961 lines
34 KiB
C++
961 lines
34 KiB
C++
/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
|
|
* vim: set ts=8 sts=4 et sw=4 tw=99:
|
|
* This Source Code Form is subject to the terms of the Mozilla Public
|
|
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
|
|
|
|
#ifndef jscompartment_h
|
|
#define jscompartment_h
|
|
|
|
#include "mozilla/Maybe.h"
|
|
#include "mozilla/MemoryReporting.h"
|
|
#include "mozilla/Variant.h"
|
|
#include "mozilla/XorShift128PlusRNG.h"
|
|
|
|
#include "builtin/RegExp.h"
|
|
#include "gc/Barrier.h"
|
|
#include "gc/Zone.h"
|
|
#include "vm/GlobalObject.h"
|
|
#include "vm/PIC.h"
|
|
#include "vm/SavedStacks.h"
|
|
#include "vm/Time.h"
|
|
|
|
namespace js {
|
|
|
|
namespace jit {
|
|
class JitCompartment;
|
|
} // namespace jit
|
|
|
|
namespace gc {
|
|
template<class Node> class ComponentFinder;
|
|
} // namespace gc
|
|
|
|
struct NativeIterator;
|
|
class ClonedBlockObject;
|
|
|
|
/*
|
|
* A single-entry cache for some base-10 double-to-string conversions. This
|
|
* helps date-format-xparb.js. It also avoids skewing the results for
|
|
* v8-splay.js when measured by the SunSpider harness, where the splay tree
|
|
* initialization (which includes many repeated double-to-string conversions)
|
|
* is erroneously included in the measurement; see bug 562553.
|
|
*/
|
|
class DtoaCache {
|
|
double d;
|
|
int base;
|
|
JSFlatString* s; // if s==nullptr, d and base are not valid
|
|
|
|
public:
|
|
DtoaCache() : s(nullptr) {}
|
|
void purge() { s = nullptr; }
|
|
|
|
JSFlatString* lookup(int base, double d) {
|
|
return this->s && base == this->base && d == this->d ? this->s : nullptr;
|
|
}
|
|
|
|
void cache(int base, double d, JSFlatString* s) {
|
|
this->base = base;
|
|
this->d = d;
|
|
this->s = s;
|
|
}
|
|
};
|
|
|
|
struct CrossCompartmentKey
|
|
{
|
|
enum Kind {
|
|
ObjectWrapper,
|
|
StringWrapper,
|
|
DebuggerScript,
|
|
DebuggerSource,
|
|
DebuggerObject,
|
|
DebuggerEnvironment
|
|
};
|
|
|
|
Kind kind;
|
|
JSObject* debugger;
|
|
js::gc::Cell* wrapped;
|
|
|
|
explicit CrossCompartmentKey(JSObject* wrapped)
|
|
: kind(ObjectWrapper), debugger(nullptr), wrapped(wrapped)
|
|
{
|
|
MOZ_RELEASE_ASSERT(wrapped);
|
|
}
|
|
explicit CrossCompartmentKey(JSString* wrapped)
|
|
: kind(StringWrapper), debugger(nullptr), wrapped(wrapped)
|
|
{
|
|
MOZ_RELEASE_ASSERT(wrapped);
|
|
}
|
|
explicit CrossCompartmentKey(Value wrappedArg)
|
|
: kind(wrappedArg.isString() ? StringWrapper : ObjectWrapper),
|
|
debugger(nullptr),
|
|
wrapped((js::gc::Cell*)wrappedArg.toGCThing())
|
|
{
|
|
MOZ_RELEASE_ASSERT(wrappedArg.isString() || wrappedArg.isObject());
|
|
MOZ_RELEASE_ASSERT(wrapped);
|
|
}
|
|
explicit CrossCompartmentKey(const RootedValue& wrappedArg)
|
|
: kind(wrappedArg.get().isString() ? StringWrapper : ObjectWrapper),
|
|
debugger(nullptr),
|
|
wrapped((js::gc::Cell*)wrappedArg.get().toGCThing())
|
|
{
|
|
MOZ_RELEASE_ASSERT(wrappedArg.isString() || wrappedArg.isObject());
|
|
MOZ_RELEASE_ASSERT(wrapped);
|
|
}
|
|
CrossCompartmentKey(Kind kind, JSObject* dbg, js::gc::Cell* wrapped)
|
|
: kind(kind), debugger(dbg), wrapped(wrapped)
|
|
{
|
|
MOZ_RELEASE_ASSERT(dbg);
|
|
MOZ_RELEASE_ASSERT(wrapped);
|
|
}
|
|
|
|
private:
|
|
CrossCompartmentKey() = delete;
|
|
};
|
|
|
|
struct WrapperHasher : public DefaultHasher<CrossCompartmentKey>
|
|
{
|
|
static HashNumber hash(const CrossCompartmentKey& key) {
|
|
static_assert(sizeof(HashNumber) == sizeof(uint32_t),
|
|
"subsequent code assumes a four-byte hash");
|
|
return uint32_t(uintptr_t(key.wrapped)) | uint32_t(key.kind);
|
|
}
|
|
|
|
static bool match(const CrossCompartmentKey& l, const CrossCompartmentKey& k) {
|
|
return l.kind == k.kind && l.debugger == k.debugger && l.wrapped == k.wrapped;
|
|
}
|
|
};
|
|
|
|
typedef HashMap<CrossCompartmentKey, ReadBarrieredValue,
|
|
WrapperHasher, SystemAllocPolicy> WrapperMap;
|
|
|
|
// We must ensure that all newly allocated JSObjects get their metadata
|
|
// set. However, metadata callbacks may require the new object be in a sane
|
|
// state (eg, have its reserved slots initialized so they can get the
|
|
// sizeOfExcludingThis of the object). Therefore, for objects of certain
|
|
// JSClasses (those marked with JSCLASS_DELAY_METADATA_CALLBACK), it is not safe
|
|
// for the allocation paths to call the object metadata callback
|
|
// immediately. Instead, the JSClass-specific "constructor" C++ function up the
|
|
// stack makes a promise that it will ensure that the new object has its
|
|
// metadata set after the object is initialized.
|
|
//
|
|
// To help those constructor functions keep their promise of setting metadata,
|
|
// each compartment is in one of three states at any given time:
|
|
//
|
|
// * ImmediateMetadata: Allocators should set new object metadata immediately,
|
|
// as usual.
|
|
//
|
|
// * DelayMetadata: Allocators should *not* set new object metadata, it will be
|
|
// handled after reserved slots are initialized by custom code
|
|
// for the object's JSClass. The newly allocated object's
|
|
// JSClass *must* have the JSCLASS_DELAY_METADATA_CALLBACK flag
|
|
// set.
|
|
//
|
|
// * PendingMetadata: This object has been allocated and is still pending its
|
|
// metadata. This should never be the case when we begin an
|
|
// allocation, as a constructor function was supposed to have
|
|
// set the metadata of the previous object *before*
|
|
// allocating another object.
|
|
//
|
|
// The js::AutoSetNewObjectMetadata RAII class provides an ergonomic way for
|
|
// constructor functions to navigate state transitions, and its instances
|
|
// collectively maintain a stack of previous states. The stack is required to
|
|
// support the lazy resolution and allocation of global builtin constructors and
|
|
// prototype objects. The initial (and intuitively most common) state is
|
|
// ImmediateMetadata.
|
|
//
|
|
// Without the presence of internal errors (such as OOM), transitions between
|
|
// the states are as follows:
|
|
//
|
|
// ImmediateMetadata .----- previous state on stack
|
|
// | | ^
|
|
// | via constructor | |
|
|
// | | | via setting the new
|
|
// | via constructor | | object's metadata
|
|
// | .-----------------------' |
|
|
// | | |
|
|
// V V |
|
|
// DelayMetadata -------------------------> PendingMetadata
|
|
// via allocation
|
|
//
|
|
// In the presence of internal errors, we do not set the new object's metadata
|
|
// (if it was even allocated) and reset to the previous state on the stack.
|
|
|
|
struct ImmediateMetadata { };
|
|
struct DelayMetadata { };
|
|
using PendingMetadata = ReadBarrieredObject;
|
|
|
|
using NewObjectMetadataState = mozilla::Variant<ImmediateMetadata,
|
|
DelayMetadata,
|
|
PendingMetadata>;
|
|
|
|
class MOZ_RAII AutoSetNewObjectMetadata : private JS::CustomAutoRooter
|
|
{
|
|
MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER;
|
|
|
|
JSContext* cx_;
|
|
NewObjectMetadataState prevState_;
|
|
|
|
AutoSetNewObjectMetadata(const AutoSetNewObjectMetadata& aOther) = delete;
|
|
void operator=(const AutoSetNewObjectMetadata& aOther) = delete;
|
|
|
|
protected:
|
|
virtual void trace(JSTracer* trc) override {
|
|
if (prevState_.is<PendingMetadata>()) {
|
|
TraceRoot(trc,
|
|
prevState_.as<PendingMetadata>().unsafeUnbarrieredForTracing(),
|
|
"Object pending metadata");
|
|
}
|
|
}
|
|
|
|
public:
|
|
explicit AutoSetNewObjectMetadata(ExclusiveContext* ecx MOZ_GUARD_OBJECT_NOTIFIER_PARAM);
|
|
~AutoSetNewObjectMetadata();
|
|
};
|
|
|
|
} /* namespace js */
|
|
|
|
namespace js {
|
|
class DebugScopes;
|
|
class ObjectWeakMap;
|
|
class WatchpointMap;
|
|
class WeakMapBase;
|
|
} // namespace js
|
|
|
|
struct JSCompartment
|
|
{
|
|
JS::CompartmentOptions options_;
|
|
|
|
private:
|
|
JS::Zone* zone_;
|
|
JSRuntime* runtime_;
|
|
|
|
public:
|
|
/*
|
|
* The principals associated with this compartment. Note that the
|
|
* same several compartments may share the same principals and
|
|
* that a compartment may change principals during its lifetime
|
|
* (e.g. in case of lazy parsing).
|
|
*/
|
|
inline JSPrincipals* principals() {
|
|
return principals_;
|
|
}
|
|
inline void setPrincipals(JSPrincipals* principals) {
|
|
if (principals_ == principals)
|
|
return;
|
|
|
|
// If we change principals, we need to unlink immediately this
|
|
// compartment from its PerformanceGroup. For one thing, the
|
|
// performance data we collect should not be improperly associated
|
|
// with a group to which we do not belong anymore. For another thing,
|
|
// we use `principals()` as part of the key to map compartments
|
|
// to a `PerformanceGroup`, so if we do not unlink now, this will
|
|
// be too late once we have updated `principals_`.
|
|
performanceMonitoring.unlink();
|
|
principals_ = principals;
|
|
}
|
|
inline bool isSystem() const {
|
|
return isSystem_;
|
|
}
|
|
inline void setIsSystem(bool isSystem) {
|
|
if (isSystem_ == isSystem)
|
|
return;
|
|
|
|
// If we change `isSystem*(`, we need to unlink immediately this
|
|
// compartment from its PerformanceGroup. For one thing, the
|
|
// performance data we collect should not be improperly associated
|
|
// to a group to which we do not belong anymore. For another thing,
|
|
// we use `isSystem()` as part of the key to map compartments
|
|
// to a `PerformanceGroup`, so if we do not unlink now, this will
|
|
// be too late once we have updated `isSystem_`.
|
|
performanceMonitoring.unlink();
|
|
isSystem_ = isSystem;
|
|
}
|
|
|
|
bool isAtomsCompartment() const {
|
|
return isAtomsCompartment_;
|
|
}
|
|
void setIsAtomsCompartment() {
|
|
isAtomsCompartment_ = true;
|
|
}
|
|
|
|
private:
|
|
JSPrincipals* principals_;
|
|
bool isSystem_;
|
|
bool isAtomsCompartment_;
|
|
|
|
public:
|
|
bool isSelfHosting;
|
|
bool marked;
|
|
bool warnedAboutFlagsArgument;
|
|
bool warnedAboutExprClosure;
|
|
bool warnedAboutAsyncFuncs;
|
|
|
|
// A null add-on ID means that the compartment is not associated with an
|
|
// add-on.
|
|
JSAddonId* const addonId;
|
|
|
|
#ifdef DEBUG
|
|
bool firedOnNewGlobalObject;
|
|
#endif
|
|
|
|
void mark() { marked = true; }
|
|
|
|
private:
|
|
friend struct JSRuntime;
|
|
friend struct JSContext;
|
|
friend class js::ExclusiveContext;
|
|
js::ReadBarrieredGlobalObject global_;
|
|
|
|
unsigned enterCompartmentDepth;
|
|
int64_t startInterval;
|
|
|
|
public:
|
|
js::PerformanceGroupHolder performanceMonitoring;
|
|
|
|
void enter() {
|
|
enterCompartmentDepth++;
|
|
}
|
|
void leave() {
|
|
enterCompartmentDepth--;
|
|
}
|
|
bool hasBeenEntered() { return !!enterCompartmentDepth; }
|
|
|
|
JS::Zone* zone() { return zone_; }
|
|
const JS::Zone* zone() const { return zone_; }
|
|
JS::CompartmentOptions& options() { return options_; }
|
|
const JS::CompartmentOptions& options() const { return options_; }
|
|
|
|
JSRuntime* runtimeFromMainThread() {
|
|
MOZ_ASSERT(CurrentThreadCanAccessRuntime(runtime_));
|
|
return runtime_;
|
|
}
|
|
|
|
// Note: Unrestricted access to the zone's runtime from an arbitrary
|
|
// thread can easily lead to races. Use this method very carefully.
|
|
JSRuntime* runtimeFromAnyThread() const {
|
|
return runtime_;
|
|
}
|
|
|
|
/*
|
|
* Nb: global_ might be nullptr, if (a) it's the atoms compartment, or
|
|
* (b) the compartment's global has been collected. The latter can happen
|
|
* if e.g. a string in a compartment is rooted but no object is, and thus
|
|
* the global isn't rooted, and thus the global can be finalized while the
|
|
* compartment lives on.
|
|
*
|
|
* In contrast, JSObject::global() is infallible because marking a JSObject
|
|
* always marks its global as well.
|
|
* TODO: add infallible JSScript::global()
|
|
*/
|
|
inline js::GlobalObject* maybeGlobal() const;
|
|
|
|
/* An unbarriered getter for use while tracing. */
|
|
inline js::GlobalObject* unsafeUnbarrieredMaybeGlobal() const;
|
|
|
|
inline void initGlobal(js::GlobalObject& global);
|
|
|
|
public:
|
|
void* data;
|
|
|
|
private:
|
|
js::ObjectMetadataCallback objectMetadataCallback;
|
|
|
|
js::SavedStacks savedStacks_;
|
|
|
|
js::WrapperMap crossCompartmentWrappers;
|
|
|
|
public:
|
|
/* Last time at which an animation was played for a global in this compartment. */
|
|
int64_t lastAnimationTime;
|
|
|
|
js::RegExpCompartment regExps;
|
|
|
|
/*
|
|
* For generational GC, record whether a write barrier has added this
|
|
* compartment's global to the store buffer since the last minor GC.
|
|
*
|
|
* This is used to avoid adding it to the store buffer on every write, which
|
|
* can quickly fill the buffer and also cause performance problems.
|
|
*/
|
|
bool globalWriteBarriered;
|
|
|
|
// Non-zero if any typed objects in this compartment might be neutered.
|
|
int32_t neuteredTypedObjects;
|
|
|
|
private:
|
|
friend class js::AutoSetNewObjectMetadata;
|
|
js::NewObjectMetadataState objectMetadataState;
|
|
|
|
public:
|
|
// Recompute the probability with which this compartment should record
|
|
// profiling data (stack traces, allocations log, etc.) about each
|
|
// allocation. We consult the probabilities requested by the Debugger
|
|
// instances observing us, if any.
|
|
void chooseAllocationSamplingProbability() { savedStacks_.chooseSamplingProbability(this); }
|
|
|
|
bool hasObjectPendingMetadata() const { return objectMetadataState.is<js::PendingMetadata>(); }
|
|
|
|
void setObjectPendingMetadata(JSContext* cx, JSObject* obj) {
|
|
MOZ_ASSERT(objectMetadataState.is<js::DelayMetadata>());
|
|
objectMetadataState = js::NewObjectMetadataState(js::PendingMetadata(obj));
|
|
}
|
|
|
|
void setObjectPendingMetadata(js::ExclusiveContext* ecx, JSObject* obj) {
|
|
if (JSContext* cx = ecx->maybeJSContext())
|
|
setObjectPendingMetadata(cx, obj);
|
|
}
|
|
|
|
public:
|
|
void addSizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf,
|
|
size_t* tiAllocationSiteTables,
|
|
size_t* tiArrayTypeTables,
|
|
size_t* tiObjectTypeTables,
|
|
size_t* compartmentObject,
|
|
size_t* compartmentTables,
|
|
size_t* innerViews,
|
|
size_t* lazyArrayBuffers,
|
|
size_t* objectMetadataTables,
|
|
size_t* crossCompartmentWrappers,
|
|
size_t* regexpCompartment,
|
|
size_t* savedStacksSet,
|
|
size_t* nonSyntacticLexicalScopes);
|
|
|
|
/*
|
|
* Shared scope property tree, and arena-pool for allocating its nodes.
|
|
*/
|
|
js::PropertyTree propertyTree;
|
|
|
|
/* Set of all unowned base shapes in the compartment. */
|
|
js::BaseShapeSet baseShapes;
|
|
void sweepBaseShapeTable();
|
|
|
|
/* Set of initial shapes in the compartment. */
|
|
js::InitialShapeSet initialShapes;
|
|
void sweepInitialShapeTable();
|
|
|
|
// Object group tables and other state in the compartment.
|
|
js::ObjectGroupCompartment objectGroups;
|
|
|
|
#ifdef JSGC_HASH_TABLE_CHECKS
|
|
void checkInitialShapesTableAfterMovingGC();
|
|
void checkWrapperMapAfterMovingGC();
|
|
void checkBaseShapeTableAfterMovingGC();
|
|
#endif
|
|
|
|
/*
|
|
* Lazily initialized script source object to use for scripts cloned
|
|
* from the self-hosting global.
|
|
*/
|
|
js::ReadBarrieredScriptSourceObject selfHostingScriptSource;
|
|
|
|
// Keep track of the metadata objects which can be associated with each JS
|
|
// object. Both keys and values are in this compartment.
|
|
js::ObjectWeakMap* objectMetadataTable;
|
|
|
|
// Map from array buffers to views sharing that storage.
|
|
js::InnerViewTable innerViews;
|
|
|
|
// Inline transparent typed objects do not initially have an array buffer,
|
|
// but can have that buffer created lazily if it is accessed later. This
|
|
// table manages references from such typed objects to their buffers.
|
|
js::ObjectWeakMap* lazyArrayBuffers;
|
|
|
|
// All unboxed layouts in the compartment.
|
|
mozilla::LinkedList<js::UnboxedLayout> unboxedLayouts;
|
|
|
|
private:
|
|
// All non-syntactic lexical scopes in the compartment. These are kept in
|
|
// a map because when loading scripts into a non-syntactic scope, we need
|
|
// to use the same lexical scope to persist lexical bindings.
|
|
js::ObjectWeakMap* nonSyntacticLexicalScopes_;
|
|
|
|
public:
|
|
/* During GC, stores the index of this compartment in rt->compartments. */
|
|
unsigned gcIndex;
|
|
|
|
/*
|
|
* During GC, stores the head of a list of incoming pointers from gray cells.
|
|
*
|
|
* The objects in the list are either cross-compartment wrappers, or
|
|
* debugger wrapper objects. The list link is either in the second extra
|
|
* slot for the former, or a special slot for the latter.
|
|
*/
|
|
JSObject* gcIncomingGrayPointers;
|
|
|
|
private:
|
|
/* Whether to preserve JIT code on non-shrinking GCs. */
|
|
bool gcPreserveJitCode;
|
|
|
|
enum {
|
|
IsDebuggee = 1 << 0,
|
|
DebuggerObservesAllExecution = 1 << 1,
|
|
DebuggerObservesAsmJS = 1 << 2,
|
|
DebuggerObservesCoverage = 1 << 3,
|
|
DebuggerNeedsDelazification = 1 << 4
|
|
};
|
|
|
|
unsigned debugModeBits;
|
|
|
|
static const unsigned DebuggerObservesMask = IsDebuggee |
|
|
DebuggerObservesAllExecution |
|
|
DebuggerObservesCoverage |
|
|
DebuggerObservesAsmJS;
|
|
|
|
void updateDebuggerObservesFlag(unsigned flag);
|
|
|
|
public:
|
|
JSCompartment(JS::Zone* zone, const JS::CompartmentOptions& options);
|
|
~JSCompartment();
|
|
|
|
bool init(JSContext* maybecx);
|
|
|
|
inline bool wrap(JSContext* cx, JS::MutableHandleValue vp,
|
|
JS::HandleObject existing = nullptr);
|
|
|
|
bool wrap(JSContext* cx, js::MutableHandleString strp);
|
|
bool wrap(JSContext* cx, JS::MutableHandleObject obj,
|
|
JS::HandleObject existingArg = nullptr);
|
|
bool wrap(JSContext* cx, JS::MutableHandle<js::PropertyDescriptor> desc);
|
|
|
|
template<typename T> bool wrap(JSContext* cx, JS::AutoVectorRooter<T>& vec) {
|
|
for (size_t i = 0; i < vec.length(); ++i) {
|
|
if (!wrap(cx, vec[i]))
|
|
return false;
|
|
}
|
|
return true;
|
|
};
|
|
|
|
bool putWrapper(JSContext* cx, const js::CrossCompartmentKey& wrapped, const js::Value& wrapper);
|
|
|
|
js::WrapperMap::Ptr lookupWrapper(const js::Value& wrapped) const {
|
|
return crossCompartmentWrappers.lookup(js::CrossCompartmentKey(wrapped));
|
|
}
|
|
|
|
void removeWrapper(js::WrapperMap::Ptr p) {
|
|
crossCompartmentWrappers.remove(p);
|
|
}
|
|
|
|
struct WrapperEnum : public js::WrapperMap::Enum {
|
|
explicit WrapperEnum(JSCompartment* c) : js::WrapperMap::Enum(c->crossCompartmentWrappers) {}
|
|
};
|
|
|
|
js::ClonedBlockObject* getOrCreateNonSyntacticLexicalScope(JSContext* cx,
|
|
js::HandleObject enclosingStatic,
|
|
js::HandleObject enclosingScope);
|
|
js::ClonedBlockObject* getNonSyntacticLexicalScope(JSObject* enclosingScope) const;
|
|
|
|
/*
|
|
* This method traces data that is live iff we know that this compartment's
|
|
* global is still live.
|
|
*/
|
|
void trace(JSTracer* trc);
|
|
/*
|
|
* This method traces JSCompartment-owned GC roots that are considered live
|
|
* regardless of whether the JSCompartment itself is still live.
|
|
*/
|
|
void traceRoots(JSTracer* trc, js::gc::GCRuntime::TraceOrMarkRuntime traceOrMark);
|
|
/*
|
|
* These methods mark pointers that cross compartment boundaries. They are
|
|
* called in per-zone GCs to prevent the wrappers' outgoing edges from
|
|
* dangling (full GCs naturally follow pointers across compartments) and
|
|
* when compacting to update cross-compartment pointers.
|
|
*/
|
|
void traceOutgoingCrossCompartmentWrappers(JSTracer* trc);
|
|
static void traceIncomingCrossCompartmentEdgesForZoneGC(JSTracer* trc);
|
|
|
|
bool preserveJitCode() { return gcPreserveJitCode; }
|
|
|
|
void sweepAfterMinorGC();
|
|
|
|
void sweepInnerViews();
|
|
void sweepCrossCompartmentWrappers();
|
|
void sweepSavedStacks();
|
|
void sweepGlobalObject(js::FreeOp* fop);
|
|
void sweepObjectPendingMetadata();
|
|
void sweepSelfHostingScriptSource();
|
|
void sweepJitCompartment(js::FreeOp* fop);
|
|
void sweepRegExps();
|
|
void sweepDebugScopes();
|
|
void sweepNativeIterators();
|
|
void sweepTemplateObjects();
|
|
|
|
void purge();
|
|
void clearTables();
|
|
|
|
static void fixupCrossCompartmentWrappersAfterMovingGC(JSTracer* trc);
|
|
void fixupInitialShapeTable();
|
|
void fixupAfterMovingGC();
|
|
void fixupGlobal();
|
|
|
|
bool hasObjectMetadataCallback() const { return objectMetadataCallback; }
|
|
js::ObjectMetadataCallback getObjectMetadataCallback() const { return objectMetadataCallback; }
|
|
void setObjectMetadataCallback(js::ObjectMetadataCallback callback);
|
|
void forgetObjectMetadataCallback() {
|
|
objectMetadataCallback = nullptr;
|
|
}
|
|
void setNewObjectMetadata(JSContext* cx, JSObject* obj);
|
|
void clearObjectMetadata();
|
|
const void* addressOfMetadataCallback() const {
|
|
return &objectMetadataCallback;
|
|
}
|
|
|
|
js::SavedStacks& savedStacks() { return savedStacks_; }
|
|
|
|
void findOutgoingEdges(js::gc::ComponentFinder<JS::Zone>& finder);
|
|
|
|
MOZ_MUST_USE bool findDeadProxyZoneEdges(bool* foundAny);
|
|
|
|
js::DtoaCache dtoaCache;
|
|
|
|
// Random number generator for Math.random().
|
|
mozilla::Maybe<mozilla::non_crypto::XorShift128PlusRNG> randomNumberGenerator;
|
|
|
|
// Initialize randomNumberGenerator if needed.
|
|
void ensureRandomNumberGenerator();
|
|
|
|
private:
|
|
mozilla::non_crypto::XorShift128PlusRNG randomKeyGenerator_;
|
|
|
|
public:
|
|
js::HashNumber randomHashCode();
|
|
|
|
mozilla::HashCodeScrambler randomHashCodeScrambler();
|
|
|
|
private:
|
|
JSCompartment* thisForCtor() { return this; }
|
|
|
|
public:
|
|
//
|
|
// The Debugger observes execution on a frame-by-frame basis. The
|
|
// invariants of JSCompartment's debug mode bits, JSScript::isDebuggee,
|
|
// InterpreterFrame::isDebuggee, and BaselineFrame::isDebuggee are
|
|
// enumerated below.
|
|
//
|
|
// 1. When a compartment's isDebuggee() == true, relazification and lazy
|
|
// parsing are disabled.
|
|
//
|
|
// Whether AOT asm.js is disabled is togglable by the Debugger API. By
|
|
// default it is disabled. See debuggerObservesAsmJS below.
|
|
//
|
|
// 2. When a compartment's debuggerObservesAllExecution() == true, all of
|
|
// the compartment's scripts are considered debuggee scripts.
|
|
//
|
|
// 3. A script is considered a debuggee script either when, per above, its
|
|
// compartment is observing all execution, or if it has breakpoints set.
|
|
//
|
|
// 4. A debuggee script always pushes a debuggee frame.
|
|
//
|
|
// 5. A debuggee frame calls all slow path Debugger hooks in the
|
|
// Interpreter and Baseline. A debuggee frame implies that its script's
|
|
// BaselineScript, if extant, has been compiled with debug hook calls.
|
|
//
|
|
// 6. A debuggee script or a debuggee frame (i.e., during OSR) ensures
|
|
// that the compiled BaselineScript is compiled with debug hook calls
|
|
// when attempting to enter Baseline.
|
|
//
|
|
// 7. A debuggee script or a debuggee frame (i.e., during OSR) does not
|
|
// attempt to enter Ion.
|
|
//
|
|
// Note that a debuggee frame may exist without its script being a
|
|
// debuggee script. e.g., Debugger.Frame.prototype.eval only marks the
|
|
// frame in which it is evaluating as a debuggee frame.
|
|
//
|
|
|
|
// True if this compartment's global is a debuggee of some Debugger
|
|
// object.
|
|
bool isDebuggee() const { return !!(debugModeBits & IsDebuggee); }
|
|
void setIsDebuggee() { debugModeBits |= IsDebuggee; }
|
|
void unsetIsDebuggee();
|
|
|
|
// True if this compartment's global is a debuggee of some Debugger
|
|
// object with a live hook that observes all execution; e.g.,
|
|
// onEnterFrame.
|
|
bool debuggerObservesAllExecution() const {
|
|
static const unsigned Mask = IsDebuggee | DebuggerObservesAllExecution;
|
|
return (debugModeBits & Mask) == Mask;
|
|
}
|
|
void updateDebuggerObservesAllExecution() {
|
|
updateDebuggerObservesFlag(DebuggerObservesAllExecution);
|
|
}
|
|
|
|
// True if this compartment's global is a debuggee of some Debugger object
|
|
// whose allowUnobservedAsmJS flag is false.
|
|
//
|
|
// Note that since AOT asm.js functions cannot bail out, this flag really
|
|
// means "observe asm.js from this point forward". We cannot make
|
|
// already-compiled asm.js code observable to Debugger.
|
|
bool debuggerObservesAsmJS() const {
|
|
static const unsigned Mask = IsDebuggee | DebuggerObservesAsmJS;
|
|
return (debugModeBits & Mask) == Mask;
|
|
}
|
|
void updateDebuggerObservesAsmJS() {
|
|
updateDebuggerObservesFlag(DebuggerObservesAsmJS);
|
|
}
|
|
|
|
// True if this compartment's global is a debuggee of some Debugger object
|
|
// whose collectCoverageInfo flag is true.
|
|
bool debuggerObservesCoverage() const {
|
|
static const unsigned Mask = DebuggerObservesCoverage;
|
|
return (debugModeBits & Mask) == Mask;
|
|
}
|
|
void updateDebuggerObservesCoverage();
|
|
|
|
// The code coverage can be enabled either for each compartment, with the
|
|
// Debugger API, or for the entire runtime.
|
|
bool collectCoverage() const;
|
|
void clearScriptCounts();
|
|
|
|
bool needsDelazificationForDebugger() const {
|
|
return debugModeBits & DebuggerNeedsDelazification;
|
|
}
|
|
|
|
/*
|
|
* Schedule the compartment to be delazified. Called from
|
|
* LazyScript::Create.
|
|
*/
|
|
void scheduleDelazificationForDebugger() { debugModeBits |= DebuggerNeedsDelazification; }
|
|
|
|
/*
|
|
* If we scheduled delazification for turning on debug mode, delazify all
|
|
* scripts.
|
|
*/
|
|
bool ensureDelazifyScriptsForDebugger(JSContext* cx);
|
|
|
|
void clearBreakpointsIn(js::FreeOp* fop, js::Debugger* dbg, JS::HandleObject handler);
|
|
|
|
private:
|
|
void sweepBreakpoints(js::FreeOp* fop);
|
|
|
|
public:
|
|
js::WatchpointMap* watchpointMap;
|
|
|
|
js::ScriptCountsMap* scriptCountsMap;
|
|
|
|
js::DebugScriptMap* debugScriptMap;
|
|
|
|
/* Bookkeeping information for debug scope objects. */
|
|
js::DebugScopes* debugScopes;
|
|
|
|
/*
|
|
* List of potentially active iterators that may need deleted property
|
|
* suppression.
|
|
*/
|
|
js::NativeIterator* enumerators;
|
|
|
|
/* Used by memory reporters and invalid otherwise. */
|
|
void* compartmentStats;
|
|
|
|
// These flags help us to discover if a compartment that shouldn't be alive
|
|
// manages to outlive a GC.
|
|
bool scheduledForDestruction;
|
|
bool maybeAlive;
|
|
|
|
private:
|
|
js::jit::JitCompartment* jitCompartment_;
|
|
|
|
js::ReadBarriered<js::ArgumentsObject*> mappedArgumentsTemplate_;
|
|
js::ReadBarriered<js::ArgumentsObject*> unmappedArgumentsTemplate_;
|
|
|
|
public:
|
|
bool ensureJitCompartmentExists(JSContext* cx);
|
|
js::jit::JitCompartment* jitCompartment() {
|
|
return jitCompartment_;
|
|
}
|
|
|
|
enum DeprecatedLanguageExtension {
|
|
DeprecatedForEach = 0, // JS 1.6+
|
|
// NO LONGER USING 1
|
|
DeprecatedLegacyGenerator = 2, // JS 1.7+
|
|
DeprecatedExpressionClosure = 3, // Added in JS 1.8
|
|
// NO LONGER USING 4
|
|
// NO LONGER USING 5
|
|
// NO LONGER USING 6
|
|
DeprecatedFlagsArgument = 7, // JS 1.3 or older
|
|
// NO LONGER USING 8
|
|
// NO LONGER USING 9
|
|
DeprecatedBlockScopeFunRedecl = 10,
|
|
DeprecatedLanguageExtensionCount
|
|
};
|
|
|
|
js::ArgumentsObject* getOrCreateArgumentsTemplateObject(JSContext* cx, bool mapped);
|
|
|
|
private:
|
|
// Used for collecting telemetry on SpiderMonkey's deprecated language extensions.
|
|
bool sawDeprecatedLanguageExtension[DeprecatedLanguageExtensionCount];
|
|
|
|
void reportTelemetry();
|
|
|
|
public:
|
|
void addTelemetry(const char* filename, DeprecatedLanguageExtension e);
|
|
|
|
public:
|
|
// Aggregated output used to collect JSScript hit counts when code coverage
|
|
// is enabled.
|
|
js::coverage::LCovCompartment lcovOutput;
|
|
};
|
|
|
|
inline bool
|
|
JSRuntime::isAtomsZone(const JS::Zone* zone) const
|
|
{
|
|
return zone == atomsCompartment_->zone();
|
|
}
|
|
|
|
namespace js {
|
|
|
|
// We only set the maybeAlive flag for objects and scripts. It's assumed that,
|
|
// if a compartment is alive, then it will have at least some live object or
|
|
// script it in. Even if we get this wrong, the worst that will happen is that
|
|
// scheduledForDestruction will be set on the compartment, which will cause
|
|
// some extra GC activity to try to free the compartment.
|
|
template<typename T> inline void SetMaybeAliveFlag(T* thing) {}
|
|
template<> inline void SetMaybeAliveFlag(JSObject* thing) {thing->compartment()->maybeAlive = true;}
|
|
template<> inline void SetMaybeAliveFlag(JSScript* thing) {thing->compartment()->maybeAlive = true;}
|
|
|
|
inline js::Handle<js::GlobalObject*>
|
|
ExclusiveContext::global() const
|
|
{
|
|
/*
|
|
* It's safe to use |unsafeGet()| here because any compartment that is
|
|
* on-stack will be marked automatically, so there's no need for a read
|
|
* barrier on it. Once the compartment is popped, the handle is no longer
|
|
* safe to use.
|
|
*/
|
|
MOZ_ASSERT(compartment_, "Caller needs to enter a compartment first");
|
|
return Handle<GlobalObject*>::fromMarkedLocation(compartment_->global_.unsafeGet());
|
|
}
|
|
|
|
class MOZ_RAII AssertCompartmentUnchanged
|
|
{
|
|
public:
|
|
explicit AssertCompartmentUnchanged(JSContext* cx
|
|
MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
|
|
: cx(cx), oldCompartment(cx->compartment())
|
|
{
|
|
MOZ_GUARD_OBJECT_NOTIFIER_INIT;
|
|
}
|
|
|
|
~AssertCompartmentUnchanged() {
|
|
MOZ_ASSERT(cx->compartment() == oldCompartment);
|
|
}
|
|
|
|
protected:
|
|
JSContext * const cx;
|
|
JSCompartment * const oldCompartment;
|
|
MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER
|
|
};
|
|
|
|
class AutoCompartment
|
|
{
|
|
ExclusiveContext * const cx_;
|
|
JSCompartment * const origin_;
|
|
|
|
public:
|
|
inline AutoCompartment(ExclusiveContext* cx, JSObject* target);
|
|
inline AutoCompartment(ExclusiveContext* cx, JSCompartment* target);
|
|
inline ~AutoCompartment();
|
|
|
|
ExclusiveContext* context() const { return cx_; }
|
|
JSCompartment* origin() const { return origin_; }
|
|
|
|
private:
|
|
AutoCompartment(const AutoCompartment&) = delete;
|
|
AutoCompartment & operator=(const AutoCompartment&) = delete;
|
|
};
|
|
|
|
/*
|
|
* Use this to change the behavior of an AutoCompartment slightly on error. If
|
|
* the exception happens to be an Error object, copy it to the origin compartment
|
|
* instead of wrapping it.
|
|
*/
|
|
class ErrorCopier
|
|
{
|
|
mozilla::Maybe<AutoCompartment>& ac;
|
|
|
|
public:
|
|
explicit ErrorCopier(mozilla::Maybe<AutoCompartment>& ac)
|
|
: ac(ac) {}
|
|
~ErrorCopier();
|
|
};
|
|
|
|
/*
|
|
* AutoWrapperVector and AutoWrapperRooter can be used to store wrappers that
|
|
* are obtained from the cross-compartment map. However, these classes should
|
|
* not be used if the wrapper will escape. For example, it should not be stored
|
|
* in the heap.
|
|
*
|
|
* The AutoWrapper rooters are different from other autorooters because their
|
|
* wrappers are marked on every GC slice rather than just the first one. If
|
|
* there's some wrapper that we want to use temporarily without causing it to be
|
|
* marked, we can use these AutoWrapper classes. If we get unlucky and a GC
|
|
* slice runs during the code using the wrapper, the GC will mark the wrapper so
|
|
* that it doesn't get swept out from under us. Otherwise, the wrapper needn't
|
|
* be marked. This is useful in functions like JS_TransplantObject that
|
|
* manipulate wrappers in compartments that may no longer be alive.
|
|
*/
|
|
|
|
/*
|
|
* This class stores the data for AutoWrapperVector and AutoWrapperRooter. It
|
|
* should not be used in any other situations.
|
|
*/
|
|
struct WrapperValue
|
|
{
|
|
/*
|
|
* We use unsafeGet() in the constructors to avoid invoking a read barrier
|
|
* on the wrapper, which may be dead (see the comment about bug 803376 in
|
|
* jsgc.cpp regarding this). If there is an incremental GC while the wrapper
|
|
* is in use, the AutoWrapper rooter will ensure the wrapper gets marked.
|
|
*/
|
|
explicit WrapperValue(const WrapperMap::Ptr& ptr)
|
|
: value(*ptr->value().unsafeGet())
|
|
{}
|
|
|
|
explicit WrapperValue(const WrapperMap::Enum& e)
|
|
: value(*e.front().value().unsafeGet())
|
|
{}
|
|
|
|
Value& get() { return value; }
|
|
Value get() const { return value; }
|
|
operator const Value&() const { return value; }
|
|
JSObject& toObject() const { return value.toObject(); }
|
|
|
|
private:
|
|
Value value;
|
|
};
|
|
|
|
class MOZ_RAII AutoWrapperVector : public JS::AutoVectorRooterBase<WrapperValue>
|
|
{
|
|
public:
|
|
explicit AutoWrapperVector(JSContext* cx
|
|
MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
|
|
: AutoVectorRooterBase<WrapperValue>(cx, WRAPVECTOR)
|
|
{
|
|
MOZ_GUARD_OBJECT_NOTIFIER_INIT;
|
|
}
|
|
|
|
MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER
|
|
};
|
|
|
|
class MOZ_RAII AutoWrapperRooter : private JS::AutoGCRooter {
|
|
public:
|
|
AutoWrapperRooter(JSContext* cx, WrapperValue v
|
|
MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
|
|
: JS::AutoGCRooter(cx, WRAPPER), value(v)
|
|
{
|
|
MOZ_GUARD_OBJECT_NOTIFIER_INIT;
|
|
}
|
|
|
|
operator JSObject*() const {
|
|
return value.get().toObjectOrNull();
|
|
}
|
|
|
|
friend void JS::AutoGCRooter::trace(JSTracer* trc);
|
|
|
|
private:
|
|
WrapperValue value;
|
|
MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER
|
|
};
|
|
|
|
} /* namespace js */
|
|
|
|
#endif /* jscompartment_h */
|