GitHub/avmplus
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
master
avmplus/core/Verifier.cpp
T
dmcallis 65a0592776 Initial source code drop 
Source code drop for the Actionscript virtual machine in the Adobe
Flash Player for December 2013
2013-12-02 16:04:04 -08:00

3846 lines
142 KiB
C++
Raw Permalink Blame History

/* -*- Mode: C++; c-basic-offset: 4; indent-tabs-mode: nil; tab-width: 4 -*- */
/* vi: set ts=4 sw=4 expandtab: (add to ~/.vimrc: set modeline modelines=5) */
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
#include "avmplus.h"
//#define DOPROF
#include "../vprof/vprof.h"
namespace avmplus
{
#ifdef VMCFG_WORDCODE
inline WordOpcode wordCode(AbcOpcode opcode) {
return (WordOpcode)opcodeInfo[opcode].wordCode;
}
#endif
Verifier::Verifier(MethodInfo* info, MethodSignaturep ms, Toplevel* toplevel, AbcEnv* abc_env
#ifdef AVMPLUS_VERBOSE
, bool secondTry
#endif
) : tryFrom(NULL), tryTo(NULL)
, info(info), ms(ms)
, worklist(NULL)
, blockStates(NULL)
, handlerIsReachable(false)
{
#ifdef AVMPLUS_VERBOSE
this->secondTry = secondTry;
#endif
this->core = info->pool()->core;
this->pool = info->pool();
this->toplevel = toplevel;
this->abc_env = abc_env;
state = NULL;
#ifdef VMCFG_RESTARG_OPTIMIZATION
restArgAnalyzer.init(core, info, ms->frame_size());
#endif
#ifdef AVMPLUS_VERBOSE
verbose = pool->isVerbose(VB_verify, info);
#endif
pool->initPrecomputedMultinames();
}
Verifier::~Verifier()
{
mmfx_delete( this->state );
if (blockStates) {
for(int i = 0, n=blockStates->map.length(); i < n; i++)
mmfx_delete( blockStates->map.at(i) );
delete blockStates;
}
}
bool Verifier::hasReachableExceptions() const
{
// Valid during code generation only.
AvmAssert(emitPass);
return handlerIsReachable;
}
void Verifier::parseBodyHeader()
{
// note: reading of max_stack, etc (and validating the values)
// is handled by MethodInfo::resolveSignature.
const uint8_t* pos = info->abc_body_pos();
AvmCore::skipU32(pos, 4);
code_length = AvmCore::readU32(pos);
code_pos = pos;
pos += code_length;
}
// ScopeWriter implements the scope-type-capturing functionality
// for OP_newfunction and OP_newclass, as well as error checking
// to handle illegally capturing incompatible scopes for the same
// function. All other opcodes are ignored. Expected to be used
// in the verifier's phase 2 when each bytecode is only visited once.
class ScopeWriter: public NullWriter
{
MethodInfo* info;
Toplevel* toplevel;
Verifier *verifier;
public:
ScopeWriter(CodeWriter* coder, MethodInfo* info,
Toplevel* toplevel, Verifier* verifier)
: NullWriter(coder), info(info),
toplevel(toplevel), verifier(verifier)
{}
void write(const FrameState* state, const uint8_t* pc, AbcOpcode opcode, Traits* type)
{
if (opcode == OP_newactivation) {
// Capture activation scope the first time the method is verified.
const ScopeTypeChain *scope = info->activationScope();
if (scope == NULL) {
AvmAssert(type == info->activationTraits());
MMgc::GC* gc = info->pool()->core->GetGC();
scope = info->declaringScope()->cloneWithNewTraits(gc, type);
type->setDeclaringScopes(scope);
info->init_activationScope(scope);
}
}
coder->write(state, pc, opcode, type);
}
void writeOp1(const FrameState* state, const uint8_t* pc, AbcOpcode opcode, uint32_t imm30, Traits* type)
{
if (opcode == OP_newfunction) {
PoolObject* pool = info->pool();
AvmCore* core = pool->core;
const ScopeTypeChain* scope = info->declaringScope();
MethodInfo* f = pool->getMethodInfo(imm30);
Traits* ftraits = core->traits.function_itraits;
const ScopeTypeChain* fscope = ScopeTypeChain::create(core->GetGC(), ftraits, scope, state, NULL, NULL);
// Duplicate function definitions aren't strictly legal, but can occur
// in otherwise "well formed" ABC due to old, buggy versions of ASC.
// Specifically, code of the form
//
// public function simpleTest():void
// {
// var f:Function = function():void { }
// f();
// f = function functwo (x):void { }
// f(8);
// }
//
// could cause the second interior function ("functwo") to include a bogus, unused OP_newfunction
// call to itself inside the body of functwo. This caused the scope to get reinitialized
// and generally caused havok. However, we want to allow existing code of this form to continue
// to work, so check to see if we already have a declaringScope, and if so, require that
// it match this one.
const ScopeTypeChain* curScope = f->declaringScope();
if (curScope != NULL)
{
if (!curScope->equals(fscope))
{
// if info->method_id() == imm30, f == info, and therefore
// curScope == scope -- don't redefine, don't fail verification,
// just accept it. see https://bugzilla.mozilla.org/show_bug.cgi?id=544370
if (info->method_id() != int32_t(imm30))
toplevel->throwVerifyError(kCorruptABCError);
AvmAssert(type == core->traits.function_itraits);
if (type != curScope->traits())
{
#ifdef AVMPLUS_VERBOSE
core->console << "ERROR in ScopeChain::create, mismatched traits " << type << " " << curScope->traits() << "\n";
#endif
toplevel->throwVerifyError(kCorruptABCError);
}
AvmAssert(curScope->equals(scope));
}
AvmAssert(f->isResolved());
}
else
{
f->makeIntoPrototypeFunction(toplevel, fscope);
}
#ifdef AVMPLUS_VERBOSE
if (verifier->verbose)
verifier->printScope("function-scope", fscope);
#endif
} else if (opcode == OP_newclass) {
PoolObject* pool = info->pool();
AvmCore* core = pool->core;
const ScopeTypeChain* scope = info->declaringScope();
Traits* ctraits = type;
// the actual result type will be the static traits of the new class.
// make sure the traits came from this pool. they have to because
// the class_index operand is resolved from the current pool.
AvmAssert(ctraits->pool == pool);
Traits *itraits = ctraits->itraits;
// add a type constraint for the "this" scope of static methods
const ScopeTypeChain* cscope = ScopeTypeChain::create(core->GetGC(), ctraits, scope, state, NULL, ctraits);
if (state->scopeDepth > 0)
{
// innermost scope must be the base class object or else createInstance()
// will malfunction because it will use the wrong [base] class object to
// construct the instance. See ScriptObject::createInstance()
Traits* baseCTraits = state->scopeValue(state->scopeDepth-1).traits;
if (!baseCTraits || baseCTraits->itraits != itraits->base)
verifier->verifyFailed(kCorruptABCError);
}
// add a type constraint for the "this" scope of instance methods
const ScopeTypeChain* iscope = ScopeTypeChain::create(core->GetGC(), itraits, cscope, NULL, ctraits, itraits);
ctraits->resolveSignatures(toplevel);
itraits->resolveSignatures(toplevel);
const ScopeTypeChain *cur_cscope = ctraits->declaringScope();
const ScopeTypeChain *cur_iscope = itraits->declaringScope();
if (!cur_cscope) {
// first time we have seen this class, capture scope types
ctraits->setDeclaringScopes(cscope);
itraits->setDeclaringScopes(iscope);
} else {
// we have captured a scope already for this class. it better match!
if (!cur_cscope->equals(cscope) ||
!cur_iscope ||
!cur_iscope->equals(iscope)) {
toplevel->throwVerifyError(kCorruptABCError);
}
// use the old ScopeTypeChains, discard the new ones
cscope = cur_cscope;
iscope = cur_iscope;
}
#ifdef AVMPLUS_VERBOSE
if (verifier->verbose)
verifier->printScope("class-scope", cscope);
#endif
}
coder->writeOp1(state, pc, opcode, imm30, type);
}
};
#ifdef VMCFG_RESTARG_OPTIMIZATION
// Most interesting things happen in init()
RestArgAnalyzer::RestArgAnalyzer()
: NullWriter(NULL)
, optimize(true)
, core(NULL)
, info(NULL)
, pool(NULL)
, frameSize(0)
, restVar(0)
, isRestArray(NULL)
{
}
void RestArgAnalyzer::init(AvmCore* _core, MethodInfo* _info, uint32_t _frameSize)
{
core = _core;
info = _info;
pool = _info->pool();
frameSize = _frameSize;
if (_info->needRest() || (_info->needArguments() && _info->onlyUntypedParameters()))
restVar = _info->getMethodSignature()->param_count() + 1;
else
optimize = false;
#ifdef DEBUGGER
if (core->debugger() != NULL)
optimize = false;
#endif
if (optimize) {
isRestArray = mmfx_new_array(bool, frameSize);
VMPI_memset(isRestArray, 0, frameSize*sizeof(bool));
}
}
RestArgAnalyzer::~RestArgAnalyzer()
{
mmfx_delete_array(isRestArray);
isRestArray = NULL;
}
CodeWriter* RestArgAnalyzer::hookup(CodeWriter* next, bool pass2)
{
if (optimize) {
if (pass2)
info->setLazyRest();
coder = next;
return this;
}
return next;
}
// Called when the analysis fails (but not during setup). Factored out to
// allow easy breakpointing, etc.
inline void RestArgAnalyzer::fail()
{
optimize = false;
}
void RestArgAnalyzer::endBlock()
{
if (!optimize)
return;
for ( uint32_t i=0 ; i < frameSize ; i++ )
if (isRestArray[i])
fail();
}
void RestArgAnalyzer::write(const FrameState* state, const uint8_t* pc, AbcOpcode opcode, Traits *type)
{
if (optimize)
operate(state, pc, opcode);
coder->write(state, pc, opcode, type);
}
void RestArgAnalyzer::writeOp1(const FrameState* state, const uint8_t *pc, AbcOpcode opcode, uint32_t opd1, Traits* type)
{
if (optimize)
operate(state, pc, opcode);
coder->writeOp1(state, pc, opcode, opd1, type);
}
void RestArgAnalyzer::writeOp2(const FrameState* state, const uint8_t *pc, AbcOpcode opcode, uint32_t opd1, uint32_t opd2, Traits* type)
{
if (optimize)
operate(state, pc, opcode);
coder->writeOp2(state, pc, opcode, opd1, opd2, type);
}
void RestArgAnalyzer::writeMethodCall(const FrameState* state, const uint8_t *pc, AbcOpcode opcode, MethodInfo* m, uintptr_t disp_id, uint32_t argc, Traits* type)
{
if (optimize)
operate(state, pc, opcode);
coder->writeMethodCall(state, pc, opcode, m, disp_id, argc, type);
}
bool RestArgAnalyzer::getProperty(const FrameState* state, const Multiname& multiname, int obj_offset)
{
if (!optimize)
return false;
uint32_t sp = state->sp();
// Be sure the arguments to run-time names aren't the rest array.
uint32_t numprops = (multiname.isRtname() != 0) + (multiname.isRtns() != 0);
if (numprops > 0) {
if (isRestArray[sp])
fail();
}
if (numprops > 1) {
if (isRestArray[sp-1])
fail();
}
if (!optimize)
return false;
if (isRestArray[sp-obj_offset+1])
{
isRestArray[sp-obj_offset+1] = false;
if (multiname.isRtname() && multiname.containsAnyPublicNamespace())
{
// OP_restarg candidate
// containsAnyPublicNamespace should imply n==2 - the multiname must have ns or nsset
AvmAssert(obj_offset == 2);
}
else if (multiname.getName() == core->klength && multiname.containsAnyPublicNamespace())
{
// OP_restargc candidate
AvmAssert(obj_offset == 1);
}
else
{
fail();
}
return optimize;
}
else {
return false;
}
}
void RestArgAnalyzer::writeOpcodeVerified(const FrameState* state, const uint8_t *pc, AbcOpcode opcode)
{
if (optimize)
{
switch (opcode)
{
case OP_getlocal:
{
uint32_t imm30=0, imm30b=0;
int32_t imm8=0, imm24=0;
AvmCore::readOperands(pc, imm30, imm24, imm30b, imm8);
if (restVar == imm30)
isRestArray[state->sp()] = true;
break;
}
case OP_getlocal0:
case OP_getlocal1:
case OP_getlocal2:
case OP_getlocal3:
{
if (restVar == uint32_t(opcode-OP_getlocal0))
isRestArray[state->sp()] = true;
break;
}
case OP_iflt:
case OP_ifle:
case OP_ifnlt:
case OP_ifnle:
case OP_ifgt:
case OP_ifge:
case OP_ifngt:
case OP_ifnge:
case OP_ifeq:
case OP_ifstricteq:
case OP_ifne:
case OP_ifstrictne:
case OP_iftrue:
case OP_iffalse:
case OP_jump:
case OP_lookupswitch:
case OP_throw:
case OP_returnvalue:
case OP_returnvoid:
endBlock();
break;
default:
break;
}
}
coder->writeOpcodeVerified(state, pc, opcode);
}
// This would be less painful if we had a table stating the number of operands read
// by most instructions.
void RestArgAnalyzer::operate(const FrameState* state, const uint8_t *pc, AbcOpcode opcode)
{
uint32_t imm30=0, imm30b=0;
int32_t imm8=0, imm24=0;
uint32_t numprops = 0;
AvmCore::readOperands(pc, imm30, imm24, imm30b, imm8);
switch (opcode) {
// Ignored because they are generated post-analysis when the analysis succeeds.
case OP_restarg:
case OP_restargc:
break;
// Handled in writeOpcodeVerified
case OP_getlocal:
case OP_getlocal0:
case OP_getlocal1:
case OP_getlocal2:
case OP_getlocal3:
break;
// Handled in getProperty
case OP_getproperty:
break;
// Op0
case OP_bkpt:
case OP_bkptline:
case OP_timestamp:
case OP_nop:
case OP_pushbyte:
case OP_pushshort:
case OP_pushtrue:
case OP_pushfalse:
case OP_pushnan:
case OP_pushnull:
case OP_pushundefined:
case OP_pushstring:
case OP_pushint:
case OP_pushuint:
case OP_pushdouble:
#ifdef VMCFG_FLOAT
case OP_pushfloat:
case OP_pushfloat4:
#endif
case OP_pushnamespace:
case OP_dxns:
case OP_label:
case OP_jump:
case OP_pop: // Does not 'read' the value
case OP_popscope:
case OP_newfunction:
case OP_returnvoid:
case OP_newactivation:
case OP_newcatch:
case OP_finddef:
case OP_getlex:
case OP_getglobalscope:
case OP_getscopeobject:
case OP_getouterscope:
case OP_getglobalslot:
case OP_debugline:
case OP_debugfile:
case OP_debug:
case OP_findpropglobalstrict: // Internal, poorly documented
case OP_findpropglobal: // Internal, poorly documented
break;
// Op1
case OP_throw:
case OP_iftrue:
case OP_iffalse:
case OP_convert_i:
case OP_convert_u:
case OP_convert_d:
#ifdef VMCFG_FLOAT
case OP_convert_f:
case OP_convert_f4:
case OP_unplus:
#endif
case OP_convert_b:
case OP_convert_o:
case OP_convert_s:
case OP_coerce_b:
case OP_coerce_a:
case OP_coerce_i:
case OP_coerce_d:
case OP_coerce_s:
case OP_coerce_u:
case OP_coerce_o:
case OP_coerce:
case OP_dxnslate:
case OP_li8:
case OP_li16:
case OP_li32:
case OP_lf32:
case OP_lf64:
case OP_sxi1:
case OP_sxi8:
case OP_sxi16:
#ifdef VMCFG_FLOAT
case OP_lf32x4:
case OP_sf32x4:
#endif
case OP_pushwith:
case OP_lookupswitch:
case OP_increment:
case OP_decrement:
case OP_typeof:
case OP_not:
case OP_bitnot:
case OP_increment_i:
case OP_decrement_i:
case OP_astype:
case OP_pushscope:
case OP_negate:
case OP_negate_i:
case OP_dup:
case OP_checkfilter:
case OP_esc_xelem:
case OP_esc_xattr:
case OP_returnvalue:
case OP_newclass:
case OP_getslot:
case OP_setglobalslot:
if (isRestArray[state->sp()])
fail();
break;
// Op2
case OP_add:
case OP_subtract:
case OP_multiply:
case OP_divide:
case OP_modulo:
case OP_lshift:
case OP_rshift:
case OP_urshift:
case OP_bitand:
case OP_bitor:
case OP_bitxor:
case OP_equals:
case OP_strictequals:
case OP_lessthan:
case OP_lessequals:
case OP_greaterthan:
case OP_greaterequals:
case OP_instanceof:
case OP_istype:
case OP_istypelate:
case OP_in:
case OP_ifnlt:
case OP_ifnle:
case OP_ifngt:
case OP_ifnge:
case OP_ifeq:
case OP_ifne:
case OP_iflt:
case OP_ifle:
case OP_ifgt:
case OP_ifge:
case OP_ifstricteq:
case OP_ifstrictne:
case OP_si8:
case OP_si16:
case OP_si32:
case OP_sf32:
case OP_sf64:
case OP_add_i:
case OP_subtract_i:
case OP_multiply_i:
case OP_astypelate:
case OP_swap:
case OP_nextname:
case OP_nextvalue:
case OP_hasnext:
case OP_setslot:
if (isRestArray[state->sp()] || isRestArray[state->sp()-1])
fail();
break;
// Locals
case OP_inclocal:
case OP_declocal:
case OP_inclocal_i:
case OP_declocal_i:
case OP_setlocal:
case OP_kill:
update_local:
if (imm30 == restVar)
fail();
break;
case OP_setlocal0:
case OP_setlocal1:
case OP_setlocal2:
case OP_setlocal3:
imm30 = opcode-OP_setlocal0;
goto update_local;
// Locals
case OP_hasnext2:
if (imm30 == restVar || imm30b == restVar)
fail();
break;
// Workhorses for variable-number-of-operands instructions
checkMultiname:
{
const Multiname* m = pool->precomputedMultiname(imm30);
numprops += (m->isRtname() != 0) + (m->isRtns() != 0);
}
checkVariable:
{
uint32_t top = state->sp();
for ( uint32_t i=0 ; i < numprops ; i++ )
if (isRestArray[top-i])
fail();
break;
}
// 0 + 0/1/2 name components
case OP_findpropstrict:
case OP_findproperty:
numprops = 0;
goto checkMultiname;
// 1 + 0/1/2 name components
case OP_getsuper:
case OP_getdescendants:
case OP_deleteproperty:
numprops = 1;
goto checkMultiname;
// 2 + 0/1/2 name components
case OP_setsuper:
case OP_setproperty:
case OP_initproperty:
numprops = 2;
goto checkMultiname;
case OP_call:
numprops = 2 + imm30;
goto checkVariable;
case OP_construct:
case OP_constructsuper:
case OP_applytype:
numprops = 1 + imm30;
goto checkVariable;
case OP_callmethod:
case OP_callstatic:
numprops = 1 + imm30b;
goto checkVariable;
case OP_callsuper:
case OP_callsupervoid:
case OP_callproperty:
case OP_callproplex:
case OP_callpropvoid:
case OP_constructprop:
numprops = 1 + imm30b;
goto checkMultiname;
case OP_newobject:
numprops = 2 * imm30;
goto checkMultiname;
case OP_newarray:
numprops = imm30;
goto checkMultiname;
default:
AvmAssert(!"Can't happen");
}
}
#endif // VMCFG_RESTARG_OPTIMIZATION
/**
* (done) branches stay in code block
* (done) branches end on even instr boundaries
* (done) all local var operands stay inside [0..max_locals-1]
* (done) no illegal opcodes
* (done) cpool refs are inside [1..cpool_size-1]
* (done) converging paths have same stack depth
* (done) operand stack stays inside [0..max_stack-1]
* (done) locals defined before use
* (done) scope stack stays bounded
* (done) getScopeObject never exceeds [0..info->maxScopeDepth()-1]
* (done) global slots limits obeyed [0..var_count-1]
* (done) callstatic method limits obeyed [0..method_count-1]
* (done) cpool refs are correct type
* (done) make sure we don't fall off end of function
* (done) slot based ops are ok (slot must be legal)
* (done) propref ops are ok: usage on actual type compatible with ref type.
* dynamic lookup ops are ok (type must not have that binding & must be dynamic)
* dont access superclass state in ctor until super ctor called.
*
* pipeline todos:
* - early binding
* - copy propagation
*
* @param pool
* @param info
*/
void Verifier::verify(CodeWriter *emitter)
{
SAMPLE_FRAME("[verify]", core);
PERFM_NVPROF("abc-bytes", code_length);
if (!info->abc_body_pos()) {
// no body was supplied in abc
toplevel->throwVerifyError(kNotImplementedError, core->toErrorString(info));
}
if (info->declaringTraits() == NULL) {
// scope hasn't been captured yet.
verifyFailed(kCannotVerifyUntilReferencedError);
}
// CodeWriter warning: Verify exceptions are thrown from here
// and callees, so any CodeWriters declared with function scope
// will not be destructed. Presently, only CodeWriter, VerifyallWriter,
// and ScopeWriter are declared this way, and none require cleanup.
// if you add a new one, or add allocations in one of these,
// a TRY/CATCH will be required.
#ifdef AVMPLUS_VERBOSE
if (verbose)
core->console << "\ntypecheck " << info << '\n';
secondTry = false;
#endif
#ifdef AVMPLUS_VERBOSE
// Switch off Re-Queue messages
bool saveVerbose = verbose;
if (core->config.verifyquiet) {
verbose = false;
}
#endif
// Verify in two passes. Phase 1 does type modelling and
// iterates to a fixed point to determine the types and nullability
// of each frame variable at branch targets. Phase 2 includes the
// emitter and ScopeWriter, and visits opcodes in linear order.
// Errors detected by these additional CodeWriters can be reported
// in phase 2. In each phase, the CodeWriter protocol is obeyed:
// writePrologue(), visits to explicit and implicit operations using
// other writeXXX() methods, then writeEpilogue().
emitPass = false;
// phase 1 - iterate to a fixed point
CodeWriter stubWriter;
#ifdef VMCFG_RESTARG_OPTIMIZATION
coder = restArgAnalyzer.hookup(&stubWriter);
#else
coder = &stubWriter;
#endif
parseBodyHeader(); // set code_pos & code_length
checkFrameDefinition();
parseExceptionHandlers(); // resolve catch block types
checkParams();
#ifdef AVMPLUS_VERBOSE
if (verbose) {
printScope("outer-scope", info->declaringScope());
StringBuffer buf(core);
printState(buf, state);
}
#endif
coder->writePrologue(state, code_pos, this);
if (code_length > 0 && code_pos[0] == OP_label) {
// a reachable block starts at code_pos; explicitly create it,
// which puts it on the worklist.
checkTarget(code_pos-1, code_pos);
} else {
// inital sequence of code is only reachable from procedure
// entry, no block will be created, so verify it explicitly
verifyBlock(code_pos);
}
for (FrameState* succ = worklist; succ != NULL; succ = worklist) {
worklist = succ->wl_next;
succ->wl_pending = false;
verifyBlock(loadBlockState(succ));
}
coder->writeEpilogue(state);
// phase 2 - traverse code in abc order and emit
mmfx_delete(state);
#ifdef VMCFG_RESTARG_OPTIMIZATION
coder = restArgAnalyzer.hookup(emitter, true);
#else
coder = emitter;
#endif
// save computed ScopeTypeChain for OP_newfunction and OP_newclass
ScopeWriter scopeWriter(coder, info, toplevel, this);
coder = &scopeWriter;
#ifdef AVMPLUS_VERBOSE
// Switch off Re-Queue messages
if (core->config.verifyquiet) {
verbose = saveVerbose;
}
#endif
#ifdef AVMPLUS_VERBOSE
if (verbose)
core->console << "\nverify " << info << '\n';
#endif
emitPass = true;
parseBodyHeader(); // reset code_pos & code_length
checkFrameDefinition();
checkParams();
coder->writePrologue(state, code_pos, this);
const uint8_t* end_pos = code_pos;
// typically, first block is not in blockStates: verify it explicitly
if (!hasFrameState(code_pos))
end_pos = verifyBlock(code_pos);
// visit blocks in linear order (blockStates is sorted by abc address)
for (int i=0, n=getBlockCount(); i < n; i++) {
const uint8_t* start_pos = loadBlockState(blockStates->map.at(i));
// overlapping blocks indicates a branch to the middle of an instruction
if (start_pos < end_pos)
verifyFailed(kInvalidBranchTargetError);
end_pos = verifyBlock(start_pos);
}
state->abc_pc = code_pos + code_length;
coder->writeEpilogue(state);
}
const uint8_t* Verifier::loadBlockState(FrameState* blk)
{
// now load the saved state at this block
state->init(blk);
state->abc_pc = blk->abc_pc;
#ifdef AVMPLUS_VERBOSE
if (verbose) {
StringBuffer buf(core);
buf << "B" << int(blk->abc_pc - code_pos) << ":";
printState(buf, state);
}
#endif
// found the start of a new basic block
coder->writeBlockStart(state);
return blk->abc_pc;
}
static bool isU30(int32_t v) { return (v & 0xc0000000) == 0; }
void Verifier::checkFrameDefinition()
{
// validate rational bounds for frame definition parameters read directly from the abc
int32_t locals = ms->local_count();
int32_t scope = ms->max_scope();
int32_t stack = ms->max_stack();
if ( !(isU30(stack) && isU30(locals) && isU30(scope)) )
toplevel->throwVerifyError(kCorruptABCError);
// also ensure that the computed size doesn't overflow (see MethodInfo._buildMethodSignature)
int32_t frame = ms->frame_size();
if ( (uint32_t)frame > ( 0x7fffffff / sizeof(FrameValue) ) )
toplevel->throwVerifyError(kCorruptABCError);
}
void Verifier::checkParams()
{
const int param_count = ms->param_count();
if (ms->local_count() < param_count+1) {
// must have enough locals to hold all parameters including this
toplevel->throwVerifyError(kCorruptABCError);
}
// initial scope chain types
if (info->declaringTraits()->init != info && info->declaringScope() == NULL) {
// this can occur when an activation scope inside a class instance method
// contains a nested getter, setter, or method. In that case the scope
// is not captured when the containing function is verified. This isn't a
// bug because such nested functions aren't supported by AS3. This
// verify error is how we don't let those constructs run.
verifyFailed(kNoScopeError, core->toErrorString(info));
}
state = mmfx_new( FrameState(ms, info));
state->abc_pc = code_pos;
// initialize method param types.
// We already verified param_count is a legal register so
// don't checkLocal(i) inside the loop.
// MethodInfo::verify takes care of resolving param&return type
// names to Traits pointers, and resolving optional param default values.
for (int i=0; i <= param_count; i++)
state->setType(i, ms->paramTraits(i), i == 0);
int first_local = param_count+1;
if (info->needRestOrArguments()) {
// abcMethod_NEED_REST overrides abcMethod_NEED_ARGUMENTS when both are set
checkLocal(first_local); // ensure param_count+1 <= max_reg
state->setType(first_local, ARRAY_TYPE, true);
first_local++;
} else {
checkLocal(param_count); // ensure param_count <= max_reg
}
for (int i=first_local, n = ms->local_count(); i < n; i++)
state->setType(i, NULL); // void would be more precise.
}
// verify one superblock, return at the end. The end of the block is when
// we reach a terminal opcode (jump, lookupswitch, returnvalue, returnvoid,
// or throw), or when we fall into the beginning of another block.
// returns the address of the next instruction after the block end.
const uint8_t* Verifier::verifyBlock(const uint8_t* start_pos)
{
_nvprof("verify-block", 1);
CodeWriter *coder = this->coder; // Load into local var for expediency.
ExceptionHandlerTable* exTable = info->abc_exceptions();
bool isLoopHeader = state->targetOfBackwardsBranch;
state->targetOfBackwardsBranch = false;
state->targetOfExceptionBranch = false;
const uint8_t* code_end = code_pos + code_length;
for (const uint8_t *pc = start_pos, *nextpc = pc; pc < code_end; pc = nextpc)
{
// should we make a new sample frame in this method?
// SAMPLE_CHECK();
PERFM_NVPROF("abc-verify", 1);
coder->writeFixExceptionsAndLabels(state, pc);
AbcOpcode opcode = (AbcOpcode) *pc;
const AbcOpcodeInfo* opcodeInfoPtr = FLOAT_ONLY(!pool->hasFloatSupport() ? opcodeInfoNoFloats :) opcodeInfo;
if (opcodeInfoPtr[opcode].operandCount == -1)
verifyFailed(kIllegalOpcodeError, core->toErrorString(info), core->toErrorString(opcode), core->toErrorString((int)(pc-code_pos)));
state->abc_pc = pc;
// test for the start of a new block
if (pc != start_pos && (opcode == OP_label || hasFrameState(pc))) {
checkTarget(pc-1, pc);
return pc;
}
int sp = state->sp();
if (pc < tryTo && pc >= tryFrom &&
(opcodeInfo[opcode].canThrow || (isLoopHeader && pc == start_pos))) {
// If this instruction can throw exceptions, treat it as an edge to
// each in-scope catch handler. The instruction can throw exceptions
// if canThrow = true, or if this is the target of a backedge, where
// the implicit interrupt check can throw an exception.
for (int i=0, n=exTable->exception_count; i < n; i++) {
ExceptionHandler* handler = &exTable->exceptions[i];
if (pc >= code_pos + handler->from && pc < code_pos + handler->to) {
int saveStackDepth = state->stackDepth;
int saveScopeDepth = state->scopeDepth;
FrameValue stackEntryZero = saveStackDepth > 0 ? state->stackValue(0) : state->value(0);
state->stackDepth = 0;
state->scopeDepth = 0;
// add edge from try statement to catch block
const uint8_t* target = code_pos + handler->target;
// The thrown value is received as an atom but we will coerce it to
// the expected type before handing control to the catch block.
state->push(handler->traits);
checkTarget(pc, target, /*isExceptionEdge*/true);
state->pop();
state->stackDepth = saveStackDepth;
state->scopeDepth = saveScopeDepth;
if (saveStackDepth > 0)
state->stackValue(0) = stackEntryZero;
// Note that an exception may be caught in this method.
handlerIsReachable = true;
}
}
}
uint32_t imm30=0, imm30b=0;
int32_t imm8=0, imm24=0;
AvmCore::readOperands(nextpc, imm30, imm24, imm30b, imm8);
// make sure U30 operands are within bounds,
// except for OP_pushshort, whose operand is sign extended from 16 bits
if (opcode != OP_pushshort && ((imm30|imm30b) & 0xc0000000))
verifyFailed(kCorruptABCError);
if (nextpc > code_end)
verifyFailed(kLastInstExceedsCodeSizeError);
#ifdef AVMPLUS_VERBOSE
if (verbose)
printOpcode(pc, code_end);
#endif
_nvprof("verify-instr", 1);
switch (opcode)
{
case OP_iflt:
case OP_ifle:
case OP_ifnlt:
case OP_ifnle:
case OP_ifgt:
case OP_ifge:
case OP_ifngt:
case OP_ifnge:
case OP_ifeq:
case OP_ifstricteq:
case OP_ifne:
case OP_ifstrictne:
checkStack(2,0);
coder->writeOp1(state, pc, opcode, imm24);
state->pop(2);
checkTarget(pc, nextpc+imm24);
break;
case OP_iftrue:
case OP_iffalse:
checkStack(1,0);
emitCoerce(BOOLEAN_TYPE, sp);
coder->writeOp1(state, pc, opcode, imm24);
state->pop();
checkTarget(pc, nextpc+imm24);
break;
case OP_jump:
//checkStack(0,0)
coder->writeOp1(state, pc, opcode, imm24);
checkTarget(pc, nextpc+imm24); // target block;
coder->writeOpcodeVerified(state, pc, opcode);
return nextpc;
case OP_lookupswitch:
{
checkStack(1,0);
peekType(INT_TYPE);
coder->write(state, pc, opcode);
state->pop();
checkTarget(pc, pc+imm24);
uint32_t case_count = 1 + imm30b;
// case_count*3 can't overflow a U32...
uint32_t const case_skip = case_count * 3;
// ...but adding it to nextpc could wrap around, so check.
if (uintptr_t(nextpc) > uintptr_t(-1) - case_skip ||
nextpc + case_skip > code_end)
verifyFailed(kLastInstExceedsCodeSizeError);
for (uint32_t i=0; i < case_count; i++)
{
int off = AvmCore::readS24(nextpc);
checkTarget(pc, pc+off);
nextpc += 3;
}
coder->writeOpcodeVerified(state, pc, opcode);
return nextpc;
}
case OP_throw:
checkStack(1,0);
coder->write(state, pc, opcode);
state->pop();
coder->writeOpcodeVerified(state, pc, opcode);
return nextpc;
case OP_returnvalue:
checkStack(1,0);
emitCoerce(ms->returnTraits(), sp);
coder->write(state, pc, opcode);
state->pop();
coder->writeOpcodeVerified(state, pc, opcode);
return nextpc;
case OP_returnvoid:
//checkStack(0,0)
coder->write(state, pc, opcode);
coder->writeOpcodeVerified(state, pc, opcode);
return nextpc;
case OP_pushnull:
checkStack(0,1);
coder->write(state, pc, opcode, NULL_TYPE);
state->push(NULL_TYPE);
break;
case OP_pushundefined:
checkStack(0,1);
coder->write(state, pc, opcode, VOID_TYPE);
state->push(VOID_TYPE);
break;
case OP_pushtrue:
checkStack(0,1);
coder->write(state, pc, opcode, BOOLEAN_TYPE);
state->push(BOOLEAN_TYPE, true);
break;
case OP_pushfalse:
checkStack(0,1);
coder->write(state, pc, opcode, BOOLEAN_TYPE);
state->push(BOOLEAN_TYPE, true);
break;
case OP_pushnan:
checkStack(0,1);
coder->write(state, pc, opcode, NUMBER_TYPE);
state->push(NUMBER_TYPE, true);
break;
case OP_pushshort:
checkStack(0,1);
coder->write(state, pc, opcode, INT_TYPE);
state->push(INT_TYPE, true);
break;
case OP_pushbyte:
checkStack(0,1);
coder->write(state, pc, opcode, INT_TYPE);
state->push(INT_TYPE, true);
break;
case OP_debugfile:
//checkStack(0,0)
// fixme: bugzilla 552988: remove ifdef.
#if defined(DEBUGGER) || defined(VMCFG_VTUNE)
checkStringOperand(imm30);
#endif
coder->write(state, pc, opcode);
break;
case OP_dxns:
//checkStack(0,0)
if (!info->setsDxns())
verifyFailed(kIllegalSetDxns, core->toErrorString(info));
checkStringOperand(imm30);
coder->write(state, pc, opcode);
break;
case OP_dxnslate:
checkStack(1,0);
if (!info->setsDxns())
verifyFailed(kIllegalSetDxns, core->toErrorString(info));
// codgen will call intern on the input atom.
coder->write(state, pc, opcode);
state->pop();
break;
case OP_pushstring:
checkStack(0,1);
checkStringOperand(imm30);
coder->write(state, pc, opcode, STRING_TYPE);
state->push(STRING_TYPE, pool->getString(imm30) != NULL);
break;
case OP_pushint:
checkStack(0,1);
// FIXME: zero check is incorrect but traditional
if (imm30 == 0 || imm30 >= pool->constantIntCount)
verifyFailed(kCpoolIndexRangeError, core->toErrorString(imm30), core->toErrorString(pool->constantIntCount));
coder->write(state, pc, opcode, INT_TYPE);
state->push(INT_TYPE,true);
break;
case OP_pushuint:
checkStack(0,1);
// FIXME: zero check is incorrect but traditional
if (imm30 == 0 || imm30 >= pool->constantUIntCount)
verifyFailed(kCpoolIndexRangeError, core->toErrorString(imm30), core->toErrorString(pool->constantUIntCount));
coder->write(state, pc, opcode, UINT_TYPE);
state->push(UINT_TYPE,true);
break;
case OP_pushdouble:
checkStack(0,1);
// FIXME: zero check is incorrect but traditional
if (imm30 == 0 || imm30 >= pool->constantDoubleCount)
verifyFailed(kCpoolIndexRangeError, core->toErrorString(imm30), core->toErrorString(pool->constantDoubleCount));
coder->write(state, pc, opcode, NUMBER_TYPE);
state->push(NUMBER_TYPE, true);
break;
#ifdef VMCFG_FLOAT
case OP_pushfloat:
checkStack(0,1);
// FIXME: zero check is incorrect but traditional
if (imm30 == 0 || imm30 >= pool->constantFloatCount)
verifyFailed(kCpoolIndexRangeError, core->toErrorString(imm30), core->toErrorString(pool->constantFloatCount));
coder->write(state, pc, opcode, FLOAT_TYPE);
state->push(FLOAT_TYPE, true);
break;
case OP_pushfloat4:
checkStack(0,1);
// FIXME: zero check is incorrect but traditional
if (imm30 == 0 || imm30 >= pool->constantFloat4Count)
verifyFailed(kCpoolIndexRangeError, core->toErrorString(imm30), core->toErrorString(pool->constantFloat4Count));
coder->write(state, pc, opcode, FLOAT4_TYPE);
state->push(FLOAT4_TYPE, true);
break;
#endif
case OP_pushnamespace:
checkStack(0,1);
if (imm30 == 0 || imm30 >= pool->constantNsCount)
verifyFailed(kCpoolIndexRangeError, core->toErrorString(imm30), core->toErrorString(pool->constantNsCount));
coder->write(state, pc, opcode, NAMESPACE_TYPE);
state->push(NAMESPACE_TYPE, pool->cpool_ns[imm30] != NULL);
break;
case OP_setlocal:
{
checkStack(1,0);
checkLocal(imm30);
coder->write(state, pc, opcode);
FrameValue &v = state->stackTop();
state->setType(imm30, v.traits, v.notNull);
state->pop();
break;
}
case OP_setlocal0:
case OP_setlocal1:
case OP_setlocal2:
case OP_setlocal3:
{
checkStack(1,0);
int index = opcode-OP_setlocal0;
checkLocal(index);
coder->write(state, pc, opcode);
FrameValue &v = state->stackTop();
state->setType(index, v.traits, v.notNull);
state->pop();
break;
}
case OP_getlocal:
{
checkStack(0,1);
FrameValue& v = checkLocal(imm30);
coder->write(state, pc, opcode);
state->push(v);
break;
}
case OP_getlocal0:
case OP_getlocal1:
case OP_getlocal2:
case OP_getlocal3:
{
checkStack(0,1);
FrameValue& v = checkLocal(opcode-OP_getlocal0);
coder->write(state, pc, opcode);
state->push(v);
break;
}
case OP_kill:
{
//checkStack(0,0)
checkLocal(imm30);
coder->write(state, pc, opcode, NULL);
state->setType(imm30, NULL, false);
break;
}
case OP_inclocal:
case OP_declocal:
{
checkLocal(imm30);
Traits* retType = NUMBER_TYPE;
bool already_coerced = false;
#ifdef VMCFG_FLOAT
if(pool->hasFloatSupport())
{
FrameValue& v = checkLocal(imm30);
BuiltinType bt = Traits::getBuiltinType(v.traits);
if(bt == BUILTIN_none || bt == BUILTIN_any || bt == BUILTIN_object)
{
emitCoerceToNumeric(imm30);
retType = OBJECT_TYPE;
already_coerced = true;
}
else if(bt == BUILTIN_float || bt == BUILTIN_float4)
retType = v.traits;
else
retType = NUMBER_TYPE;
}
#endif // VMCFG_FLOAT
if(!already_coerced)
emitCoerce(retType, imm30);
coder->write(state, pc, opcode, retType);
break;
}
case OP_inclocal_i:
case OP_declocal_i:
//checkStack(0,0);
checkLocal(imm30);
emitCoerce(INT_TYPE, imm30);
coder->write(state, pc, opcode);
break;
case OP_newfunction:
{
checkStack(0,1);
checkMethodInfo(imm30);
Traits* ftraits = core->traits.function_itraits;
coder->writeOp1(state, pc, opcode, imm30, ftraits);
state->push(ftraits, true);
break;
}
case OP_getlex:
{
if (state->scopeDepth + info->declaringScope()->size == 0)
verifyFailed(kFindVarWithNoScopeError);
Multiname multiname;
checkConstantMultiname(imm30, multiname);
checkStackMulti(0, 1, &multiname);
if (multiname.isRuntime())
verifyFailed(kIllegalOpMultinameError, core->toErrorString(opcode), core->toErrorString(&multiname));
emitFindProperty(OP_findpropstrict, multiname, imm30, pc);
emitGetProperty(multiname, 1, imm30, pc);
break;
}
case OP_findpropstrict:
case OP_findproperty:
{
if (state->scopeDepth + info->declaringScope()->size == 0)
verifyFailed(kFindVarWithNoScopeError);
Multiname multiname;
checkConstantMultiname(imm30, multiname);
checkStackMulti(0, 1, &multiname);
emitFindProperty(opcode, multiname, imm30, pc);
break;
}
case OP_newclass:
{
checkStack(1, 1);
// imm30 is the class_id of the class object to create.
Traits* ctraits = checkClassInfo(imm30);
emitCoerce(CLASS_TYPE, state->sp());
coder->writeOp1(state, pc, opcode, imm30, ctraits);
state->pop_push(1, ctraits, true);
break;
}
case OP_finddef:
{
// must be a CONSTANT_Multiname.
Multiname multiname;
checkConstantMultiname(imm30, multiname);
checkStackMulti(0, 1, &multiname);
if (!multiname.isBinding())
{
// error, def name must be CT constant, regular name
verifyFailed(kIllegalOpMultinameError, core->toErrorString(opcode), core->toErrorString(&multiname));
}
MethodInfo* script = core->domainMgr()->findScriptInPoolByMultiname(pool, multiname);
Traits* resultType;
if (script != (MethodInfo*)BIND_NONE && script != (MethodInfo*)BIND_AMBIGUOUS) {
// found a single matching traits
resultType = script->declaringTraits();
} else {
// no traits, or ambiguous reference. use Object, anticipating
// a runtime exception
resultType = OBJECT_TYPE;
}
// If the script has already failed verification, it may
// have a null declaringTraits.
if (resultType == NULL)
verifyFailed(kCorruptABCError);
coder->writeOp1(state, pc, opcode, imm30, resultType);
state->push(resultType, true);
break;
}
case OP_setproperty:
case OP_initproperty:
{
// stack in: object [ns] [name] value
Multiname multiname;
checkConstantMultiname(imm30, multiname); // CONSTANT_Multiname
checkStackMulti(2, 0, &multiname);
uint32_t n=2;
checkPropertyMultiname(n, multiname);
Traitsp declarer = NULL;
FrameValue& obj = state->peek(n);
Binding b = (opcode == OP_initproperty) ?
toplevel->getBindingAndDeclarer(obj.traits, multiname, declarer) :
toplevel->getBinding(obj.traits, &multiname);
Traits* propTraits = readBinding(obj.traits, b);
emitCheckNull(sp-(n-1));
if (AvmCore::isSlotBinding(b) &&
// it's a var, or a const being set from the init function
(!AvmCore::isConstBinding(b) ||
(opcode == OP_initproperty && declarer->init == info)))
{
emitCoerce(propTraits, state->sp());
coder->writeOp2(state, pc, OP_setslot, (uint32_t)AvmCore::bindingToSlotId(b), sp-(n-1), propTraits);
state->pop(n);
break;
}
// else: setting const from illegal context, fall through
// If it's an accessor that we can early bind, do so.
// Note that this cannot be done on String or Namespace,
// since those are represented by non-ScriptObjects
if (AvmCore::hasSetterBinding(b))
{
// invoke the setter
int disp_id = AvmCore::bindingToSetterId(b);
const TraitsBindingsp objtd = obj.traits->getTraitsBindings();
MethodInfo *f = objtd->getMethod(disp_id);
AvmAssert(f != NULL);
MethodSignaturep fms = f->getMethodSignature();
emitCoerceArgs(f, 1);
Traits* propType = fms->returnTraits();
coder->writeOp2(state, pc, opcode, imm30, n, propType);
state->pop(n);
break;
}
if(obj.traits == VECTORINT_TYPE
|| obj.traits == VECTORUINT_TYPE
|| obj.traits == VECTORDOUBLE_TYPE
#ifdef VMCFG_FLOAT
|| obj.traits == VECTORFLOAT_TYPE
|| obj.traits == VECTORFLOAT4_TYPE
#endif
)
{
bool attr = multiname.isAttr();
Traits* indexType = state->value(state->sp()-1).traits;
// NOTE a dynamic name should have the same version as the current pool
bool maybeIntegerIndex = !attr && multiname.isRtname() && multiname.containsAnyPublicNamespace();
if( maybeIntegerIndex && (indexType == UINT_TYPE
|| indexType == INT_TYPE
|| indexType == NUMBER_TYPE
#ifdef VMCFG_FLOAT
|| indexType == FLOAT_TYPE // float indices are always absorbed by the vector
#endif
) )
{
if(obj.traits == VECTORINT_TYPE)
emitCoerce(INT_TYPE, state->sp());
else if(obj.traits == VECTORUINT_TYPE)
emitCoerce(UINT_TYPE, state->sp());
else if(obj.traits == VECTORDOUBLE_TYPE)
emitCoerce(NUMBER_TYPE, state->sp());
#ifdef VMCFG_FLOAT
else if(obj.traits == VECTORFLOAT_TYPE)
emitCoerce(FLOAT_TYPE, state->sp());
else if(obj.traits == VECTORFLOAT4_TYPE)
emitCoerce(FLOAT4_TYPE, state->sp());
#endif
}
}
// Default: do setproperty or initproperty at runtime.
coder->writeOp2(state, pc, opcode, imm30, n, propTraits);
state->pop(n);
break;
}
case OP_getproperty:
{
// stack in: object [ns [name]]
// stack out: value
Multiname multiname;
checkConstantMultiname(imm30, multiname); // CONSTANT_Multiname
checkStackMulti(1, 1, &multiname);
uint32_t n=1;
checkPropertyMultiname(n, multiname);
#ifdef VMCFG_RESTARG_OPTIMIZATION
bool emitOptimizedRestArg = restArgAnalyzer.optimize;
if (emitOptimizedRestArg)
emitOptimizedRestArg = restArgAnalyzer.getProperty(state, multiname, n);
if (emitPass && emitOptimizedRestArg)
{
FrameValue& obj = state->peek(n);
if (multiname.isRtname())
{
// restarg assumes the property name is an atom, so we must coerce it to an atom on input
emitCoerce(NULL, state->sp());
coder->writeOp1(state, pc, OP_restarg, imm30, NULL);
state->pop_push(n, NULL);
}
else if (multiname.getName() == core->klength)
{
Binding b = toplevel->getBinding(obj.traits, &multiname);
Traits* propType = readBinding(obj.traits, b);
coder->write(state, pc, OP_restargc, propType);
state->pop_push(n, UINT_TYPE);
// restargc produces an uint, so we must coerce to the target type on return
emitCoerce(propType, sp);
}
else {
AvmAssert(!"Can't happen");
}
}
else {
emitGetProperty(multiname, n, imm30, pc);
}
#else
emitGetProperty(multiname, n, imm30, pc);
#endif
break;
}
case OP_getdescendants:
{
// stack in: object [ns] [name]
// stack out: value
Multiname multiname;
checkConstantMultiname(imm30, multiname);
checkStackMulti(1, 1, &multiname);
uint32_t n=1;
checkPropertyMultiname(n, multiname);
emitCheckNull(sp-(n-1));
coder->write(state, pc, opcode);
state->pop_push(n, NULL);
break;
}
case OP_checkfilter:
checkStack(1, 1);
emitCheckNull(sp);
coder->write(state, pc, opcode);
break;
case OP_deleteproperty:
{
Multiname multiname;
checkConstantMultiname(imm30, multiname);
checkStackMulti(1, 1, &multiname);
uint32_t n=1;
checkPropertyMultiname(n, multiname);
emitCheckNull(sp-(n-1));
coder->write(state, pc, opcode);
state->pop_push(n, BOOLEAN_TYPE);
break;
}
case OP_astype:
{
checkStack(1, 1);
// resolve operand into a traits, and push that type.
Traits *t = checkTypeName(imm30); // CONSTANT_Multiname
int index = sp;
Traits* rhs = state->value(index).traits;
if (!Traits::canAssign(t, rhs))
{
Traits* resultType = t;
// result is typed value or null, so if type can't hold null,
// then result type is Object.
if (t && t->isMachineType())
resultType = OBJECT_TYPE;
coder->write(state, pc, opcode, t);
state->pop_push(1, resultType);
}
break;
}
case OP_astypelate:
{
checkStack(2,1);
FrameValue& classValue = state->peek(1); // rhs - class
Traits* ct = classValue.traits;
Traits* t = NULL;
if (ct && (t=ct->itraits) != 0)
if (t->isMachineType())
t = OBJECT_TYPE;
coder->write(state, pc, opcode, t);
state->pop_push(2, t);
break;
}
case OP_coerce:
{
checkStack(1,1);
FrameValue &v = state->value(sp);
Traits *type = checkTypeName(imm30);
coder->write(state, pc, opcode, type);
state->setType(sp, type, v.notNull);
break;
}
case OP_convert_b:
case OP_coerce_b:
{
checkStack(1,1);
FrameValue &v = state->value(sp);
Traits *type = BOOLEAN_TYPE;
coder->write(state, pc, opcode, type);
state->setType(sp, type, v.notNull);
break;
}
case OP_coerce_o:
{
checkStack(1,1);
FrameValue &v = state->value(sp);
Traits *type = OBJECT_TYPE;
coder->write(state, pc, opcode, type);
state->setType(sp, type, v.notNull);
break;
}
case OP_coerce_a:
{
checkStack(1,1);
FrameValue &v = state->value(sp);
Traits *type = NULL;
coder->write(state, pc, opcode, type);
state->setType(sp, type, v.notNull);
break;
}
case OP_convert_i:
case OP_coerce_i:
{
checkStack(1,1);
FrameValue &v = state->value(sp);
Traits *type = INT_TYPE;
coder->write(state, pc, opcode, type);
state->setType(sp, type, v.notNull);
break;
}
case OP_convert_u:
case OP_coerce_u:
{
checkStack(1,1);
FrameValue &v = state->value(sp);
Traits *type = UINT_TYPE;
coder->write(state, pc, opcode, type);
state->setType(sp, type, v.notNull);
break;
}
case OP_convert_d:
case OP_coerce_d:
{
checkStack(1,1);
FrameValue &v = state->value(sp);
Traits *type = NUMBER_TYPE;
coder->write(state, pc, opcode, type);
state->setType(sp, type, v.notNull);
break;
}
#ifdef VMCFG_FLOAT
case OP_convert_f:
{
checkStack(1,1);
FrameValue &v = state->value(sp);
Traits *type = FLOAT_TYPE;
coder->write(state, pc, opcode, type);
state->setType(sp, type, v.notNull);
break;
}
case OP_convert_f4:
{
checkStack(1,1);
FrameValue &v = state->value(sp);
Traits *type = FLOAT4_TYPE;
coder->write(state, pc, opcode, type);
state->setType(sp, type, v.notNull);
break;
}
case OP_unplus:
{
checkStack(1,1);
FrameValue &v = state->value(sp);
BuiltinType bt = Traits::getBuiltinType(v.traits);
Traits* type = v.traits;
if(bt == BUILTIN_none || bt == BUILTIN_any || bt == BUILTIN_object)
{
emitCoerceToNumeric(sp);
type = OBJECT_TYPE;
}
else if(bt != BUILTIN_float && bt != BUILTIN_float4)
{
emitCoerce(NUMBER_TYPE, sp);
type = NUMBER_TYPE;
}
coder->write(state, pc, opcode, type);
state->setType(sp, type, true);
break;
}
#endif // VMCFG_FLOAT
case OP_coerce_s:
{
checkStack(1,1);
FrameValue &v = state->value(sp);
Traits *type = STRING_TYPE;
coder->write(state, pc, opcode, type);
state->setType(sp, type, v.notNull);
break;
}
case OP_istype:
{
checkStack(1,1);
// resolve operand into a traits, and test if value is that type
Traits* t = checkTypeName(imm30); // CONSTANT_Multiname
coder->write(state, pc, opcode, t);
state->pop(1);
state->push(BOOLEAN_TYPE);
break;
}
case OP_istypelate:
checkStack(2,1);
coder->write(state, pc, opcode);
// TODO if the only common base type of lhs,rhs is Object, then result is always false
state->pop_push(2, BOOLEAN_TYPE);
break;
case OP_convert_o:
checkStack(1,1);
// ISSUE should result be Object, laundering the type?
// ToObject throws an exception on null and undefined, so after this runs we
// know the value is safe to dereference.
emitCheckNull(sp);
coder->write(state, pc, opcode);
break;
case OP_convert_s:
case OP_esc_xelem:
case OP_esc_xattr:
checkStack(1,1);
// this is the ECMA ToString and ToXMLString operators, so the result must not be null
// (ToXMLString is split into two variants - escaping elements and attributes)
coder->write(state, pc, opcode);
state->pop_push(1, STRING_TYPE, true);
break;
case OP_callstatic:
{
// Ensure that the method is eligible for callstatic.
// Note: This fails when called by verifyEarly(), since the
// data structures being checked have not been initialized.
// Need to either rearrange the initialization sequence or
// mark this verify pass as "needs late retry."
if ( imm30 >= pool->methodCount() || ! abc_env->getMethod(imm30) )
verifyFailed(kCorruptABCError);
MethodInfo* m = checkMethodInfo(imm30);
const uint32_t argc = imm30b;
checkStack(argc+1, 1);
MethodSignaturep mms = m->getMethodSignature();
if (!mms->paramTraits(0))
{
verifyFailed(kDanglingFunctionError, core->toErrorString(m), core->toErrorString(info));
}
emitCheckNull(sp-argc);
emitCoerceArgs(m, argc);
Traits *resultType = mms->returnTraits();
coder->writeOp2(state, pc, OP_callstatic, (uint32_t)m->method_id(), argc, resultType);
state->pop_push(argc+1, resultType);
break;
}
case OP_call:
{
const uint32_t argc = imm30;
checkStack(argc+2, 1);
// don't need null check, AvmCore::call() uses toFunction() for null check.
/*
TODO optimizations
- if this is a class closure for a non-native type, call == coerce
- if this is a function closure, try early binding using the traits->call sig
- optimize simple cases of casts to builtin types
*/
coder->writeOp1(state, pc, opcode, argc);
state->pop_push(argc+2, NULL);
break;
}
case OP_construct:
{
const uint32_t argc = imm30;
checkStack(argc+1, 1);
// don't need null check, AvmCore::construct() uses toFunction() for null check.
Traits* ctraits = state->peek(argc+1).traits;
Traits* itraits = ctraits ? (Traits*)(ctraits->itraits) : NULL;
coder->writeOp1(state, pc, opcode, argc);
state->pop_push(argc+1, itraits, true);
break;
}
case OP_callmethod:
{
/*
OP_callmethod will always throw a verify error. that's on purpose, it's a
last minute change before we shipped FP9 and was necessary when we added methods to class Object.
since then we realized that OP_callmethod need only have failed when used outside
of the builtin abc, but it's a moot point now. We dont have to worry about it.
code has since been simplified but existing failure modes preserved.
*/
const uint32_t argc = imm30b;
checkStack(argc+1,1);
const int disp_id = imm30-1;
if (disp_id >= 0)
{
FrameValue& obj = state->peek(argc+1);
if( !obj.traits )
verifyFailed(kCorruptABCError);
else
verifyFailed(kIllegalEarlyBindingError, core->toErrorString(obj.traits));
}
else
{
verifyFailed(kZeroDispIdError);
}
break;
}
case OP_callproperty:
case OP_callproplex:
case OP_callpropvoid:
{
// stack in: obj [ns [name]] args
// stack out: result
const uint32_t argc = imm30b;
Multiname multiname;
checkConstantMultiname(imm30, multiname);
checkStackMulti(argc+1, 1, &multiname);
checkCallMultiname(opcode, &multiname);
uint32_t n = argc+1; // index of receiver
checkPropertyMultiname(n, multiname);
emitCallproperty(opcode, sp, multiname, imm30, imm30b, pc);
break;
}
case OP_constructprop:
{
// stack in: obj [ns [name]] args
const uint32_t argc = imm30b;
Multiname multiname;
checkConstantMultiname(imm30, multiname);
checkStackMulti(argc+1, 1, &multiname);
checkCallMultiname(opcode, &multiname);
uint32_t n = argc+1; // index of receiver
checkPropertyMultiname(n, multiname);
FrameValue& obj = state->peek(n); // make sure object is there
Binding b = toplevel->getBinding(obj.traits, &multiname);
Traits* ctraits = readBinding(obj.traits, b);
emitCheckNull(sp-(n-1));
coder->writeOp2(state, pc, opcode, imm30, argc, ctraits);
Traits* itraits = ctraits ? (Traits*)(ctraits->itraits) : NULL;
state->pop_push(n, itraits, itraits==NULL?false:true);
break;
}
case OP_applytype:
{
// in: factory arg1..N
// out: type
const uint32_t argc = imm30;
checkStack(argc+1, 1);
coder->write(state, pc, opcode);
state->pop_push(argc+1, NULL, true);
break;
}
case OP_callsuper:
case OP_callsupervoid:
{
// stack in: obj [ns [name]] args
const uint32_t argc = imm30b;
Multiname multiname;
checkConstantMultiname(imm30, multiname);
checkStackMulti(argc+1, 1, &multiname);
if (multiname.isAttr())
verifyFailed(kIllegalOpMultinameError, core->toErrorString(&multiname));
uint32_t n = argc+1; // index of receiver
checkPropertyMultiname(n, multiname);
Traits* base = emitCoerceSuper(sp-(n-1));
const TraitsBindingsp basetd = base->getTraitsBindings();
Binding b = toplevel->getBinding(base, &multiname);
Traits *resultType = NULL;
if (AvmCore::isMethodBinding(b))
{
int disp_id = AvmCore::bindingToMethodId(b);
MethodInfo* m = basetd->getMethod(disp_id);
if( !m ) verifyFailed(kCorruptABCError);
MethodSignaturep mms = m->getMethodSignature();
resultType = mms->returnTraits();
}
emitCheckNull(sp-(n-1));
coder->writeOp2(state, pc, opcode, imm30, argc, base);
state->pop_push(n, resultType);
if (opcode == OP_callsupervoid)
state->pop();
break;
}
case OP_getsuper:
{
// stack in: obj [ns [name]]
// stack out: value
Multiname multiname;
checkConstantMultiname(imm30, multiname);
checkStackMulti(1, 1, &multiname);
uint32_t n=1;
checkPropertyMultiname(n, multiname);
if (multiname.isAttr())
verifyFailed(kIllegalOpMultinameError, core->toErrorString(&multiname));
Traits* base = emitCoerceSuper(sp-(n-1));
Binding b = toplevel->getBinding(base, &multiname);
Traits* propType = readBinding(base, b);
emitCheckNull(sp-(n-1));
coder->writeOp2(state, pc, opcode, imm30, n, base);
if (AvmCore::hasGetterBinding(b))
{
int disp_id = AvmCore::bindingToGetterId(b);
const TraitsBindingsp basetd = base->getTraitsBindings();
MethodInfo *f = basetd->getMethod(disp_id);
AvmAssert(f != NULL);
MethodSignaturep fms = f->getMethodSignature();
Traits* resultType = fms->returnTraits();
state->pop_push(n, resultType);
}
else
{
state->pop_push(n, propType);
}
break;
}
case OP_setsuper:
{
// stack in: obj [ns [name]] value
Multiname multiname;
checkConstantMultiname(imm30, multiname);
checkStackMulti(2, 0, &multiname);
uint32_t n=2;
checkPropertyMultiname(n, multiname);
if (multiname.isAttr())
verifyFailed(kIllegalOpMultinameError, core->toErrorString(&multiname));
Traits* base = emitCoerceSuper(sp-(n-1));
emitCheckNull(sp-(n-1));
coder->writeOp2(state, pc, opcode, imm30, n, base);
state->pop(n);
break;
}
case OP_constructsuper:
{
// stack in: obj, args ...
const uint32_t argc = imm30;
checkStack(argc+1, 0);
int32_t ptrIndex = sp-argc;
Traits* baseTraits = emitCoerceSuper(ptrIndex); // check receiver
MethodInfo *f = baseTraits->init;
AvmAssert(f != NULL);
emitCoerceArgs(f, argc);
emitCheckNull(sp-argc);
coder->writeOp2(state, pc, opcode, 0, argc, baseTraits);
state->pop(argc+1);
break;
}
case OP_newobject:
{
uint32_t argc = imm30;
checkStack(2*argc, 1);
int n=0;
while (argc-- > 0)
{
n += 2;
peekType(STRING_TYPE, n); // name; will call intern on it
}
coder->write(state, pc, opcode);
state->pop_push(n, OBJECT_TYPE, true);
break;
}
case OP_newarray:
checkStack(imm30, 1);
coder->write(state, pc, opcode);
state->pop_push(imm30, ARRAY_TYPE, true);
break;
case OP_pushscope:
{
checkStack(1,0);
if (state->scopeDepth + 1 > ms->max_scope())
verifyFailed(kScopeStackOverflowError);
Traits* scopeTraits = state->peek().traits;
const ScopeTypeChain* scope = info->declaringScope();
if (scope->fullsize > (scope->size+state->scopeDepth))
{
// extra constraints on type of pushscope allowed
Traits* requiredType = scope->getScopeTraitsAt(scope->size+state->scopeDepth);
if (!scopeTraits || !scopeTraits->subtypeof(requiredType))
{
verifyFailed(kIllegalOperandTypeError, core->toErrorString(scopeTraits), core->toErrorString(requiredType));
}
}
emitCheckNull(sp);
coder->writeOp1(state, pc, opcode, ms->scope_base() + state->scopeDepth);
state->pop();
state->setType(ms->scope_base() + state->scopeDepth, scopeTraits, true, false);
state->scopeDepth++;
break;
}
case OP_pushwith:
{
checkStack(1,0);
if (state->scopeDepth + 1 > ms->max_scope())
verifyFailed(kScopeStackOverflowError);
emitCheckNull(sp);
coder->writeOp1(state, pc, opcode, ms->scope_base() + state->scopeDepth);
Traits* scopeTraits = state->peek().traits;
state->pop();
state->setType(ms->scope_base() + state->scopeDepth, scopeTraits, true, true);
if (state->withBase == -1)
state->withBase = state->scopeDepth;
state->scopeDepth++;
break;
}
case OP_newactivation:
{
checkStack(0, 1);
if (!info->needActivation())
verifyFailed(kInvalidNewActivationError);
Traits* atraits = info->activationTraits();
atraits->resolveSignatures(toplevel);
coder->write(state, pc, opcode, atraits);
state->push(atraits, true);
break;
}
case OP_newcatch:
{
checkStack(0, 1);
if (!info->abc_exceptions() || imm30 >= (uint32_t)info->abc_exceptions()->exception_count)
verifyFailed(kInvalidNewActivationError);
// FIXME better error msg
ExceptionHandler* handler = &info->abc_exceptions()->exceptions[imm30];
coder->write(state, pc, opcode);
state->push(handler->scopeTraits, true);
break;
}
case OP_popscope:
//checkStack(0,0)
if (state->scopeDepth-- <= 0)
verifyFailed(kScopeStackUnderflowError);
coder->write(state, pc, opcode);
if (state->withBase >= state->scopeDepth)
state->withBase = -1;
break;
case OP_getscopeobject:
checkStack(0,1);
// local scope
if (imm8 >= state->scopeDepth)
verifyFailed(kGetScopeObjectBoundsError, core->toErrorString(imm8));
coder->writeOp1(state, pc, opcode, imm8);
// this will copy type and all attributes too
state->push(state->scopeValue(imm8));
break;
case OP_getouterscope:
{
checkStack(0,1);
const ScopeTypeChain* scope = info->declaringScope();
uint32_t index = imm30;
int captured_depth = scope->size;
if (captured_depth > 0)
{
// imm30 is unsigned, so can't be < 0
if (index >= uint32_t(scope->size))
toplevel->throwVerifyError(kGetScopeObjectBoundsError);
// enclosing scope
Traits* t = scope->getScopeTraitsAt(index);
coder->writeOp1(state, pc, opcode, index, t);
state->push(t, true);
}
else
{
#ifdef _DEBUG
if (pool->isBuiltin)
core->console << "getouterscope >= depth (" << index << " >= " << state->scopeDepth << ")\n";
#endif
verifyFailed(kGetScopeObjectBoundsError, core->toErrorString(index));
}
break;
}
case OP_getglobalscope:
checkStack(0,1);
coder->write(state, pc, OP_getglobalscope);
checkGetGlobalScope(); // after coder->write because mutates stack that coder depends on
break;
case OP_getglobalslot:
{
checkStack(0,1);
uint32_t slot = imm30-1;
Traits* globalTraits = checkGetGlobalScope();
checkEarlySlotBinding(globalTraits); // sets state->value(sp).traits so CodeWriter can see type
Traits* slotTraits = checkSlot(globalTraits, slot);
coder->writeOp1(state, pc, OP_getglobalslot, slot, slotTraits);
state->pop_push(1, slotTraits);
break;
}
case OP_setglobalslot:
{
// FIXME need test case
const ScopeTypeChain* scope = info->declaringScope();
if (!state->scopeDepth && !scope->size)
verifyFailed(kNoGlobalScopeError);
Traits *globalTraits = scope->size > 0 ? scope->getScopeTraitsAt(0) : state->scopeValue(0).traits;
checkStack(1,0);
checkEarlySlotBinding(globalTraits);
Traits* slotTraits = checkSlot(globalTraits, imm30-1);
emitCoerce(slotTraits, state->sp());
coder->writeOp1(state, pc, opcode, imm30-1, slotTraits);
state->pop();
break;
}
case OP_getslot:
{
checkStack(1,1);
FrameValue& obj = state->peek();
checkEarlySlotBinding(obj.traits);
Traits* slotTraits = checkSlot(obj.traits, imm30-1);
emitCheckNull(state->sp());
coder->write(state, pc, opcode);
state->pop_push(1, slotTraits);
break;
}
case OP_setslot:
{
checkStack(2,0);
FrameValue& obj = state->peek(2); // object
checkEarlySlotBinding(obj.traits);
Traits* slotTraits = checkSlot(obj.traits, imm30-1);
emitCoerce(slotTraits, state->sp());
emitCheckNull(state->sp()-1);
coder->write(state, pc, opcode);
state->pop(2);
break;
}
case OP_pop:
checkStack(1,0);
coder->write(state, pc, opcode);
state->pop();
break;
case OP_dup:
{
checkStack(1, 2);
FrameValue& v = state->peek();
coder->write(state, pc, opcode);
state->push(v);
break;
}
case OP_swap:
{
checkStack(2,2);
FrameValue v1 = state->peek(1);
FrameValue v2 = state->peek(2);
coder->write(state, pc, opcode);
state->pop(2);
state->push(v1);
state->push(v2);
break;
}
case OP_lessthan:
case OP_greaterthan:
case OP_lessequals:
case OP_greaterequals:
{
// if either the LHS or RHS is a number type, then we know
// it will be a numeric comparison.
checkStack(2,1);
FrameValue& rhs = state->peek(1);
FrameValue& lhs = state->peek(2);
Traits *lhst = lhs.traits;
Traits *rhst = rhs.traits;
if(lhst && rhst ){
// We assume is that number-to-number comparison yields the same result as float-to-float comparison
// Also, float4 will be coerced to number, and this is ok.
if (!lhst->isNumeric() && rhst->isNumeric() )
{
// convert lhs to Number
emitCoerce(NUMBER_TYPE, state->sp()-1);
}
else if (lhst->isNumeric() && !rhst->isNumeric())
{
// promote rhs to Number
emitCoerce(NUMBER_TYPE, state->sp());
}
}
coder->write(state, pc, opcode, BOOLEAN_TYPE);
state->pop_push(2, BOOLEAN_TYPE);
break;
}
case OP_in:
checkStack(2,1);
emitCheckNull(sp);
coder->write(state, pc, opcode);
state->pop_push(2, BOOLEAN_TYPE);
break;
case OP_equals:
case OP_strictequals:
case OP_instanceof:
checkStack(2,1);
coder->write(state, pc, opcode);
state->pop_push(2, BOOLEAN_TYPE);
break;
case OP_not:
checkStack(1,1);
emitCoerce(BOOLEAN_TYPE, sp);
coder->write(state, pc, opcode, BOOLEAN_TYPE);
state->pop_push(1, BOOLEAN_TYPE);
break;
case OP_add:
{
checkStack(2,1);
FrameValue& rhs = state->peek(1);
FrameValue& lhs = state->peek(2);
Traits* lhst = lhs.traits;
Traits* rhst = rhs.traits;
if ((lhst == STRING_TYPE && lhs.notNull) || (rhst == STRING_TYPE && rhs.notNull))
{
coder->write(state, pc, OP_add, STRING_TYPE);
state->pop_push(2, STRING_TYPE, true);
}
else if (lhst && lhst->isNumeric() && rhst && rhst->isNumeric())
{
Traits* type = NUMBER_TYPE;
#ifdef VMCFG_FLOAT
if(pool->hasFloatSupport())
{
if(lhst == FLOAT4_TYPE || rhst == FLOAT4_TYPE)
type = FLOAT4_TYPE; // float4 + anything numeric gives float4
else
if(rhst->isNumberType() || lhst->isNumberType())
type = NUMBER_TYPE;
else
if(rhst == FLOAT_TYPE && lhst == FLOAT_TYPE)
type = FLOAT_TYPE;
else
{
// the result is "NUMERIC" because at least one is NUMERIC and the other is NUMERIC or FLOAT.
emitCoerceToNumeric(sp);
emitCoerceToNumeric(sp-1);
type = OBJECT_TYPE;
}
}
#endif // VMCFG_FLOAT
coder->write(state, pc, OP_add, type);
state->pop_push(2, type, true);
}
else
{
coder->write(state, pc, OP_add, OBJECT_TYPE);
// NOTE don't know if it will return number or string, but
// neither will be null
state->pop_push(2, OBJECT_TYPE, true);
}
break;
}
case OP_modulo:
case OP_subtract:
case OP_divide:
case OP_multiply:
{
checkStack(2,1);
Traits* type = NUMBER_TYPE;
bool already_coerced = false;
#ifdef VMCFG_FLOAT
if(pool->hasFloatSupport())
{
FrameValue& rhs = state->peek(1);
FrameValue& lhs = state->peek(2);
BuiltinType lhst = Traits::getBuiltinType(lhs.traits);
BuiltinType rhst = Traits::getBuiltinType(rhs.traits);
/* If both are floats, operate on float.
If any is float4, operate on float4.
If both types are known (and not Object), operate on number.
Otherwise - convert to numeric */
if(lhst == BUILTIN_float && rhst == BUILTIN_float)
type = FLOAT_TYPE;
else if(lhst == BUILTIN_float4 || rhst == BUILTIN_float4)
type = FLOAT4_TYPE;
else if(lhst != BUILTIN_none && lhst != BUILTIN_object && lhst != BUILTIN_any && rhst != BUILTIN_none && rhst != BUILTIN_object && rhst != BUILTIN_any)
type = NUMBER_TYPE;
else
{
emitCoerceToNumeric(sp-1);
emitCoerceToNumeric(sp);
already_coerced = true;
type = OBJECT_TYPE;
}
}
#endif
if(!already_coerced)
{
emitCoerce(type, sp-1);
emitCoerce(type, sp);
}
coder->write(state, pc, opcode, type);
state->pop_push(2, type);
break;
}
case OP_negate:
case OP_increment:
case OP_decrement:
{
checkStack(1,1);
Traits* retType = NUMBER_TYPE;
bool already_coerced = false;
#ifdef VMCFG_FLOAT
if(pool->hasFloatSupport())
{
FrameValue& v = state->peek(1);
BuiltinType bt = Traits::getBuiltinType(v.traits);
if(bt == BUILTIN_none || bt == BUILTIN_any || bt == BUILTIN_object)
{
emitCoerceToNumeric(sp);
already_coerced = true;
retType = OBJECT_TYPE;
}
else if (bt == BUILTIN_float || bt == BUILTIN_float4)
retType = v.traits;
else
retType = NUMBER_TYPE;
}
#endif
if(!already_coerced)
emitCoerce(retType, sp);
coder->write(state, pc, opcode, retType);
break;
}
case OP_increment_i:
case OP_decrement_i:
checkStack(1,1);
emitCoerce(INT_TYPE, sp);
coder->write(state, pc, opcode);
break;
case OP_add_i:
case OP_subtract_i:
case OP_multiply_i:
checkStack(2,1);
emitCoerce(INT_TYPE, sp-1);
emitCoerce(INT_TYPE, sp);
coder->write(state, pc, opcode);
state->pop_push(2, INT_TYPE);
break;
case OP_negate_i:
checkStack(1,1);
emitCoerce(INT_TYPE, sp);
coder->write(state, pc, opcode);
break;
case OP_bitand:
case OP_bitor:
case OP_bitxor:
checkStack(2,1);
emitCoerce(INT_TYPE, sp-1);
emitCoerce(INT_TYPE, sp);
coder->write(state, pc, opcode);
state->pop_push(2, INT_TYPE);
break;
// ISSUE do we care if shift amount is signed or not? we mask
// the result so maybe it doesn't matter.
// CN says see tests e11.7.2, 11.7.3, 9.6
case OP_lshift:
case OP_rshift:
checkStack(2,1);
emitCoerce(INT_TYPE, sp-1);
emitCoerce(INT_TYPE, sp);
coder->write(state, pc, opcode);
state->pop_push(2, INT_TYPE);
break;
case OP_urshift:
checkStack(2,1);
emitCoerce(INT_TYPE, sp-1);
emitCoerce(INT_TYPE, sp);
coder->write(state, pc, opcode);
state->pop_push(2, UINT_TYPE);
break;
case OP_bitnot:
checkStack(1,1);
emitCoerce(INT_TYPE, sp);
coder->write(state, pc, opcode);
break;
case OP_typeof:
checkStack(1,1);
coder->write(state, pc, opcode);
state->pop_push(1, STRING_TYPE, true);
break;
case OP_nop:
// those show up but will be ignored
case OP_bkpt:
case OP_bkptline:
case OP_timestamp:
coder->write(state, pc, OP_nop);
break;
case OP_debug:
{
#ifdef DEBUGGER
// fixme: bugzilla 552988: remove ifdef.
uint8_t type = (uint8_t)*(pc + 1);
if (type == DI_LOCAL) {
// see Debugger::scanCode
const uint8_t* pc2 = pc + 2;
uint32_t index = AvmCore::readU32(pc2);
checkStringOperand(index);
}
#endif
coder->write(state, pc, opcode);
break;
}
case OP_label:
coder->write(state, pc, opcode);
break;
case OP_debugline:
coder->write(state, pc, opcode);
break;
case OP_nextvalue:
case OP_nextname:
checkStack(2,1);
peekType(INT_TYPE, 1);
coder->write(state, pc, opcode);
state->pop_push(2, NULL);
break;
case OP_hasnext:
checkStack(2,1);
peekType(INT_TYPE,1);
coder->write(state, pc, opcode);
state->pop_push(2, INT_TYPE);
break;
case OP_hasnext2:
{
checkStack(0,1);
checkLocal(imm30);
FrameValue& v = checkLocal(imm30b);
if (imm30 == imm30b)
verifyFailed(kInvalidHasNextError);
if (v.traits != INT_TYPE)
verifyFailed(kIllegalOperandTypeError, core->toErrorString(v.traits), core->toErrorString(INT_TYPE));
coder->write(state, pc, opcode);
state->setType(imm30, NULL, false);
state->push(BOOLEAN_TYPE);
break;
}
// sign extends
case OP_sxi1:
case OP_sxi8:
case OP_sxi16:
checkStack(1,1);
emitCoerce(INT_TYPE, sp);
coder->write(state, pc, opcode);
state->pop_push(1, INT_TYPE);
break;
// loads
case OP_li8:
case OP_li16:
if (pc+1 < code_end &&
((opcode == OP_li8 && pc[1] == OP_sxi8) || (opcode == OP_li16 && pc[1] == OP_sxi16)))
{
checkStack(1,1);
emitCoerce(INT_TYPE, sp);
coder->write(state, pc, (opcode == OP_li8) ? OP_lix8 : OP_lix16);
state->pop_push(1, INT_TYPE);
// ++pc; // do not skip the sign-extend; if it's the target
// of an implicit label, skipping it would cause verification failure.
// instead, just emit it, and rely on LIR to ignore sxi instructions
// in these situations.
break;
}
// else fall thru
case OP_li32:
case OP_lf32:
case OP_lf64:
{
Traits* result = (opcode == OP_lf32 || opcode == OP_lf64) ? NUMBER_TYPE : INT_TYPE;
checkStack(1,1);
emitCoerce(INT_TYPE, sp);
coder->write(state, pc, opcode);
state->pop_push(1, result);
break;
}
#ifdef VMCFG_FLOAT
case OP_lf32x4: {
checkStack(1,1);
emitCoerce(INT_TYPE, sp);
coder->write(state, pc, opcode);
state->pop_push(1, FLOAT4_TYPE);
break;
}
#endif
// stores
case OP_si8:
case OP_si16:
case OP_si32:
case OP_sf32:
case OP_sf64:
checkStack(2,0);
emitCoerce((opcode == OP_sf32 || opcode == OP_sf64) ? NUMBER_TYPE : INT_TYPE, sp-1);
emitCoerce(INT_TYPE, sp);
coder->write(state, pc, opcode);
state->pop(2);
break;
#ifdef VMCFG_FLOAT
case OP_sf32x4: {
checkStack(2,0);
emitCoerce(FLOAT4_TYPE, sp-1);
emitCoerce(INT_TYPE, sp);
coder->write(state, pc, opcode);
state->pop(2);
break;
}
#endif
default:
// size was nonzero, but no case handled the opcode. someone asleep at the wheel!
AvmAssertMsg(false, "Unhandled opcode");
}
coder->writeOpcodeVerified(state, pc, opcode);
#ifdef AVMPLUS_VERBOSE
if (verbose) {
StringBuffer buf(core);
printState(buf, state);
}
#endif
}
verifyFailed(kCannotFallOffMethodError);
return code_end;
}
void Verifier::checkPropertyMultiname(uint32_t &depth, Multiname &multiname)
{
if (multiname.isRtname())
{
if (multiname.isQName())
{
// a.ns::@[name] or a.ns::[name]
peekType(STRING_TYPE, depth++);
}
else
{
// a.@[name] or a[name]
depth++;
}
}
if (multiname.isRtns())
{
peekType(NAMESPACE_TYPE, depth++);
}
}
void Verifier::emitCallproperty(AbcOpcode opcode, int& sp, Multiname& multiname, uint32_t multiname_index, uint32_t argc, const uint8_t* pc)
{
uint32_t n = argc+1;
checkPropertyMultiname(n, multiname);
Traits* t = state->peek(n).traits;
if (t)
t->resolveSignatures(toplevel);
Binding b = toplevel->getBinding(t, &multiname);
emitCheckNull(sp-(n-1));
if (emitCallpropertyMethod(opcode, t, b, multiname, multiname_index, argc, pc))
return;
if (emitCallpropertySlot(opcode, sp, t, b, argc, pc))
return;
coder->writeOp2(state, pc, opcode, multiname_index, argc);
// If early binding then the state will have been updated, so this will be skipped
state->pop_push(n, NULL);
if (opcode == OP_callpropvoid)
state->pop();
}
bool Verifier::emitCallpropertyMethod(AbcOpcode opcode, Traits* t, Binding b, Multiname& multiname, uint32_t multiname_index, uint32_t argc, const uint8_t* pc)
{
(void) multiname_index; // FIXME remove
if (!AvmCore::isMethodBinding(b))
return false;
uint32_t n = argc+1;
const TraitsBindingsp tb = t->getTraitsBindings();
if (t == core->traits.math_ctraits)
b = findMathFunction(tb, multiname, b, argc);
else if (t == core->traits.string_itraits)
b = findStringFunction(tb, multiname, b, argc);
int disp_id = AvmCore::bindingToMethodId(b);
MethodInfo* m = tb->getMethod(disp_id);
MethodSignaturep mms = m->getMethodSignature();
if (!mms->argcOk(argc))
return false;
Traits* resultType = mms->returnTraits();
emitCoerceArgs(m, argc);
if (!t->isInterface())
{
coder->writeMethodCall(state, pc, OP_callmethod, m, disp_id, argc, resultType);
if (opcode == OP_callpropvoid)
coder->write(state, pc, OP_pop);
}
else
{
// NOTE when the interpreter knows how to dispatch through an
// interface, we can rewrite this call as a 'writeOp2'.
coder->writeMethodCall(state, pc, opcode, m, 0, argc, resultType);
}
state->pop_push(n, resultType);
if (opcode == OP_callpropvoid)
{
state->pop();
}
return true;
}
bool Verifier::emitCallpropertySlot(AbcOpcode opcode, int& sp, Traits* t, Binding b, uint32_t argc, const uint8_t *pc)
{
if (!AvmCore::isSlotBinding(b))
return false;
if ((argc != 1) && (argc != 4))
return false;
const TraitsBindingsp tb = t->getTraitsBindings();
int slot_id = AvmCore::bindingToSlotId(b);
Traits* slotType = tb->getSlotTraits(slot_id);
bool argCheck = ((argc == 4) FLOAT_ONLY(&& (slotType != core->traits.float4_ctraits)));
if (argCheck)
return false;
if (slotType == core->traits.int_ctraits)
{
coder->write(state, pc, OP_convert_i, INT_TYPE);
state->setType(sp, INT_TYPE, true);
}
else
if (slotType == core->traits.uint_ctraits)
{
coder->write(state, pc, OP_convert_u, UINT_TYPE);
state->setType(sp, UINT_TYPE, true);
}
else
if (slotType == core->traits.number_ctraits)
{
coder->write(state, pc, OP_convert_d, NUMBER_TYPE);
state->setType(sp, NUMBER_TYPE, true);
}
else
#ifdef VMCFG_FLOAT
if (slotType == core->traits.float_ctraits)
{
coder->write(state, pc, OP_convert_f, FLOAT_TYPE);
state->setType(sp, FLOAT_TYPE, true);
}
else
if (slotType == core->traits.float4_ctraits)
{
if(argc == 1) {
coder->write(state, pc, OP_convert_f4, FLOAT4_TYPE);
state->setType(sp, FLOAT4_TYPE, true);
} else {
AvmAssert(argc == 4);
AvmAssert(opcode != OP_callpropvoid);
coder->writeCoerceToFloat4(state, sp);
state->setType(sp, FLOAT4_TYPE, true);
}
}
else
#endif
if (slotType == core->traits.boolean_ctraits)
{
coder->write(state, pc, OP_convert_b, BOOLEAN_TYPE);
state->setType(sp, BOOLEAN_TYPE, true);
}
else
if (slotType == core->traits.string_ctraits)
{
coder->write(state, pc, OP_convert_s, STRING_TYPE);
state->setType(sp, STRING_TYPE, true);
}
else
// NOTE the following has been refactored so that both lir and wc coerce. previously
// wc would be skipped and fall back on the method call the the class converter
if (slotType && slotType->base == CLASS_TYPE && slotType->getCreateClassClosureProc() == NULL)
{
// is this a user defined class? A(1+ args) means coerce to A
AvmAssert(slotType->itraits != NULL);
FrameValue &v = state->value(sp);
coder->write(state, pc, OP_coerce, slotType->itraits);
state->setType(sp, slotType->itraits, v.notNull);
}
else
{
return false;
}
if (opcode == OP_callpropvoid)
{
AvmAssert(argc == 1);
coder->write(state, pc, OP_pop); // result
coder->write(state, pc, OP_pop); // function
state->pop(2);
}
else
{
FrameValue v = state->stackTop();
// NOTE writeNip is necessary until lir optimizes the "nip"
// case to avoid the extra copies that result from swap+pop
coder->writeNip(state, pc, argc);
state->pop(argc + 1);
state->push(v);
}
return true;
}
void Verifier::emitFindProperty(AbcOpcode opcode, Multiname& multiname, uint32_t imm30, const uint8_t *pc)
{
bool skip_translation = false;
const ScopeTypeChain* scope = info->declaringScope();
if (multiname.isBinding())
{
int scope_base = ms->scope_base();
int base = scope_base;
int index = base + state->scopeDepth - 1;
if (scope->size == 0)
{
// if scope->size = 0, then global is a local
// scope, and we dont want to early bind to global.
base++;
}
for (; index >= base; index--)
{
FrameValue& v = state->value(index);
Binding b = toplevel->getBinding(v.traits, &multiname);
if (b != BIND_NONE)
{
coder->writeOp1(state, pc, OP_getscopeobject, index - scope_base);
state->push(v);
return;
}
if (v.isWith)
break; // with scope could have dynamic property
}
if (index < base)
{
// look at captured scope types
for (index = scope->size-1; index > 0; index--)
{
Traits* t = scope->getScopeTraitsAt(index);
Binding b = toplevel->getBinding(t, &multiname);
if (b != BIND_NONE)
{
coder->writeOp1(state, pc, OP_getouterscope, index);
state->push(t, true);
return;
}
if (scope->getScopeIsWithAt(index))
break; // with scope could have dynamic property
}
if (index <= 0)
{
// look at import table for a suitable script
MethodInfo* script = core->domainMgr()->findScriptInPoolByMultiname(pool, multiname);
if (script != (MethodInfo*)BIND_NONE && script != (MethodInfo*)BIND_AMBIGUOUS)
{
// If the script has already failed verification, it may
// have a null declaringTraits.
if (script->declaringTraits() == NULL)
verifyFailed(kCorruptABCError);
if (script == info)
{
// ISSUE what if there is an ambiguity at runtime? is VT too early to bind?
// its defined here, use getscopeobject 0
if (scope->size > 0)
{
coder->writeOp1(state, pc, OP_getouterscope, 0);
}
else
{
coder->write(state, pc, OP_getglobalscope);
}
}
else // found a single matching traits
{
coder->writeOp1(state, pc, OP_finddef, imm30, script->declaringTraits());
}
state->push(script->declaringTraits(), true);
return;
}
else
{
switch (opcode) {
case OP_findproperty:
coder->writeOp1(state, pc, OP_findpropglobal, imm30);
break;
case OP_findpropstrict:
coder->writeOp1(state, pc, OP_findpropglobalstrict, imm30);
break;
default:
AvmAssert(false);
break;
}
skip_translation = true;
}
}
}
}
uint32_t n=1;
checkPropertyMultiname(n, multiname);
if (!skip_translation) coder->writeOp1(state, pc, opcode, imm30, OBJECT_TYPE);
state->pop_push(n-1, OBJECT_TYPE, true);
}
void Verifier::emitGetProperty(Multiname &multiname, int n, uint32_t imm30, const uint8_t *pc)
{
FrameValue& obj = state->peek(n);
Binding b = toplevel->getBinding(obj.traits, &multiname);
Traits* propType = readBinding(obj.traits, b);
emitCheckNull(state->sp()-(n-1));
// early bind slot
if (AvmCore::isSlotBinding(b))
{
// Bugzilla 705756: If we can mark known-notnull definitions as
// notnull then finddef calls will be removed by the optimizer.
//
// *** DO NOT MERGE TO TAMARIN-REDUX WITHOUT CONSULTING FELIX ***
bool notNull = false;
if (obj.traits->pool == core->builtinPool)
{
// Global object holding the built-in types
Stringp nm = multiname.getName();
if (FLOAT_ONLY(nm == core->kfloat4 || nm == core->kfloat ||) nm == core->kMath || nm == core->kNumber)
{
// We know those bindings not to be null values
notNull = true;
}
}
coder->writeOp1(state, pc, OP_getslot, AvmCore::bindingToSlotId(b), propType);
state->pop_push(n, propType, notNull);
return;
}
// early bind accessor
if (AvmCore::hasGetterBinding(b))
{
// Invoke the getter
int disp_id = AvmCore::bindingToGetterId(b);
const TraitsBindingsp objtd = obj.traits->getTraitsBindings();
MethodInfo *f = objtd->getMethod(disp_id);
AvmAssert(f != NULL);
emitCoerceArgs(f, 0);
coder->writeOp2(state, pc, OP_getproperty, imm30, n, propType);
AvmAssert(propType == f->getMethodSignature()->returnTraits());
state->pop_push(n, propType);
return;
}
if( !propType )
{
if (obj.traits == VECTORINT_TYPE
|| obj.traits == VECTORUINT_TYPE
|| obj.traits == VECTORDOUBLE_TYPE
#ifdef VMCFG_FLOAT
|| obj.traits == VECTORFLOAT_TYPE
|| obj.traits == VECTORFLOAT4_TYPE
#endif
)
{
bool attr = multiname.isAttr();
Traits* indexType = state->value(state->sp()).traits;
// NOTE a dynamic name should have the same version as the current pool
bool maybeIntegerIndex = !attr && multiname.isRtname() && multiname.containsAnyPublicNamespace();
if( maybeIntegerIndex && (indexType == UINT_TYPE
|| indexType == INT_TYPE
|| indexType == NUMBER_TYPE
#ifdef VMCFG_FLOAT
|| indexType == FLOAT_TYPE
#endif
) )
{
if(obj.traits == VECTORINT_TYPE)
propType = INT_TYPE;
else if(obj.traits == VECTORUINT_TYPE)
propType = UINT_TYPE;
else if(obj.traits == VECTORDOUBLE_TYPE)
propType = NUMBER_TYPE;
#ifdef VMCFG_FLOAT
else if(obj.traits == VECTORFLOAT_TYPE)
propType = FLOAT_TYPE;
else if(obj.traits == VECTORFLOAT4_TYPE)
propType = FLOAT4_TYPE;
#endif // VMCFG_FLOAT
}
}
else if (obj.traits != NULL && obj.traits->subtypeof(VECTOROBJ_TYPE) &&
abc_env->codeContext()->bugCompatibility()->bugzilla678952)
{
// We version this because it affects verifier semantics, see comments
// Bugzilla 678952. The versioning is static, however: we only want to
// know the compatibility settings for the code, not for the calling context.
// If the ABC was compiled for SWFn then it gets SWFn verifier treatment
// in every context. Builtin ABC code is compiled with the latest SWF version
// and always gets the optimization; that that is correct requires some
// careful argumentation, again see Bugzilla 678952.
bool attr = multiname.isAttr();
Traits* indexType = state->value(state->sp()).traits;
// NOTE a dynamic name should have the same version as the current pool
bool maybeIntegerIndex = !attr && multiname.isRtname() && multiname.containsAnyPublicNamespace();
if( maybeIntegerIndex && (indexType == UINT_TYPE
|| indexType == INT_TYPE
|| indexType == NUMBER_TYPE
#ifdef VMCFG_FLOAT
|| indexType == FLOAT_TYPE
#endif
) )
{
propType = obj.traits->m_paramTraits;
}
}
}
// default - do getproperty at runtime
coder->writeOp2(state, pc, OP_getproperty, imm30, n, propType);
state->pop_push(n, propType);
}
Traits* Verifier::checkGetGlobalScope()
{
const ScopeTypeChain* scope = info->declaringScope();
int captured_depth = scope->size;
if (captured_depth > 0) {
// enclosing scope
Traits* t = scope->getScopeTraitsAt(0);
state->push(t, true);
return t;
}
else {
// local scope
if (state->scopeDepth == 0)
verifyFailed(kGetScopeObjectBoundsError, core->toErrorString(0));
Traits* t = state->scopeValue(0).traits;
state->push(state->scopeValue(0));
return t;
}
}
FrameState *Verifier::getFrameState(const uint8_t* pc) const
{
return blockStates ? blockStates->map.get(pc) : NULL;
}
bool Verifier::hasFrameState(const uint8_t* pc) const
{
return blockStates && blockStates->map.containsKey(pc);
}
int Verifier::getBlockCount() const
{
return blockStates ? blockStates->map.length() : 0;
}
const uint8_t* Verifier::getTryFrom() const
{
return tryFrom;
}
const uint8_t* Verifier::getTryTo() const
{
return tryTo;
}
void Verifier::emitCheckNull(int i)
{
FrameValue& value = state->value(i);
if (!value.notNull) {
coder->writeCheckNull(state, i);
value.notNull = true;
}
}
void Verifier::checkCallMultiname(AbcOpcode /*opcode*/, Multiname* name) const
{
if (name->isAttr())
{
StringBuffer sb(core);
sb << *name;
verifyFailed(kIllegalOpMultinameError, core->toErrorString(name), sb.toString());
}
}
Traits* Verifier::emitCoerceSuper(int index)
{
Traits* base = info->declaringTraits()->base;
if (base != NULL)
{
emitCoerce(base, index);
}
else
{
verifyFailed(kIllegalSuperCallError, core->toErrorString(info));
}
return base;
}
void Verifier::emitCoerce(Traits* target, int index)
{
FrameValue &v = state->value(index);
coder->writeCoerce(state, index, target);
state->setType(index, target, v.notNull);
}
void Verifier::emitCoerceToNumeric(int index)
{
coder->writeCoerceToNumeric(state, index);
state->setType(index, OBJECT_TYPE, true);
}
Traits* Verifier::peekType(Traits* requiredType, int n)
{
Traits* t = state->peek(n).traits;
if (t != requiredType)
{
verifyFailed(kIllegalOperandTypeError, core->toErrorString(t), core->toErrorString(requiredType));
}
return t;
}
void Verifier::checkEarlySlotBinding(Traits* t)
{
// early slot binding is only allowed if the method in question comes
// from the same ABC as the Traits being accessed.
if (!t || t->pool != info->pool() || !t->allowEarlyBinding())
verifyFailed(kIllegalEarlyBindingError, core->toErrorString(t));
}
void Verifier::emitCoerceArgs(MethodInfo* m, int argc)
{
if (!m->isResolved())
m->resolveSignature(toplevel);
MethodSignaturep mms = m->getMethodSignature();
if (!mms->argcOk(argc))
{
verifyFailed(kWrongArgumentCountError, core->toErrorString(m), core->toErrorString(mms->requiredParamCount()), core->toErrorString(argc));
}
// coerce parameter types
int n=1;
while (argc > 0)
{
Traits* target = (argc <= mms->param_count()) ? mms->paramTraits(argc) : NULL;
emitCoerce(target, state->sp()-(n-1));
argc--;
n++;
}
// coerce receiver type
emitCoerce(mms->paramTraits(0), state->sp()-(n-1));
}
void Verifier::checkStack(uint32_t pop, uint32_t push)
{
if (uint32_t(state->stackDepth) < pop)
verifyFailed(kStackUnderflowError);
if (state->stackDepth - pop + push > uint32_t(ms->max_stack()))
verifyFailed(kStackOverflowError);
}
void Verifier::checkStackMulti(uint32_t pop, uint32_t push, Multiname* m)
{
if (m->isRtname()) pop++;
if (m->isRtns()) pop++;
checkStack(pop,push);
}
FrameValue& Verifier::checkLocal(int local)
{
if (local < 0 || local >= ms->local_count())
verifyFailed(kInvalidRegisterError, core->toErrorString(local));
return state->value(local);
}
Traits* Verifier::checkSlot(Traits *traits, int imm30)
{
uint32_t slot = imm30;
if (traits)
traits->resolveSignatures(toplevel);
TraitsBindingsp td = traits ? traits->getTraitsBindings() : NULL;
const uint32_t count = td ? td->slotCount : 0;
if (!traits || slot >= count)
{
verifyFailed(kSlotExceedsCountError, core->toErrorString(slot+1), core->toErrorString(count), core->toErrorString(traits));
}
return td->getSlotTraits(slot);
}
Traits* Verifier::readBinding(Traits* traits, Binding b) const
{
if (traits)
{
traits->resolveSignatures(toplevel);
}
else
{
AvmAssert(AvmCore::bindingKind(b) == BKIND_NONE);
}
return Traits::readBinding(traits, b);
}
MethodInfo* Verifier::checkMethodInfo(uint32_t id)
{
const uint32_t c = pool->methodCount();
if (id >= c)
{
verifyFailed(kMethodInfoExceedsCountError, core->toErrorString(id), core->toErrorString(c));
}
return pool->getMethodInfo(id);
}
Traits* Verifier::checkClassInfo(uint32_t id)
{
const uint32_t c = pool->classCount();
if (id >= c)
{
verifyFailed(kClassInfoExceedsCountError, core->toErrorString(id), core->toErrorString(c));
}
return pool->getClassTraits(id);
}
Traits* Verifier::checkTypeName(uint32_t index)
{
Multiname name;
checkConstantMultiname(index, name); // CONSTANT_Multiname
Traits* t = core->domainMgr()->findTraitsInPoolByMultiname(pool, name);
if (t == NULL)
verifyFailed(kClassNotFoundError, core->toErrorString(&name));
if (t == (Traits*)BIND_AMBIGUOUS)
toplevel->throwReferenceError(kAmbiguousBindingError, name);
if (name.isParameterizedType())
{
core->stackCheck(toplevel);
Traits* param_traits = name.getTypeParameter() ? checkTypeName(name.getTypeParameter()) : NULL ;
t = pool->resolveParameterizedType(toplevel, t, param_traits);
}
return t;
}
void Verifier::verifyFailed(int errorID, Stringp arg1, Stringp arg2, Stringp arg3) const
{
#ifdef AVMPLUS_VERBOSE
if (!secondTry && !verbose) {
// capture the verify trace even if verbose is false.
Verifier v2(info, ms, toplevel, abc_env, true);
v2.verbose = true;
v2.tryFrom = tryFrom;
v2.tryTo = tryTo;
CodeWriter stubWriter;
// The second verification pass will presumably always throw an
// error, which we ignore. But we /must/ catch it so that we can
// clean up the verifier resources. Cleanup happens automatically
// when execution reaches the end of the block.
TRY(core, kCatchAction_Ignore) {
v2.verify(&stubWriter);
}
CATCH(Exception *ignored) {
(void)ignored;
}
END_CATCH
END_TRY
}
#endif
toplevel->throwVerifyError(errorID, arg1, arg2, arg3);
// This function throws, and should never return.
AvmAssert(false);
}
/**
* Insert f into list in abc_pc order. Use a linear search for the
* right position. Keeping the worklist sorted avoids pathologically
* revisiting the same block too many times as long as predecessors
* generally come before successors in ABC order.
*/
void requeue(FrameState* f, FrameState** list) {
while (*list && (*list)->abc_pc < f->abc_pc)
list = &(*list)->wl_next;
f->wl_next = *list;
*list = f;
f->wl_pending = true;
}
// Merge the current FrameState (this->state) with the target
// FrameState (getFrameState(target)), and report verify errors.
// Fixme: Bug 558876 - |current| must not be dereferenced, it could point
// outside the valid range of bytecodes. Its only for back-edge detection.
void Verifier::checkTarget(const uint8_t* current, const uint8_t* target, bool isExceptionEdge)
{
if (emitPass) {
AvmAssert(hasFrameState(target));
return;
}
// branches must stay inside code, and back edges must land on an OP_label,
// or a location already known as a forward-branch target
if (target < code_pos || target >= code_pos+code_length ||
(target <= current && !hasFrameState(target) && *target != OP_label)) {
verifyFailed(kInvalidBranchTargetError);
}
FrameState *targetState = getFrameState(target);
bool targetChanged;
if (!targetState) {
if (blockStates != NULL && target > current)
{
// If we're jumping forward to an instruction with no FrameState,
// we need to re-verify the block that contains it to merge FrameStates.
// This is a conservative approach: roughly,
//
// if (target is new) and (branch < nearest < target) and (nearest not queued) then queue(nearest)
//
// this is suboptimal in that we may guess wrong and requeue blocks that don't need
// reverification, but this is theoretically harmless, just extra work.
//
int i = blockStates->map.findNear(target);
// i too large should be impossible, but i < 0 is possible, if the insertion point
// was before the first block. In that case, just ignore it, since we only
// need to requeue if it's possible that an existing block has already been
// verified once; in this case no such block could exist.
AvmAssert(i < blockStates->map.length());
// (But let's check anyway...)
if (i >= 0 && i < blockStates->map.length())
{
// If the block we find in the table is in between the
// position of the branch and the position of the target,
// requeue. (And also, if it's already pending, don't bother.)
FrameState* existingState = blockStates->map.at(i);
if (current < existingState->abc_pc &&
existingState->abc_pc < target &&
!existingState->wl_pending)
{
#ifdef AVMPLUS_VERBOSE
if (verbose) {
core->console << "------------------------------------\n";
core->console << "RE-QUEUE B" << int(existingState->abc_pc - code_pos) << ":";
}
#endif
existingState->wl_pending = true;
existingState->wl_next = worklist;
worklist = existingState;
// no return: we want to fall thru and create the new blockstate as well.
}
}
}
if (!blockStates)
blockStates = new (core->GetGC()) BlockStatesType(core->GetGC());
targetState = mmfx_new(FrameState(ms, info));
targetState->abc_pc = target;
blockStates->map.put(target, targetState);
// first time visiting target block
targetChanged = true;
AvmAssert(!state->targetOfBackwardsBranch);
AvmAssert(!state->targetOfExceptionBranch);
targetState->init(state);
#ifdef AVMPLUS_VERBOSE
if (verbose) {
core->console << "------------------------------------\n";
StringBuffer buf(core);
buf << "MERGE FIRST B" << int(targetState->abc_pc - code_pos) << ":";
printState(buf, targetState);
core->console << "------------------------------------\n";
}
#endif
} else {
targetChanged = mergeState(targetState);
}
bool targetOfBackwardsBranch = targetState->targetOfBackwardsBranch || target <= current;
if (targetOfBackwardsBranch != targetState->targetOfBackwardsBranch)
targetChanged |= true;
targetState->targetOfBackwardsBranch = targetOfBackwardsBranch;
bool targetOfExceptionBranch = targetState->targetOfExceptionBranch || isExceptionEdge;
if (targetOfExceptionBranch != targetState->targetOfExceptionBranch)
targetChanged |= true;
targetState->targetOfExceptionBranch = targetOfExceptionBranch;
if (targetChanged && !targetState->wl_pending)
requeue(targetState, &worklist);
}
bool Verifier::mergeState(FrameState* targetState)
{
#ifdef AVMPLUS_VERBOSE
if (verbose) {
core->console << "------------------------------------\n";
StringBuffer buf(core);
buf << "MERGE CURRENT " << int(state->abc_pc - code_pos) << ":";
printState(buf, state);
buf.reset();
buf << "MERGE TARGET B" << int(targetState->abc_pc - code_pos) << ":";
printState(buf, targetState);
}
#endif
// check matching stack depth
if (state->stackDepth != targetState->stackDepth)
verifyFailed(kStackDepthUnbalancedError, core->toErrorString((int)state->stackDepth), core->toErrorString((int)targetState->stackDepth));
// check matching scope chain depth
if (state->scopeDepth != targetState->scopeDepth)
verifyFailed(kScopeDepthUnbalancedError, core->toErrorString(state->scopeDepth), core->toErrorString(targetState->scopeDepth));
// Merge types of locals, scopes, and operands.
// Merge could preserve common interfaces even when
// common supertype does not:
// class A implements I {}
// class B implements I {}
// var i:I = b ? new A : new B
// Doing so would require different specification for verify-time analysis,
// essentially a differnet ABC spec, yet each abc version needs predictable
// verifier semantics.
// On the other hand, later optimization passes are free to be as accurate as
// they like, if it produces better code.
bool targetChanged = false;
const int scopeTop = ms->scope_base() + targetState->scopeDepth;
const int stackTop = ms->stack_base() + targetState->stackDepth;
for (int i=0, n=stackTop; i < n; i++)
{
// ignore empty locations between scopeTop and stackBase
if (i >= scopeTop && i < ms->stack_base())
continue;
const FrameValue& curValue = state->value(i);
FrameValue& targetValue = targetState->value(i);
if (curValue.isWith != targetValue.isWith) {
// failure: pushwith on one edge, pushscope on other edge, cannot merge.
verifyFailed(kCannotMergeTypesError, core->toErrorString(targetValue.traits), core->toErrorString(curValue.traits));
}
Traits* merged_traits = findCommonBase(targetValue.traits, curValue.traits);
bool merged_notNull = targetValue.notNull && curValue.notNull;
if (targetValue.traits != merged_traits || targetValue.notNull != merged_notNull)
targetChanged = true;
#ifdef VMCFG_NANOJIT
uint16_t merged_sst = targetValue.sst_mask | curValue.sst_mask;
// String+null and Namespace+null are legal but must be special-cased
// here. The SlotStorageType for NULL_TYPE is SST_scriptobject,
// which will leave two bits set in merged_sst. Erase the SST_scriptobject bit.
// Any other type merged with null already works, as does String|Namespace
// merged with any other type.
const uint16_t str_or_obj = (1 << SST_string) | (1 << SST_scriptobject);
const uint16_t ns_or_obj = (1 << SST_namespace) | (1 << SST_scriptobject);
if ((merged_traits == STRING_TYPE && merged_sst == str_or_obj) ||
(merged_traits == NAMESPACE_TYPE && merged_sst == ns_or_obj)) {
AvmAssert(targetValue.traits == NULL_TYPE || curValue.traits == NULL_TYPE);
merged_sst &= ~(1 << SST_scriptobject);
}
if (targetValue.sst_mask != merged_sst)
targetChanged = true;
targetValue.sst_mask = merged_sst;
#endif
targetValue.traits = merged_traits;
targetValue.notNull = merged_notNull;
}
#ifdef AVMPLUS_VERBOSE
if (verbose) {
StringBuffer buf(core);
buf << "AFTER MERGE B" << int(targetState->abc_pc - code_pos) << ":";
printState(buf, targetState);
core->console << "------------------------------------\n";
}
#endif
return targetChanged;
}
/**
* find common base class of these two types
*/
Traits* Verifier::findCommonBase(Traits* t1, Traits* t2)
{
if (t1 == t2)
return t1;
if (t1 == NULL) {
// assume t1 is always non-null
Traits *temp = t1;
t1 = t2;
t2 = temp;
}
// okay to merge null with pointer type
if (Traits::getBuiltinType(t1) == BUILTIN_null && t2 && !t2->isMachineType())
return t2;
if (Traits::getBuiltinType(t2) == BUILTIN_null && t1 && !t1->isMachineType())
return t1;
// all commonBase flags start out false. set the cb bits on
// t1 and its ancestors.
Traits* t = t1;
do t->commonBase = true;
while ((t = t->base) != NULL);
// now search t2 and its ancestors looking for the first cb=true
t = t2;
while (t != NULL && !t->commonBase)
t = t->base;
Traits* common = t;
// finally reset the cb bits to false for next time
t = t1;
do t->commonBase = false;
while ((t = t->base) != NULL);
return common;
}
void Verifier::checkStringOperand(uint32_t index)
{
if (!index || index >= pool->constantStringCount)
verifyFailed(kCpoolIndexRangeError, core->toErrorString(index),
core->toErrorString(pool->constantStringCount));
}
void Verifier::checkNameOperand(uint32_t index)
{
if (!index || index >= pool->cpool_mn_offsets.length())
verifyFailed(kCpoolIndexRangeError, core->toErrorString(index),
core->toErrorString(pool->cpool_mn_offsets.length()));
}
void Verifier::checkConstantMultiname(uint32_t index, Multiname& m)
{
checkNameOperand(index);
pool->parseMultiname(m, index);
}
Binding Verifier::findMathFunction(TraitsBindingsp math, const Multiname& multiname, Binding b, int argc)
{
Stringp newname = core->internString(core->concatStrings(core->kUnderscore, multiname.getName()));
Binding newb = math->findBinding(newname);
if (AvmCore::isMethodBinding(newb))
{
int disp_id = AvmCore::bindingToMethodId(newb);
MethodInfo* newf = math->getMethod(disp_id);
MethodSignaturep newfms = newf->getMethodSignature();
const int param_count = newfms->param_count();
if (argc == param_count)
{
for (int i=state->stackDepth-argc, n=state->stackDepth; i < n; i++)
{
Traits* t = state->stackValue(i).traits;
if (!t || !t->isNumeric())
return b;
}
b = newb;
}
}
return b;
}
Binding Verifier::findStringFunction(TraitsBindingsp str, const Multiname& multiname, Binding b, int argc)
{
Stringp newname = core->internString(core->concatStrings(core->kUnderscore, multiname.getName()));
Binding newb = str->findBinding(newname);
if (AvmCore::isMethodBinding(newb))
{
int disp_id = AvmCore::bindingToMethodId(newb);
MethodInfo* newf = str->getMethod(disp_id);
// We have all required parameters but not more than required.
MethodSignaturep newfms = newf->getMethodSignature();
const int param_count = newfms->param_count();
const int optional_count = newfms->optional_count();
if ((argc >= (param_count - optional_count)) && (argc <= param_count))
{
for (int i=state->stackDepth-argc, k = 1, n=state->stackDepth; i < n; i++, k++)
{
Traits* t = state->stackValue(i).traits;
if (t != newfms->paramTraits(k))
return b;
}
b = newb;
}
}
return b;
}
#ifndef SIZE_T_MAX
# ifdef SIZE_MAX
# define SIZE_T_MAX SIZE_MAX
# else
# define SIZE_T_MAX UINT_MAX
# endif
#endif
void Verifier::parseExceptionHandlers()
{
if (info->abc_exceptions()) {
AvmAssert(tryFrom && tryTo);
return;
}
const uint8_t* pos = code_pos + code_length;
int exception_count = toplevel->readU30(pos); // will be nonnegative and less than 0xC0000000
if (exception_count != 0)
{
if (exception_count == 0 || (size_t)(exception_count-1) > SIZE_T_MAX / sizeof(ExceptionHandler))
verifyFailed(kIllegalExceptionHandlerError);
ExceptionHandlerTable* table = ExceptionHandlerTable::create(core->GetGC(), exception_count);
ExceptionHandler *handler = table->exceptions;
for (int i=0; i < exception_count; i++, handler++)
{
handler->from = toplevel->readU30(pos);
handler->to = toplevel->readU30(pos);
handler->target = toplevel->readU30(pos);
const uint8_t* const scopePosInPool = pos;
int type_index = toplevel->readU30(pos);
Traits* t = type_index ? checkTypeName(type_index) : NULL;
Multiname qn;
int name_index = pool->hasExceptionSupport() ? toplevel->readU30(pos) : 0;
if (name_index != 0)
{
pool->parseMultiname(qn, name_index);
if (!qn.isBinding()) {
// abc docs specify that the name is a string but asc generates QNames.
// Multinames with no namespaces could be supported, but Tamarin currently can't
// handle them in this context.
verifyFailed(kCorruptABCError); // the error code could be more precise
}
}
#ifdef AVMPLUS_VERBOSE
if (verbose)
{
core->console << " exception["<<i<<"] from="<< handler->from
<< " to=" << handler->to
<< " target=" << handler->target
<< " type=" << t
<< " name=";
if (name_index != 0)
core->console << qn;
else
core->console << "(none)";
core->console << "\n";
}
#endif
if (handler->from < 0 ||
handler->to < handler->from ||
handler->target < handler->to ||
handler->target >= code_length)
{
// illegal range in handler record
verifyFailed(kIllegalExceptionHandlerError);
}
// save maximum try range
if (!tryFrom || (code_pos + handler->from) < tryFrom)
tryFrom = code_pos + handler->from;
if (code_pos + handler->to > tryTo)
tryTo = code_pos + handler->to;
// note: since we require (code_len > target >= to >= from >= 0),
// all implicit exception edges are forward edges.
// handler->traits = t
WB(core->GetGC(), table, &handler->traits, t);
Traits* scopeTraits = name_index == 0 ? OBJECT_TYPE :
Traits::newCatchTraits(toplevel, pool, scopePosInPool, qn.getName(), qn.getNamespace());
// handler->scopeTraits = scopeTraits
WB(core->GetGC(), table, &handler->scopeTraits, scopeTraits);
}
info->set_abc_exceptions(core->GetGC(), table);
}
else
{
info->set_abc_exceptions(core->GetGC(), NULL);
}
}
#ifdef AVMPLUS_VERBOSE
void Verifier::printOpcode(const uint8_t* pc, const uint8_t* code_end)
{
int offset = int(pc - code_pos);
core->console << " " << offset << ':';
core->formatOpcode(core->console, pc, code_end, (AbcOpcode)*pc, offset, pool);
core->console << '\n';
}
/**
* display contents of current stack frame only.
*/
void Verifier::printState(StringBuffer& prefix, FrameState *state)
{
PrintWriter& out = core->console;
if (prefix.length() > 0) {
char buf[80]; // plenty for currently known prefixes
VMPI_sprintf(buf, "%-23s[", prefix.c_str());
out << buf;
} else {
out << " [";
}
// locals
int scope_base = ms->scope_base();
for (int i=0, n = scope_base; i < n; i++) {
printValue(state->value(i));
if (i+1 < n)
out << ' ';
}
out << "] {";
// scope chain
for (int i = scope_base, n = scope_base + state->scopeDepth; i < n; i++) {
printValue(state->value(i));
if (i+1 < n)
out << ' ';
}
out << "} (";
// stack
int stackStart;
const int stackLimit = 20; // don't display more than this, to reduce verbosity
if (state->stackDepth > stackLimit) {
stackStart = ms->stack_base() + state->stackDepth - stackLimit;
out << "..." << stackStart << ": ";
} else {
stackStart = ms->stack_base();
}
for (int i = stackStart, n = ms->stack_base() + state->stackDepth; i < n; i++) {
printValue(state->value(i));
if (i+1 < n)
out << ' ';
}
out << ")";
// branch target info
if (state->targetOfBackwardsBranch) out << " B";
if (state->targetOfExceptionBranch) out << " E";
out << "\n";
}
/** display contents of a captured scope chain */
void Verifier::printScope(const char* title, const ScopeTypeChain* scope)
{
PrintWriter& out = core->console;
out << " " << title << " = ";
if (scope && scope->size > 0) {
out << '[';
for (int i=0, n=scope->size; i < n; i++) {
Traits* t = scope->getScopeTraitsAt(i);
if (!t)
out << "*!";
else
out << t;
if (i+1 < n)
out << ' ';
}
out << "]\n";
} else {
out << "null\n";
}
}
void Verifier::printValue(FrameValue& v)
{
Traits* t = v.traits;
PrintWriter& out = core->console;
out << t;
if (!t || (!t->isNumeric() && t != BOOLEAN_TYPE && t != NULL_TYPE && t != VOID_TYPE))
out << (v.notNull ? "~" : "");
#ifdef VMCFG_NANOJIT
if (v.sst_mask) {
out << '[';
if (v.sst_mask & (1 << SST_atom)) out << 'A';
if (v.sst_mask & (1 << SST_string)) out << 'S';
if (v.sst_mask & (1 << SST_namespace)) out << 'N';
if (v.sst_mask & (1 << SST_scriptobject)) out << 'O';
if (v.sst_mask & (1 << SST_int32)) out << 'I';
if (v.sst_mask & (1 << SST_uint32)) out << 'U';
if (v.sst_mask & (1 << SST_bool32)) out << 'B';
if (v.sst_mask & (1 << SST_double)) out << 'D';
#ifdef VMCFG_FLOAT
if (v.sst_mask & (1 << SST_float)) out << 'F';
if (v.sst_mask & (1 << SST_float4)) out << "F4";
#endif
out << ']';
}
#endif
}
#endif /* AVMPLUS_VERBOSE */
}
Reference in new issue View Git Blame Copy Permalink