| blob | d36ce1dae23064ee7db54655018d64d19dba6ca1 |
1 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
2 * vim: set ts=8 sw=4 et tw=99:
3 *
4 * ***** BEGIN LICENSE BLOCK *****
5 * Version: MPL 1.1/GPL 2.0/LGPL 2.1
6 *
7 * The contents of this file are subject to the Mozilla Public License Version
8 * 1.1 (the "License"); you may not use this file except in compliance with
9 * the License. You may obtain a copy of the License at
10 * http://www.mozilla.org/MPL/
11 *
12 * Software distributed under the License is distributed on an "AS IS" basis,
13 * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
14 * for the specific language governing rights and limitations under the
15 * License.
16 *
17 * The Original Code is Mozilla Communicator client code, released
18 * March 31, 1998.
19 *
20 * The Initial Developer of the Original Code is
21 * Netscape Communications Corporation.
22 * Portions created by the Initial Developer are Copyright (C) 1998
23 * the Initial Developer. All Rights Reserved.
24 *
25 * Contributor(s):
26 *
27 * Alternatively, the contents of this file may be used under the terms of
28 * either of the GNU General Public License Version 2 or later (the "GPL"),
29 * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
30 * in which case the provisions of the GPL or the LGPL are applicable instead
31 * of those above. If you wish to allow use of your version of this file only
32 * under the terms of either the GPL or the LGPL, and not to allow others to
33 * use your version of this file under the terms of the MPL, indicate your
34 * decision by deleting the provisions above and replace them with the notice
35 * and other provisions required by the GPL or the LGPL. If you do not delete
36 * the provisions above, a recipient may use your version of this file under
37 * the terms of any one of the MPL, the GPL or the LGPL.
38 *
39 * ***** END LICENSE BLOCK ***** */
41 /*
42 * JS parser.
43 *
44 * This is a recursive-descent parser for the JavaScript language specified by
45 * "The JavaScript 1.5 Language Specification". It uses lexical and semantic
46 * feedback to disambiguate non-LL(1) structures. It generates trees of nodes
47 * induced by the recursive parsing (not precise syntax trees, see jsparse.h).
48 * After tree construction, it rewrites trees to fold constants and evaluate
49 * compile-time expressions. Finally, it calls js_EmitTree (see jsemit.h) to
50 * generate bytecode.
51 *
52 * This parser attempts no error recovery.
53 */
54 #include <stdlib.h>
55 #include <string.h>
56 #include <math.h>
83 #if JS_HAS_XML_SUPPORT
85 #endif
87 #if JS_HAS_DESTRUCTURING
89 #endif
93 /*
94 * Asserts to verify assumptions behind pn_ macros.
95 */
96 #define pn_offsetof(m) offsetof(JSParseNode, m)
101 #undef pn_offsetof
103 /*
104 * Insist that the next token be of type tt, or report errno and return null.
105 * NB: this macro uses cx and ts from its lexical environment.
106 */
107 #define MUST_MATCH_TOKEN_WITH_FLAGS(tt, errno, __flags) \
108 JS_BEGIN_MACRO \
109 if (tokenStream.getToken((__flags)) != tt) { \
110 reportErrorNumber(NULL, JSREPORT_ERROR, errno); \
111 return NULL; \
112 } \
113 JS_END_MACRO
114 #define MUST_MATCH_TOKEN(tt, errno) MUST_MATCH_TOKEN_WITH_FLAGS(tt, errno, 0)
116 #ifdef METER_PARSENODES
120 #endif
122 void
124 {
138 }
140 /* If this is a function node fix up the pn_funbox->node back-pointer. */
150 }
152 void
154 {
160 }
162 bool
165 {
172 }
174 }
177 {
184 }
186 void
188 {
193 }
195 JSObjectBox *
197 {
200 /*
201 * We use JSContext.tempPool to allocate parsed objects and place them on
202 * a list in this Parser to ensure GC safety. Thus the tempPool arenas
203 * containing the entries must be alive until we are done with scanning,
204 * parsing and code generation for the whole script or top-level function.
205 */
211 }
217 }
219 JSFunctionBox *
221 {
225 /*
226 * We use JSContext.tempPool to allocate parsed objects and place them on
227 * a list in this Parser to ensure GC safety. Thus the tempPool arenas
228 * containing the entries must be alive until we are done with scanning,
229 * parsing and code generation for the whole script or top-level function.
230 */
236 }
254 }
255 }
259 }
261 bool
263 {
266 }
268 bool
270 {
277 }
278 }
280 }
282 void
284 {
289 }
290 }
292 static void
295 static void
297 {
304 /*
305 * Remove pn from funbox->parent's methods list if it's there. See
306 * the TOK_SEMI case in Statement, near the bottom, the TOK_ASSIGN
307 * sub-case matching a constructor method assignment pattern.
308 */
316 }
318 }
319 }
326 }
328 }
340 // FIXME: use a funbox freelist (consolidate aleFreeList and nodeList).
342 }
343 }
345 static void
347 {
376 }
377 }
378 }
380 static void
385 {
391 /* Catch back-to-back dup recycles. */
395 /*
396 * JSAtomLists own definition nodes along with their used-node chains.
397 * Defer recycling such nodes until we unwind to top level to avoid
398 * linkage overhead or (alternatively) unlinking runtime complexity.
399 * Yes, this means dead code can contribute to static analysis results!
400 *
401 * Do recycle kids here, since they are no longer needed.
402 */
410 #ifdef METER_PARSENODES
411 recyclednodes++;
412 #endif
413 }
415 }
417 static void
419 {
423 /* FALL THROUGH */
426 /*
427 * Only a definition node might have a non-null strong pn_expr link
428 * to recycle, but we test !pn_used to handle PN_FUNC fall through.
429 * Every node with the pn_used flag set has a non-null pn_lexdef
430 * weak reference to its definition node.
431 */
435 }
440 }
441 }
443 /*
444 * Allocate a JSParseNode from tc's node freelist or, failing that, from cx's
445 * temporary arena.
446 */
449 {
462 /* Recycle immediate descendents only, to save work and working set. */
480 #ifdef METER_PARSENODES
482 #endif
484 }
485 }
506 }
507 }
509 #ifdef METER_PARSENODES
510 parsenodes++;
513 #endif
517 }
519 }
521 /* used only by static create methods of subclasses */
523 JSParseNode *
525 {
533 }
535 JSParseNode *
538 {
544 /*
545 * Flatten a left-associative (left-heavy) tree of a given operator into
546 * a list, to reduce js_FoldConstants and js_EmitTree recursion.
547 */
566 }
567 }
575 }
577 }
579 /*
580 * Fold constant addition immediately, to conserve node space and, what's
581 * more, so js_FoldConstants never sees mixed addition and concatenation
582 * operations with more than one leading non-string operand in a PN_LIST
583 * generated for expressions such as 1 + 2 + "pt" (which should evaluate
584 * to "3pt", not "12pt").
585 */
593 }
604 }
610 {
617 }
619 NameNode *
621 {
628 }
630 }
634 static bool
636 {
641 }
644 }
646 static bool
648 {
656 }
658 /*
659 * Parse a top-level JS script.
660 */
661 JSParseNode *
663 {
664 /*
665 * Protect atoms from being collected by a GC activation, which might
666 * - nest on this thread due to out of memory (the so-called "last ditch"
667 * GC attempted within js_NewGCThing), or
668 * - run for any reason on another thread if this thread is suspended on
669 * an object lock before it finishes generating bytecode into a script
670 * protected from the GC by a root or a stack frame reference.
671 */
685 }
686 }
688 }
694 {
695 /*
696 * Reserve FREE_STATIC_LEVEL (0xffff) in order to reserve FREE_UPVAR_COOKIE
697 * (0xffffffff) and other cookies with that level.
698 *
699 * This is a lot simpler than error-checking every MAKE_UPVAR_COOKIE, and
700 * practically speaking it leaves more than enough room for upvars. In fact
701 * we might want to split cookie fields giving fewer bits for skip and more
702 * for slot, but only based on evidence.
703 */
708 }
711 }
713 /*
714 * Compile a top-level script.
715 */
716 JSScript *
723 {
725 TokenKind tt;
727 uint32 scriptGlobals;
730 #ifdef METER_PARSENODES
732 #endif
736 /*
737 * The scripted callerFrame can only be given for compile-and-go scripts
738 * and non-zero static level requires callerFrame.
739 */
761 /* Null script early in case of error, to reduce our code footprint. */
769 /* If this is a direct call to eval, inherit the caller's strictness. */
775 }
777 /*
778 * If funbox is non-null after we create the new script, callerFrame->fun
779 * was saved in the 0th object table entry.
780 */
786 /*
787 * Save eval program source in script->atomMap.vector[0] for the
788 * eval cache (see obj_eval in jsobj.cpp).
789 */
793 }
796 /*
797 * An eval script in a caller frame needs to have its enclosing
798 * function captured in case it refers to an upvar, and someone
799 * wishes to decompile it while it's running.
800 */
807 }
808 }
810 /*
811 * Inline this->statements to emit as we go to save AST space. We must
812 * generate our script-body blockid since we aren't calling Statements.
813 */
814 uint32 bodyid;
819 #if JS_HAS_XML_SUPPORT
823 #endif
838 }
855 }
859 #if JS_HAS_XML_SUPPORT
864 }
865 #endif
867 }
869 #if JS_HAS_XML_SUPPORT
870 /*
871 * Prevent XML data theft via <script src="http://victim.com/foo.xml">.
872 * For background, see:
873 *
874 * https://bugzilla.mozilla.org/show_bug.cgi?id=336551
875 */
879 }
880 #endif
882 /*
883 * Global variables (gvars) share the atom index space with locals. Due to
884 * incremental code generation we need to patch the bytecode to adjust the
885 * local references to skip the globals.
886 */
890 JSOp op;
907 /*
908 * JSOP_GETARGPROP also has JOF_SLOTATOM type, but it may be
909 * emitted only for a function.
910 */
921 }
922 }
923 }
925 #ifdef METER_PARSENODES
928 parsenodes,
929 maxparsenodes,
932 #endif
934 /*
935 * Nowadays the threaded interpreter needs a stop instruction, so we
936 * do have to emit that here.
937 */
940 #ifdef METER_PARSENODES
943 #endif
944 #ifdef JS_ARENAMETER
946 #endif
951 #ifdef JS_SCOPE_DEPTH_METER
958 }
959 #endif
961 out:
966 too_many_slots:
970 }
972 /*
973 * Insist on a final return before control flows out of pn. Try to be a bit
974 * smart about loops: do {...; return e2;} while(0) at the end of a function
975 * that contains an early return e1 will get a strict warning. Similarly for
976 * iloops: while (true){...} is treated as though ... returns.
977 */
978 #define ENDS_IN_OTHER 0
979 #define ENDS_IN_RETURN 1
980 #define ENDS_IN_BREAK 2
982 static int
984 {
1014 }
1019 }
1043 else
1045 }
1046 }
1047 /* If a final switch has no default case, we judge it harshly. */
1068 /* If we have a finally block that returns, we are done. */
1073 }
1075 /* Else check the try block and any and all catch statements. */
1081 }
1085 /* Check this catch block's body. */
1089 /* Non-binary let statements are let declarations. */
1096 }
1097 }
1099 static JSBool
1101 uintN anonerrnum)
1102 {
1111 }
1113 }
1115 static JSBool
1117 {
1122 }
1124 /*
1125 * Check that it is permitted to assign to lhs. Strict mode code may not
1126 * assign to 'eval' or 'arguments'.
1127 */
1128 bool
1130 {
1139 name)) {
1141 }
1142 }
1143 }
1145 }
1147 /*
1148 * Check that it is permitted to introduce a binding for atom. Strict
1149 * mode forbids introducing new definitions for 'eval' or 'arguments'.
1150 * Use pn for reporting error locations, or use tc's token stream if
1151 * pn is NULL.
1152 */
1153 bool
1155 {
1165 }
1167 }
1169 /*
1170 * In strict mode code, all formal parameter names must be distinct. If fun's
1171 * formals are legit given fun's strictness level, return true. Otherwise,
1172 * report an error and return false. Use pn for error position reporting,
1173 * unless we can find something more accurate in tc's decls.
1174 *
1175 * In some cases the code to parse the argument list will already have noticed
1176 * the duplication; we could try to use that knowledge instead of re-checking
1177 * here. But since the strictness of the function's body determines what
1178 * constraints to apply to the argument list, we can't report the error until
1179 * after we've parsed the body. And as it turns out, the function's local name
1180 * list makes it reasonably cheap to find duplicates after the fact.
1181 */
1182 static bool
1185 {
1193 /*
1194 * We have found a duplicate parameter name. If we can find the
1195 * JSDefinition for the argument, that will have a more accurate source
1196 * location.
1197 */
1205 }
1206 }
1212 /* The definition's source position will be more precise. */
1219 }
1220 }
1223 }
1225 JSParseNode *
1227 {
1228 JSStmtInfo stmtInfo;
1239 /*
1240 * Save the body's first line, and store it in pn->pn_pos.begin.lineno
1241 * later, because we may have not peeked in tokenStream yet, so statements
1242 * won't acquire a valid pn->pn_pos.begin from the current token.
1243 */
1245 #if JS_HAS_EXPR_CLOSURES
1257 JSMSG_BAD_GENERATOR_RETURN,
1258 JSMSG_BAD_ANON_GENERATOR_RETURN);
1264 }
1265 }
1266 }
1267 }
1268 #else
1270 #endif
1277 /* Check for falling off the end of a function that returns a value. */
1281 }
1282 }
1286 }
1290 {
1303 }
1305 static bool
1307 {
1332 }
1341 }
1342 }
1343 }
1352 }
1354 static void
1356 {
1365 }
1367 static void
1369 {
1373 }
1381 }
1385 {
1400 }
1410 }
1414 {
1415 /*
1416 * If dn is var, const, or let, and it has an initializer, then we must
1417 * rewrite it to be an assignment node, whose freshly allocated left-hand
1418 * side becomes a use of pn.
1419 */
1426 //pn->dn_uses = lhs;
1428 }
1437 }
1439 /* Now make dn no longer a definition, rather a use of pn. */
1449 }
1459 }
1461 static bool
1463 {
1466 /* Flag tc so we don't have to lookup arguments on every use. */
1472 /*
1473 * Make an argument definition node, distinguished by being in tc->decls
1474 * but having TOK_NAME type and JSOP_NOP op. Insert it in a TOK_ARGSBODY
1475 * list node returned via pn->pn_body.
1476 */
1482 /* Arguments are initialized by definition. */
1496 }
1503 }
1505 /*
1506 * Compile a JS function body, which might appear as the value of an event
1507 * handler attribute in an HTML <INPUT> tag.
1508 */
1509 bool
1513 {
1519 /* No early return from after here until the js_FinishArenaPool calls. */
1538 /* FIXME: make Function format the source for a function definition. */
1556 }
1557 }
1558 }
1559 }
1560 }
1562 /*
1563 * Farble the body so that it looks like a block statement to js_EmitTree,
1564 * which is called from js_EmitFunctionBody (see jsemit.cpp). After we're
1565 * done parsing, we must fold constants, analyze any nested functions, and
1566 * generate code for this function, including a stop opcode at the end.
1567 */
1577 /* js_FoldConstants reported the error already. */
1588 }
1592 }
1593 }
1595 /* Restore saved state and release code generation arenas. */
1599 }
1601 /*
1602 * Parameter block types for the several Binder functions. We use a common
1603 * helper function signature in order to share code among destructuring and
1604 * simple variable declaration parsers. In the destructuring case, the binder
1605 * function is called indirectly from the variable declaration parser by way
1606 * of CheckDestructuring and its friends.
1607 */
1608 typedef JSBool
1615 error source coordinates */
1620 uintN overflow;
1622 };
1624 };
1626 static JSBool
1629 {
1632 /*
1633 * Don't bind a variable with the hidden name 'arguments', per ECMA-262.
1634 * Instead 'var arguments' always restates the predefined property of the
1635 * activation objects whose name is 'arguments'. Assignment to such a
1636 * variable must be handled specially.
1637 *
1638 * Special case: an argument named 'arguments' *does* shadow the predefined
1639 * arguments property.
1640 */
1645 }
1647 #if JS_HAS_DESTRUCTURING
1648 static JSBool
1651 {
1654 /* Flag tc so we don't have to lookup arguments on every use. */
1665 JSMSG_DESTRUCT_DUP_ARG);
1667 }
1681 }
1684 JSFunction *
1686 {
1692 /*
1693 * Find the global compilation context in order to pre-set the newborn
1694 * function's parent slot to tc->scopeChain. If the global context is a
1695 * compile-and-go one, we leave the pre-set parent intact; otherwise we
1696 * clear parent and proto.
1697 */
1708 }
1710 }
1712 static JSBool
1714 {
1721 }
1724 }
1726 bool
1728 {
1733 }
1735 /*
1736 * Mark as funargs any functions that reach up to one or more upvars across an
1737 * already-known funarg. The parser will flag the o_m lambda as a funarg in:
1738 *
1739 * function f(o, p) {
1740 * o.m = function o_m(a) {
1741 * function g() { return p; }
1742 * function h() { return a; }
1743 * return g() + h();
1744 * }
1745 * }
1746 *
1747 * but without this extra marking phase, function g will not be marked as a
1748 * funarg since it is called from within its parent scope. But g reaches up to
1749 * f's parameter p, so if o_m escapes f's activation scope, g does too and
1750 * cannot use JSOP_GETUPVAR to reach p. In contast function h neither escapes
1751 * nor uses an upvar "above" o_m's level.
1752 *
1753 * If function g itself contained lambdas that contained non-lambdas that reach
1754 * up above its level, then those non-lambdas would have to be marked too. This
1755 * process is potentially exponential in the number of functions, but generally
1756 * not so complex. But it can't be done during a single recursive traversal of
1757 * the funbox tree, so we must use a work queue.
1758 *
1759 * Return the minimal "skipmin" for funbox and its siblings. This is the delta
1760 * between the static level of the bodies of funbox and its peers (which must
1761 * be funbox->level + 1), and the static level of the nearest upvar among all
1762 * the upvars contained by funbox and its peers. If there are no upvars, return
1763 * FREE_STATIC_LEVEL. Thus this function never returns 0.
1764 */
1765 static uintN
1767 {
1775 /*
1776 * An eval can leak funbox, functions along its ancestor line, and its
1777 * immediate kids. Since FindFunArgs uses DFS and the parser propagates
1778 * TCF_FUN_HEAVYWEIGHT bottom up, funbox's ancestor function nodes have
1779 * already been marked as funargs by this point. Therefore we have to
1780 * flag only funbox->node and funbox->kids' nodes here.
1781 */
1786 }
1788 /*
1789 * Compute in skipmin the least distance from fun's static level up to
1790 * an upvar, whether used directly by fun, or indirectly by a function
1791 * nested in fun.
1792 */
1815 }
1816 }
1817 }
1819 /*
1820 * If this function escapes, whether directly (the parser detects such
1821 * escapes) or indirectly (because this non-escaping function uses an
1822 * upvar that reaches across an outer function boundary where the outer
1823 * function escapes), enqueue it for further analysis, and bump fnlevel
1824 * to trap any non-escaping children.
1825 */
1829 }
1831 /*
1832 * Now process the current function's children, and recalibrate their
1833 * cumulative skipmin to be relative to the current static level.
1834 */
1843 }
1844 }
1846 /*
1847 * Finally, after we've traversed all of the current function's kids,
1848 * minimize fun's skipmin against our accumulated skipmin. Do likewise
1849 * with allskipmin, but minimize across funbox and all of its siblings,
1850 * to compute our return value.
1851 */
1856 }
1860 }
1862 bool
1864 {
1865 JSFunctionBoxQueue queue;
1889 /*
1890 * Mark this formerly-Algol-like function as an escaping
1891 * function (i.e., as a funarg), because it is used from a
1892 * funarg and therefore can not use JSOP_{GET,CALL}UPVAR to
1893 * access upvars.
1894 *
1895 * Progress is guaranteed because we set the funarg flag
1896 * here, which suppresses revisiting this function (thanks
1897 * to the !lexdep->isFunArg() test just above).
1898 */
1903 /*
1904 * A named function expression will not appear to be a
1905 * funarg if it is immediately applied. However, if its
1906 * name is used in an escaping function nested within
1907 * it, then it must become flagged as a funarg again.
1908 * See bug 545980.
1909 */
1916 }
1920 }
1923 /*
1924 * Walk over nested functions again, now that we have
1925 * changed the level across which it is unsafe to access
1926 * upvars using the runtime dynamic link (frame chain).
1927 */
1930 }
1931 }
1932 }
1933 }
1935 }
1937 static uint32
1939 {
1946 }
1947 }
1949 }
1953 {
1954 /*
1955 * Consider the current function (the lambda, innermost below) using a var
1956 * x defined two static levels up:
1957 *
1958 * function f() {
1959 * // z = g();
1960 * var x = 42;
1961 * function g() {
1962 * return function () { return x; };
1963 * }
1964 * return g();
1965 * }
1966 *
1967 * So long as (1) the initialization in 'var x = 42' dominates all uses of
1968 * g and (2) x is not reassigned, it is safe to optimize the lambda to a
1969 * flat closure. Uncommenting the early call to g makes this optimization
1970 * unsafe (z could name a global setter that calls its argument).
1971 */
1979 /*
1980 * NB: afunbox can't be null because we are sure to find a function box
1981 * whose level == dnLevel before we would try to walk above the root of
1982 * the funbox tree. See bug 493260 comments 16-18.
1983 *
1984 * Assert but check anyway, to protect future changes that bind eval
1985 * upvars in the parser.
1986 */
1989 /*
1990 * If this function is reaching up across an enclosing funarg, then we
1991 * cannot copy dn's value into a flat closure slot (the display stops
1992 * working once the funarg escapes).
1993 */
1997 /*
1998 * Reaching up for dn across a generator also means we can't flatten,
1999 * since the generator iterator does not run until later, in general.
2000 * See bug 563034.
2001 */
2004 }
2006 /*
2007 * If afunbox's function (which is at the same level as dn) is in a loop,
2008 * pessimistically assume the variable initializer may be in the same loop.
2009 * A flat closure would then be unsafe, as the captured variable could be
2010 * assigned after the closure is created. See bug 493232.
2011 */
2015 /*
2016 * |with| and eval used as an operator defeat lexical scoping: they can be
2017 * used to assign to any in-scope variable. Therefore they must disable
2018 * flat closures that use such upvars. The parser detects these as special
2019 * forms and marks the function heavyweight.
2020 */
2024 /*
2025 * If afunbox's function is not a lambda, it will be hoisted, so it could
2026 * capture the undefined value that by default initializes var, let, and
2027 * const bindings. And if dn is a function that comes at (meaning a
2028 * function refers to its own name) or strictly after afunbox, we also
2029 * defeat the flat closure optimization for this dn.
2030 */
2035 }
2045 /*
2046 * Any formal could be mutated behind our back via the arguments
2047 * object, so deoptimize if the outer function uses arguments.
2048 *
2049 * In a Function constructor call where the final argument -- the body
2050 * source for the function to create -- contains a nested function
2051 * definition or expression, afunbox->parent will be null. The body
2052 * source might use |arguments| outside of any nested functions it may
2053 * contain, so we have to check the tcflags parameter that was passed
2054 * in from Compiler::compileFunctionBody.
2055 */
2059 }
2060 }
2062 /*
2063 * Check quick-and-dirty dominance relation. Function definitions dominate
2064 * their uses thanks to hoisting. Other binding forms hoist as undefined,
2065 * of course, so check forward-reference and blockid relations.
2066 */
2068 /*
2069 * Watch out for code such as
2070 *
2071 * (function () {
2072 * ...
2073 * var jQuery = ... = function (...) {
2074 * return new jQuery.foo.bar(baz);
2075 * }
2076 * ...
2077 * })();
2078 *
2079 * where the jQuery variable is not reassigned, but of course is not
2080 * initialized at the time that the would-be-flat closure containing
2081 * the jQuery upvar is formed.
2082 */
2087 }
2089 }
2091 static void
2093 {
2097 /*
2098 * Notice that funbox->level is the static level of the definition or
2099 * expression of the function parsed into funbox, not the static level
2100 * of its body. Therefore we must add 1 to match dn's level to find the
2101 * funbox whose body contains the dn definition.
2102 */
2106 }
2108 }
2112 }
2114 static void
2116 {
2126 }
2127 }
2131 }
2133 void
2135 {
2136 #ifdef JS_FUNCTION_METERING
2137 # define FUN_METER(x) JS_RUNTIME_METER(context->runtime, functionMeter.x)
2138 #else
2139 # define FUN_METER(x) ((void)0)
2140 #endif
2149 /*
2150 * We've unwound from recursively setting our kids' kinds, which
2151 * also classifies enclosing functions holding upvars referenced in
2152 * those descendants' bodies. So now we can check our "methods".
2153 *
2154 * Despecialize from branded method-identity-based shape to sprop-
2155 * or slot-based shape if this function smells like a constructor
2156 * and too many of its methods are *not* joinable null closures
2157 * (i.e., they have one or more upvars fetched via the display).
2158 */
2165 #if JS_HAS_EXPR_CLOSURES
2167 #endif
2176 }
2180 }
2181 }
2191 /*
2192 * No lexical dependencies => null closure, for best performance.
2193 * A null closure needs no scope chain, but alas we've coupled
2194 * principals-finding to scope (for good fundamental reasons, but
2195 * the implementation overloads the parent slot and we should fix
2196 * that). See, e.g., the JSOP_LAMBDA case in jsinterp.cpp.
2197 *
2198 * In more detail: the ES3 spec allows the implementation to create
2199 * "joined function objects", or not, at its discretion. But real-
2200 * world implementations always create unique function objects for
2201 * closures, and this can be detected via mutation. Open question:
2202 * do popular implementations create unique function objects for
2203 * null closures?
2204 *
2205 * FIXME: bug 476950.
2206 */
2217 /*
2218 * This function is Algol-like, it never escapes. So long as it
2219 * does not assign to outer variables, it needs only an upvars
2220 * array in its script and JSOP_{GET,CALL}UPVAR opcodes in its
2221 * bytecode to reach up the frame stack at runtime based on
2222 * those upvars' cookies.
2223 *
2224 * Any assignments to upvars from functions called by this one
2225 * will be coherent because of the JSOP_{GET,CALL}UPVAR ops,
2226 * which load from stack homes when interpreting or from native
2227 * stack slots when executing a trace.
2228 *
2229 * We could add JSOP_SETUPVAR, etc., but it is uncommon for a
2230 * nested function to assign to an outer lexical variable, so
2231 * we defer adding yet more code footprint in the absence of
2232 * evidence motivating these opcodes.
2233 */
2237 /*
2238 * Check that at least one outer lexical binding was assigned
2239 * to (global variables don't count). This is conservative: we
2240 * could limit assignments to those in the current function,
2241 * but that's too much work. As with flat closures (handled
2242 * below), we optimize for the case where outer bindings are
2243 * not reassigned anywhere.
2244 */
2253 }
2254 }
2263 /*
2264 * Algol-like functions can read upvars using the dynamic
2265 * link (cx->fp/fp->down), optimized using the cx->display
2266 * lookup table indexed by static level. They do not need
2267 * to entrain and search their environment objects.
2268 */
2274 }
2278 /*
2279 * For each lexical dependency from this closure to an outer
2280 * binding, analyze whether it is safe to copy the binding's
2281 * value into a flat closure slot when the closure is formed.
2282 */
2291 }
2293 }
2294 }
2300 /* FIXME bug 545759: to test nflattened != 0 */
2301 /*
2302 * We made it all the way through the upvar loop, so it's
2303 * safe to optimize to a flat closure.
2304 */
2318 /* js_EmitTree's case TOK_FUNCTION: will select op. */
2320 }
2323 }
2324 }
2325 }
2328 /*
2329 * One or more upvars cannot be safely snapshot into a flat
2330 * closure's dslot (see JSOP_GETDSLOT), so we loop again over
2331 * all upvars, and for each non-free upvar, ensure that its
2332 * containing function has been flagged as heavyweight.
2333 *
2334 * The emitter must see TCF_FUN_HEAVYWEIGHT accurately before
2335 * generating any code for a tree of nested functions.
2336 */
2347 }
2348 }
2353 }
2355 #undef FUN_METER
2356 }
2364 {
2368 };
2372 }
2377 {
2383 /* Create box for fun->object early to protect against last-ditch GC. */
2388 /* Initialize non-default members of funtc. */
2399 }
2401 static bool
2404 {
2417 /*
2418 * Propagate unresolved lexical names up to tc->lexdeps, and save a copy
2419 * of funtc->lexdeps in a TOK_UPVARS node wrapping the function's formal
2420 * params and body. We do this only if there are lexical dependencies not
2421 * satisfied by the function's declarations, to avoid penalizing functions
2422 * that use only their arguments and other local bindings.
2423 */
2439 /*
2440 * If this named function expression uses its own name other
2441 * than to call itself, flag this function specially.
2442 */
2447 }
2451 /*
2452 * Make sure we do not fail to set TCF_FUN_SETS_OUTER_NAME if
2453 * any use of dn in funtc assigns. See NoteLValue for the easy
2454 * backward-reference case; this is the hard forward-reference
2455 * case where we pay a higher price.
2456 */
2461 }
2462 }
2463 }
2469 /*
2470 * Insert dn's uses list at the front of outer_dn's list.
2471 *
2472 * Without loss of generality or correctness, we allow a dn to
2473 * be in inner and outer lexdeps, since the purpose of lexdeps
2474 * is one-pass coordination of name use and definition across
2475 * functions, and if different dn's are used we'll merge lists
2476 * when leaving the inner function.
2477 *
2478 * The dn == outer_dn case arises with generator expressions
2479 * (see CompExprTransplanter::transplant, the PN_FUNC/PN_NAME
2480 * case), and nowhere else, currently.
2481 */
2491 }
2493 /*
2494 * Make dn be a use that redirects to outer_dn, because we
2495 * can't replace dn with outer_dn in all the pn_namesets in
2496 * the AST where it may be. Instead we make it forward to
2497 * outer_dn. See JSDefinition::resolve.
2498 */
2505 }
2507 /* Add an outer lexical dependency for ale's definition. */
2512 }
2513 }
2528 }
2531 }
2534 }
2536 JSParseNode *
2538 {
2540 TokenKind tt;
2542 #if JS_HAS_DESTRUCTURING
2546 #endif
2548 /*
2549 * Save the current op for later so we can tag the created function as a
2550 * getter/setter if necessary.
2551 */
2554 /* Make a TOK_FUNCTION node. */
2561 /*
2562 * If a lambda, give up on JSOP_{GET,CALL}UPVAR usage unless this function
2563 * is immediately applied (we clear PND_FUNARG if so -- see memberExpr).
2564 *
2565 * Also treat function sub-statements (non-lambda, non-top-level functions)
2566 * as escaping funargs, since we can't statically analyze their definitions
2567 * and uses.
2568 */
2572 /* Scan the optional function name into funAtom. */
2582 }
2584 }
2585 }
2587 /*
2588 * Record names for function statements in tc->decls so we know when to
2589 * avoid optimizing variable references that might name a function.
2590 */
2607 JSMSG_REDECLARED_VAR,
2609 name)) {
2611 }
2612 }
2621 }
2623 /*
2624 * If this function was used before it was defined, claim the
2625 * pre-created definition node for this function that primaryExpr
2626 * put in tc->lexdeps on first forward reference, and recycle pn.
2627 */
2644 }
2648 }
2650 /*
2651 * A function nested at top level inside another's body needs only a
2652 * local variable to bind its name to its value, and not an activation
2653 * object property (it might also need the activation property, if the
2654 * outer function contains with statements, e.g., but the stack slot
2655 * wins when jsemit.c's BindNameToSlot can optimize a JSOP_NAME into a
2656 * JSOP_GETLOCAL bytecode).
2657 */
2662 JSLocalKind localKind;
2663 uintN index;
2665 /*
2666 * Define a local in the outer function so that BindNameToSlot
2667 * can properly optimize accesses. Note that we need a local
2668 * variable, not an argument, for the function statement. Thus
2669 * we add a variable even if a parameter with the given name
2670 * already exists.
2671 */
2679 /* FALL THROUGH */
2687 }
2688 }
2689 }
2690 }
2694 /* Initialize early for possible flags mutation via destructuringExpr. */
2706 /* Now parse formal argument list and compute fun->nargs. */
2712 #if JS_HAS_DESTRUCTURING
2715 {
2716 BindData data;
2718 jsint slot;
2720 /* See comment below in the TOK_NAME case. */
2725 /*
2726 * A destructuring formal parameter turns into one or more
2727 * local variables initialized from properties of a single
2728 * anonymous positional parameter, so here we must tweak our
2729 * binder and its data.
2730 */
2738 /*
2739 * Adjust fun->nargs to count the single anonymous positional
2740 * parameter that is to be destructured.
2741 */
2746 /*
2747 * Synthesize a destructuring assignment from the single
2748 * anonymous positional parameter into the destructuring
2749 * left-hand-side expression and accumulate it in list.
2750 */
2768 }
2771 }
2775 {
2779 #ifdef JS_HAS_DESTRUCTURING
2780 /*
2781 * ECMA-262 requires us to support duplicate parameter names, but if the
2782 * parameter list includes destructuring, we consider the code to have
2783 * opted in to higher standards, and forbid duplicates. We may see a
2784 * destructuring parameter later, so always note duplicates now.
2785 *
2786 * Duplicates are warned about (strict option) or cause errors (strict
2787 * mode code), but we do those tests in one place below, after having
2788 * parsed the body.
2789 */
2794 }
2795 #endif
2799 }
2803 /* FALL THROUGH */
2807 #if JS_HAS_DESTRUCTURING
2808 report_dup_and_destructuring:
2812 #endif
2813 }
2817 }
2819 #if JS_HAS_EXPR_CLOSURES
2824 }
2825 #else
2827 #endif
2839 #if JS_HAS_EXPR_CLOSURES
2844 #else
2846 #endif
2849 #if JS_HAS_DESTRUCTURING
2850 /*
2851 * If there were destructuring formal parameters, prepend the initializing
2852 * comma expression that we synthesized to body. If the body is a lexical
2853 * scope node, we must make a special TOK_SEQ node, to prepend the formal
2854 * parameter destructuring code without bracing the decompilation of the
2855 * function body's lexical scope.
2856 */
2869 }
2884 }
2885 #endif
2887 /*
2888 * If we collected flags that indicate nested heavyweight functions, or
2889 * this function contains heavyweight-making statements (with statement,
2890 * visible eval call, or assignment to 'arguments'), flag the function as
2891 * heavyweight (requiring a call object per invocation).
2892 */
2897 /*
2898 * If this function is a named statement function not at top-level
2899 * (i.e. not a top-level function definiton or expression), then our
2900 * enclosing function, if any, must be heavyweight.
2901 */
2904 }
2908 /*
2909 * ECMA ed. 3 standard: function expression, possibly anonymous.
2910 */
2913 /*
2914 * If this anonymous function definition is *not* embedded within a
2915 * larger expression, we treat it as an expression statement, not as
2916 * a function declaration -- and not as a syntax error (as ECMA-262
2917 * Edition 3 would have it). Backward compatibility must trump all,
2918 * unless JSOPTION_ANONFUNFIX is set.
2919 */
2928 /*
2929 * ECMA ed. 3 extension: a function expression statement not at the
2930 * top level, e.g., in a compound statement such as the "then" part
2931 * of an "if" statement, binds a closure only if control reaches that
2932 * sub-statement.
2933 */
2937 }
2948 }
2955 /* If the surrounding function is not strict code, reset the lexer. */
2960 }
2962 JSParseNode *
2964 {
2966 }
2968 JSParseNode *
2970 {
2972 }
2974 /*
2975 * Recognize Directive Prologue members and directives. Assuming pn
2976 * is a candidate for membership in a directive prologue, return
2977 * true if it is in fact a member. Recognize directives and set
2978 * tc's flags accordingly.
2979 *
2980 * Note that the following is a strict mode function:
2981 *
2982 * function foo() {
2983 * "blah" // inserted semi colon
2984 * "blurgh"
2985 * "use\x20loose"
2986 * "use strict"
2987 * }
2988 *
2989 * That is, a statement can be a Directive Prologue member, even
2990 * if it can't possibly be a directive, now or in the future.
2991 */
2992 bool
2994 {
3002 }
3003 }
3005 }
3007 /*
3008 * Parse the statements in a block, creating a TOK_LC node that lists the
3009 * statements' trees. If called from block-parsing code, the caller must
3010 * match { before and } after.
3011 */
3012 JSParseNode *
3014 {
3016 TokenKind tt;
3037 }
3039 }
3045 }
3051 /*
3052 * PNX_FUNCDEFS notifies the emitter that the block contains top-
3053 * level function definitions that should be processed before the
3054 * rest of nodes.
3055 *
3056 * TCF_HAS_FUNCTION_STMT is for the TOK_LC case in Statement. It
3057 * is relevant only for function definitions not at top-level,
3058 * which we call function statements.
3059 */
3062 else
3064 }
3066 }
3068 /*
3069 * Handle the case where there was a let declaration under this block. If
3070 * it replaced tc->blockNode with a new block node then we must refresh pn
3071 * and then restore tc->blockNode.
3072 */
3079 }
3081 JSParseNode *
3083 {
3092 /* Check for (a = b) and warn about possible (a == b) mistype. */
3098 }
3100 }
3102 static JSBool
3104 {
3106 TokenKind tt;
3116 }
3119 }
3121 static JSBool
3123 {
3127 jsint n;
3129 /*
3130 * Top-level 'let' is the same as 'var' currently -- this may change in a
3131 * successor standard to ES3.1 that specifies 'let'.
3132 */
3147 ? js_const_str
3149 name);
3150 }
3152 }
3159 }
3161 /*
3162 * Pass push = true to Define so it pushes an ale ahead of any outer scope.
3163 * This is balanced by PopStatement, defined immediately below.
3164 */
3168 /*
3169 * Assign block-local index to pn->pn_cookie right away, encoding it as an
3170 * upvar cookie whose skip tells the current static level. The emitter will
3171 * adjust the node's slot based on its stack depth model -- and, for global
3172 * and eval code, Compiler::compileScript will adjust the slot again to
3173 * include script->nfixed.
3174 */
3179 /*
3180 * Define the let binding's property before storing pn in a reserved slot,
3181 * since block_reserveSlots depends on blockObj->scope()->entryCount.
3182 */
3186 /*
3187 * Store pn temporarily in what would be reserved slots in a cloned block
3188 * object (once the prototype's final population is known, after all 'let'
3189 * bindings for this block have been parsed). We will free these reserved
3190 * slots in jsemit.cpp:EmitEnterBlock.
3191 */
3196 }
3200 }
3202 static void
3204 {
3215 /* Beware the empty destructuring dummy. */
3219 }
3220 }
3222 }
3226 {
3233 }
3235 }
3237 /*
3238 * If we are generating global or eval-called-from-global code, bind a "gvar"
3239 * here, as soon as possible. The JSOP_GETGVAR, etc., ops speed up interpreted
3240 * global variable access by memoizing name-to-slot mappings during execution
3241 * of the script prolog (via JSOP_DEFVAR/JSOP_DEFCONST). If the memoization
3242 * can't be done due to a pre-existing property of the same name as the var or
3243 * const but incompatible attributes/getter/setter/etc, these ops devolve to
3244 * JSOP_NAME, etc.
3245 *
3246 * For now, don't try to lookup eval frame variables at compile time. This is
3247 * sub-optimal: we could handle eval-called-from-global-code gvars since eval
3248 * gets its own script and frame. The eval-from-function-code case is harder,
3249 * since functions do not atomize gvars and then reserve their atom indexes as
3250 * stack frame slots.
3251 */
3252 static bool
3254 {
3261 /* Index pn->pn_atom so we can map fast global number to name. */
3266 /* Defend against cg->ngvars 16-bit overflow. */
3278 }
3279 }
3282 }
3284 static JSBool
3286 {
3289 /* Default best op for pn is JSOP_NAME; we'll try to improve below. */
3300 }
3318 name);
3320 }
3325 }
3338 !error
3341 JSMSG_REDECLARED_VAR,
3343 name)) {
3345 }
3346 }
3347 }
3348 }
3354 /*
3355 * A var declaration never recreates an existing binding, it restates
3356 * it and possibly reinitializes its value. Beware that if pn becomes a
3357 * use of ALE_DEFN(ale), and if we have an initializer for this var or
3358 * const (typically a const would ;-), then pn must be rewritten into a
3359 * TOK_ASSIGN node. See Variables, further below.
3360 *
3361 * A case such as let (x = 1) { var x = 2; print(x); } is even harder.
3362 * There the x definition is hoisted but the x = 2 assignment mutates
3363 * the block-local binding of x.
3364 */
3370 /* Make pnu be a fresh name node that uses dn. */
3377 }
3381 }
3390 }
3396 }
3398 /*
3399 * A var or const that is shadowed by one or more let bindings of the
3400 * same name, but that has not been declared until this point, must be
3401 * hoisted above the let bindings.
3402 */
3415 /* The token stream may be past the location for pn. */
3419 }
3421 }
3429 }
3441 }
3445 /*
3446 * Property not found in current variable scope: we have not seen this
3447 * variable before. Define a new local variable by adding a property to
3448 * the function's scope and allocating one slot in the function's vars
3449 * frame. Any locals declared in a with statement body are handled at
3450 * runtime, by script prolog JSOP_DEFVAR opcodes generated for global
3451 * and heavyweight-function-local vars.
3452 */
3462 }
3465 /* We checked errors and strict warnings earlier -- see above. */
3468 /* Not an argument, must be a redeclared local var. */
3470 }
3472 }
3474 static JSBool
3476 {
3485 }
3488 }
3490 static void
3492 {
3496 /*
3497 * Save the win of PND_INITIALIZED if we can prove 'var x;' and 'x = y'
3498 * occur as direct kids of the same block with no forward refs to x.
3499 */
3507 }
3512 /*
3513 * The above condition takes advantage of the all-ones nature of
3514 * FREE_UPVAR_COOKIE, and the reserved level FREE_STATIC_LEVEL.
3515 * We make a stronger assertion by excluding FREE_UPVAR_COOKIE.
3516 */
3520 }
3521 }
3527 }
3529 #if JS_HAS_DESTRUCTURING
3531 static JSBool
3534 {
3537 /*
3538 * Destructuring is a form of assignment, so just as for an initialized
3539 * simple variable, we must check for assignment to 'arguments' and flag
3540 * the enclosing function (if any) as heavyweight.
3541 */
3551 /*
3552 * Select the appropriate name-setting opcode, respecting eager selection
3553 * done by the data->binder function.
3554 */
3557 ? JSOP_SETNAME
3559 ? JSOP_SETGVAR
3563 ? JSOP_SETCONST
3565 }
3572 }
3574 /*
3575 * Here, we are destructuring {... P: Q, ...} = R, where P is any id, Q is any
3576 * LHS expression except a destructuring initialiser, and R is on the stack.
3577 * Because R is already evaluated, the usual LHS-specialized bytecodes won't
3578 * work. After pushing R[P] we need to evaluate Q's "reference base" QB and
3579 * then push its property name QN. At this point the stack looks like
3580 *
3581 * [... R, R[P], QB, QN]
3582 *
3583 * We need to set QB[QN] = R[P]. This is a job for JSOP_ENUMELEM, which takes
3584 * its operands with left-hand side above right-hand side:
3585 *
3586 * [rval, lval, xval]
3587 *
3588 * and pops all three values, setting lval[xval] = rval. But we cannot select
3589 * JSOP_ENUMELEM yet, because the LHS may turn out to be an arg or local var,
3590 * which can be optimized further. So we select JSOP_SETNAME.
3591 */
3592 static JSBool
3594 {
3598 /* FALL THROUGH */
3610 #if JS_HAS_XML_SUPPORT
3615 }
3616 /* FALL THROUGH */
3617 #endif
3623 }
3626 }
3635 JSDHashEntryHdr hdr;
3640 #define ASSERT_VALID_PROPERTY_KEY(pnkey) \
3641 JS_ASSERT(((pnkey)->pn_arity == PN_NULLARY && \
3642 ((pnkey)->pn_type == TOK_NUMBER || \
3643 (pnkey)->pn_type == TOK_STRING || \
3644 (pnkey)->pn_type == TOK_NAME)) || \
3645 ((pnkey)->pn_arity == PN_NAME && (pnkey)->pn_type == TOK_NAME))
3647 static JSDHashNumber
3649 {
3656 }
3658 static JSBool
3662 {
3671 }
3674 JS_DHashAllocTable,
3675 JS_DHashFreeTable,
3676 HashFindPropValKey,
3677 MatchFindPropValEntry,
3678 JS_DHashMoveEntryStub,
3679 JS_DHashClearEntryStub,
3680 JS_DHashFinalizeStub,
3681 NULL
3682 };
3684 #define STEP_HASH_THRESHOLD 10
3685 #define BIG_DESTRUCTURING 5
3686 #define BIG_OBJECT_INIT 20
3690 {
3693 uint32 step;
3695 /* If we have a hash table, use it as the sole source of truth. */
3700 }
3702 /* If pn is not an object initialiser node, we can't do anything here. */
3706 /*
3707 * We must search all the way through pn's list, to handle the case of an
3708 * id duplicated for two or more property initialisers.
3709 */
3723 }
3725 }
3726 }
3736 }
3738 }
3739 }
3740 }
3744 /* Hit via full search -- see whether it's time to create the hash table. */
3754 {
3760 JS_DHASH_ADD);
3762 }
3763 }
3764 }
3766 }
3768 /*
3769 * Destructuring patterns can appear in two kinds of contexts:
3770 *
3771 * - assignment-like: assignment expressions and |for| loop heads. In
3772 * these cases, the patterns' property value positions can be
3773 * arbitrary lvalue expressions; the destructuring is just a fancy
3774 * assignment.
3775 *
3776 * - declaration-like: |var| and |let| declarations, functions' formal
3777 * parameter lists, |catch| clauses, and comprehension tails. In
3778 * these cases, the patterns' property value positions must be
3779 * simple names; the destructuring defines them as new variables.
3780 *
3781 * In both cases, other code parses the pattern as an arbitrary
3782 * primaryExpr, and then, here in CheckDestructuring, verify that the
3783 * tree is a valid destructuring expression.
3784 *
3785 * In assignment-like contexts, we parse the pattern with the
3786 * TCF_DECL_DESTRUCTURING flag clear, so the lvalue expressions in the
3787 * pattern are parsed normally. primaryExpr links variable references
3788 * into the appropriate use chains; creates placeholder definitions;
3789 * and so on. CheckDestructuring is called with |data| NULL (since we
3790 * won't be binding any new names), and we specialize lvalues as
3791 * appropriate. If right is NULL, we just check for well-formed lvalues.
3792 *
3793 * In declaration-like contexts, the normal variable reference
3794 * processing would just be an obstruction, because we're going to
3795 * define the names that appear in the property value positions as new
3796 * variables anyway. In this case, we parse the pattern with
3797 * TCF_DECL_DESTRUCTURING set, which directs primaryExpr to leave
3798 * whatever name nodes it creates unconnected. Then, here in
3799 * CheckDestructuring, we require the pattern's property value
3800 * positions to be simple names, and define them as appropriate to the
3801 * context. For these calls, |data| points to the right sort of
3802 * BindData.
3803 *
3804 * See also UndominateInitializers, immediately below. If you change
3805 * either of these functions, you might have to change the other to
3806 * match.
3807 */
3808 static JSBool
3812 {
3813 JSBool ok;
3814 FindPropValData fpvd;
3819 JSMSG_ARRAY_COMP_LEFTSIDE);
3821 }
3823 #if JS_HAS_DESTRUCTURING_SHORTHAND
3826 JSMSG_BAD_OBJECT_INIT);
3828 }
3829 #endif
3841 /* Nullary comma is an elision; binary comma is an expression.*/
3853 }
3854 }
3857 }
3862 }
3884 }
3889 }
3890 }
3892 /*
3893 * The catch/finally handler implementation in the interpreter assumes
3894 * that any operation that introduces a new scope (like a "let" or "with"
3895 * block) increases the stack depth. This way, it is possible to restore
3896 * the scope chain based on stack depth of the handler alone. "let" with
3897 * an empty destructuring pattern like in
3898 *
3899 * let [] = 1;
3900 *
3901 * would violate this assumption as the there would be no let locals to
3902 * store on the stack. To satisfy it we add an empty property to such
3903 * blocks so that OBJ_BLOCK_COUNT(cx, blockObj), which gives the number of
3904 * slots, would be always positive.
3905 *
3906 * Note that we add such a property even if the block has locals due to
3907 * later let declarations in it. We optimize for code simplicity here,
3908 * not the fastest runtime performance with empty [] or {}.
3909 */
3917 JSPROP_ENUMERATE |
3918 JSPROP_PERMANENT |
3919 JSPROP_SHARED,
3923 }
3927 out:
3932 no_var_name:
3934 JSMSG_NO_VARIABLE_NAME);
3937 }
3939 /*
3940 * This is a greatly pared down version of CheckDestructuring that extends the
3941 * pn_pos.end source coordinate of each name in a destructuring binding such as
3942 *
3943 * var [x, y] = [function () y, 42];
3944 *
3945 * to cover its corresponding initializer, so that the initialized binding does
3946 * not appear to dominate any closures in its initializer. See bug 496134.
3947 *
3948 * The quick-and-dirty dominance computation in Parser::setFunctionKinds is not
3949 * very precise. With one-pass SSA construction from structured source code
3950 * (see "Single-Pass Generation of Static Single Assignment Form for Structured
3951 * Languages", Brandis and Mössenböck), we could do much better.
3952 *
3953 * See CheckDestructuring, immediately above. If you change either of these
3954 * functions, you might have to change the other to match.
3955 */
3956 static JSBool
3958 {
3959 FindPropValData fpvd;
3965 #if JS_HAS_DESTRUCTURING_SHORTHAND
3968 JSMSG_BAD_OBJECT_INIT);
3970 }
3971 #endif
3982 /* Nullary comma is an elision; binary comma is an expression.*/
3989 }
3990 }
3994 }
4011 }
4014 }
4015 }
4017 }
4019 JSParseNode *
4021 {
4032 }
4034 /*
4035 * Currently used only #if JS_HAS_DESTRUCTURING, in Statement's TOK_FOR case.
4036 * This function assumes the cloned tree is for use in the same statement and
4037 * binding context as the original tree.
4038 */
4041 {
4056 #define NULLCHECK(e) JS_BEGIN_MACRO if (!(e)) return NULL; JS_END_MACRO
4072 }
4086 else
4099 // PN_NAME could mean several arms in pn_u, so copy the whole thing.
4102 /*
4103 * The old name is a use of its pn_lexdef. Make the clone also be a
4104 * use of that definition.
4105 */
4113 /*
4114 * If the old name is a definition, the new one has pn_defn set.
4115 * Make the old name a use of the new node.
4116 */
4120 }
4121 }
4130 // Even PN_NULLARY may have data (apair for E4X -- what a botch).
4134 #undef NULLCHECK
4135 }
4137 }
4145 {
4158 }
4169 /*
4170 * Limit recursion if pn is a binary expression, which can't contain a
4171 * var statement.
4172 */
4188 }
4190 }
4192 JSParseNode *
4194 {
4202 }
4208 #if JS_HAS_GENERATORS
4211 #endif
4213 /* This is ugly, but we don't want to require a semicolon. */
4219 #if JS_HAS_GENERATORS
4223 #endif
4224 ) {
4228 #if JS_HAS_GENERATORS
4230 #endif
4235 #if JS_HAS_GENERATORS
4237 #endif
4239 }
4242 /* As in Python (see PEP-255), disallow return v; in generators. */
4244 JSMSG_BAD_GENERATOR_RETURN,
4245 JSMSG_BAD_ANON_GENERATOR_RETURN);
4247 }
4252 JSMSG_NO_RETURN_VALUE,
4253 JSMSG_ANON_NO_RETURN_VALUE)) {
4255 }
4258 }
4263 {
4290 }
4292 #if JS_HAS_BLOCK_SCOPE
4294 JSParseNode *
4296 {
4298 JSStmtInfo stmtInfo;
4302 /* Create the let binary node. */
4309 /* This is a let block or expression of the form: let (a, b, c) .... */
4324 /*
4325 * If this is really an expression in let statement guise, then we
4326 * need to wrap the TOK_LET node in a TOK_SEMI node so that we pop
4327 * the return value of the expression.
4328 */
4337 }
4345 /*
4346 * Change pnblock's opcode to the variant that propagates the last
4347 * result down after popping the block, and clear statement.
4348 */
4353 }
4357 }
4361 static bool
4363 {
4366 }
4370 {
4382 }
4383 }
4388 /*
4389 * A let binding at top level becomes a var before we get here, so if
4390 * pn and tc have the same blockid then that id must not be the bodyid.
4391 * If pn is a forward placeholder definition from the same or a higher
4392 * block then we claim it.
4393 */
4403 }
4404 }
4406 /* Make a new node for this declarator name (or destructuring pattern). */
4411 }
4413 #if JS_HAS_BLOCK_SCOPE
4414 static bool
4416 {
4460 }
4461 }
4462 }
4473 }
4475 }
4476 }
4482 }
4485 }
4488 JSParseNode *
4490 {
4491 TokenKind tt;
4502 #if JS_HAS_XML_SUPPORT
4506 #endif
4510 /* An IF node has three kids: condition, then, and optional else. */
4530 }
4538 {
4547 /* pn1 points to the switch's discriminant. */
4555 /*
4556 * NB: we must push stmtInfo before calling GenerateBlockIdForStmtNode
4557 * because that function states tc->topStmt->blockid.
4558 */
4561 /* pn2 is a list of case nodes. The default case has pn_left == NULL */
4577 }
4579 /* FALL THROUGH */
4589 }
4594 }
4603 }
4620 }
4622 /* Fix the PN_LIST so it doesn't begin at the TOK_COLON. */
4627 }
4629 /*
4630 * Handle the case where there was a let declaration in any case in
4631 * the switch body, but not within an inner block. If it replaced
4632 * tc->blockNode with a new block node then we must refresh pn2 and
4633 * then restore tc->blockNode.
4634 */
4644 }
4680 /*
4681 * All legacy and extended versions must do automatic semicolon
4682 * insertion after do-while. See the testcase and discussion in
4683 * http://bugzilla.mozilla.org/show_bug.cgi?id=238945.
4684 */
4687 }
4691 {
4693 #if JS_HAS_BLOCK_SCOPE
4695 JSStmtInfo blockInfo;
4696 #endif
4698 /* A FOR node is binary, left is loop control and right is the body. */
4709 else
4711 }
4716 #if JS_HAS_BLOCK_SCOPE
4718 #endif
4724 /* No initializer -- set first kid of left sub-node to null. */
4727 /*
4728 * Set pn1 to a var list or an initializing expression.
4729 *
4730 * Set the TCF_IN_FOR_INIT flag during parsing of the first clause
4731 * of the for statement. This flag will be used by the RelExpr
4732 * production; if it is set, then the 'in' keyword will not be
4733 * recognized as an operator, leaving it available to be parsed as
4734 * part of a for/in loop.
4735 *
4736 * A side effect of this restriction is that (unparenthesized)
4737 * expressions involving an 'in' operator are illegal in the init
4738 * clause of an ordinary for loop.
4739 */
4744 #if JS_HAS_BLOCK_SCOPE
4757 }
4758 #endif
4761 }
4765 }
4767 /*
4768 * We can be sure that it's a for/in loop if there's still an 'in'
4769 * keyword here, even if JavaScript recognizes 'in' as an operator,
4770 * as we've excluded 'in' from being parsed in RelExpr by setting
4771 * the TCF_IN_FOR_INIT flag in our JSTreeContext.
4772 */
4777 /* Check that the left side of the 'in' is valid. */
4781 #if JS_HAS_DESTRUCTURING
4791 #endif
4792 )
4795 #if JS_HAS_DESTRUCTURING
4801 #endif
4803 #if JS_HAS_XML_SUPPORT
4806 #endif
4810 }
4812 /* pn2 points to the name or destructuring pattern on in's left. */
4817 /* Tell js_EmitTree(TOK_VAR) that pn1 is part of a for/in. */
4820 /*
4821 * Rewrite 'for (<decl> x = i in o)' where <decl> is 'let',
4822 * 'var', or 'const' to hoist the initializer or the entire
4823 * decl out of the loop head. TOK_VAR is the type for both
4824 * 'var' and 'const'.
4825 */
4828 #if JS_HAS_DESTRUCTURING
4830 #endif
4831 ) {
4838 #if JS_HAS_BLOCK_SCOPE
4840 /*
4841 * Hoist just the 'i' from 'for (let x = i in o)' to
4842 * before the loop, glued together via pnseq.
4843 */
4849 #if JS_HAS_DESTRUCTURING
4854 #endif
4855 {
4858 }
4866 {
4869 /*
4870 * All of 'var x = i' is hoisted above 'for (x in o)',
4871 * so clear PNX_FORINVAR.
4872 *
4873 * Request JSOP_POP here since the var is for a simple
4874 * name (it is not a destructuring binding's left-hand
4875 * side) and it has an initializer.
4876 */
4881 #if JS_HAS_DESTRUCTURING
4887 #endif
4888 {
4898 }
4900 }
4901 }
4902 }
4909 }
4910 #if JS_HAS_XML_SUPPORT
4913 #endif
4914 }
4918 /* Beware 'for (arguments in ...)' with or without a 'var'. */
4922 #if JS_HAS_DESTRUCTURING
4926 /* FALL THROUGH */
4929 /* Check for valid lvalues in var-less destructuring for-in. */
4934 /*
4935 * Destructuring for-in requires [key, value] enumeration
4936 * in JS1.7.
4937 */
4941 }
4943 #endif
4946 }
4948 /*
4949 * Parse the object expression as the right operand of 'in', first
4950 * removing the top statement from the statement-stack if this is a
4951 * 'for (let x in y)' loop.
4952 */
4953 #if JS_HAS_BLOCK_SCOPE
4957 #endif
4959 #if JS_HAS_BLOCK_SCOPE
4962 #endif
4973 /* Parse the loop condition or null into pn2. */
4982 }
4984 /* Parse the update expression or null into pn3. */
4993 }
4995 /* Build the FORHEAD node to use as the left kid of pn. */
5005 }
5009 /* Parse the loop body into pn->pn_right. */
5015 /* Record the absolute line number for source note emission. */
5018 #if JS_HAS_BLOCK_SCOPE
5023 }
5024 #endif
5029 }
5033 bad_for_each:
5036 }
5041 /*
5042 * try nodes are ternary.
5043 * kid1 is the try statement
5044 * kid2 is the catch node list or null
5045 * kid3 is the finally statement
5046 *
5047 * catch nodes are ternary.
5048 * kid1 is the lvalue (TOK_NAME, TOK_LB, or TOK_LC)
5049 * kid2 is the catch guard or null if no guard
5050 * kid3 is the catch block
5051 *
5052 * catch lvalue nodes are either:
5053 * TOK_NAME for a single identifier
5054 * TOK_RB or TOK_RC for a destructuring left-hand side
5055 *
5056 * finally nodes are TOK_LC statement lists.
5057 */
5084 BindData data;
5086 /* Check for another catch after unconditional catch. */
5090 }
5092 /*
5093 * Create a lexical scope node around the whole catch clause,
5094 * including the head.
5095 */
5101 /*
5102 * Legal catch forms are:
5103 * catch (lhs)
5104 * catch (lhs if <boolean_expression>)
5105 * where lhs is a name or a destructuring left-hand side.
5106 * (the latter is legal only #ifdef JS_HAS_CATCH_GUARD)
5107 */
5114 /*
5115 * Contrary to ECMA Ed. 3, the catch variable is lexically
5116 * scoped, not a property of a new Object instance. This is
5117 * an intentional change that anticipates ECMA Ed. 4.
5118 */
5126 #if JS_HAS_DESTRUCTURING
5133 #endif
5148 }
5151 #if JS_HAS_CATCH_GUARD
5152 /*
5153 * We use 'catch (x if x === 5)' (not 'catch (x : x === 5)')
5154 * to avoid conflicting with the JS2/ECMAv4 type annotation
5155 * catchguard syntax.
5156 */
5161 }
5162 #endif
5176 }
5190 }
5194 }
5196 }
5203 /* ECMA-262 Edition 3 says 'throw [no LineTerminator here] Expr'. */
5210 }
5220 /* TOK_CATCH and TOK_FINALLY are both handled in the TOK_TRY case */
5242 }
5245 }
5251 }
5254 }
5255 }
5273 }
5279 }
5281 }
5284 }
5285 }
5291 }
5294 }
5295 }
5301 /*
5302 * In most cases, we want the constructs forbidden in strict mode
5303 * code to be a subset of those that JSOPTION_STRICT warns about, and
5304 * we should use ReportStrictModeError. However, 'with' is the sole
5305 * instance of a construct that is forbidden in strict mode code, but
5306 * doesn't even merit a warning under JSOPTION_STRICT. See
5307 * https://bugzilla.mozilla.org/show_bug.cgi?id=514576#c1.
5308 */
5312 }
5340 /* Tell js_EmitTree to generate a final POP. */
5344 #if JS_HAS_BLOCK_SCOPE
5346 {
5350 /* Check for a let statement or let expression. */
5356 /* Let expressions require automatic semicolon insertion. */
5360 }
5362 /*
5363 * This is a let declaration. We must be directly under a block per
5364 * the proposed ES4 specs, but not an implicit block created due to
5365 * 'for (let ...)'. If we pass this error test, make the enclosing
5366 * JSStmtInfo be our scope. Further let declarations in this block
5367 * will find this scope statement and use the same block object.
5368 *
5369 * If we are the first let declaration in this block (i.e., when the
5370 * enclosing maybe-scope JSStmtInfo isn't yet a scope statement) then
5371 * we also need to set tc->blockNode to be our TOK_LEXICALSCOPE.
5372 */
5378 }
5385 /*
5386 * ES4 specifies that let at top level and at body-block scope
5387 * does not shadow var, so convert back to var.
5388 */
5396 }
5398 /*
5399 * Some obvious assertions here, but they may help clarify the
5400 * situation. This stmt is not yet a scope, so it must not be a
5401 * catch block (catch is a lexical scope by definition).
5402 */
5411 /* Convert the block statement into a scope statement. */
5420 /*
5421 * Insert stmt on the tc->topScopeStmt/stmtInfo.downScope linked
5422 * list stack, if it isn't already there. If it is there, but it
5423 * lacks the SIF_SCOPE flag, it must be a try, catch, or finally
5424 * block.
5425 */
5436 #ifdef DEBUG
5439 #endif
5441 /* Create a new lexical scope node for these statements. */
5453 }
5460 }
5470 {
5471 uintN oldflags;
5484 /*
5485 * If we contain a function statement and our container is top-level
5486 * or another block, flag pn to preserve braces when decompiling.
5487 */
5491 }
5494 }
5504 #if JS_HAS_DEBUGGER_KEYWORD
5514 #if JS_HAS_XML_SUPPORT
5527 }
5529 /* Is this an E4X dagger I see before me? */
5538 #endif
5544 #if JS_HAS_XML_SUPPORT
5545 expression:
5546 #endif
5556 }
5562 }
5563 }
5568 /* Push a label struct and parse the statement. */
5575 /* Normalize empty statement to empty block for the decompiler. */
5580 }
5582 /* Pop the label, set pn_expr, and return early. */
5588 }
5599 /*
5600 * Flag lambdas immediately applied as statements as instances of
5601 * the JS "module pattern". See CheckForImmediatelyAppliedLambda.
5602 */
5606 }
5609 /*
5610 * Keep track of all apparent methods created by assignments such
5611 * as this.foo = function (...) {...} in a function that could end
5612 * up a constructor function. See Parser::setFunctionKinds.
5613 */
5623 }
5626 }
5628 }
5630 /* Check termination of this primitive statement. */
5632 }
5634 static void
5636 {
5641 }
5643 JSParseNode *
5645 {
5646 TokenKind tt;
5649 BindData data;
5653 /*
5654 * The three options here are:
5655 * - TOK_LET: We are parsing a let declaration.
5656 * - TOK_LP: We are parsing the head of a let block.
5657 * - Otherwise, we're parsing var declarations.
5658 */
5663 #if JS_HAS_BLOCK_SCOPE
5666 #endif
5668 /* Make sure that statement set up the tree context correctly. */
5674 }
5676 }
5685 /*
5686 * SpiderMonkey const is really "write once per initialization evaluation"
5687 * var, whereas let is block scoped. ES-Harmony wants block-scoped const so
5688 * this code will change soon.
5689 */
5696 }
5700 #if JS_HAS_DESTRUCTURING
5714 }
5720 #if JS_HAS_BLOCK_SCOPE
5724 }
5725 #endif
5727 #if JS_HAS_BLOCK_SCOPE
5731 }
5732 #endif
5742 }
5748 }
5750 }
5767 #if JS_HAS_BLOCK_SCOPE
5771 }
5772 #endif
5774 #if JS_HAS_BLOCK_SCOPE
5778 }
5779 #endif
5789 }
5792 ? JSOP_SETNAME
5794 ? JSOP_SETGVAR
5796 ? JSOP_SETLOCAL
5798 ? JSOP_SETCONST
5803 /* The declarator's position must include the initializer. */
5811 }
5812 }
5818 bad_var_init:
5821 }
5823 JSParseNode *
5825 {
5835 #if JS_HAS_GENERATORS
5840 }
5841 #endif
5848 }
5850 }
5852 JSParseNode *
5854 {
5857 #if JS_HAS_GENERATORS
5860 #endif
5870 }
5886 #if JS_HAS_DESTRUCTURING
5889 {
5893 }
5898 }
5899 #endif
5904 #if JS_HAS_XML_SUPPORT
5909 }
5910 /* FALL THROUGH */
5911 #endif
5915 }
5921 /*
5922 * If the definition is not flagged as assigned, we must have imputed
5923 * the initialized flag to it, to optimize for flat closures. But that
5924 * optimization uses source coordinates to check dominance relations,
5925 * so we must extend the end of the definition to cover the right-hand
5926 * side of this assignment, i.e., the initializer.
5927 */
5931 }
5932 }
5935 }
5937 JSParseNode *
5939 {
5947 /*
5948 * Always accept the 'in' operator in the middle clause of a ternary,
5949 * where it's unambiguous, even if we might be parsing the init of a
5950 * for statement.
5951 */
5968 }
5970 }
5972 JSParseNode *
5974 {
5979 }
5981 JSParseNode *
5983 {
5988 }
5990 JSParseNode *
5992 {
5997 }
5999 JSParseNode *
6001 {
6005 }
6007 }
6009 JSParseNode *
6011 {
6016 }
6018 JSParseNode *
6020 {
6025 }
6027 }
6029 JSParseNode *
6031 {
6034 /*
6035 * Uses of the in operator in shiftExprs are always unambiguous,
6036 * so unset the flag that prohibits recognizing it.
6037 */
6043 /*
6044 * Recognize the 'in' token as an operator only if we're not
6045 * currently in the init expr of a for loop.
6046 */
6052 }
6053 /* Restore previous state of inForInit flag. */
6057 }
6059 JSParseNode *
6061 {
6066 }
6068 }
6070 JSParseNode *
6072 {
6080 }
6082 }
6084 JSParseNode *
6086 {
6092 }
6094 }
6099 {
6104 #if JS_HAS_XML_SUPPORT
6106 #endif
6110 }
6115 }
6119 static JSBool
6123 {
6124 JSOp op;
6146 /* FALL THROUGH */
6147 #if JS_HAS_XML_SUPPORT
6151 /* FALL THROUGH */
6152 #endif
6162 }
6165 }
6167 JSParseNode *
6169 {
6205 {
6214 /*
6215 * Under ECMA3, deleting any unary expression is valid -- it simply
6216 * returns true. Here we fold constants before checking for a call
6217 * expression, in order to rule out delete of a generator expression.
6218 */
6226 }
6230 JSMSG_DEPRECATED_DELETE_OPERAND))
6237 }
6240 }
6250 /* Don't look across a newline boundary for a postfix incop. */
6262 }
6263 }
6265 }
6267 }
6269 #if JS_HAS_GENERATORS
6271 /*
6272 * A dedicated helper for transplanting the comprehension expression E in
6273 *
6274 * [E for (V in I)] // array comprehension
6275 * (E for (V in I)) // generator expression
6276 *
6277 * from its initial location in the AST, on the left of the 'for', to its final
6278 * position on the right. To avoid a separate pass we do this by adjusting the
6279 * blockids and name binding links that were established when E was parsed.
6280 *
6281 * A generator expression desugars like so:
6282 *
6283 * (E for (V in I)) => (function () { for (var V in I) yield E; })()
6284 *
6285 * so the transplanter must adjust static level as well as blockid. E's source
6286 * coordinates in root->pn_pos are critical to deciding which binding links to
6287 * preserve and which to cut.
6288 *
6289 * NB: This is not a general tree transplanter -- it knows in particular that
6290 * the one or more bindings induced by V have not yet been created.
6291 */
6296 uintN adjust;
6297 uintN funcLevel;
6302 {
6303 }
6306 };
6308 /*
6309 * Any definitions nested within the comprehension expression of a generator
6310 * expression must move "down" one static level, which of course increases the
6311 * upvar-frame-skip count.
6312 */
6313 static bool
6315 {
6324 }
6327 }
6329 }
6331 static void
6333 {
6338 }
6340 bool
6342 {
6363 /* Binary TOK_COLON nodes can have left == right. See bug 492714. */
6373 {
6374 /*
6375 * Only the first level of transplant recursion through functions needs
6376 * to reparent the funbox, since all descendant functions are correctly
6377 * linked under the top-most funbox. But every visit to this case needs
6378 * to update funbox->level.
6379 *
6380 * Recall that funbox->level is the static level of the code containing
6381 * the definition or expression of the function and not the static level
6382 * of the function's body.
6383 */
6399 }
6400 /* FALL THROUGH */
6401 }
6418 /*
6419 * Adjust the definition's block id only if it is a placeholder not
6420 * to the left of the root node, and if pn is the last use visited
6421 * in the comprehension expression (to avoid adjusting the blockid
6422 * multiple times).
6423 *
6424 * Non-placeholder definitions within the comprehension expression
6425 * will be visited further below.
6426 */
6431 }
6434 #ifdef DEBUG
6437 #endif
6464 }
6470 }
6473 }
6474 }
6475 }
6484 }
6486 }
6488 /*
6489 * Starting from a |for| keyword after the first array initialiser element or
6490 * an expression in an open parenthesis, parse the tail of the comprehension
6491 * or generator expression signified by this |for| keyword in context.
6492 *
6493 * Return null on failure, else return the top-most parse node for the array
6494 * comprehension or generator expression, with a unary node as the body of the
6495 * (possibly nested) for-loop, initialized by |type, op, kid|.
6496 */
6497 JSParseNode *
6500 {
6501 uintN adjust;
6503 JSStmtInfo stmtInfo;
6504 BindData data;
6505 TokenKind tt;
6511 /*
6512 * Generator expression desugars to an immediately applied lambda that
6513 * yields the next value from a for-in loop (possibly nested, and with
6514 * optional if guard). Make pn be the TOK_LC body node.
6515 */
6523 /*
6524 * Make a parse-node and literal object representing the block scope of
6525 * this array comprehension. Our caller in primaryExpr, the TOK_LB case
6526 * aka the array initialiser case, has passed the blockid to claim for
6527 * the comprehension's block scope. We allocate that id or one above it
6528 * here, by calling js_PushLexicalScope.
6529 *
6530 * In the case of a comprehension expression that has nested blocks
6531 * (e.g., let expressions), we will allocate a higher blockid but then
6532 * slide all blocks "to the right" to make room for the comprehension's
6533 * block scope.
6534 */
6546 }
6559 /*
6560 * FOR node is binary, left is loop control and right is body. Use
6561 * index to count each block-local let-variable on the left-hand side
6562 * of the IN.
6563 */
6573 else
6575 }
6581 #if JS_HAS_DESTRUCTURING
6590 #endif
6595 /*
6596 * Create a name node with pn_op JSOP_NAME. We can't set pn_op to
6597 * JSOP_GETLOCAL here, because we don't yet know the block's depth
6598 * in the operand stack frame. The code generator computes that,
6599 * and it tries to bind all names to slots, so we must let it do
6600 * the deed.
6601 */
6612 }
6621 #if JS_HAS_DESTRUCTURING
6628 /* Destructuring requires [key, value] enumeration in JS1.7. */
6632 }
6638 }
6640 #endif
6649 }
6667 }
6679 }
6681 #if JS_HAS_GENERATOR_EXPRS
6683 /*
6684 * Starting from a |for| keyword after an expression, parse the comprehension
6685 * tail completing this generator expression. Wrap the expression at kid in a
6686 * generator function that is immediately called to evaluate to the generator
6687 * iterator that is the value of this generator expression.
6688 *
6689 * Callers pass a blank unary node via pn, which generatorExpr fills in as the
6690 * yield expression, which ComprehensionTail in turn wraps in a TOK_SEMI-type
6691 * expression-statement node that constitutes the body of the |for| loop(s) in
6692 * the generator function.
6693 *
6694 * Note how unlike Python, we do not evaluate the expression to the right of
6695 * the first |in| in the chain of |for| heads. Instead, a generator expression
6696 * is merely sugar for a generator function expression and its application.
6697 */
6698 JSParseNode *
6700 {
6701 /* Initialize pn, connecting it to kid. */
6710 /* Make a new node for the desugared generator function. */
6719 {
6727 /*
6728 * We have to dance around a bit to propagate sharp variables from
6729 * outertc to gentc before setting TCF_HAS_SHARPS implicitly by
6730 * propagating all of outertc's TCF_FUN_FLAGS flags. As below, we have
6731 * to be conservative by leaving TCF_HAS_SHARPS set in outertc if we
6732 * do propagate to gentc.
6733 */
6738 }
6740 /*
6741 * We assume conservatively that any deoptimization flag in tc->flags
6742 * besides TCF_FUN_PARAM_ARGUMENTS can come from the kid. So we
6743 * propagate these flags into genfn. For code simplicity we also do
6744 * not detect if the flags were only set in the kid and could be
6745 * removed from tc->flags.
6746 */
6763 }
6765 /*
6766 * Our result is a call expression that invokes the anonymous generator
6767 * function object.
6768 */
6777 }
6784 JSBool
6786 {
6794 #if JS_HAS_GENERATORS
6800 }
6801 #endif
6802 #if JS_HAS_GENERATOR_EXPRS
6813 js_generator_str);
6815 }
6816 }
6817 #endif
6824 }
6826 }
6828 /* Check for an immediately-applied (new'ed) lambda and clear PND_FUNARG. */
6831 {
6839 }
6841 }
6843 JSParseNode *
6845 {
6850 /* Check for new expression first. */
6868 JSMSG_TOO_MANY_CON_ARGS);
6870 }
6890 }
6891 }
6898 #if JS_HAS_XML_SUPPORT
6904 /* Check both tt and pn_type, to distinguish |x.(y)| and |x.y::z| from |x.y|. */
6915 /* A filtering predicate is like a with statement. */
6923 }
6927 }
6928 #else
6933 #endif
6936 #if JS_HAS_XML_SUPPORT
6953 }
6959 #endif
6972 /*
6973 * Optimize o['p'] to o.p by rewriting pn2, but avoid rewriting
6974 * o['0'] to use JSOP_GETPROP, to keep fast indexing disjoint in
6975 * the interpreter from fast property access. However, if the
6976 * bracketed string is a uint32, we rewrite pn3 to be a number
6977 * instead of a string.
6978 */
6981 jsuint index;
6990 }
6994 }
7008 /* Select JSOP_EVAL and flag tc as heavyweight. */
7011 }
7015 /* Select JSOP_APPLY given foo.apply(...). */
7017 }
7018 }
7027 JSMSG_TOO_MANY_FUN_ARGS);
7029 }
7034 }
7037 }
7041 }
7043 JSParseNode *
7045 {
7046 uintN oldflags;
7049 /*
7050 * Always accept the 'in' operator in a parenthesized expression,
7051 * where it's unambiguous, even if we might be parsing the init of a
7052 * for statement.
7053 */
7059 }
7061 #if JS_HAS_XML_SUPPORT
7063 JSParseNode *
7065 {
7074 }
7076 /*
7077 * From the ECMA-357 grammar in 11.1.1 and 11.1.2:
7078 *
7079 * AttributeIdentifier:
7080 * @ PropertySelector
7081 * @ QualifiedIdentifier
7082 * @ [ Expression ]
7083 *
7084 * PropertySelector:
7085 * Identifier
7086 * *
7087 *
7088 * QualifiedIdentifier:
7089 * PropertySelector :: PropertySelector
7090 * PropertySelector :: [ Expression ]
7091 *
7092 * We adapt AttributeIdentifier and QualifiedIdentier to be LL(1), like so:
7093 *
7094 * AttributeIdentifier:
7095 * @ QualifiedIdentifier
7096 * @ [ Expression ]
7097 *
7098 * PropertySelector:
7099 * Identifier
7100 * *
7101 *
7102 * QualifiedIdentifier:
7103 * PropertySelector :: PropertySelector
7104 * PropertySelector :: [ Expression ]
7105 * PropertySelector
7106 *
7107 * As PrimaryExpression: Identifier is in ECMA-262 and we want the semantics
7108 * for that rule to result in a name node, but ECMA-357 extends the grammar
7109 * to include PrimaryExpression: QualifiedIdentifier, we must factor further:
7110 *
7111 * QualifiedIdentifier:
7112 * PropertySelector QualifiedSuffix
7113 *
7114 * QualifiedSuffix:
7115 * :: PropertySelector
7116 * :: [ Expression ]
7117 * /nothing/
7118 *
7119 * And use this production instead of PrimaryExpression: QualifiedIdentifier:
7120 *
7121 * PrimaryExpression:
7122 * Identifier QualifiedSuffix
7123 *
7124 * We hoist the :: match into callers of QualifiedSuffix, in order to tweak
7125 * PropertySelector vs. Identifier pn_arity, pn_op, and other members.
7126 */
7127 JSParseNode *
7129 {
7145 }
7147 }
7149 JSParseNode *
7151 {
7153 TokenKind tt;
7160 /* Left operand of :: must be evaluated if it is an identifier. */
7166 /* Inline and specialize propertySelector for JSOP_QNAMECONST. */
7175 }
7180 }
7192 }
7194 JSParseNode *
7196 {
7203 /* Hack for bug 496316. Slowing down E4X won't make it go away, alas. */
7206 }
7208 }
7210 JSParseNode *
7212 {
7214 TokenKind tt;
7229 }
7234 }
7236 /*
7237 * Make a TOK_LC unary node whose pn_kid is an expression.
7238 */
7239 JSParseNode *
7241 {
7249 /*
7250 * Turn off XML tag mode. We save the old value of the flag because it may
7251 * already be off: XMLExpr is called both from within a tag, and from
7252 * within text contained in an element, but outside of any start, end, or
7253 * point tag.
7254 */
7266 }
7268 /*
7269 * Make a terminal node for one of TOK_XMLNAME, TOK_XMLATTR, TOK_XMLSPACE,
7270 * TOK_XMLTEXT, TOK_XMLCDATA, TOK_XMLCOMMENT, or TOK_XMLPI. When converting
7271 * parse tree to XML, we preserve a TOK_XMLSPACE node only if it's the sole
7272 * child of a container tag.
7273 */
7274 JSParseNode *
7276 {
7286 }
7288 /*
7289 * Parse the productions:
7290 *
7291 * XMLNameExpr:
7292 * XMLName XMLNameExpr?
7293 * { Expr } XMLNameExpr?
7294 *
7295 * Return a PN_LIST, PN_UNARY, or PN_NULLARY according as XMLNameExpr produces
7296 * a list of names and/or expressions, a single expression, or a single name.
7297 * If PN_LIST or PN_NULLARY, pn_type will be TOK_XMLNAME; if PN_UNARY, pn_type
7298 * will be TOK_LC.
7299 */
7300 JSParseNode *
7302 {
7304 TokenKind tt;
7318 }
7332 }
7335 }
7340 }
7342 /*
7343 * Macro to test whether an XMLNameExpr or XMLTagContent node can be folded
7344 * at compile time into a JSXML tree.
7345 */
7346 #define XML_FOLDABLE(pn) ((pn)->pn_arity == PN_LIST \
7347 ? ((pn)->pn_xflags & PNX_CANTFOLD) == 0 \
7348 : (pn)->pn_type != TOK_LC)
7350 /*
7351 * Parse the productions:
7352 *
7353 * XMLTagContent:
7354 * XMLNameExpr
7355 * XMLTagContent S XMLNameExpr S? = S? XMLAttr
7356 * XMLTagContent S XMLNameExpr S? = S? { Expr }
7357 *
7358 * Return a PN_LIST, PN_UNARY, or PN_NULLARY according to how XMLTagContent
7359 * produces a list of name and attribute values and/or braced expressions, a
7360 * single expression, or a single name.
7361 *
7362 * If PN_LIST or PN_NULLARY, pn_type will be TOK_XMLNAME for the case where
7363 * XMLTagContent: XMLNameExpr. If pn_type is not TOK_XMLNAME but pn_arity is
7364 * PN_LIST, pn_type will be tagtype. If PN_UNARY, pn_type will be TOK_LC and
7365 * we parsed exactly one expression.
7366 */
7367 JSParseNode *
7369 {
7371 TokenKind tt;
7384 }
7397 }
7415 }
7420 }
7423 }
7425 #define XML_CHECK_FOR_ERROR_AND_EOF(tt,result) \
7426 JS_BEGIN_MACRO \
7427 if ((tt) <= TOK_EOF) { \
7428 if ((tt) == TOK_EOF) { \
7429 reportErrorNumber(NULL, JSREPORT_ERROR, JSMSG_END_OF_XML_SOURCE); \
7430 } \
7431 return result; \
7432 } \
7433 JS_END_MACRO
7435 /*
7436 * Consume XML element tag content, including the TOK_XMLETAGO (</) sequence
7437 * that opens the end tag for the container.
7438 */
7439 JSBool
7441 {
7450 /* Non-zero-length XML text scanned. */
7456 }
7472 }
7477 }
7482 }
7487 }
7489 /*
7490 * Return a PN_LIST node containing an XML or XMLList Initialiser.
7491 */
7492 JSParseNode *
7494 {
7496 TokenKind tt;
7512 /*
7513 * XMLElement. Append the tag and its contents, if any, to pn.
7514 */
7522 /* Point tag (/>): recycle pn if pn2 is a list of tag contents. */
7533 }
7537 /* We had better have a tag-close (>) at this point. */
7541 }
7544 /* Make sure pn2 is a TOK_XMLSTAGO list containing tag contents. */
7553 }
7555 /* Now make pn a nominal-root TOK_XMLELEM list containing pn2. */
7563 /* Get element contents and delimiting end-tag-open sequence. */
7572 }
7574 /* Parse end tag; check mismatch at compile-time if we can. */
7579 /* Oops, end tag has attributes! */
7582 }
7586 /* End vs. start tag name mismatch: point to the tag name. */
7590 }
7592 /* Make a TOK_XMLETAGO list with pn2 as its single child. */
7603 }
7607 }
7609 /* Set pn_op now that pn has been updated to its final value. */
7612 /* XMLList Initialiser. */
7624 }
7629 }
7631 JSParseNode *
7633 {
7634 uint32 oldopts;
7637 /*
7638 * Force XML support to be enabled so that comments and CDATA literals
7639 * are recognized, instead of <! followed by -- starting an HTML comment
7640 * to end of line (used in script tags to hide content from old browsers
7641 * that don't recognize <script>).
7642 */
7647 }
7649 JSParseNode *
7651 {
7652 /*
7653 * Push a compiler frame if we have no frames, or if the top frame is a
7654 * lightweight function activation, or if its scope chain doesn't match
7655 * the one passed to us.
7656 */
7660 /* Set XML-only mode to turn off special treatment of {expr} in XML. */
7670 }
7674 }
7678 #if JS_HAS_BLOCK_SCOPE
7679 /*
7680 * Check whether blockid is an active scoping statement in tc. This code is
7681 * necessary to qualify tc->decls.lookup() hits in primaryExpr's TOK_NAME case
7682 * (below) where the hits come from Scheme-ish let bindings in for loop heads
7683 * and let blocks and expressions (not let declarations).
7684 *
7685 * Unlike let declarations ("let as the new var"), which is a kind of letrec
7686 * due to hoisting, let in a for loop head, let block, or let expression acts
7687 * like Scheme's let: initializers are evaluated without the new let bindings
7688 * being in scope.
7689 *
7690 * Name binding analysis is eager with fixups, rather than multi-pass, and let
7691 * bindings push on the front of the tc->decls JSAtomList (either the singular
7692 * list or on a hash chain -- see JSAtomList::AddHow) in order to shadow outer
7693 * scope bindings of the same name.
7694 *
7695 * This simplifies binding lookup code at the price of a linear search here,
7696 * but only if code uses let (var predominates), and even then this function's
7697 * loop iterates more than once only in crazy cases.
7698 */
7701 {
7707 }
7709 }
7710 #endif
7712 JSParseNode *
7714 {
7716 JSOp op;
7722 #if JS_HAS_XML_SUPPORT
7732 }
7733 #endif
7740 {
7741 JSBool matched;
7742 jsuint index;
7751 #if JS_HAS_GENERATORS
7753 #endif
7761 }
7767 }
7770 /* So CURRENT_TOKEN gets TOK_COMMA and not TOK_LB. */
7776 }
7782 /* If we didn't already match TOK_COMMA in above case. */
7785 }
7786 }
7788 #if JS_HAS_GENERATORS
7789 /*
7790 * At this point, (index == 0 && pn->pn_count != 0) implies one
7791 * element initialiser was parsed.
7792 *
7793 * An array comprehension of the form:
7794 *
7795 * [i * j for (i in o) for (j in p) if (i != j)]
7796 *
7797 * translates to roughly the following let expression:
7798 *
7799 * let (array = new Array, i, j) {
7800 * for (i in o) let {
7801 * for (j in p)
7802 * if (i != j)
7803 * array.push(i * j)
7804 * }
7805 * array
7806 * }
7807 *
7808 * where array is a nameless block-local variable. The "roughly"
7809 * means that an implementation may optimize away the array.push.
7810 * An array comprehension opens exactly one block scope, no matter
7811 * how many for heads it contains.
7812 *
7813 * Each let () {...} or for (let ...) ... compiles to:
7814 *
7815 * JSOP_ENTERBLOCK <o> ... JSOP_LEAVEBLOCK <n>
7816 *
7817 * where <o> is a literal object representing the block scope,
7818 * with <n> properties, naming each var declared in the block.
7819 *
7820 * Each var declaration in a let-block binds a name in <o> at
7821 * compile time, and allocates a slot on the operand stack at
7822 * runtime via JSOP_ENTERBLOCK. A block-local var is accessed
7823 * by the JSOP_GETLOCAL and JSOP_SETLOCAL ops, and iterated with
7824 * JSOP_FORLOCAL. These ops all have an immediate operand, the
7825 * local slot's stack index from fp->spbase.
7826 *
7827 * The array comprehension iteration step, array.push(i * j) in
7828 * the example above, is done by <i * j>; JSOP_ARRAYCOMP <array>,
7829 * where <array> is the index of array's stack slot.
7830 */
7834 /* Relabel pn as an array comprehension node. */
7837 /*
7838 * Remove the comprehension expression from pn's linked list
7839 * and save it via pnexp. We'll re-install it underneath the
7840 * ARRAYPUSH node after we parse the rest of the comprehension.
7841 */
7854 }
7858 }
7861 }
7864 {
7865 JSBool afterComma;
7868 /*
7869 * A map from property names we've seen thus far to bit masks.
7870 * (We use ALE_INDEX/ALE_SET_INDEX). An atom's mask includes
7871 * JSPROP_SETTER if we've seen a setter for it, JSPROP_GETTER
7872 * if we've seen as getter, and both of those if we've just
7873 * seen an ordinary value.
7874 */
7900 }
7903 {
7909 else
7929 }
7933 }
7935 /* We have to fake a 'function' token here. */
7940 }
7941 property_name:
7954 }
7961 #if JS_HAS_DESTRUCTURING_SHORTHAND
7963 #endif
7966 #if JS_HAS_DESTRUCTURING_SHORTHAND
7967 }
7969 /*
7970 * Support, e.g., |var {x, y} = o| as destructuring shorthand
7971 * for |var {x: x, y: y} = o|, per proposed JS2/ES4 for JS1.8.
7972 */
7979 }
7980 #endif
7981 }
7984 skip:
7989 /*
7990 * In strict mode code, check for duplicate property names. Treat
7991 * getters and setters as distinct attributes of each property. A
7992 * plain old value conflicts with a getter or a setter.
7993 */
8005 }
8007 /*
8008 * Use only string-valued atoms for detecting duplicate
8009 * properties so that 1 and "1" properly collide.
8010 */
8018 }
8028 }
8029 }
8036 }
8037 }
8045 }
8047 }
8049 end_obj_init:
8052 }
8054 #if JS_HAS_BLOCK_SCOPE
8060 #endif
8062 #if JS_HAS_SHARP_VARS
8070 #if JS_HAS_XML_SUPPORT
8073 #endif
8077 }
8086 /* Check for forward/dangling references at runtime, to allow eval. */
8097 {
8098 JSBool genexp;
8107 }
8109 #if JS_HAS_XML_SUPPORT
8130 #if JS_HAS_SHARP_VARS
8131 /* FALL THROUGH */
8132 #endif
8134 #if JS_HAS_XML_SUPPORT
8138 #endif
8143 #if JS_HAS_XML_SUPPORT
8146 else
8147 #endif
8160 /*
8161 * Flag arguments usage so we can avoid unsafe optimizations such
8162 * as formal parameter assignment analysis (because of the hated
8163 * feature whereby arguments alias formals). We do this even for
8164 * a reference of the form foo.arguments, which ancient code may
8165 * still use instead of arguments (more hate).
8166 */
8169 /*
8170 * Bind early to JSOP_ARGUMENTS to relieve later code from having
8171 * to do this work (new rule for the emitter to count on).
8172 */
8176 }
8178 #if JS_HAS_XML_SUPPORT
8180 #endif
8189 #if JS_HAS_BLOCK_SCOPE
8190 /*
8191 * Skip out-of-scope let bindings along an ALE list or hash
8192 * chain. These can happen due to |let (x = x) x| block and
8193 * expression bindings, where the x on the right of = comes
8194 * from an outer scope. See bug 496532.
8195 */
8203 }
8204 #endif
8205 }
8214 /*
8215 * No definition before this use in any lexical scope.
8216 * Add a mapping in tc->lexdeps from pn->pn_atom to a
8217 * new node for the forward-referenced definition. This
8218 * placeholder definition node will be adopted when we
8219 * parse the real defining declaration form, or left as
8220 * a free variable definition if we never see the real
8221 * definition.
8222 */
8228 /*
8229 * In case this is a forward reference to a function,
8230 * we pessimistically set PND_FUNARG if the next token
8231 * is not a left parenthesis.
8232 *
8233 * If the definition eventually parsed into dn is not a
8234 * function, this flag won't hurt, and if we do parse a
8235 * function with pn's name, then the PND_FUNARG flag is
8236 * necessary for safe context->display-based optimiza-
8237 * tion of the closure's static link.
8238 */
8243 }
8244 }
8249 /* Here we handle the backward function reference case. */
8254 }
8255 }
8257 #if JS_HAS_XML_SUPPORT
8262 /*
8263 * Here primaryExpr is called after . or .. followed by a name
8264 * followed by ::. This is the only case where a keyword after
8265 * . or .. is not treated as a property name.
8266 */
8275 }
8276 }
8280 }
8281 #endif
8285 {
8301 }
8309 }
8327 /* The scanner or one of its subroutines reported the error. */
8333 }
8335 }
8337 JSParseNode *
8339 {
8340 TokenPtr begin;
8352 #if JS_HAS_GENERATOR_EXPRS
8357 }
8360 js_generator_str);
8362 }
8367 }
8375 js_generator_str);
8377 }
8380 }
8381 }
8385 }
8387 /*
8388 * Fold from one constant type to another.
8389 * XXX handles only strings and numbers for now
8390 */
8391 static JSBool
8393 {
8398 jsdouble d;
8404 }
8417 }
8421 }
8422 }
8424 }
8426 /*
8427 * Fold two numeric constants. Beware that pn1 and pn2 are recycled, unless
8428 * one of them aliases pn, so you can't safely fetch pn2->pn_next, e.g., after
8429 * a successful call to this function.
8430 */
8431 static JSBool
8434 {
8470 #if defined(XP_WIN)
8471 /* XXX MSVC miscompiles such that (NaN == 0) */
8474 else
8475 #endif
8480 else
8484 }
8492 }
8496 }
8498 /* Take care to allow pn1 or pn2 to alias pn. */
8508 }
8510 #if JS_HAS_XML_SUPPORT
8512 static JSBool
8514 {
8515 TokenKind tt;
8530 }
8532 /*
8533 * GC Rooting here is tricky: for most of the loop, |accum| is safe via
8534 * the newborn string root. However, when |pn2->pn_type| is TOK_XMLCDATA,
8535 * TOK_XMLCOMMENT, or TOK_XMLPI it is knocked out of the newborn root.
8536 * Therefore, we have to add additonal protection from GC nesting under
8537 * js_ConcatStrings.
8538 */
8540 /* The parser already rejected end-tags with attributes. */
8546 /* FALL THROUGH */
8575 cantfold:
8580 #ifdef DEBUG_brendanXXX
8584 else
8587 #endif
8592 }
8601 }
8606 }
8609 {
8614 }
8617 #ifdef DEBUG_brendanXXX
8621 #endif
8623 }
8625 }
8634 }
8639 }
8645 }
8654 }
8657 /*
8658 * Only one node under pn, and it has been folded: move pn1 onto pn
8659 * unless pn is an XML root (in which case we need it to tell the code
8660 * generator to emit a JSOP_TOXML or JSOP_TOXMLLIST op). If pn is an
8661 * XML root *and* it's a point-tag, rewrite it to TOK_XMLELEM to avoid
8662 * extra "<" and "/>" bracketing at runtime.
8663 */
8669 }
8670 }
8672 }
8676 static int
8678 {
8686 #if JS_HAS_GENERATOR_EXPRS
8688 {
8689 /*
8690 * A generator expression as an if or loop condition has no effects, it
8691 * simply results in a truthy object reference. This condition folding
8692 * is needed for the decompiler. See bug 442342 and bug 443074.
8693 */
8701 /* FALL THROUGH */
8702 }
8703 #endif
8716 }
8718 }
8720 JSBool
8722 {
8729 {
8741 }
8744 {
8745 /* Propagate inCond through logical connectives. */
8748 /* Don't fold a parenthesized call expression. See bug 537673. */
8753 /* Save the list head in pn1 for later use. */
8757 }
8759 }
8762 /* Any kid may be null (e.g. for (;;)). */
8774 }
8775 }
8784 /* Propagate inCond through logical connectives. */
8791 }
8793 /* First kid may be null (for default case in switch). */
8803 /*
8804 * Kludge to deal with typeof expressions: because constant folding
8805 * can turn an expression into a name node, we have to check here,
8806 * before folding, to see if we should throw undefined name errors.
8807 *
8808 * NB: We know that if pn->pn_op is JSOP_TYPEOF, pn1 will not be
8809 * null. This assumption does not hold true for other unary
8810 * expressions.
8811 */
8820 /*
8821 * Skip pn1 down along a chain of dotted member expressions to avoid
8822 * excessive recursion. Our only goal here is to fold constants (if
8823 * any) in the primary expression operand to the left of the first
8824 * dot in the chain.
8825 */
8832 }
8843 }
8849 /* FALL THROUGH */
8852 /* Reduce 'if (C) T; else E' into T for true C, E for false. */
8868 }
8869 /* FALL THROUGH */
8871 /* Early return to dodge common code that copies pn2 to pn. */
8873 }
8875 #if JS_HAS_GENERATOR_EXPRS
8876 /* Don't fold a trailing |if (0)| in a generator expression. */
8879 #endif
8884 /*
8885 * False condition and no else, or an empty then-statement was
8886 * moved up over pn. Either way, make pn an empty block (not an
8887 * empty statement, which does not decompile, even when labeled).
8888 * NB: pn must be a TOK_IF as TOK_HOOK can never have a null kid
8889 * or an empty statement for a child.
8890 */
8894 }
8913 }
8916 }
8926 }
8929 // We may have to change arity from LIST to BINARY.
8941 }
8951 }
8952 }
8953 }
8957 /*
8958 * Compound operators such as *= should be subject to folding, in case
8959 * the left-hand side is constant, and so that the decompiler produces
8960 * the same string that you get from decompiling a script or function
8961 * compiled from that same string. As with +, += is special.
8962 */
8967 /* FALL THROUGH */
8975 /*
8976 * Any string literal term with all others number or string means
8977 * this is a concatenation. If any term is not a string or number
8978 * literal, we can't fold.
8979 */
8986 /* Ok, we're concatenating: convert non-string constant operands. */
8991 /* XXX fold only if all operands convert to string */
8995 }
8997 /* Allocate a new buffer and string descriptor for the result. */
9005 }
9007 /* Fill the buffer, advancing chars and recycling kids as we go. */
9013 }
9016 /* Atomize the result string and mutate pn to refer to it. */
9024 }
9026 /* Handle a binary string concatenation. */
9032 TOK_STRING)) {
9034 }
9051 }
9053 /* Can't concatenate string literals, let's try numbers. */
9060 do_binary_op:
9066 }
9068 /* XXX fold only if all operands convert to number */
9071 }
9083 }
9084 }
9090 }
9094 }
9095 }
9100 jsdouble d;
9102 /* Operate on one numeric constant. */
9120 /* FALL THROUGH */
9123 /* Return early to dodge the common TOK_NUMBER code. */
9125 }
9138 }
9139 }
9142 #if JS_HAS_XML_SUPPORT
9153 }
9158 jsval v;
9175 }
9180 }
9200 }
9204 }
9205 }
9208 }