| blob | e75984a61afe1ab549b5beaee4c67401c99dc080 |
1 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
2 * vim: set ts=8 sw=4 et tw=99:
3 *
4 * ***** BEGIN LICENSE BLOCK *****
5 * Version: MPL 1.1/GPL 2.0/LGPL 2.1
6 *
7 * The contents of this file are subject to the Mozilla Public License Version
8 * 1.1 (the "License"); you may not use this file except in compliance with
9 * the License. You may obtain a copy of the License at
10 * http://www.mozilla.org/MPL/
11 *
12 * Software distributed under the License is distributed on an "AS IS" basis,
13 * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
14 * for the specific language governing rights and limitations under the
15 * License.
16 *
17 * The Original Code is Mozilla Communicator client code, released
18 * March 31, 1998.
19 *
20 * The Initial Developer of the Original Code is
21 * Netscape Communications Corporation.
22 * Portions created by the Initial Developer are Copyright (C) 1998
23 * the Initial Developer. All Rights Reserved.
24 *
25 * Contributor(s):
26 *
27 * Alternatively, the contents of this file may be used under the terms of
28 * either of the GNU General Public License Version 2 or later (the "GPL"),
29 * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
30 * in which case the provisions of the GPL or the LGPL are applicable instead
31 * of those above. If you wish to allow use of your version of this file only
32 * under the terms of either the GPL or the LGPL, and not to allow others to
33 * use your version of this file under the terms of the MPL, indicate your
34 * decision by deleting the provisions above and replace them with the notice
35 * and other provisions required by the GPL or the LGPL. If you do not delete
36 * the provisions above, a recipient may use your version of this file under
37 * the terms of any one of the MPL, the GPL or the LGPL.
38 *
39 * ***** END LICENSE BLOCK ***** */
41 /*
42 * JS parser.
43 *
44 * This is a recursive-descent parser for the JavaScript language specified by
45 * "The JavaScript 1.5 Language Specification". It uses lexical and semantic
46 * feedback to disambiguate non-LL(1) structures. It generates trees of nodes
47 * induced by the recursive parsing (not precise syntax trees, see jsparse.h).
48 * After tree construction, it rewrites trees to fold constants and evaluate
49 * compile-time expressions. Finally, it calls js_EmitTree (see jsemit.h) to
50 * generate bytecode.
51 *
52 * This parser attempts no error recovery.
53 */
54 #include <stdlib.h>
55 #include <string.h>
56 #include <math.h>
83 #if JS_HAS_XML_SUPPORT
85 #endif
87 #if JS_HAS_DESTRUCTURING
89 #endif
93 /*
94 * Asserts to verify assumptions behind pn_ macros.
95 */
96 #define pn_offsetof(m) offsetof(JSParseNode, m)
101 #undef pn_offsetof
103 /*
104 * Insist that the next token be of type tt, or report errno and return null.
105 * NB: this macro uses cx and ts from its lexical environment.
106 */
107 #define MUST_MATCH_TOKEN_WITH_FLAGS(tt, errno, __flags) \
108 JS_BEGIN_MACRO \
109 if (tokenStream.getToken((__flags)) != tt) { \
110 reportErrorNumber(NULL, JSREPORT_ERROR, errno); \
111 return NULL; \
112 } \
113 JS_END_MACRO
114 #define MUST_MATCH_TOKEN(tt, errno) MUST_MATCH_TOKEN_WITH_FLAGS(tt, errno, 0)
116 #ifdef METER_PARSENODES
120 #endif
122 void
124 {
138 }
140 /* If this is a function node fix up the pn_funbox->node back-pointer. */
150 }
152 void
154 {
160 }
162 bool
165 {
172 }
174 }
177 {
184 }
186 void
188 {
193 }
195 JSObjectBox *
197 {
200 /*
201 * We use JSContext.tempPool to allocate parsed objects and place them on
202 * a list in this Parser to ensure GC safety. Thus the tempPool arenas
203 * containing the entries must be alive until we are done with scanning,
204 * parsing and code generation for the whole script or top-level function.
205 */
211 }
217 }
219 JSFunctionBox *
221 {
225 /*
226 * We use JSContext.tempPool to allocate parsed objects and place them on
227 * a list in this Parser to ensure GC safety. Thus the tempPool arenas
228 * containing the entries must be alive until we are done with scanning,
229 * parsing and code generation for the whole script or top-level function.
230 */
236 }
254 }
255 }
259 }
261 bool
263 {
266 }
268 bool
270 {
277 }
278 }
280 }
282 void
284 {
289 }
290 }
292 static void
295 static void
297 {
304 /*
305 * Remove pn from funbox->parent's methods list if it's there. See
306 * the TOK_SEMI case in Statement, near the bottom, the TOK_ASSIGN
307 * sub-case matching a constructor method assignment pattern.
308 */
316 }
318 }
319 }
326 }
328 }
340 // FIXME: use a funbox freelist (consolidate aleFreeList and nodeList).
342 }
343 }
345 static void
347 {
376 }
377 }
378 }
380 static void
385 {
391 /* Catch back-to-back dup recycles. */
395 /*
396 * JSAtomLists own definition nodes along with their used-node chains.
397 * Defer recycling such nodes until we unwind to top level to avoid
398 * linkage overhead or (alternatively) unlinking runtime complexity.
399 * Yes, this means dead code can contribute to static analysis results!
400 *
401 * Do recycle kids here, since they are no longer needed.
402 */
410 #ifdef METER_PARSENODES
411 recyclednodes++;
412 #endif
413 }
415 }
417 static void
419 {
423 /* FALL THROUGH */
426 /*
427 * Only a definition node might have a non-null strong pn_expr link
428 * to recycle, but we test !pn_used to handle PN_FUNC fall through.
429 * Every node with the pn_used flag set has a non-null pn_lexdef
430 * weak reference to its definition node.
431 */
435 }
440 }
441 }
443 /*
444 * Allocate a JSParseNode from tc's node freelist or, failing that, from cx's
445 * temporary arena.
446 */
449 {
462 /* Recycle immediate descendents only, to save work and working set. */
480 #ifdef METER_PARSENODES
482 #endif
484 }
485 }
506 }
507 }
509 #ifdef METER_PARSENODES
510 parsenodes++;
513 #endif
517 }
519 }
521 /* used only by static create methods of subclasses */
523 JSParseNode *
525 {
533 }
535 JSParseNode *
538 {
544 /*
545 * Flatten a left-associative (left-heavy) tree of a given operator into
546 * a list, to reduce js_FoldConstants and js_EmitTree recursion.
547 */
566 }
567 }
575 }
577 }
579 /*
580 * Fold constant addition immediately, to conserve node space and, what's
581 * more, so js_FoldConstants never sees mixed addition and concatenation
582 * operations with more than one leading non-string operand in a PN_LIST
583 * generated for expressions such as 1 + 2 + "pt" (which should evaluate
584 * to "3pt", not "12pt").
585 */
593 }
604 }
610 {
617 }
619 NameNode *
621 {
628 }
630 }
634 static bool
636 {
641 }
644 }
646 static bool
648 {
656 }
658 /*
659 * Parse a top-level JS script.
660 */
661 JSParseNode *
663 {
664 /*
665 * Protect atoms from being collected by a GC activation, which might
666 * - nest on this thread due to out of memory (the so-called "last ditch"
667 * GC attempted within js_NewGCThing), or
668 * - run for any reason on another thread if this thread is suspended on
669 * an object lock before it finishes generating bytecode into a script
670 * protected from the GC by a root or a stack frame reference.
671 */
685 }
686 }
688 }
694 {
695 /*
696 * This is a lot simpler than error-checking every UpvarCookie::set, and
697 * practically speaking it leaves more than enough room for upvars.
698 */
703 }
706 }
708 /*
709 * Compile a top-level script.
710 */
711 JSScript *
718 {
720 TokenKind tt;
722 uint32 scriptGlobals;
725 #ifdef METER_PARSENODES
727 #endif
731 /*
732 * The scripted callerFrame can only be given for compile-and-go scripts
733 * and non-zero static level requires callerFrame.
734 */
756 /* Null script early in case of error, to reduce our code footprint. */
764 /* If this is a direct call to eval, inherit the caller's strictness. */
770 }
772 /*
773 * If funbox is non-null after we create the new script, callerFrame->fun
774 * was saved in the 0th object table entry.
775 */
781 /*
782 * Save eval program source in script->atomMap.vector[0] for the
783 * eval cache (see obj_eval in jsobj.cpp).
784 */
788 }
791 /*
792 * An eval script in a caller frame needs to have its enclosing
793 * function captured in case it refers to an upvar, and someone
794 * wishes to decompile it while it's running.
795 */
802 }
803 }
805 /*
806 * Inline this->statements to emit as we go to save AST space. We must
807 * generate our script-body blockid since we aren't calling Statements.
808 */
809 uint32 bodyid;
814 #if JS_HAS_XML_SUPPORT
818 #endif
833 }
850 }
854 #if JS_HAS_XML_SUPPORT
859 }
860 #endif
862 }
864 #if JS_HAS_XML_SUPPORT
865 /*
866 * Prevent XML data theft via <script src="http://victim.com/foo.xml">.
867 * For background, see:
868 *
869 * https://bugzilla.mozilla.org/show_bug.cgi?id=336551
870 */
874 }
875 #endif
877 /*
878 * Global variables (gvars) share the atom index space with locals. Due to
879 * incremental code generation we need to patch the bytecode to adjust the
880 * local references to skip the globals.
881 */
885 JSOp op;
902 /*
903 * JSOP_GETARGPROP also has JOF_SLOTATOM type, but it may be
904 * emitted only for a function.
905 */
916 }
917 }
918 }
920 #ifdef METER_PARSENODES
923 parsenodes,
924 maxparsenodes,
927 #endif
929 /*
930 * Nowadays the threaded interpreter needs a stop instruction, so we
931 * do have to emit that here.
932 */
935 #ifdef METER_PARSENODES
938 #endif
939 #ifdef JS_ARENAMETER
941 #endif
946 #ifdef JS_SCOPE_DEPTH_METER
953 }
954 #endif
956 out:
961 too_many_slots:
965 }
967 /*
968 * Insist on a final return before control flows out of pn. Try to be a bit
969 * smart about loops: do {...; return e2;} while(0) at the end of a function
970 * that contains an early return e1 will get a strict warning. Similarly for
971 * iloops: while (true){...} is treated as though ... returns.
972 */
973 #define ENDS_IN_OTHER 0
974 #define ENDS_IN_RETURN 1
975 #define ENDS_IN_BREAK 2
977 static int
979 {
1009 }
1014 }
1038 else
1040 }
1041 }
1042 /* If a final switch has no default case, we judge it harshly. */
1063 /* If we have a finally block that returns, we are done. */
1068 }
1070 /* Else check the try block and any and all catch statements. */
1076 }
1080 /* Check this catch block's body. */
1084 /* Non-binary let statements are let declarations. */
1091 }
1092 }
1094 static JSBool
1096 uintN anonerrnum)
1097 {
1106 }
1108 }
1110 static JSBool
1112 {
1117 }
1119 /*
1120 * Check that it is permitted to assign to lhs. Strict mode code may not
1121 * assign to 'eval' or 'arguments'.
1122 */
1123 bool
1125 {
1134 name)) {
1136 }
1137 }
1138 }
1140 }
1142 /*
1143 * Check that it is permitted to introduce a binding for atom. Strict
1144 * mode forbids introducing new definitions for 'eval' or 'arguments'.
1145 * Use pn for reporting error locations, or use tc's token stream if
1146 * pn is NULL.
1147 */
1148 bool
1150 {
1160 }
1162 }
1164 /*
1165 * In strict mode code, all formal parameter names must be distinct. If fun's
1166 * formals are legit given fun's strictness level, return true. Otherwise,
1167 * report an error and return false. Use pn for error position reporting,
1168 * unless we can find something more accurate in tc's decls.
1169 *
1170 * In some cases the code to parse the argument list will already have noticed
1171 * the duplication; we could try to use that knowledge instead of re-checking
1172 * here. But since the strictness of the function's body determines what
1173 * constraints to apply to the argument list, we can't report the error until
1174 * after we've parsed the body. And as it turns out, the function's local name
1175 * list makes it reasonably cheap to find duplicates after the fact.
1176 */
1177 static bool
1180 {
1188 /*
1189 * We have found a duplicate parameter name. If we can find the
1190 * JSDefinition for the argument, that will have a more accurate source
1191 * location.
1192 */
1200 }
1201 }
1207 /* The definition's source position will be more precise. */
1214 }
1215 }
1218 }
1220 JSParseNode *
1222 {
1223 JSStmtInfo stmtInfo;
1234 /*
1235 * Save the body's first line, and store it in pn->pn_pos.begin.lineno
1236 * later, because we may have not peeked in tokenStream yet, so statements
1237 * won't acquire a valid pn->pn_pos.begin from the current token.
1238 */
1240 #if JS_HAS_EXPR_CLOSURES
1252 JSMSG_BAD_GENERATOR_RETURN,
1253 JSMSG_BAD_ANON_GENERATOR_RETURN);
1259 }
1260 }
1261 }
1262 }
1263 #else
1265 #endif
1272 /* Check for falling off the end of a function that returns a value. */
1276 }
1277 }
1281 }
1285 {
1298 }
1300 static bool
1302 {
1327 }
1336 }
1337 }
1338 }
1347 }
1349 static void
1351 {
1360 }
1362 static void
1364 {
1368 }
1376 }
1380 {
1395 }
1405 }
1409 {
1410 /*
1411 * If dn is var, const, or let, and it has an initializer, then we must
1412 * rewrite it to be an assignment node, whose freshly allocated left-hand
1413 * side becomes a use of pn.
1414 */
1421 //pn->dn_uses = lhs;
1423 }
1432 }
1434 /* Now make dn no longer a definition, rather a use of pn. */
1444 }
1454 }
1456 static bool
1458 {
1461 /* Flag tc so we don't have to lookup arguments on every use. */
1467 /*
1468 * Make an argument definition node, distinguished by being in tc->decls
1469 * but having TOK_NAME type and JSOP_NOP op. Insert it in a TOK_ARGSBODY
1470 * list node returned via pn->pn_body.
1471 */
1477 /* Arguments are initialized by definition. */
1491 }
1498 }
1500 /*
1501 * Compile a JS function body, which might appear as the value of an event
1502 * handler attribute in an HTML <INPUT> tag.
1503 */
1504 bool
1508 {
1514 /* No early return from after here until the js_FinishArenaPool calls. */
1533 /* FIXME: make Function format the source for a function definition. */
1551 }
1552 }
1553 }
1554 }
1555 }
1557 /*
1558 * Farble the body so that it looks like a block statement to js_EmitTree,
1559 * which is called from js_EmitFunctionBody (see jsemit.cpp). After we're
1560 * done parsing, we must fold constants, analyze any nested functions, and
1561 * generate code for this function, including a stop opcode at the end.
1562 */
1572 /* js_FoldConstants reported the error already. */
1583 }
1587 }
1588 }
1590 /* Restore saved state and release code generation arenas. */
1594 }
1596 /*
1597 * Parameter block types for the several Binder functions. We use a common
1598 * helper function signature in order to share code among destructuring and
1599 * simple variable declaration parsers. In the destructuring case, the binder
1600 * function is called indirectly from the variable declaration parser by way
1601 * of CheckDestructuring and its friends.
1602 */
1603 typedef JSBool
1610 error source coordinates */
1615 uintN overflow;
1617 };
1619 };
1621 static JSBool
1624 {
1627 /*
1628 * Don't bind a variable with the hidden name 'arguments', per ECMA-262.
1629 * Instead 'var arguments' always restates the predefined property of the
1630 * activation objects whose name is 'arguments'. Assignment to such a
1631 * variable must be handled specially.
1632 *
1633 * Special case: an argument named 'arguments' *does* shadow the predefined
1634 * arguments property.
1635 */
1640 }
1642 #if JS_HAS_DESTRUCTURING
1643 static JSBool
1646 {
1649 /* Flag tc so we don't have to lookup arguments on every use. */
1660 JSMSG_DESTRUCT_DUP_ARG);
1662 }
1676 }
1679 JSFunction *
1681 {
1687 /*
1688 * Find the global compilation context in order to pre-set the newborn
1689 * function's parent slot to tc->scopeChain. If the global context is a
1690 * compile-and-go one, we leave the pre-set parent intact; otherwise we
1691 * clear parent and proto.
1692 */
1703 }
1705 }
1707 static JSBool
1709 {
1716 }
1719 }
1721 bool
1723 {
1728 }
1730 /*
1731 * Mark as funargs any functions that reach up to one or more upvars across an
1732 * already-known funarg. The parser will flag the o_m lambda as a funarg in:
1733 *
1734 * function f(o, p) {
1735 * o.m = function o_m(a) {
1736 * function g() { return p; }
1737 * function h() { return a; }
1738 * return g() + h();
1739 * }
1740 * }
1741 *
1742 * but without this extra marking phase, function g will not be marked as a
1743 * funarg since it is called from within its parent scope. But g reaches up to
1744 * f's parameter p, so if o_m escapes f's activation scope, g does too and
1745 * cannot use JSOP_GETUPVAR to reach p. In contast function h neither escapes
1746 * nor uses an upvar "above" o_m's level.
1747 *
1748 * If function g itself contained lambdas that contained non-lambdas that reach
1749 * up above its level, then those non-lambdas would have to be marked too. This
1750 * process is potentially exponential in the number of functions, but generally
1751 * not so complex. But it can't be done during a single recursive traversal of
1752 * the funbox tree, so we must use a work queue.
1753 *
1754 * Return the minimal "skipmin" for funbox and its siblings. This is the delta
1755 * between the static level of the bodies of funbox and its peers (which must
1756 * be funbox->level + 1), and the static level of the nearest upvar among all
1757 * the upvars contained by funbox and its peers. If there are no upvars, return
1758 * FREE_STATIC_LEVEL. Thus this function never returns 0.
1759 */
1760 static uintN
1762 {
1770 /*
1771 * An eval can leak funbox, functions along its ancestor line, and its
1772 * immediate kids. Since FindFunArgs uses DFS and the parser propagates
1773 * TCF_FUN_HEAVYWEIGHT bottom up, funbox's ancestor function nodes have
1774 * already been marked as funargs by this point. Therefore we have to
1775 * flag only funbox->node and funbox->kids' nodes here.
1776 */
1781 }
1783 /*
1784 * Compute in skipmin the least distance from fun's static level up to
1785 * an upvar, whether used directly by fun, or indirectly by a function
1786 * nested in fun.
1787 */
1810 }
1811 }
1812 }
1814 /*
1815 * If this function escapes, whether directly (the parser detects such
1816 * escapes) or indirectly (because this non-escaping function uses an
1817 * upvar that reaches across an outer function boundary where the outer
1818 * function escapes), enqueue it for further analysis, and bump fnlevel
1819 * to trap any non-escaping children.
1820 */
1824 }
1826 /*
1827 * Now process the current function's children, and recalibrate their
1828 * cumulative skipmin to be relative to the current static level.
1829 */
1838 }
1839 }
1841 /*
1842 * Finally, after we've traversed all of the current function's kids,
1843 * minimize fun's skipmin against our accumulated skipmin. Do likewise
1844 * with allskipmin, but minimize across funbox and all of its siblings,
1845 * to compute our return value.
1846 */
1851 }
1855 }
1857 bool
1859 {
1860 JSFunctionBoxQueue queue;
1884 /*
1885 * Mark this formerly-Algol-like function as an escaping
1886 * function (i.e., as a funarg), because it is used from a
1887 * funarg and therefore can not use JSOP_{GET,CALL}UPVAR to
1888 * access upvars.
1889 *
1890 * Progress is guaranteed because we set the funarg flag
1891 * here, which suppresses revisiting this function (thanks
1892 * to the !lexdep->isFunArg() test just above).
1893 */
1898 /*
1899 * A named function expression will not appear to be a
1900 * funarg if it is immediately applied. However, if its
1901 * name is used in an escaping function nested within
1902 * it, then it must become flagged as a funarg again.
1903 * See bug 545980.
1904 */
1911 }
1915 }
1918 /*
1919 * Walk over nested functions again, now that we have
1920 * changed the level across which it is unsafe to access
1921 * upvars using the runtime dynamic link (frame chain).
1922 */
1925 }
1926 }
1927 }
1928 }
1930 }
1932 static uint32
1934 {
1941 }
1942 }
1944 }
1948 {
1949 /*
1950 * Consider the current function (the lambda, innermost below) using a var
1951 * x defined two static levels up:
1952 *
1953 * function f() {
1954 * // z = g();
1955 * var x = 42;
1956 * function g() {
1957 * return function () { return x; };
1958 * }
1959 * return g();
1960 * }
1961 *
1962 * So long as (1) the initialization in 'var x = 42' dominates all uses of
1963 * g and (2) x is not reassigned, it is safe to optimize the lambda to a
1964 * flat closure. Uncommenting the early call to g makes this optimization
1965 * unsafe (z could name a global setter that calls its argument).
1966 */
1974 /*
1975 * NB: afunbox can't be null because we are sure to find a function box
1976 * whose level == dnLevel before we would try to walk above the root of
1977 * the funbox tree. See bug 493260 comments 16-18.
1978 *
1979 * Assert but check anyway, to protect future changes that bind eval
1980 * upvars in the parser.
1981 */
1984 /*
1985 * If this function is reaching up across an enclosing funarg, then we
1986 * cannot copy dn's value into a flat closure slot (the display stops
1987 * working once the funarg escapes).
1988 */
1992 /*
1993 * Reaching up for dn across a generator also means we can't flatten,
1994 * since the generator iterator does not run until later, in general.
1995 * See bug 563034.
1996 */
1999 }
2001 /*
2002 * If afunbox's function (which is at the same level as dn) is in a loop,
2003 * pessimistically assume the variable initializer may be in the same loop.
2004 * A flat closure would then be unsafe, as the captured variable could be
2005 * assigned after the closure is created. See bug 493232.
2006 */
2010 /*
2011 * |with| and eval used as an operator defeat lexical scoping: they can be
2012 * used to assign to any in-scope variable. Therefore they must disable
2013 * flat closures that use such upvars. The parser detects these as special
2014 * forms and marks the function heavyweight.
2015 */
2019 /*
2020 * If afunbox's function is not a lambda, it will be hoisted, so it could
2021 * capture the undefined value that by default initializes var, let, and
2022 * const bindings. And if dn is a function that comes at (meaning a
2023 * function refers to its own name) or strictly after afunbox, we also
2024 * defeat the flat closure optimization for this dn.
2025 */
2030 }
2040 /*
2041 * Any formal could be mutated behind our back via the arguments
2042 * object, so deoptimize if the outer function uses arguments.
2043 *
2044 * In a Function constructor call where the final argument -- the body
2045 * source for the function to create -- contains a nested function
2046 * definition or expression, afunbox->parent will be null. The body
2047 * source might use |arguments| outside of any nested functions it may
2048 * contain, so we have to check the tcflags parameter that was passed
2049 * in from Compiler::compileFunctionBody.
2050 */
2054 }
2055 }
2057 /*
2058 * Check quick-and-dirty dominance relation. Function definitions dominate
2059 * their uses thanks to hoisting. Other binding forms hoist as undefined,
2060 * of course, so check forward-reference and blockid relations.
2061 */
2063 /*
2064 * Watch out for code such as
2065 *
2066 * (function () {
2067 * ...
2068 * var jQuery = ... = function (...) {
2069 * return new jQuery.foo.bar(baz);
2070 * }
2071 * ...
2072 * })();
2073 *
2074 * where the jQuery variable is not reassigned, but of course is not
2075 * initialized at the time that the would-be-flat closure containing
2076 * the jQuery upvar is formed.
2077 */
2082 }
2084 }
2086 static void
2088 {
2092 /*
2093 * Notice that funbox->level is the static level of the definition or
2094 * expression of the function parsed into funbox, not the static level
2095 * of its body. Therefore we must add 1 to match dn's level to find the
2096 * funbox whose body contains the dn definition.
2097 */
2101 }
2103 }
2107 }
2109 static void
2111 {
2121 }
2122 }
2126 }
2128 void
2130 {
2131 #ifdef JS_FUNCTION_METERING
2132 # define FUN_METER(x) JS_RUNTIME_METER(context->runtime, functionMeter.x)
2133 #else
2134 # define FUN_METER(x) ((void)0)
2135 #endif
2144 /*
2145 * We've unwound from recursively setting our kids' kinds, which
2146 * also classifies enclosing functions holding upvars referenced in
2147 * those descendants' bodies. So now we can check our "methods".
2148 *
2149 * Despecialize from branded method-identity-based shape to sprop-
2150 * or slot-based shape if this function smells like a constructor
2151 * and too many of its methods are *not* joinable null closures
2152 * (i.e., they have one or more upvars fetched via the display).
2153 */
2160 #if JS_HAS_EXPR_CLOSURES
2162 #endif
2171 }
2175 }
2176 }
2186 /*
2187 * No lexical dependencies => null closure, for best performance.
2188 * A null closure needs no scope chain, but alas we've coupled
2189 * principals-finding to scope (for good fundamental reasons, but
2190 * the implementation overloads the parent slot and we should fix
2191 * that). See, e.g., the JSOP_LAMBDA case in jsinterp.cpp.
2192 *
2193 * In more detail: the ES3 spec allows the implementation to create
2194 * "joined function objects", or not, at its discretion. But real-
2195 * world implementations always create unique function objects for
2196 * closures, and this can be detected via mutation. Open question:
2197 * do popular implementations create unique function objects for
2198 * null closures?
2199 *
2200 * FIXME: bug 476950.
2201 */
2212 /*
2213 * This function is Algol-like, it never escapes. So long as it
2214 * does not assign to outer variables, it needs only an upvars
2215 * array in its script and JSOP_{GET,CALL}UPVAR opcodes in its
2216 * bytecode to reach up the frame stack at runtime based on
2217 * those upvars' cookies.
2218 *
2219 * Any assignments to upvars from functions called by this one
2220 * will be coherent because of the JSOP_{GET,CALL}UPVAR ops,
2221 * which load from stack homes when interpreting or from native
2222 * stack slots when executing a trace.
2223 *
2224 * We could add JSOP_SETUPVAR, etc., but it is uncommon for a
2225 * nested function to assign to an outer lexical variable, so
2226 * we defer adding yet more code footprint in the absence of
2227 * evidence motivating these opcodes.
2228 */
2232 /*
2233 * Check that at least one outer lexical binding was assigned
2234 * to (global variables don't count). This is conservative: we
2235 * could limit assignments to those in the current function,
2236 * but that's too much work. As with flat closures (handled
2237 * below), we optimize for the case where outer bindings are
2238 * not reassigned anywhere.
2239 */
2248 }
2249 }
2258 /*
2259 * Algol-like functions can read upvars using the dynamic
2260 * link (cx->fp/fp->down), optimized using the cx->display
2261 * lookup table indexed by static level. They do not need
2262 * to entrain and search their environment objects.
2263 */
2269 }
2273 /*
2274 * For each lexical dependency from this closure to an outer
2275 * binding, analyze whether it is safe to copy the binding's
2276 * value into a flat closure slot when the closure is formed.
2277 */
2286 }
2288 }
2289 }
2295 /* FIXME bug 545759: to test nflattened != 0 */
2296 /*
2297 * We made it all the way through the upvar loop, so it's
2298 * safe to optimize to a flat closure.
2299 */
2313 /* js_EmitTree's case TOK_FUNCTION: will select op. */
2315 }
2318 }
2319 }
2320 }
2323 /*
2324 * One or more upvars cannot be safely snapshot into a flat
2325 * closure's dslot (see JSOP_GETDSLOT), so we loop again over
2326 * all upvars, and for each non-free upvar, ensure that its
2327 * containing function has been flagged as heavyweight.
2328 *
2329 * The emitter must see TCF_FUN_HEAVYWEIGHT accurately before
2330 * generating any code for a tree of nested functions.
2331 */
2342 }
2343 }
2348 }
2350 #undef FUN_METER
2351 }
2359 {
2363 };
2367 }
2372 {
2378 /* Create box for fun->object early to protect against last-ditch GC. */
2383 /* Initialize non-default members of funtc. */
2394 }
2396 static bool
2399 {
2412 /*
2413 * Propagate unresolved lexical names up to tc->lexdeps, and save a copy
2414 * of funtc->lexdeps in a TOK_UPVARS node wrapping the function's formal
2415 * params and body. We do this only if there are lexical dependencies not
2416 * satisfied by the function's declarations, to avoid penalizing functions
2417 * that use only their arguments and other local bindings.
2418 */
2434 /*
2435 * If this named function expression uses its own name other
2436 * than to call itself, flag this function specially.
2437 */
2442 }
2446 /*
2447 * Make sure we do not fail to set TCF_FUN_SETS_OUTER_NAME if
2448 * any use of dn in funtc assigns. See NoteLValue for the easy
2449 * backward-reference case; this is the hard forward-reference
2450 * case where we pay a higher price.
2451 */
2456 }
2457 }
2458 }
2464 /*
2465 * Insert dn's uses list at the front of outer_dn's list.
2466 *
2467 * Without loss of generality or correctness, we allow a dn to
2468 * be in inner and outer lexdeps, since the purpose of lexdeps
2469 * is one-pass coordination of name use and definition across
2470 * functions, and if different dn's are used we'll merge lists
2471 * when leaving the inner function.
2472 *
2473 * The dn == outer_dn case arises with generator expressions
2474 * (see CompExprTransplanter::transplant, the PN_FUNC/PN_NAME
2475 * case), and nowhere else, currently.
2476 */
2486 }
2488 /*
2489 * Make dn be a use that redirects to outer_dn, because we
2490 * can't replace dn with outer_dn in all the pn_namesets in
2491 * the AST where it may be. Instead we make it forward to
2492 * outer_dn. See JSDefinition::resolve.
2493 */
2500 }
2502 /* Add an outer lexical dependency for ale's definition. */
2507 }
2508 }
2523 }
2526 }
2529 }
2531 JSParseNode *
2533 {
2535 TokenKind tt;
2537 #if JS_HAS_DESTRUCTURING
2541 #endif
2543 /*
2544 * Save the current op for later so we can tag the created function as a
2545 * getter/setter if necessary.
2546 */
2549 /* Make a TOK_FUNCTION node. */
2556 /*
2557 * If a lambda, give up on JSOP_{GET,CALL}UPVAR usage unless this function
2558 * is immediately applied (we clear PND_FUNARG if so -- see memberExpr).
2559 *
2560 * Also treat function sub-statements (non-lambda, non-top-level functions)
2561 * as escaping funargs, since we can't statically analyze their definitions
2562 * and uses.
2563 */
2567 /* Scan the optional function name into funAtom. */
2577 }
2579 }
2580 }
2582 /*
2583 * Record names for function statements in tc->decls so we know when to
2584 * avoid optimizing variable references that might name a function.
2585 */
2602 JSMSG_REDECLARED_VAR,
2604 name)) {
2606 }
2607 }
2616 }
2618 /*
2619 * If this function was used before it was defined, claim the
2620 * pre-created definition node for this function that primaryExpr
2621 * put in tc->lexdeps on first forward reference, and recycle pn.
2622 */
2639 }
2643 }
2645 /*
2646 * A function nested at top level inside another's body needs only a
2647 * local variable to bind its name to its value, and not an activation
2648 * object property (it might also need the activation property, if the
2649 * outer function contains with statements, e.g., but the stack slot
2650 * wins when jsemit.c's BindNameToSlot can optimize a JSOP_NAME into a
2651 * JSOP_GETLOCAL bytecode).
2652 */
2657 JSLocalKind localKind;
2658 uintN index;
2660 /*
2661 * Define a local in the outer function so that BindNameToSlot
2662 * can properly optimize accesses. Note that we need a local
2663 * variable, not an argument, for the function statement. Thus
2664 * we add a variable even if a parameter with the given name
2665 * already exists.
2666 */
2674 /* FALL THROUGH */
2682 }
2683 }
2684 }
2685 }
2689 /* Initialize early for possible flags mutation via destructuringExpr. */
2701 /* Now parse formal argument list and compute fun->nargs. */
2707 #if JS_HAS_DESTRUCTURING
2710 {
2711 BindData data;
2713 jsint slot;
2715 /* See comment below in the TOK_NAME case. */
2720 /*
2721 * A destructuring formal parameter turns into one or more
2722 * local variables initialized from properties of a single
2723 * anonymous positional parameter, so here we must tweak our
2724 * binder and its data.
2725 */
2733 /*
2734 * Adjust fun->nargs to count the single anonymous positional
2735 * parameter that is to be destructured.
2736 */
2741 /*
2742 * Synthesize a destructuring assignment from the single
2743 * anonymous positional parameter into the destructuring
2744 * left-hand-side expression and accumulate it in list.
2745 */
2763 }
2766 }
2770 {
2774 #ifdef JS_HAS_DESTRUCTURING
2775 /*
2776 * ECMA-262 requires us to support duplicate parameter names, but if the
2777 * parameter list includes destructuring, we consider the code to have
2778 * opted in to higher standards, and forbid duplicates. We may see a
2779 * destructuring parameter later, so always note duplicates now.
2780 *
2781 * Duplicates are warned about (strict option) or cause errors (strict
2782 * mode code), but we do those tests in one place below, after having
2783 * parsed the body.
2784 */
2789 }
2790 #endif
2794 }
2798 /* FALL THROUGH */
2802 #if JS_HAS_DESTRUCTURING
2803 report_dup_and_destructuring:
2807 #endif
2808 }
2812 }
2814 #if JS_HAS_EXPR_CLOSURES
2819 }
2820 #else
2822 #endif
2834 #if JS_HAS_EXPR_CLOSURES
2839 #else
2841 #endif
2844 #if JS_HAS_DESTRUCTURING
2845 /*
2846 * If there were destructuring formal parameters, prepend the initializing
2847 * comma expression that we synthesized to body. If the body is a lexical
2848 * scope node, we must make a special TOK_SEQ node, to prepend the formal
2849 * parameter destructuring code without bracing the decompilation of the
2850 * function body's lexical scope.
2851 */
2864 }
2879 }
2880 #endif
2882 /*
2883 * If we collected flags that indicate nested heavyweight functions, or
2884 * this function contains heavyweight-making statements (with statement,
2885 * visible eval call, or assignment to 'arguments'), flag the function as
2886 * heavyweight (requiring a call object per invocation).
2887 */
2892 /*
2893 * If this function is a named statement function not at top-level
2894 * (i.e. not a top-level function definiton or expression), then our
2895 * enclosing function, if any, must be heavyweight.
2896 */
2899 }
2903 /*
2904 * ECMA ed. 3 standard: function expression, possibly anonymous.
2905 */
2908 /*
2909 * If this anonymous function definition is *not* embedded within a
2910 * larger expression, we treat it as an expression statement, not as
2911 * a function declaration -- and not as a syntax error (as ECMA-262
2912 * Edition 3 would have it). Backward compatibility must trump all,
2913 * unless JSOPTION_ANONFUNFIX is set.
2914 */
2923 /*
2924 * ECMA ed. 3 extension: a function expression statement not at the
2925 * top level, e.g., in a compound statement such as the "then" part
2926 * of an "if" statement, binds a closure only if control reaches that
2927 * sub-statement.
2928 */
2932 }
2943 }
2950 /* If the surrounding function is not strict code, reset the lexer. */
2955 }
2957 JSParseNode *
2959 {
2961 }
2963 JSParseNode *
2965 {
2967 }
2969 /*
2970 * Recognize Directive Prologue members and directives. Assuming pn
2971 * is a candidate for membership in a directive prologue, return
2972 * true if it is in fact a member. Recognize directives and set
2973 * tc's flags accordingly.
2974 *
2975 * Note that the following is a strict mode function:
2976 *
2977 * function foo() {
2978 * "blah" // inserted semi colon
2979 * "blurgh"
2980 * "use\x20loose"
2981 * "use strict"
2982 * }
2983 *
2984 * That is, a statement can be a Directive Prologue member, even
2985 * if it can't possibly be a directive, now or in the future.
2986 */
2987 bool
2989 {
2997 }
2998 }
3000 }
3002 /*
3003 * Parse the statements in a block, creating a TOK_LC node that lists the
3004 * statements' trees. If called from block-parsing code, the caller must
3005 * match { before and } after.
3006 */
3007 JSParseNode *
3009 {
3011 TokenKind tt;
3032 }
3034 }
3040 }
3046 /*
3047 * PNX_FUNCDEFS notifies the emitter that the block contains top-
3048 * level function definitions that should be processed before the
3049 * rest of nodes.
3050 *
3051 * TCF_HAS_FUNCTION_STMT is for the TOK_LC case in Statement. It
3052 * is relevant only for function definitions not at top-level,
3053 * which we call function statements.
3054 */
3057 else
3059 }
3061 }
3063 /*
3064 * Handle the case where there was a let declaration under this block. If
3065 * it replaced tc->blockNode with a new block node then we must refresh pn
3066 * and then restore tc->blockNode.
3067 */
3074 }
3076 JSParseNode *
3078 {
3087 /* Check for (a = b) and warn about possible (a == b) mistype. */
3093 }
3095 }
3097 static JSBool
3099 {
3101 TokenKind tt;
3111 }
3114 }
3116 static JSBool
3118 {
3122 jsint n;
3124 /*
3125 * Top-level 'let' is the same as 'var' currently -- this may change in a
3126 * successor standard to ES3.1 that specifies 'let'.
3127 */
3142 ? js_const_str
3144 name);
3145 }
3147 }
3154 }
3156 /*
3157 * Pass push = true to Define so it pushes an ale ahead of any outer scope.
3158 * This is balanced by PopStatement, defined immediately below.
3159 */
3163 /*
3164 * Assign block-local index to pn->pn_cookie right away, encoding it as an
3165 * upvar cookie whose skip tells the current static level. The emitter will
3166 * adjust the node's slot based on its stack depth model -- and, for global
3167 * and eval code, Compiler::compileScript will adjust the slot again to
3168 * include script->nfixed.
3169 */
3174 /*
3175 * Define the let binding's property before storing pn in reserved slot at
3176 * reserved slot index (NB: not slot number) n.
3177 */
3181 /*
3182 * Store pn temporarily in what would be reserved slots in a cloned block
3183 * object (once the prototype's final population is known, after all 'let'
3184 * bindings for this block have been parsed). We will free these reserved
3185 * slots in jsemit.cpp:EmitEnterBlock.
3186 */
3193 }
3195 static void
3197 {
3208 /* Beware the empty destructuring dummy. */
3212 }
3213 }
3215 }
3219 {
3226 }
3228 }
3230 /*
3231 * If we are generating global or eval-called-from-global code, bind a "gvar"
3232 * here, as soon as possible. The JSOP_GETGVAR, etc., ops speed up interpreted
3233 * global variable access by memoizing name-to-slot mappings during execution
3234 * of the script prolog (via JSOP_DEFVAR/JSOP_DEFCONST). If the memoization
3235 * can't be done due to a pre-existing property of the same name as the var or
3236 * const but incompatible attributes/getter/setter/etc, these ops devolve to
3237 * JSOP_NAME, etc.
3238 *
3239 * For now, don't try to lookup eval frame variables at compile time. This is
3240 * sub-optimal: we could handle eval-called-from-global-code gvars since eval
3241 * gets its own script and frame. The eval-from-function-code case is harder,
3242 * since functions do not atomize gvars and then reserve their atom indexes as
3243 * stack frame slots.
3244 */
3245 static bool
3247 {
3254 /* Index pn->pn_atom so we can map fast global number to name. */
3259 /* Defend against cg->ngvars 16-bit overflow. */
3271 }
3272 }
3275 }
3277 static JSBool
3279 {
3282 /* Default best op for pn is JSOP_NAME; we'll try to improve below. */
3293 }
3311 name);
3313 }
3318 }
3331 !error
3334 JSMSG_REDECLARED_VAR,
3336 name)) {
3338 }
3339 }
3340 }
3341 }
3347 /*
3348 * A var declaration never recreates an existing binding, it restates
3349 * it and possibly reinitializes its value. Beware that if pn becomes a
3350 * use of ALE_DEFN(ale), and if we have an initializer for this var or
3351 * const (typically a const would ;-), then pn must be rewritten into a
3352 * TOK_ASSIGN node. See Variables, further below.
3353 *
3354 * A case such as let (x = 1) { var x = 2; print(x); } is even harder.
3355 * There the x definition is hoisted but the x = 2 assignment mutates
3356 * the block-local binding of x.
3357 */
3363 /* Make pnu be a fresh name node that uses dn. */
3370 }
3374 }
3383 }
3389 }
3391 /*
3392 * A var or const that is shadowed by one or more let bindings of the
3393 * same name, but that has not been declared until this point, must be
3394 * hoisted above the let bindings.
3395 */
3408 /* The token stream may be past the location for pn. */
3412 }
3414 }
3422 }
3434 }
3438 /*
3439 * Property not found in current variable scope: we have not seen this
3440 * variable before. Define a new local variable by adding a property to
3441 * the function's scope and allocating one slot in the function's vars
3442 * frame. Any locals declared in a with statement body are handled at
3443 * runtime, by script prolog JSOP_DEFVAR opcodes generated for global
3444 * and heavyweight-function-local vars.
3445 */
3455 }
3458 /* We checked errors and strict warnings earlier -- see above. */
3461 /* Not an argument, must be a redeclared local var. */
3463 }
3465 }
3467 static JSBool
3469 {
3478 }
3481 }
3483 static void
3485 {
3489 /*
3490 * Save the win of PND_INITIALIZED if we can prove 'var x;' and 'x = y'
3491 * occur as direct kids of the same block with no forward refs to x.
3492 */
3500 }
3506 }
3512 }
3514 #if JS_HAS_DESTRUCTURING
3516 static JSBool
3519 {
3522 /*
3523 * Destructuring is a form of assignment, so just as for an initialized
3524 * simple variable, we must check for assignment to 'arguments' and flag
3525 * the enclosing function (if any) as heavyweight.
3526 */
3536 /*
3537 * Select the appropriate name-setting opcode, respecting eager selection
3538 * done by the data->binder function.
3539 */
3542 ? JSOP_SETNAME
3544 ? JSOP_SETGVAR
3548 ? JSOP_SETCONST
3550 }
3557 }
3559 /*
3560 * Here, we are destructuring {... P: Q, ...} = R, where P is any id, Q is any
3561 * LHS expression except a destructuring initialiser, and R is on the stack.
3562 * Because R is already evaluated, the usual LHS-specialized bytecodes won't
3563 * work. After pushing R[P] we need to evaluate Q's "reference base" QB and
3564 * then push its property name QN. At this point the stack looks like
3565 *
3566 * [... R, R[P], QB, QN]
3567 *
3568 * We need to set QB[QN] = R[P]. This is a job for JSOP_ENUMELEM, which takes
3569 * its operands with left-hand side above right-hand side:
3570 *
3571 * [rval, lval, xval]
3572 *
3573 * and pops all three values, setting lval[xval] = rval. But we cannot select
3574 * JSOP_ENUMELEM yet, because the LHS may turn out to be an arg or local var,
3575 * which can be optimized further. So we select JSOP_SETNAME.
3576 */
3577 static JSBool
3579 {
3583 /* FALL THROUGH */
3587 /*
3588 * We may be called on a name node that has already been specialized,
3589 * in the very weird and ECMA-262-required "for (var [x] = i in o) ..."
3590 * case. See bug 558633.
3591 */
3601 #if JS_HAS_XML_SUPPORT
3606 }
3607 /* FALL THROUGH */
3608 #endif
3614 }
3617 }
3626 JSDHashEntryHdr hdr;
3631 #define ASSERT_VALID_PROPERTY_KEY(pnkey) \
3632 JS_ASSERT(((pnkey)->pn_arity == PN_NULLARY && \
3633 ((pnkey)->pn_type == TOK_NUMBER || \
3634 (pnkey)->pn_type == TOK_STRING || \
3635 (pnkey)->pn_type == TOK_NAME)) || \
3636 ((pnkey)->pn_arity == PN_NAME && (pnkey)->pn_type == TOK_NAME))
3638 static JSDHashNumber
3640 {
3647 }
3649 static JSBool
3653 {
3662 }
3665 JS_DHashAllocTable,
3666 JS_DHashFreeTable,
3667 HashFindPropValKey,
3668 MatchFindPropValEntry,
3669 JS_DHashMoveEntryStub,
3670 JS_DHashClearEntryStub,
3671 JS_DHashFinalizeStub,
3672 NULL
3673 };
3675 #define STEP_HASH_THRESHOLD 10
3676 #define BIG_DESTRUCTURING 5
3677 #define BIG_OBJECT_INIT 20
3681 {
3684 uint32 step;
3686 /* If we have a hash table, use it as the sole source of truth. */
3691 }
3693 /* If pn is not an object initialiser node, we can't do anything here. */
3697 /*
3698 * We must search all the way through pn's list, to handle the case of an
3699 * id duplicated for two or more property initialisers.
3700 */
3714 }
3716 }
3717 }
3727 }
3729 }
3730 }
3731 }
3735 /* Hit via full search -- see whether it's time to create the hash table. */
3745 {
3751 JS_DHASH_ADD);
3753 }
3754 }
3755 }
3757 }
3759 /*
3760 * Destructuring patterns can appear in two kinds of contexts:
3761 *
3762 * - assignment-like: assignment expressions and |for| loop heads. In
3763 * these cases, the patterns' property value positions can be
3764 * arbitrary lvalue expressions; the destructuring is just a fancy
3765 * assignment.
3766 *
3767 * - declaration-like: |var| and |let| declarations, functions' formal
3768 * parameter lists, |catch| clauses, and comprehension tails. In
3769 * these cases, the patterns' property value positions must be
3770 * simple names; the destructuring defines them as new variables.
3771 *
3772 * In both cases, other code parses the pattern as an arbitrary
3773 * primaryExpr, and then, here in CheckDestructuring, verify that the
3774 * tree is a valid destructuring expression.
3775 *
3776 * In assignment-like contexts, we parse the pattern with the
3777 * TCF_DECL_DESTRUCTURING flag clear, so the lvalue expressions in the
3778 * pattern are parsed normally. primaryExpr links variable references
3779 * into the appropriate use chains; creates placeholder definitions;
3780 * and so on. CheckDestructuring is called with |data| NULL (since we
3781 * won't be binding any new names), and we specialize lvalues as
3782 * appropriate. If right is NULL, we just check for well-formed lvalues.
3783 *
3784 * In declaration-like contexts, the normal variable reference
3785 * processing would just be an obstruction, because we're going to
3786 * define the names that appear in the property value positions as new
3787 * variables anyway. In this case, we parse the pattern with
3788 * TCF_DECL_DESTRUCTURING set, which directs primaryExpr to leave
3789 * whatever name nodes it creates unconnected. Then, here in
3790 * CheckDestructuring, we require the pattern's property value
3791 * positions to be simple names, and define them as appropriate to the
3792 * context. For these calls, |data| points to the right sort of
3793 * BindData.
3794 *
3795 * See also UndominateInitializers, immediately below. If you change
3796 * either of these functions, you might have to change the other to
3797 * match.
3798 */
3799 static JSBool
3803 {
3804 JSBool ok;
3805 FindPropValData fpvd;
3810 JSMSG_ARRAY_COMP_LEFTSIDE);
3812 }
3814 #if JS_HAS_DESTRUCTURING_SHORTHAND
3817 JSMSG_BAD_OBJECT_INIT);
3819 }
3820 #endif
3832 /* Nullary comma is an elision; binary comma is an expression.*/
3844 }
3845 }
3848 }
3853 }
3875 }
3880 }
3881 }
3883 /*
3884 * The catch/finally handler implementation in the interpreter assumes
3885 * that any operation that introduces a new scope (like a "let" or "with"
3886 * block) increases the stack depth. This way, it is possible to restore
3887 * the scope chain based on stack depth of the handler alone. "let" with
3888 * an empty destructuring pattern like in
3889 *
3890 * let [] = 1;
3891 *
3892 * would violate this assumption as the there would be no let locals to
3893 * store on the stack. To satisfy it we add an empty property to such
3894 * blocks so that OBJ_BLOCK_COUNT(cx, blockObj), which gives the number of
3895 * slots, would be always positive.
3896 *
3897 * Note that we add such a property even if the block has locals due to
3898 * later let declarations in it. We optimize for code simplicity here,
3899 * not the fastest runtime performance with empty [] or {}.
3900 */
3908 JSPROP_ENUMERATE |
3909 JSPROP_PERMANENT |
3910 JSPROP_SHARED,
3914 }
3918 out:
3923 no_var_name:
3925 JSMSG_NO_VARIABLE_NAME);
3928 }
3930 /*
3931 * This is a greatly pared down version of CheckDestructuring that extends the
3932 * pn_pos.end source coordinate of each name in a destructuring binding such as
3933 *
3934 * var [x, y] = [function () y, 42];
3935 *
3936 * to cover its corresponding initializer, so that the initialized binding does
3937 * not appear to dominate any closures in its initializer. See bug 496134.
3938 *
3939 * The quick-and-dirty dominance computation in Parser::setFunctionKinds is not
3940 * very precise. With one-pass SSA construction from structured source code
3941 * (see "Single-Pass Generation of Static Single Assignment Form for Structured
3942 * Languages", Brandis and Mössenböck), we could do much better.
3943 *
3944 * See CheckDestructuring, immediately above. If you change either of these
3945 * functions, you might have to change the other to match.
3946 */
3947 static JSBool
3949 {
3950 FindPropValData fpvd;
3956 #if JS_HAS_DESTRUCTURING_SHORTHAND
3959 JSMSG_BAD_OBJECT_INIT);
3961 }
3962 #endif
3973 /* Nullary comma is an elision; binary comma is an expression.*/
3980 }
3981 }
3985 }
4002 }
4005 }
4006 }
4008 }
4010 JSParseNode *
4012 {
4023 }
4025 /*
4026 * Currently used only #if JS_HAS_DESTRUCTURING, in Statement's TOK_FOR case.
4027 * This function assumes the cloned tree is for use in the same statement and
4028 * binding context as the original tree.
4029 */
4032 {
4047 #define NULLCHECK(e) JS_BEGIN_MACRO if (!(e)) return NULL; JS_END_MACRO
4063 }
4077 else
4090 // PN_NAME could mean several arms in pn_u, so copy the whole thing.
4093 /*
4094 * The old name is a use of its pn_lexdef. Make the clone also be a
4095 * use of that definition.
4096 */
4104 /*
4105 * If the old name is a definition, the new one has pn_defn set.
4106 * Make the old name a use of the new node.
4107 */
4111 }
4112 }
4121 // Even PN_NULLARY may have data (apair for E4X -- what a botch).
4125 #undef NULLCHECK
4126 }
4128 }
4136 {
4149 }
4160 /*
4161 * Limit recursion if pn is a binary expression, which can't contain a
4162 * var statement.
4163 */
4179 }
4181 }
4183 JSParseNode *
4185 {
4193 }
4199 #if JS_HAS_GENERATORS
4202 #endif
4204 /* This is ugly, but we don't want to require a semicolon. */
4210 #if JS_HAS_GENERATORS
4214 #endif
4215 ) {
4219 #if JS_HAS_GENERATORS
4221 #endif
4226 #if JS_HAS_GENERATORS
4228 #endif
4230 }
4233 /* As in Python (see PEP-255), disallow return v; in generators. */
4235 JSMSG_BAD_GENERATOR_RETURN,
4236 JSMSG_BAD_ANON_GENERATOR_RETURN);
4238 }
4243 JSMSG_NO_RETURN_VALUE,
4244 JSMSG_ANON_NO_RETURN_VALUE)) {
4246 }
4249 }
4254 {
4281 }
4283 #if JS_HAS_BLOCK_SCOPE
4285 JSParseNode *
4287 {
4289 JSStmtInfo stmtInfo;
4293 /* Create the let binary node. */
4300 /* This is a let block or expression of the form: let (a, b, c) .... */
4315 /*
4316 * If this is really an expression in let statement guise, then we
4317 * need to wrap the TOK_LET node in a TOK_SEMI node so that we pop
4318 * the return value of the expression.
4319 */
4328 }
4336 /*
4337 * Change pnblock's opcode to the variant that propagates the last
4338 * result down after popping the block, and clear statement.
4339 */
4344 }
4348 }
4352 static bool
4354 {
4357 }
4361 {
4373 }
4374 }
4379 /*
4380 * A let binding at top level becomes a var before we get here, so if
4381 * pn and tc have the same blockid then that id must not be the bodyid.
4382 * If pn is a forward placeholder definition from the same or a higher
4383 * block then we claim it.
4384 */
4394 }
4395 }
4397 /* Make a new node for this declarator name (or destructuring pattern). */
4402 }
4404 #if JS_HAS_BLOCK_SCOPE
4405 static bool
4407 {
4451 }
4452 }
4453 }
4464 }
4466 }
4467 }
4473 }
4476 }
4479 JSParseNode *
4481 {
4482 TokenKind tt;
4493 #if JS_HAS_XML_SUPPORT
4497 #endif
4501 /* An IF node has three kids: condition, then, and optional else. */
4521 }
4529 {
4538 /* pn1 points to the switch's discriminant. */
4546 /*
4547 * NB: we must push stmtInfo before calling GenerateBlockIdForStmtNode
4548 * because that function states tc->topStmt->blockid.
4549 */
4552 /* pn2 is a list of case nodes. The default case has pn_left == NULL */
4568 }
4570 /* FALL THROUGH */
4580 }
4585 }
4594 }
4611 }
4613 /* Fix the PN_LIST so it doesn't begin at the TOK_COLON. */
4618 }
4620 /*
4621 * Handle the case where there was a let declaration in any case in
4622 * the switch body, but not within an inner block. If it replaced
4623 * tc->blockNode with a new block node then we must refresh pn2 and
4624 * then restore tc->blockNode.
4625 */
4635 }
4671 /*
4672 * All legacy and extended versions must do automatic semicolon
4673 * insertion after do-while. See the testcase and discussion in
4674 * http://bugzilla.mozilla.org/show_bug.cgi?id=238945.
4675 */
4678 }
4682 {
4684 #if JS_HAS_BLOCK_SCOPE
4686 JSStmtInfo blockInfo;
4687 #endif
4689 /* A FOR node is binary, left is loop control and right is the body. */
4700 else
4702 }
4707 #if JS_HAS_BLOCK_SCOPE
4709 #endif
4715 /* No initializer -- set first kid of left sub-node to null. */
4718 /*
4719 * Set pn1 to a var list or an initializing expression.
4720 *
4721 * Set the TCF_IN_FOR_INIT flag during parsing of the first clause
4722 * of the for statement. This flag will be used by the RelExpr
4723 * production; if it is set, then the 'in' keyword will not be
4724 * recognized as an operator, leaving it available to be parsed as
4725 * part of a for/in loop.
4726 *
4727 * A side effect of this restriction is that (unparenthesized)
4728 * expressions involving an 'in' operator are illegal in the init
4729 * clause of an ordinary for loop.
4730 */
4735 #if JS_HAS_BLOCK_SCOPE
4748 }
4749 #endif
4752 }
4756 }
4758 /*
4759 * We can be sure that it's a for/in loop if there's still an 'in'
4760 * keyword here, even if JavaScript recognizes 'in' as an operator,
4761 * as we've excluded 'in' from being parsed in RelExpr by setting
4762 * the TCF_IN_FOR_INIT flag in our JSTreeContext.
4763 */
4768 /* Check that the left side of the 'in' is valid. */
4772 #if JS_HAS_DESTRUCTURING
4782 #endif
4783 )
4786 #if JS_HAS_DESTRUCTURING
4792 #endif
4794 #if JS_HAS_XML_SUPPORT
4797 #endif
4801 }
4803 /* pn2 points to the name or destructuring pattern on in's left. */
4808 /* Tell js_EmitTree(TOK_VAR) that pn1 is part of a for/in. */
4811 /*
4812 * Rewrite 'for (<decl> x = i in o)' where <decl> is 'let',
4813 * 'var', or 'const' to hoist the initializer or the entire
4814 * decl out of the loop head. TOK_VAR is the type for both
4815 * 'var' and 'const'.
4816 */
4819 #if JS_HAS_DESTRUCTURING
4821 #endif
4822 ) {
4829 #if JS_HAS_BLOCK_SCOPE
4831 /*
4832 * Hoist just the 'i' from 'for (let x = i in o)' to
4833 * before the loop, glued together via pnseq.
4834 */
4840 #if JS_HAS_DESTRUCTURING
4845 #endif
4846 {
4849 }
4857 {
4860 /*
4861 * All of 'var x = i' is hoisted above 'for (x in o)',
4862 * so clear PNX_FORINVAR.
4863 *
4864 * Request JSOP_POP here since the var is for a simple
4865 * name (it is not a destructuring binding's left-hand
4866 * side) and it has an initializer.
4867 */
4872 #if JS_HAS_DESTRUCTURING
4878 #endif
4879 {
4889 }
4891 }
4892 }
4893 }
4900 }
4901 #if JS_HAS_XML_SUPPORT
4904 #endif
4905 }
4909 /* Beware 'for (arguments in ...)' with or without a 'var'. */
4913 #if JS_HAS_DESTRUCTURING
4917 /* FALL THROUGH */
4920 /* Check for valid lvalues in var-less destructuring for-in. */
4925 /*
4926 * Destructuring for-in requires [key, value] enumeration
4927 * in JS1.7.
4928 */
4932 }
4934 #endif
4937 }
4939 /*
4940 * Parse the object expression as the right operand of 'in', first
4941 * removing the top statement from the statement-stack if this is a
4942 * 'for (let x in y)' loop.
4943 */
4944 #if JS_HAS_BLOCK_SCOPE
4948 #endif
4950 #if JS_HAS_BLOCK_SCOPE
4953 #endif
4964 /* Parse the loop condition or null into pn2. */
4973 }
4975 /* Parse the update expression or null into pn3. */
4984 }
4986 /* Build the FORHEAD node to use as the left kid of pn. */
4996 }
5000 /* Parse the loop body into pn->pn_right. */
5006 /* Record the absolute line number for source note emission. */
5009 #if JS_HAS_BLOCK_SCOPE
5014 }
5015 #endif
5020 }
5024 bad_for_each:
5027 }
5032 /*
5033 * try nodes are ternary.
5034 * kid1 is the try statement
5035 * kid2 is the catch node list or null
5036 * kid3 is the finally statement
5037 *
5038 * catch nodes are ternary.
5039 * kid1 is the lvalue (TOK_NAME, TOK_LB, or TOK_LC)
5040 * kid2 is the catch guard or null if no guard
5041 * kid3 is the catch block
5042 *
5043 * catch lvalue nodes are either:
5044 * TOK_NAME for a single identifier
5045 * TOK_RB or TOK_RC for a destructuring left-hand side
5046 *
5047 * finally nodes are TOK_LC statement lists.
5048 */
5075 BindData data;
5077 /* Check for another catch after unconditional catch. */
5081 }
5083 /*
5084 * Create a lexical scope node around the whole catch clause,
5085 * including the head.
5086 */
5092 /*
5093 * Legal catch forms are:
5094 * catch (lhs)
5095 * catch (lhs if <boolean_expression>)
5096 * where lhs is a name or a destructuring left-hand side.
5097 * (the latter is legal only #ifdef JS_HAS_CATCH_GUARD)
5098 */
5105 /*
5106 * Contrary to ECMA Ed. 3, the catch variable is lexically
5107 * scoped, not a property of a new Object instance. This is
5108 * an intentional change that anticipates ECMA Ed. 4.
5109 */
5117 #if JS_HAS_DESTRUCTURING
5124 #endif
5139 }
5142 #if JS_HAS_CATCH_GUARD
5143 /*
5144 * We use 'catch (x if x === 5)' (not 'catch (x : x === 5)')
5145 * to avoid conflicting with the JS2/ECMAv4 type annotation
5146 * catchguard syntax.
5147 */
5152 }
5153 #endif
5167 }
5181 }
5185 }
5187 }
5194 /* ECMA-262 Edition 3 says 'throw [no LineTerminator here] Expr'. */
5201 }
5211 /* TOK_CATCH and TOK_FINALLY are both handled in the TOK_TRY case */
5233 }
5236 }
5242 }
5245 }
5246 }
5264 }
5270 }
5272 }
5275 }
5276 }
5282 }
5285 }
5286 }
5292 /*
5293 * In most cases, we want the constructs forbidden in strict mode
5294 * code to be a subset of those that JSOPTION_STRICT warns about, and
5295 * we should use ReportStrictModeError. However, 'with' is the sole
5296 * instance of a construct that is forbidden in strict mode code, but
5297 * doesn't even merit a warning under JSOPTION_STRICT. See
5298 * https://bugzilla.mozilla.org/show_bug.cgi?id=514576#c1.
5299 */
5303 }
5331 /* Tell js_EmitTree to generate a final POP. */
5335 #if JS_HAS_BLOCK_SCOPE
5337 {
5341 /* Check for a let statement or let expression. */
5347 /* Let expressions require automatic semicolon insertion. */
5351 }
5353 /*
5354 * This is a let declaration. We must be directly under a block per
5355 * the proposed ES4 specs, but not an implicit block created due to
5356 * 'for (let ...)'. If we pass this error test, make the enclosing
5357 * JSStmtInfo be our scope. Further let declarations in this block
5358 * will find this scope statement and use the same block object.
5359 *
5360 * If we are the first let declaration in this block (i.e., when the
5361 * enclosing maybe-scope JSStmtInfo isn't yet a scope statement) then
5362 * we also need to set tc->blockNode to be our TOK_LEXICALSCOPE.
5363 */
5369 }
5376 /*
5377 * ES4 specifies that let at top level and at body-block scope
5378 * does not shadow var, so convert back to var.
5379 */
5387 }
5389 /*
5390 * Some obvious assertions here, but they may help clarify the
5391 * situation. This stmt is not yet a scope, so it must not be a
5392 * catch block (catch is a lexical scope by definition).
5393 */
5402 /* Convert the block statement into a scope statement. */
5411 /*
5412 * Insert stmt on the tc->topScopeStmt/stmtInfo.downScope linked
5413 * list stack, if it isn't already there. If it is there, but it
5414 * lacks the SIF_SCOPE flag, it must be a try, catch, or finally
5415 * block.
5416 */
5427 #ifdef DEBUG
5430 #endif
5432 /* Create a new lexical scope node for these statements. */
5444 }
5451 }
5461 {
5462 uintN oldflags;
5475 /*
5476 * If we contain a function statement and our container is top-level
5477 * or another block, flag pn to preserve braces when decompiling.
5478 */
5482 }
5485 }
5495 #if JS_HAS_DEBUGGER_KEYWORD
5505 #if JS_HAS_XML_SUPPORT
5518 }
5520 /* Is this an E4X dagger I see before me? */
5529 #endif
5535 #if JS_HAS_XML_SUPPORT
5536 expression:
5537 #endif
5547 }
5553 }
5554 }
5559 /* Push a label struct and parse the statement. */
5566 /* Normalize empty statement to empty block for the decompiler. */
5571 }
5573 /* Pop the label, set pn_expr, and return early. */
5579 }
5590 /*
5591 * Flag lambdas immediately applied as statements as instances of
5592 * the JS "module pattern". See CheckForImmediatelyAppliedLambda.
5593 */
5597 }
5600 /*
5601 * Keep track of all apparent methods created by assignments such
5602 * as this.foo = function (...) {...} in a function that could end
5603 * up a constructor function. See Parser::setFunctionKinds.
5604 */
5614 }
5617 }
5619 }
5621 /* Check termination of this primitive statement. */
5623 }
5625 static void
5627 {
5632 }
5634 JSParseNode *
5636 {
5637 TokenKind tt;
5640 BindData data;
5644 /*
5645 * The three options here are:
5646 * - TOK_LET: We are parsing a let declaration.
5647 * - TOK_LP: We are parsing the head of a let block.
5648 * - Otherwise, we're parsing var declarations.
5649 */
5654 #if JS_HAS_BLOCK_SCOPE
5657 #endif
5659 /* Make sure that statement set up the tree context correctly. */
5665 }
5667 }
5676 /*
5677 * SpiderMonkey const is really "write once per initialization evaluation"
5678 * var, whereas let is block scoped. ES-Harmony wants block-scoped const so
5679 * this code will change soon.
5680 */
5687 }
5691 #if JS_HAS_DESTRUCTURING
5705 }
5711 #if JS_HAS_BLOCK_SCOPE
5715 }
5716 #endif
5718 #if JS_HAS_BLOCK_SCOPE
5722 }
5723 #endif
5733 }
5739 }
5741 }
5758 #if JS_HAS_BLOCK_SCOPE
5762 }
5763 #endif
5765 #if JS_HAS_BLOCK_SCOPE
5769 }
5770 #endif
5780 }
5783 ? JSOP_SETNAME
5785 ? JSOP_SETGVAR
5787 ? JSOP_SETLOCAL
5789 ? JSOP_SETCONST
5794 /* The declarator's position must include the initializer. */
5802 }
5803 }
5809 bad_var_init:
5812 }
5814 JSParseNode *
5816 {
5826 #if JS_HAS_GENERATORS
5831 }
5832 #endif
5839 }
5841 }
5843 JSParseNode *
5845 {
5848 #if JS_HAS_GENERATORS
5851 #endif
5861 }
5877 #if JS_HAS_DESTRUCTURING
5880 {
5884 }
5889 }
5890 #endif
5895 #if JS_HAS_XML_SUPPORT
5900 }
5901 /* FALL THROUGH */
5902 #endif
5906 }
5912 /*
5913 * If the definition is not flagged as assigned, we must have imputed
5914 * the initialized flag to it, to optimize for flat closures. But that
5915 * optimization uses source coordinates to check dominance relations,
5916 * so we must extend the end of the definition to cover the right-hand
5917 * side of this assignment, i.e., the initializer.
5918 */
5922 }
5923 }
5926 }
5928 JSParseNode *
5930 {
5938 /*
5939 * Always accept the 'in' operator in the middle clause of a ternary,
5940 * where it's unambiguous, even if we might be parsing the init of a
5941 * for statement.
5942 */
5959 }
5961 }
5963 JSParseNode *
5965 {
5970 }
5972 JSParseNode *
5974 {
5979 }
5981 JSParseNode *
5983 {
5988 }
5990 JSParseNode *
5992 {
5996 }
5998 }
6000 JSParseNode *
6002 {
6007 }
6009 JSParseNode *
6011 {
6016 }
6018 }
6020 JSParseNode *
6022 {
6025 /*
6026 * Uses of the in operator in shiftExprs are always unambiguous,
6027 * so unset the flag that prohibits recognizing it.
6028 */
6034 /*
6035 * Recognize the 'in' token as an operator only if we're not
6036 * currently in the init expr of a for loop.
6037 */
6043 }
6044 /* Restore previous state of inForInit flag. */
6048 }
6050 JSParseNode *
6052 {
6057 }
6059 }
6061 JSParseNode *
6063 {
6071 }
6073 }
6075 JSParseNode *
6077 {
6083 }
6085 }
6090 {
6095 #if JS_HAS_XML_SUPPORT
6097 #endif
6101 }
6106 }
6110 static JSBool
6114 {
6115 JSOp op;
6137 /* FALL THROUGH */
6138 #if JS_HAS_XML_SUPPORT
6142 /* FALL THROUGH */
6143 #endif
6153 }
6156 }
6158 JSParseNode *
6160 {
6196 {
6205 /*
6206 * Under ECMA3, deleting any unary expression is valid -- it simply
6207 * returns true. Here we fold constants before checking for a call
6208 * expression, in order to rule out delete of a generator expression.
6209 */
6217 }
6221 JSMSG_DEPRECATED_DELETE_OPERAND))
6228 }
6231 }
6241 /* Don't look across a newline boundary for a postfix incop. */
6253 }
6254 }
6256 }
6258 }
6260 #if JS_HAS_GENERATORS
6262 /*
6263 * A dedicated helper for transplanting the comprehension expression E in
6264 *
6265 * [E for (V in I)] // array comprehension
6266 * (E for (V in I)) // generator expression
6267 *
6268 * from its initial location in the AST, on the left of the 'for', to its final
6269 * position on the right. To avoid a separate pass we do this by adjusting the
6270 * blockids and name binding links that were established when E was parsed.
6271 *
6272 * A generator expression desugars like so:
6273 *
6274 * (E for (V in I)) => (function () { for (var V in I) yield E; })()
6275 *
6276 * so the transplanter must adjust static level as well as blockid. E's source
6277 * coordinates in root->pn_pos are critical to deciding which binding links to
6278 * preserve and which to cut.
6279 *
6280 * NB: This is not a general tree transplanter -- it knows in particular that
6281 * the one or more bindings induced by V have not yet been created.
6282 */
6287 uintN adjust;
6288 uintN funcLevel;
6293 {
6294 }
6297 };
6299 /*
6300 * Any definitions nested within the comprehension expression of a generator
6301 * expression must move "down" one static level, which of course increases the
6302 * upvar-frame-skip count.
6303 */
6304 static bool
6306 {
6315 }
6318 }
6320 }
6322 static void
6324 {
6329 }
6331 bool
6333 {
6354 /* Binary TOK_COLON nodes can have left == right. See bug 492714. */
6364 {
6365 /*
6366 * Only the first level of transplant recursion through functions needs
6367 * to reparent the funbox, since all descendant functions are correctly
6368 * linked under the top-most funbox. But every visit to this case needs
6369 * to update funbox->level.
6370 *
6371 * Recall that funbox->level is the static level of the code containing
6372 * the definition or expression of the function and not the static level
6373 * of the function's body.
6374 */
6390 }
6391 /* FALL THROUGH */
6392 }
6409 /*
6410 * Adjust the definition's block id only if it is a placeholder not
6411 * to the left of the root node, and if pn is the last use visited
6412 * in the comprehension expression (to avoid adjusting the blockid
6413 * multiple times).
6414 *
6415 * Non-placeholder definitions within the comprehension expression
6416 * will be visited further below.
6417 */
6422 }
6425 #ifdef DEBUG
6428 #endif
6455 }
6461 }
6464 }
6465 }
6466 }
6475 }
6477 }
6479 /*
6480 * Starting from a |for| keyword after the first array initialiser element or
6481 * an expression in an open parenthesis, parse the tail of the comprehension
6482 * or generator expression signified by this |for| keyword in context.
6483 *
6484 * Return null on failure, else return the top-most parse node for the array
6485 * comprehension or generator expression, with a unary node as the body of the
6486 * (possibly nested) for-loop, initialized by |type, op, kid|.
6487 */
6488 JSParseNode *
6491 {
6492 uintN adjust;
6494 JSStmtInfo stmtInfo;
6495 BindData data;
6496 TokenKind tt;
6502 /*
6503 * Generator expression desugars to an immediately applied lambda that
6504 * yields the next value from a for-in loop (possibly nested, and with
6505 * optional if guard). Make pn be the TOK_LC body node.
6506 */
6514 /*
6515 * Make a parse-node and literal object representing the block scope of
6516 * this array comprehension. Our caller in primaryExpr, the TOK_LB case
6517 * aka the array initialiser case, has passed the blockid to claim for
6518 * the comprehension's block scope. We allocate that id or one above it
6519 * here, by calling js_PushLexicalScope.
6520 *
6521 * In the case of a comprehension expression that has nested blocks
6522 * (e.g., let expressions), we will allocate a higher blockid but then
6523 * slide all blocks "to the right" to make room for the comprehension's
6524 * block scope.
6525 */
6537 }
6550 /*
6551 * FOR node is binary, left is loop control and right is body. Use
6552 * index to count each block-local let-variable on the left-hand side
6553 * of the IN.
6554 */
6564 else
6566 }
6572 #if JS_HAS_DESTRUCTURING
6581 #endif
6586 /*
6587 * Create a name node with pn_op JSOP_NAME. We can't set pn_op to
6588 * JSOP_GETLOCAL here, because we don't yet know the block's depth
6589 * in the operand stack frame. The code generator computes that,
6590 * and it tries to bind all names to slots, so we must let it do
6591 * the deed.
6592 */
6603 }
6612 #if JS_HAS_DESTRUCTURING
6619 /* Destructuring requires [key, value] enumeration in JS1.7. */
6623 }
6629 }
6631 #endif
6640 }
6658 }
6670 }
6672 #if JS_HAS_GENERATOR_EXPRS
6674 /*
6675 * Starting from a |for| keyword after an expression, parse the comprehension
6676 * tail completing this generator expression. Wrap the expression at kid in a
6677 * generator function that is immediately called to evaluate to the generator
6678 * iterator that is the value of this generator expression.
6679 *
6680 * Callers pass a blank unary node via pn, which generatorExpr fills in as the
6681 * yield expression, which ComprehensionTail in turn wraps in a TOK_SEMI-type
6682 * expression-statement node that constitutes the body of the |for| loop(s) in
6683 * the generator function.
6684 *
6685 * Note how unlike Python, we do not evaluate the expression to the right of
6686 * the first |in| in the chain of |for| heads. Instead, a generator expression
6687 * is merely sugar for a generator function expression and its application.
6688 */
6689 JSParseNode *
6691 {
6692 /* Initialize pn, connecting it to kid. */
6701 /* Make a new node for the desugared generator function. */
6710 {
6718 /*
6719 * We have to dance around a bit to propagate sharp variables from
6720 * outertc to gentc before setting TCF_HAS_SHARPS implicitly by
6721 * propagating all of outertc's TCF_FUN_FLAGS flags. As below, we have
6722 * to be conservative by leaving TCF_HAS_SHARPS set in outertc if we
6723 * do propagate to gentc.
6724 */
6729 }
6731 /*
6732 * We assume conservatively that any deoptimization flag in tc->flags
6733 * besides TCF_FUN_PARAM_ARGUMENTS can come from the kid. So we
6734 * propagate these flags into genfn. For code simplicity we also do
6735 * not detect if the flags were only set in the kid and could be
6736 * removed from tc->flags.
6737 */
6754 }
6756 /*
6757 * Our result is a call expression that invokes the anonymous generator
6758 * function object.
6759 */
6768 }
6775 JSBool
6777 {
6785 #if JS_HAS_GENERATORS
6791 }
6792 #endif
6793 #if JS_HAS_GENERATOR_EXPRS
6804 js_generator_str);
6806 }
6807 }
6808 #endif
6815 }
6817 }
6819 /* Check for an immediately-applied (new'ed) lambda and clear PND_FUNARG. */
6822 {
6830 }
6832 }
6834 JSParseNode *
6836 {
6841 /* Check for new expression first. */
6859 JSMSG_TOO_MANY_CON_ARGS);
6861 }
6881 }
6882 }
6889 #if JS_HAS_XML_SUPPORT
6895 /* Check both tt and pn_type, to distinguish |x.(y)| and |x.y::z| from |x.y|. */
6906 /* A filtering predicate is like a with statement. */
6914 }
6918 }
6919 #else
6924 #endif
6927 #if JS_HAS_XML_SUPPORT
6944 }
6950 #endif
6963 /*
6964 * Optimize o['p'] to o.p by rewriting pn2, but avoid rewriting
6965 * o['0'] to use JSOP_GETPROP, to keep fast indexing disjoint in
6966 * the interpreter from fast property access. However, if the
6967 * bracketed string is a uint32, we rewrite pn3 to be a number
6968 * instead of a string.
6969 */
6972 jsuint index;
6981 }
6985 }
6999 /* Select JSOP_EVAL and flag tc as heavyweight. */
7002 }
7006 /* Select JSOP_APPLY given foo.apply(...). */
7008 }
7009 }
7018 JSMSG_TOO_MANY_FUN_ARGS);
7020 }
7025 }
7028 }
7032 }
7034 JSParseNode *
7036 {
7037 uintN oldflags;
7040 /*
7041 * Always accept the 'in' operator in a parenthesized expression,
7042 * where it's unambiguous, even if we might be parsing the init of a
7043 * for statement.
7044 */
7050 }
7052 #if JS_HAS_XML_SUPPORT
7054 JSParseNode *
7056 {
7065 }
7067 /*
7068 * From the ECMA-357 grammar in 11.1.1 and 11.1.2:
7069 *
7070 * AttributeIdentifier:
7071 * @ PropertySelector
7072 * @ QualifiedIdentifier
7073 * @ [ Expression ]
7074 *
7075 * PropertySelector:
7076 * Identifier
7077 * *
7078 *
7079 * QualifiedIdentifier:
7080 * PropertySelector :: PropertySelector
7081 * PropertySelector :: [ Expression ]
7082 *
7083 * We adapt AttributeIdentifier and QualifiedIdentier to be LL(1), like so:
7084 *
7085 * AttributeIdentifier:
7086 * @ QualifiedIdentifier
7087 * @ [ Expression ]
7088 *
7089 * PropertySelector:
7090 * Identifier
7091 * *
7092 *
7093 * QualifiedIdentifier:
7094 * PropertySelector :: PropertySelector
7095 * PropertySelector :: [ Expression ]
7096 * PropertySelector
7097 *
7098 * As PrimaryExpression: Identifier is in ECMA-262 and we want the semantics
7099 * for that rule to result in a name node, but ECMA-357 extends the grammar
7100 * to include PrimaryExpression: QualifiedIdentifier, we must factor further:
7101 *
7102 * QualifiedIdentifier:
7103 * PropertySelector QualifiedSuffix
7104 *
7105 * QualifiedSuffix:
7106 * :: PropertySelector
7107 * :: [ Expression ]
7108 * /nothing/
7109 *
7110 * And use this production instead of PrimaryExpression: QualifiedIdentifier:
7111 *
7112 * PrimaryExpression:
7113 * Identifier QualifiedSuffix
7114 *
7115 * We hoist the :: match into callers of QualifiedSuffix, in order to tweak
7116 * PropertySelector vs. Identifier pn_arity, pn_op, and other members.
7117 */
7118 JSParseNode *
7120 {
7136 }
7138 }
7140 JSParseNode *
7142 {
7144 TokenKind tt;
7151 /* Left operand of :: must be evaluated if it is an identifier. */
7157 /* Inline and specialize propertySelector for JSOP_QNAMECONST. */
7166 }
7171 }
7183 }
7185 JSParseNode *
7187 {
7194 /* Hack for bug 496316. Slowing down E4X won't make it go away, alas. */
7197 }
7199 }
7201 JSParseNode *
7203 {
7205 TokenKind tt;
7220 }
7225 }
7227 /*
7228 * Make a TOK_LC unary node whose pn_kid is an expression.
7229 */
7230 JSParseNode *
7232 {
7240 /*
7241 * Turn off XML tag mode. We save the old value of the flag because it may
7242 * already be off: XMLExpr is called both from within a tag, and from
7243 * within text contained in an element, but outside of any start, end, or
7244 * point tag.
7245 */
7257 }
7259 /*
7260 * Make a terminal node for one of TOK_XMLNAME, TOK_XMLATTR, TOK_XMLSPACE,
7261 * TOK_XMLTEXT, TOK_XMLCDATA, TOK_XMLCOMMENT, or TOK_XMLPI. When converting
7262 * parse tree to XML, we preserve a TOK_XMLSPACE node only if it's the sole
7263 * child of a container tag.
7264 */
7265 JSParseNode *
7267 {
7277 }
7279 /*
7280 * Parse the productions:
7281 *
7282 * XMLNameExpr:
7283 * XMLName XMLNameExpr?
7284 * { Expr } XMLNameExpr?
7285 *
7286 * Return a PN_LIST, PN_UNARY, or PN_NULLARY according as XMLNameExpr produces
7287 * a list of names and/or expressions, a single expression, or a single name.
7288 * If PN_LIST or PN_NULLARY, pn_type will be TOK_XMLNAME; if PN_UNARY, pn_type
7289 * will be TOK_LC.
7290 */
7291 JSParseNode *
7293 {
7295 TokenKind tt;
7309 }
7323 }
7326 }
7331 }
7333 /*
7334 * Macro to test whether an XMLNameExpr or XMLTagContent node can be folded
7335 * at compile time into a JSXML tree.
7336 */
7337 #define XML_FOLDABLE(pn) ((pn)->pn_arity == PN_LIST \
7338 ? ((pn)->pn_xflags & PNX_CANTFOLD) == 0 \
7339 : (pn)->pn_type != TOK_LC)
7341 /*
7342 * Parse the productions:
7343 *
7344 * XMLTagContent:
7345 * XMLNameExpr
7346 * XMLTagContent S XMLNameExpr S? = S? XMLAttr
7347 * XMLTagContent S XMLNameExpr S? = S? { Expr }
7348 *
7349 * Return a PN_LIST, PN_UNARY, or PN_NULLARY according to how XMLTagContent
7350 * produces a list of name and attribute values and/or braced expressions, a
7351 * single expression, or a single name.
7352 *
7353 * If PN_LIST or PN_NULLARY, pn_type will be TOK_XMLNAME for the case where
7354 * XMLTagContent: XMLNameExpr. If pn_type is not TOK_XMLNAME but pn_arity is
7355 * PN_LIST, pn_type will be tagtype. If PN_UNARY, pn_type will be TOK_LC and
7356 * we parsed exactly one expression.
7357 */
7358 JSParseNode *
7360 {
7362 TokenKind tt;
7375 }
7388 }
7406 }
7411 }
7414 }
7416 #define XML_CHECK_FOR_ERROR_AND_EOF(tt,result) \
7417 JS_BEGIN_MACRO \
7418 if ((tt) <= TOK_EOF) { \
7419 if ((tt) == TOK_EOF) { \
7420 reportErrorNumber(NULL, JSREPORT_ERROR, JSMSG_END_OF_XML_SOURCE); \
7421 } \
7422 return result; \
7423 } \
7424 JS_END_MACRO
7426 /*
7427 * Consume XML element tag content, including the TOK_XMLETAGO (</) sequence
7428 * that opens the end tag for the container.
7429 */
7430 JSBool
7432 {
7441 /* Non-zero-length XML text scanned. */
7447 }
7463 }
7468 }
7473 }
7478 }
7480 /*
7481 * Return a PN_LIST node containing an XML or XMLList Initialiser.
7482 */
7483 JSParseNode *
7485 {
7487 TokenKind tt;
7503 /*
7504 * XMLElement. Append the tag and its contents, if any, to pn.
7505 */
7513 /* Point tag (/>): recycle pn if pn2 is a list of tag contents. */
7524 }
7528 /* We had better have a tag-close (>) at this point. */
7532 }
7535 /* Make sure pn2 is a TOK_XMLSTAGO list containing tag contents. */
7544 }
7546 /* Now make pn a nominal-root TOK_XMLELEM list containing pn2. */
7554 /* Get element contents and delimiting end-tag-open sequence. */
7563 }
7565 /* Parse end tag; check mismatch at compile-time if we can. */
7570 /* Oops, end tag has attributes! */
7573 }
7577 /* End vs. start tag name mismatch: point to the tag name. */
7581 }
7583 /* Make a TOK_XMLETAGO list with pn2 as its single child. */
7594 }
7598 }
7600 /* Set pn_op now that pn has been updated to its final value. */
7603 /* XMLList Initialiser. */
7615 }
7620 }
7622 JSParseNode *
7624 {
7625 uint32 oldopts;
7628 /*
7629 * Force XML support to be enabled so that comments and CDATA literals
7630 * are recognized, instead of <! followed by -- starting an HTML comment
7631 * to end of line (used in script tags to hide content from old browsers
7632 * that don't recognize <script>).
7633 */
7638 }
7640 JSParseNode *
7642 {
7643 /*
7644 * Push a compiler frame if we have no frames, or if the top frame is a
7645 * lightweight function activation, or if its scope chain doesn't match
7646 * the one passed to us.
7647 */
7651 /* Set XML-only mode to turn off special treatment of {expr} in XML. */
7661 }
7665 }
7669 #if JS_HAS_BLOCK_SCOPE
7670 /*
7671 * Check whether blockid is an active scoping statement in tc. This code is
7672 * necessary to qualify tc->decls.lookup() hits in primaryExpr's TOK_NAME case
7673 * (below) where the hits come from Scheme-ish let bindings in for loop heads
7674 * and let blocks and expressions (not let declarations).
7675 *
7676 * Unlike let declarations ("let as the new var"), which is a kind of letrec
7677 * due to hoisting, let in a for loop head, let block, or let expression acts
7678 * like Scheme's let: initializers are evaluated without the new let bindings
7679 * being in scope.
7680 *
7681 * Name binding analysis is eager with fixups, rather than multi-pass, and let
7682 * bindings push on the front of the tc->decls JSAtomList (either the singular
7683 * list or on a hash chain -- see JSAtomList::AddHow) in order to shadow outer
7684 * scope bindings of the same name.
7685 *
7686 * This simplifies binding lookup code at the price of a linear search here,
7687 * but only if code uses let (var predominates), and even then this function's
7688 * loop iterates more than once only in crazy cases.
7689 */
7692 {
7698 }
7700 }
7701 #endif
7703 JSParseNode *
7705 {
7707 JSOp op;
7713 #if JS_HAS_XML_SUPPORT
7723 }
7724 #endif
7731 {
7732 JSBool matched;
7733 jsuint index;
7742 #if JS_HAS_GENERATORS
7744 #endif
7752 }
7758 }
7761 /* So CURRENT_TOKEN gets TOK_COMMA and not TOK_LB. */
7767 }
7773 /* If we didn't already match TOK_COMMA in above case. */
7776 }
7777 }
7779 #if JS_HAS_GENERATORS
7780 /*
7781 * At this point, (index == 0 && pn->pn_count != 0) implies one
7782 * element initialiser was parsed.
7783 *
7784 * An array comprehension of the form:
7785 *
7786 * [i * j for (i in o) for (j in p) if (i != j)]
7787 *
7788 * translates to roughly the following let expression:
7789 *
7790 * let (array = new Array, i, j) {
7791 * for (i in o) let {
7792 * for (j in p)
7793 * if (i != j)
7794 * array.push(i * j)
7795 * }
7796 * array
7797 * }
7798 *
7799 * where array is a nameless block-local variable. The "roughly"
7800 * means that an implementation may optimize away the array.push.
7801 * An array comprehension opens exactly one block scope, no matter
7802 * how many for heads it contains.
7803 *
7804 * Each let () {...} or for (let ...) ... compiles to:
7805 *
7806 * JSOP_ENTERBLOCK <o> ... JSOP_LEAVEBLOCK <n>
7807 *
7808 * where <o> is a literal object representing the block scope,
7809 * with <n> properties, naming each var declared in the block.
7810 *
7811 * Each var declaration in a let-block binds a name in <o> at
7812 * compile time, and allocates a slot on the operand stack at
7813 * runtime via JSOP_ENTERBLOCK. A block-local var is accessed
7814 * by the JSOP_GETLOCAL and JSOP_SETLOCAL ops, and iterated with
7815 * JSOP_FORLOCAL. These ops all have an immediate operand, the
7816 * local slot's stack index from fp->spbase.
7817 *
7818 * The array comprehension iteration step, array.push(i * j) in
7819 * the example above, is done by <i * j>; JSOP_ARRAYCOMP <array>,
7820 * where <array> is the index of array's stack slot.
7821 */
7825 /* Relabel pn as an array comprehension node. */
7828 /*
7829 * Remove the comprehension expression from pn's linked list
7830 * and save it via pnexp. We'll re-install it underneath the
7831 * ARRAYPUSH node after we parse the rest of the comprehension.
7832 */
7845 }
7849 }
7852 }
7855 {
7856 JSBool afterComma;
7859 /*
7860 * A map from property names we've seen thus far to bit masks.
7861 * (We use ALE_INDEX/ALE_SET_INDEX). An atom's mask includes
7862 * JSPROP_SETTER if we've seen a setter for it, JSPROP_GETTER
7863 * if we've seen as getter, and both of those if we've just
7864 * seen an ordinary value.
7865 */
7891 }
7894 {
7900 else
7920 }
7924 }
7926 /* We have to fake a 'function' token here. */
7931 }
7932 property_name:
7945 }
7952 #if JS_HAS_DESTRUCTURING_SHORTHAND
7954 #endif
7957 #if JS_HAS_DESTRUCTURING_SHORTHAND
7958 }
7960 /*
7961 * Support, e.g., |var {x, y} = o| as destructuring shorthand
7962 * for |var {x: x, y: y} = o|, per proposed JS2/ES4 for JS1.8.
7963 */
7970 }
7971 #endif
7972 }
7975 skip:
7980 /*
7981 * In strict mode code, check for duplicate property names. Treat
7982 * getters and setters as distinct attributes of each property. A
7983 * plain old value conflicts with a getter or a setter.
7984 */
7996 }
7998 /*
7999 * Use only string-valued atoms for detecting duplicate
8000 * properties so that 1 and "1" properly collide.
8001 */
8009 }
8019 }
8020 }
8027 }
8028 }
8036 }
8038 }
8040 end_obj_init:
8043 }
8045 #if JS_HAS_BLOCK_SCOPE
8051 #endif
8053 #if JS_HAS_SHARP_VARS
8070 }
8076 /* Check for forward/dangling references at runtime, to allow eval. */
8087 {
8088 JSBool genexp;
8097 }
8099 #if JS_HAS_XML_SUPPORT
8120 #if JS_HAS_SHARP_VARS
8121 /* FALL THROUGH */
8122 #endif
8124 #if JS_HAS_XML_SUPPORT
8128 #endif
8133 #if JS_HAS_XML_SUPPORT
8136 else
8137 #endif
8150 /*
8151 * Flag arguments usage so we can avoid unsafe optimizations such
8152 * as formal parameter assignment analysis (because of the hated
8153 * feature whereby arguments alias formals). We do this even for
8154 * a reference of the form foo.arguments, which ancient code may
8155 * still use instead of arguments (more hate).
8156 */
8159 /*
8160 * Bind early to JSOP_ARGUMENTS to relieve later code from having
8161 * to do this work (new rule for the emitter to count on).
8162 */
8166 }
8168 #if JS_HAS_XML_SUPPORT
8170 #endif
8179 #if JS_HAS_BLOCK_SCOPE
8180 /*
8181 * Skip out-of-scope let bindings along an ALE list or hash
8182 * chain. These can happen due to |let (x = x) x| block and
8183 * expression bindings, where the x on the right of = comes
8184 * from an outer scope. See bug 496532.
8185 */
8193 }
8194 #endif
8195 }
8204 /*
8205 * No definition before this use in any lexical scope.
8206 * Add a mapping in tc->lexdeps from pn->pn_atom to a
8207 * new node for the forward-referenced definition. This
8208 * placeholder definition node will be adopted when we
8209 * parse the real defining declaration form, or left as
8210 * a free variable definition if we never see the real
8211 * definition.
8212 */
8218 /*
8219 * In case this is a forward reference to a function,
8220 * we pessimistically set PND_FUNARG if the next token
8221 * is not a left parenthesis.
8222 *
8223 * If the definition eventually parsed into dn is not a
8224 * function, this flag won't hurt, and if we do parse a
8225 * function with pn's name, then the PND_FUNARG flag is
8226 * necessary for safe context->display-based optimiza-
8227 * tion of the closure's static link.
8228 */
8233 }
8234 }
8239 /* Here we handle the backward function reference case. */
8244 }
8245 }
8247 #if JS_HAS_XML_SUPPORT
8252 /*
8253 * Here primaryExpr is called after . or .. followed by a name
8254 * followed by ::. This is the only case where a keyword after
8255 * . or .. is not treated as a property name.
8256 */
8265 }
8266 }
8270 }
8271 #endif
8275 {
8291 }
8299 }
8317 /* The scanner or one of its subroutines reported the error. */
8323 }
8325 }
8327 JSParseNode *
8329 {
8330 TokenPtr begin;
8342 #if JS_HAS_GENERATOR_EXPRS
8347 }
8350 js_generator_str);
8352 }
8357 }
8365 js_generator_str);
8367 }
8370 }
8371 }
8375 }
8377 /*
8378 * Fold from one constant type to another.
8379 * XXX handles only strings and numbers for now
8380 */
8381 static JSBool
8383 {
8388 jsdouble d;
8394 }
8407 }
8411 }
8412 }
8414 }
8416 /*
8417 * Fold two numeric constants. Beware that pn1 and pn2 are recycled, unless
8418 * one of them aliases pn, so you can't safely fetch pn2->pn_next, e.g., after
8419 * a successful call to this function.
8420 */
8421 static JSBool
8424 {
8460 #if defined(XP_WIN)
8461 /* XXX MSVC miscompiles such that (NaN == 0) */
8464 else
8465 #endif
8470 else
8474 }
8482 }
8486 }
8488 /* Take care to allow pn1 or pn2 to alias pn. */
8498 }
8500 #if JS_HAS_XML_SUPPORT
8502 static JSBool
8504 {
8505 TokenKind tt;
8520 }
8522 /*
8523 * GC Rooting here is tricky: for most of the loop, |accum| is safe via
8524 * the newborn string root. However, when |pn2->pn_type| is TOK_XMLCDATA,
8525 * TOK_XMLCOMMENT, or TOK_XMLPI it is knocked out of the newborn root.
8526 * Therefore, we have to add additonal protection from GC nesting under
8527 * js_ConcatStrings.
8528 */
8530 /* The parser already rejected end-tags with attributes. */
8536 /* FALL THROUGH */
8565 cantfold:
8570 #ifdef DEBUG_brendanXXX
8574 else
8577 #endif
8582 }
8591 }
8596 }
8599 {
8604 }
8607 #ifdef DEBUG_brendanXXX
8611 #endif
8613 }
8615 }
8624 }
8629 }
8635 }
8644 }
8647 /*
8648 * Only one node under pn, and it has been folded: move pn1 onto pn
8649 * unless pn is an XML root (in which case we need it to tell the code
8650 * generator to emit a JSOP_TOXML or JSOP_TOXMLLIST op). If pn is an
8651 * XML root *and* it's a point-tag, rewrite it to TOK_XMLELEM to avoid
8652 * extra "<" and "/>" bracketing at runtime.
8653 */
8659 }
8660 }
8662 }
8666 static int
8668 {
8676 #if JS_HAS_GENERATOR_EXPRS
8678 {
8679 /*
8680 * A generator expression as an if or loop condition has no effects, it
8681 * simply results in a truthy object reference. This condition folding
8682 * is needed for the decompiler. See bug 442342 and bug 443074.
8683 */
8691 /* FALL THROUGH */
8692 }
8693 #endif
8706 }
8708 }
8710 JSBool
8712 {
8719 {
8731 }
8734 {
8735 /* Propagate inCond through logical connectives. */
8738 /* Don't fold a parenthesized call expression. See bug 537673. */
8743 /* Save the list head in pn1 for later use. */
8747 }
8749 }
8752 /* Any kid may be null (e.g. for (;;)). */
8764 }
8765 }
8774 /* Propagate inCond through logical connectives. */
8781 }
8783 /* First kid may be null (for default case in switch). */
8793 /*
8794 * Kludge to deal with typeof expressions: because constant folding
8795 * can turn an expression into a name node, we have to check here,
8796 * before folding, to see if we should throw undefined name errors.
8797 *
8798 * NB: We know that if pn->pn_op is JSOP_TYPEOF, pn1 will not be
8799 * null. This assumption does not hold true for other unary
8800 * expressions.
8801 */
8810 /*
8811 * Skip pn1 down along a chain of dotted member expressions to avoid
8812 * excessive recursion. Our only goal here is to fold constants (if
8813 * any) in the primary expression operand to the left of the first
8814 * dot in the chain.
8815 */
8822 }
8833 }
8839 /* FALL THROUGH */
8842 /* Reduce 'if (C) T; else E' into T for true C, E for false. */
8858 }
8859 /* FALL THROUGH */
8861 /* Early return to dodge common code that copies pn2 to pn. */
8863 }
8865 #if JS_HAS_GENERATOR_EXPRS
8866 /* Don't fold a trailing |if (0)| in a generator expression. */
8869 #endif
8874 /*
8875 * False condition and no else, or an empty then-statement was
8876 * moved up over pn. Either way, make pn an empty block (not an
8877 * empty statement, which does not decompile, even when labeled).
8878 * NB: pn must be a TOK_IF as TOK_HOOK can never have a null kid
8879 * or an empty statement for a child.
8880 */
8884 }
8903 }
8906 }
8916 }
8919 // We may have to change arity from LIST to BINARY.
8931 }
8941 }
8942 }
8943 }
8947 /*
8948 * Compound operators such as *= should be subject to folding, in case
8949 * the left-hand side is constant, and so that the decompiler produces
8950 * the same string that you get from decompiling a script or function
8951 * compiled from that same string. As with +, += is special.
8952 */
8957 /* FALL THROUGH */
8965 /*
8966 * Any string literal term with all others number or string means
8967 * this is a concatenation. If any term is not a string or number
8968 * literal, we can't fold.
8969 */
8976 /* Ok, we're concatenating: convert non-string constant operands. */
8981 /* XXX fold only if all operands convert to string */
8985 }
8987 /* Allocate a new buffer and string descriptor for the result. */
8995 }
8997 /* Fill the buffer, advancing chars and recycling kids as we go. */
9003 }
9006 /* Atomize the result string and mutate pn to refer to it. */
9014 }
9016 /* Handle a binary string concatenation. */
9022 TOK_STRING)) {
9024 }
9041 }
9043 /* Can't concatenate string literals, let's try numbers. */
9050 do_binary_op:
9056 }
9058 /* XXX fold only if all operands convert to number */
9061 }
9073 }
9074 }
9080 }
9084 }
9085 }
9090 jsdouble d;
9092 /* Operate on one numeric constant. */
9110 /* FALL THROUGH */
9113 /* Return early to dodge the common TOK_NUMBER code. */
9115 }
9128 }
9129 }
9132 #if JS_HAS_XML_SUPPORT
9143 }
9148 jsval v;
9165 }
9170 }
9190 }
9194 }
9195 }
9198 }