dlls/jscript/engine.c

   1 /*
   2  * Copyright 2008,2011 Jacek Caban for CodeWeavers
   3  *
   4  * This library is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU Lesser General Public
   6  * License as published by the Free Software Foundation; either
   7  * version 2.1 of the License, or (at your option) any later version.
   8  *
   9  * This library is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12  * Lesser General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU Lesser General Public
  15  * License along with this library; if not, write to the Free Software
  16  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  17  */
  18
  19 #include "config.h"
  20 #include "wine/port.h"
  21
  22 #include <math.h>
  23 #include <assert.h>
  24
  25 #include "jscript.h"
  26 #include "engine.h"
  27
  28 #include "wine/debug.h"
  29
  30 WINE_DEFAULT_DEBUG_CHANNEL(jscript);
  31 WINE_DECLARE_DEBUG_CHANNEL(jscript_except);
  32
  33 static const WCHAR booleanW[] = {'b','o','o','l','e','a','n',0};
  34 static const WCHAR functionW[] = {'f','u','n','c','t','i','o','n',0};
  35 static const WCHAR numberW[] = {'n','u','m','b','e','r',0};
  36 static const WCHAR objectW[] = {'o','b','j','e','c','t',0};
  37 static const WCHAR stringW[] = {'s','t','r','i','n','g',0};
  38 static const WCHAR undefinedW[] = {'u','n','d','e','f','i','n','e','d',0};
  39 static const WCHAR unknownW[] = {'u','n','k','n','o','w','n',0};
  40
  41 struct _except_frame_t {
  42     unsigned stack_top;
  43     scope_chain_t *scope;
  44     unsigned catch_off;
  45     unsigned finally_off;
  46
  47     except_frame_t *next;
  48 };
  49
  50 typedef struct {
  51     enum {
  52         EXPRVAL_JSVAL,
  53         EXPRVAL_IDREF,
  54         EXPRVAL_STACK_REF,
  55         EXPRVAL_INVALID
  56     } type;
  57     union {
  58         jsval_t val;
  59         struct {
  60             IDispatch *disp;
  61             DISPID id;
  62         } idref;
  63         unsigned off;
  64         HRESULT hres;
  65     } u;
  66 } exprval_t;
  67
  68 static HRESULT stack_push(script_ctx_t *ctx, jsval_t v)
  69 {
  70     if(!ctx->stack_size) {
  71         ctx->stack = heap_alloc(16*sizeof(*ctx->stack));
  72         if(!ctx->stack)
  73             return E_OUTOFMEMORY;
  74         ctx->stack_size = 16;
  75     }else if(ctx->stack_size == ctx->stack_top) {
  76         jsval_t *new_stack;
  77
  78         new_stack = heap_realloc(ctx->stack, ctx->stack_size*2*sizeof(*new_stack));
  79         if(!new_stack) {
  80             jsval_release(v);
  81             return E_OUTOFMEMORY;
  82         }
  83
  84         ctx->stack = new_stack;
  85         ctx->stack_size *= 2;
  86     }
  87
  88     ctx->stack[ctx->stack_top++] = v;
  89     return S_OK;
  90 }
  91
  92 static inline HRESULT stack_push_string(script_ctx_t *ctx, const WCHAR *str)
  93 {
  94     jsstr_t *v;
  95
  96     v = jsstr_alloc(str);
  97     if(!v)
  98         return E_OUTOFMEMORY;
  99
 100     return stack_push(ctx, jsval_string(v));
 101 }
 102
 103 static inline jsval_t stack_top(script_ctx_t *ctx)
 104 {
 105     assert(ctx->stack_top > ctx->call_ctx->stack_base);
 106     return ctx->stack[ctx->stack_top-1];
 107 }
 108
 109 static inline jsval_t *stack_top_ref(script_ctx_t *ctx, unsigned n)
 110 {
 111     assert(ctx->stack_top > ctx->call_ctx->stack_base+n);
 112     return ctx->stack+ctx->stack_top-1-n;
 113 }
 114
 115 static inline jsval_t stack_topn(script_ctx_t *ctx, unsigned n)
 116 {
 117     return *stack_top_ref(ctx, n);
 118 }
 119
 120 static inline jsval_t *stack_args(script_ctx_t *ctx, unsigned n)
 121 {
 122     if(!n)
 123         return NULL;
 124     assert(ctx->stack_top > ctx->call_ctx->stack_base+n-1);
 125     return ctx->stack + ctx->stack_top-n;
 126 }
 127
 128 static inline jsval_t stack_pop(script_ctx_t *ctx)
 129 {
 130     assert(ctx->stack_top > ctx->call_ctx->stack_base);
 131     return ctx->stack[--ctx->stack_top];
 132 }
 133
 134 static void stack_popn(script_ctx_t *ctx, unsigned n)
 135 {
 136     while(n--)
 137         jsval_release(stack_pop(ctx));
 138 }
 139
 140 static HRESULT stack_pop_number(script_ctx_t *ctx, double *r)
 141 {
 142     jsval_t v;
 143     HRESULT hres;
 144
 145     v = stack_pop(ctx);
 146     hres = to_number(ctx, v, r);
 147     jsval_release(v);
 148     return hres;
 149 }
 150
 151 static HRESULT stack_pop_object(script_ctx_t *ctx, IDispatch **r)
 152 {
 153     jsval_t v;
 154     HRESULT hres;
 155
 156     v = stack_pop(ctx);
 157     if(is_object_instance(v)) {
 158         if(!get_object(v))
 159             return throw_type_error(ctx, JS_E_OBJECT_REQUIRED, NULL);
 160         *r = get_object(v);
 161         return S_OK;
 162     }
 163
 164     hres = to_object(ctx, v, r);
 165     jsval_release(v);
 166     return hres;
 167 }
 168
 169 static inline HRESULT stack_pop_int(script_ctx_t *ctx, INT *r)
 170 {
 171     return to_int32(ctx, stack_pop(ctx), r);
 172 }
 173
 174 static inline HRESULT stack_pop_uint(script_ctx_t *ctx, DWORD *r)
 175 {
 176     return to_uint32(ctx, stack_pop(ctx), r);
 177 }
 178
 179 static inline unsigned local_off(call_frame_t *frame, int ref)
 180 {
 181     return ref < 0
 182         ? frame->arguments_off - ref-1
 183         : frame->variables_off + ref;
 184 }
 185
 186 static inline BSTR local_name(call_frame_t *frame, int ref)
 187 {
 188     return ref < 0 ? frame->function->params[-ref-1] : frame->function->variables[ref].name;
 189 }
 190
 191 /* Steals input reference even on failure. */
 192 static HRESULT stack_push_exprval(script_ctx_t *ctx, exprval_t *val)
 193 {
 194     HRESULT hres;
 195
 196     switch(val->type) {
 197     case EXPRVAL_JSVAL:
 198         assert(0);
 199     case EXPRVAL_IDREF:
 200         hres = stack_push(ctx, jsval_disp(val->u.idref.disp));
 201         if(SUCCEEDED(hres))
 202             hres = stack_push(ctx, jsval_number(val->u.idref.id));
 203         else
 204             IDispatch_Release(val->u.idref.disp);
 205         return hres;
 206     case EXPRVAL_STACK_REF:
 207         hres = stack_push(ctx, jsval_number(val->u.off));
 208         if(SUCCEEDED(hres))
 209             hres = stack_push(ctx, jsval_undefined());
 210         return hres;
 211     case EXPRVAL_INVALID:
 212         hres = stack_push(ctx, jsval_undefined());
 213         if(SUCCEEDED(hres))
 214             hres = stack_push(ctx, jsval_number(val->u.hres));
 215         return hres;
 216     }
 217
 218     assert(0);
 219     return E_FAIL;
 220 }
 221
 222 static BOOL stack_topn_exprval(script_ctx_t *ctx, unsigned n, exprval_t *r)
 223 {
 224     jsval_t v = stack_topn(ctx, n+1);
 225
 226     switch(jsval_type(v)) {
 227     case JSV_NUMBER: {
 228         call_frame_t *frame = ctx->call_ctx;
 229         unsigned off = get_number(v);
 230
 231         if(!frame->base_scope->frame && off >= frame->arguments_off) {
 232             DISPID id;
 233             BSTR name;
 234             HRESULT hres;
 235
 236             /* Got stack reference in deoptimized code. Need to convert it back to variable object reference. */
 237
 238             assert(off < frame->variables_off + frame->function->var_cnt);
 239             name = off >= frame->variables_off
 240                 ? frame->function->variables[off - frame->variables_off].name
 241                 : frame->function->params[off - frame->arguments_off];
 242             hres = jsdisp_get_id(ctx->call_ctx->base_scope->jsobj, name, 0, &id);
 243             if(FAILED(hres)) {
 244                 r->type = EXPRVAL_INVALID;
 245                 r->u.hres = hres;
 246                 return FALSE;
 247             }
 248
 249             *stack_top_ref(ctx, n+1) = jsval_obj(jsdisp_addref(frame->base_scope->jsobj));
 250             *stack_top_ref(ctx, n) = jsval_number(id);
 251             r->type = EXPRVAL_IDREF;
 252             r->u.idref.disp = frame->base_scope->obj;
 253             r->u.idref.id = id;
 254             return TRUE;
 255         }
 256
 257         r->type = EXPRVAL_STACK_REF;
 258         r->u.off = off;
 259         return TRUE;
 260     }
 261     case JSV_OBJECT:
 262         r->type = EXPRVAL_IDREF;
 263         r->u.idref.disp = get_object(v);
 264         assert(is_number(stack_topn(ctx, n)));
 265         r->u.idref.id = get_number(stack_topn(ctx, n));
 266         return TRUE;
 267     case JSV_UNDEFINED:
 268         r->type = EXPRVAL_INVALID;
 269         assert(is_number(stack_topn(ctx, n)));
 270         r->u.hres = get_number(stack_topn(ctx, n));
 271         return FALSE;
 272     default:
 273         assert(0);
 274         return FALSE;
 275     }
 276 }
 277
 278 static inline BOOL stack_pop_exprval(script_ctx_t *ctx, exprval_t *r)
 279 {
 280     BOOL ret = stack_topn_exprval(ctx, 0, r);
 281     ctx->stack_top -= 2;
 282     return ret;
 283 }
 284
 285 static HRESULT exprval_propput(script_ctx_t *ctx, exprval_t *ref, jsval_t v)
 286 {
 287     switch(ref->type) {
 288     case EXPRVAL_STACK_REF: {
 289         jsval_t *r = ctx->stack + ref->u.off;
 290         jsval_release(*r);
 291         return jsval_copy(v, r);
 292     }
 293     case EXPRVAL_IDREF:
 294         return disp_propput(ctx, ref->u.idref.disp, ref->u.idref.id, v);
 295     default:
 296         assert(0);
 297         return E_FAIL;
 298     }
 299 }
 300
 301 static HRESULT exprval_propget(script_ctx_t *ctx, exprval_t *ref, jsval_t *r)
 302 {
 303     switch(ref->type) {
 304     case EXPRVAL_STACK_REF:
 305         return jsval_copy(ctx->stack[ref->u.off], r);
 306     case EXPRVAL_IDREF:
 307         return disp_propget(ctx, ref->u.idref.disp, ref->u.idref.id, r);
 308     default:
 309         assert(0);
 310         return E_FAIL;
 311     }
 312 }
 313
 314 static HRESULT exprval_call(script_ctx_t *ctx, exprval_t *ref, WORD flags, unsigned argc, jsval_t *argv, jsval_t *r)
 315 {
 316     switch(ref->type) {
 317     case EXPRVAL_STACK_REF: {
 318         jsval_t v = ctx->stack[ref->u.off];
 319
 320         if(!is_object_instance(v)) {
 321             FIXME("invoke %s\n", debugstr_jsval(v));
 322             return E_FAIL;
 323         }
 324
 325         return disp_call_value(ctx, get_object(v), NULL, flags, argc, argv, r);
 326     }
 327     case EXPRVAL_IDREF:
 328         return disp_call(ctx, ref->u.idref.disp, ref->u.idref.id, flags, argc, argv, r);
 329     default:
 330         assert(0);
 331         return E_FAIL;
 332     }
 333 }
 334
 335 /* ECMA-262 3rd Edition    8.7.1 */
 336 /* Steals input reference. */
 337 static HRESULT exprval_to_value(script_ctx_t *ctx, exprval_t *ref, jsval_t *r)
 338 {
 339     HRESULT hres;
 340
 341     if(ref->type == EXPRVAL_JSVAL) {
 342         *r = ref->u.val;
 343         return S_OK;
 344     }
 345
 346     hres = exprval_propget(ctx, ref, r);
 347
 348     if(ref->type == EXPRVAL_IDREF)
 349         IDispatch_Release(ref->u.idref.disp);
 350     return hres;
 351 }
 352
 353 static void exprval_release(exprval_t *val)
 354 {
 355     switch(val->type) {
 356     case EXPRVAL_JSVAL:
 357         jsval_release(val->u.val);
 358         return;
 359     case EXPRVAL_IDREF:
 360         if(val->u.idref.disp)
 361             IDispatch_Release(val->u.idref.disp);
 362         return;
 363     case EXPRVAL_STACK_REF:
 364     case EXPRVAL_INVALID:
 365         return;
 366     }
 367 }
 368
 369 static inline void exprval_set_exception(exprval_t *val, HRESULT hres)
 370 {
 371     val->type = EXPRVAL_INVALID;
 372     val->u.hres = hres;
 373 }
 374
 375 static inline void exprval_set_disp_ref(exprval_t *ref, IDispatch *obj, DISPID id)
 376 {
 377     ref->type = EXPRVAL_IDREF;
 378     IDispatch_AddRef(ref->u.idref.disp = obj);
 379     ref->u.idref.id = id;
 380 }
 381
 382 static inline jsval_t steal_ret(call_frame_t *frame)
 383 {
 384     jsval_t r = frame->ret;
 385     frame->ret = jsval_undefined();
 386     return r;
 387 }
 388
 389 static inline void clear_ret(call_frame_t *frame)
 390 {
 391     jsval_release(steal_ret(frame));
 392 }
 393
 394 static HRESULT scope_push(scope_chain_t *scope, jsdisp_t *jsobj, IDispatch *obj, scope_chain_t **ret)
 395 {
 396     scope_chain_t *new_scope;
 397
 398     new_scope = heap_alloc(sizeof(scope_chain_t));
 399     if(!new_scope)
 400         return E_OUTOFMEMORY;
 401
 402     new_scope->ref = 1;
 403
 404     IDispatch_AddRef(obj);
 405     new_scope->jsobj = jsobj;
 406     new_scope->obj = obj;
 407     new_scope->frame = NULL;
 408     new_scope->next = scope ? scope_addref(scope) : NULL;
 409
 410     *ret = new_scope;
 411     return S_OK;
 412 }
 413
 414 static void scope_pop(scope_chain_t **scope)
 415 {
 416     scope_chain_t *tmp;
 417
 418     tmp = *scope;
 419     *scope = tmp->next;
 420     scope_release(tmp);
 421 }
 422
 423 void clear_ei(script_ctx_t *ctx)
 424 {
 425     memset(&ctx->ei.ei, 0, sizeof(ctx->ei.ei));
 426     jsval_release(ctx->ei.val);
 427     ctx->ei.val = jsval_undefined();
 428 }
 429
 430 void scope_release(scope_chain_t *scope)
 431 {
 432     if(--scope->ref)
 433         return;
 434
 435     if(scope->next)
 436         scope_release(scope->next);
 437
 438     IDispatch_Release(scope->obj);
 439     heap_free(scope);
 440 }
 441
 442 static HRESULT disp_get_id(script_ctx_t *ctx, IDispatch *disp, const WCHAR *name, BSTR name_bstr, DWORD flags, DISPID *id)
 443 {
 444     IDispatchEx *dispex;
 445     jsdisp_t *jsdisp;
 446     BSTR bstr;
 447     HRESULT hres;
 448
 449     jsdisp = iface_to_jsdisp(disp);
 450     if(jsdisp) {
 451         hres = jsdisp_get_id(jsdisp, name, flags, id);
 452         jsdisp_release(jsdisp);
 453         return hres;
 454     }
 455
 456     if(name_bstr) {
 457         bstr = name_bstr;
 458     }else {
 459         bstr = SysAllocString(name);
 460         if(!bstr)
 461             return E_OUTOFMEMORY;
 462     }
 463
 464     *id = 0;
 465     hres = IDispatch_QueryInterface(disp, &IID_IDispatchEx, (void**)&dispex);
 466     if(SUCCEEDED(hres)) {
 467         hres = IDispatchEx_GetDispID(dispex, bstr, make_grfdex(ctx, flags|fdexNameCaseSensitive), id);
 468         IDispatchEx_Release(dispex);
 469     }else {
 470         TRACE("using IDispatch\n");
 471         hres = IDispatch_GetIDsOfNames(disp, &IID_NULL, &bstr, 1, 0, id);
 472     }
 473
 474     if(name_bstr != bstr)
 475         SysFreeString(bstr);
 476     return hres;
 477 }
 478
 479 static HRESULT disp_cmp(IDispatch *disp1, IDispatch *disp2, BOOL *ret)
 480 {
 481     IObjectIdentity *identity;
 482     IUnknown *unk1, *unk2;
 483     HRESULT hres;
 484
 485     if(disp1 == disp2) {
 486         *ret = TRUE;
 487         return S_OK;
 488     }
 489
 490     if(!disp1 || !disp2) {
 491         *ret = FALSE;
 492         return S_OK;
 493     }
 494
 495     hres = IDispatch_QueryInterface(disp1, &IID_IUnknown, (void**)&unk1);
 496     if(FAILED(hres))
 497         return hres;
 498
 499     hres = IDispatch_QueryInterface(disp2, &IID_IUnknown, (void**)&unk2);
 500     if(FAILED(hres)) {
 501         IUnknown_Release(unk1);
 502         return hres;
 503     }
 504
 505     if(unk1 == unk2) {
 506         *ret = TRUE;
 507     }else {
 508         hres = IUnknown_QueryInterface(unk1, &IID_IObjectIdentity, (void**)&identity);
 509         if(SUCCEEDED(hres)) {
 510             hres = IObjectIdentity_IsEqualObject(identity, unk2);
 511             IObjectIdentity_Release(identity);
 512             *ret = hres == S_OK;
 513         }else {
 514             *ret = FALSE;
 515         }
 516     }
 517
 518     IUnknown_Release(unk1);
 519     IUnknown_Release(unk2);
 520     return S_OK;
 521 }
 522
 523 /* ECMA-262 3rd Edition    11.9.6 */
 524 static HRESULT equal2_values(jsval_t lval, jsval_t rval, BOOL *ret)
 525 {
 526     jsval_type_t type = jsval_type(lval);
 527
 528     TRACE("\n");
 529
 530     if(type != jsval_type(rval)) {
 531         if(is_null_instance(lval))
 532             *ret = is_null_instance(rval);
 533         else
 534             *ret = FALSE;
 535         return S_OK;
 536     }
 537
 538     switch(type) {
 539     case JSV_UNDEFINED:
 540     case JSV_NULL:
 541         *ret = TRUE;
 542         break;
 543     case JSV_OBJECT:
 544         return disp_cmp(get_object(lval), get_object(rval), ret);
 545     case JSV_STRING:
 546         *ret = jsstr_eq(get_string(lval), get_string(rval));
 547         break;
 548     case JSV_NUMBER:
 549         *ret = get_number(lval) == get_number(rval);
 550         break;
 551     case JSV_BOOL:
 552         *ret = !get_bool(lval) == !get_bool(rval);
 553         break;
 554     case JSV_VARIANT:
 555         FIXME("VARIANT not implemented\n");
 556         return E_NOTIMPL;
 557     }
 558
 559     return S_OK;
 560 }
 561
 562 /*
 563  * Transfers local variables from stack to variable object.
 564  * It's slow, so we want to avoid it as much as possible.
 565  */
 566 static HRESULT detach_variable_object(script_ctx_t *ctx, call_frame_t *frame, BOOL from_release)
 567 {
 568     unsigned i;
 569     HRESULT hres;
 570
 571     if(!frame->base_scope || !frame->base_scope->frame)
 572         return S_OK;
 573
 574     TRACE("detaching %p\n", frame);
 575
 576     assert(frame == frame->base_scope->frame);
 577     assert(frame->variable_obj == frame->base_scope->jsobj);
 578
 579     if(!from_release && !frame->arguments_obj) {
 580         hres = setup_arguments_object(ctx, frame);
 581         if(FAILED(hres))
 582             return hres;
 583     }
 584
 585     frame->base_scope->frame = NULL;
 586
 587     for(i = 0; i < frame->function->locals_cnt; i++) {
 588         hres = jsdisp_propput_name(frame->variable_obj, frame->function->locals[i].name,
 589                                    ctx->stack[local_off(frame, frame->function->locals[i].ref)]);
 590         if(FAILED(hres))
 591             return hres;
 592     }
 593
 594     return S_OK;
 595 }
 596
 597 static BOOL lookup_global_members(script_ctx_t *ctx, BSTR identifier, exprval_t *ret)
 598 {
 599     named_item_t *item;
 600     DISPID id;
 601     HRESULT hres;
 602
 603     for(item = ctx->named_items; item; item = item->next) {
 604         if(item->flags & SCRIPTITEM_GLOBALMEMBERS) {
 605             hres = disp_get_id(ctx, item->disp, identifier, identifier, 0, &id);
 606             if(SUCCEEDED(hres)) {
 607                 if(ret)
 608                     exprval_set_disp_ref(ret, item->disp, id);
 609                 return TRUE;
 610             }
 611         }
 612     }
 613
 614     return FALSE;
 615 }
 616
 617 static int local_ref_cmp(const void *key, const void *ref)
 618 {
 619     return strcmpW((const WCHAR*)key, ((const local_ref_t*)ref)->name);
 620 }
 621
 622 local_ref_t *lookup_local(const function_code_t *function, const WCHAR *identifier)
 623 {
 624     return bsearch(identifier, function->locals, function->locals_cnt, sizeof(*function->locals), local_ref_cmp);
 625 }
 626
 627 /* ECMA-262 3rd Edition    10.1.4 */
 628 static HRESULT identifier_eval(script_ctx_t *ctx, BSTR identifier, exprval_t *ret)
 629 {
 630     scope_chain_t *scope;
 631     named_item_t *item;
 632     DISPID id = 0;
 633     HRESULT hres;
 634
 635     TRACE("%s\n", debugstr_w(identifier));
 636
 637     if(ctx->call_ctx) {
 638         for(scope = ctx->call_ctx->scope; scope; scope = scope->next) {
 639             if(scope->frame) {
 640                 function_code_t *func = scope->frame->function;
 641                 local_ref_t *ref = lookup_local(func, identifier);
 642                 static const WCHAR argumentsW[] = {'a','r','g','u','m','e','n','t','s',0};
 643
 644                 if(ref) {
 645                     ret->type = EXPRVAL_STACK_REF;
 646                     ret->u.off = local_off(scope->frame, ref->ref);
 647                     TRACE("returning ref %d for %d\n", ret->u.off, ref->ref);
 648                     return S_OK;
 649                 }
 650
 651                 if(!strcmpW(identifier, argumentsW)) {
 652                     hres = detach_variable_object(ctx, scope->frame, FALSE);
 653                     if(FAILED(hres))
 654                         return hres;
 655                 }
 656             }
 657             if(scope->jsobj)
 658                 hres = jsdisp_get_id(scope->jsobj, identifier, fdexNameImplicit, &id);
 659             else
 660                 hres = disp_get_id(ctx, scope->obj, identifier, identifier, fdexNameImplicit, &id);
 661             if(SUCCEEDED(hres)) {
 662                 exprval_set_disp_ref(ret, scope->obj, id);
 663                 return S_OK;
 664             }
 665         }
 666     }
 667
 668     hres = jsdisp_get_id(ctx->global, identifier, 0, &id);
 669     if(SUCCEEDED(hres)) {
 670         exprval_set_disp_ref(ret, to_disp(ctx->global), id);
 671         return S_OK;
 672     }
 673
 674     for(item = ctx->named_items; item; item = item->next) {
 675         if((item->flags & SCRIPTITEM_ISVISIBLE) && !strcmpW(item->name, identifier)) {
 676             if(!item->disp) {
 677                 IUnknown *unk;
 678
 679                 if(!ctx->site)
 680                     break;
 681
 682                 hres = IActiveScriptSite_GetItemInfo(ctx->site, identifier,
 683                                                      SCRIPTINFO_IUNKNOWN, &unk, NULL);
 684                 if(FAILED(hres)) {
 685                     WARN("GetItemInfo failed: %08x\n", hres);
 686                     break;
 687                 }
 688
 689                 hres = IUnknown_QueryInterface(unk, &IID_IDispatch, (void**)&item->disp);
 690                 IUnknown_Release(unk);
 691                 if(FAILED(hres)) {
 692                     WARN("object does not implement IDispatch\n");
 693                     break;
 694                 }
 695             }
 696
 697             IDispatch_AddRef(item->disp);
 698             ret->type = EXPRVAL_JSVAL;
 699             ret->u.val = jsval_disp(item->disp);
 700             return S_OK;
 701         }
 702     }
 703
 704     if(lookup_global_members(ctx, identifier, ret))
 705         return S_OK;
 706
 707     exprval_set_exception(ret, JS_E_UNDEFINED_VARIABLE);
 708     return S_OK;
 709 }
 710
 711 static inline BSTR get_op_bstr(script_ctx_t *ctx, int i)
 712 {
 713     call_frame_t *frame = ctx->call_ctx;
 714     return frame->bytecode->instrs[frame->ip].u.arg[i].bstr;
 715 }
 716
 717 static inline unsigned get_op_uint(script_ctx_t *ctx, int i)
 718 {
 719     call_frame_t *frame = ctx->call_ctx;
 720     return frame->bytecode->instrs[frame->ip].u.arg[i].uint;
 721 }
 722
 723 static inline unsigned get_op_int(script_ctx_t *ctx, int i)
 724 {
 725     call_frame_t *frame = ctx->call_ctx;
 726     return frame->bytecode->instrs[frame->ip].u.arg[i].lng;
 727 }
 728
 729 static inline jsstr_t *get_op_str(script_ctx_t *ctx, int i)
 730 {
 731     call_frame_t *frame = ctx->call_ctx;
 732     return frame->bytecode->instrs[frame->ip].u.arg[i].str;
 733 }
 734
 735 static inline double get_op_double(script_ctx_t *ctx)
 736 {
 737     call_frame_t *frame = ctx->call_ctx;
 738     return frame->bytecode->instrs[frame->ip].u.dbl;
 739 }
 740
 741 static inline void jmp_next(script_ctx_t *ctx)
 742 {
 743     ctx->call_ctx->ip++;
 744 }
 745
 746 static inline void jmp_abs(script_ctx_t *ctx, unsigned dst)
 747 {
 748     ctx->call_ctx->ip = dst;
 749 }
 750
 751 /* ECMA-262 3rd Edition    12.6.4 */
 752 static HRESULT interp_forin(script_ctx_t *ctx)
 753 {
 754     const HRESULT arg = get_op_uint(ctx, 0);
 755     IDispatch *obj = NULL;
 756     IDispatchEx *dispex;
 757     exprval_t prop_ref;
 758     DISPID id;
 759     BSTR name = NULL;
 760     HRESULT hres;
 761
 762     TRACE("\n");
 763
 764     assert(is_number(stack_top(ctx)));
 765     id = get_number(stack_top(ctx));
 766
 767     if(!stack_topn_exprval(ctx, 1, &prop_ref)) {
 768         FIXME("invalid ref: %08x\n", prop_ref.u.hres);
 769         return E_FAIL;
 770     }
 771
 772     if(is_object_instance(stack_topn(ctx, 3)))
 773         obj = get_object(stack_topn(ctx, 3));
 774
 775     if(obj) {
 776         hres = IDispatch_QueryInterface(obj, &IID_IDispatchEx, (void**)&dispex);
 777         if(SUCCEEDED(hres)) {
 778             hres = IDispatchEx_GetNextDispID(dispex, fdexEnumDefault, id, &id);
 779             if(hres == S_OK)
 780                 hres = IDispatchEx_GetMemberName(dispex, id, &name);
 781             IDispatchEx_Release(dispex);
 782             if(FAILED(hres))
 783                 return hres;
 784         }else {
 785             TRACE("No IDispatchEx\n");
 786         }
 787     }
 788
 789     if(name) {
 790         jsstr_t *str;
 791
 792         str = jsstr_alloc_len(name, SysStringLen(name));
 793         SysFreeString(name);
 794         if(!str)
 795             return E_OUTOFMEMORY;
 796
 797         stack_pop(ctx);
 798         stack_push(ctx, jsval_number(id)); /* safe, just after pop() */
 799
 800         hres = exprval_propput(ctx, &prop_ref, jsval_string(str));
 801         jsstr_release(str);
 802         if(FAILED(hres))
 803             return hres;
 804
 805         jmp_next(ctx);
 806     }else {
 807         stack_popn(ctx, 4);
 808         jmp_abs(ctx, arg);
 809     }
 810     return S_OK;
 811 }
 812
 813 /* ECMA-262 3rd Edition    12.10 */
 814 static HRESULT interp_push_scope(script_ctx_t *ctx)
 815 {
 816     IDispatch *disp;
 817     jsval_t v;
 818     HRESULT hres;
 819
 820     TRACE("\n");
 821
 822     v = stack_pop(ctx);
 823     hres = to_object(ctx, v, &disp);
 824     jsval_release(v);
 825     if(FAILED(hres))
 826         return hres;
 827
 828     hres = scope_push(ctx->call_ctx->scope, to_jsdisp(disp), disp, &ctx->call_ctx->scope);
 829     IDispatch_Release(disp);
 830     return hres;
 831 }
 832
 833 /* ECMA-262 3rd Edition    12.10 */
 834 static HRESULT interp_pop_scope(script_ctx_t *ctx)
 835 {
 836     TRACE("\n");
 837
 838     scope_pop(&ctx->call_ctx->scope);
 839     return S_OK;
 840 }
 841
 842 /* ECMA-262 3rd Edition    12.13 */
 843 static HRESULT interp_case(script_ctx_t *ctx)
 844 {
 845     const unsigned arg = get_op_uint(ctx, 0);
 846     jsval_t v;
 847     BOOL b;
 848     HRESULT hres;
 849
 850     TRACE("\n");
 851
 852     v = stack_pop(ctx);
 853     hres = equal2_values(stack_top(ctx), v, &b);
 854     jsval_release(v);
 855     if(FAILED(hres))
 856         return hres;
 857
 858     if(b) {
 859         stack_popn(ctx, 1);
 860         jmp_abs(ctx, arg);
 861     }else {
 862         jmp_next(ctx);
 863     }
 864     return S_OK;
 865 }
 866
 867 /* ECMA-262 3rd Edition    12.13 */
 868 static HRESULT interp_throw(script_ctx_t *ctx)
 869 {
 870     TRACE("\n");
 871
 872     jsval_release(ctx->ei.val);
 873     ctx->ei.val = stack_pop(ctx);
 874     return DISP_E_EXCEPTION;
 875 }
 876
 877 static HRESULT interp_throw_ref(script_ctx_t *ctx)
 878 {
 879     const HRESULT arg = get_op_uint(ctx, 0);
 880
 881     TRACE("%08x\n", arg);
 882
 883     return throw_reference_error(ctx, arg, NULL);
 884 }
 885
 886 static HRESULT interp_throw_type(script_ctx_t *ctx)
 887 {
 888     const HRESULT hres = get_op_uint(ctx, 0);
 889     jsstr_t *str = get_op_str(ctx, 1);
 890     const WCHAR *ptr;
 891
 892     TRACE("%08x %s\n", hres, debugstr_jsstr(str));
 893
 894     ptr = jsstr_flatten(str);
 895     return ptr ? throw_type_error(ctx, hres, ptr) : E_OUTOFMEMORY;
 896 }
 897
 898 /* ECMA-262 3rd Edition    12.14 */
 899 static HRESULT interp_push_except(script_ctx_t *ctx)
 900 {
 901     const unsigned catch_off = get_op_uint(ctx, 0);
 902     const unsigned finally_off = get_op_uint(ctx, 1);
 903     call_frame_t *frame = ctx->call_ctx;
 904     except_frame_t *except;
 905
 906     TRACE("\n");
 907
 908     except = heap_alloc(sizeof(*except));
 909     if(!except)
 910         return E_OUTOFMEMORY;
 911
 912     except->stack_top = ctx->stack_top;
 913     except->scope = frame->scope;
 914     except->catch_off = catch_off;
 915     except->finally_off = finally_off;
 916     except->next = frame->except_frame;
 917     frame->except_frame = except;
 918     return S_OK;
 919 }
 920
 921 /* ECMA-262 3rd Edition    12.14 */
 922 static HRESULT interp_pop_except(script_ctx_t *ctx)
 923 {
 924     const unsigned ret_off = get_op_uint(ctx, 0);
 925     call_frame_t *frame = ctx->call_ctx;
 926     except_frame_t *except;
 927     unsigned finally_off;
 928
 929     TRACE("%u\n", ret_off);
 930
 931     except = frame->except_frame;
 932     assert(except != NULL);
 933
 934     finally_off = except->finally_off;
 935     frame->except_frame = except->next;
 936     heap_free(except);
 937
 938     if(finally_off) {
 939         HRESULT hres;
 940
 941         hres = stack_push(ctx, jsval_number(ret_off));
 942         if(FAILED(hres))
 943             return hres;
 944         hres = stack_push(ctx, jsval_bool(TRUE));
 945         if(FAILED(hres))
 946             return hres;
 947         frame->ip = finally_off;
 948     }else {
 949         frame->ip = ret_off;
 950     }
 951
 952     return S_OK;
 953 }
 954
 955 /* ECMA-262 3rd Edition    12.14 */
 956 static HRESULT interp_end_finally(script_ctx_t *ctx)
 957 {
 958     call_frame_t *frame = ctx->call_ctx;
 959     jsval_t v;
 960
 961     TRACE("\n");
 962
 963     v = stack_pop(ctx);
 964     assert(is_bool(v));
 965
 966     if(!get_bool(v)) {
 967         TRACE("passing exception\n");
 968
 969         ctx->ei.val = stack_pop(ctx);
 970         return DISP_E_EXCEPTION;
 971     }
 972
 973     v = stack_pop(ctx);
 974     assert(is_number(v));
 975     frame->ip = get_number(v);
 976     return S_OK;
 977 }
 978
 979 static HRESULT interp_enter_catch(script_ctx_t *ctx)
 980 {
 981     const BSTR ident = get_op_bstr(ctx, 0);
 982     jsdisp_t *scope_obj;
 983     jsval_t v;
 984     HRESULT hres;
 985
 986     hres = create_dispex(ctx, NULL, NULL, &scope_obj);
 987     if(FAILED(hres))
 988         return hres;
 989
 990     v = stack_pop(ctx);
 991     hres = jsdisp_propput_name(scope_obj, ident, v);
 992     jsval_release(v);
 993     if(SUCCEEDED(hres))
 994         hres = scope_push(ctx->call_ctx->scope, scope_obj, to_disp(scope_obj), &ctx->call_ctx->scope);
 995     jsdisp_release(scope_obj);
 996     return hres;
 997 }
 998
 999 /* ECMA-262 3rd Edition    13 */
1000 static HRESULT interp_func(script_ctx_t *ctx)
1001 {
1002     unsigned func_idx = get_op_uint(ctx, 0);
1003     call_frame_t *frame = ctx->call_ctx;
1004     jsdisp_t *dispex;
1005     HRESULT hres;
1006
1007     TRACE("%d\n", func_idx);
1008
1009     hres = create_source_function(ctx, frame->bytecode, frame->function->funcs+func_idx,
1010             frame->scope, &dispex);
1011     if(FAILED(hres))
1012         return hres;
1013
1014     return stack_push(ctx, jsval_obj(dispex));
1015 }
1016
1017 /* ECMA-262 3rd Edition    11.2.1 */
1018 static HRESULT interp_array(script_ctx_t *ctx)
1019 {
1020     jsstr_t *name_str;
1021     const WCHAR *name;
1022     jsval_t v, namev;
1023     IDispatch *obj;
1024     DISPID id;
1025     HRESULT hres;
1026
1027     TRACE("\n");
1028
1029     namev = stack_pop(ctx);
1030
1031     hres = stack_pop_object(ctx, &obj);
1032     if(FAILED(hres)) {
1033         jsval_release(namev);
1034         return hres;
1035     }
1036
1037     hres = to_flat_string(ctx, namev, &name_str, &name);
1038     jsval_release(namev);
1039     if(FAILED(hres)) {
1040         IDispatch_Release(obj);
1041         return hres;
1042     }
1043
1044     hres = disp_get_id(ctx, obj, name, NULL, 0, &id);
1045     jsstr_release(name_str);
1046     if(SUCCEEDED(hres)) {
1047         hres = disp_propget(ctx, obj, id, &v);
1048     }else if(hres == DISP_E_UNKNOWNNAME) {
1049         v = jsval_undefined();
1050         hres = S_OK;
1051     }
1052     IDispatch_Release(obj);
1053     if(FAILED(hres))
1054         return hres;
1055
1056     return stack_push(ctx, v);
1057 }
1058
1059 /* ECMA-262 3rd Edition    11.2.1 */
1060 static HRESULT interp_member(script_ctx_t *ctx)
1061 {
1062     const BSTR arg = get_op_bstr(ctx, 0);
1063     IDispatch *obj;
1064     jsval_t v;
1065     DISPID id;
1066     HRESULT hres;
1067
1068     TRACE("\n");
1069
1070     hres = stack_pop_object(ctx, &obj);
1071     if(FAILED(hres))
1072         return hres;
1073
1074     hres = disp_get_id(ctx, obj, arg, arg, 0, &id);
1075     if(SUCCEEDED(hres)) {
1076         hres = disp_propget(ctx, obj, id, &v);
1077     }else if(hres == DISP_E_UNKNOWNNAME) {
1078         v = jsval_undefined();
1079         hres = S_OK;
1080     }
1081     IDispatch_Release(obj);
1082     if(FAILED(hres))
1083         return hres;
1084
1085     return stack_push(ctx, v);
1086 }
1087
1088 /* ECMA-262 3rd Edition    11.2.1 */
1089 static HRESULT interp_memberid(script_ctx_t *ctx)
1090 {
1091     const unsigned arg = get_op_uint(ctx, 0);
1092     jsval_t objv, namev;
1093     const WCHAR *name;
1094     jsstr_t *name_str;
1095     IDispatch *obj;
1096     exprval_t ref;
1097     DISPID id;
1098     HRESULT hres;
1099
1100     TRACE("%x\n", arg);
1101
1102     namev = stack_pop(ctx);
1103     objv = stack_pop(ctx);
1104
1105     hres = to_object(ctx, objv, &obj);
1106     jsval_release(objv);
1107     if(SUCCEEDED(hres)) {
1108         hres = to_flat_string(ctx, namev, &name_str, &name);
1109         if(FAILED(hres))
1110             IDispatch_Release(obj);
1111     }
1112     jsval_release(namev);
1113     if(FAILED(hres))
1114         return hres;
1115
1116     hres = disp_get_id(ctx, obj, name, NULL, arg, &id);
1117     jsstr_release(name_str);
1118     if(SUCCEEDED(hres)) {
1119         ref.type = EXPRVAL_IDREF;
1120         ref.u.idref.disp = obj;
1121         ref.u.idref.id = id;
1122     }else {
1123         IDispatch_Release(obj);
1124         if(hres == DISP_E_UNKNOWNNAME && !(arg & fdexNameEnsure)) {
1125             exprval_set_exception(&ref, JS_E_INVALID_PROPERTY);
1126             hres = S_OK;
1127         }else {
1128             ERR("failed %08x\n", hres);
1129             return hres;
1130         }
1131     }
1132
1133     return stack_push_exprval(ctx, &ref);
1134 }
1135
1136 /* ECMA-262 3rd Edition    11.2.1 */
1137 static HRESULT interp_refval(script_ctx_t *ctx)
1138 {
1139     exprval_t ref;
1140     jsval_t v;
1141     HRESULT hres;
1142
1143     TRACE("\n");
1144
1145     if(!stack_topn_exprval(ctx, 0, &ref))
1146         return throw_reference_error(ctx, JS_E_ILLEGAL_ASSIGN, NULL);
1147
1148     hres = exprval_propget(ctx, &ref, &v);
1149     if(FAILED(hres))
1150         return hres;
1151
1152     return stack_push(ctx, v);
1153 }
1154
1155 /* ECMA-262 3rd Edition    11.2.2 */
1156 static HRESULT interp_new(script_ctx_t *ctx)
1157 {
1158     const unsigned argc = get_op_uint(ctx, 0);
1159     call_frame_t *frame = ctx->call_ctx;
1160     jsval_t constr;
1161
1162     TRACE("%d\n", argc);
1163
1164     constr = stack_topn(ctx, argc);
1165
1166     /* NOTE: Should use to_object here */
1167
1168     if(is_null(constr))
1169         return throw_type_error(ctx, JS_E_OBJECT_EXPECTED, NULL);
1170     else if(!is_object_instance(constr))
1171         return throw_type_error(ctx, JS_E_INVALID_ACTION, NULL);
1172     else if(!get_object(constr))
1173         return throw_type_error(ctx, JS_E_INVALID_PROPERTY, NULL);
1174
1175     clear_ret(frame);
1176     return disp_call_value(ctx, get_object(constr), NULL, DISPATCH_CONSTRUCT | DISPATCH_JSCRIPT_CALLEREXECSSOURCE,
1177                            argc, stack_args(ctx, argc), &frame->ret);
1178 }
1179
1180 /* ECMA-262 3rd Edition    11.2.3 */
1181 static HRESULT interp_call(script_ctx_t *ctx)
1182 {
1183     const unsigned argn = get_op_uint(ctx, 0);
1184     const int do_ret = get_op_int(ctx, 1);
1185     call_frame_t *frame = ctx->call_ctx;
1186     jsval_t obj;
1187
1188     TRACE("%d %d\n", argn, do_ret);
1189
1190     obj = stack_topn(ctx, argn);
1191     if(!is_object_instance(obj))
1192         return throw_type_error(ctx, JS_E_INVALID_PROPERTY, NULL);
1193
1194     clear_ret(frame);
1195     return disp_call_value(ctx, get_object(obj), NULL, DISPATCH_METHOD | DISPATCH_JSCRIPT_CALLEREXECSSOURCE,
1196                            argn, stack_args(ctx, argn), do_ret ? &frame->ret : NULL);
1197 }
1198
1199 /* ECMA-262 3rd Edition    11.2.3 */
1200 static HRESULT interp_call_member(script_ctx_t *ctx)
1201 {
1202     const unsigned argn = get_op_uint(ctx, 0);
1203     const int do_ret = get_op_int(ctx, 1);
1204     call_frame_t *frame = ctx->call_ctx;
1205     exprval_t ref;
1206
1207     TRACE("%d %d\n", argn, do_ret);
1208
1209     if(!stack_topn_exprval(ctx, argn, &ref))
1210         return throw_type_error(ctx, ref.u.hres, NULL);
1211
1212     clear_ret(frame);
1213     return exprval_call(ctx, &ref, DISPATCH_METHOD | DISPATCH_JSCRIPT_CALLEREXECSSOURCE,
1214             argn, stack_args(ctx, argn), do_ret ? &frame->ret : NULL);
1215 }
1216
1217 /* ECMA-262 3rd Edition    11.1.1 */
1218 static HRESULT interp_this(script_ctx_t *ctx)
1219 {
1220     call_frame_t *frame = ctx->call_ctx;
1221
1222     TRACE("\n");
1223
1224     IDispatch_AddRef(frame->this_obj);
1225     return stack_push(ctx, jsval_disp(frame->this_obj));
1226 }
1227
1228 static HRESULT interp_identifier_ref(script_ctx_t *ctx, BSTR identifier, unsigned flags)
1229 {
1230     exprval_t exprval;
1231     HRESULT hres;
1232
1233     hres = identifier_eval(ctx, identifier, &exprval);
1234     if(FAILED(hres))
1235         return hres;
1236
1237     if(exprval.type == EXPRVAL_INVALID && (flags & fdexNameEnsure)) {
1238         DISPID id;
1239
1240         hres = jsdisp_get_id(ctx->global, identifier, fdexNameEnsure, &id);
1241         if(FAILED(hres))
1242             return hres;
1243
1244         exprval_set_disp_ref(&exprval, to_disp(ctx->global), id);
1245     }
1246
1247     if(exprval.type == EXPRVAL_JSVAL || exprval.type == EXPRVAL_INVALID) {
1248         WARN("invalid ref\n");
1249         exprval_release(&exprval);
1250         exprval_set_exception(&exprval, JS_E_OBJECT_EXPECTED);
1251     }
1252
1253     return stack_push_exprval(ctx, &exprval);
1254 }
1255
1256 static HRESULT identifier_value(script_ctx_t *ctx, BSTR identifier)
1257 {
1258     exprval_t exprval;
1259     jsval_t v;
1260     HRESULT hres;
1261
1262     hres = identifier_eval(ctx, identifier, &exprval);
1263     if(FAILED(hres))
1264         return hres;
1265
1266     if(exprval.type == EXPRVAL_INVALID)
1267         return throw_type_error(ctx, exprval.u.hres, identifier);
1268
1269     hres = exprval_to_value(ctx, &exprval, &v);
1270     if(FAILED(hres))
1271         return hres;
1272
1273     return stack_push(ctx, v);
1274 }
1275
1276 static HRESULT interp_local_ref(script_ctx_t *ctx)
1277 {
1278     const int arg = get_op_int(ctx, 0);
1279     const unsigned flags = get_op_uint(ctx, 1);
1280     call_frame_t *frame = ctx->call_ctx;
1281     exprval_t ref;
1282
1283     TRACE("%d\n", arg);
1284
1285     if(!frame->base_scope || !frame->base_scope->frame)
1286         return interp_identifier_ref(ctx, local_name(frame, arg), flags);
1287
1288     ref.type = EXPRVAL_STACK_REF;
1289     ref.u.off = local_off(frame, arg);
1290     return stack_push_exprval(ctx, &ref);
1291 }
1292
1293 static HRESULT interp_local(script_ctx_t *ctx)
1294 {
1295     const int arg = get_op_int(ctx, 0);
1296     call_frame_t *frame = ctx->call_ctx;
1297     jsval_t copy;
1298     HRESULT hres;
1299
1300     TRACE("%d\n", arg);
1301
1302     if(!frame->base_scope || !frame->base_scope->frame)
1303         return identifier_value(ctx, local_name(frame, arg));
1304
1305     hres = jsval_copy(ctx->stack[local_off(frame, arg)], &copy);
1306     if(FAILED(hres))
1307         return hres;
1308
1309     return stack_push(ctx, copy);
1310 }
1311
1312 /* ECMA-262 3rd Edition    10.1.4 */
1313 static HRESULT interp_ident(script_ctx_t *ctx)
1314 {
1315     const BSTR arg = get_op_bstr(ctx, 0);
1316
1317     TRACE("%s\n", debugstr_w(arg));
1318
1319     return identifier_value(ctx, arg);
1320 }
1321
1322 /* ECMA-262 3rd Edition    10.1.4 */
1323 static HRESULT interp_identid(script_ctx_t *ctx)
1324 {
1325     const BSTR arg = get_op_bstr(ctx, 0);
1326     const unsigned flags = get_op_uint(ctx, 1);
1327
1328     TRACE("%s %x\n", debugstr_w(arg), flags);
1329
1330     return interp_identifier_ref(ctx, arg, flags);
1331 }
1332
1333 /* ECMA-262 3rd Edition    7.8.1 */
1334 static HRESULT interp_null(script_ctx_t *ctx)
1335 {
1336     TRACE("\n");
1337
1338     return stack_push(ctx, jsval_null());
1339 }
1340
1341 /* ECMA-262 3rd Edition    7.8.2 */
1342 static HRESULT interp_bool(script_ctx_t *ctx)
1343 {
1344     const int arg = get_op_int(ctx, 0);
1345
1346     TRACE("%s\n", arg ? "true" : "false");
1347
1348     return stack_push(ctx, jsval_bool(arg));
1349 }
1350
1351 /* ECMA-262 3rd Edition    7.8.3 */
1352 static HRESULT interp_int(script_ctx_t *ctx)
1353 {
1354     const int arg = get_op_int(ctx, 0);
1355
1356     TRACE("%d\n", arg);
1357
1358     return stack_push(ctx, jsval_number(arg));
1359 }
1360
1361 /* ECMA-262 3rd Edition    7.8.3 */
1362 static HRESULT interp_double(script_ctx_t *ctx)
1363 {
1364     const double arg = get_op_double(ctx);
1365
1366     TRACE("%lf\n", arg);
1367
1368     return stack_push(ctx, jsval_number(arg));
1369 }
1370
1371 /* ECMA-262 3rd Edition    7.8.4 */
1372 static HRESULT interp_str(script_ctx_t *ctx)
1373 {
1374     jsstr_t *str = get_op_str(ctx, 0);
1375
1376     TRACE("%s\n", debugstr_jsstr(str));
1377
1378     return stack_push(ctx, jsval_string(jsstr_addref(str)));
1379 }
1380
1381 /* ECMA-262 3rd Edition    7.8 */
1382 static HRESULT interp_regexp(script_ctx_t *ctx)
1383 {
1384     jsstr_t *source = get_op_str(ctx, 0);
1385     const unsigned flags = get_op_uint(ctx, 1);
1386     jsdisp_t *regexp;
1387     HRESULT hres;
1388
1389     TRACE("%s %x\n", debugstr_jsstr(source), flags);
1390
1391     hres = create_regexp(ctx, source, flags, &regexp);
1392     if(FAILED(hres))
1393         return hres;
1394
1395     return stack_push(ctx, jsval_obj(regexp));
1396 }
1397
1398 /* ECMA-262 3rd Edition    11.1.4 */
1399 static HRESULT interp_carray(script_ctx_t *ctx)
1400 {
1401     const unsigned arg = get_op_uint(ctx, 0);
1402     jsdisp_t *array;
1403     jsval_t val;
1404     unsigned i;
1405     HRESULT hres;
1406
1407     TRACE("%u\n", arg);
1408
1409     hres = create_array(ctx, arg, &array);
1410     if(FAILED(hres))
1411         return hres;
1412
1413     i = arg;
1414     while(i--) {
1415         val = stack_pop(ctx);
1416         hres = jsdisp_propput_idx(array, i, val);
1417         jsval_release(val);
1418         if(FAILED(hres)) {
1419             jsdisp_release(array);
1420             return hres;
1421         }
1422     }
1423
1424     return stack_push(ctx, jsval_obj(array));
1425 }
1426
1427 /* ECMA-262 3rd Edition    11.1.5 */
1428 static HRESULT interp_new_obj(script_ctx_t *ctx)
1429 {
1430     jsdisp_t *obj;
1431     HRESULT hres;
1432
1433     TRACE("\n");
1434
1435     hres = create_object(ctx, NULL, &obj);
1436     if(FAILED(hres))
1437         return hres;
1438
1439     return stack_push(ctx, jsval_obj(obj));
1440 }
1441
1442 /* ECMA-262 3rd Edition    11.1.5 */
1443 static HRESULT interp_obj_prop(script_ctx_t *ctx)
1444 {
1445     const BSTR name = get_op_bstr(ctx, 0);
1446     jsdisp_t *obj;
1447     jsval_t val;
1448     HRESULT hres;
1449
1450     TRACE("%s\n", debugstr_w(name));
1451
1452     val = stack_pop(ctx);
1453
1454     assert(is_object_instance(stack_top(ctx)));
1455     obj = as_jsdisp(get_object(stack_top(ctx)));
1456
1457     hres = jsdisp_propput_name(obj, name, val);
1458     jsval_release(val);
1459     return hres;
1460 }
1461
1462 /* ECMA-262 3rd Edition    11.11 */
1463 static HRESULT interp_cnd_nz(script_ctx_t *ctx)
1464 {
1465     const unsigned arg = get_op_uint(ctx, 0);
1466     BOOL b;
1467     HRESULT hres;
1468
1469     TRACE("\n");
1470
1471     hres = to_boolean(stack_top(ctx), &b);
1472     if(FAILED(hres))
1473         return hres;
1474
1475     if(b) {
1476         jmp_abs(ctx, arg);
1477     }else {
1478         stack_popn(ctx, 1);
1479         jmp_next(ctx);
1480     }
1481     return S_OK;
1482 }
1483
1484 /* ECMA-262 3rd Edition    11.11 */
1485 static HRESULT interp_cnd_z(script_ctx_t *ctx)
1486 {
1487     const unsigned arg = get_op_uint(ctx, 0);
1488     BOOL b;
1489     HRESULT hres;
1490
1491     TRACE("\n");
1492
1493     hres = to_boolean(stack_top(ctx), &b);
1494     if(FAILED(hres))
1495         return hres;
1496
1497     if(b) {
1498         stack_popn(ctx, 1);
1499         jmp_next(ctx);
1500     }else {
1501         jmp_abs(ctx, arg);
1502     }
1503     return S_OK;
1504 }
1505
1506 /* ECMA-262 3rd Edition    11.10 */
1507 static HRESULT interp_or(script_ctx_t *ctx)
1508 {
1509     INT l, r;
1510     HRESULT hres;
1511
1512     TRACE("\n");
1513
1514     hres = stack_pop_int(ctx, &r);
1515     if(FAILED(hres))
1516         return hres;
1517
1518     hres = stack_pop_int(ctx, &l);
1519     if(FAILED(hres))
1520         return hres;
1521
1522     return stack_push(ctx, jsval_number(l|r));
1523 }
1524
1525 /* ECMA-262 3rd Edition    11.10 */
1526 static HRESULT interp_xor(script_ctx_t *ctx)
1527 {
1528     INT l, r;
1529     HRESULT hres;
1530
1531     TRACE("\n");
1532
1533     hres = stack_pop_int(ctx, &r);
1534     if(FAILED(hres))
1535         return hres;
1536
1537     hres = stack_pop_int(ctx, &l);
1538     if(FAILED(hres))
1539         return hres;
1540
1541     return stack_push(ctx, jsval_number(l^r));
1542 }
1543
1544 /* ECMA-262 3rd Edition    11.10 */
1545 static HRESULT interp_and(script_ctx_t *ctx)
1546 {
1547     INT l, r;
1548     HRESULT hres;
1549
1550     TRACE("\n");
1551
1552     hres = stack_pop_int(ctx, &r);
1553     if(FAILED(hres))
1554         return hres;
1555
1556     hres = stack_pop_int(ctx, &l);
1557     if(FAILED(hres))
1558         return hres;
1559
1560     return stack_push(ctx, jsval_number(l&r));
1561 }
1562
1563 /* ECMA-262 3rd Edition    11.8.6 */
1564 static HRESULT interp_instanceof(script_ctx_t *ctx)
1565 {
1566     jsdisp_t *obj, *iter, *tmp = NULL;
1567     jsval_t prot, v;
1568     BOOL ret = FALSE;
1569     HRESULT hres;
1570
1571     static const WCHAR prototypeW[] = {'p','r','o','t','o','t', 'y', 'p','e',0};
1572
1573     v = stack_pop(ctx);
1574     if(!is_object_instance(v) || !get_object(v)) {
1575         jsval_release(v);
1576         return throw_type_error(ctx, JS_E_FUNCTION_EXPECTED, NULL);
1577     }
1578
1579     obj = iface_to_jsdisp(get_object(v));
1580     IDispatch_Release(get_object(v));
1581     if(!obj) {
1582         FIXME("non-jsdisp objects not supported\n");
1583         return E_FAIL;
1584     }
1585
1586     if(is_class(obj, JSCLASS_FUNCTION)) {
1587         hres = jsdisp_propget_name(obj, prototypeW, &prot);
1588     }else {
1589         hres = throw_type_error(ctx, JS_E_FUNCTION_EXPECTED, NULL);
1590     }
1591     jsdisp_release(obj);
1592     if(FAILED(hres))
1593         return hres;
1594
1595     v = stack_pop(ctx);
1596
1597     if(is_object_instance(prot)) {
1598         if(is_object_instance(v))
1599             tmp = iface_to_jsdisp(get_object(v));
1600         for(iter = tmp; !ret && iter; iter = iter->prototype) {
1601             hres = disp_cmp(get_object(prot), to_disp(iter), &ret);
1602             if(FAILED(hres))
1603                 break;
1604         }
1605
1606         if(tmp)
1607             jsdisp_release(tmp);
1608     }else {
1609         FIXME("prototype is not an object\n");
1610         hres = E_FAIL;
1611     }
1612
1613     jsval_release(prot);
1614     jsval_release(v);
1615     if(FAILED(hres))
1616         return hres;
1617
1618     return stack_push(ctx, jsval_bool(ret));
1619 }
1620
1621 /* ECMA-262 3rd Edition    11.8.7 */
1622 static HRESULT interp_in(script_ctx_t *ctx)
1623 {
1624     const WCHAR *str;
1625     jsstr_t *jsstr;
1626     jsval_t obj, v;
1627     DISPID id = 0;
1628     BOOL ret;
1629     HRESULT hres;
1630
1631     TRACE("\n");
1632
1633     obj = stack_pop(ctx);
1634     if(!is_object_instance(obj) || !get_object(obj)) {
1635         jsval_release(obj);
1636         return throw_type_error(ctx, JS_E_OBJECT_EXPECTED, NULL);
1637     }
1638
1639     v = stack_pop(ctx);
1640     hres = to_flat_string(ctx, v, &jsstr, &str);
1641     jsval_release(v);
1642     if(FAILED(hres)) {
1643         IDispatch_Release(get_object(obj));
1644         return hres;
1645     }
1646
1647     hres = disp_get_id(ctx, get_object(obj), str, NULL, 0, &id);
1648     IDispatch_Release(get_object(obj));
1649     jsstr_release(jsstr);
1650     if(SUCCEEDED(hres))
1651         ret = TRUE;
1652     else if(hres == DISP_E_UNKNOWNNAME)
1653         ret = FALSE;
1654     else
1655         return hres;
1656
1657     return stack_push(ctx, jsval_bool(ret));
1658 }
1659
1660 /* ECMA-262 3rd Edition    11.6.1 */
1661 static HRESULT add_eval(script_ctx_t *ctx, jsval_t lval, jsval_t rval, jsval_t *ret)
1662 {
1663     jsval_t r, l;
1664     HRESULT hres;
1665
1666     hres = to_primitive(ctx, lval, &l, NO_HINT);
1667     if(FAILED(hres))
1668         return hres;
1669
1670     hres = to_primitive(ctx, rval, &r, NO_HINT);
1671     if(FAILED(hres)) {
1672         jsval_release(l);
1673         return hres;
1674     }
1675
1676     if(is_string(l) || is_string(r)) {
1677         jsstr_t *lstr, *rstr = NULL;
1678
1679         hres = to_string(ctx, l, &lstr);
1680         if(SUCCEEDED(hres))
1681             hres = to_string(ctx, r, &rstr);
1682
1683         if(SUCCEEDED(hres)) {
1684             jsstr_t *ret_str;
1685
1686             ret_str = jsstr_concat(lstr, rstr);
1687             if(ret_str)
1688                 *ret = jsval_string(ret_str);
1689             else
1690                 hres = E_OUTOFMEMORY;
1691         }
1692
1693         jsstr_release(lstr);
1694         if(rstr)
1695             jsstr_release(rstr);
1696     }else {
1697         double nl, nr;
1698
1699         hres = to_number(ctx, l, &nl);
1700         if(SUCCEEDED(hres)) {
1701             hres = to_number(ctx, r, &nr);
1702             if(SUCCEEDED(hres))
1703                 *ret = jsval_number(nl+nr);
1704         }
1705     }
1706
1707     jsval_release(r);
1708     jsval_release(l);
1709     return hres;
1710 }
1711
1712 /* ECMA-262 3rd Edition    11.6.1 */
1713 static HRESULT interp_add(script_ctx_t *ctx)
1714 {
1715     jsval_t l, r, ret;
1716     HRESULT hres;
1717
1718     r = stack_pop(ctx);
1719     l = stack_pop(ctx);
1720
1721     TRACE("%s + %s\n", debugstr_jsval(l), debugstr_jsval(r));
1722
1723     hres = add_eval(ctx, l, r, &ret);
1724     jsval_release(l);
1725     jsval_release(r);
1726     if(FAILED(hres))
1727         return hres;
1728
1729     return stack_push(ctx, ret);
1730 }
1731
1732 /* ECMA-262 3rd Edition    11.6.2 */
1733 static HRESULT interp_sub(script_ctx_t *ctx)
1734 {
1735     double l, r;
1736     HRESULT hres;
1737
1738     TRACE("\n");
1739
1740     hres = stack_pop_number(ctx, &r);
1741     if(FAILED(hres))
1742         return hres;
1743
1744     hres = stack_pop_number(ctx, &l);
1745     if(FAILED(hres))
1746         return hres;
1747
1748     return stack_push(ctx, jsval_number(l-r));
1749 }
1750
1751 /* ECMA-262 3rd Edition    11.5.1 */
1752 static HRESULT interp_mul(script_ctx_t *ctx)
1753 {
1754     double l, r;
1755     HRESULT hres;
1756
1757     TRACE("\n");
1758
1759     hres = stack_pop_number(ctx, &r);
1760     if(FAILED(hres))
1761         return hres;
1762
1763     hres = stack_pop_number(ctx, &l);
1764     if(FAILED(hres))
1765         return hres;
1766
1767     return stack_push(ctx, jsval_number(l*r));
1768 }
1769
1770 /* ECMA-262 3rd Edition    11.5.2 */
1771 static HRESULT interp_div(script_ctx_t *ctx)
1772 {
1773     double l, r;
1774     HRESULT hres;
1775
1776     TRACE("\n");
1777
1778     hres = stack_pop_number(ctx, &r);
1779     if(FAILED(hres))
1780         return hres;
1781
1782     hres = stack_pop_number(ctx, &l);
1783     if(FAILED(hres))
1784         return hres;
1785
1786     return stack_push(ctx, jsval_number(l/r));
1787 }
1788
1789 /* ECMA-262 3rd Edition    11.5.3 */
1790 static HRESULT interp_mod(script_ctx_t *ctx)
1791 {
1792     double l, r;
1793     HRESULT hres;
1794
1795     TRACE("\n");
1796
1797     hres = stack_pop_number(ctx, &r);
1798     if(FAILED(hres))
1799         return hres;
1800
1801     hres = stack_pop_number(ctx, &l);
1802     if(FAILED(hres))
1803         return hres;
1804
1805     return stack_push(ctx, jsval_number(fmod(l, r)));
1806 }
1807
1808 /* ECMA-262 3rd Edition    11.4.2 */
1809 static HRESULT interp_delete(script_ctx_t *ctx)
1810 {
1811     jsval_t objv, namev;
1812     IDispatch *obj;
1813     jsstr_t *name;
1814     BOOL ret;
1815     HRESULT hres;
1816
1817     TRACE("\n");
1818
1819     namev = stack_pop(ctx);
1820     objv = stack_pop(ctx);
1821
1822     hres = to_object(ctx, objv, &obj);
1823     jsval_release(objv);
1824     if(FAILED(hres)) {
1825         jsval_release(namev);
1826         return hres;
1827     }
1828
1829     hres = to_string(ctx, namev, &name);
1830     jsval_release(namev);
1831     if(FAILED(hres)) {
1832         IDispatch_Release(obj);
1833         return hres;
1834     }
1835
1836     hres = disp_delete_name(ctx, obj, name, &ret);
1837     IDispatch_Release(obj);
1838     jsstr_release(name);
1839     if(FAILED(hres))
1840         return hres;
1841
1842     return stack_push(ctx, jsval_bool(ret));
1843 }
1844
1845 /* ECMA-262 3rd Edition    11.4.2 */
1846 static HRESULT interp_delete_ident(script_ctx_t *ctx)
1847 {
1848     const BSTR arg = get_op_bstr(ctx, 0);
1849     exprval_t exprval;
1850     BOOL ret;
1851     HRESULT hres;
1852
1853     TRACE("%s\n", debugstr_w(arg));
1854
1855     hres = identifier_eval(ctx, arg, &exprval);
1856     if(FAILED(hres))
1857         return hres;
1858
1859     switch(exprval.type) {
1860     case EXPRVAL_STACK_REF:
1861         ret = FALSE;
1862         break;
1863     case EXPRVAL_IDREF:
1864         hres = disp_delete(exprval.u.idref.disp, exprval.u.idref.id, &ret);
1865         IDispatch_Release(exprval.u.idref.disp);
1866         if(FAILED(hres))
1867             return hres;
1868         break;
1869     case EXPRVAL_INVALID:
1870         ret = TRUE;
1871         break;
1872     default:
1873         FIXME("Unsupported exprval\n");
1874         exprval_release(&exprval);
1875         return E_NOTIMPL;
1876     }
1877
1878
1879     return stack_push(ctx, jsval_bool(ret));
1880 }
1881
1882 /* ECMA-262 3rd Edition    11.4.2 */
1883 static HRESULT interp_void(script_ctx_t *ctx)
1884 {
1885     TRACE("\n");
1886
1887     stack_popn(ctx, 1);
1888     return stack_push(ctx, jsval_undefined());
1889 }
1890
1891 /* ECMA-262 3rd Edition    11.4.3 */
1892 static HRESULT typeof_string(jsval_t v, const WCHAR **ret)
1893 {
1894     switch(jsval_type(v)) {
1895     case JSV_UNDEFINED:
1896         *ret = undefinedW;
1897         break;
1898     case JSV_NULL:
1899         *ret = objectW;
1900         break;
1901     case JSV_OBJECT: {
1902         jsdisp_t *dispex;
1903
1904         if(get_object(v) && (dispex = iface_to_jsdisp(get_object(v)))) {
1905             *ret = is_class(dispex, JSCLASS_FUNCTION) ? functionW : objectW;
1906             jsdisp_release(dispex);
1907         }else {
1908             *ret = objectW;
1909         }
1910         break;
1911     }
1912     case JSV_STRING:
1913         *ret = stringW;
1914         break;
1915     case JSV_NUMBER:
1916         *ret = numberW;
1917         break;
1918     case JSV_BOOL:
1919         *ret = booleanW;
1920         break;
1921     case JSV_VARIANT:
1922         FIXME("unhandled variant %s\n", debugstr_variant(get_variant(v)));
1923         return E_NOTIMPL;
1924     }
1925
1926     return S_OK;
1927 }
1928
1929 /* ECMA-262 3rd Edition    11.4.3 */
1930 static HRESULT interp_typeofid(script_ctx_t *ctx)
1931 {
1932     const WCHAR *ret;
1933     exprval_t ref;
1934     jsval_t v;
1935     HRESULT hres;
1936
1937     TRACE("\n");
1938
1939     if(!stack_pop_exprval(ctx, &ref))
1940         return stack_push(ctx, jsval_string(jsstr_undefined()));
1941
1942     hres = exprval_propget(ctx, &ref, &v);
1943     exprval_release(&ref);
1944     if(FAILED(hres))
1945         return stack_push_string(ctx, unknownW);
1946
1947     hres = typeof_string(v, &ret);
1948     jsval_release(v);
1949     if(FAILED(hres))
1950         return hres;
1951
1952     return stack_push_string(ctx, ret);
1953 }
1954
1955 /* ECMA-262 3rd Edition    11.4.3 */
1956 static HRESULT interp_typeofident(script_ctx_t *ctx)
1957 {
1958     const BSTR arg = get_op_bstr(ctx, 0);
1959     exprval_t exprval;
1960     const WCHAR *ret;
1961     jsval_t v;
1962     HRESULT hres;
1963
1964     TRACE("%s\n", debugstr_w(arg));
1965
1966     hres = identifier_eval(ctx, arg, &exprval);
1967     if(FAILED(hres))
1968         return hres;
1969
1970     if(exprval.type == EXPRVAL_INVALID)
1971         return stack_push(ctx, jsval_string(jsstr_undefined()));
1972
1973     hres = exprval_to_value(ctx, &exprval, &v);
1974     if(FAILED(hres))
1975         return hres;
1976
1977     hres = typeof_string(v, &ret);
1978     jsval_release(v);
1979     if(FAILED(hres))
1980         return hres;
1981
1982     return stack_push_string(ctx, ret);
1983 }
1984
1985 /* ECMA-262 3rd Edition    11.4.3 */
1986 static HRESULT interp_typeof(script_ctx_t *ctx)
1987 {
1988     const WCHAR *ret;
1989     jsval_t v;
1990     HRESULT hres;
1991
1992     TRACE("\n");
1993
1994     v = stack_pop(ctx);
1995     hres = typeof_string(v, &ret);
1996     jsval_release(v);
1997     if(FAILED(hres))
1998         return hres;
1999
2000     return stack_push_string(ctx, ret);
2001 }
2002
2003 /* ECMA-262 3rd Edition    11.4.7 */
2004 static HRESULT interp_minus(script_ctx_t *ctx)
2005 {
2006     double n;
2007     HRESULT hres;
2008
2009     TRACE("\n");
2010
2011     hres = stack_pop_number(ctx, &n);
2012     if(FAILED(hres))
2013         return hres;
2014
2015     return stack_push(ctx, jsval_number(-n));
2016 }
2017
2018 /* ECMA-262 3rd Edition    11.4.6 */
2019 static HRESULT interp_tonum(script_ctx_t *ctx)
2020 {
2021     jsval_t v;
2022     double n;
2023     HRESULT hres;
2024
2025     TRACE("\n");
2026
2027     v = stack_pop(ctx);
2028     hres = to_number(ctx, v, &n);
2029     jsval_release(v);
2030     if(FAILED(hres))
2031         return hres;
2032
2033     return stack_push(ctx, jsval_number(n));
2034 }
2035
2036 /* ECMA-262 3rd Edition    11.3.1 */
2037 static HRESULT interp_postinc(script_ctx_t *ctx)
2038 {
2039     const int arg = get_op_int(ctx, 0);
2040     exprval_t ref;
2041     jsval_t v;
2042     HRESULT hres;
2043
2044     TRACE("%d\n", arg);
2045
2046     if(!stack_pop_exprval(ctx, &ref))
2047         return throw_type_error(ctx, JS_E_OBJECT_EXPECTED, NULL);
2048
2049     hres = exprval_propget(ctx, &ref, &v);
2050     if(SUCCEEDED(hres)) {
2051         double n;
2052
2053         hres = to_number(ctx, v, &n);
2054         if(SUCCEEDED(hres))
2055             hres = exprval_propput(ctx, &ref, jsval_number(n+(double)arg));
2056         if(FAILED(hres))
2057             jsval_release(v);
2058     }
2059     exprval_release(&ref);
2060     if(FAILED(hres))
2061         return hres;
2062
2063     return stack_push(ctx, v);
2064 }
2065
2066 /* ECMA-262 3rd Edition    11.4.4, 11.4.5 */
2067 static HRESULT interp_preinc(script_ctx_t *ctx)
2068 {
2069     const int arg = get_op_int(ctx, 0);
2070     exprval_t ref;
2071     double ret;
2072     jsval_t v;
2073     HRESULT hres;
2074
2075     TRACE("%d\n", arg);
2076
2077     if(!stack_pop_exprval(ctx, &ref))
2078         return throw_type_error(ctx, JS_E_OBJECT_EXPECTED, NULL);
2079
2080     hres = exprval_propget(ctx, &ref, &v);
2081     if(SUCCEEDED(hres)) {
2082         double n;
2083
2084         hres = to_number(ctx, v, &n);
2085         jsval_release(v);
2086         if(SUCCEEDED(hres)) {
2087             ret = n+(double)arg;
2088             hres = exprval_propput(ctx, &ref, jsval_number(ret));
2089         }
2090     }
2091     exprval_release(&ref);
2092     if(FAILED(hres))
2093         return hres;
2094
2095     return stack_push(ctx, jsval_number(ret));
2096 }
2097
2098 /* ECMA-262 3rd Edition    11.9.3 */
2099 static HRESULT equal_values(script_ctx_t *ctx, jsval_t lval, jsval_t rval, BOOL *ret)
2100 {
2101     if(jsval_type(lval) == jsval_type(rval) || (is_number(lval) && is_number(rval)))
2102        return equal2_values(lval, rval, ret);
2103
2104     /* FIXME: NULL disps should be handled in more general way */
2105     if(is_object_instance(lval) && !get_object(lval))
2106         return equal_values(ctx, jsval_null(), rval, ret);
2107     if(is_object_instance(rval) && !get_object(rval))
2108         return equal_values(ctx, lval, jsval_null(), ret);
2109
2110     if((is_null(lval) && is_undefined(rval)) || (is_undefined(lval) && is_null(rval))) {
2111         *ret = TRUE;
2112         return S_OK;
2113     }
2114
2115     if(is_string(lval) && is_number(rval)) {
2116         double n;
2117         HRESULT hres;
2118
2119         hres = to_number(ctx, lval, &n);
2120         if(FAILED(hres))
2121             return hres;
2122
2123         /* FIXME: optimize */
2124         return equal_values(ctx, jsval_number(n), rval, ret);
2125     }
2126
2127     if(is_string(rval) && is_number(lval)) {
2128         double n;
2129         HRESULT hres;
2130
2131         hres = to_number(ctx, rval, &n);
2132         if(FAILED(hres))
2133             return hres;
2134
2135         /* FIXME: optimize */
2136         return equal_values(ctx, lval, jsval_number(n), ret);
2137     }
2138
2139     if(is_bool(rval))
2140         return equal_values(ctx, lval, jsval_number(get_bool(rval) ? 1 : 0), ret);
2141
2142     if(is_bool(lval))
2143         return equal_values(ctx, jsval_number(get_bool(lval) ? 1 : 0), rval, ret);
2144
2145
2146     if(is_object_instance(rval) && (is_string(lval) || is_number(lval))) {
2147         jsval_t prim;
2148         HRESULT hres;
2149
2150         hres = to_primitive(ctx, rval, &prim, NO_HINT);
2151         if(FAILED(hres))
2152             return hres;
2153
2154         hres = equal_values(ctx, lval, prim, ret);
2155         jsval_release(prim);
2156         return hres;
2157     }
2158
2159
2160     if(is_object_instance(lval) && (is_string(rval) || is_number(rval))) {
2161         jsval_t prim;
2162         HRESULT hres;
2163
2164         hres = to_primitive(ctx, lval, &prim, NO_HINT);
2165         if(FAILED(hres))
2166             return hres;
2167
2168         hres = equal_values(ctx, prim, rval, ret);
2169         jsval_release(prim);
2170         return hres;
2171     }
2172
2173
2174     *ret = FALSE;
2175     return S_OK;
2176 }
2177
2178 /* ECMA-262 3rd Edition    11.9.1 */
2179 static HRESULT interp_eq(script_ctx_t *ctx)
2180 {
2181     jsval_t l, r;
2182     BOOL b;
2183     HRESULT hres;
2184
2185     r = stack_pop(ctx);
2186     l = stack_pop(ctx);
2187
2188     TRACE("%s == %s\n", debugstr_jsval(l), debugstr_jsval(r));
2189
2190     hres = equal_values(ctx, l, r, &b);
2191     jsval_release(l);
2192     jsval_release(r);
2193     if(FAILED(hres))
2194         return hres;
2195
2196     return stack_push(ctx, jsval_bool(b));
2197 }
2198
2199 /* ECMA-262 3rd Edition    11.9.2 */
2200 static HRESULT interp_neq(script_ctx_t *ctx)
2201 {
2202     jsval_t l, r;
2203     BOOL b;
2204     HRESULT hres;
2205
2206     r = stack_pop(ctx);
2207     l = stack_pop(ctx);
2208
2209     TRACE("%s != %s\n", debugstr_jsval(l), debugstr_jsval(r));
2210
2211     hres = equal_values(ctx, l, r, &b);
2212     jsval_release(l);
2213     jsval_release(r);
2214     if(FAILED(hres))
2215         return hres;
2216
2217     return stack_push(ctx, jsval_bool(!b));
2218 }
2219
2220 /* ECMA-262 3rd Edition    11.9.4 */
2221 static HRESULT interp_eq2(script_ctx_t *ctx)
2222 {
2223     jsval_t l, r;
2224     BOOL b;
2225     HRESULT hres;
2226
2227     r = stack_pop(ctx);
2228     l = stack_pop(ctx);
2229
2230     TRACE("%s === %s\n", debugstr_jsval(l), debugstr_jsval(r));
2231
2232     hres = equal2_values(r, l, &b);
2233     jsval_release(l);
2234     jsval_release(r);
2235     if(FAILED(hres))
2236         return hres;
2237
2238     return stack_push(ctx, jsval_bool(b));
2239 }
2240
2241 /* ECMA-262 3rd Edition    11.9.5 */
2242 static HRESULT interp_neq2(script_ctx_t *ctx)
2243 {
2244     jsval_t l, r;
2245     BOOL b;
2246     HRESULT hres;
2247
2248     TRACE("\n");
2249
2250     r = stack_pop(ctx);
2251     l = stack_pop(ctx);
2252
2253     hres = equal2_values(r, l, &b);
2254     jsval_release(l);
2255     jsval_release(r);
2256     if(FAILED(hres))
2257         return hres;
2258
2259     return stack_push(ctx, jsval_bool(!b));
2260 }
2261
2262 /* ECMA-262 3rd Edition    11.8.5 */
2263 static HRESULT less_eval(script_ctx_t *ctx, jsval_t lval, jsval_t rval, BOOL greater, BOOL *ret)
2264 {
2265     double ln, rn;
2266     jsval_t l, r;
2267     HRESULT hres;
2268
2269     hres = to_primitive(ctx, lval, &l, NO_HINT);
2270     if(FAILED(hres))
2271         return hres;
2272
2273     hres = to_primitive(ctx, rval, &r, NO_HINT);
2274     if(FAILED(hres)) {
2275         jsval_release(l);
2276         return hres;
2277     }
2278
2279     if(is_string(l) && is_string(r)) {
2280         *ret = (jsstr_cmp(get_string(l), get_string(r)) < 0) ^ greater;
2281         jsstr_release(get_string(l));
2282         jsstr_release(get_string(r));
2283         return S_OK;
2284     }
2285
2286     hres = to_number(ctx, l, &ln);
2287     jsval_release(l);
2288     if(SUCCEEDED(hres))
2289         hres = to_number(ctx, r, &rn);
2290     jsval_release(r);
2291     if(FAILED(hres))
2292         return hres;
2293
2294     *ret = !isnan(ln) && !isnan(rn) && ((ln < rn) ^ greater);
2295     return S_OK;
2296 }
2297
2298 /* ECMA-262 3rd Edition    11.8.1 */
2299 static HRESULT interp_lt(script_ctx_t *ctx)
2300 {
2301     jsval_t l, r;
2302     BOOL b;
2303     HRESULT hres;
2304
2305     r = stack_pop(ctx);
2306     l = stack_pop(ctx);
2307
2308     TRACE("%s < %s\n", debugstr_jsval(l), debugstr_jsval(r));
2309
2310     hres = less_eval(ctx, l, r, FALSE, &b);
2311     jsval_release(l);
2312     jsval_release(r);
2313     if(FAILED(hres))
2314         return hres;
2315
2316     return stack_push(ctx, jsval_bool(b));
2317 }
2318
2319 /* ECMA-262 3rd Edition    11.8.1 */
2320 static HRESULT interp_lteq(script_ctx_t *ctx)
2321 {
2322     jsval_t l, r;
2323     BOOL b;
2324     HRESULT hres;
2325
2326     r = stack_pop(ctx);
2327     l = stack_pop(ctx);
2328
2329     TRACE("%s <= %s\n", debugstr_jsval(l), debugstr_jsval(r));
2330
2331     hres = less_eval(ctx, r, l, TRUE, &b);
2332     jsval_release(l);
2333     jsval_release(r);
2334     if(FAILED(hres))
2335         return hres;
2336
2337     return stack_push(ctx, jsval_bool(b));
2338 }
2339
2340 /* ECMA-262 3rd Edition    11.8.2 */
2341 static HRESULT interp_gt(script_ctx_t *ctx)
2342 {
2343     jsval_t l, r;
2344     BOOL b;
2345     HRESULT hres;
2346
2347     r = stack_pop(ctx);
2348     l = stack_pop(ctx);
2349
2350     TRACE("%s > %s\n", debugstr_jsval(l), debugstr_jsval(r));
2351
2352     hres = less_eval(ctx, r, l, FALSE, &b);
2353     jsval_release(l);
2354     jsval_release(r);
2355     if(FAILED(hres))
2356         return hres;
2357
2358     return stack_push(ctx, jsval_bool(b));
2359 }
2360
2361 /* ECMA-262 3rd Edition    11.8.4 */
2362 static HRESULT interp_gteq(script_ctx_t *ctx)
2363 {
2364     jsval_t l, r;
2365     BOOL b;
2366     HRESULT hres;
2367
2368     r = stack_pop(ctx);
2369     l = stack_pop(ctx);
2370
2371     TRACE("%s >= %s\n", debugstr_jsval(l), debugstr_jsval(r));
2372
2373     hres = less_eval(ctx, l, r, TRUE, &b);
2374     jsval_release(l);
2375     jsval_release(r);
2376     if(FAILED(hres))
2377         return hres;
2378
2379     return stack_push(ctx, jsval_bool(b));
2380 }
2381
2382 /* ECMA-262 3rd Edition    11.4.8 */
2383 static HRESULT interp_bneg(script_ctx_t *ctx)
2384 {
2385     jsval_t v;
2386     INT i;
2387     HRESULT hres;
2388
2389     TRACE("\n");
2390
2391     v = stack_pop(ctx);
2392     hres = to_int32(ctx, v, &i);
2393     jsval_release(v);
2394     if(FAILED(hres))
2395         return hres;
2396
2397     return stack_push(ctx, jsval_number(~i));
2398 }
2399
2400 /* ECMA-262 3rd Edition    11.4.9 */
2401 static HRESULT interp_neg(script_ctx_t *ctx)
2402 {
2403     jsval_t v;
2404     BOOL b;
2405     HRESULT hres;
2406
2407     TRACE("\n");
2408
2409     v = stack_pop(ctx);
2410     hres = to_boolean(v, &b);
2411     jsval_release(v);
2412     if(FAILED(hres))
2413         return hres;
2414
2415     return stack_push(ctx, jsval_bool(!b));
2416 }
2417
2418 /* ECMA-262 3rd Edition    11.7.1 */
2419 static HRESULT interp_lshift(script_ctx_t *ctx)
2420 {
2421     DWORD r;
2422     INT l;
2423     HRESULT hres;
2424
2425     hres = stack_pop_uint(ctx, &r);
2426     if(FAILED(hres))
2427         return hres;
2428
2429     hres = stack_pop_int(ctx, &l);
2430     if(FAILED(hres))
2431         return hres;
2432
2433     return stack_push(ctx, jsval_number(l << (r&0x1f)));
2434 }
2435
2436 /* ECMA-262 3rd Edition    11.7.2 */
2437 static HRESULT interp_rshift(script_ctx_t *ctx)
2438 {
2439     DWORD r;
2440     INT l;
2441     HRESULT hres;
2442
2443     hres = stack_pop_uint(ctx, &r);
2444     if(FAILED(hres))
2445         return hres;
2446
2447     hres = stack_pop_int(ctx, &l);
2448     if(FAILED(hres))
2449         return hres;
2450
2451     return stack_push(ctx, jsval_number(l >> (r&0x1f)));
2452 }
2453
2454 /* ECMA-262 3rd Edition    11.7.3 */
2455 static HRESULT interp_rshift2(script_ctx_t *ctx)
2456 {
2457     DWORD r, l;
2458     HRESULT hres;
2459
2460     hres = stack_pop_uint(ctx, &r);
2461     if(FAILED(hres))
2462         return hres;
2463
2464     hres = stack_pop_uint(ctx, &l);
2465     if(FAILED(hres))
2466         return hres;
2467
2468     return stack_push(ctx, jsval_number(l >> (r&0x1f)));
2469 }
2470
2471 /* ECMA-262 3rd Edition    11.13.1 */
2472 static HRESULT interp_assign(script_ctx_t *ctx)
2473 {
2474     exprval_t ref;
2475     jsval_t v;
2476     HRESULT hres;
2477
2478     TRACE("\n");
2479
2480     v = stack_pop(ctx);
2481
2482     if(!stack_pop_exprval(ctx, &ref)) {
2483         jsval_release(v);
2484         return throw_reference_error(ctx, JS_E_ILLEGAL_ASSIGN, NULL);
2485     }
2486
2487     hres = exprval_propput(ctx, &ref, v);
2488     exprval_release(&ref);
2489     if(FAILED(hres)) {
2490         jsval_release(v);
2491         return hres;
2492     }
2493
2494     return stack_push(ctx, v);
2495 }
2496
2497 /* JScript extension */
2498 static HRESULT interp_assign_call(script_ctx_t *ctx)
2499 {
2500     const unsigned argc = get_op_uint(ctx, 0);
2501     exprval_t ref;
2502     jsval_t v;
2503     HRESULT hres;
2504
2505     TRACE("%u\n", argc);
2506
2507     if(!stack_topn_exprval(ctx, argc+1, &ref))
2508         return throw_reference_error(ctx, JS_E_ILLEGAL_ASSIGN, NULL);
2509
2510     hres = exprval_call(ctx, &ref, DISPATCH_PROPERTYPUT, argc+1, stack_args(ctx, argc+1), NULL);
2511     if(FAILED(hres))
2512         return hres;
2513
2514     v = stack_pop(ctx);
2515     stack_popn(ctx, argc+2);
2516     return stack_push(ctx, v);
2517 }
2518
2519 static HRESULT interp_undefined(script_ctx_t *ctx)
2520 {
2521     TRACE("\n");
2522
2523     return stack_push(ctx, jsval_undefined());
2524 }
2525
2526 static HRESULT interp_jmp(script_ctx_t *ctx)
2527 {
2528     const unsigned arg = get_op_uint(ctx, 0);
2529
2530     TRACE("%u\n", arg);
2531
2532     jmp_abs(ctx, arg);
2533     return S_OK;
2534 }
2535
2536 static HRESULT interp_jmp_z(script_ctx_t *ctx)
2537 {
2538     const unsigned arg = get_op_uint(ctx, 0);
2539     BOOL b;
2540     jsval_t v;
2541     HRESULT hres;
2542
2543     TRACE("\n");
2544
2545     v = stack_pop(ctx);
2546     hres = to_boolean(v, &b);
2547     jsval_release(v);
2548     if(FAILED(hres))
2549         return hres;
2550
2551     if(b)
2552         jmp_next(ctx);
2553     else
2554         jmp_abs(ctx, arg);
2555     return S_OK;
2556 }
2557
2558 static HRESULT interp_pop(script_ctx_t *ctx)
2559 {
2560     const unsigned arg = get_op_uint(ctx, 0);
2561
2562     TRACE("%u\n", arg);
2563
2564     stack_popn(ctx, arg);
2565     return S_OK;
2566 }
2567
2568 static HRESULT interp_ret(script_ctx_t *ctx)
2569 {
2570     const unsigned clear_ret = get_op_uint(ctx, 0);
2571     call_frame_t *frame = ctx->call_ctx;
2572
2573     TRACE("\n");
2574
2575     if(clear_ret)
2576         jsval_release(steal_ret(frame));
2577
2578     if((frame->flags & EXEC_CONSTRUCTOR) && !is_object_instance(frame->ret)) {
2579         jsval_release(frame->ret);
2580         IDispatch_AddRef(frame->this_obj);
2581         frame->ret = jsval_disp(frame->this_obj);
2582     }
2583
2584     jmp_abs(ctx, -1);
2585     return S_OK;
2586 }
2587
2588 static HRESULT interp_setret(script_ctx_t *ctx)
2589 {
2590     call_frame_t *frame = ctx->call_ctx;
2591
2592     TRACE("\n");
2593
2594     jsval_release(frame->ret);
2595     frame->ret = stack_pop(ctx);
2596     return S_OK;
2597 }
2598
2599 static HRESULT interp_push_ret(script_ctx_t *ctx)
2600 {
2601     call_frame_t *frame = ctx->call_ctx;
2602     HRESULT hres;
2603
2604     TRACE("\n");
2605
2606     hres = stack_push(ctx, frame->ret);
2607     if(SUCCEEDED(hres))
2608         frame->ret = jsval_undefined();
2609     return hres;
2610 }
2611
2612 typedef HRESULT (*op_func_t)(script_ctx_t*);
2613
2614 static const op_func_t op_funcs[] = {
2615 #define X(x,a,b,c) interp_##x,
2616 OP_LIST
2617 #undef X
2618 };
2619
2620 static const unsigned op_move[] = {
2621 #define X(a,x,b,c) x,
2622 OP_LIST
2623 #undef X
2624 };
2625
2626 static void pop_call_frame(script_ctx_t *ctx)
2627 {
2628     call_frame_t *frame = ctx->call_ctx;
2629
2630     frame->stack_base -= frame->pop_locals + frame->pop_variables;
2631
2632     assert(frame->scope == frame->base_scope);
2633
2634     /* If current scope will be kept alive, we need to transfer local variables to its variable object. */
2635     if(frame->scope && frame->scope->ref > 1) {
2636         HRESULT hres = detach_variable_object(ctx, frame, TRUE);
2637         if(FAILED(hres))
2638             ERR("Failed to detach variable object: %08x\n", hres);
2639     }
2640
2641     if(frame->arguments_obj)
2642         detach_arguments_object(frame->arguments_obj);
2643     if(frame->scope)
2644         scope_release(frame->scope);
2645
2646     if(frame->pop_variables)
2647         stack_popn(ctx, frame->pop_variables);
2648     stack_popn(ctx, frame->pop_locals);
2649
2650     ctx->call_ctx = frame->prev_frame;
2651
2652     if(frame->function_instance)
2653         jsdisp_release(frame->function_instance);
2654     if(frame->variable_obj)
2655         jsdisp_release(frame->variable_obj);
2656     if(frame->this_obj)
2657         IDispatch_Release(frame->this_obj);
2658     jsval_release(frame->ret);
2659     release_bytecode(frame->bytecode);
2660     heap_free(frame);
2661 }
2662
2663 static void print_backtrace(script_ctx_t *ctx)
2664 {
2665     unsigned depth = 0, i;
2666     call_frame_t *frame;
2667
2668     for(frame = ctx->call_ctx; frame; frame = frame->prev_frame) {
2669         TRACE_(jscript_except)("%u\t", depth);
2670         depth++;
2671
2672         if(frame->this_obj && frame->this_obj != to_disp(ctx->global) && frame->this_obj != ctx->host_global)
2673             TRACE_(jscript_except)("%p->", frame->this_obj);
2674         TRACE_(jscript_except)("%s(", frame->function->name ? debugstr_w(frame->function->name) : "[unnamed]");
2675         if(frame->base_scope && frame->base_scope->frame) {
2676             for(i=0; i < frame->argc; i++) {
2677                 if(i < frame->function->param_cnt)
2678                     TRACE_(jscript_except)("%s%s=%s", i ? ", " : "",
2679                                            debugstr_w(frame->function->params[i]),
2680                                            debugstr_jsval(ctx->stack[local_off(frame, -i-1)]));
2681                 else
2682                     TRACE_(jscript_except)("%s%s", i ? ", " : "",
2683                                            debugstr_jsval(ctx->stack[local_off(frame, -i-1)]));
2684             }
2685         }else {
2686             TRACE_(jscript_except)("[detached frame]");
2687         }
2688         TRACE_(jscript_except)(")\n");
2689
2690         if(!(frame->flags & EXEC_RETURN_TO_INTERP)) {
2691             TRACE_(jscript_except)("%u\t[native code]\n", depth);
2692             depth++;
2693         }
2694     }
2695 }
2696
2697 static HRESULT unwind_exception(script_ctx_t *ctx, HRESULT exception_hres)
2698 {
2699     except_frame_t *except_frame;
2700     call_frame_t *frame;
2701     jsval_t except_val;
2702     unsigned catch_off;
2703     HRESULT hres;
2704
2705     TRACE("%08x\n", exception_hres);
2706
2707     if(TRACE_ON(jscript_except)) {
2708         jsdisp_t *error_obj;
2709         jsval_t msg;
2710
2711         static const WCHAR messageW[] = {'m','e','s','s','a','g','e',0};
2712
2713         TRACE_(jscript_except)("Exception %08x %s", exception_hres, debugstr_jsval(ctx->ei.val));
2714         if(jsval_type(ctx->ei.val) == JSV_OBJECT) {
2715             error_obj = to_jsdisp(get_object(ctx->ei.val));
2716             if(error_obj) {
2717                 hres = jsdisp_propget_name(error_obj, messageW, &msg);
2718                 if(SUCCEEDED(hres)) {
2719                     TRACE_(jscript_except)(" (message %s)", debugstr_jsval(msg));
2720                     jsval_release(msg);
2721                 }
2722             }
2723         }
2724         TRACE_(jscript_except)(" in:\n");
2725
2726         print_backtrace(ctx);
2727     }
2728
2729     for(frame = ctx->call_ctx; !frame->except_frame; frame = ctx->call_ctx) {
2730         DWORD flags;
2731
2732         while(frame->scope != frame->base_scope)
2733             scope_pop(&frame->scope);
2734
2735         stack_popn(ctx, ctx->stack_top-frame->stack_base);
2736
2737         flags = frame->flags;
2738         pop_call_frame(ctx);
2739         if(!(flags & EXEC_RETURN_TO_INTERP))
2740             return exception_hres;
2741     }
2742
2743     except_frame = frame->except_frame;
2744     catch_off = except_frame->catch_off;
2745
2746     assert(except_frame->stack_top <= ctx->stack_top);
2747     stack_popn(ctx, ctx->stack_top - except_frame->stack_top);
2748
2749     while(except_frame->scope != frame->scope)
2750         scope_pop(&frame->scope);
2751
2752     frame->ip = catch_off ? catch_off : except_frame->finally_off;
2753     if(catch_off) assert(frame->bytecode->instrs[frame->ip].op == OP_enter_catch);
2754
2755     except_val = ctx->ei.val;
2756     ctx->ei.val = jsval_undefined();
2757     clear_ei(ctx);
2758
2759     /* keep current except_frame if we're entering catch block with finally block associated */
2760     if(catch_off && except_frame->finally_off) {
2761         except_frame->catch_off = 0;
2762     }else {
2763         frame->except_frame = except_frame->next;
2764         heap_free(except_frame);
2765     }
2766
2767     hres = stack_push(ctx, except_val);
2768     if(FAILED(hres))
2769         return hres;
2770
2771     if(!catch_off)
2772         hres = stack_push(ctx, jsval_bool(FALSE));
2773     return hres;
2774 }
2775
2776 static HRESULT enter_bytecode(script_ctx_t *ctx, jsval_t *r)
2777 {
2778     call_frame_t *frame;
2779     jsop_t op;
2780     HRESULT hres = S_OK;
2781
2782     TRACE("\n");
2783
2784     while(1) {
2785         frame = ctx->call_ctx;
2786         op = frame->bytecode->instrs[frame->ip].op;
2787         hres = op_funcs[op](ctx);
2788         if(FAILED(hres)) {
2789             hres = unwind_exception(ctx, hres);
2790             if(FAILED(hres))
2791                 return hres;
2792         }else if(frame->ip == -1) {
2793             const DWORD return_to_interp = frame->flags & EXEC_RETURN_TO_INTERP;
2794
2795             assert(ctx->stack_top == frame->stack_base);
2796             assert(frame->scope == frame->base_scope);
2797
2798             if(return_to_interp) {
2799                 clear_ret(frame->prev_frame);
2800                 frame->prev_frame->ret = steal_ret(frame);
2801             }else if(r) {
2802                 *r = steal_ret(frame);
2803             }
2804             pop_call_frame(ctx);
2805             if(!return_to_interp)
2806                 break;
2807         }else {
2808             frame->ip += op_move[op];
2809         }
2810     }
2811
2812     return S_OK;
2813 }
2814
2815 static HRESULT bind_event_target(script_ctx_t *ctx, function_code_t *func, jsdisp_t *func_obj)
2816 {
2817     IBindEventHandler *target;
2818     exprval_t exprval;
2819     IDispatch *disp;
2820     jsval_t v;
2821     HRESULT hres;
2822
2823     hres = identifier_eval(ctx, func->event_target, &exprval);
2824     if(FAILED(hres))
2825         return hres;
2826
2827     hres = exprval_to_value(ctx, &exprval, &v);
2828     if(FAILED(hres))
2829         return hres;
2830
2831     if(!is_object_instance(v)) {
2832         FIXME("Can't bind to %s\n", debugstr_jsval(v));
2833         jsval_release(v);
2834     }
2835
2836     disp = get_object(v);
2837     hres = IDispatch_QueryInterface(disp, &IID_IBindEventHandler, (void**)&target);
2838     if(SUCCEEDED(hres)) {
2839         hres = IBindEventHandler_BindHandler(target, func->name, (IDispatch*)&func_obj->IDispatchEx_iface);
2840         IBindEventHandler_Release(target);
2841         if(FAILED(hres))
2842             WARN("BindEvent failed: %08x\n", hres);
2843     }else {
2844         FIXME("No IBindEventHandler, not yet supported binding\n");
2845     }
2846
2847     IDispatch_Release(disp);
2848     return hres;
2849 }
2850
2851 static HRESULT setup_scope(script_ctx_t *ctx, call_frame_t *frame, scope_chain_t *scope_chain, jsdisp_t *variable_object, unsigned argc, jsval_t *argv)
2852 {
2853     const unsigned orig_stack = ctx->stack_top;
2854     scope_chain_t *scope;
2855     unsigned i;
2856     jsval_t v;
2857     HRESULT hres;
2858
2859     /* If arguments are already on the stack, we may use them. */
2860     if(argv + argc == ctx->stack + ctx->stack_top) {
2861         frame->arguments_off = argv - ctx->stack;
2862         i = argc;
2863     }else {
2864         frame->arguments_off = ctx->stack_top;
2865         for(i = 0; i < argc; i++) {
2866             hres = jsval_copy(argv[i], &v);
2867             if(SUCCEEDED(hres))
2868                 hres = stack_push(ctx, v);
2869             if(FAILED(hres)) {
2870                 stack_popn(ctx, i);
2871                 return hres;
2872             }
2873         }
2874     }
2875
2876     /* If fewer than declared arguments were passed, fill remaining with undefined value. */
2877     for(; i < frame->function->param_cnt; i++) {
2878         hres = stack_push(ctx, jsval_undefined());
2879         if(FAILED(hres)) {
2880             stack_popn(ctx, ctx->stack_top - orig_stack);
2881             return hres;
2882         }
2883     }
2884
2885     frame->pop_locals = ctx->stack_top - orig_stack;
2886
2887     frame->variables_off = ctx->stack_top;
2888
2889     for(i = 0; i < frame->function->var_cnt; i++) {
2890         hres = stack_push(ctx, jsval_undefined());
2891         if(FAILED(hres)) {
2892             stack_popn(ctx, ctx->stack_top - orig_stack);
2893             return hres;
2894         }
2895     }
2896
2897     frame->pop_variables = i;
2898
2899     hres = scope_push(scope_chain, variable_object, to_disp(variable_object), &scope);
2900     if(FAILED(hres)) {
2901         stack_popn(ctx, ctx->stack_top - orig_stack);
2902         return hres;
2903     }
2904
2905     for(i = 0; i < frame->function->func_cnt; i++) {
2906         if(frame->function->funcs[i].name && !frame->function->funcs[i].event_target) {
2907             jsdisp_t *func_obj;
2908             unsigned off;
2909
2910             hres = create_source_function(ctx, frame->bytecode, frame->function->funcs+i, scope, &func_obj);
2911             if(FAILED(hres)) {
2912                 stack_popn(ctx, ctx->stack_top - orig_stack);
2913                 scope_release(scope);
2914                 return hres;
2915             }
2916
2917             off = local_off(frame, frame->function->funcs[i].local_ref);
2918             jsval_release(ctx->stack[off]);
2919             ctx->stack[off] = jsval_obj(func_obj);
2920         }
2921     }
2922
2923     scope->frame = frame;
2924     frame->base_scope = frame->scope = scope;
2925     return S_OK;
2926 }
2927
2928 HRESULT exec_source(script_ctx_t *ctx, DWORD flags, bytecode_t *bytecode, function_code_t *function, scope_chain_t *scope,
2929         IDispatch *this_obj, jsdisp_t *function_instance, jsdisp_t *variable_obj, unsigned argc, jsval_t *argv, jsval_t *r)
2930 {
2931     call_frame_t *frame;
2932     unsigned i;
2933     HRESULT hres;
2934
2935     for(i = 0; i < function->func_cnt; i++) {
2936         jsdisp_t *func_obj;
2937
2938         if(!function->funcs[i].event_target)
2939             continue;
2940
2941         hres = create_source_function(ctx, bytecode, function->funcs+i, scope, &func_obj);
2942         if(FAILED(hres))
2943             return hres;
2944
2945         hres = bind_event_target(ctx, function->funcs+i, func_obj);
2946         jsdisp_release(func_obj);
2947         if(FAILED(hres))
2948             return hres;
2949     }
2950
2951     if(flags & (EXEC_GLOBAL | EXEC_EVAL)) {
2952         for(i=0; i < function->var_cnt; i++) {
2953             TRACE("[%d] %s %d\n", i, debugstr_w(function->variables[i].name), function->variables[i].func_id);
2954             if(function->variables[i].func_id != -1) {
2955                 jsdisp_t *func_obj;
2956
2957                 hres = create_source_function(ctx, bytecode, function->funcs+function->variables[i].func_id, scope, &func_obj);
2958                 if(FAILED(hres))
2959                     return hres;
2960
2961                 hres = jsdisp_propput_name(variable_obj, function->variables[i].name, jsval_obj(func_obj));
2962                 jsdisp_release(func_obj);
2963             }else if(!(flags & EXEC_GLOBAL) || !lookup_global_members(ctx, function->variables[i].name, NULL)) {
2964                 DISPID id = 0;
2965
2966                 hres = jsdisp_get_id(variable_obj, function->variables[i].name, fdexNameEnsure, &id);
2967                 if(FAILED(hres))
2968                     return hres;
2969             }
2970         }
2971     }
2972
2973     /* ECMA-262 3rd Edition    11.2.3.7 */
2974     if(this_obj) {
2975         jsdisp_t *jsthis;
2976
2977         jsthis = iface_to_jsdisp(this_obj);
2978         if(jsthis) {
2979             if(jsthis->builtin_info->class == JSCLASS_GLOBAL || jsthis->builtin_info->class == JSCLASS_NONE)
2980                 this_obj = NULL;
2981             jsdisp_release(jsthis);
2982         }
2983     }
2984
2985     if(ctx->call_ctx && (flags & EXEC_EVAL)) {
2986         hres = detach_variable_object(ctx, ctx->call_ctx, FALSE);
2987         if(FAILED(hres))
2988             return hres;
2989     }
2990
2991     frame = heap_alloc_zero(sizeof(*frame));
2992     if(!frame)
2993         return E_OUTOFMEMORY;
2994
2995     frame->function = function;
2996     frame->ret = jsval_undefined();
2997     frame->argc = argc;
2998     frame->bytecode = bytecode_addref(bytecode);
2999
3000     if(!(flags & (EXEC_GLOBAL|EXEC_EVAL))) {
3001         hres = setup_scope(ctx, frame, scope, variable_obj, argc, argv);
3002         if(FAILED(hres)) {
3003             release_bytecode(frame->bytecode);
3004             heap_free(frame);
3005             return hres;
3006         }
3007     }else if(scope) {
3008         frame->base_scope = frame->scope = scope_addref(scope);
3009     }
3010
3011     frame->ip = function->instr_off;
3012     frame->stack_base = ctx->stack_top;
3013     if(this_obj)
3014         frame->this_obj = this_obj;
3015     else if(ctx->host_global)
3016         frame->this_obj = ctx->host_global;
3017     else
3018         frame->this_obj = to_disp(ctx->global);
3019     IDispatch_AddRef(frame->this_obj);
3020
3021     if(function_instance)
3022         frame->function_instance = jsdisp_addref(function_instance);
3023
3024     frame->flags = flags;
3025     frame->variable_obj = jsdisp_addref(variable_obj);
3026
3027     frame->prev_frame = ctx->call_ctx;
3028     ctx->call_ctx = frame;
3029
3030     if(flags & EXEC_RETURN_TO_INTERP) {
3031         /*
3032          * We're called directly from interpreter, so we may just setup call frame and return.
3033          * Already running interpreter will take care of execution.
3034          */
3035         if(r)
3036             *r = jsval_undefined();
3037         return S_OK;
3038     }
3039
3040     return enter_bytecode(ctx, r);
3041 }