The Tor Browser / file revision

 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-

  * vim: set ts=8 sts=4 et sw=4 tw=99:

  * This Source Code Form is subject to the terms of the Mozilla Public

  * License, v. 2.0. If a copy of the MPL was not distributed with this

  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

 /*

  * JS parser.

  *

  * This is a recursive-descent parser for the JavaScript language specified by

  * "The JavaScript 1.5 Language Specification".  It uses lexical and semantic

  * feedback to disambiguate non-LL(1) structures.  It generates trees of nodes

  * induced by the recursive parsing (not precise syntax trees, see Parser.h).

  * After tree construction, it rewrites trees to fold constants and evaluate

  * compile-time expressions.

  *

  * This parser attempts no error recovery.

  */

 #include "frontend/Parser-inl.h"

 #include "jsapi.h"

 #include "jsatom.h"

 #include "jscntxt.h"

 #include "jsfun.h"

 #include "jsobj.h"

 #include "jsopcode.h"

 #include "jsscript.h"

 #include "jstypes.h"

 #include "frontend/BytecodeCompiler.h"

 #include "frontend/FoldConstants.h"

 #include "frontend/ParseMaps.h"

 #include "frontend/TokenStream.h"

 #include "jit/AsmJS.h"

 #include "vm/Shape.h"

 #include "jsatominlines.h"

 #include "jsscriptinlines.h"

 #include "frontend/ParseNode-inl.h"

 using namespace js;

 using namespace js::gc;

 using mozilla::Maybe;

 namespace js {

 namespace frontend {

 typedef Rooted<StaticBlockObject*> RootedStaticBlockObject;

 typedef Handle<StaticBlockObject*> HandleStaticBlockObject;

 typedef Rooted<NestedScopeObject*> RootedNestedScopeObject;

 typedef Handle<NestedScopeObject*> HandleNestedScopeObject;

 /*

  * Insist that the next token be of type tt, or report errno and return null.

  * NB: this macro uses cx and ts from its lexical environment.

  */

 #define MUST_MATCH_TOKEN(tt, errno)                                                         \

     JS_BEGIN_MACRO                                                                          \

         if (tokenStream.getToken() != tt) {                                                 \

             report(ParseError, false, null(), errno);                                       \

             return null();                                                                  \

         }                                                                                   \

     JS_END_MACRO

 static const unsigned BlockIdLimit = 1 << ParseNode::NumBlockIdBits;

 template <typename ParseHandler>

 bool

 GenerateBlockId(TokenStream &ts, ParseContext<ParseHandler> *pc, uint32_t &blockid)

 {

     if (pc->blockidGen == BlockIdLimit) {

         ts.reportError(JSMSG_NEED_DIET, "program");

         return false;

     }

     JS_ASSERT(pc->blockidGen < BlockIdLimit);

     blockid = pc->blockidGen++;

     return true;

 }

 template bool

 GenerateBlockId(TokenStream &ts, ParseContext<SyntaxParseHandler> *pc, uint32_t &blockid);

 template bool

 GenerateBlockId(TokenStream &ts, ParseContext<FullParseHandler> *pc, uint32_t &blockid);

 template <typename ParseHandler>

 static void

 PushStatementPC(ParseContext<ParseHandler> *pc, StmtInfoPC *stmt, StmtType type)

 {

     stmt->blockid = pc->blockid();

     PushStatement(pc, stmt, type);

 }

 // See comment on member function declaration.

 template <>

 bool

 ParseContext<FullParseHandler>::define(TokenStream &ts,

                                        HandlePropertyName name, ParseNode *pn, Definition::Kind kind)

 {

     JS_ASSERT(!pn->isUsed());

     JS_ASSERT_IF(pn->isDefn(), pn->isPlaceholder());

     Definition *prevDef = nullptr;

     if (kind == Definition::LET)

         prevDef = decls_.lookupFirst(name);

     else

         JS_ASSERT(!decls_.lookupFirst(name));

     if (!prevDef)

         prevDef = lexdeps.lookupDefn<FullParseHandler>(name);

     if (prevDef) {

         ParseNode **pnup = &prevDef->dn_uses;

         ParseNode *pnu;

         unsigned start = (kind == Definition::LET) ? pn->pn_blockid : bodyid;

         while ((pnu = *pnup) != nullptr && pnu->pn_blockid >= start) {

             JS_ASSERT(pnu->pn_blockid >= bodyid);

             JS_ASSERT(pnu->isUsed());

             pnu->pn_lexdef = (Definition *) pn;

             pn->pn_dflags |= pnu->pn_dflags & PND_USE2DEF_FLAGS;

             pnup = &pnu->pn_link;

         }

         if (!pnu || pnu != prevDef->dn_uses) {

             *pnup = pn->dn_uses;

             pn->dn_uses = prevDef->dn_uses;

             prevDef->dn_uses = pnu;

             if (!pnu && prevDef->isPlaceholder())

                 lexdeps->remove(name);

         }

         pn->pn_dflags |= prevDef->pn_dflags & PND_CLOSED;

     }

     JS_ASSERT_IF(kind != Definition::LET, !lexdeps->lookup(name));

     pn->setDefn(true);

     pn->pn_dflags &= ~PND_PLACEHOLDER;

     if (kind == Definition::CONST)

         pn->pn_dflags |= PND_CONST;

     Definition *dn = (Definition *)pn;

     switch (kind) {

       case Definition::ARG:

         JS_ASSERT(sc->isFunctionBox());

         dn->setOp(JSOP_GETARG);

         dn->pn_dflags |= PND_BOUND;

         if (!dn->pn_cookie.set(ts, staticLevel, args_.length()))

             return false;

         if (!args_.append(dn))

             return false;

         if (args_.length() >= ARGNO_LIMIT) {

             ts.reportError(JSMSG_TOO_MANY_FUN_ARGS);

             return false;

         }

         if (name == ts.names().empty)

             break;

         if (!decls_.addUnique(name, dn))

             return false;

         break;

       case Definition::CONST:

       case Definition::VAR:

         if (sc->isFunctionBox()) {

             dn->setOp(JSOP_GETLOCAL);

             dn->pn_dflags |= PND_BOUND;

             if (!dn->pn_cookie.set(ts, staticLevel, vars_.length()))

                 return false;

             if (!vars_.append(dn))

                 return false;

             if (vars_.length() >= LOCALNO_LIMIT) {

                 ts.reportError(JSMSG_TOO_MANY_LOCALS);

                 return false;

             }

         }

         if (!decls_.addUnique(name, dn))

             return false;

         break;

       case Definition::LET:

         dn->setOp(JSOP_GETLOCAL);

         dn->pn_dflags |= (PND_LET | PND_BOUND);

         JS_ASSERT(dn->pn_cookie.level() == staticLevel); /* see bindLet */

         if (!decls_.addShadow(name, dn))

             return false;

         break;

       default:

         MOZ_ASSUME_UNREACHABLE("unexpected kind");

     }

     return true;

 }

 template <>

 bool

 ParseContext<SyntaxParseHandler>::define(TokenStream &ts, HandlePropertyName name, Node pn,

                                          Definition::Kind kind)

 {

     JS_ASSERT(!decls_.lookupFirst(name));

     if (lexdeps.lookupDefn<SyntaxParseHandler>(name))

         lexdeps->remove(name);

     // Keep track of the number of arguments in args_, for fun->nargs.

     if (kind == Definition::ARG) {

         if (!args_.append((Definition *) nullptr))

             return false;

         if (args_.length() >= ARGNO_LIMIT) {

             ts.reportError(JSMSG_TOO_MANY_FUN_ARGS);

             return false;

         }

     }

     return decls_.addUnique(name, kind);

 }

 template <typename ParseHandler>

 void

 ParseContext<ParseHandler>::prepareToAddDuplicateArg(HandlePropertyName name, DefinitionNode prevDecl)

 {

     JS_ASSERT(decls_.lookupFirst(name) == prevDecl);

     decls_.remove(name);

 }

 template <typename ParseHandler>

 void

 ParseContext<ParseHandler>::updateDecl(JSAtom *atom, Node pn)

 {

     Definition *oldDecl = decls_.lookupFirst(atom);

     pn->setDefn(true);

     Definition *newDecl = (Definition *)pn;

     decls_.updateFirst(atom, newDecl);

     if (!sc->isFunctionBox()) {

         JS_ASSERT(newDecl->isFreeVar());

         return;

     }

     JS_ASSERT(oldDecl->isBound());

     JS_ASSERT(!oldDecl->pn_cookie.isFree());

     newDecl->pn_cookie = oldDecl->pn_cookie;

     newDecl->pn_dflags |= PND_BOUND;

     if (IsArgOp(oldDecl->getOp())) {

         newDecl->setOp(JSOP_GETARG);

         JS_ASSERT(args_[oldDecl->pn_cookie.slot()] == oldDecl);

         args_[oldDecl->pn_cookie.slot()] = newDecl;

     } else {

         JS_ASSERT(IsLocalOp(oldDecl->getOp()));

         newDecl->setOp(JSOP_GETLOCAL);

         JS_ASSERT(vars_[oldDecl->pn_cookie.slot()] == oldDecl);

         vars_[oldDecl->pn_cookie.slot()] = newDecl;

     }

 }

 template <typename ParseHandler>

 void

 ParseContext<ParseHandler>::popLetDecl(JSAtom *atom)

 {

     JS_ASSERT(ParseHandler::getDefinitionKind(decls_.lookupFirst(atom)) == Definition::LET);

     decls_.remove(atom);

 }

 template <typename ParseHandler>

 static void

 AppendPackedBindings(const ParseContext<ParseHandler> *pc, const DeclVector &vec, Binding *dst)

 {

     for (size_t i = 0; i < vec.length(); ++i, ++dst) {

         Definition *dn = vec[i];

         PropertyName *name = dn->name();

         Binding::Kind kind;

         switch (dn->kind()) {

           case Definition::VAR:

             kind = Binding::VARIABLE;

             break;

           case Definition::CONST:

             kind = Binding::CONSTANT;

             break;

           case Definition::ARG:

             kind = Binding::ARGUMENT;

             break;

           default:

             MOZ_ASSUME_UNREACHABLE("unexpected dn->kind");

         }

         /*

          * Bindings::init does not check for duplicates so we must ensure that

          * only one binding with a given name is marked aliased. pc->decls

          * maintains the canonical definition for each name, so use that.

          */

         JS_ASSERT_IF(dn->isClosed(), pc->decls().lookupFirst(name) == dn);

         bool aliased = dn->isClosed() ||

                        (pc->sc->allLocalsAliased() &&

                         pc->decls().lookupFirst(name) == dn);

         *dst = Binding(name, kind, aliased);

     }

 }

 template <typename ParseHandler>

 bool

 ParseContext<ParseHandler>::generateFunctionBindings(ExclusiveContext *cx, TokenStream &ts,

                                                      LifoAlloc &alloc,

                                                      InternalHandle<Bindings*> bindings) const

 {

     JS_ASSERT(sc->isFunctionBox());

     JS_ASSERT(args_.length() < ARGNO_LIMIT);

     JS_ASSERT(vars_.length() < LOCALNO_LIMIT);

     /*

      * Avoid pathological edge cases by explicitly limiting the total number of

      * bindings to what will fit in a uint32_t.

      */

     if (UINT32_MAX - args_.length() <= vars_.length())

         return ts.reportError(JSMSG_TOO_MANY_LOCALS);

     uint32_t count = args_.length() + vars_.length();

     Binding *packedBindings = alloc.newArrayUninitialized<Binding>(count);

     if (!packedBindings) {

         js_ReportOutOfMemory(cx);

         return false;

     }

     AppendPackedBindings(this, args_, packedBindings);

     AppendPackedBindings(this, vars_, packedBindings + args_.length());

     return Bindings::initWithTemporaryStorage(cx, bindings, args_.length(), vars_.length(),

                                               packedBindings, blockScopeDepth);

 }

 template <typename ParseHandler>

 bool

 Parser<ParseHandler>::reportHelper(ParseReportKind kind, bool strict, uint32_t offset,

                                    unsigned errorNumber, va_list args)

 {

     bool result = false;

     switch (kind) {

       case ParseError:

         result = tokenStream.reportCompileErrorNumberVA(offset, JSREPORT_ERROR, errorNumber, args);

         break;

       case ParseWarning:

         result =

             tokenStream.reportCompileErrorNumberVA(offset, JSREPORT_WARNING, errorNumber, args);

         break;

       case ParseExtraWarning:

         result = tokenStream.reportStrictWarningErrorNumberVA(offset, errorNumber, args);

         break;

       case ParseStrictError:

         result = tokenStream.reportStrictModeErrorNumberVA(offset, strict, errorNumber, args);

         break;

     }

     return result;

 }

 template <typename ParseHandler>

 bool

 Parser<ParseHandler>::report(ParseReportKind kind, bool strict, Node pn, unsigned errorNumber, ...)

 {

     uint32_t offset = (pn ? handler.getPosition(pn) : pos()).begin;

     va_list args;

     va_start(args, errorNumber);

     bool result = reportHelper(kind, strict, offset, errorNumber, args);

     va_end(args);

     return result;

 }

 template <typename ParseHandler>

 bool

 Parser<ParseHandler>::reportNoOffset(ParseReportKind kind, bool strict, unsigned errorNumber, ...)

 {

     va_list args;

     va_start(args, errorNumber);

     bool result = reportHelper(kind, strict, TokenStream::NoOffset, errorNumber, args);

     va_end(args);

     return result;

 }

 template <typename ParseHandler>

 bool

 Parser<ParseHandler>::reportWithOffset(ParseReportKind kind, bool strict, uint32_t offset,

                                        unsigned errorNumber, ...)

 {

     va_list args;

     va_start(args, errorNumber);

     bool result = reportHelper(kind, strict, offset, errorNumber, args);

     va_end(args);

     return result;

 }

 template <>

 bool

 Parser<FullParseHandler>::abortIfSyntaxParser()

 {

     handler.disableSyntaxParser();

     return true;

 }

 template <>

 bool

 Parser<SyntaxParseHandler>::abortIfSyntaxParser()

 {

     abortedSyntaxParse = true;

     return false;

 }

 template <typename ParseHandler>

 Parser<ParseHandler>::Parser(ExclusiveContext *cx, LifoAlloc *alloc,

                              const ReadOnlyCompileOptions &options,

                              const jschar *chars, size_t length, bool foldConstants,

                              Parser<SyntaxParseHandler> *syntaxParser,

                              LazyScript *lazyOuterFunction)

   : AutoGCRooter(cx, PARSER),

     context(cx),

     alloc(*alloc),

     tokenStream(cx, options, chars, length, thisForCtor()),

     traceListHead(nullptr),

     pc(nullptr),

     sct(nullptr),

     ss(nullptr),

     keepAtoms(cx->perThreadData),

     foldConstants(foldConstants),

     abortedSyntaxParse(false),

     isUnexpectedEOF_(false),

     handler(cx, *alloc, tokenStream, foldConstants, syntaxParser, lazyOuterFunction)

 {

     {

         AutoLockForExclusiveAccess lock(cx);

         cx->perThreadData->addActiveCompilation();

     }

     // The Mozilla specific JSOPTION_EXTRA_WARNINGS option adds extra warnings

     // which are not generated if functions are parsed lazily. Note that the

     // standard "use strict" does not inhibit lazy parsing.

     if (options.extraWarningsOption)

         handler.disableSyntaxParser();

     tempPoolMark = alloc->mark();

 }

 template <typename ParseHandler>

 Parser<ParseHandler>::~Parser()

 {

     alloc.release(tempPoolMark);

     /*

      * The parser can allocate enormous amounts of memory for large functions.

      * Eagerly free the memory now (which otherwise won't be freed until the

      * next GC) to avoid unnecessary OOMs.

      */

     alloc.freeAllIfHugeAndUnused();

     {

         AutoLockForExclusiveAccess lock(context);

         context->perThreadData->removeActiveCompilation();

     }

 }

 template <typename ParseHandler>

 ObjectBox *

 Parser<ParseHandler>::newObjectBox(JSObject *obj)

 {

     JS_ASSERT(obj && !IsPoisonedPtr(obj));

     /*

      * We use JSContext.tempLifoAlloc to allocate parsed objects and place them

      * on a list in this Parser to ensure GC safety. Thus the tempLifoAlloc

      * arenas containing the entries must be alive until we are done with

      * scanning, parsing and code generation for the whole script or top-level

      * function.

      */

     ObjectBox *objbox = alloc.new_<ObjectBox>(obj, traceListHead);

     if (!objbox) {

         js_ReportOutOfMemory(context);

         return nullptr;

     }

     traceListHead = objbox;

     return objbox;

 }

 template <typename ParseHandler>

 FunctionBox::FunctionBox(ExclusiveContext *cx, ObjectBox* traceListHead, JSFunction *fun,

                          ParseContext<ParseHandler> *outerpc, Directives directives,

                          bool extraWarnings, GeneratorKind generatorKind)

   : ObjectBox(fun, traceListHead),

     SharedContext(cx, directives, extraWarnings),

     bindings(),

     bufStart(0),

     bufEnd(0),

     length(0),

     generatorKindBits_(GeneratorKindAsBits(generatorKind)),

     inWith(false),                  // initialized below

     inGenexpLambda(false),

     hasDestructuringArgs(false),

     useAsm(directives.asmJS()),

     insideUseAsm(outerpc && outerpc->useAsmOrInsideUseAsm()),

     usesArguments(false),

     usesApply(false),

     funCxFlags()

 {

     // Functions created at parse time may be set singleton after parsing and

     // baked into JIT code, so they must be allocated tenured. They are held by

     // the JSScript so cannot be collected during a minor GC anyway.

     JS_ASSERT(fun->isTenured());

     if (!outerpc) {

         inWith = false;

     } else if (outerpc->parsingWith) {

         // This covers cases that don't involve eval().  For example:

         //

         //   with (o) { (function() { g(); })(); }

         //

         // In this case, |outerpc| corresponds to global code, and

         // outerpc->parsingWith is true.

         inWith = true;

     } else if (outerpc->sc->isGlobalSharedContext()) {

         // This covers the case where a function is nested within an eval()

         // within a |with| statement.

         //

         //   with (o) { eval("(function() { g(); })();"); }

         //

         // In this case, |outerpc| corresponds to the eval(),

         // outerpc->parsingWith is false because the eval() breaks the

         // ParseContext chain, and |parent| is nullptr (again because of the

         // eval(), so we have to look at |outerpc|'s scopeChain.

         //

         JSObject *scope = outerpc->sc->asGlobalSharedContext()->scopeChain();

         while (scope) {

             if (scope->is<DynamicWithObject>())

                 inWith = true;

             scope = scope->enclosingScope();

         }

     } else if (outerpc->sc->isFunctionBox()) {

         // This is like the above case, but for more deeply nested functions.

         // For example:

         //

         //   with (o) { eval("(function() { (function() { g(); })(); })();"); } }

         //

         // In this case, the inner anonymous function needs to inherit the

         // setting of |inWith| from the outer one.

         FunctionBox *parent = outerpc->sc->asFunctionBox();

         if (parent && parent->inWith)

             inWith = true;

     }

 }

 template <typename ParseHandler>

 FunctionBox *

 Parser<ParseHandler>::newFunctionBox(Node fn, JSFunction *fun, ParseContext<ParseHandler> *outerpc,

                                      Directives inheritedDirectives, GeneratorKind generatorKind)

 {

     JS_ASSERT(fun && !IsPoisonedPtr(fun));

     /*

      * We use JSContext.tempLifoAlloc to allocate parsed objects and place them

      * on a list in this Parser to ensure GC safety. Thus the tempLifoAlloc

      * arenas containing the entries must be alive until we are done with

      * scanning, parsing and code generation for the whole script or top-level

      * function.

      */

     FunctionBox *funbox =

         alloc.new_<FunctionBox>(context, traceListHead, fun, outerpc,

                                 inheritedDirectives, options().extraWarningsOption,

                                 generatorKind);

     if (!funbox) {

         js_ReportOutOfMemory(context);

         return nullptr;

     }

     traceListHead = funbox;

     if (fn)

         handler.setFunctionBox(fn, funbox);

     return funbox;

 }

 template <typename ParseHandler>

 void

 Parser<ParseHandler>::trace(JSTracer *trc)

 {

     traceListHead->trace(trc);

 }

 void

 MarkParser(JSTracer *trc, AutoGCRooter *parser)

 {

     static_cast<Parser<FullParseHandler> *>(parser)->trace(trc);

 }

 /*

  * Parse a top-level JS script.

  */

 template <typename ParseHandler>

 typename ParseHandler::Node

 Parser<ParseHandler>::parse(JSObject *chain)

 {

     /*

      * Protect atoms from being collected by a GC activation, which might

      * - nest on this thread due to out of memory (the so-called "last ditch"

      *   GC attempted within js_NewGCThing), or

      * - run for any reason on another thread if this thread is suspended on

      *   an object lock before it finishes generating bytecode into a script

      *   protected from the GC by a root or a stack frame reference.

      */

     Directives directives(options().strictOption);

     GlobalSharedContext globalsc(context, chain, directives, options().extraWarningsOption);

     ParseContext<ParseHandler> globalpc(this, /* parent = */ nullptr, ParseHandler::null(),

                                         &globalsc, /* newDirectives = */ nullptr,

                                         /* staticLevel = */ 0, /* bodyid = */ 0,

                                         /* blockScopeDepth = */ 0);

     if (!globalpc.init(tokenStream))

         return null();

     Node pn = statements();

     if (pn) {

         if (!tokenStream.matchToken(TOK_EOF)) {

             report(ParseError, false, null(), JSMSG_SYNTAX_ERROR);

             return null();

         }

         if (foldConstants) {

             if (!FoldConstants(context, &pn, this))

                 return null();

         }

     }

     return pn;

 }

 /*

  * Insist on a final return before control flows out of pn.  Try to be a bit

  * smart about loops: do {...; return e2;} while(0) at the end of a function

  * that contains an early return e1 will get a strict warning.  Similarly for

  * iloops: while (true){...} is treated as though ... returns.

  */

 enum {

     ENDS_IN_OTHER = 0,

     ENDS_IN_RETURN = 1,

     ENDS_IN_BREAK = 2

 };

 static int

 HasFinalReturn(ParseNode *pn)

 {

     ParseNode *pn2, *pn3;

     unsigned rv, rv2, hasDefault;

     switch (pn->getKind()) {

       case PNK_STATEMENTLIST:

         if (!pn->pn_head)

             return ENDS_IN_OTHER;

         return HasFinalReturn(pn->last());

       case PNK_IF:

         if (!pn->pn_kid3)

             return ENDS_IN_OTHER;

         return HasFinalReturn(pn->pn_kid2) & HasFinalReturn(pn->pn_kid3);

       case PNK_WHILE:

         pn2 = pn->pn_left;

         if (pn2->isKind(PNK_TRUE))

             return ENDS_IN_RETURN;

         if (pn2->isKind(PNK_NUMBER) && pn2->pn_dval)

             return ENDS_IN_RETURN;

         return ENDS_IN_OTHER;

       case PNK_DOWHILE:

         pn2 = pn->pn_right;

         if (pn2->isKind(PNK_FALSE))

             return HasFinalReturn(pn->pn_left);

         if (pn2->isKind(PNK_TRUE))

             return ENDS_IN_RETURN;

         if (pn2->isKind(PNK_NUMBER)) {

             if (pn2->pn_dval == 0)

                 return HasFinalReturn(pn->pn_left);

             return ENDS_IN_RETURN;

         }

         return ENDS_IN_OTHER;

       case PNK_FOR:

         pn2 = pn->pn_left;

         if (pn2->isArity(PN_TERNARY) && !pn2->pn_kid2)

             return ENDS_IN_RETURN;

         return ENDS_IN_OTHER;

       case PNK_SWITCH:

         rv = ENDS_IN_RETURN;

         hasDefault = ENDS_IN_OTHER;

         pn2 = pn->pn_right;

         if (pn2->isKind(PNK_LEXICALSCOPE))

             pn2 = pn2->expr();

         for (pn2 = pn2->pn_head; rv && pn2; pn2 = pn2->pn_next) {

             if (pn2->isKind(PNK_DEFAULT))

                 hasDefault = ENDS_IN_RETURN;

             pn3 = pn2->pn_right;

             JS_ASSERT(pn3->isKind(PNK_STATEMENTLIST));

             if (pn3->pn_head) {

                 rv2 = HasFinalReturn(pn3->last());

                 if (rv2 == ENDS_IN_OTHER && pn2->pn_next)

                     /* Falling through to next case or default. */;

                 else

                     rv &= rv2;

             }

         }

         /* If a final switch has no default case, we judge it harshly. */

         rv &= hasDefault;

         return rv;

       case PNK_BREAK:

         return ENDS_IN_BREAK;

       case PNK_WITH:

         return HasFinalReturn(pn->pn_right);

       case PNK_RETURN:

         return ENDS_IN_RETURN;

       case PNK_COLON:

       case PNK_LEXICALSCOPE:

         return HasFinalReturn(pn->expr());

       case PNK_THROW:

         return ENDS_IN_RETURN;

       case PNK_TRY:

         /* If we have a finally block that returns, we are done. */

         if (pn->pn_kid3) {

             rv = HasFinalReturn(pn->pn_kid3);

             if (rv == ENDS_IN_RETURN)

                 return rv;

         }

         /* Else check the try block and any and all catch statements. */

         rv = HasFinalReturn(pn->pn_kid1);

         if (pn->pn_kid2) {

             JS_ASSERT(pn->pn_kid2->isArity(PN_LIST));

             for (pn2 = pn->pn_kid2->pn_head; pn2; pn2 = pn2->pn_next)

                 rv &= HasFinalReturn(pn2);

         }

         return rv;

       case PNK_CATCH:

         /* Check this catch block's body. */

         return HasFinalReturn(pn->pn_kid3);

       case PNK_LET:

         /* Non-binary let statements are let declarations. */

         if (!pn->isArity(PN_BINARY))

             return ENDS_IN_OTHER;

         return HasFinalReturn(pn->pn_right);

       default:

         return ENDS_IN_OTHER;

     }

 }

 static int

 HasFinalReturn(SyntaxParseHandler::Node pn)

 {

     return ENDS_IN_RETURN;

 }

 template <typename ParseHandler>

 bool

 Parser<ParseHandler>::reportBadReturn(Node pn, ParseReportKind kind,

                                       unsigned errnum, unsigned anonerrnum)

 {

     JSAutoByteString name;

     JSAtom *atom = pc->sc->asFunctionBox()->function()->atom();

     if (atom) {

         if (!AtomToPrintableString(context, atom, &name))

             return false;

     } else {

         errnum = anonerrnum;

     }

     return report(kind, pc->sc->strict, pn, errnum, name.ptr());

 }

 template <typename ParseHandler>

 bool

 Parser<ParseHandler>::checkFinalReturn(Node pn)

 {

     JS_ASSERT(pc->sc->isFunctionBox());

     return HasFinalReturn(pn) == ENDS_IN_RETURN ||

            reportBadReturn(pn, ParseExtraWarning,

                            JSMSG_NO_RETURN_VALUE, JSMSG_ANON_NO_RETURN_VALUE);

 }

 /*

  * Check that assigning to lhs is permitted.  Assigning to 'eval' or

  * 'arguments' is banned in strict mode and in destructuring assignment.

  */

 template <typename ParseHandler>

 bool

 Parser<ParseHandler>::checkStrictAssignment(Node lhs, AssignmentFlavor flavor)

 {

     if (!pc->sc->needStrictChecks() && flavor != KeyedDestructuringAssignment)

         return true;

     JSAtom *atom = handler.isName(lhs);

     if (!atom)

         return true;

     if (atom == context->names().eval || atom == context->names().arguments) {

         JSAutoByteString name;

         if (!AtomToPrintableString(context, atom, &name))

             return false;

         ParseReportKind kind;

         unsigned errnum;

         if (pc->sc->strict || flavor != KeyedDestructuringAssignment) {

             kind = ParseStrictError;

             errnum = JSMSG_BAD_STRICT_ASSIGN;

         } else {

             kind = ParseError;

             errnum = JSMSG_BAD_DESTRUCT_ASSIGN;

         }

         if (!report(kind, pc->sc->strict, lhs, errnum, name.ptr()))

             return false;

     }

     return true;

 }

 /*

  * Check that it is permitted to introduce a binding for atom.  Strict mode

  * forbids introducing new definitions for 'eval', 'arguments', or for any

  * strict mode reserved keyword.  Use pn for reporting error locations, or use

  * pc's token stream if pn is nullptr.

  */

 template <typename ParseHandler>

 bool

 Parser<ParseHandler>::checkStrictBinding(PropertyName *name, Node pn)

 {

     if (!pc->sc->needStrictChecks())

         return true;

     if (name == context->names().eval || name == context->names().arguments || IsKeyword(name)) {

         JSAutoByteString bytes;

         if (!AtomToPrintableString(context, name, &bytes))

             return false;

         return report(ParseStrictError, pc->sc->strict, pn,

                       JSMSG_BAD_BINDING, bytes.ptr());

     }

     return true;

 }

 template <>

 ParseNode *

 Parser<FullParseHandler>::standaloneFunctionBody(HandleFunction fun, const AutoNameVector &formals,

                                                  GeneratorKind generatorKind,

                                                  Directives inheritedDirectives,

                                                  Directives *newDirectives)

 {

     Node fn = handler.newFunctionDefinition();

     if (!fn)

         return null();

     ParseNode *argsbody = ListNode::create(PNK_ARGSBODY, &handler);

     if (!argsbody)

         return null();

     argsbody->setOp(JSOP_NOP);

     argsbody->makeEmpty();

     fn->pn_body = argsbody;

     FunctionBox *funbox = newFunctionBox(fn, fun, /* outerpc = */ nullptr, inheritedDirectives,

                                          generatorKind);

     if (!funbox)

         return null();

     funbox->length = fun->nargs() - fun->hasRest();

     handler.setFunctionBox(fn, funbox);

     ParseContext<FullParseHandler> funpc(this, pc, fn, funbox, newDirectives,

                                          /* staticLevel = */ 0, /* bodyid = */ 0,

                                          /* blockScopeDepth = */ 0);

     if (!funpc.init(tokenStream))

         return null();

     for (unsigned i = 0; i < formals.length(); i++) {

         if (!defineArg(fn, formals[i]))

             return null();

     }

     ParseNode *pn = functionBody(Statement, StatementListBody);

     if (!pn)

         return null();

     if (!tokenStream.matchToken(TOK_EOF)) {

         report(ParseError, false, null(), JSMSG_SYNTAX_ERROR);

         return null();

     }

     if (!FoldConstants(context, &pn, this))

         return null();

     InternalHandle<Bindings*> funboxBindings =

         InternalHandle<Bindings*>::fromMarkedLocation(&funbox->bindings);

     if (!funpc.generateFunctionBindings(context, tokenStream, alloc, funboxBindings))

         return null();

     JS_ASSERT(fn->pn_body->isKind(PNK_ARGSBODY));

     fn->pn_body->append(pn);

     fn->pn_body->pn_pos = pn->pn_pos;

     return fn;

 }

 template <>

 bool

 Parser<FullParseHandler>::checkFunctionArguments()

 {

     /*

      * Non-top-level functions use JSOP_DEFFUN which is a dynamic scope

      * operation which means it aliases any bindings with the same name.

      */

     if (FuncStmtSet *set = pc->funcStmts) {

         for (FuncStmtSet::Range r = set->all(); !r.empty(); r.popFront()) {

             PropertyName *name = r.front()->asPropertyName();

             if (Definition *dn = pc->decls().lookupFirst(name))

                 dn->pn_dflags |= PND_CLOSED;

         }

     }

     /* Time to implement the odd semantics of 'arguments'. */

     HandlePropertyName arguments = context->names().arguments;

     /*

      * As explained by the ContextFlags::funArgumentsHasLocalBinding comment,

      * create a declaration for 'arguments' if there are any unbound uses in

      * the function body.

      */

     for (AtomDefnRange r = pc->lexdeps->all(); !r.empty(); r.popFront()) {

         if (r.front().key() == arguments) {

             Definition *dn = r.front().value().get<FullParseHandler>();

             pc->lexdeps->remove(arguments);

             dn->pn_dflags |= PND_IMPLICITARGUMENTS;

             if (!pc->define(tokenStream, arguments, dn, Definition::VAR))

                 return false;

             pc->sc->asFunctionBox()->usesArguments = true;

             break;

         }

     }

     /*

      * Report error if both rest parameters and 'arguments' are used. Do this

      * check before adding artificial 'arguments' below.

      */

     Definition *maybeArgDef = pc->decls().lookupFirst(arguments);

     bool argumentsHasBinding = !!maybeArgDef;

     bool argumentsHasLocalBinding = maybeArgDef && maybeArgDef->kind() != Definition::ARG;

     bool hasRest = pc->sc->asFunctionBox()->function()->hasRest();

     if (hasRest && argumentsHasLocalBinding) {

         report(ParseError, false, nullptr, JSMSG_ARGUMENTS_AND_REST);

         return false;

     }

     /*

      * Even if 'arguments' isn't explicitly mentioned, dynamic name lookup

      * forces an 'arguments' binding. The exception is that functions with rest

      * parameters are free from 'arguments'.

      */

     if (!argumentsHasBinding && pc->sc->bindingsAccessedDynamically() && !hasRest) {

         ParseNode *pn = newName(arguments);

         if (!pn)

             return false;

         if (!pc->define(tokenStream, arguments, pn, Definition::VAR))

             return false;

         argumentsHasBinding = true;

         argumentsHasLocalBinding = true;

     }

     /*

      * Now that all possible 'arguments' bindings have been added, note whether

      * 'arguments' has a local binding and whether it unconditionally needs an

      * arguments object. (Also see the flags' comments in ContextFlags.)

      */

     if (argumentsHasLocalBinding) {

         FunctionBox *funbox = pc->sc->asFunctionBox();

         funbox->setArgumentsHasLocalBinding();

         /*

          * If a script has both explicit mentions of 'arguments' and dynamic

          * name lookups which could access the arguments, an arguments object

          * must be created eagerly. The SSA analysis used for lazy arguments

          * cannot cope with dynamic name accesses, so any 'arguments' accessed

          * via a NAME opcode must force construction of the arguments object.

          */

         if (pc->sc->bindingsAccessedDynamically() && maybeArgDef)

             funbox->setDefinitelyNeedsArgsObj();

         /*

          * If a script contains the debugger statement either directly or

          * within an inner function, the arguments object must be created

          * eagerly. The debugger can walk the scope chain and observe any

          * values along it.

          */

         if (pc->sc->hasDebuggerStatement())

             funbox->setDefinitelyNeedsArgsObj();

         /*

          * Check whether any parameters have been assigned within this

          * function. In strict mode parameters do not alias arguments[i], and

          * to make the arguments object reflect initial parameter values prior

          * to any mutation we create it eagerly whenever parameters are (or

          * might, in the case of calls to eval) be assigned.

          */

         if (pc->sc->needStrictChecks()) {

             for (AtomDefnListMap::Range r = pc->decls().all(); !r.empty(); r.popFront()) {

                 DefinitionList &dlist = r.front().value();

                 for (DefinitionList::Range dr = dlist.all(); !dr.empty(); dr.popFront()) {

                     Definition *dn = dr.front<FullParseHandler>();

                     if (dn->kind() == Definition::ARG && dn->isAssigned())

                         funbox->setDefinitelyNeedsArgsObj();

                 }

             }

             /* Watch for mutation of arguments through e.g. eval(). */

             if (pc->sc->bindingsAccessedDynamically())

                 funbox->setDefinitelyNeedsArgsObj();

         }

     }

     return true;

 }

 template <>

 bool

 Parser<SyntaxParseHandler>::checkFunctionArguments()

 {

     bool hasRest = pc->sc->asFunctionBox()->function()->hasRest();

     if (pc->lexdeps->lookup(context->names().arguments)) {

         pc->sc->asFunctionBox()->usesArguments = true;

         if (hasRest) {

             report(ParseError, false, null(), JSMSG_ARGUMENTS_AND_REST);

             return false;

         }

     } else if (hasRest) {

         DefinitionNode maybeArgDef = pc->decls().lookupFirst(context->names().arguments);

         if (maybeArgDef && handler.getDefinitionKind(maybeArgDef) != Definition::ARG) {

             report(ParseError, false, null(), JSMSG_ARGUMENTS_AND_REST);

             return false;

         }

     }

     return true;

 }

 template <typename ParseHandler>

 typename ParseHandler::Node

 Parser<ParseHandler>::functionBody(FunctionSyntaxKind kind, FunctionBodyType type)

 {

     JS_ASSERT(pc->sc->isFunctionBox());

     JS_ASSERT(!pc->funHasReturnExpr && !pc->funHasReturnVoid);

 #ifdef DEBUG

     uint32_t startYieldOffset = pc->lastYieldOffset;

 #endif

     Node pn;

     if (type == StatementListBody) {

         pn = statements();

         if (!pn)

             return null();

     } else {

         JS_ASSERT(type == ExpressionBody);

         JS_ASSERT(JS_HAS_EXPR_CLOSURES);

         Node kid = assignExpr();

         if (!kid)

             return null();

         pn = handler.newReturnStatement(kid, handler.getPosition(kid));

         if (!pn)

             return null();

     }

     switch (pc->generatorKind()) {

       case NotGenerator:

         JS_ASSERT(pc->lastYieldOffset == startYieldOffset);

         break;

       case LegacyGenerator:

         // FIXME: Catch these errors eagerly, in yieldExpression().

         JS_ASSERT(pc->lastYieldOffset != startYieldOffset);

         if (kind == Arrow) {

             reportWithOffset(ParseError, false, pc->lastYieldOffset,

                              JSMSG_YIELD_IN_ARROW, js_yield_str);

             return null();

         }

         if (type == ExpressionBody) {

             reportBadReturn(pn, ParseError,

                             JSMSG_BAD_GENERATOR_RETURN,

                             JSMSG_BAD_ANON_GENERATOR_RETURN);

             return null();

         }

         break;

       case StarGenerator:

         JS_ASSERT(kind != Arrow);

         JS_ASSERT(type == StatementListBody);

         break;

     }

     /* Check for falling off the end of a function that returns a value. */

     if (options().extraWarningsOption && pc->funHasReturnExpr && !checkFinalReturn(pn))

         return null();

     /* Define the 'arguments' binding if necessary. */

     if (!checkFunctionArguments())

         return null();

     return pn;

 }

 /* See comment for use in Parser::functionDef. */

 template <>

 bool

 Parser<FullParseHandler>::makeDefIntoUse(Definition *dn, ParseNode *pn, JSAtom *atom)

 {

     /* Turn pn into a definition. */

     pc->updateDecl(atom, pn);

     /* Change all uses of dn to be uses of pn. */

     for (ParseNode *pnu = dn->dn_uses; pnu; pnu = pnu->pn_link) {

         JS_ASSERT(pnu->isUsed());

         JS_ASSERT(!pnu->isDefn());

         pnu->pn_lexdef = (Definition *) pn;

         pn->pn_dflags |= pnu->pn_dflags & PND_USE2DEF_FLAGS;

     }

     pn->pn_dflags |= dn->pn_dflags & PND_USE2DEF_FLAGS;

     pn->dn_uses = dn;

     /*

      * A PNK_FUNCTION node must be a definition, so convert shadowed function

      * statements into nops. This is valid since all body-level function

      * statement initialization happens at the beginning of the function

      * (thus, only the last statement's effect is visible). E.g., in

      *

      *   function outer() {

      *     function g() { return 1 }

      *     assertEq(g(), 2);

      *     function g() { return 2 }

      *     assertEq(g(), 2);

      *   }

      *

      * both asserts are valid.

      */

     if (dn->getKind() == PNK_FUNCTION) {

         JS_ASSERT(dn->functionIsHoisted());

         pn->dn_uses = dn->pn_link;

         handler.prepareNodeForMutation(dn);

         dn->setKind(PNK_NOP);

         dn->setArity(PN_NULLARY);

         return true;

     }

     /*

      * If dn is arg, or in [var, const, let] and has an initializer, then we

      * must rewrite it to be an assignment node, whose freshly allocated

      * left-hand side becomes a use of pn.

      */

     if (dn->canHaveInitializer()) {

         if (ParseNode *rhs = dn->expr()) {

             ParseNode *lhs = handler.makeAssignment(dn, rhs);

             if (!lhs)

                 return false;

             pn->dn_uses = lhs;

             dn->pn_link = nullptr;

             dn = (Definition *) lhs;

         }

     }

     /* Turn dn into a use of pn. */

     JS_ASSERT(dn->isKind(PNK_NAME));

     JS_ASSERT(dn->isArity(PN_NAME));

     JS_ASSERT(dn->pn_atom == atom);

     dn->setOp((js_CodeSpec[dn->getOp()].format & JOF_SET) ? JSOP_SETNAME : JSOP_NAME);

     dn->setDefn(false);

     dn->setUsed(true);

     dn->pn_lexdef = (Definition *) pn;

     dn->pn_cookie.makeFree();

     dn->pn_dflags &= ~PND_BOUND;

     return true;

 }

 /*

  * Parameter block types for the several Binder functions.  We use a common

  * helper function signature in order to share code among destructuring and

  * simple variable declaration parsers.  In the destructuring case, the binder

  * function is called indirectly from the variable declaration parser by way

  * of CheckDestructuring and its friends.

  */

 template <typename ParseHandler>

 struct BindData

 {

     BindData(ExclusiveContext *cx) : let(cx) {}

     typedef bool

     (*Binder)(BindData *data, HandlePropertyName name, Parser<ParseHandler> *parser);

     /* name node for definition processing and error source coordinates */

     typename ParseHandler::Node pn;

     JSOp            op;         /* prolog bytecode or nop */

     Binder          binder;     /* binder, discriminates u */

     struct LetData {

         LetData(ExclusiveContext *cx) : blockObj(cx) {}

         VarContext varContext;

         RootedStaticBlockObject blockObj;

         unsigned   overflow;

     } let;

     void initLet(VarContext varContext, StaticBlockObject &blockObj, unsigned overflow) {

         this->pn = ParseHandler::null();

         this->op = JSOP_NOP;

         this->binder = Parser<ParseHandler>::bindLet;

         this->let.varContext = varContext;

         this->let.blockObj = &blockObj;

         this->let.overflow = overflow;

     }

     void initVarOrConst(JSOp op) {

         this->op = op;

         this->binder = Parser<ParseHandler>::bindVarOrConst;

     }

 };

 template <typename ParseHandler>

 JSFunction *

 Parser<ParseHandler>::newFunction(GenericParseContext *pc, HandleAtom atom,

                                   FunctionSyntaxKind kind, JSObject *proto)

 {

     JS_ASSERT_IF(kind == Statement, atom != nullptr);

     /*

      * Find the global compilation context in order to pre-set the newborn

      * function's parent slot to pc->sc->as<GlobalObject>()->scopeChain. If the

      * global context is a compile-and-go one, we leave the pre-set parent

      * intact; otherwise we clear parent and proto.

      */

     while (pc->parent)

         pc = pc->parent;

     RootedFunction fun(context);

     JSFunction::Flags flags = (kind == Expression)

                               ? JSFunction::INTERPRETED_LAMBDA

                               : (kind == Arrow)

                                 ? JSFunction::INTERPRETED_LAMBDA_ARROW

                                 : JSFunction::INTERPRETED;

     gc::AllocKind allocKind = JSFunction::FinalizeKind;

     if (kind == Arrow)

         allocKind = JSFunction::ExtendedFinalizeKind;

     fun = NewFunctionWithProto(context, NullPtr(), nullptr, 0, flags, NullPtr(), atom, proto,

                                allocKind, MaybeSingletonObject);

     if (!fun)

         return nullptr;

     if (options().selfHostingMode)

         fun->setIsSelfHostedBuiltin();

     return fun;

 }

 static bool

 MatchOrInsertSemicolon(TokenStream &ts)

 {

     TokenKind tt = ts.peekTokenSameLine(TokenStream::Operand);

     if (tt == TOK_ERROR)

         return false;

     if (tt != TOK_EOF && tt != TOK_EOL && tt != TOK_SEMI && tt != TOK_RC) {

         /* Advance the scanner for proper error location reporting. */

         ts.getToken(TokenStream::Operand);

         ts.reportError(JSMSG_SEMI_BEFORE_STMNT);

         return false;

     }

     (void) ts.matchToken(TOK_SEMI);

     return true;

 }

 template <typename ParseHandler>

 typename ParseHandler::DefinitionNode

 Parser<ParseHandler>::getOrCreateLexicalDependency(ParseContext<ParseHandler> *pc, JSAtom *atom)

 {

     AtomDefnAddPtr p = pc->lexdeps->lookupForAdd(atom);

     if (p)

         return p.value().get<ParseHandler>();

     DefinitionNode dn = handler.newPlaceholder(atom, pc->blockid(), pos());

     if (!dn)

         return ParseHandler::nullDefinition();

     DefinitionSingle def = DefinitionSingle::new_<ParseHandler>(dn);

     if (!pc->lexdeps->add(p, atom, def))

         return ParseHandler::nullDefinition();

     return dn;

 }

 static bool

 ConvertDefinitionToNamedLambdaUse(TokenStream &ts, ParseContext<FullParseHandler> *pc,

                                   FunctionBox *funbox, Definition *dn)

 {

     dn->setOp(JSOP_CALLEE);

     if (!dn->pn_cookie.set(ts, pc->staticLevel, 0))

         return false;

     dn->pn_dflags |= PND_BOUND;

     JS_ASSERT(dn->kind() == Definition::NAMED_LAMBDA);

     /*

      * Since 'dn' is a placeholder, it has not been defined in the

      * ParseContext and hence we must manually flag a closed-over

      * callee name as needing a dynamic scope (this is done for all

      * definitions in the ParseContext by generateFunctionBindings).

      *

      * If 'dn' has been assigned to, then we also flag the function

      * scope has needing a dynamic scope so that dynamic scope

      * setter can either ignore the set (in non-strict mode) or

      * produce an error (in strict mode).

      */

     if (dn->isClosed() || dn->isAssigned())

         funbox->setNeedsDeclEnvObject();

     return true;

 }

 /*

  * Beware: this function is called for functions nested in other functions or

  * global scripts but not for functions compiled through the Function

  * constructor or JSAPI. To always execute code when a function has finished

  * parsing, use Parser::functionBody.

  */

 template <>

 bool

 Parser<FullParseHandler>::leaveFunction(ParseNode *fn, ParseContext<FullParseHandler> *outerpc,

                                         FunctionSyntaxKind kind)

 {

     outerpc->blockidGen = pc->blockidGen;

     FunctionBox *funbox = fn->pn_funbox;

     JS_ASSERT(funbox == pc->sc->asFunctionBox());

     /* Propagate unresolved lexical names up to outerpc->lexdeps. */

     if (pc->lexdeps->count()) {

         for (AtomDefnRange r = pc->lexdeps->all(); !r.empty(); r.popFront()) {

             JSAtom *atom = r.front().key();

             Definition *dn = r.front().value().get<FullParseHandler>();

             JS_ASSERT(dn->isPlaceholder());

             if (atom == funbox->function()->name() && kind == Expression) {

                 if (!ConvertDefinitionToNamedLambdaUse(tokenStream, pc, funbox, dn))

                     return false;

                 continue;

             }

             Definition *outer_dn = outerpc->decls().lookupFirst(atom);

             /*

              * Make sure to deoptimize lexical dependencies that are polluted

              * by eval and function statements (which both flag the function as

              * having an extensible scope) or any enclosing 'with'.

              */

             if (funbox->hasExtensibleScope() || outerpc->parsingWith)

                 handler.deoptimizeUsesWithin(dn, fn->pn_pos);

             if (!outer_dn) {

                 /*

                  * Create a new placeholder for our outer lexdep. We could

                  * simply re-use the inner placeholder, but that introduces

                  * subtleties in the case where we find a later definition

                  * that captures an existing lexdep. For example:

                  *

                  *   function f() { function g() { x; } let x; }

                  *

                  * Here, g's TOK_UPVARS node lists the placeholder for x,

                  * which must be captured by the 'let' declaration later,

                  * since 'let's are hoisted.  Taking g's placeholder as our

                  * own would work fine. But consider:

                  *

                  *   function f() { x; { function g() { x; } let x; } }

                  *

                  * Here, the 'let' must not capture all the uses of f's

                  * lexdep entry for x, but it must capture the x node

                  * referred to from g's TOK_UPVARS node.  Always turning

                  * inherited lexdeps into uses of a new outer definition

                  * allows us to handle both these cases in a natural way.

                  */

                 outer_dn = getOrCreateLexicalDependency(outerpc, atom);

                 if (!outer_dn)

                     return false;

             }

             /*

              * Insert dn's uses list at the front of outer_dn's list.

              *

              * Without loss of generality or correctness, we allow a dn to

              * be in inner and outer lexdeps, since the purpose of lexdeps

              * is one-pass coordination of name use and definition across

              * functions, and if different dn's are used we'll merge lists

              * when leaving the inner function.

              *

              * The dn == outer_dn case arises with generator expressions

              * (see LegacyCompExprTransplanter::transplant, the PN_CODE/PN_NAME

              * case), and nowhere else, currently.

              */

             if (dn != outer_dn) {

                 if (ParseNode *pnu = dn->dn_uses) {

                     while (true) {

                         pnu->pn_lexdef = outer_dn;

                         if (!pnu->pn_link)

                             break;

                         pnu = pnu->pn_link;

                     }

                     pnu->pn_link = outer_dn->dn_uses;

                     outer_dn->dn_uses = dn->dn_uses;

                     dn->dn_uses = nullptr;

                 }

                 outer_dn->pn_dflags |= dn->pn_dflags & ~PND_PLACEHOLDER;

             }

             /* Mark the outer dn as escaping. */

             outer_dn->pn_dflags |= PND_CLOSED;

         }

     }

     InternalHandle<Bindings*> bindings =

         InternalHandle<Bindings*>::fromMarkedLocation(&funbox->bindings);

     return pc->generateFunctionBindings(context, tokenStream, alloc, bindings);

 }

 template <>

 bool

 Parser<SyntaxParseHandler>::leaveFunction(Node fn, ParseContext<SyntaxParseHandler> *outerpc,

                                           FunctionSyntaxKind kind)

 {

     outerpc->blockidGen = pc->blockidGen;

     FunctionBox *funbox = pc->sc->asFunctionBox();

     return addFreeVariablesFromLazyFunction(funbox->function(), outerpc);

 }

 /*

  * defineArg is called for both the arguments of a regular function definition

  * and the arguments specified by the Function constructor.

  *

  * The 'disallowDuplicateArgs' bool indicates whether the use of another

  * feature (destructuring or default arguments) disables duplicate arguments.

  * (ECMA-262 requires us to support duplicate parameter names, but, for newer

  * features, we consider the code to have "opted in" to higher standards and

  * forbid duplicates.)

  *

  * If 'duplicatedArg' is non-null, then DefineArg assigns to it any previous

  * argument with the same name. The caller may use this to report an error when

  * one of the abovementioned features occurs after a duplicate.

  */

 template <typename ParseHandler>

 bool

 Parser<ParseHandler>::defineArg(Node funcpn, HandlePropertyName name,

                                 bool disallowDuplicateArgs, Node *duplicatedArg)

 {

     SharedContext *sc = pc->sc;

     /* Handle duplicate argument names. */

     if (DefinitionNode prevDecl = pc->decls().lookupFirst(name)) {

         Node pn = handler.getDefinitionNode(prevDecl);

         /*

          * Strict-mode disallows duplicate args. We may not know whether we are

          * in strict mode or not (since the function body hasn't been parsed).

          * In such cases, report will queue up the potential error and return

          * 'true'.

          */

         if (sc->needStrictChecks()) {

             JSAutoByteString bytes;

             if (!AtomToPrintableString(context, name, &bytes))

                 return false;

             if (!report(ParseStrictError, pc->sc->strict, pn,

                         JSMSG_DUPLICATE_FORMAL, bytes.ptr()))

             {

                 return false;

             }

         }

         if (disallowDuplicateArgs) {

             report(ParseError, false, pn, JSMSG_BAD_DUP_ARGS);

             return false;

         }

         if (duplicatedArg)

             *duplicatedArg = pn;

         /* ParseContext::define assumes and asserts prevDecl is not in decls. */

         JS_ASSERT(handler.getDefinitionKind(prevDecl) == Definition::ARG);

         pc->prepareToAddDuplicateArg(name, prevDecl);

     }

     Node argpn = newName(name);

     if (!argpn)

         return false;

     if (!checkStrictBinding(name, argpn))

         return false;

     handler.addFunctionArgument(funcpn, argpn);

     return pc->define(tokenStream, name, argpn, Definition::ARG);

 }

 template <typename ParseHandler>

 /* static */ bool

 Parser<ParseHandler>::bindDestructuringArg(BindData<ParseHandler> *data,

                                            HandlePropertyName name, Parser<ParseHandler> *parser)

 {

     ParseContext<ParseHandler> *pc = parser->pc;

     JS_ASSERT(pc->sc->isFunctionBox());

     if (pc->decls().lookupFirst(name)) {

         parser->report(ParseError, false, null(), JSMSG_BAD_DUP_ARGS);

         return false;

     }

     if (!parser->checkStrictBinding(name, data->pn))

         return false;

     return pc->define(parser->tokenStream, name, data->pn, Definition::VAR);

 }

 template <typename ParseHandler>

 bool

 Parser<ParseHandler>::functionArguments(FunctionSyntaxKind kind, Node *listp, Node funcpn,

                                         bool *hasRest)

 {

     FunctionBox *funbox = pc->sc->asFunctionBox();

     *hasRest = false;

     bool parenFreeArrow = false;

     if (kind == Arrow && tokenStream.peekToken() == TOK_NAME) {

         parenFreeArrow = true;

     } else {

         if (tokenStream.getToken() != TOK_LP) {

             report(ParseError, false, null(),

                    kind == Arrow ? JSMSG_BAD_ARROW_ARGS : JSMSG_PAREN_BEFORE_FORMAL);

             return false;

         }

         // Record the start of function source (for FunctionToString). If we

         // are parenFreeArrow, we will set this below, after consuming the NAME.

         funbox->setStart(tokenStream);

     }

     Node argsbody = handler.newList(PNK_ARGSBODY);

     if (!argsbody)

         return false;

     handler.setFunctionBody(funcpn, argsbody);

     if (parenFreeArrow || !tokenStream.matchToken(TOK_RP)) {

         bool hasDefaults = false;

         Node duplicatedArg = null();

         Node list = null();

         do {

             if (*hasRest) {

                 report(ParseError, false, null(), JSMSG_PARAMETER_AFTER_REST);

                 return false;

             }

             TokenKind tt = tokenStream.getToken();

             JS_ASSERT_IF(parenFreeArrow, tt == TOK_NAME);

             switch (tt) {

               case TOK_LB:

               case TOK_LC:

               {

                 /* See comment below in the TOK_NAME case. */

                 if (duplicatedArg) {

                     report(ParseError, false, duplicatedArg, JSMSG_BAD_DUP_ARGS);

                     return false;

                 }

                 if (hasDefaults) {

                     report(ParseError, false, null(), JSMSG_NONDEFAULT_FORMAL_AFTER_DEFAULT);

                     return false;

                 }

                 funbox->hasDestructuringArgs = true;

                 /*

                  * A destructuring formal parameter turns into one or more

                  * local variables initialized from properties of a single

                  * anonymous positional parameter, so here we must tweak our

                  * binder and its data.

                  */

                 BindData<ParseHandler> data(context);

                 data.pn = ParseHandler::null();

                 data.op = JSOP_DEFVAR;

                 data.binder = bindDestructuringArg;

                 Node lhs = destructuringExpr(&data, tt);

                 if (!lhs)

                     return false;

                 /*

                  * Synthesize a destructuring assignment from the single

                  * anonymous positional parameter into the destructuring

                  * left-hand-side expression and accumulate it in list.

                  */

                 HandlePropertyName name = context->names().empty;

                 Node rhs = newName(name);

                 if (!rhs)

                     return false;

                 if (!pc->define(tokenStream, name, rhs, Definition::ARG))

                     return false;

                 Node item = handler.newBinary(PNK_ASSIGN, lhs, rhs);

                 if (!item)

                     return false;

                 if (list) {

                     handler.addList(list, item);

                 } else {

                     list = handler.newList(PNK_VAR, item);

                     if (!list)

                         return false;

                     *listp = list;

                 }

                 break;

               }

               case TOK_YIELD:

                 if (!checkYieldNameValidity())

                     return false;

                 goto TOK_NAME;

               case TOK_TRIPLEDOT:

               {

                 *hasRest = true;

                 tt = tokenStream.getToken();

                 if (tt != TOK_NAME) {

                     if (tt != TOK_ERROR)

                         report(ParseError, false, null(), JSMSG_NO_REST_NAME);

                     return false;

                 }

                 goto TOK_NAME;

               }

               TOK_NAME:

               case TOK_NAME:

               {

                 if (parenFreeArrow)

                     funbox->setStart(tokenStream);

                 RootedPropertyName name(context, tokenStream.currentName());

                 bool disallowDuplicateArgs = funbox->hasDestructuringArgs || hasDefaults;

                 if (!defineArg(funcpn, name, disallowDuplicateArgs, &duplicatedArg))

                     return false;

                 if (tokenStream.matchToken(TOK_ASSIGN)) {

                     // A default argument without parentheses would look like:

                     // a = expr => body, but both operators are right-associative, so

                     // that would have been parsed as a = (expr => body) instead.

                     // Therefore it's impossible to get here with parenFreeArrow.

                     JS_ASSERT(!parenFreeArrow);

                     if (*hasRest) {

                         report(ParseError, false, null(), JSMSG_REST_WITH_DEFAULT);

                         return false;

                     }

                     if (duplicatedArg) {

                         report(ParseError, false, duplicatedArg, JSMSG_BAD_DUP_ARGS);

                         return false;

                     }

                     if (!hasDefaults) {

                         hasDefaults = true;

                         // The Function.length property is the number of formals

                         // before the first default argument.

                         funbox->length = pc->numArgs() - 1;

                     }

                     Node def_expr = assignExprWithoutYield(JSMSG_YIELD_IN_DEFAULT);

                     if (!def_expr)

                         return false;

                     handler.setLastFunctionArgumentDefault(funcpn, def_expr);

                 }

                 break;

               }

               default:

                 report(ParseError, false, null(), JSMSG_MISSING_FORMAL);

                 /* FALL THROUGH */

               case TOK_ERROR:

                 return false;

             }

         } while (!parenFreeArrow && tokenStream.matchToken(TOK_COMMA));

         if (!parenFreeArrow && tokenStream.getToken() != TOK_RP) {

             report(ParseError, false, null(), JSMSG_PAREN_AFTER_FORMAL);

             return false;

         }

         if (!hasDefaults)

             funbox->length = pc->numArgs() - *hasRest;

     }

     return true;

 }

 template <>

 bool

 Parser<FullParseHandler>::checkFunctionDefinition(HandlePropertyName funName,

                                                   ParseNode **pn_, FunctionSyntaxKind kind,

                                                   bool *pbodyProcessed)

 {

     ParseNode *&pn = *pn_;

     *pbodyProcessed = false;

     /* Function statements add a binding to the enclosing scope. */

     bool bodyLevel = pc->atBodyLevel();

     if (kind == Statement) {

         /*

          * Handle redeclaration and optimize cases where we can statically bind the

          * function (thereby avoiding JSOP_DEFFUN and dynamic name lookup).

          */

         if (Definition *dn = pc->decls().lookupFirst(funName)) {

             JS_ASSERT(!dn->isUsed());

             JS_ASSERT(dn->isDefn());

             if (options().extraWarningsOption || dn->kind() == Definition::CONST) {

                 JSAutoByteString name;

                 ParseReportKind reporter = (dn->kind() != Definition::CONST)

                                            ? ParseExtraWarning

                                            : ParseError;

                 if (!AtomToPrintableString(context, funName, &name) ||

                     !report(reporter, false, nullptr, JSMSG_REDECLARED_VAR,

                             Definition::kindString(dn->kind()), name.ptr()))

                 {

                     return false;

                 }

             }

             /*

              * Body-level function statements are effectively variable

              * declarations where the initialization is hoisted to the

              * beginning of the block. This means that any other variable

              * declaration with the same name is really just an assignment to

              * the function's binding (which is mutable), so turn any existing

              * declaration into a use.

              */

             if (bodyLevel && !makeDefIntoUse(dn, pn, funName))

                 return false;

         } else if (bodyLevel) {

             /*

              * If this function was used before it was defined, claim the

              * pre-created definition node for this function that primaryExpr

              * put in pc->lexdeps on first forward reference, and recycle pn.

              */

             if (Definition *fn = pc->lexdeps.lookupDefn<FullParseHandler>(funName)) {

                 JS_ASSERT(fn->isDefn());

                 fn->setKind(PNK_FUNCTION);

                 fn->setArity(PN_CODE);

                 fn->pn_pos.begin = pn->pn_pos.begin;

                 fn->pn_pos.end = pn->pn_pos.end;

                 fn->pn_body = nullptr;

                 fn->pn_cookie.makeFree();

                 pc->lexdeps->remove(funName);

                 handler.freeTree(pn);

                 pn = fn;

             }

             if (!pc->define(tokenStream, funName, pn, Definition::VAR))

                 return false;

         }

         if (bodyLevel) {

             JS_ASSERT(pn->functionIsHoisted());

             JS_ASSERT_IF(pc->sc->isFunctionBox(), !pn->pn_cookie.isFree());

             JS_ASSERT_IF(!pc->sc->isFunctionBox(), pn->pn_cookie.isFree());

         } else {

             /*

              * As a SpiderMonkey-specific extension, non-body-level function

              * statements (e.g., functions in an "if" or "while" block) are

              * dynamically bound when control flow reaches the statement.

              */

             JS_ASSERT(!pc->sc->strict);

             JS_ASSERT(pn->pn_cookie.isFree());

             if (pc->sc->isFunctionBox()) {

                 FunctionBox *funbox = pc->sc->asFunctionBox();

                 funbox->setMightAliasLocals();

                 funbox->setHasExtensibleScope();

             }

             pn->setOp(JSOP_DEFFUN);

             /*

              * Instead of setting bindingsAccessedDynamically, which would be

              * overly conservative, remember the names of all function

              * statements and mark any bindings with the same as aliased at the

              * end of functionBody.

              */

             if (!pc->funcStmts) {

                 pc->funcStmts = context->new_<FuncStmtSet>(context);

                 if (!pc->funcStmts || !pc->funcStmts->init())

                     return false;

             }

             if (!pc->funcStmts->put(funName))

                 return false;

             /*

              * Due to the implicit declaration mechanism, 'arguments' will not

              * have decls and, even if it did, they will not be noted as closed

              * in the emitter. Thus, in the corner case of function statements

              * overridding arguments, flag the whole scope as dynamic.

              */

             if (funName == context->names().arguments)

                 pc->sc->setBindingsAccessedDynamically();

         }

         /* No further binding (in BindNameToSlot) is needed for functions. */

         pn->pn_dflags |= PND_BOUND;

     } else {

         /* A function expression does not introduce any binding. */

         pn->setOp(kind == Arrow ? JSOP_LAMBDA_ARROW : JSOP_LAMBDA);

     }

     // When a lazily-parsed function is called, we only fully parse (and emit)

     // that function, not any of its nested children. The initial syntax-only

     // parse recorded the free variables of nested functions and their extents,

     // so we can skip over them after accounting for their free variables.

     if (LazyScript *lazyOuter = handler.lazyOuterFunction()) {

         JSFunction *fun = handler.nextLazyInnerFunction();

         JS_ASSERT(!fun->isLegacyGenerator());

         FunctionBox *funbox = newFunctionBox(pn, fun, pc, Directives(/* strict = */ false),

                                              fun->generatorKind());

         if (!funbox)

             return false;

         if (!addFreeVariablesFromLazyFunction(fun, pc))

             return false;

         // The position passed to tokenStream.advance() is relative to

         // userbuf.base() while LazyScript::{begin,end} offsets are relative to

         // the outermost script source. N.B: userbuf.base() is initialized

         // (in TokenStream()) to begin() - column() so that column numbers in

         // the lazily parsed script are correct.

         uint32_t userbufBase = lazyOuter->begin() - lazyOuter->column();

         tokenStream.advance(fun->lazyScript()->end() - userbufBase);

         *pbodyProcessed = true;

         return true;

     }

     return true;

 }

 template <class T, class U>

 static inline void

 PropagateTransitiveParseFlags(const T *inner, U *outer)

 {

    if (inner->bindingsAccessedDynamically())

      outer->setBindingsAccessedDynamically();

    if (inner->hasDebuggerStatement())

      outer->setHasDebuggerStatement();

 }

 template <typename ParseHandler>

 bool

 Parser<ParseHandler>::addFreeVariablesFromLazyFunction(JSFunction *fun,

                                                        ParseContext<ParseHandler> *pc)

 {

     // Update any definition nodes in this context according to free variables

     // in a lazily parsed inner function.

     LazyScript *lazy = fun->lazyScript();

     HeapPtrAtom *freeVariables = lazy->freeVariables();

     for (size_t i = 0; i < lazy->numFreeVariables(); i++) {

         JSAtom *atom = freeVariables[i];

         // 'arguments' will be implicitly bound within the inner function.

         if (atom == context->names().arguments)

             continue;

         DefinitionNode dn = pc->decls().lookupFirst(atom);

         if (!dn) {

             dn = getOrCreateLexicalDependency(pc, atom);

             if (!dn)

                 return false;

         }

         /* Mark the outer dn as escaping. */

         handler.setFlag(handler.getDefinitionNode(dn), PND_CLOSED);

     }

     PropagateTransitiveParseFlags(lazy, pc->sc);

     return true;

 }

 template <>

 bool

 Parser<SyntaxParseHandler>::checkFunctionDefinition(HandlePropertyName funName,

                                                     Node *pn, FunctionSyntaxKind kind,

                                                     bool *pbodyProcessed)

 {

     *pbodyProcessed = false;

     /* Function statements add a binding to the enclosing scope. */

     bool bodyLevel = pc->atBodyLevel();

     if (kind == Statement) {

         /*

          * Handle redeclaration and optimize cases where we can statically bind the

          * function (thereby avoiding JSOP_DEFFUN and dynamic name lookup).

          */

         if (DefinitionNode dn = pc->decls().lookupFirst(funName)) {

             if (dn == Definition::CONST) {

                 JSAutoByteString name;

                 if (!AtomToPrintableString(context, funName, &name) ||

                     !report(ParseError, false, null(), JSMSG_REDECLARED_VAR,

                             Definition::kindString(dn), name.ptr()))

                 {

                     return false;

                 }

             }

         } else if (bodyLevel) {

             if (pc->lexdeps.lookupDefn<SyntaxParseHandler>(funName))

                 pc->lexdeps->remove(funName);

             if (!pc->define(tokenStream, funName, *pn, Definition::VAR))

                 return false;

         }

         if (!bodyLevel && funName == context->names().arguments)

             pc->sc->setBindingsAccessedDynamically();

     }

     if (kind == Arrow) {

         /* Arrow functions cannot yet be parsed lazily. */

         return abortIfSyntaxParser();

     }

     return true;

 }

 template <typename ParseHandler>

 typename ParseHandler::Node

 Parser<ParseHandler>::functionDef(HandlePropertyName funName, const TokenStream::Position &start,

                                   FunctionType type, FunctionSyntaxKind kind,

                                   GeneratorKind generatorKind)

 {

     JS_ASSERT_IF(kind == Statement, funName);

     /* Make a TOK_FUNCTION node. */

     Node pn = handler.newFunctionDefinition();

     if (!pn)

         return null();

     bool bodyProcessed;

     if (!checkFunctionDefinition(funName, &pn, kind, &bodyProcessed))

         return null();

     if (bodyProcessed)

         return pn;

     RootedObject proto(context);

     if (generatorKind == StarGenerator) {

         // If we are off the main thread, the generator meta-objects have

         // already been created by js::StartOffThreadParseScript, so cx will not

         // be necessary.

         JSContext *cx = context->maybeJSContext();

         proto = GlobalObject::getOrCreateStarGeneratorFunctionPrototype(cx, context->global());

         if (!proto)

             return null();

     }

     RootedFunction fun(context, newFunction(pc, funName, kind, proto));

     if (!fun)

         return null();

     // Speculatively parse using the directives of the parent parsing context.

     // If a directive is encountered (e.g., "use strict") that changes how the

     // function should have been parsed, we backup and reparse with the new set

     // of directives.

     Directives directives(pc);

     Directives newDirectives = directives;

     while (true) {

         if (functionArgsAndBody(pn, fun, type, kind, generatorKind, directives, &newDirectives))

             break;

         if (tokenStream.hadError() || directives == newDirectives)

             return null();

         // Assignment must be monotonic to prevent reparsing iloops

         JS_ASSERT_IF(directives.strict(), newDirectives.strict());

         JS_ASSERT_IF(directives.asmJS(), newDirectives.asmJS());

         directives = newDirectives;

         tokenStream.seek(start);

         if (funName && tokenStream.getToken() == TOK_ERROR)

             return null();

         // functionArgsAndBody may have already set pn->pn_body before failing.

         handler.setFunctionBody(pn, null());

     }

     return pn;

 }

 template <>

 bool

 Parser<FullParseHandler>::finishFunctionDefinition(ParseNode *pn, FunctionBox *funbox,

                                                    ParseNode *prelude, ParseNode *body)

 {

     pn->pn_pos.end = pos().end;

     /*

      * If there were destructuring formal parameters, prepend the initializing

      * comma expression that we synthesized to body. If the body is a return

      * node, we must make a special PNK_SEQ node, to prepend the destructuring

      * code without bracing the decompilation of the function body.

      */

     if (prelude) {

         if (!body->isArity(PN_LIST)) {

             ParseNode *block;

             block = ListNode::create(PNK_SEQ, &handler);

             if (!block)

                 return false;

             block->pn_pos = body->pn_pos;

             block->initList(body);

             body = block;

         }

         ParseNode *item = UnaryNode::create(PNK_SEMI, &handler);

         if (!item)

             return false;

         item->pn_pos.begin = item->pn_pos.end = body->pn_pos.begin;

         item->pn_kid = prelude;

         item->pn_next = body->pn_head;

         body->pn_head = item;

         if (body->pn_tail == &body->pn_head)

             body->pn_tail = &item->pn_next;

         ++body->pn_count;

         body->pn_xflags |= PNX_DESTRUCT;

     }

     JS_ASSERT(pn->pn_funbox == funbox);

     JS_ASSERT(pn->pn_body->isKind(PNK_ARGSBODY));

     pn->pn_body->append(body);

     pn->pn_body->pn_pos = body->pn_pos;

     return true;

 }

 template <>

 bool

 Parser<SyntaxParseHandler>::finishFunctionDefinition(Node pn, FunctionBox *funbox,

                                                      Node prelude, Node body)

 {

     // The LazyScript for a lazily parsed function needs to be constructed

     // while its ParseContext and associated lexdeps and inner functions are

     // still available.

     if (funbox->inWith)

         return abortIfSyntaxParser();

     size_t numFreeVariables = pc->lexdeps->count();

     size_t numInnerFunctions = pc->innerFunctions.length();

     RootedFunction fun(context, funbox->function());

     LazyScript *lazy = LazyScript::CreateRaw(context, fun, numFreeVariables, numInnerFunctions,

                                              versionNumber(), funbox->bufStart, funbox->bufEnd,

                                              funbox->startLine, funbox->startColumn);

     if (!lazy)

         return false;

     HeapPtrAtom *freeVariables = lazy->freeVariables();

     size_t i = 0;

     for (AtomDefnRange r = pc->lexdeps->all(); !r.empty(); r.popFront())

         freeVariables[i++].init(r.front().key());

     JS_ASSERT(i == numFreeVariables);

     HeapPtrFunction *innerFunctions = lazy->innerFunctions();

     for (size_t i = 0; i < numInnerFunctions; i++)

         innerFunctions[i].init(pc->innerFunctions[i]);

     if (pc->sc->strict)

         lazy->setStrict();

     lazy->setGeneratorKind(funbox->generatorKind());

     if (funbox->usesArguments && funbox->usesApply)

         lazy->setUsesArgumentsAndApply();

     PropagateTransitiveParseFlags(funbox, lazy);

     fun->initLazyScript(lazy);

     return true;

 }

 template <>

 bool

 Parser<FullParseHandler>::functionArgsAndBody(ParseNode *pn, HandleFunction fun,

                                               FunctionType type, FunctionSyntaxKind kind,

                                               GeneratorKind generatorKind,

                                               Directives inheritedDirectives,

                                               Directives *newDirectives)

 {

     ParseContext<FullParseHandler> *outerpc = pc;

     // Create box for fun->object early to protect against last-ditch GC.

     FunctionBox *funbox = newFunctionBox(pn, fun, pc, inheritedDirectives, generatorKind);

     if (!funbox)

         return false;

     // Try a syntax parse for this inner function.

     do {

         Parser<SyntaxParseHandler> *parser = handler.syntaxParser;

         if (!parser)

             break;

         {

             // Move the syntax parser to the current position in the stream.

             TokenStream::Position position(keepAtoms);

             tokenStream.tell(&position);

             if (!parser->tokenStream.seek(position, tokenStream))

                 return false;

             ParseContext<SyntaxParseHandler> funpc(parser, outerpc, SyntaxParseHandler::null(), funbox,

                                                    newDirectives, outerpc->staticLevel + 1,

                                                    outerpc->blockidGen,

                                                    /* blockScopeDepth = */ 0);

             if (!funpc.init(tokenStream))

                 return false;

             if (!parser->functionArgsAndBodyGeneric(SyntaxParseHandler::NodeGeneric,

                                                     fun, type, kind, newDirectives))

             {

                 if (parser->hadAbortedSyntaxParse()) {

                     // Try again with a full parse.

                     parser->clearAbortedSyntaxParse();

                     break;

                 }

                 return false;

             }

             outerpc->blockidGen = funpc.blockidGen;

             // Advance this parser over tokens processed by the syntax parser.

             parser->tokenStream.tell(&position);

             if (!tokenStream.seek(position, parser->tokenStream))

                 return false;

             // Update the end position of the parse node.

             pn->pn_pos.end = tokenStream.currentToken().pos.end;

         }

         if (!addFreeVariablesFromLazyFunction(fun, pc))

             return false;

         pn->pn_blockid = outerpc->blockid();

         PropagateTransitiveParseFlags(funbox, outerpc->sc);

         return true;

     } while (false);

     // Continue doing a full parse for this inner function.

     ParseContext<FullParseHandler> funpc(this, pc, pn, funbox, newDirectives,

                                          outerpc->staticLevel + 1, outerpc->blockidGen,

                                          /* blockScopeDepth = */ 0);

     if (!funpc.init(tokenStream))

         return false;

     if (!functionArgsAndBodyGeneric(pn, fun, type, kind, newDirectives))

         return false;

     if (!leaveFunction(pn, outerpc, kind))

         return false;

     pn->pn_blockid = outerpc->blockid();

     /*

      * Fruit of the poisonous tree: if a closure contains a dynamic name access

      * (eval, with, etc), we consider the parent to do the same. The reason is

      * that the deoptimizing effects of dynamic name access apply equally to

      * parents: any local can be read at runtime.

      */

     PropagateTransitiveParseFlags(funbox, outerpc->sc);

     return true;

 }

 template <>

 bool

 Parser<SyntaxParseHandler>::functionArgsAndBody(Node pn, HandleFunction fun,

                                                 FunctionType type, FunctionSyntaxKind kind,

                                                 GeneratorKind generatorKind,

                                                 Directives inheritedDirectives,

                                                 Directives *newDirectives)

 {

     ParseContext<SyntaxParseHandler> *outerpc = pc;

     // Create box for fun->object early to protect against last-ditch GC.

     FunctionBox *funbox = newFunctionBox(pn, fun, pc, inheritedDirectives, generatorKind);

     if (!funbox)

         return false;

     // Initialize early for possible flags mutation via destructuringExpr.

     ParseContext<SyntaxParseHandler> funpc(this, pc, handler.null(), funbox, newDirectives,

                                            outerpc->staticLevel + 1, outerpc->blockidGen,

                                            /* blockScopeDepth = */ 0);

     if (!funpc.init(tokenStream))

         return false;

     if (!functionArgsAndBodyGeneric(pn, fun, type, kind, newDirectives))

         return false;

     if (!leaveFunction(pn, outerpc, kind))

         return false;

     // This is a lazy function inner to another lazy function. Remember the

     // inner function so that if the outer function is eventually parsed we do

     // not need any further parsing or processing of the inner function.

     JS_ASSERT(fun->lazyScript());

     return outerpc->innerFunctions.append(fun);

 }

 template <>

 ParseNode *

 Parser<FullParseHandler>::standaloneLazyFunction(HandleFunction fun, unsigned staticLevel,

                                                  bool strict, GeneratorKind generatorKind)

 {

     Node pn = handler.newFunctionDefinition();

     if (!pn)

         return null();

     Directives directives(/* strict = */ strict);

     FunctionBox *funbox = newFunctionBox(pn, fun, /* outerpc = */ nullptr, directives,

                                          generatorKind);

     if (!funbox)

         return null();

     funbox->length = fun->nargs() - fun->hasRest();

     Directives newDirectives = directives;

     ParseContext<FullParseHandler> funpc(this, /* parent = */ nullptr, pn, funbox,

                                          &newDirectives, staticLevel, /* bodyid = */ 0,

                                          /* blockScopeDepth = */ 0);

     if (!funpc.init(tokenStream))

         return null();

     if (!functionArgsAndBodyGeneric(pn, fun, Normal, Statement, &newDirectives)) {

         JS_ASSERT(directives == newDirectives);

         return null();

     }

     if (fun->isNamedLambda()) {

         if (AtomDefnPtr p = pc->lexdeps->lookup(fun->name())) {

             Definition *dn = p.value().get<FullParseHandler>();

             if (!ConvertDefinitionToNamedLambdaUse(tokenStream, pc, funbox, dn))

                 return nullptr;

         }

     }

     InternalHandle<Bindings*> bindings =

         InternalHandle<Bindings*>::fromMarkedLocation(&funbox->bindings);

     if (!pc->generateFunctionBindings(context, tokenStream, alloc, bindings))

         return null();

     if (!FoldConstants(context, &pn, this))

         return null();

     return pn;

 }

 template <typename ParseHandler>

 bool

 Parser<ParseHandler>::functionArgsAndBodyGeneric(Node pn, HandleFunction fun, FunctionType type,

                                                  FunctionSyntaxKind kind,

                                                  Directives *newDirectives)

 {

     // Given a properly initialized parse context, try to parse an actual

     // function without concern for conversion to strict mode, use of lazy

     // parsing and such.

     Node prelude = null();

     bool hasRest;

     if (!functionArguments(kind, &prelude, pn, &hasRest))

         return false;

     FunctionBox *funbox = pc->sc->asFunctionBox();

     fun->setArgCount(pc->numArgs());

     if (hasRest)

         fun->setHasRest();

     if (type == Getter && fun->nargs() > 0) {

         report(ParseError, false, null(), JSMSG_ACCESSOR_WRONG_ARGS, "getter", "no", "s");

         return false;

     }

     if (type == Setter && fun->nargs() != 1) {

         report(ParseError, false, null(), JSMSG_ACCESSOR_WRONG_ARGS, "setter", "one", "");

         return false;

     }

     if (kind == Arrow && !tokenStream.matchToken(TOK_ARROW)) {

         report(ParseError, false, null(), JSMSG_BAD_ARROW_ARGS);

         return false;

     }

     // Parse the function body.

     FunctionBodyType bodyType = StatementListBody;

     if (tokenStream.getToken(TokenStream::Operand) != TOK_LC) {

         if (funbox->isStarGenerator()) {

             report(ParseError, false, null(), JSMSG_CURLY_BEFORE_BODY);

             return false;

         }

         tokenStream.ungetToken();

         bodyType = ExpressionBody;

         fun->setIsExprClosure();

     }

     Node body = functionBody(kind, bodyType);

     if (!body)

         return false;

     if (fun->name() && !checkStrictBinding(fun->name(), pn))

         return false;

 #if JS_HAS_EXPR_CLOSURES

     if (bodyType == StatementListBody) {

 #endif

         if (!tokenStream.matchToken(TOK_RC)) {

             report(ParseError, false, null(), JSMSG_CURLY_AFTER_BODY);

             return false;

         }

         funbox->bufEnd = pos().begin + 1;

 #if JS_HAS_EXPR_CLOSURES

     } else {

         if (tokenStream.hadError())

             return false;

         funbox->bufEnd = pos().end;

         if (kind == Statement && !MatchOrInsertSemicolon(tokenStream))

             return false;

     }

 #endif

     return finishFunctionDefinition(pn, funbox, prelude, body);

 }

 template <typename ParseHandler>

 bool

 Parser<ParseHandler>::checkYieldNameValidity()

 {

     // In star generators and in JS >= 1.7, yield is a keyword.  Otherwise in

     // strict mode, yield is a future reserved word.

     if (pc->isStarGenerator() || versionNumber() >= JSVERSION_1_7 || pc->sc->strict) {

         report(ParseError, false, null(), JSMSG_RESERVED_ID, "yield");

         return false;

     }

     return true;

 }

 template <typename ParseHandler>

 typename ParseHandler::Node

 Parser<ParseHandler>::functionStmt()

 {

     JS_ASSERT(tokenStream.isCurrentTokenType(TOK_FUNCTION));

     TokenStream::Position start(keepAtoms);

     tokenStream.tell(&start);

     RootedPropertyName name(context);

     GeneratorKind generatorKind = NotGenerator;

     TokenKind tt = tokenStream.getToken();

     if (tt == TOK_MUL) {

         tokenStream.tell(&start);

         tt = tokenStream.getToken();

         generatorKind = StarGenerator;

     }

     if (tt == TOK_NAME) {

         name = tokenStream.currentName();

     } else if (tt == TOK_YIELD) {

         if (!checkYieldNameValidity())

             return null();

         name = tokenStream.currentName();

     } else {

         /* Unnamed function expressions are forbidden in statement context. */

         report(ParseError, false, null(), JSMSG_UNNAMED_FUNCTION_STMT);

         return null();

     }

     /* We forbid function statements in strict mode code. */

     if (!pc->atBodyLevel() && pc->sc->needStrictChecks() &&

         !report(ParseStrictError, pc->sc->strict, null(), JSMSG_STRICT_FUNCTION_STATEMENT))

         return null();

     return functionDef(name, start, Normal, Statement, generatorKind);

 }

 template <typename ParseHandler>

 typename ParseHandler::Node

 Parser<ParseHandler>::functionExpr()

 {

     JS_ASSERT(tokenStream.isCurrentTokenType(TOK_FUNCTION));

     TokenStream::Position start(keepAtoms);

     tokenStream.tell(&start);

     GeneratorKind generatorKind = NotGenerator;

     TokenKind tt = tokenStream.getToken();

     if (tt == TOK_MUL) {

         tokenStream.tell(&start);

         tt = tokenStream.getToken();

         generatorKind = StarGenerator;

     }

     RootedPropertyName name(context);

     if (tt == TOK_NAME) {

         name = tokenStream.currentName();

     } else if (tt == TOK_YIELD) {

         if (!checkYieldNameValidity())

             return null();

         name = tokenStream.currentName();

     } else {

         tokenStream.ungetToken();

     }

     return functionDef(name, start, Normal, Expression, generatorKind);

 }

 /*

  * Return true if this node, known to be an unparenthesized string literal,

  * could be the string of a directive in a Directive Prologue. Directive

  * strings never contain escape sequences or line continuations.

  * isEscapeFreeStringLiteral, below, checks whether the node itself could be

  * a directive.

  */

 static inline bool

 IsEscapeFreeStringLiteral(const TokenPos &pos, JSAtom *str)

 {

     /*

      * If the string's length in the source code is its length as a value,

      * accounting for the quotes, then it must not contain any escape

      * sequences or line continuations.

      */

     return pos.begin + str->length() + 2 == pos.end;

 }

 template <>

 bool

 Parser<SyntaxParseHandler>::asmJS(Node list)

 {

     // While asm.js could technically be validated and compiled during syntax

     // parsing, we have no guarantee that some later JS wouldn't abort the

     // syntax parse and cause us to re-parse (and re-compile) the asm.js module.

     // For simplicity, unconditionally abort the syntax parse when "use asm" is

     // encountered so that asm.js is always validated/compiled exactly once

     // during a full parse.

     JS_ALWAYS_FALSE(abortIfSyntaxParser());

     return false;

 }

 template <>

 bool

 Parser<FullParseHandler>::asmJS(Node list)

 {

     // If we are already inside "use asm" that means we are either actively

     // compiling or we are reparsing after asm.js validation failure. In either

     // case, nothing to do here.

     if (pc->useAsmOrInsideUseAsm())

         return true;

     // If there is no ScriptSource, then we are doing a non-compiling parse and

     // so we shouldn't (and can't, without a ScriptSource) compile.

     if (ss == nullptr)

         return true;

     pc->sc->asFunctionBox()->useAsm = true;

 #ifdef JS_ION

     // Attempt to validate and compile this asm.js module. On success, the

     // tokenStream has been advanced to the closing }. On failure, the

     // tokenStream is in an indeterminate state and we must reparse the

     // function from the beginning. Reparsing is triggered by marking that a

     // new directive has been encountered and returning 'false'.

     bool validated;

     if (!CompileAsmJS(context, *this, list, &validated))

         return false;

     if (!validated) {

         pc->newDirectives->setAsmJS();

         return false;

     }

 #endif

     return true;

 }

 /*

  * Recognize Directive Prologue members and directives. Assuming |pn| is a

  * candidate for membership in a directive prologue, recognize directives and

  * set |pc|'s flags accordingly. If |pn| is indeed part of a prologue, set its

  * |pn_prologue| flag.

  *

  * Note that the following is a strict mode function:

  *

  * function foo() {

  *   "blah" // inserted semi colon

  *        "blurgh"

  *   "use\x20loose"

  *   "use strict"

  * }

  *

  * That is, even though "use\x20loose" can never be a directive, now or in the

  * future (because of the hex escape), the Directive Prologue extends through it

  * to the "use strict" statement, which is indeed a directive.

  */

 template <typename ParseHandler>

 bool

 Parser<ParseHandler>::maybeParseDirective(Node list, Node pn, bool *cont)

 {

     TokenPos directivePos;

     JSAtom *directive = handler.isStringExprStatement(pn, &directivePos);

     *cont = !!directive;

     if (!*cont)

         return true;

     if (IsEscapeFreeStringLiteral(directivePos, directive)) {

         // Mark this statement as being a possibly legitimate part of a

         // directive prologue, so the bytecode emitter won't warn about it being

         // useless code. (We mustn't just omit the statement entirely yet, as it

         // could be producing the value of an eval or JSScript execution.)

         //

         // Note that even if the string isn't one we recognize as a directive,

         // the emitter still shouldn't flag it as useless, as it could become a

         // directive in the future. We don't want to interfere with people

         // taking advantage of directive-prologue-enabled features that appear

         // in other browsers first.

         handler.setPrologue(pn);

         if (directive == context->names().useStrict) {

             // We're going to be in strict mode. Note that this scope explicitly

             // had "use strict";

             pc->sc->setExplicitUseStrict();

             if (!pc->sc->strict) {

                 if (pc->sc->isFunctionBox()) {

                     // Request that this function be reparsed as strict.

                     pc->newDirectives->setStrict();

                     return false;

                 } else {

                     // We don't reparse global scopes, so we keep track of the

                     // one possible strict violation that could occur in the

                     // directive prologue -- octal escapes -- and complain now.

                     if (tokenStream.sawOctalEscape()) {

                         report(ParseError, false, null(), JSMSG_DEPRECATED_OCTAL);

                         return false;

                     }

                     pc->sc->strict = true;

                 }

             }

         } else if (directive == context->names().useAsm) {

             if (pc->sc->isFunctionBox())

                 return asmJS(list);

             return report(ParseWarning, false, pn, JSMSG_USE_ASM_DIRECTIVE_FAIL);

         }

     }

     return true;

 }

 /*

  * Parse the statements in a block, creating a StatementList node that lists

  * the statements.  If called from block-parsing code, the caller must match

  * '{' before and '}' after.

  */

 template <typename ParseHandler>

 typename ParseHandler::Node

 Parser<ParseHandler>::statements()

 {

     JS_CHECK_RECURSION(context, return null());

     Node pn = handler.newStatementList(pc->blockid(), pos());

     if (!pn)

         return null();

     Node saveBlock = pc->blockNode;

     pc->blockNode = pn;

     bool canHaveDirectives = pc->atBodyLevel();

     for (;;) {

         TokenKind tt = tokenStream.peekToken(TokenStream::Operand);

         if (tt <= TOK_EOF || tt == TOK_RC) {

             if (tt == TOK_ERROR) {

                 if (tokenStream.isEOF())

                     isUnexpectedEOF_ = true;

                 return null();

             }

             break;

         }

         Node next = statement(canHaveDirectives);

         if (!next) {

             if (tokenStream.isEOF())

                 isUnexpectedEOF_ = true;

             return null();

         }

         if (canHaveDirectives) {

             if (!maybeParseDirective(pn, next, &canHaveDirectives))

                 return null();

         }

         handler.addStatementToList(pn, next, pc);

     }

     /*

      * Handle the case where there was a let declaration under this block.  If

      * it replaced pc->blockNode with a new block node then we must refresh pn

      * and then restore pc->blockNode.

      */

     if (pc->blockNode != pn)

         pn = pc->blockNode;

     pc->blockNode = saveBlock;

     return pn;

 }

 template <typename ParseHandler>

 typename ParseHandler::Node

 Parser<ParseHandler>::condition()

 {

     MUST_MATCH_TOKEN(TOK_LP, JSMSG_PAREN_BEFORE_COND);

     Node pn = exprInParens();

     if (!pn)

         return null();

     MUST_MATCH_TOKEN(TOK_RP, JSMSG_PAREN_AFTER_COND);

     /* Check for (a = b) and warn about possible (a == b) mistype. */

     if (handler.isOperationWithoutParens(pn, PNK_ASSIGN) &&

         !report(ParseExtraWarning, false, null(), JSMSG_EQUAL_AS_ASSIGN))

     {

         return null();

     }

     return pn;

 }

 template <typename ParseHandler>