The Tor Browser / file revision

 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-

  * vim: set ts=8 sts=4 et sw=4 tw=99:

  * This Source Code Form is subject to the terms of the Mozilla Public

  * License, v. 2.0. If a copy of the MPL was not distributed with this

  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

 #include "vm/Debugger-inl.h"

 #include "jscntxt.h"

 #include "jscompartment.h"

 #include "jshashutil.h"

 #include "jsnum.h"

 #include "jsobj.h"

 #include "jswrapper.h"

 #include "frontend/BytecodeCompiler.h"

 #include "gc/Marking.h"

 #include "jit/BaselineJIT.h"

 #include "js/Vector.h"

 #include "vm/ArgumentsObject.h"

 #include "vm/DebuggerMemory.h"

 #include "vm/WrapperObject.h"

 #include "jsgcinlines.h"

 #include "jsobjinlines.h"

 #include "jsopcodeinlines.h"

 #include "jsscriptinlines.h"

 #include "vm/ObjectImpl-inl.h"

 #include "vm/Stack-inl.h"

 using namespace js;

 using js::frontend::IsIdentifier;

 using mozilla::ArrayLength;

 using mozilla::Maybe;

 /*** Forward declarations ************************************************************************/

 extern const Class DebuggerFrame_class;

 enum {

     JSSLOT_DEBUGFRAME_OWNER,

     JSSLOT_DEBUGFRAME_ARGUMENTS,

     JSSLOT_DEBUGFRAME_ONSTEP_HANDLER,

     JSSLOT_DEBUGFRAME_ONPOP_HANDLER,

     JSSLOT_DEBUGFRAME_COUNT

 };

 extern const Class DebuggerArguments_class;

 enum {

     JSSLOT_DEBUGARGUMENTS_FRAME,

     JSSLOT_DEBUGARGUMENTS_COUNT

 };

 extern const Class DebuggerEnv_class;

 enum {

     JSSLOT_DEBUGENV_OWNER,

     JSSLOT_DEBUGENV_COUNT

 };

 extern const Class DebuggerObject_class;

 enum {

     JSSLOT_DEBUGOBJECT_OWNER,

     JSSLOT_DEBUGOBJECT_COUNT

 };

 extern const Class DebuggerScript_class;

 enum {

     JSSLOT_DEBUGSCRIPT_OWNER,

     JSSLOT_DEBUGSCRIPT_COUNT

 };

 extern const Class DebuggerSource_class;

 enum {

     JSSLOT_DEBUGSOURCE_OWNER,

     JSSLOT_DEBUGSOURCE_COUNT

 };

 /*** Utils ***************************************************************************************/

 static bool

 ReportMoreArgsNeeded(JSContext *cx, const char *name, unsigned required)

 {

     JS_ASSERT(required > 0);

     JS_ASSERT(required <= 10);

     char s[2];

     s[0] = '0' + (required - 1);

     s[1] = '\0';

     JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_MORE_ARGS_NEEDED,

                          name, s, required == 2 ? "" : "s");

     return false;

 }

 static inline bool

 EnsureFunctionHasScript(JSContext *cx, HandleFunction fun)

 {

     if (fun->isInterpretedLazy()) {

         AutoCompartment ac(cx, fun);

         return !!fun->getOrCreateScript(cx);

     }

     return true;

 }

 static inline JSScript *

 GetOrCreateFunctionScript(JSContext *cx, HandleFunction fun)

 {

     MOZ_ASSERT(fun->isInterpreted());

     if (!EnsureFunctionHasScript(cx, fun))

         return nullptr;

     return fun->nonLazyScript();

 }

 #define REQUIRE_ARGC(name, n)                                                 \

     JS_BEGIN_MACRO                                                            \

         if (argc < (n))                                                       \

             return ReportMoreArgsNeeded(cx, name, n);                         \

     JS_END_MACRO

 static bool

 ReportObjectRequired(JSContext *cx)

 {

     JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_NOT_NONNULL_OBJECT);

     return false;

 }

 static bool

 ValueToIdentifier(JSContext *cx, HandleValue v, MutableHandleId id)

 {

     if (!ValueToId<CanGC>(cx, v, id))

         return false;

     if (!JSID_IS_ATOM(id) || !IsIdentifier(JSID_TO_ATOM(id))) {

         RootedValue val(cx, v);

         js_ReportValueErrorFlags(cx, JSREPORT_ERROR, JSMSG_UNEXPECTED_TYPE,

                                  JSDVG_SEARCH_STACK, val, js::NullPtr(), "not an identifier",

                                  nullptr);

         return false;

     }

     return true;

 }

 /*

  * A range of all the Debugger.Frame objects for a particular AbstractFramePtr.

  *

  * FIXME This checks only current debuggers, so it relies on a hack in

  * Debugger::removeDebuggeeGlobal to make sure only current debuggers

  * have Frame objects with .live === true.

  */

 class Debugger::FrameRange

 {

     AbstractFramePtr frame;

     /* The debuggers in |fp|'s compartment, or nullptr if there are none. */

     GlobalObject::DebuggerVector *debuggers;

     /*

      * The index of the front Debugger.Frame's debugger in debuggers.

      * nextDebugger < debuggerCount if and only if the range is not empty.

      */

     size_t debuggerCount, nextDebugger;

     /*

      * If the range is not empty, this is front Debugger.Frame's entry in its

      * debugger's frame table.

      */

     FrameMap::Ptr entry;

   public:

     /*

      * Return a range containing all Debugger.Frame instances referring to

      * |fp|. |global| is |fp|'s global object; if nullptr or omitted, we

      * compute it ourselves from |fp|.

      *

      * We keep an index into the compartment's debugger list, and a

      * FrameMap::Ptr into the current debugger's frame map. Thus, if the set of

      * debuggers in |fp|'s compartment changes, this range becomes invalid.

      * Similarly, if stack frames are added to or removed from frontDebugger(),

      * then the range's front is invalid until popFront is called.

      */

     FrameRange(AbstractFramePtr frame, GlobalObject *global = nullptr)

       : frame(frame)

     {

         nextDebugger = 0;

         /* Find our global, if we were not given one. */

         if (!global)

             global = &frame.script()->global();

         /* The frame and global must match. */

         JS_ASSERT(&frame.script()->global() == global);

         /* Find the list of debuggers we'll iterate over. There may be none. */

         debuggers = global->getDebuggers();

         if (debuggers) {

             debuggerCount = debuggers->length();

             findNext();

         } else {

             debuggerCount = 0;

         }

     }

     bool empty() const {

         return nextDebugger >= debuggerCount;

     }

     JSObject *frontFrame() const {

         JS_ASSERT(!empty());

         return entry->value();

     }

     Debugger *frontDebugger() const {

         JS_ASSERT(!empty());

         return (*debuggers)[nextDebugger];

     }

     /*

      * Delete the front frame from its Debugger's frame map. After this call,

      * the range's front is invalid until popFront is called.

      */

     void removeFrontFrame() const {

         JS_ASSERT(!empty());

         frontDebugger()->frames.remove(entry);

     }

     void popFront() {

         JS_ASSERT(!empty());

         nextDebugger++;

         findNext();

     }

   private:

     /*

      * Either make this range refer to the first appropriate Debugger.Frame at

      * or after nextDebugger, or make it empty.

      */

     void findNext() {

         while (!empty()) {

             Debugger *dbg = (*debuggers)[nextDebugger];

             entry = dbg->frames.lookup(frame);

             if (entry)

                 break;

             nextDebugger++;

         }

     }

 };

 /*** Breakpoints *********************************************************************************/

 BreakpointSite::BreakpointSite(JSScript *script, jsbytecode *pc)

   : script(script), pc(pc), enabledCount(0),

     trapHandler(nullptr), trapClosure(UndefinedValue())

 {

     JS_ASSERT(!script->hasBreakpointsAt(pc));

     JS_INIT_CLIST(&breakpoints);

 }

 void

 BreakpointSite::recompile(FreeOp *fop)

 {

 #ifdef JS_ION

     if (script->hasBaselineScript())

         script->baselineScript()->toggleDebugTraps(script, pc);

 #endif

 }

 void

 BreakpointSite::inc(FreeOp *fop)

 {

     enabledCount++;

     if (enabledCount == 1 && !trapHandler)

         recompile(fop);

 }

 void

 BreakpointSite::dec(FreeOp *fop)

 {

     JS_ASSERT(enabledCount > 0);

     enabledCount--;

     if (enabledCount == 0 && !trapHandler)

         recompile(fop);

 }

 void

 BreakpointSite::setTrap(FreeOp *fop, JSTrapHandler handler, const Value &closure)

 {

     trapHandler = handler;

     trapClosure = closure;

     if (enabledCount == 0)

         recompile(fop);

 }

 void

 BreakpointSite::clearTrap(FreeOp *fop, JSTrapHandler *handlerp, Value *closurep)

 {

     if (handlerp)

         *handlerp = trapHandler;

     if (closurep)

         *closurep = trapClosure;

     trapHandler = nullptr;

     trapClosure = UndefinedValue();

     if (enabledCount == 0) {

         if (!fop->runtime()->isHeapBusy()) {

             /* If the GC is running then the script is being destroyed. */

             recompile(fop);

         }

         destroyIfEmpty(fop);

     }

 }

 void

 BreakpointSite::destroyIfEmpty(FreeOp *fop)

 {

     if (JS_CLIST_IS_EMPTY(&breakpoints) && !trapHandler)

         script->destroyBreakpointSite(fop, pc);

 }

 Breakpoint *

 BreakpointSite::firstBreakpoint() const

 {

     if (JS_CLIST_IS_EMPTY(&breakpoints))

         return nullptr;

     return Breakpoint::fromSiteLinks(JS_NEXT_LINK(&breakpoints));

 }

 bool

 BreakpointSite::hasBreakpoint(Breakpoint *bp)

 {

     for (Breakpoint *p = firstBreakpoint(); p; p = p->nextInSite())

         if (p == bp)

             return true;

     return false;

 }

 Breakpoint::Breakpoint(Debugger *debugger, BreakpointSite *site, JSObject *handler)

     : debugger(debugger), site(site), handler(handler)

 {

     JS_ASSERT(handler->compartment() == debugger->object->compartment());

     JS_APPEND_LINK(&debuggerLinks, &debugger->breakpoints);

     JS_APPEND_LINK(&siteLinks, &site->breakpoints);

 }

 Breakpoint *

 Breakpoint::fromDebuggerLinks(JSCList *links)

 {

     return (Breakpoint *) ((unsigned char *) links - offsetof(Breakpoint, debuggerLinks));

 }

 Breakpoint *

 Breakpoint::fromSiteLinks(JSCList *links)

 {

     return (Breakpoint *) ((unsigned char *) links - offsetof(Breakpoint, siteLinks));

 }

 void

 Breakpoint::destroy(FreeOp *fop)

 {

     if (debugger->enabled)

         site->dec(fop);

     JS_REMOVE_LINK(&debuggerLinks);

     JS_REMOVE_LINK(&siteLinks);

     site->destroyIfEmpty(fop);

     fop->delete_(this);

 }

 Breakpoint *

 Breakpoint::nextInDebugger()

 {

     JSCList *link = JS_NEXT_LINK(&debuggerLinks);

     return (link == &debugger->breakpoints) ? nullptr : fromDebuggerLinks(link);

 }

 Breakpoint *

 Breakpoint::nextInSite()

 {

     JSCList *link = JS_NEXT_LINK(&siteLinks);

     return (link == &site->breakpoints) ? nullptr : fromSiteLinks(link);

 }

 /*** Debugger hook dispatch **********************************************************************/

 Debugger::Debugger(JSContext *cx, JSObject *dbg)

   : object(dbg), uncaughtExceptionHook(nullptr), enabled(true),

     frames(cx->runtime()), scripts(cx), sources(cx), objects(cx), environments(cx)

 {

     assertSameCompartment(cx, dbg);

     cx->runtime()->debuggerList.insertBack(this);

     JS_INIT_CLIST(&breakpoints);

     JS_INIT_CLIST(&onNewGlobalObjectWatchersLink);

 }

 Debugger::~Debugger()

 {

     JS_ASSERT_IF(debuggees.initialized(), debuggees.empty());

     /*

      * Since the inactive state for this link is a singleton cycle, it's always

      * safe to apply JS_REMOVE_LINK to it, regardless of whether we're in the list or not.

      *

      * We don't have to worry about locking here since Debugger is not

      * background finalized.

      */

     JS_REMOVE_LINK(&onNewGlobalObjectWatchersLink);

 }

 bool

 Debugger::init(JSContext *cx)

 {

     bool ok = debuggees.init() &&

               frames.init() &&

               scripts.init() &&

               sources.init() &&

               objects.init() &&

               environments.init();

     if (!ok)

         js_ReportOutOfMemory(cx);

     return ok;

 }

 Debugger *

 Debugger::fromJSObject(JSObject *obj)

 {

     JS_ASSERT(js::GetObjectClass(obj) == &jsclass);

     return (Debugger *) obj->getPrivate();

 }

 JS_STATIC_ASSERT(unsigned(JSSLOT_DEBUGFRAME_OWNER) == unsigned(JSSLOT_DEBUGSCRIPT_OWNER));

 JS_STATIC_ASSERT(unsigned(JSSLOT_DEBUGFRAME_OWNER) == unsigned(JSSLOT_DEBUGSOURCE_OWNER));

 JS_STATIC_ASSERT(unsigned(JSSLOT_DEBUGFRAME_OWNER) == unsigned(JSSLOT_DEBUGOBJECT_OWNER));

 JS_STATIC_ASSERT(unsigned(JSSLOT_DEBUGFRAME_OWNER) == unsigned(JSSLOT_DEBUGENV_OWNER));

 Debugger *

 Debugger::fromChildJSObject(JSObject *obj)

 {

     JS_ASSERT(obj->getClass() == &DebuggerFrame_class ||

               obj->getClass() == &DebuggerScript_class ||

               obj->getClass() == &DebuggerSource_class ||

               obj->getClass() == &DebuggerObject_class ||

               obj->getClass() == &DebuggerEnv_class);

     JSObject *dbgobj = &obj->getReservedSlot(JSSLOT_DEBUGOBJECT_OWNER).toObject();

     return fromJSObject(dbgobj);

 }

 bool

 Debugger::getScriptFrameWithIter(JSContext *cx, AbstractFramePtr frame,

                                  const ScriptFrameIter *maybeIter, MutableHandleValue vp)

 {

     MOZ_ASSERT_IF(maybeIter, maybeIter->abstractFramePtr() == frame);

     FrameMap::AddPtr p = frames.lookupForAdd(frame);

     if (!p) {

         /* Create and populate the Debugger.Frame object. */

         JSObject *proto = &object->getReservedSlot(JSSLOT_DEBUG_FRAME_PROTO).toObject();

         JSObject *frameobj =

             NewObjectWithGivenProto(cx, &DebuggerFrame_class, proto, nullptr);

         if (!frameobj)

             return false;

         // Eagerly copy ScriptFrameIter data if we've already walked the

         // stack.

         if (maybeIter) {

             AbstractFramePtr data = maybeIter->copyDataAsAbstractFramePtr();

             if (!data)

                 return false;

             frameobj->setPrivate(data.raw());

         } else {

             frameobj->setPrivate(frame.raw());

         }

         frameobj->setReservedSlot(JSSLOT_DEBUGFRAME_OWNER, ObjectValue(*object));

         if (!frames.add(p, frame, frameobj)) {

             js_ReportOutOfMemory(cx);

             return false;

         }

     }

     vp.setObject(*p->value());

     return true;

 }

 JSObject *

 Debugger::getHook(Hook hook) const

 {

     JS_ASSERT(hook >= 0 && hook < HookCount);

     const Value &v = object->getReservedSlot(JSSLOT_DEBUG_HOOK_START + hook);

     return v.isUndefined() ? nullptr : &v.toObject();

 }

 bool

 Debugger::hasAnyLiveHooks() const

 {

     if (!enabled)

         return false;

     if (getHook(OnDebuggerStatement) ||

         getHook(OnExceptionUnwind) ||

         getHook(OnNewScript) ||

         getHook(OnEnterFrame))

     {

         return true;

     }

     /* If any breakpoints are in live scripts, return true. */

     for (Breakpoint *bp = firstBreakpoint(); bp; bp = bp->nextInDebugger()) {

         if (IsScriptMarked(&bp->site->script))

             return true;

     }

     for (FrameMap::Range r = frames.all(); !r.empty(); r.popFront()) {

         JSObject *frameObj = r.front().value();

         if (!frameObj->getReservedSlot(JSSLOT_DEBUGFRAME_ONSTEP_HANDLER).isUndefined() ||

             !frameObj->getReservedSlot(JSSLOT_DEBUGFRAME_ONPOP_HANDLER).isUndefined())

             return true;

     }

     return false;

 }

 JSTrapStatus

 Debugger::slowPathOnEnterFrame(JSContext *cx, AbstractFramePtr frame, MutableHandleValue vp)

 {

     /* Build the list of recipients. */

     AutoValueVector triggered(cx);

     Handle<GlobalObject*> global = cx->global();

     if (GlobalObject::DebuggerVector *debuggers = global->getDebuggers()) {

         for (Debugger **p = debuggers->begin(); p != debuggers->end(); p++) {

             Debugger *dbg = *p;

             if (dbg->observesFrame(frame) && dbg->observesEnterFrame() &&

                 !triggered.append(ObjectValue(*dbg->toJSObject())))

             {

                 return JSTRAP_ERROR;

             }

         }

     }

     /* Deliver the event, checking again as in dispatchHook. */

     for (Value *p = triggered.begin(); p != triggered.end(); p++) {

         Debugger *dbg = Debugger::fromJSObject(&p->toObject());

         if (dbg->debuggees.has(global) && dbg->observesEnterFrame()) {

             JSTrapStatus status = dbg->fireEnterFrame(cx, frame, vp);

             if (status != JSTRAP_CONTINUE)

                 return status;

         }

     }

     return JSTRAP_CONTINUE;

 }

 static void

 DebuggerFrame_maybeDecrementFrameScriptStepModeCount(FreeOp *fop, AbstractFramePtr frame,

                                                      JSObject *frameobj);

 static void

 DebuggerFrame_freeScriptFrameIterData(FreeOp *fop, JSObject *obj);

 /*

  * Handle leaving a frame with debuggers watching. |frameOk| indicates whether

  * the frame is exiting normally or abruptly. Set |cx|'s exception and/or

  * |cx->fp()|'s return value, and return a new success value.

  */

 bool

 Debugger::slowPathOnLeaveFrame(JSContext *cx, AbstractFramePtr frame, bool frameOk)

 {

     Handle<GlobalObject*> global = cx->global();

     /* Save the frame's completion value. */

     JSTrapStatus status;

     RootedValue value(cx);

     Debugger::resultToCompletion(cx, frameOk, frame.returnValue(), &status, &value);

     /* Build a list of the recipients. */

     AutoObjectVector frames(cx);

     for (FrameRange r(frame, global); !r.empty(); r.popFront()) {

         if (!frames.append(r.frontFrame())) {

             cx->clearPendingException();

             return false;

         }

     }

     /* For each Debugger.Frame, fire its onPop handler, if any. */

     for (JSObject **p = frames.begin(); p != frames.end(); p++) {

         RootedObject frameobj(cx, *p);

         Debugger *dbg = Debugger::fromChildJSObject(frameobj);

         if (dbg->enabled &&

             !frameobj->getReservedSlot(JSSLOT_DEBUGFRAME_ONPOP_HANDLER).isUndefined()) {

             RootedValue handler(cx, frameobj->getReservedSlot(JSSLOT_DEBUGFRAME_ONPOP_HANDLER));

             Maybe<AutoCompartment> ac;

             ac.construct(cx, dbg->object);

             RootedValue completion(cx);

             if (!dbg->newCompletionValue(cx, status, value, &completion)) {

                 status = dbg->handleUncaughtException(ac, false);

                 break;

             }

             /* Call the onPop handler. */

             RootedValue rval(cx);

             bool hookOk = Invoke(cx, ObjectValue(*frameobj), handler, 1, completion.address(),

                                  &rval);

             RootedValue nextValue(cx);

             JSTrapStatus nextStatus = dbg->parseResumptionValue(ac, hookOk, rval, &nextValue);

             /*

              * At this point, we are back in the debuggee compartment, and any error has

              * been wrapped up as a completion value.

              */

             JS_ASSERT(cx->compartment() == global->compartment());

             JS_ASSERT(!cx->isExceptionPending());

             /* JSTRAP_CONTINUE means "make no change". */

             if (nextStatus != JSTRAP_CONTINUE) {

                 status = nextStatus;

                 value = nextValue;

             }

         }

     }

     /*

      * Clean up all Debugger.Frame instances. Use a fresh FrameRange, as one

      * debugger's onPop handler could have caused another debugger to create its

      * own Debugger.Frame instance.

      */

     for (FrameRange r(frame, global); !r.empty(); r.popFront()) {

         RootedObject frameobj(cx, r.frontFrame());

         Debugger *dbg = r.frontDebugger();

         JS_ASSERT(dbg == Debugger::fromChildJSObject(frameobj));

         FreeOp *fop = cx->runtime()->defaultFreeOp();

         DebuggerFrame_freeScriptFrameIterData(fop, frameobj);

         DebuggerFrame_maybeDecrementFrameScriptStepModeCount(fop, frame, frameobj);

         dbg->frames.remove(frame);

     }

     /*

      * If this is an eval frame, then from the debugger's perspective the

      * script is about to be destroyed. Remove any breakpoints in it.

      */

     if (frame.isEvalFrame()) {

         RootedScript script(cx, frame.script());

         script->clearBreakpointsIn(cx->runtime()->defaultFreeOp(), nullptr, nullptr);

     }

     /* Establish (status, value) as our resumption value. */

     switch (status) {

       case JSTRAP_RETURN:

         frame.setReturnValue(value);

         return true;

       case JSTRAP_THROW:

         cx->setPendingException(value);

         return false;

       case JSTRAP_ERROR:

         JS_ASSERT(!cx->isExceptionPending());

         return false;

       default:

         MOZ_ASSUME_UNREACHABLE("bad final trap status");

     }

 }

 bool

 Debugger::wrapEnvironment(JSContext *cx, Handle<Env*> env, MutableHandleValue rval)

 {

     if (!env) {

         rval.setNull();

         return true;

     }

     /*

      * DebuggerEnv should only wrap a debug scope chain obtained (transitively)

      * from GetDebugScopeFor(Frame|Function).

      */

     JS_ASSERT(!env->is<ScopeObject>());

     JSObject *envobj;

     DependentAddPtr<ObjectWeakMap> p(cx, environments, env);

     if (p) {

         envobj = p->value();

     } else {

         /* Create a new Debugger.Environment for env. */

         JSObject *proto = &object->getReservedSlot(JSSLOT_DEBUG_ENV_PROTO).toObject();

         envobj = NewObjectWithGivenProto(cx, &DebuggerEnv_class, proto, nullptr, TenuredObject);

         if (!envobj)

             return false;

         envobj->setPrivateGCThing(env);

         envobj->setReservedSlot(JSSLOT_DEBUGENV_OWNER, ObjectValue(*object));

         if (!p.add(cx, environments, env, envobj)) {

             js_ReportOutOfMemory(cx);

             return false;

         }

         CrossCompartmentKey key(CrossCompartmentKey::DebuggerEnvironment, object, env);

         if (!object->compartment()->putWrapper(cx, key, ObjectValue(*envobj))) {

             environments.remove(env);

             js_ReportOutOfMemory(cx);

             return false;

         }

     }

     rval.setObject(*envobj);

     return true;

 }

 bool

 Debugger::wrapDebuggeeValue(JSContext *cx, MutableHandleValue vp)

 {

     assertSameCompartment(cx, object.get());

     if (vp.isObject()) {

         RootedObject obj(cx, &vp.toObject());

         if (obj->is<JSFunction>()) {

             RootedFunction fun(cx, &obj->as<JSFunction>());

             if (!EnsureFunctionHasScript(cx, fun))

                 return false;

         }

         DependentAddPtr<ObjectWeakMap> p(cx, objects, obj);

         if (p) {

             vp.setObject(*p->value());

         } else {

             /* Create a new Debugger.Object for obj. */

             JSObject *proto = &object->getReservedSlot(JSSLOT_DEBUG_OBJECT_PROTO).toObject();

             JSObject *dobj =

                 NewObjectWithGivenProto(cx, &DebuggerObject_class, proto, nullptr, TenuredObject);

             if (!dobj)

                 return false;

             dobj->setPrivateGCThing(obj);

             dobj->setReservedSlot(JSSLOT_DEBUGOBJECT_OWNER, ObjectValue(*object));

             if (!p.add(cx, objects, obj, dobj)) {

                 js_ReportOutOfMemory(cx);

                 return false;

             }

             if (obj->compartment() != object->compartment()) {

                 CrossCompartmentKey key(CrossCompartmentKey::DebuggerObject, object, obj);

                 if (!object->compartment()->putWrapper(cx, key, ObjectValue(*dobj))) {

                     objects.remove(obj);

                     js_ReportOutOfMemory(cx);

                     return false;

                 }

             }

             vp.setObject(*dobj);

         }

     } else if (vp.isMagic()) {

         RootedObject optObj(cx, NewBuiltinClassInstance(cx, &JSObject::class_));

         if (!optObj)

             return false;

         // We handle two sentinel values: missing arguments (overloading

         // JS_OPTIMIZED_ARGUMENTS) and optimized out slots (JS_OPTIMIZED_OUT).

         // Other magic values should not have escaped.

         PropertyName *name;

         if (vp.whyMagic() == JS_OPTIMIZED_ARGUMENTS) {

             name = cx->names().missingArguments;

         } else {

             MOZ_ASSERT(vp.whyMagic() == JS_OPTIMIZED_OUT);

             name = cx->names().optimizedOut;

         }

         RootedValue trueVal(cx, BooleanValue(true));

         if (!JSObject::defineProperty(cx, optObj, name, trueVal))

             return false;

         vp.setObject(*optObj);

     } else if (!cx->compartment()->wrap(cx, vp)) {

         vp.setUndefined();

         return false;

     }

     return true;

 }

 bool

 Debugger::unwrapDebuggeeValue(JSContext *cx, MutableHandleValue vp)

 {

     assertSameCompartment(cx, object.get(), vp);

     if (vp.isObject()) {

         JSObject *dobj = &vp.toObject();

         if (dobj->getClass() != &DebuggerObject_class) {

             JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_NOT_EXPECTED_TYPE,

                                  "Debugger", "Debugger.Object", dobj->getClass()->name);

             return false;

         }

         Value owner = dobj->getReservedSlot(JSSLOT_DEBUGOBJECT_OWNER);

         if (owner.isUndefined() || &owner.toObject() != object) {

             JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr,

                                  owner.isUndefined()

                                  ? JSMSG_DEBUG_OBJECT_PROTO

                                  : JSMSG_DEBUG_OBJECT_WRONG_OWNER);

             return false;

         }

         vp.setObject(*static_cast<JSObject*>(dobj->getPrivate()));

     }

     return true;

 }

 JSTrapStatus

 Debugger::handleUncaughtExceptionHelper(Maybe<AutoCompartment> &ac,

                                         MutableHandleValue *vp, bool callHook)

 {

     JSContext *cx = ac.ref().context()->asJSContext();

     if (cx->isExceptionPending()) {

         if (callHook && uncaughtExceptionHook) {

             RootedValue exc(cx);

             if (!cx->getPendingException(&exc))

                 return JSTRAP_ERROR;

             cx->clearPendingException();

             RootedValue fval(cx, ObjectValue(*uncaughtExceptionHook));

             RootedValue rv(cx);

             if (Invoke(cx, ObjectValue(*object), fval, 1, exc.address(), &rv))

                 return vp ? parseResumptionValue(ac, true, rv, *vp, false) : JSTRAP_CONTINUE;

         }

         if (cx->isExceptionPending()) {

             JS_ReportPendingException(cx);

             cx->clearPendingException();

         }

     }

     ac.destroy();

     return JSTRAP_ERROR;

 }

 JSTrapStatus

 Debugger::handleUncaughtException(Maybe<AutoCompartment> &ac, MutableHandleValue vp, bool callHook)

 {

     return handleUncaughtExceptionHelper(ac, &vp, callHook);

 }

 JSTrapStatus

 Debugger::handleUncaughtException(Maybe<AutoCompartment> &ac, bool callHook)

 {

     return handleUncaughtExceptionHelper(ac, nullptr, callHook);

 }

 void

 Debugger::resultToCompletion(JSContext *cx, bool ok, const Value &rv,

                              JSTrapStatus *status, MutableHandleValue value)

 {

     JS_ASSERT_IF(ok, !cx->isExceptionPending());

     if (ok) {

         *status = JSTRAP_RETURN;

         value.set(rv);

     } else if (cx->isExceptionPending()) {

         *status = JSTRAP_THROW;

         if (!cx->getPendingException(value))

             *status = JSTRAP_ERROR;

         cx->clearPendingException();

     } else {

         *status = JSTRAP_ERROR;

         value.setUndefined();

     }

 }

 bool

 Debugger::newCompletionValue(JSContext *cx, JSTrapStatus status, Value value_,

                              MutableHandleValue result)

 {

     /*

      * We must be in the debugger's compartment, since that's where we want

      * to construct the completion value.

      */

     assertSameCompartment(cx, object.get());

     RootedId key(cx);

     RootedValue value(cx, value_);

     switch (status) {

       case JSTRAP_RETURN:

         key = NameToId(cx->names().return_);

         break;

       case JSTRAP_THROW:

         key = NameToId(cx->names().throw_);

         break;

       case JSTRAP_ERROR:

         result.setNull();

         return true;

       default:

         MOZ_ASSUME_UNREACHABLE("bad status passed to Debugger::newCompletionValue");

     }

     /* Common tail for JSTRAP_RETURN and JSTRAP_THROW. */

     RootedObject obj(cx, NewBuiltinClassInstance(cx, &JSObject::class_));

     if (!obj ||

         !wrapDebuggeeValue(cx, &value) ||

         !DefineNativeProperty(cx, obj, key, value, JS_PropertyStub, JS_StrictPropertyStub,

                               JSPROP_ENUMERATE))

     {

         return false;

     }

     result.setObject(*obj);

     return true;

 }

 bool

 Debugger::receiveCompletionValue(Maybe<AutoCompartment> &ac, bool ok,

                                  HandleValue val,

                                  MutableHandleValue vp)

 {

     JSContext *cx = ac.ref().context()->asJSContext();

     JSTrapStatus status;

     RootedValue value(cx);

     resultToCompletion(cx, ok, val, &status, &value);

     ac.destroy();

     return newCompletionValue(cx, status, value, vp);

 }

 JSTrapStatus

 Debugger::parseResumptionValue(Maybe<AutoCompartment> &ac, bool ok, const Value &rv, MutableHandleValue vp,

                                bool callHook)

 {

     vp.setUndefined();

     if (!ok)

         return handleUncaughtException(ac, vp, callHook);

     if (rv.isUndefined()) {

         ac.destroy();

         return JSTRAP_CONTINUE;

     }

     if (rv.isNull()) {

         ac.destroy();

         return JSTRAP_ERROR;

     }

     /* Check that rv is {return: val} or {throw: val}. */

     JSContext *cx = ac.ref().context()->asJSContext();

     Rooted<JSObject*> obj(cx);

     RootedShape shape(cx);

     RootedId returnId(cx, NameToId(cx->names().return_));

     RootedId throwId(cx, NameToId(cx->names().throw_));

     bool okResumption = rv.isObject();

     if (okResumption) {

         obj = &rv.toObject();

         okResumption = obj->is<JSObject>();

     }

     if (okResumption) {

         shape = obj->lastProperty();

         okResumption = shape->previous() &&

              !shape->previous()->previous() &&

              (shape->propid() == returnId || shape->propid() == throwId) &&

              shape->isDataDescriptor();

     }

     if (!okResumption) {

         JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_DEBUG_BAD_RESUMPTION);

         return handleUncaughtException(ac, vp, callHook);

     }

     RootedValue v(cx, vp.get());

     if (!NativeGet(cx, obj, obj, shape, &v) || !unwrapDebuggeeValue(cx, &v))

         return handleUncaughtException(ac, &v, callHook);

     ac.destroy();

     if (!cx->compartment()->wrap(cx, &v)) {

         vp.setUndefined();

         return JSTRAP_ERROR;

     }

     vp.set(v);

     return shape->propid() == returnId ? JSTRAP_RETURN : JSTRAP_THROW;

 }

 static bool

 CallMethodIfPresent(JSContext *cx, HandleObject obj, const char *name, int argc, Value *argv,

                     MutableHandleValue rval)

 {

     rval.setUndefined();

     JSAtom *atom = Atomize(cx, name, strlen(name));

     if (!atom)

         return false;

     RootedId id(cx, AtomToId(atom));

     RootedValue fval(cx);

     return JSObject::getGeneric(cx, obj, obj, id, &fval) &&

            (!js_IsCallable(fval) || Invoke(cx, ObjectValue(*obj), fval, argc, argv, rval));

 }

 JSTrapStatus

 Debugger::fireDebuggerStatement(JSContext *cx, MutableHandleValue vp)

 {

     RootedObject hook(cx, getHook(OnDebuggerStatement));

     JS_ASSERT(hook);

     JS_ASSERT(hook->isCallable());

     Maybe<AutoCompartment> ac;

     ac.construct(cx, object);

     ScriptFrameIter iter(cx);

     RootedValue scriptFrame(cx);

     if (!getScriptFrame(cx, iter, &scriptFrame))

         return handleUncaughtException(ac, false);

     RootedValue rv(cx);

     bool ok = Invoke(cx, ObjectValue(*object), ObjectValue(*hook), 1, scriptFrame.address(), &rv);

     return parseResumptionValue(ac, ok, rv, vp);

 }

 JSTrapStatus

 Debugger::fireExceptionUnwind(JSContext *cx, MutableHandleValue vp)

 {

     RootedObject hook(cx, getHook(OnExceptionUnwind));

     JS_ASSERT(hook);

     JS_ASSERT(hook->isCallable());

     RootedValue exc(cx);

     if (!cx->getPendingException(&exc))

         return JSTRAP_ERROR;

     cx->clearPendingException();

     Maybe<AutoCompartment> ac;

     ac.construct(cx, object);

     JS::AutoValueArray<2> argv(cx);

     argv[0].setUndefined();

     argv[1].set(exc);

     ScriptFrameIter iter(cx);

     if (!getScriptFrame(cx, iter, argv[0]) || !wrapDebuggeeValue(cx, argv[1]))

         return handleUncaughtException(ac, false);

     RootedValue rv(cx);

     bool ok = Invoke(cx, ObjectValue(*object), ObjectValue(*hook), 2, argv.begin(), &rv);

     JSTrapStatus st = parseResumptionValue(ac, ok, rv, vp);

     if (st == JSTRAP_CONTINUE)

         cx->setPendingException(exc);

     return st;

 }

 JSTrapStatus

 Debugger::fireEnterFrame(JSContext *cx, AbstractFramePtr frame, MutableHandleValue vp)

 {

     RootedObject hook(cx, getHook(OnEnterFrame));

     JS_ASSERT(hook);

     JS_ASSERT(hook->isCallable());

     Maybe<AutoCompartment> ac;

     ac.construct(cx, object);

     RootedValue scriptFrame(cx);

     if (!getScriptFrame(cx, frame, &scriptFrame))

         return handleUncaughtException(ac, false);

     RootedValue rv(cx);

     bool ok = Invoke(cx, ObjectValue(*object), ObjectValue(*hook), 1, scriptFrame.address(), &rv);

     return parseResumptionValue(ac, ok, rv, vp);

 }

 void

 Debugger::fireNewScript(JSContext *cx, HandleScript script)

 {

     RootedObject hook(cx, getHook(OnNewScript));

     JS_ASSERT(hook);

     JS_ASSERT(hook->isCallable());

     Maybe<AutoCompartment> ac;

     ac.construct(cx, object);

     JSObject *dsobj = wrapScript(cx, script);

     if (!dsobj) {

         handleUncaughtException(ac, false);

         return;

     }

     RootedValue scriptObject(cx, ObjectValue(*dsobj));

     RootedValue rv(cx);

     if (!Invoke(cx, ObjectValue(*object), ObjectValue(*hook), 1, scriptObject.address(), &rv))

         handleUncaughtException(ac, true);

 }

 JSTrapStatus

 Debugger::dispatchHook(JSContext *cx, MutableHandleValue vp, Hook which)

 {

     JS_ASSERT(which == OnDebuggerStatement || which == OnExceptionUnwind);

     /*

      * Determine which debuggers will receive this event, and in what order.

      * Make a copy of the list, since the original is mutable and we will be

      * calling into arbitrary JS.

      *

      * Note: In the general case, 'triggered' contains references to objects in

      * different compartments--every compartment *except* this one.

      */

     AutoValueVector triggered(cx);

     Handle<GlobalObject*> global = cx->global();

     if (GlobalObject::DebuggerVector *debuggers = global->getDebuggers()) {

         for (Debugger **p = debuggers->begin(); p != debuggers->end(); p++) {

             Debugger *dbg = *p;

             if (dbg->enabled && dbg->getHook(which)) {

                 if (!triggered.append(ObjectValue(*dbg->toJSObject())))

                     return JSTRAP_ERROR;

             }

         }

     }

     /*

      * Deliver the event to each debugger, checking again to make sure it

      * should still be delivered.

      */

     for (Value *p = triggered.begin(); p != triggered.end(); p++) {

         Debugger *dbg = Debugger::fromJSObject(&p->toObject());

         if (dbg->debuggees.has(global) && dbg->enabled && dbg->getHook(which)) {

             JSTrapStatus st = (which == OnDebuggerStatement)

                               ? dbg->fireDebuggerStatement(cx, vp)

                               : dbg->fireExceptionUnwind(cx, vp);

             if (st != JSTRAP_CONTINUE)

                 return st;

         }

     }

     return JSTRAP_CONTINUE;

 }

 static bool

 AddNewScriptRecipients(GlobalObject::DebuggerVector *src, HandleScript script,

                        AutoValueVector *dest)

 {

     bool wasEmpty = dest->length() == 0;

     for (Debugger **p = src->begin(); p != src->end(); p++) {

         Debugger *dbg = *p;

         Value v = ObjectValue(*dbg->toJSObject());

         if (dbg->observesScript(script) && dbg->observesNewScript() &&

             (wasEmpty || Find(dest->begin(), dest->end(), v) == dest->end()) &&

             !dest->append(v))

         {

             return false;

         }

     }

     return true;

 }

 void

 Debugger::slowPathOnNewScript(JSContext *cx, HandleScript script, GlobalObject *compileAndGoGlobal_)

 {

     Rooted<GlobalObject*> compileAndGoGlobal(cx, compileAndGoGlobal_);

     JS_ASSERT(script->compileAndGo() == !!compileAndGoGlobal);

     /*

      * Build the list of recipients. For compile-and-go scripts, this is the

      * same as the generic Debugger::dispatchHook code, but non-compile-and-go

      * scripts are not tied to particular globals. We deliver them to every

      * debugger observing any global in the script's compartment.

      */

     AutoValueVector triggered(cx);

     if (script->compileAndGo()) {

         if (GlobalObject::DebuggerVector *debuggers = compileAndGoGlobal->getDebuggers()) {

             if (!AddNewScriptRecipients(debuggers, script, &triggered))

                 return;

         }

     } else {

         GlobalObjectSet &debuggees = script->compartment()->getDebuggees();

         for (GlobalObjectSet::Range r = debuggees.all(); !r.empty(); r.popFront()) {

             if (!AddNewScriptRecipients(r.front()->getDebuggers(), script, &triggered))

                 return;

         }

     }

     /*

      * Deliver the event to each debugger, checking again as in

      * Debugger::dispatchHook.

      */

     for (Value *p = triggered.begin(); p != triggered.end(); p++) {

         Debugger *dbg = Debugger::fromJSObject(&p->toObject());

         if ((!compileAndGoGlobal || dbg->debuggees.has(compileAndGoGlobal)) &&

             dbg->enabled && dbg->getHook(OnNewScript)) {

             dbg->fireNewScript(cx, script);

         }

     }

 }

 JSTrapStatus

 Debugger::onTrap(JSContext *cx, MutableHandleValue vp)

 {

     MOZ_ASSERT(cx->compartment()->debugMode());

     ScriptFrameIter iter(cx);

     RootedScript script(cx, iter.script());

     Rooted<GlobalObject*> scriptGlobal(cx, &script->global());

     jsbytecode *pc = iter.pc();

     BreakpointSite *site = script->getBreakpointSite(pc);

     JSOp op = JSOp(*pc);

     /* Build list of breakpoint handlers. */

     Vector<Breakpoint *> triggered(cx);

     for (Breakpoint *bp = site->firstBreakpoint(); bp; bp = bp->nextInSite()) {

         if (!triggered.append(bp))

             return JSTRAP_ERROR;

     }

     for (Breakpoint **p = triggered.begin(); p != triggered.end(); p++) {

         Breakpoint *bp = *p;

         /* Handlers can clear breakpoints. Check that bp still exists. */

         if (!site || !site->hasBreakpoint(bp))

             continue;

         /*

          * There are two reasons we have to check whether dbg is enabled and

          * debugging scriptGlobal.

          *

          * One is just that one breakpoint handler can disable other Debuggers

          * or remove debuggees.

          *

          * The other has to do with non-compile-and-go scripts, which have no

          * specific global--until they are executed. Only now do we know which

          * global the script is running against.

          */

         Debugger *dbg = bp->debugger;

         if (dbg->enabled && dbg->debuggees.lookup(scriptGlobal)) {

             Maybe<AutoCompartment> ac;

             ac.construct(cx, dbg->object);

             RootedValue scriptFrame(cx);

             if (!dbg->getScriptFrame(cx, iter, &scriptFrame))

                 return dbg->handleUncaughtException(ac, false);

             RootedValue rv(cx);

             Rooted<JSObject*> handler(cx, bp->handler);

             bool ok = CallMethodIfPresent(cx, handler, "hit", 1, scriptFrame.address(), &rv);

             JSTrapStatus st = dbg->parseResumptionValue(ac, ok, rv, vp, true);

             if (st != JSTRAP_CONTINUE)

                 return st;

             /* Calling JS code invalidates site. Reload it. */

             site = script->getBreakpointSite(pc);

         }

     }

     if (site && site->trapHandler) {

         JSTrapStatus st = site->trapHandler(cx, script, pc, vp.address(), site->trapClosure);

         if (st != JSTRAP_CONTINUE)

             return st;

     }

     /* By convention, return the true op to the interpreter in vp. */

     vp.setInt32(op);

     return JSTRAP_CONTINUE;

 }

 JSTrapStatus

 Debugger::onSingleStep(JSContext *cx, MutableHandleValue vp)

 {

     ScriptFrameIter iter(cx);

     /*

      * We may be stepping over a JSOP_EXCEPTION, that pushes the context's

      * pending exception for a 'catch' clause to handle. Don't let the

      * onStep handlers mess with that (other than by returning a resumption

      * value).

      */

     RootedValue exception(cx, UndefinedValue());

     bool exceptionPending = cx->isExceptionPending();

     if (exceptionPending) {

         if (!cx->getPendingException(&exception))

             return JSTRAP_ERROR;

         cx->clearPendingException();

     }

     /*

      * Build list of Debugger.Frame instances referring to this frame with

      * onStep handlers.

      */

     AutoObjectVector frames(cx);

     for (FrameRange r(iter.abstractFramePtr()); !r.empty(); r.popFront()) {

         JSObject *frame = r.frontFrame();

         if (!frame->getReservedSlot(JSSLOT_DEBUGFRAME_ONSTEP_HANDLER).isUndefined() &&

             !frames.append(frame))

         {

             return JSTRAP_ERROR;

         }

     }

 #ifdef DEBUG

     /*

      * Validate the single-step count on this frame's script, to ensure that

      * we're not receiving traps we didn't ask for. Even when frames is

      * non-empty (and thus we know this trap was requested), do the check

      * anyway, to make sure the count has the correct non-zero value.

      *

      * The converse --- ensuring that we do receive traps when we should --- can

      * be done with unit tests.

      */

     {

         uint32_t stepperCount = 0;

         JSScript *trappingScript = iter.script();

         GlobalObject *global = cx->global();

         if (GlobalObject::DebuggerVector *debuggers = global->getDebuggers()) {

             for (Debugger **p = debuggers->begin(); p != debuggers->end(); p++) {

                 Debugger *dbg = *p;

                 for (FrameMap::Range r = dbg->frames.all(); !r.empty(); r.popFront()) {

                     AbstractFramePtr frame = r.front().key();

                     JSObject *frameobj = r.front().value();

                     if (frame.script() == trappingScript &&

                         !frameobj->getReservedSlot(JSSLOT_DEBUGFRAME_ONSTEP_HANDLER).isUndefined())

                     {

                         stepperCount++;

                     }

                 }

             }

         }

         if (trappingScript->compileAndGo())

             JS_ASSERT(stepperCount == trappingScript->stepModeCount());

         else

             JS_ASSERT(stepperCount <= trappingScript->stepModeCount());

     }

 #endif

     /* Preserve the debuggee's iterValue while handlers run. */

     class PreserveIterValue {

         JSContext *cx;

         RootedValue savedIterValue;

       public:

         PreserveIterValue(JSContext *cx) : cx(cx), savedIterValue(cx, cx->iterValue) {

             cx->iterValue.setMagic(JS_NO_ITER_VALUE);

         }

         ~PreserveIterValue() {

             cx->iterValue = savedIterValue;

         }

     };

     PreserveIterValue piv(cx);

     /* Call all the onStep handlers we found. */

     for (JSObject **p = frames.begin(); p != frames.end(); p++) {

         RootedObject frame(cx, *p);

         Debugger *dbg = Debugger::fromChildJSObject(frame);

         Maybe<AutoCompartment> ac;

         ac.construct(cx, dbg->object);

         const Value &handler = frame->getReservedSlot(JSSLOT_DEBUGFRAME_ONSTEP_HANDLER);

         RootedValue rval(cx);

         bool ok = Invoke(cx, ObjectValue(*frame), handler, 0, nullptr, &rval);

         JSTrapStatus st = dbg->parseResumptionValue(ac, ok, rval, vp);

         if (st != JSTRAP_CONTINUE)

             return st;

     }

     vp.setUndefined();

     if (exceptionPending)

         cx->setPendingException(exception);

     return JSTRAP_CONTINUE;

 }

 JSTrapStatus

 Debugger::fireNewGlobalObject(JSContext *cx, Handle<GlobalObject *> global, MutableHandleValue vp)

 {

     RootedObject hook(cx, getHook(OnNewGlobalObject));

     JS_ASSERT(hook);

     JS_ASSERT(hook->isCallable());

     Maybe<AutoCompartment> ac;

     ac.construct(cx, object);

     RootedValue wrappedGlobal(cx, ObjectValue(*global));

     if (!wrapDebuggeeValue(cx, &wrappedGlobal))

         return handleUncaughtException(ac, false);

     RootedValue rv(cx);

     // onNewGlobalObject is infallible, and thus is only allowed to return

     // undefined as a resumption value. If it returns anything else, we throw.

     // And if that happens, or if the hook itself throws, we invoke the

     // uncaughtExceptionHook so that we never leave an exception pending on the

     // cx. This allows JS_NewGlobalObject to avoid handling failures from debugger

     // hooks.

     bool ok = Invoke(cx, ObjectValue(*object), ObjectValue(*hook), 1, wrappedGlobal.address(), &rv);

     if (ok && !rv.isUndefined()) {

         JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr,

                              JSMSG_DEBUG_RESUMPTION_VALUE_DISALLOWED);

         ok = false;

     }

     // NB: Even though we don't care about what goes into it, we have to pass vp

     // to handleUncaughtException so that it parses resumption values from the

     // uncaughtExceptionHook and tells the caller whether we should execute the

     // rest of the onNewGlobalObject hooks or not.

     JSTrapStatus status = ok ? JSTRAP_CONTINUE

                              : handleUncaughtException(ac, vp, true);

     JS_ASSERT(!cx->isExceptionPending());

     return status;

 }

 void

 Debugger::slowPathOnNewGlobalObject(JSContext *cx, Handle<GlobalObject *> global)

 {

     JS_ASSERT(!JS_CLIST_IS_EMPTY(&cx->runtime()->onNewGlobalObjectWatchers));

     if (global->compartment()->options().invisibleToDebugger())

         return;

     /*

      * Make a copy of the runtime's onNewGlobalObjectWatchers before running the

      * handlers. Since one Debugger's handler can disable another's, the list

      * can be mutated while we're walking it.

      */

     AutoObjectVector watchers(cx);

     for (JSCList *link = JS_LIST_HEAD(&cx->runtime()->onNewGlobalObjectWatchers);

          link != &cx->runtime()->onNewGlobalObjectWatchers;

          link = JS_NEXT_LINK(link)) {

         Debugger *dbg = fromOnNewGlobalObjectWatchersLink(link);

         JS_ASSERT(dbg->observesNewGlobalObject());

         if (!watchers.append(dbg->object))

             return;

     }

     JSTrapStatus status = JSTRAP_CONTINUE;

     RootedValue value(cx);

     for (size_t i = 0; i < watchers.length(); i++) {

         Debugger *dbg = fromJSObject(watchers[i]);

         // We disallow resumption values from onNewGlobalObject hooks, because we

         // want the debugger hooks for global object creation to be infallible.

         // But if an onNewGlobalObject hook throws, and the uncaughtExceptionHook

         // decides to raise an error, we want to at least avoid invoking the rest

         // of the onNewGlobalObject handlers in the list (not for any super

         // compelling reason, just because it seems like the right thing to do).

         // So we ignore whatever comes out in |value|, but break out of the loop

         // if a non-success trap status is returned.

         if (dbg->observesNewGlobalObject()) {

             status = dbg->fireNewGlobalObject(cx, global, &value);

             if (status != JSTRAP_CONTINUE && status != JSTRAP_RETURN)

                 break;

         }

     }

     JS_ASSERT(!cx->isExceptionPending());

 }

 /*** Debugger JSObjects **************************************************************************/

 void

 Debugger::markKeysInCompartment(JSTracer *trc)

 {

     /*

      * WeakMap::Range is deliberately private, to discourage C++ code from

      * enumerating WeakMap keys. However in this case we need access, so we

      * make a base-class reference. Range is public in HashMap.

      */

     objects.markKeys(trc);

     environments.markKeys(trc);

     scripts.markKeys(trc);

     sources.markKeys(trc);

 }

 /*

  * Ordinarily, WeakMap keys and values are marked because at some point it was

  * discovered that the WeakMap was live; that is, some object containing the

  * WeakMap was marked during mark phase.

  *

  * However, during compartment GC, we have to do something about

  * cross-compartment WeakMaps in non-GC'd compartments. If their keys and values

  * might need to be marked, we have to do it manually.

  *

  * Each Debugger object keeps found cross-compartment WeakMaps: objects, scripts,

  * script source objects, and environments. They have the nice property that all

  * their values are in the same compartment as the Debugger object, so we only

  * need to mark the keys. We must simply mark all keys that are in a compartment

  * being GC'd.

  *

  * We must scan all Debugger objects regardless of whether they *currently*

  * have any debuggees in a compartment being GC'd, because the WeakMap

  * entries persist even when debuggees are removed.

  *

  * This happens during the initial mark phase, not iterative marking, because

  * all the edges being reported here are strong references.

  */

 void

 Debugger::markCrossCompartmentDebuggerObjectReferents(JSTracer *trc)

 {

     JSRuntime *rt = trc->runtime();

     /*

      * Mark all objects in comp that are referents of Debugger.Objects in other

      * compartments.

      */

     for (Debugger *dbg = rt->debuggerList.getFirst(); dbg; dbg = dbg->getNext()) {

         if (!dbg->object->zone()->isCollecting())

             dbg->markKeysInCompartment(trc);

     }

 }

 /*

  * This method has two tasks:

  *   1. Mark Debugger objects that are unreachable except for debugger hooks that

  *      may yet be called.

  *   2. Mark breakpoint handlers.

  *

  * This happens during the iterative part of the GC mark phase. This method

  * returns true if it has to mark anything; GC calls it repeatedly until it

  * returns false.

  */

 bool

 Debugger::markAllIteratively(GCMarker *trc)

 {

     bool markedAny = false;

     /*

      * Find all Debugger objects in danger of GC. This code is a little

      * convoluted since the easiest way to find them is via their debuggees.

      */

     JSRuntime *rt = trc->runtime();

     for (CompartmentsIter c(rt, SkipAtoms); !c.done(); c.next()) {

         GlobalObjectSet &debuggees = c->getDebuggees();

         for (GlobalObjectSet::Enum e(debuggees); !e.empty(); e.popFront()) {

             GlobalObject *global = e.front();

             if (!IsObjectMarked(&global))

                 continue;

             else if (global != e.front())

                 e.rekeyFront(global);

             /*

              * Every debuggee has at least one debugger, so in this case

              * getDebuggers can't return nullptr.

              */

             const GlobalObject::DebuggerVector *debuggers = global->getDebuggers();

             JS_ASSERT(debuggers);

             for (Debugger * const *p = debuggers->begin(); p != debuggers->end(); p++) {

                 Debugger *dbg = *p;

                 /*

                  * dbg is a Debugger with at least one debuggee. Check three things:

                  *   - dbg is actually in a compartment that is being marked

                  *   - it isn't already marked

                  *   - it actually has hooks that might be called

                  */

                 HeapPtrObject &dbgobj = dbg->toJSObjectRef();

                 if (!dbgobj->zone()->isGCMarking())

                     continue;

                 bool dbgMarked = IsObjectMarked(&dbgobj);

                 if (!dbgMarked && dbg->hasAnyLiveHooks()) {

                     /*

                      * obj could be reachable only via its live, enabled

                      * debugger hooks, which may yet be called.

                      */

                     MarkObject(trc, &dbgobj, "enabled Debugger");

                     markedAny = true;

                     dbgMarked = true;

                 }

                 if (dbgMarked) {

                     /* Search for breakpoints to mark. */

                     for (Breakpoint *bp = dbg->firstBreakpoint(); bp; bp = bp->nextInDebugger()) {

                         if (IsScriptMarked(&bp->site->script)) {

                             /*

                              * The debugger and the script are both live.

                              * Therefore the breakpoint handler is live.

                              */

                             if (!IsObjectMarked(&bp->getHandlerRef())) {

                                 MarkObject(trc, &bp->getHandlerRef(), "breakpoint handler");

                                 markedAny = true;

                             }

                         }

                     }

                 }

             }

         }

     }

     return markedAny;

 }

 /*

  * Mark all debugger-owned GC things unconditionally. This is used by the minor

  * GC: the minor GC cannot apply the weak constraints of the full GC because it

  * visits only part of the heap.

  */

 void

 Debugger::markAll(JSTracer *trc)

 {

     JSRuntime *rt = trc->runtime();

     for (Debugger *dbg = rt->debuggerList.getFirst(); dbg; dbg = dbg->getNext()) {

         GlobalObjectSet &debuggees = dbg->debuggees;

         for (GlobalObjectSet::Enum e(debuggees); !e.empty(); e.popFront()) {

             GlobalObject *global = e.front();

             MarkObjectUnbarriered(trc, &global, "Global Object");

             if (global != e.front())

                 e.rekeyFront(global);

         }

         HeapPtrObject &dbgobj = dbg->toJSObjectRef();

         MarkObject(trc, &dbgobj, "Debugger Object");

         dbg->scripts.trace(trc);

         dbg->sources.trace(trc);

         dbg->objects.trace(trc);

         dbg->environments.trace(trc);

         for (Breakpoint *bp = dbg->firstBreakpoint(); bp; bp = bp->nextInDebugger()) {

             MarkScriptUnbarriered(trc, &bp->site->script, "breakpoint script");

             MarkObject(trc, &bp->getHandlerRef(), "breakpoint handler");

         }

     }

 }

 void

 Debugger::traceObject(JSTracer *trc, JSObject *obj)

 {

     if (Debugger *dbg = Debugger::fromJSObject(obj))

         dbg->trace(trc);

 }

 void

 Debugger::trace(JSTracer *trc)

 {

     if (uncaughtExceptionHook)

         MarkObject(trc, &uncaughtExceptionHook, "hooks");

     /*

      * Mark Debugger.Frame objects. These are all reachable from JS, because the

      * corresponding JS frames are still on the stack.

      *

      * (Once we support generator frames properly, we will need

      * weakly-referenced Debugger.Frame objects as well, for suspended generator

      * frames.)

      */

     for (FrameMap::Range r = frames.all(); !r.empty(); r.popFront()) {

         RelocatablePtrObject &frameobj = r.front().value();

         JS_ASSERT(frameobj->getPrivate());

         MarkObject(trc, &frameobj, "live Debugger.Frame");

     }

     /* Trace the weak map from JSScript instances to Debugger.Script objects. */

     scripts.trace(trc);

     /* Trace the referent ->Debugger.Source weak map */

     sources.trace(trc);

     /* Trace the referent -> Debugger.Object weak map. */

     objects.trace(trc);

     /* Trace the referent -> Debugger.Environment weak map. */

     environments.trace(trc);

 }

 void

 Debugger::sweepAll(FreeOp *fop)

 {

     JSRuntime *rt = fop->runtime();

     for (Debugger *dbg = rt->debuggerList.getFirst(); dbg; dbg = dbg->getNext()) {

         if (IsObjectAboutToBeFinalized(&dbg->object)) {

             /*

              * dbg is being GC'd. Detach it from its debuggees. The debuggee

              * might be GC'd too. Since detaching requires access to both

              * objects, this must be done before finalize time.

              */

             for (GlobalObjectSet::Enum e(dbg->debuggees); !e.empty(); e.popFront()) {

                 // We can't recompile on-stack scripts here, and we

                 // can only toggle debug mode to off, so we use an

                 // infallible variant of removeDebuggeeGlobal.

                 dbg->removeDebuggeeGlobalUnderGC(fop, e.front(), nullptr, &e);

             }

         }

     }

     for (gc::GCCompartmentGroupIter comp(rt); !comp.done(); comp.next()) {

         /* For each debuggee being GC'd, detach it from all its debuggers. */

         GlobalObjectSet &debuggees = comp->getDebuggees();

         for (GlobalObjectSet::Enum e(debuggees); !e.empty(); e.popFront()) {

             GlobalObject *global = e.front();

             if (IsObjectAboutToBeFinalized(&global)) {

                 // See infallibility note above.

                 detachAllDebuggersFromGlobal(fop, global, &e);

             }

             else if (global != e.front())

                 e.rekeyFront(global);

         }

     }

 }

 void

 Debugger::detachAllDebuggersFromGlobal(FreeOp *fop, GlobalObject *global,

                                        GlobalObjectSet::Enum *compartmentEnum)

 {

     const GlobalObject::DebuggerVector *debuggers = global->getDebuggers();

     JS_ASSERT(!debuggers->empty());

     while (!debuggers->empty())

         debuggers->back()->removeDebuggeeGlobalUnderGC(fop, global, compartmentEnum, nullptr);

 }

 /* static */ void

 Debugger::findCompartmentEdges(Zone *zone, js::gc::ComponentFinder<Zone> &finder)

 {

     /*

      * For debugger cross compartment wrappers, add edges in the opposite

      * direction to those already added by JSCompartment::findOutgoingEdges.

      * This ensure that debuggers and their debuggees are finalized in the same

      * group.

      */

     for (Debugger *dbg = zone->runtimeFromMainThread()->debuggerList.getFirst();

          dbg;

          dbg = dbg->getNext())

     {

         Zone *w = dbg->object->zone();

         if (w == zone || !w->isGCMarking())

             continue;

         if (dbg->scripts.hasKeyInZone(zone) ||

             dbg->sources.hasKeyInZone(zone) ||

             dbg->objects.hasKeyInZone(zone) ||

             dbg->environments.hasKeyInZone(zone))

         {

             finder.addEdgeTo(w);

         }

     }

 }

 void

 Debugger::finalize(FreeOp *fop, JSObject *obj)

 {

     Debugger *dbg = fromJSObject(obj);

     if (!dbg)

         return;

     fop->delete_(dbg);

 }

 const Class Debugger::jsclass = {

     "Debugger",

     JSCLASS_HAS_PRIVATE | JSCLASS_IMPLEMENTS_BARRIERS |

     JSCLASS_HAS_RESERVED_SLOTS(JSSLOT_DEBUG_COUNT),

     JS_PropertyStub, JS_DeletePropertyStub, JS_PropertyStub, JS_StrictPropertyStub,

     JS_EnumerateStub, JS_ResolveStub, JS_ConvertStub, Debugger::finalize,

     nullptr,              /* call        */

     nullptr,              /* hasInstance */

     nullptr,              /* construct   */

     Debugger::traceObject

 };

 Debugger *

 Debugger::fromThisValue(JSContext *cx, const CallArgs &args, const char *fnname)

 {

     if (!args.thisv().isObject()) {

         ReportObjectRequired(cx);

         return nullptr;

     }

     JSObject *thisobj = &args.thisv().toObject();

     if (thisobj->getClass() != &Debugger::jsclass) {

         JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_INCOMPATIBLE_PROTO,

                              "Debugger", fnname, thisobj->getClass()->name);

         return nullptr;

     }

     /*

      * Forbid Debugger.prototype, which is of the Debugger JSClass but isn't

      * really a Debugger object. The prototype object is distinguished by

      * having a nullptr private value.

      */

     Debugger *dbg = fromJSObject(thisobj);

     if (!dbg) {

         JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_INCOMPATIBLE_PROTO,

                              "Debugger", fnname, "prototype object");

     }

     return dbg;

 }

 #define THIS_DEBUGGER(cx, argc, vp, fnname, args, dbg)                       \

     CallArgs args = CallArgsFromVp(argc, vp);                                \

     Debugger *dbg = Debugger::fromThisValue(cx, args, fnname);               \

     if (!dbg)                                                                \

         return false

 bool

 Debugger::getEnabled(JSContext *cx, unsigned argc, Value *vp)

 {

     THIS_DEBUGGER(cx, argc, vp, "get enabled", args, dbg);

     args.rval().setBoolean(dbg->enabled);

     return true;

 }

 bool

 Debugger::setEnabled(JSContext *cx, unsigned argc, Value *vp)

 {

     REQUIRE_ARGC("Debugger.set enabled", 1);

     THIS_DEBUGGER(cx, argc, vp, "set enabled", args, dbg);

     bool enabled = ToBoolean(args[0]);

     if (enabled != dbg->enabled) {

         for (Breakpoint *bp = dbg->firstBreakpoint(); bp; bp = bp->nextInDebugger()) {

             if (enabled)

                 bp->site->inc(cx->runtime()->defaultFreeOp());

             else

                 bp->site->dec(cx->runtime()->defaultFreeOp());

         }

         /*

          * Add or remove ourselves from the runtime's list of Debuggers

          * that care about new globals.

          */

         if (dbg->getHook(OnNewGlobalObject)) {

             if (enabled) {

                 /* If we were not enabled, the link should be a singleton list. */

                 JS_ASSERT(JS_CLIST_IS_EMPTY(&dbg->onNewGlobalObjectWatchersLink));

                 JS_APPEND_LINK(&dbg->onNewGlobalObjectWatchersLink,

                                &cx->runtime()->onNewGlobalObjectWatchers);

             } else {

                 /* If we were enabled, the link should be inserted in the list. */

                 JS_ASSERT(!JS_CLIST_IS_EMPTY(&dbg->onNewGlobalObjectWatchersLink));

                 JS_REMOVE_AND_INIT_LINK(&dbg->onNewGlobalObjectWatchersLink);

             }

         }

     }

     dbg->enabled = enabled;

     args.rval().setUndefined();

     return true;

 }

 bool

 Debugger::getHookImpl(JSContext *cx, unsigned argc, Value *vp, Hook which)

 {

     JS_ASSERT(which >= 0 && which < HookCount);

     THIS_DEBUGGER(cx, argc, vp, "getHook", args, dbg);

     args.rval().set(dbg->object->getReservedSlot(JSSLOT_DEBUG_HOOK_START + which));

     return true;

 }

 bool

 Debugger::setHookImpl(JSContext *cx, unsigned argc, Value *vp, Hook which)

 {

     JS_ASSERT(which >= 0 && which < HookCount);

     REQUIRE_ARGC("Debugger.setHook", 1);

     THIS_DEBUGGER(cx, argc, vp, "setHook", args, dbg);

     if (args[0].isObject()) {

         if (!args[0].toObject().isCallable())

             return ReportIsNotFunction(cx, args[0], args.length() - 1);

     } else if (!args[0].isUndefined()) {

         JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_NOT_CALLABLE_OR_UNDEFINED);

         return false;

     }

     dbg->object->setReservedSlot(JSSLOT_DEBUG_HOOK_START + which, args[0]);

     args.rval().setUndefined();

     return true;

 }

 bool

 Debugger::getOnDebuggerStatement(JSContext *cx, unsigned argc, Value *vp)

 {

     return getHookImpl(cx, argc, vp, OnDebuggerStatement);

 }

 bool

 Debugger::setOnDebuggerStatement(JSContext *cx, unsigned argc, Value *vp)

 {

     return setHookImpl(cx, argc, vp, OnDebuggerStatement);

 }

 bool

 Debugger::getOnExceptionUnwind(JSContext *cx, unsigned argc, Value *vp)

 {

     return getHookImpl(cx, argc, vp, OnExceptionUnwind);

 }

 bool

 Debugger::setOnExceptionUnwind(JSContext *cx, unsigned argc, Value *vp)

 {

     return setHookImpl(cx, argc, vp, OnExceptionUnwind);

 }

 bool

 Debugger::getOnNewScript(JSContext *cx, unsigned argc, Value *vp)

 {

     return getHookImpl(cx, argc, vp, OnNewScript);

 }

 bool

 Debugger::setOnNewScript(JSContext *cx, unsigned argc, Value *vp)

 {

     return setHookImpl(cx, argc, vp, OnNewScript);

 }

 bool

 Debugger::getOnEnterFrame(JSContext *cx, unsigned argc, Value *vp)

 {

     return getHookImpl(cx, argc, vp, OnEnterFrame);

 }

 bool

 Debugger::setOnEnterFrame(JSContext *cx, unsigned argc, Value *vp)

 {

     return setHookImpl(cx, argc, vp, OnEnterFrame);

 }

 bool

 Debugger::getOnNewGlobalObject(JSContext *cx, unsigned argc, Value *vp)

 {

     return getHookImpl(cx, argc, vp, OnNewGlobalObject);

 }

 bool

 Debugger::setOnNewGlobalObject(JSContext *cx, unsigned argc, Value *vp)

 {

     THIS_DEBUGGER(cx, argc, vp, "setOnNewGlobalObject", args, dbg);

     RootedObject oldHook(cx, dbg->getHook(OnNewGlobalObject));

     if (!setHookImpl(cx, argc, vp, OnNewGlobalObject))

         return false;

     /*

      * Add or remove ourselves from the runtime's list of Debuggers that

      * care about new globals.

      */

     if (dbg->enabled) {

         JSObject *newHook = dbg->getHook(OnNewGlobalObject);

         if (!oldHook && newHook) {

             /* If we didn't have a hook, the link should be a singleton list. */

             JS_ASSERT(JS_CLIST_IS_EMPTY(&dbg->onNewGlobalObjectWatchersLink));

             JS_APPEND_LINK(&dbg->onNewGlobalObjectWatchersLink,

                            &cx->runtime()->onNewGlobalObjectWatchers);

         } else if (oldHook && !newHook) {

             /* If we did have a hook, the link should be inserted in the list. */

             JS_ASSERT(!JS_CLIST_IS_EMPTY(&dbg->onNewGlobalObjectWatchersLink));

             JS_REMOVE_AND_INIT_LINK(&dbg->onNewGlobalObjectWatchersLink);

         }

     }

     return true;

 }

 bool

 Debugger::getUncaughtExceptionHook(JSContext *cx, unsigned argc, Value *vp)

 {

     THIS_DEBUGGER(cx, argc, vp, "get uncaughtExceptionHook", args, dbg);

     args.rval().setObjectOrNull(dbg->uncaughtExceptionHook);

     return true;

 }

 bool

 Debugger::setUncaughtExceptionHook(JSContext *cx, unsigned argc, Value *vp)

 {

     REQUIRE_ARGC("Debugger.set uncaughtExceptionHook", 1);

     THIS_DEBUGGER(cx, argc, vp, "set uncaughtExceptionHook", args, dbg);

     if (!args[0].isNull() && (!args[0].isObject() || !args[0].toObject().isCallable())) {

         JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_ASSIGN_FUNCTION_OR_NULL,

                              "uncaughtExceptionHook");

         return false;

     }

     dbg->uncaughtExceptionHook = args[0].toObjectOrNull();

     args.rval().setUndefined();

     return true;

 }

 bool

 Debugger::getMemory(JSContext *cx, unsigned argc, Value *vp)

 {

     THIS_DEBUGGER(cx, argc, vp, "get memory", args, dbg);

     args.rval().set(dbg->object->getReservedSlot(JSSLOT_DEBUG_MEMORY_INSTANCE));

     return true;

 }

 GlobalObject *

 Debugger::unwrapDebuggeeArgument(JSContext *cx, const Value &v)

 {

     if (!v.isObject()) {

         JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_UNEXPECTED_TYPE,

                              "argument", "not a global object");

         return nullptr;

     }

     RootedObject obj(cx, &v.toObject());

     /* If it's a Debugger.Object belonging to this debugger, dereference that. */

     if (obj->getClass() == &DebuggerObject_class) {

         RootedValue rv(cx, v);

         if (!unwrapDebuggeeValue(cx, &rv))

             return nullptr;

         obj = &rv.toObject();

     }

     /* If we have a cross-compartment wrapper, dereference as far as is secure. */

     obj = CheckedUnwrap(obj);

     if (!obj) {

         JS_ReportError(cx, "Permission denied to access object");

         return nullptr;

     }

     /* If that produced an outer window, innerize it. */

     obj = GetInnerObject(cx, obj);

     if (!obj)

         return nullptr;

     /* If that didn't produce a global object, it's an error. */

     if (!obj->is<GlobalObject>()) {

         JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_UNEXPECTED_TYPE,

                              "argument", "not a global object");

         return nullptr;

     }

     return &obj->as<GlobalObject>();

 }

 bool

 Debugger::addDebuggee(JSContext *cx, unsigned argc, Value *vp)

 {

     REQUIRE_ARGC("Debugger.addDebuggee", 1);

     THIS_DEBUGGER(cx, argc, vp, "addDebuggee", args, dbg);

     Rooted<GlobalObject*> global(cx, dbg->unwrapDebuggeeArgument(cx, args[0]));

     if (!global)

         return false;

     if (!dbg->addDebuggeeGlobal(cx, global))

         return false;

     RootedValue v(cx, ObjectValue(*global));

     if (!dbg->wrapDebuggeeValue(cx, &v))

         return false;

     args.rval().set(v);

     return true;

 }

 bool

 Debugger::addAllGlobalsAsDebuggees(JSContext *cx, unsigned argc, Value *vp)

 {

     THIS_DEBUGGER(cx, argc, vp, "addAllGlobalsAsDebuggees", args, dbg);

     for (ZonesIter zone(cx->runtime(), SkipAtoms); !zone.done(); zone.next()) {

         // Invalidate a zone at a time to avoid doing a zone-wide CellIter

         // per compartment.

         AutoDebugModeInvalidation invalidate(zone);

         for (CompartmentsInZoneIter c(zone); !c.done(); c.next()) {

             if (c == dbg->object->compartment() || c->options().invisibleToDebugger())

                 continue;

             c->zone()->scheduledForDestruction = false;

             GlobalObject *global = c->maybeGlobal();

             if (global) {

                 Rooted<GlobalObject*> rg(cx, global);

                 if (!dbg->addDebuggeeGlobal(cx, rg, invalidate))

                     return false;

             }

         }

     }

     args.rval().setUndefined();

     return true;

 }

 bool

 Debugger::removeDebuggee(JSContext *cx, unsigned argc, Value *vp)

 {

     REQUIRE_ARGC("Debugger.removeDebuggee", 1);

     THIS_DEBUGGER(cx, argc, vp, "removeDebuggee", args, dbg);

     GlobalObject *global = dbg->unwrapDebuggeeArgument(cx, args[0]);

     if (!global)

         return false;

     if (dbg->debuggees.has(global)) {

         if (!dbg->removeDebuggeeGlobal(cx, global, nullptr, nullptr))

             return false;

     }

     args.rval().setUndefined();

     return true;

 }

 bool

 Debugger::removeAllDebuggees(JSContext *cx, unsigned argc, Value *vp)

 {

     THIS_DEBUGGER(cx, argc, vp, "removeAllDebuggees", args, dbg);

     for (GlobalObjectSet::Enum e(dbg->debuggees); !e.empty(); e.popFront()) {

         if (!dbg->removeDebuggeeGlobal(cx, e.front(), nullptr, &e))

             return false;

     }

     args.rval().setUndefined();

     return true;

 }

 bool

 Debugger::hasDebuggee(JSContext *cx, unsigned argc, Value *vp)

 {

     REQUIRE_ARGC("Debugger.hasDebuggee", 1);

     THIS_DEBUGGER(cx, argc, vp, "hasDebuggee", args, dbg);

     GlobalObject *global = dbg->unwrapDebuggeeArgument(cx, args[0]);

     if (!global)

         return false;

     args.rval().setBoolean(!!dbg->debuggees.lookup(global));

     return true;

 }

 bool

 Debugger::getDebuggees(JSContext *cx, unsigned argc, Value *vp)

 {

     THIS_DEBUGGER(cx, argc, vp, "getDebuggees", args, dbg);

     RootedObject arrobj(cx, NewDenseAllocatedArray(cx, dbg->debuggees.count()));

     if (!arrobj)

         return false;

     arrobj->ensureDenseInitializedLength(cx, 0, dbg->debuggees.count());

     unsigned i = 0;

     for (GlobalObjectSet::Enum e(dbg->debuggees); !e.empty(); e.popFront()) {

         RootedValue v(cx, ObjectValue(*e.front()));

         if (!dbg->wrapDebuggeeValue(cx, &v))

             return false;

         arrobj->setDenseElement(i++, v);

     }

     args.rval().setObject(*arrobj);

     return true;

 }

 bool

 Debugger::getNewestFrame(JSContext *cx, unsigned argc, Value *vp)

 {

     THIS_DEBUGGER(cx, argc, vp, "getNewestFrame", args, dbg);

     /* Since there may be multiple contexts, use AllFramesIter. */

     for (AllFramesIter i(cx); !i.done(); ++i) {

         if (dbg->observesFrame(i)) {

             // Ensure that Ion frames are rematerialized. Only rematerialized

             // Ion frames may be used as AbstractFramePtrs.

             if (i.isIon() && !i.ensureHasRematerializedFrame())

                 return false;

             AbstractFramePtr frame = i.abstractFramePtr();

             ScriptFrameIter iter(i.activation()->cx(), ScriptFrameIter::GO_THROUGH_SAVED);

             while (!iter.hasUsableAbstractFramePtr() || iter.abstractFramePtr() != frame)

                 ++iter;

             return dbg->getScriptFrame(cx, iter, args.rval());

         }

     }

     args.rval().setNull();

     return true;

 }

 bool

 Debugger::clearAllBreakpoints(JSContext *cx, unsigned argc, Value *vp)

 {

     THIS_DEBUGGER(cx, argc, vp, "clearAllBreakpoints", args, dbg);

     for (GlobalObjectSet::Range r = dbg->debuggees.all(); !r.empty(); r.popFront())

         r.front()->compartment()->clearBreakpointsIn(cx->runtime()->defaultFreeOp(),

                                                      dbg, NullPtr());

     return true;

 }

 bool

 Debugger::construct(JSContext *cx, unsigned argc, Value *vp)

 {

     CallArgs args = CallArgsFromVp(argc, vp);

     /* Check that the arguments, if any, are cross-compartment wrappers. */

     for (unsigned i = 0; i < args.length(); i++) {

         const Value &arg = args[i];

         if (!arg.isObject())

             return ReportObjectRequired(cx);

         JSObject *argobj = &arg.toObject();

         if (!argobj->is<CrossCompartmentWrapperObject>()) {

             JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_CCW_REQUIRED,

                                  "Debugger");

             return false;

         }

     }

     /* Get Debugger.prototype. */

     RootedValue v(cx);

     RootedObject callee(cx, &args.callee());

     if (!JSObject::getProperty(cx, callee, callee, cx->names().prototype, &v))

         return false;

     RootedObject proto(cx, &v.toObject());

     JS_ASSERT(proto->getClass() == &Debugger::jsclass);

     /*

      * Make the new Debugger object. Each one has a reference to

      * Debugger.{Frame,Object,Script,Memory}.prototype in reserved slots. The

      * rest of the reserved slots are for hooks; they default to undefined.

      */

     RootedObject obj(cx, NewObjectWithGivenProto(cx, &Debugger::jsclass, proto, nullptr));

     if (!obj)

         return false;

     for (unsigned slot = JSSLOT_DEBUG_PROTO_START; slot < JSSLOT_DEBUG_PROTO_STOP; slot++)

         obj->setReservedSlot(slot, proto->getReservedSlot(slot));

     /* Create the Debugger.Memory instance accessible by the

      * |Debugger.prototype.memory| getter. */

     Value memoryProto = obj->getReservedSlot(JSSLOT_DEBUG_MEMORY_PROTO);

     RootedObject memory(cx, NewObjectWithGivenProto(cx, &DebuggerMemory::class_,

                                                     &memoryProto.toObject(), nullptr));

     if (!memory)

         return false;

     obj->setReservedSlot(JSSLOT_DEBUG_MEMORY_INSTANCE, ObjectValue(*memory));

     /* Construct the underlying C++ object. */

     Debugger *dbg = cx->new_<Debugger>(cx, obj.get());

     if (!dbg)

         return false;

     if (!dbg->init(cx)) {

         js_delete(dbg);

         return false;

     }

     obj->setPrivate(dbg);

     /* Now the JSObject owns the js::Debugger instance, so we needn't delete it. */

     /* Add the initial debuggees, if any. */

     for (unsigned i = 0; i < args.length(); i++) {

         Rooted<GlobalObject*>

             debuggee(cx, &args[i].toObject().as<ProxyObject>().private_().toObject().global());

         if (!dbg->addDebuggeeGlobal(cx, debuggee))

             return false;

     }

     args.rval().setObject(*obj);

     return true;

 }

 bool

 Debugger::addDebuggeeGlobal(JSContext *cx, Handle<GlobalObject*> global)

 {

     AutoDebugModeInvalidation invalidate(global->compartment());

     return addDebuggeeGlobal(cx, global, invalidate);

 }

 bool

 Debugger::addDebuggeeGlobal(JSContext *cx,

                             Handle<GlobalObject*> global,

                             AutoDebugModeInvalidation &invalidate)

 {

     if (debuggees.has(global))

         return true;

     // Callers should generally be unable to get a reference to a debugger-

     // invisible global in order to pass it to addDebuggee. But this is possible

     // with certain testing aides we expose in the shell, so just make addDebuggee

     // throw in that case.

     JSCompartment *debuggeeCompartment = global->compartment();

     if (debuggeeCompartment->options().invisibleToDebugger()) {

         JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr,

                              JSMSG_DEBUG_CANT_DEBUG_GLOBAL);

         return false;

     }

     /*

      * Check for cycles. If global's compartment is reachable from this

      * Debugger object's compartment by following debuggee-to-debugger links,

      * then adding global would create a cycle. (Typically nobody is debugging

      * the debugger, in which case we zip through this code without looping.)

      */

     Vector<JSCompartment *> visited(cx);

     if (!visited.append(object->compartment()))

         return false;

     for (size_t i = 0; i < visited.length(); i++) {

         JSCompartment *c = visited[i];

         if (c == debuggeeCompartment) {

             JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_DEBUG_LOOP);

             return false;

         }

         /*

          * Find all compartments containing debuggers debugging global objects

          * in c. Add those compartments to visited.

          */

         for (GlobalObjectSet::Range r = c->getDebuggees().all(); !r.empty(); r.popFront()) {

             GlobalObject::DebuggerVector *v = r.front()->getDebuggers();

             for (Debugger **p = v->begin(); p != v->end(); p++) {

                 JSCompartment *next = (*p)->object->compartment();

                 if (Find(visited, next) == visited.end() && !visited.append(next))

                     return false;

             }

         }

     }

     /*

      * Each debugger-debuggee relation must be stored in up to three places.

      * JSCompartment::addDebuggee enables debug mode if needed.

      */

     AutoCompartment ac(cx, global);

     GlobalObject::DebuggerVector *v = GlobalObject::getOrCreateDebuggers(cx, global);

     if (!v || !v->append(this)) {

         js_ReportOutOfMemory(cx);

     } else {

         if (!debuggees.put(global)) {

             js_ReportOutOfMemory(cx);

         } else {

             if (global->getDebuggers()->length() > 1)

                 return true;

             if (debuggeeCompartment->addDebuggee(cx, global, invalidate))

                 return true;

             /* Maintain consistency on error. */

             debuggees.remove(global);

         }

         JS_ASSERT(v->back() == this);

         v->popBack();

     }

     return false;

 }

 void

 Debugger::cleanupDebuggeeGlobalBeforeRemoval(FreeOp *fop, GlobalObject *global,

                                              AutoDebugModeInvalidation &invalidate,

                                              GlobalObjectSet::Enum *compartmentEnum,

                                              GlobalObjectSet::Enum *debugEnum)

 {

     /*

      * Each debuggee is in two HashSets: one for its compartment and one for

      * its debugger (this). The caller might be enumerating either set; if so,

      * use HashSet::Enum::removeFront rather than HashSet::remove below, to

      * avoid invalidating the live enumerator.

      */

     JS_ASSERT(global->compartment()->getDebuggees().has(global));

     JS_ASSERT_IF(compartmentEnum, compartmentEnum->front() == global);

     JS_ASSERT(debuggees.has(global));

     JS_ASSERT_IF(debugEnum, debugEnum->front() == global);

     /*

      * FIXME Debugger::slowPathOnLeaveFrame needs to kill all Debugger.Frame

      * objects referring to a particular JS stack frame. This is hard if

      * Debugger objects that are no longer debugging the relevant global might

      * have live Frame objects. So we take the easy way out and kill them here.

      * This is a bug, since it's observable and contrary to the spec. One

      * possible fix would be to put such objects into a compartment-wide bag

      * which slowPathOnLeaveFrame would have to examine.

      */

     for (FrameMap::Enum e(frames); !e.empty(); e.popFront()) {

         AbstractFramePtr frame = e.front().key();

         JSObject *frameobj = e.front().value();

         if (&frame.script()->global() == global) {

             DebuggerFrame_freeScriptFrameIterData(fop, frameobj);

             DebuggerFrame_maybeDecrementFrameScriptStepModeCount(fop, frame, frameobj);

             e.removeFront();

         }

     }

     GlobalObject::DebuggerVector *v = global->getDebuggers();

     Debugger **p;

     for (p = v->begin(); p != v->end(); p++) {

         if (*p == this)

             break;

     }

     JS_ASSERT(p != v->end());

     /*

      * The relation must be removed from up to three places: *v and debuggees

      * for sure, and possibly the compartment's debuggee set.

      */

     v->erase(p);

     if (debugEnum)

         debugEnum->removeFront();

     else

         debuggees.remove(global);

     /* Remove all breakpoints for the debuggee. */

     Breakpoint *nextbp;

     for (Breakpoint *bp = firstBreakpoint(); bp; bp = nextbp) {

         nextbp = bp->nextInDebugger();

         if (bp->site->script->compartment() == global->compartment())

             bp->destroy(fop);

     }

     JS_ASSERT_IF(debuggees.empty(), !firstBreakpoint());

 }

 bool

 Debugger::removeDebuggeeGlobal(JSContext *cx, GlobalObject *global,

                                GlobalObjectSet::Enum *compartmentEnum,

                                GlobalObjectSet::Enum *debugEnum)

 {

     AutoDebugModeInvalidation invalidate(global->compartment());

     return removeDebuggeeGlobal(cx, global, invalidate, compartmentEnum, debugEnum);

 }

 bool

 Debugger::removeDebuggeeGlobal(JSContext *cx, GlobalObject *global,

                                AutoDebugModeInvalidation &invalidate,

                                GlobalObjectSet::Enum *compartmentEnum,

                                GlobalObjectSet::Enum *debugEnum)

 {

     cleanupDebuggeeGlobalBeforeRemoval(cx->runtime()->defaultFreeOp(), global,

                                        invalidate, compartmentEnum, debugEnum);

     // The debuggee needs to be removed from the compartment last to save a root.

     if (global->getDebuggers()->empty())

         return global->compartment()->removeDebuggee(cx, global, invalidate, compartmentEnum);

     return true;

 }

 void

 Debugger::removeDebuggeeGlobalUnderGC(FreeOp *fop, GlobalObject *global,

                                       GlobalObjectSet::Enum *compartmentEnum,

                                       GlobalObjectSet::Enum *debugEnum)

 {

     AutoDebugModeInvalidation invalidate(global->compartment());

     removeDebuggeeGlobalUnderGC(fop, global, invalidate, compartmentEnum, debugEnum);

 }

 void

 Debugger::removeDebuggeeGlobalUnderGC(FreeOp *fop, GlobalObject *global,

                                       AutoDebugModeInvalidation &invalidate,

                                       GlobalObjectSet::Enum *compartmentEnum,

                                       GlobalObjectSet::Enum *debugEnum)

 {

     cleanupDebuggeeGlobalBeforeRemoval(fop, global, invalidate, compartmentEnum, debugEnum);

     /*

      * The debuggee needs to be removed from the compartment last, as this can

      * trigger GCs if the compartment's debug mode is being changed, and the

      * global cannot be rooted on the stack without a cx.

      */

     if (global->getDebuggers()->empty())

         global->compartment()->removeDebuggeeUnderGC(fop, global, invalidate, compartmentEnum);

 }

 /*

  * A class for parsing 'findScripts' query arguments and searching for

  * scripts that match the criteria they represent.

  */

 class Debugger::ScriptQuery {

   public:

     /* Construct a ScriptQuery to use matching scripts for |dbg|. */

     ScriptQuery(JSContext *cx, Debugger *dbg):

         cx(cx), debugger(dbg), compartments(cx->runtime()), url(cx), displayURL(cx),

         displayURLChars(nullptr), innermostForCompartment(cx->runtime())

     {}

     /*

      * Initialize this ScriptQuery. Raise an error and return false if we

      * haven't enough memory.

      */

     bool init() {

         if (!compartments.init() ||

             !innermostForCompartment.init())

         {

             js_ReportOutOfMemory(cx);

             return false;

         }

         return true;

     }

     /*

      * Parse the query object |query|, and prepare to match only the scripts

      * it specifies.

      */

     bool parseQuery(HandleObject query) {

         /*

          * Check for a 'global' property, which limits the results to those

          * scripts scoped to a particular global object.

          */

         RootedValue global(cx);

         if (!JSObject::getProperty(cx, query, query, cx->names().global, &global))

             return false;

         if (global.isUndefined()) {

             matchAllDebuggeeGlobals();

         } else {

             GlobalObject *globalObject = debugger->unwrapDebuggeeArgument(cx, global);

             if (!globalObject)

                 return false;

             /*

              * If the given global isn't a debuggee, just leave the set of

              * acceptable globals empty; we'll return no scripts.

              */

             if (debugger->debuggees.has(globalObject)) {

                 if (!matchSingleGlobal(globalObject))

                     return false;

             }

         }

         /* Check for a 'url' property. */

         if (!JSObject::getProperty(cx, query, query, cx->names().url, &url))

             return false;

         if (!url.isUndefined() && !url.isString()) {

             JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_UNEXPECTED_TYPE,

                                  "query object's 'url' property", "neither undefined nor a string");

             return false;

         }

         /* Check for a 'line' property. */

         RootedValue lineProperty(cx);

         if (!JSObject::getProperty(cx, query, query, cx->names().line, &lineProperty))

             return false;

         if (lineProperty.isUndefined()) {

             hasLine = false;

         } else if (lineProperty.isNumber()) {

             if (url.isUndefined()) {

                 JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr,

                                      JSMSG_QUERY_LINE_WITHOUT_URL);

                 return false;

             }

             double doubleLine = lineProperty.toNumber();

             if (doubleLine <= 0 || (unsigned int) doubleLine != doubleLine) {

                 JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_DEBUG_BAD_LINE);

                 return false;

             }

             hasLine = true;

             line = doubleLine;

         } else {

             JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_UNEXPECTED_TYPE,

                                  "query object's 'line' property",

                                  "neither undefined nor an integer");

             return false;

         }

         /* Check for an 'innermost' property. */

         PropertyName *innermostName = cx->names().innermost;

         RootedValue innermostProperty(cx);

         if (!JSObject::getProperty(cx, query, query, innermostName, &innermostProperty))

             return false;

         innermost = ToBoolean(innermostProperty);

         if (innermost) {

             /* Technically, we need only check hasLine, but this is clearer. */

             if (url.isUndefined() || !hasLine) {

                 JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr,

                                      JSMSG_QUERY_INNERMOST_WITHOUT_LINE_URL);

                 return false;

             }

         }

         /* Check for a 'displayURL' property. */

         if (!JSObject::getProperty(cx, query, query, cx->names().displayURL, &displayURL))

             return false;

         if (!displayURL.isUndefined() && !displayURL.isString()) {

             JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_UNEXPECTED_TYPE,

                                  "query object's 'displayURL' property",

                                  "neither undefined nor a string");

             return false;

         }

         return true;

     }

     /* Set up this ScriptQuery appropriately for a missing query argument. */

     bool omittedQuery() {

         url.setUndefined();

         hasLine = false;

         innermost = false;

         displayURLChars = nullptr;

         return matchAllDebuggeeGlobals();

     }

     /*

      * Search all relevant compartments and the stack for scripts matching

      * this query, and append the matching scripts to |vector|.

      */

     bool findScripts(AutoScriptVector *v) {

         if (!prepareQuery())

             return false;

         JSCompartment *singletonComp = nullptr;

         if (compartments.count() == 1)

             singletonComp = compartments.all().front();

         /* Search each compartment for debuggee scripts. */

         vector = v;

         oom = false;

         IterateScripts(cx->runtime(), singletonComp, this, considerScript);

         if (oom) {

             js_ReportOutOfMemory(cx);

             return false;

         }

         /*

          * For most queries, we just accumulate results in 'vector' as we find

          * them. But if this is an 'innermost' query, then we've accumulated the

          * results in the 'innermostForCompartment' map. In that case, we now need to

          * walk that map and populate 'vector'.

          */

         if (innermost) {

             for (CompartmentToScriptMap::Range r = innermostForCompartment.all();

                  !r.empty();

                  r.popFront()) {

                 if (!v->append(r.front().value())) {

                     js_ReportOutOfMemory(cx);

                     return false;

                 }

             }

         }

         return true;

     }

   private:

     /* The context in which we should do our work. */

     JSContext *cx;

     /* The debugger for which we conduct queries. */

     Debugger *debugger;

     typedef HashSet<JSCompartment *, DefaultHasher<JSCompartment *>, RuntimeAllocPolicy>

         CompartmentSet;

     /* A script must be in one of these compartments to match the query. */

     CompartmentSet compartments;

     /* If this is a string, matching scripts have urls equal to it. */

     RootedValue url;

     /* url as a C string. */

     JSAutoByteString urlCString;

     /* If this is a string, matching scripts' sources have displayURLs equal to

      * it. */

     RootedValue displayURL;

     /* displayURL as a jschar* */

     const jschar *displayURLChars;

     size_t displayURLLength;

     /* True if the query contained a 'line' property. */

     bool hasLine;

     /* The line matching scripts must cover. */

     unsigned int line;

     /* True if the query has an 'innermost' property whose value is true. */

     bool innermost;

     typedef HashMap<JSCompartment *, JSScript *, DefaultHasher<JSCompartment *>, RuntimeAllocPolicy>

         CompartmentToScriptMap;

     /*

      * For 'innermost' queries, a map from compartments to the innermost script

      * we've seen so far in that compartment. (Template instantiation code size

      * explosion ho!)

      */

     CompartmentToScriptMap innermostForCompartment;

     /* The vector to which to append the scripts found. */

     AutoScriptVector *vector;

     /* Indicates whether OOM has occurred while matching. */

     bool oom;

     bool addCompartment(JSCompartment *comp) {

         {

             // All scripts in the debuggee compartment must be visible, so

             // delazify everything.

             AutoCompartment ac(cx, comp);

             if (!comp->ensureDelazifyScriptsForDebugMode(cx))

                 return false;

         }

         return compartments.put(comp);

     }

     /* Arrange for this ScriptQuery to match only scripts that run in |global|. */

     bool matchSingleGlobal(GlobalObject *global) {

         JS_ASSERT(compartments.count() == 0);

         if (!addCompartment(global->compartment())) {