| blob | efde7c1791a2032bdf61747a2499342148953364 |
1 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
2 * vim: set ts=8 sw=4 et tw=99:
3 *
4 * ***** BEGIN LICENSE BLOCK *****
5 * Version: MPL 1.1/GPL 2.0/LGPL 2.1
6 *
7 * The contents of this file are subject to the Mozilla Public License Version
8 * 1.1 (the "License"); you may not use this file except in compliance with
9 * the License. You may obtain a copy of the License at
10 * http://www.mozilla.org/MPL/
11 *
12 * Software distributed under the License is distributed on an "AS IS" basis,
13 * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
14 * for the specific language governing rights and limitations under the
15 * License.
16 *
17 * The Original Code is Mozilla Communicator client code, released
18 * March 31, 1998.
19 *
20 * The Initial Developer of the Original Code is
21 * Netscape Communications Corporation.
22 * Portions created by the Initial Developer are Copyright (C) 1998
23 * the Initial Developer. All Rights Reserved.
24 *
25 * Contributor(s):
26 *
27 * Alternatively, the contents of this file may be used under the terms of
28 * either of the GNU General Public License Version 2 or later (the "GPL"),
29 * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
30 * in which case the provisions of the GPL or the LGPL are applicable instead
31 * of those above. If you wish to allow use of your version of this file only
32 * under the terms of either the GPL or the LGPL, and not to allow others to
33 * use your version of this file under the terms of the MPL, indicate your
34 * decision by deleting the provisions above and replace them with the notice
35 * and other provisions required by the GPL or the LGPL. If you do not delete
36 * the provisions above, a recipient may use your version of this file under
37 * the terms of any one of the MPL, the GPL or the LGPL.
38 *
39 * ***** END LICENSE BLOCK ***** */
41 /*
42 * JS parser.
43 *
44 * This is a recursive-descent parser for the JavaScript language specified by
45 * "The JavaScript 1.5 Language Specification". It uses lexical and semantic
46 * feedback to disambiguate non-LL(1) structures. It generates trees of nodes
47 * induced by the recursive parsing (not precise syntax trees, see jsparse.h).
48 * After tree construction, it rewrites trees to fold constants and evaluate
49 * compile-time expressions. Finally, it calls js_EmitTree (see jsemit.h) to
50 * generate bytecode.
51 *
52 * This parser attempts no error recovery.
53 */
54 #include <stdlib.h>
55 #include <string.h>
56 #include <math.h>
83 #if JS_HAS_XML_SUPPORT
85 #endif
87 #if JS_HAS_DESTRUCTURING
89 #endif
93 /*
94 * Asserts to verify assumptions behind pn_ macros.
95 */
96 #define pn_offsetof(m) offsetof(JSParseNode, m)
101 #undef pn_offsetof
103 /*
104 * Insist that the next token be of type tt, or report errno and return null.
105 * NB: this macro uses cx and ts from its lexical environment.
106 */
107 #define MUST_MATCH_TOKEN_WITH_FLAGS(tt, errno, __flags) \
108 JS_BEGIN_MACRO \
109 if (tokenStream.getToken((__flags)) != tt) { \
110 ReportCompileErrorNumber(context, &tokenStream, NULL, JSREPORT_ERROR, errno); \
111 return NULL; \
112 } \
113 JS_END_MACRO
114 #define MUST_MATCH_TOKEN(tt, errno) MUST_MATCH_TOKEN_WITH_FLAGS(tt, errno, 0)
116 #ifdef METER_PARSENODES
120 #endif
122 void
124 {
138 }
140 /* If this is a function node fix up the pn_funbox->node back-pointer. */
150 }
152 void
154 {
160 }
162 bool
165 {
172 }
174 }
177 {
184 }
186 void
188 {
193 }
195 JSObjectBox *
197 {
200 /*
201 * We use JSContext.tempPool to allocate parsed objects and place them on
202 * a list in this Parser to ensure GC safety. Thus the tempPool arenas
203 * containing the entries must be alive until we are done with scanning,
204 * parsing and code generation for the whole script or top-level function.
205 */
211 }
217 }
219 JSFunctionBox *
221 {
225 /*
226 * We use JSContext.tempPool to allocate parsed objects and place them on
227 * a list in this Parser to ensure GC safety. Thus the tempPool arenas
228 * containing the entries must be alive until we are done with scanning,
229 * parsing and code generation for the whole script or top-level function.
230 */
236 }
254 }
255 }
259 }
261 bool
263 {
266 }
268 bool
270 {
277 }
278 }
280 }
282 void
284 {
289 }
290 }
292 static void
295 static void
297 {
304 /*
305 * Remove pn from funbox->parent's methods list if it's there. See
306 * the TOK_SEMI case in Statement, near the bottom, the TOK_ASSIGN
307 * sub-case matching a constructor method assignment pattern.
308 */
316 }
318 }
319 }
326 }
328 }
340 // FIXME: use a funbox freelist (consolidate aleFreeList and nodeList).
342 }
343 }
345 static void
347 {
376 }
377 }
378 }
380 static void
385 {
391 /* Catch back-to-back dup recycles. */
395 /*
396 * JSAtomLists own definition nodes along with their used-node chains.
397 * Defer recycling such nodes until we unwind to top level to avoid
398 * linkage overhead or (alternatively) unlinking runtime complexity.
399 * Yes, this means dead code can contribute to static analysis results!
400 *
401 * Do recycle kids here, since they are no longer needed.
402 */
410 #ifdef METER_PARSENODES
411 recyclednodes++;
412 #endif
413 }
415 }
417 static void
419 {
423 /* FALL THROUGH */
426 /*
427 * Only a definition node might have a non-null strong pn_expr link
428 * to recycle, but we test !pn_used to handle PN_FUNC fall through.
429 * Every node with the pn_used flag set has a non-null pn_lexdef
430 * weak reference to its definition node.
431 */
435 }
440 }
441 }
443 /*
444 * Allocate a JSParseNode from tc's node freelist or, failing that, from cx's
445 * temporary arena.
446 */
449 {
462 /* Recycle immediate descendents only, to save work and working set. */
480 #ifdef METER_PARSENODES
482 #endif
484 }
485 }
506 }
507 }
509 #ifdef METER_PARSENODES
510 parsenodes++;
513 #endif
517 }
519 }
521 /* used only by static create methods of subclasses */
523 JSParseNode *
525 {
533 }
535 JSParseNode *
538 {
544 /*
545 * Flatten a left-associative (left-heavy) tree of a given operator into
546 * a list, to reduce js_FoldConstants and js_EmitTree recursion.
547 */
566 }
567 }
575 }
577 }
579 /*
580 * Fold constant addition immediately, to conserve node space and, what's
581 * more, so js_FoldConstants never sees mixed addition and concatenation
582 * operations with more than one leading non-string operand in a PN_LIST
583 * generated for expressions such as 1 + 2 + "pt" (which should evaluate
584 * to "3pt", not "12pt").
585 */
593 }
604 }
610 {
617 }
619 NameNode *
621 {
628 }
630 }
634 static bool
636 {
641 }
644 }
646 static bool
648 {
656 }
658 /*
659 * Parse a top-level JS script.
660 */
661 JSParseNode *
663 {
664 /*
665 * Protect atoms from being collected by a GC activation, which might
666 * - nest on this thread due to out of memory (the so-called "last ditch"
667 * GC attempted within js_NewGCThing), or
668 * - run for any reason on another thread if this thread is suspended on
669 * an object lock before it finishes generating bytecode into a script
670 * protected from the GC by a root or a stack frame reference.
671 */
681 JSMSG_SYNTAX_ERROR);
686 }
687 }
689 }
695 {
696 /*
697 * Reserve FREE_STATIC_LEVEL (0xffff) in order to reserve FREE_UPVAR_COOKIE
698 * (0xffffffff) and other cookies with that level.
699 *
700 * This is a lot simpler than error-checking every MAKE_UPVAR_COOKIE, and
701 * practically speaking it leaves more than enough room for upvars. In fact
702 * we might want to split cookie fields giving fewer bits for skip and more
703 * for slot, but only based on evidence.
704 */
709 }
712 }
714 /*
715 * Compile a top-level script.
716 */
717 JSScript *
724 {
726 TokenKind tt;
728 uint32 scriptGlobals;
731 #ifdef METER_PARSENODES
733 #endif
737 /*
738 * The scripted callerFrame can only be given for compile-and-go scripts
739 * and non-zero static level requires callerFrame.
740 */
762 /* Null script early in case of error, to reduce our code footprint. */
770 /* If this is a direct call to eval, inherit the caller's strictness. */
776 }
778 /*
779 * If funbox is non-null after we create the new script, callerFrame->fun
780 * was saved in the 0th object table entry.
781 */
787 /*
788 * Save eval program source in script->atomMap.vector[0] for the
789 * eval cache (see obj_eval in jsobj.cpp).
790 */
794 }
797 /*
798 * An eval script in a caller frame needs to have its enclosing
799 * function captured in case it refers to an upvar, and someone
800 * wishes to decompile it while it's running.
801 */
808 }
809 }
811 /*
812 * Inline this->statements to emit as we go to save AST space. We must
813 * generate our script-body blockid since we aren't calling Statements.
814 */
815 uint32 bodyid;
820 #if JS_HAS_XML_SUPPORT
824 #endif
839 }
856 }
860 #if JS_HAS_XML_SUPPORT
865 }
866 #endif
868 }
870 #if JS_HAS_XML_SUPPORT
871 /*
872 * Prevent XML data theft via <script src="http://victim.com/foo.xml">.
873 * For background, see:
874 *
875 * https://bugzilla.mozilla.org/show_bug.cgi?id=336551
876 */
879 JSMSG_XML_WHOLE_PROGRAM);
881 }
882 #endif
884 /*
885 * Global variables (gvars) share the atom index space with locals. Due to
886 * incremental code generation we need to patch the bytecode to adjust the
887 * local references to skip the globals.
888 */
892 JSOp op;
909 /*
910 * JSOP_GETARGPROP also has JOF_SLOTATOM type, but it may be
911 * emitted only for a function.
912 */
923 }
924 }
925 }
927 #ifdef METER_PARSENODES
930 parsenodes,
931 maxparsenodes,
934 #endif
936 /*
937 * Nowadays the threaded interpreter needs a stop instruction, so we
938 * do have to emit that here.
939 */
942 #ifdef METER_PARSENODES
945 #endif
946 #ifdef JS_ARENAMETER
948 #endif
953 #ifdef JS_SCOPE_DEPTH_METER
960 }
961 #endif
963 out:
968 too_many_slots:
972 }
974 /*
975 * Insist on a final return before control flows out of pn. Try to be a bit
976 * smart about loops: do {...; return e2;} while(0) at the end of a function
977 * that contains an early return e1 will get a strict warning. Similarly for
978 * iloops: while (true){...} is treated as though ... returns.
979 */
980 #define ENDS_IN_OTHER 0
981 #define ENDS_IN_RETURN 1
982 #define ENDS_IN_BREAK 2
984 static int
986 {
1016 }
1021 }
1045 else
1047 }
1048 }
1049 /* If a final switch has no default case, we judge it harshly. */
1070 /* If we have a finally block that returns, we are done. */
1075 }
1077 /* Else check the try block and any and all catch statements. */
1083 }
1087 /* Check this catch block's body. */
1091 /* Non-binary let statements are let declarations. */
1098 }
1099 }
1101 static JSBool
1103 uintN anonerrnum)
1104 {
1113 }
1115 }
1117 static JSBool
1119 {
1124 }
1126 /*
1127 * Check that it is permitted to assign to lhs. Strict mode code may not
1128 * assign to 'eval' or 'arguments'.
1129 */
1130 bool
1132 {
1141 name)) {
1143 }
1144 }
1145 }
1147 }
1149 /*
1150 * Check that it is permitted to introduce a binding for atom. Strict
1151 * mode forbids introducing new definitions for 'eval' or 'arguments'.
1152 * Use pn for reporting error locations, or use tc's token stream if
1153 * pn is NULL.
1154 */
1155 bool
1157 {
1167 }
1169 }
1171 /*
1172 * In strict mode code, all formal parameter names must be distinct. If fun's
1173 * formals are legit given fun's strictness level, return true. Otherwise,
1174 * report an error and return false. Use pn for error position reporting,
1175 * unless we can find something more accurate in tc's decls.
1176 *
1177 * In some cases the code to parse the argument list will already have noticed
1178 * the duplication; we could try to use that knowledge instead of re-checking
1179 * here. But since the strictness of the function's body determines what
1180 * constraints to apply to the argument list, we can't report the error until
1181 * after we've parsed the body. And as it turns out, the function's local name
1182 * list makes it reasonably cheap to find duplicates after the fact.
1183 */
1184 static bool
1187 {
1195 /*
1196 * We have found a duplicate parameter name. If we can find the
1197 * JSDefinition for the argument, that will have a more accurate source
1198 * location.
1199 */
1207 }
1208 }
1214 /* The definition's source position will be more precise. */
1221 }
1222 }
1225 }
1227 JSParseNode *
1229 {
1230 JSStmtInfo stmtInfo;
1241 /*
1242 * Save the body's first line, and store it in pn->pn_pos.begin.lineno
1243 * later, because we may have not peeked in tokenStream yet, so statements
1244 * won't acquire a valid pn->pn_pos.begin from the current token.
1245 */
1247 #if JS_HAS_EXPR_CLOSURES
1259 JSMSG_BAD_GENERATOR_RETURN,
1260 JSMSG_BAD_ANON_GENERATOR_RETURN);
1266 }
1267 }
1268 }
1269 }
1270 #else
1272 #endif
1279 /* Check for falling off the end of a function that returns a value. */
1283 }
1284 }
1288 }
1292 {
1305 }
1307 static bool
1309 {
1334 }
1343 }
1344 }
1345 }
1354 }
1356 static void
1358 {
1367 }
1369 static void
1371 {
1375 }
1383 }
1387 {
1402 }
1412 }
1416 {
1417 /*
1418 * If dn is var, const, or let, and it has an initializer, then we must
1419 * rewrite it to be an assignment node, whose freshly allocated left-hand
1420 * side becomes a use of pn.
1421 */
1428 //pn->dn_uses = lhs;
1430 }
1439 }
1441 /* Now make dn no longer a definition, rather a use of pn. */
1451 }
1461 }
1463 static bool
1465 {
1468 /* Flag tc so we don't have to lookup arguments on every use. */
1474 /*
1475 * Make an argument definition node, distinguished by being in tc->decls
1476 * but having TOK_NAME type and JSOP_NOP op. Insert it in a TOK_ARGSBODY
1477 * list node returned via pn->pn_body.
1478 */
1484 /* Arguments are initialized by definition. */
1498 }
1505 }
1507 /*
1508 * Compile a JS function body, which might appear as the value of an event
1509 * handler attribute in an HTML <INPUT> tag.
1510 */
1511 bool
1515 {
1521 /* No early return from after here until the js_FinishArenaPool calls. */
1540 /* FIXME: make Function format the source for a function definition. */
1558 }
1559 }
1560 }
1561 }
1562 }
1564 /*
1565 * Farble the body so that it looks like a block statement to js_EmitTree,
1566 * which is called from js_EmitFunctionBody (see jsemit.cpp). After we're
1567 * done parsing, we must fold constants, analyze any nested functions, and
1568 * generate code for this function, including a stop opcode at the end.
1569 */
1577 JSMSG_SYNTAX_ERROR);
1580 /* js_FoldConstants reported the error already. */
1591 }
1595 }
1596 }
1598 /* Restore saved state and release code generation arenas. */
1602 }
1604 /*
1605 * Parameter block types for the several Binder functions. We use a common
1606 * helper function signature in order to share code among destructuring and
1607 * simple variable declaration parsers. In the destructuring case, the binder
1608 * function is called indirectly from the variable declaration parser by way
1609 * of CheckDestructuring and its friends.
1610 */
1611 typedef JSBool
1618 error source coordinates */
1623 uintN overflow;
1625 };
1627 };
1629 static JSBool
1632 {
1635 /*
1636 * Don't bind a variable with the hidden name 'arguments', per ECMA-262.
1637 * Instead 'var arguments' always restates the predefined property of the
1638 * activation objects whose name is 'arguments'. Assignment to such a
1639 * variable must be handled specially.
1640 *
1641 * Special case: an argument named 'arguments' *does* shadow the predefined
1642 * arguments property.
1643 */
1648 }
1650 #if JS_HAS_DESTRUCTURING
1651 static JSBool
1654 {
1657 /* Flag tc so we don't have to lookup arguments on every use. */
1668 JSMSG_DESTRUCT_DUP_ARG);
1670 }
1684 }
1687 JSFunction *
1689 {
1695 /*
1696 * Find the global compilation context in order to pre-set the newborn
1697 * function's parent slot to tc->scopeChain. If the global context is a
1698 * compile-and-go one, we leave the pre-set parent intact; otherwise we
1699 * clear parent and proto.
1700 */
1711 }
1713 }
1715 static JSBool
1717 {
1724 }
1727 }
1729 bool
1731 {
1736 }
1738 /*
1739 * Mark as funargs any functions that reach up to one or more upvars across an
1740 * already-known funarg. The parser will flag the o_m lambda as a funarg in:
1741 *
1742 * function f(o, p) {
1743 * o.m = function o_m(a) {
1744 * function g() { return p; }
1745 * function h() { return a; }
1746 * return g() + h();
1747 * }
1748 * }
1749 *
1750 * but without this extra marking phase, function g will not be marked as a
1751 * funarg since it is called from within its parent scope. But g reaches up to
1752 * f's parameter p, so if o_m escapes f's activation scope, g does too and
1753 * cannot use JSOP_GETUPVAR to reach p. In contast function h neither escapes
1754 * nor uses an upvar "above" o_m's level.
1755 *
1756 * If function g itself contained lambdas that contained non-lambdas that reach
1757 * up above its level, then those non-lambdas would have to be marked too. This
1758 * process is potentially exponential in the number of functions, but generally
1759 * not so complex. But it can't be done during a single recursive traversal of
1760 * the funbox tree, so we must use a work queue.
1761 *
1762 * Return the minimal "skipmin" for funbox and its siblings. This is the delta
1763 * between the static level of the bodies of funbox and its peers (which must
1764 * be funbox->level + 1), and the static level of the nearest upvar among all
1765 * the upvars contained by funbox and its peers. If there are no upvars, return
1766 * FREE_STATIC_LEVEL. Thus this function never returns 0.
1767 */
1768 static uintN
1770 {
1778 /*
1779 * An eval can leak funbox, functions along its ancestor line, and its
1780 * immediate kids. Since FindFunArgs uses DFS and the parser propagates
1781 * TCF_FUN_HEAVYWEIGHT bottom up, funbox's ancestor function nodes have
1782 * already been marked as funargs by this point. Therefore we have to
1783 * flag only funbox->node and funbox->kids' nodes here.
1784 */
1789 }
1791 /*
1792 * Compute in skipmin the least distance from fun's static level up to
1793 * an upvar, whether used directly by fun, or indirectly by a function
1794 * nested in fun.
1795 */
1818 }
1819 }
1820 }
1822 /*
1823 * If this function escapes, whether directly (the parser detects such
1824 * escapes) or indirectly (because this non-escaping function uses an
1825 * upvar that reaches across an outer function boundary where the outer
1826 * function escapes), enqueue it for further analysis, and bump fnlevel
1827 * to trap any non-escaping children.
1828 */
1832 }
1834 /*
1835 * Now process the current function's children, and recalibrate their
1836 * cumulative skipmin to be relative to the current static level.
1837 */
1846 }
1847 }
1849 /*
1850 * Finally, after we've traversed all of the current function's kids,
1851 * minimize fun's skipmin against our accumulated skipmin. Do likewise
1852 * with allskipmin, but minimize across funbox and all of its siblings,
1853 * to compute our return value.
1854 */
1859 }
1863 }
1865 bool
1867 {
1868 JSFunctionBoxQueue queue;
1892 /*
1893 * Mark this formerly-Algol-like function as an escaping
1894 * function (i.e., as a funarg), because it is used from a
1895 * funarg and therefore can not use JSOP_{GET,CALL}UPVAR to
1896 * access upvars.
1897 *
1898 * Progress is guaranteed because we set the funarg flag
1899 * here, which suppresses revisiting this function (thanks
1900 * to the !lexdep->isFunArg() test just above).
1901 */
1906 /*
1907 * A named function expression will not appear to be a
1908 * funarg if it is immediately applied. However, if its
1909 * name is used in an escaping function nested within
1910 * it, then it must become flagged as a funarg again.
1911 * See bug 545980.
1912 */
1919 }
1923 }
1926 /*
1927 * Walk over nested functions again, now that we have
1928 * changed the level across which it is unsafe to access
1929 * upvars using the runtime dynamic link (frame chain).
1930 */
1933 }
1934 }
1935 }
1936 }
1938 }
1940 static uint32
1942 {
1949 }
1950 }
1952 }
1956 {
1957 /*
1958 * Consider the current function (the lambda, innermost below) using a var
1959 * x defined two static levels up:
1960 *
1961 * function f() {
1962 * // z = g();
1963 * var x = 42;
1964 * function g() {
1965 * return function () { return x; };
1966 * }
1967 * return g();
1968 * }
1969 *
1970 * So long as (1) the initialization in 'var x = 42' dominates all uses of
1971 * g and (2) x is not reassigned, it is safe to optimize the lambda to a
1972 * flat closure. Uncommenting the early call to g makes this optimization
1973 * unsafe (z could name a global setter that calls its argument).
1974 */
1982 /*
1983 * NB: afunbox can't be null because we are sure to find a function box
1984 * whose level == dnLevel before we would try to walk above the root of
1985 * the funbox tree. See bug 493260 comments 16-18.
1986 *
1987 * Assert but check anyway, to protect future changes that bind eval
1988 * upvars in the parser.
1989 */
1992 /*
1993 * If this function is reaching up across an enclosing funarg, then we
1994 * cannot copy dn's value into a flat closure slot (the display stops
1995 * working once the funarg escapes).
1996 */
2000 /*
2001 * Reaching up for dn across a generator also means we can't flatten,
2002 * since the generator iterator does not run until later, in general.
2003 * See bug 563034.
2004 */
2007 }
2009 /*
2010 * If afunbox's function (which is at the same level as dn) is in a loop,
2011 * pessimistically assume the variable initializer may be in the same loop.
2012 * A flat closure would then be unsafe, as the captured variable could be
2013 * assigned after the closure is created. See bug 493232.
2014 */
2018 /*
2019 * |with| and eval used as an operator defeat lexical scoping: they can be
2020 * used to assign to any in-scope variable. Therefore they must disable
2021 * flat closures that use such upvars. The parser detects these as special
2022 * forms and marks the function heavyweight.
2023 */
2027 /*
2028 * If afunbox's function is not a lambda, it will be hoisted, so it could
2029 * capture the undefined value that by default initializes var, let, and
2030 * const bindings. And if dn is a function that comes at (meaning a
2031 * function refers to its own name) or strictly after afunbox, we also
2032 * defeat the flat closure optimization for this dn.
2033 */
2038 }
2048 /*
2049 * Any formal could be mutated behind our back via the arguments
2050 * object, so deoptimize if the outer function uses arguments.
2051 *
2052 * In a Function constructor call where the final argument -- the body
2053 * source for the function to create -- contains a nested function
2054 * definition or expression, afunbox->parent will be null. The body
2055 * source might use |arguments| outside of any nested functions it may
2056 * contain, so we have to check the tcflags parameter that was passed
2057 * in from Compiler::compileFunctionBody.
2058 */
2062 }
2063 }
2065 /*
2066 * Check quick-and-dirty dominance relation. Function definitions dominate
2067 * their uses thanks to hoisting. Other binding forms hoist as undefined,
2068 * of course, so check forward-reference and blockid relations.
2069 */
2071 /*
2072 * Watch out for code such as
2073 *
2074 * (function () {
2075 * ...
2076 * var jQuery = ... = function (...) {
2077 * return new jQuery.foo.bar(baz);
2078 * }
2079 * ...
2080 * })();
2081 *
2082 * where the jQuery variable is not reassigned, but of course is not
2083 * initialized at the time that the would-be-flat closure containing
2084 * the jQuery upvar is formed.
2085 */
2090 }
2092 }
2094 static void
2096 {
2100 /*
2101 * Notice that funbox->level is the static level of the definition or
2102 * expression of the function parsed into funbox, not the static level
2103 * of its body. Therefore we must add 1 to match dn's level to find the
2104 * funbox whose body contains the dn definition.
2105 */
2109 }
2111 }
2115 }
2117 static void
2119 {
2129 }
2130 }
2134 }
2136 void
2138 {
2139 #ifdef JS_FUNCTION_METERING
2140 # define FUN_METER(x) JS_RUNTIME_METER(context->runtime, functionMeter.x)
2141 #else
2142 # define FUN_METER(x) ((void)0)
2143 #endif
2152 /*
2153 * We've unwound from recursively setting our kids' kinds, which
2154 * also classifies enclosing functions holding upvars referenced in
2155 * those descendants' bodies. So now we can check our "methods".
2156 *
2157 * Despecialize from branded method-identity-based shape to sprop-
2158 * or slot-based shape if this function smells like a constructor
2159 * and too many of its methods are *not* joinable null closures
2160 * (i.e., they have one or more upvars fetched via the display).
2161 */
2168 #if JS_HAS_EXPR_CLOSURES
2170 #endif
2179 }
2183 }
2184 }
2194 /*
2195 * No lexical dependencies => null closure, for best performance.
2196 * A null closure needs no scope chain, but alas we've coupled
2197 * principals-finding to scope (for good fundamental reasons, but
2198 * the implementation overloads the parent slot and we should fix
2199 * that). See, e.g., the JSOP_LAMBDA case in jsinterp.cpp.
2200 *
2201 * In more detail: the ES3 spec allows the implementation to create
2202 * "joined function objects", or not, at its discretion. But real-
2203 * world implementations always create unique function objects for
2204 * closures, and this can be detected via mutation. Open question:
2205 * do popular implementations create unique function objects for
2206 * null closures?
2207 *
2208 * FIXME: bug 476950.
2209 */
2220 /*
2221 * This function is Algol-like, it never escapes. So long as it
2222 * does not assign to outer variables, it needs only an upvars
2223 * array in its script and JSOP_{GET,CALL}UPVAR opcodes in its
2224 * bytecode to reach up the frame stack at runtime based on
2225 * those upvars' cookies.
2226 *
2227 * Any assignments to upvars from functions called by this one
2228 * will be coherent because of the JSOP_{GET,CALL}UPVAR ops,
2229 * which load from stack homes when interpreting or from native
2230 * stack slots when executing a trace.
2231 *
2232 * We could add JSOP_SETUPVAR, etc., but it is uncommon for a
2233 * nested function to assign to an outer lexical variable, so
2234 * we defer adding yet more code footprint in the absence of
2235 * evidence motivating these opcodes.
2236 */
2240 /*
2241 * Check that at least one outer lexical binding was assigned
2242 * to (global variables don't count). This is conservative: we
2243 * could limit assignments to those in the current function,
2244 * but that's too much work. As with flat closures (handled
2245 * below), we optimize for the case where outer bindings are
2246 * not reassigned anywhere.
2247 */
2256 }
2257 }
2266 /*
2267 * Algol-like functions can read upvars using the dynamic
2268 * link (cx->fp/fp->down), optimized using the cx->display
2269 * lookup table indexed by static level. They do not need
2270 * to entrain and search their environment objects.
2271 */
2277 }
2281 /*
2282 * For each lexical dependency from this closure to an outer
2283 * binding, analyze whether it is safe to copy the binding's
2284 * value into a flat closure slot when the closure is formed.
2285 */
2294 }
2296 }
2297 }
2303 /* FIXME bug 545759: to test nflattened != 0 */
2304 /*
2305 * We made it all the way through the upvar loop, so it's
2306 * safe to optimize to a flat closure.
2307 */
2321 /* js_EmitTree's case TOK_FUNCTION: will select op. */
2323 }
2326 }
2327 }
2328 }
2331 /*
2332 * One or more upvars cannot be safely snapshot into a flat
2333 * closure's dslot (see JSOP_GETDSLOT), so we loop again over
2334 * all upvars, and for each non-free upvar, ensure that its
2335 * containing function has been flagged as heavyweight.
2336 *
2337 * The emitter must see TCF_FUN_HEAVYWEIGHT accurately before
2338 * generating any code for a tree of nested functions.
2339 */
2350 }
2351 }
2356 }
2358 #undef FUN_METER
2359 }
2367 {
2371 };
2375 }
2380 {
2386 /* Create box for fun->object early to protect against last-ditch GC. */
2391 /* Initialize non-default members of funtc. */
2402 }
2404 static bool
2407 {
2420 /*
2421 * Propagate unresolved lexical names up to tc->lexdeps, and save a copy
2422 * of funtc->lexdeps in a TOK_UPVARS node wrapping the function's formal
2423 * params and body. We do this only if there are lexical dependencies not
2424 * satisfied by the function's declarations, to avoid penalizing functions
2425 * that use only their arguments and other local bindings.
2426 */
2442 /*
2443 * If this named function expression uses its own name other
2444 * than to call itself, flag this function specially.
2445 */
2450 }
2454 /*
2455 * Make sure we do not fail to set TCF_FUN_SETS_OUTER_NAME if
2456 * any use of dn in funtc assigns. See NoteLValue for the easy
2457 * backward-reference case; this is the hard forward-reference
2458 * case where we pay a higher price.
2459 */
2464 }
2465 }
2466 }
2472 /*
2473 * Insert dn's uses list at the front of outer_dn's list.
2474 *
2475 * Without loss of generality or correctness, we allow a dn to
2476 * be in inner and outer lexdeps, since the purpose of lexdeps
2477 * is one-pass coordination of name use and definition across
2478 * functions, and if different dn's are used we'll merge lists
2479 * when leaving the inner function.
2480 *
2481 * The dn == outer_dn case arises with generator expressions
2482 * (see CompExprTransplanter::transplant, the PN_FUNC/PN_NAME
2483 * case), and nowhere else, currently.
2484 */
2494 }
2496 /*
2497 * Make dn be a use that redirects to outer_dn, because we
2498 * can't replace dn with outer_dn in all the pn_namesets in
2499 * the AST where it may be. Instead we make it forward to
2500 * outer_dn. See JSDefinition::resolve.
2501 */
2508 }
2510 /* Add an outer lexical dependency for ale's definition. */
2515 }
2516 }
2531 }
2534 }
2537 }
2539 JSParseNode *
2541 {
2543 TokenKind tt;
2545 #if JS_HAS_DESTRUCTURING
2549 #endif
2551 /*
2552 * Save the current op for later so we can tag the created function as a
2553 * getter/setter if necessary.
2554 */
2557 /* Make a TOK_FUNCTION node. */
2564 /*
2565 * If a lambda, give up on JSOP_{GET,CALL}UPVAR usage unless this function
2566 * is immediately applied (we clear PND_FUNARG if so -- see memberExpr).
2567 *
2568 * Also treat function sub-statements (non-lambda, non-top-level functions)
2569 * as escaping funargs, since we can't statically analyze their definitions
2570 * and uses.
2571 */
2575 /* Scan the optional function name into funAtom. */
2584 JSMSG_SYNTAX_ERROR);
2586 }
2588 }
2589 }
2591 /*
2592 * Record names for function statements in tc->decls so we know when to
2593 * avoid optimizing variable references that might name a function.
2594 */
2611 JSMSG_REDECLARED_VAR,
2613 name)) {
2615 }
2616 }
2625 }
2627 /*
2628 * If this function was used before it was defined, claim the
2629 * pre-created definition node for this function that primaryExpr
2630 * put in tc->lexdeps on first forward reference, and recycle pn.
2631 */
2648 }
2652 }
2654 /*
2655 * A function nested at top level inside another's body needs only a
2656 * local variable to bind its name to its value, and not an activation
2657 * object property (it might also need the activation property, if the
2658 * outer function contains with statements, e.g., but the stack slot
2659 * wins when jsemit.c's BindNameToSlot can optimize a JSOP_NAME into a
2660 * JSOP_GETLOCAL bytecode).
2661 */
2666 JSLocalKind localKind;
2667 uintN index;
2669 /*
2670 * Define a local in the outer function so that BindNameToSlot
2671 * can properly optimize accesses. Note that we need a local
2672 * variable, not an argument, for the function statement. Thus
2673 * we add a variable even if a parameter with the given name
2674 * already exists.
2675 */
2683 /* FALL THROUGH */
2691 }
2692 }
2693 }
2694 }
2698 /* Initialize early for possible flags mutation via destructuringExpr. */
2710 /* Now parse formal argument list and compute fun->nargs. */
2716 #if JS_HAS_DESTRUCTURING
2719 {
2720 BindData data;
2722 jsint slot;
2724 /* See comment below in the TOK_NAME case. */
2729 /*
2730 * A destructuring formal parameter turns into one or more
2731 * local variables initialized from properties of a single
2732 * anonymous positional parameter, so here we must tweak our
2733 * binder and its data.
2734 */
2742 /*
2743 * Adjust fun->nargs to count the single anonymous positional
2744 * parameter that is to be destructured.
2745 */
2750 /*
2751 * Synthesize a destructuring assignment from the single
2752 * anonymous positional parameter into the destructuring
2753 * left-hand-side expression and accumulate it in list.
2754 */
2772 }
2775 }
2779 {
2783 #ifdef JS_HAS_DESTRUCTURING
2784 /*
2785 * ECMA-262 requires us to support duplicate parameter names, but if the
2786 * parameter list includes destructuring, we consider the code to have
2787 * opted in to higher standards, and forbid duplicates. We may see a
2788 * destructuring parameter later, so always note duplicates now.
2789 *
2790 * Duplicates are warned about (strict option) or cause errors (strict
2791 * mode code), but we do those tests in one place below, after having
2792 * parsed the body.
2793 */
2798 }
2799 #endif
2803 }
2807 JSMSG_MISSING_FORMAL);
2808 /* FALL THROUGH */
2812 #if JS_HAS_DESTRUCTURING
2813 report_dup_and_destructuring:
2816 JSMSG_DESTRUCT_DUP_ARG);
2818 #endif
2819 }
2823 }
2825 #if JS_HAS_EXPR_CLOSURES
2830 }
2831 #else
2833 #endif
2845 #if JS_HAS_EXPR_CLOSURES
2850 #else
2852 #endif
2855 #if JS_HAS_DESTRUCTURING
2856 /*
2857 * If there were destructuring formal parameters, prepend the initializing
2858 * comma expression that we synthesized to body. If the body is a lexical
2859 * scope node, we must make a special TOK_SEQ node, to prepend the formal
2860 * parameter destructuring code without bracing the decompilation of the
2861 * function body's lexical scope.
2862 */
2875 }
2890 }
2891 #endif
2893 /*
2894 * If we collected flags that indicate nested heavyweight functions, or
2895 * this function contains heavyweight-making statements (with statement,
2896 * visible eval call, or assignment to 'arguments'), flag the function as
2897 * heavyweight (requiring a call object per invocation).
2898 */
2903 /*
2904 * If this function is a named statement function not at top-level
2905 * (i.e. not a top-level function definiton or expression), then our
2906 * enclosing function, if any, must be heavyweight.
2907 */
2910 }
2914 /*
2915 * ECMA ed. 3 standard: function expression, possibly anonymous.
2916 */
2919 /*
2920 * If this anonymous function definition is *not* embedded within a
2921 * larger expression, we treat it as an expression statement, not as
2922 * a function declaration -- and not as a syntax error (as ECMA-262
2923 * Edition 3 would have it). Backward compatibility must trump all,
2924 * unless JSOPTION_ANONFUNFIX is set.
2925 */
2934 /*
2935 * ECMA ed. 3 extension: a function expression statement not at the
2936 * top level, e.g., in a compound statement such as the "then" part
2937 * of an "if" statement, binds a closure only if control reaches that
2938 * sub-statement.
2939 */
2943 }
2954 }
2961 /* If the surrounding function is not strict code, reset the lexer. */
2966 }
2968 JSParseNode *
2970 {
2972 }
2974 JSParseNode *
2976 {
2978 }
2980 /*
2981 * Recognize Directive Prologue members and directives. Assuming pn
2982 * is a candidate for membership in a directive prologue, return
2983 * true if it is in fact a member. Recognize directives and set
2984 * tc's flags accordingly.
2985 *
2986 * Note that the following is a strict mode function:
2987 *
2988 * function foo() {
2989 * "blah" // inserted semi colon
2990 * "blurgh"
2991 * "use\x20loose"
2992 * "use strict"
2993 * }
2994 *
2995 * That is, a statement can be a Directive Prologue member, even
2996 * if it can't possibly be a directive, now or in the future.
2997 */
2998 bool
3000 {
3008 }
3009 }
3011 }
3013 /*
3014 * Parse the statements in a block, creating a TOK_LC node that lists the
3015 * statements' trees. If called from block-parsing code, the caller must
3016 * match { before and } after.
3017 */
3018 JSParseNode *
3020 {
3022 TokenKind tt;
3043 }
3045 }
3051 }
3057 /*
3058 * PNX_FUNCDEFS notifies the emitter that the block contains top-
3059 * level function definitions that should be processed before the
3060 * rest of nodes.
3061 *
3062 * TCF_HAS_FUNCTION_STMT is for the TOK_LC case in Statement. It
3063 * is relevant only for function definitions not at top-level,
3064 * which we call function statements.
3065 */
3068 else
3070 }
3072 }
3074 /*
3075 * Handle the case where there was a let declaration under this block. If
3076 * it replaced tc->blockNode with a new block node then we must refresh pn
3077 * and then restore tc->blockNode.
3078 */
3085 }
3087 JSParseNode *
3089 {
3098 /* Check for (a = b) and warn about possible (a == b) mistype. */
3105 }
3107 }
3109 static JSBool
3111 {
3113 TokenKind tt;
3123 }
3126 }
3128 static JSBool
3130 {
3134 jsint n;
3136 /*
3137 * Top-level 'let' is the same as 'var' currently -- this may change in a
3138 * successor standard to ES3.1 that specifies 'let'.
3139 */
3154 ? js_const_str
3156 name);
3157 }
3159 }
3166 }
3168 /*
3169 * Pass push = true to Define so it pushes an ale ahead of any outer scope.
3170 * This is balanced by PopStatement, defined immediately below.
3171 */
3175 /*
3176 * Assign block-local index to pn->pn_cookie right away, encoding it as an
3177 * upvar cookie whose skip tells the current static level. The emitter will
3178 * adjust the node's slot based on its stack depth model -- and, for global
3179 * and eval code, Compiler::compileScript will adjust the slot again to
3180 * include script->nfixed.
3181 */
3186 /*
3187 * Define the let binding's property before storing pn in a reserved slot,
3188 * since block_reserveSlots depends on blockObj->scope()->entryCount.
3189 */
3193 /*
3194 * Store pn temporarily in what would be reserved slots in a cloned block
3195 * object (once the prototype's final population is known, after all 'let'
3196 * bindings for this block have been parsed). We will free these reserved
3197 * slots in jsemit.cpp:EmitEnterBlock.
3198 */
3203 }
3207 }
3209 static void
3211 {
3222 /* Beware the empty destructuring dummy. */
3226 }
3227 }
3229 }
3233 {
3240 }
3242 }
3244 /*
3245 * If we are generating global or eval-called-from-global code, bind a "gvar"
3246 * here, as soon as possible. The JSOP_GETGVAR, etc., ops speed up interpreted
3247 * global variable access by memoizing name-to-slot mappings during execution
3248 * of the script prolog (via JSOP_DEFVAR/JSOP_DEFCONST). If the memoization
3249 * can't be done due to a pre-existing property of the same name as the var or
3250 * const but incompatible attributes/getter/setter/etc, these ops devolve to
3251 * JSOP_NAME, etc.
3252 *
3253 * For now, don't try to lookup eval frame variables at compile time. This is
3254 * sub-optimal: we could handle eval-called-from-global-code gvars since eval
3255 * gets its own script and frame. The eval-from-function-code case is harder,
3256 * since functions do not atomize gvars and then reserve their atom indexes as
3257 * stack frame slots.
3258 */
3259 static bool
3261 {
3268 /* Index pn->pn_atom so we can map fast global number to name. */
3273 /* Defend against cg->ngvars 16-bit overflow. */
3285 }
3286 }
3289 }
3291 static JSBool
3293 {
3296 /* Default best op for pn is JSOP_NAME; we'll try to improve below. */
3307 }
3325 name);
3327 }
3332 }
3345 !error
3348 JSMSG_REDECLARED_VAR,
3350 name)) {
3352 }
3353 }
3354 }
3355 }
3361 /*
3362 * A var declaration never recreates an existing binding, it restates
3363 * it and possibly reinitializes its value. Beware that if pn becomes a
3364 * use of ALE_DEFN(ale), and if we have an initializer for this var or
3365 * const (typically a const would ;-), then pn must be rewritten into a
3366 * TOK_ASSIGN node. See Variables, further below.
3367 *
3368 * A case such as let (x = 1) { var x = 2; print(x); } is even harder.
3369 * There the x definition is hoisted but the x = 2 assignment mutates
3370 * the block-local binding of x.
3371 */
3377 /* Make pnu be a fresh name node that uses dn. */
3384 }
3388 }
3397 }
3403 }
3405 /*
3406 * A var or const that is shadowed by one or more let bindings of the
3407 * same name, but that has not been declared until this point, must be
3408 * hoisted above the let bindings.
3409 */
3422 /* The token stream may be past the location for pn. */
3426 }
3428 }
3436 }
3448 }
3452 /*
3453 * Property not found in current variable scope: we have not seen this
3454 * variable before. Define a new local variable by adding a property to
3455 * the function's scope and allocating one slot in the function's vars
3456 * frame. Any locals declared in a with statement body are handled at
3457 * runtime, by script prolog JSOP_DEFVAR opcodes generated for global
3458 * and heavyweight-function-local vars.
3459 */
3469 }
3472 /* We checked errors and strict warnings earlier -- see above. */
3475 /* Not an argument, must be a redeclared local var. */
3477 }
3479 }
3481 static JSBool
3483 {
3492 }
3495 }
3497 static void
3499 {
3503 /*
3504 * Save the win of PND_INITIALIZED if we can prove 'var x;' and 'x = y'
3505 * occur as direct kids of the same block with no forward refs to x.
3506 */
3514 }
3519 /*
3520 * The above condition takes advantage of the all-ones nature of
3521 * FREE_UPVAR_COOKIE, and the reserved level FREE_STATIC_LEVEL.
3522 * We make a stronger assertion by excluding FREE_UPVAR_COOKIE.
3523 */
3527 }
3528 }
3534 }
3536 #if JS_HAS_DESTRUCTURING
3538 static JSBool
3541 {
3544 /*
3545 * Destructuring is a form of assignment, so just as for an initialized
3546 * simple variable, we must check for assignment to 'arguments' and flag
3547 * the enclosing function (if any) as heavyweight.
3548 */
3558 /*
3559 * Select the appropriate name-setting opcode, respecting eager selection
3560 * done by the data->binder function.
3561 */
3564 ? JSOP_SETNAME
3566 ? JSOP_SETGVAR
3570 ? JSOP_SETCONST
3572 }
3579 }
3581 /*
3582 * Here, we are destructuring {... P: Q, ...} = R, where P is any id, Q is any
3583 * LHS expression except a destructuring initialiser, and R is on the stack.
3584 * Because R is already evaluated, the usual LHS-specialized bytecodes won't
3585 * work. After pushing R[P] we need to evaluate Q's "reference base" QB and
3586 * then push its property name QN. At this point the stack looks like
3587 *
3588 * [... R, R[P], QB, QN]
3589 *
3590 * We need to set QB[QN] = R[P]. This is a job for JSOP_ENUMELEM, which takes
3591 * its operands with left-hand side above right-hand side:
3592 *
3593 * [rval, lval, xval]
3594 *
3595 * and pops all three values, setting lval[xval] = rval. But we cannot select
3596 * JSOP_ENUMELEM yet, because the LHS may turn out to be an arg or local var,
3597 * which can be optimized further. So we select JSOP_SETNAME.
3598 */
3599 static JSBool
3601 {
3605 /* FALL THROUGH */
3617 #if JS_HAS_XML_SUPPORT
3622 }
3623 /* FALL THROUGH */
3624 #endif
3630 }
3633 }
3642 JSDHashEntryHdr hdr;
3647 #define ASSERT_VALID_PROPERTY_KEY(pnkey) \
3648 JS_ASSERT(((pnkey)->pn_arity == PN_NULLARY && \
3649 ((pnkey)->pn_type == TOK_NUMBER || \
3650 (pnkey)->pn_type == TOK_STRING || \
3651 (pnkey)->pn_type == TOK_NAME)) || \
3652 ((pnkey)->pn_arity == PN_NAME && (pnkey)->pn_type == TOK_NAME))
3654 static JSDHashNumber
3656 {
3663 }
3665 static JSBool
3669 {
3678 }
3681 JS_DHashAllocTable,
3682 JS_DHashFreeTable,
3683 HashFindPropValKey,
3684 MatchFindPropValEntry,
3685 JS_DHashMoveEntryStub,
3686 JS_DHashClearEntryStub,
3687 JS_DHashFinalizeStub,
3688 NULL
3689 };
3691 #define STEP_HASH_THRESHOLD 10
3692 #define BIG_DESTRUCTURING 5
3693 #define BIG_OBJECT_INIT 20
3697 {
3700 uint32 step;
3702 /* If we have a hash table, use it as the sole source of truth. */
3707 }
3709 /* If pn is not an object initialiser node, we can't do anything here. */
3713 /*
3714 * We must search all the way through pn's list, to handle the case of an
3715 * id duplicated for two or more property initialisers.
3716 */
3730 }
3732 }
3733 }
3743 }
3745 }
3746 }
3747 }
3751 /* Hit via full search -- see whether it's time to create the hash table. */
3761 {
3767 JS_DHASH_ADD);
3769 }
3770 }
3771 }
3773 }
3775 /*
3776 * Destructuring patterns can appear in two kinds of contexts:
3777 *
3778 * - assignment-like: assignment expressions and |for| loop heads. In
3779 * these cases, the patterns' property value positions can be
3780 * arbitrary lvalue expressions; the destructuring is just a fancy
3781 * assignment.
3782 *
3783 * - declaration-like: |var| and |let| declarations, functions' formal
3784 * parameter lists, |catch| clauses, and comprehension tails. In
3785 * these cases, the patterns' property value positions must be
3786 * simple names; the destructuring defines them as new variables.
3787 *
3788 * In both cases, other code parses the pattern as an arbitrary
3789 * primaryExpr, and then, here in CheckDestructuring, verify that the
3790 * tree is a valid destructuring expression.
3791 *
3792 * In assignment-like contexts, we parse the pattern with the
3793 * TCF_DECL_DESTRUCTURING flag clear, so the lvalue expressions in the
3794 * pattern are parsed normally. primaryExpr links variable references
3795 * into the appropriate use chains; creates placeholder definitions;
3796 * and so on. CheckDestructuring is called with |data| NULL (since we
3797 * won't be binding any new names), and we specialize lvalues as
3798 * appropriate. If right is NULL, we just check for well-formed lvalues.
3799 *
3800 * In declaration-like contexts, the normal variable reference
3801 * processing would just be an obstruction, because we're going to
3802 * define the names that appear in the property value positions as new
3803 * variables anyway. In this case, we parse the pattern with
3804 * TCF_DECL_DESTRUCTURING set, which directs primaryExpr to leave
3805 * whatever name nodes it creates unconnected. Then, here in
3806 * CheckDestructuring, we require the pattern's property value
3807 * positions to be simple names, and define them as appropriate to the
3808 * context. For these calls, |data| points to the right sort of
3809 * BindData.
3810 *
3811 * See also UndominateInitializers, immediately below. If you change
3812 * either of these functions, you might have to change the other to
3813 * match.
3814 */
3815 static JSBool
3819 {
3820 JSBool ok;
3821 FindPropValData fpvd;
3826 JSMSG_ARRAY_COMP_LEFTSIDE);
3828 }
3830 #if JS_HAS_DESTRUCTURING_SHORTHAND
3833 JSMSG_BAD_OBJECT_INIT);
3835 }
3836 #endif
3848 /* Nullary comma is an elision; binary comma is an expression.*/
3860 }
3861 }
3864 }
3869 }
3891 }
3896 }
3897 }
3899 /*
3900 * The catch/finally handler implementation in the interpreter assumes
3901 * that any operation that introduces a new scope (like a "let" or "with"
3902 * block) increases the stack depth. This way, it is possible to restore
3903 * the scope chain based on stack depth of the handler alone. "let" with
3904 * an empty destructuring pattern like in
3905 *
3906 * let [] = 1;
3907 *
3908 * would violate this assumption as the there would be no let locals to
3909 * store on the stack. To satisfy it we add an empty property to such
3910 * blocks so that OBJ_BLOCK_COUNT(cx, blockObj), which gives the number of
3911 * slots, would be always positive.
3912 *
3913 * Note that we add such a property even if the block has locals due to
3914 * later let declarations in it. We optimize for code simplicity here,
3915 * not the fastest runtime performance with empty [] or {}.
3916 */
3924 JSPROP_ENUMERATE |
3925 JSPROP_PERMANENT |
3926 JSPROP_SHARED,
3930 }
3934 out:
3939 no_var_name:
3941 JSMSG_NO_VARIABLE_NAME);
3944 }
3946 /*
3947 * This is a greatly pared down version of CheckDestructuring that extends the
3948 * pn_pos.end source coordinate of each name in a destructuring binding such as
3949 *
3950 * var [x, y] = [function () y, 42];
3951 *
3952 * to cover its corresponding initializer, so that the initialized binding does
3953 * not appear to dominate any closures in its initializer. See bug 496134.
3954 *
3955 * The quick-and-dirty dominance computation in Parser::setFunctionKinds is not
3956 * very precise. With one-pass SSA construction from structured source code
3957 * (see "Single-Pass Generation of Static Single Assignment Form for Structured
3958 * Languages", Brandis and Mössenböck), we could do much better.
3959 *
3960 * See CheckDestructuring, immediately above. If you change either of these
3961 * functions, you might have to change the other to match.
3962 */
3963 static JSBool
3965 {
3966 FindPropValData fpvd;
3972 #if JS_HAS_DESTRUCTURING_SHORTHAND
3975 JSMSG_BAD_OBJECT_INIT);
3977 }
3978 #endif
3989 /* Nullary comma is an elision; binary comma is an expression.*/
3996 }
3997 }
4001 }
4018 }
4021 }
4022 }
4024 }
4026 JSParseNode *
4028 {
4039 }
4041 /*
4042 * Currently used only #if JS_HAS_DESTRUCTURING, in Statement's TOK_FOR case.
4043 * This function assumes the cloned tree is for use in the same statement and
4044 * binding context as the original tree.
4045 */
4048 {
4063 #define NULLCHECK(e) JS_BEGIN_MACRO if (!(e)) return NULL; JS_END_MACRO
4079 }
4093 else
4106 // PN_NAME could mean several arms in pn_u, so copy the whole thing.
4109 /*
4110 * The old name is a use of its pn_lexdef. Make the clone also be a
4111 * use of that definition.
4112 */
4120 /*
4121 * If the old name is a definition, the new one has pn_defn set.
4122 * Make the old name a use of the new node.
4123 */
4127 }
4128 }
4137 // Even PN_NULLARY may have data (apair for E4X -- what a botch).
4141 #undef NULLCHECK
4142 }
4144 }
4152 {
4165 }
4176 /*
4177 * Limit recursion if pn is a binary expression, which can't contain a
4178 * var statement.
4179 */
4195 }
4197 }
4199 JSParseNode *
4201 {
4210 }
4216 #if JS_HAS_GENERATORS
4219 #endif
4221 /* This is ugly, but we don't want to require a semicolon. */
4227 #if JS_HAS_GENERATORS
4231 #endif
4232 ) {
4236 #if JS_HAS_GENERATORS
4238 #endif
4243 #if JS_HAS_GENERATORS
4245 #endif
4247 }
4250 /* As in Python (see PEP-255), disallow return v; in generators. */
4252 JSMSG_BAD_GENERATOR_RETURN,
4253 JSMSG_BAD_ANON_GENERATOR_RETURN);
4255 }
4260 JSMSG_NO_RETURN_VALUE,
4261 JSMSG_ANON_NO_RETURN_VALUE)) {
4263 }
4266 }
4271 {
4298 }
4300 #if JS_HAS_BLOCK_SCOPE
4302 JSParseNode *
4304 {
4306 JSStmtInfo stmtInfo;
4310 /* Create the let binary node. */
4317 /* This is a let block or expression of the form: let (a, b, c) .... */
4332 /*
4333 * If this is really an expression in let statement guise, then we
4334 * need to wrap the TOK_LET node in a TOK_SEMI node so that we pop
4335 * the return value of the expression.
4336 */
4345 }
4353 /*
4354 * Change pnblock's opcode to the variant that propagates the last
4355 * result down after popping the block, and clear statement.
4356 */
4361 }
4365 }
4369 static bool
4371 {
4374 }
4378 {
4390 }
4391 }
4396 /*
4397 * A let binding at top level becomes a var before we get here, so if
4398 * pn and tc have the same blockid then that id must not be the bodyid.
4399 * If pn is a forward placeholder definition from the same or a higher
4400 * block then we claim it.
4401 */
4411 }
4412 }
4414 /* Make a new node for this declarator name (or destructuring pattern). */
4419 }
4421 #if JS_HAS_BLOCK_SCOPE
4422 static bool
4424 {
4468 }
4469 }
4470 }
4481 }
4483 }
4484 }
4490 }
4493 }
4496 JSParseNode *
4498 {
4499 TokenKind tt;
4510 #if JS_HAS_XML_SUPPORT
4514 #endif
4518 /* An IF node has three kids: condition, then, and optional else. */
4538 }
4546 {
4555 /* pn1 points to the switch's discriminant. */
4563 /*
4564 * NB: we must push stmtInfo before calling GenerateBlockIdForStmtNode
4565 * because that function states tc->topStmt->blockid.
4566 */
4569 /* pn2 is a list of case nodes. The default case has pn_left == NULL */
4584 JSMSG_TOO_MANY_DEFAULTS);
4586 }
4588 /* FALL THROUGH */
4598 }
4602 JSMSG_TOO_MANY_CASES);
4604 }
4612 JSMSG_BAD_SWITCH);
4614 }
4631 }
4633 /* Fix the PN_LIST so it doesn't begin at the TOK_COLON. */
4638 }
4640 /*
4641 * Handle the case where there was a let declaration in any case in
4642 * the switch body, but not within an inner block. If it replaced
4643 * tc->blockNode with a new block node then we must refresh pn2 and
4644 * then restore tc->blockNode.
4645 */
4655 }
4691 /*
4692 * All legacy and extended versions must do automatic semicolon
4693 * insertion after do-while. See the testcase and discussion in
4694 * http://bugzilla.mozilla.org/show_bug.cgi?id=238945.
4695 */
4698 }
4702 {
4704 #if JS_HAS_BLOCK_SCOPE
4706 JSStmtInfo blockInfo;
4707 #endif
4709 /* A FOR node is binary, left is loop control and right is the body. */
4720 else
4722 }
4727 #if JS_HAS_BLOCK_SCOPE
4729 #endif
4735 /* No initializer -- set first kid of left sub-node to null. */
4738 /*
4739 * Set pn1 to a var list or an initializing expression.
4740 *
4741 * Set the TCF_IN_FOR_INIT flag during parsing of the first clause
4742 * of the for statement. This flag will be used by the RelExpr
4743 * production; if it is set, then the 'in' keyword will not be
4744 * recognized as an operator, leaving it available to be parsed as
4745 * part of a for/in loop.
4746 *
4747 * A side effect of this restriction is that (unparenthesized)
4748 * expressions involving an 'in' operator are illegal in the init
4749 * clause of an ordinary for loop.
4750 */
4755 #if JS_HAS_BLOCK_SCOPE
4768 }
4769 #endif
4772 }
4776 }
4778 /*
4779 * We can be sure that it's a for/in loop if there's still an 'in'
4780 * keyword here, even if JavaScript recognizes 'in' as an operator,
4781 * as we've excluded 'in' from being parsed in RelExpr by setting
4782 * the TCF_IN_FOR_INIT flag in our JSTreeContext.
4783 */
4788 /* Check that the left side of the 'in' is valid. */
4792 #if JS_HAS_DESTRUCTURING
4802 #endif
4803 )
4806 #if JS_HAS_DESTRUCTURING
4812 #endif
4814 #if JS_HAS_XML_SUPPORT
4817 #endif
4820 JSMSG_BAD_FOR_LEFTSIDE);
4822 }
4824 /* pn2 points to the name or destructuring pattern on in's left. */
4829 /* Tell js_EmitTree(TOK_VAR) that pn1 is part of a for/in. */
4832 /*
4833 * Rewrite 'for (<decl> x = i in o)' where <decl> is 'let',
4834 * 'var', or 'const' to hoist the initializer or the entire
4835 * decl out of the loop head. TOK_VAR is the type for both
4836 * 'var' and 'const'.
4837 */
4840 #if JS_HAS_DESTRUCTURING
4842 #endif
4843 ) {
4850 #if JS_HAS_BLOCK_SCOPE
4852 /*
4853 * Hoist just the 'i' from 'for (let x = i in o)' to
4854 * before the loop, glued together via pnseq.
4855 */
4861 #if JS_HAS_DESTRUCTURING
4866 #endif
4867 {
4870 }
4878 {
4881 /*
4882 * All of 'var x = i' is hoisted above 'for (x in o)',
4883 * so clear PNX_FORINVAR.
4884 *
4885 * Request JSOP_POP here since the var is for a simple
4886 * name (it is not a destructuring binding's left-hand
4887 * side) and it has an initializer.
4888 */
4893 #if JS_HAS_DESTRUCTURING
4899 #endif
4900 {
4910 }
4912 }
4913 }
4914 }
4921 }
4922 #if JS_HAS_XML_SUPPORT
4925 #endif
4926 }
4930 /* Beware 'for (arguments in ...)' with or without a 'var'. */
4934 #if JS_HAS_DESTRUCTURING
4938 /* FALL THROUGH */
4941 /* Check for valid lvalues in var-less destructuring for-in. */
4946 /*
4947 * Destructuring for-in requires [key, value] enumeration
4948 * in JS1.7.
4949 */
4953 }
4955 #endif
4958 }
4960 /*
4961 * Parse the object expression as the right operand of 'in', first
4962 * removing the top statement from the statement-stack if this is a
4963 * 'for (let x in y)' loop.
4964 */
4965 #if JS_HAS_BLOCK_SCOPE
4969 #endif
4971 #if JS_HAS_BLOCK_SCOPE
4974 #endif
4985 /* Parse the loop condition or null into pn2. */
4994 }
4996 /* Parse the update expression or null into pn3. */
5005 }
5007 /* Build the FORHEAD node to use as the left kid of pn. */
5017 }
5021 /* Parse the loop body into pn->pn_right. */
5027 /* Record the absolute line number for source note emission. */
5030 #if JS_HAS_BLOCK_SCOPE
5035 }
5036 #endif
5041 }
5045 bad_for_each:
5047 JSMSG_BAD_FOR_EACH_LOOP);
5049 }
5054 /*
5055 * try nodes are ternary.
5056 * kid1 is the try statement
5057 * kid2 is the catch node list or null
5058 * kid3 is the finally statement
5059 *
5060 * catch nodes are ternary.
5061 * kid1 is the lvalue (TOK_NAME, TOK_LB, or TOK_LC)
5062 * kid2 is the catch guard or null if no guard
5063 * kid3 is the catch block
5064 *
5065 * catch lvalue nodes are either:
5066 * TOK_NAME for a single identifier
5067 * TOK_RB or TOK_RC for a destructuring left-hand side
5068 *
5069 * finally nodes are TOK_LC statement lists.
5070 */
5097 BindData data;
5099 /* Check for another catch after unconditional catch. */
5102 JSMSG_CATCH_AFTER_GENERAL);
5104 }
5106 /*
5107 * Create a lexical scope node around the whole catch clause,
5108 * including the head.
5109 */
5115 /*
5116 * Legal catch forms are:
5117 * catch (lhs)
5118 * catch (lhs if <boolean_expression>)
5119 * where lhs is a name or a destructuring left-hand side.
5120 * (the latter is legal only #ifdef JS_HAS_CATCH_GUARD)
5121 */
5128 /*
5129 * Contrary to ECMA Ed. 3, the catch variable is lexically
5130 * scoped, not a property of a new Object instance. This is
5131 * an intentional change that anticipates ECMA Ed. 4.
5132 */
5140 #if JS_HAS_DESTRUCTURING
5147 #endif
5161 JSMSG_CATCH_IDENTIFIER);
5163 }
5166 #if JS_HAS_CATCH_GUARD
5167 /*
5168 * We use 'catch (x if x === 5)' (not 'catch (x : x === 5)')
5169 * to avoid conflicting with the JS2/ECMAv4 type annotation
5170 * catchguard syntax.
5171 */
5176 }
5177 #endif
5191 }
5205 }
5208 JSMSG_CATCH_OR_FINALLY);
5210 }
5212 }
5219 /* ECMA-262 Edition 3 says 'throw [no LineTerminator here] Expr'. */
5225 JSMSG_SYNTAX_ERROR);
5227 }
5237 /* TOK_CATCH and TOK_FINALLY are both handled in the TOK_TRY case */
5240 JSMSG_CATCH_WITHOUT_TRY);
5245 JSMSG_FINALLY_WITHOUT_TRY);
5260 JSMSG_LABEL_NOT_FOUND);
5262 }
5265 }
5270 JSMSG_TOUGH_BREAK);
5272 }
5275 }
5276 }
5293 JSMSG_LABEL_NOT_FOUND);
5295 }
5300 JSMSG_BAD_CONTINUE);
5302 }
5304 }
5307 }
5308 }
5313 JSMSG_BAD_CONTINUE);
5315 }
5318 }
5319 }
5325 /*
5326 * In most cases, we want the constructs forbidden in strict mode
5327 * code to be a subset of those that JSOPTION_STRICT warns about, and
5328 * we should use ReportStrictModeError. However, 'with' is the sole
5329 * instance of a construct that is forbidden in strict mode code, but
5330 * doesn't even merit a warning under JSOPTION_STRICT. See
5331 * https://bugzilla.mozilla.org/show_bug.cgi?id=514576#c1.
5332 */
5335 JSMSG_STRICT_CODE_WITH);
5337 }
5365 /* Tell js_EmitTree to generate a final POP. */
5369 #if JS_HAS_BLOCK_SCOPE
5371 {
5375 /* Check for a let statement or let expression. */
5381 /* Let expressions require automatic semicolon insertion. */
5385 }
5387 /*
5388 * This is a let declaration. We must be directly under a block per
5389 * the proposed ES4 specs, but not an implicit block created due to
5390 * 'for (let ...)'. If we pass this error test, make the enclosing
5391 * JSStmtInfo be our scope. Further let declarations in this block
5392 * will find this scope statement and use the same block object.
5393 *
5394 * If we are the first let declaration in this block (i.e., when the
5395 * enclosing maybe-scope JSStmtInfo isn't yet a scope statement) then
5396 * we also need to set tc->blockNode to be our TOK_LEXICALSCOPE.
5397 */
5402 JSMSG_LET_DECL_NOT_IN_BLOCK);
5404 }
5411 /*
5412 * ES4 specifies that let at top level and at body-block scope
5413 * does not shadow var, so convert back to var.
5414 */
5422 }
5424 /*
5425 * Some obvious assertions here, but they may help clarify the
5426 * situation. This stmt is not yet a scope, so it must not be a
5427 * catch block (catch is a lexical scope by definition).
5428 */
5437 /* Convert the block statement into a scope statement. */
5446 /*
5447 * Insert stmt on the tc->topScopeStmt/stmtInfo.downScope linked
5448 * list stack, if it isn't already there. If it is there, but it
5449 * lacks the SIF_SCOPE flag, it must be a try, catch, or finally
5450 * block.
5451 */
5462 #ifdef DEBUG
5465 #endif
5467 /* Create a new lexical scope node for these statements. */
5479 }
5486 }
5496 {
5497 uintN oldflags;
5510 /*
5511 * If we contain a function statement and our container is top-level
5512 * or another block, flag pn to preserve braces when decompiling.
5513 */
5517 }
5520 }
5530 #if JS_HAS_DEBUGGER_KEYWORD
5540 #if JS_HAS_XML_SUPPORT
5552 JSMSG_BAD_DEFAULT_XML_NAMESPACE);
5554 }
5556 /* Is this an E4X dagger I see before me? */
5565 #endif
5571 #if JS_HAS_XML_SUPPORT
5572 expression:
5573 #endif
5582 JSMSG_BAD_LABEL);
5584 }
5589 JSMSG_DUPLICATE_LABEL);
5591 }
5592 }
5597 /* Push a label struct and parse the statement. */
5604 /* Normalize empty statement to empty block for the decompiler. */
5609 }
5611 /* Pop the label, set pn_expr, and return early. */
5617 }
5628 /*
5629 * Flag lambdas immediately applied as statements as instances of
5630 * the JS "module pattern". See CheckForImmediatelyAppliedLambda.
5631 */
5635 }
5638 /*
5639 * Keep track of all apparent methods created by assignments such
5640 * as this.foo = function (...) {...} in a function that could end
5641 * up a constructor function. See Parser::setFunctionKinds.
5642 */
5652 }
5655 }
5657 }
5659 /* Check termination of this primitive statement. */
5661 }
5663 static void
5665 {
5670 }
5672 JSParseNode *
5674 {
5675 TokenKind tt;
5678 BindData data;
5682 /*
5683 * The three options here are:
5684 * - TOK_LET: We are parsing a let declaration.
5685 * - TOK_LP: We are parsing the head of a let block.
5686 * - Otherwise, we're parsing var declarations.
5687 */
5692 #if JS_HAS_BLOCK_SCOPE
5695 #endif
5697 /* Make sure that statement set up the tree context correctly. */
5703 }
5705 }
5714 /*
5715 * SpiderMonkey const is really "write once per initialization evaluation"
5716 * var, whereas let is block scoped. ES-Harmony wants block-scoped const so
5717 * this code will change soon.
5718 */
5725 }
5729 #if JS_HAS_DESTRUCTURING
5743 }
5749 #if JS_HAS_BLOCK_SCOPE
5753 }
5754 #endif
5756 #if JS_HAS_BLOCK_SCOPE
5760 }
5761 #endif
5771 }
5777 JSMSG_NO_VARIABLE_NAME);
5778 }
5780 }
5797 #if JS_HAS_BLOCK_SCOPE
5801 }
5802 #endif
5804 #if JS_HAS_BLOCK_SCOPE
5808 }
5809 #endif
5819 }
5822 ? JSOP_SETNAME
5824 ? JSOP_SETGVAR
5826 ? JSOP_SETLOCAL
5828 ? JSOP_SETCONST
5833 /* The declarator's position must include the initializer. */
5841 }
5842 }
5848 bad_var_init:
5850 JSMSG_BAD_VAR_INIT);
5852 }
5854 JSParseNode *
5856 {
5868 #if JS_HAS_GENERATORS
5872 JSMSG_BAD_GENERATOR_SYNTAX,
5873 js_yield_str);
5875 }
5876 #endif
5883 }
5885 }
5887 JSParseNode *
5889 {
5891 TokenKind tt;
5892 JSOp op;
5896 #if JS_HAS_GENERATORS
5899 #endif
5909 }
5925 #if JS_HAS_DESTRUCTURING
5930 JSMSG_BAD_DESTRUCT_ASS);
5932 }
5937 #endif
5942 #if JS_HAS_XML_SUPPORT
5947 }
5948 /* FALL THROUGH */
5949 #endif
5952 JSMSG_BAD_LEFTSIDE_OF_ASS);
5954 }
5960 /*
5961 * If the definition is not flagged as assigned, we must have imputed
5962 * the initialized flag to it, to optimize for flat closures. But that
5963 * optimization uses source coordinates to check dominance relations,
5964 * so we must extend the end of the definition to cover the right-hand
5965 * side of this assignment, i.e., the initializer.
5966 */
5970 }
5971 }
5974 }
5976 JSParseNode *
5978 {
5980 uintN oldflags;
5989 /*
5990 * Always accept the 'in' operator in the middle clause of a ternary,
5991 * where it's unambiguous, even if we might be parsing the init of a
5992 * for statement.
5993 */
6010 }
6012 }
6014 JSParseNode *
6016 {
6023 }
6025 JSParseNode *
6027 {
6034 }
6036 JSParseNode *
6038 {
6044 }
6046 }
6048 JSParseNode *
6050 {
6056 }
6058 }
6060 JSParseNode *
6062 {
6069 }
6071 JSParseNode *
6073 {
6075 JSOp op;
6081 }
6083 }
6085 JSParseNode *
6087 {
6089 TokenKind tt;
6090 JSOp op;
6093 /*
6094 * Uses of the in operator in shiftExprs are always unambiguous,
6095 * so unset the flag that prohibits recognizing it.
6096 */
6102 /*
6103 * Recognize the 'in' token as an operator only if we're not
6104 * currently in the init expr of a for loop.
6105 */
6111 }
6112 /* Restore previous state of inForInit flag. */
6116 }
6118 JSParseNode *
6120 {
6122 JSOp op;
6128 }
6130 }
6132 JSParseNode *
6134 {
6136 TokenKind tt;
6137 JSOp op;
6146 }
6148 }
6150 JSParseNode *
6152 {
6154 TokenKind tt;
6155 JSOp op;
6164 }
6166 }
6171 {
6176 #if JS_HAS_XML_SUPPORT
6178 #endif
6182 }
6187 }
6191 static JSBool
6195 {
6196 JSOp op;
6218 /* FALL THROUGH */
6219 #if JS_HAS_XML_SUPPORT
6223 /* FALL THROUGH */
6224 #endif
6234 }
6237 }
6239 JSParseNode *
6241 {
6277 {
6286 /*
6287 * Under ECMA3, deleting any unary expression is valid -- it simply
6288 * returns true. Here we fold constants before checking for a call
6289 * expression, in order to rule out delete of a generator expression.
6290 */
6298 }
6302 JSMSG_DEPRECATED_DELETE_OPERAND))
6309 }
6312 }
6322 /* Don't look across a newline boundary for a postfix incop. */
6334 }
6335 }
6337 }
6339 }
6341 #if JS_HAS_GENERATORS
6343 /*
6344 * A dedicated helper for transplanting the comprehension expression E in
6345 *
6346 * [E for (V in I)] // array comprehension
6347 * (E for (V in I)) // generator expression
6348 *
6349 * from its initial location in the AST, on the left of the 'for', to its final
6350 * position on the right. To avoid a separate pass we do this by adjusting the
6351 * blockids and name binding links that were established when E was parsed.
6352 *
6353 * A generator expression desugars like so:
6354 *
6355 * (E for (V in I)) => (function () { for (var V in I) yield E; })()
6356 *
6357 * so the transplanter must adjust static level as well as blockid. E's source
6358 * coordinates in root->pn_pos are critical to deciding which binding links to
6359 * preserve and which to cut.
6360 *
6361 * NB: This is not a general tree transplanter -- it knows in particular that
6362 * the one or more bindings induced by V have not yet been created.
6363 */
6368 uintN adjust;
6369 uintN funcLevel;
6374 {
6375 }
6378 };
6380 /*
6381 * Any definitions nested within the comprehension expression of a generator
6382 * expression must move "down" one static level, which of course increases the
6383 * upvar-frame-skip count.
6384 */
6385 static bool
6387 {
6396 }
6399 }
6401 }
6403 static void
6405 {
6410 }
6412 bool
6414 {
6435 /* Binary TOK_COLON nodes can have left == right. See bug 492714. */
6445 {
6446 /*
6447 * Only the first level of transplant recursion through functions needs
6448 * to reparent the funbox, since all descendant functions are correctly
6449 * linked under the top-most funbox. But every visit to this case needs
6450 * to update funbox->level.
6451 *
6452 * Recall that funbox->level is the static level of the code containing
6453 * the definition or expression of the function and not the static level
6454 * of the function's body.
6455 */
6471 }
6472 /* FALL THROUGH */
6473 }
6490 /*
6491 * Adjust the definition's block id only if it is a placeholder not
6492 * to the left of the root node, and if pn is the last use visited
6493 * in the comprehension expression (to avoid adjusting the blockid
6494 * multiple times).
6495 *
6496 * Non-placeholder definitions within the comprehension expression
6497 * will be visited further below.
6498 */
6503 }
6506 #ifdef DEBUG
6509 #endif
6536 }
6542 }
6545 }
6546 }
6547 }
6556 }
6558 }
6560 /*
6561 * Starting from a |for| keyword after the first array initialiser element or
6562 * an expression in an open parenthesis, parse the tail of the comprehension
6563 * or generator expression signified by this |for| keyword in context.
6564 *
6565 * Return null on failure, else return the top-most parse node for the array
6566 * comprehension or generator expression, with a unary node as the body of the
6567 * (possibly nested) for-loop, initialized by |type, op, kid|.
6568 */
6569 JSParseNode *
6572 {
6573 uintN adjust;
6575 JSStmtInfo stmtInfo;
6576 BindData data;
6577 TokenKind tt;
6583 /*
6584 * Generator expression desugars to an immediately applied lambda that
6585 * yields the next value from a for-in loop (possibly nested, and with
6586 * optional if guard). Make pn be the TOK_LC body node.
6587 */
6595 /*
6596 * Make a parse-node and literal object representing the block scope of
6597 * this array comprehension. Our caller in primaryExpr, the TOK_LB case
6598 * aka the array initialiser case, has passed the blockid to claim for
6599 * the comprehension's block scope. We allocate that id or one above it
6600 * here, by calling js_PushLexicalScope.
6601 *
6602 * In the case of a comprehension expression that has nested blocks
6603 * (e.g., let expressions), we will allocate a higher blockid but then
6604 * slide all blocks "to the right" to make room for the comprehension's
6605 * block scope.
6606 */
6618 }
6631 /*
6632 * FOR node is binary, left is loop control and right is body. Use
6633 * index to count each block-local let-variable on the left-hand side
6634 * of the IN.
6635 */
6645 else
6647 }
6653 #if JS_HAS_DESTRUCTURING
6662 #endif
6667 /*
6668 * Create a name node with pn_op JSOP_NAME. We can't set pn_op to
6669 * JSOP_GETLOCAL here, because we don't yet know the block's depth
6670 * in the operand stack frame. The code generator computes that,
6671 * and it tries to bind all names to slots, so we must let it do
6672 * the deed.
6673 */
6681 JSMSG_NO_VARIABLE_NAME);
6685 }
6694 #if JS_HAS_DESTRUCTURING
6701 /* Destructuring requires [key, value] enumeration in JS1.7. */
6704 JSMSG_BAD_FOR_LEFTSIDE);
6706 }
6712 }
6714 #endif
6723 }
6741 }
6753 }
6755 #if JS_HAS_GENERATOR_EXPRS
6757 /*
6758 * Starting from a |for| keyword after an expression, parse the comprehension
6759 * tail completing this generator expression. Wrap the expression at kid in a
6760 * generator function that is immediately called to evaluate to the generator
6761 * iterator that is the value of this generator expression.
6762 *
6763 * Callers pass a blank unary node via pn, which generatorExpr fills in as the
6764 * yield expression, which ComprehensionTail in turn wraps in a TOK_SEMI-type
6765 * expression-statement node that constitutes the body of the |for| loop(s) in
6766 * the generator function.
6767 *
6768 * Note how unlike Python, we do not evaluate the expression to the right of
6769 * the first |in| in the chain of |for| heads. Instead, a generator expression
6770 * is merely sugar for a generator function expression and its application.
6771 */
6772 JSParseNode *
6774 {
6775 /* Initialize pn, connecting it to kid. */
6784 /* Make a new node for the desugared generator function. */
6793 {
6801 /*
6802 * We have to dance around a bit to propagate sharp variables from
6803 * outertc to gentc before setting TCF_HAS_SHARPS implicitly by
6804 * propagating all of outertc's TCF_FUN_FLAGS flags. As below, we have
6805 * to be conservative by leaving TCF_HAS_SHARPS set in outertc if we
6806 * do propagate to gentc.
6807 */
6812 }
6814 /*
6815 * We assume conservatively that any deoptimization flag in tc->flags
6816 * besides TCF_FUN_PARAM_ARGUMENTS can come from the kid. So we
6817 * propagate these flags into genfn. For code simplicity we also do
6818 * not detect if the flags were only set in the kid and could be
6819 * removed from tc->flags.
6820 */
6837 }
6839 /*
6840 * Our result is a call expression that invokes the anonymous generator
6841 * function object.
6842 */
6851 }
6858 JSBool
6860 {
6868 #if JS_HAS_GENERATORS
6873 JSMSG_BAD_GENERATOR_SYNTAX,
6874 js_yield_str);
6876 }
6877 #endif
6878 #if JS_HAS_GENERATOR_EXPRS
6889 JSMSG_BAD_GENERATOR_SYNTAX,
6890 js_generator_str);
6892 }
6893 }
6894 #endif
6900 JSMSG_PAREN_AFTER_ARGS);
6902 }
6904 }
6906 /* Check for an immediately-applied (new'ed) lambda and clear PND_FUNARG. */
6909 {
6917 }
6919 }
6921 JSParseNode *
6923 {
6928 /* Check for new expression first. */
6946 JSMSG_TOO_MANY_CON_ARGS);
6948 }
6968 }
6969 }
6976 #if JS_HAS_XML_SUPPORT
6982 /* Check both tt and pn_type, to distinguish |x.(y)| and |x.y::z| from |x.y|. */
6993 /* A filtering predicate is like a with statement. */
7000 JSMSG_NAME_AFTER_DOT);
7002 }
7006 }
7007 #else
7012 #endif
7015 #if JS_HAS_XML_SUPPORT
7031 JSMSG_NAME_AFTER_DOT);
7033 }
7039 #endif
7052 /*
7053 * Optimize o['p'] to o.p by rewriting pn2, but avoid rewriting
7054 * o['0'] to use JSOP_GETPROP, to keep fast indexing disjoint in
7055 * the interpreter from fast property access. However, if the
7056 * bracketed string is a uint32, we rewrite pn3 to be a number
7057 * instead of a string.
7058 */
7061 jsuint index;
7070 }
7074 }
7088 /* Select JSOP_EVAL and flag tc as heavyweight. */
7091 }
7095 /* Select JSOP_APPLY given foo.apply(...). */
7097 }
7098 }
7107 JSMSG_TOO_MANY_FUN_ARGS);
7109 }
7114 }
7117 }
7121 }
7123 JSParseNode *
7125 {
7126 uintN oldflags;
7129 /*
7130 * Always accept the 'in' operator in a parenthesized expression,
7131 * where it's unambiguous, even if we might be parsing the init of a
7132 * for statement.
7133 */
7139 }
7141 #if JS_HAS_XML_SUPPORT
7143 JSParseNode *
7145 {
7154 }
7156 /*
7157 * From the ECMA-357 grammar in 11.1.1 and 11.1.2:
7158 *
7159 * AttributeIdentifier:
7160 * @ PropertySelector
7161 * @ QualifiedIdentifier
7162 * @ [ Expression ]
7163 *
7164 * PropertySelector:
7165 * Identifier
7166 * *
7167 *
7168 * QualifiedIdentifier:
7169 * PropertySelector :: PropertySelector
7170 * PropertySelector :: [ Expression ]
7171 *
7172 * We adapt AttributeIdentifier and QualifiedIdentier to be LL(1), like so:
7173 *
7174 * AttributeIdentifier:
7175 * @ QualifiedIdentifier
7176 * @ [ Expression ]
7177 *
7178 * PropertySelector:
7179 * Identifier
7180 * *
7181 *
7182 * QualifiedIdentifier:
7183 * PropertySelector :: PropertySelector
7184 * PropertySelector :: [ Expression ]
7185 * PropertySelector
7186 *
7187 * As PrimaryExpression: Identifier is in ECMA-262 and we want the semantics
7188 * for that rule to result in a name node, but ECMA-357 extends the grammar
7189 * to include PrimaryExpression: QualifiedIdentifier, we must factor further:
7190 *
7191 * QualifiedIdentifier:
7192 * PropertySelector QualifiedSuffix
7193 *
7194 * QualifiedSuffix:
7195 * :: PropertySelector
7196 * :: [ Expression ]
7197 * /nothing/
7198 *
7199 * And use this production instead of PrimaryExpression: QualifiedIdentifier:
7200 *
7201 * PrimaryExpression:
7202 * Identifier QualifiedSuffix
7203 *
7204 * We hoist the :: match into callers of QualifiedSuffix, in order to tweak
7205 * PropertySelector vs. Identifier pn_arity, pn_op, and other members.
7206 */
7207 JSParseNode *
7209 {
7225 }
7227 }
7229 JSParseNode *
7231 {
7233 TokenKind tt;
7240 /* Left operand of :: must be evaluated if it is an identifier. */
7246 /* Inline and specialize propertySelector for JSOP_QNAMECONST. */
7255 }
7259 JSMSG_SYNTAX_ERROR);
7261 }
7273 }
7275 JSParseNode *
7277 {
7284 /* Hack for bug 496316. Slowing down E4X won't make it go away, alas. */
7287 }
7289 }
7291 JSParseNode *
7293 {
7295 TokenKind tt;
7309 JSMSG_SYNTAX_ERROR);
7311 }
7316 }
7318 /*
7319 * Make a TOK_LC unary node whose pn_kid is an expression.
7320 */
7321 JSParseNode *
7323 {
7331 /*
7332 * Turn off XML tag mode. We save the old value of the flag because it may
7333 * already be off: XMLExpr is called both from within a tag, and from
7334 * within text contained in an element, but outside of any start, end, or
7335 * point tag.
7336 */
7348 }
7350 /*
7351 * Make a terminal node for one of TOK_XMLNAME, TOK_XMLATTR, TOK_XMLSPACE,
7352 * TOK_XMLTEXT, TOK_XMLCDATA, TOK_XMLCOMMENT, or TOK_XMLPI. When converting
7353 * parse tree to XML, we preserve a TOK_XMLSPACE node only if it's the sole
7354 * child of a container tag.
7355 */
7356 JSParseNode *
7358 {
7368 }
7370 /*
7371 * Parse the productions:
7372 *
7373 * XMLNameExpr:
7374 * XMLName XMLNameExpr?
7375 * { Expr } XMLNameExpr?
7376 *
7377 * Return a PN_LIST, PN_UNARY, or PN_NULLARY according as XMLNameExpr produces
7378 * a list of names and/or expressions, a single expression, or a single name.
7379 * If PN_LIST or PN_NULLARY, pn_type will be TOK_XMLNAME; if PN_UNARY, pn_type
7380 * will be TOK_LC.
7381 */
7382 JSParseNode *
7384 {
7386 TokenKind tt;
7400 }
7414 }
7417 }
7422 }
7424 /*
7425 * Macro to test whether an XMLNameExpr or XMLTagContent node can be folded
7426 * at compile time into a JSXML tree.
7427 */
7428 #define XML_FOLDABLE(pn) ((pn)->pn_arity == PN_LIST \
7429 ? ((pn)->pn_xflags & PNX_CANTFOLD) == 0 \
7430 : (pn)->pn_type != TOK_LC)
7432 /*
7433 * Parse the productions:
7434 *
7435 * XMLTagContent:
7436 * XMLNameExpr
7437 * XMLTagContent S XMLNameExpr S? = S? XMLAttr
7438 * XMLTagContent S XMLNameExpr S? = S? { Expr }
7439 *
7440 * Return a PN_LIST, PN_UNARY, or PN_NULLARY according to how XMLTagContent
7441 * produces a list of name and attribute values and/or braced expressions, a
7442 * single expression, or a single name.
7443 *
7444 * If PN_LIST or PN_NULLARY, pn_type will be TOK_XMLNAME for the case where
7445 * XMLTagContent: XMLNameExpr. If pn_type is not TOK_XMLNAME but pn_arity is
7446 * PN_LIST, pn_type will be tagtype. If PN_UNARY, pn_type will be TOK_LC and
7447 * we parsed exactly one expression.
7448 */
7449 JSParseNode *
7451 {
7453 TokenKind tt;
7466 }
7479 }
7496 JSMSG_BAD_XML_ATTR_VALUE);
7498 }
7503 }
7506 }
7508 #define XML_CHECK_FOR_ERROR_AND_EOF(tt,result) \
7509 JS_BEGIN_MACRO \
7510 if ((tt) <= TOK_EOF) { \
7511 if ((tt) == TOK_EOF) { \
7512 ReportCompileErrorNumber(context, &tokenStream, NULL, JSREPORT_ERROR, \
7513 JSMSG_END_OF_XML_SOURCE); \
7514 } \
7515 return result; \
7516 } \
7517 JS_END_MACRO
7519 /*
7520 * Consume XML element tag content, including the TOK_XMLETAGO (</) sequence
7521 * that opens the end tag for the container.
7522 */
7523 JSBool
7525 {
7534 /* Non-zero-length XML text scanned. */
7540 }
7556 }
7561 }
7566 }
7571 }
7573 /*
7574 * Return a PN_LIST node containing an XML or XMLList Initialiser.
7575 */
7576 JSParseNode *
7578 {
7580 TokenKind tt;
7596 /*
7597 * XMLElement. Append the tag and its contents, if any, to pn.
7598 */
7606 /* Point tag (/>): recycle pn if pn2 is a list of tag contents. */
7617 }
7621 /* We had better have a tag-close (>) at this point. */
7624 JSMSG_BAD_XML_TAG_SYNTAX);
7626 }
7629 /* Make sure pn2 is a TOK_XMLSTAGO list containing tag contents. */
7638 }
7640 /* Now make pn a nominal-root TOK_XMLELEM list containing pn2. */
7648 /* Get element contents and delimiting end-tag-open sequence. */
7656 JSMSG_BAD_XML_TAG_SYNTAX);
7658 }
7660 /* Parse end tag; check mismatch at compile-time if we can. */
7665 /* Oops, end tag has attributes! */
7667 JSMSG_BAD_XML_TAG_SYNTAX);
7669 }
7673 /* End vs. start tag name mismatch: point to the tag name. */
7677 }
7679 /* Make a TOK_XMLETAGO list with pn2 as its single child. */
7690 }
7694 }
7696 /* Set pn_op now that pn has been updated to its final value. */
7699 /* XMLList Initialiser. */
7710 JSMSG_BAD_XML_NAME_SYNTAX);
7712 }
7717 }
7719 JSParseNode *
7721 {
7722 uint32 oldopts;
7725 /*
7726 * Force XML support to be enabled so that comments and CDATA literals
7727 * are recognized, instead of <! followed by -- starting an HTML comment
7728 * to end of line (used in script tags to hide content from old browsers
7729 * that don't recognize <script>).
7730 */
7735 }
7737 JSParseNode *
7739 {
7740 /*
7741 * Push a compiler frame if we have no frames, or if the top frame is a
7742 * lightweight function activation, or if its scope chain doesn't match
7743 * the one passed to us.
7744 */
7748 /* Set XML-only mode to turn off special treatment of {expr} in XML. */
7755 JSMSG_BAD_XML_MARKUP);
7759 }
7763 }
7767 #if JS_HAS_BLOCK_SCOPE
7768 /*
7769 * Check whether blockid is an active scoping statement in tc. This code is
7770 * necessary to qualify tc->decls.lookup() hits in primaryExpr's TOK_NAME case
7771 * (below) where the hits come from Scheme-ish let bindings in for loop heads
7772 * and let blocks and expressions (not let declarations).
7773 *
7774 * Unlike let declarations ("let as the new var"), which is a kind of letrec
7775 * due to hoisting, let in a for loop head, let block, or let expression acts
7776 * like Scheme's let: initializers are evaluated without the new let bindings
7777 * being in scope.
7778 *
7779 * Name binding analysis is eager with fixups, rather than multi-pass, and let
7780 * bindings push on the front of the tc->decls JSAtomList (either the singular
7781 * list or on a hash chain -- see JSAtomList::AddHow) in order to shadow outer
7782 * scope bindings of the same name.
7783 *
7784 * This simplifies binding lookup code at the price of a linear search here,
7785 * but only if code uses let (var predominates), and even then this function's
7786 * loop iterates more than once only in crazy cases.
7787 */
7790 {
7796 }
7798 }
7799 #endif
7801 JSParseNode *
7803 {
7805 JSOp op;
7811 #if JS_HAS_XML_SUPPORT
7821 }
7822 #endif
7829 {
7830 JSBool matched;
7831 jsuint index;
7840 #if JS_HAS_GENERATORS
7842 #endif
7849 JSMSG_ARRAY_INIT_TOO_BIG);
7851 }
7857 }
7860 /* So CURRENT_TOKEN gets TOK_COMMA and not TOK_LB. */
7866 }
7872 /* If we didn't already match TOK_COMMA in above case. */
7875 }
7876 }
7878 #if JS_HAS_GENERATORS
7879 /*
7880 * At this point, (index == 0 && pn->pn_count != 0) implies one
7881 * element initialiser was parsed.
7882 *
7883 * An array comprehension of the form:
7884 *
7885 * [i * j for (i in o) for (j in p) if (i != j)]
7886 *
7887 * translates to roughly the following let expression:
7888 *
7889 * let (array = new Array, i, j) {
7890 * for (i in o) let {
7891 * for (j in p)
7892 * if (i != j)
7893 * array.push(i * j)
7894 * }
7895 * array
7896 * }
7897 *
7898 * where array is a nameless block-local variable. The "roughly"
7899 * means that an implementation may optimize away the array.push.
7900 * An array comprehension opens exactly one block scope, no matter
7901 * how many for heads it contains.
7902 *
7903 * Each let () {...} or for (let ...) ... compiles to:
7904 *
7905 * JSOP_ENTERBLOCK <o> ... JSOP_LEAVEBLOCK <n>
7906 *
7907 * where <o> is a literal object representing the block scope,
7908 * with <n> properties, naming each var declared in the block.
7909 *
7910 * Each var declaration in a let-block binds a name in <o> at
7911 * compile time, and allocates a slot on the operand stack at
7912 * runtime via JSOP_ENTERBLOCK. A block-local var is accessed
7913 * by the JSOP_GETLOCAL and JSOP_SETLOCAL ops, and iterated with
7914 * JSOP_FORLOCAL. These ops all have an immediate operand, the
7915 * local slot's stack index from fp->spbase.
7916 *
7917 * The array comprehension iteration step, array.push(i * j) in
7918 * the example above, is done by <i * j>; JSOP_ARRAYCOMP <array>,
7919 * where <array> is the index of array's stack slot.
7920 */
7924 /* Relabel pn as an array comprehension node. */
7927 /*
7928 * Remove the comprehension expression from pn's linked list
7929 * and save it via pnexp. We'll re-install it underneath the
7930 * ARRAYPUSH node after we parse the rest of the comprehension.
7931 */
7944 }
7948 }
7951 }
7954 {
7955 JSBool afterComma;
7958 /*
7959 * A map from property names we've seen thus far to bit masks.
7960 * (We use ALE_INDEX/ALE_SET_INDEX). An atom's mask includes
7961 * JSPROP_SETTER if we've seen a setter for it, JSPROP_GETTER
7962 * if we've seen as getter, and both of those if we've just
7963 * seen an ordinary value.
7964 */
7990 }
7993 {
7999 else
8019 }
8023 }
8025 /* We have to fake a 'function' token here. */
8030 }
8031 property_name:
8043 JSMSG_BAD_PROP_ID);
8045 }
8052 #if JS_HAS_DESTRUCTURING_SHORTHAND
8054 #endif
8056 JSMSG_COLON_AFTER_ID);
8058 #if JS_HAS_DESTRUCTURING_SHORTHAND
8059 }
8061 /*
8062 * Support, e.g., |var {x, y} = o| as destructuring shorthand
8063 * for |var {x: x, y: y} = o|, per proposed JS2/ES4 for JS1.8.
8064 */
8071 }
8072 #endif
8073 }
8076 skip:
8081 /*
8082 * In strict mode code, check for duplicate property names. Treat
8083 * getters and setters as distinct attributes of each property. A
8084 * plain old value conflicts with a getter or a setter.
8085 */
8097 }
8099 /*
8100 * Use only string-valued atoms for detecting duplicate
8101 * properties so that 1 and "1" properly collide.
8102 */
8110 }
8120 }
8121 }
8128 }
8129 }
8136 JSMSG_CURLY_AFTER_LIST);
8138 }
8140 }
8142 end_obj_init:
8145 }
8147 #if JS_HAS_BLOCK_SCOPE
8153 #endif
8155 #if JS_HAS_SHARP_VARS
8163 #if JS_HAS_XML_SUPPORT
8166 #endif
8169 JSMSG_BAD_SHARP_VAR_DEF);
8171 }
8180 /* Check for forward/dangling references at runtime, to allow eval. */
8191 {
8192 JSBool genexp;
8201 }
8203 #if JS_HAS_XML_SUPPORT
8224 #if JS_HAS_SHARP_VARS
8225 /* FALL THROUGH */
8226 #endif
8228 #if JS_HAS_XML_SUPPORT
8232 #endif
8237 #if JS_HAS_XML_SUPPORT
8240 else
8241 #endif
8254 /*
8255 * Flag arguments usage so we can avoid unsafe optimizations such
8256 * as formal parameter assignment analysis (because of the hated
8257 * feature whereby arguments alias formals). We do this even for
8258 * a reference of the form foo.arguments, which ancient code may
8259 * still use instead of arguments (more hate).
8260 */
8263 /*
8264 * Bind early to JSOP_ARGUMENTS to relieve later code from having
8265 * to do this work (new rule for the emitter to count on).
8266 */
8270 }
8272 #if JS_HAS_XML_SUPPORT
8274 #endif
8283 #if JS_HAS_BLOCK_SCOPE
8284 /*
8285 * Skip out-of-scope let bindings along an ALE list or hash
8286 * chain. These can happen due to |let (x = x) x| block and
8287 * expression bindings, where the x on the right of = comes
8288 * from an outer scope. See bug 496532.
8289 */
8297 }
8298 #endif
8299 }
8308 /*
8309 * No definition before this use in any lexical scope.
8310 * Add a mapping in tc->lexdeps from pn->pn_atom to a
8311 * new node for the forward-referenced definition. This
8312 * placeholder definition node will be adopted when we
8313 * parse the real defining declaration form, or left as
8314 * a free variable definition if we never see the real
8315 * definition.
8316 */
8322 /*
8323 * In case this is a forward reference to a function,
8324 * we pessimistically set PND_FUNARG if the next token
8325 * is not a left parenthesis.
8326 *
8327 * If the definition eventually parsed into dn is not a
8328 * function, this flag won't hurt, and if we do parse a
8329 * function with pn's name, then the PND_FUNARG flag is
8330 * necessary for safe context->display-based optimiza-
8331 * tion of the closure's static link.
8332 */
8337 }
8338 }
8343 /* Here we handle the backward function reference case. */
8348 }
8349 }
8351 #if JS_HAS_XML_SUPPORT
8356 /*
8357 * Here primaryExpr is called after . or .. followed by a name
8358 * followed by ::. This is the only case where a keyword after
8359 * . or .. is not treated as a property name.
8360 */
8368 JSMSG_KEYWORD_NOT_NS);
8370 }
8371 }
8375 }
8376 #endif
8380 {
8396 }
8404 }
8422 /* The scanner or one of its subroutines reported the error. */
8427 JSMSG_SYNTAX_ERROR);
8429 }
8431 }
8433 JSParseNode *
8435 {
8436 TokenPtr begin;
8448 #if JS_HAS_GENERATOR_EXPRS
8454 }
8459 }
8464 }
8474 }
8477 }
8478 }
8482 }
8484 /*
8485 * Fold from one constant type to another.
8486 * XXX handles only strings and numbers for now
8487 */
8488 static JSBool
8490 {
8495 jsdouble d;
8501 }
8514 }
8518 }
8519 }
8521 }
8523 /*
8524 * Fold two numeric constants. Beware that pn1 and pn2 are recycled, unless
8525 * one of them aliases pn, so you can't safely fetch pn2->pn_next, e.g., after
8526 * a successful call to this function.
8527 */
8528 static JSBool
8531 {
8567 #if defined(XP_WIN)
8568 /* XXX MSVC miscompiles such that (NaN == 0) */
8571 else
8572 #endif
8577 else
8581 }
8589 }
8593 }
8595 /* Take care to allow pn1 or pn2 to alias pn. */
8605 }
8607 #if JS_HAS_XML_SUPPORT
8609 static JSBool
8611 {
8612 TokenKind tt;
8627 }
8629 /*
8630 * GC Rooting here is tricky: for most of the loop, |accum| is safe via
8631 * the newborn string root. However, when |pn2->pn_type| is TOK_XMLCDATA,
8632 * TOK_XMLCOMMENT, or TOK_XMLPI it is knocked out of the newborn root.
8633 * Therefore, we have to add additonal protection from GC nesting under
8634 * js_ConcatStrings.
8635 */
8637 /* The parser already rejected end-tags with attributes. */
8643 /* FALL THROUGH */
8672 cantfold:
8677 #ifdef DEBUG_brendanXXX
8681 else
8684 #endif
8689 }
8698 }
8703 }
8706 {
8711 }
8714 #ifdef DEBUG_brendanXXX
8718 #endif
8720 }
8722 }
8731 }
8736 }
8742 }
8751 }
8754 /*
8755 * Only one node under pn, and it has been folded: move pn1 onto pn
8756 * unless pn is an XML root (in which case we need it to tell the code
8757 * generator to emit a JSOP_TOXML or JSOP_TOXMLLIST op). If pn is an
8758 * XML root *and* it's a point-tag, rewrite it to TOK_XMLELEM to avoid
8759 * extra "<" and "/>" bracketing at runtime.
8760 */
8766 }
8767 }
8769 }
8773 static int
8775 {
8783 #if JS_HAS_GENERATOR_EXPRS
8785 {
8786 /*
8787 * A generator expression as an if or loop condition has no effects, it
8788 * simply results in a truthy object reference. This condition folding
8789 * is needed for the decompiler. See bug 442342 and bug 443074.
8790 */
8798 /* FALL THROUGH */
8799 }
8800 #endif
8813 }
8815 }
8817 JSBool
8819 {
8826 {
8838 }
8841 {
8842 /* Propagate inCond through logical connectives. */
8845 /* Don't fold a parenthesized call expression. See bug 537673. */
8850 /* Save the list head in pn1 for later use. */
8854 }
8856 }
8859 /* Any kid may be null (e.g. for (;;)). */
8871 }
8872 }
8881 /* Propagate inCond through logical connectives. */
8888 }
8890 /* First kid may be null (for default case in switch). */
8900 /*
8901 * Kludge to deal with typeof expressions: because constant folding
8902 * can turn an expression into a name node, we have to check here,
8903 * before folding, to see if we should throw undefined name errors.
8904 *
8905 * NB: We know that if pn->pn_op is JSOP_TYPEOF, pn1 will not be
8906 * null. This assumption does not hold true for other unary
8907 * expressions.
8908 */
8917 /*
8918 * Skip pn1 down along a chain of dotted member expressions to avoid
8919 * excessive recursion. Our only goal here is to fold constants (if
8920 * any) in the primary expression operand to the left of the first
8921 * dot in the chain.
8922 */
8929 }
8940 }
8946 /* FALL THROUGH */
8949 /* Reduce 'if (C) T; else E' into T for true C, E for false. */
8965 }
8966 /* FALL THROUGH */
8968 /* Early return to dodge common code that copies pn2 to pn. */
8970 }
8972 #if JS_HAS_GENERATOR_EXPRS
8973 /* Don't fold a trailing |if (0)| in a generator expression. */
8976 #endif
8981 /*
8982 * False condition and no else, or an empty then-statement was
8983 * moved up over pn. Either way, make pn an empty block (not an
8984 * empty statement, which does not decompile, even when labeled).
8985 * NB: pn must be a TOK_IF as TOK_HOOK can never have a null kid
8986 * or an empty statement for a child.
8987 */
8991 }
9010 }
9013 }
9023 }
9026 // We may have to change arity from LIST to BINARY.
9038 }
9048 }
9049 }
9050 }
9054 /*
9055 * Compound operators such as *= should be subject to folding, in case
9056 * the left-hand side is constant, and so that the decompiler produces
9057 * the same string that you get from decompiling a script or function
9058 * compiled from that same string. As with +, += is special.
9059 */
9064 /* FALL THROUGH */
9072 /*
9073 * Any string literal term with all others number or string means
9074 * this is a concatenation. If any term is not a string or number
9075 * literal, we can't fold.
9076 */
9083 /* Ok, we're concatenating: convert non-string constant operands. */
9088 /* XXX fold only if all operands convert to string */
9092 }
9094 /* Allocate a new buffer and string descriptor for the result. */
9102 }
9104 /* Fill the buffer, advancing chars and recycling kids as we go. */
9110 }
9113 /* Atomize the result string and mutate pn to refer to it. */
9121 }
9123 /* Handle a binary string concatenation. */
9129 TOK_STRING)) {
9131 }
9148 }
9150 /* Can't concatenate string literals, let's try numbers. */
9157 do_binary_op:
9163 }
9165 /* XXX fold only if all operands convert to number */
9168 }
9180 }
9181 }
9187 }
9191 }
9192 }
9197 jsdouble d;
9199 /* Operate on one numeric constant. */
9217 /* FALL THROUGH */
9220 /* Return early to dodge the common TOK_NUMBER code. */
9222 }
9235 }
9236 }
9239 #if JS_HAS_XML_SUPPORT
9250 }
9255 jsval v;
9272 }
9277 }
9297 }
9301 }
9302 }
9305 }