diff options
Diffstat (limited to 'js/src/vm/EnvironmentObject.h')
| -rw-r--r-- | js/src/vm/EnvironmentObject.h | 1565 |
1 files changed, 1565 insertions, 0 deletions
diff --git a/js/src/vm/EnvironmentObject.h b/js/src/vm/EnvironmentObject.h new file mode 100644 index 0000000000..fd60128e1f --- /dev/null +++ b/js/src/vm/EnvironmentObject.h @@ -0,0 +1,1565 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- + * vim: set ts=8 sts=2 et sw=2 tw=80: + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#ifndef vm_EnvironmentObject_h +#define vm_EnvironmentObject_h + +#include <type_traits> + +#include "frontend/NameAnalysisTypes.h" +#include "gc/Barrier.h" +#include "gc/WeakMap.h" +#include "js/GCHashTable.h" +#include "vm/ArgumentsObject.h" +#include "vm/GlobalObject.h" +#include "vm/JSObject.h" +#include "vm/ProxyObject.h" +#include "vm/Scope.h" +#include "vm/ScopeKind.h" // ScopeKind + +namespace js { + +class AbstractGeneratorObject; +class IndirectBindingMap; +class ModuleObject; + +/* + * Return a shape representing the static scope containing the variable + * accessed by the ALIASEDVAR op at 'pc'. + */ +extern SharedShape* EnvironmentCoordinateToEnvironmentShape(JSScript* script, + jsbytecode* pc); + +// Return the name being accessed by the given ALIASEDVAR op. This function is +// relatively slow so it should not be used on hot paths. +extern PropertyName* EnvironmentCoordinateNameSlow(JSScript* script, + jsbytecode* pc); + +/*** Environment objects ****************************************************/ + +// clang-format off +/* + * [SMDOC] Environment Objects + * + * About environments + * ------------------ + * + * See also: https://tc39.es/ecma262/#sec-environment-records + * + * Scoping in ES is specified in terms of "Environment Records". There's a + * global Environment Record per realm, and a new Environment Record is created + * whenever control enters a function, block, or other scope. + * + * A "Lexical Environment" is a list of nested Environment Records, innermost + * first: everything that's in scope. Throughout SpiderMonkey, "environment" + * means a Lexical Environment. + * + * N.B.: "Scope" means something different: a static scope, the compile-time + * analogue of an environment. See Scope.h. + * + * How SpiderMonkey represents environments + * ---------------------------------------- + * + * Some environments are stored as JSObjects. Several kinds of objects + * represent environments: + * + * JSObject + * | + * +--NativeObject + * | | + * | +--EnvironmentObject Engine-internal environment + * | | | + * | | +--CallObject Environment of entire function + * | | | + * | | +--VarEnvironmentObject See VarScope in Scope.h. + * | | | + * | | +--ModuleEnvironmentObject + * | | | Module top-level environment + * | | | + * | | +--WasmInstanceEnvironmentObject + * | | | + * | | +--WasmFunctionCallObject + * | | | + * | | +--LexicalEnvironmentObject + * | | | | + * | | | +--ScopedLexicalEnvironmentObject + * | | | | | Non-extensible lexical environment + * | | | | | + * | | | | +--BlockLexicalEnvironmentObject + * | | | | | | Blocks and such: syntactic, + * | | | | | | non-extensible + * | | | | | | + * | | | | | +--NamedLambdaObject + * | | | | | Environment for `(function f(){...})` + * | | | | | containing only a binding for `f` + * | | | | | + * | | | | +--ClassBodyLexicalEnvironmentObject + * | | | | Environment for class body, containing + * | | | | private names, private brands, and + * | | | | static initializers list + * | | | | + * | | | +--ExtensibleLexicalEnvironmentObject + * | | | | + * | | | +--GlobalLexicalEnvironmentObject + * | | | | Top-level let/const/class in scripts + * | | | | + * | | | +--NonSyntacticLexicalEnvironmentObject + * | | | See "Non-syntactic environments" below + * | | | + * | | +--NonSyntacticVariablesObject + * | | | See "Non-syntactic environments" below + * | | | + * | | +--WithEnvironmentObject Presents object properties as bindings + * | | | + * | | +--RuntimeLexicalErrorObject + * | | Special value represents uninitialized + * | | lexical slots + * | | + * | +--GlobalObject The global environment (dynamically + * | presents its properties as bindings) + * +--ProxyObject + * | + * +--DebugEnvironmentProxy Environment for debugger eval-in-frame + * + * EnvironmentObjects are technically real JSObjects but only belong on the + * environment chain (that is, fp->environmentChain() or fun->environment()). + * They are never exposed to scripts. + * + * Note that reserved slots in any base classes shown above are fixed for all + * derived classes. So e.g. EnvironmentObject::enclosingEnvironment() can + * simply access a fixed slot without further dynamic type information. + * + * When the current environment is represented by an object, the stack frame + * has a pointer to that object (see AbstractFramePtr::environmentChain()). + * However, that isn't always the case. Where possible, we store binding values + * in JS stack slots. For block and function scopes where all bindings can be + * stored in stack slots, nothing is allocated in the heap; there is no + * environment object. + * + * Full information about the environment chain is always recoverable: + * EnvironmentIter can do it, and we construct a fake environment for debugger + * eval-in-frame (see "Debug environment objects" below). + * + * Syntactic Environments + * ---------------------- + * + * Environments may be syntactic, i.e., corresponding to source text, or + * non-syntactic, i.e., specially created by embedding. The distinction is + * necessary to maintain invariants about the environment chain: non-syntactic + * environments may not occur in arbitrary positions in the chain. + * + * CallObject, ModuleEnvironmentObject, BlockLexicalEnvironmentObject, and + * GlobalLexicalEnvironmentObject always represent syntactic + * environments. (CallObject is considered syntactic even when it's used as the + * scope of strict eval code.) WithEnvironmentObject is syntactic when it's + * used to represent the scope of a `with` block. + * + * + * Non-syntactic Environments + * -------------------------- + * + * A non-syntactic environment is one that was not created due to JS source + * code. On the scope chain, a single NonSyntactic GlobalScope maps to 0+ + * non-syntactic environment objects. This is contrasted with syntactic + * environments, where each scope corresponds to 0 or 1 environment object. + * + * There are 3 kinds of dynamic environment objects: + * + * 1. WithEnvironmentObject + * + * When the embedding compiles or executes a script, it has the option to + * pass in a vector of objects to be used as the initial env chain, ordered + * from outermost env to innermost env. Each of those objects is wrapped by + * a WithEnvironmentObject. + * + * The innermost object passed in by the embedding becomes a qualified + * variables object that captures 'var' bindings. That is, it wraps the + * holder object of 'var' bindings. + * + * Does not hold 'let' or 'const' bindings. + * + * 2. NonSyntacticVariablesObject + * + * When the embedding wants qualified 'var' bindings and unqualified + * bareword assignments to go on a different object than the global + * object. While any object can be made into a qualified variables object, + * only the GlobalObject and NonSyntacticVariablesObject are considered + * unqualified variables objects. + * + * Unlike WithEnvironmentObjects that delegate to the object they wrap, + * this object is itself the holder of 'var' bindings. + * + * Does not hold 'let' or 'const' bindings. + * + * 3. NonSyntacticLexicalEnvironmentObject + * + * Each non-syntactic object used as a qualified variables object needs to + * enclose a non-syntactic lexical environment to hold 'let' and 'const' + * bindings. There is a bijection per realm between the non-syntactic + * variables objects and their non-syntactic LexicalEnvironmentObjects. + * + * Does not hold 'var' bindings. + * + * The embedding (Gecko) and debugger uses non-syntactic envs for various + * things, all of which are detailed below. All env chain listings below are, + * from top to bottom, outermost to innermost. + * + * A. JSM loading + * + * Most JSMs are loaded into a shared system global in order to save the memory + * consumption and avoid CCWs. To support this, a NonSyntacticVariablesObject + * is used for each JSM to provide a basic form of isolation. + * NonSyntacticLexicalEnvironmentObject and + * NonSyntacticVariablesObject are allocated for each JSM, and + * NonSyntacticLexicalEnvironmentObject holds lexical variables and + * NonSyntacticVariablesObject holds qualified variables. JSMs cannot have + * unqualified names, but if unqualified names are used by subscript, they + * goes to NonSyntacticVariablesObject (see B.3 and B.4). + * They have the following env chain: + * + * BackstagePass global + * | + * GlobalLexicalEnvironmentObject[this=global] + * | + * NonSyntacticVariablesObject (qualified 'var's (and unqualified names)) + * | + * NonSyntacticLexicalEnvironmentObject[this=nsvo] (lexical vars) + * + * B.1 Subscript loading into a target object + * + * Subscripts may be loaded into a target object and it's associated global. + * NonSyntacticLexicalEnvironmentObject holds lexical variables and + * WithEnvironmentObject holds qualified variables. Unqualified names goes + * to the target object's global. + * They have the following env chain: + * + * Target object's global (unqualified names) + * | + * GlobalLexicalEnvironmentObject[this=global] + * | + * WithEnvironmentObject wrapping target (qualified 'var's) + * | + * NonSyntacticLexicalEnvironmentObject[this=target] (lexical vars) + * + * B.2 Subscript loading into global this + * + * Subscript may be loaded into global this. In this case no extra environment + * object is created. + * + * global (qualified 'var's and unqualified names) + * | + * GlobalLexicalEnvironmentObject[this=global] (lexical vars) + * + * B.3 Subscript loading into a target object in JSM + * + * The target object of a subscript load may be in a JSM, in which case we will + * also have the NonSyntacticVariablesObject on the chain. + * NonSyntacticLexicalEnvironmentObject for target object holds lexical + * variables and WithEnvironmentObject holds qualified variables. + * Unqualified names goes to NonSyntacticVariablesObject. + * + * BackstagePass global + * | + * GlobalLexicalEnvironmentObject[this=global] + * | + * NonSyntacticVariablesObject (unqualified names) + * | + * NonSyntacticLexicalEnvironmentObject[this=nsvo] + * | + * WithEnvironmentObject wrapping target (qualified 'var's) + * | + * NonSyntacticLexicalEnvironmentObject[this=target] (lexical vars) + * + * B.4 Subscript loading into per-JSM this + * + * Subscript may be loaded into global this. In this case no extra environment + * object is created. + * + * BackstagePass global + * | + * GlobalLexicalEnvironmentObject[this=global] + * | + * NonSyntacticVariablesObject (qualified 'var's and unqualified names) + * | + * NonSyntacticLexicalEnvironmentObject[this=nsvo] (lexical vars) + * + * C.1. Frame scripts with unique scope + * + * XUL frame scripts with unique scope are loaded in the same global as + * JSMs, with a NonSyntacticVariablesObject as a "polluting global" for + * both qualified 'var' variables and unqualified names, and a with + * environment wrapping a message manager object, and + * NonSyntacticLexicalEnvironmentObject holding the message manager as `this`, + * that holds lexical variables. + * These environment objects except for globals are created for each run and + * not shared across multiple runs. This is done exclusively in + * js::ExecuteInFrameScriptEnvironment. + * + * BackstagePass global + * | + * GlobalLexicalEnvironmentObject[this=global] + * | + * NonSyntacticVariablesObject (qualified 'var's and unqualified names) + * | + * WithEnvironmentObject wrapping messageManager + * | + * NonSyntacticLexicalEnvironmentObject[this=messageManager] (lexical vars) + * + * C.2. Frame scripts without unique scope + * + * XUL frame scripts without unique scope are loaded in the same global as + * JSMs, with a with environment wrapping a message manager object for + * qualified 'var' variables, and NonSyntacticLexicalEnvironmentObject holding + * the message manager as `this`, that holds lexical variables. + * The environment chain is associated with the message manager object + * and cached for subsequent runs. + * + * BackstagePass global (unqualified names) + * | + * GlobalLexicalEnvironmentObject[this=global] + * | + * WithEnvironmentObject wrapping messageManager (qualified 'var's) + * | + * NonSyntacticLexicalEnvironmentObject[this=messageManager] (lexical vars) + * + * D.1. DOM event handlers without direct eval + * + * DOM event handlers are compiled as functions with HTML elements on the + * environment chain. For a chain of elements e0, e1, ..., eN, where innerrmost + * element is the target element, enclosing elements are such as forms, and the + * outermost one is the document. + * If the DOM event handlers don't have direct eval, the function's scopes are + * optimized and frame slots are used for qualified 'var's and lexical vars. + * NonSyntacticLexicalEnvironmentObject's `this` value is not used, given + * the function's `this` value is used instead: + * + * global (unqualified names) + * | + * GlobalLexicalEnvironmentObject[this=global] + * | + * WithEnvironmentObject wrapping eN + * | + * ... + * | + * WithEnvironmentObject wrapping e1 + * | + * WithEnvironmentObject wrapping e0 + * | + * NonSyntacticLexicalEnvironmentObject [this=*unused*] + * + * D.2. DOM event handlers with direct eval + * + * If DOM event handlers have direct eval, the function's scopes are allocated + * as environment object: + * + * global (unqualified names) + * | + * GlobalLexicalEnvironmentObject[this=global] + * | + * ... + * | + * WithEnvironmentObject wrapping e1 + * | + * WithEnvironmentObject wrapping e0 + * | + * NonSyntacticLexicalEnvironmentObject [this=*unused*] + * | + * CallObject (qualified 'var's) + * | + * BlockLexicalEnvironmentObject (lexical vars) + * + * E.1. Debugger.Frame.prototype.evalWithBindings + * + * Debugger.Frame.prototype.evalWithBindings uses WithEnvironmentObject for + * given bindings, and the frame's enclosing scope. + * + * If qualified 'var's or unqualified names conflict with the bindings object's + * properties, they go to the WithEnvironmentObject. + * + * If the frame is function, it has the following env chain. + * lexical variables are optimized and uses frame slots, regardless of the name + * conflicts with bindings: + * + * global (unqualified names) + * | + * [DebugProxy] GlobalLexicalEnvironmentObject[this=global] + * | + * [DebugProxy] CallObject (qualified 'var's) + * | + * WithEnvironmentObject wrapping bindings (conflicting 'var's and names) + * + * If the script has direct eval, BlockLexicalEnvironmentObject is created for + * it: + * + * global (unqualified names) + * | + * [DebugProxy] GlobalLexicalEnvironmentObject[this=global] + * | + * [DebugProxy] CallObject (qualified 'var's) + * | + * WithEnvironmentObject wrapping bindings (conflicting 'var's and names) + * | + * BlockLexicalEnvironmentObject (lexical vars, and conflicting lexical vars) + * + * NOTE: Debugger.Frame.prototype.eval uses the frame's enclosing scope only, + * and it doesn't use any dynamic environment, but still uses + * non-syntactic scope to perform `eval` operation. + * + * E.2. Debugger.Object.prototype.executeInGlobalWithBindings + * + * Debugger.Object.prototype.executeInGlobalWithBindings uses + * WithEnvironmentObject for given bindings, and the object's global scope. + * + * If `options.useInnerBindings` is not true, if bindings conflict with + * qualified 'var's or global lexicals, those bindings are shadowed and not + * stored into the bindings object wrapped by WithEnvironmentObject. + * + * global (qualified 'var's and unqualified names) + * | + * GlobalLexicalEnvironmentObject[this=global] (lexical vars) + * | + * WithEnvironmentObject wrapping object with not-conflicting bindings + * + * If `options.useInnerBindings` is true, all bindings are stored into the + * bindings object wrapped by WithEnvironmentObject, and they shadow globals + * + * global (qualified 'var's and unqualified names) + * | + * GlobalLexicalEnvironmentObject[this=global] (lexical vars) + * | + * WithEnvironmentObject wrapping object with all bindings + * + * NOTE: If `options.useInnerBindings` is true, and if lexical variable names + * conflict with the bindings object's properties, the write on them + * within declarations is done for the GlobalLexicalEnvironmentObject, + * but the write within assignments and the read on lexicals are done + * from the WithEnvironmentObject (bug 1841964 and bug 1847219). + * + * // bindings = { x: 10, y: 20 }; + * + * let x = 11; // written to GlobalLexicalEnvironmentObject + * x; // read from WithEnvironmentObject + * let y; + * y = 21; // written to WithEnvironmentObject + * y; // read from WithEnvironmentObject + * + * NOTE: Debugger.Object.prototype.executeInGlobal uses the object's global + * scope only, and it doesn't use any dynamic environment or + * non-syntactic scope. + * NOTE: If no extra bindings are used by script, + * Debugger.Object.prototype.executeInGlobalWithBindings uses the object's + * global scope only, and it doesn't use any dynamic environment or + * non-syntactic scope. + * + */ +// clang-format on + +class EnvironmentObject : public NativeObject { + protected: + // The enclosing environment. Either another EnvironmentObject, a + // GlobalObject, or a non-syntactic environment object. + static const uint32_t ENCLOSING_ENV_SLOT = 0; + + inline void setAliasedBinding(uint32_t slot, const Value& v); + + public: + // Since every env chain terminates with a global object, whether + // GlobalObject or a non-syntactic one, and since those objects do not + // derive EnvironmentObject (they have completely different layouts), the + // enclosing environment of an EnvironmentObject is necessarily non-null. + JSObject& enclosingEnvironment() const { + return getReservedSlot(ENCLOSING_ENV_SLOT).toObject(); + } + + void initEnclosingEnvironment(JSObject* enclosing) { + initReservedSlot(ENCLOSING_ENV_SLOT, ObjectOrNullValue(enclosing)); + } + + static bool nonExtensibleIsFixedSlot(EnvironmentCoordinate ec) { + // For non-extensible environment objects isFixedSlot(slot) is equivalent to + // slot < MAX_FIXED_SLOTS. + return ec.slot() < MAX_FIXED_SLOTS; + } + static size_t nonExtensibleDynamicSlotIndex(EnvironmentCoordinate ec) { + MOZ_ASSERT(!nonExtensibleIsFixedSlot(ec)); + return ec.slot() - MAX_FIXED_SLOTS; + } + + // Get or set a name contained in this environment. + inline const Value& aliasedBinding(EnvironmentCoordinate ec); + + const Value& aliasedBinding(const BindingIter& bi) { + MOZ_ASSERT(bi.location().kind() == BindingLocation::Kind::Environment); + return getSlot(bi.location().slot()); + } + + inline void setAliasedBinding(EnvironmentCoordinate ec, const Value& v); + + inline void setAliasedBinding(const BindingIter& bi, const Value& v); + + // For JITs. + static size_t offsetOfEnclosingEnvironment() { + return getFixedSlotOffset(ENCLOSING_ENV_SLOT); + } + + static uint32_t enclosingEnvironmentSlot() { return ENCLOSING_ENV_SLOT; } + + const char* typeString() const; + +#if defined(DEBUG) || defined(JS_JITSPEW) + void dump(); +#endif /* defined(DEBUG) || defined(JS_JITSPEW) */ +}; + +class CallObject : public EnvironmentObject { + protected: + static constexpr uint32_t CALLEE_SLOT = 1; + + static CallObject* create(JSContext* cx, HandleScript script, + HandleObject enclosing, gc::Heap heap); + + public: + static const JSClass class_; + + static constexpr uint32_t RESERVED_SLOTS = 2; + static constexpr ObjectFlags OBJECT_FLAGS = {ObjectFlag::QualifiedVarObj}; + + /* These functions are internal and are exposed only for JITs. */ + + /* + * Construct a bare-bones call object given a shape. + * The call object must be further initialized to be usable. + */ + static CallObject* createWithShape(JSContext* cx, Handle<SharedShape*> shape); + + static CallObject* createTemplateObject(JSContext* cx, HandleScript script, + HandleObject enclosing); + + static CallObject* create(JSContext* cx, AbstractFramePtr frame); + + static CallObject* createHollowForDebug(JSContext* cx, HandleFunction callee); + + // If `env` or any enclosing environment is a CallObject, return that + // CallObject; else null. + // + // `env` may be a DebugEnvironmentProxy, but not a hollow environment. + static CallObject* find(JSObject* env); + + /* + * When an aliased formal (var accessed by nested closures) is also + * aliased by the arguments object, it must of course exist in one + * canonical location and that location is always the CallObject. For this + * to work, the ArgumentsObject stores special MagicValue in its array for + * forwarded-to-CallObject variables. This MagicValue's payload is the + * slot of the CallObject to access. + */ + const Value& aliasedFormalFromArguments(const Value& argsValue) { + return getSlot(ArgumentsObject::SlotFromMagicScopeSlotValue(argsValue)); + } + inline void setAliasedFormalFromArguments(const Value& argsValue, + const Value& v); + + JSFunction& callee() const { + return getReservedSlot(CALLEE_SLOT).toObject().as<JSFunction>(); + } + + /* For jit access. */ + static size_t offsetOfCallee() { return getFixedSlotOffset(CALLEE_SLOT); } + + static size_t calleeSlot() { return CALLEE_SLOT; } +}; + +class VarEnvironmentObject : public EnvironmentObject { + static constexpr uint32_t SCOPE_SLOT = 1; + + static VarEnvironmentObject* createInternal(JSContext* cx, + Handle<SharedShape*> shape, + HandleObject enclosing, + gc::Heap heap); + + static VarEnvironmentObject* create(JSContext* cx, Handle<Scope*> scope, + HandleObject enclosing, gc::Heap heap); + + void initScope(Scope* scope) { + initReservedSlot(SCOPE_SLOT, PrivateGCThingValue(scope)); + } + + public: + static const JSClass class_; + + static constexpr uint32_t RESERVED_SLOTS = 2; + static constexpr ObjectFlags OBJECT_FLAGS = {ObjectFlag::QualifiedVarObj}; + + static VarEnvironmentObject* createForFrame(JSContext* cx, + Handle<Scope*> scope, + AbstractFramePtr frame); + static VarEnvironmentObject* createHollowForDebug(JSContext* cx, + Handle<Scope*> scope); + static VarEnvironmentObject* createTemplateObject(JSContext* cx, + Handle<VarScope*> scope); + static VarEnvironmentObject* createWithoutEnclosing(JSContext* cx, + Handle<VarScope*> scope); + + Scope& scope() const { + Value v = getReservedSlot(SCOPE_SLOT); + MOZ_ASSERT(v.isPrivateGCThing()); + Scope& s = *static_cast<Scope*>(v.toGCThing()); + MOZ_ASSERT(s.is<VarScope>() || s.is<EvalScope>()); + return s; + } + + bool isForEval() const { return scope().is<EvalScope>(); } + bool isForNonStrictEval() const { return scope().kind() == ScopeKind::Eval; } +}; + +class ModuleEnvironmentObject : public EnvironmentObject { + static constexpr uint32_t MODULE_SLOT = 1; + + static const ObjectOps objectOps_; + static const JSClassOps classOps_; + + public: + static const JSClass class_; + + static constexpr uint32_t RESERVED_SLOTS = 2; + static constexpr ObjectFlags OBJECT_FLAGS = {ObjectFlag::NotExtensible, + ObjectFlag::QualifiedVarObj}; + + static ModuleEnvironmentObject* create(JSContext* cx, + Handle<ModuleObject*> module); + ModuleObject& module() const; + IndirectBindingMap& importBindings() const; + + bool createImportBinding(JSContext* cx, Handle<JSAtom*> importName, + Handle<ModuleObject*> module, + Handle<JSAtom*> exportName); + + bool hasImportBinding(Handle<PropertyName*> name); + + bool lookupImport(jsid name, ModuleEnvironmentObject** envOut, + mozilla::Maybe<PropertyInfo>* propOut); + + // If `env` or any enclosing environment is a ModuleEnvironmentObject, + // return that ModuleEnvironmentObject; else null. + // + // `env` may be a DebugEnvironmentProxy, but not a hollow environment. + static ModuleEnvironmentObject* find(JSObject* env); + + private: + static bool lookupProperty(JSContext* cx, HandleObject obj, HandleId id, + MutableHandleObject objp, PropertyResult* propp); + static bool hasProperty(JSContext* cx, HandleObject obj, HandleId id, + bool* foundp); + static bool getProperty(JSContext* cx, HandleObject obj, HandleValue receiver, + HandleId id, MutableHandleValue vp); + static bool setProperty(JSContext* cx, HandleObject obj, HandleId id, + HandleValue v, HandleValue receiver, + JS::ObjectOpResult& result); + static bool getOwnPropertyDescriptor( + JSContext* cx, HandleObject obj, HandleId id, + MutableHandle<mozilla::Maybe<PropertyDescriptor>> desc); + static bool deleteProperty(JSContext* cx, HandleObject obj, HandleId id, + ObjectOpResult& result); + static bool newEnumerate(JSContext* cx, HandleObject obj, + MutableHandleIdVector properties, + bool enumerableOnly); +}; + +class WasmInstanceEnvironmentObject : public EnvironmentObject { + // Currently WasmInstanceScopes do not use their scopes in a + // meaningful way. However, it is an invariant of DebugEnvironments that + // environments kept in those maps have live scopes, thus this strong + // reference. + static constexpr uint32_t SCOPE_SLOT = 1; + + public: + static const JSClass class_; + + static constexpr uint32_t RESERVED_SLOTS = 2; + static constexpr ObjectFlags OBJECT_FLAGS = {ObjectFlag::NotExtensible}; + + static WasmInstanceEnvironmentObject* createHollowForDebug( + JSContext* cx, Handle<WasmInstanceScope*> scope); + WasmInstanceScope& scope() const { + Value v = getReservedSlot(SCOPE_SLOT); + MOZ_ASSERT(v.isPrivateGCThing()); + return *static_cast<WasmInstanceScope*>(v.toGCThing()); + } +}; + +class WasmFunctionCallObject : public EnvironmentObject { + // Currently WasmFunctionCallObjects do not use their scopes in a + // meaningful way. However, it is an invariant of DebugEnvironments that + // environments kept in those maps have live scopes, thus this strong + // reference. + static constexpr uint32_t SCOPE_SLOT = 1; + + public: + static const JSClass class_; + + // TODO Check what Debugger behavior should be when it evaluates a + // var declaration. + static constexpr uint32_t RESERVED_SLOTS = 2; + static constexpr ObjectFlags OBJECT_FLAGS = {ObjectFlag::NotExtensible}; + + static WasmFunctionCallObject* createHollowForDebug( + JSContext* cx, HandleObject enclosing, Handle<WasmFunctionScope*> scope); + WasmFunctionScope& scope() const { + Value v = getReservedSlot(SCOPE_SLOT); + MOZ_ASSERT(v.isPrivateGCThing()); + return *static_cast<WasmFunctionScope*>(v.toGCThing()); + } +}; + +// Abstract base class for environments that can contain let/const bindings, +// plus a few other kinds of environments, such as `catch` blocks, that have +// similar behavior. +class LexicalEnvironmentObject : public EnvironmentObject { + protected: + // Global and non-syntactic lexical environments need to store a 'this' + // object and all other lexical environments have a fixed shape and store a + // backpointer to the LexicalScope. + // + // Since the two sets are disjoint, we only use one slot to save space. + static constexpr uint32_t THIS_VALUE_OR_SCOPE_SLOT = 1; + + public: + static const JSClass class_; + + static constexpr uint32_t RESERVED_SLOTS = 2; + + protected: + static LexicalEnvironmentObject* create(JSContext* cx, + Handle<SharedShape*> shape, + HandleObject enclosing, + gc::Heap heap); + + public: + // Is this the global lexical scope? + bool isGlobal() const { return enclosingEnvironment().is<GlobalObject>(); } + + // Global and non-syntactic lexical scopes are extensible. All other + // lexical scopes are not. + bool isExtensible() const; + + // Is this a syntactic (i.e. corresponds to a source text) lexical + // environment? + bool isSyntactic() const { return !isExtensible() || isGlobal(); } +}; + +// A non-extensible lexical environment. +// +// Used for blocks (ScopeKind::Lexical) and several other scope kinds, +// including Catch, NamedLambda, FunctionLexical, and ClassBody. +class ScopedLexicalEnvironmentObject : public LexicalEnvironmentObject { + public: + static constexpr ObjectFlags OBJECT_FLAGS = {ObjectFlag::NotExtensible}; + + Scope& scope() const { + Value v = getReservedSlot(THIS_VALUE_OR_SCOPE_SLOT); + MOZ_ASSERT(!isExtensible() && v.isPrivateGCThing()); + return *static_cast<Scope*>(v.toGCThing()); + } + + bool isClassBody() const { return scope().kind() == ScopeKind::ClassBody; } + + void initScope(Scope* scope) { + initReservedSlot(THIS_VALUE_OR_SCOPE_SLOT, PrivateGCThingValue(scope)); + } +}; + +class BlockLexicalEnvironmentObject : public ScopedLexicalEnvironmentObject { + protected: + static BlockLexicalEnvironmentObject* create(JSContext* cx, + Handle<LexicalScope*> scope, + HandleObject enclosing, + gc::Heap heap); + + public: + static constexpr ObjectFlags OBJECT_FLAGS = {ObjectFlag::NotExtensible}; + + static BlockLexicalEnvironmentObject* createForFrame( + JSContext* cx, Handle<LexicalScope*> scope, AbstractFramePtr frame); + + static BlockLexicalEnvironmentObject* createHollowForDebug( + JSContext* cx, Handle<LexicalScope*> scope); + + static BlockLexicalEnvironmentObject* createTemplateObject( + JSContext* cx, Handle<LexicalScope*> scope); + + static BlockLexicalEnvironmentObject* createWithoutEnclosing( + JSContext* cx, Handle<LexicalScope*> scope); + + // Create a new BlockLexicalEnvironmentObject with the same enclosing env and + // variable values as this. + static BlockLexicalEnvironmentObject* clone( + JSContext* cx, Handle<BlockLexicalEnvironmentObject*> env); + + // Create a new BlockLexicalEnvironmentObject with the same enclosing env as + // this, with all variables uninitialized. + static BlockLexicalEnvironmentObject* recreate( + JSContext* cx, Handle<BlockLexicalEnvironmentObject*> env); + + // The LexicalScope that created this environment. + LexicalScope& scope() const { + return ScopedLexicalEnvironmentObject::scope().as<LexicalScope>(); + } +}; + +class NamedLambdaObject : public BlockLexicalEnvironmentObject { + static NamedLambdaObject* create(JSContext* cx, HandleFunction callee, + HandleObject enclosing, gc::Heap heap); + + public: + static NamedLambdaObject* createTemplateObject(JSContext* cx, + HandleFunction callee); + + static NamedLambdaObject* createWithoutEnclosing(JSContext* cx, + HandleFunction callee); + + static NamedLambdaObject* create(JSContext* cx, AbstractFramePtr frame); + + // For JITs. + static size_t lambdaSlot(); + + static size_t offsetOfLambdaSlot() { + return getFixedSlotOffset(lambdaSlot()); + } +}; + +class ClassBodyLexicalEnvironmentObject + : public ScopedLexicalEnvironmentObject { + static ClassBodyLexicalEnvironmentObject* create( + JSContext* cx, Handle<ClassBodyScope*> scope, HandleObject enclosing, + gc::Heap heap); + + public: + static ClassBodyLexicalEnvironmentObject* createForFrame( + JSContext* cx, Handle<ClassBodyScope*> scope, AbstractFramePtr frame); + + static ClassBodyLexicalEnvironmentObject* createTemplateObject( + JSContext* cx, Handle<ClassBodyScope*> scope); + + static ClassBodyLexicalEnvironmentObject* createWithoutEnclosing( + JSContext* cx, Handle<ClassBodyScope*> scope); + + // The ClassBodyScope that created this environment. + ClassBodyScope& scope() const { + return ScopedLexicalEnvironmentObject::scope().as<ClassBodyScope>(); + } + + static uint32_t privateBrandSlot() { return JSSLOT_FREE(&class_); } +}; + +// Global and non-syntactic lexical environments are extensible. +class ExtensibleLexicalEnvironmentObject : public LexicalEnvironmentObject { + public: + JSObject* thisObject() const; + + // For a given global object or JSMEnvironment `obj`, return the associated + // global lexical or non-syntactic lexical environment, where top-level `let` + // bindings are added. + static ExtensibleLexicalEnvironmentObject* forVarEnvironment(JSObject* obj); + + protected: + void initThisObject(JSObject* obj) { + MOZ_ASSERT(isGlobal() || !isSyntactic()); + JSObject* thisObj = GetThisObject(obj); + initReservedSlot(THIS_VALUE_OR_SCOPE_SLOT, ObjectValue(*thisObj)); + } +}; + +// The global lexical environment, where global let/const/class bindings are +// added. +class GlobalLexicalEnvironmentObject + : public ExtensibleLexicalEnvironmentObject { + public: + static GlobalLexicalEnvironmentObject* create(JSContext* cx, + Handle<GlobalObject*> global); + + GlobalObject& global() const { + return enclosingEnvironment().as<GlobalObject>(); + } + + void setWindowProxyThisObject(JSObject* obj); + + static constexpr size_t offsetOfThisValueSlot() { + return getFixedSlotOffset(THIS_VALUE_OR_SCOPE_SLOT); + } +}; + +// Non-standard. See "Non-syntactic Environments" above. +class NonSyntacticLexicalEnvironmentObject + : public ExtensibleLexicalEnvironmentObject { + public: + static NonSyntacticLexicalEnvironmentObject* create(JSContext* cx, + HandleObject enclosing, + HandleObject thisv); +}; + +// A non-syntactic dynamic scope object that captures non-lexical +// bindings. That is, a scope object that captures both qualified var +// assignments and unqualified bareword assignments. Its parent is always the +// global lexical environment. +// +// See the long "Non-syntactic Environments" comment above. +class NonSyntacticVariablesObject : public EnvironmentObject { + public: + static const JSClass class_; + + static constexpr uint32_t RESERVED_SLOTS = 1; + static constexpr ObjectFlags OBJECT_FLAGS = {}; + + static NonSyntacticVariablesObject* create(JSContext* cx); +}; + +extern bool CreateNonSyntacticEnvironmentChain(JSContext* cx, + JS::HandleObjectVector envChain, + MutableHandleObject env); + +// With environment objects on the run-time environment chain. +class WithEnvironmentObject : public EnvironmentObject { + static constexpr uint32_t OBJECT_SLOT = 1; + static constexpr uint32_t THIS_SLOT = 2; + static constexpr uint32_t SCOPE_SLOT = 3; + + public: + static const JSClass class_; + + static constexpr uint32_t RESERVED_SLOTS = 4; + static constexpr ObjectFlags OBJECT_FLAGS = {}; + + static WithEnvironmentObject* create(JSContext* cx, HandleObject object, + HandleObject enclosing, + Handle<WithScope*> scope); + static WithEnvironmentObject* createNonSyntactic(JSContext* cx, + HandleObject object, + HandleObject enclosing); + + /* Return the 'o' in 'with (o)'. */ + JSObject& object() const; + + /* Return object for GetThisValue. */ + JSObject* withThis() const; + + /* + * Return whether this object is a syntactic with object. If not, this is + * a With object we inserted between the outermost syntactic scope and the + * global object to wrap the environment chain someone explicitly passed + * via JSAPI to CompileFunction or script evaluation. + */ + bool isSyntactic() const; + + // For syntactic with environment objects, the with scope. + WithScope& scope() const; + + static inline size_t objectSlot() { return OBJECT_SLOT; } + + static inline size_t thisSlot() { return THIS_SLOT; } +}; + +// Internal scope object used by JSOp::BindName upon encountering an +// uninitialized lexical slot or an assignment to a 'const' binding. +// +// ES6 lexical bindings cannot be accessed in any way (throwing +// ReferenceErrors) until initialized. Normally, NAME operations +// unconditionally check for uninitialized lexical slots. When getting or +// looking up names, this can be done without slowing down normal operations +// on the return value. When setting names, however, we do not want to pollute +// all set-property paths with uninitialized lexical checks. For setting names +// (i.e. JSOp::SetName), we emit an accompanying, preceding JSOp::BindName which +// finds the right scope on which to set the name. Moreover, when the name on +// the scope is an uninitialized lexical, we cannot throw eagerly, as the spec +// demands that the error be thrown after evaluating the RHS of +// assignments. Instead, this sentinel scope object is pushed on the stack. +// Attempting to access anything on this scope throws the appropriate +// ReferenceError. +// +// ES6 'const' bindings induce a runtime error when assigned to outside +// of initialization, regardless of strictness. +class RuntimeLexicalErrorObject : public EnvironmentObject { + static const unsigned ERROR_SLOT = 1; + + public: + static const unsigned RESERVED_SLOTS = 2; + static const JSClass class_; + + static RuntimeLexicalErrorObject* create(JSContext* cx, + HandleObject enclosing, + unsigned errorNumber); + + unsigned errorNumber() { return getReservedSlot(ERROR_SLOT).toInt32(); } +}; + +/****************************************************************************/ + +// A environment iterator describes the active environments starting from an +// environment, scope pair. This pair may be derived from the current point of +// execution in a frame. If derived in such a fashion, the EnvironmentIter +// tracks whether the current scope is within the extent of this initial +// frame. Here, "frame" means a single activation of: a function, eval, or +// global code. +class MOZ_RAII EnvironmentIter { + Rooted<ScopeIter> si_; + RootedObject env_; + AbstractFramePtr frame_; + + void incrementScopeIter(); + void settle(); + + // No value semantics. + EnvironmentIter(const EnvironmentIter& ei) = delete; + + public: + // Constructing from a copy of an existing EnvironmentIter. + EnvironmentIter(JSContext* cx, const EnvironmentIter& ei); + + // Constructing from an environment, scope pair. All environments + // considered not to be withinInitialFrame, since no frame is given. + EnvironmentIter(JSContext* cx, JSObject* env, Scope* scope); + + // Constructing from a frame. Places the EnvironmentIter on the innermost + // environment at pc. + EnvironmentIter(JSContext* cx, AbstractFramePtr frame, const jsbytecode* pc); + + // Constructing from an environment, scope and frame. The frame is given + // to initialize to proper enclosing environment/scope. + EnvironmentIter(JSContext* cx, JSObject* env, Scope* scope, + AbstractFramePtr frame); + + bool done() const { return si_.done(); } + + explicit operator bool() const { return !done(); } + + void operator++(int) { + if (hasAnyEnvironmentObject()) { + env_ = &env_->as<EnvironmentObject>().enclosingEnvironment(); + } + incrementScopeIter(); + settle(); + } + + EnvironmentIter& operator++() { + operator++(1); + return *this; + } + + // If done(): + JSObject& enclosingEnvironment() const; + + // If !done(): + bool hasNonSyntacticEnvironmentObject() const; + + bool hasSyntacticEnvironment() const { return si_.hasSyntacticEnvironment(); } + + bool hasAnyEnvironmentObject() const { + return hasNonSyntacticEnvironmentObject() || hasSyntacticEnvironment(); + } + + EnvironmentObject& environment() const { + MOZ_ASSERT(hasAnyEnvironmentObject()); + return env_->as<EnvironmentObject>(); + } + + Scope& scope() const { return *si_.scope(); } + + Scope* maybeScope() const { + if (si_) { + return si_.scope(); + } + return nullptr; + } + + JSFunction& callee() const { return env_->as<CallObject>().callee(); } + + bool withinInitialFrame() const { return !!frame_; } + + AbstractFramePtr initialFrame() const { + MOZ_ASSERT(withinInitialFrame()); + return frame_; + } + + AbstractFramePtr maybeInitialFrame() const { return frame_; } +}; + +// The key in MissingEnvironmentMap. For live frames, maps live frames to +// their synthesized environments. For completely optimized-out environments, +// maps the Scope to their synthesized environments. The env we synthesize for +// Scopes are read-only, and we never use their parent links, so they don't +// need to be distinct. +// +// That is, completely optimized out environments can't be distinguished by +// frame. Note that even if the frame corresponding to the Scope is live on +// the stack, it is unsound to synthesize an environment from that live +// frame. In other words, the provenance of the environment chain is from +// allocated closures (i.e., allocation sites) and is irrecoverable from +// simple stack inspection (i.e., call sites). +class MissingEnvironmentKey { + friend class LiveEnvironmentVal; + + AbstractFramePtr frame_; + Scope* scope_; + + public: + explicit MissingEnvironmentKey(const EnvironmentIter& ei) + : frame_(ei.maybeInitialFrame()), scope_(ei.maybeScope()) {} + + MissingEnvironmentKey(AbstractFramePtr frame, Scope* scope) + : frame_(frame), scope_(scope) {} + + AbstractFramePtr frame() const { return frame_; } + Scope* scope() const { return scope_; } + + void updateScope(Scope* scope) { scope_ = scope; } + void updateFrame(AbstractFramePtr frame) { frame_ = frame; } + + // For use as hash policy. + using Lookup = MissingEnvironmentKey; + static HashNumber hash(MissingEnvironmentKey sk); + static bool match(MissingEnvironmentKey sk1, MissingEnvironmentKey sk2); + bool operator!=(const MissingEnvironmentKey& other) const { + return frame_ != other.frame_ || scope_ != other.scope_; + } + static void rekey(MissingEnvironmentKey& k, + const MissingEnvironmentKey& newKey) { + k = newKey; + } +}; + +// The value in LiveEnvironmentMap, mapped from by live environment objects. +class LiveEnvironmentVal { + friend class DebugEnvironments; + friend class MissingEnvironmentKey; + + AbstractFramePtr frame_; + HeapPtr<Scope*> scope_; + + static void staticAsserts(); + + public: + explicit LiveEnvironmentVal(const EnvironmentIter& ei) + : frame_(ei.initialFrame()), scope_(ei.maybeScope()) {} + + AbstractFramePtr frame() const { return frame_; } + + void updateFrame(AbstractFramePtr frame) { frame_ = frame; } + + bool traceWeak(JSTracer* trc); +}; + +/****************************************************************************/ + +/* + * [SMDOC] Debug environment objects + * + * The frontend optimizes unaliased variables into stack slots and can optimize + * away whole EnvironmentObjects. So when the debugger wants to perform an + * unexpected eval-in-frame (or otherwise access the environment), + * `fp->environmentChain` is often incomplete. This is a problem: a major use + * case for eval-in-frame is to access the local variables in debuggee code. + * + * Even when all EnvironmentObjects exist, giving complete information for all + * bindings, stack and heap, there's another issue: eval-in-frame code can + * create closures that capture stack locals. The variable slots go away when + * the frame is popped, but the closure, which uses them, may survive. + * + * To solve both problems, eval-in-frame code is compiled and run against a + * "debug environment chain" of DebugEnvironmentProxy objects rather than real + * EnvironmentObjects. The `GetDebugEnvironmentFor` functions below create + * these proxies, one to sit in front of each existing EnvironmentObject. They + * also create bogus "hollow" EnvironmentObjects to stand in for environments + * that were optimized away; and proxies for those. The frontend sees these + * environments as something like `with` scopes, and emits deoptimized bytecode + * instructions for all variable accesses. + * + * When eval-in-frame code runs, `fp->environmentChain` points to this chain of + * proxies. On each variable access, the proxy laboriously figures out what to + * do. See e.g. `DebuggerEnvironmentProxyHandler::handleUnaliasedAccess`. + * + * There's a limit to what the proxies can manage, since they're proxying + * environments that are already optimized. Some debugger operations, like + * redefining a lexical binding, can fail when a true direct eval would + * succeed. Even plain variable accesses can throw, if the variable has been + * optimized away. + * + * To support accessing stack variables after they've gone out of scope, we + * copy the variables to the heap as they leave scope. See + * `DebugEnvironments::onPopCall` and `onPopLexical`. + * + * `GetDebugEnvironmentFor*` guarantees that the same DebugEnvironmentProxy is + * always produced for the same underlying environment (optimized or not!). + * This is maintained by some bookkeeping information stored in + * `DebugEnvironments`. + */ + +extern JSObject* GetDebugEnvironmentForFunction(JSContext* cx, + HandleFunction fun); + +extern JSObject* GetDebugEnvironmentForSuspendedGenerator( + JSContext* cx, JSScript* script, AbstractGeneratorObject& genObj); + +extern JSObject* GetDebugEnvironmentForFrame(JSContext* cx, + AbstractFramePtr frame, + jsbytecode* pc); + +extern JSObject* GetDebugEnvironmentForGlobalLexicalEnvironment(JSContext* cx); +extern Scope* GetEnvironmentScope(const JSObject& env); + +/* Provides debugger access to a environment. */ +class DebugEnvironmentProxy : public ProxyObject { + /* + * The enclosing environment on the dynamic environment chain. This slot is + * analogous to the ENCLOSING_ENV_SLOT of a EnvironmentObject. + */ + static const unsigned ENCLOSING_SLOT = 0; + + /* + * NullValue or a dense array holding the unaliased variables of a function + * frame that has been popped. + */ + static const unsigned SNAPSHOT_SLOT = 1; + + public: + static DebugEnvironmentProxy* create(JSContext* cx, EnvironmentObject& env, + HandleObject enclosing); + + // NOTE: The environment may be a debug hollow with invalid + // enclosingEnvironment. Always use the enclosingEnvironment accessor on + // the DebugEnvironmentProxy in order to walk the environment chain. + EnvironmentObject& environment() const; + JSObject& enclosingEnvironment() const; + + // May only be called for proxies to function call objects or modules + // with top-level-await. + ArrayObject* maybeSnapshot() const; + void initSnapshot(ArrayObject& snapshot); + + // Currently, the 'declarative' environments are function, module, and + // lexical environments. + bool isForDeclarative() const; + + // Get a property by 'id', but returns sentinel values instead of throwing + // on exceptional cases. + static bool getMaybeSentinelValue(JSContext* cx, + Handle<DebugEnvironmentProxy*> env, + HandleId id, MutableHandleValue vp); + + // Returns true iff this is a function environment with its own this-binding + // (all functions except arrow functions). + bool isFunctionEnvironmentWithThis(); + + // Does this debug environment not have a real counterpart or was never + // live (and thus does not have a synthesized EnvironmentObject or a + // snapshot)? + bool isOptimizedOut() const; + +#if defined(DEBUG) || defined(JS_JITSPEW) + void dump(); +#endif /* defined(DEBUG) || defined(JS_JITSPEW) */ +}; + +/* Maintains per-realm debug environment bookkeeping information. */ +class DebugEnvironments { + Zone* zone_; + + /* The map from (non-debug) environments to debug environments. */ + ObjectWeakMap proxiedEnvs; + + /* + * The map from live frames which have optimized-away environments to the + * corresponding debug environments. + */ + typedef HashMap<MissingEnvironmentKey, WeakHeapPtr<DebugEnvironmentProxy*>, + MissingEnvironmentKey, ZoneAllocPolicy> + MissingEnvironmentMap; + MissingEnvironmentMap missingEnvs; + + /* + * The map from environment objects of live frames to the live frame. This + * map updated lazily whenever the debugger needs the information. In + * between two lazy updates, liveEnvs becomes incomplete (but not invalid, + * onPop* removes environments as they are popped). Thus, two consecutive + * debugger lazy updates of liveEnvs need only fill in the new + * environments. + */ + typedef GCHashMap<WeakHeapPtr<JSObject*>, LiveEnvironmentVal, + StableCellHasher<WeakHeapPtr<JSObject*>>, ZoneAllocPolicy> + LiveEnvironmentMap; + LiveEnvironmentMap liveEnvs; + + public: + DebugEnvironments(JSContext* cx, Zone* zone); + ~DebugEnvironments(); + + Zone* zone() const { return zone_; } + + private: + static DebugEnvironments* ensureRealmData(JSContext* cx); + + template <typename Environment, typename Scope> + static void onPopGeneric(JSContext* cx, const EnvironmentIter& ei); + + public: + void trace(JSTracer* trc); + void traceWeak(JSTracer* trc); + void finish(); +#ifdef JS_GC_ZEAL + void checkHashTablesAfterMovingGC(); +#endif + + // If a live frame has a synthesized entry in missingEnvs, make sure it's not + // collected. + void traceLiveFrame(JSTracer* trc, AbstractFramePtr frame); + + static DebugEnvironmentProxy* hasDebugEnvironment(JSContext* cx, + EnvironmentObject& env); + static bool addDebugEnvironment(JSContext* cx, Handle<EnvironmentObject*> env, + Handle<DebugEnvironmentProxy*> debugEnv); + + static DebugEnvironmentProxy* hasDebugEnvironment(JSContext* cx, + const EnvironmentIter& ei); + static bool addDebugEnvironment(JSContext* cx, const EnvironmentIter& ei, + Handle<DebugEnvironmentProxy*> debugEnv); + + static bool updateLiveEnvironments(JSContext* cx); + static LiveEnvironmentVal* hasLiveEnvironment(EnvironmentObject& env); + static void unsetPrevUpToDateUntil(JSContext* cx, AbstractFramePtr frame); + + // When a frame bails out from Ion to Baseline, there might be missing + // envs keyed on, and live envs containing, the old + // RematerializedFrame. Forward those values to the new BaselineFrame. + static void forwardLiveFrame(JSContext* cx, AbstractFramePtr from, + AbstractFramePtr to); + + // When an environment is popped, we store a snapshot of its bindings that + // live on the frame. + // + // This is done during frame unwinding, which cannot handle errors + // gracefully. Errors result in no snapshot being set on the + // DebugEnvironmentProxy. + static void takeFrameSnapshot(JSContext* cx, + Handle<DebugEnvironmentProxy*> debugEnv, + AbstractFramePtr frame); + + // In debug-mode, these must be called whenever exiting a scope that might + // have stack-allocated locals. + static void onPopCall(JSContext* cx, AbstractFramePtr frame); + static void onPopVar(JSContext* cx, const EnvironmentIter& ei); + static void onPopLexical(JSContext* cx, const EnvironmentIter& ei); + static void onPopLexical(JSContext* cx, AbstractFramePtr frame, + const jsbytecode* pc); + static void onPopWith(AbstractFramePtr frame); + static void onPopModule(JSContext* cx, const EnvironmentIter& ei); + static void onRealmUnsetIsDebuggee(Realm* realm); +}; + +} /* namespace js */ + +template <> +inline bool JSObject::is<js::EnvironmentObject>() const { + return is<js::CallObject>() || is<js::VarEnvironmentObject>() || + is<js::ModuleEnvironmentObject>() || + is<js::WasmInstanceEnvironmentObject>() || + is<js::WasmFunctionCallObject>() || + is<js::LexicalEnvironmentObject>() || + is<js::WithEnvironmentObject>() || + is<js::NonSyntacticVariablesObject>() || + is<js::RuntimeLexicalErrorObject>(); +} + +template <> +inline bool JSObject::is<js::ScopedLexicalEnvironmentObject>() const { + return is<js::LexicalEnvironmentObject>() && + !as<js::LexicalEnvironmentObject>().isExtensible(); +} + +template <> +inline bool JSObject::is<js::BlockLexicalEnvironmentObject>() const { + return is<js::ScopedLexicalEnvironmentObject>() && + !as<js::ScopedLexicalEnvironmentObject>().isClassBody(); +} + +template <> +inline bool JSObject::is<js::ClassBodyLexicalEnvironmentObject>() const { + return is<js::ScopedLexicalEnvironmentObject>() && + as<js::ScopedLexicalEnvironmentObject>().isClassBody(); +} + +template <> +inline bool JSObject::is<js::ExtensibleLexicalEnvironmentObject>() const { + return is<js::LexicalEnvironmentObject>() && + as<js::LexicalEnvironmentObject>().isExtensible(); +} + +template <> +inline bool JSObject::is<js::GlobalLexicalEnvironmentObject>() const { + return is<js::LexicalEnvironmentObject>() && + as<js::LexicalEnvironmentObject>().isGlobal(); +} + +template <> +inline bool JSObject::is<js::NonSyntacticLexicalEnvironmentObject>() const { + return is<js::LexicalEnvironmentObject>() && + !as<js::LexicalEnvironmentObject>().isSyntactic(); +} + +template <> +inline bool JSObject::is<js::NamedLambdaObject>() const { + return is<js::BlockLexicalEnvironmentObject>() && + as<js::BlockLexicalEnvironmentObject>().scope().isNamedLambda(); +} + +template <> +bool JSObject::is<js::DebugEnvironmentProxy>() const; + +namespace js { + +inline bool IsSyntacticEnvironment(JSObject* env) { + if (!env->is<EnvironmentObject>()) { + return false; + } + + if (env->is<WithEnvironmentObject>()) { + return env->as<WithEnvironmentObject>().isSyntactic(); + } + + if (env->is<LexicalEnvironmentObject>()) { + return env->as<LexicalEnvironmentObject>().isSyntactic(); + } + + if (env->is<NonSyntacticVariablesObject>()) { + return false; + } + + return true; +} + +inline bool IsExtensibleLexicalEnvironment(JSObject* env) { + return env->is<ExtensibleLexicalEnvironmentObject>(); +} + +inline bool IsGlobalLexicalEnvironment(JSObject* env) { + return env->is<GlobalLexicalEnvironmentObject>(); +} + +inline bool IsNSVOLexicalEnvironment(JSObject* env) { + return env->is<LexicalEnvironmentObject>() && + env->as<LexicalEnvironmentObject>() + .enclosingEnvironment() + .is<NonSyntacticVariablesObject>(); +} + +inline JSObject* MaybeUnwrapWithEnvironment(JSObject* env) { + if (env->is<WithEnvironmentObject>()) { + return &env->as<WithEnvironmentObject>().object(); + } + return env; +} + +template <typename SpecificEnvironment> +inline bool IsFrameInitialEnvironment(AbstractFramePtr frame, + SpecificEnvironment& env) { + // A frame's initial environment is the innermost environment + // corresponding to the scope chain from frame.script()->bodyScope() to + // frame.script()->outermostScope(). This environment must be on the chain + // for the frame to be considered initialized. That is, it must be on the + // chain for the environment chain to fully match the scope chain at the + // start of execution in the frame. + // + // This logic must be in sync with the HAS_INITIAL_ENV logic in + // BaselineStackBuilder::buildBaselineFrame. + + // A function frame's CallObject, if present, is always the initial + // environment. + if constexpr (std::is_same_v<SpecificEnvironment, CallObject>) { + return true; + } + + // For an eval frame, the VarEnvironmentObject, if present, is always the + // initial environment. + if constexpr (std::is_same_v<SpecificEnvironment, VarEnvironmentObject>) { + if (frame.isEvalFrame()) { + return true; + } + } + + // For named lambda frames without CallObjects (i.e., no binding in the + // body of the function was closed over), the NamedLambdaObject + // corresponding to the named lambda scope is the initial environment. + if constexpr (std::is_same_v<SpecificEnvironment, NamedLambdaObject>) { + if (frame.isFunctionFrame() && + frame.callee()->needsNamedLambdaEnvironment() && + !frame.callee()->needsCallObject()) { + LexicalScope* namedLambdaScope = frame.script()->maybeNamedLambdaScope(); + return &env.scope() == namedLambdaScope; + } + } + + return false; +} + +extern bool CreateObjectsForEnvironmentChain(JSContext* cx, + HandleObjectVector chain, + HandleObject terminatingEnv, + MutableHandleObject envObj); + +ModuleObject* GetModuleObjectForScript(JSScript* script); + +ModuleEnvironmentObject* GetModuleEnvironmentForScript(JSScript* script); + +[[nodiscard]] bool GetThisValueForDebuggerFrameMaybeOptimizedOut( + JSContext* cx, AbstractFramePtr frame, const jsbytecode* pc, + MutableHandleValue res); +[[nodiscard]] bool GetThisValueForDebuggerSuspendedGeneratorMaybeOptimizedOut( + JSContext* cx, AbstractGeneratorObject& genObj, JSScript* script, + MutableHandleValue res); + +[[nodiscard]] bool CheckCanDeclareGlobalBinding(JSContext* cx, + Handle<GlobalObject*> global, + Handle<PropertyName*> name, + bool isFunction); + +[[nodiscard]] bool CheckLexicalNameConflict( + JSContext* cx, Handle<ExtensibleLexicalEnvironmentObject*> lexicalEnv, + HandleObject varObj, Handle<PropertyName*> name); + +[[nodiscard]] bool CheckGlobalDeclarationConflicts( + JSContext* cx, HandleScript script, + Handle<ExtensibleLexicalEnvironmentObject*> lexicalEnv, + HandleObject varObj); + +[[nodiscard]] bool GlobalOrEvalDeclInstantiation(JSContext* cx, + HandleObject envChain, + HandleScript script, + GCThingIndex lastFun); + +[[nodiscard]] bool InitFunctionEnvironmentObjects(JSContext* cx, + AbstractFramePtr frame); + +[[nodiscard]] bool PushVarEnvironmentObject(JSContext* cx, Handle<Scope*> scope, + AbstractFramePtr frame); + +[[nodiscard]] bool GetFrameEnvironmentAndScope(JSContext* cx, + AbstractFramePtr frame, + const jsbytecode* pc, + MutableHandleObject env, + MutableHandle<Scope*> scope); + +void GetSuspendedGeneratorEnvironmentAndScope(AbstractGeneratorObject& genObj, + JSScript* script, + MutableHandleObject env, + MutableHandle<Scope*> scope); + +#ifdef DEBUG +bool AnalyzeEntrainedVariables(JSContext* cx, HandleScript script); +#endif + +extern JSObject* MaybeOptimizeBindGlobalName(JSContext* cx, + Handle<GlobalObject*> global, + Handle<PropertyName*> name); +} // namespace js + +#endif /* vm_EnvironmentObject_h */ |