/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- * vim: set ts=8 sts=2 et sw=2 tw=80: * * Copyright 2016 Mozilla Foundation * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ #include "wasm/WasmJS.h" #include "mozilla/CheckedInt.h" #include "mozilla/EndianUtils.h" #include "mozilla/Maybe.h" #include "mozilla/RangedPtr.h" #include #include #include "jsapi.h" #include "jsexn.h" #include "ds/IdValuePair.h" // js::IdValuePair #include "frontend/FrontendContext.h" // AutoReportFrontendContext #include "gc/GCContext.h" #include "jit/AtomicOperations.h" #include "jit/FlushICache.h" #include "jit/JitContext.h" #include "jit/JitOptions.h" #include "jit/Simulator.h" #include "js/ColumnNumber.h" // JS::ColumnNumberOneOrigin #include "js/ForOfIterator.h" #include "js/friend/ErrorMessages.h" // js::GetErrorMessage, JSMSG_* #include "js/Printf.h" #include "js/PropertyAndElement.h" // JS_DefineProperty, JS_GetProperty #include "js/PropertySpec.h" // JS_{PS,FN}{,_END} #include "js/Stack.h" // BuildStackString #include "js/StreamConsumer.h" #include "util/StringBuffer.h" #include "util/Text.h" #include "vm/ErrorObject.h" #include "vm/FunctionFlags.h" // js::FunctionFlags #include "vm/GlobalObject.h" // js::GlobalObject #include "vm/HelperThreadState.h" // js::PromiseHelperTask #include "vm/Interpreter.h" #include "vm/JSFunction.h" #include "vm/PlainObject.h" // js::PlainObject #include "vm/PromiseObject.h" // js::PromiseObject #include "vm/SharedArrayObject.h" #include "vm/StringType.h" #include "vm/Warnings.h" // js::WarnNumberASCII #include "wasm/WasmBaselineCompile.h" #include "wasm/WasmBuiltinModule.h" #include "wasm/WasmBuiltins.h" #include "wasm/WasmCompile.h" #include "wasm/WasmDebug.h" #include "wasm/WasmFeatures.h" #include "wasm/WasmInstance.h" #include "wasm/WasmIonCompile.h" #include "wasm/WasmMemory.h" #include "wasm/WasmModule.h" #include "wasm/WasmProcess.h" #include "wasm/WasmSignalHandlers.h" #include "wasm/WasmStubs.h" #include "wasm/WasmValidate.h" #include "gc/GCContext-inl.h" #include "gc/StableCellHasher-inl.h" #include "vm/ArrayBufferObject-inl.h" #include "vm/JSObject-inl.h" #include "vm/NativeObject-inl.h" #include "wasm/WasmInstance-inl.h" /* * [SMDOC] WebAssembly code rules (evolving) * * TlsContext.get() is only to be invoked from functions that have been invoked * _directly_ by generated code as cold(!) Builtin calls, from code that is * only used by signal handlers, or from helper functions that have been * called _directly_ from a simulator. All other code shall pass in a * JSContext* to functions that need it, or an Instance* or Instance* since * the context is available through them. * * Code that uses TlsContext.get() shall annotate each such call with the * reason why the call is OK. */ using namespace js; using namespace js::jit; using namespace js::wasm; using mozilla::CheckedInt; using mozilla::Nothing; using mozilla::RangedPtr; using mozilla::Span; static bool ThrowCompileOutOfMemory(JSContext* cx) { // Most OOMs during compilation are due to large contiguous allocations, // and future allocations are likely to succeed. Throwing a proper error // object is nicer for users in these circumstances. JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_OUT_OF_MEMORY); return false; } // ============================================================================ // Imports static bool ThrowBadImportArg(JSContext* cx) { JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_BAD_IMPORT_ARG); return false; } static bool ThrowBadImportType(JSContext* cx, const CacheableName& field, const char* str) { UniqueChars fieldQuoted = field.toQuotedString(cx); if (!fieldQuoted) { ReportOutOfMemory(cx); return false; } JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_BAD_IMPORT_TYPE, fieldQuoted.get(), str); return false; } // For now reject cross-compartment wrappers. These have more complicated realm // semantics (we use nonCCWRealm in a few places) and may require unwrapping to // test for specific function types. static bool IsCallableNonCCW(const Value& v) { return IsCallable(v) && !IsCrossCompartmentWrapper(&v.toObject()); } bool js::wasm::GetImports(JSContext* cx, const Module& module, HandleObject importObj, ImportValues* imports) { if (!module.imports().empty() && !importObj) { return ThrowBadImportArg(cx); } const Metadata& metadata = module.metadata(); BuiltinModuleInstances builtinInstances(cx); RootedValue importModuleValue(cx); RootedObject importModuleObject(cx); RootedValue importFieldValue(cx); uint32_t tagIndex = 0; const TagDescVector& tags = metadata.tags; uint32_t globalIndex = 0; const GlobalDescVector& globals = metadata.globals; uint32_t tableIndex = 0; const TableDescVector& tables = metadata.tables; for (const Import& import : module.imports()) { Maybe builtinModule = ImportMatchesBuiltinModule( import.module.utf8Bytes(), metadata.builtinModules); if (builtinModule) { MutableHandle builtinInstance = builtinInstances[*builtinModule]; if (!builtinInstance && !wasm::InstantiateBuiltinModule( cx, *builtinModule, builtinInstance)) { return false; } importModuleObject = builtinInstance; } else { RootedId moduleName(cx); if (!import.module.toPropertyKey(cx, &moduleName)) { return false; } if (!GetProperty(cx, importObj, importObj, moduleName, &importModuleValue)) { return false; } if (!importModuleValue.isObject()) { UniqueChars moduleQuoted = import.module.toQuotedString(cx); if (!moduleQuoted) { ReportOutOfMemory(cx); return false; } JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_BAD_IMPORT_FIELD, moduleQuoted.get()); return false; } importModuleObject = &importModuleValue.toObject(); } RootedId fieldName(cx); if (!import.field.toPropertyKey(cx, &fieldName)) { return false; } if (!GetProperty(cx, importModuleObject, importModuleObject, fieldName, &importFieldValue)) { return false; } switch (import.kind) { case DefinitionKind::Function: { if (!IsCallableNonCCW(importFieldValue)) { return ThrowBadImportType(cx, import.field, "Function"); } if (!imports->funcs.append(&importFieldValue.toObject())) { return false; } break; } case DefinitionKind::Table: { const uint32_t index = tableIndex++; if (!importFieldValue.isObject() || !importFieldValue.toObject().is()) { return ThrowBadImportType(cx, import.field, "Table"); } Rooted obj( cx, &importFieldValue.toObject().as()); if (obj->table().elemType() != tables[index].elemType) { JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_BAD_TBL_TYPE_LINK); return false; } if (!imports->tables.append(obj)) { return false; } break; } case DefinitionKind::Memory: { if (!importFieldValue.isObject() || !importFieldValue.toObject().is()) { return ThrowBadImportType(cx, import.field, "Memory"); } if (!imports->memories.append( &importFieldValue.toObject().as())) { return false; } break; } case DefinitionKind::Tag: { const uint32_t index = tagIndex++; if (!importFieldValue.isObject() || !importFieldValue.toObject().is()) { return ThrowBadImportType(cx, import.field, "Tag"); } Rooted obj( cx, &importFieldValue.toObject().as()); // Checks whether the signature of the imported exception object matches // the signature declared in the exception import's TagDesc. if (obj->resultType() != tags[index].type->resultType()) { UniqueChars fieldQuoted = import.field.toQuotedString(cx); UniqueChars moduleQuoted = import.module.toQuotedString(cx); if (!fieldQuoted || !moduleQuoted) { ReportOutOfMemory(cx); return false; } JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_BAD_TAG_SIG, moduleQuoted.get(), fieldQuoted.get()); return false; } if (!imports->tagObjs.append(obj)) { ReportOutOfMemory(cx); return false; } break; } case DefinitionKind::Global: { const uint32_t index = globalIndex++; const GlobalDesc& global = globals[index]; MOZ_ASSERT(global.importIndex() == index); RootedVal val(cx); if (importFieldValue.isObject() && importFieldValue.toObject().is()) { Rooted obj( cx, &importFieldValue.toObject().as()); if (obj->isMutable() != global.isMutable()) { JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_BAD_GLOB_MUT_LINK); return false; } bool matches = global.isMutable() ? obj->type() == global.type() : ValType::isSubTypeOf(obj->type(), global.type()); if (!matches) { JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_BAD_GLOB_TYPE_LINK); return false; } if (imports->globalObjs.length() <= index && !imports->globalObjs.resize(index + 1)) { ReportOutOfMemory(cx); return false; } imports->globalObjs[index] = obj; val = obj->val(); } else { if (!global.type().isRefType()) { if (global.type() == ValType::I64 && !importFieldValue.isBigInt()) { return ThrowBadImportType(cx, import.field, "BigInt"); } if (global.type() != ValType::I64 && !importFieldValue.isNumber()) { return ThrowBadImportType(cx, import.field, "Number"); } } if (global.isMutable()) { JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_BAD_GLOB_MUT_LINK); return false; } if (!Val::fromJSValue(cx, global.type(), importFieldValue, &val)) { return false; } } if (!imports->globalValues.append(val)) { return false; } break; } } } MOZ_ASSERT(globalIndex == globals.length() || !globals[globalIndex].isImport()); return true; } static bool DescribeScriptedCaller(JSContext* cx, ScriptedCaller* caller, const char* introducer) { // Note: JS::DescribeScriptedCaller returns whether a scripted caller was // found, not whether an error was thrown. This wrapper function converts // back to the more ordinary false-if-error form. JS::AutoFilename af; if (JS::DescribeScriptedCaller(cx, &af, &caller->line)) { caller->filename = FormatIntroducedFilename(af.get(), caller->line, introducer); if (!caller->filename) { ReportOutOfMemory(cx); return false; } } return true; } static SharedCompileArgs InitCompileArgs(JSContext* cx, FeatureOptions options, const char* introducer) { ScriptedCaller scriptedCaller; if (!DescribeScriptedCaller(cx, &scriptedCaller, introducer)) { return nullptr; } return CompileArgs::buildAndReport(cx, std::move(scriptedCaller), options); } // ============================================================================ // Testing / Fuzzing support bool wasm::Eval(JSContext* cx, Handle code, HandleObject importObj, MutableHandle instanceObj) { if (!GlobalObject::ensureConstructor(cx, cx->global(), JSProto_WebAssembly)) { return false; } MutableBytes bytecode = cx->new_(); if (!bytecode) { return false; } if (!bytecode->append((uint8_t*)code->dataPointerEither().unwrap(), code->byteLength().valueOr(0))) { ReportOutOfMemory(cx); return false; } FeatureOptions options; SharedCompileArgs compileArgs = InitCompileArgs(cx, options, "wasm_eval"); if (!compileArgs) { return false; } UniqueChars error; UniqueCharsVector warnings; SharedModule module = CompileBuffer(*compileArgs, *bytecode, &error, &warnings, nullptr); if (!module) { if (error) { JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_COMPILE_ERROR, error.get()); return false; } return ThrowCompileOutOfMemory(cx); } Rooted imports(cx); if (!GetImports(cx, *module, importObj, imports.address())) { return false; } return module->instantiate(cx, imports.get(), nullptr, instanceObj); } struct MOZ_STACK_CLASS SerializeListener : JS::OptimizedEncodingListener { // MOZ_STACK_CLASS means these can be nops. MozExternalRefCountType MOZ_XPCOM_ABI AddRef() override { return 0; } MozExternalRefCountType MOZ_XPCOM_ABI Release() override { return 0; } DebugOnly called = false; Bytes* serialized; explicit SerializeListener(Bytes* serialized) : serialized(serialized) {} void storeOptimizedEncoding(const uint8_t* bytes, size_t length) override { MOZ_ASSERT(!called); called = true; if (serialized->resizeUninitialized(length)) { memcpy(serialized->begin(), bytes, length); } } }; bool wasm::CompileAndSerialize(JSContext* cx, const ShareableBytes& bytecode, Bytes* serialized) { // The caller must check that code caching is available MOZ_ASSERT(CodeCachingAvailable(cx)); // Create and manually fill in compile args for code caching MutableCompileArgs compileArgs = js_new(ScriptedCaller()); if (!compileArgs) { return false; } // The caller has ensured CodeCachingAvailable(). Moreover, we want to ensure // we go straight to tier-2 so that we synchronously call // JS::OptimizedEncodingListener::storeOptimizedEncoding(). compileArgs->baselineEnabled = false; compileArgs->forceTiering = false; // We always pick Ion here, and we depend on CodeCachingAvailable() having // determined that Ion is available, see comments at CodeCachingAvailable(). // To do better, we need to pass information about which compiler that should // be used into CompileAndSerialize(). compileArgs->ionEnabled = true; // Select features that are enabled. This is guaranteed to be consistent with // our compiler selection, as code caching is only available if ion is // available, and ion is only available if it's not disabled by enabled // features. compileArgs->features = FeatureArgs::build(cx, FeatureOptions()); SerializeListener listener(serialized); UniqueChars error; UniqueCharsVector warnings; SharedModule module = CompileBuffer(*compileArgs, bytecode, &error, &warnings, &listener); if (!module) { fprintf(stderr, "Compilation error: %s\n", error ? error.get() : "oom"); return false; } MOZ_ASSERT(module->code().hasTier(Tier::Serialized)); MOZ_ASSERT(listener.called); return !listener.serialized->empty(); } bool wasm::DeserializeModule(JSContext* cx, const Bytes& serialized, MutableHandleObject moduleObj) { MutableModule module = Module::deserialize(serialized.begin(), serialized.length()); if (!module) { ReportOutOfMemory(cx); return false; } moduleObj.set(module->createObject(cx)); return !!moduleObj; } // ============================================================================ // Common functions // '[EnforceRange] unsigned long' types are coerced with // ConvertToInt(v, 32, 'unsigned') // defined in Web IDL Section 3.2.4.9. // // This just generalizes that to an arbitrary limit that is representable as an // integer in double form. static bool EnforceRange(JSContext* cx, HandleValue v, const char* kind, const char* noun, uint64_t max, uint64_t* val) { // Step 4. double x; if (!ToNumber(cx, v, &x)) { return false; } // Step 5. if (mozilla::IsNegativeZero(x)) { x = 0.0; } // Step 6.1. if (!std::isfinite(x)) { JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_BAD_ENFORCE_RANGE, kind, noun); return false; } // Step 6.2. x = JS::ToInteger(x); // Step 6.3. if (x < 0 || x > double(max)) { JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_BAD_ENFORCE_RANGE, kind, noun); return false; } *val = uint64_t(x); MOZ_ASSERT(double(*val) == x); return true; } static bool EnforceRangeU32(JSContext* cx, HandleValue v, const char* kind, const char* noun, uint32_t* u32) { uint64_t u64 = 0; if (!EnforceRange(cx, v, kind, noun, uint64_t(UINT32_MAX), &u64)) { return false; } *u32 = uint32_t(u64); return true; } static bool EnforceRangeU64(JSContext* cx, HandleValue v, const char* kind, const char* noun, uint64_t* u64) { // The max is Number.MAX_SAFE_INTEGER return EnforceRange(cx, v, kind, noun, (1LL << 53) - 1, u64); } static bool GetLimit(JSContext* cx, HandleObject obj, const char* name, const char* noun, const char* msg, uint32_t range, bool* found, uint64_t* value) { JSAtom* atom = Atomize(cx, name, strlen(name)); if (!atom) { return false; } RootedId id(cx, AtomToId(atom)); RootedValue val(cx); if (!GetProperty(cx, obj, obj, id, &val)) { return false; } if (val.isUndefined()) { *found = false; return true; } *found = true; // The range can be greater than 53, but then the logic in EnforceRange has to // change to avoid precision loss. MOZ_ASSERT(range < 54); return EnforceRange(cx, val, noun, msg, (uint64_t(1) << range) - 1, value); } static bool GetLimits(JSContext* cx, HandleObject obj, LimitsKind kind, Limits* limits) { limits->indexType = IndexType::I32; // Memory limits may specify an alternate index type, and we need this to // check the ranges for initial and maximum, so look for the index type first. if (kind == LimitsKind::Memory) { #ifdef ENABLE_WASM_MEMORY64 // Get the index type field JSAtom* indexTypeAtom = Atomize(cx, "index", strlen("index")); if (!indexTypeAtom) { return false; } RootedId indexTypeId(cx, AtomToId(indexTypeAtom)); RootedValue indexTypeVal(cx); if (!GetProperty(cx, obj, obj, indexTypeId, &indexTypeVal)) { return false; } // The index type has a default value if (!indexTypeVal.isUndefined()) { if (!ToIndexType(cx, indexTypeVal, &limits->indexType)) { return false; } if (limits->indexType == IndexType::I64 && !Memory64Available(cx)) { JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_WASM_NO_MEM64_LINK); return false; } } #endif } const char* noun = (kind == LimitsKind::Memory ? "Memory" : "Table"); // 2^48 is a valid value, so the range goes to 49 bits. Values above 2^48 are // filtered later, just as values above 2^16 are filtered for mem32. const uint32_t range = limits->indexType == IndexType::I32 ? 32 : 49; uint64_t limit = 0; bool haveInitial = false; if (!GetLimit(cx, obj, "initial", noun, "initial size", range, &haveInitial, &limit)) { return false; } if (haveInitial) { limits->initial = limit; } bool haveMinimum = false; #ifdef ENABLE_WASM_TYPE_REFLECTIONS if (!GetLimit(cx, obj, "minimum", noun, "initial size", range, &haveMinimum, &limit)) { return false; } if (haveMinimum) { limits->initial = limit; } #endif if (!(haveInitial || haveMinimum)) { JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_MISSING_REQUIRED, "initial"); return false; } if (haveInitial && haveMinimum) { JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_SUPPLY_ONLY_ONE, "minimum", "initial"); return false; } bool haveMaximum = false; if (!GetLimit(cx, obj, "maximum", noun, "maximum size", range, &haveMaximum, &limit)) { return false; } if (haveMaximum) { limits->maximum = Some(limit); } limits->shared = Shareable::False; // Memory limits may be shared. if (kind == LimitsKind::Memory) { // Get the shared field JSAtom* sharedAtom = Atomize(cx, "shared", strlen("shared")); if (!sharedAtom) { return false; } RootedId sharedId(cx, AtomToId(sharedAtom)); RootedValue sharedVal(cx); if (!GetProperty(cx, obj, obj, sharedId, &sharedVal)) { return false; } // shared's default value is false, which is already the value set above. if (!sharedVal.isUndefined()) { limits->shared = ToBoolean(sharedVal) ? Shareable::True : Shareable::False; if (limits->shared == Shareable::True) { if (!haveMaximum) { JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_WASM_MISSING_MAXIMUM, noun); return false; } if (!cx->realm() ->creationOptions() .getSharedMemoryAndAtomicsEnabled()) { JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_WASM_NO_SHMEM_LINK); return false; } } } } return true; } static bool CheckLimits(JSContext* cx, uint64_t maximumField, LimitsKind kind, Limits* limits) { const char* noun = (kind == LimitsKind::Memory ? "Memory" : "Table"); if (limits->initial > maximumField) { JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_BAD_RANGE, noun, "initial size"); return false; } if (limits->maximum.isSome() && (*limits->maximum > maximumField || limits->initial > *limits->maximum)) { JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_BAD_RANGE, noun, "maximum size"); return false; } return true; } template static JSObject* CreateWasmConstructor(JSContext* cx, JSProtoKey key) { Rooted className(cx, Atomize(cx, name, strlen(name))); if (!className) { return nullptr; } return NewNativeConstructor(cx, Class::construct, 1, className); } static JSObject* GetWasmConstructorPrototype(JSContext* cx, const CallArgs& callArgs, JSProtoKey key) { RootedObject proto(cx); if (!GetPrototypeFromBuiltinConstructor(cx, callArgs, key, &proto)) { return nullptr; } if (!proto) { proto = GlobalObject::getOrCreatePrototype(cx, key); } return proto; } [[nodiscard]] static bool ParseValTypes(JSContext* cx, HandleValue src, ValTypeVector& dest) { JS::ForOfIterator iterator(cx); if (!iterator.init(src, JS::ForOfIterator::ThrowOnNonIterable)) { return false; } RootedValue nextParam(cx); while (true) { bool done; if (!iterator.next(&nextParam, &done)) { return false; } if (done) { break; } ValType valType; if (!ToValType(cx, nextParam, &valType) || !dest.append(valType)) { return false; } } return true; } #ifdef ENABLE_WASM_TYPE_REFLECTIONS template static JSString* TypeToString(JSContext* cx, T type) { UniqueChars chars = ToString(type, nullptr); if (!chars) { return nullptr; } return NewStringCopyUTF8Z( cx, JS::ConstUTF8CharsZ(chars.get(), strlen(chars.get()))); } [[nodiscard]] static JSObject* ValTypesToArray(JSContext* cx, const ValTypeVector& valTypes) { Rooted arrayObj(cx, NewDenseEmptyArray(cx)); if (!arrayObj) { return nullptr; } for (ValType valType : valTypes) { RootedString type(cx, TypeToString(cx, valType)); if (!type) { return nullptr; } if (!NewbornArrayPush(cx, arrayObj, StringValue(type))) { return nullptr; } } return arrayObj; } static JSObject* FuncTypeToObject(JSContext* cx, const FuncType& type) { Rooted props(cx, IdValueVector(cx)); RootedObject parametersObj(cx, ValTypesToArray(cx, type.args())); if (!parametersObj || !props.append(IdValuePair(NameToId(cx->names().parameters), ObjectValue(*parametersObj)))) { ReportOutOfMemory(cx); return nullptr; } RootedObject resultsObj(cx, ValTypesToArray(cx, type.results())); if (!resultsObj || !props.append(IdValuePair(NameToId(cx->names().results), ObjectValue(*resultsObj)))) { ReportOutOfMemory(cx); return nullptr; } return NewPlainObjectWithUniqueNames(cx, props); } static JSObject* TableTypeToObject(JSContext* cx, RefType type, uint32_t initial, Maybe maximum) { Rooted props(cx, IdValueVector(cx)); RootedString elementType(cx, TypeToString(cx, type)); if (!elementType || !props.append(IdValuePair(NameToId(cx->names().element), StringValue(elementType)))) { ReportOutOfMemory(cx); return nullptr; } if (maximum.isSome()) { if (!props.append(IdValuePair(NameToId(cx->names().maximum), NumberValue(maximum.value())))) { ReportOutOfMemory(cx); return nullptr; } } if (!props.append( IdValuePair(NameToId(cx->names().minimum), NumberValue(initial)))) { ReportOutOfMemory(cx); return nullptr; } return NewPlainObjectWithUniqueNames(cx, props); } static JSObject* MemoryTypeToObject(JSContext* cx, bool shared, wasm::IndexType indexType, wasm::Pages minPages, Maybe maxPages) { Rooted props(cx, IdValueVector(cx)); if (maxPages) { double maxPagesNum; if (indexType == IndexType::I32) { maxPagesNum = double(mozilla::AssertedCast(maxPages->value())); } else { // The maximum number of pages is 2^48. maxPagesNum = double(maxPages->value()); } if (!props.append(IdValuePair(NameToId(cx->names().maximum), NumberValue(maxPagesNum)))) { ReportOutOfMemory(cx); return nullptr; } } double minPagesNum; if (indexType == IndexType::I32) { minPagesNum = double(mozilla::AssertedCast(minPages.value())); } else { minPagesNum = double(minPages.value()); } if (!props.append(IdValuePair(NameToId(cx->names().minimum), NumberValue(minPagesNum)))) { ReportOutOfMemory(cx); return nullptr; } # ifdef ENABLE_WASM_MEMORY64 RootedString it( cx, JS_NewStringCopyZ(cx, indexType == IndexType::I32 ? "i32" : "i64")); if (!it) { return nullptr; } if (!props.append( IdValuePair(NameToId(cx->names().index), StringValue(it)))) { ReportOutOfMemory(cx); return nullptr; } # endif if (!props.append( IdValuePair(NameToId(cx->names().shared), BooleanValue(shared)))) { ReportOutOfMemory(cx); return nullptr; } return NewPlainObjectWithUniqueNames(cx, props); } static JSObject* GlobalTypeToObject(JSContext* cx, ValType type, bool isMutable) { Rooted props(cx, IdValueVector(cx)); if (!props.append(IdValuePair(NameToId(cx->names().mutable_), BooleanValue(isMutable)))) { ReportOutOfMemory(cx); return nullptr; } RootedString valueType(cx, TypeToString(cx, type)); if (!valueType || !props.append(IdValuePair(NameToId(cx->names().value), StringValue(valueType)))) { ReportOutOfMemory(cx); return nullptr; } return NewPlainObjectWithUniqueNames(cx, props); } static JSObject* TagTypeToObject(JSContext* cx, const wasm::ValTypeVector& params) { Rooted props(cx, IdValueVector(cx)); RootedObject parametersObj(cx, ValTypesToArray(cx, params)); if (!parametersObj || !props.append(IdValuePair(NameToId(cx->names().parameters), ObjectValue(*parametersObj)))) { ReportOutOfMemory(cx); return nullptr; } return NewPlainObjectWithUniqueNames(cx, props); } #endif // ENABLE_WASM_TYPE_REFLECTIONS // ============================================================================ // WebAssembly.Module class and methods const JSClassOps WasmModuleObject::classOps_ = { nullptr, // addProperty nullptr, // delProperty nullptr, // enumerate nullptr, // newEnumerate nullptr, // resolve nullptr, // mayResolve WasmModuleObject::finalize, // finalize nullptr, // call nullptr, // construct nullptr, // trace }; const JSClass WasmModuleObject::class_ = { "WebAssembly.Module", JSCLASS_DELAY_METADATA_BUILDER | JSCLASS_HAS_RESERVED_SLOTS(WasmModuleObject::RESERVED_SLOTS) | JSCLASS_FOREGROUND_FINALIZE, &WasmModuleObject::classOps_, &WasmModuleObject::classSpec_, }; const JSClass& WasmModuleObject::protoClass_ = PlainObject::class_; static constexpr char WasmModuleName[] = "Module"; const ClassSpec WasmModuleObject::classSpec_ = { CreateWasmConstructor, GenericCreatePrototype, WasmModuleObject::static_methods, nullptr, WasmModuleObject::methods, WasmModuleObject::properties, nullptr, ClassSpec::DontDefineConstructor}; const JSPropertySpec WasmModuleObject::properties[] = { JS_STRING_SYM_PS(toStringTag, "WebAssembly.Module", JSPROP_READONLY), JS_PS_END}; const JSFunctionSpec WasmModuleObject::methods[] = {JS_FS_END}; const JSFunctionSpec WasmModuleObject::static_methods[] = { JS_FN("imports", WasmModuleObject::imports, 1, JSPROP_ENUMERATE), JS_FN("exports", WasmModuleObject::exports, 1, JSPROP_ENUMERATE), JS_FN("customSections", WasmModuleObject::customSections, 2, JSPROP_ENUMERATE), JS_FS_END}; /* static */ void WasmModuleObject::finalize(JS::GCContext* gcx, JSObject* obj) { const Module& module = obj->as().module(); obj->zone()->decJitMemory(module.codeLength(module.code().stableTier())); gcx->release(obj, &module, module.gcMallocBytesExcludingCode(), MemoryUse::WasmModule); } static bool IsModuleObject(JSObject* obj, const Module** module) { WasmModuleObject* mobj = obj->maybeUnwrapIf(); if (!mobj) { return false; } *module = &mobj->module(); return true; } static bool GetModuleArg(JSContext* cx, const CallArgs& args, uint32_t numRequired, const char* name, const Module** module) { if (!args.requireAtLeast(cx, name, numRequired)) { return false; } if (!args[0].isObject() || !IsModuleObject(&args[0].toObject(), module)) { JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_BAD_MOD_ARG); return false; } return true; } struct KindNames { Rooted kind; Rooted table; Rooted memory; Rooted tag; Rooted type; explicit KindNames(JSContext* cx) : kind(cx), table(cx), memory(cx), tag(cx), type(cx) {} }; static bool InitKindNames(JSContext* cx, KindNames* names) { JSAtom* kind = Atomize(cx, "kind", strlen("kind")); if (!kind) { return false; } names->kind = kind->asPropertyName(); JSAtom* table = Atomize(cx, "table", strlen("table")); if (!table) { return false; } names->table = table->asPropertyName(); JSAtom* memory = Atomize(cx, "memory", strlen("memory")); if (!memory) { return false; } names->memory = memory->asPropertyName(); JSAtom* tag = Atomize(cx, "tag", strlen("tag")); if (!tag) { return false; } names->tag = tag->asPropertyName(); JSAtom* type = Atomize(cx, "type", strlen("type")); if (!type) { return false; } names->type = type->asPropertyName(); return true; } static JSString* KindToString(JSContext* cx, const KindNames& names, DefinitionKind kind) { switch (kind) { case DefinitionKind::Function: return cx->names().function; case DefinitionKind::Table: return names.table; case DefinitionKind::Memory: return names.memory; case DefinitionKind::Global: return cx->names().global; case DefinitionKind::Tag: return names.tag; } MOZ_CRASH("invalid kind"); } /* static */ bool WasmModuleObject::imports(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); const Module* module; if (!GetModuleArg(cx, args, 1, "WebAssembly.Module.imports", &module)) { return false; } KindNames names(cx); if (!InitKindNames(cx, &names)) { return false; } RootedValueVector elems(cx); if (!elems.reserve(module->imports().length())) { return false; } #ifdef ENABLE_WASM_TYPE_REFLECTIONS const Metadata& metadata = module->metadata(); const MetadataTier& metadataTier = module->metadata(module->code().stableTier()); size_t numFuncImport = 0; size_t numMemoryImport = 0; size_t numGlobalImport = 0; size_t numTableImport = 0; size_t numTagImport = 0; #endif // ENABLE_WASM_TYPE_REFLECTIONS for (const Import& import : module->imports()) { Rooted props(cx, IdValueVector(cx)); if (!props.reserve(3)) { return false; } JSString* moduleStr = import.module.toAtom(cx); if (!moduleStr) { return false; } props.infallibleAppend( IdValuePair(NameToId(cx->names().module), StringValue(moduleStr))); JSString* nameStr = import.field.toAtom(cx); if (!nameStr) { return false; } props.infallibleAppend( IdValuePair(NameToId(cx->names().name), StringValue(nameStr))); JSString* kindStr = KindToString(cx, names, import.kind); if (!kindStr) { return false; } props.infallibleAppend( IdValuePair(NameToId(names.kind), StringValue(kindStr))); #ifdef ENABLE_WASM_TYPE_REFLECTIONS RootedObject typeObj(cx); switch (import.kind) { case DefinitionKind::Function: { size_t funcIndex = numFuncImport++; const FuncType& funcType = metadata.getFuncImportType(metadataTier.funcImports[funcIndex]); typeObj = FuncTypeToObject(cx, funcType); break; } case DefinitionKind::Table: { size_t tableIndex = numTableImport++; const TableDesc& table = metadata.tables[tableIndex]; typeObj = TableTypeToObject(cx, table.elemType, table.initialLength, table.maximumLength); break; } case DefinitionKind::Memory: { size_t memoryIndex = numMemoryImport++; const MemoryDesc& memory = metadata.memories[memoryIndex]; typeObj = MemoryTypeToObject(cx, memory.isShared(), memory.indexType(), memory.initialPages(), memory.maximumPages()); break; } case DefinitionKind::Global: { size_t globalIndex = numGlobalImport++; const GlobalDesc& global = metadata.globals[globalIndex]; typeObj = GlobalTypeToObject(cx, global.type(), global.isMutable()); break; } case DefinitionKind::Tag: { size_t tagIndex = numTagImport++; const TagDesc& tag = metadata.tags[tagIndex]; typeObj = TagTypeToObject(cx, tag.type->argTypes()); break; } } if (!typeObj || !props.append(IdValuePair(NameToId(names.type), ObjectValue(*typeObj)))) { ReportOutOfMemory(cx); return false; } #endif // ENABLE_WASM_TYPE_REFLECTIONS JSObject* obj = NewPlainObjectWithUniqueNames(cx, props); if (!obj) { return false; } elems.infallibleAppend(ObjectValue(*obj)); } JSObject* arr = NewDenseCopiedArray(cx, elems.length(), elems.begin()); if (!arr) { return false; } args.rval().setObject(*arr); return true; } /* static */ bool WasmModuleObject::exports(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); const Module* module; if (!GetModuleArg(cx, args, 1, "WebAssembly.Module.exports", &module)) { return false; } KindNames names(cx); if (!InitKindNames(cx, &names)) { return false; } RootedValueVector elems(cx); if (!elems.reserve(module->exports().length())) { return false; } #ifdef ENABLE_WASM_TYPE_REFLECTIONS const Metadata& metadata = module->metadata(); const MetadataTier& metadataTier = module->metadata(module->code().stableTier()); #endif // ENABLE_WASM_TYPE_REFLECTIONS for (const Export& exp : module->exports()) { Rooted props(cx, IdValueVector(cx)); if (!props.reserve(2)) { return false; } JSString* nameStr = exp.fieldName().toAtom(cx); if (!nameStr) { return false; } props.infallibleAppend( IdValuePair(NameToId(cx->names().name), StringValue(nameStr))); JSString* kindStr = KindToString(cx, names, exp.kind()); if (!kindStr) { return false; } props.infallibleAppend( IdValuePair(NameToId(names.kind), StringValue(kindStr))); #ifdef ENABLE_WASM_TYPE_REFLECTIONS RootedObject typeObj(cx); switch (exp.kind()) { case DefinitionKind::Function: { const FuncExport& fe = metadataTier.lookupFuncExport(exp.funcIndex()); const FuncType& funcType = metadata.getFuncExportType(fe); typeObj = FuncTypeToObject(cx, funcType); break; } case DefinitionKind::Table: { const TableDesc& table = metadata.tables[exp.tableIndex()]; typeObj = TableTypeToObject(cx, table.elemType, table.initialLength, table.maximumLength); break; } case DefinitionKind::Memory: { const MemoryDesc& memory = metadata.memories[exp.memoryIndex()]; typeObj = MemoryTypeToObject(cx, memory.isShared(), memory.indexType(), memory.initialPages(), memory.maximumPages()); break; } case DefinitionKind::Global: { const GlobalDesc& global = metadata.globals[exp.globalIndex()]; typeObj = GlobalTypeToObject(cx, global.type(), global.isMutable()); break; } case DefinitionKind::Tag: { const TagDesc& tag = metadata.tags[exp.tagIndex()]; typeObj = TagTypeToObject(cx, tag.type->argTypes()); break; } } if (!typeObj || !props.append(IdValuePair(NameToId(names.type), ObjectValue(*typeObj)))) { ReportOutOfMemory(cx); return false; } #endif // ENABLE_WASM_TYPE_REFLECTIONS JSObject* obj = NewPlainObjectWithUniqueNames(cx, props); if (!obj) { return false; } elems.infallibleAppend(ObjectValue(*obj)); } JSObject* arr = NewDenseCopiedArray(cx, elems.length(), elems.begin()); if (!arr) { return false; } args.rval().setObject(*arr); return true; } /* static */ bool WasmModuleObject::customSections(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); const Module* module; if (!GetModuleArg(cx, args, 2, "WebAssembly.Module.customSections", &module)) { return false; } Vector name(cx); { RootedString str(cx, ToString(cx, args.get(1))); if (!str) { return false; } Rooted linear(cx, str->ensureLinear(cx)); if (!linear) { return false; } if (!name.initLengthUninitialized( JS::GetDeflatedUTF8StringLength(linear))) { return false; } (void)JS::DeflateStringToUTF8Buffer(linear, Span(name.begin(), name.length())); } RootedValueVector elems(cx); Rooted buf(cx); for (const CustomSection& cs : module->customSections()) { if (name.length() != cs.name.length()) { continue; } if (memcmp(name.begin(), cs.name.begin(), name.length()) != 0) { continue; } buf = ArrayBufferObject::createZeroed(cx, cs.payload->length()); if (!buf) { return false; } memcpy(buf->dataPointer(), cs.payload->begin(), cs.payload->length()); if (!elems.append(ObjectValue(*buf))) { return false; } } JSObject* arr = NewDenseCopiedArray(cx, elems.length(), elems.begin()); if (!arr) { return false; } args.rval().setObject(*arr); return true; } /* static */ WasmModuleObject* WasmModuleObject::create(JSContext* cx, const Module& module, HandleObject proto) { AutoSetNewObjectMetadata metadata(cx); auto* obj = NewObjectWithGivenProto(cx, proto); if (!obj) { return nullptr; } // The pipeline state on some architectures may retain stale instructions // even after we invalidate the instruction cache. There is no generally // available method to broadcast this pipeline flush to all threads after // we've compiled new code, so conservatively perform one here when we're // receiving a module that may have been compiled from another thread. // // The cost of this flush is expected to minimal enough to not be worth // optimizing away in the case the module was compiled on this thread. jit::FlushExecutionContext(); // This accounts for module allocation size (excluding code which is handled // separately - see below). This assumes that the size of associated data // doesn't change for the life of the WasmModuleObject. The size is counted // once per WasmModuleObject referencing a Module. InitReservedSlot(obj, MODULE_SLOT, const_cast(&module), module.gcMallocBytesExcludingCode(), MemoryUse::WasmModule); module.AddRef(); // Bug 1569888: We account for the first tier here; the second tier, if // different, also needs to be accounted for. cx->zone()->incJitMemory(module.codeLength(module.code().stableTier())); return obj; } static bool GetBufferSource(JSContext* cx, JSObject* obj, unsigned errorNumber, MutableBytes* bytecode) { *bytecode = cx->new_(); if (!*bytecode) { return false; } JSObject* unwrapped = CheckedUnwrapStatic(obj); SharedMem dataPointer; size_t byteLength; if (!unwrapped || !IsBufferSource(unwrapped, &dataPointer, &byteLength)) { JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, errorNumber); return false; } if (!(*bytecode)->append(dataPointer.unwrap(), byteLength)) { ReportOutOfMemory(cx); return false; } return true; } static bool ReportCompileWarnings(JSContext* cx, const UniqueCharsVector& warnings) { // Avoid spamming the console. size_t numWarnings = std::min(warnings.length(), 3); for (size_t i = 0; i < numWarnings; i++) { if (!WarnNumberASCII(cx, JSMSG_WASM_COMPILE_WARNING, warnings[i].get())) { return false; } } if (warnings.length() > numWarnings) { if (!WarnNumberASCII(cx, JSMSG_WASM_COMPILE_WARNING, "other warnings suppressed")) { return false; } } return true; } /* static */ bool WasmModuleObject::construct(JSContext* cx, unsigned argc, Value* vp) { CallArgs callArgs = CallArgsFromVp(argc, vp); Log(cx, "sync new Module() started"); if (!ThrowIfNotConstructing(cx, callArgs, "Module")) { return false; } if (!cx->isRuntimeCodeGenEnabled(JS::RuntimeCode::WASM, nullptr)) { JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_CSP_BLOCKED_WASM, "WebAssembly.Module"); return false; } if (!callArgs.requireAtLeast(cx, "WebAssembly.Module", 1)) { return false; } if (!callArgs[0].isObject()) { JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_BAD_BUF_ARG); return false; } MutableBytes bytecode; if (!GetBufferSource(cx, &callArgs[0].toObject(), JSMSG_WASM_BAD_BUF_ARG, &bytecode)) { return false; } FeatureOptions options; if (!options.init(cx, callArgs.get(1))) { return false; } SharedCompileArgs compileArgs = InitCompileArgs(cx, options, "WebAssembly.Module"); if (!compileArgs) { return false; } UniqueChars error; UniqueCharsVector warnings; SharedModule module = CompileBuffer(*compileArgs, *bytecode, &error, &warnings, nullptr); if (!ReportCompileWarnings(cx, warnings)) { return false; } if (!module) { if (error) { JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_COMPILE_ERROR, error.get()); return false; } return ThrowCompileOutOfMemory(cx); } RootedObject proto( cx, GetWasmConstructorPrototype(cx, callArgs, JSProto_WasmModule)); if (!proto) { ReportOutOfMemory(cx); return false; } RootedObject moduleObj(cx, WasmModuleObject::create(cx, *module, proto)); if (!moduleObj) { return false; } Log(cx, "sync new Module() succeded"); callArgs.rval().setObject(*moduleObj); return true; } const Module& WasmModuleObject::module() const { MOZ_ASSERT(is()); return *(const Module*)getReservedSlot(MODULE_SLOT).toPrivate(); } // ============================================================================ // WebAssembly.Instance class and methods const JSClassOps WasmInstanceObject::classOps_ = { nullptr, // addProperty nullptr, // delProperty nullptr, // enumerate nullptr, // newEnumerate nullptr, // resolve nullptr, // mayResolve WasmInstanceObject::finalize, // finalize nullptr, // call nullptr, // construct WasmInstanceObject::trace, // trace }; const JSClass WasmInstanceObject::class_ = { "WebAssembly.Instance", JSCLASS_DELAY_METADATA_BUILDER | JSCLASS_HAS_RESERVED_SLOTS(WasmInstanceObject::RESERVED_SLOTS) | JSCLASS_FOREGROUND_FINALIZE, &WasmInstanceObject::classOps_, &WasmInstanceObject::classSpec_, }; const JSClass& WasmInstanceObject::protoClass_ = PlainObject::class_; static constexpr char WasmInstanceName[] = "Instance"; const ClassSpec WasmInstanceObject::classSpec_ = { CreateWasmConstructor, GenericCreatePrototype, WasmInstanceObject::static_methods, nullptr, WasmInstanceObject::methods, WasmInstanceObject::properties, nullptr, ClassSpec::DontDefineConstructor}; static bool IsInstance(HandleValue v) { return v.isObject() && v.toObject().is(); } /* static */ bool WasmInstanceObject::exportsGetterImpl(JSContext* cx, const CallArgs& args) { args.rval().setObject( args.thisv().toObject().as().exportsObj()); return true; } /* static */ bool WasmInstanceObject::exportsGetter(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); return CallNonGenericMethod(cx, args); } const JSPropertySpec WasmInstanceObject::properties[] = { JS_PSG("exports", WasmInstanceObject::exportsGetter, JSPROP_ENUMERATE), JS_STRING_SYM_PS(toStringTag, "WebAssembly.Instance", JSPROP_READONLY), JS_PS_END}; const JSFunctionSpec WasmInstanceObject::methods[] = {JS_FS_END}; const JSFunctionSpec WasmInstanceObject::static_methods[] = {JS_FS_END}; bool WasmInstanceObject::isNewborn() const { MOZ_ASSERT(is()); return getReservedSlot(INSTANCE_SLOT).isUndefined(); } // WeakScopeMap maps from function index to js::Scope. This maps is weak // to avoid holding scope objects alive. The scopes are normally created // during debugging. // // This is defined here in order to avoid recursive dependency between // WasmJS.h and Scope.h. using WasmFunctionScopeMap = WeakCache, DefaultHasher, CellAllocPolicy>>; class WasmInstanceObject::UnspecifiedScopeMap { public: WasmFunctionScopeMap& asWasmFunctionScopeMap() { return *(WasmFunctionScopeMap*)this; } }; /* static */ void WasmInstanceObject::finalize(JS::GCContext* gcx, JSObject* obj) { WasmInstanceObject& instance = obj->as(); gcx->delete_(obj, &instance.exports(), MemoryUse::WasmInstanceExports); gcx->delete_(obj, &instance.scopes().asWasmFunctionScopeMap(), MemoryUse::WasmInstanceScopes); gcx->delete_(obj, &instance.indirectGlobals(), MemoryUse::WasmInstanceGlobals); if (!instance.isNewborn()) { if (instance.instance().debugEnabled()) { instance.instance().debug().finalize(gcx); } Instance::destroy(&instance.instance()); gcx->removeCellMemory(obj, sizeof(Instance), MemoryUse::WasmInstanceInstance); } } /* static */ void WasmInstanceObject::trace(JSTracer* trc, JSObject* obj) { WasmInstanceObject& instanceObj = obj->as(); instanceObj.exports().trace(trc); instanceObj.indirectGlobals().trace(trc); if (!instanceObj.isNewborn()) { instanceObj.instance().tracePrivate(trc); } } /* static */ WasmInstanceObject* WasmInstanceObject::create( JSContext* cx, const SharedCode& code, const DataSegmentVector& dataSegments, const ModuleElemSegmentVector& elemSegments, uint32_t instanceDataLength, Handle memories, SharedTableVector&& tables, const JSObjectVector& funcImports, const GlobalDescVector& globals, const ValVector& globalImportValues, const WasmGlobalObjectVector& globalObjs, const WasmTagObjectVector& tagObjs, HandleObject proto, UniqueDebugState maybeDebug) { Rooted> exports(cx, js::MakeUnique(cx->zone())); if (!exports) { ReportOutOfMemory(cx); return nullptr; } UniquePtr scopes = js::MakeUnique(cx->zone(), cx->zone()); if (!scopes) { ReportOutOfMemory(cx); return nullptr; } // Note that `scopes` is a WeakCache, auto-linked into a sweep list on the // Zone, and so does not require rooting. uint32_t indirectGlobals = 0; for (uint32_t i = 0; i < globalObjs.length(); i++) { if (globalObjs[i] && globals[i].isIndirect()) { indirectGlobals++; } } Rooted> indirectGlobalObjs( cx, js::MakeUnique(cx->zone())); if (!indirectGlobalObjs || !indirectGlobalObjs->resize(indirectGlobals)) { ReportOutOfMemory(cx); return nullptr; } { uint32_t next = 0; for (uint32_t i = 0; i < globalObjs.length(); i++) { if (globalObjs[i] && globals[i].isIndirect()) { (*indirectGlobalObjs)[next++] = globalObjs[i]; } } } Instance* instance = nullptr; Rooted obj(cx); { // We must delay creating metadata for this object until after all its // slots have been initialized. We must also create the metadata before // calling Instance::init as that may allocate new objects. AutoSetNewObjectMetadata metadata(cx); obj = NewObjectWithGivenProto(cx, proto); if (!obj) { return nullptr; } MOZ_ASSERT(obj->isTenured(), "assumed by WasmTableObject write barriers"); // Finalization assumes these slots are always initialized: InitReservedSlot(obj, EXPORTS_SLOT, exports.release(), MemoryUse::WasmInstanceExports); InitReservedSlot(obj, SCOPES_SLOT, scopes.release(), MemoryUse::WasmInstanceScopes); InitReservedSlot(obj, GLOBALS_SLOT, indirectGlobalObjs.release(), MemoryUse::WasmInstanceGlobals); obj->initReservedSlot(INSTANCE_SCOPE_SLOT, UndefinedValue()); // The INSTANCE_SLOT may not be initialized if Instance allocation fails, // leading to an observable "newborn" state in tracing/finalization. MOZ_ASSERT(obj->isNewborn()); // Create this just before constructing Instance to avoid rooting hazards. instance = Instance::create(cx, obj, code, instanceDataLength, std::move(tables), std::move(maybeDebug)); if (!instance) { return nullptr; } InitReservedSlot(obj, INSTANCE_SLOT, instance, MemoryUse::WasmInstanceInstance); MOZ_ASSERT(!obj->isNewborn()); } if (!instance->init(cx, funcImports, globalImportValues, memories, globalObjs, tagObjs, dataSegments, elemSegments)) { return nullptr; } return obj; } void WasmInstanceObject::initExportsObj(JSObject& exportsObj) { MOZ_ASSERT(getReservedSlot(EXPORTS_OBJ_SLOT).isUndefined()); setReservedSlot(EXPORTS_OBJ_SLOT, ObjectValue(exportsObj)); } static bool GetImportArg(JSContext* cx, HandleValue importArg, MutableHandleObject importObj) { if (!importArg.isUndefined()) { if (!importArg.isObject()) { return ThrowBadImportArg(cx); } importObj.set(&importArg.toObject()); } return true; } /* static */ bool WasmInstanceObject::construct(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); Log(cx, "sync new Instance() started"); if (!ThrowIfNotConstructing(cx, args, "Instance")) { return false; } if (!args.requireAtLeast(cx, "WebAssembly.Instance", 1)) { return false; } const Module* module; if (!args[0].isObject() || !IsModuleObject(&args[0].toObject(), &module)) { JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_BAD_MOD_ARG); return false; } RootedObject importObj(cx); if (!GetImportArg(cx, args.get(1), &importObj)) { return false; } RootedObject proto( cx, GetWasmConstructorPrototype(cx, args, JSProto_WasmInstance)); if (!proto) { ReportOutOfMemory(cx); return false; } Rooted imports(cx); if (!GetImports(cx, *module, importObj, imports.address())) { return false; } Rooted instanceObj(cx); if (!module->instantiate(cx, imports.get(), proto, &instanceObj)) { return false; } Log(cx, "sync new Instance() succeeded"); args.rval().setObject(*instanceObj); return true; } Instance& WasmInstanceObject::instance() const { MOZ_ASSERT(!isNewborn()); return *(Instance*)getReservedSlot(INSTANCE_SLOT).toPrivate(); } JSObject& WasmInstanceObject::exportsObj() const { return getReservedSlot(EXPORTS_OBJ_SLOT).toObject(); } WasmInstanceObject::ExportMap& WasmInstanceObject::exports() const { return *(ExportMap*)getReservedSlot(EXPORTS_SLOT).toPrivate(); } WasmInstanceObject::UnspecifiedScopeMap& WasmInstanceObject::scopes() const { return *(UnspecifiedScopeMap*)(getReservedSlot(SCOPES_SLOT).toPrivate()); } WasmInstanceObject::GlobalObjectVector& WasmInstanceObject::indirectGlobals() const { return *(GlobalObjectVector*)getReservedSlot(GLOBALS_SLOT).toPrivate(); } static bool WasmCall(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); RootedFunction callee(cx, &args.callee().as()); Instance& instance = ExportedFunctionToInstance(callee); uint32_t funcIndex = ExportedFunctionToFuncIndex(callee); return instance.callExport(cx, funcIndex, args); } /* * [SMDOC] Exported wasm functions and the jit-entry stubs * * ## The kinds of exported functions * * There are several kinds of exported wasm functions. /Explicitly/ exported * functions are: * * - any wasm function exported via the export section * - any asm.js export * - the module start function * * There are also /implicitly/ exported functions, these are the functions whose * indices in the module are referenced outside the code segment, eg, in element * segments and in global initializers. * * ## Wasm functions as JSFunctions * * Any exported function can be manipulated by JS and wasm code, and to both the * exported function is represented as a JSFunction. To JS, that means that the * function can be called in the same way as any other JSFunction. To Wasm, it * means that the function is a reference with the same representation as * externref. * * However, the JSFunction object is created only when the function value is * actually exposed to JS the first time. The creation is performed by * getExportedFunction(), below, as follows: * * - A function exported via the export section (or from asm.js) is created * when the export object is created, which happens at instantiation time. * * - A function implicitly exported via a table is created when the table * element is read (by JS or wasm) and a function value is needed to * represent that value. Functions stored in tables by initializers have a * special representation that does not require the function object to be * created, as long as the initializing element segment uses the more * efficient index encoding instead of the more general expression encoding. * * - A function implicitly exported via a global initializer is created when * the global is initialized. * * - A function referenced from a ref.func instruction in code is created when * that instruction is executed the first time. * * The JSFunction representing a wasm function never changes: every reference to * the wasm function that exposes the JSFunction gets the same JSFunction. In * particular, imported functions already have a JSFunction representation (from * JS or from their home module), and will be exposed using that representation. * * The mapping from a wasm function to its JSFunction is instance-specific, and * held in a hashmap in the instance. If a module is shared across multiple * instances, possibly in multiple threads, each instance will have its own * JSFunction representing the wasm function. * * ## Stubs -- interpreter, eager, lazy, provisional, and absent * * While a Wasm exported function is just a JSFunction, the internal wasm ABI is * neither the C++ ABI nor the JS JIT ABI, so there needs to be an extra step * when C++ or JS JIT code calls wasm code. For this, execution passes through * a stub that is adapted to both the JS caller and the wasm callee. * * ### Interpreter stubs and jit-entry stubs * * When JS interpreted code calls a wasm function, we end up in * Instance::callExport() to execute the call. This function must enter wasm, * and to do this it uses a stub that is specific to the wasm function (see * GenerateInterpEntry) that is callable with the C++ interpreter ABI and which * will convert arguments as necessary and enter compiled wasm code. * * The interpreter stub is created eagerly, when the module is compiled. * * However, the interpreter call path is slow, and when JS jitted code calls * wasm we want to do better. In this case, there is a different, optimized * stub that is to be invoked, and it uses the JIT ABI. This is the jit-entry * stub for the function. Jitted code will call a wasm function's jit-entry * stub to invoke the function with the JIT ABI. The stub will adapt the call * to the wasm ABI. * * Some jit-entry stubs are created eagerly and some are created lazily. * * ### Eager jit-entry stubs * * The explicitly exported functions have stubs created for them eagerly. Eager * stubs are created with their tier when the module is compiled, see * ModuleGenerator::finishCodeTier(), which calls wasm::GenerateStubs(), which * generates stubs for functions with eager stubs. * * An eager stub for tier-1 is upgraded to tier-2 if the module tiers up, see * below. * * ### Lazy jit-entry stubs * * Stubs are created lazily for all implicitly exported functions. These * functions may flow out to JS, but will only need a stub if they are ever * called from jitted code. (That's true for explicitly exported functions too, * but for them the presumption is that they will be called.) * * Lazy stubs are created only when they are needed, and they are /doubly/ lazy, * see getExportedFunction(), below: A function implicitly exported via a table * or global may be manipulated eagerly by host code without actually being * called (maybe ever), so we do not generate a lazy stub when the function * object escapes to JS, but instead delay stub generation until the function is * actually called. * * ### The provisional lazy jit-entry stub * * However, JS baseline compilation needs to have a stub to start with in order * to allow it to attach CacheIR data to the call (or it deoptimizes the call as * a C++ call). Thus when the JSFunction for the wasm export is retrieved by JS * code, a /provisional/ lazy jit-entry stub is associated with the function. * The stub will invoke the wasm function on the slow interpreter path via * callExport - if the function is ever called - and will cause a fast jit-entry * stub to be created at the time of the call. The provisional lazy stub is * shared globally, it contains no function-specific or context-specific data. * * Thus, the final lazy jit-entry stubs are eventually created by * Instance::callExport, when a call is routed through it on the slow path for * any of the reasons given above. * * ### Absent jit-entry stubs * * Some functions never get jit-entry stubs. The predicate canHaveJitEntry() * determines if a wasm function gets a stub, and it will deny this if the * function's signature exposes non-JS-compatible types (such as v128) or if * stub optimization has been disabled by a jit option. Calls to these * functions will continue to go via callExport and use the slow interpreter * stub. * * ## The jit-entry jump table * * The mapping from the exported function to its jit-entry stub is implemented * by the jit-entry jump table in the JumpTables object (see WasmCode.h). The * jit-entry jump table entry for a function holds a stub that the jit can call * to perform fast calls. * * While there is a single contiguous jump table, it has two logical sections: * one for eager stubs, and one for lazy stubs. These sections are initialized * and updated separately, using logic that is specific to each section. * * The value of the table element for an eager stub is a pointer to the stub * code in the current tier. The pointer is installed just after the creation * of the stub, before any code in the module is executed. If the module later * tiers up, the eager jit-entry stub for tier-1 code is replaced by one for * tier-2 code, see the next section. * * Initially the value of the jump table element for a lazy stub is null. * * If the function is retrieved by JS (by getExportedFunction()) and is not * barred from having a jit-entry, then the stub is upgraded to the shared * provisional lazy jit-entry stub. This upgrade happens to be racy if the * module is shared, and so the update is atomic and only happens if the entry * is already null. Since the provisional lazy stub is shared, this is fine; if * several threads try to upgrade at the same time, it is to the same shared * value. * * If the retrieved function is later invoked (via callExport()), the stub is * upgraded to an actual jit-entry stub for the current code tier, again if the * function is allowed to have a jit-entry. This is not racy -- though multiple * threads can be trying to create a jit-entry stub at the same time, they do so * under a lock and only the first to take the lock will be allowed to create a * stub, the others will reuse the first-installed stub. * * If the module later tiers up, the lazy jit-entry stub for tier-1 code (if it * exists) is replaced by one for tier-2 code, see the next section. * * (Note, the InterpEntry stub is never stored in the jit-entry table, as it * uses the C++ ABI, not the JIT ABI. It is accessible through the * FunctionEntry.) * * ### Interaction of the jit-entry jump table and tiering * * (For general info about tiering, see the comment in WasmCompile.cpp.) * * The jit-entry stub, whether eager or lazy, is specific to a code tier - a * stub will invoke the code for its function for the tier. When we tier up, * new jit-entry stubs must be created that reference tier-2 code, and must then * be patched into the jit-entry table. The complication here is that, since * the jump table is shared with its code between instances on multiple threads, * tier-1 code is running on other threads and new tier-1 specific jit-entry * stubs may be created concurrently with trying to create the tier-2 stubs on * the thread that performs the tiering-up. Indeed, there may also be * concurrent attempts to upgrade null jit-entries to the provisional lazy stub. * * Eager stubs: * * - Eager stubs for tier-2 code are patched in racily by Module::finishTier2() * along with code pointers for tiering; nothing conflicts with these writes. * * Lazy stubs: * * - An upgrade from a null entry to a lazy provisional stub is atomic and can * only happen if the entry is null, and it only happens in * getExportedFunction(). No lazy provisional stub will be installed if * there's another stub present. * * - The lazy tier-appropriate stub is installed by callExport() (really by * EnsureEntryStubs()) during the first invocation of the exported function * that reaches callExport(). That invocation must be from within JS, and so * the jit-entry element can't be null, because a prior getExportedFunction() * will have ensured that it is not: the lazy provisional stub will have been * installed. Hence the installing of the lazy tier-appropriate stub does * not race with the installing of the lazy provisional stub. * * - A lazy tier-1 stub is upgraded to a lazy tier-2 stub by * Module::finishTier2(). The upgrade needs to ensure that all tier-1 stubs * are upgraded, and that once the upgrade is finished, callExport() will * only create tier-2 lazy stubs. (This upgrading does not upgrade lazy * provisional stubs or absent stubs.) * * The locking protocol ensuring that all stubs are upgraded properly and * that the system switches to creating tier-2 stubs is implemented in * Module::finishTier2() and EnsureEntryStubs(): * * There are two locks, one per code tier. * * EnsureEntryStubs() is attempting to create a tier-appropriate lazy stub, * so it takes the lock for the current best tier, checks to see if there is * a stub, and exits if there is. If the tier changed racily it takes the * other lock too, since that is now the lock for the best tier. Then it * creates the stub, installs it, and releases the locks. Thus at most one * stub per tier can be created at a time. * * Module::finishTier2() takes both locks (tier-1 before tier-2), thus * preventing EnsureEntryStubs() from creating stubs while stub upgrading is * going on, and itself waiting until EnsureEntryStubs() is not active. Once * it has both locks, it upgrades all lazy stubs and makes tier-2 the new * best tier. Should EnsureEntryStubs subsequently enter, it will find that * a stub already exists at tier-2 and will exit early. * * (It would seem that the locking protocol could be simplified a little by * having only one lock, hanging off the Code object, or by unconditionally * taking both locks in EnsureEntryStubs(). However, in some cases where we * acquire a lock the Code object is not readily available, so plumbing would * have to be added, and in EnsureEntryStubs(), there are sometimes not two code * tiers.) * * ## Stub lifetimes and serialization * * Eager jit-entry stub code, along with stub code for import functions, is * serialized along with the tier-2 code for the module. * * Lazy stub code and thunks for builtin functions (including the provisional * lazy jit-entry stub) are never serialized. */ /* static */ bool WasmInstanceObject::getExportedFunction( JSContext* cx, Handle instanceObj, uint32_t funcIndex, MutableHandleFunction fun) { if (ExportMap::Ptr p = instanceObj->exports().lookup(funcIndex)) { fun.set(p->value()); return true; } const Instance& instance = instanceObj->instance(); const FuncExport& funcExport = instance.metadata(instance.code().bestTier()).lookupFuncExport(funcIndex); const TypeDef& funcTypeDef = instance.metadata().getFuncExportTypeDef(funcExport); unsigned numArgs = funcTypeDef.funcType().args().length(); if (instance.isAsmJS()) { // asm.js needs to act like a normal JS function which means having the // name from the original source and being callable as a constructor. Rooted name(cx, instance.getFuncDisplayAtom(cx, funcIndex)); if (!name) { return false; } fun.set(NewNativeConstructor(cx, WasmCall, numArgs, name, gc::AllocKind::FUNCTION_EXTENDED, TenuredObject, FunctionFlags::ASMJS_CTOR)); if (!fun) { return false; } // asm.js does not support jit entries. fun->setWasmFuncIndex(funcIndex); } else { Rooted name(cx, NumberToAtom(cx, funcIndex)); if (!name) { return false; } RootedObject proto(cx); #ifdef ENABLE_WASM_TYPE_REFLECTIONS proto = GlobalObject::getOrCreatePrototype(cx, JSProto_WasmFunction); if (!proto) { return false; } #endif fun.set(NewFunctionWithProto( cx, WasmCall, numArgs, FunctionFlags::WASM, nullptr, name, proto, gc::AllocKind::FUNCTION_EXTENDED, TenuredObject)); if (!fun) { return false; } // Some applications eagerly access all table elements which currently // triggers worst-case behavior for lazy stubs, since each will allocate a // separate 4kb code page. Most eagerly-accessed functions are not called, // so use a shared, provisional (and slow) lazy stub as JitEntry and wait // until Instance::callExport() to create the fast entry stubs. if (funcTypeDef.funcType().canHaveJitEntry()) { if (!funcExport.hasEagerStubs()) { if (!EnsureBuiltinThunksInitialized()) { return false; } void* provisionalLazyJitEntryStub = ProvisionalLazyJitEntryStub(); MOZ_ASSERT(provisionalLazyJitEntryStub); instance.code().setJitEntryIfNull(funcIndex, provisionalLazyJitEntryStub); } fun->setWasmJitEntry(instance.code().getAddressOfJitEntry(funcIndex)); } else { fun->setWasmFuncIndex(funcIndex); } } fun->setExtendedSlot(FunctionExtended::WASM_INSTANCE_SLOT, PrivateValue(const_cast(&instance))); fun->setExtendedSlot(FunctionExtended::WASM_STV_SLOT, PrivateValue((void*)funcTypeDef.superTypeVector())); const CodeTier& codeTier = instance.code().codeTier(instance.code().bestTier()); const CodeRange& codeRange = codeTier.metadata().codeRange(funcExport); fun->setExtendedSlot(FunctionExtended::WASM_FUNC_UNCHECKED_ENTRY_SLOT, PrivateValue(codeTier.segment().base() + codeRange.funcUncheckedCallEntry())); if (!instanceObj->exports().putNew(funcIndex, fun)) { ReportOutOfMemory(cx); return false; } return true; } const CodeRange& WasmInstanceObject::getExportedFunctionCodeRange( JSFunction* fun, Tier tier) { uint32_t funcIndex = ExportedFunctionToFuncIndex(fun); MOZ_ASSERT(exports().lookup(funcIndex)->value() == fun); const MetadataTier& metadata = instance().metadata(tier); return metadata.codeRange(metadata.lookupFuncExport(funcIndex)); } /* static */ WasmInstanceScope* WasmInstanceObject::getScope( JSContext* cx, Handle instanceObj) { if (!instanceObj->getReservedSlot(INSTANCE_SCOPE_SLOT).isUndefined()) { return (WasmInstanceScope*)instanceObj->getReservedSlot(INSTANCE_SCOPE_SLOT) .toGCThing(); } Rooted instanceScope( cx, WasmInstanceScope::create(cx, instanceObj)); if (!instanceScope) { return nullptr; } instanceObj->setReservedSlot(INSTANCE_SCOPE_SLOT, PrivateGCThingValue(instanceScope)); return instanceScope; } /* static */ WasmFunctionScope* WasmInstanceObject::getFunctionScope( JSContext* cx, Handle instanceObj, uint32_t funcIndex) { if (auto p = instanceObj->scopes().asWasmFunctionScopeMap().lookup(funcIndex)) { return p->value(); } Rooted instanceScope( cx, WasmInstanceObject::getScope(cx, instanceObj)); if (!instanceScope) { return nullptr; } Rooted funcScope( cx, WasmFunctionScope::create(cx, instanceScope, funcIndex)); if (!funcScope) { return nullptr; } if (!instanceObj->scopes().asWasmFunctionScopeMap().putNew(funcIndex, funcScope)) { ReportOutOfMemory(cx); return nullptr; } return funcScope; } bool wasm::IsWasmExportedFunction(JSFunction* fun) { return fun->kind() == FunctionFlags::Wasm; } Instance& wasm::ExportedFunctionToInstance(JSFunction* fun) { return fun->wasmInstance(); } WasmInstanceObject* wasm::ExportedFunctionToInstanceObject(JSFunction* fun) { return fun->wasmInstance().object(); } uint32_t wasm::ExportedFunctionToFuncIndex(JSFunction* fun) { return fun->wasmInstance().code().getFuncIndex(fun); } // ============================================================================ // WebAssembly.Memory class and methods const JSClassOps WasmMemoryObject::classOps_ = { nullptr, // addProperty nullptr, // delProperty nullptr, // enumerate nullptr, // newEnumerate nullptr, // resolve nullptr, // mayResolve WasmMemoryObject::finalize, // finalize nullptr, // call nullptr, // construct nullptr, // trace }; const JSClass WasmMemoryObject::class_ = { "WebAssembly.Memory", JSCLASS_DELAY_METADATA_BUILDER | JSCLASS_HAS_RESERVED_SLOTS(WasmMemoryObject::RESERVED_SLOTS) | JSCLASS_FOREGROUND_FINALIZE, &WasmMemoryObject::classOps_, &WasmMemoryObject::classSpec_}; const JSClass& WasmMemoryObject::protoClass_ = PlainObject::class_; static constexpr char WasmMemoryName[] = "Memory"; static JSObject* CreateWasmMemoryPrototype(JSContext* cx, JSProtoKey key) { RootedObject proto(cx, GlobalObject::createBlankPrototype( cx, cx->global(), &WasmMemoryObject::protoClass_)); if (!proto) { return nullptr; } if (MemoryControlAvailable(cx)) { if (!JS_DefineFunctions(cx, proto, WasmMemoryObject::memoryControlMethods)) { return nullptr; } } return proto; } const ClassSpec WasmMemoryObject::classSpec_ = { CreateWasmConstructor, CreateWasmMemoryPrototype, WasmMemoryObject::static_methods, nullptr, WasmMemoryObject::methods, WasmMemoryObject::properties, nullptr, ClassSpec::DontDefineConstructor}; /* static */ void WasmMemoryObject::finalize(JS::GCContext* gcx, JSObject* obj) { WasmMemoryObject& memory = obj->as(); if (memory.hasObservers()) { gcx->delete_(obj, &memory.observers(), MemoryUse::WasmMemoryObservers); } } /* static */ WasmMemoryObject* WasmMemoryObject::create( JSContext* cx, Handle buffer, bool isHuge, HandleObject proto) { AutoSetNewObjectMetadata metadata(cx); auto* obj = NewObjectWithGivenProto(cx, proto); if (!obj) { return nullptr; } obj->initReservedSlot(BUFFER_SLOT, ObjectValue(*buffer)); obj->initReservedSlot(ISHUGE_SLOT, BooleanValue(isHuge)); MOZ_ASSERT(!obj->hasObservers()); return obj; } /* static */ bool WasmMemoryObject::construct(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); if (!ThrowIfNotConstructing(cx, args, "Memory")) { return false; } if (!args.requireAtLeast(cx, "WebAssembly.Memory", 1)) { return false; } if (!args.get(0).isObject()) { JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_BAD_DESC_ARG, "memory"); return false; } RootedObject obj(cx, &args[0].toObject()); Limits limits; if (!GetLimits(cx, obj, LimitsKind::Memory, &limits) || !CheckLimits(cx, MaxMemoryLimitField(limits.indexType), LimitsKind::Memory, &limits)) { return false; } if (Pages(limits.initial) > MaxMemoryPages(limits.indexType)) { JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_MEM_IMP_LIMIT); return false; } MemoryDesc memory(limits); Rooted buffer(cx, CreateWasmBuffer(cx, memory)); if (!buffer) { return false; } RootedObject proto(cx, GetWasmConstructorPrototype(cx, args, JSProto_WasmMemory)); if (!proto) { ReportOutOfMemory(cx); return false; } Rooted memoryObj( cx, WasmMemoryObject::create( cx, buffer, IsHugeMemoryEnabled(limits.indexType), proto)); if (!memoryObj) { return false; } args.rval().setObject(*memoryObj); return true; } static bool IsMemory(HandleValue v) { return v.isObject() && v.toObject().is(); } /* static */ bool WasmMemoryObject::bufferGetterImpl(JSContext* cx, const CallArgs& args) { Rooted memoryObj( cx, &args.thisv().toObject().as()); Rooted buffer(cx, &memoryObj->buffer()); if (memoryObj->isShared()) { size_t memoryLength = memoryObj->volatileMemoryLength(); MOZ_ASSERT(memoryLength >= buffer->byteLength()); if (memoryLength > buffer->byteLength()) { Rooted newBuffer( cx, SharedArrayBufferObject::New( cx, memoryObj->sharedArrayRawBuffer(), memoryLength)); if (!newBuffer) { return false; } // OK to addReference after we try to allocate because the memoryObj // keeps the rawBuffer alive. if (!memoryObj->sharedArrayRawBuffer()->addReference()) { JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_SC_SAB_REFCNT_OFLO); return false; } buffer = newBuffer; memoryObj->setReservedSlot(BUFFER_SLOT, ObjectValue(*newBuffer)); } } args.rval().setObject(*buffer); return true; } /* static */ bool WasmMemoryObject::bufferGetter(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); return CallNonGenericMethod(cx, args); } const JSPropertySpec WasmMemoryObject::properties[] = { JS_PSG("buffer", WasmMemoryObject::bufferGetter, JSPROP_ENUMERATE), JS_STRING_SYM_PS(toStringTag, "WebAssembly.Memory", JSPROP_READONLY), JS_PS_END}; /* static */ bool WasmMemoryObject::growImpl(JSContext* cx, const CallArgs& args) { Rooted memory( cx, &args.thisv().toObject().as()); if (!args.requireAtLeast(cx, "WebAssembly.Memory.grow", 1)) { return false; } uint32_t delta; if (!EnforceRangeU32(cx, args.get(0), "Memory", "grow delta", &delta)) { return false; } uint32_t ret = grow(memory, delta, cx); if (ret == uint32_t(-1)) { JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_BAD_GROW, "memory"); return false; } args.rval().setInt32(int32_t(ret)); return true; } /* static */ bool WasmMemoryObject::grow(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); return CallNonGenericMethod(cx, args); } /* static */ bool WasmMemoryObject::discardImpl(JSContext* cx, const CallArgs& args) { Rooted memory( cx, &args.thisv().toObject().as()); if (!args.requireAtLeast(cx, "WebAssembly.Memory.discard", 2)) { return false; } uint64_t byteOffset; if (!EnforceRangeU64(cx, args.get(0), "Memory", "byte offset", &byteOffset)) { return false; } uint64_t byteLen; if (!EnforceRangeU64(cx, args.get(1), "Memory", "length", &byteLen)) { return false; } if (byteOffset % wasm::PageSize != 0 || byteLen % wasm::PageSize != 0) { JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_UNALIGNED_ACCESS); return false; } if (!wasm::MemoryBoundsCheck(byteOffset, byteLen, memory->volatileMemoryLength())) { JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_OUT_OF_BOUNDS); return false; } discard(memory, byteOffset, byteLen, cx); args.rval().setUndefined(); return true; } /* static */ bool WasmMemoryObject::discard(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); return CallNonGenericMethod(cx, args); } const JSFunctionSpec WasmMemoryObject::methods[] = { #ifdef ENABLE_WASM_TYPE_REFLECTIONS JS_FN("type", WasmMemoryObject::type, 0, JSPROP_ENUMERATE), #endif JS_FN("grow", WasmMemoryObject::grow, 1, JSPROP_ENUMERATE), JS_FS_END}; const JSFunctionSpec WasmMemoryObject::memoryControlMethods[] = { JS_FN("discard", WasmMemoryObject::discard, 2, JSPROP_ENUMERATE), JS_FS_END}; const JSFunctionSpec WasmMemoryObject::static_methods[] = {JS_FS_END}; ArrayBufferObjectMaybeShared& WasmMemoryObject::buffer() const { return getReservedSlot(BUFFER_SLOT) .toObject() .as(); } WasmSharedArrayRawBuffer* WasmMemoryObject::sharedArrayRawBuffer() const { MOZ_ASSERT(isShared()); return buffer().as().rawWasmBufferObject(); } #ifdef ENABLE_WASM_TYPE_REFLECTIONS bool WasmMemoryObject::typeImpl(JSContext* cx, const CallArgs& args) { Rooted memoryObj( cx, &args.thisv().toObject().as()); RootedObject typeObj( cx, MemoryTypeToObject(cx, memoryObj->isShared(), memoryObj->indexType(), memoryObj->volatilePages(), memoryObj->sourceMaxPages())); if (!typeObj) { return false; } args.rval().setObject(*typeObj); return true; } bool WasmMemoryObject::type(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); return CallNonGenericMethod(cx, args); } #endif size_t WasmMemoryObject::volatileMemoryLength() const { if (isShared()) { return sharedArrayRawBuffer()->volatileByteLength(); } return buffer().byteLength(); } wasm::Pages WasmMemoryObject::volatilePages() const { if (isShared()) { return sharedArrayRawBuffer()->volatileWasmPages(); } return buffer().wasmPages(); } wasm::Pages WasmMemoryObject::clampedMaxPages() const { if (isShared()) { return sharedArrayRawBuffer()->wasmClampedMaxPages(); } return buffer().wasmClampedMaxPages(); } Maybe WasmMemoryObject::sourceMaxPages() const { if (isShared()) { return Some(sharedArrayRawBuffer()->wasmSourceMaxPages()); } return buffer().wasmSourceMaxPages(); } wasm::IndexType WasmMemoryObject::indexType() const { if (isShared()) { return sharedArrayRawBuffer()->wasmIndexType(); } return buffer().wasmIndexType(); } bool WasmMemoryObject::isShared() const { return buffer().is(); } bool WasmMemoryObject::hasObservers() const { return !getReservedSlot(OBSERVERS_SLOT).isUndefined(); } WasmMemoryObject::InstanceSet& WasmMemoryObject::observers() const { MOZ_ASSERT(hasObservers()); return *reinterpret_cast( getReservedSlot(OBSERVERS_SLOT).toPrivate()); } WasmMemoryObject::InstanceSet* WasmMemoryObject::getOrCreateObservers( JSContext* cx) { if (!hasObservers()) { auto observers = MakeUnique(cx->zone(), cx->zone()); if (!observers) { ReportOutOfMemory(cx); return nullptr; } InitReservedSlot(this, OBSERVERS_SLOT, observers.release(), MemoryUse::WasmMemoryObservers); } return &observers(); } bool WasmMemoryObject::isHuge() const { return getReservedSlot(ISHUGE_SLOT).toBoolean(); } bool WasmMemoryObject::movingGrowable() const { return !isHuge() && !buffer().wasmSourceMaxPages(); } size_t WasmMemoryObject::boundsCheckLimit() const { if (!buffer().isWasm() || isHuge()) { return buffer().byteLength(); } size_t mappedSize = buffer().wasmMappedSize(); #if !defined(JS_64BIT) // See clamping performed in CreateSpecificWasmBuffer(). On 32-bit systems // we do not want to overflow a uint32_t. For the other 64-bit compilers, // all constraints are implied by the largest accepted value for a memory's // max field. MOZ_ASSERT(mappedSize < UINT32_MAX); #endif MOZ_ASSERT(mappedSize % wasm::PageSize == 0); MOZ_ASSERT(mappedSize >= wasm::GuardSize); MOZ_ASSERT(wasm::IsValidBoundsCheckImmediate(mappedSize - wasm::GuardSize)); size_t limit = mappedSize - wasm::GuardSize; MOZ_ASSERT(limit <= MaxMemoryBoundsCheckLimit(indexType())); return limit; } bool WasmMemoryObject::addMovingGrowObserver(JSContext* cx, WasmInstanceObject* instance) { MOZ_ASSERT(movingGrowable()); InstanceSet* observers = getOrCreateObservers(cx); if (!observers) { return false; } // A memory can be imported multiple times into an instance, but we only // register the instance as an observer once. if (!observers->put(instance)) { ReportOutOfMemory(cx); return false; } return true; } /* static */ uint64_t WasmMemoryObject::growShared(Handle memory, uint64_t delta) { WasmSharedArrayRawBuffer* rawBuf = memory->sharedArrayRawBuffer(); WasmSharedArrayRawBuffer::Lock lock(rawBuf); Pages oldNumPages = rawBuf->volatileWasmPages(); Pages newPages = oldNumPages; if (!newPages.checkedIncrement(Pages(delta))) { return uint64_t(int64_t(-1)); } if (!rawBuf->wasmGrowToPagesInPlace(lock, memory->indexType(), newPages)) { return uint64_t(int64_t(-1)); } // New buffer objects will be created lazily in all agents (including in // this agent) by bufferGetterImpl, above, so no more work to do here. return oldNumPages.value(); } /* static */ uint64_t WasmMemoryObject::grow(Handle memory, uint64_t delta, JSContext* cx) { if (memory->isShared()) { return growShared(memory, delta); } Rooted oldBuf(cx, &memory->buffer().as()); #if !defined(JS_64BIT) // TODO (large ArrayBuffer): See more information at the definition of // MaxMemoryBytes(). MOZ_ASSERT(MaxMemoryBytes(memory->indexType()) <= UINT32_MAX, "Avoid 32-bit overflows"); #endif Pages oldNumPages = oldBuf->wasmPages(); Pages newPages = oldNumPages; if (!newPages.checkedIncrement(Pages(delta))) { return uint64_t(int64_t(-1)); } ArrayBufferObject* newBuf; if (memory->movingGrowable()) { MOZ_ASSERT(!memory->isHuge()); newBuf = ArrayBufferObject::wasmMovingGrowToPages(memory->indexType(), newPages, oldBuf, cx); } else { newBuf = ArrayBufferObject::wasmGrowToPagesInPlace(memory->indexType(), newPages, oldBuf, cx); } if (!newBuf) { return uint64_t(int64_t(-1)); } memory->setReservedSlot(BUFFER_SLOT, ObjectValue(*newBuf)); // Only notify moving-grow-observers after the BUFFER_SLOT has been updated // since observers will call buffer(). if (memory->hasObservers()) { for (InstanceSet::Range r = memory->observers().all(); !r.empty(); r.popFront()) { r.front()->instance().onMovingGrowMemory(memory); } } return oldNumPages.value(); } /* static */ void WasmMemoryObject::discard(Handle memory, uint64_t byteOffset, uint64_t byteLen, JSContext* cx) { if (memory->isShared()) { Rooted buf( cx, &memory->buffer().as()); SharedArrayBufferObject::wasmDiscard(buf, byteOffset, byteLen); } else { Rooted buf(cx, &memory->buffer().as()); ArrayBufferObject::wasmDiscard(buf, byteOffset, byteLen); } } bool js::wasm::IsSharedWasmMemoryObject(JSObject* obj) { WasmMemoryObject* mobj = obj->maybeUnwrapIf(); return mobj && mobj->isShared(); } // ============================================================================ // WebAssembly.Table class and methods const JSClassOps WasmTableObject::classOps_ = { nullptr, // addProperty nullptr, // delProperty nullptr, // enumerate nullptr, // newEnumerate nullptr, // resolve nullptr, // mayResolve WasmTableObject::finalize, // finalize nullptr, // call nullptr, // construct WasmTableObject::trace, // trace }; const JSClass WasmTableObject::class_ = { "WebAssembly.Table", JSCLASS_DELAY_METADATA_BUILDER | JSCLASS_HAS_RESERVED_SLOTS(WasmTableObject::RESERVED_SLOTS) | JSCLASS_FOREGROUND_FINALIZE, &WasmTableObject::classOps_, &WasmTableObject::classSpec_}; const JSClass& WasmTableObject::protoClass_ = PlainObject::class_; static constexpr char WasmTableName[] = "Table"; const ClassSpec WasmTableObject::classSpec_ = { CreateWasmConstructor, GenericCreatePrototype, WasmTableObject::static_methods, nullptr, WasmTableObject::methods, WasmTableObject::properties, nullptr, ClassSpec::DontDefineConstructor}; bool WasmTableObject::isNewborn() const { MOZ_ASSERT(is()); return getReservedSlot(TABLE_SLOT).isUndefined(); } /* static */ void WasmTableObject::finalize(JS::GCContext* gcx, JSObject* obj) { WasmTableObject& tableObj = obj->as(); if (!tableObj.isNewborn()) { auto& table = tableObj.table(); gcx->release(obj, &table, table.gcMallocBytes(), MemoryUse::WasmTableTable); } } /* static */ void WasmTableObject::trace(JSTracer* trc, JSObject* obj) { WasmTableObject& tableObj = obj->as(); if (!tableObj.isNewborn()) { tableObj.table().tracePrivate(trc); } } // Return the JS value to use when a parameter to a function requiring a table // value is omitted. An implementation of [1]. // // [1] // https://webassembly.github.io/reference-types/js-api/index.html#defaultvalue static Value RefTypeDefautValue(wasm::RefType tableType) { return tableType.isExtern() ? UndefinedValue() : NullValue(); } static bool CheckRefTypeValue(JSContext* cx, wasm::RefType type, HandleValue value) { RootedFunction fun(cx); RootedAnyRef any(cx, AnyRef::null()); return CheckRefType(cx, type, value, &fun, &any); } /* static */ WasmTableObject* WasmTableObject::create(JSContext* cx, uint32_t initialLength, Maybe maximumLength, wasm::RefType tableType, HandleObject proto) { AutoSetNewObjectMetadata metadata(cx); Rooted obj( cx, NewObjectWithGivenProto(cx, proto)); if (!obj) { return nullptr; } MOZ_ASSERT(obj->isNewborn()); TableDesc td(tableType, initialLength, maximumLength, Nothing(), /*isAsmJS*/ false, /*isImported=*/true, /*isExported=*/true); SharedTable table = Table::create(cx, td, obj); if (!table) { return nullptr; } size_t size = table->gcMallocBytes(); InitReservedSlot(obj, TABLE_SLOT, table.forget().take(), size, MemoryUse::WasmTableTable); MOZ_ASSERT(!obj->isNewborn()); return obj; } /* static */ bool WasmTableObject::construct(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); if (!ThrowIfNotConstructing(cx, args, "Table")) { return false; } if (!args.requireAtLeast(cx, "WebAssembly.Table", 1)) { return false; } if (!args.get(0).isObject()) { JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_BAD_DESC_ARG, "table"); return false; } RootedObject obj(cx, &args[0].toObject()); JSAtom* elementAtom = Atomize(cx, "element", strlen("element")); if (!elementAtom) { return false; } RootedId elementId(cx, AtomToId(elementAtom)); RootedValue elementVal(cx); if (!GetProperty(cx, obj, obj, elementId, &elementVal)) { return false; } RefType tableType; if (!ToRefType(cx, elementVal, &tableType)) { return false; } Limits limits; if (!GetLimits(cx, obj, LimitsKind::Table, &limits) || !CheckLimits(cx, MaxTableLimitField, LimitsKind::Table, &limits)) { return false; } // Converting limits for a table only supports i32 MOZ_ASSERT(limits.indexType == IndexType::I32); if (limits.initial > MaxTableLength) { JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_TABLE_IMP_LIMIT); return false; } RootedObject proto(cx, GetWasmConstructorPrototype(cx, args, JSProto_WasmTable)); if (!proto) { ReportOutOfMemory(cx); return false; } // The rest of the runtime expects table limits to be within a 32-bit range. static_assert(MaxTableLimitField <= UINT32_MAX, "invariant"); uint32_t initialLength = uint32_t(limits.initial); Maybe maximumLength; if (limits.maximum) { maximumLength = Some(uint32_t(*limits.maximum)); } Rooted table( cx, WasmTableObject::create(cx, initialLength, maximumLength, tableType, proto)); if (!table) { return false; } // Initialize the table to a default value RootedValue initValue( cx, args.length() < 2 ? RefTypeDefautValue(tableType) : args[1]); if (!CheckRefTypeValue(cx, tableType, initValue)) { return false; } // Skip initializing the table if the fill value is null, as that is the // default value. if (!initValue.isNull() && !table->fillRange(cx, 0, initialLength, initValue)) { return false; } #ifdef DEBUG // Assert that null is the default value of a new table. if (initValue.isNull()) { table->table().assertRangeNull(0, initialLength); } if (!tableType.isNullable()) { table->table().assertRangeNotNull(0, initialLength); } #endif args.rval().setObject(*table); return true; } static bool IsTable(HandleValue v) { return v.isObject() && v.toObject().is(); } /* static */ bool WasmTableObject::lengthGetterImpl(JSContext* cx, const CallArgs& args) { args.rval().setNumber( args.thisv().toObject().as().table().length()); return true; } /* static */ bool WasmTableObject::lengthGetter(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); return CallNonGenericMethod(cx, args); } const JSPropertySpec WasmTableObject::properties[] = { JS_PSG("length", WasmTableObject::lengthGetter, JSPROP_ENUMERATE), JS_STRING_SYM_PS(toStringTag, "WebAssembly.Table", JSPROP_READONLY), JS_PS_END}; static bool ToTableIndex(JSContext* cx, HandleValue v, const Table& table, const char* noun, uint32_t* index) { if (!EnforceRangeU32(cx, v, "Table", noun, index)) { return false; } if (*index >= table.length()) { JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_WASM_BAD_RANGE, "Table", noun); return false; } return true; } #ifdef ENABLE_WASM_TYPE_REFLECTIONS /* static */ bool WasmTableObject::typeImpl(JSContext* cx, const CallArgs& args) { Table& table = args.thisv().toObject().as().table(); RootedObject typeObj(cx, TableTypeToObject(cx, table.elemType(), table.length(), table.maximum())); if (!typeObj) { return false; } args.rval().setObject(*typeObj); return true; } /* static */ bool WasmTableObject::type(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); return CallNonGenericMethod(cx, args); } #endif /* static */ bool WasmTableObject::getImpl(JSContext* cx, const CallArgs& args) { Rooted tableObj( cx, &args.thisv().toObject().as()); const Table& table = tableObj->table(); if (!args.requireAtLeast(cx, "WebAssembly.Table.get", 1)) { return false; } uint32_t index; if (!ToTableIndex(cx, args.get(0), table, "get index", &index)) { return false; } return table.getValue(cx, index, args.rval()); } /* static */ bool WasmTableObject::get(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); return CallNonGenericMethod(cx, args); } /* static */ bool WasmTableObject::setImpl(JSContext* cx, const CallArgs& args) { Rooted tableObj( cx, &args.thisv().toObject().as()); Table& table = tableObj->table(); if (!args.requireAtLeast(cx, "WebAssembly.Table.set", 1)) { return false; } uint32_t index; if (!ToTableIndex(cx, args.get(0), table, "set index", &index)) { return false; } RootedValue fillValue( cx, args.length() < 2 ? RefTypeDefautValue(table.elemType()) : args[1]); if (!tableObj->fillRange(cx, index, 1, fillValue)) { return false; } args.rval().setUndefined(); return true; } /* static */ bool WasmTableObject::set(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); return CallNonGenericMethod(cx, args); } /* static */ bool WasmTableObject::growImpl(JSContext* cx, const CallArgs& args) { Rooted tableObj( cx, &args.thisv().toObject().as()); Table& table = tableObj->table(); if (!args.requireAtLeast(cx, "WebAssembly.Table.grow", 1)) { return false; } uint32_t delta; if (!EnforceRangeU32(cx, args.get(0), "Table", "grow delta", &delta)) { return false; } RootedValue fillValue( cx, args.length() < 2 ? RefTypeDefautValue(table.elemType()) : args[1]); if (!CheckRefTypeValue(cx, table.elemType(), fillValue)) { return false; } uint32_t oldLength = table.grow(delta); if (oldLength == uint32_t(-1)) { JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_BAD_GROW, "table"); return false; } // Skip filling the grown range of the table if the fill value is null, as // that is the default value. if (!fillValue.isNull() && !tableObj->fillRange(cx, oldLength, delta, fillValue)) { return false; } #ifdef DEBUG // Assert that null is the default value of the grown range. if (fillValue.isNull()) { table.assertRangeNull(oldLength, delta); } if (!table.elemType().isNullable()) { table.assertRangeNotNull(oldLength, delta); } #endif args.rval().setInt32(int32_t(oldLength)); return true; } /* static */ bool WasmTableObject::grow(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); return CallNonGenericMethod(cx, args); } const JSFunctionSpec WasmTableObject::methods[] = { #ifdef ENABLE_WASM_TYPE_REFLECTIONS JS_FN("type", WasmTableObject::type, 0, JSPROP_ENUMERATE), #endif JS_FN("get", WasmTableObject::get, 1, JSPROP_ENUMERATE), JS_FN("set", WasmTableObject::set, 2, JSPROP_ENUMERATE), JS_FN("grow", WasmTableObject::grow, 1, JSPROP_ENUMERATE), JS_FS_END}; const JSFunctionSpec WasmTableObject::static_methods[] = {JS_FS_END}; Table& WasmTableObject::table() const { return *(Table*)getReservedSlot(TABLE_SLOT).toPrivate(); } bool WasmTableObject::fillRange(JSContext* cx, uint32_t index, uint32_t length, HandleValue value) const { Table& tab = table(); // All consumers are required to either bounds check or statically be in // bounds MOZ_ASSERT(uint64_t(index) + uint64_t(length) <= tab.length()); RootedFunction fun(cx); RootedAnyRef any(cx, AnyRef::null()); if (!CheckRefType(cx, tab.elemType(), value, &fun, &any)) { return false; } switch (tab.repr()) { case TableRepr::Func: MOZ_RELEASE_ASSERT(!tab.isAsmJS()); tab.fillFuncRef(index, length, FuncRef::fromJSFunction(fun), cx); break; case TableRepr::Ref: tab.fillAnyRef(index, length, any); break; } return true; } // ============================================================================ // WebAssembly.global class and methods const JSClassOps WasmGlobalObject::classOps_ = { nullptr, // addProperty nullptr, // delProperty nullptr, // enumerate nullptr, // newEnumerate nullptr, // resolve nullptr, // mayResolve WasmGlobalObject::finalize, // finalize nullptr, // call nullptr, // construct WasmGlobalObject::trace, // trace }; const JSClass WasmGlobalObject::class_ = { "WebAssembly.Global", JSCLASS_HAS_RESERVED_SLOTS(WasmGlobalObject::RESERVED_SLOTS) | JSCLASS_BACKGROUND_FINALIZE, &WasmGlobalObject::classOps_, &WasmGlobalObject::classSpec_}; const JSClass& WasmGlobalObject::protoClass_ = PlainObject::class_; static constexpr char WasmGlobalName[] = "Global"; const ClassSpec WasmGlobalObject::classSpec_ = { CreateWasmConstructor, GenericCreatePrototype, WasmGlobalObject::static_methods, nullptr, WasmGlobalObject::methods, WasmGlobalObject::properties, nullptr, ClassSpec::DontDefineConstructor}; /* static */ void WasmGlobalObject::trace(JSTracer* trc, JSObject* obj) { WasmGlobalObject* global = reinterpret_cast(obj); if (global->isNewborn()) { // This can happen while we're allocating the object, in which case // every single slot of the object is not defined yet. In particular, // there's nothing to trace yet. return; } global->val().get().trace(trc); } /* static */ void WasmGlobalObject::finalize(JS::GCContext* gcx, JSObject* obj) { WasmGlobalObject* global = reinterpret_cast(obj); if (!global->isNewborn()) { // Release the strong reference to the type definitions this global could // be referencing. global->type().Release(); gcx->delete_(obj, &global->mutableVal(), MemoryUse::WasmGlobalCell); } } /* static */ WasmGlobalObject* WasmGlobalObject::create(JSContext* cx, HandleVal value, bool isMutable, HandleObject proto) { Rooted obj( cx, NewObjectWithGivenProto(cx, proto)); if (!obj) { return nullptr; } MOZ_ASSERT(obj->isNewborn()); MOZ_ASSERT(obj->isTenured(), "assumed by global.set post barriers"); GCPtrVal* val = js_new(Val()); if (!val) { ReportOutOfMemory(cx); return nullptr; } obj->initReservedSlot(MUTABLE_SLOT, JS::BooleanValue(isMutable)); InitReservedSlot(obj, VAL_SLOT, val, MemoryUse::WasmGlobalCell); // It's simpler to initialize the cell after the object has been created, // to avoid needing to root the cell before the object creation. // We don't use `setVal` here because the assumes the cell has already // been initialized. obj->mutableVal() = value.get(); // Acquire a strong reference to a type definition this global could // be referencing. obj->type().AddRef(); MOZ_ASSERT(!obj->isNewborn()); return obj; } /* static */ bool WasmGlobalObject::construct(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); if (!ThrowIfNotConstructing(cx, args, "Global")) { return false; } if (!args.requireAtLeast(cx, "WebAssembly.Global", 1)) { return false; } if (!args.get(0).isObject()) { JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_BAD_DESC_ARG, "global"); return false; } RootedObject obj(cx, &args[0].toObject()); // Extract properties in lexicographic order per spec. RootedValue mutableVal(cx); if (!JS_GetProperty(cx, obj, "mutable", &mutableVal)) { return false; } RootedValue typeVal(cx); if (!JS_GetProperty(cx, obj, "value", &typeVal)) { return false; } ValType globalType; if (!ToValType(cx, typeVal, &globalType)) { return false; } if (!globalType.isExposable()) { JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_BAD_VAL_TYPE); return false; } bool isMutable = ToBoolean(mutableVal); // Extract the initial value, or provide a suitable default. RootedVal globalVal(cx, globalType); // Override with non-undefined value, if provided. RootedValue valueVal(cx); if (globalType.isRefType()) { valueVal.set(args.length() < 2 ? RefTypeDefautValue(globalType.refType()) : args[1]); if (!Val::fromJSValue(cx, globalType, valueVal, &globalVal)) { return false; } } else { valueVal.set(args.get(1)); if (!valueVal.isUndefined() && !Val::fromJSValue(cx, globalType, valueVal, &globalVal)) { return false; } } RootedObject proto(cx, GetWasmConstructorPrototype(cx, args, JSProto_WasmGlobal)); if (!proto) { ReportOutOfMemory(cx); return false; } WasmGlobalObject* global = WasmGlobalObject::create(cx, globalVal, isMutable, proto); if (!global) { return false; } args.rval().setObject(*global); return true; } static bool IsGlobal(HandleValue v) { return v.isObject() && v.toObject().is(); } /* static */ bool WasmGlobalObject::valueGetterImpl(JSContext* cx, const CallArgs& args) { const WasmGlobalObject& globalObj = args.thisv().toObject().as(); if (!globalObj.type().isExposable()) { JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_BAD_VAL_TYPE); return false; } return globalObj.val().get().toJSValue(cx, args.rval()); } /* static */ bool WasmGlobalObject::valueGetter(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); return CallNonGenericMethod(cx, args); } /* static */ bool WasmGlobalObject::valueSetterImpl(JSContext* cx, const CallArgs& args) { if (!args.requireAtLeast(cx, "WebAssembly.Global setter", 1)) { return false; } Rooted global( cx, &args.thisv().toObject().as()); if (!global->isMutable()) { JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_GLOBAL_IMMUTABLE); return false; } RootedVal val(cx); if (!Val::fromJSValue(cx, global->type(), args.get(0), &val)) { return false; } global->setVal(val); args.rval().setUndefined(); return true; } /* static */ bool WasmGlobalObject::valueSetter(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); return CallNonGenericMethod(cx, args); } const JSPropertySpec WasmGlobalObject::properties[] = { JS_PSGS("value", WasmGlobalObject::valueGetter, WasmGlobalObject::valueSetter, JSPROP_ENUMERATE), JS_STRING_SYM_PS(toStringTag, "WebAssembly.Global", JSPROP_READONLY), JS_PS_END}; const JSFunctionSpec WasmGlobalObject::methods[] = { #ifdef ENABLE_WASM_TYPE_REFLECTIONS JS_FN("type", WasmGlobalObject::type, 0, JSPROP_ENUMERATE), #endif JS_FN("valueOf", WasmGlobalObject::valueGetter, 0, JSPROP_ENUMERATE), JS_FS_END}; const JSFunctionSpec WasmGlobalObject::static_methods[] = {JS_FS_END}; bool WasmGlobalObject::isMutable() const { return getReservedSlot(MUTABLE_SLOT).toBoolean(); } ValType WasmGlobalObject::type() const { return val().get().type(); } GCPtrVal& WasmGlobalObject::mutableVal() { return *reinterpret_cast(getReservedSlot(VAL_SLOT).toPrivate()); } const GCPtrVal& WasmGlobalObject::val() const { return *reinterpret_cast(getReservedSlot(VAL_SLOT).toPrivate()); } void WasmGlobalObject::setVal(wasm::HandleVal value) { MOZ_ASSERT(type() == value.get().type()); mutableVal() = value; } void* WasmGlobalObject::addressOfCell() const { return (void*)&val().get().cell(); } #ifdef ENABLE_WASM_TYPE_REFLECTIONS /* static */ bool WasmGlobalObject::typeImpl(JSContext* cx, const CallArgs& args) { Rooted global( cx, &args.thisv().toObject().as()); RootedObject typeObj( cx, GlobalTypeToObject(cx, global->type(), global->isMutable())); if (!typeObj) { return false; } args.rval().setObject(*typeObj); return true; } /* static */ bool WasmGlobalObject::type(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); return CallNonGenericMethod(cx, args); } #endif // ============================================================================ // WebAssembly.Tag class and methods const JSClassOps WasmTagObject::classOps_ = { nullptr, // addProperty nullptr, // delProperty nullptr, // enumerate nullptr, // newEnumerate nullptr, // resolve nullptr, // mayResolve WasmTagObject::finalize, // finalize nullptr, // call nullptr, // construct nullptr, // trace }; const JSClass WasmTagObject::class_ = { "WebAssembly.Tag", JSCLASS_HAS_RESERVED_SLOTS(WasmTagObject::RESERVED_SLOTS) | JSCLASS_FOREGROUND_FINALIZE, &WasmTagObject::classOps_, &WasmTagObject::classSpec_}; const JSClass& WasmTagObject::protoClass_ = PlainObject::class_; static constexpr char WasmTagName[] = "Tag"; const ClassSpec WasmTagObject::classSpec_ = { CreateWasmConstructor, GenericCreatePrototype, WasmTagObject::static_methods, nullptr, WasmTagObject::methods, WasmTagObject::properties, nullptr, ClassSpec::DontDefineConstructor}; /* static */ void WasmTagObject::finalize(JS::GCContext* gcx, JSObject* obj) { WasmTagObject& tagObj = obj->as(); tagObj.tagType()->Release(); } static bool IsTag(HandleValue v) { return v.isObject() && v.toObject().is(); } bool WasmTagObject::construct(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); if (!ThrowIfNotConstructing(cx, args, "Tag")) { return false; } if (!args.requireAtLeast(cx, "WebAssembly.Tag", 1)) { return false; } if (!args.get(0).isObject()) { JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_BAD_DESC_ARG, "tag"); return false; } RootedObject obj(cx, &args[0].toObject()); RootedValue paramsVal(cx); if (!JS_GetProperty(cx, obj, "parameters", ¶msVal)) { return false; } ValTypeVector params; if (!ParseValTypes(cx, paramsVal, params)) { return false; } wasm::MutableTagType tagType = js_new(); if (!tagType || !tagType->initialize(std::move(params))) { return false; } RootedObject proto(cx, GetWasmConstructorPrototype(cx, args, JSProto_WasmTag)); if (!proto) { ReportOutOfMemory(cx); return false; } Rooted tagObj(cx, WasmTagObject::create(cx, tagType, proto)); if (!tagObj) { return false; } args.rval().setObject(*tagObj); return true; } /* static */ WasmTagObject* WasmTagObject::create(JSContext* cx, const wasm::SharedTagType& tagType, HandleObject proto) { Rooted obj(cx, NewObjectWithGivenProto(cx, proto)); if (!obj) { return nullptr; } tagType.get()->AddRef(); obj->initReservedSlot(TYPE_SLOT, PrivateValue((void*)tagType.get())); return obj; } const JSPropertySpec WasmTagObject::properties[] = { JS_STRING_SYM_PS(toStringTag, "WebAssembly.Tag", JSPROP_READONLY), JS_PS_END}; #ifdef ENABLE_WASM_TYPE_REFLECTIONS /* static */ bool WasmTagObject::typeImpl(JSContext* cx, const CallArgs& args) { Rooted tag(cx, &args.thisv().toObject().as()); RootedObject typeObj(cx, TagTypeToObject(cx, tag->valueTypes())); if (!typeObj) { return false; } args.rval().setObject(*typeObj); return true; } /* static */ bool WasmTagObject::type(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); return CallNonGenericMethod(cx, args); } #endif const JSFunctionSpec WasmTagObject::methods[] = { #ifdef ENABLE_WASM_TYPE_REFLECTIONS JS_FN("type", WasmTagObject::type, 0, JSPROP_ENUMERATE), #endif JS_FS_END}; const JSFunctionSpec WasmTagObject::static_methods[] = {JS_FS_END}; const TagType* WasmTagObject::tagType() const { return (const TagType*)getFixedSlot(TYPE_SLOT).toPrivate(); }; const wasm::ValTypeVector& WasmTagObject::valueTypes() const { return tagType()->argTypes(); }; wasm::ResultType WasmTagObject::resultType() const { return wasm::ResultType::Vector(valueTypes()); } // ============================================================================ // WebAssembly.Exception class and methods const JSClassOps WasmExceptionObject::classOps_ = { nullptr, // addProperty nullptr, // delProperty nullptr, // enumerate nullptr, // newEnumerate nullptr, // resolve nullptr, // mayResolve WasmExceptionObject::finalize, // finalize nullptr, // call nullptr, // construct WasmExceptionObject::trace, // trace }; const JSClass WasmExceptionObject::class_ = { "WebAssembly.Exception", JSCLASS_HAS_RESERVED_SLOTS(WasmExceptionObject::RESERVED_SLOTS) | JSCLASS_FOREGROUND_FINALIZE, &WasmExceptionObject::classOps_, &WasmExceptionObject::classSpec_}; const JSClass& WasmExceptionObject::protoClass_ = PlainObject::class_; static constexpr char WasmExceptionName[] = "Exception"; const ClassSpec WasmExceptionObject::classSpec_ = { CreateWasmConstructor, GenericCreatePrototype, WasmExceptionObject::static_methods, nullptr, WasmExceptionObject::methods, WasmExceptionObject::properties, nullptr, ClassSpec::DontDefineConstructor}; /* static */ void WasmExceptionObject::finalize(JS::GCContext* gcx, JSObject* obj) { WasmExceptionObject& exnObj = obj->as(); if (exnObj.isNewborn()) { return; } gcx->free_(obj, exnObj.typedMem(), exnObj.tagType()->tagSize(), MemoryUse::WasmExceptionData); exnObj.tagType()->Release(); } /* static */ void WasmExceptionObject::trace(JSTracer* trc, JSObject* obj) { WasmExceptionObject& exnObj = obj->as(); if (exnObj.isNewborn()) { return; } wasm::SharedTagType tag = exnObj.tagType(); const wasm::ValTypeVector& params = tag->argTypes(); const wasm::TagOffsetVector& offsets = tag->argOffsets(); uint8_t* typedMem = exnObj.typedMem(); for (size_t i = 0; i < params.length(); i++) { ValType paramType = params[i]; if (paramType.isRefRepr()) { GCPtr* paramPtr = reinterpret_cast*>(typedMem + offsets[i]); TraceNullableEdge(trc, paramPtr, "wasm exception param"); } } } static bool IsException(HandleValue v) { return v.isObject() && v.toObject().is(); } struct ExceptionOptions { bool traceStack; ExceptionOptions() : traceStack(false) {} [[nodiscard]] bool init(JSContext* cx, HandleValue val); }; bool ExceptionOptions::init(JSContext* cx, HandleValue val) { if (val.isNullOrUndefined()) { return true; } if (!val.isObject()) { JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_BAD_EXN_OPTIONS); return false; } RootedObject obj(cx, &val.toObject()); // Get `traceStack` and coerce to boolean RootedValue traceStackVal(cx); if (!JS_GetProperty(cx, obj, "traceStack", &traceStackVal)) { return false; } traceStack = ToBoolean(traceStackVal); return true; } bool WasmExceptionObject::construct(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); if (!ThrowIfNotConstructing(cx, args, "Exception")) { return false; } if (!args.requireAtLeast(cx, "WebAssembly.Exception", 2)) { return false; } if (!IsTag(args[0])) { JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_BAD_EXN_ARG); return false; } Rooted exnTag(cx, &args[0].toObject().as()); if (!args.get(1).isObject()) { JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_BAD_EXN_PAYLOAD); return false; } JS::ForOfIterator iterator(cx); if (!iterator.init(args.get(1), JS::ForOfIterator::ThrowOnNonIterable)) { return false; } // Get the optional 'options' parameter ExceptionOptions options; if (!options.init(cx, args.get(2))) { return false; } // Trace the stack if requested RootedObject stack(cx); if (options.traceStack && !CaptureStack(cx, &stack)) { return false; } RootedObject proto( cx, GetWasmConstructorPrototype(cx, args, JSProto_WasmException)); if (!proto) { ReportOutOfMemory(cx); return false; } Rooted exnObj( cx, WasmExceptionObject::create(cx, exnTag, stack, proto)); if (!exnObj) { return false; } wasm::SharedTagType tagType = exnObj->tagType(); const wasm::ValTypeVector& params = tagType->argTypes(); const wasm::TagOffsetVector& offsets = tagType->argOffsets(); RootedValue nextArg(cx); for (size_t i = 0; i < params.length(); i++) { bool done; if (!iterator.next(&nextArg, &done)) { return false; } if (done) { UniqueChars expected(JS_smprintf("%zu", params.length())); UniqueChars got(JS_smprintf("%zu", i)); if (!expected || !got) { ReportOutOfMemory(cx); return false; } JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_BAD_EXN_PAYLOAD_LEN, expected.get(), got.get()); return false; } if (!exnObj->initArg(cx, offsets[i], params[i], nextArg)) { return false; } } args.rval().setObject(*exnObj); return true; } /* static */ WasmExceptionObject* WasmExceptionObject::create(JSContext* cx, Handle tag, HandleObject stack, HandleObject proto) { Rooted obj( cx, NewObjectWithGivenProto(cx, proto)); if (!obj) { return nullptr; } const TagType* tagType = tag->tagType(); // Allocate the data buffer before initializing the object so that an OOM // does not result in a partially constructed object. uint8_t* data = (uint8_t*)js_calloc(tagType->tagSize()); if (!data) { ReportOutOfMemory(cx); return nullptr; } MOZ_ASSERT(obj->isNewborn()); obj->initFixedSlot(TAG_SLOT, ObjectValue(*tag)); tagType->AddRef(); obj->initFixedSlot(TYPE_SLOT, PrivateValue((void*)tagType)); InitReservedSlot(obj, DATA_SLOT, data, tagType->tagSize(), MemoryUse::WasmExceptionData); obj->initFixedSlot(STACK_SLOT, ObjectOrNullValue(stack)); MOZ_ASSERT(!obj->isNewborn()); return obj; } WasmExceptionObject* WasmExceptionObject::wrapJSValue(JSContext* cx, HandleValue value) { Rooted wasm(cx, WasmNamespaceObject::getOrCreate(cx)); if (!wasm) { return nullptr; } Rooted valueAnyRef(cx); if (!AnyRef::fromJSValue(cx, value, &valueAnyRef)) { return nullptr; } Rooted wrappedJSValueTag(cx, wasm->wrappedJSValueTag()); WasmExceptionObject* exn = WasmExceptionObject::create(cx, wrappedJSValueTag, nullptr, nullptr); if (!exn) { return nullptr; } MOZ_ASSERT(exn->isWrappedJSValue()); exn->initRefArg(WrappedJSValueTagType_ValueOffset, valueAnyRef); return exn; } bool WasmExceptionObject::isNewborn() const { MOZ_ASSERT(is()); return getReservedSlot(DATA_SLOT).isUndefined(); } bool WasmExceptionObject::isWrappedJSValue() const { return tagType() == sWrappedJSValueTagType; } Value WasmExceptionObject::wrappedJSValue() const { MOZ_ASSERT(isWrappedJSValue()); return loadRefArg(WrappedJSValueTagType_ValueOffset).toJSValue(); } const JSPropertySpec WasmExceptionObject::properties[] = { JS_PSG("stack", WasmExceptionObject::getStack, 0), JS_STRING_SYM_PS(toStringTag, "WebAssembly.Exception", JSPROP_READONLY), JS_PS_END}; /* static */ bool WasmExceptionObject::isImpl(JSContext* cx, const CallArgs& args) { Rooted exnObj( cx, &args.thisv().toObject().as()); if (!args.requireAtLeast(cx, "WebAssembly.Exception.is", 1)) { return false; } if (!IsTag(args[0])) { JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_BAD_EXN_ARG); return false; } Rooted exnTag(cx, &args.get(0).toObject().as()); args.rval().setBoolean(exnTag.get() == &exnObj->tag()); return true; } /* static */ bool WasmExceptionObject::isMethod(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); return CallNonGenericMethod(cx, args); } /* static */ bool WasmExceptionObject::getArgImpl(JSContext* cx, const CallArgs& args) { Rooted exnObj( cx, &args.thisv().toObject().as()); if (!args.requireAtLeast(cx, "WebAssembly.Exception.getArg", 2)) { return false; } if (!IsTag(args[0])) { JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_BAD_EXN_ARG); return false; } Rooted exnTag(cx, &args.get(0).toObject().as()); if (exnTag.get() != &exnObj->tag()) { JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_BAD_EXN_TAG); return false; } uint32_t index; if (!EnforceRangeU32(cx, args.get(1), "Exception", "getArg index", &index)) { return false; } const wasm::ValTypeVector& params = exnTag->valueTypes(); if (index >= params.length()) { JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_BAD_RANGE, "Exception", "getArg index"); return false; } uint32_t offset = exnTag->tagType()->argOffsets()[index]; RootedValue result(cx); if (!exnObj->loadArg(cx, offset, params[index], &result)) { return false; } args.rval().set(result); return true; } /* static */ bool WasmExceptionObject::getArg(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); return CallNonGenericMethod(cx, args); } /* static */ bool WasmExceptionObject::getStack_impl(JSContext* cx, const CallArgs& args) { Rooted exnObj( cx, &args.thisv().toObject().as()); RootedObject savedFrameObj(cx, exnObj->stack()); if (!savedFrameObj) { args.rval().setUndefined(); return true; } JSPrincipals* principals = exnObj->realm()->principals(); RootedString stackString(cx); if (!BuildStackString(cx, principals, savedFrameObj, &stackString)) { return false; } args.rval().setString(stackString); return true; } /* static */ bool WasmExceptionObject::getStack(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); return CallNonGenericMethod(cx, args); } JSObject* WasmExceptionObject::stack() const { return getReservedSlot(STACK_SLOT).toObjectOrNull(); } uint8_t* WasmExceptionObject::typedMem() const { return (uint8_t*)getReservedSlot(DATA_SLOT).toPrivate(); } bool WasmExceptionObject::loadArg(JSContext* cx, size_t offset, wasm::ValType type, MutableHandleValue vp) const { if (!type.isExposable()) { JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_BAD_VAL_TYPE); return false; } return ToJSValue(cx, typedMem() + offset, type, vp); } bool WasmExceptionObject::initArg(JSContext* cx, size_t offset, wasm::ValType type, HandleValue value) { if (!type.isExposable()) { JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_BAD_VAL_TYPE); return false; } // Avoid rooting hazard of `this` being live across `fromJSValue` // which may GC. uint8_t* dest = typedMem() + offset; RootedVal val(cx); if (!Val::fromJSValue(cx, type, value, &val)) { return false; } val.get().writeToHeapLocation(dest); return true; } void WasmExceptionObject::initRefArg(size_t offset, wasm::AnyRef ref) { uint8_t* dest = typedMem() + offset; *((GCPtr*)dest) = ref; } wasm::AnyRef WasmExceptionObject::loadRefArg(size_t offset) const { uint8_t* src = typedMem() + offset; return *((GCPtr*)src); } const JSFunctionSpec WasmExceptionObject::methods[] = { JS_FN("is", WasmExceptionObject::isMethod, 1, JSPROP_ENUMERATE), JS_FN("getArg", WasmExceptionObject::getArg, 2, JSPROP_ENUMERATE), JS_FS_END}; const JSFunctionSpec WasmExceptionObject::static_methods[] = {JS_FS_END}; const TagType* WasmExceptionObject::tagType() const { return (const TagType*)getReservedSlot(TYPE_SLOT).toPrivate(); } WasmTagObject& WasmExceptionObject::tag() const { return getReservedSlot(TAG_SLOT).toObject().as(); } // ============================================================================ // WebAssembly.Function and methods #ifdef ENABLE_WASM_TYPE_REFLECTIONS static JSObject* CreateWasmFunctionPrototype(JSContext* cx, JSProtoKey key) { // WasmFunction's prototype should inherit from JSFunction's prototype. RootedObject jsProto(cx, &cx->global()->getFunctionPrototype()); return GlobalObject::createBlankPrototypeInheriting(cx, &PlainObject::class_, jsProto); } [[nodiscard]] static bool IsWasmFunction(HandleValue v) { if (!v.isObject()) { return false; } if (!v.toObject().is()) { return false; } return v.toObject().as().isWasm(); } bool WasmFunctionTypeImpl(JSContext* cx, const CallArgs& args) { RootedFunction function(cx, &args.thisv().toObject().as()); Rooted instanceObj( cx, ExportedFunctionToInstanceObject(function)); uint32_t funcIndex = ExportedFunctionToFuncIndex(function); Instance& instance = instanceObj->instance(); const FuncExport& fe = instance.metadata(instance.code().bestTier()).lookupFuncExport(funcIndex); const FuncType& funcType = instance.metadata().getFuncExportType(fe); RootedObject typeObj(cx, FuncTypeToObject(cx, funcType)); if (!typeObj) { return false; } args.rval().setObject(*typeObj); return true; } bool WasmFunctionType(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); return CallNonGenericMethod(cx, args); } static JSFunction* WasmFunctionCreate(JSContext* cx, HandleObject func, wasm::ValTypeVector&& params, wasm::ValTypeVector&& results, HandleObject proto) { MOZ_ASSERT(IsCallableNonCCW(ObjectValue(*func))); MOZ_RELEASE_ASSERT(!func->is() || !IsWasmExportedFunction(&func->as())); // We want to import the function to a wasm module and then export it again so // that it behaves exactly like a normal wasm function and can be used like // one in wasm tables. We synthesize such a module below, instantiate it, and // then return the exported function as the result. FeatureOptions options; ScriptedCaller scriptedCaller; SharedCompileArgs compileArgs = CompileArgs::buildAndReport(cx, std::move(scriptedCaller), options); if (!compileArgs) { return nullptr; } ModuleEnvironment moduleEnv(compileArgs->features); CompilerEnvironment compilerEnv(CompileMode::Once, Tier::Optimized, DebugEnabled::False); compilerEnv.computeParameters(); if (!moduleEnv.init()) { return nullptr; } FuncType funcType = FuncType(std::move(params), std::move(results)); if (!moduleEnv.types->addType(std::move(funcType))) { return nullptr; } // Add an (import (func ...)) FuncDesc funcDesc = FuncDesc(&(*moduleEnv.types)[0].funcType(), 0); if (!moduleEnv.funcs.append(funcDesc)) { return nullptr; } moduleEnv.numFuncImports = 1; // Add an (export (func 0)) moduleEnv.declareFuncExported(0, /* eager */ true, /* canRefFunc */ true); // We will be looking up and using the function in the future by index so the // name doesn't matter. CacheableName fieldName; if (!moduleEnv.exports.emplaceBack(std::move(fieldName), 0, DefinitionKind::Function)) { return nullptr; } ModuleGenerator mg(*compileArgs, &moduleEnv, &compilerEnv, nullptr, nullptr, nullptr); if (!mg.init(nullptr)) { return nullptr; } // We're not compiling any function definitions. if (!mg.finishFuncDefs()) { return nullptr; } SharedBytes shareableBytes = js_new(); if (!shareableBytes) { return nullptr; } SharedModule module = mg.finishModule(*shareableBytes); if (!module) { return nullptr; } // Instantiate the module. Rooted imports(cx); if (!imports.get().funcs.append(func)) { return nullptr; } Rooted instance(cx); if (!module->instantiate(cx, imports.get(), nullptr, &instance)) { MOZ_ASSERT(cx->isThrowingOutOfMemory()); return nullptr; } // Get the exported function which wraps the JS function to return. RootedFunction wasmFunc(cx); if (!instance->getExportedFunction(cx, instance, 0, &wasmFunc)) { return nullptr; } return wasmFunc; } bool WasmFunctionConstruct(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); if (!ThrowIfNotConstructing(cx, args, "WebAssembly.Function")) { return false; } if (!args.requireAtLeast(cx, "WebAssembly.Function", 2)) { return false; } if (!args[0].isObject()) { JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_BAD_DESC_ARG, "function"); return false; } RootedObject typeObj(cx, &args[0].toObject()); // Extract properties in lexicographic order per spec. RootedValue parametersVal(cx); if (!JS_GetProperty(cx, typeObj, "parameters", ¶metersVal)) { return false; } ValTypeVector params; if (!ParseValTypes(cx, parametersVal, params)) { return false; } RootedValue resultsVal(cx); if (!JS_GetProperty(cx, typeObj, "results", &resultsVal)) { return false; } ValTypeVector results; if (!ParseValTypes(cx, resultsVal, results)) { return false; } // Get the target function if (!IsCallableNonCCW(args[1]) || IsWasmFunction(args[1])) { JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_BAD_FUNCTION_VALUE); return false; } RootedObject func(cx, &args[1].toObject()); RootedObject proto( cx, GetWasmConstructorPrototype(cx, args, JSProto_WasmFunction)); if (!proto) { ReportOutOfMemory(cx); return false; } RootedFunction wasmFunc(cx, WasmFunctionCreate(cx, func, std::move(params), std::move(results), proto)); if (!wasmFunc) { ReportOutOfMemory(cx); return false; } args.rval().setObject(*wasmFunc); return true; } static constexpr char WasmFunctionName[] = "Function"; static JSObject* CreateWasmFunctionConstructor(JSContext* cx, JSProtoKey key) { RootedObject proto(cx, &cx->global()->getFunctionConstructor()); Rooted className( cx, Atomize(cx, WasmFunctionName, strlen(WasmFunctionName))); if (!className) { return nullptr; } return NewFunctionWithProto(cx, WasmFunctionConstruct, 1, FunctionFlags::NATIVE_CTOR, nullptr, className, proto, gc::AllocKind::FUNCTION, TenuredObject); } const JSFunctionSpec WasmFunctionMethods[] = { JS_FN("type", WasmFunctionType, 0, 0), JS_FS_END}; const ClassSpec WasmFunctionClassSpec = {CreateWasmFunctionConstructor, CreateWasmFunctionPrototype, nullptr, nullptr, WasmFunctionMethods, nullptr, nullptr, ClassSpec::DontDefineConstructor}; const JSClass js::WasmFunctionClass = { "WebAssembly.Function", 0, JS_NULL_CLASS_OPS, &WasmFunctionClassSpec}; #endif // ============================================================================ // WebAssembly class and static methods static bool WebAssembly_toSource(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); args.rval().setString(cx->names().WebAssembly); return true; } static bool RejectWithPendingException(JSContext* cx, Handle promise) { if (!cx->isExceptionPending()) { return false; } RootedValue rejectionValue(cx); if (!GetAndClearException(cx, &rejectionValue)) { return false; } return PromiseObject::reject(cx, promise, rejectionValue); } static bool Reject(JSContext* cx, const CompileArgs& args, Handle promise, const UniqueChars& error) { if (!error) { ThrowCompileOutOfMemory(cx); return RejectWithPendingException(cx, promise); } RootedObject stack(cx, promise->allocationSite()); RootedString fileName(cx); if (const char* filename = args.scriptedCaller.filename.get()) { fileName = JS_NewStringCopyUTF8N(cx, JS::UTF8Chars(filename, strlen(filename))); } else { fileName = JS_GetEmptyString(cx); } if (!fileName) { return false; } uint32_t line = args.scriptedCaller.line; // Ideally we'd report a JSMSG_WASM_COMPILE_ERROR here, but there's no easy // way to create an ErrorObject for an arbitrary error code with multiple // replacements. UniqueChars str(JS_smprintf("wasm validation error: %s", error.get())); if (!str) { return false; } size_t len = strlen(str.get()); RootedString message(cx, NewStringCopyN(cx, str.get(), len)); if (!message) { return false; } // There's no error |cause| available here. auto cause = JS::NothingHandleValue; RootedObject errorObj( cx, ErrorObject::create(cx, JSEXN_WASMCOMPILEERROR, stack, fileName, 0, line, JS::ColumnNumberOneOrigin(), nullptr, message, cause)); if (!errorObj) { return false; } RootedValue rejectionValue(cx, ObjectValue(*errorObj)); return PromiseObject::reject(cx, promise, rejectionValue); } static void LogAsync(JSContext* cx, const char* funcName, const Module& module) { Log(cx, "async %s succeeded%s", funcName, module.loggingDeserialized() ? " (loaded from cache)" : ""); } enum class Ret { Pair, Instance }; class AsyncInstantiateTask : public OffThreadPromiseTask { SharedModule module_; PersistentRooted imports_; Ret ret_; public: AsyncInstantiateTask(JSContext* cx, const Module& module, Ret ret, Handle promise) : OffThreadPromiseTask(cx, promise), module_(&module), imports_(cx), ret_(ret) {} ImportValues& imports() { return imports_.get(); } bool resolve(JSContext* cx, Handle promise) override { RootedObject instanceProto( cx, &cx->global()->getPrototype(JSProto_WasmInstance)); Rooted instanceObj(cx); if (!module_->instantiate(cx, imports_.get(), instanceProto, &instanceObj)) { return RejectWithPendingException(cx, promise); } RootedValue resolutionValue(cx); if (ret_ == Ret::Instance) { resolutionValue = ObjectValue(*instanceObj); } else { RootedObject resultObj(cx, JS_NewPlainObject(cx)); if (!resultObj) { return RejectWithPendingException(cx, promise); } RootedObject moduleProto(cx, &cx->global()->getPrototype(JSProto_WasmModule)); RootedObject moduleObj( cx, WasmModuleObject::create(cx, *module_, moduleProto)); if (!moduleObj) { return RejectWithPendingException(cx, promise); } RootedValue val(cx, ObjectValue(*moduleObj)); if (!JS_DefineProperty(cx, resultObj, "module", val, JSPROP_ENUMERATE)) { return RejectWithPendingException(cx, promise); } val = ObjectValue(*instanceObj); if (!JS_DefineProperty(cx, resultObj, "instance", val, JSPROP_ENUMERATE)) { return RejectWithPendingException(cx, promise); } resolutionValue = ObjectValue(*resultObj); } if (!PromiseObject::resolve(cx, promise, resolutionValue)) { return RejectWithPendingException(cx, promise); } LogAsync(cx, "instantiate", *module_); return true; } }; static bool AsyncInstantiate(JSContext* cx, const Module& module, HandleObject importObj, Ret ret, Handle promise) { auto task = js::MakeUnique(cx, module, ret, promise); if (!task || !task->init(cx)) { return false; } if (!GetImports(cx, module, importObj, &task->imports())) { return RejectWithPendingException(cx, promise); } task.release()->dispatchResolveAndDestroy(); return true; } static bool ResolveCompile(JSContext* cx, const Module& module, Handle promise) { RootedObject proto(cx, &cx->global()->getPrototype(JSProto_WasmModule)); RootedObject moduleObj(cx, WasmModuleObject::create(cx, module, proto)); if (!moduleObj) { return RejectWithPendingException(cx, promise); } RootedValue resolutionValue(cx, ObjectValue(*moduleObj)); if (!PromiseObject::resolve(cx, promise, resolutionValue)) { return RejectWithPendingException(cx, promise); } LogAsync(cx, "compile", module); return true; } struct CompileBufferTask : PromiseHelperTask { MutableBytes bytecode; SharedCompileArgs compileArgs; UniqueChars error; UniqueCharsVector warnings; SharedModule module; bool instantiate; PersistentRootedObject importObj; CompileBufferTask(JSContext* cx, Handle promise, HandleObject importObj) : PromiseHelperTask(cx, promise), instantiate(true), importObj(cx, importObj) {} CompileBufferTask(JSContext* cx, Handle promise) : PromiseHelperTask(cx, promise), instantiate(false) {} bool init(JSContext* cx, FeatureOptions options, const char* introducer) { compileArgs = InitCompileArgs(cx, options, introducer); if (!compileArgs) { return false; } return PromiseHelperTask::init(cx); } void execute() override { module = CompileBuffer(*compileArgs, *bytecode, &error, &warnings, nullptr); } bool resolve(JSContext* cx, Handle promise) override { if (!ReportCompileWarnings(cx, warnings)) { return false; } if (!module) { return Reject(cx, *compileArgs, promise, error); } if (instantiate) { return AsyncInstantiate(cx, *module, importObj, Ret::Pair, promise); } return ResolveCompile(cx, *module, promise); } }; static bool RejectWithPendingException(JSContext* cx, Handle promise, CallArgs& callArgs) { if (!RejectWithPendingException(cx, promise)) { return false; } callArgs.rval().setObject(*promise); return true; } static bool EnsurePromiseSupport(JSContext* cx) { if (!cx->runtime()->offThreadPromiseState.ref().initialized()) { JS_ReportErrorASCII( cx, "WebAssembly Promise APIs not supported in this runtime."); return false; } return true; } static bool GetBufferSource(JSContext* cx, const CallArgs& callArgs, const char* name, MutableBytes* bytecode) { if (!callArgs.requireAtLeast(cx, name, 1)) { return false; } if (!callArgs[0].isObject()) { JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_BAD_BUF_ARG); return false; } return GetBufferSource(cx, &callArgs[0].toObject(), JSMSG_WASM_BAD_BUF_ARG, bytecode); } static bool WebAssembly_compile(JSContext* cx, unsigned argc, Value* vp) { if (!EnsurePromiseSupport(cx)) { return false; } Log(cx, "async compile() started"); Rooted promise(cx, PromiseObject::createSkippingExecutor(cx)); if (!promise) { return false; } CallArgs callArgs = CallArgsFromVp(argc, vp); if (!cx->isRuntimeCodeGenEnabled(JS::RuntimeCode::WASM, nullptr)) { JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_CSP_BLOCKED_WASM, "WebAssembly.compile"); return RejectWithPendingException(cx, promise, callArgs); } auto task = cx->make_unique(cx, promise); if (!task) { return false; } if (!GetBufferSource(cx, callArgs, "WebAssembly.compile", &task->bytecode)) { return RejectWithPendingException(cx, promise, callArgs); } FeatureOptions options; if (!options.init(cx, callArgs.get(1))) { return false; } if (!task->init(cx, options, "WebAssembly.compile")) { return false; } if (!StartOffThreadPromiseHelperTask(cx, std::move(task))) { return false; } callArgs.rval().setObject(*promise); return true; } static bool GetInstantiateArgs(JSContext* cx, const CallArgs& callArgs, MutableHandleObject firstArg, MutableHandleObject importObj, MutableHandleValue featureOptions) { if (!callArgs.requireAtLeast(cx, "WebAssembly.instantiate", 1)) { return false; } if (!callArgs[0].isObject()) { JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_BAD_BUF_MOD_ARG); return false; } firstArg.set(&callArgs[0].toObject()); if (!GetImportArg(cx, callArgs.get(1), importObj)) { return false; } featureOptions.set(callArgs.get(2)); return true; } static bool WebAssembly_instantiate(JSContext* cx, unsigned argc, Value* vp) { if (!EnsurePromiseSupport(cx)) { return false; } Log(cx, "async instantiate() started"); Rooted promise(cx, PromiseObject::createSkippingExecutor(cx)); if (!promise) { return false; } CallArgs callArgs = CallArgsFromVp(argc, vp); RootedObject firstArg(cx); RootedObject importObj(cx); RootedValue featureOptions(cx); if (!GetInstantiateArgs(cx, callArgs, &firstArg, &importObj, &featureOptions)) { return RejectWithPendingException(cx, promise, callArgs); } const Module* module; if (IsModuleObject(firstArg, &module)) { if (!AsyncInstantiate(cx, *module, importObj, Ret::Instance, promise)) { return false; } } else { if (!cx->isRuntimeCodeGenEnabled(JS::RuntimeCode::WASM, nullptr)) { JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_CSP_BLOCKED_WASM, "WebAssembly.instantiate"); return RejectWithPendingException(cx, promise, callArgs); } FeatureOptions options; if (!options.init(cx, featureOptions)) { return false; } auto task = cx->make_unique(cx, promise, importObj); if (!task || !task->init(cx, options, "WebAssembly.instantiate")) { return false; } if (!GetBufferSource(cx, firstArg, JSMSG_WASM_BAD_BUF_MOD_ARG, &task->bytecode)) { return RejectWithPendingException(cx, promise, callArgs); } if (!StartOffThreadPromiseHelperTask(cx, std::move(task))) { return false; } } callArgs.rval().setObject(*promise); return true; } static bool WebAssembly_validate(JSContext* cx, unsigned argc, Value* vp) { CallArgs callArgs = CallArgsFromVp(argc, vp); MutableBytes bytecode; if (!GetBufferSource(cx, callArgs, "WebAssembly.validate", &bytecode)) { return false; } FeatureOptions options; if (!options.init(cx, callArgs.get(1))) { return false; } UniqueChars error; bool validated = Validate(cx, *bytecode, options, &error); // If the reason for validation failure was OOM (signalled by null error // message), report out-of-memory so that validate's return is always // correct. if (!validated && !error) { ReportOutOfMemory(cx); return false; } if (error) { MOZ_ASSERT(!validated); Log(cx, "validate() failed with: %s", error.get()); } callArgs.rval().setBoolean(validated); return true; } static bool EnsureStreamSupport(JSContext* cx) { // This should match wasm::StreamingCompilationAvailable(). if (!EnsurePromiseSupport(cx)) { return false; } if (!CanUseExtraThreads()) { JS_ReportErrorASCII( cx, "WebAssembly.compileStreaming not supported with --no-threads"); return false; } if (!cx->runtime()->consumeStreamCallback) { JS_ReportErrorASCII(cx, "WebAssembly streaming not supported in this runtime"); return false; } return true; } // This value is chosen and asserted to be disjoint from any host error code. static const size_t StreamOOMCode = 0; static bool RejectWithStreamErrorNumber(JSContext* cx, size_t errorCode, Handle promise) { if (errorCode == StreamOOMCode) { ReportOutOfMemory(cx); return false; } cx->runtime()->reportStreamErrorCallback(cx, errorCode); return RejectWithPendingException(cx, promise); } class CompileStreamTask : public PromiseHelperTask, public JS::StreamConsumer { // The stream progresses monotonically through these states; the helper // thread wait()s for streamState_ to reach Closed. enum StreamState { Env, Code, Tail, Closed }; ExclusiveWaitableData streamState_; // Immutable: const bool instantiate_; const PersistentRootedObject importObj_; // Immutable after noteResponseURLs() which is called at most once before // first call on stream thread: const MutableCompileArgs compileArgs_; // Immutable after Env state: Bytes envBytes_; SectionRange codeSection_; // The code section vector is resized once during the Env state and filled // in chunk by chunk during the Code state, updating the end-pointer after // each chunk: Bytes codeBytes_; uint8_t* codeBytesEnd_; ExclusiveBytesPtr exclusiveCodeBytesEnd_; // Immutable after Tail state: Bytes tailBytes_; ExclusiveStreamEndData exclusiveStreamEnd_; // Written once before Closed state and read in Closed state on main thread: SharedModule module_; Maybe streamError_; UniqueChars compileError_; UniqueCharsVector warnings_; // Set on stream thread and read racily on helper thread to abort compilation: Atomic streamFailed_; // Called on some thread before consumeChunk(), streamEnd(), streamError()): void noteResponseURLs(const char* url, const char* sourceMapUrl) override { if (url) { compileArgs_->scriptedCaller.filename = DuplicateString(url); compileArgs_->scriptedCaller.filenameIsURL = true; } if (sourceMapUrl) { compileArgs_->sourceMapURL = DuplicateString(sourceMapUrl); } } // Called on a stream thread: // Until StartOffThreadPromiseHelperTask succeeds, we are responsible for // dispatching ourselves back to the JS thread. // // Warning: After this function returns, 'this' can be deleted at any time, so // the caller must immediately return from the stream callback. void setClosedAndDestroyBeforeHelperThreadStarted() { streamState_.lock().get() = Closed; dispatchResolveAndDestroy(); } // See setClosedAndDestroyBeforeHelperThreadStarted() comment. bool rejectAndDestroyBeforeHelperThreadStarted(size_t errorNumber) { MOZ_ASSERT(streamState_.lock() == Env); MOZ_ASSERT(!streamError_); streamError_ = Some(errorNumber); setClosedAndDestroyBeforeHelperThreadStarted(); return false; } // Once StartOffThreadPromiseHelperTask succeeds, the helper thread will // dispatchResolveAndDestroy() after execute() returns, but execute() // wait()s for state to be Closed. // // Warning: After this function returns, 'this' can be deleted at any time, so // the caller must immediately return from the stream callback. void setClosedAndDestroyAfterHelperThreadStarted() { auto streamState = streamState_.lock(); MOZ_ASSERT(streamState != Closed); streamState.get() = Closed; streamState.notify_one(/* stream closed */); } // See setClosedAndDestroyAfterHelperThreadStarted() comment. bool rejectAndDestroyAfterHelperThreadStarted(size_t errorNumber) { MOZ_ASSERT(!streamError_); streamError_ = Some(errorNumber); streamFailed_ = true; exclusiveCodeBytesEnd_.lock().notify_one(); exclusiveStreamEnd_.lock().notify_one(); setClosedAndDestroyAfterHelperThreadStarted(); return false; } bool consumeChunk(const uint8_t* begin, size_t length) override { switch (streamState_.lock().get()) { case Env: { if (!envBytes_.append(begin, length)) { return rejectAndDestroyBeforeHelperThreadStarted(StreamOOMCode); } if (!StartsCodeSection(envBytes_.begin(), envBytes_.end(), &codeSection_)) { return true; } uint32_t extraBytes = envBytes_.length() - codeSection_.start; if (extraBytes) { envBytes_.shrinkTo(codeSection_.start); } if (codeSection_.size > MaxCodeSectionBytes) { return rejectAndDestroyBeforeHelperThreadStarted(StreamOOMCode); } if (!codeBytes_.resize(codeSection_.size)) { return rejectAndDestroyBeforeHelperThreadStarted(StreamOOMCode); } codeBytesEnd_ = codeBytes_.begin(); exclusiveCodeBytesEnd_.lock().get() = codeBytesEnd_; if (!StartOffThreadPromiseHelperTask(this)) { return rejectAndDestroyBeforeHelperThreadStarted(StreamOOMCode); } // Set the state to Code iff StartOffThreadPromiseHelperTask() // succeeds so that the state tells us whether we are before or // after the helper thread started. streamState_.lock().get() = Code; if (extraBytes) { return consumeChunk(begin + length - extraBytes, extraBytes); } return true; } case Code: { size_t copyLength = std::min(length, codeBytes_.end() - codeBytesEnd_); memcpy(codeBytesEnd_, begin, copyLength); codeBytesEnd_ += copyLength; { auto codeStreamEnd = exclusiveCodeBytesEnd_.lock(); codeStreamEnd.get() = codeBytesEnd_; codeStreamEnd.notify_one(); } if (codeBytesEnd_ != codeBytes_.end()) { return true; } streamState_.lock().get() = Tail; if (uint32_t extraBytes = length - copyLength) { return consumeChunk(begin + copyLength, extraBytes); } return true; } case Tail: { if (!tailBytes_.append(begin, length)) { return rejectAndDestroyAfterHelperThreadStarted(StreamOOMCode); } return true; } case Closed: MOZ_CRASH("consumeChunk() in Closed state"); } MOZ_CRASH("unreachable"); } void streamEnd(JS::OptimizedEncodingListener* tier2Listener) override { switch (streamState_.lock().get()) { case Env: { SharedBytes bytecode = js_new(std::move(envBytes_)); if (!bytecode) { rejectAndDestroyBeforeHelperThreadStarted(StreamOOMCode); return; } module_ = CompileBuffer(*compileArgs_, *bytecode, &compileError_, &warnings_, nullptr); setClosedAndDestroyBeforeHelperThreadStarted(); return; } case Code: case Tail: // Unlock exclusiveStreamEnd_ before locking streamState_. { auto streamEnd = exclusiveStreamEnd_.lock(); MOZ_ASSERT(!streamEnd->reached); streamEnd->reached = true; streamEnd->tailBytes = &tailBytes_; streamEnd->tier2Listener = tier2Listener; streamEnd.notify_one(); } setClosedAndDestroyAfterHelperThreadStarted(); return; case Closed: MOZ_CRASH("streamEnd() in Closed state"); } } void streamError(size_t errorCode) override { MOZ_ASSERT(errorCode != StreamOOMCode); switch (streamState_.lock().get()) { case Env: rejectAndDestroyBeforeHelperThreadStarted(errorCode); return; case Tail: case Code: rejectAndDestroyAfterHelperThreadStarted(errorCode); return; case Closed: MOZ_CRASH("streamError() in Closed state"); } } void consumeOptimizedEncoding(const uint8_t* begin, size_t length) override { module_ = Module::deserialize(begin, length); MOZ_ASSERT(streamState_.lock().get() == Env); setClosedAndDestroyBeforeHelperThreadStarted(); } // Called on a helper thread: void execute() override { module_ = CompileStreaming(*compileArgs_, envBytes_, codeBytes_, exclusiveCodeBytesEnd_, exclusiveStreamEnd_, streamFailed_, &compileError_, &warnings_); // When execute() returns, the CompileStreamTask will be dispatched // back to its JS thread to call resolve() and then be destroyed. We // can't let this happen until the stream has been closed lest // consumeChunk() or streamEnd() be called on a dead object. auto streamState = streamState_.lock(); while (streamState != Closed) { streamState.wait(/* stream closed */); } } // Called on a JS thread after streaming compilation completes/errors: bool resolve(JSContext* cx, Handle promise) override { MOZ_ASSERT(streamState_.lock() == Closed); if (!ReportCompileWarnings(cx, warnings_)) { return false; } if (module_) { MOZ_ASSERT(!streamFailed_ && !streamError_ && !compileError_); if (instantiate_) { return AsyncInstantiate(cx, *module_, importObj_, Ret::Pair, promise); } return ResolveCompile(cx, *module_, promise); } if (streamError_) { return RejectWithStreamErrorNumber(cx, *streamError_, promise); } return Reject(cx, *compileArgs_, promise, compileError_); } public: CompileStreamTask(JSContext* cx, Handle promise, CompileArgs& compileArgs, bool instantiate, HandleObject importObj) : PromiseHelperTask(cx, promise), streamState_(mutexid::WasmStreamStatus, Env), instantiate_(instantiate), importObj_(cx, importObj), compileArgs_(&compileArgs), codeSection_{}, codeBytesEnd_(nullptr), exclusiveCodeBytesEnd_(mutexid::WasmCodeBytesEnd, nullptr), exclusiveStreamEnd_(mutexid::WasmStreamEnd), streamFailed_(false) { MOZ_ASSERT_IF(importObj_, instantiate_); } }; // A short-lived object that captures the arguments of a // WebAssembly.{compileStreaming,instantiateStreaming} while waiting for // the Promise to resolve to a (hopefully) Promise. class ResolveResponseClosure : public NativeObject { static const unsigned COMPILE_ARGS_SLOT = 0; static const unsigned PROMISE_OBJ_SLOT = 1; static const unsigned INSTANTIATE_SLOT = 2; static const unsigned IMPORT_OBJ_SLOT = 3; static const JSClassOps classOps_; static void finalize(JS::GCContext* gcx, JSObject* obj) { auto& closure = obj->as(); gcx->release(obj, &closure.compileArgs(), MemoryUse::WasmResolveResponseClosure); } public: static const unsigned RESERVED_SLOTS = 4; static const JSClass class_; static ResolveResponseClosure* create(JSContext* cx, const CompileArgs& args, HandleObject promise, bool instantiate, HandleObject importObj) { MOZ_ASSERT_IF(importObj, instantiate); AutoSetNewObjectMetadata metadata(cx); auto* obj = NewObjectWithGivenProto(cx, nullptr); if (!obj) { return nullptr; } args.AddRef(); InitReservedSlot(obj, COMPILE_ARGS_SLOT, const_cast(&args), MemoryUse::WasmResolveResponseClosure); obj->setReservedSlot(PROMISE_OBJ_SLOT, ObjectValue(*promise)); obj->setReservedSlot(INSTANTIATE_SLOT, BooleanValue(instantiate)); obj->setReservedSlot(IMPORT_OBJ_SLOT, ObjectOrNullValue(importObj)); return obj; } CompileArgs& compileArgs() const { return *(CompileArgs*)getReservedSlot(COMPILE_ARGS_SLOT).toPrivate(); } PromiseObject& promise() const { return getReservedSlot(PROMISE_OBJ_SLOT).toObject().as(); } bool instantiate() const { return getReservedSlot(INSTANTIATE_SLOT).toBoolean(); } JSObject* importObj() const { return getReservedSlot(IMPORT_OBJ_SLOT).toObjectOrNull(); } }; const JSClassOps ResolveResponseClosure::classOps_ = { nullptr, // addProperty nullptr, // delProperty nullptr, // enumerate nullptr, // newEnumerate nullptr, // resolve nullptr, // mayResolve ResolveResponseClosure::finalize, // finalize nullptr, // call nullptr, // construct nullptr, // trace }; const JSClass ResolveResponseClosure::class_ = { "WebAssembly ResolveResponseClosure", JSCLASS_DELAY_METADATA_BUILDER | JSCLASS_HAS_RESERVED_SLOTS(ResolveResponseClosure::RESERVED_SLOTS) | JSCLASS_FOREGROUND_FINALIZE, &ResolveResponseClosure::classOps_, }; static ResolveResponseClosure* ToResolveResponseClosure(const CallArgs& args) { return &args.callee() .as() .getExtendedSlot(0) .toObject() .as(); } static bool RejectWithErrorNumber(JSContext* cx, uint32_t errorNumber, Handle promise) { JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, errorNumber); return RejectWithPendingException(cx, promise); } static bool ResolveResponse_OnFulfilled(JSContext* cx, unsigned argc, Value* vp) { CallArgs callArgs = CallArgsFromVp(argc, vp); Rooted closure(cx, ToResolveResponseClosure(callArgs)); Rooted promise(cx, &closure->promise()); CompileArgs& compileArgs = closure->compileArgs(); bool instantiate = closure->instantiate(); Rooted importObj(cx, closure->importObj()); auto task = cx->make_unique(cx, promise, compileArgs, instantiate, importObj); if (!task || !task->init(cx)) { return false; } if (!callArgs.get(0).isObject()) { return RejectWithErrorNumber(cx, JSMSG_WASM_BAD_RESPONSE_VALUE, promise); } RootedObject response(cx, &callArgs.get(0).toObject()); if (!cx->runtime()->consumeStreamCallback(cx, response, JS::MimeType::Wasm, task.get())) { return RejectWithPendingException(cx, promise); } (void)task.release(); callArgs.rval().setUndefined(); return true; } static bool ResolveResponse_OnRejected(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); Rooted closure(cx, ToResolveResponseClosure(args)); Rooted promise(cx, &closure->promise()); if (!PromiseObject::reject(cx, promise, args.get(0))) { return false; } args.rval().setUndefined(); return true; } static bool ResolveResponse(JSContext* cx, Handle responsePromise, Handle featureOptions, Handle resultPromise, bool instantiate = false, HandleObject importObj = nullptr) { MOZ_ASSERT_IF(importObj, instantiate); const char* introducer = instantiate ? "WebAssembly.instantiateStreaming" : "WebAssembly.compileStreaming"; FeatureOptions options; if (!options.init(cx, featureOptions)) { return false; } SharedCompileArgs compileArgs = InitCompileArgs(cx, options, introducer); if (!compileArgs) { return false; } RootedObject closure( cx, ResolveResponseClosure::create(cx, *compileArgs, resultPromise, instantiate, importObj)); if (!closure) { return false; } RootedFunction onResolved( cx, NewNativeFunction(cx, ResolveResponse_OnFulfilled, 1, nullptr, gc::AllocKind::FUNCTION_EXTENDED, GenericObject)); if (!onResolved) { return false; } RootedFunction onRejected( cx, NewNativeFunction(cx, ResolveResponse_OnRejected, 1, nullptr, gc::AllocKind::FUNCTION_EXTENDED, GenericObject)); if (!onRejected) { return false; } onResolved->setExtendedSlot(0, ObjectValue(*closure)); onRejected->setExtendedSlot(0, ObjectValue(*closure)); RootedObject resolve(cx, PromiseObject::unforgeableResolve(cx, responsePromise)); if (!resolve) { return false; } return JS::AddPromiseReactions(cx, resolve, onResolved, onRejected); } static bool WebAssembly_compileStreaming(JSContext* cx, unsigned argc, Value* vp) { if (!EnsureStreamSupport(cx)) { return false; } Log(cx, "async compileStreaming() started"); Rooted resultPromise( cx, PromiseObject::createSkippingExecutor(cx)); if (!resultPromise) { return false; } CallArgs callArgs = CallArgsFromVp(argc, vp); if (!cx->isRuntimeCodeGenEnabled(JS::RuntimeCode::WASM, nullptr)) { JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_CSP_BLOCKED_WASM, "WebAssembly.compileStreaming"); return RejectWithPendingException(cx, resultPromise, callArgs); } Rooted responsePromise(cx, callArgs.get(0)); Rooted featureOptions(cx, callArgs.get(1)); if (!ResolveResponse(cx, responsePromise, featureOptions, resultPromise)) { return RejectWithPendingException(cx, resultPromise, callArgs); } callArgs.rval().setObject(*resultPromise); return true; } static bool WebAssembly_instantiateStreaming(JSContext* cx, unsigned argc, Value* vp) { if (!EnsureStreamSupport(cx)) { return false; } Log(cx, "async instantiateStreaming() started"); Rooted resultPromise( cx, PromiseObject::createSkippingExecutor(cx)); if (!resultPromise) { return false; } CallArgs callArgs = CallArgsFromVp(argc, vp); if (!cx->isRuntimeCodeGenEnabled(JS::RuntimeCode::WASM, nullptr)) { JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_CSP_BLOCKED_WASM, "WebAssembly.instantiateStreaming"); return RejectWithPendingException(cx, resultPromise, callArgs); } Rooted firstArg(cx); Rooted importObj(cx); Rooted featureOptions(cx); if (!GetInstantiateArgs(cx, callArgs, &firstArg, &importObj, &featureOptions)) { return RejectWithPendingException(cx, resultPromise, callArgs); } Rooted responsePromise(cx, ObjectValue(*firstArg.get())); if (!ResolveResponse(cx, responsePromise, featureOptions, resultPromise, true, importObj)) { return RejectWithPendingException(cx, resultPromise, callArgs); } callArgs.rval().setObject(*resultPromise); return true; } #ifdef ENABLE_WASM_MOZ_INTGEMM static bool WebAssembly_mozIntGemm(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); Rooted module(cx); if (!wasm::CompileBuiltinModule(cx, wasm::BuiltinModuleId::IntGemm, &module)) { ReportOutOfMemory(cx); return false; } args.rval().set(ObjectValue(*module.get())); return true; } static const JSFunctionSpec WebAssembly_mozIntGemm_methods[] = { JS_FN("mozIntGemm", WebAssembly_mozIntGemm, 0, JSPROP_ENUMERATE), JS_FS_END}; #endif // ENABLE_WASM_MOZ_INTGEMM static const JSFunctionSpec WebAssembly_static_methods[] = { JS_FN("toSource", WebAssembly_toSource, 0, 0), JS_FN("compile", WebAssembly_compile, 1, JSPROP_ENUMERATE), JS_FN("instantiate", WebAssembly_instantiate, 1, JSPROP_ENUMERATE), JS_FN("validate", WebAssembly_validate, 1, JSPROP_ENUMERATE), JS_FN("compileStreaming", WebAssembly_compileStreaming, 1, JSPROP_ENUMERATE), JS_FN("instantiateStreaming", WebAssembly_instantiateStreaming, 1, JSPROP_ENUMERATE), JS_FS_END}; static const JSPropertySpec WebAssembly_static_properties[] = { JS_STRING_SYM_PS(toStringTag, "WebAssembly", JSPROP_READONLY), JS_PS_END}; static JSObject* CreateWebAssemblyObject(JSContext* cx, JSProtoKey key) { MOZ_RELEASE_ASSERT(HasSupport(cx)); RootedObject proto(cx, &cx->global()->getObjectPrototype()); return NewTenuredObjectWithGivenProto(cx, &WasmNamespaceObject::class_, proto); } struct NameAndProtoKey { const char* const name; JSProtoKey key; }; static bool WebAssemblyDefineConstructor(JSContext* cx, Handle wasm, NameAndProtoKey entry, MutableHandleValue ctorValue, MutableHandleId id) { JSObject* ctor = GlobalObject::getOrCreateConstructor(cx, entry.key); if (!ctor) { return false; } ctorValue.setObject(*ctor); JSAtom* className = Atomize(cx, entry.name, strlen(entry.name)); if (!className) { return false; } id.set(AtomToId(className)); return DefineDataProperty(cx, wasm, id, ctorValue, 0); } static bool WebAssemblyClassFinish(JSContext* cx, HandleObject object, HandleObject proto) { Handle wasm = object.as(); constexpr NameAndProtoKey entries[] = { {"Module", JSProto_WasmModule}, {"Instance", JSProto_WasmInstance}, {"Memory", JSProto_WasmMemory}, {"Table", JSProto_WasmTable}, {"Global", JSProto_WasmGlobal}, {"CompileError", GetExceptionProtoKey(JSEXN_WASMCOMPILEERROR)}, {"LinkError", GetExceptionProtoKey(JSEXN_WASMLINKERROR)}, {"RuntimeError", GetExceptionProtoKey(JSEXN_WASMRUNTIMEERROR)}, #ifdef ENABLE_WASM_TYPE_REFLECTIONS {"Function", JSProto_WasmFunction}, #endif }; RootedValue ctorValue(cx); RootedId id(cx); for (const auto& entry : entries) { if (!WebAssemblyDefineConstructor(cx, wasm, entry, &ctorValue, &id)) { return false; } } constexpr NameAndProtoKey exceptionEntries[] = { {"Tag", JSProto_WasmTag}, {"Exception", JSProto_WasmException}, }; for (const auto& entry : exceptionEntries) { if (!WebAssemblyDefineConstructor(cx, wasm, entry, &ctorValue, &id)) { return false; } } RootedObject tagProto( cx, GlobalObject::getOrCreatePrototype(cx, JSProto_WasmTag)); if (!tagProto) { ReportOutOfMemory(cx); return false; } SharedTagType wrappedJSValueTagType(sWrappedJSValueTagType); WasmTagObject* wrappedJSValueTagObject = WasmTagObject::create(cx, wrappedJSValueTagType, tagProto); if (!wrappedJSValueTagObject) { return false; } wasm->setWrappedJSValueTag(wrappedJSValueTagObject); #ifdef ENABLE_WASM_MOZ_INTGEMM if (MozIntGemmAvailable(cx) && !JS_DefineFunctions(cx, wasm, WebAssembly_mozIntGemm_methods)) { return false; } #endif return true; } WasmNamespaceObject* WasmNamespaceObject::getOrCreate(JSContext* cx) { JSObject* wasm = GlobalObject::getOrCreateConstructor(cx, JSProto_WebAssembly); if (!wasm) { return nullptr; } return &wasm->as(); } static const ClassSpec WebAssemblyClassSpec = { CreateWebAssemblyObject, nullptr, WebAssembly_static_methods, WebAssembly_static_properties, nullptr, nullptr, WebAssemblyClassFinish}; const JSClass js::WasmNamespaceObject::class_ = { "WebAssembly", JSCLASS_HAS_CACHED_PROTO(JSProto_WebAssembly) | JSCLASS_HAS_RESERVED_SLOTS(WasmNamespaceObject::RESERVED_SLOTS), JS_NULL_CLASS_OPS, &WebAssemblyClassSpec}; // Sundry