The Tor Browser / file revision

 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-

  * vim: set ts=8 sts=4 et sw=4 tw=99:

  * This Source Code Form is subject to the terms of the Mozilla Public

  * License, v. 2.0. If a copy of the MPL was not distributed with this

  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

 /*

  * JS bytecode generation.

  */

 #include "frontend/BytecodeEmitter.h"

 #include "mozilla/DebugOnly.h"

 #include "mozilla/FloatingPoint.h"

 #include "mozilla/PodOperations.h"

 #include <string.h>

 #include "jsapi.h"

 #include "jsatom.h"

 #include "jscntxt.h"

 #include "jsfun.h"

 #include "jsnum.h"

 #include "jsopcode.h"

 #include "jsscript.h"

 #include "jstypes.h"

 #include "jsutil.h"

 #include "frontend/Parser.h"

 #include "frontend/TokenStream.h"

 #include "jit/AsmJSLink.h"

 #include "vm/Debugger.h"

 #include "jsatominlines.h"

 #include "jsobjinlines.h"

 #include "jsscriptinlines.h"

 #include "frontend/ParseMaps-inl.h"

 #include "frontend/ParseNode-inl.h"

 #include "vm/ScopeObject-inl.h"

 using namespace js;

 using namespace js::gc;

 using namespace js::frontend;

 using mozilla::DebugOnly;

 using mozilla::NumberIsInt32;

 using mozilla::PodCopy;

 static bool

 SetSrcNoteOffset(ExclusiveContext *cx, BytecodeEmitter *bce, unsigned index, unsigned which, ptrdiff_t offset);

 struct frontend::StmtInfoBCE : public StmtInfoBase

 {

     StmtInfoBCE     *down;          /* info for enclosing statement */

     StmtInfoBCE     *downScope;     /* next enclosing lexical scope */

     ptrdiff_t       update;         /* loop update offset (top if none) */

     ptrdiff_t       breaks;         /* offset of last break in loop */

     ptrdiff_t       continues;      /* offset of last continue in loop */

     uint32_t        blockScopeIndex; /* index of scope in BlockScopeArray */

     StmtInfoBCE(ExclusiveContext *cx) : StmtInfoBase(cx) {}

     /*

      * To reuse space, alias two of the ptrdiff_t fields for use during

      * try/catch/finally code generation and backpatching.

      *

      * Only a loop, switch, or label statement info record can have breaks and

      * continues, and only a for loop has an update backpatch chain, so it's

      * safe to overlay these for the "trying" StmtTypes.

      */

     ptrdiff_t &gosubs() {

         JS_ASSERT(type == STMT_FINALLY);

         return breaks;

     }

     ptrdiff_t &guardJump() {

         JS_ASSERT(type == STMT_TRY || type == STMT_FINALLY);

         return continues;

     }

 };

 namespace {

 struct LoopStmtInfo : public StmtInfoBCE

 {

     int32_t         stackDepth;     // Stack depth when this loop was pushed.

     uint32_t        loopDepth;      // Loop depth.

     // Can we OSR into Ion from here?  True unless there is non-loop state on the stack.

     bool            canIonOsr;

     LoopStmtInfo(ExclusiveContext *cx) : StmtInfoBCE(cx) {}

     static LoopStmtInfo* fromStmtInfo(StmtInfoBCE *stmt) {

         JS_ASSERT(stmt->isLoop());

         return static_cast<LoopStmtInfo*>(stmt);

     }

 };

 } // anonymous namespace

 BytecodeEmitter::BytecodeEmitter(BytecodeEmitter *parent,

                                  Parser<FullParseHandler> *parser, SharedContext *sc,

                                  HandleScript script, bool insideEval, HandleScript evalCaller,

                                  bool hasGlobalScope, uint32_t lineNum, EmitterMode emitterMode)

   : sc(sc),

     parent(parent),

     script(sc->context, script),

     prolog(sc->context, lineNum),

     main(sc->context, lineNum),

     current(&main),

     parser(parser),

     evalCaller(evalCaller),

     topStmt(nullptr),

     topScopeStmt(nullptr),

     staticScope(sc->context),

     atomIndices(sc->context),

     firstLine(lineNum),

     stackDepth(0), maxStackDepth(0),

     arrayCompDepth(0),

     emitLevel(0),

     constList(sc->context),

     tryNoteList(sc->context),

     blockScopeList(sc->context),

     typesetCount(0),

     hasSingletons(false),

     emittingForInit(false),

     emittingRunOnceLambda(false),

     lazyRunOnceLambda(false),

     insideEval(insideEval),

     hasGlobalScope(hasGlobalScope),

     emitterMode(emitterMode)

 {

     JS_ASSERT_IF(evalCaller, insideEval);

 }

 bool

 BytecodeEmitter::init()

 {

     return atomIndices.ensureMap(sc->context);

 }

 static ptrdiff_t

 EmitCheck(ExclusiveContext *cx, BytecodeEmitter *bce, ptrdiff_t delta)

 {

     ptrdiff_t offset = bce->code().length();

     // Start it off moderately large to avoid repeated resizings early on.

     if (bce->code().capacity() == 0 && !bce->code().reserve(1024))

         return -1;

     jsbytecode dummy = 0;

     if (!bce->code().appendN(dummy, delta)) {

         js_ReportOutOfMemory(cx);

         return -1;

     }

     return offset;

 }

 static void

 UpdateDepth(ExclusiveContext *cx, BytecodeEmitter *bce, ptrdiff_t target)

 {

     jsbytecode *pc = bce->code(target);

     JSOp op = (JSOp) *pc;

     const JSCodeSpec *cs = &js_CodeSpec[op];

     if (cs->format & JOF_TMPSLOT_MASK) {

         /*

          * An opcode may temporarily consume stack space during execution.

          * Account for this in maxStackDepth separately from uses/defs here.

          */

         uint32_t depth = (uint32_t) bce->stackDepth +

                          ((cs->format & JOF_TMPSLOT_MASK) >> JOF_TMPSLOT_SHIFT);

         if (depth > bce->maxStackDepth)

             bce->maxStackDepth = depth;

     }

     int nuses = StackUses(nullptr, pc);

     int ndefs = StackDefs(nullptr, pc);

     bce->stackDepth -= nuses;

     JS_ASSERT(bce->stackDepth >= 0);

     bce->stackDepth += ndefs;

     if ((uint32_t)bce->stackDepth > bce->maxStackDepth)

         bce->maxStackDepth = bce->stackDepth;

 }

 ptrdiff_t

 frontend::Emit1(ExclusiveContext *cx, BytecodeEmitter *bce, JSOp op)

 {

     ptrdiff_t offset = EmitCheck(cx, bce, 1);

     if (offset < 0)

         return -1;

     jsbytecode *code = bce->code(offset);

     code[0] = jsbytecode(op);

     UpdateDepth(cx, bce, offset);

     return offset;

 }

 ptrdiff_t

 frontend::Emit2(ExclusiveContext *cx, BytecodeEmitter *bce, JSOp op, jsbytecode op1)

 {

     ptrdiff_t offset = EmitCheck(cx, bce, 2);

     if (offset < 0)

         return -1;

     jsbytecode *code = bce->code(offset);

     code[0] = jsbytecode(op);

     code[1] = op1;

     UpdateDepth(cx, bce, offset);

     return offset;

 }

 ptrdiff_t

 frontend::Emit3(ExclusiveContext *cx, BytecodeEmitter *bce, JSOp op, jsbytecode op1,

                     jsbytecode op2)

 {

     /* These should filter through EmitVarOp. */

     JS_ASSERT(!IsArgOp(op));

     JS_ASSERT(!IsLocalOp(op));

     ptrdiff_t offset = EmitCheck(cx, bce, 3);

     if (offset < 0)

         return -1;

     jsbytecode *code = bce->code(offset);

     code[0] = jsbytecode(op);

     code[1] = op1;

     code[2] = op2;

     UpdateDepth(cx, bce, offset);

     return offset;

 }

 ptrdiff_t

 frontend::EmitN(ExclusiveContext *cx, BytecodeEmitter *bce, JSOp op, size_t extra)

 {

     ptrdiff_t length = 1 + (ptrdiff_t)extra;

     ptrdiff_t offset = EmitCheck(cx, bce, length);

     if (offset < 0)

         return -1;

     jsbytecode *code = bce->code(offset);

     code[0] = jsbytecode(op);

     /* The remaining |extra| bytes are set by the caller */

     /*

      * Don't UpdateDepth if op's use-count comes from the immediate

      * operand yet to be stored in the extra bytes after op.

      */

     if (js_CodeSpec[op].nuses >= 0)

         UpdateDepth(cx, bce, offset);

     return offset;

 }

 static ptrdiff_t

 EmitJump(ExclusiveContext *cx, BytecodeEmitter *bce, JSOp op, ptrdiff_t off)

 {

     ptrdiff_t offset = EmitCheck(cx, bce, 5);

     if (offset < 0)

         return -1;

     jsbytecode *code = bce->code(offset);

     code[0] = jsbytecode(op);

     SET_JUMP_OFFSET(code, off);

     UpdateDepth(cx, bce, offset);

     return offset;

 }

 static ptrdiff_t

 EmitCall(ExclusiveContext *cx, BytecodeEmitter *bce, JSOp op, uint16_t argc)

 {

     return Emit3(cx, bce, op, ARGC_HI(argc), ARGC_LO(argc));

 }

 // Dup the var in operand stack slot "slot".  The first item on the operand

 // stack is one slot past the last fixed slot.  The last (most recent) item is

 // slot bce->stackDepth - 1.

 //

 // The instruction that is written (JSOP_DUPAT) switches the depth around so

 // that it is addressed from the sp instead of from the fp.  This is useful when

 // you don't know the size of the fixed stack segment (nfixed), as is the case

 // when compiling scripts (because each statement is parsed and compiled

 // separately, but they all together form one script with one fixed stack

 // frame).

 static bool

 EmitDupAt(ExclusiveContext *cx, BytecodeEmitter *bce, unsigned slot)

 {

     JS_ASSERT(slot < unsigned(bce->stackDepth));

     // The slot's position on the operand stack, measured from the top.

     unsigned slotFromTop = bce->stackDepth - 1 - slot;

     if (slotFromTop >= JS_BIT(24)) {

         bce->reportError(nullptr, JSMSG_TOO_MANY_LOCALS);

         return false;

     }

     ptrdiff_t off = EmitN(cx, bce, JSOP_DUPAT, 3);

     if (off < 0)

         return false;

     jsbytecode *pc = bce->code(off);

     SET_UINT24(pc, slotFromTop);

     return true;

 }

 /* XXX too many "... statement" L10N gaffes below -- fix via js.msg! */

 const char js_with_statement_str[] = "with statement";

 const char js_finally_block_str[]  = "finally block";

 const char js_script_str[]         = "script";

 static const char * const statementName[] = {

     "label statement",       /* LABEL */

     "if statement",          /* IF */

     "else statement",        /* ELSE */

     "destructuring body",    /* BODY */

     "switch statement",      /* SWITCH */

     "block",                 /* BLOCK */

     js_with_statement_str,   /* WITH */

     "catch block",           /* CATCH */

     "try block",             /* TRY */

     js_finally_block_str,    /* FINALLY */

     js_finally_block_str,    /* SUBROUTINE */

     "do loop",               /* DO_LOOP */

     "for loop",              /* FOR_LOOP */

     "for/in loop",           /* FOR_IN_LOOP */

     "for/of loop",           /* FOR_OF_LOOP */

     "while loop",            /* WHILE_LOOP */

 };

 JS_STATIC_ASSERT(JS_ARRAY_LENGTH(statementName) == STMT_LIMIT);

 static const char *

 StatementName(StmtInfoBCE *topStmt)

 {

     if (!topStmt)

         return js_script_str;

     return statementName[topStmt->type];

 }

 static void

 ReportStatementTooLarge(TokenStream &ts, StmtInfoBCE *topStmt)

 {

     ts.reportError(JSMSG_NEED_DIET, StatementName(topStmt));

 }

 /*

  * Emit a backpatch op with offset pointing to the previous jump of this type,

  * so that we can walk back up the chain fixing up the op and jump offset.

  */

 static ptrdiff_t

 EmitBackPatchOp(ExclusiveContext *cx, BytecodeEmitter *bce, ptrdiff_t *lastp)

 {

     ptrdiff_t offset, delta;

     offset = bce->offset();

     delta = offset - *lastp;

     *lastp = offset;

     JS_ASSERT(delta > 0);

     return EmitJump(cx, bce, JSOP_BACKPATCH, delta);

 }

 static inline unsigned

 LengthOfSetLine(unsigned line)

 {

     return 1 /* SN_SETLINE */ + (line > SN_4BYTE_OFFSET_MASK ? 4 : 1);

 }

 /* Updates line number notes, not column notes. */

 static inline bool

 UpdateLineNumberNotes(ExclusiveContext *cx, BytecodeEmitter *bce, uint32_t offset)

 {

     TokenStream *ts = &bce->parser->tokenStream;

     if (!ts->srcCoords.isOnThisLine(offset, bce->currentLine())) {

         unsigned line = ts->srcCoords.lineNum(offset);

         unsigned delta = line - bce->currentLine();

         /*

          * Encode any change in the current source line number by using

          * either several SRC_NEWLINE notes or just one SRC_SETLINE note,

          * whichever consumes less space.

          *

          * NB: We handle backward line number deltas (possible with for

          * loops where the update part is emitted after the body, but its

          * line number is <= any line number in the body) here by letting

          * unsigned delta_ wrap to a very large number, which triggers a

          * SRC_SETLINE.

          */

         bce->current->currentLine = line;

         bce->current->lastColumn  = 0;

         if (delta >= LengthOfSetLine(line)) {

             if (NewSrcNote2(cx, bce, SRC_SETLINE, (ptrdiff_t)line) < 0)

                 return false;

         } else {

             do {

                 if (NewSrcNote(cx, bce, SRC_NEWLINE) < 0)

                     return false;

             } while (--delta != 0);

         }

     }

     return true;

 }

 /* A function, so that we avoid macro-bloating all the other callsites. */

 static bool

 UpdateSourceCoordNotes(ExclusiveContext *cx, BytecodeEmitter *bce, uint32_t offset)

 {

     if (!UpdateLineNumberNotes(cx, bce, offset))

         return false;

     uint32_t columnIndex = bce->parser->tokenStream.srcCoords.columnIndex(offset);

     ptrdiff_t colspan = ptrdiff_t(columnIndex) - ptrdiff_t(bce->current->lastColumn);

     if (colspan != 0) {

         if (colspan < 0) {

             colspan += SN_COLSPAN_DOMAIN;

         } else if (colspan >= SN_COLSPAN_DOMAIN / 2) {

             // If the column span is so large that we can't store it, then just

             // discard this information because column information would most

             // likely be useless anyway once the column numbers are ~4000000.

             // This has been known to happen with scripts that have been

             // minimized and put into all one line.

             return true;

         }

         if (NewSrcNote2(cx, bce, SRC_COLSPAN, colspan) < 0)

             return false;

         bce->current->lastColumn = columnIndex;

     }

     return true;

 }

 static ptrdiff_t

 EmitLoopHead(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *nextpn)

 {

     if (nextpn) {

         /*

          * Try to give the JSOP_LOOPHEAD the same line number as the next

          * instruction. nextpn is often a block, in which case the next

          * instruction typically comes from the first statement inside.

          */

         JS_ASSERT_IF(nextpn->isKind(PNK_STATEMENTLIST), nextpn->isArity(PN_LIST));

         if (nextpn->isKind(PNK_STATEMENTLIST) && nextpn->pn_head)

             nextpn = nextpn->pn_head;

         if (!UpdateSourceCoordNotes(cx, bce, nextpn->pn_pos.begin))

             return -1;

     }

     return Emit1(cx, bce, JSOP_LOOPHEAD);

 }

 static bool

 EmitLoopEntry(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *nextpn)

 {

     if (nextpn) {

         /* Update the line number, as for LOOPHEAD. */

         JS_ASSERT_IF(nextpn->isKind(PNK_STATEMENTLIST), nextpn->isArity(PN_LIST));

         if (nextpn->isKind(PNK_STATEMENTLIST) && nextpn->pn_head)

             nextpn = nextpn->pn_head;

         if (!UpdateSourceCoordNotes(cx, bce, nextpn->pn_pos.begin))

             return false;

     }

     LoopStmtInfo *loop = LoopStmtInfo::fromStmtInfo(bce->topStmt);

     JS_ASSERT(loop->loopDepth > 0);

     uint8_t loopDepthAndFlags = PackLoopEntryDepthHintAndFlags(loop->loopDepth, loop->canIonOsr);

     return Emit2(cx, bce, JSOP_LOOPENTRY, loopDepthAndFlags) >= 0;

 }

 /*

  * If op is JOF_TYPESET (see the type barriers comment in jsinfer.h), reserve

  * a type set to store its result.

  */

 static inline void

 CheckTypeSet(ExclusiveContext *cx, BytecodeEmitter *bce, JSOp op)

 {

     if (js_CodeSpec[op].format & JOF_TYPESET) {

         if (bce->typesetCount < UINT16_MAX)

             bce->typesetCount++;

     }

 }

 /*

  * Macro to emit a bytecode followed by a uint16_t immediate operand stored in

  * big-endian order.

  *

  * NB: We use cx and bce from our caller's lexical environment, and return

  * false on error.

  */

 #define EMIT_UINT16_IMM_OP(op, i)                                             \

     JS_BEGIN_MACRO                                                            \

         if (Emit3(cx, bce, op, UINT16_HI(i), UINT16_LO(i)) < 0)               \

             return false;                                                     \

         CheckTypeSet(cx, bce, op);                                            \

     JS_END_MACRO

 static bool

 FlushPops(ExclusiveContext *cx, BytecodeEmitter *bce, int *npops)

 {

     JS_ASSERT(*npops != 0);

     EMIT_UINT16_IMM_OP(JSOP_POPN, *npops);

     *npops = 0;

     return true;

 }

 static bool

 PopIterator(ExclusiveContext *cx, BytecodeEmitter *bce)

 {

     if (Emit1(cx, bce, JSOP_ENDITER) < 0)

         return false;

     return true;

 }

 namespace {

 class NonLocalExitScope {

     ExclusiveContext *cx;

     BytecodeEmitter *bce;

     const uint32_t savedScopeIndex;

     const int savedDepth;

     uint32_t openScopeIndex;

     NonLocalExitScope(const NonLocalExitScope &) MOZ_DELETE;

   public:

     explicit NonLocalExitScope(ExclusiveContext *cx_, BytecodeEmitter *bce_)

       : cx(cx_),

         bce(bce_),

         savedScopeIndex(bce->blockScopeList.length()),

         savedDepth(bce->stackDepth),

         openScopeIndex(UINT32_MAX) {

         if (bce->staticScope) {

             StmtInfoBCE *stmt = bce->topStmt;

             while (1) {

                 JS_ASSERT(stmt);

                 if (stmt->isNestedScope) {

                     openScopeIndex = stmt->blockScopeIndex;

                     break;

                 }

                 stmt = stmt->down;

             }

         }

     }

     ~NonLocalExitScope() {

         for (uint32_t n = savedScopeIndex; n < bce->blockScopeList.length(); n++)

             bce->blockScopeList.recordEnd(n, bce->offset());

         bce->stackDepth = savedDepth;

     }

     bool popScopeForNonLocalExit(uint32_t blockScopeIndex) {

         uint32_t scopeObjectIndex = bce->blockScopeList.findEnclosingScope(blockScopeIndex);

         uint32_t parent = openScopeIndex;

         if (!bce->blockScopeList.append(scopeObjectIndex, bce->offset(), parent))

             return false;

         openScopeIndex = bce->blockScopeList.length() - 1;

         return true;

     }

     bool prepareForNonLocalJump(StmtInfoBCE *toStmt);

 };

 /*

  * Emit additional bytecode(s) for non-local jumps.

  */

 bool

 NonLocalExitScope::prepareForNonLocalJump(StmtInfoBCE *toStmt)

 {

     int npops = 0;

 #define FLUSH_POPS() if (npops && !FlushPops(cx, bce, &npops)) return false

     for (StmtInfoBCE *stmt = bce->topStmt; stmt != toStmt; stmt = stmt->down) {

         switch (stmt->type) {

           case STMT_FINALLY:

             FLUSH_POPS();

             if (EmitBackPatchOp(cx, bce, &stmt->gosubs()) < 0)

                 return false;

             break;

           case STMT_WITH:

             if (Emit1(cx, bce, JSOP_LEAVEWITH) < 0)

                 return false;

             JS_ASSERT(stmt->isNestedScope);

             if (!popScopeForNonLocalExit(stmt->blockScopeIndex))

                 return false;

             break;

           case STMT_FOR_OF_LOOP:

             npops += 2;

             break;

           case STMT_FOR_IN_LOOP:

             FLUSH_POPS();

             if (!PopIterator(cx, bce))

                 return false;

             break;

           case STMT_SUBROUTINE:

             /*

              * There's a [exception or hole, retsub pc-index] pair on the

              * stack that we need to pop.

              */

             npops += 2;

             break;

           default:;

         }

         if (stmt->isBlockScope) {

             JS_ASSERT(stmt->isNestedScope);

             StaticBlockObject &blockObj = stmt->staticBlock();

             if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)

                 return false;

             if (!popScopeForNonLocalExit(stmt->blockScopeIndex))

                 return false;

             if (blockObj.needsClone()) {

                 if (Emit1(cx, bce, JSOP_POPBLOCKSCOPE) < 0)

                     return false;

             }

         }

     }

     FLUSH_POPS();

     return true;

 #undef FLUSH_POPS

 }

 }  // anonymous namespace

 static ptrdiff_t

 EmitGoto(ExclusiveContext *cx, BytecodeEmitter *bce, StmtInfoBCE *toStmt, ptrdiff_t *lastp,

          SrcNoteType noteType = SRC_NULL)

 {

     NonLocalExitScope nle(cx, bce);

     if (!nle.prepareForNonLocalJump(toStmt))

         return -1;

     if (noteType != SRC_NULL) {

         if (NewSrcNote(cx, bce, noteType) < 0)

             return -1;

     }

     return EmitBackPatchOp(cx, bce, lastp);

 }

 static bool

 BackPatch(ExclusiveContext *cx, BytecodeEmitter *bce, ptrdiff_t last, jsbytecode *target, jsbytecode op)

 {

     jsbytecode *pc, *stop;

     ptrdiff_t delta, span;

     pc = bce->code(last);

     stop = bce->code(-1);

     while (pc != stop) {

         delta = GET_JUMP_OFFSET(pc);

         span = target - pc;

         SET_JUMP_OFFSET(pc, span);

         *pc = op;

         pc -= delta;

     }

     return true;

 }

 #define SET_STATEMENT_TOP(stmt, top)                                          \

     ((stmt)->update = (top), (stmt)->breaks = (stmt)->continues = (-1))

 static void

 PushStatementInner(BytecodeEmitter *bce, StmtInfoBCE *stmt, StmtType type, ptrdiff_t top)

 {

     SET_STATEMENT_TOP(stmt, top);

     PushStatement(bce, stmt, type);

 }

 static void

 PushStatementBCE(BytecodeEmitter *bce, StmtInfoBCE *stmt, StmtType type, ptrdiff_t top)

 {

     PushStatementInner(bce, stmt, type, top);

     JS_ASSERT(!stmt->isLoop());

 }

 static void

 PushLoopStatement(BytecodeEmitter *bce, LoopStmtInfo *stmt, StmtType type, ptrdiff_t top)

 {

     PushStatementInner(bce, stmt, type, top);

     JS_ASSERT(stmt->isLoop());

     LoopStmtInfo *downLoop = nullptr;

     for (StmtInfoBCE *outer = stmt->down; outer; outer = outer->down) {

         if (outer->isLoop()) {

             downLoop = LoopStmtInfo::fromStmtInfo(outer);

             break;

         }

     }

     stmt->stackDepth = bce->stackDepth;

     stmt->loopDepth = downLoop ? downLoop->loopDepth + 1 : 1;

     int loopSlots;

     if (type == STMT_FOR_OF_LOOP)

         loopSlots = 2;

     else if (type == STMT_FOR_IN_LOOP)

         loopSlots = 1;

     else

         loopSlots = 0;

     if (downLoop)

         stmt->canIonOsr = (downLoop->canIonOsr &&

                            stmt->stackDepth == downLoop->stackDepth + loopSlots);

     else

         stmt->canIonOsr = stmt->stackDepth == loopSlots;

 }

 /*

  * Return the enclosing lexical scope, which is the innermost enclosing static

  * block object or compiler created function.

  */

 static JSObject *

 EnclosingStaticScope(BytecodeEmitter *bce)

 {

     if (bce->staticScope)

         return bce->staticScope;

     if (!bce->sc->isFunctionBox()) {

         JS_ASSERT(!bce->parent);

         return nullptr;

     }

     return bce->sc->asFunctionBox()->function();

 }

 #ifdef DEBUG

 static bool

 AllLocalsAliased(StaticBlockObject &obj)

 {

     for (unsigned i = 0; i < obj.numVariables(); i++)

         if (!obj.isAliased(i))

             return false;

     return true;

 }

 #endif

 static bool

 ComputeAliasedSlots(ExclusiveContext *cx, BytecodeEmitter *bce, Handle<StaticBlockObject *> blockObj)

 {

     for (unsigned i = 0; i < blockObj->numVariables(); i++) {

         Definition *dn = blockObj->definitionParseNode(i);

         JS_ASSERT(dn->isDefn());

         if (!dn->pn_cookie.set(bce->parser->tokenStream, dn->pn_cookie.level(),

                                blockObj->blockIndexToLocalIndex(dn->frameSlot())))

         {

             return false;

         }

 #ifdef DEBUG

         for (ParseNode *pnu = dn->dn_uses; pnu; pnu = pnu->pn_link) {

             JS_ASSERT(pnu->pn_lexdef == dn);

             JS_ASSERT(!(pnu->pn_dflags & PND_BOUND));

             JS_ASSERT(pnu->pn_cookie.isFree());

         }

 #endif

         blockObj->setAliased(i, bce->isAliasedName(dn));

     }

     JS_ASSERT_IF(bce->sc->allLocalsAliased(), AllLocalsAliased(*blockObj));

     return true;

 }

 static bool

 EmitInternedObjectOp(ExclusiveContext *cx, uint32_t index, JSOp op, BytecodeEmitter *bce);

 // In a function, block-scoped locals go after the vars, and form part of the

 // fixed part of a stack frame.  Outside a function, there are no fixed vars,

 // but block-scoped locals still form part of the fixed part of a stack frame

 // and are thus addressable via GETLOCAL and friends.

 static void

 ComputeLocalOffset(ExclusiveContext *cx, BytecodeEmitter *bce, Handle<StaticBlockObject *> blockObj)

 {

     unsigned nfixedvars = bce->sc->isFunctionBox() ? bce->script->bindings.numVars() : 0;

     unsigned localOffset = nfixedvars;

     if (bce->staticScope) {

         Rooted<NestedScopeObject *> outer(cx, bce->staticScope);

         for (; outer; outer = outer->enclosingNestedScope()) {

             if (outer->is<StaticBlockObject>()) {

                 StaticBlockObject &outerBlock = outer->as<StaticBlockObject>();

                 localOffset = outerBlock.localOffset() + outerBlock.numVariables();

                 break;

             }

         }

     }

     JS_ASSERT(localOffset + blockObj->numVariables()

               <= nfixedvars + bce->script->bindings.numBlockScoped());

     blockObj->setLocalOffset(localOffset);

 }

 // ~ Nested Scopes ~

 //

 // A nested scope is a region of a compilation unit (function, script, or eval

 // code) with an additional node on the scope chain.  This node may either be a

 // "with" object or a "block" object.  "With" objects represent "with" scopes.

 // Block objects represent lexical scopes, and contain named block-scoped

 // bindings, for example "let" bindings or the exception in a catch block.

 // Those variables may be local and thus accessible directly from the stack, or

 // "aliased" (accessed by name from nested functions, or dynamically via nested

 // "eval" or "with") and only accessible through the scope chain.

 //

 // All nested scopes are present on the "static scope chain".  A nested scope

 // that is a "with" scope will be present on the scope chain at run-time as

 // well.  A block scope may or may not have a corresponding link on the run-time

 // scope chain; if no variable declared in the block scope is "aliased", then no

 // scope chain node is allocated.

 //

 // To help debuggers, the bytecode emitter arranges to record the PC ranges

 // comprehended by a nested scope, and ultimately attach them to the JSScript.

 // An element in the "block scope array" specifies the PC range, and links to a

 // NestedScopeObject in the object list of the script.  That scope object is

 // linked to the previous link in the static scope chain, if any.  The static

 // scope chain at any pre-retire PC can be retrieved using

 // JSScript::getStaticScope(jsbytecode *pc).

 //

 // Block scopes store their locals in the fixed part of a stack frame, after the

 // "fixed var" bindings.  A fixed var binding is a "var" or legacy "const"

 // binding that occurs in a function (as opposed to a script or in eval code).

 // Only functions have fixed var bindings.

 //

 // To assist the debugger, we emit a DEBUGLEAVEBLOCK opcode before leaving a

 // block scope, even if the block has no aliased locals.  This allows

 // DebugScopes to invalidate any association between a debugger scope object,

 // which can proxy access to unaliased stack locals, and the actual live frame.

 // In normal, non-debug mode, this opcode does not cause any baseline code to be

 // emitted.

 //

 // Enter a nested scope with EnterNestedScope.  It will emit

 // PUSHBLOCKSCOPE/ENTERWITH if needed, and arrange to record the PC bounds of

 // the scope.  Leave a nested scope with LeaveNestedScope, which, for blocks,

 // will emit DEBUGLEAVEBLOCK and may emit POPBLOCKSCOPE.  (For "with" scopes it

 // emits LEAVEWITH, of course.)  Pass EnterNestedScope a fresh StmtInfoBCE

 // object, and pass that same object to the corresponding LeaveNestedScope.  If

 // the statement is a block scope, pass STMT_BLOCK as stmtType; otherwise for

 // with scopes pass STMT_WITH.

 //

 static bool

 EnterNestedScope(ExclusiveContext *cx, BytecodeEmitter *bce, StmtInfoBCE *stmt, ObjectBox *objbox,

                  StmtType stmtType)

 {

     Rooted<NestedScopeObject *> scopeObj(cx, &objbox->object->as<NestedScopeObject>());

     uint32_t scopeObjectIndex = bce->objectList.add(objbox);

     switch (stmtType) {

       case STMT_BLOCK: {

         Rooted<StaticBlockObject *> blockObj(cx, &scopeObj->as<StaticBlockObject>());

         ComputeLocalOffset(cx, bce, blockObj);

         if (!ComputeAliasedSlots(cx, bce, blockObj))

             return false;

         if (blockObj->needsClone()) {

             if (!EmitInternedObjectOp(cx, scopeObjectIndex, JSOP_PUSHBLOCKSCOPE, bce))

                 return false;

         }

         break;

       }

       case STMT_WITH:

         JS_ASSERT(scopeObj->is<StaticWithObject>());

         if (!EmitInternedObjectOp(cx, scopeObjectIndex, JSOP_ENTERWITH, bce))

             return false;

         break;

       default:

         MOZ_ASSUME_UNREACHABLE();

     }

     uint32_t parent = BlockScopeNote::NoBlockScopeIndex;

     if (StmtInfoBCE *stmt = bce->topScopeStmt) {

         for (; stmt->staticScope != bce->staticScope; stmt = stmt->down) {}

         parent = stmt->blockScopeIndex;

     }

     stmt->blockScopeIndex = bce->blockScopeList.length();

     if (!bce->blockScopeList.append(scopeObjectIndex, bce->offset(), parent))

         return false;

     PushStatementBCE(bce, stmt, stmtType, bce->offset());

     scopeObj->initEnclosingNestedScope(EnclosingStaticScope(bce));

     FinishPushNestedScope(bce, stmt, *scopeObj);

     JS_ASSERT(stmt->isNestedScope);

     stmt->isBlockScope = (stmtType == STMT_BLOCK);

     return true;

 }

 // Patches |breaks| and |continues| unless the top statement info record

 // represents a try-catch-finally suite. May fail if a jump offset overflows.

 static bool

 PopStatementBCE(ExclusiveContext *cx, BytecodeEmitter *bce)

 {

     StmtInfoBCE *stmt = bce->topStmt;

     if (!stmt->isTrying() &&

         (!BackPatch(cx, bce, stmt->breaks, bce->code().end(), JSOP_GOTO) ||

          !BackPatch(cx, bce, stmt->continues, bce->code(stmt->update), JSOP_GOTO)))

     {

         return false;

     }

     FinishPopStatement(bce);

     return true;

 }

 static bool

 LeaveNestedScope(ExclusiveContext *cx, BytecodeEmitter *bce, StmtInfoBCE *stmt)

 {

     JS_ASSERT(stmt == bce->topStmt);

     JS_ASSERT(stmt->isNestedScope);

     JS_ASSERT(stmt->isBlockScope == !(stmt->type == STMT_WITH));

     uint32_t blockScopeIndex = stmt->blockScopeIndex;

 #ifdef DEBUG

     JS_ASSERT(bce->blockScopeList.list[blockScopeIndex].length == 0);

     uint32_t blockObjIndex = bce->blockScopeList.list[blockScopeIndex].index;

     ObjectBox *blockObjBox = bce->objectList.find(blockObjIndex);

     NestedScopeObject *staticScope = &blockObjBox->object->as<NestedScopeObject>();

     JS_ASSERT(stmt->staticScope == staticScope);

     JS_ASSERT(staticScope == bce->staticScope);

     JS_ASSERT_IF(!stmt->isBlockScope, staticScope->is<StaticWithObject>());

 #endif

     if (!PopStatementBCE(cx, bce))

         return false;

     if (Emit1(cx, bce, stmt->isBlockScope ? JSOP_DEBUGLEAVEBLOCK : JSOP_LEAVEWITH) < 0)

         return false;

     bce->blockScopeList.recordEnd(blockScopeIndex, bce->offset());

     if (stmt->isBlockScope && stmt->staticScope->as<StaticBlockObject>().needsClone()) {

         if (Emit1(cx, bce, JSOP_POPBLOCKSCOPE) < 0)

             return false;

     }

     return true;

 }

 static bool

 EmitIndex32(ExclusiveContext *cx, JSOp op, uint32_t index, BytecodeEmitter *bce)

 {

     const size_t len = 1 + UINT32_INDEX_LEN;

     JS_ASSERT(len == size_t(js_CodeSpec[op].length));

     ptrdiff_t offset = EmitCheck(cx, bce, len);

     if (offset < 0)

         return false;

     jsbytecode *code = bce->code(offset);

     code[0] = jsbytecode(op);

     SET_UINT32_INDEX(code, index);

     UpdateDepth(cx, bce, offset);

     CheckTypeSet(cx, bce, op);

     return true;

 }

 static bool

 EmitIndexOp(ExclusiveContext *cx, JSOp op, uint32_t index, BytecodeEmitter *bce)

 {

     const size_t len = js_CodeSpec[op].length;

     JS_ASSERT(len >= 1 + UINT32_INDEX_LEN);

     ptrdiff_t offset = EmitCheck(cx, bce, len);

     if (offset < 0)

         return false;

     jsbytecode *code = bce->code(offset);

     code[0] = jsbytecode(op);

     SET_UINT32_INDEX(code, index);

     UpdateDepth(cx, bce, offset);

     CheckTypeSet(cx, bce, op);

     return true;

 }

 static bool

 EmitAtomOp(ExclusiveContext *cx, JSAtom *atom, JSOp op, BytecodeEmitter *bce)

 {

     JS_ASSERT(JOF_OPTYPE(op) == JOF_ATOM);

     if (op == JSOP_GETPROP && atom == cx->names().length) {

         /* Specialize length accesses for the interpreter. */

         op = JSOP_LENGTH;

     }

     jsatomid index;

     if (!bce->makeAtomIndex(atom, &index))

         return false;

     return EmitIndexOp(cx, op, index, bce);

 }

 static bool

 EmitAtomOp(ExclusiveContext *cx, ParseNode *pn, JSOp op, BytecodeEmitter *bce)

 {

     JS_ASSERT(pn->pn_atom != nullptr);

     return EmitAtomOp(cx, pn->pn_atom, op, bce);

 }

 static bool

 EmitInternedObjectOp(ExclusiveContext *cx, uint32_t index, JSOp op, BytecodeEmitter *bce)

 {

     JS_ASSERT(JOF_OPTYPE(op) == JOF_OBJECT);

     JS_ASSERT(index < bce->objectList.length);

     return EmitIndex32(cx, op, index, bce);

 }

 static bool

 EmitObjectOp(ExclusiveContext *cx, ObjectBox *objbox, JSOp op, BytecodeEmitter *bce)

 {

     return EmitInternedObjectOp(cx, bce->objectList.add(objbox), op, bce);

 }

 static bool

 EmitRegExp(ExclusiveContext *cx, uint32_t index, BytecodeEmitter *bce)

 {

     return EmitIndex32(cx, JSOP_REGEXP, index, bce);

 }

 /*

  * To catch accidental misuse, EMIT_UINT16_IMM_OP/Emit3 assert that they are

  * not used to unconditionally emit JSOP_GETLOCAL. Variable access should

  * instead be emitted using EmitVarOp. In special cases, when the caller

  * definitely knows that a given local slot is unaliased, this function may be

  * used as a non-asserting version of EMIT_UINT16_IMM_OP.

  */

 static bool

 EmitUnaliasedVarOp(ExclusiveContext *cx, JSOp op, uint32_t slot, BytecodeEmitter *bce)

 {

     JS_ASSERT(JOF_OPTYPE(op) != JOF_SCOPECOORD);

     if (IsLocalOp(op)) {

         ptrdiff_t off = EmitN(cx, bce, op, LOCALNO_LEN);

         if (off < 0)

             return false;

         SET_LOCALNO(bce->code(off), slot);

         return true;

     }

     JS_ASSERT(IsArgOp(op));

     ptrdiff_t off = EmitN(cx, bce, op, ARGNO_LEN);

     if (off < 0)

         return false;

     SET_ARGNO(bce->code(off), slot);

     return true;

 }

 static bool

 EmitAliasedVarOp(ExclusiveContext *cx, JSOp op, ScopeCoordinate sc, BytecodeEmitter *bce)

 {

     JS_ASSERT(JOF_OPTYPE(op) == JOF_SCOPECOORD);

     unsigned n = SCOPECOORD_HOPS_LEN + SCOPECOORD_SLOT_LEN;

     JS_ASSERT(int(n) + 1 /* op */ == js_CodeSpec[op].length);

     ptrdiff_t off = EmitN(cx, bce, op, n);

     if (off < 0)

         return false;

     jsbytecode *pc = bce->code(off);

     SET_SCOPECOORD_HOPS(pc, sc.hops());

     pc += SCOPECOORD_HOPS_LEN;

     SET_SCOPECOORD_SLOT(pc, sc.slot());

     pc += SCOPECOORD_SLOT_LEN;

     CheckTypeSet(cx, bce, op);

     return true;

 }

 // Compute the number of nested scope objects that will actually be on the scope

 // chain at runtime, given the BCE's current staticScope.

 static unsigned

 DynamicNestedScopeDepth(BytecodeEmitter *bce)

 {

     unsigned depth = 0;

     for (NestedScopeObject *b = bce->staticScope; b; b = b->enclosingNestedScope()) {

         if (!b->is<StaticBlockObject>() || b->as<StaticBlockObject>().needsClone())

             ++depth;

     }

     return depth;

 }

 static bool

 LookupAliasedName(HandleScript script, PropertyName *name, uint32_t *pslot)

 {

     /*

      * Beware: BindingIter may contain more than one Binding for a given name

      * (in the case of |function f(x,x) {}|) but only one will be aliased.

      */

     uint32_t slot = CallObject::RESERVED_SLOTS;

     for (BindingIter bi(script); !bi.done(); bi++) {

         if (bi->aliased()) {

             if (bi->name() == name) {

                 *pslot = slot;

                 return true;

             }

             slot++;

         }

     }

     return false;

 }

 static bool

 LookupAliasedNameSlot(HandleScript script, PropertyName *name, ScopeCoordinate *sc)

 {

     uint32_t slot;

     if (!LookupAliasedName(script, name, &slot))

         return false;

     sc->setSlot(slot);

     return true;

 }

 /*

  * Use this function instead of assigning directly to 'hops' to guard for

  * uint8_t overflows.

  */

 static bool

 AssignHops(BytecodeEmitter *bce, ParseNode *pn, unsigned src, ScopeCoordinate *dst)

 {

     if (src > UINT8_MAX) {

         bce->reportError(pn, JSMSG_TOO_DEEP, js_function_str);

         return false;

     }

     dst->setHops(src);

     return true;

 }

 static bool

 EmitAliasedVarOp(ExclusiveContext *cx, JSOp op, ParseNode *pn, BytecodeEmitter *bce)

 {

     /*

      * While pn->pn_cookie tells us how many function scopes are between the use and the def this

      * is not the same as how many hops up the dynamic scope chain are needed. In particular:

      *  - a lexical function scope only contributes a hop if it is "heavyweight" (has a dynamic

      *    scope object).

      *  - a heavyweight named function scope contributes an extra scope to the scope chain (a

      *    DeclEnvObject that holds just the name).

      *  - all the intervening let/catch blocks must be counted.

      */

     unsigned skippedScopes = 0;

     BytecodeEmitter *bceOfDef = bce;

     if (pn->isUsed()) {

         /*

          * As explained in BindNameToSlot, the 'level' of a use indicates how

          * many function scopes (i.e., BytecodeEmitters) to skip to find the

          * enclosing function scope of the definition being accessed.

          */

         for (unsigned i = pn->pn_cookie.level(); i; i--) {

             skippedScopes += DynamicNestedScopeDepth(bceOfDef);

             FunctionBox *funbox = bceOfDef->sc->asFunctionBox();

             if (funbox->isHeavyweight()) {

                 skippedScopes++;

                 if (funbox->function()->isNamedLambda())

                     skippedScopes++;

             }

             bceOfDef = bceOfDef->parent;

         }

     } else {

         JS_ASSERT(pn->isDefn());

         JS_ASSERT(pn->pn_cookie.level() == bce->script->staticLevel());

     }

     /*

      * The final part of the skippedScopes computation depends on the type of

      * variable. An arg or local variable is at the outer scope of a function

      * and so includes the full DynamicNestedScopeDepth. A let/catch-binding

      * requires a search of the block chain to see how many (dynamic) block

      * objects to skip.

      */

     ScopeCoordinate sc;

     if (IsArgOp(pn->getOp())) {

         if (!AssignHops(bce, pn, skippedScopes + DynamicNestedScopeDepth(bceOfDef), &sc))

             return false;

         JS_ALWAYS_TRUE(LookupAliasedNameSlot(bceOfDef->script, pn->name(), &sc));

     } else {

         JS_ASSERT(IsLocalOp(pn->getOp()) || pn->isKind(PNK_FUNCTION));

         uint32_t local = pn->pn_cookie.slot();

         if (local < bceOfDef->script->bindings.numVars()) {

             if (!AssignHops(bce, pn, skippedScopes + DynamicNestedScopeDepth(bceOfDef), &sc))

                 return false;

             JS_ALWAYS_TRUE(LookupAliasedNameSlot(bceOfDef->script, pn->name(), &sc));

         } else {

             JS_ASSERT_IF(bce->sc->isFunctionBox(), local <= bceOfDef->script->bindings.numLocals());

             JS_ASSERT(bceOfDef->staticScope->is<StaticBlockObject>());

             Rooted<StaticBlockObject*> b(cx, &bceOfDef->staticScope->as<StaticBlockObject>());

             while (local < b->localOffset()) {

                 if (b->needsClone())

                     skippedScopes++;

                 b = &b->enclosingNestedScope()->as<StaticBlockObject>();

             }

             if (!AssignHops(bce, pn, skippedScopes, &sc))

                 return false;

             sc.setSlot(b->localIndexToSlot(local));

         }

     }

     return EmitAliasedVarOp(cx, op, sc, bce);

 }

 static bool

 EmitVarOp(ExclusiveContext *cx, ParseNode *pn, JSOp op, BytecodeEmitter *bce)

 {

     JS_ASSERT(pn->isKind(PNK_FUNCTION) || pn->isKind(PNK_NAME));

     JS_ASSERT(!pn->pn_cookie.isFree());

     if (IsAliasedVarOp(op)) {

         ScopeCoordinate sc;

         sc.setHops(pn->pn_cookie.level());

         sc.setSlot(pn->pn_cookie.slot());

         return EmitAliasedVarOp(cx, op, sc, bce);

     }

     JS_ASSERT_IF(pn->isKind(PNK_NAME), IsArgOp(op) || IsLocalOp(op));

     if (!bce->isAliasedName(pn)) {

         JS_ASSERT(pn->isUsed() || pn->isDefn());

         JS_ASSERT_IF(pn->isUsed(), pn->pn_cookie.level() == 0);

         JS_ASSERT_IF(pn->isDefn(), pn->pn_cookie.level() == bce->script->staticLevel());

         return EmitUnaliasedVarOp(cx, op, pn->pn_cookie.slot(), bce);

     }

     switch (op) {

       case JSOP_GETARG: case JSOP_GETLOCAL: op = JSOP_GETALIASEDVAR; break;

       case JSOP_SETARG: case JSOP_SETLOCAL: op = JSOP_SETALIASEDVAR; break;

       default: MOZ_ASSUME_UNREACHABLE("unexpected var op");

     }

     return EmitAliasedVarOp(cx, op, pn, bce);

 }

 static JSOp

 GetIncDecInfo(ParseNodeKind kind, bool *post)

 {

     JS_ASSERT(kind == PNK_POSTINCREMENT || kind == PNK_PREINCREMENT ||

               kind == PNK_POSTDECREMENT || kind == PNK_PREDECREMENT);

     *post = kind == PNK_POSTINCREMENT || kind == PNK_POSTDECREMENT;

     return (kind == PNK_POSTINCREMENT || kind == PNK_PREINCREMENT) ? JSOP_ADD : JSOP_SUB;

 }

 static bool

 EmitVarIncDec(ExclusiveContext *cx, ParseNode *pn, BytecodeEmitter *bce)

 {

     JSOp op = pn->pn_kid->getOp();

     JS_ASSERT(IsArgOp(op) || IsLocalOp(op) || IsAliasedVarOp(op));

     JS_ASSERT(pn->pn_kid->isKind(PNK_NAME));

     JS_ASSERT(!pn->pn_kid->pn_cookie.isFree());

     bool post;

     JSOp binop = GetIncDecInfo(pn->getKind(), &post);

     JSOp getOp, setOp;

     if (IsLocalOp(op)) {

         getOp = JSOP_GETLOCAL;

         setOp = JSOP_SETLOCAL;

     } else if (IsArgOp(op)) {

         getOp = JSOP_GETARG;

         setOp = JSOP_SETARG;

     } else {

         getOp = JSOP_GETALIASEDVAR;

         setOp = JSOP_SETALIASEDVAR;

     }

     if (!EmitVarOp(cx, pn->pn_kid, getOp, bce))              // V

         return false;

     if (Emit1(cx, bce, JSOP_POS) < 0)                        // N

         return false;

     if (post && Emit1(cx, bce, JSOP_DUP) < 0)                // N? N

         return false;

     if (Emit1(cx, bce, JSOP_ONE) < 0)                        // N? N 1

         return false;

     if (Emit1(cx, bce, binop) < 0)                           // N? N+1

         return false;

     if (!EmitVarOp(cx, pn->pn_kid, setOp, bce))              // N? N+1

         return false;

     if (post && Emit1(cx, bce, JSOP_POP) < 0)                // RESULT

         return false;

     return true;

 }

 bool

 BytecodeEmitter::isAliasedName(ParseNode *pn)

 {

     Definition *dn = pn->resolve();

     JS_ASSERT(dn->isDefn());

     JS_ASSERT(!dn->isPlaceholder());

     JS_ASSERT(dn->isBound());

     /* If dn is in an enclosing function, it is definitely aliased. */

     if (dn->pn_cookie.level() != script->staticLevel())

         return true;

     switch (dn->kind()) {

       case Definition::LET:

         /*

          * There are two ways to alias a let variable: nested functions and

          * dynamic scope operations. (This is overly conservative since the

          * bindingsAccessedDynamically flag, checked by allLocalsAliased, is

          * function-wide.)

          *

          * In addition all locals in generators are marked as aliased, to ensure

          * that they are allocated on scope chains instead of on the stack.  See

          * the definition of SharedContext::allLocalsAliased.

          */

         return dn->isClosed() || sc->allLocalsAliased();

       case Definition::ARG:

         /*

          * Consult the bindings, since they already record aliasing. We might

          * be tempted to use the same definition as VAR/CONST/LET, but there is

          * a problem caused by duplicate arguments: only the last argument with

          * a given name is aliased. This is necessary to avoid generating a

          * shape for the call object with with more than one name for a given

          * slot (which violates internal engine invariants). All this means that

          * the '|| sc->allLocalsAliased()' disjunct is incorrect since it will

          * mark both parameters in function(x,x) as aliased.

          */

         return script->formalIsAliased(pn->pn_cookie.slot());

       case Definition::VAR:

       case Definition::CONST:

         JS_ASSERT_IF(sc->allLocalsAliased(), script->varIsAliased(pn->pn_cookie.slot()));

         return script->varIsAliased(pn->pn_cookie.slot());

       case Definition::PLACEHOLDER:

       case Definition::NAMED_LAMBDA:

       case Definition::MISSING:

         MOZ_ASSUME_UNREACHABLE("unexpected dn->kind");

     }

     return false;

 }

 /*

  * Try to convert a *NAME op with a free name to a more specialized GNAME,

  * INTRINSIC or ALIASEDVAR op, which optimize accesses on that name.

  * Return true if a conversion was made.

  */

 static bool

 TryConvertFreeName(BytecodeEmitter *bce, ParseNode *pn)

 {

     /*

      * In self-hosting mode, JSOP_*NAME is unconditionally converted to

      * JSOP_*INTRINSIC. This causes lookups to be redirected to the special

      * intrinsics holder in the global object, into which any missing values are

      * cloned lazily upon first access.

      */

     if (bce->emitterMode == BytecodeEmitter::SelfHosting) {

         JSOp op;

         switch (pn->getOp()) {

           case JSOP_NAME:     op = JSOP_GETINTRINSIC; break;

           case JSOP_SETNAME:  op = JSOP_SETINTRINSIC; break;

           /* Other *NAME ops aren't (yet) supported in self-hosted code. */

           default: MOZ_ASSUME_UNREACHABLE("intrinsic");

         }

         pn->setOp(op);

         return true;

     }

     /*

      * When parsing inner functions lazily, parse nodes for outer functions no

      * longer exist and only the function's scope chain is available for

      * resolving upvar accesses within the inner function.

      */

     if (bce->emitterMode == BytecodeEmitter::LazyFunction) {

         // The only statements within a lazy function which can push lexical

         // scopes are try/catch blocks. Use generic ops in this case.

         for (StmtInfoBCE *stmt = bce->topStmt; stmt; stmt = stmt->down) {

             if (stmt->type == STMT_CATCH)

                 return true;

         }

         size_t hops = 0;

         FunctionBox *funbox = bce->sc->asFunctionBox();

         if (funbox->hasExtensibleScope())

             return false;

         if (funbox->function()->isNamedLambda() && funbox->function()->atom() == pn->pn_atom)

             return false;

         if (funbox->isHeavyweight()) {

             hops++;

             if (funbox->function()->isNamedLambda())

                 hops++;

         }

         if (bce->script->directlyInsideEval())

             return false;

         RootedObject outerScope(bce->sc->context, bce->script->enclosingStaticScope());

         for (StaticScopeIter<CanGC> ssi(bce->sc->context, outerScope); !ssi.done(); ssi++) {

             if (ssi.type() != StaticScopeIter<CanGC>::FUNCTION) {

                 if (ssi.type() == StaticScopeIter<CanGC>::BLOCK) {

                     // Use generic ops if a catch block is encountered.

                     return false;

                 }

                 if (ssi.hasDynamicScopeObject())

                     hops++;

                 continue;

             }

             RootedScript script(bce->sc->context, ssi.funScript());

             if (script->functionNonDelazifying()->atom() == pn->pn_atom)

                 return false;

             if (ssi.hasDynamicScopeObject()) {

                 uint32_t slot;

                 if (LookupAliasedName(script, pn->pn_atom->asPropertyName(), &slot)) {

                     JSOp op;

                     switch (pn->getOp()) {

                       case JSOP_NAME:     op = JSOP_GETALIASEDVAR; break;

                       case JSOP_SETNAME:  op = JSOP_SETALIASEDVAR; break;

                       default: return false;

                     }

                     pn->setOp(op);

                     JS_ALWAYS_TRUE(pn->pn_cookie.set(bce->parser->tokenStream, hops, slot));

                     return true;

                 }

                 hops++;

             }

             if (script->funHasExtensibleScope() || script->directlyInsideEval())

                 return false;

         }

     }

     // Unbound names aren't recognizable global-property references if the

     // script isn't running against its global object.

     if (!bce->script->compileAndGo() || !bce->hasGlobalScope)

         return false;

     // Deoptimized names also aren't necessarily globals.

     if (pn->isDeoptimized())

         return false;

     if (bce->sc->isFunctionBox()) {

         // Unbound names in function code may not be globals if new locals can

         // be added to this function (or an enclosing one) to alias a global

         // reference.

         FunctionBox *funbox = bce->sc->asFunctionBox();

         if (funbox->mightAliasLocals())

             return false;

     }

     // If this is eval code, being evaluated inside strict mode eval code,

     // an "unbound" name might be a binding local to that outer eval:

     //

     //   var x = "GLOBAL";

     //   eval('"use strict"; ' +

     //        'var x; ' +

     //        'eval("print(x)");'); // "undefined", not "GLOBAL"

     //

     // Given the enclosing eval code's strictness and its bindings (neither is

     // readily available now), we could exactly check global-ness, but it's not

     // worth the trouble for doubly-nested eval code.  So we conservatively

     // approximate.  If the outer eval code is strict, then this eval code will

     // be: thus, don't optimize if we're compiling strict code inside an eval.

     if (bce->insideEval && bce->sc->strict)

         return false;

     // Beware: if you change anything here, you might also need to change

     // js::ReportIfUndeclaredVarAssignment.

     JSOp op;

     switch (pn->getOp()) {

       case JSOP_NAME:     op = JSOP_GETGNAME; break;

       case JSOP_SETNAME:  op = JSOP_SETGNAME; break;

       case JSOP_SETCONST:

         // Not supported.

         return false;

       default: MOZ_ASSUME_UNREACHABLE("gname");

     }

     pn->setOp(op);

     return true;

 }

 /*

  * BindNameToSlotHelper attempts to optimize name gets and sets to stack slot

  * loads and stores, given the compile-time information in bce and a PNK_NAME

  * node pn.  It returns false on error, true on success.

  *

  * The caller can test pn->pn_cookie.isFree() to tell whether optimization

  * occurred, in which case BindNameToSlotHelper also updated pn->pn_op.  If

  * pn->pn_cookie.isFree() is still true on return, pn->pn_op still may have

  * been optimized, e.g., from JSOP_NAME to JSOP_CALLEE.  Whether or not

  * pn->pn_op was modified, if this function finds an argument or local variable

  * name, PND_CONST will be set in pn_dflags for read-only properties after a

  * successful return.

  *

  * NB: if you add more opcodes specialized from JSOP_NAME, etc., don't forget

  * to update the special cases in EmitFor (for-in) and EmitAssignment (= and

  * op=, e.g. +=).

  */

 static bool

 BindNameToSlotHelper(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)

 {

     JS_ASSERT(pn->isKind(PNK_NAME));

     JS_ASSERT_IF(pn->isKind(PNK_FUNCTION), pn->isBound());

     /* Don't attempt if 'pn' is already bound or deoptimized or a function. */

     if (pn->isBound() || pn->isDeoptimized())

         return true;

     /* JSOP_CALLEE is pre-bound by definition. */

     JSOp op = pn->getOp();

     JS_ASSERT(op != JSOP_CALLEE);

     JS_ASSERT(JOF_OPTYPE(op) == JOF_ATOM);

     /*

      * The parser already linked name uses to definitions when (where not

      * prevented by non-lexical constructs like 'with' and 'eval').

      */

     Definition *dn;

     if (pn->isUsed()) {

         JS_ASSERT(pn->pn_cookie.isFree());

         dn = pn->pn_lexdef;

         JS_ASSERT(dn->isDefn());

         pn->pn_dflags |= (dn->pn_dflags & PND_CONST);

     } else if (pn->isDefn()) {

         dn = (Definition *) pn;

     } else {

         return true;

     }

     /*

      * Turn attempts to mutate const-declared bindings into get ops (for

      * pre-increment and pre-decrement ops, our caller will have to emit

      * JSOP_POS, JSOP_ONE, and JSOP_ADD as well).

      *

      * Turn JSOP_DELNAME into JSOP_FALSE if dn is known, as all declared

      * bindings visible to the compiler are permanent in JS unless the

      * declaration originates at top level in eval code.

      */

     switch (op) {

       case JSOP_NAME:

       case JSOP_SETCONST:

         break;

       default:

         if (pn->isConst()) {

             if (bce->sc->needStrictChecks()) {

                 JSAutoByteString name;

                 if (!AtomToPrintableString(cx, pn->pn_atom, &name) ||

                     !bce->reportStrictModeError(pn, JSMSG_READ_ONLY, name.ptr()))

                 {

                     return false;

                 }

             }

             pn->setOp(op = JSOP_NAME);

         }

     }

     if (dn->pn_cookie.isFree()) {

         if (HandleScript caller = bce->evalCaller) {

             JS_ASSERT(bce->script->compileAndGo());

             /*

              * Don't generate upvars on the left side of a for loop. See

              * bug 470758.

              */

             if (bce->emittingForInit)

                 return true;

             /*

              * If this is an eval in the global scope, then unbound variables

              * must be globals, so try to use GNAME ops.

              */

             if (!caller->functionOrCallerFunction() && TryConvertFreeName(bce, pn)) {

                 pn->pn_dflags |= PND_BOUND;

                 return true;

             }

             /*

              * Out of tricks, so we must rely on PICs to optimize named

              * accesses from direct eval called from function code.

              */

             return true;

         }

         /* Optimize accesses to undeclared globals. */

         if (!TryConvertFreeName(bce, pn))

             return true;

         pn->pn_dflags |= PND_BOUND;

         return true;

     }

     /*

      * At this point, we are only dealing with uses that have already been

      * bound to definitions via pn_lexdef. The rest of this routine converts

      * the parse node of the use from its initial JSOP_*NAME* op to a LOCAL/ARG

      * op. This requires setting the node's pn_cookie with a pair (level, slot)

      * where 'level' is the number of function scopes between the use and the

      * def and 'slot' is the index to emit as the immediate of the ARG/LOCAL

      * op. For example, in this code:

      *

      *   function(a,b,x) { return x }

      *   function(y) { function() { return y } }

      *

      * x will get (level = 0, slot = 2) and y will get (level = 1, slot = 0).

      */

     JS_ASSERT(!pn->isDefn());

     JS_ASSERT(pn->isUsed());

     JS_ASSERT(pn->pn_lexdef);

     JS_ASSERT(pn->pn_cookie.isFree());

     /*

      * We are compiling a function body and may be able to optimize name

      * to stack slot. Look for an argument or variable in the function and

      * rewrite pn_op and update pn accordingly.

      */

     switch (dn->kind()) {

       case Definition::ARG:

         switch (op) {

           case JSOP_NAME:     op = JSOP_GETARG; break;

           case JSOP_SETNAME:  op = JSOP_SETARG; break;

           default: MOZ_ASSUME_UNREACHABLE("arg");

         }

         JS_ASSERT(!pn->isConst());

         break;

       case Definition::VAR:

       case Definition::CONST:

       case Definition::LET:

         switch (op) {

           case JSOP_NAME:     op = JSOP_GETLOCAL; break;

           case JSOP_SETNAME:  op = JSOP_SETLOCAL; break;

           case JSOP_SETCONST: op = JSOP_SETLOCAL; break;

           default: MOZ_ASSUME_UNREACHABLE("local");

         }

         break;

       case Definition::NAMED_LAMBDA: {

         JS_ASSERT(dn->isOp(JSOP_CALLEE));

         JS_ASSERT(op != JSOP_CALLEE);

         /*

          * Currently, the ALIASEDVAR ops do not support accessing the

          * callee of a DeclEnvObject, so use NAME.

          */

         if (dn->pn_cookie.level() != bce->script->staticLevel())

             return true;

         DebugOnly<JSFunction *> fun = bce->sc->asFunctionBox()->function();

         JS_ASSERT(fun->isLambda());

         JS_ASSERT(pn->pn_atom == fun->atom());

         /*

          * Leave pn->isOp(JSOP_NAME) if bce->fun is heavyweight to

          * address two cases: a new binding introduced by eval, and

          * assignment to the name in strict mode.

          *

          *   var fun = (function f(s) { eval(s); return f; });

          *   assertEq(fun("var f = 42"), 42);

          *

          * ECMAScript specifies that a function expression's name is bound

          * in a lexical environment distinct from that used to bind its

          * named parameters, the arguments object, and its variables.  The

          * new binding for "var f = 42" shadows the binding for the

          * function itself, so the name of the function will not refer to

          * the function.

          *

          *    (function f() { "use strict"; f = 12; })();

          *

          * Outside strict mode, assignment to a function expression's name

          * has no effect.  But in strict mode, this attempt to mutate an

          * immutable binding must throw a TypeError.  We implement this by

          * not optimizing such assignments and by marking such functions as

          * heavyweight, ensuring that the function name is represented in

          * the scope chain so that assignment will throw a TypeError.

          */

         if (!bce->sc->asFunctionBox()->isHeavyweight()) {

             op = JSOP_CALLEE;

             pn->pn_dflags |= PND_CONST;

         }

         pn->setOp(op);

         pn->pn_dflags |= PND_BOUND;

         return true;

       }

       case Definition::PLACEHOLDER:

         return true;

       case Definition::MISSING:

         MOZ_ASSUME_UNREACHABLE("missing");

     }

     /*

      * The difference between the current static level and the static level of

      * the definition is the number of function scopes between the current

      * scope and dn's scope.

      */

     unsigned skip = bce->script->staticLevel() - dn->pn_cookie.level();

     JS_ASSERT_IF(skip, dn->isClosed());

     /*

      * Explicitly disallow accessing var/let bindings in global scope from

      * nested functions. The reason for this limitation is that, since the

      * global script is not included in the static scope chain (1. because it

      * has no object to stand in the static scope chain, 2. to minimize memory

      * bloat where a single live function keeps its whole global script

      * alive.), ScopeCoordinateToTypeSet is not able to find the var/let's

      * associated types::TypeSet.

      */

     if (skip) {

         BytecodeEmitter *bceSkipped = bce;

         for (unsigned i = 0; i < skip; i++)

             bceSkipped = bceSkipped->parent;

         if (!bceSkipped->sc->isFunctionBox())

             return true;

     }

     JS_ASSERT(!pn->isOp(op));

     pn->setOp(op);

     if (!pn->pn_cookie.set(bce->parser->tokenStream, skip, dn->pn_cookie.slot()))

         return false;

     pn->pn_dflags |= PND_BOUND;

     return true;

 }

 /*

  * Attempts to bind the name, then checks that no dynamic scope lookup ops are

  * emitted in self-hosting mode. NAME ops do lookups off current scope chain,

  * and we do not want to allow self-hosted code to use the dynamic scope.

  */

 static bool

 BindNameToSlot(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)

 {

     if (!BindNameToSlotHelper(cx, bce, pn))

         return false;

     if (bce->emitterMode == BytecodeEmitter::SelfHosting && !pn->isBound()) {

         bce->reportError(pn, JSMSG_SELFHOSTED_UNBOUND_NAME);

         return false;

     }

     return true;

 }

 /*

  * If pn contains a useful expression, return true with *answer set to true.

  * If pn contains a useless expression, return true with *answer set to false.

  * Return false on error.

  *

  * The caller should initialize *answer to false and invoke this function on

  * an expression statement or similar subtree to decide whether the tree could

  * produce code that has any side effects.  For an expression statement, we

  * define useless code as code with no side effects, because the main effect,

  * the value left on the stack after the code executes, will be discarded by a

  * pop bytecode.

  */

 static bool

 CheckSideEffects(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn, bool *answer)

 {

     if (!pn || *answer)

         return true;

     switch (pn->getArity()) {

       case PN_CODE:

         /*

          * A named function, contrary to ES3, is no longer useful, because we

          * bind its name lexically (using JSOP_CALLEE) instead of creating an

          * Object instance and binding a readonly, permanent property in it

          * (the object and binding can be detected and hijacked or captured).

          * This is a bug fix to ES3; it is fixed in ES3.1 drafts.

          */

         MOZ_ASSERT(*answer == false);

         return true;

       case PN_LIST:

         if (pn->isOp(JSOP_NOP) || pn->isOp(JSOP_OR) || pn->isOp(JSOP_AND) ||

             pn->isOp(JSOP_STRICTEQ) || pn->isOp(JSOP_STRICTNE)) {

             /*

              * Non-operators along with ||, &&, ===, and !== never invoke

              * toString or valueOf.

              */

             bool ok = true;

             for (ParseNode *pn2 = pn->pn_head; pn2; pn2 = pn2->pn_next)

                 ok &= CheckSideEffects(cx, bce, pn2, answer);

             return ok;

         }

         if (pn->isKind(PNK_GENEXP)) {

             /* Generator-expressions are harmless if the result is ignored. */

             MOZ_ASSERT(*answer == false);

             return true;

         }

         /*

          * All invocation operations (construct: PNK_NEW, call: PNK_CALL)

          * are presumed to be useful, because they may have side effects

          * even if their main effect (their return value) is discarded.

          *

          * PNK_ELEM binary trees of 3+ nodes are flattened into lists to

          * avoid too much recursion. All such lists must be presumed to be

          * useful because each index operation could invoke a getter.

          *

          * Likewise, array and object initialisers may call prototype

          * setters (the __defineSetter__ built-in, and writable __proto__

          * on Array.prototype create this hazard). Initialiser list nodes

          * have JSOP_NEWINIT in their pn_op.

          */

         *answer = true;

         return true;

       case PN_TERNARY:

         return CheckSideEffects(cx, bce, pn->pn_kid1, answer) &&

                CheckSideEffects(cx, bce, pn->pn_kid2, answer) &&

                CheckSideEffects(cx, bce, pn->pn_kid3, answer);

       case PN_BINARY:

       case PN_BINARY_OBJ:

         if (pn->isAssignment()) {

             /*

              * Assignment is presumed to be useful, even if the next operation

              * is another assignment overwriting this one's ostensible effect,

              * because the left operand may be a property with a setter that

              * has side effects.

              *

              * The only exception is assignment of a useless value to a const

              * declared in the function currently being compiled.

              */

             ParseNode *pn2 = pn->pn_left;

             if (!pn2->isKind(PNK_NAME)) {

                 *answer = true;

             } else {

                 if (!BindNameToSlot(cx, bce, pn2))

                     return false;

                 if (!CheckSideEffects(cx, bce, pn->pn_right, answer))

                     return false;

                 if (!*answer && (!pn->isOp(JSOP_NOP) || !pn2->isConst()))

                     *answer = true;

             }

             return true;

         }

         if (pn->isOp(JSOP_OR) || pn->isOp(JSOP_AND) || pn->isOp(JSOP_STRICTEQ) ||

             pn->isOp(JSOP_STRICTNE)) {

             /*

              * ||, &&, ===, and !== do not convert their operands via

              * toString or valueOf method calls.

              */

             return CheckSideEffects(cx, bce, pn->pn_left, answer) &&

                    CheckSideEffects(cx, bce, pn->pn_right, answer);

         }

         /*

          * We can't easily prove that neither operand ever denotes an

          * object with a toString or valueOf method.

          */

         *answer = true;

         return true;

       case PN_UNARY:

         switch (pn->getKind()) {

           case PNK_DELETE:

           {

             ParseNode *pn2 = pn->pn_kid;

             switch (pn2->getKind()) {

               case PNK_NAME:

                 if (!BindNameToSlot(cx, bce, pn2))

                     return false;

                 if (pn2->isConst()) {

                     MOZ_ASSERT(*answer == false);

                     return true;

                 }

                 /* FALL THROUGH */

               case PNK_DOT:

               case PNK_CALL:

               case PNK_ELEM:

                 /* All these delete addressing modes have effects too. */

                 *answer = true;

                 return true;

               default:

                 return CheckSideEffects(cx, bce, pn2, answer);

             }

             MOZ_ASSUME_UNREACHABLE("We have a returning default case");

           }

           case PNK_TYPEOF:

           case PNK_VOID:

           case PNK_NOT:

           case PNK_BITNOT:

             if (pn->isOp(JSOP_NOT)) {

                 /* ! does not convert its operand via toString or valueOf. */

                 return CheckSideEffects(cx, bce, pn->pn_kid, answer);

             }

             /* FALL THROUGH */

           default:

             /*

              * All of PNK_INC, PNK_DEC, PNK_THROW, PNK_YIELD, and PNK_YIELD_STAR

              * have direct effects. Of the remaining unary-arity node types, we

              * can't easily prove that the operand never denotes an object with

              * a toString or valueOf method.

              */

             *answer = true;

             return true;

         }

         MOZ_ASSUME_UNREACHABLE("We have a returning default case");

       case PN_NAME:

         /*

          * Take care to avoid trying to bind a label name (labels, both for

          * statements and property values in object initialisers, have pn_op

          * defaulted to JSOP_NOP).

          */

         if (pn->isKind(PNK_NAME) && !pn->isOp(JSOP_NOP)) {

             if (!BindNameToSlot(cx, bce, pn))

                 return false;

             if (!pn->isOp(JSOP_CALLEE) && pn->pn_cookie.isFree()) {

                 /*

                  * Not a use of an unshadowed named function expression's given

                  * name, so this expression could invoke a getter that has side

                  * effects.

                  */

                 *answer = true;

             }

         }

         if (pn->isKind(PNK_DOT)) {

             /* Dotted property references in general can call getters. */

             *answer = true;

         }

         return CheckSideEffects(cx, bce, pn->maybeExpr(), answer);

       case PN_NULLARY:

         if (pn->isKind(PNK_DEBUGGER))

             *answer = true;

         return true;

     }

     return true;

 }

 bool

 BytecodeEmitter::isInLoop()

 {

     for (StmtInfoBCE *stmt = topStmt; stmt; stmt = stmt->down) {

         if (stmt->isLoop())

             return true;

     }

     return false;

 }

 bool

 BytecodeEmitter::checkSingletonContext()

 {

     if (!script->compileAndGo() || sc->isFunctionBox() || isInLoop())

         return false;

     hasSingletons = true;

     return true;

 }

 bool

 BytecodeEmitter::needsImplicitThis()

 {

     if (!script->compileAndGo())

         return true;

     if (sc->isFunctionBox()) {

         if (sc->asFunctionBox()->inWith)

             return true;

     } else {

         JSObject *scope = sc->asGlobalSharedContext()->scopeChain();

         while (scope) {

             if (scope->is<DynamicWithObject>())

                 return true;

             scope = scope->enclosingScope();

         }

     }

     for (StmtInfoBCE *stmt = topStmt; stmt; stmt = stmt->down) {

         if (stmt->type == STMT_WITH)

             return true;

     }

     return false;

 }

 void

 BytecodeEmitter::tellDebuggerAboutCompiledScript(ExclusiveContext *cx)

 {

     // Note: when parsing off thread the resulting scripts need to be handed to

     // the debugger after rejoining to the main thread.

     if (!cx->isJSContext())

         return;

     RootedFunction function(cx, script->functionNonDelazifying());

     CallNewScriptHook(cx->asJSContext(), script, function);

     // Lazy scripts are never top level (despite always being invoked with a

     // nullptr parent), and so the hook should never be fired.

     if (emitterMode != LazyFunction && !parent) {

         GlobalObject *compileAndGoGlobal = nullptr;

         if (script->compileAndGo())

             compileAndGoGlobal = &script->global();

         Debugger::onNewScript(cx->asJSContext(), script, compileAndGoGlobal);

     }

 }

 inline TokenStream *

 BytecodeEmitter::tokenStream()

 {

     return &parser->tokenStream;

 }

 bool

 BytecodeEmitter::reportError(ParseNode *pn, unsigned errorNumber, ...)

 {

     TokenPos pos = pn ? pn->pn_pos : tokenStream()->currentToken().pos;

     va_list args;

     va_start(args, errorNumber);

     bool result = tokenStream()->reportCompileErrorNumberVA(pos.begin, JSREPORT_ERROR,

                                                             errorNumber, args);

     va_end(args);

     return result;

 }

 bool

 BytecodeEmitter::reportStrictWarning(ParseNode *pn, unsigned errorNumber, ...)

 {

     TokenPos pos = pn ? pn->pn_pos : tokenStream()->currentToken().pos;

     va_list args;

     va_start(args, errorNumber);

     bool result = tokenStream()->reportStrictWarningErrorNumberVA(pos.begin, errorNumber, args);

     va_end(args);

     return result;

 }

 bool

 BytecodeEmitter::reportStrictModeError(ParseNode *pn, unsigned errorNumber, ...)

 {

     TokenPos pos = pn ? pn->pn_pos : tokenStream()->currentToken().pos;

     va_list args;

     va_start(args, errorNumber);

     bool result = tokenStream()->reportStrictModeErrorNumberVA(pos.begin, sc->strict,

                                                                errorNumber, args);

     va_end(args);

     return result;

 }

 static bool

 EmitNewInit(ExclusiveContext *cx, BytecodeEmitter *bce, JSProtoKey key)

 {

     const size_t len = 1 + UINT32_INDEX_LEN;

     ptrdiff_t offset = EmitCheck(cx, bce, len);

     if (offset < 0)

         return false;

     jsbytecode *code = bce->code(offset);

     code[0] = JSOP_NEWINIT;

     code[1] = jsbytecode(key);

     code[2] = 0;

     code[3] = 0;

     code[4] = 0;

     UpdateDepth(cx, bce, offset);

     CheckTypeSet(cx, bce, JSOP_NEWINIT);

     return true;

 }

 static bool

 IteratorResultShape(ExclusiveContext *cx, BytecodeEmitter *bce, unsigned *shape)

 {

     JS_ASSERT(bce->script->compileAndGo());

     RootedObject obj(cx);

     gc::AllocKind kind = GuessObjectGCKind(2);

     obj = NewBuiltinClassInstance(cx, &JSObject::class_, kind);

     if (!obj)

         return false;

     Rooted<jsid> value_id(cx, AtomToId(cx->names().value));

     Rooted<jsid> done_id(cx, AtomToId(cx->names().done));

     if (!DefineNativeProperty(cx, obj, value_id, UndefinedHandleValue, nullptr, nullptr,

                               JSPROP_ENUMERATE))

         return false;

     if (!DefineNativeProperty(cx, obj, done_id, UndefinedHandleValue, nullptr, nullptr,

                               JSPROP_ENUMERATE))

         return false;

     ObjectBox *objbox = bce->parser->newObjectBox(obj);

     if (!objbox)

         return false;

     *shape = bce->objectList.add(objbox);

     return true;

 }

 static bool

 EmitPrepareIteratorResult(ExclusiveContext *cx, BytecodeEmitter *bce)

 {

     if (bce->script->compileAndGo()) {

         unsigned shape;

         if (!IteratorResultShape(cx, bce, &shape))

             return false;

         return EmitIndex32(cx, JSOP_NEWOBJECT, shape, bce);

     }

     return EmitNewInit(cx, bce, JSProto_Object);

 }

 static bool

 EmitFinishIteratorResult(ExclusiveContext *cx, BytecodeEmitter *bce, bool done)

 {

     jsatomid value_id;

     if (!bce->makeAtomIndex(cx->names().value, &value_id))

         return UINT_MAX;

     jsatomid done_id;

     if (!bce->makeAtomIndex(cx->names().done, &done_id))

         return UINT_MAX;

     if (!EmitIndex32(cx, JSOP_INITPROP, value_id, bce))

         return false;

     if (Emit1(cx, bce, done ? JSOP_TRUE : JSOP_FALSE) < 0)

         return false;

     if (!EmitIndex32(cx, JSOP_INITPROP, done_id, bce))

         return false;

     if (Emit1(cx, bce, JSOP_ENDINIT) < 0)

         return false;

     return true;

 }

 static bool

 EmitNameOp(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn, bool callContext)

 {

     if (!BindNameToSlot(cx, bce, pn))

         return false;

     JSOp op = pn->getOp();

     if (op == JSOP_CALLEE) {

         if (Emit1(cx, bce, op) < 0)

             return false;

     } else {

         if (!pn->pn_cookie.isFree()) {

             JS_ASSERT(JOF_OPTYPE(op) != JOF_ATOM);

             if (!EmitVarOp(cx, pn, op, bce))

                 return false;

         } else {

             if (!EmitAtomOp(cx, pn, op, bce))

                 return false;

         }

     }

     /* Need to provide |this| value for call */

     if (callContext) {

         if (op == JSOP_NAME && bce->needsImplicitThis()) {

             if (!EmitAtomOp(cx, pn, JSOP_IMPLICITTHIS, bce))

                 return false;

         } else {

             if (Emit1(cx, bce, JSOP_UNDEFINED) < 0)

                 return false;

         }

     }

     return true;

 }

 static bool

 EmitPropLHS(ExclusiveContext *cx, ParseNode *pn, JSOp op, BytecodeEmitter *bce)

 {

     JS_ASSERT(pn->isKind(PNK_DOT));

     ParseNode *pn2 = pn->maybeExpr();

     /*

      * If the object operand is also a dotted property reference, reverse the

      * list linked via pn_expr temporarily so we can iterate over it from the

      * bottom up (reversing again as we go), to avoid excessive recursion.

      */

     if (pn2->isKind(PNK_DOT)) {

         ParseNode *pndot = pn2;

         ParseNode *pnup = nullptr, *pndown;

         ptrdiff_t top = bce->offset();

         for (;;) {

             /* Reverse pndot->pn_expr to point up, not down. */

             pndot->pn_offset = top;

             JS_ASSERT(!pndot->isUsed());

             pndown = pndot->pn_expr;

             pndot->pn_expr = pnup;

             if (!pndown->isKind(PNK_DOT))

                 break;

             pnup = pndot;

             pndot = pndown;

         }

         /* pndown is a primary expression, not a dotted property reference. */

         if (!EmitTree(cx, bce, pndown))

             return false;

         do {

             /* Walk back up the list, emitting annotated name ops. */

             if (!EmitAtomOp(cx, pndot, JSOP_GETPROP, bce))

                 return false;

             /* Reverse the pn_expr link again. */

             pnup = pndot->pn_expr;

             pndot->pn_expr = pndown;

             pndown = pndot;

         } while ((pndot = pnup) != nullptr);

         return true;

     }

     // The non-optimized case.

     return EmitTree(cx, bce, pn2);

 }

 static bool

 EmitPropOp(ExclusiveContext *cx, ParseNode *pn, JSOp op, BytecodeEmitter *bce)

 {

     JS_ASSERT(pn->isArity(PN_NAME));

     if (!EmitPropLHS(cx, pn, op, bce))

         return false;

     if (op == JSOP_CALLPROP && Emit1(cx, bce, JSOP_DUP) < 0)

         return false;

     if (!EmitAtomOp(cx, pn, op, bce))

         return false;

     if (op == JSOP_CALLPROP && Emit1(cx, bce, JSOP_SWAP) < 0)

         return false;

     return true;

 }

 static bool

 EmitPropIncDec(ExclusiveContext *cx, ParseNode *pn, BytecodeEmitter *bce)

 {

     JS_ASSERT(pn->pn_kid->getKind() == PNK_DOT);

     bool post;

     JSOp binop = GetIncDecInfo(pn->getKind(), &post);

     JSOp get = JSOP_GETPROP;

     if (!EmitPropLHS(cx, pn->pn_kid, get, bce))     // OBJ

         return false;

     if (Emit1(cx, bce, JSOP_DUP) < 0)               // OBJ OBJ

         return false;

     if (!EmitAtomOp(cx, pn->pn_kid, JSOP_GETPROP, bce)) // OBJ V

         return false;

     if (Emit1(cx, bce, JSOP_POS) < 0)               // OBJ N

         return false;

     if (post && Emit1(cx, bce, JSOP_DUP) < 0)       // OBJ N? N

         return false;

     if (Emit1(cx, bce, JSOP_ONE) < 0)               // OBJ N? N 1

         return false;

     if (Emit1(cx, bce, binop) < 0)                  // OBJ N? N+1

         return false;

     if (post) {

         if (Emit2(cx, bce, JSOP_PICK, (jsbytecode)2) < 0)   // N? N+1 OBJ

             return false;

         if (Emit1(cx, bce, JSOP_SWAP) < 0)                  // N? OBJ N+1

             return false;

     }

     if (!EmitAtomOp(cx, pn->pn_kid, JSOP_SETPROP, bce))     // N? N+1

         return false;

     if (post && Emit1(cx, bce, JSOP_POP) < 0)       // RESULT

         return false;

     return true;

 }

 static bool

 EmitNameIncDec(ExclusiveContext *cx, ParseNode *pn, BytecodeEmitter *bce)

 {

     const JSCodeSpec *cs = &js_CodeSpec[pn->pn_kid->getOp()];

     bool global = (cs->format & JOF_GNAME);

     bool post;

     JSOp binop = GetIncDecInfo(pn->getKind(), &post);

     if (!EmitAtomOp(cx, pn->pn_kid, global ? JSOP_BINDGNAME : JSOP_BINDNAME, bce))  // OBJ

         return false;

     if (!EmitAtomOp(cx, pn->pn_kid, global ? JSOP_GETGNAME : JSOP_NAME, bce))       // OBJ V

         return false;

     if (Emit1(cx, bce, JSOP_POS) < 0)               // OBJ N

         return false;

     if (post && Emit1(cx, bce, JSOP_DUP) < 0)       // OBJ N? N

         return false;

     if (Emit1(cx, bce, JSOP_ONE) < 0)               // OBJ N? N 1

         return false;

     if (Emit1(cx, bce, binop) < 0)                  // OBJ N? N+1

         return false;

     if (post) {

         if (Emit2(cx, bce, JSOP_PICK, (jsbytecode)2) < 0)   // N? N+1 OBJ

             return false;

         if (Emit1(cx, bce, JSOP_SWAP) < 0)                  // N? OBJ N+1

             return false;

     }

     if (!EmitAtomOp(cx, pn->pn_kid, global ? JSOP_SETGNAME : JSOP_SETNAME, bce)) // N? N+1

         return false;

     if (post && Emit1(cx, bce, JSOP_POP) < 0)       // RESULT

         return false;

     return true;

 }

 /*

  * Emit bytecode to put operands for a JSOP_GETELEM/CALLELEM/SETELEM/DELELEM

  * opcode onto the stack in the right order. In the case of SETELEM, the

  * value to be assigned must already be pushed.

  */

 static bool

 EmitElemOperands(ExclusiveContext *cx, ParseNode *pn, JSOp op, BytecodeEmitter *bce)

 {

     JS_ASSERT(pn->isArity(PN_BINARY));

     if (!EmitTree(cx, bce, pn->pn_left))

         return false;

     if (op == JSOP_CALLELEM && Emit1(cx, bce, JSOP_DUP) < 0)

         return false;

     if (!EmitTree(cx, bce, pn->pn_right))

         return false;

     if (op == JSOP_SETELEM && Emit2(cx, bce, JSOP_PICK, (jsbytecode)2) < 0)

         return false;

     return true;

 }

 static inline bool

 EmitElemOpBase(ExclusiveContext *cx, BytecodeEmitter *bce, JSOp op)

 {

     if (Emit1(cx, bce, op) < 0)

         return false;

     CheckTypeSet(cx, bce, op);

     if (op == JSOP_CALLELEM) {

         if (Emit1(cx, bce, JSOP_SWAP) < 0)

             return false;

     }

     return true;

 }

 static bool

 EmitElemOp(ExclusiveContext *cx, ParseNode *pn, JSOp op, BytecodeEmitter *bce)

 {

     return EmitElemOperands(cx, pn, op, bce) && EmitElemOpBase(cx, bce, op);

 }

 static bool

 EmitElemIncDec(ExclusiveContext *cx, ParseNode *pn, BytecodeEmitter *bce)

 {

     JS_ASSERT(pn->pn_kid->getKind() == PNK_ELEM);

     if (!EmitElemOperands(cx, pn->pn_kid, JSOP_GETELEM, bce))

         return false;

     bool post;

     JSOp binop = GetIncDecInfo(pn->getKind(), &post);

     /*

      * We need to convert the key to an object id first, so that we do not do

      * it inside both the GETELEM and the SETELEM.

      */

                                                     // OBJ KEY*

     if (Emit1(cx, bce, JSOP_TOID) < 0)              // OBJ KEY

         return false;

     if (Emit1(cx, bce, JSOP_DUP2) < 0)              // OBJ KEY OBJ KEY

         return false;

     if (!EmitElemOpBase(cx, bce, JSOP_GETELEM))     // OBJ KEY V

         return false;

     if (Emit1(cx, bce, JSOP_POS) < 0)               // OBJ KEY N

         return false;

     if (post && Emit1(cx, bce, JSOP_DUP) < 0)       // OBJ KEY N? N

         return false;

     if (Emit1(cx, bce, JSOP_ONE) < 0)               // OBJ KEY N? N 1

         return false;

     if (Emit1(cx, bce, binop) < 0)                  // OBJ KEY N? N+1

         return false;

     if (post) {

         if (Emit2(cx, bce, JSOP_PICK, (jsbytecode)3) < 0)   // KEY N N+1 OBJ

             return false;

         if (Emit2(cx, bce, JSOP_PICK, (jsbytecode)3) < 0)   // N N+1 OBJ KEY

             return false;

         if (Emit2(cx, bce, JSOP_PICK, (jsbytecode)2) < 0)   // N OBJ KEY N+1

             return false;

     }

     if (!EmitElemOpBase(cx, bce, JSOP_SETELEM))     // N? N+1

         return false;

     if (post && Emit1(cx, bce, JSOP_POP) < 0)       // RESULT

         return false;

     return true;

 }

 static bool

 EmitNumberOp(ExclusiveContext *cx, double dval, BytecodeEmitter *bce)

 {

     int32_t ival;

     uint32_t u;

     ptrdiff_t off;

     jsbytecode *pc;

     if (NumberIsInt32(dval, &ival)) {

         if (ival == 0)

             return Emit1(cx, bce, JSOP_ZERO) >= 0;

         if (ival == 1)

             return Emit1(cx, bce, JSOP_ONE) >= 0;

         if ((int)(int8_t)ival == ival)

             return Emit2(cx, bce, JSOP_INT8, (jsbytecode)(int8_t)ival) >= 0;

         u = (uint32_t)ival;

         if (u < JS_BIT(16)) {

             EMIT_UINT16_IMM_OP(JSOP_UINT16, u);

         } else if (u < JS_BIT(24)) {

             off = EmitN(cx, bce, JSOP_UINT24, 3);

             if (off < 0)

                 return false;

             pc = bce->code(off);

             SET_UINT24(pc, u);

         } else {

             off = EmitN(cx, bce, JSOP_INT32, 4);

             if (off < 0)

                 return false;

             pc = bce->code(off);

             SET_INT32(pc, ival);

         }

         return true;

     }

     if (!bce->constList.append(DoubleValue(dval)))

         return false;

     return EmitIndex32(cx, JSOP_DOUBLE, bce->constList.length() - 1, bce);

 }

 static inline void

 SetJumpOffsetAt(BytecodeEmitter *bce, ptrdiff_t off)

 {

     SET_JUMP_OFFSET(bce->code(off), bce->offset() - off);

 }

 static bool

 PushUndefinedValues(ExclusiveContext *cx, BytecodeEmitter *bce, unsigned n)

 {

     for (unsigned i = 0; i < n; ++i) {

         if (Emit1(cx, bce, JSOP_UNDEFINED) < 0)

             return false;

     }

     return true;

 }

 static bool

 InitializeBlockScopedLocalsFromStack(ExclusiveContext *cx, BytecodeEmitter *bce,

                                      Handle<StaticBlockObject *> blockObj)

 {

     for (unsigned i = blockObj->numVariables(); i > 0; --i) {

         if (blockObj->isAliased(i - 1)) {

             ScopeCoordinate sc;

             sc.setHops(0);

             sc.setSlot(BlockObject::RESERVED_SLOTS + i - 1);

             if (!EmitAliasedVarOp(cx, JSOP_SETALIASEDVAR, sc, bce))

                 return false;

         } else {

             unsigned local = blockObj->blockIndexToLocalIndex(i - 1);

             if (!EmitUnaliasedVarOp(cx, JSOP_SETLOCAL, local, bce))

                 return false;

         }

         if (Emit1(cx, bce, JSOP_POP) < 0)

             return false;

     }

     return true;

 }

 static bool

 EnterBlockScope(ExclusiveContext *cx, BytecodeEmitter *bce, StmtInfoBCE *stmtInfo,

                 ObjectBox *objbox, unsigned alreadyPushed = 0)

 {

     // Initial values for block-scoped locals.

     Rooted<StaticBlockObject *> blockObj(cx, &objbox->object->as<StaticBlockObject>());

     if (!PushUndefinedValues(cx, bce, blockObj->numVariables() - alreadyPushed))

         return false;

     if (!EnterNestedScope(cx, bce, stmtInfo, objbox, STMT_BLOCK))

         return false;

     if (!InitializeBlockScopedLocalsFromStack(cx, bce, blockObj))

         return false;

     return true;

 }

 /*

  * Using MOZ_NEVER_INLINE in here is a workaround for llvm.org/pr14047.

  * LLVM is deciding to inline this function which uses a lot of stack space

  * into EmitTree which is recursive and uses relatively little stack space.

  */

 MOZ_NEVER_INLINE static bool

 EmitSwitch(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)

 {

     JSOp switchOp;

     bool hasDefault;

     ptrdiff_t top, off, defaultOffset;

     ParseNode *pn2, *pn3, *pn4;

     int32_t low, high;

     int noteIndex;

     size_t switchSize;

     jsbytecode *pc;

     /* Try for most optimal, fall back if not dense ints. */

     switchOp = JSOP_TABLESWITCH;

     hasDefault = false;

     defaultOffset = -1;

     pn2 = pn->pn_right;

     JS_ASSERT(pn2->isKind(PNK_LEXICALSCOPE) || pn2->isKind(PNK_STATEMENTLIST));

     /* Push the discriminant. */

     if (!EmitTree(cx, bce, pn->pn_left))

         return false;

     StmtInfoBCE stmtInfo(cx);

     if (pn2->isKind(PNK_LEXICALSCOPE)) {

         if (!EnterBlockScope(cx, bce, &stmtInfo, pn2->pn_objbox, 0))

             return false;

         stmtInfo.type = STMT_SWITCH;

         stmtInfo.update = top = bce->offset();

         /* Advance pn2 to refer to the switch case list. */

         pn2 = pn2->expr();

     } else {

         JS_ASSERT(pn2->isKind(PNK_STATEMENTLIST));

         top = bce->offset();

         PushStatementBCE(bce, &stmtInfo, STMT_SWITCH, top);

     }

     /* Switch bytecodes run from here till end of final case. */

     uint32_t caseCount = pn2->pn_count;

     uint32_t tableLength = 0;

     ScopedJSFreePtr<ParseNode*> table(nullptr);

     if (caseCount > JS_BIT(16)) {

         bce->parser->tokenStream.reportError(JSMSG_TOO_MANY_CASES);

         return false;

     }

     if (caseCount == 0 ||

         (caseCount == 1 &&

          (hasDefault = (pn2->pn_head->isKind(PNK_DEFAULT))))) {

         caseCount = 0;

         low = 0;

         high = -1;

     } else {

         bool ok = true;

 #define INTMAP_LENGTH   256

         jsbitmap intmap_space[INTMAP_LENGTH];

         jsbitmap *intmap = nullptr;

         int32_t intmap_bitlen = 0;

         low  = JSVAL_INT_MAX;

         high = JSVAL_INT_MIN;

         for (pn3 = pn2->pn_head; pn3; pn3 = pn3->pn_next) {

             if (pn3->isKind(PNK_DEFAULT)) {

                 hasDefault = true;

                 caseCount--;    /* one of the "cases" was the default */

                 continue;

             }

             JS_ASSERT(pn3->isKind(PNK_CASE));

             if (switchOp == JSOP_CONDSWITCH)

                 continue;

             JS_ASSERT(switchOp == JSOP_TABLESWITCH);

             pn4 = pn3->pn_left;

             if (pn4->getKind() != PNK_NUMBER) {

                 switchOp = JSOP_CONDSWITCH;

                 continue;

             }

             int32_t i;

             if (!NumberIsInt32(pn4->pn_dval, &i)) {

                 switchOp = JSOP_CONDSWITCH;

                 continue;

             }

             if ((unsigned)(i + (int)JS_BIT(15)) >= (unsigned)JS_BIT(16)) {

                 switchOp = JSOP_CONDSWITCH;

                 continue;

             }

             if (i < low)

                 low = i;

             if (high < i)

                 high = i;

             /*

              * Check for duplicates, which require a JSOP_CONDSWITCH.

              * We bias i by 65536 if it's negative, and hope that's a rare

              * case (because it requires a malloc'd bitmap).

              */

             if (i < 0)

                 i += JS_BIT(16);

             if (i >= intmap_bitlen) {

                 if (!intmap &&

                     size_t(i) < (INTMAP_LENGTH * JS_BITMAP_NBITS)) {

                     intmap = intmap_space;

                     intmap_bitlen = INTMAP_LENGTH * JS_BITMAP_NBITS;

                 } else {

                     /* Just grab 8K for the worst-case bitmap. */

                     intmap_bitlen = JS_BIT(16);

                     intmap = cx->pod_malloc<jsbitmap>(JS_BIT(16) / JS_BITMAP_NBITS);

                     if (!intmap) {

                         js_ReportOutOfMemory(cx);

                         return false;

                     }

                 }

                 memset(intmap, 0, size_t(intmap_bitlen) / CHAR_BIT);

             }

             if (JS_TEST_BIT(intmap, i)) {

                 switchOp = JSOP_CONDSWITCH;

                 continue;

             }

             JS_SET_BIT(intmap, i);

         }

         if (intmap && intmap != intmap_space)

             js_free(intmap);

         if (!ok)

             return false;

         /*

          * Compute table length and select condswitch instead if overlarge or

          * more than half-sparse.

          */

         if (switchOp == JSOP_TABLESWITCH) {

             tableLength = (uint32_t)(high - low + 1);

             if (tableLength >= JS_BIT(16) || tableLength > 2 * caseCount)

                 switchOp = JSOP_CONDSWITCH;

         }

     }

     /*

      * The note has one or two offsets: first tells total switch code length;