diff options
Diffstat (limited to 'js/src/vm')
46 files changed, 2273 insertions, 394 deletions
diff --git a/js/src/vm/ArrayBufferObject.cpp b/js/src/vm/ArrayBufferObject.cpp index 2fe4f01f8d..14039af574 100644 --- a/js/src/vm/ArrayBufferObject.cpp +++ b/js/src/vm/ArrayBufferObject.cpp @@ -2830,7 +2830,7 @@ bool InnerViewTable::addView(JSContext* cx, ArrayBufferObject* buffer, if (isNurseryView && !hadNurseryViews && nurseryKeysValid) { #ifdef DEBUG if (nurseryKeys.length() < 100) { - for (auto* key : nurseryKeys) { + for (const auto& key : nurseryKeys) { MOZ_ASSERT(key != buffer); } } @@ -2859,31 +2859,53 @@ void InnerViewTable::removeViews(ArrayBufferObject* buffer) { map.remove(ptr); } -bool InnerViewTable::traceWeak(JSTracer* trc) { return map.traceWeak(trc); } +bool InnerViewTable::traceWeak(JSTracer* trc) { + nurseryKeys.traceWeak(trc); + map.traceWeak(trc); + return true; +} void InnerViewTable::sweepAfterMinorGC(JSTracer* trc) { MOZ_ASSERT(needsSweepAfterMinorGC()); - if (nurseryKeysValid) { - for (size_t i = 0; i < nurseryKeys.length(); i++) { - ArrayBufferObject* buffer = nurseryKeys[i]; + NurseryKeysVector keys; + bool valid = true; + std::swap(nurseryKeys, keys); + std::swap(nurseryKeysValid, valid); + + // Use nursery keys vector if possible. + if (valid) { + for (ArrayBufferObject* buffer : keys) { MOZ_ASSERT(!gc::IsInsideNursery(buffer)); auto ptr = map.lookup(buffer); - if (ptr && !ptr->value().sweepAfterMinorGC(trc)) { + if (ptr && !sweepViewsAfterMinorGC(trc, buffer, ptr->value())) { map.remove(ptr); } } - } else { - for (ArrayBufferViewMap::Enum e(map); !e.empty(); e.popFront()) { - MOZ_ASSERT(!gc::IsInsideNursery(e.front().key())); - if (!e.front().value().sweepAfterMinorGC(trc)) { - e.removeFront(); - } + return; + } + + // Otherwise look at every map entry. + for (ArrayBufferViewMap::Enum e(map); !e.empty(); e.popFront()) { + MOZ_ASSERT(!gc::IsInsideNursery(e.front().key())); + if (!sweepViewsAfterMinorGC(trc, e.front().key(), e.front().value())) { + e.removeFront(); } } +} + +bool InnerViewTable::sweepViewsAfterMinorGC(JSTracer* trc, + ArrayBufferObject* buffer, + Views& views) { + if (!views.sweepAfterMinorGC(trc)) { + return false; // No more views. + } - nurseryKeys.clear(); - nurseryKeysValid = true; + if (views.hasNurseryViews() && !nurseryKeys.append(buffer)) { + nurseryKeysValid = false; + } + + return true; } size_t InnerViewTable::sizeOfExcludingThis(mozilla::MallocSizeOf mallocSizeOf) { diff --git a/js/src/vm/ArrayBufferObject.h b/js/src/vm/ArrayBufferObject.h index 5aa96bf887..ce78b26cb2 100644 --- a/js/src/vm/ArrayBufferObject.h +++ b/js/src/vm/ArrayBufferObject.h @@ -760,16 +760,20 @@ class InnerViewTable { StableCellHasher<JSObject*>, ZoneAllocPolicy>; ArrayBufferViewMap map; - // List of keys from innerViews where either the source or at least one - // target is in the nursery. The raw pointer to a JSObject is allowed here - // because this vector is cleared after every minor collection. Users in - // sweepAfterMinorCollection must be careful to use MaybeForwarded before - // touching these pointers. - Vector<ArrayBufferObject*, 0, SystemAllocPolicy> nurseryKeys; + // List of keys from map where either the source or at least one target is in + // the nursery. The raw pointer to a JSObject is allowed here because this + // vector is cleared after every minor collection. Users in sweepAfterMinorGC + // must be careful to use MaybeForwarded before touching these pointers. + using NurseryKeysVector = + GCVector<UnsafeBarePtr<ArrayBufferObject*>, 0, SystemAllocPolicy>; + NurseryKeysVector nurseryKeys; // Whether nurseryKeys is a complete list. bool nurseryKeysValid = true; + bool sweepMapEntryAfterMinorGC(UnsafeBarePtr<JSObject*>& buffer, + ViewVector& views); + public: explicit InnerViewTable(Zone* zone) : map(zone) {} @@ -793,6 +797,9 @@ class InnerViewTable { ArrayBufferViewObject* view); ViewVector* maybeViewsUnbarriered(ArrayBufferObject* buffer); void removeViews(ArrayBufferObject* buffer); + + bool sweepViewsAfterMinorGC(JSTracer* trc, ArrayBufferObject* buffer, + Views& views); }; template <typename Wrapper> diff --git a/js/src/vm/ArrayBufferViewObject.cpp b/js/src/vm/ArrayBufferViewObject.cpp index 27004f3e2a..37272a94af 100644 --- a/js/src/vm/ArrayBufferViewObject.cpp +++ b/js/src/vm/ArrayBufferViewObject.cpp @@ -221,7 +221,6 @@ void ArrayBufferViewObject::computeResizableLengthAndByteOffset( size_t bytesPerElement) { MOZ_ASSERT(!isSharedMemory()); MOZ_ASSERT(hasBuffer()); - MOZ_ASSERT(!bufferUnshared()->isLengthPinned()); MOZ_ASSERT(bufferUnshared()->isResizable()); size_t byteOffsetStart = initialByteOffset(); diff --git a/js/src/vm/AsyncFunction.cpp b/js/src/vm/AsyncFunction.cpp index ce523fe409..f6ed33c738 100644 --- a/js/src/vm/AsyncFunction.cpp +++ b/js/src/vm/AsyncFunction.cpp @@ -151,7 +151,7 @@ static bool AsyncFunctionResume(JSContext* cx, if (!CallSelfHostedFunction(cx, funName, generatorOrValue, args, &generatorOrValue)) { if (!generator->isClosed()) { - generator->setClosed(); + generator->setClosed(cx); } // Handle the OOM case mentioned above. diff --git a/js/src/vm/AsyncIteration.cpp b/js/src/vm/AsyncIteration.cpp index 8f8902a64a..33546dc9dd 100644 --- a/js/src/vm/AsyncIteration.cpp +++ b/js/src/vm/AsyncIteration.cpp @@ -1071,7 +1071,7 @@ bool js::AsyncGeneratorThrow(JSContext* cx, unsigned argc, Value* vp) { if (!CallSelfHostedFunction(cx, funName, thisOrRval, args, &thisOrRval)) { // 25.5.3.2, steps 5.f, 5.g. if (!generator->isClosed()) { - generator->setClosed(); + generator->setClosed(cx); } return AsyncGeneratorThrown(cx, generator); } diff --git a/js/src/vm/AtomsTable.h b/js/src/vm/AtomsTable.h index aae7728fe5..28e448ce77 100644 --- a/js/src/vm/AtomsTable.h +++ b/js/src/vm/AtomsTable.h @@ -35,6 +35,82 @@ struct AtomHasher { } }; +struct js::AtomHasher::Lookup { + union { + const JS::Latin1Char* latin1Chars; + const char16_t* twoByteChars; + const char* utf8Bytes; + }; + enum { TwoByteChar, Latin1, UTF8 } type; + size_t length; + size_t byteLength; + const JSAtom* atom; /* Optional. */ + JS::AutoCheckCannotGC nogc; + + HashNumber hash; + + MOZ_ALWAYS_INLINE Lookup(const char* utf8Bytes, size_t byteLen, size_t length, + HashNumber hash) + : utf8Bytes(utf8Bytes), + type(UTF8), + length(length), + byteLength(byteLen), + atom(nullptr), + hash(hash) {} + + MOZ_ALWAYS_INLINE Lookup(const char16_t* chars, size_t length) + : twoByteChars(chars), + type(TwoByteChar), + length(length), + atom(nullptr), + hash(mozilla::HashString(chars, length)) {} + + MOZ_ALWAYS_INLINE Lookup(const JS::Latin1Char* chars, size_t length) + : latin1Chars(chars), + type(Latin1), + length(length), + atom(nullptr), + hash(mozilla::HashString(chars, length)) {} + + MOZ_ALWAYS_INLINE Lookup(HashNumber hash, const char16_t* chars, + size_t length) + : twoByteChars(chars), + type(TwoByteChar), + length(length), + atom(nullptr), + hash(hash) { + MOZ_ASSERT(hash == mozilla::HashString(chars, length)); + } + + MOZ_ALWAYS_INLINE Lookup(HashNumber hash, const JS::Latin1Char* chars, + size_t length) + : latin1Chars(chars), + type(Latin1), + length(length), + atom(nullptr), + hash(hash) { + MOZ_ASSERT(hash == mozilla::HashString(chars, length)); + } + + inline explicit Lookup(const JSAtom* atom) + : type(atom->hasLatin1Chars() ? Latin1 : TwoByteChar), + length(atom->length()), + atom(atom), + hash(atom->hash()) { + if (type == Latin1) { + latin1Chars = atom->latin1Chars(nogc); + MOZ_ASSERT(mozilla::HashString(latin1Chars, length) == hash); + } else { + MOZ_ASSERT(type == TwoByteChar); + twoByteChars = atom->twoByteChars(nogc); + MOZ_ASSERT(mozilla::HashString(twoByteChars, length) == hash); + } + } + + // Return: true iff the string in |atom| matches the string in this Lookup. + bool StringsMatch(const JSAtom& atom) const; +}; + // Note: Use a 'class' here to make forward declarations easier to use. class AtomSet : public JS::GCHashSet<WeakHeapPtr<JSAtom*>, AtomHasher, SystemAllocPolicy> { diff --git a/js/src/vm/BigIntType.h b/js/src/vm/BigIntType.h index fb9f4085e6..8959f93c77 100644 --- a/js/src/vm/BigIntType.h +++ b/js/src/vm/BigIntType.h @@ -419,7 +419,7 @@ class BigInt final : public js::gc::CellWithLengthAndFlags { static JSLinearString* toStringGeneric(JSContext* cx, Handle<BigInt*>, unsigned radix); - friend struct ::JSStructuredCloneReader; // So it can call the following: + friend struct ::JSStructuredCloneReader; // So it can call the following: static BigInt* destructivelyTrimHighZeroDigits(JSContext* cx, BigInt* x); bool absFitsInUint64() const { return digitLength() <= 64 / DigitBits; } diff --git a/js/src/vm/CommonPropertyNames.h b/js/src/vm/CommonPropertyNames.h index d4376ec6a4..5fa3f2b633 100644 --- a/js/src/vm/CommonPropertyNames.h +++ b/js/src/vm/CommonPropertyNames.h @@ -29,6 +29,7 @@ MACRO_(allowContentIter, "allowContentIter") \ MACRO_(allowContentIterWith, "allowContentIterWith") \ MACRO_(allowContentIterWithNext, "allowContentIterWithNext") \ + MACRO_(alphabet, "alphabet") \ MACRO_(ambiguous, "ambiguous") \ MACRO_(anonymous, "anonymous") \ MACRO_(Any, "Any") \ @@ -214,6 +215,8 @@ MACRO_(frame, "frame") \ MACRO_(from, "from") \ MACRO_(fromAsync, "fromAsync") \ + MACRO_(fromBase64, "fromBase64") \ + MACRO_(fromHex, "fromHex") \ MACRO_(fulfilled, "fulfilled") \ MACRO_(GatherAsyncParentCompletions, "GatherAsyncParentCompletions") \ MACRO_(gcCycleNumber, "gcCycleNumber") \ @@ -319,6 +322,7 @@ MACRO_(isoMinute, "isoMinute") \ MACRO_(isoMonth, "isoMonth") \ MACRO_(isoNanosecond, "isoNanosecond") \ + MACRO_(isRawJSON, "isRawJSON") \ MACRO_(isoSecond, "isoSecond") \ MACRO_(isoYear, "isoYear") \ MACRO_(isStepStart, "isStepStart") \ @@ -338,6 +342,7 @@ MACRO_(label, "label") \ MACRO_(language, "language") \ MACRO_(largestUnit, "largestUnit") \ + MACRO_(lastChunkHandling, "lastChunkHandling") \ MACRO_(lastIndex, "lastIndex") \ MACRO_(length, "length") \ MACRO_(let, "let") \ @@ -467,6 +472,8 @@ MACRO_(pull, "pull") \ MACRO_(quarter, "quarter") \ MACRO_(raw, "raw") \ + MACRO_(rawJSON, "rawJSON") \ + MACRO_(read, "read") \ MACRO_(reason, "reason") \ MACRO_(RegExp_String_Iterator_, "RegExp String Iterator") \ MACRO_(RegExp_prototype_Exec, "RegExp_prototype_Exec") \ @@ -503,6 +510,8 @@ MACRO_(SetConstructorInit, "SetConstructorInit") \ MACRO_(SetIsInlinableLargeFunction, "SetIsInlinableLargeFunction") \ MACRO_(Set_Iterator_, "Set Iterator") \ + MACRO_(setFromBase64, "setFromBase64") \ + MACRO_(setFromHex, "setFromHex") \ MACRO_(setPrototypeOf, "setPrototypeOf") \ MACRO_(shape, "shape") \ MACRO_(shared, "shared") \ @@ -540,7 +549,9 @@ MACRO_(timeStyle, "timeStyle") \ MACRO_(timeZone, "timeZone") \ MACRO_(timeZoneName, "timeZoneName") \ + MACRO_(toBase64, "toBase64") \ MACRO_(toGMTString, "toGMTString") \ + MACRO_(toHex, "toHex") \ MACRO_(toISOString, "toISOString") \ MACRO_(toJSON, "toJSON") \ MACRO_(toLocaleString, "toLocaleString") \ @@ -612,6 +623,7 @@ MACRO_(weeks, "weeks") \ MACRO_(while_, "while") \ MACRO_(with, "with") \ + MACRO_(written, "written") \ MACRO_(toReversed, "toReversed") \ MACRO_(toSorted, "toSorted") \ MACRO_(toSpliced, "toSpliced") \ diff --git a/js/src/vm/FrameIter.cpp b/js/src/vm/FrameIter.cpp index 3dd50c2fcf..9a665e6b9d 100644 --- a/js/src/vm/FrameIter.cpp +++ b/js/src/vm/FrameIter.cpp @@ -124,7 +124,12 @@ JS::Realm* JitFrameIter::realm() const { return asWasm().instance()->realm(); } - return asJSJit().script()->realm(); + if (asJSJit().isScripted()) { + return asJSJit().script()->realm(); + } + + MOZ_RELEASE_ASSERT(asJSJit().isTrampolineNative()); + return asJSJit().callee()->realm(); } uint8_t* JitFrameIter::resumePCinCurrentFrame() const { diff --git a/js/src/vm/FunctionFlags.h b/js/src/vm/FunctionFlags.h index d927056230..27d51c214a 100644 --- a/js/src/vm/FunctionFlags.h +++ b/js/src/vm/FunctionFlags.h @@ -116,9 +116,10 @@ class FunctionFlags { // This flag is used only by scripted functions and AsmJS. LAMBDA = 1 << 9, - // The WASM function has a JIT entry which emulates the - // js::BaseScript::jitCodeRaw mechanism. - WASM_JIT_ENTRY = 1 << 10, + // This Native function has a JIT entry which emulates the + // js::BaseScript::jitCodeRaw mechanism. Used for Wasm functions and + // TrampolineNative builtins. + NATIVE_JIT_ENTRY = 1 << 10, // Function had no explicit name, but a name was set by SetFunctionName at // compile time or SetFunctionName at runtime. @@ -238,7 +239,7 @@ class FunctionFlags { switch (kind()) { case FunctionKind::NormalFunction: MOZ_ASSERT(!hasFlags(LAZY_ACCESSOR_NAME)); - MOZ_ASSERT(!hasFlags(WASM_JIT_ENTRY)); + MOZ_ASSERT(!hasFlags(NATIVE_JIT_ENTRY)); break; case FunctionKind::Arrow: @@ -246,38 +247,38 @@ class FunctionFlags { MOZ_ASSERT(!hasFlags(CONSTRUCTOR)); MOZ_ASSERT(!hasFlags(LAZY_ACCESSOR_NAME)); MOZ_ASSERT(hasFlags(LAMBDA)); - MOZ_ASSERT(!hasFlags(WASM_JIT_ENTRY)); + MOZ_ASSERT(!hasFlags(NATIVE_JIT_ENTRY)); break; case FunctionKind::Method: MOZ_ASSERT(hasFlags(BASESCRIPT) || hasFlags(SELFHOSTLAZY)); MOZ_ASSERT(!hasFlags(CONSTRUCTOR)); MOZ_ASSERT(!hasFlags(LAZY_ACCESSOR_NAME)); MOZ_ASSERT(!hasFlags(LAMBDA)); - MOZ_ASSERT(!hasFlags(WASM_JIT_ENTRY)); + MOZ_ASSERT(!hasFlags(NATIVE_JIT_ENTRY)); break; case FunctionKind::ClassConstructor: MOZ_ASSERT(hasFlags(BASESCRIPT) || hasFlags(SELFHOSTLAZY)); MOZ_ASSERT(hasFlags(CONSTRUCTOR)); MOZ_ASSERT(!hasFlags(LAZY_ACCESSOR_NAME)); MOZ_ASSERT(!hasFlags(LAMBDA)); - MOZ_ASSERT(!hasFlags(WASM_JIT_ENTRY)); + MOZ_ASSERT(!hasFlags(NATIVE_JIT_ENTRY)); break; case FunctionKind::Getter: MOZ_ASSERT(!hasFlags(CONSTRUCTOR)); MOZ_ASSERT(!hasFlags(LAMBDA)); - MOZ_ASSERT(!hasFlags(WASM_JIT_ENTRY)); + MOZ_ASSERT(!hasFlags(NATIVE_JIT_ENTRY)); break; case FunctionKind::Setter: MOZ_ASSERT(!hasFlags(CONSTRUCTOR)); MOZ_ASSERT(!hasFlags(LAMBDA)); - MOZ_ASSERT(!hasFlags(WASM_JIT_ENTRY)); + MOZ_ASSERT(!hasFlags(NATIVE_JIT_ENTRY)); break; case FunctionKind::AsmJS: MOZ_ASSERT(!hasFlags(BASESCRIPT)); MOZ_ASSERT(!hasFlags(SELFHOSTLAZY)); MOZ_ASSERT(!hasFlags(LAZY_ACCESSOR_NAME)); - MOZ_ASSERT(!hasFlags(WASM_JIT_ENTRY)); + MOZ_ASSERT(!hasFlags(NATIVE_JIT_ENTRY)); break; case FunctionKind::Wasm: MOZ_ASSERT(!hasFlags(BASESCRIPT)); @@ -316,10 +317,11 @@ class FunctionFlags { MOZ_ASSERT_IF(kind() == Wasm, isNativeFun()); return kind() == Wasm; } - bool isWasmWithJitEntry() const { - MOZ_ASSERT_IF(hasFlags(WASM_JIT_ENTRY), isWasm()); - return hasFlags(WASM_JIT_ENTRY); + bool isNativeWithJitEntry() const { + MOZ_ASSERT_IF(hasFlags(NATIVE_JIT_ENTRY), isNativeFun()); + return hasFlags(NATIVE_JIT_ENTRY); } + bool isWasmWithJitEntry() const { return isWasm() && isNativeWithJitEntry(); } bool isNativeWithoutJitEntry() const { MOZ_ASSERT_IF(!hasJitEntry(), isNativeFun()); return !hasJitEntry(); @@ -328,7 +330,14 @@ class FunctionFlags { return isNativeFun() && !isAsmJSNative() && !isWasm(); } bool hasJitEntry() const { - return hasBaseScript() || hasSelfHostedLazyScript() || isWasmWithJitEntry(); + return hasBaseScript() || hasSelfHostedLazyScript() || + isNativeWithJitEntry(); + } + + bool canHaveJitInfo() const { + // A native builtin can have a pointer to either its JitEntry or JSJitInfo, + // but not both. + return isBuiltinNative() && !isNativeWithJitEntry(); } /* Possible attributes of an interpreted function: */ @@ -417,7 +426,7 @@ class FunctionFlags { return clearFlags(LAZY_ACCESSOR_NAME); } - FunctionFlags& setWasmJitEntry() { return setFlags(WASM_JIT_ENTRY); } + FunctionFlags& setNativeJitEntry() { return setFlags(NATIVE_JIT_ENTRY); } bool isExtended() const { return hasFlags(EXTENDED); } FunctionFlags& setIsExtended() { return setFlags(EXTENDED); } @@ -430,7 +439,7 @@ class FunctionFlags { static uint16_t HasJitEntryFlags(bool isConstructing) { uint16_t flags = BASESCRIPT | SELFHOSTLAZY; if (!isConstructing) { - flags |= WASM_JIT_ENTRY; + flags |= NATIVE_JIT_ENTRY; } return flags; } diff --git a/js/src/vm/GeckoProfiler.cpp b/js/src/vm/GeckoProfiler.cpp index 330bcd1fa6..dbf1eb9081 100644 --- a/js/src/vm/GeckoProfiler.cpp +++ b/js/src/vm/GeckoProfiler.cpp @@ -57,9 +57,15 @@ static jit::JitFrameLayout* GetTopProfilingJitFrame(jit::JitActivation* act) { return nullptr; } + // Skip if the activation has no JS frames. This can happen if there's only a + // TrampolineNative frame because these are skipped by the profiling frame + // iterator. jit::JSJitProfilingFrameIterator jitIter( (jit::CommonFrameLayout*)iter.frame().fp()); - MOZ_ASSERT(!jitIter.done()); + if (jitIter.done()) { + return nullptr; + } + return jitIter.framePtr(); } diff --git a/js/src/vm/GeneratorObject.cpp b/js/src/vm/GeneratorObject.cpp index 4f8d807df5..4a23c4ca9e 100644 --- a/js/src/vm/GeneratorObject.cpp +++ b/js/src/vm/GeneratorObject.cpp @@ -194,10 +194,10 @@ void AbstractGeneratorObject::dump() const { } #endif -void AbstractGeneratorObject::finalSuspend(HandleObject obj) { +void AbstractGeneratorObject::finalSuspend(JSContext* cx, HandleObject obj) { auto* genObj = &obj->as<AbstractGeneratorObject>(); MOZ_ASSERT(genObj->isRunning()); - genObj->setClosed(); + genObj->setClosed(cx); } static AbstractGeneratorObject* GetGeneratorObjectForCall(JSContext* cx, @@ -442,6 +442,16 @@ void AbstractGeneratorObject::setUnaliasedLocal(uint32_t slot, return stackStorage().setDenseElement(slot, value); } +void AbstractGeneratorObject::setClosed(JSContext* cx) { + setFixedSlot(CALLEE_SLOT, NullValue()); + setFixedSlot(ENV_CHAIN_SLOT, NullValue()); + setFixedSlot(ARGS_OBJ_SLOT, NullValue()); + setFixedSlot(STACK_STORAGE_SLOT, NullValue()); + setFixedSlot(RESUME_INDEX_SLOT, NullValue()); + + DebugAPI::onGeneratorClosed(cx, this); +} + bool AbstractGeneratorObject::isAfterYield() { return isAfterYieldOrAwait(JSOp::Yield); } diff --git a/js/src/vm/GeneratorObject.h b/js/src/vm/GeneratorObject.h index ddc11ba781..b952ebd533 100644 --- a/js/src/vm/GeneratorObject.h +++ b/js/src/vm/GeneratorObject.h @@ -57,7 +57,7 @@ class AbstractGeneratorObject : public NativeObject { static bool suspend(JSContext* cx, HandleObject obj, AbstractFramePtr frame, const jsbytecode* pc, unsigned nvalues); - static void finalSuspend(HandleObject obj); + static void finalSuspend(JSContext* cx, HandleObject obj); JSFunction& callee() const { return getFixedSlot(CALLEE_SLOT).toObject().as<JSFunction>(); @@ -149,13 +149,7 @@ class AbstractGeneratorObject : public NativeObject { return getFixedSlot(RESUME_INDEX_SLOT).toInt32(); } bool isClosed() const { return getFixedSlot(CALLEE_SLOT).isNull(); } - void setClosed() { - setFixedSlot(CALLEE_SLOT, NullValue()); - setFixedSlot(ENV_CHAIN_SLOT, NullValue()); - setFixedSlot(ARGS_OBJ_SLOT, NullValue()); - setFixedSlot(STACK_STORAGE_SLOT, NullValue()); - setFixedSlot(RESUME_INDEX_SLOT, NullValue()); - } + void setClosed(JSContext* cx); bool isAfterYield(); bool isAfterAwait(); diff --git a/js/src/vm/GlobalObject.h b/js/src/vm/GlobalObject.h index a296336385..97286fde51 100644 --- a/js/src/vm/GlobalObject.h +++ b/js/src/vm/GlobalObject.h @@ -1056,10 +1056,7 @@ class GlobalObject : public NativeObject { void setSourceURLsHolder(ArrayObject* holder) { data().sourceURLsHolder = holder; } - void clearSourceURLSHolder() { - // This is called at the start of shrinking GCs, so avoids barriers. - data().sourceURLsHolder.unbarrieredSet(nullptr); - } + void clearSourceURLSHolder() { setSourceURLsHolder(nullptr); } SharedShape* maybeArrayShapeWithDefaultProto() const { return data().arrayShapeWithDefaultProto; diff --git a/js/src/vm/Interpreter.cpp b/js/src/vm/Interpreter.cpp index 9eec4b81dd..f4cdc86f18 100644 --- a/js/src/vm/Interpreter.cpp +++ b/js/src/vm/Interpreter.cpp @@ -1273,7 +1273,7 @@ bool js::HandleClosingGeneratorReturn(JSContext* cx, AbstractFramePtr frame, cx->clearPendingException(); ok = true; auto* genObj = GetGeneratorObjectForFrame(cx, frame); - genObj->setClosed(); + genObj->setClosed(cx); } return ok; } @@ -4164,7 +4164,7 @@ bool MOZ_NEVER_INLINE JS_HAZ_JSNATIVE_CALLER js::Interpret(JSContext* cx, CASE(FinalYieldRval) { ReservedRooted<JSObject*> gen(&rootObject0, ®S.sp[-1].toObject()); REGS.sp--; - AbstractGeneratorObject::finalSuspend(gen); + AbstractGeneratorObject::finalSuspend(cx, gen); goto successful_return_continuation; } diff --git a/js/src/vm/InvalidatingFuse.cpp b/js/src/vm/InvalidatingFuse.cpp index 3e14d72fcc..cae8875a19 100644 --- a/js/src/vm/InvalidatingFuse.cpp +++ b/js/src/vm/InvalidatingFuse.cpp @@ -22,7 +22,8 @@ js::DependentScriptSet::DependentScriptSet(JSContext* cx, bool js::InvalidatingRuntimeFuse::addFuseDependency(JSContext* cx, Handle<JSScript*> script) { auto* zone = script->zone(); - DependentScriptSet* dss = zone->getOrCreateDependentScriptSet(cx, this); + DependentScriptSet* dss = + zone->fuseDependencies.getOrCreateDependentScriptSet(cx, this); if (!dss) { return false; } @@ -80,3 +81,20 @@ bool js::DependentScriptSet::addScriptForFuse(InvalidatingFuse* fuse, // Script is already in the set, no need to re-add. return true; } + +js::DependentScriptSet* js::DependentScriptGroup::getOrCreateDependentScriptSet( + JSContext* cx, js::InvalidatingFuse* fuse) { + for (auto& dss : dependencies) { + if (dss.associatedFuse == fuse) { + return &dss; + } + } + + if (!dependencies.emplaceBack(cx, fuse)) { + return nullptr; + } + + auto& dss = dependencies.back(); + MOZ_ASSERT(dss.associatedFuse == fuse); + return &dss; +} diff --git a/js/src/vm/InvalidatingFuse.h b/js/src/vm/InvalidatingFuse.h index 6fc458ee79..b8760e8e0f 100644 --- a/js/src/vm/InvalidatingFuse.h +++ b/js/src/vm/InvalidatingFuse.h @@ -10,7 +10,7 @@ #include "gc/Barrier.h" #include "gc/SweepingAPI.h" #include "vm/GuardFuse.h" -#include "vm/JSScript.h" +class JSScript; namespace js { @@ -40,10 +40,6 @@ class InvalidatingRuntimeFuse : public InvalidatingFuse { // A (weak) set of scripts which are dependent on an associated fuse. // -// These are typically stored in a vector at the moment, due to the low number -// of invalidating fuses, and so the associated fuse is stored along with the -// set. -// // Because it uses JS::WeakCache, GC tracing is taken care of without any need // for tracing in this class. class DependentScriptSet { @@ -61,6 +57,24 @@ class DependentScriptSet { js::WeakCache<WeakScriptSet> weakScripts; }; +class DependentScriptGroup { + // A dependent script set pairs a fuse with a set of scripts which depend + // on said fuse; this is a vector of script sets because the expectation for + // now is that the number of runtime wide invalidating fuses will be small. + // This will need to be revisited (convert to HashMap?) should that no + // longer be the case + // + // Note: This isn't traced through the zone, but rather through the use + // of JS::WeakCache. + Vector<DependentScriptSet, 1, SystemAllocPolicy> dependencies; + + public: + DependentScriptSet* getOrCreateDependentScriptSet(JSContext* cx, + InvalidatingFuse* fuse); + DependentScriptSet* begin() { return dependencies.begin(); } + DependentScriptSet* end() { return dependencies.end(); } +}; + } // namespace js #endif // vm_InvalidatingFuse_h diff --git a/js/src/vm/Iteration.cpp b/js/src/vm/Iteration.cpp index d02f9de8cf..e36ea8b555 100644 --- a/js/src/vm/Iteration.cpp +++ b/js/src/vm/Iteration.cpp @@ -1940,10 +1940,113 @@ static const JSFunctionSpec iterator_methods_with_helpers[] = { JS_FS_END, }; +// https://tc39.es/proposal-iterator-helpers/#sec-SetterThatIgnoresPrototypeProperties +static bool SetterThatIgnoresPrototypeProperties(JSContext* cx, + Handle<Value> thisv, + Handle<PropertyKey> prop, + Handle<Value> value) { + // Step 1. + Rooted<JSObject*> thisObj(cx, + RequireObject(cx, JSMSG_OBJECT_REQUIRED, thisv)); + if (!thisObj) { + return false; + } + + // Step 2. + Rooted<JSObject*> home( + cx, GlobalObject::getOrCreateIteratorPrototype(cx, cx->global())); + if (!home) { + return false; + } + if (thisObj == home) { + UniqueChars propName = + IdToPrintableUTF8(cx, prop, IdToPrintableBehavior::IdIsPropertyKey); + if (!propName) { + return false; + } + + // Step 2.b. + JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_READ_ONLY, + propName.get()); + return false; + } + + // Step 3. + Rooted<Maybe<PropertyDescriptor>> desc(cx); + if (!GetOwnPropertyDescriptor(cx, thisObj, prop, &desc)) { + return false; + } + + // Step 4. + if (desc.isNothing()) { + // Step 4.a. + return DefineDataProperty(cx, thisObj, prop, value, JSPROP_ENUMERATE); + } + + // Step 5. + return SetProperty(cx, thisObj, prop, value); +} + +// https://tc39.es/proposal-iterator-helpers/#sec-get-iteratorprototype-@@tostringtag +static bool toStringTagGetter(JSContext* cx, unsigned argc, Value* vp) { + CallArgs args = CallArgsFromVp(argc, vp); + + // Step 1. + args.rval().setString(cx->names().Iterator); + return true; +} + +// https://tc39.es/proposal-iterator-helpers/#sec-set-iteratorprototype-@@tostringtag +static bool toStringTagSetter(JSContext* cx, unsigned argc, Value* vp) { + CallArgs args = CallArgsFromVp(argc, vp); + + // Step 1. + Rooted<PropertyKey> prop( + cx, PropertyKey::Symbol(cx->wellKnownSymbols().toStringTag)); + if (!SetterThatIgnoresPrototypeProperties(cx, args.thisv(), prop, + args.get(0))) { + return false; + } + + // Step 2. + args.rval().setUndefined(); + return true; +} + +// https://tc39.es/proposal-iterator-helpers/#sec-get-iteratorprototype-constructor +static bool constructorGetter(JSContext* cx, unsigned argc, Value* vp) { + CallArgs args = CallArgsFromVp(argc, vp); + + // Step 1. + Rooted<JSObject*> constructor( + cx, GlobalObject::getOrCreateConstructor(cx, JSProto_Iterator)); + if (!constructor) { + return false; + } + args.rval().setObject(*constructor); + return true; +} + +// https://tc39.es/proposal-iterator-helpers/#sec-set-iteratorprototype-constructor +static bool constructorSetter(JSContext* cx, unsigned argc, Value* vp) { + CallArgs args = CallArgsFromVp(argc, vp); + + // Step 1. + Rooted<PropertyKey> prop(cx, NameToId(cx->names().constructor)); + if (!SetterThatIgnoresPrototypeProperties(cx, args.thisv(), prop, + args.get(0))) { + return false; + } + + // Step 2. + args.rval().setUndefined(); + return true; +} + static const JSPropertySpec iterator_properties[] = { - // NOTE: Contrary to most other @@toStringTag properties, this property is - // writable. - JS_STRING_SYM_PS(toStringTag, "Iterator", 0), + // NOTE: Contrary to most other @@toStringTag properties, this property + // has a special setter (and a getter). + JS_SYM_GETSET(toStringTag, toStringTagGetter, toStringTagSetter, 0), JS_PS_END, }; @@ -2081,7 +2184,7 @@ static const ClassSpec IteratorObjectClassSpec = { nullptr, iterator_methods_with_helpers, iterator_properties, - nullptr, + IteratorObject::finishInit, }; const JSClass IteratorObject::class_ = { @@ -2098,6 +2201,13 @@ const JSClass IteratorObject::protoClass_ = { &IteratorObjectClassSpec, }; +/* static */ bool IteratorObject::finishInit(JSContext* cx, HandleObject ctor, + HandleObject proto) { + Rooted<PropertyKey> id(cx, NameToId(cx->names().constructor)); + return JS_DefinePropertyById(cx, proto, id, constructorGetter, + constructorSetter, 0); +} + // Set up WrapForValidIteratorObject class and its prototype. static const JSFunctionSpec wrap_for_valid_iterator_methods[] = { JS_SELF_HOSTED_FN("next", "WrapForValidIteratorNext", 0, 0), diff --git a/js/src/vm/Iteration.h b/js/src/vm/Iteration.h index 92edaccd65..7f1047eec0 100644 --- a/js/src/vm/Iteration.h +++ b/js/src/vm/Iteration.h @@ -751,6 +751,8 @@ class IteratorObject : public NativeObject { public: static const JSClass class_; static const JSClass protoClass_; + + static bool finishInit(JSContext* cx, HandleObject ctor, HandleObject proto); }; /* diff --git a/js/src/vm/JSAtomUtils.cpp b/js/src/vm/JSAtomUtils.cpp index ab8e4b2e30..2f8b066f0c 100644 --- a/js/src/vm/JSAtomUtils.cpp +++ b/js/src/vm/JSAtomUtils.cpp @@ -62,113 +62,30 @@ extern bool GetUTF8AtomizationData(JSContext* cx, const JS::UTF8Chars& utf8, JS::SmallestEncoding* encoding, HashNumber* hashNum); -struct js::AtomHasher::Lookup { - union { - const JS::Latin1Char* latin1Chars; - const char16_t* twoByteChars; - const char* utf8Bytes; - }; - enum { TwoByteChar, Latin1, UTF8 } type; - size_t length; - size_t byteLength; - const JSAtom* atom; /* Optional. */ - JS::AutoCheckCannotGC nogc; - - HashNumber hash; - - MOZ_ALWAYS_INLINE Lookup(const char* utf8Bytes, size_t byteLen, size_t length, - HashNumber hash) - : utf8Bytes(utf8Bytes), - type(UTF8), - length(length), - byteLength(byteLen), - atom(nullptr), - hash(hash) {} - - MOZ_ALWAYS_INLINE Lookup(const char16_t* chars, size_t length) - : twoByteChars(chars), - type(TwoByteChar), - length(length), - atom(nullptr), - hash(mozilla::HashString(chars, length)) {} - - MOZ_ALWAYS_INLINE Lookup(const JS::Latin1Char* chars, size_t length) - : latin1Chars(chars), - type(Latin1), - length(length), - atom(nullptr), - hash(mozilla::HashString(chars, length)) {} - - MOZ_ALWAYS_INLINE Lookup(HashNumber hash, const char16_t* chars, - size_t length) - : twoByteChars(chars), - type(TwoByteChar), - length(length), - atom(nullptr), - hash(hash) { - MOZ_ASSERT(hash == mozilla::HashString(chars, length)); - } - - MOZ_ALWAYS_INLINE Lookup(HashNumber hash, const JS::Latin1Char* chars, - size_t length) - : latin1Chars(chars), - type(Latin1), - length(length), - atom(nullptr), - hash(hash) { - MOZ_ASSERT(hash == mozilla::HashString(chars, length)); - } - - inline explicit Lookup(const JSAtom* atom) - : type(atom->hasLatin1Chars() ? Latin1 : TwoByteChar), - length(atom->length()), - atom(atom), - hash(atom->hash()) { - if (type == Latin1) { - latin1Chars = atom->latin1Chars(nogc); - MOZ_ASSERT(mozilla::HashString(latin1Chars, length) == hash); - } else { - MOZ_ASSERT(type == TwoByteChar); - twoByteChars = atom->twoByteChars(nogc); - MOZ_ASSERT(mozilla::HashString(twoByteChars, length) == hash); - } - } -}; - -inline HashNumber js::AtomHasher::hash(const Lookup& l) { return l.hash; } - -MOZ_ALWAYS_INLINE bool js::AtomHasher::match(const WeakHeapPtr<JSAtom*>& entry, - const Lookup& lookup) { - JSAtom* key = entry.unbarrieredGet(); - if (lookup.atom) { - return lookup.atom == key; - } - if (key->length() != lookup.length || key->hash() != lookup.hash) { - return false; - } - - if (key->hasLatin1Chars()) { - const Latin1Char* keyChars = key->latin1Chars(lookup.nogc); - switch (lookup.type) { +MOZ_ALWAYS_INLINE bool js::AtomHasher::Lookup::StringsMatch( + const JSAtom& atom) const { + if (atom.hasLatin1Chars()) { + const Latin1Char* keyChars = atom.latin1Chars(nogc); + switch (type) { case Lookup::Latin1: - return EqualChars(keyChars, lookup.latin1Chars, lookup.length); + return EqualChars(keyChars, latin1Chars, length); case Lookup::TwoByteChar: - return EqualChars(keyChars, lookup.twoByteChars, lookup.length); + return EqualChars(keyChars, twoByteChars, length); case Lookup::UTF8: { - JS::UTF8Chars utf8(lookup.utf8Bytes, lookup.byteLength); + JS::UTF8Chars utf8(utf8Bytes, byteLength); return UTF8EqualsChars(utf8, keyChars); } } } - const char16_t* keyChars = key->twoByteChars(lookup.nogc); - switch (lookup.type) { + const char16_t* keyChars = atom.twoByteChars(nogc); + switch (type) { case Lookup::Latin1: - return EqualChars(lookup.latin1Chars, keyChars, lookup.length); + return EqualChars(latin1Chars, keyChars, length); case Lookup::TwoByteChar: - return EqualChars(keyChars, lookup.twoByteChars, lookup.length); + return EqualChars(keyChars, twoByteChars, length); case Lookup::UTF8: { - JS::UTF8Chars utf8(lookup.utf8Bytes, lookup.byteLength); + JS::UTF8Chars utf8(utf8Bytes, byteLength); return UTF8EqualsChars(utf8, keyChars); } } @@ -177,6 +94,21 @@ MOZ_ALWAYS_INLINE bool js::AtomHasher::match(const WeakHeapPtr<JSAtom*>& entry, return false; } +inline HashNumber js::AtomHasher::hash(const Lookup& l) { return l.hash; } + +MOZ_ALWAYS_INLINE bool js::AtomHasher::match(const WeakHeapPtr<JSAtom*>& entry, + const Lookup& lookup) { + JSAtom* key = entry.unbarrieredGet(); + if (lookup.atom) { + return lookup.atom == key; + } + if (key->length() != lookup.length || key->hash() != lookup.hash) { + return false; + } + + return lookup.StringsMatch(*key); +} + UniqueChars js::AtomToPrintableString(JSContext* cx, JSAtom* atom) { return QuoteString(cx, atom); } @@ -450,18 +382,21 @@ static MOZ_ALWAYS_INLINE JSAtom* AtomizeAndCopyCharsNonStaticValidLengthFromLookup( JSContext* cx, const CharT* chars, size_t length, const AtomHasher::Lookup& lookup, const Maybe<uint32_t>& indexValue) { - // Try the per-Zone cache first. If we find the atom there we can avoid the - // markAtom call, and the multiple HashSet lookups below. Zone* zone = cx->zone(); MOZ_ASSERT(zone); - AtomSet::AddPtr zonePtr = zone->atomCache().lookupForAdd(lookup); - if (zonePtr) { - // The cache is purged on GC so if we're in the middle of an - // incremental GC we should have barriered the atom when we put - // it in the cache. - JSAtom* atom = zonePtr->unbarrieredGet(); - MOZ_ASSERT(AtomIsMarked(zone, atom)); - return atom; + + AtomCacheHashTable* atomCache = zone->atomCache(); + + // Try the per-Zone cache first. If we find the atom there we can avoid the + // markAtom call, and the multiple HashSet lookups below. + if (MOZ_LIKELY(atomCache)) { + JSAtom* const cachedAtom = atomCache->lookupForAdd(lookup); + if (cachedAtom) { + // The cache is purged on GC so if we're in the middle of an incremental + // GC we should have barriered the atom when we put it in the cache. + MOZ_ASSERT(AtomIsMarked(zone, cachedAtom)); + return cachedAtom; + } } MOZ_ASSERT(cx->permanentAtomsPopulated()); @@ -469,11 +404,9 @@ AtomizeAndCopyCharsNonStaticValidLengthFromLookup( AtomSet::Ptr pp = cx->permanentAtoms().readonlyThreadsafeLookup(lookup); if (pp) { JSAtom* atom = pp->get(); - if (MOZ_UNLIKELY(!zone->atomCache().add(zonePtr, atom))) { - ReportOutOfMemory(cx); - return nullptr; + if (MOZ_LIKELY(atomCache)) { + atomCache->add(lookup.hash, atom); } - return atom; } @@ -488,11 +421,9 @@ AtomizeAndCopyCharsNonStaticValidLengthFromLookup( return nullptr; } - if (MOZ_UNLIKELY(!zone->atomCache().add(zonePtr, atom))) { - ReportOutOfMemory(cx); - return nullptr; + if (MOZ_LIKELY(atomCache)) { + atomCache->add(lookup.hash, atom); } - return atom; } diff --git a/js/src/vm/JSContext.cpp b/js/src/vm/JSContext.cpp index 5a4bfa86cd..3cc2c4807c 100644 --- a/js/src/vm/JSContext.cpp +++ b/js/src/vm/JSContext.cpp @@ -799,8 +799,14 @@ JS_PUBLIC_API void js::StopDrainingJobQueue(JSContext* cx) { cx->internalJobQueue->interrupt(); } +JS_PUBLIC_API void js::RestartDrainingJobQueue(JSContext* cx) { + MOZ_ASSERT(cx->internalJobQueue.ref()); + cx->internalJobQueue->uninterrupt(); +} + JS_PUBLIC_API void js::RunJobs(JSContext* cx) { MOZ_ASSERT(cx->jobQueue); + MOZ_ASSERT(cx->isEvaluatingModule == 0); cx->jobQueue->runJobs(cx); JS::ClearKeptObjects(cx); } @@ -887,7 +893,6 @@ void InternalJobQueue::runJobs(JSContext* cx) { draining_ = false; if (interrupted_) { - interrupted_ = false; break; } @@ -969,6 +974,7 @@ JSContext::JSContext(JSRuntime* runtime, const JS::ContextOptions& options) #ifdef DEBUG inUnsafeCallWithABI(this, false), hasAutoUnsafeCallWithABI(this, false), + liveArraySortDataInstances(this, 0), #endif #ifdef JS_SIMULATOR simulator_(this, nullptr), @@ -994,6 +1000,7 @@ JSContext::JSContext(JSRuntime* runtime, const JS::ContextOptions& options) #else regExpSearcherLastLimit(this, 0), #endif + isEvaluatingModule(this, 0), frontendCollectionPool_(this), suppressProfilerSampling(false), tempLifoAlloc_(this, (size_t)TEMP_LIFO_ALLOC_PRIMARY_CHUNK_SIZE), @@ -1041,6 +1048,9 @@ JSContext::~JSContext() { /* Free the stuff hanging off of cx. */ MOZ_ASSERT(!resolvingList); + // Ensure we didn't leak memory for the ArraySortData vector. + MOZ_ASSERT(liveArraySortDataInstances == 0); + if (dtoaState) { DestroyDtoaState(dtoaState); } @@ -1189,6 +1199,13 @@ SavedFrame* JSContext::getPendingExceptionStack() { return unwrappedExceptionStack(); } +#ifdef DEBUG +const JS::Value& JSContext::getPendingExceptionUnwrapped() { + MOZ_ASSERT(isExceptionPending()); + return unwrappedException(); +} +#endif + bool JSContext::isClosingGenerator() { return isExceptionPending() && unwrappedException().isMagic(JS_GENERATOR_CLOSING); diff --git a/js/src/vm/JSContext.h b/js/src/vm/JSContext.h index 57aa236801..ba665d6c1a 100644 --- a/js/src/vm/JSContext.h +++ b/js/src/vm/JSContext.h @@ -89,12 +89,15 @@ class InternalJobQueue : public JS::JobQueue { JS::HandleObject incumbentGlobal) override; void runJobs(JSContext* cx) override; bool empty() const override; + bool isDrainingStopped() const override { return interrupted_; } // If we are currently in a call to runJobs(), make that call stop processing // jobs once the current one finishes, and return. If we are not currently in // a call to runJobs, make all future calls return immediately. void interrupt() { interrupted_ = true; } + void uninterrupt() { interrupted_ = false; } + // Return the front element of the queue, or nullptr if the queue is empty. // This is only used by shell testing functions. JSObject* maybeFront() const; @@ -425,6 +428,7 @@ struct JS_PUBLIC_API JSContext : public JS::RootingContext, #ifdef DEBUG js::ContextData<uint32_t> inUnsafeCallWithABI; js::ContextData<bool> hasAutoUnsafeCallWithABI; + js::ContextData<uint32_t> liveArraySortDataInstances; #endif #ifdef JS_SIMULATOR @@ -506,6 +510,9 @@ struct JS_PUBLIC_API JSContext : public JS::RootingContext, return offsetof(JSContext, regExpSearcherLastLimit); } + // Whether we are currently executing the top level of a module. + js::ContextData<uint32_t> isEvaluatingModule; + private: // Pools used for recycling name maps and vectors when parsing and // emitting bytecode. Purged on GC when there are no active script @@ -719,6 +726,13 @@ struct JS_PUBLIC_API JSContext : public JS::RootingContext, */ js::SavedFrame* getPendingExceptionStack(); +#ifdef DEBUG + /** + * Return the pending exception (without wrapping). + */ + const JS::Value& getPendingExceptionUnwrapped(); +#endif + bool isThrowingDebuggeeWouldRun(); bool isClosingGenerator(); diff --git a/js/src/vm/JSFunction.h b/js/src/vm/JSFunction.h index 451b63e11a..afd54c8f13 100644 --- a/js/src/vm/JSFunction.h +++ b/js/src/vm/JSFunction.h @@ -86,7 +86,7 @@ class JSFunction : public js::NativeObject { * the low bit set to ensure it's never identical to a BaseScript* * pointer * - * - a wasm JIT entry + * - a native JIT entry (used for Wasm and TrampolineNative functions) * * The JIT depends on none of the above being a valid BaseScript pointer. * @@ -199,6 +199,7 @@ class JSFunction : public js::NativeObject { bool isWasm() const { return flags().isWasm(); } bool isWasmWithJitEntry() const { return flags().isWasmWithJitEntry(); } + bool isNativeWithJitEntry() const { return flags().isNativeWithJitEntry(); } bool isNativeWithoutJitEntry() const { return flags().isNativeWithoutJitEntry(); } @@ -637,7 +638,9 @@ class JSFunction : public js::NativeObject { JS::PrivateValue(reinterpret_cast<void*>(native))); setNativeJitInfoOrInterpretedScript(const_cast<JSJitInfo*>(jitInfo)); } - bool hasJitInfo() const { return isBuiltinNative() && jitInfoUnchecked(); } + bool hasJitInfo() const { + return flags().canHaveJitInfo() && jitInfoUnchecked(); + } const JSJitInfo* jitInfo() const { MOZ_ASSERT(hasJitInfo()); return jitInfoUnchecked(); @@ -677,12 +680,25 @@ class JSFunction : public js::NativeObject { MOZ_ASSERT(*entry); MOZ_ASSERT(isWasm()); MOZ_ASSERT(!isWasmWithJitEntry()); - setFlags(flags().setWasmJitEntry()); + setFlags(flags().setNativeJitEntry()); setNativeJitInfoOrInterpretedScript(entry); MOZ_ASSERT(isWasmWithJitEntry()); } + void setTrampolineNativeJitEntry(void** entry) { + MOZ_ASSERT(*entry); + MOZ_ASSERT(isBuiltinNative()); + MOZ_ASSERT(!hasJitEntry()); + MOZ_ASSERT(!hasJitInfo(), "shouldn't clobber JSJitInfo"); + setFlags(flags().setNativeJitEntry()); + setNativeJitInfoOrInterpretedScript(entry); + MOZ_ASSERT(isNativeWithJitEntry()); + } void** wasmJitEntry() const { MOZ_ASSERT(isWasmWithJitEntry()); + return nativeJitEntry(); + } + void** nativeJitEntry() const { + MOZ_ASSERT(isNativeWithJitEntry()); return static_cast<void**>(nativeJitInfoOrInterpretedScript()); } inline js::wasm::Instance& wasmInstance() const; diff --git a/js/src/vm/JSONParser.cpp b/js/src/vm/JSONParser.cpp index f151f261b5..7a440e3090 100644 --- a/js/src/vm/JSONParser.cpp +++ b/js/src/vm/JSONParser.cpp @@ -644,7 +644,7 @@ inline bool JSONFullParseHandlerAnyChar::objectOpen( return false; } } - if (!stack.append(*properties)) { + if (!stack.append(StackEntry(cx, *properties))) { js_delete(*properties); return false; } @@ -676,11 +676,12 @@ inline bool JSONFullParseHandlerAnyChar::objectPropertyName( return true; } -inline void JSONFullParseHandlerAnyChar::finishObjectMember( +inline bool JSONFullParseHandlerAnyChar::finishObjectMember( Vector<StackEntry, 10>& stack, JS::Handle<JS::Value> value, PropertyVector** properties) { *properties = &stack.back().properties(); (*properties)->back().value = value; + return true; } inline bool JSONFullParseHandlerAnyChar::finishObject( @@ -718,7 +719,7 @@ inline bool JSONFullParseHandlerAnyChar::arrayOpen( return false; } } - if (!stack.append(*elements)) { + if (!stack.append(StackEntry(cx, *elements))) { js_delete(*elements); return false; } @@ -794,7 +795,7 @@ inline bool JSONFullParseHandler<CharT>::setStringValue( return false; } v = JS::StringValue(str); - return createJSONParseRecord(v, source); + return true; } template <typename CharT> @@ -812,26 +813,26 @@ inline bool JSONFullParseHandler<CharT>::setStringValue( return false; } v = JS::StringValue(str); - return createJSONParseRecord(v, source); + return true; } template <typename CharT> inline bool JSONFullParseHandler<CharT>::setNumberValue( double d, mozilla::Span<const CharT>&& source) { v = JS::NumberValue(d); - return createJSONParseRecord(v, source); + return true; } template <typename CharT> inline bool JSONFullParseHandler<CharT>::setBooleanValue( bool value, mozilla::Span<const CharT>&& source) { - return createJSONParseRecord(JS::BooleanValue(value), source); + return true; } template <typename CharT> inline bool JSONFullParseHandler<CharT>::setNullValue( mozilla::Span<const CharT>&& source) { - return createJSONParseRecord(JS::NullValue(), source); + return true; } template <typename CharT> @@ -847,29 +848,6 @@ void JSONFullParseHandler<CharT>::reportError(const char* msg, uint32_t line, msg, lineString, columnString); } -template <typename CharT> -void JSONFullParseHandler<CharT>::trace(JSTracer* trc) { - Base::trace(trc); - parseRecord.trace(trc); -} - -template <typename CharT> -inline bool JSONFullParseHandler<CharT>::createJSONParseRecord( - const Value& value, mozilla::Span<const CharT>& source) { -#ifdef ENABLE_JSON_PARSE_WITH_SOURCE - if (cx->realm()->creationOptions().getJSONParseWithSource()) { - MOZ_ASSERT(!source.IsEmpty()); - Rooted<JSONParseNode*> parseNode(cx, - NewStringCopy<CanGC, CharT>(cx, source)); - if (!parseNode) { - return false; - } - parseRecord = ParseRecordObject(parseNode, value); - } -#endif - return true; -} - template <typename CharT, typename HandlerT> JSONPerHandlerParser<CharT, HandlerT>::~JSONPerHandlerParser() { for (size_t i = 0; i < stack.length(); i++) { @@ -889,7 +867,9 @@ bool JSONPerHandlerParser<CharT, HandlerT>::parseImpl(TempValueT& value, switch (state) { case JSONParserState::FinishObjectMember: { typename HandlerT::PropertyVector* properties; - handler.finishObjectMember(stack, value, &properties); + if (!handler.finishObjectMember(stack, value, &properties)) { + return false; + } token = tokenizer.advanceAfterProperty(); if (token == JSONToken::ObjectClose) { @@ -1069,6 +1049,13 @@ template class js::JSONPerHandlerParser<Latin1Char, template class js::JSONPerHandlerParser<char16_t, js::JSONFullParseHandler<char16_t>>; +#ifdef ENABLE_JSON_PARSE_WITH_SOURCE +template class js::JSONPerHandlerParser<Latin1Char, + js::JSONReviveHandler<Latin1Char>>; +template class js::JSONPerHandlerParser<char16_t, + js::JSONReviveHandler<char16_t>>; +#endif + template class js::JSONPerHandlerParser<Latin1Char, js::JSONSyntaxParseHandler<Latin1Char>>; template class js::JSONPerHandlerParser<char16_t, @@ -1085,20 +1072,148 @@ bool JSONParser<CharT>::parse(JS::MutableHandle<JS::Value> vp) { } template <typename CharT> -bool JSONParser<CharT>::parse(JS::MutableHandle<JS::Value> vp, - JS::MutableHandle<ParseRecordObject> pro) { +void JSONParser<CharT>::trace(JSTracer* trc) { + this->handler.trace(trc); + + for (auto& elem : this->stack) { + if (elem.state == JSONParserState::FinishArrayElement) { + elem.elements().trace(trc); + } else { + elem.properties().trace(trc); + } + } +} + +template class js::JSONParser<Latin1Char>; +template class js::JSONParser<char16_t>; + +#ifdef ENABLE_JSON_PARSE_WITH_SOURCE +template <typename CharT> +inline bool JSONReviveHandler<CharT>::objectOpen(Vector<StackEntry, 10>& stack, + PropertyVector** properties) { + if (!parseRecordStack.append(ParseRecordEntry{context()})) { + return false; + } + + return Base::objectOpen(stack, properties); +} + +template <typename CharT> +inline bool JSONReviveHandler<CharT>::finishObjectMember( + Vector<StackEntry, 10>& stack, JS::Handle<JS::Value> value, + PropertyVector** properties) { + if (!Base::finishObjectMember(stack, value, properties)) { + return false; + } + parseRecord.value = value; + return finishMemberParseRecord((*properties)->back().id, + parseRecordStack.back()); +} + +template <typename CharT> +inline bool JSONReviveHandler<CharT>::finishObject( + Vector<StackEntry, 10>& stack, JS::MutableHandle<JS::Value> vp, + PropertyVector* properties) { + if (!Base::finishObject(stack, vp, properties)) { + return false; + } + if (!finishCompoundParseRecord(vp, parseRecordStack.back())) { + return false; + } + parseRecordStack.popBack(); + + return true; +} + +template <typename CharT> +inline bool JSONReviveHandler<CharT>::arrayOpen(Vector<StackEntry, 10>& stack, + ElementVector** elements) { + if (!parseRecordStack.append(ParseRecordEntry{context()})) { + return false; + } + + return Base::arrayOpen(stack, elements); +} + +template <typename CharT> +inline bool JSONReviveHandler<CharT>::arrayElement( + Vector<StackEntry, 10>& stack, JS::Handle<JS::Value> value, + ElementVector** elements) { + if (!Base::arrayElement(stack, value, elements)) { + return false; + } + size_t index = (*elements)->length() - 1; + JS::PropertyKey key = js::PropertyKey::Int(index); + return finishMemberParseRecord(key, parseRecordStack.back()); +} + +template <typename CharT> +inline bool JSONReviveHandler<CharT>::finishArray( + Vector<StackEntry, 10>& stack, JS::MutableHandle<JS::Value> vp, + ElementVector* elements) { + if (!Base::finishArray(stack, vp, elements)) { + return false; + } + if (!finishCompoundParseRecord(vp, parseRecordStack.back())) { + return false; + } + parseRecordStack.popBack(); + + return true; +} + +template <typename CharT> +inline bool JSONReviveHandler<CharT>::finishMemberParseRecord( + JS::PropertyKey& key, ParseRecordEntry& objectEntry) { + parseRecord.key = key; + return objectEntry.put(key, std::move(parseRecord)); +} + +template <typename CharT> +inline bool JSONReviveHandler<CharT>::finishCompoundParseRecord( + const Value& value, ParseRecordEntry& objectEntry) { + Rooted<JSONParseNode*> parseNode(context()); + parseRecord = ParseRecordObject(parseNode, value); + return parseRecord.addEntries(context(), std::move(objectEntry)); +} + +template <typename CharT> +inline bool JSONReviveHandler<CharT>::finishPrimitiveParseRecord( + const Value& value, SourceT source) { + MOZ_ASSERT(!source.IsEmpty()); // Empty source is for objects and arrays + Rooted<JSONParseNode*> parseNode( + context(), NewStringCopy<CanGC, CharT>(context(), source)); + if (!parseNode) { + return false; + } + parseRecord = ParseRecordObject(parseNode, value); + return true; +} + +template <typename CharT> +void JSONReviveHandler<CharT>::trace(JSTracer* trc) { + Base::trace(trc); + parseRecord.trace(trc); + for (auto& entry : this->parseRecordStack) { + entry.trace(trc); + } +} + +template <typename CharT> +bool JSONReviveParser<CharT>::parse(JS::MutableHandle<JS::Value> vp, + JS::MutableHandle<ParseRecordObject> pro) { JS::Rooted<JS::Value> tempValue(this->handler.cx); vp.setUndefined(); bool result = this->parseImpl( tempValue, [&](JS::Handle<JS::Value> value) { vp.set(value); }); - pro.get() = std::move(this->handler.parseRecord); + pro.set(std::move(this->handler.parseRecord)); return result; } template <typename CharT> -void JSONParser<CharT>::trace(JSTracer* trc) { +void JSONReviveParser<CharT>::trace(JSTracer* trc) { this->handler.trace(trc); for (auto& elem : this->stack) { @@ -1110,8 +1225,9 @@ void JSONParser<CharT>::trace(JSTracer* trc) { } } -template class js::JSONParser<Latin1Char>; -template class js::JSONParser<char16_t>; +template class js::JSONReviveParser<Latin1Char>; +template class js::JSONReviveParser<char16_t>; +#endif // ENABLE_JSON_PARSE_WITH_SOURCE template <typename CharT> inline bool JSONSyntaxParseHandler<CharT>::objectOpen( @@ -1359,9 +1475,11 @@ class MOZ_STACK_CLASS DelegateHandler { *isProtoInEval = false; return true; } - inline void finishObjectMember(Vector<StackEntry, 10>& stack, + inline bool finishObjectMember(Vector<StackEntry, 10>& stack, DummyValue& value, - PropertyVector** properties) {} + PropertyVector** properties) { + return true; + } inline bool finishObject(Vector<StackEntry, 10>& stack, DummyValue* vp, PropertyVector* properties) { if (hadHandlerError_) { diff --git a/js/src/vm/JSONParser.h b/js/src/vm/JSONParser.h index 91e33c02b3..51b90e003c 100644 --- a/js/src/vm/JSONParser.h +++ b/js/src/vm/JSONParser.h @@ -190,10 +190,10 @@ class MOZ_STACK_CLASS JSONFullParseHandlerAnyChar { return *static_cast<PropertyVector*>(vector); } - explicit StackEntry(ElementVector* elements) + explicit StackEntry(JSContext* cx, ElementVector* elements) : state(JSONParserState::FinishArrayElement), vector(elements) {} - explicit StackEntry(PropertyVector* properties) + explicit StackEntry(JSContext* cx, PropertyVector* properties) : state(JSONParserState::FinishObjectMember), vector(properties) {} JSONParserState state; @@ -255,7 +255,7 @@ class MOZ_STACK_CLASS JSONFullParseHandlerAnyChar { PropertyVector** properties); inline bool objectPropertyName(Vector<StackEntry, 10>& stack, bool* isProtoInEval); - inline void finishObjectMember(Vector<StackEntry, 10>& stack, + inline bool finishObjectMember(Vector<StackEntry, 10>& stack, JS::Handle<JS::Value> value, PropertyVector** properties); inline bool finishObject(Vector<StackEntry, 10>& stack, @@ -303,8 +303,6 @@ class MOZ_STACK_CLASS JSONFullParseHandler bool append(const CharT* begin, const CharT* end); }; - ParseRecordObject parseRecord; - explicit JSONFullParseHandler(JSContext* cx) : Base(cx) {} JSONFullParseHandler(JSONFullParseHandler&& other) noexcept @@ -324,13 +322,101 @@ class MOZ_STACK_CLASS JSONFullParseHandler inline bool setNullValue(mozilla::Span<const CharT>&& source); void reportError(const char* msg, uint32_t line, uint32_t column); +}; + +#ifdef ENABLE_JSON_PARSE_WITH_SOURCE +template <typename CharT> +class MOZ_STACK_CLASS JSONReviveHandler : public JSONFullParseHandler<CharT> { + using CharPtr = mozilla::RangedPtr<const CharT>; + using Base = JSONFullParseHandler<CharT>; + + public: + using SourceT = mozilla::Span<const CharT>; + using ParseRecordEntry = ParseRecordObject::EntryMap; + + using StringBuilder = typename Base::StringBuilder; + using StackEntry = typename Base::StackEntry; + using PropertyVector = typename Base::PropertyVector; + using ElementVector = typename Base::ElementVector; + + public: + explicit JSONReviveHandler(JSContext* cx) : Base(cx), parseRecordStack(cx) {} + + JSONReviveHandler(JSONReviveHandler&& other) noexcept + : Base(std::move(other)), + parseRecordStack(std::move(other.parseRecordStack)), + parseRecord(std::move(other.parseRecord)) {} + + JSONReviveHandler(const JSONReviveHandler& other) = delete; + void operator=(const JSONReviveHandler& other) = delete; + + JSContext* context() { return this->cx; } + + template <JSONStringType ST> + inline bool setStringValue(CharPtr start, size_t length, SourceT&& source) { + if (!Base::template setStringValue<ST>(start, length, + std::forward<SourceT&&>(source))) { + return false; + } + return finishPrimitiveParseRecord(this->v, source); + } + + template <JSONStringType ST> + inline bool setStringValue(StringBuilder& builder, SourceT&& source) { + if (!Base::template setStringValue<ST>(builder, + std::forward<SourceT&&>(source))) { + return false; + } + return finishPrimitiveParseRecord(this->v, source); + } + + inline bool setNumberValue(double d, SourceT&& source) { + if (!Base::setNumberValue(d, std::forward<SourceT&&>(source))) { + return false; + } + return finishPrimitiveParseRecord(this->v, source); + } + + inline bool setBooleanValue(bool value, SourceT&& source) { + return finishPrimitiveParseRecord(JS::BooleanValue(value), source); + } + inline bool setNullValue(SourceT&& source) { + return finishPrimitiveParseRecord(JS::NullValue(), source); + } + + inline bool objectOpen(Vector<StackEntry, 10>& stack, + PropertyVector** properties); + inline bool finishObjectMember(Vector<StackEntry, 10>& stack, + JS::Handle<JS::Value> value, + PropertyVector** properties); + inline bool finishObject(Vector<StackEntry, 10>& stack, + JS::MutableHandle<JS::Value> vp, + PropertyVector* properties); + + inline bool arrayOpen(Vector<StackEntry, 10>& stack, + ElementVector** elements); + inline bool arrayElement(Vector<StackEntry, 10>& stack, + JS::Handle<JS::Value> value, + ElementVector** elements); + inline bool finishArray(Vector<StackEntry, 10>& stack, + JS::MutableHandle<JS::Value> vp, + ElementVector* elements); void trace(JSTracer* trc); - protected: - inline bool createJSONParseRecord(const Value& value, - mozilla::Span<const CharT>& source); + private: + inline bool finishMemberParseRecord(JS::PropertyKey& key, + ParseRecordEntry& objectEntry); + inline bool finishCompoundParseRecord(const Value& value, + ParseRecordEntry& objectEntry); + inline bool finishPrimitiveParseRecord(const Value& value, SourceT source); + + Vector<ParseRecordEntry, 10> parseRecordStack; + + public: + ParseRecordObject parseRecord; }; +#endif // ENABLE_JSON_PARSE_WITH_SOURCE template <typename CharT> class MOZ_STACK_CLASS JSONSyntaxParseHandler { @@ -409,9 +495,11 @@ class MOZ_STACK_CLASS JSONSyntaxParseHandler { *isProtoInEval = false; return true; } - inline void finishObjectMember(Vector<StackEntry, 10>& stack, + inline bool finishObjectMember(Vector<StackEntry, 10>& stack, DummyValue& value, - PropertyVector** properties) {} + PropertyVector** properties) { + return true; + } inline bool finishObject(Vector<StackEntry, 10>& stack, DummyValue* vp, PropertyVector* properties); @@ -510,11 +598,52 @@ class MOZ_STACK_CLASS JSONParser * represent |undefined|, so the JSON data couldn't have specified it.) */ bool parse(JS::MutableHandle<JS::Value> vp); + + void trace(JSTracer* trc); +}; + +#ifdef ENABLE_JSON_PARSE_WITH_SOURCE +template <typename CharT> +class MOZ_STACK_CLASS JSONReviveParser + : JSONPerHandlerParser<CharT, JSONReviveHandler<CharT>> { + using Base = JSONPerHandlerParser<CharT, JSONReviveHandler<CharT>>; + + public: + using ParseType = JSONFullParseHandlerAnyChar::ParseType; + + /* Public API */ + + /* Create a parser for the provided JSON data. */ + JSONReviveParser(JSContext* cx, mozilla::Range<const CharT> data) + : Base(cx, data) {} + + /* Allow move construction for use with Rooted. */ + JSONReviveParser(JSONReviveParser&& other) noexcept + : Base(std::move(other)) {} + + JSONReviveParser(const JSONReviveParser& other) = delete; + void operator=(const JSONReviveParser& other) = delete; + + /* + * Parse the JSON data specified at construction time. If it parses + * successfully, store the prescribed value in *vp and return true. If an + * internal error (e.g. OOM) occurs during parsing, return false. + * Otherwise, if invalid input was specifed but no internal error occurred, + * behavior depends upon the error handling specified at construction: if + * error handling is RaiseError then throw a SyntaxError and return false, + * otherwise return true and set *vp to |undefined|. (JSON syntax can't + * represent |undefined|, so the JSON data couldn't have specified it.) + * + * If it parses successfully, parse information for calling the reviver + * function is stored in *pro. If this function returns false, *pro will be + * set to |undefined|. + */ bool parse(JS::MutableHandle<JS::Value> vp, JS::MutableHandle<ParseRecordObject> pro); void trace(JSTracer* trc); }; +#endif // ENABLE_JSON_PARSE_WITH_SOURCE template <typename CharT, typename Wrapper> class MutableWrappedPtrOperations<JSONParser<CharT>, Wrapper> @@ -523,10 +652,6 @@ class MutableWrappedPtrOperations<JSONParser<CharT>, Wrapper> bool parse(JS::MutableHandle<JS::Value> vp) { return static_cast<Wrapper*>(this)->get().parse(vp); } - bool parse(JS::MutableHandle<JS::Value> vp, - JS::MutableHandle<ParseRecordObject> pro) { - return static_cast<Wrapper*>(this)->get().parse(vp, pro); - } }; template <typename CharT> diff --git a/js/src/vm/JSONPrinter.cpp b/js/src/vm/JSONPrinter.cpp index 5b5183d9fb..53ab4be67c 100644 --- a/js/src/vm/JSONPrinter.cpp +++ b/js/src/vm/JSONPrinter.cpp @@ -154,8 +154,8 @@ void JSONPrinter::formatProperty(const char* name, const char* format, ...) { va_end(ap); } -void JSONPrinter::formatProperty(const char* name, const char* format, - va_list ap) { +void JSONPrinter::formatPropertyVA(const char* name, const char* format, + va_list ap) { beginStringProperty(name); out_.vprintf(format, ap); endStringProperty(); diff --git a/js/src/vm/JSONPrinter.h b/js/src/vm/JSONPrinter.h index b90696a2b4..61536a6c87 100644 --- a/js/src/vm/JSONPrinter.h +++ b/js/src/vm/JSONPrinter.h @@ -62,7 +62,7 @@ class JSONPrinter { void formatProperty(const char* name, const char* format, ...) MOZ_FORMAT_PRINTF(3, 4); - void formatProperty(const char* name, const char* format, va_list ap); + void formatPropertyVA(const char* name, const char* format, va_list ap); void propertyName(const char* name); diff --git a/js/src/vm/JSObject-inl.h b/js/src/vm/JSObject-inl.h index 4ca0946878..a493d7624a 100644 --- a/js/src/vm/JSObject-inl.h +++ b/js/src/vm/JSObject-inl.h @@ -189,8 +189,9 @@ template <typename T> MOZ_ASSERT(!cx->realm()->hasObjectPendingMetadata()); // The metadata builder is invoked for each object created on the main thread, - // except when it's suppressed. - if (!cx->zone()->suppressAllocationMetadataBuilder) { + // except when it's suppressed or we're throwing over-recursion error. + if (!cx->zone()->suppressAllocationMetadataBuilder && + !cx->isThrowingOverRecursed()) { // Don't collect metadata on objects that represent metadata, to avoid // recursion. AutoSuppressAllocationMetadataBuilder suppressMetadata(cx); diff --git a/js/src/vm/JSObject.cpp b/js/src/vm/JSObject.cpp index ea4dfeb6f7..8bc8bc0d52 100644 --- a/js/src/vm/JSObject.cpp +++ b/js/src/vm/JSObject.cpp @@ -2215,9 +2215,7 @@ JS_PUBLIC_API bool js::ShouldIgnorePropertyDefinition(JSContext* cx, id == NameToId(cx->names().symmetricDifference))) { return true; } -#endif -#ifdef NIGHTLY_BUILD if (key == JSProto_ArrayBuffer && !JS::Prefs::arraybuffer_transfer() && (id == NameToId(cx->names().transfer) || id == NameToId(cx->names().transferToFixedLength) || @@ -2240,6 +2238,33 @@ JS_PUBLIC_API bool js::ShouldIgnorePropertyDefinition(JSContext* cx, id == NameToId(cx->names().grow))) { return true; } + + if (key == JSProto_Uint8Array && + !JS::Prefs::experimental_uint8array_base64() && + (id == NameToId(cx->names().setFromBase64) || + id == NameToId(cx->names().setFromHex) || + id == NameToId(cx->names().toBase64) || + id == NameToId(cx->names().toHex))) { + return true; + } + + // It's gently surprising that this is JSProto_Function, but the trick + // to realize is that this is a -constructor function-, not a function + // on the prototype; and the proto of the constructor is JSProto_Function. + if (key == JSProto_Function && !JS::Prefs::experimental_uint8array_base64() && + (id == NameToId(cx->names().fromBase64) || + id == NameToId(cx->names().fromHex))) { + return true; + } +#endif + +#ifdef ENABLE_JSON_PARSE_WITH_SOURCE + if (key == JSProto_JSON && + !JS::Prefs::experimental_json_parse_with_source() && + (id == NameToId(cx->names().isRawJSON) || + id == NameToId(cx->names().rawJSON))) { + return true; + } #endif return false; @@ -3165,19 +3190,8 @@ js::gc::AllocKind JSObject::allocKindForTenure( return as<JSFunction>().getAllocKind(); } - // Fixed length typed arrays in the nursery may have a lazily allocated - // buffer, make sure there is room for the array's fixed data when moving - // the array. - if (is<FixedLengthTypedArrayObject>() && - !as<FixedLengthTypedArrayObject>().hasBuffer()) { - gc::AllocKind allocKind; - if (as<FixedLengthTypedArrayObject>().hasInlineElements()) { - size_t nbytes = as<FixedLengthTypedArrayObject>().byteLength(); - allocKind = FixedLengthTypedArrayObject::AllocKindForLazyBuffer(nbytes); - } else { - allocKind = GetGCObjectKind(getClass()); - } - return ForegroundToBackgroundAllocKind(allocKind); + if (is<FixedLengthTypedArrayObject>()) { + return as<FixedLengthTypedArrayObject>().allocKindForTenure(); } return as<NativeObject>().allocKindForTenure(); diff --git a/js/src/vm/Modules.cpp b/js/src/vm/Modules.cpp index f461e7bec1..917083a238 100644 --- a/js/src/vm/Modules.cpp +++ b/js/src/vm/Modules.cpp @@ -9,7 +9,8 @@ #include "vm/Modules.h" #include "mozilla/Assertions.h" // MOZ_ASSERT -#include "mozilla/Utf8.h" // mozilla::Utf8Unit +#include "mozilla/ScopeExit.h" +#include "mozilla/Utf8.h" // mozilla::Utf8Unit #include <stdint.h> // uint32_t @@ -42,6 +43,12 @@ using namespace js; using mozilla::Utf8Unit; +static bool ModuleLink(JSContext* cx, Handle<ModuleObject*> module); +static bool ModuleEvaluate(JSContext* cx, Handle<ModuleObject*> module, + MutableHandle<Value> result); +static bool SyntheticModuleEvaluate(JSContext* cx, Handle<ModuleObject*> module, + MutableHandle<Value> result); + //////////////////////////////////////////////////////////////////////////////// // Public API JS_PUBLIC_API JS::ModuleResolveHook JS::GetModuleResolveHook(JSRuntime* rt) { @@ -184,7 +191,7 @@ JS_PUBLIC_API bool JS::ModuleLink(JSContext* cx, Handle<JSObject*> moduleArg) { CHECK_THREAD(cx); cx->releaseCheck(moduleArg); - return js::ModuleLink(cx, moduleArg.as<ModuleObject>()); + return ::ModuleLink(cx, moduleArg.as<ModuleObject>()); } JS_PUBLIC_API bool JS::ModuleEvaluate(JSContext* cx, @@ -194,11 +201,17 @@ JS_PUBLIC_API bool JS::ModuleEvaluate(JSContext* cx, CHECK_THREAD(cx); cx->releaseCheck(moduleRecord); + cx->isEvaluatingModule++; + auto guard = mozilla::MakeScopeExit([cx] { + MOZ_ASSERT(cx->isEvaluatingModule != 0); + cx->isEvaluatingModule--; + }); + if (moduleRecord.as<ModuleObject>()->hasSyntheticModuleFields()) { return SyntheticModuleEvaluate(cx, moduleRecord.as<ModuleObject>(), rval); } - return js::ModuleEvaluate(cx, moduleRecord.as<ModuleObject>(), rval); + return ::ModuleEvaluate(cx, moduleRecord.as<ModuleObject>(), rval); } JS_PUBLIC_API bool JS::ThrowOnModuleEvaluationFailure( @@ -327,6 +340,11 @@ JS_PUBLIC_API void JS::ClearModuleEnvironment(JSObject* moduleObj) { } } +JS_PUBLIC_API bool JS::ModuleIsLinked(JSObject* moduleObj) { + AssertHeapIsIdle(); + return moduleObj->as<ModuleObject>().status() != ModuleStatus::Unlinked; +} + //////////////////////////////////////////////////////////////////////////////// // Internal implementation @@ -356,14 +374,17 @@ static ModuleObject* HostResolveImportedModule( JSContext* cx, Handle<ModuleObject*> module, Handle<ModuleRequestObject*> moduleRequest, ModuleStatus expectedMinimumStatus); -static bool ModuleResolveExport(JSContext* cx, Handle<ModuleObject*> module, - Handle<JSAtom*> exportName, - MutableHandle<ResolveSet> resolveSet, - MutableHandle<Value> result); +static bool CyclicModuleResolveExport(JSContext* cx, + Handle<ModuleObject*> module, + Handle<JSAtom*> exportName, + MutableHandle<ResolveSet> resolveSet, + MutableHandle<Value> result, + ModuleErrorInfo* errorInfoOut = nullptr); static bool SyntheticModuleResolveExport(JSContext* cx, Handle<ModuleObject*> module, Handle<JSAtom*> exportName, - MutableHandle<Value> result); + MutableHandle<Value> result, + ModuleErrorInfo* errorInfoOut); static ModuleNamespaceObject* ModuleNamespaceCreate( JSContext* cx, Handle<ModuleObject*> module, MutableHandle<UniquePtr<ExportNameVector>> exports); @@ -575,17 +596,20 @@ static ModuleObject* HostResolveImportedModule( // - If the request is found to be ambiguous, the string `"ambiguous"` is // returned. // -bool js::ModuleResolveExport(JSContext* cx, Handle<ModuleObject*> module, - Handle<JSAtom*> exportName, - MutableHandle<Value> result) { +static bool ModuleResolveExport(JSContext* cx, Handle<ModuleObject*> module, + Handle<JSAtom*> exportName, + MutableHandle<Value> result, + ModuleErrorInfo* errorInfoOut = nullptr) { if (module->hasSyntheticModuleFields()) { - return ::SyntheticModuleResolveExport(cx, module, exportName, result); + return SyntheticModuleResolveExport(cx, module, exportName, result, + errorInfoOut); } // Step 1. If resolveSet is not present, set resolveSet to a new empty List. Rooted<ResolveSet> resolveSet(cx); - return ::ModuleResolveExport(cx, module, exportName, &resolveSet, result); + return CyclicModuleResolveExport(cx, module, exportName, &resolveSet, result, + errorInfoOut); } static bool CreateResolvedBindingObject(JSContext* cx, @@ -602,10 +626,12 @@ static bool CreateResolvedBindingObject(JSContext* cx, return true; } -static bool ModuleResolveExport(JSContext* cx, Handle<ModuleObject*> module, - Handle<JSAtom*> exportName, - MutableHandle<ResolveSet> resolveSet, - MutableHandle<Value> result) { +static bool CyclicModuleResolveExport(JSContext* cx, + Handle<ModuleObject*> module, + Handle<JSAtom*> exportName, + MutableHandle<ResolveSet> resolveSet, + MutableHandle<Value> result, + ModuleErrorInfo* errorInfoOut) { // Step 2. For each Record { [[Module]], [[ExportName]] } r of resolveSet, do: for (const auto& entry : resolveSet) { // Step 2.a. If module and r.[[Module]] are the same Module Record and @@ -614,6 +640,9 @@ static bool ModuleResolveExport(JSContext* cx, Handle<ModuleObject*> module, // Step 2.a.i. Assert: This is a circular import request. // Step 2.a.ii. Return null. result.setNull(); + if (errorInfoOut) { + errorInfoOut->setCircularImport(cx, module); + } return true; } } @@ -669,8 +698,8 @@ static bool ModuleResolveExport(JSContext* cx, Handle<ModuleObject*> module, // importedModule.ResolveExport(e.[[ImportName]], // resolveSet). name = e.importName(); - return ModuleResolveExport(cx, importedModule, name, resolveSet, - result); + return CyclicModuleResolveExport(cx, importedModule, name, resolveSet, + result, errorInfoOut); } } } @@ -683,6 +712,9 @@ static bool ModuleResolveExport(JSContext* cx, Handle<ModuleObject*> module, // Step 6.c. NOTE: A default export cannot be provided by an export * from // "mod" declaration. result.setNull(); + if (errorInfoOut) { + errorInfoOut->setImportedModule(cx, module); + } return true; } @@ -704,8 +736,8 @@ static bool ModuleResolveExport(JSContext* cx, Handle<ModuleObject*> module, // Step 8.b. Let resolution be ? importedModule.ResolveExport(exportName, // resolveSet). - if (!ModuleResolveExport(cx, importedModule, exportName, resolveSet, - &resolution)) { + if (!CyclicModuleResolveExport(cx, importedModule, exportName, resolveSet, + &resolution, errorInfoOut)) { return false; } @@ -744,6 +776,12 @@ static bool ModuleResolveExport(JSContext* cx, Handle<ModuleObject*> module, if (binding->module() != starResolution->module() || binding->bindingName() != starResolution->bindingName()) { result.set(StringValue(cx->names().ambiguous)); + + if (errorInfoOut) { + Rooted<ModuleObject*> module1(cx, starResolution->module()); + Rooted<ModuleObject*> module2(cx, binding->module()); + errorInfoOut->setForAmbiguousImport(cx, module, module1, module2); + } return true; } } @@ -752,6 +790,9 @@ static bool ModuleResolveExport(JSContext* cx, Handle<ModuleObject*> module, // Step 9. Return starResolution. result.setObjectOrNull(starResolution); + if (!starResolution && errorInfoOut) { + errorInfoOut->setImportedModule(cx, module); + } return true; } @@ -759,10 +800,14 @@ static bool ModuleResolveExport(JSContext* cx, Handle<ModuleObject*> module, static bool SyntheticModuleResolveExport(JSContext* cx, Handle<ModuleObject*> module, Handle<JSAtom*> exportName, - MutableHandle<Value> result) { + MutableHandle<Value> result, + ModuleErrorInfo* errorInfoOut) { // Step 2. If module.[[ExportNames]] does not contain exportName, return null. if (!ContainsElement(module->syntheticExportNames(), exportName)) { result.setNull(); + if (errorInfoOut) { + errorInfoOut->setImportedModule(cx, module); + } return true; } @@ -923,63 +968,93 @@ static ModuleNamespaceObject* ModuleNamespaceCreate( return ns; } -static void ThrowResolutionError(JSContext* cx, Handle<ModuleObject*> module, - Handle<Value> resolution, bool isDirectImport, - Handle<JSAtom*> name, uint32_t line, - JS::ColumnNumberOneOrigin column) { - MOZ_ASSERT(line != 0); +void ModuleErrorInfo::setImportedModule(JSContext* cx, + ModuleObject* importedModule) { + imported = importedModule->filename(); +} - bool isAmbiguous = resolution == StringValue(cx->names().ambiguous); +void ModuleErrorInfo::setCircularImport(JSContext* cx, + ModuleObject* importedModule) { + setImportedModule(cx, importedModule); + isCircular = true; +} - // ErrorNumbers: - // | MISSING | AMBIGUOUS | - // ---------+---------+-----------+ - // INDIRECT | - // DIRECT | - static constexpr unsigned ErrorNumbers[2][2] = { - {JSMSG_MISSING_INDIRECT_EXPORT, JSMSG_AMBIGUOUS_INDIRECT_EXPORT}, - {JSMSG_MISSING_IMPORT, JSMSG_AMBIGUOUS_IMPORT}}; - unsigned errorNumber = ErrorNumbers[isDirectImport][isAmbiguous]; - - const JSErrorFormatString* errorString = - GetErrorMessage(nullptr, errorNumber); - MOZ_ASSERT(errorString); - - MOZ_ASSERT(errorString->argCount == 0); - Rooted<JSString*> message(cx, JS_NewStringCopyZ(cx, errorString->format)); - if (!message) { +void ModuleErrorInfo::setForAmbiguousImport(JSContext* cx, + ModuleObject* importedModule, + ModuleObject* module1, + ModuleObject* module2) { + setImportedModule(cx, importedModule); + entry1 = module1->filename(); + entry2 = module2->filename(); +} + +static void CreateErrorNumberMessageUTF8(JSContext* cx, unsigned errorNumber, + JSErrorReport* reportOut, ...) { + va_list ap; + va_start(ap, reportOut); + AutoReportFrontendContext fc(cx); + if (!ExpandErrorArgumentsVA(&fc, GetErrorMessage, nullptr, errorNumber, + ArgumentsAreUTF8, reportOut, ap)) { + ReportOutOfMemory(cx); return; } - Rooted<JSString*> separator(cx, JS_NewStringCopyZ(cx, ": ")); - if (!separator) { + va_end(ap); +} + +static void ThrowResolutionError(JSContext* cx, Handle<ModuleObject*> module, + Handle<Value> resolution, Handle<JSAtom*> name, + ModuleErrorInfo* errorInfo) { + MOZ_ASSERT(errorInfo); + auto chars = StringToNewUTF8CharsZ(cx, *name); + if (!chars) { + ReportOutOfMemory(cx); return; } - message = ConcatStrings<CanGC>(cx, message, separator); - if (!message) { - return; + bool isAmbiguous = resolution == StringValue(cx->names().ambiguous); + + unsigned errorNumber; + if (errorInfo->isCircular) { + errorNumber = JSMSG_MODULE_CIRCULAR_IMPORT; + } else if (isAmbiguous) { + errorNumber = JSMSG_MODULE_AMBIGUOUS; + } else { + errorNumber = JSMSG_MODULE_NO_EXPORT; + } + + JSErrorReport report; + report.isWarning_ = false; + report.errorNumber = errorNumber; + + if (errorNumber == JSMSG_MODULE_AMBIGUOUS) { + CreateErrorNumberMessageUTF8(cx, errorNumber, &report, errorInfo->imported, + chars.get(), errorInfo->entry1, + errorInfo->entry2); + } else { + CreateErrorNumberMessageUTF8(cx, errorNumber, &report, errorInfo->imported, + chars.get()); } - message = ConcatStrings<CanGC>(cx, message, name); + Rooted<JSString*> message(cx, report.newMessageString(cx)); if (!message) { + ReportOutOfMemory(cx); return; } - RootedString filename(cx); - if (const char* chars = module->script()->filename()) { - filename = - JS_NewStringCopyUTF8Z(cx, JS::ConstUTF8CharsZ(chars, strlen(chars))); - } else { - filename = cx->names().empty_; - } + const char* file = module->filename(); + RootedString filename( + cx, JS_NewStringCopyUTF8Z(cx, JS::ConstUTF8CharsZ(file, strlen(file)))); if (!filename) { + ReportOutOfMemory(cx); return; } RootedValue error(cx); - if (!JS::CreateError(cx, JSEXN_SYNTAXERR, nullptr, filename, line, column, - nullptr, message, JS::NothingHandleValue, &error)) { + if (!JS::CreateError(cx, JSEXN_SYNTAXERR, nullptr, filename, + errorInfo->lineNumber, errorInfo->columnNumber, nullptr, + message, JS::NothingHandleValue, &error)) { + ReportOutOfMemory(cx); return; } @@ -988,8 +1063,8 @@ static void ThrowResolutionError(JSContext* cx, Handle<ModuleObject*> module, // https://tc39.es/ecma262/#sec-source-text-module-record-initialize-environment // ES2023 16.2.1.6.4 InitializeEnvironment -bool js::ModuleInitializeEnvironment(JSContext* cx, - Handle<ModuleObject*> module) { +static bool ModuleInitializeEnvironment(JSContext* cx, + Handle<ModuleObject*> module) { MOZ_ASSERT(module->status() == ModuleStatus::Linking); // Step 1. For each ExportEntry Record e of module.[[IndirectExportEntries]], @@ -1002,15 +1077,15 @@ bool js::ModuleInitializeEnvironment(JSContext* cx, // Step 1.b. Let resolution be ? module.ResolveExport(e.[[ExportName]]). exportName = e.exportName(); - if (!ModuleResolveExport(cx, module, exportName, &resolution)) { + ModuleErrorInfo errorInfo{e.lineNumber(), e.columnNumber()}; + if (!ModuleResolveExport(cx, module, exportName, &resolution, &errorInfo)) { return false; } // Step 1.c. If resolution is either null or AMBIGUOUS, throw a SyntaxError // exception. if (!IsResolvedBinding(cx, resolution)) { - ThrowResolutionError(cx, module, resolution, false, exportName, - e.lineNumber(), e.columnNumber()); + ThrowResolutionError(cx, module, resolution, exportName, &errorInfo); return false; } } @@ -1059,15 +1134,16 @@ bool js::ModuleInitializeEnvironment(JSContext* cx, // Step 7.d. Else: // Step 7.d.i. Let resolution be ? // importedModule.ResolveExport(in.[[ImportName]]). - if (!ModuleResolveExport(cx, importedModule, importName, &resolution)) { + ModuleErrorInfo errorInfo{in.lineNumber(), in.columnNumber()}; + if (!ModuleResolveExport(cx, importedModule, importName, &resolution, + &errorInfo)) { return false; } // Step 7.d.ii. If resolution is null or ambiguous, throw a SyntaxError // exception. if (!IsResolvedBinding(cx, resolution)) { - ThrowResolutionError(cx, module, resolution, true, importName, - in.lineNumber(), in.columnNumber()); + ThrowResolutionError(cx, module, resolution, importName, &errorInfo); return false; } @@ -1134,7 +1210,7 @@ bool js::ModuleInitializeEnvironment(JSContext* cx, // https://tc39.es/ecma262/#sec-moduledeclarationlinking // ES2023 16.2.1.5.1 Link -bool js::ModuleLink(JSContext* cx, Handle<ModuleObject*> module) { +static bool ModuleLink(JSContext* cx, Handle<ModuleObject*> module) { // Step 1. Assert: module.[[Status]] is not linking or evaluating. ModuleStatus status = module->status(); if (status == ModuleStatus::Linking || status == ModuleStatus::Evaluating) { @@ -1313,8 +1389,9 @@ static bool InnerModuleLinking(JSContext* cx, Handle<ModuleObject*> module, return true; } -bool js::SyntheticModuleEvaluate(JSContext* cx, Handle<ModuleObject*> moduleArg, - MutableHandle<Value> result) { +static bool SyntheticModuleEvaluate(JSContext* cx, + Handle<ModuleObject*> moduleArg, + MutableHandle<Value> result) { // Steps 1-12 happens elsewhere in the engine. // Step 13. Let pc be ! NewPromiseCapability(%Promise%). @@ -1337,8 +1414,8 @@ bool js::SyntheticModuleEvaluate(JSContext* cx, Handle<ModuleObject*> moduleArg, // https://tc39.es/ecma262/#sec-moduleevaluation // ES2023 16.2.1.5.2 Evaluate -bool js::ModuleEvaluate(JSContext* cx, Handle<ModuleObject*> moduleArg, - MutableHandle<Value> result) { +static bool ModuleEvaluate(JSContext* cx, Handle<ModuleObject*> moduleArg, + MutableHandle<Value> result) { Rooted<ModuleObject*> module(cx, moduleArg); // Step 2. Assert: module.[[Status]] is linked, evaluating-async, or diff --git a/js/src/vm/Modules.h b/js/src/vm/Modules.h index 21aff46b90..d59c9db552 100644 --- a/js/src/vm/Modules.h +++ b/js/src/vm/Modules.h @@ -20,22 +20,32 @@ namespace js { using ModuleVector = GCVector<ModuleObject*, 0, SystemAllocPolicy>; -bool ModuleResolveExport(JSContext* cx, Handle<ModuleObject*> module, - Handle<JSAtom*> exportName, - MutableHandle<Value> result); +// A struct with detailed error information when import/export failed. +struct ModuleErrorInfo { + ModuleErrorInfo(uint32_t lineNumber_, JS::ColumnNumberOneOrigin columnNumber_) + : lineNumber(lineNumber_), columnNumber(columnNumber_) {} -ModuleNamespaceObject* GetOrCreateModuleNamespace(JSContext* cx, - Handle<ModuleObject*> module); + void setImportedModule(JSContext* cx, ModuleObject* importedModule); + void setCircularImport(JSContext* cx, ModuleObject* importedModule); + void setForAmbiguousImport(JSContext* cx, ModuleObject* importedModule, + ModuleObject* module1, ModuleObject* module2); + + uint32_t lineNumber; + JS::ColumnNumberOneOrigin columnNumber; -bool ModuleInitializeEnvironment(JSContext* cx, Handle<ModuleObject*> module); + // The filename of the imported module. + const char* imported; -bool ModuleLink(JSContext* cx, Handle<ModuleObject*> module); + // The filenames of the ambiguous entries. + const char* entry1; + const char* entry2; -// Start evaluating the module. If TLA is enabled, result will be a promise. -bool ModuleEvaluate(JSContext* cx, Handle<ModuleObject*> module, - MutableHandle<Value> result); -bool SyntheticModuleEvaluate(JSContext* cx, Handle<ModuleObject*> module, - MutableHandle<Value> result); + // A bool to indicate the error is a circular import when it's true. + bool isCircular = false; +}; + +ModuleNamespaceObject* GetOrCreateModuleNamespace(JSContext* cx, + Handle<ModuleObject*> module); void AsyncModuleExecutionFulfilled(JSContext* cx, Handle<ModuleObject*> module); diff --git a/js/src/vm/NativeObject.cpp b/js/src/vm/NativeObject.cpp index 640a185981..19f8b94bb6 100644 --- a/js/src/vm/NativeObject.cpp +++ b/js/src/vm/NativeObject.cpp @@ -307,20 +307,26 @@ mozilla::Maybe<PropertyInfo> js::NativeObject::lookupPure(jsid id) { return mozilla::Nothing(); } -bool NativeObject::setUniqueId(JSContext* cx, uint64_t uid) { +bool NativeObject::setUniqueId(JSRuntime* runtime, uint64_t uid) { MOZ_ASSERT(!hasUniqueId()); MOZ_ASSERT(!gc::HasUniqueId(this)); - return setOrUpdateUniqueId(cx, uid); + Nursery& nursery = runtime->gc.nursery(); + if (!hasDynamicSlots() && !allocateSlots(nursery, 0)) { + return false; + } + + getSlotsHeader()->setUniqueId(uid); + return true; } bool NativeObject::setOrUpdateUniqueId(JSContext* cx, uint64_t uid) { - if (!hasDynamicSlots() && !allocateSlots(cx, 0)) { + if (!hasDynamicSlots() && !allocateSlots(cx->nursery(), 0)) { + ReportOutOfMemory(cx); return false; } getSlotsHeader()->setUniqueId(uid); - return true; } @@ -337,7 +343,12 @@ bool NativeObject::growSlots(JSContext* cx, uint32_t oldCapacity, MOZ_ASSERT(newCapacity <= MAX_SLOTS_COUNT); if (!hasDynamicSlots()) { - return allocateSlots(cx, newCapacity); + if (!allocateSlots(cx->nursery(), newCapacity)) { + ReportOutOfMemory(cx); + return false; + } + + return true; } uint64_t uid = maybeUniqueId(); @@ -415,7 +426,7 @@ bool NativeObject::allocateInitialSlots(JSContext* cx, uint32_t capacity) { return true; } -bool NativeObject::allocateSlots(JSContext* cx, uint32_t newCapacity) { +bool NativeObject::allocateSlots(Nursery& nursery, uint32_t newCapacity) { MOZ_ASSERT(!hasUniqueId()); MOZ_ASSERT(!hasDynamicSlots()); @@ -423,7 +434,8 @@ bool NativeObject::allocateSlots(JSContext* cx, uint32_t newCapacity) { uint32_t dictionarySpan = getSlotsHeader()->dictionarySlotSpan(); - HeapSlot* allocation = AllocateCellBuffer<HeapSlot>(cx, this, newAllocated); + HeapSlot* allocation = + AllocateCellBuffer<HeapSlot>(nursery, this, newAllocated); if (!allocation) { return false; } diff --git a/js/src/vm/NativeObject.h b/js/src/vm/NativeObject.h index 8312310219..18ca0b656e 100644 --- a/js/src/vm/NativeObject.h +++ b/js/src/vm/NativeObject.h @@ -987,7 +987,7 @@ class NativeObject : public JSObject { bool growSlotsForNewSlot(JSContext* cx, uint32_t numFixed, uint32_t slot); void shrinkSlots(JSContext* cx, uint32_t oldCapacity, uint32_t newCapacity); - bool allocateSlots(JSContext* cx, uint32_t newCapacity); + bool allocateSlots(Nursery& nursery, uint32_t newCapacity); /* * This method is static because it's called from JIT code. On OOM, returns @@ -1257,7 +1257,7 @@ class NativeObject : public JSObject { return UndefinedValue(); } - [[nodiscard]] bool setUniqueId(JSContext* cx, uint64_t uid); + [[nodiscard]] bool setUniqueId(JSRuntime* runtime, uint64_t uid); inline bool hasUniqueId() const { return getSlotsHeader()->hasUniqueId(); } inline uint64_t uniqueId() const { return getSlotsHeader()->uniqueId(); } inline uint64_t maybeUniqueId() const { diff --git a/js/src/vm/PortableBaselineInterpret.cpp b/js/src/vm/PortableBaselineInterpret.cpp index 2990942dc6..2588f12009 100644 --- a/js/src/vm/PortableBaselineInterpret.cpp +++ b/js/src/vm/PortableBaselineInterpret.cpp @@ -1373,9 +1373,13 @@ ICInterpretOps(BaselineFrame* frame, VMFrameManager& frameMgr, State& state, CACHEOP_CASE(LoadWrapperTarget) { ObjOperandId objId = icregs.cacheIRReader.objOperandId(); ObjOperandId resultId = icregs.cacheIRReader.objOperandId(); + bool fallible = icregs.cacheIRReader.readBool(); BOUNDSCHECK(resultId); JSObject* obj = reinterpret_cast<JSObject*>(icregs.icVals[objId.id()]); - JSObject* target = &obj->as<ProxyObject>().private_().toObject(); + JSObject* target = obj->as<ProxyObject>().private_().toObjectOrNull(); + if (fallible && !target) { + return ICInterpretOpResult::NextIC; + } icregs.icVals[resultId.id()] = reinterpret_cast<uintptr_t>(target); DISPATCH_CACHEOP(); } diff --git a/js/src/vm/RealmFuses.cpp b/js/src/vm/RealmFuses.cpp index 3ceac2dd25..8f7a7801cc 100644 --- a/js/src/vm/RealmFuses.cpp +++ b/js/src/vm/RealmFuses.cpp @@ -11,6 +11,27 @@ #include "vm/Realm.h" #include "vm/SelfHosting.h" +void js::InvalidatingRealmFuse::popFuse(JSContext* cx, RealmFuses& realmFuses) { + InvalidatingFuse::popFuse(cx); + + for (auto& fd : realmFuses.fuseDependencies) { + fd.invalidateForFuse(cx, this); + } +} + +bool js::InvalidatingRealmFuse::addFuseDependency(JSContext* cx, + Handle<JSScript*> script) { + MOZ_ASSERT(script->realm() == cx->realm()); + auto* dss = + cx->realm()->realmFuses.fuseDependencies.getOrCreateDependentScriptSet( + cx, this); + if (!dss) { + return false; + } + + return dss->addScriptForFuse(this, script); +} + void js::PopsOptimizedGetIteratorFuse::popFuse(JSContext* cx, RealmFuses& realmFuses) { // Pop Self. diff --git a/js/src/vm/RealmFuses.h b/js/src/vm/RealmFuses.h index 54fa7bc3bf..a14ff73c59 100644 --- a/js/src/vm/RealmFuses.h +++ b/js/src/vm/RealmFuses.h @@ -8,6 +8,7 @@ #define vm_RealmFuses_h #include "vm/GuardFuse.h" +#include "vm/InvalidatingFuse.h" namespace js { @@ -28,7 +29,19 @@ class RealmFuse : public GuardFuse { virtual void popFuse(JSContext* cx) override { GuardFuse::popFuse(cx); } }; -struct OptimizeGetIteratorFuse final : public RealmFuse { +class InvalidatingRealmFuse : public InvalidatingFuse { + public: + virtual void popFuse(JSContext* cx, RealmFuses& realmFuses); + virtual bool addFuseDependency(JSContext* cx, + Handle<JSScript*> script) override; + + protected: + virtual void popFuse(JSContext* cx) override { + InvalidatingFuse::popFuse(cx); + } +}; + +struct OptimizeGetIteratorFuse final : public InvalidatingRealmFuse { virtual const char* name() override { return "OptimizeGetIteratorFuse"; } virtual bool checkInvariant(JSContext* cx) override; }; @@ -144,6 +157,8 @@ struct RealmFuses { MOZ_CRASH("Fuse Not Found"); } + DependentScriptGroup fuseDependencies; + static int32_t fuseOffsets[]; static const char* fuseNames[]; diff --git a/js/src/vm/Runtime.cpp b/js/src/vm/Runtime.cpp index 1c3611a6e5..d894bf57bf 100644 --- a/js/src/vm/Runtime.cpp +++ b/js/src/vm/Runtime.cpp @@ -332,7 +332,7 @@ void JSRuntime::addSizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf, rtSizes->uncompressedSourceCache += caches().uncompressedSourceCache.sizeOfExcludingThis(mallocSizeOf); - rtSizes->gc.nurseryCommitted += gc.nursery().committed(); + rtSizes->gc.nurseryCommitted += gc.nursery().totalCommitted(); rtSizes->gc.nurseryMallocedBuffers += gc.nursery().sizeOfMallocedBuffers(mallocSizeOf); gc.storeBuffer().addSizeOfExcludingThis(mallocSizeOf, &rtSizes->gc); diff --git a/js/src/vm/SelfHosting.cpp b/js/src/vm/SelfHosting.cpp index 32cdd4a335..5170b072fb 100644 --- a/js/src/vm/SelfHosting.cpp +++ b/js/src/vm/SelfHosting.cpp @@ -50,6 +50,7 @@ #include "frontend/FrontendContext.h" // AutoReportFrontendContext #include "jit/AtomicOperations.h" #include "jit/InlinableNatives.h" +#include "jit/TrampolineNatives.h" #include "js/CompilationAndEvaluation.h" #include "js/Conversions.h" #include "js/ErrorReport.h" // JS::PrintError @@ -900,7 +901,7 @@ static bool intrinsic_GeneratorSetClosed(JSContext* cx, unsigned argc, MOZ_ASSERT(args[0].isObject()); GeneratorObject* genObj = &args[0].toObject().as<GeneratorObject>(); - genObj->setClosed(); + genObj->setClosed(cx); return true; } @@ -1962,7 +1963,6 @@ static const JSFunctionSpec intrinsic_functions[] = { JS_INLINABLE_FN("ArrayIteratorPrototypeOptimizable", intrinsic_ArrayIteratorPrototypeOptimizable, 0, 0, IntrinsicArrayIteratorPrototypeOptimizable), - JS_FN("ArrayNativeSort", intrinsic_ArrayNativeSort, 1, 0), JS_FN("AssertionFailed", intrinsic_AssertionFailed, 1, 0), JS_FN("CallArrayBufferMethodIfWrapped", CallNonGenericSelfhostedMethod<Is<ArrayBufferObject>>, 2, 0), @@ -2336,6 +2336,7 @@ static const JSFunctionSpec intrinsic_functions[] = { JS_FN("std_Array_indexOf", array_indexOf, 1, 0), JS_FN("std_Array_lastIndexOf", array_lastIndexOf, 1, 0), JS_INLINABLE_FN("std_Array_pop", array_pop, 0, 0, ArrayPop), + JS_TRAMPOLINE_FN("std_Array_sort", array_sort, 1, 0, ArraySort), JS_FN("std_BigInt_valueOf", BigIntObject::valueOf, 0, 0), JS_FN("std_Date_now", date_now, 0, 0), JS_FN("std_Function_apply", fun_apply, 2, 0), diff --git a/js/src/vm/Stack.cpp b/js/src/vm/Stack.cpp index d222ddc51c..c8a8898d49 100644 --- a/js/src/vm/Stack.cpp +++ b/js/src/vm/Stack.cpp @@ -509,9 +509,8 @@ void JS::ProfilingFrameIterator::operator++() { void JS::ProfilingFrameIterator::settleFrames() { // Handle transition frames (see comment in JitFrameIter::operator++). - if (isJSJit() && !jsJitIter().done() && - jsJitIter().frameType() == jit::FrameType::WasmToJSJit) { - wasm::Frame* fp = (wasm::Frame*)jsJitIter().fp(); + if (isJSJit() && jsJitIter().done() && jsJitIter().wasmCallerFP()) { + wasm::Frame* fp = (wasm::Frame*)jsJitIter().wasmCallerFP(); iteratorDestroy(); new (storage()) wasm::ProfilingFrameIterator(fp); kind_ = Kind::Wasm; @@ -529,7 +528,6 @@ void JS::ProfilingFrameIterator::settleFrames() { new (storage()) jit::JSJitProfilingFrameIterator((jit::CommonFrameLayout*)fp); kind_ = Kind::JSJit; - MOZ_ASSERT(!jsJitIter().done()); maybeSetEndStackAddress(jsJitIter().endStackAddress()); return; } diff --git a/js/src/vm/StringType-inl.h b/js/src/vm/StringType-inl.h index 8954a46aac..4548e5d7ea 100644 --- a/js/src/vm/StringType-inl.h +++ b/js/src/vm/StringType-inl.h @@ -19,6 +19,7 @@ #include "vm/StaticStrings.h" #include "gc/GCContext-inl.h" +#include "gc/Marking-inl.h" #include "gc/StoreBuffer-inl.h" #include "vm/JSContext-inl.h" @@ -451,6 +452,20 @@ void JSLinearString::disownCharsBecauseError() { d.s.u2.nonInlineCharsLatin1 = nullptr; } +inline JSLinearString* JSDependentString::rootBaseDuringMinorGC() { + JSLinearString* root = this; + while (MaybeForwarded(root)->hasBase()) { + if (root->isForwarded()) { + root = js::gc::StringRelocationOverlay::fromCell(root) + ->savedNurseryBaseOrRelocOverlay(); + } else { + // Possibly nursery or tenured string (not an overlay). + root = root->nurseryBaseOrRelocOverlay(); + } + } + return root; +} + template <js::AllowGC allowGC, typename CharT> MOZ_ALWAYS_INLINE JSLinearString* JSLinearString::new_( JSContext* cx, JS::MutableHandle<JSString::OwnedChars<CharT>> chars, @@ -530,6 +545,19 @@ inline js::PropertyName* JSLinearString::toPropertyName(JSContext* cx) { return atom->asPropertyName(); } +// String characters are movable in the following cases: +// +// 1. Inline nursery strings (moved during promotion) +// 2. Nursery strings with nursery chars (moved during promotion) +// 3. Nursery strings that are deduplicated (moved during promotion) +// 4. Inline tenured strings (moved during compaction) +// +// This method does not consider #3, because if this method returns true and the +// caller does not want the characters to move, it can fix them in place by +// setting the nondeduplicatable bit. (If the bit were already taken into +// consideration, then the caller wouldn't know whether the movability is +// "fixable" or not. If it is *only* movable because of the lack of the bit +// being set, then it is fixable by setting the bit.) bool JSLinearString::hasMovableChars() const { const JSLinearString* topBase = this; while (topBase->hasBase()) { diff --git a/js/src/vm/StringType.cpp b/js/src/vm/StringType.cpp index 63afd8864b..b735b91b71 100644 --- a/js/src/vm/StringType.cpp +++ b/js/src/vm/StringType.cpp @@ -380,9 +380,13 @@ void ForEachStringFlag(const JSString* str, uint32_t flags, KnownF known, static_assert(JSString::LINEAR_IS_EXTENSIBLE_BIT == JSString::INLINE_IS_FAT_BIT); if (str->isLinear()) { - known("EXTENSIBLE"); - } else if (str->isInline()) { - known("FAT"); + if (str->isInline()) { + known("FAT"); + } else if (!str->isAtom()) { + known("EXTENSIBLE"); + } else { + unknown(i); + } } else { unknown(i); } @@ -407,9 +411,6 @@ void ForEachStringFlag(const JSString* str, uint32_t flags, KnownF known, case JSString::INDEX_VALUE_BIT: known("INDEX_VALUE_BIT"); break; - case JSString::NON_DEDUP_BIT: - known("NON_DEDUP_BIT"); - break; case JSString::IN_STRING_TO_ATOM_CACHE: known("IN_STRING_TO_ATOM_CACHE"); break; @@ -417,7 +418,7 @@ void ForEachStringFlag(const JSString* str, uint32_t flags, KnownF known, if (str->isRope()) { known("FLATTEN_VISIT_RIGHT"); } else { - unknown(i); + known("NON_DEDUP_BIT"); } break; case JSString::FLATTEN_FINISH_NODE: @@ -638,11 +639,20 @@ static MOZ_ALWAYS_INLINE JSString::OwnedChars<CharT> AllocChars(JSContext* cx, MOZ_ASSERT(cx->nursery().isEnabled()); auto [buffer, isMalloced] = cx->nursery().allocateBuffer( cx->zone(), length * sizeof(CharT), js::StringBufferArena); + if (!buffer) { + ReportOutOfMemory(cx); + return {nullptr, 0, false, false}; + } return {static_cast<CharT*>(buffer), length, isMalloced, isMalloced}; } auto buffer = cx->make_pod_arena_array<CharT>(js::StringBufferArena, length); + if (!buffer) { + ReportOutOfMemory(cx); + return {nullptr, 0, false, false}; + } + return {std::move(buffer), length, true}; } @@ -914,6 +924,14 @@ JSLinearString* JSRope::flattenInternal(JSRope* root) { * JSDependentStrings pointing to them already. Stealing the buffer doesn't * change its address, only its owning JSExtensibleString, so all chars() * pointers in the JSDependentStrings are still valid. + * + * This chain of dependent strings could be problematic if the base string + * moves, either because it was initially allocated in the nursery or it + * gets deduplicated, because you might have a dependent -> + * tenured dependent -> nursery base string, and the store buffer would + * only capture the latter edge. Prevent this case from happening by + * marking the root as nondeduplicatable if the extensible string + * optimization applied. */ const size_t wholeLength = root->length(); size_t wholeCapacity; @@ -1068,8 +1086,12 @@ finish_root: left.setLengthAndFlags(left.length(), StringFlagsForCharType<CharT>(flags)); left.d.s.u3.base = &root->asLinear(); if (left.isTenured() && !root->isTenured()) { - // leftmost child -> root is a tenured -> nursery edge. + // leftmost child -> root is a tenured -> nursery edge. Put the leftmost + // child in the store buffer and prevent the root's chars from moving or + // being freed (because the leftmost child may have a tenured dependent + // string that cannot be updated.) root->storeBuffer()->putWholeCell(&left); + root->setNonDeduplicatable(); } } @@ -1455,16 +1477,18 @@ uint32_t JSAtom::getIndexSlow() const { : AtomCharsToIndex(twoByteChars(nogc), len); } -static void MarkStringAndBasesNonDeduplicatable(JSLinearString* s) { - while (true) { - if (!s->isTenured()) { - s->setNonDeduplicatable(); - } - if (!s->hasBase()) { - break; - } +// Prevent the actual owner of the string's characters from being deduplicated +// (and thus freeing its characters, which would invalidate the ASSC's chars +// pointer). Intermediate dependent strings on the chain can be deduplicated, +// since the base will be updated to the root base during tenuring anyway and +// the intermediates won't matter. +void PreventRootBaseDeduplication(JSLinearString* s) { + while (s->hasBase()) { s = s->base(); } + if (!s->isTenured()) { + s->setNonDeduplicatable(); + } } bool AutoStableStringChars::init(JSContext* cx, JSString* s) { @@ -1492,7 +1516,7 @@ bool AutoStableStringChars::init(JSContext* cx, JSString* s) { twoByteChars_ = linearString->rawTwoByteChars(); } - MarkStringAndBasesNonDeduplicatable(linearString); + PreventRootBaseDeduplication(linearString); s_ = linearString; return true; @@ -1518,7 +1542,7 @@ bool AutoStableStringChars::initTwoByte(JSContext* cx, JSString* s) { state_ = TwoByte; twoByteChars_ = linearString->rawTwoByteChars(); - MarkStringAndBasesNonDeduplicatable(linearString); + PreventRootBaseDeduplication(linearString); s_ = linearString; return true; diff --git a/js/src/vm/StringType.h b/js/src/vm/StringType.h index f2850c33a4..38dea85c60 100644 --- a/js/src/vm/StringType.h +++ b/js/src/vm/StringType.h @@ -407,8 +407,10 @@ class JSString : public js::gc::CellWithLengthAndFlags { static const uint32_t INDEX_VALUE_BIT = js::Bit(11); static const uint32_t INDEX_VALUE_SHIFT = 16; - // NON_DEDUP_BIT is used in string deduplication during tenuring. - static const uint32_t NON_DEDUP_BIT = js::Bit(12); + // NON_DEDUP_BIT is used in string deduplication during tenuring. This bit is + // shared with both FLATTEN_FINISH_NODE and ATOM_IS_PERMANENT_BIT, since it + // only applies to linear non-atoms. + static const uint32_t NON_DEDUP_BIT = js::Bit(15); // If IN_STRING_TO_ATOM_CACHE is set, this string had an entry in the // StringToAtomCache at some point. Note that GC can purge the cache without @@ -627,13 +629,27 @@ class JSString : public js::gc::CellWithLengthAndFlags { } MOZ_ALWAYS_INLINE - void setNonDeduplicatable() { setFlagBit(NON_DEDUP_BIT); } + void setNonDeduplicatable() { + MOZ_ASSERT(isLinear()); + MOZ_ASSERT(!isAtom()); + setFlagBit(NON_DEDUP_BIT); + } + // After copying a string from the nursery to the tenured heap, adjust bits + // that no longer apply. MOZ_ALWAYS_INLINE - void clearNonDeduplicatable() { clearFlagBit(NON_DEDUP_BIT); } + void clearBitsOnTenure() { + MOZ_ASSERT(!isAtom()); + clearFlagBit(NON_DEDUP_BIT | IN_STRING_TO_ATOM_CACHE); + } + // NON_DEDUP_BIT is only valid for linear non-atoms. MOZ_ALWAYS_INLINE - bool isDeduplicatable() { return !(flags() & NON_DEDUP_BIT); } + bool isDeduplicatable() { + MOZ_ASSERT(isLinear()); + MOZ_ASSERT(!isAtom()); + return !(flags() & NON_DEDUP_BIT); + } void setInStringToAtomCache() { MOZ_ASSERT(!isAtom()); @@ -659,6 +675,7 @@ class JSString : public js::gc::CellWithLengthAndFlags { inline bool canOwnDependentChars() const; + // Only called by the GC during nursery collection. inline void setBase(JSLinearString* newBase); void traceBase(JSTracer* trc); @@ -781,6 +798,8 @@ class JSString : public js::gc::CellWithLengthAndFlags { void traceChildren(JSTracer* trc); + inline void traceBaseFromStoreBuffer(JSTracer* trc); + // Override base class implementation to tell GC about permanent atoms. bool isPermanentAndMayBeShared() const { return isPermanentAtom(); } @@ -930,6 +949,7 @@ class JSLinearString : public JSString { friend class JS::AutoStableStringChars; friend class js::gc::TenuringTracer; friend class js::gc::CellAllocator; + friend class JSDependentString; // To allow access when used as base. /* Vacuous and therefore unimplemented. */ JSLinearString* ensureLinear(JSContext* cx) = delete; @@ -1138,6 +1158,13 @@ class JSDependentString : public JSLinearString { setNonInlineChars(chars + offset); } + inline JSLinearString* rootBaseDuringMinorGC(); + + template <typename CharT> + inline void sweepTypedAfterMinorGC(); + + inline void sweepAfterMinorGC(); + #if defined(DEBUG) || defined(JS_JITSPEW) || defined(JS_CACHEIR_SPEW) void dumpOwnRepresentationFields(js::JSONPrinter& json) const; #endif @@ -2260,14 +2287,17 @@ class StringRelocationOverlay : public RelocationOverlay { MOZ_ALWAYS_INLINE const CharT* savedNurseryChars() const; const MOZ_ALWAYS_INLINE JS::Latin1Char* savedNurseryCharsLatin1() const { + MOZ_ASSERT(!forwardingAddress()->as<JSString>()->hasBase()); return nurseryCharsLatin1; } const MOZ_ALWAYS_INLINE char16_t* savedNurseryCharsTwoByte() const { + MOZ_ASSERT(!forwardingAddress()->as<JSString>()->hasBase()); return nurseryCharsTwoByte; } JSLinearString* savedNurseryBaseOrRelocOverlay() const { + MOZ_ASSERT(forwardingAddress()->as<JSString>()->hasBase()); return nurseryBaseOrRelocOverlay; } diff --git a/js/src/vm/StructuredClone.cpp b/js/src/vm/StructuredClone.cpp index e2e67a2ee3..405c18670b 100644 --- a/js/src/vm/StructuredClone.cpp +++ b/js/src/vm/StructuredClone.cpp @@ -893,7 +893,7 @@ bool SCInput::readArray(T* p, size_t nelems) { // To avoid any way in which uninitialized data could escape, zero the array // if filling it failed. std::uninitialized_fill_n(p, nelems, 0); - return false; + return reportTruncated(); } swapFromLittleEndianInPlace(p, nelems); diff --git a/js/src/vm/TypedArrayObject-inl.h b/js/src/vm/TypedArrayObject-inl.h index 95ba7b23d4..ffb9a3c9f6 100644 --- a/js/src/vm/TypedArrayObject-inl.h +++ b/js/src/vm/TypedArrayObject-inl.h @@ -760,6 +760,26 @@ class ElementSpecific { } }; +inline gc::AllocKind js::FixedLengthTypedArrayObject::allocKindForTenure() + const { + // Fixed length typed arrays in the nursery may have a lazily allocated + // buffer. Make sure there is room for the array's fixed data when moving the + // array. + + if (hasBuffer()) { + return NativeObject::allocKindForTenure(); + } + + gc::AllocKind allocKind; + if (hasInlineElements()) { + allocKind = AllocKindForLazyBuffer(byteLength()); + } else { + allocKind = gc::GetGCObjectKind(getClass()); + } + + return gc::ForegroundToBackgroundAllocKind(allocKind); +} + /* static */ gc::AllocKind js::FixedLengthTypedArrayObject::AllocKindForLazyBuffer(size_t nbytes) { MOZ_ASSERT(nbytes <= INLINE_BUFFER_LIMIT); diff --git a/js/src/vm/TypedArrayObject.cpp b/js/src/vm/TypedArrayObject.cpp index 35a2237cd5..935a902abe 100644 --- a/js/src/vm/TypedArrayObject.cpp +++ b/js/src/vm/TypedArrayObject.cpp @@ -7,8 +7,10 @@ #include "vm/TypedArrayObject-inl.h" #include "vm/TypedArrayObject.h" +#include "mozilla/CheckedInt.h" #include "mozilla/FloatingPoint.h" #include "mozilla/IntegerTypeTraits.h" +#include "mozilla/Likely.h" #include "mozilla/PodOperations.h" #include "mozilla/TextUtils.h" @@ -39,6 +41,7 @@ #include "js/UniquePtr.h" #include "js/Wrapper.h" #include "util/DifferentialTesting.h" +#include "util/StringBuffer.h" #include "util/Text.h" #include "util/WindowsWrapper.h" #include "vm/ArrayBufferObject.h" @@ -114,6 +117,13 @@ static bool IsTypedArrayObject(HandleValue v) { return v.isObject() && v.toObject().is<TypedArrayObject>(); } +#ifdef NIGHTLY_BUILD +static bool IsUint8ArrayObject(HandleValue v) { + return IsTypedArrayObject(v) && + v.toObject().as<TypedArrayObject>().type() == Scalar::Uint8; +} +#endif + /* static */ bool TypedArrayObject::ensureHasBuffer(JSContext* cx, Handle<TypedArrayObject*> typedArray) { @@ -199,7 +209,6 @@ size_t FixedLengthTypedArrayObject::objectMoved(JSObject* obj, JSObject* old) { auto* newObj = &obj->as<FixedLengthTypedArrayObject>(); const auto* oldObj = &old->as<FixedLengthTypedArrayObject>(); MOZ_ASSERT(newObj->elementsRaw() == oldObj->elementsRaw()); - MOZ_ASSERT(obj->isTenured()); // Typed arrays with a buffer object do not need an update. if (oldObj->hasBuffer()) { @@ -233,13 +242,13 @@ size_t FixedLengthTypedArrayObject::objectMoved(JSObject* obj, JSObject* old) { constexpr size_t headerSize = dataOffset() + sizeof(HeapSlot); - // See AllocKindForLazyBuffer. - gc::AllocKind newAllocKind = obj->asTenured().getAllocKind(); + gc::AllocKind allocKind = oldObj->allocKindForTenure(); + MOZ_ASSERT_IF(obj->isTenured(), obj->asTenured().getAllocKind() == allocKind); MOZ_ASSERT_IF(nbytes == 0, - headerSize + sizeof(uint8_t) <= GetGCKindBytes(newAllocKind)); + headerSize + sizeof(uint8_t) <= GetGCKindBytes(allocKind)); if (nursery.isInside(buf) && - headerSize + nbytes <= GetGCKindBytes(newAllocKind)) { + headerSize + nbytes <= GetGCKindBytes(allocKind)) { MOZ_ASSERT(oldObj->hasInlineElements()); #ifdef DEBUG if (nbytes == 0) { @@ -2046,6 +2055,1083 @@ bool TypedArrayObject::copyWithin(JSContext* cx, unsigned argc, Value* vp) { TypedArrayObject::copyWithin_impl>(cx, args); } +#ifdef NIGHTLY_BUILD + +// Byte vector with large enough inline storage to allow constructing small +// typed arrays without extra heap allocations. +using ByteVector = + js::Vector<uint8_t, FixedLengthTypedArrayObject::INLINE_BUFFER_LIMIT>; + +static UniqueChars QuoteString(JSContext* cx, char16_t ch) { + Sprinter sprinter(cx); + if (!sprinter.init()) { + return nullptr; + } + + StringEscape esc{}; + js::EscapePrinter ep(sprinter, esc); + ep.putChar(ch); + + return sprinter.release(); +} + +/** + * FromHex ( string [ , maxLength ] ) + * + * https://tc39.es/proposal-arraybuffer-base64/spec/#sec-fromhex + */ +static bool FromHex(JSContext* cx, Handle<JSString*> string, size_t maxLength, + ByteVector& bytes, size_t* readLength) { + // Step 1. (Not applicable in our implementation.) + + // Step 2. + size_t length = string->length(); + + // Step 3. + if (length % 2 != 0) { + JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, + JSMSG_TYPED_ARRAY_BAD_HEX_STRING_LENGTH); + return false; + } + + JSLinearString* linear = string->ensureLinear(cx); + if (!linear) { + return false; + } + + // Step 4. (Not applicable in our implementation.) + MOZ_ASSERT(bytes.empty()); + + // Step 5. + size_t index = 0; + + // Step 6. + while (index < length && bytes.length() < maxLength) { + // Step 6.a. + char16_t c0 = linear->latin1OrTwoByteChar(index); + char16_t c1 = linear->latin1OrTwoByteChar(index + 1); + + // Step 6.b. + if (MOZ_UNLIKELY(!mozilla::IsAsciiHexDigit(c0) || + !mozilla::IsAsciiHexDigit(c1))) { + char16_t ch = !mozilla::IsAsciiHexDigit(c0) ? c0 : c1; + if (auto str = QuoteString(cx, ch)) { + JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, + JSMSG_TYPED_ARRAY_BAD_HEX_DIGIT, str.get()); + } + return false; + } + + // Step 6.c. + index += 2; + + // Step 6.d. + uint8_t byte = (mozilla::AsciiAlphanumericToNumber(c0) << 4) + + mozilla::AsciiAlphanumericToNumber(c1); + + // Step 6.e. + if (!bytes.append(byte)) { + return false; + } + } + + // Step 7. + *readLength = index; + return true; +} + +namespace Base64 { +static constexpr uint8_t InvalidChar = UINT8_MAX; + +static constexpr auto DecodeTable(const char (&alphabet)[65]) { + std::array<uint8_t, 128> result = {}; + + // Initialize all elements to InvalidChar. + for (auto& e : result) { + e = InvalidChar; + } + + // Map the base64 characters to their values. + for (uint8_t i = 0; i < 64; ++i) { + result[alphabet[i]] = i; + } + + return result; +} +} // namespace Base64 + +namespace Base64::Encode { +static constexpr const char Base64[] = + "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; +static_assert(std::char_traits<char>::length(Base64) == 64); + +static constexpr const char Base64Url[] = + "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; +static_assert(std::char_traits<char>::length(Base64Url) == 64); +} // namespace Base64::Encode + +namespace Base64::Decode { +static constexpr auto Base64 = DecodeTable(Base64::Encode::Base64); +static_assert(Base64.size() == 128, + "128 elements to allow access through ASCII characters"); + +static constexpr auto Base64Url = DecodeTable(Base64::Encode::Base64Url); +static_assert(Base64Url.size() == 128, + "128 elements to allow access through ASCII characters"); +} // namespace Base64::Decode + +enum class Alphabet { + /** + * Standard base64 alphabet. + */ + Base64, + + /** + * URL and filename safe base64 alphabet. + */ + Base64Url, +}; + +enum class LastChunkHandling { + /** + * Allow partial chunks at the end of the input. + */ + Loose, + + /** + * Disallow partial chunks at the end of the input. + */ + Strict, + + /** + * Stop before partial chunks at the end of the input. + */ + StopBeforePartial, +}; + +/** + * FromBase64 ( string, alphabet, lastChunkHandling [ , maxLength ] ) + * + * https://tc39.es/proposal-arraybuffer-base64/spec/#sec-frombase64 + */ +static bool FromBase64(JSContext* cx, Handle<JSString*> string, + Alphabet alphabet, LastChunkHandling lastChunkHandling, + size_t maxLength, ByteVector& bytes, + size_t* readLength) { + // Steps 1-2. (Not applicable in our implementation.) + + // Step 3. + size_t remaining = maxLength; + if (remaining == 0) { + MOZ_ASSERT(bytes.empty()); + *readLength = 0; + return true; + } + + JSLinearString* linear = string->ensureLinear(cx); + if (!linear) { + return false; + } + + // DecodeBase64Chunk ( chunk [ , throwOnExtraBits ] ) + // + // Encode a complete base64 chunk. + auto decodeChunk = [&](uint32_t chunk) { + MOZ_ASSERT(chunk <= 0xffffff); + MOZ_ASSERT(remaining >= 3); + + if (!bytes.reserve(bytes.length() + 3)) { + return false; + } + bytes.infallibleAppend(chunk >> 16); + bytes.infallibleAppend(chunk >> 8); + bytes.infallibleAppend(chunk); + return true; + }; + + // DecodeBase64Chunk ( chunk [ , throwOnExtraBits ] ) + // + // Encode a three element partial base64 chunk. + auto decodeChunk3 = [&](uint32_t chunk, bool throwOnExtraBits) { + MOZ_ASSERT(chunk <= 0x3ffff); + MOZ_ASSERT(remaining >= 2); + + if (throwOnExtraBits && (chunk & 0x3) != 0) { + JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, + JSMSG_TYPED_ARRAY_EXTRA_BASE64_BITS); + return false; + } + + if (!bytes.reserve(bytes.length() + 2)) { + return false; + } + bytes.infallibleAppend(chunk >> 10); + bytes.infallibleAppend(chunk >> 2); + return true; + }; + + // DecodeBase64Chunk ( chunk [ , throwOnExtraBits ] ) + // + // Encode a two element partial base64 chunk. + auto decodeChunk2 = [&](uint32_t chunk, bool throwOnExtraBits) { + MOZ_ASSERT(chunk <= 0xfff); + MOZ_ASSERT(remaining >= 1); + + if (throwOnExtraBits && (chunk & 0xf) != 0) { + JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, + JSMSG_TYPED_ARRAY_EXTRA_BASE64_BITS); + return false; + } + + if (!bytes.reserve(bytes.length() + 1)) { + return false; + } + bytes.infallibleAppend(chunk >> 4); + return true; + }; + + // DecodeBase64Chunk ( chunk [ , throwOnExtraBits ] ) + // + // Encode a partial base64 chunk. + auto decodePartialChunk = [&](uint32_t chunk, uint32_t chunkLength, + bool throwOnExtraBits = false) { + MOZ_ASSERT(chunkLength == 2 || chunkLength == 3); + return chunkLength == 2 ? decodeChunk2(chunk, throwOnExtraBits) + : decodeChunk3(chunk, throwOnExtraBits); + }; + + // Step 4. + // + // String index after the last fully read base64 chunk. + size_t read = 0; + + // Step 5. + MOZ_ASSERT(bytes.empty()); + + // Step 6. + // + // Current base64 chunk, a uint24 number. + uint32_t chunk = 0; + + // Step 7. + // + // Current base64 chunk length, in the range [0..4]. + size_t chunkLength = 0; + + // Step 8. + // + // Current string index. + size_t index = 0; + + // Step 9. + size_t length = linear->length(); + + const auto& decode = alphabet == Alphabet::Base64 ? Base64::Decode::Base64 + : Base64::Decode::Base64Url; + + // Step 10. + for (; index < length; index++) { + // Step 10.c. (Reordered) + char16_t ch = linear->latin1OrTwoByteChar(index); + + // Step 10.a. + if (mozilla::IsAsciiWhitespace(ch)) { + continue; + } + + // Step 10.b. (Moved out of loop.) + + // Step 10.d. (Performed in for-loop step.) + + // Step 10.e. + if (ch == '=') { + break; + } + + // Steps 10.f-g. + uint8_t value = Base64::InvalidChar; + if (mozilla::IsAscii(ch)) { + value = decode[ch]; + } + if (MOZ_UNLIKELY(value == Base64::InvalidChar)) { + if (auto str = QuoteString(cx, ch)) { + JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, + JSMSG_TYPED_ARRAY_BAD_BASE64_CHAR, str.get()); + } + return false; + } + + // Step 10.h. (Not applicable in our implementation.) + + // Step 10.i. + if ((remaining == 1 && chunkLength == 2) || + (remaining == 2 && chunkLength == 3)) { + *readLength = read; + return true; + } + + // Step 10.j. + chunk = (chunk << 6) | value; + + // Step 10.k. + chunkLength += 1; + + // Step 10.l. + if (chunkLength == 4) { + // Step 10.l.i. + if (!decodeChunk(chunk)) { + return false; + } + + // Step 10.l.ii. + chunk = 0; + + // Step 10.l.iii. + chunkLength = 0; + + // Step 10.l.iv. + // + // NB: Add +1 to include the |index| update from step 10.d. + read = index + 1; + + // Step 10.l.v. + MOZ_ASSERT(remaining >= 3); + remaining -= 3; + if (remaining == 0) { + *readLength = read; + return true; + } + } + } + + // Step 10.b. + if (index == length) { + // Step 10.b.i. + if (chunkLength > 0) { + // Step 10.b.i.1. + if (lastChunkHandling == LastChunkHandling::StopBeforePartial) { + *readLength = read; + return true; + } + + // Steps 10.b.i.2-3. + if (lastChunkHandling == LastChunkHandling::Loose) { + // Step 10.b.i.2.a. + if (chunkLength == 1) { + JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, + JSMSG_TYPED_ARRAY_BAD_INCOMPLETE_CHUNK); + return false; + } + MOZ_ASSERT(chunkLength == 2 || chunkLength == 3); + + // Step 10.b.i.2.b. + if (!decodePartialChunk(chunk, chunkLength)) { + return false; + } + } else { + // Step 10.b.i.3.a. + MOZ_ASSERT(lastChunkHandling == LastChunkHandling::Strict); + + // Step 10.b.i.3.b. + JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, + JSMSG_TYPED_ARRAY_BAD_INCOMPLETE_CHUNK); + return false; + } + } + + // Step 10.b.ii. + *readLength = length; + return true; + } + + // Step 10.e. + MOZ_ASSERT(index < length); + MOZ_ASSERT(linear->latin1OrTwoByteChar(index) == '='); + + // Step 10.e.i. + if (chunkLength < 2) { + JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, + JSMSG_TYPED_ARRAY_BAD_INCOMPLETE_CHUNK); + return false; + } + MOZ_ASSERT(chunkLength == 2 || chunkLength == 3); + + // Step 10.e.ii. (Inlined SkipAsciiWhitespace) + while (++index < length) { + char16_t ch = linear->latin1OrTwoByteChar(index); + if (!mozilla::IsAsciiWhitespace(ch)) { + break; + } + } + + // Step 10.e.iii. + if (chunkLength == 2) { + // Step 10.e.iii.1. + if (index == length) { + // Step 10.e.iii.1.a. + if (lastChunkHandling == LastChunkHandling::StopBeforePartial) { + *readLength = read; + return true; + } + + // Step 10.e.iii.1.b. + JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, + JSMSG_TYPED_ARRAY_MISSING_BASE64_PADDING); + return false; + } + + // Step 10.e.iii.2. + char16_t ch = linear->latin1OrTwoByteChar(index); + + // Step 10.e.iii.3. + if (ch == '=') { + // Step 10.e.iii.3.a. (Inlined SkipAsciiWhitespace) + while (++index < length) { + char16_t ch = linear->latin1OrTwoByteChar(index); + if (!mozilla::IsAsciiWhitespace(ch)) { + break; + } + } + } + } + + // Step 10.e.iv. + if (index < length) { + char16_t ch = linear->latin1OrTwoByteChar(index); + if (auto str = QuoteString(cx, ch)) { + JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, + JSMSG_TYPED_ARRAY_BAD_BASE64_AFTER_PADDING, + str.get()); + } + return false; + } + + // Steps 10.e.v-vi. + bool throwOnExtraBits = lastChunkHandling == LastChunkHandling::Strict; + + // Step 10.e.vii. + if (!decodePartialChunk(chunk, chunkLength, throwOnExtraBits)) { + return false; + } + + // Step 10.e.viii. + *readLength = length; + return true; +} + +/** + * Uint8Array.fromBase64 ( string [ , options ] ) + * Uint8Array.prototype.setFromBase64 ( string [ , options ] ) + * Uint8Array.prototype.toBase64 ( [ options ] ) + * + * Helper to retrieve the "alphabet" option. + */ +static bool GetAlphabetOption(JSContext* cx, Handle<JSObject*> options, + Alphabet* result) { + Rooted<Value> value(cx); + if (!GetProperty(cx, options, options, cx->names().alphabet, &value)) { + return false; + } + + if (value.isUndefined()) { + *result = Alphabet::Base64; + return true; + } + + if (!value.isString()) { + return ReportValueError(cx, JSMSG_UNEXPECTED_TYPE, JSDVG_IGNORE_STACK, + value, nullptr, "not a string"); + } + + auto* linear = value.toString()->ensureLinear(cx); + if (!linear) { + return false; + } + + if (StringEqualsAscii(linear, "base64")) { + *result = Alphabet::Base64; + return true; + } + + if (StringEqualsAscii(linear, "base64url")) { + *result = Alphabet::Base64Url; + return true; + } + + JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, + JSMSG_TYPED_ARRAY_BAD_BASE64_ALPHABET); + return false; +} + +/** + * Uint8Array.fromBase64 ( string [ , options ] ) + * Uint8Array.prototype.setFromBase64 ( string [ , options ] ) + * + * Helper to retrieve the "lastChunkHandling" option. + */ +static bool GetLastChunkHandlingOption(JSContext* cx, Handle<JSObject*> options, + LastChunkHandling* result) { + Rooted<Value> value(cx); + if (!GetProperty(cx, options, options, cx->names().lastChunkHandling, + &value)) { + return false; + } + + if (value.isUndefined()) { + *result = LastChunkHandling::Loose; + return true; + } + + if (!value.isString()) { + return ReportValueError(cx, JSMSG_UNEXPECTED_TYPE, JSDVG_IGNORE_STACK, + value, nullptr, "not a string"); + } + + auto* linear = value.toString()->ensureLinear(cx); + if (!linear) { + return false; + } + + if (StringEqualsAscii(linear, "loose")) { + *result = LastChunkHandling::Loose; + return true; + } + + if (StringEqualsAscii(linear, "strict")) { + *result = LastChunkHandling::Strict; + return true; + } + + if (StringEqualsAscii(linear, "stop-before-partial")) { + *result = LastChunkHandling::StopBeforePartial; + return true; + } + + JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, + JSMSG_TYPED_ARRAY_BAD_BASE64_LAST_CHUNK_HANDLING); + return false; +} + +/** + * Uint8Array.fromBase64 ( string [ , options ] ) + * + * https://tc39.es/proposal-arraybuffer-base64/spec/#sec-uint8array.frombase64 + */ +static bool uint8array_fromBase64(JSContext* cx, unsigned argc, Value* vp) { + CallArgs args = CallArgsFromVp(argc, vp); + + // Step 1. + if (!args.get(0).isString()) { + return ReportValueError(cx, JSMSG_UNEXPECTED_TYPE, JSDVG_SEARCH_STACK, + args.get(0), nullptr, "not a string"); + } + Rooted<JSString*> string(cx, args[0].toString()); + + // Steps 2-9. + auto alphabet = Alphabet::Base64; + auto lastChunkHandling = LastChunkHandling::Loose; + if (args.hasDefined(1)) { + // Step 2. (Inlined GetOptionsObject) + Rooted<JSObject*> options( + cx, RequireObjectArg(cx, "options", "fromBase64", args[1])); + if (!options) { + return false; + } + + // Steps 3-6. + if (!GetAlphabetOption(cx, options, &alphabet)) { + return false; + } + + // Steps 7-9. + if (!GetLastChunkHandlingOption(cx, options, &lastChunkHandling)) { + return false; + } + } + + // Step 10. + constexpr size_t maxLength = std::numeric_limits<size_t>::max(); + ByteVector bytes(cx); + size_t unusedReadLength; + if (!FromBase64(cx, string, alphabet, lastChunkHandling, maxLength, bytes, + &unusedReadLength)) { + return false; + } + + // Step 11. + size_t resultLength = bytes.length(); + + // Step 12. + auto* tarray = + TypedArrayObjectTemplate<uint8_t>::fromLength(cx, resultLength); + if (!tarray) { + return false; + } + + // Step 13. + auto target = SharedMem<uint8_t*>::unshared(tarray->dataPointerUnshared()); + auto source = SharedMem<uint8_t*>::unshared(bytes.begin()); + UnsharedOps::podCopy(target, source, resultLength); + + // Step 14. + args.rval().setObject(*tarray); + return true; +} + +/** + * Uint8Array.fromHex ( string ) + * + * https://tc39.es/proposal-arraybuffer-base64/spec/#sec-uint8array.fromhex + */ +static bool uint8array_fromHex(JSContext* cx, unsigned argc, Value* vp) { + CallArgs args = CallArgsFromVp(argc, vp); + + // Step 1. + if (!args.get(0).isString()) { + return ReportValueError(cx, JSMSG_UNEXPECTED_TYPE, JSDVG_SEARCH_STACK, + args.get(0), nullptr, "not a string"); + } + Rooted<JSString*> string(cx, args[0].toString()); + + // Step 2. + constexpr size_t maxLength = std::numeric_limits<size_t>::max(); + ByteVector bytes(cx); + size_t unusedReadLength; + if (!FromHex(cx, string, maxLength, bytes, &unusedReadLength)) { + return false; + } + + // Step 3. + size_t resultLength = bytes.length(); + + // Step 4. + auto* tarray = + TypedArrayObjectTemplate<uint8_t>::fromLength(cx, resultLength); + if (!tarray) { + return false; + } + + // Step 5. + auto target = SharedMem<uint8_t*>::unshared(tarray->dataPointerUnshared()); + auto source = SharedMem<uint8_t*>::unshared(bytes.begin()); + UnsharedOps::podCopy(target, source, resultLength); + + // Step 6. + args.rval().setObject(*tarray); + return true; +} + +/** + * Uint8Array.prototype.setFromBase64 ( string [ , options ] ) + * + * https://tc39.es/proposal-arraybuffer-base64/spec/#sec-uint8array.prototype.setfrombase64 + */ +static bool uint8array_setFromBase64(JSContext* cx, const CallArgs& args) { + Rooted<TypedArrayObject*> tarray( + cx, &args.thisv().toObject().as<TypedArrayObject>()); + + // Step 3. + if (!args.get(0).isString()) { + return ReportValueError(cx, JSMSG_UNEXPECTED_TYPE, JSDVG_SEARCH_STACK, + args.get(0), nullptr, "not a string"); + } + Rooted<JSString*> string(cx, args[0].toString()); + + // Steps 4-11. + auto alphabet = Alphabet::Base64; + auto lastChunkHandling = LastChunkHandling::Loose; + if (args.hasDefined(1)) { + // Step 2. (Inlined GetOptionsObject) + Rooted<JSObject*> options( + cx, RequireObjectArg(cx, "options", "setFromBase64", args[1])); + if (!options) { + return false; + } + + // Steps 3-6. + if (!GetAlphabetOption(cx, options, &alphabet)) { + return false; + } + + // Steps 7-9. + if (!GetLastChunkHandlingOption(cx, options, &lastChunkHandling)) { + return false; + } + } + + // Steps 12-14. + auto length = tarray->length(); + if (!length) { + ReportOutOfBounds(cx, tarray); + return false; + } + + // Step 15. + size_t maxLength = *length; + + // Steps 16-17. + ByteVector bytes(cx); + size_t readLength; + if (!FromBase64(cx, string, alphabet, lastChunkHandling, maxLength, bytes, + &readLength)) { + return false; + } + + // Step 18. + size_t written = bytes.length(); + + // Step 19. + // + // The underlying buffer has neither been detached nor shrunk. (It may have + // been grown when it's a growable shared buffer and a concurrent thread + // resized the buffer.) + MOZ_ASSERT(!tarray->hasDetachedBuffer()); + MOZ_ASSERT(tarray->length().valueOr(0) >= *length); + + // Step 20. + MOZ_ASSERT(written <= *length); + + // Step 21. (Inlined SetUint8ArrayBytes) + auto target = tarray->dataPointerEither().cast<uint8_t*>(); + auto source = SharedMem<uint8_t*>::unshared(bytes.begin()); + if (tarray->isSharedMemory()) { + SharedOps::podCopy(target, source, written); + } else { + UnsharedOps::podCopy(target, source, written); + } + + // Step 22. + Rooted<PlainObject*> result(cx, NewPlainObject(cx)); + if (!result) { + return false; + } + + // Step 23. + Rooted<Value> readValue(cx, NumberValue(readLength)); + if (!DefineDataProperty(cx, result, cx->names().read, readValue)) { + return false; + } + + // Step 24. + Rooted<Value> writtenValue(cx, NumberValue(written)); + if (!DefineDataProperty(cx, result, cx->names().written, writtenValue)) { + return false; + } + + // Step 25. + args.rval().setObject(*result); + return true; +} + +/** + * Uint8Array.prototype.setFromBase64 ( string [ , options ] ) + * + * https://tc39.es/proposal-arraybuffer-base64/spec/#sec-uint8array.prototype.setfrombase64 + */ +static bool uint8array_setFromBase64(JSContext* cx, unsigned argc, Value* vp) { + CallArgs args = CallArgsFromVp(argc, vp); + + // Steps 1-2. + return CallNonGenericMethod<IsUint8ArrayObject, uint8array_setFromBase64>( + cx, args); +} + +/** + * Uint8Array.prototype.setFromHex ( string ) + * + * https://tc39.es/proposal-arraybuffer-base64/spec/#sec-uint8array.prototype.setfromhex + */ +static bool uint8array_setFromHex(JSContext* cx, const CallArgs& args) { + Rooted<TypedArrayObject*> tarray( + cx, &args.thisv().toObject().as<TypedArrayObject>()); + + // Step 3. + if (!args.get(0).isString()) { + return ReportValueError(cx, JSMSG_UNEXPECTED_TYPE, JSDVG_SEARCH_STACK, + args.get(0), nullptr, "not a string"); + } + Rooted<JSString*> string(cx, args[0].toString()); + + // Steps 4-6. + auto length = tarray->length(); + if (!length) { + ReportOutOfBounds(cx, tarray); + return false; + } + + // Step 7. + size_t maxLength = *length; + + // Steps 8-9. + ByteVector bytes(cx); + size_t readLength; + if (!FromHex(cx, string, maxLength, bytes, &readLength)) { + return false; + } + + // Step 10. + size_t written = bytes.length(); + + // Step 11. + // + // The underlying buffer has neither been detached nor shrunk. (It may have + // been grown when it's a growable shared buffer and a concurrent thread + // resized the buffer.) + MOZ_ASSERT(!tarray->hasDetachedBuffer()); + MOZ_ASSERT(tarray->length().valueOr(0) >= *length); + + // Step 12. + MOZ_ASSERT(written <= *length); + + // Step 13. (Inlined SetUint8ArrayBytes) + auto target = tarray->dataPointerEither().cast<uint8_t*>(); + auto source = SharedMem<uint8_t*>::unshared(bytes.begin()); + if (tarray->isSharedMemory()) { + SharedOps::podCopy(target, source, written); + } else { + UnsharedOps::podCopy(target, source, written); + } + + // Step 14. + Rooted<PlainObject*> result(cx, NewPlainObject(cx)); + if (!result) { + return false; + } + + // Step 15. + Rooted<Value> readValue(cx, NumberValue(readLength)); + if (!DefineDataProperty(cx, result, cx->names().read, readValue)) { + return false; + } + + // Step 16. + Rooted<Value> writtenValue(cx, NumberValue(written)); + if (!DefineDataProperty(cx, result, cx->names().written, writtenValue)) { + return false; + } + + // Step 17. + args.rval().setObject(*result); + return true; +} + +/** + * Uint8Array.prototype.setFromHex ( string ) + * + * https://tc39.es/proposal-arraybuffer-base64/spec/#sec-uint8array.prototype.setfromhex + */ +static bool uint8array_setFromHex(JSContext* cx, unsigned argc, Value* vp) { + CallArgs args = CallArgsFromVp(argc, vp); + + // Steps 1-2. + return CallNonGenericMethod<IsUint8ArrayObject, uint8array_setFromHex>(cx, + args); +} + +/** + * Uint8Array.prototype.toBase64 ( [ options ] ) + * + * https://tc39.es/proposal-arraybuffer-base64/spec/#sec-uint8array.prototype.tobase64 + */ +static bool uint8array_toBase64(JSContext* cx, const CallArgs& args) { + Rooted<TypedArrayObject*> tarray( + cx, &args.thisv().toObject().as<TypedArrayObject>()); + + // Steps 3-7. + auto alphabet = Alphabet::Base64; + if (args.hasDefined(0)) { + // Step 3. (Inlined GetOptionsObject) + Rooted<JSObject*> options( + cx, RequireObjectArg(cx, "options", "toBase64", args[0])); + if (!options) { + return false; + } + + // Steps 4-7. + if (!GetAlphabetOption(cx, options, &alphabet)) { + return false; + } + } + + // Step 8. (Partial) + auto length = tarray->length(); + if (!length) { + ReportOutOfBounds(cx, tarray); + return false; + } + + // Compute the output string length. Three input bytes are encoded as four + // characters, so the output length is ⌈length × 4/3⌉. + auto outLength = mozilla::CheckedInt<size_t>{*length}; + outLength += 2; + outLength /= 3; + outLength *= 4; + if (!outLength.isValid() || outLength.value() > JSString::MAX_LENGTH) { + ReportAllocationOverflow(cx); + return false; + } + + JSStringBuilder sb(cx); + if (!sb.reserve(outLength.value())) { + return false; + } + + // Steps 9-10. + const auto& base64Chars = alphabet == Alphabet::Base64 + ? Base64::Encode::Base64 + : Base64::Encode::Base64Url; + + auto encode = [&base64Chars](uint32_t value) { + return base64Chars[value & 0x3f]; + }; + + // Our implementation directly converts the bytes to their string + // representation instead of first collecting them into an intermediate list. + auto data = tarray->dataPointerEither().cast<uint8_t*>(); + auto toRead = *length; + for (; toRead >= 3; toRead -= 3) { + // Combine three input bytes into a single uint24 value. + auto byte0 = jit::AtomicOperations::loadSafeWhenRacy(data++); + auto byte1 = jit::AtomicOperations::loadSafeWhenRacy(data++); + auto byte2 = jit::AtomicOperations::loadSafeWhenRacy(data++); + auto u24 = (uint32_t(byte0) << 16) | (uint32_t(byte1) << 8) | byte2; + + // Encode the uint24 value as base64. + sb.infallibleAppend(encode(u24 >> 18)); + sb.infallibleAppend(encode(u24 >> 12)); + sb.infallibleAppend(encode(u24 >> 6)); + sb.infallibleAppend(encode(u24 >> 0)); + } + + // Trailing two and one element bytes are padded with '='. + if (toRead == 2) { + // Combine two input bytes into a single uint24 value. + auto byte0 = jit::AtomicOperations::loadSafeWhenRacy(data++); + auto byte1 = jit::AtomicOperations::loadSafeWhenRacy(data++); + auto u24 = (uint32_t(byte0) << 16) | (uint32_t(byte1) << 8); + + // Encode the uint24 value as base64, including padding. + sb.infallibleAppend(encode(u24 >> 18)); + sb.infallibleAppend(encode(u24 >> 12)); + sb.infallibleAppend(encode(u24 >> 6)); + sb.infallibleAppend('='); + } else if (toRead == 1) { + // Combine one input byte into a single uint24 value. + auto byte0 = jit::AtomicOperations::loadSafeWhenRacy(data++); + auto u24 = uint32_t(byte0) << 16; + + // Encode the uint24 value as base64, including padding. + sb.infallibleAppend(encode(u24 >> 18)); + sb.infallibleAppend(encode(u24 >> 12)); + sb.infallibleAppend('='); + sb.infallibleAppend('='); + } else { + MOZ_ASSERT(toRead == 0); + } + + MOZ_ASSERT(sb.length() == outLength.value(), "all characters were written"); + + // Step 11. + auto* str = sb.finishString(); + if (!str) { + return false; + } + + args.rval().setString(str); + return true; +} + +/** + * Uint8Array.prototype.toBase64 ( [ options ] ) + * + * https://tc39.es/proposal-arraybuffer-base64/spec/#sec-uint8array.prototype.tobase64 + */ +static bool uint8array_toBase64(JSContext* cx, unsigned argc, Value* vp) { + CallArgs args = CallArgsFromVp(argc, vp); + + // Steps 1-2. + return CallNonGenericMethod<IsUint8ArrayObject, uint8array_toBase64>(cx, + args); +} + +/** + * Uint8Array.prototype.toHex ( ) + * + * https://tc39.es/proposal-arraybuffer-base64/spec/#sec-uint8array.prototype.tohex + */ +static bool uint8array_toHex(JSContext* cx, const CallArgs& args) { + Rooted<TypedArrayObject*> tarray( + cx, &args.thisv().toObject().as<TypedArrayObject>()); + + // Step 3. (Partial) + auto length = tarray->length(); + if (!length) { + ReportOutOfBounds(cx, tarray); + return false; + } + + // |length| is limited by |ByteLengthLimit|, which ensures that multiplying it + // by two won't overflow. + static_assert(TypedArrayObject::ByteLengthLimit <= + std::numeric_limits<size_t>::max() / 2); + MOZ_ASSERT(*length <= TypedArrayObject::ByteLengthLimit); + + // Compute the output string length. Each byte is encoded as two characters, + // so the output length is exactly twice as large as |length|. + size_t outLength = *length * 2; + if (outLength > JSString::MAX_LENGTH) { + ReportAllocationOverflow(cx); + return false; + } + + // Step 4. + JSStringBuilder sb(cx); + if (!sb.reserve(outLength)) { + return false; + } + + // NB: Lower case hex digits. + static constexpr char HexDigits[] = "0123456789abcdef"; + static_assert(std::char_traits<char>::length(HexDigits) == 16); + + // Steps 3 and 5. + // + // Our implementation directly converts the bytes to their string + // representation instead of first collecting them into an intermediate list. + auto data = tarray->dataPointerEither().cast<uint8_t*>(); + for (size_t index = 0; index < *length; index++) { + auto byte = jit::AtomicOperations::loadSafeWhenRacy(data + index); + + sb.infallibleAppend(HexDigits[byte >> 4]); + sb.infallibleAppend(HexDigits[byte & 0xf]); + } + + MOZ_ASSERT(sb.length() == outLength, "all characters were written"); + + // Step 6. + auto* str = sb.finishString(); + if (!str) { + return false; + } + + args.rval().setString(str); + return true; +} + +/** + * Uint8Array.prototype.toHex ( ) + * + * https://tc39.es/proposal-arraybuffer-base64/spec/#sec-uint8array.prototype.tohex + */ +static bool uint8array_toHex(JSContext* cx, unsigned argc, Value* vp) { + CallArgs args = CallArgsFromVp(argc, vp); + + // Steps 1-2. + return CallNonGenericMethod<IsUint8ArrayObject, uint8array_toHex>(cx, args); +} + +#endif + /* static */ const JSFunctionSpec TypedArrayObject::protoFunctions[] = { JS_SELF_HOSTED_FN("subarray", "TypedArraySubarray", 2, 0), JS_FN("set", TypedArrayObject::set, 1, 0), @@ -2364,15 +3450,50 @@ static const JSPropertySpec #undef IMPL_TYPED_ARRAY_PROPERTIES }; +#ifdef NIGHTLY_BUILD +static const JSFunctionSpec uint8array_static_methods[] = { + JS_FN("fromBase64", uint8array_fromBase64, 1, 0), + JS_FN("fromHex", uint8array_fromHex, 1, 0), + JS_FS_END, +}; + +static const JSFunctionSpec uint8array_methods[] = { + JS_FN("setFromBase64", uint8array_setFromBase64, 1, 0), + JS_FN("setFromHex", uint8array_setFromHex, 1, 0), + JS_FN("toBase64", uint8array_toBase64, 0, 0), + JS_FN("toHex", uint8array_toHex, 0, 0), + JS_FS_END, +}; +#endif + +static constexpr const JSFunctionSpec* TypedArrayStaticMethods( + Scalar::Type type) { +#ifdef NIGHTLY_BUILD + if (type == Scalar::Uint8) { + return uint8array_static_methods; + } +#endif + return nullptr; +} + +static constexpr const JSFunctionSpec* TypedArrayMethods(Scalar::Type type) { +#ifdef NIGHTLY_BUILD + if (type == Scalar::Uint8) { + return uint8array_methods; + } +#endif + return nullptr; +} + static const ClassSpec TypedArrayObjectClassSpecs[Scalar::MaxTypedArrayViewType] = { #define IMPL_TYPED_ARRAY_CLASS_SPEC(ExternalType, NativeType, Name) \ { \ TypedArrayObjectTemplate<NativeType>::createConstructor, \ TypedArrayObjectTemplate<NativeType>::createPrototype, \ - nullptr, \ + TypedArrayStaticMethods(Scalar::Type::Name), \ static_prototype_properties[Scalar::Type::Name], \ - nullptr, \ + TypedArrayMethods(Scalar::Type::Name), \ static_prototype_properties[Scalar::Type::Name], \ nullptr, \ JSProto_TypedArray, \ diff --git a/js/src/vm/TypedArrayObject.h b/js/src/vm/TypedArrayObject.h index 46531ec4ee..6905e83600 100644 --- a/js/src/vm/TypedArrayObject.h +++ b/js/src/vm/TypedArrayObject.h @@ -149,6 +149,7 @@ class FixedLengthTypedArrayObject : public TypedArrayObject { static constexpr uint32_t INLINE_BUFFER_LIMIT = (NativeObject::MAX_FIXED_SLOTS - FIXED_DATA_START) * sizeof(Value); + inline gc::AllocKind allocKindForTenure() const; static inline gc::AllocKind AllocKindForLazyBuffer(size_t nbytes); size_t byteOffset() const { |