? or double?", rhsType.toChars()); + break; + default: + MOZ_CRASH("Unexpected view type"); + } + + switch (viewType) { + case Scalar::Int8: + case Scalar::Uint8: + if (!f.encoder().writeOp(Op::I32TeeStore8)) + return false; + break; + case Scalar::Int16: + case Scalar::Uint16: + if (!f.encoder().writeOp(Op::I32TeeStore16)) + return false; + break; + case Scalar::Int32: + case Scalar::Uint32: + if (!f.encoder().writeOp(Op::I32TeeStore)) + return false; + break; + case Scalar::Float32: + if (rhsType.isFloatish()) { + if (!f.encoder().writeOp(Op::F32TeeStore)) + return false; + } else { + if (!f.encoder().writeOp(Op::F64TeeStoreF32)) + return false; + } + break; + case Scalar::Float64: + if (rhsType.isFloatish()) { + if (!f.encoder().writeOp(Op::F32TeeStoreF64)) + return false; + } else { + if (!f.encoder().writeOp(Op::F64TeeStore)) + return false; + } + break; + default: MOZ_CRASH("unexpected scalar type"); + } + + if (!WriteArrayAccessFlags(f, viewType)) + return false; + + *type = rhsType; + return true; +} + +static bool +CheckAssignName(FunctionValidator& f, ParseNode* lhs, ParseNode* rhs, Type* type) +{ + RootedPropertyName name(f.cx(), lhs->name()); + + if (const FunctionValidator::Local* lhsVar = f.lookupLocal(name)) { + Type rhsType; + if (!CheckExpr(f, rhs, &rhsType)) + return false; + + if (!f.encoder().writeOp(Op::TeeLocal)) + return false; + if (!f.encoder().writeVarU32(lhsVar->slot)) + return false; + + if (!(rhsType <= lhsVar->type)) { + return f.failf(lhs, "%s is not a subtype of %s", + rhsType.toChars(), lhsVar->type.toChars()); + } + *type = rhsType; + return true; + } + + if (const ModuleValidator::Global* global = f.lookupGlobal(name)) { + if (global->which() != ModuleValidator::Global::Variable) + return f.failName(lhs, "'%s' is not a mutable variable", name); + + Type rhsType; + if (!CheckExpr(f, rhs, &rhsType)) + return false; + + Type globType = global->varOrConstType(); + if (!(rhsType <= globType)) + return f.failf(lhs, "%s is not a subtype of %s", rhsType.toChars(), globType.toChars()); + if (!f.encoder().writeOp(Op::TeeGlobal)) + return false; + if (!f.encoder().writeVarU32(global->varOrConstIndex())) + return false; + + *type = rhsType; + return true; + } + + return f.failName(lhs, "'%s' not found in local or asm.js module scope", name); +} + +static bool +CheckAssign(FunctionValidator& f, ParseNode* assign, Type* type) +{ + MOZ_ASSERT(assign->isKind(PNK_ASSIGN)); + + ParseNode* lhs = BinaryLeft(assign); + ParseNode* rhs = BinaryRight(assign); + + if (lhs->getKind() == PNK_ELEM) + return CheckStoreArray(f, lhs, rhs, type); + + if (lhs->getKind() == PNK_NAME) + return CheckAssignName(f, lhs, rhs, type); + + return f.fail(assign, "left-hand side of assignment must be a variable or array access"); +} + +static bool +CheckMathIMul(FunctionValidator& f, ParseNode* call, Type* type) +{ + if (CallArgListLength(call) != 2) + return f.fail(call, "Math.imul must be passed 2 arguments"); + + ParseNode* lhs = CallArgList(call); + ParseNode* rhs = NextNode(lhs); + + Type lhsType; + if (!CheckExpr(f, lhs, &lhsType)) + return false; + + Type rhsType; + if (!CheckExpr(f, rhs, &rhsType)) + return false; + + if (!lhsType.isIntish()) + return f.failf(lhs, "%s is not a subtype of intish", lhsType.toChars()); + if (!rhsType.isIntish()) + return f.failf(rhs, "%s is not a subtype of intish", rhsType.toChars()); + + *type = Type::Signed; + return f.encoder().writeOp(Op::I32Mul); +} + +static bool +CheckMathClz32(FunctionValidator& f, ParseNode* call, Type* type) +{ + if (CallArgListLength(call) != 1) + return f.fail(call, "Math.clz32 must be passed 1 argument"); + + ParseNode* arg = CallArgList(call); + + Type argType; + if (!CheckExpr(f, arg, &argType)) + return false; + + if (!argType.isIntish()) + return f.failf(arg, "%s is not a subtype of intish", argType.toChars()); + + *type = Type::Fixnum; + return f.encoder().writeOp(Op::I32Clz); +} + +static bool +CheckMathAbs(FunctionValidator& f, ParseNode* call, Type* type) +{ + if (CallArgListLength(call) != 1) + return f.fail(call, "Math.abs must be passed 1 argument"); + + ParseNode* arg = CallArgList(call); + + Type argType; + if (!CheckExpr(f, arg, &argType)) + return false; + + if (argType.isSigned()) { + *type = Type::Unsigned; + return f.encoder().writeOp(Op::I32Abs); + } + + if (argType.isMaybeDouble()) { + *type = Type::Double; + return f.encoder().writeOp(Op::F64Abs); + } + + if (argType.isMaybeFloat()) { + *type = Type::Floatish; + return f.encoder().writeOp(Op::F32Abs); + } + + return f.failf(call, "%s is not a subtype of signed, float? or double?", argType.toChars()); +} + +static bool +CheckMathSqrt(FunctionValidator& f, ParseNode* call, Type* type) +{ + if (CallArgListLength(call) != 1) + return f.fail(call, "Math.sqrt must be passed 1 argument"); + + ParseNode* arg = CallArgList(call); + + Type argType; + if (!CheckExpr(f, arg, &argType)) + return false; + + if (argType.isMaybeDouble()) { + *type = Type::Double; + return f.encoder().writeOp(Op::F64Sqrt); + } + + if (argType.isMaybeFloat()) { + *type = Type::Floatish; + return f.encoder().writeOp(Op::F32Sqrt); + } + + return f.failf(call, "%s is neither a subtype of double? nor float?", argType.toChars()); +} + +static bool +CheckMathMinMax(FunctionValidator& f, ParseNode* callNode, bool isMax, Type* type) +{ + if (CallArgListLength(callNode) < 2) + return f.fail(callNode, "Math.min/max must be passed at least 2 arguments"); + + ParseNode* firstArg = CallArgList(callNode); + Type firstType; + if (!CheckExpr(f, firstArg, &firstType)) + return false; + + Op op; + if (firstType.isMaybeDouble()) { + *type = Type::Double; + firstType = Type::MaybeDouble; + op = isMax ? Op::F64Max : Op::F64Min; + } else if (firstType.isMaybeFloat()) { + *type = Type::Float; + firstType = Type::MaybeFloat; + op = isMax ? Op::F32Max : Op::F32Min; + } else if (firstType.isSigned()) { + *type = Type::Signed; + firstType = Type::Signed; + op = isMax ? Op::I32Max : Op::I32Min; + } else { + return f.failf(firstArg, "%s is not a subtype of double?, float? or signed", + firstType.toChars()); + } + + unsigned numArgs = CallArgListLength(callNode); + ParseNode* nextArg = NextNode(firstArg); + for (unsigned i = 1; i < numArgs; i++, nextArg = NextNode(nextArg)) { + Type nextType; + if (!CheckExpr(f, nextArg, &nextType)) + return false; + if (!(nextType <= firstType)) + return f.failf(nextArg, "%s is not a subtype of %s", nextType.toChars(), firstType.toChars()); + + if (!f.encoder().writeOp(op)) + return false; + } + + return true; +} + +static bool +CheckSharedArrayAtomicAccess(FunctionValidator& f, ParseNode* viewName, ParseNode* indexExpr, + Scalar::Type* viewType) +{ + if (!CheckAndPrepareArrayAccess(f, viewName, indexExpr, NoSimd, viewType)) + return false; + + // The global will be sane, CheckArrayAccess checks it. + const ModuleValidator::Global* global = f.lookupGlobal(viewName->name()); + if (global->which() != ModuleValidator::Global::ArrayView) + return f.fail(viewName, "base of array access must be a typed array view"); + + MOZ_ASSERT(f.m().atomicsPresent()); + + switch (*viewType) { + case Scalar::Int8: + case Scalar::Int16: + case Scalar::Int32: + case Scalar::Uint8: + case Scalar::Uint16: + case Scalar::Uint32: + return true; + default: + return f.failf(viewName, "not an integer array"); + } + + return true; +} + +static bool +WriteAtomicOperator(FunctionValidator& f, Op opcode, Scalar::Type viewType) +{ + return f.encoder().writeOp(opcode) && + f.encoder().writeFixedU8(viewType); +} + +static bool +CheckAtomicsLoad(FunctionValidator& f, ParseNode* call, Type* type) +{ + if (CallArgListLength(call) != 2) + return f.fail(call, "Atomics.load must be passed 2 arguments"); + + ParseNode* arrayArg = CallArgList(call); + ParseNode* indexArg = NextNode(arrayArg); + + Scalar::Type viewType; + if (!CheckSharedArrayAtomicAccess(f, arrayArg, indexArg, &viewType)) + return false; + + if (!WriteAtomicOperator(f, Op::I32AtomicsLoad, viewType)) + return false; + + if (!WriteArrayAccessFlags(f, viewType)) + return false; + + *type = Type::Int; + return true; +} + +static bool +CheckAtomicsStore(FunctionValidator& f, ParseNode* call, Type* type) +{ + if (CallArgListLength(call) != 3) + return f.fail(call, "Atomics.store must be passed 3 arguments"); + + ParseNode* arrayArg = CallArgList(call); + ParseNode* indexArg = NextNode(arrayArg); + ParseNode* valueArg = NextNode(indexArg); + + Type rhsType; + if (!CheckExpr(f, valueArg, &rhsType)) + return false; + + if (!rhsType.isIntish()) + return f.failf(arrayArg, "%s is not a subtype of intish", rhsType.toChars()); + + Scalar::Type viewType; + if (!CheckSharedArrayAtomicAccess(f, arrayArg, indexArg, &viewType)) + return false; + + if (!WriteAtomicOperator(f, Op::I32AtomicsStore, viewType)) + return false; + + if (!WriteArrayAccessFlags(f, viewType)) + return false; + + *type = rhsType; + return true; +} + +static bool +CheckAtomicsBinop(FunctionValidator& f, ParseNode* call, Type* type, AtomicOp op) +{ + if (CallArgListLength(call) != 3) + return f.fail(call, "Atomics binary operator must be passed 3 arguments"); + + ParseNode* arrayArg = CallArgList(call); + ParseNode* indexArg = NextNode(arrayArg); + ParseNode* valueArg = NextNode(indexArg); + + Type valueArgType; + if (!CheckExpr(f, valueArg, &valueArgType)) + return false; + + if (!valueArgType.isIntish()) + return f.failf(valueArg, "%s is not a subtype of intish", valueArgType.toChars()); + + Scalar::Type viewType; + if (!CheckSharedArrayAtomicAccess(f, arrayArg, indexArg, &viewType)) + return false; + + if (!WriteAtomicOperator(f, Op::I32AtomicsBinOp, viewType)) + return false; + if (!f.encoder().writeFixedU8(uint8_t(op))) + return false; + + if (!WriteArrayAccessFlags(f, viewType)) + return false; + + *type = Type::Int; + return true; +} + +static bool +CheckAtomicsIsLockFree(FunctionValidator& f, ParseNode* call, Type* type) +{ + if (CallArgListLength(call) != 1) + return f.fail(call, "Atomics.isLockFree must be passed 1 argument"); + + ParseNode* sizeArg = CallArgList(call); + + uint32_t size; + if (!IsLiteralInt(f.m(), sizeArg, &size)) + return f.fail(sizeArg, "Atomics.isLockFree requires an integer literal argument"); + + *type = Type::Int; + return f.writeInt32Lit(AtomicOperations::isLockfree(size)); +} + +static bool +CheckAtomicsCompareExchange(FunctionValidator& f, ParseNode* call, Type* type) +{ + if (CallArgListLength(call) != 4) + return f.fail(call, "Atomics.compareExchange must be passed 4 arguments"); + + ParseNode* arrayArg = CallArgList(call); + ParseNode* indexArg = NextNode(arrayArg); + ParseNode* oldValueArg = NextNode(indexArg); + ParseNode* newValueArg = NextNode(oldValueArg); + + Type oldValueArgType; + if (!CheckExpr(f, oldValueArg, &oldValueArgType)) + return false; + + Type newValueArgType; + if (!CheckExpr(f, newValueArg, &newValueArgType)) + return false; + + if (!oldValueArgType.isIntish()) + return f.failf(oldValueArg, "%s is not a subtype of intish", oldValueArgType.toChars()); + + if (!newValueArgType.isIntish()) + return f.failf(newValueArg, "%s is not a subtype of intish", newValueArgType.toChars()); + + Scalar::Type viewType; + if (!CheckSharedArrayAtomicAccess(f, arrayArg, indexArg, &viewType)) + return false; + + if (!WriteAtomicOperator(f, Op::I32AtomicsCompareExchange, viewType)) + return false; + + if (!WriteArrayAccessFlags(f, viewType)) + return false; + + *type = Type::Int; + return true; +} + +static bool +CheckAtomicsExchange(FunctionValidator& f, ParseNode* call, Type* type) +{ + if (CallArgListLength(call) != 3) + return f.fail(call, "Atomics.exchange must be passed 3 arguments"); + + ParseNode* arrayArg = CallArgList(call); + ParseNode* indexArg = NextNode(arrayArg); + ParseNode* valueArg = NextNode(indexArg); + + Type valueArgType; + if (!CheckExpr(f, valueArg, &valueArgType)) + return false; + + if (!valueArgType.isIntish()) + return f.failf(arrayArg, "%s is not a subtype of intish", valueArgType.toChars()); + + Scalar::Type viewType; + if (!CheckSharedArrayAtomicAccess(f, arrayArg, indexArg, &viewType)) + return false; + + if (!WriteAtomicOperator(f, Op::I32AtomicsExchange, viewType)) + return false; + + if (!WriteArrayAccessFlags(f, viewType)) + return false; + + *type = Type::Int; + return true; +} + +static bool +CheckAtomicsBuiltinCall(FunctionValidator& f, ParseNode* callNode, AsmJSAtomicsBuiltinFunction func, + Type* type) +{ + f.setUsesAtomics(); + + switch (func) { + case AsmJSAtomicsBuiltin_compareExchange: + return CheckAtomicsCompareExchange(f, callNode, type); + case AsmJSAtomicsBuiltin_exchange: + return CheckAtomicsExchange(f, callNode, type); + case AsmJSAtomicsBuiltin_load: + return CheckAtomicsLoad(f, callNode, type); + case AsmJSAtomicsBuiltin_store: + return CheckAtomicsStore(f, callNode, type); + case AsmJSAtomicsBuiltin_add: + return CheckAtomicsBinop(f, callNode, type, AtomicFetchAddOp); + case AsmJSAtomicsBuiltin_sub: + return CheckAtomicsBinop(f, callNode, type, AtomicFetchSubOp); + case AsmJSAtomicsBuiltin_and: + return CheckAtomicsBinop(f, callNode, type, AtomicFetchAndOp); + case AsmJSAtomicsBuiltin_or: + return CheckAtomicsBinop(f, callNode, type, AtomicFetchOrOp); + case AsmJSAtomicsBuiltin_xor: + return CheckAtomicsBinop(f, callNode, type, AtomicFetchXorOp); + case AsmJSAtomicsBuiltin_isLockFree: + return CheckAtomicsIsLockFree(f, callNode, type); + default: + MOZ_CRASH("unexpected atomicsBuiltin function"); + } +} + +typedef bool (*CheckArgType)(FunctionValidator& f, ParseNode* argNode, Type type); + +template <CheckArgType checkArg> +static bool +CheckCallArgs(FunctionValidator& f, ParseNode* callNode, ValTypeVector* args) +{ + ParseNode* argNode = CallArgList(callNode); + for (unsigned i = 0; i < CallArgListLength(callNode); i++, argNode = NextNode(argNode)) { + Type type; + if (!CheckExpr(f, argNode, &type)) + return false; + + if (!checkArg(f, argNode, type)) + return false; + + if (!args->append(Type::canonicalize(type).canonicalToValType())) + return false; + } + return true; +} + +static bool +CheckSignatureAgainstExisting(ModuleValidator& m, ParseNode* usepn, const Sig& sig, const Sig& existing) +{ + if (sig.args().length() != existing.args().length()) { + return m.failf(usepn, "incompatible number of arguments (%" PRIuSIZE + " here vs. %" PRIuSIZE " before)", + sig.args().length(), existing.args().length()); + } + + for (unsigned i = 0; i < sig.args().length(); i++) { + if (sig.arg(i) != existing.arg(i)) { + return m.failf(usepn, "incompatible type for argument %u: (%s here vs. %s before)", i, + ToCString(sig.arg(i)), ToCString(existing.arg(i))); + } + } + + if (sig.ret() != existing.ret()) { + return m.failf(usepn, "%s incompatible with previous return of type %s", + ToCString(sig.ret()), ToCString(existing.ret())); + } + + MOZ_ASSERT(sig == existing); + return true; +} + +static bool +CheckFunctionSignature(ModuleValidator& m, ParseNode* usepn, Sig&& sig, PropertyName* name, + ModuleValidator::Func** func) +{ + ModuleValidator::Func* existing = m.lookupFunction(name); + if (!existing) { + if (!CheckModuleLevelName(m, usepn, name)) + return false; + return m.addFunction(name, usepn->pn_pos.begin, Move(sig), func); + } + + if (!CheckSignatureAgainstExisting(m, usepn, sig, m.mg().funcSig(existing->index()))) + return false; + + *func = existing; + return true; +} + +static bool +CheckIsArgType(FunctionValidator& f, ParseNode* argNode, Type type) +{ + if (!type.isArgType()) + return f.failf(argNode, + "%s is not a subtype of int, float, double, or an allowed SIMD type", + type.toChars()); + + return true; +} + +static bool +CheckInternalCall(FunctionValidator& f, ParseNode* callNode, PropertyName* calleeName, + Type ret, Type* type) +{ + MOZ_ASSERT(ret.isCanonical()); + + ValTypeVector args; + if (!CheckCallArgs<CheckIsArgType>(f, callNode, &args)) + return false; + + Sig sig(Move(args), ret.canonicalToExprType()); + + ModuleValidator::Func* callee; + if (!CheckFunctionSignature(f.m(), callNode, Move(sig), calleeName, &callee)) + return false; + + if (!f.writeCall(callNode, Op::Call)) + return false; + + if (!f.encoder().writeVarU32(callee->index())) + return false; + + *type = Type::ret(ret); + return true; +} + +static bool +CheckFuncPtrTableAgainstExisting(ModuleValidator& m, ParseNode* usepn, PropertyName* name, + Sig&& sig, unsigned mask, uint32_t* funcPtrTableIndex) +{ + if (const ModuleValidator::Global* existing = m.lookupGlobal(name)) { + if (existing->which() != ModuleValidator::Global::FuncPtrTable) + return m.failName(usepn, "'%s' is not a function-pointer table", name); + + ModuleValidator::FuncPtrTable& table = m.funcPtrTable(existing->funcPtrTableIndex()); + if (mask != table.mask()) + return m.failf(usepn, "mask does not match previous value (%u)", table.mask()); + + if (!CheckSignatureAgainstExisting(m, usepn, sig, m.mg().sig(table.sigIndex()))) + return false; + + *funcPtrTableIndex = existing->funcPtrTableIndex(); + return true; + } + + if (!CheckModuleLevelName(m, usepn, name)) + return false; + + if (!m.declareFuncPtrTable(Move(sig), name, usepn->pn_pos.begin, mask, funcPtrTableIndex)) + return false; + + return true; +} + +static bool +CheckFuncPtrCall(FunctionValidator& f, ParseNode* callNode, Type ret, Type* type) +{ + MOZ_ASSERT(ret.isCanonical()); + + ParseNode* callee = CallCallee(callNode); + ParseNode* tableNode = ElemBase(callee); + ParseNode* indexExpr = ElemIndex(callee); + + if (!tableNode->isKind(PNK_NAME)) + return f.fail(tableNode, "expecting name of function-pointer array"); + + PropertyName* name = tableNode->name(); + if (const ModuleValidator::Global* existing = f.lookupGlobal(name)) { + if (existing->which() != ModuleValidator::Global::FuncPtrTable) + return f.failName(tableNode, "'%s' is not the name of a function-pointer array", name); + } + + if (!indexExpr->isKind(PNK_BITAND)) + return f.fail(indexExpr, "function-pointer table index expression needs & mask"); + + ParseNode* indexNode = BitwiseLeft(indexExpr); + ParseNode* maskNode = BitwiseRight(indexExpr); + + uint32_t mask; + if (!IsLiteralInt(f.m(), maskNode, &mask) || mask == UINT32_MAX || !IsPowerOfTwo(mask + 1)) + return f.fail(maskNode, "function-pointer table index mask value must be a power of two minus 1"); + + Type indexType; + if (!CheckExpr(f, indexNode, &indexType)) + return false; + + if (!indexType.isIntish()) + return f.failf(indexNode, "%s is not a subtype of intish", indexType.toChars()); + + ValTypeVector args; + if (!CheckCallArgs<CheckIsArgType>(f, callNode, &args)) + return false; + + Sig sig(Move(args), ret.canonicalToExprType()); + + uint32_t tableIndex; + if (!CheckFuncPtrTableAgainstExisting(f.m(), tableNode, name, Move(sig), mask, &tableIndex)) + return false; + + if (!f.writeCall(callNode, Op::OldCallIndirect)) + return false; + + // Call signature + if (!f.encoder().writeVarU32(f.m().funcPtrTable(tableIndex).sigIndex())) + return false; + + *type = Type::ret(ret); + return true; +} + +static bool +CheckIsExternType(FunctionValidator& f, ParseNode* argNode, Type type) +{ + if (!type.isExtern()) + return f.failf(argNode, "%s is not a subtype of extern", type.toChars()); + return true; +} + +static bool +CheckFFICall(FunctionValidator& f, ParseNode* callNode, unsigned ffiIndex, Type ret, Type* type) +{ + MOZ_ASSERT(ret.isCanonical()); + + PropertyName* calleeName = CallCallee(callNode)->name(); + + if (ret.isFloat()) + return f.fail(callNode, "FFI calls can't return float"); + if (ret.isSimd()) + return f.fail(callNode, "FFI calls can't return SIMD values"); + + ValTypeVector args; + if (!CheckCallArgs<CheckIsExternType>(f, callNode, &args)) + return false; + + Sig sig(Move(args), ret.canonicalToExprType()); + + uint32_t funcIndex; + if (!f.m().declareImport(calleeName, Move(sig), ffiIndex, &funcIndex)) + return false; + + if (!f.writeCall(callNode, Op::Call)) + return false; + + if (!f.encoder().writeVarU32(funcIndex)) + return false; + + *type = Type::ret(ret); + return true; +} + +static bool +CheckFloatCoercionArg(FunctionValidator& f, ParseNode* inputNode, Type inputType) +{ + if (inputType.isMaybeDouble()) + return f.encoder().writeOp(Op::F32DemoteF64); + if (inputType.isSigned()) + return f.encoder().writeOp(Op::F32ConvertSI32); + if (inputType.isUnsigned()) + return f.encoder().writeOp(Op::F32ConvertUI32); + if (inputType.isFloatish()) + return true; + + return f.failf(inputNode, "%s is not a subtype of signed, unsigned, double? or floatish", + inputType.toChars()); +} + +static bool +CheckCoercedCall(FunctionValidator& f, ParseNode* call, Type ret, Type* type); + +static bool +CheckCoercionArg(FunctionValidator& f, ParseNode* arg, Type expected, Type* type) +{ + MOZ_ASSERT(expected.isCanonicalValType()); + + if (arg->isKind(PNK_CALL)) + return CheckCoercedCall(f, arg, expected, type); + + Type argType; + if (!CheckExpr(f, arg, &argType)) + return false; + + if (expected.isFloat()) { + if (!CheckFloatCoercionArg(f, arg, argType)) + return false; + } else if (expected.isSimd()) { + if (!(argType <= expected)) + return f.fail(arg, "argument to SIMD coercion isn't from the correct SIMD type"); + } else { + MOZ_CRASH("not call coercions"); + } + + *type = Type::ret(expected); + return true; +} + +static bool +CheckMathFRound(FunctionValidator& f, ParseNode* callNode, Type* type) +{ + if (CallArgListLength(callNode) != 1) + return f.fail(callNode, "Math.fround must be passed 1 argument"); + + ParseNode* argNode = CallArgList(callNode); + Type argType; + if (!CheckCoercionArg(f, argNode, Type::Float, &argType)) + return false; + + MOZ_ASSERT(argType == Type::Float); + *type = Type::Float; + return true; +} + +static bool +CheckMathBuiltinCall(FunctionValidator& f, ParseNode* callNode, AsmJSMathBuiltinFunction func, + Type* type) +{ + unsigned arity = 0; + Op f32; + Op f64; + switch (func) { + case AsmJSMathBuiltin_imul: return CheckMathIMul(f, callNode, type); + case AsmJSMathBuiltin_clz32: return CheckMathClz32(f, callNode, type); + case AsmJSMathBuiltin_abs: return CheckMathAbs(f, callNode, type); + case AsmJSMathBuiltin_sqrt: return CheckMathSqrt(f, callNode, type); + case AsmJSMathBuiltin_fround: return CheckMathFRound(f, callNode, type); + case AsmJSMathBuiltin_min: return CheckMathMinMax(f, callNode, /* isMax = */ false, type); + case AsmJSMathBuiltin_max: return CheckMathMinMax(f, callNode, /* isMax = */ true, type); + case AsmJSMathBuiltin_ceil: arity = 1; f64 = Op::F64Ceil; f32 = Op::F32Ceil; break; + case AsmJSMathBuiltin_floor: arity = 1; f64 = Op::F64Floor; f32 = Op::F32Floor; break; + case AsmJSMathBuiltin_sin: arity = 1; f64 = Op::F64Sin; f32 = Op::Unreachable; break; + case AsmJSMathBuiltin_cos: arity = 1; f64 = Op::F64Cos; f32 = Op::Unreachable; break; + case AsmJSMathBuiltin_tan: arity = 1; f64 = Op::F64Tan; f32 = Op::Unreachable; break; + case AsmJSMathBuiltin_asin: arity = 1; f64 = Op::F64Asin; f32 = Op::Unreachable; break; + case AsmJSMathBuiltin_acos: arity = 1; f64 = Op::F64Acos; f32 = Op::Unreachable; break; + case AsmJSMathBuiltin_atan: arity = 1; f64 = Op::F64Atan; f32 = Op::Unreachable; break; + case AsmJSMathBuiltin_exp: arity = 1; f64 = Op::F64Exp; f32 = Op::Unreachable; break; + case AsmJSMathBuiltin_log: arity = 1; f64 = Op::F64Log; f32 = Op::Unreachable; break; + case AsmJSMathBuiltin_pow: arity = 2; f64 = Op::F64Pow; f32 = Op::Unreachable; break; + case AsmJSMathBuiltin_atan2: arity = 2; f64 = Op::F64Atan2; f32 = Op::Unreachable; break; + default: MOZ_CRASH("unexpected mathBuiltin function"); + } + + unsigned actualArity = CallArgListLength(callNode); + if (actualArity != arity) + return f.failf(callNode, "call passed %u arguments, expected %u", actualArity, arity); + + if (!f.prepareCall(callNode)) + return false; + + Type firstType; + ParseNode* argNode = CallArgList(callNode); + if (!CheckExpr(f, argNode, &firstType)) + return false; + + if (!firstType.isMaybeFloat() && !firstType.isMaybeDouble()) + return f.fail(argNode, "arguments to math call should be a subtype of double? or float?"); + + bool opIsDouble = firstType.isMaybeDouble(); + if (!opIsDouble && f32 == Op::Unreachable) + return f.fail(callNode, "math builtin cannot be used as float"); + + if (arity == 2) { + Type secondType; + argNode = NextNode(argNode); + if (!CheckExpr(f, argNode, &secondType)) + return false; + + if (firstType.isMaybeDouble() && !secondType.isMaybeDouble()) + return f.fail(argNode, "both arguments to math builtin call should be the same type"); + if (firstType.isMaybeFloat() && !secondType.isMaybeFloat()) + return f.fail(argNode, "both arguments to math builtin call should be the same type"); + } + + if (opIsDouble) { + if (!f.encoder().writeOp(f64)) + return false; + } else { + if (!f.encoder().writeOp(f32)) + return false; + } + + *type = opIsDouble ? Type::Double : Type::Floatish; + return true; +} + +namespace { +// Include CheckSimdCallArgs in unnamed namespace to avoid MSVC name lookup bug. + +template<class CheckArgOp> +static bool +CheckSimdCallArgs(FunctionValidator& f, ParseNode* call, unsigned expectedArity, + const CheckArgOp& checkArg) +{ + unsigned numArgs = CallArgListLength(call); + if (numArgs != expectedArity) + return f.failf(call, "expected %u arguments to SIMD call, got %u", expectedArity, numArgs); + + ParseNode* arg = CallArgList(call); + for (size_t i = 0; i < numArgs; i++, arg = NextNode(arg)) { + MOZ_ASSERT(!!arg); + Type argType; + if (!CheckExpr(f, arg, &argType)) + return false; + if (!checkArg(f, arg, i, argType)) + return false; + } + + return true; +} + + +class CheckArgIsSubtypeOf +{ + Type formalType_; + + public: + explicit CheckArgIsSubtypeOf(SimdType t) : formalType_(t) {} + + bool operator()(FunctionValidator& f, ParseNode* arg, unsigned argIndex, Type actualType) const + { + if (!(actualType <= formalType_)) { + return f.failf(arg, "%s is not a subtype of %s", actualType.toChars(), + formalType_.toChars()); + } + return true; + } +}; + +static inline Type +SimdToCoercedScalarType(SimdType t) +{ + switch (t) { + case SimdType::Int8x16: + case SimdType::Int16x8: + case SimdType::Int32x4: + case SimdType::Uint8x16: + case SimdType::Uint16x8: + case SimdType::Uint32x4: + case SimdType::Bool8x16: + case SimdType::Bool16x8: + case SimdType::Bool32x4: + return Type::Intish; + case SimdType::Float32x4: + return Type::Floatish; + default: + break; + } + MOZ_MAKE_COMPILER_ASSUME_IS_UNREACHABLE("unexpected SIMD type"); +} + +class CheckSimdScalarArgs +{ + SimdType simdType_; + Type formalType_; + + public: + explicit CheckSimdScalarArgs(SimdType simdType) + : simdType_(simdType), formalType_(SimdToCoercedScalarType(simdType)) + {} + + bool operator()(FunctionValidator& f, ParseNode* arg, unsigned argIndex, Type actualType) const + { + if (!(actualType <= formalType_)) { + // As a special case, accept doublelit arguments to float32x4 ops by + // re-emitting them as float32 constants. + if (simdType_ != SimdType::Float32x4 || !actualType.isDoubleLit()) { + return f.failf(arg, "%s is not a subtype of %s%s", + actualType.toChars(), formalType_.toChars(), + simdType_ == SimdType::Float32x4 ? " or doublelit" : ""); + } + + // We emitted a double literal and actually want a float32. + return f.encoder().writeOp(Op::F32DemoteF64); + } + + return true; + } +}; + +class CheckSimdSelectArgs +{ + Type formalType_; + Type maskType_; + + public: + explicit CheckSimdSelectArgs(SimdType t) : formalType_(t), maskType_(GetBooleanSimdType(t)) {} + + bool operator()(FunctionValidator& f, ParseNode* arg, unsigned argIndex, Type actualType) const + { + // The first argument is the boolean selector, the next two are the + // values to choose from. + Type wantedType = argIndex == 0 ? maskType_ : formalType_; + + if (!(actualType <= wantedType)) { + return f.failf(arg, "%s is not a subtype of %s", actualType.toChars(), + wantedType.toChars()); + } + return true; + } +}; + +class CheckSimdVectorScalarArgs +{ + SimdType formalSimdType_; + + public: + explicit CheckSimdVectorScalarArgs(SimdType t) : formalSimdType_(t) {} + + bool operator()(FunctionValidator& f, ParseNode* arg, unsigned argIndex, Type actualType) const + { + MOZ_ASSERT(argIndex < 2); + if (argIndex == 0) { + // First argument is the vector + if (!(actualType <= Type(formalSimdType_))) { + return f.failf(arg, "%s is not a subtype of %s", actualType.toChars(), + Type(formalSimdType_).toChars()); + } + + return true; + } + + // Second argument is the scalar + return CheckSimdScalarArgs(formalSimdType_)(f, arg, argIndex, actualType); + } +}; + +} // namespace + +static bool +CheckSimdUnary(FunctionValidator& f, ParseNode* call, SimdType opType, SimdOperation op, + Type* type) +{ + if (!CheckSimdCallArgs(f, call, 1, CheckArgIsSubtypeOf(opType))) + return false; + if (!f.writeSimdOp(opType, op)) + return false; + *type = opType; + return true; +} + +static bool +CheckSimdBinaryShift(FunctionValidator& f, ParseNode* call, SimdType opType, SimdOperation op, + Type *type) +{ + if (!CheckSimdCallArgs(f, call, 2, CheckSimdVectorScalarArgs(opType))) + return false; + if (!f.writeSimdOp(opType, op)) + return false; + *type = opType; + return true; +} + +static bool +CheckSimdBinaryComp(FunctionValidator& f, ParseNode* call, SimdType opType, SimdOperation op, + Type *type) +{ + if (!CheckSimdCallArgs(f, call, 2, CheckArgIsSubtypeOf(opType))) + return false; + if (!f.writeSimdOp(opType, op)) + return false; + *type = GetBooleanSimdType(opType); + return true; +} + +static bool +CheckSimdBinary(FunctionValidator& f, ParseNode* call, SimdType opType, SimdOperation op, + Type* type) +{ + if (!CheckSimdCallArgs(f, call, 2, CheckArgIsSubtypeOf(opType))) + return false; + if (!f.writeSimdOp(opType, op)) + return false; + *type = opType; + return true; +} + +static bool +CheckSimdExtractLane(FunctionValidator& f, ParseNode* call, SimdType opType, Type* type) +{ + switch (opType) { + case SimdType::Int8x16: + case SimdType::Int16x8: + case SimdType::Int32x4: *type = Type::Signed; break; + case SimdType::Uint8x16: + case SimdType::Uint16x8: + case SimdType::Uint32x4: *type = Type::Unsigned; break; + case SimdType::Float32x4: *type = Type::Float; break; + case SimdType::Bool8x16: + case SimdType::Bool16x8: + case SimdType::Bool32x4: *type = Type::Int; break; + default: MOZ_CRASH("unhandled simd type"); + } + + unsigned numArgs = CallArgListLength(call); + if (numArgs != 2) + return f.failf(call, "expected 2 arguments to SIMD extract, got %u", numArgs); + + ParseNode* arg = CallArgList(call); + + // First argument is the vector + Type vecType; + if (!CheckExpr(f, arg, &vecType)) + return false; + if (!(vecType <= Type(opType))) { + return f.failf(arg, "%s is not a subtype of %s", vecType.toChars(), + Type(opType).toChars()); + } + + arg = NextNode(arg); + + // Second argument is the lane < vector length + uint32_t lane; + if (!IsLiteralOrConstInt(f, arg, &lane)) + return f.failf(arg, "lane selector should be a constant integer literal"); + if (lane >= GetSimdLanes(opType)) + return f.failf(arg, "lane selector should be in bounds"); + + if (!f.writeSimdOp(opType, SimdOperation::Fn_extractLane)) + return false; + if (!f.encoder().writeVarU32(lane)) + return false; + return true; +} + +static bool +CheckSimdReplaceLane(FunctionValidator& f, ParseNode* call, SimdType opType, Type* type) +{ + unsigned numArgs = CallArgListLength(call); + if (numArgs != 3) + return f.failf(call, "expected 2 arguments to SIMD replace, got %u", numArgs); + + ParseNode* arg = CallArgList(call); + + // First argument is the vector + Type vecType; + if (!CheckExpr(f, arg, &vecType)) + return false; + if (!(vecType <= Type(opType))) { + return f.failf(arg, "%s is not a subtype of %s", vecType.toChars(), + Type(opType).toChars()); + } + + arg = NextNode(arg); + + // Second argument is the lane < vector length + uint32_t lane; + if (!IsLiteralOrConstInt(f, arg, &lane)) + return f.failf(arg, "lane selector should be a constant integer literal"); + if (lane >= GetSimdLanes(opType)) + return f.failf(arg, "lane selector should be in bounds"); + + arg = NextNode(arg); + + // Third argument is the scalar + Type scalarType; + if (!CheckExpr(f, arg, &scalarType)) + return false; + if (!(scalarType <= SimdToCoercedScalarType(opType))) { + if (opType == SimdType::Float32x4 && scalarType.isDoubleLit()) { + if (!f.encoder().writeOp(Op::F32DemoteF64)) + return false; + } else { + return f.failf(arg, "%s is not the correct type to replace an element of %s", + scalarType.toChars(), vecType.toChars()); + } + } + + if (!f.writeSimdOp(opType, SimdOperation::Fn_replaceLane)) + return false; + if (!f.encoder().writeVarU32(lane)) + return false; + *type = opType; + return true; +} + +typedef bool Bitcast; + +namespace { +// Include CheckSimdCast in unnamed namespace to avoid MSVC name lookup bug (due to the use of Type). + +static bool +CheckSimdCast(FunctionValidator& f, ParseNode* call, SimdType fromType, SimdType toType, + SimdOperation op, Type* type) +{ + if (!CheckSimdCallArgs(f, call, 1, CheckArgIsSubtypeOf(fromType))) + return false; + if (!f.writeSimdOp(toType, op)) + return false; + *type = toType; + return true; +} + +} // namespace + +static bool +CheckSimdShuffleSelectors(FunctionValidator& f, ParseNode* lane, + mozilla::Array<uint8_t, 16>& lanes, unsigned numLanes, unsigned maxLane) +{ + for (unsigned i = 0; i < numLanes; i++, lane = NextNode(lane)) { + uint32_t u32; + if (!IsLiteralInt(f.m(), lane, &u32)) + return f.failf(lane, "lane selector should be a constant integer literal"); + if (u32 >= maxLane) + return f.failf(lane, "lane selector should be less than %u", maxLane); + lanes[i] = uint8_t(u32); + } + return true; +} + +static bool +CheckSimdSwizzle(FunctionValidator& f, ParseNode* call, SimdType opType, Type* type) +{ + const unsigned numLanes = GetSimdLanes(opType); + unsigned numArgs = CallArgListLength(call); + if (numArgs != 1 + numLanes) + return f.failf(call, "expected %u arguments to SIMD swizzle, got %u", 1 + numLanes, + numArgs); + + Type retType = opType; + ParseNode* vec = CallArgList(call); + Type vecType; + if (!CheckExpr(f, vec, &vecType)) + return false; + if (!(vecType <= retType)) + return f.failf(vec, "%s is not a subtype of %s", vecType.toChars(), retType.toChars()); + + if (!f.writeSimdOp(opType, SimdOperation::Fn_swizzle)) + return false; + + mozilla::Array<uint8_t, 16> lanes; + if (!CheckSimdShuffleSelectors(f, NextNode(vec), lanes, numLanes, numLanes)) + return false; + + for (unsigned i = 0; i < numLanes; i++) { + if (!f.encoder().writeFixedU8(lanes[i])) + return false; + } + + *type = retType; + return true; +} + +static bool +CheckSimdShuffle(FunctionValidator& f, ParseNode* call, SimdType opType, Type* type) +{ + const unsigned numLanes = GetSimdLanes(opType); + unsigned numArgs = CallArgListLength(call); + if (numArgs != 2 + numLanes) + return f.failf(call, "expected %u arguments to SIMD shuffle, got %u", 2 + numLanes, + numArgs); + + Type retType = opType; + ParseNode* arg = CallArgList(call); + for (unsigned i = 0; i < 2; i++, arg = NextNode(arg)) { + Type type; + if (!CheckExpr(f, arg, &type)) + return false; + if (!(type <= retType)) + return f.failf(arg, "%s is not a subtype of %s", type.toChars(), retType.toChars()); + } + + if (!f.writeSimdOp(opType, SimdOperation::Fn_shuffle)) + return false; + + mozilla::Array<uint8_t, 16> lanes; + if (!CheckSimdShuffleSelectors(f, arg, lanes, numLanes, 2 * numLanes)) + return false; + + for (unsigned i = 0; i < numLanes; i++) { + if (!f.encoder().writeFixedU8(uint8_t(lanes[i]))) + return false; + } + + *type = retType; + return true; +} + +static bool +CheckSimdLoadStoreArgs(FunctionValidator& f, ParseNode* call, Scalar::Type* viewType) +{ + ParseNode* view = CallArgList(call); + if (!view->isKind(PNK_NAME)) + return f.fail(view, "expected Uint8Array view as SIMD.*.load/store first argument"); + + ParseNode* indexExpr = NextNode(view); + + if (!CheckAndPrepareArrayAccess(f, view, indexExpr, YesSimd, viewType)) + return false; + + if (*viewType != Scalar::Uint8) + return f.fail(view, "expected Uint8Array view as SIMD.*.load/store first argument"); + + return true; +} + +static bool +CheckSimdLoad(FunctionValidator& f, ParseNode* call, SimdType opType, SimdOperation op, + Type* type) +{ + unsigned numArgs = CallArgListLength(call); + if (numArgs != 2) + return f.failf(call, "expected 2 arguments to SIMD load, got %u", numArgs); + + Scalar::Type viewType; + if (!CheckSimdLoadStoreArgs(f, call, &viewType)) + return false; + + if (!f.writeSimdOp(opType, op)) + return false; + + if (!WriteArrayAccessFlags(f, viewType)) + return false; + + *type = opType; + return true; +} + +static bool +CheckSimdStore(FunctionValidator& f, ParseNode* call, SimdType opType, SimdOperation op, + Type* type) +{ + unsigned numArgs = CallArgListLength(call); + if (numArgs != 3) + return f.failf(call, "expected 3 arguments to SIMD store, got %u", numArgs); + + Scalar::Type viewType; + if (!CheckSimdLoadStoreArgs(f, call, &viewType)) + return false; + + Type retType = opType; + ParseNode* vecExpr = NextNode(NextNode(CallArgList(call))); + Type vecType; + if (!CheckExpr(f, vecExpr, &vecType)) + return false; + + if (!f.writeSimdOp(opType, op)) + return false; + + if (!WriteArrayAccessFlags(f, viewType)) + return false; + + if (!(vecType <= retType)) + return f.failf(vecExpr, "%s is not a subtype of %s", vecType.toChars(), retType.toChars()); + + *type = vecType; + return true; +} + +static bool +CheckSimdSelect(FunctionValidator& f, ParseNode* call, SimdType opType, Type* type) +{ + if (!CheckSimdCallArgs(f, call, 3, CheckSimdSelectArgs(opType))) + return false; + if (!f.writeSimdOp(opType, SimdOperation::Fn_select)) + return false; + *type = opType; + return true; +} + +static bool +CheckSimdAllTrue(FunctionValidator& f, ParseNode* call, SimdType opType, Type* type) +{ + if (!CheckSimdCallArgs(f, call, 1, CheckArgIsSubtypeOf(opType))) + return false; + if (!f.writeSimdOp(opType, SimdOperation::Fn_allTrue)) + return false; + *type = Type::Int; + return true; +} + +static bool +CheckSimdAnyTrue(FunctionValidator& f, ParseNode* call, SimdType opType, Type* type) +{ + if (!CheckSimdCallArgs(f, call, 1, CheckArgIsSubtypeOf(opType))) + return false; + if (!f.writeSimdOp(opType, SimdOperation::Fn_anyTrue)) + return false; + *type = Type::Int; + return true; +} + +static bool +CheckSimdCheck(FunctionValidator& f, ParseNode* call, SimdType opType, Type* type) +{ + Type coerceTo; + ParseNode* argNode; + if (!IsCoercionCall(f.m(), call, &coerceTo, &argNode)) + return f.failf(call, "expected 1 argument in call to check"); + return CheckCoercionArg(f, argNode, coerceTo, type); +} + +static bool +CheckSimdSplat(FunctionValidator& f, ParseNode* call, SimdType opType, Type* type) +{ + if (!CheckSimdCallArgs(f, call, 1, CheckSimdScalarArgs(opType))) + return false; + if (!f.writeSimdOp(opType, SimdOperation::Fn_splat)) + return false; + *type = opType; + return true; +} + +static bool +CheckSimdOperationCall(FunctionValidator& f, ParseNode* call, const ModuleValidator::Global* global, + Type* type) +{ + f.setUsesSimd(); + + MOZ_ASSERT(global->isSimdOperation()); + + SimdType opType = global->simdOperationType(); + + switch (SimdOperation op = global->simdOperation()) { + case SimdOperation::Fn_check: + return CheckSimdCheck(f, call, opType, type); + +#define _CASE(OP) case SimdOperation::Fn_##OP: + FOREACH_SHIFT_SIMD_OP(_CASE) + return CheckSimdBinaryShift(f, call, opType, op, type); + + FOREACH_COMP_SIMD_OP(_CASE) + return CheckSimdBinaryComp(f, call, opType, op, type); + + FOREACH_NUMERIC_SIMD_BINOP(_CASE) + FOREACH_FLOAT_SIMD_BINOP(_CASE) + FOREACH_BITWISE_SIMD_BINOP(_CASE) + FOREACH_SMINT_SIMD_BINOP(_CASE) + return CheckSimdBinary(f, call, opType, op, type); +#undef _CASE + + case SimdOperation::Fn_extractLane: + return CheckSimdExtractLane(f, call, opType, type); + case SimdOperation::Fn_replaceLane: + return CheckSimdReplaceLane(f, call, opType, type); + + case SimdOperation::Fn_fromInt8x16Bits: + return CheckSimdCast(f, call, SimdType::Int8x16, opType, op, type); + case SimdOperation::Fn_fromUint8x16Bits: + return CheckSimdCast(f, call, SimdType::Uint8x16, opType, op, type); + case SimdOperation::Fn_fromInt16x8Bits: + return CheckSimdCast(f, call, SimdType::Int16x8, opType, op, type); + case SimdOperation::Fn_fromUint16x8Bits: + return CheckSimdCast(f, call, SimdType::Uint16x8, opType, op, type); + case SimdOperation::Fn_fromInt32x4: + case SimdOperation::Fn_fromInt32x4Bits: + return CheckSimdCast(f, call, SimdType::Int32x4, opType, op, type); + case SimdOperation::Fn_fromUint32x4: + case SimdOperation::Fn_fromUint32x4Bits: + return CheckSimdCast(f, call, SimdType::Uint32x4, opType, op, type); + case SimdOperation::Fn_fromFloat32x4: + case SimdOperation::Fn_fromFloat32x4Bits: + return CheckSimdCast(f, call, SimdType::Float32x4, opType, op, type); + + case SimdOperation::Fn_abs: + case SimdOperation::Fn_neg: + case SimdOperation::Fn_not: + case SimdOperation::Fn_sqrt: + case SimdOperation::Fn_reciprocalApproximation: + case SimdOperation::Fn_reciprocalSqrtApproximation: + return CheckSimdUnary(f, call, opType, op, type); + + case SimdOperation::Fn_swizzle: + return CheckSimdSwizzle(f, call, opType, type); + case SimdOperation::Fn_shuffle: + return CheckSimdShuffle(f, call, opType, type); + + case SimdOperation::Fn_load: + case SimdOperation::Fn_load1: + case SimdOperation::Fn_load2: + return CheckSimdLoad(f, call, opType, op, type); + case SimdOperation::Fn_store: + case SimdOperation::Fn_store1: + case SimdOperation::Fn_store2: + return CheckSimdStore(f, call, opType, op, type); + + case SimdOperation::Fn_select: + return CheckSimdSelect(f, call, opType, type); + + case SimdOperation::Fn_splat: + return CheckSimdSplat(f, call, opType, type); + + case SimdOperation::Fn_allTrue: + return CheckSimdAllTrue(f, call, opType, type); + case SimdOperation::Fn_anyTrue: + return CheckSimdAnyTrue(f, call, opType, type); + + case SimdOperation::Fn_load3: + case SimdOperation::Fn_store3: + return f.fail(call, "asm.js does not support 3-element SIMD loads or stores"); + + case SimdOperation::Constructor: + MOZ_CRASH("constructors are handled in CheckSimdCtorCall"); + case SimdOperation::Fn_fromFloat64x2Bits: + MOZ_CRASH("NYI"); + } + MOZ_CRASH("unexpected simd operation in CheckSimdOperationCall"); +} + +static bool +CheckSimdCtorCall(FunctionValidator& f, ParseNode* call, const ModuleValidator::Global* global, + Type* type) +{ + f.setUsesSimd(); + + MOZ_ASSERT(call->isKind(PNK_CALL)); + + SimdType simdType = global->simdCtorType(); + unsigned length = GetSimdLanes(simdType); + if (!CheckSimdCallArgs(f, call, length, CheckSimdScalarArgs(simdType))) + return false; + + if (!f.writeSimdOp(simdType, SimdOperation::Constructor)) + return false; + + *type = simdType; + return true; +} + +static bool +CheckUncoercedCall(FunctionValidator& f, ParseNode* expr, Type* type) +{ + MOZ_ASSERT(expr->isKind(PNK_CALL)); + + const ModuleValidator::Global* global; + if (IsCallToGlobal(f.m(), expr, &global)) { + if (global->isMathFunction()) + return CheckMathBuiltinCall(f, expr, global->mathBuiltinFunction(), type); + if (global->isAtomicsFunction()) + return CheckAtomicsBuiltinCall(f, expr, global->atomicsBuiltinFunction(), type); + if (global->isSimdCtor()) + return CheckSimdCtorCall(f, expr, global, type); + if (global->isSimdOperation()) + return CheckSimdOperationCall(f, expr, global, type); + } + + return f.fail(expr, "all function calls must either be calls to standard lib math functions, " + "standard atomic functions, standard SIMD constructors or operations, " + "ignored (via f(); or comma-expression), coerced to signed (via f()|0), " + "coerced to float (via fround(f())) or coerced to double (via +f())"); +} + +static bool +CoerceResult(FunctionValidator& f, ParseNode* expr, Type expected, Type actual, + Type* type) +{ + MOZ_ASSERT(expected.isCanonical()); + + // At this point, the bytecode resembles this: + // | the thing we wanted to coerce | current position |> + switch (expected.which()) { + case Type::Void: + if (!actual.isVoid()) { + if (!f.encoder().writeOp(Op::Drop)) + return false; + } + break; + case Type::Int: + if (!actual.isIntish()) + return f.failf(expr, "%s is not a subtype of intish", actual.toChars()); + break; + case Type::Float: + if (!CheckFloatCoercionArg(f, expr, actual)) + return false; + break; + case Type::Double: + if (actual.isMaybeDouble()) { + // No conversion necessary. + } else if (actual.isMaybeFloat()) { + if (!f.encoder().writeOp(Op::F64PromoteF32)) + return false; + } else if (actual.isSigned()) { + if (!f.encoder().writeOp(Op::F64ConvertSI32)) + return false; + } else if (actual.isUnsigned()) { + if (!f.encoder().writeOp(Op::F64ConvertUI32)) + return false; + } else { + return f.failf(expr, "%s is not a subtype of double?, float?, signed or unsigned", actual.toChars()); + } + break; + default: + MOZ_ASSERT(expected.isSimd(), "Incomplete switch"); + if (actual != expected) + return f.failf(expr, "got type %s, expected %s", actual.toChars(), expected.toChars()); + break; + } + + *type = Type::ret(expected); + return true; +} + +static bool +CheckCoercedMathBuiltinCall(FunctionValidator& f, ParseNode* callNode, AsmJSMathBuiltinFunction func, + Type ret, Type* type) +{ + Type actual; + if (!CheckMathBuiltinCall(f, callNode, func, &actual)) + return false; + return CoerceResult(f, callNode, ret, actual, type); +} + +static bool +CheckCoercedSimdCall(FunctionValidator& f, ParseNode* call, const ModuleValidator::Global* global, + Type ret, Type* type) +{ + MOZ_ASSERT(ret.isCanonical()); + + Type actual; + if (global->isSimdCtor()) { + if (!CheckSimdCtorCall(f, call, global, &actual)) + return false; + MOZ_ASSERT(actual.isSimd()); + } else { + MOZ_ASSERT(global->isSimdOperation()); + if (!CheckSimdOperationCall(f, call, global, &actual)) + return false; + } + + return CoerceResult(f, call, ret, actual, type); +} + +static bool +CheckCoercedAtomicsBuiltinCall(FunctionValidator& f, ParseNode* callNode, + AsmJSAtomicsBuiltinFunction func, Type ret, Type* type) +{ + MOZ_ASSERT(ret.isCanonical()); + + Type actual; + if (!CheckAtomicsBuiltinCall(f, callNode, func, &actual)) + return false; + return CoerceResult(f, callNode, ret, actual, type); +} + +static bool +CheckCoercedCall(FunctionValidator& f, ParseNode* call, Type ret, Type* type) +{ + MOZ_ASSERT(ret.isCanonical()); + + JS_CHECK_RECURSION_DONT_REPORT(f.cx(), return f.m().failOverRecursed()); + + bool isSimd = false; + if (IsNumericLiteral(f.m(), call, &isSimd)) { + if (isSimd) + f.setUsesSimd(); + NumLit lit = ExtractNumericLiteral(f.m(), call); + if (!f.writeConstExpr(lit)) + return false; + return CoerceResult(f, call, ret, Type::lit(lit), type); + } + + ParseNode* callee = CallCallee(call); + + if (callee->isKind(PNK_ELEM)) + return CheckFuncPtrCall(f, call, ret, type); + + if (!callee->isKind(PNK_NAME)) + return f.fail(callee, "unexpected callee expression type"); + + PropertyName* calleeName = callee->name(); + + if (const ModuleValidator::Global* global = f.lookupGlobal(calleeName)) { + switch (global->which()) { + case ModuleValidator::Global::FFI: + return CheckFFICall(f, call, global->ffiIndex(), ret, type); + case ModuleValidator::Global::MathBuiltinFunction: + return CheckCoercedMathBuiltinCall(f, call, global->mathBuiltinFunction(), ret, type); + case ModuleValidator::Global::AtomicsBuiltinFunction: + return CheckCoercedAtomicsBuiltinCall(f, call, global->atomicsBuiltinFunction(), ret, type); + case ModuleValidator::Global::ConstantLiteral: + case ModuleValidator::Global::ConstantImport: + case ModuleValidator::Global::Variable: + case ModuleValidator::Global::FuncPtrTable: + case ModuleValidator::Global::ArrayView: + case ModuleValidator::Global::ArrayViewCtor: + return f.failName(callee, "'%s' is not callable function", callee->name()); + case ModuleValidator::Global::SimdCtor: + case ModuleValidator::Global::SimdOp: + return CheckCoercedSimdCall(f, call, global, ret, type); + case ModuleValidator::Global::Function: + break; + } + } + + return CheckInternalCall(f, call, calleeName, ret, type); +} + +static bool +CheckPos(FunctionValidator& f, ParseNode* pos, Type* type) +{ + MOZ_ASSERT(pos->isKind(PNK_POS)); + ParseNode* operand = UnaryKid(pos); + + if (operand->isKind(PNK_CALL)) + return CheckCoercedCall(f, operand, Type::Double, type); + + Type actual; + if (!CheckExpr(f, operand, &actual)) + return false; + + return CoerceResult(f, operand, Type::Double, actual, type); +} + +static bool +CheckNot(FunctionValidator& f, ParseNode* expr, Type* type) +{ + MOZ_ASSERT(expr->isKind(PNK_NOT)); + ParseNode* operand = UnaryKid(expr); + + Type operandType; + if (!CheckExpr(f, operand, &operandType)) + return false; + + if (!operandType.isInt()) + return f.failf(operand, "%s is not a subtype of int", operandType.toChars()); + + *type = Type::Int; + return f.encoder().writeOp(Op::I32Eqz); +} + +static bool +CheckNeg(FunctionValidator& f, ParseNode* expr, Type* type) +{ + MOZ_ASSERT(expr->isKind(PNK_NEG)); + ParseNode* operand = UnaryKid(expr); + + Type operandType; + if (!CheckExpr(f, operand, &operandType)) + return false; + + if (operandType.isInt()) { + *type = Type::Intish; + return f.encoder().writeOp(Op::I32Neg); + } + + if (operandType.isMaybeDouble()) { + *type = Type::Double; + return f.encoder().writeOp(Op::F64Neg); + } + + if (operandType.isMaybeFloat()) { + *type = Type::Floatish; + return f.encoder().writeOp(Op::F32Neg); + } + + return f.failf(operand, "%s is not a subtype of int, float? or double?", operandType.toChars()); +} + +static bool +CheckCoerceToInt(FunctionValidator& f, ParseNode* expr, Type* type) +{ + MOZ_ASSERT(expr->isKind(PNK_BITNOT)); + ParseNode* operand = UnaryKid(expr); + + Type operandType; + if (!CheckExpr(f, operand, &operandType)) + return false; + + if (operandType.isMaybeDouble() || operandType.isMaybeFloat()) { + *type = Type::Signed; + Op opcode = operandType.isMaybeDouble() ? Op::I32TruncSF64 : Op::I32TruncSF32; + return f.encoder().writeOp(opcode); + } + + if (!operandType.isIntish()) + return f.failf(operand, "%s is not a subtype of double?, float? or intish", operandType.toChars()); + + *type = Type::Signed; + return true; +} + +static bool +CheckBitNot(FunctionValidator& f, ParseNode* neg, Type* type) +{ + MOZ_ASSERT(neg->isKind(PNK_BITNOT)); + ParseNode* operand = UnaryKid(neg); + + if (operand->isKind(PNK_BITNOT)) + return CheckCoerceToInt(f, operand, type); + + Type operandType; + if (!CheckExpr(f, operand, &operandType)) + return false; + + if (!operandType.isIntish()) + return f.failf(operand, "%s is not a subtype of intish", operandType.toChars()); + + if (!f.encoder().writeOp(Op::I32BitNot)) + return false; + + *type = Type::Signed; + return true; +} + +static bool +CheckAsExprStatement(FunctionValidator& f, ParseNode* exprStmt); + +static bool +CheckComma(FunctionValidator& f, ParseNode* comma, Type* type) +{ + MOZ_ASSERT(comma->isKind(PNK_COMMA)); + ParseNode* operands = ListHead(comma); + + // The block depth isn't taken into account here, because a comma list can't + // contain breaks and continues and nested control flow structures. + if (!f.encoder().writeOp(Op::Block)) + return false; + + size_t typeAt; + if (!f.encoder().writePatchableFixedU7(&typeAt)) + return false; + + ParseNode* pn = operands; + for (; NextNode(pn); pn = NextNode(pn)) { + if (!CheckAsExprStatement(f, pn)) + return false; + } + + if (!CheckExpr(f, pn, type)) + return false; + + f.encoder().patchFixedU7(typeAt, uint8_t(type->toWasmBlockSignatureType())); + + return f.encoder().writeOp(Op::End); +} + +static bool +CheckConditional(FunctionValidator& f, ParseNode* ternary, Type* type) +{ + MOZ_ASSERT(ternary->isKind(PNK_CONDITIONAL)); + + ParseNode* cond = TernaryKid1(ternary); + ParseNode* thenExpr = TernaryKid2(ternary); + ParseNode* elseExpr = TernaryKid3(ternary); + + Type condType; + if (!CheckExpr(f, cond, &condType)) + return false; + + if (!condType.isInt()) + return f.failf(cond, "%s is not a subtype of int", condType.toChars()); + + size_t typeAt; + if (!f.pushIf(&typeAt)) + return false; + + Type thenType; + if (!CheckExpr(f, thenExpr, &thenType)) + return false; + + if (!f.switchToElse()) + return false; + + Type elseType; + if (!CheckExpr(f, elseExpr, &elseType)) + return false; + + if (thenType.isInt() && elseType.isInt()) { + *type = Type::Int; + } else if (thenType.isDouble() && elseType.isDouble()) { + *type = Type::Double; + } else if (thenType.isFloat() && elseType.isFloat()) { + *type = Type::Float; + } else if (thenType.isSimd() && elseType == thenType) { + *type = thenType; + } else { + return f.failf(ternary, "then/else branches of conditional must both produce int, float, " + "double or SIMD types, current types are %s and %s", + thenType.toChars(), elseType.toChars()); + } + + if (!f.popIf(typeAt, type->toWasmBlockSignatureType())) + return false; + + return true; +} + +static bool +IsValidIntMultiplyConstant(ModuleValidator& m, ParseNode* expr) +{ + if (!IsNumericLiteral(m, expr)) + return false; + + NumLit lit = ExtractNumericLiteral(m, expr); + switch (lit.which()) { + case NumLit::Fixnum: + case NumLit::NegativeInt: + if (abs(lit.toInt32()) < (1<<20)) + return true; + return false; + case NumLit::BigUnsigned: + case NumLit::Double: + case NumLit::Float: + case NumLit::OutOfRangeInt: + case NumLit::Int8x16: + case NumLit::Uint8x16: + case NumLit::Int16x8: + case NumLit::Uint16x8: + case NumLit::Int32x4: + case NumLit::Uint32x4: + case NumLit::Float32x4: + case NumLit::Bool8x16: + case NumLit::Bool16x8: + case NumLit::Bool32x4: + return false; + } + + MOZ_MAKE_COMPILER_ASSUME_IS_UNREACHABLE("Bad literal"); +} + +static bool +CheckMultiply(FunctionValidator& f, ParseNode* star, Type* type) +{ + MOZ_ASSERT(star->isKind(PNK_STAR)); + ParseNode* lhs = MultiplyLeft(star); + ParseNode* rhs = MultiplyRight(star); + + Type lhsType; + if (!CheckExpr(f, lhs, &lhsType)) + return false; + + Type rhsType; + if (!CheckExpr(f, rhs, &rhsType)) + return false; + + if (lhsType.isInt() && rhsType.isInt()) { + if (!IsValidIntMultiplyConstant(f.m(), lhs) && !IsValidIntMultiplyConstant(f.m(), rhs)) + return f.fail(star, "one arg to int multiply must be a small (-2^20, 2^20) int literal"); + *type = Type::Intish; + return f.encoder().writeOp(Op::I32Mul); + } + + if (lhsType.isMaybeDouble() && rhsType.isMaybeDouble()) { + *type = Type::Double; + return f.encoder().writeOp(Op::F64Mul); + } + + if (lhsType.isMaybeFloat() && rhsType.isMaybeFloat()) { + *type = Type::Floatish; + return f.encoder().writeOp(Op::F32Mul); + } + + return f.fail(star, "multiply operands must be both int, both double? or both float?"); +} + +static bool +CheckAddOrSub(FunctionValidator& f, ParseNode* expr, Type* type, unsigned* numAddOrSubOut = nullptr) +{ + JS_CHECK_RECURSION_DONT_REPORT(f.cx(), return f.m().failOverRecursed()); + + MOZ_ASSERT(expr->isKind(PNK_ADD) || expr->isKind(PNK_SUB)); + ParseNode* lhs = AddSubLeft(expr); + ParseNode* rhs = AddSubRight(expr); + + Type lhsType, rhsType; + unsigned lhsNumAddOrSub, rhsNumAddOrSub; + + if (lhs->isKind(PNK_ADD) || lhs->isKind(PNK_SUB)) { + if (!CheckAddOrSub(f, lhs, &lhsType, &lhsNumAddOrSub)) + return false; + if (lhsType == Type::Intish) + lhsType = Type::Int; + } else { + if (!CheckExpr(f, lhs, &lhsType)) + return false; + lhsNumAddOrSub = 0; + } + + if (rhs->isKind(PNK_ADD) || rhs->isKind(PNK_SUB)) { + if (!CheckAddOrSub(f, rhs, &rhsType, &rhsNumAddOrSub)) + return false; + if (rhsType == Type::Intish) + rhsType = Type::Int; + } else { + if (!CheckExpr(f, rhs, &rhsType)) + return false; + rhsNumAddOrSub = 0; + } + + unsigned numAddOrSub = lhsNumAddOrSub + rhsNumAddOrSub + 1; + if (numAddOrSub > (1<<20)) + return f.fail(expr, "too many + or - without intervening coercion"); + + if (lhsType.isInt() && rhsType.isInt()) { + if (!f.encoder().writeOp(expr->isKind(PNK_ADD) ? Op::I32Add : Op::I32Sub)) + return false; + *type = Type::Intish; + } else if (lhsType.isMaybeDouble() && rhsType.isMaybeDouble()) { + if (!f.encoder().writeOp(expr->isKind(PNK_ADD) ? Op::F64Add : Op::F64Sub)) + return false; + *type = Type::Double; + } else if (lhsType.isMaybeFloat() && rhsType.isMaybeFloat()) { + if (!f.encoder().writeOp(expr->isKind(PNK_ADD) ? Op::F32Add : Op::F32Sub)) + return false; + *type = Type::Floatish; + } else { + return f.failf(expr, "operands to + or - must both be int, float? or double?, got %s and %s", + lhsType.toChars(), rhsType.toChars()); + } + + if (numAddOrSubOut) + *numAddOrSubOut = numAddOrSub; + return true; +} + +static bool +CheckDivOrMod(FunctionValidator& f, ParseNode* expr, Type* type) +{ + MOZ_ASSERT(expr->isKind(PNK_DIV) || expr->isKind(PNK_MOD)); + + ParseNode* lhs = DivOrModLeft(expr); + ParseNode* rhs = DivOrModRight(expr); + + Type lhsType, rhsType; + if (!CheckExpr(f, lhs, &lhsType)) + return false; + if (!CheckExpr(f, rhs, &rhsType)) + return false; + + if (lhsType.isMaybeDouble() && rhsType.isMaybeDouble()) { + *type = Type::Double; + return f.encoder().writeOp(expr->isKind(PNK_DIV) ? Op::F64Div : Op::F64Mod); + } + + if (lhsType.isMaybeFloat() && rhsType.isMaybeFloat()) { + *type = Type::Floatish; + if (expr->isKind(PNK_DIV)) + return f.encoder().writeOp(Op::F32Div); + else + return f.fail(expr, "modulo cannot receive float arguments"); + } + + if (lhsType.isSigned() && rhsType.isSigned()) { + *type = Type::Intish; + return f.encoder().writeOp(expr->isKind(PNK_DIV) ? Op::I32DivS : Op::I32RemS); + } + + if (lhsType.isUnsigned() && rhsType.isUnsigned()) { + *type = Type::Intish; + return f.encoder().writeOp(expr->isKind(PNK_DIV) ? Op::I32DivU : Op::I32RemU); + } + + return f.failf(expr, "arguments to / or %% must both be double?, float?, signed, or unsigned; " + "%s and %s are given", lhsType.toChars(), rhsType.toChars()); +} + +static bool +CheckComparison(FunctionValidator& f, ParseNode* comp, Type* type) +{ + MOZ_ASSERT(comp->isKind(PNK_LT) || comp->isKind(PNK_LE) || comp->isKind(PNK_GT) || + comp->isKind(PNK_GE) || comp->isKind(PNK_EQ) || comp->isKind(PNK_NE)); + + ParseNode* lhs = ComparisonLeft(comp); + ParseNode* rhs = ComparisonRight(comp); + + Type lhsType, rhsType; + if (!CheckExpr(f, lhs, &lhsType)) + return false; + if (!CheckExpr(f, rhs, &rhsType)) + return false; + + if (!(lhsType.isSigned() && rhsType.isSigned()) && + !(lhsType.isUnsigned() && rhsType.isUnsigned()) && + !(lhsType.isDouble() && rhsType.isDouble()) && + !(lhsType.isFloat() && rhsType.isFloat())) + { + return f.failf(comp, "arguments to a comparison must both be signed, unsigned, floats or doubles; " + "%s and %s are given", lhsType.toChars(), rhsType.toChars()); + } + + Op stmt; + if (lhsType.isSigned() && rhsType.isSigned()) { + switch (comp->getOp()) { + case JSOP_EQ: stmt = Op::I32Eq; break; + case JSOP_NE: stmt = Op::I32Ne; break; + case JSOP_LT: stmt = Op::I32LtS; break; + case JSOP_LE: stmt = Op::I32LeS; break; + case JSOP_GT: stmt = Op::I32GtS; break; + case JSOP_GE: stmt = Op::I32GeS; break; + default: MOZ_CRASH("unexpected comparison op"); + } + } else if (lhsType.isUnsigned() && rhsType.isUnsigned()) { + switch (comp->getOp()) { + case JSOP_EQ: stmt = Op::I32Eq; break; + case JSOP_NE: stmt = Op::I32Ne; break; + case JSOP_LT: stmt = Op::I32LtU; break; + case JSOP_LE: stmt = Op::I32LeU; break; + case JSOP_GT: stmt = Op::I32GtU; break; + case JSOP_GE: stmt = Op::I32GeU; break; + default: MOZ_CRASH("unexpected comparison op"); + } + } else if (lhsType.isDouble()) { + switch (comp->getOp()) { + case JSOP_EQ: stmt = Op::F64Eq; break; + case JSOP_NE: stmt = Op::F64Ne; break; + case JSOP_LT: stmt = Op::F64Lt; break; + case JSOP_LE: stmt = Op::F64Le; break; + case JSOP_GT: stmt = Op::F64Gt; break; + case JSOP_GE: stmt = Op::F64Ge; break; + default: MOZ_CRASH("unexpected comparison op"); + } + } else if (lhsType.isFloat()) { + switch (comp->getOp()) { + case JSOP_EQ: stmt = Op::F32Eq; break; + case JSOP_NE: stmt = Op::F32Ne; break; + case JSOP_LT: stmt = Op::F32Lt; break; + case JSOP_LE: stmt = Op::F32Le; break; + case JSOP_GT: stmt = Op::F32Gt; break; + case JSOP_GE: stmt = Op::F32Ge; break; + default: MOZ_CRASH("unexpected comparison op"); + } + } else { + MOZ_CRASH("unexpected type"); + } + + *type = Type::Int; + return f.encoder().writeOp(stmt); +} + +static bool +CheckBitwise(FunctionValidator& f, ParseNode* bitwise, Type* type) +{ + ParseNode* lhs = BitwiseLeft(bitwise); + ParseNode* rhs = BitwiseRight(bitwise); + + int32_t identityElement; + bool onlyOnRight; + switch (bitwise->getKind()) { + case PNK_BITOR: identityElement = 0; onlyOnRight = false; *type = Type::Signed; break; + case PNK_BITAND: identityElement = -1; onlyOnRight = false; *type = Type::Signed; break; + case PNK_BITXOR: identityElement = 0; onlyOnRight = false; *type = Type::Signed; break; + case PNK_LSH: identityElement = 0; onlyOnRight = true; *type = Type::Signed; break; + case PNK_RSH: identityElement = 0; onlyOnRight = true; *type = Type::Signed; break; + case PNK_URSH: identityElement = 0; onlyOnRight = true; *type = Type::Unsigned; break; + default: MOZ_CRASH("not a bitwise op"); + } + + uint32_t i; + if (!onlyOnRight && IsLiteralInt(f.m(), lhs, &i) && i == uint32_t(identityElement)) { + Type rhsType; + if (!CheckExpr(f, rhs, &rhsType)) + return false; + if (!rhsType.isIntish()) + return f.failf(bitwise, "%s is not a subtype of intish", rhsType.toChars()); + return true; + } + + if (IsLiteralInt(f.m(), rhs, &i) && i == uint32_t(identityElement)) { + if (bitwise->isKind(PNK_BITOR) && lhs->isKind(PNK_CALL)) + return CheckCoercedCall(f, lhs, Type::Int, type); + + Type lhsType; + if (!CheckExpr(f, lhs, &lhsType)) + return false; + if (!lhsType.isIntish()) + return f.failf(bitwise, "%s is not a subtype of intish", lhsType.toChars()); + return true; + } + + Type lhsType; + if (!CheckExpr(f, lhs, &lhsType)) + return false; + + Type rhsType; + if (!CheckExpr(f, rhs, &rhsType)) + return false; + + if (!lhsType.isIntish()) + return f.failf(lhs, "%s is not a subtype of intish", lhsType.toChars()); + if (!rhsType.isIntish()) + return f.failf(rhs, "%s is not a subtype of intish", rhsType.toChars()); + + switch (bitwise->getKind()) { + case PNK_BITOR: if (!f.encoder().writeOp(Op::I32Or)) return false; break; + case PNK_BITAND: if (!f.encoder().writeOp(Op::I32And)) return false; break; + case PNK_BITXOR: if (!f.encoder().writeOp(Op::I32Xor)) return false; break; + case PNK_LSH: if (!f.encoder().writeOp(Op::I32Shl)) return false; break; + case PNK_RSH: if (!f.encoder().writeOp(Op::I32ShrS)) return false; break; + case PNK_URSH: if (!f.encoder().writeOp(Op::I32ShrU)) return false; break; + default: MOZ_CRASH("not a bitwise op"); + } + + return true; +} + +static bool +CheckExpr(FunctionValidator& f, ParseNode* expr, Type* type) +{ + JS_CHECK_RECURSION_DONT_REPORT(f.cx(), return f.m().failOverRecursed()); + + bool isSimd = false; + if (IsNumericLiteral(f.m(), expr, &isSimd)) { + if (isSimd) + f.setUsesSimd(); + return CheckNumericLiteral(f, expr, type); + } + + switch (expr->getKind()) { + case PNK_NAME: return CheckVarRef(f, expr, type); + case PNK_ELEM: return CheckLoadArray(f, expr, type); + case PNK_ASSIGN: return CheckAssign(f, expr, type); + case PNK_POS: return CheckPos(f, expr, type); + case PNK_NOT: return CheckNot(f, expr, type); + case PNK_NEG: return CheckNeg(f, expr, type); + case PNK_BITNOT: return CheckBitNot(f, expr, type); + case PNK_COMMA: return CheckComma(f, expr, type); + case PNK_CONDITIONAL: return CheckConditional(f, expr, type); + case PNK_STAR: return CheckMultiply(f, expr, type); + case PNK_CALL: return CheckUncoercedCall(f, expr, type); + + case PNK_ADD: + case PNK_SUB: return CheckAddOrSub(f, expr, type); + + case PNK_DIV: + case PNK_MOD: return CheckDivOrMod(f, expr, type); + + case PNK_LT: + case PNK_LE: + case PNK_GT: + case PNK_GE: + case PNK_EQ: + case PNK_NE: return CheckComparison(f, expr, type); + + case PNK_BITOR: + case PNK_BITAND: + case PNK_BITXOR: + case PNK_LSH: + case PNK_RSH: + case PNK_URSH: return CheckBitwise(f, expr, type); + + default:; + } + + return f.fail(expr, "unsupported expression"); +} + +static bool +CheckStatement(FunctionValidator& f, ParseNode* stmt); + +static bool +CheckAsExprStatement(FunctionValidator& f, ParseNode* expr) +{ + if (expr->isKind(PNK_CALL)) { + Type ignored; + return CheckCoercedCall(f, expr, Type::Void, &ignored); + } + + Type resultType; + if (!CheckExpr(f, expr, &resultType)) + return false; + + if (!resultType.isVoid()) { + if (!f.encoder().writeOp(Op::Drop)) + return false; + } + + return true; +} + +static bool +CheckExprStatement(FunctionValidator& f, ParseNode* exprStmt) +{ + MOZ_ASSERT(exprStmt->isKind(PNK_SEMI)); + ParseNode* expr = UnaryKid(exprStmt); + if (!expr) + return true; + return CheckAsExprStatement(f, expr); +} + +static bool +CheckLoopConditionOnEntry(FunctionValidator& f, ParseNode* cond) +{ + uint32_t maybeLit; + if (IsLiteralInt(f.m(), cond, &maybeLit) && maybeLit) + return true; + + Type condType; + if (!CheckExpr(f, cond, &condType)) + return false; + if (!condType.isInt()) + return f.failf(cond, "%s is not a subtype of int", condType.toChars()); + + // TODO change this to i32.eqz + // i32.eq 0 $f + if (!f.writeInt32Lit(0)) + return false; + if (!f.encoder().writeOp(Op::I32Eq)) + return false; + + // brIf (i32.eq 0 $f) $out + if (!f.writeBreakIf()) + return false; + + return true; +} + +static bool +CheckWhile(FunctionValidator& f, ParseNode* whileStmt, const NameVector* labels = nullptr) +{ + MOZ_ASSERT(whileStmt->isKind(PNK_WHILE)); + ParseNode* cond = BinaryLeft(whileStmt); + ParseNode* body = BinaryRight(whileStmt); + + // A while loop `while(#cond) #body` is equivalent to: + // (block $after_loop + // (loop $top + // (brIf $after_loop (i32.eq 0 #cond)) + // #body + // (br $top) + // ) + // ) + if (labels && !f.addLabels(*labels, 0, 1)) + return false; + + if (!f.pushLoop()) + return false; + + if (!CheckLoopConditionOnEntry(f, cond)) + return false; + if (!CheckStatement(f, body)) + return false; + if (!f.writeContinue()) + return false; + + if (!f.popLoop()) + return false; + if (labels) + f.removeLabels(*labels); + return true; +} + +static bool +CheckFor(FunctionValidator& f, ParseNode* forStmt, const NameVector* labels = nullptr) +{ + MOZ_ASSERT(forStmt->isKind(PNK_FOR)); + ParseNode* forHead = BinaryLeft(forStmt); + ParseNode* body = BinaryRight(forStmt); + + if (!forHead->isKind(PNK_FORHEAD)) + return f.fail(forHead, "unsupported for-loop statement"); + + ParseNode* maybeInit = TernaryKid1(forHead); + ParseNode* maybeCond = TernaryKid2(forHead); + ParseNode* maybeInc = TernaryKid3(forHead); + + // A for-loop `for (#init; #cond; #inc) #body` is equivalent to: + // (block // depth X + // (#init) + // (block $after_loop // depth X+1 (block) + // (loop $loop_top // depth X+2 (loop) + // (brIf $after (eq 0 #cond)) + // (block $after_body #body) // depth X+3 + // #inc + // (br $loop_top) + // ) + // ) + // ) + // A break in the body should break out to $after_loop, i.e. depth + 1. + // A continue in the body should break out to $after_body, i.e. depth + 3. + if (labels && !f.addLabels(*labels, 1, 3)) + return false; + + if (!f.pushUnbreakableBlock()) + return false; + + if (maybeInit && !CheckAsExprStatement(f, maybeInit)) + return false; + + { + if (!f.pushLoop()) + return false; + + if (maybeCond && !CheckLoopConditionOnEntry(f, maybeCond)) + return false; + + { + // Continuing in the body should just break out to the increment. + if (!f.pushContinuableBlock()) + return false; + if (!CheckStatement(f, body)) + return false; + if (!f.popContinuableBlock()) + return false; + } + + if (maybeInc && !CheckAsExprStatement(f, maybeInc)) + return false; + + if (!f.writeContinue()) + return false; + if (!f.popLoop()) + return false; + } + + if (!f.popUnbreakableBlock()) + return false; + + if (labels) + f.removeLabels(*labels); + + return true; +} + +static bool +CheckDoWhile(FunctionValidator& f, ParseNode* whileStmt, const NameVector* labels = nullptr) +{ + MOZ_ASSERT(whileStmt->isKind(PNK_DOWHILE)); + ParseNode* body = BinaryLeft(whileStmt); + ParseNode* cond = BinaryRight(whileStmt); + + // A do-while loop `do { #body } while (#cond)` is equivalent to: + // (block $after_loop // depth X + // (loop $top // depth X+1 + // (block #body) // depth X+2 + // (brIf #cond $top) + // ) + // ) + // A break should break out of the entire loop, i.e. at depth 0. + // A continue should break out to the condition, i.e. at depth 2. + if (labels && !f.addLabels(*labels, 0, 2)) + return false; + + if (!f.pushLoop()) + return false; + + { + // An unlabeled continue in the body should break out to the condition. + if (!f.pushContinuableBlock()) + return false; + if (!CheckStatement(f, body)) + return false; + if (!f.popContinuableBlock()) + return false; + } + + Type condType; + if (!CheckExpr(f, cond, &condType)) + return false; + if (!condType.isInt()) + return f.failf(cond, "%s is not a subtype of int", condType.toChars()); + + if (!f.writeContinueIf()) + return false; + + if (!f.popLoop()) + return false; + if (labels) + f.removeLabels(*labels); + return true; +} + +static bool CheckStatementList(FunctionValidator& f, ParseNode*, const NameVector* = nullptr); + +static bool +CheckLabel(FunctionValidator& f, ParseNode* labeledStmt) +{ + MOZ_ASSERT(labeledStmt->isKind(PNK_LABEL)); + + NameVector labels; + ParseNode* innermost = labeledStmt; + do { + if (!labels.append(LabeledStatementLabel(innermost))) + return false; + innermost = LabeledStatementStatement(innermost); + } while (innermost->getKind() == PNK_LABEL); + + switch (innermost->getKind()) { + case PNK_FOR: + return CheckFor(f, innermost, &labels); + case PNK_DOWHILE: + return CheckDoWhile(f, innermost, &labels); + case PNK_WHILE: + return CheckWhile(f, innermost, &labels); + case PNK_STATEMENTLIST: + return CheckStatementList(f, innermost, &labels); + default: + break; + } + + if (!f.pushUnbreakableBlock(&labels)) + return false; + + if (!CheckStatement(f, innermost)) + return false; + + if (!f.popUnbreakableBlock(&labels)) + return false; + return true; +} + +static bool +CheckIf(FunctionValidator& f, ParseNode* ifStmt) +{ + uint32_t numIfEnd = 1; + + recurse: + MOZ_ASSERT(ifStmt->isKind(PNK_IF)); + ParseNode* cond = TernaryKid1(ifStmt); + ParseNode* thenStmt = TernaryKid2(ifStmt); + ParseNode* elseStmt = TernaryKid3(ifStmt); + + Type condType; + if (!CheckExpr(f, cond, &condType)) + return false; + if (!condType.isInt()) + return f.failf(cond, "%s is not a subtype of int", condType.toChars()); + + size_t typeAt; + if (!f.pushIf(&typeAt)) + return false; + + f.setIfType(typeAt, ExprType::Void); + + if (!CheckStatement(f, thenStmt)) + return false; + + if (elseStmt) { + if (!f.switchToElse()) + return false; + + if (elseStmt->isKind(PNK_IF)) { + ifStmt = elseStmt; + if (numIfEnd++ == UINT32_MAX) + return false; + goto recurse; + } + + if (!CheckStatement(f, elseStmt)) + return false; + } + + for (uint32_t i = 0; i != numIfEnd; ++i) { + if (!f.popIf()) + return false; + } + + return true; +} + +static bool +CheckCaseExpr(FunctionValidator& f, ParseNode* caseExpr, int32_t* value) +{ + if (!IsNumericLiteral(f.m(), caseExpr)) + return f.fail(caseExpr, "switch case expression must be an integer literal"); + + NumLit lit = ExtractNumericLiteral(f.m(), caseExpr); + switch (lit.which()) { + case NumLit::Fixnum: + case NumLit::NegativeInt: + *value = lit.toInt32(); + break; + case NumLit::OutOfRangeInt: + case NumLit::BigUnsigned: + return f.fail(caseExpr, "switch case expression out of integer range"); + case NumLit::Double: + case NumLit::Float: + case NumLit::Int8x16: + case NumLit::Uint8x16: + case NumLit::Int16x8: + case NumLit::Uint16x8: + case NumLit::Int32x4: + case NumLit::Uint32x4: + case NumLit::Float32x4: + case NumLit::Bool8x16: + case NumLit::Bool16x8: + case NumLit::Bool32x4: + return f.fail(caseExpr, "switch case expression must be an integer literal"); + } + + return true; +} + +static bool +CheckDefaultAtEnd(FunctionValidator& f, ParseNode* stmt) +{ + for (; stmt; stmt = NextNode(stmt)) { + if (IsDefaultCase(stmt) && NextNode(stmt) != nullptr) + return f.fail(stmt, "default label must be at the end"); + } + + return true; +} + +static bool +CheckSwitchRange(FunctionValidator& f, ParseNode* stmt, int32_t* low, int32_t* high, + uint32_t* tableLength) +{ + if (IsDefaultCase(stmt)) { + *low = 0; + *high = -1; + *tableLength = 0; + return true; + } + + int32_t i = 0; + if (!CheckCaseExpr(f, CaseExpr(stmt), &i)) + return false; + + *low = *high = i; + + ParseNode* initialStmt = stmt; + for (stmt = NextNode(stmt); stmt && !IsDefaultCase(stmt); stmt = NextNode(stmt)) { + int32_t i = 0; + if (!CheckCaseExpr(f, CaseExpr(stmt), &i)) + return false; + + *low = Min(*low, i); + *high = Max(*high, i); + } + + int64_t i64 = (int64_t(*high) - int64_t(*low)) + 1; + if (i64 > MaxBrTableElems) + return f.fail(initialStmt, "all switch statements generate tables; this table would be too big"); + + *tableLength = uint32_t(i64); + return true; +} + +static bool +CheckSwitchExpr(FunctionValidator& f, ParseNode* switchExpr) +{ + Type exprType; + if (!CheckExpr(f, switchExpr, &exprType)) + return false; + if (!exprType.isSigned()) + return f.failf(switchExpr, "%s is not a subtype of signed", exprType.toChars()); + return true; +} + +// A switch will be constructed as: +// - the default block wrapping all the other blocks, to be able to break +// out of the switch with an unlabeled break statement. It has two statements +// (an inner block and the default expr). asm.js rules require default to be at +// the end, so the default block always encloses all the cases blocks. +// - one block per case between low and high; undefined cases just jump to the +// default case. Each of these blocks contain two statements: the next case's +// block and the possibly empty statement list comprising the case body. The +// last block pushed is the first case so the (relative) branch target therefore +// matches the sequential order of cases. +// - one block for the br_table, so that the first break goes to the first +// case's block. +static bool +CheckSwitch(FunctionValidator& f, ParseNode* switchStmt) +{ + MOZ_ASSERT(switchStmt->isKind(PNK_SWITCH)); + + ParseNode* switchExpr = BinaryLeft(switchStmt); + ParseNode* switchBody = BinaryRight(switchStmt); + + if (switchBody->isKind(PNK_LEXICALSCOPE)) { + if (!switchBody->isEmptyScope()) + return f.fail(switchBody, "switch body may not contain lexical declarations"); + switchBody = switchBody->scopeBody(); + } + + ParseNode* stmt = ListHead(switchBody); + if (!stmt) { + if (!CheckSwitchExpr(f, switchExpr)) + return false; + if (!f.encoder().writeOp(Op::Drop)) + return false; + return true; + } + + if (!CheckDefaultAtEnd(f, stmt)) + return false; + + int32_t low = 0, high = 0; + uint32_t tableLength = 0; + if (!CheckSwitchRange(f, stmt, &low, &high, &tableLength)) + return false; + + static const uint32_t CASE_NOT_DEFINED = UINT32_MAX; + + Uint32Vector caseDepths; + if (!caseDepths.appendN(CASE_NOT_DEFINED, tableLength)) + return false; + + uint32_t numCases = 0; + for (ParseNode* s = stmt; s && !IsDefaultCase(s); s = NextNode(s)) { + int32_t caseValue = ExtractNumericLiteral(f.m(), CaseExpr(s)).toInt32(); + + MOZ_ASSERT(caseValue >= low); + unsigned i = caseValue - low; + if (caseDepths[i] != CASE_NOT_DEFINED) + return f.fail(s, "no duplicate case labels"); + + MOZ_ASSERT(numCases != CASE_NOT_DEFINED); + caseDepths[i] = numCases++; + } + + // Open the wrapping breakable default block. + if (!f.pushBreakableBlock()) + return false; + + // Open all the case blocks. + for (uint32_t i = 0; i < numCases; i++) { + if (!f.pushUnbreakableBlock()) + return false; + } + + // Open the br_table block. + if (!f.pushUnbreakableBlock()) + return false; + + // The default block is the last one. + uint32_t defaultDepth = numCases; + + // Subtract lowest case value, so that all the cases start from 0. + if (low) { + if (!CheckSwitchExpr(f, switchExpr)) + return false; + if (!f.writeInt32Lit(low)) + return false; + if (!f.encoder().writeOp(Op::I32Sub)) + return false; + } else { + if (!CheckSwitchExpr(f, switchExpr)) + return false; + } + + // Start the br_table block. + if (!f.encoder().writeOp(Op::BrTable)) + return false; + + // Write the number of cases (tableLength - 1 + 1 (default)). + // Write the number of cases (tableLength - 1 + 1 (default)). + if (!f.encoder().writeVarU32(tableLength)) + return false; + + // Each case value describes the relative depth to the actual block. When + // a case is not explicitly defined, it goes to the default. + for (size_t i = 0; i < tableLength; i++) { + uint32_t target = caseDepths[i] == CASE_NOT_DEFINED ? defaultDepth : caseDepths[i]; + if (!f.encoder().writeVarU32(target)) + return false; + } + + // Write the default depth. + if (!f.encoder().writeVarU32(defaultDepth)) + return false; + + // Our br_table is done. Close its block, write the cases down in order. + if (!f.popUnbreakableBlock()) + return false; + + for (; stmt && !IsDefaultCase(stmt); stmt = NextNode(stmt)) { + if (!CheckStatement(f, CaseBody(stmt))) + return false; + if (!f.popUnbreakableBlock()) + return false; + } + + // Write the default block. + if (stmt && IsDefaultCase(stmt)) { + if (!CheckStatement(f, CaseBody(stmt))) + return false; + } + + // Close the wrapping block. + if (!f.popBreakableBlock()) + return false; + return true; +} + +static bool +CheckReturnType(FunctionValidator& f, ParseNode* usepn, Type ret) +{ + if (!f.hasAlreadyReturned()) { + f.setReturnedType(ret.canonicalToExprType()); + return true; + } + + if (f.returnedType() != ret.canonicalToExprType()) { + return f.failf(usepn, "%s incompatible with previous return of type %s", + Type::ret(ret).toChars(), ToCString(f.returnedType())); + } + + return true; +} + +static bool +CheckReturn(FunctionValidator& f, ParseNode* returnStmt) +{ + ParseNode* expr = ReturnExpr(returnStmt); + + if (!expr) { + if (!CheckReturnType(f, returnStmt, Type::Void)) + return false; + } else { + Type type; + if (!CheckExpr(f, expr, &type)) + return false; + + if (!type.isReturnType()) + return f.failf(expr, "%s is not a valid return type", type.toChars()); + + if (!CheckReturnType(f, expr, Type::canonicalize(type))) + return false; + } + + if (!f.encoder().writeOp(Op::Return)) + return false; + + return true; +} + +static bool +CheckStatementList(FunctionValidator& f, ParseNode* stmtList, const NameVector* labels /*= nullptr */) +{ + MOZ_ASSERT(stmtList->isKind(PNK_STATEMENTLIST)); + + if (!f.pushUnbreakableBlock(labels)) + return false; + + for (ParseNode* stmt = ListHead(stmtList); stmt; stmt = NextNode(stmt)) { + if (!CheckStatement(f, stmt)) + return false; + } + + if (!f.popUnbreakableBlock(labels)) + return false; + return true; +} + +static bool +CheckLexicalScope(FunctionValidator& f, ParseNode* lexicalScope) +{ + MOZ_ASSERT(lexicalScope->isKind(PNK_LEXICALSCOPE)); + + if (!lexicalScope->isEmptyScope()) + return f.fail(lexicalScope, "cannot have 'let' or 'const' declarations"); + + return CheckStatement(f, lexicalScope->scopeBody()); +} + +static bool +CheckBreakOrContinue(FunctionValidator& f, bool isBreak, ParseNode* stmt) +{ + if (PropertyName* maybeLabel = LoopControlMaybeLabel(stmt)) + return f.writeLabeledBreakOrContinue(maybeLabel, isBreak); + return f.writeUnlabeledBreakOrContinue(isBreak); +} + +static bool +CheckStatement(FunctionValidator& f, ParseNode* stmt) +{ + JS_CHECK_RECURSION_DONT_REPORT(f.cx(), return f.m().failOverRecursed()); + + switch (stmt->getKind()) { + case PNK_SEMI: return CheckExprStatement(f, stmt); + case PNK_WHILE: return CheckWhile(f, stmt); + case PNK_FOR: return CheckFor(f, stmt); + case PNK_DOWHILE: return CheckDoWhile(f, stmt); + case PNK_LABEL: return CheckLabel(f, stmt); + case PNK_IF: return CheckIf(f, stmt); + case PNK_SWITCH: return CheckSwitch(f, stmt); + case PNK_RETURN: return CheckReturn(f, stmt); + case PNK_STATEMENTLIST: return CheckStatementList(f, stmt); + case PNK_BREAK: return CheckBreakOrContinue(f, true, stmt); + case PNK_CONTINUE: return CheckBreakOrContinue(f, false, stmt); + case PNK_LEXICALSCOPE: return CheckLexicalScope(f, stmt); + default:; + } + + return f.fail(stmt, "unexpected statement kind"); +} + +static bool +ParseFunction(ModuleValidator& m, ParseNode** fnOut, unsigned* line) +{ + TokenStream& tokenStream = m.tokenStream(); + + tokenStream.consumeKnownToken(TOK_FUNCTION, TokenStream::Operand); + *line = tokenStream.srcCoords.lineNum(tokenStream.currentToken().pos.end); + + TokenKind tk; + if (!tokenStream.getToken(&tk, TokenStream::Operand)) + return false; + if (tk != TOK_NAME && tk != TOK_YIELD) + return false; // The regular parser will throw a SyntaxError, no need to m.fail. + + RootedPropertyName name(m.cx(), m.parser().bindingIdentifier(YieldIsName)); + if (!name) + return false; + + ParseNode* fn = m.parser().handler.newFunctionDefinition(); + if (!fn) + return false; + + RootedFunction& fun = m.dummyFunction(); + fun->setAtom(name); + fun->setArgCount(0); + + ParseContext* outerpc = m.parser().pc; + Directives directives(outerpc); + FunctionBox* funbox = m.parser().newFunctionBox(fn, fun, directives, NotGenerator, + SyncFunction, /* tryAnnexB = */ false); + if (!funbox) + return false; + funbox->initWithEnclosingParseContext(outerpc, frontend::Statement); + + Directives newDirectives = directives; + ParseContext funpc(&m.parser(), funbox, &newDirectives); + if (!funpc.init()) + return false; + + if (!m.parser().functionFormalParametersAndBody(InAllowed, YieldIsName, fn, Statement)) { + if (tokenStream.hadError() || directives == newDirectives) + return false; + + return m.fail(fn, "encountered new directive in function"); + } + + MOZ_ASSERT(!tokenStream.hadError()); + MOZ_ASSERT(directives == newDirectives); + + *fnOut = fn; + return true; +} + +static bool +CheckFunction(ModuleValidator& m) +{ + // asm.js modules can be quite large when represented as parse trees so pop + // the backing LifoAlloc after parsing/compiling each function. + AsmJSParser::Mark mark = m.parser().mark(); + + ParseNode* fn = nullptr; + unsigned line = 0; + if (!ParseFunction(m, &fn, &line)) + return false; + + if (!CheckFunctionHead(m, fn)) + return false; + + FunctionValidator f(m, fn); + if (!f.init(FunctionName(fn), line)) + return m.fail(fn, "internal compiler failure (probably out of memory)"); + + ParseNode* stmtIter = ListHead(FunctionStatementList(fn)); + + if (!CheckProcessingDirectives(m, &stmtIter)) + return false; + + ValTypeVector args; + if (!CheckArguments(f, &stmtIter, &args)) + return false; + + if (!CheckVariables(f, &stmtIter)) + return false; + + ParseNode* lastNonEmptyStmt = nullptr; + for (; stmtIter; stmtIter = NextNonEmptyStatement(stmtIter)) { + lastNonEmptyStmt = stmtIter; + if (!CheckStatement(f, stmtIter)) + return false; + } + + if (!CheckFinalReturn(f, lastNonEmptyStmt)) + return false; + + ModuleValidator::Func* func = nullptr; + if (!CheckFunctionSignature(m, fn, Sig(Move(args), f.returnedType()), FunctionName(fn), &func)) + return false; + + if (func->defined()) + return m.failName(fn, "function '%s' already defined", FunctionName(fn)); + + func->define(fn); + + if (!f.finish(func->index())) + return m.fail(fn, "internal compiler failure (probably out of memory)"); + + // Release the parser's lifo memory only after the last use of a parse node. + m.parser().release(mark); + return true; +} + +static bool +CheckAllFunctionsDefined(ModuleValidator& m) +{ + for (unsigned i = 0; i < m.numFunctions(); i++) { + ModuleValidator::Func& f = m.function(i); + if (!f.defined()) + return m.failNameOffset(f.firstUse(), "missing definition of function %s", f.name()); + } + + return true; +} + +static bool +CheckFunctions(ModuleValidator& m) +{ + while (true) { + TokenKind tk; + if (!PeekToken(m.parser(), &tk)) + return false; + + if (tk != TOK_FUNCTION) + break; + + if (!CheckFunction(m)) + return false; + } + + return CheckAllFunctionsDefined(m); +} + +static bool +CheckFuncPtrTable(ModuleValidator& m, ParseNode* var) +{ + if (!var->isKind(PNK_NAME)) + return m.fail(var, "function-pointer table name is not a plain name"); + + ParseNode* arrayLiteral = MaybeInitializer(var); + if (!arrayLiteral || !arrayLiteral->isKind(PNK_ARRAY)) + return m.fail(var, "function-pointer table's initializer must be an array literal"); + + unsigned length = ListLength(arrayLiteral); + + if (!IsPowerOfTwo(length)) + return m.failf(arrayLiteral, "function-pointer table length must be a power of 2 (is %u)", length); + + unsigned mask = length - 1; + + Uint32Vector elemFuncIndices; + const Sig* sig = nullptr; + for (ParseNode* elem = ListHead(arrayLiteral); elem; elem = NextNode(elem)) { + if (!elem->isKind(PNK_NAME)) + return m.fail(elem, "function-pointer table's elements must be names of functions"); + + PropertyName* funcName = elem->name(); + const ModuleValidator::Func* func = m.lookupFunction(funcName); + if (!func) + return m.fail(elem, "function-pointer table's elements must be names of functions"); + + const Sig& funcSig = m.mg().funcSig(func->index()); + if (sig) { + if (*sig != funcSig) + return m.fail(elem, "all functions in table must have same signature"); + } else { + sig = &funcSig; + } + + if (!elemFuncIndices.append(func->index())) + return false; + } + + Sig copy; + if (!copy.clone(*sig)) + return false; + + uint32_t tableIndex; + if (!CheckFuncPtrTableAgainstExisting(m, var, var->name(), Move(copy), mask, &tableIndex)) + return false; + + if (!m.defineFuncPtrTable(tableIndex, Move(elemFuncIndices))) + return m.fail(var, "duplicate function-pointer definition"); + + return true; +} + +static bool +CheckFuncPtrTables(ModuleValidator& m) +{ + while (true) { + ParseNode* varStmt; + if (!ParseVarOrConstStatement(m.parser(), &varStmt)) + return false; + if (!varStmt) + break; + for (ParseNode* var = VarListHead(varStmt); var; var = NextNode(var)) { + if (!CheckFuncPtrTable(m, var)) + return false; + } + } + + for (unsigned i = 0; i < m.numFuncPtrTables(); i++) { + ModuleValidator::FuncPtrTable& funcPtrTable = m.funcPtrTable(i); + if (!funcPtrTable.defined()) { + return m.failNameOffset(funcPtrTable.firstUse(), + "function-pointer table %s wasn't defined", + funcPtrTable.name()); + } + } + + return true; +} + +static bool +CheckModuleExportFunction(ModuleValidator& m, ParseNode* pn, PropertyName* maybeFieldName = nullptr) +{ + if (!pn->isKind(PNK_NAME)) + return m.fail(pn, "expected name of exported function"); + + PropertyName* funcName = pn->name(); + const ModuleValidator::Func* func = m.lookupFunction(funcName); + if (!func) + return m.failName(pn, "function '%s' not found", funcName); + + return m.addExportField(pn, *func, maybeFieldName); +} + +static bool +CheckModuleExportObject(ModuleValidator& m, ParseNode* object) +{ + MOZ_ASSERT(object->isKind(PNK_OBJECT)); + + for (ParseNode* pn = ListHead(object); pn; pn = NextNode(pn)) { + if (!IsNormalObjectField(m.cx(), pn)) + return m.fail(pn, "only normal object properties may be used in the export object literal"); + + PropertyName* fieldName = ObjectNormalFieldName(m.cx(), pn); + + ParseNode* initNode = ObjectNormalFieldInitializer(m.cx(), pn); + if (!initNode->isKind(PNK_NAME)) + return m.fail(initNode, "initializer of exported object literal must be name of function"); + + if (!CheckModuleExportFunction(m, initNode, fieldName)) + return false; + } + + return true; +} + +static bool +CheckModuleReturn(ModuleValidator& m) +{ + TokenKind tk; + if (!GetToken(m.parser(), &tk)) + return false; + TokenStream& ts = m.parser().tokenStream; + if (tk != TOK_RETURN) { + return m.failCurrentOffset((tk == TOK_RC || tk == TOK_EOF) + ? "expecting return statement" + : "invalid asm.js. statement"); + } + ts.ungetToken(); + + ParseNode* returnStmt = m.parser().statementListItem(YieldIsName); + if (!returnStmt) + return false; + + ParseNode* returnExpr = ReturnExpr(returnStmt); + if (!returnExpr) + return m.fail(returnStmt, "export statement must return something"); + + if (returnExpr->isKind(PNK_OBJECT)) { + if (!CheckModuleExportObject(m, returnExpr)) + return false; + } else { + if (!CheckModuleExportFunction(m, returnExpr)) + return false; + } + + return true; +} + +static bool +CheckModuleEnd(ModuleValidator &m) +{ + TokenKind tk; + if (!GetToken(m.parser(), &tk)) + return false; + + if (tk != TOK_EOF && tk != TOK_RC) + return m.failCurrentOffset("top-level export (return) must be the last statement"); + + m.parser().tokenStream.ungetToken(); + return true; +} + +static SharedModule +CheckModule(ExclusiveContext* cx, AsmJSParser& parser, ParseNode* stmtList, unsigned* time) +{ + int64_t before = PRMJ_Now(); + + ParseNode* moduleFunctionNode = parser.pc->functionBox()->functionNode; + MOZ_ASSERT(moduleFunctionNode); + + ModuleValidator m(cx, parser, moduleFunctionNode); + if (!m.init()) + return nullptr; + + if (!CheckFunctionHead(m, moduleFunctionNode)) + return nullptr; + + if (!CheckModuleArguments(m, moduleFunctionNode)) + return nullptr; + + if (!CheckPrecedingStatements(m, stmtList)) + return nullptr; + + if (!CheckModuleProcessingDirectives(m)) + return nullptr; + + if (!CheckModuleGlobals(m)) + return nullptr; + + if (!m.startFunctionBodies()) + return nullptr; + + if (!CheckFunctions(m)) + return nullptr; + + if (!m.finishFunctionBodies()) + return nullptr; + + if (!CheckFuncPtrTables(m)) + return nullptr; + + if (!CheckModuleReturn(m)) + return nullptr; + + if (!CheckModuleEnd(m)) + return nullptr; + + SharedModule module = m.finish(); + if (!module) + return nullptr; + + *time = (PRMJ_Now() - before) / PRMJ_USEC_PER_MSEC; + return module; +} + +/*****************************************************************************/ +// Link-time validation + +static bool +LinkFail(JSContext* cx, const char* str) +{ + JS_ReportErrorFlagsAndNumberASCII(cx, JSREPORT_WARNING, GetErrorMessage, nullptr, + JSMSG_USE_ASM_LINK_FAIL, str); + return false; +} + +static bool +IsMaybeWrappedScriptedProxy(JSObject* obj) +{ + JSObject* unwrapped = UncheckedUnwrap(obj); + return unwrapped && IsScriptedProxy(unwrapped); +} + +static bool +GetDataProperty(JSContext* cx, HandleValue objVal, HandleAtom field, MutableHandleValue v) +{ + if (!objVal.isObject()) + return LinkFail(cx, "accessing property of non-object"); + + RootedObject obj(cx, &objVal.toObject()); + if (IsMaybeWrappedScriptedProxy(obj)) + return LinkFail(cx, "accessing property of a Proxy"); + + Rooted<PropertyDescriptor> desc(cx); + RootedId id(cx, AtomToId(field)); + if (!GetPropertyDescriptor(cx, obj, id, &desc)) + return false; + + if (!desc.object()) + return LinkFail(cx, "property not present on object"); + + if (!desc.isDataDescriptor()) + return LinkFail(cx, "property is not a data property"); + + v.set(desc.value()); + return true; +} + +static bool +GetDataProperty(JSContext* cx, HandleValue objVal, const char* fieldChars, MutableHandleValue v) +{ + RootedAtom field(cx, AtomizeUTF8Chars(cx, fieldChars, strlen(fieldChars))); + if (!field) + return false; + + return GetDataProperty(cx, objVal, field, v); +} + +static bool +GetDataProperty(JSContext* cx, HandleValue objVal, ImmutablePropertyNamePtr field, MutableHandleValue v) +{ + // Help the conversion along for all the cx->names().* users. + HandlePropertyName fieldHandle = field; + return GetDataProperty(cx, objVal, fieldHandle, v); +} + +static bool +HasPureCoercion(JSContext* cx, HandleValue v) +{ + // Unsigned SIMD types are not allowed in function signatures. + if (IsVectorObject<Int32x4>(v) || IsVectorObject<Float32x4>(v) || IsVectorObject<Bool32x4>(v)) + return true; + + // Ideally, we'd reject all non-SIMD non-primitives, but Emscripten has a + // bug that generates code that passes functions for some imports. To avoid + // breaking all the code that contains this bug, we make an exception for + // functions that don't have user-defined valueOf or toString, for their + // coercions are not observable and coercion via ToNumber/ToInt32 + // definitely produces NaN/0. We should remove this special case later once + // most apps have been built with newer Emscripten. + jsid toString = NameToId(cx->names().toString); + if (v.toObject().is<JSFunction>() && + HasObjectValueOf(&v.toObject(), cx) && + ClassMethodIsNative(cx, &v.toObject().as<JSFunction>(), &JSFunction::class_, toString, fun_toString)) + { + return true; + } + + return false; +} + +static bool +ValidateGlobalVariable(JSContext* cx, const AsmJSGlobal& global, HandleValue importVal, Val* val) +{ + switch (global.varInitKind()) { + case AsmJSGlobal::InitConstant: + *val = global.varInitVal(); + return true; + + case AsmJSGlobal::InitImport: { + RootedValue v(cx); + if (!GetDataProperty(cx, importVal, global.field(), &v)) + return false; + + if (!v.isPrimitive() && !HasPureCoercion(cx, v)) + return LinkFail(cx, "Imported values must be primitives"); + + switch (global.varInitImportType()) { + case ValType::I32: { + int32_t i32; + if (!ToInt32(cx, v, &i32)) + return false; + *val = Val(uint32_t(i32)); + return true; + } + case ValType::I64: + MOZ_CRASH("int64"); + case ValType::F32: { + float f; + if (!RoundFloat32(cx, v, &f)) + return false; + *val = Val(RawF32(f)); + return true; + } + case ValType::F64: { + double d; + if (!ToNumber(cx, v, &d)) + return false; + *val = Val(RawF64(d)); + return true; + } + case ValType::I8x16: { + SimdConstant simdConstant; + if (!ToSimdConstant<Int8x16>(cx, v, &simdConstant)) + return false; + *val = Val(simdConstant.asInt8x16()); + return true; + } + case ValType::I16x8: { + SimdConstant simdConstant; + if (!ToSimdConstant<Int16x8>(cx, v, &simdConstant)) + return false; + *val = Val(simdConstant.asInt16x8()); + return true; + } + case ValType::I32x4: { + SimdConstant simdConstant; + if (!ToSimdConstant<Int32x4>(cx, v, &simdConstant)) + return false; + *val = Val(simdConstant.asInt32x4()); + return true; + } + case ValType::F32x4: { + SimdConstant simdConstant; + if (!ToSimdConstant<Float32x4>(cx, v, &simdConstant)) + return false; + *val = Val(simdConstant.asFloat32x4()); + return true; + } + case ValType::B8x16: { + SimdConstant simdConstant; + if (!ToSimdConstant<Bool8x16>(cx, v, &simdConstant)) + return false; + // Bool8x16 uses the same data layout as Int8x16. + *val = Val(simdConstant.asInt8x16()); + return true; + } + case ValType::B16x8: { + SimdConstant simdConstant; + if (!ToSimdConstant<Bool16x8>(cx, v, &simdConstant)) + return false; + // Bool16x8 uses the same data layout as Int16x8. + *val = Val(simdConstant.asInt16x8()); + return true; + } + case ValType::B32x4: { + SimdConstant simdConstant; + if (!ToSimdConstant<Bool32x4>(cx, v, &simdConstant)) + return false; + // Bool32x4 uses the same data layout as Int32x4. + *val = Val(simdConstant.asInt32x4()); + return true; + } + } + } + } + + MOZ_CRASH("unreachable"); +} + +static bool +ValidateFFI(JSContext* cx, const AsmJSGlobal& global, HandleValue importVal, + MutableHandle<FunctionVector> ffis) +{ + RootedValue v(cx); + if (!GetDataProperty(cx, importVal, global.field(), &v)) + return false; + + if (!IsFunctionObject(v)) + return LinkFail(cx, "FFI imports must be functions"); + + ffis[global.ffiIndex()].set(&v.toObject().as<JSFunction>()); + return true; +} + +static bool +ValidateArrayView(JSContext* cx, const AsmJSGlobal& global, HandleValue globalVal) +{ + if (!global.field()) + return true; + + RootedValue v(cx); + if (!GetDataProperty(cx, globalVal, global.field(), &v)) + return false; + + bool tac = IsTypedArrayConstructor(v, global.viewType()); + if (!tac) + return LinkFail(cx, "bad typed array constructor"); + + return true; +} + +static bool +ValidateMathBuiltinFunction(JSContext* cx, const AsmJSGlobal& global, HandleValue globalVal) +{ + RootedValue v(cx); + if (!GetDataProperty(cx, globalVal, cx->names().Math, &v)) + return false; + + if (!GetDataProperty(cx, v, global.field(), &v)) + return false; + + Native native = nullptr; + switch (global.mathBuiltinFunction()) { + case AsmJSMathBuiltin_sin: native = math_sin; break; + case AsmJSMathBuiltin_cos: native = math_cos; break; + case AsmJSMathBuiltin_tan: native = math_tan; break; + case AsmJSMathBuiltin_asin: native = math_asin; break; + case AsmJSMathBuiltin_acos: native = math_acos; break; + case AsmJSMathBuiltin_atan: native = math_atan; break; + case AsmJSMathBuiltin_ceil: native = math_ceil; break; + case AsmJSMathBuiltin_floor: native = math_floor; break; + case AsmJSMathBuiltin_exp: native = math_exp; break; + case AsmJSMathBuiltin_log: native = math_log; break; + case AsmJSMathBuiltin_pow: native = math_pow; break; + case AsmJSMathBuiltin_sqrt: native = math_sqrt; break; + case AsmJSMathBuiltin_min: native = math_min; break; + case AsmJSMathBuiltin_max: native = math_max; break; + case AsmJSMathBuiltin_abs: native = math_abs; break; + case AsmJSMathBuiltin_atan2: native = math_atan2; break; + case AsmJSMathBuiltin_imul: native = math_imul; break; + case AsmJSMathBuiltin_clz32: native = math_clz32; break; + case AsmJSMathBuiltin_fround: native = math_fround; break; + } + + if (!IsNativeFunction(v, native)) + return LinkFail(cx, "bad Math.* builtin function"); + + return true; +} + +static bool +ValidateSimdType(JSContext* cx, const AsmJSGlobal& global, HandleValue globalVal, + MutableHandleValue out) +{ + RootedValue v(cx); + if (!GetDataProperty(cx, globalVal, cx->names().SIMD, &v)) + return false; + + SimdType type; + if (global.which() == AsmJSGlobal::SimdCtor) + type = global.simdCtorType(); + else + type = global.simdOperationType(); + + RootedPropertyName simdTypeName(cx, SimdTypeToName(cx->names(), type)); + if (!GetDataProperty(cx, v, simdTypeName, &v)) + return false; + + if (!v.isObject()) + return LinkFail(cx, "bad SIMD type"); + + RootedObject simdDesc(cx, &v.toObject()); + if (!simdDesc->is<SimdTypeDescr>()) + return LinkFail(cx, "bad SIMD type"); + + if (type != simdDesc->as<SimdTypeDescr>().type()) + return LinkFail(cx, "bad SIMD type"); + + out.set(v); + return true; +} + +static bool +ValidateSimdType(JSContext* cx, const AsmJSGlobal& global, HandleValue globalVal) +{ + RootedValue _(cx); + return ValidateSimdType(cx, global, globalVal, &_); +} + +static bool +ValidateSimdOperation(JSContext* cx, const AsmJSGlobal& global, HandleValue globalVal) +{ + RootedValue v(cx); + JS_ALWAYS_TRUE(ValidateSimdType(cx, global, globalVal, &v)); + + if (!GetDataProperty(cx, v, global.field(), &v)) + return false; + + Native native = nullptr; + switch (global.simdOperationType()) { +#define SET_NATIVE_INT8X16(op) case SimdOperation::Fn_##op: native = simd_int8x16_##op; break; +#define SET_NATIVE_INT16X8(op) case SimdOperation::Fn_##op: native = simd_int16x8_##op; break; +#define SET_NATIVE_INT32X4(op) case SimdOperation::Fn_##op: native = simd_int32x4_##op; break; +#define SET_NATIVE_UINT8X16(op) case SimdOperation::Fn_##op: native = simd_uint8x16_##op; break; +#define SET_NATIVE_UINT16X8(op) case SimdOperation::Fn_##op: native = simd_uint16x8_##op; break; +#define SET_NATIVE_UINT32X4(op) case SimdOperation::Fn_##op: native = simd_uint32x4_##op; break; +#define SET_NATIVE_FLOAT32X4(op) case SimdOperation::Fn_##op: native = simd_float32x4_##op; break; +#define SET_NATIVE_BOOL8X16(op) case SimdOperation::Fn_##op: native = simd_bool8x16_##op; break; +#define SET_NATIVE_BOOL16X8(op) case SimdOperation::Fn_##op: native = simd_bool16x8_##op; break; +#define SET_NATIVE_BOOL32X4(op) case SimdOperation::Fn_##op: native = simd_bool32x4_##op; break; +#define FALLTHROUGH(op) case SimdOperation::Fn_##op: + case SimdType::Int8x16: + switch (global.simdOperation()) { + FORALL_INT8X16_ASMJS_OP(SET_NATIVE_INT8X16) + SET_NATIVE_INT8X16(fromUint8x16Bits) + SET_NATIVE_INT8X16(fromUint16x8Bits) + SET_NATIVE_INT8X16(fromUint32x4Bits) + default: MOZ_CRASH("shouldn't have been validated in the first place"); + } + break; + case SimdType::Int16x8: + switch (global.simdOperation()) { + FORALL_INT16X8_ASMJS_OP(SET_NATIVE_INT16X8) + SET_NATIVE_INT16X8(fromUint8x16Bits) + SET_NATIVE_INT16X8(fromUint16x8Bits) + SET_NATIVE_INT16X8(fromUint32x4Bits) + default: MOZ_CRASH("shouldn't have been validated in the first place"); + } + break; + case SimdType::Int32x4: + switch (global.simdOperation()) { + FORALL_INT32X4_ASMJS_OP(SET_NATIVE_INT32X4) + SET_NATIVE_INT32X4(fromUint8x16Bits) + SET_NATIVE_INT32X4(fromUint16x8Bits) + SET_NATIVE_INT32X4(fromUint32x4Bits) + default: MOZ_CRASH("shouldn't have been validated in the first place"); + } + break; + case SimdType::Uint8x16: + switch (global.simdOperation()) { + FORALL_INT8X16_ASMJS_OP(SET_NATIVE_UINT8X16) + SET_NATIVE_UINT8X16(fromInt8x16Bits) + SET_NATIVE_UINT8X16(fromUint16x8Bits) + SET_NATIVE_UINT8X16(fromUint32x4Bits) + default: MOZ_CRASH("shouldn't have been validated in the first place"); + } + break; + case SimdType::Uint16x8: + switch (global.simdOperation()) { + FORALL_INT16X8_ASMJS_OP(SET_NATIVE_UINT16X8) + SET_NATIVE_UINT16X8(fromUint8x16Bits) + SET_NATIVE_UINT16X8(fromInt16x8Bits) + SET_NATIVE_UINT16X8(fromUint32x4Bits) + default: MOZ_CRASH("shouldn't have been validated in the first place"); + } + break; + case SimdType::Uint32x4: + switch (global.simdOperation()) { + FORALL_INT32X4_ASMJS_OP(SET_NATIVE_UINT32X4) + SET_NATIVE_UINT32X4(fromUint8x16Bits) + SET_NATIVE_UINT32X4(fromUint16x8Bits) + SET_NATIVE_UINT32X4(fromInt32x4Bits) + default: MOZ_CRASH("shouldn't have been validated in the first place"); + } + break; + case SimdType::Float32x4: + switch (global.simdOperation()) { + FORALL_FLOAT32X4_ASMJS_OP(SET_NATIVE_FLOAT32X4) + SET_NATIVE_FLOAT32X4(fromUint8x16Bits) + SET_NATIVE_FLOAT32X4(fromUint16x8Bits) + SET_NATIVE_FLOAT32X4(fromUint32x4Bits) + default: MOZ_CRASH("shouldn't have been validated in the first place"); + } + break; + case SimdType::Bool8x16: + switch (global.simdOperation()) { + FORALL_BOOL_SIMD_OP(SET_NATIVE_BOOL8X16) + default: MOZ_CRASH("shouldn't have been validated in the first place"); + } + break; + case SimdType::Bool16x8: + switch (global.simdOperation()) { + FORALL_BOOL_SIMD_OP(SET_NATIVE_BOOL16X8) + default: MOZ_CRASH("shouldn't have been validated in the first place"); + } + break; + case SimdType::Bool32x4: + switch (global.simdOperation()) { + FORALL_BOOL_SIMD_OP(SET_NATIVE_BOOL32X4) + default: MOZ_CRASH("shouldn't have been validated in the first place"); + } + break; + default: MOZ_CRASH("unhandled simd type"); +#undef FALLTHROUGH +#undef SET_NATIVE_INT8X16 +#undef SET_NATIVE_INT16X8 +#undef SET_NATIVE_INT32X4 +#undef SET_NATIVE_UINT8X16 +#undef SET_NATIVE_UINT16X8 +#undef SET_NATIVE_UINT32X4 +#undef SET_NATIVE_FLOAT32X4 +#undef SET_NATIVE_BOOL8X16 +#undef SET_NATIVE_BOOL16X8 +#undef SET_NATIVE_BOOL32X4 +#undef SET_NATIVE + } + if (!native || !IsNativeFunction(v, native)) + return LinkFail(cx, "bad SIMD.type.* operation"); + return true; +} + +static bool +ValidateAtomicsBuiltinFunction(JSContext* cx, const AsmJSGlobal& global, HandleValue globalVal) +{ + RootedValue v(cx); + if (!GetDataProperty(cx, globalVal, cx->names().Atomics, &v)) + return false; + + if (!GetDataProperty(cx, v, global.field(), &v)) + return false; + + Native native = nullptr; + switch (global.atomicsBuiltinFunction()) { + case AsmJSAtomicsBuiltin_compareExchange: native = atomics_compareExchange; break; + case AsmJSAtomicsBuiltin_exchange: native = atomics_exchange; break; + case AsmJSAtomicsBuiltin_load: native = atomics_load; break; + case AsmJSAtomicsBuiltin_store: native = atomics_store; break; + case AsmJSAtomicsBuiltin_add: native = atomics_add; break; + case AsmJSAtomicsBuiltin_sub: native = atomics_sub; break; + case AsmJSAtomicsBuiltin_and: native = atomics_and; break; + case AsmJSAtomicsBuiltin_or: native = atomics_or; break; + case AsmJSAtomicsBuiltin_xor: native = atomics_xor; break; + case AsmJSAtomicsBuiltin_isLockFree: native = atomics_isLockFree; break; + } + + if (!IsNativeFunction(v, native)) + return LinkFail(cx, "bad Atomics.* builtin function"); + + return true; +} + +static bool +ValidateConstant(JSContext* cx, const AsmJSGlobal& global, HandleValue globalVal) +{ + RootedValue v(cx, globalVal); + + if (global.constantKind() == AsmJSGlobal::MathConstant) { + if (!GetDataProperty(cx, v, cx->names().Math, &v)) + return false; + } + + if (!GetDataProperty(cx, v, global.field(), &v)) + return false; + + if (!v.isNumber()) + return LinkFail(cx, "math / global constant value needs to be a number"); + + // NaN != NaN + if (IsNaN(global.constantValue())) { + if (!IsNaN(v.toNumber())) + return LinkFail(cx, "global constant value needs to be NaN"); + } else { + if (v.toNumber() != global.constantValue()) + return LinkFail(cx, "global constant value mismatch"); + } + + return true; +} + +static bool +CheckBuffer(JSContext* cx, const AsmJSMetadata& metadata, HandleValue bufferVal, + MutableHandle<ArrayBufferObjectMaybeShared*> buffer) +{ + if (metadata.memoryUsage == MemoryUsage::Shared) { + if (!IsSharedArrayBuffer(bufferVal)) + return LinkFail(cx, "shared views can only be constructed onto SharedArrayBuffer"); + } else { + if (!IsArrayBuffer(bufferVal)) + return LinkFail(cx, "unshared views can only be constructed onto ArrayBuffer"); + } + + buffer.set(&AsAnyArrayBuffer(bufferVal)); + uint32_t memoryLength = buffer->byteLength(); + + if (!IsValidAsmJSHeapLength(memoryLength)) { + UniqueChars msg( + JS_smprintf("ArrayBuffer byteLength 0x%x is not a valid heap length. The next " + "valid length is 0x%x", + memoryLength, + RoundUpToNextValidAsmJSHeapLength(memoryLength))); + if (!msg) + return false; + return LinkFail(cx, msg.get()); + } + + // This check is sufficient without considering the size of the loaded datum because heap + // loads and stores start on an aligned boundary and the heap byteLength has larger alignment. + MOZ_ASSERT((metadata.minMemoryLength - 1) <= INT32_MAX); + if (memoryLength < metadata.minMemoryLength) { + UniqueChars msg( + JS_smprintf("ArrayBuffer byteLength of 0x%x is less than 0x%x (the size implied " + "by const heap accesses).", + memoryLength, + metadata.minMemoryLength)); + if (!msg) + return false; + return LinkFail(cx, msg.get()); + } + + if (buffer->is<ArrayBufferObject>()) { + // On 64-bit, bounds checks are statically removed so the huge guard + // region is always necessary. On 32-bit, allocating a guard page + // requires reallocating the incoming ArrayBuffer which could trigger + // OOM. Thus, only ask for a guard page when SIMD is used since SIMD + // allows unaligned memory access (see MaxMemoryAccessSize comment); +#ifdef WASM_HUGE_MEMORY + bool needGuard = true; +#else + bool needGuard = metadata.usesSimd; +#endif + Rooted<ArrayBufferObject*> arrayBuffer(cx, &buffer->as<ArrayBufferObject>()); + if (!ArrayBufferObject::prepareForAsmJS(cx, arrayBuffer, needGuard)) + return LinkFail(cx, "Unable to prepare ArrayBuffer for asm.js use"); + } else { + if (!buffer->as<SharedArrayBufferObject>().isPreparedForAsmJS()) + return LinkFail(cx, "SharedArrayBuffer must be created with wasm test mode enabled"); + } + + MOZ_ASSERT(buffer->isPreparedForAsmJS()); + return true; +} + +static bool +GetImports(JSContext* cx, const AsmJSMetadata& metadata, HandleValue globalVal, + HandleValue importVal, MutableHandle<FunctionVector> funcImports, ValVector* valImports) +{ + Rooted<FunctionVector> ffis(cx, FunctionVector(cx)); + if (!ffis.resize(metadata.numFFIs)) + return false; + + for (const AsmJSGlobal& global : metadata.asmJSGlobals) { + switch (global.which()) { + case AsmJSGlobal::Variable: { + Val val; + if (!ValidateGlobalVariable(cx, global, importVal, &val)) + return false; + if (!valImports->append(val)) + return false; + break; + } + case AsmJSGlobal::FFI: + if (!ValidateFFI(cx, global, importVal, &ffis)) + return false; + break; + case AsmJSGlobal::ArrayView: + case AsmJSGlobal::ArrayViewCtor: + if (!ValidateArrayView(cx, global, globalVal)) + return false; + break; + case AsmJSGlobal::MathBuiltinFunction: + if (!ValidateMathBuiltinFunction(cx, global, globalVal)) + return false; + break; + case AsmJSGlobal::AtomicsBuiltinFunction: + if (!ValidateAtomicsBuiltinFunction(cx, global, globalVal)) + return false; + break; + case AsmJSGlobal::Constant: + if (!ValidateConstant(cx, global, globalVal)) + return false; + break; + case AsmJSGlobal::SimdCtor: + if (!ValidateSimdType(cx, global, globalVal)) + return false; + break; + case AsmJSGlobal::SimdOp: + if (!ValidateSimdOperation(cx, global, globalVal)) + return false; + break; + } + } + + for (const AsmJSImport& import : metadata.asmJSImports) { + if (!funcImports.append(ffis[import.ffiIndex()])) + return false; + } + + return true; +} + +static bool +TryInstantiate(JSContext* cx, CallArgs args, Module& module, const AsmJSMetadata& metadata, + MutableHandleWasmInstanceObject instanceObj, MutableHandleObject exportObj) +{ + HandleValue globalVal = args.get(0); + HandleValue importVal = args.get(1); + HandleValue bufferVal = args.get(2); + + RootedArrayBufferObjectMaybeShared buffer(cx); + RootedWasmMemoryObject memory(cx); + if (module.metadata().usesMemory()) { + if (!CheckBuffer(cx, metadata, bufferVal, &buffer)) + return false; + + memory = WasmMemoryObject::create(cx, buffer, nullptr); + if (!memory) + return false; + } + + ValVector valImports; + Rooted<FunctionVector> funcs(cx, FunctionVector(cx)); + if (!GetImports(cx, metadata, globalVal, importVal, &funcs, &valImports)) + return false; + + RootedWasmTableObject table(cx); + if (!module.instantiate(cx, funcs, table, memory, valImports, nullptr, instanceObj)) + return false; + + RootedValue exportObjVal(cx); + if (!JS_GetProperty(cx, instanceObj, InstanceExportField, &exportObjVal)) + return false; + + MOZ_RELEASE_ASSERT(exportObjVal.isObject()); + exportObj.set(&exportObjVal.toObject()); + return true; +} + +static MOZ_MUST_USE bool +MaybeAppendUTF8Name(JSContext* cx, const char* utf8Chars, MutableHandle<PropertyNameVector> names) +{ + if (!utf8Chars) + return true; + + UTF8Chars utf8(utf8Chars, strlen(utf8Chars)); + + JSAtom* atom = AtomizeUTF8Chars(cx, utf8Chars, strlen(utf8Chars)); + if (!atom) + return false; + + return names.append(atom->asPropertyName()); +} + +static bool +HandleInstantiationFailure(JSContext* cx, CallArgs args, const AsmJSMetadata& metadata) +{ + RootedAtom name(cx, args.callee().as<JSFunction>().name()); + + if (cx->isExceptionPending()) + return false; + + ScriptSource* source = metadata.scriptSource.get(); + + // Source discarding is allowed to affect JS semantics because it is never + // enabled for normal JS content. + bool haveSource = source->hasSourceData(); + if (!haveSource && !JSScript::loadSource(cx, source, &haveSource)) + return false; + if (!haveSource) { + JS_ReportErrorASCII(cx, "asm.js link failure with source discarding enabled"); + return false; + } + + uint32_t begin = metadata.srcBodyStart; // starts right after 'use asm' + uint32_t end = metadata.srcEndBeforeCurly(); + Rooted<JSFlatString*> src(cx, source->substringDontDeflate(cx, begin, end)); + if (!src) + return false; + + RootedFunction fun(cx, NewScriptedFunction(cx, 0, JSFunction::INTERPRETED_NORMAL, + name, /* proto = */ nullptr, gc::AllocKind::FUNCTION, + TenuredObject)); + if (!fun) + return false; + + Rooted<PropertyNameVector> formals(cx, PropertyNameVector(cx)); + if (!MaybeAppendUTF8Name(cx, metadata.globalArgumentName.get(), &formals)) + return false; + if (!MaybeAppendUTF8Name(cx, metadata.importArgumentName.get(), &formals)) + return false; + if (!MaybeAppendUTF8Name(cx, metadata.bufferArgumentName.get(), &formals)) + return false; + + CompileOptions options(cx); + options.setMutedErrors(source->mutedErrors()) + .setFile(source->filename()) + .setNoScriptRval(false); + + // The exported function inherits an implicit strict context if the module + // also inherited it somehow. + if (metadata.strict) + options.strictOption = true; + + AutoStableStringChars stableChars(cx); + if (!stableChars.initTwoByte(cx, src)) + return false; + + const char16_t* chars = stableChars.twoByteRange().begin().get(); + SourceBufferHolder::Ownership ownership = stableChars.maybeGiveOwnershipToCaller() + ? SourceBufferHolder::GiveOwnership + : SourceBufferHolder::NoOwnership; + SourceBufferHolder srcBuf(chars, end - begin, ownership); + if (!frontend::CompileFunctionBody(cx, &fun, options, formals, srcBuf)) + return false; + + // Call the function we just recompiled. + args.setCallee(ObjectValue(*fun)); + return InternalCallOrConstruct(cx, args, args.isConstructing() ? CONSTRUCT : NO_CONSTRUCT); +} + +static Module& +AsmJSModuleFunctionToModule(JSFunction* fun) +{ + MOZ_ASSERT(IsAsmJSModule(fun)); + const Value& v = fun->getExtendedSlot(FunctionExtended::ASMJS_MODULE_SLOT); + return v.toObject().as<WasmModuleObject>().module(); +} + +// Implements the semantics of an asm.js module function that has been successfully validated. +static bool +InstantiateAsmJS(JSContext* cx, unsigned argc, JS::Value* vp) +{ + CallArgs args = CallArgsFromVp(argc, vp); + + JSFunction* callee = &args.callee().as<JSFunction>(); + Module& module = AsmJSModuleFunctionToModule(callee); + const AsmJSMetadata& metadata = module.metadata().asAsmJS(); + + RootedWasmInstanceObject instanceObj(cx); + RootedObject exportObj(cx); + if (!TryInstantiate(cx, args, module, metadata, &instanceObj, &exportObj)) { + // Link-time validation checks failed, so reparse the entire asm.js + // module from scratch to get normal interpreted bytecode which we can + // simply Invoke. Very slow. + return HandleInstantiationFailure(cx, args, metadata); + } + + args.rval().set(ObjectValue(*exportObj)); + return true; +} + +static JSFunction* +NewAsmJSModuleFunction(ExclusiveContext* cx, JSFunction* origFun, HandleObject moduleObj) +{ + RootedAtom name(cx, origFun->name()); + + JSFunction::Flags flags = origFun->isLambda() ? JSFunction::ASMJS_LAMBDA_CTOR + : JSFunction::ASMJS_CTOR; + JSFunction* moduleFun = + NewNativeConstructor(cx, InstantiateAsmJS, origFun->nargs(), name, + gc::AllocKind::FUNCTION_EXTENDED, TenuredObject, + flags); + if (!moduleFun) + return nullptr; + + moduleFun->setExtendedSlot(FunctionExtended::ASMJS_MODULE_SLOT, ObjectValue(*moduleObj)); + + MOZ_ASSERT(IsAsmJSModule(moduleFun)); + return moduleFun; +} + +/*****************************************************************************/ +// Caching and cloning + +size_t +AsmJSGlobal::serializedSize() const +{ + return sizeof(pod) + + field_.serializedSize(); +} + +uint8_t* +AsmJSGlobal::serialize(uint8_t* cursor) const +{ + cursor = WriteBytes(cursor, &pod, sizeof(pod)); + cursor = field_.serialize(cursor); + return cursor; +} + +const uint8_t* +AsmJSGlobal::deserialize(const uint8_t* cursor) +{ + (cursor = ReadBytes(cursor, &pod, sizeof(pod))) && + (cursor = field_.deserialize(cursor)); + return cursor; +} + +size_t +AsmJSGlobal::sizeOfExcludingThis(MallocSizeOf mallocSizeOf) const +{ + return field_.sizeOfExcludingThis(mallocSizeOf); +} + +size_t +AsmJSMetadata::serializedSize() const +{ + return Metadata::serializedSize() + + sizeof(pod()) + + SerializedVectorSize(asmJSGlobals) + + SerializedPodVectorSize(asmJSImports) + + SerializedPodVectorSize(asmJSExports) + + SerializedVectorSize(asmJSFuncNames) + + globalArgumentName.serializedSize() + + importArgumentName.serializedSize() + + bufferArgumentName.serializedSize(); +} + +uint8_t* +AsmJSMetadata::serialize(uint8_t* cursor) const +{ + cursor = Metadata::serialize(cursor); + cursor = WriteBytes(cursor, &pod(), sizeof(pod())); + cursor = SerializeVector(cursor, asmJSGlobals); + cursor = SerializePodVector(cursor, asmJSImports); + cursor = SerializePodVector(cursor, asmJSExports); + cursor = SerializeVector(cursor, asmJSFuncNames); + cursor = globalArgumentName.serialize(cursor); + cursor = importArgumentName.serialize(cursor); + cursor = bufferArgumentName.serialize(cursor); + return cursor; +} + +const uint8_t* +AsmJSMetadata::deserialize(const uint8_t* cursor) +{ + (cursor = Metadata::deserialize(cursor)) && + (cursor = ReadBytes(cursor, &pod(), sizeof(pod()))) && + (cursor = DeserializeVector(cursor, &asmJSGlobals)) && + (cursor = DeserializePodVector(cursor, &asmJSImports)) && + (cursor = DeserializePodVector(cursor, &asmJSExports)) && + (cursor = DeserializeVector(cursor, &asmJSFuncNames)) && + (cursor = globalArgumentName.deserialize(cursor)) && + (cursor = importArgumentName.deserialize(cursor)) && + (cursor = bufferArgumentName.deserialize(cursor)); + cacheResult = CacheResult::Hit; + return cursor; +} + +size_t +AsmJSMetadata::sizeOfExcludingThis(MallocSizeOf mallocSizeOf) const +{ + return Metadata::sizeOfExcludingThis(mallocSizeOf) + + SizeOfVectorExcludingThis(asmJSGlobals, mallocSizeOf) + + asmJSImports.sizeOfExcludingThis(mallocSizeOf) + + asmJSExports.sizeOfExcludingThis(mallocSizeOf) + + SizeOfVectorExcludingThis(asmJSFuncNames, mallocSizeOf) + + globalArgumentName.sizeOfExcludingThis(mallocSizeOf) + + importArgumentName.sizeOfExcludingThis(mallocSizeOf) + + bufferArgumentName.sizeOfExcludingThis(mallocSizeOf); +} + +namespace { + +class ModuleChars +{ + protected: + uint32_t isFunCtor_; + Vector<CacheableChars, 0, SystemAllocPolicy> funCtorArgs_; + + public: + static uint32_t beginOffset(AsmJSParser& parser) { + return parser.pc->functionBox()->functionNode->pn_pos.begin; + } + + static uint32_t endOffset(AsmJSParser& parser) { + TokenPos pos(0, 0); // initialize to silence GCC warning + MOZ_ALWAYS_TRUE(parser.tokenStream.peekTokenPos(&pos, TokenStream::Operand)); + return pos.end; + } +}; + +class ModuleCharsForStore : ModuleChars +{ + uint32_t uncompressedSize_; + uint32_t compressedSize_; + Vector<char, 0, SystemAllocPolicy> compressedBuffer_; + + public: + bool init(AsmJSParser& parser) { + MOZ_ASSERT(beginOffset(parser) < endOffset(parser)); + + uncompressedSize_ = (endOffset(parser) - beginOffset(parser)) * sizeof(char16_t); + size_t maxCompressedSize = LZ4::maxCompressedSize(uncompressedSize_); + if (maxCompressedSize < uncompressedSize_) + return false; + + if (!compressedBuffer_.resize(maxCompressedSize)) + return false; + + const char16_t* chars = parser.tokenStream.rawCharPtrAt(beginOffset(parser)); + const char* source = reinterpret_cast<const char*>(chars); + size_t compressedSize = LZ4::compress(source, uncompressedSize_, compressedBuffer_.begin()); + if (!compressedSize || compressedSize > UINT32_MAX) + return false; + + compressedSize_ = compressedSize; + + // For a function statement or named function expression: + // function f(x,y,z) { abc } + // the range [beginOffset, endOffset) captures the source: + // f(x,y,z) { abc } + // An unnamed function expression captures the same thing, sans 'f'. + // Since asm.js modules do not contain any free variables, equality of + // [beginOffset, endOffset) is sufficient to guarantee identical code + // generation, modulo Assumptions. + // + // For functions created with 'new Function', function arguments are + // not present in the source so we must manually explicitly serialize + // and match the formals as a Vector of PropertyName. + isFunCtor_ = parser.pc->isStandaloneFunctionBody(); + if (isFunCtor_) { + unsigned numArgs; + ParseNode* functionNode = parser.pc->functionBox()->functionNode; + ParseNode* arg = FunctionFormalParametersList(functionNode, &numArgs); + for (unsigned i = 0; i < numArgs; i++, arg = arg->pn_next) { + UniqueChars name = StringToNewUTF8CharsZ(nullptr, *arg->name()); + if (!name || !funCtorArgs_.append(Move(name))) + return false; + } + } + + return true; + } + + size_t serializedSize() const { + return sizeof(uint32_t) + + sizeof(uint32_t) + + compressedSize_ + + sizeof(uint32_t) + + (isFunCtor_ ? SerializedVectorSize(funCtorArgs_) : 0); + } + + uint8_t* serialize(uint8_t* cursor) const { + cursor = WriteScalar<uint32_t>(cursor, uncompressedSize_); + cursor = WriteScalar<uint32_t>(cursor, compressedSize_); + cursor = WriteBytes(cursor, compressedBuffer_.begin(), compressedSize_); + cursor = WriteScalar<uint32_t>(cursor, isFunCtor_); + if (isFunCtor_) + cursor = SerializeVector(cursor, funCtorArgs_); + return cursor; + } +}; + +class ModuleCharsForLookup : ModuleChars +{ + Vector<char16_t, 0, SystemAllocPolicy> chars_; + + public: + const uint8_t* deserialize(const uint8_t* cursor) { + uint32_t uncompressedSize; + cursor = ReadScalar<uint32_t>(cursor, &uncompressedSize); + + uint32_t compressedSize; + cursor = ReadScalar<uint32_t>(cursor, &compressedSize); + + if (!chars_.resize(uncompressedSize / sizeof(char16_t))) + return nullptr; + + const char* source = reinterpret_cast<const char*>(cursor); + char* dest = reinterpret_cast<char*>(chars_.begin()); + if (!LZ4::decompress(source, dest, uncompressedSize)) + return nullptr; + + cursor += compressedSize; + + cursor = ReadScalar<uint32_t>(cursor, &isFunCtor_); + if (isFunCtor_) + cursor = DeserializeVector(cursor, &funCtorArgs_); + + return cursor; + } + + bool match(AsmJSParser& parser) const { + const char16_t* parseBegin = parser.tokenStream.rawCharPtrAt(beginOffset(parser)); + const char16_t* parseLimit = parser.tokenStream.rawLimit(); + MOZ_ASSERT(parseLimit >= parseBegin); + if (uint32_t(parseLimit - parseBegin) < chars_.length()) + return false; + if (!PodEqual(chars_.begin(), parseBegin, chars_.length())) + return false; + if (isFunCtor_ != parser.pc->isStandaloneFunctionBody()) + return false; + if (isFunCtor_) { + // For function statements, the closing } is included as the last + // character of the matched source. For Function constructor, + // parsing terminates with EOF which we must explicitly check. This + // prevents + // new Function('"use asm"; function f() {} return f') + // from incorrectly matching + // new Function('"use asm"; function f() {} return ff') + if (parseBegin + chars_.length() != parseLimit) + return false; + unsigned numArgs; + ParseNode* functionNode = parser.pc->functionBox()->functionNode; + ParseNode* arg = FunctionFormalParametersList(functionNode, &numArgs); + if (funCtorArgs_.length() != numArgs) + return false; + for (unsigned i = 0; i < funCtorArgs_.length(); i++, arg = arg->pn_next) { + UniqueChars name = StringToNewUTF8CharsZ(nullptr, *arg->name()); + if (!name || strcmp(funCtorArgs_[i].get(), name.get())) + return false; + } + } + return true; + } +}; + +struct ScopedCacheEntryOpenedForWrite +{ + ExclusiveContext* cx; + const size_t serializedSize; + uint8_t* memory; + intptr_t handle; + + ScopedCacheEntryOpenedForWrite(ExclusiveContext* cx, size_t serializedSize) + : cx(cx), serializedSize(serializedSize), memory(nullptr), handle(-1) + {} + + ~ScopedCacheEntryOpenedForWrite() { + if (memory) + cx->asmJSCacheOps().closeEntryForWrite(serializedSize, memory, handle); + } +}; + +struct ScopedCacheEntryOpenedForRead +{ + ExclusiveContext* cx; + size_t serializedSize; + const uint8_t* memory; + intptr_t handle; + + explicit ScopedCacheEntryOpenedForRead(ExclusiveContext* cx) + : cx(cx), serializedSize(0), memory(nullptr), handle(0) + {} + + ~ScopedCacheEntryOpenedForRead() { + if (memory) + cx->asmJSCacheOps().closeEntryForRead(serializedSize, memory, handle); + } +}; + +} // unnamed namespace + +static JS::AsmJSCacheResult +StoreAsmJSModuleInCache(AsmJSParser& parser, Module& module, ExclusiveContext* cx) +{ + ModuleCharsForStore moduleChars; + if (!moduleChars.init(parser)) + return JS::AsmJSCache_InternalError; + + size_t bytecodeSize, compiledSize; + module.serializedSize(&bytecodeSize, &compiledSize); + MOZ_RELEASE_ASSERT(bytecodeSize == 0); + MOZ_RELEASE_ASSERT(compiledSize <= UINT32_MAX); + + size_t serializedSize = sizeof(uint32_t) + + compiledSize + + moduleChars.serializedSize(); + + JS::OpenAsmJSCacheEntryForWriteOp open = cx->asmJSCacheOps().openEntryForWrite; + if (!open) + return JS::AsmJSCache_Disabled_Internal; + + const char16_t* begin = parser.tokenStream.rawCharPtrAt(ModuleChars::beginOffset(parser)); + const char16_t* end = parser.tokenStream.rawCharPtrAt(ModuleChars::endOffset(parser)); + bool installed = parser.options().installedFile; + + ScopedCacheEntryOpenedForWrite entry(cx, serializedSize); + JS::AsmJSCacheResult openResult = + open(cx->global(), installed, begin, end, serializedSize, &entry.memory, &entry.handle); + if (openResult != JS::AsmJSCache_Success) + return openResult; + + uint8_t* cursor = entry.memory; + + // Everything serialized before the Module must not change incompatibly + // between any two builds (regardless of platform, architecture, ...). + // (The Module::assumptionsMatch() guard everything in the Module and + // afterwards.) + cursor = WriteScalar<uint32_t>(cursor, compiledSize); + + module.serialize(/* bytecodeBegin = */ nullptr, /* bytecodeSize = */ 0, cursor, compiledSize); + cursor += compiledSize; + + cursor = moduleChars.serialize(cursor); + + MOZ_RELEASE_ASSERT(cursor == entry.memory + serializedSize); + + return JS::AsmJSCache_Success; +} + +static bool +LookupAsmJSModuleInCache(ExclusiveContext* cx, AsmJSParser& parser, bool* loadedFromCache, + SharedModule* module, UniqueChars* compilationTimeReport) +{ + int64_t before = PRMJ_Now(); + + *loadedFromCache = false; + + JS::OpenAsmJSCacheEntryForReadOp open = cx->asmJSCacheOps().openEntryForRead; + if (!open) + return true; + + const char16_t* begin = parser.tokenStream.rawCharPtrAt(ModuleChars::beginOffset(parser)); + const char16_t* limit = parser.tokenStream.rawLimit(); + + ScopedCacheEntryOpenedForRead entry(cx); + if (!open(cx->global(), begin, limit, &entry.serializedSize, &entry.memory, &entry.handle)) + return true; + + size_t remain = entry.serializedSize; + const uint8_t* cursor = entry.memory; + + uint32_t compiledSize; + cursor = ReadScalarChecked<uint32_t>(cursor, &remain, &compiledSize); + if (!cursor) + return true; + + Assumptions assumptions; + if (!assumptions.initBuildIdFromContext(cx)) + return false; + + if (!Module::assumptionsMatch(assumptions, cursor, remain)) + return true; + + MutableAsmJSMetadata asmJSMetadata = cx->new_<AsmJSMetadata>(); + if (!asmJSMetadata) + return false; + + *module = Module::deserialize(/* bytecodeBegin = */ nullptr, /* bytecodeSize = */ 0, + cursor, compiledSize, asmJSMetadata.get()); + if (!*module) { + ReportOutOfMemory(cx); + return false; + } + cursor += compiledSize; + + // Due to the hash comparison made by openEntryForRead, this should succeed + // with high probability. + ModuleCharsForLookup moduleChars; + cursor = moduleChars.deserialize(cursor); + if (!moduleChars.match(parser)) + return true; + + // Don't punish release users by crashing if there is a programmer error + // here, just gracefully return with a cache miss. +#ifdef NIGHTLY_BUILD + MOZ_RELEASE_ASSERT(cursor == entry.memory + entry.serializedSize); +#endif + if (cursor != entry.memory + entry.serializedSize) + return true; + + // See AsmJSMetadata comment as well as ModuleValidator::init(). + asmJSMetadata->srcStart = parser.pc->functionBox()->functionNode->pn_body->pn_pos.begin; + asmJSMetadata->srcBodyStart = parser.tokenStream.currentToken().pos.end; + asmJSMetadata->strict = parser.pc->sc()->strict() && !parser.pc->sc()->hasExplicitUseStrict(); + asmJSMetadata->scriptSource.reset(parser.ss); + + if (!parser.tokenStream.advance(asmJSMetadata->srcEndBeforeCurly())) + return false; + + int64_t after = PRMJ_Now(); + int ms = (after - before) / PRMJ_USEC_PER_MSEC; + *compilationTimeReport = UniqueChars(JS_smprintf("loaded from cache in %dms", ms)); + if (!*compilationTimeReport) + return false; + + *loadedFromCache = true; + return true; +} + +/*****************************************************************************/ +// Top-level js::CompileAsmJS + +static bool +NoExceptionPending(ExclusiveContext* cx) +{ + return !cx->isJSContext() || !cx->asJSContext()->isExceptionPending(); +} + +static bool +Warn(AsmJSParser& parser, int errorNumber, const char* str) +{ + ParseReportKind reportKind = parser.options().throwOnAsmJSValidationFailureOption && + errorNumber == JSMSG_USE_ASM_TYPE_FAIL + ? ParseError + : ParseWarning; + parser.reportNoOffset(reportKind, /* strict = */ false, errorNumber, str ? str : ""); + return false; +} + +static bool +EstablishPreconditions(ExclusiveContext* cx, AsmJSParser& parser) +{ + if (!HasCompilerSupport(cx)) + return Warn(parser, JSMSG_USE_ASM_TYPE_FAIL, "Disabled by lack of compiler support"); + + switch (parser.options().asmJSOption) { + case AsmJSOption::Disabled: + return Warn(parser, JSMSG_USE_ASM_TYPE_FAIL, "Disabled by 'asmjs' runtime option"); + case AsmJSOption::DisabledByDebugger: + return Warn(parser, JSMSG_USE_ASM_TYPE_FAIL, "Disabled by debugger"); + case AsmJSOption::Enabled: + break; + } + + if (parser.pc->isGenerator()) + return Warn(parser, JSMSG_USE_ASM_TYPE_FAIL, "Disabled by generator context"); + + if (parser.pc->isArrowFunction()) + return Warn(parser, JSMSG_USE_ASM_TYPE_FAIL, "Disabled by arrow function context"); + + // Class constructors are also methods + if (parser.pc->isMethod()) + return Warn(parser, JSMSG_USE_ASM_TYPE_FAIL, "Disabled by class constructor or method context"); + + return true; +} + +static UniqueChars +BuildConsoleMessage(ExclusiveContext* cx, unsigned time, JS::AsmJSCacheResult cacheResult) +{ +#ifndef JS_MORE_DETERMINISTIC + const char* cacheString = ""; + switch (cacheResult) { + case JS::AsmJSCache_Success: + cacheString = "stored in cache"; + break; + case JS::AsmJSCache_ModuleTooSmall: + cacheString = "not stored in cache (too small to benefit)"; + break; + case JS::AsmJSCache_SynchronousScript: + cacheString = "unable to cache asm.js in synchronous scripts; try loading " + "asm.js via <script async> or createElement('script')"; + break; + case JS::AsmJSCache_QuotaExceeded: + cacheString = "not enough temporary storage quota to store in cache"; + break; + case JS::AsmJSCache_StorageInitFailure: + cacheString = "storage initialization failed (consider filing a bug)"; + break; + case JS::AsmJSCache_Disabled_Internal: + cacheString = "caching disabled by internal configuration (consider filing a bug)"; + break; + case JS::AsmJSCache_Disabled_ShellFlags: + cacheString = "caching disabled by missing command-line arguments"; + break; + case JS::AsmJSCache_Disabled_JitInspector: + cacheString = "caching disabled by active JIT inspector"; + break; + case JS::AsmJSCache_InternalError: + cacheString = "unable to store in cache due to internal error (consider filing a bug)"; + break; + case JS::AsmJSCache_Disabled_PrivateBrowsing: + cacheString = "caching disabled by private browsing mode"; + break; + case JS::AsmJSCache_ESR52: + cacheString = "caching disabled in Firefox ESR52"; + break; + case JS::AsmJSCache_LIMIT: + MOZ_CRASH("bad AsmJSCacheResult"); + break; + } + + return UniqueChars(JS_smprintf("total compilation time %dms; %s", time, cacheString)); +#else + return DuplicateString(""); +#endif +} + +bool +js::CompileAsmJS(ExclusiveContext* cx, AsmJSParser& parser, ParseNode* stmtList, bool* validated) +{ + *validated = false; + + // Various conditions disable asm.js optimizations. + if (!EstablishPreconditions(cx, parser)) + return NoExceptionPending(cx); + + // Before spending any time parsing the module, try to look it up in the + // embedding's cache using the chars about to be parsed as the key. + bool loadedFromCache; + SharedModule module; + UniqueChars message; + if (!LookupAsmJSModuleInCache(cx, parser, &loadedFromCache, &module, &message)) + return false; + + // If not present in the cache, parse, validate and generate code in a + // single linear pass over the chars of the asm.js module. + if (!loadedFromCache) { + // "Checking" parses, validates and compiles, producing a fully compiled + // WasmModuleObject as result. + unsigned time; + module = CheckModule(cx, parser, stmtList, &time); + if (!module) + return NoExceptionPending(cx); + + // Try to store the AsmJSModule in the embedding's cache. The + // AsmJSModule must be stored before static linking since static linking + // specializes the AsmJSModule to the current process's address space + // and therefore must be executed after a cache hit. + JS::AsmJSCacheResult cacheResult = StoreAsmJSModuleInCache(parser, *module, cx); + + // Build the string message to display in the developer console. + message = BuildConsoleMessage(cx, time, cacheResult); + if (!message) + return NoExceptionPending(cx); + } + + // Hand over ownership to a GC object wrapper which can then be referenced + // from the module function. + Rooted<WasmModuleObject*> moduleObj(cx, WasmModuleObject::create(cx, *module)); + if (!moduleObj) + return false; + + // The module function dynamically links the AsmJSModule when called and + // generates a set of functions wrapping all the exports. + FunctionBox* funbox = parser.pc->functionBox(); + RootedFunction moduleFun(cx, NewAsmJSModuleFunction(cx, funbox->function(), moduleObj)); + if (!moduleFun) + return false; + + // Finished! Clobber the default function created by the parser with the new + // asm.js module function. Special cases in the bytecode emitter avoid + // generating bytecode for asm.js functions, allowing this asm.js module + // function to be the finished result. + MOZ_ASSERT(funbox->function()->isInterpreted()); + funbox->object = moduleFun; + + // Success! Write to the console with a "warning" message. + *validated = true; + Warn(parser, JSMSG_USE_ASM_TYPE_OK, message.get()); + return NoExceptionPending(cx); +} + +/*****************************************************************************/ +// asm.js testing functions + +bool +js::IsAsmJSModuleNative(Native native) +{ + return native == InstantiateAsmJS; +} + +bool +js::IsAsmJSModule(JSFunction* fun) +{ + return fun->maybeNative() == InstantiateAsmJS; +} + +bool +js::IsAsmJSFunction(JSFunction* fun) +{ + if (IsExportedFunction(fun)) + return ExportedFunctionToInstance(fun).metadata().isAsmJS(); + return false; +} + +bool +js::IsAsmJSStrictModeModuleOrFunction(JSFunction* fun) +{ + if (IsAsmJSModule(fun)) + return AsmJSModuleFunctionToModule(fun).metadata().asAsmJS().strict; + + if (IsAsmJSFunction(fun)) + return ExportedFunctionToInstance(fun).metadata().asAsmJS().strict; + + return false; +} + +bool +js::IsAsmJSCompilationAvailable(JSContext* cx, unsigned argc, Value* vp) +{ + CallArgs args = CallArgsFromVp(argc, vp); + + // See EstablishPreconditions. + bool available = HasCompilerSupport(cx) && cx->options().asmJS(); + + args.rval().set(BooleanValue(available)); + return true; +} + +static JSFunction* +MaybeWrappedNativeFunction(const Value& v) +{ + if (!v.isObject()) + return nullptr; + + JSObject* obj = CheckedUnwrap(&v.toObject()); + if (!obj) + return nullptr; + + if (!obj->is<JSFunction>()) + return nullptr; + + return &obj->as<JSFunction>(); +} + +bool +js::IsAsmJSModule(JSContext* cx, unsigned argc, Value* vp) +{ + CallArgs args = CallArgsFromVp(argc, vp); + + bool rval = false; + if (JSFunction* fun = MaybeWrappedNativeFunction(args.get(0))) + rval = IsAsmJSModule(fun); + + args.rval().set(BooleanValue(rval)); + return true; +} + +bool +js::IsAsmJSFunction(JSContext* cx, unsigned argc, Value* vp) +{ + CallArgs args = CallArgsFromVp(argc, vp); + + bool rval = false; + if (JSFunction* fun = MaybeWrappedNativeFunction(args.get(0))) + rval = IsAsmJSFunction(fun); + + args.rval().set(BooleanValue(rval)); + return true; +} + +bool +js::IsAsmJSModuleLoadedFromCache(JSContext* cx, unsigned argc, Value* vp) +{ + CallArgs args = CallArgsFromVp(argc, vp); + + JSFunction* fun = MaybeWrappedNativeFunction(args.get(0)); + if (!fun || !IsAsmJSModule(fun)) { + JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_USE_ASM_TYPE_FAIL, + "argument passed to isAsmJSModuleLoadedFromCache is not a " + "validated asm.js module"); + return false; + } + + bool loadedFromCache = + AsmJSModuleFunctionToModule(fun).metadata().asAsmJS().cacheResult == CacheResult::Hit; + + args.rval().set(BooleanValue(loadedFromCache)); + return true; +} + +/*****************************************************************************/ +// asm.js toString/toSource support + +static MOZ_MUST_USE bool +MaybeAppendUTF8Chars(JSContext* cx, const char* sep, const char* utf8Chars, StringBuffer* sb) +{ + if (!utf8Chars) + return true; + + UTF8Chars utf8(utf8Chars, strlen(utf8Chars)); + + size_t length; + UniqueTwoByteChars twoByteChars(UTF8CharsToNewTwoByteCharsZ(cx, utf8, &length).get()); + if (!twoByteChars) + return false; + + return sb->append(sep, strlen(sep)) && + sb->append(twoByteChars.get(), length); +} + +JSString* +js::AsmJSModuleToString(JSContext* cx, HandleFunction fun, bool addParenToLambda) +{ + MOZ_ASSERT(IsAsmJSModule(fun)); + + const AsmJSMetadata& metadata = AsmJSModuleFunctionToModule(fun).metadata().asAsmJS(); + uint32_t begin = metadata.srcStart; + uint32_t end = metadata.srcEndAfterCurly(); + ScriptSource* source = metadata.scriptSource.get(); + + StringBuffer out(cx); + + if (addParenToLambda && fun->isLambda() && !out.append("(")) + return nullptr; + + if (!out.append("function ")) + return nullptr; + + if (fun->name() && !out.append(fun->name())) + return nullptr; + + bool haveSource = source->hasSourceData(); + if (!haveSource && !JSScript::loadSource(cx, source, &haveSource)) + return nullptr; + + if (!haveSource) { + if (!out.append("() {\n [sourceless code]\n}")) + return nullptr; + } else { + // Whether the function has been created with a Function ctor + bool funCtor = begin == 0 && end == source->length() && source->argumentsNotIncluded(); + if (funCtor) { + // Functions created with the function constructor don't have arguments in their source. + if (!out.append("(")) + return nullptr; + + if (!MaybeAppendUTF8Chars(cx, "", metadata.globalArgumentName.get(), &out)) + return nullptr; + if (!MaybeAppendUTF8Chars(cx, ", ", metadata.importArgumentName.get(), &out)) + return nullptr; + if (!MaybeAppendUTF8Chars(cx, ", ", metadata.bufferArgumentName.get(), &out)) + return nullptr; + + if (!out.append(") {\n")) + return nullptr; + } + + Rooted<JSFlatString*> src(cx, source->substring(cx, begin, end)); + if (!src) + return nullptr; + + if (!out.append(src)) + return nullptr; + + if (funCtor && !out.append("\n}")) + return nullptr; + } + + if (addParenToLambda && fun->isLambda() && !out.append(")")) + return nullptr; + + return out.finishString(); +} + +JSString* +js::AsmJSFunctionToString(JSContext* cx, HandleFunction fun) +{ + MOZ_ASSERT(IsAsmJSFunction(fun)); + + const AsmJSMetadata& metadata = ExportedFunctionToInstance(fun).metadata().asAsmJS(); + const AsmJSExport& f = metadata.lookupAsmJSExport(ExportedFunctionToFuncIndex(fun)); + + uint32_t begin = metadata.srcStart + f.startOffsetInModule(); + uint32_t end = metadata.srcStart + f.endOffsetInModule(); + + ScriptSource* source = metadata.scriptSource.get(); + StringBuffer out(cx); + + if (!out.append("function ")) + return nullptr; + + bool haveSource = source->hasSourceData(); + if (!haveSource && !JSScript::loadSource(cx, source, &haveSource)) + return nullptr; + + if (!haveSource) { + // asm.js functions can't be anonymous + MOZ_ASSERT(fun->name()); + if (!out.append(fun->name())) + return nullptr; + if (!out.append("() {\n [sourceless code]\n}")) + return nullptr; + } else { + // asm.js functions cannot have been created with a Function constructor + // as they belong within a module. + MOZ_ASSERT(!(begin == 0 && end == source->length() && source->argumentsNotIncluded())); + + Rooted<JSFlatString*> src(cx, source->substring(cx, begin, end)); + if (!src) + return nullptr; + if (!out.append(src)) + return nullptr; + } + + return out.finishString(); +} + +bool +js::IsValidAsmJSHeapLength(uint32_t length) +{ + if (length < MinHeapLength) + return false; + + return wasm::IsValidARMImmediate(length); +} |