/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-

* vim: set ts=8 sts=4 et sw=4 tw=99:

* This Source Code Form is subject to the terms of the Mozilla Public

* License, v. 2.0. If a copy of the MPL was not distributed with this

* file, You can obtain one at http://mozilla.org/MPL/2.0/. */

/*

* JS function support.

*/

#include "jsfuninlines.h"

#include "mozilla/ArrayUtils.h"

#include "mozilla/CheckedInt.h"

#include "mozilla/PodOperations.h"

#include "mozilla/Range.h"

#include <string.h>

#include "jsapi.h"

#include "jsarray.h"

#include "jsatom.h"

#include "jscntxt.h"

#include "jsobj.h"

#include "jsscript.h"

#include "jsstr.h"

#include "jstypes.h"

#include "jswrapper.h"

#include "builtin/Eval.h"

#include "builtin/Object.h"

#include "frontend/BytecodeCompiler.h"

#include "frontend/TokenStream.h"

#include "gc/Marking.h"

#include "jit/InlinableNatives.h"

#include "jit/Ion.h"

#include "jit/JitFrameIterator.h"

#include "js/CallNonGenericMethod.h"

#include "js/Proxy.h"

#include "vm/Debugger.h"

#include "vm/GlobalObject.h"

#include "vm/Interpreter.h"

#include "vm/Shape.h"

#include "vm/StringBuffer.h"

#include "vm/WrapperObject.h"

#include "vm/Xdr.h"

#include "jsscriptinlines.h"

#include "vm/Interpreter-inl.h"

#include "vm/Stack-inl.h"

using namespace js;

using namespace js::gc;

using namespace js::frontend;

using mozilla::ArrayLength;

using mozilla::PodCopy;

using mozilla::RangedPtr;

static bool

fun_enumerate(JSContext* cx, HandleObject obj)

{

MOZ_ASSERT(obj->is<JSFunction>());

RootedId id(cx);

bool found;

if (!obj->isBoundFunction() && !obj->as<JSFunction>().isArrow()) {

id = NameToId(cx->names().prototype);

if (!HasProperty(cx, obj, id, &found))

return false;

}

id = NameToId(cx->names().length);

if (!HasProperty(cx, obj, id, &found))

return false;

id = NameToId(cx->names().name);

if (!HasProperty(cx, obj, id, &found))

return false;

return true;

}

bool

IsFunction(HandleValue v)

{

return v.isObject() && v.toObject().is<JSFunction>();

}

static bool

AdvanceToActiveCallLinear(JSContext* cx, NonBuiltinScriptFrameIter& iter, HandleFunction fun)

{

MOZ_ASSERT(!fun->isBuiltin());

MOZ_ASSERT(!fun->isBoundFunction(), "all bound functions are currently native (ergo builtin)");

for (; !iter.done(); ++iter) {

if (!iter.isFunctionFrame() || iter.isEvalFrame())

continue;

if (iter.matchCallee(cx, fun))

return true;

}

return false;

}

static void

ThrowTypeErrorBehavior(JSContext* cx)

{

JS_ReportErrorFlagsAndNumber(cx, JSREPORT_ERROR, GetErrorMessage, nullptr,

JSMSG_THROW_TYPE_ERROR);

}

// Beware: this function can be invoked on *any* function! That includes

// natives, strict mode functions, bound functions, arrow functions,

// self-hosted functions and constructors, asm.js functions, functions with

// destructuring arguments and/or a rest argument, and probably a few more I

// forgot. Turn back and save yourself while you still can. It's too late for

// me.

static bool

ArgumentsRestrictions(JSContext* cx, HandleFunction fun)

{

// Throw if the function is a builtin (note: this doesn't include asm.js),

// a strict mode function (FIXME: needs work handle strict asm.js functions

// correctly, should fall out of bug 1057208), or a bound function.

if (fun->isBuiltin() ||

(fun->isInterpreted() && fun->strict()) ||

fun->isBoundFunction())

{

ThrowTypeErrorBehavior(cx);

return false;

}

// Otherwise emit a strict warning about |f.arguments| to discourage use of

// this non-standard, performance-harmful feature.

if (!JS_ReportErrorFlagsAndNumber(cx, JSREPORT_WARNING | JSREPORT_STRICT, GetErrorMessage,

nullptr, JSMSG_DEPRECATED_USAGE, js_arguments_str))

{

return false;

}

return true;

}

bool

ArgumentsGetterImpl(JSContext* cx, const CallArgs& args)

{

MOZ_ASSERT(IsFunction(args.thisv()));

RootedFunction fun(cx, &args.thisv().toObject().as<JSFunction>());

if (!ArgumentsRestrictions(cx, fun))

return false;

// Return null if this function wasn't found on the stack.

NonBuiltinScriptFrameIter iter(cx);

if (!AdvanceToActiveCallLinear(cx, iter, fun)) {

args.rval().setNull();

return true;

}

Rooted<ArgumentsObject*> argsobj(cx, ArgumentsObject::createUnexpected(cx, iter));

if (!argsobj)

return false;

// Disabling compiling of this script in IonMonkey. IonMonkey doesn't

// guarantee |f.arguments| can be fully recovered, so we try to mitigate

// observing this behavior by detecting its use early.

JSScript* script = iter.script();

jit::ForbidCompilation(cx, script);

args.rval().setObject(*argsobj);

return true;

}

static bool

ArgumentsGetter(JSContext* cx, unsigned argc, Value* vp)

{

CallArgs args = CallArgsFromVp(argc, vp);

return CallNonGenericMethod<IsFunction, ArgumentsGetterImpl>(cx, args);

}

bool

ArgumentsSetterImpl(JSContext* cx, const CallArgs& args)

{

MOZ_ASSERT(IsFunction(args.thisv()));

RootedFunction fun(cx, &args.thisv().toObject().as<JSFunction>());

if (!ArgumentsRestrictions(cx, fun))

return false;

// If the function passes the gauntlet, return |undefined|.

args.rval().setUndefined();

return true;

}

static bool

ArgumentsSetter(JSContext* cx, unsigned argc, Value* vp)

{

CallArgs args = CallArgsFromVp(argc, vp);

return CallNonGenericMethod<IsFunction, ArgumentsSetterImpl>(cx, args);

}

// Beware: this function can be invoked on *any* function! That includes

// natives, strict mode functions, bound functions, arrow functions,

// self-hosted functions and constructors, asm.js functions, functions with

// destructuring arguments and/or a rest argument, and probably a few more I

// forgot. Turn back and save yourself while you still can. It's too late for

// me.

static bool

CallerRestrictions(JSContext* cx, HandleFunction fun)

{

// Throw if the function is a builtin (note: this doesn't include asm.js),

// a strict mode function (FIXME: needs work handle strict asm.js functions

// correctly, should fall out of bug 1057208), or a bound function.

if (fun->isBuiltin() ||

(fun->isInterpreted() && fun->strict()) ||

fun->isBoundFunction())

{

ThrowTypeErrorBehavior(cx);

return false;

}

// Otherwise emit a strict warning about |f.caller| to discourage use of

// this non-standard, performance-harmful feature.

if (!JS_ReportErrorFlagsAndNumber(cx, JSREPORT_WARNING | JSREPORT_STRICT, GetErrorMessage,

nullptr, JSMSG_DEPRECATED_USAGE, js_caller_str))

{

return false;

}

return true;

}

bool

CallerGetterImpl(JSContext* cx, const CallArgs& args)

{

MOZ_ASSERT(IsFunction(args.thisv()));

// Beware! This function can be invoked on *any* function! It can't

// assume it'll never be invoked on natives, strict mode functions, bound

// functions, or anything else that ordinarily has immutable .caller

// defined with [[ThrowTypeError]].

RootedFunction fun(cx, &args.thisv().toObject().as<JSFunction>());

if (!CallerRestrictions(cx, fun))

return false;

// Also return null if this function wasn't found on the stack.

NonBuiltinScriptFrameIter iter(cx);

if (!AdvanceToActiveCallLinear(cx, iter, fun)) {

args.rval().setNull();

return true;

}

++iter;

if (iter.done() || !iter.isFunctionFrame()) {

args.rval().setNull();

return true;

}

RootedObject caller(cx, iter.callee(cx));

if (!cx->compartment()->wrap(cx, &caller))

return false;

// Censor the caller if we don't have full access to it. If we do, but the

// caller is a function with strict mode code, throw a TypeError per ES5.

// If we pass these checks, we can return the computed caller.

{

JSObject* callerObj = CheckedUnwrap(caller);

if (!callerObj) {

args.rval().setNull();

return true;

}

JSFunction* callerFun = &callerObj->as<JSFunction>();

MOZ_ASSERT(!callerFun->isBuiltin(), "non-builtin iterator returned a builtin?");

if (callerFun->strict()) {

JS_ReportErrorFlagsAndNumber(cx, JSREPORT_ERROR, GetErrorMessage, nullptr,

JSMSG_CALLER_IS_STRICT);

return false;

}

}

args.rval().setObject(*caller);

return true;

}

static bool

CallerGetter(JSContext* cx, unsigned argc, Value* vp)

{

CallArgs args = CallArgsFromVp(argc, vp);

return CallNonGenericMethod<IsFunction, CallerGetterImpl>(cx, args);

}

bool

CallerSetterImpl(JSContext* cx, const CallArgs& args)

{

MOZ_ASSERT(IsFunction(args.thisv()));

// Beware! This function can be invoked on *any* function! It can't

// assume it'll never be invoked on natives, strict mode functions, bound

// functions, or anything else that ordinarily has immutable .caller

// defined with [[ThrowTypeError]].

RootedFunction fun(cx, &args.thisv().toObject().as<JSFunction>());

if (!CallerRestrictions(cx, fun))

return false;

// Return |undefined| unless an error must be thrown.

args.rval().setUndefined();

// We can almost just return |undefined| here -- but if the caller function

// was strict mode code, we still have to throw a TypeError. This requires

// computing the caller, checking that no security boundaries are crossed,

// and throwing a TypeError if the resulting caller is strict.

NonBuiltinScriptFrameIter iter(cx);

if (!AdvanceToActiveCallLinear(cx, iter, fun))

return true;

++iter;

if (iter.done() || !iter.isFunctionFrame())

return true;

RootedObject caller(cx, iter.callee(cx));

if (!cx->compartment()->wrap(cx, &caller)) {

cx->clearPendingException();

return true;

}

// If we don't have full access to the caller, or the caller is not strict,

// return undefined. Otherwise throw a TypeError.

JSObject* callerObj = CheckedUnwrap(caller);

if (!callerObj)

return true;

JSFunction* callerFun = &callerObj->as<JSFunction>();

MOZ_ASSERT(!callerFun->isBuiltin(), "non-builtin iterator returned a builtin?");

if (callerFun->strict()) {

JS_ReportErrorFlagsAndNumber(cx, JSREPORT_ERROR, GetErrorMessage, nullptr,

JSMSG_CALLER_IS_STRICT);

return false;

}

return true;

}

static bool

CallerSetter(JSContext* cx, unsigned argc, Value* vp)

{

CallArgs args = CallArgsFromVp(argc, vp);

return CallNonGenericMethod<IsFunction, CallerSetterImpl>(cx, args);

}

static const JSPropertySpec function_properties[] = {

JS_PSGS("arguments", ArgumentsGetter, ArgumentsSetter, 0),

JS_PSGS("caller", CallerGetter, CallerSetter, 0),

JS_PS_END

};

static bool

ResolveInterpretedFunctionPrototype(JSContext* cx, HandleFunction fun, HandleId id)

{

MOZ_ASSERT(fun->isInterpreted() || fun->isAsmJSNative());

MOZ_ASSERT(!fun->isFunctionPrototype());

MOZ_ASSERT(id == NameToId(cx->names().prototype));

// Assert that fun is not a compiler-created function object, which

// must never leak to script or embedding code and then be mutated.

// Also assert that fun is not bound, per the ES5 15.3.4.5 ref above.

MOZ_ASSERT(!IsInternalFunctionObject(*fun));

MOZ_ASSERT(!fun->isBoundFunction());

// Make the prototype object an instance of Object with the same parent as

// the function object itself, unless the function is an ES6 generator. In

// that case, per the 15 July 2013 ES6 draft, section 15.19.3, its parent is

// the GeneratorObjectPrototype singleton.

bool isStarGenerator = fun->isStarGenerator();

Rooted<GlobalObject*> global(cx, &fun->global());

RootedObject objProto(cx);

if (isStarGenerator)

objProto = GlobalObject::getOrCreateStarGeneratorObjectPrototype(cx, global);

else

objProto = fun->global().getOrCreateObjectPrototype(cx);

if (!objProto)

return false;

RootedPlainObject proto(cx, NewObjectWithGivenProto<PlainObject>(cx, objProto,

SingletonObject));

if (!proto)

return false;

// Per ES5 13.2 the prototype's .constructor property is configurable,

// non-enumerable, and writable. However, per the 15 July 2013 ES6 draft,

// section 15.19.3, the .prototype of a generator function does not link

// back with a .constructor.

if (!isStarGenerator) {

RootedValue objVal(cx, ObjectValue(*fun));

if (!DefineProperty(cx, proto, cx->names().constructor, objVal, nullptr, nullptr, 0))

return false;

}

// Per ES5 15.3.5.2 a user-defined function's .prototype property is

// initially non-configurable, non-enumerable, and writable.

RootedValue protoVal(cx, ObjectValue(*proto));

return DefineProperty(cx, fun, id, protoVal, nullptr, nullptr,

JSPROP_PERMANENT | JSPROP_RESOLVING);

}

static bool

fun_mayResolve(const JSAtomState& names, jsid id, JSObject*)

{

if (!JSID_IS_ATOM(id))

return false;

JSAtom* atom = JSID_TO_ATOM(id);

return atom == names.prototype || atom == names.length || atom == names.name;

}

static bool

fun_resolve(JSContext* cx, HandleObject obj, HandleId id, bool* resolvedp)

{

if (!JSID_IS_ATOM(id))

return true;

RootedFunction fun(cx, &obj->as<JSFunction>());

if (JSID_IS_ATOM(id, cx->names().prototype)) {

/*

* Built-in functions do not have a .prototype property per ECMA-262,

* or (Object.prototype, Function.prototype, etc.) have that property

* created eagerly.

*

* ES5 15.3.4.5: bound functions don't have a prototype property. The

* isBuiltin() test covers this case because bound functions are native

* (and thus built-in) functions by definition/construction.

*

* ES6 9.2.8 MakeConstructor defines the .prototype property on constructors.

* Generators are not constructors, but they have a .prototype property anyway,

* according to errata to ES6. See bug 1191486.

*

* Thus all of the following don't get a .prototype property:

* - Methods (that are not class-constructors or generators)

* - Arrow functions

* - Function.prototype

*/

if (fun->isBuiltin() || (!fun->isConstructor() && !fun->isGenerator()))

return true;

if (!ResolveInterpretedFunctionPrototype(cx, fun, id))

return false;

*resolvedp = true;

return true;

}

bool isLength = JSID_IS_ATOM(id, cx->names().length);

if (isLength || JSID_IS_ATOM(id, cx->names().name)) {

MOZ_ASSERT(!IsInternalFunctionObject(*obj));

RootedValue v(cx);

// Since f.length and f.name are configurable, they could be resolved

// and then deleted:

// function f(x) {}

// assertEq(f.length, 1);

// delete f.length;

// assertEq(f.name, "f");

// delete f.name;

// Afterwards, asking for f.length or f.name again will cause this

// resolve hook to run again. Defining the property again the second

// time through would be a bug.

// assertEq(f.length, 0); // gets Function.prototype.length!

// assertEq(f.name, ""); // gets Function.prototype.name!

// We use the RESOLVED_LENGTH and RESOLVED_NAME flags as a hack to prevent this

// bug.

if (isLength) {

if (fun->hasResolvedLength())

return true;

uint16_t length;

if (!fun->getLength(cx, &length))

return false;

v.setInt32(length);

} else {

if (fun->hasResolvedName())

return true;

if (fun->isClassConstructor()) {

// It's impossible to have an empty named class expression. We

// use empty as a sentinel when creating default class

// constructors.

MOZ_ASSERT(fun->atom() != cx->names().empty);

// Unnamed class expressions should not get a .name property

// at all.

if (fun->atom() == nullptr)

return true;

}

v.setString(fun->atom() == nullptr ? cx->runtime()->emptyString : fun->atom());

}

if (!NativeDefineProperty(cx, fun, id, v, nullptr, nullptr,

JSPROP_READONLY | JSPROP_RESOLVING))

{

return false;

}

if (isLength)

fun->setResolvedLength();

else

fun->setResolvedName();

*resolvedp = true;

return true;

}

return true;

}

template<XDRMode mode>

bool

js::XDRInterpretedFunction(XDRState<mode>* xdr, HandleObject enclosingScope, HandleScript enclosingScript,

MutableHandleFunction objp)

{

enum FirstWordFlag {

HasAtom = 0x1,

IsStarGenerator = 0x2,

IsLazy = 0x4,

HasSingletonType = 0x8

};

/* NB: Keep this in sync with CloneInnerInterpretedFunction. */

RootedAtom atom(xdr->cx());

uint32_t firstword = 0; /* bitmask of FirstWordFlag */

uint32_t flagsword = 0; /* word for argument count and fun->flags */

JSContext* cx = xdr->cx();

RootedFunction fun(cx);

RootedScript script(cx);

Rooted<LazyScript*> lazy(cx);

if (mode == XDR_ENCODE) {

fun = objp;

if (!fun->isInterpreted()) {

JSAutoByteString funNameBytes;

if (const char* name = GetFunctionNameBytes(cx, fun, &funNameBytes)) {

JS_ReportErrorNumber(cx, GetErrorMessage, nullptr,

JSMSG_NOT_SCRIPTED_FUNCTION, name);

}

return false;

}

if (fun->atom() || fun->hasGuessedAtom())

firstword |= HasAtom;

if (fun->isStarGenerator())

firstword |= IsStarGenerator;

if (fun->isInterpretedLazy()) {

// Encode a lazy script.

firstword |= IsLazy;

lazy = fun->lazyScript();

} else {

// Encode the script.

script = fun->nonLazyScript();

}

if (fun->isSingleton())

firstword |= HasSingletonType;

atom = fun->displayAtom();

flagsword = (fun->nargs() << 16) |

(fun->flags() & ~JSFunction::NO_XDR_FLAGS);

// The environment of any function which is not reused will always be

// null, it is later defined when a function is cloned or reused to

// mirror the scope chain.

MOZ_ASSERT_IF(fun->isSingleton() &&

!((lazy && lazy->hasBeenCloned()) || (script && script->hasBeenCloned())),

fun->environment() == nullptr);

}

if (!xdr->codeUint32(&firstword))

return false;

if ((firstword & HasAtom) && !XDRAtom(xdr, &atom))

return false;

if (!xdr->codeUint32(&flagsword))

return false;

if (mode == XDR_DECODE) {

RootedObject proto(cx);

if (firstword & IsStarGenerator) {

proto = GlobalObject::getOrCreateStarGeneratorFunctionPrototype(cx, cx->global());

if (!proto)

return false;

}

gc::AllocKind allocKind = gc::AllocKind::FUNCTION;

if (uint16_t(flagsword) & JSFunction::EXTENDED)

allocKind = gc::AllocKind::FUNCTION_EXTENDED;

fun = NewFunctionWithProto(cx, nullptr, 0, JSFunction::INTERPRETED,

/* enclosingDynamicScope = */ nullptr, nullptr, proto,

allocKind, TenuredObject);

if (!fun)

return false;

script = nullptr;

}

if (firstword & IsLazy) {

if (!XDRLazyScript(xdr, enclosingScope, enclosingScript, fun, &lazy))

return false;

} else {

if (!XDRScript(xdr, enclosingScope, enclosingScript, fun, &script))

return false;

}

if (mode == XDR_DECODE) {

fun->setArgCount(flagsword >> 16);

fun->setFlags(uint16_t(flagsword));

fun->initAtom(atom);

if (firstword & IsLazy) {

MOZ_ASSERT(fun->lazyScript() == lazy);

} else {

MOZ_ASSERT(fun->nonLazyScript() == script);

MOZ_ASSERT(fun->nargs() == script->bindings.numArgs());

}

bool singleton = firstword & HasSingletonType;

if (!JSFunction::setTypeForScriptedFunction(cx, fun, singleton))

return false;

objp.set(fun);

}

return true;

}

template bool

js::XDRInterpretedFunction(XDRState<XDR_ENCODE>*, HandleObject, HandleScript, MutableHandleFunction);

template bool

js::XDRInterpretedFunction(XDRState<XDR_DECODE>*, HandleObject, HandleScript, MutableHandleFunction);

/* ES6 (04-25-16) 19.2.3.6 Function.prototype [ @@hasInstance ] */

bool

js::fun_symbolHasInstance(JSContext* cx, unsigned argc, Value* vp)

{

CallArgs args = CallArgsFromVp(argc, vp);

if (args.length() < 1) {

args.rval().setBoolean(false);

return true;

}

/* Step 1. */

HandleValue func = args.thisv();

// Primitives are non-callable and will always return false from

// OrdinaryHasInstance.

if (!func.isObject()) {

args.rval().setBoolean(false);

return true;

}

RootedObject obj(cx, &func.toObject());

RootedValue v(cx, args[0]);

/* Step 2. */

bool result;

if (!OrdinaryHasInstance(cx, obj, &v, &result))

return false;

args.rval().setBoolean(result);

return true;

}

/*

* ES6 (4-25-16) 7.3.19 OrdinaryHasInstance

*/

bool

js::OrdinaryHasInstance(JSContext* cx, HandleObject objArg, MutableHandleValue v, bool* bp)

{

RootedObject obj(cx, objArg);

/* Step 1. */

if (!obj->isCallable()) {

*bp = false;

return true;

}

/* Step 2. */

if (obj->is<JSFunction>() && obj->isBoundFunction()) {

/* Steps 2a-b. */

obj = obj->as<JSFunction>().getBoundFunctionTarget();

return InstanceOfOperator(cx, obj, v, bp);

}

/* Step 3. */

if (!v.isObject()) {

*bp = false;

return true;

}

/* Step 4. */

RootedValue pval(cx);

if (!GetProperty(cx, obj, obj, cx->names().prototype, &pval))

return false;

/* Step 5. */

if (pval.isPrimitive()) {

/*

* Throw a runtime error if instanceof is called on a function that

* has a non-object as its .prototype value.

*/

RootedValue val(cx, ObjectValue(*obj));

ReportValueError(cx, JSMSG_BAD_PROTOTYPE, -1, val, nullptr);

return false;

}

/* Step 6. */

RootedObject pobj(cx, &pval.toObject());

bool isDelegate;

if (!IsDelegate(cx, pobj, v, &isDelegate))

return false;

*bp = isDelegate;

return true;

}

inline void

JSFunction::trace(JSTracer* trc)

{

if (isExtended()) {

TraceRange(trc, ArrayLength(toExtended()->extendedSlots),

(HeapValue*)toExtended()->extendedSlots, "nativeReserved");

}

if (atom_)

TraceEdge(trc, &atom_, "atom");

if (isInterpreted()) {

// Functions can be be marked as interpreted despite having no script

// yet at some points when parsing, and can be lazy with no lazy script

// for self-hosted code.

if (hasScript() && !hasUncompiledScript())

TraceManuallyBarrieredEdge(trc, &u.i.s.script_, "script");

else if (isInterpretedLazy() && u.i.s.lazy_)

TraceManuallyBarrieredEdge(trc, &u.i.s.lazy_, "lazyScript");

if (!isBeingParsed() && u.i.env_)

TraceManuallyBarrieredEdge(trc, &u.i.env_, "fun_environment");

}

}

static void

fun_trace(JSTracer* trc, JSObject* obj)

{

obj->as<JSFunction>().trace(trc);

}

static bool

ThrowTypeError(JSContext* cx, unsigned argc, Value* vp)

{

ThrowTypeErrorBehavior(cx);

return false;

}

static JSObject*

CreateFunctionConstructor(JSContext* cx, JSProtoKey key)

{

Rooted<GlobalObject*> global(cx, cx->global());

RootedObject functionProto(cx, &global->getPrototype(JSProto_Function).toObject());

RootedObject functionCtor(cx,

NewFunctionWithProto(cx, Function, 1, JSFunction::NATIVE_CTOR,

nullptr, HandlePropertyName(cx->names().Function),

functionProto, AllocKind::FUNCTION, SingletonObject));

if (!functionCtor)

return nullptr;

return functionCtor;

}

static JSObject*

CreateFunctionPrototype(JSContext* cx, JSProtoKey key)

{

Rooted<GlobalObject*> self(cx, cx->global());

RootedObject objectProto(cx, &self->getPrototype(JSProto_Object).toObject());

/*

* Bizarrely, |Function.prototype| must be an interpreted function, so

* give it the guts to be one.

*/

JSObject* functionProto_ =

NewFunctionWithProto(cx, nullptr, 0, JSFunction::INTERPRETED,

self, nullptr, objectProto, AllocKind::FUNCTION,

SingletonObject);

if (!functionProto_)

return nullptr;

RootedFunction functionProto(cx, &functionProto_->as<JSFunction>());

functionProto->setIsFunctionPrototype();

const char* rawSource = "() {\n}";

size_t sourceLen = strlen(rawSource);

char16_t* source = InflateString(cx, rawSource, &sourceLen);

if (!source)

return nullptr;

ScriptSource* ss =

cx->new_<ScriptSource>();

if (!ss) {

js_free(source);

return nullptr;

}

ScriptSourceHolder ssHolder(ss);

ss->setSource(source, sourceLen);

CompileOptions options(cx);

options.setNoScriptRval(true)

.setVersion(JSVERSION_DEFAULT);

RootedScriptSource sourceObject(cx, ScriptSourceObject::create(cx, ss));

if (!sourceObject || !ScriptSourceObject::initFromOptions(cx, sourceObject, options))

return nullptr;

RootedScript script(cx, JSScript::Create(cx,

/* enclosingScope = */ nullptr,

/* savedCallerFun = */ false,

options,

sourceObject,

0,

ss->length()));

if (!script || !JSScript::fullyInitTrivial(cx, script))

return nullptr;

functionProto->initScript(script);

ObjectGroup* protoGroup = functionProto->getGroup(cx);

if (!protoGroup)

return nullptr;

protoGroup->setInterpretedFunction(functionProto);

script->setFunction(functionProto);

/*

* The default 'new' group of Function.prototype is required by type

* inference to have unknown properties, to simplify handling of e.g.

* NewFunctionClone.

*/

if (!JSObject::setNewGroupUnknown(cx, &JSFunction::class_, functionProto))

return nullptr;

// Construct the unique [[%ThrowTypeError%]] function object, used only for

// "callee" and "caller" accessors on strict mode arguments objects. (The

// spec also uses this for "arguments" and "caller" on various functions,

// but we're experimenting with implementing them using accessors on

// |Function.prototype| right now.)

//

// Note that we can't use NewFunction here, even though we want the normal

// Function.prototype for our proto, because we're still in the middle of

// creating that as far as the world is concerned, so things will get all

// confused.

RootedFunction throwTypeError(cx,

NewFunctionWithProto(cx, ThrowTypeError, 0, JSFunction::NATIVE_FUN,

nullptr, nullptr, functionProto, AllocKind::FUNCTION,

SingletonObject));

if (!throwTypeError || !PreventExtensions(cx, throwTypeError))

return nullptr;

self->setThrowTypeError(throwTypeError);

return functionProto;

}

const Class JSFunction::class_ = {

js_Function_str,

JSCLASS_HAS_CACHED_PROTO(JSProto_Function),

nullptr, /* addProperty */

nullptr, /* delProperty */

nullptr, /* getProperty */

nullptr, /* setProperty */

fun_enumerate,

fun_resolve,

fun_mayResolve,

nullptr, /* finalize */

nullptr, /* call */

nullptr,

nullptr, /* construct */

fun_trace,

{

CreateFunctionConstructor,

CreateFunctionPrototype,

nullptr,

nullptr,

function_methods,

function_properties

}

};

const Class* const js::FunctionClassPtr = &JSFunction::class_;

/* Find the body of a function (not including braces). */

bool

js::FindBody(JSContext* cx, HandleFunction fun, HandleLinearString src, size_t* bodyStart,

size_t* bodyEnd)

{

// We don't need principals, since those are only used for error reporting.

CompileOptions options(cx);

options.setFileAndLine("internal-findBody", 0);

// For asm.js modules, there's no script.

if (fun->hasScript())

options.setVersion(fun->nonLazyScript()->getVersion());

AutoKeepAtoms keepAtoms(cx->perThreadData);

AutoStableStringChars stableChars(cx);

if (!stableChars.initTwoByte(cx, src))

return false;

const mozilla::Range<const char16_t> srcChars = stableChars.twoByteRange();

TokenStream ts(cx, options, srcChars.start().get(), srcChars.length(), nullptr);

int nest = 0;

bool onward = true;

// Skip arguments list.

do {

TokenKind tt;

if (!ts.getToken(&tt))

return false;

switch (tt) {

case TOK_NAME:

case TOK_YIELD:

if (nest == 0)

onward = false;

break;

case TOK_LP:

nest++;

break;

case TOK_RP:

if (--nest == 0)

onward = false;

break;

default:

break;

}

} while (onward);

TokenKind tt;

if (!ts.getToken(&tt))

return false;

if (tt == TOK_ARROW) {

if (!ts.getToken(&tt))

return false;

}

bool braced = tt == TOK_LC;

MOZ_ASSERT_IF(fun->isExprBody(), !braced);

*bodyStart = ts.currentToken().pos.begin;

if (braced)

*bodyStart += 1;

mozilla::RangedPtr<const char16_t> end = srcChars.end();

if (end[-1] == '}') {

end--;

} else {

MOZ_ASSERT(!braced);

for (; unicode::IsSpaceOrBOM2(end[-1]); end--)

;

}

*bodyEnd = end - srcChars.start();

MOZ_ASSERT(*bodyStart <= *bodyEnd);

return true;

}

JSString*

js::FunctionToString(JSContext* cx, HandleFunction fun, bool lambdaParen)

{

if (fun->isInterpretedLazy() && !fun->getOrCreateScript(cx))

return nullptr;

if (IsAsmJSModule(fun))

return AsmJSModuleToString(cx, fun, !lambdaParen);

if (IsAsmJSFunction(fun))

return AsmJSFunctionToString(cx, fun);

StringBuffer out(cx);

RootedScript script(cx);

if (fun->hasScript()) {

script = fun->nonLazyScript();

if (script->isGeneratorExp()) {

if (!out.append("function genexp() {") ||

!out.append("\n [generator expression]\n") ||

!out.append("}"))

{

return nullptr;

}

return out.finishString();

}

}