/*

* Copyright (C) 1999-2002 Harri Porten (porten@kde.org)

* Copyright (C) 2001 Peter Kelly (pmk@post.com)

* Copyright (C) 2003-2022 Apple Inc. All rights reserved.

* Copyright (C) 2007 Cameron Zwarich (cwzwarich@uwaterloo.ca)

* Copyright (C) 2007 Maks Orlovich

* Copyright (C) 2007 Eric Seidel <eric@webkit.org>

* Copyright (C) 2012 Igalia, S.L.

*

* This library is free software; you can redistribute it and/or

* modify it under the terms of the GNU Library General Public

* License as published by the Free Software Foundation; either

* version 2 of the License, or (at your option) any later version.

*

* This library is distributed in the hope that it will be useful,

* but WITHOUT ANY WARRANTY; without even the implied warranty of

* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU

* Library General Public License for more details.

*

* You should have received a copy of the GNU Library General Public License

* along with this library; see the file COPYING.LIB. If not, write to

* the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,

* Boston, MA 02110-1301, USA.

*

*/

#include "config.h"

#include "Nodes.h"

#include "NodeConstructors.h"

#include "AbstractModuleRecord.h"

#include "BuiltinNames.h"

#include "BytecodeGenerator.h"

#include "BytecodeGeneratorBaseInlines.h"

#include "JSArrayIterator.h"

#include "JSAsyncDisposableStack.h"

#include "JSAsyncFromSyncIterator.h"

#include "JSAsyncGenerator.h"

#include "JSCellButterfly.h"

#include "JSCInlines.h"

#include "JSDisposableStack.h"

#include "JSGenerator.h"

#include "JSIteratorHelper.h"

#include "JSMapIterator.h"

#include "JSPromise.h"

#include "JSPromiseReaction.h"

#include "JSRegExpStringIterator.h"

#include "JSSetIterator.h"

#include "JSStringIterator.h"

#include "JSWrapForValidIterator.h"

#include "LabelScope.h"

#include "LinkTimeConstant.h"

#include "ModuleScopeData.h"

#include "StackAlignment.h"

#include "UnlinkedMetadataTableInlines.h"

#include "YarrFlags.h"

#include <wtf/Assertions.h>

#include <wtf/text/StringBuilder.h>

namespace JSC {

/*

Details of the emitBytecode function.

Return value: The register holding the production's value.

dst: An optional parameter specifying the most efficient destination at

which to store the production's value.

If dst is null, you may return whatever VirtualRegister you want. Otherwise you have to return dst.

The dst argument provides for a crude form of copy propagation. For example,

x = 1

becomes

load r[x], 1

instead of

load r0, 1

mov r[x], r0

because the assignment node, "x =", passes r[x] as dst to the number node, "1".

*/

void ExpressionNode::emitBytecodeInConditionContext(BytecodeGenerator& generator, Label& trueTarget, Label& falseTarget, FallThroughMode fallThroughMode)

{

RegisterID* result = generator.emitNode(this);

if (fallThroughMode == FallThroughMeansTrue)

generator.emitJumpIfFalse(result, falseTarget);

else

generator.emitJumpIfTrue(result, trueTarget);

}

// ------------------------------ ThrowableExpressionData --------------------------------

RegisterID* ThrowableExpressionData::emitThrowReferenceError(BytecodeGenerator& generator, ASCIILiteral message, RegisterID* dst)

{

generator.emitExpressionInfo(divot(), divotStart(), divotEnd());

generator.emitThrowReferenceError(message);

if (dst)

return dst;

return generator.newTemporary();

}

// ------------------------------ ConstantNode ----------------------------------

void ConstantNode::emitBytecodeInConditionContext(BytecodeGenerator& generator, Label& trueTarget, Label& falseTarget, FallThroughMode fallThroughMode)

{

TriState value = TriState::Indeterminate;

JSValue constant = jsValue(generator);

if (constant) [[likely]]

value = constant.pureToBoolean();

if (needsDebugHook()) [[unlikely]] {

if (value != TriState::Indeterminate)

generator.emitDebugHook(this);

}

if (value == TriState::Indeterminate)

ExpressionNode::emitBytecodeInConditionContext(generator, trueTarget, falseTarget, fallThroughMode);

else if (value == TriState::True && fallThroughMode == FallThroughMeansFalse)

generator.emitJump(trueTarget);

else if (value == TriState::False && fallThroughMode == FallThroughMeansTrue)

generator.emitJump(falseTarget);

// All other cases are unconditional fall-throughs, like "if (true)".

}

RegisterID* ConstantNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

{

if (dst == generator.ignoredResult())

return nullptr;

JSValue constant = jsValue(generator);

if (!constant) [[unlikely]] {

// This can happen if we try to parse a string or BigInt so enormous that we OOM.

return generator.emitThrowExpressionTooDeepException();

}

return generator.emitLoad(dst, constant);

}

JSValue StringNode::jsValue(BytecodeGenerator& generator) const

{

return generator.addStringConstant(m_value);

}

JSValue BigIntNode::jsValue(BytecodeGenerator& generator) const

{

return generator.addBigIntConstant(m_value, m_radix, m_sign);

}

// ------------------------------ NumberNode ----------------------------------

RegisterID* NumberNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

{

if (dst == generator.ignoredResult())

return nullptr;

return generator.emitLoad(dst, jsValue(generator), isIntegerNode() ? SourceCodeRepresentation::Integer : SourceCodeRepresentation::Double);

}

// ------------------------------ RegExpNode -----------------------------------

RegisterID* RegExpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

{

if (dst == generator.ignoredResult())

return nullptr;

auto flags = Yarr::parseFlags(m_flags.string());

ASSERT(flags);

RegExp* regExp = RegExp::create(generator.vm(), m_pattern.string(), flags.value());

if (regExp->isValid())

return generator.emitNewRegExp(generator.finalDestination(dst), regExp);

auto& message = generator.parserArena().identifierArena().makeIdentifier(generator.vm(), regExp->errorMessage().span8());

generator.emitThrowStaticError(ErrorTypeWithExtension::SyntaxError, message);

return generator.emitLoad(generator.finalDestination(dst), jsUndefined());

}

// ------------------------------ ThisNode -------------------------------------

RegisterID* ThisNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

{

generator.ensureThis();

if (dst == generator.ignoredResult())

return nullptr;

RegisterID* result = generator.move(dst, generator.thisRegister());

static const unsigned thisLength = strlen("this");

generator.emitProfileType(generator.thisRegister(), position(), position() + thisLength);

return result;

}

// ------------------------------ SuperNode -------------------------------------

static RegisterID* emitHomeObjectForCallee(BytecodeGenerator& generator)

{

if ((generator.isDerivedClassContext() || generator.isDerivedConstructorContext()) && generator.parseMode() != SourceParseMode::ClassFieldInitializerMode) {

RegisterID* derivedConstructor = generator.emitLoadDerivedConstructorFromArrowFunctionLexicalEnvironment();

return generator.emitGetById(generator.newTemporary(), derivedConstructor, generator.propertyNames().builtinNames().homeObjectPrivateName());

}

RegisterID callee;

callee.setIndex(CallFrameSlot::callee);

return generator.emitGetById(generator.newTemporary(), &callee, generator.propertyNames().builtinNames().homeObjectPrivateName());

}

static RegisterID* emitSuperBaseForCallee(BytecodeGenerator& generator)

{

RefPtr<RegisterID> homeObject = emitHomeObjectForCallee(generator);

return generator.emitGetPrototypeOf(generator.newTemporary(), homeObject.get());

}

static RegisterID* emitGetSuperFunctionForConstruct(BytecodeGenerator& generator)

{

if (generator.isDerivedConstructorContext())

return generator.emitGetPrototypeOf(generator.newTemporary(), generator.emitLoadDerivedConstructorFromArrowFunctionLexicalEnvironment());

RegisterID callee;

callee.setIndex(CallFrameSlot::callee);

return generator.emitGetPrototypeOf(generator.newTemporary(), &callee);

}

RegisterID* SuperNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

{

RegisterID* result = emitSuperBaseForCallee(generator);

return generator.move(generator.finalDestination(dst), result);

}

// ------------------------------ ImportNode -------------------------------------

RegisterID* ImportNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

{

RefPtr<RegisterID> importModule = generator.moveLinkTimeConstant(nullptr, LinkTimeConstant::importModule);

CallArguments arguments(generator, nullptr, m_option ? 2 : 1);

generator.emitLoad(arguments.thisRegister(), jsUndefined());

generator.emitNode(arguments.argumentRegister(0), m_expr);

if (m_option)

generator.emitNode(arguments.argumentRegister(1), m_option);

return generator.emitCall(generator.finalDestination(dst, importModule.get()), importModule.get(), NoExpectedFunction, arguments, divot(), divotStart(), divotEnd(), DebuggableCall::No);

}

// ------------------------------ NewTargetNode ----------------------------------

RegisterID* NewTargetNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

{

if (dst == generator.ignoredResult())

return nullptr;

return generator.move(dst, generator.newTarget());

}

// ------------------------------ ImportMetaNode ---------------------------------

RegisterID* ImportMetaNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

{

return generator.emitNode(dst, m_expr);

}

// ------------------------------ ResolveNode ----------------------------------

bool ResolveNode::isPure(BytecodeGenerator& generator) const

{

return generator.variable(m_ident).offset().isStack();

}

bool ResolveNode::getFromScopeCanThrow(BytecodeGenerator& generator) const

{

Variable var = generator.variable(m_ident);

if (var.offset().isStack() || var.offset().isScope())

return !generator.needsTDZCheck(var);

return true;

}

RegisterID* ResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

{

Variable var = generator.variable(m_ident);

JSTextPosition divot = m_start + m_ident.length();

if (RegisterID* local = var.local()) {

generator.emitExpressionInfo(divot, m_start, divot);

generator.emitTDZCheckIfNecessary(var, local, nullptr);

if (dst == generator.ignoredResult())

return nullptr;

generator.emitProfileType(local, var, m_position, m_position + m_ident.length());

return generator.move(dst, local);

}

generator.emitExpressionInfo(divot, m_start, divot);

RefPtr<RegisterID> scope = generator.emitResolveScope(dst, var);

RegisterID* finalDest = generator.finalDestination(dst);

if (!generator.needsTDZCheck(var))

generator.emitGetFromScope(finalDest, scope.get(), var, ThrowIfNotFound);

else {

RefPtr<RegisterID> uncheckedResult = generator.newTemporary();

generator.emitGetFromScope(uncheckedResult.get(), scope.get(), var, ThrowIfNotFound);

generator.emitTDZCheck(uncheckedResult.get());

generator.move(finalDest, uncheckedResult.get());

}

generator.emitProfileType(finalDest, var, m_position, m_position + m_ident.length());

return finalDest;

}

// ------------------------------ TemplateStringNode -----------------------------------

RegisterID* TemplateStringNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

{

if (dst == generator.ignoredResult())

return nullptr;

ASSERT(cooked());

return generator.emitLoad(dst, JSValue(generator.addStringConstant(*cooked())));

}

// ------------------------------ TemplateLiteralNode -----------------------------------

RegisterID* TemplateLiteralNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

{

if (!m_templateExpressions) {

TemplateStringNode* templateString = m_templateStrings->value();

ASSERT_WITH_MESSAGE(!m_templateStrings->next(), "Only one template element exists because there's no expression in a given template literal.");

return generator.emitNode(dst, templateString);

}

Vector<RefPtr<RegisterID>, 16> temporaryRegisters;

TemplateStringListNode* templateString = m_templateStrings;

TemplateExpressionListNode* templateExpression = m_templateExpressions;

for (; templateExpression; templateExpression = templateExpression->next(), templateString = templateString->next()) {

// Evaluate TemplateString.

ASSERT(templateString->value()->cooked());

if (!templateString->value()->cooked()->isEmpty()) {

temporaryRegisters.append(generator.newTemporary());

generator.emitNode(temporaryRegisters.last().get(), templateString->value());

}

// Evaluate Expression.

temporaryRegisters.append(generator.newTemporary());

generator.emitNode(temporaryRegisters.last().get(), templateExpression->value());

generator.emitToString(temporaryRegisters.last().get(), temporaryRegisters.last().get());

}

// Evaluate tail TemplateString.

ASSERT(templateString->value()->cooked());

if (!templateString->value()->cooked()->isEmpty()) {

temporaryRegisters.append(generator.newTemporary());

generator.emitNode(temporaryRegisters.last().get(), templateString->value());

}

if (temporaryRegisters.size() == 1)

return generator.move(generator.finalDestination(dst, temporaryRegisters[0].get()), temporaryRegisters[0].get());

return generator.emitStrcat(generator.finalDestination(dst, temporaryRegisters[0].get()), temporaryRegisters[0].get(), temporaryRegisters.size());

}

// ------------------------------ TaggedTemplateNode -----------------------------------

RegisterID* TaggedTemplateNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

{

ExpectedFunction expectedFunction = NoExpectedFunction;

RefPtr<RegisterID> tag = nullptr;

RefPtr<RegisterID> base = nullptr;

if (!m_tag->isLocation()) {

tag = generator.newTemporary();

tag = generator.emitNode(tag.get(), m_tag);

} else if (m_tag->isResolveNode()) {

ResolveNode* resolve = static_cast<ResolveNode*>(m_tag);

const Identifier& identifier = resolve->identifier();

expectedFunction = generator.expectedFunctionForIdentifier(identifier);

Variable var = generator.variable(identifier);

if (RegisterID* local = var.local()) {

generator.emitTDZCheckIfNecessary(var, local, nullptr);

tag = generator.move(generator.newTemporary(), local);

} else {

tag = generator.newTemporary();

base = generator.newTemporary();

JSTextPosition newDivot = divotStart() + identifier.length();

generator.emitExpressionInfo(newDivot, divotStart(), newDivot);

generator.move(base.get(), generator.emitResolveScope(base.get(), var));

generator.emitGetFromScope(tag.get(), base.get(), var, ThrowIfNotFound);

generator.emitTDZCheckIfNecessary(var, tag.get(), nullptr);

}

} else if (m_tag->isBracketAccessorNode()) {

BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(m_tag);

base = generator.newTemporary();

base = generator.emitNode(base.get(), bracket->base());

RefPtr<RegisterID> property = generator.emitNodeForProperty(bracket->subscript());

if (bracket->base()->isSuperNode()) {

RefPtr<RegisterID> thisValue = generator.ensureThis();

tag = generator.emitGetByVal(generator.newTemporary(), base.get(), thisValue.get(), property.get());

} else

tag = generator.emitGetByVal(generator.newTemporary(), base.get(), property.get());

} else {

ASSERT(m_tag->isDotAccessorNode());

DotAccessorNode* dot = static_cast<DotAccessorNode*>(m_tag);

tag = generator.newTemporary();

base = generator.newTemporary();

base = generator.emitNode(base.get(), dot->base());

tag = dot->emitGetPropertyValue(generator, tag.get(), base.get());

}

RefPtr<RegisterID> templateObject = generator.emitGetTemplateObject(nullptr, this);

unsigned expressionsCount = 0;

for (TemplateExpressionListNode* templateExpression = m_templateLiteral->templateExpressions(); templateExpression; templateExpression = templateExpression->next())

++expressionsCount;

CallArguments callArguments(generator, nullptr, 1 + expressionsCount);

if (base)

generator.move(callArguments.thisRegister(), base.get());

else

generator.emitLoad(callArguments.thisRegister(), jsUndefined());

unsigned argumentIndex = 0;

generator.move(callArguments.argumentRegister(argumentIndex++), templateObject.get());

for (TemplateExpressionListNode* templateExpression = m_templateLiteral->templateExpressions(); templateExpression; templateExpression = templateExpression->next())

generator.emitNode(callArguments.argumentRegister(argumentIndex++), templateExpression->value());

return generator.emitCallInTailPosition(generator.finalDestination(dst, tag.get()), tag.get(), expectedFunction, callArguments, divot(), divotStart(), divotEnd(), DebuggableCall::Yes);

}

// ------------------------------ ArrayNode ------------------------------------

RegisterID* ArrayNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

{

bool hadVariableExpression = false;

bool allDenseStrings = true;

unsigned length = 0;

IndexingType recommendedIndexingType = ArrayWithUndecided;

ElementNode* firstPutElement;

for (firstPutElement = m_element; firstPutElement; firstPutElement = firstPutElement->next()) {

if (firstPutElement->elision() || firstPutElement->value()->isSpreadExpression())

break;

if (!firstPutElement->value()->isConstant())

hadVariableExpression = true;

else {

JSValue constant = static_cast<ConstantNode*>(firstPutElement->value())->jsValue(generator);

if (!constant) [[unlikely]]

hadVariableExpression = true;

else {

recommendedIndexingType = leastUpperBoundOfIndexingTypeAndValue(recommendedIndexingType, constant);

if (!constant.isString())

allDenseStrings = false;

else if (auto* impl = asString(constant)->tryGetValueImpl(); !impl || !impl->isAtom())

allDenseStrings = false;

}

}

++length;

}

if (hadVariableExpression)

allDenseStrings = false;

auto newArray = [&](RegisterID* dst, ElementNode* elements, unsigned length) {

if (length && !hadVariableExpression) {

VM& vm = generator.vm();

recommendedIndexingType |= CopyOnWrite;

ASSERT(vm.heap.isDeferred()); // We run bytecode generator under a DeferGC. If we stopped doing that, we'd need to put a DeferGC here as we filled in these slots.

Structure* cellButterflyStructure = allDenseStrings ? vm.cellButterflyOnlyAtomStringsStructure.get() : vm.cellButterflyStructure(recommendedIndexingType);

auto* array = JSCellButterfly::tryCreate(generator.vm(), cellButterflyStructure, length);

RELEASE_ASSERT(array);

unsigned index = 0;

for (ElementNode* element = elements; index < length; element = element->next()) {

ASSERT(element->value()->isConstant());

JSValue constant = static_cast<ConstantNode*>(element->value())->jsValue(generator);

ASSERT(constant);

if (allDenseStrings) {

JSString* string = asString(constant);

StringImpl* stringImpl = const_cast<StringImpl*>(string->getValueImpl());

constant = vm.atomStringToJSStringMap.ensureValue(stringImpl, [&] { return string; });

}

array->setIndex(generator.vm(), index++, constant);

}

return generator.emitNewArrayBuffer(dst, array, recommendedIndexingType);

}

return generator.emitNewArray(dst, elements, length, recommendedIndexingType);

};

if (!firstPutElement && !m_elision)

return newArray(generator.finalDestination(dst), m_element, length);

allDenseStrings = false;

if (firstPutElement && firstPutElement->value()->isSpreadExpression()) {

bool hasElision = m_elision;

if (!hasElision) {

for (ElementNode* node = firstPutElement; node; node = node->next()) {

if (node->elision()) {

hasElision = true;

break;

}

}

}

if (!hasElision)

return generator.emitNewArrayWithSpread(generator.finalDestination(dst), m_element);

}

RefPtr<RegisterID> array = newArray(generator.tempDestination(dst), m_element, length);

ElementNode* n = firstPutElement;

for (; n; n = n->next()) {

if (n->value()->isSpreadExpression())

goto handleSpread;

RefPtr<RegisterID> value = generator.emitNode(n->value());

length += n->elision();

RefPtr<RegisterID> index = generator.emitLoad(nullptr, jsNumber(length++));

generator.emitDirectPutByVal(array.get(), index.get(), value.get());

}

if (m_elision) {

RegisterID* value = generator.emitLoad(nullptr, jsNumber(m_elision + length));

generator.emitPutById(array.get(), generator.propertyNames().length, value);

}

return generator.move(dst, array.get());

handleSpread:

RefPtr<RegisterID> index = generator.emitLoad(generator.newTemporary(), jsNumber(length));

auto spreader = scopedLambda<void(BytecodeGenerator&, RegisterID*)>([array, index](BytecodeGenerator& generator, RegisterID* value)

{

generator.emitDirectPutByVal(array.get(), index.get(), value);

generator.emitInc(index.get());

});

for (; n; n = n->next()) {

if (n->elision())

generator.emitBinaryOp<OpAdd>(index.get(), index.get(), generator.emitLoad(nullptr, jsNumber(n->elision())), OperandTypes(ResultType::numberTypeIsInt32(), ResultType::numberTypeIsInt32()));

if (n->value()->isSpreadExpression()) {

SpreadExpressionNode* spread = static_cast<SpreadExpressionNode*>(n->value());

generator.emitEnumeration(spread, spread->expression(), spreader);

} else {

generator.emitDirectPutByVal(array.get(), index.get(), generator.emitNode(n->value()));

generator.emitInc(index.get());

}

}

if (m_elision) {

generator.emitBinaryOp<OpAdd>(index.get(), index.get(), generator.emitLoad(nullptr, jsNumber(m_elision)), OperandTypes(ResultType::numberTypeIsInt32(), ResultType::numberTypeIsInt32()));

generator.emitPutById(array.get(), generator.propertyNames().length, index.get());

}

return generator.move(dst, array.get());

}

bool ArrayNode::isSimpleArray() const

{

if (m_elision)

return false;

for (ElementNode* ptr = m_element; ptr; ptr = ptr->next()) {

if (ptr->elision())

return false;

if (ptr->value()->isSpreadExpression())

return false;

}

return true;

}

ArgumentListNode* ArrayNode::toArgumentList(ParserArena& parserArena, int lineNumber, int startPosition) const

{

ASSERT(!m_elision);

ElementNode* ptr = m_element;

if (!ptr)

return nullptr;

JSTokenLocation location;

location.line = lineNumber;

location.startOffset = startPosition;

ArgumentListNode* head = new (parserArena) ArgumentListNode(location, ptr->value());

ArgumentListNode* tail = head;

ptr = ptr->next();

for (; ptr; ptr = ptr->next()) {

ASSERT(!ptr->elision());

tail = new (parserArena) ArgumentListNode(location, tail, ptr->value());

}

return head;

}

// ------------------------------ ObjectLiteralNode ----------------------------

RegisterID* ObjectLiteralNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)

{

if (!m_list) {

if (dst == generator.ignoredResult())

return nullptr;

return generator.emitNewObject(generator.finalDestination(dst));

}

auto* propertyList = m_list;

RefPtr<RegisterID> newObject;

if (propertyList->m_node->m_type & PropertyNode::Spread) {

// Only one element and it is spread.

if (!propertyList->m_next) {

RefPtr<RegisterID> function = generator.moveLinkTimeConstant(nullptr, LinkTimeConstant::cloneObject);

RefPtr<RegisterID> src = generator.emitNode(static_cast<ObjectSpreadExpressionNode*>(propertyList->m_node->m_assign)->expression());

CallArguments args(generator, nullptr, 0);

generator.move(args.thisRegister(), src.get());

return generator.emitCall(generator.finalDestination(dst, function.get()), function.get(), NoExpectedFunction, args, position(), position(), position(), DebuggableCall::No);

}

bool foundNonConstant = false;

for (auto* p = propertyList->m_next; p; p = p->m_next) {

if (p->m_node->m_type & PropertyNode::Constant)

continue;

if (p->m_node->m_type & PropertyNode::Computed)

continue;

if (p->m_node->m_type & PropertyNode::Spread)

continue;

foundNonConstant = true;

break;

}

// All properties are simple constants, and the first property is spread.

// Let's first clone an object and materialize the rest.

if (!foundNonConstant) {

RefPtr<RegisterID> function = generator.moveLinkTimeConstant(nullptr, LinkTimeConstant::cloneObject);

RefPtr<RegisterID> src = generator.emitNode(static_cast<ObjectSpreadExpressionNode*>(propertyList->m_node->m_assign)->expression());

CallArguments args(generator, nullptr, 0);

generator.move(args.thisRegister(), src.get());

newObject = generator.emitCall(generator.tempDestination(dst), function.get(), NoExpectedFunction, args, position(), position(), position(), DebuggableCall::No);

propertyList = propertyList->m_next;

}

}

if (!newObject)

newObject = generator.emitNewObject(generator.tempDestination(dst));

generator.emitNode(newObject.get(), propertyList);

return generator.move(dst, newObject.get());

}

// ------------------------------ PropertyListNode -----------------------------

static inline void emitPutHomeObject(BytecodeGenerator& generator, RegisterID* function, RegisterID* homeObject)

{

generator.emitPutById(function, generator.propertyNames().builtinNames().homeObjectPrivateName(), homeObject);

}

void PropertyListNode::emitDeclarePrivateFieldNames(BytecodeGenerator& generator, RegisterID* scope)

{

// Walk the list and declare any Private property names (e.g. `#foo`) in the provided scope.

RefPtr<RegisterID> createPrivateSymbol;

for (PropertyListNode* p = this; p; p = p->m_next) {

const PropertyNode& node = *p->m_node;

if (node.type() & PropertyNode::PrivateField) {

if (!createPrivateSymbol)

createPrivateSymbol = generator.moveLinkTimeConstant(nullptr, LinkTimeConstant::createPrivateSymbol);

CallArguments arguments(generator, nullptr, 1);

generator.emitLoad(arguments.thisRegister(), jsUndefined());

generator.emitLoad(arguments.argumentRegister(0), *node.name());

RefPtr<RegisterID> symbol = generator.emitCall(generator.finalDestination(nullptr, createPrivateSymbol.get()), createPrivateSymbol.get(), NoExpectedFunction, arguments, position(), position(), position(), DebuggableCall::No);

Variable var = generator.variable(*node.name());

generator.emitPutToScope(scope, var, symbol.get(), DoNotThrowIfNotFound, InitializationMode::ConstInitialization);

}

}

}

static ALWAYS_INLINE bool needsHomeObject(ExpressionNode* node)

{

if (node->isBaseFuncExprNode())

return static_cast<BaseFuncExprNode*>(node)->metadata()->superBinding() == SuperBinding::Needed;

return false;

}

RegisterID* PropertyListNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dstOrConstructor, RegisterID* prototype, Vector<UnlinkedFunctionExecutable::ClassElementDefinition>* instanceElementDefinitions, Vector<UnlinkedFunctionExecutable::ClassElementDefinition>* staticElementDefinitions)

{

auto makeClassElementDefinition = [](const PropertyListNode* p) {

using Kind = UnlinkedFunctionExecutable::ClassElementDefinition::Kind;

std::optional<JSTextPosition> initializerPosition = std::nullopt;

if (ExpressionNode* initializer = p->m_node->m_assign)

initializerPosition = initializer->position();

Kind kind = Kind::FieldWithLiteralPropertyKey;

if (p->m_node->isStaticClassBlock())

kind = Kind::StaticInitializationBlock;

else if (p->m_node->hasComputedName())

kind = Kind::FieldWithComputedPropertyKey;

else if (p->m_node->isPrivate())

kind = Kind::FieldWithPrivatePropertyKey;

return UnlinkedFunctionExecutable::ClassElementDefinition { *p->m_node->name(), p->position(), initializerPosition, kind };

};

using GetterSetterPair = std::pair<PropertyNode*, PropertyNode*>;

using GetterSetterMap = UncheckedKeyHashMap<UniquedStringImpl*, GetterSetterPair, IdentifierRepHash>;

if (hasPrivateAccessors()) {

GetterSetterMap privateAccessorMap;

for (PropertyListNode* propertyList = this; propertyList; propertyList = propertyList->m_next) {

if (!(propertyList->m_node->type() & (PropertyNode::PrivateGetter | PropertyNode::PrivateSetter)))

continue;

// We group private getters and setters to store them in a object

GetterSetterPair pair(propertyList->m_node, static_cast<PropertyNode*>(nullptr));

GetterSetterMap::AddResult result = privateAccessorMap.add(propertyList->m_node->name()->impl(), pair);

auto& resultPair = result.iterator->value;

// If the map already contains an element with node->name(),

// we need to store this node in the second part.

if (!result.isNewEntry)

resultPair.second = propertyList->m_node;

continue;

}

// Then we declare private accessors

for (auto& it : privateAccessorMap) {

// FIXME: Use GetterSetter to store private accessors

// https://bugs.webkit.org/show_bug.cgi?id=221915

RefPtr<RegisterID> getterSetterObj = generator.emitNewObject(generator.newTemporary());

GetterSetterPair pair = it.value;

auto emitPutAccessor = [&] (PropertyNode* propertyNode) {

RegisterID* base = propertyNode->isInstanceClassProperty() ? prototype : dstOrConstructor;

RefPtr<RegisterID> value = generator.emitNode(propertyNode->m_assign);

if (propertyNode->needsSuperBinding())

emitPutHomeObject(generator, value.get(), base);

auto setterOrGetterIdent = propertyNode->m_type & PropertyNode::PrivateGetter

? generator.propertyNames().builtinNames().getPrivateName()

: generator.propertyNames().builtinNames().setPrivateName();

generator.emitDirectPutById(getterSetterObj.get(), setterOrGetterIdent, value.get());

};

if (pair.first)

emitPutAccessor(pair.first);

if (pair.second)

emitPutAccessor(pair.second);

Variable var = generator.variable(*pair.first->name());

generator.emitPutToScope(generator.scopeRegister(), var, getterSetterObj.get(), DoNotThrowIfNotFound, InitializationMode::ConstInitialization);

}

}

PropertyListNode* p = this;

RegisterID* dst = nullptr;

// Fast case: this loop just handles regular value properties.

for (; p && (p->m_node->m_type & PropertyNode::Constant); p = p->m_next) {

dst = p->m_node->isInstanceClassProperty() ? prototype : dstOrConstructor;

if (p->m_node->type() & (PropertyNode::PrivateGetter | PropertyNode::PrivateSetter))

continue;

if (p->isComputedClassField())

emitSaveComputedFieldName(generator, *p->m_node);

if (p->isInstanceClassField() && !(p->m_node->type() & PropertyNode::PrivateMethod)) {

ASSERT(instanceElementDefinitions);

instanceElementDefinitions->append(makeClassElementDefinition(p));

continue;

}

if (p->isStaticClassElement()) {

ASSERT(staticElementDefinitions);

staticElementDefinitions->append(makeClassElementDefinition(p));

continue;

}

emitPutConstantProperty(generator, dst, *p->m_node);

}

// Were there any get/set properties?

if (p) {

// Build a list of getter/setter pairs to try to put them at the same time. If we encounter

// a constant property by the same name as accessor or a computed property or a spread,

// just emit everything as that may override previous values.

bool canOverrideProperties = false;

GetterSetterMap instanceMap;

GetterSetterMap staticMap;

// Build a map, pairing get/set values together.

for (PropertyListNode* q = p; q; q = q->m_next) {

PropertyNode* node = q->m_node;

if (node->m_type & PropertyNode::Computed || node->m_type & PropertyNode::Spread) {

canOverrideProperties = true;

break;

}

GetterSetterMap& map = node->isStaticClassProperty() ? staticMap : instanceMap;

if (node->m_type & PropertyNode::Constant) {

if (map.contains(node->name()->impl())) {

canOverrideProperties = true;

break;

}

continue;

}

// Duplicates are possible.

GetterSetterPair pair(node, static_cast<PropertyNode*>(nullptr));

GetterSetterMap::AddResult result = map.add(node->name()->impl(), pair);

auto& resultPair = result.iterator->value;

if (!result.isNewEntry) {

if (resultPair.first->m_type == node->m_type) {

resultPair.first->setIsOverriddenByDuplicate();

resultPair.first = node;

} else {

if (resultPair.second)

resultPair.second->setIsOverriddenByDuplicate();

resultPair.second = node;

}

}

}

// Iterate over the remaining properties in the list.

for (; p; p = p->m_next) {

PropertyNode* node = p->m_node;

dst = node->isInstanceClassProperty() ? prototype : dstOrConstructor;

if (p->isComputedClassField())

emitSaveComputedFieldName(generator, *p->m_node);

if (p->m_node->type() & (PropertyNode::PrivateGetter | PropertyNode::PrivateSetter))

continue;

if (p->isInstanceClassField()) {

ASSERT(instanceElementDefinitions);

ASSERT(node->m_type & PropertyNode::Constant);

instanceElementDefinitions->append(makeClassElementDefinition(p));

continue;

}

if (p->isStaticClassElement()) {

ASSERT(staticElementDefinitions);

staticElementDefinitions->append(makeClassElementDefinition(p));

continue;

}

// Handle regular values.

if (node->m_type & PropertyNode::Constant) {

emitPutConstantProperty(generator, dst, *node);

continue;

} else if (node->m_type & PropertyNode::Spread) {

generator.emitNode(dst, node->m_assign);

continue;

}

RefPtr<RegisterID> value = generator.emitNode(node->m_assign);

if (needsHomeObject(node->m_assign))

emitPutHomeObject(generator, value.get(), dst);

unsigned attributes = node->isClassProperty() ? (PropertyAttribute::Accessor | PropertyAttribute::DontEnum) : static_cast<unsigned>(PropertyAttribute::Accessor);

ASSERT(node->m_type & (PropertyNode::Getter | PropertyNode::Setter));

// This is a get/set property which may be overridden by a computed property or spread later.

if (canOverrideProperties) {

// Computed accessors.

if (node->m_type & PropertyNode::Computed) {

RefPtr<RegisterID> propertyName = generator.emitNode(node->m_expression);

if (generator.shouldSetFunctionName(node->m_assign)) {

propertyName = generator.emitToPropertyKey(generator.newTemporary(), propertyName.get());

generator.emitSetFunctionName(value.get(), propertyName.get());

}

if (node->m_type & PropertyNode::Getter)

generator.emitPutGetterByVal(dst, propertyName.get(), attributes, value.get());

else

generator.emitPutSetterByVal(dst, propertyName.get(), attributes, value.get());

continue;

}

if (node->m_type & PropertyNode::Getter)

generator.emitPutGetterById(dst, *node->name(), attributes, value.get());

else

generator.emitPutSetterById(dst, *node->name(), attributes, value.get());

continue;

}

// This is a get/set property pair.

GetterSetterMap& map = node->isStaticClassProperty() ? staticMap : instanceMap;

GetterSetterMap::iterator it = map.find(node->name()->impl());

ASSERT(it != map.end());

GetterSetterPair& pair = it->value;

// Was this already generated as a part of its partner?

if (pair.second == node || node->isOverriddenByDuplicate())

continue;

// Generate the paired node now.

RefPtr<RegisterID> getterReg;

RefPtr<RegisterID> setterReg;

RegisterID* secondReg = nullptr;

if (node->m_type & PropertyNode::Getter) {

getterReg = value;

if (pair.second) {

ASSERT(pair.second->m_type & PropertyNode::Setter);

setterReg = generator.emitNode(pair.second->m_assign);

secondReg = setterReg.get();

} else

setterReg = generator.emitLoad(nullptr, jsUndefined());

} else {

ASSERT(node->m_type & PropertyNode::Setter);

setterReg = value;

if (pair.second) {

ASSERT(pair.second->m_type & PropertyNode::Getter);

getterReg = generator.emitNode(pair.second->m_assign);

secondReg = getterReg.get();

} else

getterReg = generator.emitLoad(nullptr, jsUndefined());

}

if (pair.second) {

if (needsHomeObject(pair.second->m_assign))

emitPutHomeObject(generator, secondReg, dst);

}

generator.emitPutGetterSetter(dst, *node->name(), attributes, getterReg.get(), setterReg.get());

}

}

return dstOrConstructor;

}

void PropertyListNode::emitPutConstantProperty(BytecodeGenerator& generator, RegisterID* newObj, PropertyNode& node)

{

// Private fields are handled in a synthetic classFieldInitializer function, not here.

ASSERT(!(node.type() & PropertyNode::PrivateField));

if (PropertyNode::isUnderscoreProtoSetter(generator.vm(), node)) {

RefPtr<RegisterID> prototype = generator.emitNode(node.m_assign);

generator.emitDirectSetPrototypeOf<InvalidPrototypeMode::Ignore>(newObj, prototype.get(), m_position, m_position, m_position);

return;

}

bool shouldSetFunctionName = generator.shouldSetFunctionName(node.m_assign);

RefPtr<RegisterID> propertyName;

if (!node.name()) {

propertyName = generator.newTemporary();

if (shouldSetFunctionName)

generator.emitToPropertyKey(propertyName.get(), generator.emitNode(node.m_expression));

else

generator.emitNode(propertyName.get(), node.m_expression);

}

RefPtr<RegisterID> value = generator.emitNode(node.m_assign);

if (needsHomeObject(node.m_assign))

emitPutHomeObject(generator, value.get(), newObj);

if (node.isClassProperty()) {

ASSERT(node.needsSuperBinding());

ASSERT(!(node.type() & PropertyNode::PrivateSetter));

ASSERT(!(node.type() & PropertyNode::PrivateGetter));

if (node.type() & PropertyNode::PrivateMethod) {

Variable var = generator.variable(*node.name());

generator.emitPutToScope(generator.scopeRegister(), var, value.get(), DoNotThrowIfNotFound, InitializationMode::ConstInitialization);

return;

}

RefPtr<RegisterID> propertyNameRegister;

if (node.name())

propertyName = generator.emitLoad(nullptr, *node.name());

if (shouldSetFunctionName)

generator.emitSetFunctionName(value.get(), propertyName.get());

generator.emitCallDefineProperty(newObj, propertyName.get(), value.get(), nullptr, nullptr, BytecodeGenerator::PropertyConfigurable | BytecodeGenerator::PropertyWritable, m_position);

return;

}

if (const auto* identifier = node.name()) {

ASSERT(!propertyName);

std::optional<uint32_t> optionalIndex = parseIndex(*identifier);

if (!optionalIndex) {

generator.emitDirectPutById(newObj, *identifier, value.get());

return;

}

propertyName = generator.emitLoad(nullptr, jsNumber(optionalIndex.value()));

generator.emitDirectPutByVal(newObj, propertyName.get(), value.get());

return;

}

if (shouldSetFunctionName)

generator.emitSetFunctionName(value.get(), propertyName.get());

generator.emitDirectPutByVal(newObj, propertyName.get(), value.get());

}

void PropertyListNode::emitSaveComputedFieldName(BytecodeGenerator& generator, PropertyNode& node)

{

ASSERT(node.isComputedClassField());

// The 'name' refers to a synthetic private name in the class scope, where the property key is saved for later use.

const Identifier& description = *node.name();

Variable var = generator.variable(description);

ASSERT(!var.local());

RefPtr<RegisterID> propertyExpr = generator.emitNode(node.m_expression);

RefPtr<RegisterID> propertyName = generator.emitToPropertyKey(generator.newTemporary(), propertyExpr.get());

if (node.isStaticClassField()) {

Ref<Label> validPropertyNameLabel = generator.newLabel();

RefPtr<RegisterID> prototypeString = generator.emitLoad(nullptr, JSValue(generator.addStringConstant(generator.propertyNames().prototype)));

generator.emitJumpIfFalse(generator.emitBinaryOp<OpStricteq>(generator.newTemporary(), prototypeString.get(), propertyName.get(), OperandTypes(ResultType::stringType(), ResultType::stringType())), validPropertyNameLabel.get());

generator.emitThrowTypeError("Cannot declare a static field named 'prototype'"_s);