/*

* Copyright (C) 2015-2021 Apple Inc. All rights reserved.

*

* Redistribution and use in source and binary forms, with or without

* modification, are permitted provided that the following conditions

* are met:

* 1. Redistributions of source code must retain the above copyright

* notice, this list of conditions and the following disclaimer.

* 2. Redistributions in binary form must reproduce the above copyright

* notice, this list of conditions and the following disclaimer in the

* documentation and/or other materials provided with the distribution.

*

* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY

* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR

* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,

* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,

* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR

* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY

* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

*/

#include "config.h"

#include "JSDollarVM.h"

#include "ArrayPrototype.h"

#include "BuiltinNames.h"

#include "CodeBlock.h"

#include "ControlFlowProfiler.h"

#include "DOMAttributeGetterSetter.h"

#include "DOMJITGetterSetter.h"

#include "Debugger.h"

#include "FrameTracers.h"

#include "FunctionCodeBlock.h"

#include "GetterSetter.h"

#include "JITSizeStatistics.h"

#include "JSArray.h"

#include "JSCInlines.h"

#include "JSONObject.h"

#include "JSString.h"

#include "LinkBuffer.h"

#include "Options.h"

#include "Parser.h"

#include "ProbeContext.h"

#include "ShadowChicken.h"

#include "Snippet.h"

#include "SnippetParams.h"

#include "TypeProfiler.h"

#include "TypeProfilerLog.h"

#include "VMInspector.h"

#include "VMTrapsInlines.h"

#include "WasmCapabilities.h"

#include <unicode/uversion.h>

#include <wtf/Atomics.h>

#include <wtf/CPUTime.h>

#include <wtf/DataLog.h>

#include <wtf/Language.h>

#include <wtf/ProcessID.h>

#include <wtf/StringPrintStream.h>

#include <wtf/unicode/icu/ICUHelpers.h>

#if !USE(SYSTEM_MALLOC)

#include <bmalloc/BPlatform.h>

#if BUSE(LIBPAS)

#ifndef PAS_BMALLOC

#define PAS_BMALLOC 1

#endif

#include <bmalloc/pas_debug_spectrum.h>

#include <bmalloc/pas_fd_stream.h>

#include <bmalloc/pas_heap_lock.h>

#endif

#endif

#if ENABLE(WEBASSEMBLY)

#include "JSWebAssemblyHelpers.h"

#include "WasmModuleInformation.h"

#include "WasmStreamingCompiler.h"

#include "WasmStreamingParser.h"

#endif

using namespace JSC;

IGNORE_WARNINGS_BEGIN("frame-address")

extern "C" void ctiMasmProbeTrampoline();

namespace JSC {

// This class is only here as a simple way to grant JSDollarVM friend privileges

// to all the classes that it needs special access to.

class JSDollarVMHelper {

public:

JSDollarVMHelper(VM& vm)

: m_vm(vm)

{ }

void updateVMStackLimits() { return m_vm.updateStackLimits(); };

VM& m_vm;

};

} // namespace JSC

namespace {

static JSC_DECLARE_HOST_FUNCTION(functionDOMJITGetterComplexEnableException);

static JSC_DECLARE_HOST_FUNCTION(functionDOMJITFunctionObjectWithTypeCheck);

static JSC_DECLARE_HOST_FUNCTION(functionDOMJITCheckJSCastObjectWithTypeCheck);

// We must RELEASE_ASSERT(Options::useDollarVM()) in all JSDollarVM functions

// that are non-trivial at an eye's glance. This includes (but is not limited to):

// constructors

// create() factory

// createStructure() factory

// finishCreation()

// HOST_CALL or operation functions

// Constructors and methods of utility and test classes

// lambda functions

//

// The way to do this RELEASE_ASSERT is with the DollarVMAssertScope below.

//

// The only exception are some constexpr constructors used for instantiating

// globals (since these must have trivial constructors) e.g. DOMJITAttribute.

// Instead, these constructors should always be ALWAYS_INLINE.

class JSDollarVMCallFrame : public JSNonFinalObject {

using Base = JSNonFinalObject;

public:

template<typename CellType, SubspaceAccess>

static CompleteSubspace* subspaceFor(VM& vm)

{

return &vm.cellSpace;

}

JSDollarVMCallFrame(VM& vm, Structure* structure)

: Base(vm, structure)

{

DollarVMAssertScope assertScope;

}

static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)

{

DollarVMAssertScope assertScope;

return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());

}

static JSDollarVMCallFrame* create(JSGlobalObject* globalObject, CallFrame* callFrame, unsigned requestedFrameIndex)

{

DollarVMAssertScope assertScope;

VM& vm = globalObject->vm();

Structure* structure = createStructure(vm, globalObject, jsNull());

JSDollarVMCallFrame* frame = new (NotNull, allocateCell<JSDollarVMCallFrame>(vm.heap)) JSDollarVMCallFrame(vm, structure);

frame->finishCreation(vm, callFrame, requestedFrameIndex);

return frame;

}

void finishCreation(VM& vm, CallFrame* callFrame, unsigned requestedFrameIndex)

{

DollarVMAssertScope assertScope;

Base::finishCreation(vm);

auto addProperty = [&] (VM& vm, const char* name, JSValue value) {

DollarVMAssertScope assertScope;

JSDollarVMCallFrame::addProperty(vm, name, value);

};

unsigned frameIndex = 0;

bool isValid = false;

callFrame->iterate(vm, [&] (StackVisitor& visitor) {

DollarVMAssertScope assertScope;

if (frameIndex++ != requestedFrameIndex)

return StackVisitor::Continue;

addProperty(vm, "name", jsString(vm, visitor->functionName()));

if (visitor->callee().isCell())

addProperty(vm, "callee", visitor->callee().asCell());

CodeBlock* codeBlock = visitor->codeBlock();

if (codeBlock) {

addProperty(vm, "codeBlock", codeBlock);

addProperty(vm, "unlinkedCodeBlock", codeBlock->unlinkedCodeBlock());

addProperty(vm, "executable", codeBlock->ownerExecutable());

}

isValid = true;

return StackVisitor::Done;

});

addProperty(vm, "valid", jsBoolean(isValid));

}

DECLARE_INFO;

private:

void addProperty(VM& vm, const char* name, JSValue value)

{

DollarVMAssertScope assertScope;

Identifier identifier = Identifier::fromString(vm, name);

putDirect(vm, identifier, value);

}

};

const ClassInfo JSDollarVMCallFrame::s_info = { "CallFrame", &Base::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(JSDollarVMCallFrame) };

class ElementHandleOwner;

class Root;

class Element : public JSNonFinalObject {

public:

Element(VM& vm, Structure* structure)

: Base(vm, structure)

{

DollarVMAssertScope assertScope;

}

typedef JSNonFinalObject Base;

template<typename CellType, SubspaceAccess>

static CompleteSubspace* subspaceFor(VM& vm)

{

return &vm.cellSpace;

}

Root* root() const { return m_root.get(); }

void setRoot(VM& vm, Root* root) { m_root.set(vm, this, root); }

static Element* create(VM& vm, JSGlobalObject* globalObject, Root* root)

{

DollarVMAssertScope assertScope;

Structure* structure = createStructure(vm, globalObject, jsNull());

Element* element = new (NotNull, allocateCell<Element>(vm.heap)) Element(vm, structure);

element->finishCreation(vm, root);

return element;

}

void finishCreation(VM&, Root*);

DECLARE_VISIT_CHILDREN;

static ElementHandleOwner* handleOwner();

static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)

{

DollarVMAssertScope assertScope;

return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());

}

DECLARE_INFO;

private:

WriteBarrier<Root> m_root;

};

template<typename Visitor>

void Element::visitChildrenImpl(JSCell* cell, Visitor& visitor)

{

DollarVMAssertScope assertScope;

Element* thisObject = jsCast<Element*>(cell);

ASSERT_GC_OBJECT_INHERITS(thisObject, info());

Base::visitChildren(thisObject, visitor);

visitor.append(thisObject->m_root);

}

DEFINE_VISIT_CHILDREN(Element);

class ElementHandleOwner final : public WeakHandleOwner {

WTF_MAKE_FAST_ALLOCATED;

public:

bool isReachableFromOpaqueRoots(JSC::Handle<JSC::Unknown> handle, void*, AbstractSlotVisitor& visitor, const char** reason) final

{

DollarVMAssertScope assertScope;

if (UNLIKELY(reason))

*reason = "JSC::Element is opaque root";

Element* element = jsCast<Element*>(handle.slot()->asCell());

return visitor.containsOpaqueRoot(element->root());

}

};

class Root final : public JSDestructibleObject {

public:

using Base = JSDestructibleObject;

template<typename CellType, SubspaceAccess>

static CompleteSubspace* subspaceFor(VM& vm)

{

return &vm.destructibleObjectSpace;

}

Root(VM& vm, Structure* structure)

: Base(vm, structure)

{

DollarVMAssertScope assertScope;

}

Element* element()

{

return m_element.get();

}

void setElement(Element* element)

{

DollarVMAssertScope assertScope;

Weak<Element> newElement(element, Element::handleOwner());

m_element.swap(newElement);

}

static Root* create(VM& vm, JSGlobalObject* globalObject)

{

DollarVMAssertScope assertScope;

Structure* structure = createStructure(vm, globalObject, jsNull());

Root* root = new (NotNull, allocateCell<Root>(vm.heap)) Root(vm, structure);

root->finishCreation(vm);

return root;

}

DECLARE_INFO;

static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)

{

DollarVMAssertScope assertScope;

return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());

}

DECLARE_VISIT_CHILDREN;

private:

Weak<Element> m_element;

};

template<typename Visitor>

void Root::visitChildrenImpl(JSCell* thisObject, Visitor& visitor)

{

DollarVMAssertScope assertScope;

ASSERT_GC_OBJECT_INHERITS(thisObject, info());

Base::visitChildren(thisObject, visitor);

visitor.addOpaqueRoot(thisObject);

}

DEFINE_VISIT_CHILDREN(Root);

class SimpleObject : public JSNonFinalObject {

public:

SimpleObject(VM& vm, Structure* structure)

: Base(vm, structure)

{

DollarVMAssertScope assertScope;

}

typedef JSNonFinalObject Base;

template<typename CellType, SubspaceAccess>

static CompleteSubspace* subspaceFor(VM& vm)

{

return &vm.cellSpace;

}

static SimpleObject* create(VM& vm, JSGlobalObject* globalObject)

{

DollarVMAssertScope assertScope;

Structure* structure = createStructure(vm, globalObject, jsNull());

SimpleObject* simpleObject = new (NotNull, allocateCell<SimpleObject>(vm.heap)) SimpleObject(vm, structure);

simpleObject->finishCreation(vm);

return simpleObject;

}

DECLARE_VISIT_CHILDREN;

static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)

{

DollarVMAssertScope assertScope;

return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());

}

JSValue hiddenValue()

{

return m_hiddenValue.get();

}

void setHiddenValue(VM& vm, JSValue value)

{

ASSERT(value.isCell());

m_hiddenValue.set(vm, this, value);

}

static CallData getConstructData(JSCell*)

{

CallData constructData;

constructData.type = CallData::Type::Native;

constructData.native.function = callHostFunctionAsConstructor;

return constructData;

}

DECLARE_INFO;

private:

WriteBarrier<JSC::Unknown> m_hiddenValue;

};

template<typename Visitor>

void SimpleObject::visitChildrenImpl(JSCell* cell, Visitor& visitor)

{

DollarVMAssertScope assertScope;

SimpleObject* thisObject = jsCast<SimpleObject*>(cell);

ASSERT_GC_OBJECT_INHERITS(thisObject, info());

Base::visitChildren(thisObject, visitor);

visitor.append(thisObject->m_hiddenValue);

}

DEFINE_VISIT_CHILDREN(SimpleObject);

class ImpureGetter : public JSNonFinalObject {

public:

ImpureGetter(VM& vm, Structure* structure)

: Base(vm, structure)

{

DollarVMAssertScope assertScope;

}

DECLARE_INFO;

typedef JSNonFinalObject Base;

static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::GetOwnPropertySlotIsImpure | JSC::OverridesGetOwnPropertySlot;

template<typename CellType, SubspaceAccess>

static CompleteSubspace* subspaceFor(VM& vm)

{

return &vm.cellSpace;

}

static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)

{

DollarVMAssertScope assertScope;

return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());

}

static ImpureGetter* create(VM& vm, Structure* structure, JSObject* delegate)

{

DollarVMAssertScope assertScope;

ImpureGetter* getter = new (NotNull, allocateCell<ImpureGetter>(vm.heap)) ImpureGetter(vm, structure);

getter->finishCreation(vm, delegate);

return getter;

}

void finishCreation(VM& vm, JSObject* delegate)

{

DollarVMAssertScope assertScope;

Base::finishCreation(vm);

if (delegate)

m_delegate.set(vm, this, delegate);

}

static bool getOwnPropertySlot(JSObject* object, JSGlobalObject* globalObject, PropertyName name, PropertySlot& slot)

{

DollarVMAssertScope assertScope;

VM& vm = globalObject->vm();

auto scope = DECLARE_THROW_SCOPE(vm);

ImpureGetter* thisObject = jsCast<ImpureGetter*>(object);

if (thisObject->m_delegate) {

if (thisObject->m_delegate->getPropertySlot(globalObject, name, slot))

return true;

RETURN_IF_EXCEPTION(scope, false);

}

return Base::getOwnPropertySlot(object, globalObject, name, slot);

}

DECLARE_VISIT_CHILDREN;

void setDelegate(VM& vm, JSObject* delegate)

{

m_delegate.set(vm, this, delegate);

}

private:

WriteBarrier<JSObject> m_delegate;

};

template<typename Visitor>

void ImpureGetter::visitChildrenImpl(JSCell* cell, Visitor& visitor)

{

DollarVMAssertScope assertScope;

ASSERT_GC_OBJECT_INHERITS(cell, info());

Base::visitChildren(cell, visitor);

ImpureGetter* thisObject = jsCast<ImpureGetter*>(cell);

visitor.append(thisObject->m_delegate);

}

DEFINE_VISIT_CHILDREN(ImpureGetter);

static JSC_DECLARE_CUSTOM_GETTER(customGetterValueGetter);

static JSC_DECLARE_CUSTOM_GETTER(customGetterAcessorGetter);

class CustomGetter : public JSNonFinalObject {

public:

CustomGetter(VM& vm, Structure* structure)

: Base(vm, structure)

{

DollarVMAssertScope assertScope;

}

DECLARE_INFO;

typedef JSNonFinalObject Base;

static constexpr unsigned StructureFlags = Base::StructureFlags | JSC::OverridesGetOwnPropertySlot;

template<typename CellType, SubspaceAccess>

static CompleteSubspace* subspaceFor(VM& vm)

{

return &vm.cellSpace;

}

static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)

{

DollarVMAssertScope assertScope;

return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());

}

static CustomGetter* create(VM& vm, Structure* structure)

{

DollarVMAssertScope assertScope;

CustomGetter* getter = new (NotNull, allocateCell<CustomGetter>(vm.heap)) CustomGetter(vm, structure);

getter->finishCreation(vm);

return getter;

}

static bool getOwnPropertySlot(JSObject* object, JSGlobalObject* globalObject, PropertyName propertyName, PropertySlot& slot)

{

DollarVMAssertScope assertScope;

VM& vm = globalObject->vm();

CustomGetter* thisObject = jsCast<CustomGetter*>(object);

if (propertyName == PropertyName(Identifier::fromString(vm, "customGetter"))) {

slot.setCacheableCustom(thisObject, PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum, customGetterValueGetter);

return true;

}

if (propertyName == PropertyName(Identifier::fromString(vm, "customGetterAccessor"))) {

slot.setCacheableCustom(thisObject, PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum | PropertyAttribute::CustomAccessor, customGetterAcessorGetter);

return true;

}

return JSObject::getOwnPropertySlot(thisObject, globalObject, propertyName, slot);

}

};

JSC_DEFINE_CUSTOM_GETTER(customGetterValueGetter, (JSGlobalObject* globalObject, EncodedJSValue thisValue, PropertyName))

{

DollarVMAssertScope assertScope;

VM& vm = globalObject->vm();

auto scope = DECLARE_THROW_SCOPE(vm);

CustomGetter* thisObject = jsDynamicCast<CustomGetter*>(vm, JSValue::decode(thisValue));

if (!thisObject)

return throwVMTypeError(globalObject, scope);

bool shouldThrow = thisObject->get(globalObject, PropertyName(Identifier::fromString(vm, "shouldThrow"))).toBoolean(globalObject);

RETURN_IF_EXCEPTION(scope, encodedJSValue());

if (shouldThrow)

return throwVMTypeError(globalObject, scope);

return JSValue::encode(jsNumber(100));

}

JSC_DEFINE_CUSTOM_GETTER(customGetterAcessorGetter, (JSGlobalObject* globalObject, EncodedJSValue thisValue, PropertyName))

{

DollarVMAssertScope assertScope;

VM& vm = globalObject->vm();

auto scope = DECLARE_THROW_SCOPE(vm);

JSObject* thisObject = jsDynamicCast<JSObject*>(vm, JSValue::decode(thisValue));

if (!thisObject)

return throwVMTypeError(globalObject, scope);

bool shouldThrow = thisObject->get(globalObject, PropertyName(Identifier::fromString(vm, "shouldThrow"))).toBoolean(globalObject);

RETURN_IF_EXCEPTION(scope, encodedJSValue());

if (shouldThrow)

return throwVMTypeError(globalObject, scope);

return JSValue::encode(jsNumber(100));

}

static JSC_DECLARE_CUSTOM_GETTER(runtimeArrayLengthGetter);

class RuntimeArray : public JSArray {

public:

typedef JSArray Base;

static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero;

IGNORE_WARNINGS_BEGIN("unused-const-variable")

static constexpr bool needsDestruction = false;

IGNORE_WARNINGS_END

template<typename CellType, SubspaceAccess>

static CompleteSubspace* subspaceFor(VM& vm)

{

return &vm.cellSpace;

}

static RuntimeArray* create(JSGlobalObject* globalObject, CallFrame* callFrame)

{

DollarVMAssertScope assertScope;

VM& vm = globalObject->vm();

Structure* structure = createStructure(vm, globalObject, createPrototype(vm, globalObject));

RuntimeArray* runtimeArray = new (NotNull, allocateCell<RuntimeArray>(vm.heap)) RuntimeArray(globalObject, structure);

runtimeArray->finishCreation(globalObject, callFrame);

vm.heap.addFinalizer(runtimeArray, destroy);

return runtimeArray;

}

~RuntimeArray() { }

static void destroy(JSCell* cell)

{

DollarVMAssertScope assertScope;

static_cast<RuntimeArray*>(cell)->RuntimeArray::~RuntimeArray();

}

static bool getOwnPropertySlot(JSObject* object, JSGlobalObject* globalObject, PropertyName propertyName, PropertySlot& slot)

{

DollarVMAssertScope assertScope;

VM& vm = globalObject->vm();

RuntimeArray* thisObject = jsCast<RuntimeArray*>(object);

if (propertyName == vm.propertyNames->length) {

slot.setCacheableCustom(thisObject, PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum, runtimeArrayLengthGetter);

return true;

}

std::optional<uint32_t> index = parseIndex(propertyName);

if (index && index.value() < thisObject->getLength()) {

slot.setValue(thisObject, PropertyAttribute::DontDelete | PropertyAttribute::DontEnum, jsNumber(thisObject->m_vector[index.value()]));

return true;

}

return JSObject::getOwnPropertySlot(thisObject, globalObject, propertyName, slot);

}

static bool getOwnPropertySlotByIndex(JSObject* object, JSGlobalObject* globalObject, unsigned index, PropertySlot& slot)

{

DollarVMAssertScope assertScope;

RuntimeArray* thisObject = jsCast<RuntimeArray*>(object);

if (index < thisObject->getLength()) {

slot.setValue(thisObject, PropertyAttribute::DontDelete | PropertyAttribute::DontEnum, jsNumber(thisObject->m_vector[index]));

return true;

}

return JSObject::getOwnPropertySlotByIndex(thisObject, globalObject, index, slot);

}

static NO_RETURN_DUE_TO_CRASH bool put(JSCell*, JSGlobalObject*, PropertyName, JSValue, PutPropertySlot&)

{

RELEASE_ASSERT_NOT_REACHED();

}

static NO_RETURN_DUE_TO_CRASH bool deleteProperty(JSCell*, JSGlobalObject*, PropertyName, DeletePropertySlot&)

{

RELEASE_ASSERT_NOT_REACHED();

}

unsigned getLength() const { return m_vector.size(); }

DECLARE_INFO;

static ArrayPrototype* createPrototype(VM&, JSGlobalObject* globalObject)

{

DollarVMAssertScope assertScope;

return globalObject->arrayPrototype();

}

static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)

{

DollarVMAssertScope assertScope;

return Structure::create(vm, globalObject, prototype, TypeInfo(DerivedArrayType, StructureFlags), info(), ArrayClass);

}

protected:

void finishCreation(JSGlobalObject* globalObject, CallFrame* callFrame)

{

DollarVMAssertScope assertScope;

VM& vm = globalObject->vm();

Base::finishCreation(vm);

ASSERT(inherits(vm, info()));

for (size_t i = 0; i < callFrame->argumentCount(); i++)

m_vector.append(callFrame->argument(i).toInt32(globalObject));

}

private:

RuntimeArray(JSGlobalObject* globalObject, Structure* structure)

: JSArray(globalObject->vm(), structure, nullptr)

{

DollarVMAssertScope assertScope;

}

Vector<int> m_vector;

};

JSC_DEFINE_CUSTOM_GETTER(runtimeArrayLengthGetter, (JSGlobalObject* globalObject, EncodedJSValue thisValue, PropertyName))

{

DollarVMAssertScope assertScope;

VM& vm = globalObject->vm();

auto scope = DECLARE_THROW_SCOPE(vm);

RuntimeArray* thisObject = jsDynamicCast<RuntimeArray*>(vm, JSValue::decode(thisValue));

if (!thisObject)

return throwVMTypeError(globalObject, scope);

return JSValue::encode(jsNumber(thisObject->getLength()));

}

static JSC_DECLARE_CUSTOM_GETTER(testStaticAccessorGetter);

static JSC_DECLARE_CUSTOM_SETTER(testStaticAccessorPutter);

JSC_DEFINE_CUSTOM_GETTER(testStaticAccessorGetter, (JSGlobalObject* globalObject, EncodedJSValue thisValue, PropertyName))

{

DollarVMAssertScope assertScope;

VM& vm = globalObject->vm();

auto scope = DECLARE_THROW_SCOPE(vm);

JSObject* thisObject = jsDynamicCast<JSObject*>(vm, JSValue::decode(thisValue));

if (!thisObject)

return throwVMTypeError(globalObject, scope);

if (JSValue result = thisObject->getDirect(vm, PropertyName(Identifier::fromString(vm, "testField"))))

return JSValue::encode(result);

return JSValue::encode(jsUndefined());

}

JSC_DEFINE_CUSTOM_SETTER(testStaticAccessorPutter, (JSGlobalObject* globalObject, EncodedJSValue thisValue, EncodedJSValue value, PropertyName))

{

DollarVMAssertScope assertScope;

VM& vm = globalObject->vm();

auto scope = DECLARE_THROW_SCOPE(vm);

JSValue receiver = JSValue::decode(thisValue);

JSObject* thisObject = receiver.isObject() ? asObject(receiver) : receiver.synthesizePrototype(globalObject);

RETURN_IF_EXCEPTION(scope, false);

RELEASE_ASSERT(thisObject);

return thisObject->putDirect(vm, PropertyName(Identifier::fromString(vm, "testField")), JSValue::decode(value));

}

static const struct CompactHashIndex staticCustomAccessorTableIndex[9] = {

{ -1, -1 },

{ -1, -1 },

{ 2, -1 },

{ -1, -1 },

{ 0, 8 },

{ -1, -1 },

{ -1, -1 },

{ -1, -1 },

{ 1, -1 },

};

static const struct HashTableValue staticCustomAccessorTableValues[3] = {

{ "testStaticAccessor", static_cast<unsigned>(PropertyAttribute::CustomAccessor), NoIntrinsic, { (intptr_t)static_cast<PropertySlot::GetValueFunc>(testStaticAccessorGetter), (intptr_t)static_cast<PutPropertySlot::PutValueFunc>(testStaticAccessorPutter) } },

{ "testStaticAccessorDontEnum", PropertyAttribute::CustomAccessor | PropertyAttribute::DontEnum, NoIntrinsic, { (intptr_t)static_cast<GetValueFunc>(testStaticAccessorGetter), (intptr_t)static_cast<PutValueFunc>(testStaticAccessorPutter) } },

{ "testStaticAccessorReadOnly", PropertyAttribute::CustomAccessor | PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly, NoIntrinsic, { (intptr_t)static_cast<GetValueFunc>(testStaticAccessorGetter), 0 } },

};

static const struct HashTable staticCustomAccessorTable =

{ 3, 7, true, nullptr, staticCustomAccessorTableValues, staticCustomAccessorTableIndex };

class StaticCustomAccessor : public JSNonFinalObject {

using Base = JSNonFinalObject;

public:

StaticCustomAccessor(VM& vm, Structure* structure)

: Base(vm, structure)

{

DollarVMAssertScope assertScope;

}

DECLARE_INFO;

static constexpr unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable | OverridesGetOwnPropertySlot;

template<typename CellType, SubspaceAccess>

static CompleteSubspace* subspaceFor(VM& vm)

{

return &vm.cellSpace;

}

static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)

{

DollarVMAssertScope assertScope;

return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());

}

static StaticCustomAccessor* create(VM& vm, Structure* structure)

{

DollarVMAssertScope assertScope;

StaticCustomAccessor* accessor = new (NotNull, allocateCell<StaticCustomAccessor>(vm.heap)) StaticCustomAccessor(vm, structure);

accessor->finishCreation(vm);

return accessor;

}

static bool getOwnPropertySlot(JSObject* thisObject, JSGlobalObject* globalObject, PropertyName propertyName, PropertySlot& slot)

{

if (String(propertyName.uid()) == "thinAirCustomGetter") {

slot.setCacheableCustom(thisObject, PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum | PropertyAttribute::CustomAccessor, testStaticAccessorGetter);

return true;

}

return JSNonFinalObject::getOwnPropertySlot(thisObject, globalObject, propertyName, slot);

}

};

static JSC_DECLARE_CUSTOM_GETTER(testStaticValueGetter);

static JSC_DECLARE_CUSTOM_SETTER(testStaticValuePutter);

static JSC_DECLARE_CUSTOM_SETTER(testStaticValuePutterSetFlag);

JSC_DEFINE_CUSTOM_GETTER(testStaticValueGetter, (JSGlobalObject*, EncodedJSValue, PropertyName))

{

DollarVMAssertScope assertScope;

return JSValue::encode(jsUndefined());

}

JSC_DEFINE_CUSTOM_SETTER(testStaticValuePutter, (JSGlobalObject* globalObject, EncodedJSValue thisValue, EncodedJSValue value, PropertyName))

{

DollarVMAssertScope assertScope;

VM& vm = globalObject->vm();

auto scope = DECLARE_THROW_SCOPE(vm);

JSObject* thisObject = jsDynamicCast<JSObject*>(vm, JSValue::decode(thisValue));

if (!thisObject)

return throwVMTypeError(globalObject, scope);

return thisObject->putDirect(vm, PropertyName(Identifier::fromString(vm, "testStaticValue")), JSValue::decode(value));

}

JSC_DEFINE_CUSTOM_SETTER(testStaticValuePutterSetFlag, (JSGlobalObject* globalObject, EncodedJSValue thisValue, EncodedJSValue, PropertyName))

{

DollarVMAssertScope assertScope;

VM& vm = globalObject->vm();

auto scope = DECLARE_THROW_SCOPE(vm);

JSObject* thisObject = jsDynamicCast<JSObject*>(vm, JSValue::decode(thisValue));

if (!thisObject)

return throwVMTypeError(globalObject, scope);

return thisObject->putDirect(vm, PropertyName(Identifier::fromString(vm, "testStaticValueSetterCalled")), jsBoolean(true));

}

static const struct CompactHashIndex staticCustomValueTableIndex[8] = {

{ 1, -1 },

{ -1, -1 },

{ -1, -1 },

{ -1, -1 },

{ 3, -1 },

{ 2, -1 },

{ 0, -1 },

{ -1, -1 },

};

static const struct HashTableValue staticCustomValueTableValues[4] = {

{ "testStaticValue", static_cast<unsigned>(PropertyAttribute::CustomValue), NoIntrinsic, { (intptr_t)static_cast<GetValueFunc>(testStaticValueGetter), (intptr_t)static_cast<PutValueFunc>(testStaticValuePutter) } },

{ "testStaticValueNoSetter", PropertyAttribute::CustomValue | PropertyAttribute::DontEnum, NoIntrinsic, { (intptr_t)static_cast<GetValueFunc>(testStaticValueGetter), 0 } },

{ "testStaticValueReadOnly", PropertyAttribute::CustomValue | PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly, NoIntrinsic, { (intptr_t)static_cast<GetValueFunc>(testStaticValueGetter), 0 } },

{ "testStaticValueSetFlag", static_cast<unsigned>(PropertyAttribute::CustomValue), NoIntrinsic, { (intptr_t)static_cast<GetValueFunc>(testStaticValueGetter), (intptr_t)static_cast<PutValueFunc>(testStaticValuePutterSetFlag) } },

};

static const struct HashTable staticCustomValueTable =

{ 4, 7, true, nullptr, staticCustomValueTableValues, staticCustomValueTableIndex };

class StaticCustomValue : public JSNonFinalObject {

using Base = JSNonFinalObject;

public:

StaticCustomValue(VM& vm, Structure* structure)

: Base(vm, structure)

{

DollarVMAssertScope assertScope;

}

DECLARE_INFO;

static constexpr unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;

template<typename CellType, SubspaceAccess>

static CompleteSubspace* subspaceFor(VM& vm)

{

return &vm.cellSpace;

}

static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)

{

DollarVMAssertScope assertScope;

return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());

}

static StaticCustomValue* create(VM& vm, Structure* structure)

{

DollarVMAssertScope assertScope;

StaticCustomValue* accessor = new (NotNull, allocateCell<StaticCustomValue>(vm.heap)) StaticCustomValue(vm, structure);

accessor->finishCreation(vm);

return accessor;

}

};

class ObjectDoingSideEffectPutWithoutCorrectSlotStatus : public JSNonFinalObject {

using Base = JSNonFinalObject;

static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesPut;

public:

template<typename CellType, SubspaceAccess>

static CompleteSubspace* subspaceFor(VM& vm)

{

return &vm.cellSpace;

}

ObjectDoingSideEffectPutWithoutCorrectSlotStatus(VM& vm, Structure* structure)

: Base(vm, structure)

{

DollarVMAssertScope assertScope;

}

DECLARE_INFO;

static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)

{

DollarVMAssertScope assertScope;

return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());

}

static ObjectDoingSideEffectPutWithoutCorrectSlotStatus* create(VM& vm, Structure* structure)

{

DollarVMAssertScope assertScope;

ObjectDoingSideEffectPutWithoutCorrectSlotStatus* accessor = new (NotNull, allocateCell<ObjectDoingSideEffectPutWithoutCorrectSlotStatus>(vm.heap)) ObjectDoingSideEffectPutWithoutCorrectSlotStatus(vm, structure);

accessor->finishCreation(vm);

return accessor;

}

static bool put(JSCell* cell, JSGlobalObject* globalObject, PropertyName propertyName, JSValue value, PutPropertySlot& slot)

{

DollarVMAssertScope assertScope;

auto* thisObject = jsCast<ObjectDoingSideEffectPutWithoutCorrectSlotStatus*>(cell);

auto throwScope = DECLARE_THROW_SCOPE(globalObject->vm());

auto* string = value.toString(globalObject);

RETURN_IF_EXCEPTION(throwScope, false);

RELEASE_AND_RETURN(throwScope, Base::put(thisObject, globalObject, propertyName, string, slot));

}

};

class DOMJITNode : public JSNonFinalObject {

public:

DOMJITNode(VM& vm, Structure* structure)

: Base(vm, structure)

{

DollarVMAssertScope assertScope;

}

DECLARE_INFO;

typedef JSNonFinalObject Base;

static constexpr unsigned StructureFlags = Base::StructureFlags;

template<typename CellType, SubspaceAccess>

static CompleteSubspace* subspaceFor(VM& vm)

{

return &vm.cellSpace;

}

static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)

{

DollarVMAssertScope assertScope;

return Structure::create(vm, globalObject, prototype, TypeInfo(JSC::JSType(LastJSCObjectType + 1), StructureFlags), info());

}

#if ENABLE(JIT)

static Ref<Snippet> checkSubClassSnippet()

{

DollarVMAssertScope assertScope;

Ref<Snippet> snippet = Snippet::create();

snippet->setGenerator([=] (CCallHelpers& jit, SnippetParams& params) {

DollarVMAssertScope assertScope;

CCallHelpers::JumpList failureCases;

failureCases.append(jit.branchIfNotType(params[0].gpr(), JSC::JSType(LastJSCObjectType + 1)));

return failureCases;

});

return snippet;

}

#endif

static DOMJITNode* create(VM& vm, Structure* structure)

{

DollarVMAssertScope assertScope;

DOMJITNode* getter = new (NotNull, allocateCell<DOMJITNode>(vm.heap)) DOMJITNode(vm, structure);

getter->finishCreation(vm);

return getter;

}

int32_t value() const

{

return m_value;

}

static ptrdiff_t offsetOfValue() { return OBJECT_OFFSETOF(DOMJITNode, m_value); }

private:

int32_t m_value { 42 };

};

static JSC_DECLARE_CUSTOM_GETTER(domJITGetterCustomGetter);

extern "C" { static JSC_DECLARE_JIT_OPERATION_WITHOUT_WTF_INTERNAL(domJITGetterSlowCall, EncodedJSValue, (JSGlobalObject*, void*)); }

class DOMJITGetter : public DOMJITNode {

public:

DOMJITGetter(VM& vm, Structure* structure)

: Base(vm, structure)