/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- * vim: set ts=8 sw=4 et tw=78: * * ***** BEGIN LICENSE BLOCK ***** * Version: MPL 1.1/GPL 2.0/LGPL 2.1 * * The contents of this file are subject to the Mozilla Public License Version * 1.1 (the "License"); you may not use this file except in compliance with * the License. You may obtain a copy of the License at * http://www.mozilla.org/MPL/ * * Software distributed under the License is distributed on an "AS IS" basis, * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License * for the specific language governing rights and limitations under the * License. * * The Original Code is Mozilla Communicator client code, released * March 31, 1998. * * The Initial Developer of the Original Code is * Netscape Communications Corporation. * Portions created by the Initial Developer are Copyright (C) 1998 * the Initial Developer. All Rights Reserved. * * Contributor(s): * * Alternatively, the contents of this file may be used under the terms of * either of the GNU General Public License Version 2 or later (the "GPL"), * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), * in which case the provisions of the GPL or the LGPL are applicable instead * of those above. If you wish to allow use of your version of this file only * under the terms of either the GPL or the LGPL, and not to allow others to * use your version of this file under the terms of the MPL, indicate your * decision by deleting the provisions above and replace them with the notice * and other provisions required by the GPL or the LGPL. If you do not delete * the provisions above, a recipient may use your version of this file under * the terms of any one of the MPL, the GPL or the LGPL. * * ***** END LICENSE BLOCK ***** */ /* * JavaScript bytecode interpreter. */ #include "jsstddef.h" #include #include #include #include "jstypes.h" #include "jsarena.h" /* Added by JSIFY */ #include "jsutil.h" /* Added by JSIFY */ #include "jsprf.h" #include "jsapi.h" #include "jsarray.h" #include "jsatom.h" #include "jsbool.h" #include "jscntxt.h" #include "jsconfig.h" #include "jsdbgapi.h" #include "jsfun.h" #include "jsgc.h" #include "jsinterp.h" #include "jsiter.h" #include "jslock.h" #include "jsnum.h" #include "jsobj.h" #include "jsopcode.h" #include "jsscan.h" #include "jsscope.h" #include "jsscript.h" #include "jsstr.h" #if JS_HAS_XML_SUPPORT #include "jsxml.h" #endif #ifdef DEBUG #define ASSERT_CACHE_IS_EMPTY(cache) \ JS_BEGIN_MACRO \ JSPropertyCacheEntry *end_, *pce_, entry_; \ JSPropertyCache *cache_ = (cache); \ JS_ASSERT(cache_->empty); \ end_ = &cache_->table[PROPERTY_CACHE_SIZE]; \ for (pce_ = &cache_->table[0]; pce_ < end_; pce_++) { \ PCE_LOAD(cache_, pce_, entry_); \ JS_ASSERT(!PCE_OBJECT(entry_)); \ JS_ASSERT(!PCE_PROPERTY(entry_)); \ } \ JS_END_MACRO #else #define ASSERT_CACHE_IS_EMPTY(cache) ((void)0) #endif void js_FlushPropertyCache(JSContext *cx) { JSPropertyCache *cache; cache = &cx->runtime->propertyCache; if (cache->empty) { ASSERT_CACHE_IS_EMPTY(cache); return; } memset(cache->table, 0, sizeof cache->table); cache->empty = JS_TRUE; #ifdef JS_PROPERTY_CACHE_METERING cache->flushes++; #endif } void js_DisablePropertyCache(JSContext *cx) { JS_ASSERT(!cx->runtime->propertyCache.disabled); cx->runtime->propertyCache.disabled = JS_TRUE; } void js_EnablePropertyCache(JSContext *cx) { JS_ASSERT(cx->runtime->propertyCache.disabled); ASSERT_CACHE_IS_EMPTY(&cx->runtime->propertyCache); cx->runtime->propertyCache.disabled = JS_FALSE; } /* * Stack macros and functions. These all use a local variable, jsval *sp, to * point to the next free stack slot. SAVE_SP must be called before any call * to a function that may invoke the interpreter. RESTORE_SP must be called * only after return from js_Invoke, because only js_Invoke changes fp->sp. */ #define PUSH(v) (*sp++ = (v)) #define POP() (*--sp) #ifdef DEBUG #define SAVE_SP(fp) \ (JS_ASSERT((fp)->script || !(fp)->spbase || (sp) == (fp)->spbase), \ (fp)->sp = sp) #else #define SAVE_SP(fp) ((fp)->sp = sp) #endif #define RESTORE_SP(fp) (sp = (fp)->sp) /* * SAVE_SP_AND_PC commits deferred stores of interpreter registers to their * homes in fp, when calling out of the interpreter loop or threaded code. * RESTORE_SP_AND_PC copies the other way, to update registers after a call * to a subroutine that interprets a piece of the current script. */ #define SAVE_SP_AND_PC(fp) (SAVE_SP(fp), (fp)->pc = pc) #define RESTORE_SP_AND_PC(fp) (RESTORE_SP(fp), pc = (fp)->pc) /* * Push the generating bytecode's pc onto the parallel pc stack that runs * depth slots below the operands. * * NB: PUSH_OPND uses sp, depth, and pc from its lexical environment. See * js_Interpret for these local variables' declarations and uses. */ #define PUSH_OPND(v) (sp[-depth] = (jsval)pc, PUSH(v)) #define STORE_OPND(n,v) (sp[(n)-depth] = (jsval)pc, sp[n] = (v)) #define POP_OPND() POP() #define FETCH_OPND(n) (sp[n]) /* * Push the jsdouble d using sp, depth, and pc from the lexical environment. * Try to convert d to a jsint that fits in a jsval, otherwise GC-alloc space * for it and push a reference. */ #define STORE_NUMBER(cx, n, d) \ JS_BEGIN_MACRO \ jsint i_; \ jsval v_; \ \ if (JSDOUBLE_IS_INT(d, i_) && INT_FITS_IN_JSVAL(i_)) { \ v_ = INT_TO_JSVAL(i_); \ } else { \ ok = js_NewDoubleValue(cx, d, &v_); \ if (!ok) \ goto out; \ } \ STORE_OPND(n, v_); \ JS_END_MACRO #define STORE_INT(cx, n, i) \ JS_BEGIN_MACRO \ jsval v_; \ \ if (INT_FITS_IN_JSVAL(i)) { \ v_ = INT_TO_JSVAL(i); \ } else { \ ok = js_NewDoubleValue(cx, (jsdouble)(i), &v_); \ if (!ok) \ goto out; \ } \ STORE_OPND(n, v_); \ JS_END_MACRO #define STORE_UINT(cx, n, u) \ JS_BEGIN_MACRO \ jsval v_; \ \ if ((u) <= JSVAL_INT_MAX) { \ v_ = INT_TO_JSVAL(u); \ } else { \ ok = js_NewDoubleValue(cx, (jsdouble)(u), &v_); \ if (!ok) \ goto out; \ } \ STORE_OPND(n, v_); \ JS_END_MACRO #define FETCH_NUMBER(cx, n, d) \ JS_BEGIN_MACRO \ jsval v_; \ \ v_ = FETCH_OPND(n); \ VALUE_TO_NUMBER(cx, v_, d); \ JS_END_MACRO #define FETCH_INT(cx, n, i) \ JS_BEGIN_MACRO \ jsval v_ = FETCH_OPND(n); \ if (JSVAL_IS_INT(v_)) { \ i = JSVAL_TO_INT(v_); \ } else { \ SAVE_SP_AND_PC(fp); \ ok = js_ValueToECMAInt32(cx, v_, &i); \ if (!ok) \ goto out; \ } \ JS_END_MACRO #define FETCH_UINT(cx, n, ui) \ JS_BEGIN_MACRO \ jsval v_ = FETCH_OPND(n); \ jsint i_; \ if (JSVAL_IS_INT(v_) && (i_ = JSVAL_TO_INT(v_)) >= 0) { \ ui = (uint32) i_; \ } else { \ SAVE_SP_AND_PC(fp); \ ok = js_ValueToECMAUint32(cx, v_, &ui); \ if (!ok) \ goto out; \ } \ JS_END_MACRO /* * Optimized conversion macros that test for the desired type in v before * homing sp and calling a conversion function. */ #define VALUE_TO_NUMBER(cx, v, d) \ JS_BEGIN_MACRO \ if (JSVAL_IS_INT(v)) { \ d = (jsdouble)JSVAL_TO_INT(v); \ } else if (JSVAL_IS_DOUBLE(v)) { \ d = *JSVAL_TO_DOUBLE(v); \ } else { \ SAVE_SP_AND_PC(fp); \ ok = js_ValueToNumber(cx, v, &d); \ if (!ok) \ goto out; \ } \ JS_END_MACRO #define POP_BOOLEAN(cx, v, b) \ JS_BEGIN_MACRO \ v = FETCH_OPND(-1); \ if (v == JSVAL_NULL) { \ b = JS_FALSE; \ } else if (JSVAL_IS_BOOLEAN(v)) { \ b = JSVAL_TO_BOOLEAN(v); \ } else { \ SAVE_SP_AND_PC(fp); \ ok = js_ValueToBoolean(cx, v, &b); \ if (!ok) \ goto out; \ } \ sp--; \ JS_END_MACRO /* * Convert a primitive string, number or boolean to a corresponding object. * v must not be an object, null or undefined when using this macro. */ #define PRIMITIVE_TO_OBJECT(cx, v, obj) \ JS_BEGIN_MACRO \ SAVE_SP(fp); \ if (JSVAL_IS_STRING(v)) { \ obj = js_StringToObject(cx, JSVAL_TO_STRING(v)); \ } else if (JSVAL_IS_INT(v)) { \ obj = js_NumberToObject(cx, (jsdouble)JSVAL_TO_INT(v)); \ } else if (JSVAL_IS_DOUBLE(v)) { \ obj = js_NumberToObject(cx, *JSVAL_TO_DOUBLE(v)); \ } else { \ JS_ASSERT(JSVAL_IS_BOOLEAN(v)); \ obj = js_BooleanToObject(cx, JSVAL_TO_BOOLEAN(v)); \ } \ JS_END_MACRO #define VALUE_TO_OBJECT(cx, v, obj) \ JS_BEGIN_MACRO \ if (!JSVAL_IS_PRIMITIVE(v)) { \ obj = JSVAL_TO_OBJECT(v); \ } else { \ SAVE_SP_AND_PC(fp); \ obj = js_ValueToNonNullObject(cx, v); \ if (!obj) { \ ok = JS_FALSE; \ goto out; \ } \ } \ JS_END_MACRO #define FETCH_OBJECT(cx, n, v, obj) \ JS_BEGIN_MACRO \ v = FETCH_OPND(n); \ VALUE_TO_OBJECT(cx, v, obj); \ STORE_OPND(n, OBJECT_TO_JSVAL(obj)); \ JS_END_MACRO #define VALUE_TO_PRIMITIVE(cx, v, hint, vp) \ JS_BEGIN_MACRO \ if (JSVAL_IS_PRIMITIVE(v)) { \ *vp = v; \ } else { \ SAVE_SP_AND_PC(fp); \ ok = OBJ_DEFAULT_VALUE(cx, JSVAL_TO_OBJECT(v), hint, vp); \ if (!ok) \ goto out; \ } \ JS_END_MACRO JS_FRIEND_API(jsval *) js_AllocRawStack(JSContext *cx, uintN nslots, void **markp) { jsval *sp; if (markp) *markp = JS_ARENA_MARK(&cx->stackPool); JS_ARENA_ALLOCATE_CAST(sp, jsval *, &cx->stackPool, nslots * sizeof(jsval)); if (!sp) { JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_STACK_OVERFLOW, (cx->fp && cx->fp->fun) ? JS_GetFunctionName(cx->fp->fun) : "script"); } return sp; } JS_FRIEND_API(void) js_FreeRawStack(JSContext *cx, void *mark) { JS_ARENA_RELEASE(&cx->stackPool, mark); } JS_FRIEND_API(jsval *) js_AllocStack(JSContext *cx, uintN nslots, void **markp) { jsval *sp, *vp, *end; JSArena *a; JSStackHeader *sh; JSStackFrame *fp; /* Callers don't check for zero nslots: we do to avoid empty segments. */ if (nslots == 0) { *markp = NULL; return JS_ARENA_MARK(&cx->stackPool); } /* Allocate 2 extra slots for the stack segment header we'll likely need. */ sp = js_AllocRawStack(cx, 2 + nslots, markp); if (!sp) return NULL; /* Try to avoid another header if we can piggyback on the last segment. */ a = cx->stackPool.current; sh = cx->stackHeaders; if (sh && JS_STACK_SEGMENT(sh) + sh->nslots == sp) { /* Extend the last stack segment, give back the 2 header slots. */ sh->nslots += nslots; a->avail -= 2 * sizeof(jsval); } else { /* * Need a new stack segment, so we must initialize unused slots in the * current frame. See js_GC, just before marking the "operand" jsvals, * where we scan from fp->spbase to fp->sp or through fp->script->depth * (whichever covers fewer slots). */ fp = cx->fp; if (fp && fp->script && fp->spbase) { #ifdef DEBUG jsuword depthdiff = fp->script->depth * sizeof(jsval); JS_ASSERT(JS_UPTRDIFF(fp->sp, fp->spbase) <= depthdiff); JS_ASSERT(JS_UPTRDIFF(*markp, fp->spbase) >= depthdiff); #endif end = fp->spbase + fp->script->depth; for (vp = fp->sp; vp < end; vp++) *vp = JSVAL_VOID; } /* Allocate and push a stack segment header from the 2 extra slots. */ sh = (JSStackHeader *)sp; sh->nslots = nslots; sh->down = cx->stackHeaders; cx->stackHeaders = sh; sp += 2; } /* * Store JSVAL_NULL using memset, to let compilers optimize as they see * fit, in case a caller allocates and pushes GC-things one by one, which * could nest a last-ditch GC that will scan this segment. */ memset(sp, 0, nslots * sizeof(jsval)); return sp; } JS_FRIEND_API(void) js_FreeStack(JSContext *cx, void *mark) { JSStackHeader *sh; jsuword slotdiff; /* Check for zero nslots allocation special case. */ if (!mark) return; /* We can assert because js_FreeStack always balances js_AllocStack. */ sh = cx->stackHeaders; JS_ASSERT(sh); /* If mark is in the current segment, reduce sh->nslots, else pop sh. */ slotdiff = JS_UPTRDIFF(mark, JS_STACK_SEGMENT(sh)) / sizeof(jsval); if (slotdiff < (jsuword)sh->nslots) sh->nslots = slotdiff; else cx->stackHeaders = sh->down; /* Release the stackPool space allocated since mark was set. */ JS_ARENA_RELEASE(&cx->stackPool, mark); } JSBool js_GetArgument(JSContext *cx, JSObject *obj, jsval id, jsval *vp) { return JS_TRUE; } JSBool js_SetArgument(JSContext *cx, JSObject *obj, jsval id, jsval *vp) { return JS_TRUE; } JSBool js_GetLocalVariable(JSContext *cx, JSObject *obj, jsval id, jsval *vp) { return JS_TRUE; } JSBool js_SetLocalVariable(JSContext *cx, JSObject *obj, jsval id, jsval *vp) { return JS_TRUE; } JSObject * js_GetScopeChain(JSContext *cx, JSStackFrame *fp) { JSObject *obj, *cursor, *clonedChild, *parent; JSTempValueRooter tvr; obj = fp->blockChain; if (!obj) { /* * Don't force a call object for a lightweight function call, but do * insist that there is a call object for a heavyweight function call. */ JS_ASSERT(!fp->fun || !(fp->fun->flags & JSFUN_HEAVYWEIGHT) || fp->callobj); JS_ASSERT(fp->scopeChain); return fp->scopeChain; } /* * We have one or more lexical scopes to reflect into fp->scopeChain, so * make sure there's a call object at the current head of the scope chain, * if this frame is a call frame. */ if (fp->fun && !fp->callobj) { JS_ASSERT(OBJ_GET_CLASS(cx, fp->scopeChain) != &js_BlockClass || JS_GetPrivate(cx, fp->scopeChain) != fp); if (!js_GetCallObject(cx, fp, fp->scopeChain)) return NULL; } /* * Clone the block chain. To avoid recursive cloning we set the parent of * the cloned child after we clone the parent. In the following loop when * clonedChild is null it indicates the first iteration when no special GC * rooting is necessary. On the second and the following iterations we * have to protect cloned so far chain against the GC during cloning of * the cursor object. */ cursor = obj; clonedChild = NULL; for (;;) { parent = OBJ_GET_PARENT(cx, cursor); /* * We pass fp->scopeChain and not null even if we override the parent * slot later as null triggers useless calculations of slot's value in * js_NewObject that js_CloneBlockObject calls. */ cursor = js_CloneBlockObject(cx, cursor, fp->scopeChain, fp); if (!cursor) { if (clonedChild) JS_POP_TEMP_ROOT(cx, &tvr); return NULL; } if (!clonedChild) { /* * The first iteration. Check if other follow and root obj if so * to protect the whole cloned chain against GC. */ obj = cursor; if (!parent) break; JS_PUSH_TEMP_ROOT_OBJECT(cx, obj, &tvr); } else { /* * Avoid OBJ_SET_PARENT overhead as clonedChild cannot escape to * other threads. */ clonedChild->slots[JSSLOT_PARENT] = OBJECT_TO_JSVAL(cursor); if (!parent) { JS_ASSERT(tvr.u.value == OBJECT_TO_JSVAL(obj)); JS_POP_TEMP_ROOT(cx, &tvr); break; } } clonedChild = cursor; cursor = parent; } fp->flags |= JSFRAME_POP_BLOCKS; fp->scopeChain = obj; fp->blockChain = NULL; return obj; } /* * Walk the scope chain looking for block scopes whose locals need to be * copied from stack slots into object slots before fp goes away. */ static JSBool PutBlockObjects(JSContext *cx, JSStackFrame *fp) { JSBool ok; JSObject *obj; ok = JS_TRUE; for (obj = fp->scopeChain; obj; obj = OBJ_GET_PARENT(cx, obj)) { if (OBJ_GET_CLASS(cx, obj) == &js_BlockClass) { if (JS_GetPrivate(cx, obj) != fp) break; ok &= js_PutBlockObject(cx, obj); } } return ok; } JSObject * js_ComputeThis(JSContext *cx, JSObject *thisp, jsval *argv) { if (thisp && OBJ_GET_CLASS(cx, thisp) != &js_CallClass) { /* Some objects (e.g., With) delegate 'this' to another object. */ thisp = OBJ_THIS_OBJECT(cx, thisp); if (!thisp) return NULL; } else { /* * ECMA requires "the global object", but in the presence of multiple * top-level objects (windows, frames, or certain layers in the client * object model), we prefer fun's parent. An example that causes this * code to run: * * // in window w1 * function f() { return this } * function g() { return f } * * // in window w2 * var h = w1.g() * alert(h() == w1) * * The alert should display "true". */ if (JSVAL_IS_PRIMITIVE(argv[-2]) || !OBJ_GET_PARENT(cx, JSVAL_TO_OBJECT(argv[-2]))) { thisp = cx->globalObject; } else { jsid id; jsval v; uintN attrs; /* Walk up the parent chain. */ thisp = JSVAL_TO_OBJECT(argv[-2]); id = ATOM_TO_JSID(cx->runtime->atomState.parentAtom); for (;;) { if (!OBJ_CHECK_ACCESS(cx, thisp, id, JSACC_PARENT, &v, &attrs)) return NULL; if (JSVAL_IS_VOID(v)) v = OBJ_GET_SLOT(cx, thisp, JSSLOT_PARENT); if (JSVAL_IS_NULL(v)) break; thisp = JSVAL_TO_OBJECT(v); } } } argv[-1] = OBJECT_TO_JSVAL(thisp); return thisp; } #if JS_HAS_NO_SUCH_METHOD static JSBool NoSuchMethod(JSContext *cx, JSStackFrame *fp, jsval *vp, uint32 flags, uintN argc) { JSObject *thisp, *argsobj; jsval *sp, roots[3]; JSTempValueRooter tvr; jsid id; JSBool ok; jsbytecode *pc; jsatomid atomIndex; /* * We must call js_ComputeThis here to censor Call objects. A performance * hit, since we'll call it again in the normal sequence of invoke events, * but at least it's idempotent. * * Normally, we call ComputeThis after all frame members have been set, * and in particular, after any revision of the callee value at *vp due * to clasp->convert (see below). This matters because ComputeThis may * access *vp via fp->argv[-2], to follow the parent chain to a global * object to use as the 'this' parameter. * * Obviously, here in the JSVAL_IS_PRIMITIVE(v) case, there can't be any * such defaulting of 'this' to callee (v, *vp) ancestor. */ JS_ASSERT(JSVAL_IS_PRIMITIVE(vp[0])); RESTORE_SP(fp); if (JSVAL_IS_OBJECT(vp[1])) { thisp = JSVAL_TO_OBJECT(vp[1]); } else { PRIMITIVE_TO_OBJECT(cx, vp[1], thisp); if (!thisp) return JS_FALSE; vp[1] = OBJECT_TO_JSVAL(thisp); } thisp = js_ComputeThis(cx, thisp, vp + 2); if (!thisp) return JS_FALSE; vp[1] = OBJECT_TO_JSVAL(thisp); /* From here on, control must flow through label out: to return. */ memset(roots, 0, sizeof roots); JS_PUSH_TEMP_ROOT(cx, JS_ARRAY_LENGTH(roots), roots, &tvr); id = ATOM_TO_JSID(cx->runtime->atomState.noSuchMethodAtom); #if JS_HAS_XML_SUPPORT if (OBJECT_IS_XML(cx, thisp)) { JSXMLObjectOps *ops; ops = (JSXMLObjectOps *) thisp->map->ops; thisp = ops->getMethod(cx, thisp, id, &roots[2]); if (!thisp) { ok = JS_FALSE; goto out; } vp[1] = OBJECT_TO_JSVAL(thisp); } else #endif { ok = OBJ_GET_PROPERTY(cx, thisp, id, &roots[2]); if (!ok) goto out; } if (JSVAL_IS_PRIMITIVE(roots[2])) goto not_function; pc = (jsbytecode *) vp[-(intN)fp->script->depth]; switch ((JSOp) *pc) { case JSOP_NAME: case JSOP_GETPROP: #if JS_HAS_XML_SUPPORT case JSOP_GETMETHOD: #endif atomIndex = GET_ATOM_INDEX(pc); roots[0] = ATOM_KEY(js_GetAtom(cx, &fp->script->atomMap, atomIndex)); argsobj = js_NewArrayObject(cx, argc, vp + 2); if (!argsobj) { ok = JS_FALSE; goto out; } roots[1] = OBJECT_TO_JSVAL(argsobj); ok = js_InternalInvoke(cx, thisp, roots[2], flags | JSINVOKE_INTERNAL, 2, roots, &vp[0]); break; default: goto not_function; } out: JS_POP_TEMP_ROOT(cx, &tvr); return ok; not_function: js_ReportIsNotFunction(cx, vp, flags & JSINVOKE_FUNFLAGS); ok = JS_FALSE; goto out; } #endif /* JS_HAS_NO_SUCH_METHOD */ #ifdef DUMP_CALL_TABLE #include "jsclist.h" #include "jshash.h" #include "jsdtoa.h" typedef struct CallKey { jsval callee; /* callee value */ const char *filename; /* function filename or null */ uintN lineno; /* function lineno or 0 */ } CallKey; /* Compensate for typeof null == "object" brain damage. */ #define JSTYPE_NULL JSTYPE_LIMIT #define TYPEOF(cx,v) (JSVAL_IS_NULL(v) ? JSTYPE_NULL : JS_TypeOfValue(cx,v)) #define TYPENAME(t) (((t) == JSTYPE_NULL) ? js_null_str : js_type_str[t]) #define NTYPEHIST (JSTYPE_LIMIT + 1) typedef struct CallValue { uint32 total; /* total call count */ uint32 recycled; /* LRU-recycled calls lost */ uint16 minargc; /* minimum argument count */ uint16 maxargc; /* maximum argument count */ struct ArgInfo { uint32 typeHist[NTYPEHIST]; /* histogram by type */ JSCList lruList; /* top 10 values LRU list */ struct ArgValCount { JSCList lruLink; /* LRU list linkage */ jsval value; /* recently passed value */ uint32 count; /* number of times passed */ char strbuf[112]; /* string conversion buffer */ } topValCounts[10]; /* top 10 value storage */ } argInfo[8]; } CallValue; typedef struct CallEntry { JSHashEntry entry; CallKey key; CallValue value; char name[32]; /* function name copy */ } CallEntry; static void * AllocCallTable(void *pool, size_t size) { return malloc(size); } static void FreeCallTable(void *pool, void *item) { free(item); } static JSHashEntry * AllocCallEntry(void *pool, const void *key) { return (JSHashEntry*) calloc(1, sizeof(CallEntry)); } static void FreeCallEntry(void *pool, JSHashEntry *he, uintN flag) { JS_ASSERT(flag == HT_FREE_ENTRY); free(he); } static JSHashAllocOps callTableAllocOps = { AllocCallTable, FreeCallTable, AllocCallEntry, FreeCallEntry }; JS_STATIC_DLL_CALLBACK(JSHashNumber) js_hash_call_key(const void *key) { CallKey *ck = (CallKey *) key; JSHashNumber hash = (jsuword)ck->callee >> 3; if (ck->filename) { hash = (hash << 4) ^ JS_HashString(ck->filename); hash = (hash << 4) ^ ck->lineno; } return hash; } JS_STATIC_DLL_CALLBACK(intN) js_compare_call_keys(const void *k1, const void *k2) { CallKey *ck1 = (CallKey *)k1, *ck2 = (CallKey *)k2; return ck1->callee == ck2->callee && ((ck1->filename && ck2->filename) ? strcmp(ck1->filename, ck2->filename) == 0 : ck1->filename == ck2->filename) && ck1->lineno == ck2->lineno; } JSHashTable *js_CallTable; size_t js_LogCallToSourceLimit; JS_STATIC_DLL_CALLBACK(intN) CallTableDumper(JSHashEntry *he, intN k, void *arg) { CallEntry *ce = (CallEntry *)he; FILE *fp = (FILE *)arg; uintN argc, i, n; struct ArgInfo *ai; JSType save, type; JSCList *cl; struct ArgValCount *avc; jsval argval; if (ce->key.filename) { /* We're called at the end of the mark phase, so mark our filenames. */ js_MarkScriptFilename(ce->key.filename); fprintf(fp, "%s:%u ", ce->key.filename, ce->key.lineno); } else { fprintf(fp, "@%p ", (void *) ce->key.callee); } if (ce->name[0]) fprintf(fp, "name %s ", ce->name); fprintf(fp, "calls %lu (%lu) argc %u/%u\n", (unsigned long) ce->value.total, (unsigned long) ce->value.recycled, ce->value.minargc, ce->value.maxargc); argc = JS_MIN(ce->value.maxargc, 8); for (i = 0; i < argc; i++) { ai = &ce->value.argInfo[i]; n = 0; save = -1; for (type = JSTYPE_VOID; type <= JSTYPE_LIMIT; type++) { if (ai->typeHist[type]) { save = type; ++n; } } if (n == 1) { fprintf(fp, " arg %u type %s: %lu\n", i, TYPENAME(save), (unsigned long) ai->typeHist[save]); } else { fprintf(fp, " arg %u type histogram:\n", i); for (type = JSTYPE_VOID; type <= JSTYPE_LIMIT; type++) { fprintf(fp, " %9s: %8lu ", TYPENAME(type), (unsigned long) ai->typeHist[type]); for (n = (uintN) JS_HOWMANY(ai->typeHist[type], 10); n > 0; --n) fputc('*', fp); fputc('\n', fp); } } fprintf(fp, " arg %u top 10 values:\n", i); n = 1; for (cl = ai->lruList.prev; cl != &ai->lruList; cl = cl->prev) { avc = (struct ArgValCount *)cl; if (!avc->count) break; argval = avc->value; fprintf(fp, " %9u: %8lu %.*s (%#lx)\n", n, (unsigned long) avc->count, sizeof avc->strbuf, avc->strbuf, argval); ++n; } } return HT_ENUMERATE_NEXT; } void js_DumpCallTable(JSContext *cx) { char name[24]; FILE *fp; static uintN dumpCount; if (!js_CallTable) return; JS_snprintf(name, sizeof name, "/tmp/calltable.dump.%u", dumpCount & 7); dumpCount++; fp = fopen(name, "w"); if (!fp) return; JS_HashTableEnumerateEntries(js_CallTable, CallTableDumper, fp); fclose(fp); } static void LogCall(JSContext *cx, jsval callee, uintN argc, jsval *argv) { CallKey key; const char *name, *cstr; JSFunction *fun; JSHashNumber keyHash; JSHashEntry **hep, *he; CallEntry *ce; uintN i, j; jsval argval; JSType type; struct ArgInfo *ai; struct ArgValCount *avc; JSString *str; if (!js_CallTable) { js_CallTable = JS_NewHashTable(1024, js_hash_call_key, js_compare_call_keys, NULL, &callTableAllocOps, NULL); if (!js_CallTable) return; } key.callee = callee; key.filename = NULL; key.lineno = 0; name = ""; if (VALUE_IS_FUNCTION(cx, callee)) { fun = (JSFunction *) JS_GetPrivate(cx, JSVAL_TO_OBJECT(callee)); if (fun->atom) name = js_AtomToPrintableString(cx, fun->atom); if (FUN_INTERPRETED(fun)) { key.filename = fun->u.i.script->filename; key.lineno = fun->u.i.script->lineno; } } keyHash = js_hash_call_key(&key); hep = JS_HashTableRawLookup(js_CallTable, keyHash, &key); he = *hep; if (he) { ce = (CallEntry *) he; JS_ASSERT(strncmp(ce->name, name, sizeof ce->name) == 0); } else { he = JS_HashTableRawAdd(js_CallTable, hep, keyHash, &key, NULL); if (!he) return; ce = (CallEntry *) he; ce->entry.key = &ce->key; ce->entry.value = &ce->value; ce->key = key; for (i = 0; i < 8; i++) { ai = &ce->value.argInfo[i]; JS_INIT_CLIST(&ai->lruList); for (j = 0; j < 10; j++) JS_APPEND_LINK(&ai->topValCounts[j].lruLink, &ai->lruList); } strncpy(ce->name, name, sizeof ce->name); } ++ce->value.total; if (ce->value.minargc < argc) ce->value.minargc = argc; if (ce->value.maxargc < argc) ce->value.maxargc = argc; if (argc > 8) argc = 8; for (i = 0; i < argc; i++) { ai = &ce->value.argInfo[i]; argval = argv[i]; type = TYPEOF(cx, argval); ++ai->typeHist[type]; for (j = 0; ; j++) { if (j == 10) { avc = (struct ArgValCount *) ai->lruList.next; ce->value.recycled += avc->count; avc->value = argval; avc->count = 1; break; } avc = &ai->topValCounts[j]; if (avc->value == argval) { ++avc->count; break; } } /* Move avc to the back of the LRU list. */ JS_REMOVE_LINK(&avc->lruLink); JS_APPEND_LINK(&avc->lruLink, &ai->lruList); str = NULL; cstr = ""; switch (TYPEOF(cx, argval)) { case JSTYPE_VOID: cstr = js_type_str[JSTYPE_VOID]; break; case JSTYPE_NULL: cstr = js_null_str; break; case JSTYPE_BOOLEAN: cstr = js_boolean_str[JSVAL_TO_BOOLEAN(argval)]; break; case JSTYPE_NUMBER: if (JSVAL_IS_INT(argval)) { JS_snprintf(avc->strbuf, sizeof avc->strbuf, "%ld", JSVAL_TO_INT(argval)); } else { JS_dtostr(avc->strbuf, sizeof avc->strbuf, DTOSTR_STANDARD, 0, *JSVAL_TO_DOUBLE(argval)); } continue; case JSTYPE_STRING: str = js_QuoteString(cx, JSVAL_TO_STRING(argval), (jschar)'"'); break; case JSTYPE_FUNCTION: if (VALUE_IS_FUNCTION(cx, argval)) { fun = (JSFunction *)JS_GetPrivate(cx, JSVAL_TO_OBJECT(argval)); if (fun && fun->atom) { str = ATOM_TO_STRING(fun->atom); break; } } /* FALL THROUGH */ case JSTYPE_OBJECT: js_LogCallToSourceLimit = sizeof avc->strbuf; cx->options |= JSOPTION_LOGCALL_TOSOURCE; str = js_ValueToSource(cx, argval); cx->options &= ~JSOPTION_LOGCALL_TOSOURCE; break; } if (str) cstr = JS_GetStringBytes(str); strncpy(avc->strbuf, cstr, sizeof avc->strbuf); } } #endif /* DUMP_CALL_TABLE */ /* * Conditional assert to detect failure to clear a pending exception that is * suppressed (or unintentional suppression of a wanted exception). */ #if defined DEBUG_brendan || defined DEBUG_mrbkap || defined DEBUG_shaver # define DEBUG_NOT_THROWING 1 #endif #ifdef DEBUG_NOT_THROWING # define ASSERT_NOT_THROWING(cx) JS_ASSERT(!(cx)->throwing) #else # define ASSERT_NOT_THROWING(cx) /* nothing */ #endif /* * Find a function reference and its 'this' object implicit first parameter * under argc arguments on cx's stack, and call the function. Push missing * required arguments, allocate declared local variables, and pop everything * when done. Then push the return value. */ JS_FRIEND_API(JSBool) js_Invoke(JSContext *cx, uintN argc, uintN flags) { void *mark; JSStackFrame *fp, frame; jsval *sp, *newsp, *limit; jsval *vp, v, thisv; JSObject *funobj, *parent, *thisp; JSBool ok; JSClass *clasp; JSObjectOps *ops; JSNative native; JSFunction *fun; JSScript *script; uintN nslots, nvars, nalloc, surplus; JSInterpreterHook hook; void *hookData; /* Mark the top of stack and load frequently-used registers. */ mark = JS_ARENA_MARK(&cx->stackPool); fp = cx->fp; sp = fp->sp; /* * Set vp to the callee value's stack slot (it's where rval goes). * Once vp is set, control should flow through label out2: to return. * Set frame.rval early so native class and object ops can throw and * return false, causing a goto out2 with ok set to false. */ vp = sp - (2 + argc); v = *vp; frame.rval = JSVAL_VOID; /* * A callee must be an object reference, unless its 'this' parameter * implements the __noSuchMethod__ method, in which case that method will * be called like so: * * thisp.__noSuchMethod__(id, args) * * where id is the name of the method that this invocation attempted to * call by name, and args is an Array containing this invocation's actual * parameters. */ if (JSVAL_IS_PRIMITIVE(v)) { #if JS_HAS_NO_SUCH_METHOD if (fp->script && !(flags & JSINVOKE_INTERNAL)) { ok = NoSuchMethod(cx, fp, vp, flags, argc); if (ok) frame.rval = *vp; goto out2; } #endif goto bad; } /* Load thisv after potentially calling NoSuchMethod, which may set it. */ thisv = vp[1]; funobj = JSVAL_TO_OBJECT(v); parent = OBJ_GET_PARENT(cx, funobj); clasp = OBJ_GET_CLASS(cx, funobj); if (clasp != &js_FunctionClass) { /* Function is inlined, all other classes use object ops. */ ops = funobj->map->ops; /* * XXX this makes no sense -- why convert to function if clasp->call? * XXX better to call that hook without converting * XXX the only thing that needs fixing is liveconnect * * Try converting to function, for closure and API compatibility. * We attempt the conversion under all circumstances for 1.2, but * only if there is a call op defined otherwise. */ if ((ops == &js_ObjectOps) ? clasp->call : ops->call) { ok = clasp->convert(cx, funobj, JSTYPE_FUNCTION, &v); if (!ok) goto out2; if (VALUE_IS_FUNCTION(cx, v)) { /* Make vp refer to funobj to keep it available as argv[-2]. */ *vp = v; funobj = JSVAL_TO_OBJECT(v); parent = OBJ_GET_PARENT(cx, funobj); goto have_fun; } } fun = NULL; script = NULL; nslots = nvars = 0; /* Try a call or construct native object op. */ native = (flags & JSINVOKE_CONSTRUCT) ? ops->construct : ops->call; if (!native) goto bad; if (JSVAL_IS_OBJECT(thisv)) { thisp = JSVAL_TO_OBJECT(thisv); } else { PRIMITIVE_TO_OBJECT(cx, thisv, thisp); if (!thisp) goto out2; vp[1] = thisv = OBJECT_TO_JSVAL(thisp); } } else { have_fun: /* Get private data and set derived locals from it. */ fun = (JSFunction *) JS_GetPrivate(cx, funobj); nslots = (fun->nargs > argc) ? fun->nargs - argc : 0; if (FUN_INTERPRETED(fun)) { native = NULL; script = fun->u.i.script; nvars = fun->u.i.nvars; } else { native = fun->u.n.native; script = NULL; nvars = 0; nslots += fun->u.n.extra; } if (JSFUN_BOUND_METHOD_TEST(fun->flags)) { /* Handle bound method special case. */ thisp = parent; } else if (JSVAL_IS_OBJECT(thisv)) { thisp = JSVAL_TO_OBJECT(thisv); } else { uintN thispflags = JSFUN_THISP_FLAGS(fun->flags); JS_ASSERT(!(flags & JSINVOKE_CONSTRUCT)); if (JSVAL_IS_STRING(thisv)) { if (JSFUN_THISP_TEST(thispflags, JSFUN_THISP_STRING)) { thisp = (JSObject *) thisv; goto init_frame; } thisp = js_StringToObject(cx, JSVAL_TO_STRING(thisv)); } else if (JSVAL_IS_INT(thisv)) { if (JSFUN_THISP_TEST(thispflags, JSFUN_THISP_NUMBER)) { thisp = (JSObject *) thisv; goto init_frame; } thisp = js_NumberToObject(cx, (jsdouble)JSVAL_TO_INT(thisv)); } else if (JSVAL_IS_DOUBLE(thisv)) { if (JSFUN_THISP_TEST(thispflags, JSFUN_THISP_NUMBER)) { thisp = (JSObject *) thisv; goto init_frame; } thisp = js_NumberToObject(cx, *JSVAL_TO_DOUBLE(thisv)); } else { JS_ASSERT(JSVAL_IS_BOOLEAN(thisv)); if (JSFUN_THISP_TEST(thispflags, JSFUN_THISP_BOOLEAN)) { thisp = (JSObject *) thisv; goto init_frame; } thisp = js_BooleanToObject(cx, JSVAL_TO_BOOLEAN(thisv)); } if (!thisp) { ok = JS_FALSE; goto out2; } goto init_frame; } } if (flags & JSINVOKE_CONSTRUCT) { /* Default return value for a constructor is the new object. */ frame.rval = OBJECT_TO_JSVAL(thisp); } else { thisp = js_ComputeThis(cx, thisp, vp + 2); if (!thisp) { ok = JS_FALSE; goto out2; } } init_frame: /* Initialize the rest of frame, except for sp (set by SAVE_SP later). */ frame.thisp = thisp; frame.varobj = NULL; frame.callobj = frame.argsobj = NULL; frame.script = script; frame.fun = fun; frame.argc = argc; frame.argv = sp - argc; frame.nvars = nvars; frame.vars = sp; frame.down = fp; frame.annotation = NULL; frame.scopeChain = NULL; /* set below for real, after cx->fp is set */ frame.pc = NULL; frame.spbase = NULL; frame.sharpDepth = 0; frame.sharpArray = NULL; frame.flags = flags; frame.dormantNext = NULL; frame.xmlNamespace = NULL; frame.blockChain = NULL; /* From here on, control must flow through label out: to return. */ cx->fp = &frame; /* Init these now in case we goto out before first hook call. */ hook = cx->runtime->callHook; hookData = NULL; /* Check for argument slots required by the function. */ if (nslots) { /* All arguments must be contiguous, so we may have to copy actuals. */ nalloc = nslots; limit = (jsval *) cx->stackPool.current->limit; JS_ASSERT((jsval *) cx->stackPool.current->base <= sp && sp <= limit); if (sp + nslots > limit) { /* Hit end of arena: we have to copy argv[-2..(argc+nslots-1)]. */ nalloc += 2 + argc; } else { /* Take advantage of surplus slots in the caller's frame depth. */ JS_ASSERT((jsval *)mark >= sp); surplus = (jsval *)mark - sp; nalloc -= surplus; } /* Check whether we have enough space in the caller's frame. */ if ((intN)nalloc > 0) { /* Need space for actuals plus missing formals minus surplus. */ newsp = js_AllocRawStack(cx, nalloc, NULL); if (!newsp) { ok = JS_FALSE; goto out; } /* If we couldn't allocate contiguous args, copy actuals now. */ if (newsp != mark) { JS_ASSERT(sp + nslots > limit); JS_ASSERT(2 + argc + nslots == nalloc); *newsp++ = vp[0]; *newsp++ = vp[1]; if (argc) memcpy(newsp, frame.argv, argc * sizeof(jsval)); frame.argv = newsp; sp = frame.vars = newsp + argc; } } /* Advance frame.vars to make room for the missing args. */ frame.vars += nslots; /* Push void to initialize missing args. */ do { PUSH(JSVAL_VOID); } while (--nslots != 0); } JS_ASSERT(nslots == 0); /* Now allocate stack space for local variables. */ if (nvars) { JS_ASSERT((jsval *)cx->stackPool.current->avail >= frame.vars); surplus = (jsval *)cx->stackPool.current->avail - frame.vars; if (surplus < nvars) { newsp = js_AllocRawStack(cx, nvars, NULL); if (!newsp) { ok = JS_FALSE; goto out; } if (newsp != sp) { /* NB: Discontinuity between argv and vars. */ sp = frame.vars = newsp; } } /* Push void to initialize local variables. */ do { PUSH(JSVAL_VOID); } while (--nvars != 0); } JS_ASSERT(nvars == 0); /* Store the current sp in frame before calling fun. */ SAVE_SP(&frame); /* call the hook if present */ if (hook && (native || script)) hookData = hook(cx, &frame, JS_TRUE, 0, cx->runtime->callHookData); /* Call the function, either a native method or an interpreted script. */ if (native) { #ifdef DEBUG_NOT_THROWING JSBool alreadyThrowing = cx->throwing; #endif #if JS_HAS_LVALUE_RETURN /* Set by JS_SetCallReturnValue2, used to return reference types. */ cx->rval2set = JS_FALSE; #endif /* If native, use caller varobj and scopeChain for eval. */ frame.varobj = fp->varobj; frame.scopeChain = fp->scopeChain; ok = native(cx, frame.thisp, argc, frame.argv, &frame.rval); JS_RUNTIME_METER(cx->runtime, nativeCalls); #ifdef DEBUG_NOT_THROWING if (ok && !alreadyThrowing) ASSERT_NOT_THROWING(cx); #endif } else if (script) { #ifdef DUMP_CALL_TABLE LogCall(cx, *vp, argc, frame.argv); #endif /* Use parent scope so js_GetCallObject can find the right "Call". */ frame.scopeChain = parent; if (JSFUN_HEAVYWEIGHT_TEST(fun->flags)) { /* Scope with a call object parented by the callee's parent. */ if (!js_GetCallObject(cx, &frame, parent)) { ok = JS_FALSE; goto out; } } ok = js_Interpret(cx, script->code, &v); } else { /* fun might be onerror trying to report a syntax error in itself. */ frame.scopeChain = NULL; ok = JS_TRUE; } out: if (hookData) { hook = cx->runtime->callHook; if (hook) hook(cx, &frame, JS_FALSE, &ok, hookData); } /* If frame has a call object, sync values and clear back-pointer. */ if (frame.callobj) ok &= js_PutCallObject(cx, &frame); /* If frame has an arguments object, sync values and clear back-pointer. */ if (frame.argsobj) ok &= js_PutArgsObject(cx, &frame); /* Restore cx->fp now that we're done releasing frame objects. */ cx->fp = fp; out2: /* Pop everything we may have allocated off the stack. */ JS_ARENA_RELEASE(&cx->stackPool, mark); /* Store the return value and restore sp just above it. */ *vp = frame.rval; fp->sp = vp + 1; /* * Store the location of the JSOP_CALL or JSOP_EVAL that generated the * return value, but only if this is an external (compiled from script * source) call that has stack budget for the generating pc. */ if (fp->script && !(flags & JSINVOKE_INTERNAL)) vp[-(intN)fp->script->depth] = (jsval)fp->pc; return ok; bad: js_ReportIsNotFunction(cx, vp, flags & JSINVOKE_FUNFLAGS); ok = JS_FALSE; goto out2; } JSBool js_InternalInvoke(JSContext *cx, JSObject *obj, jsval fval, uintN flags, uintN argc, jsval *argv, jsval *rval) { JSStackFrame *fp, *oldfp, frame; jsval *oldsp, *sp; void *mark; uintN i; JSBool ok; fp = oldfp = cx->fp; if (!fp) { memset(&frame, 0, sizeof frame); cx->fp = fp = &frame; } oldsp = fp->sp; sp = js_AllocStack(cx, 2 + argc, &mark); if (!sp) { ok = JS_FALSE; goto out; } PUSH(fval); PUSH(OBJECT_TO_JSVAL(obj)); for (i = 0; i < argc; i++) PUSH(argv[i]); SAVE_SP(fp); ok = js_Invoke(cx, argc, flags | JSINVOKE_INTERNAL); if (ok) { RESTORE_SP(fp); /* * Store *rval in the a scoped local root if a scope is open, else in * the lastInternalResult pigeon-hole GC root, solely so users of * js_InternalInvoke and its direct and indirect (js_ValueToString for * example) callers do not need to manage roots for local, temporary * references to such results. */ *rval = POP_OPND(); if (JSVAL_IS_GCTHING(*rval)) { if (cx->localRootStack) { if (js_PushLocalRoot(cx, cx->localRootStack, *rval) < 0) ok = JS_FALSE; } else { cx->weakRoots.lastInternalResult = *rval; } } } js_FreeStack(cx, mark); out: fp->sp = oldsp; if (oldfp != fp) cx->fp = oldfp; return ok; } JSBool js_InternalGetOrSet(JSContext *cx, JSObject *obj, jsid id, jsval fval, JSAccessMode mode, uintN argc, jsval *argv, jsval *rval) { int stackDummy; /* * js_InternalInvoke could result in another try to get or set the same id * again, see bug 355497. */ if (!JS_CHECK_STACK_SIZE(cx, stackDummy)) { JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_OVER_RECURSED); return JS_FALSE; } /* * Check general (not object-ops/class-specific) access from the running * script to obj.id only if id has a scripted getter or setter that we're * about to invoke. If we don't check this case, nothing else will -- no * other native code has the chance to check. * * Contrast this non-native (scripted) case with native getter and setter * accesses, where the native itself must do an access check, if security * policies requires it. We make a checkAccess or checkObjectAccess call * back to the embedding program only in those cases where we're not going * to call an embedding-defined native function, getter, setter, or class * hook anyway. Where we do call such a native, there's no need for the * engine to impose a separate access check callback on all embeddings -- * many embeddings have no security policy at all. */ JS_ASSERT(mode == JSACC_READ || mode == JSACC_WRITE); if (cx->runtime->checkObjectAccess && VALUE_IS_FUNCTION(cx, fval) && FUN_INTERPRETED((JSFunction *) JS_GetPrivate(cx, JSVAL_TO_OBJECT(fval))) && !cx->runtime->checkObjectAccess(cx, obj, ID_TO_VALUE(id), mode, &fval)) { return JS_FALSE; } return js_InternalCall(cx, obj, fval, argc, argv, rval); } JSBool js_Execute(JSContext *cx, JSObject *chain, JSScript *script, JSStackFrame *down, uintN flags, jsval *result) { JSInterpreterHook hook; void *hookData, *mark; JSStackFrame *oldfp, frame; JSObject *obj, *tmp; JSBool ok; hook = cx->runtime->executeHook; hookData = mark = NULL; oldfp = cx->fp; frame.script = script; if (down) { /* Propagate arg/var state for eval and the debugger API. */ frame.callobj = down->callobj; frame.argsobj = down->argsobj; frame.varobj = down->varobj; frame.fun = down->fun; frame.thisp = down->thisp; frame.argc = down->argc; frame.argv = down->argv; frame.nvars = down->nvars; frame.vars = down->vars; frame.annotation = down->annotation; frame.sharpArray = down->sharpArray; } else { frame.callobj = frame.argsobj = NULL; obj = chain; if (cx->options & JSOPTION_VAROBJFIX) { while ((tmp = OBJ_GET_PARENT(cx, obj)) != NULL) obj = tmp; } frame.varobj = obj; frame.fun = NULL; frame.thisp = chain; frame.argc = 0; frame.argv = NULL; frame.nvars = script->numGlobalVars; if (frame.nvars) { frame.vars = js_AllocRawStack(cx, frame.nvars, &mark); if (!frame.vars) return JS_FALSE; memset(frame.vars, 0, frame.nvars * sizeof(jsval)); } else { frame.vars = NULL; } frame.annotation = NULL; frame.sharpArray = NULL; } frame.rval = JSVAL_VOID; frame.down = down; frame.scopeChain = chain; frame.pc = NULL; frame.sp = oldfp ? oldfp->sp : NULL; frame.spbase = NULL; frame.sharpDepth = 0; frame.flags = flags; frame.dormantNext = NULL; frame.xmlNamespace = NULL; frame.blockChain = NULL; /* * Here we wrap the call to js_Interpret with code to (conditionally) * save and restore the old stack frame chain into a chain of 'dormant' * frame chains. Since we are replacing cx->fp, we were running into * the problem that if GC was called under this frame, some of the GC * things associated with the old frame chain (available here only in * the C variable 'oldfp') were not rooted and were being collected. * * So, now we preserve the links to these 'dormant' frame chains in cx * before calling js_Interpret and cleanup afterwards. The GC walks * these dormant chains and marks objects in the same way that it marks * objects in the primary cx->fp chain. */ if (oldfp && oldfp != down) { JS_ASSERT(!oldfp->dormantNext); oldfp->dormantNext = cx->dormantFrameChain; cx->dormantFrameChain = oldfp; } cx->fp = &frame; if (hook) hookData = hook(cx, &frame, JS_TRUE, 0, cx->runtime->executeHookData); /* * Use frame.rval, not result, so the last result stays rooted across any * GC activations nested within this js_Interpret. */ ok = js_Interpret(cx, script->code, &frame.rval); *result = frame.rval; if (hookData) { hook = cx->runtime->executeHook; if (hook) hook(cx, &frame, JS_FALSE, &ok, hookData); } if (mark) js_FreeRawStack(cx, mark); cx->fp = oldfp; if (oldfp && oldfp != down) { JS_ASSERT(cx->dormantFrameChain == oldfp); cx->dormantFrameChain = oldfp->dormantNext; oldfp->dormantNext = NULL; } return ok; } #if JS_HAS_EXPORT_IMPORT /* * If id is JSVAL_VOID, import all exported properties from obj. */ static JSBool ImportProperty(JSContext *cx, JSObject *obj, jsid id) { JSBool ok; JSIdArray *ida; JSProperty *prop; JSObject *obj2, *target, *funobj, *closure; JSString *str; uintN attrs; jsint i; jsval value; if (JSVAL_IS_VOID(id)) { ida = JS_Enumerate(cx, obj); if (!ida) return JS_FALSE; ok = JS_TRUE; if (ida->length == 0) goto out; } else { ida = NULL; if (!OBJ_LOOKUP_PROPERTY(cx, obj, id, &obj2, &prop)) return JS_FALSE; if (!prop) { str = js_DecompileValueGenerator(cx, JSDVG_IGNORE_STACK, ID_TO_VALUE(id), NULL); if (str) js_ReportIsNotDefined(cx, JS_GetStringBytes(str)); return JS_FALSE; } ok = OBJ_GET_ATTRIBUTES(cx, obj, id, prop, &attrs); OBJ_DROP_PROPERTY(cx, obj2, prop); if (!ok) return JS_FALSE; if (!(attrs & JSPROP_EXPORTED)) { str = js_DecompileValueGenerator(cx, JSDVG_IGNORE_STACK, ID_TO_VALUE(id), NULL); if (str) { JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_NOT_EXPORTED, JS_GetStringBytes(str)); } return JS_FALSE; } } target = cx->fp->varobj; i = 0; do { if (ida) { id = ida->vector[i]; ok = OBJ_GET_ATTRIBUTES(cx, obj, id, NULL, &attrs); if (!ok) goto out; if (!(attrs & JSPROP_EXPORTED)) continue; } ok = OBJ_CHECK_ACCESS(cx, obj, id, JSACC_IMPORT, &value, &attrs); if (!ok) goto out; if (VALUE_IS_FUNCTION(cx, value)) { funobj = JSVAL_TO_OBJECT(value); closure = js_CloneFunctionObject(cx, funobj, obj); if (!closure) { ok = JS_FALSE; goto out; } value = OBJECT_TO_JSVAL(closure); } /* * Handle the case of importing a property that refers to a local * variable or formal parameter of a function activation. These * properties are accessed by opcodes using stack slot numbers * generated by the compiler rather than runtime name-lookup. These * local references, therefore, bypass the normal scope chain lookup. * So, instead of defining a new property in the activation object, * modify the existing value in the stack slot. */ if (OBJ_GET_CLASS(cx, target) == &js_CallClass) { ok = OBJ_LOOKUP_PROPERTY(cx, target, id, &obj2, &prop); if (!ok) goto out; } else { prop = NULL; } if (prop && target == obj2) { ok = OBJ_SET_PROPERTY(cx, target, id, &value); } else { ok = OBJ_DEFINE_PROPERTY(cx, target, id, value, NULL, NULL, attrs & ~(JSPROP_EXPORTED | JSPROP_GETTER | JSPROP_SETTER), NULL); } if (prop) OBJ_DROP_PROPERTY(cx, obj2, prop); if (!ok) goto out; } while (ida && ++i < ida->length); out: if (ida) JS_DestroyIdArray(cx, ida); return ok; } #endif /* JS_HAS_EXPORT_IMPORT */ JSBool js_CheckRedeclaration(JSContext *cx, JSObject *obj, jsid id, uintN attrs, JSObject **objp, JSProperty **propp) { JSObject *obj2; JSProperty *prop; uintN oldAttrs, report; JSBool isFunction; jsval value; const char *type, *name; if (!OBJ_LOOKUP_PROPERTY(cx, obj, id, &obj2, &prop)) return JS_FALSE; if (propp) { *objp = obj2; *propp = prop; } if (!prop) return JS_TRUE; /* * Use prop as a speedup hint to OBJ_GET_ATTRIBUTES, but drop it on error. * An assertion at label bad: will insist that it is null. */ if (!OBJ_GET_ATTRIBUTES(cx, obj2, id, prop, &oldAttrs)) { OBJ_DROP_PROPERTY(cx, obj2, prop); #ifdef DEBUG prop = NULL; #endif goto bad; } /* * From here, return true, or else goto bad on failure to null out params. * If our caller doesn't want prop, drop it (we don't need it any longer). */ if (!propp) { OBJ_DROP_PROPERTY(cx, obj2, prop); prop = NULL; } /* If either property is readonly, we have an error. */ report = ((oldAttrs | attrs) & JSPROP_READONLY) ? JSREPORT_ERROR : JSREPORT_WARNING | JSREPORT_STRICT; if (report != JSREPORT_ERROR) { /* * Allow redeclaration of variables and functions, but insist that the * new value is not a getter if the old value was, ditto for setters -- * unless prop is impermanent (in which case anyone could delete it and * redefine it, willy-nilly). */ if (!(attrs & (JSPROP_GETTER | JSPROP_SETTER))) return JS_TRUE; if ((~(oldAttrs ^ attrs) & (JSPROP_GETTER | JSPROP_SETTER)) == 0) return JS_TRUE; if (!(oldAttrs & JSPROP_PERMANENT)) return JS_TRUE; report = JSREPORT_ERROR; } isFunction = (oldAttrs & (JSPROP_GETTER | JSPROP_SETTER)) != 0; if (!isFunction) { if (!OBJ_GET_PROPERTY(cx, obj, id, &value)) goto bad; isFunction = VALUE_IS_FUNCTION(cx, value); } type = (oldAttrs & attrs & JSPROP_GETTER) ? js_getter_str : (oldAttrs & attrs & JSPROP_SETTER) ? js_setter_str : (oldAttrs & JSPROP_READONLY) ? js_const_str : isFunction ? js_function_str : js_var_str; name = js_AtomToPrintableString(cx, JSID_TO_ATOM(id)); if (!name) goto bad; return JS_ReportErrorFlagsAndNumber(cx, report, js_GetErrorMessage, NULL, JSMSG_REDECLARED_VAR, type, name); bad: if (propp) { *objp = NULL; *propp = NULL; } JS_ASSERT(!prop); return JS_FALSE; } JSBool js_StrictlyEqual(jsval lval, jsval rval) { jsval ltag = JSVAL_TAG(lval), rtag = JSVAL_TAG(rval); jsdouble ld, rd; if (ltag == rtag) { if (ltag == JSVAL_STRING) { JSString *lstr = JSVAL_TO_STRING(lval), *rstr = JSVAL_TO_STRING(rval); return js_EqualStrings(lstr, rstr); } if (ltag == JSVAL_DOUBLE) { ld = *JSVAL_TO_DOUBLE(lval); rd = *JSVAL_TO_DOUBLE(rval); return JSDOUBLE_COMPARE(ld, ==, rd, JS_FALSE); } return lval == rval; } if (ltag == JSVAL_DOUBLE && JSVAL_IS_INT(rval)) { ld = *JSVAL_TO_DOUBLE(lval); rd = JSVAL_TO_INT(rval); return JSDOUBLE_COMPARE(ld, ==, rd, JS_FALSE); } if (JSVAL_IS_INT(lval) && rtag == JSVAL_DOUBLE) { ld = JSVAL_TO_INT(lval); rd = *JSVAL_TO_DOUBLE(rval); return JSDOUBLE_COMPARE(ld, ==, rd, JS_FALSE); } return lval == rval; } JSBool js_InvokeConstructor(JSContext *cx, jsval *vp, uintN argc) { JSFunction *fun; JSObject *obj, *obj2, *proto, *parent; jsval lval, rval; JSClass *clasp, *funclasp; fun = NULL; obj2 = NULL; lval = *vp; if (!JSVAL_IS_OBJECT(lval) || (obj2 = JSVAL_TO_OBJECT(lval)) == NULL || /* XXX clean up to avoid special cases above ObjectOps layer */ OBJ_GET_CLASS(cx, obj2) == &js_FunctionClass || !obj2->map->ops->construct) { fun = js_ValueToFunction(cx, vp, JSV2F_CONSTRUCT); if (!fun) return JS_FALSE; } clasp = &js_ObjectClass; if (!obj2) { proto = parent = NULL; fun = NULL; } else { /* * Get the constructor prototype object for this function. * Use the nominal 'this' parameter slot, vp[1], as a local * root to protect this prototype, in case it has no other * strong refs. */ if (!OBJ_GET_PROPERTY(cx, obj2, ATOM_TO_JSID(cx->runtime->atomState .classPrototypeAtom), &vp[1])) { return JS_FALSE; } rval = vp[1]; proto = JSVAL_IS_OBJECT(rval) ? JSVAL_TO_OBJECT(rval) : NULL; parent = OBJ_GET_PARENT(cx, obj2); if (OBJ_GET_CLASS(cx, obj2) == &js_FunctionClass) { funclasp = ((JSFunction *)JS_GetPrivate(cx, obj2))->clasp; if (funclasp) clasp = funclasp; } } obj = js_NewObject(cx, clasp, proto, parent); if (!obj) return JS_FALSE; /* Now we have an object with a constructor method; call it. */ vp[1] = OBJECT_TO_JSVAL(obj); if (!js_Invoke(cx, argc, JSINVOKE_CONSTRUCT)) { cx->weakRoots.newborn[GCX_OBJECT] = NULL; return JS_FALSE; } /* Check the return value and if it's primitive, force it to be obj. */ rval = *vp; if (JSVAL_IS_PRIMITIVE(rval)) { if (!fun) { /* native [[Construct]] returning primitive is error */ JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_BAD_NEW_RESULT, js_ValueToPrintableString(cx, rval)); return JS_FALSE; } *vp = OBJECT_TO_JSVAL(obj); } JS_RUNTIME_METER(cx->runtime, constructs); return JS_TRUE; } static JSBool InternStringElementId(JSContext *cx, jsval idval, jsid *idp) { JSAtom *atom; atom = js_ValueToStringAtom(cx, idval); if (!atom) return JS_FALSE; *idp = ATOM_TO_JSID(atom); return JS_TRUE; } static JSBool InternNonIntElementId(JSContext *cx, jsval idval, jsid *idp) { JS_ASSERT(!JSVAL_IS_INT(idval)); #if JS_HAS_XML_SUPPORT if (JSVAL_IS_OBJECT(idval)) { *idp = OBJECT_JSVAL_TO_JSID(idval); return JS_TRUE; } #endif return InternStringElementId(cx, idval, idp); } #if JS_HAS_XML_SUPPORT #define CHECK_ELEMENT_ID(obj, id) \ JS_BEGIN_MACRO \ if (JSID_IS_OBJECT(id) && !OBJECT_IS_XML(cx, obj)) { \ SAVE_SP_AND_PC(fp); \ ok = InternStringElementId(cx, OBJECT_JSID_TO_JSVAL(id), &id); \ if (!ok) \ goto out; \ } \ JS_END_MACRO #else #define CHECK_ELEMENT_ID(obj, id) JS_ASSERT(!JSID_IS_OBJECT(id)) #endif #ifndef MAX_INTERP_LEVEL #if defined(XP_OS2) #define MAX_INTERP_LEVEL 250 #else #define MAX_INTERP_LEVEL 1000 #endif #endif #define MAX_INLINE_CALL_COUNT 1000 /* * Threaded interpretation via computed goto appears to be well-supported by * GCC 3 and higher. IBM's C compiler when run with the right options (e.g., * -qlanglvl=extended) also supports threading. Ditto the SunPro C compiler. * Currently it's broken for JS_VERSION < 160, though this isn't worth fixing. * Add your compiler support macros here. */ #if JS_VERSION >= 160 && ( \ __GNUC__ >= 3 || \ (__IBMC__ >= 700 && defined __IBM_COMPUTED_GOTO) || \ __SUNPRO_C >= 0x570) # define JS_THREADED_INTERP 1 #else # undef JS_THREADED_INTERP #endif JSBool js_Interpret(JSContext *cx, jsbytecode *pc, jsval *result) { JSRuntime *rt; JSStackFrame *fp; JSScript *script; uintN inlineCallCount; JSObject *obj, *obj2, *parent; JSVersion currentVersion, originalVersion; JSBranchCallback onbranch; JSBool ok, cond; JSTrapHandler interruptHandler; jsint depth, len; jsval *sp, *newsp; void *mark; jsbytecode *endpc, *pc2; JSOp op, op2; jsatomid atomIndex; JSAtom *atom; uintN argc, attrs, flags, slot; jsval *vp, lval, rval, ltmp, rtmp; jsid id; JSObject *withobj, *iterobj; JSProperty *prop; JSScopeProperty *sprop; JSString *str, *str2; jsint i, j; jsdouble d, d2; JSClass *clasp; JSFunction *fun; JSType type; #if !defined JS_THREADED_INTERP && defined DEBUG FILE *tracefp = NULL; #endif #if JS_HAS_EXPORT_IMPORT JSIdArray *ida; #endif jsint low, high, off, npairs; JSBool match; #if JS_HAS_GETTER_SETTER JSPropertyOp getter, setter; #endif int stackDummy; #ifdef __GNUC__ # define JS_EXTENSION __extension__ # define JS_EXTENSION_(s) __extension__ ({ s; }) #else # define JS_EXTENSION # define JS_EXTENSION_(s) s #endif #ifdef JS_THREADED_INTERP static void *normalJumpTable[] = { # define OPDEF(op,val,name,token,length,nuses,ndefs,prec,format) \ JS_EXTENSION &&L_##op, # include "jsopcode.tbl" # undef OPDEF }; static void *interruptJumpTable[] = { # define OPDEF(op,val,name,token,length,nuses,ndefs,prec,format) \ ((op != JSOP_PUSHOBJ) \ ? JS_EXTENSION &&interrupt \ : JS_EXTENSION &&L_JSOP_PUSHOBJ), # include "jsopcode.tbl" # undef OPDEF }; register void **jumpTable = normalJumpTable; # define DO_OP() JS_EXTENSION_(goto *jumpTable[op]) # define DO_NEXT_OP(n) do { op = *(pc += (n)); DO_OP(); } while (0) # define BEGIN_CASE(OP) L_##OP: # define END_CASE(OP) DO_NEXT_OP(OP##_LENGTH); # define END_VARLEN_CASE DO_NEXT_OP(len); # define EMPTY_CASE(OP) BEGIN_CASE(OP) op = *++pc; DO_OP(); #else # define DO_OP() goto do_op # define DO_NEXT_OP(n) goto advance_pc # define BEGIN_CASE(OP) case OP: # define END_CASE(OP) break; # define END_VARLEN_CASE break; # define EMPTY_CASE(OP) BEGIN_CASE(OP) END_CASE(OP) #endif *result = JSVAL_VOID; rt = cx->runtime; /* Set registerized frame pointer and derived script pointer. */ fp = cx->fp; script = fp->script; JS_ASSERT(script->length != 0); /* Count of JS function calls that nest in this C js_Interpret frame. */ inlineCallCount = 0; /* * Optimized Get and SetVersion for proper script language versioning. * * If any native method or JSClass/JSObjectOps hook calls js_SetVersion * and changes cx->version, the effect will "stick" and we will stop * maintaining currentVersion. This is relied upon by testsuites, for * the most part -- web browsers select version before compiling and not * at run-time. */ currentVersion = script->version; originalVersion = cx->version; if (currentVersion != originalVersion) js_SetVersion(cx, currentVersion); #ifdef __GNUC__ flags = 0; /* suppress gcc warnings */ id = 0; #endif /* * Prepare to call a user-supplied branch handler, and abort the script * if it returns false. We reload onbranch after calling out to native * functions (but not to getters, setters, or other native hooks). */ #define LOAD_BRANCH_CALLBACK(cx) (onbranch = (cx)->branchCallback) LOAD_BRANCH_CALLBACK(cx); #define CHECK_BRANCH(len) \ JS_BEGIN_MACRO \ if (len <= 0 && onbranch) { \ SAVE_SP_AND_PC(fp); \ if (!(ok = (*onbranch)(cx, script))) \ goto out; \ } \ JS_END_MACRO /* * Load the debugger's interrupt hook here and after calling out to native * functions (but not to getters, setters, or other native hooks), so we do * not have to reload it each time through the interpreter loop -- we hope * the compiler can keep it in a register when it is non-null. */ #ifdef JS_THREADED_INTERP # define LOAD_JUMP_TABLE() \ (jumpTable = interruptHandler ? interruptJumpTable : normalJumpTable) #else # define LOAD_JUMP_TABLE() /* nothing */ #endif #define LOAD_INTERRUPT_HANDLER(rt) \ JS_BEGIN_MACRO \ interruptHandler = (rt)->interruptHandler; \ LOAD_JUMP_TABLE(); \ JS_END_MACRO LOAD_INTERRUPT_HANDLER(rt); /* Check for too much js_Interpret nesting, or too deep a C stack. */ if (++cx->interpLevel == MAX_INTERP_LEVEL || !JS_CHECK_STACK_SIZE(cx, stackDummy)) { JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_OVER_RECURSED); ok = JS_FALSE; goto out2; } /* * Allocate operand and pc stack slots for the script's worst-case depth, * unless we're called to interpret a part of an already active script, a * filtering predicate expression for example. */ depth = (jsint) script->depth; if (JS_LIKELY(!fp->spbase)) { newsp = js_AllocRawStack(cx, (uintN)(2 * depth), &mark); if (!newsp) { ok = JS_FALSE; goto out2; } sp = newsp + depth; fp->spbase = sp; SAVE_SP(fp); } else { sp = fp->sp; JS_ASSERT(JS_UPTRDIFF(sp, fp->spbase) <= depth * sizeof(jsval)); newsp = fp->spbase - depth; mark = NULL; } /* * To support generator_throw and to catch ignored exceptions, fail right * away if cx->throwing is set. If no exception is pending, null obj in * case a callable object is being sent into a yield expression, and the * yield's result is invoked. */ ok = !cx->throwing; if (!ok) { #ifdef DEBUG_NOT_THROWING printf("JS INTERPRETER CALLED WITH PENDING EXCEPTION %lx\n", (unsigned long) cx->exception); #endif goto out; } obj = NULL; #ifdef JS_THREADED_INTERP /* * This is a loop, but it does not look like a loop. The loop-closing * jump is distributed throughout interruptJumpTable, and comes back to * the interrupt label. The dispatch on op is through normalJumpTable. * The trick is LOAD_INTERRUPT_HANDLER setting jumpTable appropriately. * * It is important that "op" be initialized before the interrupt label * because it is possible for "op" to be specially assigned during the * normally processing of an opcode while looping (in particular, this * happens in JSOP_TRAP while debugging). We rely on DO_NEXT_OP to * correctly manage "op" in all other cases. */ op = (JSOp) *pc; if (interruptHandler) { interrupt: SAVE_SP_AND_PC(fp); switch (interruptHandler(cx, script, pc, &rval, rt->interruptHandlerData)) { case JSTRAP_ERROR: ok = JS_FALSE; goto out; case JSTRAP_CONTINUE: break; case JSTRAP_RETURN: fp->rval = rval; goto out; case JSTRAP_THROW: cx->throwing = JS_TRUE; cx->exception = rval; ok = JS_FALSE; goto out; default:; } LOAD_INTERRUPT_HANDLER(rt); } JS_ASSERT((uintN)op < (uintN)JSOP_LIMIT); JS_EXTENSION_(goto *normalJumpTable[op]); #else /* !JS_THREADED_INTERP */ for (;;) { op = (JSOp) *pc; do_op: len = js_CodeSpec[op].length; #ifdef DEBUG tracefp = (FILE *) cx->tracefp; if (tracefp) { intN nuses, n; fprintf(tracefp, "%4u: ", js_PCToLineNumber(cx, script, pc)); js_Disassemble1(cx, script, pc, PTRDIFF(pc, script->code, jsbytecode), JS_FALSE, tracefp); nuses = js_CodeSpec[op].nuses; if (nuses) { SAVE_SP_AND_PC(fp); for (n = -nuses; n < 0; n++) { str = js_DecompileValueGenerator(cx, n, sp[n], NULL); if (str) { fprintf(tracefp, "%s %s", (n == -nuses) ? " inputs:" : ",", JS_GetStringBytes(str)); } } fprintf(tracefp, " @ %d\n", sp - fp->spbase); } } #endif /* DEBUG */ if (interruptHandler && op != JSOP_PUSHOBJ) { SAVE_SP_AND_PC(fp); switch (interruptHandler(cx, script, pc, &rval, rt->interruptHandlerData)) { case JSTRAP_ERROR: ok = JS_FALSE; goto out; case JSTRAP_CONTINUE: break; case JSTRAP_RETURN: fp->rval = rval; goto out; case JSTRAP_THROW: cx->throwing = JS_TRUE; cx->exception = rval; ok = JS_FALSE; goto out; default:; } LOAD_INTERRUPT_HANDLER(rt); } switch (op) { #endif /* !JS_THREADED_INTERP */ BEGIN_CASE(JSOP_STOP) goto out; EMPTY_CASE(JSOP_NOP) BEGIN_CASE(JSOP_GROUP) obj = NULL; END_CASE(JSOP_GROUP) BEGIN_CASE(JSOP_PUSH) PUSH_OPND(JSVAL_VOID); END_CASE(JSOP_PUSH) BEGIN_CASE(JSOP_POP) sp--; END_CASE(JSOP_POP) BEGIN_CASE(JSOP_POP2) sp -= 2; END_CASE(JSOP_POP2) BEGIN_CASE(JSOP_SWAP) vp = sp - depth; /* swap generating pc's for the decompiler */ ltmp = vp[-1]; vp[-1] = vp[-2]; sp[-2] = ltmp; rtmp = sp[-1]; sp[-1] = sp[-2]; sp[-2] = rtmp; END_CASE(JSOP_SWAP) BEGIN_CASE(JSOP_POPV) *result = POP_OPND(); END_CASE(JSOP_POPV) BEGIN_CASE(JSOP_ENTERWITH) FETCH_OBJECT(cx, -1, rval, obj); SAVE_SP_AND_PC(fp); OBJ_TO_INNER_OBJECT(cx, obj); if (!obj || !(obj2 = js_GetScopeChain(cx, fp))) { ok = JS_FALSE; goto out; } withobj = js_NewWithObject(cx, obj, obj2, sp - fp->spbase - 1); if (!withobj) { ok = JS_FALSE; goto out; } fp->scopeChain = withobj; STORE_OPND(-1, OBJECT_TO_JSVAL(withobj)); END_CASE(JSOP_ENTERWITH) BEGIN_CASE(JSOP_LEAVEWITH) rval = POP_OPND(); JS_ASSERT(JSVAL_IS_OBJECT(rval)); withobj = JSVAL_TO_OBJECT(rval); JS_ASSERT(OBJ_GET_CLASS(cx, withobj) == &js_WithClass); fp->scopeChain = OBJ_GET_PARENT(cx, withobj); JS_SetPrivate(cx, withobj, NULL); END_CASE(JSOP_LEAVEWITH) BEGIN_CASE(JSOP_SETRVAL) ASSERT_NOT_THROWING(cx); fp->rval = POP_OPND(); END_CASE(JSOP_SETRVAL) BEGIN_CASE(JSOP_RETURN) CHECK_BRANCH(-1); fp->rval = POP_OPND(); /* FALL THROUGH */ BEGIN_CASE(JSOP_RETRVAL) /* fp->rval already set */ ASSERT_NOT_THROWING(cx); if (inlineCallCount) inline_return: { JSInlineFrame *ifp = (JSInlineFrame *) fp; void *hookData = ifp->hookData; /* * If fp has blocks on its scope chain, home their locals now, * before calling any debugger hook, and before freeing stack. * This matches the order of block putting and hook calling in * the "out-of-line" return code at the bottom of js_Interpret * and in js_Invoke. */ if (fp->flags & JSFRAME_POP_BLOCKS) { SAVE_SP_AND_PC(fp); ok &= PutBlockObjects(cx, fp); } if (hookData) { JSInterpreterHook hook = rt->callHook; if (hook) { SAVE_SP_AND_PC(fp); hook(cx, fp, JS_FALSE, &ok, hookData); LOAD_INTERRUPT_HANDLER(rt); } } /* * If fp has a call object, sync values and clear the back- * pointer. This can happen for a lightweight function if it * calls eval unexpectedly (in a way that is hidden from the * compiler). See bug 325540. */ if (fp->callobj) { SAVE_SP_AND_PC(fp); ok &= js_PutCallObject(cx, fp); } if (fp->argsobj) { SAVE_SP_AND_PC(fp); ok &= js_PutArgsObject(cx, fp); } /* Restore context version only if callee hasn't set version. */ if (JS_LIKELY(cx->version == currentVersion)) { currentVersion = ifp->callerVersion; if (currentVersion != cx->version) js_SetVersion(cx, currentVersion); } /* Store the return value in the caller's operand frame. */ vp = ifp->rvp; *vp = fp->rval; /* Restore cx->fp and release the inline frame's space. */ cx->fp = fp = fp->down; JS_ARENA_RELEASE(&cx->stackPool, ifp->mark); /* Restore sp to point just above the return value. */ fp->sp = vp + 1; RESTORE_SP(fp); /* Restore the calling script's interpreter registers. */ obj = NULL; script = fp->script; depth = (jsint) script->depth; pc = fp->pc; #ifndef JS_THREADED_INTERP endpc = script->code + script->length; #endif /* Store the generating pc for the return value. */ vp[-depth] = (jsval)pc; /* Resume execution in the calling frame. */ inlineCallCount--; if (JS_LIKELY(ok)) { JS_ASSERT(js_CodeSpec[*pc].length == JSOP_CALL_LENGTH); len = JSOP_CALL_LENGTH; DO_NEXT_OP(len); } } goto out; BEGIN_CASE(JSOP_DEFAULT) (void) POP(); /* FALL THROUGH */ BEGIN_CASE(JSOP_GOTO) len = GET_JUMP_OFFSET(pc); CHECK_BRANCH(len); END_VARLEN_CASE BEGIN_CASE(JSOP_IFEQ) POP_BOOLEAN(cx, rval, cond); if (cond == JS_FALSE) { len = GET_JUMP_OFFSET(pc); CHECK_BRANCH(len); DO_NEXT_OP(len); } END_CASE(JSOP_IFEQ) BEGIN_CASE(JSOP_IFNE) POP_BOOLEAN(cx, rval, cond); if (cond != JS_FALSE) { len = GET_JUMP_OFFSET(pc); CHECK_BRANCH(len); DO_NEXT_OP(len); } END_CASE(JSOP_IFNE) BEGIN_CASE(JSOP_OR) POP_BOOLEAN(cx, rval, cond); if (cond == JS_TRUE) { len = GET_JUMP_OFFSET(pc); PUSH_OPND(rval); DO_NEXT_OP(len); } END_CASE(JSOP_OR) BEGIN_CASE(JSOP_AND) POP_BOOLEAN(cx, rval, cond); if (cond == JS_FALSE) { len = GET_JUMP_OFFSET(pc); PUSH_OPND(rval); DO_NEXT_OP(len); } END_CASE(JSOP_AND) BEGIN_CASE(JSOP_DEFAULTX) (void) POP(); /* FALL THROUGH */ BEGIN_CASE(JSOP_GOTOX) len = GET_JUMPX_OFFSET(pc); CHECK_BRANCH(len); END_VARLEN_CASE BEGIN_CASE(JSOP_IFEQX) POP_BOOLEAN(cx, rval, cond); if (cond == JS_FALSE) { len = GET_JUMPX_OFFSET(pc); CHECK_BRANCH(len); DO_NEXT_OP(len); } END_CASE(JSOP_IFEQX) BEGIN_CASE(JSOP_IFNEX) POP_BOOLEAN(cx, rval, cond); if (cond != JS_FALSE) { len = GET_JUMPX_OFFSET(pc); CHECK_BRANCH(len); DO_NEXT_OP(len); } END_CASE(JSOP_IFNEX) BEGIN_CASE(JSOP_ORX) POP_BOOLEAN(cx, rval, cond); if (cond == JS_TRUE) { len = GET_JUMPX_OFFSET(pc); PUSH_OPND(rval); DO_NEXT_OP(len); } END_CASE(JSOP_ORX) BEGIN_CASE(JSOP_ANDX) POP_BOOLEAN(cx, rval, cond); if (cond == JS_FALSE) { len = GET_JUMPX_OFFSET(pc); PUSH_OPND(rval); DO_NEXT_OP(len); } END_CASE(JSOP_ANDX) /* * If the index value at sp[n] is not an int that fits in a jsval, it could * be an object (an XML QName, AttributeName, or AnyName), but only if we are * compiling with JS_HAS_XML_SUPPORT. Otherwise convert the index value to a * string atom id. */ #define FETCH_ELEMENT_ID(n, id) \ JS_BEGIN_MACRO \ jsval idval_ = FETCH_OPND(n); \ if (JSVAL_IS_INT(idval_)) { \ id = INT_JSVAL_TO_JSID(idval_); \ } else { \ SAVE_SP_AND_PC(fp); \ ok = InternNonIntElementId(cx, idval_, &id); \ if (!ok) \ goto out; \ } \ JS_END_MACRO BEGIN_CASE(JSOP_IN) SAVE_SP_AND_PC(fp); rval = FETCH_OPND(-1); if (JSVAL_IS_PRIMITIVE(rval)) { str = js_DecompileValueGenerator(cx, -1, rval, NULL); if (str) { JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_IN_NOT_OBJECT, JS_GetStringBytes(str)); } ok = JS_FALSE; goto out; } obj = JSVAL_TO_OBJECT(rval); FETCH_ELEMENT_ID(-2, id); CHECK_ELEMENT_ID(obj, id); ok = OBJ_LOOKUP_PROPERTY(cx, obj, id, &obj2, &prop); if (!ok) goto out; sp--; STORE_OPND(-1, BOOLEAN_TO_JSVAL(prop != NULL)); if (prop) OBJ_DROP_PROPERTY(cx, obj2, prop); END_CASE(JSOP_IN) BEGIN_CASE(JSOP_FOREACH) flags = JSITER_ENUMERATE | JSITER_FOREACH; goto value_to_iter; #if JS_HAS_DESTRUCTURING BEGIN_CASE(JSOP_FOREACHKEYVAL) flags = JSITER_ENUMERATE | JSITER_FOREACH | JSITER_KEYVALUE; goto value_to_iter; #endif BEGIN_CASE(JSOP_FORIN) /* * Set JSITER_ENUMERATE to indicate that for-in loop should use * the enumeration protocol's iterator for compatibility if an * explicit iterator is not given via the optional __iterator__ * method. */ flags = JSITER_ENUMERATE; value_to_iter: JS_ASSERT(sp > fp->spbase); SAVE_SP_AND_PC(fp); ok = js_ValueToIterator(cx, flags, &sp[-1]); if (!ok) goto out; JS_ASSERT(!JSVAL_IS_PRIMITIVE(sp[-1])); JS_ASSERT(JSOP_FORIN_LENGTH == js_CodeSpec[op].length); END_CASE(JSOP_FORIN) BEGIN_CASE(JSOP_FORPROP) /* * Handle JSOP_FORPROP first, so the cost of the goto do_forinloop * is not paid for the more common cases. */ lval = FETCH_OPND(-1); atom = GET_ATOM(cx, script, pc); id = ATOM_TO_JSID(atom); i = -2; goto do_forinloop; BEGIN_CASE(JSOP_FORNAME) atom = GET_ATOM(cx, script, pc); id = ATOM_TO_JSID(atom); /* * ECMA 12.6.3 says to eval the LHS after looking for properties * to enumerate, and bail without LHS eval if there are no props. * We do Find here to share the most code at label do_forinloop. * If looking for enumerable properties could have side effects, * then we'd have to move this into the common code and condition * it on op == JSOP_FORNAME. */ SAVE_SP_AND_PC(fp); ok = js_FindProperty(cx, id, &obj, &obj2, &prop); if (!ok) goto out; if (prop) OBJ_DROP_PROPERTY(cx, obj2, prop); lval = OBJECT_TO_JSVAL(obj); /* FALL THROUGH */ BEGIN_CASE(JSOP_FORARG) BEGIN_CASE(JSOP_FORVAR) BEGIN_CASE(JSOP_FORLOCAL) /* * JSOP_FORARG and JSOP_FORVAR don't require any lval computation * here, because they address slots on the stack (in fp->args and * fp->vars, respectively). Same applies to JSOP_FORLOCAL, which * addresses fp->spbase. */ /* FALL THROUGH */ BEGIN_CASE(JSOP_FORELEM) /* * JSOP_FORELEM simply initializes or updates the iteration state * and leaves the index expression evaluation and assignment to the * enumerator until after the next property has been acquired, via * a JSOP_ENUMELEM bytecode. */ i = -1; do_forinloop: /* * Reach under the top of stack to find our property iterator, a * JSObject that contains the iteration state. */ JS_ASSERT(!JSVAL_IS_PRIMITIVE(sp[i])); iterobj = JSVAL_TO_OBJECT(sp[i]); SAVE_SP_AND_PC(fp); ok = js_CallIteratorNext(cx, iterobj, &rval); if (!ok) goto out; if (rval == JSVAL_HOLE) { rval = JSVAL_FALSE; goto end_forinloop; } switch (op) { case JSOP_FORARG: slot = GET_ARGNO(pc); JS_ASSERT(slot < fp->fun->nargs); fp->argv[slot] = rval; break; case JSOP_FORVAR: slot = GET_VARNO(pc); JS_ASSERT(slot < fp->fun->u.i.nvars); fp->vars[slot] = rval; break; case JSOP_FORLOCAL: slot = GET_UINT16(pc); JS_ASSERT(slot < (uintN)depth); vp = &fp->spbase[slot]; GC_POKE(cx, *vp); *vp = rval; break; case JSOP_FORELEM: /* FORELEM is not a SET operation, it's more like BINDNAME. */ PUSH_OPND(rval); break; default: JS_ASSERT(op == JSOP_FORPROP || op == JSOP_FORNAME); /* Convert lval to a non-null object containing id. */ VALUE_TO_OBJECT(cx, lval, obj); if (op == JSOP_FORPROP) STORE_OPND(-1, OBJECT_TO_JSVAL(obj)); /* Set the variable obj[id] to refer to rval. */ fp->flags |= JSFRAME_ASSIGNING; ok = OBJ_SET_PROPERTY(cx, obj, id, &rval); fp->flags &= ~JSFRAME_ASSIGNING; if (!ok) goto out; break; } /* Push true to keep looping through properties. */ rval = JSVAL_TRUE; end_forinloop: sp += i + 1; PUSH_OPND(rval); len = js_CodeSpec[op].length; DO_NEXT_OP(len); BEGIN_CASE(JSOP_DUP) JS_ASSERT(sp > fp->spbase); vp = sp - 1; /* address top of stack */ rval = *vp; vp -= depth; /* address generating pc */ vp[1] = *vp; PUSH(rval); END_CASE(JSOP_DUP) BEGIN_CASE(JSOP_DUP2) JS_ASSERT(sp - 2 >= fp->spbase); vp = sp - 1; /* address top of stack */ lval = vp[-1]; rval = *vp; vp -= depth; /* address generating pc */ vp[1] = vp[2] = *vp; PUSH(lval); PUSH(rval); END_CASE(JSOP_DUP2) #define PROPERTY_OP(n, call) \ JS_BEGIN_MACRO \ /* Fetch the left part and resolve it to a non-null object. */ \ FETCH_OBJECT(cx, n, lval, obj); \ \ /* Get or set the property, set ok false if error, true if success. */\ SAVE_SP_AND_PC(fp); \ call; \ if (!ok) \ goto out; \ JS_END_MACRO #define ELEMENT_OP(n, call) \ JS_BEGIN_MACRO \ /* Fetch the right part and resolve it to an internal id. */ \ FETCH_ELEMENT_ID(n, id); \ \ /* Fetch the left part and resolve it to a non-null object. */ \ FETCH_OBJECT(cx, n - 1, lval, obj); \ \ /* Ensure that id has a type suitable for use with obj. */ \ CHECK_ELEMENT_ID(obj, id); \ \ /* Get or set the element, set ok false if error, true if success. */ \ SAVE_SP_AND_PC(fp); \ call; \ if (!ok) \ goto out; \ JS_END_MACRO #define NATIVE_GET(cx,obj,pobj,sprop,vp) \ JS_BEGIN_MACRO \ if (SPROP_HAS_STUB_GETTER(sprop)) { \ /* Fast path for Object instance properties. */ \ JS_ASSERT((sprop)->slot != SPROP_INVALID_SLOT || \ !SPROP_HAS_STUB_SETTER(sprop)); \ *vp = ((sprop)->slot != SPROP_INVALID_SLOT) \ ? LOCKED_OBJ_GET_SLOT(pobj, (sprop)->slot) \ : JSVAL_VOID; \ } else { \ SAVE_SP_AND_PC(fp); \ ok = js_NativeGet(cx, obj, pobj, sprop, vp); \ if (!ok) \ goto out; \ } \ JS_END_MACRO #define NATIVE_SET(cx,obj,sprop,vp) \ JS_BEGIN_MACRO \ if (SPROP_HAS_STUB_SETTER(sprop) && \ (sprop)->slot != SPROP_INVALID_SLOT) { \ /* Fast path for Object instance properties. */ \ LOCKED_OBJ_SET_SLOT(obj, (sprop)->slot, *vp); \ } else { \ SAVE_SP_AND_PC(fp); \ ok = js_NativeSet(cx, obj, sprop, vp); \ if (!ok) \ goto out; \ } \ JS_END_MACRO /* * CACHED_GET and CACHED_SET use cx, obj, id, and rval from their callers' * environments. */ #define CACHED_GET(call) \ JS_BEGIN_MACRO \ if (!OBJ_IS_NATIVE(obj)) { \ ok = call; \ } else { \ JS_LOCK_OBJ(cx, obj); \ PROPERTY_CACHE_TEST(&rt->propertyCache, obj, id, sprop); \ if (sprop) { \ NATIVE_GET(cx, obj, obj, sprop, &rval); \ JS_UNLOCK_OBJ(cx, obj); \ } else { \ JS_UNLOCK_OBJ(cx, obj); \ ok = call; \ /* No fill here: js_GetProperty fills the cache. */ \ } \ } \ JS_END_MACRO #define CACHED_SET(call) \ JS_BEGIN_MACRO \ if (!OBJ_IS_NATIVE(obj)) { \ ok = call; \ } else { \ JSScope *scope_; \ JS_LOCK_OBJ(cx, obj); \ PROPERTY_CACHE_TEST(&rt->propertyCache, obj, id, sprop); \ if (sprop && \ !(sprop->attrs & JSPROP_READONLY) && \ (scope_ = OBJ_SCOPE(obj), !SCOPE_IS_SEALED(scope_))) { \ NATIVE_SET(cx, obj, sprop, &rval); \ JS_UNLOCK_SCOPE(cx, scope_); \ } else { \ JS_UNLOCK_OBJ(cx, obj); \ ok = call; \ /* No fill here: js_SetProperty writes through the cache. */ \ } \ } \ JS_END_MACRO #define BEGIN_LITOPX_CASE(OP,PCOFF) \ BEGIN_CASE(OP) \ pc2 = pc; \ atomIndex = GET_ATOM_INDEX(pc + PCOFF); \ do_##OP: \ atom = js_GetAtom(cx, &script->atomMap, atomIndex); #define END_LITOPX_CASE(OP) \ END_CASE(OP) BEGIN_LITOPX_CASE(JSOP_SETCONST, 0) obj = fp->varobj; rval = FETCH_OPND(-1); SAVE_SP_AND_PC(fp); ok = OBJ_DEFINE_PROPERTY(cx, obj, ATOM_TO_JSID(atom), rval, NULL, NULL, JSPROP_ENUMERATE | JSPROP_PERMANENT | JSPROP_READONLY, NULL); if (!ok) goto out; STORE_OPND(-1, rval); END_LITOPX_CASE(JSOP_SETCONST) #if JS_HAS_DESTRUCTURING BEGIN_CASE(JSOP_ENUMCONSTELEM) FETCH_ELEMENT_ID(-1, id); FETCH_OBJECT(cx, -2, lval, obj); CHECK_ELEMENT_ID(obj, id); rval = FETCH_OPND(-3); SAVE_SP_AND_PC(fp); ok = OBJ_DEFINE_PROPERTY(cx, obj, id, rval, NULL, NULL, JSPROP_ENUMERATE | JSPROP_PERMANENT | JSPROP_READONLY, NULL); if (!ok) goto out; sp -= 3; END_CASE(JSOP_ENUMCONSTELEM) #endif BEGIN_LITOPX_CASE(JSOP_BINDNAME, 0) SAVE_SP_AND_PC(fp); obj = js_FindIdentifierBase(cx, ATOM_TO_JSID(atom)); if (!obj) { ok = JS_FALSE; goto out; } PUSH_OPND(OBJECT_TO_JSVAL(obj)); END_LITOPX_CASE(JSOP_BINDNAME) BEGIN_CASE(JSOP_SETNAME) atom = GET_ATOM(cx, script, pc); id = ATOM_TO_JSID(atom); rval = FETCH_OPND(-1); lval = FETCH_OPND(-2); JS_ASSERT(!JSVAL_IS_PRIMITIVE(lval)); obj = JSVAL_TO_OBJECT(lval); SAVE_SP_AND_PC(fp); CACHED_SET(OBJ_SET_PROPERTY(cx, obj, id, &rval)); if (!ok) goto out; sp--; STORE_OPND(-1, rval); obj = NULL; END_CASE(JSOP_SETNAME) #define INTEGER_OP(OP, EXTRA_CODE) \ JS_BEGIN_MACRO \ FETCH_INT(cx, -1, j); \ FETCH_INT(cx, -2, i); \ EXTRA_CODE \ i = i OP j; \ sp--; \ STORE_INT(cx, -1, i); \ JS_END_MACRO #define BITWISE_OP(OP) INTEGER_OP(OP, (void) 0;) #define SIGNED_SHIFT_OP(OP) INTEGER_OP(OP, j &= 31;) BEGIN_CASE(JSOP_BITOR) BITWISE_OP(|); END_CASE(JSOP_BITOR) BEGIN_CASE(JSOP_BITXOR) BITWISE_OP(^); END_CASE(JSOP_BITXOR) BEGIN_CASE(JSOP_BITAND) BITWISE_OP(&); END_CASE(JSOP_BITAND) #define RELATIONAL_OP(OP) \ JS_BEGIN_MACRO \ rval = FETCH_OPND(-1); \ lval = FETCH_OPND(-2); \ /* Optimize for two int-tagged operands (typical loop control). */ \ if ((lval & rval) & JSVAL_INT) { \ ltmp = lval ^ JSVAL_VOID; \ rtmp = rval ^ JSVAL_VOID; \ if (ltmp && rtmp) { \ cond = JSVAL_TO_INT(lval) OP JSVAL_TO_INT(rval); \ } else { \ d = ltmp ? JSVAL_TO_INT(lval) : *rt->jsNaN; \ d2 = rtmp ? JSVAL_TO_INT(rval) : *rt->jsNaN; \ cond = JSDOUBLE_COMPARE(d, OP, d2, JS_FALSE); \ } \ } else { \ VALUE_TO_PRIMITIVE(cx, lval, JSTYPE_NUMBER, &lval); \ sp[-2] = lval; \ VALUE_TO_PRIMITIVE(cx, rval, JSTYPE_NUMBER, &rval); \ if (JSVAL_IS_STRING(lval) && JSVAL_IS_STRING(rval)) { \ str = JSVAL_TO_STRING(lval); \ str2 = JSVAL_TO_STRING(rval); \ cond = js_CompareStrings(str, str2) OP 0; \ } else { \ VALUE_TO_NUMBER(cx, lval, d); \ VALUE_TO_NUMBER(cx, rval, d2); \ cond = JSDOUBLE_COMPARE(d, OP, d2, JS_FALSE); \ } \ } \ sp--; \ STORE_OPND(-1, BOOLEAN_TO_JSVAL(cond)); \ JS_END_MACRO /* * NB: These macros can't use JS_BEGIN_MACRO/JS_END_MACRO around their bodies * because they begin if/else chains, so callers must not put semicolons after * the call expressions! */ #if JS_HAS_XML_SUPPORT #define XML_EQUALITY_OP(OP) \ if ((ltmp == JSVAL_OBJECT && \ (obj2 = JSVAL_TO_OBJECT(lval)) && \ OBJECT_IS_XML(cx, obj2)) || \ (rtmp == JSVAL_OBJECT && \ (obj2 = JSVAL_TO_OBJECT(rval)) && \ OBJECT_IS_XML(cx, obj2))) { \ JSXMLObjectOps *ops; \ \ ops = (JSXMLObjectOps *) obj2->map->ops; \ if (obj2 == JSVAL_TO_OBJECT(rval)) \ rval = lval; \ SAVE_SP_AND_PC(fp); \ ok = ops->equality(cx, obj2, rval, &cond); \ if (!ok) \ goto out; \ cond = cond OP JS_TRUE; \ } else #define EXTENDED_EQUALITY_OP(OP) \ if (ltmp == JSVAL_OBJECT && \ (obj2 = JSVAL_TO_OBJECT(lval)) && \ ((clasp = OBJ_GET_CLASS(cx, obj2))->flags & JSCLASS_IS_EXTENDED)) { \ JSExtendedClass *xclasp; \ \ xclasp = (JSExtendedClass *) clasp; \ SAVE_SP_AND_PC(fp); \ ok = xclasp->equality(cx, obj2, rval, &cond); \ if (!ok) \ goto out; \ cond = cond OP JS_TRUE; \ } else #else #define XML_EQUALITY_OP(OP) /* nothing */ #define EXTENDED_EQUALITY_OP(OP) /* nothing */ #endif #define EQUALITY_OP(OP, IFNAN) \ JS_BEGIN_MACRO \ rval = FETCH_OPND(-1); \ lval = FETCH_OPND(-2); \ ltmp = JSVAL_TAG(lval); \ rtmp = JSVAL_TAG(rval); \ XML_EQUALITY_OP(OP) \ if (ltmp == rtmp) { \ if (ltmp == JSVAL_STRING) { \ str = JSVAL_TO_STRING(lval); \ str2 = JSVAL_TO_STRING(rval); \ cond = js_EqualStrings(str, str2) OP JS_TRUE; \ } else if (ltmp == JSVAL_DOUBLE) { \ d = *JSVAL_TO_DOUBLE(lval); \ d2 = *JSVAL_TO_DOUBLE(rval); \ cond = JSDOUBLE_COMPARE(d, OP, d2, IFNAN); \ } else { \ EXTENDED_EQUALITY_OP(OP) \ /* Handle all undefined (=>NaN) and int combinations. */ \ cond = lval OP rval; \ } \ } else { \ if (JSVAL_IS_NULL(lval) || JSVAL_IS_VOID(lval)) { \ cond = (JSVAL_IS_NULL(rval) || JSVAL_IS_VOID(rval)) OP 1; \ } else if (JSVAL_IS_NULL(rval) || JSVAL_IS_VOID(rval)) { \ cond = 1 OP 0; \ } else { \ if (ltmp == JSVAL_OBJECT) { \ VALUE_TO_PRIMITIVE(cx, lval, JSTYPE_VOID, &sp[-2]); \ lval = sp[-2]; \ ltmp = JSVAL_TAG(lval); \ } else if (rtmp == JSVAL_OBJECT) { \ VALUE_TO_PRIMITIVE(cx, rval, JSTYPE_VOID, &sp[-1]); \ rval = sp[-1]; \ rtmp = JSVAL_TAG(rval); \ } \ if (ltmp == JSVAL_STRING && rtmp == JSVAL_STRING) { \ str = JSVAL_TO_STRING(lval); \ str2 = JSVAL_TO_STRING(rval); \ cond = js_EqualStrings(str, str2) OP JS_TRUE; \ } else { \ VALUE_TO_NUMBER(cx, lval, d); \ VALUE_TO_NUMBER(cx, rval, d2); \ cond = JSDOUBLE_COMPARE(d, OP, d2, IFNAN); \ } \ } \ } \ sp--; \ STORE_OPND(-1, BOOLEAN_TO_JSVAL(cond)); \ JS_END_MACRO BEGIN_CASE(JSOP_EQ) EQUALITY_OP(==, JS_FALSE); END_CASE(JSOP_EQ) BEGIN_CASE(JSOP_NE) EQUALITY_OP(!=, JS_TRUE); END_CASE(JSOP_NE) #define NEW_EQUALITY_OP(OP) \ JS_BEGIN_MACRO \ rval = FETCH_OPND(-1); \ lval = FETCH_OPND(-2); \ cond = js_StrictlyEqual(lval, rval) OP JS_TRUE; \ sp--; \ STORE_OPND(-1, BOOLEAN_TO_JSVAL(cond)); \ JS_END_MACRO BEGIN_CASE(JSOP_NEW_EQ) NEW_EQUALITY_OP(==); END_CASE(JSOP_NEW_EQ) BEGIN_CASE(JSOP_NEW_NE) NEW_EQUALITY_OP(!=); END_CASE(JSOP_NEW_NE) BEGIN_CASE(JSOP_CASE) pc2 = (jsbytecode *) sp[-2-depth]; NEW_EQUALITY_OP(==); (void) POP(); if (cond) { len = GET_JUMP_OFFSET(pc); CHECK_BRANCH(len); DO_NEXT_OP(len); } sp[-depth] = (jsval)pc2; PUSH(lval); END_CASE(JSOP_CASE) BEGIN_CASE(JSOP_CASEX) pc2 = (jsbytecode *) sp[-2-depth]; NEW_EQUALITY_OP(==); (void) POP(); if (cond) { len = GET_JUMPX_OFFSET(pc); CHECK_BRANCH(len); DO_NEXT_OP(len); } sp[-depth] = (jsval)pc2; PUSH(lval); END_CASE(JSOP_CASEX) BEGIN_CASE(JSOP_LT) RELATIONAL_OP(<); END_CASE(JSOP_LT) BEGIN_CASE(JSOP_LE) RELATIONAL_OP(<=); END_CASE(JSOP_LE) BEGIN_CASE(JSOP_GT) RELATIONAL_OP(>); END_CASE(JSOP_GT) BEGIN_CASE(JSOP_GE) RELATIONAL_OP(>=); END_CASE(JSOP_GE) #undef EQUALITY_OP #undef RELATIONAL_OP BEGIN_CASE(JSOP_LSH) SIGNED_SHIFT_OP(<<); END_CASE(JSOP_LSH) BEGIN_CASE(JSOP_RSH) SIGNED_SHIFT_OP(>>); END_CASE(JSOP_RSH) BEGIN_CASE(JSOP_URSH) { uint32 u; FETCH_INT(cx, -1, j); FETCH_UINT(cx, -2, u); u >>= j & 31; sp--; STORE_UINT(cx, -1, u); } END_CASE(JSOP_URSH) #undef INTEGER_OP #undef BITWISE_OP #undef SIGNED_SHIFT_OP BEGIN_CASE(JSOP_ADD) rval = FETCH_OPND(-1); lval = FETCH_OPND(-2); #if JS_HAS_XML_SUPPORT if (!JSVAL_IS_PRIMITIVE(lval) && (obj2 = JSVAL_TO_OBJECT(lval), OBJECT_IS_XML(cx, obj2)) && VALUE_IS_XML(cx, rval)) { JSXMLObjectOps *ops; ops = (JSXMLObjectOps *) obj2->map->ops; SAVE_SP_AND_PC(fp); ok = ops->concatenate(cx, obj2, rval, &rval); if (!ok) goto out; sp--; STORE_OPND(-1, rval); } else #endif { VALUE_TO_PRIMITIVE(cx, lval, JSTYPE_VOID, &sp[-2]); lval = sp[-2]; VALUE_TO_PRIMITIVE(cx, rval, JSTYPE_VOID, &sp[-1]); rval = sp[-1]; if ((cond = JSVAL_IS_STRING(lval)) || JSVAL_IS_STRING(rval)) { SAVE_SP_AND_PC(fp); if (cond) { str = JSVAL_TO_STRING(lval); ok = (str2 = js_ValueToString(cx, rval)) != NULL; if (!ok) goto out; sp[-1] = STRING_TO_JSVAL(str2); } else { str2 = JSVAL_TO_STRING(rval); ok = (str = js_ValueToString(cx, lval)) != NULL; if (!ok) goto out; sp[-2] = STRING_TO_JSVAL(str); } str = js_ConcatStrings(cx, str, str2); if (!str) { ok = JS_FALSE; goto out; } sp--; STORE_OPND(-1, STRING_TO_JSVAL(str)); } else { VALUE_TO_NUMBER(cx, lval, d); VALUE_TO_NUMBER(cx, rval, d2); d += d2; sp--; STORE_NUMBER(cx, -1, d); } } END_CASE(JSOP_ADD) #define BINARY_OP(OP) \ JS_BEGIN_MACRO \ FETCH_NUMBER(cx, -1, d2); \ FETCH_NUMBER(cx, -2, d); \ d = d OP d2; \ sp--; \ STORE_NUMBER(cx, -1, d); \ JS_END_MACRO BEGIN_CASE(JSOP_SUB) BINARY_OP(-); END_CASE(JSOP_SUB) BEGIN_CASE(JSOP_MUL) BINARY_OP(*); END_CASE(JSOP_MUL) BEGIN_CASE(JSOP_DIV) FETCH_NUMBER(cx, -1, d2); FETCH_NUMBER(cx, -2, d); sp--; if (d2 == 0) { #ifdef XP_WIN /* XXX MSVC miscompiles such that (NaN == 0) */ if (JSDOUBLE_IS_NaN(d2)) rval = DOUBLE_TO_JSVAL(rt->jsNaN); else #endif if (d == 0 || JSDOUBLE_IS_NaN(d)) rval = DOUBLE_TO_JSVAL(rt->jsNaN); else if ((JSDOUBLE_HI32(d) ^ JSDOUBLE_HI32(d2)) >> 31) rval = DOUBLE_TO_JSVAL(rt->jsNegativeInfinity); else rval = DOUBLE_TO_JSVAL(rt->jsPositiveInfinity); STORE_OPND(-1, rval); } else { d /= d2; STORE_NUMBER(cx, -1, d); } END_CASE(JSOP_DIV) BEGIN_CASE(JSOP_MOD) FETCH_NUMBER(cx, -1, d2); FETCH_NUMBER(cx, -2, d); sp--; if (d2 == 0) { STORE_OPND(-1, DOUBLE_TO_JSVAL(rt->jsNaN)); } else { #ifdef XP_WIN /* Workaround MS fmod bug where 42 % (1/0) => NaN, not 42. */ if (!(JSDOUBLE_IS_FINITE(d) && JSDOUBLE_IS_INFINITE(d2))) #endif d = fmod(d, d2); STORE_NUMBER(cx, -1, d); } END_CASE(JSOP_MOD) BEGIN_CASE(JSOP_NOT) POP_BOOLEAN(cx, rval, cond); PUSH_OPND(BOOLEAN_TO_JSVAL(!cond)); END_CASE(JSOP_NOT) BEGIN_CASE(JSOP_BITNOT) FETCH_INT(cx, -1, i); i = ~i; STORE_INT(cx, -1, i); END_CASE(JSOP_BITNOT) BEGIN_CASE(JSOP_NEG) /* * Optimize the case of an int-tagged operand by noting that * INT_FITS_IN_JSVAL(i) => INT_FITS_IN_JSVAL(-i) unless i is 0 * when -i is the negative zero which is jsdouble. */ rval = FETCH_OPND(-1); if (JSVAL_IS_INT(rval) && (i = JSVAL_TO_INT(rval)) != 0) { i = -i; JS_ASSERT(INT_FITS_IN_JSVAL(i)); rval = INT_TO_JSVAL(i); } else { if (JSVAL_IS_DOUBLE(rval)) { d = *JSVAL_TO_DOUBLE(rval); } else { SAVE_SP_AND_PC(fp); ok = js_ValueToNumber(cx, rval, &d); if (!ok) goto out; } #ifdef HPUX /* * Negation of a zero doesn't produce a negative * zero on HPUX. Perform the operation by bit * twiddling. */ JSDOUBLE_HI32(d) ^= JSDOUBLE_HI32_SIGNBIT; #else d = -d; #endif ok = js_NewNumberValue(cx, d, &rval); if (!ok) goto out; } STORE_OPND(-1, rval); END_CASE(JSOP_NEG) BEGIN_CASE(JSOP_POS) rval = FETCH_OPND(-1); if (!JSVAL_IS_NUMBER(rval)) { SAVE_SP_AND_PC(fp); ok = js_ValueToNumber(cx, rval, &d); if (!ok) goto out; ok = js_NewNumberValue(cx, d, &rval); if (!ok) goto out; sp[-1] = rval; } sp[-1-depth] = (jsval)pc; END_CASE(JSOP_POS) BEGIN_CASE(JSOP_NEW) /* Get immediate argc and find the constructor function. */ argc = GET_ARGC(pc); do_new: SAVE_SP_AND_PC(fp); vp = sp - (2 + argc); JS_ASSERT(vp >= fp->spbase); ok = js_InvokeConstructor(cx, vp, argc); if (!ok) goto out; RESTORE_SP(fp); LOAD_BRANCH_CALLBACK(cx); LOAD_INTERRUPT_HANDLER(rt); obj = JSVAL_TO_OBJECT(*vp); len = js_CodeSpec[op].length; DO_NEXT_OP(len); BEGIN_CASE(JSOP_DELNAME) atom = GET_ATOM(cx, script, pc); id = ATOM_TO_JSID(atom); SAVE_SP_AND_PC(fp); ok = js_FindProperty(cx, id, &obj, &obj2, &prop); if (!ok) goto out; /* ECMA says to return true if name is undefined or inherited. */ rval = JSVAL_TRUE; if (prop) { OBJ_DROP_PROPERTY(cx, obj2, prop); ok = OBJ_DELETE_PROPERTY(cx, obj, id, &rval); if (!ok) goto out; } PUSH_OPND(rval); END_CASE(JSOP_DELNAME) BEGIN_CASE(JSOP_DELPROP) atom = GET_ATOM(cx, script, pc); id = ATOM_TO_JSID(atom); PROPERTY_OP(-1, ok = OBJ_DELETE_PROPERTY(cx, obj, id, &rval)); STORE_OPND(-1, rval); END_CASE(JSOP_DELPROP) BEGIN_CASE(JSOP_DELELEM) ELEMENT_OP(-1, ok = OBJ_DELETE_PROPERTY(cx, obj, id, &rval)); sp--; STORE_OPND(-1, rval); END_CASE(JSOP_DELELEM) BEGIN_CASE(JSOP_TYPEOFEXPR) BEGIN_CASE(JSOP_TYPEOF) rval = FETCH_OPND(-1); SAVE_SP_AND_PC(fp); type = JS_TypeOfValue(cx, rval); atom = rt->atomState.typeAtoms[type]; STORE_OPND(-1, ATOM_KEY(atom)); END_CASE(JSOP_TYPEOF) BEGIN_CASE(JSOP_VOID) (void) POP_OPND(); PUSH_OPND(JSVAL_VOID); END_CASE(JSOP_VOID) BEGIN_CASE(JSOP_INCNAME) BEGIN_CASE(JSOP_DECNAME) BEGIN_CASE(JSOP_NAMEINC) BEGIN_CASE(JSOP_NAMEDEC) atom = GET_ATOM(cx, script, pc); id = ATOM_TO_JSID(atom); SAVE_SP_AND_PC(fp); ok = js_FindProperty(cx, id, &obj, &obj2, &prop); if (!ok) goto out; if (!prop) goto atom_not_defined; OBJ_DROP_PROPERTY(cx, obj2, prop); lval = OBJECT_TO_JSVAL(obj); i = 0; goto do_incop; BEGIN_CASE(JSOP_INCPROP) BEGIN_CASE(JSOP_DECPROP) BEGIN_CASE(JSOP_PROPINC) BEGIN_CASE(JSOP_PROPDEC) atom = GET_ATOM(cx, script, pc); id = ATOM_TO_JSID(atom); lval = FETCH_OPND(-1); i = -1; goto do_incop; BEGIN_CASE(JSOP_INCELEM) BEGIN_CASE(JSOP_DECELEM) BEGIN_CASE(JSOP_ELEMINC) BEGIN_CASE(JSOP_ELEMDEC) FETCH_ELEMENT_ID(-1, id); lval = FETCH_OPND(-2); i = -2; do_incop: { const JSCodeSpec *cs; VALUE_TO_OBJECT(cx, lval, obj); if (i < 0) STORE_OPND(i, OBJECT_TO_JSVAL(obj)); CHECK_ELEMENT_ID(obj, id); /* The operand must contain a number. */ SAVE_SP_AND_PC(fp); CACHED_GET(OBJ_GET_PROPERTY(cx, obj, id, &rval)); if (!ok) goto out; /* Preload for use in the if/else immediately below. */ cs = &js_CodeSpec[op]; /* The expression result goes in rtmp, the updated value in rval. */ if (JSVAL_IS_INT(rval) && rval != INT_TO_JSVAL(JSVAL_INT_MIN) && rval != INT_TO_JSVAL(JSVAL_INT_MAX)) { if (cs->format & JOF_POST) { rtmp = rval; (cs->format & JOF_INC) ? (rval += 2) : (rval -= 2); } else { (cs->format & JOF_INC) ? (rval += 2) : (rval -= 2); rtmp = rval; } } else { /* * Initially, rval contains the value to increment or decrement, which is not * yet converted. As above, the expression result goes in rtmp, the updated * value goes in rval. Our caller must set vp to point at a GC-rooted jsval * in which we home rtmp, to protect it from GC in case the unconverted rval * is not a number. */ #define NONINT_INCREMENT_OP_MIDDLE() \ JS_BEGIN_MACRO \ VALUE_TO_NUMBER(cx, rval, d);