/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- * vim: set ts=8 sts=2 et sw=2 tw=80: * This Source Code Form is subject to the terms of the Mozilla Public * License, v. 2.0. If a copy of the MPL was not distributed with this * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ /* * JS function support. */ #include "vm/JSFunction-inl.h" #include "mozilla/ArrayUtils.h" // mozilla::ArrayLength #include "mozilla/CheckedInt.h" #include "mozilla/Maybe.h" #include "mozilla/Range.h" #include #include #include "jsapi.h" #include "jstypes.h" #include "builtin/Array.h" #include "builtin/BigInt.h" #include "builtin/Object.h" #include "builtin/Symbol.h" #include "frontend/BytecodeCompiler.h" // frontend::{CompileStandaloneFunction, CompileStandaloneGenerator, CompileStandaloneAsyncFunction, CompileStandaloneAsyncGenerator, DelazifyCanonicalScriptedFunction} #include "frontend/FrontendContext.h" // AutoReportFrontendContext, ManualReportFrontendContext #include "frontend/Stencil.h" // js::DumpFunctionFlagsItems #include "jit/InlinableNatives.h" #include "jit/Ion.h" #include "js/CallNonGenericMethod.h" #include "js/CompilationAndEvaluation.h" #include "js/CompileOptions.h" #include "js/friend/ErrorMessages.h" // js::GetErrorMessage, JSMSG_* #include "js/friend/StackLimits.h" // js::AutoCheckRecursionLimit #include "js/Printer.h" // js::GenericPrinter #include "js/PropertySpec.h" #include "js/SourceText.h" #include "js/StableStringChars.h" #include "js/Wrapper.h" #include "util/DifferentialTesting.h" #include "util/StringBuffer.h" #include "util/Text.h" #include "vm/BooleanObject.h" #include "vm/BoundFunctionObject.h" #include "vm/Compartment.h" #include "vm/FunctionFlags.h" // js::FunctionFlags #include "vm/GeneratorAndAsyncKind.h" // js::GeneratorKind, js::FunctionAsyncKind #include "vm/GlobalObject.h" #include "vm/Interpreter.h" #include "vm/JSAtomUtils.h" // ToAtom #include "vm/JSContext.h" #include "vm/JSObject.h" #include "vm/JSONPrinter.h" // js::JSONPrinter #include "vm/JSScript.h" #include "vm/NumberObject.h" #include "vm/PlainObject.h" // js::PlainObject #include "vm/SelfHosting.h" #include "vm/Shape.h" #include "vm/StringObject.h" #include "wasm/AsmJS.h" #ifdef ENABLE_RECORD_TUPLE # include "vm/RecordType.h" # include "vm/TupleType.h" #endif #include "vm/Interpreter-inl.h" #include "vm/JSScript-inl.h" using namespace js; using mozilla::CheckedInt; using mozilla::Maybe; using mozilla::Some; using JS::AutoStableStringChars; using JS::CompileOptions; using JS::SourceOwnership; using JS::SourceText; static bool fun_enumerate(JSContext* cx, HandleObject obj) { MOZ_ASSERT(obj->is()); RootedId id(cx); bool found; if (obj->as().needsPrototypeProperty()) { id = NameToId(cx->names().prototype); if (!HasOwnProperty(cx, obj, id, &found)) { return false; } } if (!obj->as().hasResolvedLength()) { id = NameToId(cx->names().length); if (!HasOwnProperty(cx, obj, id, &found)) { return false; } } if (!obj->as().hasResolvedName()) { id = NameToId(cx->names().name); if (!HasOwnProperty(cx, obj, id, &found)) { return false; } } return true; } bool IsFunction(HandleValue v) { return v.isObject() && v.toObject().is(); } static bool AdvanceToActiveCallLinear(JSContext* cx, NonBuiltinScriptFrameIter& iter, HandleFunction fun) { MOZ_ASSERT(!fun->isBuiltin()); for (; !iter.done(); ++iter) { if (!iter.isFunctionFrame()) { continue; } if (iter.matchCallee(cx, fun)) { return true; } } return false; } void js::ThrowTypeErrorBehavior(JSContext* cx) { JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_THROW_TYPE_ERROR); } static bool IsSloppyNormalFunction(JSFunction* fun) { // FunctionDeclaration or FunctionExpression in sloppy mode. if (fun->kind() == FunctionFlags::NormalFunction) { if (fun->isBuiltin()) { return false; } if (fun->isGenerator() || fun->isAsync()) { return false; } MOZ_ASSERT(fun->isInterpreted()); return !fun->strict(); } // Or asm.js function in sloppy mode. if (fun->kind() == FunctionFlags::AsmJS) { return !IsAsmJSStrictModeModuleOrFunction(fun); } return false; } // Beware: this function can be invoked on *any* function! That includes // natives, strict mode functions, bound functions, arrow functions, // self-hosted functions and constructors, asm.js functions, functions with // destructuring arguments and/or a rest argument, and probably a few more I // forgot. Turn back and save yourself while you still can. It's too late for // me. static bool ArgumentsRestrictions(JSContext* cx, HandleFunction fun) { // Throw unless the function is a sloppy, normal function. // TODO (bug 1057208): ensure semantics are correct for all possible // pairings of callee/caller. if (!IsSloppyNormalFunction(fun)) { ThrowTypeErrorBehavior(cx); return false; } return true; } bool ArgumentsGetterImpl(JSContext* cx, const CallArgs& args) { MOZ_ASSERT(IsFunction(args.thisv())); RootedFunction fun(cx, &args.thisv().toObject().as()); if (!ArgumentsRestrictions(cx, fun)) { return false; } // Function.arguments isn't standard (not even Annex B), so it isn't // worth the effort to guarantee that we can always recover it from // an Ion frame. Always return null for differential fuzzing. if (js::SupportDifferentialTesting()) { args.rval().setNull(); return true; } // Return null if this function wasn't found on the stack. NonBuiltinScriptFrameIter iter(cx); if (!AdvanceToActiveCallLinear(cx, iter, fun)) { args.rval().setNull(); return true; } Rooted argsobj(cx, ArgumentsObject::createUnexpected(cx, iter)); if (!argsobj) { return false; } #ifndef JS_CODEGEN_NONE // Disabling compiling of this script in IonMonkey. IonMonkey doesn't // guarantee |f.arguments| can be fully recovered, so we try to mitigate // observing this behavior by detecting its use early. JSScript* script = iter.script(); jit::ForbidCompilation(cx, script); #endif args.rval().setObject(*argsobj); return true; } static bool ArgumentsGetter(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); return CallNonGenericMethod(cx, args); } bool ArgumentsSetterImpl(JSContext* cx, const CallArgs& args) { MOZ_ASSERT(IsFunction(args.thisv())); RootedFunction fun(cx, &args.thisv().toObject().as()); if (!ArgumentsRestrictions(cx, fun)) { return false; } // If the function passes the gauntlet, return |undefined|. args.rval().setUndefined(); return true; } static bool ArgumentsSetter(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); return CallNonGenericMethod(cx, args); } // Beware: this function can be invoked on *any* function! That includes // natives, strict mode functions, bound functions, arrow functions, // self-hosted functions and constructors, asm.js functions, functions with // destructuring arguments and/or a rest argument, and probably a few more I // forgot. Turn back and save yourself while you still can. It's too late for // me. static bool CallerRestrictions(JSContext* cx, HandleFunction fun) { // Throw unless the function is a sloppy, normal function. // TODO (bug 1057208): ensure semantics are correct for all possible // pairings of callee/caller. if (!IsSloppyNormalFunction(fun)) { ThrowTypeErrorBehavior(cx); return false; } return true; } bool CallerGetterImpl(JSContext* cx, const CallArgs& args) { MOZ_ASSERT(IsFunction(args.thisv())); // Beware! This function can be invoked on *any* function! It can't // assume it'll never be invoked on natives, strict mode functions, bound // functions, or anything else that ordinarily has immutable .caller // defined with [[ThrowTypeError]]. RootedFunction fun(cx, &args.thisv().toObject().as()); if (!CallerRestrictions(cx, fun)) { return false; } // Also return null if this function wasn't found on the stack. NonBuiltinScriptFrameIter iter(cx); if (!AdvanceToActiveCallLinear(cx, iter, fun)) { args.rval().setNull(); return true; } ++iter; while (!iter.done() && iter.isEvalFrame()) { ++iter; } if (iter.done() || !iter.isFunctionFrame()) { args.rval().setNull(); return true; } RootedObject caller(cx, iter.callee(cx)); if (!cx->compartment()->wrap(cx, &caller)) { return false; } // Censor the caller if we don't have full access to it. If we do, but the // caller is a function with strict mode code, throw a TypeError per ES5. // If we pass these checks, we can return the computed caller. { JSObject* callerObj = CheckedUnwrapStatic(caller); if (!callerObj) { args.rval().setNull(); return true; } if (JS_IsDeadWrapper(callerObj)) { JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_DEAD_OBJECT); return false; } JSFunction* callerFun = &callerObj->as(); MOZ_ASSERT(!callerFun->isBuiltin(), "non-builtin iterator returned a builtin?"); if (callerFun->strict() || callerFun->isAsync() || callerFun->isGenerator()) { args.rval().setNull(); return true; } } args.rval().setObject(*caller); return true; } static bool CallerGetter(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); return CallNonGenericMethod(cx, args); } bool CallerSetterImpl(JSContext* cx, const CallArgs& args) { MOZ_ASSERT(IsFunction(args.thisv())); // We just have to return |undefined|, but first we call CallerGetterImpl // because we need the same strict-mode and security checks. if (!CallerGetterImpl(cx, args)) { return false; } args.rval().setUndefined(); return true; } static bool CallerSetter(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); return CallNonGenericMethod(cx, args); } static const JSPropertySpec function_properties[] = { JS_PSGS("arguments", ArgumentsGetter, ArgumentsSetter, 0), JS_PSGS("caller", CallerGetter, CallerSetter, 0), JS_PS_END}; static bool ResolveInterpretedFunctionPrototype(JSContext* cx, HandleFunction fun, HandleId id) { MOZ_ASSERT(fun->isInterpreted() || fun->isAsmJSNative()); MOZ_ASSERT(id == NameToId(cx->names().prototype)); // Assert that fun is not a compiler-created function object, which // must never leak to script or embedding code and then be mutated. // Also assert that fun is not bound, per the ES5 15.3.4.5 ref above. MOZ_ASSERT(!IsInternalFunctionObject(*fun)); // Make the prototype object an instance of Object with the same parent as // the function object itself, unless the function is an ES6 generator. In // that case, per the 15 July 2013 ES6 draft, section 15.19.3, its parent is // the GeneratorObjectPrototype singleton. bool isGenerator = fun->isGenerator(); Rooted global(cx, &fun->global()); RootedObject objProto(cx); if (isGenerator && fun->isAsync()) { objProto = GlobalObject::getOrCreateAsyncGeneratorPrototype(cx, global); } else if (isGenerator) { objProto = GlobalObject::getOrCreateGeneratorObjectPrototype(cx, global); } else { objProto = &global->getObjectPrototype(); } if (!objProto) { return false; } Rooted proto( cx, NewPlainObjectWithProto(cx, objProto, TenuredObject)); if (!proto) { return false; } // Per ES5 13.2 the prototype's .constructor property is configurable, // non-enumerable, and writable. However, per the 15 July 2013 ES6 draft, // section 15.19.3, the .prototype of a generator function does not link // back with a .constructor. if (!isGenerator) { RootedValue objVal(cx, ObjectValue(*fun)); if (!DefineDataProperty(cx, proto, cx->names().constructor, objVal, 0)) { return false; } } // Per ES5 15.3.5.2 a user-defined function's .prototype property is // initially non-configurable, non-enumerable, and writable. RootedValue protoVal(cx, ObjectValue(*proto)); return DefineDataProperty(cx, fun, id, protoVal, JSPROP_PERMANENT | JSPROP_RESOLVING); } bool JSFunction::needsPrototypeProperty() { /* * Built-in functions do not have a .prototype property per ECMA-262, * or (Object.prototype, Function.prototype, etc.) have that property * created eagerly. * * ES6 9.2.8 MakeConstructor defines the .prototype property on constructors. * Generators are not constructors, but they have a .prototype property * anyway, according to errata to ES6. See bug 1191486. * * Thus all of the following don't get a .prototype property: * - Methods (that are not class-constructors or generators) * - Arrow functions * - Function.prototype * - Async functions */ return !isBuiltin() && (isConstructor() || isGenerator()); } bool JSFunction::hasNonConfigurablePrototypeDataProperty() { if (!isBuiltin()) { return needsPrototypeProperty(); } if (isSelfHostedBuiltin()) { // Self-hosted constructors have a non-configurable .prototype data // property. if (!isConstructor()) { return false; } #ifdef DEBUG PropertyName* prototypeName = runtimeFromMainThread()->commonNames->prototype; Maybe prop = lookupPure(prototypeName); MOZ_ASSERT(prop.isSome()); MOZ_ASSERT(prop->isDataProperty()); MOZ_ASSERT(!prop->configurable()); #endif return true; } if (!isConstructor()) { // We probably don't have a .prototype property. Avoid the lookup below. return false; } PropertyName* prototypeName = runtimeFromMainThread()->commonNames->prototype; Maybe prop = lookupPure(prototypeName); return prop.isSome() && prop->isDataProperty() && !prop->configurable(); } static bool fun_mayResolve(const JSAtomState& names, jsid id, JSObject*) { if (!id.isAtom()) { return false; } JSAtom* atom = id.toAtom(); return atom == names.prototype || atom == names.length || atom == names.name; } bool JSFunction::getExplicitName(JSContext* cx, JS::MutableHandle name) { if (isAccessorWithLazyName()) { JSAtom* accessorName = getAccessorNameForLazy(cx); if (!accessorName) { return false; } name.set(accessorName); return true; } name.set(maybePartialExplicitName()); return true; } bool JSFunction::getDisplayAtom(JSContext* cx, JS::MutableHandle name) { if (isAccessorWithLazyName()) { JSAtom* accessorName = getAccessorNameForLazy(cx); if (!accessorName) { return false; } name.set(accessorName); return true; } name.set(maybePartialDisplayAtom()); return true; } static JSAtom* NameToPrefixedFunctionName(JSContext* cx, JSString* nameStr, FunctionPrefixKind prefixKind) { MOZ_ASSERT(prefixKind != FunctionPrefixKind::None); StringBuffer sb(cx); if (prefixKind == FunctionPrefixKind::Get) { if (!sb.append("get ")) { return nullptr; } } else { if (!sb.append("set ")) { return nullptr; } } if (!sb.append(nameStr)) { return nullptr; } return sb.finishAtom(); } static JSAtom* NameToFunctionName(JSContext* cx, HandleValue name, FunctionPrefixKind prefixKind) { MOZ_ASSERT(name.isString() || name.isNumeric()); if (prefixKind == FunctionPrefixKind::None) { return ToAtom(cx, name); } JSString* nameStr = ToString(cx, name); if (!nameStr) { return nullptr; } return NameToPrefixedFunctionName(cx, nameStr, prefixKind); } JSAtom* JSFunction::getAccessorNameForLazy(JSContext* cx) { MOZ_ASSERT(isAccessorWithLazyName()); JSAtom* name = NameToPrefixedFunctionName( cx, rawAtom(), isGetter() ? FunctionPrefixKind::Get : FunctionPrefixKind::Set); if (!name) { return nullptr; } setAtom(name); setFlags(flags().clearLazyAccessorName()); return name; } static bool fun_resolve(JSContext* cx, HandleObject obj, HandleId id, bool* resolvedp) { if (!id.isAtom()) { return true; } RootedFunction fun(cx, &obj->as()); if (id.isAtom(cx->names().prototype)) { if (!fun->needsPrototypeProperty()) { return true; } if (!ResolveInterpretedFunctionPrototype(cx, fun, id)) { return false; } *resolvedp = true; return true; } bool isLength = id.isAtom(cx->names().length); if (isLength || id.isAtom(cx->names().name)) { MOZ_ASSERT(!IsInternalFunctionObject(*obj)); RootedValue v(cx); // Since f.length and f.name are configurable, they could be resolved // and then deleted: // function f(x) {} // assertEq(f.length, 1); // delete f.length; // assertEq(f.name, "f"); // delete f.name; // Afterwards, asking for f.length or f.name again will cause this // resolve hook to run again. Defining the property again the second // time through would be a bug. // assertEq(f.length, 0); // gets Function.prototype.length! // assertEq(f.name, ""); // gets Function.prototype.name! // We use the RESOLVED_LENGTH and RESOLVED_NAME flags as a hack to prevent // this bug. if (isLength) { if (fun->hasResolvedLength()) { return true; } uint16_t len = 0; if (!JSFunction::getUnresolvedLength(cx, fun, &len)) { return false; } v.setInt32(len); } else { if (fun->hasResolvedName()) { return true; } JSAtom* name = fun->getUnresolvedName(cx); if (!name) { return false; } v.setString(name); } if (!NativeDefineDataProperty(cx, fun, id, v, JSPROP_READONLY | JSPROP_RESOLVING)) { return false; } if (isLength) { fun->setResolvedLength(); } else { fun->setResolvedName(); } *resolvedp = true; return true; } return true; } /* ES6 (04-25-16) 19.2.3.6 Function.prototype [ @@hasInstance ] */ static bool fun_symbolHasInstance(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); if (args.length() < 1) { args.rval().setBoolean(false); return true; } /* Step 1. */ HandleValue func = args.thisv(); // Primitives are non-callable and will always return false from // OrdinaryHasInstance. if (!func.isObject()) { args.rval().setBoolean(false); return true; } RootedObject obj(cx, &func.toObject()); /* Step 2. */ bool result; if (!OrdinaryHasInstance(cx, obj, args[0], &result)) { return false; } args.rval().setBoolean(result); return true; } /* * ES6 (4-25-16) 7.3.19 OrdinaryHasInstance */ bool JS::OrdinaryHasInstance(JSContext* cx, HandleObject objArg, HandleValue v, bool* bp) { AssertHeapIsIdle(); cx->check(objArg, v); RootedObject obj(cx, objArg); /* Step 1. */ if (!obj->isCallable()) { *bp = false; return true; } /* Step 2. */ if (obj->is()) { /* Steps 2a-b. */ AutoCheckRecursionLimit recursion(cx); if (!recursion.check(cx)) { return false; } obj = obj->as().getTarget(); return InstanceofOperator(cx, obj, v, bp); } /* Step 3. */ if (!v.isObject()) { *bp = false; return true; } /* Step 4. */ RootedValue pval(cx); if (!GetProperty(cx, obj, obj, cx->names().prototype, &pval)) { return false; } /* Step 5. */ if (pval.isPrimitive()) { /* * Throw a runtime error if instanceof is called on a function that * has a non-object as its .prototype value. */ RootedValue val(cx, ObjectValue(*obj)); ReportValueError(cx, JSMSG_BAD_PROTOTYPE, -1, val, nullptr); return false; } /* Step 6. */ RootedObject pobj(cx, &pval.toObject()); bool isPrototype; if (!IsPrototypeOf(cx, pobj, &v.toObject(), &isPrototype)) { return false; } *bp = isPrototype; return true; } inline void JSFunction::trace(JSTracer* trc) { // Functions can be be marked as interpreted despite having no script yet at // some points when parsing, and can be lazy with no lazy script for // self-hosted code. MOZ_ASSERT(!getFixedSlot(NativeJitInfoOrInterpretedScriptSlot).isGCThing()); if (isInterpreted() && hasBaseScript()) { if (BaseScript* script = baseScript()) { TraceManuallyBarrieredEdge(trc, &script, "JSFunction script"); // Self-hosted scripts are shared with workers but are never relocated. // Skip unnecessary writes to prevent the possible data race. if (baseScript() != script) { HeapSlot& slot = getFixedSlotRef(NativeJitInfoOrInterpretedScriptSlot); slot.unbarrieredSet(JS::PrivateValue(script)); } } } // wasm/asm.js exported functions need to keep WasmInstantObject alive, // access it via WASM_INSTANCE_SLOT extended slot. if (isAsmJSNative() || isWasm()) { const Value& v = getExtendedSlot(FunctionExtended::WASM_INSTANCE_SLOT); if (!v.isUndefined()) { auto* instance = static_cast(v.toPrivate()); wasm::TraceInstanceEdge(trc, instance, "JSFunction instance"); } } } static void fun_trace(JSTracer* trc, JSObject* obj) { obj->as().trace(trc); } static JSObject* CreateFunctionConstructor(JSContext* cx, JSProtoKey key) { Rooted global(cx, cx->global()); RootedObject functionProto(cx, &global->getPrototype(JSProto_Function)); RootedObject functionCtor( cx, NewFunctionWithProto( cx, Function, 1, FunctionFlags::NATIVE_CTOR, nullptr, Handle(cx->names().Function), functionProto, gc::AllocKind::FUNCTION, TenuredObject)); if (!functionCtor) { return nullptr; } return functionCtor; } static bool FunctionPrototype(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); args.rval().setUndefined(); return true; } static JSObject* CreateFunctionPrototype(JSContext* cx, JSProtoKey key) { Rooted self(cx, cx->global()); RootedObject objectProto(cx, &self->getPrototype(JSProto_Object)); return NewFunctionWithProto( cx, FunctionPrototype, 0, FunctionFlags::NATIVE_FUN, nullptr, Handle(cx->names().empty_), objectProto, gc::AllocKind::FUNCTION, TenuredObject); } JSString* js::FunctionToStringCache::lookup(BaseScript* script) const { for (size_t i = 0; i < NumEntries; i++) { if (entries_[i].script == script) { return entries_[i].string; } } return nullptr; } void js::FunctionToStringCache::put(BaseScript* script, JSString* string) { for (size_t i = NumEntries - 1; i > 0; i--) { entries_[i] = entries_[i - 1]; } entries_[0].set(script, string); } JSString* js::FunctionToString(JSContext* cx, HandleFunction fun, bool isToSource) { if (IsAsmJSModule(fun)) { return AsmJSModuleToString(cx, fun, isToSource); } if (IsAsmJSFunction(fun)) { return AsmJSFunctionToString(cx, fun); } // Self-hosted built-ins should not expose their source code. bool haveSource = fun->isInterpreted() && !fun->isSelfHostedBuiltin(); // If we're in toSource mode, put parentheses around lambda functions so // that eval returns lambda, not function statement. bool addParentheses = haveSource && isToSource && (fun->isLambda() && !fun->isArrow()); if (haveSource) { if (!ScriptSource::loadSource(cx, fun->baseScript()->scriptSource(), &haveSource)) { return nullptr; } } // Fast path for the common case, to avoid StringBuffer overhead. if (!addParentheses && haveSource) { FunctionToStringCache& cache = cx->zone()->functionToStringCache(); if (JSString* str = cache.lookup(fun->baseScript())) { return str; } BaseScript* script = fun->baseScript(); size_t start = script->toStringStart(); size_t end = script->toStringEnd(); JSString* str = (end - start <= ScriptSource::SourceDeflateLimit) ? script->scriptSource()->substring(cx, start, end) : script->scriptSource()->substringDontDeflate(cx, start, end); if (!str) { return nullptr; } cache.put(fun->baseScript(), str); return str; } JSStringBuilder out(cx); if (addParentheses) { if (!out.append('(')) { return nullptr; } } if (haveSource) { if (!fun->baseScript()->appendSourceDataForToString(cx, out)) { return nullptr; } } else if (!isToSource) { // For the toString() output the source representation must match // NativeFunction when no source text is available. // // NativeFunction: // function PropertyName[~Yield,~Await]opt ( // FormalParameters[~Yield,~Await] ) { [native code] } // // Additionally, if |fun| is a well-known intrinsic object and is not // identified as an anonymous function, the portion of the returned // string that would be matched by IdentifierName must be the initial // value of the name property of |fun|. auto hasGetterOrSetterPrefix = [](JSAtom* name) { auto hasGetterOrSetterPrefix = [](const auto* chars) { return (chars[0] == 'g' || chars[0] == 's') && chars[1] == 'e' && chars[2] == 't' && chars[3] == ' '; }; JS::AutoCheckCannotGC nogc; return name->length() >= 4 && (name->hasLatin1Chars() ? hasGetterOrSetterPrefix(name->latin1Chars(nogc)) : hasGetterOrSetterPrefix(name->twoByteChars(nogc))); }; if (!out.append("function")) { return nullptr; } // We don't want to fully parse the function's name here because of // performance reasons, so only append the name if we're confident it // can be matched as the 'PropertyName' grammar production. if (fun->maybePartialExplicitName() && (fun->kind() == FunctionFlags::NormalFunction || (fun->isBuiltinNative() && (fun->kind() == FunctionFlags::Getter || fun->kind() == FunctionFlags::Setter)) || fun->kind() == FunctionFlags::Wasm || fun->kind() == FunctionFlags::ClassConstructor)) { if (!out.append(' ')) { return nullptr; } // Built-in getters or setters are classified as one of // NormalFunction, Getter, or Setter. Strip any leading "get " or "set " // if present. JSAtom* name = fun->maybePartialExplicitName(); size_t offset = hasGetterOrSetterPrefix(name) ? 4 : 0; if (!out.appendSubstring(name, offset, name->length() - offset)) { return nullptr; } } if (!out.append("() {\n [native code]\n}")) { return nullptr; } } else { if (fun->isAsync()) { if (!out.append("async ")) { return nullptr; } } if (!fun->isArrow()) { if (!out.append("function")) { return nullptr; } if (fun->isGenerator()) { if (!out.append('*')) { return nullptr; } } } JS::Rooted name(cx); if (!fun->getExplicitName(cx, &name)) { return nullptr; } if (name) { if (!out.append(' ')) { return nullptr; } if (!out.append(name)) { return nullptr; } } if (!out.append("() {\n [native code]\n}")) { return nullptr; } } if (addParentheses) { if (!out.append(')')) { return nullptr; } } return out.finishString(); } JSString* fun_toStringHelper(JSContext* cx, HandleObject obj, bool isToSource) { if (!obj->is()) { if (JSFunToStringOp op = obj->getOpsFunToString()) { return op(cx, obj, isToSource); } JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_INCOMPATIBLE_PROTO, "Function", "toString", "object"); return nullptr; } return FunctionToString(cx, obj.as(), isToSource); } bool js::fun_toString(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); MOZ_ASSERT(IsFunctionObject(args.calleev())); RootedObject obj(cx, ToObject(cx, args.thisv())); if (!obj) { return false; } JSString* str = fun_toStringHelper(cx, obj, /* isToSource = */ false); if (!str) { return false; } args.rval().setString(str); return true; } static bool fun_toSource(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); MOZ_ASSERT(IsFunctionObject(args.calleev())); RootedObject obj(cx, ToObject(cx, args.thisv())); if (!obj) { return false; } RootedString str(cx); if (obj->isCallable()) { str = fun_toStringHelper(cx, obj, /* isToSource = */ true); } else { str = ObjectToSource(cx, obj); } if (!str) { return false; } args.rval().setString(str); return true; } bool js::fun_call(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); HandleValue func = args.thisv(); // We don't need to do this -- Call would do it for us -- but the error // message is *much* better if we do this here. (Without this, // JSDVG_SEARCH_STACK tries to decompile |func| as if it were |this| in // the scripted caller's frame -- so for example // // Function.prototype.call.call({}); // // would identify |{}| as |this| as being the result of evaluating // |Function.prototype.call| and would conclude, "Function.prototype.call // is not a function". Grotesque.) if (!IsCallable(func)) { ReportIncompatibleMethod(cx, args, &FunctionClass); return false; } size_t argCount = args.length(); if (argCount > 0) { argCount--; // strip off provided |this| } InvokeArgs iargs(cx); if (!iargs.init(cx, argCount)) { return false; } for (size_t i = 0; i < argCount; i++) { iargs[i].set(args[i + 1]); } return Call(cx, func, args.get(0), iargs, args.rval(), CallReason::FunCall); } // ES5 15.3.4.3 bool js::fun_apply(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); // Step 1. // // Note that we must check callability here, not at actual call time, // because extracting argument values from the provided arraylike might // have side effects or throw an exception. HandleValue fval = args.thisv(); if (!IsCallable(fval)) { ReportIncompatibleMethod(cx, args, &FunctionClass); return false; } // Step 2. if (args.length() < 2 || args[1].isNullOrUndefined()) { return fun_call(cx, (args.length() > 0) ? 1 : 0, vp); } // Step 3. if (!args[1].isObject()) { JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_BAD_APPLY_ARGS, "apply"); return false; } // Steps 4-5 (note erratum removing steps originally numbered 5 and 7 in // original version of ES5). RootedObject aobj(cx, &args[1].toObject()); uint64_t length; if (!GetLengthProperty(cx, aobj, &length)) { return false; } // Step 6. InvokeArgs args2(cx); if (!args2.init(cx, length)) { return false; } MOZ_ASSERT(length <= ARGS_LENGTH_MAX); // Steps 7-8. if (!GetElements(cx, aobj, length, args2.array())) { return false; } // Step 9. return Call(cx, fval, args[0], args2, args.rval(), CallReason::FunCall); } static const JSFunctionSpec function_methods[] = { JS_FN("toSource", fun_toSource, 0, 0), JS_FN("toString", fun_toString, 0, 0), JS_FN("apply", fun_apply, 2, 0), JS_FN("call", fun_call, 1, 0), JS_INLINABLE_FN("bind", BoundFunctionObject::functionBind, 1, 0, FunctionBind), JS_SYM_FN(hasInstance, fun_symbolHasInstance, 1, JSPROP_READONLY | JSPROP_PERMANENT), JS_FS_END}; static const JSClassOps JSFunctionClassOps = { nullptr, // addProperty nullptr, // delProperty fun_enumerate, // enumerate nullptr, // newEnumerate fun_resolve, // resolve fun_mayResolve, // mayResolve nullptr, // finalize nullptr, // call nullptr, // construct fun_trace, // trace }; static const ClassSpec JSFunctionClassSpec = { CreateFunctionConstructor, CreateFunctionPrototype, nullptr, nullptr, function_methods, function_properties}; const JSClass js::FunctionClass = { "Function", JSCLASS_HAS_CACHED_PROTO(JSProto_Function) | JSCLASS_HAS_RESERVED_SLOTS(JSFunction::SlotCount), &JSFunctionClassOps, &JSFunctionClassSpec}; const JSClass js::ExtendedFunctionClass = { "Function", JSCLASS_HAS_CACHED_PROTO(JSProto_Function) | JSCLASS_HAS_RESERVED_SLOTS(FunctionExtended::SlotCount), &JSFunctionClassOps, &JSFunctionClassSpec}; const JSClass* const js::FunctionClassPtr = &FunctionClass; const JSClass* const js::FunctionExtendedClassPtr = &ExtendedFunctionClass; bool JSFunction::isDerivedClassConstructor() const { bool derived = hasBaseScript() && baseScript()->isDerivedClassConstructor(); MOZ_ASSERT_IF(derived, isClassConstructor()); return derived; } bool JSFunction::isSyntheticFunction() const { bool synthetic = hasBaseScript() && baseScript()->isSyntheticFunction(); MOZ_ASSERT_IF(synthetic, isMethod()); return synthetic; } /* static */ bool JSFunction::delazifyLazilyInterpretedFunction(JSContext* cx, HandleFunction fun) { MOZ_ASSERT(fun->hasBaseScript()); MOZ_ASSERT(cx->compartment() == fun->compartment()); // The function must be same-compartment but might be cross-realm. Make sure // the script is created in the function's realm. AutoRealm ar(cx, fun); Rooted lazy(cx, fun->baseScript()); RootedFunction canonicalFun(cx, lazy->function()); // If this function is non-canonical, then use the canonical function first // to get the delazified script. This may result in calling this method // again on the canonical function. This ensures the canonical function is // always non-lazy if any of the clones are non-lazy. if (fun != canonicalFun) { JSScript* script = JSFunction::getOrCreateScript(cx, canonicalFun); if (!script) { return false; } // Delazifying the canonical function should naturally make us non-lazy // because we share a BaseScript with the canonical function. MOZ_ASSERT(fun->hasBytecode()); return true; } // Finally, compile the script if it really doesn't exist. AutoReportFrontendContext fc(cx); if (!frontend::DelazifyCanonicalScriptedFunction(cx, &fc, fun)) { // The frontend shouldn't fail after linking the function and the // non-lazy script together. MOZ_ASSERT(fun->baseScript() == lazy); MOZ_ASSERT(lazy->isReadyForDelazification()); return false; } return true; } /* static */ bool JSFunction::delazifySelfHostedLazyFunction(JSContext* cx, js::HandleFunction fun) { MOZ_ASSERT(cx->compartment() == fun->compartment()); // The function must be same-compartment but might be cross-realm. Make sure // the script is created in the function's realm. AutoRealm ar(cx, fun); /* Lazily cloned self-hosted script. */ MOZ_ASSERT(fun->isSelfHostedBuiltin()); Rooted funName(cx, GetClonedSelfHostedFunctionName(fun)); if (!funName) { return false; } return cx->runtime()->delazifySelfHostedFunction(cx, funName, fun); } void JSFunction::maybeRelazify(JSRuntime* rt) { MOZ_ASSERT(!isIncomplete(), "Cannot relazify incomplete functions"); // Don't relazify functions in compartments that are active. Realm* realm = this->realm(); if (!rt->allowRelazificationForTesting) { if (realm->compartment()->gcState.hasEnteredRealm) { return; } MOZ_ASSERT(!realm->hasBeenEnteredIgnoringJit()); } // Don't relazify if the realm is being debugged. The debugger side-tables // such as the set of active breakpoints require bytecode to exist. if (realm->isDebuggee()) { return; } // Don't relazify if we are collecting coverage so that we do not lose count // information. if (coverage::IsLCovEnabled()) { return; } // Check the script's eligibility. JSScript* script = nonLazyScript(); if (!script->allowRelazify()) { return; } MOZ_ASSERT(script->isRelazifiable()); // There must not be any JIT code attached since the relazification process // does not know how to discard it. In general, the GC should discard most JIT // code before attempting relazification. if (script->hasJitScript()) { return; } if (isSelfHostedBuiltin()) { gc::PreWriteBarrier(script); initSelfHostedLazyScript(&rt->selfHostedLazyScript.ref()); } else { script->relazify(rt); } } js::GeneratorKind JSFunction::clonedSelfHostedGeneratorKind() const { MOZ_ASSERT(hasSelfHostedLazyScript()); // This is a lazy clone of a self-hosted builtin. It has no BaseScript, and // `this->flags_` does not contain the generator kind. Consult the // implementation in the self-hosting realm, which has a BaseScript. MOZ_RELEASE_ASSERT(isExtended()); PropertyName* name = GetClonedSelfHostedFunctionName(this); return runtimeFromMainThread()->getSelfHostedFunctionGeneratorKind(name); } // ES2018 draft rev 2aea8f3e617b49df06414eb062ab44fad87661d3 // 19.2.1.1.1 CreateDynamicFunction( constructor, newTarget, kind, args ) static bool CreateDynamicFunction(JSContext* cx, const CallArgs& args, GeneratorKind generatorKind, FunctionAsyncKind asyncKind) { using namespace frontend; // Steps 1-5. bool isGenerator = generatorKind == GeneratorKind::Generator; bool isAsync = asyncKind == FunctionAsyncKind::AsyncFunction; RootedScript maybeScript(cx); const char* filename; uint32_t lineno; bool mutedErrors; uint32_t pcOffset; DescribeScriptedCallerForCompilation(cx, &maybeScript, &filename, &lineno, &pcOffset, &mutedErrors); const char* introductionType = "Function"; if (isAsync) { if (isGenerator) { introductionType = "AsyncGenerator"; } else { introductionType = "AsyncFunction"; } } else if (isGenerator) { introductionType = "GeneratorFunction"; } const char* introducerFilename = filename; if (maybeScript && maybeScript->scriptSource()->introducerFilename()) { introducerFilename = maybeScript->scriptSource()->introducerFilename(); } CompileOptions options(cx); options.setMutedErrors(mutedErrors) .setFileAndLine(filename, 1) .setNoScriptRval(false) .setIntroductionInfo(introducerFilename, introductionType, lineno, pcOffset) .setDeferDebugMetadata(); JSStringBuilder sb(cx); if (isAsync) { if (!sb.append("async ")) { return false; } } if (!sb.append("function")) { return false; } if (isGenerator) { if (!sb.append('*')) { return false; } } if (!sb.append(" anonymous(")) { return false; } if (args.length() > 1) { RootedString str(cx); // Steps 10, 14.d. unsigned n = args.length() - 1; for (unsigned i = 0; i < n; i++) { // Steps 14.a-b, 14.d.i-ii. str = ToString(cx, args[i]); if (!str) { return false; } // Steps 14.b, 14.d.iii. if (!sb.append(str)) { return false; } if (i < args.length() - 2) { // Step 14.d.iii. if (!sb.append(',')) { return false; } } } } if (!sb.append('\n')) { return false; } // Remember the position of ")". Maybe parameterListEnd = Some(uint32_t(sb.length())); static_assert(FunctionConstructorMedialSigils[0] == ')'); if (!sb.append(FunctionConstructorMedialSigils.data(), FunctionConstructorMedialSigils.length())) { return false; } if (args.length() > 0) { // Steps 13, 14.e, 15. RootedString body(cx, ToString(cx, args[args.length() - 1])); if (!body || !sb.append(body)) { return false; } } if (!sb.append(FunctionConstructorFinalBrace.data(), FunctionConstructorFinalBrace.length())) { return false; } // The parser only accepts two byte strings. if (!sb.ensureTwoByteChars()) { return false; } RootedString functionText(cx, sb.finishString()); if (!functionText) { return false; } // Block this call if security callbacks forbid it. if (!cx->isRuntimeCodeGenEnabled(JS::RuntimeCode::JS, functionText)) { JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_CSP_BLOCKED_FUNCTION); return false; } // Steps 7.a-b, 8.a-b, 9.a-b, 16-28. AutoStableStringChars linearChars(cx); if (!linearChars.initTwoByte(cx, functionText)) { return false; } SourceText srcBuf; if (!srcBuf.initMaybeBorrowed(cx, linearChars)) { return false; } FunctionSyntaxKind syntaxKind = FunctionSyntaxKind::Expression; RootedFunction fun(cx); JSProtoKey protoKey; if (isAsync) { if (isGenerator) { fun = CompileStandaloneAsyncGenerator(cx, options, srcBuf, parameterListEnd, syntaxKind); protoKey = JSProto_AsyncGeneratorFunction; } else { fun = CompileStandaloneAsyncFunction(cx, options, srcBuf, parameterListEnd, syntaxKind); protoKey = JSProto_AsyncFunction; } } else { if (isGenerator) { fun = CompileStandaloneGenerator(cx, options, srcBuf, parameterListEnd, syntaxKind); protoKey = JSProto_GeneratorFunction; } else { fun = CompileStandaloneFunction(cx, options, srcBuf, parameterListEnd, syntaxKind); protoKey = JSProto_Function; } } if (!fun) { return false; } RootedValue undefValue(cx); RootedScript funScript(cx, JS_GetFunctionScript(cx, fun)); JS::InstantiateOptions instantiateOptions(options); if (funScript && !UpdateDebugMetadata(cx, funScript, instantiateOptions, undefValue, nullptr, maybeScript, maybeScript)) { return false; } if (fun->isInterpreted()) { fun->initEnvironment(&cx->global()->lexicalEnvironment()); } // Steps 6, 29. RootedObject proto(cx); if (!GetPrototypeFromBuiltinConstructor(cx, args, protoKey, &proto)) { return false; } // Steps 7.d, 8.d (implicit). // Call SetPrototype if an explicit prototype was given. if (proto && !SetPrototype(cx, fun, proto)) { return false; } // Step 38. args.rval().setObject(*fun); return true; } bool js::Function(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); return CreateDynamicFunction(cx, args, GeneratorKind::NotGenerator, FunctionAsyncKind::SyncFunction); } bool js::Generator(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); return CreateDynamicFunction(cx, args, GeneratorKind::Generator, FunctionAsyncKind::SyncFunction); } bool js::AsyncFunctionConstructor(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); return CreateDynamicFunction(cx, args, GeneratorKind::NotGenerator, FunctionAsyncKind::AsyncFunction); } bool js::AsyncGeneratorConstructor(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); return CreateDynamicFunction(cx, args, GeneratorKind::Generator, FunctionAsyncKind::AsyncFunction); } bool JSFunction::isBuiltinFunctionConstructor() { return maybeNative() == Function || maybeNative() == Generator; } bool JSFunction::needsExtraBodyVarEnvironment() const { if (isNativeFun()) { return false; } if (!nonLazyScript()->functionHasExtraBodyVarScope()) { return false; } return nonLazyScript()->functionExtraBodyVarScope()->hasEnvironment(); } bool JSFunction::needsNamedLambdaEnvironment() const { if (!isNamedLambda()) { return false; } LexicalScope* scope = nonLazyScript()->maybeNamedLambdaScope(); if (!scope) { return false; } return scope->hasEnvironment(); } bool JSFunction::needsCallObject() const { if (isNativeFun()) { return false; } MOZ_ASSERT(hasBytecode()); // Note: this should be kept in sync with // FunctionBox::needsCallObjectRegardlessOfBindings(). MOZ_ASSERT_IF( baseScript()->funHasExtensibleScope() || isGenerator() || isAsync(), nonLazyScript()->bodyScope()->hasEnvironment()); return nonLazyScript()->bodyScope()->hasEnvironment(); } #if defined(DEBUG) || defined(JS_JITSPEW) void JSFunction::dumpOwnFields(js::JSONPrinter& json) const { if (maybePartialDisplayAtom()) { js::GenericPrinter& out = json.beginStringProperty("maybePartialDisplayAtom"); maybePartialDisplayAtom()->dumpPropertyName(out); json.endStringProperty(); } if (hasBaseScript()) { js::GenericPrinter& out = json.beginStringProperty("baseScript"); baseScript()->dumpStringContent(out); json.endStringProperty(); } json.property("nargs", nargs()); json.beginInlineListProperty("flags"); DumpFunctionFlagsItems(json, flags()); json.endInlineList(); if (isNativeFun()) { json.formatProperty("native", "0x%p", native()); if (hasJitInfo()) { json.formatProperty("jitInfo", "0x%p", jitInfo()); } } } void JSFunction::dumpOwnStringContent(js::GenericPrinter& out) const { if (maybePartialDisplayAtom() && maybePartialDisplayAtom()->length() > 0) { maybePartialDisplayAtom()->dumpPropertyName(out); } else { out.put("(anonymous)"); } if (hasBaseScript()) { out.put(" ("); baseScript()->dumpStringContent(out); out.put(")"); } } #endif #ifdef DEBUG static JSObject* SkipEnvironmentObjects(JSObject* env) { if (!env) { return nullptr; } while (env->is()) { env = &env->as().enclosingEnvironment(); } return env; } static bool NewFunctionEnvironmentIsWellFormed(JSContext* cx, HandleObject env) { // Assert that the terminating environment is null, global, or a debug // scope proxy. All other cases of polluting global scope behavior are // handled by EnvironmentObjects (viz. non-syntactic DynamicWithObject and // NonSyntacticVariablesObject). RootedObject terminatingEnv(cx, SkipEnvironmentObjects(env)); return !terminatingEnv || terminatingEnv == cx->global() || terminatingEnv->is(); } #endif static inline const JSClass* FunctionClassForAllocKind( gc::AllocKind allocKind) { return (allocKind == gc::AllocKind::FUNCTION) ? FunctionClassPtr : FunctionExtendedClassPtr; } static void AssertClassMatchesAllocKind(const JSClass* clasp, gc::AllocKind kind) { #ifdef DEBUG if (kind == gc::AllocKind::FUNCTION_EXTENDED) { MOZ_ASSERT(clasp == FunctionExtendedClassPtr); } else { MOZ_ASSERT(kind == gc::AllocKind::FUNCTION); MOZ_ASSERT(clasp == FunctionClassPtr); } #endif } static SharedShape* GetFunctionShape(JSContext* cx, const JSClass* clasp, JSObject* proto, gc::AllocKind allocKind) { AssertClassMatchesAllocKind(clasp, allocKind); size_t nfixed = GetGCKindSlots(allocKind); return SharedShape::getInitialShape( cx, clasp, cx->realm(), TaggedProto(proto), nfixed, ObjectFlags()); } SharedShape* GlobalObject::createFunctionShapeWithDefaultProto(JSContext* cx, bool extended) { GlobalObjectData& data = cx->global()->data(); HeapPtr& shapeRef = extended ? data.extendedFunctionShapeWithDefaultProto : data.functionShapeWithDefaultProto; MOZ_ASSERT(!shapeRef); RootedObject proto(cx, GlobalObject::getOrCreatePrototype(cx, JSProto_Function)); if (!proto) { return nullptr; } // Creating %Function.prototype% can end up initializing the shape. if (shapeRef) { return shapeRef; } gc::AllocKind allocKind = extended ? gc::AllocKind::FUNCTION_EXTENDED : gc::AllocKind::FUNCTION; const JSClass* clasp = FunctionClassForAllocKind(allocKind); SharedShape* shape = GetFunctionShape(cx, clasp, proto, allocKind); if (!shape) { return nullptr; } shapeRef.init(shape); return shape; } JSFunction* js::NewFunctionWithProto( JSContext* cx, Native native, unsigned nargs, FunctionFlags flags, HandleObject enclosingEnv, Handle atom, HandleObject proto, gc::AllocKind allocKind /* = AllocKind::FUNCTION */, NewObjectKind newKind /* = GenericObject */) { MOZ_ASSERT(allocKind == gc::AllocKind::FUNCTION || allocKind == gc::AllocKind::FUNCTION_EXTENDED); MOZ_ASSERT_IF(native, !enclosingEnv); MOZ_ASSERT(NewFunctionEnvironmentIsWellFormed(cx, enclosingEnv)); // NOTE: Keep this in sync with `CreateFunctionFast` in Stencil.cpp const JSClass* clasp = FunctionClassForAllocKind(allocKind); Rooted shape(cx); if (!proto) { bool extended = (allocKind == gc::AllocKind::FUNCTION_EXTENDED); shape = GlobalObject::getFunctionShapeWithDefaultProto(cx, extended); } else { shape = GetFunctionShape(cx, clasp, proto, allocKind); } if (!shape) { return nullptr; } gc::Heap heap = GetInitialHeap(newKind, clasp); JSFunction* fun = JSFunction::create(cx, allocKind, heap, shape); if (!fun) { return nullptr; } if (allocKind == gc::AllocKind::FUNCTION_EXTENDED) { flags.setIsExtended(); } // Disallow flags that require special union arms to be initialized. MOZ_ASSERT(!flags.hasSelfHostedLazyScript()); MOZ_ASSERT(!flags.isWasmWithJitEntry()); /* Initialize all function members. */ fun->setArgCount(uint16_t(nargs)); fun->setFlags(flags); if (fun->isInterpreted()) { fun->initScript(nullptr); fun->initEnvironment(enclosingEnv); } else { MOZ_ASSERT(fun->isNativeFun()); fun->initNative(native, nullptr); } fun->initAtom(atom); #ifdef DEBUG fun->assertFunctionKindIntegrity(); #endif return fun; } bool js::GetFunctionPrototype(JSContext* cx, js::GeneratorKind generatorKind, js::FunctionAsyncKind asyncKind, js::MutableHandleObject proto) { if (generatorKind == js::GeneratorKind::NotGenerator) { if (asyncKind == js::FunctionAsyncKind::SyncFunction) { proto.set(nullptr); return true; } proto.set( GlobalObject::getOrCreateAsyncFunctionPrototype(cx, cx->global())); } else { if (asyncKind == js::FunctionAsyncKind::SyncFunction) { proto.set(GlobalObject::getOrCreateGeneratorFunctionPrototype( cx, cx->global())); } else { proto.set(GlobalObject::getOrCreateAsyncGenerator(cx, cx->global())); } } return !!proto; } #ifdef DEBUG static bool CanReuseScriptForClone(JS::Realm* realm, HandleFunction fun, HandleObject newEnclosingEnv) { MOZ_ASSERT(fun->isInterpreted()); if (realm != fun->realm()) { return false; } if (newEnclosingEnv->is()) { return true; } // Don't need to clone the script if newEnclosingEnv is a syntactic scope, // since in that case we have some actual scope objects on our scope chain and // whatnot; whoever put them there should be responsible for setting our // script's flags appropriately. We hit this case for JSOp::Lambda, for // example. if (IsSyntacticEnvironment(newEnclosingEnv)) { return true; } // We need to clone the script if we're not already marked as having a // non-syntactic scope. The HasNonSyntacticScope flag is not computed for lazy // scripts so fallback to checking the scope chain. BaseScript* script = fun->baseScript(); return script->hasNonSyntacticScope() || script->enclosingScope()->hasOnChain(ScopeKind::NonSyntactic); } #endif static inline JSFunction* NewFunctionClone(JSContext* cx, HandleFunction fun, HandleObject proto) { MOZ_ASSERT(cx->realm() == fun->realm()); MOZ_ASSERT(proto); const JSClass* clasp = fun->getClass(); gc::AllocKind allocKind = fun->getAllocKind(); AssertClassMatchesAllocKind(clasp, allocKind); // If |fun| also has |proto| as prototype (the common case) we can reuse its // shape for the clone. This works because |fun| isn't exposed to script. Rooted shape(cx); if (fun->staticPrototype() == proto) { shape = fun->sharedShape(); MOZ_ASSERT(shape->propMapLength() == 0); MOZ_ASSERT(shape->objectFlags().isEmpty()); MOZ_ASSERT(shape->realm() == cx->realm()); } else { shape = GetFunctionShape(cx, clasp, proto, allocKind); if (!shape) { return nullptr; } } JSFunction* clone = JSFunction::create(cx, allocKind, gc::Heap::Default, shape); if (!clone) { return nullptr; } constexpr uint16_t NonCloneableFlags = FunctionFlags::RESOLVED_LENGTH | FunctionFlags::RESOLVED_NAME; FunctionFlags flags = fun->flags(); flags.clearFlags(NonCloneableFlags); clone->setArgCount(fun->nargs()); clone->setFlags(flags); // Note: |clone| and |fun| are same-zone so we don't need to call markAtom. clone->initAtom(fun->maybePartialDisplayAtom()); #ifdef DEBUG clone->assertFunctionKindIntegrity(); #endif return clone; } JSFunction* js::CloneFunctionReuseScript(JSContext* cx, HandleFunction fun, HandleObject enclosingEnv, HandleObject proto) { MOZ_ASSERT(cx->realm() == fun->realm()); MOZ_ASSERT(NewFunctionEnvironmentIsWellFormed(cx, enclosingEnv)); MOZ_ASSERT(fun->isInterpreted()); MOZ_ASSERT(fun->hasBaseScript()); MOZ_ASSERT(CanReuseScriptForClone(cx->realm(), fun, enclosingEnv)); JSFunction* clone = NewFunctionClone(cx, fun, proto); if (!clone) { return nullptr; } BaseScript* base = fun->baseScript(); clone->initScript(base); clone->initEnvironment(enclosingEnv); #ifdef DEBUG // Assert extended slots don't need to be copied. if (fun->isExtended()) { for (unsigned i = 0; i < FunctionExtended::NUM_EXTENDED_SLOTS; i++) { MOZ_ASSERT(fun->getExtendedSlot(i).isUndefined()); MOZ_ASSERT(clone->getExtendedSlot(i).isUndefined()); } } #endif return clone; } JSFunction* js::CloneAsmJSModuleFunction(JSContext* cx, HandleFunction fun) { MOZ_ASSERT(fun->isNativeFun()); MOZ_ASSERT(IsAsmJSModule(fun)); MOZ_ASSERT(fun->isExtended()); MOZ_ASSERT(cx->compartment() == fun->compartment()); RootedObject proto(cx, fun->staticPrototype()); JSFunction* clone = NewFunctionClone(cx, fun, proto); if (!clone) { return nullptr; } MOZ_ASSERT(fun->native() == InstantiateAsmJS); MOZ_ASSERT(!fun->hasJitInfo()); clone->initNative(InstantiateAsmJS, nullptr); JSObject* moduleObj = &fun->getExtendedSlot(FunctionExtended::ASMJS_MODULE_SLOT).toObject(); clone->initExtendedSlot(FunctionExtended::ASMJS_MODULE_SLOT, ObjectValue(*moduleObj)); return clone; } static JSAtom* SymbolToFunctionName(JSContext* cx, JS::Symbol* symbol, FunctionPrefixKind prefixKind) { // Step 4.a. JSAtom* desc = symbol->description(); // Step 4.b, no prefix fastpath. if (!desc && prefixKind == FunctionPrefixKind::None) { return cx->names().empty_; } // Step 5 (reordered). StringBuffer sb(cx); if (prefixKind == FunctionPrefixKind::Get) { if (!sb.append("get ")) { return nullptr; } } else if (prefixKind == FunctionPrefixKind::Set) { if (!sb.append("set ")) { return nullptr; } } // Step 4.b. if (desc) { // Note: Private symbols are wedged in, as implementation wise they're // PrivateNameSymbols with a the source level name as a description // i.e. obj.#f desugars to obj.[PrivateNameSymbol("#f")], however // they don't use the symbol naming, but rather property naming. if (symbol->isPrivateName()) { if (!sb.append(desc)) { return nullptr; } } else { // Step 4.c. if (!sb.append('[') || !sb.append(desc) || !sb.append(']')) { return nullptr; } } } return sb.finishAtom(); } /* * Return an atom for use as the name of a builtin method with the given * property id. * * Function names are always strings. If id is the well-known @@iterator * symbol, this returns "[Symbol.iterator]". If a prefix is supplied the final * name is |prefix + " " + name|. * * Implements steps 3-5 of 9.2.11 SetFunctionName in ES2016. */ JSAtom* js::IdToFunctionName( JSContext* cx, HandleId id, FunctionPrefixKind prefixKind /* = FunctionPrefixKind::None */) { MOZ_ASSERT(id.isString() || id.isSymbol() || id.isInt()); // No prefix fastpath. if (id.isAtom() && prefixKind == FunctionPrefixKind::None) { return id.toAtom(); } // Step 3 (implicit). // Step 4. if (id.isSymbol()) { return SymbolToFunctionName(cx, id.toSymbol(), prefixKind); } // Step 5. RootedValue idv(cx, IdToValue(id)); return NameToFunctionName(cx, idv, prefixKind); } bool js::SetFunctionName(JSContext* cx, HandleFunction fun, HandleValue name, FunctionPrefixKind prefixKind) { MOZ_ASSERT(name.isString() || name.isSymbol() || name.isNumeric()); // `fun` is a newly created function, so it can't already have an inferred // name. MOZ_ASSERT(!fun->hasInferredName()); // Anonymous functions should neither have an own 'name' property nor a // resolved name at this point. MOZ_ASSERT(!fun->containsPure(cx->names().name)); MOZ_ASSERT(!fun->hasResolvedName()); JSAtom* funName = name.isSymbol() ? SymbolToFunctionName(cx, name.toSymbol(), prefixKind) : NameToFunctionName(cx, name, prefixKind); if (!funName) { return false; } fun->setInferredName(funName); return true; } JSFunction* js::DefineFunction( JSContext* cx, HandleObject obj, HandleId id, Native native, unsigned nargs, unsigned flags, gc::AllocKind allocKind /* = AllocKind::FUNCTION */) { Rooted atom(cx, IdToFunctionName(cx, id)); if (!atom) { return nullptr; } MOZ_ASSERT(native); RootedFunction fun(cx); if (flags & JSFUN_CONSTRUCTOR) { fun = NewNativeConstructor(cx, native, nargs, atom, allocKind); } else { fun = NewNativeFunction(cx, native, nargs, atom, allocKind); } if (!fun) { return nullptr; } RootedValue funVal(cx, ObjectValue(*fun)); if (!DefineDataProperty(cx, obj, id, funVal, flags & ~JSFUN_FLAGS_MASK)) { return nullptr; } return fun; } void js::ReportIncompatibleMethod(JSContext* cx, const CallArgs& args, const JSClass* clasp) { RootedValue thisv(cx, args.thisv()); #ifdef DEBUG switch (thisv.type()) { case ValueType::Object: MOZ_ASSERT(thisv.toObject().getClass() != clasp || !thisv.toObject().is() || !thisv.toObject().staticPrototype() || thisv.toObject().staticPrototype()->getClass() != clasp); break; # ifdef ENABLE_RECORD_TUPLE case ValueType::ExtendedPrimitive: MOZ_CRASH("ExtendedPrimitive is not supported yet"); break; # endif case ValueType::String: MOZ_ASSERT(clasp != &StringObject::class_); break; case ValueType::Double: case ValueType::Int32: MOZ_ASSERT(clasp != &NumberObject::class_); break; case ValueType::Boolean: MOZ_ASSERT(clasp != &BooleanObject::class_); break; case ValueType::Symbol: MOZ_ASSERT(clasp != &SymbolObject::class_); break; case ValueType::BigInt: MOZ_ASSERT(clasp != &BigIntObject::class_); break; case ValueType::Undefined: case ValueType::Null: break; case ValueType::Magic: case ValueType::PrivateGCThing: MOZ_CRASH("unexpected type"); } #endif if (JSFunction* fun = ReportIfNotFunction(cx, args.calleev())) { UniqueChars funNameBytes; if (const char* funName = GetFunctionNameBytes(cx, fun, &funNameBytes)) { JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_INCOMPATIBLE_PROTO, clasp->name, funName, InformalValueTypeName(thisv)); } } } void js::ReportIncompatible(JSContext* cx, const CallArgs& args) { if (JSFunction* fun = ReportIfNotFunction(cx, args.calleev())) { UniqueChars funNameBytes; if (const char* funName = GetFunctionNameBytes(cx, fun, &funNameBytes)) { JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_INCOMPATIBLE_METHOD, funName, "method", InformalValueTypeName(args.thisv())); } } } namespace JS { namespace detail { JS_PUBLIC_API void CheckIsValidConstructible(const Value& calleev) { MOZ_ASSERT(calleev.toObject().isConstructor()); } } // namespace detail } // namespace JS