/*

* Copyright (c) Facebook, Inc. and its affiliates.

*

* This source code is licensed under the MIT license found in the

* LICENSE file in the root directory of this source tree.

*/

#define DEBUG_TYPE "vm"

#include "hermes/VM/Interpreter.h"

#include "hermes/VM/Runtime.h"

#include "hermes/Inst/InstDecode.h"

#include "hermes/Support/Conversions.h"

#include "hermes/Support/SlowAssert.h"

#include "hermes/Support/Statistic.h"

#include "hermes/VM/Callable.h"

#include "hermes/VM/CodeBlock.h"

#include "hermes/VM/HandleRootOwner-inline.h"

#include "hermes/VM/JIT/JIT.h"

#include "hermes/VM/JSArray.h"

#include "hermes/VM/JSError.h"

#include "hermes/VM/JSGenerator.h"

#include "hermes/VM/JSProxy.h"

#include "hermes/VM/JSRegExp.h"

#include "hermes/VM/Operations.h"

#include "hermes/VM/Profiler.h"

#include "hermes/VM/Profiler/CodeCoverageProfiler.h"

#include "hermes/VM/Runtime-inline.h"

#include "hermes/VM/RuntimeModule-inline.h"

#include "hermes/VM/StackFrame-inline.h"

#include "hermes/VM/StringPrimitive.h"

#include "hermes/VM/StringView.h"

#include "llvh/ADT/SmallSet.h"

#include "llvh/Support/Debug.h"

#include "llvh/Support/Format.h"

#include "llvh/Support/raw_ostream.h"

#include "Interpreter-internal.h"

using llvh::dbgs;

using namespace hermes::inst;

HERMES_SLOW_STATISTIC(

NumGetById,

"NumGetById: Number of property 'read by id' accesses");

HERMES_SLOW_STATISTIC(

NumGetByIdCacheHits,

"NumGetByIdCacheHits: Number of property 'read by id' cache hits");

HERMES_SLOW_STATISTIC(

NumGetByIdProtoHits,

"NumGetByIdProtoHits: Number of property 'read by id' cache hits for the prototype");

HERMES_SLOW_STATISTIC(

NumGetByIdCacheEvicts,

"NumGetByIdCacheEvicts: Number of property 'read by id' cache evictions");

HERMES_SLOW_STATISTIC(

NumGetByIdFastPaths,

"NumGetByIdFastPaths: Number of property 'read by id' fast paths");

HERMES_SLOW_STATISTIC(

NumGetByIdAccessor,

"NumGetByIdAccessor: Number of property 'read by id' accessors");

HERMES_SLOW_STATISTIC(

NumGetByIdProto,

"NumGetByIdProto: Number of property 'read by id' in the prototype chain");

HERMES_SLOW_STATISTIC(

NumGetByIdNotFound,

"NumGetByIdNotFound: Number of property 'read by id' not found");

HERMES_SLOW_STATISTIC(

NumGetByIdTransient,

"NumGetByIdTransient: Number of property 'read by id' of non-objects");

HERMES_SLOW_STATISTIC(

NumGetByIdDict,

"NumGetByIdDict: Number of property 'read by id' of dictionaries");

HERMES_SLOW_STATISTIC(

NumGetByIdSlow,

"NumGetByIdSlow: Number of property 'read by id' slow path");

HERMES_SLOW_STATISTIC(

NumPutById,

"NumPutById: Number of property 'write by id' accesses");

HERMES_SLOW_STATISTIC(

NumPutByIdCacheHits,

"NumPutByIdCacheHits: Number of property 'write by id' cache hits");

HERMES_SLOW_STATISTIC(

NumPutByIdCacheEvicts,

"NumPutByIdCacheEvicts: Number of property 'write by id' cache evictions");

HERMES_SLOW_STATISTIC(

NumPutByIdFastPaths,

"NumPutByIdFastPaths: Number of property 'write by id' fast paths");

HERMES_SLOW_STATISTIC(

NumPutByIdTransient,

"NumPutByIdTransient: Number of property 'write by id' to non-objects");

HERMES_SLOW_STATISTIC(

NumNativeFunctionCalls,

"NumNativeFunctionCalls: Number of native function calls");

HERMES_SLOW_STATISTIC(

NumBoundFunctionCalls,

"NumBoundCalls: Number of bound function calls");

// Ensure that instructions declared as having matching layouts actually do.

#include "InstLayout.inc"

#if defined(HERMESVM_PROFILER_EXTERN)

// External profiler mode wraps calls to each JS function with a unique native

// function that recusively calls the interpreter. See Profiler.{h,cpp} for how

// these symbols are subsequently patched with JS function names.

#define INTERP_WRAPPER(name) \

__attribute__((__noinline__)) static llvh::CallResult<llvh::HermesValue> \

name(hermes::vm::Runtime *runtime, hermes::vm::CodeBlock *newCodeBlock) { \

return runtime->interpretFunctionImpl(newCodeBlock); \

}

PROFILER_SYMBOLS(INTERP_WRAPPER)

#endif

namespace hermes {

namespace vm {

#if defined(HERMESVM_PROFILER_EXTERN)

typedef CallResult<HermesValue> (*WrapperFunc)(Runtime *, CodeBlock *);

#define LIST_ITEM(name) name,

static const WrapperFunc interpWrappers[] = {PROFILER_SYMBOLS(LIST_ITEM)};

#endif

/// Initialize the state of some internal variables based on the current

/// code block.

#define INIT_STATE_FOR_CODEBLOCK(codeBlock) \

do { \

strictMode = (codeBlock)->isStrictMode(); \

defaultPropOpFlags = DEFAULT_PROP_OP_FLAGS(strictMode); \

} while (0)

CallResult<PseudoHandle<JSGeneratorFunction>>

Interpreter::createGeneratorClosure(

Runtime *runtime,

RuntimeModule *runtimeModule,

unsigned funcIndex,

Handle<Environment> envHandle) {

return JSGeneratorFunction::create(

runtime,

runtimeModule->getDomain(runtime),

Handle<JSObject>::vmcast(&runtime->generatorFunctionPrototype),

envHandle,

runtimeModule->getCodeBlockMayAllocate(funcIndex));

}

CallResult<PseudoHandle<JSGenerator>> Interpreter::createGenerator_RJS(

Runtime *runtime,

RuntimeModule *runtimeModule,

unsigned funcIndex,

Handle<Environment> envHandle,

NativeArgs args) {

auto gifRes = GeneratorInnerFunction::create(

runtime,

runtimeModule->getDomain(runtime),

Handle<JSObject>::vmcast(&runtime->functionPrototype),

envHandle,

runtimeModule->getCodeBlockMayAllocate(funcIndex),

args);

if (LLVM_UNLIKELY(gifRes == ExecutionStatus::EXCEPTION)) {

return ExecutionStatus::EXCEPTION;

}

auto generatorFunction = runtime->makeHandle(vmcast<JSGeneratorFunction>(

runtime->getCurrentFrame().getCalleeClosure()));

auto prototypeProp = JSObject::getNamed_RJS(

generatorFunction,

runtime,

Predefined::getSymbolID(Predefined::prototype));

if (LLVM_UNLIKELY(prototypeProp == ExecutionStatus::EXCEPTION)) {

return ExecutionStatus::EXCEPTION;

}

Handle<JSObject> prototype = vmisa<JSObject>(prototypeProp->get())

? runtime->makeHandle<JSObject>(prototypeProp->get())

: Handle<JSObject>::vmcast(&runtime->generatorPrototype);

return JSGenerator::create(runtime, *gifRes, prototype);

}

CallResult<Handle<Arguments>> Interpreter::reifyArgumentsSlowPath(

Runtime *runtime,

Handle<Callable> curFunction,

bool strictMode) {

auto frame = runtime->getCurrentFrame();

uint32_t argCount = frame.getArgCount();

// Define each JavaScript argument.

auto argRes = Arguments::create(runtime, argCount, curFunction, strictMode);

if (LLVM_UNLIKELY(argRes == ExecutionStatus::EXCEPTION)) {

return ExecutionStatus::EXCEPTION;

}

Handle<Arguments> args = *argRes;

for (uint32_t argIndex = 0; argIndex < argCount; ++argIndex) {

Arguments::unsafeSetExistingElementAt(

*args, runtime, argIndex, frame.getArgRef(argIndex));

}

// The returned value should already be set from the create call.

return args;

}

CallResult<PseudoHandle<>> Interpreter::getArgumentsPropByValSlowPath_RJS(

Runtime *runtime,

PinnedHermesValue *lazyReg,

PinnedHermesValue *valueReg,

Handle<Callable> curFunction,

bool strictMode) {

auto frame = runtime->getCurrentFrame();

// If the arguments object has already been created.

if (!lazyReg->isUndefined()) {

// The arguments object has been created, so this is a regular property

// get.

assert(lazyReg->isObject() && "arguments lazy register is not an object");

return JSObject::getComputed_RJS(

Handle<JSObject>::vmcast(lazyReg), runtime, Handle<>(valueReg));

}

if (!valueReg->isSymbol()) {

// Attempt a fast path in the case that the key is not a symbol.

// If it is a symbol, force reification for now.

// Convert the value to a string.

auto strRes = toString_RJS(runtime, Handle<>(valueReg));

if (strRes == ExecutionStatus::EXCEPTION)

return ExecutionStatus::EXCEPTION;

auto strPrim = runtime->makeHandle(std::move(*strRes));

// Check if the string is a valid argument index.

if (auto index = toArrayIndex(runtime, strPrim)) {

if (*index < frame.getArgCount()) {

return createPseudoHandle(frame.getArgRef(*index));

}

auto objectPrototype =

Handle<JSObject>::vmcast(&runtime->objectPrototype);

// OK, they are requesting an index that either doesn't exist or is

// somewhere up in the prototype chain. Since we want to avoid reifying,

// check which it is:

MutableHandle<JSObject> inObject{runtime};

ComputedPropertyDescriptor desc;

JSObject::getComputedPrimitiveDescriptor(

objectPrototype, runtime, strPrim, inObject, desc);

// If we couldn't find the property, just return 'undefined'.

if (!inObject)

return createPseudoHandle(HermesValue::encodeUndefinedValue());

// If the property isn't an accessor, we can just return it without

// reifying.

if (!desc.flags.accessor) {

return createPseudoHandle(

JSObject::getComputedSlotValue(inObject.get(), runtime, desc));

}

}

// Are they requesting "arguments.length"?

if (runtime->symbolEqualsToStringPrim(

Predefined::getSymbolID(Predefined::length), *strPrim)) {

return createPseudoHandle(

HermesValue::encodeDoubleValue(frame.getArgCount()));

}

}

// Looking for an accessor or a property that needs reification.

auto argRes = reifyArgumentsSlowPath(runtime, curFunction, strictMode);

if (argRes == ExecutionStatus::EXCEPTION) {

return ExecutionStatus::EXCEPTION;

}

// Update the register with the reified value.

*lazyReg = argRes->getHermesValue();

// For simplicity, call ourselves again.

return getArgumentsPropByValSlowPath_RJS(

runtime, lazyReg, valueReg, curFunction, strictMode);

}

ExecutionStatus Interpreter::handleGetPNameList(

Runtime *runtime,

PinnedHermesValue *frameRegs,

const Inst *ip) {

if (O2REG(GetPNameList).isUndefined() || O2REG(GetPNameList).isNull()) {

// Set the iterator to be undefined value.

O1REG(GetPNameList) = HermesValue::encodeUndefinedValue();

return ExecutionStatus::RETURNED;

}

// Convert to object and store it back to the register.

auto res = toObject(runtime, Handle<>(&O2REG(GetPNameList)));

if (LLVM_UNLIKELY(res == ExecutionStatus::EXCEPTION)) {

return ExecutionStatus::EXCEPTION;

}

O2REG(GetPNameList) = res.getValue();

auto obj = runtime->makeMutableHandle(vmcast<JSObject>(res.getValue()));

uint32_t beginIndex;

uint32_t endIndex;

auto cr = getForInPropertyNames(runtime, obj, beginIndex, endIndex);

if (cr == ExecutionStatus::EXCEPTION) {

return ExecutionStatus::EXCEPTION;

}

auto arr = *cr;

O1REG(GetPNameList) = arr.getHermesValue();

O3REG(GetPNameList) = HermesValue::encodeNumberValue(beginIndex);

O4REG(GetPNameList) = HermesValue::encodeNumberValue(endIndex);

return ExecutionStatus::RETURNED;

}

CallResult<PseudoHandle<>> Interpreter::handleCallSlowPath(

Runtime *runtime,

PinnedHermesValue *callTarget) {

if (auto *native = dyn_vmcast<NativeFunction>(*callTarget)) {

++NumNativeFunctionCalls;

// Call the native function directly

return NativeFunction::_nativeCall(native, runtime);

} else if (auto *bound = dyn_vmcast<BoundFunction>(*callTarget)) {

++NumBoundFunctionCalls;

// Call the bound function.

return BoundFunction::_boundCall(bound, runtime->getCurrentIP(), runtime);

} else {

return runtime->raiseTypeErrorForValue(

Handle<>(callTarget), " is not a function");

}

}

inline PseudoHandle<> Interpreter::tryGetPrimitiveOwnPropertyById(

Runtime *runtime,

Handle<> base,

SymbolID id) {

if (base->isString() && id == Predefined::getSymbolID(Predefined::length)) {

return createPseudoHandle(

HermesValue::encodeNumberValue(base->getString()->getStringLength()));

}

return createPseudoHandle(HermesValue::encodeEmptyValue());

}

CallResult<PseudoHandle<>> Interpreter::getByIdTransient_RJS(

Runtime *runtime,

Handle<> base,

SymbolID id) {

// This is similar to what ES5.1 8.7.1 special [[Get]] internal

// method did, but that section doesn't exist in ES9 anymore.

// Instead, the [[Get]] Receiver argument serves a similar purpose.

// Fast path: try to get primitive own property directly first.

PseudoHandle<> valOpt = tryGetPrimitiveOwnPropertyById(runtime, base, id);

if (!valOpt->isEmpty()) {

return valOpt;

}

// get the property descriptor from primitive prototype without

// boxing with vm::toObject(). This is where any properties will

// be.

CallResult<Handle<JSObject>> primitivePrototypeResult =

getPrimitivePrototype(runtime, base);

if (primitivePrototypeResult == ExecutionStatus::EXCEPTION) {

// If an exception is thrown, likely we are trying to read property on

// undefined/null. Passing over the name of the property

// so that we could emit more meaningful error messages.

return amendPropAccessErrorMsgWithPropName(runtime, base, "read", id);

}

return JSObject::getNamedWithReceiver_RJS(

*primitivePrototypeResult, runtime, id, base);

}

PseudoHandle<> Interpreter::getByValTransientFast(

Runtime *runtime,

Handle<> base,

Handle<> nameHandle) {

if (base->isString()) {

// Handle most common fast path -- array index property for string

// primitive.

// Since primitive string cannot have index like property we can

// skip ObjectFlags::fastIndexProperties checking and directly

// checking index storage from StringPrimitive.

OptValue<uint32_t> arrayIndex = toArrayIndexFastPath(*nameHandle);

// Get character directly from primitive if arrayIndex is within range.

// Otherwise we need to fall back to prototype lookup.

if (arrayIndex &&

arrayIndex.getValue() < base->getString()->getStringLength()) {

return createPseudoHandle(

runtime

->getCharacterString(base->getString()->at(arrayIndex.getValue()))

.getHermesValue());

}

}

return createPseudoHandle(HermesValue::encodeEmptyValue());

}

CallResult<PseudoHandle<>> Interpreter::getByValTransient_RJS(

Runtime *runtime,

Handle<> base,

Handle<> name) {

// This is similar to what ES5.1 8.7.1 special [[Get]] internal

// method did, but that section doesn't exist in ES9 anymore.

// Instead, the [[Get]] Receiver argument serves a similar purpose.

// Optimization: check fast path first.

PseudoHandle<> fastRes = getByValTransientFast(runtime, base, name);

if (!fastRes->isEmpty()) {

return fastRes;

}

auto res = toObject(runtime, base);

if (LLVM_UNLIKELY(res == ExecutionStatus::EXCEPTION))

return ExecutionStatus::EXCEPTION;

return JSObject::getComputedWithReceiver_RJS(

runtime->makeHandle<JSObject>(res.getValue()), runtime, name, base);

}

static ExecutionStatus

transientObjectPutErrorMessage(Runtime *runtime, Handle<> base, SymbolID id) {

// Emit an error message that looks like:

// "Cannot create property '%{id}' on ${typeof base} '${String(base)}'".

StringView propName =

runtime->getIdentifierTable().getStringView(runtime, id);

Handle<StringPrimitive> baseType =

runtime->makeHandle(vmcast<StringPrimitive>(typeOf(runtime, base)));

StringView baseTypeAsString =

StringPrimitive::createStringView(runtime, baseType);

MutableHandle<StringPrimitive> valueAsString{runtime};

if (base->isSymbol()) {

// Special workaround for Symbol which can't be stringified.

auto str = symbolDescriptiveString(runtime, Handle<SymbolID>::vmcast(base));

if (str != ExecutionStatus::EXCEPTION) {

valueAsString = *str;

} else {

runtime->clearThrownValue();

valueAsString = StringPrimitive::createNoThrow(

runtime, "<<Exception occurred getting the value>>");

}

} else {

auto str = toString_RJS(runtime, base);

assert(

str != ExecutionStatus::EXCEPTION &&

"Primitives should be convertible to string without exceptions");

valueAsString = std::move(*str);

}

StringView valueAsStringPrintable =

StringPrimitive::createStringView(runtime, valueAsString);

SmallU16String<32> tmp1;

SmallU16String<32> tmp2;

return runtime->raiseTypeError(

TwineChar16("Cannot create property '") + propName + "' on " +

baseTypeAsString.getUTF16Ref(tmp1) + " '" +

valueAsStringPrintable.getUTF16Ref(tmp2) + "'");

}

ExecutionStatus Interpreter::putByIdTransient_RJS(

Runtime *runtime,

Handle<> base,

SymbolID id,

Handle<> value,

bool strictMode) {

// ES5.1 8.7.2 special [[Get]] internal method.

// TODO: avoid boxing primitives unless we are calling an accessor.

// 1. Let O be ToObject(base)

auto res = toObject(runtime, base);

if (LLVM_UNLIKELY(res == ExecutionStatus::EXCEPTION)) {

// If an exception is thrown, likely we are trying to convert

// undefined/null to an object. Passing over the name of the property

// so that we could emit more meaningful error messages.

return amendPropAccessErrorMsgWithPropName(runtime, base, "set", id);

}

auto O = runtime->makeHandle<JSObject>(res.getValue());

NamedPropertyDescriptor desc;

JSObject *propObj = JSObject::getNamedDescriptor(O, runtime, id, desc);

// Is this a missing property, or a data property defined in the prototype

// chain? In both cases we would need to create an own property on the

// transient object, which is prohibited.

if (!propObj ||

(propObj != O.get() &&

(!desc.flags.accessor && !desc.flags.proxyObject))) {

if (strictMode) {

return transientObjectPutErrorMessage(runtime, base, id);

}

return ExecutionStatus::RETURNED;

}

// Modifying an own data property in a transient object is prohibited.

if (!desc.flags.accessor && !desc.flags.proxyObject) {

if (strictMode) {

return runtime->raiseTypeError(

"Cannot modify a property in a transient object");

}

return ExecutionStatus::RETURNED;

}

if (desc.flags.accessor) {

// This is an accessor.

auto *accessor = vmcast<PropertyAccessor>(

JSObject::getNamedSlotValue(propObj, runtime, desc));

// It needs to have a setter.

if (!accessor->setter) {

if (strictMode) {

return runtime->raiseTypeError("Cannot modify a read-only accessor");

}

return ExecutionStatus::RETURNED;

}

CallResult<PseudoHandle<>> setRes =

accessor->setter.get(runtime)->executeCall1(

runtime->makeHandle(accessor->setter), runtime, base, *value);

if (setRes == ExecutionStatus::EXCEPTION) {

return ExecutionStatus::EXCEPTION;

}

} else {

assert(desc.flags.proxyObject && "descriptor flags are impossible");

CallResult<bool> setRes = JSProxy::setNamed(

runtime->makeHandle(propObj), runtime, id, value, base);

if (setRes == ExecutionStatus::EXCEPTION) {

return ExecutionStatus::EXCEPTION;

}

if (!*setRes && strictMode) {

return runtime->raiseTypeError("transient proxy set returned false");

}

}

return ExecutionStatus::RETURNED;

}

ExecutionStatus Interpreter::putByValTransient_RJS(

Runtime *runtime,

Handle<> base,

Handle<> name,

Handle<> value,

bool strictMode) {

auto idRes = valueToSymbolID(runtime, name);

if (idRes == ExecutionStatus::EXCEPTION)

return ExecutionStatus::EXCEPTION;

return putByIdTransient_RJS(runtime, base, **idRes, value, strictMode);

}

CallResult<PseudoHandle<>> Interpreter::createObjectFromBuffer(

Runtime *runtime,

CodeBlock *curCodeBlock,

unsigned numLiterals,

unsigned keyBufferIndex,

unsigned valBufferIndex) {

// Fetch any cached hidden class first.

auto *runtimeModule = curCodeBlock->getRuntimeModule();

const llvh::Optional<Handle<HiddenClass>> optCachedHiddenClassHandle =

runtimeModule->findCachedLiteralHiddenClass(

runtime, keyBufferIndex, numLiterals);

// Create a new object using the built-in constructor or cached hidden class.

// Note that the built-in constructor is empty, so we don't actually need to

// call it.

auto obj = runtime->makeHandle(

optCachedHiddenClassHandle.hasValue()

? JSObject::create(runtime, optCachedHiddenClassHandle.getValue())

: JSObject::create(runtime, numLiterals));

MutableHandle<> tmpHandleKey(runtime);

MutableHandle<> tmpHandleVal(runtime);

auto &gcScope = *runtime->getTopGCScope();

auto marker = gcScope.createMarker();

auto genPair = curCodeBlock->getObjectBufferIter(

keyBufferIndex, valBufferIndex, numLiterals);

auto keyGen = genPair.first;

auto valGen = genPair.second;

if (optCachedHiddenClassHandle.hasValue()) {

uint32_t propIndex = 0;

// keyGen should always have the same amount of elements as valGen

while (valGen.hasNext()) {

#ifndef NDEBUG

{

// keyGen points to an element in the key buffer, which means it will

// only ever generate a Number or a Symbol. This means it will never

// allocate memory, and it is safe to not use a Handle.

SymbolID stringIdResult{};

auto key = keyGen.get(runtime);

if (key.isSymbol()) {

stringIdResult = ID(key.getSymbol().unsafeGetIndex());

} else {

tmpHandleKey = HermesValue::encodeDoubleValue(key.getNumber());

auto idRes = valueToSymbolID(runtime, tmpHandleKey);

assert(

idRes != ExecutionStatus::EXCEPTION &&

"valueToIdentifier() failed for uint32_t value");

stringIdResult = **idRes;

}

NamedPropertyDescriptor desc;

auto pos = HiddenClass::findProperty(

optCachedHiddenClassHandle.getValue(),

runtime,

stringIdResult,

PropertyFlags::defaultNewNamedPropertyFlags(),

desc);

assert(

pos &&

"Should find this property in cached hidden class property table.");

assert(

desc.slot == propIndex &&

"propIndex should be the same as recorded in hidden class table.");

}

#endif

// Explicitly make sure valGen.get() is called before obj.get() so that

// any allocation in valGen.get() won't invalidate the raw pointer

// retruned from obj.get().

auto val = valGen.get(runtime);

JSObject::setNamedSlotValue(obj.get(), runtime, propIndex, val);

gcScope.flushToMarker(marker);

++propIndex;

}

} else {

// keyGen should always have the same amount of elements as valGen

while (keyGen.hasNext()) {

// keyGen points to an element in the key buffer, which means it will

// only ever generate a Number or a Symbol. This means it will never

// allocate memory, and it is safe to not use a Handle.

auto key = keyGen.get(runtime);

tmpHandleVal = valGen.get(runtime);

if (key.isSymbol()) {

auto stringIdResult = ID(key.getSymbol().unsafeGetIndex());

if (LLVM_UNLIKELY(

JSObject::defineNewOwnProperty(

obj,

runtime,

stringIdResult,

PropertyFlags::defaultNewNamedPropertyFlags(),

tmpHandleVal) == ExecutionStatus::EXCEPTION)) {

return ExecutionStatus::EXCEPTION;

}

} else {

tmpHandleKey = HermesValue::encodeDoubleValue(key.getNumber());

if (LLVM_UNLIKELY(

!JSObject::defineOwnComputedPrimitive(

obj,

runtime,

tmpHandleKey,

DefinePropertyFlags::getDefaultNewPropertyFlags(),

tmpHandleVal)

.getValue())) {

return ExecutionStatus::EXCEPTION;

}

}

gcScope.flushToMarker(marker);

}

}

tmpHandleKey.clear();

tmpHandleVal.clear();

// Hidden class in dictionary mode can't be shared.

HiddenClass *const clazz = obj->getClass(runtime);

if (!optCachedHiddenClassHandle.hasValue() && !clazz->isDictionary()) {

assert(

numLiterals == clazz->getNumProperties() &&

"numLiterals should match hidden class property count.");

assert(

clazz->getNumProperties() < 256 &&

"cached hidden class should have property count less than 256");

runtimeModule->tryCacheLiteralHiddenClass(runtime, keyBufferIndex, clazz);

}

return createPseudoHandle(HermesValue::encodeObjectValue(*obj));

}

CallResult<PseudoHandle<>> Interpreter::createArrayFromBuffer(

Runtime *runtime,

CodeBlock *curCodeBlock,

unsigned numElements,

unsigned numLiterals,

unsigned bufferIndex) {

// Create a new array using the built-in constructor, and initialize

// the elements from a literal array buffer.

auto arrRes = JSArray::create(runtime, numElements, numElements);

if (arrRes == ExecutionStatus::EXCEPTION) {

return ExecutionStatus::EXCEPTION;

}

// Resize the array storage in advance.

auto arr = runtime->makeHandle(std::move(*arrRes));

JSArray::setStorageEndIndex(arr, runtime, numElements);

auto iter = curCodeBlock->getArrayBufferIter(bufferIndex, numLiterals);

JSArray::size_type i = 0;

while (iter.hasNext()) {

// NOTE: we must get the value in a separate step to guarantee ordering.

auto value = iter.get(runtime);

JSArray::unsafeSetExistingElementAt(*arr, runtime, i++, value);

}

return createPseudoHandle(HermesValue::encodeObjectValue(*arr));

}

#ifndef NDEBUG

namespace {

/// A tag used to instruct the output stream to dump more details about the

/// HermesValue, like the length of the string, etc.

struct DumpHermesValue {

const HermesValue hv;

DumpHermesValue(HermesValue hv) : hv(hv) {}

};

} // anonymous namespace.

static llvh::raw_ostream &operator<<(

llvh::raw_ostream &OS,

DumpHermesValue dhv) {

OS << dhv.hv;

// If it is a string, dump the contents, truncated to 8 characters.

if (dhv.hv.isString()) {

SmallU16String<32> str;

dhv.hv.getString()->appendUTF16String(str);

UTF16Ref ref = str.arrayRef();

if (str.size() <= 8) {

OS << ":'" << ref << "'";

} else {

OS << ":'" << ref.slice(0, 8) << "'";

OS << "...[" << str.size() << "]";

}

}

return OS;

}

/// Dump the arguments from a callee frame.

LLVM_ATTRIBUTE_UNUSED

static void dumpCallArguments(

llvh::raw_ostream &OS,

Runtime *runtime,

StackFramePtr calleeFrame) {

OS << "arguments:\n";

OS << " " << 0 << " " << DumpHermesValue(calleeFrame.getThisArgRef())

<< "\n";

for (unsigned i = 0; i < calleeFrame.getArgCount(); ++i) {

OS << " " << (i + 1) << " " << DumpHermesValue(calleeFrame.getArgRef(i))

<< "\n";

}

}

LLVM_ATTRIBUTE_UNUSED

static void printDebugInfo(

CodeBlock *curCodeBlock,

PinnedHermesValue *frameRegs,

const Inst *ip) {

// Check if LLVm debugging is enabled for us.

bool debug = false;

SLOW_DEBUG(debug = true);

if (!debug)

return;

DecodedInstruction decoded = decodeInstruction(ip);

dbgs() << llvh::format_decimal((const uint8_t *)ip - curCodeBlock->begin(), 4)

<< " OpCode::" << getOpCodeString(decoded.meta.opCode);

for (unsigned i = 0; i < decoded.meta.numOperands; ++i) {

auto operandType = decoded.meta.operandType[i];

auto value = decoded.operandValue[i];

dbgs() << (i == 0 ? " " : ", ");

dumpOperand(dbgs(), operandType, value);

if (operandType == OperandType::Reg8 || operandType == OperandType::Reg32) {

// Print the register value, if source.

if (i != 0 || decoded.meta.numOperands == 1)

dbgs() << "=" << DumpHermesValue(REG(value.integer));

}

}

dbgs() << "\n";

}

/// \return whether \p opcode is a call opcode (Call, CallDirect, Construct,

/// CallLongIndex, etc). Note CallBuiltin is not really a Call.

LLVM_ATTRIBUTE_UNUSED

static bool isCallType(OpCode opcode) {

switch (opcode) {

#define DEFINE_RET_TARGET(name) \

case OpCode::name: \

return true;

#include "hermes/BCGen/HBC/BytecodeList.def"

default:

return false;

}

}

#endif

/// \return the address of the next instruction after \p ip, which must be a

/// call-type instruction.

LLVM_ATTRIBUTE_ALWAYS_INLINE

static inline const Inst *nextInstCall(const Inst *ip) {

HERMES_SLOW_ASSERT(isCallType(ip->opCode) && "ip is not of call type");

// The following is written to elicit compares instead of table lookup.

// The idea is to present code like so:

// if (opcode <= 70) return ip + 4;

// if (opcode <= 71) return ip + 4;

// if (opcode <= 72) return ip + 4;

// if (opcode <= 73) return ip + 5;

// if (opcode <= 74) return ip + 5;

// ...

// and the compiler will retain only compares where the result changes (here,

// 72 and 74). This allows us to compute the next instruction using three

// compares, instead of a naive compare-per-call type (or lookup table).

//

// Statically verify that increasing call opcodes correspond to monotone

// instruction sizes; this enables the compiler to do a better job optimizing.

constexpr bool callSizesMonotoneIncreasing = monotoneIncreasing(

#define DEFINE_RET_TARGET(name) sizeof(inst::name##Inst),

#include "hermes/BCGen/HBC/BytecodeList.def"

SIZE_MAX // sentinel avoiding a trailing comma.

);

static_assert(

callSizesMonotoneIncreasing,

"Call instruction sizes are not monotone increasing");

#define DEFINE_RET_TARGET(name) \

if (ip->opCode <= OpCode::name) \

return NEXTINST(name);

#include "hermes/BCGen/HBC/BytecodeList.def"

llvm_unreachable("Not a call type");

}

CallResult<HermesValue> Runtime::interpretFunctionImpl(

CodeBlock *newCodeBlock) {

newCodeBlock->lazyCompile(this);

#if defined(HERMES_ENABLE_ALLOCATION_LOCATION_TRACES) || !defined(NDEBUG)

// We always call getCurrentIP() in a debug build as this has the effect

// of asserting the IP is correctly set (not invalidated) at this point.

// This allows us to leverage our whole test-suite to find missing cases

// of CAPTURE_IP* macros in the interpreter loop.

const inst::Inst *ip = getCurrentIP();

(void)ip;

#endif

#ifdef HERMES_ENABLE_ALLOCATION_LOCATION_TRACES

if (ip) {

const CodeBlock *codeBlock;

std::tie(codeBlock, ip) = getCurrentInterpreterLocation(ip);

// All functions end in a Ret so we must match this with a pushCallStack()

// before executing.

if (codeBlock) {

// Push a call entry at the last location we were executing bytecode.

// This will correctly attribute things like eval().

pushCallStack(codeBlock, ip);

} else {

// Push a call entry at the entry at the top of interpreted code.

pushCallStack(newCodeBlock, (const Inst *)newCodeBlock->begin());

}

} else {

// Push a call entry at the entry at the top of interpreted code.

pushCallStack(newCodeBlock, (const Inst *)newCodeBlock->begin());

}

#endif

InterpreterState state{newCodeBlock, 0};

return Interpreter::interpretFunction<false>(this, state);

}

CallResult<HermesValue> Runtime::interpretFunction(CodeBlock *newCodeBlock) {

#ifdef HERMESVM_PROFILER_EXTERN

auto id = getProfilerID(newCodeBlock);

if (id >= NUM_PROFILER_SYMBOLS) {

id = NUM_PROFILER_SYMBOLS - 1; // Overflow entry.

}

return interpWrappers[id](this, newCodeBlock);

#else

return interpretFunctionImpl(newCodeBlock);

#endif

}

#ifdef HERMES_ENABLE_DEBUGGER

ExecutionStatus Runtime::stepFunction(InterpreterState &state) {

return Interpreter::interpretFunction<true>(this, state).getStatus();

}

#endif

/// \return the quotient of x divided by y.

static double doDiv(double x, double y)

LLVM_NO_SANITIZE("float-divide-by-zero");

static inline double doDiv(double x, double y) {

// UBSan will complain about float divide by zero as our implementation

// of OpCode::Div depends on IEEE 754 float divide by zero. All modern

// compilers implement this and there is no trivial work-around without

// sacrificing performance and readability.

// NOTE: This was pulled out of the interpreter to avoid putting the sanitize

// silencer on the entire interpreter function.

return x / y;

}

/// \return the product of x multiplied by y.

static inline double doMult(double x, double y) {

return x * y;

}

/// \return the difference of y subtracted from x.

static inline double doSub(double x, double y) {

return x - y;

}

template <bool SingleStep>

CallResult<HermesValue> Interpreter::interpretFunction(

Runtime *runtime,

InterpreterState &state) {

// The interpreter is re-entrant and also saves/restores its IP via the

// runtime whenever a call out is made (see the CAPTURE_IP_* macros). As such,

// failure to preserve the IP across calls to interpreterFunction() disrupt

// interpreter calls further up the C++ callstack. The RAII utility class

// below makes sure we always do this correctly.

//

// TODO: The IPs stored in the C++ callstack via this holder will generally be

// the same as in the JS stack frames via the Saved IP field. We can probably

// get rid of one of these redundant stores. Doing this isn't completely

// trivial as there are currently cases where we re-enter the interpreter

// without calling Runtime::saveCallerIPInStackFrame(), and there are features

// (I think mostly the debugger + stack traces) which implicitly rely on

// this behavior. At least their tests break if this behavior is not

// preserved.

struct IPSaver {

IPSaver(Runtime *runtime)

: ip_(runtime->getCurrentIP()), runtime_(runtime) {}

~IPSaver() {

runtime_->setCurrentIP(ip_);

}

private:

const Inst *ip_;

Runtime *runtime_;

};

IPSaver ipSaver(runtime);

#ifndef HERMES_ENABLE_DEBUGGER

static_assert(!SingleStep, "can't use single-step mode without the debugger");

#endif

// Make sure that the cache can use an optimization by avoiding a branch to

// access the property storage.

static_assert(

HiddenClass::kDictionaryThreshold <=

SegmentedArray::kValueToSegmentThreshold,

"Cannot avoid branches in cache check if the dictionary "

"crossover point is larger than the inline storage");

CodeBlock *curCodeBlock = state.codeBlock;

const Inst *ip = nullptr;

// Points to the first local register in the current frame.

// This eliminates the indirect load from Runtime and the -1 offset.

PinnedHermesValue *frameRegs;

// Strictness of current function.

bool strictMode;

// Default flags when accessing properties.

PropOpFlags defaultPropOpFlags;

// These CAPTURE_IP* macros should wrap around any major calls out of the

// interpreter loop. They stash and retrieve the IP via the current Runtime

// allowing the IP to be externally observed and even altered to change the flow

// of execution. Explicitly saving AND restoring the IP from the Runtime in this

// way means the C++ compiler will keep IP in a register within the rest of the

// interpreter loop.

//

// When assertions are enabled we take the extra step of "invalidating" the IP

// between captures so we can detect if it's erroneously accessed.

//

// In some cases we explicitly don't want to invalidate the IP and instead want

// it to stay set. For this we use the *NO_INVALIDATE variants. This comes up

// when we're performing a call operation which may re-enter the interpreter

// loop, and so need the IP available for the saveCallerIPInStackFrame() call

// when we next enter.

#define CAPTURE_IP_ASSIGN_NO_INVALIDATE(dst, expr) \

runtime->setCurrentIP(ip); \

dst = expr; \

ip = runtime->getCurrentIP();

#ifdef NDEBUG

#define CAPTURE_IP(expr) \

runtime->setCurrentIP(ip); \

(void)expr; \

ip = runtime->getCurrentIP();

#define CAPTURE_IP_ASSIGN(dst, expr) CAPTURE_IP_ASSIGN_NO_INVALIDATE(dst, expr)

#else // !NDEBUG

#define CAPTURE_IP(expr) \

runtime->setCurrentIP(ip); \

(void)expr; \

ip = runtime->getCurrentIP(); \

runtime->invalidateCurrentIP();

#define CAPTURE_IP_ASSIGN(dst, expr) \

runtime->setCurrentIP(ip); \

dst = expr; \

ip = runtime->getCurrentIP(); \

runtime->invalidateCurrentIP();