Attachment #8767830 for bug #1016936

Attachment #8767830: (Plan B) Part 1: Throw if the value returned by iterator.next() is not an object. for bug #1016936

View | Details | Raw Unified | Return to bug 1016936
Collapse All | Expand All







// ES6 7.2.1 (previously, ES5 9.10 under the name "CheckObjectCoercible").
function RequireObjectCoercible(v) {
    if (v === undefined || v === null)
        ThrowTypeError(JSMSG_CANT_CONVERT_TO, ToString(v), "object");
}

function RequireIsObjectIteratorNext(v) {
    if (!IsObject(v))
        ThrowTypeError(JSMSG_NEXT_RETURNED_PRIMITIVE);
}

/* Spec: ECMAScript Draft, 6 edition May 22, 2014, 7.1.15 */
function ToLength(v) {
    v = ToInteger(v);

    if (v <= 0)
        return 0;

    // Math.pow(2, 53) - 1 = 0x1fffffffffffff





    if (!emit1(JSOP_DUP))                                 // ... ITER ITER
        return false;
    if (!emitAtomOp(cx->names().next, JSOP_CALLPROP))     // ... ITER NEXT
        return false;
    if (!emit1(JSOP_SWAP))                                // ... NEXT ITER
        return false;
    if (!emitCall(JSOP_CALL, 0, pn))                      // ... RESULT
        return false;
    if (!emitRequireIsObjectIteratorNext())               // ... RESULT
        return false;
    checkTypeSet(JSOP_CALL);
    return true;
}

bool
BytecodeEmitter::emitDefault(ParseNode* defaultExpr)
{
    if (!emit1(JSOP_DUP))                                 // VALUE VALUE

    if (!emitTree(pn->pn_right))
        return false;
    if (!leaveNestedScope(&stmtInfo))
        return false;
    return true;
}

bool
BytecodeEmitter::emitCallSelfHosted1AfterDup(JSAtom* func)
{
    // For simplicity, handle this in self-hosted code, at cost of 13 bytes of
    // bytecode versus 1 byte for a dedicated opcode.  As more places need this
    // behavior, we may want to reconsider this tradeoff.

#ifdef DEBUG
    auto depth = this->stackDepth;
#endif
    MOZ_ASSERT(depth > 0);                 // VAL
    if (!emit1(JSOP_DUP))                  // VAL VAL
        return false;

    // Note that "intrinsic" is a misnomer: we're calling a *self-hosted*
    // function that's not an intrinsic!  But it nonetheless works as desired.
    if (!emitAtomOp(func, JSOP_GETINTRINSIC)) // VAL VAL FUNC
        return false;
    if (!emit1(JSOP_UNDEFINED))            // VAL VAL FUNC UNDEFINED
        return false;
    if (!emit2(JSOP_PICK, 2))              // VAL FUNC UNDEFINED VAL
    if (!emit1(JSOP_UNDEFINED))            // VAL VAL REQUIREOBJECTCOERCIBLE UNDEFINED
        return false;
    if (!emit2(JSOP_PICK, 2))              // VAL REQUIREOBJECTCOERCIBLE UNDEFINED VAL
        return false;
    if (!emitCall(JSOP_CALL, 1))           // VAL IGNORED
        return false;
    checkTypeSet(JSOP_CALL);

    if (!emit1(JSOP_POP))                  // VAL
        return false;

    MOZ_ASSERT(depth == this->stackDepth);
    return true;
}

bool
BytecodeEmitter::emitRequireObjectCoercible()
{
    // For simplicity, handle this in self-hosted code, at cost of 13 bytes of
    // bytecode versus 1 byte for a dedicated opcode.  As more places need this
    // behavior, we may want to reconsider this tradeoff.

    return emitCallSelfHosted1AfterDup(cx->names().RequireObjectCoercible);
}

bool
BytecodeEmitter::emitRequireIsObjectIteratorNext()
{
    return emitCallSelfHosted1AfterDup(cx->names().RequireIsObjectIteratorNext);
}

bool
BytecodeEmitter::emitIterator()
{
    // Convert iterable to iterator.
    if (!emit1(JSOP_DUP))                                         // OBJ OBJ
        return false;
    if (!emit2(JSOP_SYMBOL, uint8_t(JS::SymbolCode::iterator)))   // OBJ OBJ @@ITERATOR
        return false;
    if (!emitElemOpBase(JSOP_CALLELEM))                           // OBJ ITERFN

    if (!emitAtomOp(cx->names().next, JSOP_CALLPROP))            // RECEIVED ITER ITER NEXT
        return false;
    if (!emit1(JSOP_SWAP))                                       // RECEIVED ITER NEXT ITER
        return false;
    if (!emit2(JSOP_PICK, 3))                                    // ITER NEXT ITER RECEIVED
        return false;
    if (!emitCall(JSOP_CALL, 1, iter))                           // ITER RESULT
        return false;
    if (!emitRequireIsObjectIteratorNext())                      // ITER RESULT
        return false;
    checkTypeSet(JSOP_CALL);
    MOZ_ASSERT(this->stackDepth == depth);

    if (!emitJumpTargetAndPatch(checkResult))                    // checkResult:
        return false;

    // if (!result.done) goto tryStart;                          // ITER RESULT
    if (!emit1(JSOP_DUP))                                        // ITER RESULT RESULT

(-)a/js/src/frontend/BytecodeEmitter.h (+8 lines)

Line	Link Here

Lines 658-677 struct BytecodeEmitter	Link Here

658

    MOZ_MUST_USE bool emitDestructuringDeclsWithEmitter(JSOp prologueOp, ParseNode* pattern);

658

    MOZ_MUST_USE bool emitDestructuringDeclsWithEmitter(JSOp prologueOp, ParseNode* pattern);

659

660

    MOZ_MUST_USE bool emitDestructuringDecls(JSOp prologueOp, ParseNode* pattern);

660

    MOZ_MUST_USE bool emitDestructuringDecls(JSOp prologueOp, ParseNode* pattern);

661

662

    // Emit code to initialize all destructured names to the value on the top of

662

    // Emit code to initialize all destructured names to the value on the top of

663

    // the stack.

663

    // the stack.

664

    MOZ_MUST_USE bool emitInitializeDestructuringDecls(JSOp prologueOp, ParseNode* pattern);

664

    MOZ_MUST_USE bool emitInitializeDestructuringDecls(JSOp prologueOp, ParseNode* pattern);

665

666

    // Helper to emit codes to call self-hosted function with the value on the

667

    // top of the stack.

668

    MOZ_MUST_USE bool emitCallSelfHosted1AfterDup(JSAtom* func);

669

666

    // Throw a TypeError if the value atop the stack isn't convertible to an

670

    // Throw a TypeError if the value atop the stack isn't convertible to an

667

    // object, with no overall effect on the stack.

671

    // object, with no overall effect on the stack.

668

    MOZ_MUST_USE bool emitRequireObjectCoercible();

672

    MOZ_MUST_USE bool emitRequireObjectCoercible();

669

673

674

    // Throw a TypeError if the value atop the stack isn't convertible to an

675

    // object, with no overall effect on the stack.

676

    MOZ_MUST_USE bool emitRequireIsObjectIteratorNext();

677

670

    // emitIterator expects the iterable to already be on the stack.

678

    // emitIterator expects the iterable to already be on the stack.

671

    // It will replace that stack value with the corresponding iterator

679

    // It will replace that stack value with the corresponding iterator

672

    MOZ_MUST_USE bool emitIterator();

680

    MOZ_MUST_USE bool emitIterator();

673

681

674

    // Pops iterator from the top of the stack. Pushes the result of |.next()|

682

    // Pops iterator from the top of the stack. Pushes the result of |.next()|

675

    // onto the stack.

683

    // onto the stack.

676

    MOZ_MUST_USE bool emitIteratorNext(ParseNode* pn, bool allowSelfHosted = false);

684

    MOZ_MUST_USE bool emitIteratorNext(ParseNode* pn, bool allowSelfHosted = false);

677

685





    macro(fulfilled, fulfilled, "fulfilled") \
    macro(rejected, rejected, "rejected") \
    macro(propertyIsEnumerable, propertyIsEnumerable, "propertyIsEnumerable") \
    macro(proto, proto, "__proto__") \
    macro(prototype, prototype, "prototype") \
    macro(proxy, proxy, "proxy") \
    macro(reason, reason, "reason") \
    macro(Reify, Reify, "Reify") \
    macro(RequireIsObjectIteratorNext, RequireIsObjectIteratorNext, "RequireIsObjectIteratorNext") \
    macro(RequireObjectCoercible, RequireObjectCoercible, "RequireObjectCoercible") \
    macro(resumeGenerator, resumeGenerator, "resumeGenerator") \
    macro(return, return_, "return") \
    macro(revoke, revoke, "revoke") \
    macro(script, script, "script") \
    macro(scripts, scripts, "scripts") \
    macro(second, second, "second") \
    macro(sensitivity, sensitivity, "sensitivity") \






    RootedValue v(cx_);
    if (!GetProperty(cx_, iterator, iterator, cx_->names().next, &v))
        return false;

    if (!js::Call(cx_, v, iterator, &v))
        return false;

    if (!v.isObject()) {
        JS_ReportErrorNumber(cx_, GetErrorMessage, nullptr, JSMSG_NEXT_RETURNED_PRIMITIVE);
        return false;
    }

    RootedObject resultObj(cx_, &v.toObject());
    if (!GetProperty(cx_, resultObj, resultObj, cx_->names().done, &v))
        return false;

    *done = ToBoolean(v);
    if (*done) {
        vp.setUndefined();
        return true;
    }

Return to bug 1016936