1/*
2 * Copyright (C) 2015-2019 Apple Inc. All rights reserved.
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the
11 * documentation and/or other materials provided with the distribution.
12 *
13 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
14 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
15 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
16 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
17 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
18 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
19 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
20 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
21 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
23 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24 */
25
26#pragma once
27
28#include "GenericArguments.h"
29#include "JSLexicalEnvironment.h"
30
31namespace JSC {
32
33// This is an Arguments-class object that we create when you say "arguments" inside a function,
34// and one or more of the arguments may be captured in the function's activation. The function
35// will copy its formally declared arguments into the activation and then create this object. This
36// object will store the overflow arguments, if there are any. This object will use the symbol
37// table's ScopedArgumentsTable and the activation, or its overflow storage, to handle all indexed
38// lookups.
39class ScopedArguments final : public GenericArguments<ScopedArguments> {
40private:
41 ScopedArguments(VM&, Structure*, WriteBarrier<Unknown>* storage);
42 void finishCreation(VM&, JSFunction* callee, ScopedArgumentsTable*, JSLexicalEnvironment*);
43 using Base = GenericArguments<ScopedArguments>;
44
45public:
46 template<typename CellType, SubspaceAccess>
47 static CompleteSubspace* subspaceFor(VM& vm)
48 {
49 static_assert(!CellType::needsDestruction, "");
50 return &vm.jsValueGigacageCellSpace;
51 }
52
53 // Creates an arguments object but leaves it uninitialized. This is dangerous if we GC right
54 // after allocation.
55 static ScopedArguments* createUninitialized(VM&, Structure*, JSFunction* callee, ScopedArgumentsTable*, JSLexicalEnvironment*, unsigned totalLength);
56
57 // Creates an arguments object and initializes everything to the empty value. Use this if you
58 // cannot guarantee that you'll immediately initialize all of the elements.
59 static ScopedArguments* create(VM&, Structure*, JSFunction* callee, ScopedArgumentsTable*, JSLexicalEnvironment*, unsigned totalLength);
60
61 // Creates an arguments object by copying the arguments from the stack.
62 static ScopedArguments* createByCopying(ExecState*, ScopedArgumentsTable*, JSLexicalEnvironment*);
63
64 // Creates an arguments object by copying the arguments from a well-defined stack location.
65 static ScopedArguments* createByCopyingFrom(VM&, Structure*, Register* argumentsStart, unsigned totalLength, JSFunction* callee, ScopedArgumentsTable*, JSLexicalEnvironment*);
66
67 static void visitChildren(JSCell*, SlotVisitor&);
68
69 uint32_t internalLength() const
70 {
71 return storageHeader().totalLength;
72 }
73
74 uint32_t length(ExecState* exec) const
75 {
76 VM& vm = exec->vm();
77 auto scope = DECLARE_THROW_SCOPE(vm);
78 if (UNLIKELY(storageHeader().overrodeThings)) {
79 auto value = get(exec, vm.propertyNames->length);
80 RETURN_IF_EXCEPTION(scope, 0);
81 RELEASE_AND_RETURN(scope, value.toUInt32(exec));
82 }
83 return internalLength();
84 }
85
86 bool isMappedArgument(uint32_t i) const
87 {
88 WriteBarrier<Unknown>* storage = overflowStorage();
89 if (i >= storageHeader(storage).totalLength)
90 return false;
91 unsigned namedLength = m_table->length();
92 if (i < namedLength)
93 return !!m_table->get(i);
94 return !!storage[i - namedLength].get();
95 }
96
97 bool isMappedArgumentInDFG(uint32_t i) const
98 {
99 return isMappedArgument(i);
100 }
101
102 JSValue getIndexQuickly(uint32_t i) const
103 {
104 ASSERT_WITH_SECURITY_IMPLICATION(isMappedArgument(i));
105 WriteBarrier<Unknown>* storage = overflowStorage();
106 unsigned totalLength = storageHeader(storage).totalLength;
107 unsigned namedLength = m_table->length();
108 if (i < namedLength)
109 return preciseIndexMaskPtr(i, totalLength, &m_scope->variableAt(m_table->get(i)))->get();
110 return preciseIndexMaskPtr(i, totalLength, storage + (i - namedLength))->get();
111 }
112
113 void setIndexQuickly(VM& vm, uint32_t i, JSValue value)
114 {
115 ASSERT_WITH_SECURITY_IMPLICATION(isMappedArgument(i));
116 WriteBarrier<Unknown>* storage = overflowStorage();
117 unsigned totalLength = storageHeader(storage).totalLength;
118 unsigned namedLength = m_table->length();
119 if (i < namedLength)
120 preciseIndexMaskPtr(i, totalLength, &m_scope->variableAt(m_table->get(i)))->set(vm, m_scope.get(), value);
121 else
122 preciseIndexMaskPtr(i, totalLength, storage + (i - namedLength))->set(vm, this, value);
123 }
124
125 JSFunction* callee()
126 {
127 return m_callee.get();
128 }
129
130 bool overrodeThings() const { return storageHeader().overrodeThings; }
131 void overrideThings(VM&);
132 void overrideThingsIfNecessary(VM&);
133 void unmapArgument(VM&, uint32_t index);
134
135 void initModifiedArgumentsDescriptorIfNecessary(VM& vm)
136 {
137 GenericArguments<ScopedArguments>::initModifiedArgumentsDescriptorIfNecessary(vm, m_table->length());
138 }
139
140 void setModifiedArgumentDescriptor(VM& vm, unsigned index)
141 {
142 GenericArguments<ScopedArguments>::setModifiedArgumentDescriptor(vm, index, m_table->length());
143 }
144
145 bool isModifiedArgumentDescriptor(unsigned index)
146 {
147 return GenericArguments<ScopedArguments>::isModifiedArgumentDescriptor(index, m_table->length());
148 }
149
150 void copyToArguments(ExecState*, VirtualRegister firstElementDest, unsigned offset, unsigned length);
151
152 DECLARE_INFO;
153
154 static Structure* createStructure(VM&, JSGlobalObject*, JSValue prototype);
155
156 static ptrdiff_t offsetOfStorage() { return OBJECT_OFFSETOF(ScopedArguments, m_storage); }
157 static ptrdiff_t offsetOfOverrodeThingsInStorage() { return OBJECT_OFFSETOF(StorageHeader, overrodeThings) - sizeof(WriteBarrier<Unknown>); }
158 static ptrdiff_t offsetOfTotalLengthInStorage() { return OBJECT_OFFSETOF(StorageHeader, totalLength) - sizeof(WriteBarrier<Unknown>); }
159 static ptrdiff_t offsetOfTable() { return OBJECT_OFFSETOF(ScopedArguments, m_table); }
160 static ptrdiff_t offsetOfScope() { return OBJECT_OFFSETOF(ScopedArguments, m_scope); }
161
162 static size_t allocationSize(size_t inlineSize)
163 {
164 RELEASE_ASSERT(!inlineSize);
165 return sizeof(ScopedArguments);
166 }
167
168 static size_t storageSize(Checked<size_t> capacity)
169 {
170 return (sizeof(WriteBarrier<Unknown>) * (capacity + static_cast<size_t>(1))).unsafeGet();
171 }
172
173 static size_t storageHeaderSize() { return sizeof(WriteBarrier<Unknown>); }
174
175private:
176 struct StorageHeader {
177 unsigned totalLength;
178 bool overrodeThings; // True if length, callee, and caller are fully materialized in the object.
179 };
180
181 WriteBarrier<Unknown>* overflowStorage() const
182 {
183 return m_storage.get();
184 }
185
186 static StorageHeader& storageHeader(WriteBarrier<Unknown>* storage)
187 {
188 static_assert(sizeof(StorageHeader) <= sizeof(WriteBarrier<Unknown>), "StorageHeader needs to be no bigger than a JSValue");
189 return *bitwise_cast<StorageHeader*>(storage - 1);
190 }
191
192 StorageHeader& storageHeader() const
193 {
194 return storageHeader(overflowStorage());
195 }
196
197 WriteBarrier<JSFunction> m_callee;
198 WriteBarrier<ScopedArgumentsTable> m_table;
199 WriteBarrier<JSLexicalEnvironment> m_scope;
200
201 AuxiliaryBarrier<WriteBarrier<Unknown>*> m_storage;
202};
203
204} // namespace JSC
205