dlls/jscript/engine.c

   1 /*
   2  * Copyright 2008,2011 Jacek Caban for CodeWeavers
   3  *
   4  * This library is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU Lesser General Public
   6  * License as published by the Free Software Foundation; either
   7  * version 2.1 of the License, or (at your option) any later version.
   8  *
   9  * This library is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12  * Lesser General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU Lesser General Public
  15  * License along with this library; if not, write to the Free Software
  16  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  17  */
  18
  19 #include "config.h"
  20 #include "wine/port.h"
  21
  22 #include <math.h>
  23 #include <assert.h>
  24
  25 #include "jscript.h"
  26 #include "engine.h"
  27
  28 #include "wine/debug.h"
  29
  30 WINE_DEFAULT_DEBUG_CHANNEL(jscript);
  31
  32 static const WCHAR booleanW[] = {'b','o','o','l','e','a','n',0};
  33 static const WCHAR functionW[] = {'f','u','n','c','t','i','o','n',0};
  34 static const WCHAR numberW[] = {'n','u','m','b','e','r',0};
  35 static const WCHAR objectW[] = {'o','b','j','e','c','t',0};
  36 static const WCHAR stringW[] = {'s','t','r','i','n','g',0};
  37 static const WCHAR undefinedW[] = {'u','n','d','e','f','i','n','e','d',0};
  38 static const WCHAR unknownW[] = {'u','n','k','n','o','w','n',0};
  39
  40 struct _except_frame_t {
  41     unsigned stack_top;
  42     scope_chain_t *scope;
  43     unsigned catch_off;
  44     unsigned finally_off;
  45
  46     except_frame_t *next;
  47 };
  48
  49 typedef struct {
  50     enum {
  51         EXPRVAL_JSVAL,
  52         EXPRVAL_IDREF,
  53         EXPRVAL_STACK_REF,
  54         EXPRVAL_INVALID
  55     } type;
  56     union {
  57         jsval_t val;
  58         struct {
  59             IDispatch *disp;
  60             DISPID id;
  61         } idref;
  62         unsigned off;
  63         HRESULT hres;
  64     } u;
  65 } exprval_t;
  66
  67 static HRESULT stack_push(script_ctx_t *ctx, jsval_t v)
  68 {
  69     if(!ctx->stack_size) {
  70         ctx->stack = heap_alloc(16*sizeof(*ctx->stack));
  71         if(!ctx->stack)
  72             return E_OUTOFMEMORY;
  73         ctx->stack_size = 16;
  74     }else if(ctx->stack_size == ctx->stack_top) {
  75         jsval_t *new_stack;
  76
  77         new_stack = heap_realloc(ctx->stack, ctx->stack_size*2*sizeof(*new_stack));
  78         if(!new_stack) {
  79             jsval_release(v);
  80             return E_OUTOFMEMORY;
  81         }
  82
  83         ctx->stack = new_stack;
  84         ctx->stack_size *= 2;
  85     }
  86
  87     ctx->stack[ctx->stack_top++] = v;
  88     return S_OK;
  89 }
  90
  91 static inline HRESULT stack_push_string(script_ctx_t *ctx, const WCHAR *str)
  92 {
  93     jsstr_t *v;
  94
  95     v = jsstr_alloc(str);
  96     if(!v)
  97         return E_OUTOFMEMORY;
  98
  99     return stack_push(ctx, jsval_string(v));
 100 }
 101
 102 static inline jsval_t stack_top(script_ctx_t *ctx)
 103 {
 104     assert(ctx->stack_top > ctx->call_ctx->stack_base);
 105     return ctx->stack[ctx->stack_top-1];
 106 }
 107
 108 static inline jsval_t *stack_top_ref(script_ctx_t *ctx, unsigned n)
 109 {
 110     assert(ctx->stack_top > ctx->call_ctx->stack_base+n);
 111     return ctx->stack+ctx->stack_top-1-n;
 112 }
 113
 114 static inline jsval_t stack_topn(script_ctx_t *ctx, unsigned n)
 115 {
 116     return *stack_top_ref(ctx, n);
 117 }
 118
 119 static inline jsval_t *stack_args(script_ctx_t *ctx, unsigned n)
 120 {
 121     if(!n)
 122         return NULL;
 123     assert(ctx->stack_top > ctx->call_ctx->stack_base+n-1);
 124     return ctx->stack + ctx->stack_top-n;
 125 }
 126
 127 static inline jsval_t stack_pop(script_ctx_t *ctx)
 128 {
 129     assert(ctx->stack_top > ctx->call_ctx->stack_base);
 130     return ctx->stack[--ctx->stack_top];
 131 }
 132
 133 static void stack_popn(script_ctx_t *ctx, unsigned n)
 134 {
 135     while(n--)
 136         jsval_release(stack_pop(ctx));
 137 }
 138
 139 static HRESULT stack_pop_number(script_ctx_t *ctx, double *r)
 140 {
 141     jsval_t v;
 142     HRESULT hres;
 143
 144     v = stack_pop(ctx);
 145     hres = to_number(ctx, v, r);
 146     jsval_release(v);
 147     return hres;
 148 }
 149
 150 static HRESULT stack_pop_object(script_ctx_t *ctx, IDispatch **r)
 151 {
 152     jsval_t v;
 153     HRESULT hres;
 154
 155     v = stack_pop(ctx);
 156     if(is_object_instance(v)) {
 157         if(!get_object(v))
 158             return throw_type_error(ctx, JS_E_OBJECT_REQUIRED, NULL);
 159         *r = get_object(v);
 160         return S_OK;
 161     }
 162
 163     hres = to_object(ctx, v, r);
 164     jsval_release(v);
 165     return hres;
 166 }
 167
 168 static inline HRESULT stack_pop_int(script_ctx_t *ctx, INT *r)
 169 {
 170     return to_int32(ctx, stack_pop(ctx), r);
 171 }
 172
 173 static inline HRESULT stack_pop_uint(script_ctx_t *ctx, DWORD *r)
 174 {
 175     return to_uint32(ctx, stack_pop(ctx), r);
 176 }
 177
 178 static inline unsigned local_off(call_frame_t *frame, int ref)
 179 {
 180     return ref < 0
 181         ? frame->arguments_off - ref-1
 182         : frame->variables_off + ref;
 183 }
 184
 185 static inline BSTR local_name(call_frame_t *frame, int ref)
 186 {
 187     return ref < 0 ? frame->function->params[-ref-1] : frame->function->variables[ref].name;
 188 }
 189
 190 /* Steals input reference even on failure. */
 191 static HRESULT stack_push_exprval(script_ctx_t *ctx, exprval_t *val)
 192 {
 193     HRESULT hres;
 194
 195     switch(val->type) {
 196     case EXPRVAL_JSVAL:
 197         assert(0);
 198     case EXPRVAL_IDREF:
 199         hres = stack_push(ctx, jsval_disp(val->u.idref.disp));
 200         if(SUCCEEDED(hres))
 201             hres = stack_push(ctx, jsval_number(val->u.idref.id));
 202         else
 203             IDispatch_Release(val->u.idref.disp);
 204         return hres;
 205     case EXPRVAL_STACK_REF:
 206         hres = stack_push(ctx, jsval_number(val->u.off));
 207         if(SUCCEEDED(hres))
 208             hres = stack_push(ctx, jsval_undefined());
 209         return hres;
 210     case EXPRVAL_INVALID:
 211         hres = stack_push(ctx, jsval_undefined());
 212         if(SUCCEEDED(hres))
 213             hres = stack_push(ctx, jsval_number(val->u.hres));
 214         return hres;
 215     }
 216
 217     assert(0);
 218     return E_FAIL;
 219 }
 220
 221 static BOOL stack_topn_exprval(script_ctx_t *ctx, unsigned n, exprval_t *r)
 222 {
 223     jsval_t v = stack_topn(ctx, n+1);
 224
 225     switch(jsval_type(v)) {
 226     case JSV_NUMBER: {
 227         call_frame_t *frame = ctx->call_ctx;
 228         unsigned off = get_number(v);
 229
 230         if(!frame->base_scope->frame && off >= frame->arguments_off) {
 231             DISPID id;
 232             BSTR name;
 233             HRESULT hres;
 234
 235             /* Got stack reference in deoptimized code. Need to convert it back to variable object reference. */
 236
 237             assert(off < frame->variables_off + frame->function->var_cnt);
 238             name = off >= frame->variables_off
 239                 ? frame->function->variables[off - frame->variables_off].name
 240                 : frame->function->params[off - frame->arguments_off];
 241             hres = jsdisp_get_id(ctx->call_ctx->base_scope->jsobj, name, 0, &id);
 242             if(FAILED(hres)) {
 243                 r->type = EXPRVAL_INVALID;
 244                 r->u.hres = hres;
 245                 return FALSE;
 246             }
 247
 248             *stack_top_ref(ctx, n+1) = jsval_obj(jsdisp_addref(frame->base_scope->jsobj));
 249             *stack_top_ref(ctx, n) = jsval_number(id);
 250             r->type = EXPRVAL_IDREF;
 251             r->u.idref.disp = frame->base_scope->obj;
 252             r->u.idref.id = id;
 253             return TRUE;
 254         }
 255
 256         r->type = EXPRVAL_STACK_REF;
 257         r->u.off = off;
 258         return TRUE;
 259     }
 260     case JSV_OBJECT:
 261         r->type = EXPRVAL_IDREF;
 262         r->u.idref.disp = get_object(v);
 263         assert(is_number(stack_topn(ctx, n)));
 264         r->u.idref.id = get_number(stack_topn(ctx, n));
 265         return TRUE;
 266     case JSV_UNDEFINED:
 267         r->type = EXPRVAL_INVALID;
 268         assert(is_number(stack_topn(ctx, n)));
 269         r->u.hres = get_number(stack_topn(ctx, n));
 270         return FALSE;
 271     default:
 272         assert(0);
 273         return FALSE;
 274     }
 275 }
 276
 277 static inline BOOL stack_pop_exprval(script_ctx_t *ctx, exprval_t *r)
 278 {
 279     BOOL ret = stack_topn_exprval(ctx, 0, r);
 280     ctx->stack_top -= 2;
 281     return ret;
 282 }
 283
 284 static HRESULT exprval_propput(script_ctx_t *ctx, exprval_t *ref, jsval_t v)
 285 {
 286     switch(ref->type) {
 287     case EXPRVAL_STACK_REF: {
 288         jsval_t *r = ctx->stack + ref->u.off;
 289         jsval_release(*r);
 290         return jsval_copy(v, r);
 291     }
 292     case EXPRVAL_IDREF:
 293         return disp_propput(ctx, ref->u.idref.disp, ref->u.idref.id, v);
 294     default:
 295         assert(0);
 296         return E_FAIL;
 297     }
 298 }
 299
 300 static HRESULT exprval_propget(script_ctx_t *ctx, exprval_t *ref, jsval_t *r)
 301 {
 302     switch(ref->type) {
 303     case EXPRVAL_STACK_REF:
 304         return jsval_copy(ctx->stack[ref->u.off], r);
 305     case EXPRVAL_IDREF:
 306         return disp_propget(ctx, ref->u.idref.disp, ref->u.idref.id, r);
 307     default:
 308         assert(0);
 309         return E_FAIL;
 310     }
 311 }
 312
 313 static HRESULT exprval_call(script_ctx_t *ctx, exprval_t *ref, WORD flags, unsigned argc, jsval_t *argv, jsval_t *r)
 314 {
 315     switch(ref->type) {
 316     case EXPRVAL_STACK_REF: {
 317         jsval_t v = ctx->stack[ref->u.off];
 318
 319         if(!is_object_instance(v)) {
 320             FIXME("invoke %s\n", debugstr_jsval(v));
 321             return E_FAIL;
 322         }
 323
 324         return disp_call_value(ctx, get_object(v), NULL, flags, argc, argv, r);
 325     }
 326     case EXPRVAL_IDREF:
 327         return disp_call(ctx, ref->u.idref.disp, ref->u.idref.id, flags, argc, argv, r);
 328     default:
 329         assert(0);
 330         return E_FAIL;
 331     }
 332 }
 333
 334 /* ECMA-262 3rd Edition    8.7.1 */
 335 /* Steals input reference. */
 336 static HRESULT exprval_to_value(script_ctx_t *ctx, exprval_t *ref, jsval_t *r)
 337 {
 338     HRESULT hres;
 339
 340     if(ref->type == EXPRVAL_JSVAL) {
 341         *r = ref->u.val;
 342         return S_OK;
 343     }
 344
 345     hres = exprval_propget(ctx, ref, r);
 346
 347     if(ref->type == EXPRVAL_IDREF)
 348         IDispatch_Release(ref->u.idref.disp);
 349     return hres;
 350 }
 351
 352 static void exprval_release(exprval_t *val)
 353 {
 354     switch(val->type) {
 355     case EXPRVAL_JSVAL:
 356         jsval_release(val->u.val);
 357         return;
 358     case EXPRVAL_IDREF:
 359         if(val->u.idref.disp)
 360             IDispatch_Release(val->u.idref.disp);
 361         return;
 362     case EXPRVAL_STACK_REF:
 363     case EXPRVAL_INVALID:
 364         return;
 365     }
 366 }
 367
 368 static inline void exprval_set_exception(exprval_t *val, HRESULT hres)
 369 {
 370     val->type = EXPRVAL_INVALID;
 371     val->u.hres = hres;
 372 }
 373
 374 static inline void exprval_set_disp_ref(exprval_t *ref, IDispatch *obj, DISPID id)
 375 {
 376     ref->type = EXPRVAL_IDREF;
 377     IDispatch_AddRef(ref->u.idref.disp = obj);
 378     ref->u.idref.id = id;
 379 }
 380
 381 static inline jsval_t steal_ret(call_frame_t *frame)
 382 {
 383     jsval_t r = frame->ret;
 384     frame->ret = jsval_undefined();
 385     return r;
 386 }
 387
 388 static inline void clear_ret(call_frame_t *frame)
 389 {
 390     jsval_release(steal_ret(frame));
 391 }
 392
 393 static HRESULT scope_push(scope_chain_t *scope, jsdisp_t *jsobj, IDispatch *obj, scope_chain_t **ret)
 394 {
 395     scope_chain_t *new_scope;
 396
 397     new_scope = heap_alloc(sizeof(scope_chain_t));
 398     if(!new_scope)
 399         return E_OUTOFMEMORY;
 400
 401     new_scope->ref = 1;
 402
 403     IDispatch_AddRef(obj);
 404     new_scope->jsobj = jsobj;
 405     new_scope->obj = obj;
 406     new_scope->frame = NULL;
 407     new_scope->next = scope ? scope_addref(scope) : NULL;
 408
 409     *ret = new_scope;
 410     return S_OK;
 411 }
 412
 413 static void scope_pop(scope_chain_t **scope)
 414 {
 415     scope_chain_t *tmp;
 416
 417     tmp = *scope;
 418     *scope = tmp->next;
 419     scope_release(tmp);
 420 }
 421
 422 void clear_ei(script_ctx_t *ctx)
 423 {
 424     memset(&ctx->ei.ei, 0, sizeof(ctx->ei.ei));
 425     jsval_release(ctx->ei.val);
 426     ctx->ei.val = jsval_undefined();
 427 }
 428
 429 void scope_release(scope_chain_t *scope)
 430 {
 431     if(--scope->ref)
 432         return;
 433
 434     if(scope->next)
 435         scope_release(scope->next);
 436
 437     IDispatch_Release(scope->obj);
 438     heap_free(scope);
 439 }
 440
 441 static HRESULT disp_get_id(script_ctx_t *ctx, IDispatch *disp, const WCHAR *name, BSTR name_bstr, DWORD flags, DISPID *id)
 442 {
 443     IDispatchEx *dispex;
 444     jsdisp_t *jsdisp;
 445     BSTR bstr;
 446     HRESULT hres;
 447
 448     jsdisp = iface_to_jsdisp(disp);
 449     if(jsdisp) {
 450         hres = jsdisp_get_id(jsdisp, name, flags, id);
 451         jsdisp_release(jsdisp);
 452         return hres;
 453     }
 454
 455     if(name_bstr) {
 456         bstr = name_bstr;
 457     }else {
 458         bstr = SysAllocString(name);
 459         if(!bstr)
 460             return E_OUTOFMEMORY;
 461     }
 462
 463     *id = 0;
 464     hres = IDispatch_QueryInterface(disp, &IID_IDispatchEx, (void**)&dispex);
 465     if(SUCCEEDED(hres)) {
 466         hres = IDispatchEx_GetDispID(dispex, bstr, make_grfdex(ctx, flags|fdexNameCaseSensitive), id);
 467         IDispatchEx_Release(dispex);
 468     }else {
 469         TRACE("using IDispatch\n");
 470         hres = IDispatch_GetIDsOfNames(disp, &IID_NULL, &bstr, 1, 0, id);
 471     }
 472
 473     if(name_bstr != bstr)
 474         SysFreeString(bstr);
 475     return hres;
 476 }
 477
 478 static HRESULT disp_cmp(IDispatch *disp1, IDispatch *disp2, BOOL *ret)
 479 {
 480     IObjectIdentity *identity;
 481     IUnknown *unk1, *unk2;
 482     HRESULT hres;
 483
 484     if(disp1 == disp2) {
 485         *ret = TRUE;
 486         return S_OK;
 487     }
 488
 489     if(!disp1 || !disp2) {
 490         *ret = FALSE;
 491         return S_OK;
 492     }
 493
 494     hres = IDispatch_QueryInterface(disp1, &IID_IUnknown, (void**)&unk1);
 495     if(FAILED(hres))
 496         return hres;
 497
 498     hres = IDispatch_QueryInterface(disp2, &IID_IUnknown, (void**)&unk2);
 499     if(FAILED(hres)) {
 500         IUnknown_Release(unk1);
 501         return hres;
 502     }
 503
 504     if(unk1 == unk2) {
 505         *ret = TRUE;
 506     }else {
 507         hres = IUnknown_QueryInterface(unk1, &IID_IObjectIdentity, (void**)&identity);
 508         if(SUCCEEDED(hres)) {
 509             hres = IObjectIdentity_IsEqualObject(identity, unk2);
 510             IObjectIdentity_Release(identity);
 511             *ret = hres == S_OK;
 512         }else {
 513             *ret = FALSE;
 514         }
 515     }
 516
 517     IUnknown_Release(unk1);
 518     IUnknown_Release(unk2);
 519     return S_OK;
 520 }
 521
 522 /* ECMA-262 3rd Edition    11.9.6 */
 523 static HRESULT equal2_values(jsval_t lval, jsval_t rval, BOOL *ret)
 524 {
 525     jsval_type_t type = jsval_type(lval);
 526
 527     TRACE("\n");
 528
 529     if(type != jsval_type(rval)) {
 530         if(is_null_instance(lval))
 531             *ret = is_null_instance(rval);
 532         else
 533             *ret = FALSE;
 534         return S_OK;
 535     }
 536
 537     switch(type) {
 538     case JSV_UNDEFINED:
 539     case JSV_NULL:
 540         *ret = TRUE;
 541         break;
 542     case JSV_OBJECT:
 543         return disp_cmp(get_object(lval), get_object(rval), ret);
 544     case JSV_STRING:
 545         *ret = jsstr_eq(get_string(lval), get_string(rval));
 546         break;
 547     case JSV_NUMBER:
 548         *ret = get_number(lval) == get_number(rval);
 549         break;
 550     case JSV_BOOL:
 551         *ret = !get_bool(lval) == !get_bool(rval);
 552         break;
 553     case JSV_VARIANT:
 554         FIXME("VARIANT not implemented\n");
 555         return E_NOTIMPL;
 556     }
 557
 558     return S_OK;
 559 }
 560
 561 /*
 562  * Transfers local variables from stack to variable object.
 563  * It's slow, so we want to avoid it as much as possible.
 564  */
 565 static HRESULT detach_variable_object(script_ctx_t *ctx, call_frame_t *frame, BOOL from_release)
 566 {
 567     unsigned i;
 568     HRESULT hres;
 569
 570     if(!frame->base_scope || !frame->base_scope->frame)
 571         return S_OK;
 572
 573     TRACE("detaching %p\n", frame);
 574
 575     assert(frame == frame->base_scope->frame);
 576     assert(frame->variable_obj == frame->base_scope->jsobj);
 577
 578     if(!from_release && !frame->arguments_obj) {
 579         hres = setup_arguments_object(ctx, frame);
 580         if(FAILED(hres))
 581             return hres;
 582     }
 583
 584     frame->base_scope->frame = NULL;
 585
 586     for(i = 0; i < frame->function->locals_cnt; i++) {
 587         hres = jsdisp_propput_name(frame->variable_obj, frame->function->locals[i].name,
 588                                    ctx->stack[local_off(frame, frame->function->locals[i].ref)]);
 589         if(FAILED(hres))
 590             return hres;
 591     }
 592
 593     return S_OK;
 594 }
 595
 596 static BOOL lookup_global_members(script_ctx_t *ctx, BSTR identifier, exprval_t *ret)
 597 {
 598     named_item_t *item;
 599     DISPID id;
 600     HRESULT hres;
 601
 602     for(item = ctx->named_items; item; item = item->next) {
 603         if(item->flags & SCRIPTITEM_GLOBALMEMBERS) {
 604             hres = disp_get_id(ctx, item->disp, identifier, identifier, 0, &id);
 605             if(SUCCEEDED(hres)) {
 606                 if(ret)
 607                     exprval_set_disp_ref(ret, item->disp, id);
 608                 return TRUE;
 609             }
 610         }
 611     }
 612
 613     return FALSE;
 614 }
 615
 616 static int local_ref_cmp(const void *key, const void *ref)
 617 {
 618     return strcmpW((const WCHAR*)key, ((const local_ref_t*)ref)->name);
 619 }
 620
 621 local_ref_t *lookup_local(const function_code_t *function, const WCHAR *identifier)
 622 {
 623     return bsearch(identifier, function->locals, function->locals_cnt, sizeof(*function->locals), local_ref_cmp);
 624 }
 625
 626 /* ECMA-262 3rd Edition    10.1.4 */
 627 static HRESULT identifier_eval(script_ctx_t *ctx, BSTR identifier, exprval_t *ret)
 628 {
 629     scope_chain_t *scope;
 630     named_item_t *item;
 631     DISPID id = 0;
 632     HRESULT hres;
 633
 634     TRACE("%s\n", debugstr_w(identifier));
 635
 636     if(ctx->call_ctx) {
 637         for(scope = ctx->call_ctx->scope; scope; scope = scope->next) {
 638             if(scope->frame) {
 639                 function_code_t *func = scope->frame->function;
 640                 local_ref_t *ref = lookup_local(func, identifier);
 641                 static const WCHAR argumentsW[] = {'a','r','g','u','m','e','n','t','s',0};
 642
 643                 if(ref) {
 644                     ret->type = EXPRVAL_STACK_REF;
 645                     ret->u.off = local_off(scope->frame, ref->ref);
 646                     TRACE("returning ref %d for %d\n", ret->u.off, ref->ref);
 647                     return S_OK;
 648                 }
 649
 650                 if(!strcmpW(identifier, argumentsW)) {
 651                     hres = detach_variable_object(ctx, scope->frame, FALSE);
 652                     if(FAILED(hres))
 653                         return hres;
 654                 }
 655             }
 656             if(scope->jsobj)
 657                 hres = jsdisp_get_id(scope->jsobj, identifier, fdexNameImplicit, &id);
 658             else
 659                 hres = disp_get_id(ctx, scope->obj, identifier, identifier, fdexNameImplicit, &id);
 660             if(SUCCEEDED(hres)) {
 661                 exprval_set_disp_ref(ret, scope->obj, id);
 662                 return S_OK;
 663             }
 664         }
 665     }
 666
 667     hres = jsdisp_get_id(ctx->global, identifier, 0, &id);
 668     if(SUCCEEDED(hres)) {
 669         exprval_set_disp_ref(ret, to_disp(ctx->global), id);
 670         return S_OK;
 671     }
 672
 673     for(item = ctx->named_items; item; item = item->next) {
 674         if((item->flags & SCRIPTITEM_ISVISIBLE) && !strcmpW(item->name, identifier)) {
 675             if(!item->disp) {
 676                 IUnknown *unk;
 677
 678                 if(!ctx->site)
 679                     break;
 680
 681                 hres = IActiveScriptSite_GetItemInfo(ctx->site, identifier,
 682                                                      SCRIPTINFO_IUNKNOWN, &unk, NULL);
 683                 if(FAILED(hres)) {
 684                     WARN("GetItemInfo failed: %08x\n", hres);
 685                     break;
 686                 }
 687
 688                 hres = IUnknown_QueryInterface(unk, &IID_IDispatch, (void**)&item->disp);
 689                 IUnknown_Release(unk);
 690                 if(FAILED(hres)) {
 691                     WARN("object does not implement IDispatch\n");
 692                     break;
 693                 }
 694             }
 695
 696             IDispatch_AddRef(item->disp);
 697             ret->type = EXPRVAL_JSVAL;
 698             ret->u.val = jsval_disp(item->disp);
 699             return S_OK;
 700         }
 701     }
 702
 703     if(lookup_global_members(ctx, identifier, ret))
 704         return S_OK;
 705
 706     exprval_set_exception(ret, JS_E_UNDEFINED_VARIABLE);
 707     return S_OK;
 708 }
 709
 710 static inline BSTR get_op_bstr(script_ctx_t *ctx, int i)
 711 {
 712     call_frame_t *frame = ctx->call_ctx;
 713     return frame->bytecode->instrs[frame->ip].u.arg[i].bstr;
 714 }
 715
 716 static inline unsigned get_op_uint(script_ctx_t *ctx, int i)
 717 {
 718     call_frame_t *frame = ctx->call_ctx;
 719     return frame->bytecode->instrs[frame->ip].u.arg[i].uint;
 720 }
 721
 722 static inline unsigned get_op_int(script_ctx_t *ctx, int i)
 723 {
 724     call_frame_t *frame = ctx->call_ctx;
 725     return frame->bytecode->instrs[frame->ip].u.arg[i].lng;
 726 }
 727
 728 static inline jsstr_t *get_op_str(script_ctx_t *ctx, int i)
 729 {
 730     call_frame_t *frame = ctx->call_ctx;
 731     return frame->bytecode->instrs[frame->ip].u.arg[i].str;
 732 }
 733
 734 static inline double get_op_double(script_ctx_t *ctx)
 735 {
 736     call_frame_t *frame = ctx->call_ctx;
 737     return frame->bytecode->instrs[frame->ip].u.dbl;
 738 }
 739
 740 static inline void jmp_next(script_ctx_t *ctx)
 741 {
 742     ctx->call_ctx->ip++;
 743 }
 744
 745 static inline void jmp_abs(script_ctx_t *ctx, unsigned dst)
 746 {
 747     ctx->call_ctx->ip = dst;
 748 }
 749
 750 /* ECMA-262 3rd Edition    12.6.4 */
 751 static HRESULT interp_forin(script_ctx_t *ctx)
 752 {
 753     const HRESULT arg = get_op_uint(ctx, 0);
 754     IDispatch *obj = NULL;
 755     IDispatchEx *dispex;
 756     exprval_t prop_ref;
 757     DISPID id;
 758     BSTR name = NULL;
 759     HRESULT hres;
 760
 761     TRACE("\n");
 762
 763     assert(is_number(stack_top(ctx)));
 764     id = get_number(stack_top(ctx));
 765
 766     if(!stack_topn_exprval(ctx, 1, &prop_ref)) {
 767         FIXME("invalid ref: %08x\n", prop_ref.u.hres);
 768         return E_FAIL;
 769     }
 770
 771     if(is_object_instance(stack_topn(ctx, 3)))
 772         obj = get_object(stack_topn(ctx, 3));
 773
 774     if(obj) {
 775         hres = IDispatch_QueryInterface(obj, &IID_IDispatchEx, (void**)&dispex);
 776         if(SUCCEEDED(hres)) {
 777             hres = IDispatchEx_GetNextDispID(dispex, fdexEnumDefault, id, &id);
 778             if(hres == S_OK)
 779                 hres = IDispatchEx_GetMemberName(dispex, id, &name);
 780             IDispatchEx_Release(dispex);
 781             if(FAILED(hres))
 782                 return hres;
 783         }else {
 784             TRACE("No IDispatchEx\n");
 785         }
 786     }
 787
 788     if(name) {
 789         jsstr_t *str;
 790
 791         str = jsstr_alloc_len(name, SysStringLen(name));
 792         SysFreeString(name);
 793         if(!str)
 794             return E_OUTOFMEMORY;
 795
 796         stack_pop(ctx);
 797         stack_push(ctx, jsval_number(id)); /* safe, just after pop() */
 798
 799         hres = exprval_propput(ctx, &prop_ref, jsval_string(str));
 800         jsstr_release(str);
 801         if(FAILED(hres))
 802             return hres;
 803
 804         jmp_next(ctx);
 805     }else {
 806         stack_popn(ctx, 4);
 807         jmp_abs(ctx, arg);
 808     }
 809     return S_OK;
 810 }
 811
 812 /* ECMA-262 3rd Edition    12.10 */
 813 static HRESULT interp_push_scope(script_ctx_t *ctx)
 814 {
 815     IDispatch *disp;
 816     jsval_t v;
 817     HRESULT hres;
 818
 819     TRACE("\n");
 820
 821     v = stack_pop(ctx);
 822     hres = to_object(ctx, v, &disp);
 823     jsval_release(v);
 824     if(FAILED(hres))
 825         return hres;
 826
 827     hres = scope_push(ctx->call_ctx->scope, to_jsdisp(disp), disp, &ctx->call_ctx->scope);
 828     IDispatch_Release(disp);
 829     return hres;
 830 }
 831
 832 /* ECMA-262 3rd Edition    12.10 */
 833 static HRESULT interp_pop_scope(script_ctx_t *ctx)
 834 {
 835     TRACE("\n");
 836
 837     scope_pop(&ctx->call_ctx->scope);
 838     return S_OK;
 839 }
 840
 841 /* ECMA-262 3rd Edition    12.13 */
 842 static HRESULT interp_case(script_ctx_t *ctx)
 843 {
 844     const unsigned arg = get_op_uint(ctx, 0);
 845     jsval_t v;
 846     BOOL b;
 847     HRESULT hres;
 848
 849     TRACE("\n");
 850
 851     v = stack_pop(ctx);
 852     hres = equal2_values(stack_top(ctx), v, &b);
 853     jsval_release(v);
 854     if(FAILED(hres))
 855         return hres;
 856
 857     if(b) {
 858         stack_popn(ctx, 1);
 859         jmp_abs(ctx, arg);
 860     }else {
 861         jmp_next(ctx);
 862     }
 863     return S_OK;
 864 }
 865
 866 /* ECMA-262 3rd Edition    12.13 */
 867 static HRESULT interp_throw(script_ctx_t *ctx)
 868 {
 869     TRACE("\n");
 870
 871     jsval_release(ctx->ei.val);
 872     ctx->ei.val = stack_pop(ctx);
 873     return DISP_E_EXCEPTION;
 874 }
 875
 876 static HRESULT interp_throw_ref(script_ctx_t *ctx)
 877 {
 878     const HRESULT arg = get_op_uint(ctx, 0);
 879
 880     TRACE("%08x\n", arg);
 881
 882     return throw_reference_error(ctx, arg, NULL);
 883 }
 884
 885 static HRESULT interp_throw_type(script_ctx_t *ctx)
 886 {
 887     const HRESULT hres = get_op_uint(ctx, 0);
 888     jsstr_t *str = get_op_str(ctx, 1);
 889     const WCHAR *ptr;
 890
 891     TRACE("%08x %s\n", hres, debugstr_jsstr(str));
 892
 893     ptr = jsstr_flatten(str);
 894     return ptr ? throw_type_error(ctx, hres, ptr) : E_OUTOFMEMORY;
 895 }
 896
 897 /* ECMA-262 3rd Edition    12.14 */
 898 static HRESULT interp_push_except(script_ctx_t *ctx)
 899 {
 900     const unsigned catch_off = get_op_uint(ctx, 0);
 901     const unsigned finally_off = get_op_uint(ctx, 1);
 902     call_frame_t *frame = ctx->call_ctx;
 903     except_frame_t *except;
 904
 905     TRACE("\n");
 906
 907     except = heap_alloc(sizeof(*except));
 908     if(!except)
 909         return E_OUTOFMEMORY;
 910
 911     except->stack_top = ctx->stack_top;
 912     except->scope = frame->scope;
 913     except->catch_off = catch_off;
 914     except->finally_off = finally_off;
 915     except->next = frame->except_frame;
 916     frame->except_frame = except;
 917     return S_OK;
 918 }
 919
 920 /* ECMA-262 3rd Edition    12.14 */
 921 static HRESULT interp_pop_except(script_ctx_t *ctx)
 922 {
 923     const unsigned ret_off = get_op_uint(ctx, 0);
 924     call_frame_t *frame = ctx->call_ctx;
 925     except_frame_t *except;
 926     unsigned finally_off;
 927
 928     TRACE("%u\n", ret_off);
 929
 930     except = frame->except_frame;
 931     assert(except != NULL);
 932
 933     finally_off = except->finally_off;
 934     frame->except_frame = except->next;
 935     heap_free(except);
 936
 937     if(finally_off) {
 938         HRESULT hres;
 939
 940         hres = stack_push(ctx, jsval_number(ret_off));
 941         if(FAILED(hres))
 942             return hres;
 943         hres = stack_push(ctx, jsval_bool(TRUE));
 944         if(FAILED(hres))
 945             return hres;
 946         frame->ip = finally_off;
 947     }else {
 948         frame->ip = ret_off;
 949     }
 950
 951     return S_OK;
 952 }
 953
 954 /* ECMA-262 3rd Edition    12.14 */
 955 static HRESULT interp_end_finally(script_ctx_t *ctx)
 956 {
 957     call_frame_t *frame = ctx->call_ctx;
 958     jsval_t v;
 959
 960     TRACE("\n");
 961
 962     v = stack_pop(ctx);
 963     assert(is_bool(v));
 964
 965     if(!get_bool(v)) {
 966         TRACE("passing exception\n");
 967
 968         ctx->ei.val = stack_pop(ctx);
 969         return DISP_E_EXCEPTION;
 970     }
 971
 972     v = stack_pop(ctx);
 973     assert(is_number(v));
 974     frame->ip = get_number(v);
 975     return S_OK;
 976 }
 977
 978 static HRESULT interp_enter_catch(script_ctx_t *ctx)
 979 {
 980     const BSTR ident = get_op_bstr(ctx, 0);
 981     jsdisp_t *scope_obj;
 982     jsval_t v;
 983     HRESULT hres;
 984
 985     hres = create_dispex(ctx, NULL, NULL, &scope_obj);
 986     if(FAILED(hres))
 987         return hres;
 988
 989     v = stack_pop(ctx);
 990     hres = jsdisp_propput_name(scope_obj, ident, v);
 991     jsval_release(v);
 992     if(SUCCEEDED(hres))
 993         hres = scope_push(ctx->call_ctx->scope, scope_obj, to_disp(scope_obj), &ctx->call_ctx->scope);
 994     jsdisp_release(scope_obj);
 995     return hres;
 996 }
 997
 998 /* ECMA-262 3rd Edition    13 */
 999 static HRESULT interp_func(script_ctx_t *ctx)
1000 {
1001     unsigned func_idx = get_op_uint(ctx, 0);
1002     call_frame_t *frame = ctx->call_ctx;
1003     jsdisp_t *dispex;
1004     HRESULT hres;
1005
1006     TRACE("%d\n", func_idx);
1007
1008     hres = create_source_function(ctx, frame->bytecode, frame->function->funcs+func_idx,
1009             frame->scope, &dispex);
1010     if(FAILED(hres))
1011         return hres;
1012
1013     return stack_push(ctx, jsval_obj(dispex));
1014 }
1015
1016 /* ECMA-262 3rd Edition    11.2.1 */
1017 static HRESULT interp_array(script_ctx_t *ctx)
1018 {
1019     jsstr_t *name_str;
1020     const WCHAR *name;
1021     jsval_t v, namev;
1022     IDispatch *obj;
1023     DISPID id;
1024     HRESULT hres;
1025
1026     TRACE("\n");
1027
1028     namev = stack_pop(ctx);
1029
1030     hres = stack_pop_object(ctx, &obj);
1031     if(FAILED(hres)) {
1032         jsval_release(namev);
1033         return hres;
1034     }
1035
1036     hres = to_flat_string(ctx, namev, &name_str, &name);
1037     jsval_release(namev);
1038     if(FAILED(hres)) {
1039         IDispatch_Release(obj);
1040         return hres;
1041     }
1042
1043     hres = disp_get_id(ctx, obj, name, NULL, 0, &id);
1044     jsstr_release(name_str);
1045     if(SUCCEEDED(hres)) {
1046         hres = disp_propget(ctx, obj, id, &v);
1047     }else if(hres == DISP_E_UNKNOWNNAME) {
1048         v = jsval_undefined();
1049         hres = S_OK;
1050     }
1051     IDispatch_Release(obj);
1052     if(FAILED(hres))
1053         return hres;
1054
1055     return stack_push(ctx, v);
1056 }
1057
1058 /* ECMA-262 3rd Edition    11.2.1 */
1059 static HRESULT interp_member(script_ctx_t *ctx)
1060 {
1061     const BSTR arg = get_op_bstr(ctx, 0);
1062     IDispatch *obj;
1063     jsval_t v;
1064     DISPID id;
1065     HRESULT hres;
1066
1067     TRACE("\n");
1068
1069     hres = stack_pop_object(ctx, &obj);
1070     if(FAILED(hres))
1071         return hres;
1072
1073     hres = disp_get_id(ctx, obj, arg, arg, 0, &id);
1074     if(SUCCEEDED(hres)) {
1075         hres = disp_propget(ctx, obj, id, &v);
1076     }else if(hres == DISP_E_UNKNOWNNAME) {
1077         v = jsval_undefined();
1078         hres = S_OK;
1079     }
1080     IDispatch_Release(obj);
1081     if(FAILED(hres))
1082         return hres;
1083
1084     return stack_push(ctx, v);
1085 }
1086
1087 /* ECMA-262 3rd Edition    11.2.1 */
1088 static HRESULT interp_memberid(script_ctx_t *ctx)
1089 {
1090     const unsigned arg = get_op_uint(ctx, 0);
1091     jsval_t objv, namev;
1092     const WCHAR *name;
1093     jsstr_t *name_str;
1094     IDispatch *obj;
1095     exprval_t ref;
1096     DISPID id;
1097     HRESULT hres;
1098
1099     TRACE("%x\n", arg);
1100
1101     namev = stack_pop(ctx);
1102     objv = stack_pop(ctx);
1103
1104     hres = to_object(ctx, objv, &obj);
1105     jsval_release(objv);
1106     if(SUCCEEDED(hres)) {
1107         hres = to_flat_string(ctx, namev, &name_str, &name);
1108         if(FAILED(hres))
1109             IDispatch_Release(obj);
1110     }
1111     jsval_release(namev);
1112     if(FAILED(hres))
1113         return hres;
1114
1115     hres = disp_get_id(ctx, obj, name, NULL, arg, &id);
1116     jsstr_release(name_str);
1117     if(SUCCEEDED(hres)) {
1118         ref.type = EXPRVAL_IDREF;
1119         ref.u.idref.disp = obj;
1120         ref.u.idref.id = id;
1121     }else {
1122         IDispatch_Release(obj);
1123         if(hres == DISP_E_UNKNOWNNAME && !(arg & fdexNameEnsure)) {
1124             exprval_set_exception(&ref, JS_E_INVALID_PROPERTY);
1125             hres = S_OK;
1126         }else {
1127             ERR("failed %08x\n", hres);
1128             return hres;
1129         }
1130     }
1131
1132     return stack_push_exprval(ctx, &ref);
1133 }
1134
1135 /* ECMA-262 3rd Edition    11.2.1 */
1136 static HRESULT interp_refval(script_ctx_t *ctx)
1137 {
1138     exprval_t ref;
1139     jsval_t v;
1140     HRESULT hres;
1141
1142     TRACE("\n");
1143
1144     if(!stack_topn_exprval(ctx, 0, &ref))
1145         return throw_reference_error(ctx, JS_E_ILLEGAL_ASSIGN, NULL);
1146
1147     hres = exprval_propget(ctx, &ref, &v);
1148     if(FAILED(hres))
1149         return hres;
1150
1151     return stack_push(ctx, v);
1152 }
1153
1154 /* ECMA-262 3rd Edition    11.2.2 */
1155 static HRESULT interp_new(script_ctx_t *ctx)
1156 {
1157     const unsigned argc = get_op_uint(ctx, 0);
1158     call_frame_t *frame = ctx->call_ctx;
1159     jsval_t constr;
1160
1161     TRACE("%d\n", argc);
1162
1163     constr = stack_topn(ctx, argc);
1164
1165     /* NOTE: Should use to_object here */
1166
1167     if(is_null(constr))
1168         return throw_type_error(ctx, JS_E_OBJECT_EXPECTED, NULL);
1169     else if(!is_object_instance(constr))
1170         return throw_type_error(ctx, JS_E_INVALID_ACTION, NULL);
1171     else if(!get_object(constr))
1172         return throw_type_error(ctx, JS_E_INVALID_PROPERTY, NULL);
1173
1174     clear_ret(frame);
1175     return disp_call_value(ctx, get_object(constr), NULL, DISPATCH_CONSTRUCT | DISPATCH_JSCRIPT_CALLEREXECSSOURCE,
1176                            argc, stack_args(ctx, argc), &frame->ret);
1177 }
1178
1179 /* ECMA-262 3rd Edition    11.2.3 */
1180 static HRESULT interp_call(script_ctx_t *ctx)
1181 {
1182     const unsigned argn = get_op_uint(ctx, 0);
1183     const int do_ret = get_op_int(ctx, 1);
1184     call_frame_t *frame = ctx->call_ctx;
1185     jsval_t obj;
1186
1187     TRACE("%d %d\n", argn, do_ret);
1188
1189     obj = stack_topn(ctx, argn);
1190     if(!is_object_instance(obj))
1191         return throw_type_error(ctx, JS_E_INVALID_PROPERTY, NULL);
1192
1193     clear_ret(frame);
1194     return disp_call_value(ctx, get_object(obj), NULL, DISPATCH_METHOD | DISPATCH_JSCRIPT_CALLEREXECSSOURCE,
1195                            argn, stack_args(ctx, argn), do_ret ? &frame->ret : NULL);
1196 }
1197
1198 /* ECMA-262 3rd Edition    11.2.3 */
1199 static HRESULT interp_call_member(script_ctx_t *ctx)
1200 {
1201     const unsigned argn = get_op_uint(ctx, 0);
1202     const int do_ret = get_op_int(ctx, 1);
1203     call_frame_t *frame = ctx->call_ctx;
1204     exprval_t ref;
1205
1206     TRACE("%d %d\n", argn, do_ret);
1207
1208     if(!stack_topn_exprval(ctx, argn, &ref))
1209         return throw_type_error(ctx, ref.u.hres, NULL);
1210
1211     clear_ret(frame);
1212     return exprval_call(ctx, &ref, DISPATCH_METHOD | DISPATCH_JSCRIPT_CALLEREXECSSOURCE,
1213             argn, stack_args(ctx, argn), do_ret ? &frame->ret : NULL);
1214 }
1215
1216 /* ECMA-262 3rd Edition    11.1.1 */
1217 static HRESULT interp_this(script_ctx_t *ctx)
1218 {
1219     call_frame_t *frame = ctx->call_ctx;
1220
1221     TRACE("\n");
1222
1223     IDispatch_AddRef(frame->this_obj);
1224     return stack_push(ctx, jsval_disp(frame->this_obj));
1225 }
1226
1227 static HRESULT interp_identifier_ref(script_ctx_t *ctx, BSTR identifier, unsigned flags)
1228 {
1229     exprval_t exprval;
1230     HRESULT hres;
1231
1232     hres = identifier_eval(ctx, identifier, &exprval);
1233     if(FAILED(hres))
1234         return hres;
1235
1236     if(exprval.type == EXPRVAL_INVALID && (flags & fdexNameEnsure)) {
1237         DISPID id;
1238
1239         hres = jsdisp_get_id(ctx->global, identifier, fdexNameEnsure, &id);
1240         if(FAILED(hres))
1241             return hres;
1242
1243         exprval_set_disp_ref(&exprval, to_disp(ctx->global), id);
1244     }
1245
1246     if(exprval.type == EXPRVAL_JSVAL || exprval.type == EXPRVAL_INVALID) {
1247         WARN("invalid ref\n");
1248         exprval_release(&exprval);
1249         exprval_set_exception(&exprval, JS_E_OBJECT_EXPECTED);
1250     }
1251
1252     return stack_push_exprval(ctx, &exprval);
1253 }
1254
1255 static HRESULT identifier_value(script_ctx_t *ctx, BSTR identifier)
1256 {
1257     exprval_t exprval;
1258     jsval_t v;
1259     HRESULT hres;
1260
1261     hres = identifier_eval(ctx, identifier, &exprval);
1262     if(FAILED(hres))
1263         return hres;
1264
1265     if(exprval.type == EXPRVAL_INVALID)
1266         return throw_type_error(ctx, exprval.u.hres, identifier);
1267
1268     hres = exprval_to_value(ctx, &exprval, &v);
1269     if(FAILED(hres))
1270         return hres;
1271
1272     return stack_push(ctx, v);
1273 }
1274
1275 static HRESULT interp_local_ref(script_ctx_t *ctx)
1276 {
1277     const int arg = get_op_int(ctx, 0);
1278     const unsigned flags = get_op_uint(ctx, 1);
1279     call_frame_t *frame = ctx->call_ctx;
1280     exprval_t ref;
1281
1282     TRACE("%d\n", arg);
1283
1284     if(!frame->base_scope || !frame->base_scope->frame)
1285         return interp_identifier_ref(ctx, local_name(frame, arg), flags);
1286
1287     ref.type = EXPRVAL_STACK_REF;
1288     ref.u.off = local_off(frame, arg);
1289     return stack_push_exprval(ctx, &ref);
1290 }
1291
1292 static HRESULT interp_local(script_ctx_t *ctx)
1293 {
1294     const int arg = get_op_int(ctx, 0);
1295     call_frame_t *frame = ctx->call_ctx;
1296     jsval_t copy;
1297     HRESULT hres;
1298
1299     TRACE("%d\n", arg);
1300
1301     if(!frame->base_scope || !frame->base_scope->frame)
1302         return identifier_value(ctx, local_name(frame, arg));
1303
1304     hres = jsval_copy(ctx->stack[local_off(frame, arg)], &copy);
1305     if(FAILED(hres))
1306         return hres;
1307
1308     return stack_push(ctx, copy);
1309 }
1310
1311 /* ECMA-262 3rd Edition    10.1.4 */
1312 static HRESULT interp_ident(script_ctx_t *ctx)
1313 {
1314     const BSTR arg = get_op_bstr(ctx, 0);
1315
1316     TRACE("%s\n", debugstr_w(arg));
1317
1318     return identifier_value(ctx, arg);
1319 }
1320
1321 /* ECMA-262 3rd Edition    10.1.4 */
1322 static HRESULT interp_identid(script_ctx_t *ctx)
1323 {
1324     const BSTR arg = get_op_bstr(ctx, 0);
1325     const unsigned flags = get_op_uint(ctx, 1);
1326
1327     TRACE("%s %x\n", debugstr_w(arg), flags);
1328
1329     return interp_identifier_ref(ctx, arg, flags);
1330 }
1331
1332 /* ECMA-262 3rd Edition    7.8.1 */
1333 static HRESULT interp_null(script_ctx_t *ctx)
1334 {
1335     TRACE("\n");
1336
1337     return stack_push(ctx, jsval_null());
1338 }
1339
1340 /* ECMA-262 3rd Edition    7.8.2 */
1341 static HRESULT interp_bool(script_ctx_t *ctx)
1342 {
1343     const int arg = get_op_int(ctx, 0);
1344
1345     TRACE("%s\n", arg ? "true" : "false");
1346
1347     return stack_push(ctx, jsval_bool(arg));
1348 }
1349
1350 /* ECMA-262 3rd Edition    7.8.3 */
1351 static HRESULT interp_int(script_ctx_t *ctx)
1352 {
1353     const int arg = get_op_int(ctx, 0);
1354
1355     TRACE("%d\n", arg);
1356
1357     return stack_push(ctx, jsval_number(arg));
1358 }
1359
1360 /* ECMA-262 3rd Edition    7.8.3 */
1361 static HRESULT interp_double(script_ctx_t *ctx)
1362 {
1363     const double arg = get_op_double(ctx);
1364
1365     TRACE("%lf\n", arg);
1366
1367     return stack_push(ctx, jsval_number(arg));
1368 }
1369
1370 /* ECMA-262 3rd Edition    7.8.4 */
1371 static HRESULT interp_str(script_ctx_t *ctx)
1372 {
1373     jsstr_t *str = get_op_str(ctx, 0);
1374
1375     TRACE("%s\n", debugstr_jsstr(str));
1376
1377     return stack_push(ctx, jsval_string(jsstr_addref(str)));
1378 }
1379
1380 /* ECMA-262 3rd Edition    7.8 */
1381 static HRESULT interp_regexp(script_ctx_t *ctx)
1382 {
1383     jsstr_t *source = get_op_str(ctx, 0);
1384     const unsigned flags = get_op_uint(ctx, 1);
1385     jsdisp_t *regexp;
1386     HRESULT hres;
1387
1388     TRACE("%s %x\n", debugstr_jsstr(source), flags);
1389
1390     hres = create_regexp(ctx, source, flags, &regexp);
1391     if(FAILED(hres))
1392         return hres;
1393
1394     return stack_push(ctx, jsval_obj(regexp));
1395 }
1396
1397 /* ECMA-262 3rd Edition    11.1.4 */
1398 static HRESULT interp_carray(script_ctx_t *ctx)
1399 {
1400     const unsigned arg = get_op_uint(ctx, 0);
1401     jsdisp_t *array;
1402     jsval_t val;
1403     unsigned i;
1404     HRESULT hres;
1405
1406     TRACE("%u\n", arg);
1407
1408     hres = create_array(ctx, arg, &array);
1409     if(FAILED(hres))
1410         return hres;
1411
1412     i = arg;
1413     while(i--) {
1414         val = stack_pop(ctx);
1415         hres = jsdisp_propput_idx(array, i, val);
1416         jsval_release(val);
1417         if(FAILED(hres)) {
1418             jsdisp_release(array);
1419             return hres;
1420         }
1421     }
1422
1423     return stack_push(ctx, jsval_obj(array));
1424 }
1425
1426 /* ECMA-262 3rd Edition    11.1.5 */
1427 static HRESULT interp_new_obj(script_ctx_t *ctx)
1428 {
1429     jsdisp_t *obj;
1430     HRESULT hres;
1431
1432     TRACE("\n");
1433
1434     hres = create_object(ctx, NULL, &obj);
1435     if(FAILED(hres))
1436         return hres;
1437
1438     return stack_push(ctx, jsval_obj(obj));
1439 }
1440
1441 /* ECMA-262 3rd Edition    11.1.5 */
1442 static HRESULT interp_obj_prop(script_ctx_t *ctx)
1443 {
1444     const BSTR name = get_op_bstr(ctx, 0);
1445     jsdisp_t *obj;
1446     jsval_t val;
1447     HRESULT hres;
1448
1449     TRACE("%s\n", debugstr_w(name));
1450
1451     val = stack_pop(ctx);
1452
1453     assert(is_object_instance(stack_top(ctx)));
1454     obj = as_jsdisp(get_object(stack_top(ctx)));
1455
1456     hres = jsdisp_propput_name(obj, name, val);
1457     jsval_release(val);
1458     return hres;
1459 }
1460
1461 /* ECMA-262 3rd Edition    11.11 */
1462 static HRESULT interp_cnd_nz(script_ctx_t *ctx)
1463 {
1464     const unsigned arg = get_op_uint(ctx, 0);
1465     BOOL b;
1466     HRESULT hres;
1467
1468     TRACE("\n");
1469
1470     hres = to_boolean(stack_top(ctx), &b);
1471     if(FAILED(hres))
1472         return hres;
1473
1474     if(b) {
1475         jmp_abs(ctx, arg);
1476     }else {
1477         stack_popn(ctx, 1);
1478         jmp_next(ctx);
1479     }
1480     return S_OK;
1481 }
1482
1483 /* ECMA-262 3rd Edition    11.11 */
1484 static HRESULT interp_cnd_z(script_ctx_t *ctx)
1485 {
1486     const unsigned arg = get_op_uint(ctx, 0);
1487     BOOL b;
1488     HRESULT hres;
1489
1490     TRACE("\n");
1491
1492     hres = to_boolean(stack_top(ctx), &b);
1493     if(FAILED(hres))
1494         return hres;
1495
1496     if(b) {
1497         stack_popn(ctx, 1);
1498         jmp_next(ctx);
1499     }else {
1500         jmp_abs(ctx, arg);
1501     }
1502     return S_OK;
1503 }
1504
1505 /* ECMA-262 3rd Edition    11.10 */
1506 static HRESULT interp_or(script_ctx_t *ctx)
1507 {
1508     INT l, r;
1509     HRESULT hres;
1510
1511     TRACE("\n");
1512
1513     hres = stack_pop_int(ctx, &r);
1514     if(FAILED(hres))
1515         return hres;
1516
1517     hres = stack_pop_int(ctx, &l);
1518     if(FAILED(hres))
1519         return hres;
1520
1521     return stack_push(ctx, jsval_number(l|r));
1522 }
1523
1524 /* ECMA-262 3rd Edition    11.10 */
1525 static HRESULT interp_xor(script_ctx_t *ctx)
1526 {
1527     INT l, r;
1528     HRESULT hres;
1529
1530     TRACE("\n");
1531
1532     hres = stack_pop_int(ctx, &r);
1533     if(FAILED(hres))
1534         return hres;
1535
1536     hres = stack_pop_int(ctx, &l);
1537     if(FAILED(hres))
1538         return hres;
1539
1540     return stack_push(ctx, jsval_number(l^r));
1541 }
1542
1543 /* ECMA-262 3rd Edition    11.10 */
1544 static HRESULT interp_and(script_ctx_t *ctx)
1545 {
1546     INT l, r;
1547     HRESULT hres;
1548
1549     TRACE("\n");
1550
1551     hres = stack_pop_int(ctx, &r);
1552     if(FAILED(hres))
1553         return hres;
1554
1555     hres = stack_pop_int(ctx, &l);
1556     if(FAILED(hres))
1557         return hres;
1558
1559     return stack_push(ctx, jsval_number(l&r));
1560 }
1561
1562 /* ECMA-262 3rd Edition    11.8.6 */
1563 static HRESULT interp_instanceof(script_ctx_t *ctx)
1564 {
1565     jsdisp_t *obj, *iter, *tmp = NULL;
1566     jsval_t prot, v;
1567     BOOL ret = FALSE;
1568     HRESULT hres;
1569
1570     static const WCHAR prototypeW[] = {'p','r','o','t','o','t', 'y', 'p','e',0};
1571
1572     v = stack_pop(ctx);
1573     if(!is_object_instance(v) || !get_object(v)) {
1574         jsval_release(v);
1575         return throw_type_error(ctx, JS_E_FUNCTION_EXPECTED, NULL);
1576     }
1577
1578     obj = iface_to_jsdisp(get_object(v));
1579     IDispatch_Release(get_object(v));
1580     if(!obj) {
1581         FIXME("non-jsdisp objects not supported\n");
1582         return E_FAIL;
1583     }
1584
1585     if(is_class(obj, JSCLASS_FUNCTION)) {
1586         hres = jsdisp_propget_name(obj, prototypeW, &prot);
1587     }else {
1588         hres = throw_type_error(ctx, JS_E_FUNCTION_EXPECTED, NULL);
1589     }
1590     jsdisp_release(obj);
1591     if(FAILED(hres))
1592         return hres;
1593
1594     v = stack_pop(ctx);
1595
1596     if(is_object_instance(prot)) {
1597         if(is_object_instance(v))
1598             tmp = iface_to_jsdisp(get_object(v));
1599         for(iter = tmp; !ret && iter; iter = iter->prototype) {
1600             hres = disp_cmp(get_object(prot), to_disp(iter), &ret);
1601             if(FAILED(hres))
1602                 break;
1603         }
1604
1605         if(tmp)
1606             jsdisp_release(tmp);
1607     }else {
1608         FIXME("prototype is not an object\n");
1609         hres = E_FAIL;
1610     }
1611
1612     jsval_release(prot);
1613     jsval_release(v);
1614     if(FAILED(hres))
1615         return hres;
1616
1617     return stack_push(ctx, jsval_bool(ret));
1618 }
1619
1620 /* ECMA-262 3rd Edition    11.8.7 */
1621 static HRESULT interp_in(script_ctx_t *ctx)
1622 {
1623     const WCHAR *str;
1624     jsstr_t *jsstr;
1625     jsval_t obj, v;
1626     DISPID id = 0;
1627     BOOL ret;
1628     HRESULT hres;
1629
1630     TRACE("\n");
1631
1632     obj = stack_pop(ctx);
1633     if(!is_object_instance(obj) || !get_object(obj)) {
1634         jsval_release(obj);
1635         return throw_type_error(ctx, JS_E_OBJECT_EXPECTED, NULL);
1636     }
1637
1638     v = stack_pop(ctx);
1639     hres = to_flat_string(ctx, v, &jsstr, &str);
1640     jsval_release(v);
1641     if(FAILED(hres)) {
1642         IDispatch_Release(get_object(obj));
1643         return hres;
1644     }
1645
1646     hres = disp_get_id(ctx, get_object(obj), str, NULL, 0, &id);
1647     IDispatch_Release(get_object(obj));
1648     jsstr_release(jsstr);
1649     if(SUCCEEDED(hres))
1650         ret = TRUE;
1651     else if(hres == DISP_E_UNKNOWNNAME)
1652         ret = FALSE;
1653     else
1654         return hres;
1655
1656     return stack_push(ctx, jsval_bool(ret));
1657 }
1658
1659 /* ECMA-262 3rd Edition    11.6.1 */
1660 static HRESULT add_eval(script_ctx_t *ctx, jsval_t lval, jsval_t rval, jsval_t *ret)
1661 {
1662     jsval_t r, l;
1663     HRESULT hres;
1664
1665     hres = to_primitive(ctx, lval, &l, NO_HINT);
1666     if(FAILED(hres))
1667         return hres;
1668
1669     hres = to_primitive(ctx, rval, &r, NO_HINT);
1670     if(FAILED(hres)) {
1671         jsval_release(l);
1672         return hres;
1673     }
1674
1675     if(is_string(l) || is_string(r)) {
1676         jsstr_t *lstr, *rstr = NULL;
1677
1678         hres = to_string(ctx, l, &lstr);
1679         if(SUCCEEDED(hres))
1680             hres = to_string(ctx, r, &rstr);
1681
1682         if(SUCCEEDED(hres)) {
1683             jsstr_t *ret_str;
1684
1685             ret_str = jsstr_concat(lstr, rstr);
1686             if(ret_str)
1687                 *ret = jsval_string(ret_str);
1688             else
1689                 hres = E_OUTOFMEMORY;
1690         }
1691
1692         jsstr_release(lstr);
1693         if(rstr)
1694             jsstr_release(rstr);
1695     }else {
1696         double nl, nr;
1697
1698         hres = to_number(ctx, l, &nl);
1699         if(SUCCEEDED(hres)) {
1700             hres = to_number(ctx, r, &nr);
1701             if(SUCCEEDED(hres))
1702                 *ret = jsval_number(nl+nr);
1703         }
1704     }
1705
1706     jsval_release(r);
1707     jsval_release(l);
1708     return hres;
1709 }
1710
1711 /* ECMA-262 3rd Edition    11.6.1 */
1712 static HRESULT interp_add(script_ctx_t *ctx)
1713 {
1714     jsval_t l, r, ret;
1715     HRESULT hres;
1716
1717     r = stack_pop(ctx);
1718     l = stack_pop(ctx);
1719
1720     TRACE("%s + %s\n", debugstr_jsval(l), debugstr_jsval(r));
1721
1722     hres = add_eval(ctx, l, r, &ret);
1723     jsval_release(l);
1724     jsval_release(r);
1725     if(FAILED(hres))
1726         return hres;
1727
1728     return stack_push(ctx, ret);
1729 }
1730
1731 /* ECMA-262 3rd Edition    11.6.2 */
1732 static HRESULT interp_sub(script_ctx_t *ctx)
1733 {
1734     double l, r;
1735     HRESULT hres;
1736
1737     TRACE("\n");
1738
1739     hres = stack_pop_number(ctx, &r);
1740     if(FAILED(hres))
1741         return hres;
1742
1743     hres = stack_pop_number(ctx, &l);
1744     if(FAILED(hres))
1745         return hres;
1746
1747     return stack_push(ctx, jsval_number(l-r));
1748 }
1749
1750 /* ECMA-262 3rd Edition    11.5.1 */
1751 static HRESULT interp_mul(script_ctx_t *ctx)
1752 {
1753     double l, r;
1754     HRESULT hres;
1755
1756     TRACE("\n");
1757
1758     hres = stack_pop_number(ctx, &r);
1759     if(FAILED(hres))
1760         return hres;
1761
1762     hres = stack_pop_number(ctx, &l);
1763     if(FAILED(hres))
1764         return hres;
1765
1766     return stack_push(ctx, jsval_number(l*r));
1767 }
1768
1769 /* ECMA-262 3rd Edition    11.5.2 */
1770 static HRESULT interp_div(script_ctx_t *ctx)
1771 {
1772     double l, r;
1773     HRESULT hres;
1774
1775     TRACE("\n");
1776
1777     hres = stack_pop_number(ctx, &r);
1778     if(FAILED(hres))
1779         return hres;
1780
1781     hres = stack_pop_number(ctx, &l);
1782     if(FAILED(hres))
1783         return hres;
1784
1785     return stack_push(ctx, jsval_number(l/r));
1786 }
1787
1788 /* ECMA-262 3rd Edition    11.5.3 */
1789 static HRESULT interp_mod(script_ctx_t *ctx)
1790 {
1791     double l, r;
1792     HRESULT hres;
1793
1794     TRACE("\n");
1795
1796     hres = stack_pop_number(ctx, &r);
1797     if(FAILED(hres))
1798         return hres;
1799
1800     hres = stack_pop_number(ctx, &l);
1801     if(FAILED(hres))
1802         return hres;
1803
1804     return stack_push(ctx, jsval_number(fmod(l, r)));
1805 }
1806
1807 /* ECMA-262 3rd Edition    11.4.2 */
1808 static HRESULT interp_delete(script_ctx_t *ctx)
1809 {
1810     jsval_t objv, namev;
1811     IDispatch *obj;
1812     jsstr_t *name;
1813     BOOL ret;
1814     HRESULT hres;
1815
1816     TRACE("\n");
1817
1818     namev = stack_pop(ctx);
1819     objv = stack_pop(ctx);
1820
1821     hres = to_object(ctx, objv, &obj);
1822     jsval_release(objv);
1823     if(FAILED(hres)) {
1824         jsval_release(namev);
1825         return hres;
1826     }
1827
1828     hres = to_string(ctx, namev, &name);
1829     jsval_release(namev);
1830     if(FAILED(hres)) {
1831         IDispatch_Release(obj);
1832         return hres;
1833     }
1834
1835     hres = disp_delete_name(ctx, obj, name, &ret);
1836     IDispatch_Release(obj);
1837     jsstr_release(name);
1838     if(FAILED(hres))
1839         return hres;
1840
1841     return stack_push(ctx, jsval_bool(ret));
1842 }
1843
1844 /* ECMA-262 3rd Edition    11.4.2 */
1845 static HRESULT interp_delete_ident(script_ctx_t *ctx)
1846 {
1847     const BSTR arg = get_op_bstr(ctx, 0);
1848     exprval_t exprval;
1849     BOOL ret;
1850     HRESULT hres;
1851
1852     TRACE("%s\n", debugstr_w(arg));
1853
1854     hres = identifier_eval(ctx, arg, &exprval);
1855     if(FAILED(hres))
1856         return hres;
1857
1858     switch(exprval.type) {
1859     case EXPRVAL_STACK_REF:
1860         ret = FALSE;
1861         break;
1862     case EXPRVAL_IDREF:
1863         hres = disp_delete(exprval.u.idref.disp, exprval.u.idref.id, &ret);
1864         IDispatch_Release(exprval.u.idref.disp);
1865         if(FAILED(hres))
1866             return hres;
1867         break;
1868     case EXPRVAL_INVALID:
1869         ret = TRUE;
1870         break;
1871     default:
1872         FIXME("Unsupported exprval\n");
1873         exprval_release(&exprval);
1874         return E_NOTIMPL;
1875     }
1876
1877
1878     return stack_push(ctx, jsval_bool(ret));
1879 }
1880
1881 /* ECMA-262 3rd Edition    11.4.2 */
1882 static HRESULT interp_void(script_ctx_t *ctx)
1883 {
1884     TRACE("\n");
1885
1886     stack_popn(ctx, 1);
1887     return stack_push(ctx, jsval_undefined());
1888 }
1889
1890 /* ECMA-262 3rd Edition    11.4.3 */
1891 static HRESULT typeof_string(jsval_t v, const WCHAR **ret)
1892 {
1893     switch(jsval_type(v)) {
1894     case JSV_UNDEFINED:
1895         *ret = undefinedW;
1896         break;
1897     case JSV_NULL:
1898         *ret = objectW;
1899         break;
1900     case JSV_OBJECT: {
1901         jsdisp_t *dispex;
1902
1903         if(get_object(v) && (dispex = iface_to_jsdisp(get_object(v)))) {
1904             *ret = is_class(dispex, JSCLASS_FUNCTION) ? functionW : objectW;
1905             jsdisp_release(dispex);
1906         }else {
1907             *ret = objectW;
1908         }
1909         break;
1910     }
1911     case JSV_STRING:
1912         *ret = stringW;
1913         break;
1914     case JSV_NUMBER:
1915         *ret = numberW;
1916         break;
1917     case JSV_BOOL:
1918         *ret = booleanW;
1919         break;
1920     case JSV_VARIANT:
1921         FIXME("unhandled variant %s\n", debugstr_variant(get_variant(v)));
1922         return E_NOTIMPL;
1923     }
1924
1925     return S_OK;
1926 }
1927
1928 /* ECMA-262 3rd Edition    11.4.3 */
1929 static HRESULT interp_typeofid(script_ctx_t *ctx)
1930 {
1931     const WCHAR *ret;
1932     exprval_t ref;
1933     jsval_t v;
1934     HRESULT hres;
1935
1936     TRACE("\n");
1937
1938     if(!stack_pop_exprval(ctx, &ref))
1939         return stack_push(ctx, jsval_string(jsstr_undefined()));
1940
1941     hres = exprval_propget(ctx, &ref, &v);
1942     exprval_release(&ref);
1943     if(FAILED(hres))
1944         return stack_push_string(ctx, unknownW);
1945
1946     hres = typeof_string(v, &ret);
1947     jsval_release(v);
1948     if(FAILED(hres))
1949         return hres;
1950
1951     return stack_push_string(ctx, ret);
1952 }
1953
1954 /* ECMA-262 3rd Edition    11.4.3 */
1955 static HRESULT interp_typeofident(script_ctx_t *ctx)
1956 {
1957     const BSTR arg = get_op_bstr(ctx, 0);
1958     exprval_t exprval;
1959     const WCHAR *ret;
1960     jsval_t v;
1961     HRESULT hres;
1962
1963     TRACE("%s\n", debugstr_w(arg));
1964
1965     hres = identifier_eval(ctx, arg, &exprval);
1966     if(FAILED(hres))
1967         return hres;
1968
1969     if(exprval.type == EXPRVAL_INVALID)
1970         return stack_push(ctx, jsval_string(jsstr_undefined()));
1971
1972     hres = exprval_to_value(ctx, &exprval, &v);
1973     if(FAILED(hres))
1974         return hres;
1975
1976     hres = typeof_string(v, &ret);
1977     jsval_release(v);
1978     if(FAILED(hres))
1979         return hres;
1980
1981     return stack_push_string(ctx, ret);
1982 }
1983
1984 /* ECMA-262 3rd Edition    11.4.3 */
1985 static HRESULT interp_typeof(script_ctx_t *ctx)
1986 {
1987     const WCHAR *ret;
1988     jsval_t v;
1989     HRESULT hres;
1990
1991     TRACE("\n");
1992
1993     v = stack_pop(ctx);
1994     hres = typeof_string(v, &ret);
1995     jsval_release(v);
1996     if(FAILED(hres))
1997         return hres;
1998
1999     return stack_push_string(ctx, ret);
2000 }
2001
2002 /* ECMA-262 3rd Edition    11.4.7 */
2003 static HRESULT interp_minus(script_ctx_t *ctx)
2004 {
2005     double n;
2006     HRESULT hres;
2007
2008     TRACE("\n");
2009
2010     hres = stack_pop_number(ctx, &n);
2011     if(FAILED(hres))
2012         return hres;
2013
2014     return stack_push(ctx, jsval_number(-n));
2015 }
2016
2017 /* ECMA-262 3rd Edition    11.4.6 */
2018 static HRESULT interp_tonum(script_ctx_t *ctx)
2019 {
2020     jsval_t v;
2021     double n;
2022     HRESULT hres;
2023
2024     TRACE("\n");
2025
2026     v = stack_pop(ctx);
2027     hres = to_number(ctx, v, &n);
2028     jsval_release(v);
2029     if(FAILED(hres))
2030         return hres;
2031
2032     return stack_push(ctx, jsval_number(n));
2033 }
2034
2035 /* ECMA-262 3rd Edition    11.3.1 */
2036 static HRESULT interp_postinc(script_ctx_t *ctx)
2037 {
2038     const int arg = get_op_int(ctx, 0);
2039     exprval_t ref;
2040     jsval_t v;
2041     HRESULT hres;
2042
2043     TRACE("%d\n", arg);
2044
2045     if(!stack_pop_exprval(ctx, &ref))
2046         return throw_type_error(ctx, JS_E_OBJECT_EXPECTED, NULL);
2047
2048     hres = exprval_propget(ctx, &ref, &v);
2049     if(SUCCEEDED(hres)) {
2050         double n;
2051
2052         hres = to_number(ctx, v, &n);
2053         if(SUCCEEDED(hres))
2054             hres = exprval_propput(ctx, &ref, jsval_number(n+(double)arg));
2055         if(FAILED(hres))
2056             jsval_release(v);
2057     }
2058     exprval_release(&ref);
2059     if(FAILED(hres))
2060         return hres;
2061
2062     return stack_push(ctx, v);
2063 }
2064
2065 /* ECMA-262 3rd Edition    11.4.4, 11.4.5 */
2066 static HRESULT interp_preinc(script_ctx_t *ctx)
2067 {
2068     const int arg = get_op_int(ctx, 0);
2069     exprval_t ref;
2070     double ret;
2071     jsval_t v;
2072     HRESULT hres;
2073
2074     TRACE("%d\n", arg);
2075
2076     if(!stack_pop_exprval(ctx, &ref))
2077         return throw_type_error(ctx, JS_E_OBJECT_EXPECTED, NULL);
2078
2079     hres = exprval_propget(ctx, &ref, &v);
2080     if(SUCCEEDED(hres)) {
2081         double n;
2082
2083         hres = to_number(ctx, v, &n);
2084         jsval_release(v);
2085         if(SUCCEEDED(hres)) {
2086             ret = n+(double)arg;
2087             hres = exprval_propput(ctx, &ref, jsval_number(ret));
2088         }
2089     }
2090     exprval_release(&ref);
2091     if(FAILED(hres))
2092         return hres;
2093
2094     return stack_push(ctx, jsval_number(ret));
2095 }
2096
2097 /* ECMA-262 3rd Edition    11.9.3 */
2098 static HRESULT equal_values(script_ctx_t *ctx, jsval_t lval, jsval_t rval, BOOL *ret)
2099 {
2100     if(jsval_type(lval) == jsval_type(rval) || (is_number(lval) && is_number(rval)))
2101        return equal2_values(lval, rval, ret);
2102
2103     /* FIXME: NULL disps should be handled in more general way */
2104     if(is_object_instance(lval) && !get_object(lval))
2105         return equal_values(ctx, jsval_null(), rval, ret);
2106     if(is_object_instance(rval) && !get_object(rval))
2107         return equal_values(ctx, lval, jsval_null(), ret);
2108
2109     if((is_null(lval) && is_undefined(rval)) || (is_undefined(lval) && is_null(rval))) {
2110         *ret = TRUE;
2111         return S_OK;
2112     }
2113
2114     if(is_string(lval) && is_number(rval)) {
2115         double n;
2116         HRESULT hres;
2117
2118         hres = to_number(ctx, lval, &n);
2119         if(FAILED(hres))
2120             return hres;
2121
2122         /* FIXME: optimize */
2123         return equal_values(ctx, jsval_number(n), rval, ret);
2124     }
2125
2126     if(is_string(rval) && is_number(lval)) {
2127         double n;
2128         HRESULT hres;
2129
2130         hres = to_number(ctx, rval, &n);
2131         if(FAILED(hres))
2132             return hres;
2133
2134         /* FIXME: optimize */
2135         return equal_values(ctx, lval, jsval_number(n), ret);
2136     }
2137
2138     if(is_bool(rval))
2139         return equal_values(ctx, lval, jsval_number(get_bool(rval) ? 1 : 0), ret);
2140
2141     if(is_bool(lval))
2142         return equal_values(ctx, jsval_number(get_bool(lval) ? 1 : 0), rval, ret);
2143
2144
2145     if(is_object_instance(rval) && (is_string(lval) || is_number(lval))) {
2146         jsval_t prim;
2147         HRESULT hres;
2148
2149         hres = to_primitive(ctx, rval, &prim, NO_HINT);
2150         if(FAILED(hres))
2151             return hres;
2152
2153         hres = equal_values(ctx, lval, prim, ret);
2154         jsval_release(prim);
2155         return hres;
2156     }
2157
2158
2159     if(is_object_instance(lval) && (is_string(rval) || is_number(rval))) {
2160         jsval_t prim;
2161         HRESULT hres;
2162
2163         hres = to_primitive(ctx, lval, &prim, NO_HINT);
2164         if(FAILED(hres))
2165             return hres;
2166
2167         hres = equal_values(ctx, prim, rval, ret);
2168         jsval_release(prim);
2169         return hres;
2170     }
2171
2172
2173     *ret = FALSE;
2174     return S_OK;
2175 }
2176
2177 /* ECMA-262 3rd Edition    11.9.1 */
2178 static HRESULT interp_eq(script_ctx_t *ctx)
2179 {
2180     jsval_t l, r;
2181     BOOL b;
2182     HRESULT hres;
2183
2184     r = stack_pop(ctx);
2185     l = stack_pop(ctx);
2186
2187     TRACE("%s == %s\n", debugstr_jsval(l), debugstr_jsval(r));
2188
2189     hres = equal_values(ctx, l, r, &b);
2190     jsval_release(l);
2191     jsval_release(r);
2192     if(FAILED(hres))
2193         return hres;
2194
2195     return stack_push(ctx, jsval_bool(b));
2196 }
2197
2198 /* ECMA-262 3rd Edition    11.9.2 */
2199 static HRESULT interp_neq(script_ctx_t *ctx)
2200 {
2201     jsval_t l, r;
2202     BOOL b;
2203     HRESULT hres;
2204
2205     r = stack_pop(ctx);
2206     l = stack_pop(ctx);
2207
2208     TRACE("%s != %s\n", debugstr_jsval(l), debugstr_jsval(r));
2209
2210     hres = equal_values(ctx, l, r, &b);
2211     jsval_release(l);
2212     jsval_release(r);
2213     if(FAILED(hres))
2214         return hres;
2215
2216     return stack_push(ctx, jsval_bool(!b));
2217 }
2218
2219 /* ECMA-262 3rd Edition    11.9.4 */
2220 static HRESULT interp_eq2(script_ctx_t *ctx)
2221 {
2222     jsval_t l, r;
2223     BOOL b;
2224     HRESULT hres;
2225
2226     r = stack_pop(ctx);
2227     l = stack_pop(ctx);
2228
2229     TRACE("%s === %s\n", debugstr_jsval(l), debugstr_jsval(r));
2230
2231     hres = equal2_values(r, l, &b);
2232     jsval_release(l);
2233     jsval_release(r);
2234     if(FAILED(hres))
2235         return hres;
2236
2237     return stack_push(ctx, jsval_bool(b));
2238 }
2239
2240 /* ECMA-262 3rd Edition    11.9.5 */
2241 static HRESULT interp_neq2(script_ctx_t *ctx)
2242 {
2243     jsval_t l, r;
2244     BOOL b;
2245     HRESULT hres;
2246
2247     TRACE("\n");
2248
2249     r = stack_pop(ctx);
2250     l = stack_pop(ctx);
2251
2252     hres = equal2_values(r, l, &b);
2253     jsval_release(l);
2254     jsval_release(r);
2255     if(FAILED(hres))
2256         return hres;
2257
2258     return stack_push(ctx, jsval_bool(!b));
2259 }
2260
2261 /* ECMA-262 3rd Edition    11.8.5 */
2262 static HRESULT less_eval(script_ctx_t *ctx, jsval_t lval, jsval_t rval, BOOL greater, BOOL *ret)
2263 {
2264     double ln, rn;
2265     jsval_t l, r;
2266     HRESULT hres;
2267
2268     hres = to_primitive(ctx, lval, &l, NO_HINT);
2269     if(FAILED(hres))
2270         return hres;
2271
2272     hres = to_primitive(ctx, rval, &r, NO_HINT);
2273     if(FAILED(hres)) {
2274         jsval_release(l);
2275         return hres;
2276     }
2277
2278     if(is_string(l) && is_string(r)) {
2279         *ret = (jsstr_cmp(get_string(l), get_string(r)) < 0) ^ greater;
2280         jsstr_release(get_string(l));
2281         jsstr_release(get_string(r));
2282         return S_OK;
2283     }
2284
2285     hres = to_number(ctx, l, &ln);
2286     jsval_release(l);
2287     if(SUCCEEDED(hres))
2288         hres = to_number(ctx, r, &rn);
2289     jsval_release(r);
2290     if(FAILED(hres))
2291         return hres;
2292
2293     *ret = !isnan(ln) && !isnan(rn) && ((ln < rn) ^ greater);
2294     return S_OK;
2295 }
2296
2297 /* ECMA-262 3rd Edition    11.8.1 */
2298 static HRESULT interp_lt(script_ctx_t *ctx)
2299 {
2300     jsval_t l, r;
2301     BOOL b;
2302     HRESULT hres;
2303
2304     r = stack_pop(ctx);
2305     l = stack_pop(ctx);
2306
2307     TRACE("%s < %s\n", debugstr_jsval(l), debugstr_jsval(r));
2308
2309     hres = less_eval(ctx, l, r, FALSE, &b);
2310     jsval_release(l);
2311     jsval_release(r);
2312     if(FAILED(hres))
2313         return hres;
2314
2315     return stack_push(ctx, jsval_bool(b));
2316 }
2317
2318 /* ECMA-262 3rd Edition    11.8.1 */
2319 static HRESULT interp_lteq(script_ctx_t *ctx)
2320 {
2321     jsval_t l, r;
2322     BOOL b;
2323     HRESULT hres;
2324
2325     r = stack_pop(ctx);
2326     l = stack_pop(ctx);
2327
2328     TRACE("%s <= %s\n", debugstr_jsval(l), debugstr_jsval(r));
2329
2330     hres = less_eval(ctx, r, l, TRUE, &b);
2331     jsval_release(l);
2332     jsval_release(r);
2333     if(FAILED(hres))
2334         return hres;
2335
2336     return stack_push(ctx, jsval_bool(b));
2337 }
2338
2339 /* ECMA-262 3rd Edition    11.8.2 */
2340 static HRESULT interp_gt(script_ctx_t *ctx)
2341 {
2342     jsval_t l, r;
2343     BOOL b;
2344     HRESULT hres;
2345
2346     r = stack_pop(ctx);
2347     l = stack_pop(ctx);
2348
2349     TRACE("%s > %s\n", debugstr_jsval(l), debugstr_jsval(r));
2350
2351     hres = less_eval(ctx, r, l, FALSE, &b);
2352     jsval_release(l);
2353     jsval_release(r);
2354     if(FAILED(hres))
2355         return hres;
2356
2357     return stack_push(ctx, jsval_bool(b));
2358 }
2359
2360 /* ECMA-262 3rd Edition    11.8.4 */
2361 static HRESULT interp_gteq(script_ctx_t *ctx)
2362 {
2363     jsval_t l, r;
2364     BOOL b;
2365     HRESULT hres;
2366
2367     r = stack_pop(ctx);
2368     l = stack_pop(ctx);
2369
2370     TRACE("%s >= %s\n", debugstr_jsval(l), debugstr_jsval(r));
2371
2372     hres = less_eval(ctx, l, r, TRUE, &b);
2373     jsval_release(l);
2374     jsval_release(r);
2375     if(FAILED(hres))
2376         return hres;
2377
2378     return stack_push(ctx, jsval_bool(b));
2379 }
2380
2381 /* ECMA-262 3rd Edition    11.4.8 */
2382 static HRESULT interp_bneg(script_ctx_t *ctx)
2383 {
2384     jsval_t v;
2385     INT i;
2386     HRESULT hres;
2387
2388     TRACE("\n");
2389
2390     v = stack_pop(ctx);
2391     hres = to_int32(ctx, v, &i);
2392     jsval_release(v);
2393     if(FAILED(hres))
2394         return hres;
2395
2396     return stack_push(ctx, jsval_number(~i));
2397 }
2398
2399 /* ECMA-262 3rd Edition    11.4.9 */
2400 static HRESULT interp_neg(script_ctx_t *ctx)
2401 {
2402     jsval_t v;
2403     BOOL b;
2404     HRESULT hres;
2405
2406     TRACE("\n");
2407
2408     v = stack_pop(ctx);
2409     hres = to_boolean(v, &b);
2410     jsval_release(v);
2411     if(FAILED(hres))
2412         return hres;
2413
2414     return stack_push(ctx, jsval_bool(!b));
2415 }
2416
2417 /* ECMA-262 3rd Edition    11.7.1 */
2418 static HRESULT interp_lshift(script_ctx_t *ctx)
2419 {
2420     DWORD r;
2421     INT l;
2422     HRESULT hres;
2423
2424     hres = stack_pop_uint(ctx, &r);
2425     if(FAILED(hres))
2426         return hres;
2427
2428     hres = stack_pop_int(ctx, &l);
2429     if(FAILED(hres))
2430         return hres;
2431
2432     return stack_push(ctx, jsval_number(l << (r&0x1f)));
2433 }
2434
2435 /* ECMA-262 3rd Edition    11.7.2 */
2436 static HRESULT interp_rshift(script_ctx_t *ctx)
2437 {
2438     DWORD r;
2439     INT l;
2440     HRESULT hres;
2441
2442     hres = stack_pop_uint(ctx, &r);
2443     if(FAILED(hres))
2444         return hres;
2445
2446     hres = stack_pop_int(ctx, &l);
2447     if(FAILED(hres))
2448         return hres;
2449
2450     return stack_push(ctx, jsval_number(l >> (r&0x1f)));
2451 }
2452
2453 /* ECMA-262 3rd Edition    11.7.3 */
2454 static HRESULT interp_rshift2(script_ctx_t *ctx)
2455 {
2456     DWORD r, l;
2457     HRESULT hres;
2458
2459     hres = stack_pop_uint(ctx, &r);
2460     if(FAILED(hres))
2461         return hres;
2462
2463     hres = stack_pop_uint(ctx, &l);
2464     if(FAILED(hres))
2465         return hres;
2466
2467     return stack_push(ctx, jsval_number(l >> (r&0x1f)));
2468 }
2469
2470 /* ECMA-262 3rd Edition    11.13.1 */
2471 static HRESULT interp_assign(script_ctx_t *ctx)
2472 {
2473     exprval_t ref;
2474     jsval_t v;
2475     HRESULT hres;
2476
2477     TRACE("\n");
2478
2479     v = stack_pop(ctx);
2480
2481     if(!stack_pop_exprval(ctx, &ref)) {
2482         jsval_release(v);
2483         return throw_reference_error(ctx, JS_E_ILLEGAL_ASSIGN, NULL);
2484     }
2485
2486     hres = exprval_propput(ctx, &ref, v);
2487     exprval_release(&ref);
2488     if(FAILED(hres)) {
2489         jsval_release(v);
2490         return hres;
2491     }
2492
2493     return stack_push(ctx, v);
2494 }
2495
2496 /* JScript extension */
2497 static HRESULT interp_assign_call(script_ctx_t *ctx)
2498 {
2499     const unsigned argc = get_op_uint(ctx, 0);
2500     exprval_t ref;
2501     jsval_t v;
2502     HRESULT hres;
2503
2504     TRACE("%u\n", argc);
2505
2506     if(!stack_topn_exprval(ctx, argc+1, &ref))
2507         return throw_reference_error(ctx, JS_E_ILLEGAL_ASSIGN, NULL);
2508
2509     hres = exprval_call(ctx, &ref, DISPATCH_PROPERTYPUT, argc+1, stack_args(ctx, argc+1), NULL);
2510     if(FAILED(hres))
2511         return hres;
2512
2513     v = stack_pop(ctx);
2514     stack_popn(ctx, argc+2);
2515     return stack_push(ctx, v);
2516 }
2517
2518 static HRESULT interp_undefined(script_ctx_t *ctx)
2519 {
2520     TRACE("\n");
2521
2522     return stack_push(ctx, jsval_undefined());
2523 }
2524
2525 static HRESULT interp_jmp(script_ctx_t *ctx)
2526 {
2527     const unsigned arg = get_op_uint(ctx, 0);
2528
2529     TRACE("%u\n", arg);
2530
2531     jmp_abs(ctx, arg);
2532     return S_OK;
2533 }
2534
2535 static HRESULT interp_jmp_z(script_ctx_t *ctx)
2536 {
2537     const unsigned arg = get_op_uint(ctx, 0);
2538     BOOL b;
2539     jsval_t v;
2540     HRESULT hres;
2541
2542     TRACE("\n");
2543
2544     v = stack_pop(ctx);
2545     hres = to_boolean(v, &b);
2546     jsval_release(v);
2547     if(FAILED(hres))
2548         return hres;
2549
2550     if(b)
2551         jmp_next(ctx);
2552     else
2553         jmp_abs(ctx, arg);
2554     return S_OK;
2555 }
2556
2557 static HRESULT interp_pop(script_ctx_t *ctx)
2558 {
2559     const unsigned arg = get_op_uint(ctx, 0);
2560
2561     TRACE("%u\n", arg);
2562
2563     stack_popn(ctx, arg);
2564     return S_OK;
2565 }
2566
2567 static HRESULT interp_ret(script_ctx_t *ctx)
2568 {
2569     const unsigned clear_ret = get_op_uint(ctx, 0);
2570     call_frame_t *frame = ctx->call_ctx;
2571
2572     TRACE("\n");
2573
2574     if(clear_ret)
2575         jsval_release(steal_ret(frame));
2576
2577     if((frame->flags & EXEC_CONSTRUCTOR) && !is_object_instance(frame->ret)) {
2578         jsval_release(frame->ret);
2579         IDispatch_AddRef(frame->this_obj);
2580         frame->ret = jsval_disp(frame->this_obj);
2581     }
2582
2583     jmp_abs(ctx, -1);
2584     return S_OK;
2585 }
2586
2587 static HRESULT interp_setret(script_ctx_t *ctx)
2588 {
2589     call_frame_t *frame = ctx->call_ctx;
2590
2591     TRACE("\n");
2592
2593     jsval_release(frame->ret);
2594     frame->ret = stack_pop(ctx);
2595     return S_OK;
2596 }
2597
2598 static HRESULT interp_push_ret(script_ctx_t *ctx)
2599 {
2600     call_frame_t *frame = ctx->call_ctx;
2601     HRESULT hres;
2602
2603     TRACE("\n");
2604
2605     hres = stack_push(ctx, frame->ret);
2606     if(SUCCEEDED(hres))
2607         frame->ret = jsval_undefined();
2608     return hres;
2609 }
2610
2611 typedef HRESULT (*op_func_t)(script_ctx_t*);
2612
2613 static const op_func_t op_funcs[] = {
2614 #define X(x,a,b,c) interp_##x,
2615 OP_LIST
2616 #undef X
2617 };
2618
2619 static const unsigned op_move[] = {
2620 #define X(a,x,b,c) x,
2621 OP_LIST
2622 #undef X
2623 };
2624
2625 static void pop_call_frame(script_ctx_t *ctx)
2626 {
2627     call_frame_t *frame = ctx->call_ctx;
2628
2629     frame->stack_base -= frame->pop_locals + frame->pop_variables;
2630
2631     assert(frame->scope == frame->base_scope);
2632
2633     /* If current scope will be kept alive, we need to transfer local variables to its variable object. */
2634     if(frame->scope && frame->scope->ref > 1) {
2635         HRESULT hres = detach_variable_object(ctx, frame, TRUE);
2636         if(FAILED(hres))
2637             ERR("Failed to detach variable object: %08x\n", hres);
2638     }
2639
2640     if(frame->arguments_obj)
2641         detach_arguments_object(frame->arguments_obj);
2642     if(frame->scope)
2643         scope_release(frame->scope);
2644
2645     if(frame->pop_variables)
2646         stack_popn(ctx, frame->pop_variables);
2647     stack_popn(ctx, frame->pop_locals);
2648
2649     ctx->call_ctx = frame->prev_frame;
2650
2651     if(frame->function_instance)
2652         jsdisp_release(frame->function_instance);
2653     if(frame->variable_obj)
2654         jsdisp_release(frame->variable_obj);
2655     if(frame->this_obj)
2656         IDispatch_Release(frame->this_obj);
2657     jsval_release(frame->ret);
2658     release_bytecode(frame->bytecode);
2659     heap_free(frame);
2660 }
2661
2662 static void print_backtrace(script_ctx_t *ctx)
2663 {
2664     unsigned depth = 0, i;
2665     call_frame_t *frame;
2666
2667     for(frame = ctx->call_ctx; frame; frame = frame->prev_frame) {
2668         WARN("%u\t", depth);
2669         depth++;
2670
2671         if(frame->this_obj && frame->this_obj != to_disp(ctx->global) && frame->this_obj != ctx->host_global)
2672             WARN("%p->", frame->this_obj);
2673         WARN("%s(", frame->function->name ? debugstr_w(frame->function->name) : "[unnamed]");
2674         if(frame->base_scope && frame->base_scope->frame) {
2675             for(i=0; i < frame->argc; i++) {
2676                 if(i < frame->function->param_cnt)
2677                     WARN("%s%s=%s", i ? ", " : "", debugstr_w(frame->function->params[i]),
2678                          debugstr_jsval(ctx->stack[local_off(frame, -i-1)]));
2679                 else
2680                     WARN("%s%s", i ? ", " : "", debugstr_jsval(ctx->stack[local_off(frame, -i-1)]));
2681             }
2682         }else {
2683             WARN("[detached frame]");
2684         }
2685         WARN(")\n");
2686
2687         if(!(frame->flags & EXEC_RETURN_TO_INTERP)) {
2688             WARN("%u\t[native code]\n", depth);
2689             depth++;
2690         }
2691     }
2692 }
2693
2694 static HRESULT unwind_exception(script_ctx_t *ctx, HRESULT exception_hres)
2695 {
2696     except_frame_t *except_frame;
2697     call_frame_t *frame;
2698     jsval_t except_val;
2699     unsigned catch_off;
2700     HRESULT hres;
2701
2702     if(WARN_ON(jscript)) {
2703         jsdisp_t *error_obj;
2704         jsval_t msg;
2705
2706         static const WCHAR messageW[] = {'m','e','s','s','a','g','e',0};
2707
2708         WARN("Exception %08x %s", exception_hres, debugstr_jsval(ctx->ei.val));
2709         if(jsval_type(ctx->ei.val) == JSV_OBJECT) {
2710             error_obj = to_jsdisp(get_object(ctx->ei.val));
2711             if(error_obj) {
2712                 hres = jsdisp_propget_name(error_obj, messageW, &msg);
2713                 if(SUCCEEDED(hres)) {
2714                     WARN(" (message %s)", debugstr_jsval(msg));
2715                     jsval_release(msg);
2716                 }
2717             }
2718         }
2719         WARN(" in:\n");
2720
2721         print_backtrace(ctx);
2722     }
2723
2724     for(frame = ctx->call_ctx; !frame->except_frame; frame = ctx->call_ctx) {
2725         DWORD flags;
2726
2727         while(frame->scope != frame->base_scope)
2728             scope_pop(&frame->scope);
2729
2730         stack_popn(ctx, ctx->stack_top-frame->stack_base);
2731
2732         flags = frame->flags;
2733         pop_call_frame(ctx);
2734         if(!(flags & EXEC_RETURN_TO_INTERP))
2735             return exception_hres;
2736     }
2737
2738     except_frame = frame->except_frame;
2739     catch_off = except_frame->catch_off;
2740
2741     assert(except_frame->stack_top <= ctx->stack_top);
2742     stack_popn(ctx, ctx->stack_top - except_frame->stack_top);
2743
2744     while(except_frame->scope != frame->scope)
2745         scope_pop(&frame->scope);
2746
2747     frame->ip = catch_off ? catch_off : except_frame->finally_off;
2748     if(catch_off) assert(frame->bytecode->instrs[frame->ip].op == OP_enter_catch);
2749
2750     except_val = ctx->ei.val;
2751     ctx->ei.val = jsval_undefined();
2752     clear_ei(ctx);
2753
2754     /* keep current except_frame if we're entering catch block with finally block associated */
2755     if(catch_off && except_frame->finally_off) {
2756         except_frame->catch_off = 0;
2757     }else {
2758         frame->except_frame = except_frame->next;
2759         heap_free(except_frame);
2760     }
2761
2762     hres = stack_push(ctx, except_val);
2763     if(FAILED(hres))
2764         return hres;
2765
2766     if(!catch_off)
2767         hres = stack_push(ctx, jsval_bool(FALSE));
2768     return hres;
2769 }
2770
2771 static HRESULT enter_bytecode(script_ctx_t *ctx, jsval_t *r)
2772 {
2773     call_frame_t *frame;
2774     jsop_t op;
2775     HRESULT hres = S_OK;
2776
2777     TRACE("\n");
2778
2779     while(1) {
2780         frame = ctx->call_ctx;
2781         op = frame->bytecode->instrs[frame->ip].op;
2782         hres = op_funcs[op](ctx);
2783         if(FAILED(hres)) {
2784             hres = unwind_exception(ctx, hres);
2785             if(FAILED(hres))
2786                 return hres;
2787         }else if(frame->ip == -1) {
2788             const DWORD return_to_interp = frame->flags & EXEC_RETURN_TO_INTERP;
2789
2790             assert(ctx->stack_top == frame->stack_base);
2791             assert(frame->scope == frame->base_scope);
2792
2793             if(return_to_interp) {
2794                 clear_ret(frame->prev_frame);
2795                 frame->prev_frame->ret = steal_ret(frame);
2796             }else if(r) {
2797                 *r = steal_ret(frame);
2798             }
2799             pop_call_frame(ctx);
2800             if(!return_to_interp)
2801                 break;
2802         }else {
2803             frame->ip += op_move[op];
2804         }
2805     }
2806
2807     return S_OK;
2808 }
2809
2810 static HRESULT bind_event_target(script_ctx_t *ctx, function_code_t *func, jsdisp_t *func_obj)
2811 {
2812     IBindEventHandler *target;
2813     exprval_t exprval;
2814     IDispatch *disp;
2815     jsval_t v;
2816     HRESULT hres;
2817
2818     hres = identifier_eval(ctx, func->event_target, &exprval);
2819     if(FAILED(hres))
2820         return hres;
2821
2822     hres = exprval_to_value(ctx, &exprval, &v);
2823     if(FAILED(hres))
2824         return hres;
2825
2826     if(!is_object_instance(v)) {
2827         FIXME("Can't bind to %s\n", debugstr_jsval(v));
2828         jsval_release(v);
2829     }
2830
2831     disp = get_object(v);
2832     hres = IDispatch_QueryInterface(disp, &IID_IBindEventHandler, (void**)&target);
2833     if(SUCCEEDED(hres)) {
2834         hres = IBindEventHandler_BindHandler(target, func->name, (IDispatch*)&func_obj->IDispatchEx_iface);
2835         IBindEventHandler_Release(target);
2836         if(FAILED(hres))
2837             WARN("BindEvent failed: %08x\n", hres);
2838     }else {
2839         FIXME("No IBindEventHandler, not yet supported binding\n");
2840     }
2841
2842     IDispatch_Release(disp);
2843     return hres;
2844 }
2845
2846 static HRESULT setup_scope(script_ctx_t *ctx, call_frame_t *frame, scope_chain_t *scope_chain, jsdisp_t *variable_object, unsigned argc, jsval_t *argv)
2847 {
2848     const unsigned orig_stack = ctx->stack_top;
2849     scope_chain_t *scope;
2850     unsigned i;
2851     jsval_t v;
2852     HRESULT hres;
2853
2854     /* If arguments are already on the stack, we may use them. */
2855     if(argv + argc == ctx->stack + ctx->stack_top) {
2856         frame->arguments_off = argv - ctx->stack;
2857         i = argc;
2858     }else {
2859         frame->arguments_off = ctx->stack_top;
2860         for(i = 0; i < argc; i++) {
2861             hres = jsval_copy(argv[i], &v);
2862             if(SUCCEEDED(hres))
2863                 hres = stack_push(ctx, v);
2864             if(FAILED(hres)) {
2865                 stack_popn(ctx, i);
2866                 return hres;
2867             }
2868         }
2869     }
2870
2871     /* If fewer than declared arguments were passed, fill remaining with undefined value. */
2872     for(; i < frame->function->param_cnt; i++) {
2873         hres = stack_push(ctx, jsval_undefined());
2874         if(FAILED(hres)) {
2875             stack_popn(ctx, ctx->stack_top - orig_stack);
2876             return hres;
2877         }
2878     }
2879
2880     frame->pop_locals = ctx->stack_top - orig_stack;
2881
2882     frame->variables_off = ctx->stack_top;
2883
2884     for(i = 0; i < frame->function->var_cnt; i++) {
2885         hres = stack_push(ctx, jsval_undefined());
2886         if(FAILED(hres)) {
2887             stack_popn(ctx, ctx->stack_top - orig_stack);
2888             return hres;
2889         }
2890     }
2891
2892     frame->pop_variables = i;
2893
2894     hres = scope_push(scope_chain, variable_object, to_disp(variable_object), &scope);
2895     if(FAILED(hres)) {
2896         stack_popn(ctx, ctx->stack_top - orig_stack);
2897         return hres;
2898     }
2899
2900     for(i = 0; i < frame->function->func_cnt; i++) {
2901         if(frame->function->funcs[i].name && !frame->function->funcs[i].event_target) {
2902             jsdisp_t *func_obj;
2903             unsigned off;
2904
2905             hres = create_source_function(ctx, frame->bytecode, frame->function->funcs+i, scope, &func_obj);
2906             if(FAILED(hres)) {
2907                 stack_popn(ctx, ctx->stack_top - orig_stack);
2908                 scope_release(scope);
2909                 return hres;
2910             }
2911
2912             off = local_off(frame, frame->function->funcs[i].local_ref);
2913             jsval_release(ctx->stack[off]);
2914             ctx->stack[off] = jsval_obj(func_obj);
2915         }
2916     }
2917
2918     scope->frame = frame;
2919     frame->base_scope = frame->scope = scope;
2920     return S_OK;
2921 }
2922
2923 HRESULT exec_source(script_ctx_t *ctx, DWORD flags, bytecode_t *bytecode, function_code_t *function, scope_chain_t *scope,
2924         IDispatch *this_obj, jsdisp_t *function_instance, jsdisp_t *variable_obj, unsigned argc, jsval_t *argv, jsval_t *r)
2925 {
2926     call_frame_t *frame;
2927     unsigned i;
2928     HRESULT hres;
2929
2930     for(i = 0; i < function->func_cnt; i++) {
2931         jsdisp_t *func_obj;
2932
2933         if(!function->funcs[i].event_target)
2934             continue;
2935
2936         hres = create_source_function(ctx, bytecode, function->funcs+i, scope, &func_obj);
2937         if(FAILED(hres))
2938             return hres;
2939
2940         hres = bind_event_target(ctx, function->funcs+i, func_obj);
2941         jsdisp_release(func_obj);
2942         if(FAILED(hres))
2943             return hres;
2944     }
2945
2946     if(flags & (EXEC_GLOBAL | EXEC_EVAL)) {
2947         for(i=0; i < function->var_cnt; i++) {
2948             TRACE("[%d] %s %d\n", i, debugstr_w(function->variables[i].name), function->variables[i].func_id);
2949             if(function->variables[i].func_id != -1) {
2950                 jsdisp_t *func_obj;
2951
2952                 hres = create_source_function(ctx, bytecode, function->funcs+function->variables[i].func_id, scope, &func_obj);
2953                 if(FAILED(hres))
2954                     return hres;
2955
2956                 hres = jsdisp_propput_name(variable_obj, function->variables[i].name, jsval_obj(func_obj));
2957                 jsdisp_release(func_obj);
2958             }else if(!(flags & EXEC_GLOBAL) || !lookup_global_members(ctx, function->variables[i].name, NULL)) {
2959                 DISPID id = 0;
2960
2961                 hres = jsdisp_get_id(variable_obj, function->variables[i].name, fdexNameEnsure, &id);
2962                 if(FAILED(hres))
2963                     return hres;
2964             }
2965         }
2966     }
2967
2968     /* ECMA-262 3rd Edition    11.2.3.7 */
2969     if(this_obj) {
2970         jsdisp_t *jsthis;
2971
2972         jsthis = iface_to_jsdisp(this_obj);
2973         if(jsthis) {
2974             if(jsthis->builtin_info->class == JSCLASS_GLOBAL || jsthis->builtin_info->class == JSCLASS_NONE)
2975                 this_obj = NULL;
2976             jsdisp_release(jsthis);
2977         }
2978     }
2979
2980     if(ctx->call_ctx && (flags & EXEC_EVAL)) {
2981         hres = detach_variable_object(ctx, ctx->call_ctx, FALSE);
2982         if(FAILED(hres))
2983             return hres;
2984     }
2985
2986     frame = heap_alloc_zero(sizeof(*frame));
2987     if(!frame)
2988         return E_OUTOFMEMORY;
2989
2990     frame->function = function;
2991     frame->ret = jsval_undefined();
2992     frame->argc = argc;
2993     frame->bytecode = bytecode_addref(bytecode);
2994
2995     if(!(flags & (EXEC_GLOBAL|EXEC_EVAL))) {
2996         hres = setup_scope(ctx, frame, scope, variable_obj, argc, argv);
2997         if(FAILED(hres)) {
2998             release_bytecode(frame->bytecode);
2999             heap_free(frame);
3000             return hres;
3001         }
3002     }else if(scope) {
3003         frame->base_scope = frame->scope = scope_addref(scope);
3004     }
3005
3006     frame->ip = function->instr_off;
3007     frame->stack_base = ctx->stack_top;
3008     if(this_obj)
3009         frame->this_obj = this_obj;
3010     else if(ctx->host_global)
3011         frame->this_obj = ctx->host_global;
3012     else
3013         frame->this_obj = to_disp(ctx->global);
3014     IDispatch_AddRef(frame->this_obj);
3015
3016     if(function_instance)
3017         frame->function_instance = jsdisp_addref(function_instance);
3018
3019     frame->flags = flags;
3020     frame->variable_obj = jsdisp_addref(variable_obj);
3021
3022     frame->prev_frame = ctx->call_ctx;
3023     ctx->call_ctx = frame;
3024
3025     if(flags & EXEC_RETURN_TO_INTERP) {
3026         /*
3027          * We're called directly from interpreter, so we may just setup call frame and return.
3028          * Already running interpreter will take care of execution.
3029          */
3030         if(r)
3031             *r = jsval_undefined();
3032         return S_OK;
3033     }
3034
3035     return enter_bytecode(ctx, r);
3036 }