diff options
Diffstat (limited to 'js/src/frontend')
22 files changed, 34450 insertions, 0 deletions
diff --git a/js/src/frontend/BytecodeCompiler.cpp b/js/src/frontend/BytecodeCompiler.cpp new file mode 100644 index 000000000..d4c758b6c --- /dev/null +++ b/js/src/frontend/BytecodeCompiler.cpp @@ -0,0 +1,738 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- + * vim: set ts=8 sts=4 et sw=4 tw=99: + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#include "frontend/BytecodeCompiler.h" + +#include "mozilla/IntegerPrintfMacros.h" + +#include "jscntxt.h" +#include "jsscript.h" + +#include "builtin/ModuleObject.h" +#include "frontend/BytecodeEmitter.h" +#include "frontend/FoldConstants.h" +#include "frontend/NameFunctions.h" +#include "frontend/Parser.h" +#include "vm/GlobalObject.h" +#include "vm/TraceLogging.h" +#include "wasm/AsmJS.h" + +#include "jsobjinlines.h" +#include "jsscriptinlines.h" + +#include "vm/EnvironmentObject-inl.h" + +using namespace js; +using namespace js::frontend; +using mozilla::Maybe; + +class MOZ_STACK_CLASS AutoCompilationTraceLogger +{ + public: + AutoCompilationTraceLogger(ExclusiveContext* cx, const TraceLoggerTextId id, + const ReadOnlyCompileOptions& options); + + private: + TraceLoggerThread* logger; + TraceLoggerEvent event; + AutoTraceLog scriptLogger; + AutoTraceLog typeLogger; +}; + +// The BytecodeCompiler class contains resources common to compiling scripts and +// function bodies. +class MOZ_STACK_CLASS BytecodeCompiler +{ + public: + // Construct an object passing mandatory arguments. + BytecodeCompiler(ExclusiveContext* cx, + LifoAlloc& alloc, + const ReadOnlyCompileOptions& options, + SourceBufferHolder& sourceBuffer, + HandleScope enclosingScope, + TraceLoggerTextId logId); + + // Call setters for optional arguments. + void maybeSetSourceCompressor(SourceCompressionTask* sourceCompressor); + void setSourceArgumentsNotIncluded(); + + JSScript* compileGlobalScript(ScopeKind scopeKind); + JSScript* compileEvalScript(HandleObject environment, HandleScope enclosingScope); + ModuleObject* compileModule(); + bool compileFunctionBody(MutableHandleFunction fun, Handle<PropertyNameVector> formals, + GeneratorKind generatorKind, FunctionAsyncKind asyncKind); + + ScriptSourceObject* sourceObjectPtr() const; + + private: + JSScript* compileScript(HandleObject environment, SharedContext* sc); + bool checkLength(); + bool createScriptSource(); + bool maybeCompressSource(); + bool canLazilyParse(); + bool createParser(); + bool createSourceAndParser(); + bool createScript(); + bool emplaceEmitter(Maybe<BytecodeEmitter>& emitter, SharedContext* sharedContext); + bool handleParseFailure(const Directives& newDirectives); + bool deoptimizeArgumentsInEnclosingScripts(JSContext* cx, HandleObject environment); + bool maybeCompleteCompressSource(); + + AutoCompilationTraceLogger traceLogger; + AutoKeepAtoms keepAtoms; + + ExclusiveContext* cx; + LifoAlloc& alloc; + const ReadOnlyCompileOptions& options; + SourceBufferHolder& sourceBuffer; + + RootedScope enclosingScope; + bool sourceArgumentsNotIncluded; + + RootedScriptSource sourceObject; + ScriptSource* scriptSource; + + Maybe<SourceCompressionTask> maybeSourceCompressor; + SourceCompressionTask* sourceCompressor; + + Maybe<UsedNameTracker> usedNames; + Maybe<Parser<SyntaxParseHandler>> syntaxParser; + Maybe<Parser<FullParseHandler>> parser; + + Directives directives; + TokenStream::Position startPosition; + + RootedScript script; +}; + +AutoCompilationTraceLogger::AutoCompilationTraceLogger(ExclusiveContext* cx, + const TraceLoggerTextId id, const ReadOnlyCompileOptions& options) + : logger(cx->isJSContext() ? TraceLoggerForMainThread(cx->asJSContext()->runtime()) + : TraceLoggerForCurrentThread()), + event(logger, TraceLogger_AnnotateScripts, options), + scriptLogger(logger, event), + typeLogger(logger, id) +{} + +BytecodeCompiler::BytecodeCompiler(ExclusiveContext* cx, + LifoAlloc& alloc, + const ReadOnlyCompileOptions& options, + SourceBufferHolder& sourceBuffer, + HandleScope enclosingScope, + TraceLoggerTextId logId) + : traceLogger(cx, logId, options), + keepAtoms(cx->perThreadData), + cx(cx), + alloc(alloc), + options(options), + sourceBuffer(sourceBuffer), + enclosingScope(cx, enclosingScope), + sourceArgumentsNotIncluded(false), + sourceObject(cx), + scriptSource(nullptr), + sourceCompressor(nullptr), + directives(options.strictOption), + startPosition(keepAtoms), + script(cx) +{ + MOZ_ASSERT(sourceBuffer.get()); +} + +void +BytecodeCompiler::maybeSetSourceCompressor(SourceCompressionTask* sourceCompressor) +{ + this->sourceCompressor = sourceCompressor; +} + +void +BytecodeCompiler::setSourceArgumentsNotIncluded() +{ + sourceArgumentsNotIncluded = true; +} + +bool +BytecodeCompiler::checkLength() +{ + // Note this limit is simply so we can store sourceStart and sourceEnd in + // JSScript as 32-bits. It could be lifted fairly easily, since the compiler + // is using size_t internally already. + if (sourceBuffer.length() > UINT32_MAX) { + if (cx->isJSContext()) + JS_ReportErrorNumberASCII(cx->asJSContext(), GetErrorMessage, nullptr, + JSMSG_SOURCE_TOO_LONG); + return false; + } + return true; +} + +bool +BytecodeCompiler::createScriptSource() +{ + if (!checkLength()) + return false; + + sourceObject = CreateScriptSourceObject(cx, options); + if (!sourceObject) + return false; + + scriptSource = sourceObject->source(); + return true; +} + +bool +BytecodeCompiler::maybeCompressSource() +{ + if (!sourceCompressor) { + maybeSourceCompressor.emplace(cx); + sourceCompressor = maybeSourceCompressor.ptr(); + } + + if (!cx->compartment()->behaviors().discardSource()) { + if (options.sourceIsLazy) { + scriptSource->setSourceRetrievable(); + } else if (!scriptSource->setSourceCopy(cx, sourceBuffer, sourceArgumentsNotIncluded, + sourceCompressor)) + { + return false; + } + } + + return true; +} + +bool +BytecodeCompiler::canLazilyParse() +{ + return options.canLazilyParse && + !(enclosingScope && enclosingScope->hasOnChain(ScopeKind::NonSyntactic)) && + !cx->compartment()->behaviors().disableLazyParsing() && + !cx->compartment()->behaviors().discardSource() && + !options.sourceIsLazy && + !cx->lcovEnabled(); +} + +bool +BytecodeCompiler::createParser() +{ + usedNames.emplace(cx); + if (!usedNames->init()) + return false; + + if (canLazilyParse()) { + syntaxParser.emplace(cx, alloc, options, sourceBuffer.get(), sourceBuffer.length(), + /* foldConstants = */ false, *usedNames, + (Parser<SyntaxParseHandler>*) nullptr, (LazyScript*) nullptr); + + if (!syntaxParser->checkOptions()) + return false; + } + + parser.emplace(cx, alloc, options, sourceBuffer.get(), sourceBuffer.length(), + /* foldConstants = */ true, *usedNames, syntaxParser.ptrOr(nullptr), nullptr); + parser->sct = sourceCompressor; + parser->ss = scriptSource; + if (!parser->checkOptions()) + return false; + + parser->tokenStream.tell(&startPosition); + return true; +} + +bool +BytecodeCompiler::createSourceAndParser() +{ + return createScriptSource() && + maybeCompressSource() && + createParser(); +} + +bool +BytecodeCompiler::createScript() +{ + script = JSScript::Create(cx, options, + sourceObject, /* sourceStart = */ 0, sourceBuffer.length()); + return script != nullptr; +} + +bool +BytecodeCompiler::emplaceEmitter(Maybe<BytecodeEmitter>& emitter, SharedContext* sharedContext) +{ + BytecodeEmitter::EmitterMode emitterMode = + options.selfHostingMode ? BytecodeEmitter::SelfHosting : BytecodeEmitter::Normal; + emitter.emplace(/* parent = */ nullptr, parser.ptr(), sharedContext, script, + /* lazyScript = */ nullptr, options.lineno, emitterMode); + return emitter->init(); +} + +bool +BytecodeCompiler::handleParseFailure(const Directives& newDirectives) +{ + if (parser->hadAbortedSyntaxParse()) { + // Hit some unrecoverable ambiguity during an inner syntax parse. + // Syntax parsing has now been disabled in the parser, so retry + // the parse. + parser->clearAbortedSyntaxParse(); + } else if (parser->tokenStream.hadError() || directives == newDirectives) { + return false; + } + + parser->tokenStream.seek(startPosition); + + // Assignment must be monotonic to prevent reparsing iloops + MOZ_ASSERT_IF(directives.strict(), newDirectives.strict()); + MOZ_ASSERT_IF(directives.asmJS(), newDirectives.asmJS()); + directives = newDirectives; + return true; +} + +bool +BytecodeCompiler::deoptimizeArgumentsInEnclosingScripts(JSContext* cx, HandleObject environment) +{ + RootedObject env(cx, environment); + while (env->is<EnvironmentObject>() || env->is<DebugEnvironmentProxy>()) { + if (env->is<CallObject>()) { + RootedScript script(cx, env->as<CallObject>().callee().getOrCreateScript(cx)); + if (!script) + return false; + if (script->argumentsHasVarBinding()) { + if (!JSScript::argumentsOptimizationFailed(cx, script)) + return false; + } + } + env = env->enclosingEnvironment(); + } + + return true; +} + +bool +BytecodeCompiler::maybeCompleteCompressSource() +{ + return !maybeSourceCompressor || maybeSourceCompressor->complete(); +} + +JSScript* +BytecodeCompiler::compileScript(HandleObject environment, SharedContext* sc) +{ + if (!createSourceAndParser()) + return nullptr; + + if (!createScript()) + return nullptr; + + Maybe<BytecodeEmitter> emitter; + if (!emplaceEmitter(emitter, sc)) + return nullptr; + + for (;;) { + ParseNode* pn; + if (sc->isEvalContext()) + pn = parser->evalBody(sc->asEvalContext()); + else + pn = parser->globalBody(sc->asGlobalContext()); + + // Successfully parsed. Emit the script. + if (pn) { + if (sc->isEvalContext() && sc->hasDebuggerStatement() && cx->isJSContext()) { + // If the eval'ed script contains any debugger statement, force construction + // of arguments objects for the caller script and any other scripts it is + // transitively nested inside. The debugger can access any variable on the + // scope chain. + if (!deoptimizeArgumentsInEnclosingScripts(cx->asJSContext(), environment)) + return nullptr; + } + if (!NameFunctions(cx, pn)) + return nullptr; + if (!emitter->emitScript(pn)) + return nullptr; + parser->handler.freeTree(pn); + + break; + } + + // Maybe we aborted a syntax parse. See if we can try again. + if (!handleParseFailure(directives)) + return nullptr; + + // Reset UsedNameTracker state before trying again. + usedNames->reset(); + } + + if (!maybeCompleteCompressSource()) + return nullptr; + + MOZ_ASSERT_IF(cx->isJSContext(), !cx->asJSContext()->isExceptionPending()); + + return script; +} + +JSScript* +BytecodeCompiler::compileGlobalScript(ScopeKind scopeKind) +{ + GlobalSharedContext globalsc(cx, scopeKind, directives, options.extraWarningsOption); + return compileScript(nullptr, &globalsc); +} + +JSScript* +BytecodeCompiler::compileEvalScript(HandleObject environment, HandleScope enclosingScope) +{ + EvalSharedContext evalsc(cx, environment, enclosingScope, + directives, options.extraWarningsOption); + return compileScript(environment, &evalsc); +} + +ModuleObject* +BytecodeCompiler::compileModule() +{ + if (!createSourceAndParser()) + return nullptr; + + Rooted<ModuleObject*> module(cx, ModuleObject::create(cx)); + if (!module) + return nullptr; + + if (!createScript()) + return nullptr; + + module->init(script); + + ModuleBuilder builder(cx, module); + ModuleSharedContext modulesc(cx, module, enclosingScope, builder); + ParseNode* pn = parser->moduleBody(&modulesc); + if (!pn) + return nullptr; + + if (!NameFunctions(cx, pn)) + return nullptr; + + Maybe<BytecodeEmitter> emitter; + if (!emplaceEmitter(emitter, &modulesc)) + return nullptr; + if (!emitter->emitScript(pn->pn_body)) + return nullptr; + + parser->handler.freeTree(pn); + + if (!builder.initModule()) + return nullptr; + + RootedModuleEnvironmentObject env(cx, ModuleEnvironmentObject::create(cx, module)); + if (!env) + return nullptr; + + module->setInitialEnvironment(env); + + if (!maybeCompleteCompressSource()) + return nullptr; + + MOZ_ASSERT_IF(cx->isJSContext(), !cx->asJSContext()->isExceptionPending()); + return module; +} + +bool +BytecodeCompiler::compileFunctionBody(MutableHandleFunction fun, + Handle<PropertyNameVector> formals, + GeneratorKind generatorKind, + FunctionAsyncKind asyncKind) +{ + MOZ_ASSERT(fun); + MOZ_ASSERT(fun->isTenured()); + + fun->setArgCount(formals.length()); + + if (!createSourceAndParser()) + return false; + + // Speculatively parse using the default directives implied by the context. + // If a directive is encountered (e.g., "use strict") that changes how the + // function should have been parsed, we backup and reparse with the new set + // of directives. + + ParseNode* fn; + do { + Directives newDirectives = directives; + fn = parser->standaloneFunctionBody(fun, enclosingScope, formals, generatorKind, asyncKind, + directives, &newDirectives); + if (!fn && !handleParseFailure(newDirectives)) + return false; + } while (!fn); + + if (!NameFunctions(cx, fn)) + return false; + + if (fn->pn_funbox->function()->isInterpreted()) { + MOZ_ASSERT(fun == fn->pn_funbox->function()); + + if (!createScript()) + return false; + + Maybe<BytecodeEmitter> emitter; + if (!emplaceEmitter(emitter, fn->pn_funbox)) + return false; + if (!emitter->emitFunctionScript(fn->pn_body)) + return false; + } else { + fun.set(fn->pn_funbox->function()); + MOZ_ASSERT(IsAsmJSModule(fun)); + } + + if (!maybeCompleteCompressSource()) + return false; + + return true; +} + +ScriptSourceObject* +BytecodeCompiler::sourceObjectPtr() const +{ + return sourceObject.get(); +} + +ScriptSourceObject* +frontend::CreateScriptSourceObject(ExclusiveContext* cx, const ReadOnlyCompileOptions& options) +{ + ScriptSource* ss = cx->new_<ScriptSource>(); + if (!ss) + return nullptr; + ScriptSourceHolder ssHolder(ss); + + if (!ss->initFromOptions(cx, options)) + return nullptr; + + RootedScriptSource sso(cx, ScriptSourceObject::create(cx, ss)); + if (!sso) + return nullptr; + + // Off-thread compilations do all their GC heap allocation, including the + // SSO, in a temporary compartment. Hence, for the SSO to refer to the + // gc-heap-allocated values in |options|, it would need cross-compartment + // wrappers from the temporary compartment to the real compartment --- which + // would then be inappropriate once we merged the temporary and real + // compartments. + // + // Instead, we put off populating those SSO slots in off-thread compilations + // until after we've merged compartments. + if (cx->isJSContext()) { + if (!ScriptSourceObject::initFromOptions(cx->asJSContext(), sso, options)) + return nullptr; + } + + return sso; +} + +// CompileScript independently returns the ScriptSourceObject (SSO) for the +// compile. This is used by off-main-thread script compilation (OMT-SC). +// +// OMT-SC cannot initialize the SSO when it is first constructed because the +// SSO is allocated initially in a separate compartment. +// +// After OMT-SC, the separate compartment is merged with the main compartment, +// at which point the JSScripts created become observable by the debugger via +// memory-space scanning. +// +// Whatever happens to the top-level script compilation (even if it fails and +// returns null), we must finish initializing the SSO. This is because there +// may be valid inner scripts observable by the debugger which reference the +// partially-initialized SSO. +class MOZ_STACK_CLASS AutoInitializeSourceObject +{ + BytecodeCompiler& compiler_; + ScriptSourceObject** sourceObjectOut_; + + public: + AutoInitializeSourceObject(BytecodeCompiler& compiler, ScriptSourceObject** sourceObjectOut) + : compiler_(compiler), + sourceObjectOut_(sourceObjectOut) + { } + + ~AutoInitializeSourceObject() { + if (sourceObjectOut_) + *sourceObjectOut_ = compiler_.sourceObjectPtr(); + } +}; + +JSScript* +frontend::CompileGlobalScript(ExclusiveContext* cx, LifoAlloc& alloc, ScopeKind scopeKind, + const ReadOnlyCompileOptions& options, + SourceBufferHolder& srcBuf, + SourceCompressionTask* extraSct, + ScriptSourceObject** sourceObjectOut) +{ + MOZ_ASSERT(scopeKind == ScopeKind::Global || scopeKind == ScopeKind::NonSyntactic); + BytecodeCompiler compiler(cx, alloc, options, srcBuf, /* enclosingScope = */ nullptr, + TraceLogger_ParserCompileScript); + AutoInitializeSourceObject autoSSO(compiler, sourceObjectOut); + compiler.maybeSetSourceCompressor(extraSct); + return compiler.compileGlobalScript(scopeKind); +} + +JSScript* +frontend::CompileEvalScript(ExclusiveContext* cx, LifoAlloc& alloc, + HandleObject environment, HandleScope enclosingScope, + const ReadOnlyCompileOptions& options, + SourceBufferHolder& srcBuf, + SourceCompressionTask* extraSct, + ScriptSourceObject** sourceObjectOut) +{ + BytecodeCompiler compiler(cx, alloc, options, srcBuf, enclosingScope, + TraceLogger_ParserCompileScript); + AutoInitializeSourceObject autoSSO(compiler, sourceObjectOut); + compiler.maybeSetSourceCompressor(extraSct); + return compiler.compileEvalScript(environment, enclosingScope); +} + +ModuleObject* +frontend::CompileModule(ExclusiveContext* cx, const ReadOnlyCompileOptions& optionsInput, + SourceBufferHolder& srcBuf, LifoAlloc& alloc, + ScriptSourceObject** sourceObjectOut /* = nullptr */) +{ + MOZ_ASSERT(srcBuf.get()); + MOZ_ASSERT_IF(sourceObjectOut, *sourceObjectOut == nullptr); + + CompileOptions options(cx, optionsInput); + options.maybeMakeStrictMode(true); // ES6 10.2.1 Module code is always strict mode code. + options.setIsRunOnce(true); + + RootedScope emptyGlobalScope(cx, &cx->global()->emptyGlobalScope()); + BytecodeCompiler compiler(cx, alloc, options, srcBuf, emptyGlobalScope, + TraceLogger_ParserCompileModule); + AutoInitializeSourceObject autoSSO(compiler, sourceObjectOut); + return compiler.compileModule(); +} + +ModuleObject* +frontend::CompileModule(JSContext* cx, const ReadOnlyCompileOptions& options, + SourceBufferHolder& srcBuf) +{ + if (!GlobalObject::ensureModulePrototypesCreated(cx, cx->global())) + return nullptr; + + LifoAlloc& alloc = cx->asJSContext()->tempLifoAlloc(); + RootedModuleObject module(cx, CompileModule(cx, options, srcBuf, alloc)); + if (!module) + return nullptr; + + // This happens in GlobalHelperThreadState::finishModuleParseTask() when a + // module is compiled off main thread. + if (!ModuleObject::Freeze(cx->asJSContext(), module)) + return nullptr; + + return module; +} + +bool +frontend::CompileLazyFunction(JSContext* cx, Handle<LazyScript*> lazy, const char16_t* chars, size_t length) +{ + MOZ_ASSERT(cx->compartment() == lazy->functionNonDelazifying()->compartment()); + + CompileOptions options(cx, lazy->version()); + options.setMutedErrors(lazy->mutedErrors()) + .setFileAndLine(lazy->filename(), lazy->lineno()) + .setColumn(lazy->column()) + .setNoScriptRval(false) + .setSelfHostingMode(false); + + AutoCompilationTraceLogger traceLogger(cx, TraceLogger_ParserCompileLazy, options); + + UsedNameTracker usedNames(cx); + if (!usedNames.init()) + return false; + Parser<FullParseHandler> parser(cx, cx->tempLifoAlloc(), options, chars, length, + /* foldConstants = */ true, usedNames, nullptr, lazy); + if (!parser.checkOptions()) + return false; + + Rooted<JSFunction*> fun(cx, lazy->functionNonDelazifying()); + MOZ_ASSERT(!lazy->isLegacyGenerator()); + ParseNode* pn = parser.standaloneLazyFunction(fun, lazy->strict(), lazy->generatorKind(), + lazy->asyncKind()); + if (!pn) + return false; + + if (!NameFunctions(cx, pn)) + return false; + + RootedScriptSource sourceObject(cx, lazy->sourceObject()); + MOZ_ASSERT(sourceObject); + + Rooted<JSScript*> script(cx, JSScript::Create(cx, options, sourceObject, + lazy->begin(), lazy->end())); + if (!script) + return false; + + if (lazy->isLikelyConstructorWrapper()) + script->setLikelyConstructorWrapper(); + if (lazy->hasBeenCloned()) + script->setHasBeenCloned(); + + BytecodeEmitter bce(/* parent = */ nullptr, &parser, pn->pn_funbox, script, lazy, + pn->pn_pos, BytecodeEmitter::LazyFunction); + if (!bce.init()) + return false; + + return bce.emitFunctionScript(pn->pn_body); +} + +// Compile a JS function body, which might appear as the value of an event +// handler attribute in an HTML <INPUT> tag, or in a Function() constructor. +static bool +CompileFunctionBody(JSContext* cx, MutableHandleFunction fun, const ReadOnlyCompileOptions& options, + Handle<PropertyNameVector> formals, SourceBufferHolder& srcBuf, + HandleScope enclosingScope, GeneratorKind generatorKind, + FunctionAsyncKind asyncKind) +{ + MOZ_ASSERT(!options.isRunOnce); + + // FIXME: make Function pass in two strings and parse them as arguments and + // ProgramElements respectively. + + BytecodeCompiler compiler(cx, cx->tempLifoAlloc(), options, srcBuf, enclosingScope, + TraceLogger_ParserCompileFunction); + compiler.setSourceArgumentsNotIncluded(); + return compiler.compileFunctionBody(fun, formals, generatorKind, asyncKind); +} + +bool +frontend::CompileFunctionBody(JSContext* cx, MutableHandleFunction fun, + const ReadOnlyCompileOptions& options, + Handle<PropertyNameVector> formals, JS::SourceBufferHolder& srcBuf, + HandleScope enclosingScope) +{ + return CompileFunctionBody(cx, fun, options, formals, srcBuf, enclosingScope, NotGenerator, + SyncFunction); +} + +bool +frontend::CompileFunctionBody(JSContext* cx, MutableHandleFunction fun, + const ReadOnlyCompileOptions& options, + Handle<PropertyNameVector> formals, JS::SourceBufferHolder& srcBuf) +{ + RootedScope emptyGlobalScope(cx, &cx->global()->emptyGlobalScope()); + return CompileFunctionBody(cx, fun, options, formals, srcBuf, emptyGlobalScope, + NotGenerator, SyncFunction); +} + +bool +frontend::CompileStarGeneratorBody(JSContext* cx, MutableHandleFunction fun, + const ReadOnlyCompileOptions& options, + Handle<PropertyNameVector> formals, + JS::SourceBufferHolder& srcBuf) +{ + RootedScope emptyGlobalScope(cx, &cx->global()->emptyGlobalScope()); + return CompileFunctionBody(cx, fun, options, formals, srcBuf, emptyGlobalScope, + StarGenerator, SyncFunction); +} + +bool +frontend::CompileAsyncFunctionBody(JSContext* cx, MutableHandleFunction fun, + const ReadOnlyCompileOptions& options, + Handle<PropertyNameVector> formals, + JS::SourceBufferHolder& srcBuf) +{ + RootedScope emptyGlobalScope(cx, &cx->global()->emptyGlobalScope()); + return CompileFunctionBody(cx, fun, options, formals, srcBuf, emptyGlobalScope, + StarGenerator, AsyncFunction); +} diff --git a/js/src/frontend/BytecodeCompiler.h b/js/src/frontend/BytecodeCompiler.h new file mode 100644 index 000000000..1d86f1160 --- /dev/null +++ b/js/src/frontend/BytecodeCompiler.h @@ -0,0 +1,108 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- + * vim: set ts=8 sts=4 et sw=4 tw=99: + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#ifndef frontend_BytecodeCompiler_h +#define frontend_BytecodeCompiler_h + +#include "NamespaceImports.h" + +#include "vm/Scope.h" +#include "vm/String.h" + +class JSLinearString; + +namespace js { + +class LazyScript; +class LifoAlloc; +class ModuleObject; +class ScriptSourceObject; +struct SourceCompressionTask; + +namespace frontend { + +JSScript* +CompileGlobalScript(ExclusiveContext* cx, LifoAlloc& alloc, ScopeKind scopeKind, + const ReadOnlyCompileOptions& options, + SourceBufferHolder& srcBuf, + SourceCompressionTask* extraSct = nullptr, + ScriptSourceObject** sourceObjectOut = nullptr); + +JSScript* +CompileEvalScript(ExclusiveContext* cx, LifoAlloc& alloc, + HandleObject scopeChain, HandleScope enclosingScope, + const ReadOnlyCompileOptions& options, + SourceBufferHolder& srcBuf, + SourceCompressionTask* extraSct = nullptr, + ScriptSourceObject** sourceObjectOut = nullptr); + +ModuleObject* +CompileModule(JSContext* cx, const ReadOnlyCompileOptions& options, + SourceBufferHolder& srcBuf); + +ModuleObject* +CompileModule(ExclusiveContext* cx, const ReadOnlyCompileOptions& options, + SourceBufferHolder& srcBuf, LifoAlloc& alloc, + ScriptSourceObject** sourceObjectOut = nullptr); + +MOZ_MUST_USE bool +CompileLazyFunction(JSContext* cx, Handle<LazyScript*> lazy, const char16_t* chars, size_t length); + +MOZ_MUST_USE bool +CompileFunctionBody(JSContext* cx, MutableHandleFunction fun, + const ReadOnlyCompileOptions& options, + Handle<PropertyNameVector> formals, JS::SourceBufferHolder& srcBuf, + HandleScope enclosingScope); + +// As above, but defaults to the global lexical scope as the enclosing scope. +MOZ_MUST_USE bool +CompileFunctionBody(JSContext* cx, MutableHandleFunction fun, + const ReadOnlyCompileOptions& options, + Handle<PropertyNameVector> formals, JS::SourceBufferHolder& srcBuf); + +MOZ_MUST_USE bool +CompileStarGeneratorBody(JSContext* cx, MutableHandleFunction fun, + const ReadOnlyCompileOptions& options, + Handle<PropertyNameVector> formals, JS::SourceBufferHolder& srcBuf); + +MOZ_MUST_USE bool +CompileAsyncFunctionBody(JSContext* cx, MutableHandleFunction fun, + const ReadOnlyCompileOptions& options, + Handle<PropertyNameVector> formals, JS::SourceBufferHolder& srcBuf); + +ScriptSourceObject* +CreateScriptSourceObject(ExclusiveContext* cx, const ReadOnlyCompileOptions& options); + +/* + * True if str consists of an IdentifierStart character, followed by one or + * more IdentifierPart characters, i.e. it matches the IdentifierName production + * in the language spec. + * + * This returns true even if str is a keyword like "if". + * + * Defined in TokenStream.cpp. + */ +bool +IsIdentifier(JSLinearString* str); + +/* + * As above, but taking chars + length. + */ +bool +IsIdentifier(const char16_t* chars, size_t length); + +/* True if str is a keyword. Defined in TokenStream.cpp. */ +bool +IsKeyword(JSLinearString* str); + +/* GC marking. Defined in Parser.cpp. */ +void +MarkParser(JSTracer* trc, JS::AutoGCRooter* parser); + +} /* namespace frontend */ +} /* namespace js */ + +#endif /* frontend_BytecodeCompiler_h */ diff --git a/js/src/frontend/BytecodeEmitter.cpp b/js/src/frontend/BytecodeEmitter.cpp new file mode 100644 index 000000000..1e9d8f224 --- /dev/null +++ b/js/src/frontend/BytecodeEmitter.cpp @@ -0,0 +1,10170 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- + * vim: set ts=8 sts=4 et sw=4 tw=99: + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/* + * JS bytecode generation. + */ + +#include "frontend/BytecodeEmitter.h" + +#include "mozilla/ArrayUtils.h" +#include "mozilla/DebugOnly.h" +#include "mozilla/FloatingPoint.h" +#include "mozilla/Maybe.h" +#include "mozilla/PodOperations.h" + +#include <string.h> + +#include "jsapi.h" +#include "jsatom.h" +#include "jscntxt.h" +#include "jsfun.h" +#include "jsnum.h" +#include "jsopcode.h" +#include "jsscript.h" +#include "jstypes.h" +#include "jsutil.h" + +#include "frontend/Parser.h" +#include "frontend/TokenStream.h" +#include "vm/Debugger.h" +#include "vm/GeneratorObject.h" +#include "vm/Stack.h" +#include "wasm/AsmJS.h" + +#include "jsatominlines.h" +#include "jsobjinlines.h" +#include "jsscriptinlines.h" + +#include "frontend/ParseNode-inl.h" +#include "vm/EnvironmentObject-inl.h" +#include "vm/NativeObject-inl.h" + +using namespace js; +using namespace js::gc; +using namespace js::frontend; + +using mozilla::AssertedCast; +using mozilla::DebugOnly; +using mozilla::Maybe; +using mozilla::Nothing; +using mozilla::NumberIsInt32; +using mozilla::PodCopy; +using mozilla::Some; + +class BreakableControl; +class LabelControl; +class LoopControl; +class TryFinallyControl; + +static bool +ParseNodeRequiresSpecialLineNumberNotes(ParseNode* pn) +{ + return pn->getKind() == PNK_WHILE || pn->getKind() == PNK_FOR; +} + +// A cache that tracks superfluous TDZ checks. +// +// Each basic block should have a TDZCheckCache in scope. Some NestableControl +// subclasses contain a TDZCheckCache. +class BytecodeEmitter::TDZCheckCache : public Nestable<BytecodeEmitter::TDZCheckCache> +{ + PooledMapPtr<CheckTDZMap> cache_; + + MOZ_MUST_USE bool ensureCache(BytecodeEmitter* bce) { + return cache_ || cache_.acquire(bce->cx); + } + + public: + explicit TDZCheckCache(BytecodeEmitter* bce) + : Nestable<TDZCheckCache>(&bce->innermostTDZCheckCache), + cache_(bce->cx->frontendCollectionPool()) + { } + + Maybe<MaybeCheckTDZ> needsTDZCheck(BytecodeEmitter* bce, JSAtom* name); + MOZ_MUST_USE bool noteTDZCheck(BytecodeEmitter* bce, JSAtom* name, MaybeCheckTDZ check); +}; + +class BytecodeEmitter::NestableControl : public Nestable<BytecodeEmitter::NestableControl> +{ + StatementKind kind_; + + // The innermost scope when this was pushed. + EmitterScope* emitterScope_; + + protected: + NestableControl(BytecodeEmitter* bce, StatementKind kind) + : Nestable<NestableControl>(&bce->innermostNestableControl), + kind_(kind), + emitterScope_(bce->innermostEmitterScope) + { } + + public: + using Nestable<NestableControl>::enclosing; + using Nestable<NestableControl>::findNearest; + + StatementKind kind() const { + return kind_; + } + + EmitterScope* emitterScope() const { + return emitterScope_; + } + + template <typename T> + bool is() const; + + template <typename T> + T& as() { + MOZ_ASSERT(this->is<T>()); + return static_cast<T&>(*this); + } +}; + +// Template specializations are disallowed in different namespaces; specialize +// all the NestableControl subtypes up front. +namespace js { +namespace frontend { + +template <> +bool +BytecodeEmitter::NestableControl::is<BreakableControl>() const +{ + return StatementKindIsUnlabeledBreakTarget(kind_) || kind_ == StatementKind::Label; +} + +template <> +bool +BytecodeEmitter::NestableControl::is<LabelControl>() const +{ + return kind_ == StatementKind::Label; +} + +template <> +bool +BytecodeEmitter::NestableControl::is<LoopControl>() const +{ + return StatementKindIsLoop(kind_); +} + +template <> +bool +BytecodeEmitter::NestableControl::is<TryFinallyControl>() const +{ + return kind_ == StatementKind::Try || kind_ == StatementKind::Finally; +} + +} // namespace frontend +} // namespace js + +class BreakableControl : public BytecodeEmitter::NestableControl +{ + public: + // Offset of the last break. + JumpList breaks; + + BreakableControl(BytecodeEmitter* bce, StatementKind kind) + : NestableControl(bce, kind) + { + MOZ_ASSERT(is<BreakableControl>()); + } + + MOZ_MUST_USE bool patchBreaks(BytecodeEmitter* bce) { + return bce->emitJumpTargetAndPatch(breaks); + } +}; + +class LabelControl : public BreakableControl +{ + RootedAtom label_; + + // The code offset when this was pushed. Used for effectfulness checking. + ptrdiff_t startOffset_; + + public: + LabelControl(BytecodeEmitter* bce, JSAtom* label, ptrdiff_t startOffset) + : BreakableControl(bce, StatementKind::Label), + label_(bce->cx, label), + startOffset_(startOffset) + { } + + HandleAtom label() const { + return label_; + } + + ptrdiff_t startOffset() const { + return startOffset_; + } +}; + +class LoopControl : public BreakableControl +{ + // Loops' children are emitted in dominance order, so they can always + // have a TDZCheckCache. + BytecodeEmitter::TDZCheckCache tdzCache_; + + // Stack depth when this loop was pushed on the control stack. + int32_t stackDepth_; + + // The loop nesting depth. Used as a hint to Ion. + uint32_t loopDepth_; + + // Can we OSR into Ion from here? True unless there is non-loop state on the stack. + bool canIonOsr_; + + public: + // The target of continue statement jumps, e.g., the update portion of a + // for(;;) loop. + JumpTarget continueTarget; + + // Offset of the last continue in the loop. + JumpList continues; + + LoopControl(BytecodeEmitter* bce, StatementKind loopKind) + : BreakableControl(bce, loopKind), + tdzCache_(bce), + continueTarget({ -1 }) + { + MOZ_ASSERT(is<LoopControl>()); + + LoopControl* enclosingLoop = findNearest<LoopControl>(enclosing()); + + stackDepth_ = bce->stackDepth; + loopDepth_ = enclosingLoop ? enclosingLoop->loopDepth_ + 1 : 1; + + int loopSlots; + if (loopKind == StatementKind::Spread) + loopSlots = 3; + else if (loopKind == StatementKind::ForInLoop || loopKind == StatementKind::ForOfLoop) + loopSlots = 2; + else + loopSlots = 0; + + MOZ_ASSERT(loopSlots <= stackDepth_); + + if (enclosingLoop) { + canIonOsr_ = (enclosingLoop->canIonOsr_ && + stackDepth_ == enclosingLoop->stackDepth_ + loopSlots); + } else { + canIonOsr_ = stackDepth_ == loopSlots; + } + } + + uint32_t loopDepth() const { + return loopDepth_; + } + + bool canIonOsr() const { + return canIonOsr_; + } + + MOZ_MUST_USE bool patchBreaksAndContinues(BytecodeEmitter* bce) { + MOZ_ASSERT(continueTarget.offset != -1); + if (!patchBreaks(bce)) + return false; + bce->patchJumpsToTarget(continues, continueTarget); + return true; + } +}; + +class TryFinallyControl : public BytecodeEmitter::NestableControl +{ + bool emittingSubroutine_; + + public: + // The subroutine when emitting a finally block. + JumpList gosubs; + + // Offset of the last catch guard, if any. + JumpList guardJump; + + TryFinallyControl(BytecodeEmitter* bce, StatementKind kind) + : NestableControl(bce, kind), + emittingSubroutine_(false) + { + MOZ_ASSERT(is<TryFinallyControl>()); + } + + void setEmittingSubroutine() { + emittingSubroutine_ = true; + } + + bool emittingSubroutine() const { + return emittingSubroutine_; + } +}; + +static bool +ScopeKindIsInBody(ScopeKind kind) +{ + return kind == ScopeKind::Lexical || + kind == ScopeKind::SimpleCatch || + kind == ScopeKind::Catch || + kind == ScopeKind::With || + kind == ScopeKind::FunctionBodyVar || + kind == ScopeKind::ParameterExpressionVar; +} + +static inline void +MarkAllBindingsClosedOver(LexicalScope::Data& data) +{ + BindingName* names = data.names; + for (uint32_t i = 0; i < data.length; i++) + names[i] = BindingName(names[i].name(), true); +} + +// A scope that introduces bindings. +class BytecodeEmitter::EmitterScope : public Nestable<BytecodeEmitter::EmitterScope> +{ + // The cache of bound names that may be looked up in the + // scope. Initially populated as the set of names this scope binds. As + // names are looked up in enclosing scopes, they are cached on the + // current scope. + PooledMapPtr<NameLocationMap> nameCache_; + + // If this scope's cache does not include free names, such as the + // global scope, the NameLocation to return. + Maybe<NameLocation> fallbackFreeNameLocation_; + + // True if there is a corresponding EnvironmentObject on the environment + // chain, false if all bindings are stored in frame slots on the stack. + bool hasEnvironment_; + + // The number of enclosing environments. Used for error checking. + uint8_t environmentChainLength_; + + // The next usable slot on the frame for not-closed over bindings. + // + // The initial frame slot when assigning slots to bindings is the + // enclosing scope's nextFrameSlot. For the first scope in a frame, + // the initial frame slot is 0. + uint32_t nextFrameSlot_; + + // The index in the BytecodeEmitter's interned scope vector, otherwise + // ScopeNote::NoScopeIndex. + uint32_t scopeIndex_; + + // If kind is Lexical, Catch, or With, the index in the BytecodeEmitter's + // block scope note list. Otherwise ScopeNote::NoScopeNote. + uint32_t noteIndex_; + + MOZ_MUST_USE bool ensureCache(BytecodeEmitter* bce) { + return nameCache_.acquire(bce->cx); + } + + template <typename BindingIter> + MOZ_MUST_USE bool checkSlotLimits(BytecodeEmitter* bce, const BindingIter& bi) { + if (bi.nextFrameSlot() >= LOCALNO_LIMIT || + bi.nextEnvironmentSlot() >= ENVCOORD_SLOT_LIMIT) + { + return bce->reportError(nullptr, JSMSG_TOO_MANY_LOCALS); + } + return true; + } + + MOZ_MUST_USE bool checkEnvironmentChainLength(BytecodeEmitter* bce) { + uint32_t hops; + if (EmitterScope* emitterScope = enclosing(&bce)) + hops = emitterScope->environmentChainLength_; + else + hops = bce->sc->compilationEnclosingScope()->environmentChainLength(); + if (hops >= ENVCOORD_HOPS_LIMIT - 1) + return bce->reportError(nullptr, JSMSG_TOO_DEEP, js_function_str); + environmentChainLength_ = mozilla::AssertedCast<uint8_t>(hops + 1); + return true; + } + + void updateFrameFixedSlots(BytecodeEmitter* bce, const BindingIter& bi) { + nextFrameSlot_ = bi.nextFrameSlot(); + if (nextFrameSlot_ > bce->maxFixedSlots) + bce->maxFixedSlots = nextFrameSlot_; + MOZ_ASSERT_IF(bce->sc->isFunctionBox() && bce->sc->asFunctionBox()->isGenerator(), + bce->maxFixedSlots == 0); + } + + MOZ_MUST_USE bool putNameInCache(BytecodeEmitter* bce, JSAtom* name, NameLocation loc) { + NameLocationMap& cache = *nameCache_; + NameLocationMap::AddPtr p = cache.lookupForAdd(name); + MOZ_ASSERT(!p); + if (!cache.add(p, name, loc)) { + ReportOutOfMemory(bce->cx); + return false; + } + return true; + } + + Maybe<NameLocation> lookupInCache(BytecodeEmitter* bce, JSAtom* name) { + if (NameLocationMap::Ptr p = nameCache_->lookup(name)) + return Some(p->value().wrapped); + if (fallbackFreeNameLocation_ && nameCanBeFree(bce, name)) + return fallbackFreeNameLocation_; + return Nothing(); + } + + friend bool BytecodeEmitter::needsImplicitThis(); + + EmitterScope* enclosing(BytecodeEmitter** bce) const { + // There is an enclosing scope with access to the same frame. + if (EmitterScope* inFrame = enclosingInFrame()) + return inFrame; + + // We are currently compiling the enclosing script, look in the + // enclosing BCE. + if ((*bce)->parent) { + *bce = (*bce)->parent; + return (*bce)->innermostEmitterScope; + } + + return nullptr; + } + + Scope* enclosingScope(BytecodeEmitter* bce) const { + if (EmitterScope* es = enclosing(&bce)) + return es->scope(bce); + + // The enclosing script is already compiled or the current script is the + // global script. + return bce->sc->compilationEnclosingScope(); + } + + static bool nameCanBeFree(BytecodeEmitter* bce, JSAtom* name) { + // '.generator' cannot be accessed by name. + return name != bce->cx->names().dotGenerator; + } + + static NameLocation searchInEnclosingScope(JSAtom* name, Scope* scope, uint8_t hops); + NameLocation searchAndCache(BytecodeEmitter* bce, JSAtom* name); + + template <typename ScopeCreator> + MOZ_MUST_USE bool internScope(BytecodeEmitter* bce, ScopeCreator createScope); + template <typename ScopeCreator> + MOZ_MUST_USE bool internBodyScope(BytecodeEmitter* bce, ScopeCreator createScope); + MOZ_MUST_USE bool appendScopeNote(BytecodeEmitter* bce); + + MOZ_MUST_USE bool deadZoneFrameSlotRange(BytecodeEmitter* bce, uint32_t slotStart, + uint32_t slotEnd); + + public: + explicit EmitterScope(BytecodeEmitter* bce) + : Nestable<EmitterScope>(&bce->innermostEmitterScope), + nameCache_(bce->cx->frontendCollectionPool()), + hasEnvironment_(false), + environmentChainLength_(0), + nextFrameSlot_(0), + scopeIndex_(ScopeNote::NoScopeIndex), + noteIndex_(ScopeNote::NoScopeNoteIndex) + { } + + void dump(BytecodeEmitter* bce); + + MOZ_MUST_USE bool enterLexical(BytecodeEmitter* bce, ScopeKind kind, + Handle<LexicalScope::Data*> bindings); + MOZ_MUST_USE bool enterNamedLambda(BytecodeEmitter* bce, FunctionBox* funbox); + MOZ_MUST_USE bool enterComprehensionFor(BytecodeEmitter* bce, + Handle<LexicalScope::Data*> bindings); + MOZ_MUST_USE bool enterFunction(BytecodeEmitter* bce, FunctionBox* funbox); + MOZ_MUST_USE bool enterFunctionExtraBodyVar(BytecodeEmitter* bce, FunctionBox* funbox); + MOZ_MUST_USE bool enterParameterExpressionVar(BytecodeEmitter* bce); + MOZ_MUST_USE bool enterGlobal(BytecodeEmitter* bce, GlobalSharedContext* globalsc); + MOZ_MUST_USE bool enterEval(BytecodeEmitter* bce, EvalSharedContext* evalsc); + MOZ_MUST_USE bool enterModule(BytecodeEmitter* module, ModuleSharedContext* modulesc); + MOZ_MUST_USE bool enterWith(BytecodeEmitter* bce); + MOZ_MUST_USE bool deadZoneFrameSlots(BytecodeEmitter* bce); + + MOZ_MUST_USE bool leave(BytecodeEmitter* bce, bool nonLocal = false); + + uint32_t index() const { + MOZ_ASSERT(scopeIndex_ != ScopeNote::NoScopeIndex, "Did you forget to intern a Scope?"); + return scopeIndex_; + } + + uint32_t noteIndex() const { + return noteIndex_; + } + + Scope* scope(const BytecodeEmitter* bce) const { + return bce->scopeList.vector[index()]; + } + + bool hasEnvironment() const { + return hasEnvironment_; + } + + // The first frame slot used. + uint32_t frameSlotStart() const { + if (EmitterScope* inFrame = enclosingInFrame()) + return inFrame->nextFrameSlot_; + return 0; + } + + // The last frame slot used + 1. + uint32_t frameSlotEnd() const { + return nextFrameSlot_; + } + + uint32_t numFrameSlots() const { + return frameSlotEnd() - frameSlotStart(); + } + + EmitterScope* enclosingInFrame() const { + return Nestable<EmitterScope>::enclosing(); + } + + NameLocation lookup(BytecodeEmitter* bce, JSAtom* name) { + if (Maybe<NameLocation> loc = lookupInCache(bce, name)) + return *loc; + return searchAndCache(bce, name); + } + + Maybe<NameLocation> locationBoundInScope(BytecodeEmitter* bce, JSAtom* name, + EmitterScope* target); +}; + +void +BytecodeEmitter::EmitterScope::dump(BytecodeEmitter* bce) +{ + fprintf(stdout, "EmitterScope [%s] %p\n", ScopeKindString(scope(bce)->kind()), this); + + for (NameLocationMap::Range r = nameCache_->all(); !r.empty(); r.popFront()) { + const NameLocation& l = r.front().value(); + + JSAutoByteString bytes; + if (!AtomToPrintableString(bce->cx, r.front().key(), &bytes)) + return; + if (l.kind() != NameLocation::Kind::Dynamic) + fprintf(stdout, " %s %s ", BindingKindString(l.bindingKind()), bytes.ptr()); + else + fprintf(stdout, " %s ", bytes.ptr()); + + switch (l.kind()) { + case NameLocation::Kind::Dynamic: + fprintf(stdout, "dynamic\n"); + break; + case NameLocation::Kind::Global: + fprintf(stdout, "global\n"); + break; + case NameLocation::Kind::Intrinsic: + fprintf(stdout, "intrinsic\n"); + break; + case NameLocation::Kind::NamedLambdaCallee: + fprintf(stdout, "named lambda callee\n"); + break; + case NameLocation::Kind::Import: + fprintf(stdout, "import\n"); + break; + case NameLocation::Kind::ArgumentSlot: + fprintf(stdout, "arg slot=%u\n", l.argumentSlot()); + break; + case NameLocation::Kind::FrameSlot: + fprintf(stdout, "frame slot=%u\n", l.frameSlot()); + break; + case NameLocation::Kind::EnvironmentCoordinate: + fprintf(stdout, "environment hops=%u slot=%u\n", + l.environmentCoordinate().hops(), l.environmentCoordinate().slot()); + break; + case NameLocation::Kind::DynamicAnnexBVar: + fprintf(stdout, "dynamic annex b var\n"); + break; + } + } + + fprintf(stdout, "\n"); +} + +template <typename ScopeCreator> +bool +BytecodeEmitter::EmitterScope::internScope(BytecodeEmitter* bce, ScopeCreator createScope) +{ + RootedScope enclosing(bce->cx, enclosingScope(bce)); + Scope* scope = createScope(bce->cx, enclosing); + if (!scope) + return false; + hasEnvironment_ = scope->hasEnvironment(); + scopeIndex_ = bce->scopeList.length(); + return bce->scopeList.append(scope); +} + +template <typename ScopeCreator> +bool +BytecodeEmitter::EmitterScope::internBodyScope(BytecodeEmitter* bce, ScopeCreator createScope) +{ + MOZ_ASSERT(bce->bodyScopeIndex == UINT32_MAX, "There can be only one body scope"); + bce->bodyScopeIndex = bce->scopeList.length(); + return internScope(bce, createScope); +} + +bool +BytecodeEmitter::EmitterScope::appendScopeNote(BytecodeEmitter* bce) +{ + MOZ_ASSERT(ScopeKindIsInBody(scope(bce)->kind()) && enclosingInFrame(), + "Scope notes are not needed for body-level scopes."); + noteIndex_ = bce->scopeNoteList.length(); + return bce->scopeNoteList.append(index(), bce->offset(), bce->inPrologue(), + enclosingInFrame() ? enclosingInFrame()->noteIndex() + : ScopeNote::NoScopeNoteIndex); +} + +#ifdef DEBUG +static bool +NameIsOnEnvironment(Scope* scope, JSAtom* name) +{ + for (BindingIter bi(scope); bi; bi++) { + // If found, the name must already be on the environment or an import, + // or else there is a bug in the closed-over name analysis in the + // Parser. + if (bi.name() == name) { + BindingLocation::Kind kind = bi.location().kind(); + + if (bi.hasArgumentSlot()) { + JSScript* script = scope->as<FunctionScope>().script(); + if (!script->strict() && !script->functionHasParameterExprs()) { + // Check for duplicate positional formal parameters. + for (BindingIter bi2(bi); bi2 && bi2.hasArgumentSlot(); bi2++) { + if (bi2.name() == name) + kind = bi2.location().kind(); + } + } + } + + return kind == BindingLocation::Kind::Global || + kind == BindingLocation::Kind::Environment || + kind == BindingLocation::Kind::Import; + } + } + + // If not found, assume it's on the global or dynamically accessed. + return true; +} +#endif + +/* static */ NameLocation +BytecodeEmitter::EmitterScope::searchInEnclosingScope(JSAtom* name, Scope* scope, uint8_t hops) +{ + for (ScopeIter si(scope); si; si++) { + MOZ_ASSERT(NameIsOnEnvironment(si.scope(), name)); + + bool hasEnv = si.hasSyntacticEnvironment(); + + switch (si.kind()) { + case ScopeKind::Function: + if (hasEnv) { + JSScript* script = si.scope()->as<FunctionScope>().script(); + if (script->funHasExtensibleScope()) + return NameLocation::Dynamic(); + + for (BindingIter bi(si.scope()); bi; bi++) { + if (bi.name() != name) + continue; + + BindingLocation bindLoc = bi.location(); + if (bi.hasArgumentSlot() && + !script->strict() && + !script->functionHasParameterExprs()) + { + // Check for duplicate positional formal parameters. + for (BindingIter bi2(bi); bi2 && bi2.hasArgumentSlot(); bi2++) { + if (bi2.name() == name) + bindLoc = bi2.location(); + } + } + + MOZ_ASSERT(bindLoc.kind() == BindingLocation::Kind::Environment); + return NameLocation::EnvironmentCoordinate(bi.kind(), hops, bindLoc.slot()); + } + } + break; + + case ScopeKind::FunctionBodyVar: + case ScopeKind::ParameterExpressionVar: + case ScopeKind::Lexical: + case ScopeKind::NamedLambda: + case ScopeKind::StrictNamedLambda: + case ScopeKind::SimpleCatch: + case ScopeKind::Catch: + if (hasEnv) { + for (BindingIter bi(si.scope()); bi; bi++) { + if (bi.name() != name) + continue; + + // The name must already have been marked as closed + // over. If this assertion is hit, there is a bug in the + // name analysis. + BindingLocation bindLoc = bi.location(); + MOZ_ASSERT(bindLoc.kind() == BindingLocation::Kind::Environment); + return NameLocation::EnvironmentCoordinate(bi.kind(), hops, bindLoc.slot()); + } + } + break; + + case ScopeKind::Module: + if (hasEnv) { + for (BindingIter bi(si.scope()); bi; bi++) { + if (bi.name() != name) + continue; + + BindingLocation bindLoc = bi.location(); + + // Imports are on the environment but are indirect + // bindings and must be accessed dynamically instead of + // using an EnvironmentCoordinate. + if (bindLoc.kind() == BindingLocation::Kind::Import) { + MOZ_ASSERT(si.kind() == ScopeKind::Module); + return NameLocation::Import(); + } + + MOZ_ASSERT(bindLoc.kind() == BindingLocation::Kind::Environment); + return NameLocation::EnvironmentCoordinate(bi.kind(), hops, bindLoc.slot()); + } + } + break; + + case ScopeKind::Eval: + case ScopeKind::StrictEval: + // As an optimization, if the eval doesn't have its own var + // environment and its immediate enclosing scope is a global + // scope, all accesses are global. + if (!hasEnv && si.scope()->enclosing()->is<GlobalScope>()) + return NameLocation::Global(BindingKind::Var); + return NameLocation::Dynamic(); + + case ScopeKind::Global: + return NameLocation::Global(BindingKind::Var); + + case ScopeKind::With: + case ScopeKind::NonSyntactic: + return NameLocation::Dynamic(); + } + + if (hasEnv) { + MOZ_ASSERT(hops < ENVCOORD_HOPS_LIMIT - 1); + hops++; + } + } + + MOZ_CRASH("Malformed scope chain"); +} + +NameLocation +BytecodeEmitter::EmitterScope::searchAndCache(BytecodeEmitter* bce, JSAtom* name) +{ + Maybe<NameLocation> loc; + uint8_t hops = hasEnvironment() ? 1 : 0; + DebugOnly<bool> inCurrentScript = enclosingInFrame(); + + // Start searching in the current compilation. + for (EmitterScope* es = enclosing(&bce); es; es = es->enclosing(&bce)) { + loc = es->lookupInCache(bce, name); + if (loc) { + if (loc->kind() == NameLocation::Kind::EnvironmentCoordinate) + *loc = loc->addHops(hops); + break; + } + + if (es->hasEnvironment()) + hops++; + +#ifdef DEBUG + if (!es->enclosingInFrame()) + inCurrentScript = false; +#endif + } + + // If the name is not found in the current compilation, walk the Scope + // chain encompassing the compilation. + if (!loc) { + inCurrentScript = false; + loc = Some(searchInEnclosingScope(name, bce->sc->compilationEnclosingScope(), hops)); + } + + // Each script has its own frame. A free name that is accessed + // from an inner script must not be a frame slot access. If this + // assertion is hit, it is a bug in the free name analysis in the + // parser. + MOZ_ASSERT_IF(!inCurrentScript, loc->kind() != NameLocation::Kind::FrameSlot); + + // It is always correct to not cache the location. Ignore OOMs to make + // lookups infallible. + if (!putNameInCache(bce, name, *loc)) + bce->cx->recoverFromOutOfMemory(); + + return *loc; +} + +Maybe<NameLocation> +BytecodeEmitter::EmitterScope::locationBoundInScope(BytecodeEmitter* bce, JSAtom* name, + EmitterScope* target) +{ + // The target scope must be an intra-frame enclosing scope of this + // one. Count the number of extra hops to reach it. + uint8_t extraHops = 0; + for (EmitterScope* es = this; es != target; es = es->enclosingInFrame()) { + if (es->hasEnvironment()) + extraHops++; + } + + // Caches are prepopulated with bound names. So if the name is bound in a + // particular scope, it must already be in the cache. Furthermore, don't + // consult the fallback location as we only care about binding names. + Maybe<NameLocation> loc; + if (NameLocationMap::Ptr p = target->nameCache_->lookup(name)) { + NameLocation l = p->value().wrapped; + if (l.kind() == NameLocation::Kind::EnvironmentCoordinate) + loc = Some(l.addHops(extraHops)); + else + loc = Some(l); + } + return loc; +} + +bool +BytecodeEmitter::EmitterScope::deadZoneFrameSlotRange(BytecodeEmitter* bce, uint32_t slotStart, + uint32_t slotEnd) +{ + // Lexical bindings throw ReferenceErrors if they are used before + // initialization. See ES6 8.1.1.1.6. + // + // For completeness, lexical bindings are initialized in ES6 by calling + // InitializeBinding, after which touching the binding will no longer + // throw reference errors. See 13.1.11, 9.2.13, 13.6.3.4, 13.6.4.6, + // 13.6.4.8, 13.14.5, 15.1.8, and 15.2.0.15. + if (slotStart != slotEnd) { + if (!bce->emit1(JSOP_UNINITIALIZED)) + return false; + for (uint32_t slot = slotStart; slot < slotEnd; slot++) { + if (!bce->emitLocalOp(JSOP_INITLEXICAL, slot)) + return false; + } + if (!bce->emit1(JSOP_POP)) + return false; + } + + return true; +} + +bool +BytecodeEmitter::EmitterScope::deadZoneFrameSlots(BytecodeEmitter* bce) +{ + return deadZoneFrameSlotRange(bce, frameSlotStart(), frameSlotEnd()); +} + +bool +BytecodeEmitter::EmitterScope::enterLexical(BytecodeEmitter* bce, ScopeKind kind, + Handle<LexicalScope::Data*> bindings) +{ + MOZ_ASSERT(kind != ScopeKind::NamedLambda && kind != ScopeKind::StrictNamedLambda); + MOZ_ASSERT(this == bce->innermostEmitterScope); + + if (!ensureCache(bce)) + return false; + + // Marks all names as closed over if the the context requires it. This + // cannot be done in the Parser as we may not know if the context requires + // all bindings to be closed over until after parsing is finished. For + // example, legacy generators require all bindings to be closed over but + // it is unknown if a function is a legacy generator until the first + // 'yield' expression is parsed. + // + // This is not a problem with other scopes, as all other scopes with + // bindings are body-level. At the time of their creation, whether or not + // the context requires all bindings to be closed over is already known. + if (bce->sc->allBindingsClosedOver()) + MarkAllBindingsClosedOver(*bindings); + + // Resolve bindings. + TDZCheckCache* tdzCache = bce->innermostTDZCheckCache; + uint32_t firstFrameSlot = frameSlotStart(); + BindingIter bi(*bindings, firstFrameSlot, /* isNamedLambda = */ false); + for (; bi; bi++) { + if (!checkSlotLimits(bce, bi)) + return false; + + NameLocation loc = NameLocation::fromBinding(bi.kind(), bi.location()); + if (!putNameInCache(bce, bi.name(), loc)) + return false; + + if (!tdzCache->noteTDZCheck(bce, bi.name(), CheckTDZ)) + return false; + } + + updateFrameFixedSlots(bce, bi); + + // Create and intern the VM scope. + auto createScope = [kind, bindings, firstFrameSlot](ExclusiveContext* cx, + HandleScope enclosing) + { + return LexicalScope::create(cx, kind, bindings, firstFrameSlot, enclosing); + }; + if (!internScope(bce, createScope)) + return false; + + if (ScopeKindIsInBody(kind) && hasEnvironment()) { + // After interning the VM scope we can get the scope index. + if (!bce->emitInternedScopeOp(index(), JSOP_PUSHLEXICALENV)) + return false; + } + + // Lexical scopes need notes to be mapped from a pc. + if (!appendScopeNote(bce)) + return false; + + // Put frame slots in TDZ. Environment slots are poisoned during + // environment creation. + // + // This must be done after appendScopeNote to be considered in the extent + // of the scope. + if (!deadZoneFrameSlotRange(bce, firstFrameSlot, frameSlotEnd())) + return false; + + return checkEnvironmentChainLength(bce); +} + +bool +BytecodeEmitter::EmitterScope::enterNamedLambda(BytecodeEmitter* bce, FunctionBox* funbox) +{ + MOZ_ASSERT(this == bce->innermostEmitterScope); + MOZ_ASSERT(funbox->namedLambdaBindings()); + + if (!ensureCache(bce)) + return false; + + // See comment in enterLexical about allBindingsClosedOver. + if (funbox->allBindingsClosedOver()) + MarkAllBindingsClosedOver(*funbox->namedLambdaBindings()); + + BindingIter bi(*funbox->namedLambdaBindings(), LOCALNO_LIMIT, /* isNamedLambda = */ true); + MOZ_ASSERT(bi.kind() == BindingKind::NamedLambdaCallee); + + // The lambda name, if not closed over, is accessed via JSOP_CALLEE and + // not a frame slot. Do not update frame slot information. + NameLocation loc = NameLocation::fromBinding(bi.kind(), bi.location()); + if (!putNameInCache(bce, bi.name(), loc)) + return false; + + bi++; + MOZ_ASSERT(!bi, "There should be exactly one binding in a NamedLambda scope"); + + auto createScope = [funbox](ExclusiveContext* cx, HandleScope enclosing) { + ScopeKind scopeKind = + funbox->strict() ? ScopeKind::StrictNamedLambda : ScopeKind::NamedLambda; + return LexicalScope::create(cx, scopeKind, funbox->namedLambdaBindings(), + LOCALNO_LIMIT, enclosing); + }; + if (!internScope(bce, createScope)) + return false; + + return checkEnvironmentChainLength(bce); +} + +bool +BytecodeEmitter::EmitterScope::enterComprehensionFor(BytecodeEmitter* bce, + Handle<LexicalScope::Data*> bindings) +{ + if (!enterLexical(bce, ScopeKind::Lexical, bindings)) + return false; + + // For comprehensions, initialize all lexical names up front to undefined + // because they're now a dead feature and don't interact properly with + // TDZ. + auto nop = [](BytecodeEmitter*, const NameLocation&, bool) { + return true; + }; + + if (!bce->emit1(JSOP_UNDEFINED)) + return false; + + RootedAtom name(bce->cx); + for (BindingIter bi(*bindings, frameSlotStart(), /* isNamedLambda = */ false); bi; bi++) { + name = bi.name(); + if (!bce->emitInitializeName(name, nop)) + return false; + } + + if (!bce->emit1(JSOP_POP)) + return false; + + return true; +} + +bool +BytecodeEmitter::EmitterScope::enterParameterExpressionVar(BytecodeEmitter* bce) +{ + MOZ_ASSERT(this == bce->innermostEmitterScope); + + if (!ensureCache(bce)) + return false; + + // Parameter expressions var scopes have no pre-set bindings and are + // always extensible, as they are needed for eval. + fallbackFreeNameLocation_ = Some(NameLocation::Dynamic()); + + // Create and intern the VM scope. + uint32_t firstFrameSlot = frameSlotStart(); + auto createScope = [firstFrameSlot](ExclusiveContext* cx, HandleScope enclosing) { + return VarScope::create(cx, ScopeKind::ParameterExpressionVar, + /* data = */ nullptr, firstFrameSlot, + /* needsEnvironment = */ true, enclosing); + }; + if (!internScope(bce, createScope)) + return false; + + MOZ_ASSERT(hasEnvironment()); + if (!bce->emitInternedScopeOp(index(), JSOP_PUSHVARENV)) + return false; + + // The extra var scope needs a note to be mapped from a pc. + if (!appendScopeNote(bce)) + return false; + + return checkEnvironmentChainLength(bce); +} + +bool +BytecodeEmitter::EmitterScope::enterFunction(BytecodeEmitter* bce, FunctionBox* funbox) +{ + MOZ_ASSERT(this == bce->innermostEmitterScope); + + // If there are parameter expressions, there is an extra var scope. + if (!funbox->hasExtraBodyVarScope()) + bce->setVarEmitterScope(this); + + if (!ensureCache(bce)) + return false; + + // Resolve body-level bindings, if there are any. + auto bindings = funbox->functionScopeBindings(); + Maybe<uint32_t> lastLexicalSlot; + if (bindings) { + NameLocationMap& cache = *nameCache_; + + BindingIter bi(*bindings, funbox->hasParameterExprs); + for (; bi; bi++) { + if (!checkSlotLimits(bce, bi)) + return false; + + NameLocation loc = NameLocation::fromBinding(bi.kind(), bi.location()); + NameLocationMap::AddPtr p = cache.lookupForAdd(bi.name()); + + // The only duplicate bindings that occur are simple formal + // parameters, in which case the last position counts, so update the + // location. + if (p) { + MOZ_ASSERT(bi.kind() == BindingKind::FormalParameter); + MOZ_ASSERT(!funbox->hasDestructuringArgs); + MOZ_ASSERT(!funbox->function()->hasRest()); + p->value() = loc; + continue; + } + + if (!cache.add(p, bi.name(), loc)) { + ReportOutOfMemory(bce->cx); + return false; + } + } + + updateFrameFixedSlots(bce, bi); + } else { + nextFrameSlot_ = 0; + } + + // If the function's scope may be extended at runtime due to sloppy direct + // eval and there is no extra var scope, any names beyond the function + // scope must be accessed dynamically as we don't know if the name will + // become a 'var' binding due to direct eval. + if (!funbox->hasParameterExprs && funbox->hasExtensibleScope()) + fallbackFreeNameLocation_ = Some(NameLocation::Dynamic()); + + // In case of parameter expressions, the parameters are lexical + // bindings and have TDZ. + if (funbox->hasParameterExprs && nextFrameSlot_) { + uint32_t paramFrameSlotEnd = 0; + for (BindingIter bi(*bindings, true); bi; bi++) { + if (!BindingKindIsLexical(bi.kind())) + break; + + NameLocation loc = NameLocation::fromBinding(bi.kind(), bi.location()); + if (loc.kind() == NameLocation::Kind::FrameSlot) { + MOZ_ASSERT(paramFrameSlotEnd <= loc.frameSlot()); + paramFrameSlotEnd = loc.frameSlot() + 1; + } + } + + if (!deadZoneFrameSlotRange(bce, 0, paramFrameSlotEnd)) + return false; + } + + // Create and intern the VM scope. + auto createScope = [funbox](ExclusiveContext* cx, HandleScope enclosing) { + RootedFunction fun(cx, funbox->function()); + return FunctionScope::create(cx, funbox->functionScopeBindings(), + funbox->hasParameterExprs, + funbox->needsCallObjectRegardlessOfBindings(), + fun, enclosing); + }; + if (!internBodyScope(bce, createScope)) + return false; + + return checkEnvironmentChainLength(bce); +} + +bool +BytecodeEmitter::EmitterScope::enterFunctionExtraBodyVar(BytecodeEmitter* bce, FunctionBox* funbox) +{ + MOZ_ASSERT(funbox->hasParameterExprs); + MOZ_ASSERT(funbox->extraVarScopeBindings() || + funbox->needsExtraBodyVarEnvironmentRegardlessOfBindings()); + MOZ_ASSERT(this == bce->innermostEmitterScope); + + // The extra var scope is never popped once it's entered. It replaces the + // function scope as the var emitter scope. + bce->setVarEmitterScope(this); + + if (!ensureCache(bce)) + return false; + + // Resolve body-level bindings, if there are any. + uint32_t firstFrameSlot = frameSlotStart(); + if (auto bindings = funbox->extraVarScopeBindings()) { + BindingIter bi(*bindings, firstFrameSlot); + for (; bi; bi++) { + if (!checkSlotLimits(bce, bi)) + return false; + + NameLocation loc = NameLocation::fromBinding(bi.kind(), bi.location()); + if (!putNameInCache(bce, bi.name(), loc)) + return false; + } + + updateFrameFixedSlots(bce, bi); + } else { + nextFrameSlot_ = firstFrameSlot; + } + + // If the extra var scope may be extended at runtime due to sloppy + // direct eval, any names beyond the var scope must be accessed + // dynamically as we don't know if the name will become a 'var' binding + // due to direct eval. + if (funbox->hasExtensibleScope()) + fallbackFreeNameLocation_ = Some(NameLocation::Dynamic()); + + // Create and intern the VM scope. + auto createScope = [funbox, firstFrameSlot](ExclusiveContext* cx, HandleScope enclosing) { + return VarScope::create(cx, ScopeKind::FunctionBodyVar, + funbox->extraVarScopeBindings(), firstFrameSlot, + funbox->needsExtraBodyVarEnvironmentRegardlessOfBindings(), + enclosing); + }; + if (!internScope(bce, createScope)) + return false; + + if (hasEnvironment()) { + if (!bce->emitInternedScopeOp(index(), JSOP_PUSHVARENV)) + return false; + } + + // The extra var scope needs a note to be mapped from a pc. + if (!appendScopeNote(bce)) + return false; + + return checkEnvironmentChainLength(bce); +} + +class DynamicBindingIter : public BindingIter +{ + public: + explicit DynamicBindingIter(GlobalSharedContext* sc) + : BindingIter(*sc->bindings) + { } + + explicit DynamicBindingIter(EvalSharedContext* sc) + : BindingIter(*sc->bindings, /* strict = */ false) + { + MOZ_ASSERT(!sc->strict()); + } + + JSOp bindingOp() const { + switch (kind()) { + case BindingKind::Var: + return JSOP_DEFVAR; + case BindingKind::Let: + return JSOP_DEFLET; + case BindingKind::Const: + return JSOP_DEFCONST; + default: + MOZ_CRASH("Bad BindingKind"); + } + } +}; + +bool +BytecodeEmitter::EmitterScope::enterGlobal(BytecodeEmitter* bce, GlobalSharedContext* globalsc) +{ + MOZ_ASSERT(this == bce->innermostEmitterScope); + + bce->setVarEmitterScope(this); + + if (!ensureCache(bce)) + return false; + + if (bce->emitterMode == BytecodeEmitter::SelfHosting) { + // In self-hosting, it is incorrect to consult the global scope because + // self-hosted scripts are cloned into their target compartments before + // they are run. Instead of Global, Intrinsic is used for all names. + // + // Intrinsic lookups are redirected to the special intrinsics holder + // in the global object, into which any missing values are cloned + // lazily upon first access. + fallbackFreeNameLocation_ = Some(NameLocation::Intrinsic()); + + auto createScope = [](ExclusiveContext* cx, HandleScope enclosing) { + MOZ_ASSERT(!enclosing); + return &cx->global()->emptyGlobalScope(); + }; + return internBodyScope(bce, createScope); + } + + // Resolve binding names and emit DEF{VAR,LET,CONST} prologue ops. + if (globalsc->bindings) { + for (DynamicBindingIter bi(globalsc); bi; bi++) { + NameLocation loc = NameLocation::fromBinding(bi.kind(), bi.location()); + JSAtom* name = bi.name(); + if (!putNameInCache(bce, name, loc)) + return false; + + // Define the name in the prologue. Do not emit DEFVAR for + // functions that we'll emit DEFFUN for. + if (bi.isTopLevelFunction()) + continue; + + if (!bce->emitAtomOp(name, bi.bindingOp())) + return false; + } + } + + // Note that to save space, we don't add free names to the cache for + // global scopes. They are assumed to be global vars in the syntactic + // global scope, dynamic accesses under non-syntactic global scope. + if (globalsc->scopeKind() == ScopeKind::Global) + fallbackFreeNameLocation_ = Some(NameLocation::Global(BindingKind::Var)); + else + fallbackFreeNameLocation_ = Some(NameLocation::Dynamic()); + + auto createScope = [globalsc](ExclusiveContext* cx, HandleScope enclosing) { + MOZ_ASSERT(!enclosing); + return GlobalScope::create(cx, globalsc->scopeKind(), globalsc->bindings); + }; + return internBodyScope(bce, createScope); +} + +bool +BytecodeEmitter::EmitterScope::enterEval(BytecodeEmitter* bce, EvalSharedContext* evalsc) +{ + MOZ_ASSERT(this == bce->innermostEmitterScope); + + bce->setVarEmitterScope(this); + + if (!ensureCache(bce)) + return false; + + // For simplicity, treat all free name lookups in eval scripts as dynamic. + fallbackFreeNameLocation_ = Some(NameLocation::Dynamic()); + + // Create the `var` scope. Note that there is also a lexical scope, created + // separately in emitScript(). + auto createScope = [evalsc](ExclusiveContext* cx, HandleScope enclosing) { + ScopeKind scopeKind = evalsc->strict() ? ScopeKind::StrictEval : ScopeKind::Eval; + return EvalScope::create(cx, scopeKind, evalsc->bindings, enclosing); + }; + if (!internBodyScope(bce, createScope)) + return false; + + if (hasEnvironment()) { + if (!bce->emitInternedScopeOp(index(), JSOP_PUSHVARENV)) + return false; + } else { + // Resolve binding names and emit DEFVAR prologue ops if we don't have + // an environment (i.e., a sloppy eval not in a parameter expression). + // Eval scripts always have their own lexical scope, but non-strict + // scopes may introduce 'var' bindings to the nearest var scope. + // + // TODO: We may optimize strict eval bindings in the future to be on + // the frame. For now, handle everything dynamically. + if (!hasEnvironment() && evalsc->bindings) { + for (DynamicBindingIter bi(evalsc); bi; bi++) { + MOZ_ASSERT(bi.bindingOp() == JSOP_DEFVAR); + + if (bi.isTopLevelFunction()) + continue; + + if (!bce->emitAtomOp(bi.name(), JSOP_DEFVAR)) + return false; + } + } + + // As an optimization, if the eval does not have its own var + // environment and is directly enclosed in a global scope, then all + // free name lookups are global. + if (scope(bce)->enclosing()->is<GlobalScope>()) + fallbackFreeNameLocation_ = Some(NameLocation::Global(BindingKind::Var)); + } + + return true; +} + +bool +BytecodeEmitter::EmitterScope::enterModule(BytecodeEmitter* bce, ModuleSharedContext* modulesc) +{ + MOZ_ASSERT(this == bce->innermostEmitterScope); + + bce->setVarEmitterScope(this); + + if (!ensureCache(bce)) + return false; + + // Resolve body-level bindings, if there are any. + TDZCheckCache* tdzCache = bce->innermostTDZCheckCache; + Maybe<uint32_t> firstLexicalFrameSlot; + if (ModuleScope::Data* bindings = modulesc->bindings) { + BindingIter bi(*bindings); + for (; bi; bi++) { + if (!checkSlotLimits(bce, bi)) + return false; + + NameLocation loc = NameLocation::fromBinding(bi.kind(), bi.location()); + if (!putNameInCache(bce, bi.name(), loc)) + return false; + + if (BindingKindIsLexical(bi.kind())) { + if (loc.kind() == NameLocation::Kind::FrameSlot && !firstLexicalFrameSlot) + firstLexicalFrameSlot = Some(loc.frameSlot()); + + if (!tdzCache->noteTDZCheck(bce, bi.name(), CheckTDZ)) + return false; + } + } + + updateFrameFixedSlots(bce, bi); + } else { + nextFrameSlot_ = 0; + } + + // Modules are toplevel, so any free names are global. + fallbackFreeNameLocation_ = Some(NameLocation::Global(BindingKind::Var)); + + // Put lexical frame slots in TDZ. Environment slots are poisoned during + // environment creation. + if (firstLexicalFrameSlot) { + if (!deadZoneFrameSlotRange(bce, *firstLexicalFrameSlot, frameSlotEnd())) + return false; + } + + // Create and intern the VM scope. + auto createScope = [modulesc](ExclusiveContext* cx, HandleScope enclosing) { + return ModuleScope::create(cx, modulesc->bindings, modulesc->module(), enclosing); + }; + if (!internBodyScope(bce, createScope)) + return false; + + return checkEnvironmentChainLength(bce); +} + +bool +BytecodeEmitter::EmitterScope::enterWith(BytecodeEmitter* bce) +{ + MOZ_ASSERT(this == bce->innermostEmitterScope); + + if (!ensureCache(bce)) + return false; + + // 'with' make all accesses dynamic and unanalyzable. + fallbackFreeNameLocation_ = Some(NameLocation::Dynamic()); + + auto createScope = [](ExclusiveContext* cx, HandleScope enclosing) { + return WithScope::create(cx, enclosing); + }; + if (!internScope(bce, createScope)) + return false; + + if (!bce->emitInternedScopeOp(index(), JSOP_ENTERWITH)) + return false; + + if (!appendScopeNote(bce)) + return false; + + return checkEnvironmentChainLength(bce); +} + +bool +BytecodeEmitter::EmitterScope::leave(BytecodeEmitter* bce, bool nonLocal) +{ + // If we aren't leaving the scope due to a non-local jump (e.g., break), + // we must be the innermost scope. + MOZ_ASSERT_IF(!nonLocal, this == bce->innermostEmitterScope); + + ScopeKind kind = scope(bce)->kind(); + switch (kind) { + case ScopeKind::Lexical: + case ScopeKind::SimpleCatch: + case ScopeKind::Catch: + if (!bce->emit1(hasEnvironment() ? JSOP_POPLEXICALENV : JSOP_DEBUGLEAVELEXICALENV)) + return false; + break; + + case ScopeKind::With: + if (!bce->emit1(JSOP_LEAVEWITH)) + return false; + break; + + case ScopeKind::ParameterExpressionVar: + MOZ_ASSERT(hasEnvironment()); + if (!bce->emit1(JSOP_POPVARENV)) + return false; + break; + + case ScopeKind::Function: + case ScopeKind::FunctionBodyVar: + case ScopeKind::NamedLambda: + case ScopeKind::StrictNamedLambda: + case ScopeKind::Eval: + case ScopeKind::StrictEval: + case ScopeKind::Global: + case ScopeKind::NonSyntactic: + case ScopeKind::Module: + break; + } + + // Finish up the scope if we are leaving it in LIFO fashion. + if (!nonLocal) { + // Popping scopes due to non-local jumps generate additional scope + // notes. See NonLocalExitControl::prepareForNonLocalJump. + if (ScopeKindIsInBody(kind)) { + // The extra function var scope is never popped once it's pushed, + // so its scope note extends until the end of any possible code. + uint32_t offset = kind == ScopeKind::FunctionBodyVar ? UINT32_MAX : bce->offset(); + bce->scopeNoteList.recordEnd(noteIndex_, offset, bce->inPrologue()); + } + } + + return true; +} + +Maybe<MaybeCheckTDZ> +BytecodeEmitter::TDZCheckCache::needsTDZCheck(BytecodeEmitter* bce, JSAtom* name) +{ + if (!ensureCache(bce)) + return Nothing(); + + CheckTDZMap::AddPtr p = cache_->lookupForAdd(name); + if (p) + return Some(p->value().wrapped); + + MaybeCheckTDZ rv = CheckTDZ; + for (TDZCheckCache* it = enclosing(); it; it = it->enclosing()) { + if (it->cache_) { + if (CheckTDZMap::Ptr p2 = it->cache_->lookup(name)) { + rv = p2->value(); + break; + } + } + } + + if (!cache_->add(p, name, rv)) { + ReportOutOfMemory(bce->cx); + return Nothing(); + } + + return Some(rv); +} + +bool +BytecodeEmitter::TDZCheckCache::noteTDZCheck(BytecodeEmitter* bce, JSAtom* name, + MaybeCheckTDZ check) +{ + if (!ensureCache(bce)) + return false; + + CheckTDZMap::AddPtr p = cache_->lookupForAdd(name); + if (p) { + MOZ_ASSERT(!check, "TDZ only needs to be checked once per binding per basic block."); + p->value() = check; + } else { + if (!cache_->add(p, name, check)) + return false; + } + + return true; +} + +BytecodeEmitter::BytecodeEmitter(BytecodeEmitter* parent, + Parser<FullParseHandler>* parser, SharedContext* sc, + HandleScript script, Handle<LazyScript*> lazyScript, + uint32_t lineNum, EmitterMode emitterMode) + : sc(sc), + cx(sc->context), + parent(parent), + script(cx, script), + lazyScript(cx, lazyScript), + prologue(cx, lineNum), + main(cx, lineNum), + current(&main), + parser(parser), + atomIndices(cx->frontendCollectionPool()), + firstLine(lineNum), + maxFixedSlots(0), + maxStackDepth(0), + stackDepth(0), + arrayCompDepth(0), + emitLevel(0), + bodyScopeIndex(UINT32_MAX), + varEmitterScope(nullptr), + innermostNestableControl(nullptr), + innermostEmitterScope(nullptr), + innermostTDZCheckCache(nullptr), + constList(cx), + scopeList(cx), + tryNoteList(cx), + scopeNoteList(cx), + yieldOffsetList(cx), + typesetCount(0), + hasSingletons(false), + hasTryFinally(false), + emittingRunOnceLambda(false), + emitterMode(emitterMode), + functionBodyEndPosSet(false) +{ + MOZ_ASSERT_IF(emitterMode == LazyFunction, lazyScript); +} + +BytecodeEmitter::BytecodeEmitter(BytecodeEmitter* parent, + Parser<FullParseHandler>* parser, SharedContext* sc, + HandleScript script, Handle<LazyScript*> lazyScript, + TokenPos bodyPosition, EmitterMode emitterMode) + : BytecodeEmitter(parent, parser, sc, script, lazyScript, + parser->tokenStream.srcCoords.lineNum(bodyPosition.begin), + emitterMode) +{ + setFunctionBodyEndPos(bodyPosition); +} + +bool +BytecodeEmitter::init() +{ + return atomIndices.acquire(cx); +} + +template <typename Predicate /* (NestableControl*) -> bool */> +BytecodeEmitter::NestableControl* +BytecodeEmitter::findInnermostNestableControl(Predicate predicate) const +{ + return NestableControl::findNearest(innermostNestableControl, predicate); +} + +template <typename T> +T* +BytecodeEmitter::findInnermostNestableControl() const +{ + return NestableControl::findNearest<T>(innermostNestableControl); +} + +template <typename T, typename Predicate /* (T*) -> bool */> +T* +BytecodeEmitter::findInnermostNestableControl(Predicate predicate) const +{ + return NestableControl::findNearest<T>(innermostNestableControl, predicate); +} + +NameLocation +BytecodeEmitter::lookupName(JSAtom* name) +{ + return innermostEmitterScope->lookup(this, name); +} + +Maybe<NameLocation> +BytecodeEmitter::locationOfNameBoundInScope(JSAtom* name, EmitterScope* target) +{ + return innermostEmitterScope->locationBoundInScope(this, name, target); +} + +Maybe<NameLocation> +BytecodeEmitter::locationOfNameBoundInFunctionScope(JSAtom* name, EmitterScope* source) +{ + EmitterScope* funScope = source; + while (!funScope->scope(this)->is<FunctionScope>()) + funScope = funScope->enclosingInFrame(); + return source->locationBoundInScope(this, name, funScope); +} + +bool +BytecodeEmitter::emitCheck(ptrdiff_t delta, ptrdiff_t* offset) +{ + *offset = code().length(); + + // Start it off moderately large to avoid repeated resizings early on. + // ~98% of cases fit within 1024 bytes. + if (code().capacity() == 0 && !code().reserve(1024)) + return false; + + if (!code().growBy(delta)) { + ReportOutOfMemory(cx); + return false; + } + return true; +} + +void +BytecodeEmitter::updateDepth(ptrdiff_t target) +{ + jsbytecode* pc = code(target); + + int nuses = StackUses(nullptr, pc); + int ndefs = StackDefs(nullptr, pc); + + stackDepth -= nuses; + MOZ_ASSERT(stackDepth >= 0); + stackDepth += ndefs; + + if ((uint32_t)stackDepth > maxStackDepth) + maxStackDepth = stackDepth; +} + +#ifdef DEBUG +bool +BytecodeEmitter::checkStrictOrSloppy(JSOp op) +{ + if (IsCheckStrictOp(op) && !sc->strict()) + return false; + if (IsCheckSloppyOp(op) && sc->strict()) + return false; + return true; +} +#endif + +bool +BytecodeEmitter::emit1(JSOp op) +{ + MOZ_ASSERT(checkStrictOrSloppy(op)); + + ptrdiff_t offset; + if (!emitCheck(1, &offset)) + return false; + + jsbytecode* code = this->code(offset); + code[0] = jsbytecode(op); + updateDepth(offset); + return true; +} + +bool +BytecodeEmitter::emit2(JSOp op, uint8_t op1) +{ + MOZ_ASSERT(checkStrictOrSloppy(op)); + + ptrdiff_t offset; + if (!emitCheck(2, &offset)) + return false; + + jsbytecode* code = this->code(offset); + code[0] = jsbytecode(op); + code[1] = jsbytecode(op1); + updateDepth(offset); + return true; +} + +bool +BytecodeEmitter::emit3(JSOp op, jsbytecode op1, jsbytecode op2) +{ + MOZ_ASSERT(checkStrictOrSloppy(op)); + + /* These should filter through emitVarOp. */ + MOZ_ASSERT(!IsArgOp(op)); + MOZ_ASSERT(!IsLocalOp(op)); + + ptrdiff_t offset; + if (!emitCheck(3, &offset)) + return false; + + jsbytecode* code = this->code(offset); + code[0] = jsbytecode(op); + code[1] = op1; + code[2] = op2; + updateDepth(offset); + return true; +} + +bool +BytecodeEmitter::emitN(JSOp op, size_t extra, ptrdiff_t* offset) +{ + MOZ_ASSERT(checkStrictOrSloppy(op)); + ptrdiff_t length = 1 + ptrdiff_t(extra); + + ptrdiff_t off; + if (!emitCheck(length, &off)) + return false; + + jsbytecode* code = this->code(off); + code[0] = jsbytecode(op); + /* The remaining |extra| bytes are set by the caller */ + + /* + * Don't updateDepth if op's use-count comes from the immediate + * operand yet to be stored in the extra bytes after op. + */ + if (CodeSpec[op].nuses >= 0) + updateDepth(off); + + if (offset) + *offset = off; + return true; +} + +bool +BytecodeEmitter::emitJumpTarget(JumpTarget* target) +{ + ptrdiff_t off = offset(); + + // Alias consecutive jump targets. + if (off == current->lastTarget.offset + ptrdiff_t(JSOP_JUMPTARGET_LENGTH)) { + target->offset = current->lastTarget.offset; + return true; + } + + target->offset = off; + current->lastTarget.offset = off; + if (!emit1(JSOP_JUMPTARGET)) + return false; + return true; +} + +void +JumpList::push(jsbytecode* code, ptrdiff_t jumpOffset) +{ + SET_JUMP_OFFSET(&code[jumpOffset], offset - jumpOffset); + offset = jumpOffset; +} + +void +JumpList::patchAll(jsbytecode* code, JumpTarget target) +{ + ptrdiff_t delta; + for (ptrdiff_t jumpOffset = offset; jumpOffset != -1; jumpOffset += delta) { + jsbytecode* pc = &code[jumpOffset]; + MOZ_ASSERT(IsJumpOpcode(JSOp(*pc)) || JSOp(*pc) == JSOP_LABEL); + delta = GET_JUMP_OFFSET(pc); + MOZ_ASSERT(delta < 0); + ptrdiff_t span = target.offset - jumpOffset; + SET_JUMP_OFFSET(pc, span); + } +} + +bool +BytecodeEmitter::emitJumpNoFallthrough(JSOp op, JumpList* jump) +{ + ptrdiff_t offset; + if (!emitCheck(5, &offset)) + return false; + + jsbytecode* code = this->code(offset); + code[0] = jsbytecode(op); + MOZ_ASSERT(-1 <= jump->offset && jump->offset < offset); + jump->push(this->code(0), offset); + updateDepth(offset); + return true; +} + +bool +BytecodeEmitter::emitJump(JSOp op, JumpList* jump) +{ + if (!emitJumpNoFallthrough(op, jump)) + return false; + if (BytecodeFallsThrough(op)) { + JumpTarget fallthrough; + if (!emitJumpTarget(&fallthrough)) + return false; + } + return true; +} + +bool +BytecodeEmitter::emitBackwardJump(JSOp op, JumpTarget target, JumpList* jump, JumpTarget* fallthrough) +{ + if (!emitJumpNoFallthrough(op, jump)) + return false; + patchJumpsToTarget(*jump, target); + + // Unconditionally create a fallthrough for closing iterators, and as a + // target for break statements. + if (!emitJumpTarget(fallthrough)) + return false; + return true; +} + +void +BytecodeEmitter::patchJumpsToTarget(JumpList jump, JumpTarget target) +{ + MOZ_ASSERT(-1 <= jump.offset && jump.offset <= offset()); + MOZ_ASSERT(0 <= target.offset && target.offset <= offset()); + MOZ_ASSERT_IF(jump.offset != -1 && target.offset + 4 <= offset(), + BytecodeIsJumpTarget(JSOp(*code(target.offset)))); + jump.patchAll(code(0), target); +} + +bool +BytecodeEmitter::emitJumpTargetAndPatch(JumpList jump) +{ + if (jump.offset == -1) + return true; + JumpTarget target; + if (!emitJumpTarget(&target)) + return false; + patchJumpsToTarget(jump, target); + return true; +} + +bool +BytecodeEmitter::emitCall(JSOp op, uint16_t argc, ParseNode* pn) +{ + if (pn && !updateSourceCoordNotes(pn->pn_pos.begin)) + return false; + return emit3(op, ARGC_HI(argc), ARGC_LO(argc)); +} + +bool +BytecodeEmitter::emitDupAt(unsigned slotFromTop) +{ + MOZ_ASSERT(slotFromTop < unsigned(stackDepth)); + + if (slotFromTop >= JS_BIT(24)) { + reportError(nullptr, JSMSG_TOO_MANY_LOCALS); + return false; + } + + ptrdiff_t off; + if (!emitN(JSOP_DUPAT, 3, &off)) + return false; + + jsbytecode* pc = code(off); + SET_UINT24(pc, slotFromTop); + return true; +} + +bool +BytecodeEmitter::emitCheckIsObj(CheckIsObjectKind kind) +{ + return emit2(JSOP_CHECKISOBJ, uint8_t(kind)); +} + +static inline unsigned +LengthOfSetLine(unsigned line) +{ + return 1 /* SN_SETLINE */ + (line > SN_4BYTE_OFFSET_MASK ? 4 : 1); +} + +/* Updates line number notes, not column notes. */ +bool +BytecodeEmitter::updateLineNumberNotes(uint32_t offset) +{ + TokenStream* ts = &parser->tokenStream; + bool onThisLine; + if (!ts->srcCoords.isOnThisLine(offset, currentLine(), &onThisLine)) + return ts->reportError(JSMSG_OUT_OF_MEMORY); + if (!onThisLine) { + unsigned line = ts->srcCoords.lineNum(offset); + unsigned delta = line - currentLine(); + + /* + * Encode any change in the current source line number by using + * either several SRC_NEWLINE notes or just one SRC_SETLINE note, + * whichever consumes less space. + * + * NB: We handle backward line number deltas (possible with for + * loops where the update part is emitted after the body, but its + * line number is <= any line number in the body) here by letting + * unsigned delta_ wrap to a very large number, which triggers a + * SRC_SETLINE. + */ + current->currentLine = line; + current->lastColumn = 0; + if (delta >= LengthOfSetLine(line)) { + if (!newSrcNote2(SRC_SETLINE, ptrdiff_t(line))) + return false; + } else { + do { + if (!newSrcNote(SRC_NEWLINE)) + return false; + } while (--delta != 0); + } + } + return true; +} + +/* Updates the line number and column number information in the source notes. */ +bool +BytecodeEmitter::updateSourceCoordNotes(uint32_t offset) +{ + if (!updateLineNumberNotes(offset)) + return false; + + uint32_t columnIndex = parser->tokenStream.srcCoords.columnIndex(offset); + ptrdiff_t colspan = ptrdiff_t(columnIndex) - ptrdiff_t(current->lastColumn); + if (colspan != 0) { + // If the column span is so large that we can't store it, then just + // discard this information. This can happen with minimized or otherwise + // machine-generated code. Even gigantic column numbers are still + // valuable if you have a source map to relate them to something real; + // but it's better to fail soft here. + if (!SN_REPRESENTABLE_COLSPAN(colspan)) + return true; + if (!newSrcNote2(SRC_COLSPAN, SN_COLSPAN_TO_OFFSET(colspan))) + return false; + current->lastColumn = columnIndex; + } + return true; +} + +bool +BytecodeEmitter::emitLoopHead(ParseNode* nextpn, JumpTarget* top) +{ + if (nextpn) { + /* + * Try to give the JSOP_LOOPHEAD the same line number as the next + * instruction. nextpn is often a block, in which case the next + * instruction typically comes from the first statement inside. + */ + if (nextpn->isKind(PNK_LEXICALSCOPE)) + nextpn = nextpn->scopeBody(); + MOZ_ASSERT_IF(nextpn->isKind(PNK_STATEMENTLIST), nextpn->isArity(PN_LIST)); + if (nextpn->isKind(PNK_STATEMENTLIST) && nextpn->pn_head) + nextpn = nextpn->pn_head; + if (!updateSourceCoordNotes(nextpn->pn_pos.begin)) + return false; + } + + *top = { offset() }; + return emit1(JSOP_LOOPHEAD); +} + +bool +BytecodeEmitter::emitLoopEntry(ParseNode* nextpn, JumpList entryJump) +{ + if (nextpn) { + /* Update the line number, as for LOOPHEAD. */ + if (nextpn->isKind(PNK_LEXICALSCOPE)) + nextpn = nextpn->scopeBody(); + MOZ_ASSERT_IF(nextpn->isKind(PNK_STATEMENTLIST), nextpn->isArity(PN_LIST)); + if (nextpn->isKind(PNK_STATEMENTLIST) && nextpn->pn_head) + nextpn = nextpn->pn_head; + if (!updateSourceCoordNotes(nextpn->pn_pos.begin)) + return false; + } + + JumpTarget entry{ offset() }; + patchJumpsToTarget(entryJump, entry); + + LoopControl& loopInfo = innermostNestableControl->as<LoopControl>(); + MOZ_ASSERT(loopInfo.loopDepth() > 0); + + uint8_t loopDepthAndFlags = PackLoopEntryDepthHintAndFlags(loopInfo.loopDepth(), + loopInfo.canIonOsr()); + return emit2(JSOP_LOOPENTRY, loopDepthAndFlags); +} + +void +BytecodeEmitter::checkTypeSet(JSOp op) +{ + if (CodeSpec[op].format & JOF_TYPESET) { + if (typesetCount < UINT16_MAX) + typesetCount++; + } +} + +bool +BytecodeEmitter::emitUint16Operand(JSOp op, uint32_t operand) +{ + MOZ_ASSERT(operand <= UINT16_MAX); + if (!emit3(op, UINT16_HI(operand), UINT16_LO(operand))) + return false; + checkTypeSet(op); + return true; +} + +bool +BytecodeEmitter::emitUint32Operand(JSOp op, uint32_t operand) +{ + ptrdiff_t off; + if (!emitN(op, 4, &off)) + return false; + SET_UINT32(code(off), operand); + checkTypeSet(op); + return true; +} + +bool +BytecodeEmitter::flushPops(int* npops) +{ + MOZ_ASSERT(*npops != 0); + if (!emitUint16Operand(JSOP_POPN, *npops)) + return false; + + *npops = 0; + return true; +} + +namespace { + +class NonLocalExitControl { + BytecodeEmitter* bce_; + const uint32_t savedScopeNoteIndex_; + const int savedDepth_; + uint32_t openScopeNoteIndex_; + + NonLocalExitControl(const NonLocalExitControl&) = delete; + + MOZ_MUST_USE bool leaveScope(BytecodeEmitter::EmitterScope* scope); + + public: + explicit NonLocalExitControl(BytecodeEmitter* bce) + : bce_(bce), + savedScopeNoteIndex_(bce->scopeNoteList.length()), + savedDepth_(bce->stackDepth), + openScopeNoteIndex_(bce->innermostEmitterScope->noteIndex()) + { } + + ~NonLocalExitControl() { + for (uint32_t n = savedScopeNoteIndex_; n < bce_->scopeNoteList.length(); n++) + bce_->scopeNoteList.recordEnd(n, bce_->offset(), bce_->inPrologue()); + bce_->stackDepth = savedDepth_; + } + + MOZ_MUST_USE bool prepareForNonLocalJump(BytecodeEmitter::NestableControl* target); + + MOZ_MUST_USE bool prepareForNonLocalJumpToOutermost() { + return prepareForNonLocalJump(nullptr); + } +}; + +bool +NonLocalExitControl::leaveScope(BytecodeEmitter::EmitterScope* es) +{ + if (!es->leave(bce_, /* nonLocal = */ true)) + return false; + + // As we pop each scope due to the non-local jump, emit notes that + // record the extent of the enclosing scope. These notes will have + // their ends recorded in ~NonLocalExitControl(). + uint32_t enclosingScopeIndex = ScopeNote::NoScopeIndex; + if (es->enclosingInFrame()) + enclosingScopeIndex = es->enclosingInFrame()->index(); + if (!bce_->scopeNoteList.append(enclosingScopeIndex, bce_->offset(), bce_->inPrologue(), + openScopeNoteIndex_)) + return false; + openScopeNoteIndex_ = bce_->scopeNoteList.length() - 1; + + return true; +} + +/* + * Emit additional bytecode(s) for non-local jumps. + */ +bool +NonLocalExitControl::prepareForNonLocalJump(BytecodeEmitter::NestableControl* target) +{ + using NestableControl = BytecodeEmitter::NestableControl; + using EmitterScope = BytecodeEmitter::EmitterScope; + + EmitterScope* es = bce_->innermostEmitterScope; + int npops = 0; + + auto flushPops = [&npops](BytecodeEmitter* bce) { + if (npops && !bce->flushPops(&npops)) + return false; + return true; + }; + + // Walk the nestable control stack and patch jumps. + for (NestableControl* control = bce_->innermostNestableControl; + control != target; + control = control->enclosing()) + { + // Walk the scope stack and leave the scopes we entered. Leaving a scope + // may emit administrative ops like JSOP_POPLEXICALENV but never anything + // that manipulates the stack. + for (; es != control->emitterScope(); es = es->enclosingInFrame()) { + if (!leaveScope(es)) + return false; + } + + switch (control->kind()) { + case StatementKind::Finally: { + TryFinallyControl& finallyControl = control->as<TryFinallyControl>(); + if (finallyControl.emittingSubroutine()) { + /* + * There's a [exception or hole, retsub pc-index] pair and the + * possible return value on the stack that we need to pop. + */ + npops += 3; + } else { + if (!flushPops(bce_)) + return false; + if (!bce_->emitJump(JSOP_GOSUB, &finallyControl.gosubs)) + return false; + } + break; + } + + case StatementKind::ForOfLoop: + npops += 2; + break; + + case StatementKind::ForInLoop: + /* The iterator and the current value are on the stack. */ + npops += 1; + if (!flushPops(bce_)) + return false; + if (!bce_->emit1(JSOP_ENDITER)) + return false; + break; + + default: + break; + } + } + + EmitterScope* targetEmitterScope = target ? target->emitterScope() : bce_->varEmitterScope; + for (; es != targetEmitterScope; es = es->enclosingInFrame()) { + if (!leaveScope(es)) + return false; + } + + return flushPops(bce_); +} + +} // anonymous namespace + +bool +BytecodeEmitter::emitGoto(NestableControl* target, JumpList* jumplist, SrcNoteType noteType) +{ + NonLocalExitControl nle(this); + + if (!nle.prepareForNonLocalJump(target)) + return false; + + if (noteType != SRC_NULL) { + if (!newSrcNote(noteType)) + return false; + } + + return emitJump(JSOP_GOTO, jumplist); +} + +Scope* +BytecodeEmitter::innermostScope() const +{ + return innermostEmitterScope->scope(this); +} + +bool +BytecodeEmitter::emitIndex32(JSOp op, uint32_t index) +{ + MOZ_ASSERT(checkStrictOrSloppy(op)); + + const size_t len = 1 + UINT32_INDEX_LEN; + MOZ_ASSERT(len == size_t(CodeSpec[op].length)); + + ptrdiff_t offset; + if (!emitCheck(len, &offset)) + return false; + + jsbytecode* code = this->code(offset); + code[0] = jsbytecode(op); + SET_UINT32_INDEX(code, index); + checkTypeSet(op); + updateDepth(offset); + return true; +} + +bool +BytecodeEmitter::emitIndexOp(JSOp op, uint32_t index) +{ + MOZ_ASSERT(checkStrictOrSloppy(op)); + + const size_t len = CodeSpec[op].length; + MOZ_ASSERT(len >= 1 + UINT32_INDEX_LEN); + + ptrdiff_t offset; + if (!emitCheck(len, &offset)) + return false; + + jsbytecode* code = this->code(offset); + code[0] = jsbytecode(op); + SET_UINT32_INDEX(code, index); + checkTypeSet(op); + updateDepth(offset); + return true; +} + +bool +BytecodeEmitter::emitAtomOp(JSAtom* atom, JSOp op) +{ + MOZ_ASSERT(atom); + MOZ_ASSERT(JOF_OPTYPE(op) == JOF_ATOM); + + // .generator lookups should be emitted as JSOP_GETALIASEDVAR instead of + // JSOP_GETNAME etc, to bypass |with| objects on the scope chain. + // It's safe to emit .this lookups though because |with| objects skip + // those. + MOZ_ASSERT_IF(op == JSOP_GETNAME || op == JSOP_GETGNAME, + atom != cx->names().dotGenerator); + + if (op == JSOP_GETPROP && atom == cx->names().length) { + /* Specialize length accesses for the interpreter. */ + op = JSOP_LENGTH; + } + + uint32_t index; + if (!makeAtomIndex(atom, &index)) + return false; + + return emitIndexOp(op, index); +} + +bool +BytecodeEmitter::emitAtomOp(ParseNode* pn, JSOp op) +{ + MOZ_ASSERT(pn->pn_atom != nullptr); + return emitAtomOp(pn->pn_atom, op); +} + +bool +BytecodeEmitter::emitInternedScopeOp(uint32_t index, JSOp op) +{ + MOZ_ASSERT(JOF_OPTYPE(op) == JOF_SCOPE); + MOZ_ASSERT(index < scopeList.length()); + return emitIndex32(op, index); +} + +bool +BytecodeEmitter::emitInternedObjectOp(uint32_t index, JSOp op) +{ + MOZ_ASSERT(JOF_OPTYPE(op) == JOF_OBJECT); + MOZ_ASSERT(index < objectList.length); + return emitIndex32(op, index); +} + +bool +BytecodeEmitter::emitObjectOp(ObjectBox* objbox, JSOp op) +{ + return emitInternedObjectOp(objectList.add(objbox), op); +} + +bool +BytecodeEmitter::emitObjectPairOp(ObjectBox* objbox1, ObjectBox* objbox2, JSOp op) +{ + uint32_t index = objectList.add(objbox1); + objectList.add(objbox2); + return emitInternedObjectOp(index, op); +} + +bool +BytecodeEmitter::emitRegExp(uint32_t index) +{ + return emitIndex32(JSOP_REGEXP, index); +} + +bool +BytecodeEmitter::emitLocalOp(JSOp op, uint32_t slot) +{ + MOZ_ASSERT(JOF_OPTYPE(op) != JOF_ENVCOORD); + MOZ_ASSERT(IsLocalOp(op)); + + ptrdiff_t off; + if (!emitN(op, LOCALNO_LEN, &off)) + return false; + + SET_LOCALNO(code(off), slot); + return true; +} + +bool +BytecodeEmitter::emitArgOp(JSOp op, uint16_t slot) +{ + MOZ_ASSERT(IsArgOp(op)); + ptrdiff_t off; + if (!emitN(op, ARGNO_LEN, &off)) + return false; + + SET_ARGNO(code(off), slot); + return true; +} + +bool +BytecodeEmitter::emitEnvCoordOp(JSOp op, EnvironmentCoordinate ec) +{ + MOZ_ASSERT(JOF_OPTYPE(op) == JOF_ENVCOORD); + + unsigned n = ENVCOORD_HOPS_LEN + ENVCOORD_SLOT_LEN; + MOZ_ASSERT(int(n) + 1 /* op */ == CodeSpec[op].length); + + ptrdiff_t off; + if (!emitN(op, n, &off)) + return false; + + jsbytecode* pc = code(off); + SET_ENVCOORD_HOPS(pc, ec.hops()); + pc += ENVCOORD_HOPS_LEN; + SET_ENVCOORD_SLOT(pc, ec.slot()); + pc += ENVCOORD_SLOT_LEN; + checkTypeSet(op); + return true; +} + +static JSOp +GetIncDecInfo(ParseNodeKind kind, bool* post) +{ + MOZ_ASSERT(kind == PNK_POSTINCREMENT || kind == PNK_PREINCREMENT || + kind == PNK_POSTDECREMENT || kind == PNK_PREDECREMENT); + *post = kind == PNK_POSTINCREMENT || kind == PNK_POSTDECREMENT; + return (kind == PNK_POSTINCREMENT || kind == PNK_PREINCREMENT) ? JSOP_ADD : JSOP_SUB; +} + +JSOp +BytecodeEmitter::strictifySetNameOp(JSOp op) +{ + switch (op) { + case JSOP_SETNAME: + if (sc->strict()) + op = JSOP_STRICTSETNAME; + break; + case JSOP_SETGNAME: + if (sc->strict()) + op = JSOP_STRICTSETGNAME; + break; + default:; + } + return op; +} + +bool +BytecodeEmitter::checkSideEffects(ParseNode* pn, bool* answer) +{ + JS_CHECK_RECURSION(cx, return false); + + restart: + + switch (pn->getKind()) { + // Trivial cases with no side effects. + case PNK_NOP: + case PNK_STRING: + case PNK_TEMPLATE_STRING: + case PNK_REGEXP: + case PNK_TRUE: + case PNK_FALSE: + case PNK_NULL: + case PNK_ELISION: + case PNK_GENERATOR: + case PNK_NUMBER: + case PNK_OBJECT_PROPERTY_NAME: + MOZ_ASSERT(pn->isArity(PN_NULLARY)); + *answer = false; + return true; + + // |this| can throw in derived class constructors, including nested arrow + // functions or eval. + case PNK_THIS: + MOZ_ASSERT(pn->isArity(PN_UNARY)); + *answer = sc->needsThisTDZChecks(); + return true; + + // Trivial binary nodes with more token pos holders. + case PNK_NEWTARGET: + MOZ_ASSERT(pn->isArity(PN_BINARY)); + MOZ_ASSERT(pn->pn_left->isKind(PNK_POSHOLDER)); + MOZ_ASSERT(pn->pn_right->isKind(PNK_POSHOLDER)); + *answer = false; + return true; + + case PNK_BREAK: + case PNK_CONTINUE: + case PNK_DEBUGGER: + MOZ_ASSERT(pn->isArity(PN_NULLARY)); + *answer = true; + return true; + + // Watch out for getters! + case PNK_DOT: + MOZ_ASSERT(pn->isArity(PN_NAME)); + *answer = true; + return true; + + // Unary cases with side effects only if the child has them. + case PNK_TYPEOFEXPR: + case PNK_VOID: + case PNK_NOT: + MOZ_ASSERT(pn->isArity(PN_UNARY)); + return checkSideEffects(pn->pn_kid, answer); + + // Even if the name expression is effect-free, performing ToPropertyKey on + // it might not be effect-free: + // + // RegExp.prototype.toString = () => { throw 42; }; + // ({ [/regex/]: 0 }); // ToPropertyKey(/regex/) throws 42 + // + // function Q() { + // ({ [new.target]: 0 }); + // } + // Q.toString = () => { throw 17; }; + // new Q; // new.target will be Q, ToPropertyKey(Q) throws 17 + case PNK_COMPUTED_NAME: + MOZ_ASSERT(pn->isArity(PN_UNARY)); + *answer = true; + return true; + + // Looking up or evaluating the associated name could throw. + case PNK_TYPEOFNAME: + MOZ_ASSERT(pn->isArity(PN_UNARY)); + *answer = true; + return true; + + // These unary cases have side effects on the enclosing object/array, + // sure. But that's not the question this function answers: it's + // whether the operation may have a side effect on something *other* than + // the result of the overall operation in which it's embedded. The + // answer to that is no, for an object literal having a mutated prototype + // and an array comprehension containing no other effectful operations + // only produce a value, without affecting anything else. + case PNK_MUTATEPROTO: + case PNK_ARRAYPUSH: + MOZ_ASSERT(pn->isArity(PN_UNARY)); + return checkSideEffects(pn->pn_kid, answer); + + // Unary cases with obvious side effects. + case PNK_PREINCREMENT: + case PNK_POSTINCREMENT: + case PNK_PREDECREMENT: + case PNK_POSTDECREMENT: + case PNK_THROW: + MOZ_ASSERT(pn->isArity(PN_UNARY)); + *answer = true; + return true; + + // These might invoke valueOf/toString, even with a subexpression without + // side effects! Consider |+{ valueOf: null, toString: null }|. + case PNK_BITNOT: + case PNK_POS: + case PNK_NEG: + MOZ_ASSERT(pn->isArity(PN_UNARY)); + *answer = true; + return true; + + // This invokes the (user-controllable) iterator protocol. + case PNK_SPREAD: + MOZ_ASSERT(pn->isArity(PN_UNARY)); + *answer = true; + return true; + + case PNK_YIELD_STAR: + case PNK_YIELD: + case PNK_AWAIT: + MOZ_ASSERT(pn->isArity(PN_BINARY)); + *answer = true; + return true; + + // Deletion generally has side effects, even if isolated cases have none. + case PNK_DELETENAME: + case PNK_DELETEPROP: + case PNK_DELETEELEM: + MOZ_ASSERT(pn->isArity(PN_UNARY)); + *answer = true; + return true; + + // Deletion of a non-Reference expression has side effects only through + // evaluating the expression. + case PNK_DELETEEXPR: { + MOZ_ASSERT(pn->isArity(PN_UNARY)); + ParseNode* expr = pn->pn_kid; + return checkSideEffects(expr, answer); + } + + case PNK_SEMI: + MOZ_ASSERT(pn->isArity(PN_UNARY)); + if (ParseNode* expr = pn->pn_kid) + return checkSideEffects(expr, answer); + *answer = false; + return true; + + // Binary cases with obvious side effects. + case PNK_ASSIGN: + case PNK_ADDASSIGN: + case PNK_SUBASSIGN: + case PNK_BITORASSIGN: + case PNK_BITXORASSIGN: + case PNK_BITANDASSIGN: + case PNK_LSHASSIGN: + case PNK_RSHASSIGN: + case PNK_URSHASSIGN: + case PNK_MULASSIGN: + case PNK_DIVASSIGN: + case PNK_MODASSIGN: + case PNK_POWASSIGN: + case PNK_SETTHIS: + MOZ_ASSERT(pn->isArity(PN_BINARY)); + *answer = true; + return true; + + case PNK_STATEMENTLIST: + case PNK_CATCHLIST: + // Strict equality operations and logical operators are well-behaved and + // perform no conversions. + case PNK_OR: + case PNK_AND: + case PNK_STRICTEQ: + case PNK_STRICTNE: + // Any subexpression of a comma expression could be effectful. + case PNK_COMMA: + MOZ_ASSERT(pn->pn_count > 0); + MOZ_FALLTHROUGH; + // Subcomponents of a literal may be effectful. + case PNK_ARRAY: + case PNK_OBJECT: + MOZ_ASSERT(pn->isArity(PN_LIST)); + for (ParseNode* item = pn->pn_head; item; item = item->pn_next) { + if (!checkSideEffects(item, answer)) + return false; + if (*answer) + return true; + } + return true; + + // Most other binary operations (parsed as lists in SpiderMonkey) may + // perform conversions triggering side effects. Math operations perform + // ToNumber and may fail invoking invalid user-defined toString/valueOf: + // |5 < { toString: null }|. |instanceof| throws if provided a + // non-object constructor: |null instanceof null|. |in| throws if given + // a non-object RHS: |5 in null|. + case PNK_BITOR: + case PNK_BITXOR: + case PNK_BITAND: + case PNK_EQ: + case PNK_NE: + case PNK_LT: + case PNK_LE: + case PNK_GT: + case PNK_GE: + case PNK_INSTANCEOF: + case PNK_IN: + case PNK_LSH: + case PNK_RSH: + case PNK_URSH: + case PNK_ADD: + case PNK_SUB: + case PNK_STAR: + case PNK_DIV: + case PNK_MOD: + case PNK_POW: + MOZ_ASSERT(pn->isArity(PN_LIST)); + MOZ_ASSERT(pn->pn_count >= 2); + *answer = true; + return true; + + case PNK_COLON: + case PNK_CASE: + MOZ_ASSERT(pn->isArity(PN_BINARY)); + if (!checkSideEffects(pn->pn_left, answer)) + return false; + if (*answer) + return true; + return checkSideEffects(pn->pn_right, answer); + + // More getters. + case PNK_ELEM: + MOZ_ASSERT(pn->isArity(PN_BINARY)); + *answer = true; + return true; + + // These affect visible names in this code, or in other code. + case PNK_IMPORT: + case PNK_EXPORT_FROM: + case PNK_EXPORT_DEFAULT: + MOZ_ASSERT(pn->isArity(PN_BINARY)); + *answer = true; + return true; + + // Likewise. + case PNK_EXPORT: + MOZ_ASSERT(pn->isArity(PN_UNARY)); + *answer = true; + return true; + + // Every part of a loop might be effect-free, but looping infinitely *is* + // an effect. (Language lawyer trivia: C++ says threads can be assumed + // to exit or have side effects, C++14 [intro.multithread]p27, so a C++ + // implementation's equivalent of the below could set |*answer = false;| + // if all loop sub-nodes set |*answer = false|!) + case PNK_DOWHILE: + case PNK_WHILE: + case PNK_FOR: + case PNK_COMPREHENSIONFOR: + MOZ_ASSERT(pn->isArity(PN_BINARY)); + *answer = true; + return true; + + // Declarations affect the name set of the relevant scope. + case PNK_VAR: + case PNK_CONST: + case PNK_LET: + MOZ_ASSERT(pn->isArity(PN_LIST)); + *answer = true; + return true; + + case PNK_IF: + case PNK_CONDITIONAL: + MOZ_ASSERT(pn->isArity(PN_TERNARY)); + if (!checkSideEffects(pn->pn_kid1, answer)) + return false; + if (*answer) + return true; + if (!checkSideEffects(pn->pn_kid2, answer)) + return false; + if (*answer) + return true; + if ((pn = pn->pn_kid3)) + goto restart; + return true; + + // Function calls can invoke non-local code. + case PNK_NEW: + case PNK_CALL: + case PNK_TAGGED_TEMPLATE: + case PNK_SUPERCALL: + MOZ_ASSERT(pn->isArity(PN_LIST)); + *answer = true; + return true; + + // Classes typically introduce names. Even if no name is introduced, + // the heritage and/or class body (through computed property names) + // usually have effects. + case PNK_CLASS: + MOZ_ASSERT(pn->isArity(PN_TERNARY)); + *answer = true; + return true; + + // |with| calls |ToObject| on its expression and so throws if that value + // is null/undefined. + case PNK_WITH: + MOZ_ASSERT(pn->isArity(PN_BINARY)); + *answer = true; + return true; + + case PNK_RETURN: + MOZ_ASSERT(pn->isArity(PN_BINARY)); + *answer = true; + return true; + + case PNK_NAME: + MOZ_ASSERT(pn->isArity(PN_NAME)); + *answer = true; + return true; + + // Shorthands could trigger getters: the |x| in the object literal in + // |with ({ get x() { throw 42; } }) ({ x });|, for example, triggers + // one. (Of course, it isn't necessary to use |with| for a shorthand to + // trigger a getter.) + case PNK_SHORTHAND: + MOZ_ASSERT(pn->isArity(PN_BINARY)); + *answer = true; + return true; + + case PNK_FUNCTION: + MOZ_ASSERT(pn->isArity(PN_CODE)); + /* + * A named function, contrary to ES3, is no longer effectful, because + * we bind its name lexically (using JSOP_CALLEE) instead of creating + * an Object instance and binding a readonly, permanent property in it + * (the object and binding can be detected and hijacked or captured). + * This is a bug fix to ES3; it is fixed in ES3.1 drafts. + */ + *answer = false; + return true; + + case PNK_MODULE: + *answer = false; + return true; + + // Generator expressions have no side effects on their own. + case PNK_GENEXP: + MOZ_ASSERT(pn->isArity(PN_LIST)); + *answer = false; + return true; + + case PNK_TRY: + MOZ_ASSERT(pn->isArity(PN_TERNARY)); + if (!checkSideEffects(pn->pn_kid1, answer)) + return false; + if (*answer) + return true; + if (ParseNode* catchList = pn->pn_kid2) { + MOZ_ASSERT(catchList->isKind(PNK_CATCHLIST)); + if (!checkSideEffects(catchList, answer)) + return false; + if (*answer) + return true; + } + if (ParseNode* finallyBlock = pn->pn_kid3) { + if (!checkSideEffects(finallyBlock, answer)) + return false; + } + return true; + + case PNK_CATCH: + MOZ_ASSERT(pn->isArity(PN_TERNARY)); + if (!checkSideEffects(pn->pn_kid1, answer)) + return false; + if (*answer) + return true; + if (ParseNode* cond = pn->pn_kid2) { + if (!checkSideEffects(cond, answer)) + return false; + if (*answer) + return true; + } + return checkSideEffects(pn->pn_kid3, answer); + + case PNK_SWITCH: + MOZ_ASSERT(pn->isArity(PN_BINARY)); + if (!checkSideEffects(pn->pn_left, answer)) + return false; + return *answer || checkSideEffects(pn->pn_right, answer); + + case PNK_LABEL: + MOZ_ASSERT(pn->isArity(PN_NAME)); + return checkSideEffects(pn->expr(), answer); + + case PNK_LEXICALSCOPE: + MOZ_ASSERT(pn->isArity(PN_SCOPE)); + return checkSideEffects(pn->scopeBody(), answer); + + // We could methodically check every interpolated expression, but it's + // probably not worth the trouble. Treat template strings as effect-free + // only if they don't contain any substitutions. + case PNK_TEMPLATE_STRING_LIST: + MOZ_ASSERT(pn->isArity(PN_LIST)); + MOZ_ASSERT(pn->pn_count > 0); + MOZ_ASSERT((pn->pn_count % 2) == 1, + "template strings must alternate template and substitution " + "parts"); + *answer = pn->pn_count > 1; + return true; + + case PNK_ARRAYCOMP: + MOZ_ASSERT(pn->isArity(PN_LIST)); + MOZ_ASSERT(pn->pn_count == 1); + return checkSideEffects(pn->pn_head, answer); + + // This should be unreachable but is left as-is for now. + case PNK_PARAMSBODY: + *answer = true; + return true; + + case PNK_FORIN: // by PNK_FOR/PNK_COMPREHENSIONFOR + case PNK_FOROF: // by PNK_FOR/PNK_COMPREHENSIONFOR + case PNK_FORHEAD: // by PNK_FOR/PNK_COMPREHENSIONFOR + case PNK_CLASSMETHOD: // by PNK_CLASS + case PNK_CLASSNAMES: // by PNK_CLASS + case PNK_CLASSMETHODLIST: // by PNK_CLASS + case PNK_IMPORT_SPEC_LIST: // by PNK_IMPORT + case PNK_IMPORT_SPEC: // by PNK_IMPORT + case PNK_EXPORT_BATCH_SPEC:// by PNK_EXPORT + case PNK_EXPORT_SPEC_LIST: // by PNK_EXPORT + case PNK_EXPORT_SPEC: // by PNK_EXPORT + case PNK_CALLSITEOBJ: // by PNK_TAGGED_TEMPLATE + case PNK_POSHOLDER: // by PNK_NEWTARGET + case PNK_SUPERBASE: // by PNK_ELEM and others + MOZ_CRASH("handled by parent nodes"); + + case PNK_LIMIT: // invalid sentinel value + MOZ_CRASH("invalid node kind"); + } + + MOZ_CRASH("invalid, unenumerated ParseNodeKind value encountered in " + "BytecodeEmitter::checkSideEffects"); +} + +bool +BytecodeEmitter::isInLoop() +{ + return findInnermostNestableControl<LoopControl>(); +} + +bool +BytecodeEmitter::checkSingletonContext() +{ + if (!script->treatAsRunOnce() || sc->isFunctionBox() || isInLoop()) + return false; + hasSingletons = true; + return true; +} + +bool +BytecodeEmitter::checkRunOnceContext() +{ + return checkSingletonContext() || (!isInLoop() && isRunOnceLambda()); +} + +bool +BytecodeEmitter::needsImplicitThis() +{ + // Short-circuit if there is an enclosing 'with' scope. + if (sc->inWith()) + return true; + + // Otherwise see if the current point is under a 'with'. + for (EmitterScope* es = innermostEmitterScope; es; es = es->enclosingInFrame()) { + if (es->scope(this)->kind() == ScopeKind::With) + return true; + } + + return false; +} + +bool +BytecodeEmitter::maybeSetDisplayURL() +{ + if (tokenStream()->hasDisplayURL()) { + if (!parser->ss->setDisplayURL(cx, tokenStream()->displayURL())) + return false; + } + return true; +} + +bool +BytecodeEmitter::maybeSetSourceMap() +{ + if (tokenStream()->hasSourceMapURL()) { + MOZ_ASSERT(!parser->ss->hasSourceMapURL()); + if (!parser->ss->setSourceMapURL(cx, tokenStream()->sourceMapURL())) + return false; + } + + /* + * Source map URLs passed as a compile option (usually via a HTTP source map + * header) override any source map urls passed as comment pragmas. + */ + if (parser->options().sourceMapURL()) { + // Warn about the replacement, but use the new one. + if (parser->ss->hasSourceMapURL()) { + if(!parser->report(ParseWarning, false, nullptr, JSMSG_ALREADY_HAS_PRAGMA, + parser->ss->filename(), "//# sourceMappingURL")) + return false; + } + + if (!parser->ss->setSourceMapURL(cx, parser->options().sourceMapURL())) + return false; + } + + return true; +} + +void +BytecodeEmitter::tellDebuggerAboutCompiledScript(ExclusiveContext* cx) +{ + // Note: when parsing off thread the resulting scripts need to be handed to + // the debugger after rejoining to the main thread. + if (!cx->isJSContext()) + return; + + // Lazy scripts are never top level (despite always being invoked with a + // nullptr parent), and so the hook should never be fired. + if (emitterMode != LazyFunction && !parent) { + Debugger::onNewScript(cx->asJSContext(), script); + } +} + +inline TokenStream* +BytecodeEmitter::tokenStream() +{ + return &parser->tokenStream; +} + +bool +BytecodeEmitter::reportError(ParseNode* pn, unsigned errorNumber, ...) +{ + TokenPos pos = pn ? pn->pn_pos : tokenStream()->currentToken().pos; + + va_list args; + va_start(args, errorNumber); + bool result = tokenStream()->reportCompileErrorNumberVA(pos.begin, JSREPORT_ERROR, + errorNumber, args); + va_end(args); + return result; +} + +bool +BytecodeEmitter::reportStrictWarning(ParseNode* pn, unsigned errorNumber, ...) +{ + TokenPos pos = pn ? pn->pn_pos : tokenStream()->currentToken().pos; + + va_list args; + va_start(args, errorNumber); + bool result = tokenStream()->reportStrictWarningErrorNumberVA(pos.begin, errorNumber, args); + va_end(args); + return result; +} + +bool +BytecodeEmitter::reportStrictModeError(ParseNode* pn, unsigned errorNumber, ...) +{ + TokenPos pos = pn ? pn->pn_pos : tokenStream()->currentToken().pos; + + va_list args; + va_start(args, errorNumber); + bool result = tokenStream()->reportStrictModeErrorNumberVA(pos.begin, sc->strict(), + errorNumber, args); + va_end(args); + return result; +} + +bool +BytecodeEmitter::emitNewInit(JSProtoKey key) +{ + const size_t len = 1 + UINT32_INDEX_LEN; + ptrdiff_t offset; + if (!emitCheck(len, &offset)) + return false; + + jsbytecode* code = this->code(offset); + code[0] = JSOP_NEWINIT; + code[1] = jsbytecode(key); + code[2] = 0; + code[3] = 0; + code[4] = 0; + checkTypeSet(JSOP_NEWINIT); + updateDepth(offset); + return true; +} + +bool +BytecodeEmitter::iteratorResultShape(unsigned* shape) +{ + // No need to do any guessing for the object kind, since we know exactly how + // many properties we plan to have. + gc::AllocKind kind = gc::GetGCObjectKind(2); + RootedPlainObject obj(cx, NewBuiltinClassInstance<PlainObject>(cx, kind, TenuredObject)); + if (!obj) + return false; + + Rooted<jsid> value_id(cx, AtomToId(cx->names().value)); + Rooted<jsid> done_id(cx, AtomToId(cx->names().done)); + if (!NativeDefineProperty(cx, obj, value_id, UndefinedHandleValue, nullptr, nullptr, + JSPROP_ENUMERATE)) + { + return false; + } + if (!NativeDefineProperty(cx, obj, done_id, UndefinedHandleValue, nullptr, nullptr, + JSPROP_ENUMERATE)) + { + return false; + } + + ObjectBox* objbox = parser->newObjectBox(obj); + if (!objbox) + return false; + + *shape = objectList.add(objbox); + + return true; +} + +bool +BytecodeEmitter::emitPrepareIteratorResult() +{ + unsigned shape; + if (!iteratorResultShape(&shape)) + return false; + return emitIndex32(JSOP_NEWOBJECT, shape); +} + +bool +BytecodeEmitter::emitFinishIteratorResult(bool done) +{ + uint32_t value_id; + if (!makeAtomIndex(cx->names().value, &value_id)) + return false; + uint32_t done_id; + if (!makeAtomIndex(cx->names().done, &done_id)) + return false; + + if (!emitIndex32(JSOP_INITPROP, value_id)) + return false; + if (!emit1(done ? JSOP_TRUE : JSOP_FALSE)) + return false; + if (!emitIndex32(JSOP_INITPROP, done_id)) + return false; + return true; +} + +bool +BytecodeEmitter::emitGetNameAtLocation(JSAtom* name, const NameLocation& loc, bool callContext) +{ + switch (loc.kind()) { + case NameLocation::Kind::Dynamic: + if (!emitAtomOp(name, JSOP_GETNAME)) + return false; + break; + + case NameLocation::Kind::Global: + if (!emitAtomOp(name, JSOP_GETGNAME)) + return false; + break; + + case NameLocation::Kind::Intrinsic: + if (!emitAtomOp(name, JSOP_GETINTRINSIC)) + return false; + break; + + case NameLocation::Kind::NamedLambdaCallee: + if (!emit1(JSOP_CALLEE)) + return false; + break; + + case NameLocation::Kind::Import: + if (!emitAtomOp(name, JSOP_GETIMPORT)) + return false; + break; + + case NameLocation::Kind::ArgumentSlot: + if (!emitArgOp(JSOP_GETARG, loc.argumentSlot())) + return false; + break; + + case NameLocation::Kind::FrameSlot: + if (loc.isLexical()) { + if (!emitTDZCheckIfNeeded(name, loc)) + return false; + } + if (!emitLocalOp(JSOP_GETLOCAL, loc.frameSlot())) + return false; + break; + + case NameLocation::Kind::EnvironmentCoordinate: + if (loc.isLexical()) { + if (!emitTDZCheckIfNeeded(name, loc)) + return false; + } + if (!emitEnvCoordOp(JSOP_GETALIASEDVAR, loc.environmentCoordinate())) + return false; + break; + + case NameLocation::Kind::DynamicAnnexBVar: + MOZ_CRASH("Synthesized vars for Annex B.3.3 should only be used in initialization"); + } + + // Need to provide |this| value for call. + if (callContext) { + switch (loc.kind()) { + case NameLocation::Kind::Dynamic: { + JSOp thisOp = needsImplicitThis() ? JSOP_IMPLICITTHIS : JSOP_GIMPLICITTHIS; + if (!emitAtomOp(name, thisOp)) + return false; + break; + } + + case NameLocation::Kind::Global: + if (!emitAtomOp(name, JSOP_GIMPLICITTHIS)) + return false; + break; + + case NameLocation::Kind::Intrinsic: + case NameLocation::Kind::NamedLambdaCallee: + case NameLocation::Kind::Import: + case NameLocation::Kind::ArgumentSlot: + case NameLocation::Kind::FrameSlot: + case NameLocation::Kind::EnvironmentCoordinate: + if (!emit1(JSOP_UNDEFINED)) + return false; + break; + + case NameLocation::Kind::DynamicAnnexBVar: + MOZ_CRASH("Synthesized vars for Annex B.3.3 should only be used in initialization"); + } + } + + return true; +} + +bool +BytecodeEmitter::emitGetName(ParseNode* pn, bool callContext) +{ + return emitGetName(pn->name(), callContext); +} + +template <typename RHSEmitter> +bool +BytecodeEmitter::emitSetOrInitializeNameAtLocation(HandleAtom name, const NameLocation& loc, + RHSEmitter emitRhs, bool initialize) +{ + bool emittedBindOp = false; + + switch (loc.kind()) { + case NameLocation::Kind::Dynamic: + case NameLocation::Kind::Import: + case NameLocation::Kind::DynamicAnnexBVar: { + uint32_t atomIndex; + if (!makeAtomIndex(name, &atomIndex)) + return false; + if (loc.kind() == NameLocation::Kind::DynamicAnnexBVar) { + // Annex B vars always go on the nearest variable environment, + // even if lexical environments in between contain same-named + // bindings. + if (!emit1(JSOP_BINDVAR)) + return false; + } else { + if (!emitIndexOp(JSOP_BINDNAME, atomIndex)) + return false; + } + emittedBindOp = true; + if (!emitRhs(this, loc, emittedBindOp)) + return false; + if (!emitIndexOp(strictifySetNameOp(JSOP_SETNAME), atomIndex)) + return false; + break; + } + + case NameLocation::Kind::Global: { + JSOp op; + uint32_t atomIndex; + if (!makeAtomIndex(name, &atomIndex)) + return false; + if (loc.isLexical() && initialize) { + // INITGLEXICAL always gets the global lexical scope. It doesn't + // need a BINDGNAME. + MOZ_ASSERT(innermostScope()->is<GlobalScope>()); + op = JSOP_INITGLEXICAL; + } else { + if (!emitIndexOp(JSOP_BINDGNAME, atomIndex)) + return false; + emittedBindOp = true; + op = strictifySetNameOp(JSOP_SETGNAME); + } + if (!emitRhs(this, loc, emittedBindOp)) + return false; + if (!emitIndexOp(op, atomIndex)) + return false; + break; + } + + case NameLocation::Kind::Intrinsic: + if (!emitRhs(this, loc, emittedBindOp)) + return false; + if (!emitAtomOp(name, JSOP_SETINTRINSIC)) + return false; + break; + + case NameLocation::Kind::NamedLambdaCallee: + if (!emitRhs(this, loc, emittedBindOp)) + return false; + // Assigning to the named lambda is a no-op in sloppy mode but + // throws in strict mode. + if (sc->strict() && !emit1(JSOP_THROWSETCALLEE)) + return false; + break; + + case NameLocation::Kind::ArgumentSlot: { + // If we assign to a positional formal parameter and the arguments + // object is unmapped (strict mode or function with + // default/rest/destructing args), parameters do not alias + // arguments[i], and to make the arguments object reflect initial + // parameter values prior to any mutation we create it eagerly + // whenever parameters are (or might, in the case of calls to eval) + // assigned. + FunctionBox* funbox = sc->asFunctionBox(); + if (funbox->argumentsHasLocalBinding() && !funbox->hasMappedArgsObj()) + funbox->setDefinitelyNeedsArgsObj(); + + if (!emitRhs(this, loc, emittedBindOp)) + return false; + if (!emitArgOp(JSOP_SETARG, loc.argumentSlot())) + return false; + break; + } + + case NameLocation::Kind::FrameSlot: { + JSOp op = JSOP_SETLOCAL; + if (!emitRhs(this, loc, emittedBindOp)) + return false; + if (loc.isLexical()) { + if (initialize) { + op = JSOP_INITLEXICAL; + } else { + if (loc.isConst()) + op = JSOP_THROWSETCONST; + + if (!emitTDZCheckIfNeeded(name, loc)) + return false; + } + } + if (!emitLocalOp(op, loc.frameSlot())) + return false; + if (op == JSOP_INITLEXICAL) { + if (!innermostTDZCheckCache->noteTDZCheck(this, name, DontCheckTDZ)) + return false; + } + break; + } + + case NameLocation::Kind::EnvironmentCoordinate: { + JSOp op = JSOP_SETALIASEDVAR; + if (!emitRhs(this, loc, emittedBindOp)) + return false; + if (loc.isLexical()) { + if (initialize) { + op = JSOP_INITALIASEDLEXICAL; + } else { + if (loc.isConst()) + op = JSOP_THROWSETALIASEDCONST; + + if (!emitTDZCheckIfNeeded(name, loc)) + return false; + } + } + if (loc.bindingKind() == BindingKind::NamedLambdaCallee) { + // Assigning to the named lambda is a no-op in sloppy mode and throws + // in strict mode. + op = JSOP_THROWSETALIASEDCONST; + if (sc->strict() && !emitEnvCoordOp(op, loc.environmentCoordinate())) + return false; + } else { + if (!emitEnvCoordOp(op, loc.environmentCoordinate())) + return false; + } + if (op == JSOP_INITALIASEDLEXICAL) { + if (!innermostTDZCheckCache->noteTDZCheck(this, name, DontCheckTDZ)) + return false; + } + break; + } + } + + return true; +} + +bool +BytecodeEmitter::emitTDZCheckIfNeeded(JSAtom* name, const NameLocation& loc) +{ + // Dynamic accesses have TDZ checks built into their VM code and should + // never emit explicit TDZ checks. + MOZ_ASSERT(loc.hasKnownSlot()); + MOZ_ASSERT(loc.isLexical()); + + Maybe<MaybeCheckTDZ> check = innermostTDZCheckCache->needsTDZCheck(this, name); + if (!check) + return false; + + // We've already emitted a check in this basic block. + if (*check == DontCheckTDZ) + return true; + + if (loc.kind() == NameLocation::Kind::FrameSlot) { + if (!emitLocalOp(JSOP_CHECKLEXICAL, loc.frameSlot())) + return false; + } else { + if (!emitEnvCoordOp(JSOP_CHECKALIASEDLEXICAL, loc.environmentCoordinate())) + return false; + } + + return innermostTDZCheckCache->noteTDZCheck(this, name, DontCheckTDZ); +} + +bool +BytecodeEmitter::emitPropLHS(ParseNode* pn) +{ + MOZ_ASSERT(pn->isKind(PNK_DOT)); + MOZ_ASSERT(!pn->as<PropertyAccess>().isSuper()); + + ParseNode* pn2 = pn->pn_expr; + + /* + * If the object operand is also a dotted property reference, reverse the + * list linked via pn_expr temporarily so we can iterate over it from the + * bottom up (reversing again as we go), to avoid excessive recursion. + */ + if (pn2->isKind(PNK_DOT) && !pn2->as<PropertyAccess>().isSuper()) { + ParseNode* pndot = pn2; + ParseNode* pnup = nullptr; + ParseNode* pndown; + for (;;) { + /* Reverse pndot->pn_expr to point up, not down. */ + pndown = pndot->pn_expr; + pndot->pn_expr = pnup; + if (!pndown->isKind(PNK_DOT) || pndown->as<PropertyAccess>().isSuper()) + break; + pnup = pndot; + pndot = pndown; + } + + /* pndown is a primary expression, not a dotted property reference. */ + if (!emitTree(pndown)) + return false; + + do { + /* Walk back up the list, emitting annotated name ops. */ + if (!emitAtomOp(pndot, JSOP_GETPROP)) + return false; + + /* Reverse the pn_expr link again. */ + pnup = pndot->pn_expr; + pndot->pn_expr = pndown; + pndown = pndot; + } while ((pndot = pnup) != nullptr); + return true; + } + + // The non-optimized case. + return emitTree(pn2); +} + +bool +BytecodeEmitter::emitSuperPropLHS(ParseNode* superBase, bool isCall) +{ + if (!emitGetThisForSuperBase(superBase)) + return false; + if (isCall && !emit1(JSOP_DUP)) + return false; + if (!emit1(JSOP_SUPERBASE)) + return false; + return true; +} + +bool +BytecodeEmitter::emitPropOp(ParseNode* pn, JSOp op) +{ + MOZ_ASSERT(pn->isArity(PN_NAME)); + + if (!emitPropLHS(pn)) + return false; + + if (op == JSOP_CALLPROP && !emit1(JSOP_DUP)) + return false; + + if (!emitAtomOp(pn, op)) + return false; + + if (op == JSOP_CALLPROP && !emit1(JSOP_SWAP)) + return false; + + return true; +} + +bool +BytecodeEmitter::emitSuperPropOp(ParseNode* pn, JSOp op, bool isCall) +{ + ParseNode* base = &pn->as<PropertyAccess>().expression(); + if (!emitSuperPropLHS(base, isCall)) + return false; + + if (!emitAtomOp(pn, op)) + return false; + + if (isCall && !emit1(JSOP_SWAP)) + return false; + + return true; +} + +bool +BytecodeEmitter::emitPropIncDec(ParseNode* pn) +{ + MOZ_ASSERT(pn->pn_kid->isKind(PNK_DOT)); + + bool post; + bool isSuper = pn->pn_kid->as<PropertyAccess>().isSuper(); + JSOp binop = GetIncDecInfo(pn->getKind(), &post); + + if (isSuper) { + ParseNode* base = &pn->pn_kid->as<PropertyAccess>().expression(); + if (!emitSuperPropLHS(base)) // THIS OBJ + return false; + if (!emit1(JSOP_DUP2)) // THIS OBJ THIS OBJ + return false; + } else { + if (!emitPropLHS(pn->pn_kid)) // OBJ + return false; + if (!emit1(JSOP_DUP)) // OBJ OBJ + return false; + } + if (!emitAtomOp(pn->pn_kid, isSuper? JSOP_GETPROP_SUPER : JSOP_GETPROP)) // OBJ V + return false; + if (!emit1(JSOP_POS)) // OBJ N + return false; + if (post && !emit1(JSOP_DUP)) // OBJ N? N + return false; + if (!emit1(JSOP_ONE)) // OBJ N? N 1 + return false; + if (!emit1(binop)) // OBJ N? N+1 + return false; + + if (post) { + if (!emit2(JSOP_PICK, 2 + isSuper)) // N? N+1 OBJ + return false; + if (!emit1(JSOP_SWAP)) // N? OBJ N+1 + return false; + if (isSuper) { + if (!emit2(JSOP_PICK, 3)) // N THIS N+1 OBJ + return false; + if (!emit1(JSOP_SWAP)) // N THIS OBJ N+1 + return false; + } + } + + JSOp setOp = isSuper ? sc->strict() ? JSOP_STRICTSETPROP_SUPER : JSOP_SETPROP_SUPER + : sc->strict() ? JSOP_STRICTSETPROP : JSOP_SETPROP; + if (!emitAtomOp(pn->pn_kid, setOp)) // N? N+1 + return false; + if (post && !emit1(JSOP_POP)) // RESULT + return false; + + return true; +} + +bool +BytecodeEmitter::emitNameIncDec(ParseNode* pn) +{ + MOZ_ASSERT(pn->pn_kid->isKind(PNK_NAME)); + + bool post; + JSOp binop = GetIncDecInfo(pn->getKind(), &post); + + auto emitRhs = [pn, post, binop](BytecodeEmitter* bce, const NameLocation& loc, + bool emittedBindOp) + { + JSAtom* name = pn->pn_kid->name(); + if (!bce->emitGetNameAtLocation(name, loc, false)) // SCOPE? V + return false; + if (!bce->emit1(JSOP_POS)) // SCOPE? N + return false; + if (post && !bce->emit1(JSOP_DUP)) // SCOPE? N? N + return false; + if (!bce->emit1(JSOP_ONE)) // SCOPE? N? N 1 + return false; + if (!bce->emit1(binop)) // SCOPE? N? N+1 + return false; + + if (post && emittedBindOp) { + if (!bce->emit2(JSOP_PICK, 2)) // N? N+1 SCOPE? + return false; + if (!bce->emit1(JSOP_SWAP)) // N? SCOPE? N+1 + return false; + } + + return true; + }; + + if (!emitSetName(pn->pn_kid, emitRhs)) + return false; + + if (post && !emit1(JSOP_POP)) + return false; + + return true; +} + +bool +BytecodeEmitter::emitElemOperands(ParseNode* pn, EmitElemOption opts) +{ + MOZ_ASSERT(pn->isArity(PN_BINARY)); + + if (!emitTree(pn->pn_left)) + return false; + + if (opts == EmitElemOption::IncDec) { + if (!emit1(JSOP_CHECKOBJCOERCIBLE)) + return false; + } else if (opts == EmitElemOption::Call) { + if (!emit1(JSOP_DUP)) + return false; + } + + if (!emitTree(pn->pn_right)) + return false; + + if (opts == EmitElemOption::Set) { + if (!emit2(JSOP_PICK, 2)) + return false; + } else if (opts == EmitElemOption::IncDec || opts == EmitElemOption::CompoundAssign) { + if (!emit1(JSOP_TOID)) + return false; + } + return true; +} + +bool +BytecodeEmitter::emitSuperElemOperands(ParseNode* pn, EmitElemOption opts) +{ + MOZ_ASSERT(pn->isKind(PNK_ELEM) && pn->as<PropertyByValue>().isSuper()); + + // The ordering here is somewhat screwy. We need to evaluate the propval + // first, by spec. Do a little dance to not emit more than one JSOP_THIS. + // Since JSOP_THIS might throw in derived class constructors, we cannot + // just push it earlier as the receiver. We have to swap it down instead. + + if (!emitTree(pn->pn_right)) + return false; + + // We need to convert the key to an object id first, so that we do not do + // it inside both the GETELEM and the SETELEM. + if (opts == EmitElemOption::IncDec || opts == EmitElemOption::CompoundAssign) { + if (!emit1(JSOP_TOID)) + return false; + } + + if (!emitGetThisForSuperBase(pn->pn_left)) + return false; + + if (opts == EmitElemOption::Call) { + if (!emit1(JSOP_SWAP)) + return false; + + // We need another |this| on top, also + if (!emitDupAt(1)) + return false; + } + + if (!emit1(JSOP_SUPERBASE)) + return false; + + if (opts == EmitElemOption::Set && !emit2(JSOP_PICK, 3)) + return false; + + return true; +} + +bool +BytecodeEmitter::emitElemOpBase(JSOp op) +{ + if (!emit1(op)) + return false; + + checkTypeSet(op); + return true; +} + +bool +BytecodeEmitter::emitElemOp(ParseNode* pn, JSOp op) +{ + EmitElemOption opts = EmitElemOption::Get; + if (op == JSOP_CALLELEM) + opts = EmitElemOption::Call; + else if (op == JSOP_SETELEM || op == JSOP_STRICTSETELEM) + opts = EmitElemOption::Set; + + return emitElemOperands(pn, opts) && emitElemOpBase(op); +} + +bool +BytecodeEmitter::emitSuperElemOp(ParseNode* pn, JSOp op, bool isCall) +{ + EmitElemOption opts = EmitElemOption::Get; + if (isCall) + opts = EmitElemOption::Call; + else if (op == JSOP_SETELEM_SUPER || op == JSOP_STRICTSETELEM_SUPER) + opts = EmitElemOption::Set; + + if (!emitSuperElemOperands(pn, opts)) + return false; + if (!emitElemOpBase(op)) + return false; + + if (isCall && !emit1(JSOP_SWAP)) + return false; + + return true; +} + +bool +BytecodeEmitter::emitElemIncDec(ParseNode* pn) +{ + MOZ_ASSERT(pn->pn_kid->isKind(PNK_ELEM)); + + bool isSuper = pn->pn_kid->as<PropertyByValue>().isSuper(); + + // We need to convert the key to an object id first, so that we do not do + // it inside both the GETELEM and the SETELEM. This is done by + // emit(Super)ElemOperands. + if (isSuper) { + if (!emitSuperElemOperands(pn->pn_kid, EmitElemOption::IncDec)) + return false; + } else { + if (!emitElemOperands(pn->pn_kid, EmitElemOption::IncDec)) + return false; + } + + bool post; + JSOp binop = GetIncDecInfo(pn->getKind(), &post); + + JSOp getOp; + if (isSuper) { + // There's no such thing as JSOP_DUP3, so we have to be creative. + // Note that pushing things again is no fewer JSOps. + if (!emitDupAt(2)) // KEY THIS OBJ KEY + return false; + if (!emitDupAt(2)) // KEY THIS OBJ KEY THIS + return false; + if (!emitDupAt(2)) // KEY THIS OBJ KEY THIS OBJ + return false; + getOp = JSOP_GETELEM_SUPER; + } else { + // OBJ KEY + if (!emit1(JSOP_DUP2)) // OBJ KEY OBJ KEY + return false; + getOp = JSOP_GETELEM; + } + if (!emitElemOpBase(getOp)) // OBJ KEY V + return false; + if (!emit1(JSOP_POS)) // OBJ KEY N + return false; + if (post && !emit1(JSOP_DUP)) // OBJ KEY N? N + return false; + if (!emit1(JSOP_ONE)) // OBJ KEY N? N 1 + return false; + if (!emit1(binop)) // OBJ KEY N? N+1 + return false; + + if (post) { + if (isSuper) { + // We have one more value to rotate around, because of |this| + // on the stack + if (!emit2(JSOP_PICK, 4)) + return false; + } + if (!emit2(JSOP_PICK, 3 + isSuper)) // KEY N N+1 OBJ + return false; + if (!emit2(JSOP_PICK, 3 + isSuper)) // N N+1 OBJ KEY + return false; + if (!emit2(JSOP_PICK, 2 + isSuper)) // N OBJ KEY N+1 + return false; + } + + JSOp setOp = isSuper ? (sc->strict() ? JSOP_STRICTSETELEM_SUPER : JSOP_SETELEM_SUPER) + : (sc->strict() ? JSOP_STRICTSETELEM : JSOP_SETELEM); + if (!emitElemOpBase(setOp)) // N? N+1 + return false; + if (post && !emit1(JSOP_POP)) // RESULT + return false; + + return true; +} + +bool +BytecodeEmitter::emitCallIncDec(ParseNode* incDec) +{ + MOZ_ASSERT(incDec->isKind(PNK_PREINCREMENT) || + incDec->isKind(PNK_POSTINCREMENT) || + incDec->isKind(PNK_PREDECREMENT) || + incDec->isKind(PNK_POSTDECREMENT)); + + MOZ_ASSERT(incDec->pn_kid->isKind(PNK_CALL)); + + ParseNode* call = incDec->pn_kid; + if (!emitTree(call)) // CALLRESULT + return false; + if (!emit1(JSOP_POS)) // N + return false; + + // The increment/decrement has no side effects, so proceed to throw for + // invalid assignment target. + return emitUint16Operand(JSOP_THROWMSG, JSMSG_BAD_LEFTSIDE_OF_ASS); +} + +bool +BytecodeEmitter::emitNumberOp(double dval) +{ + int32_t ival; + if (NumberIsInt32(dval, &ival)) { + if (ival == 0) + return emit1(JSOP_ZERO); + if (ival == 1) + return emit1(JSOP_ONE); + if ((int)(int8_t)ival == ival) + return emit2(JSOP_INT8, uint8_t(int8_t(ival))); + + uint32_t u = uint32_t(ival); + if (u < JS_BIT(16)) { + if (!emitUint16Operand(JSOP_UINT16, u)) + return false; + } else if (u < JS_BIT(24)) { + ptrdiff_t off; + if (!emitN(JSOP_UINT24, 3, &off)) + return false; + SET_UINT24(code(off), u); + } else { + ptrdiff_t off; + if (!emitN(JSOP_INT32, 4, &off)) + return false; + SET_INT32(code(off), ival); + } + return true; + } + + if (!constList.append(DoubleValue(dval))) + return false; + + return emitIndex32(JSOP_DOUBLE, constList.length() - 1); +} + +/* + * Using MOZ_NEVER_INLINE in here is a workaround for llvm.org/pr14047. + * LLVM is deciding to inline this function which uses a lot of stack space + * into emitTree which is recursive and uses relatively little stack space. + */ +MOZ_NEVER_INLINE bool +BytecodeEmitter::emitSwitch(ParseNode* pn) +{ + ParseNode* cases = pn->pn_right; + MOZ_ASSERT(cases->isKind(PNK_LEXICALSCOPE) || cases->isKind(PNK_STATEMENTLIST)); + + // Emit code for the discriminant. + if (!emitTree(pn->pn_left)) + return false; + + // Enter the scope before pushing the switch BreakableControl since all + // breaks are under this scope. + Maybe<TDZCheckCache> tdzCache; + Maybe<EmitterScope> emitterScope; + if (cases->isKind(PNK_LEXICALSCOPE)) { + if (!cases->isEmptyScope()) { + tdzCache.emplace(this); + emitterScope.emplace(this); + if (!emitterScope->enterLexical(this, ScopeKind::Lexical, cases->scopeBindings())) + return false; + } + + // Advance |cases| to refer to the switch case list. + cases = cases->scopeBody(); + + // A switch statement may contain hoisted functions inside its + // cases. The PNX_FUNCDEFS flag is propagated from the STATEMENTLIST + // bodies of the cases to the case list. + if (cases->pn_xflags & PNX_FUNCDEFS) { + MOZ_ASSERT(emitterScope); + for (ParseNode* caseNode = cases->pn_head; caseNode; caseNode = caseNode->pn_next) { + if (caseNode->pn_right->pn_xflags & PNX_FUNCDEFS) { + if (!emitHoistedFunctionsInList(caseNode->pn_right)) + return false; + } + } + } + } + + // After entering the scope, push the switch control. + BreakableControl controlInfo(this, StatementKind::Switch); + + ptrdiff_t top = offset(); + + // Switch bytecodes run from here till end of final case. + uint32_t caseCount = cases->pn_count; + if (caseCount > JS_BIT(16)) { + parser->tokenStream.reportError(JSMSG_TOO_MANY_CASES); + return false; + } + + // Try for most optimal, fall back if not dense ints. + JSOp switchOp = JSOP_TABLESWITCH; + uint32_t tableLength = 0; + int32_t low, high; + bool hasDefault = false; + CaseClause* firstCase = cases->pn_head ? &cases->pn_head->as<CaseClause>() : nullptr; + if (caseCount == 0 || + (caseCount == 1 && (hasDefault = firstCase->isDefault()))) + { + caseCount = 0; + low = 0; + high = -1; + } else { + Vector<jsbitmap, 128, SystemAllocPolicy> intmap; + int32_t intmapBitLength = 0; + + low = JSVAL_INT_MAX; + high = JSVAL_INT_MIN; + + for (CaseClause* caseNode = firstCase; caseNode; caseNode = caseNode->next()) { + if (caseNode->isDefault()) { + hasDefault = true; + caseCount--; // one of the "cases" was the default + continue; + } + + if (switchOp == JSOP_CONDSWITCH) + continue; + + MOZ_ASSERT(switchOp == JSOP_TABLESWITCH); + + ParseNode* caseValue = caseNode->caseExpression(); + + if (caseValue->getKind() != PNK_NUMBER) { + switchOp = JSOP_CONDSWITCH; + continue; + } + + int32_t i; + if (!NumberIsInt32(caseValue->pn_dval, &i)) { + switchOp = JSOP_CONDSWITCH; + continue; + } + + if (unsigned(i + int(JS_BIT(15))) >= unsigned(JS_BIT(16))) { + switchOp = JSOP_CONDSWITCH; + continue; + } + if (i < low) + low = i; + if (i > high) + high = i; + + // Check for duplicates, which require a JSOP_CONDSWITCH. + // We bias i by 65536 if it's negative, and hope that's a rare + // case (because it requires a malloc'd bitmap). + if (i < 0) + i += JS_BIT(16); + if (i >= intmapBitLength) { + size_t newLength = (i / JS_BITMAP_NBITS) + 1; + if (!intmap.resize(newLength)) + return false; + intmapBitLength = newLength * JS_BITMAP_NBITS; + } + if (JS_TEST_BIT(intmap, i)) { + switchOp = JSOP_CONDSWITCH; + continue; + } + JS_SET_BIT(intmap, i); + } + + // Compute table length and select condswitch instead if overlarge or + // more than half-sparse. + if (switchOp == JSOP_TABLESWITCH) { + tableLength = uint32_t(high - low + 1); + if (tableLength >= JS_BIT(16) || tableLength > 2 * caseCount) + switchOp = JSOP_CONDSWITCH; + } + } + + // The note has one or two offsets: first tells total switch code length; + // second (if condswitch) tells offset to first JSOP_CASE. + unsigned noteIndex; + size_t switchSize; + if (switchOp == JSOP_CONDSWITCH) { + // 0 bytes of immediate for unoptimized switch. + switchSize = 0; + if (!newSrcNote3(SRC_CONDSWITCH, 0, 0, ¬eIndex)) + return false; + } else { + MOZ_ASSERT(switchOp == JSOP_TABLESWITCH); + + // 3 offsets (len, low, high) before the table, 1 per entry. + switchSize = size_t(JUMP_OFFSET_LEN * (3 + tableLength)); + if (!newSrcNote2(SRC_TABLESWITCH, 0, ¬eIndex)) + return false; + } + + // Emit switchOp followed by switchSize bytes of jump or lookup table. + MOZ_ASSERT(top == offset()); + if (!emitN(switchOp, switchSize)) + return false; + + Vector<CaseClause*, 32, SystemAllocPolicy> table; + + JumpList condSwitchDefaultOff; + if (switchOp == JSOP_CONDSWITCH) { + unsigned caseNoteIndex; + bool beforeCases = true; + ptrdiff_t lastCaseOffset = -1; + + // The case conditions need their own TDZ cache since they might not + // all execute. + TDZCheckCache tdzCache(this); + + // Emit code for evaluating cases and jumping to case statements. + for (CaseClause* caseNode = firstCase; caseNode; caseNode = caseNode->next()) { + ParseNode* caseValue = caseNode->caseExpression(); + + // If the expression is a literal, suppress line number emission so + // that debugging works more naturally. + if (caseValue) { + if (!emitTree(caseValue, + caseValue->isLiteral() ? SUPPRESS_LINENOTE : EMIT_LINENOTE)) + { + return false; + } + } + + if (!beforeCases) { + // prevCase is the previous JSOP_CASE's bytecode offset. + if (!setSrcNoteOffset(caseNoteIndex, 0, offset() - lastCaseOffset)) + return false; + } + if (!caseValue) { + // This is the default clause. + continue; + } + + if (!newSrcNote2(SRC_NEXTCASE, 0, &caseNoteIndex)) + return false; + + // The case clauses are produced before any of the case body. The + // JumpList is saved on the parsed tree, then later restored and + // patched when generating the cases body. + JumpList caseJump; + if (!emitJump(JSOP_CASE, &caseJump)) + return false; + caseNode->setOffset(caseJump.offset); + lastCaseOffset = caseJump.offset; + + if (beforeCases) { + // Switch note's second offset is to first JSOP_CASE. + unsigned noteCount = notes().length(); + if (!setSrcNoteOffset(noteIndex, 1, lastCaseOffset - top)) + return false; + unsigned noteCountDelta = notes().length() - noteCount; + if (noteCountDelta != 0) + caseNoteIndex += noteCountDelta; + beforeCases = false; + } + } + + // If we didn't have an explicit default (which could fall in between + // cases, preventing us from fusing this setSrcNoteOffset with the call + // in the loop above), link the last case to the implicit default for + // the benefit of IonBuilder. + if (!hasDefault && + !beforeCases && + !setSrcNoteOffset(caseNoteIndex, 0, offset() - lastCaseOffset)) + { + return false; + } + + // Emit default even if no explicit default statement. + if (!emitJump(JSOP_DEFAULT, &condSwitchDefaultOff)) + return false; + } else { + MOZ_ASSERT(switchOp == JSOP_TABLESWITCH); + + // skip default offset. + jsbytecode* pc = code(top + JUMP_OFFSET_LEN); + + // Fill in switch bounds, which we know fit in 16-bit offsets. + SET_JUMP_OFFSET(pc, low); + pc += JUMP_OFFSET_LEN; + SET_JUMP_OFFSET(pc, high); + pc += JUMP_OFFSET_LEN; + + if (tableLength != 0) { + if (!table.growBy(tableLength)) + return false; + + for (CaseClause* caseNode = firstCase; caseNode; caseNode = caseNode->next()) { + if (ParseNode* caseValue = caseNode->caseExpression()) { + MOZ_ASSERT(caseValue->isKind(PNK_NUMBER)); + + int32_t i = int32_t(caseValue->pn_dval); + MOZ_ASSERT(double(i) == caseValue->pn_dval); + + i -= low; + MOZ_ASSERT(uint32_t(i) < tableLength); + MOZ_ASSERT(!table[i]); + table[i] = caseNode; + } + } + } + } + + JumpTarget defaultOffset{ -1 }; + + // Emit code for each case's statements. + for (CaseClause* caseNode = firstCase; caseNode; caseNode = caseNode->next()) { + if (switchOp == JSOP_CONDSWITCH && !caseNode->isDefault()) { + // The case offset got saved in the caseNode structure after + // emitting the JSOP_CASE jump instruction above. + JumpList caseCond; + caseCond.offset = caseNode->offset(); + if (!emitJumpTargetAndPatch(caseCond)) + return false; + } + + JumpTarget here; + if (!emitJumpTarget(&here)) + return false; + if (caseNode->isDefault()) + defaultOffset = here; + + // If this is emitted as a TABLESWITCH, we'll need to know this case's + // offset later when emitting the table. Store it in the node's + // pn_offset (giving the field a different meaning vs. how we used it + // on the immediately preceding line of code). + caseNode->setOffset(here.offset); + + TDZCheckCache tdzCache(this); + + if (!emitTree(caseNode->statementList())) + return false; + } + + if (!hasDefault) { + // If no default case, offset for default is to end of switch. + if (!emitJumpTarget(&defaultOffset)) + return false; + } + MOZ_ASSERT(defaultOffset.offset != -1); + + // Set the default offset (to end of switch if no default). + jsbytecode* pc; + if (switchOp == JSOP_CONDSWITCH) { + pc = nullptr; + patchJumpsToTarget(condSwitchDefaultOff, defaultOffset); + } else { + MOZ_ASSERT(switchOp == JSOP_TABLESWITCH); + pc = code(top); + SET_JUMP_OFFSET(pc, defaultOffset.offset - top); + pc += JUMP_OFFSET_LEN; + } + + // Set the SRC_SWITCH note's offset operand to tell end of switch. + if (!setSrcNoteOffset(noteIndex, 0, lastNonJumpTargetOffset() - top)) + return false; + + if (switchOp == JSOP_TABLESWITCH) { + // Skip over the already-initialized switch bounds. + pc += 2 * JUMP_OFFSET_LEN; + + // Fill in the jump table, if there is one. + for (uint32_t i = 0; i < tableLength; i++) { + CaseClause* caseNode = table[i]; + ptrdiff_t off = caseNode ? caseNode->offset() - top : 0; + SET_JUMP_OFFSET(pc, off); + pc += JUMP_OFFSET_LEN; + } + } + + // Patch breaks before leaving the scope, as all breaks are under the + // lexical scope if it exists. + if (!controlInfo.patchBreaks(this)) + return false; + + if (emitterScope && !emitterScope->leave(this)) + return false; + + return true; +} + +bool +BytecodeEmitter::isRunOnceLambda() +{ + // The run once lambda flags set by the parser are approximate, and we look + // at properties of the function itself before deciding to emit a function + // as a run once lambda. + + if (!(parent && parent->emittingRunOnceLambda) && + (emitterMode != LazyFunction || !lazyScript->treatAsRunOnce())) + { + return false; + } + + FunctionBox* funbox = sc->asFunctionBox(); + return !funbox->argumentsHasLocalBinding() && + !funbox->isGenerator() && + !funbox->function()->name(); +} + +bool +BytecodeEmitter::emitYieldOp(JSOp op) +{ + if (op == JSOP_FINALYIELDRVAL) + return emit1(JSOP_FINALYIELDRVAL); + + MOZ_ASSERT(op == JSOP_INITIALYIELD || op == JSOP_YIELD); + + ptrdiff_t off; + if (!emitN(op, 3, &off)) + return false; + + uint32_t yieldIndex = yieldOffsetList.length(); + if (yieldIndex >= JS_BIT(24)) { + reportError(nullptr, JSMSG_TOO_MANY_YIELDS); + return false; + } + + SET_UINT24(code(off), yieldIndex); + + if (!yieldOffsetList.append(offset())) + return false; + + return emit1(JSOP_DEBUGAFTERYIELD); +} + +bool +BytecodeEmitter::emitSetThis(ParseNode* pn) +{ + // PNK_SETTHIS is used to update |this| after a super() call in a derived + // class constructor. + + MOZ_ASSERT(pn->isKind(PNK_SETTHIS)); + MOZ_ASSERT(pn->pn_left->isKind(PNK_NAME)); + + RootedAtom name(cx, pn->pn_left->name()); + auto emitRhs = [&name, pn](BytecodeEmitter* bce, const NameLocation&, bool) { + // Emit the new |this| value. + if (!bce->emitTree(pn->pn_right)) + return false; + // Get the original |this| and throw if we already initialized + // it. Do *not* use the NameLocation argument, as that's the special + // lexical location below to deal with super() semantics. + if (!bce->emitGetName(name)) + return false; + if (!bce->emit1(JSOP_CHECKTHISREINIT)) + return false; + if (!bce->emit1(JSOP_POP)) + return false; + return true; + }; + + // The 'this' binding is not lexical, but due to super() semantics this + // initialization needs to be treated as a lexical one. + NameLocation loc = lookupName(name); + NameLocation lexicalLoc; + if (loc.kind() == NameLocation::Kind::FrameSlot) { + lexicalLoc = NameLocation::FrameSlot(BindingKind::Let, loc.frameSlot()); + } else if (loc.kind() == NameLocation::Kind::EnvironmentCoordinate) { + EnvironmentCoordinate coord = loc.environmentCoordinate(); + uint8_t hops = AssertedCast<uint8_t>(coord.hops()); + lexicalLoc = NameLocation::EnvironmentCoordinate(BindingKind::Let, hops, coord.slot()); + } else { + MOZ_ASSERT(loc.kind() == NameLocation::Kind::Dynamic); + lexicalLoc = loc; + } + + return emitSetOrInitializeNameAtLocation(name, lexicalLoc, emitRhs, true); +} + +bool +BytecodeEmitter::emitScript(ParseNode* body) +{ + TDZCheckCache tdzCache(this); + EmitterScope emitterScope(this); + if (sc->isGlobalContext()) { + switchToPrologue(); + if (!emitterScope.enterGlobal(this, sc->asGlobalContext())) + return false; + switchToMain(); + } else if (sc->isEvalContext()) { + switchToPrologue(); + if (!emitterScope.enterEval(this, sc->asEvalContext())) + return false; + switchToMain(); + } else { + MOZ_ASSERT(sc->isModuleContext()); + if (!emitterScope.enterModule(this, sc->asModuleContext())) + return false; + } + + setFunctionBodyEndPos(body->pn_pos); + + if (sc->isEvalContext() && !sc->strict() && + body->isKind(PNK_LEXICALSCOPE) && !body->isEmptyScope()) + { + // Sloppy eval scripts may need to emit DEFFUNs in the prologue. If there is + // an immediately enclosed lexical scope, we need to enter the lexical + // scope in the prologue for the DEFFUNs to pick up the right + // environment chain. + EmitterScope lexicalEmitterScope(this); + + switchToPrologue(); + if (!lexicalEmitterScope.enterLexical(this, ScopeKind::Lexical, body->scopeBindings())) + return false; + switchToMain(); + + if (!emitLexicalScopeBody(body->scopeBody())) + return false; + + if (!lexicalEmitterScope.leave(this)) + return false; + } else { + if (!emitTree(body)) + return false; + } + + if (!emit1(JSOP_RETRVAL)) + return false; + + if (!emitterScope.leave(this)) + return false; + + if (!JSScript::fullyInitFromEmitter(cx, script, this)) + return false; + + // URL and source map information must be set before firing + // Debugger::onNewScript. + if (!maybeSetDisplayURL() || !maybeSetSourceMap()) + return false; + + tellDebuggerAboutCompiledScript(cx); + + return true; +} + +bool +BytecodeEmitter::emitFunctionScript(ParseNode* body) +{ + FunctionBox* funbox = sc->asFunctionBox(); + + // The ordering of these EmitterScopes is important. The named lambda + // scope needs to enclose the function scope needs to enclose the extra + // var scope. + + Maybe<EmitterScope> namedLambdaEmitterScope; + if (funbox->namedLambdaBindings()) { + namedLambdaEmitterScope.emplace(this); + if (!namedLambdaEmitterScope->enterNamedLambda(this, funbox)) + return false; + } + + /* + * Emit a prologue for run-once scripts which will deoptimize JIT code + * if the script ends up running multiple times via foo.caller related + * shenanigans. + * + * Also mark the script so that initializers created within it may be + * given more precise types. + */ + if (isRunOnceLambda()) { + script->setTreatAsRunOnce(); + MOZ_ASSERT(!script->hasRunOnce()); + + switchToPrologue(); + if (!emit1(JSOP_RUNONCE)) + return false; + switchToMain(); + } + + setFunctionBodyEndPos(body->pn_pos); + if (!emitTree(body)) + return false; + + if (!updateSourceCoordNotes(body->pn_pos.end)) + return false; + + // Always end the script with a JSOP_RETRVAL. Some other parts of the + // codebase depend on this opcode, + // e.g. InterpreterRegs::setToEndOfScript. + if (!emit1(JSOP_RETRVAL)) + return false; + + if (namedLambdaEmitterScope) { + if (!namedLambdaEmitterScope->leave(this)) + return false; + namedLambdaEmitterScope.reset(); + } + + if (!JSScript::fullyInitFromEmitter(cx, script, this)) + return false; + + // URL and source map information must be set before firing + // Debugger::onNewScript. Only top-level functions need this, as compiling + // the outer scripts of nested functions already processed the source. + if (emitterMode != LazyFunction && !parent) { + if (!maybeSetDisplayURL() || !maybeSetSourceMap()) + return false; + + tellDebuggerAboutCompiledScript(cx); + } + + return true; +} + +template <typename NameEmitter> +bool +BytecodeEmitter::emitDestructuringDeclsWithEmitter(ParseNode* pattern, NameEmitter emitName) +{ + if (pattern->isKind(PNK_ARRAY)) { + for (ParseNode* element = pattern->pn_head; element; element = element->pn_next) { + if (element->isKind(PNK_ELISION)) + continue; + ParseNode* target = element; + if (element->isKind(PNK_SPREAD)) { + target = element->pn_kid; + } + if (target->isKind(PNK_ASSIGN)) + target = target->pn_left; + if (target->isKind(PNK_NAME)) { + if (!emitName(this, target)) + return false; + } else { + if (!emitDestructuringDeclsWithEmitter(target, emitName)) + return false; + } + } + return true; + } + + MOZ_ASSERT(pattern->isKind(PNK_OBJECT)); + for (ParseNode* member = pattern->pn_head; member; member = member->pn_next) { + MOZ_ASSERT(member->isKind(PNK_MUTATEPROTO) || + member->isKind(PNK_COLON) || + member->isKind(PNK_SHORTHAND)); + + ParseNode* target = member->isKind(PNK_MUTATEPROTO) ? member->pn_kid : member->pn_right; + + if (target->isKind(PNK_ASSIGN)) + target = target->pn_left; + if (target->isKind(PNK_NAME)) { + if (!emitName(this, target)) + return false; + } else { + if (!emitDestructuringDeclsWithEmitter(target, emitName)) + return false; + } + } + return true; +} + +bool +BytecodeEmitter::emitDestructuringLHS(ParseNode* target, DestructuringFlavor flav) +{ + // Now emit the lvalue opcode sequence. If the lvalue is a nested + // destructuring initialiser-form, call ourselves to handle it, then pop + // the matched value. Otherwise emit an lvalue bytecode sequence followed + // by an assignment op. + if (target->isKind(PNK_SPREAD)) + target = target->pn_kid; + else if (target->isKind(PNK_ASSIGN)) + target = target->pn_left; + if (target->isKind(PNK_ARRAY) || target->isKind(PNK_OBJECT)) { + if (!emitDestructuringOps(target, flav)) + return false; + // Per its post-condition, emitDestructuringOps has left the + // to-be-destructured value on top of the stack. + if (!emit1(JSOP_POP)) + return false; + } else { + switch (target->getKind()) { + case PNK_NAME: { + auto emitSwapScopeAndRhs = [](BytecodeEmitter* bce, const NameLocation&, + bool emittedBindOp) + { + if (emittedBindOp) { + // This is like ordinary assignment, but with one + // difference. + // + // In `a = b`, we first determine a binding for `a` (using + // JSOP_BINDNAME or JSOP_BINDGNAME), then we evaluate `b`, + // then a JSOP_SETNAME instruction. + // + // In `[a] = [b]`, per spec, `b` is evaluated first, then + // we determine a binding for `a`. Then we need to do + // assignment-- but the operands are on the stack in the + // wrong order for JSOP_SETPROP, so we have to add a + // JSOP_SWAP. + // + // In the cases where we are emitting a name op, emit a + // swap because of this. + return bce->emit1(JSOP_SWAP); + } + + // In cases of emitting a frame slot or environment slot, + // nothing needs be done. + return true; + }; + + RootedAtom name(cx, target->name()); + switch (flav) { + case DestructuringDeclaration: + if (!emitInitializeName(name, emitSwapScopeAndRhs)) + return false; + break; + + case DestructuringFormalParameterInVarScope: { + // If there's an parameter expression var scope, the + // destructuring declaration needs to initialize the name in + // the function scope. The innermost scope is the var scope, + // and its enclosing scope is the function scope. + EmitterScope* funScope = innermostEmitterScope->enclosingInFrame(); + NameLocation paramLoc = *locationOfNameBoundInScope(name, funScope); + if (!emitSetOrInitializeNameAtLocation(name, paramLoc, emitSwapScopeAndRhs, true)) + return false; + break; + } + + case DestructuringAssignment: + if (!emitSetName(name, emitSwapScopeAndRhs)) + return false; + break; + } + + break; + } + + case PNK_DOT: { + // See the (PNK_NAME, JSOP_SETNAME) case above. + // + // In `a.x = b`, `a` is evaluated first, then `b`, then a + // JSOP_SETPROP instruction. + // + // In `[a.x] = [b]`, per spec, `b` is evaluated before `a`. Then we + // need a property set -- but the operands are on the stack in the + // wrong order for JSOP_SETPROP, so we have to add a JSOP_SWAP. + JSOp setOp; + if (target->as<PropertyAccess>().isSuper()) { + if (!emitSuperPropLHS(&target->as<PropertyAccess>().expression())) + return false; + if (!emit2(JSOP_PICK, 2)) + return false; + setOp = sc->strict() ? JSOP_STRICTSETPROP_SUPER : JSOP_SETPROP_SUPER; + } else { + if (!emitTree(target->pn_expr)) + return false; + if (!emit1(JSOP_SWAP)) + return false; + setOp = sc->strict() ? JSOP_STRICTSETPROP : JSOP_SETPROP; + } + if (!emitAtomOp(target, setOp)) + return false; + break; + } + + case PNK_ELEM: { + // See the comment at `case PNK_DOT:` above. This case, + // `[a[x]] = [b]`, is handled much the same way. The JSOP_SWAP + // is emitted by emitElemOperands. + if (target->as<PropertyByValue>().isSuper()) { + JSOp setOp = sc->strict() ? JSOP_STRICTSETELEM_SUPER : JSOP_SETELEM_SUPER; + if (!emitSuperElemOp(target, setOp)) + return false; + } else { + JSOp setOp = sc->strict() ? JSOP_STRICTSETELEM : JSOP_SETELEM; + if (!emitElemOp(target, setOp)) + return false; + } + break; + } + + case PNK_CALL: + MOZ_ASSERT_UNREACHABLE("Parser::reportIfNotValidSimpleAssignmentTarget " + "rejects function calls as assignment " + "targets in destructuring assignments"); + break; + + default: + MOZ_CRASH("emitDestructuringLHS: bad lhs kind"); + } + + // Pop the assigned value. + if (!emit1(JSOP_POP)) + return false; + } + + return true; +} + +bool +BytecodeEmitter::emitConditionallyExecutedDestructuringLHS(ParseNode* target, DestructuringFlavor flav) +{ + TDZCheckCache tdzCache(this); + return emitDestructuringLHS(target, flav); +} + +bool +BytecodeEmitter::emitIteratorNext(ParseNode* pn, bool allowSelfHosted) +{ + MOZ_ASSERT(allowSelfHosted || emitterMode != BytecodeEmitter::SelfHosting, + ".next() iteration is prohibited in self-hosted code because it " + "can run user-modifiable iteration code"); + + if (!emit1(JSOP_DUP)) // ... ITER ITER + return false; + if (!emitAtomOp(cx->names().next, JSOP_CALLPROP)) // ... ITER NEXT + return false; + if (!emit1(JSOP_SWAP)) // ... NEXT ITER + return false; + if (!emitCall(JSOP_CALL, 0, pn)) // ... RESULT + return false; + if (!emitCheckIsObj(CheckIsObjectKind::IteratorNext)) // ... RESULT + return false; + checkTypeSet(JSOP_CALL); + return true; +} + +bool +BytecodeEmitter::emitDefault(ParseNode* defaultExpr) +{ + if (!emit1(JSOP_DUP)) // VALUE VALUE + return false; + if (!emit1(JSOP_UNDEFINED)) // VALUE VALUE UNDEFINED + return false; + if (!emit1(JSOP_STRICTEQ)) // VALUE EQL? + return false; + // Emit source note to enable ion compilation. + if (!newSrcNote(SRC_IF)) + return false; + JumpList jump; + if (!emitJump(JSOP_IFEQ, &jump)) // VALUE + return false; + if (!emit1(JSOP_POP)) // . + return false; + if (!emitConditionallyExecutedTree(defaultExpr)) // DEFAULTVALUE + return false; + if (!emitJumpTargetAndPatch(jump)) + return false; + return true; +} + +class MOZ_STACK_CLASS IfThenElseEmitter +{ + BytecodeEmitter* bce_; + JumpList jumpAroundThen_; + JumpList jumpsAroundElse_; + unsigned noteIndex_; + int32_t thenDepth_; +#ifdef DEBUG + int32_t pushed_; + bool calculatedPushed_; +#endif + enum State { + Start, + If, + Cond, + IfElse, + Else, + End + }; + State state_; + + public: + explicit IfThenElseEmitter(BytecodeEmitter* bce) + : bce_(bce), + noteIndex_(-1), + thenDepth_(0), +#ifdef DEBUG + pushed_(0), + calculatedPushed_(false), +#endif + state_(Start) + {} + + ~IfThenElseEmitter() + {} + + private: + bool emitIf(State nextState) { + MOZ_ASSERT(state_ == Start || state_ == Else); + MOZ_ASSERT(nextState == If || nextState == IfElse || nextState == Cond); + + // Clear jumpAroundThen_ offset that points previous JSOP_IFEQ. + if (state_ == Else) + jumpAroundThen_ = JumpList(); + + // Emit an annotated branch-if-false around the then part. + SrcNoteType type = nextState == If ? SRC_IF : nextState == IfElse ? SRC_IF_ELSE : SRC_COND; + if (!bce_->newSrcNote(type, ¬eIndex_)) + return false; + if (!bce_->emitJump(JSOP_IFEQ, &jumpAroundThen_)) + return false; + + // To restore stack depth in else part, save depth of the then part. +#ifdef DEBUG + // If DEBUG, this is also necessary to calculate |pushed_|. + thenDepth_ = bce_->stackDepth; +#else + if (nextState == IfElse || nextState == Cond) + thenDepth_ = bce_->stackDepth; +#endif + state_ = nextState; + return true; + } + + public: + bool emitIf() { + return emitIf(If); + } + + bool emitCond() { + return emitIf(Cond); + } + + bool emitIfElse() { + return emitIf(IfElse); + } + + bool emitElse() { + MOZ_ASSERT(state_ == IfElse || state_ == Cond); + + calculateOrCheckPushed(); + + // Emit a jump from the end of our then part around the else part. The + // patchJumpsToTarget call at the bottom of this function will fix up + // the offset with jumpsAroundElse value. + if (!bce_->emitJump(JSOP_GOTO, &jumpsAroundElse_)) + return false; + + // Ensure the branch-if-false comes here, then emit the else. + if (!bce_->emitJumpTargetAndPatch(jumpAroundThen_)) + return false; + + // Annotate SRC_IF_ELSE or SRC_COND with the offset from branch to + // jump, for IonMonkey's benefit. We can't just "back up" from the pc + // of the else clause, because we don't know whether an extended + // jump was required to leap from the end of the then clause over + // the else clause. + if (!bce_->setSrcNoteOffset(noteIndex_, 0, + jumpsAroundElse_.offset - jumpAroundThen_.offset)) + { + return false; + } + + // Restore stack depth of the then part. + bce_->stackDepth = thenDepth_; + state_ = Else; + return true; + } + + bool emitEnd() { + MOZ_ASSERT(state_ == If || state_ == Else); + + calculateOrCheckPushed(); + + if (state_ == If) { + // No else part, fixup the branch-if-false to come here. + if (!bce_->emitJumpTargetAndPatch(jumpAroundThen_)) + return false; + } + + // Patch all the jumps around else parts. + if (!bce_->emitJumpTargetAndPatch(jumpsAroundElse_)) + return false; + + state_ = End; + return true; + } + + void calculateOrCheckPushed() { +#ifdef DEBUG + if (!calculatedPushed_) { + pushed_ = bce_->stackDepth - thenDepth_; + calculatedPushed_ = true; + } else { + MOZ_ASSERT(pushed_ == bce_->stackDepth - thenDepth_); + } +#endif + } + +#ifdef DEBUG + int32_t pushed() const { + return pushed_; + } + + int32_t popped() const { + return -pushed_; + } +#endif +}; + +bool +BytecodeEmitter::emitDestructuringOpsArray(ParseNode* pattern, DestructuringFlavor flav) +{ + MOZ_ASSERT(pattern->isKind(PNK_ARRAY)); + MOZ_ASSERT(pattern->isArity(PN_LIST)); + MOZ_ASSERT(this->stackDepth != 0); + + // Here's pseudo code for |let [a, b, , c=y, ...d] = x;| + // + // let x, y; + // let a, b, c, d; + // let tmp, done, iter, result; // stack values + // + // iter = x[Symbol.iterator](); + // + // // ==== emitted by loop for a ==== + // result = iter.next(); + // done = result.done; + // + // if (done) { + // a = undefined; + // + // result = undefined; + // done = true; + // } else { + // a = result.value; + // + // // Do next element's .next() and .done access here + // result = iter.next(); + // done = result.done; + // } + // + // // ==== emitted by loop for b ==== + // if (done) { + // b = undefined; + // + // result = undefined; + // done = true; + // } else { + // b = result.value; + // + // result = iter.next(); + // done = result.done; + // } + // + // // ==== emitted by loop for elision ==== + // if (done) { + // result = undefined + // done = true + // } else { + // result.value; + // + // result = iter.next(); + // done = result.done; + // } + // + // // ==== emitted by loop for c ==== + // if (done) { + // c = y; + // } else { + // tmp = result.value; + // if (tmp === undefined) + // tmp = y; + // c = tmp; + // + // // Don't do next element's .next() and .done access if + // // this is the last non-spread element. + // } + // + // // ==== emitted by loop for d ==== + // if (done) { + // // Assing empty array when completed + // d = []; + // } else { + // d = [...iter]; + // } + + /* + * Use an iterator to destructure the RHS, instead of index lookup. We + * must leave the *original* value on the stack. + */ + if (!emit1(JSOP_DUP)) // ... OBJ OBJ + return false; + if (!emitIterator()) // ... OBJ? ITER + return false; + bool needToPopIterator = true; + + for (ParseNode* member = pattern->pn_head; member; member = member->pn_next) { + bool isHead = member == pattern->pn_head; + if (member->isKind(PNK_SPREAD)) { + IfThenElseEmitter ifThenElse(this); + if (!isHead) { + // If spread is not the first element of the pattern, + // iterator can already be completed. + if (!ifThenElse.emitIfElse()) // ... OBJ? ITER + return false; + + if (!emit1(JSOP_POP)) // ... OBJ? + return false; + if (!emitUint32Operand(JSOP_NEWARRAY, 0)) // ... OBJ? ARRAY + return false; + if (!emitConditionallyExecutedDestructuringLHS(member, flav)) // ... OBJ? + return false; + + if (!ifThenElse.emitElse()) // ... OBJ? ITER + return false; + } + + // If iterator is not completed, create a new array with the rest + // of the iterator. + if (!emitUint32Operand(JSOP_NEWARRAY, 0)) // ... OBJ? ITER ARRAY + return false; + if (!emitNumberOp(0)) // ... OBJ? ITER ARRAY INDEX + return false; + if (!emitSpread()) // ... OBJ? ARRAY INDEX + return false; + if (!emit1(JSOP_POP)) // ... OBJ? ARRAY + return false; + if (!emitConditionallyExecutedDestructuringLHS(member, flav)) // ... OBJ? + return false; + + if (!isHead) { + if (!ifThenElse.emitEnd()) + return false; + MOZ_ASSERT(ifThenElse.popped() == 1); + } + needToPopIterator = false; + MOZ_ASSERT(!member->pn_next); + break; + } + + ParseNode* pndefault = nullptr; + ParseNode* subpattern = member; + if (subpattern->isKind(PNK_ASSIGN)) { + pndefault = subpattern->pn_right; + subpattern = subpattern->pn_left; + } + + bool isElision = subpattern->isKind(PNK_ELISION); + bool hasNextNonSpread = member->pn_next && !member->pn_next->isKind(PNK_SPREAD); + bool hasNextSpread = member->pn_next && member->pn_next->isKind(PNK_SPREAD); + + MOZ_ASSERT(!subpattern->isKind(PNK_SPREAD)); + + auto emitNext = [pattern](ExclusiveContext* cx, BytecodeEmitter* bce) { + if (!bce->emit1(JSOP_DUP)) // ... OBJ? ITER ITER + return false; + if (!bce->emitIteratorNext(pattern)) // ... OBJ? ITER RESULT + return false; + if (!bce->emit1(JSOP_DUP)) // ... OBJ? ITER RESULT RESULT + return false; + if (!bce->emitAtomOp(cx->names().done, JSOP_GETPROP)) // ... OBJ? ITER RESULT DONE? + return false; + return true; + }; + + if (isHead) { + if (!emitNext(cx, this)) // ... OBJ? ITER RESULT DONE? + return false; + } + + IfThenElseEmitter ifThenElse(this); + if (!ifThenElse.emitIfElse()) // ... OBJ? ITER RESULT + return false; + + if (!emit1(JSOP_POP)) // ... OBJ? ITER + return false; + if (pndefault) { + // Emit only pndefault tree here, as undefined check in emitDefault + // should always be true. + if (!emitConditionallyExecutedTree(pndefault)) // ... OBJ? ITER VALUE + return false; + } else { + if (!isElision) { + if (!emit1(JSOP_UNDEFINED)) // ... OBJ? ITER UNDEFINED + return false; + if (!emit1(JSOP_NOP_DESTRUCTURING)) + return false; + } + } + if (!isElision) { + if (!emitConditionallyExecutedDestructuringLHS(subpattern, flav)) // ... OBJ? ITER + return false; + } else if (pndefault) { + if (!emit1(JSOP_POP)) // ... OBJ? ITER + return false; + } + + // Setup next element's result when the iterator is done. + if (hasNextNonSpread) { + if (!emit1(JSOP_UNDEFINED)) // ... OBJ? ITER RESULT + return false; + if (!emit1(JSOP_NOP_DESTRUCTURING)) + return false; + if (!emit1(JSOP_TRUE)) // ... OBJ? ITER RESULT DONE? + return false; + } else if (hasNextSpread) { + if (!emit1(JSOP_TRUE)) // ... OBJ? ITER DONE? + return false; + } + + if (!ifThenElse.emitElse()) // ... OBJ? ITER RESULT + return false; + + if (!emitAtomOp(cx->names().value, JSOP_GETPROP)) // ... OBJ? ITER VALUE + return false; + + if (pndefault) { + if (!emitDefault(pndefault)) // ... OBJ? ITER VALUE + return false; + } + + if (!isElision) { + if (!emitConditionallyExecutedDestructuringLHS(subpattern, flav)) // ... OBJ? ITER + return false; + } else { + if (!emit1(JSOP_POP)) // ... OBJ? ITER + return false; + } + + // Setup next element's result when the iterator is not done. + if (hasNextNonSpread) { + if (!emitNext(cx, this)) // ... OBJ? ITER RESULT DONE? + return false; + } else if (hasNextSpread) { + if (!emit1(JSOP_FALSE)) // ... OBJ? ITER DONE? + return false; + } + + if (!ifThenElse.emitEnd()) + return false; + if (hasNextNonSpread) + MOZ_ASSERT(ifThenElse.pushed() == 1); + else if (hasNextSpread) + MOZ_ASSERT(ifThenElse.pushed() == 0); + else + MOZ_ASSERT(ifThenElse.popped() == 1); + } + + if (needToPopIterator) { + if (!emit1(JSOP_POP)) // ... OBJ? + return false; + } + + return true; +} + +bool +BytecodeEmitter::emitComputedPropertyName(ParseNode* computedPropName) +{ + MOZ_ASSERT(computedPropName->isKind(PNK_COMPUTED_NAME)); + return emitTree(computedPropName->pn_kid) && emit1(JSOP_TOID); +} + +bool +BytecodeEmitter::emitDestructuringOpsObject(ParseNode* pattern, DestructuringFlavor flav) +{ + MOZ_ASSERT(pattern->isKind(PNK_OBJECT)); + MOZ_ASSERT(pattern->isArity(PN_LIST)); + + MOZ_ASSERT(this->stackDepth > 0); // ... RHS + + if (!emitRequireObjectCoercible()) // ... RHS + return false; + + for (ParseNode* member = pattern->pn_head; member; member = member->pn_next) { + // Duplicate the value being destructured to use as a reference base. + if (!emit1(JSOP_DUP)) // ... RHS RHS + return false; + + // Now push the property name currently being matched, which is the + // current property name "label" on the left of a colon in the object + // initialiser. + bool needsGetElem = true; + + ParseNode* subpattern; + if (member->isKind(PNK_MUTATEPROTO)) { + if (!emitAtomOp(cx->names().proto, JSOP_GETPROP)) // ... RHS PROP + return false; + needsGetElem = false; + subpattern = member->pn_kid; + } else { + MOZ_ASSERT(member->isKind(PNK_COLON) || member->isKind(PNK_SHORTHAND)); + + ParseNode* key = member->pn_left; + if (key->isKind(PNK_NUMBER)) { + if (!emitNumberOp(key->pn_dval)) // ... RHS RHS KEY + return false; + } else if (key->isKind(PNK_OBJECT_PROPERTY_NAME) || key->isKind(PNK_STRING)) { + PropertyName* name = key->pn_atom->asPropertyName(); + + // The parser already checked for atoms representing indexes and + // used PNK_NUMBER instead, but also watch for ids which TI treats + // as indexes for simplification of downstream analysis. + jsid id = NameToId(name); + if (id != IdToTypeId(id)) { + if (!emitTree(key)) // ... RHS RHS KEY + return false; + } else { + if (!emitAtomOp(name, JSOP_GETPROP)) // ...RHS PROP + return false; + needsGetElem = false; + } + } else { + if (!emitComputedPropertyName(key)) // ... RHS RHS KEY + return false; + } + + subpattern = member->pn_right; + } + + // Get the property value if not done already. + if (needsGetElem && !emitElemOpBase(JSOP_GETELEM)) // ... RHS PROP + return false; + + if (subpattern->isKind(PNK_ASSIGN)) { + if (!emitDefault(subpattern->pn_right)) + return false; + subpattern = subpattern->pn_left; + } + + // Destructure PROP per this member's subpattern. + if (!emitDestructuringLHS(subpattern, flav)) + return false; + } + + return true; +} + +bool +BytecodeEmitter::emitDestructuringOps(ParseNode* pattern, DestructuringFlavor flav) +{ + if (pattern->isKind(PNK_ARRAY)) + return emitDestructuringOpsArray(pattern, flav); + return emitDestructuringOpsObject(pattern, flav); +} + +bool +BytecodeEmitter::emitTemplateString(ParseNode* pn) +{ + MOZ_ASSERT(pn->isArity(PN_LIST)); + + bool pushedString = false; + + for (ParseNode* pn2 = pn->pn_head; pn2 != NULL; pn2 = pn2->pn_next) { + bool isString = (pn2->getKind() == PNK_STRING || pn2->getKind() == PNK_TEMPLATE_STRING); + + // Skip empty strings. These are very common: a template string like + // `${a}${b}` has three empty strings and without this optimization + // we'd emit four JSOP_ADD operations instead of just one. + if (isString && pn2->pn_atom->empty()) + continue; + + if (!isString) { + // We update source notes before emitting the expression + if (!updateSourceCoordNotes(pn2->pn_pos.begin)) + return false; + } + + if (!emitTree(pn2)) + return false; + + if (!isString) { + // We need to convert the expression to a string + if (!emit1(JSOP_TOSTRING)) + return false; + } + + if (pushedString) { + // We've pushed two strings onto the stack. Add them together, leaving just one. + if (!emit1(JSOP_ADD)) + return false; + } else { + pushedString = true; + } + } + + if (!pushedString) { + // All strings were empty, this can happen for something like `${""}`. + // Just push an empty string. + if (!emitAtomOp(cx->names().empty, JSOP_STRING)) + return false; + } + + return true; +} + +bool +BytecodeEmitter::emitDeclarationList(ParseNode* declList) +{ + MOZ_ASSERT(declList->isArity(PN_LIST)); + + ParseNode* next; + for (ParseNode* decl = declList->pn_head; decl; decl = next) { + if (!updateSourceCoordNotes(decl->pn_pos.begin)) + return false; + next = decl->pn_next; + + if (decl->isKind(PNK_ASSIGN)) { + MOZ_ASSERT(decl->isOp(JSOP_NOP)); + + ParseNode* pattern = decl->pn_left; + MOZ_ASSERT(pattern->isKind(PNK_ARRAY) || pattern->isKind(PNK_OBJECT)); + + if (!emitTree(decl->pn_right)) + return false; + + if (!emitDestructuringOps(pattern, DestructuringDeclaration)) + return false; + + if (!emit1(JSOP_POP)) + return false; + } else { + if (!emitSingleDeclaration(declList, decl, decl->expr())) + return false; + } + } + return true; +} + +bool +BytecodeEmitter::emitSingleDeclaration(ParseNode* declList, ParseNode* decl, + ParseNode* initializer) +{ + MOZ_ASSERT(decl->isKind(PNK_NAME)); + + // Nothing to do for initializer-less 'var' declarations, as there's no TDZ. + if (!initializer && declList->isKind(PNK_VAR)) + return true; + + auto emitRhs = [initializer, declList](BytecodeEmitter* bce, const NameLocation&, bool) { + if (!initializer) { + // Lexical declarations are initialized to undefined without an + // initializer. + MOZ_ASSERT(declList->isKind(PNK_LET), + "var declarations without initializers handled above, " + "and const declarations must have initializers"); + return bce->emit1(JSOP_UNDEFINED); + } + + MOZ_ASSERT(initializer); + return bce->emitTree(initializer); + }; + + if (!emitInitializeName(decl, emitRhs)) + return false; + + // Pop the RHS. + return emit1(JSOP_POP); +} + +static bool +EmitAssignmentRhs(BytecodeEmitter* bce, ParseNode* rhs, uint8_t offset) +{ + // If there is a RHS tree, emit the tree. + if (rhs) + return bce->emitTree(rhs); + + // Otherwise the RHS value to assign is already on the stack, i.e., the + // next enumeration value in a for-in or for-of loop. Depending on how + // many other values have been pushed on the stack, we need to get the + // already-pushed RHS value. + if (offset != 1 && !bce->emit2(JSOP_PICK, offset - 1)) + return false; + + return true; +} + +bool +BytecodeEmitter::emitAssignment(ParseNode* lhs, JSOp op, ParseNode* rhs) +{ + // Name assignments are handled separately because choosing ops and when + // to emit BINDNAME is involved and should avoid duplication. + if (lhs->isKind(PNK_NAME)) { + auto emitRhs = [op, lhs, rhs](BytecodeEmitter* bce, const NameLocation& lhsLoc, + bool emittedBindOp) + { + // For compound assignments, first get the LHS value, then emit + // the RHS and the op. + if (op != JSOP_NOP) { + if (lhsLoc.kind() == NameLocation::Kind::Dynamic) { + // For dynamic accesses we can do better than a GETNAME + // since the assignment already emitted a BINDNAME on the + // top of the stack. As an optimization, use that to get + // the name. + if (!bce->emit1(JSOP_DUP)) + return false; + if (!bce->emitAtomOp(lhs, JSOP_GETXPROP)) + return false; + } else { + if (!bce->emitGetNameAtLocation(lhs->name(), lhsLoc)) + return false; + } + } + + // Emit the RHS. If we emitted a BIND[G]NAME, then the scope is on + // the top of the stack and we need to pick the right RHS value. + if (!EmitAssignmentRhs(bce, rhs, emittedBindOp ? 2 : 1)) + return false; + + // Emit the compound assignment op if there is one. + if (op != JSOP_NOP && !bce->emit1(op)) + return false; + + return true; + }; + + return emitSetName(lhs, emitRhs); + } + + // Deal with non-name assignments. + uint32_t atomIndex = (uint32_t) -1; + uint8_t offset = 1; + + switch (lhs->getKind()) { + case PNK_DOT: + if (lhs->as<PropertyAccess>().isSuper()) { + if (!emitSuperPropLHS(&lhs->as<PropertyAccess>().expression())) + return false; + offset += 2; + } else { + if (!emitTree(lhs->expr())) + return false; + offset += 1; + } + if (!makeAtomIndex(lhs->pn_atom, &atomIndex)) + return false; + break; + case PNK_ELEM: { + MOZ_ASSERT(lhs->isArity(PN_BINARY)); + EmitElemOption opt = op == JSOP_NOP ? EmitElemOption::Get : EmitElemOption::CompoundAssign; + if (lhs->as<PropertyByValue>().isSuper()) { + if (!emitSuperElemOperands(lhs, opt)) + return false; + offset += 3; + } else { + if (!emitElemOperands(lhs, opt)) + return false; + offset += 2; + } + break; + } + case PNK_ARRAY: + case PNK_OBJECT: + break; + case PNK_CALL: + if (!emitTree(lhs)) + return false; + + // Assignment to function calls is forbidden, but we have to make the + // call first. Now we can throw. + if (!emitUint16Operand(JSOP_THROWMSG, JSMSG_BAD_LEFTSIDE_OF_ASS)) + return false; + + // Rebalance the stack to placate stack-depth assertions. + if (!emit1(JSOP_POP)) + return false; + break; + default: + MOZ_ASSERT(0); + } + + if (op != JSOP_NOP) { + MOZ_ASSERT(rhs); + switch (lhs->getKind()) { + case PNK_DOT: { + JSOp getOp; + if (lhs->as<PropertyAccess>().isSuper()) { + if (!emit1(JSOP_DUP2)) + return false; + getOp = JSOP_GETPROP_SUPER; + } else { + if (!emit1(JSOP_DUP)) + return false; + bool isLength = (lhs->pn_atom == cx->names().length); + getOp = isLength ? JSOP_LENGTH : JSOP_GETPROP; + } + if (!emitIndex32(getOp, atomIndex)) + return false; + break; + } + case PNK_ELEM: { + JSOp elemOp; + if (lhs->as<PropertyByValue>().isSuper()) { + if (!emitDupAt(2)) + return false; + if (!emitDupAt(2)) + return false; + if (!emitDupAt(2)) + return false; + elemOp = JSOP_GETELEM_SUPER; + } else { + if (!emit1(JSOP_DUP2)) + return false; + elemOp = JSOP_GETELEM; + } + if (!emitElemOpBase(elemOp)) + return false; + break; + } + case PNK_CALL: + // We just emitted a JSOP_THROWMSG and popped the call's return + // value. Push a random value to make sure the stack depth is + // correct. + if (!emit1(JSOP_NULL)) + return false; + break; + default:; + } + } + + if (!EmitAssignmentRhs(this, rhs, offset)) + return false; + + /* If += etc., emit the binary operator with a source note. */ + if (op != JSOP_NOP) { + if (!newSrcNote(SRC_ASSIGNOP)) + return false; + if (!emit1(op)) + return false; + } + + /* Finally, emit the specialized assignment bytecode. */ + switch (lhs->getKind()) { + case PNK_DOT: { + JSOp setOp = lhs->as<PropertyAccess>().isSuper() ? + (sc->strict() ? JSOP_STRICTSETPROP_SUPER : JSOP_SETPROP_SUPER) : + (sc->strict() ? JSOP_STRICTSETPROP : JSOP_SETPROP); + if (!emitIndexOp(setOp, atomIndex)) + return false; + break; + } + case PNK_CALL: + // We threw above, so nothing to do here. + break; + case PNK_ELEM: { + JSOp setOp = lhs->as<PropertyByValue>().isSuper() ? + sc->strict() ? JSOP_STRICTSETELEM_SUPER : JSOP_SETELEM_SUPER : + sc->strict() ? JSOP_STRICTSETELEM : JSOP_SETELEM; + if (!emit1(setOp)) + return false; + break; + } + case PNK_ARRAY: + case PNK_OBJECT: + if (!emitDestructuringOps(lhs, DestructuringAssignment)) + return false; + break; + default: + MOZ_ASSERT(0); + } + return true; +} + +bool +ParseNode::getConstantValue(ExclusiveContext* cx, AllowConstantObjects allowObjects, + MutableHandleValue vp, Value* compare, size_t ncompare, + NewObjectKind newKind) +{ + MOZ_ASSERT(newKind == TenuredObject || newKind == SingletonObject); + + switch (getKind()) { + case PNK_NUMBER: + vp.setNumber(pn_dval); + return true; + case PNK_TEMPLATE_STRING: + case PNK_STRING: + vp.setString(pn_atom); + return true; + case PNK_TRUE: + vp.setBoolean(true); + return true; + case PNK_FALSE: + vp.setBoolean(false); + return true; + case PNK_NULL: + vp.setNull(); + return true; + case PNK_CALLSITEOBJ: + case PNK_ARRAY: { + unsigned count; + ParseNode* pn; + + if (allowObjects == DontAllowObjects) { + vp.setMagic(JS_GENERIC_MAGIC); + return true; + } + + ObjectGroup::NewArrayKind arrayKind = ObjectGroup::NewArrayKind::Normal; + if (allowObjects == ForCopyOnWriteArray) { + arrayKind = ObjectGroup::NewArrayKind::CopyOnWrite; + allowObjects = DontAllowObjects; + } + + if (getKind() == PNK_CALLSITEOBJ) { + count = pn_count - 1; + pn = pn_head->pn_next; + } else { + MOZ_ASSERT(isOp(JSOP_NEWINIT) && !(pn_xflags & PNX_NONCONST)); + count = pn_count; + pn = pn_head; + } + + AutoValueVector values(cx); + if (!values.appendN(MagicValue(JS_ELEMENTS_HOLE), count)) + return false; + size_t idx; + for (idx = 0; pn; idx++, pn = pn->pn_next) { + if (!pn->getConstantValue(cx, allowObjects, values[idx], values.begin(), idx)) + return false; + if (values[idx].isMagic(JS_GENERIC_MAGIC)) { + vp.setMagic(JS_GENERIC_MAGIC); + return true; + } + } + MOZ_ASSERT(idx == count); + + JSObject* obj = ObjectGroup::newArrayObject(cx, values.begin(), values.length(), + newKind, arrayKind); + if (!obj) + return false; + + if (!CombineArrayElementTypes(cx, obj, compare, ncompare)) + return false; + + vp.setObject(*obj); + return true; + } + case PNK_OBJECT: { + MOZ_ASSERT(isOp(JSOP_NEWINIT)); + MOZ_ASSERT(!(pn_xflags & PNX_NONCONST)); + + if (allowObjects == DontAllowObjects) { + vp.setMagic(JS_GENERIC_MAGIC); + return true; + } + MOZ_ASSERT(allowObjects == AllowObjects); + + Rooted<IdValueVector> properties(cx, IdValueVector(cx)); + + RootedValue value(cx), idvalue(cx); + for (ParseNode* pn = pn_head; pn; pn = pn->pn_next) { + if (!pn->pn_right->getConstantValue(cx, allowObjects, &value)) + return false; + if (value.isMagic(JS_GENERIC_MAGIC)) { + vp.setMagic(JS_GENERIC_MAGIC); + return true; + } + + ParseNode* pnid = pn->pn_left; + if (pnid->isKind(PNK_NUMBER)) { + idvalue = NumberValue(pnid->pn_dval); + } else { + MOZ_ASSERT(pnid->isKind(PNK_OBJECT_PROPERTY_NAME) || pnid->isKind(PNK_STRING)); + MOZ_ASSERT(pnid->pn_atom != cx->names().proto); + idvalue = StringValue(pnid->pn_atom); + } + + RootedId id(cx); + if (!ValueToId<CanGC>(cx, idvalue, &id)) + return false; + + if (!properties.append(IdValuePair(id, value))) + return false; + } + + JSObject* obj = ObjectGroup::newPlainObject(cx, properties.begin(), properties.length(), + newKind); + if (!obj) + return false; + + if (!CombinePlainObjectPropertyTypes(cx, obj, compare, ncompare)) + return false; + + vp.setObject(*obj); + return true; + } + default: + MOZ_CRASH("Unexpected node"); + } + return false; +} + +bool +BytecodeEmitter::emitSingletonInitialiser(ParseNode* pn) +{ + NewObjectKind newKind = (pn->getKind() == PNK_OBJECT) ? SingletonObject : TenuredObject; + + RootedValue value(cx); + if (!pn->getConstantValue(cx, ParseNode::AllowObjects, &value, nullptr, 0, newKind)) + return false; + + MOZ_ASSERT_IF(newKind == SingletonObject, value.toObject().isSingleton()); + + ObjectBox* objbox = parser->newObjectBox(&value.toObject()); + if (!objbox) + return false; + + return emitObjectOp(objbox, JSOP_OBJECT); +} + +bool +BytecodeEmitter::emitCallSiteObject(ParseNode* pn) +{ + RootedValue value(cx); + if (!pn->getConstantValue(cx, ParseNode::AllowObjects, &value)) + return false; + + MOZ_ASSERT(value.isObject()); + + ObjectBox* objbox1 = parser->newObjectBox(&value.toObject()); + if (!objbox1) + return false; + + if (!pn->as<CallSiteNode>().getRawArrayValue(cx, &value)) + return false; + + MOZ_ASSERT(value.isObject()); + + ObjectBox* objbox2 = parser->newObjectBox(&value.toObject()); + if (!objbox2) + return false; + + return emitObjectPairOp(objbox1, objbox2, JSOP_CALLSITEOBJ); +} + +/* See the SRC_FOR source note offsetBias comments later in this file. */ +JS_STATIC_ASSERT(JSOP_NOP_LENGTH == 1); +JS_STATIC_ASSERT(JSOP_POP_LENGTH == 1); + +namespace { + +class EmitLevelManager +{ + BytecodeEmitter* bce; + public: + explicit EmitLevelManager(BytecodeEmitter* bce) : bce(bce) { bce->emitLevel++; } + ~EmitLevelManager() { bce->emitLevel--; } +}; + +} /* anonymous namespace */ + +bool +BytecodeEmitter::emitCatch(ParseNode* pn) +{ + // We must be nested under a try-finally statement. + TryFinallyControl& controlInfo = innermostNestableControl->as<TryFinallyControl>(); + + /* Pick up the pending exception and bind it to the catch variable. */ + if (!emit1(JSOP_EXCEPTION)) + return false; + + /* + * Dup the exception object if there is a guard for rethrowing to use + * it later when rethrowing or in other catches. + */ + if (pn->pn_kid2 && !emit1(JSOP_DUP)) + return false; + + ParseNode* pn2 = pn->pn_kid1; + switch (pn2->getKind()) { + case PNK_ARRAY: + case PNK_OBJECT: + if (!emitDestructuringOps(pn2, DestructuringDeclaration)) + return false; + if (!emit1(JSOP_POP)) + return false; + break; + + case PNK_NAME: + if (!emitLexicalInitialization(pn2)) + return false; + if (!emit1(JSOP_POP)) + return false; + break; + + default: + MOZ_ASSERT(0); + } + + // If there is a guard expression, emit it and arrange to jump to the next + // catch block if the guard expression is false. + if (pn->pn_kid2) { + if (!emitTree(pn->pn_kid2)) + return false; + + // If the guard expression is false, fall through, pop the block scope, + // and jump to the next catch block. Otherwise jump over that code and + // pop the dupped exception. + JumpList guardCheck; + if (!emitJump(JSOP_IFNE, &guardCheck)) + return false; + + { + NonLocalExitControl nle(this); + + // Move exception back to cx->exception to prepare for + // the next catch. + if (!emit1(JSOP_THROWING)) + return false; + + // Leave the scope for this catch block. + if (!nle.prepareForNonLocalJump(&controlInfo)) + return false; + + // Jump to the next handler added by emitTry. + if (!emitJump(JSOP_GOTO, &controlInfo.guardJump)) + return false; + } + + // Back to normal control flow. + if (!emitJumpTargetAndPatch(guardCheck)) + return false; + + // Pop duplicated exception object as we no longer need it. + if (!emit1(JSOP_POP)) + return false; + } + + /* Emit the catch body. */ + return emitTree(pn->pn_kid3); +} + +// Using MOZ_NEVER_INLINE in here is a workaround for llvm.org/pr14047. See the +// comment on EmitSwitch. +MOZ_NEVER_INLINE bool +BytecodeEmitter::emitTry(ParseNode* pn) +{ + // Track jumps-over-catches and gosubs-to-finally for later fixup. + // + // When a finally block is active, non-local jumps (including + // jumps-over-catches) result in a GOSUB being written into the bytecode + // stream and fixed-up later. + // + TryFinallyControl controlInfo(this, pn->pn_kid3 ? StatementKind::Finally : StatementKind::Try); + + // Since an exception can be thrown at any place inside the try block, + // we need to restore the stack and the scope chain before we transfer + // the control to the exception handler. + // + // For that we store in a try note associated with the catch or + // finally block the stack depth upon the try entry. The interpreter + // uses this depth to properly unwind the stack and the scope chain. + // + int depth = stackDepth; + + // Record the try location, then emit the try block. + unsigned noteIndex; + if (!newSrcNote(SRC_TRY, ¬eIndex)) + return false; + if (!emit1(JSOP_TRY)) + return false; + + ptrdiff_t tryStart = offset(); + if (!emitTree(pn->pn_kid1)) + return false; + MOZ_ASSERT(depth == stackDepth); + + // GOSUB to finally, if present. + if (pn->pn_kid3) { + if (!emitJump(JSOP_GOSUB, &controlInfo.gosubs)) + return false; + } + + // Source note points to the jump at the end of the try block. + if (!setSrcNoteOffset(noteIndex, 0, offset() - tryStart + JSOP_TRY_LENGTH)) + return false; + + // Emit jump over catch and/or finally. + JumpList catchJump; + if (!emitJump(JSOP_GOTO, &catchJump)) + return false; + + JumpTarget tryEnd; + if (!emitJumpTarget(&tryEnd)) + return false; + + // If this try has a catch block, emit it. + ParseNode* catchList = pn->pn_kid2; + if (catchList) { + MOZ_ASSERT(catchList->isKind(PNK_CATCHLIST)); + + // The emitted code for a catch block looks like: + // + // [pushlexicalenv] only if any local aliased + // exception + // if there is a catchguard: + // dup + // setlocal 0; pop assign or possibly destructure exception + // if there is a catchguard: + // < catchguard code > + // ifne POST + // debugleaveblock + // [poplexicalenv] only if any local aliased + // throwing pop exception to cx->exception + // goto <next catch block> + // POST: pop + // < catch block contents > + // debugleaveblock + // [poplexicalenv] only if any local aliased + // goto <end of catch blocks> non-local; finally applies + // + // If there's no catch block without a catchguard, the last <next catch + // block> points to rethrow code. This code will [gosub] to the finally + // code if appropriate, and is also used for the catch-all trynote for + // capturing exceptions thrown from catch{} blocks. + // + for (ParseNode* pn3 = catchList->pn_head; pn3; pn3 = pn3->pn_next) { + MOZ_ASSERT(this->stackDepth == depth); + + // Clear the frame's return value that might have been set by the + // try block: + // + // eval("try { 1; throw 2 } catch(e) {}"); // undefined, not 1 + if (!emit1(JSOP_UNDEFINED)) + return false; + if (!emit1(JSOP_SETRVAL)) + return false; + + // Emit the lexical scope and catch body. + MOZ_ASSERT(pn3->isKind(PNK_LEXICALSCOPE)); + if (!emitTree(pn3)) + return false; + + // gosub <finally>, if required. + if (pn->pn_kid3) { + if (!emitJump(JSOP_GOSUB, &controlInfo.gosubs)) + return false; + MOZ_ASSERT(this->stackDepth == depth); + } + + // Jump over the remaining catch blocks. This will get fixed + // up to jump to after catch/finally. + if (!emitJump(JSOP_GOTO, &catchJump)) + return false; + + // If this catch block had a guard clause, patch the guard jump to + // come here. + if (controlInfo.guardJump.offset != -1) { + if (!emitJumpTargetAndPatch(controlInfo.guardJump)) + return false; + controlInfo.guardJump.offset = -1; + + // If this catch block is the last one, rethrow, delegating + // execution of any finally block to the exception handler. + if (!pn3->pn_next) { + if (!emit1(JSOP_EXCEPTION)) + return false; + if (!emit1(JSOP_THROW)) + return false; + } + } + } + } + + MOZ_ASSERT(this->stackDepth == depth); + + // Emit the finally handler, if there is one. + JumpTarget finallyStart{ 0 }; + if (pn->pn_kid3) { + if (!emitJumpTarget(&finallyStart)) + return false; + + // Fix up the gosubs that might have been emitted before non-local + // jumps to the finally code. + patchJumpsToTarget(controlInfo.gosubs, finallyStart); + + // Indicate that we're emitting a subroutine body. + controlInfo.setEmittingSubroutine(); + if (!updateSourceCoordNotes(pn->pn_kid3->pn_pos.begin)) + return false; + if (!emit1(JSOP_FINALLY)) + return false; + if (!emit1(JSOP_GETRVAL)) + return false; + + // Clear the frame's return value to make break/continue return + // correct value even if there's no other statement before them: + // + // eval("x: try { 1 } finally { break x; }"); // undefined, not 1 + if (!emit1(JSOP_UNDEFINED)) + return false; + if (!emit1(JSOP_SETRVAL)) + return false; + + if (!emitTree(pn->pn_kid3)) + return false; + if (!emit1(JSOP_SETRVAL)) + return false; + if (!emit1(JSOP_RETSUB)) + return false; + hasTryFinally = true; + MOZ_ASSERT(this->stackDepth == depth); + } + + // ReconstructPCStack needs a NOP here to mark the end of the last catch block. + if (!emit1(JSOP_NOP)) + return false; + + // Fix up the end-of-try/catch jumps to come here. + if (!emitJumpTargetAndPatch(catchJump)) + return false; + + // Add the try note last, to let post-order give us the right ordering + // (first to last for a given nesting level, inner to outer by level). + if (catchList && !tryNoteList.append(JSTRY_CATCH, depth, tryStart, tryEnd.offset)) + return false; + + // If we've got a finally, mark try+catch region with additional + // trynote to catch exceptions (re)thrown from a catch block or + // for the try{}finally{} case. + if (pn->pn_kid3 && !tryNoteList.append(JSTRY_FINALLY, depth, tryStart, finallyStart.offset)) + return false; + + return true; +} + +bool +BytecodeEmitter::emitIf(ParseNode* pn) +{ + IfThenElseEmitter ifThenElse(this); + + if_again: + /* Emit code for the condition before pushing stmtInfo. */ + if (!emitConditionallyExecutedTree(pn->pn_kid1)) + return false; + + ParseNode* elseNode = pn->pn_kid3; + if (elseNode) { + if (!ifThenElse.emitIfElse()) + return false; + } else { + if (!ifThenElse.emitIf()) + return false; + } + + /* Emit code for the then part. */ + if (!emitConditionallyExecutedTree(pn->pn_kid2)) + return false; + + if (elseNode) { + if (!ifThenElse.emitElse()) + return false; + + if (elseNode->isKind(PNK_IF)) { + pn = elseNode; + goto if_again; + } + + /* Emit code for the else part. */ + if (!emitConditionallyExecutedTree(elseNode)) + return false; + } + + if (!ifThenElse.emitEnd()) + return false; + + return true; +} + +bool +BytecodeEmitter::emitHoistedFunctionsInList(ParseNode* list) +{ + MOZ_ASSERT(list->pn_xflags & PNX_FUNCDEFS); + + for (ParseNode* pn = list->pn_head; pn; pn = pn->pn_next) { + ParseNode* maybeFun = pn; + + if (!sc->strict()) { + while (maybeFun->isKind(PNK_LABEL)) + maybeFun = maybeFun->as<LabeledStatement>().statement(); + } + + if (maybeFun->isKind(PNK_FUNCTION) && maybeFun->functionIsHoisted()) { + if (!emitTree(maybeFun)) + return false; + } + } + + return true; +} + +bool +BytecodeEmitter::emitLexicalScopeBody(ParseNode* body, EmitLineNumberNote emitLineNote) +{ + if (body->isKind(PNK_STATEMENTLIST) && body->pn_xflags & PNX_FUNCDEFS) { + // This block contains function statements whose definitions are + // hoisted to the top of the block. Emit these as a separate pass + // before the rest of the block. + if (!emitHoistedFunctionsInList(body)) + return false; + } + + // Line notes were updated by emitLexicalScope. + return emitTree(body, emitLineNote); +} + +// Using MOZ_NEVER_INLINE in here is a workaround for llvm.org/pr14047. See +// the comment on emitSwitch. +MOZ_NEVER_INLINE bool +BytecodeEmitter::emitLexicalScope(ParseNode* pn) +{ + MOZ_ASSERT(pn->isKind(PNK_LEXICALSCOPE)); + + TDZCheckCache tdzCache(this); + + ParseNode* body = pn->scopeBody(); + if (pn->isEmptyScope()) + return emitLexicalScopeBody(body); + + // Update line number notes before emitting TDZ poison in + // EmitterScope::enterLexical to avoid spurious pausing on seemingly + // non-effectful lines in Debugger. + // + // For example, consider the following code. + // + // L1: { + // L2: let x = 42; + // L3: } + // + // If line number notes were not updated before the TDZ poison, the TDZ + // poison bytecode sequence of 'uninitialized; initlexical' will have line + // number L1, and the Debugger will pause there. + if (!ParseNodeRequiresSpecialLineNumberNotes(body)) { + ParseNode* pnForPos = body; + if (body->isKind(PNK_STATEMENTLIST) && body->pn_head) + pnForPos = body->pn_head; + if (!updateLineNumberNotes(pnForPos->pn_pos.begin)) + return false; + } + + EmitterScope emitterScope(this); + ScopeKind kind; + if (body->isKind(PNK_CATCH)) + kind = body->pn_kid1->isKind(PNK_NAME) ? ScopeKind::SimpleCatch : ScopeKind::Catch; + else + kind = ScopeKind::Lexical; + + if (!emitterScope.enterLexical(this, kind, pn->scopeBindings())) + return false; + + if (body->isKind(PNK_FOR)) { + // for loops need to emit {FRESHEN,RECREATE}LEXICALENV if there are + // lexical declarations in the head. Signal this by passing a + // non-nullptr lexical scope. + if (!emitFor(body, &emitterScope)) + return false; + } else { + if (!emitLexicalScopeBody(body, SUPPRESS_LINENOTE)) + return false; + } + + return emitterScope.leave(this); +} + +bool +BytecodeEmitter::emitWith(ParseNode* pn) +{ + if (!emitTree(pn->pn_left)) + return false; + + EmitterScope emitterScope(this); + if (!emitterScope.enterWith(this)) + return false; + + if (!emitTree(pn->pn_right)) + return false; + + return emitterScope.leave(this); +} + +bool +BytecodeEmitter::emitRequireObjectCoercible() +{ + // For simplicity, handle this in self-hosted code, at cost of 13 bytes of + // bytecode versus 1 byte for a dedicated opcode. As more places need this + // behavior, we may want to reconsider this tradeoff. + +#ifdef DEBUG + auto depth = this->stackDepth; +#endif + MOZ_ASSERT(depth > 0); // VAL + if (!emit1(JSOP_DUP)) // VAL VAL + return false; + + // Note that "intrinsic" is a misnomer: we're calling a *self-hosted* + // function that's not an intrinsic! But it nonetheless works as desired. + if (!emitAtomOp(cx->names().RequireObjectCoercible, + JSOP_GETINTRINSIC)) // VAL VAL REQUIREOBJECTCOERCIBLE + { + return false; + } + if (!emit1(JSOP_UNDEFINED)) // VAL VAL REQUIREOBJECTCOERCIBLE UNDEFINED + return false; + if (!emit2(JSOP_PICK, 2)) // VAL REQUIREOBJECTCOERCIBLE UNDEFINED VAL + return false; + if (!emitCall(JSOP_CALL, 1)) // VAL IGNORED + return false; + checkTypeSet(JSOP_CALL); + + if (!emit1(JSOP_POP)) // VAL + return false; + + MOZ_ASSERT(depth == this->stackDepth); + return true; +} + +bool +BytecodeEmitter::emitIterator() +{ + // Convert iterable to iterator. + if (!emit1(JSOP_DUP)) // OBJ OBJ + return false; + if (!emit2(JSOP_SYMBOL, uint8_t(JS::SymbolCode::iterator))) // OBJ OBJ @@ITERATOR + return false; + if (!emitElemOpBase(JSOP_CALLELEM)) // OBJ ITERFN + return false; + if (!emit1(JSOP_SWAP)) // ITERFN OBJ + return false; + if (!emitCall(JSOP_CALLITER, 0)) // ITER + return false; + checkTypeSet(JSOP_CALLITER); + if (!emitCheckIsObj(CheckIsObjectKind::GetIterator)) // ITER + return false; + return true; +} + +bool +BytecodeEmitter::emitSpread(bool allowSelfHosted) +{ + LoopControl loopInfo(this, StatementKind::Spread); + + // Jump down to the loop condition to minimize overhead assuming at least + // one iteration, as the other loop forms do. Annotate so IonMonkey can + // find the loop-closing jump. + unsigned noteIndex; + if (!newSrcNote(SRC_FOR_OF, ¬eIndex)) + return false; + + // Jump down to the loop condition to minimize overhead, assuming at least + // one iteration. (This is also what we do for loops; whether this + // assumption holds for spreads is an unanswered question.) + JumpList initialJump; + if (!emitJump(JSOP_GOTO, &initialJump)) // ITER ARR I (during the goto) + return false; + + JumpTarget top{ -1 }; + if (!emitLoopHead(nullptr, &top)) // ITER ARR I + return false; + + // When we enter the goto above, we have ITER ARR I on the stack. But when + // we reach this point on the loop backedge (if spreading produces at least + // one value), we've additionally pushed a RESULT iteration value. + // Increment manually to reflect this. + this->stackDepth++; + + JumpList beq; + JumpTarget breakTarget{ -1 }; + { +#ifdef DEBUG + auto loopDepth = this->stackDepth; +#endif + + // Emit code to assign result.value to the iteration variable. + if (!emitAtomOp(cx->names().value, JSOP_GETPROP)) // ITER ARR I VALUE + return false; + if (!emit1(JSOP_INITELEM_INC)) // ITER ARR (I+1) + return false; + + MOZ_ASSERT(this->stackDepth == loopDepth - 1); + + // Spread operations can't contain |continue|, so don't bother setting loop + // and enclosing "update" offsets, as we do with for-loops. + + // COME FROM the beginning of the loop to here. + if (!emitLoopEntry(nullptr, initialJump)) // ITER ARR I + return false; + + if (!emitDupAt(2)) // ITER ARR I ITER + return false; + if (!emitIteratorNext(nullptr, allowSelfHosted)) // ITER ARR I RESULT + return false; + if (!emit1(JSOP_DUP)) // ITER ARR I RESULT RESULT + return false; + if (!emitAtomOp(cx->names().done, JSOP_GETPROP)) // ITER ARR I RESULT DONE? + return false; + + if (!emitBackwardJump(JSOP_IFEQ, top, &beq, &breakTarget)) // ITER ARR I RESULT + return false; + + MOZ_ASSERT(this->stackDepth == loopDepth); + } + + // Let Ion know where the closing jump of this loop is. + if (!setSrcNoteOffset(noteIndex, 0, beq.offset - initialJump.offset)) + return false; + + // No breaks or continues should occur in spreads. + MOZ_ASSERT(loopInfo.breaks.offset == -1); + MOZ_ASSERT(loopInfo.continues.offset == -1); + + if (!tryNoteList.append(JSTRY_FOR_OF, stackDepth, top.offset, breakTarget.offset)) + return false; + + if (!emit2(JSOP_PICK, 3)) // ARR FINAL_INDEX RESULT ITER + return false; + + return emitUint16Operand(JSOP_POPN, 2); // ARR FINAL_INDEX +} + +bool +BytecodeEmitter::emitInitializeForInOrOfTarget(ParseNode* forHead) +{ + MOZ_ASSERT(forHead->isKind(PNK_FORIN) || forHead->isKind(PNK_FOROF)); + MOZ_ASSERT(forHead->isArity(PN_TERNARY)); + + MOZ_ASSERT(this->stackDepth >= 1, + "must have a per-iteration value for initializing"); + + ParseNode* target = forHead->pn_kid1; + MOZ_ASSERT(!forHead->pn_kid2); + + // If the for-in/of loop didn't have a variable declaration, per-loop + // initialization is just assigning the iteration value to a target + // expression. + if (!parser->handler.isDeclarationList(target)) + return emitAssignment(target, JSOP_NOP, nullptr); // ... ITERVAL + + // Otherwise, per-loop initialization is (possibly) declaration + // initialization. If the declaration is a lexical declaration, it must be + // initialized. If the declaration is a variable declaration, an + // assignment to that name (which does *not* necessarily assign to the + // variable!) must be generated. + + if (!updateSourceCoordNotes(target->pn_pos.begin)) + return false; + + MOZ_ASSERT(target->isForLoopDeclaration()); + target = parser->handler.singleBindingFromDeclaration(target); + + if (target->isKind(PNK_NAME)) { + auto emitSwapScopeAndRhs = [](BytecodeEmitter* bce, const NameLocation&, + bool emittedBindOp) + { + if (emittedBindOp) { + // Per-iteration initialization in for-in/of loops computes the + // iteration value *before* initializing. Thus the + // initializing value may be buried under a bind-specific value + // on the stack. Swap it to the top of the stack. + MOZ_ASSERT(bce->stackDepth >= 2); + return bce->emit1(JSOP_SWAP); + } + + // In cases of emitting a frame slot or environment slot, + // nothing needs be done. + MOZ_ASSERT(bce->stackDepth >= 1); + return true; + }; + + // The caller handles removing the iteration value from the stack. + return emitInitializeName(target, emitSwapScopeAndRhs); + } + + MOZ_ASSERT(!target->isKind(PNK_ASSIGN), + "for-in/of loop destructuring declarations can't have initializers"); + + MOZ_ASSERT(target->isKind(PNK_ARRAY) || target->isKind(PNK_OBJECT)); + return emitDestructuringOps(target, DestructuringDeclaration); +} + +bool +BytecodeEmitter::emitForOf(ParseNode* forOfLoop, EmitterScope* headLexicalEmitterScope) +{ + MOZ_ASSERT(forOfLoop->isKind(PNK_FOR)); + MOZ_ASSERT(forOfLoop->isArity(PN_BINARY)); + + ParseNode* forOfHead = forOfLoop->pn_left; + MOZ_ASSERT(forOfHead->isKind(PNK_FOROF)); + MOZ_ASSERT(forOfHead->isArity(PN_TERNARY)); + + // Evaluate the expression being iterated. + ParseNode* forHeadExpr = forOfHead->pn_kid3; + if (!emitTree(forHeadExpr)) // ITERABLE + return false; + if (!emitIterator()) // ITER + return false; + + // For-of loops have both the iterator and the value on the stack. Push + // undefined to balance the stack. + if (!emit1(JSOP_UNDEFINED)) // ITER RESULT + return false; + + LoopControl loopInfo(this, StatementKind::ForOfLoop); + + // Annotate so IonMonkey can find the loop-closing jump. + unsigned noteIndex; + if (!newSrcNote(SRC_FOR_OF, ¬eIndex)) + return false; + + JumpList initialJump; + if (!emitJump(JSOP_GOTO, &initialJump)) // ITER RESULT + return false; + + JumpTarget top{ -1 }; + if (!emitLoopHead(nullptr, &top)) // ITER RESULT + return false; + + // If the loop had an escaping lexical declaration, replace the current + // environment with an dead zoned one to implement TDZ semantics. + if (headLexicalEmitterScope) { + // The environment chain only includes an environment for the for-of + // loop head *if* a scope binding is captured, thereby requiring + // recreation each iteration. If a lexical scope exists for the head, + // it must be the innermost one. If that scope has closed-over + // bindings inducing an environment, recreate the current environment. + DebugOnly<ParseNode*> forOfTarget = forOfHead->pn_kid1; + MOZ_ASSERT(forOfTarget->isKind(PNK_LET) || forOfTarget->isKind(PNK_CONST)); + MOZ_ASSERT(headLexicalEmitterScope == innermostEmitterScope); + MOZ_ASSERT(headLexicalEmitterScope->scope(this)->kind() == ScopeKind::Lexical); + + if (headLexicalEmitterScope->hasEnvironment()) { + if (!emit1(JSOP_RECREATELEXICALENV)) // ITER RESULT + return false; + } + + // For uncaptured bindings, put them back in TDZ. + if (!headLexicalEmitterScope->deadZoneFrameSlots(this)) + return false; + } + + JumpList beq; + JumpTarget breakTarget{ -1 }; + { +#ifdef DEBUG + auto loopDepth = this->stackDepth; +#endif + + // Emit code to assign result.value to the iteration variable. + if (!emit1(JSOP_DUP)) // ITER RESULT RESULT + return false; + if (!emitAtomOp(cx->names().value, JSOP_GETPROP)) // ITER RESULT VALUE + return false; + + if (!emitInitializeForInOrOfTarget(forOfHead)) // ITER RESULT VALUE + return false; + + if (!emit1(JSOP_POP)) // ITER RESULT + return false; + + MOZ_ASSERT(this->stackDepth == loopDepth, + "the stack must be balanced around the initializing " + "operation"); + + // Perform the loop body. + ParseNode* forBody = forOfLoop->pn_right; + if (!emitTree(forBody)) // ITER RESULT + return false; + + // Set offset for continues. + loopInfo.continueTarget = { offset() }; + + if (!emitLoopEntry(forHeadExpr, initialJump)) // ITER RESULT + return false; + + if (!emit1(JSOP_POP)) // ITER + return false; + if (!emit1(JSOP_DUP)) // ITER ITER + return false; + + if (!emitIteratorNext(forOfHead)) // ITER RESULT + return false; + if (!emit1(JSOP_DUP)) // ITER RESULT RESULT + return false; + if (!emitAtomOp(cx->names().done, JSOP_GETPROP)) // ITER RESULT DONE? + return false; + + if (!emitBackwardJump(JSOP_IFEQ, top, &beq, &breakTarget)) + return false; // ITER RESULT + + MOZ_ASSERT(this->stackDepth == loopDepth); + } + + // Let Ion know where the closing jump of this loop is. + if (!setSrcNoteOffset(noteIndex, 0, beq.offset - initialJump.offset)) + return false; + + if (!loopInfo.patchBreaksAndContinues(this)) + return false; + + if (!tryNoteList.append(JSTRY_FOR_OF, stackDepth, top.offset, breakTarget.offset)) + return false; + + return emitUint16Operand(JSOP_POPN, 2); // +} + +bool +BytecodeEmitter::emitForIn(ParseNode* forInLoop, EmitterScope* headLexicalEmitterScope) +{ + MOZ_ASSERT(forInLoop->isKind(PNK_FOR)); + MOZ_ASSERT(forInLoop->isArity(PN_BINARY)); + MOZ_ASSERT(forInLoop->isOp(JSOP_ITER)); + + ParseNode* forInHead = forInLoop->pn_left; + MOZ_ASSERT(forInHead->isKind(PNK_FORIN)); + MOZ_ASSERT(forInHead->isArity(PN_TERNARY)); + + // Annex B: Evaluate the var-initializer expression if present. + // |for (var i = initializer in expr) { ... }| + ParseNode* forInTarget = forInHead->pn_kid1; + if (parser->handler.isDeclarationList(forInTarget)) { + ParseNode* decl = parser->handler.singleBindingFromDeclaration(forInTarget); + if (decl->isKind(PNK_NAME)) { + if (ParseNode* initializer = decl->expr()) { + MOZ_ASSERT(forInTarget->isKind(PNK_VAR), + "for-in initializers are only permitted for |var| declarations"); + + if (!updateSourceCoordNotes(decl->pn_pos.begin)) + return false; + + auto emitRhs = [initializer](BytecodeEmitter* bce, const NameLocation&, bool) { + return bce->emitTree(initializer); + }; + + if (!emitInitializeName(decl, emitRhs)) + return false; + + // Pop the initializer. + if (!emit1(JSOP_POP)) + return false; + } + } + } + + // Evaluate the expression being iterated. + ParseNode* expr = forInHead->pn_kid3; + if (!emitTree(expr)) // EXPR + return false; + + // Convert the value to the appropriate sort of iterator object for the + // loop variant (for-in, for-each-in, or destructuring for-in). + unsigned iflags = forInLoop->pn_iflags; + MOZ_ASSERT(0 == (iflags & ~(JSITER_FOREACH | JSITER_ENUMERATE))); + if (!emit2(JSOP_ITER, AssertedCast<uint8_t>(iflags))) // ITER + return false; + + // For-in loops have both the iterator and the value on the stack. Push + // undefined to balance the stack. + if (!emit1(JSOP_UNDEFINED)) // ITER ITERVAL + return false; + + LoopControl loopInfo(this, StatementKind::ForInLoop); + + /* Annotate so IonMonkey can find the loop-closing jump. */ + unsigned noteIndex; + if (!newSrcNote(SRC_FOR_IN, ¬eIndex)) + return false; + + // Jump down to the loop condition to minimize overhead (assuming at least + // one iteration, just like the other loop forms). + JumpList initialJump; + if (!emitJump(JSOP_GOTO, &initialJump)) // ITER ITERVAL + return false; + + JumpTarget top{ -1 }; + if (!emitLoopHead(nullptr, &top)) // ITER ITERVAL + return false; + + // If the loop had an escaping lexical declaration, replace the current + // environment with an dead zoned one to implement TDZ semantics. + if (headLexicalEmitterScope) { + // The environment chain only includes an environment for the for-in + // loop head *if* a scope binding is captured, thereby requiring + // recreation each iteration. If a lexical scope exists for the head, + // it must be the innermost one. If that scope has closed-over + // bindings inducing an environment, recreate the current environment. + MOZ_ASSERT(forInTarget->isKind(PNK_LET) || forInTarget->isKind(PNK_CONST)); + MOZ_ASSERT(headLexicalEmitterScope == innermostEmitterScope); + MOZ_ASSERT(headLexicalEmitterScope->scope(this)->kind() == ScopeKind::Lexical); + + if (headLexicalEmitterScope->hasEnvironment()) { + if (!emit1(JSOP_RECREATELEXICALENV)) // ITER ITERVAL + return false; + } + + // For uncaptured bindings, put them back in TDZ. + if (!headLexicalEmitterScope->deadZoneFrameSlots(this)) + return false; + } + + { +#ifdef DEBUG + auto loopDepth = this->stackDepth; +#endif + MOZ_ASSERT(loopDepth >= 2); + + if (!emitInitializeForInOrOfTarget(forInHead)) // ITER ITERVAL + return false; + + MOZ_ASSERT(this->stackDepth == loopDepth, + "iterator and iterval must be left on the stack"); + } + + // Perform the loop body. + ParseNode* forBody = forInLoop->pn_right; + if (!emitTree(forBody)) // ITER ITERVAL + return false; + + // Set offset for continues. + loopInfo.continueTarget = { offset() }; + + if (!emitLoopEntry(nullptr, initialJump)) // ITER ITERVAL + return false; + if (!emit1(JSOP_POP)) // ITER + return false; + if (!emit1(JSOP_MOREITER)) // ITER NEXTITERVAL? + return false; + if (!emit1(JSOP_ISNOITER)) // ITER NEXTITERVAL? ISNOITER + return false; + + JumpList beq; + JumpTarget breakTarget{ -1 }; + if (!emitBackwardJump(JSOP_IFEQ, top, &beq, &breakTarget)) + return false; // ITER NEXTITERVAL + + // Set the srcnote offset so we can find the closing jump. + if (!setSrcNoteOffset(noteIndex, 0, beq.offset - initialJump.offset)) + return false; + + if (!loopInfo.patchBreaksAndContinues(this)) + return false; + + // Pop the enumeration value. + if (!emit1(JSOP_POP)) // ITER + return false; + + if (!tryNoteList.append(JSTRY_FOR_IN, this->stackDepth, top.offset, offset())) + return false; + + return emit1(JSOP_ENDITER); // +} + +/* C-style `for (init; cond; update) ...` loop. */ +bool +BytecodeEmitter::emitCStyleFor(ParseNode* pn, EmitterScope* headLexicalEmitterScope) +{ + LoopControl loopInfo(this, StatementKind::ForLoop); + + ParseNode* forHead = pn->pn_left; + ParseNode* forBody = pn->pn_right; + + // If the head of this for-loop declared any lexical variables, the parser + // wrapped this PNK_FOR node in a PNK_LEXICALSCOPE representing the + // implicit scope of those variables. By the time we get here, we have + // already entered that scope. So far, so good. + // + // ### Scope freshening + // + // Each iteration of a `for (let V...)` loop creates a fresh loop variable + // binding for V, even if the loop is a C-style `for(;;)` loop: + // + // var funcs = []; + // for (let i = 0; i < 2; i++) + // funcs.push(function() { return i; }); + // assertEq(funcs[0](), 0); // the two closures capture... + // assertEq(funcs[1](), 1); // ...two different `i` bindings + // + // This is implemented by "freshening" the implicit block -- changing the + // scope chain to a fresh clone of the instantaneous block object -- each + // iteration, just before evaluating the "update" in for(;;) loops. + // + // No freshening occurs in `for (const ...;;)` as there's no point: you + // can't reassign consts. This is observable through the Debugger API. (The + // ES6 spec also skips cloning the environment in this case.) + bool forLoopRequiresFreshening = false; + if (ParseNode* init = forHead->pn_kid1) { + // Emit the `init` clause, whether it's an expression or a variable + // declaration. (The loop variables were hoisted into an enclosing + // scope, but we still need to emit code for the initializers.) + if (!updateSourceCoordNotes(init->pn_pos.begin)) + return false; + if (!emitTree(init)) + return false; + + if (!init->isForLoopDeclaration()) { + // 'init' is an expression, not a declaration. emitTree left its + // value on the stack. + if (!emit1(JSOP_POP)) + return false; + } + + // ES 13.7.4.8 step 2. The initial freshening. + // + // If an initializer let-declaration may be captured during loop iteration, + // the current scope has an environment. If so, freshen the current + // environment to expose distinct bindings for each loop iteration. + forLoopRequiresFreshening = init->isKind(PNK_LET) && headLexicalEmitterScope; + if (forLoopRequiresFreshening) { + // The environment chain only includes an environment for the for(;;) + // loop head's let-declaration *if* a scope binding is captured, thus + // requiring a fresh environment each iteration. If a lexical scope + // exists for the head, it must be the innermost one. If that scope + // has closed-over bindings inducing an environment, recreate the + // current environment. + MOZ_ASSERT(headLexicalEmitterScope == innermostEmitterScope); + MOZ_ASSERT(headLexicalEmitterScope->scope(this)->kind() == ScopeKind::Lexical); + + if (headLexicalEmitterScope->hasEnvironment()) { + if (!emit1(JSOP_FRESHENLEXICALENV)) + return false; + } + } + } + + /* + * NB: the SRC_FOR note has offsetBias 1 (JSOP_NOP_LENGTH). + * Use tmp to hold the biased srcnote "top" offset, which differs + * from the top local variable by the length of the JSOP_GOTO + * emitted in between tmp and top if this loop has a condition. + */ + unsigned noteIndex; + if (!newSrcNote(SRC_FOR, ¬eIndex)) + return false; + if (!emit1(JSOP_NOP)) + return false; + ptrdiff_t tmp = offset(); + + JumpList jmp; + if (forHead->pn_kid2) { + /* Goto the loop condition, which branches back to iterate. */ + if (!emitJump(JSOP_GOTO, &jmp)) + return false; + } + + /* Emit code for the loop body. */ + JumpTarget top{ -1 }; + if (!emitLoopHead(forBody, &top)) + return false; + if (jmp.offset == -1 && !emitLoopEntry(forBody, jmp)) + return false; + + if (!emitConditionallyExecutedTree(forBody)) + return false; + + // Set loop and enclosing "update" offsets, for continue. Note that we + // continue to immediately *before* the block-freshening: continuing must + // refresh the block. + if (!emitJumpTarget(&loopInfo.continueTarget)) + return false; + + // ES 13.7.4.8 step 3.e. The per-iteration freshening. + if (forLoopRequiresFreshening) { + MOZ_ASSERT(headLexicalEmitterScope == innermostEmitterScope); + MOZ_ASSERT(headLexicalEmitterScope->scope(this)->kind() == ScopeKind::Lexical); + + if (headLexicalEmitterScope->hasEnvironment()) { + if (!emit1(JSOP_FRESHENLEXICALENV)) + return false; + } + } + + // Check for update code to do before the condition (if any). + // The update code may not be executed at all; it needs its own TDZ cache. + if (ParseNode* update = forHead->pn_kid3) { + TDZCheckCache tdzCache(this); + + if (!updateSourceCoordNotes(update->pn_pos.begin)) + return false; + if (!emitTree(update)) + return false; + if (!emit1(JSOP_POP)) + return false; + + /* Restore the absolute line number for source note readers. */ + uint32_t lineNum = parser->tokenStream.srcCoords.lineNum(pn->pn_pos.end); + if (currentLine() != lineNum) { + if (!newSrcNote2(SRC_SETLINE, ptrdiff_t(lineNum))) + return false; + current->currentLine = lineNum; + current->lastColumn = 0; + } + } + + ptrdiff_t tmp3 = offset(); + + if (forHead->pn_kid2) { + /* Fix up the goto from top to target the loop condition. */ + MOZ_ASSERT(jmp.offset >= 0); + if (!emitLoopEntry(forHead->pn_kid2, jmp)) + return false; + + if (!emitTree(forHead->pn_kid2)) + return false; + } else if (!forHead->pn_kid3) { + // If there is no condition clause and no update clause, mark + // the loop-ending "goto" with the location of the "for". + // This ensures that the debugger will stop on each loop + // iteration. + if (!updateSourceCoordNotes(pn->pn_pos.begin)) + return false; + } + + /* Set the first note offset so we can find the loop condition. */ + if (!setSrcNoteOffset(noteIndex, 0, tmp3 - tmp)) + return false; + if (!setSrcNoteOffset(noteIndex, 1, loopInfo.continueTarget.offset - tmp)) + return false; + + /* If no loop condition, just emit a loop-closing jump. */ + JumpList beq; + JumpTarget breakTarget{ -1 }; + if (!emitBackwardJump(forHead->pn_kid2 ? JSOP_IFNE : JSOP_GOTO, top, &beq, &breakTarget)) + return false; + + /* The third note offset helps us find the loop-closing jump. */ + if (!setSrcNoteOffset(noteIndex, 2, beq.offset - tmp)) + return false; + + if (!tryNoteList.append(JSTRY_LOOP, stackDepth, top.offset, breakTarget.offset)) + return false; + + if (!loopInfo.patchBreaksAndContinues(this)) + return false; + + return true; +} + +bool +BytecodeEmitter::emitFor(ParseNode* pn, EmitterScope* headLexicalEmitterScope) +{ + MOZ_ASSERT(pn->isKind(PNK_FOR)); + + if (pn->pn_left->isKind(PNK_FORHEAD)) + return emitCStyleFor(pn, headLexicalEmitterScope); + + if (!updateLineNumberNotes(pn->pn_pos.begin)) + return false; + + if (pn->pn_left->isKind(PNK_FORIN)) + return emitForIn(pn, headLexicalEmitterScope); + + MOZ_ASSERT(pn->pn_left->isKind(PNK_FOROF)); + return emitForOf(pn, headLexicalEmitterScope); +} + +bool +BytecodeEmitter::emitComprehensionForInOrOfVariables(ParseNode* pn, bool* lexicalScope) +{ + // ES6 specifies that lexical for-loop variables get a fresh binding each + // iteration, and that evaluation of the expression looped over occurs with + // these variables dead zoned. But these rules only apply to *standard* + // for-in/of loops, and we haven't extended these requirements to + // comprehension syntax. + + *lexicalScope = pn->isKind(PNK_LEXICALSCOPE); + if (*lexicalScope) { + // This is initially-ES7-tracked syntax, now with considerably murkier + // outlook. The scope work is done by the caller by instantiating an + // EmitterScope. There's nothing to do here. + } else { + // This is legacy comprehension syntax. We'll have PNK_LET here, using + // a lexical scope provided by/for the entire comprehension. Name + // analysis assumes declarations initialize lets, but as we're handling + // this declaration manually, we must also initialize manually to avoid + // triggering dead zone checks. + MOZ_ASSERT(pn->isKind(PNK_LET)); + MOZ_ASSERT(pn->pn_count == 1); + + if (!emitDeclarationList(pn)) + return false; + } + + return true; +} + +bool +BytecodeEmitter::emitComprehensionForOf(ParseNode* pn) +{ + MOZ_ASSERT(pn->isKind(PNK_COMPREHENSIONFOR)); + + ParseNode* forHead = pn->pn_left; + MOZ_ASSERT(forHead->isKind(PNK_FOROF)); + + ParseNode* forHeadExpr = forHead->pn_kid3; + ParseNode* forBody = pn->pn_right; + + ParseNode* loopDecl = forHead->pn_kid1; + bool lexicalScope = false; + if (!emitComprehensionForInOrOfVariables(loopDecl, &lexicalScope)) + return false; + + // For-of loops run with two values on the stack: the iterator and the + // current result object. + + // Evaluate the expression to the right of 'of'. + if (!emitTree(forHeadExpr)) // EXPR + return false; + if (!emitIterator()) // ITER + return false; + + // Push a dummy result so that we properly enter iteration midstream. + if (!emit1(JSOP_UNDEFINED)) // ITER RESULT + return false; + + // Enter the block before the loop body, after evaluating the obj. + // Initialize let bindings with undefined when entering, as the name + // assigned to is a plain assignment. + TDZCheckCache tdzCache(this); + Maybe<EmitterScope> emitterScope; + ParseNode* loopVariableName; + if (lexicalScope) { + loopVariableName = parser->handler.singleBindingFromDeclaration(loopDecl->pn_expr); + emitterScope.emplace(this); + if (!emitterScope->enterComprehensionFor(this, loopDecl->scopeBindings())) + return false; + } else { + loopVariableName = parser->handler.singleBindingFromDeclaration(loopDecl); + } + + LoopControl loopInfo(this, StatementKind::ForOfLoop); + + // Jump down to the loop condition to minimize overhead assuming at least + // one iteration, as the other loop forms do. Annotate so IonMonkey can + // find the loop-closing jump. + unsigned noteIndex; + if (!newSrcNote(SRC_FOR_OF, ¬eIndex)) + return false; + JumpList jmp; + if (!emitJump(JSOP_GOTO, &jmp)) + return false; + + JumpTarget top{ -1 }; + if (!emitLoopHead(nullptr, &top)) + return false; + +#ifdef DEBUG + int loopDepth = this->stackDepth; +#endif + + // Emit code to assign result.value to the iteration variable. + if (!emit1(JSOP_DUP)) // ITER RESULT RESULT + return false; + if (!emitAtomOp(cx->names().value, JSOP_GETPROP)) // ITER RESULT VALUE + return false; + if (!emitAssignment(loopVariableName, JSOP_NOP, nullptr)) // ITER RESULT VALUE + return false; + if (!emit1(JSOP_POP)) // ITER RESULT + return false; + + // The stack should be balanced around the assignment opcode sequence. + MOZ_ASSERT(this->stackDepth == loopDepth); + + // Emit code for the loop body. + if (!emitTree(forBody)) + return false; + + // Set offset for continues. + loopInfo.continueTarget = { offset() }; + + if (!emitLoopEntry(forHeadExpr, jmp)) + return false; + + if (!emit1(JSOP_POP)) // ITER + return false; + if (!emit1(JSOP_DUP)) // ITER ITER + return false; + if (!emitIteratorNext(forHead)) // ITER RESULT + return false; + if (!emit1(JSOP_DUP)) // ITER RESULT RESULT + return false; + if (!emitAtomOp(cx->names().done, JSOP_GETPROP)) // ITER RESULT DONE? + return false; + + JumpList beq; + JumpTarget breakTarget{ -1 }; + if (!emitBackwardJump(JSOP_IFEQ, top, &beq, &breakTarget)) // ITER RESULT + return false; + + MOZ_ASSERT(this->stackDepth == loopDepth); + + // Let Ion know where the closing jump of this loop is. + if (!setSrcNoteOffset(noteIndex, 0, beq.offset - jmp.offset)) + return false; + + if (!loopInfo.patchBreaksAndContinues(this)) + return false; + + if (!tryNoteList.append(JSTRY_FOR_OF, stackDepth, top.offset, breakTarget.offset)) + return false; + + if (emitterScope) { + if (!emitterScope->leave(this)) + return false; + emitterScope.reset(); + } + + // Pop the result and the iter. + return emitUint16Operand(JSOP_POPN, 2); // +} + +bool +BytecodeEmitter::emitComprehensionForIn(ParseNode* pn) +{ + MOZ_ASSERT(pn->isKind(PNK_COMPREHENSIONFOR)); + + ParseNode* forHead = pn->pn_left; + MOZ_ASSERT(forHead->isKind(PNK_FORIN)); + + ParseNode* forBody = pn->pn_right; + + ParseNode* loopDecl = forHead->pn_kid1; + bool lexicalScope = false; + if (loopDecl && !emitComprehensionForInOrOfVariables(loopDecl, &lexicalScope)) + return false; + + // Evaluate the expression to the right of 'in'. + if (!emitTree(forHead->pn_kid3)) + return false; + + /* + * Emit a bytecode to convert top of stack value to the iterator + * object depending on the loop variant (for-in, for-each-in, or + * destructuring for-in). + */ + MOZ_ASSERT(pn->isOp(JSOP_ITER)); + if (!emit2(JSOP_ITER, (uint8_t) pn->pn_iflags)) + return false; + + // For-in loops have both the iterator and the value on the stack. Push + // undefined to balance the stack. + if (!emit1(JSOP_UNDEFINED)) + return false; + + // Enter the block before the loop body, after evaluating the obj. + // Initialize let bindings with undefined when entering, as the name + // assigned to is a plain assignment. + TDZCheckCache tdzCache(this); + Maybe<EmitterScope> emitterScope; + if (lexicalScope) { + emitterScope.emplace(this); + if (!emitterScope->enterComprehensionFor(this, loopDecl->scopeBindings())) + return false; + } + + LoopControl loopInfo(this, StatementKind::ForInLoop); + + /* Annotate so IonMonkey can find the loop-closing jump. */ + unsigned noteIndex; + if (!newSrcNote(SRC_FOR_IN, ¬eIndex)) + return false; + + /* + * Jump down to the loop condition to minimize overhead assuming at + * least one iteration, as the other loop forms do. + */ + JumpList jmp; + if (!emitJump(JSOP_GOTO, &jmp)) + return false; + + JumpTarget top{ -1 }; + if (!emitLoopHead(nullptr, &top)) + return false; + +#ifdef DEBUG + int loopDepth = this->stackDepth; +#endif + + // Emit code to assign the enumeration value to the left hand side, but + // also leave it on the stack. + if (!emitAssignment(forHead->pn_kid2, JSOP_NOP, nullptr)) + return false; + + /* The stack should be balanced around the assignment opcode sequence. */ + MOZ_ASSERT(this->stackDepth == loopDepth); + + /* Emit code for the loop body. */ + if (!emitTree(forBody)) + return false; + + // Set offset for continues. + loopInfo.continueTarget = { offset() }; + + if (!emitLoopEntry(nullptr, jmp)) + return false; + if (!emit1(JSOP_POP)) + return false; + if (!emit1(JSOP_MOREITER)) + return false; + if (!emit1(JSOP_ISNOITER)) + return false; + JumpList beq; + JumpTarget breakTarget{ -1 }; + if (!emitBackwardJump(JSOP_IFEQ, top, &beq, &breakTarget)) + return false; + + /* Set the srcnote offset so we can find the closing jump. */ + if (!setSrcNoteOffset(noteIndex, 0, beq.offset - jmp.offset)) + return false; + + if (!loopInfo.patchBreaksAndContinues(this)) + return false; + + // Pop the enumeration value. + if (!emit1(JSOP_POP)) + return false; + + JumpTarget endIter{ offset() }; + if (!tryNoteList.append(JSTRY_FOR_IN, this->stackDepth, top.offset, endIter.offset)) + return false; + if (!emit1(JSOP_ENDITER)) + return false; + + if (emitterScope) { + if (!emitterScope->leave(this)) + return false; + emitterScope.reset(); + } + + return true; +} + +bool +BytecodeEmitter::emitComprehensionFor(ParseNode* compFor) +{ + MOZ_ASSERT(compFor->pn_left->isKind(PNK_FORIN) || + compFor->pn_left->isKind(PNK_FOROF)); + + if (!updateLineNumberNotes(compFor->pn_pos.begin)) + return false; + + return compFor->pn_left->isKind(PNK_FORIN) + ? emitComprehensionForIn(compFor) + : emitComprehensionForOf(compFor); +} + +MOZ_NEVER_INLINE bool +BytecodeEmitter::emitFunction(ParseNode* pn, bool needsProto) +{ + FunctionBox* funbox = pn->pn_funbox; + RootedFunction fun(cx, funbox->function()); + RootedAtom name(cx, fun->name()); + MOZ_ASSERT_IF(fun->isInterpretedLazy(), fun->lazyScript()); + MOZ_ASSERT_IF(pn->isOp(JSOP_FUNWITHPROTO), needsProto); + + /* + * Set the |wasEmitted| flag in the funbox once the function has been + * emitted. Function definitions that need hoisting to the top of the + * function will be seen by emitFunction in two places. + */ + if (funbox->wasEmitted && pn->functionIsHoisted()) { + // Annex B block-scoped functions are hoisted like any other + // block-scoped function to the top of their scope. When their + // definitions are seen for the second time, we need to emit the + // assignment that assigns the function to the outer 'var' binding. + if (funbox->isAnnexB) { + auto emitRhs = [&name](BytecodeEmitter* bce, const NameLocation&, bool) { + // The RHS is the value of the lexically bound name in the + // innermost scope. + return bce->emitGetName(name); + }; + + // Get the location of the 'var' binding in the body scope. The + // name must be found, else there is a bug in the Annex B handling + // in Parser. + // + // In sloppy eval contexts, this location is dynamic. + Maybe<NameLocation> lhsLoc = locationOfNameBoundInScope(name, varEmitterScope); + + // If there are parameter expressions, the var name could be a + // parameter. + if (!lhsLoc && sc->isFunctionBox() && sc->asFunctionBox()->hasExtraBodyVarScope()) + lhsLoc = locationOfNameBoundInScope(name, varEmitterScope->enclosingInFrame()); + + if (!lhsLoc) { + lhsLoc = Some(NameLocation::DynamicAnnexBVar()); + } else { + MOZ_ASSERT(lhsLoc->bindingKind() == BindingKind::Var || + lhsLoc->bindingKind() == BindingKind::FormalParameter || + (lhsLoc->bindingKind() == BindingKind::Let && + sc->asFunctionBox()->hasParameterExprs)); + } + + if (!emitSetOrInitializeNameAtLocation(name, *lhsLoc, emitRhs, false)) + return false; + if (!emit1(JSOP_POP)) + return false; + } + + MOZ_ASSERT_IF(fun->hasScript(), fun->nonLazyScript()); + MOZ_ASSERT(pn->functionIsHoisted()); + return true; + } + + funbox->wasEmitted = true; + + /* + * Mark as singletons any function which will only be executed once, or + * which is inner to a lambda we only expect to run once. In the latter + * case, if the lambda runs multiple times then CloneFunctionObject will + * make a deep clone of its contents. + */ + if (fun->isInterpreted()) { + bool singleton = checkRunOnceContext(); + if (!JSFunction::setTypeForScriptedFunction(cx, fun, singleton)) + return false; + + SharedContext* outersc = sc; + if (fun->isInterpretedLazy()) { + // We need to update the static scope chain regardless of whether + // the LazyScript has already been initialized, due to the case + // where we previously successfully compiled an inner function's + // lazy script but failed to compile the outer script after the + // fact. If we attempt to compile the outer script again, the + // static scope chain will be newly allocated and will mismatch + // the previously compiled LazyScript's. + ScriptSourceObject* source = &script->sourceObject()->as<ScriptSourceObject>(); + fun->lazyScript()->setEnclosingScopeAndSource(innermostScope(), source); + if (emittingRunOnceLambda) + fun->lazyScript()->setTreatAsRunOnce(); + } else { + MOZ_ASSERT_IF(outersc->strict(), funbox->strictScript); + + // Inherit most things (principals, version, etc) from the + // parent. Use default values for the rest. + Rooted<JSScript*> parent(cx, script); + MOZ_ASSERT(parent->getVersion() == parser->options().version); + MOZ_ASSERT(parent->mutedErrors() == parser->options().mutedErrors()); + const TransitiveCompileOptions& transitiveOptions = parser->options(); + CompileOptions options(cx, transitiveOptions); + + Rooted<JSObject*> sourceObject(cx, script->sourceObject()); + Rooted<JSScript*> script(cx, JSScript::Create(cx, options, sourceObject, + funbox->bufStart, funbox->bufEnd)); + if (!script) + return false; + + BytecodeEmitter bce2(this, parser, funbox, script, /* lazyScript = */ nullptr, + pn->pn_pos, emitterMode); + if (!bce2.init()) + return false; + + /* We measured the max scope depth when we parsed the function. */ + if (!bce2.emitFunctionScript(pn->pn_body)) + return false; + + if (funbox->isLikelyConstructorWrapper()) + script->setLikelyConstructorWrapper(); + } + + if (outersc->isFunctionBox()) + outersc->asFunctionBox()->setHasInnerFunctions(); + } else { + MOZ_ASSERT(IsAsmJSModule(fun)); + } + + /* Make the function object a literal in the outer script's pool. */ + unsigned index = objectList.add(pn->pn_funbox); + + /* Non-hoisted functions simply emit their respective op. */ + if (!pn->functionIsHoisted()) { + /* JSOP_LAMBDA_ARROW is always preceded by a new.target */ + MOZ_ASSERT(fun->isArrow() == (pn->getOp() == JSOP_LAMBDA_ARROW)); + if (funbox->isAsync()) { + MOZ_ASSERT(!needsProto); + return emitAsyncWrapper(index, funbox->needsHomeObject(), fun->isArrow()); + } + + if (fun->isArrow()) { + if (sc->allowNewTarget()) { + if (!emit1(JSOP_NEWTARGET)) + return false; + } else { + if (!emit1(JSOP_NULL)) + return false; + } + } + + if (needsProto) { + MOZ_ASSERT(pn->getOp() == JSOP_FUNWITHPROTO || pn->getOp() == JSOP_LAMBDA); + pn->setOp(JSOP_FUNWITHPROTO); + } + + if (pn->getOp() == JSOP_DEFFUN) { + if (!emitIndex32(JSOP_LAMBDA, index)) + return false; + return emit1(JSOP_DEFFUN); + } + + return emitIndex32(pn->getOp(), index); + } + + MOZ_ASSERT(!needsProto); + + bool topLevelFunction; + if (sc->isFunctionBox() || (sc->isEvalContext() && sc->strict())) { + // No nested functions inside other functions are top-level. + topLevelFunction = false; + } else { + // In sloppy eval scripts, top-level functions in are accessed + // dynamically. In global and module scripts, top-level functions are + // those bound in the var scope. + NameLocation loc = lookupName(name); + topLevelFunction = loc.kind() == NameLocation::Kind::Dynamic || + loc.bindingKind() == BindingKind::Var; + } + + if (topLevelFunction) { + if (sc->isModuleContext()) { + // For modules, we record the function and instantiate the binding + // during ModuleDeclarationInstantiation(), before the script is run. + + RootedModuleObject module(cx, sc->asModuleContext()->module()); + if (!module->noteFunctionDeclaration(cx, name, fun)) + return false; + } else { + MOZ_ASSERT(sc->isGlobalContext() || sc->isEvalContext()); + MOZ_ASSERT(pn->getOp() == JSOP_NOP); + switchToPrologue(); + if (funbox->isAsync()) { + if (!emitAsyncWrapper(index, fun->isMethod(), fun->isArrow())) + return false; + } else { + if (!emitIndex32(JSOP_LAMBDA, index)) + return false; + } + if (!emit1(JSOP_DEFFUN)) + return false; + if (!updateSourceCoordNotes(pn->pn_pos.begin)) + return false; + switchToMain(); + } + } else { + // For functions nested within functions and blocks, make a lambda and + // initialize the binding name of the function in the current scope. + + bool isAsync = funbox->isAsync(); + auto emitLambda = [index, isAsync](BytecodeEmitter* bce, const NameLocation&, bool) { + if (isAsync) { + return bce->emitAsyncWrapper(index, /* needsHomeObject = */ false, + /* isArrow = */ false); + } + return bce->emitIndexOp(JSOP_LAMBDA, index); + }; + + if (!emitInitializeName(name, emitLambda)) + return false; + if (!emit1(JSOP_POP)) + return false; + } + + return true; +} + +bool +BytecodeEmitter::emitAsyncWrapperLambda(unsigned index, bool isArrow) { + if (isArrow) { + if (sc->allowNewTarget()) { + if (!emit1(JSOP_NEWTARGET)) + return false; + } else { + if (!emit1(JSOP_NULL)) + return false; + } + if (!emitIndex32(JSOP_LAMBDA_ARROW, index)) + return false; + } else { + if (!emitIndex32(JSOP_LAMBDA, index)) + return false; + } + + return true; +} + +bool +BytecodeEmitter::emitAsyncWrapper(unsigned index, bool needsHomeObject, bool isArrow) +{ + // needsHomeObject can be true for propertyList for extended class. + // In that case push both unwrapped and wrapped function, in order to + // initialize home object of unwrapped function, and set wrapped function + // as a property. + // + // lambda // unwrapped + // dup // unwrapped unwrapped + // toasync // unwrapped wrapped + // + // Emitted code is surrounded by the following code. + // + // // classObj classCtor classProto + // (emitted code) // classObj classCtor classProto unwrapped wrapped + // swap // classObj classCtor classProto wrapped unwrapped + // inithomeobject 1 // classObj classCtor classProto wrapped unwrapped + // // initialize the home object of unwrapped + // // with classProto here + // pop // classObj classCtor classProto wrapped + // inithiddenprop // classObj classCtor classProto wrapped + // // initialize the property of the classProto + // // with wrapped function here + // pop // classObj classCtor classProto + // + // needsHomeObject is false for other cases, push wrapped function only. + if (!emitAsyncWrapperLambda(index, isArrow)) + return false; + if (needsHomeObject) { + if (!emit1(JSOP_DUP)) + return false; + } + if (!emit1(JSOP_TOASYNC)) + return false; + return true; +} + +bool +BytecodeEmitter::emitDo(ParseNode* pn) +{ + /* Emit an annotated nop so IonBuilder can recognize the 'do' loop. */ + unsigned noteIndex; + if (!newSrcNote(SRC_WHILE, ¬eIndex)) + return false; + if (!emit1(JSOP_NOP)) + return false; + + unsigned noteIndex2; + if (!newSrcNote(SRC_WHILE, ¬eIndex2)) + return false; + + /* Compile the loop body. */ + JumpTarget top; + if (!emitLoopHead(pn->pn_left, &top)) + return false; + + LoopControl loopInfo(this, StatementKind::DoLoop); + + JumpList empty; + if (!emitLoopEntry(nullptr, empty)) + return false; + + if (!emitTree(pn->pn_left)) + return false; + + // Set the offset for continues. + if (!emitJumpTarget(&loopInfo.continueTarget)) + return false; + + /* Compile the loop condition, now that continues know where to go. */ + if (!emitTree(pn->pn_right)) + return false; + + JumpList beq; + JumpTarget breakTarget{ -1 }; + if (!emitBackwardJump(JSOP_IFNE, top, &beq, &breakTarget)) + return false; + + if (!tryNoteList.append(JSTRY_LOOP, stackDepth, top.offset, breakTarget.offset)) + return false; + + /* + * Update the annotations with the update and back edge positions, for + * IonBuilder. + * + * Be careful: We must set noteIndex2 before noteIndex in case the noteIndex + * note gets bigger. + */ + if (!setSrcNoteOffset(noteIndex2, 0, beq.offset - top.offset)) + return false; + if (!setSrcNoteOffset(noteIndex, 0, 1 + (loopInfo.continueTarget.offset - top.offset))) + return false; + + if (!loopInfo.patchBreaksAndContinues(this)) + return false; + + return true; +} + +bool +BytecodeEmitter::emitWhile(ParseNode* pn) +{ + /* + * Minimize bytecodes issued for one or more iterations by jumping to + * the condition below the body and closing the loop if the condition + * is true with a backward branch. For iteration count i: + * + * i test at the top test at the bottom + * = =============== ================== + * 0 ifeq-pass goto; ifne-fail + * 1 ifeq-fail; goto; ifne-pass goto; ifne-pass; ifne-fail + * 2 2*(ifeq-fail; goto); ifeq-pass goto; 2*ifne-pass; ifne-fail + * . . . + * N N*(ifeq-fail; goto); ifeq-pass goto; N*ifne-pass; ifne-fail + */ + + // If we have a single-line while, like "while (x) ;", we want to + // emit the line note before the initial goto, so that the + // debugger sees a single entry point. This way, if there is a + // breakpoint on the line, it will only fire once; and "next"ing + // will skip the whole loop. However, for the multi-line case we + // want to emit the line note after the initial goto, so that + // "cont" stops on each iteration -- but without a stop before the + // first iteration. + if (parser->tokenStream.srcCoords.lineNum(pn->pn_pos.begin) == + parser->tokenStream.srcCoords.lineNum(pn->pn_pos.end) && + !updateSourceCoordNotes(pn->pn_pos.begin)) + return false; + + JumpTarget top{ -1 }; + if (!emitJumpTarget(&top)) + return false; + + LoopControl loopInfo(this, StatementKind::WhileLoop); + loopInfo.continueTarget = top; + + unsigned noteIndex; + if (!newSrcNote(SRC_WHILE, ¬eIndex)) + return false; + + JumpList jmp; + if (!emitJump(JSOP_GOTO, &jmp)) + return false; + + if (!emitLoopHead(pn->pn_right, &top)) + return false; + + if (!emitConditionallyExecutedTree(pn->pn_right)) + return false; + + if (!emitLoopEntry(pn->pn_left, jmp)) + return false; + if (!emitTree(pn->pn_left)) + return false; + + JumpList beq; + JumpTarget breakTarget{ -1 }; + if (!emitBackwardJump(JSOP_IFNE, top, &beq, &breakTarget)) + return false; + + if (!tryNoteList.append(JSTRY_LOOP, stackDepth, top.offset, breakTarget.offset)) + return false; + + if (!setSrcNoteOffset(noteIndex, 0, beq.offset - jmp.offset)) + return false; + + if (!loopInfo.patchBreaksAndContinues(this)) + return false; + + return true; +} + +bool +BytecodeEmitter::emitBreak(PropertyName* label) +{ + BreakableControl* target; + SrcNoteType noteType; + if (label) { + // Any statement with the matching label may be the break target. + auto hasSameLabel = [label](LabelControl* labelControl) { + return labelControl->label() == label; + }; + target = findInnermostNestableControl<LabelControl>(hasSameLabel); + noteType = SRC_BREAK2LABEL; + } else { + auto isNotLabel = [](BreakableControl* control) { + return !control->is<LabelControl>(); + }; + target = findInnermostNestableControl<BreakableControl>(isNotLabel); + noteType = (target->kind() == StatementKind::Switch) ? SRC_SWITCHBREAK : SRC_BREAK; + } + + return emitGoto(target, &target->breaks, noteType); +} + +bool +BytecodeEmitter::emitContinue(PropertyName* label) +{ + LoopControl* target = nullptr; + if (label) { + // Find the loop statement enclosed by the matching label. + NestableControl* control = innermostNestableControl; + while (!control->is<LabelControl>() || control->as<LabelControl>().label() != label) { + if (control->is<LoopControl>()) + target = &control->as<LoopControl>(); + control = control->enclosing(); + } + } else { + target = findInnermostNestableControl<LoopControl>(); + } + return emitGoto(target, &target->continues, SRC_CONTINUE); +} + +bool +BytecodeEmitter::emitGetFunctionThis(ParseNode* pn) +{ + MOZ_ASSERT(sc->thisBinding() == ThisBinding::Function); + MOZ_ASSERT(pn->isKind(PNK_NAME)); + MOZ_ASSERT(pn->name() == cx->names().dotThis); + + if (!emitTree(pn)) + return false; + if (sc->needsThisTDZChecks() && !emit1(JSOP_CHECKTHIS)) + return false; + + return true; +} + +bool +BytecodeEmitter::emitGetThisForSuperBase(ParseNode* pn) +{ + MOZ_ASSERT(pn->isKind(PNK_SUPERBASE)); + return emitGetFunctionThis(pn->pn_kid); +} + +bool +BytecodeEmitter::emitThisLiteral(ParseNode* pn) +{ + MOZ_ASSERT(pn->isKind(PNK_THIS)); + + if (ParseNode* thisName = pn->pn_kid) + return emitGetFunctionThis(thisName); + + if (sc->thisBinding() == ThisBinding::Module) + return emit1(JSOP_UNDEFINED); + + MOZ_ASSERT(sc->thisBinding() == ThisBinding::Global); + return emit1(JSOP_GLOBALTHIS); +} + +bool +BytecodeEmitter::emitCheckDerivedClassConstructorReturn() +{ + MOZ_ASSERT(lookupName(cx->names().dotThis).hasKnownSlot()); + if (!emitGetName(cx->names().dotThis)) + return false; + if (!emit1(JSOP_CHECKRETURN)) + return false; + return true; +} + +bool +BytecodeEmitter::emitReturn(ParseNode* pn) +{ + if (!updateSourceCoordNotes(pn->pn_pos.begin)) + return false; + + if (sc->isFunctionBox() && sc->asFunctionBox()->isStarGenerator()) { + if (!emitPrepareIteratorResult()) + return false; + } + + /* Push a return value */ + if (ParseNode* pn2 = pn->pn_kid) { + if (!emitTree(pn2)) + return false; + } else { + /* No explicit return value provided */ + if (!emit1(JSOP_UNDEFINED)) + return false; + } + + if (sc->isFunctionBox() && sc->asFunctionBox()->isStarGenerator()) { + if (!emitFinishIteratorResult(true)) + return false; + } + + // We know functionBodyEndPos is set because "return" is only + // valid in a function, and so we've passed through + // emitFunctionScript. + MOZ_ASSERT(functionBodyEndPosSet); + if (!updateSourceCoordNotes(functionBodyEndPos)) + return false; + + /* + * EmitNonLocalJumpFixup may add fixup bytecode to close open try + * blocks having finally clauses and to exit intermingled let blocks. + * We can't simply transfer control flow to our caller in that case, + * because we must gosub to those finally clauses from inner to outer, + * with the correct stack pointer (i.e., after popping any with, + * for/in, etc., slots nested inside the finally's try). + * + * In this case we mutate JSOP_RETURN into JSOP_SETRVAL and add an + * extra JSOP_RETRVAL after the fixups. + */ + ptrdiff_t top = offset(); + + bool isGenerator = sc->isFunctionBox() && sc->asFunctionBox()->isGenerator(); + bool isDerivedClassConstructor = + sc->isFunctionBox() && sc->asFunctionBox()->isDerivedClassConstructor(); + + if (!emit1((isGenerator || isDerivedClassConstructor) ? JSOP_SETRVAL : JSOP_RETURN)) + return false; + + // Make sure that we emit this before popping the blocks in prepareForNonLocalJump, + // to ensure that the error is thrown while the scope-chain is still intact. + if (isDerivedClassConstructor) { + if (!emitCheckDerivedClassConstructorReturn()) + return false; + } + + NonLocalExitControl nle(this); + + if (!nle.prepareForNonLocalJumpToOutermost()) + return false; + + if (isGenerator) { + // We know that .generator is on the function scope, as we just exited + // all nested scopes. + NameLocation loc = + *locationOfNameBoundInFunctionScope(cx->names().dotGenerator, varEmitterScope); + if (!emitGetNameAtLocation(cx->names().dotGenerator, loc)) + return false; + if (!emitYieldOp(JSOP_FINALYIELDRVAL)) + return false; + } else if (isDerivedClassConstructor) { + MOZ_ASSERT(code()[top] == JSOP_SETRVAL); + if (!emit1(JSOP_RETRVAL)) + return false; + } else if (top + static_cast<ptrdiff_t>(JSOP_RETURN_LENGTH) != offset()) { + code()[top] = JSOP_SETRVAL; + if (!emit1(JSOP_RETRVAL)) + return false; + } + + return true; +} + +bool +BytecodeEmitter::emitYield(ParseNode* pn) +{ + MOZ_ASSERT(sc->isFunctionBox()); + + if (pn->getOp() == JSOP_YIELD) { + if (sc->asFunctionBox()->isStarGenerator()) { + if (!emitPrepareIteratorResult()) + return false; + } + if (pn->pn_left) { + if (!emitTree(pn->pn_left)) + return false; + } else { + if (!emit1(JSOP_UNDEFINED)) + return false; + } + if (sc->asFunctionBox()->isStarGenerator()) { + if (!emitFinishIteratorResult(false)) + return false; + } + } else { + MOZ_ASSERT(pn->getOp() == JSOP_INITIALYIELD); + } + + if (!emitTree(pn->pn_right)) + return false; + + if (!emitYieldOp(pn->getOp())) + return false; + + if (pn->getOp() == JSOP_INITIALYIELD && !emit1(JSOP_POP)) + return false; + + return true; +} + +bool +BytecodeEmitter::emitYieldStar(ParseNode* iter, ParseNode* gen) +{ + MOZ_ASSERT(sc->isFunctionBox()); + MOZ_ASSERT(sc->asFunctionBox()->isStarGenerator()); + + if (!emitTree(iter)) // ITERABLE + return false; + if (!emitIterator()) // ITER + return false; + + // Initial send value is undefined. + if (!emit1(JSOP_UNDEFINED)) // ITER RECEIVED + return false; + + int depth = stackDepth; + MOZ_ASSERT(depth >= 2); + + JumpList send; + if (!emitJump(JSOP_GOTO, &send)) // goto send + return false; + + // Try prologue. // ITER RESULT + unsigned noteIndex; + if (!newSrcNote(SRC_TRY, ¬eIndex)) + return false; + JumpTarget tryStart{ offset() }; + if (!emit1(JSOP_TRY)) // tryStart: + return false; + MOZ_ASSERT(this->stackDepth == depth); + + // Load the generator object. + if (!emitTree(gen)) // ITER RESULT GENOBJ + return false; + + // Yield RESULT as-is, without re-boxing. + if (!emitYieldOp(JSOP_YIELD)) // ITER RECEIVED + return false; + + // Try epilogue. + if (!setSrcNoteOffset(noteIndex, 0, offset() - tryStart.offset)) + return false; + if (!emitJump(JSOP_GOTO, &send)) // goto send + return false; + + JumpTarget tryEnd; + if (!emitJumpTarget(&tryEnd)) // tryEnd: + return false; + + // Catch location. + stackDepth = uint32_t(depth); // ITER RESULT + if (!emit1(JSOP_POP)) // ITER + return false; + // THROW? = 'throw' in ITER + if (!emit1(JSOP_EXCEPTION)) // ITER EXCEPTION + return false; + if (!emit1(JSOP_SWAP)) // EXCEPTION ITER + return false; + if (!emit1(JSOP_DUP)) // EXCEPTION ITER ITER + return false; + if (!emitAtomOp(cx->names().throw_, JSOP_STRING)) // EXCEPTION ITER ITER "throw" + return false; + if (!emit1(JSOP_SWAP)) // EXCEPTION ITER "throw" ITER + return false; + if (!emit1(JSOP_IN)) // EXCEPTION ITER THROW? + return false; + // if (THROW?) goto delegate + JumpList checkThrow; + if (!emitJump(JSOP_IFNE, &checkThrow)) // EXCEPTION ITER + return false; + if (!emit1(JSOP_POP)) // EXCEPTION + return false; + if (!emit1(JSOP_THROW)) // throw EXCEPTION + return false; + + if (!emitJumpTargetAndPatch(checkThrow)) // delegate: + return false; + // RESULT = ITER.throw(EXCEPTION) // EXCEPTION ITER + stackDepth = uint32_t(depth); + if (!emit1(JSOP_DUP)) // EXCEPTION ITER ITER + return false; + if (!emit1(JSOP_DUP)) // EXCEPTION ITER ITER ITER + return false; + if (!emitAtomOp(cx->names().throw_, JSOP_CALLPROP)) // EXCEPTION ITER ITER THROW + return false; + if (!emit1(JSOP_SWAP)) // EXCEPTION ITER THROW ITER + return false; + if (!emit2(JSOP_PICK, 3)) // ITER THROW ITER EXCEPTION + return false; + if (!emitCall(JSOP_CALL, 1, iter)) // ITER RESULT + return false; + checkTypeSet(JSOP_CALL); + MOZ_ASSERT(this->stackDepth == depth); + JumpList checkResult; + if (!emitJump(JSOP_GOTO, &checkResult)) // goto checkResult + return false; + + // Catch epilogue. + + // This is a peace offering to ReconstructPCStack. See the note in EmitTry. + if (!emit1(JSOP_NOP)) + return false; + if (!tryNoteList.append(JSTRY_CATCH, depth, tryStart.offset + JSOP_TRY_LENGTH, tryEnd.offset)) + return false; + + // After the try/catch block: send the received value to the iterator. + if (!emitJumpTargetAndPatch(send)) // send: + return false; + + // Send location. + // result = iter.next(received) // ITER RECEIVED + if (!emit1(JSOP_SWAP)) // RECEIVED ITER + return false; + if (!emit1(JSOP_DUP)) // RECEIVED ITER ITER + return false; + if (!emit1(JSOP_DUP)) // RECEIVED ITER ITER ITER + return false; + if (!emitAtomOp(cx->names().next, JSOP_CALLPROP)) // RECEIVED ITER ITER NEXT + return false; + if (!emit1(JSOP_SWAP)) // RECEIVED ITER NEXT ITER + return false; + if (!emit2(JSOP_PICK, 3)) // ITER NEXT ITER RECEIVED + return false; + if (!emitCall(JSOP_CALL, 1, iter)) // ITER RESULT + return false; + if (!emitCheckIsObj(CheckIsObjectKind::IteratorNext)) // ITER RESULT + return false; + checkTypeSet(JSOP_CALL); + MOZ_ASSERT(this->stackDepth == depth); + + if (!emitJumpTargetAndPatch(checkResult)) // checkResult: + return false; + + // if (!result.done) goto tryStart; // ITER RESULT + if (!emit1(JSOP_DUP)) // ITER RESULT RESULT + return false; + if (!emitAtomOp(cx->names().done, JSOP_GETPROP)) // ITER RESULT DONE + return false; + // if (!DONE) goto tryStart; + JumpList beq; + JumpTarget breakTarget{ -1 }; + if (!emitBackwardJump(JSOP_IFEQ, tryStart, &beq, &breakTarget)) // ITER RESULT + return false; + + // result.value + if (!emit1(JSOP_SWAP)) // RESULT ITER + return false; + if (!emit1(JSOP_POP)) // RESULT + return false; + if (!emitAtomOp(cx->names().value, JSOP_GETPROP)) // VALUE + return false; + + MOZ_ASSERT(this->stackDepth == depth - 1); + + return true; +} + +bool +BytecodeEmitter::emitStatementList(ParseNode* pn) +{ + MOZ_ASSERT(pn->isArity(PN_LIST)); + for (ParseNode* pn2 = pn->pn_head; pn2; pn2 = pn2->pn_next) { + if (!emitTree(pn2)) + return false; + } + return true; +} + +bool +BytecodeEmitter::emitStatement(ParseNode* pn) +{ + MOZ_ASSERT(pn->isKind(PNK_SEMI)); + + ParseNode* pn2 = pn->pn_kid; + if (!pn2) + return true; + + if (!updateSourceCoordNotes(pn->pn_pos.begin)) + return false; + + /* + * Top-level or called-from-a-native JS_Execute/EvaluateScript, + * debugger, and eval frames may need the value of the ultimate + * expression statement as the script's result, despite the fact + * that it appears useless to the compiler. + * + * API users may also set the JSOPTION_NO_SCRIPT_RVAL option when + * calling JS_Compile* to suppress JSOP_SETRVAL. + */ + bool wantval = false; + bool useful = false; + if (sc->isFunctionBox()) + MOZ_ASSERT(!script->noScriptRval()); + else + useful = wantval = !script->noScriptRval(); + + /* Don't eliminate expressions with side effects. */ + if (!useful) { + if (!checkSideEffects(pn2, &useful)) + return false; + + /* + * Don't eliminate apparently useless expressions if they are labeled + * expression statements. The startOffset() test catches the case + * where we are nesting in emitTree for a labeled compound statement. + */ + if (innermostNestableControl && + innermostNestableControl->is<LabelControl>() && + innermostNestableControl->as<LabelControl>().startOffset() >= offset()) + { + useful = true; + } + } + + if (useful) { + JSOp op = wantval ? JSOP_SETRVAL : JSOP_POP; + MOZ_ASSERT_IF(pn2->isKind(PNK_ASSIGN), pn2->isOp(JSOP_NOP)); + if (!emitTree(pn2)) + return false; + if (!emit1(op)) + return false; + } else if (pn->isDirectivePrologueMember()) { + // Don't complain about directive prologue members; just don't emit + // their code. + } else { + if (JSAtom* atom = pn->isStringExprStatement()) { + // Warn if encountering a non-directive prologue member string + // expression statement, that is inconsistent with the current + // directive prologue. That is, a script *not* starting with + // "use strict" should warn for any "use strict" statements seen + // later in the script, because such statements are misleading. + const char* directive = nullptr; + if (atom == cx->names().useStrict) { + if (!sc->strictScript) + directive = js_useStrict_str; + } else if (atom == cx->names().useAsm) { + if (sc->isFunctionBox()) { + if (IsAsmJSModule(sc->asFunctionBox()->function())) + directive = js_useAsm_str; + } + } + + if (directive) { + if (!reportStrictWarning(pn2, JSMSG_CONTRARY_NONDIRECTIVE, directive)) + return false; + } + } else { + current->currentLine = parser->tokenStream.srcCoords.lineNum(pn2->pn_pos.begin); + current->lastColumn = 0; + if (!reportStrictWarning(pn2, JSMSG_USELESS_EXPR)) + return false; + } + } + + return true; +} + +bool +BytecodeEmitter::emitDeleteName(ParseNode* node) +{ + MOZ_ASSERT(node->isKind(PNK_DELETENAME)); + MOZ_ASSERT(node->isArity(PN_UNARY)); + + ParseNode* nameExpr = node->pn_kid; + MOZ_ASSERT(nameExpr->isKind(PNK_NAME)); + + return emitAtomOp(nameExpr, JSOP_DELNAME); +} + +bool +BytecodeEmitter::emitDeleteProperty(ParseNode* node) +{ + MOZ_ASSERT(node->isKind(PNK_DELETEPROP)); + MOZ_ASSERT(node->isArity(PN_UNARY)); + + ParseNode* propExpr = node->pn_kid; + MOZ_ASSERT(propExpr->isKind(PNK_DOT)); + + if (propExpr->as<PropertyAccess>().isSuper()) { + // Still have to calculate the base, even though we are are going + // to throw unconditionally, as calculating the base could also + // throw. + if (!emit1(JSOP_SUPERBASE)) + return false; + + return emitUint16Operand(JSOP_THROWMSG, JSMSG_CANT_DELETE_SUPER); + } + + JSOp delOp = sc->strict() ? JSOP_STRICTDELPROP : JSOP_DELPROP; + return emitPropOp(propExpr, delOp); +} + +bool +BytecodeEmitter::emitDeleteElement(ParseNode* node) +{ + MOZ_ASSERT(node->isKind(PNK_DELETEELEM)); + MOZ_ASSERT(node->isArity(PN_UNARY)); + + ParseNode* elemExpr = node->pn_kid; + MOZ_ASSERT(elemExpr->isKind(PNK_ELEM)); + + if (elemExpr->as<PropertyByValue>().isSuper()) { + // Still have to calculate everything, even though we're gonna throw + // since it may have side effects + if (!emitTree(elemExpr->pn_right)) + return false; + + if (!emit1(JSOP_SUPERBASE)) + return false; + if (!emitUint16Operand(JSOP_THROWMSG, JSMSG_CANT_DELETE_SUPER)) + return false; + + // Another wrinkle: Balance the stack from the emitter's point of view. + // Execution will not reach here, as the last bytecode threw. + return emit1(JSOP_POP); + } + + JSOp delOp = sc->strict() ? JSOP_STRICTDELELEM : JSOP_DELELEM; + return emitElemOp(elemExpr, delOp); +} + +bool +BytecodeEmitter::emitDeleteExpression(ParseNode* node) +{ + MOZ_ASSERT(node->isKind(PNK_DELETEEXPR)); + MOZ_ASSERT(node->isArity(PN_UNARY)); + + ParseNode* expression = node->pn_kid; + + // If useless, just emit JSOP_TRUE; otherwise convert |delete <expr>| to + // effectively |<expr>, true|. + bool useful = false; + if (!checkSideEffects(expression, &useful)) + return false; + + if (useful) { + if (!emitTree(expression)) + return false; + if (!emit1(JSOP_POP)) + return false; + } + + return emit1(JSOP_TRUE); +} + +static const char * +SelfHostedCallFunctionName(JSAtom* name, ExclusiveContext* cx) +{ + if (name == cx->names().callFunction) + return "callFunction"; + if (name == cx->names().callContentFunction) + return "callContentFunction"; + if (name == cx->names().constructContentFunction) + return "constructContentFunction"; + + MOZ_CRASH("Unknown self-hosted call function name"); +} + +bool +BytecodeEmitter::emitSelfHostedCallFunction(ParseNode* pn) +{ + // Special-casing of callFunction to emit bytecode that directly + // invokes the callee with the correct |this| object and arguments. + // callFunction(fun, thisArg, arg0, arg1) thus becomes: + // - emit lookup for fun + // - emit lookup for thisArg + // - emit lookups for arg0, arg1 + // + // argc is set to the amount of actually emitted args and the + // emitting of args below is disabled by setting emitArgs to false. + ParseNode* pn2 = pn->pn_head; + const char* errorName = SelfHostedCallFunctionName(pn2->name(), cx); + + if (pn->pn_count < 3) { + reportError(pn, JSMSG_MORE_ARGS_NEEDED, errorName, "2", "s"); + return false; + } + + JSOp callOp = pn->getOp(); + if (callOp != JSOP_CALL) { + reportError(pn, JSMSG_NOT_CONSTRUCTOR, errorName); + return false; + } + + bool constructing = pn2->name() == cx->names().constructContentFunction; + ParseNode* funNode = pn2->pn_next; + if (constructing) + callOp = JSOP_NEW; + else if (funNode->getKind() == PNK_NAME && funNode->name() == cx->names().std_Function_apply) + callOp = JSOP_FUNAPPLY; + + if (!emitTree(funNode)) + return false; + +#ifdef DEBUG + if (emitterMode == BytecodeEmitter::SelfHosting && + pn2->name() == cx->names().callFunction) + { + if (!emit1(JSOP_DEBUGCHECKSELFHOSTED)) + return false; + } +#endif + + ParseNode* thisOrNewTarget = funNode->pn_next; + if (constructing) { + // Save off the new.target value, but here emit a proper |this| for a + // constructing call. + if (!emit1(JSOP_IS_CONSTRUCTING)) + return false; + } else { + // It's |this|, emit it. + if (!emitTree(thisOrNewTarget)) + return false; + } + + for (ParseNode* argpn = thisOrNewTarget->pn_next; argpn; argpn = argpn->pn_next) { + if (!emitTree(argpn)) + return false; + } + + if (constructing) { + if (!emitTree(thisOrNewTarget)) + return false; + } + + uint32_t argc = pn->pn_count - 3; + if (!emitCall(callOp, argc)) + return false; + + checkTypeSet(callOp); + return true; +} + +bool +BytecodeEmitter::emitSelfHostedResumeGenerator(ParseNode* pn) +{ + // Syntax: resumeGenerator(gen, value, 'next'|'throw'|'close') + if (pn->pn_count != 4) { + reportError(pn, JSMSG_MORE_ARGS_NEEDED, "resumeGenerator", "1", "s"); + return false; + } + + ParseNode* funNode = pn->pn_head; // The resumeGenerator node. + + ParseNode* genNode = funNode->pn_next; + if (!emitTree(genNode)) + return false; + + ParseNode* valNode = genNode->pn_next; + if (!emitTree(valNode)) + return false; + + ParseNode* kindNode = valNode->pn_next; + MOZ_ASSERT(kindNode->isKind(PNK_STRING)); + uint16_t operand = GeneratorObject::getResumeKind(cx, kindNode->pn_atom); + MOZ_ASSERT(!kindNode->pn_next); + + if (!emitCall(JSOP_RESUME, operand)) + return false; + + return true; +} + +bool +BytecodeEmitter::emitSelfHostedForceInterpreter(ParseNode* pn) +{ + if (!emit1(JSOP_FORCEINTERPRETER)) + return false; + if (!emit1(JSOP_UNDEFINED)) + return false; + return true; +} + +bool +BytecodeEmitter::emitSelfHostedAllowContentSpread(ParseNode* pn) +{ + if (pn->pn_count != 2) { + reportError(pn, JSMSG_MORE_ARGS_NEEDED, "allowContentSpread", "1", ""); + return false; + } + + // We're just here as a sentinel. Pass the value through directly. + return emitTree(pn->pn_head->pn_next); +} + +bool +BytecodeEmitter::isRestParameter(ParseNode* pn, bool* result) +{ + if (!sc->isFunctionBox()) { + *result = false; + return true; + } + + FunctionBox* funbox = sc->asFunctionBox(); + RootedFunction fun(cx, funbox->function()); + if (!fun->hasRest()) { + *result = false; + return true; + } + + if (!pn->isKind(PNK_NAME)) { + if (emitterMode == BytecodeEmitter::SelfHosting && pn->isKind(PNK_CALL)) { + ParseNode* pn2 = pn->pn_head; + if (pn2->getKind() == PNK_NAME && pn2->name() == cx->names().allowContentSpread) + return isRestParameter(pn2->pn_next, result); + } + *result = false; + return true; + } + + JSAtom* name = pn->name(); + Maybe<NameLocation> paramLoc = locationOfNameBoundInFunctionScope(name); + if (paramLoc && lookupName(name) == *paramLoc) { + FunctionScope::Data* bindings = funbox->functionScopeBindings(); + if (bindings->nonPositionalFormalStart > 0) { + // |paramName| can be nullptr when the rest destructuring syntax is + // used: `function f(...[]) {}`. + JSAtom* paramName = bindings->names[bindings->nonPositionalFormalStart - 1].name(); + *result = paramName && name == paramName; + return true; + } + } + + return true; +} + +bool +BytecodeEmitter::emitOptimizeSpread(ParseNode* arg0, JumpList* jmp, bool* emitted) +{ + // Emit a pereparation code to optimize the spread call with a rest + // parameter: + // + // function f(...args) { + // g(...args); + // } + // + // If the spread operand is a rest parameter and it's optimizable array, + // skip spread operation and pass it directly to spread call operation. + // See the comment in OptimizeSpreadCall in Interpreter.cpp for the + // optimizable conditons. + bool result = false; + if (!isRestParameter(arg0, &result)) + return false; + + if (!result) { + *emitted = false; + return true; + } + + if (!emitTree(arg0)) + return false; + + if (!emit1(JSOP_OPTIMIZE_SPREADCALL)) + return false; + + if (!emitJump(JSOP_IFNE, jmp)) + return false; + + if (!emit1(JSOP_POP)) + return false; + + *emitted = true; + return true; +} + +bool +BytecodeEmitter::emitCallOrNew(ParseNode* pn) +{ + bool callop = pn->isKind(PNK_CALL) || pn->isKind(PNK_TAGGED_TEMPLATE); + /* + * Emit callable invocation or operator new (constructor call) code. + * First, emit code for the left operand to evaluate the callable or + * constructable object expression. + * + * For operator new, we emit JSOP_GETPROP instead of JSOP_CALLPROP, etc. + * This is necessary to interpose the lambda-initialized method read + * barrier -- see the code in jsinterp.cpp for JSOP_LAMBDA followed by + * JSOP_{SET,INIT}PROP. + * + * Then (or in a call case that has no explicit reference-base + * object) we emit JSOP_UNDEFINED to produce the undefined |this| + * value required for calls (which non-strict mode functions + * will box into the global object). + */ + uint32_t argc = pn->pn_count - 1; + + if (argc >= ARGC_LIMIT) { + parser->tokenStream.reportError(callop + ? JSMSG_TOO_MANY_FUN_ARGS + : JSMSG_TOO_MANY_CON_ARGS); + return false; + } + + ParseNode* pn2 = pn->pn_head; + bool spread = JOF_OPTYPE(pn->getOp()) == JOF_BYTE; + switch (pn2->getKind()) { + case PNK_NAME: + if (emitterMode == BytecodeEmitter::SelfHosting && !spread) { + // Calls to "forceInterpreter", "callFunction", + // "callContentFunction", or "resumeGenerator" in self-hosted + // code generate inline bytecode. + if (pn2->name() == cx->names().callFunction || + pn2->name() == cx->names().callContentFunction || + pn2->name() == cx->names().constructContentFunction) + { + return emitSelfHostedCallFunction(pn); + } + if (pn2->name() == cx->names().resumeGenerator) + return emitSelfHostedResumeGenerator(pn); + if (pn2->name() == cx->names().forceInterpreter) + return emitSelfHostedForceInterpreter(pn); + if (pn2->name() == cx->names().allowContentSpread) + return emitSelfHostedAllowContentSpread(pn); + // Fall through. + } + if (!emitGetName(pn2, callop)) + return false; + break; + case PNK_DOT: + MOZ_ASSERT(emitterMode != BytecodeEmitter::SelfHosting); + if (pn2->as<PropertyAccess>().isSuper()) { + if (!emitSuperPropOp(pn2, JSOP_GETPROP_SUPER, /* isCall = */ callop)) + return false; + } else { + if (!emitPropOp(pn2, callop ? JSOP_CALLPROP : JSOP_GETPROP)) + return false; + } + + break; + case PNK_ELEM: + MOZ_ASSERT(emitterMode != BytecodeEmitter::SelfHosting); + if (pn2->as<PropertyByValue>().isSuper()) { + if (!emitSuperElemOp(pn2, JSOP_GETELEM_SUPER, /* isCall = */ callop)) + return false; + } else { + if (!emitElemOp(pn2, callop ? JSOP_CALLELEM : JSOP_GETELEM)) + return false; + if (callop) { + if (!emit1(JSOP_SWAP)) + return false; + } + } + + break; + case PNK_FUNCTION: + /* + * Top level lambdas which are immediately invoked should be + * treated as only running once. Every time they execute we will + * create new types and scripts for their contents, to increase + * the quality of type information within them and enable more + * backend optimizations. Note that this does not depend on the + * lambda being invoked at most once (it may be named or be + * accessed via foo.caller indirection), as multiple executions + * will just cause the inner scripts to be repeatedly cloned. + */ + MOZ_ASSERT(!emittingRunOnceLambda); + if (checkRunOnceContext()) { + emittingRunOnceLambda = true; + if (!emitTree(pn2)) + return false; + emittingRunOnceLambda = false; + } else { + if (!emitTree(pn2)) + return false; + } + callop = false; + break; + case PNK_SUPERBASE: + MOZ_ASSERT(pn->isKind(PNK_SUPERCALL)); + MOZ_ASSERT(parser->handler.isSuperBase(pn2)); + if (!emit1(JSOP_SUPERFUN)) + return false; + break; + default: + if (!emitTree(pn2)) + return false; + callop = false; /* trigger JSOP_UNDEFINED after */ + break; + } + + bool isNewOp = pn->getOp() == JSOP_NEW || pn->getOp() == JSOP_SPREADNEW || + pn->getOp() == JSOP_SUPERCALL || pn->getOp() == JSOP_SPREADSUPERCALL; + + + // Emit room for |this|. + if (!callop) { + if (isNewOp) { + if (!emit1(JSOP_IS_CONSTRUCTING)) + return false; + } else { + if (!emit1(JSOP_UNDEFINED)) + return false; + } + } + + /* + * Emit code for each argument in order, then emit the JSOP_*CALL or + * JSOP_NEW bytecode with a two-byte immediate telling how many args + * were pushed on the operand stack. + */ + if (!spread) { + for (ParseNode* pn3 = pn2->pn_next; pn3; pn3 = pn3->pn_next) { + if (!emitTree(pn3)) + return false; + } + + if (isNewOp) { + if (pn->isKind(PNK_SUPERCALL)) { + if (!emit1(JSOP_NEWTARGET)) + return false; + } else { + // Repush the callee as new.target + if (!emitDupAt(argc + 1)) + return false; + } + } + } else { + ParseNode* args = pn2->pn_next; + JumpList jmp; + bool optCodeEmitted = false; + if (argc == 1) { + if (!emitOptimizeSpread(args->pn_kid, &jmp, &optCodeEmitted)) + return false; + } + + if (!emitArray(args, argc, JSOP_SPREADCALLARRAY)) + return false; + + if (optCodeEmitted) { + if (!emitJumpTargetAndPatch(jmp)) + return false; + } + + if (isNewOp) { + if (pn->isKind(PNK_SUPERCALL)) { + if (!emit1(JSOP_NEWTARGET)) + return false; + } else { + if (!emitDupAt(2)) + return false; + } + } + } + + if (!spread) { + if (!emitCall(pn->getOp(), argc, pn)) + return false; + } else { + if (!emit1(pn->getOp())) + return false; + } + checkTypeSet(pn->getOp()); + if (pn->isOp(JSOP_EVAL) || + pn->isOp(JSOP_STRICTEVAL) || + pn->isOp(JSOP_SPREADEVAL) || + pn->isOp(JSOP_STRICTSPREADEVAL)) + { + uint32_t lineNum = parser->tokenStream.srcCoords.lineNum(pn->pn_pos.begin); + if (!emitUint32Operand(JSOP_LINENO, lineNum)) + return false; + } + + return true; +} + +bool +BytecodeEmitter::emitRightAssociative(ParseNode* pn) +{ + // ** is the only right-associative operator. + MOZ_ASSERT(pn->isKind(PNK_POW)); + MOZ_ASSERT(pn->isArity(PN_LIST)); + + // Right-associative operator chain. + for (ParseNode* subexpr = pn->pn_head; subexpr; subexpr = subexpr->pn_next) { + if (!emitTree(subexpr)) + return false; + } + for (uint32_t i = 0; i < pn->pn_count - 1; i++) { + if (!emit1(JSOP_POW)) + return false; + } + return true; +} + +bool +BytecodeEmitter::emitLeftAssociative(ParseNode* pn) +{ + MOZ_ASSERT(pn->isArity(PN_LIST)); + + // Left-associative operator chain. + if (!emitTree(pn->pn_head)) + return false; + JSOp op = pn->getOp(); + ParseNode* nextExpr = pn->pn_head->pn_next; + do { + if (!emitTree(nextExpr)) + return false; + if (!emit1(op)) + return false; + } while ((nextExpr = nextExpr->pn_next)); + return true; +} + +bool +BytecodeEmitter::emitLogical(ParseNode* pn) +{ + MOZ_ASSERT(pn->isArity(PN_LIST)); + + /* + * JSOP_OR converts the operand on the stack to boolean, leaves the original + * value on the stack and jumps if true; otherwise it falls into the next + * bytecode, which pops the left operand and then evaluates the right operand. + * The jump goes around the right operand evaluation. + * + * JSOP_AND converts the operand on the stack to boolean and jumps if false; + * otherwise it falls into the right operand's bytecode. + */ + + TDZCheckCache tdzCache(this); + + /* Left-associative operator chain: avoid too much recursion. */ + ParseNode* pn2 = pn->pn_head; + if (!emitTree(pn2)) + return false; + JSOp op = pn->getOp(); + JumpList jump; + if (!emitJump(op, &jump)) + return false; + if (!emit1(JSOP_POP)) + return false; + + /* Emit nodes between the head and the tail. */ + while ((pn2 = pn2->pn_next)->pn_next) { + if (!emitTree(pn2)) + return false; + if (!emitJump(op, &jump)) + return false; + if (!emit1(JSOP_POP)) + return false; + } + if (!emitTree(pn2)) + return false; + + if (!emitJumpTargetAndPatch(jump)) + return false; + return true; +} + +bool +BytecodeEmitter::emitSequenceExpr(ParseNode* pn) +{ + for (ParseNode* child = pn->pn_head; ; child = child->pn_next) { + if (!updateSourceCoordNotes(child->pn_pos.begin)) + return false; + if (!emitTree(child)) + return false; + if (!child->pn_next) + break; + if (!emit1(JSOP_POP)) + return false; + } + return true; +} + +// Using MOZ_NEVER_INLINE in here is a workaround for llvm.org/pr14047. See +// the comment on emitSwitch. +MOZ_NEVER_INLINE bool +BytecodeEmitter::emitIncOrDec(ParseNode* pn) +{ + switch (pn->pn_kid->getKind()) { + case PNK_DOT: + return emitPropIncDec(pn); + case PNK_ELEM: + return emitElemIncDec(pn); + case PNK_CALL: + return emitCallIncDec(pn); + default: + return emitNameIncDec(pn); + } + + return true; +} + +// Using MOZ_NEVER_INLINE in here is a workaround for llvm.org/pr14047. See +// the comment on emitSwitch. +MOZ_NEVER_INLINE bool +BytecodeEmitter::emitLabeledStatement(const LabeledStatement* pn) +{ + /* + * Emit a JSOP_LABEL instruction. The argument is the offset to the statement + * following the labeled statement. + */ + uint32_t index; + if (!makeAtomIndex(pn->label(), &index)) + return false; + + JumpList top; + if (!emitJump(JSOP_LABEL, &top)) + return false; + + /* Emit code for the labeled statement. */ + LabelControl controlInfo(this, pn->label(), offset()); + + if (!emitTree(pn->statement())) + return false; + + /* Patch the JSOP_LABEL offset. */ + JumpTarget brk{ lastNonJumpTargetOffset() }; + patchJumpsToTarget(top, brk); + + if (!controlInfo.patchBreaks(this)) + return false; + + return true; +} + +bool +BytecodeEmitter::emitConditionalExpression(ConditionalExpression& conditional) +{ + /* Emit the condition, then branch if false to the else part. */ + if (!emitTree(&conditional.condition())) + return false; + + IfThenElseEmitter ifThenElse(this); + if (!ifThenElse.emitCond()) + return false; + + if (!emitConditionallyExecutedTree(&conditional.thenExpression())) + return false; + + if (!ifThenElse.emitElse()) + return false; + + if (!emitConditionallyExecutedTree(&conditional.elseExpression())) + return false; + + if (!ifThenElse.emitEnd()) + return false; + MOZ_ASSERT(ifThenElse.pushed() == 1); + + return true; +} + +bool +BytecodeEmitter::emitPropertyList(ParseNode* pn, MutableHandlePlainObject objp, PropListType type) +{ + for (ParseNode* propdef = pn->pn_head; propdef; propdef = propdef->pn_next) { + if (!updateSourceCoordNotes(propdef->pn_pos.begin)) + return false; + + // Handle __proto__: v specially because *only* this form, and no other + // involving "__proto__", performs [[Prototype]] mutation. + if (propdef->isKind(PNK_MUTATEPROTO)) { + MOZ_ASSERT(type == ObjectLiteral); + if (!emitTree(propdef->pn_kid)) + return false; + objp.set(nullptr); + if (!emit1(JSOP_MUTATEPROTO)) + return false; + continue; + } + + bool extraPop = false; + if (type == ClassBody && propdef->as<ClassMethod>().isStatic()) { + extraPop = true; + if (!emit1(JSOP_DUP2)) + return false; + if (!emit1(JSOP_POP)) + return false; + } + + /* Emit an index for t[2] for later consumption by JSOP_INITELEM. */ + ParseNode* key = propdef->pn_left; + bool isIndex = false; + if (key->isKind(PNK_NUMBER)) { + if (!emitNumberOp(key->pn_dval)) + return false; + isIndex = true; + } else if (key->isKind(PNK_OBJECT_PROPERTY_NAME) || key->isKind(PNK_STRING)) { + // EmitClass took care of constructor already. + if (type == ClassBody && key->pn_atom == cx->names().constructor && + !propdef->as<ClassMethod>().isStatic()) + { + continue; + } + + // The parser already checked for atoms representing indexes and + // used PNK_NUMBER instead, but also watch for ids which TI treats + // as indexes for simpliciation of downstream analysis. + jsid id = NameToId(key->pn_atom->asPropertyName()); + if (id != IdToTypeId(id)) { + if (!emitTree(key)) + return false; + isIndex = true; + } + } else { + if (!emitComputedPropertyName(key)) + return false; + isIndex = true; + } + + /* Emit code for the property initializer. */ + if (!emitTree(propdef->pn_right)) + return false; + + JSOp op = propdef->getOp(); + MOZ_ASSERT(op == JSOP_INITPROP || + op == JSOP_INITPROP_GETTER || + op == JSOP_INITPROP_SETTER); + + if (op == JSOP_INITPROP_GETTER || op == JSOP_INITPROP_SETTER) + objp.set(nullptr); + + if (propdef->pn_right->isKind(PNK_FUNCTION) && + propdef->pn_right->pn_funbox->needsHomeObject()) + { + MOZ_ASSERT(propdef->pn_right->pn_funbox->function()->allowSuperProperty()); + bool isAsync = propdef->pn_right->pn_funbox->isAsync(); + if (isAsync) { + if (!emit1(JSOP_SWAP)) + return false; + } + if (!emit2(JSOP_INITHOMEOBJECT, isIndex + isAsync)) + return false; + if (isAsync) { + if (!emit1(JSOP_POP)) + return false; + } + } + + // Class methods are not enumerable. + if (type == ClassBody) { + switch (op) { + case JSOP_INITPROP: op = JSOP_INITHIDDENPROP; break; + case JSOP_INITPROP_GETTER: op = JSOP_INITHIDDENPROP_GETTER; break; + case JSOP_INITPROP_SETTER: op = JSOP_INITHIDDENPROP_SETTER; break; + default: MOZ_CRASH("Invalid op"); + } + } + + if (isIndex) { + objp.set(nullptr); + switch (op) { + case JSOP_INITPROP: op = JSOP_INITELEM; break; + case JSOP_INITHIDDENPROP: op = JSOP_INITHIDDENELEM; break; + case JSOP_INITPROP_GETTER: op = JSOP_INITELEM_GETTER; break; + case JSOP_INITHIDDENPROP_GETTER: op = JSOP_INITHIDDENELEM_GETTER; break; + case JSOP_INITPROP_SETTER: op = JSOP_INITELEM_SETTER; break; + case JSOP_INITHIDDENPROP_SETTER: op = JSOP_INITHIDDENELEM_SETTER; break; + default: MOZ_CRASH("Invalid op"); + } + if (!emit1(op)) + return false; + } else { + MOZ_ASSERT(key->isKind(PNK_OBJECT_PROPERTY_NAME) || key->isKind(PNK_STRING)); + + uint32_t index; + if (!makeAtomIndex(key->pn_atom, &index)) + return false; + + if (objp) { + MOZ_ASSERT(type == ObjectLiteral); + MOZ_ASSERT(!IsHiddenInitOp(op)); + MOZ_ASSERT(!objp->inDictionaryMode()); + Rooted<jsid> id(cx, AtomToId(key->pn_atom)); + RootedValue undefinedValue(cx, UndefinedValue()); + if (!NativeDefineProperty(cx, objp, id, undefinedValue, nullptr, nullptr, + JSPROP_ENUMERATE)) + { + return false; + } + if (objp->inDictionaryMode()) + objp.set(nullptr); + } + + if (!emitIndex32(op, index)) + return false; + } + + if (extraPop) { + if (!emit1(JSOP_POP)) + return false; + } + } + return true; +} + +// Using MOZ_NEVER_INLINE in here is a workaround for llvm.org/pr14047. See +// the comment on emitSwitch. +MOZ_NEVER_INLINE bool +BytecodeEmitter::emitObject(ParseNode* pn) +{ + if (!(pn->pn_xflags & PNX_NONCONST) && pn->pn_head && checkSingletonContext()) + return emitSingletonInitialiser(pn); + + /* + * Emit code for {p:a, '%q':b, 2:c} that is equivalent to constructing + * a new object and defining (in source order) each property on the object + * (or mutating the object's [[Prototype]], in the case of __proto__). + */ + ptrdiff_t offset = this->offset(); + if (!emitNewInit(JSProto_Object)) + return false; + + /* + * Try to construct the shape of the object as we go, so we can emit a + * JSOP_NEWOBJECT with the final shape instead. + */ + RootedPlainObject obj(cx); + // No need to do any guessing for the object kind, since we know exactly + // how many properties we plan to have. + gc::AllocKind kind = gc::GetGCObjectKind(pn->pn_count); + obj = NewBuiltinClassInstance<PlainObject>(cx, kind, TenuredObject); + if (!obj) + return false; + + if (!emitPropertyList(pn, &obj, ObjectLiteral)) + return false; + + if (obj) { + /* + * The object survived and has a predictable shape: update the original + * bytecode. + */ + ObjectBox* objbox = parser->newObjectBox(obj); + if (!objbox) + return false; + + static_assert(JSOP_NEWINIT_LENGTH == JSOP_NEWOBJECT_LENGTH, + "newinit and newobject must have equal length to edit in-place"); + + uint32_t index = objectList.add(objbox); + jsbytecode* code = this->code(offset); + code[0] = JSOP_NEWOBJECT; + code[1] = jsbytecode(index >> 24); + code[2] = jsbytecode(index >> 16); + code[3] = jsbytecode(index >> 8); + code[4] = jsbytecode(index); + } + + return true; +} + +bool +BytecodeEmitter::emitArrayComp(ParseNode* pn) +{ + if (!emitNewInit(JSProto_Array)) + return false; + + /* + * Pass the new array's stack index to the PNK_ARRAYPUSH case via + * arrayCompDepth, then simply traverse the PNK_FOR node and + * its kids under pn2 to generate this comprehension. + */ + MOZ_ASSERT(stackDepth > 0); + uint32_t saveDepth = arrayCompDepth; + arrayCompDepth = (uint32_t) (stackDepth - 1); + if (!emitTree(pn->pn_head)) + return false; + arrayCompDepth = saveDepth; + + return true; +} + +bool +BytecodeEmitter::emitArrayLiteral(ParseNode* pn) +{ + if (!(pn->pn_xflags & PNX_NONCONST) && pn->pn_head) { + if (checkSingletonContext()) { + // Bake in the object entirely if it will only be created once. + return emitSingletonInitialiser(pn); + } + + // If the array consists entirely of primitive values, make a + // template object with copy on write elements that can be reused + // every time the initializer executes. + if (emitterMode != BytecodeEmitter::SelfHosting && pn->pn_count != 0) { + RootedValue value(cx); + if (!pn->getConstantValue(cx, ParseNode::ForCopyOnWriteArray, &value)) + return false; + if (!value.isMagic(JS_GENERIC_MAGIC)) { + // Note: the group of the template object might not yet reflect + // that the object has copy on write elements. When the + // interpreter or JIT compiler fetches the template, it should + // use ObjectGroup::getOrFixupCopyOnWriteObject to make sure the + // group for the template is accurate. We don't do this here as we + // want to use ObjectGroup::allocationSiteGroup, which requires a + // finished script. + JSObject* obj = &value.toObject(); + MOZ_ASSERT(obj->is<ArrayObject>() && + obj->as<ArrayObject>().denseElementsAreCopyOnWrite()); + + ObjectBox* objbox = parser->newObjectBox(obj); + if (!objbox) + return false; + + return emitObjectOp(objbox, JSOP_NEWARRAY_COPYONWRITE); + } + } + } + + return emitArray(pn->pn_head, pn->pn_count, JSOP_NEWARRAY); +} + +bool +BytecodeEmitter::emitArray(ParseNode* pn, uint32_t count, JSOp op) +{ + + /* + * Emit code for [a, b, c] that is equivalent to constructing a new + * array and in source order evaluating each element value and adding + * it to the array, without invoking latent setters. We use the + * JSOP_NEWINIT and JSOP_INITELEM_ARRAY bytecodes to ignore setters and + * to avoid dup'ing and popping the array as each element is added, as + * JSOP_SETELEM/JSOP_SETPROP would do. + */ + MOZ_ASSERT(op == JSOP_NEWARRAY || op == JSOP_SPREADCALLARRAY); + + uint32_t nspread = 0; + for (ParseNode* elt = pn; elt; elt = elt->pn_next) { + if (elt->isKind(PNK_SPREAD)) + nspread++; + } + + // Array literal's length is limited to NELEMENTS_LIMIT in parser. + static_assert(NativeObject::MAX_DENSE_ELEMENTS_COUNT <= INT32_MAX, + "array literals' maximum length must not exceed limits " + "required by BaselineCompiler::emit_JSOP_NEWARRAY, " + "BaselineCompiler::emit_JSOP_INITELEM_ARRAY, " + "and DoSetElemFallback's handling of JSOP_INITELEM_ARRAY"); + MOZ_ASSERT(count >= nspread); + MOZ_ASSERT(count <= NativeObject::MAX_DENSE_ELEMENTS_COUNT, + "the parser must throw an error if the array exceeds maximum " + "length"); + + // For arrays with spread, this is a very pessimistic allocation, the + // minimum possible final size. + if (!emitUint32Operand(op, count - nspread)) // ARRAY + return false; + + ParseNode* pn2 = pn; + uint32_t index; + bool afterSpread = false; + for (index = 0; pn2; index++, pn2 = pn2->pn_next) { + if (!afterSpread && pn2->isKind(PNK_SPREAD)) { + afterSpread = true; + if (!emitNumberOp(index)) // ARRAY INDEX + return false; + } + if (!updateSourceCoordNotes(pn2->pn_pos.begin)) + return false; + + bool allowSelfHostedSpread = false; + if (pn2->isKind(PNK_ELISION)) { + if (!emit1(JSOP_HOLE)) + return false; + } else { + ParseNode* expr; + if (pn2->isKind(PNK_SPREAD)) { + expr = pn2->pn_kid; + + if (emitterMode == BytecodeEmitter::SelfHosting && + expr->isKind(PNK_CALL) && + expr->pn_head->name() == cx->names().allowContentSpread) + { + allowSelfHostedSpread = true; + } + } else { + expr = pn2; + } + if (!emitTree(expr)) // ARRAY INDEX? VALUE + return false; + } + if (pn2->isKind(PNK_SPREAD)) { + if (!emitIterator()) // ARRAY INDEX ITER + return false; + if (!emit2(JSOP_PICK, 2)) // INDEX ITER ARRAY + return false; + if (!emit2(JSOP_PICK, 2)) // ITER ARRAY INDEX + return false; + if (!emitSpread(allowSelfHostedSpread)) // ARRAY INDEX + return false; + } else if (afterSpread) { + if (!emit1(JSOP_INITELEM_INC)) + return false; + } else { + if (!emitUint32Operand(JSOP_INITELEM_ARRAY, index)) + return false; + } + } + MOZ_ASSERT(index == count); + if (afterSpread) { + if (!emit1(JSOP_POP)) // ARRAY + return false; + } + return true; +} + +bool +BytecodeEmitter::emitUnary(ParseNode* pn) +{ + if (!updateSourceCoordNotes(pn->pn_pos.begin)) + return false; + + /* Unary op, including unary +/-. */ + JSOp op = pn->getOp(); + ParseNode* pn2 = pn->pn_kid; + + if (!emitTree(pn2)) + return false; + + return emit1(op); +} + +bool +BytecodeEmitter::emitTypeof(ParseNode* node, JSOp op) +{ + MOZ_ASSERT(op == JSOP_TYPEOF || op == JSOP_TYPEOFEXPR); + + if (!updateSourceCoordNotes(node->pn_pos.begin)) + return false; + + if (!emitTree(node->pn_kid)) + return false; + + return emit1(op); +} + +bool +BytecodeEmitter::emitFunctionFormalParametersAndBody(ParseNode *pn) +{ + MOZ_ASSERT(pn->isKind(PNK_PARAMSBODY)); + + ParseNode* funBody = pn->last(); + FunctionBox* funbox = sc->asFunctionBox(); + + TDZCheckCache tdzCache(this); + + if (funbox->hasParameterExprs) { + EmitterScope funEmitterScope(this); + if (!funEmitterScope.enterFunction(this, funbox)) + return false; + + if (!emitInitializeFunctionSpecialNames()) + return false; + + if (!emitFunctionFormalParameters(pn)) + return false; + + { + Maybe<EmitterScope> extraVarEmitterScope; + + if (funbox->hasExtraBodyVarScope()) { + extraVarEmitterScope.emplace(this); + if (!extraVarEmitterScope->enterFunctionExtraBodyVar(this, funbox)) + return false; + + // After emitting expressions for all parameters, copy over any + // formal parameters which have been redeclared as vars. For + // example, in the following, the var y in the body scope is 42: + // + // function f(x, y = 42) { var y; } + // + RootedAtom name(cx); + if (funbox->extraVarScopeBindings() && funbox->functionScopeBindings()) { + for (BindingIter bi(*funbox->functionScopeBindings(), true); bi; bi++) { + name = bi.name(); + + // There may not be a var binding of the same name. + if (!locationOfNameBoundInScope(name, extraVarEmitterScope.ptr())) + continue; + + // The '.this' and '.generator' function special + // bindings should never appear in the extra var + // scope. 'arguments', however, may. + MOZ_ASSERT(name != cx->names().dotThis && + name != cx->names().dotGenerator); + + NameLocation paramLoc = *locationOfNameBoundInScope(name, &funEmitterScope); + auto emitRhs = [&name, ¶mLoc](BytecodeEmitter* bce, + const NameLocation&, bool) + { + return bce->emitGetNameAtLocation(name, paramLoc); + }; + + if (!emitInitializeName(name, emitRhs)) + return false; + if (!emit1(JSOP_POP)) + return false; + } + } + } + + if (!emitFunctionBody(funBody)) + return false; + + if (extraVarEmitterScope && !extraVarEmitterScope->leave(this)) + return false; + } + + return funEmitterScope.leave(this); + } + + // No parameter expressions. Enter the function body scope and emit + // everything. + // + // One caveat is that Debugger considers ops in the prologue to be + // unreachable (i.e. cannot set a breakpoint on it). If there are no + // parameter exprs, any unobservable environment ops (like pushing the + // call object, setting '.this', etc) need to go in the prologue, else it + // messes up breakpoint tests. + EmitterScope emitterScope(this); + + switchToPrologue(); + if (!emitterScope.enterFunction(this, funbox)) + return false; + + if (!emitInitializeFunctionSpecialNames()) + return false; + switchToMain(); + + if (!emitFunctionFormalParameters(pn)) + return false; + + if (!emitFunctionBody(funBody)) + return false; + + return emitterScope.leave(this); +} + +bool +BytecodeEmitter::emitFunctionFormalParameters(ParseNode* pn) +{ + ParseNode* funBody = pn->last(); + FunctionBox* funbox = sc->asFunctionBox(); + EmitterScope* funScope = innermostEmitterScope; + + bool hasParameterExprs = funbox->hasParameterExprs; + bool hasRest = funbox->function()->hasRest(); + + uint16_t argSlot = 0; + for (ParseNode* arg = pn->pn_head; arg != funBody; arg = arg->pn_next, argSlot++) { + ParseNode* bindingElement = arg; + ParseNode* initializer = nullptr; + if (arg->isKind(PNK_ASSIGN)) { + bindingElement = arg->pn_left; + initializer = arg->pn_right; + } + + // Left-hand sides are either simple names or destructuring patterns. + MOZ_ASSERT(bindingElement->isKind(PNK_NAME) || + bindingElement->isKind(PNK_ARRAY) || + bindingElement->isKind(PNK_ARRAYCOMP) || + bindingElement->isKind(PNK_OBJECT)); + + // The rest parameter doesn't have an initializer. + bool isRest = hasRest && arg->pn_next == funBody; + MOZ_ASSERT_IF(isRest, !initializer); + + bool isDestructuring = !bindingElement->isKind(PNK_NAME); + + // ES 14.1.19 says if BindingElement contains an expression in the + // production FormalParameter : BindingElement, it is evaluated in a + // new var environment. This is needed to prevent vars from escaping + // direct eval in parameter expressions. + Maybe<EmitterScope> paramExprVarScope; + if (funbox->hasDirectEvalInParameterExpr && (isDestructuring || initializer)) { + paramExprVarScope.emplace(this); + if (!paramExprVarScope->enterParameterExpressionVar(this)) + return false; + } + + // First push the RHS if there is a default expression or if it is + // rest. + + if (initializer) { + // If we have an initializer, emit the initializer and assign it + // to the argument slot. TDZ is taken care of afterwards. + MOZ_ASSERT(hasParameterExprs); + if (!emitArgOp(JSOP_GETARG, argSlot)) + return false; + if (!emit1(JSOP_DUP)) + return false; + if (!emit1(JSOP_UNDEFINED)) + return false; + if (!emit1(JSOP_STRICTEQ)) + return false; + // Emit source note to enable Ion compilation. + if (!newSrcNote(SRC_IF)) + return false; + JumpList jump; + if (!emitJump(JSOP_IFEQ, &jump)) + return false; + if (!emit1(JSOP_POP)) + return false; + if (!emitConditionallyExecutedTree(initializer)) + return false; + if (!emitJumpTargetAndPatch(jump)) + return false; + } else if (isRest) { + if (!emit1(JSOP_REST)) + return false; + checkTypeSet(JSOP_REST); + } + + // Initialize the parameter name. + + if (isDestructuring) { + // If we had an initializer or the rest parameter, the value is + // already on the stack. + if (!initializer && !isRest && !emitArgOp(JSOP_GETARG, argSlot)) + return false; + + // If there's an parameter expression var scope, the destructuring + // declaration needs to initialize the name in the function scope, + // which is not the innermost scope. + if (!emitDestructuringOps(bindingElement, + paramExprVarScope + ? DestructuringFormalParameterInVarScope + : DestructuringDeclaration)) + { + return false; + } + + if (!emit1(JSOP_POP)) + return false; + } else { + RootedAtom paramName(cx, bindingElement->name()); + NameLocation paramLoc = *locationOfNameBoundInScope(paramName, funScope); + + if (hasParameterExprs) { + auto emitRhs = [argSlot, initializer, isRest](BytecodeEmitter* bce, + const NameLocation&, bool) + { + // If we had an initializer or a rest parameter, the value is + // already on the stack. + if (!initializer && !isRest) + return bce->emitArgOp(JSOP_GETARG, argSlot); + return true; + }; + + if (!emitSetOrInitializeNameAtLocation(paramName, paramLoc, emitRhs, true)) + return false; + if (!emit1(JSOP_POP)) + return false; + } else if (isRest) { + // The rest value is already on top of the stack. + auto nop = [](BytecodeEmitter*, const NameLocation&, bool) { + return true; + }; + + if (!emitSetOrInitializeNameAtLocation(paramName, paramLoc, nop, true)) + return false; + if (!emit1(JSOP_POP)) + return false; + } + } + + if (paramExprVarScope) { + if (!paramExprVarScope->leave(this)) + return false; + } + } + + return true; +} + +bool +BytecodeEmitter::emitInitializeFunctionSpecialNames() +{ + FunctionBox* funbox = sc->asFunctionBox(); + + auto emitInitializeFunctionSpecialName = [](BytecodeEmitter* bce, HandlePropertyName name, + JSOp op) + { + // A special name must be slotful, either on the frame or on the + // call environment. + MOZ_ASSERT(bce->lookupName(name).hasKnownSlot()); + + auto emitInitial = [op](BytecodeEmitter* bce, const NameLocation&, bool) { + return bce->emit1(op); + }; + + if (!bce->emitInitializeName(name, emitInitial)) + return false; + if (!bce->emit1(JSOP_POP)) + return false; + + return true; + }; + + // Do nothing if the function doesn't have an arguments binding. + if (funbox->argumentsHasLocalBinding()) { + if (!emitInitializeFunctionSpecialName(this, cx->names().arguments, JSOP_ARGUMENTS)) + return false; + } + + // Do nothing if the function doesn't have a this-binding (this + // happens for instance if it doesn't use this/eval or if it's an + // arrow function). + if (funbox->hasThisBinding()) { + if (!emitInitializeFunctionSpecialName(this, cx->names().dotThis, JSOP_FUNCTIONTHIS)) + return false; + } + + return true; +} + +bool +BytecodeEmitter::emitFunctionBody(ParseNode* funBody) +{ + FunctionBox* funbox = sc->asFunctionBox(); + + if (!emitTree(funBody)) + return false; + + if (funbox->isGenerator()) { + // If we fall off the end of a generator, do a final yield. + if (funbox->isStarGenerator() && !emitPrepareIteratorResult()) + return false; + + if (!emit1(JSOP_UNDEFINED)) + return false; + + if (sc->asFunctionBox()->isStarGenerator() && !emitFinishIteratorResult(true)) + return false; + + if (!emit1(JSOP_SETRVAL)) + return false; + + NameLocation loc = *locationOfNameBoundInFunctionScope(cx->names().dotGenerator); + if (!emitGetNameAtLocation(cx->names().dotGenerator, loc)) + return false; + + // No need to check for finally blocks, etc as in EmitReturn. + if (!emitYieldOp(JSOP_FINALYIELDRVAL)) + return false; + } else { + // Non-generator functions just return |undefined|. The + // JSOP_RETRVAL emitted below will do that, except if the + // script has a finally block: there can be a non-undefined + // value in the return value slot. Make sure the return value + // is |undefined|. + if (hasTryFinally) { + if (!emit1(JSOP_UNDEFINED)) + return false; + if (!emit1(JSOP_SETRVAL)) + return false; + } + } + + if (funbox->isDerivedClassConstructor()) { + if (!emitCheckDerivedClassConstructorReturn()) + return false; + } + + return true; +} + +bool +BytecodeEmitter::emitLexicalInitialization(ParseNode* pn) +{ + // The caller has pushed the RHS to the top of the stack. Assert that the + // name is lexical and no BIND[G]NAME ops were emitted. + auto assertLexical = [](BytecodeEmitter*, const NameLocation& loc, bool emittedBindOp) { + MOZ_ASSERT(loc.isLexical()); + MOZ_ASSERT(!emittedBindOp); + return true; + }; + return emitInitializeName(pn, assertLexical); +} + +// This follows ES6 14.5.14 (ClassDefinitionEvaluation) and ES6 14.5.15 +// (BindingClassDeclarationEvaluation). +bool +BytecodeEmitter::emitClass(ParseNode* pn) +{ + ClassNode& classNode = pn->as<ClassNode>(); + + ClassNames* names = classNode.names(); + + ParseNode* heritageExpression = classNode.heritage(); + + ParseNode* classMethods = classNode.methodList(); + ParseNode* constructor = nullptr; + for (ParseNode* mn = classMethods->pn_head; mn; mn = mn->pn_next) { + ClassMethod& method = mn->as<ClassMethod>(); + ParseNode& methodName = method.name(); + if (!method.isStatic() && + (methodName.isKind(PNK_OBJECT_PROPERTY_NAME) || methodName.isKind(PNK_STRING)) && + methodName.pn_atom == cx->names().constructor) + { + constructor = &method.method(); + break; + } + } + + bool savedStrictness = sc->setLocalStrictMode(true); + + Maybe<TDZCheckCache> tdzCache; + Maybe<EmitterScope> emitterScope; + if (names) { + tdzCache.emplace(this); + emitterScope.emplace(this); + if (!emitterScope->enterLexical(this, ScopeKind::Lexical, classNode.scopeBindings())) + return false; + } + + // This is kind of silly. In order to the get the home object defined on + // the constructor, we have to make it second, but we want the prototype + // on top for EmitPropertyList, because we expect static properties to be + // rarer. The result is a few more swaps than we would like. Such is life. + if (heritageExpression) { + if (!emitTree(heritageExpression)) + return false; + if (!emit1(JSOP_CLASSHERITAGE)) + return false; + if (!emit1(JSOP_OBJWITHPROTO)) + return false; + + // JSOP_CLASSHERITAGE leaves both protos on the stack. After + // creating the prototype, swap it to the bottom to make the + // constructor. + if (!emit1(JSOP_SWAP)) + return false; + } else { + if (!emitNewInit(JSProto_Object)) + return false; + } + + if (constructor) { + if (!emitFunction(constructor, !!heritageExpression)) + return false; + if (constructor->pn_funbox->needsHomeObject()) { + if (!emit2(JSOP_INITHOMEOBJECT, 0)) + return false; + } + } else { + JSAtom *name = names ? names->innerBinding()->pn_atom : cx->names().empty; + if (heritageExpression) { + if (!emitAtomOp(name, JSOP_DERIVEDCONSTRUCTOR)) + return false; + } else { + if (!emitAtomOp(name, JSOP_CLASSCONSTRUCTOR)) + return false; + } + } + + if (!emit1(JSOP_SWAP)) + return false; + + if (!emit1(JSOP_DUP2)) + return false; + if (!emitAtomOp(cx->names().prototype, JSOP_INITLOCKEDPROP)) + return false; + if (!emitAtomOp(cx->names().constructor, JSOP_INITHIDDENPROP)) + return false; + + RootedPlainObject obj(cx); + if (!emitPropertyList(classMethods, &obj, ClassBody)) + return false; + + if (!emit1(JSOP_POP)) + return false; + + if (names) { + ParseNode* innerName = names->innerBinding(); + if (!emitLexicalInitialization(innerName)) + return false; + + // Pop the inner scope. + if (!emitterScope->leave(this)) + return false; + emitterScope.reset(); + + ParseNode* outerName = names->outerBinding(); + if (outerName) { + if (!emitLexicalInitialization(outerName)) + return false; + // Only class statements make outer bindings, and they do not leave + // themselves on the stack. + if (!emit1(JSOP_POP)) + return false; + } + } + + MOZ_ALWAYS_TRUE(sc->setLocalStrictMode(savedStrictness)); + + return true; +} + +bool +BytecodeEmitter::emitTree(ParseNode* pn, EmitLineNumberNote emitLineNote) +{ + JS_CHECK_RECURSION(cx, return false); + + EmitLevelManager elm(this); + + /* Emit notes to tell the current bytecode's source line number. + However, a couple trees require special treatment; see the + relevant emitter functions for details. */ + if (emitLineNote == EMIT_LINENOTE && !ParseNodeRequiresSpecialLineNumberNotes(pn)) { + if (!updateLineNumberNotes(pn->pn_pos.begin)) + return false; + } + + switch (pn->getKind()) { + case PNK_FUNCTION: + if (!emitFunction(pn)) + return false; + break; + + case PNK_PARAMSBODY: + if (!emitFunctionFormalParametersAndBody(pn)) + return false; + break; + + case PNK_IF: + if (!emitIf(pn)) + return false; + break; + + case PNK_SWITCH: + if (!emitSwitch(pn)) + return false; + break; + + case PNK_WHILE: + if (!emitWhile(pn)) + return false; + break; + + case PNK_DOWHILE: + if (!emitDo(pn)) + return false; + break; + + case PNK_FOR: + if (!emitFor(pn)) + return false; + break; + + case PNK_COMPREHENSIONFOR: + if (!emitComprehensionFor(pn)) + return false; + break; + + case PNK_BREAK: + if (!emitBreak(pn->as<BreakStatement>().label())) + return false; + break; + + case PNK_CONTINUE: + if (!emitContinue(pn->as<ContinueStatement>().label())) + return false; + break; + + case PNK_WITH: + if (!emitWith(pn)) + return false; + break; + + case PNK_TRY: + if (!emitTry(pn)) + return false; + break; + + case PNK_CATCH: + if (!emitCatch(pn)) + return false; + break; + + case PNK_VAR: + if (!emitDeclarationList(pn)) + return false; + break; + + case PNK_RETURN: + if (!emitReturn(pn)) + return false; + break; + + case PNK_YIELD_STAR: + if (!emitYieldStar(pn->pn_left, pn->pn_right)) + return false; + break; + + case PNK_GENERATOR: + if (!emit1(JSOP_GENERATOR)) + return false; + break; + + case PNK_YIELD: + case PNK_AWAIT: + if (!emitYield(pn)) + return false; + break; + + case PNK_STATEMENTLIST: + if (!emitStatementList(pn)) + return false; + break; + + case PNK_SEMI: + if (!emitStatement(pn)) + return false; + break; + + case PNK_LABEL: + if (!emitLabeledStatement(&pn->as<LabeledStatement>())) + return false; + break; + + case PNK_COMMA: + if (!emitSequenceExpr(pn)) + return false; + break; + + case PNK_ASSIGN: + case PNK_ADDASSIGN: + case PNK_SUBASSIGN: + case PNK_BITORASSIGN: + case PNK_BITXORASSIGN: + case PNK_BITANDASSIGN: + case PNK_LSHASSIGN: + case PNK_RSHASSIGN: + case PNK_URSHASSIGN: + case PNK_MULASSIGN: + case PNK_DIVASSIGN: + case PNK_MODASSIGN: + case PNK_POWASSIGN: + if (!emitAssignment(pn->pn_left, pn->getOp(), pn->pn_right)) + return false; + break; + + case PNK_CONDITIONAL: + if (!emitConditionalExpression(pn->as<ConditionalExpression>())) + return false; + break; + + case PNK_OR: + case PNK_AND: + if (!emitLogical(pn)) + return false; + break; + + case PNK_ADD: + case PNK_SUB: + case PNK_BITOR: + case PNK_BITXOR: + case PNK_BITAND: + case PNK_STRICTEQ: + case PNK_EQ: + case PNK_STRICTNE: + case PNK_NE: + case PNK_LT: + case PNK_LE: + case PNK_GT: + case PNK_GE: + case PNK_IN: + case PNK_INSTANCEOF: + case PNK_LSH: + case PNK_RSH: + case PNK_URSH: + case PNK_STAR: + case PNK_DIV: + case PNK_MOD: + if (!emitLeftAssociative(pn)) + return false; + break; + + case PNK_POW: + if (!emitRightAssociative(pn)) + return false; + break; + + case PNK_TYPEOFNAME: + if (!emitTypeof(pn, JSOP_TYPEOF)) + return false; + break; + + case PNK_TYPEOFEXPR: + if (!emitTypeof(pn, JSOP_TYPEOFEXPR)) + return false; + break; + + case PNK_THROW: + case PNK_VOID: + case PNK_NOT: + case PNK_BITNOT: + case PNK_POS: + case PNK_NEG: + if (!emitUnary(pn)) + return false; + break; + + case PNK_PREINCREMENT: + case PNK_PREDECREMENT: + case PNK_POSTINCREMENT: + case PNK_POSTDECREMENT: + if (!emitIncOrDec(pn)) + return false; + break; + + case PNK_DELETENAME: + if (!emitDeleteName(pn)) + return false; + break; + + case PNK_DELETEPROP: + if (!emitDeleteProperty(pn)) + return false; + break; + + case PNK_DELETEELEM: + if (!emitDeleteElement(pn)) + return false; + break; + + case PNK_DELETEEXPR: + if (!emitDeleteExpression(pn)) + return false; + break; + + case PNK_DOT: + if (pn->as<PropertyAccess>().isSuper()) { + if (!emitSuperPropOp(pn, JSOP_GETPROP_SUPER)) + return false; + } else { + if (!emitPropOp(pn, JSOP_GETPROP)) + return false; + } + break; + + case PNK_ELEM: + if (pn->as<PropertyByValue>().isSuper()) { + if (!emitSuperElemOp(pn, JSOP_GETELEM_SUPER)) + return false; + } else { + if (!emitElemOp(pn, JSOP_GETELEM)) + return false; + } + break; + + case PNK_NEW: + case PNK_TAGGED_TEMPLATE: + case PNK_CALL: + case PNK_GENEXP: + case PNK_SUPERCALL: + if (!emitCallOrNew(pn)) + return false; + break; + + case PNK_LEXICALSCOPE: + if (!emitLexicalScope(pn)) + return false; + break; + + case PNK_CONST: + case PNK_LET: + if (!emitDeclarationList(pn)) + return false; + break; + + case PNK_IMPORT: + MOZ_ASSERT(sc->isModuleContext()); + break; + + case PNK_EXPORT: + MOZ_ASSERT(sc->isModuleContext()); + if (pn->pn_kid->getKind() != PNK_EXPORT_SPEC_LIST) { + if (!emitTree(pn->pn_kid)) + return false; + } + break; + + case PNK_EXPORT_DEFAULT: + MOZ_ASSERT(sc->isModuleContext()); + if (!emitTree(pn->pn_kid)) + return false; + if (pn->pn_right) { + if (!emitLexicalInitialization(pn->pn_right)) + return false; + if (!emit1(JSOP_POP)) + return false; + } + break; + + case PNK_EXPORT_FROM: + MOZ_ASSERT(sc->isModuleContext()); + break; + + case PNK_ARRAYPUSH: + /* + * The array object's stack index is in arrayCompDepth. See below + * under the array initialiser code generator for array comprehension + * special casing. + */ + if (!emitTree(pn->pn_kid)) + return false; + if (!emitDupAt(this->stackDepth - 1 - arrayCompDepth)) + return false; + if (!emit1(JSOP_ARRAYPUSH)) + return false; + break; + + case PNK_CALLSITEOBJ: + if (!emitCallSiteObject(pn)) + return false; + break; + + case PNK_ARRAY: + if (!emitArrayLiteral(pn)) + return false; + break; + + case PNK_ARRAYCOMP: + if (!emitArrayComp(pn)) + return false; + break; + + case PNK_OBJECT: + if (!emitObject(pn)) + return false; + break; + + case PNK_NAME: + if (!emitGetName(pn)) + return false; + break; + + case PNK_TEMPLATE_STRING_LIST: + if (!emitTemplateString(pn)) + return false; + break; + + case PNK_TEMPLATE_STRING: + case PNK_STRING: + if (!emitAtomOp(pn, JSOP_STRING)) + return false; + break; + + case PNK_NUMBER: + if (!emitNumberOp(pn->pn_dval)) + return false; + break; + + case PNK_REGEXP: + if (!emitRegExp(objectList.add(pn->as<RegExpLiteral>().objbox()))) + return false; + break; + + case PNK_TRUE: + case PNK_FALSE: + case PNK_NULL: + if (!emit1(pn->getOp())) + return false; + break; + + case PNK_THIS: + if (!emitThisLiteral(pn)) + return false; + break; + + case PNK_DEBUGGER: + if (!updateSourceCoordNotes(pn->pn_pos.begin)) + return false; + if (!emit1(JSOP_DEBUGGER)) + return false; + break; + + case PNK_NOP: + MOZ_ASSERT(pn->getArity() == PN_NULLARY); + break; + + case PNK_CLASS: + if (!emitClass(pn)) + return false; + break; + + case PNK_NEWTARGET: + if (!emit1(JSOP_NEWTARGET)) + return false; + break; + + case PNK_SETTHIS: + if (!emitSetThis(pn)) + return false; + break; + + case PNK_POSHOLDER: + MOZ_FALLTHROUGH_ASSERT("Should never try to emit PNK_POSHOLDER"); + + default: + MOZ_ASSERT(0); + } + + /* bce->emitLevel == 1 means we're last on the stack, so finish up. */ + if (emitLevel == 1) { + if (!updateSourceCoordNotes(pn->pn_pos.end)) + return false; + } + return true; +} + +bool +BytecodeEmitter::emitConditionallyExecutedTree(ParseNode* pn) +{ + // Code that may be conditionally executed always need their own TDZ + // cache. + TDZCheckCache tdzCache(this); + return emitTree(pn); +} + +static bool +AllocSrcNote(ExclusiveContext* cx, SrcNotesVector& notes, unsigned* index) +{ + // Start it off moderately large to avoid repeated resizings early on. + // ~99% of cases fit within 256 bytes. + if (notes.capacity() == 0 && !notes.reserve(256)) + return false; + + if (!notes.growBy(1)) { + ReportOutOfMemory(cx); + return false; + } + + *index = notes.length() - 1; + return true; +} + +bool +BytecodeEmitter::newSrcNote(SrcNoteType type, unsigned* indexp) +{ + SrcNotesVector& notes = this->notes(); + unsigned index; + if (!AllocSrcNote(cx, notes, &index)) + return false; + + /* + * Compute delta from the last annotated bytecode's offset. If it's too + * big to fit in sn, allocate one or more xdelta notes and reset sn. + */ + ptrdiff_t offset = this->offset(); + ptrdiff_t delta = offset - lastNoteOffset(); + current->lastNoteOffset = offset; + if (delta >= SN_DELTA_LIMIT) { + do { + ptrdiff_t xdelta = Min(delta, SN_XDELTA_MASK); + SN_MAKE_XDELTA(¬es[index], xdelta); + delta -= xdelta; + if (!AllocSrcNote(cx, notes, &index)) + return false; + } while (delta >= SN_DELTA_LIMIT); + } + + /* + * Initialize type and delta, then allocate the minimum number of notes + * needed for type's arity. Usually, we won't need more, but if an offset + * does take two bytes, setSrcNoteOffset will grow notes. + */ + SN_MAKE_NOTE(¬es[index], type, delta); + for (int n = (int)js_SrcNoteSpec[type].arity; n > 0; n--) { + if (!newSrcNote(SRC_NULL)) + return false; + } + + if (indexp) + *indexp = index; + return true; +} + +bool +BytecodeEmitter::newSrcNote2(SrcNoteType type, ptrdiff_t offset, unsigned* indexp) +{ + unsigned index; + if (!newSrcNote(type, &index)) + return false; + if (!setSrcNoteOffset(index, 0, offset)) + return false; + if (indexp) + *indexp = index; + return true; +} + +bool +BytecodeEmitter::newSrcNote3(SrcNoteType type, ptrdiff_t offset1, ptrdiff_t offset2, + unsigned* indexp) +{ + unsigned index; + if (!newSrcNote(type, &index)) + return false; + if (!setSrcNoteOffset(index, 0, offset1)) + return false; + if (!setSrcNoteOffset(index, 1, offset2)) + return false; + if (indexp) + *indexp = index; + return true; +} + +bool +BytecodeEmitter::addToSrcNoteDelta(jssrcnote* sn, ptrdiff_t delta) +{ + /* + * Called only from finishTakingSrcNotes to add to main script note + * deltas, and only by a small positive amount. + */ + MOZ_ASSERT(current == &main); + MOZ_ASSERT((unsigned) delta < (unsigned) SN_XDELTA_LIMIT); + + ptrdiff_t base = SN_DELTA(sn); + ptrdiff_t limit = SN_IS_XDELTA(sn) ? SN_XDELTA_LIMIT : SN_DELTA_LIMIT; + ptrdiff_t newdelta = base + delta; + if (newdelta < limit) { + SN_SET_DELTA(sn, newdelta); + } else { + jssrcnote xdelta; + SN_MAKE_XDELTA(&xdelta, delta); + if (!main.notes.insert(sn, xdelta)) + return false; + } + return true; +} + +bool +BytecodeEmitter::setSrcNoteOffset(unsigned index, unsigned which, ptrdiff_t offset) +{ + if (!SN_REPRESENTABLE_OFFSET(offset)) { + parser->tokenStream.reportError(JSMSG_NEED_DIET, js_script_str); + return false; + } + + SrcNotesVector& notes = this->notes(); + + /* Find the offset numbered which (i.e., skip exactly which offsets). */ + jssrcnote* sn = ¬es[index]; + MOZ_ASSERT(SN_TYPE(sn) != SRC_XDELTA); + MOZ_ASSERT((int) which < js_SrcNoteSpec[SN_TYPE(sn)].arity); + for (sn++; which; sn++, which--) { + if (*sn & SN_4BYTE_OFFSET_FLAG) + sn += 3; + } + + /* + * See if the new offset requires four bytes either by being too big or if + * the offset has already been inflated (in which case, we need to stay big + * to not break the srcnote encoding if this isn't the last srcnote). + */ + if (offset > (ptrdiff_t)SN_4BYTE_OFFSET_MASK || (*sn & SN_4BYTE_OFFSET_FLAG)) { + /* Maybe this offset was already set to a four-byte value. */ + if (!(*sn & SN_4BYTE_OFFSET_FLAG)) { + /* Insert three dummy bytes that will be overwritten shortly. */ + jssrcnote dummy = 0; + if (!(sn = notes.insert(sn, dummy)) || + !(sn = notes.insert(sn, dummy)) || + !(sn = notes.insert(sn, dummy))) + { + ReportOutOfMemory(cx); + return false; + } + } + *sn++ = (jssrcnote)(SN_4BYTE_OFFSET_FLAG | (offset >> 24)); + *sn++ = (jssrcnote)(offset >> 16); + *sn++ = (jssrcnote)(offset >> 8); + } + *sn = (jssrcnote)offset; + return true; +} + +bool +BytecodeEmitter::finishTakingSrcNotes(uint32_t* out) +{ + MOZ_ASSERT(current == &main); + + unsigned prologueCount = prologue.notes.length(); + if (prologueCount && prologue.currentLine != firstLine) { + switchToPrologue(); + if (!newSrcNote2(SRC_SETLINE, ptrdiff_t(firstLine))) + return false; + switchToMain(); + } else { + /* + * Either no prologue srcnotes, or no line number change over prologue. + * We don't need a SRC_SETLINE, but we may need to adjust the offset + * of the first main note, by adding to its delta and possibly even + * prepending SRC_XDELTA notes to it to account for prologue bytecodes + * that came at and after the last annotated bytecode. + */ + ptrdiff_t offset = prologueOffset() - prologue.lastNoteOffset; + MOZ_ASSERT(offset >= 0); + if (offset > 0 && main.notes.length() != 0) { + /* NB: Use as much of the first main note's delta as we can. */ + jssrcnote* sn = main.notes.begin(); + ptrdiff_t delta = SN_IS_XDELTA(sn) + ? SN_XDELTA_MASK - (*sn & SN_XDELTA_MASK) + : SN_DELTA_MASK - (*sn & SN_DELTA_MASK); + if (offset < delta) + delta = offset; + for (;;) { + if (!addToSrcNoteDelta(sn, delta)) + return false; + offset -= delta; + if (offset == 0) + break; + delta = Min(offset, SN_XDELTA_MASK); + sn = main.notes.begin(); + } + } + } + + // The prologue count might have changed, so we can't reuse prologueCount. + // The + 1 is to account for the final SN_MAKE_TERMINATOR that is appended + // when the notes are copied to their final destination by CopySrcNotes. + *out = prologue.notes.length() + main.notes.length() + 1; + return true; +} + +void +BytecodeEmitter::copySrcNotes(jssrcnote* destination, uint32_t nsrcnotes) +{ + unsigned prologueCount = prologue.notes.length(); + unsigned mainCount = main.notes.length(); + unsigned totalCount = prologueCount + mainCount; + MOZ_ASSERT(totalCount == nsrcnotes - 1); + if (prologueCount) + PodCopy(destination, prologue.notes.begin(), prologueCount); + PodCopy(destination + prologueCount, main.notes.begin(), mainCount); + SN_MAKE_TERMINATOR(&destination[totalCount]); +} + +void +CGConstList::finish(ConstArray* array) +{ + MOZ_ASSERT(length() == array->length); + + for (unsigned i = 0; i < length(); i++) + array->vector[i] = list[i]; +} + +bool +CGObjectList::isAdded(ObjectBox* objbox) +{ + // An objbox added to CGObjectList as non-first element has non-null + // emitLink member. The first element has null emitLink. + // Check for firstbox to cover the first element. + return objbox->emitLink || objbox == firstbox; +} + +/* + * Find the index of the given object for code generator. + * + * Since the emitter refers to each parsed object only once, for the index we + * use the number of already indexed objects. We also add the object to a list + * to convert the list to a fixed-size array when we complete code generation, + * see js::CGObjectList::finish below. + */ +unsigned +CGObjectList::add(ObjectBox* objbox) +{ + if (isAdded(objbox)) + return indexOf(objbox->object); + + objbox->emitLink = lastbox; + lastbox = objbox; + + // See the comment in CGObjectList::isAdded. + if (!firstbox) + firstbox = objbox; + return length++; +} + +unsigned +CGObjectList::indexOf(JSObject* obj) +{ + MOZ_ASSERT(length > 0); + unsigned index = length - 1; + for (ObjectBox* box = lastbox; box->object != obj; box = box->emitLink) + index--; + return index; +} + +void +CGObjectList::finish(ObjectArray* array) +{ + MOZ_ASSERT(length <= INDEX_LIMIT); + MOZ_ASSERT(length == array->length); + + js::GCPtrObject* cursor = array->vector + array->length; + ObjectBox* objbox = lastbox; + do { + --cursor; + MOZ_ASSERT(!*cursor); + MOZ_ASSERT(objbox->object->isTenured()); + *cursor = objbox->object; + + ObjectBox* tmp = objbox->emitLink; + // Clear emitLink for CGObjectList::isAdded. + objbox->emitLink = nullptr; + objbox = tmp; + } while (objbox != nullptr); + MOZ_ASSERT(cursor == array->vector); +} + +ObjectBox* +CGObjectList::find(uint32_t index) +{ + MOZ_ASSERT(index < length); + ObjectBox* box = lastbox; + for (unsigned n = length - 1; n > index; n--) + box = box->emitLink; + return box; +} + +void +CGScopeList::finish(ScopeArray* array) +{ + MOZ_ASSERT(length() <= INDEX_LIMIT); + MOZ_ASSERT(length() == array->length); + for (uint32_t i = 0; i < length(); i++) + array->vector[i].init(vector[i]); +} + +bool +CGTryNoteList::append(JSTryNoteKind kind, uint32_t stackDepth, size_t start, size_t end) +{ + MOZ_ASSERT(start <= end); + MOZ_ASSERT(size_t(uint32_t(start)) == start); + MOZ_ASSERT(size_t(uint32_t(end)) == end); + + JSTryNote note; + note.kind = kind; + note.stackDepth = stackDepth; + note.start = uint32_t(start); + note.length = uint32_t(end - start); + + return list.append(note); +} + +void +CGTryNoteList::finish(TryNoteArray* array) +{ + MOZ_ASSERT(length() == array->length); + + for (unsigned i = 0; i < length(); i++) + array->vector[i] = list[i]; +} + +bool +CGScopeNoteList::append(uint32_t scopeIndex, uint32_t offset, bool inPrologue, + uint32_t parent) +{ + CGScopeNote note; + mozilla::PodZero(¬e); + + note.index = scopeIndex; + note.start = offset; + note.parent = parent; + note.startInPrologue = inPrologue; + + return list.append(note); +} + +void +CGScopeNoteList::recordEnd(uint32_t index, uint32_t offset, bool inPrologue) +{ + MOZ_ASSERT(index < length()); + MOZ_ASSERT(list[index].length == 0); + list[index].end = offset; + list[index].endInPrologue = inPrologue; +} + +void +CGScopeNoteList::finish(ScopeNoteArray* array, uint32_t prologueLength) +{ + MOZ_ASSERT(length() == array->length); + + for (unsigned i = 0; i < length(); i++) { + if (!list[i].startInPrologue) + list[i].start += prologueLength; + if (!list[i].endInPrologue && list[i].end != UINT32_MAX) + list[i].end += prologueLength; + MOZ_ASSERT(list[i].end >= list[i].start); + list[i].length = list[i].end - list[i].start; + array->vector[i] = list[i]; + } +} + +void +CGYieldOffsetList::finish(YieldOffsetArray& array, uint32_t prologueLength) +{ + MOZ_ASSERT(length() == array.length()); + + for (unsigned i = 0; i < length(); i++) + array[i] = prologueLength + list[i]; +} + +/* + * We should try to get rid of offsetBias (always 0 or 1, where 1 is + * JSOP_{NOP,POP}_LENGTH), which is used only by SRC_FOR. + */ +const JSSrcNoteSpec js_SrcNoteSpec[] = { +#define DEFINE_SRC_NOTE_SPEC(sym, name, arity) { name, arity }, + FOR_EACH_SRC_NOTE_TYPE(DEFINE_SRC_NOTE_SPEC) +#undef DEFINE_SRC_NOTE_SPEC +}; + +static int +SrcNoteArity(jssrcnote* sn) +{ + MOZ_ASSERT(SN_TYPE(sn) < SRC_LAST); + return js_SrcNoteSpec[SN_TYPE(sn)].arity; +} + +JS_FRIEND_API(unsigned) +js::SrcNoteLength(jssrcnote* sn) +{ + unsigned arity; + jssrcnote* base; + + arity = SrcNoteArity(sn); + for (base = sn++; arity; sn++, arity--) { + if (*sn & SN_4BYTE_OFFSET_FLAG) + sn += 3; + } + return sn - base; +} + +JS_FRIEND_API(ptrdiff_t) +js::GetSrcNoteOffset(jssrcnote* sn, unsigned which) +{ + /* Find the offset numbered which (i.e., skip exactly which offsets). */ + MOZ_ASSERT(SN_TYPE(sn) != SRC_XDELTA); + MOZ_ASSERT((int) which < SrcNoteArity(sn)); + for (sn++; which; sn++, which--) { + if (*sn & SN_4BYTE_OFFSET_FLAG) + sn += 3; + } + if (*sn & SN_4BYTE_OFFSET_FLAG) { + return (ptrdiff_t)(((uint32_t)(sn[0] & SN_4BYTE_OFFSET_MASK) << 24) + | (sn[1] << 16) + | (sn[2] << 8) + | sn[3]); + } + return (ptrdiff_t)*sn; +} diff --git a/js/src/frontend/BytecodeEmitter.h b/js/src/frontend/BytecodeEmitter.h new file mode 100644 index 000000000..1bb4191ee --- /dev/null +++ b/js/src/frontend/BytecodeEmitter.h @@ -0,0 +1,763 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- + * vim: set ts=8 sts=4 et sw=4 tw=99: + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/* JS bytecode generation. */ + +#ifndef frontend_BytecodeEmitter_h +#define frontend_BytecodeEmitter_h + +#include "jscntxt.h" +#include "jsopcode.h" +#include "jsscript.h" + +#include "ds/InlineTable.h" +#include "frontend/Parser.h" +#include "frontend/SharedContext.h" +#include "frontend/SourceNotes.h" +#include "vm/Interpreter.h" + +namespace js { +namespace frontend { + +class FullParseHandler; +class ObjectBox; +class ParseNode; +template <typename ParseHandler> class Parser; +class SharedContext; +class TokenStream; + +class CGConstList { + Vector<Value> list; + public: + explicit CGConstList(ExclusiveContext* cx) : list(cx) {} + MOZ_MUST_USE bool append(const Value& v) { + MOZ_ASSERT_IF(v.isString(), v.toString()->isAtom()); + return list.append(v); + } + size_t length() const { return list.length(); } + void finish(ConstArray* array); +}; + +struct CGObjectList { + uint32_t length; /* number of emitted so far objects */ + ObjectBox* firstbox; /* first emitted object */ + ObjectBox* lastbox; /* last emitted object */ + + CGObjectList() : length(0), firstbox(nullptr), lastbox(nullptr) {} + + bool isAdded(ObjectBox* objbox); + unsigned add(ObjectBox* objbox); + unsigned indexOf(JSObject* obj); + void finish(ObjectArray* array); + ObjectBox* find(uint32_t index); +}; + +struct MOZ_STACK_CLASS CGScopeList { + Rooted<GCVector<Scope*>> vector; + + explicit CGScopeList(ExclusiveContext* cx) + : vector(cx, GCVector<Scope*>(cx)) + { } + + bool append(Scope* scope) { return vector.append(scope); } + uint32_t length() const { return vector.length(); } + void finish(ScopeArray* array); +}; + +struct CGTryNoteList { + Vector<JSTryNote> list; + explicit CGTryNoteList(ExclusiveContext* cx) : list(cx) {} + + MOZ_MUST_USE bool append(JSTryNoteKind kind, uint32_t stackDepth, size_t start, size_t end); + size_t length() const { return list.length(); } + void finish(TryNoteArray* array); +}; + +struct CGScopeNote : public ScopeNote +{ + // The end offset. Used to compute the length; may need adjusting first if + // in the prologue. + uint32_t end; + + // Is the start offset in the prologue? + bool startInPrologue; + + // Is the end offset in the prologue? + bool endInPrologue; +}; + +struct CGScopeNoteList { + Vector<CGScopeNote> list; + explicit CGScopeNoteList(ExclusiveContext* cx) : list(cx) {} + + MOZ_MUST_USE bool append(uint32_t scopeIndex, uint32_t offset, bool inPrologue, + uint32_t parent); + void recordEnd(uint32_t index, uint32_t offset, bool inPrologue); + size_t length() const { return list.length(); } + void finish(ScopeNoteArray* array, uint32_t prologueLength); +}; + +struct CGYieldOffsetList { + Vector<uint32_t> list; + explicit CGYieldOffsetList(ExclusiveContext* cx) : list(cx) {} + + MOZ_MUST_USE bool append(uint32_t offset) { return list.append(offset); } + size_t length() const { return list.length(); } + void finish(YieldOffsetArray& array, uint32_t prologueLength); +}; + +// Use zero inline elements because these go on the stack and affect how many +// nested functions are possible. +typedef Vector<jsbytecode, 0> BytecodeVector; +typedef Vector<jssrcnote, 0> SrcNotesVector; + +// Linked list of jump instructions that need to be patched. The linked list is +// stored in the bytes of the incomplete bytecode that will be patched, so no +// extra memory is needed, and patching the instructions destroys the list. +// +// Example: +// +// JumpList brList; +// if (!emitJump(JSOP_IFEQ, &brList)) +// return false; +// ... +// JumpTarget label; +// if (!emitJumpTarget(&label)) +// return false; +// ... +// if (!emitJump(JSOP_GOTO, &brList)) +// return false; +// ... +// patchJumpsToTarget(brList, label); +// +// +-> -1 +// | +// | +// ifeq .. <+ + +-+ ifeq .. +// .. | | .. +// label: | +-> label: +// jumptarget | | jumptarget +// .. | | .. +// goto .. <+ + +-+ goto .. <+ +// | | +// | | +// + + +// brList brList +// +// | ^ +// +------- patchJumpsToTarget -------+ +// + +// Offset of a jump target instruction, used for patching jump instructions. +struct JumpTarget { + ptrdiff_t offset; +}; + +struct JumpList { + // -1 is used to mark the end of jump lists. + JumpList() : offset(-1) {} + ptrdiff_t offset; + + // Add a jump instruction to the list. + void push(jsbytecode* code, ptrdiff_t jumpOffset); + + // Patch all jump instructions in this list to jump to `target`. This + // clobbers the list. + void patchAll(jsbytecode* code, JumpTarget target); +}; + +struct MOZ_STACK_CLASS BytecodeEmitter +{ + class TDZCheckCache; + class NestableControl; + class EmitterScope; + + SharedContext* const sc; /* context shared between parsing and bytecode generation */ + + ExclusiveContext* const cx; + + BytecodeEmitter* const parent; /* enclosing function or global context */ + + Rooted<JSScript*> script; /* the JSScript we're ultimately producing */ + + Rooted<LazyScript*> lazyScript; /* the lazy script if mode is LazyFunction, + nullptr otherwise. */ + + struct EmitSection { + BytecodeVector code; /* bytecode */ + SrcNotesVector notes; /* source notes, see below */ + ptrdiff_t lastNoteOffset; /* code offset for last source note */ + uint32_t currentLine; /* line number for tree-based srcnote gen */ + uint32_t lastColumn; /* zero-based column index on currentLine of + last SRC_COLSPAN-annotated opcode */ + JumpTarget lastTarget; // Last jump target emitted. + + EmitSection(ExclusiveContext* cx, uint32_t lineNum) + : code(cx), notes(cx), lastNoteOffset(0), currentLine(lineNum), lastColumn(0), + lastTarget{ -1 - ptrdiff_t(JSOP_JUMPTARGET_LENGTH) } + {} + }; + EmitSection prologue, main, *current; + + Parser<FullParseHandler>* const parser; + + PooledMapPtr<AtomIndexMap> atomIndices; /* literals indexed for mapping */ + unsigned firstLine; /* first line, for JSScript::initFromEmitter */ + + uint32_t maxFixedSlots; /* maximum number of fixed frame slots so far */ + uint32_t maxStackDepth; /* maximum number of expression stack slots so far */ + + int32_t stackDepth; /* current stack depth in script frame */ + + uint32_t arrayCompDepth; /* stack depth of array in comprehension */ + + unsigned emitLevel; /* emitTree recursion level */ + + uint32_t bodyScopeIndex; /* index into scopeList of the body scope */ + + EmitterScope* varEmitterScope; + NestableControl* innermostNestableControl; + EmitterScope* innermostEmitterScope; + TDZCheckCache* innermostTDZCheckCache; + + CGConstList constList; /* constants to be included with the script */ + CGObjectList objectList; /* list of emitted objects */ + CGScopeList scopeList; /* list of emitted scopes */ + CGTryNoteList tryNoteList; /* list of emitted try notes */ + CGScopeNoteList scopeNoteList; /* list of emitted block scope notes */ + + /* + * For each yield op, map the yield index (stored as bytecode operand) to + * the offset of the next op. + */ + CGYieldOffsetList yieldOffsetList; + + uint16_t typesetCount; /* Number of JOF_TYPESET opcodes generated */ + + bool hasSingletons:1; /* script contains singleton initializer JSOP_OBJECT */ + + bool hasTryFinally:1; /* script contains finally block */ + + bool emittingRunOnceLambda:1; /* true while emitting a lambda which is only + expected to run once. */ + + bool isRunOnceLambda(); + + enum EmitterMode { + Normal, + + /* + * Emit JSOP_GETINTRINSIC instead of JSOP_GETNAME and assert that + * JSOP_GETNAME and JSOP_*GNAME don't ever get emitted. See the comment + * for the field |selfHostingMode| in Parser.h for details. + */ + SelfHosting, + + /* + * Check the static scope chain of the root function for resolving free + * variable accesses in the script. + */ + LazyFunction + }; + + const EmitterMode emitterMode; + + // The end location of a function body that is being emitted. + uint32_t functionBodyEndPos; + // Whether functionBodyEndPos was set. + bool functionBodyEndPosSet; + + /* + * Note that BytecodeEmitters are magic: they own the arena "top-of-stack" + * space above their tempMark points. This means that you cannot alloc from + * tempLifoAlloc and save the pointer beyond the next BytecodeEmitter + * destruction. + */ + BytecodeEmitter(BytecodeEmitter* parent, Parser<FullParseHandler>* parser, SharedContext* sc, + HandleScript script, Handle<LazyScript*> lazyScript, uint32_t lineNum, + EmitterMode emitterMode = Normal); + + // An alternate constructor that uses a TokenPos for the starting + // line and that sets functionBodyEndPos as well. + BytecodeEmitter(BytecodeEmitter* parent, Parser<FullParseHandler>* parser, SharedContext* sc, + HandleScript script, Handle<LazyScript*> lazyScript, + TokenPos bodyPosition, EmitterMode emitterMode = Normal); + + MOZ_MUST_USE bool init(); + + template <typename Predicate /* (NestableControl*) -> bool */> + NestableControl* findInnermostNestableControl(Predicate predicate) const; + + template <typename T> + T* findInnermostNestableControl() const; + + template <typename T, typename Predicate /* (T*) -> bool */> + T* findInnermostNestableControl(Predicate predicate) const; + + NameLocation lookupName(JSAtom* name); + + // To implement Annex B and the formal parameter defaults scope semantics + // requires accessing names that would otherwise be shadowed. This method + // returns the access location of a name that is known to be bound in a + // target scope. + mozilla::Maybe<NameLocation> locationOfNameBoundInScope(JSAtom* name, EmitterScope* target); + + // Get the location of a name known to be bound in the function scope, + // starting at the source scope. + mozilla::Maybe<NameLocation> locationOfNameBoundInFunctionScope(JSAtom* name, + EmitterScope* source); + + mozilla::Maybe<NameLocation> locationOfNameBoundInFunctionScope(JSAtom* name) { + return locationOfNameBoundInFunctionScope(name, innermostEmitterScope); + } + + void setVarEmitterScope(EmitterScope* emitterScope) { + MOZ_ASSERT(emitterScope); + MOZ_ASSERT(!varEmitterScope); + varEmitterScope = emitterScope; + } + + Scope* bodyScope() const { return scopeList.vector[bodyScopeIndex]; } + Scope* outermostScope() const { return scopeList.vector[0]; } + Scope* innermostScope() const; + + MOZ_ALWAYS_INLINE + MOZ_MUST_USE bool makeAtomIndex(JSAtom* atom, uint32_t* indexp) { + MOZ_ASSERT(atomIndices); + AtomIndexMap::AddPtr p = atomIndices->lookupForAdd(atom); + if (p) { + *indexp = p->value(); + return true; + } + + uint32_t index = atomIndices->count(); + if (!atomIndices->add(p, atom, index)) + return false; + + *indexp = index; + return true; + } + + bool isInLoop(); + MOZ_MUST_USE bool checkSingletonContext(); + + // Check whether our function is in a run-once context (a toplevel + // run-one script or a run-once lambda). + MOZ_MUST_USE bool checkRunOnceContext(); + + bool needsImplicitThis(); + + MOZ_MUST_USE bool maybeSetDisplayURL(); + MOZ_MUST_USE bool maybeSetSourceMap(); + void tellDebuggerAboutCompiledScript(ExclusiveContext* cx); + + inline TokenStream* tokenStream(); + + BytecodeVector& code() const { return current->code; } + jsbytecode* code(ptrdiff_t offset) const { return current->code.begin() + offset; } + ptrdiff_t offset() const { return current->code.end() - current->code.begin(); } + ptrdiff_t prologueOffset() const { return prologue.code.end() - prologue.code.begin(); } + void switchToMain() { current = &main; } + void switchToPrologue() { current = &prologue; } + bool inPrologue() const { return current == &prologue; } + + SrcNotesVector& notes() const { return current->notes; } + ptrdiff_t lastNoteOffset() const { return current->lastNoteOffset; } + unsigned currentLine() const { return current->currentLine; } + unsigned lastColumn() const { return current->lastColumn; } + + // Check if the last emitted opcode is a jump target. + bool lastOpcodeIsJumpTarget() const { + return offset() - current->lastTarget.offset == ptrdiff_t(JSOP_JUMPTARGET_LENGTH); + } + + // JumpTarget should not be part of the emitted statement, as they can be + // aliased by multiple statements. If we included the jump target as part of + // the statement we might have issues where the enclosing statement might + // not contain all the opcodes of the enclosed statements. + ptrdiff_t lastNonJumpTargetOffset() const { + return lastOpcodeIsJumpTarget() ? current->lastTarget.offset : offset(); + } + + void setFunctionBodyEndPos(TokenPos pos) { + functionBodyEndPos = pos.end; + functionBodyEndPosSet = true; + } + + bool reportError(ParseNode* pn, unsigned errorNumber, ...); + bool reportStrictWarning(ParseNode* pn, unsigned errorNumber, ...); + bool reportStrictModeError(ParseNode* pn, unsigned errorNumber, ...); + + // If pn contains a useful expression, return true with *answer set to true. + // If pn contains a useless expression, return true with *answer set to + // false. Return false on error. + // + // The caller should initialize *answer to false and invoke this function on + // an expression statement or similar subtree to decide whether the tree + // could produce code that has any side effects. For an expression + // statement, we define useless code as code with no side effects, because + // the main effect, the value left on the stack after the code executes, + // will be discarded by a pop bytecode. + MOZ_MUST_USE bool checkSideEffects(ParseNode* pn, bool* answer); + +#ifdef DEBUG + MOZ_MUST_USE bool checkStrictOrSloppy(JSOp op); +#endif + + // Append a new source note of the given type (and therefore size) to the + // notes dynamic array, updating noteCount. Return the new note's index + // within the array pointed at by current->notes as outparam. + MOZ_MUST_USE bool newSrcNote(SrcNoteType type, unsigned* indexp = nullptr); + MOZ_MUST_USE bool newSrcNote2(SrcNoteType type, ptrdiff_t offset, unsigned* indexp = nullptr); + MOZ_MUST_USE bool newSrcNote3(SrcNoteType type, ptrdiff_t offset1, ptrdiff_t offset2, + unsigned* indexp = nullptr); + + void copySrcNotes(jssrcnote* destination, uint32_t nsrcnotes); + MOZ_MUST_USE bool setSrcNoteOffset(unsigned index, unsigned which, ptrdiff_t offset); + + // NB: this function can add at most one extra extended delta note. + MOZ_MUST_USE bool addToSrcNoteDelta(jssrcnote* sn, ptrdiff_t delta); + + // Finish taking source notes in cx's notePool. If successful, the final + // source note count is stored in the out outparam. + MOZ_MUST_USE bool finishTakingSrcNotes(uint32_t* out); + + // Control whether emitTree emits a line number note. + enum EmitLineNumberNote { + EMIT_LINENOTE, + SUPPRESS_LINENOTE + }; + + // Emit code for the tree rooted at pn. + MOZ_MUST_USE bool emitTree(ParseNode* pn, EmitLineNumberNote emitLineNote = EMIT_LINENOTE); + + // Emit code for the tree rooted at pn with its own TDZ cache. + MOZ_MUST_USE bool emitConditionallyExecutedTree(ParseNode* pn); + + // Emit global, eval, or module code for tree rooted at body. Always + // encompasses the entire source. + MOZ_MUST_USE bool emitScript(ParseNode* body); + + // Emit function code for the tree rooted at body. + MOZ_MUST_USE bool emitFunctionScript(ParseNode* body); + + // If op is JOF_TYPESET (see the type barriers comment in TypeInference.h), + // reserve a type set to store its result. + void checkTypeSet(JSOp op); + + void updateDepth(ptrdiff_t target); + MOZ_MUST_USE bool updateLineNumberNotes(uint32_t offset); + MOZ_MUST_USE bool updateSourceCoordNotes(uint32_t offset); + + JSOp strictifySetNameOp(JSOp op); + + MOZ_MUST_USE bool flushPops(int* npops); + + MOZ_MUST_USE bool emitCheck(ptrdiff_t delta, ptrdiff_t* offset); + + // Emit one bytecode. + MOZ_MUST_USE bool emit1(JSOp op); + + // Emit two bytecodes, an opcode (op) with a byte of immediate operand + // (op1). + MOZ_MUST_USE bool emit2(JSOp op, uint8_t op1); + + // Emit three bytecodes, an opcode with two bytes of immediate operands. + MOZ_MUST_USE bool emit3(JSOp op, jsbytecode op1, jsbytecode op2); + + // Helper to emit JSOP_DUPAT. The argument is the value's depth on the + // JS stack, as measured from the top. + MOZ_MUST_USE bool emitDupAt(unsigned slotFromTop); + + // Helper to emit JSOP_CHECKISOBJ. + MOZ_MUST_USE bool emitCheckIsObj(CheckIsObjectKind kind); + + // Emit a bytecode followed by an uint16 immediate operand stored in + // big-endian order. + MOZ_MUST_USE bool emitUint16Operand(JSOp op, uint32_t operand); + + // Emit a bytecode followed by an uint32 immediate operand. + MOZ_MUST_USE bool emitUint32Operand(JSOp op, uint32_t operand); + + // Emit (1 + extra) bytecodes, for N bytes of op and its immediate operand. + MOZ_MUST_USE bool emitN(JSOp op, size_t extra, ptrdiff_t* offset = nullptr); + + MOZ_MUST_USE bool emitNumberOp(double dval); + + MOZ_MUST_USE bool emitThisLiteral(ParseNode* pn); + MOZ_MUST_USE bool emitGetFunctionThis(ParseNode* pn); + MOZ_MUST_USE bool emitGetThisForSuperBase(ParseNode* pn); + MOZ_MUST_USE bool emitSetThis(ParseNode* pn); + MOZ_MUST_USE bool emitCheckDerivedClassConstructorReturn(); + + // Handle jump opcodes and jump targets. + MOZ_MUST_USE bool emitJumpTarget(JumpTarget* target); + MOZ_MUST_USE bool emitJumpNoFallthrough(JSOp op, JumpList* jump); + MOZ_MUST_USE bool emitJump(JSOp op, JumpList* jump); + MOZ_MUST_USE bool emitBackwardJump(JSOp op, JumpTarget target, JumpList* jump, + JumpTarget* fallthrough); + void patchJumpsToTarget(JumpList jump, JumpTarget target); + MOZ_MUST_USE bool emitJumpTargetAndPatch(JumpList jump); + + MOZ_MUST_USE bool emitCall(JSOp op, uint16_t argc, ParseNode* pn = nullptr); + MOZ_MUST_USE bool emitCallIncDec(ParseNode* incDec); + + MOZ_MUST_USE bool emitLoopHead(ParseNode* nextpn, JumpTarget* top); + MOZ_MUST_USE bool emitLoopEntry(ParseNode* nextpn, JumpList entryJump); + + MOZ_MUST_USE bool emitGoto(NestableControl* target, JumpList* jumplist, + SrcNoteType noteType = SRC_NULL); + + MOZ_MUST_USE bool emitIndex32(JSOp op, uint32_t index); + MOZ_MUST_USE bool emitIndexOp(JSOp op, uint32_t index); + + MOZ_MUST_USE bool emitAtomOp(JSAtom* atom, JSOp op); + MOZ_MUST_USE bool emitAtomOp(ParseNode* pn, JSOp op); + + MOZ_MUST_USE bool emitArrayLiteral(ParseNode* pn); + MOZ_MUST_USE bool emitArray(ParseNode* pn, uint32_t count, JSOp op); + MOZ_MUST_USE bool emitArrayComp(ParseNode* pn); + + MOZ_MUST_USE bool emitInternedScopeOp(uint32_t index, JSOp op); + MOZ_MUST_USE bool emitInternedObjectOp(uint32_t index, JSOp op); + MOZ_MUST_USE bool emitObjectOp(ObjectBox* objbox, JSOp op); + MOZ_MUST_USE bool emitObjectPairOp(ObjectBox* objbox1, ObjectBox* objbox2, JSOp op); + MOZ_MUST_USE bool emitRegExp(uint32_t index); + + MOZ_NEVER_INLINE MOZ_MUST_USE bool emitFunction(ParseNode* pn, bool needsProto = false); + MOZ_NEVER_INLINE MOZ_MUST_USE bool emitObject(ParseNode* pn); + + MOZ_MUST_USE bool emitHoistedFunctionsInList(ParseNode* pn); + + MOZ_MUST_USE bool emitPropertyList(ParseNode* pn, MutableHandlePlainObject objp, + PropListType type); + + // To catch accidental misuse, emitUint16Operand/emit3 assert that they are + // not used to unconditionally emit JSOP_GETLOCAL. Variable access should + // instead be emitted using EmitVarOp. In special cases, when the caller + // definitely knows that a given local slot is unaliased, this function may be + // used as a non-asserting version of emitUint16Operand. + MOZ_MUST_USE bool emitLocalOp(JSOp op, uint32_t slot); + + MOZ_MUST_USE bool emitArgOp(JSOp op, uint16_t slot); + MOZ_MUST_USE bool emitEnvCoordOp(JSOp op, EnvironmentCoordinate ec); + + MOZ_MUST_USE bool emitGetNameAtLocation(JSAtom* name, const NameLocation& loc, + bool callContext = false); + MOZ_MUST_USE bool emitGetName(JSAtom* name, bool callContext = false) { + return emitGetNameAtLocation(name, lookupName(name), callContext); + } + MOZ_MUST_USE bool emitGetName(ParseNode* pn, bool callContext = false); + + template <typename RHSEmitter> + MOZ_MUST_USE bool emitSetOrInitializeNameAtLocation(HandleAtom name, const NameLocation& loc, + RHSEmitter emitRhs, bool initialize); + template <typename RHSEmitter> + MOZ_MUST_USE bool emitSetOrInitializeName(HandleAtom name, RHSEmitter emitRhs, + bool initialize) + { + return emitSetOrInitializeNameAtLocation(name, lookupName(name), emitRhs, initialize); + } + template <typename RHSEmitter> + MOZ_MUST_USE bool emitSetName(ParseNode* pn, RHSEmitter emitRhs) { + RootedAtom name(cx, pn->name()); + return emitSetName(name, emitRhs); + } + template <typename RHSEmitter> + MOZ_MUST_USE bool emitSetName(HandleAtom name, RHSEmitter emitRhs) { + return emitSetOrInitializeName(name, emitRhs, false); + } + template <typename RHSEmitter> + MOZ_MUST_USE bool emitInitializeName(ParseNode* pn, RHSEmitter emitRhs) { + RootedAtom name(cx, pn->name()); + return emitInitializeName(name, emitRhs); + } + template <typename RHSEmitter> + MOZ_MUST_USE bool emitInitializeName(HandleAtom name, RHSEmitter emitRhs) { + return emitSetOrInitializeName(name, emitRhs, true); + } + + MOZ_MUST_USE bool emitTDZCheckIfNeeded(JSAtom* name, const NameLocation& loc); + + MOZ_MUST_USE bool emitNameIncDec(ParseNode* pn); + + MOZ_MUST_USE bool emitDeclarationList(ParseNode* decls); + MOZ_MUST_USE bool emitSingleDeclaration(ParseNode* decls, ParseNode* decl, + ParseNode* initializer); + + MOZ_MUST_USE bool emitNewInit(JSProtoKey key); + MOZ_MUST_USE bool emitSingletonInitialiser(ParseNode* pn); + + MOZ_MUST_USE bool emitPrepareIteratorResult(); + MOZ_MUST_USE bool emitFinishIteratorResult(bool done); + MOZ_MUST_USE bool iteratorResultShape(unsigned* shape); + + MOZ_MUST_USE bool emitYield(ParseNode* pn); + MOZ_MUST_USE bool emitYieldOp(JSOp op); + MOZ_MUST_USE bool emitYieldStar(ParseNode* iter, ParseNode* gen); + + MOZ_MUST_USE bool emitPropLHS(ParseNode* pn); + MOZ_MUST_USE bool emitPropOp(ParseNode* pn, JSOp op); + MOZ_MUST_USE bool emitPropIncDec(ParseNode* pn); + + MOZ_MUST_USE bool emitAsyncWrapperLambda(unsigned index, bool isArrow); + MOZ_MUST_USE bool emitAsyncWrapper(unsigned index, bool needsHomeObject, bool isArrow); + + MOZ_MUST_USE bool emitComputedPropertyName(ParseNode* computedPropName); + + // Emit bytecode to put operands for a JSOP_GETELEM/CALLELEM/SETELEM/DELELEM + // opcode onto the stack in the right order. In the case of SETELEM, the + // value to be assigned must already be pushed. + enum class EmitElemOption { Get, Set, Call, IncDec, CompoundAssign }; + MOZ_MUST_USE bool emitElemOperands(ParseNode* pn, EmitElemOption opts); + + MOZ_MUST_USE bool emitElemOpBase(JSOp op); + MOZ_MUST_USE bool emitElemOp(ParseNode* pn, JSOp op); + MOZ_MUST_USE bool emitElemIncDec(ParseNode* pn); + + MOZ_MUST_USE bool emitCatch(ParseNode* pn); + MOZ_MUST_USE bool emitIf(ParseNode* pn); + MOZ_MUST_USE bool emitWith(ParseNode* pn); + + MOZ_NEVER_INLINE MOZ_MUST_USE bool emitLabeledStatement(const LabeledStatement* pn); + MOZ_NEVER_INLINE MOZ_MUST_USE bool emitLexicalScope(ParseNode* pn); + MOZ_MUST_USE bool emitLexicalScopeBody(ParseNode* body, + EmitLineNumberNote emitLineNote = EMIT_LINENOTE); + MOZ_NEVER_INLINE MOZ_MUST_USE bool emitSwitch(ParseNode* pn); + MOZ_NEVER_INLINE MOZ_MUST_USE bool emitTry(ParseNode* pn); + + enum DestructuringFlavor { + // Destructuring into a declaration. + DestructuringDeclaration, + + // Destructuring into a formal parameter, when the formal parameters + // contain an expression that might be evaluated, and thus require + // this destructuring to assign not into the innermost scope that + // contains the function body's vars, but into its enclosing scope for + // parameter expressions. + DestructuringFormalParameterInVarScope, + + // Destructuring as part of an AssignmentExpression. + DestructuringAssignment + }; + + // emitDestructuringLHS assumes the to-be-destructured value has been pushed on + // the stack and emits code to destructure a single lhs expression (either a + // name or a compound []/{} expression). + MOZ_MUST_USE bool emitDestructuringLHS(ParseNode* target, DestructuringFlavor flav); + MOZ_MUST_USE bool emitConditionallyExecutedDestructuringLHS(ParseNode* target, + DestructuringFlavor flav); + + // emitDestructuringOps assumes the to-be-destructured value has been + // pushed on the stack and emits code to destructure each part of a [] or + // {} lhs expression. + MOZ_MUST_USE bool emitDestructuringOps(ParseNode* pattern, DestructuringFlavor flav); + MOZ_MUST_USE bool emitDestructuringOpsArray(ParseNode* pattern, DestructuringFlavor flav); + MOZ_MUST_USE bool emitDestructuringOpsObject(ParseNode* pattern, DestructuringFlavor flav); + + typedef bool + (*DestructuringDeclEmitter)(BytecodeEmitter* bce, ParseNode* pn); + + template <typename NameEmitter> + MOZ_MUST_USE bool emitDestructuringDeclsWithEmitter(ParseNode* pattern, NameEmitter emitName); + + // Throw a TypeError if the value atop the stack isn't convertible to an + // object, with no overall effect on the stack. + MOZ_MUST_USE bool emitRequireObjectCoercible(); + + // emitIterator expects the iterable to already be on the stack. + // It will replace that stack value with the corresponding iterator + MOZ_MUST_USE bool emitIterator(); + + // Pops iterator from the top of the stack. Pushes the result of |.next()| + // onto the stack. + MOZ_MUST_USE bool emitIteratorNext(ParseNode* pn, bool allowSelfHosted = false); + + // Check if the value on top of the stack is "undefined". If so, replace + // that value on the stack with the value defined by |defaultExpr|. + MOZ_MUST_USE bool emitDefault(ParseNode* defaultExpr); + + MOZ_MUST_USE bool emitCallSiteObject(ParseNode* pn); + MOZ_MUST_USE bool emitTemplateString(ParseNode* pn); + MOZ_MUST_USE bool emitAssignment(ParseNode* lhs, JSOp op, ParseNode* rhs); + + MOZ_MUST_USE bool emitReturn(ParseNode* pn); + MOZ_MUST_USE bool emitStatement(ParseNode* pn); + MOZ_MUST_USE bool emitStatementList(ParseNode* pn); + + MOZ_MUST_USE bool emitDeleteName(ParseNode* pn); + MOZ_MUST_USE bool emitDeleteProperty(ParseNode* pn); + MOZ_MUST_USE bool emitDeleteElement(ParseNode* pn); + MOZ_MUST_USE bool emitDeleteExpression(ParseNode* pn); + + // |op| must be JSOP_TYPEOF or JSOP_TYPEOFEXPR. + MOZ_MUST_USE bool emitTypeof(ParseNode* node, JSOp op); + + MOZ_MUST_USE bool emitUnary(ParseNode* pn); + MOZ_MUST_USE bool emitRightAssociative(ParseNode* pn); + MOZ_MUST_USE bool emitLeftAssociative(ParseNode* pn); + MOZ_MUST_USE bool emitLogical(ParseNode* pn); + MOZ_MUST_USE bool emitSequenceExpr(ParseNode* pn); + + MOZ_NEVER_INLINE MOZ_MUST_USE bool emitIncOrDec(ParseNode* pn); + + MOZ_MUST_USE bool emitConditionalExpression(ConditionalExpression& conditional); + + MOZ_MUST_USE bool isRestParameter(ParseNode* pn, bool* result); + MOZ_MUST_USE bool emitOptimizeSpread(ParseNode* arg0, JumpList* jmp, bool* emitted); + + MOZ_MUST_USE bool emitCallOrNew(ParseNode* pn); + MOZ_MUST_USE bool emitSelfHostedCallFunction(ParseNode* pn); + MOZ_MUST_USE bool emitSelfHostedResumeGenerator(ParseNode* pn); + MOZ_MUST_USE bool emitSelfHostedForceInterpreter(ParseNode* pn); + MOZ_MUST_USE bool emitSelfHostedAllowContentSpread(ParseNode* pn); + + MOZ_MUST_USE bool emitComprehensionFor(ParseNode* compFor); + MOZ_MUST_USE bool emitComprehensionForIn(ParseNode* pn); + MOZ_MUST_USE bool emitComprehensionForInOrOfVariables(ParseNode* pn, bool* lexicalScope); + MOZ_MUST_USE bool emitComprehensionForOf(ParseNode* pn); + + MOZ_MUST_USE bool emitDo(ParseNode* pn); + MOZ_MUST_USE bool emitWhile(ParseNode* pn); + + MOZ_MUST_USE bool emitFor(ParseNode* pn, EmitterScope* headLexicalEmitterScope = nullptr); + MOZ_MUST_USE bool emitCStyleFor(ParseNode* pn, EmitterScope* headLexicalEmitterScope); + MOZ_MUST_USE bool emitForIn(ParseNode* pn, EmitterScope* headLexicalEmitterScope); + MOZ_MUST_USE bool emitForOf(ParseNode* pn, EmitterScope* headLexicalEmitterScope); + + MOZ_MUST_USE bool emitInitializeForInOrOfTarget(ParseNode* forHead); + + MOZ_MUST_USE bool emitBreak(PropertyName* label); + MOZ_MUST_USE bool emitContinue(PropertyName* label); + + MOZ_MUST_USE bool emitFunctionFormalParametersAndBody(ParseNode* pn); + MOZ_MUST_USE bool emitFunctionFormalParameters(ParseNode* pn); + MOZ_MUST_USE bool emitInitializeFunctionSpecialNames(); + MOZ_MUST_USE bool emitFunctionBody(ParseNode* pn); + MOZ_MUST_USE bool emitLexicalInitialization(ParseNode* pn); + + // Emit bytecode for the spread operator. + // + // emitSpread expects the current index (I) of the array, the array itself + // and the iterator to be on the stack in that order (iterator on the bottom). + // It will pop the iterator and I, then iterate over the iterator by calling + // |.next()| and put the results into the I-th element of array with + // incrementing I, then push the result I (it will be original I + + // iteration count). The stack after iteration will look like |ARRAY INDEX|. + MOZ_MUST_USE bool emitSpread(bool allowSelfHosted = false); + + MOZ_MUST_USE bool emitClass(ParseNode* pn); + MOZ_MUST_USE bool emitSuperPropLHS(ParseNode* superBase, bool isCall = false); + MOZ_MUST_USE bool emitSuperPropOp(ParseNode* pn, JSOp op, bool isCall = false); + MOZ_MUST_USE bool emitSuperElemOperands(ParseNode* pn, + EmitElemOption opts = EmitElemOption::Get); + MOZ_MUST_USE bool emitSuperElemOp(ParseNode* pn, JSOp op, bool isCall = false); +}; + +} /* namespace frontend */ +} /* namespace js */ + +#endif /* frontend_BytecodeEmitter_h */ diff --git a/js/src/frontend/FoldConstants.cpp b/js/src/frontend/FoldConstants.cpp new file mode 100644 index 000000000..6f62ffac6 --- /dev/null +++ b/js/src/frontend/FoldConstants.cpp @@ -0,0 +1,1928 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- + * vim: set ts=8 sts=4 et sw=4 tw=99: + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#include "frontend/FoldConstants.h" + +#include "mozilla/FloatingPoint.h" + +#include "jslibmath.h" + +#include "frontend/ParseNode.h" +#include "frontend/Parser.h" +#include "js/Conversions.h" + +#include "jscntxtinlines.h" +#include "jsobjinlines.h" + +using namespace js; +using namespace js::frontend; + +using mozilla::IsNaN; +using mozilla::IsNegative; +using mozilla::NegativeInfinity; +using mozilla::PositiveInfinity; +using JS::GenericNaN; +using JS::ToInt32; +using JS::ToUint32; + +static bool +ContainsHoistedDeclaration(ExclusiveContext* cx, ParseNode* node, bool* result); + +static bool +ListContainsHoistedDeclaration(ExclusiveContext* cx, ListNode* list, bool* result) +{ + for (ParseNode* node = list->pn_head; node; node = node->pn_next) { + if (!ContainsHoistedDeclaration(cx, node, result)) + return false; + if (*result) + return true; + } + + *result = false; + return true; +} + +// Determines whether the given ParseNode contains any declarations whose +// visibility will extend outside the node itself -- that is, whether the +// ParseNode contains any var statements. +// +// THIS IS NOT A GENERAL-PURPOSE FUNCTION. It is only written to work in the +// specific context of deciding that |node|, as one arm of a PNK_IF controlled +// by a constant condition, contains a declaration that forbids |node| being +// completely eliminated as dead. +static bool +ContainsHoistedDeclaration(ExclusiveContext* cx, ParseNode* node, bool* result) +{ + JS_CHECK_RECURSION(cx, return false); + + restart: + + // With a better-typed AST, we would have distinct parse node classes for + // expressions and for statements and would characterize expressions with + // ExpressionKind and statements with StatementKind. Perhaps someday. In + // the meantime we must characterize every ParseNodeKind, even the + // expression/sub-expression ones that, if we handle all statement kinds + // correctly, we'll never see. + switch (node->getKind()) { + // Base case. + case PNK_VAR: + *result = true; + return true; + + // Non-global lexical declarations are block-scoped (ergo not hoistable). + case PNK_LET: + case PNK_CONST: + MOZ_ASSERT(node->isArity(PN_LIST)); + *result = false; + return true; + + // Similarly to the lexical declarations above, classes cannot add hoisted + // declarations + case PNK_CLASS: + MOZ_ASSERT(node->isArity(PN_TERNARY)); + *result = false; + return true; + + // Function declarations *can* be hoisted declarations. But in the + // magical world of the rewritten frontend, the declaration necessitated + // by a nested function statement, not at body level, doesn't require + // that we preserve an unreachable function declaration node against + // dead-code removal. + case PNK_FUNCTION: + MOZ_ASSERT(node->isArity(PN_CODE)); + *result = false; + return true; + + case PNK_MODULE: + *result = false; + return true; + + // Statements with no sub-components at all. + case PNK_NOP: // induced by function f() {} function f() {} + case PNK_DEBUGGER: + MOZ_ASSERT(node->isArity(PN_NULLARY)); + *result = false; + return true; + + // Statements containing only an expression have no declarations. + case PNK_SEMI: + case PNK_THROW: + case PNK_RETURN: + MOZ_ASSERT(node->isArity(PN_UNARY)); + *result = false; + return true; + + // These two aren't statements in the spec, but we sometimes insert them + // in statement lists anyway. + case PNK_YIELD_STAR: + case PNK_YIELD: + MOZ_ASSERT(node->isArity(PN_BINARY)); + *result = false; + return true; + + // Other statements with no sub-statement components. + case PNK_BREAK: + case PNK_CONTINUE: + case PNK_IMPORT: + case PNK_IMPORT_SPEC_LIST: + case PNK_IMPORT_SPEC: + case PNK_EXPORT_FROM: + case PNK_EXPORT_DEFAULT: + case PNK_EXPORT_SPEC_LIST: + case PNK_EXPORT_SPEC: + case PNK_EXPORT: + case PNK_EXPORT_BATCH_SPEC: + *result = false; + return true; + + // Statements possibly containing hoistable declarations only in the left + // half, in ParseNode terms -- the loop body in AST terms. + case PNK_DOWHILE: + return ContainsHoistedDeclaration(cx, node->pn_left, result); + + // Statements possibly containing hoistable declarations only in the + // right half, in ParseNode terms -- the loop body or nested statement + // (usually a block statement), in AST terms. + case PNK_WHILE: + case PNK_WITH: + return ContainsHoistedDeclaration(cx, node->pn_right, result); + + case PNK_LABEL: + return ContainsHoistedDeclaration(cx, node->pn_expr, result); + + // Statements with more complicated structures. + + // if-statement nodes may have hoisted declarations in their consequent + // and alternative components. + case PNK_IF: { + MOZ_ASSERT(node->isArity(PN_TERNARY)); + + ParseNode* consequent = node->pn_kid2; + if (!ContainsHoistedDeclaration(cx, consequent, result)) + return false; + if (*result) + return true; + + if ((node = node->pn_kid3)) + goto restart; + + *result = false; + return true; + } + + // Legacy array and generator comprehensions use PNK_IF to represent + // conditions specified in the comprehension tail: for example, + // [x for (x in obj) if (x)]. The consequent of such PNK_IF nodes is + // either PNK_YIELD in a PNK_SEMI statement (generator comprehensions) or + // PNK_ARRAYPUSH (array comprehensions) . The first case is consistent + // with normal if-statement structure with consequent/alternative as + // statements. The second case is abnormal and requires that we not + // banish PNK_ARRAYPUSH to the unreachable list, handling it explicitly. + // + // We could require that this one weird PNK_ARRAYPUSH case be packaged in + // a PNK_SEMI, for consistency. That requires careful bytecode emitter + // adjustment that seems unwarranted for a deprecated feature. + case PNK_ARRAYPUSH: + *result = false; + return true; + + // try-statements have statements to execute, and one or both of a + // catch-list and a finally-block. + case PNK_TRY: { + MOZ_ASSERT(node->isArity(PN_TERNARY)); + MOZ_ASSERT(node->pn_kid2 || node->pn_kid3, + "must have either catch(es) or finally"); + + ParseNode* tryBlock = node->pn_kid1; + if (!ContainsHoistedDeclaration(cx, tryBlock, result)) + return false; + if (*result) + return true; + + if (ParseNode* catchList = node->pn_kid2) { + for (ParseNode* lexicalScope = catchList->pn_head; + lexicalScope; + lexicalScope = lexicalScope->pn_next) + { + MOZ_ASSERT(lexicalScope->isKind(PNK_LEXICALSCOPE)); + + ParseNode* catchNode = lexicalScope->pn_expr; + MOZ_ASSERT(catchNode->isKind(PNK_CATCH)); + + ParseNode* catchStatements = catchNode->pn_kid3; + if (!ContainsHoistedDeclaration(cx, catchStatements, result)) + return false; + if (*result) + return true; + } + } + + if (ParseNode* finallyBlock = node->pn_kid3) + return ContainsHoistedDeclaration(cx, finallyBlock, result); + + *result = false; + return true; + } + + // A switch node's left half is an expression; only its right half (a + // list of cases/defaults, or a block node) could contain hoisted + // declarations. + case PNK_SWITCH: + MOZ_ASSERT(node->isArity(PN_BINARY)); + return ContainsHoistedDeclaration(cx, node->pn_right, result); + + case PNK_CASE: + return ContainsHoistedDeclaration(cx, node->as<CaseClause>().statementList(), result); + + case PNK_FOR: + case PNK_COMPREHENSIONFOR: { + MOZ_ASSERT(node->isArity(PN_BINARY)); + + ParseNode* loopHead = node->pn_left; + MOZ_ASSERT(loopHead->isKind(PNK_FORHEAD) || + loopHead->isKind(PNK_FORIN) || + loopHead->isKind(PNK_FOROF)); + + if (loopHead->isKind(PNK_FORHEAD)) { + // for (init?; cond?; update?), with only init possibly containing + // a hoisted declaration. (Note: a lexical-declaration |init| is + // (at present) hoisted in SpiderMonkey parlance -- but such + // hoisting doesn't extend outside of this statement, so it is not + // hoisting in the sense meant by ContainsHoistedDeclaration.) + MOZ_ASSERT(loopHead->isArity(PN_TERNARY)); + + ParseNode* init = loopHead->pn_kid1; + if (init && init->isKind(PNK_VAR)) { + *result = true; + return true; + } + } else { + MOZ_ASSERT(loopHead->isKind(PNK_FORIN) || loopHead->isKind(PNK_FOROF)); + + // for each? (target in ...), where only target may introduce + // hoisted declarations. + // + // -- or -- + // + // for (target of ...), where only target may introduce hoisted + // declarations. + // + // Either way, if |target| contains a declaration, it's |loopHead|'s + // first kid. + MOZ_ASSERT(loopHead->isArity(PN_TERNARY)); + + ParseNode* decl = loopHead->pn_kid1; + if (decl && decl->isKind(PNK_VAR)) { + *result = true; + return true; + } + } + + ParseNode* loopBody = node->pn_right; + return ContainsHoistedDeclaration(cx, loopBody, result); + } + + case PNK_LEXICALSCOPE: { + MOZ_ASSERT(node->isArity(PN_SCOPE)); + ParseNode* expr = node->pn_expr; + + if (expr->isKind(PNK_FOR) || expr->isKind(PNK_FUNCTION)) + return ContainsHoistedDeclaration(cx, expr, result); + + MOZ_ASSERT(expr->isKind(PNK_STATEMENTLIST)); + return ListContainsHoistedDeclaration(cx, &node->pn_expr->as<ListNode>(), result); + } + + // List nodes with all non-null children. + case PNK_STATEMENTLIST: + return ListContainsHoistedDeclaration(cx, &node->as<ListNode>(), result); + + // Grammar sub-components that should never be reached directly by this + // method, because some parent component should have asserted itself. + case PNK_OBJECT_PROPERTY_NAME: + case PNK_COMPUTED_NAME: + case PNK_SPREAD: + case PNK_MUTATEPROTO: + case PNK_COLON: + case PNK_SHORTHAND: + case PNK_CONDITIONAL: + case PNK_TYPEOFNAME: + case PNK_TYPEOFEXPR: + case PNK_AWAIT: + case PNK_VOID: + case PNK_NOT: + case PNK_BITNOT: + case PNK_DELETENAME: + case PNK_DELETEPROP: + case PNK_DELETEELEM: + case PNK_DELETEEXPR: + case PNK_POS: + case PNK_NEG: + case PNK_PREINCREMENT: + case PNK_POSTINCREMENT: + case PNK_PREDECREMENT: + case PNK_POSTDECREMENT: + case PNK_OR: + case PNK_AND: + case PNK_BITOR: + case PNK_BITXOR: + case PNK_BITAND: + case PNK_STRICTEQ: + case PNK_EQ: + case PNK_STRICTNE: + case PNK_NE: + case PNK_LT: + case PNK_LE: + case PNK_GT: + case PNK_GE: + case PNK_INSTANCEOF: + case PNK_IN: + case PNK_LSH: + case PNK_RSH: + case PNK_URSH: + case PNK_ADD: + case PNK_SUB: + case PNK_STAR: + case PNK_DIV: + case PNK_MOD: + case PNK_POW: + case PNK_ASSIGN: + case PNK_ADDASSIGN: + case PNK_SUBASSIGN: + case PNK_BITORASSIGN: + case PNK_BITXORASSIGN: + case PNK_BITANDASSIGN: + case PNK_LSHASSIGN: + case PNK_RSHASSIGN: + case PNK_URSHASSIGN: + case PNK_MULASSIGN: + case PNK_DIVASSIGN: + case PNK_MODASSIGN: + case PNK_POWASSIGN: + case PNK_COMMA: + case PNK_ARRAY: + case PNK_OBJECT: + case PNK_DOT: + case PNK_ELEM: + case PNK_CALL: + case PNK_NAME: + case PNK_TEMPLATE_STRING: + case PNK_TEMPLATE_STRING_LIST: + case PNK_TAGGED_TEMPLATE: + case PNK_CALLSITEOBJ: + case PNK_STRING: + case PNK_REGEXP: + case PNK_TRUE: + case PNK_FALSE: + case PNK_NULL: + case PNK_THIS: + case PNK_ELISION: + case PNK_NUMBER: + case PNK_NEW: + case PNK_GENERATOR: + case PNK_GENEXP: + case PNK_ARRAYCOMP: + case PNK_PARAMSBODY: + case PNK_CATCHLIST: + case PNK_CATCH: + case PNK_FORIN: + case PNK_FOROF: + case PNK_FORHEAD: + case PNK_CLASSMETHOD: + case PNK_CLASSMETHODLIST: + case PNK_CLASSNAMES: + case PNK_NEWTARGET: + case PNK_POSHOLDER: + case PNK_SUPERCALL: + case PNK_SUPERBASE: + case PNK_SETTHIS: + MOZ_CRASH("ContainsHoistedDeclaration should have indicated false on " + "some parent node without recurring to test this node"); + + case PNK_LIMIT: // invalid sentinel value + MOZ_CRASH("unexpected PNK_LIMIT in node"); + } + + MOZ_CRASH("invalid node kind"); +} + +/* + * Fold from one constant type to another. + * XXX handles only strings and numbers for now + */ +static bool +FoldType(ExclusiveContext* cx, ParseNode* pn, ParseNodeKind kind) +{ + if (!pn->isKind(kind)) { + switch (kind) { + case PNK_NUMBER: + if (pn->isKind(PNK_STRING)) { + double d; + if (!StringToNumber(cx, pn->pn_atom, &d)) + return false; + pn->pn_dval = d; + pn->setKind(PNK_NUMBER); + pn->setOp(JSOP_DOUBLE); + } + break; + + case PNK_STRING: + if (pn->isKind(PNK_NUMBER)) { + pn->pn_atom = NumberToAtom(cx, pn->pn_dval); + if (!pn->pn_atom) + return false; + pn->setKind(PNK_STRING); + pn->setOp(JSOP_STRING); + } + break; + + default:; + } + } + return true; +} + +// Remove a ParseNode, **pnp, from a parse tree, putting another ParseNode, +// *pn, in its place. +// +// pnp points to a ParseNode pointer. This must be the only pointer that points +// to the parse node being replaced. The replacement, *pn, is unchanged except +// for its pn_next pointer; updating that is necessary if *pn's new parent is a +// list node. +static void +ReplaceNode(ParseNode** pnp, ParseNode* pn) +{ + pn->pn_next = (*pnp)->pn_next; + *pnp = pn; +} + +static bool +IsEffectless(ParseNode* node) +{ + return node->isKind(PNK_TRUE) || + node->isKind(PNK_FALSE) || + node->isKind(PNK_STRING) || + node->isKind(PNK_TEMPLATE_STRING) || + node->isKind(PNK_NUMBER) || + node->isKind(PNK_NULL) || + node->isKind(PNK_FUNCTION) || + node->isKind(PNK_GENEXP); +} + +enum Truthiness { Truthy, Falsy, Unknown }; + +static Truthiness +Boolish(ParseNode* pn) +{ + switch (pn->getKind()) { + case PNK_NUMBER: + return (pn->pn_dval != 0 && !IsNaN(pn->pn_dval)) ? Truthy : Falsy; + + case PNK_STRING: + case PNK_TEMPLATE_STRING: + return (pn->pn_atom->length() > 0) ? Truthy : Falsy; + + case PNK_TRUE: + case PNK_FUNCTION: + case PNK_GENEXP: + return Truthy; + + case PNK_FALSE: + case PNK_NULL: + return Falsy; + + case PNK_VOID: { + // |void <foo>| evaluates to |undefined| which isn't truthy. But the + // sense of this method requires that the expression be literally + // replaceable with true/false: not the case if the nested expression + // is effectful, might throw, &c. Walk past the |void| (and nested + // |void| expressions, for good measure) and check that the nested + // expression doesn't break this requirement before indicating falsity. + do { + pn = pn->pn_kid; + } while (pn->isKind(PNK_VOID)); + + return IsEffectless(pn) ? Falsy : Unknown; + } + + default: + return Unknown; + } +} + +static bool +Fold(ExclusiveContext* cx, ParseNode** pnp, Parser<FullParseHandler>& parser, bool inGenexpLambda); + +static bool +FoldCondition(ExclusiveContext* cx, ParseNode** nodePtr, Parser<FullParseHandler>& parser, + bool inGenexpLambda) +{ + // Conditions fold like any other expression... + if (!Fold(cx, nodePtr, parser, inGenexpLambda)) + return false; + + // ...but then they sometimes can be further folded to constants. + ParseNode* node = *nodePtr; + Truthiness t = Boolish(node); + if (t != Unknown) { + // We can turn function nodes into constant nodes here, but mutating + // function nodes is tricky --- in particular, mutating a function node + // that appears on a method list corrupts the method list. However, + // methods are M's in statements of the form 'this.foo = M;', which we + // never fold, so we're okay. + parser.prepareNodeForMutation(node); + if (t == Truthy) { + node->setKind(PNK_TRUE); + node->setOp(JSOP_TRUE); + } else { + node->setKind(PNK_FALSE); + node->setOp(JSOP_FALSE); + } + node->setArity(PN_NULLARY); + } + + return true; +} + +static bool +FoldTypeOfExpr(ExclusiveContext* cx, ParseNode* node, Parser<FullParseHandler>& parser, + bool inGenexpLambda) +{ + MOZ_ASSERT(node->isKind(PNK_TYPEOFEXPR)); + MOZ_ASSERT(node->isArity(PN_UNARY)); + + ParseNode*& expr = node->pn_kid; + if (!Fold(cx, &expr, parser, inGenexpLambda)) + return false; + + // Constant-fold the entire |typeof| if given a constant with known type. + RootedPropertyName result(cx); + if (expr->isKind(PNK_STRING) || expr->isKind(PNK_TEMPLATE_STRING)) + result = cx->names().string; + else if (expr->isKind(PNK_NUMBER)) + result = cx->names().number; + else if (expr->isKind(PNK_NULL)) + result = cx->names().object; + else if (expr->isKind(PNK_TRUE) || expr->isKind(PNK_FALSE)) + result = cx->names().boolean; + else if (expr->isKind(PNK_FUNCTION)) + result = cx->names().function; + + if (result) { + parser.prepareNodeForMutation(node); + + node->setKind(PNK_STRING); + node->setArity(PN_NULLARY); + node->setOp(JSOP_NOP); + node->pn_atom = result; + } + + return true; +} + +static bool +FoldDeleteExpr(ExclusiveContext* cx, ParseNode* node, Parser<FullParseHandler>& parser, + bool inGenexpLambda) +{ + MOZ_ASSERT(node->isKind(PNK_DELETEEXPR)); + MOZ_ASSERT(node->isArity(PN_UNARY)); + + ParseNode*& expr = node->pn_kid; + if (!Fold(cx, &expr, parser, inGenexpLambda)) + return false; + + // Expression deletion evaluates the expression, then evaluates to true. + // For effectless expressions, eliminate the expression evaluation. + if (IsEffectless(expr)) { + parser.prepareNodeForMutation(node); + node->setKind(PNK_TRUE); + node->setArity(PN_NULLARY); + node->setOp(JSOP_TRUE); + } + + return true; +} + +static bool +FoldDeleteElement(ExclusiveContext* cx, ParseNode* node, Parser<FullParseHandler>& parser, + bool inGenexpLambda) +{ + MOZ_ASSERT(node->isKind(PNK_DELETEELEM)); + MOZ_ASSERT(node->isArity(PN_UNARY)); + MOZ_ASSERT(node->pn_kid->isKind(PNK_ELEM)); + + ParseNode*& expr = node->pn_kid; + if (!Fold(cx, &expr, parser, inGenexpLambda)) + return false; + + // If we're deleting an element, but constant-folding converted our + // element reference into a dotted property access, we must *also* + // morph the node's kind. + // + // In principle this also applies to |super["foo"] -> super.foo|, + // but we don't constant-fold |super["foo"]| yet. + MOZ_ASSERT(expr->isKind(PNK_ELEM) || expr->isKind(PNK_DOT)); + if (expr->isKind(PNK_DOT)) + node->setKind(PNK_DELETEPROP); + + return true; +} + +static bool +FoldDeleteProperty(ExclusiveContext* cx, ParseNode* node, Parser<FullParseHandler>& parser, + bool inGenexpLambda) +{ + MOZ_ASSERT(node->isKind(PNK_DELETEPROP)); + MOZ_ASSERT(node->isArity(PN_UNARY)); + MOZ_ASSERT(node->pn_kid->isKind(PNK_DOT)); + + ParseNode*& expr = node->pn_kid; +#ifdef DEBUG + ParseNodeKind oldKind = expr->getKind(); +#endif + + if (!Fold(cx, &expr, parser, inGenexpLambda)) + return false; + + MOZ_ASSERT(expr->isKind(oldKind), + "kind should have remained invariant under folding"); + + return true; +} + +static bool +FoldNot(ExclusiveContext* cx, ParseNode* node, Parser<FullParseHandler>& parser, + bool inGenexpLambda) +{ + MOZ_ASSERT(node->isKind(PNK_NOT)); + MOZ_ASSERT(node->isArity(PN_UNARY)); + + ParseNode*& expr = node->pn_kid; + if (!FoldCondition(cx, &expr, parser, inGenexpLambda)) + return false; + + if (expr->isKind(PNK_NUMBER)) { + double d = expr->pn_dval; + + parser.prepareNodeForMutation(node); + if (d == 0 || IsNaN(d)) { + node->setKind(PNK_TRUE); + node->setOp(JSOP_TRUE); + } else { + node->setKind(PNK_FALSE); + node->setOp(JSOP_FALSE); + } + node->setArity(PN_NULLARY); + } else if (expr->isKind(PNK_TRUE) || expr->isKind(PNK_FALSE)) { + bool newval = !expr->isKind(PNK_TRUE); + + parser.prepareNodeForMutation(node); + node->setKind(newval ? PNK_TRUE : PNK_FALSE); + node->setArity(PN_NULLARY); + node->setOp(newval ? JSOP_TRUE : JSOP_FALSE); + } + + return true; +} + +static bool +FoldUnaryArithmetic(ExclusiveContext* cx, ParseNode* node, Parser<FullParseHandler>& parser, + bool inGenexpLambda) +{ + MOZ_ASSERT(node->isKind(PNK_BITNOT) || node->isKind(PNK_POS) || node->isKind(PNK_NEG), + "need a different method for this node kind"); + MOZ_ASSERT(node->isArity(PN_UNARY)); + + ParseNode*& expr = node->pn_kid; + if (!Fold(cx, &expr, parser, inGenexpLambda)) + return false; + + if (expr->isKind(PNK_NUMBER) || expr->isKind(PNK_TRUE) || expr->isKind(PNK_FALSE)) { + double d = expr->isKind(PNK_NUMBER) + ? expr->pn_dval + : double(expr->isKind(PNK_TRUE)); + + if (node->isKind(PNK_BITNOT)) + d = ~ToInt32(d); + else if (node->isKind(PNK_NEG)) + d = -d; + else + MOZ_ASSERT(node->isKind(PNK_POS)); // nothing to do + + parser.prepareNodeForMutation(node); + node->setKind(PNK_NUMBER); + node->setOp(JSOP_DOUBLE); + node->setArity(PN_NULLARY); + node->pn_dval = d; + } + + return true; +} + +static bool +FoldIncrementDecrement(ExclusiveContext* cx, ParseNode* node, Parser<FullParseHandler>& parser, + bool inGenexpLambda) +{ + MOZ_ASSERT(node->isKind(PNK_PREINCREMENT) || + node->isKind(PNK_POSTINCREMENT) || + node->isKind(PNK_PREDECREMENT) || + node->isKind(PNK_POSTDECREMENT)); + MOZ_ASSERT(node->isArity(PN_UNARY)); + + ParseNode*& target = node->pn_kid; + MOZ_ASSERT(parser.isValidSimpleAssignmentTarget(target, Parser<FullParseHandler>::PermitAssignmentToFunctionCalls)); + + if (!Fold(cx, &target, parser, inGenexpLambda)) + return false; + + MOZ_ASSERT(parser.isValidSimpleAssignmentTarget(target, Parser<FullParseHandler>::PermitAssignmentToFunctionCalls)); + + return true; +} + +static bool +FoldAndOr(ExclusiveContext* cx, ParseNode** nodePtr, Parser<FullParseHandler>& parser, + bool inGenexpLambda) +{ + ParseNode* node = *nodePtr; + + MOZ_ASSERT(node->isKind(PNK_AND) || node->isKind(PNK_OR)); + MOZ_ASSERT(node->isArity(PN_LIST)); + + bool isOrNode = node->isKind(PNK_OR); + ParseNode** elem = &node->pn_head; + do { + if (!Fold(cx, elem, parser, inGenexpLambda)) + return false; + + Truthiness t = Boolish(*elem); + + // If we don't know the constant-folded node's truthiness, we can't + // reduce this node with its surroundings. Continue folding any + // remaining nodes. + if (t == Unknown) { + elem = &(*elem)->pn_next; + continue; + } + + // If the constant-folded node's truthiness will terminate the + // condition -- `a || true || expr` or |b && false && expr| -- then + // trailing nodes will never be evaluated. Truncate the list after + // the known-truthiness node, as it's the overall result. + if ((t == Truthy) == isOrNode) { + ParseNode* afterNext; + for (ParseNode* next = (*elem)->pn_next; next; next = afterNext) { + afterNext = next->pn_next; + parser.handler.freeTree(next); + --node->pn_count; + } + + // Terminate the original and/or list at the known-truthiness + // node. + (*elem)->pn_next = nullptr; + elem = &(*elem)->pn_next; + break; + } + + MOZ_ASSERT((t == Truthy) == !isOrNode); + + // We've encountered a vacuous node that'll never short- circuit + // evaluation. + if ((*elem)->pn_next) { + // This node is never the overall result when there are + // subsequent nodes. Remove it. + ParseNode* elt = *elem; + *elem = elt->pn_next; + parser.handler.freeTree(elt); + --node->pn_count; + } else { + // Otherwise this node is the result of the overall expression, + // so leave it alone. And we're done. + elem = &(*elem)->pn_next; + break; + } + } while (*elem); + + // If the last node in the list was replaced, we need to update the + // tail pointer in the original and/or node. + node->pn_tail = elem; + + node->checkListConsistency(); + + // If we removed nodes, we may have to replace a one-element list with + // its element. + if (node->pn_count == 1) { + ParseNode* first = node->pn_head; + ReplaceNode(nodePtr, first); + + node->setKind(PNK_NULL); + node->setArity(PN_NULLARY); + parser.freeTree(node); + } + + return true; +} + +static bool +FoldConditional(ExclusiveContext* cx, ParseNode** nodePtr, Parser<FullParseHandler>& parser, + bool inGenexpLambda) +{ + ParseNode** nextNode = nodePtr; + + do { + // |nextNode| on entry points to the C?T:F expression to be folded. + // Reset it to exit the loop in the common case where F isn't another + // ?: expression. + nodePtr = nextNode; + nextNode = nullptr; + + ParseNode* node = *nodePtr; + MOZ_ASSERT(node->isKind(PNK_CONDITIONAL)); + MOZ_ASSERT(node->isArity(PN_TERNARY)); + + ParseNode*& expr = node->pn_kid1; + if (!FoldCondition(cx, &expr, parser, inGenexpLambda)) + return false; + + ParseNode*& ifTruthy = node->pn_kid2; + if (!Fold(cx, &ifTruthy, parser, inGenexpLambda)) + return false; + + ParseNode*& ifFalsy = node->pn_kid3; + + // If our C?T:F node has F as another ?: node, *iteratively* constant- + // fold F *after* folding C and T (and possibly eliminating C and one + // of T/F entirely); otherwise fold F normally. Making |nextNode| non- + // null causes this loop to run again to fold F. + // + // Conceivably we could instead/also iteratively constant-fold T, if T + // were more complex than F. Such an optimization is unimplemented. + if (ifFalsy->isKind(PNK_CONDITIONAL)) { + nextNode = &ifFalsy; + } else { + if (!Fold(cx, &ifFalsy, parser, inGenexpLambda)) + return false; + } + + // Try to constant-fold based on the condition expression. + Truthiness t = Boolish(expr); + if (t == Unknown) + continue; + + // Otherwise reduce 'C ? T : F' to T or F as directed by C. + ParseNode* replacement; + ParseNode* discarded; + if (t == Truthy) { + replacement = ifTruthy; + discarded = ifFalsy; + } else { + replacement = ifFalsy; + discarded = ifTruthy; + } + + // Otherwise perform a replacement. This invalidates |nextNode|, so + // reset it (if the replacement requires folding) or clear it (if + // |ifFalsy| is dead code) as needed. + if (nextNode) + nextNode = (*nextNode == replacement) ? nodePtr : nullptr; + ReplaceNode(nodePtr, replacement); + + parser.freeTree(discarded); + } while (nextNode); + + return true; +} + +static bool +FoldIf(ExclusiveContext* cx, ParseNode** nodePtr, Parser<FullParseHandler>& parser, + bool inGenexpLambda) +{ + ParseNode** nextNode = nodePtr; + + do { + // |nextNode| on entry points to the initial |if| to be folded. Reset + // it to exit the loop when the |else| arm isn't another |if|. + nodePtr = nextNode; + nextNode = nullptr; + + ParseNode* node = *nodePtr; + MOZ_ASSERT(node->isKind(PNK_IF)); + MOZ_ASSERT(node->isArity(PN_TERNARY)); + + ParseNode*& expr = node->pn_kid1; + if (!FoldCondition(cx, &expr, parser, inGenexpLambda)) + return false; + + ParseNode*& consequent = node->pn_kid2; + if (!Fold(cx, &consequent, parser, inGenexpLambda)) + return false; + + ParseNode*& alternative = node->pn_kid3; + if (alternative) { + // If in |if (C) T; else F;| we have |F| as another |if|, + // *iteratively* constant-fold |F| *after* folding |C| and |T| (and + // possibly completely replacing the whole thing with |T| or |F|); + // otherwise fold F normally. Making |nextNode| non-null causes + // this loop to run again to fold F. + if (alternative->isKind(PNK_IF)) { + nextNode = &alternative; + } else { + if (!Fold(cx, &alternative, parser, inGenexpLambda)) + return false; + } + } + + // Eliminate the consequent or alternative if the condition has + // constant truthiness. Don't eliminate if we have an |if (0)| in + // trailing position in a generator expression, as this is a special + // form we can't fold away. + Truthiness t = Boolish(expr); + if (t == Unknown || inGenexpLambda) + continue; + + // Careful! Either of these can be null: |replacement| in |if (0) T;|, + // and |discarded| in |if (true) T;|. + ParseNode* replacement; + ParseNode* discarded; + if (t == Truthy) { + replacement = consequent; + discarded = alternative; + } else { + replacement = alternative; + discarded = consequent; + } + + bool performReplacement = true; + if (discarded) { + // A declaration that hoists outside the discarded arm prevents the + // |if| from being folded away. + bool containsHoistedDecls; + if (!ContainsHoistedDeclaration(cx, discarded, &containsHoistedDecls)) + return false; + + performReplacement = !containsHoistedDecls; + } + + if (!performReplacement) + continue; + + if (!replacement) { + // If there's no replacement node, we have a constantly-false |if| + // with no |else|. Replace the entire thing with an empty + // statement list. + parser.prepareNodeForMutation(node); + node->setKind(PNK_STATEMENTLIST); + node->setArity(PN_LIST); + node->makeEmpty(); + } else { + // Replacement invalidates |nextNode|, so reset it (if the + // replacement requires folding) or clear it (if |alternative| + // is dead code) as needed. + if (nextNode) + nextNode = (*nextNode == replacement) ? nodePtr : nullptr; + ReplaceNode(nodePtr, replacement); + + // Morph the original node into a discardable node, then + // aggressively free it and the discarded arm (if any) to suss out + // any bugs in the preceding logic. + node->setKind(PNK_STATEMENTLIST); + node->setArity(PN_LIST); + node->makeEmpty(); + if (discarded) + node->append(discarded); + parser.freeTree(node); + } + } while (nextNode); + + return true; +} + +static bool +FoldFunction(ExclusiveContext* cx, ParseNode* node, Parser<FullParseHandler>& parser, + bool inGenexpLambda) +{ + MOZ_ASSERT(node->isKind(PNK_FUNCTION)); + MOZ_ASSERT(node->isArity(PN_CODE)); + + // Don't constant-fold inside "use asm" code, as this could create a parse + // tree that doesn't type-check as asm.js. + if (node->pn_funbox->useAsmOrInsideUseAsm()) + return true; + + // Note: pn_body is null for lazily-parsed functions. + if (ParseNode*& functionBody = node->pn_body) { + if (!Fold(cx, &functionBody, parser, node->pn_funbox->isGenexpLambda)) + return false; + } + + return true; +} + +static double +ComputeBinary(ParseNodeKind kind, double left, double right) +{ + if (kind == PNK_ADD) + return left + right; + + if (kind == PNK_SUB) + return left - right; + + if (kind == PNK_STAR) + return left * right; + + if (kind == PNK_MOD) + return right == 0 ? GenericNaN() : js_fmod(left, right); + + if (kind == PNK_URSH) + return ToUint32(left) >> (ToUint32(right) & 31); + + if (kind == PNK_DIV) { + if (right == 0) { +#if defined(XP_WIN) + /* XXX MSVC miscompiles such that (NaN == 0) */ + if (IsNaN(right)) + return GenericNaN(); +#endif + if (left == 0 || IsNaN(left)) + return GenericNaN(); + if (IsNegative(left) != IsNegative(right)) + return NegativeInfinity<double>(); + return PositiveInfinity<double>(); + } + + return left / right; + } + + MOZ_ASSERT(kind == PNK_LSH || kind == PNK_RSH); + + int32_t i = ToInt32(left); + uint32_t j = ToUint32(right) & 31; + return int32_t((kind == PNK_LSH) ? uint32_t(i) << j : i >> j); +} + +static bool +FoldModule(ExclusiveContext* cx, ParseNode* node, Parser<FullParseHandler>& parser) +{ + MOZ_ASSERT(node->isKind(PNK_MODULE)); + MOZ_ASSERT(node->isArity(PN_CODE)); + + ParseNode*& moduleBody = node->pn_body; + MOZ_ASSERT(moduleBody); + return Fold(cx, &moduleBody, parser, false); +} + +static bool +FoldBinaryArithmetic(ExclusiveContext* cx, ParseNode* node, Parser<FullParseHandler>& parser, + bool inGenexpLambda) +{ + MOZ_ASSERT(node->isKind(PNK_SUB) || + node->isKind(PNK_STAR) || + node->isKind(PNK_LSH) || + node->isKind(PNK_RSH) || + node->isKind(PNK_URSH) || + node->isKind(PNK_DIV) || + node->isKind(PNK_MOD)); + MOZ_ASSERT(node->isArity(PN_LIST)); + MOZ_ASSERT(node->pn_count >= 2); + + // Fold each operand, ideally into a number. + ParseNode** listp = &node->pn_head; + for (; *listp; listp = &(*listp)->pn_next) { + if (!Fold(cx, listp, parser, inGenexpLambda)) + return false; + + if (!FoldType(cx, *listp, PNK_NUMBER)) + return false; + } + + // Repoint the list's tail pointer. + node->pn_tail = listp; + + // Now fold all leading numeric terms together into a single number. + // (Trailing terms for the non-shift operations can't be folded together + // due to floating point imprecision. For example, if |x === -2**53|, + // |x - 1 - 1 === -2**53| but |x - 2 === -2**53 - 2|. Shifts could be + // folded, but it doesn't seem worth the effort.) + ParseNode* elem = node->pn_head; + ParseNode* next = elem->pn_next; + if (elem->isKind(PNK_NUMBER)) { + ParseNodeKind kind = node->getKind(); + while (true) { + if (!next || !next->isKind(PNK_NUMBER)) + break; + + double d = ComputeBinary(kind, elem->pn_dval, next->pn_dval); + + ParseNode* afterNext = next->pn_next; + parser.freeTree(next); + next = afterNext; + elem->pn_next = next; + + elem->setKind(PNK_NUMBER); + elem->setOp(JSOP_DOUBLE); + elem->setArity(PN_NULLARY); + elem->pn_dval = d; + + node->pn_count--; + } + + if (node->pn_count == 1) { + MOZ_ASSERT(node->pn_head == elem); + MOZ_ASSERT(elem->isKind(PNK_NUMBER)); + + double d = elem->pn_dval; + node->setKind(PNK_NUMBER); + node->setArity(PN_NULLARY); + node->setOp(JSOP_DOUBLE); + node->pn_dval = d; + + parser.freeTree(elem); + } + } + + return true; +} + +static bool +FoldExponentiation(ExclusiveContext* cx, ParseNode* node, Parser<FullParseHandler>& parser, + bool inGenexpLambda) +{ + MOZ_ASSERT(node->isKind(PNK_POW)); + MOZ_ASSERT(node->isArity(PN_LIST)); + MOZ_ASSERT(node->pn_count >= 2); + + // Fold each operand, ideally into a number. + ParseNode** listp = &node->pn_head; + for (; *listp; listp = &(*listp)->pn_next) { + if (!Fold(cx, listp, parser, inGenexpLambda)) + return false; + + if (!FoldType(cx, *listp, PNK_NUMBER)) + return false; + } + + // Repoint the list's tail pointer. + node->pn_tail = listp; + + // Unlike all other binary arithmetic operators, ** is right-associative: + // 2**3**5 is 2**(3**5), not (2**3)**5. As list nodes singly-link their + // children, full constant-folding requires either linear space or dodgy + // in-place linked list reversal. So we only fold one exponentiation: it's + // easy and addresses common cases like |2**32|. + if (node->pn_count > 2) + return true; + + ParseNode* base = node->pn_head; + ParseNode* exponent = base->pn_next; + if (!base->isKind(PNK_NUMBER) || !exponent->isKind(PNK_NUMBER)) + return true; + + double d1 = base->pn_dval, d2 = exponent->pn_dval; + + parser.prepareNodeForMutation(node); + node->setKind(PNK_NUMBER); + node->setArity(PN_NULLARY); + node->setOp(JSOP_DOUBLE); + node->pn_dval = ecmaPow(d1, d2); + return true; +} + +static bool +FoldList(ExclusiveContext* cx, ParseNode* list, Parser<FullParseHandler>& parser, + bool inGenexpLambda) +{ + MOZ_ASSERT(list->isArity(PN_LIST)); + + ParseNode** elem = &list->pn_head; + for (; *elem; elem = &(*elem)->pn_next) { + if (!Fold(cx, elem, parser, inGenexpLambda)) + return false; + } + + // Repoint the list's tail pointer if the final element was replaced. + list->pn_tail = elem; + + list->checkListConsistency(); + + return true; +} + +static bool +FoldReturn(ExclusiveContext* cx, ParseNode* node, Parser<FullParseHandler>& parser, + bool inGenexpLambda) +{ + MOZ_ASSERT(node->isKind(PNK_RETURN)); + MOZ_ASSERT(node->isArity(PN_UNARY)); + + if (ParseNode*& expr = node->pn_kid) { + if (!Fold(cx, &expr, parser, inGenexpLambda)) + return false; + } + + return true; +} + +static bool +FoldTry(ExclusiveContext* cx, ParseNode* node, Parser<FullParseHandler>& parser, + bool inGenexpLambda) +{ + MOZ_ASSERT(node->isKind(PNK_TRY)); + MOZ_ASSERT(node->isArity(PN_TERNARY)); + + ParseNode*& statements = node->pn_kid1; + if (!Fold(cx, &statements, parser, inGenexpLambda)) + return false; + + if (ParseNode*& catchList = node->pn_kid2) { + if (!Fold(cx, &catchList, parser, inGenexpLambda)) + return false; + } + + if (ParseNode*& finally = node->pn_kid3) { + if (!Fold(cx, &finally, parser, inGenexpLambda)) + return false; + } + + return true; +} + +static bool +FoldCatch(ExclusiveContext* cx, ParseNode* node, Parser<FullParseHandler>& parser, + bool inGenexpLambda) +{ + MOZ_ASSERT(node->isKind(PNK_CATCH)); + MOZ_ASSERT(node->isArity(PN_TERNARY)); + + ParseNode*& declPattern = node->pn_kid1; + if (!Fold(cx, &declPattern, parser, inGenexpLambda)) + return false; + + if (ParseNode*& cond = node->pn_kid2) { + if (!FoldCondition(cx, &cond, parser, inGenexpLambda)) + return false; + } + + if (ParseNode*& statements = node->pn_kid3) { + if (!Fold(cx, &statements, parser, inGenexpLambda)) + return false; + } + + return true; +} + +static bool +FoldClass(ExclusiveContext* cx, ParseNode* node, Parser<FullParseHandler>& parser, + bool inGenexpLambda) +{ + MOZ_ASSERT(node->isKind(PNK_CLASS)); + MOZ_ASSERT(node->isArity(PN_TERNARY)); + + if (ParseNode*& classNames = node->pn_kid1) { + if (!Fold(cx, &classNames, parser, inGenexpLambda)) + return false; + } + + if (ParseNode*& heritage = node->pn_kid2) { + if (!Fold(cx, &heritage, parser, inGenexpLambda)) + return false; + } + + ParseNode*& body = node->pn_kid3; + return Fold(cx, &body, parser, inGenexpLambda); +} + +static bool +FoldElement(ExclusiveContext* cx, ParseNode** nodePtr, Parser<FullParseHandler>& parser, + bool inGenexpLambda) +{ + ParseNode* node = *nodePtr; + + MOZ_ASSERT(node->isKind(PNK_ELEM)); + MOZ_ASSERT(node->isArity(PN_BINARY)); + + ParseNode*& expr = node->pn_left; + if (!Fold(cx, &expr, parser, inGenexpLambda)) + return false; + + ParseNode*& key = node->pn_right; + if (!Fold(cx, &key, parser, inGenexpLambda)) + return false; + + PropertyName* name = nullptr; + if (key->isKind(PNK_STRING)) { + JSAtom* atom = key->pn_atom; + uint32_t index; + + if (atom->isIndex(&index)) { + // Optimization 1: We have something like expr["100"]. This is + // equivalent to expr[100] which is faster. + key->setKind(PNK_NUMBER); + key->setOp(JSOP_DOUBLE); + key->pn_dval = index; + } else { + name = atom->asPropertyName(); + } + } else if (key->isKind(PNK_NUMBER)) { + double number = key->pn_dval; + if (number != ToUint32(number)) { + // Optimization 2: We have something like expr[3.14]. The number + // isn't an array index, so it converts to a string ("3.14"), + // enabling optimization 3 below. + JSAtom* atom = ToAtom<NoGC>(cx, DoubleValue(number)); + if (!atom) + return false; + name = atom->asPropertyName(); + } + } + + // If we don't have a name, we can't optimize to getprop. + if (!name) + return true; + + // Also don't optimize if the name doesn't map directly to its id for TI's + // purposes. + if (NameToId(name) != IdToTypeId(NameToId(name))) + return true; + + // Optimization 3: We have expr["foo"] where foo is not an index. Convert + // to a property access (like expr.foo) that optimizes better downstream. + // Don't bother with this for names that TI considers to be indexes, to + // simplify downstream analysis. + ParseNode* dottedAccess = parser.handler.newPropertyAccess(expr, name, node->pn_pos.end); + if (!dottedAccess) + return false; + dottedAccess->setInParens(node->isInParens()); + ReplaceNode(nodePtr, dottedAccess); + + // If we've replaced |expr["prop"]| with |expr.prop|, we can now free the + // |"prop"| and |expr["prop"]| nodes -- but not the |expr| node that we're + // now using as a sub-node of |dottedAccess|. Munge |expr["prop"]| into a + // node with |"prop"| as its only child, that'll pass AST sanity-checking + // assertions during freeing, then free it. + node->setKind(PNK_TYPEOFEXPR); + node->setArity(PN_UNARY); + node->pn_kid = key; + parser.freeTree(node); + + return true; +} + +static bool +FoldAdd(ExclusiveContext* cx, ParseNode** nodePtr, Parser<FullParseHandler>& parser, + bool inGenexpLambda) +{ + ParseNode* node = *nodePtr; + + MOZ_ASSERT(node->isKind(PNK_ADD)); + MOZ_ASSERT(node->isArity(PN_LIST)); + MOZ_ASSERT(node->pn_count >= 2); + + // Generically fold all operands first. + if (!FoldList(cx, node, parser, inGenexpLambda)) + return false; + + // Fold leading numeric operands together: + // + // (1 + 2 + x) becomes (3 + x) + // + // Don't go past the leading operands: additions after a string are + // string concatenations, not additions: ("1" + 2 + 3 === "123"). + ParseNode* current = node->pn_head; + ParseNode* next = current->pn_next; + if (current->isKind(PNK_NUMBER)) { + do { + if (!next->isKind(PNK_NUMBER)) + break; + + current->pn_dval += next->pn_dval; + current->pn_next = next->pn_next; + parser.freeTree(next); + next = current->pn_next; + + MOZ_ASSERT(node->pn_count > 1); + node->pn_count--; + } while (next); + } + + // If any operands remain, attempt string concatenation folding. + do { + // If no operands remain, we're done. + if (!next) + break; + + // (number + string) is string concatenation *only* at the start of + // the list: (x + 1 + "2" !== x + "12") when x is a number. + if (current->isKind(PNK_NUMBER) && next->isKind(PNK_STRING)) { + if (!FoldType(cx, current, PNK_STRING)) + return false; + next = current->pn_next; + } + + // The first string forces all subsequent additions to be + // string concatenations. + do { + if (current->isKind(PNK_STRING)) + break; + + current = next; + next = next->pn_next; + } while (next); + + // If there's nothing left to fold, we're done. + if (!next) + break; + + RootedString combination(cx); + RootedString tmp(cx); + do { + // Create a rope of the current string and all succeeding + // constants that we can convert to strings, then atomize it + // and replace them all with that fresh string. + MOZ_ASSERT(current->isKind(PNK_STRING)); + + combination = current->pn_atom; + + do { + // Try folding the next operand to a string. + if (!FoldType(cx, next, PNK_STRING)) + return false; + + // Stop glomming once folding doesn't produce a string. + if (!next->isKind(PNK_STRING)) + break; + + // Add this string to the combination and remove the node. + tmp = next->pn_atom; + combination = ConcatStrings<CanGC>(cx, combination, tmp); + if (!combination) + return false; + + current->pn_next = next->pn_next; + parser.freeTree(next); + next = current->pn_next; + + MOZ_ASSERT(node->pn_count > 1); + node->pn_count--; + } while (next); + + // Replace |current|'s string with the entire combination. + MOZ_ASSERT(current->isKind(PNK_STRING)); + combination = AtomizeString(cx, combination); + if (!combination) + return false; + current->pn_atom = &combination->asAtom(); + + + // If we're out of nodes, we're done. + if (!next) + break; + + current = next; + next = current->pn_next; + + // If we're out of nodes *after* the non-foldable-to-string + // node, we're done. + if (!next) + break; + + // Otherwise find the next node foldable to a string, and loop. + do { + current = next; + next = current->pn_next; + + if (!FoldType(cx, current, PNK_STRING)) + return false; + next = current->pn_next; + } while (!current->isKind(PNK_STRING) && next); + } while (next); + } while (false); + + MOZ_ASSERT(!next, "must have considered all nodes here"); + MOZ_ASSERT(!current->pn_next, "current node must be the last node"); + + node->pn_tail = ¤t->pn_next; + node->checkListConsistency(); + + if (node->pn_count == 1) { + // We reduced the list to a constant. Replace the PNK_ADD node + // with that constant. + ReplaceNode(nodePtr, current); + + // Free the old node to aggressively verify nothing uses it. + node->setKind(PNK_TRUE); + node->setArity(PN_NULLARY); + node->setOp(JSOP_TRUE); + parser.freeTree(node); + } + + return true; +} + +static bool +FoldCall(ExclusiveContext* cx, ParseNode* node, Parser<FullParseHandler>& parser, + bool inGenexpLambda) +{ + MOZ_ASSERT(node->isKind(PNK_CALL) || node->isKind(PNK_SUPERCALL) || + node->isKind(PNK_TAGGED_TEMPLATE)); + MOZ_ASSERT(node->isArity(PN_LIST)); + + // Don't fold a parenthesized callable component in an invocation, as this + // might cause a different |this| value to be used, changing semantics: + // + // var prop = "global"; + // var obj = { prop: "obj", f: function() { return this.prop; } }; + // assertEq((true ? obj.f : null)(), "global"); + // assertEq(obj.f(), "obj"); + // assertEq((true ? obj.f : null)``, "global"); + // assertEq(obj.f``, "obj"); + // + // See bug 537673 and bug 1182373. + ParseNode** listp = &node->pn_head; + if ((*listp)->isInParens()) + listp = &(*listp)->pn_next; + + for (; *listp; listp = &(*listp)->pn_next) { + if (!Fold(cx, listp, parser, inGenexpLambda)) + return false; + } + + // If the last node in the list was replaced, pn_tail points into the wrong node. + node->pn_tail = listp; + + node->checkListConsistency(); + return true; +} + +static bool +FoldForInOrOf(ExclusiveContext* cx, ParseNode* node, Parser<FullParseHandler>& parser, + bool inGenexpLambda) +{ + MOZ_ASSERT(node->isKind(PNK_FORIN) || node->isKind(PNK_FOROF)); + MOZ_ASSERT(node->isArity(PN_TERNARY)); + MOZ_ASSERT(!node->pn_kid2); + + return Fold(cx, &node->pn_kid1, parser, inGenexpLambda) && + Fold(cx, &node->pn_kid3, parser, inGenexpLambda); +} + +static bool +FoldForHead(ExclusiveContext* cx, ParseNode* node, Parser<FullParseHandler>& parser, + bool inGenexpLambda) +{ + MOZ_ASSERT(node->isKind(PNK_FORHEAD)); + MOZ_ASSERT(node->isArity(PN_TERNARY)); + + if (ParseNode*& init = node->pn_kid1) { + if (!Fold(cx, &init, parser, inGenexpLambda)) + return false; + } + + if (ParseNode*& test = node->pn_kid2) { + if (!FoldCondition(cx, &test, parser, inGenexpLambda)) + return false; + + if (test->isKind(PNK_TRUE)) { + parser.freeTree(test); + test = nullptr; + } + } + + if (ParseNode*& update = node->pn_kid3) { + if (!Fold(cx, &update, parser, inGenexpLambda)) + return false; + } + + return true; +} + +static bool +FoldDottedProperty(ExclusiveContext* cx, ParseNode* node, Parser<FullParseHandler>& parser, + bool inGenexpLambda) +{ + MOZ_ASSERT(node->isKind(PNK_DOT)); + MOZ_ASSERT(node->isArity(PN_NAME)); + + // Iterate through a long chain of dotted property accesses to find the + // most-nested non-dotted property node, then fold that. + ParseNode** nested = &node->pn_expr; + while ((*nested)->isKind(PNK_DOT)) { + MOZ_ASSERT((*nested)->isArity(PN_NAME)); + nested = &(*nested)->pn_expr; + } + + return Fold(cx, nested, parser, inGenexpLambda); +} + +static bool +FoldName(ExclusiveContext* cx, ParseNode* node, Parser<FullParseHandler>& parser, + bool inGenexpLambda) +{ + MOZ_ASSERT(node->isKind(PNK_NAME)); + MOZ_ASSERT(node->isArity(PN_NAME)); + + if (!node->pn_expr) + return true; + + return Fold(cx, &node->pn_expr, parser, inGenexpLambda); +} + +bool +Fold(ExclusiveContext* cx, ParseNode** pnp, Parser<FullParseHandler>& parser, bool inGenexpLambda) +{ + JS_CHECK_RECURSION(cx, return false); + + ParseNode* pn = *pnp; + + switch (pn->getKind()) { + case PNK_NOP: + case PNK_REGEXP: + case PNK_STRING: + case PNK_TRUE: + case PNK_FALSE: + case PNK_NULL: + case PNK_ELISION: + case PNK_NUMBER: + case PNK_DEBUGGER: + case PNK_BREAK: + case PNK_CONTINUE: + case PNK_TEMPLATE_STRING: + case PNK_GENERATOR: + case PNK_EXPORT_BATCH_SPEC: + case PNK_OBJECT_PROPERTY_NAME: + case PNK_POSHOLDER: + MOZ_ASSERT(pn->isArity(PN_NULLARY)); + return true; + + case PNK_SUPERBASE: + case PNK_TYPEOFNAME: + MOZ_ASSERT(pn->isArity(PN_UNARY)); + MOZ_ASSERT(pn->pn_kid->isKind(PNK_NAME)); + MOZ_ASSERT(!pn->pn_kid->expr()); + return true; + + case PNK_TYPEOFEXPR: + return FoldTypeOfExpr(cx, pn, parser, inGenexpLambda); + + case PNK_DELETENAME: { + MOZ_ASSERT(pn->isArity(PN_UNARY)); + MOZ_ASSERT(pn->pn_kid->isKind(PNK_NAME)); + return true; + } + + case PNK_DELETEEXPR: + return FoldDeleteExpr(cx, pn, parser, inGenexpLambda); + + case PNK_DELETEELEM: + return FoldDeleteElement(cx, pn, parser, inGenexpLambda); + + case PNK_DELETEPROP: + return FoldDeleteProperty(cx, pn, parser, inGenexpLambda); + + case PNK_CONDITIONAL: + return FoldConditional(cx, pnp, parser, inGenexpLambda); + + case PNK_IF: + return FoldIf(cx, pnp, parser, inGenexpLambda); + + case PNK_NOT: + return FoldNot(cx, pn, parser, inGenexpLambda); + + case PNK_BITNOT: + case PNK_POS: + case PNK_NEG: + return FoldUnaryArithmetic(cx, pn, parser, inGenexpLambda); + + case PNK_PREINCREMENT: + case PNK_POSTINCREMENT: + case PNK_PREDECREMENT: + case PNK_POSTDECREMENT: + return FoldIncrementDecrement(cx, pn, parser, inGenexpLambda); + + case PNK_THROW: + case PNK_ARRAYPUSH: + case PNK_MUTATEPROTO: + case PNK_COMPUTED_NAME: + case PNK_SPREAD: + case PNK_EXPORT: + case PNK_VOID: + MOZ_ASSERT(pn->isArity(PN_UNARY)); + return Fold(cx, &pn->pn_kid, parser, inGenexpLambda); + + case PNK_EXPORT_DEFAULT: + MOZ_ASSERT(pn->isArity(PN_BINARY)); + return Fold(cx, &pn->pn_left, parser, inGenexpLambda); + + case PNK_SEMI: + case PNK_THIS: + MOZ_ASSERT(pn->isArity(PN_UNARY)); + if (ParseNode*& expr = pn->pn_kid) + return Fold(cx, &expr, parser, inGenexpLambda); + return true; + + case PNK_AND: + case PNK_OR: + return FoldAndOr(cx, pnp, parser, inGenexpLambda); + + case PNK_FUNCTION: + return FoldFunction(cx, pn, parser, inGenexpLambda); + + case PNK_MODULE: + return FoldModule(cx, pn, parser); + + case PNK_SUB: + case PNK_STAR: + case PNK_LSH: + case PNK_RSH: + case PNK_URSH: + case PNK_DIV: + case PNK_MOD: + return FoldBinaryArithmetic(cx, pn, parser, inGenexpLambda); + + case PNK_POW: + return FoldExponentiation(cx, pn, parser, inGenexpLambda); + + // Various list nodes not requiring care to minimally fold. Some of + // these could be further folded/optimized, but we don't make the effort. + case PNK_BITOR: + case PNK_BITXOR: + case PNK_BITAND: + case PNK_STRICTEQ: + case PNK_EQ: + case PNK_STRICTNE: + case PNK_NE: + case PNK_LT: + case PNK_LE: + case PNK_GT: + case PNK_GE: + case PNK_INSTANCEOF: + case PNK_IN: + case PNK_COMMA: + case PNK_NEW: + case PNK_ARRAY: + case PNK_OBJECT: + case PNK_ARRAYCOMP: + case PNK_STATEMENTLIST: + case PNK_CLASSMETHODLIST: + case PNK_CATCHLIST: + case PNK_TEMPLATE_STRING_LIST: + case PNK_VAR: + case PNK_CONST: + case PNK_LET: + case PNK_PARAMSBODY: + case PNK_CALLSITEOBJ: + case PNK_EXPORT_SPEC_LIST: + case PNK_IMPORT_SPEC_LIST: + case PNK_GENEXP: + return FoldList(cx, pn, parser, inGenexpLambda); + + case PNK_YIELD_STAR: + MOZ_ASSERT(pn->isArity(PN_BINARY)); + MOZ_ASSERT(pn->pn_right->isKind(PNK_NAME)); + return Fold(cx, &pn->pn_left, parser, inGenexpLambda); + + case PNK_YIELD: + case PNK_AWAIT: + MOZ_ASSERT(pn->isArity(PN_BINARY)); + MOZ_ASSERT(pn->pn_right->isKind(PNK_NAME) || + (pn->pn_right->isKind(PNK_ASSIGN) && + pn->pn_right->pn_left->isKind(PNK_NAME) && + pn->pn_right->pn_right->isKind(PNK_GENERATOR))); + if (!pn->pn_left) + return true; + return Fold(cx, &pn->pn_left, parser, inGenexpLambda); + + case PNK_RETURN: + return FoldReturn(cx, pn, parser, inGenexpLambda); + + case PNK_TRY: + return FoldTry(cx, pn, parser, inGenexpLambda); + + case PNK_CATCH: + return FoldCatch(cx, pn, parser, inGenexpLambda); + + case PNK_CLASS: + return FoldClass(cx, pn, parser, inGenexpLambda); + + case PNK_ELEM: + return FoldElement(cx, pnp, parser, inGenexpLambda); + + case PNK_ADD: + return FoldAdd(cx, pnp, parser, inGenexpLambda); + + case PNK_CALL: + case PNK_SUPERCALL: + case PNK_TAGGED_TEMPLATE: + return FoldCall(cx, pn, parser, inGenexpLambda); + + case PNK_SWITCH: + case PNK_COLON: + case PNK_ASSIGN: + case PNK_ADDASSIGN: + case PNK_SUBASSIGN: + case PNK_BITORASSIGN: + case PNK_BITANDASSIGN: + case PNK_BITXORASSIGN: + case PNK_LSHASSIGN: + case PNK_RSHASSIGN: + case PNK_URSHASSIGN: + case PNK_DIVASSIGN: + case PNK_MODASSIGN: + case PNK_MULASSIGN: + case PNK_POWASSIGN: + case PNK_IMPORT: + case PNK_EXPORT_FROM: + case PNK_SHORTHAND: + case PNK_FOR: + case PNK_COMPREHENSIONFOR: + case PNK_CLASSMETHOD: + case PNK_IMPORT_SPEC: + case PNK_EXPORT_SPEC: + case PNK_SETTHIS: + MOZ_ASSERT(pn->isArity(PN_BINARY)); + return Fold(cx, &pn->pn_left, parser, inGenexpLambda) && + Fold(cx, &pn->pn_right, parser, inGenexpLambda); + + case PNK_NEWTARGET: + MOZ_ASSERT(pn->isArity(PN_BINARY)); + MOZ_ASSERT(pn->pn_left->isKind(PNK_POSHOLDER)); + MOZ_ASSERT(pn->pn_right->isKind(PNK_POSHOLDER)); + return true; + + case PNK_CLASSNAMES: + MOZ_ASSERT(pn->isArity(PN_BINARY)); + if (ParseNode*& outerBinding = pn->pn_left) { + if (!Fold(cx, &outerBinding, parser, inGenexpLambda)) + return false; + } + return Fold(cx, &pn->pn_right, parser, inGenexpLambda); + + case PNK_DOWHILE: + MOZ_ASSERT(pn->isArity(PN_BINARY)); + return Fold(cx, &pn->pn_left, parser, inGenexpLambda) && + FoldCondition(cx, &pn->pn_right, parser, inGenexpLambda); + + case PNK_WHILE: + MOZ_ASSERT(pn->isArity(PN_BINARY)); + return FoldCondition(cx, &pn->pn_left, parser, inGenexpLambda) && + Fold(cx, &pn->pn_right, parser, inGenexpLambda); + + case PNK_CASE: { + MOZ_ASSERT(pn->isArity(PN_BINARY)); + + // pn_left is null for DefaultClauses. + if (pn->pn_left) { + if (!Fold(cx, &pn->pn_left, parser, inGenexpLambda)) + return false; + } + return Fold(cx, &pn->pn_right, parser, inGenexpLambda); + } + + case PNK_WITH: + MOZ_ASSERT(pn->isArity(PN_BINARY)); + return Fold(cx, &pn->pn_left, parser, inGenexpLambda) && + Fold(cx, &pn->pn_right, parser, inGenexpLambda); + + case PNK_FORIN: + case PNK_FOROF: + return FoldForInOrOf(cx, pn, parser, inGenexpLambda); + + case PNK_FORHEAD: + return FoldForHead(cx, pn, parser, inGenexpLambda); + + case PNK_LABEL: + MOZ_ASSERT(pn->isArity(PN_NAME)); + return Fold(cx, &pn->pn_expr, parser, inGenexpLambda); + + case PNK_DOT: + return FoldDottedProperty(cx, pn, parser, inGenexpLambda); + + case PNK_LEXICALSCOPE: + MOZ_ASSERT(pn->isArity(PN_SCOPE)); + if (!pn->scopeBody()) + return true; + return Fold(cx, &pn->pn_u.scope.body, parser, inGenexpLambda); + + case PNK_NAME: + return FoldName(cx, pn, parser, inGenexpLambda); + + case PNK_LIMIT: // invalid sentinel value + MOZ_CRASH("invalid node kind"); + } + + MOZ_CRASH("shouldn't reach here"); + return false; +} + +bool +frontend::FoldConstants(ExclusiveContext* cx, ParseNode** pnp, Parser<FullParseHandler>* parser) +{ + // Don't constant-fold inside "use asm" code, as this could create a parse + // tree that doesn't type-check as asm.js. + if (parser->pc->useAsmOrInsideUseAsm()) + return true; + + return Fold(cx, pnp, *parser, false); +} diff --git a/js/src/frontend/FoldConstants.h b/js/src/frontend/FoldConstants.h new file mode 100644 index 000000000..274daaaae --- /dev/null +++ b/js/src/frontend/FoldConstants.h @@ -0,0 +1,41 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- + * vim: set ts=8 sts=4 et sw=4 tw=99: + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#ifndef frontend_FoldConstants_h +#define frontend_FoldConstants_h + +#include "frontend/SyntaxParseHandler.h" + +namespace js { +namespace frontend { + +// Perform constant folding on the given AST. For example, the program +// `print(2 + 2)` would become `print(4)`. +// +// pnp is the address of a pointer variable that points to the root node of the +// AST. On success, *pnp points to the root node of the new tree, which may be +// the same node (unchanged or modified in place) or a new node. +// +// Usage: +// pn = parser->statement(); +// if (!pn) +// return false; +// if (!FoldConstants(cx, &pn, parser)) +// return false; +MOZ_MUST_USE bool +FoldConstants(ExclusiveContext* cx, ParseNode** pnp, Parser<FullParseHandler>* parser); + +inline MOZ_MUST_USE bool +FoldConstants(ExclusiveContext* cx, SyntaxParseHandler::Node* pnp, + Parser<SyntaxParseHandler>* parser) +{ + return true; +} + +} /* namespace frontend */ +} /* namespace js */ + +#endif /* frontend_FoldConstants_h */ diff --git a/js/src/frontend/FullParseHandler.h b/js/src/frontend/FullParseHandler.h new file mode 100644 index 000000000..add881900 --- /dev/null +++ b/js/src/frontend/FullParseHandler.h @@ -0,0 +1,977 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- + * vim: set ts=8 sts=4 et sw=4 tw=99: + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#ifndef frontend_FullParseHandler_h +#define frontend_FullParseHandler_h + +#include "mozilla/Attributes.h" +#include "mozilla/PodOperations.h" + +#include "frontend/ParseNode.h" +#include "frontend/SharedContext.h" + +namespace js { +namespace frontend { + +template <typename ParseHandler> +class Parser; + +class SyntaxParseHandler; + +// Parse handler used when generating a full parse tree for all code which the +// parser encounters. +class FullParseHandler +{ + ParseNodeAllocator allocator; + TokenStream& tokenStream; + + ParseNode* allocParseNode(size_t size) { + MOZ_ASSERT(size == sizeof(ParseNode)); + return static_cast<ParseNode*>(allocator.allocNode()); + } + + ParseNode* cloneNode(const ParseNode& other) { + ParseNode* node = allocParseNode(sizeof(ParseNode)); + if (!node) + return nullptr; + mozilla::PodAssign(node, &other); + return node; + } + + /* + * If this is a full parse to construct the bytecode for a function that + * was previously lazily parsed, that lazy function and the current index + * into its inner functions. We do not want to reparse the inner functions. + */ + const Rooted<LazyScript*> lazyOuterFunction_; + size_t lazyInnerFunctionIndex; + size_t lazyClosedOverBindingIndex; + + const TokenPos& pos() { + return tokenStream.currentToken().pos; + } + + public: + + /* + * If non-nullptr, points to a syntax parser which can be used for inner + * functions. Cleared if language features not handled by the syntax parser + * are encountered, in which case all future activity will use the full + * parser. + */ + Parser<SyntaxParseHandler>* syntaxParser; + + /* new_ methods for creating parse nodes. These report OOM on context. */ + JS_DECLARE_NEW_METHODS(new_, allocParseNode, inline) + + typedef ParseNode* Node; + + bool isPropertyAccess(ParseNode* node) { + return node->isKind(PNK_DOT) || node->isKind(PNK_ELEM); + } + + bool isFunctionCall(ParseNode* node) { + // Note: super() is a special form, *not* a function call. + return node->isKind(PNK_CALL); + } + + static bool isUnparenthesizedDestructuringPattern(ParseNode* node) { + return !node->isInParens() && (node->isKind(PNK_OBJECT) || node->isKind(PNK_ARRAY)); + } + + static bool isParenthesizedDestructuringPattern(ParseNode* node) { + // Technically this isn't a destructuring pattern at all -- the grammar + // doesn't treat it as such. But we need to know when this happens to + // consider it a SyntaxError rather than an invalid-left-hand-side + // ReferenceError. + return node->isInParens() && (node->isKind(PNK_OBJECT) || node->isKind(PNK_ARRAY)); + } + + static bool isDestructuringPatternAnyParentheses(ParseNode* node) { + return isUnparenthesizedDestructuringPattern(node) || + isParenthesizedDestructuringPattern(node); + } + + FullParseHandler(ExclusiveContext* cx, LifoAlloc& alloc, + TokenStream& tokenStream, Parser<SyntaxParseHandler>* syntaxParser, + LazyScript* lazyOuterFunction) + : allocator(cx, alloc), + tokenStream(tokenStream), + lazyOuterFunction_(cx, lazyOuterFunction), + lazyInnerFunctionIndex(0), + lazyClosedOverBindingIndex(0), + syntaxParser(syntaxParser) + {} + + static ParseNode* null() { return nullptr; } + + ParseNode* freeTree(ParseNode* pn) { return allocator.freeTree(pn); } + void prepareNodeForMutation(ParseNode* pn) { return allocator.prepareNodeForMutation(pn); } + const Token& currentToken() { return tokenStream.currentToken(); } + + ParseNode* newName(PropertyName* name, const TokenPos& pos, ExclusiveContext* cx) + { + return new_<NameNode>(PNK_NAME, JSOP_GETNAME, name, pos); + } + + ParseNode* newComputedName(ParseNode* expr, uint32_t begin, uint32_t end) { + TokenPos pos(begin, end); + return new_<UnaryNode>(PNK_COMPUTED_NAME, JSOP_NOP, pos, expr); + } + + ParseNode* newObjectLiteralPropertyName(JSAtom* atom, const TokenPos& pos) { + return new_<NullaryNode>(PNK_OBJECT_PROPERTY_NAME, JSOP_NOP, pos, atom); + } + + ParseNode* newNumber(double value, DecimalPoint decimalPoint, const TokenPos& pos) { + ParseNode* pn = new_<NullaryNode>(PNK_NUMBER, pos); + if (!pn) + return nullptr; + pn->initNumber(value, decimalPoint); + return pn; + } + + ParseNode* newBooleanLiteral(bool cond, const TokenPos& pos) { + return new_<BooleanLiteral>(cond, pos); + } + + ParseNode* newStringLiteral(JSAtom* atom, const TokenPos& pos) { + return new_<NullaryNode>(PNK_STRING, JSOP_NOP, pos, atom); + } + + ParseNode* newTemplateStringLiteral(JSAtom* atom, const TokenPos& pos) { + return new_<NullaryNode>(PNK_TEMPLATE_STRING, JSOP_NOP, pos, atom); + } + + ParseNode* newCallSiteObject(uint32_t begin) { + ParseNode* callSite = new_<CallSiteNode>(begin); + if (!callSite) + return null(); + + Node propExpr = newArrayLiteral(getPosition(callSite).begin); + if (!propExpr) + return null(); + + addArrayElement(callSite, propExpr); + + return callSite; + } + + void addToCallSiteObject(ParseNode* callSiteObj, ParseNode* rawNode, ParseNode* cookedNode) { + MOZ_ASSERT(callSiteObj->isKind(PNK_CALLSITEOBJ)); + + addArrayElement(callSiteObj, cookedNode); + addArrayElement(callSiteObj->pn_head, rawNode); + + /* + * We don't know when the last noSubstTemplate will come in, and we + * don't want to deal with this outside this method + */ + setEndPosition(callSiteObj, callSiteObj->pn_head); + } + + ParseNode* newThisLiteral(const TokenPos& pos, ParseNode* thisName) { + return new_<ThisLiteral>(pos, thisName); + } + + ParseNode* newNullLiteral(const TokenPos& pos) { + return new_<NullLiteral>(pos); + } + + // The Boxer object here is any object that can allocate ObjectBoxes. + // Specifically, a Boxer has a .newObjectBox(T) method that accepts a + // Rooted<RegExpObject*> argument and returns an ObjectBox*. + template <class Boxer> + ParseNode* newRegExp(RegExpObject* reobj, const TokenPos& pos, Boxer& boxer) { + ObjectBox* objbox = boxer.newObjectBox(reobj); + if (!objbox) + return null(); + return new_<RegExpLiteral>(objbox, pos); + } + + ParseNode* newConditional(ParseNode* cond, ParseNode* thenExpr, ParseNode* elseExpr) { + return new_<ConditionalExpression>(cond, thenExpr, elseExpr); + } + + ParseNode* newDelete(uint32_t begin, ParseNode* expr) { + if (expr->isKind(PNK_NAME)) { + expr->setOp(JSOP_DELNAME); + return newUnary(PNK_DELETENAME, JSOP_NOP, begin, expr); + } + + if (expr->isKind(PNK_DOT)) + return newUnary(PNK_DELETEPROP, JSOP_NOP, begin, expr); + + if (expr->isKind(PNK_ELEM)) + return newUnary(PNK_DELETEELEM, JSOP_NOP, begin, expr); + + return newUnary(PNK_DELETEEXPR, JSOP_NOP, begin, expr); + } + + ParseNode* newTypeof(uint32_t begin, ParseNode* kid) { + TokenPos pos(begin, kid->pn_pos.end); + ParseNodeKind kind = kid->isKind(PNK_NAME) ? PNK_TYPEOFNAME : PNK_TYPEOFEXPR; + return new_<UnaryNode>(kind, JSOP_NOP, pos, kid); + } + + ParseNode* newNullary(ParseNodeKind kind, JSOp op, const TokenPos& pos) { + return new_<NullaryNode>(kind, op, pos); + } + + ParseNode* newUnary(ParseNodeKind kind, JSOp op, uint32_t begin, ParseNode* kid) { + TokenPos pos(begin, kid ? kid->pn_pos.end : begin + 1); + return new_<UnaryNode>(kind, op, pos, kid); + } + + ParseNode* newUpdate(ParseNodeKind kind, uint32_t begin, ParseNode* kid) { + TokenPos pos(begin, kid->pn_pos.end); + return new_<UnaryNode>(kind, JSOP_NOP, pos, kid); + } + + ParseNode* newSpread(uint32_t begin, ParseNode* kid) { + TokenPos pos(begin, kid->pn_pos.end); + return new_<UnaryNode>(PNK_SPREAD, JSOP_NOP, pos, kid); + } + + ParseNode* newArrayPush(uint32_t begin, ParseNode* kid) { + TokenPos pos(begin, kid->pn_pos.end); + return new_<UnaryNode>(PNK_ARRAYPUSH, JSOP_ARRAYPUSH, pos, kid); + } + + ParseNode* newBinary(ParseNodeKind kind, JSOp op = JSOP_NOP) { + return new_<BinaryNode>(kind, op, pos(), (ParseNode*) nullptr, (ParseNode*) nullptr); + } + ParseNode* newBinary(ParseNodeKind kind, ParseNode* left, + JSOp op = JSOP_NOP) { + return new_<BinaryNode>(kind, op, left->pn_pos, left, (ParseNode*) nullptr); + } + ParseNode* newBinary(ParseNodeKind kind, ParseNode* left, ParseNode* right, + JSOp op = JSOP_NOP) { + TokenPos pos(left->pn_pos.begin, right->pn_pos.end); + return new_<BinaryNode>(kind, op, pos, left, right); + } + ParseNode* appendOrCreateList(ParseNodeKind kind, ParseNode* left, ParseNode* right, + ParseContext* pc, JSOp op = JSOP_NOP) + { + return ParseNode::appendOrCreateList(kind, op, left, right, this, pc); + } + + ParseNode* newTernary(ParseNodeKind kind, + ParseNode* first, ParseNode* second, ParseNode* third, + JSOp op = JSOP_NOP) + { + return new_<TernaryNode>(kind, op, first, second, third); + } + + // Expressions + + ParseNode* newArrayComprehension(ParseNode* body, const TokenPos& pos) { + MOZ_ASSERT(pos.begin <= body->pn_pos.begin); + MOZ_ASSERT(body->pn_pos.end <= pos.end); + ParseNode* pn = new_<ListNode>(PNK_ARRAYCOMP, pos); + if (!pn) + return nullptr; + pn->append(body); + return pn; + } + + ParseNode* newArrayLiteral(uint32_t begin) { + ParseNode* literal = new_<ListNode>(PNK_ARRAY, TokenPos(begin, begin + 1)); + // Later in this stack: remove dependency on this opcode. + if (literal) + literal->setOp(JSOP_NEWINIT); + return literal; + } + + MOZ_MUST_USE bool addElision(ParseNode* literal, const TokenPos& pos) { + ParseNode* elision = new_<NullaryNode>(PNK_ELISION, pos); + if (!elision) + return false; + literal->append(elision); + literal->pn_xflags |= PNX_ARRAYHOLESPREAD | PNX_NONCONST; + return true; + } + + MOZ_MUST_USE bool addSpreadElement(ParseNode* literal, uint32_t begin, ParseNode* inner) { + TokenPos pos(begin, inner->pn_pos.end); + ParseNode* spread = new_<UnaryNode>(PNK_SPREAD, JSOP_NOP, pos, inner); + if (!spread) + return null(); + literal->append(spread); + literal->pn_xflags |= PNX_ARRAYHOLESPREAD | PNX_NONCONST; + return true; + } + + void addArrayElement(ParseNode* literal, ParseNode* element) { + if (!element->isConstant()) + literal->pn_xflags |= PNX_NONCONST; + literal->append(element); + } + + ParseNode* newCall() { + return newList(PNK_CALL, JSOP_CALL); + } + + ParseNode* newTaggedTemplate() { + return newList(PNK_TAGGED_TEMPLATE, JSOP_CALL); + } + + ParseNode* newObjectLiteral(uint32_t begin) { + ParseNode* literal = new_<ListNode>(PNK_OBJECT, TokenPos(begin, begin + 1)); + // Later in this stack: remove dependency on this opcode. + if (literal) + literal->setOp(JSOP_NEWINIT); + return literal; + } + + ParseNode* newClass(ParseNode* name, ParseNode* heritage, ParseNode* methodBlock) { + return new_<ClassNode>(name, heritage, methodBlock); + } + ParseNode* newClassMethodList(uint32_t begin) { + return new_<ListNode>(PNK_CLASSMETHODLIST, TokenPos(begin, begin + 1)); + } + ParseNode* newClassNames(ParseNode* outer, ParseNode* inner, const TokenPos& pos) { + return new_<ClassNames>(outer, inner, pos); + } + ParseNode* newNewTarget(ParseNode* newHolder, ParseNode* targetHolder) { + return new_<BinaryNode>(PNK_NEWTARGET, JSOP_NOP, newHolder, targetHolder); + } + ParseNode* newPosHolder(const TokenPos& pos) { + return new_<NullaryNode>(PNK_POSHOLDER, pos); + } + ParseNode* newSuperBase(ParseNode* thisName, const TokenPos& pos) { + return new_<UnaryNode>(PNK_SUPERBASE, JSOP_NOP, pos, thisName); + } + + MOZ_MUST_USE bool addPrototypeMutation(ParseNode* literal, uint32_t begin, ParseNode* expr) { + // Object literals with mutated [[Prototype]] are non-constant so that + // singleton objects will have Object.prototype as their [[Prototype]]. + setListFlag(literal, PNX_NONCONST); + + ParseNode* mutation = newUnary(PNK_MUTATEPROTO, JSOP_NOP, begin, expr); + if (!mutation) + return false; + literal->append(mutation); + return true; + } + + MOZ_MUST_USE bool addPropertyDefinition(ParseNode* literal, ParseNode* key, ParseNode* val) { + MOZ_ASSERT(literal->isKind(PNK_OBJECT)); + MOZ_ASSERT(literal->isArity(PN_LIST)); + MOZ_ASSERT(key->isKind(PNK_NUMBER) || + key->isKind(PNK_OBJECT_PROPERTY_NAME) || + key->isKind(PNK_STRING) || + key->isKind(PNK_COMPUTED_NAME)); + + ParseNode* propdef = newBinary(PNK_COLON, key, val, JSOP_INITPROP); + if (!propdef) + return false; + literal->append(propdef); + return true; + } + + MOZ_MUST_USE bool addShorthand(ParseNode* literal, ParseNode* name, ParseNode* expr) { + MOZ_ASSERT(literal->isKind(PNK_OBJECT)); + MOZ_ASSERT(literal->isArity(PN_LIST)); + MOZ_ASSERT(name->isKind(PNK_OBJECT_PROPERTY_NAME)); + MOZ_ASSERT(expr->isKind(PNK_NAME)); + MOZ_ASSERT(name->pn_atom == expr->pn_atom); + + setListFlag(literal, PNX_NONCONST); + ParseNode* propdef = newBinary(PNK_SHORTHAND, name, expr, JSOP_INITPROP); + if (!propdef) + return false; + literal->append(propdef); + return true; + } + + MOZ_MUST_USE bool addObjectMethodDefinition(ParseNode* literal, ParseNode* key, ParseNode* fn, + JSOp op) + { + MOZ_ASSERT(literal->isArity(PN_LIST)); + MOZ_ASSERT(key->isKind(PNK_NUMBER) || + key->isKind(PNK_OBJECT_PROPERTY_NAME) || + key->isKind(PNK_STRING) || + key->isKind(PNK_COMPUTED_NAME)); + literal->pn_xflags |= PNX_NONCONST; + + ParseNode* propdef = newBinary(PNK_COLON, key, fn, op); + if (!propdef) + return false; + literal->append(propdef); + return true; + } + + MOZ_MUST_USE bool addClassMethodDefinition(ParseNode* methodList, ParseNode* key, ParseNode* fn, + JSOp op, bool isStatic) + { + MOZ_ASSERT(methodList->isKind(PNK_CLASSMETHODLIST)); + MOZ_ASSERT(key->isKind(PNK_NUMBER) || + key->isKind(PNK_OBJECT_PROPERTY_NAME) || + key->isKind(PNK_STRING) || + key->isKind(PNK_COMPUTED_NAME)); + + ParseNode* classMethod = new_<ClassMethod>(key, fn, op, isStatic); + if (!classMethod) + return false; + methodList->append(classMethod); + return true; + } + + ParseNode* newYieldExpression(uint32_t begin, ParseNode* value, ParseNode* gen, + JSOp op = JSOP_YIELD) { + TokenPos pos(begin, value ? value->pn_pos.end : begin + 1); + return new_<BinaryNode>(PNK_YIELD, op, pos, value, gen); + } + + ParseNode* newYieldStarExpression(uint32_t begin, ParseNode* value, ParseNode* gen) { + TokenPos pos(begin, value->pn_pos.end); + return new_<BinaryNode>(PNK_YIELD_STAR, JSOP_NOP, pos, value, gen); + } + + ParseNode* newAwaitExpression(uint32_t begin, ParseNode* value, ParseNode* gen) { + TokenPos pos(begin, value ? value->pn_pos.end : begin + 1); + return new_<BinaryNode>(PNK_AWAIT, JSOP_YIELD, pos, value, gen); + } + + // Statements + + ParseNode* newStatementList(const TokenPos& pos) { + return new_<ListNode>(PNK_STATEMENTLIST, pos); + } + + MOZ_MUST_USE bool isFunctionStmt(ParseNode* stmt) { + while (stmt->isKind(PNK_LABEL)) + stmt = stmt->as<LabeledStatement>().statement(); + return stmt->isKind(PNK_FUNCTION); + } + + void addStatementToList(ParseNode* list, ParseNode* stmt) { + MOZ_ASSERT(list->isKind(PNK_STATEMENTLIST)); + + list->append(stmt); + + if (isFunctionStmt(stmt)) { + // PNX_FUNCDEFS notifies the emitter that the block contains + // body-level function definitions that should be processed + // before the rest of nodes. + list->pn_xflags |= PNX_FUNCDEFS; + } + } + + void addCaseStatementToList(ParseNode* list, ParseNode* casepn) { + MOZ_ASSERT(list->isKind(PNK_STATEMENTLIST)); + MOZ_ASSERT(casepn->isKind(PNK_CASE)); + MOZ_ASSERT(casepn->pn_right->isKind(PNK_STATEMENTLIST)); + + list->append(casepn); + + if (casepn->pn_right->pn_xflags & PNX_FUNCDEFS) + list->pn_xflags |= PNX_FUNCDEFS; + } + + MOZ_MUST_USE bool prependInitialYield(ParseNode* stmtList, ParseNode* genName) { + MOZ_ASSERT(stmtList->isKind(PNK_STATEMENTLIST)); + + TokenPos yieldPos(stmtList->pn_pos.begin, stmtList->pn_pos.begin + 1); + ParseNode* makeGen = new_<NullaryNode>(PNK_GENERATOR, yieldPos); + if (!makeGen) + return false; + + MOZ_ASSERT(genName->getOp() == JSOP_GETNAME); + genName->setOp(JSOP_SETNAME); + ParseNode* genInit = newBinary(PNK_ASSIGN, genName, makeGen); + if (!genInit) + return false; + + ParseNode* initialYield = newYieldExpression(yieldPos.begin, nullptr, genInit, + JSOP_INITIALYIELD); + if (!initialYield) + return false; + + stmtList->prepend(initialYield); + return true; + } + + ParseNode* newSetThis(ParseNode* thisName, ParseNode* val) { + MOZ_ASSERT(thisName->getOp() == JSOP_GETNAME); + thisName->setOp(JSOP_SETNAME); + return newBinary(PNK_SETTHIS, thisName, val); + } + + ParseNode* newEmptyStatement(const TokenPos& pos) { + return new_<UnaryNode>(PNK_SEMI, JSOP_NOP, pos, (ParseNode*) nullptr); + } + + ParseNode* newImportDeclaration(ParseNode* importSpecSet, + ParseNode* moduleSpec, const TokenPos& pos) + { + ParseNode* pn = new_<BinaryNode>(PNK_IMPORT, JSOP_NOP, pos, + importSpecSet, moduleSpec); + if (!pn) + return null(); + return pn; + } + + ParseNode* newExportDeclaration(ParseNode* kid, const TokenPos& pos) { + return new_<UnaryNode>(PNK_EXPORT, JSOP_NOP, pos, kid); + } + + ParseNode* newExportFromDeclaration(uint32_t begin, ParseNode* exportSpecSet, + ParseNode* moduleSpec) + { + ParseNode* pn = new_<BinaryNode>(PNK_EXPORT_FROM, JSOP_NOP, exportSpecSet, moduleSpec); + if (!pn) + return null(); + pn->pn_pos.begin = begin; + return pn; + } + + ParseNode* newExportDefaultDeclaration(ParseNode* kid, ParseNode* maybeBinding, + const TokenPos& pos) { + return new_<BinaryNode>(PNK_EXPORT_DEFAULT, JSOP_NOP, pos, kid, maybeBinding); + } + + ParseNode* newExprStatement(ParseNode* expr, uint32_t end) { + MOZ_ASSERT(expr->pn_pos.end <= end); + return new_<UnaryNode>(PNK_SEMI, JSOP_NOP, TokenPos(expr->pn_pos.begin, end), expr); + } + + ParseNode* newIfStatement(uint32_t begin, ParseNode* cond, ParseNode* thenBranch, + ParseNode* elseBranch) + { + ParseNode* pn = new_<TernaryNode>(PNK_IF, JSOP_NOP, cond, thenBranch, elseBranch); + if (!pn) + return null(); + pn->pn_pos.begin = begin; + return pn; + } + + ParseNode* newDoWhileStatement(ParseNode* body, ParseNode* cond, const TokenPos& pos) { + return new_<BinaryNode>(PNK_DOWHILE, JSOP_NOP, pos, body, cond); + } + + ParseNode* newWhileStatement(uint32_t begin, ParseNode* cond, ParseNode* body) { + TokenPos pos(begin, body->pn_pos.end); + return new_<BinaryNode>(PNK_WHILE, JSOP_NOP, pos, cond, body); + } + + ParseNode* newForStatement(uint32_t begin, ParseNode* forHead, ParseNode* body, + unsigned iflags) + { + /* A FOR node is binary, left is loop control and right is the body. */ + JSOp op = forHead->isKind(PNK_FORIN) ? JSOP_ITER : JSOP_NOP; + BinaryNode* pn = new_<BinaryNode>(PNK_FOR, op, TokenPos(begin, body->pn_pos.end), + forHead, body); + if (!pn) + return null(); + pn->pn_iflags = iflags; + return pn; + } + + ParseNode* newComprehensionFor(uint32_t begin, ParseNode* forHead, ParseNode* body) { + // A PNK_COMPREHENSIONFOR node is binary: left is loop control, right + // is the body. + MOZ_ASSERT(forHead->isKind(PNK_FORIN) || forHead->isKind(PNK_FOROF)); + JSOp op = forHead->isKind(PNK_FORIN) ? JSOP_ITER : JSOP_NOP; + BinaryNode* pn = new_<BinaryNode>(PNK_COMPREHENSIONFOR, op, + TokenPos(begin, body->pn_pos.end), forHead, body); + if (!pn) + return null(); + pn->pn_iflags = JSOP_ITER; + return pn; + } + + ParseNode* newComprehensionBinding(ParseNode* kid) { + MOZ_ASSERT(kid->isKind(PNK_NAME)); + return new_<ListNode>(PNK_LET, JSOP_NOP, kid); + } + + ParseNode* newForHead(ParseNode* init, ParseNode* test, ParseNode* update, + const TokenPos& pos) + { + return new_<TernaryNode>(PNK_FORHEAD, JSOP_NOP, init, test, update, pos); + } + + ParseNode* newForInOrOfHead(ParseNodeKind kind, ParseNode* target, ParseNode* iteratedExpr, + const TokenPos& pos) + { + MOZ_ASSERT(kind == PNK_FORIN || kind == PNK_FOROF); + return new_<TernaryNode>(kind, JSOP_NOP, target, nullptr, iteratedExpr, pos); + } + + ParseNode* newSwitchStatement(uint32_t begin, ParseNode* discriminant, ParseNode* caseList) { + TokenPos pos(begin, caseList->pn_pos.end); + return new_<BinaryNode>(PNK_SWITCH, JSOP_NOP, pos, discriminant, caseList); + } + + ParseNode* newCaseOrDefault(uint32_t begin, ParseNode* expr, ParseNode* body) { + return new_<CaseClause>(expr, body, begin); + } + + ParseNode* newContinueStatement(PropertyName* label, const TokenPos& pos) { + return new_<ContinueStatement>(label, pos); + } + + ParseNode* newBreakStatement(PropertyName* label, const TokenPos& pos) { + return new_<BreakStatement>(label, pos); + } + + ParseNode* newReturnStatement(ParseNode* expr, const TokenPos& pos) { + MOZ_ASSERT_IF(expr, pos.encloses(expr->pn_pos)); + return new_<UnaryNode>(PNK_RETURN, JSOP_RETURN, pos, expr); + } + + ParseNode* newWithStatement(uint32_t begin, ParseNode* expr, ParseNode* body) { + return new_<BinaryNode>(PNK_WITH, JSOP_NOP, TokenPos(begin, body->pn_pos.end), + expr, body); + } + + ParseNode* newLabeledStatement(PropertyName* label, ParseNode* stmt, uint32_t begin) { + return new_<LabeledStatement>(label, stmt, begin); + } + + ParseNode* newThrowStatement(ParseNode* expr, const TokenPos& pos) { + MOZ_ASSERT(pos.encloses(expr->pn_pos)); + return new_<UnaryNode>(PNK_THROW, JSOP_THROW, pos, expr); + } + + ParseNode* newTryStatement(uint32_t begin, ParseNode* body, ParseNode* catchList, + ParseNode* finallyBlock) { + TokenPos pos(begin, (finallyBlock ? finallyBlock : catchList)->pn_pos.end); + return new_<TernaryNode>(PNK_TRY, JSOP_NOP, body, catchList, finallyBlock, pos); + } + + ParseNode* newDebuggerStatement(const TokenPos& pos) { + return new_<DebuggerStatement>(pos); + } + + ParseNode* newPropertyAccess(ParseNode* pn, PropertyName* name, uint32_t end) { + return new_<PropertyAccess>(pn, name, pn->pn_pos.begin, end); + } + + ParseNode* newPropertyByValue(ParseNode* lhs, ParseNode* index, uint32_t end) { + return new_<PropertyByValue>(lhs, index, lhs->pn_pos.begin, end); + } + + inline MOZ_MUST_USE bool addCatchBlock(ParseNode* catchList, ParseNode* lexicalScope, + ParseNode* catchName, ParseNode* catchGuard, + ParseNode* catchBody); + + inline MOZ_MUST_USE bool setLastFunctionFormalParameterDefault(ParseNode* funcpn, + ParseNode* pn); + inline void setLastFunctionFormalParameterDestructuring(ParseNode* funcpn, ParseNode* pn); + + ParseNode* newFunctionDefinition() { + return new_<CodeNode>(PNK_FUNCTION, pos()); + } + bool setComprehensionLambdaBody(ParseNode* pn, ParseNode* body) { + MOZ_ASSERT(body->isKind(PNK_STATEMENTLIST)); + ParseNode* paramsBody = newList(PNK_PARAMSBODY, body); + if (!paramsBody) + return false; + setFunctionFormalParametersAndBody(pn, paramsBody); + return true; + } + void setFunctionFormalParametersAndBody(ParseNode* pn, ParseNode* kid) { + MOZ_ASSERT_IF(kid, kid->isKind(PNK_PARAMSBODY)); + pn->pn_body = kid; + } + void setFunctionBox(ParseNode* pn, FunctionBox* funbox) { + MOZ_ASSERT(pn->isKind(PNK_FUNCTION)); + pn->pn_funbox = funbox; + funbox->functionNode = pn; + } + void addFunctionFormalParameter(ParseNode* pn, ParseNode* argpn) { + pn->pn_body->append(argpn); + } + void setFunctionBody(ParseNode* fn, ParseNode* body) { + MOZ_ASSERT(fn->pn_body->isKind(PNK_PARAMSBODY)); + fn->pn_body->append(body); + } + + ParseNode* newModule() { + return new_<CodeNode>(PNK_MODULE, pos()); + } + + ParseNode* newLexicalScope(LexicalScope::Data* bindings, ParseNode* body) { + return new_<LexicalScopeNode>(bindings, body); + } + + ParseNode* newAssignment(ParseNodeKind kind, ParseNode* lhs, ParseNode* rhs, + JSOp op) + { + return newBinary(kind, lhs, rhs, op); + } + + bool isUnparenthesizedYieldExpression(ParseNode* node) { + return node->isKind(PNK_YIELD) && !node->isInParens(); + } + + bool isUnparenthesizedCommaExpression(ParseNode* node) { + return node->isKind(PNK_COMMA) && !node->isInParens(); + } + + bool isUnparenthesizedAssignment(Node node) { + if (node->isKind(PNK_ASSIGN) && !node->isInParens()) { + // PNK_ASSIGN is also (mis)used for things like |var name = expr;|. + // But this method is only called on actual expressions, so we can + // just assert the node's op is the one used for plain assignment. + MOZ_ASSERT(node->isOp(JSOP_NOP)); + return true; + } + + return false; + } + + bool isUnparenthesizedUnaryExpression(ParseNode* node) { + if (!node->isInParens()) { + ParseNodeKind kind = node->getKind(); + return kind == PNK_VOID || kind == PNK_NOT || kind == PNK_BITNOT || kind == PNK_POS || + kind == PNK_NEG || IsTypeofKind(kind) || IsDeleteKind(kind); + } + return false; + } + + bool isReturnStatement(ParseNode* node) { + return node->isKind(PNK_RETURN); + } + + bool isStatementPermittedAfterReturnStatement(ParseNode *node) { + ParseNodeKind kind = node->getKind(); + return kind == PNK_FUNCTION || kind == PNK_VAR || kind == PNK_BREAK || kind == PNK_THROW || + (kind == PNK_SEMI && !node->pn_kid); + } + + bool isSuperBase(ParseNode* node) { + return node->isKind(PNK_SUPERBASE); + } + + inline MOZ_MUST_USE bool finishInitializerAssignment(ParseNode* pn, ParseNode* init); + + void setBeginPosition(ParseNode* pn, ParseNode* oth) { + setBeginPosition(pn, oth->pn_pos.begin); + } + void setBeginPosition(ParseNode* pn, uint32_t begin) { + pn->pn_pos.begin = begin; + MOZ_ASSERT(pn->pn_pos.begin <= pn->pn_pos.end); + } + + void setEndPosition(ParseNode* pn, ParseNode* oth) { + setEndPosition(pn, oth->pn_pos.end); + } + void setEndPosition(ParseNode* pn, uint32_t end) { + pn->pn_pos.end = end; + MOZ_ASSERT(pn->pn_pos.begin <= pn->pn_pos.end); + } + + void setPosition(ParseNode* pn, const TokenPos& pos) { + pn->pn_pos = pos; + } + TokenPos getPosition(ParseNode* pn) { + return pn->pn_pos; + } + + bool isDeclarationKind(ParseNodeKind kind) { + return kind == PNK_VAR || kind == PNK_LET || kind == PNK_CONST; + } + + ParseNode* newList(ParseNodeKind kind, JSOp op = JSOP_NOP) { + MOZ_ASSERT(!isDeclarationKind(kind)); + return new_<ListNode>(kind, op, pos()); + } + + ParseNode* newList(ParseNodeKind kind, uint32_t begin, JSOp op = JSOP_NOP) { + MOZ_ASSERT(!isDeclarationKind(kind)); + return new_<ListNode>(kind, op, TokenPos(begin, begin + 1)); + } + + ParseNode* newList(ParseNodeKind kind, ParseNode* kid, JSOp op = JSOP_NOP) { + MOZ_ASSERT(!isDeclarationKind(kind)); + return new_<ListNode>(kind, op, kid); + } + + ParseNode* newDeclarationList(ParseNodeKind kind, JSOp op = JSOP_NOP) { + MOZ_ASSERT(isDeclarationKind(kind)); + return new_<ListNode>(kind, op, pos()); + } + + ParseNode* newDeclarationList(ParseNodeKind kind, ParseNode* kid, JSOp op = JSOP_NOP) { + MOZ_ASSERT(isDeclarationKind(kind)); + return new_<ListNode>(kind, op, kid); + } + + bool isDeclarationList(ParseNode* node) { + return isDeclarationKind(node->getKind()); + } + + ParseNode* singleBindingFromDeclaration(ParseNode* decl) { + MOZ_ASSERT(isDeclarationList(decl)); + MOZ_ASSERT(decl->pn_count == 1); + return decl->pn_head; + } + + ParseNode* newCatchList() { + return new_<ListNode>(PNK_CATCHLIST, JSOP_NOP, pos()); + } + + ParseNode* newCommaExpressionList(ParseNode* kid) { + return newList(PNK_COMMA, kid, JSOP_NOP); + } + + void addList(ParseNode* list, ParseNode* kid) { + list->append(kid); + } + + void setOp(ParseNode* pn, JSOp op) { + pn->setOp(op); + } + void setListFlag(ParseNode* pn, unsigned flag) { + MOZ_ASSERT(pn->isArity(PN_LIST)); + pn->pn_xflags |= flag; + } + MOZ_MUST_USE ParseNode* parenthesize(ParseNode* pn) { + pn->setInParens(true); + return pn; + } + MOZ_MUST_USE ParseNode* setLikelyIIFE(ParseNode* pn) { + return parenthesize(pn); + } + void setPrologue(ParseNode* pn) { + pn->pn_prologue = true; + } + + bool isConstant(ParseNode* pn) { + return pn->isConstant(); + } + + bool isUnparenthesizedName(ParseNode* node) { + return node->isKind(PNK_NAME) && !node->isInParens(); + } + + bool isNameAnyParentheses(ParseNode* node) { + return node->isKind(PNK_NAME); + } + + bool nameIsEvalAnyParentheses(ParseNode* node, ExclusiveContext* cx) { + MOZ_ASSERT(isNameAnyParentheses(node), + "must only call this function on known names"); + + return node->pn_atom == cx->names().eval; + } + + const char* nameIsArgumentsEvalAnyParentheses(ParseNode* node, ExclusiveContext* cx) { + MOZ_ASSERT(isNameAnyParentheses(node), + "must only call this function on known names"); + + if (nameIsEvalAnyParentheses(node, cx)) + return js_eval_str; + if (node->pn_atom == cx->names().arguments) + return js_arguments_str; + return nullptr; + } + + bool nameIsUnparenthesizedAsync(ParseNode* node, ExclusiveContext* cx) { + MOZ_ASSERT(isNameAnyParentheses(node), + "must only call this function on known names"); + + return node->pn_atom == cx->names().async; + } + + bool isCall(ParseNode* pn) { + return pn->isKind(PNK_CALL); + } + PropertyName* maybeDottedProperty(ParseNode* pn) { + return pn->is<PropertyAccess>() ? &pn->as<PropertyAccess>().name() : nullptr; + } + JSAtom* isStringExprStatement(ParseNode* pn, TokenPos* pos) { + if (JSAtom* atom = pn->isStringExprStatement()) { + *pos = pn->pn_kid->pn_pos; + return atom; + } + return nullptr; + } + + void adjustGetToSet(ParseNode* node) { + node->setOp(node->isOp(JSOP_GETLOCAL) ? JSOP_SETLOCAL : JSOP_SETNAME); + } + + void disableSyntaxParser() { + syntaxParser = nullptr; + } + + bool canSkipLazyInnerFunctions() { + return !!lazyOuterFunction_; + } + bool canSkipLazyClosedOverBindings() { + return !!lazyOuterFunction_; + } + LazyScript* lazyOuterFunction() { + return lazyOuterFunction_; + } + JSFunction* nextLazyInnerFunction() { + MOZ_ASSERT(lazyInnerFunctionIndex < lazyOuterFunction()->numInnerFunctions()); + return lazyOuterFunction()->innerFunctions()[lazyInnerFunctionIndex++]; + } + JSAtom* nextLazyClosedOverBinding() { + MOZ_ASSERT(lazyClosedOverBindingIndex < lazyOuterFunction()->numClosedOverBindings()); + return lazyOuterFunction()->closedOverBindings()[lazyClosedOverBindingIndex++]; + } +}; + +inline bool +FullParseHandler::addCatchBlock(ParseNode* catchList, ParseNode* lexicalScope, + ParseNode* catchName, ParseNode* catchGuard, ParseNode* catchBody) +{ + ParseNode* catchpn = newTernary(PNK_CATCH, catchName, catchGuard, catchBody); + if (!catchpn) + return false; + catchList->append(lexicalScope); + lexicalScope->setScopeBody(catchpn); + return true; +} + +inline bool +FullParseHandler::setLastFunctionFormalParameterDefault(ParseNode* funcpn, ParseNode* defaultValue) +{ + ParseNode* arg = funcpn->pn_body->last(); + ParseNode* pn = newBinary(PNK_ASSIGN, arg, defaultValue, JSOP_NOP); + if (!pn) + return false; + + funcpn->pn_body->pn_pos.end = pn->pn_pos.end; + ParseNode* pnchild = funcpn->pn_body->pn_head; + ParseNode* pnlast = funcpn->pn_body->last(); + MOZ_ASSERT(pnchild); + if (pnchild == pnlast) { + funcpn->pn_body->pn_head = pn; + } else { + while (pnchild->pn_next != pnlast) { + MOZ_ASSERT(pnchild->pn_next); + pnchild = pnchild->pn_next; + } + pnchild->pn_next = pn; + } + funcpn->pn_body->pn_tail = &pn->pn_next; + + return true; +} + +inline bool +FullParseHandler::finishInitializerAssignment(ParseNode* pn, ParseNode* init) +{ + pn->pn_expr = init; + pn->setOp(JSOP_SETNAME); + + /* The declarator's position must include the initializer. */ + pn->pn_pos.end = init->pn_pos.end; + return true; +} + +} // namespace frontend +} // namespace js + +#endif /* frontend_FullParseHandler_h */ diff --git a/js/src/frontend/NameAnalysisTypes.h b/js/src/frontend/NameAnalysisTypes.h new file mode 100644 index 000000000..d39e177fb --- /dev/null +++ b/js/src/frontend/NameAnalysisTypes.h @@ -0,0 +1,366 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- + * vim: set ts=8 sts=4 et sw=4 tw=99: + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#ifndef frontend_NameAnalysis_h +#define frontend_NameAnalysis_h + +#include "jsopcode.h" + +#include "vm/Scope.h" + +namespace js { + +// An "environment coordinate" describes how to get from head of the +// environment chain to a given lexically-enclosing variable. An environment +// coordinate has two dimensions: +// - hops: the number of environment objects on the scope chain to skip +// - slot: the slot on the environment object holding the variable's value +class EnvironmentCoordinate +{ + uint32_t hops_; + uint32_t slot_; + + // Technically, hops_/slot_ are ENVCOORD_(HOPS|SLOT)_BITS wide. Since + // EnvironmentCoordinate is a temporary value, don't bother with a bitfield as + // this only adds overhead. + static_assert(ENVCOORD_HOPS_BITS <= 32, "We have enough bits below"); + static_assert(ENVCOORD_SLOT_BITS <= 32, "We have enough bits below"); + + public: + explicit inline EnvironmentCoordinate(jsbytecode* pc) + : hops_(GET_ENVCOORD_HOPS(pc)), slot_(GET_ENVCOORD_SLOT(pc + ENVCOORD_HOPS_LEN)) + { + MOZ_ASSERT(JOF_OPTYPE(JSOp(*pc)) == JOF_ENVCOORD); + } + + EnvironmentCoordinate() {} + + void setHops(uint32_t hops) { + MOZ_ASSERT(hops < ENVCOORD_HOPS_LIMIT); + hops_ = hops; + } + + void setSlot(uint32_t slot) { + MOZ_ASSERT(slot < ENVCOORD_SLOT_LIMIT); + slot_ = slot; + } + + uint32_t hops() const { + MOZ_ASSERT(hops_ < ENVCOORD_HOPS_LIMIT); + return hops_; + } + + uint32_t slot() const { + MOZ_ASSERT(slot_ < ENVCOORD_SLOT_LIMIT); + return slot_; + } + + bool operator==(const EnvironmentCoordinate& rhs) const { + return hops() == rhs.hops() && slot() == rhs.slot(); + } +}; + +namespace frontend { + +// A detailed kind used for tracking declarations in the Parser. Used for +// specific early error semantics and better error messages. +enum class DeclarationKind : uint8_t +{ + PositionalFormalParameter, + FormalParameter, + CoverArrowParameter, + Var, + ForOfVar, + Let, + Const, + Import, + BodyLevelFunction, + LexicalFunction, + VarForAnnexBLexicalFunction, + SimpleCatchParameter, + CatchParameter +}; + +static inline BindingKind +DeclarationKindToBindingKind(DeclarationKind kind) +{ + switch (kind) { + case DeclarationKind::PositionalFormalParameter: + case DeclarationKind::FormalParameter: + case DeclarationKind::CoverArrowParameter: + return BindingKind::FormalParameter; + + case DeclarationKind::Var: + case DeclarationKind::BodyLevelFunction: + case DeclarationKind::VarForAnnexBLexicalFunction: + case DeclarationKind::ForOfVar: + return BindingKind::Var; + + case DeclarationKind::Let: + case DeclarationKind::LexicalFunction: + case DeclarationKind::SimpleCatchParameter: + case DeclarationKind::CatchParameter: + return BindingKind::Let; + + case DeclarationKind::Const: + return BindingKind::Const; + + case DeclarationKind::Import: + return BindingKind::Import; + } + + MOZ_CRASH("Bad DeclarationKind"); +} + +static inline bool +DeclarationKindIsLexical(DeclarationKind kind) +{ + return BindingKindIsLexical(DeclarationKindToBindingKind(kind)); +} + +// Used in Parser to track declared names. +class DeclaredNameInfo +{ + DeclarationKind kind_; + + // If the declared name is a binding, whether the binding is closed + // over. Its value is meaningless if the declared name is not a binding + // (i.e., a 'var' declared name in a non-var scope). + bool closedOver_; + + public: + explicit DeclaredNameInfo(DeclarationKind kind) + : kind_(kind), + closedOver_(false) + { } + + // Needed for InlineMap. + DeclaredNameInfo() = default; + + DeclarationKind kind() const { + return kind_; + } + + void alterKind(DeclarationKind kind) { + kind_ = kind; + } + + void setClosedOver() { + closedOver_ = true; + } + + bool closedOver() const { + return closedOver_; + } +}; + +// Used in BytecodeEmitter to map names to locations. +class NameLocation +{ + public: + enum class Kind : uint8_t + { + // Cannot statically determine where the name lives. Needs to walk the + // environment chain to search for the name. + Dynamic, + + // The name lives on the global or is a global lexical binding. Search + // for the name on the global scope. + Global, + + // Special mode used only when emitting self-hosted scripts. See + // BytecodeEmitter::lookupName. + Intrinsic, + + // In a named lambda, the name is the callee itself. + NamedLambdaCallee, + + // The name is a positional formal parameter name and can be retrieved + // directly from the stack using slot_. + ArgumentSlot, + + // The name is not closed over and lives on the frame in slot_. + FrameSlot, + + // The name is closed over and lives on an environment hops_ away in slot_. + EnvironmentCoordinate, + + // An imported name in a module. + Import, + + // Cannot statically determine where the synthesized var for Annex + // B.3.3 lives. + DynamicAnnexBVar + }; + + private: + // Where the name lives. + Kind kind_; + + // If the name is not Dynamic or DynamicAnnexBVar, the kind of the + // binding. + BindingKind bindingKind_; + + // If the name is closed over and accessed via EnvironmentCoordinate, the + // number of dynamic environments to skip. + // + // Otherwise UINT8_MAX. + uint8_t hops_; + + // If the name lives on the frame, the slot frame. + // + // If the name is closed over and accessed via EnvironmentCoordinate, the + // slot on the environment. + // + // Otherwise LOCALNO_LIMIT/ENVCOORD_SLOT_LIMIT. + uint32_t slot_ : ENVCOORD_SLOT_BITS; + + static_assert(LOCALNO_BITS == ENVCOORD_SLOT_BITS, + "Frame and environment slots must be same sized."); + + NameLocation(Kind kind, BindingKind bindingKind, + uint8_t hops = UINT8_MAX, uint32_t slot = ENVCOORD_SLOT_LIMIT) + : kind_(kind), + bindingKind_(bindingKind), + hops_(hops), + slot_(slot) + { } + + public: + // Default constructor for InlineMap. + NameLocation() = default; + + static NameLocation Dynamic() { + return NameLocation(); + } + + static NameLocation Global(BindingKind bindKind) { + MOZ_ASSERT(bindKind != BindingKind::FormalParameter); + return NameLocation(Kind::Global, bindKind); + } + + static NameLocation Intrinsic() { + return NameLocation(Kind::Intrinsic, BindingKind::Var); + } + + static NameLocation NamedLambdaCallee() { + return NameLocation(Kind::NamedLambdaCallee, BindingKind::NamedLambdaCallee); + } + + static NameLocation ArgumentSlot(uint16_t slot) { + return NameLocation(Kind::ArgumentSlot, BindingKind::FormalParameter, 0, slot); + } + + static NameLocation FrameSlot(BindingKind bindKind, uint32_t slot) { + MOZ_ASSERT(slot < LOCALNO_LIMIT); + return NameLocation(Kind::FrameSlot, bindKind, 0, slot); + } + + static NameLocation EnvironmentCoordinate(BindingKind bindKind, uint8_t hops, uint32_t slot) { + MOZ_ASSERT(slot < ENVCOORD_SLOT_LIMIT); + return NameLocation(Kind::EnvironmentCoordinate, bindKind, hops, slot); + } + + static NameLocation Import() { + return NameLocation(Kind::Import, BindingKind::Import); + } + + static NameLocation DynamicAnnexBVar() { + return NameLocation(Kind::DynamicAnnexBVar, BindingKind::Var); + } + + static NameLocation fromBinding(BindingKind bindKind, const BindingLocation& bl) { + switch (bl.kind()) { + case BindingLocation::Kind::Global: + return Global(bindKind); + case BindingLocation::Kind::Argument: + return ArgumentSlot(bl.argumentSlot()); + case BindingLocation::Kind::Frame: + return FrameSlot(bindKind, bl.slot()); + case BindingLocation::Kind::Environment: + return EnvironmentCoordinate(bindKind, 0, bl.slot()); + case BindingLocation::Kind::Import: + return Import(); + case BindingLocation::Kind::NamedLambdaCallee: + return NamedLambdaCallee(); + } + MOZ_CRASH("Bad BindingKind"); + } + + bool operator==(const NameLocation& other) const { + return kind_ == other.kind_ && bindingKind_ == other.bindingKind_ && + hops_ == other.hops_ && slot_ == other.slot_; + } + + bool operator!=(const NameLocation& other) const { + return !(*this == other); + } + + Kind kind() const { + return kind_; + } + + uint16_t argumentSlot() const { + MOZ_ASSERT(kind_ == Kind::ArgumentSlot); + return mozilla::AssertedCast<uint16_t>(slot_); + } + + uint32_t frameSlot() const { + MOZ_ASSERT(kind_ == Kind::FrameSlot); + return slot_; + } + + NameLocation addHops(uint8_t more) { + MOZ_ASSERT(hops_ < ENVCOORD_HOPS_LIMIT - more); + MOZ_ASSERT(kind_ == Kind::EnvironmentCoordinate); + return NameLocation(kind_, bindingKind_, hops_ + more, slot_); + } + + class EnvironmentCoordinate environmentCoordinate() const { + MOZ_ASSERT(kind_ == Kind::EnvironmentCoordinate); + class EnvironmentCoordinate coord; + coord.setHops(hops_); + coord.setSlot(slot_); + return coord; + } + + BindingKind bindingKind() const { + MOZ_ASSERT(kind_ != Kind::Dynamic); + return bindingKind_; + } + + bool isLexical() const { + return BindingKindIsLexical(bindingKind()); + } + + bool isConst() const { + return bindingKind() == BindingKind::Const; + } + + bool hasKnownSlot() const { + return kind_ == Kind::ArgumentSlot || + kind_ == Kind::FrameSlot || + kind_ == Kind::EnvironmentCoordinate; + } +}; + +// This type is declared here for LazyScript::Create. +using AtomVector = Vector<JSAtom*, 24, SystemAllocPolicy>; + +} // namespace frontend +} // namespace js + +namespace mozilla { + +template <> +struct IsPod<js::frontend::DeclaredNameInfo> : TrueType {}; + +template <> +struct IsPod<js::frontend::NameLocation> : TrueType {}; + +} // namespace mozilla + +#endif // frontend_NameAnalysis_h diff --git a/js/src/frontend/NameCollections.h b/js/src/frontend/NameCollections.h new file mode 100644 index 000000000..58c5d0ac0 --- /dev/null +++ b/js/src/frontend/NameCollections.h @@ -0,0 +1,338 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- + * vim: set ts=8 sts=4 et sw=4 tw=99: + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#ifndef frontend_NameCollections_h +#define frontend_NameCollections_h + +#include "ds/InlineTable.h" +#include "frontend/NameAnalysisTypes.h" +#include "js/Vector.h" +#include "vm/Stack.h" + +namespace js { +namespace frontend { + +// A pool of recyclable containers for use in the frontend. The Parser and +// BytecodeEmitter create many maps for name analysis that are short-lived +// (i.e., for the duration of parsing or emitting a lexical scope). Making +// them recyclable cuts down significantly on allocator churn. +template <typename RepresentativeCollection, typename ConcreteCollectionPool> +class CollectionPool +{ + using RecyclableCollections = Vector<void*, 32, SystemAllocPolicy>; + + RecyclableCollections all_; + RecyclableCollections recyclable_; + + static RepresentativeCollection* asRepresentative(void* p) { + return reinterpret_cast<RepresentativeCollection*>(p); + } + + RepresentativeCollection* allocate() { + size_t newAllLength = all_.length() + 1; + if (!all_.reserve(newAllLength) || !recyclable_.reserve(newAllLength)) + return nullptr; + + RepresentativeCollection* collection = js_new<RepresentativeCollection>(); + if (collection) + all_.infallibleAppend(collection); + return collection; + } + + public: + ~CollectionPool() { + purgeAll(); + } + + bool empty() const { + return all_.empty(); + } + + void purgeAll() { + void** end = all_.end(); + for (void** it = all_.begin(); it != end; ++it) + js_delete(asRepresentative(*it)); + + all_.clearAndFree(); + recyclable_.clearAndFree(); + } + + // Fallibly aquire one of the supported collection types from the pool. + template <typename Collection> + Collection* acquire(ExclusiveContext* cx) { + ConcreteCollectionPool::template assertInvariants<Collection>(); + + RepresentativeCollection* collection; + if (recyclable_.empty()) { + collection = allocate(); + if (!collection) + ReportOutOfMemory(cx); + } else { + collection = asRepresentative(recyclable_.popCopy()); + collection->clear(); + } + return reinterpret_cast<Collection*>(collection); + } + + // Release a collection back to the pool. + template <typename Collection> + void release(Collection** collection) { + ConcreteCollectionPool::template assertInvariants<Collection>(); + MOZ_ASSERT(*collection); + +#ifdef DEBUG + bool ok = false; + // Make sure the collection is in |all_| but not already in |recyclable_|. + for (void** it = all_.begin(); it != all_.end(); ++it) { + if (*it == *collection) { + ok = true; + break; + } + } + MOZ_ASSERT(ok); + for (void** it = recyclable_.begin(); it != recyclable_.end(); ++it) + MOZ_ASSERT(*it != *collection); +#endif + + MOZ_ASSERT(recyclable_.length() < all_.length()); + // Reserved in allocateFresh. + recyclable_.infallibleAppend(*collection); + *collection = nullptr; + } +}; + +template <typename Wrapped> +struct RecyclableAtomMapValueWrapper +{ + union { + Wrapped wrapped; + uint64_t dummy; + }; + + static void assertInvariant() { + static_assert(sizeof(Wrapped) <= sizeof(uint64_t), + "Can only recycle atom maps with values smaller than uint64"); + } + + RecyclableAtomMapValueWrapper() { + assertInvariant(); + } + + MOZ_IMPLICIT RecyclableAtomMapValueWrapper(Wrapped w) + : wrapped(w) + { + assertInvariant(); + } + + MOZ_IMPLICIT operator Wrapped&() { + return wrapped; + } + + MOZ_IMPLICIT operator Wrapped&() const { + return wrapped; + } + + Wrapped* operator->() { + return &wrapped; + } + + const Wrapped* operator->() const { + return &wrapped; + } +}; + +template <typename MapValue> +using RecyclableNameMap = InlineMap<JSAtom*, + RecyclableAtomMapValueWrapper<MapValue>, + 24, + DefaultHasher<JSAtom*>, + SystemAllocPolicy>; + +using DeclaredNameMap = RecyclableNameMap<DeclaredNameInfo>; +using CheckTDZMap = RecyclableNameMap<MaybeCheckTDZ>; +using NameLocationMap = RecyclableNameMap<NameLocation>; +using AtomIndexMap = RecyclableNameMap<uint32_t>; + +#undef RECYCLABLE_NAME_MAP_TYPE + +template <typename RepresentativeTable> +class InlineTablePool + : public CollectionPool<RepresentativeTable, InlineTablePool<RepresentativeTable>> +{ + public: + template <typename Table> + static void assertInvariants() { + static_assert(Table::SizeOfInlineEntries == RepresentativeTable::SizeOfInlineEntries, + "Only tables with the same size for inline entries are usable in the pool."); + static_assert(mozilla::IsPod<typename Table::Table::Entry>::value, + "Only tables with POD values are usable in the pool."); + } +}; + +using FunctionBoxVector = Vector<FunctionBox*, 24, SystemAllocPolicy>; + +template <typename RepresentativeVector> +class VectorPool : public CollectionPool<RepresentativeVector, VectorPool<RepresentativeVector>> +{ + public: + template <typename Vector> + static void assertInvariants() { + static_assert(Vector::sMaxInlineStorage == RepresentativeVector::sMaxInlineStorage, + "Only vectors with the same size for inline entries are usable in the pool."); + static_assert(mozilla::IsPod<typename Vector::ElementType>::value, + "Only vectors of POD values are usable in the pool."); + static_assert(sizeof(typename Vector::ElementType) == + sizeof(typename RepresentativeVector::ElementType), + "Only vectors with same-sized elements are usable in the pool."); + } +}; + +class NameCollectionPool +{ + InlineTablePool<AtomIndexMap> mapPool_; + VectorPool<AtomVector> vectorPool_; + uint32_t activeCompilations_; + + public: + NameCollectionPool() + : activeCompilations_(0) + { } + + bool hasActiveCompilation() const { + return activeCompilations_ != 0; + } + + void addActiveCompilation() { + activeCompilations_++; + } + + void removeActiveCompilation() { + MOZ_ASSERT(hasActiveCompilation()); + activeCompilations_--; + } + + template <typename Map> + Map* acquireMap(ExclusiveContext* cx) { + MOZ_ASSERT(hasActiveCompilation()); + return mapPool_.acquire<Map>(cx); + } + + template <typename Map> + void releaseMap(Map** map) { + MOZ_ASSERT(hasActiveCompilation()); + MOZ_ASSERT(map); + if (*map) + mapPool_.release(map); + } + + template <typename Vector> + Vector* acquireVector(ExclusiveContext* cx) { + MOZ_ASSERT(hasActiveCompilation()); + return vectorPool_.acquire<Vector>(cx); + } + + template <typename Vector> + void releaseVector(Vector** vec) { + MOZ_ASSERT(hasActiveCompilation()); + MOZ_ASSERT(vec); + if (*vec) + vectorPool_.release(vec); + } + + void purge() { + if (!hasActiveCompilation()) { + mapPool_.purgeAll(); + vectorPool_.purgeAll(); + } + } +}; + +#define POOLED_COLLECTION_PTR_METHODS(N, T) \ + NameCollectionPool& pool_; \ + T* collection_; \ + \ + T& collection() { \ + MOZ_ASSERT(collection_); \ + return *collection_; \ + } \ + \ + const T& collection() const { \ + MOZ_ASSERT(collection_); \ + return *collection_; \ + } \ + \ + public: \ + explicit N(NameCollectionPool& pool) \ + : pool_(pool), \ + collection_(nullptr) \ + { } \ + \ + ~N() { \ + pool_.release##T(&collection_); \ + } \ + \ + bool acquire(ExclusiveContext* cx) { \ + MOZ_ASSERT(!collection_); \ + collection_ = pool_.acquire##T<T>(cx); \ + return !!collection_; \ + } \ + \ + explicit operator bool() const { \ + return !!collection_; \ + } \ + \ + T* operator->() { \ + return &collection(); \ + } \ + \ + const T* operator->() const { \ + return &collection(); \ + } \ + \ + T& operator*() { \ + return collection(); \ + } \ + \ + const T& operator*() const { \ + return collection(); \ + } + +template <typename Map> +class PooledMapPtr +{ + POOLED_COLLECTION_PTR_METHODS(PooledMapPtr, Map) +}; + +template <typename Vector> +class PooledVectorPtr +{ + POOLED_COLLECTION_PTR_METHODS(PooledVectorPtr, Vector) + + typename Vector::ElementType& operator[](size_t index) { + return collection()[index]; + } + + const typename Vector::ElementType& operator[](size_t index) const { + return collection()[index]; + } +}; + +#undef POOLED_COLLECTION_PTR_METHODS + +} // namespace frontend +} // namespace js + +namespace mozilla { + +template <> +struct IsPod<js::MaybeCheckTDZ> : TrueType {}; + +template <typename T> +struct IsPod<js::frontend::RecyclableAtomMapValueWrapper<T>> : IsPod<T> {}; + +} // namespace mozilla + +#endif // frontend_NameCollections_h diff --git a/js/src/frontend/NameFunctions.cpp b/js/src/frontend/NameFunctions.cpp new file mode 100644 index 000000000..ce1318f0b --- /dev/null +++ b/js/src/frontend/NameFunctions.cpp @@ -0,0 +1,838 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- + * vim: set ts=8 sts=4 et sw=4 tw=99: + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#include "frontend/NameFunctions.h" + +#include "mozilla/Sprintf.h" + +#include "jsfun.h" +#include "jsprf.h" + +#include "frontend/BytecodeCompiler.h" +#include "frontend/ParseNode.h" +#include "frontend/SharedContext.h" +#include "vm/StringBuffer.h" + +using namespace js; +using namespace js::frontend; + +namespace { + +class NameResolver +{ + static const size_t MaxParents = 100; + + ExclusiveContext* cx; + size_t nparents; /* number of parents in the parents array */ + ParseNode* parents[MaxParents]; /* history of ParseNodes we've been looking at */ + StringBuffer* buf; /* when resolving, buffer to append to */ + + /* Test whether a ParseNode represents a function invocation */ + bool call(ParseNode* pn) { + return pn && pn->isKind(PNK_CALL); + } + + /* + * Append a reference to a property named |name| to |buf|. If |name| is + * a proper identifier name, then we append '.name'; otherwise, we + * append '["name"]'. + * + * Note that we need the IsIdentifier check for atoms from both + * PNK_NAME nodes and PNK_STRING nodes: given code like a["b c"], the + * front end will produce a PNK_DOT with a PNK_NAME child whose name + * contains spaces. + */ + bool appendPropertyReference(JSAtom* name) { + if (IsIdentifier(name)) + return buf->append('.') && buf->append(name); + + /* Quote the string as needed. */ + JSString* source = QuoteString(cx, name, '"'); + return source && buf->append('[') && buf->append(source) && buf->append(']'); + } + + /* Append a number to buf. */ + bool appendNumber(double n) { + char number[30]; + int digits = SprintfLiteral(number, "%g", n); + return buf->append(number, digits); + } + + /* Append "[<n>]" to buf, referencing a property named by a numeric literal. */ + bool appendNumericPropertyReference(double n) { + return buf->append("[") && appendNumber(n) && buf->append(']'); + } + + /* + * Walk over the given ParseNode, attempting to convert it to a stringified + * name that respresents where the function is being assigned to. + * + * |*foundName| is set to true if a name is found for the expression. + */ + bool nameExpression(ParseNode* n, bool* foundName) { + switch (n->getKind()) { + case PNK_DOT: + if (!nameExpression(n->expr(), foundName)) + return false; + if (!*foundName) + return true; + return appendPropertyReference(n->pn_atom); + + case PNK_NAME: + *foundName = true; + return buf->append(n->pn_atom); + + case PNK_THIS: + *foundName = true; + return buf->append("this"); + + case PNK_ELEM: + if (!nameExpression(n->pn_left, foundName)) + return false; + if (!*foundName) + return true; + if (!buf->append('[') || !nameExpression(n->pn_right, foundName)) + return false; + if (!*foundName) + return true; + return buf->append(']'); + + case PNK_NUMBER: + *foundName = true; + return appendNumber(n->pn_dval); + + default: + /* We're confused as to what to call this function. */ + *foundName = false; + return true; + } + } + + /* + * When naming an anonymous function, the process works loosely by walking + * up the AST and then translating that to a string. The stringification + * happens from some far-up assignment and then going back down the parse + * tree to the function definition point. + * + * This function will walk up the parse tree, gathering relevant nodes used + * for naming, and return the assignment node if there is one. The provided + * array and size will be filled in, and the returned node could be nullptr + * if no assignment is found. The first element of the array will be the + * innermost node relevant to naming, and the last element will be the + * outermost node. + */ + ParseNode* gatherNameable(ParseNode** nameable, size_t* size) { + *size = 0; + + for (int pos = nparents - 1; pos >= 0; pos--) { + ParseNode* cur = parents[pos]; + if (cur->isAssignment()) + return cur; + + switch (cur->getKind()) { + case PNK_NAME: return cur; /* found the initialized declaration */ + case PNK_THIS: return cur; /* Setting a property of 'this'. */ + case PNK_FUNCTION: return nullptr; /* won't find an assignment or declaration */ + + case PNK_RETURN: + /* + * Normally the relevant parent of a node is its direct parent, but + * sometimes with code like: + * + * var foo = (function() { return function() {}; })(); + * + * the outer function is just a helper to create a scope for the + * returned function. Hence the name of the returned function should + * actually be 'foo'. This loop sees if the current node is a + * PNK_RETURN, and if there is a direct function call we skip to + * that. + */ + for (int tmp = pos - 1; tmp > 0; tmp--) { + if (isDirectCall(tmp, cur)) { + pos = tmp; + break; + } else if (call(cur)) { + /* Don't skip too high in the tree */ + break; + } + cur = parents[tmp]; + } + break; + + case PNK_COLON: + case PNK_SHORTHAND: + /* + * Record the PNK_COLON/SHORTHAND but skip the PNK_OBJECT so we're not + * flagged as a contributor. + */ + pos--; + MOZ_FALLTHROUGH; + + default: + /* Save any other nodes we encounter on the way up. */ + MOZ_ASSERT(*size < MaxParents); + nameable[(*size)++] = cur; + break; + } + } + + return nullptr; + } + + /* + * Resolve the name of a function. If the function already has a name + * listed, then it is skipped. Otherwise an intelligent name is guessed to + * assign to the function's displayAtom field. + */ + bool resolveFun(ParseNode* pn, HandleAtom prefix, MutableHandleAtom retAtom) { + MOZ_ASSERT(pn != nullptr); + MOZ_ASSERT(pn->isKind(PNK_FUNCTION)); + MOZ_ASSERT(pn->isArity(PN_CODE)); + RootedFunction fun(cx, pn->pn_funbox->function()); + + StringBuffer buf(cx); + this->buf = &buf; + + retAtom.set(nullptr); + + /* If the function already has a name, use that */ + if (fun->displayAtom() != nullptr) { + if (prefix == nullptr) { + retAtom.set(fun->displayAtom()); + return true; + } + if (!buf.append(prefix) || + !buf.append('/') || + !buf.append(fun->displayAtom())) + return false; + retAtom.set(buf.finishAtom()); + return !!retAtom; + } + + /* If a prefix is specified, then it is a form of namespace */ + if (prefix != nullptr && (!buf.append(prefix) || !buf.append('/'))) + return false; + + /* Gather all nodes relevant to naming */ + ParseNode* toName[MaxParents]; + size_t size; + ParseNode* assignment = gatherNameable(toName, &size); + + /* If the function is assigned to something, then that is very relevant */ + if (assignment) { + if (assignment->isAssignment()) + assignment = assignment->pn_left; + bool foundName = false; + if (!nameExpression(assignment, &foundName)) + return false; + if (!foundName) + return true; + } + + /* + * Other than the actual assignment, other relevant nodes to naming are + * those in object initializers and then particular nodes marking a + * contribution. + */ + for (int pos = size - 1; pos >= 0; pos--) { + ParseNode* node = toName[pos]; + + if (node->isKind(PNK_COLON) || node->isKind(PNK_SHORTHAND)) { + ParseNode* left = node->pn_left; + if (left->isKind(PNK_OBJECT_PROPERTY_NAME) || left->isKind(PNK_STRING)) { + if (!appendPropertyReference(left->pn_atom)) + return false; + } else if (left->isKind(PNK_NUMBER)) { + if (!appendNumericPropertyReference(left->pn_dval)) + return false; + } else { + MOZ_ASSERT(left->isKind(PNK_COMPUTED_NAME)); + } + } else { + /* + * Don't have consecutive '<' characters, and also don't start + * with a '<' character. + */ + if (!buf.empty() && buf.getChar(buf.length() - 1) != '<' && !buf.append('<')) + return false; + } + } + + /* + * functions which are "genuinely anonymous" but are contained in some + * other namespace are rather considered as "contributing" to the outer + * function, so give them a contribution symbol here. + */ + if (!buf.empty() && buf.getChar(buf.length() - 1) == '/' && !buf.append('<')) + return false; + + if (buf.empty()) + return true; + + retAtom.set(buf.finishAtom()); + if (!retAtom) + return false; + fun->setGuessedAtom(retAtom); + return true; + } + + /* + * Tests whether parents[pos] is a function call whose callee is cur. + * This is the case for functions which do things like simply create a scope + * for new variables and then return an anonymous function using this scope. + */ + bool isDirectCall(int pos, ParseNode* cur) { + return pos >= 0 && call(parents[pos]) && parents[pos]->pn_head == cur; + } + + bool resolveTemplateLiteral(ParseNode* node, HandleAtom prefix) { + MOZ_ASSERT(node->isKind(PNK_TEMPLATE_STRING_LIST)); + ParseNode* element = node->pn_head; + while (true) { + MOZ_ASSERT(element->isKind(PNK_TEMPLATE_STRING)); + + element = element->pn_next; + if (!element) + return true; + + if (!resolve(element, prefix)) + return false; + + element = element->pn_next; + } + } + + bool resolveTaggedTemplate(ParseNode* node, HandleAtom prefix) { + MOZ_ASSERT(node->isKind(PNK_TAGGED_TEMPLATE)); + + ParseNode* element = node->pn_head; + + // The list head is a leading expression, e.g. |tag| in |tag`foo`|, + // that might contain functions. + if (!resolve(element, prefix)) + return false; + + // Next is the callsite object node. This node only contains + // internal strings and an array -- no user-controlled expressions. + element = element->pn_next; +#ifdef DEBUG + { + MOZ_ASSERT(element->isKind(PNK_CALLSITEOBJ)); + ParseNode* array = element->pn_head; + MOZ_ASSERT(array->isKind(PNK_ARRAY)); + for (ParseNode* kid = array->pn_head; kid; kid = kid->pn_next) + MOZ_ASSERT(kid->isKind(PNK_TEMPLATE_STRING)); + for (ParseNode* next = array->pn_next; next; next = next->pn_next) + MOZ_ASSERT(next->isKind(PNK_TEMPLATE_STRING)); + } +#endif + + // Next come any interpolated expressions in the tagged template. + ParseNode* interpolated = element->pn_next; + for (; interpolated; interpolated = interpolated->pn_next) { + if (!resolve(interpolated, prefix)) + return false; + } + + return true; + } + + public: + explicit NameResolver(ExclusiveContext* cx) : cx(cx), nparents(0), buf(nullptr) {} + + /* + * Resolve all names for anonymous functions recursively within the + * ParseNode instance given. The prefix is for each subsequent name, and + * should initially be nullptr. + */ + bool resolve(ParseNode* cur, HandleAtom prefixArg = nullptr) { + RootedAtom prefix(cx, prefixArg); + if (cur == nullptr) + return true; + + MOZ_ASSERT((cur->isKind(PNK_FUNCTION) || cur->isKind(PNK_MODULE)) == cur->isArity(PN_CODE)); + if (cur->isKind(PNK_FUNCTION)) { + RootedAtom prefix2(cx); + if (!resolveFun(cur, prefix, &prefix2)) + return false; + + /* + * If a function looks like (function(){})() where the parent node + * of the definition of the function is a call, then it shouldn't + * contribute anything to the namespace, so don't bother updating + * the prefix to whatever was returned. + */ + if (!isDirectCall(nparents - 1, cur)) + prefix = prefix2; + } + if (nparents >= MaxParents) + return true; + parents[nparents++] = cur; + + switch (cur->getKind()) { + // Nodes with no children that might require name resolution need no + // further work. + case PNK_NOP: + case PNK_STRING: + case PNK_TEMPLATE_STRING: + case PNK_REGEXP: + case PNK_TRUE: + case PNK_FALSE: + case PNK_NULL: + case PNK_ELISION: + case PNK_GENERATOR: + case PNK_NUMBER: + case PNK_BREAK: + case PNK_CONTINUE: + case PNK_DEBUGGER: + case PNK_EXPORT_BATCH_SPEC: + case PNK_OBJECT_PROPERTY_NAME: + case PNK_POSHOLDER: + MOZ_ASSERT(cur->isArity(PN_NULLARY)); + break; + + case PNK_TYPEOFNAME: + case PNK_SUPERBASE: + MOZ_ASSERT(cur->isArity(PN_UNARY)); + MOZ_ASSERT(cur->pn_kid->isKind(PNK_NAME)); + MOZ_ASSERT(!cur->pn_kid->expr()); + break; + + case PNK_NEWTARGET: + MOZ_ASSERT(cur->isArity(PN_BINARY)); + MOZ_ASSERT(cur->pn_left->isKind(PNK_POSHOLDER)); + MOZ_ASSERT(cur->pn_right->isKind(PNK_POSHOLDER)); + break; + + // Nodes with a single non-null child requiring name resolution. + case PNK_TYPEOFEXPR: + case PNK_VOID: + case PNK_NOT: + case PNK_BITNOT: + case PNK_THROW: + case PNK_DELETENAME: + case PNK_DELETEPROP: + case PNK_DELETEELEM: + case PNK_DELETEEXPR: + case PNK_NEG: + case PNK_POS: + case PNK_PREINCREMENT: + case PNK_POSTINCREMENT: + case PNK_PREDECREMENT: + case PNK_POSTDECREMENT: + case PNK_COMPUTED_NAME: + case PNK_ARRAYPUSH: + case PNK_SPREAD: + case PNK_MUTATEPROTO: + case PNK_EXPORT: + MOZ_ASSERT(cur->isArity(PN_UNARY)); + if (!resolve(cur->pn_kid, prefix)) + return false; + break; + + // Nodes with a single nullable child. + case PNK_SEMI: + case PNK_THIS: + MOZ_ASSERT(cur->isArity(PN_UNARY)); + if (ParseNode* expr = cur->pn_kid) { + if (!resolve(expr, prefix)) + return false; + } + break; + + // Binary nodes with two non-null children. + case PNK_ASSIGN: + case PNK_ADDASSIGN: + case PNK_SUBASSIGN: + case PNK_BITORASSIGN: + case PNK_BITXORASSIGN: + case PNK_BITANDASSIGN: + case PNK_LSHASSIGN: + case PNK_RSHASSIGN: + case PNK_URSHASSIGN: + case PNK_MULASSIGN: + case PNK_DIVASSIGN: + case PNK_MODASSIGN: + case PNK_POWASSIGN: + case PNK_COLON: + case PNK_SHORTHAND: + case PNK_DOWHILE: + case PNK_WHILE: + case PNK_SWITCH: + case PNK_FOR: + case PNK_COMPREHENSIONFOR: + case PNK_CLASSMETHOD: + case PNK_SETTHIS: + MOZ_ASSERT(cur->isArity(PN_BINARY)); + if (!resolve(cur->pn_left, prefix)) + return false; + if (!resolve(cur->pn_right, prefix)) + return false; + break; + + case PNK_ELEM: + MOZ_ASSERT(cur->isArity(PN_BINARY)); + if (!cur->as<PropertyByValue>().isSuper() && !resolve(cur->pn_left, prefix)) + return false; + if (!resolve(cur->pn_right, prefix)) + return false; + break; + + case PNK_WITH: + MOZ_ASSERT(cur->isArity(PN_BINARY)); + if (!resolve(cur->pn_left, prefix)) + return false; + if (!resolve(cur->pn_right, prefix)) + return false; + break; + + case PNK_CASE: + MOZ_ASSERT(cur->isArity(PN_BINARY)); + if (ParseNode* caseExpr = cur->pn_left) { + if (!resolve(caseExpr, prefix)) + return false; + } + if (!resolve(cur->pn_right, prefix)) + return false; + break; + + case PNK_YIELD_STAR: + MOZ_ASSERT(cur->isArity(PN_BINARY)); + MOZ_ASSERT(cur->pn_right->isKind(PNK_NAME)); + if (!resolve(cur->pn_left, prefix)) + return false; + break; + + case PNK_YIELD: + case PNK_AWAIT: + MOZ_ASSERT(cur->isArity(PN_BINARY)); + if (cur->pn_left) { + if (!resolve(cur->pn_left, prefix)) + return false; + } + MOZ_ASSERT(cur->pn_right->isKind(PNK_NAME) || + (cur->pn_right->isKind(PNK_ASSIGN) && + cur->pn_right->pn_left->isKind(PNK_NAME) && + cur->pn_right->pn_right->isKind(PNK_GENERATOR))); + break; + + case PNK_RETURN: + MOZ_ASSERT(cur->isArity(PN_UNARY)); + if (ParseNode* returnValue = cur->pn_kid) { + if (!resolve(returnValue, prefix)) + return false; + } + break; + + case PNK_IMPORT: + case PNK_EXPORT_FROM: + case PNK_EXPORT_DEFAULT: + MOZ_ASSERT(cur->isArity(PN_BINARY)); + // The left halves of these nodes don't contain any unconstrained + // expressions, but it's very hard to assert this to safely rely on + // it. So recur anyway. + if (!resolve(cur->pn_left, prefix)) + return false; + MOZ_ASSERT_IF(!cur->isKind(PNK_EXPORT_DEFAULT), + cur->pn_right->isKind(PNK_STRING)); + break; + + // Ternary nodes with three expression children. + case PNK_CONDITIONAL: + MOZ_ASSERT(cur->isArity(PN_TERNARY)); + if (!resolve(cur->pn_kid1, prefix)) + return false; + if (!resolve(cur->pn_kid2, prefix)) + return false; + if (!resolve(cur->pn_kid3, prefix)) + return false; + break; + + // The first part of a for-in/of is the declaration in the loop (or + // null if no declaration). The latter two parts are the location + // assigned each loop and the value being looped over; obviously, + // either might contain functions to name. Declarations may (through + // computed property names, and possibly through [deprecated!] + // initializers) also contain functions to name. + case PNK_FORIN: + case PNK_FOROF: + MOZ_ASSERT(cur->isArity(PN_TERNARY)); + if (ParseNode* decl = cur->pn_kid1) { + if (!resolve(decl, prefix)) + return false; + } + if (!resolve(cur->pn_kid2, prefix)) + return false; + if (!resolve(cur->pn_kid3, prefix)) + return false; + break; + + // Every part of a for(;;) head may contain a function needing name + // resolution. + case PNK_FORHEAD: + MOZ_ASSERT(cur->isArity(PN_TERNARY)); + if (ParseNode* init = cur->pn_kid1) { + if (!resolve(init, prefix)) + return false; + } + if (ParseNode* cond = cur->pn_kid2) { + if (!resolve(cond, prefix)) + return false; + } + if (ParseNode* step = cur->pn_kid3) { + if (!resolve(step, prefix)) + return false; + } + break; + + // The first child of a class is a pair of names referring to it, + // inside and outside the class. The second is the class's heritage, + // if any. The third is the class body. + case PNK_CLASS: + MOZ_ASSERT(cur->isArity(PN_TERNARY)); + MOZ_ASSERT_IF(cur->pn_kid1, cur->pn_kid1->isKind(PNK_CLASSNAMES)); + MOZ_ASSERT_IF(cur->pn_kid1, cur->pn_kid1->isArity(PN_BINARY)); + MOZ_ASSERT_IF(cur->pn_kid1 && cur->pn_kid1->pn_left, + cur->pn_kid1->pn_left->isKind(PNK_NAME)); + MOZ_ASSERT_IF(cur->pn_kid1 && cur->pn_kid1->pn_left, + !cur->pn_kid1->pn_left->expr()); + MOZ_ASSERT_IF(cur->pn_kid1, cur->pn_kid1->pn_right->isKind(PNK_NAME)); + MOZ_ASSERT_IF(cur->pn_kid1, !cur->pn_kid1->pn_right->expr()); + if (cur->pn_kid2) { + if (!resolve(cur->pn_kid2, prefix)) + return false; + } + if (!resolve(cur->pn_kid3, prefix)) + return false; + break; + + // The condition and consequent are non-optional, but the alternative + // might be omitted. + case PNK_IF: + MOZ_ASSERT(cur->isArity(PN_TERNARY)); + if (!resolve(cur->pn_kid1, prefix)) + return false; + if (!resolve(cur->pn_kid2, prefix)) + return false; + if (cur->pn_kid3) { + if (!resolve(cur->pn_kid3, prefix)) + return false; + } + break; + + // The statements in the try-block are mandatory. The catch-blocks + // and finally block are optional (but at least one or the other must + // be present). + case PNK_TRY: + MOZ_ASSERT(cur->isArity(PN_TERNARY)); + if (!resolve(cur->pn_kid1, prefix)) + return false; + MOZ_ASSERT(cur->pn_kid2 || cur->pn_kid3); + if (ParseNode* catchList = cur->pn_kid2) { + MOZ_ASSERT(catchList->isKind(PNK_CATCHLIST)); + if (!resolve(catchList, prefix)) + return false; + } + if (ParseNode* finallyBlock = cur->pn_kid3) { + if (!resolve(finallyBlock, prefix)) + return false; + } + break; + + // The first child, the catch-pattern, may contain functions via + // computed property names. The optional catch-conditions may + // contain any expression. The catch statements, of course, may + // contain arbitrary expressions. + case PNK_CATCH: + MOZ_ASSERT(cur->isArity(PN_TERNARY)); + if (!resolve(cur->pn_kid1, prefix)) + return false; + if (cur->pn_kid2) { + if (!resolve(cur->pn_kid2, prefix)) + return false; + } + if (!resolve(cur->pn_kid3, prefix)) + return false; + break; + + // Nodes with arbitrary-expression children. + case PNK_OR: + case PNK_AND: + case PNK_BITOR: + case PNK_BITXOR: + case PNK_BITAND: + case PNK_STRICTEQ: + case PNK_EQ: + case PNK_STRICTNE: + case PNK_NE: + case PNK_LT: + case PNK_LE: + case PNK_GT: + case PNK_GE: + case PNK_INSTANCEOF: + case PNK_IN: + case PNK_LSH: + case PNK_RSH: + case PNK_URSH: + case PNK_ADD: + case PNK_SUB: + case PNK_STAR: + case PNK_DIV: + case PNK_MOD: + case PNK_POW: + case PNK_COMMA: + case PNK_NEW: + case PNK_CALL: + case PNK_SUPERCALL: + case PNK_GENEXP: + case PNK_ARRAY: + case PNK_STATEMENTLIST: + case PNK_PARAMSBODY: + // Initializers for individual variables, and computed property names + // within destructuring patterns, may contain unnamed functions. + case PNK_VAR: + case PNK_CONST: + case PNK_LET: + MOZ_ASSERT(cur->isArity(PN_LIST)); + for (ParseNode* element = cur->pn_head; element; element = element->pn_next) { + if (!resolve(element, prefix)) + return false; + } + break; + + // Array comprehension nodes are lists with a single child: + // PNK_COMPREHENSIONFOR for comprehensions, PNK_LEXICALSCOPE for + // legacy comprehensions. Probably this should be a non-list + // eventually. + case PNK_ARRAYCOMP: + MOZ_ASSERT(cur->isArity(PN_LIST)); + MOZ_ASSERT(cur->pn_count == 1); + MOZ_ASSERT(cur->pn_head->isKind(PNK_LEXICALSCOPE) || + cur->pn_head->isKind(PNK_COMPREHENSIONFOR)); + if (!resolve(cur->pn_head, prefix)) + return false; + break; + + case PNK_OBJECT: + case PNK_CLASSMETHODLIST: + MOZ_ASSERT(cur->isArity(PN_LIST)); + for (ParseNode* element = cur->pn_head; element; element = element->pn_next) { + if (!resolve(element, prefix)) + return false; + } + break; + + // A template string list's contents alternate raw template string + // contents with expressions interpolated into the overall literal. + case PNK_TEMPLATE_STRING_LIST: + MOZ_ASSERT(cur->isArity(PN_LIST)); + if (!resolveTemplateLiteral(cur, prefix)) + return false; + break; + + case PNK_TAGGED_TEMPLATE: + MOZ_ASSERT(cur->isArity(PN_LIST)); + if (!resolveTaggedTemplate(cur, prefix)) + return false; + break; + + // Import/export spec lists contain import/export specs containing + // only pairs of names. Alternatively, an export spec lists may + // contain a single export batch specifier. + case PNK_EXPORT_SPEC_LIST: + case PNK_IMPORT_SPEC_LIST: { + MOZ_ASSERT(cur->isArity(PN_LIST)); +#ifdef DEBUG + bool isImport = cur->isKind(PNK_IMPORT_SPEC_LIST); + ParseNode* item = cur->pn_head; + if (!isImport && item && item->isKind(PNK_EXPORT_BATCH_SPEC)) { + MOZ_ASSERT(item->isArity(PN_NULLARY)); + break; + } + for (; item; item = item->pn_next) { + MOZ_ASSERT(item->isKind(isImport ? PNK_IMPORT_SPEC : PNK_EXPORT_SPEC)); + MOZ_ASSERT(item->isArity(PN_BINARY)); + MOZ_ASSERT(item->pn_left->isKind(PNK_NAME)); + MOZ_ASSERT(!item->pn_left->expr()); + MOZ_ASSERT(item->pn_right->isKind(PNK_NAME)); + MOZ_ASSERT(!item->pn_right->expr()); + } +#endif + break; + } + + case PNK_CATCHLIST: { + MOZ_ASSERT(cur->isArity(PN_LIST)); + for (ParseNode* catchNode = cur->pn_head; catchNode; catchNode = catchNode->pn_next) { + MOZ_ASSERT(catchNode->isKind(PNK_LEXICALSCOPE)); + MOZ_ASSERT(catchNode->scopeBody()->isKind(PNK_CATCH)); + MOZ_ASSERT(catchNode->scopeBody()->isArity(PN_TERNARY)); + if (!resolve(catchNode->scopeBody(), prefix)) + return false; + } + break; + } + + case PNK_DOT: + MOZ_ASSERT(cur->isArity(PN_NAME)); + + // Super prop nodes do not have a meaningful LHS + if (cur->as<PropertyAccess>().isSuper()) + break; + if (!resolve(cur->expr(), prefix)) + return false; + break; + + case PNK_LABEL: + MOZ_ASSERT(cur->isArity(PN_NAME)); + if (!resolve(cur->expr(), prefix)) + return false; + break; + + case PNK_NAME: + MOZ_ASSERT(cur->isArity(PN_NAME)); + if (!resolve(cur->expr(), prefix)) + return false; + break; + + case PNK_LEXICALSCOPE: + MOZ_ASSERT(cur->isArity(PN_SCOPE)); + if (!resolve(cur->scopeBody(), prefix)) + return false; + break; + + case PNK_FUNCTION: + case PNK_MODULE: + MOZ_ASSERT(cur->isArity(PN_CODE)); + if (!resolve(cur->pn_body, prefix)) + return false; + break; + + // Kinds that should be handled by parent node resolution. + + case PNK_IMPORT_SPEC: // by PNK_IMPORT_SPEC_LIST + case PNK_EXPORT_SPEC: // by PNK_EXPORT_SPEC_LIST + case PNK_CALLSITEOBJ: // by PNK_TAGGED_TEMPLATE + case PNK_CLASSNAMES: // by PNK_CLASS + MOZ_CRASH("should have been handled by a parent node"); + + case PNK_LIMIT: // invalid sentinel value + MOZ_CRASH("invalid node kind"); + } + + nparents--; + return true; + } +}; + +} /* anonymous namespace */ + +bool +frontend::NameFunctions(ExclusiveContext* cx, ParseNode* pn) +{ + NameResolver nr(cx); + return nr.resolve(pn); +} diff --git a/js/src/frontend/NameFunctions.h b/js/src/frontend/NameFunctions.h new file mode 100644 index 000000000..a04e7040e --- /dev/null +++ b/js/src/frontend/NameFunctions.h @@ -0,0 +1,28 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- + * vim: set ts=8 sts=4 et sw=4 tw=99: + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#ifndef frontend_NameFunctions_h +#define frontend_NameFunctions_h + +#include "mozilla/Attributes.h" + +#include "js/TypeDecls.h" + +namespace js { + +class ExclusiveContext; + +namespace frontend { + +class ParseNode; + +MOZ_MUST_USE bool +NameFunctions(ExclusiveContext* cx, ParseNode* pn); + +} /* namespace frontend */ +} /* namespace js */ + +#endif /* frontend_NameFunctions_h */ diff --git a/js/src/frontend/ParseNode-inl.h b/js/src/frontend/ParseNode-inl.h new file mode 100644 index 000000000..395d09b5b --- /dev/null +++ b/js/src/frontend/ParseNode-inl.h @@ -0,0 +1,35 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- + * vim: set ts=8 sts=4 et sw=4 tw=99: + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#ifndef frontend_ParseNode_inl_h +#define frontend_ParseNode_inl_h + +#include "frontend/ParseNode.h" + +#include "frontend/SharedContext.h" + +namespace js { +namespace frontend { + +inline PropertyName* +ParseNode::name() const +{ + MOZ_ASSERT(isKind(PNK_FUNCTION) || isKind(PNK_NAME)); + JSAtom* atom = isKind(PNK_FUNCTION) ? pn_funbox->function()->name() : pn_atom; + return atom->asPropertyName(); +} + +inline JSAtom* +ParseNode::atom() const +{ + MOZ_ASSERT(isKind(PNK_STRING)); + return pn_atom; +} + +} /* namespace frontend */ +} /* namespace js */ + +#endif /* frontend_ParseNode_inl_h */ diff --git a/js/src/frontend/ParseNode.cpp b/js/src/frontend/ParseNode.cpp new file mode 100644 index 000000000..f79baba9e --- /dev/null +++ b/js/src/frontend/ParseNode.cpp @@ -0,0 +1,904 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- + * vim: set ts=8 sts=4 et sw=4 tw=99: + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#include "frontend/ParseNode-inl.h" + +#include "frontend/Parser.h" + +#include "jscntxtinlines.h" + +using namespace js; +using namespace js::frontend; + +using mozilla::ArrayLength; +using mozilla::IsFinite; + +#ifdef DEBUG +void +ParseNode::checkListConsistency() +{ + MOZ_ASSERT(isArity(PN_LIST)); + ParseNode** tail; + uint32_t count = 0; + if (pn_head) { + ParseNode* last = pn_head; + ParseNode* pn = last; + while (pn) { + last = pn; + pn = pn->pn_next; + count++; + } + + tail = &last->pn_next; + } else { + tail = &pn_head; + } + MOZ_ASSERT(pn_tail == tail); + MOZ_ASSERT(pn_count == count); +} +#endif + +/* Add |node| to |parser|'s free node list. */ +void +ParseNodeAllocator::freeNode(ParseNode* pn) +{ + /* Catch back-to-back dup recycles. */ + MOZ_ASSERT(pn != freelist); + +#ifdef DEBUG + /* Poison the node, to catch attempts to use it without initializing it. */ + memset(pn, 0xab, sizeof(*pn)); +#endif + + pn->pn_next = freelist; + freelist = pn; +} + +namespace { + +/* + * A work pool of ParseNodes. The work pool is a stack, chained together + * by nodes' pn_next fields. We use this to avoid creating deep C++ stacks + * when recycling deep parse trees. + * + * Since parse nodes are probably allocated in something close to the order + * they appear in a depth-first traversal of the tree, making the work pool + * a stack should give us pretty good locality. + */ +class NodeStack { + public: + NodeStack() : top(nullptr) { } + bool empty() { return top == nullptr; } + void push(ParseNode* pn) { + pn->pn_next = top; + top = pn; + } + /* Push the children of the PN_LIST node |pn| on the stack. */ + void pushList(ParseNode* pn) { + /* This clobbers pn->pn_head if the list is empty; should be okay. */ + *pn->pn_tail = top; + top = pn->pn_head; + } + ParseNode* pop() { + MOZ_ASSERT(!empty()); + ParseNode* hold = top; /* my kingdom for a prog1 */ + top = top->pn_next; + return hold; + } + private: + ParseNode* top; +}; + +} /* anonymous namespace */ + +enum class PushResult { Recyclable, CleanUpLater }; + +static PushResult +PushCodeNodeChildren(ParseNode* node, NodeStack* stack) +{ + MOZ_ASSERT(node->isArity(PN_CODE)); + + /* + * Function nodes are linked into the function box tree, and may appear + * on method lists. Both of those lists are singly-linked, so trying to + * update them now could result in quadratic behavior when recycling + * trees containing many functions; and the lists can be very long. So + * we put off cleaning the lists up until just before function + * analysis, when we call CleanFunctionList. + * + * In fact, we can't recycle the parse node yet, either: it may appear + * on a method list, and reusing the node would corrupt that. Instead, + * we clear its pn_funbox pointer to mark it as deleted; + * CleanFunctionList recycles it as well. + * + * We do recycle the nodes around it, though, so we must clear pointers + * to them to avoid leaving dangling references where someone can find + * them. + */ + node->pn_funbox = nullptr; + if (node->pn_body) + stack->push(node->pn_body); + node->pn_body = nullptr; + + return PushResult::CleanUpLater; +} + +static PushResult +PushNameNodeChildren(ParseNode* node, NodeStack* stack) +{ + MOZ_ASSERT(node->isArity(PN_NAME)); + + if (node->pn_expr) + stack->push(node->pn_expr); + node->pn_expr = nullptr; + return PushResult::Recyclable; +} + +static PushResult +PushScopeNodeChildren(ParseNode* node, NodeStack* stack) +{ + MOZ_ASSERT(node->isArity(PN_SCOPE)); + + if (node->scopeBody()) + stack->push(node->scopeBody()); + node->setScopeBody(nullptr); + return PushResult::Recyclable; +} + +static PushResult +PushListNodeChildren(ParseNode* node, NodeStack* stack) +{ + MOZ_ASSERT(node->isArity(PN_LIST)); + node->checkListConsistency(); + + stack->pushList(node); + + return PushResult::Recyclable; +} + +static PushResult +PushUnaryNodeChild(ParseNode* node, NodeStack* stack) +{ + MOZ_ASSERT(node->isArity(PN_UNARY)); + + stack->push(node->pn_kid); + + return PushResult::Recyclable; +} + +/* + * Push the children of |pn| on |stack|. Return true if |pn| itself could be + * safely recycled, or false if it must be cleaned later (pn_used and pn_defn + * nodes, and all function nodes; see comments for CleanFunctionList in + * SemanticAnalysis.cpp). Some callers want to free |pn|; others + * (js::ParseNodeAllocator::prepareNodeForMutation) don't care about |pn|, and + * just need to take care of its children. + */ +static PushResult +PushNodeChildren(ParseNode* pn, NodeStack* stack) +{ + switch (pn->getKind()) { + // Trivial nodes that refer to no nodes, are referred to by nothing + // but their parents, are never used, and are never a definition. + case PNK_NOP: + case PNK_STRING: + case PNK_TEMPLATE_STRING: + case PNK_REGEXP: + case PNK_TRUE: + case PNK_FALSE: + case PNK_NULL: + case PNK_ELISION: + case PNK_GENERATOR: + case PNK_NUMBER: + case PNK_BREAK: + case PNK_CONTINUE: + case PNK_DEBUGGER: + case PNK_EXPORT_BATCH_SPEC: + case PNK_OBJECT_PROPERTY_NAME: + case PNK_POSHOLDER: + MOZ_ASSERT(pn->isArity(PN_NULLARY)); + return PushResult::Recyclable; + + // Nodes with a single non-null child. + case PNK_TYPEOFNAME: + case PNK_TYPEOFEXPR: + case PNK_VOID: + case PNK_NOT: + case PNK_BITNOT: + case PNK_THROW: + case PNK_DELETENAME: + case PNK_DELETEPROP: + case PNK_DELETEELEM: + case PNK_DELETEEXPR: + case PNK_POS: + case PNK_NEG: + case PNK_PREINCREMENT: + case PNK_POSTINCREMENT: + case PNK_PREDECREMENT: + case PNK_POSTDECREMENT: + case PNK_COMPUTED_NAME: + case PNK_ARRAYPUSH: + case PNK_SPREAD: + case PNK_MUTATEPROTO: + case PNK_EXPORT: + case PNK_SUPERBASE: + return PushUnaryNodeChild(pn, stack); + + // Nodes with a single nullable child. + case PNK_THIS: + case PNK_SEMI: { + MOZ_ASSERT(pn->isArity(PN_UNARY)); + if (pn->pn_kid) + stack->push(pn->pn_kid); + return PushResult::Recyclable; + } + + // Binary nodes with two non-null children. + + // All assignment and compound assignment nodes qualify. + case PNK_ASSIGN: + case PNK_ADDASSIGN: + case PNK_SUBASSIGN: + case PNK_BITORASSIGN: + case PNK_BITXORASSIGN: + case PNK_BITANDASSIGN: + case PNK_LSHASSIGN: + case PNK_RSHASSIGN: + case PNK_URSHASSIGN: + case PNK_MULASSIGN: + case PNK_DIVASSIGN: + case PNK_MODASSIGN: + case PNK_POWASSIGN: + // ...and a few others. + case PNK_ELEM: + case PNK_IMPORT_SPEC: + case PNK_EXPORT_SPEC: + case PNK_COLON: + case PNK_SHORTHAND: + case PNK_DOWHILE: + case PNK_WHILE: + case PNK_SWITCH: + case PNK_CLASSMETHOD: + case PNK_NEWTARGET: + case PNK_SETTHIS: + case PNK_FOR: + case PNK_COMPREHENSIONFOR: + case PNK_WITH: { + MOZ_ASSERT(pn->isArity(PN_BINARY)); + stack->push(pn->pn_left); + stack->push(pn->pn_right); + return PushResult::Recyclable; + } + + // Default clauses are PNK_CASE but do not have case expressions. + // Named class expressions do not have outer binding nodes. + // So both are binary nodes with a possibly-null pn_left. + case PNK_CASE: + case PNK_CLASSNAMES: { + MOZ_ASSERT(pn->isArity(PN_BINARY)); + if (pn->pn_left) + stack->push(pn->pn_left); + stack->push(pn->pn_right); + return PushResult::Recyclable; + } + + // The left half is the expression being yielded. The right half is + // internal goop: a name reference to the invisible '.generator' local + // variable, or an assignment of a PNK_GENERATOR node to the '.generator' + // local, for a synthesized, prepended initial yield. Yum! + case PNK_YIELD_STAR: + case PNK_YIELD: + case PNK_AWAIT: { + MOZ_ASSERT(pn->isArity(PN_BINARY)); + MOZ_ASSERT(pn->pn_right); + MOZ_ASSERT(pn->pn_right->isKind(PNK_NAME) || + (pn->pn_right->isKind(PNK_ASSIGN) && + pn->pn_right->pn_left->isKind(PNK_NAME) && + pn->pn_right->pn_right->isKind(PNK_GENERATOR))); + if (pn->pn_left) + stack->push(pn->pn_left); + stack->push(pn->pn_right); + return PushResult::Recyclable; + } + + // A return node's child is what you'd expect: the return expression, + // if any. + case PNK_RETURN: { + MOZ_ASSERT(pn->isArity(PN_UNARY)); + if (pn->pn_kid) + stack->push(pn->pn_kid); + return PushResult::Recyclable; + } + + // Import and export-from nodes have a list of specifiers on the left + // and a module string on the right. + case PNK_IMPORT: + case PNK_EXPORT_FROM: { + MOZ_ASSERT(pn->isArity(PN_BINARY)); + MOZ_ASSERT_IF(pn->isKind(PNK_IMPORT), pn->pn_left->isKind(PNK_IMPORT_SPEC_LIST)); + MOZ_ASSERT_IF(pn->isKind(PNK_EXPORT_FROM), pn->pn_left->isKind(PNK_EXPORT_SPEC_LIST)); + MOZ_ASSERT(pn->pn_left->isArity(PN_LIST)); + MOZ_ASSERT(pn->pn_right->isKind(PNK_STRING)); + stack->pushList(pn->pn_left); + stack->push(pn->pn_right); + return PushResult::Recyclable; + } + + case PNK_EXPORT_DEFAULT: { + MOZ_ASSERT(pn->isArity(PN_BINARY)); + MOZ_ASSERT_IF(pn->pn_right, pn->pn_right->isKind(PNK_NAME)); + stack->push(pn->pn_left); + if (pn->pn_right) + stack->push(pn->pn_right); + return PushResult::Recyclable; + } + + // Ternary nodes with all children non-null. + case PNK_CONDITIONAL: { + MOZ_ASSERT(pn->isArity(PN_TERNARY)); + stack->push(pn->pn_kid1); + stack->push(pn->pn_kid2); + stack->push(pn->pn_kid3); + return PushResult::Recyclable; + } + + // For for-in and for-of, the first child is the left-hand side of the + // 'in' or 'of' (a declaration or an assignment target). The second + // child is always null, and the third child is the expression looped + // over. For example, in |for (var p in obj)|, the first child is |var + // p|, the second child is null, and the third child is |obj|. + case PNK_FORIN: + case PNK_FOROF: { + MOZ_ASSERT(pn->isArity(PN_TERNARY)); + MOZ_ASSERT(!pn->pn_kid2); + stack->push(pn->pn_kid1); + stack->push(pn->pn_kid3); + return PushResult::Recyclable; + } + + // for (;;) nodes have one child per optional component of the loop head. + case PNK_FORHEAD: { + MOZ_ASSERT(pn->isArity(PN_TERNARY)); + if (pn->pn_kid1) + stack->push(pn->pn_kid1); + if (pn->pn_kid2) + stack->push(pn->pn_kid2); + if (pn->pn_kid3) + stack->push(pn->pn_kid3); + return PushResult::Recyclable; + } + + // classes might have an optional node for the heritage, as well as the names + case PNK_CLASS: { + MOZ_ASSERT(pn->isArity(PN_TERNARY)); + if (pn->pn_kid1) + stack->push(pn->pn_kid1); + if (pn->pn_kid2) + stack->push(pn->pn_kid2); + stack->push(pn->pn_kid3); + return PushResult::Recyclable; + } + + // if-statement nodes have condition and consequent children and a + // possibly-null alternative. + case PNK_IF: { + MOZ_ASSERT(pn->isArity(PN_TERNARY)); + stack->push(pn->pn_kid1); + stack->push(pn->pn_kid2); + if (pn->pn_kid3) + stack->push(pn->pn_kid3); + return PushResult::Recyclable; + } + + // try-statements have statements to execute, and one or both of a + // catch-list and a finally-block. + case PNK_TRY: { + MOZ_ASSERT(pn->isArity(PN_TERNARY)); + MOZ_ASSERT(pn->pn_kid2 || pn->pn_kid3); + stack->push(pn->pn_kid1); + if (pn->pn_kid2) + stack->push(pn->pn_kid2); + if (pn->pn_kid3) + stack->push(pn->pn_kid3); + return PushResult::Recyclable; + } + + // A catch node has first kid as catch-variable pattern, the second kid + // as catch condition (which, if non-null, records the |<cond>| in + // SpiderMonkey's |catch (e if <cond>)| extension), and third kid as the + // statements in the catch block. + case PNK_CATCH: { + MOZ_ASSERT(pn->isArity(PN_TERNARY)); + stack->push(pn->pn_kid1); + if (pn->pn_kid2) + stack->push(pn->pn_kid2); + stack->push(pn->pn_kid3); + return PushResult::Recyclable; + } + + // List nodes with all non-null children. + case PNK_OR: + case PNK_AND: + case PNK_BITOR: + case PNK_BITXOR: + case PNK_BITAND: + case PNK_STRICTEQ: + case PNK_EQ: + case PNK_STRICTNE: + case PNK_NE: + case PNK_LT: + case PNK_LE: + case PNK_GT: + case PNK_GE: + case PNK_INSTANCEOF: + case PNK_IN: + case PNK_LSH: + case PNK_RSH: + case PNK_URSH: + case PNK_ADD: + case PNK_SUB: + case PNK_STAR: + case PNK_DIV: + case PNK_MOD: + case PNK_POW: + case PNK_COMMA: + case PNK_NEW: + case PNK_CALL: + case PNK_SUPERCALL: + case PNK_GENEXP: + case PNK_ARRAY: + case PNK_OBJECT: + case PNK_TEMPLATE_STRING_LIST: + case PNK_TAGGED_TEMPLATE: + case PNK_CALLSITEOBJ: + case PNK_VAR: + case PNK_CONST: + case PNK_LET: + case PNK_CATCHLIST: + case PNK_STATEMENTLIST: + case PNK_IMPORT_SPEC_LIST: + case PNK_EXPORT_SPEC_LIST: + case PNK_PARAMSBODY: + case PNK_CLASSMETHODLIST: + return PushListNodeChildren(pn, stack); + + // Array comprehension nodes are lists with a single child: + // PNK_COMPREHENSIONFOR for comprehensions, PNK_LEXICALSCOPE for legacy + // comprehensions. Probably this should be a non-list eventually. + case PNK_ARRAYCOMP: { +#ifdef DEBUG + MOZ_ASSERT(pn->isKind(PNK_ARRAYCOMP)); + MOZ_ASSERT(pn->isArity(PN_LIST)); + MOZ_ASSERT(pn->pn_count == 1); + MOZ_ASSERT(pn->pn_head->isKind(PNK_LEXICALSCOPE) || + pn->pn_head->isKind(PNK_COMPREHENSIONFOR)); +#endif + return PushListNodeChildren(pn, stack); + } + + case PNK_LABEL: + case PNK_DOT: + case PNK_NAME: + return PushNameNodeChildren(pn, stack); + + case PNK_LEXICALSCOPE: + return PushScopeNodeChildren(pn, stack); + + case PNK_FUNCTION: + case PNK_MODULE: + return PushCodeNodeChildren(pn, stack); + + case PNK_LIMIT: // invalid sentinel value + MOZ_CRASH("invalid node kind"); + } + + MOZ_CRASH("bad ParseNodeKind"); + return PushResult::CleanUpLater; +} + +/* + * Prepare |pn| to be mutated in place into a new kind of node. Recycle all + * |pn|'s recyclable children (but not |pn| itself!), and disconnect it from + * metadata structures (the function box tree). + */ +void +ParseNodeAllocator::prepareNodeForMutation(ParseNode* pn) +{ + // Nothing to do for nullary nodes. + if (pn->isArity(PN_NULLARY)) + return; + + // Put |pn|'s children (but not |pn| itself) on a work stack. + NodeStack stack; + PushNodeChildren(pn, &stack); + + // For each node on the work stack, push its children on the work stack, + // and free the node if we can. + while (!stack.empty()) { + pn = stack.pop(); + if (PushNodeChildren(pn, &stack) == PushResult::Recyclable) + freeNode(pn); + } +} + +/* + * Return the nodes in the subtree |pn| to the parser's free node list, for + * reallocation. + */ +ParseNode* +ParseNodeAllocator::freeTree(ParseNode* pn) +{ + if (!pn) + return nullptr; + + ParseNode* savedNext = pn->pn_next; + + NodeStack stack; + for (;;) { + if (PushNodeChildren(pn, &stack) == PushResult::Recyclable) + freeNode(pn); + if (stack.empty()) + break; + pn = stack.pop(); + } + + return savedNext; +} + +/* + * Allocate a ParseNode from parser's node freelist or, failing that, from + * cx's temporary arena. + */ +void* +ParseNodeAllocator::allocNode() +{ + if (ParseNode* pn = freelist) { + freelist = pn->pn_next; + return pn; + } + + LifoAlloc::AutoFallibleScope fallibleAllocator(&alloc); + void* p = alloc.alloc(sizeof (ParseNode)); + if (!p) + ReportOutOfMemory(cx); + return p; +} + +ParseNode* +ParseNode::appendOrCreateList(ParseNodeKind kind, JSOp op, ParseNode* left, ParseNode* right, + FullParseHandler* handler, ParseContext* pc) +{ + // The asm.js specification is written in ECMAScript grammar terms that + // specify *only* a binary tree. It's a royal pain to implement the asm.js + // spec to act upon n-ary lists as created below. So for asm.js, form a + // binary tree of lists exactly as ECMAScript would by skipping the + // following optimization. + if (!pc->useAsmOrInsideUseAsm()) { + // Left-associative trees of a given operator (e.g. |a + b + c|) are + // binary trees in the spec: (+ (+ a b) c) in Lisp terms. Recursively + // processing such a tree, exactly implemented that way, would blow the + // the stack. We use a list node that uses O(1) stack to represent + // such operations: (+ a b c). + // + // (**) is right-associative; per spec |a ** b ** c| parses as + // (** a (** b c)). But we treat this the same way, creating a list + // node: (** a b c). All consumers must understand that this must be + // processed with a right fold, whereas the list (+ a b c) must be + // processed with a left fold because (+) is left-associative. + // + if (left->isKind(kind) && + left->isOp(op) && + (CodeSpec[op].format & JOF_LEFTASSOC || + (kind == PNK_POW && !left->pn_parens))) + { + ListNode* list = &left->as<ListNode>(); + + list->append(right); + list->pn_pos.end = right->pn_pos.end; + + return list; + } + } + + ParseNode* list = handler->new_<ListNode>(kind, op, left); + if (!list) + return nullptr; + + list->append(right); + return list; +} + +#ifdef DEBUG + +static const char * const parseNodeNames[] = { +#define STRINGIFY(name) #name, + FOR_EACH_PARSE_NODE_KIND(STRINGIFY) +#undef STRINGIFY +}; + +void +frontend::DumpParseTree(ParseNode* pn, int indent) +{ + if (pn == nullptr) + fprintf(stderr, "#NULL"); + else + pn->dump(indent); +} + +static void +IndentNewLine(int indent) +{ + fputc('\n', stderr); + for (int i = 0; i < indent; ++i) + fputc(' ', stderr); +} + +void +ParseNode::dump() +{ + dump(0); + fputc('\n', stderr); +} + +void +ParseNode::dump(int indent) +{ + switch (pn_arity) { + case PN_NULLARY: + ((NullaryNode*) this)->dump(); + break; + case PN_UNARY: + ((UnaryNode*) this)->dump(indent); + break; + case PN_BINARY: + ((BinaryNode*) this)->dump(indent); + break; + case PN_TERNARY: + ((TernaryNode*) this)->dump(indent); + break; + case PN_CODE: + ((CodeNode*) this)->dump(indent); + break; + case PN_LIST: + ((ListNode*) this)->dump(indent); + break; + case PN_NAME: + ((NameNode*) this)->dump(indent); + break; + case PN_SCOPE: + ((LexicalScopeNode*) this)->dump(indent); + break; + default: + fprintf(stderr, "#<BAD NODE %p, kind=%u, arity=%u>", + (void*) this, unsigned(getKind()), unsigned(pn_arity)); + break; + } +} + +void +NullaryNode::dump() +{ + switch (getKind()) { + case PNK_TRUE: fprintf(stderr, "#true"); break; + case PNK_FALSE: fprintf(stderr, "#false"); break; + case PNK_NULL: fprintf(stderr, "#null"); break; + + case PNK_NUMBER: { + ToCStringBuf cbuf; + const char* cstr = NumberToCString(nullptr, &cbuf, pn_dval); + if (!IsFinite(pn_dval)) + fputc('#', stderr); + if (cstr) + fprintf(stderr, "%s", cstr); + else + fprintf(stderr, "%g", pn_dval); + break; + } + + case PNK_STRING: + pn_atom->dumpCharsNoNewline(); + break; + + default: + fprintf(stderr, "(%s)", parseNodeNames[getKind()]); + } +} + +void +UnaryNode::dump(int indent) +{ + const char* name = parseNodeNames[getKind()]; + fprintf(stderr, "(%s ", name); + indent += strlen(name) + 2; + DumpParseTree(pn_kid, indent); + fprintf(stderr, ")"); +} + +void +BinaryNode::dump(int indent) +{ + const char* name = parseNodeNames[getKind()]; + fprintf(stderr, "(%s ", name); + indent += strlen(name) + 2; + DumpParseTree(pn_left, indent); + IndentNewLine(indent); + DumpParseTree(pn_right, indent); + fprintf(stderr, ")"); +} + +void +TernaryNode::dump(int indent) +{ + const char* name = parseNodeNames[getKind()]; + fprintf(stderr, "(%s ", name); + indent += strlen(name) + 2; + DumpParseTree(pn_kid1, indent); + IndentNewLine(indent); + DumpParseTree(pn_kid2, indent); + IndentNewLine(indent); + DumpParseTree(pn_kid3, indent); + fprintf(stderr, ")"); +} + +void +CodeNode::dump(int indent) +{ + const char* name = parseNodeNames[getKind()]; + fprintf(stderr, "(%s ", name); + indent += strlen(name) + 2; + DumpParseTree(pn_body, indent); + fprintf(stderr, ")"); +} + +void +ListNode::dump(int indent) +{ + const char* name = parseNodeNames[getKind()]; + fprintf(stderr, "(%s [", name); + if (pn_head != nullptr) { + indent += strlen(name) + 3; + DumpParseTree(pn_head, indent); + ParseNode* pn = pn_head->pn_next; + while (pn != nullptr) { + IndentNewLine(indent); + DumpParseTree(pn, indent); + pn = pn->pn_next; + } + } + fprintf(stderr, "])"); +} + +template <typename CharT> +static void +DumpName(const CharT* s, size_t len) +{ + if (len == 0) + fprintf(stderr, "#<zero-length name>"); + + for (size_t i = 0; i < len; i++) { + char16_t c = s[i]; + if (c > 32 && c < 127) + fputc(c, stderr); + else if (c <= 255) + fprintf(stderr, "\\x%02x", unsigned(c)); + else + fprintf(stderr, "\\u%04x", unsigned(c)); + } +} + +void +NameNode::dump(int indent) +{ + if (isKind(PNK_NAME) || isKind(PNK_DOT)) { + if (isKind(PNK_DOT)) + fprintf(stderr, "(."); + + if (!pn_atom) { + fprintf(stderr, "#<null name>"); + } else if (getOp() == JSOP_GETARG && pn_atom->length() == 0) { + // Dump destructuring parameter. + fprintf(stderr, "(#<zero-length name> "); + DumpParseTree(expr(), indent + 21); + fputc(')', stderr); + } else { + JS::AutoCheckCannotGC nogc; + if (pn_atom->hasLatin1Chars()) + DumpName(pn_atom->latin1Chars(nogc), pn_atom->length()); + else + DumpName(pn_atom->twoByteChars(nogc), pn_atom->length()); + } + + if (isKind(PNK_DOT)) { + fputc(' ', stderr); + if (as<PropertyAccess>().isSuper()) + fprintf(stderr, "super"); + else + DumpParseTree(expr(), indent + 2); + fputc(')', stderr); + } + return; + } + + const char* name = parseNodeNames[getKind()]; + fprintf(stderr, "(%s ", name); + indent += strlen(name) + 2; + DumpParseTree(expr(), indent); + fprintf(stderr, ")"); +} + +void +LexicalScopeNode::dump(int indent) +{ + const char* name = parseNodeNames[getKind()]; + fprintf(stderr, "(%s [", name); + int nameIndent = indent + strlen(name) + 3; + if (!isEmptyScope()) { + LexicalScope::Data* bindings = scopeBindings(); + for (uint32_t i = 0; i < bindings->length; i++) { + JSAtom* name = bindings->names[i].name(); + JS::AutoCheckCannotGC nogc; + if (name->hasLatin1Chars()) + DumpName(name->latin1Chars(nogc), name->length()); + else + DumpName(name->twoByteChars(nogc), name->length()); + if (i < bindings->length - 1) + IndentNewLine(nameIndent); + } + } + fprintf(stderr, "]"); + indent += 2; + IndentNewLine(indent); + DumpParseTree(scopeBody(), indent); + fprintf(stderr, ")"); +} +#endif + +ObjectBox::ObjectBox(JSObject* object, ObjectBox* traceLink) + : object(object), + traceLink(traceLink), + emitLink(nullptr) +{ + MOZ_ASSERT(!object->is<JSFunction>()); + MOZ_ASSERT(object->isTenured()); +} + +ObjectBox::ObjectBox(JSFunction* function, ObjectBox* traceLink) + : object(function), + traceLink(traceLink), + emitLink(nullptr) +{ + MOZ_ASSERT(object->is<JSFunction>()); + MOZ_ASSERT(asFunctionBox()->function() == function); + MOZ_ASSERT(object->isTenured()); +} + +FunctionBox* +ObjectBox::asFunctionBox() +{ + MOZ_ASSERT(isFunctionBox()); + return static_cast<FunctionBox*>(this); +} + +/* static */ void +ObjectBox::TraceList(JSTracer* trc, ObjectBox* listHead) +{ + for (ObjectBox* box = listHead; box; box = box->traceLink) + box->trace(trc); +} + +void +ObjectBox::trace(JSTracer* trc) +{ + TraceRoot(trc, &object, "parser.object"); +} + +void +FunctionBox::trace(JSTracer* trc) +{ + ObjectBox::trace(trc); + if (enclosingScope_) + TraceRoot(trc, &enclosingScope_, "funbox-enclosingScope"); +} diff --git a/js/src/frontend/ParseNode.h b/js/src/frontend/ParseNode.h new file mode 100644 index 000000000..d37aaaae0 --- /dev/null +++ b/js/src/frontend/ParseNode.h @@ -0,0 +1,1450 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- + * vim: set ts=8 sts=4 et sw=4 tw=99: + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#ifndef frontend_ParseNode_h +#define frontend_ParseNode_h + +#include "mozilla/Attributes.h" + +#include "builtin/ModuleObject.h" +#include "frontend/TokenStream.h" + +namespace js { +namespace frontend { + +class ParseContext; +class FullParseHandler; +class FunctionBox; +class ObjectBox; + +#define FOR_EACH_PARSE_NODE_KIND(F) \ + F(NOP) \ + F(SEMI) \ + F(COMMA) \ + F(CONDITIONAL) \ + F(COLON) \ + F(SHORTHAND) \ + F(POS) \ + F(NEG) \ + F(PREINCREMENT) \ + F(POSTINCREMENT) \ + F(PREDECREMENT) \ + F(POSTDECREMENT) \ + F(DOT) \ + F(ELEM) \ + F(ARRAY) \ + F(ELISION) \ + F(STATEMENTLIST) \ + F(LABEL) \ + F(OBJECT) \ + F(CALL) \ + F(NAME) \ + F(OBJECT_PROPERTY_NAME) \ + F(COMPUTED_NAME) \ + F(NUMBER) \ + F(STRING) \ + F(TEMPLATE_STRING_LIST) \ + F(TEMPLATE_STRING) \ + F(TAGGED_TEMPLATE) \ + F(CALLSITEOBJ) \ + F(REGEXP) \ + F(TRUE) \ + F(FALSE) \ + F(NULL) \ + F(THIS) \ + F(FUNCTION) \ + F(MODULE) \ + F(IF) \ + F(SWITCH) \ + F(CASE) \ + F(WHILE) \ + F(DOWHILE) \ + F(FOR) \ + F(COMPREHENSIONFOR) \ + F(BREAK) \ + F(CONTINUE) \ + F(VAR) \ + F(CONST) \ + F(WITH) \ + F(RETURN) \ + F(NEW) \ + /* Delete operations. These must be sequential. */ \ + F(DELETENAME) \ + F(DELETEPROP) \ + F(DELETEELEM) \ + F(DELETEEXPR) \ + F(TRY) \ + F(CATCH) \ + F(CATCHLIST) \ + F(THROW) \ + F(DEBUGGER) \ + F(GENERATOR) \ + F(YIELD) \ + F(YIELD_STAR) \ + F(GENEXP) \ + F(ARRAYCOMP) \ + F(ARRAYPUSH) \ + F(LEXICALSCOPE) \ + F(LET) \ + F(IMPORT) \ + F(IMPORT_SPEC_LIST) \ + F(IMPORT_SPEC) \ + F(EXPORT) \ + F(EXPORT_FROM) \ + F(EXPORT_DEFAULT) \ + F(EXPORT_SPEC_LIST) \ + F(EXPORT_SPEC) \ + F(EXPORT_BATCH_SPEC) \ + F(FORIN) \ + F(FOROF) \ + F(FORHEAD) \ + F(PARAMSBODY) \ + F(SPREAD) \ + F(MUTATEPROTO) \ + F(CLASS) \ + F(CLASSMETHOD) \ + F(CLASSMETHODLIST) \ + F(CLASSNAMES) \ + F(NEWTARGET) \ + F(POSHOLDER) \ + F(SUPERBASE) \ + F(SUPERCALL) \ + F(SETTHIS) \ + \ + /* Unary operators. */ \ + F(TYPEOFNAME) \ + F(TYPEOFEXPR) \ + F(VOID) \ + F(NOT) \ + F(BITNOT) \ + F(AWAIT) \ + \ + /* \ + * Binary operators. \ + * These must be in the same order as TOK_OR and friends in TokenStream.h. \ + */ \ + F(OR) \ + F(AND) \ + F(BITOR) \ + F(BITXOR) \ + F(BITAND) \ + F(STRICTEQ) \ + F(EQ) \ + F(STRICTNE) \ + F(NE) \ + F(LT) \ + F(LE) \ + F(GT) \ + F(GE) \ + F(INSTANCEOF) \ + F(IN) \ + F(LSH) \ + F(RSH) \ + F(URSH) \ + F(ADD) \ + F(SUB) \ + F(STAR) \ + F(DIV) \ + F(MOD) \ + F(POW) \ + \ + /* Assignment operators (= += -= etc.). */ \ + /* ParseNode::isAssignment assumes all these are consecutive. */ \ + F(ASSIGN) \ + F(ADDASSIGN) \ + F(SUBASSIGN) \ + F(BITORASSIGN) \ + F(BITXORASSIGN) \ + F(BITANDASSIGN) \ + F(LSHASSIGN) \ + F(RSHASSIGN) \ + F(URSHASSIGN) \ + F(MULASSIGN) \ + F(DIVASSIGN) \ + F(MODASSIGN) \ + F(POWASSIGN) + +/* + * Parsing builds a tree of nodes that directs code generation. This tree is + * not a concrete syntax tree in all respects (for example, || and && are left + * associative, but (A && B && C) translates into the right-associated tree + * <A && <B && C>> so that code generation can emit a left-associative branch + * around <B && C> when A is false). Nodes are labeled by kind, with a + * secondary JSOp label when needed. + * + * The long comment after this enum block describes the kinds in detail. + */ +enum ParseNodeKind +{ +#define EMIT_ENUM(name) PNK_##name, + FOR_EACH_PARSE_NODE_KIND(EMIT_ENUM) +#undef EMIT_ENUM + PNK_LIMIT, /* domain size */ + PNK_BINOP_FIRST = PNK_OR, + PNK_BINOP_LAST = PNK_POW, + PNK_ASSIGNMENT_START = PNK_ASSIGN, + PNK_ASSIGNMENT_LAST = PNK_POWASSIGN +}; + +inline bool +IsDeleteKind(ParseNodeKind kind) +{ + return PNK_DELETENAME <= kind && kind <= PNK_DELETEEXPR; +} + +inline bool +IsTypeofKind(ParseNodeKind kind) +{ + return PNK_TYPEOFNAME <= kind && kind <= PNK_TYPEOFEXPR; +} + +/* + * Label Variant Members + * ----- ------- ------- + * <Definitions> + * PNK_FUNCTION name pn_funbox: ptr to js::FunctionBox holding function + * object containing arg and var properties. We + * create the function object at parse (not emit) + * time to specialize arg and var bytecodes early. + * pn_body: PNK_PARAMSBODY, ordinarily; + * PNK_LEXICALSCOPE for implicit function in genexpr + * PNK_PARAMSBODY list list of formal parameters with + * PNK_NAME node with non-empty name for + * SingleNameBinding without Initializer + * PNK_ASSIGN node for SingleNameBinding with + * Initializer + * PNK_NAME node with empty name for destructuring + * pn_expr: PNK_ARRAY, PNK_OBJECT, or PNK_ASSIGN + * PNK_ARRAY or PNK_OBJECT for BindingPattern + * without Initializer + * PNK_ASSIGN for BindingPattern with + * Initializer + * followed by: + * PNK_STATEMENTLIST node for function body + * statements, + * PNK_RETURN for expression closure + * pn_count: 1 + number of formal parameters + * pn_tree: PNK_PARAMSBODY or PNK_STATEMENTLIST node + * PNK_SPREAD unary pn_kid: expression being spread + * + * <Statements> + * PNK_STATEMENTLIST list pn_head: list of pn_count statements + * PNK_IF ternary pn_kid1: cond, pn_kid2: then, pn_kid3: else or null. + * In body of a comprehension or desugared generator + * expression, pn_kid2 is PNK_YIELD, PNK_ARRAYPUSH, + * or (if the push was optimized away) empty + * PNK_STATEMENTLIST. + * PNK_SWITCH binary pn_left: discriminant + * pn_right: list of PNK_CASE nodes, with at most one + * default node, or if there are let bindings + * in the top level of the switch body's cases, a + * PNK_LEXICALSCOPE node that contains the list of + * PNK_CASE nodes. + * PNK_CASE binary pn_left: case-expression if CaseClause, or + * null if DefaultClause + * pn_right: PNK_STATEMENTLIST node for this case's + * statements + * pn_u.binary.offset: scratch space for the emitter + * PNK_WHILE binary pn_left: cond, pn_right: body + * PNK_DOWHILE binary pn_left: body, pn_right: cond + * PNK_FOR binary pn_left: either PNK_FORIN (for-in statement), + * PNK_FOROF (for-of) or PNK_FORHEAD (for(;;)) + * pn_right: body + * PNK_COMPREHENSIONFOR pn_left: either PNK_FORIN or PNK_FOROF + * binary pn_right: body + * PNK_FORIN ternary pn_kid1: declaration or expression to left of 'in' + * pn_kid2: null + * pn_kid3: object expr to right of 'in' + * PNK_FOROF ternary pn_kid1: declaration or expression to left of 'of' + * pn_kid2: null + * pn_kid3: expr to right of 'of' + * PNK_FORHEAD ternary pn_kid1: init expr before first ';' or nullptr + * pn_kid2: cond expr before second ';' or nullptr + * pn_kid3: update expr after second ';' or nullptr + * PNK_THROW unary pn_op: JSOP_THROW, pn_kid: exception + * PNK_TRY ternary pn_kid1: try block + * pn_kid2: null or PNK_CATCHLIST list + * pn_kid3: null or finally block + * PNK_CATCHLIST list pn_head: list of PNK_LEXICALSCOPE nodes, one per + * catch-block, each with pn_expr pointing + * to a PNK_CATCH node + * PNK_CATCH ternary pn_kid1: PNK_NAME, PNK_ARRAY, or PNK_OBJECT catch var node + * (PNK_ARRAY or PNK_OBJECT if destructuring) + * pn_kid2: null or the catch guard expression + * pn_kid3: catch block statements + * PNK_BREAK name pn_atom: label or null + * PNK_CONTINUE name pn_atom: label or null + * PNK_WITH binary pn_left: head expr; pn_right: body; + * PNK_VAR, list pn_head: list of PNK_NAME or PNK_ASSIGN nodes + * PNK_LET, each name node has either + * PNK_CONST pn_used: false + * pn_atom: variable name + * pn_expr: initializer or null + * or + * pn_used: true + * pn_atom: variable name + * pn_lexdef: def node + * each assignment node has + * pn_left: PNK_NAME with pn_used true and + * pn_lexdef (NOT pn_expr) set + * pn_right: initializer + * PNK_RETURN unary pn_kid: return expr or null + * PNK_SEMI unary pn_kid: expr or null statement + * pn_prologue: true if Directive Prologue member + * in original source, not introduced via + * constant folding or other tree rewriting + * PNK_LABEL name pn_atom: label, pn_expr: labeled statement + * PNK_IMPORT binary pn_left: PNK_IMPORT_SPEC_LIST import specifiers + * pn_right: PNK_STRING module specifier + * PNK_EXPORT unary pn_kid: declaration expression + * PNK_EXPORT_FROM binary pn_left: PNK_EXPORT_SPEC_LIST export specifiers + * pn_right: PNK_STRING module specifier + * PNK_EXPORT_DEFAULT unary pn_kid: export default declaration or expression + * + * <Expressions> + * All left-associated binary trees of the same type are optimized into lists + * to avoid recursion when processing expression chains. + * PNK_COMMA list pn_head: list of pn_count comma-separated exprs + * PNK_ASSIGN binary pn_left: lvalue, pn_right: rvalue + * PNK_ADDASSIGN, binary pn_left: lvalue, pn_right: rvalue + * PNK_SUBASSIGN, pn_op: JSOP_ADD for +=, etc. + * PNK_BITORASSIGN, + * PNK_BITXORASSIGN, + * PNK_BITANDASSIGN, + * PNK_LSHASSIGN, + * PNK_RSHASSIGN, + * PNK_URSHASSIGN, + * PNK_MULASSIGN, + * PNK_DIVASSIGN, + * PNK_MODASSIGN, + * PNK_POWASSIGN + * PNK_CONDITIONAL ternary (cond ? trueExpr : falseExpr) + * pn_kid1: cond, pn_kid2: then, pn_kid3: else + * PNK_OR, list pn_head; list of pn_count subexpressions + * PNK_AND, All of these operators are left-associative except (**). + * PNK_BITOR, + * PNK_BITXOR, + * PNK_BITAND, + * PNK_EQ, + * PNK_NE, + * PNK_STRICTEQ, + * PNK_STRICTNE, + * PNK_LT, + * PNK_LE, + * PNK_GT, + * PNK_GE, + * PNK_LSH, + * PNK_RSH, + * PNK_URSH, + * PNK_ADD, + * PNK_SUB, + * PNK_STAR, + * PNK_DIV, + * PNK_MOD, + * PNK_POW (**) is right-associative, but forms a list + * nonetheless. Special hacks everywhere. + * + * PNK_POS, unary pn_kid: UNARY expr + * PNK_NEG + * PNK_VOID, unary pn_kid: UNARY expr + * PNK_NOT, + * PNK_BITNOT, + * PNK_AWAIT + * PNK_TYPEOFNAME, unary pn_kid: UNARY expr + * PNK_TYPEOFEXPR + * PNK_PREINCREMENT, unary pn_kid: MEMBER expr + * PNK_POSTINCREMENT, + * PNK_PREDECREMENT, + * PNK_POSTDECREMENT + * PNK_NEW list pn_head: list of ctor, arg1, arg2, ... argN + * pn_count: 1 + N (where N is number of args) + * ctor is a MEMBER expr + * PNK_DELETENAME unary pn_kid: PNK_NAME expr + * PNK_DELETEPROP unary pn_kid: PNK_DOT expr + * PNK_DELETEELEM unary pn_kid: PNK_ELEM expr + * PNK_DELETEEXPR unary pn_kid: MEMBER expr that's evaluated, then the + * overall delete evaluates to true; can't be a kind + * for a more-specific PNK_DELETE* unless constant + * folding (or a similar parse tree manipulation) has + * occurred + * PNK_DOT name pn_expr: MEMBER expr to left of . + * pn_atom: name to right of . + * PNK_ELEM binary pn_left: MEMBER expr to left of [ + * pn_right: expr between [ and ] + * PNK_CALL list pn_head: list of call, arg1, arg2, ... argN + * pn_count: 1 + N (where N is number of args) + * call is a MEMBER expr naming a callable object + * PNK_GENEXP list Exactly like PNK_CALL, used for the implicit call + * in the desugaring of a generator-expression. + * PNK_ARRAY list pn_head: list of pn_count array element exprs + * [,,] holes are represented by PNK_ELISION nodes + * pn_xflags: PN_ENDCOMMA if extra comma at end + * PNK_OBJECT list pn_head: list of pn_count binary PNK_COLON nodes + * PNK_COLON binary key-value pair in object initializer or + * destructuring lhs + * pn_left: property id, pn_right: value + * PNK_SHORTHAND binary Same fields as PNK_COLON. This is used for object + * literal properties using shorthand ({x}). + * PNK_COMPUTED_NAME unary ES6 ComputedPropertyName. + * pn_kid: the AssignmentExpression inside the square brackets + * PNK_NAME, name pn_atom: name, string, or object atom + * PNK_STRING pn_op: JSOP_GETNAME, JSOP_STRING, or JSOP_OBJECT + * If JSOP_GETNAME, pn_op may be JSOP_*ARG or JSOP_*VAR + * telling const-ness and static analysis results + * PNK_TEMPLATE_STRING_LIST pn_head: list of alternating expr and template strings + * list + * PNK_TEMPLATE_STRING pn_atom: template string atom + nullary pn_op: JSOP_NOP + * PNK_TAGGED_TEMPLATE pn_head: list of call, call site object, arg1, arg2, ... argN + * list pn_count: 2 + N (N is the number of substitutions) + * PNK_CALLSITEOBJ list pn_head: a PNK_ARRAY node followed by + * list of pn_count - 1 PNK_TEMPLATE_STRING nodes + * PNK_REGEXP nullary pn_objbox: RegExp model object + * PNK_NUMBER dval pn_dval: double value of numeric literal + * PNK_TRUE, nullary pn_op: JSOp bytecode + * PNK_FALSE, + * PNK_NULL + * + * PNK_THIS, unary pn_kid: '.this' Name if function `this`, else nullptr + * PNK_SUPERBASE unary pn_kid: '.this' Name + * + * PNK_SETTHIS binary pn_left: '.this' Name, pn_right: SuperCall + * + * PNK_LEXICALSCOPE scope pn_u.scope.bindings: scope bindings + * pn_u.scope.body: scope body + * PNK_GENERATOR nullary + * PNK_YIELD, binary pn_left: expr or null; pn_right: generator object + * PNK_YIELD_STAR + * PNK_ARRAYCOMP list pn_count: 1 + * pn_head: list of 1 element, which is block + * enclosing for loop(s) and optionally + * if-guarded PNK_ARRAYPUSH + * PNK_ARRAYPUSH unary pn_op: JSOP_ARRAYCOMP + * pn_kid: array comprehension expression + * PNK_NOP nullary + */ +enum ParseNodeArity +{ + PN_NULLARY, /* 0 kids, only pn_atom/pn_dval/etc. */ + PN_UNARY, /* one kid, plus a couple of scalars */ + PN_BINARY, /* two kids, plus a couple of scalars */ + PN_TERNARY, /* three kids */ + PN_CODE, /* module or function definition node */ + PN_LIST, /* generic singly linked list */ + PN_NAME, /* name, label, or regexp */ + PN_SCOPE /* lexical scope */ +}; + +class LoopControlStatement; +class BreakStatement; +class ContinueStatement; +class ConditionalExpression; +class PropertyAccess; + +class ParseNode +{ + uint16_t pn_type; /* PNK_* type */ + uint8_t pn_op; /* see JSOp enum and jsopcode.tbl */ + uint8_t pn_arity:4; /* see ParseNodeArity enum */ + bool pn_parens:1; /* this expr was enclosed in parens */ + + ParseNode(const ParseNode& other) = delete; + void operator=(const ParseNode& other) = delete; + + public: + ParseNode(ParseNodeKind kind, JSOp op, ParseNodeArity arity) + : pn_type(kind), + pn_op(op), + pn_arity(arity), + pn_parens(false), + pn_pos(0, 0), + pn_next(nullptr) + { + MOZ_ASSERT(kind < PNK_LIMIT); + memset(&pn_u, 0, sizeof pn_u); + } + + ParseNode(ParseNodeKind kind, JSOp op, ParseNodeArity arity, const TokenPos& pos) + : pn_type(kind), + pn_op(op), + pn_arity(arity), + pn_parens(false), + pn_pos(pos), + pn_next(nullptr) + { + MOZ_ASSERT(kind < PNK_LIMIT); + memset(&pn_u, 0, sizeof pn_u); + } + + JSOp getOp() const { return JSOp(pn_op); } + void setOp(JSOp op) { pn_op = op; } + bool isOp(JSOp op) const { return getOp() == op; } + + ParseNodeKind getKind() const { + MOZ_ASSERT(pn_type < PNK_LIMIT); + return ParseNodeKind(pn_type); + } + void setKind(ParseNodeKind kind) { + MOZ_ASSERT(kind < PNK_LIMIT); + pn_type = kind; + } + bool isKind(ParseNodeKind kind) const { return getKind() == kind; } + + ParseNodeArity getArity() const { return ParseNodeArity(pn_arity); } + bool isArity(ParseNodeArity a) const { return getArity() == a; } + void setArity(ParseNodeArity a) { pn_arity = a; } + + bool isAssignment() const { + ParseNodeKind kind = getKind(); + return PNK_ASSIGNMENT_START <= kind && kind <= PNK_ASSIGNMENT_LAST; + } + + bool isBinaryOperation() const { + ParseNodeKind kind = getKind(); + return PNK_BINOP_FIRST <= kind && kind <= PNK_BINOP_LAST; + } + + /* Boolean attributes. */ + bool isInParens() const { return pn_parens; } + bool isLikelyIIFE() const { return isInParens(); } + void setInParens(bool enabled) { pn_parens = enabled; } + + TokenPos pn_pos; /* two 16-bit pairs here, for 64 bits */ + ParseNode* pn_next; /* intrinsic link in parent PN_LIST */ + + union { + struct { /* list of next-linked nodes */ + ParseNode* head; /* first node in list */ + ParseNode** tail; /* ptr to ptr to last node in list */ + uint32_t count; /* number of nodes in list */ + uint32_t xflags; /* see PNX_* below */ + } list; + struct { /* ternary: if, for(;;), ?: */ + ParseNode* kid1; /* condition, discriminant, etc. */ + ParseNode* kid2; /* then-part, case list, etc. */ + ParseNode* kid3; /* else-part, default case, etc. */ + } ternary; + struct { /* two kids if binary */ + ParseNode* left; + ParseNode* right; + union { + unsigned iflags; /* JSITER_* flags for PNK_{COMPREHENSION,}FOR node */ + bool isStatic; /* only for PNK_CLASSMETHOD */ + uint32_t offset; /* for the emitter's use on PNK_CASE nodes */ + }; + } binary; + struct { /* one kid if unary */ + ParseNode* kid; + bool prologue; /* directive prologue member (as + pn_prologue) */ + } unary; + struct { /* name, labeled statement, etc. */ + union { + JSAtom* atom; /* lexical name or label atom */ + ObjectBox* objbox; /* regexp object */ + FunctionBox* funbox; /* function object */ + }; + ParseNode* expr; /* module or function body, var + initializer, argument default, or + base object of PNK_DOT */ + } name; + struct { + LexicalScope::Data* bindings; + ParseNode* body; + } scope; + struct { + double value; /* aligned numeric literal value */ + DecimalPoint decimalPoint; /* Whether the number has a decimal point */ + } number; + class { + friend class LoopControlStatement; + PropertyName* label; /* target of break/continue statement */ + } loopControl; + } pn_u; + +#define pn_objbox pn_u.name.objbox +#define pn_funbox pn_u.name.funbox +#define pn_body pn_u.name.expr +#define pn_head pn_u.list.head +#define pn_tail pn_u.list.tail +#define pn_count pn_u.list.count +#define pn_xflags pn_u.list.xflags +#define pn_kid1 pn_u.ternary.kid1 +#define pn_kid2 pn_u.ternary.kid2 +#define pn_kid3 pn_u.ternary.kid3 +#define pn_left pn_u.binary.left +#define pn_right pn_u.binary.right +#define pn_pval pn_u.binary.pval +#define pn_iflags pn_u.binary.iflags +#define pn_kid pn_u.unary.kid +#define pn_prologue pn_u.unary.prologue +#define pn_atom pn_u.name.atom +#define pn_objbox pn_u.name.objbox +#define pn_expr pn_u.name.expr +#define pn_dval pn_u.number.value + + + public: + /* + * If |left| is a list of the given kind/left-associative op, append + * |right| to it and return |left|. Otherwise return a [left, right] list. + */ + static ParseNode* + appendOrCreateList(ParseNodeKind kind, JSOp op, ParseNode* left, ParseNode* right, + FullParseHandler* handler, ParseContext* pc); + + inline PropertyName* name() const; + inline JSAtom* atom() const; + + ParseNode* expr() const { + MOZ_ASSERT(pn_arity == PN_NAME || pn_arity == PN_CODE); + return pn_expr; + } + + bool isEmptyScope() const { + MOZ_ASSERT(pn_arity == PN_SCOPE); + return !pn_u.scope.bindings; + } + + Handle<LexicalScope::Data*> scopeBindings() const { + MOZ_ASSERT(!isEmptyScope()); + // Bindings' GC safety depend on the presence of an AutoKeepAtoms that + // the rest of the frontend also depends on. + return Handle<LexicalScope::Data*>::fromMarkedLocation(&pn_u.scope.bindings); + } + + ParseNode* scopeBody() const { + MOZ_ASSERT(pn_arity == PN_SCOPE); + return pn_u.scope.body; + } + + void setScopeBody(ParseNode* body) { + MOZ_ASSERT(pn_arity == PN_SCOPE); + pn_u.scope.body = body; + } + +/* PN_LIST pn_xflags bits. */ +#define PNX_FUNCDEFS 0x01 /* contains top-level function statements */ +#define PNX_ARRAYHOLESPREAD 0x02 /* one or more of + 1. array initialiser has holes + 2. array initializer has spread node */ +#define PNX_NONCONST 0x04 /* initialiser has non-constants */ + + bool functionIsHoisted() const { + MOZ_ASSERT(pn_arity == PN_CODE && getKind() == PNK_FUNCTION); + MOZ_ASSERT(isOp(JSOP_LAMBDA) || // lambda, genexpr + isOp(JSOP_LAMBDA_ARROW) || // arrow function + isOp(JSOP_FUNWITHPROTO) || // already emitted lambda with needsProto + isOp(JSOP_DEFFUN) || // non-body-level function statement + isOp(JSOP_NOP) || // body-level function stmt in global code + isOp(JSOP_GETLOCAL) || // body-level function stmt in function code + isOp(JSOP_GETARG) || // body-level function redeclaring formal + isOp(JSOP_INITLEXICAL)); // block-level function stmt + return !isOp(JSOP_LAMBDA) && !isOp(JSOP_LAMBDA_ARROW) && + !isOp(JSOP_FUNWITHPROTO) && !isOp(JSOP_DEFFUN); + } + + /* + * True if this statement node could be a member of a Directive Prologue: an + * expression statement consisting of a single string literal. + * + * This considers only the node and its children, not its context. After + * parsing, check the node's pn_prologue flag to see if it is indeed part of + * a directive prologue. + * + * Note that a Directive Prologue can contain statements that cannot + * themselves be directives (string literals that include escape sequences + * or escaped newlines, say). This member function returns true for such + * nodes; we use it to determine the extent of the prologue. + */ + JSAtom* isStringExprStatement() const { + if (getKind() == PNK_SEMI) { + MOZ_ASSERT(pn_arity == PN_UNARY); + ParseNode* kid = pn_kid; + if (kid && kid->getKind() == PNK_STRING && !kid->pn_parens) + return kid->pn_atom; + } + return nullptr; + } + + /* True if pn is a parsenode representing a literal constant. */ + bool isLiteral() const { + return isKind(PNK_NUMBER) || + isKind(PNK_STRING) || + isKind(PNK_TRUE) || + isKind(PNK_FALSE) || + isKind(PNK_NULL); + } + + /* Return true if this node appears in a Directive Prologue. */ + bool isDirectivePrologueMember() const { return pn_prologue; } + + // True iff this is a for-in/of loop variable declaration (var/let/const). + bool isForLoopDeclaration() const { + if (isKind(PNK_VAR) || isKind(PNK_LET) || isKind(PNK_CONST)) { + MOZ_ASSERT(isArity(PN_LIST)); + MOZ_ASSERT(pn_count > 0); + return true; + } + + return false; + } + + ParseNode* generatorExpr() const { + MOZ_ASSERT(isKind(PNK_GENEXP)); + + ParseNode* callee = this->pn_head; + MOZ_ASSERT(callee->isKind(PNK_FUNCTION)); + + ParseNode* paramsBody = callee->pn_body; + MOZ_ASSERT(paramsBody->isKind(PNK_PARAMSBODY)); + + ParseNode* body = paramsBody->last(); + MOZ_ASSERT(body->isKind(PNK_STATEMENTLIST)); + MOZ_ASSERT(body->last()->isKind(PNK_LEXICALSCOPE) || + body->last()->isKind(PNK_COMPREHENSIONFOR)); + return body->last(); + } + + /* + * Compute a pointer to the last element in a singly-linked list. NB: list + * must be non-empty for correct PN_LAST usage -- this is asserted! + */ + ParseNode* last() const { + MOZ_ASSERT(pn_arity == PN_LIST); + MOZ_ASSERT(pn_count != 0); + return (ParseNode*)(uintptr_t(pn_tail) - offsetof(ParseNode, pn_next)); + } + + void initNumber(double value, DecimalPoint decimalPoint) { + MOZ_ASSERT(pn_arity == PN_NULLARY); + MOZ_ASSERT(getKind() == PNK_NUMBER); + pn_u.number.value = value; + pn_u.number.decimalPoint = decimalPoint; + } + + void makeEmpty() { + MOZ_ASSERT(pn_arity == PN_LIST); + pn_head = nullptr; + pn_tail = &pn_head; + pn_count = 0; + pn_xflags = 0; + } + + void initList(ParseNode* pn) { + MOZ_ASSERT(pn_arity == PN_LIST); + if (pn->pn_pos.begin < pn_pos.begin) + pn_pos.begin = pn->pn_pos.begin; + pn_pos.end = pn->pn_pos.end; + pn_head = pn; + pn_tail = &pn->pn_next; + pn_count = 1; + pn_xflags = 0; + } + + void append(ParseNode* pn) { + MOZ_ASSERT(pn_arity == PN_LIST); + MOZ_ASSERT(pn->pn_pos.begin >= pn_pos.begin); + pn_pos.end = pn->pn_pos.end; + *pn_tail = pn; + pn_tail = &pn->pn_next; + pn_count++; + } + + void prepend(ParseNode* pn) { + MOZ_ASSERT(pn_arity == PN_LIST); + pn->pn_next = pn_head; + pn_head = pn; + if (pn_tail == &pn_head) + pn_tail = &pn->pn_next; + pn_count++; + } + + void checkListConsistency() +#ifndef DEBUG + {} +#endif + ; + + enum AllowConstantObjects { + DontAllowObjects = 0, + AllowObjects, + ForCopyOnWriteArray + }; + + MOZ_MUST_USE bool getConstantValue(ExclusiveContext* cx, AllowConstantObjects allowObjects, + MutableHandleValue vp, Value* compare = nullptr, + size_t ncompare = 0, NewObjectKind newKind = TenuredObject); + inline bool isConstant(); + + template <class NodeType> + inline bool is() const { + return NodeType::test(*this); + } + + /* Casting operations. */ + template <class NodeType> + inline NodeType& as() { + MOZ_ASSERT(NodeType::test(*this)); + return *static_cast<NodeType*>(this); + } + + template <class NodeType> + inline const NodeType& as() const { + MOZ_ASSERT(NodeType::test(*this)); + return *static_cast<const NodeType*>(this); + } + +#ifdef DEBUG + void dump(); + void dump(int indent); +#endif +}; + +struct NullaryNode : public ParseNode +{ + NullaryNode(ParseNodeKind kind, const TokenPos& pos) + : ParseNode(kind, JSOP_NOP, PN_NULLARY, pos) {} + NullaryNode(ParseNodeKind kind, JSOp op, const TokenPos& pos) + : ParseNode(kind, op, PN_NULLARY, pos) {} + + // This constructor is for a few mad uses in the emitter. It populates + // the pn_atom field even though that field belongs to a branch in pn_u + // that nullary nodes shouldn't use -- bogus. + NullaryNode(ParseNodeKind kind, JSOp op, const TokenPos& pos, JSAtom* atom) + : ParseNode(kind, op, PN_NULLARY, pos) + { + pn_atom = atom; + } + +#ifdef DEBUG + void dump(); +#endif +}; + +struct UnaryNode : public ParseNode +{ + UnaryNode(ParseNodeKind kind, JSOp op, const TokenPos& pos, ParseNode* kid) + : ParseNode(kind, op, PN_UNARY, pos) + { + pn_kid = kid; + } + +#ifdef DEBUG + void dump(int indent); +#endif +}; + +struct BinaryNode : public ParseNode +{ + BinaryNode(ParseNodeKind kind, JSOp op, const TokenPos& pos, ParseNode* left, ParseNode* right) + : ParseNode(kind, op, PN_BINARY, pos) + { + pn_left = left; + pn_right = right; + } + + BinaryNode(ParseNodeKind kind, JSOp op, ParseNode* left, ParseNode* right) + : ParseNode(kind, op, PN_BINARY, TokenPos::box(left->pn_pos, right->pn_pos)) + { + pn_left = left; + pn_right = right; + } + +#ifdef DEBUG + void dump(int indent); +#endif +}; + +struct TernaryNode : public ParseNode +{ + TernaryNode(ParseNodeKind kind, JSOp op, ParseNode* kid1, ParseNode* kid2, ParseNode* kid3) + : ParseNode(kind, op, PN_TERNARY, + TokenPos((kid1 ? kid1 : kid2 ? kid2 : kid3)->pn_pos.begin, + (kid3 ? kid3 : kid2 ? kid2 : kid1)->pn_pos.end)) + { + pn_kid1 = kid1; + pn_kid2 = kid2; + pn_kid3 = kid3; + } + + TernaryNode(ParseNodeKind kind, JSOp op, ParseNode* kid1, ParseNode* kid2, ParseNode* kid3, + const TokenPos& pos) + : ParseNode(kind, op, PN_TERNARY, pos) + { + pn_kid1 = kid1; + pn_kid2 = kid2; + pn_kid3 = kid3; + } + +#ifdef DEBUG + void dump(int indent); +#endif +}; + +struct ListNode : public ParseNode +{ + ListNode(ParseNodeKind kind, const TokenPos& pos) + : ParseNode(kind, JSOP_NOP, PN_LIST, pos) + { + makeEmpty(); + } + + ListNode(ParseNodeKind kind, JSOp op, const TokenPos& pos) + : ParseNode(kind, op, PN_LIST, pos) + { + makeEmpty(); + } + + ListNode(ParseNodeKind kind, JSOp op, ParseNode* kid) + : ParseNode(kind, op, PN_LIST, kid->pn_pos) + { + initList(kid); + } + + static bool test(const ParseNode& node) { + return node.isArity(PN_LIST); + } + +#ifdef DEBUG + void dump(int indent); +#endif +}; + +struct CodeNode : public ParseNode +{ + CodeNode(ParseNodeKind kind, const TokenPos& pos) + : ParseNode(kind, JSOP_NOP, PN_CODE, pos) + { + MOZ_ASSERT(kind == PNK_FUNCTION || kind == PNK_MODULE); + MOZ_ASSERT(!pn_body); + MOZ_ASSERT(!pn_objbox); + } + + public: +#ifdef DEBUG + void dump(int indent); +#endif +}; + +struct NameNode : public ParseNode +{ + NameNode(ParseNodeKind kind, JSOp op, JSAtom* atom, const TokenPos& pos) + : ParseNode(kind, op, PN_NAME, pos) + { + pn_atom = atom; + pn_expr = nullptr; + } + +#ifdef DEBUG + void dump(int indent); +#endif +}; + +struct LexicalScopeNode : public ParseNode +{ + LexicalScopeNode(LexicalScope::Data* bindings, ParseNode* body) + : ParseNode(PNK_LEXICALSCOPE, JSOP_NOP, PN_SCOPE, body->pn_pos) + { + pn_u.scope.bindings = bindings; + pn_u.scope.body = body; + } + + static bool test(const ParseNode& node) { + return node.isKind(PNK_LEXICALSCOPE); + } + +#ifdef DEBUG + void dump(int indent); +#endif +}; + +class LabeledStatement : public ParseNode +{ + public: + LabeledStatement(PropertyName* label, ParseNode* stmt, uint32_t begin) + : ParseNode(PNK_LABEL, JSOP_NOP, PN_NAME, TokenPos(begin, stmt->pn_pos.end)) + { + pn_atom = label; + pn_expr = stmt; + } + + PropertyName* label() const { + return pn_atom->asPropertyName(); + } + + ParseNode* statement() const { + return pn_expr; + } + + static bool test(const ParseNode& node) { + bool match = node.isKind(PNK_LABEL); + MOZ_ASSERT_IF(match, node.isArity(PN_NAME)); + MOZ_ASSERT_IF(match, node.isOp(JSOP_NOP)); + return match; + } +}; + +// Inside a switch statement, a CaseClause is a case-label and the subsequent +// statements. The same node type is used for DefaultClauses. The only +// difference is that their caseExpression() is null. +class CaseClause : public BinaryNode +{ + public: + CaseClause(ParseNode* expr, ParseNode* stmts, uint32_t begin) + : BinaryNode(PNK_CASE, JSOP_NOP, TokenPos(begin, stmts->pn_pos.end), expr, stmts) {} + + ParseNode* caseExpression() const { return pn_left; } + bool isDefault() const { return !caseExpression(); } + ParseNode* statementList() const { return pn_right; } + + // The next CaseClause in the same switch statement. + CaseClause* next() const { return pn_next ? &pn_next->as<CaseClause>() : nullptr; } + + // Scratch space used by the emitter. + uint32_t offset() const { return pn_u.binary.offset; } + void setOffset(uint32_t u) { pn_u.binary.offset = u; } + + static bool test(const ParseNode& node) { + bool match = node.isKind(PNK_CASE); + MOZ_ASSERT_IF(match, node.isArity(PN_BINARY)); + MOZ_ASSERT_IF(match, node.isOp(JSOP_NOP)); + return match; + } +}; + +class LoopControlStatement : public ParseNode +{ + protected: + LoopControlStatement(ParseNodeKind kind, PropertyName* label, const TokenPos& pos) + : ParseNode(kind, JSOP_NOP, PN_NULLARY, pos) + { + MOZ_ASSERT(kind == PNK_BREAK || kind == PNK_CONTINUE); + pn_u.loopControl.label = label; + } + + public: + /* Label associated with this break/continue statement, if any. */ + PropertyName* label() const { + return pn_u.loopControl.label; + } + + static bool test(const ParseNode& node) { + bool match = node.isKind(PNK_BREAK) || node.isKind(PNK_CONTINUE); + MOZ_ASSERT_IF(match, node.isArity(PN_NULLARY)); + MOZ_ASSERT_IF(match, node.isOp(JSOP_NOP)); + return match; + } +}; + +class BreakStatement : public LoopControlStatement +{ + public: + BreakStatement(PropertyName* label, const TokenPos& pos) + : LoopControlStatement(PNK_BREAK, label, pos) + { } + + static bool test(const ParseNode& node) { + bool match = node.isKind(PNK_BREAK); + MOZ_ASSERT_IF(match, node.isArity(PN_NULLARY)); + MOZ_ASSERT_IF(match, node.isOp(JSOP_NOP)); + return match; + } +}; + +class ContinueStatement : public LoopControlStatement +{ + public: + ContinueStatement(PropertyName* label, const TokenPos& pos) + : LoopControlStatement(PNK_CONTINUE, label, pos) + { } + + static bool test(const ParseNode& node) { + bool match = node.isKind(PNK_CONTINUE); + MOZ_ASSERT_IF(match, node.isArity(PN_NULLARY)); + MOZ_ASSERT_IF(match, node.isOp(JSOP_NOP)); + return match; + } +}; + +class DebuggerStatement : public ParseNode +{ + public: + explicit DebuggerStatement(const TokenPos& pos) + : ParseNode(PNK_DEBUGGER, JSOP_NOP, PN_NULLARY, pos) + { } +}; + +class ConditionalExpression : public ParseNode +{ + public: + ConditionalExpression(ParseNode* condition, ParseNode* thenExpr, ParseNode* elseExpr) + : ParseNode(PNK_CONDITIONAL, JSOP_NOP, PN_TERNARY, + TokenPos(condition->pn_pos.begin, elseExpr->pn_pos.end)) + { + MOZ_ASSERT(condition); + MOZ_ASSERT(thenExpr); + MOZ_ASSERT(elseExpr); + pn_u.ternary.kid1 = condition; + pn_u.ternary.kid2 = thenExpr; + pn_u.ternary.kid3 = elseExpr; + } + + ParseNode& condition() const { + return *pn_u.ternary.kid1; + } + + ParseNode& thenExpression() const { + return *pn_u.ternary.kid2; + } + + ParseNode& elseExpression() const { + return *pn_u.ternary.kid3; + } + + static bool test(const ParseNode& node) { + bool match = node.isKind(PNK_CONDITIONAL); + MOZ_ASSERT_IF(match, node.isArity(PN_TERNARY)); + MOZ_ASSERT_IF(match, node.isOp(JSOP_NOP)); + return match; + } +}; + +class ThisLiteral : public UnaryNode +{ + public: + ThisLiteral(const TokenPos& pos, ParseNode* thisName) + : UnaryNode(PNK_THIS, JSOP_NOP, pos, thisName) + { } +}; + +class NullLiteral : public ParseNode +{ + public: + explicit NullLiteral(const TokenPos& pos) : ParseNode(PNK_NULL, JSOP_NULL, PN_NULLARY, pos) { } +}; + +class BooleanLiteral : public ParseNode +{ + public: + BooleanLiteral(bool b, const TokenPos& pos) + : ParseNode(b ? PNK_TRUE : PNK_FALSE, b ? JSOP_TRUE : JSOP_FALSE, PN_NULLARY, pos) + { } +}; + +class RegExpLiteral : public NullaryNode +{ + public: + RegExpLiteral(ObjectBox* reobj, const TokenPos& pos) + : NullaryNode(PNK_REGEXP, JSOP_REGEXP, pos) + { + pn_objbox = reobj; + } + + ObjectBox* objbox() const { return pn_objbox; } + + static bool test(const ParseNode& node) { + bool match = node.isKind(PNK_REGEXP); + MOZ_ASSERT_IF(match, node.isArity(PN_NULLARY)); + MOZ_ASSERT_IF(match, node.isOp(JSOP_REGEXP)); + return match; + } +}; + +class PropertyAccess : public ParseNode +{ + public: + PropertyAccess(ParseNode* lhs, PropertyName* name, uint32_t begin, uint32_t end) + : ParseNode(PNK_DOT, JSOP_NOP, PN_NAME, TokenPos(begin, end)) + { + MOZ_ASSERT(lhs != nullptr); + MOZ_ASSERT(name != nullptr); + pn_u.name.expr = lhs; + pn_u.name.atom = name; + } + + static bool test(const ParseNode& node) { + bool match = node.isKind(PNK_DOT); + MOZ_ASSERT_IF(match, node.isArity(PN_NAME)); + return match; + } + + ParseNode& expression() const { + return *pn_u.name.expr; + } + + PropertyName& name() const { + return *pn_u.name.atom->asPropertyName(); + } + + bool isSuper() const { + // PNK_SUPERBASE cannot result from any expression syntax. + return expression().isKind(PNK_SUPERBASE); + } +}; + +class PropertyByValue : public ParseNode +{ + public: + PropertyByValue(ParseNode* lhs, ParseNode* propExpr, uint32_t begin, uint32_t end) + : ParseNode(PNK_ELEM, JSOP_NOP, PN_BINARY, TokenPos(begin, end)) + { + pn_u.binary.left = lhs; + pn_u.binary.right = propExpr; + } + + static bool test(const ParseNode& node) { + bool match = node.isKind(PNK_ELEM); + MOZ_ASSERT_IF(match, node.isArity(PN_BINARY)); + return match; + } + + bool isSuper() const { + return pn_left->isKind(PNK_SUPERBASE); + } +}; + +/* + * A CallSiteNode represents the implicit call site object argument in a TaggedTemplate. + */ +struct CallSiteNode : public ListNode { + explicit CallSiteNode(uint32_t begin): ListNode(PNK_CALLSITEOBJ, TokenPos(begin, begin + 1)) {} + + static bool test(const ParseNode& node) { + return node.isKind(PNK_CALLSITEOBJ); + } + + MOZ_MUST_USE bool getRawArrayValue(ExclusiveContext* cx, MutableHandleValue vp) { + return pn_head->getConstantValue(cx, AllowObjects, vp); + } +}; + +struct ClassMethod : public BinaryNode { + /* + * Method defintions often keep a name and function body that overlap, + * so explicitly define the beginning and end here. + */ + ClassMethod(ParseNode* name, ParseNode* body, JSOp op, bool isStatic) + : BinaryNode(PNK_CLASSMETHOD, op, TokenPos(name->pn_pos.begin, body->pn_pos.end), name, body) + { + pn_u.binary.isStatic = isStatic; + } + + static bool test(const ParseNode& node) { + bool match = node.isKind(PNK_CLASSMETHOD); + MOZ_ASSERT_IF(match, node.isArity(PN_BINARY)); + return match; + } + + ParseNode& name() const { + return *pn_u.binary.left; + } + ParseNode& method() const { + return *pn_u.binary.right; + } + bool isStatic() const { + return pn_u.binary.isStatic; + } +}; + +struct ClassNames : public BinaryNode { + ClassNames(ParseNode* outerBinding, ParseNode* innerBinding, const TokenPos& pos) + : BinaryNode(PNK_CLASSNAMES, JSOP_NOP, pos, outerBinding, innerBinding) + { + MOZ_ASSERT_IF(outerBinding, outerBinding->isKind(PNK_NAME)); + MOZ_ASSERT(innerBinding->isKind(PNK_NAME)); + MOZ_ASSERT_IF(outerBinding, innerBinding->pn_atom == outerBinding->pn_atom); + } + + static bool test(const ParseNode& node) { + bool match = node.isKind(PNK_CLASSNAMES); + MOZ_ASSERT_IF(match, node.isArity(PN_BINARY)); + return match; + } + + /* + * Classes require two definitions: The first "outer" binding binds the + * class into the scope in which it was declared. the outer binding is a + * mutable lexial binding. The second "inner" binding binds the class by + * name inside a block in which the methods are evaulated. It is immutable, + * giving the methods access to the static members of the class even if + * the outer binding has been overwritten. + */ + ParseNode* outerBinding() const { + return pn_u.binary.left; + } + ParseNode* innerBinding() const { + return pn_u.binary.right; + } +}; + +struct ClassNode : public TernaryNode { + ClassNode(ParseNode* names, ParseNode* heritage, ParseNode* methodsOrBlock) + : TernaryNode(PNK_CLASS, JSOP_NOP, names, heritage, methodsOrBlock) + { + MOZ_ASSERT_IF(names, names->is<ClassNames>()); + MOZ_ASSERT(methodsOrBlock->is<LexicalScopeNode>() || + methodsOrBlock->isKind(PNK_CLASSMETHODLIST)); + } + + static bool test(const ParseNode& node) { + bool match = node.isKind(PNK_CLASS); + MOZ_ASSERT_IF(match, node.isArity(PN_TERNARY)); + return match; + } + + ClassNames* names() const { + return pn_kid1 ? &pn_kid1->as<ClassNames>() : nullptr; + } + ParseNode* heritage() const { + return pn_kid2; + } + ParseNode* methodList() const { + if (pn_kid3->isKind(PNK_CLASSMETHODLIST)) + return pn_kid3; + + MOZ_ASSERT(pn_kid3->is<LexicalScopeNode>()); + ParseNode* list = pn_kid3->scopeBody(); + MOZ_ASSERT(list->isKind(PNK_CLASSMETHODLIST)); + return list; + } + Handle<LexicalScope::Data*> scopeBindings() const { + MOZ_ASSERT(pn_kid3->is<LexicalScopeNode>()); + return pn_kid3->scopeBindings(); + } +}; + +#ifdef DEBUG +void DumpParseTree(ParseNode* pn, int indent = 0); +#endif + +class ParseNodeAllocator +{ + public: + explicit ParseNodeAllocator(ExclusiveContext* cx, LifoAlloc& alloc) + : cx(cx), alloc(alloc), freelist(nullptr) + {} + + void* allocNode(); + void freeNode(ParseNode* pn); + ParseNode* freeTree(ParseNode* pn); + void prepareNodeForMutation(ParseNode* pn); + + private: + ExclusiveContext* cx; + LifoAlloc& alloc; + ParseNode* freelist; +}; + +inline bool +ParseNode::isConstant() +{ + switch (pn_type) { + case PNK_NUMBER: + case PNK_STRING: + case PNK_TEMPLATE_STRING: + case PNK_NULL: + case PNK_FALSE: + case PNK_TRUE: + return true; + case PNK_ARRAY: + case PNK_OBJECT: + MOZ_ASSERT(isOp(JSOP_NEWINIT)); + return !(pn_xflags & PNX_NONCONST); + default: + return false; + } +} + +class ObjectBox +{ + public: + JSObject* object; + + ObjectBox(JSObject* object, ObjectBox* traceLink); + bool isFunctionBox() { return object->is<JSFunction>(); } + FunctionBox* asFunctionBox(); + virtual void trace(JSTracer* trc); + + static void TraceList(JSTracer* trc, ObjectBox* listHead); + + protected: + friend struct CGObjectList; + + ObjectBox* traceLink; + ObjectBox* emitLink; + + ObjectBox(JSFunction* function, ObjectBox* traceLink); +}; + +enum ParseReportKind +{ + ParseError, + ParseWarning, + ParseExtraWarning, + ParseStrictError +}; + +enum FunctionSyntaxKind +{ + Expression, + Statement, + Arrow, + Method, + ClassConstructor, + DerivedClassConstructor, + Getter, + GetterNoExpressionClosure, + Setter, + SetterNoExpressionClosure +}; + +static inline bool +IsConstructorKind(FunctionSyntaxKind kind) +{ + return kind == ClassConstructor || kind == DerivedClassConstructor; +} + +static inline bool +IsGetterKind(FunctionSyntaxKind kind) +{ + return kind == Getter || kind == GetterNoExpressionClosure; +} + +static inline bool +IsSetterKind(FunctionSyntaxKind kind) +{ + return kind == Setter || kind == SetterNoExpressionClosure; +} + +static inline bool +IsMethodDefinitionKind(FunctionSyntaxKind kind) +{ + return kind == Method || IsConstructorKind(kind) || + IsGetterKind(kind) || IsSetterKind(kind); +} + +static inline ParseNode* +FunctionFormalParametersList(ParseNode* fn, unsigned* numFormals) +{ + MOZ_ASSERT(fn->isKind(PNK_FUNCTION)); + ParseNode* argsBody = fn->pn_body; + MOZ_ASSERT(argsBody->isKind(PNK_PARAMSBODY)); + *numFormals = argsBody->pn_count; + if (*numFormals > 0 && + argsBody->last()->isKind(PNK_LEXICALSCOPE) && + argsBody->last()->scopeBody()->isKind(PNK_STATEMENTLIST)) + { + (*numFormals)--; + } + MOZ_ASSERT(argsBody->isArity(PN_LIST)); + return argsBody->pn_head; +} + +} /* namespace frontend */ +} /* namespace js */ + +#endif /* frontend_ParseNode_h */ diff --git a/js/src/frontend/Parser.cpp b/js/src/frontend/Parser.cpp new file mode 100644 index 000000000..49fef2bf9 --- /dev/null +++ b/js/src/frontend/Parser.cpp @@ -0,0 +1,9627 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- + * vim: set ts=8 sts=4 et sw=4 tw=99: + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/* + * JS parser. + * + * This is a recursive-descent parser for the JavaScript language specified by + * "The ECMAScript Language Specification" (Standard ECMA-262). It uses + * lexical and semantic feedback to disambiguate non-LL(1) structures. It + * generates trees of nodes induced by the recursive parsing (not precise + * syntax trees, see Parser.h). After tree construction, it rewrites trees to + * fold constants and evaluate compile-time expressions. + * + * This parser attempts no error recovery. + */ + +#include "frontend/Parser.h" + +#include "jsapi.h" +#include "jsatom.h" +#include "jscntxt.h" +#include "jsfun.h" +#include "jsopcode.h" +#include "jsscript.h" +#include "jstypes.h" + +#include "builtin/ModuleObject.h" +#include "builtin/SelfHostingDefines.h" +#include "frontend/BytecodeCompiler.h" +#include "frontend/FoldConstants.h" +#include "frontend/TokenStream.h" +#include "wasm/AsmJS.h" + +#include "jsatominlines.h" +#include "jsscriptinlines.h" + +#include "frontend/ParseNode-inl.h" +#include "vm/EnvironmentObject-inl.h" + +using namespace js; +using namespace js::gc; + +using mozilla::Maybe; +using mozilla::Move; +using mozilla::Nothing; +using mozilla::PodCopy; +using mozilla::PodZero; +using mozilla::Some; + +using JS::AutoGCRooter; + +namespace js { +namespace frontend { + +using DeclaredNamePtr = ParseContext::Scope::DeclaredNamePtr; +using AddDeclaredNamePtr = ParseContext::Scope::AddDeclaredNamePtr; +using BindingIter = ParseContext::Scope::BindingIter; +using UsedNamePtr = UsedNameTracker::UsedNameMap::Ptr; + +/* Read a token. Report an error and return null() if that token isn't of type tt. */ +#define MUST_MATCH_TOKEN_MOD(tt, modifier, errno) \ + JS_BEGIN_MACRO \ + TokenKind token; \ + if (!tokenStream.getToken(&token, modifier)) \ + return null(); \ + if (token != tt) { \ + report(ParseError, false, null(), errno); \ + return null(); \ + } \ + JS_END_MACRO + +#define MUST_MATCH_TOKEN(tt, errno) MUST_MATCH_TOKEN_MOD(tt, TokenStream::None, errno) + +template <class T, class U> +static inline void +PropagateTransitiveParseFlags(const T* inner, U* outer) +{ + if (inner->bindingsAccessedDynamically()) + outer->setBindingsAccessedDynamically(); + if (inner->hasDebuggerStatement()) + outer->setHasDebuggerStatement(); + if (inner->hasDirectEval()) + outer->setHasDirectEval(); +} + +static const char* +DeclarationKindString(DeclarationKind kind) +{ + switch (kind) { + case DeclarationKind::PositionalFormalParameter: + case DeclarationKind::FormalParameter: + return "formal parameter"; + case DeclarationKind::CoverArrowParameter: + return "cover arrow parameter"; + case DeclarationKind::Var: + return "var"; + case DeclarationKind::Let: + return "let"; + case DeclarationKind::Const: + return "const"; + case DeclarationKind::Import: + return "import"; + case DeclarationKind::BodyLevelFunction: + case DeclarationKind::LexicalFunction: + return "function"; + case DeclarationKind::VarForAnnexBLexicalFunction: + return "annex b var"; + case DeclarationKind::ForOfVar: + return "var in for-of"; + case DeclarationKind::SimpleCatchParameter: + case DeclarationKind::CatchParameter: + return "catch parameter"; + } + + MOZ_CRASH("Bad DeclarationKind"); +} + +static bool +StatementKindIsBraced(StatementKind kind) +{ + return kind == StatementKind::Block || + kind == StatementKind::Switch || + kind == StatementKind::Try || + kind == StatementKind::Catch || + kind == StatementKind::Finally; +} + +void +ParseContext::Scope::dump(ParseContext* pc) +{ + ExclusiveContext* cx = pc->sc()->context; + + fprintf(stdout, "ParseScope %p", this); + + fprintf(stdout, "\n decls:\n"); + for (DeclaredNameMap::Range r = declared_->all(); !r.empty(); r.popFront()) { + JSAutoByteString bytes; + if (!AtomToPrintableString(cx, r.front().key(), &bytes)) + return; + DeclaredNameInfo& info = r.front().value().wrapped; + fprintf(stdout, " %s %s%s\n", + DeclarationKindString(info.kind()), + bytes.ptr(), + info.closedOver() ? " (closed over)" : ""); + } + + fprintf(stdout, "\n"); +} + +/* static */ void +ParseContext::Scope::removeVarForAnnexBLexicalFunction(ParseContext* pc, JSAtom* name) +{ + // Local strict mode is allowed, e.g., a class binding removing a + // synthesized Annex B binding. + MOZ_ASSERT(!pc->sc()->strictScript); + + for (ParseContext::Scope* scope = pc->innermostScope(); + scope != pc->varScope().enclosing(); + scope = scope->enclosing()) + { + if (DeclaredNamePtr p = scope->declared_->lookup(name)) { + if (p->value()->kind() == DeclarationKind::VarForAnnexBLexicalFunction) + scope->declared_->remove(p); + } + } + + // Annex B semantics no longer applies to any functions with this name, as + // an early error would have occurred. + pc->removeInnerFunctionBoxesForAnnexB(name); +} + +static bool +DeclarationKindIsCatchParameter(DeclarationKind kind) +{ + return kind == DeclarationKind::SimpleCatchParameter || + kind == DeclarationKind::CatchParameter; +} + +bool +ParseContext::Scope::addCatchParameters(ParseContext* pc, Scope& catchParamScope) +{ + if (pc->useAsmOrInsideUseAsm()) + return true; + + for (DeclaredNameMap::Range r = catchParamScope.declared_->all(); !r.empty(); r.popFront()) { + DeclarationKind kind = r.front().value()->kind(); + MOZ_ASSERT(DeclarationKindIsCatchParameter(kind)); + JSAtom* name = r.front().key(); + AddDeclaredNamePtr p = lookupDeclaredNameForAdd(name); + MOZ_ASSERT(!p); + if (!addDeclaredName(pc, p, name, kind)) + return false; + } + + return true; +} + +void +ParseContext::Scope::removeCatchParameters(ParseContext* pc, Scope& catchParamScope) +{ + if (pc->useAsmOrInsideUseAsm()) + return; + + for (DeclaredNameMap::Range r = catchParamScope.declared_->all(); !r.empty(); r.popFront()) { + DeclaredNamePtr p = declared_->lookup(r.front().key()); + MOZ_ASSERT(p); + + // This check is needed because the catch body could have declared + // vars, which would have been added to catchParamScope. + if (DeclarationKindIsCatchParameter(r.front().value()->kind())) + declared_->remove(p); + } +} + +void +SharedContext::computeAllowSyntax(Scope* scope) +{ + for (ScopeIter si(scope); si; si++) { + if (si.kind() == ScopeKind::Function) { + JSFunction* fun = si.scope()->as<FunctionScope>().canonicalFunction(); + if (fun->isArrow()) + continue; + allowNewTarget_ = true; + allowSuperProperty_ = fun->allowSuperProperty(); + allowSuperCall_ = fun->isDerivedClassConstructor(); + return; + } + } +} + +void +SharedContext::computeThisBinding(Scope* scope) +{ + for (ScopeIter si(scope); si; si++) { + if (si.kind() == ScopeKind::Module) { + thisBinding_ = ThisBinding::Module; + return; + } + + if (si.kind() == ScopeKind::Function) { + JSFunction* fun = si.scope()->as<FunctionScope>().canonicalFunction(); + + // Arrow functions and generator expression lambdas don't have + // their own `this` binding. + if (fun->isArrow() || fun->nonLazyScript()->isGeneratorExp()) + continue; + + // Derived class constructors (including nested arrow functions and + // eval) need TDZ checks when accessing |this|. + if (fun->isDerivedClassConstructor()) + needsThisTDZChecks_ = true; + + thisBinding_ = ThisBinding::Function; + return; + } + } + + thisBinding_ = ThisBinding::Global; +} + +void +SharedContext::computeInWith(Scope* scope) +{ + for (ScopeIter si(scope); si; si++) { + if (si.kind() == ScopeKind::With) { + inWith_ = true; + break; + } + } +} + +EvalSharedContext::EvalSharedContext(ExclusiveContext* cx, JSObject* enclosingEnv, + Scope* enclosingScope, Directives directives, + bool extraWarnings) + : SharedContext(cx, Kind::Eval, directives, extraWarnings), + enclosingScope_(cx, enclosingScope), + bindings(cx) +{ + computeAllowSyntax(enclosingScope); + computeInWith(enclosingScope); + computeThisBinding(enclosingScope); + + // Like all things Debugger, Debugger.Frame.eval needs special + // handling. Since the environment chain of such evals are non-syntactic + // (DebuggerEnvironmentProxy is not an EnvironmentObject), computing the + // this binding with respect to enclosingScope is incorrect if the + // Debugger.Frame is a function frame. Recompute the this binding if we + // are such an eval. + if (enclosingEnv && enclosingScope->hasOnChain(ScopeKind::NonSyntactic)) { + // For Debugger.Frame.eval with bindings, the environment chain may + // have more than the DebugEnvironmentProxy. + JSObject* env = enclosingEnv; + while (env) { + if (env->is<DebugEnvironmentProxy>()) + env = &env->as<DebugEnvironmentProxy>().environment(); + + if (env->is<CallObject>()) { + computeThisBinding(env->as<CallObject>().callee().nonLazyScript()->bodyScope()); + break; + } + + env = env->enclosingEnvironment(); + } + } +} + +bool +ParseContext::init() +{ + if (scriptId_ == UINT32_MAX) { + tokenStream_.reportError(JSMSG_NEED_DIET, js_script_str); + return false; + } + + ExclusiveContext* cx = sc()->context; + + if (isFunctionBox()) { + // Named lambdas always need a binding for their own name. If this + // binding is closed over when we finish parsing the function in + // finishExtraFunctionScopes, the function box needs to be marked as + // needing a dynamic DeclEnv object. + RootedFunction fun(cx, functionBox()->function()); + if (fun->isNamedLambda()) { + if (!namedLambdaScope_->init(this)) + return false; + AddDeclaredNamePtr p = namedLambdaScope_->lookupDeclaredNameForAdd(fun->name()); + MOZ_ASSERT(!p); + if (!namedLambdaScope_->addDeclaredName(this, p, fun->name(), DeclarationKind::Const)) + return false; + } + + if (!functionScope_->init(this)) + return false; + + if (!positionalFormalParameterNames_.acquire(cx)) + return false; + } + + if (!closedOverBindingsForLazy_.acquire(cx)) + return false; + + if (!sc()->strict()) { + if (!innerFunctionBoxesForAnnexB_.acquire(cx)) + return false; + } + + return true; +} + +bool +ParseContext::addInnerFunctionBoxForAnnexB(FunctionBox* funbox) +{ + for (uint32_t i = 0; i < innerFunctionBoxesForAnnexB_->length(); i++) { + if (!innerFunctionBoxesForAnnexB_[i]) { + innerFunctionBoxesForAnnexB_[i] = funbox; + return true; + } + } + return innerFunctionBoxesForAnnexB_->append(funbox); +} + +void +ParseContext::removeInnerFunctionBoxesForAnnexB(JSAtom* name) +{ + for (uint32_t i = 0; i < innerFunctionBoxesForAnnexB_->length(); i++) { + if (FunctionBox* funbox = innerFunctionBoxesForAnnexB_[i]) { + if (funbox->function()->name() == name) + innerFunctionBoxesForAnnexB_[i] = nullptr; + } + } +} + +void +ParseContext::finishInnerFunctionBoxesForAnnexB() +{ + // Strict mode doesn't have wack Annex B function semantics. Or we + // could've failed to initialize ParseContext. + if (sc()->strict() || !innerFunctionBoxesForAnnexB_) + return; + + for (uint32_t i = 0; i < innerFunctionBoxesForAnnexB_->length(); i++) { + if (FunctionBox* funbox = innerFunctionBoxesForAnnexB_[i]) + funbox->isAnnexB = true; + } +} + +ParseContext::~ParseContext() +{ + // Any funboxes still in the list at the end of parsing means no early + // error would have occurred for declaring a binding in the nearest var + // scope. Mark them as needing extra assignments to this var binding. + finishInnerFunctionBoxesForAnnexB(); +} + +bool +UsedNameTracker::noteUse(ExclusiveContext* cx, JSAtom* name, uint32_t scriptId, uint32_t scopeId) +{ + if (UsedNameMap::AddPtr p = map_.lookupForAdd(name)) { + if (!p->value().noteUsedInScope(scriptId, scopeId)) + return false; + } else { + UsedNameInfo info(cx); + if (!info.noteUsedInScope(scriptId, scopeId)) + return false; + if (!map_.add(p, name, Move(info))) + return false; + } + + return true; +} + +void +UsedNameTracker::UsedNameInfo::resetToScope(uint32_t scriptId, uint32_t scopeId) +{ + while (!uses_.empty()) { + Use& innermost = uses_.back(); + if (innermost.scopeId < scopeId) + break; + MOZ_ASSERT(innermost.scriptId >= scriptId); + uses_.popBack(); + } +} + +void +UsedNameTracker::rewind(RewindToken token) +{ + scriptCounter_ = token.scriptId; + scopeCounter_ = token.scopeId; + + for (UsedNameMap::Range r = map_.all(); !r.empty(); r.popFront()) + r.front().value().resetToScope(token.scriptId, token.scopeId); +} + +FunctionBox::FunctionBox(ExclusiveContext* cx, LifoAlloc& alloc, ObjectBox* traceListHead, + JSFunction* fun, Directives directives, bool extraWarnings, + GeneratorKind generatorKind, FunctionAsyncKind asyncKind) + : ObjectBox(fun, traceListHead), + SharedContext(cx, Kind::ObjectBox, directives, extraWarnings), + enclosingScope_(nullptr), + namedLambdaBindings_(nullptr), + functionScopeBindings_(nullptr), + extraVarScopeBindings_(nullptr), + functionNode(nullptr), + bufStart(0), + bufEnd(0), + startLine(1), + startColumn(0), + length(0), + generatorKindBits_(GeneratorKindAsBits(generatorKind)), + asyncKindBits_(AsyncKindAsBits(asyncKind)), + isGenexpLambda(false), + hasDestructuringArgs(false), + hasParameterExprs(false), + hasDirectEvalInParameterExpr(false), + hasDuplicateParameters(false), + useAsm(false), + insideUseAsm(false), + isAnnexB(false), + wasEmitted(false), + declaredArguments(false), + usesArguments(false), + usesApply(false), + usesThis(false), + usesReturn(false), + funCxFlags() +{ + // Functions created at parse time may be set singleton after parsing and + // baked into JIT code, so they must be allocated tenured. They are held by + // the JSScript so cannot be collected during a minor GC anyway. + MOZ_ASSERT(fun->isTenured()); +} + +void +FunctionBox::initFromLazyFunction() +{ + JSFunction* fun = function(); + length = fun->nargs() - fun->hasRest(); + if (fun->lazyScript()->isDerivedClassConstructor()) + setDerivedClassConstructor(); + if (fun->lazyScript()->needsHomeObject()) + setNeedsHomeObject(); + enclosingScope_ = fun->lazyScript()->enclosingScope(); + initWithEnclosingScope(enclosingScope_); +} + +void +FunctionBox::initStandaloneFunction(Scope* enclosingScope) +{ + // Standalone functions are Function or Generator constructors and are + // always scoped to the global. + MOZ_ASSERT(enclosingScope->is<GlobalScope>()); + JSFunction* fun = function(); + length = fun->nargs() - fun->hasRest(); + enclosingScope_ = enclosingScope; + allowNewTarget_ = true; + thisBinding_ = ThisBinding::Function; +} + +void +FunctionBox::initWithEnclosingParseContext(ParseContext* enclosing, FunctionSyntaxKind kind) +{ + SharedContext* sc = enclosing->sc(); + useAsm = sc->isFunctionBox() && sc->asFunctionBox()->useAsmOrInsideUseAsm(); + + JSFunction* fun = function(); + + // Arrow functions and generator expression lambdas don't have + // their own `this` binding. + if (fun->isArrow()) { + allowNewTarget_ = sc->allowNewTarget(); + allowSuperProperty_ = sc->allowSuperProperty(); + allowSuperCall_ = sc->allowSuperCall(); + needsThisTDZChecks_ = sc->needsThisTDZChecks(); + thisBinding_ = sc->thisBinding(); + } else { + allowNewTarget_ = true; + allowSuperProperty_ = fun->allowSuperProperty(); + + if (kind == DerivedClassConstructor) { + setDerivedClassConstructor(); + allowSuperCall_ = true; + needsThisTDZChecks_ = true; + } + + if (isGenexpLambda) + thisBinding_ = sc->thisBinding(); + else + thisBinding_ = ThisBinding::Function; + } + + if (sc->inWith()) { + inWith_ = true; + } else { + auto isWith = [](ParseContext::Statement* stmt) { + return stmt->kind() == StatementKind::With; + }; + + inWith_ = enclosing->findInnermostStatement(isWith); + } +} + +void +FunctionBox::initWithEnclosingScope(Scope* enclosingScope) +{ + if (!function()->isArrow()) { + allowNewTarget_ = true; + allowSuperProperty_ = function()->allowSuperProperty(); + + if (isDerivedClassConstructor()) { + setDerivedClassConstructor(); + allowSuperCall_ = true; + needsThisTDZChecks_ = true; + } + + thisBinding_ = ThisBinding::Function; + } else { + computeAllowSyntax(enclosingScope); + computeThisBinding(enclosingScope); + } + + computeInWith(enclosingScope); +} + +template <typename ParseHandler> +bool +Parser<ParseHandler>::reportHelper(ParseReportKind kind, bool strict, uint32_t offset, + unsigned errorNumber, va_list args) +{ + bool result = false; + switch (kind) { + case ParseError: + result = tokenStream.reportCompileErrorNumberVA(offset, JSREPORT_ERROR, errorNumber, args); + break; + case ParseWarning: + result = + tokenStream.reportCompileErrorNumberVA(offset, JSREPORT_WARNING, errorNumber, args); + break; + case ParseExtraWarning: + result = tokenStream.reportStrictWarningErrorNumberVA(offset, errorNumber, args); + break; + case ParseStrictError: + result = tokenStream.reportStrictModeErrorNumberVA(offset, strict, errorNumber, args); + break; + } + return result; +} + +template <typename ParseHandler> +bool +Parser<ParseHandler>::report(ParseReportKind kind, bool strict, Node pn, unsigned errorNumber, ...) +{ + uint32_t offset = (pn ? handler.getPosition(pn) : pos()).begin; + + va_list args; + va_start(args, errorNumber); + bool result = reportHelper(kind, strict, offset, errorNumber, args); + va_end(args); + return result; +} + +template <typename ParseHandler> +bool +Parser<ParseHandler>::reportNoOffset(ParseReportKind kind, bool strict, unsigned errorNumber, ...) +{ + va_list args; + va_start(args, errorNumber); + bool result = reportHelper(kind, strict, TokenStream::NoOffset, errorNumber, args); + va_end(args); + return result; +} + +template <typename ParseHandler> +bool +Parser<ParseHandler>::reportWithOffset(ParseReportKind kind, bool strict, uint32_t offset, + unsigned errorNumber, ...) +{ + va_list args; + va_start(args, errorNumber); + bool result = reportHelper(kind, strict, offset, errorNumber, args); + va_end(args); + return result; +} + +template <> +bool +Parser<FullParseHandler>::abortIfSyntaxParser() +{ + handler.disableSyntaxParser(); + return true; +} + +template <> +bool +Parser<SyntaxParseHandler>::abortIfSyntaxParser() +{ + abortedSyntaxParse = true; + return false; +} + +template <typename ParseHandler> +Parser<ParseHandler>::Parser(ExclusiveContext* cx, LifoAlloc& alloc, + const ReadOnlyCompileOptions& options, + const char16_t* chars, size_t length, + bool foldConstants, + UsedNameTracker& usedNames, + Parser<SyntaxParseHandler>* syntaxParser, + LazyScript* lazyOuterFunction) + : AutoGCRooter(cx, PARSER), + context(cx), + alloc(alloc), + tokenStream(cx, options, chars, length, thisForCtor()), + traceListHead(nullptr), + pc(nullptr), + usedNames(usedNames), + sct(nullptr), + ss(nullptr), + keepAtoms(cx->perThreadData), + foldConstants(foldConstants), +#ifdef DEBUG + checkOptionsCalled(false), +#endif + abortedSyntaxParse(false), + isUnexpectedEOF_(false), + handler(cx, alloc, tokenStream, syntaxParser, lazyOuterFunction) +{ + cx->perThreadData->frontendCollectionPool.addActiveCompilation(); + + // The Mozilla specific JSOPTION_EXTRA_WARNINGS option adds extra warnings + // which are not generated if functions are parsed lazily. Note that the + // standard "use strict" does not inhibit lazy parsing. + if (options.extraWarningsOption) + handler.disableSyntaxParser(); + + tempPoolMark = alloc.mark(); +} + +template<typename ParseHandler> +bool +Parser<ParseHandler>::checkOptions() +{ +#ifdef DEBUG + checkOptionsCalled = true; +#endif + + if (!tokenStream.checkOptions()) + return false; + + return true; +} + +template <typename ParseHandler> +Parser<ParseHandler>::~Parser() +{ + MOZ_ASSERT(checkOptionsCalled); + alloc.release(tempPoolMark); + + /* + * The parser can allocate enormous amounts of memory for large functions. + * Eagerly free the memory now (which otherwise won't be freed until the + * next GC) to avoid unnecessary OOMs. + */ + alloc.freeAllIfHugeAndUnused(); + + context->perThreadData->frontendCollectionPool.removeActiveCompilation(); +} + +template <typename ParseHandler> +ObjectBox* +Parser<ParseHandler>::newObjectBox(JSObject* obj) +{ + MOZ_ASSERT(obj); + + /* + * We use JSContext.tempLifoAlloc to allocate parsed objects and place them + * on a list in this Parser to ensure GC safety. Thus the tempLifoAlloc + * arenas containing the entries must be alive until we are done with + * scanning, parsing and code generation for the whole script or top-level + * function. + */ + + ObjectBox* objbox = alloc.new_<ObjectBox>(obj, traceListHead); + if (!objbox) { + ReportOutOfMemory(context); + return nullptr; + } + + traceListHead = objbox; + + return objbox; +} + +template <typename ParseHandler> +FunctionBox* +Parser<ParseHandler>::newFunctionBox(Node fn, JSFunction* fun, Directives inheritedDirectives, + GeneratorKind generatorKind, FunctionAsyncKind asyncKind, + bool tryAnnexB) +{ + MOZ_ASSERT(fun); + MOZ_ASSERT_IF(tryAnnexB, !pc->sc()->strict()); + + /* + * We use JSContext.tempLifoAlloc to allocate parsed objects and place them + * on a list in this Parser to ensure GC safety. Thus the tempLifoAlloc + * arenas containing the entries must be alive until we are done with + * scanning, parsing and code generation for the whole script or top-level + * function. + */ + FunctionBox* funbox = + alloc.new_<FunctionBox>(context, alloc, traceListHead, fun, inheritedDirectives, + options().extraWarningsOption, generatorKind, asyncKind); + if (!funbox) { + ReportOutOfMemory(context); + return nullptr; + } + + traceListHead = funbox; + if (fn) + handler.setFunctionBox(fn, funbox); + + if (tryAnnexB && !pc->addInnerFunctionBoxForAnnexB(funbox)) + return nullptr; + + return funbox; +} + +ModuleSharedContext::ModuleSharedContext(ExclusiveContext* cx, ModuleObject* module, + Scope* enclosingScope, ModuleBuilder& builder) + : SharedContext(cx, Kind::Module, Directives(true), false), + module_(cx, module), + enclosingScope_(cx, enclosingScope), + bindings(cx), + builder(builder) +{ + thisBinding_ = ThisBinding::Module; +} + +template <typename ParseHandler> +void +Parser<ParseHandler>::trace(JSTracer* trc) +{ + ObjectBox::TraceList(trc, traceListHead); +} + +void +MarkParser(JSTracer* trc, AutoGCRooter* parser) +{ + static_cast<Parser<FullParseHandler>*>(parser)->trace(trc); +} + +/* + * Parse a top-level JS script. + */ +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::parse() +{ + MOZ_ASSERT(checkOptionsCalled); + + Directives directives(options().strictOption); + GlobalSharedContext globalsc(context, ScopeKind::Global, + directives, options().extraWarningsOption); + ParseContext globalpc(this, &globalsc, /* newDirectives = */ nullptr); + if (!globalpc.init()) + return null(); + + ParseContext::VarScope varScope(this); + if (!varScope.init(pc)) + return null(); + + Node pn = statementList(YieldIsName); + if (!pn) + return null(); + + TokenKind tt; + if (!tokenStream.getToken(&tt, TokenStream::Operand)) + return null(); + if (tt != TOK_EOF) { + report(ParseError, false, null(), JSMSG_GARBAGE_AFTER_INPUT, + "script", TokenKindToDesc(tt)); + return null(); + } + if (foldConstants) { + if (!FoldConstants(context, &pn, this)) + return null(); + } + + return pn; +} + +template <typename ParseHandler> +bool +Parser<ParseHandler>::reportBadReturn(Node pn, ParseReportKind kind, + unsigned errnum, unsigned anonerrnum) +{ + JSAutoByteString name; + if (JSAtom* atom = pc->functionBox()->function()->name()) { + if (!AtomToPrintableString(context, atom, &name)) + return false; + } else { + errnum = anonerrnum; + } + return report(kind, pc->sc()->strict(), pn, errnum, name.ptr()); +} + +/* + * Strict mode forbids introducing new definitions for 'eval', 'arguments', or + * for any strict mode reserved keyword. + */ +template <typename ParseHandler> +bool +Parser<ParseHandler>::isValidStrictBinding(PropertyName* name) +{ + return name != context->names().eval && + name != context->names().arguments && + name != context->names().let && + name != context->names().static_ && + !(IsKeyword(name) && name != context->names().await); +} + +/* + * Check that it is permitted to introduce a binding for |name|. Use |pos| for + * reporting error locations. + */ +template <typename ParseHandler> +bool +Parser<ParseHandler>::checkStrictBinding(PropertyName* name, TokenPos pos) +{ + if (!pc->sc()->needStrictChecks()) + return true; + + if (!isValidStrictBinding(name)) { + JSAutoByteString bytes; + if (!AtomToPrintableString(context, name, &bytes)) + return false; + return reportWithOffset(ParseStrictError, pc->sc()->strict(), pos.begin, + JSMSG_BAD_BINDING, bytes.ptr()); + } + + return true; +} + +/* + * Returns true if all parameter names are valid strict mode binding names and + * no duplicate parameter names are present. + */ +template <typename ParseHandler> +bool +Parser<ParseHandler>::hasValidSimpleStrictParameterNames() +{ + MOZ_ASSERT(pc->isFunctionBox() && pc->functionBox()->hasSimpleParameterList()); + + if (pc->functionBox()->hasDuplicateParameters) + return false; + + for (size_t i = 0; i < pc->positionalFormalParameterNames().length(); i++) { + JSAtom* name = pc->positionalFormalParameterNames()[i]; + MOZ_ASSERT(name); + if (!isValidStrictBinding(name->asPropertyName())) + return false; + } + return true; +} + +template <typename ParseHandler> +void +Parser<ParseHandler>::reportRedeclaration(HandlePropertyName name, DeclarationKind kind, + TokenPos pos) +{ + JSAutoByteString bytes; + if (!AtomToPrintableString(context, name, &bytes)) + return; + reportWithOffset(ParseError, false, pos.begin, JSMSG_REDECLARED_VAR, + DeclarationKindString(kind), bytes.ptr()); +} + +// notePositionalFormalParameter is called for both the arguments of a regular +// function definition and the arguments specified by the Function +// constructor. +// +// The 'disallowDuplicateParams' bool indicates whether the use of another +// feature (destructuring or default arguments) disables duplicate arguments. +// (ECMA-262 requires us to support duplicate parameter names, but, for newer +// features, we consider the code to have "opted in" to higher standards and +// forbid duplicates.) +template <typename ParseHandler> +bool +Parser<ParseHandler>::notePositionalFormalParameter(Node fn, HandlePropertyName name, + bool disallowDuplicateParams, + bool* duplicatedParam) +{ + if (AddDeclaredNamePtr p = pc->functionScope().lookupDeclaredNameForAdd(name)) { + if (disallowDuplicateParams) { + report(ParseError, false, null(), JSMSG_BAD_DUP_ARGS); + return false; + } + + // Strict-mode disallows duplicate args. We may not know whether we are + // in strict mode or not (since the function body hasn't been parsed). + // In such cases, report will queue up the potential error and return + // 'true'. + if (pc->sc()->needStrictChecks()) { + JSAutoByteString bytes; + if (!AtomToPrintableString(context, name, &bytes)) + return false; + if (!report(ParseStrictError, pc->sc()->strict(), null(), + JSMSG_DUPLICATE_FORMAL, bytes.ptr())) + { + return false; + } + } + + *duplicatedParam = true; + } else { + DeclarationKind kind = DeclarationKind::PositionalFormalParameter; + if (!pc->functionScope().addDeclaredName(pc, p, name, kind)) + return false; + } + + if (!pc->positionalFormalParameterNames().append(name)) { + ReportOutOfMemory(context); + return false; + } + + Node paramNode = newName(name); + if (!paramNode) + return false; + + if (!checkStrictBinding(name, pos())) + return false; + + handler.addFunctionFormalParameter(fn, paramNode); + return true; +} + +template <typename ParseHandler> +bool +Parser<ParseHandler>::noteDestructuredPositionalFormalParameter(Node fn, Node destruct) +{ + // Append an empty name to the positional formals vector to keep track of + // argument slots when making FunctionScope::Data. + if (!pc->positionalFormalParameterNames().append(nullptr)) { + ReportOutOfMemory(context); + return false; + } + + handler.addFunctionFormalParameter(fn, destruct); + return true; +} + +static bool +DeclarationKindIsVar(DeclarationKind kind) +{ + return kind == DeclarationKind::Var || + kind == DeclarationKind::BodyLevelFunction || + kind == DeclarationKind::VarForAnnexBLexicalFunction || + kind == DeclarationKind::ForOfVar; +} + +template <typename ParseHandler> +Maybe<DeclarationKind> +Parser<ParseHandler>::isVarRedeclaredInEval(HandlePropertyName name, DeclarationKind kind) +{ + MOZ_ASSERT(DeclarationKindIsVar(kind)); + MOZ_ASSERT(pc->sc()->isEvalContext()); + + // In the case of eval, we also need to check enclosing VM scopes to see + // if the var declaration is allowed in the context. + // + // This check is necessary in addition to + // js::CheckEvalDeclarationConflicts because we only know during parsing + // if a var is bound by for-of. + Scope* enclosingScope = pc->sc()->compilationEnclosingScope(); + Scope* varScope = EvalScope::nearestVarScopeForDirectEval(enclosingScope); + MOZ_ASSERT(varScope); + for (ScopeIter si(enclosingScope); si; si++) { + for (js::BindingIter bi(si.scope()); bi; bi++) { + if (bi.name() != name) + continue; + + switch (bi.kind()) { + case BindingKind::Let: { + // Annex B.3.5 allows redeclaring simple (non-destructured) + // catch parameters with var declarations, except when it + // appears in a for-of. + bool annexB35Allowance = si.kind() == ScopeKind::SimpleCatch && + kind != DeclarationKind::ForOfVar; + if (!annexB35Allowance) { + return Some(ScopeKindIsCatch(si.kind()) + ? DeclarationKind::CatchParameter + : DeclarationKind::Let); + } + break; + } + + case BindingKind::Const: + return Some(DeclarationKind::Const); + + case BindingKind::Import: + case BindingKind::FormalParameter: + case BindingKind::Var: + case BindingKind::NamedLambdaCallee: + break; + } + } + + if (si.scope() == varScope) + break; + } + + return Nothing(); +} + +static bool +DeclarationKindIsParameter(DeclarationKind kind) +{ + return kind == DeclarationKind::PositionalFormalParameter || + kind == DeclarationKind::FormalParameter; +} + +template <typename ParseHandler> +bool +Parser<ParseHandler>::tryDeclareVar(HandlePropertyName name, DeclarationKind kind, + Maybe<DeclarationKind>* redeclaredKind) +{ + MOZ_ASSERT(DeclarationKindIsVar(kind)); + + // It is an early error if a 'var' declaration appears inside a + // scope contour that has a lexical declaration of the same name. For + // example, the following are early errors: + // + // { let x; var x; } + // { { var x; } let x; } + // + // And the following are not: + // + // { var x; var x; } + // { { let x; } var x; } + + for (ParseContext::Scope* scope = pc->innermostScope(); + scope != pc->varScope().enclosing(); + scope = scope->enclosing()) + { + if (AddDeclaredNamePtr p = scope->lookupDeclaredNameForAdd(name)) { + DeclarationKind declaredKind = p->value()->kind(); + if (DeclarationKindIsVar(declaredKind)) { + // Any vars that are redeclared as body-level functions must + // be recorded as body-level functions. + // + // In the case of global and eval scripts, GlobalDeclaration- + // Instantiation [1] and EvalDeclarationInstantiation [2] + // check for the declarability of global var and function + // bindings via CanDeclareVar [3] and CanDeclareGlobal- + // Function [4]. CanDeclareGlobalFunction is strictly more + // restrictive than CanDeclareGlobalVar, so record the more + // restrictive kind. These semantics are implemented in + // CheckCanDeclareGlobalBinding. + // + // For a var previously declared as ForOfVar, this previous + // DeclarationKind is used only to check for if the + // 'arguments' binding should be declared. Since body-level + // functions shadow 'arguments' [5], it is correct to alter + // the kind to BodyLevelFunction. See + // declareFunctionArgumentsObject. + // + // For a var previously declared as + // VarForAnnexBLexicalFunction, this previous DeclarationKind + // is used so that vars synthesized solely for Annex B.3.3 may + // be removed if an early error would occur. If a synthesized + // Annex B.3.3 var has the same name as a body-level function, + // this is not a redeclaration, and indeed, because the + // body-level function binds the name, this name should not be + // removed should a redeclaration occur in the future. Thus it + // is also correct to alter the kind to BodyLevelFunction. + // + // [1] ES 15.1.11 + // [2] ES 18.2.1.3 + // [3] ES 8.1.1.4.15 + // [4] ES 8.1.1.4.16 + // [5] ES 9.2.12 + if (kind == DeclarationKind::BodyLevelFunction) + p->value()->alterKind(kind); + } else if (!DeclarationKindIsParameter(declaredKind)) { + // Annex B.3.5 allows redeclaring simple (non-destructured) + // catch parameters with var declarations, except when it + // appears in a for-of. + bool annexB35Allowance = declaredKind == DeclarationKind::SimpleCatchParameter && + kind != DeclarationKind::ForOfVar; + + // Annex B.3.3 allows redeclaring functions in the same block. + bool annexB33Allowance = declaredKind == DeclarationKind::LexicalFunction && + kind == DeclarationKind::VarForAnnexBLexicalFunction && + scope == pc->innermostScope(); + + if (!annexB35Allowance && !annexB33Allowance) { + *redeclaredKind = Some(declaredKind); + return true; + } + } + } else { + if (!scope->addDeclaredName(pc, p, name, kind)) + return false; + } + } + + if (!pc->sc()->strict() && pc->sc()->isEvalContext()) + *redeclaredKind = isVarRedeclaredInEval(name, kind); + + return true; +} + +template <typename ParseHandler> +bool +Parser<ParseHandler>::tryDeclareVarForAnnexBLexicalFunction(HandlePropertyName name, + bool* tryAnnexB) +{ + Maybe<DeclarationKind> redeclaredKind; + if (!tryDeclareVar(name, DeclarationKind::VarForAnnexBLexicalFunction, &redeclaredKind)) + return false; + + if (redeclaredKind) { + // If an early error would have occurred, undo all the + // VarForAnnexBLexicalFunction declarations. + *tryAnnexB = false; + ParseContext::Scope::removeVarForAnnexBLexicalFunction(pc, name); + } else { + *tryAnnexB = true; + } + + return true; +} + +template <typename ParseHandler> +bool +Parser<ParseHandler>::checkLexicalDeclarationDirectlyWithinBlock(ParseContext::Statement& stmt, + DeclarationKind kind, + TokenPos pos) +{ + MOZ_ASSERT(DeclarationKindIsLexical(kind)); + + // It is an early error to declare a lexical binding not directly + // within a block. + if (!StatementKindIsBraced(stmt.kind()) && + stmt.kind() != StatementKind::ForLoopLexicalHead) + { + reportWithOffset(ParseError, false, pos.begin, + stmt.kind() == StatementKind::Label + ? JSMSG_LEXICAL_DECL_LABEL + : JSMSG_LEXICAL_DECL_NOT_IN_BLOCK, + DeclarationKindString(kind)); + return false; + } + + return true; +} + +template <typename ParseHandler> +bool +Parser<ParseHandler>::noteDeclaredName(HandlePropertyName name, DeclarationKind kind, + TokenPos pos) +{ + // The asm.js validator does all its own symbol-table management so, as an + // optimization, avoid doing any work here. + if (pc->useAsmOrInsideUseAsm()) + return true; + + if (!checkStrictBinding(name, pos)) + return false; + + switch (kind) { + case DeclarationKind::Var: + case DeclarationKind::BodyLevelFunction: + case DeclarationKind::ForOfVar: { + Maybe<DeclarationKind> redeclaredKind; + if (!tryDeclareVar(name, kind, &redeclaredKind)) + return false; + + if (redeclaredKind) { + reportRedeclaration(name, *redeclaredKind, pos); + return false; + } + + break; + } + + case DeclarationKind::FormalParameter: { + // It is an early error if any non-positional formal parameter name + // (e.g., destructuring formal parameter) is duplicated. + + AddDeclaredNamePtr p = pc->functionScope().lookupDeclaredNameForAdd(name); + if (p) { + report(ParseError, false, null(), JSMSG_BAD_DUP_ARGS); + return false; + } + + if (!pc->functionScope().addDeclaredName(pc, p, name, kind)) + return false; + + break; + } + + case DeclarationKind::LexicalFunction: { + // Functions in block have complex allowances in sloppy mode for being + // labelled that other lexical declarations do not have. Those checks + // are more complex than calling checkLexicalDeclarationDirectlyWithin- + // Block and are done in checkFunctionDefinition. + + ParseContext::Scope* scope = pc->innermostScope(); + if (AddDeclaredNamePtr p = scope->lookupDeclaredNameForAdd(name)) { + // It is usually an early error if there is another declaration + // with the same name in the same scope. + // + // In sloppy mode, lexical functions may redeclare other lexical + // functions for web compatibility reasons. + if (pc->sc()->strict() || + (p->value()->kind() != DeclarationKind::LexicalFunction && + p->value()->kind() != DeclarationKind::VarForAnnexBLexicalFunction)) + { + reportRedeclaration(name, p->value()->kind(), pos); + return false; + } + + // Update the DeclarationKind to make a LexicalFunction + // declaration that shadows the VarForAnnexBLexicalFunction. + p->value()->alterKind(kind); + } else { + if (!scope->addDeclaredName(pc, p, name, kind)) + return false; + } + + break; + } + + case DeclarationKind::Let: + case DeclarationKind::Const: + // The BoundNames of LexicalDeclaration and ForDeclaration must not + // contain 'let'. (CatchParameter is the only lexical binding form + // without this restriction.) + if (name == context->names().let) { + reportWithOffset(ParseError, false, pos.begin, JSMSG_LEXICAL_DECL_DEFINES_LET); + return false; + } + + MOZ_FALLTHROUGH; + + case DeclarationKind::Import: + // Module code is always strict, so 'let' is always a keyword and never a name. + MOZ_ASSERT(name != context->names().let); + MOZ_FALLTHROUGH; + + case DeclarationKind::SimpleCatchParameter: + case DeclarationKind::CatchParameter: { + if (ParseContext::Statement* stmt = pc->innermostStatement()) { + if (!checkLexicalDeclarationDirectlyWithinBlock(*stmt, kind, pos)) + return false; + } + + ParseContext::Scope* scope = pc->innermostScope(); + + // For body-level lexically declared names in a function, it is an + // early error if there is a formal parameter of the same name. This + // needs a special check if there is an extra var scope due to + // parameter expressions. + if (pc->isFunctionExtraBodyVarScopeInnermost()) { + DeclaredNamePtr p = pc->functionScope().lookupDeclaredName(name); + if (p && DeclarationKindIsParameter(p->value()->kind())) { + reportRedeclaration(name, p->value()->kind(), pos); + return false; + } + } + + // It is an early error if there is another declaration with the same + // name in the same scope. + AddDeclaredNamePtr p = scope->lookupDeclaredNameForAdd(name); + if (p) { + // If the early error would have occurred due to Annex B.3.3 + // semantics, remove the synthesized Annex B var declaration, do + // not report the redeclaration, and declare the lexical name. + if (p->value()->kind() == DeclarationKind::VarForAnnexBLexicalFunction) { + ParseContext::Scope::removeVarForAnnexBLexicalFunction(pc, name); + p = scope->lookupDeclaredNameForAdd(name); + MOZ_ASSERT(!p); + } else { + reportRedeclaration(name, p->value()->kind(), pos); + return false; + } + } + + if (!p && !scope->addDeclaredName(pc, p, name, kind)) + return false; + + break; + } + + case DeclarationKind::CoverArrowParameter: + // CoverArrowParameter is only used as a placeholder declaration kind. + break; + + case DeclarationKind::PositionalFormalParameter: + MOZ_CRASH("Positional formal parameter names should use " + "notePositionalFormalParameter"); + break; + + case DeclarationKind::VarForAnnexBLexicalFunction: + MOZ_CRASH("Synthesized Annex B vars should go through " + "tryDeclareVarForAnnexBLexicalFunction"); + break; + } + + return true; +} + +template <typename ParseHandler> +bool +Parser<ParseHandler>::noteUsedName(HandlePropertyName name) +{ + // If the we are delazifying, the LazyScript already has all the + // closed-over info for bindings and there's no need to track used names. + if (handler.canSkipLazyClosedOverBindings()) + return true; + + // The asm.js validator does all its own symbol-table management so, as an + // optimization, avoid doing any work here. + if (pc->useAsmOrInsideUseAsm()) + return true; + + // Global bindings are properties and not actual bindings; we don't need + // to know if they are closed over. So no need to track used name at the + // global scope. It is not incorrect to track them, this is an + // optimization. + ParseContext::Scope* scope = pc->innermostScope(); + if (pc->sc()->isGlobalContext() && scope == &pc->varScope()) + return true; + + return usedNames.noteUse(context, name, pc->scriptId(), scope->id()); +} + +template <typename ParseHandler> +bool +Parser<ParseHandler>::hasUsedName(HandlePropertyName name) +{ + if (UsedNamePtr p = usedNames.lookup(name)) + return p->value().isUsedInScript(pc->scriptId()); + return false; +} + +template <typename ParseHandler> +bool +Parser<ParseHandler>::propagateFreeNamesAndMarkClosedOverBindings(ParseContext::Scope& scope) +{ + if (handler.canSkipLazyClosedOverBindings()) { + // Scopes are nullptr-delimited in the LazyScript closed over bindings + // array. + while (JSAtom* name = handler.nextLazyClosedOverBinding()) + scope.lookupDeclaredName(name)->value()->setClosedOver(); + return true; + } + + bool isSyntaxParser = mozilla::IsSame<ParseHandler, SyntaxParseHandler>::value; + uint32_t scriptId = pc->scriptId(); + uint32_t scopeId = scope.id(); + for (BindingIter bi = scope.bindings(pc); bi; bi++) { + if (UsedNamePtr p = usedNames.lookup(bi.name())) { + bool closedOver; + p->value().noteBoundInScope(scriptId, scopeId, &closedOver); + if (closedOver) { + bi.setClosedOver(); + + if (isSyntaxParser && !pc->closedOverBindingsForLazy().append(bi.name())) { + ReportOutOfMemory(context); + return false; + } + } + } + } + + // Append a nullptr to denote end-of-scope. + if (isSyntaxParser && !pc->closedOverBindingsForLazy().append(nullptr)) { + ReportOutOfMemory(context); + return false; + } + + return true; +} + +template <> +bool +Parser<FullParseHandler>::checkStatementsEOF() +{ + // This is designed to be paired with parsing a statement list at the top + // level. + // + // The statementList() call breaks on TOK_RC, so make sure we've + // reached EOF here. + TokenKind tt; + if (!tokenStream.peekToken(&tt, TokenStream::Operand)) + return false; + if (tt != TOK_EOF) { + report(ParseError, false, null(), JSMSG_UNEXPECTED_TOKEN, + "expression", TokenKindToDesc(tt)); + return false; + } + return true; +} + +template <typename Scope> +static typename Scope::Data* +NewEmptyBindingData(ExclusiveContext* cx, LifoAlloc& alloc, uint32_t numBindings) +{ + size_t allocSize = Scope::sizeOfData(numBindings); + typename Scope::Data* bindings = static_cast<typename Scope::Data*>(alloc.alloc(allocSize)); + if (!bindings) { + ReportOutOfMemory(cx); + return nullptr; + } + PodZero(bindings); + return bindings; +} + +template <> +Maybe<GlobalScope::Data*> +Parser<FullParseHandler>::newGlobalScopeData(ParseContext::Scope& scope) +{ + Vector<BindingName> funs(context); + Vector<BindingName> vars(context); + Vector<BindingName> lets(context); + Vector<BindingName> consts(context); + + bool allBindingsClosedOver = pc->sc()->allBindingsClosedOver(); + for (BindingIter bi = scope.bindings(pc); bi; bi++) { + BindingName binding(bi.name(), allBindingsClosedOver || bi.closedOver()); + switch (bi.kind()) { + case BindingKind::Var: + if (bi.declarationKind() == DeclarationKind::BodyLevelFunction) { + if (!funs.append(binding)) + return Nothing(); + } else { + if (!vars.append(binding)) + return Nothing(); + } + break; + case BindingKind::Let: + if (!lets.append(binding)) + return Nothing(); + break; + case BindingKind::Const: + if (!consts.append(binding)) + return Nothing(); + break; + default: + MOZ_CRASH("Bad global scope BindingKind"); + } + } + + GlobalScope::Data* bindings = nullptr; + uint32_t numBindings = funs.length() + vars.length() + lets.length() + consts.length(); + + if (numBindings > 0) { + bindings = NewEmptyBindingData<GlobalScope>(context, alloc, numBindings); + if (!bindings) + return Nothing(); + + // The ordering here is important. See comments in GlobalScope. + BindingName* start = bindings->names; + BindingName* cursor = start; + + PodCopy(cursor, funs.begin(), funs.length()); + cursor += funs.length(); + + bindings->varStart = cursor - start; + PodCopy(cursor, vars.begin(), vars.length()); + cursor += vars.length(); + + bindings->letStart = cursor - start; + PodCopy(cursor, lets.begin(), lets.length()); + cursor += lets.length(); + + bindings->constStart = cursor - start; + PodCopy(cursor, consts.begin(), consts.length()); + bindings->length = numBindings; + } + + return Some(bindings); +} + +template <> +Maybe<ModuleScope::Data*> +Parser<FullParseHandler>::newModuleScopeData(ParseContext::Scope& scope) +{ + Vector<BindingName> imports(context); + Vector<BindingName> vars(context); + Vector<BindingName> lets(context); + Vector<BindingName> consts(context); + + bool allBindingsClosedOver = pc->sc()->allBindingsClosedOver(); + for (BindingIter bi = scope.bindings(pc); bi; bi++) { + // Imports are indirect bindings and must not be given known slots. + BindingName binding(bi.name(), (allBindingsClosedOver || bi.closedOver()) && + bi.kind() != BindingKind::Import); + switch (bi.kind()) { + case BindingKind::Import: + if (!imports.append(binding)) + return Nothing(); + break; + case BindingKind::Var: + if (!vars.append(binding)) + return Nothing(); + break; + case BindingKind::Let: + if (!lets.append(binding)) + return Nothing(); + break; + case BindingKind::Const: + if (!consts.append(binding)) + return Nothing(); + break; + default: + MOZ_CRASH("Bad module scope BindingKind"); + } + } + + ModuleScope::Data* bindings = nullptr; + uint32_t numBindings = imports.length() + vars.length() + lets.length() + consts.length(); + + if (numBindings > 0) { + bindings = NewEmptyBindingData<ModuleScope>(context, alloc, numBindings); + if (!bindings) + return Nothing(); + + // The ordering here is important. See comments in ModuleScope. + BindingName* start = bindings->names; + BindingName* cursor = start; + + PodCopy(cursor, imports.begin(), imports.length()); + cursor += imports.length(); + + bindings->varStart = cursor - start; + PodCopy(cursor, vars.begin(), vars.length()); + cursor += vars.length(); + + bindings->letStart = cursor - start; + PodCopy(cursor, lets.begin(), lets.length()); + cursor += lets.length(); + + bindings->constStart = cursor - start; + PodCopy(cursor, consts.begin(), consts.length()); + bindings->length = numBindings; + } + + return Some(bindings); +} + +template <> +Maybe<EvalScope::Data*> +Parser<FullParseHandler>::newEvalScopeData(ParseContext::Scope& scope) +{ + Vector<BindingName> funs(context); + Vector<BindingName> vars(context); + + for (BindingIter bi = scope.bindings(pc); bi; bi++) { + // Eval scopes only contain 'var' bindings. Make all bindings aliased + // for now. + MOZ_ASSERT(bi.kind() == BindingKind::Var); + BindingName binding(bi.name(), true); + if (bi.declarationKind() == DeclarationKind::BodyLevelFunction) { + if (!funs.append(binding)) + return Nothing(); + } else { + if (!vars.append(binding)) + return Nothing(); + } + } + + EvalScope::Data* bindings = nullptr; + uint32_t numBindings = funs.length() + vars.length(); + + if (numBindings > 0) { + bindings = NewEmptyBindingData<EvalScope>(context, alloc, numBindings); + if (!bindings) + return Nothing(); + + BindingName* start = bindings->names; + BindingName* cursor = start; + + // Keep track of what vars are functions. This is only used in BCE to omit + // superfluous DEFVARs. + PodCopy(cursor, funs.begin(), funs.length()); + cursor += funs.length(); + + bindings->varStart = cursor - start; + PodCopy(cursor, vars.begin(), vars.length()); + bindings->length = numBindings; + } + + return Some(bindings); +} + +template <> +Maybe<FunctionScope::Data*> +Parser<FullParseHandler>::newFunctionScopeData(ParseContext::Scope& scope, bool hasParameterExprs) +{ + Vector<BindingName> positionalFormals(context); + Vector<BindingName> formals(context); + Vector<BindingName> vars(context); + + bool allBindingsClosedOver = pc->sc()->allBindingsClosedOver(); + bool hasDuplicateParams = pc->functionBox()->hasDuplicateParameters; + + // Positional parameter names must be added in order of appearance as they are + // referenced using argument slots. + for (size_t i = 0; i < pc->positionalFormalParameterNames().length(); i++) { + JSAtom* name = pc->positionalFormalParameterNames()[i]; + + BindingName bindName; + if (name) { + DeclaredNamePtr p = scope.lookupDeclaredName(name); + + // Do not consider any positional formal parameters closed over if + // there are parameter defaults. It is the binding in the defaults + // scope that is closed over instead. + bool closedOver = allBindingsClosedOver || + (p && p->value()->closedOver()); + + // If the parameter name has duplicates, only the final parameter + // name should be on the environment, as otherwise the environment + // object would have multiple, same-named properties. + if (hasDuplicateParams) { + for (size_t j = pc->positionalFormalParameterNames().length() - 1; j > i; j--) { + if (pc->positionalFormalParameterNames()[j] == name) { + closedOver = false; + break; + } + } + } + + bindName = BindingName(name, closedOver); + } + + if (!positionalFormals.append(bindName)) + return Nothing(); + } + + for (BindingIter bi = scope.bindings(pc); bi; bi++) { + BindingName binding(bi.name(), allBindingsClosedOver || bi.closedOver()); + switch (bi.kind()) { + case BindingKind::FormalParameter: + // Positional parameter names are already handled above. + if (bi.declarationKind() == DeclarationKind::FormalParameter) { + if (!formals.append(binding)) + return Nothing(); + } + break; + case BindingKind::Var: + // The only vars in the function scope when there are parameter + // exprs, which induces a separate var environment, should be the + // special internal bindings. + MOZ_ASSERT_IF(hasParameterExprs, + bi.name() == context->names().arguments || + bi.name() == context->names().dotThis || + bi.name() == context->names().dotGenerator); + if (!vars.append(binding)) + return Nothing(); + break; + default: + break; + } + } + + FunctionScope::Data* bindings = nullptr; + uint32_t numBindings = positionalFormals.length() + formals.length() + vars.length(); + + if (numBindings > 0) { + bindings = NewEmptyBindingData<FunctionScope>(context, alloc, numBindings); + if (!bindings) + return Nothing(); + + // The ordering here is important. See comments in FunctionScope. + BindingName* start = bindings->names; + BindingName* cursor = start; + + PodCopy(cursor, positionalFormals.begin(), positionalFormals.length()); + cursor += positionalFormals.length(); + + bindings->nonPositionalFormalStart = cursor - start; + PodCopy(cursor, formals.begin(), formals.length()); + cursor += formals.length(); + + bindings->varStart = cursor - start; + PodCopy(cursor, vars.begin(), vars.length()); + bindings->length = numBindings; + } + + return Some(bindings); +} + +template <> +Maybe<VarScope::Data*> +Parser<FullParseHandler>::newVarScopeData(ParseContext::Scope& scope) +{ + Vector<BindingName> vars(context); + + bool allBindingsClosedOver = pc->sc()->allBindingsClosedOver(); + + for (BindingIter bi = scope.bindings(pc); bi; bi++) { + BindingName binding(bi.name(), allBindingsClosedOver || bi.closedOver()); + if (!vars.append(binding)) + return Nothing(); + } + + VarScope::Data* bindings = nullptr; + uint32_t numBindings = vars.length(); + + if (numBindings > 0) { + bindings = NewEmptyBindingData<VarScope>(context, alloc, numBindings); + if (!bindings) + return Nothing(); + + // The ordering here is important. See comments in FunctionScope. + BindingName* start = bindings->names; + BindingName* cursor = start; + + PodCopy(cursor, vars.begin(), vars.length()); + bindings->length = numBindings; + } + + return Some(bindings); +} + +template <> +Maybe<LexicalScope::Data*> +Parser<FullParseHandler>::newLexicalScopeData(ParseContext::Scope& scope) +{ + Vector<BindingName> lets(context); + Vector<BindingName> consts(context); + + // Unlike other scopes with bindings which are body-level, it is unknown + // if pc->sc()->allBindingsClosedOver() is correct at the time of + // finishing parsing a lexical scope. + // + // Instead, pc->sc()->allBindingsClosedOver() is checked in + // EmitterScope::enterLexical. Also see comment there. + for (BindingIter bi = scope.bindings(pc); bi; bi++) { + BindingName binding(bi.name(), bi.closedOver()); + switch (bi.kind()) { + case BindingKind::Let: + if (!lets.append(binding)) + return Nothing(); + break; + case BindingKind::Const: + if (!consts.append(binding)) + return Nothing(); + break; + default: + break; + } + } + + LexicalScope::Data* bindings = nullptr; + uint32_t numBindings = lets.length() + consts.length(); + + if (numBindings > 0) { + bindings = NewEmptyBindingData<LexicalScope>(context, alloc, numBindings); + if (!bindings) + return Nothing(); + + // The ordering here is important. See comments in LexicalScope. + BindingName* cursor = bindings->names; + BindingName* start = cursor; + + PodCopy(cursor, lets.begin(), lets.length()); + cursor += lets.length(); + + bindings->constStart = cursor - start; + PodCopy(cursor, consts.begin(), consts.length()); + bindings->length = numBindings; + } + + return Some(bindings); +} + +template <> +SyntaxParseHandler::Node +Parser<SyntaxParseHandler>::finishLexicalScope(ParseContext::Scope& scope, Node body) +{ + if (!propagateFreeNamesAndMarkClosedOverBindings(scope)) + return null(); + return body; +} + +template <> +ParseNode* +Parser<FullParseHandler>::finishLexicalScope(ParseContext::Scope& scope, ParseNode* body) +{ + if (!propagateFreeNamesAndMarkClosedOverBindings(scope)) + return nullptr; + Maybe<LexicalScope::Data*> bindings = newLexicalScopeData(scope); + if (!bindings) + return nullptr; + return handler.newLexicalScope(*bindings, body); +} + +static bool +IsArgumentsUsedInLegacyGenerator(ExclusiveContext* cx, Scope* scope) +{ + JSAtom* argumentsName = cx->names().arguments; + for (ScopeIter si(scope); si; si++) { + if (si.scope()->is<LexicalScope>()) { + // Using a shadowed lexical 'arguments' is okay. + for (::BindingIter bi(si.scope()); bi; bi++) { + if (bi.name() == argumentsName) + return false; + } + } else if (si.scope()->is<FunctionScope>()) { + // It's an error to use 'arguments' in a legacy generator expression. + JSScript* script = si.scope()->as<FunctionScope>().script(); + return script->isGeneratorExp() && script->isLegacyGenerator(); + } + } + + return false; +} + +template <> +ParseNode* +Parser<FullParseHandler>::evalBody(EvalSharedContext* evalsc) +{ + ParseContext evalpc(this, evalsc, /* newDirectives = */ nullptr); + if (!evalpc.init()) + return nullptr; + + ParseContext::VarScope varScope(this); + if (!varScope.init(pc)) + return nullptr; + + // All evals have an implicit non-extensible lexical scope. + ParseContext::Scope lexicalScope(this); + if (!lexicalScope.init(pc)) + return nullptr; + + ParseNode* body = statementList(YieldIsName); + if (!body) + return nullptr; + + if (!checkStatementsEOF()) + return nullptr; + + body = finishLexicalScope(lexicalScope, body); + if (!body) + return nullptr; + + // It's an error to use 'arguments' in a legacy generator expression. + // + // If 'arguments' appears free (i.e. not a declared name) or if the + // declaration does not shadow the enclosing script's 'arguments' + // binding (i.e. not a lexical declaration), check the enclosing + // script. + if (hasUsedName(context->names().arguments)) { + if (IsArgumentsUsedInLegacyGenerator(context, pc->sc()->compilationEnclosingScope())) { + report(ParseError, false, nullptr, JSMSG_BAD_GENEXP_BODY, js_arguments_str); + return nullptr; + } + } + +#ifdef DEBUG + if (evalpc.superScopeNeedsHomeObject() && evalsc->compilationEnclosingScope()) { + // If superScopeNeedsHomeObject_ is set and we are an entry-point + // ParseContext, then we must be emitting an eval script, and the + // outer function must already be marked as needing a home object + // since it contains an eval. + ScopeIter si(evalsc->compilationEnclosingScope()); + for (; si; si++) { + if (si.kind() == ScopeKind::Function) { + JSFunction* fun = si.scope()->as<FunctionScope>().canonicalFunction(); + if (fun->isArrow()) + continue; + MOZ_ASSERT(fun->allowSuperProperty()); + MOZ_ASSERT(fun->nonLazyScript()->needsHomeObject()); + break; + } + } + MOZ_ASSERT(!si.done(), + "Eval must have found an enclosing function box scope that allows super.property"); + } +#endif + + if (!FoldConstants(context, &body, this)) + return nullptr; + + Maybe<EvalScope::Data*> bindings = newEvalScopeData(pc->varScope()); + if (!bindings) + return nullptr; + evalsc->bindings = *bindings; + + return body; +} + +template <> +ParseNode* +Parser<FullParseHandler>::globalBody(GlobalSharedContext* globalsc) +{ + ParseContext globalpc(this, globalsc, /* newDirectives = */ nullptr); + if (!globalpc.init()) + return nullptr; + + ParseContext::VarScope varScope(this); + if (!varScope.init(pc)) + return nullptr; + + ParseNode* body = statementList(YieldIsName); + if (!body) + return nullptr; + + if (!checkStatementsEOF()) + return nullptr; + + if (!FoldConstants(context, &body, this)) + return nullptr; + + Maybe<GlobalScope::Data*> bindings = newGlobalScopeData(pc->varScope()); + if (!bindings) + return nullptr; + globalsc->bindings = *bindings; + + return body; +} + +template <> +ParseNode* +Parser<FullParseHandler>::moduleBody(ModuleSharedContext* modulesc) +{ + MOZ_ASSERT(checkOptionsCalled); + + ParseContext modulepc(this, modulesc, nullptr); + if (!modulepc.init()) + return null(); + + ParseContext::VarScope varScope(this); + if (!varScope.init(pc)) + return nullptr; + + Node mn = handler.newModule(); + if (!mn) + return null(); + + AutoAwaitIsKeyword awaitIsKeyword(&tokenStream, true); + ParseNode* pn = statementList(YieldIsKeyword); + if (!pn) + return null(); + + MOZ_ASSERT(pn->isKind(PNK_STATEMENTLIST)); + mn->pn_body = pn; + + TokenKind tt; + if (!tokenStream.getToken(&tt, TokenStream::Operand)) + return null(); + if (tt != TOK_EOF) { + report(ParseError, false, null(), JSMSG_GARBAGE_AFTER_INPUT, "module", TokenKindToDesc(tt)); + return null(); + } + + if (!modulesc->builder.buildTables()) + return null(); + + // Check exported local bindings exist and mark them as closed over. + for (auto entry : modulesc->builder.localExportEntries()) { + JSAtom* name = entry->localName(); + MOZ_ASSERT(name); + + DeclaredNamePtr p = modulepc.varScope().lookupDeclaredName(name); + if (!p) { + JSAutoByteString str; + if (!str.encodeLatin1(context, name)) + return null(); + + JS_ReportErrorNumberLatin1(context->asJSContext(), GetErrorMessage, nullptr, + JSMSG_MISSING_EXPORT, str.ptr()); + return null(); + } + + p->value()->setClosedOver(); + } + + if (!FoldConstants(context, &pn, this)) + return null(); + + if (!propagateFreeNamesAndMarkClosedOverBindings(modulepc.varScope())) + return null(); + + Maybe<ModuleScope::Data*> bindings = newModuleScopeData(modulepc.varScope()); + if (!bindings) + return nullptr; + + modulesc->bindings = *bindings; + return mn; +} + +template <> +SyntaxParseHandler::Node +Parser<SyntaxParseHandler>::moduleBody(ModuleSharedContext* modulesc) +{ + MOZ_ALWAYS_FALSE(abortIfSyntaxParser()); + return SyntaxParseHandler::NodeFailure; +} + +template <typename ParseHandler> +bool +Parser<ParseHandler>::hasUsedFunctionSpecialName(HandlePropertyName name) +{ + MOZ_ASSERT(name == context->names().arguments || name == context->names().dotThis); + return hasUsedName(name) || pc->functionBox()->bindingsAccessedDynamically(); +} + +template <typename ParseHandler> +bool +Parser<ParseHandler>::declareFunctionThis() +{ + // The asm.js validator does all its own symbol-table management so, as an + // optimization, avoid doing any work here. + if (pc->useAsmOrInsideUseAsm()) + return true; + + // Derived class constructors emit JSOP_CHECKRETURN, which requires + // '.this' to be bound. + FunctionBox* funbox = pc->functionBox(); + HandlePropertyName dotThis = context->names().dotThis; + + bool declareThis; + if (handler.canSkipLazyClosedOverBindings()) + declareThis = funbox->function()->lazyScript()->hasThisBinding(); + else + declareThis = hasUsedFunctionSpecialName(dotThis) || funbox->isDerivedClassConstructor(); + + if (declareThis) { + ParseContext::Scope& funScope = pc->functionScope(); + AddDeclaredNamePtr p = funScope.lookupDeclaredNameForAdd(dotThis); + MOZ_ASSERT(!p); + if (!funScope.addDeclaredName(pc, p, dotThis, DeclarationKind::Var)) + return false; + funbox->setHasThisBinding(); + } + + return true; +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::newInternalDotName(HandlePropertyName name) +{ + Node nameNode = newName(name); + if (!nameNode) + return null(); + if (!noteUsedName(name)) + return null(); + return nameNode; +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::newThisName() +{ + return newInternalDotName(context->names().dotThis); +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::newDotGeneratorName() +{ + return newInternalDotName(context->names().dotGenerator); +} + +template <typename ParseHandler> +bool +Parser<ParseHandler>::declareDotGeneratorName() +{ + // The special '.generator' binding must be on the function scope, as + // generators expect to find it on the CallObject. + ParseContext::Scope& funScope = pc->functionScope(); + HandlePropertyName dotGenerator = context->names().dotGenerator; + AddDeclaredNamePtr p = funScope.lookupDeclaredNameForAdd(dotGenerator); + if (!p && !funScope.addDeclaredName(pc, p, dotGenerator, DeclarationKind::Var)) + return false; + return true; +} + +template <typename ParseHandler> +bool +Parser<ParseHandler>::finishFunctionScopes() +{ + FunctionBox* funbox = pc->functionBox(); + + if (funbox->hasParameterExprs) { + if (!propagateFreeNamesAndMarkClosedOverBindings(pc->functionScope())) + return false; + } + + if (funbox->function()->isNamedLambda()) { + if (!propagateFreeNamesAndMarkClosedOverBindings(pc->namedLambdaScope())) + return false; + } + + return true; +} + +template <> +bool +Parser<FullParseHandler>::finishFunction() +{ + if (!finishFunctionScopes()) + return false; + + FunctionBox* funbox = pc->functionBox(); + bool hasParameterExprs = funbox->hasParameterExprs; + + if (hasParameterExprs) { + Maybe<VarScope::Data*> bindings = newVarScopeData(pc->varScope()); + if (!bindings) + return false; + funbox->extraVarScopeBindings().set(*bindings); + } + + { + Maybe<FunctionScope::Data*> bindings = newFunctionScopeData(pc->functionScope(), + hasParameterExprs); + if (!bindings) + return false; + funbox->functionScopeBindings().set(*bindings); + } + + if (funbox->function()->isNamedLambda()) { + Maybe<LexicalScope::Data*> bindings = newLexicalScopeData(pc->namedLambdaScope()); + if (!bindings) + return false; + funbox->namedLambdaBindings().set(*bindings); + } + + return true; +} + +template <> +bool +Parser<SyntaxParseHandler>::finishFunction() +{ + // The LazyScript for a lazily parsed function needs to know its set of + // free variables and inner functions so that when it is fully parsed, we + // can skip over any already syntax parsed inner functions and still + // retain correct scope information. + + if (!finishFunctionScopes()) + return false; + + // There are too many bindings or inner functions to be saved into the + // LazyScript. Do a full parse. + if (pc->closedOverBindingsForLazy().length() >= LazyScript::NumClosedOverBindingsLimit || + pc->innerFunctionsForLazy.length() >= LazyScript::NumInnerFunctionsLimit) + { + MOZ_ALWAYS_FALSE(abortIfSyntaxParser()); + return false; + } + + FunctionBox* funbox = pc->functionBox(); + RootedFunction fun(context, funbox->function()); + LazyScript* lazy = LazyScript::Create(context, fun, pc->closedOverBindingsForLazy(), + pc->innerFunctionsForLazy, versionNumber(), + funbox->bufStart, funbox->bufEnd, + funbox->startLine, funbox->startColumn); + if (!lazy) + return false; + + // Flags that need to be copied into the JSScript when we do the full + // parse. + if (pc->sc()->strict()) + lazy->setStrict(); + lazy->setGeneratorKind(funbox->generatorKind()); + lazy->setAsyncKind(funbox->asyncKind()); + if (funbox->isLikelyConstructorWrapper()) + lazy->setLikelyConstructorWrapper(); + if (funbox->isDerivedClassConstructor()) + lazy->setIsDerivedClassConstructor(); + if (funbox->needsHomeObject()) + lazy->setNeedsHomeObject(); + if (funbox->declaredArguments) + lazy->setShouldDeclareArguments(); + if (funbox->hasThisBinding()) + lazy->setHasThisBinding(); + + // Flags that need to copied back into the parser when we do the full + // parse. + PropagateTransitiveParseFlags(funbox, lazy); + + fun->initLazyScript(lazy); + return true; +} + +static YieldHandling +GetYieldHandling(GeneratorKind generatorKind, FunctionAsyncKind asyncKind) +{ + if (asyncKind == AsyncFunction) + return YieldIsName; + if (generatorKind == NotGenerator) + return YieldIsName; + return YieldIsKeyword; +} + +template <> +ParseNode* +Parser<FullParseHandler>::standaloneFunctionBody(HandleFunction fun, + HandleScope enclosingScope, + Handle<PropertyNameVector> formals, + GeneratorKind generatorKind, + FunctionAsyncKind asyncKind, + Directives inheritedDirectives, + Directives* newDirectives) +{ + MOZ_ASSERT(checkOptionsCalled); + + Node fn = handler.newFunctionDefinition(); + if (!fn) + return null(); + + ParseNode* argsbody = handler.newList(PNK_PARAMSBODY); + if (!argsbody) + return null(); + fn->pn_body = argsbody; + + FunctionBox* funbox = newFunctionBox(fn, fun, inheritedDirectives, generatorKind, + asyncKind, /* tryAnnexB = */ false); + if (!funbox) + return null(); + funbox->initStandaloneFunction(enclosingScope); + + ParseContext funpc(this, funbox, newDirectives); + if (!funpc.init()) + return null(); + funpc.setIsStandaloneFunctionBody(); + funpc.functionScope().useAsVarScope(&funpc); + + if (formals.length() >= ARGNO_LIMIT) { + report(ParseError, false, null(), JSMSG_TOO_MANY_FUN_ARGS); + return null(); + } + + bool duplicatedParam = false; + for (uint32_t i = 0; i < formals.length(); i++) { + if (!notePositionalFormalParameter(fn, formals[i], false, &duplicatedParam)) + return null(); + } + funbox->hasDuplicateParameters = duplicatedParam; + + YieldHandling yieldHandling = GetYieldHandling(generatorKind, asyncKind); + AutoAwaitIsKeyword awaitIsKeyword(&tokenStream, asyncKind == AsyncFunction); + ParseNode* pn = functionBody(InAllowed, yieldHandling, Statement, StatementListBody); + if (!pn) + return null(); + + TokenKind tt; + if (!tokenStream.getToken(&tt, TokenStream::Operand)) + return null(); + if (tt != TOK_EOF) { + report(ParseError, false, null(), JSMSG_GARBAGE_AFTER_INPUT, + "function body", TokenKindToDesc(tt)); + return null(); + } + + if (!FoldConstants(context, &pn, this)) + return null(); + + fn->pn_pos.end = pos().end; + + MOZ_ASSERT(fn->pn_body->isKind(PNK_PARAMSBODY)); + fn->pn_body->append(pn); + + if (!finishFunction()) + return null(); + + return fn; +} + +template <typename ParseHandler> +bool +Parser<ParseHandler>::declareFunctionArgumentsObject() +{ + FunctionBox* funbox = pc->functionBox(); + ParseContext::Scope& funScope = pc->functionScope(); + ParseContext::Scope& varScope = pc->varScope(); + + bool hasExtraBodyVarScope = &funScope != &varScope; + + // Time to implement the odd semantics of 'arguments'. + HandlePropertyName argumentsName = context->names().arguments; + + bool tryDeclareArguments; + if (handler.canSkipLazyClosedOverBindings()) + tryDeclareArguments = funbox->function()->lazyScript()->shouldDeclareArguments(); + else + tryDeclareArguments = hasUsedFunctionSpecialName(argumentsName); + + // ES 9.2.12 steps 19 and 20 say formal parameters, lexical bindings, + // and body-level functions named 'arguments' shadow the arguments + // object. + // + // So even if there wasn't a free use of 'arguments' but there is a var + // binding of 'arguments', we still might need the arguments object. + // + // If we have an extra var scope due to parameter expressions and the body + // declared 'var arguments', we still need to declare 'arguments' in the + // function scope. + DeclaredNamePtr p = varScope.lookupDeclaredName(argumentsName); + if (p && (p->value()->kind() == DeclarationKind::Var || + p->value()->kind() == DeclarationKind::ForOfVar)) + { + if (hasExtraBodyVarScope) + tryDeclareArguments = true; + else + funbox->usesArguments = true; + } + + if (tryDeclareArguments) { + AddDeclaredNamePtr p = funScope.lookupDeclaredNameForAdd(argumentsName); + if (!p) { + if (!funScope.addDeclaredName(pc, p, argumentsName, DeclarationKind::Var)) + return false; + funbox->declaredArguments = true; + funbox->usesArguments = true; + } else if (hasExtraBodyVarScope) { + // Formal parameters shadow the arguments object. + return true; + } + } + + // Compute if we need an arguments object. + if (funbox->usesArguments) { + // There is an 'arguments' binding. Is the arguments object definitely + // needed? + // + // Also see the flags' comments in ContextFlags. + funbox->setArgumentsHasLocalBinding(); + + // Dynamic scope access destroys all hope of optimization. + if (pc->sc()->bindingsAccessedDynamically()) + funbox->setDefinitelyNeedsArgsObj(); + + // If a script contains the debugger statement either directly or + // within an inner function, the arguments object should be created + // eagerly so the Debugger API may observe bindings. + if (pc->sc()->hasDebuggerStatement()) + funbox->setDefinitelyNeedsArgsObj(); + } + + return true; +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::functionBody(InHandling inHandling, YieldHandling yieldHandling, + FunctionSyntaxKind kind, FunctionBodyType type) +{ + MOZ_ASSERT(pc->isFunctionBox()); + MOZ_ASSERT(!pc->funHasReturnExpr && !pc->funHasReturnVoid); + +#ifdef DEBUG + uint32_t startYieldOffset = pc->lastYieldOffset; +#endif + + Node pn; + if (type == StatementListBody) { + bool inheritedStrict = pc->sc()->strict(); + pn = statementList(yieldHandling); + if (!pn) + return null(); + + // When we transitioned from non-strict to strict mode, we need to + // validate that all parameter names are valid strict mode names. + if (!inheritedStrict && pc->sc()->strict()) { + MOZ_ASSERT(pc->sc()->hasExplicitUseStrict(), + "strict mode should only change when a 'use strict' directive is present"); + if (!hasValidSimpleStrictParameterNames()) { + // Request that this function be reparsed as strict to report + // the invalid parameter name at the correct source location. + pc->newDirectives->setStrict(); + return null(); + } + } + } else { + MOZ_ASSERT(type == ExpressionBody); + + // Async functions are implemented as star generators, and star + // generators are assumed to be statement lists, to prepend initial + // `yield`. + Node stmtList = null(); + if (pc->isAsync()) { + stmtList = handler.newStatementList(pos()); + if (!stmtList) + return null(); + } + + Node kid = assignExpr(inHandling, yieldHandling, TripledotProhibited); + if (!kid) + return null(); + + pn = handler.newReturnStatement(kid, handler.getPosition(kid)); + if (!pn) + return null(); + + if (pc->isAsync()) { + handler.addStatementToList(stmtList, pn); + pn = stmtList; + } + } + + switch (pc->generatorKind()) { + case NotGenerator: + MOZ_ASSERT(pc->lastYieldOffset == startYieldOffset); + break; + + case LegacyGenerator: + MOZ_ASSERT(pc->lastYieldOffset != startYieldOffset); + + // These should throw while parsing the yield expression. + MOZ_ASSERT(kind != Arrow); + MOZ_ASSERT(!IsGetterKind(kind)); + MOZ_ASSERT(!IsSetterKind(kind)); + MOZ_ASSERT(!IsConstructorKind(kind)); + MOZ_ASSERT(kind != Method); + MOZ_ASSERT(type != ExpressionBody); + break; + + case StarGenerator: + MOZ_ASSERT_IF(!pc->isAsync(), kind != Arrow); + MOZ_ASSERT_IF(!pc->isAsync(), type == StatementListBody); + break; + } + + if (pc->isGenerator()) { + MOZ_ASSERT_IF(!pc->isAsync(), type == StatementListBody); + if (!declareDotGeneratorName()) + return null(); + Node generator = newDotGeneratorName(); + if (!generator) + return null(); + if (!handler.prependInitialYield(pn, generator)) + return null(); + } + + // Declare the 'arguments' and 'this' bindings if necessary before + // finishing up the scope so these special bindings get marked as closed + // over if necessary. Arrow functions don't have these bindings. + if (kind != Arrow) { + if (!declareFunctionArgumentsObject()) + return null(); + if (!declareFunctionThis()) + return null(); + } + + return finishLexicalScope(pc->varScope(), pn); +} + +template <typename ParseHandler> +JSFunction* +Parser<ParseHandler>::newFunction(HandleAtom atom, FunctionSyntaxKind kind, + GeneratorKind generatorKind, FunctionAsyncKind asyncKind, + HandleObject proto) +{ + MOZ_ASSERT_IF(kind == Statement, atom != nullptr); + + RootedFunction fun(context); + + gc::AllocKind allocKind = gc::AllocKind::FUNCTION; + JSFunction::Flags flags; +#ifdef DEBUG + bool isGlobalSelfHostedBuiltin = false; +#endif + switch (kind) { + case Expression: + flags = (generatorKind == NotGenerator + ? JSFunction::INTERPRETED_LAMBDA + : JSFunction::INTERPRETED_LAMBDA_GENERATOR); + break; + case Arrow: + flags = JSFunction::INTERPRETED_LAMBDA_ARROW; + allocKind = gc::AllocKind::FUNCTION_EXTENDED; + break; + case Method: + MOZ_ASSERT(generatorKind == NotGenerator || generatorKind == StarGenerator); + flags = (generatorKind == NotGenerator + ? JSFunction::INTERPRETED_METHOD + : JSFunction::INTERPRETED_METHOD_GENERATOR); + allocKind = gc::AllocKind::FUNCTION_EXTENDED; + break; + case ClassConstructor: + case DerivedClassConstructor: + flags = JSFunction::INTERPRETED_CLASS_CONSTRUCTOR; + allocKind = gc::AllocKind::FUNCTION_EXTENDED; + break; + case Getter: + case GetterNoExpressionClosure: + flags = JSFunction::INTERPRETED_GETTER; + allocKind = gc::AllocKind::FUNCTION_EXTENDED; + break; + case Setter: + case SetterNoExpressionClosure: + flags = JSFunction::INTERPRETED_SETTER; + allocKind = gc::AllocKind::FUNCTION_EXTENDED; + break; + default: + MOZ_ASSERT(kind == Statement); +#ifdef DEBUG + if (options().selfHostingMode && !pc->isFunctionBox()) { + isGlobalSelfHostedBuiltin = true; + allocKind = gc::AllocKind::FUNCTION_EXTENDED; + } +#endif + flags = (generatorKind == NotGenerator + ? JSFunction::INTERPRETED_NORMAL + : JSFunction::INTERPRETED_GENERATOR); + } + + // We store the async wrapper in a slot for later access. + if (asyncKind == AsyncFunction) + allocKind = gc::AllocKind::FUNCTION_EXTENDED; + + fun = NewFunctionWithProto(context, nullptr, 0, flags, nullptr, atom, proto, + allocKind, TenuredObject); + if (!fun) + return nullptr; + if (options().selfHostingMode) { + fun->setIsSelfHostedBuiltin(); +#ifdef DEBUG + if (isGlobalSelfHostedBuiltin) + fun->setExtendedSlot(HAS_SELFHOSTED_CANONICAL_NAME_SLOT, BooleanValue(false)); +#endif + } + return fun; +} + +/* + * WARNING: Do not call this function directly. + * Call either MatchOrInsertSemicolonAfterExpression or + * MatchOrInsertSemicolonAfterNonExpression instead, depending on context. + */ +static bool +MatchOrInsertSemicolonHelper(TokenStream& ts, TokenStream::Modifier modifier) +{ + TokenKind tt = TOK_EOF; + if (!ts.peekTokenSameLine(&tt, modifier)) + return false; + if (tt != TOK_EOF && tt != TOK_EOL && tt != TOK_SEMI && tt != TOK_RC) { + /* Advance the scanner for proper error location reporting. */ + ts.consumeKnownToken(tt, modifier); + ts.reportError(JSMSG_SEMI_BEFORE_STMNT); + return false; + } + bool matched; + if (!ts.matchToken(&matched, TOK_SEMI, modifier)) + return false; + if (!matched && modifier == TokenStream::None) + ts.addModifierException(TokenStream::OperandIsNone); + return true; +} + +static bool +MatchOrInsertSemicolonAfterExpression(TokenStream& ts) +{ + return MatchOrInsertSemicolonHelper(ts, TokenStream::None); +} + +static bool +MatchOrInsertSemicolonAfterNonExpression(TokenStream& ts) +{ + return MatchOrInsertSemicolonHelper(ts, TokenStream::Operand); +} + +template <typename ParseHandler> +bool +Parser<ParseHandler>::leaveInnerFunction(ParseContext* outerpc) +{ + MOZ_ASSERT(pc != outerpc); + + // If the current function allows super.property but cannot have a home + // object, i.e., it is an arrow function, we need to propagate the flag to + // the outer ParseContext. + if (pc->superScopeNeedsHomeObject()) { + if (!pc->isArrowFunction()) + MOZ_ASSERT(pc->functionBox()->needsHomeObject()); + else + outerpc->setSuperScopeNeedsHomeObject(); + } + + // Lazy functions inner to another lazy function need to be remembered by + // the inner function so that if the outer function is eventually parsed + // we do not need any further parsing or processing of the inner function. + // + // Append the inner function here unconditionally; the vector is only used + // if the Parser using outerpc is a syntax parsing. See + // Parser<SyntaxParseHandler>::finishFunction. + if (!outerpc->innerFunctionsForLazy.append(pc->functionBox()->function())) + return false; + + PropagateTransitiveParseFlags(pc->functionBox(), outerpc->sc()); + + return true; +} + +template <typename ParseHandler> +JSAtom* +Parser<ParseHandler>::prefixAccessorName(PropertyType propType, HandleAtom propAtom) +{ + RootedAtom prefix(context); + if (propType == PropertyType::Setter || propType == PropertyType::SetterNoExpressionClosure) { + prefix = context->names().setPrefix; + } else { + MOZ_ASSERT(propType == PropertyType::Getter || propType == PropertyType::GetterNoExpressionClosure); + prefix = context->names().getPrefix; + } + + RootedString str(context, ConcatStrings<CanGC>(context, prefix, propAtom)); + if (!str) + return nullptr; + + return AtomizeString(context, str); +} + +template <typename ParseHandler> +bool +Parser<ParseHandler>::functionArguments(YieldHandling yieldHandling, FunctionSyntaxKind kind, + Node funcpn) +{ + FunctionBox* funbox = pc->functionBox(); + + bool parenFreeArrow = false; + // Modifier for the following tokens. + // TokenStream::None for the following cases: + // async a => 1 + // ^ + // + // (a) => 1 + // ^ + // + // async (a) => 1 + // ^ + // + // function f(a) {} + // ^ + // + // TokenStream::Operand for the following case: + // a => 1 + // ^ + TokenStream::Modifier firstTokenModifier = TokenStream::None; + + // Modifier for the the first token in each argument. + // can be changed to TokenStream::None for the following case: + // async a => 1 + // ^ + TokenStream::Modifier argModifier = TokenStream::Operand; + if (kind == Arrow) { + TokenKind tt; + // In async function, the first token after `async` is already gotten + // with TokenStream::None. + // In sync function, the first token is already gotten with + // TokenStream::Operand. + firstTokenModifier = funbox->isAsync() ? TokenStream::None : TokenStream::Operand; + if (!tokenStream.peekToken(&tt, firstTokenModifier)) + return false; + if (tt == TOK_NAME || tt == TOK_YIELD) { + parenFreeArrow = true; + argModifier = firstTokenModifier; + } + } + if (!parenFreeArrow) { + TokenKind tt; + if (!tokenStream.getToken(&tt, firstTokenModifier)) + return false; + if (tt != TOK_LP) { + report(ParseError, false, null(), + kind == Arrow ? JSMSG_BAD_ARROW_ARGS : JSMSG_PAREN_BEFORE_FORMAL); + return false; + } + + // Record the start of function source (for FunctionToString). If we + // are parenFreeArrow, we will set this below, after consuming the NAME. + funbox->setStart(tokenStream); + } + + Node argsbody = handler.newList(PNK_PARAMSBODY); + if (!argsbody) + return false; + handler.setFunctionFormalParametersAndBody(funcpn, argsbody); + + bool hasArguments = false; + if (parenFreeArrow) { + hasArguments = true; + } else { + bool matched; + if (!tokenStream.matchToken(&matched, TOK_RP, TokenStream::Operand)) + return false; + if (!matched) + hasArguments = true; + } + if (hasArguments) { + bool hasRest = false; + bool hasDefault = false; + bool duplicatedParam = false; + bool disallowDuplicateParams = kind == Arrow || kind == Method || kind == ClassConstructor; + AtomVector& positionalFormals = pc->positionalFormalParameterNames(); + + if (IsGetterKind(kind)) { + report(ParseError, false, null(), JSMSG_ACCESSOR_WRONG_ARGS, "getter", "no", "s"); + return false; + } + + while (true) { + if (hasRest) { + report(ParseError, false, null(), JSMSG_PARAMETER_AFTER_REST); + return false; + } + + TokenKind tt; + if (!tokenStream.getToken(&tt, argModifier)) + return false; + argModifier = TokenStream::Operand; + MOZ_ASSERT_IF(parenFreeArrow, tt == TOK_NAME || tt == TOK_YIELD); + + if (tt == TOK_TRIPLEDOT) { + if (IsSetterKind(kind)) { + report(ParseError, false, null(), + JSMSG_ACCESSOR_WRONG_ARGS, "setter", "one", ""); + return false; + } + + disallowDuplicateParams = true; + if (duplicatedParam) { + // Has duplicated args before the rest parameter. + report(ParseError, false, null(), JSMSG_BAD_DUP_ARGS); + return false; + } + + hasRest = true; + funbox->function()->setHasRest(); + + if (!tokenStream.getToken(&tt)) + return false; + + if (tt != TOK_NAME && tt != TOK_YIELD && tt != TOK_LB && tt != TOK_LC) { + report(ParseError, false, null(), JSMSG_NO_REST_NAME); + return false; + } + } + + switch (tt) { + case TOK_LB: + case TOK_LC: { + disallowDuplicateParams = true; + if (duplicatedParam) { + // Has duplicated args before the destructuring parameter. + report(ParseError, false, null(), JSMSG_BAD_DUP_ARGS); + return false; + } + + funbox->hasDestructuringArgs = true; + + Node destruct = destructuringDeclarationWithoutYieldOrAwait( + DeclarationKind::FormalParameter, + yieldHandling, tt); + if (!destruct) + return false; + + if (!noteDestructuredPositionalFormalParameter(funcpn, destruct)) + return false; + + break; + } + + case TOK_NAME: + case TOK_YIELD: { + if (parenFreeArrow) + funbox->setStart(tokenStream); + + if (funbox->isAsync() && tokenStream.currentName() == context->names().await) { + // `await` is already gotten as TOK_NAME for the following + // case: + // + // async await => 1 + report(ParseError, false, null(), JSMSG_RESERVED_ID, "await"); + return false; + } + + RootedPropertyName name(context, bindingIdentifier(yieldHandling)); + if (!name) + return false; + + if (!notePositionalFormalParameter(funcpn, name, disallowDuplicateParams, + &duplicatedParam)) + { + return false; + } + if (duplicatedParam) + funbox->hasDuplicateParameters = true; + + break; + } + + default: + report(ParseError, false, null(), JSMSG_MISSING_FORMAL); + return false; + } + + if (positionalFormals.length() >= ARGNO_LIMIT) { + report(ParseError, false, null(), JSMSG_TOO_MANY_FUN_ARGS); + return false; + } + + bool matched; + if (!tokenStream.matchToken(&matched, TOK_ASSIGN)) + return false; + if (matched) { + // A default argument without parentheses would look like: + // a = expr => body, but both operators are right-associative, so + // that would have been parsed as a = (expr => body) instead. + // Therefore it's impossible to get here with parenFreeArrow. + MOZ_ASSERT(!parenFreeArrow); + + if (hasRest) { + report(ParseError, false, null(), JSMSG_REST_WITH_DEFAULT); + return false; + } + disallowDuplicateParams = true; + if (duplicatedParam) { + report(ParseError, false, null(), JSMSG_BAD_DUP_ARGS); + return false; + } + + if (!hasDefault) { + hasDefault = true; + + // The Function.length property is the number of formals + // before the first default argument. + funbox->length = positionalFormals.length() - 1; + } + funbox->hasParameterExprs = true; + + Node def_expr = assignExprWithoutYieldOrAwait(yieldHandling); + if (!def_expr) + return false; + if (!handler.setLastFunctionFormalParameterDefault(funcpn, def_expr)) + return false; + } + + if (parenFreeArrow || IsSetterKind(kind)) + break; + + if (!tokenStream.matchToken(&matched, TOK_COMMA)) + return false; + if (!matched) + break; + + if (!hasRest) { + if (!tokenStream.peekToken(&tt, TokenStream::Operand)) + return null(); + if (tt == TOK_RP) { + tokenStream.addModifierException(TokenStream::NoneIsOperand); + break; + } + } + } + + if (!parenFreeArrow) { + TokenKind tt; + if (!tokenStream.getToken(&tt)) + return false; + if (tt != TOK_RP) { + if (IsSetterKind(kind)) { + report(ParseError, false, null(), + JSMSG_ACCESSOR_WRONG_ARGS, "setter", "one", ""); + return false; + } + + report(ParseError, false, null(), JSMSG_PAREN_AFTER_FORMAL); + return false; + } + } + + if (!hasDefault) + funbox->length = positionalFormals.length() - hasRest; + + if (funbox->hasParameterExprs && funbox->hasDirectEval()) + funbox->hasDirectEvalInParameterExpr = true; + + funbox->function()->setArgCount(positionalFormals.length()); + } else if (IsSetterKind(kind)) { + report(ParseError, false, null(), JSMSG_ACCESSOR_WRONG_ARGS, "setter", "one", ""); + return false; + } + + return true; +} + +template <typename ParseHandler> +bool +Parser<ParseHandler>::checkFunctionDefinition(HandleAtom funAtom, Node pn, FunctionSyntaxKind kind, + GeneratorKind generatorKind, bool* tryAnnexB) +{ + if (kind == Statement) { + TokenPos pos = handler.getPosition(pn); + RootedPropertyName funName(context, funAtom->asPropertyName()); + + // In sloppy mode, Annex B.3.2 allows labelled function + // declarations. Otherwise it is a parse error. + ParseContext::Statement* declaredInStmt = pc->innermostStatement(); + if (declaredInStmt && declaredInStmt->kind() == StatementKind::Label) { + MOZ_ASSERT(!pc->sc()->strict(), + "labeled functions shouldn't be parsed in strict mode"); + + // Find the innermost non-label statement. Report an error if it's + // unbraced: functions can't appear in it. Otherwise the statement + // (or its absence) determines the scope the function's bound in. + while (declaredInStmt && declaredInStmt->kind() == StatementKind::Label) + declaredInStmt = declaredInStmt->enclosing(); + + if (declaredInStmt && !StatementKindIsBraced(declaredInStmt->kind())) { + reportWithOffset(ParseError, false, pos.begin, JSMSG_SLOPPY_FUNCTION_LABEL); + return false; + } + } + + if (declaredInStmt) { + MOZ_ASSERT(declaredInStmt->kind() != StatementKind::Label); + MOZ_ASSERT(StatementKindIsBraced(declaredInStmt->kind())); + + if (!pc->sc()->strict() && generatorKind == NotGenerator) { + // Under sloppy mode, try Annex B.3.3 semantics. If making an + // additional 'var' binding of the same name does not throw an + // early error, do so. This 'var' binding would be assigned + // the function object when its declaration is reached, not at + // the start of the block. + + if (!tryDeclareVarForAnnexBLexicalFunction(funName, tryAnnexB)) + return false; + } + + if (!noteDeclaredName(funName, DeclarationKind::LexicalFunction, pos)) + return false; + } else { + if (!noteDeclaredName(funName, DeclarationKind::BodyLevelFunction, pos)) + return false; + + // Body-level functions in modules are always closed over. + if (pc->atModuleLevel()) + pc->varScope().lookupDeclaredName(funName)->value()->setClosedOver(); + } + } else { + // A function expression does not introduce any binding. + handler.setOp(pn, kind == Arrow ? JSOP_LAMBDA_ARROW : JSOP_LAMBDA); + } + + return true; +} + +template <> +bool +Parser<FullParseHandler>::skipLazyInnerFunction(ParseNode* pn, FunctionSyntaxKind kind, + bool tryAnnexB) +{ + // When a lazily-parsed function is called, we only fully parse (and emit) + // that function, not any of its nested children. The initial syntax-only + // parse recorded the free variables of nested functions and their extents, + // so we can skip over them after accounting for their free variables. + + RootedFunction fun(context, handler.nextLazyInnerFunction()); + MOZ_ASSERT(!fun->isLegacyGenerator()); + FunctionBox* funbox = newFunctionBox(pn, fun, Directives(/* strict = */ false), + fun->generatorKind(), fun->asyncKind(), tryAnnexB); + if (!funbox) + return false; + + LazyScript* lazy = fun->lazyScript(); + if (lazy->needsHomeObject()) + funbox->setNeedsHomeObject(); + + PropagateTransitiveParseFlags(lazy, pc->sc()); + + // The position passed to tokenStream.advance() is an offset of the sort + // returned by userbuf.offset() and expected by userbuf.rawCharPtrAt(), + // while LazyScript::{begin,end} offsets are relative to the outermost + // script source. + Rooted<LazyScript*> lazyOuter(context, handler.lazyOuterFunction()); + uint32_t userbufBase = lazyOuter->begin() - lazyOuter->column(); + if (!tokenStream.advance(fun->lazyScript()->end() - userbufBase)) + return false; + + if (kind == Statement && fun->isExprBody()) { + if (!MatchOrInsertSemicolonAfterExpression(tokenStream)) + return false; + } + + return true; +} + +template <> +bool +Parser<SyntaxParseHandler>::skipLazyInnerFunction(Node pn, FunctionSyntaxKind kind, + bool tryAnnexB) +{ + MOZ_CRASH("Cannot skip lazy inner functions when syntax parsing"); +} + +template <typename ParseHandler> +bool +Parser<ParseHandler>::addExprAndGetNextTemplStrToken(YieldHandling yieldHandling, Node nodeList, + TokenKind* ttp) +{ + Node pn = expr(InAllowed, yieldHandling, TripledotProhibited); + if (!pn) + return false; + handler.addList(nodeList, pn); + + TokenKind tt; + if (!tokenStream.getToken(&tt)) + return false; + if (tt != TOK_RC) { + report(ParseError, false, null(), JSMSG_TEMPLSTR_UNTERM_EXPR); + return false; + } + + return tokenStream.getToken(ttp, TokenStream::TemplateTail); +} + +template <typename ParseHandler> +bool +Parser<ParseHandler>::taggedTemplate(YieldHandling yieldHandling, Node nodeList, TokenKind tt) +{ + Node callSiteObjNode = handler.newCallSiteObject(pos().begin); + if (!callSiteObjNode) + return false; + handler.addList(nodeList, callSiteObjNode); + + while (true) { + if (!appendToCallSiteObj(callSiteObjNode)) + return false; + if (tt != TOK_TEMPLATE_HEAD) + break; + + if (!addExprAndGetNextTemplStrToken(yieldHandling, nodeList, &tt)) + return false; + } + handler.setEndPosition(nodeList, callSiteObjNode); + return true; +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::templateLiteral(YieldHandling yieldHandling) +{ + Node pn = noSubstitutionTemplate(); + if (!pn) + return null(); + + Node nodeList = handler.newList(PNK_TEMPLATE_STRING_LIST, pn); + if (!nodeList) + return null(); + + TokenKind tt; + do { + if (!addExprAndGetNextTemplStrToken(yieldHandling, nodeList, &tt)) + return null(); + + pn = noSubstitutionTemplate(); + if (!pn) + return null(); + + handler.addList(nodeList, pn); + } while (tt == TOK_TEMPLATE_HEAD); + return nodeList; +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::functionDefinition(InHandling inHandling, YieldHandling yieldHandling, + HandleAtom funName, FunctionSyntaxKind kind, + GeneratorKind generatorKind, FunctionAsyncKind asyncKind, + InvokedPrediction invoked) +{ + MOZ_ASSERT_IF(kind == Statement, funName); + MOZ_ASSERT_IF(asyncKind == AsyncFunction, generatorKind == StarGenerator); + + Node pn = handler.newFunctionDefinition(); + if (!pn) + return null(); + + if (invoked) + pn = handler.setLikelyIIFE(pn); + + // Note the declared name and check for early errors. + bool tryAnnexB = false; + if (!checkFunctionDefinition(funName, pn, kind, generatorKind, &tryAnnexB)) + return null(); + + // When fully parsing a LazyScript, we do not fully reparse its inner + // functions, which are also lazy. Instead, their free variables and + // source extents are recorded and may be skipped. + if (handler.canSkipLazyInnerFunctions()) { + if (!skipLazyInnerFunction(pn, kind, tryAnnexB)) + return null(); + return pn; + } + + RootedObject proto(context); + if (generatorKind == StarGenerator) { + // If we are off the main thread, the generator meta-objects have + // already been created by js::StartOffThreadParseScript, so cx will not + // be necessary. + JSContext* cx = context->maybeJSContext(); + proto = GlobalObject::getOrCreateStarGeneratorFunctionPrototype(cx, context->global()); + if (!proto) + return null(); + } + RootedFunction fun(context, newFunction(funName, kind, generatorKind, asyncKind, proto)); + if (!fun) + return null(); + + // Speculatively parse using the directives of the parent parsing context. + // If a directive is encountered (e.g., "use strict") that changes how the + // function should have been parsed, we backup and reparse with the new set + // of directives. + Directives directives(pc); + Directives newDirectives = directives; + + TokenStream::Position start(keepAtoms); + tokenStream.tell(&start); + + // Parse the inner function. The following is a loop as we may attempt to + // reparse a function due to failed syntax parsing and encountering new + // "use foo" directives. + while (true) { + if (trySyntaxParseInnerFunction(pn, fun, inHandling, yieldHandling, kind, generatorKind, + asyncKind, tryAnnexB, directives, &newDirectives)) + { + break; + } + + // Return on error. + if (tokenStream.hadError() || directives == newDirectives) + return null(); + + // Assignment must be monotonic to prevent infinitely attempting to + // reparse. + MOZ_ASSERT_IF(directives.strict(), newDirectives.strict()); + MOZ_ASSERT_IF(directives.asmJS(), newDirectives.asmJS()); + directives = newDirectives; + + tokenStream.seek(start); + + // functionFormalParametersAndBody may have already set pn->pn_body before failing. + handler.setFunctionFormalParametersAndBody(pn, null()); + } + + return pn; +} + +template <> +bool +Parser<FullParseHandler>::trySyntaxParseInnerFunction(ParseNode* pn, HandleFunction fun, + InHandling inHandling, + YieldHandling yieldHandling, + FunctionSyntaxKind kind, + GeneratorKind generatorKind, + FunctionAsyncKind asyncKind, + bool tryAnnexB, + Directives inheritedDirectives, + Directives* newDirectives) +{ + // Try a syntax parse for this inner function. + do { + // If we're assuming this function is an IIFE, always perform a full + // parse to avoid the overhead of a lazy syntax-only parse. Although + // the prediction may be incorrect, IIFEs are common enough that it + // pays off for lots of code. + if (pn->isLikelyIIFE() && generatorKind == NotGenerator) + break; + + Parser<SyntaxParseHandler>* parser = handler.syntaxParser; + if (!parser) + break; + + UsedNameTracker::RewindToken token = usedNames.getRewindToken(); + + // Move the syntax parser to the current position in the stream. + TokenStream::Position position(keepAtoms); + tokenStream.tell(&position); + if (!parser->tokenStream.seek(position, tokenStream)) + return false; + + // Make a FunctionBox before we enter the syntax parser, because |pn| + // still expects a FunctionBox to be attached to it during BCE, and + // the syntax parser cannot attach one to it. + FunctionBox* funbox = newFunctionBox(pn, fun, inheritedDirectives, generatorKind, + asyncKind, tryAnnexB); + if (!funbox) + return false; + funbox->initWithEnclosingParseContext(pc, kind); + + if (!parser->innerFunction(SyntaxParseHandler::NodeGeneric, pc, funbox, inHandling, + yieldHandling, kind, inheritedDirectives, newDirectives)) + { + if (parser->hadAbortedSyntaxParse()) { + // Try again with a full parse. UsedNameTracker needs to be + // rewound to just before we tried the syntax parse for + // correctness. + parser->clearAbortedSyntaxParse(); + usedNames.rewind(token); + MOZ_ASSERT_IF(parser->context->isJSContext(), + !parser->context->asJSContext()->isExceptionPending()); + break; + } + return false; + } + + // Advance this parser over tokens processed by the syntax parser. + parser->tokenStream.tell(&position); + if (!tokenStream.seek(position, parser->tokenStream)) + return false; + + // Update the end position of the parse node. + pn->pn_pos.end = tokenStream.currentToken().pos.end; + return true; + } while (false); + + // We failed to do a syntax parse above, so do the full parse. + return innerFunction(pn, pc, fun, inHandling, yieldHandling, kind, generatorKind, asyncKind, + tryAnnexB, inheritedDirectives, newDirectives); +} + +template <> +bool +Parser<SyntaxParseHandler>::trySyntaxParseInnerFunction(Node pn, HandleFunction fun, + InHandling inHandling, + YieldHandling yieldHandling, + FunctionSyntaxKind kind, + GeneratorKind generatorKind, + FunctionAsyncKind asyncKind, + bool tryAnnexB, + Directives inheritedDirectives, + Directives* newDirectives) +{ + // This is already a syntax parser, so just parse the inner function. + return innerFunction(pn, pc, fun, inHandling, yieldHandling, kind, generatorKind, asyncKind, + tryAnnexB, inheritedDirectives, newDirectives); +} + +template <typename ParseHandler> +bool +Parser<ParseHandler>::innerFunction(Node pn, ParseContext* outerpc, FunctionBox* funbox, + InHandling inHandling, YieldHandling yieldHandling, + FunctionSyntaxKind kind, Directives inheritedDirectives, + Directives* newDirectives) +{ + // Note that it is possible for outerpc != this->pc, as we may be + // attempting to syntax parse an inner function from an outer full + // parser. In that case, outerpc is a ParseContext from the full parser + // instead of the current top of the stack of the syntax parser. + + // Push a new ParseContext. + ParseContext funpc(this, funbox, newDirectives); + if (!funpc.init()) + return false; + + if (!functionFormalParametersAndBody(inHandling, yieldHandling, pn, kind)) + return false; + + return leaveInnerFunction(outerpc); +} + +template <typename ParseHandler> +bool +Parser<ParseHandler>::innerFunction(Node pn, ParseContext* outerpc, HandleFunction fun, + InHandling inHandling, YieldHandling yieldHandling, + FunctionSyntaxKind kind, + GeneratorKind generatorKind, FunctionAsyncKind asyncKind, + bool tryAnnexB, + Directives inheritedDirectives, Directives* newDirectives) +{ + // Note that it is possible for outerpc != this->pc, as we may be + // attempting to syntax parse an inner function from an outer full + // parser. In that case, outerpc is a ParseContext from the full parser + // instead of the current top of the stack of the syntax parser. + + FunctionBox* funbox = newFunctionBox(pn, fun, inheritedDirectives, generatorKind, + asyncKind, tryAnnexB); + if (!funbox) + return false; + funbox->initWithEnclosingParseContext(outerpc, kind); + + return innerFunction(pn, outerpc, funbox, inHandling, yieldHandling, kind, inheritedDirectives, + newDirectives); +} + +template <typename ParseHandler> +bool +Parser<ParseHandler>::appendToCallSiteObj(Node callSiteObj) +{ + Node cookedNode = noSubstitutionTemplate(); + if (!cookedNode) + return false; + + JSAtom* atom = tokenStream.getRawTemplateStringAtom(); + if (!atom) + return false; + Node rawNode = handler.newTemplateStringLiteral(atom, pos()); + if (!rawNode) + return false; + + handler.addToCallSiteObject(callSiteObj, rawNode, cookedNode); + return true; +} + +template <> +ParseNode* +Parser<FullParseHandler>::standaloneLazyFunction(HandleFunction fun, bool strict, + GeneratorKind generatorKind, + FunctionAsyncKind asyncKind) +{ + MOZ_ASSERT(checkOptionsCalled); + + Node pn = handler.newFunctionDefinition(); + if (!pn) + return null(); + + Directives directives(strict); + FunctionBox* funbox = newFunctionBox(pn, fun, directives, generatorKind, asyncKind, + /* tryAnnexB = */ false); + if (!funbox) + return null(); + funbox->initFromLazyFunction(); + + Directives newDirectives = directives; + ParseContext funpc(this, funbox, &newDirectives); + if (!funpc.init()) + return null(); + + // Our tokenStream has no current token, so pn's position is garbage. + // Substitute the position of the first token in our source. If the function + // is a not-async arrow, use TokenStream::Operand to keep + // verifyConsistentModifier from complaining (we will use + // TokenStream::Operand in functionArguments). + TokenStream::Modifier modifier = (fun->isArrow() && asyncKind == SyncFunction) + ? TokenStream::Operand : TokenStream::None; + if (!tokenStream.peekTokenPos(&pn->pn_pos, modifier)) + return null(); + + YieldHandling yieldHandling = GetYieldHandling(generatorKind, asyncKind); + FunctionSyntaxKind syntaxKind = Statement; + if (fun->isClassConstructor()) + syntaxKind = ClassConstructor; + else if (fun->isMethod()) + syntaxKind = Method; + else if (fun->isGetter()) + syntaxKind = Getter; + else if (fun->isSetter()) + syntaxKind = Setter; + else if (fun->isArrow()) + syntaxKind = Arrow; + + if (!functionFormalParametersAndBody(InAllowed, yieldHandling, pn, syntaxKind)) { + MOZ_ASSERT(directives == newDirectives); + return null(); + } + + if (!FoldConstants(context, &pn, this)) + return null(); + + return pn; +} + +template <typename ParseHandler> +bool +Parser<ParseHandler>::functionFormalParametersAndBody(InHandling inHandling, + YieldHandling yieldHandling, + Node pn, FunctionSyntaxKind kind) +{ + // Given a properly initialized parse context, try to parse an actual + // function without concern for conversion to strict mode, use of lazy + // parsing and such. + + FunctionBox* funbox = pc->functionBox(); + RootedFunction fun(context, funbox->function()); + + AutoAwaitIsKeyword awaitIsKeyword(&tokenStream, funbox->isAsync()); + if (!functionArguments(yieldHandling, kind, pn)) + return false; + + Maybe<ParseContext::VarScope> varScope; + if (funbox->hasParameterExprs) { + varScope.emplace(this); + if (!varScope->init(pc)) + return false; + } else { + pc->functionScope().useAsVarScope(pc); + } + + if (kind == Arrow) { + bool matched; + if (!tokenStream.matchToken(&matched, TOK_ARROW)) + return false; + if (!matched) { + report(ParseError, false, null(), JSMSG_BAD_ARROW_ARGS); + return false; + } + } + + // Parse the function body. + FunctionBodyType bodyType = StatementListBody; + TokenKind tt; + if (!tokenStream.getToken(&tt, TokenStream::Operand)) + return false; + if (tt != TOK_LC) { + if ((funbox->isStarGenerator() && !funbox->isAsync()) || kind == Method || + kind == GetterNoExpressionClosure || kind == SetterNoExpressionClosure || + IsConstructorKind(kind)) { + report(ParseError, false, null(), JSMSG_CURLY_BEFORE_BODY); + return false; + } + + if (kind != Arrow) { +#if JS_HAS_EXPR_CLOSURES + addTelemetry(JSCompartment::DeprecatedExpressionClosure); + if (!warnOnceAboutExprClosure()) + return false; +#else + report(ParseError, false, null(), JSMSG_CURLY_BEFORE_BODY); + return false; +#endif + } + + tokenStream.ungetToken(); + bodyType = ExpressionBody; +#if JS_HAS_EXPR_CLOSURES + fun->setIsExprBody(); +#endif + } + + // Arrow function parameters inherit yieldHandling from the enclosing + // context, but the arrow body doesn't. E.g. in |(a = yield) => yield|, + // |yield| in the parameters is either a name or keyword, depending on + // whether the arrow function is enclosed in a generator function or not. + // Whereas the |yield| in the function body is always parsed as a name. + YieldHandling bodyYieldHandling = GetYieldHandling(pc->generatorKind(), pc->asyncKind()); + Node body = functionBody(inHandling, bodyYieldHandling, kind, bodyType); + if (!body) + return false; + + if ((kind != Method && !IsConstructorKind(kind)) && fun->name()) { + RootedPropertyName propertyName(context, fun->name()->asPropertyName()); + if (!checkStrictBinding(propertyName, handler.getPosition(pn))) + return false; + } + + if (bodyType == StatementListBody) { + bool matched; + if (!tokenStream.matchToken(&matched, TOK_RC, TokenStream::Operand)) + return false; + if (!matched) { + report(ParseError, false, null(), JSMSG_CURLY_AFTER_BODY); + return false; + } + funbox->bufEnd = pos().begin + 1; + } else { +#if !JS_HAS_EXPR_CLOSURES + MOZ_ASSERT(kind == Arrow); +#endif + if (tokenStream.hadError()) + return false; + funbox->bufEnd = pos().end; + if (kind == Statement && !MatchOrInsertSemicolonAfterExpression(tokenStream)) + return false; + } + + if (IsMethodDefinitionKind(kind) && pc->superScopeNeedsHomeObject()) + funbox->setNeedsHomeObject(); + + if (!finishFunction()) + return false; + + handler.setEndPosition(body, pos().begin); + handler.setEndPosition(pn, pos().end); + handler.setFunctionBody(pn, body); + + return true; +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::functionStmt(YieldHandling yieldHandling, DefaultHandling defaultHandling, + FunctionAsyncKind asyncKind) +{ + MOZ_ASSERT(tokenStream.isCurrentTokenType(TOK_FUNCTION)); + + // Annex B.3.4 says we can parse function declarations unbraced under if + // or else as if it were braced. That is, |if (x) function f() {}| is + // parsed as |if (x) { function f() {} }|. + Maybe<ParseContext::Statement> synthesizedStmtForAnnexB; + Maybe<ParseContext::Scope> synthesizedScopeForAnnexB; + if (!pc->sc()->strict()) { + ParseContext::Statement* stmt = pc->innermostStatement(); + if (stmt && stmt->kind() == StatementKind::If) { + synthesizedStmtForAnnexB.emplace(pc, StatementKind::Block); + synthesizedScopeForAnnexB.emplace(this); + if (!synthesizedScopeForAnnexB->init(pc)) + return null(); + } + } + + RootedPropertyName name(context); + GeneratorKind generatorKind = asyncKind == AsyncFunction ? StarGenerator : NotGenerator; + TokenKind tt; + if (!tokenStream.getToken(&tt)) + return null(); + + if (tt == TOK_MUL) { + if (asyncKind != SyncFunction) { + report(ParseError, false, null(), JSMSG_ASYNC_GENERATOR); + return null(); + } + generatorKind = StarGenerator; + if (!tokenStream.getToken(&tt)) + return null(); + } + + if (tt == TOK_NAME || tt == TOK_YIELD) { + name = bindingIdentifier(yieldHandling); + if (!name) + return null(); + } else if (defaultHandling == AllowDefaultName) { + name = context->names().starDefaultStar; + tokenStream.ungetToken(); + } else { + /* Unnamed function expressions are forbidden in statement context. */ + report(ParseError, false, null(), JSMSG_UNNAMED_FUNCTION_STMT); + return null(); + } + + YieldHandling newYieldHandling = GetYieldHandling(generatorKind, asyncKind); + Node fun = functionDefinition(InAllowed, newYieldHandling, name, Statement, generatorKind, + asyncKind, PredictUninvoked); + if (!fun) + return null(); + + if (synthesizedStmtForAnnexB) { + Node synthesizedStmtList = handler.newStatementList(handler.getPosition(fun)); + if (!synthesizedStmtList) + return null(); + handler.addStatementToList(synthesizedStmtList, fun); + return finishLexicalScope(*synthesizedScopeForAnnexB, synthesizedStmtList); + } + + return fun; +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::functionExpr(InvokedPrediction invoked, FunctionAsyncKind asyncKind) +{ + MOZ_ASSERT(tokenStream.isCurrentTokenType(TOK_FUNCTION)); + + AutoAwaitIsKeyword awaitIsKeyword(&tokenStream, asyncKind == AsyncFunction); + GeneratorKind generatorKind = asyncKind == AsyncFunction ? StarGenerator : NotGenerator; + TokenKind tt; + if (!tokenStream.getToken(&tt)) + return null(); + + if (tt == TOK_MUL) { + if (asyncKind != SyncFunction) { + report(ParseError, false, null(), JSMSG_ASYNC_GENERATOR); + return null(); + } + generatorKind = StarGenerator; + if (!tokenStream.getToken(&tt)) + return null(); + } + + YieldHandling yieldHandling = GetYieldHandling(generatorKind, asyncKind); + + RootedPropertyName name(context); + if (tt == TOK_NAME || tt == TOK_YIELD) { + name = bindingIdentifier(yieldHandling); + if (!name) + return null(); + } else { + tokenStream.ungetToken(); + } + + return functionDefinition(InAllowed, yieldHandling, name, Expression, generatorKind, + asyncKind, invoked); +} + +/* + * Return true if this node, known to be an unparenthesized string literal, + * could be the string of a directive in a Directive Prologue. Directive + * strings never contain escape sequences or line continuations. + * isEscapeFreeStringLiteral, below, checks whether the node itself could be + * a directive. + */ +static inline bool +IsEscapeFreeStringLiteral(const TokenPos& pos, JSAtom* str) +{ + /* + * If the string's length in the source code is its length as a value, + * accounting for the quotes, then it must not contain any escape + * sequences or line continuations. + */ + return pos.begin + str->length() + 2 == pos.end; +} + +template <typename ParseHandler> +bool +Parser<ParseHandler>::checkUnescapedName() +{ + if (!tokenStream.currentToken().nameContainsEscape()) + return true; + + report(ParseError, false, null(), JSMSG_ESCAPED_KEYWORD); + return false; +} + +template <> +bool +Parser<SyntaxParseHandler>::asmJS(Node list) +{ + // While asm.js could technically be validated and compiled during syntax + // parsing, we have no guarantee that some later JS wouldn't abort the + // syntax parse and cause us to re-parse (and re-compile) the asm.js module. + // For simplicity, unconditionally abort the syntax parse when "use asm" is + // encountered so that asm.js is always validated/compiled exactly once + // during a full parse. + JS_ALWAYS_FALSE(abortIfSyntaxParser()); + return false; +} + +template <> +bool +Parser<FullParseHandler>::asmJS(Node list) +{ + // Disable syntax parsing in anything nested inside the asm.js module. + handler.disableSyntaxParser(); + + // We should be encountering the "use asm" directive for the first time; if + // the directive is already, we must have failed asm.js validation and we're + // reparsing. In that case, don't try to validate again. A non-null + // newDirectives means we're not in a normal function. + if (!pc->newDirectives || pc->newDirectives->asmJS()) + return true; + + // If there is no ScriptSource, then we are doing a non-compiling parse and + // so we shouldn't (and can't, without a ScriptSource) compile. + if (ss == nullptr) + return true; + + pc->functionBox()->useAsm = true; + + // Attempt to validate and compile this asm.js module. On success, the + // tokenStream has been advanced to the closing }. On failure, the + // tokenStream is in an indeterminate state and we must reparse the + // function from the beginning. Reparsing is triggered by marking that a + // new directive has been encountered and returning 'false'. + bool validated; + if (!CompileAsmJS(context, *this, list, &validated)) + return false; + if (!validated) { + pc->newDirectives->setAsmJS(); + return false; + } + + return true; +} + +/* + * Recognize Directive Prologue members and directives. Assuming |pn| is a + * candidate for membership in a directive prologue, recognize directives and + * set |pc|'s flags accordingly. If |pn| is indeed part of a prologue, set its + * |pn_prologue| flag. + * + * Note that the following is a strict mode function: + * + * function foo() { + * "blah" // inserted semi colon + * "blurgh" + * "use\x20loose" + * "use strict" + * } + * + * That is, even though "use\x20loose" can never be a directive, now or in the + * future (because of the hex escape), the Directive Prologue extends through it + * to the "use strict" statement, which is indeed a directive. + */ +template <typename ParseHandler> +bool +Parser<ParseHandler>::maybeParseDirective(Node list, Node pn, bool* cont) +{ + TokenPos directivePos; + JSAtom* directive = handler.isStringExprStatement(pn, &directivePos); + + *cont = !!directive; + if (!*cont) + return true; + + if (IsEscapeFreeStringLiteral(directivePos, directive)) { + // Mark this statement as being a possibly legitimate part of a + // directive prologue, so the bytecode emitter won't warn about it being + // useless code. (We mustn't just omit the statement entirely yet, as it + // could be producing the value of an eval or JSScript execution.) + // + // Note that even if the string isn't one we recognize as a directive, + // the emitter still shouldn't flag it as useless, as it could become a + // directive in the future. We don't want to interfere with people + // taking advantage of directive-prologue-enabled features that appear + // in other browsers first. + handler.setPrologue(pn); + + if (directive == context->names().useStrict) { + // Functions with non-simple parameter lists (destructuring, + // default or rest parameters) must not contain a "use strict" + // directive. + if (pc->isFunctionBox()) { + FunctionBox* funbox = pc->functionBox(); + if (!funbox->hasSimpleParameterList()) { + const char* parameterKind = funbox->hasDestructuringArgs + ? "destructuring" + : funbox->hasParameterExprs + ? "default" + : "rest"; + reportWithOffset(ParseError, false, directivePos.begin, + JSMSG_STRICT_NON_SIMPLE_PARAMS, parameterKind); + return false; + } + } + + // We're going to be in strict mode. Note that this scope explicitly + // had "use strict"; + pc->sc()->setExplicitUseStrict(); + if (!pc->sc()->strict()) { + // We keep track of the one possible strict violation that could + // occur in the directive prologue -- octal escapes -- and + // complain now. + if (tokenStream.sawOctalEscape()) { + report(ParseError, false, null(), JSMSG_DEPRECATED_OCTAL); + return false; + } + pc->sc()->strictScript = true; + } + } else if (directive == context->names().useAsm) { + if (pc->isFunctionBox()) + return asmJS(list); + return report(ParseWarning, false, pn, JSMSG_USE_ASM_DIRECTIVE_FAIL); + } + } + return true; +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::statementList(YieldHandling yieldHandling) +{ + JS_CHECK_RECURSION(context, return null()); + + Node pn = handler.newStatementList(pos()); + if (!pn) + return null(); + + bool canHaveDirectives = pc->atBodyLevel(); + if (canHaveDirectives) + tokenStream.clearSawOctalEscape(); + bool afterReturn = false; + bool warnedAboutStatementsAfterReturn = false; + uint32_t statementBegin = 0; + for (;;) { + TokenKind tt = TOK_EOF; + if (!tokenStream.peekToken(&tt, TokenStream::Operand)) { + if (tokenStream.isEOF()) + isUnexpectedEOF_ = true; + return null(); + } + if (tt == TOK_EOF || tt == TOK_RC) + break; + if (afterReturn) { + TokenPos pos(0, 0); + if (!tokenStream.peekTokenPos(&pos, TokenStream::Operand)) + return null(); + statementBegin = pos.begin; + } + Node next = statementListItem(yieldHandling, canHaveDirectives); + if (!next) { + if (tokenStream.isEOF()) + isUnexpectedEOF_ = true; + return null(); + } + if (!warnedAboutStatementsAfterReturn) { + if (afterReturn) { + if (!handler.isStatementPermittedAfterReturnStatement(next)) { + if (!reportWithOffset(ParseWarning, false, statementBegin, + JSMSG_STMT_AFTER_RETURN)) + { + return null(); + } + warnedAboutStatementsAfterReturn = true; + } + } else if (handler.isReturnStatement(next)) { + afterReturn = true; + } + } + + if (canHaveDirectives) { + if (!maybeParseDirective(pn, next, &canHaveDirectives)) + return null(); + } + + handler.addStatementToList(pn, next); + } + + return pn; +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::condition(InHandling inHandling, YieldHandling yieldHandling) +{ + MUST_MATCH_TOKEN(TOK_LP, JSMSG_PAREN_BEFORE_COND); + Node pn = exprInParens(inHandling, yieldHandling, TripledotProhibited); + if (!pn) + return null(); + MUST_MATCH_TOKEN(TOK_RP, JSMSG_PAREN_AFTER_COND); + + /* Check for (a = b) and warn about possible (a == b) mistype. */ + if (handler.isUnparenthesizedAssignment(pn)) { + if (!report(ParseExtraWarning, false, null(), JSMSG_EQUAL_AS_ASSIGN)) + return null(); + } + return pn; +} + +template <typename ParseHandler> +bool +Parser<ParseHandler>::matchLabel(YieldHandling yieldHandling, MutableHandle<PropertyName*> label) +{ + TokenKind tt = TOK_EOF; + if (!tokenStream.peekTokenSameLine(&tt, TokenStream::Operand)) + return false; + + if (tt == TOK_NAME || tt == TOK_YIELD) { + tokenStream.consumeKnownToken(tt, TokenStream::Operand); + + label.set(labelIdentifier(yieldHandling)); + if (!label) + return false; + } else { + label.set(nullptr); + } + return true; +} + +template <typename ParseHandler> +Parser<ParseHandler>::PossibleError::PossibleError(Parser<ParseHandler>& parser) + : parser_(parser) +{} + +template <typename ParseHandler> +typename Parser<ParseHandler>::PossibleError::Error& +Parser<ParseHandler>::PossibleError::error(ErrorKind kind) +{ + if (kind == ErrorKind::Expression) + return exprError_; + MOZ_ASSERT(kind == ErrorKind::Destructuring); + return destructuringError_; +} + +template <typename ParseHandler> +void +Parser<ParseHandler>::PossibleError::setResolved(ErrorKind kind) +{ + error(kind).state_ = ErrorState::None; +} + +template <typename ParseHandler> +bool +Parser<ParseHandler>::PossibleError::hasError(ErrorKind kind) +{ + return error(kind).state_ == ErrorState::Pending; +} + +template <typename ParseHandler> +void +Parser<ParseHandler>::PossibleError::setPending(ErrorKind kind, Node pn, unsigned errorNumber) +{ + // Don't overwrite a previously recorded error. + if (hasError(kind)) + return; + + // If we report an error later, we'll do it from the position where we set + // the state to pending. + Error& err = error(kind); + err.offset_ = (pn ? parser_.handler.getPosition(pn) : parser_.pos()).begin; + err.errorNumber_ = errorNumber; + err.state_ = ErrorState::Pending; +} + +template <typename ParseHandler> +void +Parser<ParseHandler>::PossibleError::setPendingDestructuringError(Node pn, unsigned errorNumber) +{ + setPending(ErrorKind::Destructuring, pn, errorNumber); +} + +template <typename ParseHandler> +void +Parser<ParseHandler>::PossibleError::setPendingExpressionError(Node pn, unsigned errorNumber) +{ + setPending(ErrorKind::Expression, pn, errorNumber); +} + +template <typename ParseHandler> +bool +Parser<ParseHandler>::PossibleError::checkForError(ErrorKind kind) +{ + if (!hasError(kind)) + return true; + + Error& err = error(kind); + parser_.reportWithOffset(ParseError, false, err.offset_, err.errorNumber_); + return false; +} + +template <typename ParseHandler> +bool +Parser<ParseHandler>::PossibleError::checkForDestructuringError() +{ + // Clear pending expression error, because we're definitely not in an + // expression context. + setResolved(ErrorKind::Expression); + + // Report any pending destructuring error. + return checkForError(ErrorKind::Destructuring); +} + +template <typename ParseHandler> +bool +Parser<ParseHandler>::PossibleError::checkForExpressionError() +{ + // Clear pending destructuring error, because we're definitely not in a + // destructuring context. + setResolved(ErrorKind::Destructuring); + + // Report any pending expression error. + return checkForError(ErrorKind::Expression); +} + +template <typename ParseHandler> +void +Parser<ParseHandler>::PossibleError::transferErrorTo(ErrorKind kind, PossibleError* other) +{ + if (hasError(kind) && !other->hasError(kind)) { + Error& err = error(kind); + Error& otherErr = other->error(kind); + otherErr.offset_ = err.offset_; + otherErr.errorNumber_ = err.errorNumber_; + otherErr.state_ = err.state_; + } +} + +template <typename ParseHandler> +void +Parser<ParseHandler>::PossibleError::transferErrorsTo(PossibleError* other) +{ + MOZ_ASSERT(other); + MOZ_ASSERT(this != other); + MOZ_ASSERT(&parser_ == &other->parser_, + "Can't transfer fields to an instance which belongs to a different parser"); + + transferErrorTo(ErrorKind::Destructuring, other); + transferErrorTo(ErrorKind::Expression, other); +} + +template <typename ParseHandler> +bool +Parser<ParseHandler>::checkAssignmentToCall(Node target, unsigned msg) +{ + MOZ_ASSERT(handler.isFunctionCall(target)); + + // Assignment to function calls is forbidden in ES6. We're still somewhat + // concerned about sites using this in dead code, so forbid it only in + // strict mode code (or if the werror option has been set), and otherwise + // warn. + return report(ParseStrictError, pc->sc()->strict(), target, msg); +} + +template <> +bool +Parser<FullParseHandler>::checkDestructuringName(ParseNode* expr, Maybe<DeclarationKind> maybeDecl) +{ + MOZ_ASSERT(!handler.isUnparenthesizedDestructuringPattern(expr)); + + // Parentheses are forbidden around destructuring *patterns* (but allowed + // around names). Use our nicer error message for parenthesized, nested + // patterns. + if (handler.isParenthesizedDestructuringPattern(expr)) { + report(ParseError, false, expr, JSMSG_BAD_DESTRUCT_PARENS); + return false; + } + + // This expression might be in a variable-binding pattern where only plain, + // unparenthesized names are permitted. + if (maybeDecl) { + // Destructuring patterns in declarations must only contain + // unparenthesized names. + if (!handler.isUnparenthesizedName(expr)) { + report(ParseError, false, expr, JSMSG_NO_VARIABLE_NAME); + return false; + } + + RootedPropertyName name(context, expr->name()); + return noteDeclaredName(name, *maybeDecl, handler.getPosition(expr)); + } + + // Otherwise this is an expression in destructuring outside a declaration. + if (!reportIfNotValidSimpleAssignmentTarget(expr, KeyedDestructuringAssignment)) + return false; + + MOZ_ASSERT(!handler.isFunctionCall(expr), + "function calls shouldn't be considered valid targets in " + "destructuring patterns"); + + if (handler.isNameAnyParentheses(expr)) { + // The arguments/eval identifiers are simple in non-strict mode code. + // Warn to discourage their use nonetheless. + return reportIfArgumentsEvalTarget(expr); + } + + // Nothing further to do for property accesses. + MOZ_ASSERT(handler.isPropertyAccess(expr)); + return true; +} + +template <> +bool +Parser<FullParseHandler>::checkDestructuringPattern(ParseNode* pattern, + Maybe<DeclarationKind> maybeDecl, + PossibleError* possibleError /* = nullptr */); + +template <> +bool +Parser<FullParseHandler>::checkDestructuringObject(ParseNode* objectPattern, + Maybe<DeclarationKind> maybeDecl) +{ + MOZ_ASSERT(objectPattern->isKind(PNK_OBJECT)); + + for (ParseNode* member = objectPattern->pn_head; member; member = member->pn_next) { + ParseNode* target; + if (member->isKind(PNK_MUTATEPROTO)) { + target = member->pn_kid; + } else { + MOZ_ASSERT(member->isKind(PNK_COLON) || member->isKind(PNK_SHORTHAND)); + MOZ_ASSERT_IF(member->isKind(PNK_SHORTHAND), + member->pn_left->isKind(PNK_OBJECT_PROPERTY_NAME) && + member->pn_right->isKind(PNK_NAME) && + member->pn_left->pn_atom == member->pn_right->pn_atom); + + target = member->pn_right; + } + if (handler.isUnparenthesizedAssignment(target)) + target = target->pn_left; + + if (handler.isUnparenthesizedDestructuringPattern(target)) { + if (!checkDestructuringPattern(target, maybeDecl)) + return false; + } else { + if (!checkDestructuringName(target, maybeDecl)) + return false; + } + } + + return true; +} + +template <> +bool +Parser<FullParseHandler>::checkDestructuringArray(ParseNode* arrayPattern, + Maybe<DeclarationKind> maybeDecl) +{ + MOZ_ASSERT(arrayPattern->isKind(PNK_ARRAY)); + + for (ParseNode* element = arrayPattern->pn_head; element; element = element->pn_next) { + if (element->isKind(PNK_ELISION)) + continue; + + ParseNode* target; + if (element->isKind(PNK_SPREAD)) { + if (element->pn_next) { + report(ParseError, false, element->pn_next, JSMSG_PARAMETER_AFTER_REST); + return false; + } + target = element->pn_kid; + } else if (handler.isUnparenthesizedAssignment(element)) { + target = element->pn_left; + } else { + target = element; + } + + if (handler.isUnparenthesizedDestructuringPattern(target)) { + if (!checkDestructuringPattern(target, maybeDecl)) + return false; + } else { + if (!checkDestructuringName(target, maybeDecl)) + return false; + } + } + + return true; +} + +/* + * Destructuring patterns can appear in two kinds of contexts: + * + * - assignment-like: assignment expressions and |for| loop heads. In + * these cases, the patterns' property value positions can be + * arbitrary lvalue expressions; the destructuring is just a fancy + * assignment. + * + * - binding-like: |var| and |let| declarations, functions' formal + * parameter lists, |catch| clauses, and comprehension tails. In + * these cases, the patterns' property value positions must be + * simple names; the destructuring defines them as new variables. + * + * In both cases, other code parses the pattern as an arbitrary + * primaryExpr, and then, here in checkDestructuringPattern, verify + * that the tree is a valid AssignmentPattern or BindingPattern. + * + * In assignment-like contexts, we parse the pattern with + * pc->inDestructuringDecl clear, so the lvalue expressions in the + * pattern are parsed normally. primaryExpr links variable references + * into the appropriate use chains; creates placeholder definitions; + * and so on. checkDestructuringPattern won't bind any new names and + * we specialize lvalues as appropriate. + * + * In declaration-like contexts, the normal variable reference + * processing would just be an obstruction, because we're going to + * define the names that appear in the property value positions as new + * variables anyway. In this case, we parse the pattern with + * pc->inDestructuringDecl set, which directs primaryExpr to leave + * whatever name nodes it creates unconnected. Then, here in + * checkDestructuringPattern, we require the pattern's property value + * positions to be simple names, and define them as appropriate to the + * context. + */ +template <> +bool +Parser<FullParseHandler>::checkDestructuringPattern(ParseNode* pattern, + Maybe<DeclarationKind> maybeDecl, + PossibleError* possibleError /* = nullptr */) +{ + if (pattern->isKind(PNK_ARRAYCOMP)) { + report(ParseError, false, pattern, JSMSG_ARRAY_COMP_LEFTSIDE); + return false; + } + + bool isDestructuring = pattern->isKind(PNK_ARRAY) + ? checkDestructuringArray(pattern, maybeDecl) + : checkDestructuringObject(pattern, maybeDecl); + + // Report any pending destructuring error. + if (isDestructuring && possibleError && !possibleError->checkForDestructuringError()) + return false; + + return isDestructuring; +} + +template <> +bool +Parser<SyntaxParseHandler>::checkDestructuringPattern(Node pattern, + Maybe<DeclarationKind> maybeDecl, + PossibleError* possibleError /* = nullptr */) +{ + return abortIfSyntaxParser(); +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::destructuringDeclaration(DeclarationKind kind, YieldHandling yieldHandling, + TokenKind tt) +{ + MOZ_ASSERT(tokenStream.isCurrentTokenType(tt)); + MOZ_ASSERT(tt == TOK_LB || tt == TOK_LC); + + PossibleError possibleError(*this); + Node pattern; + { + pc->inDestructuringDecl = Some(kind); + pattern = primaryExpr(yieldHandling, TripledotProhibited, tt, &possibleError); + pc->inDestructuringDecl = Nothing(); + } + + if (!pattern || !checkDestructuringPattern(pattern, Some(kind), &possibleError)) + return null(); + + return pattern; +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::destructuringDeclarationWithoutYieldOrAwait(DeclarationKind kind, + YieldHandling yieldHandling, + TokenKind tt) +{ + uint32_t startYieldOffset = pc->lastYieldOffset; + uint32_t startAwaitOffset = pc->lastAwaitOffset; + Node res = destructuringDeclaration(kind, yieldHandling, tt); + if (res) { + if (pc->lastYieldOffset != startYieldOffset) { + reportWithOffset(ParseError, false, pc->lastYieldOffset, JSMSG_YIELD_IN_DEFAULT); + return null(); + } + if (pc->lastAwaitOffset != startAwaitOffset) { + reportWithOffset(ParseError, false, pc->lastAwaitOffset, JSMSG_AWAIT_IN_DEFAULT); + return null(); + } + } + return res; +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::blockStatement(YieldHandling yieldHandling, unsigned errorNumber) +{ + MOZ_ASSERT(tokenStream.isCurrentTokenType(TOK_LC)); + + ParseContext::Statement stmt(pc, StatementKind::Block); + ParseContext::Scope scope(this); + if (!scope.init(pc)) + return null(); + + Node list = statementList(yieldHandling); + if (!list) + return null(); + + MUST_MATCH_TOKEN_MOD(TOK_RC, TokenStream::Operand, errorNumber); + + return finishLexicalScope(scope, list); +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::expressionAfterForInOrOf(ParseNodeKind forHeadKind, + YieldHandling yieldHandling) +{ + MOZ_ASSERT(forHeadKind == PNK_FORIN || forHeadKind == PNK_FOROF); + Node pn = forHeadKind == PNK_FOROF + ? assignExpr(InAllowed, yieldHandling, TripledotProhibited) + : expr(InAllowed, yieldHandling, TripledotProhibited); + return pn; +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::declarationPattern(Node decl, DeclarationKind declKind, TokenKind tt, + bool initialDeclaration, YieldHandling yieldHandling, + ParseNodeKind* forHeadKind, Node* forInOrOfExpression) +{ + MOZ_ASSERT(tokenStream.isCurrentTokenType(TOK_LB) || + tokenStream.isCurrentTokenType(TOK_LC)); + + Node pattern = destructuringDeclaration(declKind, yieldHandling, tt); + if (!pattern) + return null(); + + if (initialDeclaration && forHeadKind) { + bool isForIn, isForOf; + if (!matchInOrOf(&isForIn, &isForOf)) + return null(); + + if (isForIn) { + *forHeadKind = PNK_FORIN; + } else if (isForOf) { + *forHeadKind = PNK_FOROF; + + // Annex B.3.5 has different early errors for vars in for-of loops. + if (declKind == DeclarationKind::Var) + declKind = DeclarationKind::ForOfVar; + } else { + *forHeadKind = PNK_FORHEAD; + } + + if (*forHeadKind != PNK_FORHEAD) { + *forInOrOfExpression = expressionAfterForInOrOf(*forHeadKind, yieldHandling); + if (!*forInOrOfExpression) + return null(); + + return pattern; + } + } + + TokenKind token; + if (!tokenStream.getToken(&token, TokenStream::None)) + return null(); + + if (token != TOK_ASSIGN) { + report(ParseError, false, null(), JSMSG_BAD_DESTRUCT_DECL); + return null(); + } + + Node init = assignExpr(forHeadKind ? InProhibited : InAllowed, + yieldHandling, TripledotProhibited); + if (!init) + return null(); + + if (forHeadKind) { + // For for(;;) declarations, consistency with |for (;| parsing requires + // that the ';' first be examined as Operand, even though absence of a + // binary operator (examined with modifier None) terminated |init|. + // For all other declarations, through ASI's infinite majesty, a next + // token on a new line would begin an expression. + tokenStream.addModifierException(TokenStream::OperandIsNone); + } + + return handler.newBinary(PNK_ASSIGN, pattern, init); +} + +template <typename ParseHandler> +bool +Parser<ParseHandler>::initializerInNameDeclaration(Node decl, Node binding, + Handle<PropertyName*> name, + DeclarationKind declKind, + bool initialDeclaration, + YieldHandling yieldHandling, + ParseNodeKind* forHeadKind, + Node* forInOrOfExpression) +{ + MOZ_ASSERT(tokenStream.isCurrentTokenType(TOK_ASSIGN)); + + Node initializer = assignExpr(forHeadKind ? InProhibited : InAllowed, + yieldHandling, TripledotProhibited); + if (!initializer) + return false; + + if (forHeadKind) { + if (initialDeclaration) { + bool isForIn, isForOf; + if (!matchInOrOf(&isForIn, &isForOf)) + return false; + + // An initialized declaration can't appear in a for-of: + // + // for (var/let/const x = ... of ...); // BAD + if (isForOf) { + report(ParseError, false, binding, JSMSG_BAD_FOR_LEFTSIDE); + return false; + } + + if (isForIn) { + // Lexical declarations in for-in loops can't be initialized: + // + // for (let/const x = ... in ...); // BAD + if (DeclarationKindIsLexical(declKind)) { + report(ParseError, false, binding, JSMSG_BAD_FOR_LEFTSIDE); + return false; + } + + // This leaves only initialized for-in |var| declarations. ES6 + // forbids these; later ES un-forbids in non-strict mode code. + *forHeadKind = PNK_FORIN; + if (!report(ParseStrictError, pc->sc()->strict(), initializer, + JSMSG_INVALID_FOR_IN_DECL_WITH_INIT)) + { + return false; + } + + *forInOrOfExpression = expressionAfterForInOrOf(PNK_FORIN, yieldHandling); + if (!*forInOrOfExpression) + return false; + } else { + *forHeadKind = PNK_FORHEAD; + } + } else { + MOZ_ASSERT(*forHeadKind == PNK_FORHEAD); + + // In the very rare case of Parser::assignExpr consuming an + // ArrowFunction with block body, when full-parsing with the arrow + // function being a skipped lazy inner function, we don't have + // lookahead for the next token. Do a one-off peek here to be + // consistent with what Parser::matchForInOrOf does in the other + // arm of this |if|. + // + // If you think this all sounds pretty code-smelly, you're almost + // certainly correct. + TokenKind ignored; + if (!tokenStream.peekToken(&ignored)) + return false; + } + + if (*forHeadKind == PNK_FORHEAD) { + // Per Parser::forHeadStart, the semicolon in |for (;| is + // ultimately gotten as Operand. But initializer expressions + // terminate with the absence of an operator gotten as None, + // so we need an exception. + tokenStream.addModifierException(TokenStream::OperandIsNone); + } + } + + return handler.finishInitializerAssignment(binding, initializer); +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::declarationName(Node decl, DeclarationKind declKind, TokenKind tt, + bool initialDeclaration, YieldHandling yieldHandling, + ParseNodeKind* forHeadKind, Node* forInOrOfExpression) +{ + // Anything other than TOK_YIELD or TOK_NAME is an error. + if (tt != TOK_NAME && tt != TOK_YIELD) { + report(ParseError, false, null(), JSMSG_NO_VARIABLE_NAME); + return null(); + } + + RootedPropertyName name(context, bindingIdentifier(yieldHandling)); + if (!name) + return null(); + + Node binding = newName(name); + if (!binding) + return null(); + + TokenPos namePos = pos(); + + // The '=' context after a variable name in a declaration is an opportunity + // for ASI, and thus for the next token to start an ExpressionStatement: + // + // var foo // VariableDeclaration + // /bar/g; // ExpressionStatement + // + // Therefore get the token here as Operand. + bool matched; + if (!tokenStream.matchToken(&matched, TOK_ASSIGN, TokenStream::Operand)) + return null(); + + if (matched) { + if (!initializerInNameDeclaration(decl, binding, name, declKind, initialDeclaration, + yieldHandling, forHeadKind, forInOrOfExpression)) + { + return null(); + } + } else { + tokenStream.addModifierException(TokenStream::NoneIsOperand); + + if (initialDeclaration && forHeadKind) { + bool isForIn, isForOf; + if (!matchInOrOf(&isForIn, &isForOf)) + return null(); + + if (isForIn) { + *forHeadKind = PNK_FORIN; + } else if (isForOf) { + *forHeadKind = PNK_FOROF; + + // Annex B.3.5 has different early errors for vars in for-of loops. + if (declKind == DeclarationKind::Var) + declKind = DeclarationKind::ForOfVar; + } else { + *forHeadKind = PNK_FORHEAD; + } + } + + if (forHeadKind && *forHeadKind != PNK_FORHEAD) { + *forInOrOfExpression = expressionAfterForInOrOf(*forHeadKind, yieldHandling); + if (!*forInOrOfExpression) + return null(); + } else { + // Normal const declarations, and const declarations in for(;;) + // heads, must be initialized. + if (declKind == DeclarationKind::Const) { + report(ParseError, false, binding, JSMSG_BAD_CONST_DECL); + return null(); + } + } + } + + // Note the declared name after knowing whether or not we are in a for-of + // loop, due to special early error semantics in Annex B.3.5. + if (!noteDeclaredName(name, declKind, namePos)) + return null(); + + return binding; +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::declarationList(YieldHandling yieldHandling, + ParseNodeKind kind, + ParseNodeKind* forHeadKind /* = nullptr */, + Node* forInOrOfExpression /* = nullptr */) +{ + MOZ_ASSERT(kind == PNK_VAR || kind == PNK_LET || kind == PNK_CONST); + + JSOp op; + DeclarationKind declKind; + switch (kind) { + case PNK_VAR: + op = JSOP_DEFVAR; + declKind = DeclarationKind::Var; + break; + case PNK_CONST: + op = JSOP_DEFCONST; + declKind = DeclarationKind::Const; + break; + case PNK_LET: + op = JSOP_DEFLET; + declKind = DeclarationKind::Let; + break; + default: + MOZ_CRASH("Unknown declaration kind"); + } + + Node decl = handler.newDeclarationList(kind, op); + if (!decl) + return null(); + + bool matched; + bool initialDeclaration = true; + do { + MOZ_ASSERT_IF(!initialDeclaration && forHeadKind, + *forHeadKind == PNK_FORHEAD); + + TokenKind tt; + if (!tokenStream.getToken(&tt)) + return null(); + + Node binding = (tt == TOK_LB || tt == TOK_LC) + ? declarationPattern(decl, declKind, tt, initialDeclaration, yieldHandling, + forHeadKind, forInOrOfExpression) + : declarationName(decl, declKind, tt, initialDeclaration, yieldHandling, + forHeadKind, forInOrOfExpression); + if (!binding) + return null(); + + handler.addList(decl, binding); + + if (forHeadKind && *forHeadKind != PNK_FORHEAD) + break; + + initialDeclaration = false; + + if (!tokenStream.matchToken(&matched, TOK_COMMA)) + return null(); + } while (matched); + + return decl; +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::lexicalDeclaration(YieldHandling yieldHandling, bool isConst) +{ + /* + * Parse body-level lets without a new block object. ES6 specs + * that an execution environment's initial lexical environment + * is the VariableEnvironment, i.e., body-level lets are in + * the same environment record as vars. + * + * However, they cannot be parsed exactly as vars, as ES6 + * requires that uninitialized lets throw ReferenceError on use. + * + * See 8.1.1.1.6 and the note in 13.2.1. + */ + Node decl = declarationList(yieldHandling, isConst ? PNK_CONST : PNK_LET); + if (!decl || !MatchOrInsertSemicolonAfterExpression(tokenStream)) + return null(); + + return decl; +} + +template <> +bool +Parser<FullParseHandler>::namedImportsOrNamespaceImport(TokenKind tt, Node importSpecSet) +{ + if (tt == TOK_LC) { + TokenStream::Modifier modifier = TokenStream::KeywordIsName; + while (true) { + // Handle the forms |import {} from 'a'| and + // |import { ..., } from 'a'| (where ... is non empty), by + // escaping the loop early if the next token is }. + if (!tokenStream.peekToken(&tt, TokenStream::KeywordIsName)) + return false; + + if (tt == TOK_RC) + break; + + // If the next token is a keyword, the previous call to + // peekToken matched it as a TOK_NAME, and put it in the + // lookahead buffer, so this call will match keywords as well. + MUST_MATCH_TOKEN_MOD(TOK_NAME, TokenStream::KeywordIsName, JSMSG_NO_IMPORT_NAME); + Rooted<PropertyName*> importName(context, tokenStream.currentName()); + TokenPos importNamePos = pos(); + + TokenKind maybeAs; + if (!tokenStream.peekToken(&maybeAs)) + return null(); + + if (maybeAs == TOK_NAME && + tokenStream.nextName() == context->names().as) + { + tokenStream.consumeKnownToken(TOK_NAME); + + if (!checkUnescapedName()) + return false; + + TokenKind afterAs; + if (!tokenStream.getToken(&afterAs)) + return false; + + if (afterAs != TOK_NAME && afterAs != TOK_YIELD) { + report(ParseError, false, null(), JSMSG_NO_BINDING_NAME); + return false; + } + } else { + // Keywords cannot be bound to themselves, so an import name + // that is a keyword is a syntax error if it is not followed + // by the keyword 'as'. + // See the ImportSpecifier production in ES6 section 15.2.2. + if (IsKeyword(importName)) { + JSAutoByteString bytes; + if (!AtomToPrintableString(context, importName, &bytes)) + return false; + report(ParseError, false, null(), JSMSG_AS_AFTER_RESERVED_WORD, bytes.ptr()); + return false; + } + } + + RootedPropertyName bindingAtom(context, importedBinding()); + if (!bindingAtom) + return false; + + Node bindingName = newName(bindingAtom); + if (!bindingName) + return false; + if (!noteDeclaredName(bindingAtom, DeclarationKind::Import, pos())) + return false; + + Node importNameNode = newName(importName, importNamePos); + if (!importNameNode) + return false; + + Node importSpec = handler.newBinary(PNK_IMPORT_SPEC, importNameNode, bindingName); + if (!importSpec) + return false; + + handler.addList(importSpecSet, importSpec); + + bool matched; + if (!tokenStream.matchToken(&matched, TOK_COMMA)) + return false; + + if (!matched) { + modifier = TokenStream::None; + break; + } + } + + MUST_MATCH_TOKEN_MOD(TOK_RC, modifier, JSMSG_RC_AFTER_IMPORT_SPEC_LIST); + } else { + MOZ_ASSERT(tt == TOK_MUL); + if (!tokenStream.getToken(&tt)) + return false; + + if (tt != TOK_NAME || tokenStream.currentName() != context->names().as) { + report(ParseError, false, null(), JSMSG_AS_AFTER_IMPORT_STAR); + return false; + } + + if (!checkUnescapedName()) + return false; + + MUST_MATCH_TOKEN(TOK_NAME, JSMSG_NO_BINDING_NAME); + + Node importName = newName(context->names().star); + if (!importName) + return false; + + // Namespace imports are are not indirect bindings but lexical + // definitions that hold a module namespace object. They are treated + // as const variables which are initialized during the + // ModuleDeclarationInstantiation step. + RootedPropertyName bindingName(context, importedBinding()); + if (!bindingName) + return false; + Node bindingNameNode = newName(bindingName); + if (!bindingNameNode) + return false; + if (!noteDeclaredName(bindingName, DeclarationKind::Const, pos())) + return false; + + // The namespace import name is currently required to live on the + // environment. + pc->varScope().lookupDeclaredName(bindingName)->value()->setClosedOver(); + + Node importSpec = handler.newBinary(PNK_IMPORT_SPEC, importName, bindingNameNode); + if (!importSpec) + return false; + + handler.addList(importSpecSet, importSpec); + } + + return true; +} + +template<> +bool +Parser<SyntaxParseHandler>::namedImportsOrNamespaceImport(TokenKind tt, Node importSpecSet) +{ + MOZ_ALWAYS_FALSE(abortIfSyntaxParser()); + return false; +} + +template<> +ParseNode* +Parser<FullParseHandler>::importDeclaration() +{ + MOZ_ASSERT(tokenStream.currentToken().type == TOK_IMPORT); + + if (!pc->atModuleLevel()) { + report(ParseError, false, null(), JSMSG_IMPORT_DECL_AT_TOP_LEVEL); + return null(); + } + + uint32_t begin = pos().begin; + TokenKind tt; + if (!tokenStream.getToken(&tt)) + return null(); + + Node importSpecSet = handler.newList(PNK_IMPORT_SPEC_LIST); + if (!importSpecSet) + return null(); + + if (tt == TOK_NAME || tt == TOK_LC || tt == TOK_MUL) { + if (tt == TOK_NAME) { + // Handle the form |import a from 'b'|, by adding a single import + // specifier to the list, with 'default' as the import name and + // 'a' as the binding name. This is equivalent to + // |import { default as a } from 'b'|. + Node importName = newName(context->names().default_); + if (!importName) + return null(); + + RootedPropertyName bindingAtom(context, importedBinding()); + if (!bindingAtom) + return null(); + + Node bindingName = newName(bindingAtom); + if (!bindingName) + return null(); + + if (!noteDeclaredName(bindingAtom, DeclarationKind::Import, pos())) + return null(); + + Node importSpec = handler.newBinary(PNK_IMPORT_SPEC, importName, bindingName); + if (!importSpec) + return null(); + + handler.addList(importSpecSet, importSpec); + + if (!tokenStream.peekToken(&tt)) + return null(); + + if (tt == TOK_COMMA) { + tokenStream.consumeKnownToken(tt); + if (!tokenStream.getToken(&tt)) + return null(); + + if (tt != TOK_LC && tt != TOK_MUL) { + report(ParseError, false, null(), JSMSG_NAMED_IMPORTS_OR_NAMESPACE_IMPORT); + return null(); + } + + if (!namedImportsOrNamespaceImport(tt, importSpecSet)) + return null(); + } + } else { + if (!namedImportsOrNamespaceImport(tt, importSpecSet)) + return null(); + } + + if (!tokenStream.getToken(&tt)) + return null(); + + if (tt != TOK_NAME || tokenStream.currentName() != context->names().from) { + report(ParseError, false, null(), JSMSG_FROM_AFTER_IMPORT_CLAUSE); + return null(); + } + + if (!checkUnescapedName()) + return null(); + + MUST_MATCH_TOKEN(TOK_STRING, JSMSG_MODULE_SPEC_AFTER_FROM); + } else if (tt == TOK_STRING) { + // Handle the form |import 'a'| by leaving the list empty. This is + // equivalent to |import {} from 'a'|. + importSpecSet->pn_pos.end = importSpecSet->pn_pos.begin; + } else { + report(ParseError, false, null(), JSMSG_DECLARATION_AFTER_IMPORT); + return null(); + } + + Node moduleSpec = stringLiteral(); + if (!moduleSpec) + return null(); + + if (!MatchOrInsertSemicolonAfterNonExpression(tokenStream)) + return null(); + + ParseNode* node = + handler.newImportDeclaration(importSpecSet, moduleSpec, TokenPos(begin, pos().end)); + if (!node || !pc->sc()->asModuleContext()->builder.processImport(node)) + return null(); + + return node; +} + +template<> +SyntaxParseHandler::Node +Parser<SyntaxParseHandler>::importDeclaration() +{ + JS_ALWAYS_FALSE(abortIfSyntaxParser()); + return SyntaxParseHandler::NodeFailure; +} + +template<> +bool +Parser<FullParseHandler>::checkExportedName(JSAtom* exportName) +{ + if (!pc->sc()->asModuleContext()->builder.hasExportedName(exportName)) + return true; + + JSAutoByteString str; + if (!AtomToPrintableString(context, exportName, &str)) + return false; + + report(ParseError, false, null(), JSMSG_DUPLICATE_EXPORT_NAME, str.ptr()); + return false; +} + +template<> +bool +Parser<SyntaxParseHandler>::checkExportedName(JSAtom* exportName) +{ + MOZ_ALWAYS_FALSE(abortIfSyntaxParser()); + return false; +} + +template<> +bool +Parser<FullParseHandler>::checkExportedNamesForDeclaration(ParseNode* node) +{ + MOZ_ASSERT(node->isArity(PN_LIST)); + for (ParseNode* binding = node->pn_head; binding; binding = binding->pn_next) { + if (binding->isKind(PNK_ASSIGN)) + binding = binding->pn_left; + MOZ_ASSERT(binding->isKind(PNK_NAME)); + if (!checkExportedName(binding->pn_atom)) + return false; + } + + return true; +} + +template<> +bool +Parser<SyntaxParseHandler>::checkExportedNamesForDeclaration(Node node) +{ + MOZ_ALWAYS_FALSE(abortIfSyntaxParser()); + return false; +} + +template<> +ParseNode* +Parser<FullParseHandler>::exportDeclaration() +{ + MOZ_ASSERT(tokenStream.currentToken().type == TOK_EXPORT); + + if (!pc->atModuleLevel()) { + report(ParseError, false, null(), JSMSG_EXPORT_DECL_AT_TOP_LEVEL); + return null(); + } + + uint32_t begin = pos().begin; + + Node kid; + TokenKind tt; + if (!tokenStream.getToken(&tt)) + return null(); + switch (tt) { + case TOK_LC: { + kid = handler.newList(PNK_EXPORT_SPEC_LIST); + if (!kid) + return null(); + + while (true) { + // Handle the forms |export {}| and |export { ..., }| (where ... + // is non empty), by escaping the loop early if the next token + // is }. + if (!tokenStream.peekToken(&tt)) + return null(); + if (tt == TOK_RC) + break; + + MUST_MATCH_TOKEN(TOK_NAME, JSMSG_NO_BINDING_NAME); + Node bindingName = newName(tokenStream.currentName()); + if (!bindingName) + return null(); + + bool foundAs; + if (!tokenStream.matchContextualKeyword(&foundAs, context->names().as)) + return null(); + if (foundAs) { + if (!tokenStream.getToken(&tt, TokenStream::KeywordIsName)) + return null(); + if (tt != TOK_NAME) { + report(ParseError, false, null(), JSMSG_NO_EXPORT_NAME); + return null(); + } + } + + Node exportName = newName(tokenStream.currentName()); + if (!exportName) + return null(); + + if (!checkExportedName(exportName->pn_atom)) + return null(); + + Node exportSpec = handler.newBinary(PNK_EXPORT_SPEC, bindingName, exportName); + if (!exportSpec) + return null(); + + handler.addList(kid, exportSpec); + + bool matched; + if (!tokenStream.matchToken(&matched, TOK_COMMA)) + return null(); + if (!matched) + break; + } + + MUST_MATCH_TOKEN(TOK_RC, JSMSG_RC_AFTER_EXPORT_SPEC_LIST); + + // Careful! If |from| follows, even on a new line, it must start a + // FromClause: + // + // export { x } + // from "foo"; // a single ExportDeclaration + // + // But if it doesn't, we might have an ASI opportunity in Operand + // context, so simply matching a contextual keyword won't work: + // + // export { x } // ExportDeclaration, terminated by ASI + // fro\u006D // ExpressionStatement, the name "from" + // + // In that case let MatchOrInsertSemicolonAfterNonExpression sort out + // ASI or any necessary error. + TokenKind tt; + if (!tokenStream.getToken(&tt, TokenStream::Operand)) + return null(); + + if (tt == TOK_NAME && + tokenStream.currentToken().name() == context->names().from && + !tokenStream.currentToken().nameContainsEscape()) + { + MUST_MATCH_TOKEN(TOK_STRING, JSMSG_MODULE_SPEC_AFTER_FROM); + + Node moduleSpec = stringLiteral(); + if (!moduleSpec) + return null(); + + if (!MatchOrInsertSemicolonAfterNonExpression(tokenStream)) + return null(); + + ParseNode* node = handler.newExportFromDeclaration(begin, kid, moduleSpec); + if (!node || !pc->sc()->asModuleContext()->builder.processExportFrom(node)) + return null(); + + return node; + } + + tokenStream.ungetToken(); + + if (!MatchOrInsertSemicolonAfterNonExpression(tokenStream)) + return null(); + break; + } + + case TOK_MUL: { + kid = handler.newList(PNK_EXPORT_SPEC_LIST); + if (!kid) + return null(); + + // Handle the form |export *| by adding a special export batch + // specifier to the list. + Node exportSpec = handler.newNullary(PNK_EXPORT_BATCH_SPEC, JSOP_NOP, pos()); + if (!exportSpec) + return null(); + + handler.addList(kid, exportSpec); + + if (!tokenStream.getToken(&tt)) + return null(); + if (tt != TOK_NAME || tokenStream.currentName() != context->names().from) { + report(ParseError, false, null(), JSMSG_FROM_AFTER_EXPORT_STAR); + return null(); + } + + if (!checkUnescapedName()) + return null(); + + MUST_MATCH_TOKEN(TOK_STRING, JSMSG_MODULE_SPEC_AFTER_FROM); + + Node moduleSpec = stringLiteral(); + if (!moduleSpec) + return null(); + + if (!MatchOrInsertSemicolonAfterNonExpression(tokenStream)) + return null(); + + ParseNode* node = handler.newExportFromDeclaration(begin, kid, moduleSpec); + if (!node || !pc->sc()->asModuleContext()->builder.processExportFrom(node)) + return null(); + + return node; + + } + + case TOK_FUNCTION: + kid = functionStmt(YieldIsKeyword, NameRequired); + if (!kid) + return null(); + + if (!checkExportedName(kid->pn_funbox->function()->name())) + return null(); + break; + + case TOK_CLASS: { + kid = classDefinition(YieldIsKeyword, ClassStatement, NameRequired); + if (!kid) + return null(); + + const ClassNode& cls = kid->as<ClassNode>(); + MOZ_ASSERT(cls.names()); + if (!checkExportedName(cls.names()->innerBinding()->pn_atom)) + return null(); + break; + } + + case TOK_VAR: + kid = declarationList(YieldIsName, PNK_VAR); + if (!kid) + return null(); + if (!MatchOrInsertSemicolonAfterExpression(tokenStream)) + return null(); + if (!checkExportedNamesForDeclaration(kid)) + return null(); + break; + + case TOK_DEFAULT: { + if (!tokenStream.getToken(&tt, TokenStream::Operand)) + return null(); + + if (!checkExportedName(context->names().default_)) + return null(); + + ParseNode* nameNode = nullptr; + switch (tt) { + case TOK_FUNCTION: + kid = functionStmt(YieldIsKeyword, AllowDefaultName); + if (!kid) + return null(); + break; + case TOK_CLASS: + kid = classDefinition(YieldIsKeyword, ClassStatement, AllowDefaultName); + if (!kid) + return null(); + break; + default: { + if (tt == TOK_NAME && tokenStream.currentName() == context->names().async) { + TokenKind nextSameLine = TOK_EOF; + if (!tokenStream.peekTokenSameLine(&nextSameLine)) + return null(); + + if (nextSameLine == TOK_FUNCTION) { + tokenStream.consumeKnownToken(nextSameLine); + kid = functionStmt(YieldIsName, AllowDefaultName, AsyncFunction); + if (!kid) + return null(); + break; + } + } + + tokenStream.ungetToken(); + RootedPropertyName name(context, context->names().starDefaultStar); + nameNode = newName(name); + if (!nameNode) + return null(); + if (!noteDeclaredName(name, DeclarationKind::Const, pos())) + return null(); + kid = assignExpr(InAllowed, YieldIsKeyword, TripledotProhibited); + if (!kid) + return null(); + if (!MatchOrInsertSemicolonAfterExpression(tokenStream)) + return null(); + break; + } + } + + ParseNode* node = handler.newExportDefaultDeclaration(kid, nameNode, + TokenPos(begin, pos().end)); + if (!node || !pc->sc()->asModuleContext()->builder.processExport(node)) + return null(); + + return node; + } + + case TOK_CONST: + kid = lexicalDeclaration(YieldIsName, /* isConst = */ true); + if (!kid) + return null(); + if (!checkExportedNamesForDeclaration(kid)) + return null(); + break; + + case TOK_NAME: + if (tokenStream.currentName() == context->names().let) { + if (!checkUnescapedName()) + return null(); + + kid = lexicalDeclaration(YieldIsName, /* isConst = */ false); + if (!kid) + return null(); + if (!checkExportedNamesForDeclaration(kid)) + return null(); + break; + } + MOZ_FALLTHROUGH; + + default: + report(ParseError, false, null(), JSMSG_DECLARATION_AFTER_EXPORT); + return null(); + } + + ParseNode* node = handler.newExportDeclaration(kid, TokenPos(begin, pos().end)); + if (!node || !pc->sc()->asModuleContext()->builder.processExport(node)) + return null(); + + return node; +} + +template<> +SyntaxParseHandler::Node +Parser<SyntaxParseHandler>::exportDeclaration() +{ + JS_ALWAYS_FALSE(abortIfSyntaxParser()); + return SyntaxParseHandler::NodeFailure; +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::expressionStatement(YieldHandling yieldHandling, InvokedPrediction invoked) +{ + tokenStream.ungetToken(); + Node pnexpr = expr(InAllowed, yieldHandling, TripledotProhibited, + /* possibleError = */ nullptr, invoked); + if (!pnexpr) + return null(); + if (!MatchOrInsertSemicolonAfterExpression(tokenStream)) + return null(); + return handler.newExprStatement(pnexpr, pos().end); +} + +template <class ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::consequentOrAlternative(YieldHandling yieldHandling) +{ + TokenKind next; + if (!tokenStream.peekToken(&next, TokenStream::Operand)) + return null(); + + if (next == TOK_FUNCTION) { + // Apply Annex B.3.4 in non-strict code to allow FunctionDeclaration as + // the consequent/alternative of an |if| or |else|. Parser::statement + // will report the strict mode error. + if (!pc->sc()->strict()) { + tokenStream.consumeKnownToken(next, TokenStream::Operand); + return functionStmt(yieldHandling, NameRequired); + } + } + + return statement(yieldHandling); +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::ifStatement(YieldHandling yieldHandling) +{ + Vector<Node, 4> condList(context), thenList(context); + Vector<uint32_t, 4> posList(context); + Node elseBranch; + + ParseContext::Statement stmt(pc, StatementKind::If); + + while (true) { + uint32_t begin = pos().begin; + + /* An IF node has three kids: condition, then, and optional else. */ + Node cond = condition(InAllowed, yieldHandling); + if (!cond) + return null(); + + TokenKind tt; + if (!tokenStream.peekToken(&tt, TokenStream::Operand)) + return null(); + if (tt == TOK_SEMI) { + if (!report(ParseExtraWarning, false, null(), JSMSG_EMPTY_CONSEQUENT)) + return null(); + } + + Node thenBranch = consequentOrAlternative(yieldHandling); + if (!thenBranch) + return null(); + + if (!condList.append(cond) || !thenList.append(thenBranch) || !posList.append(begin)) + return null(); + + bool matched; + if (!tokenStream.matchToken(&matched, TOK_ELSE, TokenStream::Operand)) + return null(); + if (matched) { + if (!tokenStream.matchToken(&matched, TOK_IF, TokenStream::Operand)) + return null(); + if (matched) + continue; + elseBranch = consequentOrAlternative(yieldHandling); + if (!elseBranch) + return null(); + } else { + elseBranch = null(); + } + break; + } + + for (int i = condList.length() - 1; i >= 0; i--) { + elseBranch = handler.newIfStatement(posList[i], condList[i], thenList[i], elseBranch); + if (!elseBranch) + return null(); + } + + return elseBranch; +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::doWhileStatement(YieldHandling yieldHandling) +{ + uint32_t begin = pos().begin; + ParseContext::Statement stmt(pc, StatementKind::DoLoop); + Node body = statement(yieldHandling); + if (!body) + return null(); + MUST_MATCH_TOKEN_MOD(TOK_WHILE, TokenStream::Operand, JSMSG_WHILE_AFTER_DO); + Node cond = condition(InAllowed, yieldHandling); + if (!cond) + return null(); + + // The semicolon after do-while is even more optional than most + // semicolons in JS. Web compat required this by 2004: + // http://bugzilla.mozilla.org/show_bug.cgi?id=238945 + // ES3 and ES5 disagreed, but ES6 conforms to Web reality: + // https://bugs.ecmascript.org/show_bug.cgi?id=157 + // To parse |do {} while (true) false| correctly, use Operand. + bool ignored; + if (!tokenStream.matchToken(&ignored, TOK_SEMI, TokenStream::Operand)) + return null(); + return handler.newDoWhileStatement(body, cond, TokenPos(begin, pos().end)); +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::whileStatement(YieldHandling yieldHandling) +{ + uint32_t begin = pos().begin; + ParseContext::Statement stmt(pc, StatementKind::WhileLoop); + Node cond = condition(InAllowed, yieldHandling); + if (!cond) + return null(); + Node body = statement(yieldHandling); + if (!body) + return null(); + return handler.newWhileStatement(begin, cond, body); +} + +template <typename ParseHandler> +bool +Parser<ParseHandler>::matchInOrOf(bool* isForInp, bool* isForOfp) +{ + TokenKind tt; + if (!tokenStream.getToken(&tt)) + return false; + + *isForInp = tt == TOK_IN; + *isForOfp = tt == TOK_NAME && tokenStream.currentToken().name() == context->names().of; + if (!*isForInp && !*isForOfp) { + tokenStream.ungetToken(); + } else { + if (tt == TOK_NAME && !checkUnescapedName()) + return false; + } + + MOZ_ASSERT_IF(*isForInp || *isForOfp, *isForInp != *isForOfp); + return true; +} + +template <class ParseHandler> +bool +Parser<ParseHandler>::validateForInOrOfLHSExpression(Node target, PossibleError* possibleError) +{ + if (handler.isUnparenthesizedDestructuringPattern(target)) + return checkDestructuringPattern(target, Nothing(), possibleError); + + // All other permitted targets are simple. + if (!reportIfNotValidSimpleAssignmentTarget(target, ForInOrOfTarget)) + return false; + + if (handler.isPropertyAccess(target)) + return true; + + if (handler.isNameAnyParentheses(target)) { + // The arguments/eval identifiers are simple in non-strict mode code, + // but warn to discourage use nonetheless. + if (!reportIfArgumentsEvalTarget(target)) + return false; + + handler.adjustGetToSet(target); + return true; + } + + if (handler.isFunctionCall(target)) + return checkAssignmentToCall(target, JSMSG_BAD_FOR_LEFTSIDE); + + report(ParseError, false, target, JSMSG_BAD_FOR_LEFTSIDE); + return false; +} + +template <class ParseHandler> +bool +Parser<ParseHandler>::forHeadStart(YieldHandling yieldHandling, + ParseNodeKind* forHeadKind, + Node* forInitialPart, + Maybe<ParseContext::Scope>& forLoopLexicalScope, + Node* forInOrOfExpression) +{ + MOZ_ASSERT(tokenStream.isCurrentTokenType(TOK_LP)); + + TokenKind tt; + if (!tokenStream.peekToken(&tt, TokenStream::Operand)) + return null(); + + // Super-duper easy case: |for (;| is a C-style for-loop with no init + // component. + if (tt == TOK_SEMI) { + *forInitialPart = null(); + *forHeadKind = PNK_FORHEAD; + return true; + } + + // Parsing after |for (var| is also relatively simple (from this method's + // point of view). No block-related work complicates matters, so delegate + // to Parser::declaration. + if (tt == TOK_VAR) { + tokenStream.consumeKnownToken(tt, TokenStream::Operand); + + // Pass null for block object because |var| declarations don't use one. + *forInitialPart = declarationList(yieldHandling, PNK_VAR, forHeadKind, + forInOrOfExpression); + return *forInitialPart != null(); + } + + // Otherwise we have a lexical declaration or an expression. + + // For-in loop backwards compatibility requires that |let| starting a + // for-loop that's not a (new to ES6) for-of loop, in non-strict mode code, + // parse as an identifier. (|let| in for-of is always a declaration.) + bool parsingLexicalDeclaration = false; + bool letIsIdentifier = false; + if (tt == TOK_CONST) { + parsingLexicalDeclaration = true; + tokenStream.consumeKnownToken(tt, TokenStream::Operand); + } else if (tt == TOK_NAME && + tokenStream.nextName() == context->names().let && + !tokenStream.nextNameContainsEscape()) + { + // We could have a {For,Lexical}Declaration, or we could have a + // LeftHandSideExpression with lookahead restrictions so it's not + // ambiguous with the former. Check for a continuation of the former + // to decide which we have. + tokenStream.consumeKnownToken(TOK_NAME, TokenStream::Operand); + + TokenKind next; + if (!tokenStream.peekToken(&next)) + return false; + + parsingLexicalDeclaration = nextTokenContinuesLetDeclaration(next, yieldHandling); + if (!parsingLexicalDeclaration) { + tokenStream.ungetToken(); + letIsIdentifier = true; + } + } + + if (parsingLexicalDeclaration) { + forLoopLexicalScope.emplace(this); + if (!forLoopLexicalScope->init(pc)) + return null(); + + // Push a temporary ForLoopLexicalHead Statement that allows for + // lexical declarations, as they are usually allowed only in braced + // statements. + ParseContext::Statement forHeadStmt(pc, StatementKind::ForLoopLexicalHead); + + *forInitialPart = declarationList(yieldHandling, tt == TOK_CONST ? PNK_CONST : PNK_LET, + forHeadKind, forInOrOfExpression); + return *forInitialPart != null(); + } + + // Finally, handle for-loops that start with expressions. Pass + // |InProhibited| so that |in| isn't parsed in a RelationalExpression as a + // binary operator. |in| makes it a for-in loop, *not* an |in| expression. + PossibleError possibleError(*this); + *forInitialPart = expr(InProhibited, yieldHandling, TripledotProhibited, &possibleError); + if (!*forInitialPart) + return false; + + bool isForIn, isForOf; + if (!matchInOrOf(&isForIn, &isForOf)) + return false; + + // If we don't encounter 'in'/'of', we have a for(;;) loop. We've handled + // the init expression; the caller handles the rest. Allow the Operand + // modifier when regetting: Operand must be used to examine the ';' in + // |for (;|, and our caller handles this case and that. + if (!isForIn && !isForOf) { + if (!possibleError.checkForExpressionError()) + return false; + *forHeadKind = PNK_FORHEAD; + tokenStream.addModifierException(TokenStream::OperandIsNone); + return true; + } + + MOZ_ASSERT(isForIn != isForOf); + + // In a for-of loop, 'let' that starts the loop head is a |let| keyword, + // per the [lookahead ≠let] restriction on the LeftHandSideExpression + // variant of such loops. Expressions that start with |let| can't be used + // here. + // + // var let = {}; + // for (let.prop of [1]) // BAD + // break; + // + // See ES6 13.7. + if (isForOf && letIsIdentifier) { + report(ParseError, false, *forInitialPart, JSMSG_LET_STARTING_FOROF_LHS); + return false; + } + + *forHeadKind = isForIn ? PNK_FORIN : PNK_FOROF; + + if (!validateForInOrOfLHSExpression(*forInitialPart, &possibleError)) + return false; + if (!possibleError.checkForExpressionError()) + return false; + + // Finally, parse the iterated expression, making the for-loop's closing + // ')' the next token. + *forInOrOfExpression = expressionAfterForInOrOf(*forHeadKind, yieldHandling); + return *forInOrOfExpression != null(); +} + +template <class ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::forStatement(YieldHandling yieldHandling) +{ + MOZ_ASSERT(tokenStream.isCurrentTokenType(TOK_FOR)); + uint32_t begin = pos().begin; + + ParseContext::Statement stmt(pc, StatementKind::ForLoop); + + bool isForEach = false; + unsigned iflags = 0; + + if (allowsForEachIn()) { + bool matched; + if (!tokenStream.matchContextualKeyword(&matched, context->names().each)) + return null(); + if (matched) { + iflags = JSITER_FOREACH; + isForEach = true; + addTelemetry(JSCompartment::DeprecatedForEach); + if (!warnOnceAboutForEach()) + return null(); + } + } + + MUST_MATCH_TOKEN(TOK_LP, JSMSG_PAREN_AFTER_FOR); + + // PNK_FORHEAD, PNK_FORIN, or PNK_FOROF depending on the loop type. + ParseNodeKind headKind; + + // |x| in either |for (x; ...; ...)| or |for (x in/of ...)|. + Node startNode; + + // The next two variables are used to implement `for (let/const ...)`. + // + // We generate an implicit block, wrapping the whole loop, to store loop + // variables declared this way. Note that if the loop uses `for (var...)` + // instead, those variables go on some existing enclosing scope, so no + // implicit block scope is created. + // + // Both variables remain null/none if the loop is any other form. + + // The static block scope for the implicit block scope. + Maybe<ParseContext::Scope> forLoopLexicalScope; + + // The expression being iterated over, for for-in/of loops only. Unused + // for for(;;) loops. + Node iteratedExpr; + + // Parse the entirety of the loop-head for a for-in/of loop (so the next + // token is the closing ')'): + // + // for (... in/of ...) ... + // ^next token + // + // ...OR, parse up to the first ';' in a C-style for-loop: + // + // for (...; ...; ...) ... + // ^next token + // + // In either case the subsequent token can be consistently accessed using + // TokenStream::None semantics. + if (!forHeadStart(yieldHandling, &headKind, &startNode, forLoopLexicalScope, + &iteratedExpr)) + { + return null(); + } + + MOZ_ASSERT(headKind == PNK_FORIN || headKind == PNK_FOROF || headKind == PNK_FORHEAD); + + Node forHead; + if (headKind == PNK_FORHEAD) { + Node init = startNode; + + if (isForEach) { + reportWithOffset(ParseError, false, begin, JSMSG_BAD_FOR_EACH_LOOP); + return null(); + } + + // Look for an operand: |for (;| means we might have already examined + // this semicolon with that modifier. + MUST_MATCH_TOKEN_MOD(TOK_SEMI, TokenStream::Operand, JSMSG_SEMI_AFTER_FOR_INIT); + + TokenKind tt; + if (!tokenStream.peekToken(&tt, TokenStream::Operand)) + return null(); + + Node test; + TokenStream::Modifier mod; + if (tt == TOK_SEMI) { + test = null(); + mod = TokenStream::Operand; + } else { + test = expr(InAllowed, yieldHandling, TripledotProhibited); + if (!test) + return null(); + mod = TokenStream::None; + } + + MUST_MATCH_TOKEN_MOD(TOK_SEMI, mod, JSMSG_SEMI_AFTER_FOR_COND); + + if (!tokenStream.peekToken(&tt, TokenStream::Operand)) + return null(); + + Node update; + if (tt == TOK_RP) { + update = null(); + mod = TokenStream::Operand; + } else { + update = expr(InAllowed, yieldHandling, TripledotProhibited); + if (!update) + return null(); + mod = TokenStream::None; + } + + MUST_MATCH_TOKEN_MOD(TOK_RP, mod, JSMSG_PAREN_AFTER_FOR_CTRL); + + TokenPos headPos(begin, pos().end); + forHead = handler.newForHead(init, test, update, headPos); + if (!forHead) + return null(); + } else { + MOZ_ASSERT(headKind == PNK_FORIN || headKind == PNK_FOROF); + + // |target| is the LeftHandSideExpression or declaration to which the + // per-iteration value (an arbitrary value exposed by the iteration + // protocol, or a string naming a property) is assigned. + Node target = startNode; + + // Parse the rest of the for-in/of head. + if (headKind == PNK_FORIN) { + stmt.refineForKind(StatementKind::ForInLoop); + iflags |= JSITER_ENUMERATE; + } else { + if (isForEach) { + report(ParseError, false, startNode, JSMSG_BAD_FOR_EACH_LOOP); + return null(); + } + + stmt.refineForKind(StatementKind::ForOfLoop); + } + + if (!handler.isDeclarationList(target)) { + MOZ_ASSERT(!forLoopLexicalScope); + if (!checkAndMarkAsAssignmentLhs(target, PlainAssignment)) + return null(); + } + + // Parser::declaration consumed everything up to the closing ')'. That + // token follows an {Assignment,}Expression, so the next token must be + // consumed as if an operator continued the expression, i.e. as None. + MUST_MATCH_TOKEN_MOD(TOK_RP, TokenStream::None, JSMSG_PAREN_AFTER_FOR_CTRL); + + TokenPos headPos(begin, pos().end); + forHead = handler.newForInOrOfHead(headKind, target, iteratedExpr, headPos); + if (!forHead) + return null(); + } + + Node body = statement(yieldHandling); + if (!body) + return null(); + + Node forLoop = handler.newForStatement(begin, forHead, body, iflags); + if (!forLoop) + return null(); + + if (forLoopLexicalScope) + return finishLexicalScope(*forLoopLexicalScope, forLoop); + + return forLoop; +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::switchStatement(YieldHandling yieldHandling) +{ + MOZ_ASSERT(tokenStream.isCurrentTokenType(TOK_SWITCH)); + uint32_t begin = pos().begin; + + MUST_MATCH_TOKEN(TOK_LP, JSMSG_PAREN_BEFORE_SWITCH); + + Node discriminant = exprInParens(InAllowed, yieldHandling, TripledotProhibited); + if (!discriminant) + return null(); + + MUST_MATCH_TOKEN(TOK_RP, JSMSG_PAREN_AFTER_SWITCH); + MUST_MATCH_TOKEN(TOK_LC, JSMSG_CURLY_BEFORE_SWITCH); + + ParseContext::Statement stmt(pc, StatementKind::Switch); + ParseContext::Scope scope(this); + if (!scope.init(pc)) + return null(); + + Node caseList = handler.newStatementList(pos()); + if (!caseList) + return null(); + + bool seenDefault = false; + TokenKind tt; + while (true) { + if (!tokenStream.getToken(&tt, TokenStream::Operand)) + return null(); + if (tt == TOK_RC) + break; + uint32_t caseBegin = pos().begin; + + Node caseExpr; + switch (tt) { + case TOK_DEFAULT: + if (seenDefault) { + report(ParseError, false, null(), JSMSG_TOO_MANY_DEFAULTS); + return null(); + } + seenDefault = true; + caseExpr = null(); // The default case has pn_left == nullptr. + break; + + case TOK_CASE: + caseExpr = expr(InAllowed, yieldHandling, TripledotProhibited); + if (!caseExpr) + return null(); + break; + + default: + report(ParseError, false, null(), JSMSG_BAD_SWITCH); + return null(); + } + + MUST_MATCH_TOKEN(TOK_COLON, JSMSG_COLON_AFTER_CASE); + + Node body = handler.newStatementList(pos()); + if (!body) + return null(); + + bool afterReturn = false; + bool warnedAboutStatementsAfterReturn = false; + uint32_t statementBegin = 0; + while (true) { + if (!tokenStream.peekToken(&tt, TokenStream::Operand)) + return null(); + if (tt == TOK_RC || tt == TOK_CASE || tt == TOK_DEFAULT) + break; + if (afterReturn) { + TokenPos pos(0, 0); + if (!tokenStream.peekTokenPos(&pos, TokenStream::Operand)) + return null(); + statementBegin = pos.begin; + } + Node stmt = statementListItem(yieldHandling); + if (!stmt) + return null(); + if (!warnedAboutStatementsAfterReturn) { + if (afterReturn) { + if (!handler.isStatementPermittedAfterReturnStatement(stmt)) { + if (!reportWithOffset(ParseWarning, false, statementBegin, + JSMSG_STMT_AFTER_RETURN)) + { + return null(); + } + warnedAboutStatementsAfterReturn = true; + } + } else if (handler.isReturnStatement(stmt)) { + afterReturn = true; + } + } + handler.addStatementToList(body, stmt); + } + + Node casepn = handler.newCaseOrDefault(caseBegin, caseExpr, body); + if (!casepn) + return null(); + handler.addCaseStatementToList(caseList, casepn); + } + + caseList = finishLexicalScope(scope, caseList); + if (!caseList) + return null(); + + handler.setEndPosition(caseList, pos().end); + + return handler.newSwitchStatement(begin, discriminant, caseList); +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::continueStatement(YieldHandling yieldHandling) +{ + MOZ_ASSERT(tokenStream.isCurrentTokenType(TOK_CONTINUE)); + uint32_t begin = pos().begin; + + RootedPropertyName label(context); + if (!matchLabel(yieldHandling, &label)) + return null(); + + // Labeled 'continue' statements target the nearest labeled loop + // statements with the same label. Unlabeled 'continue' statements target + // the innermost loop statement. + auto isLoop = [](ParseContext::Statement* stmt) { + return StatementKindIsLoop(stmt->kind()); + }; + + if (label) { + ParseContext::Statement* stmt = pc->innermostStatement(); + bool foundLoop = false; + + for (;;) { + stmt = ParseContext::Statement::findNearest(stmt, isLoop); + if (!stmt) { + report(ParseError, false, null(), + foundLoop ? JSMSG_LABEL_NOT_FOUND : JSMSG_BAD_CONTINUE); + return null(); + } + + foundLoop = true; + + // Is it labeled by our label? + bool foundTarget = false; + stmt = stmt->enclosing(); + while (stmt && stmt->is<ParseContext::LabelStatement>()) { + if (stmt->as<ParseContext::LabelStatement>().label() == label) { + foundTarget = true; + break; + } + stmt = stmt->enclosing(); + } + if (foundTarget) + break; + } + } else if (!pc->findInnermostStatement(isLoop)) { + report(ParseError, false, null(), JSMSG_BAD_CONTINUE); + return null(); + } + + if (!MatchOrInsertSemicolonAfterNonExpression(tokenStream)) + return null(); + + return handler.newContinueStatement(label, TokenPos(begin, pos().end)); +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::breakStatement(YieldHandling yieldHandling) +{ + MOZ_ASSERT(tokenStream.isCurrentTokenType(TOK_BREAK)); + uint32_t begin = pos().begin; + + RootedPropertyName label(context); + if (!matchLabel(yieldHandling, &label)) + return null(); + + // Labeled 'break' statements target the nearest labeled statements (could + // be any kind) with the same label. Unlabeled 'break' statements target + // the innermost loop or switch statement. + if (label) { + auto hasSameLabel = [&label](ParseContext::LabelStatement* stmt) { + return stmt->label() == label; + }; + + if (!pc->findInnermostStatement<ParseContext::LabelStatement>(hasSameLabel)) { + report(ParseError, false, null(), JSMSG_LABEL_NOT_FOUND); + return null(); + } + } else { + auto isBreakTarget = [](ParseContext::Statement* stmt) { + return StatementKindIsUnlabeledBreakTarget(stmt->kind()); + }; + + if (!pc->findInnermostStatement(isBreakTarget)) { + report(ParseError, false, null(), JSMSG_TOUGH_BREAK); + return null(); + } + } + + if (!MatchOrInsertSemicolonAfterNonExpression(tokenStream)) + return null(); + + return handler.newBreakStatement(label, TokenPos(begin, pos().end)); +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::returnStatement(YieldHandling yieldHandling) +{ + MOZ_ASSERT(tokenStream.isCurrentTokenType(TOK_RETURN)); + uint32_t begin = pos().begin; + + MOZ_ASSERT(pc->isFunctionBox()); + pc->functionBox()->usesReturn = true; + + // Parse an optional operand. + // + // This is ugly, but we don't want to require a semicolon. + Node exprNode; + TokenKind tt = TOK_EOF; + if (!tokenStream.peekTokenSameLine(&tt, TokenStream::Operand)) + return null(); + switch (tt) { + case TOK_EOL: + case TOK_EOF: + case TOK_SEMI: + case TOK_RC: + exprNode = null(); + pc->funHasReturnVoid = true; + break; + default: { + exprNode = expr(InAllowed, yieldHandling, TripledotProhibited); + if (!exprNode) + return null(); + pc->funHasReturnExpr = true; + } + } + + if (exprNode) { + if (!MatchOrInsertSemicolonAfterExpression(tokenStream)) + return null(); + } else { + if (!MatchOrInsertSemicolonAfterNonExpression(tokenStream)) + return null(); + } + + Node pn = handler.newReturnStatement(exprNode, TokenPos(begin, pos().end)); + if (!pn) + return null(); + + if (pc->isLegacyGenerator() && exprNode) { + /* Disallow "return v;" in legacy generators. */ + reportBadReturn(pn, ParseError, JSMSG_BAD_GENERATOR_RETURN, + JSMSG_BAD_ANON_GENERATOR_RETURN); + return null(); + } + + return pn; +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::newYieldExpression(uint32_t begin, typename ParseHandler::Node expr, + bool isYieldStar) +{ + Node generator = newDotGeneratorName(); + if (!generator) + return null(); + if (isYieldStar) + return handler.newYieldStarExpression(begin, expr, generator); + return handler.newYieldExpression(begin, expr, generator); +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::newAwaitExpression(uint32_t begin, typename ParseHandler::Node expr) +{ + Node generator = newDotGeneratorName(); + if (!generator) + return null(); + return handler.newAwaitExpression(begin, expr, generator); +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::yieldExpression(InHandling inHandling) +{ + MOZ_ASSERT(tokenStream.isCurrentTokenType(TOK_YIELD)); + uint32_t begin = pos().begin; + + switch (pc->generatorKind()) { + case StarGenerator: + { + MOZ_ASSERT(pc->isFunctionBox()); + + pc->lastYieldOffset = begin; + + Node exprNode; + ParseNodeKind kind = PNK_YIELD; + TokenKind tt = TOK_EOF; + if (!tokenStream.peekTokenSameLine(&tt, TokenStream::Operand)) + return null(); + switch (tt) { + // TOK_EOL is special; it implements the [no LineTerminator here] + // quirk in the grammar. + case TOK_EOL: + // The rest of these make up the complete set of tokens that can + // appear after any of the places where AssignmentExpression is used + // throughout the grammar. Conveniently, none of them can also be the + // start an expression. + case TOK_EOF: + case TOK_SEMI: + case TOK_RC: + case TOK_RB: + case TOK_RP: + case TOK_COLON: + case TOK_COMMA: + case TOK_IN: + // No value. + exprNode = null(); + tokenStream.addModifierException(TokenStream::NoneIsOperand); + break; + case TOK_MUL: + kind = PNK_YIELD_STAR; + tokenStream.consumeKnownToken(TOK_MUL, TokenStream::Operand); + MOZ_FALLTHROUGH; + default: + exprNode = assignExpr(inHandling, YieldIsKeyword, TripledotProhibited); + if (!exprNode) + return null(); + } + return newYieldExpression(begin, exprNode, kind == PNK_YIELD_STAR); + } + + case NotGenerator: + // We are in code that has not seen a yield, but we are in JS 1.7 or + // later. Try to transition to being a legacy generator. + MOZ_ASSERT(tokenStream.versionNumber() >= JSVERSION_1_7); + MOZ_ASSERT(pc->lastYieldOffset == ParseContext::NoYieldOffset); + + if (!abortIfSyntaxParser()) + return null(); + + if (!pc->isFunctionBox()) { + report(ParseError, false, null(), JSMSG_BAD_RETURN_OR_YIELD, js_yield_str); + return null(); + } + + if (pc->functionBox()->isArrow()) { + reportWithOffset(ParseError, false, begin, + JSMSG_YIELD_IN_ARROW, js_yield_str); + return null(); + } + + if (pc->functionBox()->function()->isMethod() || + pc->functionBox()->function()->isGetter() || + pc->functionBox()->function()->isSetter()) + { + reportWithOffset(ParseError, false, begin, + JSMSG_YIELD_IN_METHOD, js_yield_str); + return null(); + } + + if (pc->funHasReturnExpr +#if JS_HAS_EXPR_CLOSURES + || pc->functionBox()->function()->isExprBody() +#endif + ) + { + /* As in Python (see PEP-255), disallow return v; in generators. */ + reportBadReturn(null(), ParseError, JSMSG_BAD_GENERATOR_RETURN, + JSMSG_BAD_ANON_GENERATOR_RETURN); + return null(); + } + + pc->functionBox()->setGeneratorKind(LegacyGenerator); + addTelemetry(JSCompartment::DeprecatedLegacyGenerator); + + MOZ_FALLTHROUGH; + + case LegacyGenerator: + { + // We are in a legacy generator: a function that has already seen a + // yield. + MOZ_ASSERT(pc->isFunctionBox()); + + pc->lastYieldOffset = begin; + + // Legacy generators do not require a value. + Node exprNode; + TokenKind tt = TOK_EOF; + if (!tokenStream.peekTokenSameLine(&tt, TokenStream::Operand)) + return null(); + switch (tt) { + case TOK_EOF: + case TOK_EOL: + case TOK_SEMI: + case TOK_RC: + case TOK_RB: + case TOK_RP: + case TOK_COLON: + case TOK_COMMA: + // No value. + exprNode = null(); + tokenStream.addModifierException(TokenStream::NoneIsOperand); + break; + default: + exprNode = assignExpr(inHandling, YieldIsKeyword, TripledotProhibited); + if (!exprNode) + return null(); + } + + return newYieldExpression(begin, exprNode); + } + } + + MOZ_CRASH("yieldExpr"); +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::withStatement(YieldHandling yieldHandling) +{ + MOZ_ASSERT(tokenStream.isCurrentTokenType(TOK_WITH)); + uint32_t begin = pos().begin; + + // In most cases, we want the constructs forbidden in strict mode code to be + // a subset of those that JSOPTION_EXTRA_WARNINGS warns about, and we should + // use reportStrictModeError. However, 'with' is the sole instance of a + // construct that is forbidden in strict mode code, but doesn't even merit a + // warning under JSOPTION_EXTRA_WARNINGS. See + // https://bugzilla.mozilla.org/show_bug.cgi?id=514576#c1. + if (pc->sc()->strict()) { + if (!report(ParseStrictError, true, null(), JSMSG_STRICT_CODE_WITH)) + return null(); + } + + MUST_MATCH_TOKEN(TOK_LP, JSMSG_PAREN_BEFORE_WITH); + Node objectExpr = exprInParens(InAllowed, yieldHandling, TripledotProhibited); + if (!objectExpr) + return null(); + MUST_MATCH_TOKEN(TOK_RP, JSMSG_PAREN_AFTER_WITH); + + Node innerBlock; + { + ParseContext::Statement stmt(pc, StatementKind::With); + innerBlock = statement(yieldHandling); + if (!innerBlock) + return null(); + } + + pc->sc()->setBindingsAccessedDynamically(); + + return handler.newWithStatement(begin, objectExpr, innerBlock); +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::labeledItem(YieldHandling yieldHandling) +{ + TokenKind tt; + if (!tokenStream.getToken(&tt, TokenStream::Operand)) + return null(); + + if (tt == TOK_FUNCTION) { + TokenKind next; + if (!tokenStream.peekToken(&next)) + return null(); + + // GeneratorDeclaration is only matched by HoistableDeclaration in + // StatementListItem, so generators can't be inside labels. + if (next == TOK_MUL) { + report(ParseError, false, null(), JSMSG_GENERATOR_LABEL); + return null(); + } + + // Per 13.13.1 it's a syntax error if LabelledItem: FunctionDeclaration + // is ever matched. Per Annex B.3.2 that modifies this text, this + // applies only to strict mode code. + if (pc->sc()->strict()) { + report(ParseError, false, null(), JSMSG_FUNCTION_LABEL); + return null(); + } + + return functionStmt(yieldHandling, NameRequired); + } + + tokenStream.ungetToken(); + return statement(yieldHandling); +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::labeledStatement(YieldHandling yieldHandling) +{ + RootedPropertyName label(context, labelIdentifier(yieldHandling)); + if (!label) + return null(); + + auto hasSameLabel = [&label](ParseContext::LabelStatement* stmt) { + return stmt->label() == label; + }; + + if (pc->findInnermostStatement<ParseContext::LabelStatement>(hasSameLabel)) { + report(ParseError, false, null(), JSMSG_DUPLICATE_LABEL); + return null(); + } + + uint32_t begin = pos().begin; + + tokenStream.consumeKnownToken(TOK_COLON); + + /* Push a label struct and parse the statement. */ + ParseContext::LabelStatement stmt(pc, label); + Node pn = labeledItem(yieldHandling); + if (!pn) + return null(); + + return handler.newLabeledStatement(label, pn, begin); +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::throwStatement(YieldHandling yieldHandling) +{ + MOZ_ASSERT(tokenStream.isCurrentTokenType(TOK_THROW)); + uint32_t begin = pos().begin; + + /* ECMA-262 Edition 3 says 'throw [no LineTerminator here] Expr'. */ + TokenKind tt = TOK_EOF; + if (!tokenStream.peekTokenSameLine(&tt, TokenStream::Operand)) + return null(); + if (tt == TOK_EOF || tt == TOK_SEMI || tt == TOK_RC) { + report(ParseError, false, null(), JSMSG_MISSING_EXPR_AFTER_THROW); + return null(); + } + if (tt == TOK_EOL) { + report(ParseError, false, null(), JSMSG_LINE_BREAK_AFTER_THROW); + return null(); + } + + Node throwExpr = expr(InAllowed, yieldHandling, TripledotProhibited); + if (!throwExpr) + return null(); + + if (!MatchOrInsertSemicolonAfterExpression(tokenStream)) + return null(); + + return handler.newThrowStatement(throwExpr, TokenPos(begin, pos().end)); +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::tryStatement(YieldHandling yieldHandling) +{ + MOZ_ASSERT(tokenStream.isCurrentTokenType(TOK_TRY)); + uint32_t begin = pos().begin; + + /* + * try nodes are ternary. + * kid1 is the try statement + * kid2 is the catch node list or null + * kid3 is the finally statement + * + * catch nodes are ternary. + * kid1 is the lvalue (TOK_NAME, TOK_LB, or TOK_LC) + * kid2 is the catch guard or null if no guard + * kid3 is the catch block + * + * catch lvalue nodes are either: + * TOK_NAME for a single identifier + * TOK_RB or TOK_RC for a destructuring left-hand side + * + * finally nodes are TOK_LC statement lists. + */ + + Node innerBlock; + { + MUST_MATCH_TOKEN(TOK_LC, JSMSG_CURLY_BEFORE_TRY); + + ParseContext::Statement stmt(pc, StatementKind::Try); + ParseContext::Scope scope(this); + if (!scope.init(pc)) + return null(); + + innerBlock = statementList(yieldHandling); + if (!innerBlock) + return null(); + + innerBlock = finishLexicalScope(scope, innerBlock); + if (!innerBlock) + return null(); + + MUST_MATCH_TOKEN_MOD(TOK_RC, TokenStream::Operand, JSMSG_CURLY_AFTER_TRY); + } + + bool hasUnconditionalCatch = false; + Node catchList = null(); + TokenKind tt; + if (!tokenStream.getToken(&tt)) + return null(); + if (tt == TOK_CATCH) { + catchList = handler.newCatchList(); + if (!catchList) + return null(); + + do { + Node pnblock; + + /* Check for another catch after unconditional catch. */ + if (hasUnconditionalCatch) { + report(ParseError, false, null(), JSMSG_CATCH_AFTER_GENERAL); + return null(); + } + + /* + * Create a lexical scope node around the whole catch clause, + * including the head. + */ + ParseContext::Statement stmt(pc, StatementKind::Catch); + ParseContext::Scope scope(this); + if (!scope.init(pc)) + return null(); + + /* + * Legal catch forms are: + * catch (lhs) + * catch (lhs if <boolean_expression>) + * where lhs is a name or a destructuring left-hand side. + * (the latter is legal only #ifdef JS_HAS_CATCH_GUARD) + */ + MUST_MATCH_TOKEN(TOK_LP, JSMSG_PAREN_BEFORE_CATCH); + + if (!tokenStream.getToken(&tt)) + return null(); + Node catchName; + switch (tt) { + case TOK_LB: + case TOK_LC: + catchName = destructuringDeclaration(DeclarationKind::CatchParameter, + yieldHandling, tt); + if (!catchName) + return null(); + break; + + case TOK_NAME: + case TOK_YIELD: { + RootedPropertyName param(context, bindingIdentifier(yieldHandling)); + if (!param) + return null(); + catchName = newName(param); + if (!catchName) + return null(); + if (!noteDeclaredName(param, DeclarationKind::SimpleCatchParameter, pos())) + return null(); + break; + } + + default: + report(ParseError, false, null(), JSMSG_CATCH_IDENTIFIER); + return null(); + } + + Node catchGuard = null(); +#if JS_HAS_CATCH_GUARD + /* + * We use 'catch (x if x === 5)' (not 'catch (x : x === 5)') + * to avoid conflicting with the JS2/ECMAv4 type annotation + * catchguard syntax. + */ + bool matched; + if (!tokenStream.matchToken(&matched, TOK_IF)) + return null(); + if (matched) { + catchGuard = expr(InAllowed, yieldHandling, TripledotProhibited); + if (!catchGuard) + return null(); + } +#endif + MUST_MATCH_TOKEN(TOK_RP, JSMSG_PAREN_AFTER_CATCH); + + MUST_MATCH_TOKEN(TOK_LC, JSMSG_CURLY_BEFORE_CATCH); + + Node catchBody = catchBlockStatement(yieldHandling, scope); + if (!catchBody) + return null(); + + if (!catchGuard) + hasUnconditionalCatch = true; + + pnblock = finishLexicalScope(scope, catchBody); + if (!pnblock) + return null(); + + if (!handler.addCatchBlock(catchList, pnblock, catchName, catchGuard, catchBody)) + return null(); + handler.setEndPosition(catchList, pos().end); + handler.setEndPosition(pnblock, pos().end); + + if (!tokenStream.getToken(&tt, TokenStream::Operand)) + return null(); + } while (tt == TOK_CATCH); + } + + Node finallyBlock = null(); + + if (tt == TOK_FINALLY) { + MUST_MATCH_TOKEN(TOK_LC, JSMSG_CURLY_BEFORE_FINALLY); + + ParseContext::Statement stmt(pc, StatementKind::Finally); + ParseContext::Scope scope(this); + if (!scope.init(pc)) + return null(); + + finallyBlock = statementList(yieldHandling); + if (!finallyBlock) + return null(); + + finallyBlock = finishLexicalScope(scope, finallyBlock); + if (!finallyBlock) + return null(); + + MUST_MATCH_TOKEN_MOD(TOK_RC, TokenStream::Operand, JSMSG_CURLY_AFTER_FINALLY); + } else { + tokenStream.ungetToken(); + } + if (!catchList && !finallyBlock) { + report(ParseError, false, null(), JSMSG_CATCH_OR_FINALLY); + return null(); + } + + return handler.newTryStatement(begin, innerBlock, catchList, finallyBlock); +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::catchBlockStatement(YieldHandling yieldHandling, + ParseContext::Scope& catchParamScope) +{ + ParseContext::Statement stmt(pc, StatementKind::Block); + + // ES 13.15.7 CatchClauseEvaluation + // + // Step 8 means that the body of a catch block always has an additional + // lexical scope. + ParseContext::Scope scope(this); + if (!scope.init(pc)) + return null(); + + // The catch parameter names cannot be redeclared inside the catch + // block, so declare the name in the inner scope. + if (!scope.addCatchParameters(pc, catchParamScope)) + return null(); + + Node list = statementList(yieldHandling); + if (!list) + return null(); + + MUST_MATCH_TOKEN_MOD(TOK_RC, TokenStream::Operand, JSMSG_CURLY_AFTER_CATCH); + + // The catch parameter names are not bound in the body scope, so remove + // them before generating bindings. + scope.removeCatchParameters(pc, catchParamScope); + return finishLexicalScope(scope, list); +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::debuggerStatement() +{ + TokenPos p; + p.begin = pos().begin; + if (!MatchOrInsertSemicolonAfterNonExpression(tokenStream)) + return null(); + p.end = pos().end; + + pc->sc()->setBindingsAccessedDynamically(); + pc->sc()->setHasDebuggerStatement(); + + return handler.newDebuggerStatement(p); +} + +static JSOp +JSOpFromPropertyType(PropertyType propType) +{ + switch (propType) { + case PropertyType::Getter: + case PropertyType::GetterNoExpressionClosure: + return JSOP_INITPROP_GETTER; + case PropertyType::Setter: + case PropertyType::SetterNoExpressionClosure: + return JSOP_INITPROP_SETTER; + case PropertyType::Normal: + case PropertyType::Method: + case PropertyType::GeneratorMethod: + case PropertyType::AsyncMethod: + case PropertyType::Constructor: + case PropertyType::DerivedConstructor: + return JSOP_INITPROP; + default: + MOZ_CRASH("unexpected property type"); + } +} + +static FunctionSyntaxKind +FunctionSyntaxKindFromPropertyType(PropertyType propType) +{ + switch (propType) { + case PropertyType::Getter: + return Getter; + case PropertyType::GetterNoExpressionClosure: + return GetterNoExpressionClosure; + case PropertyType::Setter: + return Setter; + case PropertyType::SetterNoExpressionClosure: + return SetterNoExpressionClosure; + case PropertyType::Method: + case PropertyType::GeneratorMethod: + case PropertyType::AsyncMethod: + return Method; + case PropertyType::Constructor: + return ClassConstructor; + case PropertyType::DerivedConstructor: + return DerivedClassConstructor; + default: + MOZ_CRASH("unexpected property type"); + } +} + +static GeneratorKind +GeneratorKindFromPropertyType(PropertyType propType) +{ + if (propType == PropertyType::GeneratorMethod) + return StarGenerator; + if (propType == PropertyType::AsyncMethod) + return StarGenerator; + return NotGenerator; +} + +static FunctionAsyncKind +AsyncKindFromPropertyType(PropertyType propType) +{ + if (propType == PropertyType::AsyncMethod) + return AsyncFunction; + return SyncFunction; +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::classDefinition(YieldHandling yieldHandling, + ClassContext classContext, + DefaultHandling defaultHandling) +{ + MOZ_ASSERT(tokenStream.isCurrentTokenType(TOK_CLASS)); + + bool savedStrictness = setLocalStrictMode(true); + + TokenKind tt; + if (!tokenStream.getToken(&tt)) + return null(); + + RootedPropertyName name(context); + if (tt == TOK_NAME || tt == TOK_YIELD) { + name = bindingIdentifier(yieldHandling); + if (!name) + return null(); + } else if (classContext == ClassStatement) { + if (defaultHandling == AllowDefaultName) { + name = context->names().starDefaultStar; + tokenStream.ungetToken(); + } else { + // Class statements must have a bound name + report(ParseError, false, null(), JSMSG_UNNAMED_CLASS_STMT); + return null(); + } + } else { + // Make sure to put it back, whatever it was + tokenStream.ungetToken(); + } + + RootedAtom propAtom(context); + + // A named class creates a new lexical scope with a const binding of the + // class name. + Maybe<ParseContext::Statement> classStmt; + Maybe<ParseContext::Scope> classScope; + if (name) { + classStmt.emplace(pc, StatementKind::Block); + classScope.emplace(this); + if (!classScope->init(pc)) + return null(); + } + + // Because the binding definitions keep track of their blockId, we need to + // create at least the inner binding later. Keep track of the name's position + // in order to provide it for the nodes created later. + TokenPos namePos = pos(); + + Node classHeritage = null(); + bool hasHeritage; + if (!tokenStream.matchToken(&hasHeritage, TOK_EXTENDS)) + return null(); + if (hasHeritage) { + if (!tokenStream.getToken(&tt)) + return null(); + classHeritage = memberExpr(yieldHandling, TripledotProhibited, tt); + if (!classHeritage) + return null(); + } + + MUST_MATCH_TOKEN(TOK_LC, JSMSG_CURLY_BEFORE_CLASS); + + Node classMethods = handler.newClassMethodList(pos().begin); + if (!classMethods) + return null(); + + bool seenConstructor = false; + for (;;) { + TokenKind tt; + if (!tokenStream.getToken(&tt, TokenStream::KeywordIsName)) + return null(); + if (tt == TOK_RC) + break; + + if (tt == TOK_SEMI) + continue; + + bool isStatic = false; + if (tt == TOK_NAME && tokenStream.currentName() == context->names().static_) { + if (!tokenStream.peekToken(&tt, TokenStream::KeywordIsName)) + return null(); + if (tt == TOK_RC) { + tokenStream.consumeKnownToken(tt, TokenStream::KeywordIsName); + report(ParseError, false, null(), JSMSG_UNEXPECTED_TOKEN, + "property name", TokenKindToDesc(tt)); + return null(); + } + + if (tt != TOK_LP) { + if (!checkUnescapedName()) + return null(); + + isStatic = true; + } else { + tokenStream.addModifierException(TokenStream::NoneIsKeywordIsName); + tokenStream.ungetToken(); + } + } else { + tokenStream.ungetToken(); + } + + PropertyType propType; + Node propName = propertyName(yieldHandling, classMethods, &propType, &propAtom); + if (!propName) + return null(); + + if (propType != PropertyType::Getter && propType != PropertyType::Setter && + propType != PropertyType::Method && propType != PropertyType::GeneratorMethod && + propType != PropertyType::AsyncMethod && + propType != PropertyType::Constructor && propType != PropertyType::DerivedConstructor) + { + report(ParseError, false, null(), JSMSG_BAD_METHOD_DEF); + return null(); + } + + if (propType == PropertyType::Getter) + propType = PropertyType::GetterNoExpressionClosure; + if (propType == PropertyType::Setter) + propType = PropertyType::SetterNoExpressionClosure; + if (!isStatic && propAtom == context->names().constructor) { + if (propType != PropertyType::Method) { + report(ParseError, false, propName, JSMSG_BAD_METHOD_DEF); + return null(); + } + if (seenConstructor) { + report(ParseError, false, propName, JSMSG_DUPLICATE_PROPERTY, "constructor"); + return null(); + } + seenConstructor = true; + propType = hasHeritage ? PropertyType::DerivedConstructor : PropertyType::Constructor; + } else if (isStatic && propAtom == context->names().prototype) { + report(ParseError, false, propName, JSMSG_BAD_METHOD_DEF); + return null(); + } + + // FIXME: Implement ES6 function "name" property semantics + // (bug 883377). + RootedAtom funName(context); + switch (propType) { + case PropertyType::GetterNoExpressionClosure: + case PropertyType::SetterNoExpressionClosure: + if (!tokenStream.isCurrentTokenType(TOK_RB)) { + funName = prefixAccessorName(propType, propAtom); + if (!funName) + return null(); + } + break; + case PropertyType::Constructor: + case PropertyType::DerivedConstructor: + funName = name; + break; + default: + if (!tokenStream.isCurrentTokenType(TOK_RB)) + funName = propAtom; + } + Node fn = methodDefinition(propType, funName); + if (!fn) + return null(); + + JSOp op = JSOpFromPropertyType(propType); + if (!handler.addClassMethodDefinition(classMethods, propName, fn, op, isStatic)) + return null(); + } + + Node nameNode = null(); + Node methodsOrBlock = classMethods; + if (name) { + // The inner name is immutable. + if (!noteDeclaredName(name, DeclarationKind::Const, namePos)) + return null(); + + Node innerName = newName(name, namePos); + if (!innerName) + return null(); + + Node classBlock = finishLexicalScope(*classScope, classMethods); + if (!classBlock) + return null(); + + methodsOrBlock = classBlock; + + // Pop the inner scope. + classScope.reset(); + classStmt.reset(); + + Node outerName = null(); + if (classContext == ClassStatement) { + // The outer name is mutable. + if (!noteDeclaredName(name, DeclarationKind::Let, namePos)) + return null(); + + outerName = newName(name, namePos); + if (!outerName) + return null(); + } + + nameNode = handler.newClassNames(outerName, innerName, namePos); + if (!nameNode) + return null(); + } + + MOZ_ALWAYS_TRUE(setLocalStrictMode(savedStrictness)); + + return handler.newClass(nameNode, classHeritage, methodsOrBlock); +} + +template <class ParseHandler> +bool +Parser<ParseHandler>::nextTokenContinuesLetDeclaration(TokenKind next, YieldHandling yieldHandling) +{ + MOZ_ASSERT(tokenStream.isCurrentTokenType(TOK_NAME)); + MOZ_ASSERT(tokenStream.currentName() == context->names().let); + MOZ_ASSERT(!tokenStream.currentToken().nameContainsEscape()); + +#ifdef DEBUG + TokenKind verify; + MOZ_ALWAYS_TRUE(tokenStream.peekToken(&verify)); + MOZ_ASSERT(next == verify); +#endif + + // Destructuring is (for once) the easy case. + if (next == TOK_LB || next == TOK_LC) + return true; + + // Otherwise a let declaration must have a name. + if (next == TOK_NAME) { + if (tokenStream.nextName() == context->names().yield) { + MOZ_ASSERT(tokenStream.nextNameContainsEscape(), + "token stream should interpret unescaped 'yield' as TOK_YIELD"); + + // Same as |next == TOK_YIELD|. + return yieldHandling == YieldIsName; + } + + // One non-"yield" TOK_NAME edge case deserves special comment. + // Consider this: + // + // let // not an ASI opportunity + // let; + // + // Static semantics in §13.3.1.1 turn a LexicalDeclaration that binds + // "let" into an early error. Does this retroactively permit ASI so + // that we should parse this as two ExpressionStatements? No. ASI + // resolves during parsing. Static semantics only apply to the full + // parse tree with ASI applied. No backsies! + return true; + } + + // If we have the name "yield", the grammar parameter exactly states + // whether this is okay. (This wasn't true for SpiderMonkey's ancient + // legacy generator syntax, but that's dead now.) If YieldIsName, + // declaration-parsing code will (if necessary) enforce a strict mode + // restriction on defining "yield". If YieldIsKeyword, consider this the + // end of the declaration, in case ASI induces a semicolon that makes the + // "yield" valid. + if (next == TOK_YIELD) + return yieldHandling == YieldIsName; + + // Otherwise not a let declaration. + return false; +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::variableStatement(YieldHandling yieldHandling) +{ + Node vars = declarationList(yieldHandling, PNK_VAR); + if (!vars) + return null(); + if (!MatchOrInsertSemicolonAfterExpression(tokenStream)) + return null(); + return vars; +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::statement(YieldHandling yieldHandling) +{ + MOZ_ASSERT(checkOptionsCalled); + + JS_CHECK_RECURSION(context, return null()); + + TokenKind tt; + if (!tokenStream.getToken(&tt, TokenStream::Operand)) + return null(); + + switch (tt) { + // BlockStatement[?Yield, ?Return] + case TOK_LC: + return blockStatement(yieldHandling); + + // VariableStatement[?Yield] + case TOK_VAR: + return variableStatement(yieldHandling); + + // EmptyStatement + case TOK_SEMI: + return handler.newEmptyStatement(pos()); + + // ExpressionStatement[?Yield]. + + case TOK_YIELD: { + // Don't use a ternary operator here due to obscure linker issues + // around using static consts in the arms of a ternary. + TokenStream::Modifier modifier; + if (yieldExpressionsSupported()) + modifier = TokenStream::Operand; + else + modifier = TokenStream::None; + + TokenKind next; + if (!tokenStream.peekToken(&next, modifier)) + return null(); + + if (next == TOK_COLON) + return labeledStatement(yieldHandling); + + return expressionStatement(yieldHandling); + } + + case TOK_NAME: { + TokenKind next; + if (!tokenStream.peekToken(&next)) + return null(); + + // |let| here can only be an Identifier, not a declaration. Give nicer + // errors for declaration-looking typos. + if (!tokenStream.currentToken().nameContainsEscape() && + tokenStream.currentName() == context->names().let) + { + bool forbiddenLetDeclaration = false; + + if (pc->sc()->strict() || versionNumber() >= JSVERSION_1_7) { + // |let| can't be an Identifier in strict mode code. Ditto for + // non-standard JavaScript 1.7+. + forbiddenLetDeclaration = true; + } else if (next == TOK_LB) { + // Enforce ExpressionStatement's 'let [' lookahead restriction. + forbiddenLetDeclaration = true; + } else if (next == TOK_LC || next == TOK_NAME) { + // 'let {' and 'let foo' aren't completely forbidden, if ASI + // causes 'let' to be the entire Statement. But if they're + // same-line, we can aggressively give a better error message. + // + // Note that this ignores 'yield' as TOK_YIELD: we'll handle it + // correctly but with a worse error message. + TokenKind nextSameLine; + if (!tokenStream.peekTokenSameLine(&nextSameLine)) + return null(); + + MOZ_ASSERT(nextSameLine == TOK_NAME || + nextSameLine == TOK_LC || + nextSameLine == TOK_EOL); + + forbiddenLetDeclaration = nextSameLine != TOK_EOL; + } + + if (forbiddenLetDeclaration) { + report(ParseError, false, null(), JSMSG_FORBIDDEN_AS_STATEMENT, + "lexical declarations"); + return null(); + } + } + + // NOTE: It's unfortunately allowed to have a label named 'let' in + // non-strict code. 💯 + if (next == TOK_COLON) + return labeledStatement(yieldHandling); + + return expressionStatement(yieldHandling); + } + + case TOK_NEW: + return expressionStatement(yieldHandling, PredictInvoked); + + default: + return expressionStatement(yieldHandling); + + // IfStatement[?Yield, ?Return] + case TOK_IF: + return ifStatement(yieldHandling); + + // BreakableStatement[?Yield, ?Return] + // + // BreakableStatement[Yield, Return]: + // IterationStatement[?Yield, ?Return] + // SwitchStatement[?Yield, ?Return] + case TOK_DO: + return doWhileStatement(yieldHandling); + + case TOK_WHILE: + return whileStatement(yieldHandling); + + case TOK_FOR: + return forStatement(yieldHandling); + + case TOK_SWITCH: + return switchStatement(yieldHandling); + + // ContinueStatement[?Yield] + case TOK_CONTINUE: + return continueStatement(yieldHandling); + + // BreakStatement[?Yield] + case TOK_BREAK: + return breakStatement(yieldHandling); + + // [+Return] ReturnStatement[?Yield] + case TOK_RETURN: + // The Return parameter is only used here, and the effect is easily + // detected this way, so don't bother passing around an extra parameter + // everywhere. + if (!pc->isFunctionBox()) { + report(ParseError, false, null(), JSMSG_BAD_RETURN_OR_YIELD, js_return_str); + return null(); + } + return returnStatement(yieldHandling); + + // WithStatement[?Yield, ?Return] + case TOK_WITH: + return withStatement(yieldHandling); + + // LabelledStatement[?Yield, ?Return] + // This is really handled by TOK_NAME and TOK_YIELD cases above. + + // ThrowStatement[?Yield] + case TOK_THROW: + return throwStatement(yieldHandling); + + // TryStatement[?Yield, ?Return] + case TOK_TRY: + return tryStatement(yieldHandling); + + // DebuggerStatement + case TOK_DEBUGGER: + return debuggerStatement(); + + // |function| is forbidden by lookahead restriction (unless as child + // statement of |if| or |else|, but Parser::consequentOrAlternative + // handles that). + case TOK_FUNCTION: + report(ParseError, false, null(), JSMSG_FORBIDDEN_AS_STATEMENT, "function declarations"); + return null(); + + // |class| is also forbidden by lookahead restriction. + case TOK_CLASS: + report(ParseError, false, null(), JSMSG_FORBIDDEN_AS_STATEMENT, "classes"); + return null(); + + // ImportDeclaration (only inside modules) + case TOK_IMPORT: + return importDeclaration(); + + // ExportDeclaration (only inside modules) + case TOK_EXPORT: + return exportDeclaration(); + + // Miscellaneous error cases arguably better caught here than elsewhere. + + case TOK_CATCH: + report(ParseError, false, null(), JSMSG_CATCH_WITHOUT_TRY); + return null(); + + case TOK_FINALLY: + report(ParseError, false, null(), JSMSG_FINALLY_WITHOUT_TRY); + return null(); + + // NOTE: default case handled in the ExpressionStatement section. + } +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::statementListItem(YieldHandling yieldHandling, + bool canHaveDirectives /* = false */) +{ + MOZ_ASSERT(checkOptionsCalled); + + JS_CHECK_RECURSION(context, return null()); + + TokenKind tt; + if (!tokenStream.getToken(&tt, TokenStream::Operand)) + return null(); + + switch (tt) { + // BlockStatement[?Yield, ?Return] + case TOK_LC: + return blockStatement(yieldHandling); + + // VariableStatement[?Yield] + case TOK_VAR: + return variableStatement(yieldHandling); + + // EmptyStatement + case TOK_SEMI: + return handler.newEmptyStatement(pos()); + + // ExpressionStatement[?Yield]. + // + // These should probably be handled by a single ExpressionStatement + // function in a default, not split up this way. + case TOK_STRING: + if (!canHaveDirectives && tokenStream.currentToken().atom() == context->names().useAsm) { + if (!abortIfSyntaxParser()) + return null(); + if (!report(ParseWarning, false, null(), JSMSG_USE_ASM_DIRECTIVE_FAIL)) + return null(); + } + return expressionStatement(yieldHandling); + + case TOK_YIELD: { + // Don't use a ternary operator here due to obscure linker issues + // around using static consts in the arms of a ternary. + TokenStream::Modifier modifier; + if (yieldExpressionsSupported()) + modifier = TokenStream::Operand; + else + modifier = TokenStream::None; + + TokenKind next; + if (!tokenStream.peekToken(&next, modifier)) + return null(); + + if (next == TOK_COLON) + return labeledStatement(yieldHandling); + + return expressionStatement(yieldHandling); + } + + case TOK_NAME: { + TokenKind next; + if (!tokenStream.peekToken(&next)) + return null(); + + if (!tokenStream.currentToken().nameContainsEscape() && + tokenStream.currentName() == context->names().let && + nextTokenContinuesLetDeclaration(next, yieldHandling)) + { + return lexicalDeclaration(yieldHandling, /* isConst = */ false); + } + + if (tokenStream.currentName() == context->names().async) { + TokenKind nextSameLine = TOK_EOF; + if (!tokenStream.peekTokenSameLine(&nextSameLine)) + return null(); + if (nextSameLine == TOK_FUNCTION) { + tokenStream.consumeKnownToken(TOK_FUNCTION); + return functionStmt(yieldHandling, NameRequired, AsyncFunction); + } + } + + if (next == TOK_COLON) + return labeledStatement(yieldHandling); + + return expressionStatement(yieldHandling); + } + + case TOK_NEW: + return expressionStatement(yieldHandling, PredictInvoked); + + default: + return expressionStatement(yieldHandling); + + // IfStatement[?Yield, ?Return] + case TOK_IF: + return ifStatement(yieldHandling); + + // BreakableStatement[?Yield, ?Return] + // + // BreakableStatement[Yield, Return]: + // IterationStatement[?Yield, ?Return] + // SwitchStatement[?Yield, ?Return] + case TOK_DO: + return doWhileStatement(yieldHandling); + + case TOK_WHILE: + return whileStatement(yieldHandling); + + case TOK_FOR: + return forStatement(yieldHandling); + + case TOK_SWITCH: + return switchStatement(yieldHandling); + + // ContinueStatement[?Yield] + case TOK_CONTINUE: + return continueStatement(yieldHandling); + + // BreakStatement[?Yield] + case TOK_BREAK: + return breakStatement(yieldHandling); + + // [+Return] ReturnStatement[?Yield] + case TOK_RETURN: + // The Return parameter is only used here, and the effect is easily + // detected this way, so don't bother passing around an extra parameter + // everywhere. + if (!pc->isFunctionBox()) { + report(ParseError, false, null(), JSMSG_BAD_RETURN_OR_YIELD, js_return_str); + return null(); + } + return returnStatement(yieldHandling); + + // WithStatement[?Yield, ?Return] + case TOK_WITH: + return withStatement(yieldHandling); + + // LabelledStatement[?Yield, ?Return] + // This is really handled by TOK_NAME and TOK_YIELD cases above. + + // ThrowStatement[?Yield] + case TOK_THROW: + return throwStatement(yieldHandling); + + // TryStatement[?Yield, ?Return] + case TOK_TRY: + return tryStatement(yieldHandling); + + // DebuggerStatement + case TOK_DEBUGGER: + return debuggerStatement(); + + // Declaration[Yield]: + + // HoistableDeclaration[?Yield, ~Default] + case TOK_FUNCTION: + return functionStmt(yieldHandling, NameRequired); + + // ClassDeclaration[?Yield, ~Default] + case TOK_CLASS: + return classDefinition(yieldHandling, ClassStatement, NameRequired); + + // LexicalDeclaration[In, ?Yield] + // LetOrConst BindingList[?In, ?Yield] + case TOK_CONST: + // [In] is the default behavior, because for-loops specially parse + // their heads to handle |in| in this situation. + return lexicalDeclaration(yieldHandling, /* isConst = */ true); + + // ImportDeclaration (only inside modules) + case TOK_IMPORT: + return importDeclaration(); + + // ExportDeclaration (only inside modules) + case TOK_EXPORT: + return exportDeclaration(); + + // Miscellaneous error cases arguably better caught here than elsewhere. + + case TOK_CATCH: + report(ParseError, false, null(), JSMSG_CATCH_WITHOUT_TRY); + return null(); + + case TOK_FINALLY: + report(ParseError, false, null(), JSMSG_FINALLY_WITHOUT_TRY); + return null(); + + // NOTE: default case handled in the ExpressionStatement section. + } +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::expr(InHandling inHandling, YieldHandling yieldHandling, + TripledotHandling tripledotHandling, + PossibleError* possibleError /* = nullptr */, + InvokedPrediction invoked /* = PredictUninvoked */) +{ + Node pn = assignExpr(inHandling, yieldHandling, tripledotHandling, + possibleError, invoked); + if (!pn) + return null(); + + bool matched; + if (!tokenStream.matchToken(&matched, TOK_COMMA)) + return null(); + if (!matched) + return pn; + + Node seq = handler.newCommaExpressionList(pn); + if (!seq) + return null(); + while (true) { + // Trailing comma before the closing parenthesis is valid in an arrow + // function parameters list: `(a, b, ) => body`. Check if we are + // directly under CoverParenthesizedExpressionAndArrowParameterList, + // and the next two tokens are closing parenthesis and arrow. If all + // are present allow the trailing comma. + if (tripledotHandling == TripledotAllowed) { + TokenKind tt; + if (!tokenStream.peekToken(&tt, TokenStream::Operand)) + return null(); + + if (tt == TOK_RP) { + tokenStream.consumeKnownToken(TOK_RP, TokenStream::Operand); + + if (!tokenStream.peekToken(&tt)) + return null(); + if (tt != TOK_ARROW) { + report(ParseError, false, null(), JSMSG_UNEXPECTED_TOKEN, + "expression", TokenKindToDesc(TOK_RP)); + return null(); + } + + tokenStream.ungetToken(); // put back right paren + tokenStream.addModifierException(TokenStream::NoneIsOperand); + break; + } + } + + // Additional calls to assignExpr should not reuse the possibleError + // which had been passed into the function. Otherwise we would lose + // information needed to determine whether or not we're dealing with + // a non-recoverable situation. + PossibleError possibleErrorInner(*this); + pn = assignExpr(inHandling, yieldHandling, tripledotHandling, + &possibleErrorInner); + if (!pn) + return null(); + + if (!possibleError) { + // Report any pending expression error. + if (!possibleErrorInner.checkForExpressionError()) + return null(); + } else { + possibleErrorInner.transferErrorsTo(possibleError); + } + + handler.addList(seq, pn); + + if (!tokenStream.matchToken(&matched, TOK_COMMA)) + return null(); + if (!matched) + break; + } + return seq; +} + +static const JSOp ParseNodeKindToJSOp[] = { + JSOP_OR, + JSOP_AND, + JSOP_BITOR, + JSOP_BITXOR, + JSOP_BITAND, + JSOP_STRICTEQ, + JSOP_EQ, + JSOP_STRICTNE, + JSOP_NE, + JSOP_LT, + JSOP_LE, + JSOP_GT, + JSOP_GE, + JSOP_INSTANCEOF, + JSOP_IN, + JSOP_LSH, + JSOP_RSH, + JSOP_URSH, + JSOP_ADD, + JSOP_SUB, + JSOP_MUL, + JSOP_DIV, + JSOP_MOD, + JSOP_POW +}; + +static inline JSOp +BinaryOpParseNodeKindToJSOp(ParseNodeKind pnk) +{ + MOZ_ASSERT(pnk >= PNK_BINOP_FIRST); + MOZ_ASSERT(pnk <= PNK_BINOP_LAST); + return ParseNodeKindToJSOp[pnk - PNK_BINOP_FIRST]; +} + +static ParseNodeKind +BinaryOpTokenKindToParseNodeKind(TokenKind tok) +{ + MOZ_ASSERT(TokenKindIsBinaryOp(tok)); + return ParseNodeKind(PNK_BINOP_FIRST + (tok - TOK_BINOP_FIRST)); +} + +static const int PrecedenceTable[] = { + 1, /* PNK_OR */ + 2, /* PNK_AND */ + 3, /* PNK_BITOR */ + 4, /* PNK_BITXOR */ + 5, /* PNK_BITAND */ + 6, /* PNK_STRICTEQ */ + 6, /* PNK_EQ */ + 6, /* PNK_STRICTNE */ + 6, /* PNK_NE */ + 7, /* PNK_LT */ + 7, /* PNK_LE */ + 7, /* PNK_GT */ + 7, /* PNK_GE */ + 7, /* PNK_INSTANCEOF */ + 7, /* PNK_IN */ + 8, /* PNK_LSH */ + 8, /* PNK_RSH */ + 8, /* PNK_URSH */ + 9, /* PNK_ADD */ + 9, /* PNK_SUB */ + 10, /* PNK_STAR */ + 10, /* PNK_DIV */ + 10, /* PNK_MOD */ + 11 /* PNK_POW */ +}; + +static const int PRECEDENCE_CLASSES = 11; + +static int +Precedence(ParseNodeKind pnk) { + // Everything binds tighter than PNK_LIMIT, because we want to reduce all + // nodes to a single node when we reach a token that is not another binary + // operator. + if (pnk == PNK_LIMIT) + return 0; + + MOZ_ASSERT(pnk >= PNK_BINOP_FIRST); + MOZ_ASSERT(pnk <= PNK_BINOP_LAST); + return PrecedenceTable[pnk - PNK_BINOP_FIRST]; +} + +template <typename ParseHandler> +MOZ_ALWAYS_INLINE typename ParseHandler::Node +Parser<ParseHandler>::orExpr1(InHandling inHandling, YieldHandling yieldHandling, + TripledotHandling tripledotHandling, + PossibleError* possibleError, + InvokedPrediction invoked /* = PredictUninvoked */) +{ + // Shift-reduce parser for the binary operator part of the JS expression + // syntax. + + // Conceptually there's just one stack, a stack of pairs (lhs, op). + // It's implemented using two separate arrays, though. + Node nodeStack[PRECEDENCE_CLASSES]; + ParseNodeKind kindStack[PRECEDENCE_CLASSES]; + int depth = 0; + Node pn; + for (;;) { + pn = unaryExpr(yieldHandling, tripledotHandling, possibleError, invoked); + if (!pn) + return pn; + + // If a binary operator follows, consume it and compute the + // corresponding operator. + TokenKind tok; + if (!tokenStream.getToken(&tok)) + return null(); + + ParseNodeKind pnk; + if (tok == TOK_IN ? inHandling == InAllowed : TokenKindIsBinaryOp(tok)) { + // We're definitely not in a destructuring context, so report any + // pending expression error now. + if (possibleError && !possibleError->checkForExpressionError()) + return null(); + // Report an error for unary expressions on the LHS of **. + if (tok == TOK_POW && handler.isUnparenthesizedUnaryExpression(pn)) { + report(ParseError, false, null(), JSMSG_BAD_POW_LEFTSIDE); + return null(); + } + pnk = BinaryOpTokenKindToParseNodeKind(tok); + } else { + tok = TOK_EOF; + pnk = PNK_LIMIT; + } + + // From this point on, destructuring defaults are definitely an error. + possibleError = nullptr; + + // If pnk has precedence less than or equal to another operator on the + // stack, reduce. This combines nodes on the stack until we form the + // actual lhs of pnk. + // + // The >= in this condition works because it is appendOrCreateList's + // job to decide if the operator in question is left- or + // right-associative, and build the corresponding tree. + while (depth > 0 && Precedence(kindStack[depth - 1]) >= Precedence(pnk)) { + depth--; + ParseNodeKind combiningPnk = kindStack[depth]; + JSOp combiningOp = BinaryOpParseNodeKindToJSOp(combiningPnk); + pn = handler.appendOrCreateList(combiningPnk, nodeStack[depth], pn, pc, combiningOp); + if (!pn) + return pn; + } + + if (pnk == PNK_LIMIT) + break; + + nodeStack[depth] = pn; + kindStack[depth] = pnk; + depth++; + MOZ_ASSERT(depth <= PRECEDENCE_CLASSES); + } + + MOZ_ASSERT(depth == 0); + return pn; +} + +template <typename ParseHandler> +MOZ_ALWAYS_INLINE typename ParseHandler::Node +Parser<ParseHandler>::condExpr1(InHandling inHandling, YieldHandling yieldHandling, + TripledotHandling tripledotHandling, + PossibleError* possibleError, + InvokedPrediction invoked /* = PredictUninvoked */) +{ + Node condition = orExpr1(inHandling, yieldHandling, tripledotHandling, possibleError, invoked); + + if (!condition || !tokenStream.isCurrentTokenType(TOK_HOOK)) + return condition; + + Node thenExpr = assignExpr(InAllowed, yieldHandling, TripledotProhibited); + if (!thenExpr) + return null(); + + MUST_MATCH_TOKEN(TOK_COLON, JSMSG_COLON_IN_COND); + + Node elseExpr = assignExpr(inHandling, yieldHandling, TripledotProhibited); + if (!elseExpr) + return null(); + + // Advance to the next token; the caller is responsible for interpreting it. + TokenKind ignored; + if (!tokenStream.getToken(&ignored)) + return null(); + return handler.newConditional(condition, thenExpr, elseExpr); +} + +template <typename ParseHandler> +bool +Parser<ParseHandler>::checkAndMarkAsAssignmentLhs(Node target, AssignmentFlavor flavor, + PossibleError* possibleError) +{ + MOZ_ASSERT(flavor != KeyedDestructuringAssignment, + "destructuring must use special checking/marking code, not " + "this method"); + + if (handler.isUnparenthesizedDestructuringPattern(target)) { + if (flavor == CompoundAssignment) { + report(ParseError, false, null(), JSMSG_BAD_DESTRUCT_ASS); + return false; + } + + return checkDestructuringPattern(target, Nothing(), possibleError); + } + + // All other permitted targets are simple. + if (!reportIfNotValidSimpleAssignmentTarget(target, flavor)) + return false; + + if (handler.isPropertyAccess(target)) + return true; + + if (handler.isNameAnyParentheses(target)) { + // The arguments/eval identifiers are simple in non-strict mode code, + // but warn to discourage use nonetheless. + if (!reportIfArgumentsEvalTarget(target)) + return false; + + handler.adjustGetToSet(target); + return true; + } + + MOZ_ASSERT(handler.isFunctionCall(target)); + return checkAssignmentToCall(target, JSMSG_BAD_LEFTSIDE_OF_ASS); +} + +class AutoClearInDestructuringDecl +{ + ParseContext* pc_; + Maybe<DeclarationKind> saved_; + + public: + explicit AutoClearInDestructuringDecl(ParseContext* pc) + : pc_(pc), + saved_(pc->inDestructuringDecl) + { + pc->inDestructuringDecl = Nothing(); + if (saved_ && *saved_ == DeclarationKind::FormalParameter) + pc->functionBox()->hasParameterExprs = true; + } + + ~AutoClearInDestructuringDecl() { + pc_->inDestructuringDecl = saved_; + } +}; + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::assignExpr(InHandling inHandling, YieldHandling yieldHandling, + TripledotHandling tripledotHandling, + PossibleError* possibleError /* = nullptr */, + InvokedPrediction invoked /* = PredictUninvoked */) +{ + JS_CHECK_RECURSION(context, return null()); + + // It's very common at this point to have a "detectably simple" expression, + // i.e. a name/number/string token followed by one of the following tokens + // that obviously isn't part of an expression: , ; : ) ] } + // + // (In Parsemark this happens 81.4% of the time; in code with large + // numeric arrays, such as some Kraken benchmarks, it happens more often.) + // + // In such cases, we can avoid the full expression parsing route through + // assignExpr(), condExpr1(), orExpr1(), unaryExpr(), memberExpr(), and + // primaryExpr(). + + TokenKind tt; + if (!tokenStream.getToken(&tt, TokenStream::Operand)) + return null(); + + bool endsExpr; + + if (tt == TOK_NAME) { + if (!tokenStream.nextTokenEndsExpr(&endsExpr)) + return null(); + if (endsExpr) { + Rooted<PropertyName*> name(context, identifierReference(yieldHandling)); + if (!name) + return null(); + + return identifierReference(name); + } + } + + if (tt == TOK_NUMBER) { + if (!tokenStream.nextTokenEndsExpr(&endsExpr)) + return null(); + if (endsExpr) + return newNumber(tokenStream.currentToken()); + } + + if (tt == TOK_STRING) { + if (!tokenStream.nextTokenEndsExpr(&endsExpr)) + return null(); + if (endsExpr) + return stringLiteral(); + } + + if (tt == TOK_YIELD && yieldExpressionsSupported()) + return yieldExpression(inHandling); + + bool maybeAsyncArrow = false; + if (tt == TOK_NAME && tokenStream.currentName() == context->names().async) { + TokenKind nextSameLine = TOK_EOF; + if (!tokenStream.peekTokenSameLine(&nextSameLine)) + return null(); + + if (nextSameLine == TOK_NAME || nextSameLine == TOK_YIELD) + maybeAsyncArrow = true; + } + + tokenStream.ungetToken(); + + // Save the tokenizer state in case we find an arrow function and have to + // rewind. + TokenStream::Position start(keepAtoms); + tokenStream.tell(&start); + + PossibleError possibleErrorInner(*this); + Node lhs; + if (maybeAsyncArrow) { + tokenStream.consumeKnownToken(TOK_NAME, TokenStream::Operand); + MOZ_ASSERT(tokenStream.currentName() == context->names().async); + + TokenKind tt; + if (!tokenStream.getToken(&tt)) + return null(); + MOZ_ASSERT(tt == TOK_NAME || tt == TOK_YIELD); + + // Check yield validity here. + RootedPropertyName name(context, bindingIdentifier(yieldHandling)); + if (!name) + return null(); + + if (!tokenStream.getToken(&tt)) + return null(); + if (tt != TOK_ARROW) { + report(ParseError, false, null(), JSMSG_UNEXPECTED_TOKEN, + "'=>' after argument list", TokenKindToDesc(tt)); + + return null(); + } + } else { + lhs = condExpr1(inHandling, yieldHandling, tripledotHandling, &possibleErrorInner, invoked); + if (!lhs) { + return null(); + } + } + + ParseNodeKind kind; + JSOp op; + switch (tokenStream.currentToken().type) { + case TOK_ASSIGN: kind = PNK_ASSIGN; op = JSOP_NOP; break; + case TOK_ADDASSIGN: kind = PNK_ADDASSIGN; op = JSOP_ADD; break; + case TOK_SUBASSIGN: kind = PNK_SUBASSIGN; op = JSOP_SUB; break; + case TOK_BITORASSIGN: kind = PNK_BITORASSIGN; op = JSOP_BITOR; break; + case TOK_BITXORASSIGN: kind = PNK_BITXORASSIGN; op = JSOP_BITXOR; break; + case TOK_BITANDASSIGN: kind = PNK_BITANDASSIGN; op = JSOP_BITAND; break; + case TOK_LSHASSIGN: kind = PNK_LSHASSIGN; op = JSOP_LSH; break; + case TOK_RSHASSIGN: kind = PNK_RSHASSIGN; op = JSOP_RSH; break; + case TOK_URSHASSIGN: kind = PNK_URSHASSIGN; op = JSOP_URSH; break; + case TOK_MULASSIGN: kind = PNK_MULASSIGN; op = JSOP_MUL; break; + case TOK_DIVASSIGN: kind = PNK_DIVASSIGN; op = JSOP_DIV; break; + case TOK_MODASSIGN: kind = PNK_MODASSIGN; op = JSOP_MOD; break; + case TOK_POWASSIGN: kind = PNK_POWASSIGN; op = JSOP_POW; break; + + case TOK_ARROW: { + + // A line terminator between ArrowParameters and the => should trigger a SyntaxError. + tokenStream.ungetToken(); + TokenKind next; + if (!tokenStream.peekTokenSameLine(&next)) + return null(); + MOZ_ASSERT(next == TOK_ARROW || next == TOK_EOL); + + if (next != TOK_ARROW) { + report(ParseError, false, null(), JSMSG_LINE_BREAK_BEFORE_ARROW); + return null(); + } + tokenStream.consumeKnownToken(TOK_ARROW); + + bool isBlock = false; + if (!tokenStream.peekToken(&next, TokenStream::Operand)) + return null(); + if (next == TOK_LC) + isBlock = true; + + tokenStream.seek(start); + + if (!tokenStream.peekToken(&next, TokenStream::Operand)) + return null(); + + GeneratorKind generatorKind = NotGenerator; + FunctionAsyncKind asyncKind = SyncFunction; + + if (next == TOK_NAME) { + tokenStream.consumeKnownToken(next, TokenStream::Operand); + + if (tokenStream.currentName() == context->names().async) { + TokenKind nextSameLine = TOK_EOF; + if (!tokenStream.peekTokenSameLine(&nextSameLine)) + return null(); + + if (nextSameLine == TOK_ARROW) { + tokenStream.ungetToken(); + } else { + generatorKind = StarGenerator; + asyncKind = AsyncFunction; + } + } else { + tokenStream.ungetToken(); + } + } + + Node arrowFunc = functionDefinition(inHandling, yieldHandling, nullptr, + Arrow, generatorKind, asyncKind); + if (!arrowFunc) + return null(); + + if (isBlock) { + // This arrow function could be a non-trailing member of a comma + // expression or a semicolon terminating a full expression. If so, + // the next token is that comma/semicolon, gotten with None: + // + // a => {}, b; // as if (a => {}), b; + // a => {}; + // + // But if this arrow function ends a statement, ASI permits the + // next token to start an expression statement. In that case the + // next token must be gotten as Operand: + // + // a => {} // complete expression statement + // /x/g; // regular expression as a statement, *not* division + // + // Getting the second case right requires the first token-peek + // after the arrow function use Operand, and that peek must occur + // before Parser::expr() looks for a comma. Do so here, then + // immediately add the modifier exception needed for the first + // case. + // + // Note that the second case occurs *only* if the arrow function + // has block body. An arrow function not ending in such, ends in + // another AssignmentExpression that we can inductively assume was + // peeked consistently. + TokenKind ignored; + if (!tokenStream.peekToken(&ignored, TokenStream::Operand)) + return null(); + tokenStream.addModifierException(TokenStream::NoneIsOperand); + } + return arrowFunc; + } + + default: + MOZ_ASSERT(!tokenStream.isCurrentTokenAssignment()); + if (!possibleError) { + if (!possibleErrorInner.checkForExpressionError()) + return null(); + } else { + possibleErrorInner.transferErrorsTo(possibleError); + } + tokenStream.ungetToken(); + return lhs; + } + + AssignmentFlavor flavor = kind == PNK_ASSIGN ? PlainAssignment : CompoundAssignment; + if (!checkAndMarkAsAssignmentLhs(lhs, flavor, &possibleErrorInner)) + return null(); + if (!possibleErrorInner.checkForExpressionError()) + return null(); + + Node rhs; + { + AutoClearInDestructuringDecl autoClear(pc); + rhs = assignExpr(inHandling, yieldHandling, TripledotProhibited); + if (!rhs) + return null(); + } + + return handler.newAssignment(kind, lhs, rhs, op); +} + +template <typename ParseHandler> +bool +Parser<ParseHandler>::isValidSimpleAssignmentTarget(Node node, + FunctionCallBehavior behavior /* = ForbidAssignmentToFunctionCalls */) +{ + // Note that this method implements *only* a boolean test. Reporting an + // error for the various syntaxes that fail this, and warning for the + // various syntaxes that "pass" this but should not, occurs elsewhere. + + if (handler.isNameAnyParentheses(node)) { + if (!pc->sc()->strict()) + return true; + + return !handler.nameIsArgumentsEvalAnyParentheses(node, context); + } + + if (handler.isPropertyAccess(node)) + return true; + + if (behavior == PermitAssignmentToFunctionCalls) { + if (handler.isFunctionCall(node)) + return true; + } + + return false; +} + +template <typename ParseHandler> +bool +Parser<ParseHandler>::reportIfArgumentsEvalTarget(Node nameNode) +{ + const char* chars = handler.nameIsArgumentsEvalAnyParentheses(nameNode, context); + if (!chars) + return true; + + if (!report(ParseStrictError, pc->sc()->strict(), nameNode, JSMSG_BAD_STRICT_ASSIGN, chars)) + return false; + + MOZ_ASSERT(!pc->sc()->strict(), + "an error should have been reported if this was strict mode " + "code"); + return true; +} + +template <typename ParseHandler> +bool +Parser<ParseHandler>::reportIfNotValidSimpleAssignmentTarget(Node target, AssignmentFlavor flavor) +{ + FunctionCallBehavior behavior = flavor == KeyedDestructuringAssignment + ? ForbidAssignmentToFunctionCalls + : PermitAssignmentToFunctionCalls; + if (isValidSimpleAssignmentTarget(target, behavior)) + return true; + + if (handler.isNameAnyParentheses(target)) { + // Use a special error if the target is arguments/eval. This ensures + // targeting these names is consistently a SyntaxError (which error numbers + // below don't guarantee) while giving us a nicer error message. + if (!reportIfArgumentsEvalTarget(target)) + return false; + } + + unsigned errnum = 0; + const char* extra = nullptr; + + switch (flavor) { + case IncrementAssignment: + errnum = JSMSG_BAD_OPERAND; + extra = "increment"; + break; + + case DecrementAssignment: + errnum = JSMSG_BAD_OPERAND; + extra = "decrement"; + break; + + case KeyedDestructuringAssignment: + errnum = JSMSG_BAD_DESTRUCT_TARGET; + break; + + case PlainAssignment: + case CompoundAssignment: + errnum = JSMSG_BAD_LEFTSIDE_OF_ASS; + break; + + case ForInOrOfTarget: + errnum = JSMSG_BAD_FOR_LEFTSIDE; + break; + } + + report(ParseError, pc->sc()->strict(), target, errnum, extra); + return false; +} + +template <typename ParseHandler> +bool +Parser<ParseHandler>::checkAndMarkAsIncOperand(Node target, AssignmentFlavor flavor) +{ + MOZ_ASSERT(flavor == IncrementAssignment || flavor == DecrementAssignment); + + // Check. + if (!reportIfNotValidSimpleAssignmentTarget(target, flavor)) + return false; + + // Mark. + if (handler.isNameAnyParentheses(target)) { + // Assignment to arguments/eval is allowed outside strict mode code, + // but it's dodgy. Report a strict warning (error, if werror was set). + if (!reportIfArgumentsEvalTarget(target)) + return false; + } else if (handler.isFunctionCall(target)) { + if (!checkAssignmentToCall(target, JSMSG_BAD_INCOP_OPERAND)) + return false; + } + return true; +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::unaryOpExpr(YieldHandling yieldHandling, ParseNodeKind kind, JSOp op, + uint32_t begin) +{ + Node kid = unaryExpr(yieldHandling, TripledotProhibited); + if (!kid) + return null(); + return handler.newUnary(kind, op, begin, kid); +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::unaryExpr(YieldHandling yieldHandling, TripledotHandling tripledotHandling, + PossibleError* possibleError /* = nullptr */, + InvokedPrediction invoked /* = PredictUninvoked */) +{ + JS_CHECK_RECURSION(context, return null()); + + TokenKind tt; + if (!tokenStream.getToken(&tt, TokenStream::Operand)) + return null(); + uint32_t begin = pos().begin; + switch (tt) { + case TOK_VOID: + return unaryOpExpr(yieldHandling, PNK_VOID, JSOP_VOID, begin); + case TOK_NOT: + return unaryOpExpr(yieldHandling, PNK_NOT, JSOP_NOT, begin); + case TOK_BITNOT: + return unaryOpExpr(yieldHandling, PNK_BITNOT, JSOP_BITNOT, begin); + case TOK_ADD: + return unaryOpExpr(yieldHandling, PNK_POS, JSOP_POS, begin); + case TOK_SUB: + return unaryOpExpr(yieldHandling, PNK_NEG, JSOP_NEG, begin); + + case TOK_TYPEOF: { + // The |typeof| operator is specially parsed to distinguish its + // application to a name, from its application to a non-name + // expression: + // + // // Looks up the name, doesn't find it and so evaluates to + // // "undefined". + // assertEq(typeof nonExistentName, "undefined"); + // + // // Evaluates expression, triggering a runtime ReferenceError for + // // the undefined name. + // typeof (1, nonExistentName); + Node kid = unaryExpr(yieldHandling, TripledotProhibited); + if (!kid) + return null(); + + return handler.newTypeof(begin, kid); + } + + case TOK_INC: + case TOK_DEC: + { + TokenKind tt2; + if (!tokenStream.getToken(&tt2, TokenStream::Operand)) + return null(); + Node pn2 = memberExpr(yieldHandling, TripledotProhibited, tt2); + if (!pn2) + return null(); + AssignmentFlavor flavor = (tt == TOK_INC) ? IncrementAssignment : DecrementAssignment; + if (!checkAndMarkAsIncOperand(pn2, flavor)) + return null(); + return handler.newUpdate((tt == TOK_INC) ? PNK_PREINCREMENT : PNK_PREDECREMENT, + begin, + pn2); + } + + case TOK_DELETE: { + Node expr = unaryExpr(yieldHandling, TripledotProhibited); + if (!expr) + return null(); + + // Per spec, deleting any unary expression is valid -- it simply + // returns true -- except for one case that is illegal in strict mode. + if (handler.isNameAnyParentheses(expr)) { + if (!report(ParseStrictError, pc->sc()->strict(), expr, JSMSG_DEPRECATED_DELETE_OPERAND)) + return null(); + pc->sc()->setBindingsAccessedDynamically(); + } + + return handler.newDelete(begin, expr); + } + + case TOK_AWAIT: { + if (!pc->isAsync()) { + // TOK_AWAIT can be returned in module, even if it's not inside + // async function. + report(ParseError, false, null(), JSMSG_RESERVED_ID, "await"); + return null(); + } + + Node kid = unaryExpr(yieldHandling, tripledotHandling, possibleError, invoked); + if (!kid) + return null(); + pc->lastAwaitOffset = begin; + return newAwaitExpression(begin, kid); + } + + default: { + Node pn = memberExpr(yieldHandling, tripledotHandling, tt, /* allowCallSyntax = */ true, + possibleError, invoked); + if (!pn) + return null(); + + /* Don't look across a newline boundary for a postfix incop. */ + if (!tokenStream.peekTokenSameLine(&tt)) + return null(); + if (tt == TOK_INC || tt == TOK_DEC) { + tokenStream.consumeKnownToken(tt); + AssignmentFlavor flavor = (tt == TOK_INC) ? IncrementAssignment : DecrementAssignment; + if (!checkAndMarkAsIncOperand(pn, flavor)) + return null(); + return handler.newUpdate((tt == TOK_INC) ? PNK_POSTINCREMENT : PNK_POSTDECREMENT, + begin, + pn); + } + return pn; + } + } +} + + +/*** Comprehensions ******************************************************************************* + * + * We currently support two flavors of comprehensions, all deprecated: + * + * [for (V of OBJ) if (COND) EXPR] // ES6-era array comprehension + * (for (V of OBJ) if (COND) EXPR) // ES6-era generator expression + * + * (These flavors are called "ES6-era" because they were in ES6 draft + * specifications for a while. Shortly after this syntax was implemented in SM, + * TC39 decided to drop it.) + */ + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::generatorComprehensionLambda(unsigned begin) +{ + Node genfn = handler.newFunctionDefinition(); + if (!genfn) + return null(); + handler.setOp(genfn, JSOP_LAMBDA); + + ParseContext* outerpc = pc; + + // If we are off the main thread, the generator meta-objects have + // already been created by js::StartOffThreadParseScript, so cx will not + // be necessary. + RootedObject proto(context); + JSContext* cx = context->maybeJSContext(); + proto = GlobalObject::getOrCreateStarGeneratorFunctionPrototype(cx, context->global()); + if (!proto) + return null(); + + RootedFunction fun(context, newFunction(/* atom = */ nullptr, Expression, + StarGenerator, SyncFunction, proto)); + if (!fun) + return null(); + + // Create box for fun->object early to root it. + Directives directives(/* strict = */ outerpc->sc()->strict()); + FunctionBox* genFunbox = newFunctionBox(genfn, fun, directives, StarGenerator, SyncFunction, + /* tryAnnexB = */ false); + if (!genFunbox) + return null(); + genFunbox->isGenexpLambda = true; + genFunbox->initWithEnclosingParseContext(outerpc, Expression); + + ParseContext genpc(this, genFunbox, /* newDirectives = */ nullptr); + if (!genpc.init()) + return null(); + genpc.functionScope().useAsVarScope(&genpc); + + /* + * We assume conservatively that any deoptimization flags in pc->sc() + * come from the kid. So we propagate these flags into genfn. For code + * simplicity we also do not detect if the flags were only set in the + * kid and could be removed from pc->sc(). + */ + genFunbox->anyCxFlags = outerpc->sc()->anyCxFlags; + + if (!declareDotGeneratorName()) + return null(); + + Node body = handler.newStatementList(TokenPos(begin, pos().end)); + if (!body) + return null(); + + Node comp = comprehension(StarGenerator); + if (!comp) + return null(); + + MUST_MATCH_TOKEN(TOK_RP, JSMSG_PAREN_IN_PAREN); + + handler.setBeginPosition(comp, begin); + handler.setEndPosition(comp, pos().end); + handler.addStatementToList(body, comp); + handler.setEndPosition(body, pos().end); + handler.setBeginPosition(genfn, begin); + handler.setEndPosition(genfn, pos().end); + + Node generator = newDotGeneratorName(); + if (!generator) + return null(); + if (!handler.prependInitialYield(body, generator)) + return null(); + + if (!propagateFreeNamesAndMarkClosedOverBindings(pc->varScope())) + return null(); + if (!finishFunction()) + return null(); + if (!leaveInnerFunction(outerpc)) + return null(); + + // Note that if we ever start syntax-parsing generators, we will also + // need to propagate the closed-over variable set to the inner + // lazyscript. + if (!handler.setComprehensionLambdaBody(genfn, body)) + return null(); + + return genfn; +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::comprehensionFor(GeneratorKind comprehensionKind) +{ + MOZ_ASSERT(tokenStream.isCurrentTokenType(TOK_FOR)); + + uint32_t begin = pos().begin; + + MUST_MATCH_TOKEN(TOK_LP, JSMSG_PAREN_AFTER_FOR); + + // FIXME: Destructuring binding (bug 980828). + + MUST_MATCH_TOKEN(TOK_NAME, JSMSG_NO_VARIABLE_NAME); + RootedPropertyName name(context, tokenStream.currentName()); + if (name == context->names().let) { + report(ParseError, false, null(), JSMSG_LET_COMP_BINDING); + return null(); + } + TokenPos namePos = pos(); + Node lhs = newName(name); + if (!lhs) + return null(); + bool matched; + if (!tokenStream.matchContextualKeyword(&matched, context->names().of)) + return null(); + if (!matched) { + report(ParseError, false, null(), JSMSG_OF_AFTER_FOR_NAME); + return null(); + } + + Node rhs = assignExpr(InAllowed, YieldIsKeyword, TripledotProhibited); + if (!rhs) + return null(); + + MUST_MATCH_TOKEN(TOK_RP, JSMSG_PAREN_AFTER_FOR_OF_ITERABLE); + + TokenPos headPos(begin, pos().end); + + ParseContext::Scope scope(this); + if (!scope.init(pc)) + return null(); + + { + // Push a temporary ForLoopLexicalHead Statement that allows for + // lexical declarations, as they are usually allowed only in braced + // statements. + ParseContext::Statement forHeadStmt(pc, StatementKind::ForLoopLexicalHead); + if (!noteDeclaredName(name, DeclarationKind::Let, namePos)) + return null(); + } + + Node decls = handler.newComprehensionBinding(lhs); + if (!decls) + return null(); + + Node tail = comprehensionTail(comprehensionKind); + if (!tail) + return null(); + + // Finish the lexical scope after parsing the tail. + Node lexicalScope = finishLexicalScope(scope, decls); + if (!lexicalScope) + return null(); + + Node head = handler.newForInOrOfHead(PNK_FOROF, lexicalScope, rhs, headPos); + if (!head) + return null(); + + return handler.newComprehensionFor(begin, head, tail); +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::comprehensionIf(GeneratorKind comprehensionKind) +{ + MOZ_ASSERT(tokenStream.isCurrentTokenType(TOK_IF)); + + uint32_t begin = pos().begin; + + MUST_MATCH_TOKEN(TOK_LP, JSMSG_PAREN_BEFORE_COND); + Node cond = assignExpr(InAllowed, YieldIsKeyword, TripledotProhibited); + if (!cond) + return null(); + MUST_MATCH_TOKEN(TOK_RP, JSMSG_PAREN_AFTER_COND); + + /* Check for (a = b) and warn about possible (a == b) mistype. */ + if (handler.isUnparenthesizedAssignment(cond)) { + if (!report(ParseExtraWarning, false, null(), JSMSG_EQUAL_AS_ASSIGN)) + return null(); + } + + Node then = comprehensionTail(comprehensionKind); + if (!then) + return null(); + + return handler.newIfStatement(begin, cond, then, null()); +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::comprehensionTail(GeneratorKind comprehensionKind) +{ + JS_CHECK_RECURSION(context, return null()); + + bool matched; + if (!tokenStream.matchToken(&matched, TOK_FOR, TokenStream::Operand)) + return null(); + if (matched) + return comprehensionFor(comprehensionKind); + + if (!tokenStream.matchToken(&matched, TOK_IF, TokenStream::Operand)) + return null(); + if (matched) + return comprehensionIf(comprehensionKind); + + uint32_t begin = pos().begin; + + Node bodyExpr = assignExpr(InAllowed, YieldIsKeyword, TripledotProhibited); + if (!bodyExpr) + return null(); + + if (comprehensionKind == NotGenerator) + return handler.newArrayPush(begin, bodyExpr); + + MOZ_ASSERT(comprehensionKind == StarGenerator); + Node yieldExpr = newYieldExpression(begin, bodyExpr); + if (!yieldExpr) + return null(); + yieldExpr = handler.parenthesize(yieldExpr); + + return handler.newExprStatement(yieldExpr, pos().end); +} + +// Parse an ES6-era generator or array comprehension, starting at the first +// `for`. The caller is responsible for matching the ending TOK_RP or TOK_RB. +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::comprehension(GeneratorKind comprehensionKind) +{ + MOZ_ASSERT(tokenStream.isCurrentTokenType(TOK_FOR)); + + uint32_t startYieldOffset = pc->lastYieldOffset; + + Node body = comprehensionFor(comprehensionKind); + if (!body) + return null(); + + if (comprehensionKind != NotGenerator && pc->lastYieldOffset != startYieldOffset) { + reportWithOffset(ParseError, false, pc->lastYieldOffset, + JSMSG_BAD_GENEXP_BODY, js_yield_str); + return null(); + } + + return body; +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::arrayComprehension(uint32_t begin) +{ + Node inner = comprehension(NotGenerator); + if (!inner) + return null(); + + MUST_MATCH_TOKEN(TOK_RB, JSMSG_BRACKET_AFTER_ARRAY_COMPREHENSION); + + Node comp = handler.newList(PNK_ARRAYCOMP, inner); + if (!comp) + return null(); + + handler.setBeginPosition(comp, begin); + handler.setEndPosition(comp, pos().end); + + return comp; +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::generatorComprehension(uint32_t begin) +{ + MOZ_ASSERT(tokenStream.isCurrentTokenType(TOK_FOR)); + + // We have no problem parsing generator comprehensions inside lazy + // functions, but the bytecode emitter currently can't handle them that way, + // because when it goes to emit the code for the inner generator function, + // it expects outer functions to have non-lazy scripts. + if (!abortIfSyntaxParser()) + return null(); + + Node genfn = generatorComprehensionLambda(begin); + if (!genfn) + return null(); + + Node result = handler.newList(PNK_GENEXP, genfn, JSOP_CALL); + if (!result) + return null(); + handler.setBeginPosition(result, begin); + handler.setEndPosition(result, pos().end); + + return result; +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::assignExprWithoutYieldOrAwait(YieldHandling yieldHandling) +{ + uint32_t startYieldOffset = pc->lastYieldOffset; + uint32_t startAwaitOffset = pc->lastAwaitOffset; + Node res = assignExpr(InAllowed, yieldHandling, TripledotProhibited); + if (res) { + if (pc->lastYieldOffset != startYieldOffset) { + reportWithOffset(ParseError, false, pc->lastYieldOffset, JSMSG_YIELD_IN_DEFAULT); + return null(); + } + if (pc->lastAwaitOffset != startAwaitOffset) { + reportWithOffset(ParseError, false, pc->lastAwaitOffset, JSMSG_AWAIT_IN_DEFAULT); + return null(); + } + } + return res; +} + +template <typename ParseHandler> +bool +Parser<ParseHandler>::argumentList(YieldHandling yieldHandling, Node listNode, bool* isSpread, + PossibleError* possibleError /* = nullptr */) +{ + bool matched; + if (!tokenStream.matchToken(&matched, TOK_RP, TokenStream::Operand)) + return false; + if (matched) { + handler.setEndPosition(listNode, pos().end); + return true; + } + + while (true) { + bool spread = false; + uint32_t begin = 0; + if (!tokenStream.matchToken(&matched, TOK_TRIPLEDOT, TokenStream::Operand)) + return false; + if (matched) { + spread = true; + begin = pos().begin; + *isSpread = true; + } + + Node argNode = assignExpr(InAllowed, yieldHandling, TripledotProhibited, possibleError); + if (!argNode) + return false; + if (spread) { + argNode = handler.newSpread(begin, argNode); + if (!argNode) + return false; + } + + handler.addList(listNode, argNode); + + bool matched; + if (!tokenStream.matchToken(&matched, TOK_COMMA)) + return false; + if (!matched) + break; + + TokenKind tt; + if (!tokenStream.peekToken(&tt, TokenStream::Operand)) + return null(); + if (tt == TOK_RP) { + tokenStream.addModifierException(TokenStream::NoneIsOperand); + break; + } + } + + TokenKind tt; + if (!tokenStream.getToken(&tt)) + return false; + if (tt != TOK_RP) { + report(ParseError, false, null(), JSMSG_PAREN_AFTER_ARGS); + return false; + } + handler.setEndPosition(listNode, pos().end); + return true; +} + +template <typename ParseHandler> +bool +Parser<ParseHandler>::checkAndMarkSuperScope() +{ + if (!pc->sc()->allowSuperProperty()) + return false; + pc->setSuperScopeNeedsHomeObject(); + return true; +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::memberExpr(YieldHandling yieldHandling, TripledotHandling tripledotHandling, + TokenKind tt, bool allowCallSyntax /* = true */, + PossibleError* possibleError /* = nullptr */, + InvokedPrediction invoked /* = PredictUninvoked */) +{ + MOZ_ASSERT(tokenStream.isCurrentTokenType(tt)); + + Node lhs; + + JS_CHECK_RECURSION(context, return null()); + + /* Check for new expression first. */ + if (tt == TOK_NEW) { + uint32_t newBegin = pos().begin; + // Make sure this wasn't a |new.target| in disguise. + Node newTarget; + if (!tryNewTarget(newTarget)) + return null(); + if (newTarget) { + lhs = newTarget; + } else { + lhs = handler.newList(PNK_NEW, newBegin, JSOP_NEW); + if (!lhs) + return null(); + + // Gotten by tryNewTarget + tt = tokenStream.currentToken().type; + Node ctorExpr = memberExpr(yieldHandling, TripledotProhibited, tt, + /* allowCallSyntax = */ false, + /* possibleError = */ nullptr, PredictInvoked); + if (!ctorExpr) + return null(); + + handler.addList(lhs, ctorExpr); + + bool matched; + if (!tokenStream.matchToken(&matched, TOK_LP)) + return null(); + if (matched) { + bool isSpread = false; + if (!argumentList(yieldHandling, lhs, &isSpread)) + return null(); + if (isSpread) + handler.setOp(lhs, JSOP_SPREADNEW); + } + } + } else if (tt == TOK_SUPER) { + Node thisName = newThisName(); + if (!thisName) + return null(); + lhs = handler.newSuperBase(thisName, pos()); + if (!lhs) + return null(); + } else { + lhs = primaryExpr(yieldHandling, tripledotHandling, tt, possibleError, invoked); + if (!lhs) + return null(); + } + + MOZ_ASSERT_IF(handler.isSuperBase(lhs), tokenStream.isCurrentTokenType(TOK_SUPER)); + + while (true) { + if (!tokenStream.getToken(&tt)) + return null(); + if (tt == TOK_EOF) + break; + + Node nextMember; + if (tt == TOK_DOT) { + if (!tokenStream.getToken(&tt, TokenStream::KeywordIsName)) + return null(); + if (tt == TOK_NAME) { + PropertyName* field = tokenStream.currentName(); + if (handler.isSuperBase(lhs) && !checkAndMarkSuperScope()) { + report(ParseError, false, null(), JSMSG_BAD_SUPERPROP, "property"); + return null(); + } + nextMember = handler.newPropertyAccess(lhs, field, pos().end); + if (!nextMember) + return null(); + } else { + report(ParseError, false, null(), JSMSG_NAME_AFTER_DOT); + return null(); + } + } else if (tt == TOK_LB) { + Node propExpr = expr(InAllowed, yieldHandling, TripledotProhibited); + if (!propExpr) + return null(); + + MUST_MATCH_TOKEN(TOK_RB, JSMSG_BRACKET_IN_INDEX); + + if (handler.isSuperBase(lhs) && !checkAndMarkSuperScope()) { + report(ParseError, false, null(), JSMSG_BAD_SUPERPROP, "member"); + return null(); + } + nextMember = handler.newPropertyByValue(lhs, propExpr, pos().end); + if (!nextMember) + return null(); + } else if ((allowCallSyntax && tt == TOK_LP) || + tt == TOK_TEMPLATE_HEAD || + tt == TOK_NO_SUBS_TEMPLATE) + { + if (handler.isSuperBase(lhs)) { + if (!pc->sc()->allowSuperCall()) { + report(ParseError, false, null(), JSMSG_BAD_SUPERCALL); + return null(); + } + + if (tt != TOK_LP) { + report(ParseError, false, null(), JSMSG_BAD_SUPER); + return null(); + } + + nextMember = handler.newList(PNK_SUPERCALL, lhs, JSOP_SUPERCALL); + if (!nextMember) + return null(); + + // Despite the fact that it's impossible to have |super()| in a + // generator, we still inherit the yieldHandling of the + // memberExpression, per spec. Curious. + bool isSpread = false; + if (!argumentList(yieldHandling, nextMember, &isSpread)) + return null(); + + if (isSpread) + handler.setOp(nextMember, JSOP_SPREADSUPERCALL); + + Node thisName = newThisName(); + if (!thisName) + return null(); + + nextMember = handler.newSetThis(thisName, nextMember); + if (!nextMember) + return null(); + } else { + if (options().selfHostingMode && handler.isPropertyAccess(lhs)) { + report(ParseError, false, null(), JSMSG_SELFHOSTED_METHOD_CALL); + return null(); + } + + nextMember = tt == TOK_LP ? handler.newCall() : handler.newTaggedTemplate(); + if (!nextMember) + return null(); + + JSOp op = JSOP_CALL; + bool maybeAsyncArrow = false; + if (tt == TOK_LP && handler.isNameAnyParentheses(lhs)) { + if (handler.nameIsEvalAnyParentheses(lhs, context)) { + // Select the right EVAL op and flag pc as having a + // direct eval. + op = pc->sc()->strict() ? JSOP_STRICTEVAL : JSOP_EVAL; + pc->sc()->setBindingsAccessedDynamically(); + pc->sc()->setHasDirectEval(); + + // In non-strict mode code, direct calls to eval can + // add variables to the call object. + if (pc->isFunctionBox() && !pc->sc()->strict()) + pc->functionBox()->setHasExtensibleScope(); + + // If we're in a method, mark the method as requiring + // support for 'super', since direct eval code can use + // it. (If we're not in a method, that's fine, so + // ignore the return value.) + checkAndMarkSuperScope(); + } else if (handler.nameIsUnparenthesizedAsync(lhs, context)) { + // |async (| can be the start of an async arrow + // function, so we need to defer reporting possible + // errors from destructuring syntax. To give better + // error messages, we only allow the AsyncArrowHead + // part of the CoverCallExpressionAndAsyncArrowHead + // syntax when the initial name is "async". + maybeAsyncArrow = true; + } + } else if (PropertyName* prop = handler.maybeDottedProperty(lhs)) { + // Use the JSOP_FUN{APPLY,CALL} optimizations given the + // right syntax. + if (prop == context->names().apply) { + op = JSOP_FUNAPPLY; + if (pc->isFunctionBox()) + pc->functionBox()->usesApply = true; + } else if (prop == context->names().call) { + op = JSOP_FUNCALL; + } + } + + handler.setBeginPosition(nextMember, lhs); + handler.addList(nextMember, lhs); + + if (tt == TOK_LP) { + bool isSpread = false; + PossibleError* asyncPossibleError = maybeAsyncArrow ? possibleError : nullptr; + if (!argumentList(yieldHandling, nextMember, &isSpread, asyncPossibleError)) + return null(); + if (isSpread) { + if (op == JSOP_EVAL) + op = JSOP_SPREADEVAL; + else if (op == JSOP_STRICTEVAL) + op = JSOP_STRICTSPREADEVAL; + else + op = JSOP_SPREADCALL; + } + } else { + if (!taggedTemplate(yieldHandling, nextMember, tt)) + return null(); + } + handler.setOp(nextMember, op); + } + } else { + tokenStream.ungetToken(); + if (handler.isSuperBase(lhs)) + break; + return lhs; + } + + lhs = nextMember; + } + + if (handler.isSuperBase(lhs)) { + report(ParseError, false, null(), JSMSG_BAD_SUPER); + return null(); + } + + return lhs; +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::newName(PropertyName* name) +{ + return newName(name, pos()); +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::newName(PropertyName* name, TokenPos pos) +{ + return handler.newName(name, pos, context); +} + +template <typename ParseHandler> +PropertyName* +Parser<ParseHandler>::labelOrIdentifierReference(YieldHandling yieldHandling, + bool yieldTokenizedAsName) +{ + PropertyName* ident; + bool isYield; + const Token& tok = tokenStream.currentToken(); + if (tok.type == TOK_NAME) { + MOZ_ASSERT(tok.name() != context->names().yield || + tok.nameContainsEscape() || + yieldTokenizedAsName, + "tokenizer should have treated unescaped 'yield' as TOK_YIELD"); + MOZ_ASSERT_IF(yieldTokenizedAsName, tok.name() == context->names().yield); + + ident = tok.name(); + isYield = ident == context->names().yield; + } else { + MOZ_ASSERT(tok.type == TOK_YIELD && !yieldTokenizedAsName); + + ident = context->names().yield; + isYield = true; + } + + if (!isYield) { + if (pc->sc()->strict()) { + const char* badName = ident == context->names().let + ? "let" + : ident == context->names().static_ + ? "static" + : nullptr; + if (badName) { + report(ParseError, false, null(), JSMSG_RESERVED_ID, badName); + return nullptr; + } + } + } else { + if (yieldHandling == YieldIsKeyword || + pc->sc()->strict() || + versionNumber() >= JSVERSION_1_7) + { + report(ParseError, false, null(), JSMSG_RESERVED_ID, "yield"); + return nullptr; + } + } + + return ident; +} + +template <typename ParseHandler> +PropertyName* +Parser<ParseHandler>::bindingIdentifier(YieldHandling yieldHandling) +{ + PropertyName* ident; + bool isYield; + const Token& tok = tokenStream.currentToken(); + if (tok.type == TOK_NAME) { + MOZ_ASSERT(tok.name() != context->names().yield || tok.nameContainsEscape(), + "tokenizer should have treated unescaped 'yield' as TOK_YIELD"); + + ident = tok.name(); + isYield = ident == context->names().yield; + } else { + MOZ_ASSERT(tok.type == TOK_YIELD); + + ident = context->names().yield; + isYield = true; + } + + if (!isYield) { + if (pc->sc()->strict()) { + const char* badName = ident == context->names().arguments + ? "arguments" + : ident == context->names().eval + ? "eval" + : nullptr; + if (badName) { + report(ParseError, false, null(), JSMSG_BAD_STRICT_ASSIGN, badName); + return nullptr; + } + + badName = ident == context->names().let + ? "let" + : ident == context->names().static_ + ? "static" + : nullptr; + if (badName) { + report(ParseError, false, null(), JSMSG_RESERVED_ID, badName); + return nullptr; + } + } + } else { + if (yieldHandling == YieldIsKeyword || + pc->sc()->strict() || + versionNumber() >= JSVERSION_1_7) + { + report(ParseError, false, null(), JSMSG_RESERVED_ID, "yield"); + return nullptr; + } + } + + return ident; +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::identifierReference(Handle<PropertyName*> name) +{ + Node pn = newName(name); + if (!pn) + return null(); + + if (!pc->inDestructuringDecl && !noteUsedName(name)) + return null(); + + return pn; +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::stringLiteral() +{ + return handler.newStringLiteral(stopStringCompression(), pos()); +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::noSubstitutionTemplate() +{ + return handler.newTemplateStringLiteral(stopStringCompression(), pos()); +} + +template <typename ParseHandler> +JSAtom * Parser<ParseHandler>::stopStringCompression() { + JSAtom* atom = tokenStream.currentToken().atom(); + + // Large strings are fast to parse but slow to compress. Stop compression on + // them, so we don't wait for a long time for compression to finish at the + // end of compilation. + const size_t HUGE_STRING = 50000; + if (sct && sct->active() && atom->length() >= HUGE_STRING) + sct->abort(); + return atom; +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::newRegExp() +{ + MOZ_ASSERT(!options().selfHostingMode); + // Create the regexp even when doing a syntax parse, to check the regexp's syntax. + const char16_t* chars = tokenStream.getTokenbuf().begin(); + size_t length = tokenStream.getTokenbuf().length(); + RegExpFlag flags = tokenStream.currentToken().regExpFlags(); + + Rooted<RegExpObject*> reobj(context); + reobj = RegExpObject::create(context, chars, length, flags, &tokenStream, alloc); + if (!reobj) + return null(); + + return handler.newRegExp(reobj, pos(), *this); +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::arrayInitializer(YieldHandling yieldHandling, PossibleError* possibleError) +{ + MOZ_ASSERT(tokenStream.isCurrentTokenType(TOK_LB)); + + uint32_t begin = pos().begin; + Node literal = handler.newArrayLiteral(begin); + if (!literal) + return null(); + + TokenKind tt; + if (!tokenStream.getToken(&tt, TokenStream::Operand)) + return null(); + + // Handle an ES6-era array comprehension first. + if (tt == TOK_FOR) + return arrayComprehension(begin); + + if (tt == TOK_RB) { + /* + * Mark empty arrays as non-constant, since we cannot easily + * determine their type. + */ + handler.setListFlag(literal, PNX_NONCONST); + } else { + tokenStream.ungetToken(); + + uint32_t index = 0; + TokenStream::Modifier modifier = TokenStream::Operand; + for (; ; index++) { + if (index >= NativeObject::MAX_DENSE_ELEMENTS_COUNT) { + report(ParseError, false, null(), JSMSG_ARRAY_INIT_TOO_BIG); + return null(); + } + + TokenKind tt; + if (!tokenStream.peekToken(&tt, TokenStream::Operand)) + return null(); + if (tt == TOK_RB) + break; + + if (tt == TOK_COMMA) { + tokenStream.consumeKnownToken(TOK_COMMA, TokenStream::Operand); + if (!handler.addElision(literal, pos())) + return null(); + } else if (tt == TOK_TRIPLEDOT) { + tokenStream.consumeKnownToken(TOK_TRIPLEDOT, TokenStream::Operand); + uint32_t begin = pos().begin; + Node inner = assignExpr(InAllowed, yieldHandling, TripledotProhibited, + possibleError); + if (!inner) + return null(); + if (!handler.addSpreadElement(literal, begin, inner)) + return null(); + } else { + Node element = assignExpr(InAllowed, yieldHandling, TripledotProhibited, + possibleError); + if (!element) + return null(); + if (foldConstants && !FoldConstants(context, &element, this)) + return null(); + handler.addArrayElement(literal, element); + } + + if (tt != TOK_COMMA) { + /* If we didn't already match TOK_COMMA in above case. */ + bool matched; + if (!tokenStream.matchToken(&matched, TOK_COMMA)) + return null(); + if (!matched) { + modifier = TokenStream::None; + break; + } + if (tt == TOK_TRIPLEDOT && possibleError) + possibleError->setPendingDestructuringError(null(), JSMSG_REST_WITH_COMMA); + } + } + + MUST_MATCH_TOKEN_MOD(TOK_RB, modifier, JSMSG_BRACKET_AFTER_LIST); + } + handler.setEndPosition(literal, pos().end); + return literal; +} + +static JSAtom* +DoubleToAtom(ExclusiveContext* cx, double value) +{ + // This is safe because doubles can not be moved. + Value tmp = DoubleValue(value); + return ToAtom<CanGC>(cx, HandleValue::fromMarkedLocation(&tmp)); +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::propertyName(YieldHandling yieldHandling, Node propList, + PropertyType* propType, MutableHandleAtom propAtom) +{ + TokenKind ltok; + if (!tokenStream.getToken(<ok, TokenStream::KeywordIsName)) + return null(); + + MOZ_ASSERT(ltok != TOK_RC, "caller should have handled TOK_RC"); + + bool isGenerator = false; + bool isAsync = false; + if (ltok == TOK_MUL) { + isGenerator = true; + if (!tokenStream.getToken(<ok, TokenStream::KeywordIsName)) + return null(); + } + + if (ltok == TOK_NAME && tokenStream.currentName() == context->names().async) { + // AsyncMethod[Yield, Await]: + // async [no LineTerminator here] PropertyName[?Yield, ?Await] ... + // + // PropertyName: + // LiteralPropertyName + // ComputedPropertyName[?Yield, ?Await] + // + // LiteralPropertyName: + // IdentifierName + // StringLiteral + // NumericLiteral + // + // ComputedPropertyName[Yield, Await]: + // [ ... + TokenKind tt = TOK_EOF; + if (!tokenStream.peekTokenSameLine(&tt, TokenStream::KeywordIsName)) + return null(); + if (tt == TOK_STRING || tt == TOK_NUMBER || tt == TOK_LB || + tt == TOK_NAME || tt == TOK_YIELD) + { + isAsync = true; + tokenStream.consumeKnownToken(tt, TokenStream::KeywordIsName); + ltok = tt; + } else { + tokenStream.addModifierException(TokenStream::NoneIsKeywordIsName); + } + } + + if (isAsync && isGenerator) { + report(ParseError, false, null(), JSMSG_ASYNC_GENERATOR); + return null(); + } + + propAtom.set(nullptr); + Node propName; + switch (ltok) { + case TOK_NUMBER: + propAtom.set(DoubleToAtom(context, tokenStream.currentToken().number())); + if (!propAtom.get()) + return null(); + propName = newNumber(tokenStream.currentToken()); + if (!propName) + return null(); + break; + + case TOK_LB: + propName = computedPropertyName(yieldHandling, propList); + if (!propName) + return null(); + break; + + case TOK_NAME: { + propAtom.set(tokenStream.currentName()); + // Do not look for accessor syntax on generators + if (isGenerator || isAsync || + !(propAtom.get() == context->names().get || + propAtom.get() == context->names().set)) + { + propName = handler.newObjectLiteralPropertyName(propAtom, pos()); + if (!propName) + return null(); + break; + } + + *propType = propAtom.get() == context->names().get ? PropertyType::Getter + : PropertyType::Setter; + + // We have parsed |get| or |set|. Look for an accessor property + // name next. + TokenKind tt; + if (!tokenStream.peekToken(&tt, TokenStream::KeywordIsName)) + return null(); + if (tt == TOK_NAME) { + if (!checkUnescapedName()) + return null(); + + tokenStream.consumeKnownToken(TOK_NAME, TokenStream::KeywordIsName); + + propAtom.set(tokenStream.currentName()); + return handler.newObjectLiteralPropertyName(propAtom, pos()); + } + if (tt == TOK_STRING) { + if (!checkUnescapedName()) + return null(); + + tokenStream.consumeKnownToken(TOK_STRING, TokenStream::KeywordIsName); + + propAtom.set(tokenStream.currentToken().atom()); + + uint32_t index; + if (propAtom->isIndex(&index)) { + propAtom.set(DoubleToAtom(context, index)); + if (!propAtom.get()) + return null(); + return handler.newNumber(index, NoDecimal, pos()); + } + return stringLiteral(); + } + if (tt == TOK_NUMBER) { + if (!checkUnescapedName()) + return null(); + + tokenStream.consumeKnownToken(TOK_NUMBER, TokenStream::KeywordIsName); + + propAtom.set(DoubleToAtom(context, tokenStream.currentToken().number())); + if (!propAtom.get()) + return null(); + return newNumber(tokenStream.currentToken()); + } + if (tt == TOK_LB) { + if (!checkUnescapedName()) + return null(); + + tokenStream.consumeKnownToken(TOK_LB, TokenStream::KeywordIsName); + + return computedPropertyName(yieldHandling, propList); + } + + // Not an accessor property after all. + propName = handler.newObjectLiteralPropertyName(propAtom.get(), pos()); + if (!propName) + return null(); + tokenStream.addModifierException(TokenStream::NoneIsKeywordIsName); + break; + } + + case TOK_STRING: { + propAtom.set(tokenStream.currentToken().atom()); + uint32_t index; + if (propAtom->isIndex(&index)) { + propName = handler.newNumber(index, NoDecimal, pos()); + if (!propName) + return null(); + break; + } + propName = stringLiteral(); + if (!propName) + return null(); + break; + } + + default: + report(ParseError, false, null(), JSMSG_BAD_PROP_ID); + return null(); + } + + TokenKind tt; + if (!tokenStream.getToken(&tt)) + return null(); + + if (tt == TOK_COLON) { + if (isGenerator) { + report(ParseError, false, null(), JSMSG_BAD_PROP_ID); + return null(); + } + *propType = PropertyType::Normal; + return propName; + } + + if (ltok == TOK_NAME && (tt == TOK_COMMA || tt == TOK_RC || tt == TOK_ASSIGN)) { + if (isGenerator) { + report(ParseError, false, null(), JSMSG_BAD_PROP_ID); + return null(); + } + tokenStream.ungetToken(); + *propType = tt == TOK_ASSIGN ? + PropertyType::CoverInitializedName : + PropertyType::Shorthand; + return propName; + } + + if (tt == TOK_LP) { + tokenStream.ungetToken(); + if (isGenerator) + *propType = PropertyType::GeneratorMethod; + else if (isAsync) + *propType = PropertyType::AsyncMethod; + else + *propType = PropertyType::Method; + return propName; + } + + report(ParseError, false, null(), JSMSG_COLON_AFTER_ID); + return null(); +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::computedPropertyName(YieldHandling yieldHandling, Node literal) +{ + uint32_t begin = pos().begin; + + Node assignNode; + { + // Turn off the inDestructuringDecl flag when parsing computed property + // names. In short, when parsing 'let {[x + y]: z} = obj;', noteUsedName() + // should be called on x and y, but not on z. See the comment on + // Parser<>::checkDestructuringPattern() for details. + AutoClearInDestructuringDecl autoClear(pc); + assignNode = assignExpr(InAllowed, yieldHandling, TripledotProhibited); + if (!assignNode) + return null(); + } + + MUST_MATCH_TOKEN(TOK_RB, JSMSG_COMP_PROP_UNTERM_EXPR); + Node propname = handler.newComputedName(assignNode, begin, pos().end); + if (!propname) + return null(); + handler.setListFlag(literal, PNX_NONCONST); + return propname; +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::objectLiteral(YieldHandling yieldHandling, PossibleError* possibleError) +{ + MOZ_ASSERT(tokenStream.isCurrentTokenType(TOK_LC)); + + Node literal = handler.newObjectLiteral(pos().begin); + if (!literal) + return null(); + + bool seenPrototypeMutation = false; + bool seenCoverInitializedName = false; + RootedAtom propAtom(context); + for (;;) { + TokenKind tt; + if (!tokenStream.getToken(&tt, TokenStream::KeywordIsName)) + return null(); + if (tt == TOK_RC) + break; + + tokenStream.ungetToken(); + + PropertyType propType; + Node propName = propertyName(yieldHandling, literal, &propType, &propAtom); + if (!propName) + return null(); + + if (propType == PropertyType::Normal) { + Node propExpr = assignExpr(InAllowed, yieldHandling, TripledotProhibited, + possibleError); + if (!propExpr) + return null(); + + if (foldConstants && !FoldConstants(context, &propExpr, this)) + return null(); + + if (propAtom == context->names().proto) { + if (seenPrototypeMutation) { + // Directly report the error when we're not in a + // destructuring context. + if (!possibleError) { + report(ParseError, false, propName, JSMSG_DUPLICATE_PROTO_PROPERTY); + return null(); + } + + // Otherwise delay error reporting until we've determined + // whether or not we're destructuring. + possibleError->setPendingExpressionError(propName, + JSMSG_DUPLICATE_PROTO_PROPERTY); + } + seenPrototypeMutation = true; + + // Note: this occurs *only* if we observe TOK_COLON! Only + // __proto__: v mutates [[Prototype]]. Getters, setters, + // method/generator definitions, computed property name + // versions of all of these, and shorthands do not. + uint32_t begin = handler.getPosition(propName).begin; + if (!handler.addPrototypeMutation(literal, begin, propExpr)) + return null(); + } else { + if (!handler.isConstant(propExpr)) + handler.setListFlag(literal, PNX_NONCONST); + + if (!handler.addPropertyDefinition(literal, propName, propExpr)) + return null(); + } + } else if (propType == PropertyType::Shorthand) { + /* + * Support, e.g., |var {x, y} = o| as destructuring shorthand + * for |var {x: x, y: y} = o|, and |var o = {x, y}| as initializer + * shorthand for |var o = {x: x, y: y}|. + */ + TokenKind propToken = TOK_NAME; + if (!tokenStream.checkForKeyword(propAtom, &propToken)) + return null(); + + if (propToken != TOK_NAME && propToken != TOK_YIELD) { + report(ParseError, false, null(), JSMSG_RESERVED_ID, TokenKindToDesc(propToken)); + return null(); + } + + Rooted<PropertyName*> name(context, + identifierReference(yieldHandling, propToken == TOK_YIELD)); + if (!name) + return null(); + + Node nameExpr = identifierReference(name); + if (!nameExpr) + return null(); + + if (!handler.addShorthand(literal, propName, nameExpr)) + return null(); + } else if (propType == PropertyType::CoverInitializedName) { + /* + * Support, e.g., |var {x=1, y=2} = o| as destructuring shorthand + * with default values, as per ES6 12.14.5 + */ + TokenKind propToken = TOK_NAME; + if (!tokenStream.checkForKeyword(propAtom, &propToken)) + return null(); + + if (propToken != TOK_NAME && propToken != TOK_YIELD) { + report(ParseError, false, null(), JSMSG_RESERVED_ID, TokenKindToDesc(propToken)); + return null(); + } + + Rooted<PropertyName*> name(context, + identifierReference(yieldHandling, propToken == TOK_YIELD)); + if (!name) + return null(); + + Node lhs = identifierReference(name); + if (!lhs) + return null(); + + tokenStream.consumeKnownToken(TOK_ASSIGN); + + if (!seenCoverInitializedName) { + // "shorthand default" or "CoverInitializedName" syntax is only + // valid in the case of destructuring. + seenCoverInitializedName = true; + + if (!possibleError) { + // Destructuring defaults are definitely not allowed in this object literal, + // because of something the caller knows about the preceding code. + // For example, maybe the preceding token is an operator: `x + {y=z}`. + report(ParseError, false, null(), JSMSG_COLON_AFTER_ID); + return null(); + } + + // Here we set a pending error so that later in the parse, once we've + // determined whether or not we're destructuring, the error can be + // reported or ignored appropriately. + possibleError->setPendingExpressionError(null(), JSMSG_COLON_AFTER_ID); + } + + Node rhs; + { + // Clearing `inDestructuringDecl` allows name use to be noted + // in Parser::identifierReference. See bug 1255167. + AutoClearInDestructuringDecl autoClear(pc); + rhs = assignExpr(InAllowed, yieldHandling, TripledotProhibited); + if (!rhs) + return null(); + } + + Node propExpr = handler.newAssignment(PNK_ASSIGN, lhs, rhs, JSOP_NOP); + if (!propExpr) + return null(); + + if (!handler.addPropertyDefinition(literal, propName, propExpr)) + return null(); + + if (!abortIfSyntaxParser()) + return null(); + } else { + // FIXME: Implement ES6 function "name" property semantics + // (bug 883377). + RootedAtom funName(context); + if (!tokenStream.isCurrentTokenType(TOK_RB)) { + funName = propAtom; + + if (propType == PropertyType::Getter || propType == PropertyType::Setter) { + funName = prefixAccessorName(propType, propAtom); + if (!funName) + return null(); + } + } + + Node fn = methodDefinition(propType, funName); + if (!fn) + return null(); + + JSOp op = JSOpFromPropertyType(propType); + if (!handler.addObjectMethodDefinition(literal, propName, fn, op)) + return null(); + } + + if (!tokenStream.getToken(&tt)) + return null(); + if (tt == TOK_RC) + break; + if (tt != TOK_COMMA) { + report(ParseError, false, null(), JSMSG_CURLY_AFTER_LIST); + return null(); + } + } + + handler.setEndPosition(literal, pos().end); + return literal; +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::methodDefinition(PropertyType propType, HandleAtom funName) +{ + FunctionSyntaxKind kind = FunctionSyntaxKindFromPropertyType(propType); + GeneratorKind generatorKind = GeneratorKindFromPropertyType(propType); + FunctionAsyncKind asyncKind = AsyncKindFromPropertyType(propType); + YieldHandling yieldHandling = GetYieldHandling(generatorKind, asyncKind); + return functionDefinition(InAllowed, yieldHandling, funName, kind, generatorKind, asyncKind); +} + +template <typename ParseHandler> +bool +Parser<ParseHandler>::tryNewTarget(Node &newTarget) +{ + MOZ_ASSERT(tokenStream.isCurrentTokenType(TOK_NEW)); + + newTarget = null(); + + Node newHolder = handler.newPosHolder(pos()); + if (!newHolder) + return false; + + uint32_t begin = pos().begin; + + // |new| expects to look for an operand, so we will honor that. + TokenKind next; + if (!tokenStream.getToken(&next, TokenStream::Operand)) + return false; + + // Don't unget the token, since lookahead cannot handle someone calling + // getToken() with a different modifier. Callers should inspect currentToken(). + if (next != TOK_DOT) + return true; + + if (!tokenStream.getToken(&next)) + return false; + if (next != TOK_NAME || tokenStream.currentName() != context->names().target) { + report(ParseError, false, null(), JSMSG_UNEXPECTED_TOKEN, + "target", TokenKindToDesc(next)); + return false; + } + + if (!checkUnescapedName()) + return false; + + if (!pc->sc()->allowNewTarget()) { + reportWithOffset(ParseError, false, begin, JSMSG_BAD_NEWTARGET); + return false; + } + + Node targetHolder = handler.newPosHolder(pos()); + if (!targetHolder) + return false; + + newTarget = handler.newNewTarget(newHolder, targetHolder); + return !!newTarget; +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::primaryExpr(YieldHandling yieldHandling, TripledotHandling tripledotHandling, + TokenKind tt, PossibleError* possibleError, + InvokedPrediction invoked /* = PredictUninvoked */) +{ + MOZ_ASSERT(tokenStream.isCurrentTokenType(tt)); + JS_CHECK_RECURSION(context, return null()); + + switch (tt) { + case TOK_FUNCTION: + return functionExpr(invoked); + + case TOK_CLASS: + return classDefinition(yieldHandling, ClassExpression, NameRequired); + + case TOK_LB: + return arrayInitializer(yieldHandling, possibleError); + + case TOK_LC: + return objectLiteral(yieldHandling, possibleError); + + case TOK_LP: { + TokenKind next; + if (!tokenStream.peekToken(&next, TokenStream::Operand)) + return null(); + + if (next == TOK_RP) { + // Not valid expression syntax, but this is valid in an arrow function + // with no params: `() => body`. + tokenStream.consumeKnownToken(next, TokenStream::Operand); + + if (!tokenStream.peekToken(&next)) + return null(); + if (next != TOK_ARROW) { + report(ParseError, false, null(), JSMSG_UNEXPECTED_TOKEN, + "expression", TokenKindToDesc(TOK_RP)); + return null(); + } + + // Now just return something that will allow parsing to continue. + // It doesn't matter what; when we reach the =>, we will rewind and + // reparse the whole arrow function. See Parser::assignExpr. + return handler.newNullLiteral(pos()); + } + + if (next == TOK_FOR) { + uint32_t begin = pos().begin; + tokenStream.consumeKnownToken(next, TokenStream::Operand); + return generatorComprehension(begin); + } + + // Pass |possibleError| to support destructuring in arrow parameters. + Node expr = exprInParens(InAllowed, yieldHandling, TripledotAllowed, possibleError); + if (!expr) + return null(); + MUST_MATCH_TOKEN(TOK_RP, JSMSG_PAREN_IN_PAREN); + handler.setEndPosition(expr, pos().end); + return handler.parenthesize(expr); + } + + case TOK_TEMPLATE_HEAD: + return templateLiteral(yieldHandling); + + case TOK_NO_SUBS_TEMPLATE: + return noSubstitutionTemplate(); + + case TOK_STRING: + return stringLiteral(); + + case TOK_YIELD: + case TOK_NAME: { + if (tokenStream.currentName() == context->names().async) { + TokenKind nextSameLine = TOK_EOF; + if (!tokenStream.peekTokenSameLine(&nextSameLine)) + return null(); + + if (nextSameLine == TOK_FUNCTION) { + tokenStream.consumeKnownToken(TOK_FUNCTION); + return functionExpr(PredictUninvoked, AsyncFunction); + } + } + + Rooted<PropertyName*> name(context, identifierReference(yieldHandling)); + if (!name) + return null(); + + return identifierReference(name); + } + + case TOK_REGEXP: + return newRegExp(); + + case TOK_NUMBER: + return newNumber(tokenStream.currentToken()); + + case TOK_TRUE: + return handler.newBooleanLiteral(true, pos()); + case TOK_FALSE: + return handler.newBooleanLiteral(false, pos()); + case TOK_THIS: { + if (pc->isFunctionBox()) + pc->functionBox()->usesThis = true; + Node thisName = null(); + if (pc->sc()->thisBinding() == ThisBinding::Function) { + thisName = newThisName(); + if (!thisName) + return null(); + } + return handler.newThisLiteral(pos(), thisName); + } + case TOK_NULL: + return handler.newNullLiteral(pos()); + + case TOK_TRIPLEDOT: { + // This isn't valid expression syntax, but it's valid in an arrow + // function as a trailing rest param: `(a, b, ...rest) => body`. Check + // if it's directly under + // CoverParenthesizedExpressionAndArrowParameterList, and check for a + // name, closing parenthesis, and arrow, and allow it only if all are + // present. + if (tripledotHandling != TripledotAllowed) { + report(ParseError, false, null(), JSMSG_UNEXPECTED_TOKEN, + "expression", TokenKindToDesc(tt)); + return null(); + } + + TokenKind next; + if (!tokenStream.getToken(&next)) + return null(); + + if (next == TOK_LB || next == TOK_LC) { + // Validate, but don't store the pattern right now. The whole arrow + // function is reparsed in functionFormalParametersAndBody(). + if (!destructuringDeclaration(DeclarationKind::CoverArrowParameter, yieldHandling, + next)) + { + return null(); + } + } else { + // This doesn't check that the provided name is allowed, e.g. if + // the enclosing code is strict mode code, any of "let", "yield", + // or "arguments" should be prohibited. Argument-parsing code + // handles that. + if (next != TOK_NAME && next != TOK_YIELD) { + report(ParseError, false, null(), JSMSG_UNEXPECTED_TOKEN, + "rest argument name", TokenKindToDesc(next)); + return null(); + } + } + + if (!tokenStream.getToken(&next)) + return null(); + if (next != TOK_RP) { + report(ParseError, false, null(), JSMSG_UNEXPECTED_TOKEN, + "closing parenthesis", TokenKindToDesc(next)); + return null(); + } + + if (!tokenStream.peekToken(&next)) + return null(); + if (next != TOK_ARROW) { + // Advance the scanner for proper error location reporting. + tokenStream.consumeKnownToken(next); + report(ParseError, false, null(), JSMSG_UNEXPECTED_TOKEN, + "'=>' after argument list", TokenKindToDesc(next)); + return null(); + } + + tokenStream.ungetToken(); // put back right paren + + // Return an arbitrary expression node. See case TOK_RP above. + return handler.newNullLiteral(pos()); + } + + default: + report(ParseError, false, null(), JSMSG_UNEXPECTED_TOKEN, + "expression", TokenKindToDesc(tt)); + return null(); + } +} + +template <typename ParseHandler> +typename ParseHandler::Node +Parser<ParseHandler>::exprInParens(InHandling inHandling, YieldHandling yieldHandling, + TripledotHandling tripledotHandling, + PossibleError* possibleError /* = nullptr */) +{ + MOZ_ASSERT(tokenStream.isCurrentTokenType(TOK_LP)); + return expr(inHandling, yieldHandling, tripledotHandling, possibleError, PredictInvoked); +} + +template <typename ParseHandler> +void +Parser<ParseHandler>::addTelemetry(JSCompartment::DeprecatedLanguageExtension e) +{ + JSContext* cx = context->maybeJSContext(); + if (!cx) + return; + cx->compartment()->addTelemetry(getFilename(), e); +} + +template <typename ParseHandler> +bool +Parser<ParseHandler>::warnOnceAboutExprClosure() +{ +#ifndef RELEASE_OR_BETA + JSContext* cx = context->maybeJSContext(); + if (!cx) + return true; + + if (!cx->compartment()->warnedAboutExprClosure) { + if (!report(ParseWarning, false, null(), JSMSG_DEPRECATED_EXPR_CLOSURE)) + return false; + cx->compartment()->warnedAboutExprClosure = true; + } +#endif + return true; +} + +template <typename ParseHandler> +bool +Parser<ParseHandler>::warnOnceAboutForEach() +{ + JSContext* cx = context->maybeJSContext(); + if (!cx) + return true; + + if (!cx->compartment()->warnedAboutForEach) { + if (!report(ParseWarning, false, null(), JSMSG_DEPRECATED_FOR_EACH)) + return false; + cx->compartment()->warnedAboutForEach = true; + } + return true; +} + +template class Parser<FullParseHandler>; +template class Parser<SyntaxParseHandler>; + +} /* namespace frontend */ +} /* namespace js */ diff --git a/js/src/frontend/Parser.h b/js/src/frontend/Parser.h new file mode 100644 index 000000000..0ad4d56a0 --- /dev/null +++ b/js/src/frontend/Parser.h @@ -0,0 +1,1430 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- + * vim: set ts=8 sts=4 et sw=4 tw=99: + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/* JS parser. */ + +#ifndef frontend_Parser_h +#define frontend_Parser_h + +#include "mozilla/Array.h" +#include "mozilla/Maybe.h" + +#include "jspubtd.h" + +#include "frontend/BytecodeCompiler.h" +#include "frontend/FullParseHandler.h" +#include "frontend/NameAnalysisTypes.h" +#include "frontend/NameCollections.h" +#include "frontend/SharedContext.h" +#include "frontend/SyntaxParseHandler.h" + +namespace js { + +class ModuleObject; + +namespace frontend { + +/* + * The struct ParseContext stores information about the current parsing context, + * which is part of the parser state (see the field Parser::pc). The current + * parsing context is either the global context, or the function currently being + * parsed. When the parser encounters a function definition, it creates a new + * ParseContext, makes it the new current context. + */ +class ParseContext : public Nestable<ParseContext> +{ + public: + // The intra-function statement stack. + // + // Used for early error checking that depend on the nesting structure of + // statements, such as continue/break targets, labels, and unbraced + // lexical declarations. + class Statement : public Nestable<Statement> + { + StatementKind kind_; + + public: + using Nestable<Statement>::enclosing; + using Nestable<Statement>::findNearest; + + Statement(ParseContext* pc, StatementKind kind) + : Nestable<Statement>(&pc->innermostStatement_), + kind_(kind) + { } + + template <typename T> inline bool is() const; + template <typename T> inline T& as(); + + StatementKind kind() const { + return kind_; + } + + void refineForKind(StatementKind newForKind) { + MOZ_ASSERT(kind_ == StatementKind::ForLoop); + MOZ_ASSERT(newForKind == StatementKind::ForInLoop || + newForKind == StatementKind::ForOfLoop); + kind_ = newForKind; + } + }; + + class LabelStatement : public Statement + { + RootedAtom label_; + + public: + LabelStatement(ParseContext* pc, JSAtom* label) + : Statement(pc, StatementKind::Label), + label_(pc->sc_->context, label) + { } + + HandleAtom label() const { + return label_; + } + }; + + // The intra-function scope stack. + // + // Tracks declared and used names within a scope. + class Scope : public Nestable<Scope> + { + // Names declared in this scope. Corresponds to the union of + // VarDeclaredNames and LexicallyDeclaredNames in the ES spec. + // + // A 'var' declared name is a member of the declared name set of every + // scope in its scope contour. + // + // A lexically declared name is a member only of the declared name set of + // the scope in which it is declared. + PooledMapPtr<DeclaredNameMap> declared_; + + // Monotonically increasing id. + uint32_t id_; + + bool maybeReportOOM(ParseContext* pc, bool result) { + if (!result) + ReportOutOfMemory(pc->sc()->context); + return result; + } + + public: + using DeclaredNamePtr = DeclaredNameMap::Ptr; + using AddDeclaredNamePtr = DeclaredNameMap::AddPtr; + + using Nestable<Scope>::enclosing; + + template <typename ParseHandler> + explicit Scope(Parser<ParseHandler>* parser) + : Nestable<Scope>(&parser->pc->innermostScope_), + declared_(parser->context->frontendCollectionPool()), + id_(parser->usedNames.nextScopeId()) + { } + + void dump(ParseContext* pc); + + uint32_t id() const { + return id_; + } + + MOZ_MUST_USE bool init(ParseContext* pc) { + if (id_ == UINT32_MAX) { + pc->tokenStream_.reportError(JSMSG_NEED_DIET, js_script_str); + return false; + } + + return declared_.acquire(pc->sc()->context); + } + + DeclaredNamePtr lookupDeclaredName(JSAtom* name) { + return declared_->lookup(name); + } + + AddDeclaredNamePtr lookupDeclaredNameForAdd(JSAtom* name) { + return declared_->lookupForAdd(name); + } + + MOZ_MUST_USE bool addDeclaredName(ParseContext* pc, AddDeclaredNamePtr& p, JSAtom* name, + DeclarationKind kind) + { + return maybeReportOOM(pc, declared_->add(p, name, DeclaredNameInfo(kind))); + } + + // Remove all VarForAnnexBLexicalFunction declarations of a certain + // name from all scopes in pc's scope stack. + static void removeVarForAnnexBLexicalFunction(ParseContext* pc, JSAtom* name); + + // Add and remove catch parameter names. Used to implement the odd + // semantics of catch bodies. + bool addCatchParameters(ParseContext* pc, Scope& catchParamScope); + void removeCatchParameters(ParseContext* pc, Scope& catchParamScope); + + void useAsVarScope(ParseContext* pc) { + MOZ_ASSERT(!pc->varScope_); + pc->varScope_ = this; + } + + // An iterator for the set of names a scope binds: the set of all + // declared names for 'var' scopes, and the set of lexically declared + // names for non-'var' scopes. + class BindingIter + { + friend class Scope; + + DeclaredNameMap::Range declaredRange_; + mozilla::DebugOnly<uint32_t> count_; + bool isVarScope_; + + BindingIter(Scope& scope, bool isVarScope) + : declaredRange_(scope.declared_->all()), + count_(0), + isVarScope_(isVarScope) + { + settle(); + } + + void settle() { + // Both var and lexically declared names are binding in a var + // scope. + if (isVarScope_) + return; + + // Otherwise, pop only lexically declared names are + // binding. Pop the range until we find such a name. + while (!declaredRange_.empty()) { + if (BindingKindIsLexical(kind())) + break; + declaredRange_.popFront(); + } + } + + public: + bool done() const { + return declaredRange_.empty(); + } + + explicit operator bool() const { + return !done(); + } + + JSAtom* name() { + MOZ_ASSERT(!done()); + return declaredRange_.front().key(); + } + + DeclarationKind declarationKind() { + MOZ_ASSERT(!done()); + return declaredRange_.front().value()->kind(); + } + + BindingKind kind() { + return DeclarationKindToBindingKind(declarationKind()); + } + + bool closedOver() { + MOZ_ASSERT(!done()); + return declaredRange_.front().value()->closedOver(); + } + + void setClosedOver() { + MOZ_ASSERT(!done()); + return declaredRange_.front().value()->setClosedOver(); + } + + void operator++(int) { + MOZ_ASSERT(!done()); + MOZ_ASSERT(count_ != UINT32_MAX); + declaredRange_.popFront(); + settle(); + } + }; + + inline BindingIter bindings(ParseContext* pc); + }; + + class VarScope : public Scope + { + public: + template <typename ParseHandler> + explicit VarScope(Parser<ParseHandler>* parser) + : Scope(parser) + { + useAsVarScope(parser->pc); + } + }; + + private: + // Context shared between parsing and bytecode generation. + SharedContext* sc_; + + // TokenStream used for error reporting. + TokenStream& tokenStream_; + + // The innermost statement, i.e., top of the statement stack. + Statement* innermostStatement_; + + // The innermost scope, i.e., top of the scope stack. + // + // The outermost scope in the stack is usually varScope_. In the case of + // functions, the outermost scope is functionScope_, which may be + // varScope_. See comment above functionScope_. + Scope* innermostScope_; + + // If isFunctionBox() and the function is a named lambda, the DeclEnv + // scope for named lambdas. + mozilla::Maybe<Scope> namedLambdaScope_; + + // If isFunctionBox(), the scope for the function. If there are no + // parameter expressions, this is scope for the entire function. If there + // are parameter expressions, this holds the special function names + // ('.this', 'arguments') and the formal parameers. + mozilla::Maybe<Scope> functionScope_; + + // The body-level scope. This always exists, but not necessarily at the + // beginning of parsing the script in the case of functions with parameter + // expressions. + Scope* varScope_; + + // Inner function boxes in this context to try Annex B.3.3 semantics + // on. Only used when full parsing. + PooledVectorPtr<FunctionBoxVector> innerFunctionBoxesForAnnexB_; + + // Simple formal parameter names, in order of appearance. Only used when + // isFunctionBox(). + PooledVectorPtr<AtomVector> positionalFormalParameterNames_; + + // Closed over binding names, in order of appearance. Null-delimited + // between scopes. Only used when syntax parsing. + PooledVectorPtr<AtomVector> closedOverBindingsForLazy_; + + // Monotonically increasing id. + uint32_t scriptId_; + + // Set when compiling a function using Parser::standaloneFunctionBody via + // the Function or Generator constructor. + bool isStandaloneFunctionBody_; + + // Set when encountering a super.property inside a method. We need to mark + // the nearest super scope as needing a home object. + bool superScopeNeedsHomeObject_; + + public: + // lastYieldOffset stores the offset of the last yield that was parsed. + // NoYieldOffset is its initial value. + static const uint32_t NoYieldOffset = UINT32_MAX; + uint32_t lastYieldOffset; + + // lastAwaitOffset stores the offset of the last await that was parsed. + // NoAwaitOffset is its initial value. + static const uint32_t NoAwaitOffset = UINT32_MAX; + uint32_t lastAwaitOffset; + + // All inner functions in this context. Only used when syntax parsing. + Rooted<GCVector<JSFunction*, 8>> innerFunctionsForLazy; + + // In a function context, points to a Directive struct that can be updated + // to reflect new directives encountered in the Directive Prologue that + // require reparsing the function. In global/module/generator-tail contexts, + // we don't need to reparse when encountering a DirectivePrologue so this + // pointer may be nullptr. + Directives* newDirectives; + + // Set when parsing a declaration-like destructuring pattern. This flag + // causes PrimaryExpr to create PN_NAME parse nodes for variable references + // which are not hooked into any definition's use chain, added to any tree + // context's AtomList, etc. etc. checkDestructuring will do that work + // later. + // + // The comments atop checkDestructuring explain the distinction between + // assignment-like and declaration-like destructuring patterns, and why + // they need to be treated differently. + mozilla::Maybe<DeclarationKind> inDestructuringDecl; + + // Set when parsing a function and it has 'return <expr>;' + bool funHasReturnExpr; + + // Set when parsing a function and it has 'return;' + bool funHasReturnVoid; + + public: + template <typename ParseHandler> + ParseContext(Parser<ParseHandler>* prs, SharedContext* sc, Directives* newDirectives) + : Nestable<ParseContext>(&prs->pc), + sc_(sc), + tokenStream_(prs->tokenStream), + innermostStatement_(nullptr), + innermostScope_(nullptr), + varScope_(nullptr), + innerFunctionBoxesForAnnexB_(prs->context->frontendCollectionPool()), + positionalFormalParameterNames_(prs->context->frontendCollectionPool()), + closedOverBindingsForLazy_(prs->context->frontendCollectionPool()), + scriptId_(prs->usedNames.nextScriptId()), + isStandaloneFunctionBody_(false), + superScopeNeedsHomeObject_(false), + lastYieldOffset(NoYieldOffset), + lastAwaitOffset(NoAwaitOffset), + innerFunctionsForLazy(prs->context, GCVector<JSFunction*, 8>(prs->context)), + newDirectives(newDirectives), + funHasReturnExpr(false), + funHasReturnVoid(false) + { + if (isFunctionBox()) { + if (functionBox()->function()->isNamedLambda()) + namedLambdaScope_.emplace(prs); + functionScope_.emplace(prs); + } + } + + ~ParseContext(); + + MOZ_MUST_USE bool init(); + + SharedContext* sc() { + return sc_; + } + + bool isFunctionBox() const { + return sc_->isFunctionBox(); + } + + FunctionBox* functionBox() { + return sc_->asFunctionBox(); + } + + Statement* innermostStatement() { + return innermostStatement_; + } + + Scope* innermostScope() { + // There is always at least one scope: the 'var' scope. + MOZ_ASSERT(innermostScope_); + return innermostScope_; + } + + Scope& namedLambdaScope() { + MOZ_ASSERT(functionBox()->function()->isNamedLambda()); + return *namedLambdaScope_; + } + + Scope& functionScope() { + MOZ_ASSERT(isFunctionBox()); + return *functionScope_; + } + + Scope& varScope() { + MOZ_ASSERT(varScope_); + return *varScope_; + } + + bool isFunctionExtraBodyVarScopeInnermost() { + return isFunctionBox() && functionBox()->hasParameterExprs && + innermostScope() == varScope_; + } + + template <typename Predicate /* (Statement*) -> bool */> + Statement* findInnermostStatement(Predicate predicate) { + return Statement::findNearest(innermostStatement_, predicate); + } + + template <typename T, typename Predicate /* (Statement*) -> bool */> + T* findInnermostStatement(Predicate predicate) { + return Statement::findNearest<T>(innermostStatement_, predicate); + } + + AtomVector& positionalFormalParameterNames() { + return *positionalFormalParameterNames_; + } + + AtomVector& closedOverBindingsForLazy() { + return *closedOverBindingsForLazy_; + } + + MOZ_MUST_USE bool addInnerFunctionBoxForAnnexB(FunctionBox* funbox); + void removeInnerFunctionBoxesForAnnexB(JSAtom* name); + void finishInnerFunctionBoxesForAnnexB(); + + // True if we are at the topmost level of a entire script or function body. + // For example, while parsing this code we would encounter f1 and f2 at + // body level, but we would not encounter f3 or f4 at body level: + // + // function f1() { function f2() { } } + // if (cond) { function f3() { if (cond) { function f4() { } } } } + // + bool atBodyLevel() { + return !innermostStatement_; + } + + bool atGlobalLevel() { + return atBodyLevel() && sc_->isGlobalContext(); + } + + // True if we are at the topmost level of a module only. + bool atModuleLevel() { + return atBodyLevel() && sc_->isModuleContext(); + } + + void setIsStandaloneFunctionBody() { + isStandaloneFunctionBody_ = true; + } + + bool isStandaloneFunctionBody() const { + return isStandaloneFunctionBody_; + } + + void setSuperScopeNeedsHomeObject() { + MOZ_ASSERT(sc_->allowSuperProperty()); + superScopeNeedsHomeObject_ = true; + } + + bool superScopeNeedsHomeObject() const { + return superScopeNeedsHomeObject_; + } + + bool useAsmOrInsideUseAsm() const { + return sc_->isFunctionBox() && sc_->asFunctionBox()->useAsmOrInsideUseAsm(); + } + + // Most functions start off being parsed as non-generators. + // Non-generators transition to LegacyGenerator on parsing "yield" in JS 1.7. + // An ES6 generator is marked as a "star generator" before its body is parsed. + GeneratorKind generatorKind() const { + return sc_->isFunctionBox() ? sc_->asFunctionBox()->generatorKind() : NotGenerator; + } + + bool isGenerator() const { + return generatorKind() != NotGenerator; + } + + bool isLegacyGenerator() const { + return generatorKind() == LegacyGenerator; + } + + bool isStarGenerator() const { + return generatorKind() == StarGenerator; + } + + bool isAsync() const { + return sc_->isFunctionBox() && sc_->asFunctionBox()->isAsync(); + } + + FunctionAsyncKind asyncKind() const { + return isAsync() ? AsyncFunction : SyncFunction; + } + + bool isArrowFunction() const { + return sc_->isFunctionBox() && sc_->asFunctionBox()->function()->isArrow(); + } + + bool isMethod() const { + return sc_->isFunctionBox() && sc_->asFunctionBox()->function()->isMethod(); + } + + uint32_t scriptId() const { + return scriptId_; + } +}; + +template <> +inline bool +ParseContext::Statement::is<ParseContext::LabelStatement>() const +{ + return kind_ == StatementKind::Label; +} + +template <typename T> +inline T& +ParseContext::Statement::as() +{ + MOZ_ASSERT(is<T>()); + return static_cast<T&>(*this); +} + +inline ParseContext::Scope::BindingIter +ParseContext::Scope::bindings(ParseContext* pc) +{ + // In function scopes with parameter expressions, function special names + // (like '.this') are declared as vars in the function scope, despite its + // not being the var scope. + return BindingIter(*this, pc->varScope_ == this || pc->functionScope_.ptrOr(nullptr) == this); +} + +inline +Directives::Directives(ParseContext* parent) + : strict_(parent->sc()->strict()), + asmJS_(parent->useAsmOrInsideUseAsm()) +{} + +enum VarContext { HoistVars, DontHoistVars }; +enum PropListType { ObjectLiteral, ClassBody, DerivedClassBody }; +enum class PropertyType { + Normal, + Shorthand, + CoverInitializedName, + Getter, + GetterNoExpressionClosure, + Setter, + SetterNoExpressionClosure, + Method, + GeneratorMethod, + AsyncMethod, + Constructor, + DerivedConstructor +}; + +// Specify a value for an ES6 grammar parametrization. We have no enum for +// [Return] because its behavior is exactly equivalent to checking whether +// we're in a function box -- easier and simpler than passing an extra +// parameter everywhere. +enum YieldHandling { YieldIsName, YieldIsKeyword }; +enum InHandling { InAllowed, InProhibited }; +enum DefaultHandling { NameRequired, AllowDefaultName }; +enum TripledotHandling { TripledotAllowed, TripledotProhibited }; + +// A data structure for tracking used names per parsing session in order to +// compute which bindings are closed over. Scripts and scopes are numbered +// monotonically in textual order and name uses are tracked by lists of +// (script id, scope id) pairs of their use sites. +// +// Intuitively, in a pair (P,S), P tracks the most nested function that has a +// use of u, and S tracks the most nested scope that is still being parsed. +// +// P is used to answer the question "is u used by a nested function?" +// S is used to answer the question "is u used in any scopes currently being +// parsed?" +// +// The algorithm: +// +// Let Used by a map of names to lists. +// +// 1. Number all scopes in monotonic increasing order in textual order. +// 2. Number all scripts in monotonic increasing order in textual order. +// 3. When an identifier u is used in scope numbered S in script numbered P, +// and u is found in Used, +// a. Append (P,S) to Used[u]. +// b. Otherwise, assign the the list [(P,S)] to Used[u]. +// 4. When we finish parsing a scope S in script P, for each declared name d in +// Declared(S): +// a. If d is found in Used, mark d as closed over if there is a value +// (P_d, S_d) in Used[d] such that P_d > P and S_d > S. +// b. Remove all values (P_d, S_d) in Used[d] such that S_d are >= S. +// +// Steps 1 and 2 are implemented by UsedNameTracker::next{Script,Scope}Id. +// Step 3 is implemented by UsedNameTracker::noteUsedInScope. +// Step 4 is implemented by UsedNameTracker::noteBoundInScope and +// Parser::propagateFreeNamesAndMarkClosedOverBindings. +class UsedNameTracker +{ + public: + struct Use + { + uint32_t scriptId; + uint32_t scopeId; + }; + + class UsedNameInfo + { + friend class UsedNameTracker; + + Vector<Use, 6> uses_; + + void resetToScope(uint32_t scriptId, uint32_t scopeId); + + public: + explicit UsedNameInfo(ExclusiveContext* cx) + : uses_(cx) + { } + + UsedNameInfo(UsedNameInfo&& other) + : uses_(mozilla::Move(other.uses_)) + { } + + bool noteUsedInScope(uint32_t scriptId, uint32_t scopeId) { + if (uses_.empty() || uses_.back().scopeId < scopeId) + return uses_.append(Use { scriptId, scopeId }); + return true; + } + + void noteBoundInScope(uint32_t scriptId, uint32_t scopeId, bool* closedOver) { + *closedOver = false; + while (!uses_.empty()) { + Use& innermost = uses_.back(); + if (innermost.scopeId < scopeId) + break; + if (innermost.scriptId > scriptId) + *closedOver = true; + uses_.popBack(); + } + } + + bool isUsedInScript(uint32_t scriptId) const { + return !uses_.empty() && uses_.back().scriptId >= scriptId; + } + }; + + using UsedNameMap = HashMap<JSAtom*, + UsedNameInfo, + DefaultHasher<JSAtom*>>; + + private: + // The map of names to chains of uses. + UsedNameMap map_; + + // Monotonically increasing id for all nested scripts. + uint32_t scriptCounter_; + + // Monotonically increasing id for all nested scopes. + uint32_t scopeCounter_; + + public: + explicit UsedNameTracker(ExclusiveContext* cx) + : map_(cx), + scriptCounter_(0), + scopeCounter_(0) + { } + + MOZ_MUST_USE bool init() { + return map_.init(); + } + + uint32_t nextScriptId() { + MOZ_ASSERT(scriptCounter_ != UINT32_MAX, + "ParseContext::Scope::init should have prevented wraparound"); + return scriptCounter_++; + } + + uint32_t nextScopeId() { + MOZ_ASSERT(scopeCounter_ != UINT32_MAX); + return scopeCounter_++; + } + + UsedNameMap::Ptr lookup(JSAtom* name) const { + return map_.lookup(name); + } + + MOZ_MUST_USE bool noteUse(ExclusiveContext* cx, JSAtom* name, + uint32_t scriptId, uint32_t scopeId); + + struct RewindToken + { + private: + friend class UsedNameTracker; + uint32_t scriptId; + uint32_t scopeId; + }; + + RewindToken getRewindToken() const { + RewindToken token; + token.scriptId = scriptCounter_; + token.scopeId = scopeCounter_; + return token; + } + + // Resets state so that scriptId and scopeId are the innermost script and + // scope, respectively. Used for rewinding state on syntax parse failure. + void rewind(RewindToken token); + + // Resets state to beginning of compilation. + void reset() { + map_.clear(); + RewindToken token; + token.scriptId = 0; + token.scopeId = 0; + rewind(token); + } +}; + +template <typename ParseHandler> +class Parser final : private JS::AutoGCRooter, public StrictModeGetter +{ + private: + using Node = typename ParseHandler::Node; + + /* + * A class for temporarily stashing errors while parsing continues. + * + * The ability to stash an error is useful for handling situations where we + * aren't able to verify that an error has occurred until later in the parse. + * For instance | ({x=1}) | is always parsed as an object literal with + * a SyntaxError, however, in the case where it is followed by '=>' we rewind + * and reparse it as a valid arrow function. Here a PossibleError would be + * set to 'pending' when the initial SyntaxError was encountered then 'resolved' + * just before rewinding the parser. + * + * There are currently two kinds of PossibleErrors: Expression and + * Destructuring errors. Expression errors are used to mark a possible + * syntax error when a grammar production is used in an expression context. + * For example in |{x = 1}|, we mark the CoverInitializedName |x = 1| as a + * possible expression error, because CoverInitializedName productions + * are disallowed when an actual ObjectLiteral is expected. + * Destructuring errors are used to record possible syntax errors in + * destructuring contexts. For example in |[...rest, ] = []|, we initially + * mark the trailing comma after the spread expression as a possible + * destructuring error, because the ArrayAssignmentPattern grammar + * production doesn't allow a trailing comma after the rest element. + * + * When using PossibleError one should set a pending error at the location + * where an error occurs. From that point, the error may be resolved + * (invalidated) or left until the PossibleError is checked. + * + * Ex: + * PossibleError possibleError(*this); + * possibleError.setPendingExpressionError(pn, JSMSG_BAD_PROP_ID); + * // A JSMSG_BAD_PROP_ID ParseError is reported, returns false. + * if (!possibleError.checkForExpressionError()) + * return false; // we reach this point with a pending exception + * + * PossibleError possibleError(*this); + * possibleError.setPendingExpressionError(pn, JSMSG_BAD_PROP_ID); + * // Returns true, no error is reported. + * if (!possibleError.checkForDestructuringError()) + * return false; // not reached, no pending exception + * + * PossibleError possibleError(*this); + * // Returns true, no error is reported. + * if (!possibleError.checkForExpressionError()) + * return false; // not reached, no pending exception + */ + class MOZ_STACK_CLASS PossibleError + { + private: + enum class ErrorKind { Expression, Destructuring }; + + enum class ErrorState { None, Pending }; + + struct Error { + ErrorState state_ = ErrorState::None; + + // Error reporting fields. + uint32_t offset_; + unsigned errorNumber_; + }; + + Parser<ParseHandler>& parser_; + Error exprError_; + Error destructuringError_; + + // Returns the error report. + Error& error(ErrorKind kind); + + // Return true if an error is pending without reporting + bool hasError(ErrorKind kind); + + // Resolve any pending error. + void setResolved(ErrorKind kind); + + // Set a pending error. Only a single error may be set per instance and + // error kind. + void setPending(ErrorKind kind, Node pn, unsigned errorNumber); + + // If there is a pending error, report it and return false, otherwise + // return true. + bool checkForError(ErrorKind kind); + + // Transfer an existing error to another instance. + void transferErrorTo(ErrorKind kind, PossibleError* other); + + public: + explicit PossibleError(Parser<ParseHandler>& parser); + + // Set a pending destructuring error. Only a single error may be set + // per instance, i.e. subsequent calls to this method are ignored and + // won't overwrite the existing pending error. + void setPendingDestructuringError(Node pn, unsigned errorNumber); + + // Set a pending expression error. Only a single error may be set per + // instance, i.e. subsequent calls to this method are ignored and won't + // overwrite the existing pending error. + void setPendingExpressionError(Node pn, unsigned errorNumber); + + // If there is a pending destructuring error, report it and return + // false, otherwise return true. Clears any pending expression error. + bool checkForDestructuringError(); + + // If there is a pending expression error, report it and return false, + // otherwise return true. Clears any pending destructuring error. + bool checkForExpressionError(); + + // Pass pending errors between possible error instances. This is useful + // for extending the lifetime of a pending error beyond the scope of + // the PossibleError where it was initially set (keeping in mind that + // PossibleError is a MOZ_STACK_CLASS). + void transferErrorsTo(PossibleError* other); + }; + + public: + ExclusiveContext* const context; + + LifoAlloc& alloc; + + TokenStream tokenStream; + LifoAlloc::Mark tempPoolMark; + + /* list of parsed objects for GC tracing */ + ObjectBox* traceListHead; + + /* innermost parse context (stack-allocated) */ + ParseContext* pc; + + // For tracking used names in this parsing session. + UsedNameTracker& usedNames; + + /* Compression token for aborting. */ + SourceCompressionTask* sct; + + ScriptSource* ss; + + /* Root atoms and objects allocated for the parsed tree. */ + AutoKeepAtoms keepAtoms; + + /* Perform constant-folding; must be true when interfacing with the emitter. */ + const bool foldConstants:1; + + private: +#if DEBUG + /* Our fallible 'checkOptions' member function has been called. */ + bool checkOptionsCalled:1; +#endif + + /* + * Not all language constructs can be handled during syntax parsing. If it + * is not known whether the parse succeeds or fails, this bit is set and + * the parse will return false. + */ + bool abortedSyntaxParse:1; + + /* Unexpected end of input, i.e. TOK_EOF not at top-level. */ + bool isUnexpectedEOF_:1; + + public: + /* State specific to the kind of parse being performed. */ + ParseHandler handler; + + void prepareNodeForMutation(Node node) { handler.prepareNodeForMutation(node); } + void freeTree(Node node) { handler.freeTree(node); } + + private: + bool reportHelper(ParseReportKind kind, bool strict, uint32_t offset, + unsigned errorNumber, va_list args); + public: + bool report(ParseReportKind kind, bool strict, Node pn, unsigned errorNumber, ...); + bool reportNoOffset(ParseReportKind kind, bool strict, unsigned errorNumber, ...); + bool reportWithOffset(ParseReportKind kind, bool strict, uint32_t offset, unsigned errorNumber, + ...); + + Parser(ExclusiveContext* cx, LifoAlloc& alloc, const ReadOnlyCompileOptions& options, + const char16_t* chars, size_t length, bool foldConstants, UsedNameTracker& usedNames, + Parser<SyntaxParseHandler>* syntaxParser, LazyScript* lazyOuterFunction); + ~Parser(); + + bool checkOptions(); + + // A Parser::Mark is the extension of the LifoAlloc::Mark to the entire + // Parser's state. Note: clients must still take care that any ParseContext + // that points into released ParseNodes is destroyed. + class Mark + { + friend class Parser; + LifoAlloc::Mark mark; + ObjectBox* traceListHead; + }; + Mark mark() const { + Mark m; + m.mark = alloc.mark(); + m.traceListHead = traceListHead; + return m; + } + void release(Mark m) { + alloc.release(m.mark); + traceListHead = m.traceListHead; + } + + friend void js::frontend::MarkParser(JSTracer* trc, JS::AutoGCRooter* parser); + + const char* getFilename() const { return tokenStream.getFilename(); } + JSVersion versionNumber() const { return tokenStream.versionNumber(); } + + /* + * Parse a top-level JS script. + */ + Node parse(); + + /* + * Allocate a new parsed object or function container from + * cx->tempLifoAlloc. + */ + ObjectBox* newObjectBox(JSObject* obj); + FunctionBox* newFunctionBox(Node fn, JSFunction* fun, Directives directives, + GeneratorKind generatorKind, FunctionAsyncKind asyncKind, + bool tryAnnexB); + + /* + * Create a new function object given a name (which is optional if this is + * a function expression). + */ + JSFunction* newFunction(HandleAtom atom, FunctionSyntaxKind kind, + GeneratorKind generatorKind, FunctionAsyncKind asyncKind, + HandleObject proto); + + void trace(JSTracer* trc); + + bool hadAbortedSyntaxParse() { + return abortedSyntaxParse; + } + void clearAbortedSyntaxParse() { + abortedSyntaxParse = false; + } + + bool isUnexpectedEOF() const { return isUnexpectedEOF_; } + + bool checkUnescapedName(); + + private: + Parser* thisForCtor() { return this; } + + JSAtom* stopStringCompression(); + + Node stringLiteral(); + Node noSubstitutionTemplate(); + Node templateLiteral(YieldHandling yieldHandling); + bool taggedTemplate(YieldHandling yieldHandling, Node nodeList, TokenKind tt); + bool appendToCallSiteObj(Node callSiteObj); + bool addExprAndGetNextTemplStrToken(YieldHandling yieldHandling, Node nodeList, + TokenKind* ttp); + bool checkStatementsEOF(); + + inline Node newName(PropertyName* name); + inline Node newName(PropertyName* name, TokenPos pos); + inline Node newYieldExpression(uint32_t begin, Node expr, bool isYieldStar = false); + inline Node newAwaitExpression(uint32_t begin, Node expr); + + inline bool abortIfSyntaxParser(); + + public: + /* Public entry points for parsing. */ + Node statement(YieldHandling yieldHandling); + Node statementListItem(YieldHandling yieldHandling, bool canHaveDirectives = false); + + bool maybeParseDirective(Node list, Node pn, bool* cont); + + // Parse the body of an eval. + // + // Eval scripts are distinguished from global scripts in that in ES6, per + // 18.2.1.1 steps 9 and 10, all eval scripts are executed under a fresh + // lexical scope. + Node evalBody(EvalSharedContext* evalsc); + + // Parse the body of a global script. + Node globalBody(GlobalSharedContext* globalsc); + + // Parse a module. + Node moduleBody(ModuleSharedContext* modulesc); + + // Parse a function, given only its body. Used for the Function and + // Generator constructors. + Node standaloneFunctionBody(HandleFunction fun, HandleScope enclosingScope, + Handle<PropertyNameVector> formals, + GeneratorKind generatorKind, FunctionAsyncKind asyncKind, + Directives inheritedDirectives, Directives* newDirectives); + + // Parse a function, given only its arguments and body. Used for lazily + // parsed functions. + Node standaloneLazyFunction(HandleFunction fun, bool strict, + GeneratorKind generatorKind, FunctionAsyncKind asyncKind); + + // Parse an inner function given an enclosing ParseContext and a + // FunctionBox for the inner function. + bool innerFunction(Node pn, ParseContext* outerpc, FunctionBox* funbox, InHandling inHandling, + YieldHandling yieldHandling, FunctionSyntaxKind kind, + Directives inheritedDirectives, Directives* newDirectives); + + // Parse a function's formal parameters and its body assuming its function + // ParseContext is already on the stack. + bool functionFormalParametersAndBody(InHandling inHandling, YieldHandling yieldHandling, + Node pn, FunctionSyntaxKind kind); + + // Determine whether |yield| is a valid name in the current context, or + // whether it's prohibited due to strictness, JS version, or occurrence + // inside a star generator. + bool yieldExpressionsSupported() { + return (versionNumber() >= JSVERSION_1_7 || pc->isGenerator()) && !pc->isAsync(); + } + + // Match the current token against the BindingIdentifier production with + // the given Yield parameter. If there is no match, report a syntax + // error. + PropertyName* bindingIdentifier(YieldHandling yieldHandling); + + virtual bool strictMode() { return pc->sc()->strict(); } + bool setLocalStrictMode(bool strict) { + MOZ_ASSERT(tokenStream.debugHasNoLookahead()); + return pc->sc()->setLocalStrictMode(strict); + } + + const ReadOnlyCompileOptions& options() const { + return tokenStream.options(); + } + + private: + enum InvokedPrediction { PredictUninvoked = false, PredictInvoked = true }; + enum ForInitLocation { InForInit, NotInForInit }; + + private: + /* + * JS parsers, from lowest to highest precedence. + * + * Each parser must be called during the dynamic scope of a ParseContext + * object, pointed to by this->pc. + * + * Each returns a parse node tree or null on error. + * + * Parsers whose name has a '1' suffix leave the TokenStream state + * pointing to the token one past the end of the parsed fragment. For a + * number of the parsers this is convenient and avoids a lot of + * unnecessary ungetting and regetting of tokens. + * + * Some parsers have two versions: an always-inlined version (with an 'i' + * suffix) and a never-inlined version (with an 'n' suffix). + */ + Node functionStmt(YieldHandling yieldHandling, DefaultHandling defaultHandling, + FunctionAsyncKind asyncKind = SyncFunction); + Node functionExpr(InvokedPrediction invoked = PredictUninvoked, + FunctionAsyncKind asyncKind = SyncFunction); + + Node statementList(YieldHandling yieldHandling); + + Node blockStatement(YieldHandling yieldHandling, + unsigned errorNumber = JSMSG_CURLY_IN_COMPOUND); + Node doWhileStatement(YieldHandling yieldHandling); + Node whileStatement(YieldHandling yieldHandling); + + Node forStatement(YieldHandling yieldHandling); + bool forHeadStart(YieldHandling yieldHandling, + ParseNodeKind* forHeadKind, + Node* forInitialPart, + mozilla::Maybe<ParseContext::Scope>& forLetImpliedScope, + Node* forInOrOfExpression); + bool validateForInOrOfLHSExpression(Node target, PossibleError* possibleError); + Node expressionAfterForInOrOf(ParseNodeKind forHeadKind, YieldHandling yieldHandling); + + Node switchStatement(YieldHandling yieldHandling); + Node continueStatement(YieldHandling yieldHandling); + Node breakStatement(YieldHandling yieldHandling); + Node returnStatement(YieldHandling yieldHandling); + Node withStatement(YieldHandling yieldHandling); + Node throwStatement(YieldHandling yieldHandling); + Node tryStatement(YieldHandling yieldHandling); + Node catchBlockStatement(YieldHandling yieldHandling, ParseContext::Scope& catchParamScope); + Node debuggerStatement(); + + Node variableStatement(YieldHandling yieldHandling); + + Node labeledStatement(YieldHandling yieldHandling); + Node labeledItem(YieldHandling yieldHandling); + + Node ifStatement(YieldHandling yieldHandling); + Node consequentOrAlternative(YieldHandling yieldHandling); + + // While on a |let| TOK_NAME token, examine |next|. Indicate whether + // |next|, the next token already gotten with modifier TokenStream::None, + // continues a LexicalDeclaration. + bool nextTokenContinuesLetDeclaration(TokenKind next, YieldHandling yieldHandling); + + Node lexicalDeclaration(YieldHandling yieldHandling, bool isConst); + + Node importDeclaration(); + Node exportDeclaration(); + Node expressionStatement(YieldHandling yieldHandling, + InvokedPrediction invoked = PredictUninvoked); + + // Declaration parsing. The main entrypoint is Parser::declarationList, + // with sub-functionality split out into the remaining methods. + + // |blockScope| may be non-null only when |kind| corresponds to a lexical + // declaration (that is, PNK_LET or PNK_CONST). + // + // The for* parameters, for normal declarations, should be null/ignored. + // They should be non-null only when Parser::forHeadStart parses a + // declaration at the start of a for-loop head. + // + // In this case, on success |*forHeadKind| is PNK_FORHEAD, PNK_FORIN, or + // PNK_FOROF, corresponding to the three for-loop kinds. The precise value + // indicates what was parsed. + // + // If parsing recognized a for(;;) loop, the next token is the ';' within + // the loop-head that separates the init/test parts. + // + // Otherwise, for for-in/of loops, the next token is the ')' ending the + // loop-head. Additionally, the expression that the loop iterates over was + // parsed into |*forInOrOfExpression|. + Node declarationList(YieldHandling yieldHandling, + ParseNodeKind kind, + ParseNodeKind* forHeadKind = nullptr, + Node* forInOrOfExpression = nullptr); + + // The items in a declaration list are either patterns or names, with or + // without initializers. These two methods parse a single pattern/name and + // any associated initializer -- and if parsing an |initialDeclaration| + // will, if parsing in a for-loop head (as specified by |forHeadKind| being + // non-null), consume additional tokens up to the closing ')' in a + // for-in/of loop head, returning the iterated expression in + // |*forInOrOfExpression|. (An "initial declaration" is the first + // declaration in a declaration list: |a| but not |b| in |var a, b|, |{c}| + // but not |d| in |let {c} = 3, d|.) + Node declarationPattern(Node decl, DeclarationKind declKind, TokenKind tt, + bool initialDeclaration, YieldHandling yieldHandling, + ParseNodeKind* forHeadKind, Node* forInOrOfExpression); + Node declarationName(Node decl, DeclarationKind declKind, TokenKind tt, + bool initialDeclaration, YieldHandling yieldHandling, + ParseNodeKind* forHeadKind, Node* forInOrOfExpression); + + // Having parsed a name (not found in a destructuring pattern) declared by + // a declaration, with the current token being the '=' separating the name + // from its initializer, parse and bind that initializer -- and possibly + // consume trailing in/of and subsequent expression, if so directed by + // |forHeadKind|. + bool initializerInNameDeclaration(Node decl, Node binding, Handle<PropertyName*> name, + DeclarationKind declKind, bool initialDeclaration, + YieldHandling yieldHandling, ParseNodeKind* forHeadKind, + Node* forInOrOfExpression); + + Node expr(InHandling inHandling, YieldHandling yieldHandling, + TripledotHandling tripledotHandling, PossibleError* possibleError = nullptr, + InvokedPrediction invoked = PredictUninvoked); + Node assignExpr(InHandling inHandling, YieldHandling yieldHandling, + TripledotHandling tripledotHandling, PossibleError* possibleError = nullptr, + InvokedPrediction invoked = PredictUninvoked); + Node assignExprWithoutYieldOrAwait(YieldHandling yieldHandling); + Node yieldExpression(InHandling inHandling); + Node condExpr1(InHandling inHandling, YieldHandling yieldHandling, + TripledotHandling tripledotHandling, + PossibleError* possibleError, + InvokedPrediction invoked = PredictUninvoked); + Node orExpr1(InHandling inHandling, YieldHandling yieldHandling, + TripledotHandling tripledotHandling, + PossibleError* possibleError, + InvokedPrediction invoked = PredictUninvoked); + Node unaryExpr(YieldHandling yieldHandling, TripledotHandling tripledotHandling, + PossibleError* possibleError = nullptr, + InvokedPrediction invoked = PredictUninvoked); + Node memberExpr(YieldHandling yieldHandling, TripledotHandling tripledotHandling, + TokenKind tt, bool allowCallSyntax = true, + PossibleError* possibleError = nullptr, + InvokedPrediction invoked = PredictUninvoked); + Node primaryExpr(YieldHandling yieldHandling, TripledotHandling tripledotHandling, + TokenKind tt, PossibleError* possibleError, + InvokedPrediction invoked = PredictUninvoked); + Node exprInParens(InHandling inHandling, YieldHandling yieldHandling, + TripledotHandling tripledotHandling, PossibleError* possibleError = nullptr); + + bool tryNewTarget(Node& newTarget); + bool checkAndMarkSuperScope(); + + Node methodDefinition(PropertyType propType, HandleAtom funName); + + /* + * Additional JS parsers. + */ + bool functionArguments(YieldHandling yieldHandling, FunctionSyntaxKind kind, + Node funcpn); + + Node functionDefinition(InHandling inHandling, YieldHandling yieldHandling, HandleAtom name, + FunctionSyntaxKind kind, + GeneratorKind generatorKind, FunctionAsyncKind asyncKind, + InvokedPrediction invoked = PredictUninvoked); + + // Parse a function body. Pass StatementListBody if the body is a list of + // statements; pass ExpressionBody if the body is a single expression. + enum FunctionBodyType { StatementListBody, ExpressionBody }; + Node functionBody(InHandling inHandling, YieldHandling yieldHandling, FunctionSyntaxKind kind, + FunctionBodyType type); + + Node unaryOpExpr(YieldHandling yieldHandling, ParseNodeKind kind, JSOp op, uint32_t begin); + + Node condition(InHandling inHandling, YieldHandling yieldHandling); + + /* comprehensions */ + Node generatorComprehensionLambda(unsigned begin); + Node comprehensionFor(GeneratorKind comprehensionKind); + Node comprehensionIf(GeneratorKind comprehensionKind); + Node comprehensionTail(GeneratorKind comprehensionKind); + Node comprehension(GeneratorKind comprehensionKind); + Node arrayComprehension(uint32_t begin); + Node generatorComprehension(uint32_t begin); + + bool argumentList(YieldHandling yieldHandling, Node listNode, bool* isSpread, + PossibleError* possibleError = nullptr); + Node destructuringDeclaration(DeclarationKind kind, YieldHandling yieldHandling, + TokenKind tt); + Node destructuringDeclarationWithoutYieldOrAwait(DeclarationKind kind, YieldHandling yieldHandling, + TokenKind tt); + + bool namedImportsOrNamespaceImport(TokenKind tt, Node importSpecSet); + bool checkExportedName(JSAtom* exportName); + bool checkExportedNamesForDeclaration(Node node); + + enum ClassContext { ClassStatement, ClassExpression }; + Node classDefinition(YieldHandling yieldHandling, ClassContext classContext, + DefaultHandling defaultHandling); + + PropertyName* labelOrIdentifierReference(YieldHandling yieldHandling, + bool yieldTokenizedAsName); + + PropertyName* labelIdentifier(YieldHandling yieldHandling) { + return labelOrIdentifierReference(yieldHandling, false); + } + + PropertyName* identifierReference(YieldHandling yieldHandling, + bool yieldTokenizedAsName = false) + { + return labelOrIdentifierReference(yieldHandling, yieldTokenizedAsName); + } + + PropertyName* importedBinding() { + return bindingIdentifier(YieldIsName); + } + + Node identifierReference(Handle<PropertyName*> name); + + bool matchLabel(YieldHandling yieldHandling, MutableHandle<PropertyName*> label); + + bool allowsForEachIn() { +#if !JS_HAS_FOR_EACH_IN + return false; +#else + return versionNumber() >= JSVERSION_1_6; +#endif + } + + enum AssignmentFlavor { + PlainAssignment, + CompoundAssignment, + KeyedDestructuringAssignment, + IncrementAssignment, + DecrementAssignment, + ForInOrOfTarget + }; + + bool checkAndMarkAsAssignmentLhs(Node pn, AssignmentFlavor flavor, + PossibleError* possibleError=nullptr); + bool matchInOrOf(bool* isForInp, bool* isForOfp); + + bool hasUsedFunctionSpecialName(HandlePropertyName name); + bool declareFunctionArgumentsObject(); + bool declareFunctionThis(); + Node newInternalDotName(HandlePropertyName name); + Node newThisName(); + Node newDotGeneratorName(); + bool declareDotGeneratorName(); + + bool checkFunctionDefinition(HandleAtom funAtom, Node pn, FunctionSyntaxKind kind, + GeneratorKind generatorKind, bool* tryAnnexB); + bool skipLazyInnerFunction(Node pn, FunctionSyntaxKind kind, bool tryAnnexB); + bool innerFunction(Node pn, ParseContext* outerpc, HandleFunction fun, + InHandling inHandling, YieldHandling yieldHandling, + FunctionSyntaxKind kind, + GeneratorKind generatorKind, FunctionAsyncKind asyncKind, bool tryAnnexB, + Directives inheritedDirectives, Directives* newDirectives); + bool trySyntaxParseInnerFunction(Node pn, HandleFunction fun, InHandling inHandling, + YieldHandling yieldHandling, FunctionSyntaxKind kind, + GeneratorKind generatorKind, FunctionAsyncKind asyncKind, + bool tryAnnexB, + Directives inheritedDirectives, Directives* newDirectives); + bool finishFunctionScopes(); + bool finishFunction(); + bool leaveInnerFunction(ParseContext* outerpc); + + public: + enum FunctionCallBehavior { + PermitAssignmentToFunctionCalls, + ForbidAssignmentToFunctionCalls + }; + + bool isValidSimpleAssignmentTarget(Node node, + FunctionCallBehavior behavior = ForbidAssignmentToFunctionCalls); + + private: + bool reportIfArgumentsEvalTarget(Node nameNode); + bool reportIfNotValidSimpleAssignmentTarget(Node target, AssignmentFlavor flavor); + + bool checkAndMarkAsIncOperand(Node kid, AssignmentFlavor flavor); + bool checkStrictAssignment(Node lhs); + bool checkStrictBinding(PropertyName* name, TokenPos pos); + + bool hasValidSimpleStrictParameterNames(); + + bool isValidStrictBinding(PropertyName* name); + + void reportRedeclaration(HandlePropertyName name, DeclarationKind kind, TokenPos pos); + bool notePositionalFormalParameter(Node fn, HandlePropertyName name, + bool disallowDuplicateParams, bool* duplicatedParam); + bool noteDestructuredPositionalFormalParameter(Node fn, Node destruct); + mozilla::Maybe<DeclarationKind> isVarRedeclaredInEval(HandlePropertyName name, + DeclarationKind kind); + bool tryDeclareVar(HandlePropertyName name, DeclarationKind kind, + mozilla::Maybe<DeclarationKind>* redeclaredKind); + bool tryDeclareVarForAnnexBLexicalFunction(HandlePropertyName name, bool* tryAnnexB); + bool checkLexicalDeclarationDirectlyWithinBlock(ParseContext::Statement& stmt, + DeclarationKind kind, TokenPos pos); + bool noteDeclaredName(HandlePropertyName name, DeclarationKind kind, TokenPos pos); + bool noteUsedName(HandlePropertyName name); + bool hasUsedName(HandlePropertyName name); + + // Required on Scope exit. + bool propagateFreeNamesAndMarkClosedOverBindings(ParseContext::Scope& scope); + + mozilla::Maybe<GlobalScope::Data*> newGlobalScopeData(ParseContext::Scope& scope); + mozilla::Maybe<ModuleScope::Data*> newModuleScopeData(ParseContext::Scope& scope); + mozilla::Maybe<EvalScope::Data*> newEvalScopeData(ParseContext::Scope& scope); + mozilla::Maybe<FunctionScope::Data*> newFunctionScopeData(ParseContext::Scope& scope, + bool hasParameterExprs); + mozilla::Maybe<VarScope::Data*> newVarScopeData(ParseContext::Scope& scope); + mozilla::Maybe<LexicalScope::Data*> newLexicalScopeData(ParseContext::Scope& scope); + Node finishLexicalScope(ParseContext::Scope& scope, Node body); + + Node propertyName(YieldHandling yieldHandling, Node propList, + PropertyType* propType, MutableHandleAtom propAtom); + Node computedPropertyName(YieldHandling yieldHandling, Node literal); + Node arrayInitializer(YieldHandling yieldHandling, PossibleError* possibleError); + Node newRegExp(); + + Node objectLiteral(YieldHandling yieldHandling, PossibleError* possibleError); + + // Top-level entrypoint into destructuring pattern checking/name-analyzing. + bool checkDestructuringPattern(Node pattern, mozilla::Maybe<DeclarationKind> maybeDecl, + PossibleError* possibleError = nullptr); + + // Recursive methods for checking/name-analyzing subcomponents of a + // destructuring pattern. The array/object methods *must* be passed arrays + // or objects. The name method may be passed anything but will report an + // error if not passed a name. + bool checkDestructuringArray(Node arrayPattern, mozilla::Maybe<DeclarationKind> maybeDecl); + bool checkDestructuringObject(Node objectPattern, mozilla::Maybe<DeclarationKind> maybeDecl); + bool checkDestructuringName(Node expr, mozilla::Maybe<DeclarationKind> maybeDecl); + + bool checkAssignmentToCall(Node node, unsigned errnum); + + Node newNumber(const Token& tok) { + return handler.newNumber(tok.number(), tok.decimalPoint(), tok.pos); + } + + static Node null() { return ParseHandler::null(); } + + bool reportBadReturn(Node pn, ParseReportKind kind, unsigned errnum, unsigned anonerrnum); + + JSAtom* prefixAccessorName(PropertyType propType, HandleAtom propAtom); + + TokenPos pos() const { return tokenStream.currentToken().pos; } + + bool asmJS(Node list); + + void addTelemetry(JSCompartment::DeprecatedLanguageExtension e); + + bool warnOnceAboutExprClosure(); + bool warnOnceAboutForEach(); +}; + +} /* namespace frontend */ +} /* namespace js */ + +#endif /* frontend_Parser_h */ diff --git a/js/src/frontend/SharedContext.h b/js/src/frontend/SharedContext.h new file mode 100644 index 000000000..39df47c20 --- /dev/null +++ b/js/src/frontend/SharedContext.h @@ -0,0 +1,639 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- + * vim: set ts=8 sts=4 et sw=4 tw=99: + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#ifndef frontend_SharedContext_h +#define frontend_SharedContext_h + +#include "jsatom.h" +#include "jsopcode.h" +#include "jspubtd.h" +#include "jsscript.h" +#include "jstypes.h" + +#include "builtin/ModuleObject.h" +#include "ds/InlineTable.h" +#include "frontend/ParseNode.h" +#include "frontend/TokenStream.h" +#include "vm/EnvironmentObject.h" + +namespace js { +namespace frontend { + +enum class StatementKind : uint8_t +{ + Label, + Block, + If, + Switch, + With, + Catch, + Try, + Finally, + ForLoopLexicalHead, + ForLoop, + ForInLoop, + ForOfLoop, + DoLoop, + WhileLoop, + + // Used only by BytecodeEmitter. + Spread +}; + +static inline bool +StatementKindIsLoop(StatementKind kind) +{ + return kind == StatementKind::ForLoop || + kind == StatementKind::ForInLoop || + kind == StatementKind::ForOfLoop || + kind == StatementKind::DoLoop || + kind == StatementKind::WhileLoop || + kind == StatementKind::Spread; +} + +static inline bool +StatementKindIsUnlabeledBreakTarget(StatementKind kind) +{ + return StatementKindIsLoop(kind) || kind == StatementKind::Switch; +} + +// A base class for nestable structures in the frontend, such as statements +// and scopes. +template <typename Concrete> +class MOZ_STACK_CLASS Nestable +{ + Concrete** stack_; + Concrete* enclosing_; + + protected: + explicit Nestable(Concrete** stack) + : stack_(stack), + enclosing_(*stack) + { + *stack_ = static_cast<Concrete*>(this); + } + + // These method are protected. Some derived classes, such as ParseContext, + // do not expose the ability to walk the stack. + Concrete* enclosing() const { + return enclosing_; + } + + template <typename Predicate /* (Concrete*) -> bool */> + static Concrete* findNearest(Concrete* it, Predicate predicate) { + while (it && !predicate(it)) + it = it->enclosing(); + return it; + } + + template <typename T> + static T* findNearest(Concrete* it) { + while (it && !it->template is<T>()) + it = it->enclosing(); + return it ? &it->template as<T>() : nullptr; + } + + template <typename T, typename Predicate /* (T*) -> bool */> + static T* findNearest(Concrete* it, Predicate predicate) { + while (it && (!it->template is<T>() || !predicate(&it->template as<T>()))) + it = it->enclosing(); + return it ? &it->template as<T>() : nullptr; + } + + public: + ~Nestable() { + MOZ_ASSERT(*stack_ == static_cast<Concrete*>(this)); + *stack_ = enclosing_; + } +}; + +// These flags apply to both global and function contexts. +class AnyContextFlags +{ + // This class's data is all private and so only visible to these friends. + friend class SharedContext; + + // True if "use strict"; appears in the body instead of being inherited. + bool hasExplicitUseStrict:1; + + // The (static) bindings of this script need to support dynamic name + // read/write access. Here, 'dynamic' means dynamic dictionary lookup on + // the scope chain for a dynamic set of keys. The primary examples are: + // - direct eval + // - function:: + // - with + // since both effectively allow any name to be accessed. Non-examples are: + // - upvars of nested functions + // - function statement + // since the set of assigned name is known dynamically. + // + // Note: access through the arguments object is not considered dynamic + // binding access since it does not go through the normal name lookup + // mechanism. This is debatable and could be changed (although care must be + // taken not to turn off the whole 'arguments' optimization). To answer the + // more general "is this argument aliased" question, script->needsArgsObj + // should be tested (see JSScript::argIsAliased). + bool bindingsAccessedDynamically:1; + + // Whether this script, or any of its inner scripts contains a debugger + // statement which could potentially read or write anywhere along the + // scope chain. + bool hasDebuggerStatement:1; + + // A direct eval occurs in the body of the script. + bool hasDirectEval:1; + + public: + AnyContextFlags() + : hasExplicitUseStrict(false), + bindingsAccessedDynamically(false), + hasDebuggerStatement(false), + hasDirectEval(false) + { } +}; + +class FunctionContextFlags +{ + // This class's data is all private and so only visible to these friends. + friend class FunctionBox; + + // This function does something that can extend the set of bindings in its + // call objects --- it does a direct eval in non-strict code, or includes a + // function statement (as opposed to a function definition). + // + // This flag is *not* inherited by enclosed or enclosing functions; it + // applies only to the function in whose flags it appears. + // + bool hasExtensibleScope:1; + + // Technically, every function has a binding named 'arguments'. Internally, + // this binding is only added when 'arguments' is mentioned by the function + // body. This flag indicates whether 'arguments' has been bound either + // through implicit use: + // function f() { return arguments } + // or explicit redeclaration: + // function f() { var arguments; return arguments } + // + // Note 1: overwritten arguments (function() { arguments = 3 }) will cause + // this flag to be set but otherwise require no special handling: + // 'arguments' is just a local variable and uses of 'arguments' will just + // read the local's current slot which may have been assigned. The only + // special semantics is that the initial value of 'arguments' is the + // arguments object (not undefined, like normal locals). + // + // Note 2: if 'arguments' is bound as a formal parameter, there will be an + // 'arguments' in Bindings, but, as the "LOCAL" in the name indicates, this + // flag will not be set. This is because, as a formal, 'arguments' will + // have no special semantics: the initial value is unconditionally the + // actual argument (or undefined if nactual < nformal). + // + bool argumentsHasLocalBinding:1; + + // In many cases where 'arguments' has a local binding (as described above) + // we do not need to actually create an arguments object in the function + // prologue: instead we can analyze how 'arguments' is used (using the + // simple dataflow analysis in analyzeSSA) to determine that uses of + // 'arguments' can just read from the stack frame directly. However, the + // dataflow analysis only looks at how JSOP_ARGUMENTS is used, so it will + // be unsound in several cases. The frontend filters out such cases by + // setting this flag which eagerly sets script->needsArgsObj to true. + // + bool definitelyNeedsArgsObj:1; + + bool needsHomeObject:1; + bool isDerivedClassConstructor:1; + + // Whether this function has a .this binding. If true, we need to emit + // JSOP_FUNCTIONTHIS in the prologue to initialize it. + bool hasThisBinding:1; + + // Whether this function has nested functions. + bool hasInnerFunctions:1; + + public: + FunctionContextFlags() + : hasExtensibleScope(false), + argumentsHasLocalBinding(false), + definitelyNeedsArgsObj(false), + needsHomeObject(false), + isDerivedClassConstructor(false), + hasThisBinding(false), + hasInnerFunctions(false) + { } +}; + +// List of directives that may be encountered in a Directive Prologue (ES5 15.1). +class Directives +{ + bool strict_; + bool asmJS_; + + public: + explicit Directives(bool strict) : strict_(strict), asmJS_(false) {} + explicit Directives(ParseContext* parent); + + void setStrict() { strict_ = true; } + bool strict() const { return strict_; } + + void setAsmJS() { asmJS_ = true; } + bool asmJS() const { return asmJS_; } + + Directives& operator=(Directives rhs) { + strict_ = rhs.strict_; + asmJS_ = rhs.asmJS_; + return *this; + } + bool operator==(const Directives& rhs) const { + return strict_ == rhs.strict_ && asmJS_ == rhs.asmJS_; + } + bool operator!=(const Directives& rhs) const { + return !(*this == rhs); + } +}; + +// The kind of this-binding for the current scope. Note that arrow functions +// (and generator expression lambdas) have a lexical this-binding so their +// ThisBinding is the same as the ThisBinding of their enclosing scope and can +// be any value. +enum class ThisBinding { Global, Function, Module }; + +class GlobalSharedContext; +class EvalSharedContext; +class ModuleSharedContext; + +/* + * The struct SharedContext is part of the current parser context (see + * ParseContext). It stores information that is reused between the parser and + * the bytecode emitter. + */ +class SharedContext +{ + public: + ExclusiveContext* const context; + AnyContextFlags anyCxFlags; + bool strictScript; + bool localStrict; + bool extraWarnings; + + protected: + enum class Kind { + ObjectBox, + Global, + Eval, + Module + }; + + Kind kind_; + + ThisBinding thisBinding_; + + bool allowNewTarget_; + bool allowSuperProperty_; + bool allowSuperCall_; + bool inWith_; + bool needsThisTDZChecks_; + + void computeAllowSyntax(Scope* scope); + void computeInWith(Scope* scope); + void computeThisBinding(Scope* scope); + + public: + SharedContext(ExclusiveContext* cx, Kind kind, Directives directives, bool extraWarnings) + : context(cx), + anyCxFlags(), + strictScript(directives.strict()), + localStrict(false), + extraWarnings(extraWarnings), + kind_(kind), + thisBinding_(ThisBinding::Global), + allowNewTarget_(false), + allowSuperProperty_(false), + allowSuperCall_(false), + inWith_(false), + needsThisTDZChecks_(false) + { } + + // If this is the outermost SharedContext, the Scope that encloses + // it. Otherwise nullptr. + virtual Scope* compilationEnclosingScope() const = 0; + + virtual ObjectBox* toObjectBox() { return nullptr; } + bool isObjectBox() { return toObjectBox(); } + bool isFunctionBox() { return isObjectBox() && toObjectBox()->isFunctionBox(); } + inline FunctionBox* asFunctionBox(); + bool isModuleContext() { return kind_ == Kind::Module; } + inline ModuleSharedContext* asModuleContext(); + bool isGlobalContext() { return kind_ == Kind::Global; } + inline GlobalSharedContext* asGlobalContext(); + bool isEvalContext() { return kind_ == Kind::Eval; } + inline EvalSharedContext* asEvalContext(); + + ThisBinding thisBinding() const { return thisBinding_; } + + bool allowNewTarget() const { return allowNewTarget_; } + bool allowSuperProperty() const { return allowSuperProperty_; } + bool allowSuperCall() const { return allowSuperCall_; } + bool inWith() const { return inWith_; } + bool needsThisTDZChecks() const { return needsThisTDZChecks_; } + + bool hasExplicitUseStrict() const { return anyCxFlags.hasExplicitUseStrict; } + bool bindingsAccessedDynamically() const { return anyCxFlags.bindingsAccessedDynamically; } + bool hasDebuggerStatement() const { return anyCxFlags.hasDebuggerStatement; } + bool hasDirectEval() const { return anyCxFlags.hasDirectEval; } + + void setExplicitUseStrict() { anyCxFlags.hasExplicitUseStrict = true; } + void setBindingsAccessedDynamically() { anyCxFlags.bindingsAccessedDynamically = true; } + void setHasDebuggerStatement() { anyCxFlags.hasDebuggerStatement = true; } + void setHasDirectEval() { anyCxFlags.hasDirectEval = true; } + + inline bool allBindingsClosedOver(); + + bool strict() const { + return strictScript || localStrict; + } + bool setLocalStrictMode(bool strict) { + bool retVal = localStrict; + localStrict = strict; + return retVal; + } + + // JSOPTION_EXTRA_WARNINGS warnings or strict mode errors. + bool needStrictChecks() const { + return strict() || extraWarnings; + } + + bool isDotVariable(JSAtom* atom) const { + return atom == context->names().dotGenerator || atom == context->names().dotThis; + } +}; + +class MOZ_STACK_CLASS GlobalSharedContext : public SharedContext +{ + ScopeKind scopeKind_; + + public: + Rooted<GlobalScope::Data*> bindings; + + GlobalSharedContext(ExclusiveContext* cx, ScopeKind scopeKind, Directives directives, + bool extraWarnings) + : SharedContext(cx, Kind::Global, directives, extraWarnings), + scopeKind_(scopeKind), + bindings(cx) + { + MOZ_ASSERT(scopeKind == ScopeKind::Global || scopeKind == ScopeKind::NonSyntactic); + thisBinding_ = ThisBinding::Global; + } + + Scope* compilationEnclosingScope() const override { + return nullptr; + } + + ScopeKind scopeKind() const { + return scopeKind_; + } +}; + +inline GlobalSharedContext* +SharedContext::asGlobalContext() +{ + MOZ_ASSERT(isGlobalContext()); + return static_cast<GlobalSharedContext*>(this); +} + +class MOZ_STACK_CLASS EvalSharedContext : public SharedContext +{ + RootedScope enclosingScope_; + + public: + Rooted<EvalScope::Data*> bindings; + + EvalSharedContext(ExclusiveContext* cx, JSObject* enclosingEnv, Scope* enclosingScope, + Directives directives, bool extraWarnings); + + Scope* compilationEnclosingScope() const override { + return enclosingScope_; + } +}; + +inline EvalSharedContext* +SharedContext::asEvalContext() +{ + MOZ_ASSERT(isEvalContext()); + return static_cast<EvalSharedContext*>(this); +} + +class FunctionBox : public ObjectBox, public SharedContext +{ + // The parser handles tracing the fields below via the ObjectBox linked + // list. + + Scope* enclosingScope_; + + // Names from the named lambda scope, if a named lambda. + LexicalScope::Data* namedLambdaBindings_; + + // Names from the function scope. + FunctionScope::Data* functionScopeBindings_; + + // Names from the extra 'var' scope of the function, if the parameter list + // has expressions. + VarScope::Data* extraVarScopeBindings_; + + void initWithEnclosingScope(Scope* enclosingScope); + + public: + ParseNode* functionNode; /* back pointer used by asm.js for error messages */ + uint32_t bufStart; + uint32_t bufEnd; + uint32_t startLine; + uint32_t startColumn; + uint16_t length; + + uint8_t generatorKindBits_; /* The GeneratorKind of this function. */ + uint8_t asyncKindBits_; /* The FunctionAsyncKing of this function. */ + + bool isGenexpLambda:1; /* lambda from generator expression */ + bool hasDestructuringArgs:1; /* parameter list contains destructuring expression */ + bool hasParameterExprs:1; /* parameter list contains expressions */ + bool hasDirectEvalInParameterExpr:1; /* parameter list contains direct eval */ + bool hasDuplicateParameters:1; /* parameter list contains duplicate names */ + bool useAsm:1; /* see useAsmOrInsideUseAsm */ + bool insideUseAsm:1; /* see useAsmOrInsideUseAsm */ + bool isAnnexB:1; /* need to emit a synthesized Annex B assignment */ + bool wasEmitted:1; /* Bytecode has been emitted for this function. */ + + // Fields for use in heuristics. + bool declaredArguments:1; /* the Parser declared 'arguments' */ + bool usesArguments:1; /* contains a free use of 'arguments' */ + bool usesApply:1; /* contains an f.apply() call */ + bool usesThis:1; /* contains 'this' */ + bool usesReturn:1; /* contains a 'return' statement */ + + FunctionContextFlags funCxFlags; + + FunctionBox(ExclusiveContext* cx, LifoAlloc& alloc, ObjectBox* traceListHead, JSFunction* fun, + Directives directives, bool extraWarnings, GeneratorKind generatorKind, + FunctionAsyncKind asyncKind); + + MutableHandle<LexicalScope::Data*> namedLambdaBindings() { + MOZ_ASSERT(context->compartment()->runtimeFromAnyThread()->keepAtoms()); + return MutableHandle<LexicalScope::Data*>::fromMarkedLocation(&namedLambdaBindings_); + } + + MutableHandle<FunctionScope::Data*> functionScopeBindings() { + MOZ_ASSERT(context->compartment()->runtimeFromAnyThread()->keepAtoms()); + return MutableHandle<FunctionScope::Data*>::fromMarkedLocation(&functionScopeBindings_); + } + + MutableHandle<VarScope::Data*> extraVarScopeBindings() { + MOZ_ASSERT(context->compartment()->runtimeFromAnyThread()->keepAtoms()); + return MutableHandle<VarScope::Data*>::fromMarkedLocation(&extraVarScopeBindings_); + } + + void initFromLazyFunction(); + void initStandaloneFunction(Scope* enclosingScope); + void initWithEnclosingParseContext(ParseContext* enclosing, FunctionSyntaxKind kind); + + ObjectBox* toObjectBox() override { return this; } + JSFunction* function() const { return &object->as<JSFunction>(); } + + Scope* compilationEnclosingScope() const override { + // This method is used to distinguish the outermost SharedContext. If + // a FunctionBox is the outermost SharedContext, it must be a lazy + // function. + MOZ_ASSERT_IF(function()->isInterpretedLazy(), + enclosingScope_ == function()->lazyScript()->enclosingScope()); + return enclosingScope_; + } + + bool needsCallObjectRegardlessOfBindings() const { + return hasExtensibleScope() || + needsHomeObject() || + isDerivedClassConstructor() || + isGenerator(); + } + + bool hasExtraBodyVarScope() const { + return hasParameterExprs && + (extraVarScopeBindings_ || + needsExtraBodyVarEnvironmentRegardlessOfBindings()); + } + + bool needsExtraBodyVarEnvironmentRegardlessOfBindings() const { + MOZ_ASSERT(hasParameterExprs); + return hasExtensibleScope() || isGenerator(); + } + + bool isLikelyConstructorWrapper() const { + return usesArguments && usesApply && usesThis && !usesReturn; + } + + GeneratorKind generatorKind() const { return GeneratorKindFromBits(generatorKindBits_); } + bool isGenerator() const { return generatorKind() != NotGenerator; } + bool isLegacyGenerator() const { return generatorKind() == LegacyGenerator; } + bool isStarGenerator() const { return generatorKind() == StarGenerator; } + FunctionAsyncKind asyncKind() const { return AsyncKindFromBits(asyncKindBits_); } + bool isAsync() const { return asyncKind() == AsyncFunction; } + bool isArrow() const { return function()->isArrow(); } + + void setGeneratorKind(GeneratorKind kind) { + // A generator kind can be set at initialization, or when "yield" is + // first seen. In both cases the transition can only happen from + // NotGenerator. + MOZ_ASSERT(!isGenerator()); + generatorKindBits_ = GeneratorKindAsBits(kind); + } + + bool hasExtensibleScope() const { return funCxFlags.hasExtensibleScope; } + bool hasThisBinding() const { return funCxFlags.hasThisBinding; } + bool argumentsHasLocalBinding() const { return funCxFlags.argumentsHasLocalBinding; } + bool definitelyNeedsArgsObj() const { return funCxFlags.definitelyNeedsArgsObj; } + bool needsHomeObject() const { return funCxFlags.needsHomeObject; } + bool isDerivedClassConstructor() const { return funCxFlags.isDerivedClassConstructor; } + bool hasInnerFunctions() const { return funCxFlags.hasInnerFunctions; } + + void setHasExtensibleScope() { funCxFlags.hasExtensibleScope = true; } + void setHasThisBinding() { funCxFlags.hasThisBinding = true; } + void setArgumentsHasLocalBinding() { funCxFlags.argumentsHasLocalBinding = true; } + void setDefinitelyNeedsArgsObj() { MOZ_ASSERT(funCxFlags.argumentsHasLocalBinding); + funCxFlags.definitelyNeedsArgsObj = true; } + void setNeedsHomeObject() { MOZ_ASSERT(function()->allowSuperProperty()); + funCxFlags.needsHomeObject = true; } + void setDerivedClassConstructor() { MOZ_ASSERT(function()->isClassConstructor()); + funCxFlags.isDerivedClassConstructor = true; } + void setHasInnerFunctions() { funCxFlags.hasInnerFunctions = true; } + + bool hasSimpleParameterList() const { + return !function()->hasRest() && !hasParameterExprs && !hasDestructuringArgs; + } + + bool hasMappedArgsObj() const { + return !strict() && hasSimpleParameterList(); + } + + // Return whether this or an enclosing function is being parsed and + // validated as asm.js. Note: if asm.js validation fails, this will be false + // while the function is being reparsed. This flag can be used to disable + // certain parsing features that are necessary in general, but unnecessary + // for validated asm.js. + bool useAsmOrInsideUseAsm() const { + return useAsm || insideUseAsm; + } + + void setStart(const TokenStream& tokenStream) { + bufStart = tokenStream.currentToken().pos.begin; + tokenStream.srcCoords.lineNumAndColumnIndex(bufStart, &startLine, &startColumn); + } + + void trace(JSTracer* trc) override; +}; + +inline FunctionBox* +SharedContext::asFunctionBox() +{ + MOZ_ASSERT(isFunctionBox()); + return static_cast<FunctionBox*>(this); +} + +class MOZ_STACK_CLASS ModuleSharedContext : public SharedContext +{ + RootedModuleObject module_; + RootedScope enclosingScope_; + + public: + Rooted<ModuleScope::Data*> bindings; + ModuleBuilder& builder; + + ModuleSharedContext(ExclusiveContext* cx, ModuleObject* module, Scope* enclosingScope, + ModuleBuilder& builder); + + HandleModuleObject module() const { return module_; } + Scope* compilationEnclosingScope() const override { return enclosingScope_; } +}; + +inline ModuleSharedContext* +SharedContext::asModuleContext() +{ + MOZ_ASSERT(isModuleContext()); + return static_cast<ModuleSharedContext*>(this); +} + +// In generators, we treat all bindings as closed so that they get stored on +// the heap. This way there is less information to copy off the stack when +// suspending, and back on when resuming. It also avoids the need to create +// and invalidate DebugScope proxies for unaliased locals in a generator +// frame, as the generator frame will be copied out to the heap and released +// only by GC. +inline bool +SharedContext::allBindingsClosedOver() +{ + return bindingsAccessedDynamically() || (isFunctionBox() && asFunctionBox()->isGenerator()); +} + +} // namespace frontend +} // namespace js + +#endif /* frontend_SharedContext_h */ diff --git a/js/src/frontend/SourceNotes.h b/js/src/frontend/SourceNotes.h new file mode 100644 index 000000000..dd2a95ad1 --- /dev/null +++ b/js/src/frontend/SourceNotes.h @@ -0,0 +1,207 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- + * vim: set ts=8 sts=4 et sw=4 tw=99: + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#ifndef frontend_SourceNotes_h +#define frontend_SourceNotes_h + +#include <stdint.h> + +#include "jstypes.h" + +typedef uint8_t jssrcnote; + +namespace js { + +/* + * Source notes generated along with bytecode for decompiling and debugging. + * A source note is a uint8_t with 5 bits of type and 3 of offset from the pc + * of the previous note. If 3 bits of offset aren't enough, extended delta + * notes (SRC_XDELTA) consisting of 2 set high order bits followed by 6 offset + * bits are emitted before the next note. Some notes have operand offsets + * encoded immediately after them, in note bytes or byte-triples. + * + * Source Note Extended Delta + * +7-6-5-4-3+2-1-0+ +7-6-5+4-3-2-1-0+ + * |note-type|delta| |1 1| ext-delta | + * +---------+-----+ +---+-----------+ + * + * At most one "gettable" note (i.e., a note of type other than SRC_NEWLINE, + * SRC_COLSPAN, SRC_SETLINE, and SRC_XDELTA) applies to a given bytecode. + * + * NB: the js_SrcNoteSpec array in BytecodeEmitter.cpp is indexed by this + * enum, so its initializers need to match the order here. + */ +#define FOR_EACH_SRC_NOTE_TYPE(M) \ + M(SRC_NULL, "null", 0) /* Terminates a note vector. */ \ + M(SRC_IF, "if", 0) /* JSOP_IFEQ bytecode is from an if-then. */ \ + M(SRC_IF_ELSE, "if-else", 1) /* JSOP_IFEQ bytecode is from an if-then-else. */ \ + M(SRC_COND, "cond", 1) /* JSOP_IFEQ is from conditional ?: operator. */ \ + M(SRC_FOR, "for", 3) /* JSOP_NOP or JSOP_POP in for(;;) loop head. */ \ + M(SRC_WHILE, "while", 1) /* JSOP_GOTO to for or while loop condition from before \ + loop, else JSOP_NOP at top of do-while loop. */ \ + M(SRC_FOR_IN, "for-in", 1) /* JSOP_GOTO to for-in loop condition from before \ + loop. */ \ + M(SRC_FOR_OF, "for-of", 1) /* JSOP_GOTO to for-of loop condition from before \ + loop. */ \ + M(SRC_CONTINUE, "continue", 0) /* JSOP_GOTO is a continue. */ \ + M(SRC_BREAK, "break", 0) /* JSOP_GOTO is a break. */ \ + M(SRC_BREAK2LABEL, "break2label", 0) /* JSOP_GOTO for 'break label'. */ \ + M(SRC_SWITCHBREAK, "switchbreak", 0) /* JSOP_GOTO is a break in a switch. */ \ + M(SRC_TABLESWITCH, "tableswitch", 1) /* JSOP_TABLESWITCH; offset points to end of switch. */ \ + M(SRC_CONDSWITCH, "condswitch", 2) /* JSOP_CONDSWITCH; 1st offset points to end of switch, \ + 2nd points to first JSOP_CASE. */ \ + M(SRC_NEXTCASE, "nextcase", 1) /* Distance forward from one CASE in a CONDSWITCH to \ + the next. */ \ + M(SRC_ASSIGNOP, "assignop", 0) /* += or another assign-op follows. */ \ + M(SRC_TRY, "try", 1) /* JSOP_TRY, offset points to goto at the end of the \ + try block. */ \ + /* All notes above here are "gettable". See SN_IS_GETTABLE below. */ \ + M(SRC_COLSPAN, "colspan", 1) /* Number of columns this opcode spans. */ \ + M(SRC_NEWLINE, "newline", 0) /* Bytecode follows a source newline. */ \ + M(SRC_SETLINE, "setline", 1) /* A file-absolute source line number note. */ \ + M(SRC_UNUSED20, "unused20", 0) /* Unused. */ \ + M(SRC_UNUSED21, "unused21", 0) /* Unused. */ \ + M(SRC_UNUSED22, "unused22", 0) /* Unused. */ \ + M(SRC_UNUSED23, "unused23", 0) /* Unused. */ \ + M(SRC_XDELTA, "xdelta", 0) /* 24-31 are for extended delta notes. */ + +enum SrcNoteType { +#define DEFINE_SRC_NOTE_TYPE(sym, name, arity) sym, + FOR_EACH_SRC_NOTE_TYPE(DEFINE_SRC_NOTE_TYPE) +#undef DEFINE_SRC_NOTE_TYPE + + SRC_LAST, + SRC_LAST_GETTABLE = SRC_TRY +}; + +static_assert(SRC_XDELTA == 24, "SRC_XDELTA should be 24"); + +/* A source note array is terminated by an all-zero element. */ +inline void +SN_MAKE_TERMINATOR(jssrcnote* sn) +{ + *sn = SRC_NULL; +} + +inline bool +SN_IS_TERMINATOR(jssrcnote* sn) +{ + return *sn == SRC_NULL; +} + +} // namespace js + +#define SN_TYPE_BITS 5 +#define SN_DELTA_BITS 3 +#define SN_XDELTA_BITS 6 +#define SN_TYPE_MASK (JS_BITMASK(SN_TYPE_BITS) << SN_DELTA_BITS) +#define SN_DELTA_MASK ((ptrdiff_t)JS_BITMASK(SN_DELTA_BITS)) +#define SN_XDELTA_MASK ((ptrdiff_t)JS_BITMASK(SN_XDELTA_BITS)) + +#define SN_MAKE_NOTE(sn,t,d) (*(sn) = (jssrcnote) \ + (((t) << SN_DELTA_BITS) \ + | ((d) & SN_DELTA_MASK))) +#define SN_MAKE_XDELTA(sn,d) (*(sn) = (jssrcnote) \ + ((SRC_XDELTA << SN_DELTA_BITS) \ + | ((d) & SN_XDELTA_MASK))) + +#define SN_IS_XDELTA(sn) ((*(sn) >> SN_DELTA_BITS) >= SRC_XDELTA) +#define SN_TYPE(sn) ((js::SrcNoteType)(SN_IS_XDELTA(sn) \ + ? SRC_XDELTA \ + : *(sn) >> SN_DELTA_BITS)) +#define SN_SET_TYPE(sn,type) SN_MAKE_NOTE(sn, type, SN_DELTA(sn)) +#define SN_IS_GETTABLE(sn) (SN_TYPE(sn) <= SRC_LAST_GETTABLE) + +#define SN_DELTA(sn) ((ptrdiff_t)(SN_IS_XDELTA(sn) \ + ? *(sn) & SN_XDELTA_MASK \ + : *(sn) & SN_DELTA_MASK)) +#define SN_SET_DELTA(sn,delta) (SN_IS_XDELTA(sn) \ + ? SN_MAKE_XDELTA(sn, delta) \ + : SN_MAKE_NOTE(sn, SN_TYPE(sn), delta)) + +#define SN_DELTA_LIMIT ((ptrdiff_t)JS_BIT(SN_DELTA_BITS)) +#define SN_XDELTA_LIMIT ((ptrdiff_t)JS_BIT(SN_XDELTA_BITS)) + +/* + * Offset fields follow certain notes and are frequency-encoded: an offset in + * [0,0x7f] consumes one byte, an offset in [0x80,0x7fffffff] takes four, and + * the high bit of the first byte is set. + */ +#define SN_4BYTE_OFFSET_FLAG 0x80 +#define SN_4BYTE_OFFSET_MASK 0x7f + +#define SN_OFFSET_BITS 31 +#define SN_MAX_OFFSET (((size_t) 1 << SN_OFFSET_BITS) - 1) + +inline bool +SN_REPRESENTABLE_OFFSET(ptrdiff_t offset) +{ + return 0 <= offset && size_t(offset) <= SN_MAX_OFFSET; +} + +/* + * SRC_COLSPAN values represent changes to the column number. Colspans are + * signed: negative changes arise in describing constructs like for(;;) loops, + * that generate code in non-source order. (Negative colspans also have a + * history of indicating bugs in updating ParseNodes' source locations.) + * + * We store colspans using the same variable-length encoding as offsets, + * described above. However, unlike offsets, colspans are signed, so we truncate + * colspans (SN_COLSPAN_TO_OFFSET) for storage as offsets, and sign-extend + * offsets into colspans when we read them (SN_OFFSET_TO_COLSPAN). + */ +#define SN_COLSPAN_SIGN_BIT (1 << (SN_OFFSET_BITS - 1)) +#define SN_MIN_COLSPAN (-SN_COLSPAN_SIGN_BIT) +#define SN_MAX_COLSPAN (SN_COLSPAN_SIGN_BIT - 1) + +inline bool +SN_REPRESENTABLE_COLSPAN(ptrdiff_t colspan) +{ + return SN_MIN_COLSPAN <= colspan && colspan <= SN_MAX_COLSPAN; +} + +inline ptrdiff_t +SN_OFFSET_TO_COLSPAN(ptrdiff_t offset) { + // There should be no bits set outside the field we're going to sign-extend. + MOZ_ASSERT(!(offset & ~((1U << SN_OFFSET_BITS) - 1))); + // Sign-extend the least significant SN_OFFSET_BITS bits. + return (offset ^ SN_COLSPAN_SIGN_BIT) - SN_COLSPAN_SIGN_BIT; +} + +inline ptrdiff_t +SN_COLSPAN_TO_OFFSET(ptrdiff_t colspan) { + // Truncate the two's complement colspan, for storage as an offset. + ptrdiff_t offset = colspan & ((1U << SN_OFFSET_BITS) - 1); + // When we read this back, we'd better get the value we stored. + MOZ_ASSERT(SN_OFFSET_TO_COLSPAN(offset) == colspan); + return offset; +} + +#define SN_LENGTH(sn) ((js_SrcNoteSpec[SN_TYPE(sn)].arity == 0) ? 1 \ + : js::SrcNoteLength(sn)) +#define SN_NEXT(sn) ((sn) + SN_LENGTH(sn)) + +struct JSSrcNoteSpec { + const char* name; /* name for disassembly/debugging output */ + int8_t arity; /* number of offset operands */ +}; + +extern JS_FRIEND_DATA(const JSSrcNoteSpec) js_SrcNoteSpec[]; + +namespace js { + +extern JS_FRIEND_API(unsigned) +SrcNoteLength(jssrcnote* sn); + +/* + * Get and set the offset operand identified by which (0 for the first, etc.). + */ +extern JS_FRIEND_API(ptrdiff_t) +GetSrcNoteOffset(jssrcnote* sn, unsigned which); + +} // namespace js + +#endif /* frontend_SourceNotes_h */ diff --git a/js/src/frontend/SyntaxParseHandler.h b/js/src/frontend/SyntaxParseHandler.h new file mode 100644 index 000000000..75c7e3333 --- /dev/null +++ b/js/src/frontend/SyntaxParseHandler.h @@ -0,0 +1,599 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- + * vim: set ts=8 sts=4 et sw=4 tw=99: + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#ifndef frontend_SyntaxParseHandler_h +#define frontend_SyntaxParseHandler_h + +#include "mozilla/Attributes.h" + +#include "frontend/ParseNode.h" +#include "frontend/TokenStream.h" + +namespace js { +namespace frontend { + +template <typename ParseHandler> +class Parser; + +// Parse handler used when processing the syntax in a block of code, to generate +// the minimal information which is required to detect syntax errors and allow +// bytecode to be emitted for outer functions. +// +// When parsing, we start at the top level with a full parse, and when possible +// only check the syntax for inner functions, so that they can be lazily parsed +// into bytecode when/if they first run. Checking the syntax of a function is +// several times faster than doing a full parse/emit, and lazy parsing improves +// both performance and memory usage significantly when pages contain large +// amounts of code that never executes (which happens often). +class SyntaxParseHandler +{ + // Remember the last encountered name or string literal during syntax parses. + JSAtom* lastAtom; + TokenPos lastStringPos; + TokenStream& tokenStream; + + public: + enum Node { + NodeFailure = 0, + NodeGeneric, + NodeGetProp, + NodeStringExprStatement, + NodeReturn, + NodeBreak, + NodeThrow, + NodeEmptyStatement, + + NodeVarDeclaration, + NodeLexicalDeclaration, + + NodeFunctionDefinition, + + // This is needed for proper assignment-target handling. ES6 formally + // requires function calls *not* pass IsValidSimpleAssignmentTarget, + // but at last check there were still sites with |f() = 5| and similar + // in code not actually executed (or at least not executed enough to be + // noticed). + NodeFunctionCall, + + // Nodes representing *parenthesized* IsValidSimpleAssignmentTarget + // nodes. We can't simply treat all such parenthesized nodes + // identically, because in assignment and increment/decrement contexts + // ES6 says that parentheses constitute a syntax error. + // + // var obj = {}; + // var val; + // (val) = 3; (obj.prop) = 4; // okay per ES5's little mind + // [(a)] = [3]; [(obj.prop)] = [4]; // invalid ES6 syntax + // // ...and so on for the other IsValidSimpleAssignmentTarget nodes + // + // We don't know in advance in the current parser when we're parsing + // in a place where name parenthesization changes meaning, so we must + // have multiple node values for these cases. + NodeParenthesizedArgumentsName, + NodeParenthesizedEvalName, + NodeParenthesizedName, + + NodeDottedProperty, + NodeElement, + + // Destructuring target patterns can't be parenthesized: |([a]) = [3];| + // must be a syntax error. (We can't use NodeGeneric instead of these + // because that would trigger invalid-left-hand-side ReferenceError + // semantics when SyntaxError semantics are desired.) + NodeParenthesizedArray, + NodeParenthesizedObject, + + // In rare cases a parenthesized |node| doesn't have the same semantics + // as |node|. Each such node has a special Node value, and we use a + // different Node value to represent the parenthesized form. See also + // is{Unp,P}arenthesized*(Node), parenthesize(Node), and the various + // functions that deal in NodeUnparenthesized* below. + + // Nodes representing unparenthesized names. + NodeUnparenthesizedArgumentsName, + NodeUnparenthesizedAsyncName, + NodeUnparenthesizedEvalName, + NodeUnparenthesizedName, + + // Valuable for recognizing potential destructuring patterns. + NodeUnparenthesizedArray, + NodeUnparenthesizedObject, + + // The directive prologue at the start of a FunctionBody or ScriptBody + // is the longest sequence (possibly empty) of string literal + // expression statements at the start of a function. Thus we need this + // to treat |"use strict";| as a possible Use Strict Directive and + // |("use strict");| as a useless statement. + NodeUnparenthesizedString, + + // Legacy generator expressions of the form |(expr for (...))| and + // array comprehensions of the form |[expr for (...)]|) don't permit + // |expr| to be a comma expression. Thus we need this to treat + // |(a(), b for (x in []))| as a syntax error and + // |((a(), b) for (x in []))| as a generator that calls |a| and then + // yields |b| each time it's resumed. + NodeUnparenthesizedCommaExpr, + + // Assignment expressions in condition contexts could be typos for + // equality checks. (Think |if (x = y)| versus |if (x == y)|.) Thus + // we need this to treat |if (x = y)| as a possible typo and + // |if ((x = y))| as a deliberate assignment within a condition. + // + // (Technically this isn't needed, as these are *only* extraWarnings + // warnings, and parsing with that option disables syntax parsing. But + // it seems best to be consistent, and perhaps the syntax parser will + // eventually enforce extraWarnings and will require this then.) + NodeUnparenthesizedAssignment, + + // This node is necessary to determine if the base operand in an + // exponentiation operation is an unparenthesized unary expression. + // We want to reject |-2 ** 3|, but still need to allow |(-2) ** 3|. + NodeUnparenthesizedUnary, + + // This node is necessary to determine if the LHS of a property access is + // super related. + NodeSuperBase + }; + + bool isPropertyAccess(Node node) { + return node == NodeDottedProperty || node == NodeElement; + } + + bool isFunctionCall(Node node) { + // Note: super() is a special form, *not* a function call. + return node == NodeFunctionCall; + } + + static bool isUnparenthesizedDestructuringPattern(Node node) { + return node == NodeUnparenthesizedArray || node == NodeUnparenthesizedObject; + } + + static bool isParenthesizedDestructuringPattern(Node node) { + // Technically this isn't a destructuring target at all -- the grammar + // doesn't treat it as such. But we need to know when this happens to + // consider it a SyntaxError rather than an invalid-left-hand-side + // ReferenceError. + return node == NodeParenthesizedArray || node == NodeParenthesizedObject; + } + + static bool isDestructuringPatternAnyParentheses(Node node) { + return isUnparenthesizedDestructuringPattern(node) || + isParenthesizedDestructuringPattern(node); + } + + public: + SyntaxParseHandler(ExclusiveContext* cx, LifoAlloc& alloc, + TokenStream& tokenStream, Parser<SyntaxParseHandler>* syntaxParser, + LazyScript* lazyOuterFunction) + : lastAtom(nullptr), + tokenStream(tokenStream) + {} + + static Node null() { return NodeFailure; } + + void prepareNodeForMutation(Node node) {} + void freeTree(Node node) {} + + void trace(JSTracer* trc) {} + + Node newName(PropertyName* name, const TokenPos& pos, ExclusiveContext* cx) { + lastAtom = name; + if (name == cx->names().arguments) + return NodeUnparenthesizedArgumentsName; + if (name == cx->names().async) + return NodeUnparenthesizedAsyncName; + if (name == cx->names().eval) + return NodeUnparenthesizedEvalName; + return NodeUnparenthesizedName; + } + + Node newComputedName(Node expr, uint32_t start, uint32_t end) { + return NodeGeneric; + } + + Node newObjectLiteralPropertyName(JSAtom* atom, const TokenPos& pos) { + return NodeUnparenthesizedName; + } + + Node newNumber(double value, DecimalPoint decimalPoint, const TokenPos& pos) { return NodeGeneric; } + Node newBooleanLiteral(bool cond, const TokenPos& pos) { return NodeGeneric; } + + Node newStringLiteral(JSAtom* atom, const TokenPos& pos) { + lastAtom = atom; + lastStringPos = pos; + return NodeUnparenthesizedString; + } + + Node newTemplateStringLiteral(JSAtom* atom, const TokenPos& pos) { + return NodeGeneric; + } + + Node newCallSiteObject(uint32_t begin) { + return NodeGeneric; + } + + void addToCallSiteObject(Node callSiteObj, Node rawNode, Node cookedNode) {} + + Node newThisLiteral(const TokenPos& pos, Node thisName) { return NodeGeneric; } + Node newNullLiteral(const TokenPos& pos) { return NodeGeneric; } + + template <class Boxer> + Node newRegExp(RegExpObject* reobj, const TokenPos& pos, Boxer& boxer) { return NodeGeneric; } + + Node newConditional(Node cond, Node thenExpr, Node elseExpr) { return NodeGeneric; } + + Node newElision() { return NodeGeneric; } + + Node newDelete(uint32_t begin, Node expr) { + return NodeUnparenthesizedUnary; + } + + Node newTypeof(uint32_t begin, Node kid) { + return NodeUnparenthesizedUnary; + } + + Node newUnary(ParseNodeKind kind, JSOp op, uint32_t begin, Node kid) { + return NodeUnparenthesizedUnary; + } + + Node newUpdate(ParseNodeKind kind, uint32_t begin, Node kid) { + return NodeGeneric; + } + + Node newSpread(uint32_t begin, Node kid) { + return NodeGeneric; + } + + Node newArrayPush(uint32_t begin, Node kid) { + return NodeGeneric; + } + + Node newBinary(ParseNodeKind kind, JSOp op = JSOP_NOP) { return NodeGeneric; } + Node newBinary(ParseNodeKind kind, Node left, JSOp op = JSOP_NOP) { return NodeGeneric; } + Node newBinary(ParseNodeKind kind, Node left, Node right, JSOp op = JSOP_NOP) { + return NodeGeneric; + } + Node appendOrCreateList(ParseNodeKind kind, Node left, Node right, + ParseContext* pc, JSOp op = JSOP_NOP) { + return NodeGeneric; + } + + Node newTernary(ParseNodeKind kind, Node first, Node second, Node third, JSOp op = JSOP_NOP) { + return NodeGeneric; + } + + // Expressions + + Node newArrayComprehension(Node body, const TokenPos& pos) { return NodeGeneric; } + Node newArrayLiteral(uint32_t begin) { return NodeUnparenthesizedArray; } + MOZ_MUST_USE bool addElision(Node literal, const TokenPos& pos) { return true; } + MOZ_MUST_USE bool addSpreadElement(Node literal, uint32_t begin, Node inner) { return true; } + void addArrayElement(Node literal, Node element) { } + + Node newCall() { return NodeFunctionCall; } + Node newTaggedTemplate() { return NodeGeneric; } + + Node newObjectLiteral(uint32_t begin) { return NodeUnparenthesizedObject; } + Node newClassMethodList(uint32_t begin) { return NodeGeneric; } + Node newClassNames(Node outer, Node inner, const TokenPos& pos) { return NodeGeneric; } + Node newClass(Node name, Node heritage, Node methodBlock) { return NodeGeneric; } + + Node newNewTarget(Node newHolder, Node targetHolder) { return NodeGeneric; } + Node newPosHolder(const TokenPos& pos) { return NodeGeneric; } + Node newSuperBase(Node thisName, const TokenPos& pos) { return NodeSuperBase; } + + MOZ_MUST_USE bool addPrototypeMutation(Node literal, uint32_t begin, Node expr) { return true; } + MOZ_MUST_USE bool addPropertyDefinition(Node literal, Node name, Node expr) { return true; } + MOZ_MUST_USE bool addShorthand(Node literal, Node name, Node expr) { return true; } + MOZ_MUST_USE bool addObjectMethodDefinition(Node literal, Node name, Node fn, JSOp op) { return true; } + MOZ_MUST_USE bool addClassMethodDefinition(Node literal, Node name, Node fn, JSOp op, bool isStatic) { return true; } + Node newYieldExpression(uint32_t begin, Node value, Node gen) { return NodeGeneric; } + Node newYieldStarExpression(uint32_t begin, Node value, Node gen) { return NodeGeneric; } + Node newAwaitExpression(uint32_t begin, Node value, Node gen) { return NodeGeneric; } + + // Statements + + Node newStatementList(const TokenPos& pos) { return NodeGeneric; } + void addStatementToList(Node list, Node stmt) {} + void addCaseStatementToList(Node list, Node stmt) {} + MOZ_MUST_USE bool prependInitialYield(Node stmtList, Node gen) { return true; } + Node newEmptyStatement(const TokenPos& pos) { return NodeEmptyStatement; } + + Node newSetThis(Node thisName, Node value) { return value; } + + Node newExprStatement(Node expr, uint32_t end) { + return expr == NodeUnparenthesizedString ? NodeStringExprStatement : NodeGeneric; + } + + Node newIfStatement(uint32_t begin, Node cond, Node then, Node else_) { return NodeGeneric; } + Node newDoWhileStatement(Node body, Node cond, const TokenPos& pos) { return NodeGeneric; } + Node newWhileStatement(uint32_t begin, Node cond, Node body) { return NodeGeneric; } + Node newSwitchStatement(uint32_t begin, Node discriminant, Node caseList) { return NodeGeneric; } + Node newCaseOrDefault(uint32_t begin, Node expr, Node body) { return NodeGeneric; } + Node newContinueStatement(PropertyName* label, const TokenPos& pos) { return NodeGeneric; } + Node newBreakStatement(PropertyName* label, const TokenPos& pos) { return NodeBreak; } + Node newReturnStatement(Node expr, const TokenPos& pos) { return NodeReturn; } + Node newWithStatement(uint32_t begin, Node expr, Node body) { return NodeGeneric; } + + Node newLabeledStatement(PropertyName* label, Node stmt, uint32_t begin) { + return NodeGeneric; + } + + Node newThrowStatement(Node expr, const TokenPos& pos) { return NodeThrow; } + Node newTryStatement(uint32_t begin, Node body, Node catchList, Node finallyBlock) { + return NodeGeneric; + } + Node newDebuggerStatement(const TokenPos& pos) { return NodeGeneric; } + + Node newPropertyAccess(Node pn, PropertyName* name, uint32_t end) { + lastAtom = name; + return NodeDottedProperty; + } + + Node newPropertyByValue(Node pn, Node kid, uint32_t end) { return NodeElement; } + + MOZ_MUST_USE bool addCatchBlock(Node catchList, Node letBlock, Node catchName, + Node catchGuard, Node catchBody) { return true; } + + MOZ_MUST_USE bool setLastFunctionFormalParameterDefault(Node funcpn, Node pn) { return true; } + Node newFunctionDefinition() { return NodeFunctionDefinition; } + bool setComprehensionLambdaBody(Node pn, Node body) { return true; } + void setFunctionFormalParametersAndBody(Node pn, Node kid) {} + void setFunctionBody(Node pn, Node kid) {} + void setFunctionBox(Node pn, FunctionBox* funbox) {} + void addFunctionFormalParameter(Node pn, Node argpn) {} + + Node newForStatement(uint32_t begin, Node forHead, Node body, unsigned iflags) { + return NodeGeneric; + } + + Node newComprehensionFor(uint32_t begin, Node forHead, Node body) { + return NodeGeneric; + } + + Node newComprehensionBinding(Node kid) { + // Careful: we're asking this well after the name was parsed, so the + // value returned may not correspond to |kid|'s actual name. But it + // *will* be truthy iff |kid| was a name, so we're safe. + MOZ_ASSERT(isUnparenthesizedName(kid)); + return NodeGeneric; + } + + Node newForHead(Node init, Node test, Node update, const TokenPos& pos) { + return NodeGeneric; + } + + Node newForInOrOfHead(ParseNodeKind kind, Node target, Node iteratedExpr, const TokenPos& pos) { + return NodeGeneric; + } + + MOZ_MUST_USE bool finishInitializerAssignment(Node pn, Node init) { return true; } + + void setBeginPosition(Node pn, Node oth) {} + void setBeginPosition(Node pn, uint32_t begin) {} + + void setEndPosition(Node pn, Node oth) {} + void setEndPosition(Node pn, uint32_t end) {} + + void setPosition(Node pn, const TokenPos& pos) {} + TokenPos getPosition(Node pn) { + return tokenStream.currentToken().pos; + } + + Node newList(ParseNodeKind kind, JSOp op = JSOP_NOP) { + MOZ_ASSERT(kind != PNK_VAR); + MOZ_ASSERT(kind != PNK_LET); + MOZ_ASSERT(kind != PNK_CONST); + return NodeGeneric; + } + Node newList(ParseNodeKind kind, uint32_t begin, JSOp op = JSOP_NOP) { + return newList(kind, op); + } + Node newList(ParseNodeKind kind, Node kid, JSOp op = JSOP_NOP) { + return newList(kind, op); + } + + Node newDeclarationList(ParseNodeKind kind, JSOp op = JSOP_NOP) { + if (kind == PNK_VAR) + return NodeVarDeclaration; + MOZ_ASSERT(kind == PNK_LET || kind == PNK_CONST); + return NodeLexicalDeclaration; + } + Node newDeclarationList(ParseNodeKind kind, Node kid, JSOp op = JSOP_NOP) { + return newDeclarationList(kind, op); + } + + bool isDeclarationList(Node node) { + return node == NodeVarDeclaration || node == NodeLexicalDeclaration; + } + + Node singleBindingFromDeclaration(Node decl) { + MOZ_ASSERT(isDeclarationList(decl)); + + // This is, unfortunately, very dodgy. Obviously NodeVarDeclaration + // and NodeLexicalDeclaration can store no info on the arbitrary + // number of bindings it could contain. + // + // But this method is called only for cloning for-in/of declarations + // as initialization targets. That context simplifies matters. If the + // binding is a single name, it'll always syntax-parse (or it would + // already have been rejected as assigning/binding a forbidden name). + // Otherwise the binding is a destructuring pattern. But syntax + // parsing would *already* have aborted when it saw a destructuring + // pattern. So we can just say any old thing here, because the only + // time we'll be wrong is a case that syntax parsing has already + // rejected. Use NodeUnparenthesizedName so the SyntaxParseHandler + // Parser::cloneLeftHandSide can assert it sees only this. + return NodeUnparenthesizedName; + } + + Node newCatchList() { + return newList(PNK_CATCHLIST, JSOP_NOP); + } + + Node newCommaExpressionList(Node kid) { + return NodeUnparenthesizedCommaExpr; + } + + void addList(Node list, Node kid) { + MOZ_ASSERT(list == NodeGeneric || + list == NodeUnparenthesizedArray || + list == NodeUnparenthesizedObject || + list == NodeUnparenthesizedCommaExpr || + list == NodeVarDeclaration || + list == NodeLexicalDeclaration || + list == NodeFunctionCall); + } + + Node newAssignment(ParseNodeKind kind, Node lhs, Node rhs, JSOp op) { + if (kind == PNK_ASSIGN) + return NodeUnparenthesizedAssignment; + return newBinary(kind, lhs, rhs, op); + } + + bool isUnparenthesizedCommaExpression(Node node) { + return node == NodeUnparenthesizedCommaExpr; + } + + bool isUnparenthesizedAssignment(Node node) { + return node == NodeUnparenthesizedAssignment; + } + + bool isUnparenthesizedUnaryExpression(Node node) { + return node == NodeUnparenthesizedUnary; + } + + bool isReturnStatement(Node node) { + return node == NodeReturn; + } + + bool isStatementPermittedAfterReturnStatement(Node pn) { + return pn == NodeFunctionDefinition || pn == NodeVarDeclaration || + pn == NodeBreak || + pn == NodeThrow || + pn == NodeEmptyStatement; + } + + bool isSuperBase(Node pn) { + return pn == NodeSuperBase; + } + + void setOp(Node pn, JSOp op) {} + void setListFlag(Node pn, unsigned flag) {} + MOZ_MUST_USE Node parenthesize(Node node) { + // A number of nodes have different behavior upon parenthesization, but + // only in some circumstances. Convert these nodes to special + // parenthesized forms. + if (node == NodeUnparenthesizedArgumentsName) + return NodeParenthesizedArgumentsName; + if (node == NodeUnparenthesizedEvalName) + return NodeParenthesizedEvalName; + if (node == NodeUnparenthesizedName || node == NodeUnparenthesizedAsyncName) + return NodeParenthesizedName; + + if (node == NodeUnparenthesizedArray) + return NodeParenthesizedArray; + if (node == NodeUnparenthesizedObject) + return NodeParenthesizedObject; + + // Other nodes need not be recognizable after parenthesization; convert + // them to a generic node. + if (node == NodeUnparenthesizedString || + node == NodeUnparenthesizedCommaExpr || + node == NodeUnparenthesizedAssignment || + node == NodeUnparenthesizedUnary) + { + return NodeGeneric; + } + + // In all other cases, the parenthesized form of |node| is equivalent + // to the unparenthesized form: return |node| unchanged. + return node; + } + MOZ_MUST_USE Node setLikelyIIFE(Node pn) { + return pn; // Remain in syntax-parse mode. + } + void setPrologue(Node pn) {} + + bool isConstant(Node pn) { return false; } + + bool isUnparenthesizedName(Node node) { + return node == NodeUnparenthesizedArgumentsName || + node == NodeUnparenthesizedAsyncName || + node == NodeUnparenthesizedEvalName || + node == NodeUnparenthesizedName; + } + + bool isNameAnyParentheses(Node node) { + if (isUnparenthesizedName(node)) + return true; + return node == NodeParenthesizedArgumentsName || + node == NodeParenthesizedEvalName || + node == NodeParenthesizedName; + } + + bool nameIsEvalAnyParentheses(Node node, ExclusiveContext* cx) { + MOZ_ASSERT(isNameAnyParentheses(node), + "must only call this function on known names"); + return node == NodeUnparenthesizedEvalName || node == NodeParenthesizedEvalName; + } + + const char* nameIsArgumentsEvalAnyParentheses(Node node, ExclusiveContext* cx) { + MOZ_ASSERT(isNameAnyParentheses(node), + "must only call this method on known names"); + + if (nameIsEvalAnyParentheses(node, cx)) + return js_eval_str; + if (node == NodeUnparenthesizedArgumentsName || node == NodeParenthesizedArgumentsName) + return js_arguments_str; + return nullptr; + } + + bool nameIsUnparenthesizedAsync(Node node, ExclusiveContext* cx) { + MOZ_ASSERT(isNameAnyParentheses(node), + "must only call this function on known names"); + return node == NodeUnparenthesizedAsyncName; + } + + PropertyName* maybeDottedProperty(Node node) { + // Note: |super.apply(...)| is a special form that calls an "apply" + // method retrieved from one value, but using a *different* value as + // |this|. It's not really eligible for the funapply/funcall + // optimizations as they're currently implemented (assuming a single + // value is used for both retrieval and |this|). + if (node != NodeDottedProperty) + return nullptr; + return lastAtom->asPropertyName(); + } + + JSAtom* isStringExprStatement(Node pn, TokenPos* pos) { + if (pn == NodeStringExprStatement) { + *pos = lastStringPos; + return lastAtom; + } + return nullptr; + } + + bool canSkipLazyInnerFunctions() { + return false; + } + bool canSkipLazyClosedOverBindings() { + return false; + } + JSAtom* nextLazyClosedOverBinding() { + MOZ_CRASH("SyntaxParseHandler::canSkipLazyClosedOverBindings must return false"); + } + + void adjustGetToSet(Node node) {} + + void disableSyntaxParser() { + } +}; + +} // namespace frontend +} // namespace js + +#endif /* frontend_SyntaxParseHandler_h */ diff --git a/js/src/frontend/TokenKind.h b/js/src/frontend/TokenKind.h new file mode 100644 index 000000000..6f22d78e5 --- /dev/null +++ b/js/src/frontend/TokenKind.h @@ -0,0 +1,245 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- + * vim: set ts=8 sts=4 et sw=4 tw=99: + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#ifndef frontend_TokenKind_h +#define frontend_TokenKind_h + +/* + * List of token kinds and their ranges. + * + * The format for each line is: + * + * macro(<TOKEN_KIND_NAME>, <DESCRIPTION>) + * + * or + * + * range(<TOKEN_RANGE_NAME>, <TOKEN_KIND_NAME>) + * + * where ; + * <TOKEN_KIND_NAME> is a legal C identifier of the token, that will be used in + * the JS engine source, with `TOK_` prefix. + * + * <DESCRIPTION> is a string that describe about the token, and will be used in + * error message. + * + * <TOKEN_RANGE_NAME> is a legal C identifier of the range that will be used to + * JS engine source, with `TOK_` prefix. It should end with `_FIRST` or `_LAST`. + * This is used to check TokenKind by range-testing: + * TOK_BINOP_FIRST <= tt && tt <= TOK_BINOP_LAST + * + * Second argument of `range` is the actual value of the <TOKEN_RANGE_NAME>, + * should be same as one of <TOKEN_KIND_NAME> in other `macro`s. + * + * To use this macro, define two macros for `macro` and `range`, and pass them + * as arguments. + * + * #define EMIT_TOKEN(name, desc) ... + * #define EMIT_RANGE(name, value) ... + * FOR_EACH_TOKEN_KIND_WITH_RANGE(EMIT_TOKEN, EMIT_RANGE) + * #undef EMIT_TOKEN + * #undef EMIT_RANGE + * + * If you don't need range data, use FOR_EACH_TOKEN_KIND instead. + * + * #define EMIT_TOKEN(name, desc) ... + * FOR_EACH_TOKEN_KIND(EMIT_TOKEN) + * #undef EMIT_TOKEN + * + * Note that this list does not contain ERROR and LIMIT. + */ +#define FOR_EACH_TOKEN_KIND_WITH_RANGE(macro, range) \ + macro(EOF, "end of script") \ + \ + /* only returned by peekTokenSameLine() */ \ + macro(EOL, "line terminator") \ + \ + macro(SEMI, "';'") \ + macro(COMMA, "','") \ + macro(HOOK, "'?'") /* conditional */ \ + macro(COLON, "':'") /* conditional */ \ + macro(INC, "'++'") /* increment */ \ + macro(DEC, "'--'") /* decrement */ \ + macro(DOT, "'.'") /* member operator */ \ + macro(TRIPLEDOT, "'...'") /* rest arguments and spread operator */ \ + macro(LB, "'['") \ + macro(RB, "']'") \ + macro(LC, "'{'") \ + macro(RC, "'}'") \ + macro(LP, "'('") \ + macro(RP, "')'") \ + macro(NAME, "identifier") \ + macro(NUMBER, "numeric literal") \ + macro(STRING, "string literal") \ + \ + /* start of template literal with substitutions */ \ + macro(TEMPLATE_HEAD, "'${'") \ + /* template literal without substitutions */ \ + macro(NO_SUBS_TEMPLATE, "template literal") \ + \ + macro(REGEXP, "regular expression literal") \ + macro(TRUE, "boolean literal 'true'") \ + macro(FALSE, "boolean literal 'false'") \ + macro(NULL, "null literal") \ + macro(THIS, "keyword 'this'") \ + macro(FUNCTION, "keyword 'function'") \ + macro(IF, "keyword 'if'") \ + macro(ELSE, "keyword 'else'") \ + macro(SWITCH, "keyword 'switch'") \ + macro(CASE, "keyword 'case'") \ + macro(DEFAULT, "keyword 'default'") \ + macro(WHILE, "keyword 'while'") \ + macro(DO, "keyword 'do'") \ + macro(FOR, "keyword 'for'") \ + macro(BREAK, "keyword 'break'") \ + macro(CONTINUE, "keyword 'continue'") \ + macro(VAR, "keyword 'var'") \ + macro(CONST, "keyword 'const'") \ + macro(WITH, "keyword 'with'") \ + macro(RETURN, "keyword 'return'") \ + macro(NEW, "keyword 'new'") \ + macro(DELETE, "keyword 'delete'") \ + macro(TRY, "keyword 'try'") \ + macro(CATCH, "keyword 'catch'") \ + macro(FINALLY, "keyword 'finally'") \ + macro(THROW, "keyword 'throw'") \ + macro(DEBUGGER, "keyword 'debugger'") \ + macro(YIELD, "keyword 'yield'") \ + macro(AWAIT, "keyword 'await'") \ + macro(EXPORT, "keyword 'export'") \ + macro(IMPORT, "keyword 'import'") \ + macro(CLASS, "keyword 'class'") \ + macro(EXTENDS, "keyword 'extends'") \ + macro(SUPER, "keyword 'super'") \ + macro(RESERVED, "reserved keyword") \ + /* reserved keywords in strict mode */ \ + macro(STRICT_RESERVED, "reserved keyword") \ + \ + /* \ + * The following token types occupy contiguous ranges to enable easy \ + * range-testing. \ + */ \ + /* \ + * Binary operators tokens, TOK_OR thru TOK_POW. These must be in the same \ + * order as F(OR) and friends in FOR_EACH_PARSE_NODE_KIND in ParseNode.h. \ + */ \ + macro(OR, "'||'") /* logical or */ \ + range(BINOP_FIRST, OR) \ + macro(AND, "'&&'") /* logical and */ \ + macro(BITOR, "'|'") /* bitwise-or */ \ + macro(BITXOR, "'^'") /* bitwise-xor */ \ + macro(BITAND, "'&'") /* bitwise-and */ \ + \ + /* Equality operation tokens, per TokenKindIsEquality. */ \ + macro(STRICTEQ, "'==='") \ + range(EQUALITY_START, STRICTEQ) \ + macro(EQ, "'=='") \ + macro(STRICTNE, "'!=='") \ + macro(NE, "'!='") \ + range(EQUALITY_LAST, NE) \ + \ + /* Relational ops, per TokenKindIsRelational. */ \ + macro(LT, "'<'") \ + range(RELOP_START, LT) \ + macro(LE, "'<='") \ + macro(GT, "'>'") \ + macro(GE, "'>='") \ + range(RELOP_LAST, GE) \ + \ + macro(INSTANCEOF, "keyword 'instanceof'") \ + macro(IN, "keyword 'in'") \ + \ + /* Shift ops, per TokenKindIsShift. */ \ + macro(LSH, "'<<'") \ + range(SHIFTOP_START, LSH) \ + macro(RSH, "'>>'") \ + macro(URSH, "'>>>'") \ + range(SHIFTOP_LAST, URSH) \ + \ + macro(ADD, "'+'") \ + macro(SUB, "'-'") \ + macro(MUL, "'*'") \ + macro(DIV, "'/'") \ + macro(MOD, "'%'") \ + macro(POW, "'**'") \ + range(BINOP_LAST, POW) \ + \ + /* Unary operation tokens. */ \ + macro(TYPEOF, "keyword 'typeof'") \ + macro(VOID, "keyword 'void'") \ + macro(NOT, "'!'") \ + macro(BITNOT, "'~'") \ + \ + macro(ARROW, "'=>'") /* function arrow */ \ + \ + /* Assignment ops, per TokenKindIsAssignment */ \ + macro(ASSIGN, "'='") \ + range(ASSIGNMENT_START, ASSIGN) \ + macro(ADDASSIGN, "'+='") \ + macro(SUBASSIGN, "'-='") \ + macro(BITORASSIGN, "'|='") \ + macro(BITXORASSIGN, "'^='") \ + macro(BITANDASSIGN, "'&='") \ + macro(LSHASSIGN, "'<<='") \ + macro(RSHASSIGN, "'>>='") \ + macro(URSHASSIGN, "'>>>='") \ + macro(MULASSIGN, "'*='") \ + macro(DIVASSIGN, "'/='") \ + macro(MODASSIGN, "'%='") \ + macro(POWASSIGN, "'**='") \ + range(ASSIGNMENT_LAST, POWASSIGN) + +#define TOKEN_KIND_RANGE_EMIT_NONE(name, value) +#define FOR_EACH_TOKEN_KIND(macro) \ + FOR_EACH_TOKEN_KIND_WITH_RANGE(macro, TOKEN_KIND_RANGE_EMIT_NONE) + +namespace js { +namespace frontend { + +// Values of this type are used to index into arrays such as isExprEnding[], +// so the first value must be zero. +enum TokenKind { +#define EMIT_ENUM(name, desc) TOK_##name, +#define EMIT_ENUM_RANGE(name, value) TOK_##name = TOK_##value, + FOR_EACH_TOKEN_KIND_WITH_RANGE(EMIT_ENUM, EMIT_ENUM_RANGE) +#undef EMIT_ENUM +#undef EMIT_ENUM_RANGE + TOK_LIMIT // domain size +}; + +inline bool +TokenKindIsBinaryOp(TokenKind tt) +{ + return TOK_BINOP_FIRST <= tt && tt <= TOK_BINOP_LAST; +} + +inline bool +TokenKindIsEquality(TokenKind tt) +{ + return TOK_EQUALITY_START <= tt && tt <= TOK_EQUALITY_LAST; +} + +inline bool +TokenKindIsRelational(TokenKind tt) +{ + return TOK_RELOP_START <= tt && tt <= TOK_RELOP_LAST; +} + +inline bool +TokenKindIsShift(TokenKind tt) +{ + return TOK_SHIFTOP_START <= tt && tt <= TOK_SHIFTOP_LAST; +} + +inline bool +TokenKindIsAssignment(TokenKind tt) +{ + return TOK_ASSIGNMENT_START <= tt && tt <= TOK_ASSIGNMENT_LAST; +} + +} // namespace frontend +} // namespace js + +#endif /* frontend_TokenKind_h */ diff --git a/js/src/frontend/TokenStream.cpp b/js/src/frontend/TokenStream.cpp new file mode 100644 index 000000000..c166ed414 --- /dev/null +++ b/js/src/frontend/TokenStream.cpp @@ -0,0 +1,1962 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- + * vim: set ts=8 sts=4 et sw=4 tw=99: + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +// JS lexical scanner. + +#include "frontend/TokenStream.h" + +#include "mozilla/IntegerTypeTraits.h" +#include "mozilla/PodOperations.h" + +#include <ctype.h> +#include <stdarg.h> +#include <stdio.h> +#include <string.h> + +#include "jsatom.h" +#include "jscntxt.h" +#include "jscompartment.h" +#include "jsexn.h" +#include "jsnum.h" + +#include "frontend/BytecodeCompiler.h" +#include "js/CharacterEncoding.h" +#include "js/UniquePtr.h" +#include "vm/HelperThreads.h" +#include "vm/Keywords.h" +#include "vm/StringBuffer.h" +#include "vm/Unicode.h" + +using namespace js; +using namespace js::frontend; + +using mozilla::Maybe; +using mozilla::PodAssign; +using mozilla::PodCopy; +using mozilla::PodZero; + +struct KeywordInfo { + const char* chars; // C string with keyword text + TokenKind tokentype; +}; + +static const KeywordInfo keywords[] = { +#define KEYWORD_INFO(keyword, name, type) \ + {js_##keyword##_str, type}, + FOR_EACH_JAVASCRIPT_KEYWORD(KEYWORD_INFO) +#undef KEYWORD_INFO +}; + +// Returns a KeywordInfo for the specified characters, or nullptr if the string +// is not a keyword. +template <typename CharT> +static const KeywordInfo* +FindKeyword(const CharT* s, size_t length) +{ + MOZ_ASSERT(length != 0); + + size_t i; + const KeywordInfo* kw; + const char* chars; + +#define JSKW_LENGTH() length +#define JSKW_AT(column) s[column] +#define JSKW_GOT_MATCH(index) i = (index); goto got_match; +#define JSKW_TEST_GUESS(index) i = (index); goto test_guess; +#define JSKW_NO_MATCH() goto no_match; +#include "jsautokw.h" +#undef JSKW_NO_MATCH +#undef JSKW_TEST_GUESS +#undef JSKW_GOT_MATCH +#undef JSKW_AT +#undef JSKW_LENGTH + + got_match: + return &keywords[i]; + + test_guess: + kw = &keywords[i]; + chars = kw->chars; + do { + if (*s++ != (unsigned char)(*chars++)) + goto no_match; + } while (--length != 0); + return kw; + + no_match: + return nullptr; +} + +static const KeywordInfo* +FindKeyword(JSLinearString* str) +{ + JS::AutoCheckCannotGC nogc; + return str->hasLatin1Chars() + ? FindKeyword(str->latin1Chars(nogc), str->length()) + : FindKeyword(str->twoByteChars(nogc), str->length()); +} + +template <typename CharT> +static bool +IsIdentifier(const CharT* chars, size_t length) +{ + if (length == 0) + return false; + + if (!unicode::IsIdentifierStart(char16_t(*chars))) + return false; + + const CharT* end = chars + length; + while (++chars != end) { + if (!unicode::IsIdentifierPart(char16_t(*chars))) + return false; + } + + return true; +} + +bool +frontend::IsIdentifier(JSLinearString* str) +{ + JS::AutoCheckCannotGC nogc; + return str->hasLatin1Chars() + ? ::IsIdentifier(str->latin1Chars(nogc), str->length()) + : ::IsIdentifier(str->twoByteChars(nogc), str->length()); +} + +bool +frontend::IsIdentifier(const char16_t* chars, size_t length) +{ + return ::IsIdentifier(chars, length); +} + +bool +frontend::IsKeyword(JSLinearString* str) +{ + return FindKeyword(str) != nullptr; +} + +TokenStream::SourceCoords::SourceCoords(ExclusiveContext* cx, uint32_t ln) + : lineStartOffsets_(cx), initialLineNum_(ln), lastLineIndex_(0) +{ + // This is actually necessary! Removing it causes compile errors on + // GCC and clang. You could try declaring this: + // + // const uint32_t TokenStream::SourceCoords::MAX_PTR; + // + // which fixes the GCC/clang error, but causes bustage on Windows. Sigh. + // + uint32_t maxPtr = MAX_PTR; + + // The first line begins at buffer offset 0. MAX_PTR is the sentinel. The + // appends cannot fail because |lineStartOffsets_| has statically-allocated + // elements. + MOZ_ASSERT(lineStartOffsets_.capacity() >= 2); + MOZ_ALWAYS_TRUE(lineStartOffsets_.reserve(2)); + lineStartOffsets_.infallibleAppend(0); + lineStartOffsets_.infallibleAppend(maxPtr); +} + +MOZ_ALWAYS_INLINE bool +TokenStream::SourceCoords::add(uint32_t lineNum, uint32_t lineStartOffset) +{ + uint32_t lineIndex = lineNumToIndex(lineNum); + uint32_t sentinelIndex = lineStartOffsets_.length() - 1; + + MOZ_ASSERT(lineStartOffsets_[0] == 0 && lineStartOffsets_[sentinelIndex] == MAX_PTR); + + if (lineIndex == sentinelIndex) { + // We haven't seen this newline before. Update lineStartOffsets_ + // only if lineStartOffsets_.append succeeds, to keep sentinel. + // Otherwise return false to tell TokenStream about OOM. + uint32_t maxPtr = MAX_PTR; + if (!lineStartOffsets_.append(maxPtr)) + return false; + + lineStartOffsets_[lineIndex] = lineStartOffset; + } else { + // We have seen this newline before (and ungot it). Do nothing (other + // than checking it hasn't mysteriously changed). + // This path can be executed after hitting OOM, so check lineIndex. + MOZ_ASSERT_IF(lineIndex < sentinelIndex, lineStartOffsets_[lineIndex] == lineStartOffset); + } + return true; +} + +MOZ_ALWAYS_INLINE bool +TokenStream::SourceCoords::fill(const TokenStream::SourceCoords& other) +{ + MOZ_ASSERT(lineStartOffsets_.back() == MAX_PTR); + MOZ_ASSERT(other.lineStartOffsets_.back() == MAX_PTR); + + if (lineStartOffsets_.length() >= other.lineStartOffsets_.length()) + return true; + + uint32_t sentinelIndex = lineStartOffsets_.length() - 1; + lineStartOffsets_[sentinelIndex] = other.lineStartOffsets_[sentinelIndex]; + + for (size_t i = sentinelIndex + 1; i < other.lineStartOffsets_.length(); i++) { + if (!lineStartOffsets_.append(other.lineStartOffsets_[i])) + return false; + } + return true; +} + +MOZ_ALWAYS_INLINE uint32_t +TokenStream::SourceCoords::lineIndexOf(uint32_t offset) const +{ + uint32_t iMin, iMax, iMid; + + if (lineStartOffsets_[lastLineIndex_] <= offset) { + // If we reach here, offset is on a line the same as or higher than + // last time. Check first for the +0, +1, +2 cases, because they + // typically cover 85--98% of cases. + if (offset < lineStartOffsets_[lastLineIndex_ + 1]) + return lastLineIndex_; // lineIndex is same as last time + + // If we reach here, there must be at least one more entry (plus the + // sentinel). Try it. + lastLineIndex_++; + if (offset < lineStartOffsets_[lastLineIndex_ + 1]) + return lastLineIndex_; // lineIndex is one higher than last time + + // The same logic applies here. + lastLineIndex_++; + if (offset < lineStartOffsets_[lastLineIndex_ + 1]) { + return lastLineIndex_; // lineIndex is two higher than last time + } + + // No luck. Oh well, we have a better-than-default starting point for + // the binary search. + iMin = lastLineIndex_ + 1; + MOZ_ASSERT(iMin < lineStartOffsets_.length() - 1); // -1 due to the sentinel + + } else { + iMin = 0; + } + + // This is a binary search with deferred detection of equality, which was + // marginally faster in this case than a standard binary search. + // The -2 is because |lineStartOffsets_.length() - 1| is the sentinel, and we + // want one before that. + iMax = lineStartOffsets_.length() - 2; + while (iMax > iMin) { + iMid = iMin + (iMax - iMin) / 2; + if (offset >= lineStartOffsets_[iMid + 1]) + iMin = iMid + 1; // offset is above lineStartOffsets_[iMid] + else + iMax = iMid; // offset is below or within lineStartOffsets_[iMid] + } + MOZ_ASSERT(iMax == iMin); + MOZ_ASSERT(lineStartOffsets_[iMin] <= offset && offset < lineStartOffsets_[iMin + 1]); + lastLineIndex_ = iMin; + return iMin; +} + +uint32_t +TokenStream::SourceCoords::lineNum(uint32_t offset) const +{ + uint32_t lineIndex = lineIndexOf(offset); + return lineIndexToNum(lineIndex); +} + +uint32_t +TokenStream::SourceCoords::columnIndex(uint32_t offset) const +{ + uint32_t lineIndex = lineIndexOf(offset); + uint32_t lineStartOffset = lineStartOffsets_[lineIndex]; + MOZ_ASSERT(offset >= lineStartOffset); + return offset - lineStartOffset; +} + +void +TokenStream::SourceCoords::lineNumAndColumnIndex(uint32_t offset, uint32_t* lineNum, + uint32_t* columnIndex) const +{ + uint32_t lineIndex = lineIndexOf(offset); + *lineNum = lineIndexToNum(lineIndex); + uint32_t lineStartOffset = lineStartOffsets_[lineIndex]; + MOZ_ASSERT(offset >= lineStartOffset); + *columnIndex = offset - lineStartOffset; +} + +#ifdef _MSC_VER +#pragma warning(push) +#pragma warning(disable:4351) +#endif + +TokenStream::TokenStream(ExclusiveContext* cx, const ReadOnlyCompileOptions& options, + const char16_t* base, size_t length, StrictModeGetter* smg) + : srcCoords(cx, options.lineno), + options_(options), + tokens(), + cursor(), + lookahead(), + lineno(options.lineno), + flags(), + linebase(0), + prevLinebase(size_t(-1)), + userbuf(cx, base, length, options.column), + filename(options.filename()), + displayURL_(nullptr), + sourceMapURL_(nullptr), + tokenbuf(cx), + cx(cx), + mutedErrors(options.mutedErrors()), + strictModeGetter(smg) +{ + // Nb: the following tables could be static, but initializing them here is + // much easier. Don't worry, the time to initialize them for each + // TokenStream is trivial. See bug 639420. + + // See Parser::assignExpr() for an explanation of isExprEnding[]. + memset(isExprEnding, 0, sizeof(isExprEnding)); + isExprEnding[TOK_COMMA] = 1; + isExprEnding[TOK_SEMI] = 1; + isExprEnding[TOK_COLON] = 1; + isExprEnding[TOK_RP] = 1; + isExprEnding[TOK_RB] = 1; + isExprEnding[TOK_RC] = 1; +} + +#ifdef _MSC_VER +#pragma warning(pop) +#endif + +bool +TokenStream::checkOptions() +{ + // Constrain starting columns to half of the range of a signed 32-bit value, + // to avoid overflow. + if (options().column >= mozilla::MaxValue<int32_t>::value / 2 + 1) { + reportErrorNoOffset(JSMSG_BAD_COLUMN_NUMBER); + return false; + } + + return true; +} + +TokenStream::~TokenStream() +{ +} + +// Use the fastest available getc. +#if defined(HAVE_GETC_UNLOCKED) +# define fast_getc getc_unlocked +#elif defined(HAVE__GETC_NOLOCK) +# define fast_getc _getc_nolock +#else +# define fast_getc getc +#endif + +MOZ_ALWAYS_INLINE void +TokenStream::updateLineInfoForEOL() +{ + prevLinebase = linebase; + linebase = userbuf.offset(); + lineno++; + if (!srcCoords.add(lineno, linebase)) + flags.hitOOM = true; +} + +MOZ_ALWAYS_INLINE void +TokenStream::updateFlagsForEOL() +{ + flags.isDirtyLine = false; +} + +// This gets the next char, normalizing all EOL sequences to '\n' as it goes. +int32_t +TokenStream::getChar() +{ + int32_t c; + if (MOZ_LIKELY(userbuf.hasRawChars())) { + c = userbuf.getRawChar(); + + // Normalize the char16_t if it was a newline. + if (MOZ_UNLIKELY(c == '\n')) + goto eol; + if (MOZ_UNLIKELY(c == '\r')) { + // If it's a \r\n sequence: treat as a single EOL, skip over the \n. + if (MOZ_LIKELY(userbuf.hasRawChars())) + userbuf.matchRawChar('\n'); + goto eol; + } + if (MOZ_UNLIKELY(c == LINE_SEPARATOR || c == PARA_SEPARATOR)) + goto eol; + + return c; + } + + flags.isEOF = true; + return EOF; + + eol: + updateLineInfoForEOL(); + return '\n'; +} + +// This gets the next char. It does nothing special with EOL sequences, not +// even updating the line counters. It can be used safely if (a) the +// resulting char is guaranteed to be ungotten (by ungetCharIgnoreEOL()) if +// it's an EOL, and (b) the line-related state (lineno, linebase) is not used +// before it's ungotten. +int32_t +TokenStream::getCharIgnoreEOL() +{ + if (MOZ_LIKELY(userbuf.hasRawChars())) + return userbuf.getRawChar(); + + flags.isEOF = true; + return EOF; +} + +void +TokenStream::ungetChar(int32_t c) +{ + if (c == EOF) + return; + MOZ_ASSERT(!userbuf.atStart()); + userbuf.ungetRawChar(); + if (c == '\n') { +#ifdef DEBUG + int32_t c2 = userbuf.peekRawChar(); + MOZ_ASSERT(TokenBuf::isRawEOLChar(c2)); +#endif + + // If it's a \r\n sequence, also unget the \r. + if (!userbuf.atStart()) + userbuf.matchRawCharBackwards('\r'); + + MOZ_ASSERT(prevLinebase != size_t(-1)); // we should never get more than one EOL char + linebase = prevLinebase; + prevLinebase = size_t(-1); + lineno--; + } else { + MOZ_ASSERT(userbuf.peekRawChar() == c); + } +} + +void +TokenStream::ungetCharIgnoreEOL(int32_t c) +{ + if (c == EOF) + return; + MOZ_ASSERT(!userbuf.atStart()); + userbuf.ungetRawChar(); +} + +// Return true iff |n| raw characters can be read from this without reading past +// EOF or a newline, and copy those characters into |cp| if so. The characters +// are not consumed: use skipChars(n) to do so after checking that the consumed +// characters had appropriate values. +bool +TokenStream::peekChars(int n, char16_t* cp) +{ + int i, j; + int32_t c; + + for (i = 0; i < n; i++) { + c = getCharIgnoreEOL(); + if (c == EOF) + break; + if (c == '\n') { + ungetCharIgnoreEOL(c); + break; + } + cp[i] = char16_t(c); + } + for (j = i - 1; j >= 0; j--) + ungetCharIgnoreEOL(cp[j]); + return i == n; +} + +size_t +TokenStream::TokenBuf::findEOLMax(size_t start, size_t max) +{ + const char16_t* p = rawCharPtrAt(start); + + size_t n = 0; + while (true) { + if (p >= limit_) + break; + if (n >= max) + break; + n++; + if (TokenBuf::isRawEOLChar(*p++)) + break; + } + return start + n; +} + +bool +TokenStream::advance(size_t position) +{ + const char16_t* end = userbuf.rawCharPtrAt(position); + while (userbuf.addressOfNextRawChar() < end) + getChar(); + + Token* cur = &tokens[cursor]; + cur->pos.begin = userbuf.offset(); + MOZ_MAKE_MEM_UNDEFINED(&cur->type, sizeof(cur->type)); + lookahead = 0; + + if (flags.hitOOM) + return reportError(JSMSG_OUT_OF_MEMORY); + + return true; +} + +void +TokenStream::tell(Position* pos) +{ + pos->buf = userbuf.addressOfNextRawChar(/* allowPoisoned = */ true); + pos->flags = flags; + pos->lineno = lineno; + pos->linebase = linebase; + pos->prevLinebase = prevLinebase; + pos->lookahead = lookahead; + pos->currentToken = currentToken(); + for (unsigned i = 0; i < lookahead; i++) + pos->lookaheadTokens[i] = tokens[(cursor + 1 + i) & ntokensMask]; +} + +void +TokenStream::seek(const Position& pos) +{ + userbuf.setAddressOfNextRawChar(pos.buf, /* allowPoisoned = */ true); + flags = pos.flags; + lineno = pos.lineno; + linebase = pos.linebase; + prevLinebase = pos.prevLinebase; + lookahead = pos.lookahead; + + tokens[cursor] = pos.currentToken; + for (unsigned i = 0; i < lookahead; i++) + tokens[(cursor + 1 + i) & ntokensMask] = pos.lookaheadTokens[i]; +} + +bool +TokenStream::seek(const Position& pos, const TokenStream& other) +{ + if (!srcCoords.fill(other.srcCoords)) + return false; + seek(pos); + return true; +} + +bool +TokenStream::reportStrictModeErrorNumberVA(uint32_t offset, bool strictMode, unsigned errorNumber, + va_list args) +{ + // In strict mode code, this is an error, not merely a warning. + unsigned flags; + if (strictMode) + flags = JSREPORT_ERROR; + else if (options().extraWarningsOption) + flags = JSREPORT_WARNING | JSREPORT_STRICT; + else + return true; + + return reportCompileErrorNumberVA(offset, flags, errorNumber, args); +} + +void +CompileError::throwError(JSContext* cx) +{ + if (JSREPORT_IS_WARNING(flags)) { + CallWarningReporter(cx, this); + return; + } + + // If there's a runtime exception type associated with this error + // number, set that as the pending exception. For errors occuring at + // compile time, this is very likely to be a JSEXN_SYNTAXERR. + // + // If an exception is thrown but not caught, the JSREPORT_EXCEPTION + // flag will be set in report.flags. Proper behavior for an error + // reporter is to ignore a report with this flag for all but top-level + // compilation errors. The exception will remain pending, and so long + // as the non-top-level "load", "eval", or "compile" native function + // returns false, the top-level reporter will eventually receive the + // uncaught exception report. + ErrorToException(cx, this, nullptr, nullptr); +} + +bool +TokenStream::reportCompileErrorNumberVA(uint32_t offset, unsigned flags, unsigned errorNumber, + va_list args) +{ + bool warning = JSREPORT_IS_WARNING(flags); + + if (warning && options().werrorOption) { + flags &= ~JSREPORT_WARNING; + warning = false; + } + + // On the main thread, report the error immediately. When compiling off + // thread, save the error so that the main thread can report it later. + CompileError tempErr; + CompileError* tempErrPtr = &tempErr; + if (!cx->isJSContext() && !cx->addPendingCompileError(&tempErrPtr)) + return false; + CompileError& err = *tempErrPtr; + + err.flags = flags; + err.errorNumber = errorNumber; + err.filename = filename; + err.isMuted = mutedErrors; + if (offset == NoOffset) { + err.lineno = 0; + err.column = 0; + } else { + err.lineno = srcCoords.lineNum(offset); + err.column = srcCoords.columnIndex(offset); + } + + // If we have no location information, try to get one from the caller. + bool callerFilename = false; + if (offset != NoOffset && !err.filename && cx->isJSContext()) { + NonBuiltinFrameIter iter(cx->asJSContext(), + FrameIter::FOLLOW_DEBUGGER_EVAL_PREV_LINK, + cx->compartment()->principals()); + if (!iter.done() && iter.filename()) { + callerFilename = true; + err.filename = iter.filename(); + err.lineno = iter.computeLine(&err.column); + } + } + + if (!ExpandErrorArgumentsVA(cx, GetErrorMessage, nullptr, errorNumber, + nullptr, ArgumentsAreLatin1, &err, args)) + { + return false; + } + + // Given a token, T, that we want to complain about: if T's (starting) + // lineno doesn't match TokenStream's lineno, that means we've scanned past + // the line that T starts on, which makes it hard to print some or all of + // T's (starting) line for context. + // + // So we don't even try, leaving report.linebuf and friends zeroed. This + // means that any error involving a multi-line token (e.g. an unterminated + // multi-line string literal) won't have a context printed. + if (offset != NoOffset && err.lineno == lineno && !callerFilename) { + // We show only a portion (a "window") of the line around the erroneous + // token -- the first char in the token, plus |windowRadius| chars + // before it and |windowRadius - 1| chars after it. This is because + // lines can be very long and printing the whole line is (a) not that + // helpful, and (b) can waste a lot of memory. See bug 634444. + static const size_t windowRadius = 60; + + // The window must start within the current line, no earlier than + // windowRadius characters before offset. + size_t windowStart = (offset - linebase > windowRadius) ? + offset - windowRadius : + linebase; + + // The window must start within the portion of the current line + // that we actually have in our buffer. + if (windowStart < userbuf.startOffset()) + windowStart = userbuf.startOffset(); + + // The window must end within the current line, no later than + // windowRadius after offset. + size_t windowEnd = userbuf.findEOLMax(offset, windowRadius); + size_t windowLength = windowEnd - windowStart; + MOZ_ASSERT(windowLength <= windowRadius * 2); + + // Create the windowed strings. + StringBuffer windowBuf(cx); + if (!windowBuf.append(userbuf.rawCharPtrAt(windowStart), windowLength) || + !windowBuf.append('\0')) + { + return false; + } + + // The window into the offending source line, without final \n. + UniqueTwoByteChars linebuf(windowBuf.stealChars()); + if (!linebuf) + return false; + + err.initOwnedLinebuf(linebuf.release(), windowLength, offset - windowStart); + } + + if (cx->isJSContext()) + err.throwError(cx->asJSContext()); + + return warning; +} + +bool +TokenStream::reportStrictModeError(unsigned errorNumber, ...) +{ + va_list args; + va_start(args, errorNumber); + bool result = reportStrictModeErrorNumberVA(currentToken().pos.begin, strictMode(), + errorNumber, args); + va_end(args); + return result; +} + +bool +TokenStream::reportError(unsigned errorNumber, ...) +{ + va_list args; + va_start(args, errorNumber); + bool result = reportCompileErrorNumberVA(currentToken().pos.begin, JSREPORT_ERROR, errorNumber, + args); + va_end(args); + return result; +} + +bool +TokenStream::reportErrorNoOffset(unsigned errorNumber, ...) +{ + va_list args; + va_start(args, errorNumber); + bool result = reportCompileErrorNumberVA(NoOffset, JSREPORT_ERROR, errorNumber, + args); + va_end(args); + return result; +} + +bool +TokenStream::reportWarning(unsigned errorNumber, ...) +{ + va_list args; + va_start(args, errorNumber); + bool result = reportCompileErrorNumberVA(currentToken().pos.begin, JSREPORT_WARNING, + errorNumber, args); + va_end(args); + return result; +} + +bool +TokenStream::reportStrictWarningErrorNumberVA(uint32_t offset, unsigned errorNumber, va_list args) +{ + if (!options().extraWarningsOption) + return true; + + return reportCompileErrorNumberVA(offset, JSREPORT_STRICT|JSREPORT_WARNING, errorNumber, args); +} + +void +TokenStream::reportAsmJSError(uint32_t offset, unsigned errorNumber, ...) +{ + va_list args; + va_start(args, errorNumber); + unsigned flags = options().throwOnAsmJSValidationFailureOption + ? JSREPORT_ERROR + : JSREPORT_WARNING; + reportCompileErrorNumberVA(offset, flags, errorNumber, args); + va_end(args); +} + +// We have encountered a '\': check for a Unicode escape sequence after it. +// Return the length of the escape sequence and the character code point (by +// value) if we found a Unicode escape sequence. Otherwise, return 0. In both +// cases, do not advance along the buffer. +uint32_t +TokenStream::peekUnicodeEscape(uint32_t* codePoint) +{ + int32_t c = getCharIgnoreEOL(); + if (c != 'u') { + ungetCharIgnoreEOL(c); + return 0; + } + + char16_t cp[3]; + uint32_t length; + c = getCharIgnoreEOL(); + if (JS7_ISHEX(c) && peekChars(3, cp) && + JS7_ISHEX(cp[0]) && JS7_ISHEX(cp[1]) && JS7_ISHEX(cp[2])) + { + *codePoint = (JS7_UNHEX(c) << 12) | + (JS7_UNHEX(cp[0]) << 8) | + (JS7_UNHEX(cp[1]) << 4) | + JS7_UNHEX(cp[2]); + length = 5; + } else if (c == '{') { + length = peekExtendedUnicodeEscape(codePoint); + } else { + length = 0; + } + + ungetCharIgnoreEOL(c); + ungetCharIgnoreEOL('u'); + return length; +} + +uint32_t +TokenStream::peekExtendedUnicodeEscape(uint32_t* codePoint) +{ + // The opening brace character was already read. + int32_t c = getCharIgnoreEOL(); + + // Skip leading zeros. + uint32_t leadingZeros = 0; + while (c == '0') { + leadingZeros++; + c = getCharIgnoreEOL(); + } + + char16_t cp[6]; + size_t i = 0; + uint32_t code = 0; + while (JS7_ISHEX(c) && i < 6) { + cp[i++] = c; + code = code << 4 | JS7_UNHEX(c); + c = getCharIgnoreEOL(); + } + + uint32_t length; + if (c == '}' && (leadingZeros > 0 || i > 0) && code <= unicode::NonBMPMax) { + *codePoint = code; + length = leadingZeros + i + 3; + } else { + length = 0; + } + + ungetCharIgnoreEOL(c); + while (i--) + ungetCharIgnoreEOL(cp[i]); + while (leadingZeros--) + ungetCharIgnoreEOL('0'); + + return length; +} + +uint32_t +TokenStream::matchUnicodeEscapeIdStart(uint32_t* codePoint) +{ + uint32_t length = peekUnicodeEscape(codePoint); + if (length > 0 && unicode::IsIdentifierStart(*codePoint)) { + skipChars(length); + return length; + } + return 0; +} + +bool +TokenStream::matchUnicodeEscapeIdent(uint32_t* codePoint) +{ + uint32_t length = peekUnicodeEscape(codePoint); + if (length > 0 && unicode::IsIdentifierPart(*codePoint)) { + skipChars(length); + return true; + } + return false; +} + +// Helper function which returns true if the first length(q) characters in p are +// the same as the characters in q. +static bool +CharsMatch(const char16_t* p, const char* q) { + while (*q) { + if (*p++ != *q++) + return false; + } + return true; +} + +bool +TokenStream::getDirectives(bool isMultiline, bool shouldWarnDeprecated) +{ + // Match directive comments used in debugging, such as "//# sourceURL" and + // "//# sourceMappingURL". Use of "//@" instead of "//#" is deprecated. + // + // To avoid a crashing bug in IE, several JavaScript transpilers wrap single + // line comments containing a source mapping URL inside a multiline + // comment. To avoid potentially expensive lookahead and backtracking, we + // only check for this case if we encounter a '#' character. + + if (!getDisplayURL(isMultiline, shouldWarnDeprecated)) + return false; + if (!getSourceMappingURL(isMultiline, shouldWarnDeprecated)) + return false; + + return true; +} + +bool +TokenStream::getDirective(bool isMultiline, bool shouldWarnDeprecated, + const char* directive, int directiveLength, + const char* errorMsgPragma, + UniqueTwoByteChars* destination) +{ + MOZ_ASSERT(directiveLength <= 18); + char16_t peeked[18]; + int32_t c; + + if (peekChars(directiveLength, peeked) && CharsMatch(peeked, directive)) { + if (shouldWarnDeprecated && + !reportWarning(JSMSG_DEPRECATED_PRAGMA, errorMsgPragma)) + return false; + + skipChars(directiveLength); + tokenbuf.clear(); + + while ((c = peekChar()) && c != EOF && !unicode::IsSpaceOrBOM2(c)) { + getChar(); + // Debugging directives can occur in both single- and multi-line + // comments. If we're currently inside a multi-line comment, we also + // need to recognize multi-line comment terminators. + if (isMultiline && c == '*' && peekChar() == '/') { + ungetChar('*'); + break; + } + if (!tokenbuf.append(c)) + return false; + } + + if (tokenbuf.empty()) { + // The directive's URL was missing, but this is not quite an + // exception that we should stop and drop everything for. + return true; + } + + size_t length = tokenbuf.length(); + + *destination = cx->make_pod_array<char16_t>(length + 1); + if (!*destination) + return false; + + PodCopy(destination->get(), tokenbuf.begin(), length); + (*destination)[length] = '\0'; + } + + return true; +} + +bool +TokenStream::getDisplayURL(bool isMultiline, bool shouldWarnDeprecated) +{ + // Match comments of the form "//# sourceURL=<url>" or + // "/\* //# sourceURL=<url> *\/" + // + // Note that while these are labeled "sourceURL" in the source text, + // internally we refer to it as a "displayURL" to distinguish what the + // developer would like to refer to the source as from the source's actual + // URL. + + return getDirective(isMultiline, shouldWarnDeprecated, " sourceURL=", 11, + "sourceURL", &displayURL_); +} + +bool +TokenStream::getSourceMappingURL(bool isMultiline, bool shouldWarnDeprecated) +{ + // Match comments of the form "//# sourceMappingURL=<url>" or + // "/\* //# sourceMappingURL=<url> *\/" + + return getDirective(isMultiline, shouldWarnDeprecated, " sourceMappingURL=", 18, + "sourceMappingURL", &sourceMapURL_); +} + +MOZ_ALWAYS_INLINE Token* +TokenStream::newToken(ptrdiff_t adjust) +{ + cursor = (cursor + 1) & ntokensMask; + Token* tp = &tokens[cursor]; + tp->pos.begin = userbuf.offset() + adjust; + + // NOTE: tp->pos.end is not set until the very end of getTokenInternal(). + MOZ_MAKE_MEM_UNDEFINED(&tp->pos.end, sizeof(tp->pos.end)); + + return tp; +} + +MOZ_ALWAYS_INLINE JSAtom* +TokenStream::atomize(ExclusiveContext* cx, CharBuffer& cb) +{ + return AtomizeChars(cx, cb.begin(), cb.length()); +} + +#ifdef DEBUG +static bool +IsTokenSane(Token* tp) +{ + // Nb: TOK_EOL should never be used in an actual Token; it should only be + // returned as a TokenKind from peekTokenSameLine(). + if (tp->type < 0 || tp->type >= TOK_LIMIT || tp->type == TOK_EOL) + return false; + + if (tp->pos.end < tp->pos.begin) + return false; + + return true; +} +#endif + +bool +TokenStream::putIdentInTokenbuf(const char16_t* identStart) +{ + int32_t c; + uint32_t qc; + const char16_t* tmp = userbuf.addressOfNextRawChar(); + userbuf.setAddressOfNextRawChar(identStart); + + tokenbuf.clear(); + for (;;) { + c = getCharIgnoreEOL(); + if (!unicode::IsIdentifierPart(char16_t(c))) { + if (c != '\\' || !matchUnicodeEscapeIdent(&qc)) + break; + c = qc; + } + if (!tokenbuf.append(c)) { + userbuf.setAddressOfNextRawChar(tmp); + return false; + } + } + userbuf.setAddressOfNextRawChar(tmp); + return true; +} + +bool +TokenStream::checkForKeyword(const KeywordInfo* kw, TokenKind* ttp) +{ + if (!awaitIsKeyword && kw->tokentype == TOK_AWAIT) { + if (ttp) + *ttp = TOK_NAME; + return true; + } + + if (kw->tokentype == TOK_RESERVED) + return reportError(JSMSG_RESERVED_ID, kw->chars); + + if (kw->tokentype == TOK_STRICT_RESERVED) + return reportStrictModeError(JSMSG_RESERVED_ID, kw->chars); + + // Working keyword. + *ttp = kw->tokentype; + return true; +} + +bool +TokenStream::checkForKeyword(JSAtom* atom, TokenKind* ttp) +{ + const KeywordInfo* kw = FindKeyword(atom); + if (!kw) + return true; + + return checkForKeyword(kw, ttp); +} + +enum FirstCharKind { + // A char16_t has the 'OneChar' kind if it, by itself, constitutes a valid + // token that cannot also be a prefix of a longer token. E.g. ';' has the + // OneChar kind, but '+' does not, because '++' and '+=' are valid longer tokens + // that begin with '+'. + // + // The few token kinds satisfying these properties cover roughly 35--45% + // of the tokens seen in practice. + // + // We represent the 'OneChar' kind with any positive value less than + // TOK_LIMIT. This representation lets us associate each one-char token + // char16_t with a TokenKind and thus avoid a subsequent char16_t-to-TokenKind + // conversion. + OneChar_Min = 0, + OneChar_Max = TOK_LIMIT - 1, + + Space = TOK_LIMIT, + Ident, + Dec, + String, + EOL, + BasePrefix, + Other, + + LastCharKind = Other +}; + +// OneChar: 40, 41, 44, 58, 59, 63, 91, 93, 123, 125, 126: +// '(', ')', ',', ':', ';', '?', '[', ']', '{', '}', '~' +// Ident: 36, 65..90, 95, 97..122: '$', 'A'..'Z', '_', 'a'..'z' +// Dot: 46: '.' +// Equals: 61: '=' +// String: 34, 39: '"', '\'' +// Dec: 49..57: '1'..'9' +// Plus: 43: '+' +// BasePrefix: 48: '0' +// Space: 9, 11, 12, 32: '\t', '\v', '\f', ' ' +// EOL: 10, 13: '\n', '\r' +// +#define T_COMMA TOK_COMMA +#define T_COLON TOK_COLON +#define T_BITNOT TOK_BITNOT +#define Templat String +#define _______ Other +static const uint8_t firstCharKinds[] = { +/* 0 1 2 3 4 5 6 7 8 9 */ +/* 0+ */ _______, _______, _______, _______, _______, _______, _______, _______, _______, Space, +/* 10+ */ EOL, Space, Space, EOL, _______, _______, _______, _______, _______, _______, +/* 20+ */ _______, _______, _______, _______, _______, _______, _______, _______, _______, _______, +/* 30+ */ _______, _______, Space, _______, String, _______, Ident, _______, _______, String, +/* 40+ */ TOK_LP, TOK_RP, _______, _______, T_COMMA,_______, _______, _______,BasePrefix, Dec, +/* 50+ */ Dec, Dec, Dec, Dec, Dec, Dec, Dec, Dec, T_COLON,TOK_SEMI, +/* 60+ */ _______, _______, _______,TOK_HOOK, _______, Ident, Ident, Ident, Ident, Ident, +/* 70+ */ Ident, Ident, Ident, Ident, Ident, Ident, Ident, Ident, Ident, Ident, +/* 80+ */ Ident, Ident, Ident, Ident, Ident, Ident, Ident, Ident, Ident, Ident, +/* 90+ */ Ident, TOK_LB, _______, TOK_RB, _______, Ident, Templat, Ident, Ident, Ident, +/* 100+ */ Ident, Ident, Ident, Ident, Ident, Ident, Ident, Ident, Ident, Ident, +/* 110+ */ Ident, Ident, Ident, Ident, Ident, Ident, Ident, Ident, Ident, Ident, +/* 120+ */ Ident, Ident, Ident, TOK_LC, _______, TOK_RC,T_BITNOT, _______ +}; +#undef T_COMMA +#undef T_COLON +#undef T_BITNOT +#undef Templat +#undef _______ + +static_assert(LastCharKind < (1 << (sizeof(firstCharKinds[0]) * 8)), + "Elements of firstCharKinds[] are too small"); + +bool +TokenStream::getTokenInternal(TokenKind* ttp, Modifier modifier) +{ + int c; + uint32_t qc; + Token* tp; + FirstCharKind c1kind; + const char16_t* numStart; + bool hasExp; + DecimalPoint decimalPoint; + const char16_t* identStart; + bool hadUnicodeEscape; + + // Check if in the middle of a template string. Have to get this out of + // the way first. + if (MOZ_UNLIKELY(modifier == TemplateTail)) { + if (!getStringOrTemplateToken('`', &tp)) + goto error; + goto out; + } + + retry: + if (MOZ_UNLIKELY(!userbuf.hasRawChars())) { + tp = newToken(0); + tp->type = TOK_EOF; + flags.isEOF = true; + goto out; + } + + c = userbuf.getRawChar(); + MOZ_ASSERT(c != EOF); + + // Chars not in the range 0..127 are rare. Getting them out of the way + // early allows subsequent checking to be faster. + if (MOZ_UNLIKELY(c >= 128)) { + if (unicode::IsSpaceOrBOM2(c)) { + if (c == LINE_SEPARATOR || c == PARA_SEPARATOR) { + updateLineInfoForEOL(); + updateFlagsForEOL(); + } + + goto retry; + } + + tp = newToken(-1); + + static_assert('$' < 128, + "IdentifierStart contains '$', but as !IsUnicodeIDStart('$'), " + "ensure that '$' is never handled here"); + static_assert('_' < 128, + "IdentifierStart contains '_', but as !IsUnicodeIDStart('_'), " + "ensure that '_' is never handled here"); + if (unicode::IsUnicodeIDStart(c)) { + identStart = userbuf.addressOfNextRawChar() - 1; + hadUnicodeEscape = false; + goto identifier; + } + + goto badchar; + } + + // Get the token kind, based on the first char. The ordering of c1kind + // comparison is based on the frequency of tokens in real code -- Parsemark + // (which represents typical JS code on the web) and the Unreal demo (which + // represents asm.js code). + // + // Parsemark Unreal + // OneChar 32.9% 39.7% + // Space 25.0% 0.6% + // Ident 19.2% 36.4% + // Dec 7.2% 5.1% + // String 7.9% 0.0% + // EOL 1.7% 0.0% + // BasePrefix 0.4% 4.9% + // Other 5.7% 13.3% + // + // The ordering is based mostly only Parsemark frequencies, with Unreal + // frequencies used to break close categories (e.g. |Dec| and |String|). + // |Other| is biggish, but no other token kind is common enough for it to + // be worth adding extra values to FirstCharKind. + // + c1kind = FirstCharKind(firstCharKinds[c]); + + // Look for an unambiguous single-char token. + // + if (c1kind <= OneChar_Max) { + tp = newToken(-1); + tp->type = TokenKind(c1kind); + goto out; + } + + // Skip over non-EOL whitespace chars. + // + if (c1kind == Space) + goto retry; + + // Look for an identifier. + // + if (c1kind == Ident) { + tp = newToken(-1); + identStart = userbuf.addressOfNextRawChar() - 1; + hadUnicodeEscape = false; + + identifier: + for (;;) { + c = getCharIgnoreEOL(); + if (c == EOF) + break; + if (!unicode::IsIdentifierPart(char16_t(c))) { + if (c != '\\' || !matchUnicodeEscapeIdent(&qc)) + break; + hadUnicodeEscape = true; + } + } + ungetCharIgnoreEOL(c); + + // Identifiers containing no Unicode escapes can be processed directly + // from userbuf. The rest must use the escapes converted via tokenbuf + // before atomizing. + const char16_t* chars; + size_t length; + if (hadUnicodeEscape) { + if (!putIdentInTokenbuf(identStart)) + goto error; + + chars = tokenbuf.begin(); + length = tokenbuf.length(); + } else { + chars = identStart; + length = userbuf.addressOfNextRawChar() - identStart; + } + + // Represent keywords as keyword tokens unless told otherwise. + if (modifier != KeywordIsName) { + if (const KeywordInfo* kw = FindKeyword(chars, length)) { + // That said, keywords can't contain escapes. (Contexts where + // keywords are treated as names, that also sometimes treat + // keywords as keywords, must manually check this requirement.) + // There are two exceptions + // 1) StrictReservedWords: These keywords need to be treated as + // names in non-strict mode. + // 2) yield is also treated as a name if it contains an escape + // sequence. The parser must handle this case separately. + if (hadUnicodeEscape && !( + (kw->tokentype == TOK_STRICT_RESERVED && !strictMode()) || + kw->tokentype == TOK_YIELD)) + { + reportError(JSMSG_ESCAPED_KEYWORD); + goto error; + } + + tp->type = TOK_NAME; + if (!checkForKeyword(kw, &tp->type)) + goto error; + if (tp->type != TOK_NAME && !hadUnicodeEscape) + goto out; + } + } + + JSAtom* atom = AtomizeChars(cx, chars, length); + if (!atom) + goto error; + tp->type = TOK_NAME; + tp->setName(atom->asPropertyName()); + goto out; + } + + // Look for a decimal number. + // + if (c1kind == Dec) { + tp = newToken(-1); + numStart = userbuf.addressOfNextRawChar() - 1; + + decimal: + decimalPoint = NoDecimal; + hasExp = false; + while (JS7_ISDEC(c)) + c = getCharIgnoreEOL(); + + if (c == '.') { + decimalPoint = HasDecimal; + decimal_dot: + do { + c = getCharIgnoreEOL(); + } while (JS7_ISDEC(c)); + } + if (c == 'e' || c == 'E') { + hasExp = true; + c = getCharIgnoreEOL(); + if (c == '+' || c == '-') + c = getCharIgnoreEOL(); + if (!JS7_ISDEC(c)) { + ungetCharIgnoreEOL(c); + reportError(JSMSG_MISSING_EXPONENT); + goto error; + } + do { + c = getCharIgnoreEOL(); + } while (JS7_ISDEC(c)); + } + ungetCharIgnoreEOL(c); + + if (c != EOF && unicode::IsIdentifierStart(char16_t(c))) { + reportError(JSMSG_IDSTART_AFTER_NUMBER); + goto error; + } + + // Unlike identifiers and strings, numbers cannot contain escaped + // chars, so we don't need to use tokenbuf. Instead we can just + // convert the char16_t characters in userbuf to the numeric value. + double dval; + if (!((decimalPoint == HasDecimal) || hasExp)) { + if (!GetDecimalInteger(cx, numStart, userbuf.addressOfNextRawChar(), &dval)) + goto error; + } else { + const char16_t* dummy; + if (!js_strtod(cx, numStart, userbuf.addressOfNextRawChar(), &dummy, &dval)) + goto error; + } + tp->type = TOK_NUMBER; + tp->setNumber(dval, decimalPoint); + goto out; + } + + // Look for a string or a template string. + // + if (c1kind == String) { + if (!getStringOrTemplateToken(c, &tp)) + goto error; + goto out; + } + + // Skip over EOL chars, updating line state along the way. + // + if (c1kind == EOL) { + // If it's a \r\n sequence: treat as a single EOL, skip over the \n. + if (c == '\r' && userbuf.hasRawChars()) + userbuf.matchRawChar('\n'); + updateLineInfoForEOL(); + updateFlagsForEOL(); + goto retry; + } + + // Look for a hexadecimal, octal, or binary number. + // + if (c1kind == BasePrefix) { + tp = newToken(-1); + int radix; + c = getCharIgnoreEOL(); + if (c == 'x' || c == 'X') { + radix = 16; + c = getCharIgnoreEOL(); + if (!JS7_ISHEX(c)) { + ungetCharIgnoreEOL(c); + reportError(JSMSG_MISSING_HEXDIGITS); + goto error; + } + numStart = userbuf.addressOfNextRawChar() - 1; // one past the '0x' + while (JS7_ISHEX(c)) + c = getCharIgnoreEOL(); + } else if (c == 'b' || c == 'B') { + radix = 2; + c = getCharIgnoreEOL(); + if (c != '0' && c != '1') { + ungetCharIgnoreEOL(c); + reportError(JSMSG_MISSING_BINARY_DIGITS); + goto error; + } + numStart = userbuf.addressOfNextRawChar() - 1; // one past the '0b' + while (c == '0' || c == '1') + c = getCharIgnoreEOL(); + } else if (c == 'o' || c == 'O') { + radix = 8; + c = getCharIgnoreEOL(); + if (c < '0' || c > '7') { + ungetCharIgnoreEOL(c); + reportError(JSMSG_MISSING_OCTAL_DIGITS); + goto error; + } + numStart = userbuf.addressOfNextRawChar() - 1; // one past the '0o' + while ('0' <= c && c <= '7') + c = getCharIgnoreEOL(); + } else if (JS7_ISDEC(c)) { + radix = 8; + numStart = userbuf.addressOfNextRawChar() - 1; // one past the '0' + while (JS7_ISDEC(c)) { + // Octal integer literals are not permitted in strict mode code. + if (!reportStrictModeError(JSMSG_DEPRECATED_OCTAL)) + goto error; + + // Outside strict mode, we permit 08 and 09 as decimal numbers, + // which makes our behaviour a superset of the ECMA numeric + // grammar. We might not always be so permissive, so we warn + // about it. + if (c >= '8') { + if (!reportWarning(JSMSG_BAD_OCTAL, c == '8' ? "08" : "09")) { + goto error; + } + goto decimal; // use the decimal scanner for the rest of the number + } + c = getCharIgnoreEOL(); + } + } else { + // '0' not followed by 'x', 'X' or a digit; scan as a decimal number. + numStart = userbuf.addressOfNextRawChar() - 1; + goto decimal; + } + ungetCharIgnoreEOL(c); + + if (c != EOF && unicode::IsIdentifierStart(char16_t(c))) { + reportError(JSMSG_IDSTART_AFTER_NUMBER); + goto error; + } + + double dval; + const char16_t* dummy; + if (!GetPrefixInteger(cx, numStart, userbuf.addressOfNextRawChar(), radix, &dummy, &dval)) + goto error; + tp->type = TOK_NUMBER; + tp->setNumber(dval, NoDecimal); + goto out; + } + + // This handles everything else. + // + MOZ_ASSERT(c1kind == Other); + tp = newToken(-1); + switch (c) { + case '.': + c = getCharIgnoreEOL(); + if (JS7_ISDEC(c)) { + numStart = userbuf.addressOfNextRawChar() - 2; + decimalPoint = HasDecimal; + hasExp = false; + goto decimal_dot; + } + if (c == '.') { + if (matchChar('.')) { + tp->type = TOK_TRIPLEDOT; + goto out; + } + } + ungetCharIgnoreEOL(c); + tp->type = TOK_DOT; + goto out; + + case '=': + if (matchChar('=')) + tp->type = matchChar('=') ? TOK_STRICTEQ : TOK_EQ; + else if (matchChar('>')) + tp->type = TOK_ARROW; + else + tp->type = TOK_ASSIGN; + goto out; + + case '+': + if (matchChar('+')) + tp->type = TOK_INC; + else + tp->type = matchChar('=') ? TOK_ADDASSIGN : TOK_ADD; + goto out; + + case '\\': { + uint32_t escapeLength = matchUnicodeEscapeIdStart(&qc); + if (escapeLength > 0) { + identStart = userbuf.addressOfNextRawChar() - escapeLength - 1; + hadUnicodeEscape = true; + goto identifier; + } + goto badchar; + } + + case '|': + if (matchChar('|')) + tp->type = TOK_OR; + else + tp->type = matchChar('=') ? TOK_BITORASSIGN : TOK_BITOR; + goto out; + + case '^': + tp->type = matchChar('=') ? TOK_BITXORASSIGN : TOK_BITXOR; + goto out; + + case '&': + if (matchChar('&')) + tp->type = TOK_AND; + else + tp->type = matchChar('=') ? TOK_BITANDASSIGN : TOK_BITAND; + goto out; + + case '!': + if (matchChar('=')) + tp->type = matchChar('=') ? TOK_STRICTNE : TOK_NE; + else + tp->type = TOK_NOT; + goto out; + + case '<': + // NB: treat HTML begin-comment as comment-till-end-of-line. + if (matchChar('!')) { + if (matchChar('-')) { + if (matchChar('-')) + goto skipline; + ungetChar('-'); + } + ungetChar('!'); + } + if (matchChar('<')) { + tp->type = matchChar('=') ? TOK_LSHASSIGN : TOK_LSH; + } else { + tp->type = matchChar('=') ? TOK_LE : TOK_LT; + } + goto out; + + case '>': + if (matchChar('>')) { + if (matchChar('>')) + tp->type = matchChar('=') ? TOK_URSHASSIGN : TOK_URSH; + else + tp->type = matchChar('=') ? TOK_RSHASSIGN : TOK_RSH; + } else { + tp->type = matchChar('=') ? TOK_GE : TOK_GT; + } + goto out; + + case '*': + if (matchChar('*')) + tp->type = matchChar('=') ? TOK_POWASSIGN : TOK_POW; + else + tp->type = matchChar('=') ? TOK_MULASSIGN : TOK_MUL; + goto out; + + case '/': + // Look for a single-line comment. + if (matchChar('/')) { + c = peekChar(); + if (c == '@' || c == '#') { + bool shouldWarn = getChar() == '@'; + if (!getDirectives(false, shouldWarn)) + goto error; + } + + skipline: + while ((c = getChar()) != EOF && c != '\n') + continue; + ungetChar(c); + cursor = (cursor - 1) & ntokensMask; + goto retry; + } + + // Look for a multi-line comment. + if (matchChar('*')) { + unsigned linenoBefore = lineno; + while ((c = getChar()) != EOF && + !(c == '*' && matchChar('/'))) { + if (c == '@' || c == '#') { + bool shouldWarn = c == '@'; + if (!getDirectives(true, shouldWarn)) + goto error; + } + } + if (c == EOF) { + reportError(JSMSG_UNTERMINATED_COMMENT); + goto error; + } + if (linenoBefore != lineno) + updateFlagsForEOL(); + cursor = (cursor - 1) & ntokensMask; + goto retry; + } + + // Look for a regexp. + if (modifier == Operand) { + tokenbuf.clear(); + + bool inCharClass = false; + for (;;) { + c = getChar(); + if (c == '\\') { + if (!tokenbuf.append(c)) + goto error; + c = getChar(); + } else if (c == '[') { + inCharClass = true; + } else if (c == ']') { + inCharClass = false; + } else if (c == '/' && !inCharClass) { + // For compat with IE, allow unescaped / in char classes. + break; + } + if (c == '\n' || c == EOF) { + ungetChar(c); + reportError(JSMSG_UNTERMINATED_REGEXP); + goto error; + } + if (!tokenbuf.append(c)) + goto error; + } + + RegExpFlag reflags = NoFlags; + unsigned length = tokenbuf.length() + 1; + while (true) { + c = peekChar(); + if (c == 'g' && !(reflags & GlobalFlag)) + reflags = RegExpFlag(reflags | GlobalFlag); + else if (c == 'i' && !(reflags & IgnoreCaseFlag)) + reflags = RegExpFlag(reflags | IgnoreCaseFlag); + else if (c == 'm' && !(reflags & MultilineFlag)) + reflags = RegExpFlag(reflags | MultilineFlag); + else if (c == 'y' && !(reflags & StickyFlag)) + reflags = RegExpFlag(reflags | StickyFlag); + else if (c == 'u' && !(reflags & UnicodeFlag)) + reflags = RegExpFlag(reflags | UnicodeFlag); + else + break; + getChar(); + length++; + } + + c = peekChar(); + if (JS7_ISLET(c)) { + char buf[2] = { '\0', '\0' }; + tp->pos.begin += length + 1; + buf[0] = char(c); + reportError(JSMSG_BAD_REGEXP_FLAG, buf); + (void) getChar(); + goto error; + } + tp->type = TOK_REGEXP; + tp->setRegExpFlags(reflags); + goto out; + } + + tp->type = matchChar('=') ? TOK_DIVASSIGN : TOK_DIV; + goto out; + + case '%': + tp->type = matchChar('=') ? TOK_MODASSIGN : TOK_MOD; + goto out; + + case '-': + if (matchChar('-')) { + if (peekChar() == '>' && !flags.isDirtyLine) + goto skipline; + tp->type = TOK_DEC; + } else { + tp->type = matchChar('=') ? TOK_SUBASSIGN : TOK_SUB; + } + goto out; + + badchar: + default: + reportError(JSMSG_ILLEGAL_CHARACTER); + goto error; + } + + MOZ_CRASH("should have jumped to |out| or |error|"); + + out: + if (flags.hitOOM) + return reportError(JSMSG_OUT_OF_MEMORY); + + flags.isDirtyLine = true; + tp->pos.end = userbuf.offset(); +#ifdef DEBUG + // Save the modifier used to get this token, so that if an ungetToken() + // occurs and then the token is re-gotten (or peeked, etc.), we can assert + // that both gets have used the same modifiers. + tp->modifier = modifier; + tp->modifierException = NoException; +#endif + MOZ_ASSERT(IsTokenSane(tp)); + *ttp = tp->type; + return true; + + error: + if (flags.hitOOM) + return reportError(JSMSG_OUT_OF_MEMORY); + + flags.isDirtyLine = true; + tp->pos.end = userbuf.offset(); + MOZ_MAKE_MEM_UNDEFINED(&tp->type, sizeof(tp->type)); + flags.hadError = true; +#ifdef DEBUG + // Poisoning userbuf on error establishes an invariant: once an erroneous + // token has been seen, userbuf will not be consulted again. This is true + // because the parser will deal with the illegal token by aborting parsing + // immediately. + userbuf.poison(); +#endif + MOZ_MAKE_MEM_UNDEFINED(ttp, sizeof(*ttp)); + return false; +} + +bool +TokenStream::getBracedUnicode(uint32_t* cp) +{ + consumeKnownChar('{'); + + bool first = true; + int32_t c; + uint32_t code = 0; + while (true) { + c = getCharIgnoreEOL(); + if (c == EOF) + return false; + if (c == '}') { + if (first) + return false; + break; + } + + if (!JS7_ISHEX(c)) + return false; + + code = (code << 4) | JS7_UNHEX(c); + if (code > unicode::NonBMPMax) + return false; + first = false; + } + + *cp = code; + return true; +} + +bool +TokenStream::getStringOrTemplateToken(int untilChar, Token** tp) +{ + int c; + int nc = -1; + + bool parsingTemplate = (untilChar == '`'); + + *tp = newToken(-1); + tokenbuf.clear(); + + // We need to detect any of these chars: " or ', \n (or its + // equivalents), \\, EOF. Because we detect EOL sequences here and + // put them back immediately, we can use getCharIgnoreEOL(). + while ((c = getCharIgnoreEOL()) != untilChar) { + if (c == EOF) { + ungetCharIgnoreEOL(c); + reportError(JSMSG_UNTERMINATED_STRING); + return false; + } + + if (c == '\\') { + switch (c = getChar()) { + case 'b': c = '\b'; break; + case 'f': c = '\f'; break; + case 'n': c = '\n'; break; + case 'r': c = '\r'; break; + case 't': c = '\t'; break; + case 'v': c = '\v'; break; + + case '\n': + // ES5 7.8.4: an escaped line terminator represents + // no character. + continue; + + // Unicode character specification. + case 'u': { + if (peekChar() == '{') { + uint32_t code; + if (!getBracedUnicode(&code)) { + reportError(JSMSG_MALFORMED_ESCAPE, "Unicode"); + return false; + } + + MOZ_ASSERT(code <= unicode::NonBMPMax); + if (code < unicode::NonBMPMin) { + c = code; + } else { + if (!tokenbuf.append(unicode::LeadSurrogate(code))) + return false; + c = unicode::TrailSurrogate(code); + } + break; + } + + char16_t cp[4]; + if (peekChars(4, cp) && + JS7_ISHEX(cp[0]) && JS7_ISHEX(cp[1]) && JS7_ISHEX(cp[2]) && JS7_ISHEX(cp[3])) + { + c = JS7_UNHEX(cp[0]); + c = (c << 4) + JS7_UNHEX(cp[1]); + c = (c << 4) + JS7_UNHEX(cp[2]); + c = (c << 4) + JS7_UNHEX(cp[3]); + skipChars(4); + } else { + reportError(JSMSG_MALFORMED_ESCAPE, "Unicode"); + return false; + } + break; + } + + // Hexadecimal character specification. + case 'x': { + char16_t cp[2]; + if (peekChars(2, cp) && JS7_ISHEX(cp[0]) && JS7_ISHEX(cp[1])) { + c = (JS7_UNHEX(cp[0]) << 4) + JS7_UNHEX(cp[1]); + skipChars(2); + } else { + reportError(JSMSG_MALFORMED_ESCAPE, "hexadecimal"); + return false; + } + break; + } + + default: + // Octal character specification. + if (JS7_ISOCT(c)) { + int32_t val = JS7_UNOCT(c); + + c = peekChar(); + + // Strict mode code allows only \0, then a non-digit. + if (val != 0 || JS7_ISDEC(c)) { + if (parsingTemplate) { + reportError(JSMSG_DEPRECATED_OCTAL); + return false; + } + if (!reportStrictModeError(JSMSG_DEPRECATED_OCTAL)) + return false; + flags.sawOctalEscape = true; + } + + if (JS7_ISOCT(c)) { + val = 8 * val + JS7_UNOCT(c); + getChar(); + c = peekChar(); + if (JS7_ISOCT(c)) { + int32_t save = val; + val = 8 * val + JS7_UNOCT(c); + if (val <= 0xFF) + getChar(); + else + val = save; + } + } + + c = char16_t(val); + } + break; + } + } else if (TokenBuf::isRawEOLChar(c)) { + if (!parsingTemplate) { + ungetCharIgnoreEOL(c); + reportError(JSMSG_UNTERMINATED_STRING); + return false; + } + if (c == '\r') { + c = '\n'; + if (userbuf.peekRawChar() == '\n') + skipCharsIgnoreEOL(1); + } + updateLineInfoForEOL(); + updateFlagsForEOL(); + } else if (parsingTemplate && c == '$') { + if ((nc = getCharIgnoreEOL()) == '{') + break; + ungetCharIgnoreEOL(nc); + } + + if (!tokenbuf.append(c)) { + ReportOutOfMemory(cx); + return false; + } + } + + JSAtom* atom = atomize(cx, tokenbuf); + if (!atom) + return false; + + if (!parsingTemplate) { + (*tp)->type = TOK_STRING; + } else { + if (c == '$' && nc == '{') + (*tp)->type = TOK_TEMPLATE_HEAD; + else + (*tp)->type = TOK_NO_SUBS_TEMPLATE; + } + + (*tp)->setAtom(atom); + return true; +} + +JS_FRIEND_API(int) +js_fgets(char* buf, int size, FILE* file) +{ + int n, i, c; + bool crflag; + + n = size - 1; + if (n < 0) + return -1; + + crflag = false; + for (i = 0; i < n && (c = fast_getc(file)) != EOF; i++) { + buf[i] = c; + if (c == '\n') { // any \n ends a line + i++; // keep the \n; we know there is room for \0 + break; + } + if (crflag) { // \r not followed by \n ends line at the \r + ungetc(c, file); + break; // and overwrite c in buf with \0 + } + crflag = (c == '\r'); + } + + buf[i] = '\0'; + return i; +} + +const char* +frontend::TokenKindToDesc(TokenKind tt) +{ + switch (tt) { +#define EMIT_CASE(name, desc) case TOK_##name: return desc; + FOR_EACH_TOKEN_KIND(EMIT_CASE) +#undef EMIT_CASE + case TOK_LIMIT: + MOZ_ASSERT_UNREACHABLE("TOK_LIMIT should not be passed."); + break; + } + + return "<bad TokenKind>"; +} + +#ifdef DEBUG +const char* +TokenKindToString(TokenKind tt) +{ + switch (tt) { +#define EMIT_CASE(name, desc) case TOK_##name: return "TOK_" #name; + FOR_EACH_TOKEN_KIND(EMIT_CASE) +#undef EMIT_CASE + case TOK_LIMIT: break; + } + + return "<bad TokenKind>"; +} +#endif diff --git a/js/src/frontend/TokenStream.h b/js/src/frontend/TokenStream.h new file mode 100644 index 000000000..29dcead62 --- /dev/null +++ b/js/src/frontend/TokenStream.h @@ -0,0 +1,1057 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- + * vim: set ts=8 sts=4 et sw=4 tw=99: + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#ifndef frontend_TokenStream_h +#define frontend_TokenStream_h + +// JS lexical scanner interface. + +#include "mozilla/ArrayUtils.h" +#include "mozilla/Assertions.h" +#include "mozilla/Attributes.h" +#include "mozilla/DebugOnly.h" +#include "mozilla/PodOperations.h" + +#include <stdarg.h> +#include <stddef.h> +#include <stdio.h> + +#include "jscntxt.h" +#include "jspubtd.h" + +#include "frontend/TokenKind.h" +#include "js/UniquePtr.h" +#include "js/Vector.h" +#include "vm/RegExpObject.h" + +struct KeywordInfo; + +namespace js { +namespace frontend { + +class AutoAwaitIsKeyword; + +struct TokenPos { + uint32_t begin; // Offset of the token's first char. + uint32_t end; // Offset of 1 past the token's last char. + + TokenPos() {} + TokenPos(uint32_t begin, uint32_t end) : begin(begin), end(end) {} + + // Return a TokenPos that covers left, right, and anything in between. + static TokenPos box(const TokenPos& left, const TokenPos& right) { + MOZ_ASSERT(left.begin <= left.end); + MOZ_ASSERT(left.end <= right.begin); + MOZ_ASSERT(right.begin <= right.end); + return TokenPos(left.begin, right.end); + } + + bool operator==(const TokenPos& bpos) const { + return begin == bpos.begin && end == bpos.end; + } + + bool operator!=(const TokenPos& bpos) const { + return begin != bpos.begin || end != bpos.end; + } + + bool operator <(const TokenPos& bpos) const { + return begin < bpos.begin; + } + + bool operator <=(const TokenPos& bpos) const { + return begin <= bpos.begin; + } + + bool operator >(const TokenPos& bpos) const { + return !(*this <= bpos); + } + + bool operator >=(const TokenPos& bpos) const { + return !(*this < bpos); + } + + bool encloses(const TokenPos& pos) const { + return begin <= pos.begin && pos.end <= end; + } +}; + +enum DecimalPoint { NoDecimal = false, HasDecimal = true }; + +class TokenStream; + +struct Token +{ + private: + // Sometimes the parser needs to inform the tokenizer to interpret + // subsequent text in a particular manner: for example, to tokenize a + // keyword as an identifier, not as the actual keyword, on the right-hand + // side of a dotted property access. Such information is communicated to + // the tokenizer as a Modifier when getting the next token. + // + // Ideally this definition would reside in TokenStream as that's the real + // user, but the debugging-use of it here causes a cyclic dependency (and + // C++ provides no way to forward-declare an enum inside a class). So + // define it here, then typedef it into TokenStream with static consts to + // bring the initializers into scope. + enum Modifier + { + // Normal operation. + None, + + // Looking for an operand, not an operator. In practice, this means + // that when '/' is seen, we look for a regexp instead of just returning + // TOK_DIV. + Operand, + + // Treat keywords as names by returning TOK_NAME. + KeywordIsName, + + // Treat subsequent characters as the tail of a template literal, after + // a template substitution, beginning with a "}", continuing with zero + // or more template literal characters, and ending with either "${" or + // the end of the template literal. For example: + // + // var entity = "world"; + // var s = `Hello ${entity}!`; + // ^ TemplateTail context + TemplateTail, + }; + enum ModifierException + { + NoException, + + // Used in following 2 cases: + // a) After |yield| we look for a token on the same line that starts an + // expression (Operand): |yield <expr>|. If no token is found, the + // |yield| stands alone, and the next token on a subsequent line must + // be: a comma continuing a comma expression, a semicolon terminating + // the statement that ended with |yield|, or the start of another + // statement (possibly an expression statement). The comma/semicolon + // cases are gotten as operators (None), contrasting with Operand + // earlier. + // b) After an arrow function with a block body in an expression + // statement, the next token must be: a colon in a conditional + // expression, a comma continuing a comma expression, a semicolon + // terminating the statement, or the token on a subsequent line that is + // the start of another statement (possibly an expression statement). + // Colon is gotten as operator (None), and it should only be gotten in + // conditional expression and missing it results in SyntaxError. + // Comma/semicolon cases are also gotten as operators (None), and 4th + // case is gotten after them. If no comma/semicolon found but EOL, + // the next token should be gotten as operand in 4th case (especially if + // '/' is the first character). So we should peek the token as + // operand before try getting colon/comma/semicolon. + // See also the comment in Parser::assignExpr(). + NoneIsOperand, + + // If a semicolon is inserted automatically, the next token is already + // gotten with None, but we expect Operand. + OperandIsNone, + + // If name of method definition is `get` or `set`, the next token is + // already gotten with KeywordIsName, but we expect None. + NoneIsKeywordIsName, + }; + friend class TokenStream; + + public: + TokenKind type; // char value or above enumerator + TokenPos pos; // token position in file + union { + private: + friend struct Token; + PropertyName* name; // non-numeric atom + JSAtom* atom; // potentially-numeric atom + struct { + double value; // floating point number + DecimalPoint decimalPoint; // literal contains '.' + } number; + RegExpFlag reflags; // regexp flags; use tokenbuf to access + // regexp chars + } u; +#ifdef DEBUG + Modifier modifier; // Modifier used to get this token + ModifierException modifierException; // Exception for this modifier +#endif + + // Mutators + + void setName(PropertyName* name) { + MOZ_ASSERT(type == TOK_NAME); + u.name = name; + } + + void setAtom(JSAtom* atom) { + MOZ_ASSERT(type == TOK_STRING || + type == TOK_TEMPLATE_HEAD || + type == TOK_NO_SUBS_TEMPLATE); + u.atom = atom; + } + + void setRegExpFlags(js::RegExpFlag flags) { + MOZ_ASSERT(type == TOK_REGEXP); + MOZ_ASSERT((flags & AllFlags) == flags); + u.reflags = flags; + } + + void setNumber(double n, DecimalPoint decimalPoint) { + MOZ_ASSERT(type == TOK_NUMBER); + u.number.value = n; + u.number.decimalPoint = decimalPoint; + } + + // Type-safe accessors + + PropertyName* name() const { + MOZ_ASSERT(type == TOK_NAME); + return u.name->JSAtom::asPropertyName(); // poor-man's type verification + } + + bool nameContainsEscape() const { + PropertyName* n = name(); + return pos.begin + n->length() != pos.end; + } + + JSAtom* atom() const { + MOZ_ASSERT(type == TOK_STRING || + type == TOK_TEMPLATE_HEAD || + type == TOK_NO_SUBS_TEMPLATE); + return u.atom; + } + + js::RegExpFlag regExpFlags() const { + MOZ_ASSERT(type == TOK_REGEXP); + MOZ_ASSERT((u.reflags & AllFlags) == u.reflags); + return u.reflags; + } + + double number() const { + MOZ_ASSERT(type == TOK_NUMBER); + return u.number.value; + } + + DecimalPoint decimalPoint() const { + MOZ_ASSERT(type == TOK_NUMBER); + return u.number.decimalPoint; + } +}; + +class CompileError : public JSErrorReport { +public: + void throwError(JSContext* cx); +}; + +// Ideally, tokenizing would be entirely independent of context. But the +// strict mode flag, which is in SharedContext, affects tokenizing, and +// TokenStream needs to see it. +// +// This class is a tiny back-channel from TokenStream to the strict mode flag +// that avoids exposing the rest of SharedContext to TokenStream. +// +class StrictModeGetter { + public: + virtual bool strictMode() = 0; +}; + +// TokenStream is the lexical scanner for Javascript source text. +// +// It takes a buffer of char16_t characters and linearly scans it into |Token|s. +// Internally the class uses a four element circular buffer |tokens| of +// |Token|s. As an index for |tokens|, the member |cursor| points to the +// current token. +// Calls to getToken() increase |cursor| by one and return the new current +// token. If a TokenStream was just created, the current token is initialized +// with random data (i.e. not initialized). It is therefore important that +// one of the first four member functions listed below is called first. +// The circular buffer lets us go back up to two tokens from the last +// scanned token. Internally, the relative number of backward steps that were +// taken (via ungetToken()) after the last token was scanned is stored in +// |lookahead|. +// +// The following table lists in which situations it is safe to call each listed +// function. No checks are made by the functions in non-debug builds. +// +// Function Name | Precondition; changes to |lookahead| +// ------------------+--------------------------------------------------------- +// getToken | none; if |lookahead > 0| then |lookahead--| +// peekToken | none; if |lookahead == 0| then |lookahead == 1| +// peekTokenSameLine | none; if |lookahead == 0| then |lookahead == 1| +// matchToken | none; if |lookahead > 0| and the match succeeds then +// | |lookahead--| +// consumeKnownToken | none; if |lookahead > 0| then |lookahead--| +// ungetToken | 0 <= |lookahead| <= |maxLookahead - 1|; |lookahead++| +// +// The behavior of the token scanning process (see getTokenInternal()) can be +// modified by calling one of the first four above listed member functions with +// an optional argument of type Modifier. However, the modifier will be +// ignored unless |lookahead == 0| holds. Due to constraints of the grammar, +// this turns out not to be a problem in practice. See the +// mozilla.dev.tech.js-engine.internals thread entitled 'Bug in the scanner?' +// for more details: +// https://groups.google.com/forum/?fromgroups=#!topic/mozilla.dev.tech.js-engine.internals/2JLH5jRcr7E). +// +// The methods seek() and tell() allow to rescan from a previous visited +// location of the buffer. +// +class MOZ_STACK_CLASS TokenStream +{ + // Unicode separators that are treated as line terminators, in addition to \n, \r. + enum { + LINE_SEPARATOR = 0x2028, + PARA_SEPARATOR = 0x2029 + }; + + static const size_t ntokens = 4; // 1 current + 2 lookahead, rounded + // to power of 2 to avoid divmod by 3 + static const unsigned maxLookahead = 2; + static const unsigned ntokensMask = ntokens - 1; + + public: + typedef Vector<char16_t, 32> CharBuffer; + + TokenStream(ExclusiveContext* cx, const ReadOnlyCompileOptions& options, + const char16_t* base, size_t length, StrictModeGetter* smg); + + ~TokenStream(); + + MOZ_MUST_USE bool checkOptions(); + + // Accessors. + const Token& currentToken() const { return tokens[cursor]; } + bool isCurrentTokenType(TokenKind type) const { + return currentToken().type == type; + } + const CharBuffer& getTokenbuf() const { return tokenbuf; } + const char* getFilename() const { return filename; } + bool getMutedErrors() const { return mutedErrors; } + JSVersion versionNumber() const { return VersionNumber(options().version); } + JSVersion versionWithFlags() const { return options().version; } + + PropertyName* currentName() const { + if (isCurrentTokenType(TOK_YIELD)) + return cx->names().yield; + MOZ_ASSERT(isCurrentTokenType(TOK_NAME)); + return currentToken().name(); + } + + PropertyName* nextName() const { + if (nextToken().type == TOK_YIELD) + return cx->names().yield; + MOZ_ASSERT(nextToken().type == TOK_NAME); + return nextToken().name(); + } + + bool nextNameContainsEscape() const { + if (nextToken().type == TOK_YIELD) + return false; + MOZ_ASSERT(nextToken().type == TOK_NAME); + return nextToken().nameContainsEscape(); + } + + bool isCurrentTokenAssignment() const { + return TokenKindIsAssignment(currentToken().type); + } + + // Flag methods. + bool isEOF() const { return flags.isEOF; } + bool sawOctalEscape() const { return flags.sawOctalEscape; } + bool hadError() const { return flags.hadError; } + void clearSawOctalEscape() { flags.sawOctalEscape = false; } + + // TokenStream-specific error reporters. + bool reportError(unsigned errorNumber, ...); + bool reportErrorNoOffset(unsigned errorNumber, ...); + bool reportWarning(unsigned errorNumber, ...); + + static const uint32_t NoOffset = UINT32_MAX; + + // General-purpose error reporters. You should avoid calling these + // directly, and instead use the more succinct alternatives (e.g. + // reportError()) in TokenStream, Parser, and BytecodeEmitter. + bool reportCompileErrorNumberVA(uint32_t offset, unsigned flags, unsigned errorNumber, + va_list args); + bool reportStrictModeErrorNumberVA(uint32_t offset, bool strictMode, unsigned errorNumber, + va_list args); + bool reportStrictWarningErrorNumberVA(uint32_t offset, unsigned errorNumber, + va_list args); + + // asm.js reporter + void reportAsmJSError(uint32_t offset, unsigned errorNumber, ...); + + JSAtom* getRawTemplateStringAtom() { + MOZ_ASSERT(currentToken().type == TOK_TEMPLATE_HEAD || + currentToken().type == TOK_NO_SUBS_TEMPLATE); + const char16_t* cur = userbuf.rawCharPtrAt(currentToken().pos.begin + 1); + const char16_t* end; + if (currentToken().type == TOK_TEMPLATE_HEAD) { + // Of the form |`...${| or |}...${| + end = userbuf.rawCharPtrAt(currentToken().pos.end - 2); + } else { + // NO_SUBS_TEMPLATE is of the form |`...`| or |}...`| + end = userbuf.rawCharPtrAt(currentToken().pos.end - 1); + } + + CharBuffer charbuf(cx); + while (cur < end) { + int32_t ch = *cur; + if (ch == '\r') { + ch = '\n'; + if ((cur + 1 < end) && (*(cur + 1) == '\n')) + cur++; + } + if (!charbuf.append(ch)) + return nullptr; + cur++; + } + return AtomizeChars(cx, charbuf.begin(), charbuf.length()); + } + + private: + // These are private because they should only be called by the tokenizer + // while tokenizing not by, for example, BytecodeEmitter. + bool reportStrictModeError(unsigned errorNumber, ...); + bool strictMode() const { return strictModeGetter && strictModeGetter->strictMode(); } + + static JSAtom* atomize(ExclusiveContext* cx, CharBuffer& cb); + MOZ_MUST_USE bool putIdentInTokenbuf(const char16_t* identStart); + + struct Flags + { + bool isEOF:1; // Hit end of file. + bool isDirtyLine:1; // Non-whitespace since start of line. + bool sawOctalEscape:1; // Saw an octal character escape. + bool hadError:1; // Hit a syntax error, at start or during a + // token. + bool hitOOM:1; // Hit OOM. + + Flags() + : isEOF(), isDirtyLine(), sawOctalEscape(), hadError(), hitOOM() + {} + }; + + bool awaitIsKeyword = false; + friend class AutoAwaitIsKeyword; + + public: + typedef Token::Modifier Modifier; + static constexpr Modifier None = Token::None; + static constexpr Modifier Operand = Token::Operand; + static constexpr Modifier KeywordIsName = Token::KeywordIsName; + static constexpr Modifier TemplateTail = Token::TemplateTail; + + typedef Token::ModifierException ModifierException; + static constexpr ModifierException NoException = Token::NoException; + static constexpr ModifierException NoneIsOperand = Token::NoneIsOperand; + static constexpr ModifierException OperandIsNone = Token::OperandIsNone; + static constexpr ModifierException NoneIsKeywordIsName = Token::NoneIsKeywordIsName; + + void addModifierException(ModifierException modifierException) { +#ifdef DEBUG + const Token& next = nextToken(); + if (next.modifierException == NoneIsOperand) + { + // Token after yield expression without operand already has + // NoneIsOperand exception. + MOZ_ASSERT(modifierException == OperandIsNone); + MOZ_ASSERT(next.type != TOK_DIV, + "next token requires contextual specifier to be parsed unambiguously"); + + // Do not update modifierException. + return; + } + + MOZ_ASSERT(next.modifierException == NoException); + switch (modifierException) { + case NoneIsOperand: + MOZ_ASSERT(next.modifier == Operand); + MOZ_ASSERT(next.type != TOK_DIV, + "next token requires contextual specifier to be parsed unambiguously"); + break; + case OperandIsNone: + MOZ_ASSERT(next.modifier == None); + MOZ_ASSERT(next.type != TOK_DIV && next.type != TOK_REGEXP, + "next token requires contextual specifier to be parsed unambiguously"); + break; + case NoneIsKeywordIsName: + MOZ_ASSERT(next.modifier == KeywordIsName); + MOZ_ASSERT(next.type != TOK_NAME); + break; + default: + MOZ_CRASH("unexpected modifier exception"); + } + tokens[(cursor + 1) & ntokensMask].modifierException = modifierException; +#endif + } + + void + verifyConsistentModifier(Modifier modifier, Token lookaheadToken) { +#ifdef DEBUG + // Easy case: modifiers match. + if (modifier == lookaheadToken.modifier) + return; + + if (lookaheadToken.modifierException == OperandIsNone) { + // getToken(Operand) permissibly following getToken(). + if (modifier == Operand && lookaheadToken.modifier == None) + return; + } + + if (lookaheadToken.modifierException == NoneIsOperand) { + // getToken() permissibly following getToken(Operand). + if (modifier == None && lookaheadToken.modifier == Operand) + return; + } + + if (lookaheadToken.modifierException == NoneIsKeywordIsName) { + // getToken() permissibly following getToken(KeywordIsName). + if (modifier == None && lookaheadToken.modifier == KeywordIsName) + return; + } + + MOZ_ASSERT_UNREACHABLE("this token was previously looked up with a " + "different modifier, potentially making " + "tokenization non-deterministic"); +#endif + } + + // Advance to the next token. If the token stream encountered an error, + // return false. Otherwise return true and store the token kind in |*ttp|. + MOZ_MUST_USE bool getToken(TokenKind* ttp, Modifier modifier = None) { + // Check for a pushed-back token resulting from mismatching lookahead. + if (lookahead != 0) { + MOZ_ASSERT(!flags.hadError); + lookahead--; + cursor = (cursor + 1) & ntokensMask; + TokenKind tt = currentToken().type; + MOZ_ASSERT(tt != TOK_EOL); + verifyConsistentModifier(modifier, currentToken()); + *ttp = tt; + return true; + } + + return getTokenInternal(ttp, modifier); + } + + // Push the last scanned token back into the stream. + void ungetToken() { + MOZ_ASSERT(lookahead < maxLookahead); + lookahead++; + cursor = (cursor - 1) & ntokensMask; + } + + MOZ_MUST_USE bool peekToken(TokenKind* ttp, Modifier modifier = None) { + if (lookahead > 0) { + MOZ_ASSERT(!flags.hadError); + verifyConsistentModifier(modifier, nextToken()); + *ttp = nextToken().type; + return true; + } + if (!getTokenInternal(ttp, modifier)) + return false; + ungetToken(); + return true; + } + + MOZ_MUST_USE bool peekTokenPos(TokenPos* posp, Modifier modifier = None) { + if (lookahead == 0) { + TokenKind tt; + if (!getTokenInternal(&tt, modifier)) + return false; + ungetToken(); + MOZ_ASSERT(hasLookahead()); + } else { + MOZ_ASSERT(!flags.hadError); + verifyConsistentModifier(modifier, nextToken()); + } + *posp = nextToken().pos; + return true; + } + + // This is like peekToken(), with one exception: if there is an EOL + // between the end of the current token and the start of the next token, it + // return true and store TOK_EOL in |*ttp|. In that case, no token with + // TOK_EOL is actually created, just a TOK_EOL TokenKind is returned, and + // currentToken() shouldn't be consulted. (This is the only place TOK_EOL + // is produced.) + MOZ_ALWAYS_INLINE MOZ_MUST_USE bool + peekTokenSameLine(TokenKind* ttp, Modifier modifier = None) { + const Token& curr = currentToken(); + + // If lookahead != 0, we have scanned ahead at least one token, and + // |lineno| is the line that the furthest-scanned token ends on. If + // it's the same as the line that the current token ends on, that's a + // stronger condition than what we are looking for, and we don't need + // to return TOK_EOL. + if (lookahead != 0) { + bool onThisLine; + if (!srcCoords.isOnThisLine(curr.pos.end, lineno, &onThisLine)) + return reportError(JSMSG_OUT_OF_MEMORY); + if (onThisLine) { + MOZ_ASSERT(!flags.hadError); + verifyConsistentModifier(modifier, nextToken()); + *ttp = nextToken().type; + return true; + } + } + + // The above check misses two cases where we don't have to return + // TOK_EOL. + // - The next token starts on the same line, but is a multi-line token. + // - The next token starts on the same line, but lookahead==2 and there + // is a newline between the next token and the one after that. + // The following test is somewhat expensive but gets these cases (and + // all others) right. + TokenKind tmp; + if (!getToken(&tmp, modifier)) + return false; + const Token& next = currentToken(); + ungetToken(); + + *ttp = srcCoords.lineNum(curr.pos.end) == srcCoords.lineNum(next.pos.begin) + ? next.type + : TOK_EOL; + return true; + } + + // Get the next token from the stream if its kind is |tt|. + MOZ_MUST_USE bool matchToken(bool* matchedp, TokenKind tt, Modifier modifier = None) { + TokenKind token; + if (!getToken(&token, modifier)) + return false; + if (token == tt) { + *matchedp = true; + } else { + ungetToken(); + *matchedp = false; + } + return true; + } + + void consumeKnownToken(TokenKind tt, Modifier modifier = None) { + bool matched; + MOZ_ASSERT(hasLookahead()); + MOZ_ALWAYS_TRUE(matchToken(&matched, tt, modifier)); + MOZ_ALWAYS_TRUE(matched); + } + + // Like matchToken(..., TOK_NAME) but further matching the name token only + // if it has the given characters, without containing escape sequences. + // If the name token has the given characters yet *does* contain an escape, + // a syntax error will be reported. + // + // This latter behavior makes this method unsuitable for use in any context + // where ASI might occur. In such places, an escaped "contextual keyword" + // on a new line is the start of an ExpressionStatement, not a continuation + // of a StatementListItem (or ImportDeclaration or ExportDeclaration, in + // modules). + MOZ_MUST_USE bool matchContextualKeyword(bool* matchedp, Handle<PropertyName*> keyword, + Modifier modifier = None) + { + TokenKind token; + if (!getToken(&token, modifier)) + return false; + if (token == TOK_NAME && currentToken().name() == keyword) { + if (currentToken().nameContainsEscape()) { + reportError(JSMSG_ESCAPED_KEYWORD); + return false; + } + + *matchedp = true; + } else { + *matchedp = false; + ungetToken(); + } + return true; + } + + MOZ_MUST_USE bool nextTokenEndsExpr(bool* endsExpr) { + TokenKind tt; + if (!peekToken(&tt)) + return false; + *endsExpr = isExprEnding[tt]; + return true; + } + + class MOZ_STACK_CLASS Position { + public: + // The Token fields may contain pointers to atoms, so for correct + // rooting we must ensure collection of atoms is disabled while objects + // of this class are live. Do this by requiring a dummy AutoKeepAtoms + // reference in the constructor. + // + // This class is explicity ignored by the analysis, so don't add any + // more pointers to GC things here! + explicit Position(AutoKeepAtoms&) { } + private: + Position(const Position&) = delete; + friend class TokenStream; + const char16_t* buf; + Flags flags; + unsigned lineno; + size_t linebase; + size_t prevLinebase; + Token currentToken; + unsigned lookahead; + Token lookaheadTokens[maxLookahead]; + }; + + MOZ_MUST_USE bool advance(size_t position); + void tell(Position*); + void seek(const Position& pos); + MOZ_MUST_USE bool seek(const Position& pos, const TokenStream& other); +#ifdef DEBUG + inline bool debugHasNoLookahead() const { + return lookahead == 0; + } +#endif + + const char16_t* rawCharPtrAt(size_t offset) const { + return userbuf.rawCharPtrAt(offset); + } + + const char16_t* rawLimit() const { + return userbuf.limit(); + } + + bool hasDisplayURL() const { + return displayURL_ != nullptr; + } + + char16_t* displayURL() { + return displayURL_.get(); + } + + bool hasSourceMapURL() const { + return sourceMapURL_ != nullptr; + } + + char16_t* sourceMapURL() { + return sourceMapURL_.get(); + } + + // If |atom| is not a keyword in this version, return true with *ttp + // unchanged. + // + // If it is a reserved word in this version and strictness mode, and thus + // can't be present in correct code, report a SyntaxError and return false. + // + // If it is a keyword, like "if", return true with the keyword's TokenKind + // in *ttp. + MOZ_MUST_USE bool checkForKeyword(JSAtom* atom, TokenKind* ttp); + + // Same semantics as above, but for the provided keyword. + MOZ_MUST_USE bool checkForKeyword(const KeywordInfo* kw, TokenKind* ttp); + + // This class maps a userbuf offset (which is 0-indexed) to a line number + // (which is 1-indexed) and a column index (which is 0-indexed). + class SourceCoords + { + // For a given buffer holding source code, |lineStartOffsets_| has one + // element per line of source code, plus one sentinel element. Each + // non-sentinel element holds the buffer offset for the start of the + // corresponding line of source code. For this example script: + // + // 1 // xyz [line starts at offset 0] + // 2 var x; [line starts at offset 7] + // 3 [line starts at offset 14] + // 4 var y; [line starts at offset 15] + // + // |lineStartOffsets_| is: + // + // [0, 7, 14, 15, MAX_PTR] + // + // To convert a "line number" to a "line index" (i.e. an index into + // |lineStartOffsets_|), subtract |initialLineNum_|. E.g. line 3's + // line index is (3 - initialLineNum_), which is 2. Therefore + // lineStartOffsets_[2] holds the buffer offset for the start of line 3, + // which is 14. (Note that |initialLineNum_| is often 1, but not + // always.) + // + // The first element is always 0, and the last element is always the + // MAX_PTR sentinel. + // + // offset-to-line/column lookups are O(log n) in the worst case (binary + // search), but in practice they're heavily clustered and we do better + // than that by using the previous lookup's result (lastLineIndex_) as + // a starting point. + // + // Checking if an offset lies within a particular line number + // (isOnThisLine()) is O(1). + // + Vector<uint32_t, 128> lineStartOffsets_; + uint32_t initialLineNum_; + + // This is mutable because it's modified on every search, but that fact + // isn't visible outside this class. + mutable uint32_t lastLineIndex_; + + uint32_t lineIndexOf(uint32_t offset) const; + + static const uint32_t MAX_PTR = UINT32_MAX; + + uint32_t lineIndexToNum(uint32_t lineIndex) const { return lineIndex + initialLineNum_; } + uint32_t lineNumToIndex(uint32_t lineNum) const { return lineNum - initialLineNum_; } + + public: + SourceCoords(ExclusiveContext* cx, uint32_t ln); + + MOZ_MUST_USE bool add(uint32_t lineNum, uint32_t lineStartOffset); + MOZ_MUST_USE bool fill(const SourceCoords& other); + + bool isOnThisLine(uint32_t offset, uint32_t lineNum, bool* onThisLine) const { + uint32_t lineIndex = lineNumToIndex(lineNum); + if (lineIndex + 1 >= lineStartOffsets_.length()) // +1 due to sentinel + return false; + *onThisLine = lineStartOffsets_[lineIndex] <= offset && + offset < lineStartOffsets_[lineIndex + 1]; + return true; + } + + uint32_t lineNum(uint32_t offset) const; + uint32_t columnIndex(uint32_t offset) const; + void lineNumAndColumnIndex(uint32_t offset, uint32_t* lineNum, uint32_t* columnIndex) const; + }; + + SourceCoords srcCoords; + + JSAtomState& names() const { + return cx->names(); + } + + ExclusiveContext* context() const { + return cx; + } + + const ReadOnlyCompileOptions& options() const { + return options_; + } + + private: + // This is the low-level interface to the JS source code buffer. It just + // gets raw chars, basically. TokenStreams functions are layered on top + // and do some extra stuff like converting all EOL sequences to '\n', + // tracking the line number, and setting |flags.isEOF|. (The "raw" in "raw + // chars" refers to the lack of EOL sequence normalization.) + // + // buf[0..length-1] often represents a substring of some larger source, + // where we have only the substring in memory. The |startOffset| argument + // indicates the offset within this larger string at which our string + // begins, the offset of |buf[0]|. + class TokenBuf { + public: + TokenBuf(ExclusiveContext* cx, const char16_t* buf, size_t length, size_t startOffset) + : base_(buf), + startOffset_(startOffset), + limit_(buf + length), + ptr(buf) + { } + + bool hasRawChars() const { + return ptr < limit_; + } + + bool atStart() const { + return offset() == 0; + } + + size_t startOffset() const { + return startOffset_; + } + + size_t offset() const { + return startOffset_ + mozilla::PointerRangeSize(base_, ptr); + } + + const char16_t* rawCharPtrAt(size_t offset) const { + MOZ_ASSERT(startOffset_ <= offset); + MOZ_ASSERT(offset - startOffset_ <= mozilla::PointerRangeSize(base_, limit_)); + return base_ + (offset - startOffset_); + } + + const char16_t* limit() const { + return limit_; + } + + char16_t getRawChar() { + return *ptr++; // this will nullptr-crash if poisoned + } + + char16_t peekRawChar() const { + return *ptr; // this will nullptr-crash if poisoned + } + + bool matchRawChar(char16_t c) { + if (*ptr == c) { // this will nullptr-crash if poisoned + ptr++; + return true; + } + return false; + } + + bool matchRawCharBackwards(char16_t c) { + MOZ_ASSERT(ptr); // make sure it hasn't been poisoned + if (*(ptr - 1) == c) { + ptr--; + return true; + } + return false; + } + + void ungetRawChar() { + MOZ_ASSERT(ptr); // make sure it hasn't been poisoned + ptr--; + } + + const char16_t* addressOfNextRawChar(bool allowPoisoned = false) const { + MOZ_ASSERT_IF(!allowPoisoned, ptr); // make sure it hasn't been poisoned + return ptr; + } + + // Use this with caution! + void setAddressOfNextRawChar(const char16_t* a, bool allowPoisoned = false) { + MOZ_ASSERT_IF(!allowPoisoned, a); + ptr = a; + } + +#ifdef DEBUG + // Poison the TokenBuf so it cannot be accessed again. + void poison() { + ptr = nullptr; + } +#endif + + static bool isRawEOLChar(int32_t c) { + return c == '\n' || c == '\r' || c == LINE_SEPARATOR || c == PARA_SEPARATOR; + } + + // Returns the offset of the next EOL, but stops once 'max' characters + // have been scanned (*including* the char at startOffset_). + size_t findEOLMax(size_t start, size_t max); + + private: + const char16_t* base_; // base of buffer + uint32_t startOffset_; // offset of base_[0] + const char16_t* limit_; // limit for quick bounds check + const char16_t* ptr; // next char to get + }; + + MOZ_MUST_USE bool getTokenInternal(TokenKind* ttp, Modifier modifier); + + MOZ_MUST_USE bool getBracedUnicode(uint32_t* code); + MOZ_MUST_USE bool getStringOrTemplateToken(int untilChar, Token** tp); + + int32_t getChar(); + int32_t getCharIgnoreEOL(); + void ungetChar(int32_t c); + void ungetCharIgnoreEOL(int32_t c); + Token* newToken(ptrdiff_t adjust); + uint32_t peekUnicodeEscape(uint32_t* codePoint); + uint32_t peekExtendedUnicodeEscape(uint32_t* codePoint); + uint32_t matchUnicodeEscapeIdStart(uint32_t* codePoint); + bool matchUnicodeEscapeIdent(uint32_t* codePoint); + bool peekChars(int n, char16_t* cp); + + MOZ_MUST_USE bool getDirectives(bool isMultiline, bool shouldWarnDeprecated); + MOZ_MUST_USE bool getDirective(bool isMultiline, bool shouldWarnDeprecated, + const char* directive, int directiveLength, + const char* errorMsgPragma, + UniquePtr<char16_t[], JS::FreePolicy>* destination); + MOZ_MUST_USE bool getDisplayURL(bool isMultiline, bool shouldWarnDeprecated); + MOZ_MUST_USE bool getSourceMappingURL(bool isMultiline, bool shouldWarnDeprecated); + + // |expect| cannot be an EOL char. + bool matchChar(int32_t expect) { + MOZ_ASSERT(!TokenBuf::isRawEOLChar(expect)); + return MOZ_LIKELY(userbuf.hasRawChars()) && + userbuf.matchRawChar(expect); + } + + void consumeKnownChar(int32_t expect) { + mozilla::DebugOnly<int32_t> c = getChar(); + MOZ_ASSERT(c == expect); + } + + int32_t peekChar() { + int32_t c = getChar(); + ungetChar(c); + return c; + } + + void skipChars(int n) { + while (--n >= 0) + getChar(); + } + + void skipCharsIgnoreEOL(int n) { + while (--n >= 0) + getCharIgnoreEOL(); + } + + void updateLineInfoForEOL(); + void updateFlagsForEOL(); + + const Token& nextToken() const { + MOZ_ASSERT(hasLookahead()); + return tokens[(cursor + 1) & ntokensMask]; + } + + bool hasLookahead() const { return lookahead > 0; } + + // Options used for parsing/tokenizing. + const ReadOnlyCompileOptions& options_; + + Token tokens[ntokens]; // circular token buffer + unsigned cursor; // index of last parsed token + unsigned lookahead; // count of lookahead tokens + unsigned lineno; // current line number + Flags flags; // flags -- see above + size_t linebase; // start of current line + size_t prevLinebase; // start of previous line; size_t(-1) if on the first line + TokenBuf userbuf; // user input buffer + const char* filename; // input filename or null + UniqueTwoByteChars displayURL_; // the user's requested source URL or null + UniqueTwoByteChars sourceMapURL_; // source map's filename or null + CharBuffer tokenbuf; // current token string buffer + uint8_t isExprEnding[TOK_LIMIT];// which tokens definitely terminate exprs? + ExclusiveContext* const cx; + bool mutedErrors; + StrictModeGetter* strictModeGetter; // used to test for strict mode +}; + +class MOZ_STACK_CLASS AutoAwaitIsKeyword +{ +private: + TokenStream* ts_; + bool oldAwaitIsKeyword_; + +public: + AutoAwaitIsKeyword(TokenStream* ts, bool awaitIsKeyword) { + ts_ = ts; + oldAwaitIsKeyword_ = ts_->awaitIsKeyword; + ts_->awaitIsKeyword = awaitIsKeyword; + } + + ~AutoAwaitIsKeyword() { + ts_->awaitIsKeyword = oldAwaitIsKeyword_; + ts_ = nullptr; + } +}; + +extern const char* +TokenKindToDesc(TokenKind tt); + +} // namespace frontend +} // namespace js + +extern JS_FRIEND_API(int) +js_fgets(char* buf, int size, FILE* file); + +#ifdef DEBUG +extern const char* +TokenKindToString(js::frontend::TokenKind tt); +#endif + +#endif /* frontend_TokenStream_h */ |