1/*
2 * Copyright (C) 2015-2019 Apple Inc. All rights reserved.
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the
11 * documentation and/or other materials provided with the distribution.
12 *
13 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
14 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
15 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
16 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
17 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
18 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
19 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
20 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
21 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
23 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24 */
25
26#pragma once
27
28#include "GenericArguments.h"
29#include "JSLexicalEnvironment.h"
30
31namespace JSC {
32
33// This is an Arguments-class object that we create when you say "arguments" inside a function,
34// and one or more of the arguments may be captured in the function's activation. The function
35// will copy its formally declared arguments into the activation and then create this object. This
36// object will store the overflow arguments, if there are any. This object will use the symbol
37// table's ScopedArgumentsTable and the activation, or its overflow storage, to handle all indexed
38// lookups.
39class ScopedArguments final : public GenericArguments<ScopedArguments> {
40private:
41 ScopedArguments(VM&, Structure*, WriteBarrier<Unknown>* storage, unsigned totalLength);
42 void finishCreation(VM&, JSFunction* callee, ScopedArgumentsTable*, JSLexicalEnvironment*);
43 using Base = GenericArguments<ScopedArguments>;
44
45public:
46 template<typename CellType, SubspaceAccess>
47 static IsoSubspace* subspaceFor(VM& vm)
48 {
49 static_assert(!CellType::needsDestruction, "");
50 return &vm.scopedArgumentsSpace;
51 }
52
53 // Creates an arguments object but leaves it uninitialized. This is dangerous if we GC right
54 // after allocation.
55 static ScopedArguments* createUninitialized(VM&, Structure*, JSFunction* callee, ScopedArgumentsTable*, JSLexicalEnvironment*, unsigned totalLength);
56
57 // Creates an arguments object and initializes everything to the empty value. Use this if you
58 // cannot guarantee that you'll immediately initialize all of the elements.
59 static ScopedArguments* create(VM&, Structure*, JSFunction* callee, ScopedArgumentsTable*, JSLexicalEnvironment*, unsigned totalLength);
60
61 // Creates an arguments object by copying the arguments from the stack.
62 static ScopedArguments* createByCopying(JSGlobalObject*, CallFrame*, ScopedArgumentsTable*, JSLexicalEnvironment*);
63
64 // Creates an arguments object by copying the arguments from a well-defined stack location.
65 static ScopedArguments* createByCopyingFrom(VM&, Structure*, Register* argumentsStart, unsigned totalLength, JSFunction* callee, ScopedArgumentsTable*, JSLexicalEnvironment*);
66
67 static void visitChildren(JSCell*, SlotVisitor&);
68
69 uint32_t internalLength() const
70 {
71 return m_totalLength;
72 }
73
74 uint32_t length(JSGlobalObject* globalObject) const
75 {
76 VM& vm = getVM(globalObject);
77 auto scope = DECLARE_THROW_SCOPE(vm);
78 if (UNLIKELY(m_overrodeThings)) {
79 auto value = get(globalObject, vm.propertyNames->length);
80 RETURN_IF_EXCEPTION(scope, 0);
81 RELEASE_AND_RETURN(scope, value.toUInt32(globalObject));
82 }
83 return internalLength();
84 }
85
86 bool isMappedArgument(uint32_t i) const
87 {
88 if (i >= m_totalLength)
89 return false;
90 unsigned namedLength = m_table->length();
91 if (i < namedLength)
92 return !!m_table->get(i);
93 return !!storage()[i - namedLength].get();
94 }
95
96 bool isMappedArgumentInDFG(uint32_t i) const
97 {
98 return isMappedArgument(i);
99 }
100
101 JSValue getIndexQuickly(uint32_t i) const
102 {
103 ASSERT_WITH_SECURITY_IMPLICATION(isMappedArgument(i));
104 unsigned namedLength = m_table->length();
105 if (i < namedLength)
106 return m_scope->variableAt(m_table->get(i)).get();
107 return storage()[i - namedLength].get();
108 }
109
110 void setIndexQuickly(VM& vm, uint32_t i, JSValue value)
111 {
112 ASSERT_WITH_SECURITY_IMPLICATION(isMappedArgument(i));
113 unsigned namedLength = m_table->length();
114 if (i < namedLength)
115 m_scope->variableAt(m_table->get(i)).set(vm, m_scope.get(), value);
116 else
117 storage()[i - namedLength].set(vm, this, value);
118 }
119
120 JSFunction* callee()
121 {
122 return m_callee.get();
123 }
124
125 bool overrodeThings() const { return m_overrodeThings; }
126 void overrideThings(VM&);
127 void overrideThingsIfNecessary(VM&);
128 void unmapArgument(VM&, uint32_t index);
129
130 void initModifiedArgumentsDescriptorIfNecessary(VM& vm)
131 {
132 GenericArguments<ScopedArguments>::initModifiedArgumentsDescriptorIfNecessary(vm, m_table->length());
133 }
134
135 void setModifiedArgumentDescriptor(VM& vm, unsigned index)
136 {
137 GenericArguments<ScopedArguments>::setModifiedArgumentDescriptor(vm, index, m_table->length());
138 }
139
140 bool isModifiedArgumentDescriptor(unsigned index)
141 {
142 return GenericArguments<ScopedArguments>::isModifiedArgumentDescriptor(index, m_table->length());
143 }
144
145 void copyToArguments(JSGlobalObject*, CallFrame*, VirtualRegister firstElementDest, unsigned offset, unsigned length);
146
147 DECLARE_INFO;
148
149 static Structure* createStructure(VM&, JSGlobalObject*, JSValue prototype);
150
151 static ptrdiff_t offsetOfOverrodeThings() { return OBJECT_OFFSETOF(ScopedArguments, m_overrodeThings); }
152 static ptrdiff_t offsetOfTotalLength() { return OBJECT_OFFSETOF(ScopedArguments, m_totalLength); }
153 static ptrdiff_t offsetOfTable() { return OBJECT_OFFSETOF(ScopedArguments, m_table); }
154 static ptrdiff_t offsetOfScope() { return OBJECT_OFFSETOF(ScopedArguments, m_scope); }
155 static ptrdiff_t offsetOfStorage() { return OBJECT_OFFSETOF(ScopedArguments, m_storage); }
156
157private:
158 WriteBarrier<Unknown>* storage() const
159 {
160 return m_storage.get();
161 }
162
163 bool m_overrodeThings { false }; // True if length, callee, and caller are fully materialized in the object.
164 unsigned m_totalLength; // The length of declared plus overflow arguments.
165 WriteBarrier<JSFunction> m_callee;
166 WriteBarrier<ScopedArgumentsTable> m_table;
167 WriteBarrier<JSLexicalEnvironment> m_scope;
168
169 AuxiliaryBarrier<WriteBarrier<Unknown>*> m_storage;
170};
171
172} // namespace JSC
173